config

type Config struct {
	// CredentialRef is the authoritative <service>/<profile> keyring ref
	// (§1.3). Resolved via credstore.ParseRef; never hard-coded.
	CredentialRef string `yaml:"credential_ref" json:"credential_ref,omitempty"`
	// OAuthClientPath is the absolute path to the OAuth client JSON
	// (deployment material). Stored expanded + absolute; `~` is display-only
	// via ShortenPath. An org may override the default location here.
	OAuthClientPath string `yaml:"oauth_client_path" json:"oauth_client_path,omitempty"`
	// GrantedScopes is preserved: detects when a token's scopes drift from
	// what init granted. Not a secret.
	GrantedScopes []string `yaml:"granted_scopes,omitempty" json:"granted_scopes,omitempty"`
	// Keyring carries the optional §1.4 explicit file-backend opt-in.
	Keyring KeyringConfig `yaml:"keyring,omitempty" json:"-"`
}

type Identity struct {
	// DirName is the config/cache dir name, keyring service segment, and
	// env-var prefix source (e.g. "google-readonly").
	DirName string
	// DefaultRef is the default <service>/<profile> credential ref applied
	// when config.yml is absent or omits credential_ref (e.g.
	// "google-readonly/default"). Callers still resolve it via
	// credstore.ParseRef — the structure is never assumed (§1.3).
	DefaultRef string
	// ProductName is the user-facing command/product name spliced into
	// messages (e.g. "gro" -> "run 'gro init'").
	ProductName string
	// Scopes is the OAuth scope set requested at init and validated for drift.
	Scopes []string
	// ScopeDescriptions maps scope URLs to human-friendly descriptions used by
	// the init wizard and the scope-drift re-auth prompt.
	ScopeDescriptions map[string]string
	// SiblingDirNames lists the DirNames of sibling CLIs whose OAuth client
	// JSON (deployment material, not a secret) this CLI may reuse during init,
	// so a user who has already set up a sibling need not paste it again. E.g.
	// grw lists "google-readonly" so `grw init` can adopt gro's OAuth client.
	SiblingDirNames []string
}

type KeyringConfig struct {
	Backend string `yaml:"backend,omitempty" json:"-"`
}

type SharedRelocation struct {
	Kind       relocKind
	OldPath    string // old hand-rolled config dir; "" on Linux short-circuit
	NewPath    string // statedir-resolved config dir (always set)
	CopyNeeded bool   // relocOldOnly only
}