debugger

type AWSIdentity struct {
	AccessKeyID     string // → AWS_ACCESS_KEY_ID
	SecretAccessKey string // → AWS_SECRET_ACCESS_KEY
	SessionToken    string // → AWS_SESSION_TOKEN (empty for long-lived creds)
	Account         string // local caller identity (arn), for the transparency line (best-effort)
}

type AuthMode int

type ConfigSummary struct {
	Secrets []string // secret names (sorted), values withheld
	Vars    []string // var names (sorted)
	Env     []string // env names (sorted)
}

type DockerUnavailableError struct{ Cause error }

type EnvOverlay struct {
	Secrets map[string]string
	Vars    map[string]string
}

type EnvSummary struct {
	Name    string // the job's `environment:` (deployment environment), "" if none
	Secrets int    // overlay secret keys merged in
	Vars    int    // overlay var keys merged in
}

type EventSummary struct {
	EventName string // the planned event (github.event_name)
	Path      string // user-supplied event JSON path, if any (else synthesized "{}")
	Synthetic bool   // payload was synthesized (no -event-file)
}

type GCPIdentity struct {
	CredentialFile string // host path to the ADC json, bind-mounted ro into the container
	AccessToken    string // ambient ADC access token → CLOUDSDK_AUTH_ACCESS_TOKEN
	Account        string // local identity, for the transparency line (best-effort, may be empty)
}

type GitHubContextSummary struct {
	Repository string   // github.repository (resolved from local git or overridden)
	Ref        string   // github.ref
	Sha        string   // github.sha (short, for display)
	Actor      string   // github.actor ("" → act's "nektos/act" placeholder)
	Overridden []string // which of repository/ref/sha/actor came from a flag
}

type IdentitySummary struct {
	Cloud    string   // "GCP" / "AWS" / "Azure" — names the line
	Mode     AuthMode // how the federated steps were handled
	Steps    []string // intercepted federated auth step labels
	Targets  []string // federation target per federated step (as declared in the workflow)
	Declared []string // secret/key-mode step labels left to run untouched
	Account  string   // the identity we run as (brought principal, or ambient account)
	Region   string   // AWS only: the declared aws-region honored ("" otherwise)
	// Ambient-only detail (Mode == AuthAmbient), for the GCP/AWS ambient line:
	File  bool // an ambient credential file was mounted into the container (GCP)
	Token bool // an ambient access token was injected (GCP)
}

type InputsSummary struct {
	Provided map[string]string // inputs.* the user supplied
	Defaults []string          // declared inputs not supplied (act fills their default)
	Declared bool              // the workflow declares inputs for this event
}

type JobListing struct {
	ID          string
	Name        string
	Environment string   // deployment environment (`environment:`), "" if none
	Matrix      []string // combination labels ("k=v, …") when the job has more than one; nil otherwise
	Steps       []StepListing
}

type Listing struct {
	WorkflowPath string
	Event        string
	Jobs         []JobListing
}

type MultipleJobsError struct{ Jobs []string }

type MultipleMatrixError struct {
	Job    string
	Combos []string // candidate combinations as "k=v, k2=v2" labels, sorted
}

type NeedsInput struct {
	Outputs map[string]string
	Result  string
}

type NeedsSummary struct {
	Job     string
	Live    bool
	Result  string
	Assumed bool
	Outputs map[string]string
}

type Options struct {
	WorkflowPath    string                     // path to the workflow file
	EventName       string                     // event to plan for (default "push")
	JobID           string                     // which job to debug; required only if the event plans more than one
	Matrix          map[string]map[string]bool // matrix combination to pin (act's Config.Matrix shape: key→value→true); required only if the job's matrix has more than one combination
	WithDeps        bool                       // run the job's upstream needs for real (to completion) before debugging it, instead of isolating
	Image           string                     // docker image mapped to ubuntu-latest when Images is empty (default catthehacker); back-compat sugar for Images
	Images          map[string]string          // runner label → docker image (act's -P/Platforms map); empty falls back to {ubuntu-latest: Image}
	Workdir         string                     // workspace bind-mounted into the container so local 'uses: ./' actions resolve; empty = an isolated empty temp dir (steps can't write to your tree). NOTE: a set workdir is mounted, so steps can write to it
	Source          string                     // working tree a default actions/checkout copies into the workspace (no host mutation); empty = current dir. Ignored when Workdir is set
	Secrets         map[string]string          // secrets.* base (flat defaults, e.g. from secret-file); the env overlay and SecretOverrides layer on top
	Vars            map[string]string          // vars.* base (flat defaults); the env overlay and VarOverrides layer on top
	Env             map[string]string          // extra env for containers
	Environments    map[string]EnvOverlay      // per-`environment:` secrets/vars overlays, keyed by environment name; the one matching the debugged job's `environment:` is merged over Secrets/Vars
	SecretOverrides map[string]string          // secrets.* applied last (after the env overlay) so an explicit CLI -secret wins; nil for library callers
	VarOverrides    map[string]string          // vars.* applied last (after the env overlay) so an explicit CLI -var wins; nil for library callers
	// Cloud identity (CLAUDE.md §4). The default is bring-a-credential: a scoped
	// non-personal credential rewrites a federated auth step to its secret/key mode so
	// the real action runs. Ambient personal login is an opt-in fallback (GCP/AWS only;
	// Azure has none) — non-nil GCP/AWS means -…-ambient was set and the creds resolved.
	GCPKeyJSON         string                // service-account key JSON content → rewrites a federated google-github-actions/auth to credentials_json mode
	AzureCredsJSON     string                // service-principal creds JSON content → rewrites a federated azure/login to creds mode
	AWSAccessKeyID     string                // brought static access key id → rewrites a federated aws-actions/configure-aws-credentials to static-key mode
	AWSSecretAccessKey string                // brought static secret access key (paired with AWSAccessKeyID)
	GCP                *GCPIdentity          // ambient GCP creds for the opt-in fallback (nil unless -gcp-ambient)
	AWS                *AWSIdentity          // ambient AWS creds for the opt-in fallback (nil unless -aws-ambient)
	Needs              map[string]NeedsInput // seeded needs.<job>.* for isolated debugging, keyed by upstream job id (ignored with WithDeps)
	BreakOnError       bool                  // in Continue mode, halt after a step that errored
	Breakpoints        []int                 // zero-based step indices to halt before, in Continue mode
	BreakpointNames    []string              // step names to halt before, resolved to indices against the job's steps in New (a name with no matching step is an error)

	// Runtime context GitHub injects in real CI that a clean local runner lacks
	// — all seed-and-be-honest surfaces (CLAUDE.md §4), each with a transparency line.
	GitHubToken string            // GITHUB_TOKEN → github.token (and mirrored into secrets.GITHUB_TOKEN); empty falls back to Secrets["GITHUB_TOKEN"]
	Inputs      map[string]string // workflow_dispatch/workflow_call inputs.* (user values; act applies declared defaults + typing on top)
	EventPath   string            // path to a github.event payload JSON; empty = "{}" (plus any Inputs)
	Repository  string            // override github.repository (env GITHUB_REPOSITORY); empty = act derives from local git
	Ref         string            // override github.ref (env GITHUB_REF); empty = act derives from local git
	Sha         string            // override github.sha (env SHA_REF, act's read key); empty = act derives from local git
	Actor       string            // override github.actor (Config.Actor); empty = act's "nektos/act" placeholder
	// GitHubOverrides names the github.* fields the user set explicitly by flag (any of
	// "repository"/"ref"/"sha"/"actor"), so the transparency line marks those as overrides.
	// The values above may also be filled from local git for an honest display — only an
	// entry here means the user overrode it, not merely that the value is non-empty.
	GitHubOverrides []string
}

type PauseEvent struct {
	When  When        // before or after the step's main executor
	Index int         // zero-based step index within the job
	Step  *model.Step // the step at this boundary
	Err   error       // for When==After: the step's error, or nil
}

type ProgressEvent struct {
	Index int         // zero-based step index now starting
	Step  *model.Step // the step at this boundary
}

type ServicesSummary struct {
	Names []string // service container names (sorted)
}

type Session struct {
	// contains filtered or unexported fields
}

type StepListing struct {
	Index int
	Label string // step display label (name / uses / run)
	Kind  string // run / docker / local / remote / reusable
}

type TokenSummary struct {
	Present bool   // github.token (and secrets.GITHUB_TOKEN) was set
	Source  string // "flag", "secret", or "" when absent
}

type When int