shared

type AgentBootstrap struct {
	CertPEM   []byte
	KeyPEM    []byte
	CACertPEM []byte
	Assertion string
}

type CommandOpts struct {
	Client         func(context.Context) (*docker.Client, error)
	Config         func() (config.Config, error)
	ProjectManager func() (project.ProjectManager, error)
	HostProxy      func() hostproxy.HostProxyService
	ControlPlane   func() cpboot.Manager
	AdminClient    func(context.Context) (adminv1.AdminServiceClient, error)
	SocketBridge   func() socketbridge.SocketBridgeManager
	Logger         func() (*logger.Logger, error)

	// AgentName is the user-typed short agent name (e.g. "dev", "test").
	// NOT the canonical "clawker.project.agent" form — the canonical name
	// is composed downstream (in MintAgentCert and as the registry row's
	// canonical_cn column) from (Project, AgentName) so it has a single
	// home. New-container start paths MUST set this; without it
	// ContainerStart skips the bootstrap-delivery + registry-write and
	// the entrypoint silently skips clawkerd launch. Existing-container
	// start/restart paths leave it empty by design — those containers'
	// registry rows already exist (the CP-side agent dialer picks up
	// where it left off) or were intentionally never registered.
	AgentName string

	// Project is the clawker project slug the agent runs under, paired
	// with AgentName to form the (project, agent) identity the CP keys
	// agentregistry entries by. Empty string for the 2-segment unscoped
	// naming case — same convention as docker.ContainerName. Must be set
	// whenever AgentName is set on a new-container start path so
	// MintAgentCert composes the right canonical CN.
	Project string
}

type ContainerCreateOptions struct {
	// Naming
	Agent string // Agent name for clawker naming (clawker.<project>.<agent>)
	Name  string // Same as agent, for Docker CLI familiarity

	// Container configuration
	Env             []string // Environment variables
	EnvFile         []string // Read env vars from file(s)
	Volumes         []string // Bind mounts
	Publish         *PortOpts
	Workdir         string     // Working directory
	User            string     // User
	Entrypoint      string     // Override entrypoint
	TTY             bool       // Allocate TTY
	Stdin           bool       // Keep STDIN open
	Attach          *ListOpts  // Attach to STDIN, STDOUT, STDERR
	NetMode         NetworkOpt // Network connection (supports advanced syntax)
	Labels          []string   // Additional labels
	LabelsFile      []string   // Read labels from file(s)
	AutoRemove      bool       // Auto-remove on exit
	Domainname      string     // Container NIS domain name
	ContainerIDFile string     // Write container ID to file
	GroupAdd        []string   // Additional groups

	// Resource limits
	Memory            docker.MemBytes           // Memory limit (e.g., "512m", "2g")
	MemorySwap        docker.MemSwapBytes       // Total memory (memory + swap), -1 for unlimited
	MemoryReservation docker.MemBytes           // Memory soft limit
	ShmSize           docker.MemBytes           // Size of /dev/shm
	CPUs              docker.NanoCPUs           // Number of CPUs (e.g., "1.5", "0.5")
	CPUShares         int64                     // CPU shares (relative weight)
	CPUSetCPUs        string                    // CPUs to allow (0-3, 0,1)
	CPUSetMems        string                    // MEMs to allow (0-3, 0,1)
	CPUPeriod         int64                     // CFS period
	CPUQuota          int64                     // CFS quota
	CPURtPeriod       int64                     // Realtime period
	CPURtRuntime      int64                     // Realtime runtime
	BlkioWeight       uint16                    // Block IO weight (10-1000)
	BlkioWeightDevice *docker.WeightDeviceOpt   // Per-device block IO weight
	DeviceReadBps     *docker.ThrottleDeviceOpt // Read rate limit (bytes/sec)
	DeviceWriteBps    *docker.ThrottleDeviceOpt // Write rate limit (bytes/sec)
	DeviceReadIOps    *docker.ThrottleDeviceOpt // Read rate limit (IO/sec)
	DeviceWriteIOps   *docker.ThrottleDeviceOpt // Write rate limit (IO/sec)
	PidsLimit         int64                     // Process limit (-1 unlimited)
	OOMKillDisable    bool                      // Disable OOM Killer
	OOMScoreAdj       int                       // OOM preferences (-1000 to 1000)
	Swappiness        int64                     // Memory swappiness (0-100, -1 for default)
	CPUCount          int64                     // CPU count (Windows only)
	CPUPercent        int64                     // CPU percent (Windows only)
	IOMaxBandwidth    docker.MemBytes           // Max IO bandwidth (Windows only)
	IOMaxIOps         uint64                    // Max IOps (Windows only)

	// Networking
	Hostname     string   // Container hostname
	DNS          []string // Custom DNS servers
	DNSSearch    []string // Custom DNS search domains
	DNSOptions   []string // DNS options
	ExtraHosts   []string // Extra hosts (host:IP mapping)
	Expose       []string // Expose port(s) without publishing
	PublishAll   bool     // Publish all exposed ports
	MacAddress   string   // Container MAC address
	IPv4Address  string   // IPv4 address
	IPv6Address  string   // IPv6 address
	Links        []string // Add link to another container
	Aliases      []string // Network-scoped aliases
	LinkLocalIPs []string // Link-local addresses

	// Storage
	Tmpfs        []string         // Tmpfs mounts (path or path:options)
	ReadOnly     bool             // Mount root filesystem as read-only
	VolumesFrom  []string         // Mount volumes from another container
	VolumeDriver string           // Volume driver
	StorageOpt   []string         // Storage driver options
	Mounts       *docker.MountOpt // Advanced mount specifications

	// Devices
	Devices           *docker.DeviceOpt // Host devices to add
	GPUs              *docker.GpuOpts   // GPU devices
	DeviceCgroupRules []string          // Device cgroup rules

	// Security
	CapAdd          []string // Add Linux capabilities
	CapDrop         []string // Drop Linux capabilities
	Privileged      bool     // Give extended privileges to container
	SecurityOpt     []string // Security options (e.g., seccomp, apparmor, label)
	DisableFirewall bool     // DEPRECATED: no-op, use "clawker firewall bypass" instead

	// Health check
	HealthCmd           string        // Command to run to check health
	HealthInterval      time.Duration // Time between health checks
	HealthTimeout       time.Duration // Maximum time to allow health check to run
	HealthRetries       int           // Consecutive failures needed to report unhealthy
	HealthStartPeriod   time.Duration // Start period for the container to initialize
	HealthStartInterval time.Duration // Check interval during start period
	NoHealthcheck       bool          // Disable any container-specified HEALTHCHECK

	// Process and runtime
	Restart     string // Restart policy (no, always, on-failure[:max-retries], unless-stopped)
	StopSignal  string // Signal to stop the container (e.g., SIGTERM)
	StopTimeout int    // Timeout (in seconds) to stop a container
	Init        bool   // Run init inside the container

	// Namespace/Runtime
	PidMode      string // PID namespace
	IpcMode      string // IPC namespace
	UtsMode      string // UTS namespace
	UsernsMode   string // User namespace
	CgroupnsMode string // Cgroup namespace
	CgroupParent string // Parent cgroup
	Runtime      string // OCI runtime
	Isolation    string // Container isolation

	// Logging
	LogDriver string   // Logging driver
	LogOpts   []string // Log driver options

	// Resource limits (ulimits)
	Ulimits *docker.UlimitOpt // Ulimit options

	// Annotations and kernel parameters
	Annotations *MapOpts // OCI annotations
	Sysctls     *MapOpts // Kernel parameters

	// Workspace configuration
	Mode     string // "bind" or "snapshot" (empty = use config default)
	Worktree string // Git worktree: "" (none), "branch", or "branch:base"

	// Internal (set after parsing positional args)
	Image   string
	Command []string
}

type CopyFromContainerFn func(ctx context.Context, containerID, srcPath string) (io.ReadCloser, error)

type CopyToContainerFn func(ctx context.Context, containerID, destPath string, content io.Reader) error

type CopyToVolumeFn func(ctx context.Context, volumeName, srcDir, destPath string, ignorePatterns []string) error

type CreateContainerEvent struct {
	Step    string      // "workspace", "config", "environment", "container"
	Status  StepStatus  // Step lifecycle state
	Message string      // User-facing text
	Type    MessageType // Info or Warning
}

type CreateContainerOptions struct {
	Client         *docker.Client
	Config         config.Config
	ProjectName    string
	Options        *ContainerCreateOptions
	Flags          *pflag.FlagSet
	Version        string
	ProjectManager func() (project.ProjectManager, error)
	HostProxy      func() hostproxy.HostProxyService
	Log            *logger.Logger
	Is256Color     bool
	IsTrueColor    bool
}

type CreateContainerResult struct {
	ContainerID      string
	AgentName        string
	ContainerName    string
	WorkDir          string
	HostProxyRunning bool
}

type InitConfigOpts struct {
	// ProjectName is the project name for volume naming.
	ProjectName string
	// AgentName is the agent name for volume naming.
	AgentName string
	// ContainerWorkDir is the workspace directory inside the container (e.g. "/Users/dev/my-app").
	// Used to rewrite projectPath values in installed_plugins.json.
	ContainerWorkDir string
	// ClaudeCode is the claude code configuration. Nil uses defaults (copy strategy + host auth).
	ClaudeCode *config.ClaudeCodeConfig
	// CopyToVolume copies a directory to a Docker volume.
	// In production, wire this to (*docker.Client).CopyToVolume.
	CopyToVolume CopyToVolumeFn
	// Log is the logger for diagnostic file logging.
	Log *logger.Logger
}

type InjectPostInitOpts struct {
	// ContainerID is the Docker container ID to inject the script into.
	ContainerID string
	// Script is the user's post_init content from .clawker.yaml.
	Script string
	// Cfg provides config constants for containerfs.
	Cfg config.Config
	// CopyToContainer copies a tar archive to the container at the given destination path.
	// In production, wire this to a function that calls (*docker.Client).CopyToContainer.
	CopyToContainer CopyToContainerFn
	// Log is the logger for diagnostic file logging.
	Log *logger.Logger
}

type InstallAgentBootstrapOptions struct {
	// Project + Agent are the typed (project, agent_name) identity
	// validated upstream at the CLI flag boundary. Used to compose the
	// canonical CN in the leaf cert.
	Project auth.ProjectSlug
	Agent   auth.AgentName
	// ContainerID is the ID returned by client.ContainerCreate. Embedded
	// as a URI SAN in the leaf cert and read by the CP-side Register
	// handler at handler entry.
	ContainerID string
	// HydraTokenAudience is the `aud` claim in the Hydra
	// client_assertion. Resolved by callers via
	// hydraTokenAudienceFromPort(cfg.Settings().ControlPlane.HydraPublicPort).
	HydraTokenAudience string
	// CopyToContainer streams the bootstrap tar into ContainerID's
	// writable layer at consts.BootstrapDir.
	CopyToContainer CopyToContainerFn
	// Logger receives a single info line on success. Required.
	Logger *logger.Logger
}

type ListOpts struct {
	// contains filtered or unexported fields
}

type MapOpts struct {
	// contains filtered or unexported fields
}

type MessageType int

type NetworkAttachmentOpts struct {
	Target       string
	Aliases      []string
	DriverOpts   map[string]string
	Links        []string
	IPv4Address  netip.Addr
	IPv6Address  netip.Addr
	MacAddress   string
	LinkLocalIPs []netip.Addr
	GwPriority   int
}

type NetworkOpt struct {
	// contains filtered or unexported fields
}

type PortOpts struct {
	// contains filtered or unexported fields
}

type RebuildMissingImageOpts struct {
	ImageRef    string
	IOStreams   *iostreams.IOStreams
	TUI         *tui.TUI
	Prompter    func() *prompter.Prompter
	BuildImage  docker.BuildDefaultImageFn
	CommandVerb string // "run" or "create" for error messages
}

type StepStatus int