local

type Options struct {
	// BinPath is the absolute path to the clank-host binary. Empty
	// → resolved via PATH at first EnsureHost.
	BinPath string

	// DataDir is passed to clank-host as --data-dir for its host.db.
	// Empty → clank-host uses its own default ($HOME/.clank-host).
	DataDir string

	// WorkRoot is passed to clank-host as --work-root — the parent for
	// worktrees and repo canonicals. Empty → clank-host uses its own
	// default ($HOME/work, the dedicated-sandbox layout). Laptop
	// deployments set this under the user's clank config dir so the
	// host doesn't drop a work/ directory into their home.
	WorkRoot string

	// ProvisionTimeout caps how long EnsureHost waits for the child
	// to print its bound listen address. Default: 10 seconds.
	ProvisionTimeout time.Duration

	// NotifierWebhookURL, when non-empty, configures the subprocess
	// clank-host to POST agent-lifecycle notifications back to this
	// URL — typically the same clankd that spawned it. Empty disables
	// the notifier (laptop dev without push delivery).
	NotifierWebhookURL string

	// PreviewWebhookURL, when non-empty, configures the subprocess
	// clank-host to POST preview register/revoke webhooks back to
	// this URL on the gateway. Same auth as NotifierWebhookURL (the
	// per-host bearer below). When set without NotifierWebhookURL,
	// the bearer is still generated and passed so the preview
	// webhook can authenticate.
	PreviewWebhookURL string

	// UserID is the identity the local provisioner reports for its
	// single in-memory host record. Must match the `sub` claim the
	// gateway's authenticator extracts from inbound JWTs, otherwise
	// the preview surface's owner-ship check rejects owner_only
	// tokens as cross-tenant. Empty falls back to "local".
	UserID string

	// TunnelInternalConn routes OpenInternalConn through clank-host's
	// /tunnel endpoint (pkg/provisioner/tunnelclient) instead of
	// dialing 127.0.0.1 directly — the same data path machine-style
	// cloud backends use. Off for laptop speed; turn on (e.g. in the
	// docker dev stack) to exercise the production preview path
	// end-to-end without a cloud provider.
	TunnelInternalConn bool

	// Templates is the builtin create-project catalog, forwarded to the
	// subprocess as --templates-json (the builtin half of its GET
	// /templates). Passed as an explicit flag so it beats any
	// CLANK_TEMPLATES the child would inherit from this process's env.
	// Empty passes no flag — clank-host then serves only the user's
	// own GitHub template repos.
	Templates []provisioner.Template
}

type Provisioner struct {
	// contains filtered or unexported fields
}