models

type AddCustomDomainRequest struct {
	Hostname   string `json:"hostname"`
	TargetPort int    `json:"target_port,omitempty"`
}

type CreateSandboxRequest struct {
	Image string `json:"image"`
	// ImageDistributionMode classifies whether Image can be pulled on any
	// worker (external_registry/aocr) or is pinned to the local node
	// (local_only). Empty is resolved by the service from snapshot metadata
	// or by the default image distribution provider.
	ImageDistributionMode string     `json:"image_distribution_mode,omitempty"`
	ImageDigest           string     `json:"image_digest,omitempty"`
	ImageRegistryRef      string     `json:"image_registry_ref,omitempty"`
	ImageVerifiedAt       *time.Time `json:"image_verified_at,omitempty"`
	// CPU is the number of CPU cores to allocate. Fractional values are
	// supported (e.g. 0.5 = half a core, 1.5 = one and a half cores).
	// Translates to Docker's CpuQuota at 100ms periods.
	CPU              float64           `json:"cpu"`
	MemoryMB         int               `json:"memory_mb"`
	DiskGB           int               `json:"disk_gb"`
	Env              map[string]string `json:"env"`
	OSUser           string            `json:"os_user"`
	NetworkBlockAll  bool              `json:"network_block_all"`
	Registry         *RegistryAuth     `json:"registry,omitempty"`
	ContainerCommand []string          `json:"container_command,omitempty"`
	Mounts           []MountSpec       `json:"mounts,omitempty"`
	Lifecycle        *Lifecycle        `json:"lifecycle,omitempty"`
	Failover         *Failover         `json:"failover,omitempty"`
	// Name is an optional human-readable identifier. When set, it must be
	// unique across all sandboxes — the store enforces this with a partial
	// unique index. Empty means no name; the sandbox can only be referenced
	// by ID. The Daytona facade requires names; the native /v1 API and other
	// facades may set or omit it.
	Name string `json:"name,omitempty"`
	// Tags is an optional free-form key/value map associated with the
	// sandbox. Used by facades that expose label-style metadata (Daytona
	// labels, E2B metadata).
	Tags map[string]string `json:"tags,omitempty"`
	// Runtime selects the container runtime for this sandbox. Empty falls back
	// to the host default (SB_CONTAINER_RUNTIME). Allowed values: "docker"
	// (standard runc-backed Docker runtime, default), "gvisor" (runsc-backed
	// userspace kernel — use for untrusted workloads), or "kata" (reserved,
	// not yet implemented).
	Runtime string `json:"runtime,omitempty"`
	// GPUs attaches GPU resources to the sandbox. Nil means no GPU. GPU access
	// is not supported with the gVisor runtime — the API returns an error if
	// both GPUs and runtime="gvisor" are set.
	GPUs *GPURequest `json:"gpus,omitempty"`
	// NetworkBytesInLimit caps lifetime ingress bytes for the sandbox. Zero
	// means unlimited. When the cumulative counter crosses the limit, the
	// reconcile loop installs an ingress DROP rule. The "we already paid for
	// the bytes you see in the meter" caveat applies — host-side ingress is
	// counted after the NIC has accepted the packet.
	NetworkBytesInLimit int64 `json:"network_bytes_in_limit,omitempty"`
	// NetworkBytesOutLimit caps lifetime egress bytes. Zero means unlimited.
	// Crossing the limit installs an egress DROP rule via the same primitive
	// NetworkBlockAll uses.
	NetworkBytesOutLimit int64 `json:"network_bytes_out_limit,omitempty"`
	// CustomDomains attaches operator-provided public hostnames to the
	// sandbox at create time. Each hostname must resolve (via DNS) to the
	// cluster's ingress host before HTTPS can serve traffic — see
	// plans/custom-domains.md. Bare strings on the wire; the response shape
	// (Sandbox.CustomDomains) carries per-hostname status. Capped by
	// MaxCustomDomainsPerCreateRequest.
	CustomDomains []string `json:"custom_domains,omitempty"`
	// TemplateID, when set alongside Runtime="firecracker", skips the
	// per-create OCI→ext4 build and reuses a previously prepared
	// rootfs.ext4 from a Firecracker template (POST /v1/templates). The
	// template must be in status="ready" or Create rejects with a
	// not-ready error. Ignored on the Docker path — templates are a
	// Firecracker-only concept (see plans/snapshot-clone-fast-boot.md
	// Phase 2). Pre-snapshot phase: the rootfs is the only artifact a
	// template provides; Phase 3 layers snapshot.memory/state on top.
	TemplateID string `json:"template_id,omitempty"`
	// OverlaySizeGB, when > 0 and Runtime="firecracker", attaches a
	// per-sandbox writable virtio-blk device (drive_id="overlay") of
	// this size at /dev/vdb. On the snapshot-load fast-boot path the
	// device must exist in the template snapshot's virtio-blk state —
	// templates built before Phase 3 PR-B (has_overlay=false) reject
	// this field with an error pointing at POST /v1/templates for a
	// rebuild. The host allocates a sparse file; the guest is
	// responsible for mkfs and mount (or set SB_FIRECRACKER_OVERLAY_MKFS
	// on the daemon to have the host mkfs.ext4 the file at create time).
	// Ignored on the Docker path. Capped at 1024 GiB by request
	// validation; the daemon's admission control may reject smaller.
	OverlaySizeGB int `json:"overlay_size_gb,omitempty"`
}

type CreateSandboxResponse struct {
	Sandbox
	SSHPrivateKey string `json:"ssh_private_key,omitempty"`
}

type CreateSandboxSnapshotRequest struct {
	Name string `json:"name"`
}

type CreateSessionRequest struct {
	// Name is the human-friendly session label. Two callers asking for the
	// same Name see the same session (idempotent attach). Default "default".
	Name    string            `json:"name,omitempty"`
	Argv    []string          `json:"argv,omitempty"`
	Command string            `json:"command,omitempty"`
	WorkDir string            `json:"workdir,omitempty"`
	Env     map[string]string `json:"env,omitempty"`
	PTY     bool              `json:"pty,omitempty"`
	Cols    int               `json:"cols,omitempty"`
	Rows    int               `json:"rows,omitempty"`
}

type CreateTemplateRequest struct {
	ID         string `json:"id,omitempty"`
	Image      string `json:"image"`
	MinSizeMiB int    `json:"min_size_mib,omitempty"`
}

type CustomDomain struct {
	Hostname string             `json:"hostname"`
	Status   CustomDomainStatus `json:"status"`
	// TargetPort is the in-container TCP port traffic for this hostname
	// reverse-proxies to. Zero means "use the toolbox port" (the legacy
	// behavior before per-domain target ports existed). Non-zero values
	// dial straight to the user's app — e.g. an HTTP server on 3333.
	// Set once at attach time; changing it requires detach + re-add so
	// in-flight traffic can't silently redirect.
	TargetPort int       `json:"target_port,omitempty"`
	LastError  string    `json:"last_error,omitempty"`
	CreatedAt  time.Time `json:"created_at"`
	UpdatedAt  time.Time `json:"updated_at"`
}

type CustomDomainDNSRecords struct {
	Records []DNSRecord   `json:"records"`
	Target  IngressTarget `json:"target"`
}

type CustomDomainStatus string

type DNSRecord struct {
	Hostname string `json:"hostname"`
	Type     string `json:"type"`
	Name     string `json:"name"`
	Value    string `json:"value"`
	Notes    string `json:"notes,omitempty"`
}

type ErrorResponse struct {
	Error string `json:"error"`
}

type ExecRequest struct {
	Command        string            `json:"command"`
	WorkDir        string            `json:"workdir,omitempty"`
	Env            map[string]string `json:"env,omitempty"`
	TimeoutSeconds int               `json:"timeout_seconds,omitempty"`
}

type ExecResult struct {
	Stdout     string `json:"stdout"`
	Stderr     string `json:"stderr"`
	ExitCode   int    `json:"exit_code"`
	DurationMS int64  `json:"duration_ms"`
}

type ExposePortRequest struct {
	Protocol string `json:"protocol,omitempty"`
}

type ExposePortResponse struct {
	Protocol  string `json:"protocol"`
	PublicURL string `json:"public_url"`
	Host      string `json:"host,omitempty"`
	HostPort  int    `json:"host_port,omitempty"`
}

type ExposedPort struct {
	SandboxID string `json:"sandbox_id"`
	Port      int    `json:"port"`
	// Protocol is one of "http" (default — Caddy HTTP reverse proxy), "tcp"
	// (caddy-l4 listener bound to HostPort, raw TCP forward to the container),
	// or "tls" (caddy-l4 SNI route on the shared TLS listener). Pre-migration
	// rows carry "http" via the column default.
	Protocol string `json:"protocol"`
	// HostPort is the parent-host TCP listener allocated for protocol="tcp"
	// from the configured pool (default [22000, 23000]). Zero for http/tls
	// modes, which don't reserve a per-exposure host port.
	HostPort  int       `json:"host_port,omitempty"`
	PublicURL string    `json:"public_url"`
	CreatedAt time.Time `json:"created_at"`
}

type Failover struct {
	Policy string `json:"policy,omitempty"`
}

type GPURequest struct {
	// Vendor is required. Allowed values: "nvidia", "amd", "apple".
	Vendor GPUVendor `json:"vendor"`
	// Count is the number of GPUs to allocate. Use -1 to request all GPUs on
	// the host. Zero is treated as 1 (default). Ignored for AMD (all AMD GPUs
	// on the host are exposed via /dev/kfd and /dev/dri).
	Count int `json:"count,omitempty"`
	// DeviceIDs pins the sandbox to specific GPU device indices or UUIDs.
	// For NVIDIA: GPU indices ("0", "1") or UUIDs ("GPU-abc123...").
	// For AMD and Apple: ignored.
	DeviceIDs []string `json:"device_ids,omitempty"`
}

type GPUVendor string

type HealthStatus struct {
	Status          string `json:"status"`
	Sandboxes       int    `json:"sandboxes"`
	Docker          string `json:"docker"`
	Caddy           string `json:"caddy"`
	SSHGateway      string `json:"ssh_gateway"`
	ClusterTopology string `json:"cluster_topology,omitempty"`
	ClusterNodes    int    `json:"cluster_nodes,omitempty"`
	Version         string `json:"version"`
}

type IdempotentRequestRecord struct {
	Scope       string
	Fingerprint string
	TargetID    string
	State       string
	LockedUntil time.Time
	ReplayUntil time.Time
	CreatedAt   time.Time
	UpdatedAt   time.Time
}

type ImageDistributionMetadata struct {
	Mode        string     `json:"mode,omitempty"`
	Digest      string     `json:"digest,omitempty"`
	RegistryRef string     `json:"registry_ref,omitempty"`
	VerifiedAt  *time.Time `json:"verified_at,omitempty"`
}

type IngressTarget struct {
	Hostname string   `json:"hostname,omitempty"`
	IPs      []string `json:"ips,omitempty"`
	Source   string   `json:"source"`
}

type Lifecycle struct {
	StopIfIdleFor    time.Duration `json:"stop_if_idle_for,omitempty"`
	DestroyIfIdleFor time.Duration `json:"destroy_if_idle_for,omitempty"`
	StopAtAge        time.Duration `json:"stop_at_age,omitempty"`
	DestroyAtAge     time.Duration `json:"destroy_at_age,omitempty"`
	// Serverless opts the sandbox into HTTP-wake behavior: stops driven by
	// lifecycle (idle timer / age) or involuntary exits arm the sandbox to
	// be transparently restarted on the next inbound HTTP request. Manual
	// StopSandbox calls clear the arming so the sandbox stays down.
	// Requires StopIfIdleFor to be set explicitly; there is no implicit
	// default — see Validate.
	Serverless bool `json:"serverless,omitempty"`
}

type MountSpec struct {
	Type        MountType         `json:"type"`
	Target      string            `json:"target"`
	Source      string            `json:"source"`
	Options     map[string]string `json:"options,omitempty"`
	Credentials map[string]string `json:"credentials,omitempty"`
	ReadOnly    bool              `json:"read_only,omitempty"`
}

type MountSpecFile struct {
	Mounts []MountSpec `json:"mounts"`
}

type MountSpecRedacted struct {
	Type           MountType         `json:"type"`
	Target         string            `json:"target"`
	Source         string            `json:"source"`
	Options        map[string]string `json:"options,omitempty"`
	ReadOnly       bool              `json:"read_only,omitempty"`
	HasCredentials bool              `json:"has_credentials"`
}

type MountType string

type NetworkUsage struct {
	SandboxID       string     `json:"sandbox_id"`
	BytesIn         int64      `json:"bytes_in"`
	BytesOut        int64      `json:"bytes_out"`
	BytesInLimit    int64      `json:"bytes_in_limit"`
	BytesOutLimit   int64      `json:"bytes_out_limit"`
	QuotaExceeded   bool       `json:"quota_exceeded"`
	QuotaExceededAt *time.Time `json:"quota_exceeded_at,omitempty"`
	// LastSampledAt is omitted until the netstats poller has produced at
	// least one sample. Pointer + omitempty so we don't serialize the zero
	// time as "0001-01-01T00:00:00Z" before the first tick.
	LastSampledAt *time.Time `json:"last_sampled_at,omitempty"`
}

type RegistryAuth struct {
	Server   string `json:"server"`
	Username string `json:"username"`
	Password string `json:"password"`
}

type ResizeSandboxRequest struct {
	CPU      float64 `json:"cpu"`
	MemoryMB int     `json:"memory_mb"`
	DiskGB   int     `json:"disk_gb"`
}

type Sandbox struct {
	ID               string            `json:"id"`
	Image            string            `json:"image"`
	Status           SandboxStatus     `json:"status"`
	PublicURL        string            `json:"public_url"`
	ContainerID      string            `json:"container_id,omitempty"`
	ContainerIP      string            `json:"container_ip,omitempty"`
	CPU              float64           `json:"cpu"`
	MemoryMB         int               `json:"memory_mb"`
	DiskGB           int               `json:"disk_gb"`
	OSUser           string            `json:"os_user"`
	Env              map[string]string `json:"env,omitempty"`
	NetworkBlockAll  bool              `json:"network_block_all"`
	ToolboxEnabled   bool              `json:"toolbox_enabled"`
	ToolboxToken     string            `json:"-"`
	SSHPublicKey     string            `json:"ssh_public_key,omitempty"`
	ExposedPorts     []ExposedPort     `json:"exposed_ports,omitempty"`
	CreatedAt        time.Time         `json:"created_at"`
	UpdatedAt        time.Time         `json:"updated_at"`
	LastActiveAt     time.Time         `json:"last_active_at"`
	LastError        string            `json:"last_error,omitempty"`
	ContainerCommand []string          `json:"container_command,omitempty"`
	Lifecycle        Lifecycle         `json:"lifecycle"`
	Failover         *Failover         `json:"failover,omitempty"`
	// Name is the optional unique identifier set at create time. Empty when
	// the sandbox was created without one (the common path on /v1 today).
	Name string `json:"name,omitempty"`
	// Tags is the optional key/value bag set at create time. Facades use it
	// for label-style metadata (Daytona labels, E2B metadata) but the field
	// is facade-agnostic — anything that wants attribute-tagged sandboxes
	// can write here.
	Tags map[string]string `json:"tags,omitempty"`
	// Runtime is the container runtime this sandbox uses (one of "docker",
	// "gvisor", or "kata"). Pre-migration rows carry "" and resolve to the
	// host default at start time; new sandboxes always store the resolved
	// value so the choice cannot drift across host restarts.
	Runtime string `json:"runtime"`
	// GPUs is the GPU configuration this sandbox was created with. Nil means
	// no GPU was requested.
	GPUs *GPURequest `json:"gpus,omitempty"`
	// RegistryAuthSealed is the AES-GCM-encrypted JSON of the original
	// RegistryAuth supplied at create time, or nil/empty when the sandbox
	// pulled from a public registry. Persisted so cluster failover can hand
	// the credentials back to the new owner's docker pull. Never serialized
	// over the API — it is internal store ↔ service plumbing.
	RegistryAuthSealed []byte `json:"-"`
	// NetworkBytesIn / NetworkBytesOut are cumulative byte counters
	// maintained by the netstats poller. They survive container restarts —
	// a new veth resets in-memory baseline math but the persisted total is
	// preserved.
	NetworkBytesIn  int64 `json:"network_bytes_in"`
	NetworkBytesOut int64 `json:"network_bytes_out"`
	// NetworkBytesInLimit / NetworkBytesOutLimit are the caps the sandbox was
	// created or patched with. Zero = unlimited.
	NetworkBytesInLimit  int64 `json:"network_bytes_in_limit"`
	NetworkBytesOutLimit int64 `json:"network_bytes_out_limit"`
	// NetworkQuotaExceeded reflects whether either lifetime byte counter has
	// crossed its limit. The reconcile loop installs DROP rules when this is
	// true; clearing requires raising the limit (or zeroing it for unlimited).
	NetworkQuotaExceeded bool `json:"network_quota_exceeded"`
	// NetworkQuotaExceededAt is the wall-clock time the limit was first
	// observed crossed. Nil while under quota.
	NetworkQuotaExceededAt *time.Time `json:"network_quota_exceeded_at,omitempty"`
	// AutoImportPending is set by the post-pull auto-import path when the
	// AOCR ImportAPI call failed. A background reconciler walks rows with
	// this flag and re-tries the import; once the import succeeds the flag
	// is cleared and the create spec's ImageDistributionMode flips to
	// `aocr_imported`. The flag is local-node bookkeeping — it is not
	// replicated via Raft, since each owner gets one opportunistic shot
	// at the import per pull.
	AutoImportPending bool `json:"-"`
	// WakeArmed indicates the sandbox is currently in the stopped state
	// because of a lifecycle-driven idle timeout or an involuntary exit
	// while Lifecycle.Serverless was true. Wake-aware control-plane proxies
	// transparently start the sandbox on the next inbound request when this
	// is set. Cleared on manual StopSandbox and after a successful wake.
	// Internal-only bookkeeping; never exposed over the wire.
	WakeArmed bool `json:"-"`
	// CustomDomains carries the per-hostname rows for any operator-attached
	// public hostnames. Status is server-managed (pending_dns → issuing →
	// ready / failed). Nil when the sandbox has no custom domains.
	CustomDomains []CustomDomain `json:"custom_domains,omitempty"`
	// TemplateID records the Firecracker template this sandbox was created
	// from, when one was supplied. Empty for Docker sandboxes and for
	// Firecracker sandboxes built from an ad-hoc Image. The Phase 2 template
	// GC reads this column via IsTemplateReferenced to decide whether a
	// template is still in use; the firecracker driver also reads it on
	// recreate so failover stays on the same rootfs.
	TemplateID string `json:"template_id,omitempty"`
	// OverlaySizeGB is the size of the per-sandbox writable overlay
	// drive (virtio-blk at /dev/vdb), echoed back from the create
	// request so callers can confirm what was provisioned. Zero means
	// no overlay was attached. Persisted because the runtime cleanup
	// path needs to know whether overlay.ext4 was allocated in the
	// per-sandbox runDir.
	OverlaySizeGB int `json:"overlay_size_gb,omitempty"`
	// OwnerRef is the account key this sandbox is attributed to, resolved by
	// the optional fleet control plane from a user token at create time.
	// Empty means operator/PAT-created (the only possibility on the
	// open-source build). Owner scoping uses it to fence user tokens to their
	// own sandboxes; the PAT bypasses scoping. Never exposed over the wire —
	// it is internal attribution, not caller-facing.
	OwnerRef string `json:"-"`
	// FleetSuspended marks a sandbox that was stopped by a fleet standing
	// directive (suspend), as opposed to a user/operator stop. Recovery
	// restarts exactly the sandboxes carrying this marker, then clears it.
	// Internal-only bookkeeping.
	FleetSuspended bool `json:"-"`
}

type SandboxCompatState struct {
	SandboxID string
	Facade    string
	StateJSON string
	CreatedAt time.Time
	UpdatedAt time.Time
}

type SandboxRuntimeState struct {
	SandboxID   string
	ContainerID string
	ContainerIP string
	Status      SandboxStatus
}

type SandboxSnapshot struct {
	Name            string    `json:"name"`
	Image           string    `json:"image"`
	ImageID         string    `json:"image_id,omitempty"`
	SourceSandboxID string    `json:"source_sandbox_id"`
	CreatedAt       time.Time `json:"created_at"`
	// Image distribution metadata is the snapshot-level placement contract.
	// Local-only snapshots may be started only on the node whose Docker image
	// store contains Image; external_registry/aocr snapshots may be placed on
	// any worker that can pull RegistryRef/Image.
	ImageDistributionMode string     `json:"image_distribution_mode,omitempty"`
	ImageDigest           string     `json:"image_digest,omitempty"`
	ImageRegistryRef      string     `json:"image_registry_ref,omitempty"`
	ImageVerifiedAt       *time.Time `json:"image_verified_at,omitempty"`

	// Entrypoint is the optional command override the caller wants the
	// runtime to use when starting a sandbox from this snapshot.
	Entrypoint []string `json:"entrypoint,omitempty"`
	// RegionID echoes the region the caller requested when creating the
	// snapshot. The facade persists this verbatim for read-back; region
	// routing itself is not yet wired through the daemon.
	RegionID string `json:"region_id,omitempty"`
	// CPU / MemoryMB / DiskGB / GPU mirror the resource hints the caller
	// supplied on create — surfaced back to clients that poll the snapshot
	// after creation.
	CPU      float64 `json:"cpu,omitempty"`
	MemoryMB int     `json:"memory_mb,omitempty"`
	DiskGB   int     `json:"disk_gb,omitempty"`
	GPU      float64 `json:"gpu,omitempty"`

	// PushState reflects the AOCR-push lifecycle for this snapshot. See the
	// SnapshotPushState* constants above. When push is disabled (or the image
	// already lives in a remote registry) this is "active" from the moment
	// the row is inserted, matching pre-feature behavior. Otherwise it
	// transitions pending → pushing → active|error, and the cluster placement
	// path treats the snapshot as locally-pinned until it hits "active".
	PushState string `json:"push_state,omitempty"`
	// PushError is populated only when PushState is "error" — the last error
	// the reconciler saw, surfaced to the Daytona facade's errorReason field.
	PushError string `json:"push_error,omitempty"`
}

type SandboxStatus string

type Session struct {
	ID         string        `json:"id"`
	Name       string        `json:"name"`
	Argv       []string      `json:"argv"`
	WorkDir    string        `json:"workdir,omitempty"`
	PTY        bool          `json:"pty"`
	Status     SessionStatus `json:"status"`
	ExitCode   int           `json:"exit_code"`
	ExitSignal string        `json:"exit_signal,omitempty"`
	CreatedAt  time.Time     `json:"created_at"`
	StartedAt  time.Time     `json:"started_at"`
	ExitedAt   time.Time     `json:"exited_at,omitempty"`
	Recording  bool          `json:"recording"`
	Bytes      int64         `json:"bytes"`    // total stdout+stderr bytes produced
	Attached   int           `json:"attached"` // current number of attached clients
}

type SessionList struct {
	Sessions []Session `json:"sessions"`
}

type SessionResizeRequest struct {
	Cols int `json:"cols"`
	Rows int `json:"rows"`
}

type SessionSignalRequest struct {
	Signal string `json:"signal"`
}

type SessionStatus string

type SnapshotAlias struct {
	Alias        string
	SnapshotName string
	Facade       string
	ExtraNames   []string
	CreatedAt    time.Time
	UpdatedAt    time.Time
}

type Template struct {
	ID                 string         `json:"id"`
	Image              string         `json:"image"`
	Status             TemplateStatus `json:"status"`
	RootfsPath         string         `json:"-"`
	RootfsSizeBytes    int64          `json:"rootfs_size_bytes,omitempty"`
	MinSizeMiB         int            `json:"min_size_mib,omitempty"`
	LastError          string         `json:"last_error,omitempty"`
	CreatedAt          time.Time      `json:"created_at"`
	UpdatedAt          time.Time      `json:"updated_at"`
	ReadyAt            *time.Time     `json:"ready_at,omitempty"`
	SnapshotMemoryPath string         `json:"-"`
	SnapshotStatePath  string         `json:"-"`
	SnapshotSizeBytes  int64          `json:"snapshot_size_bytes,omitempty"`
	SnapshotChecksum   string         `json:"-"`
	SnapshotVsockCID   uint32         `json:"-"`
	SnapshotError      string         `json:"snapshot_error,omitempty"`
	HasSnapshot        bool           `json:"has_snapshot"`
	// HasOverlay is the API-facing "this template was built with a
	// per-sandbox overlay drive placeholder baked into its snapshot
	// state" flag. PR-A templates have it false; the snapshot-load path
	// rejects an OverlaySizeGB request against a HasOverlay=false
	// template because Firecracker cannot add a virtio-blk device
	// post-load — only PATCH an existing one's backing path. Operators
	// rebuild the template via POST /v1/templates to upgrade.
	HasOverlay bool `json:"has_overlay"`
	// PushState reflects the AOCR-push lifecycle for this template's
	// artifacts (Phase 6 PR 6-B.1). See the TemplatePushState* constants.
	// When push is disabled (or this is a warm-upgrade row) the value is
	// "active" from the moment the row is inserted, matching pre-feature
	// behaviour. Otherwise it transitions pending → pushing → active|error
	// driven by TemplateArtifactPushReconciler.
	PushState string `json:"push_state,omitempty"`
	// PushError is populated only when PushState is "error" — the last
	// error the reconciler saw, surfaced to operator-facing API responses.
	PushError string `json:"push_error,omitempty"`
	// RegistryRef is the canonical destination ref the push pipeline
	// wrote (`<host>/cluster/<id>/templates/<tid>:latest`). Populated
	// after a successful push; empty until then. Read by consumer-side
	// code in PR 6-B.2 to know where peers can pull the template from.
	RegistryRef string `json:"registry_ref,omitempty"`
	// PushDigest is the manifest digest (`sha256:...`) the registry
	// assigned to the pushed tag, as reported by the Docker push stream's
	// `aux` payload. Empty when the daemon did not surface one — older
	// daemons or registries that don't return a manifest digest leave
	// this blank.
	PushDigest string `json:"push_digest,omitempty"`
}

type TemplateStatus string

type UpdateLifecycleRequest struct {
	Lifecycle
}

type UpdateNetworkLimitsRequest struct {
	NetworkBytesInLimit  *int64 `json:"network_bytes_in_limit,omitempty"`
	NetworkBytesOutLimit *int64 `json:"network_bytes_out_limit,omitempty"`
}