cmd

type AccessExplainBackendAuthAssumption struct {
	Proven           bool     `json:"proven"`
	Summary          string   `json:"summary"`
	OutsideTSLink    bool     `json:"outside_tslink"`
	OutOfScopeLayers []string `json:"out_of_scope_layers"`
}

type AccessExplainExternalPolicyUnknown struct {
	Known         bool     `json:"known"`
	Summary       string   `json:"summary"`
	UnknownLayers []string `json:"unknown_layers"`
}

type AccessExplainKnown struct {
	PreserveHost                 bool                              `json:"preserve_host"`
	ServiceType                  string                            `json:"service_type"`
	Endpoint                     inspect.EndpointView              `json:"endpoint"`
	Exposure                     inspect.ExposureView              `json:"exposure"`
	Tags                         inspect.SummaryView               `json:"tags"`
	Allow                        inspect.SummaryView               `json:"allow"`
	Backend                      inspect.BackendView               `json:"backend"`
	Warnings                     []inspect.WarningView             `json:"warnings,omitempty"`
	TargetLoopbackClassification AccessExplainTargetClassification `json:"target_loopback_classification"`
}

type AccessExplainLocalEnforcement struct {
	Kind           string                      `json:"kind"`
	Applies        bool                        `json:"applies"`
	Summary        string                      `json:"summary"`
	AllowList      inspect.SummaryView         `json:"allow_list"`
	FailureMode    string                      `json:"failure_mode,omitempty"`
	PublicExposure AccessExplainPublicExposure `json:"public_exposure"`
	Notes          []string                    `json:"notes"`
	People         *AccessExplainPeople        `json:"people,omitempty"`
}

type AccessExplainPeople struct {
	Scoped         bool   `json:"scoped"`
	KnownLogins    int    `json:"known_logins"`
	Grants         int    `json:"grants"`
	Tombstones     int    `json:"tombstones"`
	DetailsCommand string `json:"details_command"`
}

type AccessExplainPublicExposure struct {
	Public  bool   `json:"public"`
	Summary string `json:"summary"`
}

type AccessExplainResult struct {
	Reasons                []accesslog.Count                  `json:"reasons,omitempty"`
	ReasonsUnavailable     bool                               `json:"reasons_unavailable,omitempty"`
	SchemaVersion          int                                `json:"schema_version"`
	Service                string                             `json:"service"`
	Summary                string                             `json:"summary"`
	TSLinkKnown            AccessExplainKnown                 `json:"tslink_known"`
	TSLinkLocalEnforcement AccessExplainLocalEnforcement      `json:"tslink_local_enforcement"`
	ExternalPolicyUnknown  AccessExplainExternalPolicyUnknown `json:"external_policy_unknown"`
	BackendAuthAssumption  AccessExplainBackendAuthAssumption `json:"backend_auth_assumption"`
}

type AccessExplainTargetClassification struct {
	AppliesTo      string `json:"applies_to"`
	Meaningful     bool   `json:"meaningful"`
	Classification string `json:"classification"`
	Host           string `json:"host,omitempty"`
	Port           string `json:"port,omitempty"`
	Summary        string `json:"summary"`
}

type AddDryRunResult struct {
	DryRun  bool             `json:"dry_run"`
	Service registry.Service `json:"service"`
}

type AddParams struct {
	AccessTool      string
	For             *string
	Until           *string
	AckNever        bool
	PrintLinks      bool
	ExplicitFields  map[string]bool
	Remote          string
	PortalOnly      bool
	PortalPort      int
	Health          *registry.HealthConfig
	RequestLimits   *registry.RequestLimits
	Name            string
	Proxy           string
	PreserveHost    bool
	Requestable     bool
	Dir             string
	TCP             string
	Ephemeral       bool
	Tags            string
	Allow           string
	Funnel          bool
	FunnelTTL       string
	FunnelTTLSet    bool
	Now             time.Time
	Public          bool
	NoAutoProvision bool
	NoDaemonInstall bool
	ControlURL      string
}

type AddResult struct {
	Access        []PeopleResult                   `json:"access,omitempty"`
	RequestLimits *registry.EffectiveRequestLimits `json:"request_limits,omitempty"`
	Name          string                           `json:"name"`
	Type          string                           `json:"type"`
	Created       bool                             `json:"created"`
	PreserveHost  bool                             `json:"preserve_host"`
	Requestable   bool                             `json:"requestable"`
	// ReplacedFields names the registry.json fields an add of an existing
	// service changed or dropped; empty when the add created the service.
	ReplacedFields  fieldList             `json:"replaced_fields"`
	FunnelExpiresAt *time.Time            `json:"funnel_expires_at,omitempty"`
	FunnelRearmed   bool                  `json:"funnel_rearmed"`
	URL             *string               `json:"url"`
	URLPending      bool                  `json:"url_pending"`
	Endpoint        inspect.EndpointView  `json:"endpoint"`
	Exposure        inspect.ExposureView  `json:"exposure"`
	Warnings        []inspect.WarningView `json:"warnings,omitempty"`
	DaemonRunning   bool                  `json:"daemon_running"`
	AuthURL         string                `json:"auth_url,omitempty"`
	Next            []string              `json:"next,omitempty"`
}

type CLIManifest struct {
	SchemaVersion         int                             `json:"schema_version"`
	Platform              PlatformInfo                    `json:"platform"`
	SupportedPlatforms    []string                        `json:"supported_platforms"`
	RegistrySchemaVersion int                             `json:"registry_schema_version"`
	Toolchain             ToolchainInfo                   `json:"toolchain"`
	ExitCodes             map[string]int                  `json:"exit_codes"`
	RegistrySchema        RegistrySchemaInfo              `json:"registry_schema"`
	CredentialSources     CredentialSources               `json:"credential_sources"`
	HighRiskOperations    []HighRiskOperation             `json:"high_risk_operations"`
	RemoteSideEffectPlans []security.RemoteSideEffectPlan `json:"remote_side_effect_plans"`
	Commands              []CommandInfo                   `json:"commands"`
	Capabilities          security.CapabilityManifest     `json:"capabilities"`
	ErrorCodes            map[string]ErrorCodeInfo        `json:"error_codes"`
}

type CommandInfo struct {
	Path             string                         `json:"path"`
	Short            string                         `json:"short"`
	Flags            []FlagInfo                     `json:"flags,omitempty"`
	JSONResultFields map[string]JSONResultFieldInfo `json:"json_result_fields,omitempty"`
}

type CompactCLIManifest struct {
	SchemaVersion int                 `json:"schema_version"`
	Platform      PlatformInfo        `json:"platform"`
	Flags         []string            `json:"flags"`
	Commands      map[string][]string `json:"commands"`
	ErrorCodes    map[string]int      `json:"error_codes"`
}

type ConfigGetResult struct {
	Key   string `json:"key"`
	Value string `json:"value"`
	IsSet bool   `json:"is_set"`
}

type ConfigItem struct {
	Key   string `json:"key"`
	Value string `json:"value"`
	IsSet bool   `json:"is_set"`
}

type ConfigListResult struct {
	Items []ConfigItem `json:"items"`
}

type ConfigSetResult struct {
	Key     string `json:"key"`
	Value   string `json:"value"`
	Cleared bool   `json:"cleared"`
}

type CredentialSource struct {
	ID          string   `json:"id"`
	Command     string   `json:"command,omitempty"`
	Flags       []string `json:"flags,omitempty"`
	Environment []string `json:"environment,omitempty"`
	Boundary    string   `json:"boundary"`
}

type CredentialSources struct {
	Recommended []CredentialSource `json:"recommended"`
	Automation  []CredentialSource `json:"automation"`
	Avoid       []CredentialSource `json:"avoid"`
	Storage     []CredentialSource `json:"storage"`
}

type DaemonInstalled struct {
	Manager string `json:"manager"`
	Path    string `json:"path"`
	Undo    string `json:"undo"`
}

type DoctorCounts struct {
	Services int `json:"services"`
	Findings int `json:"findings"`
	Info     int `json:"info"`
	Warnings int `json:"warnings"`
	Errors   int `json:"errors"`
	Critical int `json:"critical"`
}

type DoctorDaemon struct {
	IdentityUnverified bool `json:"identity_unverified,omitempty"`
	Running            bool `json:"running"`
	PID                int  `json:"pid,omitempty"`
	// BuildVersion, Executable, and BuildSkew are reporting-only: they never
	// factor into IdentityUnverified, Running, or health_status/exit code
	// beyond the daemon_build_skew warning itself. See
	// diagnoseDaemonBuildSkew and daemon.ProcessBuildIdentity.
	BuildVersion string `json:"build_version,omitempty"`
	Executable   string `json:"executable,omitempty"`
	BuildSkew    bool   `json:"build_skew,omitempty"`
}

type DoctorFinding struct {
	Code     string            `json:"code"`
	Severity string            `json:"severity"`
	Area     string            `json:"area"`
	Message  string            `json:"message"`
	Service  string            `json:"service,omitempty"`
	Evidence map[string]string `json:"evidence,omitempty"`
}

type DoctorPaths struct {
	ConfigDir       string `json:"config_dir,omitempty"`
	Registry        string `json:"registry,omitempty"`
	RuntimeSnapshot string `json:"runtime_snapshot,omitempty"`
	AuthHandoff     string `json:"auth_handoff,omitempty"`
	PID             string `json:"pid,omitempty"`
}

type DoctorResult struct {
	AccessLog  accesslog.Health      `json:"access_log"`
	Portal     tsruntime.PortalState `json:"portal"`
	GuestLinks []registry.GuestView  `json:"guest_links"`

	NodeKeys        map[string]health.Expiry    `json:"node_keys"`
	Credentials     StatusCredentials           `json:"credentials"`
	Alerts          health.AlertsView           `json:"alerts"`
	Supervision     Supervision                 `json:"supervision"`
	SchemaVersion   int                         `json:"schema_version"`
	ExecutionStatus string                      `json:"execution_status"`
	Status          string                      `json:"status"`
	HealthStatus    string                      `json:"health_status"`
	HealthExitCode  int                         `json:"health_exit_code"`
	Counts          DoctorCounts                `json:"counts"`
	Paths           DoctorPaths                 `json:"paths"`
	CredentialMode  string                      `json:"credential_mode"`
	CredentialTier  string                      `json:"credential_tier"`
	Daemon          DoctorDaemon                `json:"daemon"`
	RuntimeSnapshot StatusRuntimeSnapshotResult `json:"runtime_snapshot"`
	TailscaleSSH    DoctorTailscaleSSH          `json:"tailscale_ssh"`
	Findings        []DoctorFinding             `json:"findings"`
	// contains filtered or unexported fields
}

type DoctorTailscaleSSH struct {
	State string `json:"state"`
	// ACLRuleRequired records the second half of the requirement, which no
	// local read can observe. `tailscale set --ssh` alone is not enough; the
	// tailnet policy file also needs an ssh rule admitting the caller.
	ACLRuleRequired bool `json:"acl_rule_required"`
}

type ErrorCodeInfo struct {
	ExitCode    int    `json:"exit_code"`
	Description string `json:"description"`
}

type FlagInfo struct {
	Name      string   `json:"name"`
	Shorthand string   `json:"shorthand,omitempty"`
	Type      string   `json:"type"`
	Default   string   `json:"default,omitempty"`
	Scope     string   `json:"scope,omitempty"`
	Usage     string   `json:"usage"`
	OneOf     []string `json:"one_of,omitempty"`
	Requires  []string `json:"requires,omitempty"`
	Conflicts []string `json:"conflicts,omitempty"`
	Platforms []string `json:"platforms,omitempty"`
}

type HealthSetResult struct {
	App  string `json:"app"`
	Type string `json:"type"`
	// Changed is false when the stored settings already matched; nothing was written.
	Changed bool `json:"changed"`
	// Defaults is true when the service stores no health settings.
	Defaults bool               `json:"defaults"`
	Health   HealthSettingsView `json:"health"`
}

type HealthSettingsView struct {
	Path      string `json:"path,omitempty"`
	StatusMin int    `json:"status_min,omitempty"`
	StatusMax int    `json:"status_max,omitempty"`
	BodyCheck bool   `json:"body_check,omitempty"`
	Timeout   string `json:"timeout"`
	Interval  string `json:"interval"`
}

type HighRiskOperation struct {
	Command       string   `json:"command"`
	Operation     string   `json:"operation"`
	Default       string   `json:"default"`
	RequiredFlags []string `json:"required_flags"`
	Boundary      string   `json:"boundary"`
}

type InstallResult struct {
	Path           string `json:"path"`
	Installed      bool   `json:"installed"`
	Started        bool   `json:"started"`
	ServiceManager string `json:"service_manager"`
	Warning        string `json:"warning,omitempty"`
}

type InviteMutationResult struct {
	tailapi.Invite
	RemoteSideEffectPlan security.RemoteSideEffectPlan `json:"remote_side_effect_plan"`
}

type InviteResendResult struct {
	Kind                 string                        `json:"kind"`
	ID                   string                        `json:"id"`
	Recipient            string                        `json:"recipient,omitempty"`
	Email                string                        `json:"email"`
	Emailed              bool                          `json:"emailed"`
	Service              string                        `json:"service,omitempty"`
	RemoteSideEffectPlan security.RemoteSideEffectPlan `json:"remote_side_effect_plan"`
}

type InviteRevokeResult struct {
	Kind                 string                        `json:"kind"`
	ID                   string                        `json:"id"`
	Service              string                        `json:"service,omitempty"`
	Revoked              bool                          `json:"revoked"`
	RemoteSideEffectPlan security.RemoteSideEffectPlan `json:"remote_side_effect_plan"`
}

type JSONResultFieldInfo struct {
	Type        string   `json:"type"`
	Description string   `json:"description"`
	Values      []string `json:"values,omitempty"`
	Platforms   []string `json:"platforms,omitempty"`
}

type ListResult struct {
	Portal        tsruntime.PortalState `json:"portal"`
	SchemaVersion int                   `json:"schema_version"`
	Services      any                   `json:"services"`
	Count         int                   `json:"count"`
}

type ListServiceSummary struct {
	RequestLimits   *registry.EffectiveRequestLimits `json:"request_limits,omitempty"`
	Warnings        []inspect.WarningView            `json:"warnings,omitempty"`
	Health          health.State                     `json:"health"`
	NodeKey         health.Expiry                    `json:"node_key"`
	Name            string                           `json:"name"`
	Type            string                           `json:"type"`
	URL             *string                          `json:"url"`
	URLPending      bool                             `json:"url_pending"`
	State           string                           `json:"state"`
	PreserveHost    bool                             `json:"preserve_host"`
	FunnelRequested bool                             `json:"funnel_requested"`
	FunnelActive    bool                             `json:"funnel_active"`
	FunnelState     string                           `json:"funnel_state"`
	FunnelExpiresAt *time.Time                       `json:"funnel_expires_at,omitempty"`
	FunnelRemaining *string                          `json:"funnel_remaining,omitempty"`
	Error           *tsruntime.ServiceError          `json:"error,omitempty"`
}

type LoginBootstrapResult struct {
	Page   string   `json:"page"`
	URL    string   `json:"url"`
	Opened bool     `json:"opened"`
	Next   []string `json:"next"`
}

type LoginResult struct {
	Method               string                         `json:"method"`
	CredentialBackend    credentials.CredentialBackend  `json:"credential_backend"`
	CredentialKind       string                         `json:"credential_kind"`
	Fingerprint          string                         `json:"fingerprint"`
	StoredAt             *time.Time                     `json:"stored_at,omitempty"`
	ExpiresAt            *time.Time                     `json:"expires_at,omitempty"`
	ExpiresAtSource      string                         `json:"expires_at_source,omitempty"`
	Rotated              bool                           `json:"rotated"`
	PreviousFingerprint  string                         `json:"previous_fingerprint,omitempty"`
	RetiredCredential    string                         `json:"retired_credential,omitempty"`
	LoginName            string                         `json:"login_name,omitempty"`
	TagCreated           string                         `json:"tag_created,omitempty"`
	Degraded             bool                           `json:"degraded"`
	TagEnsureError       string                         `json:"tag_ensure_error,omitempty"`
	ACLMutationSkipped   bool                           `json:"acl_mutation_skipped"`
	RemoteSideEffectPlan *security.RemoteSideEffectPlan `json:"remote_side_effect_plan,omitempty"`
}

type LogoutResult struct {
	WasLoggedIn bool `json:"was_logged_in"`
	// Kind is the selected credential slot for a selective logout; empty for
	// the full logout.
	Kind string `json:"kind,omitempty"`
	// DeletedCredentials lists the credential slots removed by this invocation.
	DeletedCredentials []string `json:"deleted_credentials"`
}

type LogsResult struct {
	Lines []string `json:"lines"`
	Count int      `json:"count"`
	File  string   `json:"file"`
}

type MCPLogsResult struct {
	Source string `json:"source"`
	File   string `json:"file"`
	Level  string `json:"level,omitempty"`
	// Since is the requested window as a duration; SinceAt is the resulting
	// absolute cutoff, so a caller never has to recompute it against a clock
	// that may not be the daemon's.
	Since   string    `json:"since"`
	SinceAt time.Time `json:"since_at"`
	Lines   []string  `json:"lines"`
	Count   int       `json:"count"`
	// Truncated says the answer is not the whole of what matched, and
	// TruncatedReason says which bound cut it. Both are always present rather
	// than omitted when false: a client must be able to distinguish "complete"
	// from "this field was not populated".
	Truncated       bool   `json:"truncated"`
	TruncatedReason string `json:"truncated_reason,omitempty"`
	// Matched is how many lines passed the level and time filters before any
	// bound was applied, so a caller can tell a quiet window from a truncated
	// one and decide whether to narrow the query.
	Matched int `json:"matched"`
	// Redacted is constant true. It is emitted so a consumer of these lines
	// knows they are not byte-identical to the file on disk, and does not treat
	// a "[redacted]" token as something the daemon logged.
	Redacted bool `json:"redacted"`
}

type PeopleAppAccess struct {
	App         string `json:"app"`
	AccessState string `json:"access_state"`
	URL         string `json:"url,omitempty"`
	Message     string `json:"message"`
}

type PeopleGrantView struct {
	registry.PersonGrant
	Active bool   `json:"active"`
	URL    string `json:"url,omitempty"`
}

type PeopleInviteView struct {
	TargetKind           string                         `json:"target_kind,omitempty"`
	App                  string                         `json:"app"`
	ID                   string                         `json:"id,omitempty"`
	InviteURL            string                         `json:"invite_url,omitempty"`
	Code                 string                         `json:"code,omitempty"`
	RemoteSideEffectPlan *security.RemoteSideEffectPlan `json:"remote_side_effect_plan,omitempty"`
	State                string                         `json:"state,omitempty"`
	ReconcileIDs         []string                       `json:"reconcile_ids,omitempty"`
}

type PeopleListResult struct {
	People []PeopleView `json:"people"`
}

type PeopleRemoveResult struct {
	Login    string             `json:"login"`
	Removed  bool               `json:"removed"`
	Revoked  bool               `json:"revoked"`
	Complete bool               `json:"complete"`
	Cleanup  []PeopleInviteView `json:"cleanup"`
}

type PeopleResult struct {
	Access            []PeopleAppAccess     `json:"access"`
	Membership        tailapi.Membership    `json:"membership,omitempty"`
	Person            PeopleView            `json:"person"`
	Invites           []PeopleInviteView    `json:"invites"`
	Complete          bool                  `json:"complete"`
	Portal            tsruntime.PortalState `json:"portal"`
	Message           string                `json:"message"`
	InviteRequirement string                `json:"invite_requirement"`
	QRPayload         string                `json:"qr_payload,omitempty"`
	QRTerminal        bool                  `json:"-"`
	QRWarning         string                `json:"qr_warning,omitempty"`
	Warnings          []string              `json:"warnings,omitempty"`
	Guide             []string              `json:"guide"`
	GuideZH           []string              `json:"guide_zh"`
}

type PeopleView struct {
	Login   string                  `json:"login"`
	Revoked bool                    `json:"revoked"`
	Grants  []PeopleGrantView       `json:"grants"`
	Invites []registry.PersonInvite `json:"invites,omitempty"`
}

type PlatformInfo struct {
	GOOS   string `json:"goos"`
	GOARCH string `json:"goarch"`
}

type RecipeResult struct {
	SchemaVersion  int                 `json:"schema_version"`
	CatalogVersion int                 `json:"catalog_version"`
	Recipe         recipes.Recipe      `json:"recipe"`
	Service        inspect.ServiceView `json:"service"`
	Requested      inspect.ServiceView `json:"requested"`
	Action         string              `json:"action"`
	DryRun         bool                `json:"dry_run"`
	Applied        bool                `json:"applied"`
	Warnings       []string            `json:"warnings"`
	Next           []string            `json:"next"`
}

type RegistryCheckIssue struct {
	Index   int    `json:"index"`
	Name    string `json:"name"`
	Code    string `json:"code"`
	Message string `json:"message"`
}

type RegistryCheckResult struct {
	Path          string               `json:"path"`
	SchemaVersion int                  `json:"schema_version"`
	ValidServices int                  `json:"valid_services"`
	TotalServices int                  `json:"total_services"`
	Issues        []RegistryCheckIssue `json:"issues"`
}

type RegistrySchemaInfo struct {
	Version        int      `json:"version"`
	ServiceTypes   []string `json:"service_types"`
	RequiredFields []string `json:"required_fields"`
}

type RemoveResult struct {
	Name                 string `json:"name"`
	Removed              bool   `json:"removed"`
	DeviceCleaned        bool   `json:"device_cleaned"`
	DeviceCleanupSkipped bool   `json:"device_cleanup_skipped"`
	DeviceSkipReason     string `json:"device_skip_reason,omitempty"`
	DeviceWarning        string `json:"device_warning,omitempty"`
	// NodeStateKeptReason explains a local tsnet state directory this command
	// left in place, and only for the cause that reaches no other field here.
	// A protected hostname or a skipped cleanup are already stated by
	// device_cleanup_skipped and device_skip_reason; partial resolution --
	// some of the service's recorded nodes deleted and some unaccounted for --
	// was previously a silent decision.
	NodeStateKeptReason string `json:"node_state_kept_reason,omitempty"`
}

type RequestDecisionResult struct {
	Access  *PeopleResult          `json:"access,omitempty"`
	Request registry.AccessRequest `json:"request"`
	Changed bool                   `json:"changed"`
}

type RequestListResult struct {
	Requests []registry.AccessRequest `json:"requests"`
}

type ServeResult struct {
	Daemon             bool `json:"daemon"`
	PID                int  `json:"pid"`
	CredentialMigrated bool `json:"credential_migrated,omitempty"`
}

type ShareResult struct {
	Access        []PeopleResult                   `json:"access,omitempty"`
	RequestLimits *registry.EffectiveRequestLimits `json:"request_limits,omitempty"`
	URL           string                           `json:"url,omitempty"`
	Name          string                           `json:"name"`
	Status        string                           `json:"status"`
	PreserveHost  bool                             `json:"preserve_host"`
	AuthURL       string                           `json:"auth_url,omitempty"`
	// FunnelExpiresAt is the deadline of the Funnel share this call returned.
	// A reused share keeps its own, which can be sooner than the one asked
	// for, so it is reported rather than implied by the request.
	FunnelExpiresAt *time.Time `json:"funnel_expires_at,omitempty"`
	// FunnelRearmed is true when this call re-armed the expired Funnel
	// deadline of the share it reused.
	FunnelRearmed bool `json:"funnel_rearmed,omitempty"`
	// Exposure is the same view add returns. With FunnelExpiresAt it tells
	// tailnet-only (kind tailnet or tailnet_allow) from public until a
	// deadline (public_funnel with funnel_expires_at) from public with no
	// deadline (public_funnel without it).
	Exposure inspect.ExposureView `json:"exposure"`
	// Warnings are non-fatal notes about the share, such as a directory share
	// of the whole home directory.
	Warnings []inspect.WarningView `json:"warnings,omitempty"`
	// contains filtered or unexported fields
}

type StatusCredentialSlot struct {
	Present            bool          `json:"present"`
	Fingerprint        string        `json:"fingerprint,omitempty"`
	StoredAt           *time.Time    `json:"stored_at,omitempty"`
	ExpiresAt          *time.Time    `json:"expires_at,omitempty"`
	ExpiresAtSource    string        `json:"expires_at_source,omitempty"`
	DaysLeft           *int          `json:"days_left,omitempty"`
	ExpiryState        string        `json:"expiry_state"`
	LastVerifiedAt     *time.Time    `json:"last_verified_at,omitempty"`
	LastVerifiedResult string        `json:"last_verified_result,omitempty"`
	EarlyWarning       health.Expiry `json:"early_warning"`
}

type StatusCredentials struct {
	APIKey       StatusCredentialSlot `json:"api_key"`
	ClientSecret StatusCredentialSlot `json:"client_secret"`
	// MetadataError is set when credential-meta.json exists but is unreadable;
	// present slots then report expiry_state=unknown.
	MetadataError string `json:"metadata_error,omitempty"`
}

type StatusPendingLogin struct {
	Node      string    `json:"node"`
	AuthURL   string    `json:"auth_url"`
	ExpiresAt time.Time `json:"expires_at"`
}

type StatusResult struct {
	GuestLinks              []registry.GuestView    `json:"guest_links"`
	AccessLog               accesslog.Health        `json:"access_log"`
	Portal                  tsruntime.PortalState   `json:"portal"`
	MCPBindings             []mcpBindingView        `json:"mcp_bindings,omitempty"`
	Alerts                  health.AlertsView       `json:"alerts"`
	Supervision             Supervision             `json:"supervision"`
	DaemonRunning           bool                    `json:"daemon_running"`
	DaemonState             string                  `json:"daemon_state"`
	DaemonPID               int                     `json:"daemon_pid"`
	OwnershipProofAvailable bool                    `json:"ownership_proof_available"`
	Authenticated           bool                    `json:"authenticated"`
	CredentialStored        bool                    `json:"credential_stored"`
	Credentials             StatusCredentials       `json:"credentials"`
	CredentialExpiryState   string                  `json:"credential_expiry_state"`
	NodeAuthorized          bool                    `json:"node_authorized"`
	AuthorizedServiceCount  int                     `json:"authorized_service_count"`
	AuthStatus              string                  `json:"auth_status"`
	PendingLogins           []StatusPendingLogin    `json:"pending_logins,omitempty"`
	AuthURL                 string                  `json:"auth_url,omitempty"`
	ExpiresAt               *time.Time              `json:"expires_at,omitempty"`
	Next                    []string                `json:"next,omitempty"`
	GlobalError             *tsruntime.ServiceError `json:"global_error,omitempty"`
	ServiceCount            int                     `json:"service_count"`
	Services                []StatusServiceState    `json:"services"`
}

type StatusRuntimeSnapshotResult struct {
	Status              string     `json:"status"`
	Code                string     `json:"code,omitempty"`
	Exact               bool       `json:"exact"`
	Message             string     `json:"message,omitempty"`
	UpdatedAt           *time.Time `json:"updated_at,omitempty"`
	DaemonPID           int        `json:"daemon_pid,omitempty"`
	RegistryFingerprint string     `json:"registry_fingerprint,omitempty"`
}

type StatusServiceState struct {
	PortalOnly      bool                             `json:"portal_only,omitempty"`
	PortalURL       string                           `json:"portal_url,omitempty"`
	RequestLimits   *registry.EffectiveRequestLimits `json:"request_limits,omitempty"`
	Warnings        []inspect.WarningView            `json:"warnings,omitempty"`
	Health          health.State                     `json:"health"`
	NodeKey         health.Expiry                    `json:"node_key"`
	Name            string                           `json:"name"`
	Status          string                           `json:"status"`
	OwnershipProof  bool                             `json:"ownership_proof"`
	PreserveHost    *bool                            `json:"preserve_host,omitempty"`
	FunnelRequested bool                             `json:"funnel_requested"`
	FunnelActive    bool                             `json:"funnel_active"`
	FunnelState     string                           `json:"funnel_state"`
	FunnelExpiresAt *time.Time                       `json:"funnel_expires_at,omitempty"`
	FunnelRemaining *string                          `json:"funnel_remaining,omitempty"`
	Error           *tsruntime.ServiceError          `json:"error,omitempty"`
}

type StatusServiceView struct {
	PortalOnly      bool                             `json:"portal_only,omitempty"`
	PortalURL       string                           `json:"portal_url,omitempty"`
	RequestLimits   *registry.EffectiveRequestLimits `json:"request_limits,omitempty"`
	Health          health.State                     `json:"health"`
	NodeKey         health.Expiry                    `json:"node_key"`
	Name            string                           `json:"name"`
	Type            string                           `json:"type"`
	RuntimeState    string                           `json:"runtime_state"`
	OwnershipProof  bool                             `json:"ownership_proof"`
	Endpoint        inspect.EndpointView             `json:"endpoint"`
	Exposure        inspect.ExposureView             `json:"exposure"`
	PreserveHost    bool                             `json:"preserve_host"`
	FunnelRequested bool                             `json:"funnel_requested"`
	FunnelActive    bool                             `json:"funnel_active"`
	FunnelState     string                           `json:"funnel_state"`
	FunnelExpiresAt *time.Time                       `json:"funnel_expires_at,omitempty"`
	FunnelRemaining *string                          `json:"funnel_remaining,omitempty"`
	Error           *tsruntime.ServiceError          `json:"error,omitempty"`
	Allow           inspect.SummaryView              `json:"allow"`
	Tags            inspect.SummaryView              `json:"tags"`
	Backend         inspect.BackendView              `json:"backend"`
	Warnings        []inspect.WarningView            `json:"warnings,omitempty"`
}

type StatusURLsResult struct {
	GuestLinks              []registry.GuestView        `json:"guest_links"`
	AccessLog               accesslog.Health            `json:"access_log"`
	Portal                  tsruntime.PortalState       `json:"portal"`
	MCPBindings             []mcpBindingView            `json:"mcp_bindings,omitempty"`
	Alerts                  health.AlertsView           `json:"alerts"`
	Supervision             Supervision                 `json:"supervision"`
	SchemaVersion           int                         `json:"schema_version"`
	DaemonRunning           bool                        `json:"daemon_running"`
	DaemonState             string                      `json:"daemon_state"`
	DaemonPID               int                         `json:"daemon_pid"`
	OwnershipProofAvailable bool                        `json:"ownership_proof_available"`
	Authenticated           bool                        `json:"authenticated"`
	CredentialStored        bool                        `json:"credential_stored"`
	Credentials             StatusCredentials           `json:"credentials"`
	CredentialExpiryState   string                      `json:"credential_expiry_state"`
	NodeAuthorized          bool                        `json:"node_authorized"`
	AuthorizedServiceCount  int                         `json:"authorized_service_count"`
	AuthStatus              string                      `json:"auth_status"`
	PendingLogins           []StatusPendingLogin        `json:"pending_logins,omitempty"`
	AuthURL                 string                      `json:"auth_url,omitempty"`
	ExpiresAt               *time.Time                  `json:"expires_at,omitempty"`
	Next                    []string                    `json:"next,omitempty"`
	GlobalError             *tsruntime.ServiceError     `json:"global_error,omitempty"`
	ServiceCount            int                         `json:"service_count"`
	RuntimeSnapshot         StatusRuntimeSnapshotResult `json:"runtime_snapshot"`
	Services                []StatusServiceView         `json:"services"`
}

type StopResult struct {
	WasRunning bool `json:"was_running"`
	Stopped    bool `json:"stopped"`
}

type Supervision struct {
	Manager   string `json:"manager"`
	Installed bool   `json:"installed"`
	Autostart bool   `json:"autostart"`
	// AutostartScope answers the question Autostart alone cannot: "boot" comes
	// back with the machine while nobody is logged in, "login" only comes back
	// once this user has a session. Every supervisor this tool installs is a
	// per-user one, so the difference is the whole of what "will it still be
	// there after a reboot" means on a headless host. It is empty whenever
	// autostart itself is unverified.
	AutostartScope string `json:"autostart_scope,omitempty"`
	RestartOnExit  bool   `json:"restart_on_exit"`
	Path           string `json:"path,omitempty"`
	Detail         string `json:"detail"`
	SupervisorPID  int    `json:"supervisor_pid,omitempty"`
	RuntimeState   string `json:"runtime_state,omitempty"`
	FailureReason  string `json:"failure_reason,omitempty"`
}

type TagsAddResult struct {
	Service        string `json:"service"`
	Tag            string `json:"tag"`
	AlreadyExisted bool   `json:"already_existed"`
}

type TagsDeleteResult struct {
	Tag                          string                        `json:"tag"`
	RemoteACLTagOwnerRuleRemoved bool                          `json:"remote_acl_tag_owner_rule_removed"`
	Message                      string                        `json:"message"`
	RemoteSideEffectPlan         security.RemoteSideEffectPlan `json:"remote_side_effect_plan"`
}

type TagsListResult struct {
	Services []TagsServiceEntry `json:"services"`
}

type TagsPullResult struct {
	Tags       []string `json:"tags"`
	DefaultTag string   `json:"default_tag"`
	Skipped    bool     `json:"skipped,omitempty"`
	SkipReason string   `json:"skip_reason,omitempty"`
}

type TagsServiceEntry struct {
	Name string   `json:"name"`
	Tags []string `json:"tags"`
}

type TagsSetDefaultResult struct {
	Tag string `json:"tag"`
}

type TagsSetResult struct {
	Service string   `json:"service"`
	Tags    []string `json:"tags"`
}

type TailnetDeviceView struct {
	Hostname           string     `json:"hostname"`
	Name               string     `json:"name,omitempty"`
	LocallyRegistered  bool       `json:"locally_registered"`
	Origin             string     `json:"origin"`
	LocalService       string     `json:"local_service,omitempty"`
	Tags               []string   `json:"tags"`
	OS                 string     `json:"os,omitempty"`
	CreatedAt          *time.Time `json:"created_at,omitempty"`
	LastSeenAt         *time.Time `json:"last_seen_at,omitempty"`
	ConnectedToControl bool       `json:"connected_to_control"`
	Authorized         bool       `json:"authorized"`
}

type TailnetListResult struct {
	SchemaVersion     int                 `json:"schema_version"`
	Devices           []TailnetDeviceView `json:"devices"`
	Count             int                 `json:"count"`
	RegisteredCount   int                 `json:"registered_count"`
	UnregisteredCount int                 `json:"unregistered_count"`
	CleanupAuthority  string              `json:"cleanup_authority"`
}

type TemplateApplyResult struct {
	SchemaVersion int                `json:"schema_version"`
	Name          string             `json:"name"`
	Summary       string             `json:"summary"`
	DryRun        bool               `json:"dry_run"`
	Applied       bool               `json:"applied"`
	Services      []TemplatePlanItem `json:"services"`
	Created       int                `json:"created"`
	Skipped       int                `json:"skipped"`
}

type TemplateListResult struct {
	SchemaVersion int               `json:"schema_version"`
	Templates     []TemplateSummary `json:"templates"`
	Count         int               `json:"count"`
}

type TemplatePlanItem struct {
	Name    string              `json:"name"`
	Action  string              `json:"action"`
	Message string              `json:"message,omitempty"`
	Service inspect.ServiceView `json:"service"`
}

type TemplateShowResult struct {
	SchemaVersion int                   `json:"schema_version"`
	Name          string                `json:"name"`
	Summary       string                `json:"summary"`
	Description   string                `json:"description"`
	Services      []inspect.ServiceView `json:"services"`
	Count         int                   `json:"count"`
}

type TemplateSummary struct {
	Name         string `json:"name"`
	Summary      string `json:"summary"`
	ServiceCount int    `json:"service_count"`
}

type ToolchainInfo struct {
	MinimumGoVersion string `json:"minimum_go_version"`
}

type URLResult struct {
	PortalURL string `json:"portal_url,omitempty"`
	Name      string `json:"name"`
	URL       string `json:"url"`
	State     string `json:"state"`
}

type UninstallResult struct {
	Path           string `json:"path"`
	Removed        bool   `json:"removed"`
	ServiceManager string `json:"service_manager"`
	Warning        string `json:"warning,omitempty"`
}

type VersionResult struct {
	Version string `json:"version"`
	Commit  string `json:"commit,omitempty"`
}