httpapi

type ActivationBackend interface {
	// ListActivating returns every plan in plan_activating with each owned
	// activation criterion's current probe status + evidence pointer.
	ListActivating(ctx context.Context) (ActivationListResponse, error)
	// OverrideProbe marks the named activation probe satisfied on the planning
	// issue with the operator's mandatory reason and returns the plan's state at
	// commit. ErrNotFound (unknown/non-planning key), ErrSpecStateConflict (plan
	// not in plan_activating), ErrBadRequest (empty/unknown rid or empty reason).
	OverrideProbe(ctx context.Context, planningKey, requirementID, reason string) (ActivationOverrideResponse, error)
}

type ActivationListResponse = apiclient.ActivationListResponse

type ActivationOverrideRequest = apiclient.ActivationOverrideRequest

type ActivationOverrideResponse = apiclient.ActivationOverrideResponse

type ActivationPlanView = apiclient.ActivationPlanView

type ActivationProbeView = apiclient.ActivationProbeView

type ActiveProposal struct {
	ID             int64
	Outcome        string // 'pending' or 'approved'
	OriginIssue    string
	PlannerSession string
}

type AnswerStewardLedgerQuestionRequest = apiclient.AnswerStewardLedgerQuestionRequest

type Backend interface {
	// SubmitOperatorCommand pushes one operator command onto the
	// daemon's event channel and waits up to ~5s for an ack. The
	// command string carries any payload (replan uses
	// "replan:<issue>:<reason>"). Returns nil on accept, the
	// applied error on rejection, or an "ack timeout" error if the
	// main loop is wedged.
	SubmitOperatorCommand(ctx context.Context, command string) error
	// StatusSnapshot returns the operator-facing status map served
	// at GET /v1/status.
	StatusSnapshot() (map[string]any, error)
}

type CapabilityGapBlockView = apiclient.CapabilityGapBlockView

type CascadeImpactError struct {
	ParentPlan               string
	SiblingsOrphaned         []string
	SiblingsWithLostSquashes []string
	Message                  string
	Hint                     string
}

type CommentHit = apiclient.CommentHit

type CommentView = apiclient.CommentView

type Config struct {
	// Bind is the listener address (host:port). 127.0.0.1:7777 is the
	// recommended default; operators front this with a reverse proxy
	// when exposing beyond loopback.
	Bind string
	// Token is the bearer token clients must present. Empty rejected.
	Token string
	// Backend is the daemon hook. Required.
	Backend Backend
	// IssueReader serves the /v1/issues* read endpoints. Required.
	IssueReader IssueReader
	// IssueMutator serves the /v1/issues/{key}/* write endpoints.
	// Required — the server refuses to start without one even if no
	// mutation traffic is expected, so a misconfiguration is caught
	// at boot rather than on the first transition request.
	IssueMutator IssueMutator
	// PlanStore is the proposals lifecycle's persistence surface,
	// consumed by /v1/plan/submit, /v1/plan/{id}/review, and
	// /v1/plan/{id}/dump. Optional: when nil, every /v1/plan/*
	// endpoint returns 500 "plan store not configured" so the route
	// table doesn't need a conditional registration. The post-cutover
	// daemon wires this; the existing planner pipeline doesn't depend
	// on it, so the endpoints can ship unwired without breaking
	// anything.
	PlanStore PlanStore
	// PlanApproveProjector, when non-nil, is called by handlePlanReview
	// immediately after a successful Store.ReviewProposal(approve) commit
	// to project the proposal's children into the daemon's d.state.Issues
	// on the single-writer main goroutine (SOR-2323). Nil disables the
	// eager projection — the recovery sweep then remains the sole
	// projection path (the pre-SOR-2323 behavior), which is the right
	// default for test servers that don't run a live event loop.
	PlanApproveProjector PlanApproveProjector
	// PlanAllowedRepos is the project's strict push allowlist passed
	// through to the plan validator (rule 4). Empty disables the
	// rule, which is fine in tests but rejected at runtime by the
	// validator itself.
	PlanAllowedRepos []string
	// PlanCitations is the file-existence checker passed through to
	// the plan validator (rule 1). Nil disables citation checking.
	PlanCitations PlanCitations
	// PlanDeclaredArtifactPaths is the project's flattened set of declared
	// generated-artifact output paths, passed through to the plan validator's
	// rule 14b (validateFootprintDeclaredArtifactPaths) so a proposal child
	// whose predicted_footprint declares a daemon-generated artifact path (or
	// the built-in docs/traceability/ matrix prefix) is hard-rejected at submit
	// time. Production wiring (cmd/sorcererd/start.go) passes the same flattened
	// value the daemon threads into seatPredictedFootprint. Empty/nil degrades
	// the rule to the matrix-only behavior, so legacy test wiring keeps passing.
	PlanDeclaredArtifactPaths []string
	// PlanSelfHostingScaffolding is the project's config-declared
	// self-hosting-scaffolding path prefix set (config.SelfHostingScaffolding),
	// passed through to the plan validator's R7 advisory product-altitude check
	// (validateFootprintProductAltitude) so a flagged product-domain child's
	// no-product-source footprint paths can be characterized as recognized
	// self-hosting scaffolding via footprint.IsSelfHostingScaffolding. Production
	// wiring (cmd/sorcererd/start.go) passes config.SelfHostingScaffolding(cfg),
	// the same value the seat-time altitude gate consumes. Empty/nil classifies
	// every path non-scaffolding (no config = no scaffolding recognized), which
	// leaves the flag itself intact — flagging keys on the product-engine-source
	// predicate, not this set.
	PlanSelfHostingScaffolding []string
	// PlanOpenPRCounter returns the number of non-terminal issues in
	// the daemon's state whose `latestPRSnapshots` entry contains at
	// least one element with `State == "OPEN"` and a non-empty
	// `PRURL`. Used by handlePlanSubmit to populate
	// ValidationContext.OpenPRCount (which gates the plan validator's
	// rule 8 `overlap_considered` check). Optional: when nil the
	// handler defaults OpenPRCount to 0 so existing test wiring that
	// doesn't supply this counter continues to pass — at the cost of
	// disabling rule 8 in those tests, which the test fixtures don't
	// exercise. Production wiring (cmd/sorcererd/start.go) supplies a
	// counter that reads d.latestPRSnapshots on the supervisor main
	// goroutine.
	PlanOpenPRCounter func(ctx context.Context) int
	// PlanImplementerMaxAgeFloorSec is the lower-bound the plan
	// validator's rule 9 enforces on every per-issue `max_age_seconds`
	// override. Production wiring passes
	// `int(cfg.SessionMaxAges()["implementer"].Seconds())` so the
	// planner can't undercut the project-wide default. A zero value
	// disables the floor check (zero accepted, ceiling still 86400) so
	// legacy test wiring that doesn't supply the field keeps passing.
	PlanImplementerMaxAgeFloorSec int
	// OversizedCeiling is the per-project dispatch-escalate ceiling (in
	// predicted cache tokens) threaded onto every ValidateProposal call in the
	// submit-proposal handler (lintProposalFromResult). DetectOversizedChild
	// upgrades an oversized_child finding to gating SeverityCritical only when a
	// child's estimate exceeds it — the same boundary the dispatch gate
	// escalates on (SOR-2708). Production wiring passes
	// cfg.OversizedDispatchEscalateCeiling(); zero in tests that don't configure
	// it leaves the ceiling gate inactive (findings advisory only).
	OversizedCeiling int64
	// IntegrationSizeCap is the per-project proposal-time submit-gate cap on a
	// CIPB plan's cumulative integration FILE footprint (the de-duplicated distinct-
	// file count), threaded onto every ValidateProposal call in the submit-proposal
	// handler (lintProposalFromResult) as Proposal.IntegrationSizeCap.
	// DetectOversizedPlan rejects an over-cap proposal as gating oversized_plan,
	// directing the planner to decompose into a depends_on-chained set of smaller
	// sub-plans. Production wiring passes cfg.IntegrationSizeCap(); zero in tests
	// that don't configure it leaves the file axis of the oversized_plan gate
	// inactive.
	IntegrationSizeCap int64
	// IntegrationSizeCapChildren is the child-count companion to IntegrationSizeCap,
	// threaded onto Proposal.IntegrationSizeCapChildren at the same submit gate so
	// DetectOversizedPlan rejects a proposal whose child count exceeds it. Production
	// wiring passes cfg.IntegrationSizeCapChildren(); zero in tests that don't
	// configure it leaves the child axis inactive (when BOTH are zero the lint is a
	// no-op).
	IntegrationSizeCapChildren int64
	// RecoverBackend serves the POST /v1/recover endpoint. Optional:
	// when nil, the handler returns 500 "recover backend not configured"
	// so the route table doesn't need a conditional registration. The
	// production daemon wires this; tests that exercise other
	// endpoints can omit it.
	RecoverBackend RecoverBackend
	// RoleHealthBackend serves GET /v1/role-pauses and POST
	// /v1/role-pauses/clear. Optional: when nil, both endpoints
	// return 500 "role health backend not configured" so the route
	// table doesn't need a conditional registration. The production
	// daemon wires this with a thin issuestore adapter.
	RoleHealthBackend RoleHealthBackend
	// SubscriptionBackend serves GET /v1/subscriptions and POST
	// /v1/subscriptions/{name}/clear. Optional: when nil, both
	// endpoints return 500 "subscription backend not configured" so
	// the route table doesn't need a conditional registration. The
	// production daemon wires this with a thin clauderunner adapter
	// (SOR-1080) so the auth-flagged subscription recovery path
	// doesn't require a daemon restart.
	SubscriptionBackend SubscriptionBackend
	// FindingsBackend serves GET /v1/findings, GET /v1/findings/{id},
	// and POST /v1/findings/{id}/dismiss. Optional: when nil, every
	// findings endpoint returns 500 "findings backend not configured"
	// so the route table doesn't need a conditional registration. The
	// production daemon wires this with a thin issuestore adapter.
	FindingsBackend FindingsBackend
	// SpecBackend serves the seven /v1/specs/* endpoints (spec-driven
	// phase B): the two GET read paths plus the verify / patch / amend /
	// approve / suppress-finding mutations. Optional: when nil, every
	// spec endpoint returns 500 "specs backend not configured" so the
	// route table doesn't need a conditional registration. The production
	// daemon wires this with cmdadapter.SpecBackend (reads via the
	// issuestore, mutations through the daemon's single-writer main loop).
	SpecBackend SpecBackend
	// SelfReflectionsBackend serves GET /v1/self-reflections. Optional:
	// when nil, the endpoint returns 500 "self-reflections backend not
	// configured" so the route table doesn't need a conditional
	// registration. The production daemon wires this with a thin
	// issuestore adapter; rows are append-only audit (no write/dismiss
	// surface — the operator's intervention point is the daemon-auto-
	// filed meta-issue from the hourly blocker-rollup sweep).
	SelfReflectionsBackend SelfReflectionsBackend
	// ActivationBackend serves the two /v1/activation endpoints (SOR-2504):
	// GET /v1/activation lists plans in the post-merge plan_activating phase
	// with each probe's status + evidence pointer, and POST
	// /v1/activation/{key}/override marks one activation probe satisfied with
	// a mandatory operator reason (the spec R6 sole exception). Optional: when
	// nil, both endpoints return 500 "activation backend not configured" so
	// the route table doesn't need a conditional registration. The production
	// daemon wires this with cmdadapter.ActivationBackend (the override routes
	// through the daemon's single-writer main loop; the list is a per-request
	// sync read of the live plan set, no time-based cache).
	ActivationBackend ActivationBackend
	// StewardLedgerBackend serves the four /v1/steward/ledger endpoints
	// (SOR-2659): GET lists rows (optional ?row_type= filter), POST creates a
	// row, POST .../{id} updates a row, POST .../{id}/expire hard-deletes one.
	// Optional: when nil, every endpoint returns 500 "steward ledger backend
	// not configured" so the route table doesn't need a conditional
	// registration. The production daemon wires cmdadapter.StewardLedgerBackend
	// (reads direct to the issuestore; writes route through the daemon's
	// single-writer main loop, which emits the audited steward_ledger_write
	// event — spec R5).
	StewardLedgerBackend StewardLedgerBackend
	// IssueAgentShellBackend spawns the issue_agent subprocess backing the
	// /v1/issue-agent-shell WebSocket endpoint. Optional: when nil, a connect
	// (after the bearer check passes) is rejected with 503 before the
	// WebSocket upgrade so the route table stays unconditional. The
	// production daemon wires a cmdadapter that holds the resolved
	// issue_agent effort so the httpapi package stays off the
	// clauderunner import.
	IssueAgentShellBackend IssueAgentShellBackend
	// IssueAgentShellIdleTimeout bounds an idle /v1/issue-agent-shell session: when no
	// operator-side message arrives for this long the handler closes
	// the socket with the `session timed out` reason and reaps the
	// subprocess. Zero falls back to issueAgentShellDefaultIdleTimeout so a
	// misconfigured wiring still bounds the subprocess. Production
	// passes time.Duration(cfg.Limits.IssueAgentShellIdleTimeoutSeconds)*time.Second.
	IssueAgentShellIdleTimeout time.Duration
	// Topology is the daemon's peer-cache lookup for the SOR-1214
	// cross-daemon auth path on POST /v1/issues. Optional: when nil,
	// the dual-auth branch is disabled and requests carrying
	// `X-Sorcerer-Forwarded-From` 401 with the same envelope as a
	// local-bearer mismatch. Production wiring passes the
	// (*daemon.Topology) constructed in cmd/sorcererd/start.go.
	Topology TopologyLookup
	// RouteClassifier serves the SOR-1279 dry-run POST
	// /v1/issues/route-classify endpoint. Optional: when nil, the
	// handler returns 503 Service Unavailable with the documented
	// `cross-daemon routing disabled (no topology cache)` body — the
	// only correct answer when the daemon was started without a UI
	// endpoint (no peers to forward to, so routing classification has
	// no input). Production wiring passes a cmdadapter.RouteClassifier
	// that calls daemon.ResolveDestination against the live topology
	// snapshot.
	RouteClassifier RouteClassifier
	// Logger is optional.
	Logger Logger
}

type CreateStewardLedgerRowRequest = apiclient.CreateStewardLedgerRowRequest

type DashboardRow = apiclient.DashboardRow

type DuplicateEntry struct {
	Key     string `json:"key"`
	Overlap string `json:"overlap"`
}

type DuplicateError struct {
	Duplicates []DuplicateEntry
}

type EventView = apiclient.EventView

type FindingDismissResponse = apiclient.FindingDismissResponse

type FindingListResponse = apiclient.FindingListResponse

type FindingView = apiclient.FindingView

type FindingsBackend interface {
	// ListFindings returns FindingView rows matching the filter,
	// newest-first. An empty result is a non-nil empty slice (the JSON
	// envelope is `{"findings":[]}`).
	ListFindings(ctx context.Context, filter FindingsFilter) ([]FindingView, error)
	// GetFinding returns the FindingView for id. Returns
	// ErrFindingNotFound when no row with that id exists.
	GetFinding(ctx context.Context, id int64) (FindingView, error)
	// DismissFinding flips the finding's outcome to `dismissed`.
	// Returns dismissed=true when it flipped a non-dismissed finding;
	// dismissed=false on an idempotent re-dismiss of an already-
	// dismissed finding (NOT an error — the handler maps it to 200).
	// Returns ErrFindingNotFound when no row with that id exists.
	DismissFinding(ctx context.Context, id int64) (dismissed bool, err error)
}

type FindingsFilter struct {
	SinceTS   int64  // unix seconds; rows with ts >= SinceTS only when > 0
	Limit     int    // 0 → unlimited
	Outcome   string // exact match on outcome
	Signature string // exact match on pattern_signature
}

type ForwardQueuedError struct {
	PendingID int64
}

type ForwardRequiredError struct {
	TargetDaemon string
	TargetURL    string
	Rationale    string
}

type ForwardedCreateError struct {
	DestKey    string
	DestDaemon string
}

type HistoryView = apiclient.HistoryView

type IssueAdoptPRInput = apiclient.IssueAdoptPRInput

type IssueAgentShellBackend interface {
	// StartConversation spawns the long-lived issue_agent
	// subprocess for ONE WebSocket connection (Shape A) or for ONE
	// per-convID registry entry (Shape B). Canceling ctx (operator
	// disconnect, idle reap, concurrent-connect eviction) reaps the
	// whole subprocess tree. A token-pool exhaustion (or any spawn
	// failure) returns a non-nil error and no conversation.
	//
	// SOR-333: opts.ResumeConvID, when non-empty, threads `--resume
	// <id>` onto the claude argv so the spawned subprocess resumes the
	// named on-disk conversation. The Shape B registry passes a non-
	// empty value only on a reconnect after a between-connections reap
	// — fresh-spawn paths (Shape A, and the first spawn for a new
	// convID) supply an empty ResumeConvID and get a fresh subprocess.
	//
	// Per-conversation worktree prep / cleanup, OAuth token pick, and
	// live-registry enrolment all happen here (per-conversation
	// lifecycle, NOT per-turn — SOR-331). The conversation has no
	// user message yet; the first turn is sent via SendTurn whose
	// payload should carry the rendered issue_agent prompt
	// template + system-context envelope.
	StartConversation(ctx context.Context, opts IssueAgentShellStartOptions) (IssueAgentShellConversation, error)

	// BuildFirstTurnPayload returns the text the first turn's
	// stream-json user message should carry: the rendered
	// issue_agent prompt template + system-context envelope with
	// the operator's first message substituted into MESSAGE. Called
	// exactly once per subprocess — every subsequent turn writes
	// the raw operator message text without any envelope, because
	// claude retains conversation state internally. SOR-333: under
	// Shape B the handler caches the envelope-rendered state on the
	// registry entry so a reconnect that reuses the existing
	// subprocess skips the envelope (claude already has it in
	// context); only a fresh spawn (including the --resume reconnect
	// path, which starts a brand-new subprocess whose context comes
	// from claude's on-disk store) renders the envelope.
	BuildFirstTurnPayload(message string) (string, error)
}

type IssueAgentShellConversation interface {
	// SendTurn writes one operator-side user message (text) to the
	// subprocess's stdin as a stream-json frame and returns a
	// IssueAgentShellTurn whose Stdout yields the assistant's text content
	// line-by-line until the per-turn `result` terminator (io.EOF).
	SendTurn(messageText string) (IssueAgentShellTurn, error)

	// Reap tears the subprocess tree down. Idempotent — the eviction,
	// idle-timeout, and connection-closed paths can all call it.
	Reap(reason string)

	// Wait blocks until the subprocess exits. Returns the classified
	// exit error (e.g. *agentcli.NarrationError on a transient
	// upstream API failure) for diagnostics; the operator-visible
	// signal is per-turn stdout EOF on the in-flight IssueAgentShellTurn, not
	// Wait's return value.
	Wait() error
}

type IssueAgentShellStartOptions struct {
	// ResumeConvID, when non-empty, tells the backend to spawn the
	// subprocess via `claude --resume <ResumeConvID>` so it picks up
	// the named on-disk conversation. The Shape B registry sets this
	// only on the between-connections-reap path; fresh spawns leave
	// it empty.
	ResumeConvID string
}

type IssueAgentShellTurn interface {
	Stdout() io.Reader
	Close()
}

type IssueCreateInput = apiclient.IssueCreateInput

type IssueDetail = apiclient.IssueDetail

type IssueDryRunResult = apiclient.IssueDryRunResult

type IssueListFilter = apiclient.IssueListFilter

type IssueMutator interface {
	// ApplyTransition advances the issue at key to toState, recording
	// reason in the audit trail. The actor is "operator" by
	// convention. Returns ErrNotFound, ErrInvalidTransition, or
	// nil.
	ApplyTransition(ctx context.Context, key, toState, reason string) error
	// AddBlocker declares "blockerKey blocks blockedKey" — i.e.
	// appends blockerKey to blockedKey's DependsOn slice and pushes
	// the matching Linear `blocks` relation. Idempotent (a duplicate
	// add is a silent success). Returns ErrNotFound (either side
	// missing), ErrCycle (would close a cycle), or nil.
	AddBlocker(ctx context.Context, blockerKey, blockedKey string) error
	// RemoveBlocker is the inverse of AddBlocker: drops blockerKey
	// from blockedKey's DependsOn and removes the Linear relation.
	// Idempotent (a remove against a missing edge is a silent
	// success). Returns ErrNotFound (either side missing) or nil.
	RemoveBlocker(ctx context.Context, blockerKey, blockedKey string) error
	// AppendComment inserts one operator-authored comment on the
	// issue at key with the given body. The body is taken verbatim;
	// callers MUST trim and reject empties at the wire layer (the
	// daemon never inserts an empty-body row). Returns the assigned
	// comment id and unix-seconds timestamp on success, or
	// ErrNotFound when the key is absent. Other errors surface to
	// the handler as 500.
	AppendComment(ctx context.Context, key, body string) (commentID int64, ts int64, err error)
	// CancelIssue transitions the issue at key to its terminal-cancel
	// state (abandoned for implementation, plan_abandoned for planning),
	// runs the cleanup path the supervisor uses today on involuntary
	// abandonment (worktree teardown, optional WIP preservation, Linear
	// push to canceled), and inserts an audit history row plus an
	// optional derived comment row carrying the cancel reason.
	//
	// When the issue is a `plan_branch` implementation child whose
	// parent Planning Issue is in a non-terminal plan state, canceling
	// the child cascade-abandons the parent and orphans every sibling
	// (with any already-squashed sibling commits lost on plan-branch
	// teardown). The daemon refuses the cancel with CascadeImpactError
	// in that situation unless cascadePlanAbandon is true; the operator
	// passes true via the `--cascade-plan-abandon` CLI flag (wire field
	// `cascade_plan_abandon`) once they have inspected the impact.
	//
	// Returns ErrNotFound, ErrInvalidTransition, *CascadeImpactError, or
	// nil.
	CancelIssue(ctx context.Context, key, reason string, cascadePlanAbandon bool) error
	// CreateIssue files one fresh issue. Title / BodyMarkdown / Kind
	// are required; Repos / DependsOn are optional. The daemon
	// validates Repos against the project's allowlist and DependsOn
	// against state.Issues; rejections wrap ErrBadRequest with the
	// offending input in the message. The Linear-side create runs
	// inside the daemon's main-loop handler; a Linear-side failure
	// wraps ErrLinearAPI so the handler can map it to 502 (distinct
	// from a 500 local failure). Returns the assigned Linear key
	// (e.g. "SOR-N") plus an optional operator-facing warning string
	// on success. The warning is non-empty only when the SOR-1218
	// body-vs-repos detector overrode the prior repos-field routing
	// decision so the create proceeded locally despite the operator's
	// declared `--repo` flag pointing elsewhere; the handler folds
	// it into the 201 reply as the optional `warning` field.
	//
	// The third return value, specDriven, reports whether the create was
	// routed to the spec-driven lifecycle (minted in spec_drafting) — true
	// exactly when createroute.Decide returns RouteSpecDrafting for this
	// request (SPEC-SOR-2828-v1 R7), false on every error path and on the
	// cross-daemon forward path. The handler folds it into the 201 reply as
	// the optional `spec_driven` field (omitted when false).
	CreateIssue(ctx context.Context, in IssueCreateInput) (key string, warning string, specDriven bool, err error)
	// DryRunCreateIssue runs the read-only create-time validation chain
	// plus the body-features / risk-bucket analyzer against a candidate
	// issue body and returns a typed report — WITHOUT minting a key,
	// persisting a row, or invoking the dedupe LLM. It is the cheap,
	// deterministic pre-commit check a drafting tool iterates against
	// before the mutating real create. The returned error is non-nil only
	// on a genuine daemon-side failure (e.g. a state-snapshot error); a
	// draft that would be rejected by a real create is reported via
	// IssueDryRunResult.Valid=false + ValidationErrors, NOT via this error.
	DryRunCreateIssue(ctx context.Context, in IssueCreateInput) (*IssueDryRunResult, error)
	// AmendIssue updates the issue at key's description in place and
	// writes an audited, recoverable amendment row capturing actor,
	// reason, timestamp, and the pre-amend body. The amend touches
	// description only — issue state, state_kind, and dependencies
	// rows are NEVER modified by this method. The caller is
	// responsible for trimming and rejecting empties at the wire
	// layer; the daemon also rejects empties as defense in depth.
	// Returns ErrNotFound when key is absent, ErrInvalidTransition
	// when the issue is in a terminal state, or nil on success. On
	// success it also returns the operator-facing body-sizing warning
	// for the NEW body (empty when the post-amend body is in the "safe"
	// risk bucket or forceLargeScope is true); the handler folds it into
	// the 200 reply as the optional `warning` field.
	AmendIssue(ctx context.Context, key, newDescription, reason string, forceLargeScope bool) (warning string, err error)
	// AdoptPR creates a fresh implementation Issue around an existing
	// out-of-band PR (SOR-220 Layer 4 `sorcerer issue adopt-pr`).
	// The daemon resolves the PR via GitHub, validates that the PR's
	// repo is in the project allowlist and that the PR is open, then
	// mints a fresh SOR-N key and inserts the issue directly at
	// IssueStateInReview with PRURLs+Branch pre-populated. Returns
	// (key, nil) on success. The 400-mapped failures wrap
	// ErrBadRequest with the offending input in the message
	// ("repo not in allowlist", "PR is closed, not open"). PR
	// resolution failures surface as ErrLinearAPI (502 by analogy
	// with the existing create path's Linear-side failures).
	AdoptPR(ctx context.Context, in IssueAdoptPRInput) (key string, err error)
	// SetPriority updates the issue at key's Linear priority in place
	// and writes an audited history row capturing actor, reason,
	// timestamp, and the prior + new value. Like AmendIssue it touches
	// one field only — issue state, state_kind, and dependencies rows
	// are NEVER modified by this method. newPriority MUST be in
	// [0, 4]; the caller is responsible for rejecting out-of-range
	// values and empty reasons at the wire layer (the daemon also
	// rejects them as defense in depth). Returns ErrNotFound when key
	// is absent, ErrInvalidTransition when the issue is in a terminal
	// state (merged / abandoned / rejected / plan_completed /
	// plan_abandoned), or nil on success.
	SetPriority(ctx context.Context, key string, newPriority int, reason string) error
	// Retitle corrects the issue at key's title in place and writes an
	// audited history row capturing actor, reason, timestamp, and the
	// prior + new title (SPEC-SOR-2786-v1 R7/R8). Like SetPriority it
	// touches one field only — issue state, state_kind, session_id, and
	// dependencies rows are NEVER modified — so the issue's key, in-flight
	// session, and dependency edges are preserved. newTitle MUST be
	// non-empty; the caller rejects blank titles and empty reasons at the
	// wire layer (the daemon also rejects them as defense in depth).
	// Returns ErrNotFound when key is absent, ErrInvalidTransition when
	// the issue is in a terminal state (merged / abandoned / rejected /
	// plan_completed / plan_abandoned), or nil on success.
	Retitle(ctx context.Context, key, newTitle, reason string) error
	// RekeyIssue renames the issue at oldKey to a fresh canonical
	// `<teamPrefix>-<N>` minted from project.last_issue_seq. SOR-222
	// surgical fix for orphan-PR adoptions that synthesized non-
	// canonical keys (e.g. `TREAT-500`) which the operator UI's
	// issue list can't render. The rewrite touches every referencing
	// table (history, comments, dependencies, etc.) atomically and
	// inserts a comment on the renamed row recording the rename.
	// Returns the assigned new key on success, ErrNotFound when
	// oldKey is absent, ErrBadRequest when oldKey is malformed.
	RekeyIssue(ctx context.Context, oldKey string) (newKey string, err error)
	// RouteMove executes the SOR-1278 `sorcerer issue route --to` cross-
	// daemon move: the source daemon emits route_operator_move_initiated,
	// forwards a fresh create to targetDaemon with the source key on the
	// X-Sorcerer-Source-Key header, cancels the source issue as
	// abandoned with a reason naming the destination, emits
	// route_operator_move_completed, and rewrites any sibling deps that
	// pointed at sourceKey (removing the dep + emitting one
	// route_operator_move_dep_rewritten per affected sibling). Returns
	// (destKey, destDaemon, nil) on success.
	//
	// Failure modes:
	//   - ErrNotFound when sourceKey is absent from state.Issues.
	//   - *RouteMoveRefusedError when the source has a live session
	//     (cancel the session first) or the SM does not admit
	//     abandonment (already merged / abandoned / rejected). Handler
	//     maps to 409 with {error,hint}.
	//   - *RouteMoveForwardError when the destination's POST /v1/issues
	//     returned non-201 or the request never reached it. Handler
	//     maps to 502 with {error,status,body}.
	//   - err wrapping ErrBadRequest for operator-side validation
	//     (unknown / stale target daemon, moving to self, empty
	//     targetDaemon / reason). Handler maps to 400.
	RouteMove(ctx context.Context, sourceKey, targetDaemon, reason string) (destKey, destDaemon string, err error)
	// AddPlanChildren attaches N new implementation children to the
	// named planning issue's MaterializedChildren and transitions the
	// plan to plan_auto_fixing (SOR-1448 / SOR-1443 Fix 4). Additive —
	// existing parked children stay parked; does NOT trigger
	// cancel-cascade. Each minted child carries
	// BranchModel=plan_branch so the dispatcher carves a worktree
	// from the cumulative plan-state for its implementer session.
	// Returns the assigned keys (parallel to in.Children) + any
	// operator-facing warnings on success.
	//
	// Failure modes:
	//   - ErrNotFound when in.PlanKey is absent from state.Issues.
	//   - err wrapping ErrBadRequest for validation rejections (plan
	//     state outside the accepted set, kind not planning, repo not
	//     on the project allowlist, missing required field). The
	//     handler maps to 400. State-outside-set rejections fold onto
	//     the same wrapper but the prose names the accepted set.
	AddPlanChildren(ctx context.Context, in PlanAddChildrenInput) (keys []string, warnings []string, err error)
	// RefactorPlan is the operator-driven replan escape hatch for POST
	// /v1/plan/{key}/refactor. On the daemon's main goroutine it
	// atomically (single-writer-serialized, not single-transaction)
	// snapshots the planning issue's children + emits a
	// plan_refactor_dispatched audit event, cascade-cancels every
	// non-merged child through the existing per-issue cancel core,
	// amends the planning body, and force-transitions the plan to
	// plan_revising. Idempotent: re-running converges to
	// (plan_revising, new body, zero in-flight children).
	//
	// Failure modes:
	//   - ErrNotFound when in.PlanKey is absent from state.Issues.
	//   - err wrapping ErrBadRequest for validation rejections (empty
	//     key / body / reason, target not a planning issue). The
	//     handler maps to 400.
	//   - any other error (a child that could not be canceled, the
	//     amend, or the transition) maps to 500; the operator re-runs.
	RefactorPlan(ctx context.Context, in PlanRefactorInput) (PlanRefactorResult, error)
	// ApplyReferBack injects operator-supplied refer-back concerns onto
	// an in_review / merging issue and walks it to feedback so the next
	// implementer feedback cycle's REVIEW_FEEDBACK carries them. The
	// handler clears the live session, sets OperatorReferBackConcerns
	// to the supplied slice (overwriting any prior buffer), and routes
	// through applyIssueTransition with EventKind=operator_refer_back
	// so the audit trail and downstream side-effects match a
	// reviewer-driven refer-back.
	//
	// Returns ErrNotFound when key is absent, an error wrapping
	// ErrInvalidTransition when the issue is not in in_review or
	// merging, or nil on success.
	ApplyReferBack(ctx context.Context, key, reason string, concerns []ReviewConcern) error
	// ReplaceIssue atomically replaces the issue at oldKey with a freshly-
	// minted live replacement (SPEC-SOR-2826): it mints the replacement from
	// in, copies the old issue's retained declared forward edges onto it,
	// repoints every declared reverse dependent off oldKey onto the
	// replacement, and terminally cancels the old issue — all in one
	// issuestore transaction, so no scheduler pass observes a dependent gated
	// only on a terminal issue (the R10 no-release property). Returns the
	// minted replacement key on success.
	//
	// Returns ErrNotFound when oldKey is absent, an error wrapping
	// ErrBadRequest when the old issue has materialized children (R9), is
	// already terminal, or a depends_on entry names the old key, an error
	// wrapping ErrCycle when a depends_on entry would close a cycle with the
	// replacement, or any other error for a local failure.
	ReplaceIssue(ctx context.Context, in IssueCreateInput, oldKey string) (newKey string, err error)
}

type IssuePR = apiclient.IssuePR

type IssueReader interface {
	// ListIssues returns IssueSummary rows matching f. Zero-valued
	// filter fields impose no constraint; an empty result is a
	// non-nil empty slice (the JSON envelope is `{"issues":[]}`).
	ListIssues(ctx context.Context, f IssueListFilter) ([]IssueSummary, error)
	// GetIssue returns the full IssueDetail for key. Returns
	// ErrNotFound when the key does not exist.
	GetIssue(ctx context.Context, key string) (*IssueDetail, error)
	// ListComments returns every comment on the issue at key,
	// oldest first. An unknown key surfaces as ErrNotFound (the
	// daemon-side adapter checks the issue exists before
	// querying); a known key with no comments is a non-nil empty
	// slice.
	ListComments(ctx context.Context, key string) ([]CommentView, error)
	// ListHistory returns every history row on the issue at key,
	// oldest first. Same not-found / empty-slice contract as
	// ListComments.
	ListHistory(ctx context.Context, key string) ([]HistoryView, error)
	// SearchIssues runs an FTS5 MATCH query against the issuestore and
	// returns ranked title + snippet hits, plus optional comment hits
	// when SearchOptions.IncludeComments is set. Empty queries are the
	// caller's responsibility — the HTTP handler rejects them at 400.
	// FTS5 syntax errors come back wrapped in issuestore.ErrInvalidQuery
	// so the handler can surface 400 instead of 500.
	SearchIssues(ctx context.Context, query string, opts SearchOptions) (*SearchResults, error)
	// CommentsAfter returns every comment on the issue at key whose
	// id > sinceID, oldest first. Used by the /v1/issues/{key}/stream
	// SSE handler to deliver backlog and poll for new rows. sinceID==0
	// is "every comment". Same not-found / empty-slice contract as
	// ListComments.
	CommentsAfter(ctx context.Context, key string, sinceID int64) ([]CommentView, error)
	// HistoryAfter returns every history row on the issue at key whose
	// id > sinceID, oldest first. Used by the /v1/issues/{key}/stream
	// SSE handler to deliver backlog and poll for new rows. sinceID==0
	// is "every history row". Same not-found / empty-slice contract as
	// ListHistory.
	HistoryAfter(ctx context.Context, key string, sinceID int64) ([]HistoryView, error)
	// EventsAfter returns rows from the daemon's events table whose
	// id > sinceID, oldest first. sinceID <= 0 means "every event".
	// limit > 0 bounds the result; limit <= 0 is no limit. Used by the
	// /v1/events JSON-list and SSE handlers to serve the audit-trail
	// stream that previously read from events.log.
	EventsAfter(ctx context.Context, sinceID int64, limit int) ([]EventView, error)
	// RouteHistoryEvents returns the chronological routing-history audit
	// rows for the issue at key — the post-mint `route_resolved_for_key`
	// row (SOR-1277) plus the four `route_operator_move_*` rows
	// (SOR-1278). Filter shape: `subject = key AND kind IN
	// (route_resolved_for_key, route_operator_move_initiated,
	// route_operator_move_completed, route_operator_move_received,
	// route_operator_move_dep_rewritten)`, sorted ts ASC. Empty result is
	// a non-nil empty slice (the caller renders {events:[]}). A missing
	// issue key is NOT a not-found — an issue with no routing history is
	// a normal case (any issue minted before the topology cache was wired
	// has zero rows). Used by the SOR-1279 GET
	// /v1/issues/{key}/route-show inspection endpoint.
	RouteHistoryEvents(ctx context.Context, key string) ([]EventView, error)
	// ListDashboardRows returns one aggregated row per issue for the
	// `sorcererd dashboard` view: key + kind + state + state_kind +
	// last_change (unix seconds of the most-recent history row, or the
	// issue's updated_at when no history row exists). When
	// includeTerminal is false (the default), terminal issue / plan
	// states are filtered out so the dashboard's default "what's
	// in-flight?" view stays focused.
	ListDashboardRows(ctx context.Context, includeTerminal bool) ([]DashboardRow, error)
}

type IssueSummary = apiclient.IssueSummary

type Logger interface {
	Printf(format string, args ...any)
}

type PlanAddChildInput = apiclient.PlanAddChildInput

type PlanAddChildrenInput = apiclient.PlanAddChildrenInput

type PlanAddChildrenResult = apiclient.PlanAddChildrenResult

type PlanApproveProjector interface {
	ProjectApprovedChildren(ctx context.Context, proposalID int64) error
}

type PlanBranchCommit = apiclient.PlanBranchCommit

type PlanBranchRepoStatus = apiclient.PlanBranchRepoStatus

type PlanCitations = plan.CitationChecker

type PlanRefactorInput = apiclient.PlanRefactorInput

type PlanRefactorResult = apiclient.PlanRefactorResult

type PlanStore interface {
	// SubmitProposal persists one planner submission inside a single
	// BEGIN IMMEDIATE transaction. The handler-built `validate` callback
	// is invoked inside the transaction after all INSERTs but before
	// COMMIT; a non-empty return slice rolls back every write and
	// returns an error matching errors.Is(err, ErrValidationRejected)
	// with the joined slice as the wrapped message.
	//
	// envelope is the raw HTTP request body — stored byte-for-byte so
	// the dump endpoint can return it without re-marshaling.
	//
	// Returns (proposalID, mintedKeys, nil) on success.
	SubmitProposal(
		ctx context.Context,
		envelope []byte,
		plannerSession, originIssue string,
		now int64,
		issues []SubmittedIssue,
		validate PlanSubmitValidator,
	) (int64, []string, error)

	// ReviewProposal flips a proposal's outcome and every
	// proposal_id=<id> issue's state (approve → 'waiting' children;
	// reject → 'rejected' children) inside one transaction. When
	// planningKey is non-empty AND decision == "approve",
	// issue_materialized_children is populated.
	//
	// Returns ErrNotFound (unknown id), ErrProposalConflict (already
	// reviewed), or nil.
	ReviewProposal(
		ctx context.Context,
		proposalID int64,
		decision, summary, concerns, planningKey string,
		decidedAt int64,
	) error

	// GetProposalEnvelope returns the bytes from proposals.envelope
	// for the row at proposalID. Returns ErrNotFound when the id is
	// unknown.
	GetProposalEnvelope(ctx context.Context, proposalID int64) ([]byte, error)

	// ExistingIssueRefs returns one IssueRef per issuestore row,
	// keyed by SOR-N. Used by the submit handler to feed the
	// plan validator's cross-batch dep / canceled-dep checks.
	// StateType is the Linear-style classifier ("canceled" /
	// "completed" / "started") derived from the issue's state column.
	// Priority is the issue's stored Linear priority (0..4); rule 10
	// (ApplyChildPriority + the downgrade hard reject in
	// ValidatePlannerResult) reads it off the parent planning issue's
	// entry.
	ExistingIssueRefs(ctx context.Context) (map[string]plan.IssueRef, error)

	// NonTerminalImplCohort returns a snapshot of the non-terminal
	// implementation issues (state ∈ implementing | in_review |
	// awaiting_integration) that carry a materialized footprint, sorted by
	// key, for the proposal-time cross-impl footprint-overlap validator rule
	// (CIPB Phase E). Empty-footprint impls are excluded (no overlap is
	// computable). Returns nil without error when no in-flight impls exist.
	// The submit handler treats an error as fail-open (no cohort, the
	// cross-impl rule no-ops) so a flaky probe never blocks a proposal.
	NonTerminalImplCohort(ctx context.Context) ([]planvalidate.InFlightImpl, error)

	// PlanningKeyForPlannerSession resolves the planner session id to
	// the Linear key of the planning issue it was opened against. Used
	// by the submit handler to populate
	// ValidationContext.ParentIssueKey so rule 10 can inherit the
	// parent's priority onto omitted children and reject unjustified
	// downgrades. Returns ("", nil) when the session is unknown (e.g.
	// tests that don't seed sessions, or a session row that hasn't
	// been mirrored yet) — rule 10 then silently skips, which is the
	// right outcome for the no-parent case.
	PlanningKeyForPlannerSession(ctx context.Context, plannerSession string) (string, error)

	// SpecRequirementIDs returns the full R-ID set of the approved spec
	// backing the named planning issue (resolved via SpecAwarePlanning →
	// GetSpec → the spec DSL's Requirements[].ID), or (nil, nil) when the
	// planning issue is spec-unaware. The submit handler threads the result
	// into ValidationContext.RequirementIDs so the spec-driven verifies
	// rules fire only on spec-driven dispatches. Fail-open: the handler
	// treats any error as "no spec" (legacy path) so a flaky spec probe
	// never blocks a proposal, matching the NonTerminalImplCohort /
	// PlanOpenPRCounter convention.
	SpecRequirementIDs(ctx context.Context, planningKey string) ([]string, error)

	// SpecRequirements returns the full approved-spec requirement set backing
	// the named planning issue (the same SpecAwarePlanning → GetSpec → spec
	// DSL chain as SpecRequirementIDs, but carrying each Requirement's
	// closer / terminal / after placement metadata), or (nil, nil) when the
	// planning issue is spec-unaware. The submit handler threads the result
	// into plan.CheckSpecPlacement so the deterministic R-ID coverage +
	// placement checks fire only on spec-driven dispatches. Fail-open with
	// the same convention as SpecRequirementIDs.
	SpecRequirements(ctx context.Context, planningKey string) ([]dsl.Requirement, error)

	// PlanningBody returns the stored body (Description) of the named planning
	// issue — the authoritative acceptance-criteria text the AC-coverage gate
	// checks the planner's children against. The submit handler threads the
	// result into lintProposalFromResult → Proposal.ParentBody so
	// DetectACCoverageGap reads the parent's ACs from the issuestore, never
	// from the planner's (untrusted) submission. Fail-open with the same
	// convention as SpecRequirements: returns ("", nil) on an empty key or an
	// unknown issue, and the caller treats any error as "no parent body" (the
	// gate short-circuits on an empty ParentBody) so a flaky probe never blocks
	// a proposal.
	PlanningBody(ctx context.Context, planningKey string) (string, error)

	// FindActiveProposalForSession returns the oldest non-rejected
	// proposal for plannerSession plus its envelope bytes verbatim.
	// "Active" means outcome IN ('pending', 'approved'); rejected
	// and abandoned rows are excluded. Returns (nil, nil, nil) when
	// no active row exists. Backs the SOR-93 duplicate-proposal
	// guard in handlePlanSubmit.
	FindActiveProposalForSession(ctx context.Context, plannerSession string) (*ActiveProposal, []byte, error)

	// AppendEvent appends one row to the issuestore's events table.
	// Used by handlePlanSubmit to audit the duplicate-proposal guard
	// (proposal_submit_idempotent on the 200 byte-equal retry path,
	// proposal_submit_refused on the 409 conflict path). Errors are
	// logged by the adapter and swallowed at the caller — a failed
	// audit row must NOT take down the user-facing response.
	AppendEvent(ctx context.Context, kind, subject, message string)
}

type PlanSubmitValidator func(envelope []byte, children []SubmittedIssue) []string

type RecoverBackend interface {
	ApplyRecoverSweep(ctx context.Context, kinds []string) (RecoverResponse, error)
}

type RecoverRequest = apiclient.RecoverRequest

type RecoverResponse = apiclient.RecoverResponse

type RecoverTransition = apiclient.RecoverTransition

type RequirementVerdictEntryView = apiclient.RequirementVerdictEntryView

type ReviewConcern struct {
	PR       string `json:"pr,omitempty"`
	File     string `json:"file,omitempty"`
	Line     int    `json:"line,omitempty"`
	Severity string `json:"severity"`
	Comment  string `json:"comment"`
}

type ReviewVerdictView = apiclient.ReviewVerdictView

type RoleHealthBackend interface {
	// ListRolePauses returns every row of role_health_pauses, ordered
	// by role for stable output. An empty result is a non-nil empty
	// slice (the JSON envelope is `{"pauses":[]}`).
	ListRolePauses(ctx context.Context) ([]RolePauseView, error)
	// ClearRolePause removes one row. Returns ErrRolePauseNotFound
	// when the role is not paused; the handler maps that to a
	// `cleared:false` body (still 200 — the absence of a pause
	// satisfies the request's intent). Any other error surfaces as
	// 500.
	ClearRolePause(ctx context.Context, role string) error
	// SetRolePause UPSERTs the role_health_pauses row from the given
	// operator-supplied input and emits the audit event. SOR-1364:
	// after the row + audit-event commit succeeds, the implementation
	// dispatches a daemon-side abort across every in-flight session of
	// the paused role; the second return is the count of sessions
	// walked to aborted (zero in the steady-state "no in-flight
	// session" path), surfaced through the wire-shape
	// RolePauseSetResponse.AbortedInFlightSessions field. Returns the
	// resulting RolePauseView on success; the caller renders it back
	// to the operator without a follow-up GET.
	SetRolePause(ctx context.Context, in SetRolePauseInput) (RolePauseView, int, error)
	// KnownRoles returns the set of role names the watchdog tracks
	// (the `daemon.role_health.roles` config slice). The POST handler
	// uses it to gate operator-set pauses to known roles only — a
	// `--pause-role bogus` typo surfaces as 400 rather than a
	// silently-orphaned row the watchdog ignores. Returns a fresh
	// slice; callers may mutate without affecting backend state.
	KnownRoles() []string
}

type RolePauseClearRequest = apiclient.RolePauseClearRequest

type RolePauseClearResponse = apiclient.RolePauseClearResponse

type RolePauseListResponse = apiclient.RolePauseListResponse

type RolePauseSetRequest = apiclient.RolePauseSetRequest

type RolePauseSetResponse = apiclient.RolePauseSetResponse

type RolePauseView = apiclient.RolePauseView

type RouteClassification struct {
	Action           string
	TargetDaemon     string
	TargetURL        string
	Rationale        string
	OverrideEvidence []string
}

type RouteClassifier interface {
	ClassifyRoute(ctx context.Context, body string, repos []string) (RouteClassification, error)
}

type RouteMoveForwardError struct {
	Message string
	Status  int
	Body    string
}

type RouteMoveRefusedError struct {
	Message string
	Hint    string
}

type SearchHit = apiclient.SearchHit

type SearchOptions = apiclient.SearchOptions

type SearchResults = apiclient.SearchResults

type SelfReflectionListResponse = apiclient.SelfReflectionListResponse

type SelfReflectionView = apiclient.SelfReflectionView

type SelfReflectionsBackend interface {
	// ListSelfReflections returns SelfReflectionView rows matching the
	// filter, newest-first. An empty result is a non-nil empty slice
	// (the JSON envelope is `{"self_reflections":[]}`).
	ListSelfReflections(ctx context.Context, filter SelfReflectionsFilter) ([]SelfReflectionView, error)
}

type SelfReflectionsFilter struct {
	SinceTS int64  // unix seconds; rows with ts >= SinceTS only when > 0
	Limit   int    // 0 → unlimited
	Blocker string // exact match on blocker
}

type Server struct {
	// contains filtered or unexported fields
}

type SetRolePauseInput struct {
	Role        string
	PausedAt    int64
	PausedUntil int64
	Reason      string
}

type SpecAmendResponse = apiclient.SpecAmendResponse

type SpecApproveResponse = apiclient.SpecApproveResponse

type SpecBackend interface {
	// GetCurrentSpec returns the current (highest-version) spec for a
	// planning issue plus its findings and the full version history.
	// Returns ErrSpecNotFound when no spec has been drafted.
	GetCurrentSpec(ctx context.Context, planningKey string) (SpecView, error)
	// GetSpecVersion returns an explicit historical spec version (plus that
	// version's findings and the full history). ErrSpecNotFound on a miss.
	GetSpecVersion(ctx context.Context, planningKey string, version int64) (SpecView, error)
	// VerifySpec re-runs the verifier pipeline against the current version,
	// replaces its persisted findings, emits spec_verified, and returns the
	// fresh finding set. ErrSpecNotFound / ErrSpecStateConflict on failure.
	VerifySpec(ctx context.Context, planningKey string) (SpecVerifyResponse, error)
	// ApplyPatch applies an RFC-6902 JSON-Patch to the current version
	// atomically (optionally resolving findingID; 0 = free-form edit),
	// re-enters verify, and emits spec_patch_applied. ErrSpecPatchFailed
	// when the atomic apply rolled back.
	ApplyPatch(ctx context.Context, planningKey string, findingID int64, patches json.RawMessage) (SpecPatchResponse, error)
	// AmendSpec dispatches a TASK: amend on the spec_drafter with the
	// operator's narrow change and emits spec_amend_dispatched. scope is the
	// local|structural discriminator ("" defaults to the full re-author
	// amend); the handler validates it before this call.
	AmendSpec(ctx context.Context, planningKey, narrowChange, reason, scope string) (SpecAmendResponse, error)
	// ApproveSpec transitions the planning issue spec_review → spec_approved
	// (precondition: no open error findings) and emits spec_approved.
	// ErrSpecApprovalBlocked / ErrSpecStateConflict on refusal.
	ApproveSpec(ctx context.Context, planningKey, reason string) (SpecApproveResponse, error)
	// SuppressFinding flips one finding open → suppressed with the
	// operator's reason and emits spec_finding_suppressed.
	// ErrSpecFindingNotFound on a miss.
	SuppressFinding(ctx context.Context, planningKey string, findingID int64, reason string) (SpecSuppressFindingResponse, error)
}

type SpecFindingView = apiclient.SpecFindingView

type SpecFindingsSummary = apiclient.SpecFindingsSummary

type SpecPatchResponse = apiclient.SpecPatchResponse

type SpecSuppressFindingResponse = apiclient.SpecSuppressFindingResponse

type SpecVerifyResponse = apiclient.SpecVerifyResponse

type SpecVersionMeta = apiclient.SpecVersionMeta

type SpecVersionView = apiclient.SpecVersionView

type SpecView = apiclient.SpecView

type StateDescriptor = apiclient.StateDescriptor

type StatesResponse = apiclient.StatesResponse

type StewardLedgerBackend interface {
	// CreateLedgerRow persists one steward_ledger row and returns it with the
	// AUTOINCREMENT id + stamped timestamps populated. ErrBadRequest on an
	// invalid row (empty row_type).
	CreateLedgerRow(ctx context.Context, req *CreateStewardLedgerRowRequest) (StewardLedgerCreateResponse, error)
	// ListLedgerRows returns every row (id ASC); a non-empty rowType filters
	// to that kind.
	ListLedgerRows(ctx context.Context, rowType string) (StewardLedgerListResponse, error)
	// UpdateLedgerRow overwrites every mutable column of the row identified by
	// req.Row.ID. ErrNotFound on a miss, ErrBadRequest on an invalid row.
	UpdateLedgerRow(ctx context.Context, req *UpdateStewardLedgerRowRequest) error
	// ExpireLedgerRow hard-deletes the row with the given id. ErrNotFound on a
	// miss.
	ExpireLedgerRow(ctx context.Context, id int64) error
	// AnswerQuestion resolves the operator-question row id by applying the
	// option labeled chosenLabel through the daemon's normal mutation surface
	// and then expiring the row (SOR-2663, R17). ErrNotFound when the row is
	// absent; ErrBadRequest when it is not an operator-question, the options are
	// unparseable, no option matches chosenLabel, or the action kind is unknown.
	AnswerQuestion(ctx context.Context, id int64, chosenLabel string) error
}

type StewardLedgerCreateResponse = apiclient.StewardLedgerCreateResponse

type StewardLedgerListResponse = apiclient.StewardLedgerListResponse

type StewardLedgerRowView = apiclient.StewardLedgerRowView

type SubmittedIssue = apiclient.SubmittedIssue

type SubscriptionBackend interface {
	// ListSubscriptions returns every OAuth-pool entry's wire view,
	// ordered by the picker's internal token-slice order for stable
	// output. An empty result is a non-nil empty slice (the JSON
	// envelope is `{"subscriptions":[]}`).
	ListSubscriptions(ctx context.Context) ([]SubscriptionView, error)
	// ClearSubscription zeroes the named token's unavailableSince /
	// unavailableReason fields on the picker and writes an audit
	// event. Returns the prior reason (empty when the token was
	// already healthy) and the post-clear wire view. Returns
	// ErrSubscriptionNotFound when name is not a registered token
	// (the handler maps that to 404).
	ClearSubscription(ctx context.Context, name string) (priorReason string, post SubscriptionView, err error)
	// ResetSubscriptions clears a subscription's blocked state in place
	// (both the throttle cooldown AND the auth-dead flag) and writes a
	// subscription_reset audit event. When all is true the whole pool is
	// reset; otherwise the single token named by name. Returns the
	// post-reset wire views of the affected token(s) and the number of
	// tokens reset. Returns ErrSubscriptionNotFound when a single-name
	// reset targets a name that is not a registered token (the handler
	// maps that to 404). The handler validates the name/all one-of
	// before calling, so exactly one is set here.
	ResetSubscriptions(ctx context.Context, name string, all bool) (post []SubscriptionView, count int, err error)
}

type SubscriptionClearResponse = apiclient.SubscriptionClearResponse

type SubscriptionListResponse = apiclient.SubscriptionListResponse

type SubscriptionResetRequest = apiclient.SubscriptionResetRequest

type SubscriptionResetResponse = apiclient.SubscriptionResetResponse

type SubscriptionView = apiclient.SubscriptionView

type TopologyLookup interface {
	AuthTokenHashOf(daemonName string) string
}

type UpdateStewardLedgerRowRequest = apiclient.UpdateStewardLedgerRowRequest