model

type APIToken struct {
	ID        int64  `json:"id"`
	UserID    int64  `json:"user_id"`
	Label     string `json:"label"`
	TokenHash string `json:"-"`
	// Scopes is the comma-separated allow-list of what this token may do.
	// ⚠⚠ An EMPTY list grants NOTHING (HasScope answers false). Until
	// v0.43.0 it meant "every scope", `admin` included, and a token created
	// with nothing ticked could read the admin API; every door that issues a
	// token now refuses an empty list (400 scopes_required), and a stored
	// empty row fails closed. Do not restore the old reading — the reasoning
	// is in auth/drivers/apitoken/issue.go.
	Scopes string `json:"scopes"`
	// Usernames is the comma-separated allow-list of identities a caller may
	// act under (X-Filex-Token-User); the FIRST entry is the default. One
	// durable token often serves several consumers (work panel, PWA, a PC MCP
	// client) — the chosen username is what audit, shares and presence show.
	// Empty == only the token's label is usable (legacy behavior).
	Usernames string `json:"usernames"`
	// Kind is what this credential IS — TokenKindUser (a person's own: CLI,
	// WebDAV, SFTP, S3, `filex mount`) or TokenKindApp (an integration: a host
	// app's proxy, a bot, an MCP client). Every token acts as its owner either
	// way; kind only decides whether the identity-bearing surfaces are drawn
	// for it. See NormalizeTokenKind for why "" reads as app.
	Kind string `json:"kind"`
	// Source is which door minted the token (migration 00060): TokenSourceDesktop
	// for a desktop pairing, "" for every other. It decides which permission
	// USING the token falls under — access.desktop or access.api (package perm).
	Source string `json:"source,omitempty"`
	// Permissions is the level this token holds of each permission of the
	// catalogue (package tokenperm): the level its Scopes name, the
	// permission's default for the rest. Never stored - the token lists and
	// mint answers fill it (WithPermissions), so a screen draws a token's
	// levels without a copy of the default rule.
	Permissions map[string]tokenperm.Level `json:"permissions,omitempty"`
	LastUsedAt  *time.Time                 `json:"last_used_at,omitempty"`
	ExpiresAt   *time.Time                 `json:"expires_at,omitempty"`
	CreatedAt   time.Time                  `json:"created_at"`
}

type AppPlugin struct {
	ID int64 `json:"id"`
	// Name is the manifest's name, unique, [a-z0-9][a-z0-9_-]{0,31}. It names
	// the plugin's directory under <data-dir>/app-plugins/ and every menu key
	// (`plugin:<name>/<action>`).
	Name    string `json:"name"`
	Version string `json:"version"`
	// LabelJSON is the manifest label ({"en": …, "tr": …}) kept as-is so a
	// list can show it without parsing the whole manifest.
	LabelJSON string `json:"-"`
	// ManifestJSON is filex-app.json exactly as installed (validated).
	ManifestJSON string `json:"-"`
	// WasmPath is the module file inside the plugin's directory.
	WasmPath string `json:"-"`
	// SHA256 of the module as installed; checked again at every load. (Of
	// the manifest when there is no module: a language pack, an app that is
	// only an interface.)
	SHA256 string `json:"sha256"`
	// UISHA256 is the interface bundle's sha256 (ui.zip), checked again at
	// every load; "" when the app has no interface of its own (migration
	// 00065). Its first 16 hex digits are the interface's address.
	UISHA256 string `json:"ui_sha256,omitempty"`
	// Signature is the detached signature this version was installed with
	// ("" without one), kept so a roll-back to it can be held to the same
	// rule on an instance that only runs signed apps (migration 00066).
	Signature string `json:"-"`
	Source    string `json:"source"`
	SourceURL string `json:"source_url,omitempty"`
	Signed    bool   `json:"signed"`
	// PermissionsJSON is the grant the admin approved at install, a JSON
	// array of permission strings. It is what host functions check — never
	// the manifest's list, so an upgrade cannot widen it without a new
	// approval.
	PermissionsJSON string `json:"-"`
	Enabled         bool   `json:"enabled"`
	LastError       string `json:"last_error,omitempty"`
	// ManifestURL is where a URL install read filex-app.json (SourceURL is
	// the module's address for an app with one) — what the update check
	// re-reads. Empty for GitHub (SourceURL says repo@ref) and uploads
	// (migration 00063).
	ManifestURL string `json:"manifest_url,omitempty"`
	// AutoUpdate is filex 0.47's per-app switch for installing a newer version
	// by itself. Nothing reads it since 0.48 — nothing updates itself
	// (wasmplugin/updates.go); the column stays for older rows.
	AutoUpdate bool `json:"-"`
	// UpdateJSON is what the last update check found (wasmplugin.UpdateInfo),
	// kept so the Apps list can say it after a restart. "" = never checked.
	UpdateJSON string    `json:"-"`
	CreatedAt  time.Time `json:"created_at"`
	UpdatedAt  time.Time `json:"updated_at"`
}

type AppPluginJob struct {
	// ID is a random 32-hex token; pending_ops.dest carries it so the worker
	// can find this row from the queue row.
	ID         string `json:"id"`
	OpID       *int64 `json:"op_id,omitempty"`
	PluginID   int64  `json:"plugin_id"`
	PluginName string `json:"plugin"`
	ActionID   string `json:"action"`
	StorageID  int64  `json:"storage_id"`
	// PathsJSON is the JSON array of storage-relative input paths.
	PathsJSON string `json:"-"`
	// ParamsJSON is the JSON object of action parameters (from the form).
	ParamsJSON string `json:"-"`
	ActorID    *int64 `json:"actor_id,omitempty"`
	Locale     string `json:"locale,omitempty"`
	// Label is the action label in the actor's locale, resolved at submit so
	// the tray never has to know the manifest.
	Label   string `json:"label"`
	Status  string `json:"status"`
	Message string `json:"message,omitempty"`
	// OutputsJSON is the JSON array of {path} objects written once the
	// outputs are committed to the storage.
	OutputsJSON string     `json:"-"`
	Error       string     `json:"error,omitempty"`
	CreatedAt   time.Time  `json:"created_at"`
	FinishedAt  *time.Time `json:"finished_at,omitempty"`
}

type AppPluginLock struct {
	StorageID  int64      `json:"storage_id"`
	PathHash   string     `json:"-"`
	Rel        string     `json:"path"`
	PluginID   int64      `json:"plugin_id"`
	PluginName string     `json:"plugin"`
	Reason     string     `json:"reason,omitempty"`
	Until      *time.Time `json:"until,omitempty"`
	CreatedBy  *int64     `json:"created_by,omitempty"`
	CreatedAt  time.Time  `json:"created_at"`
}

type AppPluginOverride struct {
	PluginID    int64  `json:"-"`
	ActionID    string `json:"id"`
	Enabled     bool   `json:"enabled"`
	AdminOnly   bool   `json:"admin_only"`
	AppliesJSON string `json:"-"`
}

type AppPluginScheduleItem struct {
	PluginID int64  `json:"plugin_id"`
	Key      string `json:"key"`
	// DueAt is when this runs, to the second. Nothing runs before it.
	DueAt time.Time `json:"due_at"`
	// ActionID, StorageID, PathsJSON and ParamsJSON are the job to queue;
	// all four are empty on a wake-up row.
	ActionID   string `json:"action_id,omitempty"`
	StorageID  int64  `json:"storage_id,omitempty"`
	PathsJSON  string `json:"-"`
	ParamsJSON string `json:"-"`
	Status     string `json:"status"`
	// Attempts counts claims, so a row that keeps coming back says so.
	Attempts int `json:"attempts"`
	// ClaimedBy names the filex process that took the row (Registry.InstanceID).
	ClaimedBy string     `json:"claimed_by,omitempty"`
	ClaimedAt *time.Time `json:"claimed_at,omitempty"`
	// JobID is the app_plugin_jobs row this item became, once queued.
	JobID string `json:"job_id,omitempty"`
	// Error is why the last attempt did not queue work — or, on a wake-up
	// row, what the last wake-up decided.
	Error     string    `json:"error,omitempty"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}

type AppPluginSigningKey struct {
	ID          string     `json:"id"`
	TenantID    int64      `json:"tenant_id"`
	PluginID    int64      `json:"plugin_id"`
	Purpose     string     `json:"purpose"`
	Subject     string     `json:"subject"`
	CertPEM     string     `json:"cert_pem"`
	KeySealed   string     `json:"-"`
	CreatedAt   time.Time  `json:"created_at"`
	ExpiresAt   *time.Time `json:"expires_at,omitempty"`
	DestroyedAt *time.Time `json:"destroyed_at,omitempty"`
	RetiredAt   *time.Time `json:"retired_at,omitempty"`
}

type AppPluginStateFile struct {
	StorageID   int64  `json:"storage_id"`
	StorageName string `json:"storage"`
	Path        string `json:"path"`
	Name        string `json:"name"`
	Key         string `json:"key"`
	Value       string `json:"value"`
}

type AppPluginVersion struct {
	ID              int64     `json:"id"`
	PluginID        int64     `json:"plugin_id"`
	Version         string    `json:"version"`
	ManifestJSON    string    `json:"-"`
	WasmPath        string    `json:"-"`
	SHA256          string    `json:"sha256"`
	UISHA256        string    `json:"ui_sha256,omitempty"`
	PermissionsJSON string    `json:"-"`
	Source          string    `json:"source"`
	SourceURL       string    `json:"source_url,omitempty"`
	ManifestURL     string    `json:"manifest_url,omitempty"`
	Signed          bool      `json:"signed"`
	Signature       string    `json:"-"`
	Dir             string    `json:"-"`
	ReplacedBy      *int64    `json:"replaced_by,omitempty"`
	ReplacedAt      time.Time `json:"replaced_at"`
}

type AppPluginsCapabilities struct {
	Enabled bool `json:"enabled"`
	// Engines lists which heavy engines (ffmpeg, imagemagick, …) a plugin
	// may be handed on this host — informational for the admin panel.
	Engines map[string]bool `json:"engines,omitempty"`
}

type AppThumbLimits struct {
	PluginID    int64     `json:"plugin_id"`
	MaxInputMB  int       `json:"max_input_mb"`
	TimeoutS    int       `json:"timeout_s"`
	MemoryMB    int       `json:"memory_mb"`
	Concurrency int       `json:"concurrency"`
	UpdatedAt   time.Time `json:"updated_at"`
}

type AuditEntry struct {
	ID         int64                  `json:"id"`
	UserID     *int64                 `json:"user_id,omitempty"`
	Action     string                 `json:"action"`
	TargetType string                 `json:"target_type,omitempty"`
	TargetID   string                 `json:"target_id,omitempty"`
	Metadata   map[string]interface{} `json:"metadata,omitempty"`
	IP         string                 `json:"ip,omitempty"`
	CreatedAt  time.Time              `json:"created_at"`
}

type AuthBinding struct {
	ProviderID int64     `json:"provider_id"`
	InstanceID int64     `json:"instance_id"`
	Source     string    `json:"source"`
	CreatedAt  time.Time `json:"created_at"`
}

type AuthInstance struct {
	ID int64 `json:"id"`
	// Slug is the stable name. The first instance of each driver keeps the
	// driver's name, so the routes that addressed "the ldap" still do.
	Slug   string `json:"slug"`
	Driver string `json:"driver"`
	// Label is what the sign-in page calls it; "" = the driver's own words.
	Label  string `json:"label"`
	Origin string `json:"origin"`
	// OwnerProviderID is the tenant that made it (Origin == tenant), else nil.
	OwnerProviderID *int64 `json:"owner_provider_id,omitempty"`
	Enabled         bool   `json:"enabled"`
	// Legacy: saved before v0.43.0 and never applied; imported switched off.
	Legacy bool `json:"legacy,omitempty"`
	// ConfigJSON holds the driver's fields: field → value, every value a
	// string as the settings rows held them, a secret SEALED. Never sent to a
	// client as it is (authsetup redacts it).
	ConfigJSON string `json:"-"`
	// Promoted lists the scopes (tenant ids; 0 = the platform's own tenant) in
	// which an operating-system instance has already promoted its test
	// account: only the first switch-on in a scope promotes.
	Promoted  []int64   `json:"promoted,omitempty"`
	CreatedBy *int64    `json:"created_by,omitempty"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}

type BroadcastFilter struct {
	// Only admits just the broadcasts of these events. Wins over Except.
	// Only and Except narrow a per-user read and are ignored by the
	// admin-global one; ReaderID applies to both.
	Only []string
	// Except leaves out the broadcasts of these events.
	Except []string
	// ReaderID is whose read state a broadcast carries in this read
	// (migration 00056). For that reader a broadcast is read when it is at or
	// below their "mark all read" point, when they marked it on its own, or
	// when the row's own read_at was stamped before per-reader state existed.
	// 0 reads the row's own column only. A row addressed to a user always
	// carries that column.
	ReaderID int64
	// OwnOnly takes no broadcast at all, BroadcastsOnly none of the reader's
	// own rows — the two halves of a per-user read, read apart. A bell whose
	// broadcasts get a per-row pass after the store (a member's: the grants)
	// counts its own rows in SQL and walks only the broadcasts, so its total
	// is exact and its pages are cut where the reader sees them
	// (notify.Service.ListVisible). Ignored by the admin-global read.
	OwnOnly        bool
	BroadcastsOnly bool
	// Digest is the reader's notification digest (internal/notify digest.go,
	// migration 00087): which of their rows are "quiet" — held for the digest
	// rather than told one by one. Nil reads every row as it always was. Like
	// Only and Except it narrows a per-user read and is ignored by the
	// admin-global one, which is the audit.
	Digest *DigestFilter
}

type Capabilities struct {
	// Storage write operations.
	Upload  bool `json:"upload"`
	Move    bool `json:"move"`
	Copy    bool `json:"copy"`
	Delete  bool `json:"delete"`
	Mkdir   bool `json:"mkdir"`
	Presign bool `json:"presign"` // browser-direct uploads

	// Search & versioning.
	Search   bool `json:"search"`
	Versions bool `json:"versions"`

	// Thumbnail backends present in the runtime.
	Thumbs ThumbCapabilities `json:"thumbs"`

	// OCR reports whether the optional `tesseract` binary was found
	// (FILEX_TESSERACT_BIN or $PATH) — image text extraction for the
	// content search index (v0.2 "Bul").
	OCR bool `json:"ocr"`

	// Antivirus reports whether async upload scanning (v0.4 "Koru") is both
	// switched on and reachable-in-principle: the `antivirus.enabled`
	// setting is true AND either a scanner binary resolved or a clamd
	// address is configured.
	//
	// ⚠ It does not mean clamd ANSWERED. Reachability costs a network
	// round-trip and is probed where an operator is waiting for the answer
	// (GET /api/admin/protection), not on every capabilities fetch.
	Antivirus bool `json:"antivirus"`

	// AntivirusMode names HOW ClamAV is reached — "binary" (an executable on
	// filex's $PATH) or "daemon" (clamd over TCP / a unix socket); empty when
	// Antivirus is false. Two very different deployments produce the same
	// green light, and the person looking at it has to know which one
	// answered before they can debug it.
	AntivirusMode string `json:"antivirus_mode,omitempty"`

	// Per-storage capability probe — keyed by storage ID (string for JSON).
	Storage map[string]StorageCapabilities `json:"storage,omitempty"`

	// Plug-and-play external services.
	External map[string]ExternalServiceState `json:"external"`

	// Backend-effective limits.
	MaxUploadSize int64 `json:"max_upload_size"`
	ChunkSize     int64 `json:"chunk_size"`

	// Driver inventory (UI uses these to render the right login form,
	// drop-down for storage create wizard, etc.). Frontend has matching
	// defaults in stores/capabilities.ts so a missing field never
	// crashes a caller.
	AuthDrivers    []string `json:"auth_drivers"`
	StorageDrivers []string `json:"storage_drivers"`
	DBDriver       string   `json:"db_driver"`
	SearchEnabled  bool     `json:"search_enabled"`

	// OIDCAutoRedirect tells the login page to start the OIDC flow
	// immediately instead of showing the password form (SSO-first
	// installs, FILEX_OIDC_AUTO_REDIRECT). The form stays reachable via
	// ?local=1.
	OIDCAutoRedirect bool `json:"oidc_auto_redirect"`

	// AuthRecoveryLogin is true when password sign-in is off (no `local`
	// driver) but the bootstrap administrator may still use it, for recovery.
	// The login page then keeps the password form behind a recovery link
	// instead of hiding it altogether.
	AuthRecoveryLogin bool `json:"auth_recovery_login"`

	// Build metadata.
	Version string `json:"version"`
	Build   string `json:"build"`

	// Demo-mode toggles a public landing on Login.vue with an "Open
	// the demo" CTA that auto-submits the supplied creds.
	DemoMode bool   `json:"demo_mode"`
	DemoUser string `json:"demo_user,omitempty"`
	// DemoPass is the password that CTA submits (FILEX_DEMO_PASS). It is
	// emitted ONLY when DemoMode is on, where the credentials are published
	// on the landing page anyway - that is what a demo is. Without it the
	// button hardcodes "demo" and an operator who changes the password
	// breaks the button while believing they secured the instance.
	DemoPass string `json:"demo_pass,omitempty"`

	// DefaultLocale, when set (FILEX_DEFAULT_LOCALE), pins the initial UI
	// language for users who haven't picked one — overriding browser detection.
	DefaultLocale string `json:"default_locale,omitempty"`

	// AppPlugins says whether in-process WebAssembly app plugins are on
	// (internal/wasmplugin). When Enabled is false the explorer makes no
	// plugin calls at all.
	AppPlugins AppPluginsCapabilities `json:"app_plugins"`
}

type CatalogueCounts struct {
	Uncatalogued int64 `json:"uncatalogued"`
	Catalogued   int64 `json:"catalogued"`
	Watched      int64 `json:"watched"`
	// HeldBack counts folders whose last reconcile refused a deletion.
	HeldBack int64 `json:"held_back"`
	// RootCatalogued: the storage root's listing has been applied.
	RootCatalogued bool `json:"root_catalogued"`
}

type CatalogueFolder struct {
	StorageID int64
	PathHash  string
	// Path is canonical: "/" for the storage root, "/a/b" below it.
	Path  string
	Depth int
	State CatalogueFolderState
	// ReconciledAt is when the folder's last complete listing was applied.
	ReconciledAt *time.Time
	// VisitedAt is when a person last opened the folder.
	VisitedAt *time.Time
	// WatchedAt is when its current watch was placed; nil = no watch.
	WatchedAt *time.Time
	// ReconcileOnOpen: the watch was evicted, expired or lost with the
	// process, so the catalogue may have drifted from the disk.
	ReconcileOnOpen bool
	// Entries is how many entries the last listing held; HeldBack how many
	// deletions its guard refused to make.
	Entries  int
	HeldBack int
}

type CatalogueFolderFilter struct {
	// State, when set, keeps rows in that state only.
	State CatalogueFolderState
	// ReconciledBefore, when set, keeps catalogued rows whose last listing is
	// older than it — oldest first — instead of the shallowest-first frontier
	// order.
	ReconciledBefore *time.Time
	// Under, when set, keeps the folder itself and every folder below it.
	Under string
	Limit int
}

type CatalogueFolderState string

type ChunkedUpload struct {
	ID         string       `json:"id"`
	StorageID  int64        `json:"storage_id"`
	StorageKey string       `json:"storage_key"`
	UploadID   string       `json:"upload_id"`
	TotalSize  int64        `json:"total_size"`
	Parts      []UploadPart `json:"parts"`
	ExpiresAt  time.Time    `json:"expires_at"`
}

type CustomTheme struct {
	ID          int64             `json:"-"`
	Key         string            `json:"key"`
	Name        string            `json:"name"`
	TokensLight map[string]string `json:"light"`
	TokensDark  map[string]string `json:"dark"`
	CreatedAt   time.Time         `json:"-"`
	UpdatedAt   time.Time         `json:"-"`
}

type DigestFilter struct {
	// After is the reader's digest point (notify_digest_state.through_id):
	// every row at or below it has been told, on its own or in a digest.
	After int64
	// Quiet is the event kinds this reader holds for the digest. Empty: no row
	// is quiet.
	Quiet []string
	// Only reads the quiet rows alone, whatever their read state — what a
	// digest is made of — and UpTo, when above zero, stops at that id.
	Only bool
	UpTo int64
}

type DigestPolicy struct {
	Scope int64 `json:"-"`
	// WindowMinutes is how long the non-urgent notifications are held before
	// the digest that carries them is sent: 1-15.
	WindowMinutes int `json:"window_minutes"`
	// Urgent is the kinds that are told at once for everybody who did not
	// choose otherwise. Nil: the built-in list (notify.DefaultUrgentEvents).
	Urgent    []string  `json:"urgent_events"`
	UpdatedAt time.Time `json:"updated_at"`
}

type DomainCheck struct {
	// Text is the English sentence (ProviderDomain.LastError).
	Text   string
	Code   string
	Params map[string]string
}

type Draft struct {
	ID int64
	// Key is the `<draft key>` folder segment, and the draft's address in the
	// API (/api/files/drafts/{key}).
	Key       string
	UserID    int64
	StorageID int64
	NodeID    int64
	// TargetDir is the storage-relative folder the document is meant for,
	// "" for the storage root, no leading slash.
	TargetDir string
	// TargetName is the file name it is meant to have there.
	TargetName string
	// DocType is the New-document type it was made as (internal/newdoc key),
	// so a name with no extension still opens in the right editor.
	DocType   string
	CreatedAt time.Time
	UpdatedAt time.Time

	// Read from the draft file's catalogue row by the store's queries: where
	// the bytes are, how many there are, when they last changed, and whether
	// the row is live (a discarded draft's row is in the trash).
	Path     string
	Size     int64
	Mime     string
	Mtime    *time.Time
	NodeLive bool
}

type E2ERequest struct {
	ID int64
	// ProviderID is the tenant whose administrators decide; nil on a
	// single-tenant install.
	ProviderID *int64
	// UserID is who asked; Requester their name as shown when they asked.
	UserID    int64
	Requester string
	// StorageID and Path say where: the folder P approved. What it opens is
	// Kind's: P itself, encrypted in place (E2ERequestFolder); one NEW
	// encrypted folder directly inside P (E2ERequestNewFolder); or one single
	// encrypted file in P (E2ERequestFile). Storage-relative, no leading
	// slash, "" = the root.
	StorageID int64
	Path      string
	// Kind is E2ERequestFolder, E2ERequestNewFolder or E2ERequestFile.
	Kind string
	// Reason is the requester's own words.
	Reason string
	// Status is one of the E2ERequest* states.
	Status string
	// DecidedBy/Decider/DecidedAt: who closed the request and when (an
	// expired one: nobody).
	DecidedBy *int64
	Decider   string
	DecidedAt *time.Time
	// DecisionNote is a rejection's reason.
	DecisionNote string
	// ExpiresAt: a pending request past it expires, and so does an approval
	// nobody used.
	ExpiresAt time.Time
	// UsedAt is when the approved encryption happened (E2ERequestUsed).
	UsedAt    *time.Time
	CreatedAt time.Time
	UpdatedAt time.Time
}

type E2ERequestFilter struct {
	ProviderID *int64
	UserID     *int64
	Status     string
	// ExpiresBefore keeps what is due — an expiry at or before it — and lists
	// it oldest expiry first instead of newest first, so a sweep reading a
	// batch at a time reaches every due row, however many newer ones there
	// are.
	ExpiresBefore time.Time
	Limit         int
}

type ExternalServiceState struct {
	Enabled   bool       `json:"enabled"`
	URL       string     `json:"url,omitempty"`
	State     string     `json:"state"` // "ok", "unreachable", "unauthorized", "disabled"
	LastCheck *time.Time `json:"last_check,omitempty"`
	// Detail says what the probe saw when it did not get a healthy answer:
	// the HTTP status, a timeout, or the connection error (issue #17).
	// "unreachable" alone sent an operator to the network when the answer was
	// a 502 from the service's own web server.
	Detail string `json:"detail,omitempty"`
}

type FileAssociation struct {
	// Capability is "open" or "thumbnail".
	Capability string `json:"capability"`
	// Ext is the kind: a file name's extension, lower-case, no dot.
	Ext string `json:"ext"`
	// Handlers are the handler ids in the order they are asked
	// ("builtin", "app:<app>/<view>", "app:<app>").
	Handlers []string `json:"handlers"`
	// Off are the handler ids switched off for this kind.
	Off       []string  `json:"off"`
	UpdatedBy *int64    `json:"updated_by,omitempty"`
	UpdatedAt time.Time `json:"updated_at"`
}

type FileGrant struct {
	ID         int64  `json:"id"`
	StorageID  int64  `json:"storage_id"`
	PathPrefix string `json:"path_prefix"`
	IsDir      bool   `json:"is_dir"`
	UserID     int64  `json:"user_id,omitempty"`
	// GroupID is set instead of UserID on a group's grant
	// (group_file_grants, migration 00074): every member of the group holds
	// it. The two tables have their own ids — a grant is named by its id AND
	// which of the two it is.
	GroupID   int64     `json:"group_id,omitempty"`
	Level     string    `json:"level"`
	CreatedBy *int64    `json:"created_by,omitempty"`
	CreatedAt time.Time `json:"created_at"`

	// Enrichment fields (not persisted; filled by the permissions handler for
	// the UI panel). Left empty by the store scanners.
	UserEmail       string `json:"user_email,omitempty"`
	UserDisplayName string `json:"user_display_name,omitempty"`
	// UserName is the person as every screen names them (PersonLabel):
	// display name, else username, else e-mail. The panels print this; the
	// e-mail stays for the tooltip.
	UserName  string `json:"user_name,omitempty"`
	GroupName string `json:"group_name,omitempty"`
	Inherited bool   `json:"inherited,omitempty"`
}

type Group struct {
	ID          int64  `json:"id"`
	Name        string `json:"name"`
	Description string `json:"description"`
	ProviderID  *int64 `json:"provider_id,omitempty"`
	RoleID      *int64 `json:"role_id"`
	// GivesAdmin: the group makes its members administrators — the
	// built-in Administrator role, full access — instead of giving a role
	// (migration 00086). RoleID is then nil.
	GivesAdmin bool `json:"gives_admin"`
	// Priority orders the groups a member's role can come from: the
	// highest first, then the lowest id (perm.EffectiveRole).
	Priority int         `json:"priority"`
	Links    []GroupLink `json:"links"`
	// A group directory sync brought in (migration 00084): DirectoryID is
	// the directory group's permanent id ("ldap:…"), DirectoryName the name
	// it last had there, DirectoryState "" while the directory has it and
	// GroupDirectoryRemoved once it does not. All empty for every other
	// group.
	DirectoryID    string    `json:"directory_id,omitempty"`
	DirectoryName  string    `json:"directory_name,omitempty"`
	DirectoryState string    `json:"directory_state,omitempty"`
	CreatedBy      *int64    `json:"created_by,omitempty"`
	CreatedAt      time.Time `json:"created_at"`
	UpdatedAt      time.Time `json:"updated_at"`
}

type GroupLink struct {
	Kind  string `json:"kind"`
	Value string `json:"value"`
}

type GroupMember struct {
	GroupID int64     `json:"group_id"`
	UserID  int64     `json:"user_id"`
	Source  string    `json:"source"`
	AddedAt time.Time `json:"added_at"`
}

type LoginThrottle struct {
	ID int64 `json:"id"`
	// Scope is LoginThrottleAccount or LoginThrottleIP.
	Scope string `json:"scope"`
	// Subject is the normalized identifier, or the address.
	Subject string `json:"subject"`
	// Fails is the wrong attempts inside the current window.
	Fails int `json:"fails"`
	// LockLevel is how many locks in a row this subject has earned; the next
	// lock lasts twice as long as the previous, up to a ceiling.
	LockLevel   int        `json:"lock_level"`
	WindowStart time.Time  `json:"window_start"`
	LockedUntil *time.Time `json:"locked_until,omitempty"`
	LastFailAt  time.Time  `json:"last_fail_at"`
	// LastIP is the address of the most recent wrong attempt.
	LastIP string `json:"last_ip,omitempty"`
	// LastProtocol is the door it came through: web, dav, ftp, sftp, s3.
	LastProtocol string    `json:"last_protocol,omitempty"`
	UpdatedAt    time.Time `json:"updated_at"`
}

type NFSExport struct {
	ID     int64 `json:"id"`
	UserID int64 `json:"user_id"`
	// APITokenID ties this export to the token it inherits from, or nil when
	// minted from the account. The FK cascades, so revoking the token revokes
	// the mount with it.
	APITokenID *int64 `json:"api_token_id,omitempty"`
	Label      string `json:"label"`
	// TokenHash is sha256 of the path secret. The plaintext is shown once, at
	// creation, and never stored — this is a bearer credential the server only
	// has to compare, unlike an S3 secret which SigV4 must recompute from.
	TokenHash string `json:"-"`
	// StorageName/Prefix confine the mount, in the same shape the S3 keys use.
	// Empty StorageName means every storage the account can see.
	StorageName string `json:"storage_name,omitempty"`
	Prefix      string `json:"prefix,omitempty"`
	// ReadOnly makes this export refuse every write regardless of the
	// account's own permissions. An NFS mount is usually consumed by a MACHINE,
	// and "this one may only read" is the commonest thing to want to say.
	ReadOnly bool `json:"read_only"`
	// AllowCIDRs is a comma-separated allow-list. Empty means any address the
	// listener itself accepts.
	AllowCIDRs string `json:"allow_cidrs,omitempty"`

	CreatedAt  time.Time  `json:"created_at"`
	LastUsedAt *time.Time `json:"last_used_at,omitempty"`
	ExpiresAt  *time.Time `json:"expires_at,omitempty"`
	DisabledAt *time.Time `json:"disabled_at,omitempty"`
}

type NameMatch struct {
	// Words must ALL be in the name, compared the way internal/namefold
	// compares — composed, the four i's one letter, case folded — on both
	// sides. Each word is already folded that way. Checked after Runs.
	Words []string
	// Runs are ASCII text every stored spelling of a matching name holds as
	// it is (see namefold.Plain), so the database can reject most rows with
	// its own case-insensitive LIKE before the costlier comparison above.
	// They narrow nothing Words would not; they only make it cheap.
	Runs []string
	// Prefer decides which rows survive the LIMIT: names equal to it, or to
	// it plus an extension, first; then names starting with it; then the
	// rest — shorter names first within a tier, then by name. Folded like
	// Words. "" orders by name.
	Prefer string
}

type Node struct {
	ID           int64      `json:"id"`
	StorageID    int64      `json:"storage_id"`
	ParentID     *int64     `json:"parent_id,omitempty"`
	Name         string     `json:"name"`
	Path         string     `json:"path"`
	PathHash     string     `json:"path_hash"`
	StorageKey   string     `json:"storage_key,omitempty"`
	Type         NodeType   `json:"type"`
	Size         int64      `json:"size"`
	Mime         string     `json:"mime,omitempty"`
	Etag         string     `json:"etag,omitempty"`
	BackendMtime *time.Time `json:"backend_mtime,omitempty"`
	DBMtime      time.Time  `json:"db_mtime"`
	SyncState    SyncState  `json:"sync_state"`
	// TransferState is "stored" (the bytes are on the driver) or "staged" (the
	// row exists and is listed, but the bytes are still in filex's staging area
	// while a background upload-commit op transfers them). Everything written
	// before staged uploads existed reads back "stored".
	TransferState string     `json:"transfer_state,omitempty"`
	SeenAt        time.Time  `json:"seen_at"`
	DeletedAt     *time.Time `json:"deleted_at,omitempty"`
	CreatedAt     time.Time  `json:"created_at"`
	UpdatedAt     time.Time  `json:"updated_at"`

	// ─── Ownership (migration 00004 + 00038) ───
	//
	// OwnerID is who PUT THE THING HERE. nil means SYSTEM: nobody put it here
	// through filex — the storage scanner found it, it was written straight
	// into the bucket, or the row predates the column. "System" is the honest
	// word for ownerless, and no user is invented to stand in for it.
	//
	// It is set by the acting identity on every write surface (browser upload,
	// new folder, save, WebDAV/FTPS/SFTP/S3/CLI/desktop under the account whose
	// token was used) and it does NOT move afterwards: a move or a rename is
	// the same file, and an overwrite changes the bytes, not whose file it is.
	// The one exception is adoption — a system row (nil) that a user writes
	// becomes that user's, because "nobody's" is not somebody else's.
	OwnerID *int64 `json:"owner_id,omitempty"`
	// LastActorID is who touched it LAST. nil means system for the same reason
	// OwnerID does: a change that arrived from outside filex (the bucket side
	// changed, a sync found new bytes) has no actor to name.
	LastActorID *int64 `json:"last_actor_id,omitempty"`
	// ExternalUpload marks a thing that arrived through an anonymous drop link
	// / file request. The owner is the person who CREATED the link — they asked
	// for the file, it lands in their storage and it is billed to their quota —
	// but the row still has to be able to say the bytes were handed over by
	// somebody else. That somebody is anonymous by design and gets no identity.
	ExternalUpload bool `json:"external_upload,omitempty"`
	// DeletedBy is who put it in the TRASH (migration 00061): the person whose
	// delete it was, named on the row and on every row trashed with it, since
	// the trash lists a folder's contents as rows of their own. nil when
	// nobody in filex did it (the scanner found the object gone, the virus
	// scan quarantined it) or the row was trashed before filex kept this. A
	// restore clears it; so does every soft delete, before the person is
	// named, so a name never outlives the trip through the trash it was for.
	DeletedBy *int64 `json:"deleted_by,omitempty"`

	// UnavailableReason is what the storage answered when the sync last asked
	// whether this row's object still exists and got neither "yes" nor "not
	// found" (migration 00078, issue #104): a plugin that does not speak Stat
	// for it, a permission it lacks, a backend error. Empty for an ordinary
	// row. A row that carries one is listed with a warning, and every
	// operation on it - and below it, for a folder - is refused with 409
	// ENTRY_UNAVAILABLE until the storage answers for it again.
	UnavailableReason string `json:"unavailable_reason,omitempty"`
	// UnavailableAt is when the storage last gave that answer.
	UnavailableAt *time.Time `json:"unavailable_at,omitempty"`
	// Unavailable is UnavailableReason != "", set by the store when it reads
	// the row, so a JSON reader (the AI/MCP answers) has a flag to test.
	Unavailable bool `json:"unavailable,omitempty"`

	// LinkState is why a symlink row (NodeTypeSymlink) is a link filex will
	// not follow: the driver's storage.MetaLinkState - outside_root, broken,
	// unresolved - as the sync last listed it (migration 00098). Empty when no
	// reason is known: a row catalogued before 0.54 until the next sync of its
	// folder, or a driver that gives none.
	//
	// ⚠ The common node reads (GetNode, ListNodesByParent, ...) leave it
	// empty. A listing asks Store.NodeLinkStates for its link rows
	// (handlers hydrateLinkStates); db.NodeLinkStateSQL says why.
	LinkState string `json:"link_state,omitempty"`

	// OwnerName is the owner's display name, resolved in one batched lookup by
	// the API layer for the rows it is about to return. Never persisted, and
	// empty for a system row — the client decides what to call "nobody".
	OwnerName string `json:"owner_name,omitempty"`
	// LastActorName is the same for LastActorID.
	LastActorName string `json:"last_actor_name,omitempty"`

	// Optional joined data — populated by API layer, never persisted.
	Thumb *Thumbnail        `json:"thumb,omitempty"`
	Meta  map[string]string `json:"meta,omitempty"`
	// Storage is the NAME of the storage holding this node, filled by the
	// handlers that return nodes outside a folder listing (starred, recently
	// opened). Those rows carry only a numeric storage_id, and a client in
	// multi-storage mode cannot build the `name://path` it needs to open one —
	// so the recently-opened tray listed files that did nothing when clicked.
	Storage string `json:"storage,omitempty"`
}

type NodeComment struct {
	ID        int64      `json:"id"`
	NodeID    int64      `json:"node_id"`
	UserID    int64      `json:"user_id"`
	Body      string     `json:"body"`
	CreatedAt time.Time  `json:"created_at"`
	UpdatedAt time.Time  `json:"updated_at"`
	DeletedAt *time.Time `json:"deleted_at,omitempty"`

	// AuthorName is the joined users.display_name (falling back to email)
	// filled by ListNodeComments. Not persisted.
	AuthorName string `json:"author_name,omitempty"`
	// CanDelete marks whether the CURRENT caller may delete this comment
	// (author or admin). Computed by the API layer. Not persisted.
	CanDelete bool `json:"can_delete,omitempty"`
}

type NodeType string

type NodeVersion struct {
	ID         int64     `json:"id"`
	NodeID     int64     `json:"node_id"`
	VersionN   int       `json:"version_n"`
	StorageKey string    `json:"storage_key,omitempty"`
	Size       int64     `json:"size"`
	Etag       string    `json:"etag,omitempty"`
	CreatedAt  time.Time `json:"created_at"`
}

type Notification struct {
	ID            int64           `json:"id"`
	Event         string          `json:"event"`
	Severity      string          `json:"severity"`
	Title         string          `json:"title"`
	Body          string          `json:"body"`
	MetaJSON      json.RawMessage `json:"meta"`
	UserID        *int64          `json:"user_id,omitempty"`
	ReadAt        *time.Time      `json:"read_at,omitempty"`
	WebhookStatus string          `json:"webhook_status"`
	WebhookError  string          `json:"webhook_error,omitempty"`
	CreatedAt     time.Time       `json:"created_at"`

	// WebhookReason is, at read time, the webhook cell's second half in the
	// reader's language (notify.WebhookReason): why a delivery was skipped,
	// in the server's words - WebhookError keeps the code (no_destination,
	// digest_unnamed, sibling, stopped) - or a failed delivery's error as the
	// receiver gave it. Never stored.
	WebhookReason string `json:"webhook_reason,omitempty"`

	// Target is derived from MetaJSON at read time (HydrateTarget), never
	// stored in a column of its own. Absent on rows that have nothing to
	// open — the client reads a missing `target` as kind "none".
	Target *NotificationTarget `json:"target,omitempty"`

	// UserName is the display name of the person a user-scoped row belongs
	// to, filled on the admin list only (notify.Service.List with no user).
	// The audit page's Scope column printed `user #2` — a database id is not
	// who somebody is (release-candidate sweep, 2026-09-21).
	UserName string `json:"user_name,omitempty"`

	// AdminsOnly marks, on the admin list, a broadcast only administrators'
	// bells show (an operator alarm such as update_available): its Scope is
	// "Administrators", not "Everyone". Kept beside Audience for clients that
	// read only this flag; it is exactly Audience == "admins".
	AdminsOnly bool `json:"admins_only,omitempty"`

	// Audience says, on the admin list, who a BROADCAST reaches — the same
	// rule the bells apply (notify.BroadcastAudience): "everyone", "viewers"
	// (administrators and the members who can see the file it names),
	// "admins", or "nobody" (routine file activity recorded without the
	// person who did it — kept in the history, shown in no bell). Empty on a
	// row addressed to somebody, and on every row a bell hands out.
	Audience string `json:"audience,omitempty"`

	// E2E is set, at read time, on a row whose sentence names an item inside
	// an end-to-end encrypted folder (notify.SayRows): Title and Body then say
	// "🔒 Encrypted item" there, and E2E says where those words stand, so a
	// browser that has the folder unlocked puts the item's real name in their
	// place. Never stored.
	E2E *NotificationE2E `json:"e2e,omitempty"`

	// Opens says, at read time, whether a click on the row goes somewhere
	// (notify.Opens - the one rule the bell's rows, the page's pop-up and a
	// push follow). Never stored.
	Opens *bool `json:"opens,omitempty"`
}

type NotificationE2E struct {
	Title []NotificationTextPart `json:"title"`
	Body  []NotificationTextPart `json:"body"`
	Names []NotificationE2EName  `json:"names"`
}

type NotificationE2EName struct {
	// Wire is the item as listings address it, "<storage>://<path>", its
	// encrypted segments as stored.
	Wire string `json:"wire"`
	// Root is the encrypted folder it is in, "<storage>://<root>".
	Root string `json:"root"`
	// Part is "name" (the item's own name) or "path" (where it is, from the
	// encrypted folder down).
	Part string `json:"part"`
	// Locked is what the name reads as without the folder's key: the lock
	// word, or "<root>/…/<lock word>" for a path.
	Locked string `json:"locked"`
}

type NotificationInput struct {
	Event    string
	Severity string
	Title    string
	Body     string
	MetaJSON json.RawMessage
	UserID   *int64
}

type NotificationOpen struct {
	Plugin string `json:"plugin"`
	Action string `json:"action,omitempty"`
	View   string `json:"view,omitempty"`
	// Section is the part of a home page to land on (TargetApp only).
	Section string `json:"section,omitempty"`
}

type NotificationSettings struct {
	UserID         int64           `json:"user_id"`
	InAppEnabled   bool            `json:"in_app_enabled"`
	MutedEventsRaw json.RawMessage `json:"muted_events"`
	// UrgentOverridesRaw is the person's own urgent choices (migration
	// 00087): a JSON object {"<event>": true|false}; a kind it does not name
	// follows the administrator's default. ⚠ Nil on a write keeps what is
	// stored: a client that knows nothing of the digest (an older desktop
	// app) resends the two fields above and must not wipe these.
	UrgentOverridesRaw json.RawMessage `json:"urgent_overrides,omitempty"`
}

type NotificationTarget struct {
	Kind    NotificationTargetKind `json:"kind"`
	Storage string                 `json:"storage,omitempty"`
	Path    string                 `json:"path,omitempty"`
	// ID is the opaque id of a target that is not a path — the share token
	// for TargetShare.
	ID string `json:"id,omitempty"`
	// Open, when set, says what to do once the file is reached: start an
	// app-plugin action or view on it (a "sign this" notification lands the
	// reader in the signing screen, not merely on the file).
	Open *NotificationOpen `json:"open,omitempty"`
}

type NotificationTargetKind string

type NotificationTextPart struct {
	Text string `json:"text,omitempty"`
	Name *int   `json:"name,omitempty"`
}

type OfficeSession struct {
	// DocKey is the session's document.key.
	DocKey string `json:"doc_key"`
	NodeID int64  `json:"node_id"`
	// Size, MtimeNs (Unix nanoseconds, 0 = none) and Etag ("" = none) are the
	// version the storage driver reported.
	Size    int64  `json:"size"`
	MtimeNs int64  `json:"mtime_ns"`
	Etag    string `json:"etag,omitempty"`
	// Unknown: the session is on an older version, which one is not known.
	Unknown bool `json:"unknown,omitempty"`
	// Dropped: the person chose the outside version; the save is not written.
	Dropped bool `json:"dropped,omitempty"`
	// ExpiresUnix is when the row may be removed (Unix seconds).
	ExpiresUnix int64 `json:"expires_unix"`
}

type PermRuleConditions struct {
	// StorageIDs limits the rule to these storages; empty is every storage.
	StorageIDs []int64 `json:"storage_ids,omitempty"`
	// Paths limits it to storage-relative paths matching any of these
	// patterns: "Archive" or "Archive/**" (that folder and everything in
	// it), "*" within a segment ("*.psd", "Clients/*/Contracts/**").
	Paths []string `json:"paths,omitempty"`
}

type PermRuleSettings struct {
	// ShareLinkMaxDays caps a public link's lifetime; also forbids links
	// with no expiry.
	ShareLinkMaxDays *int `json:"share_link_max_days,omitempty"`
	// ShareLinkPasswordRequired refuses a public link without a password.
	ShareLinkPasswordRequired bool `json:"share_link_password_required,omitempty"`
	// BlockedExtensions refuses uploads by file extension, lowercase and
	// without the dot ("exe", "bat").
	BlockedExtensions []string `json:"blocked_extensions,omitempty"`
	// MaxUploadBytes caps a single file's size.
	MaxUploadBytes *int64 `json:"max_upload_bytes,omitempty"`
	// Require2FA refuses a session to an account without TOTP enabled.
	Require2FA bool `json:"require_2fa,omitempty"`
	// Apps are the role's decisions about app permissions (perm/app.go):
	// "app.sign.request" → allow | deny. A key it does not name follows the
	// built-in role's decision, then the app's own default.
	Apps map[string]string `json:"apps,omitempty"`
}

type PermRuleTarget struct {
	Kind  string `json:"kind"`
	Value string `json:"value,omitempty"`
}

type PermissionRule struct {
	ID          int64  `json:"id"`
	Name        string `json:"name"`
	Description string `json:"description"`
	// Names and Descriptions are the role in other interface languages
	// (migration 00071): language code → text, {"tr": "Muhasebe"}. Name and
	// Description stay the role's own — the answer for a language without an
	// entry, and what the audit log records. Pick for a reader with NameFor
	// and DescriptionFor, never by indexing these.
	Names        map[string]string `json:"names,omitempty"`
	Descriptions map[string]string `json:"descriptions,omitempty"`
	Enabled      bool              `json:"enabled"`
	// Permissions is the role's own list (migration 00069): what its people
	// may do everywhere.
	Permissions []string           `json:"permissions"`
	ProviderID  *int64             `json:"provider_id,omitempty"`
	Targets     []PermRuleTarget   `json:"targets"`
	Effects     map[string]string  `json:"effects"`
	Settings    PermRuleSettings   `json:"settings"`
	Conditions  PermRuleConditions `json:"conditions"`
	CreatedBy   *int64             `json:"created_by,omitempty"`
	CreatedAt   time.Time          `json:"created_at"`
	UpdatedAt   time.Time          `json:"updated_at"`
}

type Plugin struct {
	ID int64 `json:"id"`
	// Name is the operator-chosen identifier, unique, [a-z0-9][a-z0-9_-]{0,31}.
	// It names the plugin's directory and appears in logs; the DRIVER name is
	// what the plugin itself describes, and may differ.
	Name string `json:"name"`
	Kind string `json:"kind"`
	// Binary is the file name inside <data-dir>/plugins/<name>/ (kind binary).
	Binary string `json:"binary,omitempty"`
	// SHA256 of the binary as installed. Checked again on every start: a file
	// that changed under filex is refused, not run.
	SHA256 string `json:"sha256,omitempty"`
	// Address is the remote base URL (kind remote), http(s)://host:port[/path].
	Address string `json:"address,omitempty"`
	// TokenSealed is the bearer token, sealed with the instance secret key
	// (secretbox). For a binary plugin filex minted it and hands it to the
	// process at start; for a remote one the admin supplied it. Never on the
	// wire.
	TokenSealed string `json:"-"`
	Enabled     bool   `json:"enabled"`

	// Version and Driver are the last values the plugin described, kept so
	// the list can show them while a plugin is stopped.
	Version string `json:"version,omitempty"`
	Driver  string `json:"driver,omitempty"`
	// LastError is the last start/validation failure, cleared on success.
	LastError string `json:"last_error,omitempty"`

	// Source is where newer versions of a binary plugin are published:
	// `owner/name` (the filex-storage.json attached to the repository's
	// latest release) or the https address of a filex-storage.json feed.
	// Empty = none (plugin/updates.go).
	Source string `json:"source,omitempty"`
	// UpdateJSON is what the last update check found (plugin.UpdateInfo);
	// the admin reads it as Status.Update.
	UpdateJSON string `json:"-"`

	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}

type PluginRequest struct {
	ID int64
	// Key is random hex, unique: what the store reads a new row back by.
	Key string
	// Kind is PluginRequestKindApp or PluginRequestKindStorage.
	Kind string
	// Op is PluginRequestOpInstall or PluginRequestOpUpgrade.
	Op string
	// Name is the plugin's name: an app's manifest name, or the name a
	// storage plugin is (to be) installed under.
	Name string
	// PluginID is the installed plugin an upgrade replaces (app_plugins.id or
	// plugins.id, per Kind); nil for an install.
	PluginID *int64
	// SourceKind is github | url | source | from_source; SourceJSON the source
	// as given (pluginreq.Source), SourceKey the sha256 of its normalized form.
	SourceKind string
	SourceJSON string
	SourceKey  string
	// Version is what the source answered; FromVersion the version an upgrade
	// replaces.
	Version     string
	FromVersion string
	// ManifestJSON is the resolved snapshot (an app's filex-app.json, a
	// storage plugin's filex-storage.json feed); ReviewJSON the dry run's
	// review, for the approval screen.
	ManifestJSON string
	ReviewJSON   string
	// SHA256 is what approval holds the bytes to (an app's module, or its
	// manifest when it has none; a storage plugin's binary). ManifestSHA256
	// pins an app's manifest, which the module's hash does not.
	SHA256         string
	ManifestSHA256 string
	// PermissionsJSON is the JSON array of permission ids the request asks to
	// grant, frozen at request time.
	PermissionsJSON string
	// RequestedBy is the account that asked (nil once deleted); Requester its
	// name as shown when it asked; TokenID/TokenLabel the API key it came
	// through (nil/"" from a session).
	RequestedBy *int64
	Requester   string
	TokenID     *int64
	TokenLabel  string
	// Reason is the requester's own words.
	Reason string
	// Status is one of the PluginRequestStatus* values.
	Status string
	// DecidedBy/Decider/DecidedAt: who closed the request and when (an
	// expired one: nobody, at its expiry).
	DecidedBy *int64
	Decider   string
	DecidedAt *time.Time
	// DecisionNote is a rejection's reason, or why the request was superseded.
	DecisionNote string
	// ResultJSON is what approval did — the installed plugin — or, while the
	// request stays pending, the last attempt's refusal.
	ResultJSON string
	ExpiresAt  time.Time
	CreatedAt  time.Time
	UpdatedAt  time.Time
}

type Provider struct {
	ID   int64  `json:"id"`
	Slug string `json:"slug"`
	// Realm is the tenant's sign-in name (migration 00073, package tenant):
	// the sign-in form's Realm field and `realm/name` over SFTP. Set when the
	// tenant is created and never changed — UpdateProvider does not write it.
	// Empty for the supertenant, which is signed in to with an empty realm.
	Realm    string `json:"realm"`
	Name     string `json:"name"`
	Host     string `json:"host,omitempty"`
	AuthType string `json:"auth_type"`

	OIDCIssuer       string `json:"oidc_issuer,omitempty"`
	OIDCClientID     string `json:"oidc_client_id,omitempty"`
	OIDCClientSecret string `json:"-"` // never serialized to the client
	OIDCRedirectURL  string `json:"oidc_redirect_url,omitempty"`
	RoleClaim        string `json:"role_claim,omitempty"`
	AdminGroup       string `json:"admin_group,omitempty"`

	// CookieDomain, when set (e.g. ".example.com"), is stamped as the Domain
	// attribute on this tenant's session cookie so the tenant's subdomains
	// share the session. Empty = derive from Host by dropping its first
	// label (files.example.com → .example.com), falling back to the global
	// FILEX_COOKIE_DOMAIN. Only consulted in multi-tenant mode.
	CookieDomain string `json:"cookie_domain,omitempty"`

	IsSupertenant bool `json:"is_supertenant"`
	Enabled       bool `json:"enabled"`

	// AllowInsecureAuth lets this tenant's own sign-in providers reach an
	// internal address and plain ldap:// (migration 00076,
	// docs/TENANT-ADMIN.md). Off by default; only a platform super
	// administrator sets it (db.Store.SetProviderAllowInsecureAuth), and
	// UpdateProvider never writes it.
	AllowInsecureAuth bool `json:"allow_insecure_auth"`

	// OIDCTrustEmail is the tenant's own OIDC's "trust this provider's email
	// addresses" (migration 00079, docs/SSO.md): every address it sends counts
	// as verified, `email_verified` or not. Off for a tenant made from 0.50 on;
	// ON for the ones an upgrade found (OIDCTrustEmailByUpgrade). Written by
	// db.Store.SetProviderOIDCTrustEmail only; UpdateProvider never writes it.
	OIDCTrustEmail bool `json:"oidc_trust_email"`
	// OIDCTrustEmailByUpgrade: the value above is the one the upgrade to 0.50
	// set, to keep the old behaviour, and nobody has saved it since. Filled
	// by the API from the upgrade's record, not a column.
	OIDCTrustEmailByUpgrade bool `json:"oidc_trust_email_by_upgrade,omitempty"`

	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}

type ProviderDomain struct {
	ID         int64  `json:"id"`
	ProviderID int64  `json:"provider_id"`
	Domain     string `json:"domain"`
	Status     string `json:"status"`
	// LastError is what the last check found when it did not find the CNAME
	// ("points at other.example", "no CNAME record").
	LastError string `json:"last_error,omitempty"`
	// LastErrorCode and LastErrorParams say the same as LastError for a
	// screen to put in the reader's language: one of the DomainWhy* codes and
	// its names (domain, found, target, tenant_domain, detail). LastError
	// stays the English sentence, for a log, a tool and a code a screen does
	// not know.
	LastErrorCode   string            `json:"last_error_code,omitempty"`
	LastErrorParams map[string]string `json:"last_error_params,omitempty"`
	CheckedAt       *time.Time        `json:"checked_at,omitempty"`
	ActiveSince     *time.Time        `json:"active_since,omitempty"`
	// TLSCertPEM is a certificate the tenant brought (the chain, PEM); its
	// key is sealed in TLSKeySealed and never sent to a client.
	TLSCertPEM   string     `json:"-"`
	TLSKeySealed string     `json:"-"`
	TLSNotAfter  *time.Time `json:"tls_not_after,omitempty"`
	CreatedBy    *int64     `json:"created_by,omitempty"`
	CreatedAt    time.Time  `json:"created_at"`
}

type ProviderE2E struct {
	// Allowed is the platform's ceiling, which only the supertenant changes.
	// Off: nobody in the tenant encrypts anything new, whatever the policy.
	Allowed bool
	// Policy is the tenant's own choice, one of the E2EPolicy* values.
	Policy string
}

type ProviderStorage struct {
	ProviderID int64 `json:"provider_id"`
	StorageID  int64 `json:"storage_id"`
}

type PushSubscription struct {
	ID           int64  `json:"id"`
	UserID       int64  `json:"-"`
	Endpoint     string `json:"-"`
	EndpointHash string `json:"endpoint_hash"`
	P256dh       string `json:"-"`
	Auth         string `json:"-"`
	// Label is what the device was called when it subscribed ("Chrome on
	// Android"), for the person's list.
	Label string `json:"label"`
	// Service is the push service's host (fcm.googleapis.com,
	// web.push.apple.com ...), filled when answered.
	Service string `json:"service,omitempty"`
	// ThroughID is the device's mark: every notification at or below it has
	// been pushed to it or passed over. A compare-and-set moves it, so two
	// servers never push one row twice.
	ThroughID int64 `json:"-"`
	// Failures counts the push service's refusals since the last push it
	// took; past a few the device is dropped.
	Failures  int        `json:"-"`
	CreatedAt time.Time  `json:"created_at"`
	LastOKAt  *time.Time `json:"last_ok_at,omitempty"`
}

type PushVAPIDKey struct {
	PublicKey     string
	PrivateSealed string
	CreatedAt     time.Time
}

type RecentSearch struct {
	ID     int64 `json:"id"`
	UserID int64 `json:"-"`
	// Surface is which search box kept it (RecentSearchSurfaceAdmin).
	Surface string `json:"-"`
	// Query is the words as typed, a prefix such as `file:` included.
	Query      string    `json:"query"`
	SearchedAt time.Time `json:"searched_at"`
}

type ReplicaFailure struct {
	ID            int64      `json:"id"`
	StorageID     int64      `json:"storage_id"`
	Path          string     `json:"path"`
	Op            string     `json:"op"`
	ErrorCode     string     `json:"error_code"`
	ErrorMsg      string     `json:"error_msg"`
	Attempts      int        `json:"attempts"`
	LastAttemptAt time.Time  `json:"last_attempt_at"`
	ResolvedAt    *time.Time `json:"resolved_at,omitempty"`
}

type ReplicaInitialCopy struct {
	StorageID int64  `json:"storage_id"`
	TargetID  int64  `json:"target_id"`
	Phase     string `json:"phase"`
	// Cursor is the last file the walk finished with, in the walk's own order
	// (internal/replica walk.go); the next slice starts after it. "" = from
	// the beginning of the phase.
	Cursor string `json:"-"`
	// Counted: Total is final (the counting walk finished).
	Counted bool `json:"counted"`
	// Total is the number of files on the storage (so far, while counting).
	Total int64 `json:"total"`
	// Copied, Present, Excluded and Failed add up to the files looked at:
	// written to the target, already there (same size, not older), left out
	// by a `skip` rule, failed (in replica_failures, Fix all replays them).
	Copied      int64  `json:"copied"`
	Present     int64  `json:"present"`
	Excluded    int64  `json:"excluded"`
	Failed      int64  `json:"failed"`
	CopiedBytes int64  `json:"copied_bytes"`
	LastError   string `json:"last_error,omitempty"`
	// StartedUnix, UpdatedUnix, FinishedUnix: Unix seconds; FinishedUnix is
	// 0 until the copy is done.
	StartedUnix  int64 `json:"started_unix"`
	UpdatedUnix  int64 `json:"updated_unix"`
	FinishedUnix int64 `json:"finished_unix"`
	// LeaseOwner/LeaseUntil: the worker running a slice of this copy now and
	// until when its claim holds (Unix seconds). Revision moves on every write
	// so an UPDATE always changes the row (MySQL counts changed rows).
	LeaseOwner string `json:"-"`
	LeaseUntil int64  `json:"-"`
	Revision   int64  `json:"-"`
}

type ReplicaLink struct {
	StorageID   int64  `json:"storage_id"`
	TargetID    int64  `json:"target_id"`
	Folder      string `json:"folder"`
	FolderKey   string `json:"-"`
	CreatedUnix int64  `json:"created_unix"`
}

type ReplicaRule struct {
	ID          int64     `json:"id"`
	PathPattern string    `json:"path_pattern"`
	Mode        string    `json:"mode"`
	Priority    int       `json:"priority"`
	Enabled     bool      `json:"enabled"`
	Description string    `json:"description"`
	CreatedAt   time.Time `json:"created_at"`
	UpdatedAt   time.Time `json:"updated_at"`
}

type ReplicaRuleInput struct {
	PathPattern string `json:"path_pattern"`
	Mode        string `json:"mode"`
	Priority    int    `json:"priority"`
	Enabled     bool   `json:"enabled"`
	Description string `json:"description"`
}

type ReplicaSettings struct {
	ReportCron    string `json:"report_cron"`
	ReportEnabled bool   `json:"report_enabled"`
	DefaultMode   string `json:"default_mode"`
}

type ReplicaStatusReport struct {
	GeneratedAt   time.Time       `json:"generated_at"`
	TotalFiles    int64           `json:"total_files"`
	FailedCount   int64           `json:"failed_count"`
	RepairedCount int64           `json:"repaired_count"`
	SummaryJSON   json.RawMessage `json:"summary"`
}

type ReplicationTarget struct {
	ID         int64           `json:"id"`
	Name       string          `json:"name"`
	Driver     string          `json:"driver"`
	ConfigJSON json.RawMessage `json:"config"`
	Mode       string          `json:"mode"` // "async" | "sync"
	Enabled    bool            `json:"enabled"`
	CreatedAt  time.Time       `json:"created_at"`
	UpdatedAt  time.Time       `json:"updated_at"`
}

type Role struct {
	ID          int64    `json:"id"`
	Name        string   `json:"name"`
	Permissions []string `json:"permissions"`
}

type S3AccessKey struct {
	ID int64 `json:"id"`
	// AccessKeyID is the public half — what the client puts in the
	// Authorization header, and what an incoming signature is looked up by.
	AccessKeyID string `json:"access_key_id"`
	// SecretEnc is the sealed secret. It is `json:"-"` for the same reason a
	// password hash is: the plaintext is shown exactly once, at creation, and
	// no listing endpoint may ever hand it back.
	SecretEnc string `json:"-"`
	UserID    int64  `json:"user_id"`
	// APITokenID ties the key to the token it inherits from, or nil when it was
	// minted straight from the account. The FK cascades, so revoking the token
	// revokes this key too — a credential must not outlive its parent.
	APITokenID *int64 `json:"api_token_id,omitempty"`
	Label      string `json:"label"`
	// Bucket/Prefix are the optional confinement, in the shape S3 clients
	// already understand (and IAM already models). Empty Bucket means every
	// storage the caller can see.
	Bucket string `json:"bucket,omitempty"`
	Prefix string `json:"prefix,omitempty"`

	CreatedAt  time.Time  `json:"created_at"`
	LastUsedAt *time.Time `json:"last_used_at,omitempty"`
	ExpiresAt  *time.Time `json:"expires_at,omitempty"`
	// DisabledAt turns the key off without deleting it, so an operator can stop
	// a leaked credential and still see it in the audit trail.
	DisabledAt *time.Time `json:"disabled_at,omitempty"`
}

type SSHPublicKey struct {
	ID     int64 `json:"id"`
	UserID int64 `json:"user_id"`
	// Name is the human label — the comment from the pasted key by default,
	// which is usually `user@machine` and is exactly what somebody needs to
	// decide which row to revoke.
	Name string `json:"name"`
	// Fingerprint is the SHA256 fingerprint OpenSSH prints, base64, without the
	// `SHA256:` prefix. It is what a login is looked up by.
	Fingerprint string `json:"fingerprint"`
	// PublicKey is the normalised wire form (`<type> <base64>`), so the key can
	// be shown back and exported.
	PublicKey string `json:"public_key"`

	CreatedAt  time.Time  `json:"created_at"`
	LastUsedAt *time.Time `json:"last_used_at,omitempty"`
	// DisabledAt switches a key off without deleting it, so a machine that is
	// away for a while can be stopped and restored rather than re-registered.
	DisabledAt *time.Time `json:"disabled_at,omitempty"`
}

type Session struct {
	ID        int64     `json:"id"`
	UserID    int64     `json:"user_id"`
	Token     string    `json:"-"`
	ExpiresAt time.Time `json:"expires_at"`
	IP        string    `json:"ip,omitempty"`
	UserAgent string    `json:"user_agent,omitempty"`
	CreatedAt time.Time `json:"created_at"`
}

type Share struct {
	ID      int64  `json:"id"`
	NodeID  int64  `json:"node_id"`
	Token   string `json:"token"`
	PinHash string `json:"-"`       // never serialized
	HasPin  bool   `json:"has_pin"` // computed
	// PinEnc is the SEALED PIN (internal/secretbox, AES-GCM under
	// FILEX_SECRET_KEY) — migration 00049. It exists so the link's owner and an
	// administrator can be told the PIN again; nothing ever verifies against
	// it, because PinHash above is still the gate (share/pin.go CheckPIN).
	//
	// ⚠ `json:"-"`, like the hash and for a stronger reason: a hash handed out
	// is a hash to crack offline, but a ciphertext handed out is one guess away
	// from the PIN for anyone who also gets the key. It leaves this process
	// only as PLAINTEXT, only through GET /api/shares/{id}/pin, only to the
	// creator or an admin, and only with an audit row written.
	PinEnc string `json:"-"`
	// PinRecoverable is computed: can this link's PIN still be shown? False
	// for a link minted before 00049, for one minted while the instance had no
	// FILEX_SECRET_KEY, and for one with no PIN at all. It carries no secret —
	// it is what lets a row say "this one cannot be shown" instead of offering
	// a copy button with nothing behind it.
	PinRecoverable bool       `json:"pin_recoverable"`
	ExpiresAt      *time.Time `json:"expires_at,omitempty"`
	MaxDownloads   *int       `json:"max_downloads,omitempty"`
	DownloadCount  int        `json:"download_count"`
	// VisitCount is how many times an APP page was opened (00052). Kept
	// apart from DownloadCount because a page view is not a download: a
	// signing link somebody had only looked at twice said "İndirme 2" in
	// My shares (2026-09-21). Always 0 for an ordinary share.
	VisitCount int    `json:"visit_count"`
	CreatedBy  *int64 `json:"created_by,omitempty"`
	// CreatedVia is the token username the creating API call acted under
	// ("work", "fishapp"…). Empty for browser-session shares. Display-only —
	// ownership/authorization stay on CreatedBy.
	CreatedVia string    `json:"created_via,omitempty"`
	CreatedAt  time.Time `json:"created_at"`

	// Drop-link fields (Kind == ShareKindDrop). Empty/zero for a normal
	// download share.
	Kind         string  `json:"kind"`                    // "download" | "drop"
	MaxUploads   *int    `json:"max_uploads,omitempty"`   // cap on total files received
	UploadCount  int     `json:"upload_count"`            // files received so far
	DropSettings *string `json:"drop_settings,omitempty"` // JSON limits blob (max_files, max_file_size_mb, allowed_ext, ask_name)

	// ── App-plugin page fields (migration 00046) ──
	//
	// An app plugin's public page IS a share: the plugin opens one through the
	// `share_create` host function and the visitor's link is /s/<token> like
	// every other, so the administrator sees and revokes it in Shares, the
	// expiry ceiling is the instance's, and there is ONE PIN implementation to
	// get right. Zero here means an ordinary share and every path behaves
	// exactly as it did before.
	PluginID int64  `json:"plugin_id,omitempty"`
	PageID   string `json:"page_id,omitempty"`
	// Subject is the line the public shell puts in its header ("Please sign
	// contract.pdf"). Host-owned; the plugin supplies it at creation.
	Subject string `json:"subject,omitempty"`
	// StateJSON is the PLUGIN's durable record for this link, read and
	// replaced by the share_state host function. Never serialized: it is the
	// app's own bookkeeping, not the visitor's business.
	StateJSON string `json:"-"`
	// FilesJSON lists the copies the plugin exposed to the visitor —
	// [{ref,name,file,size,mime}] — where `file` is the BASENAME inside the
	// share's directory under <data-dir>/app-plugins/public/<id>/. Never
	// serialized: the public API answers with refs, not with the layout on
	// disk.
	FilesJSON string `json:"-"`
	// PurposeJSON is what the app said this link IS when it opened it
	// (wire.PagePurpose, migration 00052): the only way a page-less link —
	// a plain share of a finished document — can be named for what it is in
	// a list of links. Not serialized: lists carry the resolved `app`
	// (db.AppLink) instead.
	PurposeJSON string `json:"-"`
	// AppRoot is the `root:` of the token whose app job opened this link
	// (`<adapter>://<rel>`, migration 00082), "" for a link opened with no
	// root. A visitor's job on the link runs as its creator with no token
	// behind it, so this is the root it is held to: the door stamps it on the
	// job (wasmplugin.StampJobRoot) as the token's own door would have. Never
	// serialized: it is the host's bookkeeping.
	AppRoot string `json:"-"`

	// PinFails / LockedUntil are the five-strikes-then-ten-minutes PIN lock,
	// which from 00046 covers EVERY public link rather than only an app page.
	// Never serialized: a strike counter a client can read is one it can pace
	// itself against.
	PinFails    int        `json:"-"`
	LockedUntil *time.Time `json:"-"`

	// RevokedAt is when a person (or the app that opened it) ENDED the link
	// (00053). Revoking also sets ExpiresAt to the same moment, which is what
	// stops the link working; this is only the word for it, so a screen can
	// say "revoked" rather than "expired" (QA, 2026-09-21: My shares said
	// "Süresi doldu" for a link revoked a minute earlier).
	//
	// ⚠ Filled by the LISTINGS (shareMetaCols), not by the single-row reads
	// (shareCols): those decide whether a link works, and that is the expiry.
	RevokedAt *time.Time `json:"revoked_at,omitempty"`

	// State is where the link stands - ShareStateActive, ShareStateExpired,
	// ShareStateExhausted or ShareStateRevoked - said by the server
	// (StateAt) on every LIST of links, so a screen shows the word instead of
	// working it out from the expiry on the browser's clock. Empty on a
	// single-row read, which decides whether the link works (IsExpired).
	State string `json:"state,omitempty"`
}

type StagedUpload struct {
	ID            string    `json:"id"`
	StorageID     int64     `json:"storage_id"`
	StorageKey    string    `json:"storage_key"`
	UserID        int64     `json:"user_id"`
	TotalSize     int64     `json:"total_size"`
	ChunkSize     int64     `json:"chunk_size"`
	Mime          string    `json:"mime,omitempty"`
	Hash          string    `json:"hash,omitempty"`
	ReceivedBytes int64     `json:"received_bytes"`
	State         string    `json:"state"`
	Error         string    `json:"error,omitempty"`
	NodeID        *int64    `json:"node_id,omitempty"`
	OpID          *int64    `json:"op_id,omitempty"`
	CreatedAt     time.Time `json:"created_at"`
	UpdatedAt     time.Time `json:"updated_at"`
	ExpiresAt     time.Time `json:"expires_at"`
}

type Storage struct {
	ID int64 `json:"id"`
	// UID is the address that does not move. The Name is what people read and
	// what the file protocols accept as the first path segment, which means
	// renaming a storage re-addresses it and every mount written against the
	// old name answers 404 (issue #21). The uid is assigned once, at creation,
	// and the protocols resolve it too — so a mount written against it
	// survives every rename. Empty only on a row from before the column
	// existed that the migration somehow did not reach.
	UID           string          `json:"uid,omitempty"`
	Name          string          `json:"name"`
	Driver        string          `json:"driver"`
	MountPath     string          `json:"mount_path"`
	ConfigJSON    json.RawMessage `json:"config"`
	SyncMode      SyncMode        `json:"sync_mode"`
	SyncIntervalS int             `json:"sync_interval_s"`
	LastSyncAt    *time.Time      `json:"last_sync_at,omitempty"`
	LastSyncToken string          `json:"last_sync_token,omitempty"`
	Enabled       bool            `json:"enabled"`
	ReadOnly      bool            `json:"read_only"`
	// RBACEnabled turns on per-user/per-item access control for this storage.
	// When false (default) the storage is visible to every authenticated user
	// and capability is governed purely by account role (RBAC-off passthrough,
	// preserving pre-00012 behavior). When true the storage is hidden by
	// default and only paths explicitly granted (directly or via an ancestor
	// folder) are visible; see internal/acl. Added in migration 00012.
	RBACEnabled bool      `json:"rbac_enabled"`
	CreatedAt   time.Time `json:"created_at"`
	// Replica pairing — `role` and `replica_of_id` are LEGACY columns
	// retained for backwards compatibility with v0.1.16 deployments
	// (SQLite can't DROP COLUMN cleanly). The current model lives in
	// `replica_target_id` — a foreign key into the new
	// `replication_targets` table. Set it via the Replikasyon page;
	// the wrapper Driver fan-outs writes to the linked target.
	Role            string `json:"role,omitempty"`
	ReplicaOfID     *int64 `json:"replica_of_id,omitempty"`
	ReplicaMode     string `json:"replica_mode,omitempty"`
	ReplicaTargetID *int64 `json:"replica_target_id,omitempty"`

	// SortOrder is the position the admin gave this storage (1 = first;
	// migration 00060, issue #57). NULL = not placed: listed after every
	// placed storage, in creation order. Written only by
	// Store.SetStorageOrder — CreateStorage leaves it NULL and UpdateStorage
	// never touches it. No omitempty: the admin list says null explicitly.
	SortOrder *int64 `json:"sort_order"`
}

type StorageCapabilities struct {
	Read bool `json:"read"`
	// Range reports ranged reads — the download endpoint answers 206 /
	// Content-Range for this storage instead of whole-object only.
	Range     bool `json:"range"`
	Write     bool `json:"write"`
	Move      bool `json:"move"`
	Copy      bool `json:"copy"`
	Delete    bool `json:"delete"`
	Mkdir     bool `json:"mkdir"`
	Presign   bool `json:"presign"`
	Multipart bool `json:"multipart"`
	Events    bool `json:"events"`
}

type SyncConflict struct {
	ID           int64      `json:"id"`
	NodeID       *int64     `json:"node_id,omitempty"`
	StorageID    int64      `json:"storage_id"`
	StorageKey   string     `json:"storage_key,omitempty"`
	DBEtag       string     `json:"db_etag,omitempty"`
	BackendEtag  string     `json:"backend_etag,omitempty"`
	DBMtime      *time.Time `json:"db_mtime,omitempty"`
	BackendMtime *time.Time `json:"backend_mtime,omitempty"`
	DetectedAt   time.Time  `json:"detected_at"`
	ResolvedAt   *time.Time `json:"resolved_at,omitempty"`
	Resolution   string     `json:"resolution,omitempty"` // backend_wins, db_wins, manual
}

type SyncMode string

type SyncRun struct {
	ID           int64      `json:"id"`
	StorageID    int64      `json:"storage_id"`
	StartedAt    time.Time  `json:"started_at"`
	FinishedAt   *time.Time `json:"finished_at,omitempty"`
	CursorBefore string     `json:"cursor_before,omitempty"`
	CursorAfter  string     `json:"cursor_after,omitempty"`
	SeenCount    int        `json:"seen_count"`
	Added        int        `json:"added"`
	Updated      int        `json:"updated"`
	Deleted      int        `json:"deleted"`
	Status       string     `json:"status"` // running, ok, partial, failed, aborted
	Error        string     `json:"error,omitempty"`
}

type SyncState string

type Tag struct {
	ID       int64  `json:"id"`
	Kind     string `json:"kind"`
	TenantID *int64 `json:"-"`
	OwnerID  *int64 `json:"-"`
	// Name is the display form, case preserved (tagname.Clean).
	Name string `json:"name"`
	// Key is the identity (tagname.Key) — never shown.
	Key       string    `json:"-"`
	CreatedAt time.Time `json:"-"`
}

type TagPlacement struct {
	TagID     int64
	NodeID    int64
	StorageID int64
	Path      string
}

type TagQuery struct {
	// OwnerID > 0 includes that person's personal tags.
	OwnerID int64
	// Team includes team tags; TeamTenants, when non-nil, restricts them to
	// those tenant ids (0 included explicitly when wanted). nil = every tenant
	// — only ever for an unconfined caller (single-tenant mode, supertenant).
	Team        bool
	TeamTenants []int64
}

type ThumbCapabilities struct {
	Image       bool `json:"image"`
	ImageMagick bool `json:"imagemagick"` // `magick`/`convert` binary present
	// HEIC: that ImageMagick DECODES a HEIC photo, measured by drawing a
	// sample (enginebin.HEIC), not inferred from ImageMagick being there:
	// libheif can be present without its HEVC decoder plugin (Ubuntu 24.04).
	HEIC   bool `json:"heic"`
	Video  bool `json:"video"`
	Audio  bool `json:"audio"`
	PDF    bool `json:"pdf"`
	Office bool `json:"office"`
	SVG    bool `json:"svg"`
}

type Thumbnail struct {
	NodeID      int64      `json:"node_id"`
	State       string     `json:"state"` // pending, ready, failed, skipped
	StorageKey  string     `json:"storage_key,omitempty"`
	Width       int        `json:"width,omitempty"`
	Height      int        `json:"height,omitempty"`
	Error       string     `json:"error,omitempty"`
	GeneratedAt *time.Time `json:"generated_at,omitempty"`
	// SourceSig is the ContentFingerprint of the bytes the latest render
	// read (migration 00075). A row whose signature is not the node's
	// current one was drawn from other content: thumb.Assess re-renders it.
	// Empty on rows drawn before 0.50.
	SourceSig string `json:"source_sig,omitempty"`
	// AttemptedAt is when the latest render started, whatever it ended in.
	AttemptedAt *time.Time `json:"attempted_at,omitempty"`
	// Generator is who drew the picture: "builtin", or "app:<name>@<version>"
	// (migration 00077). Empty when nobody did, and on rows from before 0.50.
	Generator string `json:"generator,omitempty"`
	// Attempts is who was asked, in order, and what each answered: a JSON
	// list of {"h": handler, "r": "ok" | reason} (thumb.Attempt). Empty on
	// rows drawn before 0.50; "[]" when every handler was switched off.
	Attempts string `json:"attempts,omitempty"`
}

type ThumbnailProblem struct {
	NodeID      int64      `json:"node_id"`
	StorageID   int64      `json:"storage_id"`
	Path        string     `json:"path"`
	Name        string     `json:"name"`
	Size        int64      `json:"size"`
	State       string     `json:"state"`
	Error       string     `json:"error,omitempty"`
	AttemptedAt *time.Time `json:"attempted_at,omitempty"`
	// Attempts: see Thumbnail.Attempts.
	Attempts string `json:"attempts,omitempty"`
}

type UploadPart struct {
	PartNumber int    `json:"part_number"`
	Etag       string `json:"etag"`
	Size       int64  `json:"size"`
	URL        string `json:"url,omitempty"` // only on init response
}

type User struct {
	ID    int64  `json:"id"`
	Email string `json:"email"`
	// Username is the short login name (migration 00025), unique across the
	// install. It exists because the connection protocols cannot carry an
	// e-mail comfortably — `sftp://ada@example.com@host` needs escaping, and
	// rclone/WinSCP config files split on `@`. Every login surface accepts
	// EITHER this or the e-mail; internal/identity owns that rule and is the
	// only place allowed to decide which one an identifier is.
	Username          string   `json:"username"`
	DisplayName       string   `json:"display_name"`
	PasswordHash      string   `json:"-"`
	Role              string   `json:"role"`
	TOTPSecret        string   `json:"-"`
	TOTPPendingSecret string   `json:"-"`
	TOTPEnabled       bool     `json:"totp_enabled"`
	TOTPRecoveryCodes []string `json:"-"`
	Locale            string   `json:"locale"`
	Timezone          string   `json:"timezone"`
	// AvatarURL is the profile picture: a small data: URI or an http(s) /
	// site-relative URL (migration 00023). It is the face the collaboration
	// presence strip draws instead of initials, for every client of this
	// account — browser session, desktop app, and any API key minted under it.
	AvatarURL   string     `json:"avatar_url,omitempty"`
	CreatedAt   time.Time  `json:"created_at"`
	UpdatedAt   time.Time  `json:"updated_at"`
	LastLoginAt *time.Time `json:"last_login_at,omitempty"`
	// Multi-tenancy (docs/MULTI-TENANCY.md): the tenant (provider) this user
	// belongs to. Nil only on rows predating the 00014 backfill; assigned
	// immutably at JIT login. OIDCSubject pins the OIDC identity per provider.
	ProviderID  *int64 `json:"provider_id,omitempty"`
	OIDCSubject string `json:"-"`
	// OIDCIssuer is the `iss` of the SSO identity the account is bound to,
	// with OIDCSubject its `sub` (migration 00079): once bound, an SSO sign-in
	// finds the account by that pair, and the same e-mail address arriving
	// with another identity is refused (docs/SSO.md).
	OIDCIssuer string `json:"-"`
	// SSOLinked: the account is bound to an SSO identity (it has a subject).
	// Filled by the store from OIDCIssuer/OIDCSubject, which are never sent:
	// the users page offers "Remove SSO bind" on such an account.
	SSOLinked bool `json:"sso_linked,omitempty"`
	// Storage accounting (migration 00003). QuotaBytes == 0 means unlimited.
	// Carried on the user so an admin table costs one call instead of one
	// /quota request per row.
	QuotaBytes int64 `json:"quota_bytes"`
	UsageBytes int64 `json:"used_bytes"`
	// Enabled (migration 00022) gates whether the account may start a
	// session — local login, OIDC and /dav alike. Disabling is not a soft
	// delete: files, quota and grants are untouched.
	Enabled bool `json:"enabled"`
	// DisabledReason says why the SERVER switched the account off (migration
	// 00079): DisabledPendingApproval for an account an SSO sign-in opened
	// whose address the identity provider did not confirm, DisabledByDirectory
	// for one LDAP directory sync switched off. "" for an account that is on,
	// or that an administrator switched off; switching it on or off clears it.
	// The users page shows it beside the disabled state.
	DisabledReason string `json:"disabled_reason,omitempty"`
	// AuthSource says where the account comes from (migration 00084): one of
	// the AuthSource* values, or "" for an account from before it with no
	// password here and no SSO identity (its next sign-in labels it; any
	// LDAP directory may take it until then - ldap.notMine). A label for the
	// Users page; it decides only which LDAP directory signs the account in.
	AuthSource string `json:"auth_source"`
	// AuthDirectory names the LDAP provider that made the account — its
	// slug, "ldap" or another instance's (migration 00084); "" for any other
	// account. Only that directory signs it in (DirectoryOwner).
	AuthDirectory string `json:"auth_directory,omitempty"`
	// DirectoryID is the person's permanent id in that directory —
	// "<directory>:<entryUUID or objectGUID>" (migration 00085); "" when the
	// directory has none, or for any other account. A sign-in or sync finds
	// the account by it before the e-mail.
	DirectoryID string `json:"-"`
	// AdminByGroup: an administrator because a group gives its members
	// Administrator (migration 00086); back to their earlier level when no
	// group does. Any other change of role clears it.
	AdminByGroup bool `json:"admin_by_group,omitempty"`
}

type VaultLock struct {
	TenantID int64
	// VaultID is the key file's vault.id as 32 lower-case hex digits.
	VaultID string
	// Rev is the compare-and-set counter: every write of the row names the
	// revision it read, and loses when another writer came first.
	Rev int64
	// TokenHash is the hex SHA-256 of the live lock's token; "" when no lock
	// is recorded as held.
	TokenHash string
	// Holder: the person, the kind of client (web, desktop, cli, mount) and
	// the client's own short label ("Firefox, ofis").
	HolderUserID int64
	HolderName   string
	HolderClient string
	HolderLabel  string
	// StorageID and Path are where the lock was taken: the vault folder the
	// holder named (a copy of a vault shares its id, and so its lock).
	StorageID int64
	Path      string
	// TakenMs: when the lock was taken; LeaseMs: when it runs out unless
	// renewed; ActiveMs: the last vault write or active renewal; IdleSeconds:
	// the holder's idle time, read when the lock was taken.
	TakenMs     int64
	LeaseMs     int64
	ActiveMs    int64
	IdleSeconds int64
	// IndexStartedMs: an index write of the holder is running since then
	// (0 = none). The lock is not free again until it ends or 60 seconds
	// pass.
	IndexStartedMs int64
	// FirstGen and LastGen are the first and last generation committed
	// under the current (or, once it ended, the last) lock.
	FirstGen int64
	LastGen  int64
	// EndedTokenHash, EndedReason and EndedMs record how the last lock
	// ended: released, expired, idle, broken or locked_idle. The holder of
	// that token is told the reason on its next call - and, for a break,
	// EndedBy: the name of who broke it.
	EndedTokenHash string
	EndedReason    string
	EndedBy        string
	EndedMs        int64
}

type WebhookTarget struct {
	ID        int64     `json:"id"`
	Name      string    `json:"name"`
	URL       string    `json:"url"`
	Secret    string    `json:"-"`
	Events    string    `json:"events"`
	Enabled   bool      `json:"enabled"`
	CreatedAt time.Time `json:"created_at"`

	// Lang is the language the target's `title` and `body` are said in
	// (migration 00105): a webhook is a receiver no person stands behind, so
	// it has the language chosen for it here, and "" is the instance's
	// (FILEX_DEFAULT_LOCALE, else English). notify say.go.
	Lang string `json:"lang"`

	// Last-delivery persistence (migration 00019). All nil until the
	// first delivery attempt (real dispatch or admin test-fire).
	// LastStatus is the HTTP status code of the final attempt — 0 means
	// the request never got a response (DNS/connect/timeout). LastError
	// is nil after a success, the aggregated error message otherwise.
	LastStatus     *int       `json:"last_status,omitempty"`
	LastError      *string    `json:"last_error,omitempty"`
	LastDeliveryAt *time.Time `json:"last_delivery_at,omitempty"`
}