client

type APIError struct {
	// Status is the HTTP status code, e.g. 404.
	Status int
	// Body is the raw server response body (capped at 2048 bytes).
	Body string
}

type ActorType = types.ActorType

type AgentRun = types.AgentRun

type ApprovalKind = types.ApprovalKind

type ApprovalRequest = types.ApprovalRequest

type ApprovalScope = types.ApprovalScope

type ApprovalState = types.ApprovalState

type AuditEvent = types.AuditEvent

type AuditFilter struct {
	Since        string // RFC3339, e.g. time.Now().UTC().Format(time.RFC3339)
	Until        string // RFC3339
	ActionPrefix string
	ActorType    string // "human" | "agent" | "system"
	Outcome      string // "success" | "denied" | "failure"
}

type BaseImageEntry = types.BaseImageEntry

type Client struct {
	// BaseURL is the wardynd root, e.g. "https://wardyn.example.com".
	// A trailing slash is stripped automatically.
	BaseURL string

	// Token is the admin bearer token configured in wardynd (AdminToken).
	Token string

	// HTTPClient, when non-nil, is used instead of http.DefaultClient.
	HTTPClient *http.Client

	// Principal, when non-empty, is sent as the X-Wardyn-Principal header — a
	// DEV-ONLY override for simulating different principals against a local
	// wardynd. The server honors it ONLY in local (no-auth) mode. Under
	// admin-token auth it is ignored and the action is attributed to
	// actor_type=system / principal "admin-token" (the token is an opaque shared
	// bearer, not a JWT — there is no subject to extract); under OIDC the
	// verified subject wins. Use OIDC for real per-human attribution.
	Principal string
}

type ConfinementClass = types.ConfinementClass

type CreateRunRequest struct {
	Agent string `json:"agent"`
	Repo  string `json:"repo"`
	// Task is the agent's prompt for a non-interactive run. For an interactive
	// run it is instead the OPTIONAL boot seed: interpreted per
	// InteractiveStart (an initial prompt for "agent", a startup command for
	// "shell") and fired once, at sandbox boot, in the same persistent session
	// the human later attaches to — never re-run on attach. Empty is today's
	// pure-idle behavior, unchanged.
	Task string `json:"task,omitempty"`
	// Title is a short human NAME for the run. Runs that share a title are
	// grouped in the console's run list. OPTIONAL on the wire even though the
	// console requires it: the site-config probe, harness login and workspace
	// record/verify all create runs with no human to name them, and the console
	// falls back to Task for display. Trimmed and stored on the run row.
	Title string `json:"title,omitempty"`
	// Description is optional free-text context — why this run exists. Never
	// interpreted, only stored and displayed.
	Description string     `json:"description,omitempty"`
	PolicyID    *uuid.UUID `json:"policy_id,omitempty"`
	// ConfinementClass, when set, requests a specific confinement class
	// ("CC1"/"CC2"/"CC3"). Empty inherits the policy minimum; an unknown
	// non-empty value is rejected by the server with 400.
	ConfinementClass string `json:"confinement_class,omitempty"`
	// Interactive requests an interactive run: the sandbox comes up idle — or,
	// with a non-empty Task, runs that boot seed in a persistent session — so a
	// human can attach to it (wardyn attach <id>) either way. Pair with a
	// never-reap policy (AutoStopAfterSec < 0) or the idle reaper will stop the
	// idle sandbox.
	Interactive bool `json:"interactive,omitempty"`
	// WorkspaceID, when set, launches the run against that ONBOARDED workspace:
	// the server prepends the workspace's stored source onto the resolved policy
	// (a repo as a workspace_repos entry, a local dir as a read-only-by-default
	// workspace_mounts entry) so the run inherits its approved egress, built image
	// and bound model/harness credentials. Composes with PolicyID / InlinePolicy /
	// the default policy — it seeds the source those cannot name without
	// hand-reproducing the workspace's exact path. Container-kind workspaces are
	// rejected: pass the image ref as Image instead.
	WorkspaceID *uuid.UUID `json:"workspace_id,omitempty"`
	// InlinePolicy, when set, supplies the run's full RunPolicySpec INLINE
	// instead of referencing a stored PolicyID. It is MUTUALLY EXCLUSIVE with
	// PolicyID (the server rejects both with 400); neither set falls back to the
	// configured default. The server validates it exactly like a stored policy
	// (mounts pass the same deny-list; api_key grants must reference an existing
	// secret) and attaches it with no stored policy id.
	InlinePolicy *RunPolicySpec `json:"inline_policy,omitempty"`
	// DevcontainerRepo, when set AND an image builder is wired (WARDYN_ENVBUILD),
	// triggers a devcontainer build of that git repo whose resulting image becomes
	// the sandbox image. Ignored (degrades to the convention image) when no builder
	// is wired. Mutually exclusive with Image.
	DevcontainerRepo string `json:"devcontainer_repo,omitempty"`
	// DevcontainerRef is the optional git ref (branch/tag/sha) to build for
	// DevcontainerRepo.
	DevcontainerRef string `json:"devcontainer_ref,omitempty"`
	// Image, when set, is a USER-supplied base image (Bring Your Own Image); the
	// server wraps it with the runner tools via a trusted finalize stage and
	// requires an image builder to be wired (WARDYN_ENVBUILD) — an explicit
	// Image with no builder wired is a hard 400 rather than a silent fallback.
	// Mutually exclusive with DevcontainerRepo.
	Image string `json:"image,omitempty"`
	// TaskMode selects how a non-interactive run executes Task: "" / "harness"
	// (default) runs the agent harness; "exec" runs Task as a plain shell
	// command in the same governed sandbox (no agent, no LLM credentials — the
	// BYOA/CI lane; see docs/CI.md). Ignored for an interactive run.
	TaskMode string `json:"task_mode,omitempty"`
	// InteractiveStart is TaskMode's interactive counterpart: what the attach
	// shell opens with. "" / "shell" drops the human into a shell in the
	// prepared workspace (the long-standing behavior); "agent" additionally
	// launches the image's agent CLI (claude / codex) there, once, on the first
	// attach. Request-scoped like TaskMode — never persisted on the run row,
	// carried to the sandbox as WARDYN_INTERACTIVE_START and consumed by the
	// image's attach ~/.bashrc. Ignored for a non-interactive run.
	InteractiveStart string `json:"interactive_start,omitempty"`
	// SeedAutoTools, when true, lets an interactive run's boot SEED (Task,
	// interpreted per InteractiveStart — see Task's own doc) use tools before a
	// human attaches, equivalent to --dangerously-skip-permissions for that
	// pre-attach span only. Default false: the seed is supervised, so an
	// unattended agent-started seed parks at its first tool-approval prompt
	// until someone joins. Meaningful only for an agent-started seed with
	// non-empty Task; request-scoped like InteractiveStart — never persisted on
	// the run row, carried to the sandbox as WARDYN_SEED_AUTO_TOOLS.
	SeedAutoTools bool `json:"seed_auto_tools,omitempty"`
	// ToolApprovals governs an AUTONOMOUS (non-interactive) Claude Code run's
	// own tool calls: "" / "auto" (default) is today's behavior — the sandbox
	// and egress policy are the only boundary, same as
	// --dangerously-skip-permissions; "hold" routes every tool call through
	// Wardyn's approval FSM instead, so an operator decides each one before it
	// runs. Rejected for codex-cli (no external tool-approval contract) and
	// structurally inert for an interactive run (that run's own supervised-seed
	// posture is SeedAutoTools's job, not this field's). Request-scoped like
	// TaskMode — never persisted on the run row, carried to the sandbox as
	// WARDYN_TOOL_APPROVALS.
	ToolApprovals string `json:"tool_approvals,omitempty"`
	// Workspaces carries PER-WORKSPACE options — which of a workspace's
	// OPTIONAL requirements (types.Workspace.Requirements, level="optional")
	// this run enables, and a read-only narrowing — for the workspaces this run
	// attaches. Additive to WorkspaceID, which stays a working SINGLE-selection
	// alias: a caller that sets only WorkspaceID (never touching Workspaces)
	// gets exactly today's behavior — no optional requirement enabled, no
	// narrowing. A REQUIRED requirement needs no entry here at all; it applies
	// automatically whenever its workspace is used. A selection naming a
	// workspace this run does not otherwise attach (via WorkspaceID or a
	// policy's workspace_mounts/workspace_repos) does nothing.
	Workspaces []WorkspaceSelection `json:"workspaces,omitempty"`
	// IntegrationID, when set, pins this run's model/harness credential to a
	// SPECIFIC AI-provider Integration (SiteConfig.Integrations[i].ID, stored
	// or a well-known legacy-derived id — see GET /integrations), overriding
	// any workspace LLMCred binding and the operator's DefaultFor:agent_runs
	// default. Naming a non-AI-provider integration (a source-control or
	// corporate-network id — those apply operator-wide already, and are never
	// run-selectable) is a 400.
	IntegrationID string `json:"integration_id,omitempty"`
}

type CreateRunResult struct {
	types.AgentRun
	// Warnings are ADVISORY notices the server raised while resolving the run —
	// discouraged, never blocking: a workspace-directory collision with another
	// active run, or an ssh_key grant dropped because the agent has no SSH clone
	// lane. Surface them: the run is live either way, so a dropped warning is a
	// silently degraded run.
	Warnings []string `json:"warnings,omitempty"`
}

type CredentialGrant = types.CredentialGrant

type DecisionOpts struct {
	// Scope is the decision's blast radius: ScopeOnce, ScopeRun (the zero
	// value, and today's default), ScopeUntil, or ScopeAlways. Meaningful
	// only for an egress_domain approval; the server rejects it otherwise.
	Scope ApprovalScope
	// Until is the expiry for Scope == ScopeUntil: required by the server in
	// that case, and rejected if set for any other scope.
	Until *time.Time
}

type EgressRedirect = types.EgressRedirect

type GrantKind = types.GrantKind

type GrantSpec = types.GrantSpec

type KillRunResponse struct {
	ID    uuid.UUID      `json:"id"`
	State types.RunState `json:"state"`
}

type ListOpts struct {
	Limit  int
	Offset int
}

type PolicyRequest struct {
	Name string              `json:"name"`
	Spec types.RunPolicySpec `json:"spec"`
}

type PreflightItem struct {
	Kind       string `json:"kind"`
	ID         string `json:"id"`
	Label      string `json:"label"`
	RequiredBy string `json:"required_by"`
	Status     string `json:"status"` // "satisfied" | "missing" | "unverified"
	Detail     string `json:"detail,omitempty"`
}

type PreflightResult struct {
	SetupItems               []PreflightItem        `json:"setup_items"`
	EnforcedConfinementClass types.ConfinementClass `json:"enforced_confinement_class"`
	// Warnings carries resolveRunPolicy's clamp notes — a member's silently
	// narrowed inline policy, a filtered grant. The dry run is the ONLY place
	// these surface (launch never returns them), so dropping them here left a
	// member with no way to learn their policy was clamped at all.
	Warnings []string `json:"warnings,omitempty"`
}

type ProfileResult struct {
	Proposed struct {
		InlinePolicy RunPolicySpec `json:"inline_policy"`
	} `json:"proposed"`
	OverallRisk  string `json:"overall_risk"`
	Observations struct {
		Domains []struct {
			Host    string   `json:"host"`
			Methods []string `json:"methods"`
		} `json:"domains"`
		Anomalies []string `json:"anomalies"`
	} `json:"observations"`
	Warnings []string `json:"warnings"`
}

type RecordTaskResult struct {
	RecordRunID string   `json:"record_run_id"`
	TaskKey     string   `json:"task_key"`
	Mode        string   `json:"mode"`
	Detail      string   `json:"detail"`
	Warnings    []string `json:"warnings"`
}

type RunPolicy = types.RunPolicy

type RunPolicySpec = types.RunPolicySpec

type RunState = types.RunState

type SiteConfig = types.SiteConfig

type Source = types.Source

type SourceKind = types.SourceKind

type SourceRequest struct {
	Kind types.SourceKind `json:"kind"`
	// Locator is a host directory path (local_dir) or repo slug/clone URL (repo).
	Locator string `json:"locator"`
	// Ref is an optional git ref; repo only. Part of the identity — the same
	// repo at two refs is two sources with two contracts.
	Ref  string `json:"ref,omitempty"`
	Name string `json:"name,omitempty"`
	// Requirements seeds the source's own contract (secret:/egress:/write:
	// keys; integration: keys are tier-3-only and rejected here).
	Requirements map[string]types.WorkspaceRequirement `json:"requirements,omitempty"`
}

type Workspace = types.Workspace

type WorkspaceAttachment = types.WorkspaceAttachment

type WorkspaceBaseImage = types.WorkspaceBaseImage

type WorkspaceBedrockRef = types.WorkspaceBedrockRef

type WorkspaceKind = types.WorkspaceKind

type WorkspaceLLMCred = types.WorkspaceLLMCred

type WorkspaceMount = types.WorkspaceMount

type WorkspaceRequest struct {
	Name string `json:"name"`
	// Sources is the workspace's composition: one-or-more local_dir/repo/
	// ephemeral sources. Mutually exclusive with the legacy scalar fields
	// below (Kind/Source/Ref/DefaultTarget/Writable) — set one or the other,
	// never both. Omitting both onboards the composition floor: one ephemeral
	// scratch source.
	Sources []types.WorkspaceSource `json:"sources,omitempty"`
	// BaseImage is the workspace's base-image choice. Nil means the platform
	// default convention image for the detected/scanned stack.
	BaseImage *types.WorkspaceBaseImage `json:"base_image,omitempty"`

	// Deprecated: Kind/Source/Ref/DefaultTarget/Writable are the pre-
	// composition-model scalar shape — a single source, folded server-side
	// into Sources[0] (legacyWorkspaceSource). Kept so
	// `wardyn workspace create --kind local_dir --source /x` and existing SDK
	// callers keep working; prefer Sources for a new caller, especially a
	// multi-source one.
	Kind          types.WorkspaceKind `json:"kind,omitempty"`
	Source        string              `json:"source,omitempty"`
	Ref           string              `json:"ref,omitempty"`
	DefaultTarget string              `json:"default_target,omitempty"`
	// Deprecated: see Kind. Writable opts the single legacy source into a
	// READ-WRITE mount for import Record/Verify runs; omitted/false is
	// read-only (the safe default). A sandboxed agent's changes then PERSIST
	// to the host directory. A multi-source caller sets WorkspaceSource.Writable
	// per source instead.
	Writable bool `json:"writable,omitempty"`
	// LLMCred is the operator-owned model/harness credential BINDING for this
	// workspace/container (refs/names only). A run that picks the workspace
	// inherits this model access. Nil => no binding. CREATE-ONLY: the update
	// handler ignores it, so changing a binding needs the standalone
	// PUT /workspaces/{id}/llm-cred route (not covered by this SDK).
	LLMCred *types.WorkspaceLLMCred `json:"llm_cred,omitempty"`
}

type WorkspaceRequirement = types.WorkspaceRequirement

type WorkspaceSelection struct {
	// WorkspaceID is the workspace this selection applies to (string form of
	// its uuid — matched against the run's referenced workspaces by id).
	WorkspaceID string `json:"workspace_id"`
	// EnabledOptional lists the workspace's OPTIONAL requirement KEYS (the
	// exact "<type>:<key>" form, e.g. "egress:api.stripe.com" or
	// "write:/home/user/repo") this run opts into. A key not listed here stays
	// at its safe default (no egress, no grant, read-only mount).
	EnabledOptional []string `json:"enabled_optional,omitempty"`
	// ReadOnly, when set, NARROWS this workspace's write:<path> requirements —
	// true forces every one read-only even if Required or enabled; false is a
	// no-op (a selection may only narrow what the contract already grants,
	// never widen it — see the fold in internal/api/runs_create.go). Nil
	// leaves the contract's own resolved default in effect.
	ReadOnly *bool `json:"read_only,omitempty"`
}

type WorkspaceSource = types.WorkspaceSource

type WorkspaceSourceType = types.WorkspaceSourceType

type WorkspaceStatus = types.WorkspaceStatus