client

type APIError struct {
	// Status is the HTTP status code, e.g. 404.
	Status int
	// Body is the raw server response body (capped at 2048 bytes).
	Body string
	// Reason is the server's machine-readable refusal class (internal/api's
	// errorBody.Reason), "" when the route does not send one — most do not yet
	// (#204 is phasing coverage in lane by lane). A caller that needs to branch
	// on WHY a call failed reads Reason, never Error()'s prose: the human
	// sentence is free to reword without notice, the reason string is not.
	Reason string
	// Policy names the governance policy whose ceiling refused the request and
	// how to ask for a change (internal/api's errorBody.Policy), nil when the
	// refusal is not a ceiling refusal or the server sent none.
	Policy *PolicyRef
}

type ActorType = types.ActorType

type AgentRun = types.AgentRun

type ApprovalKind = types.ApprovalKind

type ApprovalRequest = types.ApprovalRequest

type ApprovalScope = types.ApprovalScope

type ApprovalState = types.ApprovalState

type AuditEvent = types.AuditEvent

type AuditFilter struct {
	Since        string // RFC3339, e.g. time.Now().UTC().Format(time.RFC3339)
	Until        string // RFC3339
	ActionPrefix string
	Actor        string // exact principal, e.g. "alice@corp.example" — "everything X did"
	ActorType    string // "human" | "agent" | "system"
	Outcome      string // "success" | "denied" | "failure"
}

type AutonomyLevel = types.AutonomyLevel

type AutonomyRubric = types.AutonomyRubric

type BaseImageEntry = types.BaseImageEntry

type BedrockSettings = types.BedrockSettings

type CapabilitySubjectType = types.CapabilitySubjectType

type Client struct {
	// BaseURL is the wardynd root, e.g. "https://wardyn.example.com".
	// A trailing slash is stripped automatically.
	BaseURL string

	// Token is the admin bearer token configured in wardynd (AdminToken).
	Token string

	// HTTPClient, when non-nil, is used instead of the default client, and its
	// redirect policy is YOURS: the default returns a 3xx as an *APIError
	// rather than following it, but a client you supply is used as it is.
	// Following a redirect can replay a request body (a secret value) and the
	// Authorization bearer at wherever Location points, so a caller who sets
	// this should set a CheckRedirect func that returns http.ErrUseLastResponse.
	HTTPClient *http.Client

	// Principal, when non-empty, is sent as the X-Wardyn-Principal header — a
	// DEV-ONLY override for simulating different principals against a local
	// wardynd. The server honors it ONLY in local (no-auth) mode. Under
	// admin-token auth it is ignored and the action is attributed to
	// actor_type=system / principal "admin-token" (the token is an opaque shared
	// bearer, not a JWT — there is no subject to extract); under OIDC the
	// verified subject wins. Use OIDC for real per-human attribution.
	Principal string
}

type ConfinementClass = types.ConfinementClass

type CreateRunRequest struct {
	Agent string `json:"agent"`
	Repo  string `json:"repo"`
	// Task is the agent's prompt for a non-interactive run. For an interactive
	// run it is instead the OPTIONAL boot seed: interpreted per
	// InteractiveStart (an initial prompt for "agent", a startup command for
	// "shell") and fired once, at sandbox boot, in the same persistent session
	// the human later attaches to — never re-run on attach. Empty is today's
	// pure-idle behavior, unchanged.
	Task string `json:"task,omitempty"`
	// Title is a short human NAME for the run. Runs that share a title are
	// grouped in the console's run list. OPTIONAL on the wire even though the
	// console requires it: the site-config probe, harness login and workspace
	// record/verify all create runs with no human to name them, and the console
	// falls back to Task for display. Trimmed and stored on the run row.
	Title string `json:"title,omitempty"`
	// Description is optional free-text context — why this run exists. Never
	// interpreted, only stored and displayed.
	Description string     `json:"description,omitempty"`
	PolicyID    *uuid.UUID `json:"policy_id,omitempty"`
	// ConfinementClass, when set, requests a specific confinement class
	// ("CC1"/"CC2"/"CC3"). Empty inherits the policy minimum; an unknown
	// non-empty value is rejected by the server with 400.
	ConfinementClass string `json:"confinement_class,omitempty"`
	// Interactive requests an interactive run: the sandbox comes up idle — or,
	// with a non-empty Task, runs that boot seed in a persistent session — so a
	// human can attach to it (wardyn run attach <id>) either way. Pair with a
	// never-reap policy (AutoStopAfterSec < 0) or the idle reaper will stop the
	// idle sandbox.
	Interactive bool `json:"interactive,omitempty"`
	// WorkspaceID, when set, launches the run against that ONBOARDED workspace:
	// the server prepends the workspace's stored source onto the resolved policy
	// (a repo as a workspace_repos entry, a local dir as a read-only-by-default
	// workspace_mounts entry) so the run inherits its approved egress, built image
	// and bound model/harness credentials. Composes with PolicyID / InlinePolicy /
	// the default policy — it seeds the source those cannot name without
	// hand-reproducing the workspace's exact path. Container-kind workspaces are
	// rejected: pass the image ref as Image instead.
	WorkspaceID *uuid.UUID `json:"workspace_id,omitempty"`
	// InlinePolicy, when set, supplies the run's full RunPolicySpec INLINE
	// instead of referencing a stored PolicyID. It is MUTUALLY EXCLUSIVE with
	// PolicyID (the server rejects both with 400); neither set falls back to the
	// configured default. The server validates it exactly like a stored policy
	// (mounts pass the same deny-list; api_key grants must reference an existing
	// secret) and attaches it with no stored policy id.
	InlinePolicy *RunPolicySpec `json:"inline_policy,omitempty"`
	// DevcontainerRepo, when set AND an image builder is wired (WARDYN_ENVBUILD),
	// triggers a devcontainer build of that git repo whose resulting image becomes
	// the sandbox image. Ignored (degrades to the convention image) when no builder
	// is wired. Mutually exclusive with Image.
	DevcontainerRepo string `json:"devcontainer_repo,omitempty"`
	// DevcontainerRef is the optional git ref (branch/tag/sha) to build for
	// DevcontainerRepo.
	DevcontainerRef string `json:"devcontainer_ref,omitempty"`
	// Image, when set, is a USER-supplied base image (Bring Your Own Image); the
	// server wraps it with the runner tools via a trusted finalize stage and
	// requires an image builder to be wired (WARDYN_ENVBUILD) — an explicit
	// Image with no builder wired is a hard 400 rather than a silent fallback.
	// Mutually exclusive with DevcontainerRepo.
	Image string `json:"image,omitempty"`
	// TaskMode selects how a non-interactive run executes Task: "" / "harness"
	// (default) runs the agent harness; "exec" runs Task as a plain shell
	// command in the same governed sandbox (no agent, no LLM credentials — the
	// BYOA/CI lane; see docs/CI.md). Ignored for an interactive run.
	TaskMode string `json:"task_mode,omitempty"`
	// InteractiveStart is TaskMode's interactive counterpart: what the attach
	// shell opens with. "" / "shell" drops the human into a shell in the
	// prepared workspace (the long-standing behavior); "agent" additionally
	// launches the image's agent CLI (claude / codex) there, once, on the first
	// attach. Request-scoped like TaskMode — never persisted on the run row,
	// carried to the sandbox as WARDYN_INTERACTIVE_START and consumed by the
	// image's attach ~/.bashrc. Ignored for a non-interactive run.
	InteractiveStart string `json:"interactive_start,omitempty"`
	// SeedAutoTools, when true, lets an interactive run's boot SEED (Task,
	// interpreted per InteractiveStart — see Task's own doc) use tools before a
	// human attaches, equivalent to --dangerously-skip-permissions for that
	// pre-attach span only. Default false: the seed is supervised, so an
	// unattended agent-started seed parks at its first tool-approval prompt
	// until someone joins. Meaningful only for an agent-started seed with
	// non-empty Task; request-scoped like InteractiveStart — never persisted on
	// the run row, carried to the sandbox as WARDYN_SEED_AUTO_TOOLS.
	SeedAutoTools bool `json:"seed_auto_tools,omitempty"`
	// ToolApprovals governs an AUTONOMOUS (non-interactive) Claude Code run's
	// own tool calls: "" / "auto" (default) is today's behavior — the sandbox
	// and egress policy are the only boundary, same as
	// --dangerously-skip-permissions; "hold" routes every tool call through
	// Wardyn's approval FSM instead, so an operator decides each one before it
	// runs. Rejected for codex-cli (no external tool-approval contract) and
	// ALSO rejected for an interactive run: that run's supervised-seed posture is
	// SeedAutoTools's job, so this field could never take effect there. It used
	// to be accepted and silently discarded, which is worse than refusing it —
	// the caller got a 201 and none of the supervision they asked for.
	// Request-scoped like TaskMode — never persisted on the run row, carried to
	// the sandbox as WARDYN_TOOL_APPROVALS.
	ToolApprovals string `json:"tool_approvals,omitempty"`
	// Workspaces carries PER-WORKSPACE options — which of a workspace's
	// OPTIONAL requirements (types.Workspace.Requirements, level="optional")
	// this run enables, and a read-only narrowing — for the workspaces this run
	// attaches. Additive to WorkspaceID, which stays a working SINGLE-selection
	// alias: a caller that sets only WorkspaceID (never touching Workspaces)
	// gets exactly today's behavior — no optional requirement enabled, no
	// narrowing. A REQUIRED requirement needs no entry here at all; it applies
	// automatically whenever its workspace is used. A selection naming a
	// workspace this run does not otherwise attach (via WorkspaceID or a
	// policy's workspace_mounts/workspace_repos) does nothing.
	Workspaces []WorkspaceSelection `json:"workspaces,omitempty"`
	// IntegrationID no longer chooses a model credential: a run naming one is
	// refused with a 422. Use ModelProvider.
	IntegrationID string `json:"integration_id,omitempty"`
	// ModelProvider chooses this run's model provider (GET /model-providers,
	// by id), ahead of a workspace's provider pin and the agent's default. It
	// must be one the caller is granted, that is on and that serves Agent —
	// otherwise the run is refused, never moved to another provider. Named on a
	// deployment with no model providers, or on a run that calls no model, it
	// is refused rather than ignored.
	ModelProvider string `json:"model_provider,omitempty"`
	// Drive opts this run into the member's USER DRIVE — the per-user storage
	// an admin allocated them. Nil (the default) mounts nothing, byte for byte
	// today. Nothing here names a path or a drive: the server resolves which
	// drive belongs to the authenticated caller and derives their home from
	// their own identity, so this flag can only ever ask for the storage the
	// caller was already granted.
	Drive *DriveSelection `json:"drive,omitempty"`
	// Preset launches the named launch preset (see Preset): the server
	// expands it into the equivalent explicit request and runs the unchanged
	// create path under the caller's own ceiling. Alongside it only Title,
	// Task and PresetVersion may be set; any other field is refused.
	Preset string `json:"preset,omitempty"`
	// PresetVersion, with Preset, pins the version the caller expects: a
	// preset changed since is refused (409) rather than launched. 0 launches
	// the current version. The created run records the version it used.
	PresetVersion int `json:"preset_version,omitempty"`
}

type CreateRunResult struct {
	types.AgentRun
	// Warnings are ADVISORY notices the server raised while resolving the run —
	// discouraged, never blocking: a member's inline policy narrowed to what
	// they are granted (an egress host, a secret-referencing grant, a workspace
	// repo), a workspace-directory collision with another active run, or an
	// ssh_key grant dropped because the agent has no SSH clone lane. Surface
	// them: the run is live either way, so a dropped warning is a silently
	// degraded run.
	Warnings []string `json:"warnings,omitempty"`
}

type CredentialGrant = types.CredentialGrant

type DecisionOpts struct {
	// Scope is the decision's blast radius: ScopeOnce, ScopeRun (the zero
	// value, and today's default), ScopeUntil, or ScopeAlways. Meaningful
	// only for an egress_domain approval; the server rejects it otherwise.
	Scope ApprovalScope
	// Until is the expiry for Scope == ScopeUntil: required by the server in
	// that case, and rejected if set for any other scope.
	Until *time.Time
}

type Device = types.Device

type DeviceEnrolmentToken = types.DeviceEnrolmentToken

type DeviceEnrolmentTokenRequest struct {
	// Name is the laptop's inventory name; the device it enrols carries it.
	Name string `json:"name"`
}

type DriveBackend = types.DriveBackend

type DriveGrantRequest struct {
	SubjectType CapabilitySubjectType `json:"subject_type"`
	Subject     string                `json:"subject"`
	DriveID     uuid.UUID             `json:"drive_id"`
	// Priority breaks ties within a tier (higher wins) when a subject's
	// membership qualifies it for more than one group-tier grant. It does not
	// cross tiers (user beats group beats all).
	Priority int `json:"priority"`
	// SizeMiBOverride replaces the drive's allocation for this subject. 0
	// means "use the drive's".
	SizeMiBOverride int `json:"size_mib_override,omitempty"`
	// WritableOverride is TRI-STATE: nil is "use the drive's posture", and an
	// explicit false is "this subject reads only" even on a writable drive.
	WritableOverride *bool `json:"writable_override,omitempty"`
	// HomeOverride is TRI-STATE for the same reason: nil leaves a previously
	// pinned directory name alone, and an explicit "" (or a name) states the
	// field, which is itself the confirmation to change it. User-tier
	// subjects only.
	HomeOverride *string `json:"home_override,omitempty"`
	// Enabled is TRI-STATE and defaults to true when nil: allocating a drive
	// is a deliberate act, so omitting the field means "give it to them", not
	// "pause it". An explicit false pauses the allocation without deleting it.
	Enabled *bool `json:"enabled,omitempty"`
}

type DriveReclaim = types.DriveReclaim

type DriveRequest struct {
	Name    string       `json:"name"`
	Backend DriveBackend `json:"backend"`
	// HostRoot is the operator-mounted tree a host_path drive binds a
	// subdirectory of. Meaningless for every other backend, and refused
	// outright when it names a path outside this deployment's configured
	// drive host roots.
	HostRoot string `json:"host_root,omitempty"`
	// StorageClass is the k8s_pvc provisioner to request; "" means the
	// cluster default. Meaningless for every other backend.
	StorageClass string `json:"storage_class,omitempty"`
	// HomeTemplate is which identity a drive's per-user home name is derived
	// from. "" means the server's default (HomeTemplateHash).
	HomeTemplate HomeTemplate `json:"home_template,omitempty"`
	// SizeMiB is the allocation, not a guarantee — see types.StorageEnforcement.
	// Required (and enforced) on a k8s_pvc drive; advisory elsewhere.
	SizeMiB int `json:"size_mib,omitempty"`
	// Writable is the drive's DEFAULT posture and it defaults to false. A
	// grant may narrow it and a run may narrow it again; neither may widen it.
	Writable bool `json:"writable,omitempty"`
	// Reclaim is the declared intent for the drive's storage objects once an
	// allocation is removed. "" means the server's default (DriveReclaimRetain).
	Reclaim DriveReclaim `json:"reclaim,omitempty"`
}

type DriveSelection struct {
	// Enabled asks for the caller's drive to be mounted. False (and an absent
	// Drive) mounts nothing. A caller with no drive allocated, or one whose
	// governance profile carries DenyUserDrive, is refused rather than silently
	// given a run without it — asking for storage and not getting it is how
	// work is lost.
	Enabled bool `json:"enabled"`
	// ReadOnly, when set, NARROWS this run's mount: true forces read-only even
	// on a writable allocation. Nil leaves the resolved allocation's own posture
	// in effect.
	//
	// FALSE IS NOT A NO-OP EVERYWHERE, and the difference matters to a caller
	// scripting a run: against a READ-ONLY allocation it is REFUSED (422) and
	// never silently honoured — a run the caller believes is writable would only
	// reveal itself when the work failed to persist. On a WRITABLE allocation it
	// is a no-op, since that is the posture already in force.
	//
	// The same direction WorkspaceSelection.ReadOnly enforces, and for the same
	// reason: a run-level option may only ever narrow what an admin granted.
	ReadOnly *bool `json:"read_only,omitempty"`
}

type DrivesDocument struct {
	Drives              []UserDriveListItem `json:"drives"`
	Grants              []UserDriveGrant    `json:"grants"`
	HostRootsConfigured bool                `json:"host_roots_configured"`
	RunnerTarget        string              `json:"runner_target"`
	Disabled            bool                `json:"disabled"`
	GrantTotal          int                 `json:"grant_total"`
}

type EgressRedirect = types.EgressRedirect

type ErasePersonResult struct {
	// Person is the principal the name resolved to.
	Person string `json:"person"`
	// Scopes are the scopes erased, in the order they ran.
	Scopes []string `json:"scopes"`
	// Outcome is each scope's result: "done".
	Outcome map[string]string `json:"outcome"`
	// Detail is each scope's counts.
	Detail map[string]any `json:"detail"`
}

type GovernanceApplyResult struct {
	// Document is a fresh GetGovernance after the apply: what is actually in
	// force, which excludes every pending write.
	Document GovernanceDocument `json:"document"`
	// Pending are the writes held for a second approver. Nothing in them is
	// applied until they are approved.
	Pending []GovernanceChange `json:"pending,omitempty"`
	// Deferred are the assignments not sent because the profile they name has
	// a pending write. Apply again once that change is approved.
	Deferred []GovernanceDeferredWrite `json:"deferred,omitempty"`
	// PruneSkipped is true when prune was requested and did not run to
	// completion because a write was pending.
	PruneSkipped bool `json:"prune_skipped,omitempty"`
}

type GovernanceAssignment = types.GovernanceAssignment

type GovernanceAssignmentRequest struct {
	SubjectType CapabilitySubjectType `json:"subject_type"`
	Subject     string                `json:"subject"`
	ProfileID   uuid.UUID             `json:"profile_id"`
	Priority    int                   `json:"priority"`
}

type GovernanceChange struct {
	ID         uuid.UUID            `json:"id"`
	TargetKind string               `json:"target_kind"`
	Op         string               `json:"op"`
	TargetKey  string               `json:"target_key"`
	State      string               `json:"state"`
	ProposedBy string               `json:"proposed_by"`
	ProposedAt time.Time            `json:"proposed_at"`
	ExpiresAt  time.Time            `json:"expires_at"`
	Diff       GovernanceChangeDiff `json:"diff"`
}

type GovernanceChangeDiff struct {
	Before  json.RawMessage `json:"before,omitempty"`
	After   json.RawMessage `json:"after,omitempty"`
	Changed []string        `json:"changed,omitempty"`
}

type GovernanceDeferredWrite struct {
	SubjectType CapabilitySubjectType `json:"subject_type"`
	Subject     string                `json:"subject"`
	// Profile is the pending profile's name.
	Profile string `json:"profile"`
	// Base is set when the deferred write is a PROFILE rather than an assignment: Profile is the
	// child that was not sent, Base the profile it composes on whose write is pending.
	Base string `json:"base,omitempty"`
}

type GovernanceDocument struct {
	Profiles    []GovernanceProfile    `json:"profiles"`
	Assignments []GovernanceAssignment `json:"assignments"`
}

type GovernanceLimits = types.GovernanceLimits

type GovernanceProfile = types.GovernanceProfile

type GovernanceProfileRequest struct {
	Name    string           `json:"name"`
	Ceiling RunPolicySpec    `json:"ceiling"`
	Limits  GovernanceLimits `json:"limits"`
	// Contact is who owns the profile and how a person it refuses asks for a
	// change. nil leaves the stored contact unchanged (an older caller that
	// never sets it cannot wipe it); a pointer to an empty Contact clears it.
	Contact *PolicyContact `json:"contact,omitempty"`
	// BaseProfileID, Overlay and OverlayLimits are a composed profile's members. Left nil they are
	// omitted, which keeps the stored value; ApplyGovernance sets each to an explicit JSON null when
	// it must clear one, so a repeat apply reproduces the document and not a merge of it.
	BaseProfileID json.RawMessage `json:"base_profile_id,omitempty"`
	Overlay       json.RawMessage `json:"overlay,omitempty"`
	OverlayLimits json.RawMessage `json:"overlay_limits,omitempty"`
}

type GovernanceProfileResponse struct {
	Profile  GovernanceProfile `json:"profile"`
	Warnings []string          `json:"warnings,omitempty"`
}

type GrantKind = types.GrantKind

type GrantSpec = types.GrantSpec

type HomeTemplate = types.HomeTemplate

type KillRunResponse struct {
	ID    uuid.UUID      `json:"id"`
	State types.RunState `json:"state"`
}

type ListOpts struct {
	Limit  int
	Offset int
}

type ModelProvider = types.ModelProvider

type ModelProviderKind = types.ModelProviderKind

type ModelProviders = types.ModelProviders

type PendingApprovalError struct {
	// Changes are the writes held for approval.
	Changes []GovernanceChange
	// Deferred are the apply's writes that depend on a pending one and were
	// not sent (ApplyGovernance only).
	Deferred []GovernanceDeferredWrite
	// PruneSkipped is true when prune was requested and did not run to
	// completion because a write was pending (ApplyGovernance only).
	PruneSkipped bool
}

type PeopleListOpts struct {
	// Limit is the page size: 50 when zero, at most 200.
	Limit int
	// Cursor is the NextCursor of the previous page.
	Cursor string
	// Query keeps people whose principal or email starts with it.
	Query string
	// State is "active" or "deactivated"; empty keeps both.
	State string
}

type PersonList = types.PersonList

type PersonSummary = types.PersonSummary

type PolicyContact = policyref.Contact

type PolicyRef = policyref.Ref

type PolicyRequest struct {
	Name string              `json:"name"`
	Spec types.RunPolicySpec `json:"spec"`
}

type PreflightItem struct {
	Kind       string `json:"kind"`
	ID         string `json:"id"`
	Label      string `json:"label"`
	RequiredBy string `json:"required_by"`
	Status     string `json:"status"` // "satisfied" | "missing" | "unverified"
	Detail     string `json:"detail,omitempty"`
}

type PreflightResult struct {
	SetupItems               []PreflightItem        `json:"setup_items"`
	EnforcedConfinementClass types.ConfinementClass `json:"enforced_confinement_class"`
	// Warnings carries resolveRunPolicy's clamp notes — a member's silently
	// narrowed inline policy, a filtered grant. The same list rides
	// CreateRunResult.Warnings at launch, so a preview and the real thing say
	// the same words about the same drop.
	Warnings []string `json:"warnings,omitempty"`
}

type Preset struct {
	Name        string `json:"name"`
	Version     int    `json:"version"`
	Description string `json:"description,omitempty"`
	// UserTypes narrows who may list and launch the preset to these user
	// types; empty is every type. Admins see and launch every preset.
	UserTypes []string `json:"user_types"`
	// Request is the stored create-run body. It may not carry the
	// per-launch fields (title, task) or a preset of its own.
	Request   CreateRunRequest `json:"request"`
	CreatedAt time.Time        `json:"created_at"`
	UpdatedAt time.Time        `json:"updated_at"`
	CreatedBy string           `json:"created_by,omitempty"`
	UpdatedBy string           `json:"updated_by,omitempty"`
}

type PresetRequest struct {
	Description string           `json:"description,omitempty"`
	UserTypes   []string         `json:"user_types,omitempty"`
	Request     CreateRunRequest `json:"request"`
}

type PresetsDocument struct {
	Presets []Preset `json:"presets"`
}

type ProfileResult struct {
	Proposed struct {
		InlinePolicy RunPolicySpec `json:"inline_policy"`
	} `json:"proposed"`
	OverallRisk  string `json:"overall_risk"`
	Observations struct {
		Domains []struct {
			Host    string   `json:"host"`
			Methods []string `json:"methods"`
		} `json:"domains"`
		Anomalies []string `json:"anomalies"`
	} `json:"observations"`
	Warnings []string `json:"warnings"`
}

type ProviderAuth = types.ProviderAuth

type ProviderHarness = types.ProviderHarness

type PushContentScope = types.PushContentScope

type PushRulesSpec = types.PushRulesSpec

type RecordTaskResult struct {
	RecordRunID string   `json:"record_run_id"`
	TaskKey     string   `json:"task_key"`
	Mode        string   `json:"mode"`
	Detail      string   `json:"detail"`
	Warnings    []string `json:"warnings"`
}

type RunEvent struct {
	ID     uint64    `json:"id"`
	Type   string    `json:"type"`
	Reason string    `json:"reason,omitempty"`
	State  RunState  `json:"state,omitempty"`
	At     time.Time `json:"at"`
}

type RunFileStat struct {
	Path string `json:"path"`
	// Status is git's porcelain code ("M", "A", "D", "??", …); empty when git
	// listed the file in the diff but not in status.
	Status  string `json:"status,omitempty"`
	Added   *int   `json:"added,omitempty"`
	Deleted *int   `json:"deleted,omitempty"`
	// Binary marks a file git declined to count lines for.
	Binary bool `json:"binary,omitempty"`
}

type RunFiles struct {
	VCS       string        `json:"vcs"`
	Path      string        `json:"path,omitempty"`
	Files     []RunFileStat `json:"files"`
	Truncated bool          `json:"truncated"`
}

type RunOutput struct {
	Output string `json:"output"`
	// Truncated: Output does not start at the run's first byte.
	Truncated bool `json:"truncated"`
	// Complete: the capture is final (a stored row, or a memory tail sealed after
	// the run's last bytes), so a read never gains bytes after it. A run that
	// has just finished is not Complete until then: read again.
	Complete bool `json:"complete"`
	// Source is where the bytes came from; "stdout" for a run's own output.
	Source string `json:"source"`
	// Incomplete: bytes may be missing (a copy did not end in time or failed, or
	// a byte arrived after the capture was sealed).
	Incomplete bool `json:"incomplete"`
	// CaptureGap: the output could not be captured (no process held it), so
	// Output is empty.
	CaptureGap bool `json:"capture_gap"`
	// MaskScope is "run" when the capture was masked against the run's complete
	// manifest throughout, "globals_only" when it was not; empty when this
	// deployment keeps no manifests.
	MaskScope string `json:"mask_scope,omitempty"`
	// CapturedAt is when the final row was written; nil while the run is live.
	CapturedAt *time.Time `json:"captured_at,omitempty"`
}

type RunPolicy = types.RunPolicy

type RunPolicyChange struct {
	Cause   string   `json:"cause"`
	Field   string   `json:"field"`
	Added   []string `json:"added,omitempty"`
	Removed []string `json:"removed,omitempty"`
	// Detail is the launch-time narrowing sentences, verbatim (Cause "limits" only).
	Detail  []string   `json:"detail,omitempty"`
	Profile string     `json:"profile,omitempty"`
	At      *time.Time `json:"at,omitempty"` // when the run was restarted (Cause "restart")
}

type RunPolicySource struct {
	Kind          string     `json:"kind"`
	PolicyID      *uuid.UUID `json:"policy_id,omitempty"`
	Name          string     `json:"name,omitempty"`
	Deleted       bool       `json:"deleted,omitempty"`
	Preset        string     `json:"preset,omitempty"`
	PresetVersion int        `json:"preset_version,omitempty"`
}

type RunPolicySpec = types.RunPolicySpec

type RunPolicyView struct {
	RunID      uuid.UUID            `json:"run_id"`
	State      string               `json:"state"`
	RecordedAt *time.Time           `json:"recorded_at,omitempty"`
	Source     RunPolicySource      `json:"source"`
	Spec       *types.RunPolicySpec `json:"spec,omitempty"`
	// Redacted is true when the reader is below the security admin tier and the
	// policy holds mount sources or secret names, which read as "<redacted>" or
	// are dropped. Such a spec is a starting point, not a policy that validates.
	Redacted bool `json:"redacted"`
	// Changes is never null.
	Changes  []RunPolicyChange `json:"changes"`
	Complete bool              `json:"complete"`
	// StoredPolicyNow is set when the run started from a saved policy.
	StoredPolicyNow *StoredPolicyNow `json:"stored_policy_now,omitempty"`
}

type RunState = types.RunState

type SSHPublicKey = types.SSHPublicKey

type SiteConfig = types.SiteConfig

type SiteConfigPutResult struct {
	types.SiteConfig
	DanglingSecretRefs           []string `json:"dangling_secret_refs,omitempty"`
	OnboardingCompletedAtIgnored bool     `json:"onboarding_completed_at_ignored,omitempty"`
	// BrandingLogoPending (#1215): branding.logo_path was valid but not attached,
	// because the console has no branding record yet. Apply again after saving
	// the Branding card.
	BrandingLogoPending bool `json:"branding_logo_pending,omitempty"`
	// ModelProviderWarnings are advisories on the model_providers block, such as an azure_foundry
	// endpoint that resolves to a private address no internal_hosts entry covers.
	ModelProviderWarnings []string `json:"model_provider_warnings,omitempty"`
}

type Source = types.Source

type SourceKind = types.SourceKind

type SourceRequest struct {
	Kind types.SourceKind `json:"kind"`
	// Locator is a host directory path (local_dir) or repo slug/clone URL (repo).
	Locator string `json:"locator"`
	// Ref is an optional git ref; repo only. Part of the identity — the same
	// repo at two refs is two sources with two contracts.
	Ref  string `json:"ref,omitempty"`
	Name string `json:"name,omitempty"`
	// Requirements seeds the source's own contract (secret:/egress:/write:
	// keys; integration: keys are tier-3-only and rejected here).
	Requirements map[string]types.WorkspaceRequirement `json:"requirements,omitempty"`
}

type StoredPolicyNow struct {
	State     string     `json:"state"`
	Name      string     `json:"name,omitempty"`
	UpdatedAt *time.Time `json:"updated_at,omitempty"`
}

type UserDrive = types.UserDrive

type UserDriveGrant = types.UserDriveGrant

type UserDriveListItem = types.UserDriveListItem

type Workspace = types.Workspace

type WorkspaceAttachment = types.WorkspaceAttachment

type WorkspaceBaseImage = types.WorkspaceBaseImage

type WorkspaceKind = types.WorkspaceKind

type WorkspaceLLMCred = types.WorkspaceLLMCred

type WorkspaceMount = types.WorkspaceMount

type WorkspaceRequest struct {
	Name string `json:"name"`
	// Sources is the workspace's composition: one-or-more local_dir/repo/
	// ephemeral sources. Mutually exclusive with the legacy scalar fields
	// below (Kind/Source/Ref/DefaultTarget/Writable) — set one or the other,
	// never both. Omitting both onboards the composition floor: one ephemeral
	// scratch source.
	Sources []types.WorkspaceSource `json:"sources,omitempty"`
	// BaseImage is the workspace's base-image choice. Nil means the platform
	// default convention image for the detected/scanned stack.
	BaseImage *types.WorkspaceBaseImage `json:"base_image,omitempty"`

	// Deprecated: Kind/Source/Ref/DefaultTarget/Writable are the pre-
	// composition-model scalar shape — a single source, folded server-side
	// into Sources[0] (legacyWorkspaceSource). Kept so
	// `wardyn workspace create --kind local_dir --source /x` and existing SDK
	// callers keep working; prefer Sources for a new caller, especially a
	// multi-source one.
	Kind          types.WorkspaceKind `json:"kind,omitempty"`
	Source        string              `json:"source,omitempty"`
	Ref           string              `json:"ref,omitempty"`
	DefaultTarget string              `json:"default_target,omitempty"`
	// Deprecated: see Kind. Writable opts the single legacy source into a
	// READ-WRITE mount for import Record/Verify runs; omitted/false is
	// read-only (the safe default). A sandboxed agent's changes then PERSIST
	// to the host directory. A multi-source caller sets WorkspaceSource.Writable
	// per source instead.
	Writable bool `json:"writable,omitempty"`
	// LLMCred is the operator-owned model/harness credential BINDING for this
	// workspace/container (refs/names only). A run that picks the workspace
	// inherits this model access. Nil => no binding. CREATE-ONLY: the update
	// handler ignores it, so changing a binding needs the standalone
	// PUT /workspaces/{id}/llm-cred route (not covered by this SDK).
	LLMCred *types.WorkspaceLLMCred `json:"llm_cred,omitempty"`
}

type WorkspaceRequirement = types.WorkspaceRequirement

type WorkspaceSelection struct {
	// WorkspaceID is the workspace this selection applies to (string form of
	// its uuid — matched against the run's referenced workspaces by id).
	WorkspaceID string `json:"workspace_id"`
	// EnabledOptional lists the workspace's OPTIONAL requirement KEYS (the
	// exact "<type>:<key>" form, e.g. "egress:api.stripe.com" or
	// "write:/home/user/repo") this run opts into. A key not listed here stays
	// at its safe default (no egress, no grant, read-only mount).
	EnabledOptional []string `json:"enabled_optional,omitempty"`
	// ReadOnly, when set, NARROWS this workspace's write:<path> requirements —
	// true forces every one read-only even if Required or enabled; false is a
	// no-op (a selection may only narrow what the contract already grants,
	// never widen it — see the fold in internal/api/runs_create.go). Nil
	// leaves the contract's own resolved default in effect.
	ReadOnly *bool `json:"read_only,omitempty"`
}

type WorkspaceSource = types.WorkspaceSource

type WorkspaceSourceType = types.WorkspaceSourceType

type WorkspaceStatus = types.WorkspaceStatus