ddm

type ACMECredential struct {
	// Specifies the directory URL of the ACME server. Use the `https` scheme for the URL.
	DirectoryURL string `plist:"DirectoryURL" json:"DirectoryURL"`
	// The server can use this as a one-time code to prevent issuing multiple certificates. It
	// also indicates to the ACME server that the device has access to a valid client
	// identifier that the enterprise infrastructure issued. This can help the ACME server
	// determine whether to trust the device, however this is a relatively weak indication
	// because of the risk that an attacker may intercept and duplicate the client identifier.
	ClientIdentifier string `plist:"ClientIdentifier" json:"ClientIdentifier"`
	// The valid values for `KeySize` depend on the values of `KeyType` and `HardwareBound`.
	// See those keys for specific requirements.
	KeySize int64 `plist:"KeySize" json:"KeySize"`
	// Specifies the type of key pair to generate.
	KeyType string `plist:"KeyType" json:"KeyType"`
	// If `false`, the private key isn't bound to the device.
	HardwareBound bool `plist:"HardwareBound" json:"HardwareBound"`
	// The device requests this subject for the certificate that the ACME server issues. The
	// ACME server may override or ignore this field in the certificate it issues.
	Subject [][][]string `plist:"Subject,omitempty" json:"Subject,omitempty"`
	// Specifies the subject's alternative name that the device requests for the certificate
	// that the ACME server issues. The ACME server may override or ignore this field in the
	// certificate it issues.
	SubjectAltName *ACMECredentialSubjectAltName `plist:"SubjectAltName,omitempty" json:"SubjectAltName,omitempty"`
	// The device requests this key usage for the certificate that the ACME server issues. The
	// ACME server may override or ignore this field in the certificate it issues.
	UsageFlags *int64 `plist:"UsageFlags,omitempty" json:"UsageFlags,omitempty"`
	// The device requests this extended key usage for the certificate that the ACME server
	// issues. The ACME server may override or ignore this field in the certificate it issues.
	ExtendedKeyUsage []string `plist:"ExtendedKeyUsage,omitempty" json:"ExtendedKeyUsage,omitempty"`
	// If `true`, the device provides attestations that describe the device and the generated
	// key to the ACME server. The server can use the attestations as strong evidence that the
	// key is bound to the device, and that the device has properties listed in the
	// attestation. The server can use that as part of a trust score to decide whether to issue
	// the requested certificate. When `Attest` is `true`, set `HardwareBound` to `true`. On
	// macOS, set this key, if present, to `false`. The hardware requirements for attestation
	// are described below.
	Attest *bool `plist:"Attest,omitempty" json:"Attest,omitempty"`
}

type ACMECredentialSubjectAltName struct {
	// The RFC 822 email address.
	Rfc822Name *string `plist:"rfc822Name,omitempty" json:"rfc822Name,omitempty"`
	// The DNS name.
	DNSName *string `plist:"dNSName,omitempty" json:"dNSName,omitempty"`
	// The uniform resource identifier.
	UniformResourceIdentifier *string `plist:"uniformResourceIdentifier,omitempty" json:"uniformResourceIdentifier,omitempty"`
	// The NT principal name. Use an other name OID set to `1.3.6.1.4.1.311.20.2.3`.
	NtPrincipalName *string `plist:"ntPrincipalName,omitempty" json:"ntPrincipalName,omitempty"`
}

type AccountCalDAV struct {
	// The name that apps show to the user for this calendar account. If not present, the
	// system generates a suitable default.
	VisibleName *string `plist:"VisibleName,omitempty" json:"VisibleName,omitempty"`
	// The hostname or IP address of the CalDAV server.
	HostName string `plist:"HostName" json:"HostName"`
	// The port number for the CalDAV server.
	Port *int64 `plist:"Port,omitempty" json:"Port,omitempty"`
	// The path for the CalDAV server.
	Path *string `plist:"Path,omitempty" json:"Path,omitempty"`
	// The identifier of an asset declaration that contains the credentials for this account.
	// Set the corresponding asset type to `CredentialUserNameAndPassword`.
	AuthenticationCredentialsAssetReference *string `plist:"AuthenticationCredentialsAssetReference,omitempty" json:"AuthenticationCredentialsAssetReference,omitempty"`
}

type AccountCardDAV struct {
	// The name that apps show to the user for this address book account. If not present, the
	// system generates a suitable default.
	VisibleName *string `plist:"VisibleName,omitempty" json:"VisibleName,omitempty"`
	// The hostname or IP address of the CardDAV server.
	HostName string `plist:"HostName" json:"HostName"`
	// The port number for the CardDAV server.
	Port *int64 `plist:"Port,omitempty" json:"Port,omitempty"`
	// The path for the CardDAV server.
	Path *string `plist:"Path,omitempty" json:"Path,omitempty"`
	// The identifier of an asset declaration that contains the credentials for this account.
	// Set the corresponding asset type to `CredentialUserNameAndPassword`.
	AuthenticationCredentialsAssetReference *string `plist:"AuthenticationCredentialsAssetReference,omitempty" json:"AuthenticationCredentialsAssetReference,omitempty"`
}

type AccountExchange struct {
	// The name that apps show to the user for this Exchange account. If not present, the
	// system generates a suitable default.
	VisibleName *string `plist:"VisibleName,omitempty" json:"VisibleName,omitempty"`
	// The set of protocol types to enable on the Exchange server, in order of preference. This
	// is an array of unique strings with possible values:
	EnabledProtocolTypes []string `plist:"EnabledProtocolTypes,omitempty" json:"EnabledProtocolTypes,omitempty"`
	// The identifier of an asset declaration that contains the user identity for this account.
	// The corresponding asset must be of type `UserIdentity`.
	UserIdentityAssetReference *string `plist:"UserIdentityAssetReference,omitempty" json:"UserIdentityAssetReference,omitempty"`
	// The IP address or fully qualified domain name (FQDN) of the Exchange host.
	HostName *string `plist:"HostName,omitempty" json:"HostName,omitempty"`
	// The port number of the EWS server. The system uses this only when this declaration has a
	// `HostName` value.
	Port *int64 `plist:"Port,omitempty" json:"Port,omitempty"`
	// The path of the EWS server. The system uses this only when this declaration has a
	// `HostName` value.
	Path *string `plist:"Path,omitempty" json:"Path,omitempty"`
	// The external hostname of the EWS server (or IP address).
	ExternalHostName *string `plist:"ExternalHostName,omitempty" json:"ExternalHostName,omitempty"`
	// The external port number of the EWS server. The system uses this only when this
	// declaration has a `ExternalHostName` value.
	ExternalPort *int64 `plist:"ExternalPort,omitempty" json:"ExternalPort,omitempty"`
	// The external path of the EWS server. The system uses this only when this declaration has
	// a `ExternalHostName` value.
	ExternalPath *string `plist:"External Path,omitempty" json:"External Path,omitempty"`
	// The configuration settings for OAuth for this account.
	OAuth *AccountExchangeOAuth `plist:"OAuth,omitempty" json:"OAuth,omitempty"`
	// The identifier of an asset declaration that contains the credentials for this account to
	// authenticate with an Exchange server. Set the corresponding asset type to
	// `CredentialUserNameAndPassword`.
	AuthenticationCredentialsAssetReference *string `plist:"AuthenticationCredentialsAssetReference,omitempty" json:"AuthenticationCredentialsAssetReference,omitempty"`
	// The identifier of a credential asset declaration that contains the identity that this
	// account requires to authenticate with the Exchange server.
	AuthenticationIdentityAssetReference *string `plist:"AuthenticationIdentityAssetReference,omitempty" json:"AuthenticationIdentityAssetReference,omitempty"`
	// Settings for S/MIME.
	SMIME *AccountExchangeSMIME `plist:"SMIME,omitempty" json:"SMIME,omitempty"`
	// If `true`, the system activates the mail service for this account.
	MailServiceActive *bool `plist:"MailServiceActive,omitempty" json:"MailServiceActive,omitempty"`
	// If `true`, the system prevents the user from changing the status of the mail service for
	// this account.
	LockMailService *bool `plist:"LockMailService,omitempty" json:"LockMailService,omitempty"`
	// If `true`, activates the address book service for this account.
	ContactsServiceActive *bool `plist:"ContactsServiceActive,omitempty" json:"ContactsServiceActive,omitempty"`
	// If `true`, the system prevents the user from changing the status of the address book
	// service for this account.
	LockContactsService *bool `plist:"LockContactsService,omitempty" json:"LockContactsService,omitempty"`
	// If `true`, activates the calendar service for this account.
	CalendarServiceActive *bool `plist:"CalendarServiceActive,omitempty" json:"CalendarServiceActive,omitempty"`
	// If `true`, the system prevents the user from changing the status of the calendar service
	// for this account.
	LockCalendarService *bool `plist:"LockCalendarService,omitempty" json:"LockCalendarService,omitempty"`
	// If `true`, the system activates the reminders service for this account.
	RemindersServiceActive *bool `plist:"RemindersServiceActive,omitempty" json:"RemindersServiceActive,omitempty"`
	// If `true`, the system prevents the user from changing the status of the reminders
	// service for this account.
	LockRemindersService *bool `plist:"LockRemindersService,omitempty" json:"LockRemindersService,omitempty"`
	// If `true`, the system activates the notes service for this account.
	NotesServiceActive *bool `plist:"NotesServiceActive,omitempty" json:"NotesServiceActive,omitempty"`
	// If `true`, the system prevents the user from changing the status of the notes service
	// for this account.
	LockNotesService *bool `plist:"LockNotesService,omitempty" json:"LockNotesService,omitempty"`
}

type AccountExchangeOAuth struct {
	// If `true`, enables OAuth for this account.
	Enabled bool `plist:"Enabled" json:"Enabled"`
	// The URL that this account uses for signing in with OAuth. The system ignores this value
	// unless `Enabled` is `true`. The system doesn't use autodiscovery when a declaration
	// contains this URL, so the declaration must also contain a `HostName`.
	SignInURL *string `plist:"SignInURL,omitempty" json:"SignInURL,omitempty"`
	// The URL that this account uses for token requests with OAuth. The system ignores this
	// value unless `Enabled` is `true`.
	TokenRequestURL *string `plist:"TokenRequestURL,omitempty" json:"TokenRequestURL,omitempty"`
}

type AccountExchangeSMIME struct {
	// Settings for S/MIME signing.
	Signing *AccountExchangeSMIMESigning `plist:"Signing,omitempty" json:"Signing,omitempty"`
	// Settings for S/MIME encryption.
	Encryption *AccountExchangeSMIMEEncryption `plist:"Encryption,omitempty" json:"Encryption,omitempty"`
}

type AccountExchangeSMIMEEncryption struct {
	// If `true`, the system enables S/MIME encryption by default, which the user can't
	// override if `PerMessageSwitchEnabled` is `false`.
	Enabled bool `plist:"Enabled" json:"Enabled"`
	// Specifies the identifier of an asset declaration containing the identity required for
	// S/MIME encryption. The system attaches the public certificate to outgoing mail to allow
	// the user to receive encrypted mail. When the user sends encrypted mail, the system uses
	// the public certificate to encrypt the copy of the mail in their Sent mailbox.
	IdentityAssetReference *string `plist:"IdentityAssetReference,omitempty" json:"IdentityAssetReference,omitempty"`
	// If `true`, the user can turn S/MIME encryption by default on or off in Settings.
	UserOverrideable *bool `plist:"UserOverrideable,omitempty" json:"UserOverrideable,omitempty"`
	// If `true`, the user can select an S/MIME signing identity in Settings.
	IdentityUserOverrideable *bool `plist:"IdentityUserOverrideable,omitempty" json:"IdentityUserOverrideable,omitempty"`
	// If `true`, the system enables the per-message encryption switch in the compose view.
	PerMessageSwitchEnabled *bool `plist:"PerMessageSwitchEnabled,omitempty" json:"PerMessageSwitchEnabled,omitempty"`
}

type AccountExchangeSMIMESigning struct {
	// If `true`, the system enables S/MIME signing.
	Enabled bool `plist:"Enabled" json:"Enabled"`
	// Specifies the identifier of an asset declaration containing the identity required for
	// S/MIME signing of messages sent from this account.
	IdentityAssetReference *string `plist:"IdentityAssetReference,omitempty" json:"IdentityAssetReference,omitempty"`
	// If `true`, the user can turn S/MIME signing on or off in Settings.
	UserOverrideable *bool `plist:"UserOverrideable,omitempty" json:"UserOverrideable,omitempty"`
	// If `true`, the user can select an S/MIME signing identity in Settings.
	IdentityUserOverrideable *bool `plist:"IdentityUserOverrideable,omitempty" json:"IdentityUserOverrideable,omitempty"`
}

type AccountGoogle struct {
	// The name that apps show to the user for this Google account. If not present, the system
	// generates a suitable default.
	VisibleName *string `plist:"VisibleName,omitempty" json:"VisibleName,omitempty"`
	// The identifier of an asset declaration that contains the user identity for this Google
	// account. Set the corresponding asset type to `UserIdentity` and ensure that it contains
	// an `EmailAddress` key that specifies the full Google email address for the account.
	UserIdentityAssetReference string `plist:"UserIdentityAssetReference" json:"UserIdentityAssetReference"`
}

type AccountLDAP struct {
	// The name that apps show to the user for this LDAP account. If not present, the system
	// generates a suitable default.
	VisibleName *string `plist:"VisibleName,omitempty" json:"VisibleName,omitempty"`
	// The hostname or IP address of the LDAP server.
	HostName string `plist:"HostName" json:"HostName"`
	// The port number or IP address of the LDAP server.
	Port *int64 `plist:"Port,omitempty" json:"Port,omitempty"`
	// The identifier of an asset declaration that contains the credentials for this account.
	// Set the corresponding asset type to `CredentialUserNameAndPassword`.
	AuthenticationCredentialsAssetReference *string `plist:"AuthenticationCredentialsAssetReference,omitempty" json:"AuthenticationCredentialsAssetReference,omitempty"`
	// The array of nodes to start LDAP searches from. There must be at least one node for this
	// account to be useful. macOS only searches one node and ignores other items in the array.
	SearchSettings []AccountLDAPSearchSettings `plist:"SearchSettings,omitempty" json:"SearchSettings,omitempty"`
}

type AccountLDAPSearchSettings struct {
	// The description of this search setting in the Contacts and Settings apps. If not
	// present, the apps display no name.
	VisibleDescription *string `plist:"VisibleDescription,omitempty" json:"VisibleDescription,omitempty"`
	// The path to the node where a search starts. For example, `ou=people,o=example corp`.
	SearchBase string `plist:"SearchBase" json:"SearchBase"`
	// The type of recursion to use in the search:
	Scope *string `plist:"Scope,omitempty" json:"Scope,omitempty"`
}

type AccountMail struct {
	// The name that apps show to the user for this mail account. If not present, the system
	// generates a suitable default.
	VisibleName *string `plist:"VisibleName,omitempty" json:"VisibleName,omitempty"`
	// The identifier of an asset declaration that contains the user identity for this account.
	// Set the corresponding asset type to `UserIdentity`.
	UserIdentityAssetReference *string `plist:"UserIdentityAssetReference,omitempty" json:"UserIdentityAssetReference,omitempty"`
	// The settings for the incoming mail server for this account.
	IncomingServer AccountMailIncomingServer `plist:"IncomingServer,omitempty" json:"IncomingServer,omitempty"`
	// The settings for the outgoing mail server for this account.
	OutgoingServer AccountMailOutgoingServer `plist:"OutgoingServer,omitempty" json:"OutgoingServer,omitempty"`
	// Settings for S/MIME.
	SMIME *AccountMailSMIME `plist:"SMIME,omitempty" json:"SMIME,omitempty"`
}

type AccountMailIncomingServer struct {
	// The mail protocol this account uses.
	ServerType string `plist:"ServerType" json:"ServerType"`
	// The host name for the incoming mail server.
	HostName string `plist:"HostName" json:"HostName"`
	// The port number for the incoming mail server.
	Port *int64 `plist:"Port,omitempty" json:"Port,omitempty"`
	// The authentication method for the incoming mail server.
	AuthenticationMethod string `plist:"AuthenticationMethod" json:"AuthenticationMethod"`
	// The identifier of an asset declaration that contains the credentials for this account to
	// authenticate with an incoming mail server. The corresponding asset must be of type
	// `CredentialUserNameAndPassword`.
	AuthenticationCredentialsAssetReference *string `plist:"AuthenticationCredentialsAssetReference,omitempty" json:"AuthenticationCredentialsAssetReference,omitempty"`
	// The path prefix for the IMAP server. The system uses this only when `ServerType` is
	// `IMAP`.
	IMAPPathPrefix *string `plist:"IMAPPathPrefix,omitempty" json:"IMAPPathPrefix,omitempty"`
}

type AccountMailOutgoingServer struct {
	// The host name for the outgoing mail server.
	HostName string `plist:"HostName" json:"HostName"`
	// The port number for the outgoing mail server.
	Port *int64 `plist:"Port,omitempty" json:"Port,omitempty"`
	// The authentication method for the outgoing mail server.
	AuthenticationMethod string `plist:"AuthenticationMethod" json:"AuthenticationMethod"`
	// The identifier of an asset declaration that contains the credentials for this account to
	// authenticate with an outgoing mail server. The corresponding asset must be of type
	// `CredentialUserNameAndPassword`.
	AuthenticationCredentialsAssetReference *string `plist:"AuthenticationCredentialsAssetReference,omitempty" json:"AuthenticationCredentialsAssetReference,omitempty"`
}

type AccountMailSMIME struct {
	// Settings for S/MIME signing.
	Signing *AccountMailSMIMESigning `plist:"Signing,omitempty" json:"Signing,omitempty"`
	// Settings for S/MIME encryption.
	Encryption *AccountMailSMIMEEncryption `plist:"Encryption,omitempty" json:"Encryption,omitempty"`
}

type AccountMailSMIMEEncryption struct {
	// If `true`, the system enables S/MIME encryption by default, which the user can't
	// override if `PerMessageSwitchEnabled` is `false`.
	Enabled bool `plist:"Enabled" json:"Enabled"`
	// Specifies the identifier of an asset declaration containing the identity required for
	// S/MIME encryption. The system attaches the public certificate to outgoing mail to allow
	// the user to receive encrypted mail. When the user sends encrypted mail, the system uses
	// the public certificate to encrypt the copy of the mail in their Sent mailbox.
	IdentityAssetReference *string `plist:"IdentityAssetReference,omitempty" json:"IdentityAssetReference,omitempty"`
	// If `true`, the user can set the default value for S/MIME encryption to on or off in
	// Settings.
	UserOverrideable *bool `plist:"UserOverrideable,omitempty" json:"UserOverrideable,omitempty"`
	// If `true`, the user can select an S/MIME signing identity in Settings.
	IdentityUserOverrideable *bool `plist:"IdentityUserOverrideable,omitempty" json:"IdentityUserOverrideable,omitempty"`
	// If `true`, the system enables the per-message encryption switch in the compose view.
	PerMessageSwitchEnabled *bool `plist:"PerMessageSwitchEnabled,omitempty" json:"PerMessageSwitchEnabled,omitempty"`
}

type AccountMailSMIMESigning struct {
	// If `true`, the system enables S/MIME signing.
	Enabled bool `plist:"Enabled" json:"Enabled"`
	// Specifies the identifier of an asset declaration containing the identity required for
	// S/MIME signing of messages sent from this account.
	IdentityAssetReference *string `plist:"IdentityAssetReference,omitempty" json:"IdentityAssetReference,omitempty"`
	// If `true`, the user can turn S/MIME signing on or off in Settings.
	UserOverrideable *bool `plist:"UserOverrideable,omitempty" json:"UserOverrideable,omitempty"`
	// If `true`, the user can select an S/MIME signing identity in Settings.
	IdentityUserOverrideable *bool `plist:"IdentityUserOverrideable,omitempty" json:"IdentityUserOverrideable,omitempty"`
}

type AccountSubscribedCalendar struct {
	// The name that apps show to the user for this calendar account. If not present, the
	// system generates a suitable default.
	VisibleName *string `plist:"VisibleName,omitempty" json:"VisibleName,omitempty"`
	// The URL of the subscribed calendar, which needs to start with `https://`.
	CalendarURL string `plist:"CalendarURL" json:"CalendarURL"`
	// The identifier of an asset declaration that contains the credentials for this account to
	// authenticate with a calendar server. Set the corresponding asset type to
	// `CredentialUserNameAndPassword`.
	AuthenticationCredentialsAssetReference *string `plist:"AuthenticationCredentialsAssetReference,omitempty" json:"AuthenticationCredentialsAssetReference,omitempty"`
}

type ActivationSimple struct {
	// An array of strings that specify the identifiers of configurations to install. A failure
	// to install one of the configurations doesn't prevent other configurations from
	// installing.
	StandardConfigurations []string `plist:"StandardConfigurations,omitempty" json:"StandardConfigurations,omitempty"`
	// A predicate format string as [Apple's Predicate
	// Programming](https://developer.apple.com/library/archive/documentation/Cocoa/Conceptual/Predicates/AdditionalChapters/Introduction.html)
	// describes. The activation only installs when the predicate evaluates to `true` or isn't
	// present.
	Predicate *string `plist:"Predicate,omitempty" json:"Predicate,omitempty"`
}

type AppManaged struct {
	// The App Store ID of the managed app that is downloaded from the App Store.
	AppStoreID *string `plist:"AppStoreID,omitempty" json:"AppStoreID,omitempty"`
	// The bundle ID of the managed app that is downloaded from the App Store.
	BundleID *string `plist:"BundleID,omitempty" json:"BundleID,omitempty"`
	// The URL of the manifest for the managed app that the device downloads from a web site.
	// The manifest is returned as a `ManifestURL` property list.
	ManifestURL *string `plist:"ManifestURL,omitempty" json:"ManifestURL,omitempty"`
	// A string that specifies the composed identifier of an existing app that needs to be
	// managed. The device uses this to take over management of an app installed by some other
	// process, for example installed manually by the user, or via a package configuration. If
	// the app isn't present when the device applies the configuration, the device takes over
	// management of it when it does install.
	AppComposedIdentifier *string `plist:"AppComposedIdentifier,omitempty" json:"AppComposedIdentifier,omitempty"`
	// If `true`, the device installs an iOS or iPadOS app that runs on a Mac with Apple
	// Silicon. This is only used when the app is an App Store app.
	IOSApp *bool `plist:"iOSApp,omitempty" json:"iOSApp,omitempty"`
	// A dictionary that describes how and when to install the app.
	InstallBehavior *AppManagedInstallBehavior `plist:"InstallBehavior,omitempty" json:"InstallBehavior,omitempty"`
	// A dictionary that specifies how the device updates apps.
	UpdateBehavior *AppManagedUpdateBehavior `plist:"UpdateBehavior,omitempty" json:"UpdateBehavior,omitempty"`
	// If `true`, backups contain the app and its data.
	IncludeInBackup *bool `plist:"IncludeInBackup,omitempty" json:"IncludeInBackup,omitempty"`
	// A dictionary of values to associate with the app.
	Attributes *AppManagedAttributes `plist:"Attributes,omitempty" json:"Attributes,omitempty"`
	// A dictionary of app config data and credentials.
	AppConfig *AppManagedAppConfigDictionary `plist:"AppConfig,omitempty" json:"AppConfig,omitempty"`
	// A dictionary of extension config data and credentials.
	ExtensionConfigs map[string]AppManagedAppConfigDictionary `plist:"ExtensionConfigs,omitempty" json:"ExtensionConfigs,omitempty"`
	// The identifier of an asset declaration containing a reference to the app config data.
	// The device provides the app config data to the app using the MDMv1 behavior. The
	// corresponding asset needs to be of type `com.apple.asset.data`. The referenced data
	// needs to be a property list file, and the asset's "ContentType" value set to match the
	// data type.
	LegacyAppConfigAssetReference *string `plist:"LegacyAppConfigAssetReference,omitempty" json:"LegacyAppConfigAssetReference,omitempty"`
}

type AppManagedAppConfigDictionary struct {
	// Specifies the identifier of an asset declaration containing a reference to the app or
	// extension config data. The corresponding asset needs to be of type
	// `com.apple.asset.data`. The referenced data needs to be a property list file, and the
	// asset's "ContentType" value set to match the data type.
	DataAssetReference *string `plist:"DataAssetReference,omitempty" json:"DataAssetReference,omitempty"`
	// Provides passwords to the managed app or extension. Each element in the array contains a
	// password asset reference and an associated identifier which the app or extension uses to
	// look up the password.
	Passwords []AppManagedCredentialConfig `plist:"Passwords,omitempty" json:"Passwords,omitempty"`
	// Provides identities to the managed app or extension. Each element in the array contains
	// an identity asset reference and an associated identifier which the app or extension uses
	// to look up the identity.
	Identities []AppManagedCredentialConfig `plist:"Identities,omitempty" json:"Identities,omitempty"`
	// Provides certificates to the managed app or extension. Each element in the array
	// contains a certificate asset reference and an associated identifier which the app or
	// extension uses to look up the certificate.
	Certificates []AppManagedCredentialConfig `plist:"Certificates,omitempty" json:"Certificates,omitempty"`
}

type AppManagedAttributes struct {
	// An array of domain names to associate with the app.
	AssociatedDomains []string `plist:"AssociatedDomains,omitempty" json:"AssociatedDomains,omitempty"`
	// If `true`, the system enables direct downloads for the `AssociatedDomains`.
	AssociatedDomainsEnableDirectDownloads *bool `plist:"AssociatedDomainsEnableDirectDownloads,omitempty" json:"AssociatedDomainsEnableDirectDownloads,omitempty"`
	// The cellular slice identifier, which can be the data network name (DNN) or app category.
	// For DNN, encode the value as "DNN:name", where "name" is the carrier-provided DNN name.
	// For app category, encode the value as "AppCategory:category", where "category" is a
	// carrier-provided string such as "Enterprise1".
	CellularSliceUUID *string `plist:"CellularSliceUUID,omitempty" json:"CellularSliceUUID,omitempty"`
	// The UUID of the content filter to associate with the app.
	ContentFilterUUID *string `plist:"ContentFilterUUID,omitempty" json:"ContentFilterUUID,omitempty"`
	// The UUID of the DNS proxy to associate with the app.
	DNSProxyUUID *string `plist:"DNSProxyUUID,omitempty" json:"DNSProxyUUID,omitempty"`
	// If `false`, the system prevents the user from hiding the app. It doesn't affect the
	// user's ability to leave it in the App Library, while removing it from the Home Screen.
	Hideable *bool `plist:"Hideable,omitempty" json:"Hideable,omitempty"`
	// If `false`, the system prevents the user from locking the app. This also prevents the
	// user from hiding the app.
	Lockable *bool `plist:"Lockable,omitempty" json:"Lockable,omitempty"`
	// The UUID of the relay to associate with the app.
	RelayUUID *string `plist:"RelayUUID,omitempty" json:"RelayUUID,omitempty"`
	// If `true`, the device automatically locks after every transaction that requires a
	// customer's card PIN. If `false`, the user can choose the behavior.
	TapToPayScreenLock *bool `plist:"TapToPayScreenLock,omitempty" json:"TapToPayScreenLock,omitempty"`
	// The UUID of the VPN to associate with the app.
	VPNUUID *string `plist:"VPNUUID,omitempty" json:"VPNUUID,omitempty"`
}

type AppManagedCredentialConfig struct {
	// The app or extension uses this identifier to fetch the corresponding password using the
	// `ManagedApp` framework. App developers define the values for these identifiers.
	Identifier string `plist:"Identifier" json:"Identifier"`
	// Specifies the identifier of an asset declaration containing a username and password. The
	// `ManagedApp` framework makes the password available to the app or extension. The
	// `ManagedApp` framework ignores the username.
	AssetReference string `plist:"AssetReference" json:"AssetReference"`
}

type AppManagedInstallBehavior struct {
	// A string that specifies if the app needs to remain on the device at all times or if the
	// user can freely install and remove it, which is one of the following values:
	Install *string `plist:"Install,omitempty" json:"Install,omitempty"`
	// A dictionary that describes the app's license.
	License *AppManagedInstallBehaviorLicense `plist:"License,omitempty" json:"License,omitempty"`
	// The App Store external version identifier (EVID) of the version of the app the device
	// installs. You can retrieve this value from the App Store. For more information, see
	// `Apps and Books for Organizations`. This key is ignored if the app isn't an App Store
	// app.
	Version *int64 `plist:"Version,omitempty" json:"Version,omitempty"`
	// Indicates how the device uses a cellular network when it downloads the app for automatic
	// install or update operations:
	AllowDownloadsOverCellular *string `plist:"AllowDownloadsOverCellular,omitempty" json:"AllowDownloadsOverCellular,omitempty"`
}

type AppManagedInstallBehaviorLicense struct {
	// The type of license that the app uses for installation through the App Store, which is
	// one of the following values:
	Assignment *string `plist:"Assignment,omitempty" json:"Assignment,omitempty"`
	// The type of VPP license that the app uses for installation through the App Store, which
	// is one of the following values:
	VPPType *string `plist:"VPPType,omitempty" json:"VPPType,omitempty"`
}

type AppManagedUpdateBehavior struct {
	// Specifies whether the device automatically updates the app:
	AutomaticAppUpdates string `plist:"AutomaticAppUpdates" json:"AutomaticAppUpdates"`
}

type AssetCredentialACME struct {
	// The external reference. Ensure that the asset data:
	Reference AssetCredentialACMEReference `plist:"Reference,omitempty" json:"Reference,omitempty"`
	// The server authentication details.
	Authentication *AssetCredentialACMEAuthentication `plist:"Authentication,omitempty" json:"Authentication,omitempty"`
	// The keychain accessibility that determines when the keychain item is available for use,
	// which has these allowed values:
	Accessible *string `plist:"Accessible,omitempty" json:"Accessible,omitempty"`
}

type AssetCredentialACMEAuthentication struct {
	// The type of authentication, which has these allowed values: - `MDM`: A request that uses
	// MDM semantics, which includes the device-identity certificate, and any user
	// authentication. This is equivalent to an MDM request made to the `CheckInURL` or
	// `ServerURL`. This option is only available through declarative device management. -
	// `None`: A standard GET request.
	Type string `plist:"Type" json:"Type"`
}

type AssetCredentialACMEReference struct {
	// The URL to retrieve data, which needs to start with `https://`.
	DataURL string `plist:"DataURL" json:"DataURL"`
	// The media type that describes the data. If present, the system checks the actual media
	// type of the downloaded data, and an error occurs if the values don't match.
	ContentType *string `plist:"ContentType,omitempty" json:"ContentType,omitempty"`
	// The size of the data. Set the size to `0` if there's no expectation of a response body.
	// If present, the system checks the actual size of the downloaded data, and an error
	// occurs if the values don't match.
	Size *int64 `plist:"Size,omitempty" json:"Size,omitempty"`
	// A SHA-256 hash of the data stored at the `DataURL`. Don't set this value if `Size` is
	// `0` as the client ignores it. However, if present, the system checks the actual hash of
	// the downloaded data, and an error occurs if the values don't match.
	HashSHA256 *string `plist:"Hash-SHA-256,omitempty" json:"Hash-SHA-256,omitempty"`
}

type AssetCredentialCertificate struct {
	// The external reference. Ensure that the asset data uses a media type of
	// `application/pkcs1` or `application/pem` to correctly identify the type of encoded
	// certificate. If the asset data includes a `ContentType` sub-key, set it to the
	// corresponding media type.
	Reference AssetCredentialCertificateReference `plist:"Reference,omitempty" json:"Reference,omitempty"`
	// The server authentication details.
	Authentication *AssetCredentialCertificateAuthentication `plist:"Authentication,omitempty" json:"Authentication,omitempty"`
}

type AssetCredentialCertificateAuthentication struct {
	// The type of authentication, which has these allowed values: - `MDM`: A request that uses
	// MDM semantics, which includes the device-identity certificate, and any user
	// authentication. This is equivalent to an MDM request made to the `CheckInURL` or
	// `ServerURL`. This option is only available through declarative device management. -
	// `None`: A standard GET request.
	Type string `plist:"Type" json:"Type"`
}

type AssetCredentialCertificateReference struct {
	// The URL to retrieve data, which needs to start with `https://`.
	DataURL string `plist:"DataURL" json:"DataURL"`
	// The media type that describes the data. If present, the system checks the actual media
	// type of the downloaded data, and an error occurs if the values don't match.
	ContentType *string `plist:"ContentType,omitempty" json:"ContentType,omitempty"`
	// The size of the data. Set the size to `0` if there's no expectation of a response body.
	// If present, the system checks the actual size of the downloaded data, and an error
	// occurs if the values don't match.
	Size *int64 `plist:"Size,omitempty" json:"Size,omitempty"`
	// A SHA-256 hash of the data stored at the `DataURL`. Don't set this value if `Size` is
	// `0` as the client ignores it. However, if present, the system checks the actual hash of
	// the downloaded data, and an error occurs if the values don't match.
	HashSHA256 *string `plist:"Hash-SHA-256,omitempty" json:"Hash-SHA-256,omitempty"`
}

type AssetCredentialIdentity struct {
	// The external reference. Ensure that the asset data:
	Reference AssetCredentialIdentityReference `plist:"Reference,omitempty" json:"Reference,omitempty"`
	// The server authentication details.
	Authentication *AssetCredentialIdentityAuthentication `plist:"Authentication,omitempty" json:"Authentication,omitempty"`
	// The keychain accessibility that determines when the keychain item is available for use,
	// which has these allowed values:
	Accessible *string `plist:"Accessible,omitempty" json:"Accessible,omitempty"`
}

type AssetCredentialIdentityAuthentication struct {
	// The type of authentication, which has these allowed values: - `MDM`: A request that uses
	// MDM semantics, which includes the device-identity certificate, and any user
	// authentication. This is equivalent to an MDM request made to the `CheckInURL` or
	// `ServerURL`. This option is only available through declarative device management. -
	// `None`: A standard GET request.
	Type string `plist:"Type" json:"Type"`
}

type AssetCredentialIdentityReference struct {
	// The URL to retrieve data, which needs to start with `https://`.
	DataURL string `plist:"DataURL" json:"DataURL"`
	// The media type that describes the data. If present, the system checks the actual media
	// type of the downloaded data, and an error occurs if the values don't match.
	ContentType *string `plist:"ContentType,omitempty" json:"ContentType,omitempty"`
	// The size of the data. Set the size to `0` if there's no expectation of a response body.
	// If present, the system checks the actual size of the downloaded data, and an error
	// occurs if the values don't match.
	Size *int64 `plist:"Size,omitempty" json:"Size,omitempty"`
	// A SHA-256 hash of the data stored at the `DataURL`. Don't set this value if `Size` is
	// `0` as the client ignores it. However, if present, the system checks the actual hash of
	// the downloaded data, and an error occurs if the values don't match.
	HashSHA256 *string `plist:"Hash-SHA-256,omitempty" json:"Hash-SHA-256,omitempty"`
}

type AssetCredentialSCEP struct {
	// The external reference. Ensure that the asset data:
	Reference AssetCredentialSCEPReference `plist:"Reference,omitempty" json:"Reference,omitempty"`
	// The server authentication details.
	Authentication *AssetCredentialSCEPAuthentication `plist:"Authentication,omitempty" json:"Authentication,omitempty"`
	// The keychain accessibility that determines when the keychain item is available for use,
	// which has these allowed values:
	Accessible *string `plist:"Accessible,omitempty" json:"Accessible,omitempty"`
}

type AssetCredentialSCEPAuthentication struct {
	// The type of authentication, which has these allowed values: - `MDM`: A request that uses
	// MDM semantics, which includes the device-identity certificate, and any user
	// authentication. This is equivalent to an MDM request made to the `CheckInURL` or
	// `ServerURL`. This option is only available through declarative device management. -
	// `None`: A standard GET request.
	Type string `plist:"Type" json:"Type"`
}

type AssetCredentialSCEPReference struct {
	// The URL to retrieve data, which needs to start with `https://`.
	DataURL string `plist:"DataURL" json:"DataURL"`
	// The media type that describes the data. If present, the system checks the actual media
	// type of the downloaded data, and an error occurs if the values don't match.
	ContentType *string `plist:"ContentType,omitempty" json:"ContentType,omitempty"`
	// The size of the data. Set the size to `0` if there's no expectation of a response body.
	// If present, the system checks the actual size of the downloaded data, and an error
	// occurs if the values don't match.
	Size *int64 `plist:"Size,omitempty" json:"Size,omitempty"`
	// A SHA-256 hash of the data stored at the `DataURL`. Don't set this value if `Size` is
	// `0` as the client ignores it. However, if present, the system checks the actual hash of
	// the downloaded data, and an error occurs if the values don't match.
	HashSHA256 *string `plist:"Hash-SHA-256,omitempty" json:"Hash-SHA-256,omitempty"`
}

type AssetCredentialUserNameAndPassword struct {
	// The external reference. Ensure that the asset data:
	Reference AssetCredentialUserNameAndPasswordReference `plist:"Reference,omitempty" json:"Reference,omitempty"`
	// The server authentication details.
	Authentication *AssetCredentialUserNameAndPasswordAuthentication `plist:"Authentication,omitempty" json:"Authentication,omitempty"`
}

type AssetCredentialUserNameAndPasswordAuthentication struct {
	// The type of authentication, which has these allowed values: - `MDM`: A request that uses
	// MDM semantics, which includes the device-identity certificate, and any user
	// authentication. This is equivalent to an MDM request made to the `CheckInURL` or
	// `ServerURL`. This option is only available through declarative device management. -
	// `None`: A standard GET request.
	Type string `plist:"Type" json:"Type"`
}

type AssetCredentialUserNameAndPasswordReference struct {
	// The URL to retrieve data, which needs to start with `https://`.
	DataURL string `plist:"DataURL" json:"DataURL"`
	// The media type that describes the data. If present, the system checks the actual media
	// type of the downloaded data, and an error occurs if the values don't match.
	ContentType *string `plist:"ContentType,omitempty" json:"ContentType,omitempty"`
	// The size of the data. Set the size to `0` if there's no expectation of a response body.
	// If present, the system checks the actual size of the downloaded data, and an error
	// occurs if the values don't match.
	Size *int64 `plist:"Size,omitempty" json:"Size,omitempty"`
	// A SHA-256 hash of the data stored at the `DataURL`. Don't set this value if `Size` is
	// `0` as the client ignores it. However, if present, the system checks the actual hash of
	// the downloaded data, and an error occurs if the values don't match.
	HashSHA256 *string `plist:"Hash-SHA-256,omitempty" json:"Hash-SHA-256,omitempty"`
}

type AssetData struct {
	// The external reference.
	Reference AssetDataReference `plist:"Reference,omitempty" json:"Reference,omitempty"`
	// The server authentication details.
	Authentication *AssetDataAuthentication `plist:"Authentication,omitempty" json:"Authentication,omitempty"`
}

type AssetDataAuthentication struct {
	// The type of authentication, which has these allowed values: - `MDM`: A request that uses
	// MDM semantics, which includes the device-identity certificate, and any user
	// authentication. This is equivalent to an MDM request made to the `CheckInURL` or
	// `ServerURL`. This option is only available through declarative device management. -
	// `None`: A standard GET request.
	Type string `plist:"Type" json:"Type"`
}

type AssetDataReference struct {
	// The URL to retrieve data, which needs to start with `https://`.
	DataURL string `plist:"DataURL" json:"DataURL"`
	// The media type that describes the data. If present, the system checks the actual media
	// type of the downloaded data, and an error occurs if the values don't match.
	ContentType *string `plist:"ContentType,omitempty" json:"ContentType,omitempty"`
	// The size of the data. Set the size to `0` if there's no expectation of a response body.
	// If present, the system checks the actual size of the downloaded data, and an error
	// occurs if the values don't match.
	Size *int64 `plist:"Size,omitempty" json:"Size,omitempty"`
	// A SHA-256 hash of the data stored at the `DataURL`. Don't set this value if `Size` is
	// `0` as the client ignores it. However, if present, the system checks the actual hash of
	// the downloaded data, and an error occurs if the values don't match.
	HashSHA256 *string `plist:"Hash-SHA-256,omitempty" json:"Hash-SHA-256,omitempty"`
}

type AssetUserIdentity struct {
	// The user's full name.
	FullName *string `plist:"FullName,omitempty" json:"FullName,omitempty"`
	// The email address of the user.
	EmailAddress *string `plist:"EmailAddress,omitempty" json:"EmailAddress,omitempty"`
}

type AudioAccessorySettings struct {
	// A dictionary that describes audio accessory temporary pairing behavior. The device
	// enables temporary pairing when this key is present and the `Disabled` key isn't `false`.
	// The device doesn't synchronize pairing information with iCloud when temporary pairing is
	// active.
	TemporaryPairing *AudioAccessorySettingsTemporaryPairing `plist:"TemporaryPairing,omitempty" json:"TemporaryPairing,omitempty"`
}

type AudioAccessorySettingsTemporaryPairing struct {
	// If `true`, temporary pairing of audio accessories is disabled.
	Disabled *bool `plist:"Disabled,omitempty" json:"Disabled,omitempty"`
	// A dictionary providing configuration for temporary pairing. Required if `Disabled` isn't
	// present or is `false`.
	Configuration *AudioAccessorySettingsTemporaryPairingConfiguration `plist:"Configuration,omitempty" json:"Configuration,omitempty"`
}

type AudioAccessorySettingsTemporaryPairingConfiguration struct {
	// A dictionary that describes when the device automatically unpairs temporarily paired
	// audio accessories.
	UnpairingTime AudioAccessorySettingsTemporaryPairingConfigurationUnpairingTime `plist:"UnpairingTime,omitempty" json:"UnpairingTime,omitempty"`
}

type AudioAccessorySettingsTemporaryPairingConfigurationUnpairingTime struct {
	// A string that specifies the device's unpairing policy. - `None`: The device doesn't
	// automatically unpair. Use this only with a return to service device that you erase and
	// reenroll when assigning it from one user to another. - `Hour`: The device automatically
	// unpairs temporarily paired audio accessories at the local time that the `Hour` key
	// specifies.
	Policy string `plist:"Policy" json:"Policy"`
	// The local time hour (24-hour clock) when the device automatically unpairs temporarily
	// paired audio accessories. Required when setting the `Policy` key to `Hour`.
	Hour *int64 `plist:"Hour,omitempty" json:"Hour,omitempty"`
}

type Declaration interface {
	// DeclarationTypeName returns the wire identifier from Apple's schema.
	DeclarationTypeName() string
	// SchemaPath returns the schema file the type was generated from.
	SchemaPath() string
	// Validate checks the value against the schema for the target.
	Validate(t support.Target) error
}

type DeclarationBase struct {
	// A string specifying the type of this declaration.
	Type string `plist:"Type" json:"Type"`
	// A string uniquely identifying this declaration. The size of this string should not
	// exceed 64 octets. A UUID string value is a good choice.
	Identifier string `plist:"Identifier" json:"Identifier"`
	// A unique token generated by the server specifying a particular revision of the
	// declaration. The size of this string should not exceed 64 octets.
	ServerToken string `plist:"ServerToken" json:"ServerToken"`
	// The payload describing this declaration.
	Payload map[string]any `plist:"Payload,omitempty" json:"Payload,omitempty"`
}

type DiskManagementSettings struct {
	// The restrictions for the disk.
	Restrictions *DiskManagementSettingsRestrictions `plist:"Restrictions,omitempty" json:"Restrictions,omitempty"`
}

type DiskManagementSettingsRestrictions struct {
	// Specifies the mount policy for external storage:
	ExternalStorage *string `plist:"ExternalStorage,omitempty" json:"ExternalStorage,omitempty"`
	// Specifies the mount policy for network storage:
	NetworkStorage *string `plist:"NetworkStorage,omitempty" json:"NetworkStorage,omitempty"`
}

type Entry struct {
	// ID is the wire identifier: RequestType, MessageType, PayloadType,
	// DeclarationType, StatusItemType, error code, or type name.
	ID string
	// Schema is the YAML path in apple/device-management.
	Schema string
	Title  string
	Kind   Kind
	// New returns a zero value of the type as Declaration.
	New func() Declaration
	// NewResponse returns a zero response value, or nil when the schema
	// defines no response keys.
	NewResponse func() any
}

type ExternalIntelligenceSettings struct {
	// If `false`, disables external intelligence integrations.
	Enabled *bool `plist:"Enabled,omitempty" json:"Enabled,omitempty"`
	// If `false`, disables sign-in for external intelligence integrations.
	AllowSignIn *bool `plist:"AllowSignIn,omitempty" json:"AllowSignIn,omitempty"`
	// An array of strings, but currently restricted to a single element. If present, Apple
	// Intelligence allows use of only the given external integration workspace ID, and
	// requires a sign-in to make requests. The user is required to sign in to integrations
	// that support signing in. Multiple values combine using an intersect operation.
	AllowedWorkspaceIDs []string `plist:"AllowedWorkspaceIDs,omitempty" json:"AllowedWorkspaceIDs,omitempty"`
}

type IdentityCredential struct {
	// The password required to decrypt the PKCS #12 identity data.
	Password string `plist:"Password" json:"Password"`
	// The PKCS #12 identity data.
	Identity []byte `plist:"Identity,omitempty" json:"Identity,omitempty"`
}

type IntelligenceSettings struct {
	// If `false`, disables Apple Intelligence Report.
	AllowAppleIntelligenceReport *bool `plist:"AllowAppleIntelligenceReport,omitempty" json:"AllowAppleIntelligenceReport,omitempty"`
	// If `false`, disables Genmoji.
	AllowGenmoji *bool `plist:"AllowGenmoji,omitempty" json:"AllowGenmoji,omitempty"`
	// If `false`, disables Image Playground.
	AllowImagePlayground *bool `plist:"AllowImagePlayground,omitempty" json:"AllowImagePlayground,omitempty"`
	// If `false`, disables Image Wand.
	AllowImageWand *bool `plist:"AllowImageWand,omitempty" json:"AllowImageWand,omitempty"`
	// If `false`, disables Personalized Handwriting Results.
	AllowPersonalizedHandwritingResults *bool `plist:"AllowPersonalizedHandwritingResults,omitempty" json:"AllowPersonalizedHandwritingResults,omitempty"`
	// If `false`, disables Visual Intelligence Summary.
	AllowVisualIntelligenceSummary *bool `plist:"AllowVisualIntelligenceSummary,omitempty" json:"AllowVisualIntelligenceSummary,omitempty"`
	// If `false`, disables Writing Tools.
	AllowWritingTools *bool `plist:"AllowWritingTools,omitempty" json:"AllowWritingTools,omitempty"`
	// If present, configures app-specific Intelligence features.
	Apps *IntelligenceSettingsApps `plist:"Apps,omitempty" json:"Apps,omitempty"`
	// If `true`, forces On-Device Only Dictation.
	ForceOnDeviceOnlyDictation *bool `plist:"ForceOnDeviceOnlyDictation,omitempty" json:"ForceOnDeviceOnlyDictation,omitempty"`
	// If `true`, forces On-Device Only Translation.
	ForceOnDeviceOnlyTranslation *bool `plist:"ForceOnDeviceOnlyTranslation,omitempty" json:"ForceOnDeviceOnlyTranslation,omitempty"`
}

type IntelligenceSettingsApps struct {
	// If present, configures Mail Intelligence features.
	Mail *IntelligenceSettingsAppsMail `plist:"Mail,omitempty" json:"Mail,omitempty"`
	// If present, configures Notes Intelligence features.
	Notes *IntelligenceSettingsAppsNotes `plist:"Notes,omitempty" json:"Notes,omitempty"`
	// If present, configures Safari intelligence features.
	Safari *IntelligenceSettingsAppsSafari `plist:"Safari,omitempty" json:"Safari,omitempty"`
}

type IntelligenceSettingsAppsMail struct {
	// If `false`, disables Mail Smart Replies.
	AllowSmartReplies *bool `plist:"AllowSmartReplies,omitempty" json:"AllowSmartReplies,omitempty"`
	// If `false`, disables Mail Summary.
	AllowSummary *bool `plist:"AllowSummary,omitempty" json:"AllowSummary,omitempty"`
}

type IntelligenceSettingsAppsNotes struct {
	// If `false`, disables Notes Transcription.
	AllowTranscription *bool `plist:"AllowTranscription,omitempty" json:"AllowTranscription,omitempty"`
	// If `false`, disables Notes Transcription Summary.
	AllowTranscriptionSummary *bool `plist:"AllowTranscriptionSummary,omitempty" json:"AllowTranscriptionSummary,omitempty"`
}

type IntelligenceSettingsAppsSafari struct {
	// If `false`, disables Safari Summary.
	AllowSummary *bool `plist:"AllowSummary,omitempty" json:"AllowSummary,omitempty"`
}

type KeyboardSettings struct {
	// If `false`, disables auto-correction.
	AllowAutoCorrection *bool `plist:"AllowAutoCorrection,omitempty" json:"AllowAutoCorrection,omitempty"`
	// If `false`, disables definition lookup.
	AllowDefinitionLookup *bool `plist:"AllowDefinitionLookup,omitempty" json:"AllowDefinitionLookup,omitempty"`
	// If `false`, disables dictation.
	AllowDictation *bool `plist:"AllowDictation,omitempty" json:"AllowDictation,omitempty"`
	// If `false`, disables keyboard suggestions that include math solutions. This key is also
	// supported by the math.settings configuration.
	AllowMathKeyboardSuggestions *bool `plist:"AllowMathKeyboardSuggestions,omitempty" json:"AllowMathKeyboardSuggestions,omitempty"`
	// If `false`, disables predictive text.
	AllowPredictiveText *bool `plist:"AllowPredictiveText,omitempty" json:"AllowPredictiveText,omitempty"`
	// If `false`, disables slide to type.
	AllowSlideToType *bool `plist:"AllowSlideToType,omitempty" json:"AllowSlideToType,omitempty"`
	// If `false`, disables spell check.
	AllowSpellCheck *bool `plist:"AllowSpellCheck,omitempty" json:"AllowSpellCheck,omitempty"`
	// If `false`, disables text replacement.
	AllowTextReplacement *bool `plist:"AllowTextReplacement,omitempty" json:"AllowTextReplacement,omitempty"`
}

type Kind string

type LegacyInteractiveProfile struct {
	// The URL of the profile to download and install, which needs to start with `https://`,
	// and must be hosted by the MDM server.
	ProfileURL string `plist:"ProfileURL" json:"ProfileURL"`
	// The visible name of the configuration. This name needs to indicate the nature of the
	// profile.
	VisibleName string `plist:"VisibleName" json:"VisibleName"`
}

type LegacyProfile struct {
	// The URL of the profile to download and install, which needs to start with `https://`,
	// and must be hosted by the MDM server.
	ProfileURL string `plist:"ProfileURL" json:"ProfileURL"`
}

type ManagementOrganizationInformation struct {
	// The name of the organization.
	Name string `plist:"Name" json:"Name"`
	// The email address of the contact person for the organization.
	Email *string `plist:"Email,omitempty" json:"Email,omitempty"`
	// The website of the organization to contact for support.
	URL *string `plist:"URL,omitempty" json:"URL,omitempty"`
	// The additional properties that verify the identity and authenticity of the organization.
	Proof *ManagementOrganizationInformationProof `plist:"Proof,omitempty" json:"Proof,omitempty"`
}

type ManagementOrganizationInformationProof struct {
	// A token that verifies the identity of the organization when using this service.
	IdentityToken *string `plist:"IdentityToken,omitempty" json:"IdentityToken,omitempty"`
}

type ManagementProperties struct {
	// Each entry represents a property key/value.
	ANY any `plist:"ANY,omitempty" json:"ANY,omitempty"`
}

type ManagementServerCapabilities struct {
	// The server's protocol version.
	Version string `plist:"Version" json:"Version"`
	// A dictionary that contains the server's optional protocol features.
	SupportedFeatures map[string]any `plist:"SupportedFeatures,omitempty" json:"SupportedFeatures,omitempty"`
}

type ManagementStatusSubscriptions struct {
	// An array of status items that the device notifies subscribers about.
	StatusItems []ManagementStatusSubscriptionsStatusItems `plist:"StatusItems,omitempty" json:"StatusItems,omitempty"`
}

type ManagementStatusSubscriptionsStatusItems struct {
	// The name of the status item to send to subscribers.
	Name string `plist:"Name" json:"Name"`
}

type ManagementTest struct {
	// The string to echo back in a status response reason.
	Echo string `plist:"Echo" json:"Echo"`
	// The string to read from a data asset to echo back in status response reason description.
	EchoDataAssetReference *string `plist:"EchoDataAssetReference,omitempty" json:"EchoDataAssetReference,omitempty"`
	// The status the system reports back when the device implements the configuration. Use
	// this to override the normal `success` result.
	ReturnStatus *string `plist:"ReturnStatus,omitempty" json:"ReturnStatus,omitempty"`
}

type MathSettings struct {
	// If present, configures the built-in Calculator app.
	Calculator *MathSettingsCalculator `plist:"Calculator,omitempty" json:"Calculator,omitempty"`
	// If present, configures math behavior in the system.
	SystemBehavior *MathSettingsSystemBehavior `plist:"SystemBehavior,omitempty" json:"SystemBehavior,omitempty"`
}

type MathSettingsCalculator struct {
	// If present, configures the basic mode of the calculator. Basic mode is always enabled.
	BasicMode *MathSettingsCalculatorBasicMode `plist:"BasicMode,omitempty" json:"BasicMode,omitempty"`
	// If present, configures the scientific mode of the calculator. If not present, scientific
	// mode is enabled.
	ScientificMode *MathSettingsCalculatorScientificMode `plist:"ScientificMode,omitempty" json:"ScientificMode,omitempty"`
	// If present, configures the programmer mode of the calculator. If not present, programmer
	// mode is enabled.
	ProgrammerMode *MathSettingsCalculatorProgrammerMode `plist:"ProgrammerMode,omitempty" json:"ProgrammerMode,omitempty"`
	// If present, configures the Math Notes mode of the calculator. If not present, Math Notes
	// mode is enabled.
	MathNotesMode *MathSettingsCalculatorMathNotesMode `plist:"MathNotesMode,omitempty" json:"MathNotesMode,omitempty"`
	// If present, controls global input options of the calculator. If not present, all input
	// modes are enabled.
	InputModes *MathSettingsCalculatorInputModes `plist:"InputModes,omitempty" json:"InputModes,omitempty"`
}

type MathSettingsCalculatorBasicMode struct {
	// Add the square root button to the basic calculator by replacing the +/- button.
	// Normally, the square root button is available in scientific mode, so this key can be
	// used to make it available when the scientific mode is restricted.
	AddSquareRoot bool `plist:"AddSquareRoot" json:"AddSquareRoot"`
}

type MathSettingsCalculatorInputModes struct {
	// Configures whether unit conversions are enabled.
	UnitConversion bool `plist:"UnitConversion" json:"UnitConversion"`
	// Configures whether RPN input is enabled.
	RPN bool `plist:"RPN" json:"RPN"`
}

type MathSettingsCalculatorMathNotesMode struct {
	// Controls whether the mode is enabled.
	Enabled bool `plist:"Enabled" json:"Enabled"`
}

type MathSettingsCalculatorProgrammerMode struct {
	// Controls whether the mode is enabled.
	Enabled bool `plist:"Enabled" json:"Enabled"`
}

type MathSettingsCalculatorScientificMode struct {
	// Controls whether the mode is enabled.
	Enabled bool `plist:"Enabled" json:"Enabled"`
}

type MathSettingsSystemBehavior struct {
	// Controls whether keyboard suggestions include math solutions. This key is also supported
	// by the keyboard.settings configuration.
	KeyboardSuggestions bool `plist:"KeyboardSuggestions" json:"KeyboardSuggestions"`
	// Controls whether Math Notes is allowed in other apps such as Notes.
	MathNotes bool `plist:"MathNotes" json:"MathNotes"`
}

type MigrationAssistantSettings struct {
	// If `true`, the device manages Migration Assistant.
	ShouldDoManagedMigration bool `plist:"ShouldDoManagedMigration" json:"ShouldDoManagedMigration"`
	// An array of strings that represent the user account short names the system excludes from
	// migration.
	ExcludedAccounts []string `plist:"ExcludedAccounts,omitempty" json:"ExcludedAccounts,omitempty"`
	// An array of strings that represent files and directories relative to the user's home
	// directory that the system excludes from migration. Directory paths need to include a
	// trailing "/". For example, to exclude the "Excluded" directory in the "Documents" folder
	// of a user's home directory, use "Documents/Excluded/".
	ExcludedPaths []string `plist:"ExcludedPaths,omitempty" json:"ExcludedPaths,omitempty"`
	// An array of strings that represent files and directories relative to the user's home
	// directory that the system needs to migrate. Directory paths need to include a trailing
	// "/". For example, to require the "Required" directory in the "Documents" folder of a
	// user's home directory, use "Documents/Required/".
	RequiredPaths []string `plist:"RequiredPaths,omitempty" json:"RequiredPaths,omitempty"`
	// If `true`, the system migrates Security & Privacy settings.
	ShouldMigrateSecurityPrivacySettings bool `plist:"ShouldMigrateSecurityPrivacySettings" json:"ShouldMigrateSecurityPrivacySettings"`
}

type Package struct {
	// The URL of the manifest document for the package that the device downloads. The manifest
	// is returned as a `ManifestURL` property list. The `url` property of the manifest must
	// point to the package (.pkg) file to install.
	ManifestURL string `plist:"ManifestURL" json:"ManifestURL"`
	// A dictionary that describes how and when to install the package.
	InstallBehavior *PackageInstallBehavior `plist:"InstallBehavior,omitempty" json:"InstallBehavior,omitempty"`
}

type PackageInstallBehavior struct {
	// A string that specifies when the system installs the package:
	Install *string `plist:"Install,omitempty" json:"Install,omitempty"`
}

type PasscodeSettings struct {
	// If `true`, the system requires the user to set a passcode without any requirements about
	// the length or quality of the passcode. The presence of any other keys implicitly
	// requires a passcode, and overrides this key's value.
	RequirePasscode *bool `plist:"RequirePasscode,omitempty" json:"RequirePasscode,omitempty"`
	// If `true`, the passcode needs to consist of at least one alphabetic character and at
	// least one number.
	RequireAlphanumericPasscode *bool `plist:"RequireAlphanumericPasscode,omitempty" json:"RequireAlphanumericPasscode,omitempty"`
	// If `true`, the system requires a complex passcode. A complex passcode is one that
	// doesn't contain repeated characters or increasing or decreasing characters (such as 123
	// or CBA).
	RequireComplexPasscode *bool `plist:"RequireComplexPasscode,omitempty" json:"RequireComplexPasscode,omitempty"`
	// The minimum number of characters a passcode can contain.
	MinimumLength *int64 `plist:"MinimumLength,omitempty" json:"MinimumLength,omitempty"`
	// Specifies the minimum number of complex characters in the password. A complex character
	// is a character other than a number or a letter, such as `&`, `%`, `$`, and `#`.
	MinimumComplexCharacters *int64 `plist:"MinimumComplexCharacters,omitempty" json:"MinimumComplexCharacters,omitempty"`
	// The number of failed passcode attempts that the system allows the user before it erases
	// or locks the device. After six failed attempts, the device imposes a time delay before
	// the user can enter a passcode again. The time delay increases with each failed attempt.
	// On macOS, set `FailedAttemptsResetInMinutes` to define the time delay. The time delay
	// begins after the sixth attempt, so if `MaximumFailedAttempts` is six or lower, the
	// system has no time delay and triggers the erase or lock as soon as the user exceeds the
	// limit.
	MaximumFailedAttempts *int64 `plist:"MaximumFailedAttempts,omitempty" json:"MaximumFailedAttempts,omitempty"`
	// The number of minutes before the login is reset after the maximum number of failed
	// attempts. Also set the `MaximumFailedAttempts` key for this to take effect.
	FailedAttemptsResetInMinutes *int64 `plist:"FailedAttemptsResetInMinutes,omitempty" json:"FailedAttemptsResetInMinutes,omitempty"`
	// The maximum period that a user can select, during which the user can unlock the device
	// without a passcode. A value of `0` means no grace period, and the device requires a
	// passcode immediately. In the absence of this key, the user can select any period. In
	// macOS, the system translates this to screensaver settings.
	MaximumGracePeriodInMinutes *int64 `plist:"MaximumGracePeriodInMinutes,omitempty" json:"MaximumGracePeriodInMinutes,omitempty"`
	// The maximum period that a user can select, during which the device can be idle before
	// the system automatically locks it. When the device reaches this limit, the device locks
	// and the user must enter the passcode to unlock it. In the absence of this key, the user
	// can select any period. In macOS, the system translates this to screensaver settings.
	MaximumInactivityInMinutes *int64 `plist:"MaximumInactivityInMinutes,omitempty" json:"MaximumInactivityInMinutes,omitempty"`
	// Specifies the maximum number of days that the passcode can remain unchanged. After this
	// number of days, the system forces the user to change the passcode before it unlocks the
	// device.
	MaximumPasscodeAgeInDays *int64 `plist:"MaximumPasscodeAgeInDays,omitempty" json:"MaximumPasscodeAgeInDays,omitempty"`
	// The number of historical passcode entries the system checks when validating a new
	// passcode. The device refuses a new passcode if it matches a previously used passcode
	// within the specified passcode history range. In the absence of this key, the system
	// performs no historical check.
	PasscodeReuseLimit *int64 `plist:"PasscodeReuseLimit,omitempty" json:"PasscodeReuseLimit,omitempty"`
	// If `true`, the system forces a password reset the next time the user tries to
	// authenticate. If you set this key in a configuration in the system scope (device
	// channel), the setting takes effect for all users, and admin authentication may fail
	// until the admin user password is also reset.
	ChangeAtNextAuth *bool `plist:"ChangeAtNextAuth,omitempty" json:"ChangeAtNextAuth,omitempty"`
	// Specifies a regular expression, and its description, to enforce password compliance. Use
	// the simpler passcode settings whenever possible, and rely on regular expression matching
	// only when necessary. Mistakes in regular expressions can lead to frustrating user
	// experiences, such as unsatisfiable passcode policies, or policy descriptions that don't
	// match the enforced policy.
	CustomRegex *PasscodeSettingsCustomRegex `plist:"CustomRegex,omitempty" json:"CustomRegex,omitempty"`
}

type PasscodeSettingsCustomRegex struct {
	// A regular expression string to match against the password to determine whether it
	// complies with a policy. The regular expression uses the ICU syntax. The string can't
	// exceed 2048 characters in length.
	Regex string `plist:"Regex" json:"Regex"`
	// A dictionary with supported OS language IDs for the keys (such as `en-US`), and values
	// that represent a localized description of the policy that the regular expression
	// enforces. Use the special `default` key for languages that the dictionary doesn't
	// contain.
	Description map[string]string `plist:"Description,omitempty" json:"Description,omitempty"`
}

type ReasonDetail struct {
	// Key is the wire key inside the details dictionary.
	Key string
	// Type is Apple's declared type for the value, such as "<string>".
	Type string
	// Description is Apple's prose for the key.
	Description string
}

type ReasonEntry struct {
	// Code is the wire value, matching the Code field of a status report reason.
	Code string
	// Description is Apple's prose for the code in this schema.
	Description string
	// Schema is the YAML path in apple/device-management that declares it.
	Schema string
	// Details are the keys Apple documents in the reason's details dictionary.
	Details []ReasonDetail
}

type SCEPCredential struct {
	// The SCEP URL.
	URL string `plist:"URL" json:"URL"`
	// Any string that the SCEP server recognizes. For example, it could be a domain name such
	// as `example.org`. If a certificate authority has multiple CA certificates, you can use
	// this field to specify the required certificate.
	Name *string `plist:"Name,omitempty" json:"Name,omitempty"`
	// The representation of an X.500 name is an array of OID and value. For example,
	// `/C=US/O=Apple Inc./CN=foo/1.2.5.3=bar` corresponds to:
	Subject [][][]string `plist:"Subject,omitempty" json:"Subject,omitempty"`
	// A preshared secret.
	Challenge *string `plist:"Challenge,omitempty" json:"Challenge,omitempty"`
	// The key size in bits, either `1024`, `2048`, or `4096`.
	Keysize *int64 `plist:"Keysize,omitempty" json:"Keysize,omitempty"`
	// The key type, which always has the value `RSA`.
	KeyType *string `plist:"Key Type,omitempty" json:"Key Type,omitempty"`
	// A bitmask that specifies the use of the key: `1` is signing, `4` is encryption, and `5`
	// is both signing and encryption. Some certificate authorities, such as Windows CA,
	// support only encryption or signing, but not both at the same time.
	KeyUsage *int64 `plist:"Key Usage,omitempty" json:"Key Usage,omitempty"`
	// The fingerprint of the Certificate Authority certificate.
	CAFingerprint []byte `plist:"CAFingerprint,omitempty" json:"CAFingerprint,omitempty"`
	// The number of times the device should retry if the server sends a `PENDING` response.
	Retries *int64 `plist:"Retries,omitempty" json:"Retries,omitempty"`
	// The number of seconds to wait between subsequent retries. The system makes the first
	// retry without this delay.
	RetryDelay *int64 `plist:"RetryDelay,omitempty" json:"RetryDelay,omitempty"`
	// The subject's alternative name for the certificate.
	SubjectAltName *SCEPCredentialSubjectAltName `plist:"SubjectAltName,omitempty" json:"SubjectAltName,omitempty"`
}

type SCEPCredentialSubjectAltName struct {
	// The RFC 822 email address.
	Rfc822Name *string `plist:"rfc822Name,omitempty" json:"rfc822Name,omitempty"`
	// The DNS name.
	DNSName *string `plist:"dNSName,omitempty" json:"dNSName,omitempty"`
	// The uniform resource identifier.
	UniformResourceIdentifier *string `plist:"uniformResourceIdentifier,omitempty" json:"uniformResourceIdentifier,omitempty"`
	// The NT principal name. Use an other name OID set to `1.3.6.1.4.1.311.20.2.3`.
	NtPrincipalName *string `plist:"ntPrincipalName,omitempty" json:"ntPrincipalName,omitempty"`
}

type SafariBookmarks struct {
	// A dictionary that specifies a set of managed bookmarks.
	ManagedBookmarks []SafariBookmarksManagedBookmarks `plist:"ManagedBookmarks,omitempty" json:"ManagedBookmarks,omitempty"`
}

type SafariBookmarksBookmarksItem struct {
	// The title of the bookmark shown in Safari.
	Title string `plist:"Title" json:"Title"`
	// The URL for the bookmark item.
	URL *string `plist:"URL,omitempty" json:"URL,omitempty"`
	// An array of bookmarks for each bookmark in the folder. Folders can include bookmark
	// items and bookmark folders.
	Folder []SafariBookmarksBookmarksItem `plist:"Folder,omitempty" json:"Folder,omitempty"`
}

type SafariBookmarksManagedBookmarks struct {
	// A string that specifies the unique identifier for this group of managed bookmarks.
	// Safari displays a separate managed bookmarks item for each set of unique managed
	// bookmarks based on the value of this key. If multiple active configurations use the same
	// value for this key, Safari displays a single group formed by merging the list of
	// `Bookmarks` from each group.
	GroupIdentifier string `plist:"GroupIdentifier" json:"GroupIdentifier"`
	// The name of the bookmarks folder. Safari uses this as the title for the top-level
	// managed bookmarks item.
	Title string `plist:"Title" json:"Title"`
	// A list of bookmarks. Either a `URL` or `Folder` key must be present in each item.
	Bookmarks []SafariBookmarksBookmarksItem `plist:"Bookmarks,omitempty" json:"Bookmarks,omitempty"`
}

type SafariExtensionSettings struct {
	// The dictionary of managed extensions settings. Each key in the dictionary represents a
	// composed identifier for a specific managed extension, or you can specify a single "*"
	// character to match any extension. The dictionary values represent the settings that
	// Safari applies to each extension that matches the key. In order for the extension to be
	// managed, its host app needs to be present on the device.
	ManagedExtensions map[string]SafariExtensionSettingsExtensionDictionary `plist:"ManagedExtensions,omitempty" json:"ManagedExtensions,omitempty"`
}

type SafariExtensionSettingsExtensionDictionary struct {
	// Controls whether an extension is allowed. * `Allowed` - The user is allowed to turn the
	// extension on or off. * `AlwaysOn` - The extension will always be on. * `AlwaysOff` - The
	// extension will always be off.
	State *string `plist:"State,omitempty" json:"State,omitempty"`
	// Controls whether an extension is allowed in Private Browsing. * `Allowed` - The user is
	// allowed to turn the extension on or off in Private Browsing. * `AlwaysOn` - The
	// extension will always be on in Private Browsing if the extension is on outside of
	// Private Browsing. * `AlwaysOff` - The extension will never be on in Private Browsing.
	PrivateBrowsing *string `plist:"PrivateBrowsing,omitempty" json:"PrivateBrowsing,omitempty"`
	// Controls the domains and sub-domains the extension is granted access to.
	AllowedDomains []string `plist:"AllowedDomains,omitempty" json:"AllowedDomains,omitempty"`
	// Controls the domains and sub-domains the extension isn't allowed to access.
	DeniedDomains []string `plist:"DeniedDomains,omitempty" json:"DeniedDomains,omitempty"`
}

type SafariSettings struct {
	// The policy Safari uses for managing cookies:
	AcceptCookies *string `plist:"AcceptCookies,omitempty" json:"AcceptCookies,omitempty"`
	// If `false`, the system forces fraud warnings on in Safari.
	AllowDisablingFraudWarning *bool `plist:"AllowDisablingFraudWarning,omitempty" json:"AllowDisablingFraudWarning,omitempty"`
	// If `false`, the system disables clearing history in Safari.
	AllowHistoryClearing *bool `plist:"AllowHistoryClearing,omitempty" json:"AllowHistoryClearing,omitempty"`
	// If `false`, the system disables JavaScript in Safari.
	AllowJavaScript *bool `plist:"AllowJavaScript,omitempty" json:"AllowJavaScript,omitempty"`
	// If `false`, the system disables private browsing in Safari.
	AllowPrivateBrowsing *bool `plist:"AllowPrivateBrowsing,omitempty" json:"AllowPrivateBrowsing,omitempty"`
	// If `false`, the system disables popups in Safari.
	AllowPopups *bool `plist:"AllowPopups,omitempty" json:"AllowPopups,omitempty"`
	// If `false`, the system disables summarization of content in Safari.
	AllowSummary *bool `plist:"AllowSummary,omitempty" json:"AllowSummary,omitempty"`
	// Sets the start page for new tabs in Safari.
	NewTabStartPage *SafariSettingsNewTabStartPage `plist:"NewTabStartPage,omitempty" json:"NewTabStartPage,omitempty"`
}

type SafariSettingsNewTabStartPage struct {
	// Sets the start page type in Safari:
	PageType string `plist:"PageType" json:"PageType"`
	// The URL of the homepage which needs to start with `https://` or `http://`. Required when
	// setting `PageType` to `Home`.
	HomepageURL *string `plist:"HomepageURL,omitempty" json:"HomepageURL,omitempty"`
	// The composed identifier of the extension that provides the start page. The required
	// format is "Identifier (TeamIdentifier)", for example "com.example.app (ABCD1234)".
	// Required when setting `PageType` to `Extension`.
	ExtensionIdentifier *string `plist:"ExtensionIdentifier,omitempty" json:"ExtensionIdentifier,omitempty"`
}

type ScreenSharingConnection struct {
	// A unique identifier for this connection when it's in a connection group.
	ConnectionUUID string `plist:"ConnectionUUID" json:"ConnectionUUID"`
	// The name of the connection.
	DisplayName string `plist:"DisplayName" json:"DisplayName"`
	// The host name or IP address of the Mac that hosts the screen-sharing connection.
	HostName string `plist:"HostName" json:"HostName"`
	// The TCP port number on the host to initiate the connection.
	Port *int64 `plist:"Port,omitempty" json:"Port,omitempty"`
	// The display configuration for this connection.
	DisplayConfiguration ScreenSharingConnectionDisplayConfiguration `plist:"DisplayConfiguration,omitempty" json:"DisplayConfiguration,omitempty"`
	// The identifier of an asset declaration that contains the required credentials for this
	// connection to authenticate with the screen-sharing server. Set the corresponding asset
	// type to `com.apple.asset.credential.userpassword`.
	AuthenticationCredentialsAssetReference *string `plist:"AuthenticationCredentialsAssetReference,omitempty" json:"AuthenticationCredentialsAssetReference,omitempty"`
}

type ScreenSharingConnectionDisplayConfiguration struct {
	// The type of display for the connection, which has these allowed values:
	DisplayType string `plist:"DisplayType" json:"DisplayType"`
}

type ScreenSharingConnectionGroup struct {
	// A unique identifier for this connection group.
	ConnectionGroupUUID string `plist:"ConnectionGroupUUID" json:"ConnectionGroupUUID"`
	// The name of the connection group.
	GroupName string `plist:"GroupName" json:"GroupName"`
	// An array of `ConnectionUUID`s that represent connections declared in
	// `ScreenSharingConnection` configurations that are members of this group.
	Members []string `plist:"Members,omitempty" json:"Members,omitempty"`
}

type ScreenSharingHostSettings struct {
	// The maximum number of virtual displays to make available to clients.
	MaximumVirtualDisplays *int64 `plist:"MaximumVirtualDisplays,omitempty" json:"MaximumVirtualDisplays,omitempty"`
	// The initial UDP port number to connect to the host. Screen sharing requires multiple
	// connections, so the system increments this value by 1 for each additional connection.
	// This doesn't change the port number that the system uses to initially establish a
	// connection with a host, which is always TCP port 5900.
	PortBase *int64 `plist:"PortBase,omitempty" json:"PortBase,omitempty"`
	// If `true`, the system prevents users from copying files from the screen-sharing host.
	PreventCopyFilesFromHost *bool `plist:"PreventCopyFilesFromHost,omitempty" json:"PreventCopyFilesFromHost,omitempty"`
	// If `true`, the system prevents users from copying files to the screen-sharing host.
	PreventCopyFilesToHost *bool `plist:"PreventCopyFilesToHost,omitempty" json:"PreventCopyFilesToHost,omitempty"`
	// If `true`, the system prevents clients from establishing high-performance connections to
	// the host.
	PreventHighPerformanceConnections *bool `plist:"PreventHighPerformanceConnections,omitempty" json:"PreventHighPerformanceConnections,omitempty"`
}

type SecurityCertificate struct {
	// The identifier of an asset declaration that contains the certificate to install.
	CredentialAssetReference string `plist:"CredentialAssetReference" json:"CredentialAssetReference"`
}

type SecurityIdentity struct {
	// The identifier of an asset declaration that contains the identity to install.
	CredentialAssetReference string `plist:"CredentialAssetReference" json:"CredentialAssetReference"`
	// If `true`, apps can access the private key.
	AllowAllAppsAccess *bool `plist:"AllowAllAppsAccess,omitempty" json:"AllowAllAppsAccess,omitempty"`
	// If `true`, the private key is extractable in the keychain.
	KeyIsExtractable *bool `plist:"KeyIsExtractable,omitempty" json:"KeyIsExtractable,omitempty"`
}

type SecurityPasskeyAttestation struct {
	// The identifier of an asset declaration that contains the identity to install and use for
	// passkey attestation.
	AttestationIdentityAssetReference string `plist:"AttestationIdentityAssetReference" json:"AttestationIdentityAssetReference"`
	// If `true`, the private key for the attestation identity is extractable in the keychain.
	AttestationIdentityKeyIsExtractable *bool `plist:"AttestationIdentityKeyIsExtractable,omitempty" json:"AttestationIdentityKeyIsExtractable,omitempty"`
	// An array of the relying parties to allow enterprise attestation.
	RelyingParties []string `plist:"RelyingParties,omitempty" json:"RelyingParties,omitempty"`
}

type ServicesBackgroundTasks struct {
	// The unique identifier of the set of background tasks managed with this configuration.
	// This should be a reverse DNS style identifier. The system uses this identifier to
	// differentiate between tasks in different configurations.
	TaskType string `plist:"TaskType" json:"TaskType"`
	// A description of the set of background tasks managed by this configuration.
	TaskDescription *string `plist:"TaskDescription,omitempty" json:"TaskDescription,omitempty"`
	// Specifies the identifier of an asset declaration containing a reference to the files to
	// be used for the background task configuration. The corresponding asset must be of type
	// `com.apple.asset.data`.
	ExecutableAssetReference *string `plist:"ExecutableAssetReference,omitempty" json:"ExecutableAssetReference,omitempty"`
	// An array of `launchd` configuration files used to run the background tasks.
	LaunchdConfigurations []ServicesBackgroundTasksLaunchdConfigurations `plist:"LaunchdConfigurations,omitempty" json:"LaunchdConfigurations,omitempty"`
}

type ServicesBackgroundTasksLaunchdConfigurations struct {
	// Specifies the identifier of an asset declaration containing a reference to the launchd
	// configuration file for the background task. The referenced data must be a property list
	// file conforming to the launchd.plist format. The asset's "ContentType" and
	// "Hash-SHA-256" keys in the "Reference" key are required.
	FileAssetReference string `plist:"FileAssetReference" json:"FileAssetReference"`
	// Indicates whether the launchd configuration file is applied to the system daemon, or
	// system agent domain.
	Context string `plist:"Context" json:"Context"`
}

type ServicesConfigurationFiles struct {
	// The identifier of the system service with managed configuration files. Use a reverse DNS
	// style for this identifier.
	ServiceType string `plist:"ServiceType" json:"ServiceType"`
	// The identifier of an asset declaration that contains a reference to the files to use for
	// system service configuration. Ensure that the corresponding asset:
	DataAssetReference string `plist:"DataAssetReference" json:"DataAssetReference"`
}

type SiriSettings struct {
	// If `false`, disables Siri.
	Enabled *bool `plist:"Enabled,omitempty" json:"Enabled,omitempty"`
	// If `false`, disables Siri user-generated content.
	AllowUserGeneratedContent *bool `plist:"AllowUserGeneratedContent,omitempty" json:"AllowUserGeneratedContent,omitempty"`
	// If `false`, disables Siri while locked.
	AllowWhileLocked *bool `plist:"AllowWhileLocked,omitempty" json:"AllowWhileLocked,omitempty"`
	// If `true`, forces Siri profanity filter.
	ForceProfanityFilter *bool `plist:"ForceProfanityFilter,omitempty" json:"ForceProfanityFilter,omitempty"`
}

type SoftwareUpdateEnforcementSpecific struct {
	// The target OS version to update the device to by the appropriate time. This is the OS
	// version number, for example, `16.1`.
	TargetOSVersion string `plist:"TargetOSVersion" json:"TargetOSVersion"`
	// The target build version to update the device to by the appropriate time, for example,
	// `20A242`. Use the build version for testing during seeding periods. The build version
	// can include a supplemental version identifier, for example, `20A242a`.
	TargetBuildVersion *string `plist:"TargetBuildVersion,omitempty" json:"TargetBuildVersion,omitempty"`
	// The local date time value that specifies when to force install the software update. Use
	// the format `yyyy-mm-ddThh:mm:ss`, which is derived from RFC3339 but doesn't include a
	// time zone offset. If the user doesn't trigger the software update before this time, the
	// device force installs it.
	TargetLocalDateTime string `plist:"TargetLocalDateTime" json:"TargetLocalDateTime"`
	// The URL of a web page that shows details that the organization provides about the
	// enforced software update.
	DetailsURL *string `plist:"DetailsURL,omitempty" json:"DetailsURL,omitempty"`
}

type SoftwareUpdateSettings struct {
	// If set to `true`, the device shows all software update enforcement notifications.
	Notifications *bool `plist:"Notifications,omitempty" json:"Notifications,omitempty"`
	// This object configures the deferral of software updates. Background Security
	// Improvements aren't considered in `Major`, `Minor`, or `System` deferral mechanism.
	Deferrals *SoftwareUpdateSettingsDeferrals `plist:"Deferrals,omitempty" json:"Deferrals,omitempty"`
	// This string specifies how the device shows software updates to the user. When more than
	// one update is available update, the device behaves as follows:
	RecommendedCadence *string `plist:"RecommendedCadence,omitempty" json:"RecommendedCadence,omitempty"`
	// This object configures various automatic Software Update functionality.
	AutomaticActions *SoftwareUpdateSettingsAutomaticActions `plist:"AutomaticActions,omitempty" json:"AutomaticActions,omitempty"`
	// These configurations set user access to interacting with Background Security
	// Improvement.
	RapidSecurityResponse *SoftwareUpdateSettingsRapidSecurityResponse `plist:"RapidSecurityResponse,omitempty" json:"RapidSecurityResponse,omitempty"`
	// If set to `true`, a standard user can perform Major and Minor Software Updates.
	AllowStandardUserOSUpdates *bool `plist:"AllowStandardUserOSUpdates,omitempty" json:"AllowStandardUserOSUpdates,omitempty"`
	// This object configures the beta program settings for a device.
	Beta *SoftwareUpdateSettingsBeta `plist:"Beta,omitempty" json:"Beta,omitempty"`
}

type SoftwareUpdateSettingsAutomaticActions struct {
	// Specifies whether the user can control automatic downloads of available updates:
	Download *string `plist:"Download,omitempty" json:"Download,omitempty"`
	// Specifies whether the user can control automatic installation of available updates:
	InstallOSUpdates *string `plist:"InstallOSUpdates,omitempty" json:"InstallOSUpdates,omitempty"`
	// Specifies whether the user can control automatic installation of available security
	// updates:
	InstallSecurityUpdate *string `plist:"InstallSecurityUpdate,omitempty" json:"InstallSecurityUpdate,omitempty"`
}

type SoftwareUpdateSettingsBeta struct {
	// Specifies whether the user can control beta program enrollment in the software update
	// settings UI:
	ProgramEnrollment *string `plist:"ProgramEnrollment,omitempty" json:"ProgramEnrollment,omitempty"`
	// An array of beta programs allowed on the device. This key must only be present if the
	// `ProgramEnrollment` key is set to `Allowed` or `AlwaysOn`. This key must not be present
	// if the `RequireProgram` key is present. This key can be present on unsupervised devices
	// where the `ProgramEnrollment` key isn't supported but is implicitly set to `Allowed`.
	OfferPrograms []SoftwareUpdateSettingsBetaOfferPrograms `plist:"OfferPrograms,omitempty" json:"OfferPrograms,omitempty"`
	// The device automatically enrolls in this beta program. This key must only be present if
	// the `ProgramEnrollment` key is set to `AlwaysOn`. The `OfferPrograms` key must not be
	// present if this key is present.
	RequireProgram *SoftwareUpdateSettingsBetaRequireProgram `plist:"RequireProgram,omitempty" json:"RequireProgram,omitempty"`
}

type SoftwareUpdateSettingsBetaOfferPrograms struct {
	// A human readable description of the beta program.
	Description string `plist:"Description" json:"Description"`
	// The Apple Business Manager or Apple School Manager seeding service token for the
	// organization the MDM server is part of. The system uses this token to enroll the device
	// in the corresponding beta program.
	Token string `plist:"Token" json:"Token"`
}

type SoftwareUpdateSettingsBetaRequireProgram struct {
	// A human readable description of the beta program.
	Description string `plist:"Description" json:"Description"`
	// The Apple Business Manager or Apple School Manager seeding service token for the
	// organization the MDM server is part of. The system uses this token to enroll the device
	// in the corresponding beta program.
	Token string `plist:"Token" json:"Token"`
}

type SoftwareUpdateSettingsDeferrals struct {
	// Specifies the number of days to defer a major or minor OS software update on the device.
	// When set, software updates only appear after the specified delay, following the release
	// of the software update. Available in iOS 18 and later.
	CombinedPeriodInDays *int64 `plist:"CombinedPeriodInDays,omitempty" json:"CombinedPeriodInDays,omitempty"`
	// Specifies the number of days to defer a major OS software update on the device. When
	// set, software updates only appear after the specified delay, following the release of
	// the software update. Available in macOS 15 and later.
	MajorPeriodInDays *int64 `plist:"MajorPeriodInDays,omitempty" json:"MajorPeriodInDays,omitempty"`
	// Specifies the number of days to defer a minor OS software update on the device. It also
	// defers major updates for iOS. When set, software updates only appear after the specified
	// delay, following the release of the software update. Available in macOS 15 and later.
	MinorPeriodInDays *int64 `plist:"MinorPeriodInDays,omitempty" json:"MinorPeriodInDays,omitempty"`
	// Specifies the number of days to defer system or non-OS updates. When set, updates only
	// appear after the specified delay, following the release of the update. Available in
	// macOS 15 and later.
	SystemPeriodInDays *int64 `plist:"SystemPeriodInDays,omitempty" json:"SystemPeriodInDays,omitempty"`
}

type SoftwareUpdateSettingsRapidSecurityResponse struct {
	// If set to `false`, Background Security Improvements aren't offered for user
	// installation. The system can still install Background Security Improvements with
	// `com.apple.configuration.softwareupdate.enforcement.specific` configurations.
	Enable *bool `plist:"Enable,omitempty" json:"Enable,omitempty"`
	// If set to `false`, the system doesn't offer Background Security Improvement rollbacks to
	// the user.
	EnableRollback *bool `plist:"EnableRollback,omitempty" json:"EnableRollback,omitempty"`
}

type UserNameAndPasswordCredential struct {
	// The user name for this credential.
	UserName string `plist:"UserName" json:"UserName"`
	// The password for this credential.
	Password *string `plist:"Password,omitempty" json:"Password,omitempty"`
}

type WatchEnrollment struct {
	// The URL of the profile that the Apple Watch downloads and installs if the user opts in
	// to management during the pairing process, which needs to start with `https://`.
	// Successful enrollment requires that the pairing iPhone is supervised and the profile
	// contains an MDM payload. Apple Watch attempts to install each payload that the profile
	// contains.
	EnrollmentProfileURL string `plist:"EnrollmentProfileURL" json:"EnrollmentProfileURL"`
	// An array of identifiers of asset declarations that contain anchor certificates to use to
	// evaluate the trust of the enrollment profile server. Set the type of the corresponding
	// assets to `com.apple.asset.credential.certificate`.
	AnchorCertificateAssetReferences []string `plist:"AnchorCertificateAssetReferences,omitempty" json:"AnchorCertificateAssetReferences,omitempty"`
}