wire

type AgentHits struct {
	Building  bool             `json:"building"`
	Truncated bool             `json:"truncated"`
	Hits      []agentstore.Hit `json:"hits"`
	// ReqID echoes the reqId of the agentSearch this answers.
	ReqID uint64 `json:"reqId,omitempty"`
}

type AgentIndex struct {
	Building bool                 `json:"building"`
	Sessions []agentstore.Summary `json:"sessions"`
	// History is per-day backfill from the tools' own aggregates — days the
	// transcripts no longer witness because the tool pruned them (see
	// agentstore.HistoryDay). It honours the request's Tools filter, and a
	// request scoped by Cwd gets none at all: the aggregates carry no
	// working directory, and global history merged into a per-project
	// answer would inflate it. Optional and additive: a daemon without it
	// simply sends sessions alone, which is what every daemon did before
	// the field existed.
	History []agentstore.HistoryDay `json:"history,omitempty"`
	// HistoryTotals is the same aggregates' lifetime per-model accounting,
	// in the summaries' own four buckets (see agentstore.HistoryTotals).
	// Lifetime only — it cannot be sliced by range — so a client folds it
	// into its all-time view alone. Filtered and omitted exactly as History
	// is, and additive on the same terms.
	HistoryTotals []agentstore.HistoryTotals `json:"historyTotals,omitempty"`
	// ReqID echoes the reqId of the agents this answers.
	ReqID uint64 `json:"reqId,omitempty"`
}

type AgentPage struct {
	Tool     string               `json:"tool"`
	ID       string               `json:"id"`
	Messages []agentstore.Message `json:"messages"`
	Start    int64                `json:"start"`
	Next     int64                `json:"next"`
	Eof      bool                 `json:"eof"`
	FileSize int64                `json:"fileSize"`
	// ReqID echoes the reqId of the agentRead this answers.
	ReqID uint64 `json:"reqId,omitempty"`
}

type AgentRead struct {
	Tool   string `json:"tool"`
	ID     string `json:"id"`
	Offset int64  `json:"offset"`
	Dir    string `json:"dir,omitempty"`
	Limit  int    `json:"limit,omitempty"`
	// ReqID correlates this request with the agentPage or error answering it.
	ReqID uint64 `json:"reqId,omitempty"`
}

type AgentSearch struct {
	Query string   `json:"query"`
	Tools []string `json:"tools,omitempty"`
	Cwd   string   `json:"cwd,omitempty"`
	Limit int      `json:"limit,omitempty"`
	// ReqID correlates this request with the agentHits or error answering it.
	ReqID uint64 `json:"reqId,omitempty"`
}

type Agents struct {
	Tools []string `json:"tools,omitempty"`
	Cwd   string   `json:"cwd,omitempty"`
	// ReqID correlates this request with the agentIndex or error answering it.
	ReqID uint64 `json:"reqId,omitempty"`
}

type Attach struct {
	ID      string `json:"id"`
	LastSeq uint64 `json:"lastSeq"`
	// ReqID correlates this request with the attached or error answering it.
	ReqID uint64 `json:"reqId,omitempty"`
}

type Attached struct {
	Ref       uint32 `json:"ref"`
	ID        string `json:"id"`
	Cols      uint16 `json:"cols"`
	Rows      uint16 `json:"rows"`
	Title     string `json:"title"`
	Seq       uint64 `json:"seq"`
	Truncated bool   `json:"truncated"`
	// Head is the offset one past the replayed backlog: bytes below Head are
	// history, bytes at or after it are live. Head == Seq means no backlog.
	Head    uint64 `json:"head"`
	Primary bool   `json:"primary"`
	// ReqID echoes the reqId of the attach or spawn this answers.
	ReqID uint64 `json:"reqId,omitempty"`
}

type Cancel struct {
	Ref uint32 `json:"ref"`
}

type CloseSession struct {
	Ref uint32 `json:"ref,omitempty"`
	ID  string `json:"id,omitempty"`
}

type Detach struct {
	Ref uint32 `json:"ref"`
}

type DeviceInfo struct {
	ID       string `json:"id"`
	Label    string `json:"label"`
	PairedAt int64  `json:"pairedAt"`
	LastSeen int64  `json:"lastSeen"`
	// PairedOn is the machine that ran the ceremony this device came from —
	// the `pairedOn` of its fleet certificate, read from the signed blob and
	// not from anything the device said about itself.
	//
	// It is here so a Devices screen can tell its two kinds of row apart. A
	// machine on a fleet lists every device it admitted, and it admits two
	// ways: the ones it paired itself, and the ones it took on the fleet's word
	// when they turned up over the relay holding a certificate (rule 2,
	// spec/fleet-trust.md). Those read identically without this — a phone
	// paired on the laptop appears on the desktop looking exactly like a phone
	// paired on the desktop — and they are not identical at all: revoking the
	// second cuts it off every machine in the fleet, permanently.
	//
	// Empty for a device with no certificate (paired before the fleet key
	// existed) and for one whose certificate does not verify under the fleet
	// key this machine holds now. Both mean the same thing to a reader: nothing
	// signed says where this row came from, so it is treated as this machine's
	// own — the conservative direction, since it is the one that does not offer
	// a fleet-wide revoke on the strength of a blob that proved nothing.
	PairedOn string `json:"pairedOn,omitempty"`
	// Origin is where the device first reached this machine from — the Origin
	// header on its enrolment POST, recorded on the local row and never minted
	// into the certificate (crypto.Device). It exists because several loopback
	// tabs enrol as several devices, one per browser origin, and their rows
	// are otherwise identical. A hint, not an identity: absent is the ordinary
	// state of a device paired by ceremony, admitted on a fleet cert, or
	// enrolled before origins were recorded, and a screen must render absent
	// as unremarkable rather than suspicious.
	Origin string `json:"origin,omitempty"`
}

type DeviceList struct {
	Devices []DeviceInfo `json:"devices"`
}

type Devices struct{}

type Eof struct {
	Ref uint32 `json:"ref"`
}

type Error struct {
	Code string `json:"code"`
	Msg  string `json:"msg"`
	// ReqID echoes the reqId of the request this error answers, when it
	// answers one — not_found and spawn_failed do; a lagged stream does not.
	ReqID uint64 `json:"reqId,omitempty"`
}

type Exit struct {
	Ref  uint32 `json:"ref"`
	Code int    `json:"code"`
}

type File struct {
	Ref  uint32 `json:"ref"`
	Path string `json:"path"`
	// Size is the file's real size, which is not always how much is sent: see
	// Truncated.
	Size int64 `json:"size"`
	// Mime is sniffed from the content, never from the extension.
	Mime string `json:"mime"`
	// Kind is "text" or "image". Anything else is refused rather than sent,
	// because a client has nothing useful to do with it.
	Kind string `json:"kind"`
	// Truncated says the file is longer than this daemon will send and only
	// its head is coming. Reported rather than hidden: a viewer that showed
	// 8 MiB of a 40 MiB file in silence would be lying about the file.
	Truncated bool `json:"truncated,omitempty"`
	// ReqID echoes the reqId of the read this answers.
	ReqID uint64 `json:"reqId,omitempty"`
}

type Hello struct {
	Ver  string   `json:"ver"`
	Caps []string `json:"caps,omitempty"`
}

type List struct{}

type PairCancel struct{}

type PairStart struct{}

type Pairing struct {
	Token string `json:"token"`
	// URL is absolute: the /pair page on this origin, carrying the token.
	URL string `json:"url"`
	// DaemonPub is the daemon's static public key, base64.
	DaemonPub string `json:"daemonPub"`
	// ExpiresAt is unix seconds. The token is single-use and short-lived.
	ExpiresAt int64 `json:"expiresAt"`
}

type PathEntry struct {
	Path   string `json:"path"`
	Exists bool   `json:"exists"`
	// Kind is "file", "dir" or "other". Empty when Exists is false.
	Kind string `json:"kind,omitempty"`
	// Size is bytes, and Mtime unix seconds — the same unit deviceList uses,
	// rather than the RFC 3339 strings sessions[] carries.
	Size  int64 `json:"size,omitempty"`
	Mtime int64 `json:"mtime,omitempty"`
}

type Peek struct {
	ID    string `json:"id"`
	Bytes int    `json:"bytes,omitempty"`
	// ReqID correlates this request with the preview or error answering it.
	ReqID uint64 `json:"reqId,omitempty"`
}

type Preview struct {
	ID string `json:"id"`
	// Data is the raw tail of the session's scrollback.
	Data []byte `json:"data"`
	// Cols and Rows are the dimensions the bytes were drawn at, so a consumer
	// that replays them into an emulator can size it the way the session is.
	Cols uint16 `json:"cols"`
	Rows uint16 `json:"rows"`
	// ReqID echoes the reqId of the peek this answers.
	ReqID uint64 `json:"reqId,omitempty"`
}

type Read struct {
	ID   string `json:"id"`
	Path string `json:"path"`
	// ReqID correlates this request with the file or error answering it.
	ReqID uint64 `json:"reqId,omitempty"`
}

type RelayInfo struct {
	// Status is "connecting" while the daemon is dialling and "connected" once
	// the socket is up. "off" is a daemon with no relay: on a welcome it is
	// never sent — the whole field is omitted instead — but on a RelayState it
	// is spelled out, because a push that said nothing would say nothing.
	Status string `json:"status"`
	// Origin is the https origin the relay serves browsers on — the address a
	// pairing URL names while the relay is up. Empty unless Status is
	// "connected", because a socket that is not up carries nothing.
	Origin string `json:"origin,omitempty"`
	// MachineID is the slot this daemon holds on the relay — the <id> in the
	// /client/<id> URL a browser opens to reach this machine. It comes from
	// relay.json rather than from the socket, so it is present whenever the
	// relay is configured, connecting and connected alike.
	MachineID string `json:"machineId,omitempty"`
	// MachineName is the machine's human label, free text from the same file.
	// For lists and titles, never for URLs — that is what MachineID is for.
	MachineName string `json:"machineName,omitempty"`
	// NoFleetKey says this daemon is on a relay and cannot sign for its fleet:
	// relay.json carries no fleet key, or one this daemon cannot parse, or no
	// machine id for a certificate to name. A device paired while it is true
	// gets no fleet key pinned and no certificate minted — it reaches this
	// machine and nothing else, for the life of the pairing, because both of
	// those records are written exactly once by the ceremony. So the screen
	// that draws the QR refuses to draw one (routes/devices.tsx), the way it
	// already refuses a QR that could only name loopback.
	//
	// Stated as the fault rather than as a capability, deliberately: absent
	// means "this daemon said nothing about it", which is what an older build
	// on the other end of a relay-served tab says, and that must not read as a
	// refusal. It is also the reason this is a field on the welcome rather than
	// something the client infers — whether a *process* can sign is not
	// visible from any file the browser can see.
	NoFleetKey bool `json:"noFleetKey,omitempty"`
}

type RelayState struct {
	Relay RelayInfo `json:"relay"`
}

type Resize struct {
	Ref     uint32 `json:"ref"`
	Cols    uint16 `json:"cols"`
	Rows    uint16 `json:"rows"`
	Primary bool   `json:"primary"`
}

type Revoke struct {
	DeviceID string `json:"deviceId"`
}

type Revoked struct {
	Reason string `json:"reason"`
}

type Sessions struct {
	Sessions []session.Info `json:"sessions"`
}

type Signal struct {
	Ref uint32 `json:"ref"`
	Sig string `json:"sig"`
}

type SizeChanged struct {
	Ref     uint32 `json:"ref"`
	Cols    uint16 `json:"cols"`
	Rows    uint16 `json:"rows"`
	Primary bool   `json:"primary"`
}

type Spawn struct {
	Cwd  string   `json:"cwd,omitempty"`
	Cmd  []string `json:"cmd,omitempty"`
	Cols uint16   `json:"cols"`
	Rows uint16   `json:"rows"`
	// ReqID correlates this request with the attached or error answering it.
	// Client-chosen; zero means the client asked for no correlation.
	ReqID uint64 `json:"reqId,omitempty"`
	// Group links the new session under an anchor session — a split pane, or a
	// tab in the anchor's group. Optional and additive: a daemon from before
	// the field ignores it, and the session simply spawns ungrouped.
	Group string `json:"group,omitempty"`
	// Ephemeral marks a scratch terminal: hidden by clients, reaped fast once
	// exited, and closed by the daemon when the Group parent ends. Optional
	// and additive like Group.
	Ephemeral bool `json:"ephemeral,omitempty"`
}

type Stat struct {
	ID    string   `json:"id"`
	Paths []string `json:"paths"`
	// ReqID correlates this request with the stats or error answering it.
	ReqID uint64 `json:"reqId,omitempty"`
}

type Stats struct {
	Entries []PathEntry `json:"entries"`
	// ReqID echoes the reqId of the stat this answers.
	ReqID uint64 `json:"reqId,omitempty"`
}

type Update struct {
	ID     string    `json:"id"`
	Name   *string   `json:"name,omitempty"`
	Tags   *[]string `json:"tags,omitempty"`
	Pinned *bool     `json:"pinned,omitempty"`
	// Ephemeral exists for one edit: clearing it keeps a scratch terminal,
	// promoting it to an ordinary member of its group. A pointer for the same
	// reason the others are — absent means this edit is not about it.
	Ephemeral *bool `json:"ephemeral,omitempty"`
}

type Welcome struct {
	DaemonID string   `json:"daemonId"`
	Host     string   `json:"host"`
	Ver      string   `json:"ver"`
	Caps     []string `json:"caps,omitempty"`
	// Relay is how this daemon is reachable from outside the machine, or nil
	// when it is not configured for a relay at all. See RelayInfo.
	Relay *RelayInfo `json:"relay,omitempty"`

	// FleetCert is this device's own fleet certificate — the signed blob it
	// presents to every *other* machine in the fleet to be admitted without a
	// second ceremony (spec/fleet-trust.md, rule 2) — or empty when there is
	// none to give.
	//
	// It rides the welcome because this connection is the one place the cert
	// can be handed over privately and to the right device at once: the socket
	// is inside Noise, so the relay carries ciphertext, and the far end has
	// already proved it holds the key the cert names. The alternative this
	// replaced was publishing every device cert to the credential-less
	// `GET /directory` and letting the browser find its own — which worked, and
	// put every device's public key and human label in a document anybody on
	// the internet could read, and spent one of the directory's 512 permanent
	// entries on every pairing ceremony ever performed.
	//
	// Empty for a loopback connection (no device identity to hand one to), for
	// a daemon with no fleet key, and for a device paired before the fleet key
	// existed. A client that gets none keeps whatever it already had.
	FleetCert []byte `json:"fleetCert,omitempty"`

	// FleetPub is the fleet's Ed25519 *public* key — what every certificate in
	// the fleet verifies under — or empty on a daemon that holds none.
	//
	// It rides the welcome for the reason FleetCert does, one level up. A
	// browser pins this key from the QR at pairing time and from nowhere else,
	// which was right and was also final: a browser that paired while its
	// machine held no fleet key pinned nothing, and nothing afterwards could
	// give it one, so it saw the single machine it paired with until somebody
	// ran the ceremony again. The certificate had the same problem and this
	// field is the same answer.
	//
	// Handing it over here is not trust-on-first-use, because of who is
	// speaking. A relayed connection is a Noise IK session the browser opened
	// against a static key it pinned out of band, so a key that arrives on it
	// is an authenticated statement from a party the browser already trusts,
	// not an assertion from an unknown peer: a hostile relay cannot forge the
	// session, and a daemon that could lie about this already holds the fleet
	// seed (it is in relay.json on every machine) and can therefore already
	// mint a certificate for any key it likes. The condition is enforced on the
	// receiving side, which is the only side that knows how it learned the
	// static key it is talking to: web/src/fleet/fleet.ts, adoptFleetKey, keeps
	// this only from a machine whose daemon key this browser pinned itself.
	//
	// The public half only, and never the seed. The seed rides the join line
	// between machines; a browser holding it could mint certificates for the
	// fleet, which is the one thing the layering in spec/fleet-trust.md exists
	// to keep out of a tab's reach.
	FleetPub []byte `json:"fleetPub,omitempty"`
}