types

package
v0.9.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 8, 2026 License: AGPL-3.0 Imports: 9 Imported by: 0

Documentation

Overview

Package types contains API DTOs (data transfer objects) used by the API service to receive requests and return responses to clients.

These types are intentionally NOT Kubernetes CRD types. CRD types live in pkg/apis/llmsafespaces/v1; this package converts to/from them at the service boundary. Types here use plain Go types (e.g. *time.Time, not *metav1.Time) so the JSON contract returned to clients is free of Kubernetes-isms (kind, apiVersion, metadata).

Types are organized by domain (one file per area):

  • errors.go — cross-cutting sentinel errors
  • context.go — context-key types and the WorkspaceMetaFromCtx accessor
  • auth.go — user, registration/login, API keys, auth config
  • workspace.go — workspace API DTOs (create/list/status/metadata)
  • container.go — pod/resource/security/network config types
  • session.go — sessions, WebSocket connections, agent health
  • pagination.go — pagination metadata and list options
  • event.go — Kubernetes events, resource status, file info
  • orgs.go — organizations, members, invitations
  • orgs_policy.go — org policies and audit log entries
  • billing.go — usage events, reports, quota

Index

Constants

View Source 
const (
	MCPServerTransportHTTP  = "http"
	MCPServerTransportSSE   = "sse"
	MCPServerTransportStdio = "stdio"
)

MCP server transports as stored in mcp_servers.transport. They map to opencode config types at materialization time (http/sse → "remote", stdio → "local").

View Source 
const (
	MCPServerOwnerAdmin = "admin"
	MCPServerOwnerOrg   = "org"
	MCPServerOwnerUser  = "user"
)

MCP server owner scopes (mirrors provider_credentials.owner_type).

View Source 
const (
	WorkflowStatusDraft   = "draft"
	WorkflowStatusActive  = "active"
	WorkflowStatusArchive = "archived"
)

WorkflowStatus is the lifecycle state of a workflow definition (draft → active → archived).

View Source 
const (
	WorkflowOwnerUser = "user"
	WorkflowOwnerOrg  = "org"
)

Owner scopes (mirrors provider_credentials.owner_type — minus admin, deferred to v2 per D7).

View Source 
const (
	TriggerSourceCron    = "cron"
	TriggerSourceWebhook = "webhook"
)

TriggerSourceType enumerates trigger source types (design D5: 'manual' is NOT a source type; manual runs go through POST /workflows/:id/runs with trigger_id = null).

View Source 
const (
	TriggerTargetRunWorkflow = "run_workflow"
	TriggerTargetRunScript   = "run_script"
)

TriggerTargetType enumerates what a trigger fires.

View Source 
const (
	NodeTypeScript    = "script"
	NodeTypeAgent     = "agent"
	NodeTypeHTTP      = "http"
	NodeTypeCondition = "condition"
)

NodeType enumerates the four v1 node types (design Node Type Specifications).

View Source 
const (
	RunStatusQueued    = "queued"
	RunStatusRunning   = "running"
	RunStatusSucceeded = "succeeded"
	RunStatusFailed    = "failed"
	RunStatusCanceled  = "canceled"
	RunStatusTimedOut  = "timed_out"
)

RunStatus is the six-state workflow run state machine (no library, design D8).

View Source 
const (
	NodeRunStatusPending   = "pending"
	NodeRunStatusRunning   = "running"
	NodeRunStatusSucceeded = "succeeded"
	NodeRunStatusFailed    = "failed"
	NodeRunStatusSkipped   = "skipped"
)

NodeRunStatus is the per-node state.

View Source 
const (
	TriggerFireFired           = "fired"
	TriggerFireDelivered       = "delivered"
	TriggerFireFailed          = "failed"
	TriggerFireValidationError = "validation_error"
	TriggerFireRateLimited     = "rate_limited"
	TriggerFireSkipped         = "skipped"
	TriggerFireAutoDisabled    = "auto_disabled"
)

TriggerFireStatus records what happened when a trigger fired.

View Source 
const (
	WebhookIdempotencyHeader   = "header"
	WebhookIdempotencyHash     = "hash"
	WebhookIdempotencyDisabled = "disabled"
)

WebhookIdempotencyMode controls how duplicate deliveries are detected.

View Source 
const (
	RunErrorCodeNodeFailed           = "node_failed"
	RunErrorCodeWorkspaceUnavailable = "workspace_unavailable"
	RunErrorCodeCanceled             = "canceled"
	RunErrorCodeTimedOut             = "timed_out"
	RunErrorCodeValidationError      = "validation_error"
	RunErrorCodeSchemaMismatch       = "schema_mismatch"
	RunErrorCodeOutputOversize       = "output_oversize"
	RunErrorCodeAgentNotFound        = "agent_not_found"
	RunErrorCodeSessionNotFound      = "session_not_found"
	RunErrorCodeSecretNotFound       = "secret_not_found"
	RunErrorCodeScriptFailed         = "script_failed"
	RunErrorCodeScriptOutputInvalid  = "script_output_invalid"
	RunErrorCodeAPIRestart           = "api_restart"
)

RunErrorCode is the machine-readable failure categorization on workflow_runs (and workflow_node_runs.error_code). Bounded by the migration's CHECK constraint.

View Source 
const ContextKeyUserID contextKey = "userID"

ContextKeyUserID is the context key used to store the authenticated user ID. Both the auth middleware and service layer use this constant so the key is always in sync.

View Source 
const ContextKeyUserRole contextKey = "userRole"

ContextKeyUserRole is the context key used to store the authenticated user's role.

View Source 
const ContextKeyWorkspaceMeta contextKey = "workspaceMeta"

ContextKeyWorkspaceMeta is the context key under which WorkspaceAccessMiddleware stores the resolved *WorkspaceMetadata for the current /:id workspace route. Service-layer methods (workspace.Service. verifyOwner, SecretService methods that previously re-checked ownership) read the metadata from here so they can short-circuit the redundant ResolveWorkspace + CheckOwnership round-trip the middleware has already performed. Lives in pkg/types — not api/internal/middleware — so the service layer can read it without importing the HTTP middleware package (which would invert the dependency direction).

View Source 
const DefaultMaxMcpServersPerWorkspace = 5

DefaultMaxMcpServersPerWorkspace is the per-workspace MCP server quota when an org has not set PolicyMaxMcpServersPerWorkspace. It bounds agent-startup cost and blast radius (each server is a startup connection).

View Source 
const PlatformMcpOwnerID = "_platform"

PlatformMcpOwnerID is the owner_id literal for platform-admin-scoped rows.

View Source 
const RoleConfigVersion = 1

RoleConfigVersion is the current config schema version.

Variables

View Source 
var (
	ErrNotFound         = errors.New("resource not found")
	ErrPermissionDenied = errors.New("permission denied")
	ErrInvalidInput     = errors.New("invalid input")
	ErrAlreadyExists    = errors.New("resource already exists")
)

Common sentinel errors used across service-layer methods. Callers use errors.Is to branch on these without coupling to a specific service.

Functions

func IsTerminalRunStatus added in v0.8.11 

func IsTerminalRunStatus(s string) bool

IsTerminalRunStatus reports whether s is a terminal run state.

func MarshalRoleConfig 

func MarshalRoleConfig(cfg *RoleConfig) ([]byte, error)

MarshalRoleConfig encodes a RoleConfig back to JSONB, including Raw keys.

func MaxPromptPerLevel 

func MaxPromptPerLevel() int

MaxPromptPerLevel is the character limit for each prompt tier.

func ValidMCPServerName added in v0.7.0 

func ValidMCPServerName(name string) bool

ValidMCPServerName reports whether name is an acceptable server name.

func ValidMCPServerTransport added in v0.7.0 

func ValidMCPServerTransport(t string) bool

ValidMCPServerTransport reports whether t is a supported transport.

func ValidNodeRunStatus added in v0.8.11 

func ValidNodeRunStatus(s string) bool

ValidNodeRunStatus reports whether s is a valid per-node run status.

func ValidNodeType added in v0.8.11 

func ValidNodeType(t string) bool

ValidNodeType reports whether t is a supported node type (v1: 4 types).

func ValidRunErrorCode added in v0.8.11 

func ValidRunErrorCode(c string) bool

ValidRunErrorCode reports whether c is a member of the bounded error_code set (enforced by the workflow_runs.error_code CHECK constraint in migration 000016).

func ValidRunStatus added in v0.8.11 

func ValidRunStatus(s string) bool

ValidRunStatus reports whether s is a valid workflow run status.

func ValidTriggerFireStatus added in v0.8.11 

func ValidTriggerFireStatus(s string) bool

ValidTriggerFireStatus reports whether s is a valid trigger-fire audit status.

func ValidTriggerSourceType added in v0.8.11 

func ValidTriggerSourceType(t string) bool

ValidTriggerSourceType reports whether t is a supported trigger source type.

func ValidTriggerTargetType added in v0.8.11 

func ValidTriggerTargetType(t string) bool

ValidTriggerTargetType reports whether t is a supported trigger target type.

func ValidWebhookIdempotencyMode added in v0.8.11 

func ValidWebhookIdempotencyMode(m string) bool

ValidWebhookIdempotencyMode reports whether m is a supported idempotency mode.

func ValidWorkflowName added in v0.8.11 

func ValidWorkflowName(name string) bool

ValidWorkflowName reports whether name is an acceptable workflow/trigger name.

func ValidWorkflowOwnerType added in v0.8.11 

func ValidWorkflowOwnerType(t string) bool

ValidWorkflowOwnerType reports whether t is a supported owner_type (v1: user|org).

func ValidWorkflowSlug added in v0.8.11 

func ValidWorkflowSlug(slug string) bool

ValidWorkflowSlug reports whether slug is an acceptable workflow slug.

func ValidWorkflowStatus added in v0.8.11 

func ValidWorkflowStatus(s string) bool

ValidWorkflowStatus reports whether s is a valid workflow definition status.

Types

type APIKey 

type APIKey struct {
	ID        string     `json:"id"`
	UserID    string     `json:"-" db:"user_id"`
	Name      string     `json:"name"`
	Key       string     `json:"key,omitempty"`
	Prefix    string     `json:"prefix"`
	Active    bool       `json:"active"`
	CreatedAt time.Time  `json:"createdAt"`
	ExpiresAt *time.Time `json:"expiresAt,omitempty"`
	Legacy    bool       `json:"legacy,omitempty" db:"key_legacy"`

	DecryptAccess bool     `json:"decryptAccess"`
	DekSynced     bool     `json:"dekSynced"`
	AllowedCIDRs  []string `json:"allowedCidrs,omitempty"`
	KekSalt       []byte   `json:"-" db:"kek_salt"`
	WrappedDEK    []byte   `json:"-" db:"wrapped_dek"`
	KeyCiphertext []byte   `json:"-" db:"key_ciphertext"`
	KeyVersion    int      `json:"-" db:"key_version"`
}

APIKey represents an API key record returned in list responses.

type ActivateWorkspaceResponse 

type ActivateWorkspaceResponse struct {
	Resumed   string `json:"resumed"`
	Suspended string `json:"suspended,omitempty"`
}

ActivateWorkspaceResponse is returned by POST /workspaces/:id/activate.

type ActiveSessionsResponse 

type ActiveSessionsResponse struct {
	Active    []string `json:"active"`
	MaxActive int      `json:"maxActive"`
}

ActiveSessionsResponse is returned by GET /workspaces/:id/sessions/active.

type AddOrgMemberRequest 

type AddOrgMemberRequest struct {
	UserID string  `json:"userId" binding:"required"`
	Role   OrgRole `json:"role"   binding:"required"`
}

AddOrgMemberRequest is the request body for adding an org member.

type AgentHealthResult 

type AgentHealthResult struct {
	Status              string   `json:"status"`
	ProvidersConfigured int      `json:"providersConfigured"`
	AgentVersion        string   `json:"agentVersion,omitempty"`
	Connected           []string `json:"connected,omitempty"`
	Message             string   `json:"message,omitempty"`
	LastCheckedAt       string   `json:"lastCheckedAt,omitempty"`
}

type AgentRole 

type AgentRole struct {
	ID          string     `json:"id"`
	Scope       string     `json:"scope"`
	OrgID       *string    `json:"orgId,omitempty"`
	Name        string     `json:"name"`
	Slug        string     `json:"slug"`
	Description string     `json:"description"`
	Extends     *string    `json:"extends,omitempty"`
	IsDefault   bool       `json:"isDefault"`
	Config      RoleConfig `json:"config"`
	CreatedAt   time.Time  `json:"createdAt"`
	UpdatedAt   time.Time  `json:"updatedAt"`
}

AgentRole is the database row representation.

type AuditEntry 

type AuditEntry struct {
	ID        int64          `json:"id"`
	ActorID   string         `json:"actorId"`
	Domain    string         `json:"domain"`
	Action    string         `json:"action"`
	TargetID  string         `json:"targetId,omitempty"`
	OrgID     string         `json:"orgId,omitempty"`
	Metadata  map[string]any `json:"metadata,omitempty"`
	CreatedAt time.Time      `json:"createdAt"`
}

AuditEntry is one row of the audit_log, scoped to an org when OrgID is non-empty.

type AuditFilters 

type AuditFilters struct {
	OrgID   *string
	ActorID *string
	Domain  *string
	Limit   int
	Offset  int
}

AuditFilters holds optional filters for cross-org audit queries.

type AuthConfig 

type AuthConfig struct {
	RegistrationEnabled  bool     `json:"registrationEnabled"`
	OIDCEnabled          bool     `json:"oidcEnabled"`
	PasskeyEnabled       bool     `json:"passkeyEnabled"`
	PasskeyDefaultSignup bool     `json:"passkeyDefaultSignup,omitempty"`
	SSOProviders         []string `json:"ssoProviders,omitempty"`
	InstanceName         string   `json:"instanceName"`
	MOTD                 string   `json:"motd"`
}

AuthConfig is returned by GET /auth/config for feature-flag discovery.

type AuthResponse 

type AuthResponse struct {
	Token       string        `json:"token"`
	User        User          `json:"user"`
	RecoveryKey string        `json:"recoveryKey,omitempty"`
	TokenTTL    time.Duration `json:"-"` // router-internal: not serialized
}

AuthResponse is returned after successful registration or login.

RecoveryKey is populated only on registration (one-time display). It is the user's sole opportunity to retrieve it; the API does not store it anywhere recoverable. Login responses omit this field entirely.

TokenTTL is the effective JWT lifetime used for this session. It is tagged json:"-" so it never appears in the HTTP response body — clients already receive the exp claim inside the JWT. This field carries the TTL from the auth service to the router handler for cookie Max-Age calculation without requiring an interface change.

type BillingOwner 

type BillingOwner struct {
	ID   string    `json:"id"`
	Type OwnerType `json:"type"`
}

type CachedSession 

type CachedSession struct {
	SessionID   string `json:"sessionId"`
	UserID      string `json:"userId"`
	WorkspaceID string `json:"workspaceId"`
}

CachedSession is the typed representation of a WebSocket session stored in the cache. It replaces the previous map[string]interface{} bag.

type ChangeOrgMemberRoleRequest 

type ChangeOrgMemberRoleRequest struct {
	Role OrgRole `json:"role" binding:"required"`
}

ChangeOrgMemberRoleRequest is the request body for changing a member's role.

type ContainerStateValue 

type ContainerStateValue string

ContainerStateValue represents the state of a container 

const (
	ContainerStateRunning    ContainerStateValue = "Running"
	ContainerStateTerminated ContainerStateValue = "Terminated"
	ContainerStateWaiting    ContainerStateValue = "Waiting"
	ContainerStateUnknown    ContainerStateValue = "Unknown"
)

type ContainerStatus 

type ContainerStatus struct {
	// Container name
	Name string `json:"name"`

	// Whether the container is ready
	Ready bool `json:"ready"`

	// Number of times the container has been restarted
	RestartCount int32 `json:"restartCount"`

	// Container state
	State ContainerStateValue `json:"state"`

	// Time when the container started
	StartedAt *time.Time `json:"startedAt,omitempty"`

	// Time when the container finished
	FinishedAt *time.Time `json:"finishedAt,omitempty"`

	// Exit code if terminated
	ExitCode int32 `json:"exitCode,omitempty"`

	// Reason for current state
	Reason string `json:"reason,omitempty"`

	// Message regarding current state
	Message string `json:"message,omitempty"`
}

ContainerStatus represents the status of a container

type CreateAPIKeyRequest 

type CreateAPIKeyRequest struct {
	Name          string   `json:"name" binding:"required,min=1,max=128"`
	DecryptAccess bool     `json:"decryptAccess"`
	AllowedCIDRs  []string `json:"allowedCidrs,omitempty"`
}

CreateAPIKeyRequest is the request body for creating an API key.

type CreateInvitationsRequest 

type CreateInvitationsRequest struct {
	Emails []string `json:"emails" binding:"required,min=1,max=100,dive,email"`
	Role   OrgRole  `json:"role"   binding:"required"`
}

CreateInvitationsRequest is the body for POST /orgs/:id/invitations.

type CreateMCPServerRequest added in v0.7.0 

type CreateMCPServerRequest struct {
	Name      string                    `json:"name" binding:"required"`
	Transport string                    `json:"transport" binding:"required"`
	URL       string                    `json:"url,omitempty"`
	Command   string                    `json:"command,omitempty"`
	Args      []string                  `json:"args,omitempty"`
	TimeoutMs *int                      `json:"timeoutMs,omitempty"`
	Enabled   *bool                     `json:"enabled,omitempty"`
	Env       map[string]string         `json:"env,omitempty"`
	Headers   map[string]string         `json:"headers,omitempty"`
	AutoApply *MCPServerAutoApplyTarget `json:"autoApply,omitempty"`
}

CreateMCPServerRequest is the body for POST .../mcp-servers.

type CreateOrgRequest 

type CreateOrgRequest struct {
	Name       string  `json:"name"       binding:"required,min=2,max=100"`
	Slug       string  `json:"slug"       binding:"required,min=2,max=50,slug"`
	OwnerEmail string  `json:"ownerEmail" binding:"required,email"`
	PlanID     OrgPlan `json:"planId"     binding:"omitempty"`
}

CreateOrgRequest is the request body for creating an organization. The slug is lowercased by the service before insert and uniqueness check.

Per design 0031 D1, org creation is platform-admin only. The admin supplies the intended owner's email; the backend resolves it to a user ID. This is a single lookup, not a search/list endpoint (account-enumeration prevention).

Slug format: lowercase letters, digits, and single hyphens between segments (e.g. "my-org", "team-1"). The `slug` validator is registered in pkg/types/validators.go. Hyphens are required because the frontend's slugify() produces them from multi-word names; rejecting hyphens would produce an unreachable 400 for any user-friendly name.

type CreateOrgResponse 

type CreateOrgResponse struct {
	OrgResponse
}

CreateOrgResponse is returned by POST /api/v1/orgs. Org creation is platform-admin only (design 0031 D1).

type CreateTriggerRequest added in v0.8.11 

type CreateTriggerRequest struct {
	Name             string          `json:"name" binding:"required"`
	Description      string          `json:"description,omitempty"`
	Enabled          *bool           `json:"enabled,omitempty"`
	SourceType       string          `json:"sourceType" binding:"required"`
	SourceConfig     json.RawMessage `json:"sourceConfig" binding:"required"`
	TargetType       string          `json:"targetType" binding:"required"`
	TargetConfig     json.RawMessage `json:"targetConfig" binding:"required"`
	AutoDisableAfter *int            `json:"autoDisableAfter,omitempty"`
	// Webhook-specific fields (required when sourceType == 'webhook'):
	WebhookAllowedIPs        []string `json:"webhookAllowedIps,omitempty"`
	WebhookIdempotencyMode   string   `json:"webhookIdempotencyMode,omitempty"`
	WebhookIdempotencyHeader string   `json:"webhookIdempotencyHeader,omitempty"`
}

CreateTriggerRequest is the body for POST .../triggers. For webhook sources, an accompanying webhooks row (with secret_cipher) is created in the same transaction. auto_disable_after defaults to 10 if unset.

type CreateWorkflowRequest added in v0.8.11 

type CreateWorkflowRequest struct {
	Name              string          `json:"name" binding:"required"`
	Slug              string          `json:"slug,omitempty"`
	Description       string          `json:"description,omitempty"`
	SpecYAML          string          `json:"specYaml" binding:"required"`
	InputSchema       json.RawMessage `json:"inputSchema,omitempty"`
	TargetWorkspaceID string          `json:"targetWorkspaceId,omitempty"`
	Status            string          `json:"status,omitempty"`
	Defaults          json.RawMessage `json:"defaults,omitempty"`
}

CreateWorkflowRequest is the body for POST .../workflows. The server computes slug from name if not provided; spec_yaml is validated + parsed into spec_json by the DAG validator (US-64.4).

type CreateWorkflowRunRequest added in v0.8.11 

type CreateWorkflowRunRequest struct {
	Input       json.RawMessage `json:"input,omitempty"`
	WorkspaceID string          `json:"workspaceId,omitempty"`
}

CreateWorkflowRunRequest is the body for POST .../workflows/:id/runs (manual run). workspace_id overrides the workflow's target_workspace_id if set. input must satisfy the workflow's inputSchema (strict validation for manual runs per D12).

type CreateWorkspaceRequest 

type CreateWorkspaceRequest struct {
	Name         string            `json:"name"`
	Runtime      string            `json:"runtime"`
	StorageSize  string            `json:"storageSize"`
	StorageClass string            `json:"storageClass,omitempty"`
	Labels       map[string]string `json:"labels,omitempty"`
	OrgID        *string           `json:"orgId,omitempty"`
	// ImageConfigHash references an image-factory config (design/0046).
	// When set, the workspace service resolves it to a Ready config's
	// built image ref and overrides Runtime with it. The config must be
	// Ready and owned by the user, their org, or be platform-scoped.
	ImageConfigHash string `json:"imageConfigHash,omitempty"`
}

CreateWorkspaceRequest is the request body for creating a workspace.

type CredentialStateResult 

type CredentialStateResult struct {
	Available bool   `json:"available"`
	Reason    string `json:"reason,omitempty"`
	Message   string `json:"message,omitempty"`
}

type CronSourceConfig added in v0.8.11 

type CronSourceConfig struct {
	Expr string `json:"expr"`
	TZ   string `json:"tz,omitempty"`
}

CronSourceConfig is the typed shape of triggers.source_config for cron sources. expr is a cron expression (validated by the handler); tz is an IANA timezone name.

type DEKSource added in v0.7.0 

type DEKSource string

DEKSource identifies which encryption tier a user's personal secrets live in.

  • "server_kek" DEK wrapped by the master-KEK RootKeyProvider.
  • "passkey" Same unwrap path; distinguishes passkey-provisioned users.
const (
	DEKSourceServerKEK DEKSource = "server_kek"
	// DEKSourcePasskey marks passkey-only users (Epic 59). Their DEK is wrapped
	// by the master-KEK provider exactly like DEKSourceServerKEK; the distinct
	// value distinguishes the auth source for audit/telemetry, not a different
	// encryption tier.
	DEKSourcePasskey DEKSource = "passkey"
)

type EffectiveAgentRole 

type EffectiveAgentRole struct {
	AgentRole
	EffectiveConfig  RoleConfig `json:"effectiveConfig"`
	InheritanceChain []string   `json:"inheritanceChain"`
}

EffectiveAgentRole is the fully resolved role after walking the inheritance chain and merging all configs from root to leaf.

type EffectivePrompt 

type EffectivePrompt struct {
	PlatformPrompt string `json:"platformPrompt,omitempty"`
	OrgPrompt      string `json:"orgPrompt,omitempty"`
	RolePrompt     string `json:"rolePrompt,omitempty"`
	UserPrompt     string `json:"userPrompt,omitempty"`

	// Resolved is the merged text written to the admin prompt file.
	Resolved string `json:"resolved"`

	// AllowUserPrompt reports whether user customization is enabled for
	// this workspace's org. Delivered so the frontend can show lock state.
	AllowUserPrompt bool `json:"allowUserPrompt"`
}

EffectivePrompt is the fully resolved system prompt delivered to the pod via the bootstrap endpoint and materialized into agentd.AdminPromptPath (/sandbox-runtime/admin-prompt.md).

type EgressRule 

type EgressRule struct {
	// Domain name for egress filtering
	Domain string `json:"domain"`

	// Ports allowed for this domain
	Ports []PortRule `json:"ports,omitempty"`
}

EgressRule defines an egress rule

type EmailToken 

type EmailToken struct {
	ID         string     `json:"id" db:"id"`
	UserID     string     `json:"userId" db:"user_id"`
	Kind       string     `json:"kind" db:"kind"` // "password_reset" | "email_verify"
	TokenHash  string     `json:"-" db:"token_hash"`
	ExpiresAt  time.Time  `json:"expiresAt" db:"expires_at"`
	ConsumedAt *time.Time `json:"consumedAt,omitempty" db:"consumed_at"`
}

EmailToken is a single-use token for password reset or email verification. Only the sha256 hash is stored; the raw token is presented to the user via email and consumed on first POST (never via GET — scanner defense, US-49.9).

type EnsureSessionResponse 

type EnsureSessionResponse struct {
	WorkspaceID    string `json:"workspaceId"`
	WorkspacePhase string `json:"workspacePhase"`
	SessionID      string `json:"sessionId"`
	Resumed        bool   `json:"resumed"`
}

EnsureSessionResponse is returned by POST /workspaces/:id/sessions/new. It guarantees the workspace is active with a running pod, returning the workspace ID and session ID for immediate use.

type Event 

type Event struct {
	// Event type (Normal, Warning)
	Type string `json:"type"`

	// Event reason
	Reason string `json:"reason"`

	// Event message
	Message string `json:"message"`

	// Event count
	Count int32 `json:"count"`

	// Event time
	Time *time.Time `json:"time,omitempty"`

	// Event source (Pod, Sandbox, etc.)
	Source string `json:"source,omitempty"`
}

Event represents a Kubernetes event

type ExecutionResult 

type ExecutionResult struct {
	// Stdout output
	Stdout string `json:"stdout"`

	// Stderr output
	Stderr string `json:"stderr"`

	// Exit code
	ExitCode int `json:"exitCode"`

	// Execution time in milliseconds
	ExecutionTime int64 `json:"executionTime"`

	// Error message if any
	Error string `json:"error,omitempty"`
}

ExecutionResult represents the result of an execution

type FileInfo 

type FileInfo struct {
	// File name
	Name string `json:"name"`

	// File path
	Path string `json:"path"`

	// File size in bytes
	Size int64 `json:"size"`

	// File mode
	Mode string `json:"mode"`

	// Last modified time
	ModTime time.Time `json:"modTime"`

	// Whether it's a directory
	IsDir bool `json:"isDir"`
}

FileInfo represents information about a file

type FilesystemConfig 

type FilesystemConfig struct {
	// Mount root filesystem as read-only
	ReadOnlyRoot bool `json:"readOnlyRoot,omitempty"`

	// Paths that should be writable
	WritablePaths []string `json:"writablePaths,omitempty"`
}

FilesystemConfig defines filesystem configuration

type InvitationDetail 

type InvitationDetail struct {
	OrgName     string    `json:"orgName"`
	OrgSlug     string    `json:"orgSlug"`
	InviterName string    `json:"inviterName"`
	Role        OrgRole   `json:"role"`
	ExpiresAt   time.Time `json:"expiresAt"`
}

InvitationDetail is the public response for GET /invitations/:token. It does not expose the token hash or internal IDs beyond what the recipient needs to decide whether to accept.

type LastAdminOrg 

type LastAdminOrg struct {
	OrgID   string `json:"orgId"`
	OrgName string `json:"orgName"`
}

LastAdminOrg identifies an org where a user is the sole active admin.

type ListOptions 

type ListOptions struct {
	Limit  int `json:"limit"`
	Offset int `json:"offset"`
}

ListOptions carries pagination and filtering parameters.

type LoginRequest 

type LoginRequest struct {
	Email      string `json:"email"      binding:"required,email"`
	Password   string `json:"password"   binding:"required"`
	RememberMe bool   `json:"rememberMe"`
}

LoginRequest is the request body for user login.

type MCPServerAutoApplyRule added in v0.7.0 

type MCPServerAutoApplyRule struct {
	ServerID   string  `json:"-"`
	TargetType string  `json:"targetType"`
	TargetID   *string `json:"targetId,omitempty"`
}

MCPServerAutoApplyRule is a row of mcp_server_auto_apply.

type MCPServerAutoApplyTarget added in v0.7.0 

type MCPServerAutoApplyTarget struct {
	TargetType string  `json:"targetType"`
	TargetID   *string `json:"targetId,omitempty"`
}

MCPServerAutoApplyTarget describes an auto-apply rule on create.

type MCPServerBinding added in v0.7.0 

type MCPServerBinding struct {
	WorkspaceID string `json:"workspaceId"`
	ServerID    string `json:"serverId"`
	SourceType  string `json:"sourceType"`
}

MCPServerBinding is a row of mcp_server_bindings (workspace ↔ server).

type MCPServerResponse added in v0.7.0 

type MCPServerResponse struct {
	ID        string    `json:"id"`
	Name      string    `json:"name"`
	Transport string    `json:"transport"`
	URL       string    `json:"url,omitempty"`
	Command   string    `json:"command,omitempty"`
	Args      []string  `json:"args,omitempty"`
	TimeoutMs *int      `json:"timeoutMs,omitempty"`
	HasSecret bool      `json:"hasSecret"`
	Enabled   bool      `json:"enabled"`
	CreatedAt time.Time `json:"createdAt"`
	UpdatedAt time.Time `json:"updatedAt"`
}

MCPServerResponse is the API response shape. Secret bytes are never present; HasSecret reports whether the server carries an encrypted payload (UI eye-toggle).

type MCPServerSecretPayload added in v0.7.0 

type MCPServerSecretPayload struct {
	Env     map[string]string `json:"env,omitempty"`
	Headers map[string]string `json:"headers,omitempty"`
}

MCPServerSecretPayload is the JSON shape encoded into mcp_servers.ciphertext. Empty maps are valid (a server may have no secrets); the blob is always present so the NOT NULL column is satisfied.

func DecodeMCPServerSecretPayload added in v0.7.0 

func DecodeMCPServerSecretPayload(b []byte) (*MCPServerSecretPayload, error)

DecodeMCPServerSecretPayload parses ciphertext bytes.

func (*MCPServerSecretPayload) Encode added in v0.7.0 

func (p *MCPServerSecretPayload) Encode() ([]byte, error)

Encode returns the JSON bytes of the payload.

type Message 

type Message struct {
	Type    string `json:"type"`
	Content string `json:"content"`
}

type NetworkAccess 

type NetworkAccess struct {
	// Egress rules
	Egress []EgressRule `json:"egress,omitempty"`

	// Allow ingress traffic to sandbox
	Ingress bool `json:"ingress,omitempty"`
}

NetworkAccess defines network access configuration

type NetworkInfo 

type NetworkInfo struct {
	// Pod IP address
	PodIP string `json:"podIP,omitempty"`

	// Host IP address
	HostIP string `json:"hostIP,omitempty"`

	// Whether ingress is allowed
	Ingress bool `json:"ingress"`

	// Allowed egress domains
	EgressDomains []string `json:"egressDomains,omitempty"`
}

NetworkInfo represents network information for a sandbox

type OrgInvitation 

type OrgInvitation struct {
	ID         string     `json:"id"`
	OrgID      string     `json:"orgId"`
	Email      string     `json:"email"`
	Role       OrgRole    `json:"role"`
	InvitedBy  string     `json:"invitedBy"`
	TokenHash  string     `json:"-"`
	ExpiresAt  time.Time  `json:"expiresAt"`
	AcceptedAt *time.Time `json:"acceptedAt,omitempty"`
	DeclinedAt *time.Time `json:"declinedAt,omitempty"`
	BounceType string     `json:"bounceType,omitempty"`
	BouncedAt  *time.Time `json:"bouncedAt,omitempty"`
	CreatedAt  time.Time  `json:"createdAt"`

	// InviteeUserExists is true when a `users` row exists with this
	// invitation's email (case-folded match). Surfaced so the org admin
	// UI can render the per-row Verify button only when force-verify is
	// actionable. Pointer so a missing-from-payload value is
	// distinguishable from a definite false on older API responses.
	InviteeUserExists *bool `json:"inviteeUserExists,omitempty"`

	// InviteeEmailVerified mirrors users.email_verified for the row
	// matched by InviteeUserExists. Nil when no users row exists. The
	// org admin UI hides the Verify button when this is true (the
	// override has already been applied or the user verified through
	// the normal flow).
	InviteeEmailVerified *bool `json:"inviteeEmailVerified,omitempty"`
}

OrgInvitation is the API DTO for an org invitation row.

type OrgMember 

type OrgMember struct {
	OrgID         string    `json:"orgId"`
	UserID        string    `json:"userId"`
	Username      string    `json:"username"`
	Email         string    `json:"email"`
	Role          OrgRole   `json:"role"`
	EmailVerified bool      `json:"emailVerified"`
	CreatedAt     time.Time `json:"createdAt"`
}

OrgMember is the API DTO for an organization membership.

EmailVerified mirrors users.email_verified for the member's user account. It is exposed so org admins can see which members have not yet completed the email-verification flow, and offers a "Verify" action to bypass it (POST /orgs/:id/members/:userID/verify). Verification state lives on the user row (not the membership) — there is exactly one user account per member, and a single user belongs to at most one org under single-org enforcement (D8).

type OrgPlan 

type OrgPlan string

OrgPlan is the product plan identifier stored in organizations.plan_id and used locally for feature gating. The plan is set at org creation (enterprise for platform-admin orgs; the selected checkout plan on checkout.session.completed for self-service orgs). Per-event plan syncing from Stripe is planned for US-43.15. 

const (
	PlanFree       OrgPlan = "free"
	PlanTeam       OrgPlan = "team"
	PlanBusiness   OrgPlan = "business"
	PlanEnterprise OrgPlan = "enterprise"
)

type OrgPolicy 

type OrgPolicy struct {
	OrgID     string          `json:"-"`
	Key       OrgPolicyKey    `json:"key"`
	Value     json.RawMessage `json:"value"`
	UpdatedBy string          `json:"-"`
	UpdatedAt time.Time       `json:"updatedAt"`
}

OrgPolicy is one row of org_policies. The Value is the raw JSONB payload; the interpretation depends on the Key (see OrgPolicyValues).

type OrgPolicyKey 

type OrgPolicyKey string

OrgPolicyKey identifies a single org-scoped policy. Per D15, Phase 2 ships exactly these four; the migration CHECK constraint enforces the same set. 

const (
	PolicyAllowedModels             OrgPolicyKey = "allowed_models"
	PolicyAllowedProviders          OrgPolicyKey = "allowed_providers"
	PolicyMaxWorkspacesPerMember    OrgPolicyKey = "max_workspaces_per_member"
	PolicyMaxActiveWorkspacesPerMem OrgPolicyKey = "max_active_workspaces_per_member"

	// Agent customization policies
	PolicySysPromptOrg    OrgPolicyKey = "sys_prompt_org"
	PolicyAllowUserPrompt OrgPolicyKey = "allow_user_prompt"

	// Epic 53 — MCP server governance policies
	PolicyAllowUserMcpServers       OrgPolicyKey = "allow_user_mcp_servers"
	PolicyMaxMcpServersPerWorkspace OrgPolicyKey = "max_mcp_servers_per_workspace"

	// Image factory — org default workspace image (design/0046 launch hierarchy)
	PolicyDefaultRuntime OrgPolicyKey = "default_runtime"

	// Image factory — restrict which org/platform configs members can launch
	// (design/0047 D3). When non-empty, members can only launch workspaces
	// using org/platform configs whose hash is in this list. Member-scoped
	// configs are always exempt. Empty (default) = unrestricted.
	PolicyAllowedImageConfigs OrgPolicyKey = "allowed_image_configs"
)

type OrgPolicyValues 

type OrgPolicyValues struct {
	AllowedModels             *[]string `json:"allowedModels,omitempty"`
	AllowedProviders          *[]string `json:"allowedProviders,omitempty"`
	MaxWorkspacesPerMember    *int      `json:"maxWorkspacesPerMember,omitempty"`
	MaxActiveWorkspacesPerMem *int      `json:"maxActiveWorkspacesPerMember,omitempty"`

	// Agent customization
	SysPromptOrg    *string `json:"sysPromptOrg,omitempty"`
	AllowUserPrompt *bool   `json:"allowUserPrompt,omitempty"`

	// Epic 53 — MCP server governance
	AllowUserMcpServers       *bool `json:"allowUserMcpServers,omitempty"`
	MaxMcpServersPerWorkspace *int  `json:"maxMcpServersPerWorkspace,omitempty"`

	// Image factory — org default workspace image (design/0046)
	DefaultRuntime *string `json:"defaultRuntime,omitempty"`

	// Image factory — restrict which org/platform configs are launchable
	// (design/0047 D3). nil = unrestricted; non-empty = only listed hashes.
	AllowedImageConfigs *[]string `json:"allowedImageConfigs,omitempty"`
}

OrgPolicyValues is the typed view of all four Phase 2 policies for one org. Fields are pointers so nil means "not set / unrestricted"; the zero value of the dereferenced type is never confused with "unset".

func (*OrgPolicyValues) DefaultRuntimeImage added in v0.8.6 

func (p *OrgPolicyValues) DefaultRuntimeImage() string

DefaultRuntimeImage returns the org's default workspace image config hash, or "" when unset. Used by the workspace service's default-image hierarchy.

func (*OrgPolicyValues) IsModelAllowed 

func (p *OrgPolicyValues) IsModelAllowed(modelID string) bool

IsModelAllowed reports whether modelID is permitted under the allowed-models policy. Returns true when no policy is set (unrestricted).

func (*OrgPolicyValues) IsProviderAllowed 

func (p *OrgPolicyValues) IsProviderAllowed(providerID string) bool

IsProviderAllowed reports whether providerID is permitted.

func (*OrgPolicyValues) IsUserMcpAllowed added in v0.7.0 

func (p *OrgPolicyValues) IsUserMcpAllowed() bool

IsUserMcpAllowed reports whether org members can register their own MCP servers (user-scope). Defaults to false (locked) when no policy is set — mirroring IsUserPromptAllowed so a value the org admin must opt into is never silently granted by omission.

func (*OrgPolicyValues) IsUserPromptAllowed 

func (p *OrgPolicyValues) IsUserPromptAllowed() bool

IsUserPromptAllowed reports whether org members can customize their agent prompts. Defaults to false (locked) when no policy is set.

func (*OrgPolicyValues) MaxActive 

func (p *OrgPolicyValues) MaxActive() int

MaxActive returns the per-member concurrent active workspace limit, or -1.

func (*OrgPolicyValues) MaxMcpServers added in v0.7.0 

func (p *OrgPolicyValues) MaxMcpServers() int

MaxMcpServers returns the per-workspace MCP server quota, or the default (DefaultMaxMcpServersPerWorkspace) when unset.

func (*OrgPolicyValues) MaxWorkspaces 

func (p *OrgPolicyValues) MaxWorkspaces() int

MaxWorkspaces returns the per-member workspace creation limit, or -1 (unlimited) when unset.

func (*OrgPolicyValues) OrgPrompt 

func (p *OrgPolicyValues) OrgPrompt() string

OrgPrompt returns the org-level system prompt overlay, or "" when unset.

type OrgResponse 

type OrgResponse struct {
	Organization
	UserRole    OrgRole `json:"userRole,omitempty"`
	MemberCount int     `json:"memberCount"`
}

OrgResponse extends Organization with the calling user's membership context. UserRole is omitempty so that an empty string (caller is not a member — e.g. platform admin creating an org for someone else) is omitted from JSON rather than appearing as `"userRole": ""`.

type OrgRole 

type OrgRole string

OrgRole represents a user's role within an organization. 

const (
	OrgRoleAdmin  OrgRole = "admin"
	OrgRoleMember OrgRole = "member"
)

type OrgSSOConfig 

type OrgSSOConfig struct {
	OrgID             string             `json:"-"`
	DiscoveryURL      string             `json:"discoveryUrl"`
	ClientID          string             `json:"clientId"`
	ClientSecret      []byte             `json:"-"`
	ClaimedDomains    []string           `json:"claimedDomains"`
	VerifiedDomains   []string           `json:"verifiedDomains"`
	VerificationToken string             `json:"verificationToken"`
	AutoProvision     bool               `json:"autoProvision"`
	GroupRoleMapping  map[string]OrgRole `json:"groupRoleMapping"`
	CreatedAt         time.Time          `json:"createdAt"`
	UpdatedAt         time.Time          `json:"updatedAt"`
}

OrgSSOConfig is the per-org OIDC SSO configuration. ClientSecret is the encrypted blob stored in the DB; it is never serialized to JSON. VerifiedDomains is a subset of ClaimedDomains that have passed DNS verification (D17 Q-S2); only verified domains auto-route on the login page. VerificationToken is the per-org random token the org admin places as a TXT record at _llmsafespaces-verify.<domain> to prove ownership.

type OrgSSOConfigResponse 

type OrgSSOConfigResponse struct {
	OrgID             string             `json:"orgId"`
	DiscoveryURL      string             `json:"discoveryUrl"`
	ClientID          string             `json:"clientId"`
	HasSecret         bool               `json:"hasSecret"`
	ClaimedDomains    []string           `json:"claimedDomains"`
	VerifiedDomains   []string           `json:"verifiedDomains"`
	VerificationToken string             `json:"verificationToken"`
	AutoProvision     bool               `json:"autoProvision"`
	GroupRoleMapping  map[string]OrgRole `json:"groupRoleMapping"`
	UpdatedAt         time.Time          `json:"updatedAt"`
}

OrgSSOConfigResponse is the API response shape — omits the encrypted secret.

type OrgStatus 

type OrgStatus string

OrgStatus is the operational status of an organization. It gates access: only non-suspended orgs are usable via OrgMemberGuard/OrgAdminGuard. Both 'active' and 'pending_activation' allow access (the creator needs to reach the portal and Stripe checkout while pending); 'suspended' is fully locked. 

const (
	OrgStatusPendingActivation OrgStatus = "pending_activation"
	OrgStatusActive            OrgStatus = "active"
	OrgStatusSuspended         OrgStatus = "suspended"
)

type OrgSubscriptionStatus 

type OrgSubscriptionStatus string

OrgSubscriptionStatus tracks the Stripe subscription lifecycle separately from OrgStatus. An org can be status='active' (members retain access) while subscription_status='past_due' (in the 7-day Smart Retries grace window). 

const (
	SubscriptionInactive OrgSubscriptionStatus = "inactive"
	SubscriptionActive   OrgSubscriptionStatus = "active"
	SubscriptionTrialing OrgSubscriptionStatus = "trialing"
	SubscriptionPastDue  OrgSubscriptionStatus = "past_due"
	SubscriptionCanceled OrgSubscriptionStatus = "canceled"
	SubscriptionUnpaid   OrgSubscriptionStatus = "unpaid"
)

type OrgSummary 

type OrgSummary struct {
	Organization
	MemberCount    int `json:"memberCount"`
	WorkspaceCount int `json:"workspaceCount"`
}

OrgSummary extends Organization with aggregate counts for the platform admin dashboard. The counts are populated by a single SQL query (no N+1).

type Organization 

type Organization struct {
	ID                 string                `json:"id"`
	Name               string                `json:"name"`
	Slug               string                `json:"slug"`
	CreatedBy          string                `json:"createdBy"`
	CreatedAt          time.Time             `json:"createdAt"`
	UpdatedAt          time.Time             `json:"updatedAt"`
	Status             OrgStatus             `json:"status"`
	PlanID             OrgPlan               `json:"planId"`
	SubscriptionStatus OrgSubscriptionStatus `json:"subscriptionStatus"`
}

Organization is the API DTO for an organization.

type OwnerType 

type OwnerType string
const (
	OwnerTypeUser OwnerType = "user"
	OwnerTypeOrg  OwnerType = "org"
)

type PaginationMetadata 

type PaginationMetadata struct {
	// Total number of items
	Total int `json:"total"`

	// Start index
	Start int `json:"start"`

	// End index
	End int `json:"end"`

	// Limit per page
	Limit int `json:"limit"`

	// Offset
	Offset int `json:"offset"`
}

PaginationMetadata represents pagination metadata

type PasskeyBeginResponse added in v0.7.0 

type PasskeyBeginResponse struct {
	Options map[string]any `json:"options"`
}

PasskeyBeginResponse carries the WebAuthn challenge/options the browser feeds to navigator.credentials.create() (register) or .get() (login). The opaque PublicKeyCredentialCreation/Request JSON is forwarded verbatim from go-webauthn.

type PasskeyCredential added in v0.7.0 

type PasskeyCredential struct {
	ID             uuid.UUID  `json:"id"`
	UserID         string     `json:"-" db:"user_id"`
	CredentialID   []byte     `json:"-" db:"credential_id"`
	Name           string     `json:"name,omitempty" db:"name"`
	CreatedAt      time.Time  `json:"createdAt" db:"created_at"`
	LastUsedAt     *time.Time `json:"lastUsedAt,omitempty" db:"last_used_at"`
	AttestationFmt string     `json:"-" db:"attestation_format"`
	AAGUID         *uuid.UUID `json:"-" db:"aaguid"`
}

PasskeyCredential is the API transfer object for a stored WebAuthn credential (user_passkeys row). It is public material only — the private key never leaves the authenticator.

type PasskeyFinishRequest added in v0.7.0 

type PasskeyFinishRequest struct {
	// CredentialCreationResponse / CredentialAssertionResponse as produced by
	// the browser, parsed server-side by go-webauthn's protocol package. Kept as
	// raw JSON so the server never reshapes WebAuthn protocol fields.
	Response map[string]any `json:"response"`
	// Name is an optional friendly label for a newly-registered credential
	// ("YubiKey 5C", "iPhone Face ID"). Registration finish only.
	Name string `json:"name,omitempty"`
}

PasskeyFinishRequest carries the authenticator's attestation (register) or assertion (login) response, forwarded to go-webauthn for verification.

type PasskeyFinishResponse added in v0.7.0 

type PasskeyFinishResponse struct {
	Token         string   `json:"token"`
	User          User     `json:"user"`
	RecoveryCodes []string `json:"recoveryCodes,omitempty"`
}

PasskeyFinishResponse is returned after a successful ceremony. On register finish it returns the session token + recovery codes (one-time display). On login finish it returns the session token.

type PasskeyLoginBeginRequest added in v0.7.0 

type PasskeyLoginBeginRequest struct {
	Email string `json:"email" binding:"required,email"`
}

PasskeyLoginBeginRequest identifies the account for a username-first login ceremony. Discoverable-credential (no-username) login is a future enhancement; Phase 2 ships username-first to match Epic 54's login discovery.

type PasskeyRegisterBeginRequest added in v0.7.0 

type PasskeyRegisterBeginRequest struct {
	// Email identifies the account being created/logged-in (Phase 2 default
	// signup is passkey; email is still required to bind the credential). For an
	// existing user adding a second passkey, the session already identifies them.
	Email string `json:"email" binding:"required,email"`
	Name  string `json:"name,omitempty"`
}

PasskeyRegisterBeginRequest initiates a WebAuthn registration ceremony.

type PermissionRule 

type PermissionRule struct {
	Action   string `json:"action"`
	Resource string `json:"resource"`
	Effect   string `json:"effect"`
}

PermissionRule is one tool-permission rule in a role config.

type PlatformSetting 

type PlatformSetting struct {
	Key       string          `json:"key"`
	Value     json.RawMessage `json:"value"`
	UpdatedBy string          `json:"-"`
	UpdatedAt time.Time       `json:"updatedAt"`
}

PlatformSetting is one row of platform_settings. Used for platform-wide mutable configuration like the base system prompt. Key is a stable identifier; Value is the raw JSONB payload.

type PlatformSettingKey 

type PlatformSettingKey string

PlatformSettingKey identifies a single platform-wide setting. 

const (
	SettingSysPromptPlatform PlatformSettingKey = "sys_prompt_platform"
)

type PortRule 

type PortRule struct {
	// Port number
	Port int `json:"port"`

	// Protocol (TCP or UDP)
	Protocol string `json:"protocol,omitempty"`
}

PortRule defines a port rule

type ProfileReference 

type ProfileReference struct {
	// Name of RuntimeEnvironment to use
	Name string `json:"name"`

	// Namespace of RuntimeEnvironment
	Namespace string `json:"namespace,omitempty"`
}

ProfileReference defines a reference to a RuntimeEnvironment

type QuotaStatus 

type QuotaStatus struct {
	EventType  string    `json:"eventType"`
	PeriodType string    `json:"periodType"`
	Limit      int64     `json:"limit"`
	Used       int64     `json:"used"`
	Remaining  int64     `json:"remaining"`
	ResetsAt   time.Time `json:"resetsAt"`
}

type RefreshWorkspaceResult 

type RefreshWorkspaceResult struct {
	RestartGeneration int64 `json:"restartGeneration"`
}

RefreshWorkspaceResult is returned by POST /workspaces/:id/refresh-compute. It reports the restartGeneration that will trigger a pod rebuild, which re-resolves the runtime image to its latest version and applies the refreshed resource requests.

type RegisterRequest 

type RegisterRequest struct {
	Username string `json:"username" binding:"required,min=3,max=64"`
	Email    string `json:"email" binding:"required,email"`
	Password string `json:"password" binding:"required,min=8,max=128"`
}

RegisterRequest is the request body for user registration.

type ResourceRequirements 

type ResourceRequirements struct {
	// CPU resource limit
	CPU string `json:"cpu,omitempty"`

	// Memory resource limit
	Memory string `json:"memory,omitempty"`

	// GPU resource limit
	GPU string `json:"gpu,omitempty"`
}

ResourceRequirements defines resource limits for a sandbox

type ResourceStatus 

type ResourceStatus struct {
	// Current CPU usage
	CPUUsage string `json:"cpuUsage,omitempty"`

	// Current memory usage
	MemoryUsage string `json:"memoryUsage,omitempty"`
}

ResourceStatus defines resource usage

type RoleConfig 

type RoleConfig struct {
	Version     int              `json:"version"`
	System      *string          `json:"system,omitempty"`
	Description *string          `json:"description,omitempty"`
	Color       *string          `json:"color,omitempty"`
	Model       *string          `json:"model,omitempty"`
	Mode        *string          `json:"mode,omitempty"`
	Hidden      *bool            `json:"hidden,omitempty"`
	Permissions []PermissionRule `json:"permissions,omitempty"`
	Tools       json.RawMessage  `json:"tools,omitempty"`
	MCP         json.RawMessage  `json:"mcp,omitempty"`
	Raw         map[string]any   `json:"-"`
}

RoleConfig is the strongly-typed view of a role's JSONB config. Fields are pointers so nil = inherit from parent (during merge).

func MergeRoleConfigs 

func MergeRoleConfigs(parent, child *RoleConfig) *RoleConfig

MergeRoleConfigs merges a parent config with a child config. Child values override parent values for scalar fields; permissions are concatenated (child appended after parent); Raw keys from both are merged (child wins).

func UnmarshalRoleConfig 

func UnmarshalRoleConfig(data []byte) (*RoleConfig, error)

UnmarshalRoleConfig decodes a JSONB config blob into a RoleConfig, preserving unknown keys in the Raw map for forward compatibility. (Stress test 3.4: Go's default unmarshaler would silently drop unknown keys.)

type RunScriptTargetConfig added in v0.8.11 

type RunScriptTargetConfig struct {
	WorkspaceID string            `json:"workspaceId"`
	Path        string            `json:"path"`
	Args        []string          `json:"args,omitempty"`
	Env         map[string]string `json:"env,omitempty"`
}

RunScriptTargetConfig is the typed shape of triggers.target_config for run_script.

type RunWorkflowTargetConfig added in v0.8.11 

type RunWorkflowTargetConfig struct {
	WorkflowID    string            `json:"workflowId"`
	InputTemplate map[string]string `json:"inputTemplate,omitempty"`
}

RunWorkflowTargetConfig is the typed shape of triggers.target_config for run_workflow. input_template is a text/template map rendered against the trigger envelope at fire time.

type SSODomain 

type SSODomain struct {
	Domain  string `json:"domain"`
	OrgSlug string `json:"orgSlug"`
	OrgName string `json:"orgName"`
}

SSODomain is a single entry in the domain discovery response.

type SecurityContext 

type SecurityContext struct {
	// User ID to run container processes
	RunAsUser int64 `json:"runAsUser,omitempty"`

	// Group ID to run container processes
	RunAsGroup int64 `json:"runAsGroup,omitempty"`

	// Seccomp profile
	SeccompProfile string `json:"seccompProfile,omitempty"`

	// AppArmor profile
	AppArmorProfile string `json:"appArmorProfile,omitempty"`

	// Allow privilege escalation
	AllowPrivilegeEscalation bool `json:"allowPrivilegeEscalation,omitempty"`
}

SecurityContext defines security context

type Session 

type Session struct {
	// Session ID
	ID string

	// User ID
	UserID string

	// Workspace ID
	WorkspaceID string

	// WebSocket connection
	Conn WSConnection

	// Creation time
	CreatedAt time.Time
}

Session represents a WebSocket session

type SessionListItem 

type SessionListItem struct {
	ID            string     `json:"id"`
	Title         string     `json:"title,omitempty"`
	ParentID      string     `json:"parentId,omitempty"`
	LastMessageAt *time.Time `json:"lastMessageAt,omitempty"`
	MessageCount  int        `json:"messageCount"`
	Status        string     `json:"status"` // "active" | "idle"
	LastSeenAt    *time.Time `json:"lastSeenAt,omitempty"`
	HasUnread     bool       `json:"hasUnread"`
	ContextUsed   *int64     `json:"contextUsed,omitempty"`
}

SessionListItem is sidebar metadata for a session (NOT message bodies).

ParentID, when non-empty, is the session_id of the user-visible parent session — typically populated for opencode subagent (subtask) sessions spawned via the `task` tool. The sidebar nests children under their parent for navigation. NULL/empty means the session is top-level.

ContextUsed, when non-nil, is the prompt token count from the last session.next.step.ended SSE event persisted by the API proxy. nil means no LLM step has completed yet for this session (distinguishable from 0).

type SessionStatusItem 

type SessionStatusItem struct {
	ID          string `json:"id"`
	Title       string `json:"title,omitempty"`
	Status      string `json:"status"`
	ContextUsed int64  `json:"contextUsed"`
}

SessionStatusItem describes a session reported by the workspace agent.

type StorageConfig 

type StorageConfig struct {
	// Enable persistent storage
	Persistent bool `json:"persistent,omitempty"`

	// Size of persistent volume
	VolumeSize string `json:"volumeSize,omitempty"`
}

StorageConfig defines storage configuration

type TriggerFireResponse added in v0.8.11 

type TriggerFireResponse struct {
	ID            string          `json:"id"`
	TriggerID     string          `json:"triggerId"`
	SourceType    string          `json:"sourceType"`
	InputEnvelope json.RawMessage `json:"inputEnvelope,omitempty"`
	ActionType    string          `json:"actionType"`
	ActionResult  json.RawMessage `json:"actionResult,omitempty"`
	Status        string          `json:"status"`
	FiredAt       time.Time       `json:"firedAt"`
	CompletedAt   *time.Time      `json:"completedAt,omitempty"`
}

TriggerFireResponse is the API response shape for a trigger fire audit row. input_envelope is the raw source payload (webhook body + headers; cron template render).

type TriggerResponse added in v0.8.11 

type TriggerResponse struct {
	ID                  string          `json:"id"`
	OwnerType           string          `json:"ownerType"`
	OwnerID             string          `json:"ownerId,omitempty"`
	Name                string          `json:"name"`
	Description         string          `json:"description,omitempty"`
	Enabled             bool            `json:"enabled"`
	SourceType          string          `json:"sourceType"`
	SourceConfig        json.RawMessage `json:"sourceConfig"`
	TargetType          string          `json:"targetType"`
	TargetConfig        json.RawMessage `json:"targetConfig"`
	ConsecutiveFailures int             `json:"consecutiveFailures"`
	AutoDisableAfter    int             `json:"autoDisableAfter"`
	LastFiredAt         *time.Time      `json:"lastFiredAt,omitempty"`
	NextFireAt          *time.Time      `json:"nextFireAt,omitempty"`
	CreatedAt           time.Time       `json:"createdAt"`
	UpdatedAt           time.Time       `json:"updatedAt"`
}

TriggerResponse is the API response shape for a trigger. source_config and target_config are typed JSON blobs (validated by the handler). next_fire_at is computed by the scheduler for cron triggers.

type UpdateMCPServerRequest added in v0.7.0 

type UpdateMCPServerRequest struct {
	Name      *string            `json:"name,omitempty"`
	URL       *string            `json:"url,omitempty"`
	Command   *string            `json:"command,omitempty"`
	Args      []string           `json:"args,omitempty"`
	TimeoutMs *int               `json:"timeoutMs,omitempty"`
	Enabled   *bool              `json:"enabled,omitempty"`
	Env       *map[string]string `json:"env,omitempty"`
	Headers   *map[string]string `json:"headers,omitempty"`
}

UpdateMCPServerRequest supports partial update. Pointer fields: nil means "keep existing"; a non-nil value replaces it (an empty string clears url/command, an empty map clears env/headers). Mirrors the OrgSSO partial-update discipline.

type UpdateOrgRequest 

type UpdateOrgRequest struct {
	Name string `json:"name" binding:"omitempty,min=2,max=100"`
	Slug string `json:"slug" binding:"omitempty,min=2,max=50,slug"`
}

UpdateOrgRequest is the request body for updating an organization.

type UpdateTriggerRequest added in v0.8.11 

type UpdateTriggerRequest struct {
	Name             *string         `json:"name,omitempty"`
	Description      *string         `json:"description,omitempty"`
	Enabled          *bool           `json:"enabled,omitempty"`
	SourceConfig     json.RawMessage `json:"sourceConfig,omitempty"`
	TargetType       *string         `json:"targetType,omitempty"`
	TargetConfig     json.RawMessage `json:"targetConfig,omitempty"`
	AutoDisableAfter *int            `json:"autoDisableAfter,omitempty"`
}

UpdateTriggerRequest supports partial update. Pointer fields: nil = "keep existing". source_type is NOT mutable after create (the source defines the trigger's identity). auto_disable_after must be >= 1 (validated at handler).

type UpdateWorkflowRequest added in v0.8.11 

type UpdateWorkflowRequest struct {
	Name              *string         `json:"name,omitempty"`
	Slug              *string         `json:"slug,omitempty"`
	Description       *string         `json:"description,omitempty"`
	SpecYAML          *string         `json:"specYaml,omitempty"`
	InputSchema       json.RawMessage `json:"inputSchema,omitempty"`
	TargetWorkspaceID *string         `json:"targetWorkspaceId,omitempty"`
	Status            *string         `json:"status,omitempty"`
	Defaults          json.RawMessage `json:"defaults,omitempty"`
}

UpdateWorkflowRequest supports partial update. Pointer fields: nil = "keep existing". A non-nil value replaces it. status transitions (draft→active→archived) are validated in the service layer. Updating spec_yaml creates a new spec_snapshot baseline; in-flight runs are pinned to the snapshot at their start (D6).

type UpsertSSOConfigRequest 

type UpsertSSOConfigRequest struct {
	DiscoveryURL     string             `json:"discoveryUrl"     binding:"required,url"`
	ClientID         string             `json:"clientId"         binding:"required,min=1"`
	ClientSecret     string             `json:"clientSecret"     binding:"omitempty"`
	ClaimedDomains   []string           `json:"claimedDomains"`
	AutoProvision    *bool              `json:"autoProvision"`
	GroupRoleMapping map[string]OrgRole `json:"groupRoleMapping"`
}

UpsertSSOConfigRequest is the API request body for creating/updating SSO config.

type UsageEvent 

type UsageEvent struct {
	IdempotencyKey string         `json:"idempotencyKey,omitempty"`
	Owner          BillingOwner   `json:"owner"`
	ActorID        string         `json:"actorId"`
	WorkspaceID    string         `json:"workspaceId,omitempty"`
	EventType      string         `json:"eventType"`
	EventSubtype   string         `json:"eventSubtype,omitempty"`
	Quantity       int64          `json:"quantity"`
	ResourceTier   string         `json:"resourceTier,omitempty"`
	Region         string         `json:"region,omitempty"`
	Metadata       map[string]any `json:"metadata,omitempty"`
	RequestContext map[string]any `json:"requestContext,omitempty"`
	Source         string         `json:"source"`
	EventTime      time.Time      `json:"eventTime"`
}

type UsageReport 

type UsageReport struct {
	OwnerID     string                      `json:"ownerId"`
	OwnerType   OwnerType                   `json:"ownerType"`
	PeriodFrom  time.Time                   `json:"periodFrom"`
	PeriodTo    time.Time                   `json:"periodTo"`
	Totals      map[string]int64            `json:"totals"`
	ByWorkspace map[string]map[string]int64 `json:"byWorkspace,omitempty"`
	ByDay       map[string]map[string]int64 `json:"byDay,omitempty"`
}

type User 

type User struct {
	ID            string     `json:"id" db:"id"`
	Username      string     `json:"username" db:"username"`
	Email         string     `json:"email" db:"email"`
	PasswordHash  string     `json:"-" db:"password_hash"`
	DEKSource     DEKSource  `json:"-" db:"dek_source"`
	CreatedAt     time.Time  `json:"createdAt" db:"created_at"`
	UpdatedAt     time.Time  `json:"updatedAt" db:"updated_at"`
	Active        bool       `json:"active" db:"active"`
	Role          string     `json:"role" db:"role"`
	Status        UserStatus `json:"status" db:"status"`
	EmailVerified bool       `json:"emailVerified" db:"email_verified"`
}

User represents a user

type UserListEntry 

type UserListEntry struct {
	ID        string     `json:"id"`
	Email     string     `json:"email"`
	Role      string     `json:"role"`
	Status    UserStatus `json:"status"`
	CreatedAt time.Time  `json:"createdAt"`
	OrgCount  int        `json:"orgCount"`
	OrgID     string     `json:"orgId,omitempty"`
	OrgName   string     `json:"orgName,omitempty"`
}

UserListEntry is the list DTO for platform admin user listing.

type UserStatus 

type UserStatus string

UserStatus is the authoritative operational status of a user account. 

const (
	UserStatusActive    UserStatus = "active"
	UserStatusSuspended UserStatus = "suspended"
)

type UserUpdates 

type UserUpdates struct {
	Username      *string     `json:"username,omitempty"`
	Email         *string     `json:"email,omitempty"`
	Active        *bool       `json:"active,omitempty"`
	Role          *string     `json:"role,omitempty"`
	Status        *UserStatus `json:"status,omitempty"`
	PasswordHash  *string     `json:"-"`
	EmailVerified *bool       `json:"-"`
	DEKSource     *DEKSource  `json:"-"`
}

UserUpdates carries the fields that may be changed on a User record. All fields are pointers — nil means "do not update this field".

type WSConnection 

type WSConnection interface {
	// ReadMessage reads a message from the connection
	ReadMessage() (messageType int, p []byte, err error)

	// WriteMessage writes a message to the connection
	WriteMessage(messageType int, data []byte) error

	// Close closes the connection
	Close() error
}

WSConnection represents a WebSocket connection

type WebhookSourceConfig added in v0.8.11 

type WebhookSourceConfig struct {
	WebhookID string `json:"webhookId"`
}

WebhookSourceConfig is the typed shape of triggers.source_config for webhook sources. WebhookID references the webhooks row carrying the HMAC secret + IP allowlist.

type WorkflowNodeRunResponse added in v0.8.11 

type WorkflowNodeRunResponse struct {
	ID            string          `json:"id"`
	WorkflowRunID string          `json:"workflowRunId"`
	NodeID        string          `json:"nodeId"`
	NodeType      string          `json:"nodeType"`
	Status        string          `json:"status"`
	Attempt       int             `json:"attempt"`
	Input         json.RawMessage `json:"input,omitempty"`
	Output        json.RawMessage `json:"output,omitempty"`
	Branch        string          `json:"branch,omitempty"`
	ErrorCode     string          `json:"errorCode,omitempty"`
	Error         json.RawMessage `json:"error,omitempty"`
	StartedAt     time.Time       `json:"startedAt"`
	FinishedAt    *time.Time      `json:"finishedAt,omitempty"`
}

WorkflowNodeRunResponse is the per-node state within a run. node_id matches spec_snapshot.nodes[].id (NOT the current spec — pinned).

type WorkflowResponse added in v0.8.11 

type WorkflowResponse struct {
	ID                string          `json:"id"`
	OwnerType         string          `json:"ownerType"`
	OwnerID           string          `json:"ownerId,omitempty"`
	Name              string          `json:"name"`
	Slug              string          `json:"slug"`
	Description       string          `json:"description,omitempty"`
	SpecYAML          string          `json:"specYaml"`
	InputSchema       json.RawMessage `json:"inputSchema,omitempty"`
	TargetWorkspaceID string          `json:"targetWorkspaceId,omitempty"`
	Status            string          `json:"status"`
	Defaults          json.RawMessage `json:"defaults,omitempty"`
	CreatedAt         time.Time       `json:"createdAt"`
	UpdatedAt         time.Time       `json:"updatedAt"`
}

WorkflowResponse is the API response shape for a workflow definition. spec_yaml is the author's input; spec_json is the parsed DAG (denormalized for execution). target_workspace_id is nullable (null = caller picks at run time).

type WorkflowRunResponse added in v0.8.11 

type WorkflowRunResponse struct {
	ID            string          `json:"id"`
	WorkflowID    string          `json:"workflowId"`
	SpecSnapshot  json.RawMessage `json:"specSnapshot"`
	Input         json.RawMessage `json:"input,omitempty"`
	Output        json.RawMessage `json:"output,omitempty"`
	Status        string          `json:"status"`
	ErrorCode     string          `json:"errorCode,omitempty"`
	Error         json.RawMessage `json:"error,omitempty"`
	TriggerID     string          `json:"triggerId,omitempty"`
	TriggerFireID string          `json:"triggerFireId,omitempty"`
	WorkspaceID   string          `json:"workspaceId"`
	StartedAt     *time.Time      `json:"startedAt,omitempty"`
	FinishedAt    *time.Time      `json:"finishedAt,omitempty"`
	CreatedAt     time.Time       `json:"createdAt"`
	UpdatedAt     time.Time       `json:"updatedAt"`
}

WorkflowRunResponse is the API response shape for a workflow run. spec_snapshot is the immutable DAG pinned at run start. error_code is null on success.

type Workspace 

type Workspace struct {
	ID                      string            `json:"id"`
	Name                    string            `json:"name"`
	UserID                  string            `json:"userId"`
	Runtime                 string            `json:"runtime"`
	StorageSize             string            `json:"storageSize"`
	Phase                   string            `json:"phase"`
	PVCName                 string            `json:"pvcName,omitempty"`
	Labels                  map[string]string `json:"labels,omitempty"`
	DefaultModel            string            `json:"defaultModel,omitempty"`
	CreatedAt               time.Time         `json:"createdAt"`
	UpdatedAt               time.Time         `json:"updatedAt"`
	AgentNeedsRefresh       bool              `json:"agentNeedsRefresh"`
	CredentialsPendingSince *time.Time        `json:"credentialsPendingSince,omitempty"`
}

Workspace is the API transfer object for a workspace resource.

type WorkspaceConditionResult 

type WorkspaceConditionResult struct {
	Type    string `json:"type"`
	Status  string `json:"status"`
	Reason  string `json:"reason,omitempty"`
	Message string `json:"message,omitempty"`
}

WorkspaceConditionResult carries a single workspace condition.

type WorkspaceConfig 

type WorkspaceConfig struct {
	DefaultModel string `json:"defaultModel,omitempty"`
}

WorkspaceConfig is non-sensitive workspace metadata (default model) delivered to the pod via the bootstrap HTTP endpoint at boot.

type WorkspaceListItem 

type WorkspaceListItem struct {
	ID                      string     `json:"id"`
	Name                    string     `json:"name"`
	UserID                  string     `json:"userId"`
	Runtime                 string     `json:"runtime"`
	StorageSize             string     `json:"storageSize"`
	Phase                   string     `json:"phase,omitempty"`
	ImageTag                string     `json:"imageTag,omitempty"`
	AgentVersion            string     `json:"agentVersion,omitempty"`
	DefaultModel            string     `json:"defaultModel,omitempty"`
	MaxActiveSessions       int        `json:"maxActiveSessions,omitempty"`
	CreatedAt               time.Time  `json:"createdAt"`
	UpdatedAt               time.Time  `json:"updatedAt"`
	AgentNeedsRefresh       bool       `json:"agentNeedsRefresh"`
	CredentialsPendingSince *time.Time `json:"credentialsPendingSince,omitempty"`
	// OrgID is the owning org for org-scoped workspaces (Epic 11; nil for
	// personal workspaces). The frontend relies on this field to decide
	// whether to fetch and enforce the org's allow_user_prompt policy in
	// the Workspace Settings drawer's "Custom Instructions" Lock UI.
	// Mirrors WorkspaceMetadata.OrgID.
	OrgID *string `json:"orgId,omitempty"`
}

WorkspaceListItem is a lightweight workspace representation for list responses.

type WorkspaceListResult 

type WorkspaceListResult struct {
	Items      []WorkspaceListItem `json:"items"`
	Pagination *PaginationMetadata `json:"pagination,omitempty"`
}

WorkspaceListResult bundles workspace list items with pagination.

type WorkspaceMetadata 

type WorkspaceMetadata struct {
	ID           string    `json:"id" db:"id"`
	UserID       string    `json:"userId" db:"user_id"`
	Name         string    `json:"name" db:"name"`
	Runtime      string    `json:"runtime" db:"runtime"`
	StorageSize  string    `json:"storageSize" db:"storage_size"`
	ImageTag     string    `json:"imageTag" db:"image_tag"`
	AgentVersion string    `json:"agentVersion" db:"agent_version"`
	CreatedAt    time.Time `json:"createdAt" db:"created_at"`
	UpdatedAt    time.Time `json:"updatedAt" db:"updated_at"`
	// Model selection (migration 000013)
	DefaultModel string `json:"defaultModel,omitempty" db:"default_model"`
	// Epic 27a: agent credential state (LEFT JOIN workspace_agent_state)
	AgentNeedsRefresh       bool       `json:"agentNeedsRefresh" db:"agent_needs_refresh"`
	CredentialsPendingSince *time.Time `json:"credentialsPendingSince,omitempty" db:"credentials_pending_since"`
	// Epic 11: org attribution (nullable — personal workspaces have no org)
	OrgID *string `json:"orgId,omitempty" db:"org_id"`
}

WorkspaceMetadata is the database record for a workspace.

Phase and pvc_state used to live here as a denormalised cache of the Workspace CRD's status fields. The cache was removed in migration 9 because it was eventually-consistent at best (best-effort writes from `syncPhase`) and routinely diverged from the CRD shortly after creation, which caused the sidebar to render new workspaces with no phase. The CRD is now the only source of truth; phase is fetched directly from the kube-apiserver in `ListWorkspaces` and `enforceMaxActiveWorkspaces`.

func WorkspaceMetaFromCtx 

func WorkspaceMetaFromCtx(ctx context.Context) (*WorkspaceMetadata, bool)

WorkspaceMetaFromCtx returns the *WorkspaceMetadata stored in ctx by WorkspaceAccessMiddleware, or (nil, false) when the middleware did not run (e.g. the caller is a background job, a route outside idGroup, or a unit test). Callers that need to authorize MUST handle the (nil, false) case explicitly — a missing meta is NOT an implicit allow.

type WorkspaceNotFoundError 

type WorkspaceNotFoundError struct {
	ID string
}

WorkspaceNotFoundError is returned when a workspace cannot be found.

func (*WorkspaceNotFoundError) Error 

func (e *WorkspaceNotFoundError) Error() string

type WorkspacePrompt 

type WorkspacePrompt struct {
	WorkspaceID string    `json:"-"`
	Prompt      string    `json:"prompt"`
	AgentRoleID *string   `json:"agentRoleId,omitempty"`
	UpdatedBy   string    `json:"-"`
	UpdatedAt   time.Time `json:"updatedAt"`
}

WorkspacePrompt holds the user-level agent customization for a workspace. This is only consulted when the org's allow_user_prompt policy is true.

type WorkspaceStatusResult 

type WorkspaceStatusResult struct {
	Phase            string                     `json:"phase"`
	PVCName          string                     `json:"pvcName,omitempty"`
	ActiveSessions   int                        `json:"activeSessions"`
	LastActivityAt   *time.Time                 `json:"lastActivityAt,omitempty"`
	Message          string                     `json:"message,omitempty"`
	Conditions       []WorkspaceConditionResult `json:"conditions,omitempty"`
	CredentialState  CredentialStateResult      `json:"credentialState"`
	AgentHealth      AgentHealthResult          `json:"agentHealth"`
	Sessions         []SessionStatusItem        `json:"sessions,omitempty"`
	ImageTag         string                     `json:"imageTag,omitempty"`
	DiskUsedBytes    int64                      `json:"diskUsedBytes,omitempty"`
	DiskTotalBytes   int64                      `json:"diskTotalBytes,omitempty"`
	MemoryUsedBytes  int64                      `json:"memoryUsedBytes,omitempty"`
	MemoryTotalBytes int64                      `json:"memoryTotalBytes,omitempty"`
	ContextUsed      int64                      `json:"contextUsed"`
	ContextTotal     int64                      `json:"contextTotal"`
}

WorkspaceStatusResult carries the status fields read from the Workspace CRD.

type WorkspaceUpdates 

type WorkspaceUpdates struct {
	Name         *string `json:"name,omitempty"`
	DefaultModel *string `json:"defaultModel,omitempty"`
}

WorkspaceUpdates carries the fields that may be changed on a WorkspaceMetadata record.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.