openapi

type Agent struct {
	// BootstrapState Enrollment lifecycle state of the agents row: "pending"
	// (provisioned, awaiting first enrollment), "expired" (bootstrap
	// token lapsed before enrollment) or "active" (enrolled). Empty for
	// legacy inbound rows. Meaningful for the UI only while the node has
	// never connected — a half-added node renders as pending/expired
	// instead of offline (R9a).
	BootstrapState *string `json:"bootstrap_state,omitempty"`

	// CertExpiresAt Expiry timestamp of the agent's current certificate.
	CertExpiresAt *time.Time `json:"cert_expires_at,omitempty"`

	// CertIssuedAt Issuance timestamp of the agent's current certificate.
	CertIssuedAt *time.Time `json:"cert_issued_at,omitempty"`

	// CertificateRecovery Optional snapshot of any active certificate-recovery grant
	// for the agent. Absent when no grant has been issued.
	CertificateRecovery *AgentCertificateRecoveryGrant `json:"certificate_recovery,omitempty"`

	// DialTransportMode Persisted transport mode of the agents row — "inbound" (agent
	// dials the panel) or "outbound" (panel dials the agent). Distinct
	// from runtime.transport_mode (Telemt classic/middle_proxy).
	DialTransportMode *string `json:"dial_transport_mode,omitempty"`

	// FleetGroupId UUID of the fleet group the agent belongs to.
	FleetGroupId string `json:"fleet_group_id"`

	// Id Agent UUID.
	Id string `json:"id"`

	// LastSeenAt Last successful heartbeat timestamp.
	LastSeenAt time.Time `json:"last_seen_at"`

	// NodeName Operator-facing display name.
	NodeName string `json:"node_name"`

	// PresenceState Live presence evaluation — `online`, `flapping`, `offline`, etc.
	// Computed at request time from session + heartbeat data.
	PresenceState string `json:"presence_state"`

	// ReadOnly True when the agent serves read-only Telemt instances.
	ReadOnly bool `json:"read_only"`

	// Runtime Telemt operator overview reported by the agent. The set of
	// fields is defensive on the Zod side because backends can ship
	// new counters without an immediate web release; on the spec
	// side we list every field the panel currently consumes.
	Runtime AgentRuntime `json:"runtime"`

	// TelemtUpdateProbe Whether (and how) this node's telemt install can be updated
	// in place: which process supervisor fronts it, and — when no
	// in-place path exists — why. Cached by the agent once at
	// process startup and stamped on every snapshot; absent until
	// the agent has sent at least one such snapshot (older agents
	// that predate the probe never populate it).
	TelemtUpdateProbe *TelemtUpdateProbe `json:"telemt_update_probe,omitempty"`

	// TransportDrift True when the direction of the last accepted stream disagreed with
	// dial_transport_mode — the agent is still dialing IN while the DB
	// says outbound, or vice versa (R-4). The panel re-enqueues the
	// switch job to converge; cleared once a session connects in the
	// direction the DB expects.
	TransportDrift *bool `json:"transport_drift,omitempty"`

	// TransportReconnectPending True when the agent was switched to outbound transport but the
	// panel has not accepted a session from/to it since the switch
	// ("switched but never reconnected"). Cleared on the next accepted
	// agent stream.
	TransportReconnectPending *bool `json:"transport_reconnect_pending,omitempty"`

	// Version Agent binary semver as last reported.
	Version string `json:"version"`
}

type AgentCertificateRecoveryGrant struct {
	AgentId       string                              `json:"agent_id"`
	ExpiresAtUnix int64                               `json:"expires_at_unix"`
	IssuedAtUnix  int64                               `json:"issued_at_unix"`
	RevokedAtUnix *int64                              `json:"revoked_at_unix,omitempty"`
	Status        AgentCertificateRecoveryGrantStatus `json:"status"`
	UsedAtUnix    *int64                              `json:"used_at_unix,omitempty"`
}

type AgentCertificateRecoveryGrantStatus string

type AgentConfigResponse struct {
	Desired map[string]interface{} `json:"desired"`

	// Drift Drift summary attached to a config GET response. `fields` lists
	// the dotted paths that drift; it is empty unless `status` is
	// `drifted`.
	Drift      ConfigDrift            `json:"drift"`
	Effective  map[string]interface{} `json:"effective"`
	GroupPaths []string               `json:"group_paths"`
	Observed   map[string]interface{} `json:"observed"`
}

type AgentList = []Agent

type AgentRuntime struct {
	AcceptingNewConnections bool  `json:"accepting_new_connections"`
	ActiveUsers             int   `json:"active_users"`
	ConfiguredUsers         int   `json:"configured_users"`
	ConnectAttemptTotal     int64 `json:"connect_attempt_total"`
	ConnectFailTotal        int64 `json:"connect_fail_total"`
	ConnectFailfastTotal    int64 `json:"connect_failfast_total"`
	ConnectSuccessTotal     int64 `json:"connect_success_total"`

	// ConnectionsBadByClass Per-class breakdown of bad connections (Telemt 3.4.10+). The
	// class set is open-ended. Backend emits `null` (not `[]`) when
	// no breakdown has been observed yet — absence means "unknown".
	ConnectionsBadByClass    *[]ConnectionClassCount `json:"connections_bad_by_class,omitempty"`
	ConnectionsBadTotal      int64                   `json:"connections_bad_total"`
	ConnectionsTotal         int64                   `json:"connections_total"`
	CurrentConnections       int                     `json:"current_connections"`
	CurrentConnectionsDirect int                     `json:"current_connections_direct"`
	CurrentConnectionsMe     int                     `json:"current_connections_me"`
	DcCoveragePct            float64                 `json:"dc_coverage_pct"`
	Dcs                      []RuntimeDC             `json:"dcs"`
	Degraded                 bool                    `json:"degraded"`
	DirectUpstreams          *int                    `json:"direct_upstreams,omitempty"`
	FailRateKnown            bool                    `json:"fail_rate_known"`

	// FailRatePct5m 5-minute upstream connect fail-rate. Read together with
	// `fail_rate_known`: `false` means "unknown", not "0%".
	FailRatePct5m float64 `json:"fail_rate_pct_5m"`

	// FallbackEnteredAtUnix Unix timestamp the panel observed this agent enter
	// ME→DC fallback. Absent when not in fallback.
	FallbackEnteredAtUnix *int64 `json:"fallback_entered_at_unix,omitempty"`

	// HandshakeFailuresByClass Per-class breakdown of handshake failures (Telemt 3.4.10+).
	// Same null-vs-empty semantics as connections_bad_by_class.
	HandshakeFailuresByClass   *[]ConnectionClassCount    `json:"handshake_failures_by_class,omitempty"`
	HandshakeTimeoutsTotal     int64                      `json:"handshake_timeouts_total"`
	HealthyUpstreams           int                        `json:"healthy_upstreams"`
	InitializationProgressPct  float64                    `json:"initialization_progress_pct"`
	InitializationStage        string                     `json:"initialization_stage"`
	InitializationStatus       string                     `json:"initialization_status"`
	LifecycleState             *string                    `json:"lifecycle_state,omitempty"`
	Me2dcFallbackEnabled       bool                       `json:"me2dc_fallback_enabled"`
	Me2dcFastEnabled           *bool                      `json:"me2dc_fast_enabled,omitempty"`
	MeRuntimeReady             bool                       `json:"me_runtime_ready"`
	MeWritersSummary           *RuntimeMeWritersSummary   `json:"me_writers_summary,omitempty"`
	RecentEvents               []RuntimeEvent             `json:"recent_events"`
	RerouteActive              *bool                      `json:"reroute_active,omitempty"`
	RouteMode                  *string                    `json:"route_mode,omitempty"`
	ShadowsocksUpstreams       *int                       `json:"shadowsocks_upstreams,omitempty"`
	Socks4Upstreams            *int                       `json:"socks4_upstreams,omitempty"`
	Socks5Upstreams            *int                       `json:"socks5_upstreams,omitempty"`
	StaleCacheUsed             *bool                      `json:"stale_cache_used,omitempty"`
	StartupProgressPct         float64                    `json:"startup_progress_pct"`
	StartupStage               string                     `json:"startup_stage"`
	StartupStatus              string                     `json:"startup_status"`
	SystemLoad                 RuntimeSystemLoad          `json:"system_load"`
	TelemtUnreachable          bool                       `json:"telemt_unreachable"`
	TelemtUnreachableSinceUnix int64                      `json:"telemt_unreachable_since_unix"`
	TopByConnections           *[]RuntimeTopByConnections `json:"top_by_connections,omitempty"`
	TopByThroughput            *[]RuntimeTopByThroughput  `json:"top_by_throughput,omitempty"`
	TotalUpstreams             int                        `json:"total_upstreams"`
	TransportMode              string                     `json:"transport_mode"`
	UnhealthyUpstreams         *int                       `json:"unhealthy_upstreams,omitempty"`
	UpdatedAt                  time.Time                  `json:"updated_at"`
	Upstreams                  []RuntimeUpstream          `json:"upstreams"`
	UptimeSeconds              float64                    `json:"uptime_seconds"`
	UseMiddleProxy             bool                       `json:"use_middle_proxy"`
	UserTelemetrySuppressed    bool                       `json:"user_telemetry_suppressed"`
}

type ApplyAccepted struct {
	BatchId string `json:"batch_id"`
}

type ApplyAgentConfig202JSONResponse ApplyAccepted

type ApplyAgentConfig400JSONResponse struct{ BadRequestJSONResponse }

type ApplyAgentConfig401JSONResponse struct{ UnauthorizedJSONResponse }

type ApplyAgentConfig404JSONResponse struct{ NotFoundJSONResponse }

type ApplyAgentConfigJSONBody struct {
	// Paths Optional dotted config paths to restrict the apply to. Absent or empty pushes every drifted leaf.
	Paths             *[]string                           `json:"paths,omitempty"`
	ReloadMode        *ApplyAgentConfigJSONBodyReloadMode `json:"reload_mode,omitempty"`
	ReloadTimeoutSecs *int                                `json:"reload_timeout_secs,omitempty"`
}

type ApplyAgentConfigJSONBodyReloadMode string

type ApplyAgentConfigJSONRequestBody ApplyAgentConfigJSONBody

type ApplyAgentConfigRequestObject struct {
	Id   string `json:"id"`
	Body *ApplyAgentConfigJSONRequestBody
}

type ApplyAgentConfigResponseObject interface {
	VisitApplyAgentConfigResponse(w http.ResponseWriter) error
}

type ApplyGroupConfig202JSONResponse ApplyAccepted

type ApplyGroupConfig400JSONResponse struct{ BadRequestJSONResponse }

type ApplyGroupConfig401JSONResponse struct{ UnauthorizedJSONResponse }

type ApplyGroupConfig404JSONResponse struct{ NotFoundJSONResponse }

type ApplyGroupConfigJSONBody struct {
	ReloadMode        *ApplyGroupConfigJSONBodyReloadMode `json:"reload_mode,omitempty"`
	ReloadTimeoutSecs *int                                `json:"reload_timeout_secs,omitempty"`
}

type ApplyGroupConfigJSONBodyReloadMode string

type ApplyGroupConfigJSONRequestBody ApplyGroupConfigJSONBody

type ApplyGroupConfigRequestObject struct {
	Id   string `json:"id"`
	Body *ApplyGroupConfigJSONRequestBody
}

type ApplyGroupConfigResponseObject interface {
	VisitApplyGroupConfigResponse(w http.ResponseWriter) error
}

type BadRequest = Error

type BadRequestJSONResponse Error

type ChiServerOptions struct {
	BaseURL          string
	BaseRouter       chi.Router
	Middlewares      []MiddlewareFunc
	ErrorHandlerFunc func(w http.ResponseWriter, r *http.Request, err error)
}

type ConfigDrift struct {
	Fields []string          `json:"fields"`
	Status ConfigDriftStatus `json:"status"`
}

type ConfigDriftStatus string

type ConnectionClassCount struct {
	Class string `json:"class"`
	Total int64  `json:"total"`
}

type CreateAgentCertificateRecoveryGrant201JSONResponse AgentCertificateRecoveryGrant

type CreateAgentCertificateRecoveryGrant400JSONResponse struct{ BadRequestJSONResponse }

type CreateAgentCertificateRecoveryGrant401JSONResponse struct{ UnauthorizedJSONResponse }

type CreateAgentCertificateRecoveryGrant403JSONResponse struct{ ForbiddenJSONResponse }

type CreateAgentCertificateRecoveryGrant404JSONResponse struct{ NotFoundJSONResponse }

type CreateAgentCertificateRecoveryGrantJSONRequestBody = CreateCertificateRecoveryGrantRequest

type CreateAgentCertificateRecoveryGrantRequestObject struct {
	Id   string `json:"id"`
	Body *CreateAgentCertificateRecoveryGrantJSONRequestBody
}

type CreateAgentCertificateRecoveryGrantResponseObject interface {
	VisitCreateAgentCertificateRecoveryGrantResponse(w http.ResponseWriter) error
}

type CreateCertificateRecoveryGrantRequest struct {
	// TtlSeconds Grant lifetime in seconds. Zero or omitted yields the
	// server's default TTL (15m, capped at 1h).
	TtlSeconds *int `json:"ttl_seconds,omitempty"`
}

type CreateEnrollmentToken201JSONResponse CreateEnrollmentTokenResponse

type CreateEnrollmentToken400JSONResponse struct{ BadRequestJSONResponse }

type CreateEnrollmentToken401JSONResponse struct{ UnauthorizedJSONResponse }

type CreateEnrollmentToken403JSONResponse struct{ ForbiddenJSONResponse }

type CreateEnrollmentTokenJSONRequestBody = CreateEnrollmentTokenRequest

type CreateEnrollmentTokenRequest struct {
	// FleetGroupId Either the canonical UUID or the friendly slug; empty
	// string falls back to the default fleet group.
	FleetGroupId *string `json:"fleet_group_id,omitempty"`

	// TtlSeconds Token lifetime in seconds.
	TtlSeconds int `json:"ttl_seconds"`
}

type CreateEnrollmentTokenRequestObject struct {
	Body *CreateEnrollmentTokenJSONRequestBody
}

type CreateEnrollmentTokenResponse struct {
	// CaPem PEM-encoded panel CA certificate.
	CaPem         string `json:"ca_pem"`
	ExpiresAtUnix int64  `json:"expires_at_unix"`
	FleetGroupId  string `json:"fleet_group_id"`
	IssuedAtUnix  int64  `json:"issued_at_unix"`
	PanelUrl      string `json:"panel_url"`

	// ScriptSources The two canonical sources from which an agent host can fetch
	// the install script. Operators choose between them in the
	// Add-Server wizard — Panel for the default inbound case (panel
	// is reachable, integrity-checked), GitHub for outbound (panel
	// is firewalled from the agent host) or cold-bootstrap.
	ScriptSources ScriptSources `json:"script_sources"`

	// Value The raw bootstrap token. Returned only at creation.
	Value string `json:"value"`
}

type CreateEnrollmentTokenResponseObject interface {
	VisitCreateEnrollmentTokenResponse(w http.ResponseWriter) error
}

type DeregisterAgent204Response struct {
}

type DeregisterAgent401JSONResponse struct{ UnauthorizedJSONResponse }

type DeregisterAgent403JSONResponse struct{ ForbiddenJSONResponse }

type DeregisterAgent404JSONResponse struct{ NotFoundJSONResponse }

type DeregisterAgentRequestObject struct {
	Id string `json:"id"`
}

type DeregisterAgentResponseObject interface {
	VisitDeregisterAgentResponse(w http.ResponseWriter) error
}

type DispatchAgentUpdate200JSONResponse DispatchAgentUpdateResponse

type DispatchAgentUpdate400JSONResponse struct{ BadRequestJSONResponse }

type DispatchAgentUpdate401JSONResponse struct{ UnauthorizedJSONResponse }

type DispatchAgentUpdate404JSONResponse struct{ NotFoundJSONResponse }

type DispatchAgentUpdateJSONRequestBody = DispatchAgentUpdateRequest

type DispatchAgentUpdateRequest struct {
	// Version Target agent binary version.
	Version string `json:"version"`
}

type DispatchAgentUpdateRequestObject struct {
	Id   string `json:"id"`
	Body *DispatchAgentUpdateJSONRequestBody
}

type DispatchAgentUpdateResponse struct {
	JobId   string `json:"job_id"`
	Status  string `json:"status"`
	Version string `json:"version"`
}

type DispatchAgentUpdateResponseObject interface {
	VisitDispatchAgentUpdateResponse(w http.ResponseWriter) error
}

type DispatchTelemtUpdate202JSONResponse DispatchTelemtUpdateResponse

type DispatchTelemtUpdate400JSONResponse struct{ BadRequestJSONResponse }

type DispatchTelemtUpdate401JSONResponse struct{ UnauthorizedJSONResponse }

type DispatchTelemtUpdate403JSONResponse struct{ ForbiddenJSONResponse }

type DispatchTelemtUpdate404JSONResponse struct{ NotFoundJSONResponse }

type DispatchTelemtUpdate409JSONResponse DispatchTelemtUpdateError

type DispatchTelemtUpdateError struct {
	// Code strategy_not_configured: no update strategy has been PUT for
	// this agent yet. mode_not_binary: the configured strategy's mode
	// is "docker" or "none" — no in-place binary swap path exists.
	// update_unavailable: the agent's live probe reports it cannot
	// offer an in-place update right now. no_known_release: no
	// version was given and the panel has never cached a latest
	// Telemt release.
	Code DispatchTelemtUpdateErrorCode `json:"code"`

	// Error Human-readable message; safe to display to operators.
	Error string `json:"error"`
}

type DispatchTelemtUpdateErrorCode string

type DispatchTelemtUpdateJSONRequestBody = DispatchTelemtUpdateRequest

type DispatchTelemtUpdateRequest struct {
	// AllowDowngrade Allow installing a version older than the one currently
	// running (e.g. an emergency rollback). Defaults to false.
	AllowDowngrade *bool `json:"allow_downgrade,omitempty"`

	// Version Target Telemt version (bare semver, e.g. "3.4.25"). Omit to use
	// the panel's cached latest known Telemt release
	// (`telemt_latest_version` in the updates state); a 409
	// `no_known_release` is returned if neither is available.
	Version *string `json:"version,omitempty"`
}

type DispatchTelemtUpdateRequestObject struct {
	Id   string `json:"id"`
	Body *DispatchTelemtUpdateJSONRequestBody
}

type DispatchTelemtUpdateResponse struct {
	JobId string `json:"job_id"`
}

type DispatchTelemtUpdateResponseObject interface {
	VisitDispatchTelemtUpdateResponse(w http.ResponseWriter) error
}

type EnrollmentTokenList = []EnrollmentTokenListItem

type EnrollmentTokenListItem struct {
	ConsumedAtUnix *int64 `json:"consumed_at_unix,omitempty"`
	ExpiresAtUnix  int64  `json:"expires_at_unix"`
	FleetGroupId   string `json:"fleet_group_id"`

	// Handle SHA-256 prefix of the raw value, hex-encoded.
	Handle       *string `json:"handle,omitempty"`
	IssuedAtUnix int64   `json:"issued_at_unix"`

	// MaskedValue Truncated form of the raw value, ellipsis-suffixed.
	MaskedValue   *string                       `json:"masked_value,omitempty"`
	PanelUrl      string                        `json:"panel_url"`
	RevokedAtUnix *int64                        `json:"revoked_at_unix,omitempty"`
	Status        EnrollmentTokenListItemStatus `json:"status"`
}

type EnrollmentTokenListItemStatus string

type Error struct {
	// Details Optional structured context. Shape varies per error code.
	Details *map[string]interface{} `json:"details,omitempty"`

	// Error Machine-readable error code (e.g. `not_found`, `forbidden`).
	Error string `json:"error"`

	// Message Human-readable message; safe to display to operators.
	Message *string `json:"message,omitempty"`
}

type Forbidden = Error

type ForbiddenJSONResponse Error

type GetAgentConfig200JSONResponse AgentConfigResponse

type GetAgentConfig401JSONResponse struct{ UnauthorizedJSONResponse }

type GetAgentConfig403JSONResponse struct{ ForbiddenJSONResponse }

type GetAgentConfig404JSONResponse struct{ NotFoundJSONResponse }

type GetAgentConfigRequestObject struct {
	Id string `json:"id"`
}

type GetAgentConfigResponseObject interface {
	VisitGetAgentConfigResponse(w http.ResponseWriter) error
}

type GetHealthz200TextResponse string

type GetHealthzRequestObject struct {
}

type GetHealthzResponseObject interface {
	VisitGetHealthzResponse(w http.ResponseWriter) error
}

type GetTelemtUpdateStrategy200JSONResponse TelemtUpdateStrategyResponse

type GetTelemtUpdateStrategy401JSONResponse struct{ UnauthorizedJSONResponse }

type GetTelemtUpdateStrategy403JSONResponse struct{ ForbiddenJSONResponse }

type GetTelemtUpdateStrategy404JSONResponse struct{ NotFoundJSONResponse }

type GetTelemtUpdateStrategyRequestObject struct {
	Id string `json:"id"`
}

type GetTelemtUpdateStrategyResponseObject interface {
	VisitGetTelemtUpdateStrategyResponse(w http.ResponseWriter) error
}

type GetVersion200JSONResponse VersionResponse

type GetVersion401JSONResponse struct{ UnauthorizedJSONResponse }

type GetVersionRequestObject struct {
}

type GetVersionResponseObject interface {
	VisitGetVersionResponse(w http.ResponseWriter) error
}

type InstallCommandAdvancedOptions struct {
	// InsecureTransport Opt-in: allow plain-HTTP panel URLs on non-loopback hosts.
	// Intended for VPN-only / private-network deploys where the
	// bootstrap-key handshake transits in cleartext.
	InsecureTransport *bool `json:"insecure_transport,omitempty"`

	// TelemtAuth Authorization header value (e.g. "Bearer xxx") the agent
	// forwards to Telemt. Empty / omitted = no auth header.
	TelemtAuth *string `json:"telemt_auth,omitempty"`

	// TelemtMetricsUrl Override the agent's Telemt metrics URL.
	TelemtMetricsUrl *string `json:"telemt_metrics_url,omitempty"`

	// TelemtUrl Override the agent's Telemt API URL.
	TelemtUrl *string `json:"telemt_url,omitempty"`
}

type InvalidParamFormatError struct {
	ParamName string
	Err       error
}

type ListAgents200JSONResponse AgentList

type ListAgents401JSONResponse struct{ UnauthorizedJSONResponse }

type ListAgents403JSONResponse struct{ ForbiddenJSONResponse }

type ListAgentsRequestObject struct {
}

type ListAgentsResponseObject interface {
	VisitListAgentsResponse(w http.ResponseWriter) error
}

type ListEnrollmentTokens200JSONResponse EnrollmentTokenList

type ListEnrollmentTokens401JSONResponse struct{ UnauthorizedJSONResponse }

type ListEnrollmentTokens403JSONResponse struct{ ForbiddenJSONResponse }

type ListEnrollmentTokensRequestObject struct {
}

type ListEnrollmentTokensResponseObject interface {
	VisitListEnrollmentTokensResponse(w http.ResponseWriter) error
}

type MiddlewareFunc func(http.Handler) http.Handler

type NotFound = Error

type NotFoundJSONResponse Error

type ProvisionOutboundAgent201JSONResponse ProvisionOutboundAgentResponse

type ProvisionOutboundAgent400JSONResponse struct{ BadRequestJSONResponse }

type ProvisionOutboundAgent401JSONResponse struct{ UnauthorizedJSONResponse }

type ProvisionOutboundAgent403JSONResponse struct{ ForbiddenJSONResponse }

type ProvisionOutboundAgent409JSONResponse Error

type ProvisionOutboundAgent503TextResponse string

type ProvisionOutboundAgentJSONRequestBody = ProvisionOutboundAgentRequest

type ProvisionOutboundAgentRequest struct {
	// Advanced Optional per-install overrides — the wizard's "Advanced" section.
	// All fields nullable / omittable so the default install (with the
	// agent's built-in Telemt defaults) needs none of these.
	Advanced *InstallCommandAdvancedOptions `json:"advanced,omitempty"`

	// DialAddress Public host:port the panel dials to reach the agent. Used
	// both for the agent's listen bind (derived port) and for
	// the panel's outbound supervisor target.
	DialAddress string `json:"dial_address"`

	// FleetGroupId Canonical fleet-group UUID or friendly slug. Empty string
	// falls back to the operator's default fleet group.
	FleetGroupId string `json:"fleet_group_id"`

	// NodeName Operator-supplied display name. Must satisfy the same
	// character class enforced for inbound enrollment
	// (`[A-Za-z0-9._-]+`), since the value is interpolated into
	// the curl|bash one-liner as a CLI flag value.
	NodeName string `json:"node_name"`

	// ScriptSource Source from which the agent host fetches install-agent.sh.
	// 'github' is the default for outbound because the panel is
	// typically firewalled from the agent host (otherwise the
	// operator would use inbound mode); 'panel' is supported for
	// cases where the agent can reach the panel during bootstrap
	// even though the steady-state transport is reverse.
	ScriptSource *ProvisionOutboundAgentRequestScriptSource `json:"script_source,omitempty"`
}

type ProvisionOutboundAgentRequestObject struct {
	Body *ProvisionOutboundAgentJSONRequestBody
}

type ProvisionOutboundAgentRequestScriptSource string

type ProvisionOutboundAgentResponse struct {
	AgentId string `json:"agent_id"`

	// Command Pre-baked `curl ... | sudo bash -s -- ...` one-liner.
	Command       string `json:"command"`
	ExpiresAtUnix int64  `json:"expires_at_unix"`

	// ScriptUrl The URL the curl in the command points at — exposed so the
	// wizard can show the operator which source was used.
	ScriptUrl string `json:"script_url"`
}

type ProvisionOutboundAgentResponseObject interface {
	VisitProvisionOutboundAgentResponse(w http.ResponseWriter) error
}

type PutTelemtUpdateStrategy204Response struct {
}

type PutTelemtUpdateStrategy400JSONResponse struct{ BadRequestJSONResponse }

type PutTelemtUpdateStrategy401JSONResponse struct{ UnauthorizedJSONResponse }

type PutTelemtUpdateStrategy403JSONResponse struct{ ForbiddenJSONResponse }

type PutTelemtUpdateStrategy404JSONResponse struct{ NotFoundJSONResponse }

type PutTelemtUpdateStrategyJSONRequestBody = TelemtUpdateStrategy

type PutTelemtUpdateStrategyRequestObject struct {
	Id   string `json:"id"`
	Body *PutTelemtUpdateStrategyJSONRequestBody
}

type PutTelemtUpdateStrategyResponseObject interface {
	VisitPutTelemtUpdateStrategyResponse(w http.ResponseWriter) error
}

type RenameAgent200JSONResponse Agent

type RenameAgent400JSONResponse struct{ BadRequestJSONResponse }

type RenameAgent401JSONResponse struct{ UnauthorizedJSONResponse }

type RenameAgent404JSONResponse struct{ NotFoundJSONResponse }

type RenameAgentJSONRequestBody = RenameAgentRequest

type RenameAgentRequest struct {
	NodeName string `json:"node_name"`
}

type RenameAgentRequestObject struct {
	Id   string `json:"id"`
	Body *RenameAgentJSONRequestBody
}

type RenameAgentResponseObject interface {
	VisitRenameAgentResponse(w http.ResponseWriter) error
}

type RequiredHeaderError struct {
	ParamName string
	Err       error
}

type RequiredParamError struct {
	ParamName string
}

type RevokeAgentCertificateRecoveryGrant200JSONResponse AgentCertificateRecoveryGrant

type RevokeAgentCertificateRecoveryGrant401JSONResponse struct{ UnauthorizedJSONResponse }

type RevokeAgentCertificateRecoveryGrant403JSONResponse struct{ ForbiddenJSONResponse }

type RevokeAgentCertificateRecoveryGrant404JSONResponse struct{ NotFoundJSONResponse }

type RevokeAgentCertificateRecoveryGrantRequestObject struct {
	Id string `json:"id"`
}

type RevokeAgentCertificateRecoveryGrantResponseObject interface {
	VisitRevokeAgentCertificateRecoveryGrantResponse(w http.ResponseWriter) error
}

type RevokeEnrollmentToken204Response struct {
}

type RevokeEnrollmentToken401JSONResponse struct{ UnauthorizedJSONResponse }

type RevokeEnrollmentToken403JSONResponse struct{ ForbiddenJSONResponse }

type RevokeEnrollmentToken404JSONResponse struct{ NotFoundJSONResponse }

type RevokeEnrollmentTokenRequestObject struct {
	Value string `json:"value"`
}

type RevokeEnrollmentTokenResponseObject interface {
	VisitRevokeEnrollmentTokenResponse(w http.ResponseWriter) error
}

type RuntimeDC struct {
	AliveWriters       int     `json:"alive_writers"`
	AvailableEndpoints int     `json:"available_endpoints"`
	AvailablePct       float64 `json:"available_pct"`
	CoveragePct        float64 `json:"coverage_pct"`
	Dc                 int     `json:"dc"`
	FreshAliveWriters  int     `json:"fresh_alive_writers"`
	FreshCoveragePct   float64 `json:"fresh_coverage_pct"`
	Load               int     `json:"load"`
	RequiredWriters    int     `json:"required_writers"`
	RttMs              float64 `json:"rtt_ms"`
}

type RuntimeEvent struct {
	Context       string `json:"context"`
	EventType     string `json:"event_type"`
	Sequence      int64  `json:"sequence"`
	TimestampUnix int64  `json:"timestamp_unix"`
}

type RuntimeMeWritersSummary struct {
	AliveWriters        int     `json:"alive_writers"`
	AvailableEndpoints  int     `json:"available_endpoints"`
	ConfiguredEndpoints int     `json:"configured_endpoints"`
	CoveragePct         float64 `json:"coverage_pct"`
	FreshAliveWriters   int     `json:"fresh_alive_writers"`
	FreshCoveragePct    float64 `json:"fresh_coverage_pct"`
	RequiredWriters     int     `json:"required_writers"`
}

type RuntimeSystemLoad struct {
	CpuUsagePct      float64 `json:"cpu_usage_pct"`
	DiskTotalBytes   int64   `json:"disk_total_bytes"`
	DiskUsagePct     float64 `json:"disk_usage_pct"`
	DiskUsedBytes    int64   `json:"disk_used_bytes"`
	Load15m          float64 `json:"load_15m"`
	Load1m           float64 `json:"load_1m"`
	Load5m           float64 `json:"load_5m"`
	MemoryTotalBytes int64   `json:"memory_total_bytes"`
	MemoryUsagePct   float64 `json:"memory_usage_pct"`
	MemoryUsedBytes  int64   `json:"memory_used_bytes"`
	NetBytesRecv     int64   `json:"net_bytes_recv"`
	NetBytesSent     int64   `json:"net_bytes_sent"`
}

type RuntimeTopByConnections struct {
	Connections int    `json:"connections"`
	Username    string `json:"username"`
}

type RuntimeTopByThroughput struct {
	ThroughputBytes int64  `json:"throughput_bytes"`
	Username        string `json:"username"`
}

type RuntimeUpstream struct {
	Address            string    `json:"address"`
	EffectiveLatencyMs float64   `json:"effective_latency_ms"`
	Fails              int       `json:"fails"`
	Healthy            bool      `json:"healthy"`
	LastCheckAgeSecs   int       `json:"last_check_age_secs"`
	RouteKind          string    `json:"route_kind"`
	Scopes             *[]string `json:"scopes,omitempty"`
	UpstreamId         int       `json:"upstream_id"`
	Weight             int       `json:"weight"`
}

type ScriptSource struct {
	// Sha256 Lowercase hex SHA-256 of the script body. Populated for the
	// Panel-served source (the panel knows the exact bytes it is
	// serving); null for the GitHub-hosted fallback (no
	// panel-side integrity guarantee — operators pin a release
	// tag instead).
	Sha256 *string `json:"sha256,omitempty"`

	// Url Fully-qualified HTTPS URL to install-agent.sh.
	Url string `json:"url"`
}

type ScriptSources struct {
	// Github Pointer to a hosted copy of the agent install script
	// (`install-agent.sh`). Each source carries its own URL; the
	// Panel-served copy also exports its SHA-256 so the operator
	// client can render a tamper-resistant curl|sudo-bash form.
	Github ScriptSource `json:"github"`

	// Panel Pointer to a hosted copy of the agent install script
	// (`install-agent.sh`). Each source carries its own URL; the
	// Panel-served copy also exports its SHA-256 so the operator
	// client can render a tamper-resistant curl|sudo-bash form.
	Panel ScriptSource `json:"panel"`
}

type SelfUpdateState struct {
	FromVersion *string              `json:"from_version,omitempty"`
	Message     *string              `json:"message,omitempty"`
	Phase       SelfUpdateStatePhase `json:"phase"`
	ToVersion   *string              `json:"to_version,omitempty"`

	// UpdatedAt Unix seconds of the last phase transition.
	UpdatedAt *int64 `json:"updated_at,omitempty"`
}

type SelfUpdateStatePhase string

type ServerInterface interface {
	// List enrolled agents in operator's fleet scope
	// (GET /api/agents)
	ListAgents(w http.ResponseWriter, r *http.Request)
	// List enrollment tokens visible to the operator
	// (GET /api/agents/enrollment-tokens)
	ListEnrollmentTokens(w http.ResponseWriter, r *http.Request)
	// Mint a new enrollment token
	// (POST /api/agents/enrollment-tokens)
	CreateEnrollmentToken(w http.ResponseWriter, r *http.Request)
	// Revoke an enrollment token
	// (POST /api/agents/enrollment-tokens/{value}/revoke)
	RevokeEnrollmentToken(w http.ResponseWriter, r *http.Request, value string)
	// Create an outbound agent and return its install command
	// (POST /api/agents/provision-outbound)
	ProvisionOutboundAgent(w http.ResponseWriter, r *http.Request)
	// Deregister an agent
	// (DELETE /api/agents/{id})
	DeregisterAgent(w http.ResponseWriter, r *http.Request, id string)
	// Rename an agent's display node-name
	// (PATCH /api/agents/{id})
	RenameAgent(w http.ResponseWriter, r *http.Request, id string)
	// Allow an agent to recover an expired certificate
	// (POST /api/agents/{id}/certificate-recovery-grants)
	CreateAgentCertificateRecoveryGrant(w http.ResponseWriter, r *http.Request, id string)
	// Revoke a previously-issued recovery grant
	// (POST /api/agents/{id}/certificate-recovery-grants/revoke)
	RevokeAgentCertificateRecoveryGrant(w http.ResponseWriter, r *http.Request, id string)
	// Get an agent's desired config snapshot, effective merge, observed config, and drift
	// (GET /api/agents/{id}/config)
	GetAgentConfig(w http.ResponseWriter, r *http.Request, id string)
	// Apply the effective config target to a single agent
	// (POST /api/agents/{id}/config/apply)
	ApplyAgentConfig(w http.ResponseWriter, r *http.Request, id string)
	// Reassign an agent to a different fleet group
	// (PUT /api/agents/{id}/fleet-group)
	UpdateAgentFleetGroup(w http.ResponseWriter, r *http.Request, id string)
	// Enqueue a telemt.update job for an agent's managed Telemt install
	// (POST /api/agents/{id}/telemt/update)
	DispatchTelemtUpdate(w http.ResponseWriter, r *http.Request, id string)
	// Get an agent's Telemt update strategy and live probe
	// (GET /api/agents/{id}/telemt/update-strategy)
	GetTelemtUpdateStrategy(w http.ResponseWriter, r *http.Request, id string)
	// Set an agent's Telemt update strategy
	// (PUT /api/agents/{id}/telemt/update-strategy)
	PutTelemtUpdateStrategy(w http.ResponseWriter, r *http.Request, id string)
	// Switch an agent between inbound and outbound transport
	// (PUT /api/agents/{id}/transport-mode)
	UpdateAgentTransportMode(w http.ResponseWriter, r *http.Request, id string)
	// Enqueue a self-update job for an agent
	// (POST /api/agents/{id}/update)
	DispatchAgentUpdate(w http.ResponseWriter, r *http.Request, id string)
	// Apply the effective config target to every in-scope agent in a fleet group
	// (POST /api/fleet-groups/{id}/config/apply)
	ApplyGroupConfig(w http.ResponseWriter, r *http.Request, id string)
	// Panel build identification
	// (GET /api/version)
	GetVersion(w http.ResponseWriter, r *http.Request)
	// Liveness probe
	// (GET /healthz)
	GetHealthz(w http.ResponseWriter, r *http.Request)
}

type ServerInterfaceWrapper struct {
	Handler            ServerInterface
	HandlerMiddlewares []MiddlewareFunc
	ErrorHandlerFunc   func(w http.ResponseWriter, r *http.Request, err error)
}

type StrictHTTPServerOptions struct {
	RequestErrorHandlerFunc  func(w http.ResponseWriter, r *http.Request, err error)
	ResponseErrorHandlerFunc func(w http.ResponseWriter, r *http.Request, err error)
}

type StrictHandlerFunc func(ctx context.Context, w http.ResponseWriter, r *http.Request, request any) (any, error)

type StrictMiddlewareFunc func(f StrictHandlerFunc, operationID string) StrictHandlerFunc

type StrictServerInterface interface {
	// List enrolled agents in operator's fleet scope
	// (GET /api/agents)
	ListAgents(ctx context.Context, request ListAgentsRequestObject) (ListAgentsResponseObject, error)
	// List enrollment tokens visible to the operator
	// (GET /api/agents/enrollment-tokens)
	ListEnrollmentTokens(ctx context.Context, request ListEnrollmentTokensRequestObject) (ListEnrollmentTokensResponseObject, error)
	// Mint a new enrollment token
	// (POST /api/agents/enrollment-tokens)
	CreateEnrollmentToken(ctx context.Context, request CreateEnrollmentTokenRequestObject) (CreateEnrollmentTokenResponseObject, error)
	// Revoke an enrollment token
	// (POST /api/agents/enrollment-tokens/{value}/revoke)
	RevokeEnrollmentToken(ctx context.Context, request RevokeEnrollmentTokenRequestObject) (RevokeEnrollmentTokenResponseObject, error)
	// Create an outbound agent and return its install command
	// (POST /api/agents/provision-outbound)
	ProvisionOutboundAgent(ctx context.Context, request ProvisionOutboundAgentRequestObject) (ProvisionOutboundAgentResponseObject, error)
	// Deregister an agent
	// (DELETE /api/agents/{id})
	DeregisterAgent(ctx context.Context, request DeregisterAgentRequestObject) (DeregisterAgentResponseObject, error)
	// Rename an agent's display node-name
	// (PATCH /api/agents/{id})
	RenameAgent(ctx context.Context, request RenameAgentRequestObject) (RenameAgentResponseObject, error)
	// Allow an agent to recover an expired certificate
	// (POST /api/agents/{id}/certificate-recovery-grants)
	CreateAgentCertificateRecoveryGrant(ctx context.Context, request CreateAgentCertificateRecoveryGrantRequestObject) (CreateAgentCertificateRecoveryGrantResponseObject, error)
	// Revoke a previously-issued recovery grant
	// (POST /api/agents/{id}/certificate-recovery-grants/revoke)
	RevokeAgentCertificateRecoveryGrant(ctx context.Context, request RevokeAgentCertificateRecoveryGrantRequestObject) (RevokeAgentCertificateRecoveryGrantResponseObject, error)
	// Get an agent's desired config snapshot, effective merge, observed config, and drift
	// (GET /api/agents/{id}/config)
	GetAgentConfig(ctx context.Context, request GetAgentConfigRequestObject) (GetAgentConfigResponseObject, error)
	// Apply the effective config target to a single agent
	// (POST /api/agents/{id}/config/apply)
	ApplyAgentConfig(ctx context.Context, request ApplyAgentConfigRequestObject) (ApplyAgentConfigResponseObject, error)
	// Reassign an agent to a different fleet group
	// (PUT /api/agents/{id}/fleet-group)
	UpdateAgentFleetGroup(ctx context.Context, request UpdateAgentFleetGroupRequestObject) (UpdateAgentFleetGroupResponseObject, error)
	// Enqueue a telemt.update job for an agent's managed Telemt install
	// (POST /api/agents/{id}/telemt/update)
	DispatchTelemtUpdate(ctx context.Context, request DispatchTelemtUpdateRequestObject) (DispatchTelemtUpdateResponseObject, error)
	// Get an agent's Telemt update strategy and live probe
	// (GET /api/agents/{id}/telemt/update-strategy)
	GetTelemtUpdateStrategy(ctx context.Context, request GetTelemtUpdateStrategyRequestObject) (GetTelemtUpdateStrategyResponseObject, error)
	// Set an agent's Telemt update strategy
	// (PUT /api/agents/{id}/telemt/update-strategy)
	PutTelemtUpdateStrategy(ctx context.Context, request PutTelemtUpdateStrategyRequestObject) (PutTelemtUpdateStrategyResponseObject, error)
	// Switch an agent between inbound and outbound transport
	// (PUT /api/agents/{id}/transport-mode)
	UpdateAgentTransportMode(ctx context.Context, request UpdateAgentTransportModeRequestObject) (UpdateAgentTransportModeResponseObject, error)
	// Enqueue a self-update job for an agent
	// (POST /api/agents/{id}/update)
	DispatchAgentUpdate(ctx context.Context, request DispatchAgentUpdateRequestObject) (DispatchAgentUpdateResponseObject, error)
	// Apply the effective config target to every in-scope agent in a fleet group
	// (POST /api/fleet-groups/{id}/config/apply)
	ApplyGroupConfig(ctx context.Context, request ApplyGroupConfigRequestObject) (ApplyGroupConfigResponseObject, error)
	// Panel build identification
	// (GET /api/version)
	GetVersion(ctx context.Context, request GetVersionRequestObject) (GetVersionResponseObject, error)
	// Liveness probe
	// (GET /healthz)
	GetHealthz(ctx context.Context, request GetHealthzRequestObject) (GetHealthzResponseObject, error)
}

type TelemtUpdateProbe struct {
	// Available Whether an in-place update is offered at all.
	Available bool `json:"available"`

	// BinaryPath Best-effort resolved path to the telemt executable, used as
	// the swap target. May be empty if it could not be resolved.
	BinaryPath string `json:"binary_path"`

	// Mode "binary" (a supported supervisor owns telemt; a binary swap +
	// supervised restart is safe), "docker" (telemt runs in a
	// container; updates must go through the image), or "none"
	// (nothing detected).
	Mode string `json:"mode"`

	// Reason Localizable CODE (not a human-readable phrase) explaining why
	// available is false, e.g. "docker_only",
	// "no_service_manager_detected". Empty when available is true.
	Reason string `json:"reason"`

	// SuggestedRestartSpec telemtrestart spec ("systemd:telemt", "openrc:telemt",
	// "procd:telemt", "runit:telemt") to use for the supervised
	// restart after a binary swap. Empty when mode != "binary".
	SuggestedRestartSpec string `json:"suggested_restart_spec"`
}

type TelemtUpdateStrategy struct {
	// AssetFlavor Release-asset variant to download for this agent, e.g. "v3"
	// for a CPU-feature-optimised build. Empty selects the default
	// asset.
	AssetFlavor string `json:"asset_flavor"`

	// BinaryPath Absolute path to the telemt executable, used as the swap
	// target. Required for mode=binary.
	BinaryPath string `json:"binary_path"`

	// Mode "binary" (a supported supervisor owns telemt; a binary swap +
	// supervised restart is safe), "docker" (telemt runs in a
	// container; updates must go through the image), or "none" (no
	// in-place update path).
	Mode TelemtUpdateStrategyMode `json:"mode"`

	// RestartSpec telemtrestart spec ("systemd:telemt", "openrc:telemt",
	// "procd:telemt", "runit:telemt", "command:...") to use for the
	// supervised restart after a binary swap. Required for
	// mode=binary; validated with the same rules the agent applies.
	RestartSpec string `json:"restart_spec"`
}

type TelemtUpdateStrategyMode string

type TelemtUpdateStrategyResponse struct {
	Probe    *TelemtUpdateProbe    `json:"probe"`
	Strategy *TelemtUpdateStrategy `json:"strategy"`
}

type TooManyValuesForParamError struct {
	ParamName string
	Count     int
}

type Unauthorized = Error

type UnauthorizedJSONResponse Error

type UnescapedCookieParamError struct {
	ParamName string
	Err       error
}

type Unimplemented struct{}

type UnmarshalingParamError struct {
	ParamName string
	Err       error
}

type UpdateAgentFleetGroup200JSONResponse Agent

type UpdateAgentFleetGroup400JSONResponse struct{ BadRequestJSONResponse }

type UpdateAgentFleetGroup401JSONResponse struct{ UnauthorizedJSONResponse }

type UpdateAgentFleetGroup403JSONResponse struct{ ForbiddenJSONResponse }

type UpdateAgentFleetGroup404JSONResponse struct{ NotFoundJSONResponse }

type UpdateAgentFleetGroupJSONRequestBody = UpdateAgentFleetGroupRequest

type UpdateAgentFleetGroupRequest struct {
	// FleetGroupId Target fleet-group UUID. Must already exist.
	FleetGroupId string `json:"fleet_group_id"`
}

type UpdateAgentFleetGroupRequestObject struct {
	Id   string `json:"id"`
	Body *UpdateAgentFleetGroupJSONRequestBody
}

type UpdateAgentFleetGroupResponseObject interface {
	VisitUpdateAgentFleetGroupResponse(w http.ResponseWriter) error
}

type UpdateAgentTransportMode204Response struct {
}

type UpdateAgentTransportMode400JSONResponse struct{ BadRequestJSONResponse }

type UpdateAgentTransportMode401JSONResponse struct{ UnauthorizedJSONResponse }

type UpdateAgentTransportMode404JSONResponse struct{ NotFoundJSONResponse }

type UpdateAgentTransportModeJSONRequestBody = UpdateAgentTransportModeRequest

type UpdateAgentTransportModeRequest struct {
	// DialAddress Public host:port the panel dials (required for outbound).
	DialAddress *string `json:"dial_address,omitempty"`

	// ListenAddress Agent-side bind spec. Optional — defaults to `:<port>`
	// derived from `dial_address` when omitted.
	ListenAddress *string                                      `json:"listen_address,omitempty"`
	TransportMode UpdateAgentTransportModeRequestTransportMode `json:"transport_mode"`
}

type UpdateAgentTransportModeRequestObject struct {
	Id   string `json:"id"`
	Body *UpdateAgentTransportModeJSONRequestBody
}

type UpdateAgentTransportModeRequestTransportMode string

type UpdateAgentTransportModeResponseObject interface {
	VisitUpdateAgentTransportModeResponse(w http.ResponseWriter) error
}

type VersionResponse struct {
	// BuildTime RFC3339 build timestamp. Operator+ only.
	BuildTime *time.Time `json:"build_time,omitempty"`

	// CommitSha Git commit hash baked in at build time. Operator+ only.
	CommitSha *string `json:"commit_sha,omitempty"`

	// Version Semantic version (or "dev" for unstamped builds).
	Version string `json:"version"`
}