client

type AksMeteringConfig struct {
	ClientConfig KubernetesClientConfig               `json:"clientConfig" tfsdk:"client_config"`
	Processing   MeshPlatformMeteringProcessingConfig `json:"processing" tfsdk:"processing"`
}

type AksPlatformConfig struct {
	BaseUrl              string                `json:"baseUrl" tfsdk:"base_url"`
	DisableSslValidation bool                  `json:"disableSslValidation" tfsdk:"disable_ssl_validation"`
	Replication          *AksReplicationConfig `json:"replication" tfsdk:"replication"`
	Metering             *AksMeteringConfig    `json:"metering,omitzero" tfsdk:"metering"`
}

type AksPlatformProperties struct {
	KubernetesRoleMappings []KubernetesRoleMapping `json:"kubernetesRoleMappings" tfsdk:"kubernetes_role_mappings"`
}

type AksReplicationConfig struct {
	AccessToken             types.Secret              `json:"accessToken" tfsdk:"access_token"`
	NamespaceNamePattern    string                    `json:"namespaceNamePattern" tfsdk:"namespace_name_pattern"`
	GroupNamePattern        string                    `json:"groupNamePattern" tfsdk:"group_name_pattern"`
	ServicePrincipal        AksServicePrincipalConfig `json:"servicePrincipal" tfsdk:"service_principal"`
	AksSubscriptionId       string                    `json:"aksSubscriptionId" tfsdk:"aks_subscription_id"`
	AksClusterName          string                    `json:"aksClusterName" tfsdk:"aks_cluster_name"`
	AksResourceGroup        string                    `json:"aksResourceGroup" tfsdk:"aks_resource_group"`
	RedirectUrl             *string                   `json:"redirectUrl,omitzero" tfsdk:"redirect_url"`
	SendAzureInvitationMail bool                      `json:"sendAzureInvitationMail" tfsdk:"send_azure_invitation_mail"`
	UserLookupStrategy      string                    `json:"userLookUpStrategy" tfsdk:"user_lookup_strategy"`
	AdministrativeUnitId    *string                   `json:"administrativeUnitId,omitzero" tfsdk:"administrative_unit_id"`
}

type AksServicePrincipalConfig struct {
	EntraTenant string          `json:"entraTenant" tfsdk:"entra_tenant"`
	ObjectId    string          `json:"objectId" tfsdk:"object_id"`
	ClientId    string          `json:"clientId" tfsdk:"client_id"`
	Auth        AzureAuthConfig `json:"auth" tfsdk:"auth"`
}

type ApiKeyPermissions [][][]ApiPermission

type ApiPermission string

type AppliedQuotaValue struct {
	Value int64 `json:"value" tfsdk:"value"`
}

type Authorization = http.Authorization

type AwsAccessConfig struct {
	OrganizationRootAccountRole       string  `json:"organizationRootAccountRole" tfsdk:"organization_root_account_role"`
	OrganizationRootAccountExternalId *string `json:"organizationRootAccountExternalId,omitzero" tfsdk:"organization_root_account_external_id"`
	Auth                              AwsAuth `json:"auth" tfsdk:"auth"`
}

type AwsAuth struct {
	Type             string                         `json:"type" tfsdk:"type"`
	Credential       *AwsServiceUserCredential      `json:"credential,omitzero" tfsdk:"credential"`
	WorkloadIdentity *AwsWorkloadIdentityCredential `json:"workloadIdentity,omitzero" tfsdk:"workload_identity"`
}

type AwsEnrollmentConfiguration struct {
	ManagementAccountId     string `json:"managementAccountId" tfsdk:"management_account_id"`
	AccountFactoryProductId string `json:"accountFactoryProductId" tfsdk:"account_factory_product_id"`
}

type AwsIdentityStoreConfig struct {
	IdentityStoreId  string                                 `json:"identityStoreId" tfsdk:"identity_store_id"`
	Arn              string                                 `json:"arn" tfsdk:"arn"`
	GroupNamePattern string                                 `json:"groupNamePattern" tfsdk:"group_name_pattern"`
	AwsRoleMappings  types.Set[AwsIdentityStoreRoleMapping] `json:"awsRoleMappings" tfsdk:"aws_role_mappings"`
	SignInUrl        string                                 `json:"signInUrl" tfsdk:"sign_in_url"`
}

type AwsIdentityStoreRoleMapping struct {
	ProjectRoleRef    NamedRef `json:"projectRoleRef" tfsdk:"project_role_ref"`
	AwsRole           string   `json:"awsRole" tfsdk:"aws_role"`
	PermissionSetArns []string `json:"permissionSetArns" tfsdk:"permission_set_arns"`
}

type AwsMeteringConfig struct {
	AccessConfig                   AwsAccessConfig                      `json:"accessConfig" tfsdk:"access_config"`
	Filter                         string                               `json:"filter" tfsdk:"filter"`
	ReservedInstanceFairChargeback bool                                 `json:"reservedInstanceFairChargeback" tfsdk:"reserved_instance_fair_chargeback"`
	SavingsPlanFairChargeback      bool                                 `json:"savingsPlanFairChargeback" tfsdk:"savings_plan_fair_chargeback"`
	Processing                     MeshPlatformMeteringProcessingConfig `json:"processing" tfsdk:"processing"`
}

type AwsPlatformConfig struct {
	Region      string                `json:"region,omitempty" tfsdk:"region"`
	Replication *AwsReplicationConfig `json:"replication,omitzero" tfsdk:"replication"`
	Metering    *AwsMeteringConfig    `json:"metering,omitzero" tfsdk:"metering"`
}

type AwsPlatformProperties struct {
	AwsTargetOrgUnitId string           `json:"awsTargetOrgUnitId" tfsdk:"aws_target_org_unit_id"`
	AwsEnrollAccount   bool             `json:"awsEnrollAccount" tfsdk:"aws_enroll_account"`
	AwsLambdaArn       *string          `json:"awsLambdaArn" tfsdk:"aws_lambda_arn"`
	AwsRoleMappings    []AwsRoleMapping `json:"awsRoleMappings" tfsdk:"aws_role_mappings"`
}

type AwsReplicationConfig struct {
	AccessConfig                                  AwsAccessConfig             `json:"accessConfig" tfsdk:"access_config"`
	WaitForExternalAvm                            bool                        `json:"waitForExternalAvm" tfsdk:"wait_for_external_avm"`
	AutomationAccountRole                         string                      `json:"automationAccountRole" tfsdk:"automation_account_role"`
	AutomationAccountExternalId                   *string                     `json:"automationAccountExternalId,omitzero" tfsdk:"automation_account_external_id"`
	AccountAccessRole                             string                      `json:"accountAccessRole" tfsdk:"account_access_role"`
	AccountAliasPattern                           string                      `json:"accountAliasPattern" tfsdk:"account_alias_pattern"`
	EnforceAccountAlias                           bool                        `json:"enforceAccountAlias" tfsdk:"enforce_account_alias"`
	AccountEmailPattern                           string                      `json:"accountEmailPattern" tfsdk:"account_email_pattern"`
	TenantTags                                    *MeshTenantTags             `json:"tenantTags,omitzero" tfsdk:"tenant_tags"`
	AwsSso                                        *AwsSsoConfig               `json:"awsSso,omitzero" tfsdk:"aws_sso"`
	AwsIdentityStore                              *AwsIdentityStoreConfig     `json:"awsIdentityStore,omitzero" tfsdk:"aws_identity_store"`
	EnrollmentConfiguration                       *AwsEnrollmentConfiguration `json:"enrollmentConfiguration,omitzero" tfsdk:"enrollment_configuration"`
	SelfDowngradeAccessRole                       bool                        `json:"selfDowngradeAccessRole" tfsdk:"self_downgrade_access_role"`
	SkipUserGroupPermissionCleanup                bool                        `json:"skipUserGroupPermissionCleanup" tfsdk:"skip_user_group_permission_cleanup"`
	AllowHierarchicalOrganizationalUnitAssignment bool                        `json:"allowHierarchicalOrganizationalUnitAssignment" tfsdk:"allow_hierarchical_organizational_unit_assignment"`
}

type AwsRoleMapping struct {
	MeshProjectRoleRef NamedRef `json:"projectRoleRef" tfsdk:"project_role_ref"`
	PlatformRole       string   `json:"platformRole" tfsdk:"platform_role"`
	Policies           []string `json:"policies" tfsdk:"policies"`
}

type AwsServiceUserCredential struct {
	AccessKey string       `json:"accessKey" tfsdk:"access_key"`
	SecretKey types.Secret `json:"secretKey" tfsdk:"secret_key"`
}

type AwsSsoConfig struct {
	ScimEndpoint     string                       `json:"scimEndpoint" tfsdk:"scim_endpoint"`
	Arn              string                       `json:"arn" tfsdk:"arn"`
	GroupNamePattern string                       `json:"groupNamePattern" tfsdk:"group_name_pattern"`
	SsoAccessToken   types.Secret                 `json:"ssoAccessToken" tfsdk:"sso_access_token"`
	AwsRoleMappings  types.Set[AwsSsoRoleMapping] `json:"awsRoleMappings" tfsdk:"aws_role_mappings"`
	SignInUrl        string                       `json:"signInUrl" tfsdk:"sign_in_url"`
}

type AwsSsoRoleMapping struct {
	MeshProjectRoleRef NamedRef `json:"projectRoleRef" tfsdk:"project_role_ref"`
	AwsRole            string   `json:"awsRole" tfsdk:"aws_role"`
	PermissionSetArns  []string `json:"permissionSetArns" tfsdk:"permission_set_arns"`
}

type AwsWorkloadIdentityCredential struct {
	RoleArn string `json:"roleArn" tfsdk:"role_arn"`
}

type AzureAuthConfig struct {
	Type       string        `json:"type" tfsdk:"type"`
	Credential *types.Secret `json:"credential,omitzero" tfsdk:"credential"`
}

type AzureCustomerAgreementConfig struct {
	SourceServicePrincipal               AzureGraphApiCredentials `json:"sourceServicePrincipal" tfsdk:"source_service_principal"`
	DestinationEntraId                   string                   `json:"destinationEntraId" tfsdk:"destination_entra_id"`
	SourceEntraTenant                    string                   `json:"sourceEntraTenant" tfsdk:"source_entra_tenant"`
	BillingScope                         string                   `json:"billingScope" tfsdk:"billing_scope"`
	SubscriptionCreationErrorCooldownSec *int64                   `json:"subscriptionCreationErrorCooldownSec,omitzero" tfsdk:"subscription_creation_error_cooldown_sec"`
}

type AzureEnterpriseEnrollmentConfig struct {
	EnrollmentAccountId                  string `json:"enrollmentAccountId" tfsdk:"enrollment_account_id"`
	SubscriptionOfferType                string `json:"subscriptionOfferType" tfsdk:"subscription_offer_type"`
	UseLegacySubscriptionEnrollment      bool   `json:"useLegacySubscriptionEnrollment" tfsdk:"use_legacy_subscription_enrollment"`
	SubscriptionCreationErrorCooldownSec *int64 `json:"subscriptionCreationErrorCooldownSec,omitzero" tfsdk:"subscription_creation_error_cooldown_sec"`
}

type AzureFunction struct {
	AzureFunctionUrl   string `json:"azureFunctionUrl" tfsdk:"azure_function_url"`
	AzureFunctionScope string `json:"azureFunctionScope" tfsdk:"azure_function_scope"`
}

type AzureGraphApiCredentials struct {
	ClientId string          `json:"clientId" tfsdk:"client_id"`
	Auth     AzureAuthConfig `json:"auth" tfsdk:"auth"`
}

type AzureInviteB2BUserConfig struct {
	RedirectUrl             string `json:"redirectUrl" tfsdk:"redirect_url"`
	SendAzureInvitationMail bool   `json:"sendAzureInvitationMail" tfsdk:"send_azure_invitation_mail"`
}

type AzureMeteringConfig struct {
	ServicePrincipal AzureServicePrincipalConfig          `json:"servicePrincipal" tfsdk:"service_principal"`
	Processing       MeshPlatformMeteringProcessingConfig `json:"processing" tfsdk:"processing"`
}

type AzurePlatformConfig struct {
	EntraTenant string                  `json:"entraTenant" tfsdk:"entra_tenant"`
	Replication *AzureReplicationConfig `json:"replication,omitzero" tfsdk:"replication"`
	Metering    *AzureMeteringConfig    `json:"metering,omitzero" tfsdk:"metering"`
}

type AzurePlatformProperties struct {
	AzureRoleMappings      []AzureRoleMappingProperty `json:"azureRoleMappings" tfsdk:"azure_role_mappings"`
	AzureManagementGroupId string                     `json:"azureManagementGroupId" tfsdk:"azure_management_group_id"`
}

type AzurePreProvisionedSubscriptionConfig struct {
	UnusedSubscriptionNamePrefix string `json:"unusedSubscriptionNamePrefix" tfsdk:"unused_subscription_name_prefix"`
}

type AzureReplicationConfig struct {
	ServicePrincipal                           AzureServicePrincipalConfig          `json:"servicePrincipal" tfsdk:"service_principal"`
	UpdateSubscriptionName                     bool                                 `json:"updateSubscriptionName" tfsdk:"update_subscription_name"`
	Provisioning                               *AzureSubscriptionProvisioningConfig `json:"provisioning,omitzero" tfsdk:"provisioning"`
	B2bUserInvitation                          *AzureInviteB2BUserConfig            `json:"b2bUserInvitation,omitzero" tfsdk:"b2b_user_invitation"`
	SubscriptionNamePattern                    string                               `json:"subscriptionNamePattern" tfsdk:"subscription_name_pattern"`
	GroupNamePattern                           string                               `json:"groupNamePattern" tfsdk:"group_name_pattern"`
	AzureRoleMappings                          types.Set[AzureRoleMapping]          `json:"azureRoleMappings" tfsdk:"azure_role_mappings"`
	TenantTags                                 *MeshTenantTags                      `json:"tenantTags,omitzero" tfsdk:"tenant_tags"`
	UserLookUpStrategy                         string                               `json:"userLookUpStrategy" tfsdk:"user_lookup_strategy"`
	SkipUserGroupPermissionCleanup             bool                                 `json:"skipUserGroupPermissionCleanup" tfsdk:"skip_user_group_permission_cleanup"`
	AdministrativeUnitId                       *string                              `json:"administrativeUnitId,omitzero" tfsdk:"administrative_unit_id"`
	AllowHierarchicalManagementGroupAssignment bool                                 `json:"allowHierarchicalManagementGroupAssignment" tfsdk:"allow_hierarchical_management_group_assignment"`
}

type AzureRgPlatformConfig struct {
	EntraTenant string                    `json:"entraTenant" tfsdk:"entra_tenant"`
	Replication *AzureRgReplicationConfig `json:"replication,omitzero" tfsdk:"replication"`
}

type AzureRgPlatformProperties struct {
	AzureRgLocation     string               `json:"azureRgLocation" tfsdk:"azure_rg_location"`
	AzureRgRoleMappings []AzureRgRoleMapping `json:"azureRgRoleMappings" tfsdk:"azure_rg_role_mappings"`
	AzureFunction       *AzureFunction       `json:"azureFunction,omitzero" tfsdk:"azure_function"`
}

type AzureRgReplicationConfig struct {
	ServicePrincipal               AzureServicePrincipalConfig `json:"servicePrincipal" tfsdk:"service_principal"`
	Subscription                   string                      `json:"subscription" tfsdk:"subscription"`
	ResourceGroupNamePattern       string                      `json:"resourceGroupNamePattern" tfsdk:"resource_group_name_pattern"`
	UserGroupNamePattern           string                      `json:"userGroupNamePattern" tfsdk:"user_group_name_pattern"`
	B2bUserInvitation              *AzureInviteB2BUserConfig   `json:"b2bUserInvitation,omitzero" tfsdk:"b2b_user_invitation"`
	UserLookUpStrategy             string                      `json:"userLookUpStrategy" tfsdk:"user_lookup_strategy"`
	TenantTags                     *MeshTenantTags             `json:"tenantTags,omitzero" tfsdk:"tenant_tags"`
	SkipUserGroupPermissionCleanup bool                        `json:"skipUserGroupPermissionCleanup" tfsdk:"skip_user_group_permission_cleanup"`
	AdministrativeUnitId           *string                     `json:"administrativeUnitId,omitzero" tfsdk:"administrative_unit_id"`
}

type AzureRgRoleMapping struct {
	MeshProjectRoleRef     NamedRef `json:"projectRoleRef" tfsdk:"project_role_ref"`
	AzureGroupSuffix       string   `json:"azureGroupSuffix" tfsdk:"azure_group_suffix"`
	AzureRoleDefinitionIds []string `json:"azureRoleDefinitionIds" tfsdk:"azure_role_definition_ids"`
}

type AzureRole struct {
	Alias string `json:"alias" tfsdk:"alias"`
	Id    string `json:"id" tfsdk:"id"`
}

type AzureRoleDefinition struct {
	AzureRoleDefinitionId string  `json:"azureRoleDefinitionId" tfsdk:"azure_role_definition_id"`
	AbacCondition         *string `json:"abacCondition" tfsdk:"abac_condition"`
}

type AzureRoleMapping struct {
	MeshProjectRoleRef NamedRef  `json:"projectRoleRef" tfsdk:"project_role_ref"`
	AzureRole          AzureRole `json:"azureRole" tfsdk:"azure_role"`
}

type AzureRoleMappingProperty struct {
	MeshProjectRoleRef   NamedRef              `json:"projectRoleRef" tfsdk:"project_role_ref"`
	AzureGroupSuffix     string                `json:"azureGroupSuffix" tfsdk:"azure_group_suffix"`
	AzureRoleDefinitions []AzureRoleDefinition `json:"azureRoleDefinitions" tfsdk:"azure_role_definitions"`
}

type AzureServicePrincipalConfig struct {
	ClientId string          `json:"clientId" tfsdk:"client_id"`
	ObjectId string          `json:"objectId" tfsdk:"object_id"`
	Auth     AzureAuthConfig `json:"auth" tfsdk:"auth"`
}

type AzureSubscriptionProvisioningConfig struct {
	SubscriptionOwnerObjectIds types.Set[string]                      `json:"subscriptionOwnerObjectIds" tfsdk:"subscription_owner_object_ids"`
	EnterpriseEnrollment       *AzureEnterpriseEnrollmentConfig       `json:"enterpriseEnrollment,omitzero" tfsdk:"enterprise_enrollment"`
	CustomerAgreement          *AzureCustomerAgreementConfig          `json:"customerAgreement,omitzero" tfsdk:"customer_agreement"`
	PreProvisioned             *AzurePreProvisionedSubscriptionConfig `json:"preProvisioned,omitzero" tfsdk:"pre_provisioned"`
}

type BuildingBlockDeletionMode string

type BuildingBlockLifecycleState string

type BuildingBlockStatus string

type Client struct {
	ApiKey                         MeshApiKeyClient
	BuildingBlock                  MeshBuildingBlockClient
	BuildingBlockV2                MeshBuildingBlockV2Client
	BuildingBlockRun               MeshBuildingBlockRunClient
	BuildingBlockDefinition        MeshBuildingBlockDefinitionClient
	BuildingBlockDefinitionVersion MeshBuildingBlockDefinitionVersionClient
	BuildingBlockRunner            MeshBuildingBlockRunnerClient
	Integration                    MeshIntegrationClient
	LandingZone                    MeshLandingZoneClient
	Location                       MeshLocationClient
	MeshInfo                       MeshInfoClient
	PaymentMethod                  MeshPaymentMethodClient
	Platform                       MeshPlatformClient
	PlatformType                   MeshPlatformTypeClient
	Project                        MeshProjectClient
	ProjectGroupBinding            MeshProjectGroupBindingClient
	ProjectUserBinding             MeshProjectUserBindingClient
	ServiceInstance                MeshServiceInstanceClient
	TagDefinition                  MeshTagDefinitionClient
	Tenant                         MeshTenantClient
	Workspace                      MeshWorkspaceClient
	WorkspaceGroupBinding          MeshWorkspaceGroupBindingClient
	WorkspaceUserBinding           MeshWorkspaceUserBindingClient

	// Endpoint is read by the Terraform provider's meshstack_instance data source.
	Endpoint xurl.URL
}

type CustomMeteringConfig struct {
	Processing *MeshPlatformMeteringProcessingConfig `json:"processing,omitzero" tfsdk:"processing"`
}

type CustomPlatformConfig struct {
	PlatformTypeRef NamedRef              `json:"platformTypeRef" tfsdk:"platform_type_ref"`
	Metering        *CustomMeteringConfig `json:"metering,omitzero" tfsdk:"metering"`
}

type CustomPlatformProperties struct {
}

type GcpMeteringConfig struct {
	ServiceAccount                          GcpServiceAccountConfig              `json:"serviceAccount" tfsdk:"service_account"`
	BigqueryTable                           string                               `json:"bigqueryTable" tfsdk:"bigquery_table"`
	BigqueryTableForCarbonFootprint         *string                              `json:"bigqueryTableForCarbonFootprint,omitzero" tfsdk:"bigquery_table_for_carbon_footprint"`
	CarbonFootprintDataCollectionStartMonth *string                              `json:"carbonFootprintDataCollectionStartMonth,omitzero" tfsdk:"carbon_footprint_data_collection_start_month"`
	PartitionTimeColumn                     string                               `json:"partitionTimeColumn" tfsdk:"partition_time_column"`
	AdditionalFilter                        *string                              `json:"additionalFilter,omitzero" tfsdk:"additional_filter"`
	Processing                              MeshPlatformMeteringProcessingConfig `json:"processing" tfsdk:"processing"`
}

type GcpPlatformConfig struct {
	Replication *GcpReplicationConfig `json:"replication,omitzero" tfsdk:"replication"`
	Metering    *GcpMeteringConfig    `json:"metering,omitzero" tfsdk:"metering"`
}

type GcpPlatformProperties struct {
	GcpCloudFunctionUrl *string          `json:"gcpCloudFunctionUrl,omitzero" tfsdk:"gcp_cloud_function_url"`
	GcpFolderId         *string          `json:"gcpFolderId,omitzero" tfsdk:"gcp_folder_id"`
	GcpRoleMappings     []GcpRoleMapping `json:"gcpRoleMappings" tfsdk:"gcp_role_mappings"`
}

type GcpPlatformRoleMapping struct {
	MeshProjectRoleRef NamedRef `json:"projectRoleRef" tfsdk:"project_role_ref"`
	GcpRole            string   `json:"gcpRole" tfsdk:"gcp_role"`
}

type GcpReplicationConfig struct {
	ServiceAccount                    GcpServiceAccountConfig           `json:"serviceAccount" tfsdk:"service_account"`
	Domain                            string                            `json:"domain" tfsdk:"domain"`
	CustomerId                        string                            `json:"customerId" tfsdk:"customer_id"`
	GroupNamePattern                  string                            `json:"groupNamePattern" tfsdk:"group_name_pattern"`
	ProjectNamePattern                string                            `json:"projectNamePattern" tfsdk:"project_name_pattern"`
	ProjectIdPattern                  string                            `json:"projectIdPattern" tfsdk:"project_id_pattern"`
	BillingAccountId                  string                            `json:"billingAccountId" tfsdk:"billing_account_id"`
	UserLookupStrategy                string                            `json:"userLookupStrategy" tfsdk:"user_lookup_strategy"`
	UsedExternalIdType                *string                           `json:"usedExternalIdType,omitzero" tfsdk:"used_external_id_type"`
	GcpRoleMappings                   types.Set[GcpPlatformRoleMapping] `json:"gcpRoleMappings" tfsdk:"gcp_role_mappings"`
	AllowHierarchicalFolderAssignment bool                              `json:"allowHierarchicalFolderAssignment" tfsdk:"allow_hierarchical_folder_assignment"`
	TenantTags                        *MeshTenantTags                   `json:"tenantTags,omitzero" tfsdk:"tenant_tags"`
	SkipUserGroupPermissionCleanup    bool                              `json:"skipUserGroupPermissionCleanup" tfsdk:"skip_user_group_permission_cleanup"`
}

type GcpRoleMapping struct {
	MeshProjectRoleRef NamedRef `json:"projectRoleRef" tfsdk:"project_role_ref"`
	PlatformRoles      []string `json:"platformRoles" tfsdk:"platform_roles"`
}

type GcpServiceAccountConfig struct {
	Type             string                                   `json:"type" tfsdk:"type"`
	Credential       *types.Secret                            `json:"credential,omitzero" tfsdk:"credential"`
	WorkloadIdentity *GcpServiceAccountWorkloadIdentityConfig `json:"workloadIdentity,omitzero" tfsdk:"workload_identity"`
}

type GcpServiceAccountWorkloadIdentityConfig struct {
	Audience            string `json:"audience" tfsdk:"audience"`
	ServiceAccountEmail string `json:"serviceAccountEmail" tfsdk:"service_account_email"`
}

type HttpError = http.Error

type KubernetesClientConfig struct {
	AccessToken types.Secret `json:"accessToken" tfsdk:"access_token"`
}

type KubernetesMeteringConfig struct {
	ClientConfig KubernetesClientConfig               `json:"clientConfig" tfsdk:"client_config"`
	Processing   MeshPlatformMeteringProcessingConfig `json:"processing" tfsdk:"processing"`
}

type KubernetesPlatformConfig struct {
	BaseUrl              string                       `json:"baseUrl" tfsdk:"base_url"`
	DisableSslValidation bool                         `json:"disableSslValidation" tfsdk:"disable_ssl_validation"`
	Replication          *KubernetesReplicationConfig `json:"replication" tfsdk:"replication"`
	Metering             *KubernetesMeteringConfig    `json:"metering,omitzero" tfsdk:"metering"`
}

type KubernetesPlatformProperties struct {
	KubernetesRoleMappings []KubernetesRoleMapping `json:"kubernetesRoleMappings" tfsdk:"kubernetes_role_mappings"`
}

type KubernetesReplicationConfig struct {
	ClientConfig         KubernetesClientConfig `json:"clientConfig" tfsdk:"client_config"`
	NamespaceNamePattern string                 `json:"namespaceNamePattern" tfsdk:"namespace_name_pattern"`
}

type KubernetesRoleMapping struct {
	MeshProjectRoleRef NamedRef `json:"projectRoleRef" tfsdk:"project_role_ref"`
	PlatformRoles      []string `json:"platformRoles" tfsdk:"platform_roles"`
}

type MeshApiKey struct {
	Metadata MeshApiKeyMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshApiKeySpec     `json:"spec" tfsdk:"spec"`
	Status   *MeshApiKeyStatus  `json:"status,omitzero" tfsdk:"status"`
}

type MeshApiKeyClient interface {
	Create(ctx context.Context, apiKey *MeshApiKey) (*MeshApiKey, error)
	Read(ctx context.Context, uuid string) (*MeshApiKey, error)
	Update(ctx context.Context, uuid string, apiKey *MeshApiKey) (*MeshApiKey, error)
	Delete(ctx context.Context, uuid string) error
}

type MeshApiKeyMetadata struct {
	Uuid             *string `json:"uuid,omitzero" tfsdk:"uuid"`
	OwnedByWorkspace string  `json:"ownedByWorkspace" tfsdk:"owned_by_workspace"`
}

type MeshApiKeySpec struct {
	DisplayName string                   `json:"displayName" tfsdk:"display_name"`
	Permissions types.Set[ApiPermission] `json:"permissions" tfsdk:"permissions"`
	ExpiresAt   *string                  `json:"expiresAt,omitzero" tfsdk:"expires_at"`
}

type MeshApiKeyStatus struct {
	ClientId     string  `json:"clientId" tfsdk:"client_id"`
	ClientSecret *string `json:"clientSecret,omitzero" tfsdk:"client_secret"`
}

type MeshAwsWifProvider struct {
	Audience   string `json:"audience" tfsdk:"audience"`
	Thumbprint string `json:"thumbprint" tfsdk:"thumbprint"`
}

type MeshBuildingBlock struct {
	Metadata MeshBuildingBlockMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshBuildingBlockSpec     `json:"spec" tfsdk:"spec"`
	Status   MeshBuildingBlockStatus   `json:"status" tfsdk:"status"`
}

type MeshBuildingBlockClient interface {
	Read(ctx context.Context, uuid string) (*MeshBuildingBlock, error)
	Create(ctx context.Context, bb *MeshBuildingBlockCreate) (*MeshBuildingBlock, error)
	Delete(ctx context.Context, uuid string) error
}

type MeshBuildingBlockCreate struct {
	Metadata MeshBuildingBlockCreateMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshBuildingBlockSpec           `json:"spec" tfsdk:"spec"`
}

type MeshBuildingBlockCreateMetadata struct {
	DefinitionUuid    string `json:"definitionUuid" tfsdk:"definition_uuid"`
	DefinitionVersion int64  `json:"definitionVersion" tfsdk:"definition_version"`
	TenantIdentifier  string `json:"tenantIdentifier" tfsdk:"tenant_identifier"`
}

type MeshBuildingBlockDefinition struct {
	Metadata MeshBuildingBlockDefinitionMetadata `json:"metadata"`
	Spec     MeshBuildingBlockDefinitionSpec     `json:"spec"`
	Status   *MeshBuildingBlockDefinitionStatus  `json:"status,omitzero"`
}

type MeshBuildingBlockDefinitionApprovalPolicies struct {
	VersionUpgrade        bool `json:"versionUpgrade" tfsdk:"version_upgrade"`
	UserInputChanges      bool `json:"userInputChanges" tfsdk:"user_input_changes"`
	ManualTriggers        bool `json:"manualTriggers" tfsdk:"manual_triggers"`
	BuildingBlockCreation bool `json:"buildingBlockCreation" tfsdk:"building_block_creation"`
	AnyInputChanges       bool `json:"anyInputChanges" tfsdk:"any_input_changes"`
}

type MeshBuildingBlockDefinitionAzureDevOpsPipelineImplementation struct {
	Project        string  `json:"project" tfsdk:"project"`
	PipelineID     string  `json:"pipelineId" tfsdk:"pipeline_id"`
	RefName        *string `json:"refName,omitzero" tfsdk:"ref_name"`
	Async          bool    `json:"async" tfsdk:"async"`
	IntegrationRef UuidRef `json:"integrationRef" tfsdk:"integration_ref"`
}

type MeshBuildingBlockDefinitionClient interface {
	List(ctx context.Context, workspaceIdentifier *string) ([]MeshBuildingBlockDefinition, error)
	Read(ctx context.Context, uuid string) (*MeshBuildingBlockDefinition, error)
	Create(ctx context.Context, definition MeshBuildingBlockDefinition) (*MeshBuildingBlockDefinition, error)
	Update(ctx context.Context, uuid string, definition MeshBuildingBlockDefinition) (*MeshBuildingBlockDefinition, error)
	Delete(ctx context.Context, uuid string) error
}

type MeshBuildingBlockDefinitionGitHubWorkflowsImplementation struct {
	Repository         string  `json:"repository" tfsdk:"repository"`
	Branch             string  `json:"branch" tfsdk:"branch"`
	ApplyWorkflow      string  `json:"applyWorkflow" tfsdk:"apply_workflow"`
	DestroyWorkflow    *string `json:"destroyWorkflow" tfsdk:"destroy_workflow"`
	Async              bool    `json:"async" tfsdk:"async"`
	OmitRunObjectInput bool    `json:"omitRunObjectInput" tfsdk:"omit_run_object_input"`
	IntegrationRef     UuidRef `json:"integrationRef" tfsdk:"integration_ref"`
}

type MeshBuildingBlockDefinitionGitLabPipelineImplementation struct {
	ProjectID            string       `json:"projectId" tfsdk:"project_id"`
	RefName              string       `json:"refName" tfsdk:"ref_name"`
	IntegrationRef       UuidRef      `json:"integrationRef" tfsdk:"integration_ref"`
	PipelineTriggerToken types.Secret `json:"pipelineTriggerToken" tfsdk:"pipeline_trigger_token"`
}

type MeshBuildingBlockDefinitionImplementation struct {
	Type                enum.Entry[MeshBuildingBlockImplementationType]               `json:"type" tfsdk:"-"`
	Manual              *MeshBuildingBlockDefinitionManualImplementation              `json:"manual,omitzero" tfsdk:"manual"`
	GithubWorkflows     *MeshBuildingBlockDefinitionGitHubWorkflowsImplementation     `json:"githubWorkflows,omitzero" tfsdk:"github_workflows"`
	AzureDevOpsPipeline *MeshBuildingBlockDefinitionAzureDevOpsPipelineImplementation `json:"azureDevOpsPipeline,omitzero" tfsdk:"azure_devops_pipeline"`
	GitlabPipeline      *MeshBuildingBlockDefinitionGitLabPipelineImplementation      `json:"gitlabPipeline,omitzero" tfsdk:"gitlab_pipeline"`
	Terraform           *MeshBuildingBlockDefinitionTerraformImplementation           `json:"terraform,omitzero" tfsdk:"terraform"`
}

type MeshBuildingBlockDefinitionInput struct {
	DisplayName    string                               `json:"displayName" tfsdk:"display_name"`
	Type           MeshBuildingBlockIOType              `json:"type" tfsdk:"type"`
	AssignmentType MeshBuildingBlockInputAssignmentType `json:"assignmentType" tfsdk:"assignment_type"`
	IsEnvironment  bool                                 `json:"isEnvironment" tfsdk:"is_environment"`
	IsSensitive    bool                                 `json:"isSensitive" tfsdk:"-"`
	// If IsSensitive is true, the [types.Variant] (typedef [types.SecretOrAny]) for fields
	// MeshBuildingBlockDefinitionInputAdapter.Argument and
	// MeshBuildingBlockDefinitionInputAdapter.DefaultValue
	// is of [types.Secret] (case [types.Variant.X]).
	// Otherwise, the [types.Variant] is of [types.Any] (case [types.Variant.Y]).
	// As this is a fallback detection when JSON (un)marshaling,
	// types.Any must go second as [types.Variant] intentionally prefers X over Y.
	Argument                    types.SecretOrAny `json:"argument" tfsdk:"argument"`
	DefaultValue                types.SecretOrAny `json:"defaultValue" tfsdk:"default_value"`
	UpdateableByConsumer        bool              `json:"updateableByConsumer" tfsdk:"updateable_by_consumer"`
	IsOptional                  bool              `json:"isOptional,omitzero" tfsdk:"is_optional"`
	SelectableValues            types.Set[string] `json:"selectableValues,omitempty" tfsdk:"selectable_values"`
	Description                 *string           `json:"description,omitzero" tfsdk:"description"`
	ValueValidationRegex        *string           `json:"valueValidationRegex,omitzero" tfsdk:"value_validation_regex"`
	ValidationRegexErrorMessage *string           `json:"validationRegexErrorMessage,omitzero" tfsdk:"validation_regex_error_message"`
	// The form this input is filled in through, as a JSON Schema string. Only for MeshBuildingBlockIOTypeJson.
	JsonSchema *string `json:"jsonSchema,omitzero" tfsdk:"json_schema"`
	Condition  *string `json:"condition,omitzero" tfsdk:"condition"`
	// No omitempty: a 0 (the schema default, and what an unknown plan value collapses to) must be sent so
	// the backend stores it verbatim. With omitempty the 0 would be dropped and the backend would assign
	// a position itself, making the applied value differ from the plan.
	DisplayOrder int64 `json:"displayOrder" tfsdk:"display_order"`
}

type MeshBuildingBlockDefinitionManualImplementation struct{}

type MeshBuildingBlockDefinitionMetadata struct {
	Uuid             *string             `json:"uuid,omitzero" tfsdk:"uuid"`
	OwnedByWorkspace string              `json:"ownedByWorkspace" tfsdk:"owned_by_workspace"`
	Tags             map[string][]string `json:"tags" tfsdk:"tags"`
}

type MeshBuildingBlockDefinitionOutput struct {
	DisplayName    string                                          `json:"displayName" tfsdk:"display_name"`
	Type           MeshBuildingBlockIOType                         `json:"type" tfsdk:"type"`
	AssignmentType MeshBuildingBlockDefinitionOutputAssignmentType `json:"assignmentType" tfsdk:"assignment_type"`
	// No omitempty so a 0 is sent, not dropped (see MeshBuildingBlockDefinitionInput.DisplayOrder).
	DisplayOrder int64 `json:"displayOrder" tfsdk:"display_order"`
}

type MeshBuildingBlockDefinitionOutputAssignmentType string

type MeshBuildingBlockDefinitionSchedule struct {
	Mode              MeshBuildingBlockScheduleMode      `json:"mode" tfsdk:"mode"`
	Frequency         MeshBuildingBlockScheduleFrequency `json:"frequency" tfsdk:"frequency"`
	AutomaticApproval bool                               `json:"automaticApproval" tfsdk:"automatic_approval"`
}

type MeshBuildingBlockDefinitionSpec struct {
	DisplayName           string                                      `json:"displayName" tfsdk:"display_name"`
	DisplayNameTemplate   *string                                     `json:"displayNameTemplate,omitzero" tfsdk:"display_name_template"`
	TargetType            MeshBuildingBlockType                       `json:"targetType" tfsdk:"target_type"`
	Description           string                                      `json:"description" tfsdk:"description"`
	Readme                *string                                     `json:"readme,omitzero" tfsdk:"readme"`
	RunTransparency       bool                                        `json:"runTransparency" tfsdk:"run_transparency"`
	ApprovalPolicies      MeshBuildingBlockDefinitionApprovalPolicies `json:"approvalPolicies" tfsdk:"approval_policies"`
	Schedule              MeshBuildingBlockDefinitionSchedule         `json:"schedule" tfsdk:"schedule"`
	UseInLandingZonesOnly bool                                        `json:"useInLandingZonesOnly" tfsdk:"use_in_landing_zones_only"`
	SupportURL            *string                                     `json:"supportUrl,omitzero" tfsdk:"support_url"`
	DocumentationURL      *string                                     `json:"documentationUrl,omitzero" tfsdk:"documentation_url"`
	// NotificationSubscribers can also specify emails with prefix 'email:', so it's not only usernames (as the JSON field name suggests)!
	NotificationSubscribers types.Set[string]   `json:"notificationSubscriberUsernames,omitempty" tfsdk:"notification_subscribers"`
	Symbol                  *string             `json:"symbol,omitzero" tfsdk:"symbol"`
	SupportedPlatforms      types.Set[NamedRef] `json:"supportedPlatforms" tfsdk:"supported_platforms"`
}

type MeshBuildingBlockDefinitionSshKnownHost struct {
	Host     string `json:"host" tfsdk:"host"`
	KeyType  string `json:"keyType" tfsdk:"key_type"`
	KeyValue string `json:"keyValue" tfsdk:"key_value"`
}

type MeshBuildingBlockDefinitionStatus struct {
	UsageCount                *int64                                     `json:"usageCount"`
	Versions                  []MeshBuildingBlockDefinitionStatusVersion `json:"versions"`
	LatestVersion             int64                                      `json:"latestVersion"`
	LatestVersionUuid         string                                     `json:"latestVersionUuid"`
	LatestReleasedVersion     *int64                                     `json:"latestReleasedVersion"`
	LatestReleasedVersionUuid *string                                    `json:"latestReleasedVersionUuid"`
}

type MeshBuildingBlockDefinitionStatusVersion struct {
	VersionUuid   string                                  `json:"versionUuid"`
	VersionNumber int64                                   `json:"versionNumber"`
	State         MeshBuildingBlockDefinitionVersionState `json:"state"`
}

type MeshBuildingBlockDefinitionTerraformImplementation struct {
	TerraformVersion           string                                   `json:"terraformVersion" tfsdk:"terraform_version"`
	RepositoryURL              string                                   `json:"repositoryUrl" tfsdk:"repository_url"`
	Async                      bool                                     `json:"async" tfsdk:"async"`
	RepositoryPath             *string                                  `json:"repositoryPath,omitzero" tfsdk:"repository_path"`
	RefName                    *string                                  `json:"refName,omitzero" tfsdk:"ref_name"`
	SSHKnownHost               *MeshBuildingBlockDefinitionSshKnownHost `json:"sshKnownHost,omitzero" tfsdk:"ssh_known_host"`
	UseMeshHTTPBackendFallback bool                                     `json:"useMeshHttpBackendFallback" tfsdk:"use_mesh_http_backend_fallback"`
	SSHPrivateKey              *types.Secret                            `json:"sshPrivateKey,omitzero" tfsdk:"ssh_private_key"`
	PreRunScript               *string                                  `json:"preRunScript,omitzero" tfsdk:"pre_run_script"`
}

type MeshBuildingBlockDefinitionVersion struct {
	Metadata MeshBuildingBlockDefinitionVersionMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshBuildingBlockDefinitionVersionSpec     `json:"spec" tfsdk:"spec"`
	Status   *MeshBuildingBlockDefinitionVersionStatus  `json:"status,omitzero" tfsdk:"status"`
}

type MeshBuildingBlockDefinitionVersionClient interface {
	List(ctx context.Context, buildingBlockDefinitionUuid string) ([]MeshBuildingBlockDefinitionVersion, error)
	Create(ctx context.Context, ownedByWorkspace string, versionSpec MeshBuildingBlockDefinitionVersionSpec) (*MeshBuildingBlockDefinitionVersion, error)
	Update(ctx context.Context, uuid, ownedByWorkspace string, versionSpec MeshBuildingBlockDefinitionVersionSpec) (*MeshBuildingBlockDefinitionVersion, error)
}

type MeshBuildingBlockDefinitionVersionMetadata struct {
	Uuid             string `json:"uuid"`
	OwnedByWorkspace string `json:"ownedByWorkspace"`
	CreatedOn        string `json:"createdOn"`
}

type MeshBuildingBlockDefinitionVersionSpec struct {
	BuildingBlockDefinitionRef *UuidRef                                     `json:"buildingBlockDefinitionRef" tfsdk:"-"`
	OnlyApplyOncePerTenant     bool                                         `json:"onlyApplyOncePerTenant" tfsdk:"only_apply_once_per_tenant"`
	DeletionMode               BuildingBlockDeletionMode                    `json:"deletionMode" tfsdk:"deletion_mode"`
	Permissions                types.Set[ApiPermission]                     `json:"permissions,omitempty" tfsdk:"permissions"`
	Outputs                    map[string]MeshBuildingBlockDefinitionOutput `json:"outputs" tfsdk:"outputs"`
	VersionNumber              *int64                                       `json:"versionNumber,omitzero" tfsdk:"version_number"`
	State                      *MeshBuildingBlockDefinitionVersionState     `json:"state,omitzero" tfsdk:"state"`
	RunnerRef                  *UuidRef                                     `json:"runnerRef" tfsdk:"runner_ref"`
	// Replaces the deprecated bare-UUID dependencyDefinitionUuids; requires a backend serving it.
	DependencyDefinitionRefs types.Set[UuidRef]                           `json:"dependencyDefinitionRefs,omitempty" tfsdk:"dependency_refs"`
	Implementation           MeshBuildingBlockDefinitionImplementation    `json:"implementation" tfsdk:"implementation"`
	Inputs                   map[string]*MeshBuildingBlockDefinitionInput `json:"inputs" tfsdk:"inputs"`
}

type MeshBuildingBlockDefinitionVersionState string

type MeshBuildingBlockDefinitionVersionStatus struct {
	State      MeshBuildingBlockDefinitionVersionState `json:"state" tfsdk:"state"`
	UsageCount int64                                   `json:"usageCount" tfsdk:"usage_count"`
}

type MeshBuildingBlockIO struct {
	Key       string `json:"key" tfsdk:"key"`
	Value     any    `json:"value" tfsdk:"value"`
	ValueType string `json:"valueType" tfsdk:"value_type"`
}

type MeshBuildingBlockIOType string

type MeshBuildingBlockImplementationType string

type MeshBuildingBlockInput struct {
	Value          types.SecretOrAny                                `json:"value" tfsdk:"value"`
	ValueType      *enum.Entry[MeshBuildingBlockIOType]             `json:"valueType,omitzero" tfsdk:"-"`
	AssignmentType enum.Entry[MeshBuildingBlockInputAssignmentType] `json:"assignmentType,omitempty" tfsdk:"-"`

	// If IsSensitive is true, the [types.Variant] (typedef [types.SecretOrAny]) for Value field
	// is of [types.Secret] (case [types.Variant.X]).
	// Otherwise, the [types.Variant] is of [types.Any] (case [types.Variant.Y]).
	// As this is a fallback detection when JSON (un)marshaling,
	// types.Any must go second as [types.Variant] intentionally prefers X over Y.
	IsSensitive bool `json:"isSensitive" tfsdk:"-"`
}

type MeshBuildingBlockInputAssignmentType string

type MeshBuildingBlockMetadata struct {
	Uuid                string  `json:"uuid" tfsdk:"uuid"`
	DefinitionUuid      string  `json:"definitionUuid" tfsdk:"definition_uuid"`
	DefinitionVersion   int64   `json:"definitionVersion" tfsdk:"definition_version"`
	TenantIdentifier    string  `json:"tenantIdentifier" tfsdk:"tenant_identifier"`
	ForcePurge          bool    `json:"forcePurge" tfsdk:"force_purge"`
	CreatedOn           string  `json:"createdOn" tfsdk:"created_on"`
	MarkedForDeletionOn *string `json:"markedForDeletionOn" tfsdk:"marked_for_deletion_on"`
	MarkedForDeletionBy *string `json:"markedForDeletionBy" tfsdk:"marked_for_deletion_by"`
}

type MeshBuildingBlockOutput struct {
	Value          types.Any                                                   `json:"value" tfsdk:"value"`
	ValueType      enum.Entry[MeshBuildingBlockIOType]                         `json:"valueType" tfsdk:"value_type"`
	AssignmentType enum.Entry[MeshBuildingBlockDefinitionOutputAssignmentType] `json:"assignmentType" tfsdk:"assignment_type"`
}

type MeshBuildingBlockParent struct {
	BuildingBlockUuid string `json:"buildingBlockUuid" tfsdk:"buildingblock_uuid"`
	DefinitionUuid    string `json:"definitionUuid" tfsdk:"definition_uuid"`
}

type MeshBuildingBlockRun struct {
	Metadata MeshBuildingBlockRunMetadata `json:"metadata"`
	Spec     MeshBuildingBlockRunSpec     `json:"spec"`
	Status   string                       `json:"status"`
}

type MeshBuildingBlockRunClient interface {
	GetLogs(ctx context.Context, runUuid string) (MeshBuildingBlockRunLogs, error)
}

type MeshBuildingBlockRunLogs struct {
	Steps []MeshBuildingBlockRunStepLog `json:"steps"`
}

type MeshBuildingBlockRunMetadata struct {
	Uuid      string `json:"uuid"`
	CreatedOn string `json:"createdOn"`
}

type MeshBuildingBlockRunSpec struct {
	RunNumber int64  `json:"runNumber"`
	Behavior  string `json:"behavior"`
}

type MeshBuildingBlockRunStepLog struct {
	DisplayName   string  `json:"displayName"`
	Status        string  `json:"status"`
	UserMessage   *string `json:"userMessage"`
	SystemMessage *string `json:"systemMessage"`
}

type MeshBuildingBlockRunner struct {
	Metadata MeshBuildingBlockRunnerMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshBuildingBlockRunnerSpec     `json:"spec" tfsdk:"spec"`
}

type MeshBuildingBlockRunnerClient interface {
	Create(ctx context.Context, runner MeshBuildingBlockRunner) (*MeshBuildingBlockRunner, error)
	Read(ctx context.Context, uuid string) (*MeshBuildingBlockRunner, error)
	Update(ctx context.Context, runner MeshBuildingBlockRunner) (*MeshBuildingBlockRunner, error)
	Delete(ctx context.Context, uuid string) error
}

type MeshBuildingBlockRunnerImplementationType string

type MeshBuildingBlockRunnerMetadata struct {
	Uuid             *string `json:"uuid,omitzero" tfsdk:"uuid"`
	OwnedByWorkspace string  `json:"ownedByWorkspace" tfsdk:"owned_by_workspace"`
	CreatedOn        *string `json:"createdOn,omitzero" tfsdk:"created_on"`
	LastSeen         *string `json:"lastSeen,omitzero" tfsdk:"last_seen"`
}

type MeshBuildingBlockRunnerSpec struct {
	DisplayName                string                         `json:"displayName" tfsdk:"display_name"`
	PublicKey                  string                         `json:"publicKey" tfsdk:"public_key"`
	ImplementationType         string                         `json:"implementationType" tfsdk:"implementation_type"`
	Restriction                *string                        `json:"restriction,omitzero" tfsdk:"restriction"`
	IsSelfHosted               *bool                          `json:"isSelfHosted,omitzero" tfsdk:"is_self_hosted"`
	WorkloadIdentityFederation *MeshRunnerWorkloadIdentityFed `json:"workloadIdentityFederation,omitzero" tfsdk:"workload_identity_federation"`
}

type MeshBuildingBlockScheduleFrequency string

type MeshBuildingBlockScheduleMode string

type MeshBuildingBlockSpec struct {
	DisplayName          string                    `json:"displayName" tfsdk:"display_name"`
	Inputs               []MeshBuildingBlockIO     `json:"inputs" tfsdk:"inputs"`
	ParentBuildingBlocks []MeshBuildingBlockParent `json:"parentBuildingBlocks" tfsdk:"parent_building_blocks"`
}

type MeshBuildingBlockStatus struct {
	Status  string                `json:"status" tfsdk:"status"`
	Outputs []MeshBuildingBlockIO `json:"outputs" tfsdk:"outputs"`
}

type MeshBuildingBlockTagInputTarget string

type MeshBuildingBlockType string

type MeshBuildingBlockV2 struct {
	Metadata MeshBuildingBlockV2Metadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshBuildingBlockV2Spec     `json:"spec" tfsdk:"spec"`
	Status   *MeshBuildingBlockV2Status  `json:"status" tfsdk:"status"`
}

type MeshBuildingBlockV2Client interface {
	Read(ctx context.Context, uuid string) (*MeshBuildingBlockV2, error)
	ReadFunc(uuid string) func(ctx context.Context) (*MeshBuildingBlockV2, error)
	List(ctx context.Context, filter MeshBuildingBlockV2ListFilter) ([]MeshBuildingBlockV2, error)
	Create(ctx context.Context, bb *MeshBuildingBlockV2) (*MeshBuildingBlockV2, error)
	Update(ctx context.Context, bb *MeshBuildingBlockV2) (*MeshBuildingBlockV2, error)
	Delete(ctx context.Context, uuid string, purge bool) error
	TriggerRun(ctx context.Context, uuid string) error
}

type MeshBuildingBlockV2DefinitionVersionRef struct {
	UuidRef

	// ContentHash is a Terraform-only field (json:"-", never sent to or returned by the backend).
	// It lets a config signal that the referenced version's content changed so a rerun is triggered
	// even though the version uuid is unchanged. The building_block (v3) resource honors it via the
	// shared rerunNeeded predicate used by both ModifyPlan and Update.
	ContentHash *string `json:"-" tfsdk:"content_hash"`
}

type MeshBuildingBlockV2Lifecycle struct {
	State enum.Entry[BuildingBlockLifecycleState] `json:"state" tfsdk:"state"`
}

type MeshBuildingBlockV2ListFilter struct {
	WorkspaceIdentifier *string `json:"workspaceIdentifier"`
	ProjectIdentifier   *string `json:"projectIdentifier"`
	PlatformIdentifier  *string `json:"platformIdentifier"`
	Name                *string `json:"name"`
	// DefinitionUuid filters by the owning building block definition's UUID (not a version).
	DefinitionUuid *string `json:"definitionUuid"`
	// VersionUuid filters by a specific building block definition version UUID.
	VersionUuid *string `json:"versionUuid"`
	// VersionNumber filters by the literal definition version number. The backend parses it
	// leniently, so both "v1" and "1" match version 1.
	VersionNumber *string `json:"versionNumber"`
	TenantUuid    *string `json:"tenantUuid"`
	// TargetKind filters by target ref kind, one of meshTenant or meshWorkspace.
	TargetKind *string `json:"targetRefKind"`
	Status     *string `json:"status"`
	// ManagedByWorkspaceIdentifier and ManagedByDefinitionUuid select the platform-operator
	// (managed) permission scope: building blocks created from definitions owned by the given
	// workspace / definition. Requires the MANAGED_BUILDINGBLOCK_LIST authority.
	ManagedByWorkspaceIdentifier *string `json:"managedByWorkspaceIdentifier"`
	ManagedByDefinitionUuid      *string `json:"managedByDefinitionUuid"`
}

type MeshBuildingBlockV2Metadata struct {
	Uuid             *string `json:"uuid" tfsdk:"uuid"`
	OwnedByWorkspace string  `json:"ownedByWorkspace" tfsdk:"owned_by_workspace"`
}

type MeshBuildingBlockV2Parent struct {
	UuidRef

	// BuildingBlockUuid identifies the parent and always holds the same value as Uuid.
	BuildingBlockUuid string `json:"buildingBlockUuid"`
	// DefinitionUuid is the parent's building block definition. The backend derives it from the
	// referenced block, so every response carries it and a request never does.
	DefinitionUuid string `json:"definitionUuid,omitempty"`
}

type MeshBuildingBlockV2Spec struct {
	BuildingBlockDefinitionVersionRef MeshBuildingBlockV2DefinitionVersionRef `json:"buildingBlockDefinitionVersionRef" tfsdk:"building_block_definition_version_ref"`
	TargetRef                         MeshBuildingBlockV2TargetRef            `json:"targetRef" tfsdk:"target_ref"`
	DisplayName                       string                                  `json:"displayName" tfsdk:"display_name"`

	// Inputs as pointer MeshBuildingBlockInput to support mocking secret responses.
	Inputs                  map[string]*MeshBuildingBlockInput `json:"inputs" tfsdk:"inputs"`
	ParentBuildingBlockRefs types.Set[UuidRef]                 `json:"parentBuildingBlockRefs" tfsdk:"parent_building_block_refs"`

	// ParentBuildingBlocks holds the deprecated parentBuildingBlocks field. MarshalJSON and
	// UnmarshalJSON put it on the wire and take it off again, and the deprecated
	// meshstack_building_block_v2 surfaces read it for the definition uuid they report.
	ParentBuildingBlocks types.Set[MeshBuildingBlockV2Parent] `json:"-" tfsdk:"-"`
}

type MeshBuildingBlockV2Status struct {
	Status     enum.Entry[BuildingBlockStatus]    `json:"status" tfsdk:"status"`
	Outputs    map[string]MeshBuildingBlockOutput `json:"outputs" tfsdk:"outputs"`
	ForcePurge bool                               `json:"forcePurge" tfsdk:"force_purge"`
	Lifecycle  MeshBuildingBlockV2Lifecycle       `json:"lifecycle" tfsdk:"-"`
	// LatestRunUuid tracks the latest *modifying* (apply/destroy) run and excludes dry runs. It is nil
	// only when no such run exists: run_transparency gates reading the run and its system messages, not
	// this identifier (MeshBuildingBlockV2RepresentationModelAssembler.resolveLatestRunUuid).
	LatestRunUuid *string `json:"latestRunUuid" tfsdk:"latest_run_uuid"`
	// LatestDryRunUuid is the latest dry (DETECT) run, but only when it is the newest run; nil otherwise.
	// Ungated like LatestRunUuid.
	LatestDryRunUuid *string `json:"latestDryRunUuid" tfsdk:"latest_dry_run_uuid"`
}

type MeshBuildingBlockV2TargetRef struct {
	Kind string  `json:"kind" tfsdk:"kind"`
	Uuid *string `json:"uuid" tfsdk:"uuid"`
	Name *string `json:"name" tfsdk:"name"`
}

type MeshFeatureFlag string

type MeshInfo struct {
	Version string `json:"version" tfsdk:"version"`
	// Is4EPEnabled means "Is four-eyes principle enabled"
	Is4EPEnabled             bool              `json:"is4EPEnabled" tfsdk:"-"`
	Metadata                 map[string]string `json:"metadata" tfsdk:"metadata"`
	AdminWorkspaceIdentifier string            `json:"adminWorkspaceIdentifier" tfsdk:"admin_workspace_identifier"`
	Issuer                   xurl.URL          `json:"issuer" tfsdk:"-"`
	CliClientId              string            `json:"cliClientId" tfsdk:"-"`
}

type MeshInfoClient interface {
	Read(ctx context.Context) (MeshInfo, error)
}

type MeshIntegration struct {
	Metadata MeshIntegrationMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshIntegrationSpec     `json:"spec" tfsdk:"spec"`
	Status   *MeshIntegrationStatus  `json:"status" tfsdk:"status"`
}

type MeshIntegrationAzureDevopsConfig struct {
	BaseUrl             string       `json:"baseUrl" tfsdk:"base_url"`
	Organization        string       `json:"organization" tfsdk:"organization"`
	PersonalAccessToken types.Secret `json:"personalAccessToken" tfsdk:"personal_access_token"`
	RunnerRef           *UuidRef     `json:"runnerRef" tfsdk:"runner_ref"`
}

type MeshIntegrationClient interface {
	Create(ctx context.Context, integration MeshIntegration) (*MeshIntegration, error)
	Read(ctx context.Context, uuid string) (*MeshIntegration, error)
	Update(ctx context.Context, integration MeshIntegration) (*MeshIntegration, error)
	Delete(ctx context.Context, uuid string) error
	List(ctx context.Context) ([]MeshIntegration, error)
}

type MeshIntegrationConfig struct {
	Type        enum.Entry[MeshIntegrationConfigType] `json:"type" tfsdk:"-"`
	Github      *MeshIntegrationGithubConfig          `json:"github,omitzero" tfsdk:"github"`
	Gitlab      *MeshIntegrationGitlabConfig          `json:"gitlab,omitzero" tfsdk:"gitlab"`
	AzureDevops *MeshIntegrationAzureDevopsConfig     `json:"azuredevops,omitzero" tfsdk:"azuredevops"`
	EntraId     *MeshIntegrationEntraIdConfig         `json:"entraid,omitzero" tfsdk:"entraid"`
}

type MeshIntegrationConfigType string

type MeshIntegrationEntraIdConfig struct {
	TenantId     string       `json:"tenantId" tfsdk:"tenant_id"`
	ClientId     string       `json:"clientId" tfsdk:"client_id"`
	ClientSecret types.Secret `json:"clientSecret" tfsdk:"client_secret"`
	IdpAlias     *string      `json:"idpAlias,omitzero" tfsdk:"idp_alias"`
	// meshStack derives this and returns it inside spec, which configuration writes. A computed value
	// there is unreachable under provider mocks (issue #272), so Terraform reads it from status instead.
	RedirectUrl *string `json:"redirectUrl,omitzero" tfsdk:"-"`
}

type MeshIntegrationGithubConfig struct {
	Owner         string       `json:"owner" tfsdk:"owner"`
	BaseUrl       string       `json:"baseUrl" tfsdk:"base_url"`
	AppId         string       `json:"appId" tfsdk:"app_id"`
	AppPrivateKey types.Secret `json:"appPrivateKey" tfsdk:"app_private_key"`
	RunnerRef     *UuidRef     `json:"runnerRef" tfsdk:"runner_ref"`
}

type MeshIntegrationGitlabConfig struct {
	BaseUrl   string   `json:"baseUrl" tfsdk:"base_url"`
	RunnerRef *UuidRef `json:"runnerRef" tfsdk:"runner_ref"`
}

type MeshIntegrationMetadata struct {
	Uuid             *string `json:"uuid,omitzero" tfsdk:"uuid"`
	OwnedByWorkspace string  `json:"ownedByWorkspace" tfsdk:"owned_by_workspace"`
}

type MeshIntegrationSpec struct {
	DisplayName string                `json:"displayName" tfsdk:"display_name"`
	Config      MeshIntegrationConfig `json:"config" tfsdk:"config"`
}

type MeshIntegrationStatus struct {
	IsBuiltIn                  bool                            `json:"isBuiltIn" tfsdk:"is_built_in"`
	WorkloadIdentityFederation *MeshWorkloadIdentityFederation `json:"workloadIdentityFederation" tfsdk:"workload_identity_federation"`
}

type MeshLandingZone struct {
	Metadata MeshLandingZoneMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshLandingZoneSpec     `json:"spec" tfsdk:"spec"`
	Status   MeshLandingZoneStatus   `json:"status" tfsdk:"status"`
}

type MeshLandingZoneClient interface {
	Read(ctx context.Context, name string) (*MeshLandingZone, error)
	List(ctx context.Context, query MeshLandingZoneListQuery) ([]MeshLandingZone, error)
	Create(ctx context.Context, landingZone *MeshLandingZoneCreate) (*MeshLandingZone, error)
	Update(ctx context.Context, name string, landingZone *MeshLandingZoneCreate) (*MeshLandingZone, error)
	Delete(ctx context.Context, name string) error
}

type MeshLandingZoneCreate struct {
	Metadata MeshLandingZoneMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshLandingZoneSpec     `json:"spec" tfsdk:"spec"`
}

type MeshLandingZoneListQuery struct {
	PlatformUuid     *string `json:"platformUuid"`
	Identifier       *string `json:"identifier"`
	DisplayName      *string `json:"displayName"`
	Restricted       *bool   `json:"restricted"`
	OwnedByWorkspace *string `json:"ownedByWorkspace"`
}

type MeshLandingZoneMetadata struct {
	Name             string              `json:"name" tfsdk:"name"`
	OwnedByWorkspace string              `json:"ownedByWorkspace" tfsdk:"owned_by_workspace"`
	Tags             map[string][]string `json:"tags" tfsdk:"tags"`
}

type MeshLandingZonePlatformProperties struct {
	Type       string                        `json:"type" tfsdk:"type"`
	Aws        *AwsPlatformProperties        `json:"aws" tfsdk:"aws"`
	Aks        *AksPlatformProperties        `json:"aks" tfsdk:"aks"`
	Azure      *AzurePlatformProperties      `json:"azure" tfsdk:"azure"`
	AzureRg    *AzureRgPlatformProperties    `json:"azurerg" tfsdk:"azurerg"`
	Custom     *CustomPlatformProperties     `json:"custom" tfsdk:"custom"`
	Gcp        *GcpPlatformProperties        `json:"gcp" tfsdk:"gcp"`
	Kubernetes *KubernetesPlatformProperties `json:"kubernetes" tfsdk:"kubernetes"`
	OpenShift  *OpenShiftPlatformProperties  `json:"openshift" tfsdk:"openshift"`
}

type MeshLandingZoneQuota struct {
	Key   string `json:"key" tfsdk:"key"`
	Value int64  `json:"value" tfsdk:"value"`
}

type MeshLandingZoneSpec struct {
	DisplayName                 string `json:"displayName" tfsdk:"display_name"`
	Description                 string `json:"description" tfsdk:"description"`
	AutomateDeletionApproval    bool   `json:"automateDeletionApproval" tfsdk:"automate_deletion_approval"`
	AutomateDeletionReplication bool   `json:"automateDeletionReplication" tfsdk:"automate_deletion_replication"`
	// Nullable in the API, where absent means "keep the stored value" — hence no `,omitempty`: the
	// schema defaults this to false, so the provider always states the value it wants and never
	// asks the backend to keep whatever is stored.
	Restricted                   bool                               `json:"restricted" tfsdk:"restricted"`
	InfoLink                     *string                            `json:"infoLink,omitzero" tfsdk:"info_link"`
	PlatformRef                  UuidRef                            `json:"platformRef" tfsdk:"platform_ref"`
	PlatformProperties           *MeshLandingZonePlatformProperties `json:"platformProperties,omitzero" tfsdk:"platform_properties"`
	Quotas                       []MeshLandingZoneQuota             `json:"quotas" tfsdk:"quotas"`
	MandatoryBuildingBlockRefs   []UuidRef                          `json:"mandatoryBuildingBlockRefs" tfsdk:"mandatory_building_block_refs"`
	RecommendedBuildingBlockRefs []UuidRef                          `json:"recommendedBuildingBlockRefs" tfsdk:"recommended_building_block_refs"`
}

type MeshLandingZoneStatus struct {
	Disabled   bool `json:"disabled" tfsdk:"disabled"`
	Restricted bool `json:"restricted" tfsdk:"restricted"`
}

type MeshLocation struct {
	Metadata MeshLocationMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshLocationSpec     `json:"spec" tfsdk:"spec"`
	Status   MeshLocationStatus   `json:"status" tfsdk:"status"`
}

type MeshLocationClient interface {
	Read(ctx context.Context, name string) (*MeshLocation, error)
	Create(ctx context.Context, location *MeshLocationCreate) (*MeshLocation, error)
	Update(ctx context.Context, name string, location *MeshLocationCreate) (*MeshLocation, error)
	Delete(ctx context.Context, name string) error
}

type MeshLocationCreate struct {
	Metadata MeshLocationCreateMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshLocationSpec           `json:"spec" tfsdk:"spec"`
}

type MeshLocationCreateMetadata struct {
	Name             string `json:"name" tfsdk:"name"`
	OwnedByWorkspace string `json:"ownedByWorkspace" tfsdk:"owned_by_workspace"`
}

type MeshLocationMetadata struct {
	Name             string `json:"name" tfsdk:"name"`
	OwnedByWorkspace string `json:"ownedByWorkspace" tfsdk:"owned_by_workspace"`
	Uuid             string `json:"uuid" tfsdk:"uuid"`
}

type MeshLocationSpec struct {
	DisplayName string `json:"displayName" tfsdk:"display_name"`
	Description string `json:"description" tfsdk:"description"`
}

type MeshLocationStatus struct {
	IsPublic bool `json:"isPublic" tfsdk:"is_public"`
}

type MeshPaymentMethod struct {
	Metadata MeshPaymentMethodMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshPaymentMethodSpec     `json:"spec" tfsdk:"spec"`
}

type MeshPaymentMethodClient interface {
	Read(ctx context.Context, identifier string) (*MeshPaymentMethod, error)
	Create(ctx context.Context, paymentMethod *MeshPaymentMethodCreate) (*MeshPaymentMethod, error)
	Update(ctx context.Context, identifier string, paymentMethod *MeshPaymentMethodCreate) (*MeshPaymentMethod, error)
	Delete(ctx context.Context, identifier string) error
}

type MeshPaymentMethodCreate struct {
	Metadata MeshPaymentMethodCreateMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshPaymentMethodSpec           `json:"spec" tfsdk:"spec"`
}

type MeshPaymentMethodCreateMetadata struct {
	Name             string `json:"name" tfsdk:"name"`
	OwnedByWorkspace string `json:"ownedByWorkspace" tfsdk:"owned_by_workspace"`
}

type MeshPaymentMethodMetadata struct {
	Name             string  `json:"name" tfsdk:"name"`
	OwnedByWorkspace string  `json:"ownedByWorkspace" tfsdk:"owned_by_workspace"`
	CreatedOn        string  `json:"createdOn" tfsdk:"created_on"`
	DeletedOn        *string `json:"deletedOn" tfsdk:"deleted_on"`
}

type MeshPaymentMethodSpec struct {
	DisplayName    string              `json:"displayName" tfsdk:"display_name"`
	ExpirationDate *string             `json:"expirationDate,omitzero" tfsdk:"expiration_date"`
	Amount         *int64              `json:"amount,omitzero" tfsdk:"amount"`
	Tags           map[string][]string `json:"tags,omitempty" tfsdk:"tags"`
}

type MeshPlatform struct {
	Metadata MeshPlatformMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshPlatformSpec     `json:"spec" tfsdk:"spec"`
}

type MeshPlatformClient interface {
	Read(ctx context.Context, uuid string) (*MeshPlatform, error)
	List(ctx context.Context, query MeshPlatformListQuery) ([]MeshPlatform, error)
	Create(ctx context.Context, platform MeshPlatform) (*MeshPlatform, error)
	Update(ctx context.Context, uuid string, platform MeshPlatform) (*MeshPlatform, error)
	Delete(ctx context.Context, uuid string) error
}

type MeshPlatformListQuery struct {
	OwnedByWorkspace      *string `json:"ownedByWorkspace"`
	Identifier            *string `json:"identifier"`
	LocationIdentifier    *string `json:"locationIdentifier"`
	DisplayName           *string `json:"displayName"`
	Restriction           *string `json:"restriction"`
	PublicationState      *string `json:"publicationState"`
	ContributingWorkspace *string `json:"contributingWorkspace"`
	// PlatformTypeIdentifier filters by the platform type's identifier (matched backend-side); the type
	// is not carried in the response, and spec.config is redacted for marketplace consumers anyway.
	PlatformTypeIdentifier *string `json:"platformTypeIdentifier"`
}

type MeshPlatformMetadata struct {
	Name             string  `json:"name" tfsdk:"name"`
	OwnedByWorkspace string  `json:"ownedByWorkspace" tfsdk:"owned_by_workspace"`
	Uuid             *string `json:"uuid,omitzero" tfsdk:"uuid"`
}

type MeshPlatformMeteringProcessingConfig struct {
	CompactTimelinesAfterDays int64 `json:"compactTimelinesAfterDays" tfsdk:"compact_timelines_after_days"`
	DeleteRawDataAfterDays    int64 `json:"deleteRawDataAfterDays" tfsdk:"delete_raw_data_after_days"`
}

type MeshPlatformSpec struct {
	DisplayName            string               `json:"displayName" tfsdk:"display_name"`
	Description            string               `json:"description" tfsdk:"description"`
	Endpoint               string               `json:"endpoint" tfsdk:"endpoint"`
	SupportUrl             *string              `json:"supportUrl,omitzero" tfsdk:"support_url"`
	DocumentationUrl       *string              `json:"documentationUrl,omitzero" tfsdk:"documentation_url"`
	AccessInformation      *string              `json:"accessInformation,omitzero" tfsdk:"access_information"`
	LocationRef            NamedRef             `json:"locationRef" tfsdk:"location_ref"`
	ContributingWorkspaces types.Set[string]    `json:"contributingWorkspaces" tfsdk:"contributing_workspaces"`
	Availability           PlatformAvailability `json:"availability" tfsdk:"availability"`
	// Config is nullable in responses: redacted (omitted) for marketplace-consumer callers. Required on write.
	Config           *PlatformConfig            `json:"config,omitzero" tfsdk:"config"`
	QuotaDefinitions types.Set[QuotaDefinition] `json:"quotaDefinitions" tfsdk:"quota_definitions"`
}

type MeshPlatformType struct {
	Metadata MeshPlatformTypeMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshPlatformTypeSpec     `json:"spec" tfsdk:"spec"`
	Status   MeshPlatformTypeStatus   `json:"status" tfsdk:"status"`
}

type MeshPlatformTypeClient interface {
	Create(ctx context.Context, platformType *MeshPlatformTypeCreate) (*MeshPlatformType, error)
	Read(ctx context.Context, identifier string) (*MeshPlatformType, error)
	Update(ctx context.Context, name string, platformType *MeshPlatformTypeCreate) (*MeshPlatformType, error)
	Delete(ctx context.Context, name string) error
	List(ctx context.Context, category *string, lifecycleStatus *string) ([]MeshPlatformType, error)
}

type MeshPlatformTypeCreate struct {
	Metadata MeshPlatformTypeCreateMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshPlatformTypeSpec           `json:"spec" tfsdk:"spec"`
}

type MeshPlatformTypeCreateMetadata struct {
	Name             string `json:"name" tfsdk:"name"`
	OwnedByWorkspace string `json:"ownedByWorkspace" tfsdk:"owned_by_workspace"`
}

type MeshPlatformTypeLifecycle struct {
	State string `json:"state" tfsdk:"state"`
}

type MeshPlatformTypeMetadata struct {
	Name             string  `json:"name" tfsdk:"name"`
	OwnedByWorkspace string  `json:"ownedByWorkspace" tfsdk:"owned_by_workspace"`
	Uuid             *string `json:"uuid,omitzero" tfsdk:"uuid"`
}

type MeshPlatformTypeSpec struct {
	DisplayName     string  `json:"displayName" tfsdk:"display_name"`
	Category        string  `json:"category" tfsdk:"category"`
	DefaultEndpoint *string `json:"defaultEndpoint,omitzero" tfsdk:"default_endpoint"`
	Icon            string  `json:"icon" tfsdk:"icon"`
}

type MeshPlatformTypeStatus struct {
	Lifecycle MeshPlatformTypeLifecycle `json:"lifecycle" tfsdk:"lifecycle"`
}

type MeshProject struct {
	Metadata MeshProjectMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshProjectSpec     `json:"spec" tfsdk:"spec"`
}

type MeshProjectBinding struct {
	Metadata  MeshProjectBindingMetadata `json:"metadata" tfsdk:"metadata"`
	RoleRef   MeshProjectRoleRef         `json:"roleRef" tfsdk:"role_ref"`
	TargetRef MeshProjectTargetRef       `json:"targetRef" tfsdk:"target_ref"`
	Subject   MeshSubject                `json:"subject" tfsdk:"subject"`
}

type MeshProjectBindingMetadata struct {
	Name string `json:"name" tfsdk:"name"`
}

type MeshProjectClient interface {
	Read(ctx context.Context, workspace string, name string) (*MeshProject, error)
	List(ctx context.Context, workspaceIdentifier string, paymentMethodIdentifier *string) ([]MeshProject, error)
	Create(ctx context.Context, project *MeshProjectCreate) (*MeshProject, error)
	Update(ctx context.Context, project *MeshProjectCreate) (*MeshProject, error)
	Delete(ctx context.Context, workspace string, name string) error
}

type MeshProjectCreate struct {
	Metadata MeshProjectCreateMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshProjectSpec           `json:"spec" tfsdk:"spec"`
}

type MeshProjectCreateMetadata struct {
	Name             string `json:"name" tfsdk:"name"`
	OwnedByWorkspace string `json:"ownedByWorkspace" tfsdk:"owned_by_workspace"`
}

type MeshProjectGroupBinding struct {
	MeshProjectBinding
}

type MeshProjectGroupBindingClient interface {
	Read(ctx context.Context, name string) (*MeshProjectGroupBinding, error)
	Create(ctx context.Context, binding *MeshProjectGroupBinding) (*MeshProjectGroupBinding, error)
	Delete(ctx context.Context, name string) error
}

type MeshProjectMetadata struct {
	Name             string  `json:"name" tfsdk:"name"`
	OwnedByWorkspace string  `json:"ownedByWorkspace" tfsdk:"owned_by_workspace"`
	CreatedOn        string  `json:"createdOn" tfsdk:"created_on"`
	DeletedOn        *string `json:"deletedOn" tfsdk:"deleted_on"`
}

type MeshProjectSpec struct {
	DisplayName                       string              `json:"displayName" tfsdk:"display_name"`
	Tags                              map[string][]string `json:"tags" tfsdk:"tags"`
	PaymentMethodIdentifier           *string             `json:"paymentMethodIdentifier" tfsdk:"payment_method_identifier"`
	SubstitutePaymentMethodIdentifier *string             `json:"substitutePaymentMethodIdentifier" tfsdk:"substitute_payment_method_identifier"`
}

type MeshProjectTargetRef struct {
	Name             string `json:"name" tfsdk:"name"`
	OwnedByWorkspace string `json:"ownedByWorkspace" tfsdk:"owned_by_workspace"`
}

type MeshProjectUserBinding struct {
	MeshProjectBinding
}

type MeshProjectUserBindingClient interface {
	Read(ctx context.Context, name string) (*MeshProjectUserBinding, error)
	Create(ctx context.Context, binding *MeshProjectUserBinding) (*MeshProjectUserBinding, error)
	Delete(ctx context.Context, name string) error
}

type MeshRunnerWifProviderConfig struct {
	Audience  string `json:"audience" tfsdk:"audience"`
	TokenPath string `json:"tokenPath" tfsdk:"token_path"`
}

type MeshRunnerWorkloadIdentityFed struct {
	Subject *string                      `json:"subject,omitzero" tfsdk:"subject"`
	Issuer  *string                      `json:"issuer,omitzero" tfsdk:"issuer"`
	Gcp     *MeshRunnerWifProviderConfig `json:"gcp,omitzero" tfsdk:"gcp"`
	Aws     *MeshRunnerWifProviderConfig `json:"aws,omitzero" tfsdk:"aws"`
	Azure   *MeshRunnerWifProviderConfig `json:"azure,omitzero" tfsdk:"azure"`
}

type MeshServiceInstance struct {
	Metadata MeshServiceInstanceMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshServiceInstanceSpec     `json:"spec" tfsdk:"spec"`
}

type MeshServiceInstanceClient interface {
	Read(ctx context.Context, instanceId string) (*MeshServiceInstance, error)
	List(ctx context.Context, filter MeshServiceInstanceFilter) ([]MeshServiceInstance, error)
}

type MeshServiceInstanceFilter struct {
	WorkspaceIdentifier   *string `json:"workspaceIdentifier"`
	ProjectIdentifier     *string `json:"projectIdentifier"`
	MarketplaceIdentifier *string `json:"marketplaceIdentifier"`
	ServiceIdentifier     *string `json:"serviceIdentifier"`
	PlanIdentifier        *string `json:"planIdentifier"`
}

type MeshServiceInstanceMetadata struct {
	OwnedByProject        string `json:"ownedByProject" tfsdk:"owned_by_project"`
	OwnedByWorkspace      string `json:"ownedByWorkspace" tfsdk:"owned_by_workspace"`
	MarketplaceIdentifier string `json:"marketplaceIdentifier" tfsdk:"marketplace_identifier"`
	InstanceId            string `json:"instanceId" tfsdk:"instance_id"`
}

type MeshServiceInstanceSpec struct {
	Creator     string               `json:"creator" tfsdk:"creator"`
	DisplayName string               `json:"displayName" tfsdk:"display_name"`
	PlanId      string               `json:"planId" tfsdk:"plan_id"`
	ServiceId   string               `json:"serviceId" tfsdk:"service_id"`
	Parameters  map[string]types.Any `json:"parameters" tfsdk:"parameters"`
}

type MeshSubject struct {
	Name string `json:"name" tfsdk:"name"`
}

type MeshTagDefinition struct {
	Metadata MeshTagDefinitionMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshTagDefinitionSpec     `json:"spec" tfsdk:"spec"`
}

type MeshTagDefinitionClient interface {
	List(ctx context.Context) ([]MeshTagDefinition, error)
	Read(ctx context.Context, name string) (*MeshTagDefinition, error)
	Create(ctx context.Context, tagDefinition *MeshTagDefinition) (*MeshTagDefinition, error)
	Update(ctx context.Context, tagDefinition *MeshTagDefinition) (*MeshTagDefinition, error)
	Delete(ctx context.Context, name string) error
}

type MeshTagDefinitionMetadata struct {
	Name string `json:"name" tfsdk:"name"`
}

type MeshTagDefinitionSpec struct {
	TargetKind     string                     `json:"targetKind" tfsdk:"target_kind"`
	Key            string                     `json:"key" tfsdk:"key"`
	ValueType      MeshTagDefinitionValueType `json:"valueType" tfsdk:"value_type"`
	Description    string                     `json:"description" tfsdk:"description"`
	DisplayName    string                     `json:"displayName" tfsdk:"display_name"`
	SortOrder      int64                      `json:"sortOrder" tfsdk:"sort_order"`
	Mandatory      bool                       `json:"mandatory" tfsdk:"mandatory"`
	Immutable      bool                       `json:"immutable" tfsdk:"immutable"`
	Restricted     bool                       `json:"restricted" tfsdk:"restricted"`
	ReplicationKey *string                    `json:"replicationKey,omitzero" tfsdk:"replication_key"`
}

type MeshTagDefinitionValueType struct {
	String       *TagValueString       `json:"string,omitzero" tfsdk:"string"`
	Email        *TagValueEmail        `json:"email,omitzero" tfsdk:"email"`
	Integer      *TagValueInteger      `json:"integer,omitzero" tfsdk:"integer"`
	Number       *TagValueNumber       `json:"number,omitzero" tfsdk:"number"`
	SingleSelect *TagValueSingleSelect `json:"singleSelect,omitzero" tfsdk:"single_select"`
	MultiSelect  *TagValueMultiSelect  `json:"multiSelect,omitzero" tfsdk:"multi_select"`
}

type MeshTenant struct {
	Metadata MeshTenantMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshTenantSpec     `json:"spec" tfsdk:"spec"`
	Status   MeshTenantStatus   `json:"status" tfsdk:"status"`
}

type MeshTenantClient interface {
	Read(ctx context.Context, uuid string) (*MeshTenant, error)
	ReadFunc(uuid string) func(ctx context.Context) (*MeshTenant, error)
	List(ctx context.Context, query MeshTenantQuery) ([]MeshTenant, error)
	Create(ctx context.Context, tenant *MeshTenantCreate) (*MeshTenant, error)
	Delete(ctx context.Context, uuid string) error
}

type MeshTenantCreate struct {
	Metadata MeshTenantCreateMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshTenantCreateSpec     `json:"spec" tfsdk:"spec"`
}

type MeshTenantCreateMetadata struct {
	OwnedByProject   string `json:"ownedByProject" tfsdk:"owned_by_project"`
	OwnedByWorkspace string `json:"ownedByWorkspace" tfsdk:"owned_by_workspace"`
}

type MeshTenantCreateSpec struct {
	PlatformRef      UuidRef                      `json:"platformRef" tfsdk:"platform_ref"`
	LandingZoneRef   *NamedRef                    `json:"landingZoneRef" tfsdk:"landing_zone_ref"`
	PlatformTenantId *string                      `json:"platformTenantId" tfsdk:"platform_tenant_id"`
	RequestedQuotas  map[string]RequestQuotaValue `json:"requestedQuotas,omitempty" tfsdk:"requested_quotas"`
}

type MeshTenantLifecycle struct {
	State             enum.Entry[TenantLifecycleState] `json:"state" tfsdk:"-"`
	MarkedForDeletion *MeshTenantLifecycleAction       `json:"markedForDeletion" tfsdk:"-"`
}

type MeshTenantLifecycleAction struct {
	Timestamp string `json:"timestamp" tfsdk:"-"`
}

type MeshTenantMetadata struct {
	Uuid             string `json:"uuid" tfsdk:"uuid"`
	OwnedByProject   string `json:"ownedByProject" tfsdk:"owned_by_project"`
	OwnedByWorkspace string `json:"ownedByWorkspace" tfsdk:"owned_by_workspace"`
}

type MeshTenantQuery struct {
	Workspace      string  `json:"workspaceIdentifier"`
	Project        *string `json:"projectIdentifier"`
	Platform       *string `json:"platformIdentifier"`
	PlatformType   *string `json:"platformTypeIdentifier"`
	LandingZone    *string `json:"landingZoneIdentifier"`
	PlatformTenant *string `json:"platformTenantId"`
}

type MeshTenantQuota struct {
	Key   string `json:"key" tfsdk:"key"`
	Value int64  `json:"value" tfsdk:"value"`
}

type MeshTenantSpec struct {
	PlatformRef      UuidRef   `json:"platformRef" tfsdk:"platform_ref"`
	PlatformTenantId *string   `json:"platformTenantId" tfsdk:"platform_tenant_id"`
	LandingZoneRef   *NamedRef `json:"landingZoneRef" tfsdk:"landing_zone_ref"`
	// RequestedQuotas is the preferred key->value form for requesting quotas at creation, e.g.
	// {"limits.cpu": {"value": 4}}. The backend does not return it on read (it is a create-time input),
	// so the resource echoes the configured value from state.
	RequestedQuotas map[string]RequestQuotaValue `json:"requestedQuotas" tfsdk:"requested_quotas"`
}

type MeshTenantStatus struct {
	TenantName             string              `json:"tenantName" tfsdk:"tenant_name"`
	PlatformTypeIdentifier string              `json:"platformTypeIdentifier" tfsdk:"platform_type_identifier"`
	PlatformWorkspaceId    *string             `json:"platformWorkspaceId" tfsdk:"platform_workspace_id"`
	Tags                   map[string][]string `json:"tags" tfsdk:"tags"`
	// AppliedQuotas are the effective quotas meshStack applied to the tenant as a key->value map, each
	// value a structured object (e.g. `{"limits.cpu": {"value": 4}}`). spec.requested_quotas carries
	// only the values requested at create (create-only); the effective quotas here can differ once
	// landing-zone defaults are merged in or an operator adjusts them, so drift is tracked against these.
	AppliedQuotas map[string]AppliedQuotaValue `json:"appliedQuotas" tfsdk:"applied_quotas"`
	Lifecycle     MeshTenantLifecycle          `json:"lifecycle" tfsdk:"-"`
}

type MeshTenantTags struct {
	NamespacePrefix string               `json:"namespacePrefix" tfsdk:"namespace_prefix"`
	TagMappers      types.Set[TagMapper] `json:"tagMappers" tfsdk:"tag_mappers"`
}

type MeshWifProvider struct {
	Audience string `json:"audience" tfsdk:"audience"`
}

type MeshWorkloadIdentityFederation struct {
	Issuer  string              `json:"issuer" tfsdk:"issuer"`
	Subject string              `json:"subject" tfsdk:"subject"`
	Gcp     *MeshWifProvider    `json:"gcp" tfsdk:"gcp"`
	Aws     *MeshAwsWifProvider `json:"aws" tfsdk:"aws"`
	Azure   *MeshWifProvider    `json:"azure" tfsdk:"azure"`
}

type MeshWorkspace struct {
	Metadata MeshWorkspaceMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshWorkspaceSpec     `json:"spec" tfsdk:"spec"`
}

type MeshWorkspaceBinding struct {
	Metadata   MeshWorkspaceBindingMetadata `json:"metadata" tfsdk:"metadata"`
	RoleRef    MeshWorkspaceRoleRef         `json:"roleRef" tfsdk:"role_ref"`
	TargetRef  MeshWorkspaceTargetRef       `json:"targetRef" tfsdk:"target_ref"`
	Subject    MeshWorkspaceSubject         `json:"subject" tfsdk:"subject"`
	ExpiryDate *string                      `json:"expiryDate,omitzero" tfsdk:"expiry_date"`
}

type MeshWorkspaceBindingMetadata struct {
	Name string `json:"name" tfsdk:"name"`
}

type MeshWorkspaceClient interface {
	// List returns every workspace the credential can see. An unscoped user token reaches this and
	// almost nothing else, which is why `meshstack auth login` prompts for a workspace from it.
	List(ctx context.Context) ([]MeshWorkspace, error)
	Read(ctx context.Context, name string) (*MeshWorkspace, error)
	Create(ctx context.Context, workspace *MeshWorkspaceCreate) (*MeshWorkspace, error)
	Update(ctx context.Context, name string, workspace *MeshWorkspaceCreate) (*MeshWorkspace, error)
	Delete(ctx context.Context, name string) error
}

type MeshWorkspaceCreate struct {
	Metadata MeshWorkspaceCreateMetadata `json:"metadata" tfsdk:"metadata"`
	Spec     MeshWorkspaceSpec           `json:"spec" tfsdk:"spec"`
}

type MeshWorkspaceCreateMetadata struct {
	Name string              `json:"name" tfsdk:"name"`
	Tags map[string][]string `json:"tags" tfsdk:"tags"`
}

type MeshWorkspaceGroupBinding struct {
	MeshWorkspaceBinding
}

type MeshWorkspaceGroupBindingClient interface {
	Read(ctx context.Context, name string) (*MeshWorkspaceGroupBinding, error)
	Create(ctx context.Context, binding *MeshWorkspaceGroupBinding) (*MeshWorkspaceGroupBinding, error)
	Delete(ctx context.Context, name string) error
}

type MeshWorkspaceMetadata struct {
	Name      string              `json:"name" tfsdk:"name"`
	CreatedOn string              `json:"createdOn" tfsdk:"created_on"`
	DeletedOn *string             `json:"deletedOn" tfsdk:"deleted_on"`
	Tags      map[string][]string `json:"tags" tfsdk:"tags"`
}

type MeshWorkspaceRoleRef struct {
	Name string `json:"name" tfsdk:"name"`
}

type MeshWorkspaceSpec struct {
	DisplayName                  string `json:"displayName" tfsdk:"display_name"`
	PlatformBuilderAccessEnabled *bool  `json:"platformBuilderAccessEnabled,omitzero" tfsdk:"platform_builder_access_enabled"`
}

type MeshWorkspaceSubject struct {
	Name string `json:"name" tfsdk:"name"`
}

type MeshWorkspaceTargetRef struct {
	Name string `json:"name" tfsdk:"name"`
}

type MeshWorkspaceUserBinding struct {
	MeshWorkspaceBinding
}

type MeshWorkspaceUserBindingClient interface {
	Read(ctx context.Context, name string) (*MeshWorkspaceUserBinding, error)
	Create(ctx context.Context, binding *MeshWorkspaceUserBinding) (*MeshWorkspaceUserBinding, error)
	Delete(ctx context.Context, name string) error
}

type NamedRef struct {
	Name string `json:"name" tfsdk:"name"`
	Kind string `json:"kind" tfsdk:"kind"`
}

type OpenShiftMeteringConfig struct {
	ClientConfig KubernetesClientConfig               `json:"clientConfig" tfsdk:"client_config"`
	Processing   MeshPlatformMeteringProcessingConfig `json:"processing" tfsdk:"processing"`
}

type OpenShiftPlatformConfig struct {
	BaseUrl              string                      `json:"baseUrl" tfsdk:"base_url"`
	DisableSslValidation bool                        `json:"disableSslValidation" tfsdk:"disable_ssl_validation"`
	Replication          *OpenShiftReplicationConfig `json:"replication" tfsdk:"replication"`
	Metering             *OpenShiftMeteringConfig    `json:"metering,omitzero" tfsdk:"metering"`
}

type OpenShiftPlatformProperties struct {
}

type OpenShiftPlatformRoleMapping struct {
	MeshProjectRoleRef NamedRef `json:"projectRoleRef" tfsdk:"project_role_ref"`
	OpenshiftRole      string   `json:"openshiftRole" tfsdk:"openshift_role"`
}

type OpenShiftReplicationConfig struct {
	ClientConfig          KubernetesClientConfig                  `json:"clientConfig" tfsdk:"client_config"`
	WebConsoleUrl         *string                                 `json:"webConsoleUrl,omitzero" tfsdk:"web_console_url"`
	ProjectNamePattern    string                                  `json:"projectNamePattern" tfsdk:"project_name_pattern"`
	OpenshiftRoleMappings types.Set[OpenShiftPlatformRoleMapping] `json:"openshiftRoleMappings" tfsdk:"openshift_role_mappings"`
	IdentityProviderName  string                                  `json:"identityProviderName" tfsdk:"identity_provider_name"`
	TenantTags            *MeshTenantTags                         `json:"tenantTags,omitzero" tfsdk:"tenant_tags"`
}

type PlatformAvailability struct {
	Restriction            string            `json:"restriction" tfsdk:"restriction"`
	PublicationState       string            `json:"publicationState" tfsdk:"publication_state"`
	RestrictedToWorkspaces types.Set[string] `json:"restrictedToWorkspaces,omitempty" tfsdk:"restricted_to_workspaces"`
}

type PlatformConfig struct {
	Type       string                    `json:"type" tfsdk:"type"`
	Custom     *CustomPlatformConfig     `json:"custom,omitzero" tfsdk:"custom"`
	Aws        *AwsPlatformConfig        `json:"aws,omitzero" tfsdk:"aws"`
	Aks        *AksPlatformConfig        `json:"aks,omitzero" tfsdk:"aks"`
	Azure      *AzurePlatformConfig      `json:"azure,omitzero" tfsdk:"azure"`
	AzureRg    *AzureRgPlatformConfig    `json:"azurerg,omitzero" tfsdk:"azurerg"`
	Gcp        *GcpPlatformConfig        `json:"gcp,omitzero" tfsdk:"gcp"`
	Kubernetes *KubernetesPlatformConfig `json:"kubernetes,omitzero" tfsdk:"kubernetes"`
	OpenShift  *OpenShiftPlatformConfig  `json:"openshift,omitzero" tfsdk:"openshift"`
}

type QuotaDefinition struct {
	QuotaKey              string `json:"quotaKey" tfsdk:"quota_key"`
	MinValue              int64  `json:"minValue" tfsdk:"min_value"`
	MaxValue              int64  `json:"maxValue" tfsdk:"max_value"`
	Unit                  string `json:"unit" tfsdk:"unit"`
	AutoApprovalThreshold int64  `json:"autoApprovalThreshold" tfsdk:"auto_approval_threshold"`
	Description           string `json:"description" tfsdk:"description"`
	Label                 string `json:"label" tfsdk:"label"`
}

type RequestQuotaValue struct {
	Value int64 `json:"value" tfsdk:"value"`
}

type TagMapper struct {
	Key          string `json:"key" tfsdk:"key"`
	ValuePattern string `json:"valuePattern" tfsdk:"value_pattern"`
}

type TagValueEmail struct {
	DefaultValue    *string `json:"defaultValue,omitzero" tfsdk:"default_value"`
	ValidationRegex *string `json:"validationRegex,omitzero" tfsdk:"validation_regex"`
}

type TagValueInteger struct {
	DefaultValue *int64 `json:"defaultValue,omitzero" tfsdk:"default_value"`
}

type TagValueMultiSelect struct {
	Options      []string  `json:"options,omitempty" tfsdk:"options"`
	DefaultValue *[]string `json:"defaultValue,omitzero" tfsdk:"default_value"`
}

type TagValueNumber struct {
	DefaultValue *float64 `json:"defaultValue,omitzero" tfsdk:"default_value"`
}

type TagValueSingleSelect struct {
	Options      []string `json:"options,omitempty" tfsdk:"options"`
	DefaultValue *string  `json:"defaultValue,omitzero" tfsdk:"default_value"`
}

type TagValueString struct {
	DefaultValue    *string `json:"defaultValue,omitzero" tfsdk:"default_value"`
	ValidationRegex *string `json:"validationRegex,omitzero" tfsdk:"validation_regex"`
}

type TenantLifecycleState string

type UuidRef struct {
	Uuid string `json:"uuid" tfsdk:"uuid"`
	Kind string `json:"kind" tfsdk:"kind"`
}

type Version = version.Version