model

type AltNameEntry struct {
	Name string `json:"name"`
	Port uint16 `json:"port"`
}

type AuditLogEntry struct {
	Id         int64                  `json:"audit_log_id" db:"audit_log_id,pk"`
	Zone       string                 `json:"zone" db:"zone"`
	Actor      string                 `json:"actor" db:"actor"`
	ActorType  string                 `json:"actor_type" db:"actor_type"`
	Event      string                 `json:"event" db:"event"`
	When       time.Time              `json:"created_at" db:"created_at"`
	Details    string                 `json:"details" db:"details"`
	Properties map[string]interface{} `json:"properties" db:"properties,json"`
}

type AuditLogFilter struct {
	Query     string
	Actor     string
	ActorType string
	Event     string
	From      *time.Time
	To        *time.Time
}

type CSIVolume struct {
	Id           string                `yaml:"id" json:"ID"`
	Name         string                `yaml:"name" json:"Name"`
	Namespace    string                `yaml:"namespace" json:"Namespace"`
	PuluginId    string                `yaml:"plugin_id" json:"PluginID"`
	Type         string                `yaml:"type" json:"Type"`
	MountOptions CSIVolumeMountOptions `yaml:"mount_options" json:"MountOptions"`
	CapacityMin  interface{}           `yaml:"capacity_min,omitempty" json:"RequestedCapacityMin,omitempty"`
	CapacityMax  interface{}           `yaml:"capacity_max,omitempty" json:"RequestedCapacityMax,omitempty"`
	Capabilities []CSIVolumeCapability `yaml:"capabilities,omitempty" json:"RequestedCapabilities,omitempty"`
	Secrets      map[string]string     `yaml:"secrets,omitempty" json:"Secrets,omitempty"`
	Parameters   map[string]string     `yaml:"parameters,omitempty" json:"Parameters,omitempty"`
}

type CSIVolumeCapability struct {
	AccessMode     string `yaml:"access_mode" json:"AccessMode"`
	AttachmentMode string `yaml:"attachment_mode" json:"AttachmentMode"`
}

type CSIVolumeMountOptions struct {
	FsType     string   `yaml:"fs_type" json:"FsType"`
	MountFlags []string `yaml:"mount_flags" json:"MountFlags"`
}

type CSIVolumes struct {
	Volumes []CSIVolume `yaml:"volumes" json:"Volumes"`
}

type CfgValue struct {
	Name  string `json:"name" db:"name,pk" msgpack:"name"`
	Value string `json:"value" db:"value" msgpack:"value"`
}

type Command struct {
	Id            string        `json:"command_id" db:"command_id,pk"`
	UserId        string        `json:"user_id" db:"user_id"`
	Name          string        `json:"name" db:"name"`
	Description   string        `json:"description" db:"description"`
	ArgumentHint  string        `json:"argument_hint" db:"argument_hint"`
	AllowedTools  []string      `json:"allowed_tools" db:"allowed_tools,json"`
	Body          string        `json:"body" db:"body"`
	Groups        []string      `json:"groups" db:"groups,json"`
	Zones         []string      `json:"zones" db:"zones,json"`
	Active        bool          `json:"active" db:"active"`
	IsDeleted     bool          `json:"is_deleted" db:"is_deleted"`
	IsManaged     bool          `json:"is_managed" db:"is_managed"`
	CreatedUserId string        `json:"created_user_id" db:"created_user_id"`
	CreatedAt     time.Time     `json:"created_at" db:"created_at"`
	UpdatedUserId string        `json:"updated_user_id" db:"updated_user_id"`
	UpdatedAt     hlc.Timestamp `json:"updated_at" db:"updated_at"`
}

type Conversation struct {
	Id        string        `json:"conversation_id" db:"conversation_id,pk" msgpack:"conversation_id"`
	UserId    string        `json:"user_id" db:"user_id" msgpack:"user_id"`
	Title     string        `json:"title" db:"title" msgpack:"title"`
	Data      string        `json:"data" db:"data" msgpack:"data"`
	CreatedAt time.Time     `json:"created_at" db:"created_at" msgpack:"created_at"`
	UpdatedAt hlc.Timestamp `json:"updated_at" db:"updated_at" msgpack:"updated_at"`
	IsDeleted bool          `json:"is_deleted" db:"is_deleted" msgpack:"is_deleted"`
}

type EventRenderData struct {
	EventId      string
	EventType    string
	SpaceId      string
	SpaceName    string
	UserId       string
	Username     string
	PoolName     string
	PortURLs     map[string]string
	CustomFields map[string]string
	Payload      map[string]interface{}
	Ts           hlc.Timestamp
	ActorId      string
	ActorName    string
	ActorKind    string
}

type EventSink struct {
	Id            string         `json:"event_sink_id" db:"event_sink_id,pk" msgpack:"event_sink_id"`
	UserId        string         `json:"user_id" db:"user_id" msgpack:"user_id"`
	Name          string         `json:"name" db:"name" msgpack:"name"`
	Description   string         `json:"description" db:"description" msgpack:"description"`
	Events        []string       `json:"events" db:"events,json" msgpack:"events"`
	SinkType      string         `json:"sink_type" db:"sink_type" msgpack:"sink_type"`
	Webhook       *WebhookConfig `json:"webhook,omitempty" db:"webhook,json" msgpack:"webhook,omitempty"`
	ScriptId      string         `json:"script_id,omitempty" db:"script_id" msgpack:"script_id,omitempty"`
	Active        bool           `json:"active" db:"active" msgpack:"active"`
	CreatedUserId string         `json:"created_user_id" db:"created_user_id" msgpack:"created_user_id"`
	CreatedAt     time.Time      `json:"created_at" db:"created_at" msgpack:"created_at"`
	UpdatedUserId string         `json:"updated_user_id" db:"updated_user_id" msgpack:"updated_user_id"`
	UpdatedAt     hlc.Timestamp  `json:"updated_at" db:"updated_at" msgpack:"updated_at"`
	IsDeleted     bool           `json:"is_deleted" db:"is_deleted" msgpack:"is_deleted"`
}

type ExternalProvider struct {
	ProviderUID  string `json:"provider_uid"`            // provider's own stable user ID (e.g. GitHub integer ID)
	Username     string `json:"username"`                // human-readable handle, may change
	Token        string `json:"token"`                   // encrypted access token
	RefreshToken string `json:"refresh_token,omitempty"` // encrypted refresh token
}

type Group struct {
	Id            string        `json:"group_id" db:"group_id,pk" msgpack:"group_id"`
	Name          string        `json:"name" db:"name" msgpack:"name"`
	MaxSpaces     uint32        `json:"max_spaces" db:"max_spaces" msgpack:"max_spaces"`
	ComputeUnits  uint32        `json:"compute_units" db:"compute_units" msgpack:"compute_units"`
	StorageUnits  uint32        `json:"storage_units" db:"storage_units" msgpack:"storage_units"`
	MaxTunnels    uint32        `json:"max_tunnels" db:"max_tunnels" msgpack:"max_tunnels"`
	FileStorageMB uint32        `json:"file_storage_mb" db:"file_storage_mb" msgpack:"file_storage_mb"`
	MaxBuckets    uint32        `json:"max_buckets" db:"max_buckets" msgpack:"max_buckets"`
	IsDeleted     bool          `json:"is_deleted" db:"is_deleted" msgpack:"is_deleted"`
	CreatedUserId string        `json:"created_user_id" db:"created_user_id" msgpack:"created_user_id"`
	CreatedAt     time.Time     `json:"created_at" db:"created_at" msgpack:"created_at"`
	UpdatedUserId string        `json:"updated_user_id" db:"updated_user_id" msgpack:"updated_user_id"`
	UpdatedAt     hlc.Timestamp `json:"updated_at" db:"updated_at" msgpack:"updated_at"`
}

type KvmNetwork struct {
	IPNet   *net.IPNet
	Start   net.IP
	End     net.IP
	Gateway net.IP
}

type LocalStorageSpec struct {
	Volumes map[string]LocalVolumeEntry `yaml:"volumes"`
	Paths   PathList                    `yaml:"paths"`
}

type LocalVolumeEntry struct {
	Size string `yaml:"size,omitempty"`
}

type MCPServer struct {
	Id                string        `json:"mcp_server_id" db:"mcp_server_id,pk" msgpack:"mcp_server_id"`
	UserId            string        `json:"user_id" db:"user_id" msgpack:"user_id"`
	Namespace         string        `json:"namespace" db:"namespace" msgpack:"namespace"`
	URL               string        `json:"url" db:"url" msgpack:"url"`
	Command           string        `json:"command" db:"command" msgpack:"command"`
	Args              []string      `json:"args" db:"args,json" msgpack:"args"`
	Env               []string      `json:"env" db:"env,json" msgpack:"env"`
	AuthType          string        `json:"auth_type" db:"auth_type" msgpack:"auth_type"`
	Token             string        `json:"token" db:"token" msgpack:"token"`
	OAuthClientID     string        `json:"oauth_client_id" db:"oauth_client_id" msgpack:"oauth_client_id"`
	OAuthTokenURL     string        `json:"oauth_token_url" db:"oauth_token_url" msgpack:"oauth_token_url"`
	OAuthAccessToken  string        `json:"oauth_access_token" db:"oauth_access_token" msgpack:"oauth_access_token"`
	OAuthRefreshToken string        `json:"oauth_refresh_token" db:"oauth_refresh_token" msgpack:"oauth_refresh_token"`
	Enabled           bool          `json:"enabled" db:"enabled" msgpack:"enabled"`
	ToolVisibility    string        `json:"tool_visibility" db:"tool_visibility" msgpack:"tool_visibility"`
	DisabledTools     []string      `json:"disabled_tools" db:"disabled_tools,json" msgpack:"disabled_tools"`
	RemoteSearch      bool          `json:"remote_search" db:"remote_search" msgpack:"remote_search"`
	IsDeleted         bool          `json:"is_deleted" db:"is_deleted" msgpack:"is_deleted"`
	CreatedUserId     string        `json:"created_user_id" db:"created_user_id" msgpack:"created_user_id"`
	CreatedAt         time.Time     `json:"created_at" db:"created_at" msgpack:"created_at"`
	UpdatedUserId     string        `json:"updated_user_id" db:"updated_user_id" msgpack:"updated_user_id"`
	UpdatedAt         hlc.Timestamp `json:"updated_at" db:"updated_at" msgpack:"updated_at"`
}

type ManagedPathsSpec struct {
	Paths PathList `yaml:"paths"`
}

type NavPage struct {
	URL   string
	Label string
}

type PathList []string

type PermissionName struct {
	Id          int    `json:"id"`
	Group       string `json:"group"`
	Name        string `json:"name"`
	Description string `json:"description"`
}

type PoolDefinition struct {
	Id              string `json:"pool_id" db:"pool_id,pk" msgpack:"pool_id"`
	Name            string `json:"name" db:"name" msgpack:"name"`
	TemplateId      string `json:"template_id" db:"template_id" msgpack:"template_id"`
	StartupScriptId string `json:"startup_script_id" db:"startup_script_id" msgpack:"startup_script_id"`
	DesiredCount    int    `json:"desired_count" db:"desired_count" msgpack:"desired_count"`
	Active          bool   `json:"active" db:"active" msgpack:"active"`
	Zone            string `json:"zone" db:"zone" msgpack:"zone"`
	IsDeleted       bool   `json:"is_deleted" db:"is_deleted" msgpack:"is_deleted"`
	// Exclusive member leases. LeaseMaxTime is in seconds: 0 = leases
	// disabled (the default), -1 = no timeout (leases run until released),
	// >0 = maximum duration of one acquire/extend. LeaseMaxExtensions:
	// 0 = extending forbidden, -1 = unlimited, >0 = max extensions per lease.
	LeaseMaxTime       int `json:"lease_max_time" db:"lease_max_time" msgpack:"lease_max_time"`
	LeaseMaxExtensions int `json:"lease_max_extensions" db:"lease_max_extensions" msgpack:"lease_max_extensions"`
	// Custom field values given to every member. Copied onto a member when
	// it is created or started, so a change reaches running members on
	// their next start.
	CustomFields  []SpaceCustomField `json:"custom_fields" db:"custom_fields,json" msgpack:"custom_fields"`
	CreatedUserId string             `json:"created_user_id" db:"created_user_id" msgpack:"created_user_id"`
	CreatedAt     time.Time          `json:"created_at" db:"created_at" msgpack:"created_at"`
	UpdatedUserId string             `json:"updated_user_id" db:"updated_user_id" msgpack:"updated_user_id"`
	UpdatedAt     hlc.Timestamp      `json:"updated_at" db:"updated_at" msgpack:"updated_at"`
}

type PortForwardEntry struct {
	LocalPort  uint16 `json:"local_port" yaml:"local_port"`
	Space      string `json:"space" yaml:"space"`
	RemotePort uint16 `json:"remote_port" yaml:"remote_port"`
}

type Quota struct {
	ComputeUnits  uint32
	StorageUnits  uint32
	MaxSpaces     uint32
	MaxTunnels    uint32
	FileStorageMB uint32
	MaxBuckets    uint32
}

type Response struct {
	Id                 string                 `json:"response_id" db:"response_id,pk" msgpack:"response_id"`
	Status             ResponseStatus         `json:"status" db:"status" msgpack:"status"`
	Request            map[string]interface{} `json:"request" db:"request,json" msgpack:"request"`
	Response           map[string]interface{} `json:"response" db:"response,json" msgpack:"response"`
	Error              string                 `json:"error,omitempty" db:"error_text" msgpack:"error"`
	PreviousResponseId string                 `json:"previous_response_id,omitempty" db:"previous_response_id" msgpack:"previous_response_id"`
	UserId             string                 `json:"user_id" db:"user_id" msgpack:"user_id"`
	SpaceId            string                 `json:"space_id,omitempty" db:"space_id" msgpack:"space_id"`
	ExpiresAt          *time.Time             `json:"expires_at,omitempty" db:"expires_at" msgpack:"expires_at"`
	IsDeleted          bool                   `json:"is_deleted" db:"is_deleted" msgpack:"is_deleted"`
	CreatedAt          time.Time              `json:"created_at" db:"created_at" msgpack:"created_at"`
	UpdatedAt          hlc.Timestamp          `json:"updated_at" db:"updated_at" msgpack:"updated_at"`
}

type ResponseStatus string

type Role struct {
	Id                string        `json:"role_id" db:"role_id,pk" msgpack:"role_id"`
	Name              string        `json:"name" db:"name" msgpack:"name"`
	Permissions       []uint16      `json:"permissions" db:"permissions,json" msgpack:"permissions"`
	PluginPermissions []string      `json:"plugin_permissions" db:"plugin_permissions,json" msgpack:"plugin_permissions"`
	IsDeleted         bool          `json:"is_deleted" db:"is_deleted" msgpack:"is_deleted"`
	CreatedUserId     string        `json:"created_user_id" db:"created_user_id" msgpack:"created_user_id"`
	CreatedAt         time.Time     `json:"created_at" db:"created_at" msgpack:"created_at"`
	UpdatedUserId     string        `json:"updated_user_id" db:"updated_user_id" msgpack:"updated_user_id"`
	UpdatedAt         hlc.Timestamp `json:"updated_at" db:"updated_at" msgpack:"updated_at"`
}

type Script struct {
	Id                 string        `json:"script_id" db:"script_id,pk"`
	UserId             string        `json:"user_id" db:"user_id"`
	Name               string        `json:"name" db:"name"`
	Description        string        `json:"description" db:"description"`
	Content            string        `json:"content" db:"content"`
	Groups             []string      `json:"groups" db:"groups,json"`
	Zones              []string      `json:"zones" db:"zones,json"`
	Active             bool          `json:"active" db:"active"`
	ScriptType         string        `json:"script_type" db:"script_type"`
	MCPInputSchemaToml string        `json:"mcp_input_schema_toml" db:"mcp_input_schema_toml"`
	MCPKeywords        []string      `json:"mcp_keywords" db:"mcp_keywords,json"`
	Discoverable       bool          `json:"discoverable" db:"discoverable"`
	IsDeleted          bool          `json:"is_deleted" db:"is_deleted"`
	IsManaged          bool          `json:"is_managed" db:"is_managed"`
	CreatedUserId      string        `json:"created_user_id" db:"created_user_id"`
	CreatedAt          time.Time     `json:"created_at" db:"created_at"`
	UpdatedUserId      string        `json:"updated_user_id" db:"updated_user_id"`
	UpdatedAt          hlc.Timestamp `json:"updated_at" db:"updated_at"`
}

type Session struct {
	Id string `json:"session_id" db:"session_id,pk"`
	Ip string `json:"ip" db:"ip"`
	// UserId is the account the session currently runs as. Switching user
	// rewrites it; OriginalUserId keeps the account that actually
	// authenticated so the session can always flick back — fast user
	// switching, with no reverse link granted.
	UserId         string        `json:"user_id" db:"user_id"`
	OriginalUserId string        `json:"original_user_id" db:"original_user_id"`
	UserAgent      string        `json:"user_agent" db:"user_agent"`
	ExpiresAfter   time.Time     `json:"expires_after" db:"expires_after"`
	UpdatedAt      hlc.Timestamp `json:"updated_at" db:"updated_at"`
	IsDeleted      bool          `json:"is_deleted" db:"is_deleted"`
}

type Skill struct {
	Id            string        `json:"skill_id" db:"skill_id,pk"`
	UserId        string        `json:"user_id" db:"user_id"`
	Name          string        `json:"name" db:"name"`
	Description   string        `json:"description" db:"description"`
	Content       string        `json:"content" db:"content"`
	Groups        []string      `json:"groups" db:"groups,json"`
	Zones         []string      `json:"zones" db:"zones,json"`
	Active        bool          `json:"active" db:"active"`
	IsDeleted     bool          `json:"is_deleted" db:"is_deleted"`
	IsManaged     bool          `json:"is_managed" db:"is_managed"`
	CreatedUserId string        `json:"created_user_id" db:"created_user_id"`
	CreatedAt     time.Time     `json:"created_at" db:"created_at"`
	UpdatedUserId string        `json:"updated_user_id" db:"updated_user_id"`
	UpdatedAt     hlc.Timestamp `json:"updated_at" db:"updated_at"`
}

type Space struct {
	Id               string             `json:"space_id" db:"space_id,pk" msgpack:"space_id"`
	ParentSpaceId    string             `json:"parent_space_id" db:"parent_space_id" msgpack:"parent_space_id"`
	PoolId           string             `json:"pool_id" db:"pool_id" msgpack:"pool_id"`
	UserId           string             `json:"user_id" db:"user_id" msgpack:"user_id"`
	TemplateId       string             `json:"template_id" db:"template_id" msgpack:"template_id"`
	Shares           []string           `json:"shares" db:"shares,json" msgpack:"shares"`
	DependsOn        []string           `json:"depends_on" db:"depends_on,json" msgpack:"depends_on"`
	SharedWithUserId string             `json:"-" msgpack:"-"`
	Name             string             `json:"name" db:"name" msgpack:"name"`
	Description      string             `json:"description" db:"description" msgpack:"description"`
	Note             string             `json:"note" db:"note" msgpack:"note"`
	Stack            string             `json:"stack" db:"stack" msgpack:"stack"`
	StackPrefix      string             `json:"stack_prefix" db:"stack_prefix" msgpack:"stack_prefix"`
	Zone             string             `json:"zone" db:"zone" msgpack:"zone"`
	NodeId           string             `json:"node_id,omitempty" db:"node_id" msgpack:"node_id,omitempty"`
	Shell            string             `json:"shell" db:"shell" msgpack:"shell"`
	StartupScriptId  string             `json:"startup_script_id" db:"startup_script_id" msgpack:"startup_script_id"`
	TemplateHash     string             `json:"template_hash" db:"template_hash" msgpack:"template_hash"`
	NomadNamespace   string             `json:"nomad_namespace" db:"nomad_namespace" msgpack:"nomad_namespace"`
	ContainerId      string             `json:"container_id" db:"container_id" msgpack:"container_id"`
	IPAddress        string             `json:"ip_address,omitempty" db:"ip_address" msgpack:"ip_address,omitempty"` // KVM spaces: the VM's static IP, chosen at create time
	IconURL          string             `json:"icon_url" db:"icon_url" msgpack:"icon_url"`
	VolumeData       VolumeDataMap      `json:"volume_data" db:"volume_data" msgpack:"volume_data"`
	SSHHostSigner    string             `json:"ssh_host_signer" db:"ssh_host_signer" msgpack:"ssh_host_signer"`
	IsDeployed       bool               `json:"is_deployed" db:"is_deployed" msgpack:"is_deployed"`
	IsPending        bool               `json:"is_pending" db:"is_pending" msgpack:"is_pending"` // Flags if the space is pending a state change, starting or stopping
	IsDeleting       bool               `json:"is_deleting" db:"is_deleting" msgpack:"is_deleting"`
	IsDeleted        bool               `json:"is_deleted" db:"is_deleted" msgpack:"is_deleted"`
	AltNames         []AltNameEntry     `json:"alt_names" msgpack:"alt_names"`
	CustomFields     []SpaceCustomField `json:"custom_fields" db:"custom_fields,json" msgpack:"custom_fields"`
	PortForwards     []PortForwardEntry `json:"port_forwards" db:"port_forwards,json" msgpack:"port_forwards"`
	Jobs             []SpaceJob         `json:"jobs" db:"jobs,json" msgpack:"jobs"`
	JobsEnabled      bool               `json:"jobs_enabled" db:"jobs_enabled" msgpack:"jobs_enabled"`
	Restrictions     SpaceRestrictions  `json:"restrictions" db:"restrictions,json" msgpack:"restrictions"` // held until lifted from outside the space
	StartedAt        time.Time          `json:"started_at" db:"started_at" msgpack:"started_at"`
	CreatedAt        time.Time          `json:"created_at" db:"created_at" msgpack:"created_at"`
	UpdatedAt        hlc.Timestamp      `json:"updated_at" db:"updated_at" msgpack:"updated_at"`

	// Exclusive pool-member lease. Set on pool spaces only, while a lease
	// granted from the pool is held (or has ended but in-flight work has
	// not drained yet — the pool sweep clears all four fields once the
	// member returns to the shared pool). A nil LeaseExpiresAt means the
	// lease never expires (NULL column; the MySQL driver cannot round-trip
	// a zero time.Time).
	LeaseId         string     `json:"lease_id" db:"lease_id" msgpack:"lease_id"`
	LeaseUserId     string     `json:"lease_user_id" db:"lease_user_id" msgpack:"lease_user_id"`
	LeaseExpiresAt  *time.Time `json:"lease_expires_at" db:"lease_expires_at" msgpack:"lease_expires_at"`
	LeaseExtensions int        `json:"lease_extensions" db:"lease_extensions" msgpack:"lease_extensions"`
}

type SpaceBucketGrant struct {
	Id       string `json:"id" msgpack:"id"`
	Name     string `json:"name" msgpack:"name"`
	ReadOnly bool   `json:"read_only" msgpack:"read_only"`
}

type SpaceCustomField struct {
	Name  string `json:"name"`
	Value string `json:"value"`
}

type SpaceJob struct {
	Name     string `json:"name" msgpack:"name"`
	Command  string `json:"command" msgpack:"command"`
	Schedule string `json:"schedule,omitempty" msgpack:"schedule,omitempty"` // 5-field cron expression, empty = manual only
	Enabled  bool   `json:"enabled" msgpack:"enabled"`                       // gates automatic firing only, manual runs always work
}

type SpaceRestrictions struct {
	Active    bool   `json:"active" msgpack:"active"`
	NoSecrets bool   `json:"no_secrets" msgpack:"no_secrets"`
	Files     string `json:"files" msgpack:"files"`
	// Locked locks the space's processes out of everything but file storage
	// and personal secrets, which their own restrictions govern: the knot
	// command and scripts in the space may otherwise only restart or shut it
	// down and show its restrictions. Requests from outside the space, which
	// the agent carries out, such as port forwards and scripts run from the
	// desktop, still work.
	Locked bool `json:"locked" msgpack:"locked"`
	// LimitBuckets makes Buckets an allowlist: buckets not in it are hidden.
	LimitBuckets bool               `json:"limit_buckets" msgpack:"limit_buckets"`
	Buckets      []SpaceBucketGrant `json:"buckets" msgpack:"buckets"`
}

type SpaceUsageSample struct {
	Id                    string        `json:"space_usage_id" db:"space_usage_id,pk" msgpack:"space_usage_id"`
	SpaceId               string        `json:"space_id" db:"space_id" msgpack:"space_id"`
	UserId                string        `json:"user_id" db:"user_id" msgpack:"user_id"`
	BucketKind            string        `json:"bucket_kind" db:"bucket_kind" msgpack:"bucket_kind"`
	BucketStart           time.Time     `json:"bucket_start" db:"bucket_start" msgpack:"bucket_start"`
	CPUPercent            float64       `json:"cpu_percent" db:"cpu_percent" msgpack:"cpu_percent"`
	MemoryUsedBytes       uint64        `json:"memory_used_bytes" db:"memory_used_bytes" msgpack:"memory_used_bytes"`
	MemoryLimitBytes      uint64        `json:"memory_limit_bytes" db:"memory_limit_bytes" msgpack:"memory_limit_bytes"`
	DiskUsedBytes         uint64        `json:"disk_used_bytes" db:"disk_used_bytes" msgpack:"disk_used_bytes"`
	DiskLimitBytes        uint64        `json:"disk_limit_bytes" db:"disk_limit_bytes" msgpack:"disk_limit_bytes"`
	ActivityWriteCount    uint32        `json:"activity_write_count" db:"activity_write_count" msgpack:"activity_write_count"`
	ActivityCreateCount   uint32        `json:"activity_create_count" db:"activity_create_count" msgpack:"activity_create_count"`
	ActivityDeleteCount   uint32        `json:"activity_delete_count" db:"activity_delete_count" msgpack:"activity_delete_count"`
	ActivityRenameCount   uint32        `json:"activity_rename_count" db:"activity_rename_count" msgpack:"activity_rename_count"`
	ActivityDistinctPaths uint32        `json:"activity_distinct_paths" db:"activity_distinct_paths" msgpack:"activity_distinct_paths"`
	ActivitySpaceStarts   uint32        `json:"activity_space_starts" db:"activity_space_starts" msgpack:"activity_space_starts"`
	ActivitySpaceStops    uint32        `json:"activity_space_stops" db:"activity_space_stops" msgpack:"activity_space_stops"`
	ActivitySpaceCreates  uint32        `json:"activity_space_creates" db:"activity_space_creates" msgpack:"activity_space_creates"`
	ActivitySpaceDeletes  uint32        `json:"activity_space_deletes" db:"activity_space_deletes" msgpack:"activity_space_deletes"`
	LastActivityAt        *time.Time    `json:"last_activity_at,omitempty" db:"last_activity_at" msgpack:"last_activity_at,omitempty"`
	CreatedAt             time.Time     `json:"created_at" db:"created_at" msgpack:"created_at"`
	UpdatedAt             hlc.Timestamp `json:"updated_at" db:"updated_at" msgpack:"updated_at"`
}

type SpaceVolume struct {
	Id        string `json:"id"`
	Namespace string `json:"Namespace"`
	Type      string `json:"type,omitempty"`
}

type StackComponent struct {
	Name            string             `json:"name" db:"name"`
	TemplateId      string             `json:"template_id" db:"template_id"`
	Description     string             `json:"description" db:"description"`
	Shell           string             `json:"shell" db:"shell"`
	StartupScriptId string             `json:"startup_script_id" db:"startup_script_id"`
	DependsOn       []string           `json:"depends_on" db:"depends_on,json"`
	CustomFields    []StackCustomField `json:"custom_fields" db:"custom_fields,json"`
	PortForwards    []StackPortForward `json:"port_forwards" db:"port_forwards,json"`
}

type StackCustomField struct {
	Name  string `json:"name" db:"name"`
	Value string `json:"value" db:"value"`
}

type StackDefinition struct {
	Id            string           `json:"stack_definition_id" db:"stack_definition_id,pk"`
	UserId        string           `json:"user_id" db:"user_id"`
	Name          string           `json:"name" db:"name"`
	Description   string           `json:"description" db:"description"`
	IconURL       string           `json:"icon_url" db:"icon_url"`
	Groups        []string         `json:"groups" db:"groups,json"`
	Zones         []string         `json:"zones" db:"zones,json"`
	Active        bool             `json:"active" db:"active"`
	IsDeleted     bool             `json:"is_deleted" db:"is_deleted"`
	IsManaged     bool             `json:"is_managed" db:"is_managed"`
	Components    []StackComponent `json:"components" db:"components,json"`
	CreatedUserId string           `json:"created_user_id" db:"created_user_id"`
	CreatedAt     time.Time        `json:"created_at" db:"created_at"`
	UpdatedUserId string           `json:"updated_user_id" db:"updated_user_id"`
	UpdatedAt     hlc.Timestamp    `json:"updated_at" db:"updated_at"`
}

type StackPortForward struct {
	ToSpace    string `json:"to_space" db:"to_space"`
	LocalPort  int    `json:"local_port" db:"local_port"`
	RemotePort int    `json:"remote_port" db:"remote_port"`
}

type Template struct {
	Id               string   `json:"template_id" db:"template_id,pk"`
	Name             string   `json:"name" db:"name"`
	Description      string   `json:"description" db:"description"`
	Hash             string   `json:"hash" db:"hash"`
	Platform         string   `json:"platform" db:"platform"`
	IconURL          string   `json:"icon_url" db:"icon_url"`
	Job              string   `json:"job" db:"job"`
	Volumes          string   `json:"volumes" db:"volumes"`
	Groups           []string `json:"groups" db:"groups,json"`
	Active           bool     `json:"active" db:"active"`
	WithTerminal     bool     `json:"with_terminal" db:"with_terminal"`
	WithVSCodeTunnel bool     `json:"with_vscode_tunnel" db:"with_vscode_tunnel"`
	WithCodeServer   bool     `json:"with_code_server" db:"with_code_server"`
	WithSSH          bool     `json:"with_ssh" db:"with_ssh"`
	WithRunCommand   bool     `json:"with_run_command" db:"with_run_command"`
	// WithVNC exposes the VM's built-in QEMU VNC display (the framebuffer
	// QEMU itself renders — bootloader, console, desktop) in the browser via
	// knot's websocket bridge. KVM-only; nothing is installed in the guest.
	WithVNC                  bool                   `json:"with_vnc" db:"with_vnc"`
	AllowNodeMigration       bool                   `json:"allow_node_migration" db:"allow_node_migration"`
	StartupScriptId          string                 `json:"startup_script_id" db:"startup_script_id"`
	ShutdownScriptId         string                 `json:"shutdown_script_id" db:"shutdown_script_id"`
	ComputeUnits             uint32                 `json:"compute_units" db:"compute_units"`
	StorageUnits             uint32                 `json:"storage_units" db:"storage_units"`
	ScheduleEnabled          bool                   `json:"schedule_enabled" db:"schedule_enabled"`
	AutoStart                bool                   `json:"auto_start" db:"auto_start"`
	IsDeleted                bool                   `json:"is_deleted" db:"is_deleted"`
	IsManaged                bool                   `json:"is_managed" db:"is_managed"`
	Schedule                 []TemplateScheduleDays `json:"schedule" db:"schedule,json"`
	Zones                    []string               `json:"zones" db:"zones,json"`
	CustomFields             []TemplateCustomField  `json:"custom_fields" db:"custom_fields,json"`
	MaxUptime                uint32                 `json:"max_uptime" db:"max_uptime"`
	MaxUptimeUnit            string                 `json:"max_uptime_unit" db:"max_uptime_unit"`
	IdleTimeout              uint32                 `json:"idle_timeout" db:"idle_timeout"`
	IdleTimeoutUnit          string                 `json:"idle_timeout_unit" db:"idle_timeout_unit"`
	HealthCheckType          string                 `json:"health_check_type" db:"health_check_type"`
	HealthCheckConfig        string                 `json:"health_check_config" db:"health_check_config"`
	HealthCheckSkipSSLVerify bool                   `json:"health_check_skip_ssl_verify" db:"health_check_skip_ssl_verify"`
	HealthCheckTimeout       uint32                 `json:"health_check_timeout" db:"health_check_timeout"`
	HealthCheckInterval      uint32                 `json:"health_check_interval" db:"health_check_interval"`
	HealthCheckMaxFailures   uint32                 `json:"health_check_max_failures" db:"health_check_max_failures"`
	HealthCheckAutoRestart   bool                   `json:"health_check_auto_restart" db:"health_check_auto_restart"`
	DisableUserActivity      bool                   `json:"disable_user_activity" db:"disable_user_activity"`
	DisableFileStorage       bool                   `json:"disable_file_storage" db:"disable_file_storage"`
	DisableUserSecrets       bool                   `json:"disable_user_secrets" db:"disable_user_secrets"`
	Ports                    []TemplatePort         `json:"ports" db:"ports,json"`
	// Port forwards seeded into every space created from this template, so
	// client spaces connect to their services automatically when they start
	// (the same restore-on-start replay as manually persisted forwards).
	// Entries use target references — bare name, user--name — resolved and
	// authorized per connection. Pro ships the template editor for this;
	// the API accepts it everywhere.
	PortForwards []PortForwardEntry `json:"port_forwards" db:"port_forwards,json"`
	Jobs         []SpaceJob         `json:"jobs" db:"jobs,json"`
	// KVM network configuration, derived from the job spec's network:
	// block. Bridged mode attaches VMs to a host bridge (or libvirt
	// network) and gives each space a static IP chosen from the
	// kvm_ip_range at create time; NAT mode attaches to a libvirt NAT
	// network (named by the bridge field, default "default") and the VM
	// DHCPs — no addresses to manage.
	KvmNetworkMode  string        `json:"kvm_network_mode,omitempty" db:"kvm_network_mode"`
	KvmNetworkCidr  string        `json:"kvm_network_cidr,omitempty" db:"kvm_network_cidr"`
	KvmIPRangeStart string        `json:"kvm_ip_range_start,omitempty" db:"kvm_ip_range_start"`
	KvmIPRangeEnd   string        `json:"kvm_ip_range_end,omitempty" db:"kvm_ip_range_end"`
	KvmGateway      string        `json:"kvm_gateway,omitempty" db:"kvm_gateway"`
	KvmBridge       string        `json:"kvm_bridge,omitempty" db:"kvm_bridge"`
	CreatedUserId   string        `json:"created_user_id" db:"created_user_id"`
	CreatedAt       time.Time     `json:"created_at" db:"created_at"`
	UpdatedUserId   string        `json:"updated_user_id" db:"updated_user_id"`
	UpdatedAt       hlc.Timestamp `json:"updated_at" db:"updated_at"`
}

type TemplateCustomField struct {
	Name        string `json:"name"`
	Description string `json:"description"`
	// Type controls how the space form renders the field: text (default)
	// or autocomplete. Autocomplete requires Handler - a plugin field
	// handler id (plugin.<name>.<id>) that serves the suggestions.
	Type    string `json:"type,omitempty"`
	Handler string `json:"handler,omitempty"`
	// Language selects the ace mode/completions for textarea fields:
	// yaml, toml, json, markdown, shell or scriptling ("" is plain text).
	Language string `json:"language,omitempty"`
	// Default is the value a space starts with for this field. It is
	// presence-based: applied only when the create request omits the
	// field entirely, never when the field arrives with an empty value —
	// clearing a prefilled default is an intentional blank.
	Default string `json:"default,omitempty"`
	// Required marks a field the space form refuses to leave blank (and
	// the space create/update API rejects): absent, empty or
	// whitespace-only values fail. A bool field is never blank.
	Required bool `json:"required,omitempty"`
	// Options is a select field's manual option list — the alternative to
	// Handler. Values are stored verbatim.
	Options []string `json:"options,omitempty"`
	// ShowOnCreate shows an optional field on the create-space form with the
	// required ones, instead of behind its "optional fields" toggle. It only
	// changes how the form is laid out, so it is left out of the template
	// hash. Absent (older templates) means false.
	ShowOnCreate bool `json:"show_on_create,omitempty"`
}

type TemplatePort struct {
	Name     string `json:"name"`
	Port     uint16 `json:"port"`
	Protocol string `json:"protocol"`
}

type TemplateScheduleDays struct {
	Enabled bool   `json:"enabled"`
	From    string `json:"from"`
	To      string `json:"to"`
}

type TemplateVar struct {
	Id            string        `json:"templatevar_id" db:"templatevar_id,pk"`
	Name          string        `json:"name" db:"name"`
	Zones         []string      `json:"zones" db:"zones,json"`
	Value         string        `json:"value" db:"value"`
	Protected     bool          `json:"protected" db:"protected"`
	Local         bool          `json:"local" db:"local"`
	Restricted    bool          `json:"restricted" db:"restricted"`
	IsDeleted     bool          `json:"is_deleted" db:"is_deleted"`
	IsManaged     bool          `json:"is_managed" db:"is_managed"`
	CreatedUserId string        `json:"created_user_id" db:"created_user_id"`
	CreatedAt     time.Time     `json:"created_at" db:"created_at"`
	UpdatedUserId string        `json:"updated_user_id" db:"updated_user_id"`
	UpdatedAt     hlc.Timestamp `json:"updated_at" db:"updated_at"`
}

type Token struct {
	Id           string        `json:"token_id" db:"token_id,pk"`
	UserId       string        `json:"user_id" db:"user_id"`
	Name         string        `json:"name" db:"name"`
	ExpiresAfter time.Time     `json:"expires_after" db:"expires_after"`
	UpdatedAt    hlc.Timestamp `json:"updated_at" db:"updated_at"`
	IsDeleted    bool          `json:"is_deleted" db:"is_deleted"`
	// Scopes restricts which endpoint groups this token can reach.
	// nil/empty = unrestricted (backward compatible with pre-scopes tokens).
	// Non-empty = token may only reach endpoints covered by the listed scopes.
	Scopes []string `json:"scopes,omitempty" db:"scopes,json"`
	// RefreshToken marks tokens issued via the OAuth2 authorization-code
	// flow; only these may be extended through the /token refresh grant.
	RefreshToken bool `json:"refresh_token,omitempty" db:"refresh_token"`
}

type Usage struct {
	ComputeUnits               uint32
	StorageUnits               uint32
	NumberSpaces               int
	NumberSpacesDeployed       int
	NumberSpacesDeployedInZone int
}

type User struct {
	Id                    string                      `json:"user_id" db:"user_id,pk" msgpack:"user_id"`
	Username              string                      `json:"username" db:"username" msgpack:"username"`
	Email                 string                      `json:"email" db:"email" msgpack:"email"`
	Password              string                      `json:"password" db:"password" msgpack:"password"`
	TOTPSecret            string                      `json:"totp_secret" db:"totp_secret" msgpack:"totp_secret"`
	ServicePassword       string                      `json:"service_password" db:"service_password" msgpack:"service_password"`
	SSHPublicKey          string                      `json:"ssh_public_key" db:"ssh_public_key" msgpack:"ssh_public_key"`
	SSHPrivateKey         string                      `json:"ssh_private_key" db:"ssh_private_key" msgpack:"ssh_private_key"`
	OnePasswordToken      string                      `json:"onepassword_token" db:"onepassword_token" msgpack:"onepassword_token"` // encrypted 1Password service account token (Knot Pro user secrets)
	GitHubUsername        string                      `json:"github_username" db:"github_username" msgpack:"github_username"`
	ExternalAuthProviders map[string]ExternalProvider `json:"external_auth_providers" db:"external_auth_providers,json" msgpack:"external_auth_providers"`
	Roles                 []string                    `json:"roles" db:"roles,json" msgpack:"roles"`
	Groups                []string                    `json:"groups" db:"groups,json" msgpack:"groups"`
	// LinkedUsers holds the accounts this user may become — fast user
	// switching, one way. The link grants nothing in return: a listed
	// user cannot become this one. Maintained only through the
	// link/unlink endpoints.
	LinkedUsers    []string       `json:"linked_users" db:"linked_users,json" msgpack:"linked_users"`
	Active         bool           `json:"active" db:"active" msgpack:"active"`
	IsDeleted      bool           `json:"is_deleted" db:"is_deleted" msgpack:"is_deleted"`
	MaxSpaces      uint32         `json:"max_spaces" db:"max_spaces" msgpack:"max_spaces"`
	ComputeUnits   uint32         `json:"compute_units" db:"compute_units" msgpack:"compute_units"`
	StorageUnits   uint32         `json:"storage_units" db:"storage_units" msgpack:"storage_units"`
	MaxTunnels     uint32         `json:"max_tunnels" db:"max_tunnels" msgpack:"max_tunnels"`
	FileStorageMB  uint32         `json:"file_storage_mb" db:"file_storage_mb" msgpack:"file_storage_mb"`
	MaxBuckets     uint32         `json:"max_buckets" db:"max_buckets" msgpack:"max_buckets"`
	PreferredShell string         `json:"preferred_shell" db:"preferred_shell" msgpack:"preferred_shell"`
	Timezone       string         `json:"timezone" db:"timezone" msgpack:"timezone"`
	Preferences    map[string]any `json:"preferences" db:"preferences,json" msgpack:"preferences"`
	LastLoginAt    *time.Time     `json:"last_login_at" db:"last_login_at" msgpack:"last_login_at"`
	UpdatedAt      hlc.Timestamp  `json:"updated_at" db:"updated_at" msgpack:"updated_at"`
	CreatedAt      time.Time      `json:"created_at" db:"created_at" msgpack:"created_at"`
}

type Volume struct {
	Id            string        `json:"volume_id" db:"volume_id,pk"`
	Name          string        `json:"name" db:"name"`
	Zone          string        `json:"zone" db:"zone"`
	NodeId        string        `json:"node_id" db:"node_id"`
	Platform      string        `json:"platform" db:"platform"`
	Definition    string        `json:"definition" db:"definition"`
	Active        bool          `json:"active" db:"active"`
	IsDeleted     bool          `json:"is_deleted" db:"is_deleted"`
	CreatedUserId string        `json:"created_user_id" db:"created_user_id"`
	CreatedAt     time.Time     `json:"created_at" db:"created_at"`
	UpdatedUserId string        `json:"updated_user_id" db:"updated_user_id"`
	UpdatedAt     hlc.Timestamp `json:"updated_at" db:"updated_at"`
}

type VolumeDataMap map[string]SpaceVolume

type WebhookConfig struct {
	URL           string            `json:"url" msgpack:"url"`
	Secret        string            `json:"secret" msgpack:"secret"`
	Headers       map[string]string `json:"headers,omitempty" msgpack:"headers,omitempty"`
	BodyTemplate  string            `json:"body_template" msgpack:"body_template"`
	SkipTLSVerify bool              `json:"skip_tls_verify" msgpack:"skip_tls_verify"`
}