api

type APIError struct {
	StatusCode int
	Message    string
	RetryAfter time.Duration // only set for 429
}

type ActionInfo struct {
	Name        string        `json:"name"`
	Description string        `json:"description"`
	Parameters  []ActionParam `json:"parameters"`
}

type ActionParam struct {
	Name        string `json:"name"`
	Type        string `json:"type"`
	Required    bool   `json:"required"`
	Default     string `json:"default,omitempty"`
	Description string `json:"description"`
}

type ActionRequest struct {
	ExecutionID string            `json:"execution_id"`
	Action      string            `json:"action"`
	Parameters  map[string]string `json:"parameters,omitempty"`
	Timeout     string            `json:"timeout"`
	Checksum    string            `json:"checksum,omitempty"`
	TriggeredBy *TriggeredBy      `json:"triggered_by,omitempty"`
}

type AuditBatch = []AuditEntry

type AuditEntry struct {
	Timestamp time.Time       `json:"timestamp"`
	Source    string          `json:"source"`
	EventType string          `json:"event_type"`
	Subject   json.RawMessage `json:"subject"`
	Object    json.RawMessage `json:"object"`
	Action    string          `json:"action"`
	Result    string          `json:"result"`
	Hostname  string          `json:"hostname"`
	Raw       string          `json:"raw"`
}

type BinaryInfo struct {
	Version  string `json:"version"`
	Checksum string `json:"checksum"`
}

type BridgeConfig struct {
	AccessSubnets    []string `json:"access_subnets"`
	EnableNAT        bool     `json:"enable_nat"`
	EnableForwarding bool     `json:"enable_forwarding"`
}

type BridgeInfo struct {
	Enabled                 bool   `json:"enabled"`
	AccessInterface         string `json:"access_interface"`
	ActiveRoutes            int    `json:"active_routes"`
	RelayEnabled            bool   `json:"relay_enabled"`
	ActiveRelaySessions     int    `json:"active_relay_sessions"`
	IngressEnabled          bool   `json:"ingress_enabled"`
	ActiveIngressRules      int    `json:"active_ingress_rules"`
	SiteToSiteEnabled       bool   `json:"site_to_site_enabled"`
	ActiveSiteToSiteTunnels int    `json:"active_site_to_site_tunnels"`
}

type CapabilitiesPayload struct {
	Binary         *BinaryInfo  `json:"binary,omitempty"`
	BuiltinActions []ActionInfo `json:"builtin_actions"`
	Hooks          []HookInfo   `json:"hooks"`
}

type Clock interface {
	Now() time.Time
	After(d time.Duration) <-chan time.Time
}

type Config struct {
	// BaseURL is the control plane API base URL (required).
	// Example: "https://api.plexsphere.com"
	BaseURL string `yaml:"base_url"`

	// TLSInsecureSkipVerify disables TLS certificate verification.
	// WARNING: Only use for development/testing.
	TLSInsecureSkipVerify bool `yaml:"tls_insecure_skip_verify"`

	// ConnectTimeout is the maximum time to wait for a TCP connection.
	// Default: 10s
	ConnectTimeout time.Duration `yaml:"connect_timeout"`

	// RequestTimeout is the maximum time for a complete HTTP request/response cycle.
	// Default: 30s
	RequestTimeout time.Duration `yaml:"request_timeout"`

	// SSEIdleTimeout is the maximum time to wait for any data on the SSE stream
	// before considering the connection stale and reconnecting.
	// Default: 90s
	SSEIdleTimeout time.Duration `yaml:"sse_idle_timeout"`
}

type ConnectFunc func(ctx context.Context) error

type ControlPlane struct {
	// contains filtered or unexported fields
}

type DataEntry struct {
	Key         string          `json:"key"`
	ContentType string          `json:"content_type"`
	Payload     json.RawMessage `json:"payload"`
	Version     int             `json:"version"`
	UpdatedAt   time.Time       `json:"updated_at"`
}

type DriftCorrection struct {
	Type   string `json:"type"`
	Detail string `json:"detail"`
}

type DriftReport struct {
	Timestamp   time.Time         `json:"timestamp"`
	Corrections []DriftCorrection `json:"corrections"`
}

type Ed25519Verifier struct {
	// contains filtered or unexported fields
}

type EndpointReport struct {
	PublicEndpoint string `json:"public_endpoint"`
	NATType        string `json:"nat_type"`
}

type EndpointResponse struct {
	PeerEndpoints []PeerEndpoint `json:"peer_endpoints"`
}

type EventDispatcher struct {
	// contains filtered or unexported fields
}

type EventHandler func(ctx context.Context, envelope SignedEnvelope) error

type EventVerifier interface {
	Verify(ctx context.Context, envelope SignedEnvelope) error
}

type ExecutionAck struct {
	ExecutionID string `json:"execution_id"`
	Status      string `json:"status"`
	Reason      string `json:"reason"`
}

type ExecutionResult struct {
	ExecutionID string       `json:"execution_id"`
	Status      string       `json:"status"`
	ExitCode    int          `json:"exit_code"`
	Stdout      string       `json:"stdout"`
	Stderr      string       `json:"stderr"`
	Duration    string       `json:"duration"`
	FinishedAt  time.Time    `json:"finished_at"`
	TriggeredBy *TriggeredBy `json:"triggered_by,omitempty"`
}

type FailureAction int

type HeartbeatRequest struct {
	NodeID         string          `json:"node_id"`
	Timestamp      time.Time       `json:"timestamp"`
	Status         string          `json:"status"`
	Uptime         string          `json:"uptime"`
	BinaryChecksum string          `json:"binary_checksum"`
	Mesh           *MeshInfo       `json:"mesh,omitempty"`
	NAT            *NATInfo        `json:"nat,omitempty"`
	Bridge         *BridgeInfo     `json:"bridge,omitempty"`
	UserAccess     *UserAccessInfo `json:"user_access,omitempty"`
	Ingress        *IngressInfo    `json:"ingress,omitempty"`
	SiteToSite     *SiteToSiteInfo `json:"site_to_site,omitempty"`
}

type HeartbeatResponse struct {
	Reconcile  bool `json:"reconcile"`
	RotateKeys bool `json:"rotate_keys"`
}

type HookInfo struct {
	Name        string        `json:"name"`
	Description string        `json:"description"`
	Source      string        `json:"source"`
	Checksum    string        `json:"checksum"`
	Parameters  []ActionParam `json:"parameters"`
	Timeout     string        `json:"timeout"`
	Sandbox     string        `json:"sandbox"`
}

type IngressConfig struct {
	Enabled bool          `json:"enabled"`
	Rules   []IngressRule `json:"rules"`
}

type IngressInfo struct {
	Enabled         bool `json:"enabled"`
	RuleCount       int  `json:"rule_count"`
	ConnectionCount int  `json:"connection_count"`
	ACMEEnabled     bool `json:"acme_enabled"`
}

type IngressRule struct {
	RuleID     string `json:"rule_id"`
	ListenPort int    `json:"listen_port"`
	TargetAddr string `json:"target_addr"`
	// Mode is the TLS handling mode: "tcp" (passthrough), "terminate" (static cert),
	// or "acme" (automatic certificate via ACME).
	Mode     string `json:"mode"`
	CertPEM  string `json:"cert_pem,omitempty"`
	KeyPEM   string `json:"key_pem,omitempty"`
	Hostname string `json:"hostname,omitempty"`
}

type IntegrityViolationReport struct {
	Type             string    `json:"type"`
	Path             string    `json:"path"`
	ExpectedChecksum string    `json:"expected_checksum"`
	ActualChecksum   string    `json:"actual_checksum"`
	Detail           string    `json:"detail"`
	Timestamp        time.Time `json:"timestamp"`
}

type KeyRotateRequest struct {
	NodeID       string `json:"node_id"`
	NewPublicKey string `json:"new_public_key"`
}

type KeyRotateResponse struct {
	UpdatedPeers []Peer `json:"updated_peers"`
}

type LocalEndpointConfig struct {
	// URL is the HTTPS endpoint URL. Must use the https:// scheme when set.
	URL string `yaml:"url"`

	// SecretKey is the authentication credential for the local endpoint.
	// Required when URL is non-empty.
	SecretKey string `yaml:"secret_key"`

	// TLSInsecureSkipVerify disables TLS certificate verification.
	TLSInsecureSkipVerify bool `yaml:"tls_insecure_skip_verify"`
}

type LogBatch = []LogEntry

type LogEntry struct {
	Timestamp time.Time `json:"timestamp"`
	Source    string    `json:"source"`
	Unit      string    `json:"unit"`
	Message   string    `json:"message"`
	Severity  string    `json:"severity"`
	Hostname  string    `json:"hostname"`
}

type MeshInfo struct {
	Interface  string `json:"interface"`
	PeerCount  int    `json:"peer_count"`
	ListenPort int    `json:"listen_port"`
}

type MetricBatch = []MetricPoint

type MetricPoint struct {
	Timestamp time.Time       `json:"timestamp"`
	Group     string          `json:"group"`
	PeerID    string          `json:"peer_id,omitempty"`
	Data      json.RawMessage `json:"data"`
}

type NATInfo struct {
	PublicEndpoint string `json:"public_endpoint"`
	Type           string `json:"type"`
}

type NoOpVerifier struct{}

type NonceStore struct {
	// contains filtered or unexported fields
}

type Peer struct {
	ID         string   `json:"id"`
	PublicKey  string   `json:"public_key"`
	MeshIP     string   `json:"mesh_ip"`
	Endpoint   string   `json:"endpoint"`
	AllowedIPs []string `json:"allowed_ips"`
	PSK        string   `json:"psk"`
}

type PeerEndpoint struct {
	PeerID   string `json:"peer_id"`
	Endpoint string `json:"endpoint"`
}

type Policy struct {
	ID    string       `json:"id"`
	Rules []PolicyRule `json:"rules"`
}

type PolicyRule struct {
	Src      string `json:"src"`
	Dst      string `json:"dst"`
	Port     int    `json:"port"`
	Protocol string `json:"protocol"`
	Action   string `json:"action"`
}

type PollFunc func(ctx context.Context) error

type ReconnectEngine struct {
	// contains filtered or unexported fields
}

type RegisterRequest struct {
	Token        string               `json:"token"`
	PublicKey    string               `json:"public_key"`
	Hostname     string               `json:"hostname"`
	Metadata     map[string]string    `json:"metadata,omitempty"`
	Capabilities *CapabilitiesPayload `json:"capabilities,omitempty"`
}

type RegisterResponse struct {
	NodeID           string `json:"node_id"`
	MeshIP           string `json:"mesh_ip"`
	SigningPublicKey string `json:"signing_public_key"`
	NodeSecretKey    string `json:"node_secret_key"`
	Peers            []Peer `json:"peers"`
}

type RelayConfig struct {
	Sessions []RelaySessionAssignment `json:"sessions"`
}

type RelaySessionAssignment struct {
	SessionID     string    `json:"session_id"`
	PeerAID       string    `json:"peer_a_id"`
	PeerAEndpoint string    `json:"peer_a_endpoint"`
	PeerBID       string    `json:"peer_b_id"`
	PeerBEndpoint string    `json:"peer_b_endpoint"`
	ExpiresAt     time.Time `json:"expires_at"`
}

type ReportEntry struct {
	Key         string          `json:"key"`
	ContentType string          `json:"content_type"`
	Payload     json.RawMessage `json:"payload"`
	Version     int             `json:"version"`
	UpdatedAt   time.Time       `json:"updated_at"`
}

type ReportSyncRequest struct {
	Entries []ReportEntry `json:"entries"`
	Deleted []string      `json:"deleted"`
}

type RetryCallback func(interval time.Duration)

type SSEEvent struct {
	Type string // from "event:" field, defaults to "message"
	Data string // concatenated data fields
	ID   string // from "id:" field
}

type SSEManager struct {
	// contains filtered or unexported fields
}

type SSEParser struct {
	// contains filtered or unexported fields
}

type SSEStream struct {
	// contains filtered or unexported fields
}

type SSHSessionSetup struct {
	SessionID     string    `json:"session_id"`
	TargetHost    string    `json:"target_host"`
	TargetPort    int       `json:"target_port"`
	AuthorizedKey string    `json:"authorized_key"`
	ExpiresAt     time.Time `json:"expires_at"`
}

type SecretRef struct {
	Key     string `json:"key"`
	Version int    `json:"version"`
}

type SecretResponse struct {
	Key        string `json:"key"`
	Ciphertext string `json:"ciphertext"`
	Nonce      string `json:"nonce"`
	Version    int    `json:"version"`
}

type SignedEnvelope struct {
	EventType string          `json:"event_type"`
	EventID   string          `json:"event_id"`
	IssuedAt  time.Time       `json:"issued_at"`
	Nonce     string          `json:"nonce"`
	Payload   json.RawMessage `json:"payload"`
	Signature string          `json:"signature"`
}

type SigningKeys struct {
	Current           string     `json:"current"`
	Previous          string     `json:"previous,omitempty"`
	TransitionExpires *time.Time `json:"transition_expires,omitempty"`
}

type SiteToSiteConfig struct {
	Enabled bool               `json:"enabled"`
	Tunnels []SiteToSiteTunnel `json:"tunnels"`
}

type SiteToSiteInfo struct {
	Enabled             bool     `json:"enabled"`
	TunnelCount         int      `json:"tunnel_count"`
	TunnelProviderNames []string `json:"tunnel_provider_names,omitempty"`
}

type SiteToSiteTunnel struct {
	TunnelID        string   `json:"tunnel_id"`
	RemoteEndpoint  string   `json:"remote_endpoint"`
	RemotePublicKey string   `json:"remote_public_key"`
	LocalSubnets    []string `json:"local_subnets"`
	RemoteSubnets   []string `json:"remote_subnets"`
	PSK             string   `json:"psk,omitempty"`
	InterfaceName   string   `json:"interface_name"`
	ListenPort      int      `json:"listen_port"`
	// ProviderType specifies which tunnel provider to use for this tunnel.
	// Empty or "wireguard" means the default WireGuard-based approach.
	// Other values (e.g. "ipsec", "openvpn") delegate to the corresponding TunnelProvider.
	ProviderType string `json:"provider_type,omitempty"`
}

type StateResponse struct {
	Peers            []Peer            `json:"peers"`
	Policies         []Policy          `json:"policies"`
	SigningKeys      *SigningKeys      `json:"signing_keys,omitempty"`
	Metadata         map[string]string `json:"metadata,omitempty"`
	BridgeConfig     *BridgeConfig     `json:"bridge_config,omitempty"`
	RelayConfig      *RelayConfig      `json:"relay_config,omitempty"`
	UserAccessConfig *UserAccessConfig `json:"user_access_config,omitempty"`
	IngressConfig    *IngressConfig    `json:"ingress_config,omitempty"`
	SiteToSiteConfig *SiteToSiteConfig `json:"site_to_site_config,omitempty"`
	Data             []DataEntry       `json:"data"`
	SecretRefs       []SecretRef       `json:"secret_refs"`
}

type TriggeredBy struct {
	Type      string `json:"type"`
	SessionID string `json:"session_id"`
	UserID    string `json:"user_id"`
	Email     string `json:"email"`
}

type TunnelClosedRequest struct {
	Reason    string    `json:"reason"`
	Duration  string    `json:"duration"`
	Timestamp time.Time `json:"timestamp"`
}

type TunnelReadyRequest struct {
	ListenAddr string    `json:"listen_addr"`
	Timestamp  time.Time `json:"timestamp"`
}

type UserAccessConfig struct {
	Enabled       bool             `json:"enabled"`
	InterfaceName string           `json:"interface_name"`
	ListenPort    int              `json:"listen_port"`
	Peers         []UserAccessPeer `json:"peers"`
}

type UserAccessInfo struct {
	Enabled        bool   `json:"enabled"`
	InterfaceName  string `json:"interface_name"`
	PeerCount      int    `json:"peer_count"`
	ListenPort     int    `json:"listen_port"`
	ProviderName   string `json:"provider_name,omitempty"`
	ProviderStatus string `json:"provider_status,omitempty"`
}

type UserAccessPeer struct {
	PublicKey  string   `json:"public_key"`
	AllowedIPs []string `json:"allowed_ips"`
	PSK        string   `json:"psk,omitempty"`
	Label      string   `json:"label"`
}