api

type APIError struct {
	StatusCode int
	Message    string
	// Code carries the machine-readable code member of an RFC 9457
	// problem+json response. It is empty when the response carries no
	// code (or is not a problem+json body).
	Code string
	// CorrelationID carries the correlation_id member of an RFC 9457
	// problem+json response, falling back to the X-Correlation-Id header
	// of that same response. Both sources are read only from a response
	// that presents itself as a problem document, and that is the whole
	// of what the gate buys: a response an intermediary substituted for
	// the control plane's contributes no id. It does not authenticate the
	// header, so a tracing proxy that passes a genuine problem document
	// through and stamps its own X-Correlation-Id on it is read by the
	// fallback. It is empty when neither source carries a usable id.
	CorrelationID string
	RetryAfter    time.Duration // only set for 429
}

type ActionInfo struct {
	Name        string        `json:"name"`
	Description string        `json:"description"`
	Parameters  []ActionParam `json:"parameters"`
}

type ActionParam struct {
	Name        string `json:"name"`
	Type        string `json:"type"`
	Required    bool   `json:"required"`
	Default     string `json:"default,omitempty"`
	Description string `json:"description"`
}

type AuditBatch = []AuditEntry

type AuditEntry struct {
	Timestamp time.Time       `json:"timestamp"`
	Source    string          `json:"source"`
	EventType string          `json:"event_type"`
	Subject   json.RawMessage `json:"subject"`
	Object    json.RawMessage `json:"object"`
	Action    string          `json:"action"`
	Result    string          `json:"result"`
	Hostname  string          `json:"hostname"`
	Raw       string          `json:"raw"`
}

type AuditEvent struct {
	Source    string    `json:"source"`
	Action    string    `json:"action"`
	Outcome   string    `json:"outcome"`
	Timestamp time.Time `json:"timestamp"`
}

type BinaryInfo struct {
	Version  string `json:"version"`
	Checksum string `json:"checksum"`
}

type BridgeInfo struct {
	Enabled                 bool   `json:"enabled"`
	AccessInterface         string `json:"access_interface"`
	ActiveRoutes            int    `json:"active_routes"`
	RelayEnabled            bool   `json:"relay_enabled"`
	ActiveRelaySessions     int    `json:"active_relay_sessions"`
	IngressEnabled          bool   `json:"ingress_enabled"`
	ActiveIngressRules      int    `json:"active_ingress_rules"`
	SiteToSiteEnabled       bool   `json:"site_to_site_enabled"`
	ActiveSiteToSiteTunnels int    `json:"active_site_to_site_tunnels"`
}

type BridgeSnapshot struct {
	Relay      *RelayConfig      `json:"relay"`
	UserAccess *UserAccessConfig `json:"user_access"`
	Ingress    *IngressConfig    `json:"ingress"`
	SiteToSite *SiteToSiteConfig `json:"site_to_site"`
}

type CapabilityManifestRequest struct {
	// BinaryVersion is the agent version string, non-empty after trimming.
	BinaryVersion string `json:"binary_version"`
	// BinaryChecksum is the running binary's SHA-256 as 32 raw bytes in
	// standard-padded base64 (see integrity.WireChecksum). Anything that does
	// not decode to exactly 32 bytes is refused with 400
	// binary_checksum_invalid.
	BinaryChecksum string `json:"binary_checksum"`
	// SSHHostKeyFingerprint is the optional OpenSSH host-key fingerprint in the
	// canonical `SHA256:<base64>` form. Omitted when the agent has none.
	SSHHostKeyFingerprint string `json:"ssh_host_key_fingerprint,omitempty"`
	// DeclaredHooks are the hooks the agent advertises, at most 128, with
	// unique names. Omitted when empty rather than sent as null.
	DeclaredHooks []DeclaredHook `json:"declared_hooks,omitempty"`
}

type Clock interface {
	Now() time.Time
	After(d time.Duration) <-chan time.Time
}

type Config struct {
	// BaseURL is the control plane API base URL (required).
	// Example: "https://api.plexsphere.com"
	BaseURL string `yaml:"base_url"`

	// TLSInsecureSkipVerify disables TLS certificate verification.
	// WARNING: Only use for development/testing.
	TLSInsecureSkipVerify bool `yaml:"tls_insecure_skip_verify"`

	// ConnectTimeout is the maximum time to wait for a TCP connection.
	// Default: 10s
	ConnectTimeout time.Duration `yaml:"connect_timeout"`

	// RequestTimeout is the maximum time for a complete HTTP request/response cycle.
	// Default: 30s
	RequestTimeout time.Duration `yaml:"request_timeout"`

	// SSEIdleTimeout is the maximum time to wait for any data on the SSE stream
	// before considering the connection stale and reconnecting.
	// Default: 90s
	SSEIdleTimeout time.Duration `yaml:"sse_idle_timeout"`

	// SSEReprobeInterval is how often pull-only delivery re-probes the SSE
	// endpoint after the control plane descoped it.
	// Default: 10m
	SSEReprobeInterval time.Duration `yaml:"sse_reprobe_interval"`
}

type ConnectFunc func(ctx context.Context) error

type ControlPlane struct {
	// contains filtered or unexported fields
}

type DataEntry struct {
	Key         string          `json:"key"`
	ContentType string          `json:"content_type"`
	Payload     json.RawMessage `json:"payload"`
	Version     int             `json:"version"`
	UpdatedAt   time.Time       `json:"updated_at"`
}

type DeclaredHook struct {
	Name string `json:"name"`
	// Checksum is the hook payload's SHA-256 as 32 raw bytes in
	// standard-padded base64, same encoding as BinaryChecksum.
	Checksum string `json:"checksum"`
}

type DeliveryMode string

type Ed25519Verifier struct {
	// contains filtered or unexported fields
}

type EndpointRequest struct {
	Endpoint   string    `json:"endpoint"`
	NATType    string    `json:"nat_type"`
	ReportedAt time.Time `json:"reported_at"`
}

type EndpointResponse struct {
	AcceptedAt time.Time `json:"accepted_at"`
	StaleAfter time.Time `json:"stale_after"`
}

type Envelope struct {
	ID        string          `json:"id"`
	Type      string          `json:"type"`
	Scope     string          `json:"scope"`
	KeyID     string          `json:"key_id"`
	IssuedAt  time.Time       `json:"issued_at"`
	Payload   json.RawMessage `json:"payload"`
	Signature string          `json:"signature"`
}

type EventDispatcher struct {
	// contains filtered or unexported fields
}

type EventHandler func(ctx context.Context, envelope Envelope) error

type EventVerifier interface {
	Verify(ctx context.Context, envelope Envelope) error
}

type ExecutionCallbackRequest struct {
	Status              string           `json:"status"`
	ExitCode            *int             `json:"exit_code,omitempty"`
	Error               string           `json:"error,omitempty"`
	DeclaredOutputBytes int64            `json:"declared_output_bytes,omitempty"`
	Output              *ExecutionOutput `json:"output,omitempty"`
}

type ExecutionCallbackResponse struct {
	Status          string `json:"status"`
	OutputUploadURL string `json:"output_upload_url,omitempty"`
}

type ExecutionOutput struct {
	Inline    string `json:"inline,omitempty"`
	ObjectKey string `json:"object_key,omitempty"`
	SHA256    string `json:"sha256,omitempty"`
}

type FailureAction int

type HeartbeatRequest struct {
	ClientNow      time.Time      `json:"client_now"`
	BinaryChecksum string         `json:"binary_checksum"`
	BinaryVersion  string         `json:"binary_version"`
	NATSummary     map[string]any `json:"nat_summary"`
}

type HeartbeatResponse struct {
	AcceptedAt time.Time `json:"accepted_at"`
	Reconcile  bool      `json:"reconcile"`
	RotateKeys bool      `json:"rotate_keys"`
}

type HookInfo struct {
	Name        string        `json:"name"`
	Description string        `json:"description"`
	Source      string        `json:"source"`
	Checksum    string        `json:"checksum"`
	Parameters  []ActionParam `json:"parameters"`
	Timeout     string        `json:"timeout"`
	Sandbox     string        `json:"sandbox"`
}

type IngestReceipt struct {
	AcceptedAt time.Time `json:"accepted_at"`
	Records    int       `json:"records"`
}

type IngressConfig struct {
	Enabled bool          `json:"enabled"`
	Rules   []IngressRule `json:"rules"`
}

type IngressInfo struct {
	Enabled         bool `json:"enabled"`
	RuleCount       int  `json:"rule_count"`
	ConnectionCount int  `json:"connection_count"`
	ACMEEnabled     bool `json:"acme_enabled"`
}

type IngressRule struct {
	RuleID     string `json:"rule_id"`
	ListenPort int    `json:"listen_port"`
	TargetAddr string `json:"target_addr"`
	// Mode is the TLS handling mode: "tcp" (passthrough), "terminate" (static cert),
	// or "acme" (automatic certificate via ACME).
	Mode     string `json:"mode"`
	CertPEM  string `json:"cert_pem,omitempty"`
	KeyPEM   string `json:"key_pem,omitempty"`
	Hostname string `json:"hostname,omitempty"`
}

type IntegrityDetector string

type IntegrityViolationKind string

type IntegrityViolationReport struct {
	Kind       IntegrityViolationKind `json:"kind"`
	DetectedBy IntegrityDetector      `json:"detected_by"`
	// ArtifactID identifies the affected artifact — a hook path, the binary
	// path, or the host-key file. Non-empty after trimming, at most 4096 bytes.
	ArtifactID string `json:"artifact_id"`
	// ObservedChecksum is the SHA-256 the agent computed, as 32 raw bytes in
	// standard-padded base64 (see integrity.WireChecksum). Required for the
	// checksum kinds; anything that does not decode to exactly 32 bytes is
	// refused with 400 integrity_violation_checksum_invalid.
	ObservedChecksum string `json:"observed_checksum,omitempty"`
	// ExpectedChecksum is the baseline digest, same encoding as
	// ObservedChecksum.
	ExpectedChecksum string `json:"expected_checksum,omitempty"`
	// ObservedFingerprint is the OpenSSH host-key fingerprint the agent
	// observed, in the canonical `SHA256:<base64>` form. Required for the
	// ssh_host_key kind.
	ObservedFingerprint string `json:"observed_fingerprint,omitempty"`
	// ExpectedFingerprint is the baseline fingerprint, same form as
	// ObservedFingerprint.
	ExpectedFingerprint string `json:"expected_fingerprint,omitempty"`
}

type IntegrityViolationsRequest struct {
	// Violations carries between 1 and MaxIntegrityViolationsPerBatch entries.
	Violations []IntegrityViolationReport `json:"violations"`
}

type IntegrityViolationsResponse struct {
	// AcceptedAt is the server-side commit timestamp.
	AcceptedAt time.Time `json:"accepted_at"`
	// ViolationCount echoes the number of rows persisted, matching the length
	// of the violations array on input.
	ViolationCount int `json:"violation_count"`
}

type K8sActivity struct {
	Verb         string `json:"verb"`
	ResourceKind string `json:"resource_kind,omitempty"`
	Namespace    string `json:"namespace,omitempty"`
	Name         string `json:"name,omitempty"`
	StatusCode   int    `json:"status_code,omitempty"`
	DurationMS   int64  `json:"duration_ms,omitempty"`
}

type KeyRotateRequest struct {
	NewPublicKey string `json:"new_public_key"`
}

type KeyRotateResponse struct {
	RotationID     string `json:"rotation_id"`
	KID            string `json:"kid"`
	WrapKeyVersion int    `json:"wrap_key_version"`
}

type LocalEndpointConfig struct {
	// URL is the HTTPS endpoint URL. Must use the https:// scheme when set.
	URL string `yaml:"url"`

	// SecretKey is the authentication credential for the local endpoint.
	// Required when URL is non-empty.
	SecretKey string `yaml:"secret_key"`

	// TLSInsecureSkipVerify disables TLS certificate verification.
	TLSInsecureSkipVerify bool `yaml:"tls_insecure_skip_verify"`
}

type LogBatch = []LogEntry

type LogEntry struct {
	Timestamp time.Time `json:"timestamp"`
	Source    string    `json:"source"`
	Unit      string    `json:"unit"`
	Message   string    `json:"message"`
	Severity  string    `json:"severity"`
	Hostname  string    `json:"hostname"`
}

type LogLine struct {
	Severity  string    `json:"severity"`
	Unit      string    `json:"unit,omitempty"`
	Hostname  string    `json:"hostname,omitempty"`
	Message   string    `json:"message"`
	Timestamp time.Time `json:"timestamp"`
}

type MetricBatch = []MetricPoint

type MetricPoint struct {
	Timestamp time.Time       `json:"timestamp"`
	Group     string          `json:"group"`
	PeerID    string          `json:"peer_id,omitempty"`
	Data      json.RawMessage `json:"data"`
}

type MetricSample struct {
	Group     string            `json:"group"`
	Name      string            `json:"name"`
	Value     float64           `json:"value"`
	Labels    map[string]string `json:"labels,omitempty"`
	Timestamp time.Time         `json:"timestamp"`
}

type NoOpVerifier struct{}

type NodeStateBlock struct {
	Metadata []StateEntry `json:"metadata"`
	Data     []StateEntry `json:"data"`
	Reports  []StateEntry `json:"reports"`
}

type NodeStateExecution struct {
	ExecutionID string                     `json:"execution_id"`
	Action      string                     `json:"action"`
	Type        string                     `json:"type"`
	Parameters  map[string]json.RawMessage `json:"parameters"`
	Status      string                     `json:"status"`
	RequestedAt time.Time                  `json:"requested_at"`
	ExpiresAt   time.Time                  `json:"expires_at"`
}

type NodeStateReportRequest struct {
	Value       string `json:"value"`
	WorkloadTag string `json:"workload_tag,omitempty"`
}

type NodeStateReportResponse struct {
	AcceptedAt time.Time `json:"accepted_at"`
	Key        string    `json:"key"`
}

type NodeStateSession struct {
	SessionID          string        `json:"session_id"`
	JTI                string        `json:"jti"`
	Kind               string        `json:"kind"`
	Target             SessionTarget `json:"target"`
	ExpiresAt          time.Time     `json:"expires_at"`
	IdleTimeoutSeconds int           `json:"idle_timeout_seconds,omitempty"`
}

type NodeStateSnapshot struct {
	Peers        []SnapshotPeer       `json:"peers"`
	Reachability json.RawMessage      `json:"reachability"`
	Policy       *PolicySnapshot      `json:"policy"`
	Bridge       *BridgeSnapshot      `json:"bridge"`
	State        *NodeStateBlock      `json:"state"`
	Reports      *NodeStateBlock      `json:"reports"`
	Executions   []NodeStateExecution `json:"executions"`
	// Sessions is a pointer for the same reason the block fields above are: the
	// sessions block is desired state whose emptiness is destructive — an empty
	// block tears every live session down — so "the control plane says you have
	// no sessions" ([]) has to stay distinguishable from "the control plane did
	// not populate the block" (null, or a key a build predating the block never
	// wrote). A nil pointer is the second case and is not a teardown signal.
	Sessions *[]NodeStateSession `json:"sessions"`
}

type Peer struct {
	ID         string   `json:"id"`
	PublicKey  string   `json:"public_key"`
	MeshIP     string   `json:"mesh_ip"`
	Endpoint   string   `json:"endpoint"`
	AllowedIPs []string `json:"allowed_ips"`
	PSK        string   `json:"psk"`
}

type PolicyRule struct {
	Action          string     `json:"action"`
	Protocol        string     `json:"protocol"`
	SourceCIDR      string     `json:"source_cidr"`
	DestinationCIDR string     `json:"destination_cidr"`
	Ports           *PortRange `json:"ports,omitempty"`
}

type PolicySnapshot struct {
	RevisionID  string       `json:"revision_id"`
	Fingerprint string       `json:"fingerprint"`
	Rules       []PolicyRule `json:"rules"`
}

type PollFunc func(ctx context.Context) error

type PortRange struct {
	From int `json:"from"`
	To   int `json:"to"`
}

type ReachabilitySnapshot struct {
	State           string     `json:"state"`
	LastHeartbeatAt *time.Time `json:"last_heartbeat_at,omitempty"`
	ChangedAt       time.Time  `json:"changed_at"`
}

type ReconcileTrigger interface {
	TriggerReconcile()
}

type ReconnectEngine struct {
	// contains filtered or unexported fields
}

type RegisterPeer struct {
	NodeID           string `json:"node_id"`
	MeshIP           string `json:"mesh_ip"`
	PublicKey        string `json:"public_key"`
	FallbackEndpoint string `json:"fallback_endpoint,omitempty"`
}

type RegisterRequest struct {
	ProjectID           string `json:"project_id"`
	ResourceHandle      string `json:"resource_handle"`
	BootstrapToken      string `json:"bootstrap_token"`
	Nonce               string `json:"nonce"`
	PublicKey           string `json:"public_key"`
	RequestedResourceID string `json:"requested_resource_id,omitempty"`
}

type RegisterResponse struct {
	NodeID           string         `json:"node_id"`
	MeshIP           string         `json:"mesh_ip"`
	SigningPublicKey string         `json:"signing_public_key"`
	SigningKeyID     string         `json:"signing_key_id"`
	NSK              string         `json:"nsk"`
	PeerSnapshot     []RegisterPeer `json:"peer_snapshot"`
	DomainMeshCIDR   string         `json:"domain_mesh_cidr"`
}

type RelayConfig struct {
	Sessions []RelaySessionAssignment `json:"sessions"`
}

type RelaySessionAssignment struct {
	SessionID     string    `json:"session_id"`
	PeerAID       string    `json:"peer_a_id"`
	PeerAEndpoint string    `json:"peer_a_endpoint"`
	PeerBID       string    `json:"peer_b_id"`
	PeerBEndpoint string    `json:"peer_b_endpoint"`
	ExpiresAt     time.Time `json:"expires_at"`
}

type RetryCallback func(interval time.Duration)

type SSEEvent struct {
	Type string // from "event:" field, defaults to "message"
	Data string // concatenated data fields
	ID   string // from "id:" field
}

type SSEManager struct {
	// contains filtered or unexported fields
}

type SSEParser struct {
	// contains filtered or unexported fields
}

type SSEStream struct {
	// contains filtered or unexported fields
}

type SSHActivity struct {
	Command     string     `json:"command"`
	ExitCode    *int       `json:"exit_code,omitempty"`
	StartedAt   *time.Time `json:"started_at,omitempty"`
	CompletedAt *time.Time `json:"completed_at,omitempty"`
}

type SecretEnvelope struct {
	Data    []byte
	Version int
	KID     string
}

type SecretRef struct {
	Key     string `json:"key"`
	Version int    `json:"version"`
}

type SessionActivityRequest struct {
	SSH *SSHActivity `json:"ssh,omitempty"`
	K8s *K8sActivity `json:"k8s,omitempty"`
	TCP *TCPActivity `json:"tcp,omitempty"`
}

type SessionTarget struct {
	SSH *SessionTargetSSH `json:"ssh,omitempty"`
	K8s *SessionTargetK8s `json:"k8s,omitempty"`
	TCP *SessionTargetTCP `json:"tcp,omitempty"`
}

type SessionTargetK8s struct {
	User              string   `json:"user"`
	ImpersonateGroups []string `json:"impersonate_groups,omitempty"`
}

type SessionTargetSSH struct {
	User            string   `json:"user"`
	AllowedCommands []string `json:"allowed_commands,omitempty"`
}

type SessionTargetTCP struct {
	Host string `json:"host"`
	Port int    `json:"port"`
}

type SigningKeyRotation struct {
	KeyID             string    `json:"key_id"`
	PublicKey         string    `json:"public_key"`
	PreviousKeyID     string    `json:"previous_key_id"`
	TransitionExpires time.Time `json:"transition_expires"`
}

type SiteToSiteConfig struct {
	Enabled bool               `json:"enabled"`
	Tunnels []SiteToSiteTunnel `json:"tunnels"`
}

type SiteToSiteInfo struct {
	Enabled             bool     `json:"enabled"`
	TunnelCount         int      `json:"tunnel_count"`
	TunnelProviderNames []string `json:"tunnel_provider_names,omitempty"`
}

type SiteToSiteTunnel struct {
	TunnelID        string   `json:"tunnel_id"`
	RemoteEndpoint  string   `json:"remote_endpoint"`
	RemotePublicKey string   `json:"remote_public_key"`
	LocalSubnets    []string `json:"local_subnets"`
	RemoteSubnets   []string `json:"remote_subnets"`
	PSK             string   `json:"psk,omitempty"`
	InterfaceName   string   `json:"interface_name"`
	ListenPort      int      `json:"listen_port"`
	// ProviderType specifies which tunnel provider to use for this tunnel.
	// Empty or "wireguard" means the default WireGuard-based approach.
	// Other values (e.g. "ipsec", "openvpn") delegate to the corresponding TunnelProvider.
	ProviderType string `json:"provider_type,omitempty"`
}

type SnapshotPeer struct {
	NodeID           string `json:"node_id"`
	MeshIP           string `json:"mesh_ip"`
	PublicKey        string `json:"public_key"`
	FallbackEndpoint string `json:"fallback_endpoint,omitempty"`
}

type StateEntry struct {
	Key         string `json:"key"`
	Value       string `json:"value"`
	WorkloadTag string `json:"workload_tag,omitempty"`
}

type TCPActivity struct {
	Phase            string `json:"phase"`
	TargetHost       string `json:"target_host,omitempty"`
	TargetPort       int    `json:"target_port,omitempty"`
	ListenerEndpoint string `json:"listener_endpoint,omitempty"`
	BytesIn          *int64 `json:"bytes_in,omitempty"`
	BytesOut         *int64 `json:"bytes_out,omitempty"`
	TerminatedBy     string `json:"terminated_by,omitempty"`
}

type UserAccessConfig struct {
	Enabled       bool             `json:"enabled"`
	InterfaceName string           `json:"interface_name"`
	ListenPort    int              `json:"listen_port"`
	Peers         []UserAccessPeer `json:"peers"`
}

type UserAccessInfo struct {
	Enabled        bool   `json:"enabled"`
	InterfaceName  string `json:"interface_name"`
	PeerCount      int    `json:"peer_count"`
	ListenPort     int    `json:"listen_port"`
	ProviderName   string `json:"provider_name,omitempty"`
	ProviderStatus string `json:"provider_status,omitempty"`
}

type UserAccessPeer struct {
	PublicKey  string   `json:"public_key"`
	AllowedIPs []string `json:"allowed_ips"`
	PSK        string   `json:"psk,omitempty"`
	Label      string   `json:"label"`
}