msg

type ApprovalDecision string

type ApprovalType string

type ChatbotSessionInfo struct {
	SessionID    string `json:"session_id"`
	PaneID       string `json:"pane_id"`
	VisitorID    string `json:"visitor_id"`
	VisitorName  string `json:"visitor_name"`
	OriginURL    string `json:"origin_url"`
	Status       string `json:"status"`
	TakenOverBy  string `json:"taken_over_by"`
	MessageCount int    `json:"message_count"`
	CreatedAt    string `json:"created_at"`
	LastMessage  string `json:"last_message"`
}

type Choice struct {
	Label       string `json:"label"`
	Description string `json:"description"`
}

type CodecRegistry struct {
	// contains filtered or unexported fields
}

type ConversationMessage struct {
	// Identity — links question and answer within a turn.
	TurnID           string           `json:"turn_id"`
	TurnType         TurnType         `json:"turn_type"`
	ConversationType ConversationType `json:"conversation_type"`

	// Source — who created this message and how.
	InputType     InputType     `json:"input_type"`
	MessageSource MessageSource `json:"message_source"`

	// Payload
	Content     string `json:"content"`
	TimestampMs int64  `json:"timestamp_ms"`

	// Metadata
	Sensitive      bool   `json:"sensitive,omitempty"`
	SubjectToShare bool   `json:"subject_to_share,omitempty"`
	Role           string `json:"role,omitempty"`      // multi-party: visitor, assistant, human, system
	Streaming      bool   `json:"streaming,omitempty"` // true = partial chunk of an in-progress answer
	// ToolChrome marks agent working output — a "⏺ tool(…)" header, its
	// "⎿ ✓ N lines" result branch, a tool error, a diff — as opposed to answer
	// text. Operators' terminals show it; customer-facing surfaces (a chatbot
	// widget, a channel reply, the visitor transcript) drop it (E-59). Set by
	// the orchestrator, which is the last place that knows the difference.
	ToolChrome bool `json:"tool_chrome,omitempty"`

	// Origin records mirroring provenance: set when this message is a remote
	// tab/pane's output being mirrored into a local (subscriber) pane, so the
	// content is traceable back to its source. Nil for normal local messages.
	Origin *MessageOrigin `json:"origin,omitempty"`

	// ProviderName / Model record WHICH model produced an answer. MessageSource
	// says "ai"; these say which one — the distinction that matters once
	// `##llm select` can change the model mid-conversation, leaving a pane whose
	// stored turns were written by two different models with nothing in the JSON
	// to tell them apart. Empty on questions, and on answers recorded before
	// this existed.
	//
	// The provider-facing twin is ConversationTurn.ProviderName/Model; this is
	// the display/persistence side, so a reader of the pane's history can
	// attribute a turn without replaying the agentic loop.
	ProviderName string `json:"provider_name,omitempty"`
	Model        string `json:"model,omitempty"`
}

type ConversationTurnInfo struct {
	Role       string         `json:"role"`
	Content    string         `json:"content"`
	ToolCalls  []ToolCallInfo `json:"tool_calls,omitempty"`
	ToolCallID string         `json:"tool_call_id,omitempty"`
	IsError    bool           `json:"is_error,omitempty"`
	// Category / Origin / Summary mirror provider.ConversationTurn metadata:
	// the pane-mode categorisation (shell/ai/rysh/chat) extended with agentic
	// origins (tool/subagent), the producer id, and the short step title.
	Category    string `json:"category,omitempty"`
	Origin      string `json:"origin,omitempty"`
	Summary     string `json:"summary,omitempty"`
	TimestampMs int64  `json:"timestamp_ms,omitempty"`
}

type ConversationType string

type DiffPayload struct {
	FilePath    string `json:"file_path"`
	UnifiedDiff string `json:"unified_diff"`
}

type GatewayLeaseReply struct {
	GrantedTokens  int64     `json:"granted_tokens"`
	ExpiresAt      time.Time `json:"expires_at"`
	RemainingToday int64     `json:"remaining_today"`
	// CeilingTokens is the scope's configured ceiling, 0 when unlimited. With
	// no ceiling the server grants freely and the daemon still reports usage.
	CeilingTokens int64 `json:"ceiling_tokens"`
	// ActiveDaemons and MaxLeaseTokens make the OVERSPEND BOUND observable
	// rather than a claim in a document: worst case is
	// ceiling + ActiveDaemons × MaxLeaseTokens (023 §4.2).
	ActiveDaemons  int   `json:"active_daemons"`
	MaxLeaseTokens int64 `json:"max_lease_tokens"`
}

type GatewayLeaseRequest struct {
	// Scope is "" for the whole workspace, or "tenant:<name>" for one customer.
	Scope      string `json:"scope,omitempty"`
	WantTokens int64  `json:"want_tokens"`
	DaemonID   string `json:"daemon_id"`
	SpentSince int64  `json:"spent_since"`
}

type GatewayUsageRollup struct {
	// Tenant is the customer dimension from 022 §4.3. "" = untenanted.
	Tenant string `json:"tenant,omitempty"`
	// UsageDate is the UTC calendar day, "YYYY-MM-DD" — the same string form
	// invoke_op_usage uses, so the unique key is a stable upsert target.
	UsageDate    string `json:"usage_date"`
	InTokens     int64  `json:"in_tokens"`
	OutTokens    int64  `json:"out_tokens"`
	CacheRead    int64  `json:"cache_read,omitempty"`
	CacheWrite   int64  `json:"cache_write,omitempty"`
	CostMicroUSD int64  `json:"cost_micro_usd"`
	Calls        int64  `json:"calls"`
}

type GroundingReportInfo struct {
	Understood    bool     `json:"understood"`
	RelevantFiles []string `json:"relevant_files,omitempty"`
	Evidence      string   `json:"evidence,omitempty"`
	MissingInfo   string   `json:"missing_info,omitempty"`
	Question      string   `json:"question,omitempty"`
	TimestampMs   int64    `json:"timestamp_ms,omitempty"`
}

type InputType string

type MemoryEntry struct {
	ID          string           `json:"id"`            // UUID
	Summary     string           `json:"summary"`       // LLM-generated summary
	TurnIDs     []string         `json:"turn_ids"`      // turn_ids that were summarized
	Mode        ConversationType `json:"mode"`          // conversation mode
	CreatedAtMs int64            `json:"created_at_ms"` // when the memory was created
	TurnCount   int              `json:"turn_count"`    // how many turns were condensed
}

type MemoryState struct {
	PaneID               string           `json:"pane_id"`
	Mode                 ConversationType `json:"mode"`
	Entries              []MemoryEntry    `json:"entries"`
	TotalSummarizedTurns int              `json:"total_summarized_turns"`
}

type MessageLogger struct {
	// contains filtered or unexported fields
}

type MessageOrigin struct {
	SourceShareID   string `json:"source_share_id,omitempty"`
	SourceTabID     string `json:"source_tab_id,omitempty"`
	SourcePaneID    string `json:"source_pane_id,omitempty"`
	SourcePaneAlias string `json:"source_pane_alias,omitempty"`
	MirrorTabID     string `json:"mirror_tab_id,omitempty"`
	MirrorPaneID    string `json:"mirror_pane_id,omitempty"`
}

type MessageSource string

type MsgAgenticCancel struct{}

type MsgAgenticContinue struct{}

type MsgAgenticOutput struct {
	OrchestratorID string            `json:"orchestrator_id"`
	Type           string            `json:"type"` // "thinking", "text", "tool_call", "tool_result", "diff", "error"
	Content        string            `json:"content"`
	Metadata       map[string]string `json:"metadata,omitempty"`
}

type MsgAgenticPrompt struct {
	RequestID     string                  `json:"request_id"`
	Prompt        string                  `json:"prompt"`
	ContentBlocks []provider.ContentBlock `json:"content_blocks,omitempty"`
	// ScopeHint identifies the execution point (e.g. the invoking pane's scope
	// chain) so an agent/humanoid resolves tools against that pane's scope. Opaque
	// to this package; interpreted by the host's scope resolver. Empty for panes
	// (their registry is fixed) and for agents invoked outside any pane.
	ScopeHint string `json:"scope_hint,omitempty"`
}

type MsgAgenticStatus struct {
	OrchestratorID string   `json:"orchestrator_id"`
	Phase          string   `json:"phase"` // "planning", "executing", "waiting_approval", "done", "error"
	Iteration      int      `json:"iteration"`
	MaxIterations  int      `json:"max_iterations"`
	ActiveTools    []string `json:"active_tools,omitempty"`
}

type MsgAgenticStep struct {
	OrchestratorID string `json:"orchestrator_id"`
	Kind           string `json:"kind"`  // Step* constants above
	Title          string `json:"title"` // short human-readable step title
	// Detail optionally carries the larger payload (tool result digest,
	// sub-agent summary, final answer text). Renderers that only want titles
	// ignore it.
	Detail string `json:"detail,omitempty"`
	// Category / Origin mirror the conversation-turn categorisation
	// (provider.TurnCategory*): "tool" with the tool name, "subagent" with the
	// child orchestrator id, "ai" for model-level events.
	Category string `json:"category,omitempty"`
	Origin   string `json:"origin,omitempty"`
	// Depth is the sub-agent depth of the emitting orchestrator (0 = top).
	Depth       int   `json:"depth"`
	Iteration   int   `json:"iteration,omitempty"`
	TimestampMs int64 `json:"timestamp_ms"`
}

type MsgApprovalRequest struct {
	RequestID      string       `json:"request_id"`
	OrchestratorID string       `json:"orchestrator_id"`
	ToolCallID     string       `json:"tool_call_id"`
	Type           ApprovalType `json:"type"`
	Description    string       `json:"description"`
	Diff           *DiffPayload `json:"diff,omitempty"`
	Choices        []Choice     `json:"choices,omitempty"`
}

type MsgApprovalResponse struct {
	RequestID string           `json:"request_id"`
	Decision  ApprovalDecision `json:"decision"`
	Reason    string           `json:"reason,omitempty"`
	// ChoiceIdx is the zero-based index into the request's Choices, meaningful
	// only with DecisionChoiceSelected. Only ask_user's question requests carry
	// Choices, and ask_user is its consumer; a gate refuses it (F-47). Index 0
	// is omitted on the wire and decodes back to 0.
	ChoiceIdx        int    `json:"choice_idx,omitempty"`
	RespondingPaneID string `json:"responding_pane_id,omitempty"`
}

type MsgBrowserActionRequest struct {
	RequestID string          `json:"request_id"` // UUID for correlation
	Action    string          `json:"action"`     // Action name: navigate, click, type, etc.
	Params    json.RawMessage `json:"params"`     // Action-specific parameters
}

type MsgBrowserActionResponse struct {
	RequestID  string          `json:"request_id"`           // Echoes request ID
	Success    bool            `json:"success"`              // Whether the action succeeded
	Result     json.RawMessage `json:"result,omitempty"`     // Action-specific result data
	Error      string          `json:"error,omitempty"`      // Error message if !success
	Screenshot string          `json:"screenshot,omitempty"` // Optional base64 PNG
}

type MsgChatbotHumanReply struct {
	SessionID string `json:"session_id"`
	PaneID    string `json:"pane_id"`
	Content   string `json:"content"`
	UserName  string `json:"user_name"`
}

type MsgChatbotRelease struct {
	SessionID string `json:"session_id"`
	PaneID    string `json:"pane_id"`
	UserID    string `json:"user_id"`
}

type MsgChatbotSessionClosed struct {
	ConfigID  string `json:"config_id"`
	SessionID string `json:"session_id"`
	PaneID    string `json:"pane_id"`
	Reason    string `json:"reason"` // "visitor_left", "timeout", "operator_closed"
}

type MsgChatbotSessionCreated struct {
	ConfigID    string `json:"config_id"`
	SessionID   string `json:"session_id"`
	PaneID      string `json:"pane_id"`
	VisitorID   string `json:"visitor_id"`
	VisitorName string `json:"visitor_name"`
	OriginURL   string `json:"origin_url"`
}

type MsgChatbotSessionList struct {
	ConfigID string `json:"config_id"`
}

type MsgChatbotSessionListReply struct {
	Sessions []ChatbotSessionInfo `json:"sessions"`
}

type MsgChatbotTakeover struct {
	SessionID string `json:"session_id"`
	PaneID    string `json:"pane_id"`
	UserID    string `json:"user_id"`
	UserName  string `json:"user_name"`
}

type MsgChatbotVisitorTyping struct {
	SessionID string `json:"session_id"`
	IsTyping  bool   `json:"is_typing"`
}

type MsgConversationAppend struct {
	Message *ConversationMessage `json:"message"`
}

type MsgConversationHistoryAppend struct {
	Message *ConversationMessage `json:"message"`
}

type MsgConversationHistoryReply struct {
	PaneID string                 `json:"pane_id"`
	Turns  []ConversationTurnInfo `json:"turns"`
}

type MsgCreateApprovalPane struct {
	RequestID       string              `json:"request_id"`
	SourcePaneID    string              `json:"source_pane_id"`
	SourcePaneName  string              `json:"source_pane_name"`
	OrchestratorID  string              `json:"orchestrator_id"`
	ApprovalRequest *MsgApprovalRequest `json:"approval_request"`
	ResponseSubject string              `json:"response_subject"`
}

type MsgDestroyApprovalPane struct {
	RequestID string `json:"request_id"`
}

type MsgGatewayUsageBatch struct {
	// DaemonID identifies the sending daemon for the lifetime of its process.
	DaemonID string `json:"daemon_id"`
	// Seq increments per batch within one daemon, starting at 1.
	Seq int64 `json:"seq"`
	// WorkspaceID is carried in the payload as well as the subject so a
	// consumer that fans in from several subjects does not have to parse it
	// back out of the subject token.
	WorkspaceID string               `json:"workspace_id"`
	Rollups     []GatewayUsageRollup `json:"rollups"`
	SentAt      time.Time            `json:"sent_at"`
}

type MsgGetConversationHistory struct {
	LastN int `json:"last_n"` // number of recent turns to return
}

type MsgGetGroundingState struct{}

type MsgGetRunStatus struct{}

type MsgGetSessionMemory struct{}

type MsgGroundingStateReply struct {
	PaneID string `json:"pane_id"`
	// Mode is the effective grounding mode for the NEXT run.
	Mode string `json:"mode"`
	// DefaultMode is what the host originally configured (pane/agent default
	// or config override); Overridden is true when a runtime ##grounding
	// command changed Mode away from it.
	DefaultMode string `json:"default_mode"`
	Overridden  bool   `json:"overridden,omitempty"`
	// RunActive reports whether an orchestrator run is currently in flight.
	RunActive bool `json:"run_active,omitempty"`
	// LastReport is the most recent grounding_report call recorded in the
	// session memory (nil when no grounded run happened yet).
	LastReport *GroundingReportInfo `json:"last_report,omitempty"`
}

type MsgMemoryAppend struct {
	PaneID string      `json:"pane_id"`
	Entry  MemoryEntry `json:"entry"`
}

type MsgMemoryGet struct {
	PaneID string           `json:"pane_id"`
	Mode   ConversationType `json:"mode"`
}

type MsgMemoryGetReply struct {
	State *MemoryState `json:"state"`
}

type MsgMemoryStateUpdate struct {
	State *MemoryState `json:"state"`
}

type MsgMemorySummarize struct {
	PaneID string                `json:"pane_id"`
	Mode   ConversationType      `json:"mode"`
	Turns  []ConversationMessage `json:"turns"` // the turns to summarize
}

type MsgMemorySummarizeDone struct {
	PaneID string           `json:"pane_id"`
	Mode   ConversationType `json:"mode"`
	Entry  MemoryEntry      `json:"entry"`
	Error  string           `json:"error,omitempty"`
}

type MsgOrchestratorDone struct {
	OrchestratorID string                      `json:"orchestrator_id"`
	Success        bool                        `json:"success"`
	Summary        string                      `json:"summary"`
	FilesChanged   []string                    `json:"files_changed,omitempty"`
	Errors         []string                    `json:"errors,omitempty"`
	Conversation   []provider.ConversationTurn `json:"-"` // in-process only, not serialized
	// Interrupted is true when the run stopped without finishing the task —
	// user cancel, iteration cap, or wall-clock cap. The parent marks its
	// session memory paused so the run can be resumed with "continue".
	Interrupted bool `json:"interrupted,omitempty"`
	// StoppedReason is one of the StoppedReason* constants when Interrupted.
	StoppedReason string `json:"stopped_reason,omitempty"`
	// TokensUsed is this leg's cumulative token usage (sum of input+output across
	// its LLM calls). The parent accumulates it across auto-continued legs to
	// enforce the run's cumulative token budget.
	TokensUsed int `json:"tokens_used,omitempty"`
	// Prompt-cache accounting for this leg (see MsgRunStatusReply for the
	// field semantics). The parent accumulates these across legs.
	CacheReadTokens  int `json:"cache_read_tokens,omitempty"`
	CacheWriteTokens int `json:"cache_write_tokens,omitempty"`
	FreshInputTokens int `json:"fresh_input_tokens,omitempty"`
}

type MsgPaneSetApprovalPaneGroups struct {
	PaneGroupIDs []string `json:"pane_group_ids"`
	PaneName     string   `json:"pane_name,omitempty"` // source pane name shown in approval pane title
}

type MsgPaneStatusUpdate struct {
	Status string `json:"status"`
}

type MsgPipelineOutputAppend struct {
	Text string `json:"text"`
}

type MsgProxyAuditSnapshotReply struct {
	Records []MsgProxyRequestAudit `json:"records"`
	Durable bool                   `json:"durable"`
}

type MsgProxyAuditSnapshotRequest struct {
	Limit int `json:"limit"`
}

type MsgProxyRequestAudit struct {
	PaneID        string `json:"pane_id"`
	Dialect       string `json:"dialect"`             // anthropic | openai | gemini
	Model         string `json:"model,omitempty"`     // provider-reported model, if known
	Endpoint      string `json:"endpoint"`            // upstream path, or "(budget)"/"(model)"/"(unknown-pane)" for a refusal
	ReqBytes      int    `json:"req_bytes"`           // size of the (redacted) request body
	RedactionHits int    `json:"redaction_hits"`      // secrets SNAT redacted before forwarding
	BudgetState   string `json:"budget_state"`        // ok | exceeded | rate_limited | blocked
	Status        int    `json:"status"`              // upstream HTTP status, or 429 for a refusal
	InTokens      int    `json:"in_tokens,omitempty"` // provider-reported input tokens
	OutTokens     int    `json:"out_tokens,omitempty"`
	// Upstream is the base URL that actually served the request and Attempts
	// how many it took (1, or absent, = no failover). Added by design 022 §4.1;
	// both are optional so records written before failover existed still decode.
	Upstream string `json:"upstream,omitempty"`
	Attempts int    `json:"attempts,omitempty"`
	// Tenant attributes the request to a customer (design 022 §4.3), so the
	// durable trail can be sliced per customer — which for a reseller is the
	// entire point of tenanting. Optional: records predating it still decode.
	Tenant string    `json:"tenant,omitempty"`
	TS     time.Time `json:"ts"`
}

type MsgReloadPrompts struct {
	SystemPrompt    string `json:"system_prompt"`
	EmailGovernance string `json:"email_governance,omitempty"`
}

type MsgRestoreConversation struct {
	Conversation []provider.ConversationTurn `json:"conversation"`
}

type MsgRunStatusReply struct {
	PaneID   string `json:"pane_id"`
	Armed    bool   `json:"armed"`     // auto-continue budget armed
	InFlight bool   `json:"in_flight"` // an orchestrator leg is executing right now
	// Finalizer marks the takeover (wrap-up) leg; Paused/PausedReason mirror
	// the session pause state (max_iterations / awaiting_user_info / …).
	Finalizer    bool   `json:"finalizer,omitempty"`
	Paused       bool   `json:"paused,omitempty"`
	PausedReason string `json:"paused_reason,omitempty"`
	// TokensUsed is the run's cumulative token usage across COMPLETED legs
	// (the in-flight leg is added when it ends); MaxContextTokens is the armed
	// cumulative cap (0 → no token cap).
	TokensUsed       int `json:"tokens_used"`
	MaxContextTokens int `json:"max_context_tokens,omitempty"`
	// StepInterval is the per-leg step cap; ContinuesLeft the remaining
	// automatic resumes of the armed budget.
	StepInterval  int `json:"step_interval,omitempty"`
	ContinuesLeft int `json:"continues_left,omitempty"`
	// ArmedAtMs is when the current budget was armed (unix ms, 0 → not armed);
	// DeadlineMs the run's wall-clock deadline (0 → no time cap).
	ArmedAtMs  int64 `json:"armed_at_ms,omitempty"`
	DeadlineMs int64 `json:"deadline_ms,omitempty"`
	// Prompt-cache accounting across COMPLETED legs (in-flight leg added when
	// it ends). CacheReadTokens were served from Anthropic's prompt cache
	// (~10% price, excluded from TokensUsed); CacheWriteTokens were written to
	// it (1.25x price, counted); FreshInputTokens billed at the full rate.
	// hit% = read / (read + write + fresh).
	CacheReadTokens  int `json:"cache_read_tokens,omitempty"`
	CacheWriteTokens int `json:"cache_write_tokens,omitempty"`
	FreshInputTokens int `json:"fresh_input_tokens,omitempty"`
	// TokensUsedTotal is the run's whole-life token count (survives finalizer
	// takeover and disarm; resets only on arm) — the number the run report
	// should print. TokensUsed remains the live budget-enforcement counter.
	TokensUsedTotal int `json:"tokens_used_total,omitempty"`
}

type MsgSessionMemoryReplace struct {
	Turns        []provider.ConversationTurn `json:"turns"`
	Paused       bool                        `json:"paused,omitempty"`
	PausedReason string                      `json:"paused_reason,omitempty"`
	// Provenance, for logging and pane output.
	SourcePaneID string `json:"source_pane_id,omitempty"`
	SourceAlias  string `json:"source_alias,omitempty"`
}

type MsgSessionMemoryReply struct {
	PaneID       string                      `json:"pane_id"`
	Turns        []provider.ConversationTurn `json:"turns"`
	Paused       bool                        `json:"paused,omitempty"`
	PausedReason string                      `json:"paused_reason,omitempty"`
}

type MsgSetChatOutputPane struct {
	PaneID string `json:"pane_id"`
}

type MsgSetGroundingMode struct {
	Mode string `json:"mode"`
}

type MsgSetRunBudget struct {
	AutoContinue bool `json:"auto_continue"`
	// AutoApprove, when true, runs this run's tool calls without an approval
	// prompt (##web auto step.auto_approve). Independent of AutoContinue.
	AutoApprove bool `json:"auto_approve"`
	// AutoApprovePersist promotes AutoApprove from per-run state to the
	// actor's own default: it survives disarmRunBudget (which fires on every
	// terminal outcome, a clean finish included), so every LATER prompt to
	// this pane's agent runs approval-free too — not just the run being armed.
	// This is the fleet arm: a fleet agent launched approval-free used to be
	// approval-free for exactly one turn, and its second work order stalled at
	// the first `bash` on an approval prompt nobody was watching (E-45,
	// f8824f5's defect in native dress). Send AutoApprovePersist=true with
	// AutoApprove=false to turn the sticky grant back off. Policy gate rules
	// (always_gate / bash.deny) still override either form downstream.
	AutoApprovePersist bool  `json:"auto_approve_persist,omitempty"`
	MaxTotalIterations int   `json:"max_total_iterations,omitempty"`
	MaxDurationMs      int64 `json:"max_duration_ms,omitempty"`
	// StepInterval is the per-leg step cap (how many tool-iterations run before a
	// checkpoint/auto-resume). 0 → the actor's default. The auto-continue leg
	// count is ceil(MaxTotalIterations / StepInterval).
	StepInterval int `json:"step_interval,omitempty"`
	// MaxContextTokens caps the run's CUMULATIVE token usage — the sum of
	// input+output tokens across every LLM call (total "reading"), accumulated
	// across legs. When it's reached the run stops with StoppedReasonMaxTokens and
	// — unlike a step cap — does NOT auto-resume; it routes straight to the
	// finalizer. 0 → no token cap.
	MaxContextTokens int `json:"max_context_tokens,omitempty"`
	// FinalizerPrompt, when set, runs ONCE as a dedicated closing leg if the run
	// exhausts its budget (hit the iteration/time/token cap without finishing) — a
	// graceful wrap-up (e.g. "save what you've collected so far and summarize
	// what's incomplete"). It shares the run's conversation and is skipped when the
	// task finishes on its own.
	FinalizerPrompt string `json:"finalizer_prompt,omitempty"`
	// Finalizer sub-budget (the reserved budget_percent share): separate fresh
	// allowances for the closing leg — steps, duration, and cumulative tokens.
	// Token accounting resets when the finalizer takes over, so its share is a
	// clean fresh budget (not headroom). 0 → fall back to the built-in allowance.
	FinalizerMaxIterations    int   `json:"finalizer_max_iterations,omitempty"`
	FinalizerMaxDurationMs    int64 `json:"finalizer_max_duration_ms,omitempty"`
	FinalizerMaxContextTokens int   `json:"finalizer_max_context_tokens,omitempty"`
	// Model / Effort override the provider's model and effort for this run's
	// main legs (empty → the provider's configured defaults). Effort is the
	// Anthropic output_config.effort value (low|medium|high|xhigh|max).
	Model  string `json:"model,omitempty"`
	Effort string `json:"effort,omitempty"`
	// FinalizerModel / FinalizerEffort override the model/effort for the
	// finalizer (takeover) leg only — the mechanical wrap-up can run on a
	// cheaper model. Empty → fall back to Model/Effort, then the provider's
	// defaults.
	FinalizerModel  string `json:"finalizer_model,omitempty"`
	FinalizerEffort string `json:"finalizer_effort,omitempty"`
	// OutputDir is the absolute directory the run's result files belong in.
	// It is restated in every synthetic continue/finalizer turn so the save
	// location survives context compaction on long runs (the original prompt —
	// the only other place it appears — is exactly what compaction drops).
	OutputDir string `json:"output_dir,omitempty"`
}

type MsgSpawnSubOrchestrator struct {
	ParentOrchestratorID string `json:"parent_orchestrator_id"`
	SubOrchestratorID    string `json:"sub_orchestrator_id"`
	Task                 string `json:"task"`
	Context              string `json:"context,omitempty"`
}

type MsgSubOrchestratorResult struct {
	SubOrchestratorID    string `json:"sub_orchestrator_id"`
	ParentOrchestratorID string `json:"parent_orchestrator_id"`
	Success              bool   `json:"success"`
	Summary              string `json:"summary"`
}

type MsgToolCall struct {
	ToolCallID string          `json:"tool_call_id"`
	ToolName   string          `json:"tool_name"`
	Parameters json.RawMessage `json:"parameters"`
}

type MsgToolResult struct {
	ToolCallID string `json:"tool_call_id"`
	ToolName   string `json:"tool_name"`
	Content    string `json:"content"`
	Error      string `json:"error,omitempty"`
	ExitCode   int    `json:"exit_code,omitempty"`
	Approved   bool   `json:"approved"`
}

type MsgUsageBudgetSet struct {
	PaneID        string `json:"pane_id"`
	CeilingTokens int64  `json:"ceiling_tokens"`
}

type MsgUsageCheck struct {
	PaneID string `json:"pane_id"`
	// Tenant, when set, asks the ledger to check the TENANT's ceiling as well
	// as the pane's (design 022 §4.3). The stricter of the two binds: a pane
	// with headroom under a tenant that is out of budget must still be refused.
	Tenant string `json:"tenant,omitempty"`
}

type MsgUsageCheckReply struct {
	PaneID        string `json:"pane_id"`
	SpentTokens   int64  `json:"spent_tokens"`
	CeilingTokens int64  `json:"ceiling_tokens"`
	Ok            bool   `json:"ok"`
	// Scope names which ceiling the figures above describe: "" or "pane" for
	// the pane's own, "tenant" when the tenant's ceiling is the binding one.
	// Without it the refusal message would name the wrong budget and point the
	// operator at the wrong command.
	Scope string `json:"scope,omitempty"`
	// Tenant echoes the tenant the check was made for, when Scope == "tenant".
	Tenant string `json:"tenant,omitempty"`
}

type MsgUsageRecord struct {
	PaneID    string `json:"pane_id"`
	AgentName string `json:"agent_name,omitempty"`
	// Tenant attributes this record to a customer as well as a pane
	// (design 022 §4.3). It is a SECOND INDEX over the same record, never a
	// second record: session totals are summed from the pane rollup only, so
	// tenant accounting cannot double-count `##cost`. Empty ⇒ untenanted.
	Tenant       string    `json:"tenant,omitempty"`
	Provider     string    `json:"provider"`
	Model        string    `json:"model,omitempty"`
	Source       string    `json:"source"`
	InTokens     int       `json:"in_tokens"`
	OutTokens    int       `json:"out_tokens"`
	CacheRead    int       `json:"cache_read,omitempty"`
	CacheWrite   int       `json:"cache_write,omitempty"`
	CostMicroUSD int64     `json:"cost_micro_usd"`
	TS           time.Time `json:"ts"`
}

type MsgUsageSnapshotReply struct {
	Window              string         `json:"window"`
	SessionCostMicroUSD int64          `json:"session_cost_micro_usd"`
	SessionTokens       int64          `json:"session_tokens"`
	ByPane              []UsageAgg     `json:"by_pane"`
	ByAgent             []UsageAgg     `json:"by_agent"`
	Ceilings            []UsageCeiling `json:"ceilings,omitempty"`
}

type MsgUsageSnapshotRequest struct {
	Window string `json:"window"`
}

type NATSEnvelope struct {
	TypeTag string          `json:"t"` // message type discriminator string constant
	ReplyTo string          `json:"r"` // NATS reply subject; empty for fire-and-forget
	Payload json.RawMessage `json:"p"` // JSON inner message, embedded verbatim
}

type NATSPublisher struct {
	// contains filtered or unexported fields
}

type RequestEnvelope struct {
	Inner   interface{}
	ReplyTo string
	NC      *nats.Conn
	Codecs  *CodecRegistry
}

type ToolCallInfo struct {
	ID    string          `json:"id"`
	Name  string          `json:"name"`
	Input json.RawMessage `json:"input"`
}

type TurnType string

type UsageAgg struct {
	Key          string `json:"key"`
	Label        string `json:"label,omitempty"`
	InTokens     int64  `json:"in_tokens"`
	OutTokens    int64  `json:"out_tokens"`
	CacheRead    int64  `json:"cache_read"`
	CacheWrite   int64  `json:"cache_write"`
	CostMicroUSD int64  `json:"cost_micro_usd"`
	Calls        int64  `json:"calls"`
	// UnknownCost is set when at least one record folded into this aggregate
	// had a model with no pricing entry — cost is then a lower bound and the
	// UI flags it with a tilde rather than inventing a dollar figure.
	UnknownCost bool `json:"unknown_cost,omitempty"`
}

type UsageCeiling struct {
	PaneID        string `json:"pane_id"`
	CeilingTokens int64  `json:"ceiling_tokens"`
	SpentTokens   int64  `json:"spent_tokens"`
}