// Package generated provides primitives to interact with the openapi HTTP API.
//
// Code generated by github.com/oapi-codegen/oapi-codegen/v2 version v2.7.0 DO NOT EDIT.
package generated

import (
	"encoding/json"
	"fmt"
	"time"

	"github.com/oapi-codegen/runtime"
	openapi_types "github.com/oapi-codegen/runtime/types"
)

const (
	BearerAuthScopes bearerAuthContextKey = "BearerAuth.Scopes"
)

// Defines values for ActivityEventType.
const (
	ActivityEventTypeSessionStart ActivityEventType = "session_start"
	ActivityEventTypeTaskCreated  ActivityEventType = "task_created"
	ActivityEventTypeTaskUpdated  ActivityEventType = "task_updated"
)

// Valid indicates whether the value is a known member of the ActivityEventType enum.
func (e ActivityEventType) Valid() bool {
	switch e {
	case ActivityEventTypeSessionStart:
		return true
	case ActivityEventTypeTaskCreated:
		return true
	case ActivityEventTypeTaskUpdated:
		return true
	default:
		return false
	}
}

// Defines values for ActivityEventsResponseEventsType.
const (
	ActivityEventsResponseEventsTypeSessionStart ActivityEventsResponseEventsType = "session_start"
	ActivityEventsResponseEventsTypeTaskCreated  ActivityEventsResponseEventsType = "task_created"
	ActivityEventsResponseEventsTypeTaskUpdated  ActivityEventsResponseEventsType = "task_updated"
)

// Valid indicates whether the value is a known member of the ActivityEventsResponseEventsType enum.
func (e ActivityEventsResponseEventsType) Valid() bool {
	switch e {
	case ActivityEventsResponseEventsTypeSessionStart:
		return true
	case ActivityEventsResponseEventsTypeTaskCreated:
		return true
	case ActivityEventsResponseEventsTypeTaskUpdated:
		return true
	default:
		return false
	}
}

// Defines values for AgentSandboxProfile.
const (
	AgentSandboxProfileHost         AgentSandboxProfile = "host"
	AgentSandboxProfileOff          AgentSandboxProfile = "off"
	AgentSandboxProfileWorkspace    AgentSandboxProfile = "workspace"
	AgentSandboxProfileWorkspaceNet AgentSandboxProfile = "workspace+net"
)

// Valid indicates whether the value is a known member of the AgentSandboxProfile enum.
func (e AgentSandboxProfile) Valid() bool {
	switch e {
	case AgentSandboxProfileHost:
		return true
	case AgentSandboxProfileOff:
		return true
	case AgentSandboxProfileWorkspace:
		return true
	case AgentSandboxProfileWorkspaceNet:
		return true
	default:
		return false
	}
}

// Defines values for AgentStatus.
const (
	AgentStatusActive AgentStatus = "active"
	AgentStatusDraft  AgentStatus = "draft"
	AgentStatusError  AgentStatus = "error"
	AgentStatusIdle   AgentStatus = "idle"
)

// Valid indicates whether the value is a known member of the AgentStatus enum.
func (e AgentStatus) Valid() bool {
	switch e {
	case AgentStatusActive:
		return true
	case AgentStatusDraft:
		return true
	case AgentStatusError:
		return true
	case AgentStatusIdle:
		return true
	default:
		return false
	}
}

// Defines values for AgentToolsCfgBuiltinDefaultPolicy.
const (
	AgentToolsCfgBuiltinDefaultPolicyAllow AgentToolsCfgBuiltinDefaultPolicy = "allow"
	AgentToolsCfgBuiltinDefaultPolicyAsk   AgentToolsCfgBuiltinDefaultPolicy = "ask"
	AgentToolsCfgBuiltinDefaultPolicyDeny  AgentToolsCfgBuiltinDefaultPolicy = "deny"
)

// Valid indicates whether the value is a known member of the AgentToolsCfgBuiltinDefaultPolicy enum.
func (e AgentToolsCfgBuiltinDefaultPolicy) Valid() bool {
	switch e {
	case AgentToolsCfgBuiltinDefaultPolicyAllow:
		return true
	case AgentToolsCfgBuiltinDefaultPolicyAsk:
		return true
	case AgentToolsCfgBuiltinDefaultPolicyDeny:
		return true
	default:
		return false
	}
}

// Defines values for AgentToolsCfgBuiltinPolicies.
const (
	AgentToolsCfgBuiltinPoliciesAllow AgentToolsCfgBuiltinPolicies = "allow"
	AgentToolsCfgBuiltinPoliciesAsk   AgentToolsCfgBuiltinPolicies = "ask"
	AgentToolsCfgBuiltinPoliciesDeny  AgentToolsCfgBuiltinPolicies = "deny"
)

// Valid indicates whether the value is a known member of the AgentToolsCfgBuiltinPolicies enum.
func (e AgentToolsCfgBuiltinPolicies) Valid() bool {
	switch e {
	case AgentToolsCfgBuiltinPoliciesAllow:
		return true
	case AgentToolsCfgBuiltinPoliciesAsk:
		return true
	case AgentToolsCfgBuiltinPoliciesDeny:
		return true
	default:
		return false
	}
}

// Defines values for AgentType.
const (
	AgentTypeCore   AgentType = "core"
	AgentTypeCustom AgentType = "custom"
	AgentTypeSystem AgentType = "system"
)

// Valid indicates whether the value is a known member of the AgentType enum.
func (e AgentType) Valid() bool {
	switch e {
	case AgentTypeCore:
		return true
	case AgentTypeCustom:
		return true
	case AgentTypeSystem:
		return true
	default:
		return false
	}
}

// Defines values for AgentCreateRequestToolsCfgBuiltinDefaultPolicy.
const (
	AgentCreateRequestToolsCfgBuiltinDefaultPolicyAllow AgentCreateRequestToolsCfgBuiltinDefaultPolicy = "allow"
	AgentCreateRequestToolsCfgBuiltinDefaultPolicyAsk   AgentCreateRequestToolsCfgBuiltinDefaultPolicy = "ask"
	AgentCreateRequestToolsCfgBuiltinDefaultPolicyDeny  AgentCreateRequestToolsCfgBuiltinDefaultPolicy = "deny"
)

// Valid indicates whether the value is a known member of the AgentCreateRequestToolsCfgBuiltinDefaultPolicy enum.
func (e AgentCreateRequestToolsCfgBuiltinDefaultPolicy) Valid() bool {
	switch e {
	case AgentCreateRequestToolsCfgBuiltinDefaultPolicyAllow:
		return true
	case AgentCreateRequestToolsCfgBuiltinDefaultPolicyAsk:
		return true
	case AgentCreateRequestToolsCfgBuiltinDefaultPolicyDeny:
		return true
	default:
		return false
	}
}

// Defines values for AgentCreateRequestToolsCfgBuiltinPolicies.
const (
	AgentCreateRequestToolsCfgBuiltinPoliciesAllow AgentCreateRequestToolsCfgBuiltinPolicies = "allow"
	AgentCreateRequestToolsCfgBuiltinPoliciesAsk   AgentCreateRequestToolsCfgBuiltinPolicies = "ask"
	AgentCreateRequestToolsCfgBuiltinPoliciesDeny  AgentCreateRequestToolsCfgBuiltinPolicies = "deny"
)

// Valid indicates whether the value is a known member of the AgentCreateRequestToolsCfgBuiltinPolicies enum.
func (e AgentCreateRequestToolsCfgBuiltinPolicies) Valid() bool {
	switch e {
	case AgentCreateRequestToolsCfgBuiltinPoliciesAllow:
		return true
	case AgentCreateRequestToolsCfgBuiltinPoliciesAsk:
		return true
	case AgentCreateRequestToolsCfgBuiltinPoliciesDeny:
		return true
	default:
		return false
	}
}

// Defines values for AgentToolEntryConfiguredPolicy.
const (
	AgentToolEntryConfiguredPolicyAllow AgentToolEntryConfiguredPolicy = "allow"
	AgentToolEntryConfiguredPolicyAsk   AgentToolEntryConfiguredPolicy = "ask"
	AgentToolEntryConfiguredPolicyDeny  AgentToolEntryConfiguredPolicy = "deny"
)

// Valid indicates whether the value is a known member of the AgentToolEntryConfiguredPolicy enum.
func (e AgentToolEntryConfiguredPolicy) Valid() bool {
	switch e {
	case AgentToolEntryConfiguredPolicyAllow:
		return true
	case AgentToolEntryConfiguredPolicyAsk:
		return true
	case AgentToolEntryConfiguredPolicyDeny:
		return true
	default:
		return false
	}
}

// Defines values for AgentToolEntryEffectivePolicy.
const (
	AgentToolEntryEffectivePolicyAllow AgentToolEntryEffectivePolicy = "allow"
	AgentToolEntryEffectivePolicyAsk   AgentToolEntryEffectivePolicy = "ask"
	AgentToolEntryEffectivePolicyDeny  AgentToolEntryEffectivePolicy = "deny"
)

// Valid indicates whether the value is a known member of the AgentToolEntryEffectivePolicy enum.
func (e AgentToolEntryEffectivePolicy) Valid() bool {
	switch e {
	case AgentToolEntryEffectivePolicyAllow:
		return true
	case AgentToolEntryEffectivePolicyAsk:
		return true
	case AgentToolEntryEffectivePolicyDeny:
		return true
	default:
		return false
	}
}

// Defines values for AgentToolsResponseAgentType.
const (
	AgentToolsResponseAgentTypeCore   AgentToolsResponseAgentType = "core"
	AgentToolsResponseAgentTypeCustom AgentToolsResponseAgentType = "custom"
	AgentToolsResponseAgentTypeSystem AgentToolsResponseAgentType = "system"
)

// Valid indicates whether the value is a known member of the AgentToolsResponseAgentType enum.
func (e AgentToolsResponseAgentType) Valid() bool {
	switch e {
	case AgentToolsResponseAgentTypeCore:
		return true
	case AgentToolsResponseAgentTypeCustom:
		return true
	case AgentToolsResponseAgentTypeSystem:
		return true
	default:
		return false
	}
}

// Defines values for AgentToolsResponseConfigBuiltinDefaultPolicy.
const (
	AgentToolsResponseConfigBuiltinDefaultPolicyAllow AgentToolsResponseConfigBuiltinDefaultPolicy = "allow"
	AgentToolsResponseConfigBuiltinDefaultPolicyAsk   AgentToolsResponseConfigBuiltinDefaultPolicy = "ask"
	AgentToolsResponseConfigBuiltinDefaultPolicyDeny  AgentToolsResponseConfigBuiltinDefaultPolicy = "deny"
)

// Valid indicates whether the value is a known member of the AgentToolsResponseConfigBuiltinDefaultPolicy enum.
func (e AgentToolsResponseConfigBuiltinDefaultPolicy) Valid() bool {
	switch e {
	case AgentToolsResponseConfigBuiltinDefaultPolicyAllow:
		return true
	case AgentToolsResponseConfigBuiltinDefaultPolicyAsk:
		return true
	case AgentToolsResponseConfigBuiltinDefaultPolicyDeny:
		return true
	default:
		return false
	}
}

// Defines values for AgentToolsResponseConfigBuiltinPolicies.
const (
	AgentToolsResponseConfigBuiltinPoliciesAllow AgentToolsResponseConfigBuiltinPolicies = "allow"
	AgentToolsResponseConfigBuiltinPoliciesAsk   AgentToolsResponseConfigBuiltinPolicies = "ask"
	AgentToolsResponseConfigBuiltinPoliciesDeny  AgentToolsResponseConfigBuiltinPolicies = "deny"
)

// Valid indicates whether the value is a known member of the AgentToolsResponseConfigBuiltinPolicies enum.
func (e AgentToolsResponseConfigBuiltinPolicies) Valid() bool {
	switch e {
	case AgentToolsResponseConfigBuiltinPoliciesAllow:
		return true
	case AgentToolsResponseConfigBuiltinPoliciesAsk:
		return true
	case AgentToolsResponseConfigBuiltinPoliciesDeny:
		return true
	default:
		return false
	}
}

// Defines values for AgentToolsResponseToolsConfiguredPolicy.
const (
	AgentToolsResponseToolsConfiguredPolicyAllow AgentToolsResponseToolsConfiguredPolicy = "allow"
	AgentToolsResponseToolsConfiguredPolicyAsk   AgentToolsResponseToolsConfiguredPolicy = "ask"
	AgentToolsResponseToolsConfiguredPolicyDeny  AgentToolsResponseToolsConfiguredPolicy = "deny"
)

// Valid indicates whether the value is a known member of the AgentToolsResponseToolsConfiguredPolicy enum.
func (e AgentToolsResponseToolsConfiguredPolicy) Valid() bool {
	switch e {
	case AgentToolsResponseToolsConfiguredPolicyAllow:
		return true
	case AgentToolsResponseToolsConfiguredPolicyAsk:
		return true
	case AgentToolsResponseToolsConfiguredPolicyDeny:
		return true
	default:
		return false
	}
}

// Defines values for AgentToolsResponseToolsEffectivePolicy.
const (
	AgentToolsResponseToolsEffectivePolicyAllow AgentToolsResponseToolsEffectivePolicy = "allow"
	AgentToolsResponseToolsEffectivePolicyAsk   AgentToolsResponseToolsEffectivePolicy = "ask"
	AgentToolsResponseToolsEffectivePolicyDeny  AgentToolsResponseToolsEffectivePolicy = "deny"
)

// Valid indicates whether the value is a known member of the AgentToolsResponseToolsEffectivePolicy enum.
func (e AgentToolsResponseToolsEffectivePolicy) Valid() bool {
	switch e {
	case AgentToolsResponseToolsEffectivePolicyAllow:
		return true
	case AgentToolsResponseToolsEffectivePolicyAsk:
		return true
	case AgentToolsResponseToolsEffectivePolicyDeny:
		return true
	default:
		return false
	}
}

// Defines values for AgentToolsUpdateRequestBuiltinDefaultPolicy.
const (
	AgentToolsUpdateRequestBuiltinDefaultPolicyAllow AgentToolsUpdateRequestBuiltinDefaultPolicy = "allow"
	AgentToolsUpdateRequestBuiltinDefaultPolicyAsk   AgentToolsUpdateRequestBuiltinDefaultPolicy = "ask"
	AgentToolsUpdateRequestBuiltinDefaultPolicyDeny  AgentToolsUpdateRequestBuiltinDefaultPolicy = "deny"
)

// Valid indicates whether the value is a known member of the AgentToolsUpdateRequestBuiltinDefaultPolicy enum.
func (e AgentToolsUpdateRequestBuiltinDefaultPolicy) Valid() bool {
	switch e {
	case AgentToolsUpdateRequestBuiltinDefaultPolicyAllow:
		return true
	case AgentToolsUpdateRequestBuiltinDefaultPolicyAsk:
		return true
	case AgentToolsUpdateRequestBuiltinDefaultPolicyDeny:
		return true
	default:
		return false
	}
}

// Defines values for AgentToolsUpdateRequestBuiltinMode.
const (
	Explicit AgentToolsUpdateRequestBuiltinMode = "explicit"
	Inherit  AgentToolsUpdateRequestBuiltinMode = "inherit"
)

// Valid indicates whether the value is a known member of the AgentToolsUpdateRequestBuiltinMode enum.
func (e AgentToolsUpdateRequestBuiltinMode) Valid() bool {
	switch e {
	case Explicit:
		return true
	case Inherit:
		return true
	default:
		return false
	}
}

// Defines values for AgentToolsUpdateRequestBuiltinPolicies.
const (
	AgentToolsUpdateRequestBuiltinPoliciesAllow AgentToolsUpdateRequestBuiltinPolicies = "allow"
	AgentToolsUpdateRequestBuiltinPoliciesAsk   AgentToolsUpdateRequestBuiltinPolicies = "ask"
	AgentToolsUpdateRequestBuiltinPoliciesDeny  AgentToolsUpdateRequestBuiltinPolicies = "deny"
)

// Valid indicates whether the value is a known member of the AgentToolsUpdateRequestBuiltinPolicies enum.
func (e AgentToolsUpdateRequestBuiltinPolicies) Valid() bool {
	switch e {
	case AgentToolsUpdateRequestBuiltinPoliciesAllow:
		return true
	case AgentToolsUpdateRequestBuiltinPoliciesAsk:
		return true
	case AgentToolsUpdateRequestBuiltinPoliciesDeny:
		return true
	default:
		return false
	}
}

// Defines values for AgentUpdateRequestSandboxProfile.
const (
	AgentUpdateRequestSandboxProfileHost         AgentUpdateRequestSandboxProfile = "host"
	AgentUpdateRequestSandboxProfileOff          AgentUpdateRequestSandboxProfile = "off"
	AgentUpdateRequestSandboxProfileWorkspace    AgentUpdateRequestSandboxProfile = "workspace"
	AgentUpdateRequestSandboxProfileWorkspaceNet AgentUpdateRequestSandboxProfile = "workspace+net"
)

// Valid indicates whether the value is a known member of the AgentUpdateRequestSandboxProfile enum.
func (e AgentUpdateRequestSandboxProfile) Valid() bool {
	switch e {
	case AgentUpdateRequestSandboxProfileHost:
		return true
	case AgentUpdateRequestSandboxProfileOff:
		return true
	case AgentUpdateRequestSandboxProfileWorkspace:
		return true
	case AgentUpdateRequestSandboxProfileWorkspaceNet:
		return true
	default:
		return false
	}
}

// Defines values for AgentUpdateRequestToolsCfgBuiltinDefaultPolicy.
const (
	AgentUpdateRequestToolsCfgBuiltinDefaultPolicyAllow AgentUpdateRequestToolsCfgBuiltinDefaultPolicy = "allow"
	AgentUpdateRequestToolsCfgBuiltinDefaultPolicyAsk   AgentUpdateRequestToolsCfgBuiltinDefaultPolicy = "ask"
	AgentUpdateRequestToolsCfgBuiltinDefaultPolicyDeny  AgentUpdateRequestToolsCfgBuiltinDefaultPolicy = "deny"
)

// Valid indicates whether the value is a known member of the AgentUpdateRequestToolsCfgBuiltinDefaultPolicy enum.
func (e AgentUpdateRequestToolsCfgBuiltinDefaultPolicy) Valid() bool {
	switch e {
	case AgentUpdateRequestToolsCfgBuiltinDefaultPolicyAllow:
		return true
	case AgentUpdateRequestToolsCfgBuiltinDefaultPolicyAsk:
		return true
	case AgentUpdateRequestToolsCfgBuiltinDefaultPolicyDeny:
		return true
	default:
		return false
	}
}

// Defines values for AgentUpdateRequestToolsCfgBuiltinPolicies.
const (
	AgentUpdateRequestToolsCfgBuiltinPoliciesAllow AgentUpdateRequestToolsCfgBuiltinPolicies = "allow"
	AgentUpdateRequestToolsCfgBuiltinPoliciesAsk   AgentUpdateRequestToolsCfgBuiltinPolicies = "ask"
	AgentUpdateRequestToolsCfgBuiltinPoliciesDeny  AgentUpdateRequestToolsCfgBuiltinPolicies = "deny"
)

// Valid indicates whether the value is a known member of the AgentUpdateRequestToolsCfgBuiltinPolicies enum.
func (e AgentUpdateRequestToolsCfgBuiltinPolicies) Valid() bool {
	switch e {
	case AgentUpdateRequestToolsCfgBuiltinPoliciesAllow:
		return true
	case AgentUpdateRequestToolsCfgBuiltinPoliciesAsk:
		return true
	case AgentUpdateRequestToolsCfgBuiltinPoliciesDeny:
		return true
	default:
		return false
	}
}

// Defines values for AttachmentType.
const (
	AttachmentTypeAudio AttachmentType = "audio"
	AttachmentTypeFile  AttachmentType = "file"
	AttachmentTypeImage AttachmentType = "image"
	AttachmentTypeVideo AttachmentType = "video"
)

// Valid indicates whether the value is a known member of the AttachmentType enum.
func (e AttachmentType) Valid() bool {
	switch e {
	case AttachmentTypeAudio:
		return true
	case AttachmentTypeFile:
		return true
	case AttachmentTypeImage:
		return true
	case AttachmentTypeVideo:
		return true
	default:
		return false
	}
}

// Defines values for AuditEntryDecision.
const (
	AuditEntryDecisionAllow AuditEntryDecision = "allow"
	AuditEntryDecisionDeny  AuditEntryDecision = "deny"
	AuditEntryDecisionError AuditEntryDecision = "error"
)

// Valid indicates whether the value is a known member of the AuditEntryDecision enum.
func (e AuditEntryDecision) Valid() bool {
	switch e {
	case AuditEntryDecisionAllow:
		return true
	case AuditEntryDecisionDeny:
		return true
	case AuditEntryDecisionError:
		return true
	default:
		return false
	}
}

// Defines values for ChannelEnabledResponseId.
const (
	ChannelEnabledResponseIdDingtalk ChannelEnabledResponseId = "dingtalk"
	ChannelEnabledResponseIdDiscord  ChannelEnabledResponseId = "discord"
	ChannelEnabledResponseIdFeishu   ChannelEnabledResponseId = "feishu"
	ChannelEnabledResponseIdIrc      ChannelEnabledResponseId = "irc"
	ChannelEnabledResponseIdLine     ChannelEnabledResponseId = "line"
	ChannelEnabledResponseIdMaixcam  ChannelEnabledResponseId = "maixcam"
	ChannelEnabledResponseIdMatrix   ChannelEnabledResponseId = "matrix"
	ChannelEnabledResponseIdOnebot   ChannelEnabledResponseId = "onebot"
	ChannelEnabledResponseIdQq       ChannelEnabledResponseId = "qq"
	ChannelEnabledResponseIdSlack    ChannelEnabledResponseId = "slack"
	ChannelEnabledResponseIdTelegram ChannelEnabledResponseId = "telegram"
	ChannelEnabledResponseIdWebchat  ChannelEnabledResponseId = "webchat"
	ChannelEnabledResponseIdWecom    ChannelEnabledResponseId = "wecom"
	ChannelEnabledResponseIdWeixin   ChannelEnabledResponseId = "weixin"
	ChannelEnabledResponseIdWhatsapp ChannelEnabledResponseId = "whatsapp"
)

// Valid indicates whether the value is a known member of the ChannelEnabledResponseId enum.
func (e ChannelEnabledResponseId) Valid() bool {
	switch e {
	case ChannelEnabledResponseIdDingtalk:
		return true
	case ChannelEnabledResponseIdDiscord:
		return true
	case ChannelEnabledResponseIdFeishu:
		return true
	case ChannelEnabledResponseIdIrc:
		return true
	case ChannelEnabledResponseIdLine:
		return true
	case ChannelEnabledResponseIdMaixcam:
		return true
	case ChannelEnabledResponseIdMatrix:
		return true
	case ChannelEnabledResponseIdOnebot:
		return true
	case ChannelEnabledResponseIdQq:
		return true
	case ChannelEnabledResponseIdSlack:
		return true
	case ChannelEnabledResponseIdTelegram:
		return true
	case ChannelEnabledResponseIdWebchat:
		return true
	case ChannelEnabledResponseIdWecom:
		return true
	case ChannelEnabledResponseIdWeixin:
		return true
	case ChannelEnabledResponseIdWhatsapp:
		return true
	default:
		return false
	}
}

// Defines values for ChannelEntryId.
const (
	ChannelEntryIdDingtalk ChannelEntryId = "dingtalk"
	ChannelEntryIdDiscord  ChannelEntryId = "discord"
	ChannelEntryIdFeishu   ChannelEntryId = "feishu"
	ChannelEntryIdIrc      ChannelEntryId = "irc"
	ChannelEntryIdLine     ChannelEntryId = "line"
	ChannelEntryIdMaixcam  ChannelEntryId = "maixcam"
	ChannelEntryIdMatrix   ChannelEntryId = "matrix"
	ChannelEntryIdOnebot   ChannelEntryId = "onebot"
	ChannelEntryIdQq       ChannelEntryId = "qq"
	ChannelEntryIdSlack    ChannelEntryId = "slack"
	ChannelEntryIdTelegram ChannelEntryId = "telegram"
	ChannelEntryIdWebchat  ChannelEntryId = "webchat"
	ChannelEntryIdWecom    ChannelEntryId = "wecom"
	ChannelEntryIdWeixin   ChannelEntryId = "weixin"
	ChannelEntryIdWhatsapp ChannelEntryId = "whatsapp"
)

// Valid indicates whether the value is a known member of the ChannelEntryId enum.
func (e ChannelEntryId) Valid() bool {
	switch e {
	case ChannelEntryIdDingtalk:
		return true
	case ChannelEntryIdDiscord:
		return true
	case ChannelEntryIdFeishu:
		return true
	case ChannelEntryIdIrc:
		return true
	case ChannelEntryIdLine:
		return true
	case ChannelEntryIdMaixcam:
		return true
	case ChannelEntryIdMatrix:
		return true
	case ChannelEntryIdOnebot:
		return true
	case ChannelEntryIdQq:
		return true
	case ChannelEntryIdSlack:
		return true
	case ChannelEntryIdTelegram:
		return true
	case ChannelEntryIdWebchat:
		return true
	case ChannelEntryIdWecom:
		return true
	case ChannelEntryIdWeixin:
		return true
	case ChannelEntryIdWhatsapp:
		return true
	default:
		return false
	}
}

// Defines values for ChannelEntryTransport.
const (
	ChannelEntryTransportBridge    ChannelEntryTransport = "bridge"
	ChannelEntryTransportHttp      ChannelEntryTransport = "http"
	ChannelEntryTransportSerial    ChannelEntryTransport = "serial"
	ChannelEntryTransportTcp       ChannelEntryTransport = "tcp"
	ChannelEntryTransportWebhook   ChannelEntryTransport = "webhook"
	ChannelEntryTransportWebsocket ChannelEntryTransport = "websocket"
)

// Valid indicates whether the value is a known member of the ChannelEntryTransport enum.
func (e ChannelEntryTransport) Valid() bool {
	switch e {
	case ChannelEntryTransportBridge:
		return true
	case ChannelEntryTransportHttp:
		return true
	case ChannelEntryTransportSerial:
		return true
	case ChannelEntryTransportTcp:
		return true
	case ChannelEntryTransportWebhook:
		return true
	case ChannelEntryTransportWebsocket:
		return true
	default:
		return false
	}
}

// Defines values for ChannelId.
const (
	Dingtalk ChannelId = "dingtalk"
	Discord  ChannelId = "discord"
	Feishu   ChannelId = "feishu"
	Irc      ChannelId = "irc"
	Line     ChannelId = "line"
	Maixcam  ChannelId = "maixcam"
	Matrix   ChannelId = "matrix"
	Onebot   ChannelId = "onebot"
	Qq       ChannelId = "qq"
	Slack    ChannelId = "slack"
	Telegram ChannelId = "telegram"
	Webchat  ChannelId = "webchat"
	Wecom    ChannelId = "wecom"
	Weixin   ChannelId = "weixin"
	Whatsapp ChannelId = "whatsapp"
)

// Valid indicates whether the value is a known member of the ChannelId enum.
func (e ChannelId) Valid() bool {
	switch e {
	case Dingtalk:
		return true
	case Discord:
		return true
	case Feishu:
		return true
	case Irc:
		return true
	case Line:
		return true
	case Maixcam:
		return true
	case Matrix:
		return true
	case Onebot:
		return true
	case Qq:
		return true
	case Slack:
		return true
	case Telegram:
		return true
	case Webchat:
		return true
	case Wecom:
		return true
	case Weixin:
		return true
	case Whatsapp:
		return true
	default:
		return false
	}
}

// Defines values for DevicePairedStatus.
const (
	DevicePairedStatusActive  DevicePairedStatus = "active"
	DevicePairedStatusRevoked DevicePairedStatus = "revoked"
)

// Valid indicates whether the value is a known member of the DevicePairedStatus enum.
func (e DevicePairedStatus) Valid() bool {
	switch e {
	case DevicePairedStatusActive:
		return true
	case DevicePairedStatusRevoked:
		return true
	default:
		return false
	}
}

// Defines values for DevicesResponsePairedStatus.
const (
	DevicesResponsePairedStatusActive  DevicesResponsePairedStatus = "active"
	DevicesResponsePairedStatusRevoked DevicesResponsePairedStatus = "revoked"
)

// Valid indicates whether the value is a known member of the DevicesResponsePairedStatus enum.
func (e DevicesResponsePairedStatus) Valid() bool {
	switch e {
	case DevicesResponsePairedStatusActive:
		return true
	case DevicesResponsePairedStatusRevoked:
		return true
	default:
		return false
	}
}

// Defines values for DoctorIssueSeverity.
const (
	DoctorIssueSeverityHigh   DoctorIssueSeverity = "high"
	DoctorIssueSeverityLow    DoctorIssueSeverity = "low"
	DoctorIssueSeverityMedium DoctorIssueSeverity = "medium"
)

// Valid indicates whether the value is a known member of the DoctorIssueSeverity enum.
func (e DoctorIssueSeverity) Valid() bool {
	switch e {
	case DoctorIssueSeverityHigh:
		return true
	case DoctorIssueSeverityLow:
		return true
	case DoctorIssueSeverityMedium:
		return true
	default:
		return false
	}
}

// Defines values for DoctorResultIssuesSeverity.
const (
	DoctorResultIssuesSeverityHigh   DoctorResultIssuesSeverity = "high"
	DoctorResultIssuesSeverityLow    DoctorResultIssuesSeverity = "low"
	DoctorResultIssuesSeverityMedium DoctorResultIssuesSeverity = "medium"
)

// Valid indicates whether the value is a known member of the DoctorResultIssuesSeverity enum.
func (e DoctorResultIssuesSeverity) Valid() bool {
	switch e {
	case DoctorResultIssuesSeverityHigh:
		return true
	case DoctorResultIssuesSeverityLow:
		return true
	case DoctorResultIssuesSeverityMedium:
		return true
	default:
		return false
	}
}

// Defines values for GlobalToolPoliciesDefaultPolicy.
const (
	GlobalToolPoliciesDefaultPolicyAllow GlobalToolPoliciesDefaultPolicy = "allow"
	GlobalToolPoliciesDefaultPolicyAsk   GlobalToolPoliciesDefaultPolicy = "ask"
	GlobalToolPoliciesDefaultPolicyDeny  GlobalToolPoliciesDefaultPolicy = "deny"
)

// Valid indicates whether the value is a known member of the GlobalToolPoliciesDefaultPolicy enum.
func (e GlobalToolPoliciesDefaultPolicy) Valid() bool {
	switch e {
	case GlobalToolPoliciesDefaultPolicyAllow:
		return true
	case GlobalToolPoliciesDefaultPolicyAsk:
		return true
	case GlobalToolPoliciesDefaultPolicyDeny:
		return true
	default:
		return false
	}
}

// Defines values for GlobalToolPoliciesPolicies.
const (
	GlobalToolPoliciesPoliciesAllow GlobalToolPoliciesPolicies = "allow"
	GlobalToolPoliciesPoliciesAsk   GlobalToolPoliciesPolicies = "ask"
	GlobalToolPoliciesPoliciesDeny  GlobalToolPoliciesPolicies = "deny"
)

// Valid indicates whether the value is a known member of the GlobalToolPoliciesPolicies enum.
func (e GlobalToolPoliciesPolicies) Valid() bool {
	switch e {
	case GlobalToolPoliciesPoliciesAllow:
		return true
	case GlobalToolPoliciesPoliciesAsk:
		return true
	case GlobalToolPoliciesPoliciesDeny:
		return true
	default:
		return false
	}
}

// Defines values for HealthResponseStatus.
const (
	HealthResponseStatusOk HealthResponseStatus = "ok"
)

// Valid indicates whether the value is a known member of the HealthResponseStatus enum.
func (e HealthResponseStatus) Valid() bool {
	switch e {
	case HealthResponseStatusOk:
		return true
	default:
		return false
	}
}

// Defines values for LoginResponseRole.
const (
	LoginResponseRoleAdmin LoginResponseRole = "admin"
	LoginResponseRoleUser  LoginResponseRole = "user"
)

// Valid indicates whether the value is a known member of the LoginResponseRole enum.
func (e LoginResponseRole) Valid() bool {
	switch e {
	case LoginResponseRoleAdmin:
		return true
	case LoginResponseRoleUser:
		return true
	default:
		return false
	}
}

// Defines values for McpServerStatus.
const (
	McpServerStatusConnected    McpServerStatus = "connected"
	McpServerStatusDisconnected McpServerStatus = "disconnected"
	McpServerStatusError        McpServerStatus = "error"
)

// Valid indicates whether the value is a known member of the McpServerStatus enum.
func (e McpServerStatus) Valid() bool {
	switch e {
	case McpServerStatusConnected:
		return true
	case McpServerStatusDisconnected:
		return true
	case McpServerStatusError:
		return true
	default:
		return false
	}
}

// Defines values for McpServerTransport.
const (
	McpServerTransportHttp  McpServerTransport = "http"
	McpServerTransportSse   McpServerTransport = "sse"
	McpServerTransportStdio McpServerTransport = "stdio"
)

// Valid indicates whether the value is a known member of the McpServerTransport enum.
func (e McpServerTransport) Valid() bool {
	switch e {
	case McpServerTransportHttp:
		return true
	case McpServerTransportSse:
		return true
	case McpServerTransportStdio:
		return true
	default:
		return false
	}
}

// Defines values for McpServerCreateTransport.
const (
	Http  McpServerCreateTransport = "http"
	Sse   McpServerCreateTransport = "sse"
	Stdio McpServerCreateTransport = "stdio"
)

// Valid indicates whether the value is a known member of the McpServerCreateTransport enum.
func (e McpServerCreateTransport) Valid() bool {
	switch e {
	case Http:
		return true
	case Sse:
		return true
	case Stdio:
		return true
	default:
		return false
	}
}

// Defines values for MeInfoRole.
const (
	MeInfoRoleAdmin MeInfoRole = "admin"
	MeInfoRoleUser  MeInfoRole = "user"
)

// Valid indicates whether the value is a known member of the MeInfoRole enum.
func (e MeInfoRole) Valid() bool {
	switch e {
	case MeInfoRoleAdmin:
		return true
	case MeInfoRoleUser:
		return true
	default:
		return false
	}
}

// Defines values for MessageAttachmentsType.
const (
	MessageAttachmentsTypeAudio MessageAttachmentsType = "audio"
	MessageAttachmentsTypeFile  MessageAttachmentsType = "file"
	MessageAttachmentsTypeImage MessageAttachmentsType = "image"
	MessageAttachmentsTypeVideo MessageAttachmentsType = "video"
)

// Valid indicates whether the value is a known member of the MessageAttachmentsType enum.
func (e MessageAttachmentsType) Valid() bool {
	switch e {
	case MessageAttachmentsTypeAudio:
		return true
	case MessageAttachmentsTypeFile:
		return true
	case MessageAttachmentsTypeImage:
		return true
	case MessageAttachmentsTypeVideo:
		return true
	default:
		return false
	}
}

// Defines values for MessageCancelMethod.
const (
	MessageCancelMethodGraceful MessageCancelMethod = "graceful"
	MessageCancelMethodHard     MessageCancelMethod = "hard"
)

// Valid indicates whether the value is a known member of the MessageCancelMethod enum.
func (e MessageCancelMethod) Valid() bool {
	switch e {
	case MessageCancelMethodGraceful:
		return true
	case MessageCancelMethodHard:
		return true
	default:
		return false
	}
}

// Defines values for MessageRole.
const (
	MessageRoleAssistant MessageRole = "assistant"
	MessageRoleSystem    MessageRole = "system"
	MessageRoleUser      MessageRole = "user"
)

// Valid indicates whether the value is a known member of the MessageRole enum.
func (e MessageRole) Valid() bool {
	switch e {
	case MessageRoleAssistant:
		return true
	case MessageRoleSystem:
		return true
	case MessageRoleUser:
		return true
	default:
		return false
	}
}

// Defines values for MessageStatus.
const (
	MessageStatusError       MessageStatus = "error"
	MessageStatusInterrupted MessageStatus = "interrupted"
	MessageStatusOk          MessageStatus = "ok"
)

// Valid indicates whether the value is a known member of the MessageStatus enum.
func (e MessageStatus) Valid() bool {
	switch e {
	case MessageStatusError:
		return true
	case MessageStatusInterrupted:
		return true
	case MessageStatusOk:
		return true
	default:
		return false
	}
}

// Defines values for MessageToolCallsStatus.
const (
	MessageToolCallsStatusCancelled MessageToolCallsStatus = "cancelled"
	MessageToolCallsStatusDenied    MessageToolCallsStatus = "denied"
	MessageToolCallsStatusError     MessageToolCallsStatus = "error"
	MessageToolCallsStatusPending   MessageToolCallsStatus = "pending"
	MessageToolCallsStatusRunning   MessageToolCallsStatus = "running"
	MessageToolCallsStatusSuccess   MessageToolCallsStatus = "success"
)

// Valid indicates whether the value is a known member of the MessageToolCallsStatus enum.
func (e MessageToolCallsStatus) Valid() bool {
	switch e {
	case MessageToolCallsStatusCancelled:
		return true
	case MessageToolCallsStatusDenied:
		return true
	case MessageToolCallsStatusError:
		return true
	case MessageToolCallsStatusPending:
		return true
	case MessageToolCallsStatusRunning:
		return true
	case MessageToolCallsStatusSuccess:
		return true
	default:
		return false
	}
}

// Defines values for MessageType.
const (
	MessageTypeCompaction   MessageType = "compaction"
	MessageTypeMessage      MessageType = "message"
	MessageTypeSystem       MessageType = "system"
	MessageTypeToolCall     MessageType = "tool_call"
	MessageTypeTurnCanceled MessageType = "turn_canceled"
)

// Valid indicates whether the value is a known member of the MessageType enum.
func (e MessageType) Valid() bool {
	switch e {
	case MessageTypeCompaction:
		return true
	case MessageTypeMessage:
		return true
	case MessageTypeSystem:
		return true
	case MessageTypeToolCall:
		return true
	case MessageTypeTurnCanceled:
		return true
	default:
		return false
	}
}

// Defines values for OnboardingCompleteResponseRole.
const (
	OnboardingCompleteResponseRoleAdmin OnboardingCompleteResponseRole = "admin"
	OnboardingCompleteResponseRoleUser  OnboardingCompleteResponseRole = "user"
)

// Valid indicates whether the value is a known member of the OnboardingCompleteResponseRole enum.
func (e OnboardingCompleteResponseRole) Valid() bool {
	switch e {
	case OnboardingCompleteResponseRoleAdmin:
		return true
	case OnboardingCompleteResponseRoleUser:
		return true
	default:
		return false
	}
}

// Defines values for ProbeProviderRequestId.
const (
	AlibabaCoding          ProbeProviderRequestId = "alibaba-coding"
	AlibabaCodingAnthropic ProbeProviderRequestId = "alibaba-coding-anthropic"
	Anthropic              ProbeProviderRequestId = "anthropic"
	AnthropicMessages      ProbeProviderRequestId = "anthropic-messages"
	Antigravity            ProbeProviderRequestId = "antigravity"
	Avian                  ProbeProviderRequestId = "avian"
	Azure                  ProbeProviderRequestId = "azure"
	AzureOpenai            ProbeProviderRequestId = "azure-openai"
	Bedrock                ProbeProviderRequestId = "bedrock"
	Cerebras               ProbeProviderRequestId = "cerebras"
	ClaudeCli              ProbeProviderRequestId = "claude-cli"
	Claudecli              ProbeProviderRequestId = "claudecli"
	CodexCli               ProbeProviderRequestId = "codex-cli"
	Codexcli               ProbeProviderRequestId = "codexcli"
	CodingPlan             ProbeProviderRequestId = "coding-plan"
	CodingPlanAnthropic    ProbeProviderRequestId = "coding-plan-anthropic"
	Copilot                ProbeProviderRequestId = "copilot"
	DashscopeIntl          ProbeProviderRequestId = "dashscope-intl"
	DashscopeUs            ProbeProviderRequestId = "dashscope-us"
	Deepseek               ProbeProviderRequestId = "deepseek"
	Gemini                 ProbeProviderRequestId = "gemini"
	GithubCopilot          ProbeProviderRequestId = "github-copilot"
	Google                 ProbeProviderRequestId = "google"
	Groq                   ProbeProviderRequestId = "groq"
	Litellm                ProbeProviderRequestId = "litellm"
	Longcat                ProbeProviderRequestId = "longcat"
	Mimo                   ProbeProviderRequestId = "mimo"
	Minimax                ProbeProviderRequestId = "minimax"
	Mistral                ProbeProviderRequestId = "mistral"
	Modelscope             ProbeProviderRequestId = "modelscope"
	Moonshot               ProbeProviderRequestId = "moonshot"
	Novita                 ProbeProviderRequestId = "novita"
	Nvidia                 ProbeProviderRequestId = "nvidia"
	Ollama                 ProbeProviderRequestId = "ollama"
	Openai                 ProbeProviderRequestId = "openai"
	Openrouter             ProbeProviderRequestId = "openrouter"
	Qwen                   ProbeProviderRequestId = "qwen"
	QwenCoding             ProbeProviderRequestId = "qwen-coding"
	QwenInternational      ProbeProviderRequestId = "qwen-international"
	QwenIntl               ProbeProviderRequestId = "qwen-intl"
	QwenUs                 ProbeProviderRequestId = "qwen-us"
	Shengsuanyun           ProbeProviderRequestId = "shengsuanyun"
	Vivgrid                ProbeProviderRequestId = "vivgrid"
	Vllm                   ProbeProviderRequestId = "vllm"
	Volcengine             ProbeProviderRequestId = "volcengine"
	Zhipu                  ProbeProviderRequestId = "zhipu"
)

// Valid indicates whether the value is a known member of the ProbeProviderRequestId enum.
func (e ProbeProviderRequestId) Valid() bool {
	switch e {
	case AlibabaCoding:
		return true
	case AlibabaCodingAnthropic:
		return true
	case Anthropic:
		return true
	case AnthropicMessages:
		return true
	case Antigravity:
		return true
	case Avian:
		return true
	case Azure:
		return true
	case AzureOpenai:
		return true
	case Bedrock:
		return true
	case Cerebras:
		return true
	case ClaudeCli:
		return true
	case Claudecli:
		return true
	case CodexCli:
		return true
	case Codexcli:
		return true
	case CodingPlan:
		return true
	case CodingPlanAnthropic:
		return true
	case Copilot:
		return true
	case DashscopeIntl:
		return true
	case DashscopeUs:
		return true
	case Deepseek:
		return true
	case Gemini:
		return true
	case GithubCopilot:
		return true
	case Google:
		return true
	case Groq:
		return true
	case Litellm:
		return true
	case Longcat:
		return true
	case Mimo:
		return true
	case Minimax:
		return true
	case Mistral:
		return true
	case Modelscope:
		return true
	case Moonshot:
		return true
	case Novita:
		return true
	case Nvidia:
		return true
	case Ollama:
		return true
	case Openai:
		return true
	case Openrouter:
		return true
	case Qwen:
		return true
	case QwenCoding:
		return true
	case QwenInternational:
		return true
	case QwenIntl:
		return true
	case QwenUs:
		return true
	case Shengsuanyun:
		return true
	case Vivgrid:
		return true
	case Vllm:
		return true
	case Volcengine:
		return true
	case Zhipu:
		return true
	default:
		return false
	}
}

// Defines values for PromptGuardResponseLevel.
const (
	PromptGuardResponseLevelHigh   PromptGuardResponseLevel = "high"
	PromptGuardResponseLevelLow    PromptGuardResponseLevel = "low"
	PromptGuardResponseLevelMedium PromptGuardResponseLevel = "medium"
)

// Valid indicates whether the value is a known member of the PromptGuardResponseLevel enum.
func (e PromptGuardResponseLevel) Valid() bool {
	switch e {
	case PromptGuardResponseLevelHigh:
		return true
	case PromptGuardResponseLevelLow:
		return true
	case PromptGuardResponseLevelMedium:
		return true
	default:
		return false
	}
}

// Defines values for PromptGuardUpdateRequestLevel.
const (
	PromptGuardUpdateRequestLevelHigh   PromptGuardUpdateRequestLevel = "high"
	PromptGuardUpdateRequestLevelLow    PromptGuardUpdateRequestLevel = "low"
	PromptGuardUpdateRequestLevelMedium PromptGuardUpdateRequestLevel = "medium"
)

// Valid indicates whether the value is a known member of the PromptGuardUpdateRequestLevel enum.
func (e PromptGuardUpdateRequestLevel) Valid() bool {
	switch e {
	case PromptGuardUpdateRequestLevelHigh:
		return true
	case PromptGuardUpdateRequestLevelLow:
		return true
	case PromptGuardUpdateRequestLevelMedium:
		return true
	default:
		return false
	}
}

// Defines values for PromptGuardUpdateResponseAppliedLevel.
const (
	High   PromptGuardUpdateResponseAppliedLevel = "high"
	Low    PromptGuardUpdateResponseAppliedLevel = "low"
	Medium PromptGuardUpdateResponseAppliedLevel = "medium"
)

// Valid indicates whether the value is a known member of the PromptGuardUpdateResponseAppliedLevel enum.
func (e PromptGuardUpdateResponseAppliedLevel) Valid() bool {
	switch e {
	case High:
		return true
	case Low:
		return true
	case Medium:
		return true
	default:
		return false
	}
}

// Defines values for ProviderStatus.
const (
	ProviderStatusConnected    ProviderStatus = "connected"
	ProviderStatusDisconnected ProviderStatus = "disconnected"
	ProviderStatusError        ProviderStatus = "error"
)

// Valid indicates whether the value is a known member of the ProviderStatus enum.
func (e ProviderStatus) Valid() bool {
	switch e {
	case ProviderStatusConnected:
		return true
	case ProviderStatusDisconnected:
		return true
	case ProviderStatusError:
		return true
	default:
		return false
	}
}

// Defines values for SandboxConfigDefaultProfile.
const (
	SandboxConfigDefaultProfileEmpty        SandboxConfigDefaultProfile = ""
	SandboxConfigDefaultProfileHost         SandboxConfigDefaultProfile = "host"
	SandboxConfigDefaultProfileNone         SandboxConfigDefaultProfile = "none"
	SandboxConfigDefaultProfileOff          SandboxConfigDefaultProfile = "off"
	SandboxConfigDefaultProfileWorkspace    SandboxConfigDefaultProfile = "workspace"
	SandboxConfigDefaultProfileWorkspaceNet SandboxConfigDefaultProfile = "workspace+net"
)

// Valid indicates whether the value is a known member of the SandboxConfigDefaultProfile enum.
func (e SandboxConfigDefaultProfile) Valid() bool {
	switch e {
	case SandboxConfigDefaultProfileEmpty:
		return true
	case SandboxConfigDefaultProfileHost:
		return true
	case SandboxConfigDefaultProfileNone:
		return true
	case SandboxConfigDefaultProfileOff:
		return true
	case SandboxConfigDefaultProfileWorkspace:
		return true
	case SandboxConfigDefaultProfileWorkspaceNet:
		return true
	default:
		return false
	}
}

// Defines values for SandboxConfigMode.
const (
	SandboxConfigModeEnforce    SandboxConfigMode = "enforce"
	SandboxConfigModeOff        SandboxConfigMode = "off"
	SandboxConfigModePermissive SandboxConfigMode = "permissive"
)

// Valid indicates whether the value is a known member of the SandboxConfigMode enum.
func (e SandboxConfigMode) Valid() bool {
	switch e {
	case SandboxConfigModeEnforce:
		return true
	case SandboxConfigModeOff:
		return true
	case SandboxConfigModePermissive:
		return true
	default:
		return false
	}
}

// Defines values for SandboxConfigUpdateDefaultProfile.
const (
	SandboxConfigUpdateDefaultProfileEmpty        SandboxConfigUpdateDefaultProfile = ""
	SandboxConfigUpdateDefaultProfileHost         SandboxConfigUpdateDefaultProfile = "host"
	SandboxConfigUpdateDefaultProfileNone         SandboxConfigUpdateDefaultProfile = "none"
	SandboxConfigUpdateDefaultProfileOff          SandboxConfigUpdateDefaultProfile = "off"
	SandboxConfigUpdateDefaultProfileWorkspace    SandboxConfigUpdateDefaultProfile = "workspace"
	SandboxConfigUpdateDefaultProfileWorkspaceNet SandboxConfigUpdateDefaultProfile = "workspace+net"
)

// Valid indicates whether the value is a known member of the SandboxConfigUpdateDefaultProfile enum.
func (e SandboxConfigUpdateDefaultProfile) Valid() bool {
	switch e {
	case SandboxConfigUpdateDefaultProfileEmpty:
		return true
	case SandboxConfigUpdateDefaultProfileHost:
		return true
	case SandboxConfigUpdateDefaultProfileNone:
		return true
	case SandboxConfigUpdateDefaultProfileOff:
		return true
	case SandboxConfigUpdateDefaultProfileWorkspace:
		return true
	case SandboxConfigUpdateDefaultProfileWorkspaceNet:
		return true
	default:
		return false
	}
}

// Defines values for SandboxConfigUpdateMode.
const (
	SandboxConfigUpdateModeEnforce    SandboxConfigUpdateMode = "enforce"
	SandboxConfigUpdateModeOff        SandboxConfigUpdateMode = "off"
	SandboxConfigUpdateModePermissive SandboxConfigUpdateMode = "permissive"
)

// Valid indicates whether the value is a known member of the SandboxConfigUpdateMode enum.
func (e SandboxConfigUpdateMode) Valid() bool {
	switch e {
	case SandboxConfigUpdateModeEnforce:
		return true
	case SandboxConfigUpdateModeOff:
		return true
	case SandboxConfigUpdateModePermissive:
		return true
	default:
		return false
	}
}

// Defines values for SessionStatus.
const (
	SessionStatusActive      SessionStatus = "active"
	SessionStatusArchived    SessionStatus = "archived"
	SessionStatusInterrupted SessionStatus = "interrupted"
)

// Valid indicates whether the value is a known member of the SessionStatus enum.
func (e SessionStatus) Valid() bool {
	switch e {
	case SessionStatusActive:
		return true
	case SessionStatusArchived:
		return true
	case SessionStatusInterrupted:
		return true
	default:
		return false
	}
}

// Defines values for SessionType.
const (
	SessionTypeChannel SessionType = "channel"
	SessionTypeChat    SessionType = "chat"
	SessionTypeTask    SessionType = "task"
)

// Valid indicates whether the value is a known member of the SessionType enum.
func (e SessionType) Valid() bool {
	switch e {
	case SessionTypeChannel:
		return true
	case SessionTypeChat:
		return true
	case SessionTypeTask:
		return true
	default:
		return false
	}
}

// Defines values for SessionCreateRequestType.
const (
	SessionCreateRequestTypeChannel SessionCreateRequestType = "channel"
	SessionCreateRequestTypeChat    SessionCreateRequestType = "chat"
	SessionCreateRequestTypeTask    SessionCreateRequestType = "task"
)

// Valid indicates whether the value is a known member of the SessionCreateRequestType enum.
func (e SessionCreateRequestType) Valid() bool {
	switch e {
	case SessionCreateRequestTypeChannel:
		return true
	case SessionCreateRequestTypeChat:
		return true
	case SessionCreateRequestTypeTask:
		return true
	default:
		return false
	}
}

// Defines values for SessionDetailMessagesAttachmentsType.
const (
	Audio SessionDetailMessagesAttachmentsType = "audio"
	File  SessionDetailMessagesAttachmentsType = "file"
	Image SessionDetailMessagesAttachmentsType = "image"
	Video SessionDetailMessagesAttachmentsType = "video"
)

// Valid indicates whether the value is a known member of the SessionDetailMessagesAttachmentsType enum.
func (e SessionDetailMessagesAttachmentsType) Valid() bool {
	switch e {
	case Audio:
		return true
	case File:
		return true
	case Image:
		return true
	case Video:
		return true
	default:
		return false
	}
}

// Defines values for SessionDetailMessagesCancelMethod.
const (
	SessionDetailMessagesCancelMethodGraceful SessionDetailMessagesCancelMethod = "graceful"
	SessionDetailMessagesCancelMethodHard     SessionDetailMessagesCancelMethod = "hard"
)

// Valid indicates whether the value is a known member of the SessionDetailMessagesCancelMethod enum.
func (e SessionDetailMessagesCancelMethod) Valid() bool {
	switch e {
	case SessionDetailMessagesCancelMethodGraceful:
		return true
	case SessionDetailMessagesCancelMethodHard:
		return true
	default:
		return false
	}
}

// Defines values for SessionDetailMessagesRole.
const (
	SessionDetailMessagesRoleAssistant SessionDetailMessagesRole = "assistant"
	SessionDetailMessagesRoleSystem    SessionDetailMessagesRole = "system"
	SessionDetailMessagesRoleUser      SessionDetailMessagesRole = "user"
)

// Valid indicates whether the value is a known member of the SessionDetailMessagesRole enum.
func (e SessionDetailMessagesRole) Valid() bool {
	switch e {
	case SessionDetailMessagesRoleAssistant:
		return true
	case SessionDetailMessagesRoleSystem:
		return true
	case SessionDetailMessagesRoleUser:
		return true
	default:
		return false
	}
}

// Defines values for SessionDetailMessagesStatus.
const (
	SessionDetailMessagesStatusError       SessionDetailMessagesStatus = "error"
	SessionDetailMessagesStatusInterrupted SessionDetailMessagesStatus = "interrupted"
	SessionDetailMessagesStatusOk          SessionDetailMessagesStatus = "ok"
)

// Valid indicates whether the value is a known member of the SessionDetailMessagesStatus enum.
func (e SessionDetailMessagesStatus) Valid() bool {
	switch e {
	case SessionDetailMessagesStatusError:
		return true
	case SessionDetailMessagesStatusInterrupted:
		return true
	case SessionDetailMessagesStatusOk:
		return true
	default:
		return false
	}
}

// Defines values for SessionDetailMessagesToolCallsStatus.
const (
	SessionDetailMessagesToolCallsStatusCancelled SessionDetailMessagesToolCallsStatus = "cancelled"
	SessionDetailMessagesToolCallsStatusDenied    SessionDetailMessagesToolCallsStatus = "denied"
	SessionDetailMessagesToolCallsStatusError     SessionDetailMessagesToolCallsStatus = "error"
	SessionDetailMessagesToolCallsStatusPending   SessionDetailMessagesToolCallsStatus = "pending"
	SessionDetailMessagesToolCallsStatusRunning   SessionDetailMessagesToolCallsStatus = "running"
	SessionDetailMessagesToolCallsStatusSuccess   SessionDetailMessagesToolCallsStatus = "success"
)

// Valid indicates whether the value is a known member of the SessionDetailMessagesToolCallsStatus enum.
func (e SessionDetailMessagesToolCallsStatus) Valid() bool {
	switch e {
	case SessionDetailMessagesToolCallsStatusCancelled:
		return true
	case SessionDetailMessagesToolCallsStatusDenied:
		return true
	case SessionDetailMessagesToolCallsStatusError:
		return true
	case SessionDetailMessagesToolCallsStatusPending:
		return true
	case SessionDetailMessagesToolCallsStatusRunning:
		return true
	case SessionDetailMessagesToolCallsStatusSuccess:
		return true
	default:
		return false
	}
}

// Defines values for SessionDetailMessagesType.
const (
	SessionDetailMessagesTypeCompaction   SessionDetailMessagesType = "compaction"
	SessionDetailMessagesTypeMessage      SessionDetailMessagesType = "message"
	SessionDetailMessagesTypeSystem       SessionDetailMessagesType = "system"
	SessionDetailMessagesTypeToolCall     SessionDetailMessagesType = "tool_call"
	SessionDetailMessagesTypeTurnCanceled SessionDetailMessagesType = "turn_canceled"
)

// Valid indicates whether the value is a known member of the SessionDetailMessagesType enum.
func (e SessionDetailMessagesType) Valid() bool {
	switch e {
	case SessionDetailMessagesTypeCompaction:
		return true
	case SessionDetailMessagesTypeMessage:
		return true
	case SessionDetailMessagesTypeSystem:
		return true
	case SessionDetailMessagesTypeToolCall:
		return true
	case SessionDetailMessagesTypeTurnCanceled:
		return true
	default:
		return false
	}
}

// Defines values for SessionDetailSessionStatus.
const (
	SessionDetailSessionStatusActive      SessionDetailSessionStatus = "active"
	SessionDetailSessionStatusArchived    SessionDetailSessionStatus = "archived"
	SessionDetailSessionStatusInterrupted SessionDetailSessionStatus = "interrupted"
)

// Valid indicates whether the value is a known member of the SessionDetailSessionStatus enum.
func (e SessionDetailSessionStatus) Valid() bool {
	switch e {
	case SessionDetailSessionStatusActive:
		return true
	case SessionDetailSessionStatusArchived:
		return true
	case SessionDetailSessionStatusInterrupted:
		return true
	default:
		return false
	}
}

// Defines values for SessionDetailSessionType.
const (
	SessionDetailSessionTypeChannel SessionDetailSessionType = "channel"
	SessionDetailSessionTypeChat    SessionDetailSessionType = "chat"
	SessionDetailSessionTypeTask    SessionDetailSessionType = "task"
)

// Valid indicates whether the value is a known member of the SessionDetailSessionType enum.
func (e SessionDetailSessionType) Valid() bool {
	switch e {
	case SessionDetailSessionTypeChannel:
		return true
	case SessionDetailSessionTypeChat:
		return true
	case SessionDetailSessionTypeTask:
		return true
	default:
		return false
	}
}

// Defines values for SessionScopeRequestDmScope.
const (
	SessionScopeRequestDmScopeMain                  SessionScopeRequestDmScope = "main"
	SessionScopeRequestDmScopePerAccountChannelPeer SessionScopeRequestDmScope = "per-account-channel-peer"
	SessionScopeRequestDmScopePerChannelPeer        SessionScopeRequestDmScope = "per-channel-peer"
	SessionScopeRequestDmScopePerPeer               SessionScopeRequestDmScope = "per-peer"
)

// Valid indicates whether the value is a known member of the SessionScopeRequestDmScope enum.
func (e SessionScopeRequestDmScope) Valid() bool {
	switch e {
	case SessionScopeRequestDmScopeMain:
		return true
	case SessionScopeRequestDmScopePerAccountChannelPeer:
		return true
	case SessionScopeRequestDmScopePerChannelPeer:
		return true
	case SessionScopeRequestDmScopePerPeer:
		return true
	default:
		return false
	}
}

// Defines values for SessionScopeResponseDmScope.
const (
	SessionScopeResponseDmScopeMain                  SessionScopeResponseDmScope = "main"
	SessionScopeResponseDmScopePerAccountChannelPeer SessionScopeResponseDmScope = "per-account-channel-peer"
	SessionScopeResponseDmScopePerChannelPeer        SessionScopeResponseDmScope = "per-channel-peer"
	SessionScopeResponseDmScopePerPeer               SessionScopeResponseDmScope = "per-peer"
)

// Valid indicates whether the value is a known member of the SessionScopeResponseDmScope enum.
func (e SessionScopeResponseDmScope) Valid() bool {
	switch e {
	case SessionScopeResponseDmScopeMain:
		return true
	case SessionScopeResponseDmScopePerAccountChannelPeer:
		return true
	case SessionScopeResponseDmScopePerChannelPeer:
		return true
	case SessionScopeResponseDmScopePerPeer:
		return true
	default:
		return false
	}
}

// Defines values for SkillStatus.
const (
	SkillStatusActive   SkillStatus = "active"
	SkillStatusDisabled SkillStatus = "disabled"
	SkillStatusError    SkillStatus = "error"
	SkillStatusInactive SkillStatus = "inactive"
)

// Valid indicates whether the value is a known member of the SkillStatus enum.
func (e SkillStatus) Valid() bool {
	switch e {
	case SkillStatusActive:
		return true
	case SkillStatusDisabled:
		return true
	case SkillStatusError:
		return true
	case SkillStatusInactive:
		return true
	default:
		return false
	}
}

// Defines values for SkillTrustResponseLevel.
const (
	SkillTrustResponseLevelAllowAll        SkillTrustResponseLevel = "allow_all"
	SkillTrustResponseLevelBlockUnverified SkillTrustResponseLevel = "block_unverified"
	SkillTrustResponseLevelWarnUnverified  SkillTrustResponseLevel = "warn_unverified"
)

// Valid indicates whether the value is a known member of the SkillTrustResponseLevel enum.
func (e SkillTrustResponseLevel) Valid() bool {
	switch e {
	case SkillTrustResponseLevelAllowAll:
		return true
	case SkillTrustResponseLevelBlockUnverified:
		return true
	case SkillTrustResponseLevelWarnUnverified:
		return true
	default:
		return false
	}
}

// Defines values for SkillTrustUpdateRequestLevel.
const (
	SkillTrustUpdateRequestLevelAllowAll        SkillTrustUpdateRequestLevel = "allow_all"
	SkillTrustUpdateRequestLevelBlockUnverified SkillTrustUpdateRequestLevel = "block_unverified"
	SkillTrustUpdateRequestLevelWarnUnverified  SkillTrustUpdateRequestLevel = "warn_unverified"
)

// Valid indicates whether the value is a known member of the SkillTrustUpdateRequestLevel enum.
func (e SkillTrustUpdateRequestLevel) Valid() bool {
	switch e {
	case SkillTrustUpdateRequestLevelAllowAll:
		return true
	case SkillTrustUpdateRequestLevelBlockUnverified:
		return true
	case SkillTrustUpdateRequestLevelWarnUnverified:
		return true
	default:
		return false
	}
}

// Defines values for SkillTrustUpdateResponseAppliedLevel.
const (
	AllowAll        SkillTrustUpdateResponseAppliedLevel = "allow_all"
	BlockUnverified SkillTrustUpdateResponseAppliedLevel = "block_unverified"
	WarnUnverified  SkillTrustUpdateResponseAppliedLevel = "warn_unverified"
)

// Valid indicates whether the value is a known member of the SkillTrustUpdateResponseAppliedLevel enum.
func (e SkillTrustUpdateResponseAppliedLevel) Valid() bool {
	switch e {
	case AllowAll:
		return true
	case BlockUnverified:
		return true
	case WarnUnverified:
		return true
	default:
		return false
	}
}

// Defines values for TaskStatus.
const (
	TaskStatusAssigned  TaskStatus = "assigned"
	TaskStatusCompleted TaskStatus = "completed"
	TaskStatusFailed    TaskStatus = "failed"
	TaskStatusQueued    TaskStatus = "queued"
	TaskStatusRunning   TaskStatus = "running"
)

// Valid indicates whether the value is a known member of the TaskStatus enum.
func (e TaskStatus) Valid() bool {
	switch e {
	case TaskStatusAssigned:
		return true
	case TaskStatusCompleted:
		return true
	case TaskStatusFailed:
		return true
	case TaskStatusQueued:
		return true
	case TaskStatusRunning:
		return true
	default:
		return false
	}
}

// Defines values for TaskTriggerType.
const (
	TaskTriggerTypeEvent  TaskTriggerType = "event"
	TaskTriggerTypeManual TaskTriggerType = "manual"
	TaskTriggerTypeTime   TaskTriggerType = "time"
)

// Valid indicates whether the value is a known member of the TaskTriggerType enum.
func (e TaskTriggerType) Valid() bool {
	switch e {
	case TaskTriggerTypeEvent:
		return true
	case TaskTriggerTypeManual:
		return true
	case TaskTriggerTypeTime:
		return true
	default:
		return false
	}
}

// Defines values for TaskAcceptedResponseStatus.
const (
	Accepted TaskAcceptedResponseStatus = "accepted"
)

// Valid indicates whether the value is a known member of the TaskAcceptedResponseStatus enum.
func (e TaskAcceptedResponseStatus) Valid() bool {
	switch e {
	case Accepted:
		return true
	default:
		return false
	}
}

// Defines values for TaskCreateRequestTriggerType.
const (
	TaskCreateRequestTriggerTypeEvent  TaskCreateRequestTriggerType = "event"
	TaskCreateRequestTriggerTypeManual TaskCreateRequestTriggerType = "manual"
	TaskCreateRequestTriggerTypeTime   TaskCreateRequestTriggerType = "time"
)

// Valid indicates whether the value is a known member of the TaskCreateRequestTriggerType enum.
func (e TaskCreateRequestTriggerType) Valid() bool {
	switch e {
	case TaskCreateRequestTriggerTypeEvent:
		return true
	case TaskCreateRequestTriggerTypeManual:
		return true
	case TaskCreateRequestTriggerTypeTime:
		return true
	default:
		return false
	}
}

// Defines values for TaskUpdateRequestStatus.
const (
	TaskUpdateRequestStatusAssigned  TaskUpdateRequestStatus = "assigned"
	TaskUpdateRequestStatusCompleted TaskUpdateRequestStatus = "completed"
	TaskUpdateRequestStatusFailed    TaskUpdateRequestStatus = "failed"
	TaskUpdateRequestStatusQueued    TaskUpdateRequestStatus = "queued"
	TaskUpdateRequestStatusRunning   TaskUpdateRequestStatus = "running"
)

// Valid indicates whether the value is a known member of the TaskUpdateRequestStatus enum.
func (e TaskUpdateRequestStatus) Valid() bool {
	switch e {
	case TaskUpdateRequestStatusAssigned:
		return true
	case TaskUpdateRequestStatusCompleted:
		return true
	case TaskUpdateRequestStatusFailed:
		return true
	case TaskUpdateRequestStatusQueued:
		return true
	case TaskUpdateRequestStatusRunning:
		return true
	default:
		return false
	}
}

// Defines values for ToolApprovalActionRequestAction.
const (
	ToolApprovalActionRequestActionApprove ToolApprovalActionRequestAction = "approve"
	ToolApprovalActionRequestActionCancel  ToolApprovalActionRequestAction = "cancel"
	ToolApprovalActionRequestActionDeny    ToolApprovalActionRequestAction = "deny"
)

// Valid indicates whether the value is a known member of the ToolApprovalActionRequestAction enum.
func (e ToolApprovalActionRequestAction) Valid() bool {
	switch e {
	case ToolApprovalActionRequestActionApprove:
		return true
	case ToolApprovalActionRequestActionCancel:
		return true
	case ToolApprovalActionRequestActionDeny:
		return true
	default:
		return false
	}
}

// Defines values for ToolApprovalResponseAction.
const (
	ToolApprovalResponseActionApprove ToolApprovalResponseAction = "approve"
	ToolApprovalResponseActionCancel  ToolApprovalResponseAction = "cancel"
	ToolApprovalResponseActionDeny    ToolApprovalResponseAction = "deny"
)

// Valid indicates whether the value is a known member of the ToolApprovalResponseAction enum.
func (e ToolApprovalResponseAction) Valid() bool {
	switch e {
	case ToolApprovalResponseActionApprove:
		return true
	case ToolApprovalResponseActionCancel:
		return true
	case ToolApprovalResponseActionDeny:
		return true
	default:
		return false
	}
}

// Defines values for ToolApprovalResponseStatus.
const (
	Ok ToolApprovalResponseStatus = "ok"
)

// Valid indicates whether the value is a known member of the ToolApprovalResponseStatus enum.
func (e ToolApprovalResponseStatus) Valid() bool {
	switch e {
	case Ok:
		return true
	default:
		return false
	}
}

// Defines values for ToolCallStatus.
const (
	ToolCallStatusCancelled ToolCallStatus = "cancelled"
	ToolCallStatusDenied    ToolCallStatus = "denied"
	ToolCallStatusError     ToolCallStatus = "error"
	ToolCallStatusPending   ToolCallStatus = "pending"
	ToolCallStatusRunning   ToolCallStatus = "running"
	ToolCallStatusSuccess   ToolCallStatus = "success"
)

// Valid indicates whether the value is a known member of the ToolCallStatus enum.
func (e ToolCallStatus) Valid() bool {
	switch e {
	case ToolCallStatusCancelled:
		return true
	case ToolCallStatusDenied:
		return true
	case ToolCallStatusError:
		return true
	case ToolCallStatusPending:
		return true
	case ToolCallStatusRunning:
		return true
	case ToolCallStatusSuccess:
		return true
	default:
		return false
	}
}

// Defines values for ToolPolicy.
const (
	Allow ToolPolicy = "allow"
	Ask   ToolPolicy = "ask"
	Deny  ToolPolicy = "deny"
)

// Valid indicates whether the value is a known member of the ToolPolicy enum.
func (e ToolPolicy) Valid() bool {
	switch e {
	case Allow:
		return true
	case Ask:
		return true
	case Deny:
		return true
	default:
		return false
	}
}

// Defines values for ToolRegistryEntryScope.
const (
	ToolRegistryEntryScopeCore    ToolRegistryEntryScope = "core"
	ToolRegistryEntryScopeGeneral ToolRegistryEntryScope = "general"
	ToolRegistryEntryScopeSystem  ToolRegistryEntryScope = "system"
)

// Valid indicates whether the value is a known member of the ToolRegistryEntryScope enum.
func (e ToolRegistryEntryScope) Valid() bool {
	switch e {
	case ToolRegistryEntryScopeCore:
		return true
	case ToolRegistryEntryScopeGeneral:
		return true
	case ToolRegistryEntryScopeSystem:
		return true
	default:
		return false
	}
}

// Defines values for ToolRegistryEntrySource.
const (
	Builtin ToolRegistryEntrySource = "builtin"
	Mcp     ToolRegistryEntrySource = "mcp"
)

// Valid indicates whether the value is a known member of the ToolRegistryEntrySource enum.
func (e ToolRegistryEntrySource) Valid() bool {
	switch e {
	case Builtin:
		return true
	case Mcp:
		return true
	default:
		return false
	}
}

// Defines values for UserRole.
const (
	UserRoleAdmin UserRole = "admin"
	UserRoleUser  UserRole = "user"
)

// Valid indicates whether the value is a known member of the UserRole enum.
func (e UserRole) Valid() bool {
	switch e {
	case UserRoleAdmin:
		return true
	case UserRoleUser:
		return true
	default:
		return false
	}
}

// Defines values for UserCreateRequestRole.
const (
	UserCreateRequestRoleAdmin UserCreateRequestRole = "admin"
	UserCreateRequestRoleUser  UserCreateRequestRole = "user"
)

// Valid indicates whether the value is a known member of the UserCreateRequestRole enum.
func (e UserCreateRequestRole) Valid() bool {
	switch e {
	case UserCreateRequestRoleAdmin:
		return true
	case UserCreateRequestRoleUser:
		return true
	default:
		return false
	}
}

// Defines values for UserCreateResponseRole.
const (
	UserCreateResponseRoleAdmin UserCreateResponseRole = "admin"
	UserCreateResponseRoleUser  UserCreateResponseRole = "user"
)

// Valid indicates whether the value is a known member of the UserCreateResponseRole enum.
func (e UserCreateResponseRole) Valid() bool {
	switch e {
	case UserCreateResponseRoleAdmin:
		return true
	case UserCreateResponseRoleUser:
		return true
	default:
		return false
	}
}

// Defines values for UserRoleChangeRequestRole.
const (
	UserRoleChangeRequestRoleAdmin UserRoleChangeRequestRole = "admin"
	UserRoleChangeRequestRoleUser  UserRoleChangeRequestRole = "user"
)

// Valid indicates whether the value is a known member of the UserRoleChangeRequestRole enum.
func (e UserRoleChangeRequestRole) Valid() bool {
	switch e {
	case UserRoleChangeRequestRoleAdmin:
		return true
	case UserRoleChangeRequestRoleUser:
		return true
	default:
		return false
	}
}

// Defines values for UserRoleChangeResponseRole.
const (
	UserRoleChangeResponseRoleAdmin UserRoleChangeResponseRole = "admin"
	UserRoleChangeResponseRoleUser  UserRoleChangeResponseRole = "user"
)

// Valid indicates whether the value is a known member of the UserRoleChangeResponseRole enum.
func (e UserRoleChangeResponseRole) Valid() bool {
	switch e {
	case UserRoleChangeResponseRoleAdmin:
		return true
	case UserRoleChangeResponseRoleUser:
		return true
	default:
		return false
	}
}

// Defines values for ValidateTokenResponseRole.
const (
	ValidateTokenResponseRoleAdmin ValidateTokenResponseRole = "admin"
	ValidateTokenResponseRoleUser  ValidateTokenResponseRole = "user"
)

// Valid indicates whether the value is a known member of the ValidateTokenResponseRole enum.
func (e ValidateTokenResponseRole) Valid() bool {
	switch e {
	case ValidateTokenResponseRoleAdmin:
		return true
	case ValidateTokenResponseRoleUser:
		return true
	default:
		return false
	}
}

// Defines values for DeleteCredential200JSONResponseBodyStatus.
const (
	Removed DeleteCredential200JSONResponseBodyStatus = "removed"
)

// Valid indicates whether the value is a known member of the DeleteCredential200JSONResponseBodyStatus enum.
func (e DeleteCredential200JSONResponseBodyStatus) Valid() bool {
	switch e {
	case Removed:
		return true
	default:
		return false
	}
}

// Defines values for RestoreBackup200JSONResponseBodyStatus.
const (
	Restored RestoreBackup200JSONResponseBodyStatus = "restored"
)

// Valid indicates whether the value is a known member of the RestoreBackup200JSONResponseBodyStatus enum.
func (e RestoreBackup200JSONResponseBodyStatus) Valid() bool {
	switch e {
	case Restored:
		return true
	default:
		return false
	}
}

// Defines values for ListSessionsParamsType.
const (
	ListSessionsParamsTypeChannel ListSessionsParamsType = "channel"
	ListSessionsParamsTypeChat    ListSessionsParamsType = "chat"
	ListSessionsParamsTypeTask    ListSessionsParamsType = "task"
)

// Valid indicates whether the value is a known member of the ListSessionsParamsType enum.
func (e ListSessionsParamsType) Valid() bool {
	switch e {
	case ListSessionsParamsTypeChannel:
		return true
	case ListSessionsParamsTypeChat:
		return true
	case ListSessionsParamsTypeTask:
		return true
	default:
		return false
	}
}

// Defines values for ClearAllSessions200JSONResponseBodyStatus.
const (
	Cleared ClearAllSessions200JSONResponseBodyStatus = "cleared"
)

// Valid indicates whether the value is a known member of the ClearAllSessions200JSONResponseBodyStatus enum.
func (e ClearAllSessions200JSONResponseBodyStatus) Valid() bool {
	switch e {
	case Cleared:
		return true
	default:
		return false
	}
}

// Defines values for ListTasksParamsStatus.
const (
	ListTasksParamsStatusAssigned  ListTasksParamsStatus = "assigned"
	ListTasksParamsStatusCompleted ListTasksParamsStatus = "completed"
	ListTasksParamsStatusFailed    ListTasksParamsStatus = "failed"
	ListTasksParamsStatusQueued    ListTasksParamsStatus = "queued"
	ListTasksParamsStatusRunning   ListTasksParamsStatus = "running"
)

// Valid indicates whether the value is a known member of the ListTasksParamsStatus enum.
func (e ListTasksParamsStatus) Valid() bool {
	switch e {
	case ListTasksParamsStatusAssigned:
		return true
	case ListTasksParamsStatusCompleted:
		return true
	case ListTasksParamsStatusFailed:
		return true
	case ListTasksParamsStatusQueued:
		return true
	case ListTasksParamsStatusRunning:
		return true
	default:
		return false
	}
}

// AboutResponse Gateway metadata returned by GET /api/v1/about.
type AboutResponse struct {
	// Arch CPU architecture (GOARCH).
	Arch string `json:"arch"`

	// FrameAncestorsFallback True when frame-ancestors is in fallback ('*') mode — the host is bound to 0.0.0.0/[::] and public_url is not set, degrading T-04 defence. The SPA can show a warning banner when this is true.
	FrameAncestorsFallback bool `json:"frame_ancestors_fallback"`

	// GoVersion Go runtime version string.
	GoVersion string `json:"go_version"`

	// Os Operating system (GOOS).
	Os string `json:"os"`

	// Pid Gateway process ID.
	Pid int `json:"pid"`

	// PreviewListenerEnabled Whether the iframe preview listener is currently bound and serving requests. Absent on old gateway versions (treat as true when absent).
	PreviewListenerEnabled bool `json:"preview_listener_enabled"`

	// PreviewOrigin Fully-qualified HTTPS origin operators set via gateway.preview_origin (e.g. "https://preview.acme.com"). Absent when not configured; the SPA constructs the origin from preview_port in that case.
	PreviewOrigin *string `json:"preview_origin,omitempty"`

	// PreviewPort Port the preview listener is bound on (FR-009). Default is gateway.port + 1.
	PreviewPort int `json:"preview_port"`

	// Uptime Human-readable uptime string.
	Uptime string `json:"uptime"`

	// UptimeSeconds Process uptime in seconds.
	UptimeSeconds int `json:"uptime_seconds"`

	// Version Omnipus gateway version string.
	Version string `json:"version"`

	// WarmupTimeoutSeconds Dev-server warmup timeout from config.
	WarmupTimeoutSeconds int `json:"warmup_timeout_seconds"`
}

// ActivityEvent A single activity event as returned by GET /activity. Events represent notable runtime occurrences (session starts, task lifecycle changes) from the last 24 hours, returned in reverse-chronological order (max 50 entries).
type ActivityEvent struct {
	// AgentId ID of the agent involved in the event (absent for system events).
	AgentId *string `json:"agent_id,omitempty"`

	// AgentName Display name of the agent involved (absent for system events).
	AgentName *string `json:"agent_name,omitempty"`

	// Id Opaque event identifier derived from the source entity. E.g. "session-<uuid>", "task-c-<id>", "task-u-<id>".
	Id string `json:"id"`

	// Summary Human-readable one-line summary of the event (e.g. session title, task title).
	Summary *string `json:"summary,omitempty"`

	// Timestamp RFC3339 UTC timestamp when the event occurred.
	Timestamp time.Time `json:"timestamp"`

	// Type Event category. "session_start" = new session began. "task_created" = a task was created. "task_updated" = a task completed or changed status.
	Type ActivityEventType `json:"type"`
}

// ActivityEventType Event category. "session_start" = new session began. "task_created" = a task was created. "task_updated" = a task completed or changed status.
type ActivityEventType string

// ActivityEventsResponse Response from GET /api/v1/activity when partial data is available with a warning. Returned instead of a plain ActivityEvent array when a session read error occurred.
type ActivityEventsResponse struct {
	// Events Activity events (reverse-chronological, max 50, last 24 hours).
	Events []struct {
		// AgentId ID of the agent involved in the event (absent for system events).
		AgentId *string `json:"agent_id,omitempty"`

		// AgentName Display name of the agent involved (absent for system events).
		AgentName *string `json:"agent_name,omitempty"`

		// Id Opaque event identifier derived from the source entity. E.g. "session-<uuid>", "task-c-<id>", "task-u-<id>".
		Id string `json:"id"`

		// Summary Human-readable one-line summary of the event (e.g. session title, task title).
		Summary *string `json:"summary,omitempty"`

		// Timestamp RFC3339 UTC timestamp when the event occurred.
		Timestamp time.Time `json:"timestamp"`

		// Type Event category. "session_start" = new session began. "task_created" = a task was created. "task_updated" = a task completed or changed status.
		Type ActivityEventsResponseEventsType `json:"type"`
	} `json:"events"`

	// Warning Present when a non-fatal error occurred while collecting events (e.g. a session store was unreadable). The response is still returned.
	Warning *string `json:"warning,omitempty"`
}

// ActivityEventsResponseEventsType Event category. "session_start" = new session began. "task_created" = a task was created. "task_updated" = a task completed or changed status.
type ActivityEventsResponseEventsType string

// Agent An agent configuration object as returned by GET /agents and GET /agents/{id}. Maps to the Go agentResponse struct and the TypeScript Agent interface in src/lib/api.ts. Core (locked) agents suppress soul/instructions in list responses and forbid identity mutations via PUT.
type Agent struct {
	// Color Hex color code for agent avatar display (e.g. "#D4AF37").
	Color *string `json:"color,omitempty"`

	// Default Whether this agent is the global default that handles inbound messages with no more-specific routing rule. At most one agent is default.
	Default *bool `json:"default,omitempty"`

	// Description Short description of the agent's purpose.
	Description *string `json:"description,omitempty"`

	// FallbackModels Ordered list of fallback model IDs tried when the primary model returns an error. Each entry may be a bare model name or "provider/model" format.
	FallbackModels *[]string `json:"fallback_models,omitempty"`

	// Heartbeat Contents of HEARTBEAT.md — periodic background instructions. Empty string when not set. Always present on detail responses (never null).
	Heartbeat string `json:"heartbeat"`

	// HeartbeatEnabled Whether the HEARTBEAT.md periodic instruction loop is active for this agent.
	HeartbeatEnabled bool `json:"heartbeat_enabled"`

	// HeartbeatInterval Interval in seconds between heartbeat passes.
	HeartbeatInterval int `json:"heartbeat_interval"`

	// Icon Phosphor icon name for agent avatar (e.g. "Robot", "Octopus").
	Icon *string `json:"icon,omitempty"`

	// Id Unique agent identifier. UUID for custom agents; well-known strings for core agents (e.g. "jim").
	Id string `json:"id"`

	// Instructions Body of AGENT.md (everything after the closing frontmatter delimiter) — additional runtime instructions. Empty string when not set. Always present on detail responses (never null).
	Instructions string `json:"instructions"`

	// Locked When true, name, description, soul, heartbeat, and instructions are immutable via the PUT /agents/{id} endpoint. Core agents are always locked.
	Locked bool `json:"locked"`

	// MaxToolIterations Maximum number of tool calls allowed per turn. Inherited from agents.defaults.max_tool_iterations when not overridden.
	MaxToolIterations int `json:"max_tool_iterations"`

	// Model Model name string used for LLM calls (resolved from defaults when not explicitly set on the agent). May be "provider/model" format for OpenRouter.
	Model *string `json:"model,omitempty"`

	// ModelParams LLM sampling parameters applied to an agent's requests. When absent, the provider defaults are used.
	ModelParams *struct {
		// MaxTokens Maximum tokens to generate per turn.
		MaxTokens *int `json:"max_tokens,omitempty"`

		// Temperature Sampling temperature (0.0 – 2.0). Lower = more deterministic.
		Temperature *float64 `json:"temperature,omitempty"`

		// TopP Nucleus sampling probability mass. 1.0 disables nucleus sampling.
		TopP *float64 `json:"top_p,omitempty"`
	} `json:"model_params,omitempty"`

	// Name Human-readable display name.
	Name string `json:"name"`

	// RateLimits Per-agent rate-limit overrides. When use_global_defaults is true the global policy applies and per-agent overrides are ignored.
	RateLimits *struct {
		// MaxCostPerDay Maximum USD cost per day for this agent. Absent = no per-agent cap.
		MaxCostPerDay *float64 `json:"max_cost_per_day,omitempty"`

		// MaxLlmCallsPerHour Maximum LLM API calls per hour for this agent. Absent = no per-agent cap.
		MaxLlmCallsPerHour *int `json:"max_llm_calls_per_hour,omitempty"`

		// MaxToolCallsPerMinute Maximum tool calls per minute for this agent. Absent = no per-agent cap.
		MaxToolCallsPerMinute *int `json:"max_tool_calls_per_minute,omitempty"`

		// UseGlobalDefaults When true, global rate limits are used and per-agent overrides are ignored.
		UseGlobalDefaults *bool `json:"use_global_defaults,omitempty"`
	} `json:"rate_limits,omitempty"`

	// SandboxProfile Kernel sandbox profile applied to this agent's tool calls. "workspace" = Landlock to workspace dir only. "workspace+net" = Landlock + network access. "host" = read-only host filesystem access. "off" = god-mode (requires --allow-god-mode at gateway boot).
	SandboxProfile *AgentSandboxProfile `json:"sandbox_profile,omitempty"`

	// ShellPolicy Per-agent shell command deny-pattern configuration.
	ShellPolicy *struct {
		// CustomDenyPatterns Additional Go regexp patterns to block in shell commands.
		CustomDenyPatterns *[]string `json:"custom_deny_patterns,omitempty"`

		// EnableDenyPatterns Enable pattern-based shell command blocking.
		EnableDenyPatterns *bool `json:"enable_deny_patterns,omitempty"`
	} `json:"shell_policy,omitempty"`

	// Soul Contents of SOUL.md — the agent's system prompt. Empty string for locked core agents (prompt is compiled in, not exposed via API). Empty string for draft agents (no SOUL.md written yet). Always present (never null).
	Soul string `json:"soul"`

	// Stats Aggregate runtime statistics for an agent. Absent on the Agent object when no sessions have been run.
	Stats *struct {
		// LastActive RFC3339 timestamp of the last turn completed by this agent.
		LastActive *time.Time `json:"last_active,omitempty"`

		// TotalCost Lifetime USD cost across all sessions.
		TotalCost float64 `json:"total_cost"`

		// TotalSessions Lifetime count of sessions created for this agent.
		TotalSessions int `json:"total_sessions"`

		// TotalTokens Lifetime token count across all sessions.
		TotalTokens int `json:"total_tokens"`
	} `json:"stats,omitempty"`

	// Status Current runtime status. "active" = agent is processing a turn. "idle" = ready and waiting. "draft" = SOUL.md is empty (no prompt written yet). "error" is a frontend-added possibility not emitted by the backend today.
	Status AgentStatus `json:"status"`

	// SteeringMode Tool execution steering strategy. "one-at-a-time" = approve each tool call individually. Other values are provider-specific. Defaults to "one-at-a-time".
	SteeringMode string `json:"steering_mode"`

	// TimeoutSeconds Maximum seconds a single agent turn may run before being interrupted. Inherited from agents.defaults.timeout_seconds when not overridden per-agent.
	TimeoutSeconds int `json:"timeout_seconds"`

	// ToolFeedback When true, tool results are echoed back to the LLM as user messages (tool feedback loop enabled).
	ToolFeedback bool `json:"tool_feedback"`

	// ToolsCfg Per-agent tool configuration governing which builtin tools are accessible and which MCP servers are bound (config.AgentToolsCfg on the Go side, AgentToolsCfg interface in src/lib/api.ts).
	ToolsCfg *struct {
		// Builtin Controls builtin tool visibility for this agent.
		Builtin *struct {
			// DefaultPolicy Fallback policy applied to any builtin tool not listed in policies. Custom agents are seeded with default_policy=allow and a system.*=deny entry to enforce the privilege rail.
			DefaultPolicy *AgentToolsCfgBuiltinDefaultPolicy `json:"default_policy,omitempty"`

			// Policies Per-tool policy overrides. Keys are tool names or glob patterns (e.g. "system.*", "workspace.shell"). Values are one of "allow", "ask", "deny".
			Policies *map[string]AgentToolsCfgBuiltinPolicies `json:"policies,omitempty"`
		} `json:"builtin,omitempty"`

		// Mcp MCP server bindings for this agent.
		Mcp *struct {
			// Servers List of MCP server bindings.
			Servers *[]struct {
				// Id MCP server identifier as registered in config.json.
				Id string `json:"id"`

				// Tools Specific tool names to expose from this server. When absent, all tools from the server are available.
				Tools *[]string `json:"tools,omitempty"`
			} `json:"servers,omitempty"`
		} `json:"mcp,omitempty"`
	} `json:"tools_cfg,omitempty"`

	// Type Agent classification. "core" = compiled-in identity locked agent. "custom" = user-defined agent. "system" = legacy operator-supplied entry (config.AgentTypeSystem survives in the API contract for backwards compatibility but SeedConfig does NOT create these — they only appear if config.json contains one).
	Type AgentType `json:"type"`

	// Warning Non-fatal advisory (e.g. config reload failed after create/update).
	Warning *string `json:"warning,omitempty"`
}

// AgentSandboxProfile Kernel sandbox profile applied to this agent's tool calls. "workspace" = Landlock to workspace dir only. "workspace+net" = Landlock + network access. "host" = read-only host filesystem access. "off" = god-mode (requires --allow-god-mode at gateway boot).
type AgentSandboxProfile string

// AgentStatus Current runtime status. "active" = agent is processing a turn. "idle" = ready and waiting. "draft" = SOUL.md is empty (no prompt written yet). "error" is a frontend-added possibility not emitted by the backend today.
type AgentStatus string

// AgentToolsCfgBuiltinDefaultPolicy Fallback policy applied to any builtin tool not listed in policies. Custom agents are seeded with default_policy=allow and a system.*=deny entry to enforce the privilege rail.
type AgentToolsCfgBuiltinDefaultPolicy string

// AgentToolsCfgBuiltinPolicies defines model for Agent.ToolsCfg.Builtin.Policies.
type AgentToolsCfgBuiltinPolicies string

// AgentType Agent classification. "core" = compiled-in identity locked agent. "custom" = user-defined agent. "system" = legacy operator-supplied entry (config.AgentTypeSystem survives in the API contract for backwards compatibility but SeedConfig does NOT create these — they only appear if config.json contains one).
type AgentType string

// AgentCreateRequest Body for POST /agents. Creates a new custom agent. A UUID is assigned by the server. The agent starts in "draft" status (no SOUL.md written yet).
type AgentCreateRequest struct {
	// Color Hex color code for the agent avatar.
	Color *string `json:"color,omitempty"`

	// Description Short description of the agent's purpose.
	Description *string `json:"description,omitempty"`

	// FallbackModels Ordered list of fallback model IDs tried when the primary model returns an error. Each entry may be a bare model name or "provider/model" format.
	FallbackModels *[]string `json:"fallback_models,omitempty"`

	// Icon Phosphor icon name for the agent avatar.
	Icon *string `json:"icon,omitempty"`

	// Model Model name for LLM calls. When omitted, the global agents.defaults.model_name is used.
	Model *string `json:"model,omitempty"`

	// ModelParams LLM sampling parameters applied to this agent's requests.
	ModelParams *struct {
		// MaxTokens Maximum tokens to generate per turn.
		MaxTokens *int `json:"max_tokens,omitempty"`

		// Temperature Sampling temperature (0.0 – 2.0). Lower = more deterministic.
		Temperature *float64 `json:"temperature,omitempty"`

		// TopP Nucleus sampling probability mass. 1.0 disables nucleus sampling.
		TopP *float64 `json:"top_p,omitempty"`
	} `json:"model_params,omitempty"`

	// Name Display name for the new agent.
	Name string `json:"name"`

	// RateLimits Per-agent rate-limit overrides. When use_global_defaults is true the global policy applies.
	RateLimits *struct {
		// MaxCostPerDay Maximum USD cost per day for this agent. Absent = no per-agent cap.
		MaxCostPerDay *float64 `json:"max_cost_per_day,omitempty"`

		// MaxLlmCallsPerHour Maximum LLM API calls per hour for this agent. Absent = no per-agent cap.
		MaxLlmCallsPerHour *int `json:"max_llm_calls_per_hour,omitempty"`

		// MaxToolCallsPerMinute Maximum tool calls per minute for this agent. Absent = no per-agent cap.
		MaxToolCallsPerMinute *int `json:"max_tool_calls_per_minute,omitempty"`

		// UseGlobalDefaults When true, global rate limits are used and per-agent overrides are ignored.
		UseGlobalDefaults *bool `json:"use_global_defaults,omitempty"`
	} `json:"rate_limits,omitempty"`

	// ToolsCfg Per-agent tool configuration governing which builtin tools are accessible and which MCP servers are bound (config.AgentToolsCfg on the Go side, AgentToolsCfg interface in src/lib/api.ts).
	ToolsCfg *struct {
		// Builtin Controls builtin tool visibility for this agent.
		Builtin *struct {
			// DefaultPolicy Fallback policy applied to any builtin tool not listed in policies. Custom agents are seeded with default_policy=allow and a system.*=deny entry to enforce the privilege rail.
			DefaultPolicy *AgentCreateRequestToolsCfgBuiltinDefaultPolicy `json:"default_policy,omitempty"`

			// Policies Per-tool policy overrides. Keys are tool names or glob patterns (e.g. "system.*", "workspace.shell"). Values are one of "allow", "ask", "deny".
			Policies *map[string]AgentCreateRequestToolsCfgBuiltinPolicies `json:"policies,omitempty"`
		} `json:"builtin,omitempty"`

		// Mcp MCP server bindings for this agent.
		Mcp *struct {
			// Servers List of MCP server bindings.
			Servers *[]struct {
				// Id MCP server identifier as registered in config.json.
				Id string `json:"id"`

				// Tools Specific tool names to expose from this server. When absent, all tools from the server are available.
				Tools *[]string `json:"tools,omitempty"`
			} `json:"servers,omitempty"`
		} `json:"mcp,omitempty"`
	} `json:"tools_cfg,omitempty"`
}

// AgentCreateRequestToolsCfgBuiltinDefaultPolicy Fallback policy applied to any builtin tool not listed in policies. Custom agents are seeded with default_policy=allow and a system.*=deny entry to enforce the privilege rail.
type AgentCreateRequestToolsCfgBuiltinDefaultPolicy string

// AgentCreateRequestToolsCfgBuiltinPolicies defines model for AgentCreateRequest.ToolsCfg.Builtin.Policies.
type AgentCreateRequestToolsCfgBuiltinPolicies string

// AgentModelParams LLM sampling parameters applied to an agent's requests. When absent, the provider defaults are used.
type AgentModelParams struct {
	// MaxTokens Maximum tokens to generate per turn.
	MaxTokens *int `json:"max_tokens,omitempty"`

	// Temperature Sampling temperature (0.0 – 2.0). Lower = more deterministic.
	Temperature *float64 `json:"temperature,omitempty"`

	// TopP Nucleus sampling probability mass. 1.0 disables nucleus sampling.
	TopP *float64 `json:"top_p,omitempty"`
}

// AgentOwnerUpdateResponse Response from PATCH /api/v1/agents/{id}/ownership. Confirms the ownership change.
type AgentOwnerUpdateResponse struct {
	// AgentId The agent whose ownership was changed.
	AgentId string `json:"agent_id"`

	// OwnerUsername The username of the new owner.
	OwnerUsername string `json:"owner_username"`

	// Success True when ownership was successfully updated.
	Success bool `json:"success"`
}

// AgentOwnershipUpdateRequest Request body for PATCH /api/v1/agents/{id}/ownership. Updates the owner_username field on a custom agent. Admin-only. System and core agents cannot have an owner assigned. Clearing the owner (empty string) requires the X-Confirm-Demote: 1 header.
type AgentOwnershipUpdateRequest struct {
	// OwnerUsername Username of the new owner. Empty string clears ownership (requires X-Confirm-Demote: 1 header to prevent accidents).
	OwnerUsername *string `json:"owner_username,omitempty"`
}

// AgentRateLimits Per-agent rate-limit overrides. When use_global_defaults is true the global policy applies and per-agent overrides are ignored.
type AgentRateLimits struct {
	// MaxCostPerDay Maximum USD cost per day for this agent. Absent = no per-agent cap.
	MaxCostPerDay *float64 `json:"max_cost_per_day,omitempty"`

	// MaxLlmCallsPerHour Maximum LLM API calls per hour for this agent. Absent = no per-agent cap.
	MaxLlmCallsPerHour *int `json:"max_llm_calls_per_hour,omitempty"`

	// MaxToolCallsPerMinute Maximum tool calls per minute for this agent. Absent = no per-agent cap.
	MaxToolCallsPerMinute *int `json:"max_tool_calls_per_minute,omitempty"`

	// UseGlobalDefaults When true, global rate limits are used and per-agent overrides are ignored.
	UseGlobalDefaults *bool `json:"use_global_defaults,omitempty"`
}

// AgentSession Minimal session summary as returned by GET /agents/{id}/sessions. Maps to the AgentSession interface in src/lib/api.ts. This is the same underlying session.UnifiedMeta object, but the SPA consumes it through the AgentSession interface which reads id, title, created_at, and updated_at directly.
type AgentSession struct {
	// CreatedAt RFC3339 creation timestamp.
	CreatedAt time.Time `json:"created_at"`

	// Id Session identifier.
	Id string `json:"id"`

	// Title Session title.
	Title string `json:"title"`

	// UpdatedAt RFC3339 last-update timestamp.
	UpdatedAt time.Time `json:"updated_at"`
}

// AgentShellPolicy Per-agent shell command deny-pattern configuration.
type AgentShellPolicy struct {
	// CustomDenyPatterns Additional Go regexp patterns to block in shell commands.
	CustomDenyPatterns *[]string `json:"custom_deny_patterns,omitempty"`

	// EnableDenyPatterns Enable pattern-based shell command blocking.
	EnableDenyPatterns *bool `json:"enable_deny_patterns,omitempty"`
}

// AgentStats Aggregate runtime statistics for an agent. Absent on the Agent object when no sessions have been run.
type AgentStats struct {
	// LastActive RFC3339 timestamp of the last turn completed by this agent.
	LastActive *time.Time `json:"last_active,omitempty"`

	// TotalCost Lifetime USD cost across all sessions.
	TotalCost float64 `json:"total_cost"`

	// TotalSessions Lifetime count of sessions created for this agent.
	TotalSessions int `json:"total_sessions"`

	// TotalTokens Lifetime token count across all sessions.
	TotalTokens int `json:"total_tokens"`
}

// AgentToolEntry Per-tool entry returned by GET /api/v1/agents/{id}/tools (FR-086, MAJ-008). Exposes both the configured policy and the effective (post-fence) policy so the SPA can display policy downgrades.
type AgentToolEntry struct {
	// ConfiguredPolicy The policy as written in the agent's config (before fence application).
	ConfiguredPolicy AgentToolEntryConfiguredPolicy `json:"configured_policy"`

	// EffectivePolicy The policy actually enforced at LLM-call time after fence and global policy overrides are applied.
	EffectivePolicy AgentToolEntryEffectivePolicy `json:"effective_policy"`

	// FenceApplied True when the tool requires admin approval (RequiresAdminAsk=true), the agent type is "custom", and the configured policy was "allow" but was downgraded to "ask" by the admin-ask fence (FR-061).
	FenceApplied bool `json:"fence_applied"`

	// Name Canonical tool name.
	Name string `json:"name"`

	// RequiresAdminAsk True when the tool's RequiresAdminAsk() returns true — the tool always needs an admin to approve its use.
	RequiresAdminAsk bool `json:"requires_admin_ask"`
}

// AgentToolEntryConfiguredPolicy The policy as written in the agent's config (before fence application).
type AgentToolEntryConfiguredPolicy string

// AgentToolEntryEffectivePolicy The policy actually enforced at LLM-call time after fence and global policy overrides are applied.
type AgentToolEntryEffectivePolicy string

// AgentToolsCfg Per-agent tool configuration governing which builtin tools are accessible and which MCP servers are bound (config.AgentToolsCfg on the Go side, AgentToolsCfg interface in src/lib/api.ts).
type AgentToolsCfg struct {
	// Builtin Controls builtin tool visibility for this agent.
	Builtin *struct {
		// DefaultPolicy Fallback policy applied to any builtin tool not listed in policies. Custom agents are seeded with default_policy=allow and a system.*=deny entry to enforce the privilege rail.
		DefaultPolicy *AgentToolsCfgBuiltinDefaultPolicy `json:"default_policy,omitempty"`

		// Policies Per-tool policy overrides. Keys are tool names or glob patterns (e.g. "system.*", "workspace.shell"). Values are one of "allow", "ask", "deny".
		Policies *map[string]AgentToolsCfgBuiltinPolicies `json:"policies,omitempty"`
	} `json:"builtin,omitempty"`

	// Mcp MCP server bindings for this agent.
	Mcp *struct {
		// Servers List of MCP server bindings.
		Servers *[]struct {
			// Id MCP server identifier as registered in config.json.
			Id string `json:"id"`

			// Tools Specific tool names to expose from this server. When absent, all tools from the server are available.
			Tools *[]string `json:"tools,omitempty"`
		} `json:"servers,omitempty"`
	} `json:"mcp,omitempty"`
}

// AgentToolsResponse Response from GET /api/v1/agents/{id}/tools and PUT /api/v1/agents/{id}/tools. Returns the agent's tool policy configuration plus the effective per-tool policy list.
type AgentToolsResponse struct {
	// AgentType Agent classification: "core", "system", or "custom". Informs the UI whether policy editing is allowed.
	AgentType *AgentToolsResponseAgentType `json:"agent_type,omitempty"`

	// Config Per-agent tool configuration governing which builtin tools are accessible and which MCP servers are bound (config.AgentToolsCfg on the Go side, AgentToolsCfg interface in src/lib/api.ts).
	Config struct {
		// Builtin Controls builtin tool visibility for this agent.
		Builtin *struct {
			// DefaultPolicy Fallback policy applied to any builtin tool not listed in policies. Custom agents are seeded with default_policy=allow and a system.*=deny entry to enforce the privilege rail.
			DefaultPolicy *AgentToolsResponseConfigBuiltinDefaultPolicy `json:"default_policy,omitempty"`

			// Policies Per-tool policy overrides. Keys are tool names or glob patterns (e.g. "system.*", "workspace.shell"). Values are one of "allow", "ask", "deny".
			Policies *map[string]AgentToolsResponseConfigBuiltinPolicies `json:"policies,omitempty"`
		} `json:"builtin,omitempty"`

		// Mcp MCP server bindings for this agent.
		Mcp *struct {
			// Servers List of MCP server bindings.
			Servers *[]struct {
				// Id MCP server identifier as registered in config.json.
				Id string `json:"id"`

				// Tools Specific tool names to expose from this server. When absent, all tools from the server are available.
				Tools *[]string `json:"tools,omitempty"`
			} `json:"servers,omitempty"`
		} `json:"mcp,omitempty"`
	} `json:"config"`

	// Tools Per-tool effective policy entries.
	Tools []struct {
		// ConfiguredPolicy The policy as written in the agent's config (before fence application).
		ConfiguredPolicy AgentToolsResponseToolsConfiguredPolicy `json:"configured_policy"`

		// EffectivePolicy The policy actually enforced at LLM-call time after fence and global policy overrides are applied.
		EffectivePolicy AgentToolsResponseToolsEffectivePolicy `json:"effective_policy"`

		// FenceApplied True when the tool requires admin approval (RequiresAdminAsk=true), the agent type is "custom", and the configured policy was "allow" but was downgraded to "ask" by the admin-ask fence (FR-061).
		FenceApplied bool `json:"fence_applied"`

		// Name Canonical tool name.
		Name string `json:"name"`

		// RequiresAdminAsk True when the tool's RequiresAdminAsk() returns true — the tool always needs an admin to approve its use.
		RequiresAdminAsk bool `json:"requires_admin_ask"`
	} `json:"tools"`
}

// AgentToolsResponseAgentType Agent classification: "core", "system", or "custom". Informs the UI whether policy editing is allowed.
type AgentToolsResponseAgentType string

// AgentToolsResponseConfigBuiltinDefaultPolicy Fallback policy applied to any builtin tool not listed in policies. Custom agents are seeded with default_policy=allow and a system.*=deny entry to enforce the privilege rail.
type AgentToolsResponseConfigBuiltinDefaultPolicy string

// AgentToolsResponseConfigBuiltinPolicies defines model for AgentToolsResponse.Config.Builtin.Policies.
type AgentToolsResponseConfigBuiltinPolicies string

// AgentToolsResponseToolsConfiguredPolicy The policy as written in the agent's config (before fence application).
type AgentToolsResponseToolsConfiguredPolicy string

// AgentToolsResponseToolsEffectivePolicy The policy actually enforced at LLM-call time after fence and global policy overrides are applied.
type AgentToolsResponseToolsEffectivePolicy string

// AgentToolsUpdateRequest Request body for PUT /api/v1/agents/{id}/tools. Replaces the agent's tool policy configuration. Supports both the current policy format (builtin.default_policy + builtin.policies) and the legacy explicit/inherit mode format (builtin.mode + builtin.visible) for backward compatibility. Legacy fields are converted to policy format server-side before persisting.
type AgentToolsUpdateRequest struct {
	// Builtin Builtin tool policy configuration for this agent.
	Builtin *struct {
		// DefaultPolicy Fallback policy applied to any builtin tool not listed in policies. Defaults to "allow" when omitted.
		DefaultPolicy *AgentToolsUpdateRequestBuiltinDefaultPolicy `json:"default_policy,omitempty"`

		// Mode Legacy format: "explicit" builds a deny-all policy with allow entries for each name in visible[]. "inherit" sets default_policy=allow. Ignored when default_policy is present.
		Mode *AgentToolsUpdateRequestBuiltinMode `json:"mode,omitempty"`

		// Policies Per-tool policy overrides. Keys are canonical tool names or glob patterns (e.g. "system.*"). Values are "allow", "ask", or "deny".
		Policies *map[string]AgentToolsUpdateRequestBuiltinPolicies `json:"policies,omitempty"`

		// Visible Legacy format: tool names to allow when mode="explicit". Ignored when default_policy is present.
		Visible *[]string `json:"visible,omitempty"`
	} `json:"builtin,omitempty"`

	// Mcp MCP server bindings for this agent.
	Mcp *struct {
		// Servers List of MCP server bindings.
		Servers *[]struct {
			// Id MCP server identifier as registered in config.json.
			Id string `json:"id"`

			// Tools Specific tool names to expose from this server. When absent, all tools from the server are available.
			Tools *[]string `json:"tools,omitempty"`
		} `json:"servers,omitempty"`
	} `json:"mcp,omitempty"`
}

// AgentToolsUpdateRequestBuiltinDefaultPolicy Fallback policy applied to any builtin tool not listed in policies. Defaults to "allow" when omitted.
type AgentToolsUpdateRequestBuiltinDefaultPolicy string

// AgentToolsUpdateRequestBuiltinMode Legacy format: "explicit" builds a deny-all policy with allow entries for each name in visible[]. "inherit" sets default_policy=allow. Ignored when default_policy is present.
type AgentToolsUpdateRequestBuiltinMode string

// AgentToolsUpdateRequestBuiltinPolicies defines model for AgentToolsUpdateRequest.Builtin.Policies.
type AgentToolsUpdateRequestBuiltinPolicies string

// AgentUpdateRequest Body for PUT /agents/{id}. All fields are optional — only provided fields are updated. Locked (core) agents reject mutations to name, description, soul, heartbeat, instructions. model, timeout_seconds, max_tool_iterations, steering_mode, tool_feedback, heartbeat_enabled, and heartbeat_interval may be updated on locked agents. At least one field must be present (minProperties: 1) — empty patches are rejected 400.
type AgentUpdateRequest struct {
	// Color Hex color code for agent avatar display (e.g. "#D4AF37").
	Color *string `json:"color,omitempty"`

	// Default Whether this agent is the global default that handles inbound messages with no more-specific routing rule. At most one agent is default. Omitting this field leaves the flag unchanged.
	Default *bool `json:"default,omitempty"`

	// Description New description. Rejected on locked agents. Empty string removes it.
	Description *string `json:"description,omitempty"`

	// FallbackModels Ordered list of fallback model IDs tried when the primary model returns an error. Each entry may be a bare model name or "provider/model" format.
	FallbackModels *[]string `json:"fallback_models,omitempty"`

	// Heartbeat New HEARTBEAT.md content. Rejected on locked agents. Writing this triggers a config reload.
	Heartbeat *string `json:"heartbeat,omitempty"`

	// HeartbeatEnabled Enable/disable heartbeat loop. Allowed on all agents.
	HeartbeatEnabled *bool `json:"heartbeat_enabled,omitempty"`

	// HeartbeatInterval New heartbeat interval in seconds. Allowed on all agents.
	HeartbeatInterval *int `json:"heartbeat_interval,omitempty"`

	// Icon Phosphor icon name for agent avatar (e.g. "Robot", "Octopus").
	Icon *string `json:"icon,omitempty"`

	// Instructions New AGENT.md body (after frontmatter). Rejected on locked agents. Writing this triggers a config reload.
	Instructions *string `json:"instructions,omitempty"`

	// MaxToolIterations New maximum tool calls per turn. Allowed on all agents.
	MaxToolIterations *int `json:"max_tool_iterations,omitempty"`

	// Model New model name. Allowed on all agents.
	Model *string `json:"model,omitempty"`

	// ModelParams LLM sampling parameters applied to this agent's requests.
	ModelParams *struct {
		// MaxTokens Maximum tokens to generate per turn.
		MaxTokens *int `json:"max_tokens,omitempty"`

		// Temperature Sampling temperature (0.0 – 2.0). Lower = more deterministic.
		Temperature *float64 `json:"temperature,omitempty"`

		// TopP Nucleus sampling probability mass. 1.0 disables nucleus sampling.
		TopP *float64 `json:"top_p,omitempty"`
	} `json:"model_params,omitempty"`

	// Name New display name. Rejected on locked agents.
	Name *string `json:"name,omitempty"`

	// RateLimits Per-agent rate-limit overrides. When use_global_defaults is true the global policy applies.
	RateLimits *struct {
		// MaxCostPerDay Maximum USD cost per day for this agent. Absent = no per-agent cap.
		MaxCostPerDay *float64 `json:"max_cost_per_day,omitempty"`

		// MaxLlmCallsPerHour Maximum LLM API calls per hour for this agent. Absent = no per-agent cap.
		MaxLlmCallsPerHour *int `json:"max_llm_calls_per_hour,omitempty"`

		// MaxToolCallsPerMinute Maximum tool calls per minute for this agent. Absent = no per-agent cap.
		MaxToolCallsPerMinute *int `json:"max_tool_calls_per_minute,omitempty"`

		// UseGlobalDefaults When true, global rate limits are used and per-agent overrides are ignored.
		UseGlobalDefaults *bool `json:"use_global_defaults,omitempty"`
	} `json:"rate_limits,omitempty"`

	// SandboxProfile New sandbox profile. "off" requires --allow-god-mode at gateway boot (403 otherwise).
	SandboxProfile *AgentUpdateRequestSandboxProfile `json:"sandbox_profile,omitempty"`

	// ShellPolicy Per-agent shell command deny-pattern configuration.
	ShellPolicy *struct {
		// CustomDenyPatterns Must each be valid Go regexp patterns (400 on invalid regexp).
		CustomDenyPatterns *[]string `json:"custom_deny_patterns,omitempty"`
		EnableDenyPatterns *bool     `json:"enable_deny_patterns,omitempty"`
	} `json:"shell_policy,omitempty"`

	// Soul New SOUL.md content (agent system prompt). Rejected on locked agents. Writing this triggers a config reload.
	Soul *string `json:"soul,omitempty"`

	// SteeringMode New steering mode. Allowed on all agents.
	SteeringMode *string `json:"steering_mode,omitempty"`

	// TimeoutSeconds New timeout in seconds per turn. Allowed on all agents.
	TimeoutSeconds *int `json:"timeout_seconds,omitempty"`

	// ToolFeedback Enable/disable tool feedback loop. Allowed on all agents.
	ToolFeedback *bool `json:"tool_feedback,omitempty"`

	// ToolsCfg Per-agent tool configuration governing which builtin tools are accessible and which MCP servers are bound (config.AgentToolsCfg on the Go side, AgentToolsCfg interface in src/lib/api.ts).
	ToolsCfg *struct {
		// Builtin Controls builtin tool visibility for this agent.
		Builtin *struct {
			// DefaultPolicy Fallback policy applied to any builtin tool not listed in policies. Custom agents are seeded with default_policy=allow and a system.*=deny entry to enforce the privilege rail.
			DefaultPolicy *AgentUpdateRequestToolsCfgBuiltinDefaultPolicy `json:"default_policy,omitempty"`

			// Policies Per-tool policy overrides. Keys are tool names or glob patterns (e.g. "system.*", "workspace.shell"). Values are one of "allow", "ask", "deny".
			Policies *map[string]AgentUpdateRequestToolsCfgBuiltinPolicies `json:"policies,omitempty"`
		} `json:"builtin,omitempty"`

		// Mcp MCP server bindings for this agent.
		Mcp *struct {
			// Servers List of MCP server bindings.
			Servers *[]struct {
				// Id MCP server identifier as registered in config.json.
				Id string `json:"id"`

				// Tools Specific tool names to expose from this server. When absent, all tools from the server are available.
				Tools *[]string `json:"tools,omitempty"`
			} `json:"servers,omitempty"`
		} `json:"mcp,omitempty"`
	} `json:"tools_cfg,omitempty"`
}

// AgentUpdateRequestSandboxProfile New sandbox profile. "off" requires --allow-god-mode at gateway boot (403 otherwise).
type AgentUpdateRequestSandboxProfile string

// AgentUpdateRequestToolsCfgBuiltinDefaultPolicy Fallback policy applied to any builtin tool not listed in policies. Custom agents are seeded with default_policy=allow and a system.*=deny entry to enforce the privilege rail.
type AgentUpdateRequestToolsCfgBuiltinDefaultPolicy string

// AgentUpdateRequestToolsCfgBuiltinPolicies defines model for AgentUpdateRequest.ToolsCfg.Builtin.Policies.
type AgentUpdateRequestToolsCfgBuiltinPolicies string

// AppState Application state returned by GET /api/v1/state. Reflects whether onboarding has been completed and optional diagnostic metadata.
type AppState struct {
	// DevModeBypass True when gateway.dev_mode_bypass is enabled. Read-only — cannot be set via this endpoint. The SPA uses this to hide controls that are inoperative when bypass is active.
	DevModeBypass *bool `json:"dev_mode_bypass,omitempty"`

	// GodModeAvailable True when the sandbox mode is "off" (no kernel enforcement). Indicates the gateway is running without sandbox protection.
	GodModeAvailable *bool `json:"god_mode_available,omitempty"`

	// GodModeOptedIn True when the operator has explicitly opted into god mode (sandbox=off). Distinct from god_mode_available to allow UI differentiation.
	GodModeOptedIn *bool `json:"god_mode_opted_in,omitempty"`

	// LastDoctorRun RFC3339 timestamp of the last health-check run. Absent if never run.
	LastDoctorRun *time.Time `json:"last_doctor_run,omitempty"`

	// LastDoctorScore Score from the last health-check run (0–100, integer). Absent if never run.
	LastDoctorScore *int `json:"last_doctor_score,omitempty"`

	// OnboardingComplete Whether the first-run onboarding wizard has been completed.
	OnboardingComplete bool `json:"onboarding_complete"`
}

// AppStatePatchRequest Request body for PATCH /api/v1/state. Partial update to application state. Currently only supports marking onboarding as complete (onboarding_complete must be true — setting it to false is rejected 400).
type AppStatePatchRequest struct {
	// OnboardingComplete Mark onboarding as complete. Must be true — false is rejected with 400.
	OnboardingComplete *bool `json:"onboarding_complete,omitempty"`
}

// Attachment File attachment associated with a transcript entry.
type Attachment struct {
	// MimeType MIME type of the attachment.
	MimeType string `json:"mime_type"`

	// Path Relative path within the session workspace.
	Path string `json:"path"`

	// Size File size in bytes.
	Size int64 `json:"size"`

	// Type Attachment category. Aligned with MediaPart.type enum.
	Type AttachmentType `json:"type"`
}

// AttachmentType Attachment category. Aligned with MediaPart.type enum.
type AttachmentType string

// AuditEntry A single audit log record from the JSONL audit log file (~/.omnipus/system/audit.jsonl). Matches the Go pkg/audit.Entry struct.
type AuditEntry struct {
	// AgentId ID of the agent that triggered the event. May be absent.
	AgentId *string `json:"agent_id,omitempty"`

	// Command Command string when the event is an exec event. May be absent.
	Command *string `json:"command,omitempty"`

	// Decision Outcome of the event evaluation. One of: allow, deny, error. May be absent for informational events.
	Decision *AuditEntryDecision `json:"decision,omitempty"`

	// Details Event-specific metadata. Structure varies by event type.
	Details *map[string]interface{} `json:"details,omitempty"`

	// Event Event type identifier. Well-known values: tool_call, exec, file_op, llm_call, policy_eval, rate_limit, ssrf, startup, shutdown. Custom values are permitted for extensibility — must match ^[a-z_]+$ (lowercase letters and underscores only).
	Event string `json:"event"`

	// Parameters Tool call parameters or other event-specific key-value pairs.
	Parameters *map[string]interface{} `json:"parameters,omitempty"`

	// PolicyRule Policy rule that produced this decision. May be absent.
	PolicyRule *string `json:"policy_rule,omitempty"`

	// SessionId Session ID associated with the event. May be absent.
	SessionId *string `json:"session_id,omitempty"`

	// Timestamp ISO 8601 UTC timestamp of when the event was recorded.
	Timestamp time.Time `json:"timestamp"`

	// Tool Tool name when the event is a tool call. May be absent.
	Tool *string `json:"tool,omitempty"`
}

// AuditEntryDecision Outcome of the event evaluation. One of: allow, deny, error. May be absent for informational events.
type AuditEntryDecision string

// AuditLogToggle Audit log enable/disable state returned by GET /api/v1/security/audit-log. Note: this endpoint controls whether audit logging is enabled at all. GET /api/v1/audit-log (distinct path) returns the actual audit entries.
type AuditLogToggle struct {
	// Enabled Whether audit logging is currently enabled.
	Enabled bool `json:"enabled"`
}

// AuditLogToggleRequest Request body for PUT /api/v1/security/audit-log. Enables or disables audit logging.
type AuditLogToggleRequest struct {
	// Enabled Whether audit logging should be enabled.
	Enabled bool `json:"enabled"`
}

// AuditLogUpdateResponse Response from PUT /api/v1/security/audit-log. Returns save status and the previously active state (restart required to apply).
type AuditLogUpdateResponse struct {
	// AppliedEnabled The audit log enabled state currently active (before restart takes effect). This is the old value — the new value will take effect after restart.
	AppliedEnabled bool `json:"applied_enabled"`

	// RequiresRestart Always true — changing the audit log enabled state requires a restart to swap file handles.
	RequiresRestart bool `json:"requires_restart"`

	// Saved True when the configuration was successfully persisted to disk.
	Saved bool `json:"saved"`
}

// BackupCreateResponse Response from POST /api/v1/backup. Returns the path, size, and creation time of the new backup archive.
type BackupCreateResponse struct {
	// CreatedAt RFC3339 timestamp when the backup was created.
	CreatedAt time.Time `json:"created_at"`

	// Path Absolute path to the backup file.
	Path string `json:"path"`

	// SizeBytes Size of the backup file in bytes.
	SizeBytes int64 `json:"size_bytes"`
}

// BackupEntry A single backup archive entry returned by GET /api/v1/backups.
type BackupEntry struct {
	// CreatedAt RFC3339 timestamp when the backup was created.
	CreatedAt time.Time `json:"created_at"`

	// Filename Backup archive filename (e.g. "omnipus-backup-2026-05-16.tar.gz").
	Filename string `json:"filename"`

	// SizeBytes Archive size in bytes.
	SizeBytes int64 `json:"size_bytes"`
}

// BearerToken Canonical opaque bearer token format used by Omnipus. The prefix "omnipus_" (8 characters) followed by 64 lowercase hex characters (32 random bytes), giving a total length of 72 characters. Used in Authorization headers, WS AuthFrame, and rotate-token responses.
type BearerToken = string

// ChangePasswordRequest Body for POST /auth/change-password. Changes the authenticated user's own password.
type ChangePasswordRequest struct {
	// CurrentPassword The user's current password for verification. Maximum 72 characters (bcrypt limit).
	CurrentPassword string `json:"current_password"`

	// NewPassword The new password. Minimum 8 characters, maximum 72 (bcrypt limit).
	NewPassword string `json:"new_password"`
}

// ChannelConfigureRequest Request body for PUT /api/v1/channels/{id}/configure. Merges the supplied fields into the channel's config section. The "enabled" field is reserved and silently removed — use the separate enable/disable endpoints instead. Field names and value types are channel-specific; unknown fields are stored as-is and passed through to the channel implementation.
type ChannelConfigureRequest struct {
	// AppId Application ID (used by Slack, Discord).
	AppId *string `json:"app_id,omitempty"`

	// AppSecret Application secret / signing secret.
	AppSecret *string `json:"app_secret,omitempty"`

	// BotToken Alias for token used by some channels.
	BotToken *string `json:"bot_token,omitempty"`

	// Token Channel authentication token (e.g. Telegram bot token, Discord bot token).
	Token *string `json:"token,omitempty"`

	// WebhookSecret HMAC secret for verifying incoming webhook payloads.
	WebhookSecret        *string                `json:"webhook_secret,omitempty"`
	AdditionalProperties map[string]interface{} `json:"-"`
}

// ChannelEnabledResponse Response from PUT /api/v1/channels/{id}/enable and PUT /api/v1/channels/{id}/disable. Returns the channel ID and its new enabled state.
type ChannelEnabledResponse struct {
	// Enabled Whether the channel is now enabled.
	Enabled bool `json:"enabled"`

	// Id Stable identifier for a built-in channel.
	Id ChannelEnabledResponseId `json:"id"`
}

// ChannelEnabledResponseId Stable identifier for a built-in channel.
type ChannelEnabledResponseId string

// ChannelEntry A communication channel entry returned by GET /api/v1/channels.
type ChannelEntry struct {
	// Description Short description of the channel.
	Description string `json:"description"`

	// Enabled Whether this channel is currently enabled.
	Enabled bool `json:"enabled"`

	// Id Stable identifier for a built-in channel.
	Id ChannelEntryId `json:"id"`

	// Name Human-readable channel name.
	Name string `json:"name"`

	// Transport Transport mechanism used by this channel.
	Transport ChannelEntryTransport `json:"transport"`
}

// ChannelEntryId Stable identifier for a built-in channel.
type ChannelEntryId string

// ChannelEntryTransport Transport mechanism used by this channel.
type ChannelEntryTransport string

// ChannelId Stable identifier for a built-in channel.
type ChannelId string

// ChannelRouting Routing configuration for a single communication channel. Controls which agent handles inbound messages arriving on this channel.
type ChannelRouting struct {
	// DefaultAgentId ID of the agent that handles this channel's inbound messages. Omitted or empty means fall back to the global default agent.
	DefaultAgentId *string `json:"default_agent_id,omitempty"`
}

// ChannelTestResponse Response from POST /api/v1/channels/{id}/test. Returns whether required credentials are configured.
type ChannelTestResponse struct {
	// Message Human-readable description of the test result.
	Message string `json:"message"`

	// Success True when all required credential fields are present.
	Success bool `json:"success"`
}

// CredentialSetRequest Request body for POST /api/v1/credentials. Stores an encrypted credential. The key must be non-empty; the value is stored AES-256-GCM encrypted.
type CredentialSetRequest struct {
	// Key Credential key name.
	Key string `json:"key"`

	// Value Credential value (stored encrypted).
	Value string `json:"value"`
}

// DevicePaired A device that has been successfully paired. Returned as part of the DevicesResponse from GET /api/v1/devices.
type DevicePaired struct {
	// DeviceId Unique device identifier.
	DeviceId string `json:"device_id"`

	// DeviceName Human-readable device name.
	DeviceName string `json:"device_name"`

	// Fingerprint Cryptographic fingerprint of the device's public key.
	Fingerprint string `json:"fingerprint"`

	// LastSeenAt RFC3339 timestamp of the last authenticated request from this device.
	LastSeenAt time.Time `json:"last_seen_at"`

	// PairedAt RFC3339 timestamp when the device was paired.
	PairedAt time.Time `json:"paired_at"`

	// Status Whether this device's access is currently active or revoked.
	Status DevicePairedStatus `json:"status"`
}

// DevicePairedStatus Whether this device's access is currently active or revoked.
type DevicePairedStatus string

// DevicePending A device pairing request that has not yet been approved. Returned as part of the DevicesResponse from GET /api/v1/devices.
type DevicePending struct {
	// CreatedAt RFC3339 timestamp when the pairing request was created.
	CreatedAt time.Time `json:"created_at"`

	// DeviceId Unique device identifier.
	DeviceId string `json:"device_id"`

	// DeviceName Human-readable device name provided during pairing.
	DeviceName string `json:"device_name"`

	// ExpiresAt RFC3339 timestamp when the pairing request expires.
	ExpiresAt time.Time `json:"expires_at"`

	// Fingerprint Cryptographic fingerprint of the device's public key.
	Fingerprint string `json:"fingerprint"`

	// PairingCode Short human-readable pairing code displayed to the user.
	PairingCode string `json:"pairing_code"`
}

// DevicesResponse Response from GET /api/v1/devices. Lists both pending pairing requests and already-paired devices.
type DevicesResponse struct {
	// Paired Devices that have been successfully paired. Capped at 100.
	Paired []struct {
		// DeviceId Unique device identifier.
		DeviceId string `json:"device_id"`

		// DeviceName Human-readable device name.
		DeviceName string `json:"device_name"`

		// Fingerprint Cryptographic fingerprint of the device's public key.
		Fingerprint string `json:"fingerprint"`

		// LastSeenAt RFC3339 timestamp of the last authenticated request from this device.
		LastSeenAt time.Time `json:"last_seen_at"`

		// PairedAt RFC3339 timestamp when the device was paired.
		PairedAt time.Time `json:"paired_at"`

		// Status Whether this device's access is currently active or revoked.
		Status DevicesResponsePairedStatus `json:"status"`
	} `json:"paired"`

	// Pending Pairing requests awaiting approval. Capped at 100.
	Pending []struct {
		// CreatedAt RFC3339 timestamp when the pairing request was created.
		CreatedAt time.Time `json:"created_at"`

		// DeviceId Unique device identifier.
		DeviceId string `json:"device_id"`

		// DeviceName Human-readable device name provided during pairing.
		DeviceName string `json:"device_name"`

		// ExpiresAt RFC3339 timestamp when the pairing request expires.
		ExpiresAt time.Time `json:"expires_at"`

		// Fingerprint Cryptographic fingerprint of the device's public key.
		Fingerprint string `json:"fingerprint"`

		// PairingCode Short human-readable pairing code displayed to the user.
		PairingCode string `json:"pairing_code"`
	} `json:"pending"`
}

// DevicesResponsePairedStatus Whether this device's access is currently active or revoked.
type DevicesResponsePairedStatus string

// DoctorIssue A single health-check finding returned as part of a DoctorResult. Each issue has a severity, a human-readable title and description, and an optional actionable link.
type DoctorIssue struct {
	// ActionLabel Display label for the action link.
	ActionLabel *string `json:"action_label,omitempty"`

	// ActionLink Optional URL or SPA route to navigate to for remediation.
	ActionLink *string `json:"action_link,omitempty"`

	// Description Full description of the issue and its impact.
	Description string `json:"description"`

	// Id Unique identifier for this issue type.
	Id string `json:"id"`

	// Recommendation Recommended remediation action.
	Recommendation string `json:"recommendation"`

	// Severity Issue severity level.
	Severity DoctorIssueSeverity `json:"severity"`

	// Title Short human-readable title for the issue.
	Title string `json:"title"`
}

// DoctorIssueSeverity Issue severity level.
type DoctorIssueSeverity string

// DoctorResult Health-check result returned by GET /api/v1/doctor and POST /api/v1/doctor. Contains an overall score and a list of individual findings.
type DoctorResult struct {
	// CheckedAt RFC3339 timestamp when this health check was run.
	CheckedAt time.Time `json:"checked_at"`

	// Issues List of health-check findings. Empty when score is 100. Capped at 100 to bound response size.
	Issues []struct {
		// ActionLabel Display label for the action link.
		ActionLabel *string `json:"action_label,omitempty"`

		// ActionLink Optional URL or SPA route to navigate to for remediation.
		ActionLink *string `json:"action_link,omitempty"`

		// Description Full description of the issue and its impact.
		Description string `json:"description"`

		// Id Unique identifier for this issue type.
		Id string `json:"id"`

		// Recommendation Recommended remediation action.
		Recommendation string `json:"recommendation"`

		// Severity Issue severity level.
		Severity DoctorResultIssuesSeverity `json:"severity"`

		// Title Short human-readable title for the issue.
		Title string `json:"title"`
	} `json:"issues"`

	// Score Overall health score (0 = critical issues; 100 = fully healthy).
	Score int `json:"score"`
}

// DoctorResultIssuesSeverity Issue severity level.
type DoctorResultIssuesSeverity string

// ErrorResponse Standard error envelope returned by all non-2xx responses.
type ErrorResponse struct {
	// Code Machine-readable error code for programmatic branching (e.g. "csrf_missing", "rate_limited").
	Code *string `json:"code,omitempty"`

	// Details Optional structured details about the error.
	Details *map[string]interface{} `json:"details,omitempty"`

	// Error Human-readable error message.
	Error string `json:"error"`
}

// ExecAllowlist Exec binary allowlist configuration for GET/PUT /api/v1/security/exec-allowlist (SEC-05).
type ExecAllowlist struct {
	// AllowedBinaries Ordered list of allowed binary name patterns evaluated on every exec call. Patterns are trimmed, deduplicated, and validated server-side. Empty array = block all exec calls.
	AllowedBinaries []string `json:"allowed_binaries"`

	// Approval Approval mode for exec calls. Reflects config.tools.exec.approval. Only present in GET responses.
	Approval *string `json:"approval,omitempty"`

	// RestartRequired True in PUT responses — the in-memory agent loop uses the previous allowlist until the gateway restarts (SEC-12).
	RestartRequired *bool `json:"restart_required,omitempty"`
}

// ExecProxyStatus Runtime state of the exec SSRF proxy returned by GET /api/v1/security/exec-proxy-status (SEC-28).
type ExecProxyStatus struct {
	// Address Bound address in "host:port" format. Present only when running is true. Backend handler enforces this invariant; OpenAPI 3.0.3 cannot express conditional required fields.
	Address *string `json:"address,omitempty"`

	// Enabled Whether the exec proxy is configured to run (cfg.Tools.Exec.EnableProxy).
	Enabled bool `json:"enabled"`

	// Running Whether the proxy listener is currently bound and running.
	Running bool `json:"running"`
}

// GatewayStatus Gateway runtime status as returned by GET /status (polled by the frontend StatusBar every 15 seconds). Summarises the number of configured agents and channels plus a daily cost accumulator.
type GatewayStatus struct {
	// AgentCount Total number of configured agents (core + custom), including the implicit system agent.
	AgentCount int `json:"agent_count"`

	// ChannelCount Number of enabled channels including the always-available webchat channel.
	ChannelCount int `json:"channel_count"`

	// DailyCost Aggregate USD cost accrued today across all agents. Zero when cost tracking is disabled.
	DailyCost float64 `json:"daily_cost"`

	// Online Always true when the gateway is reachable and the agent loop is running.
	Online bool `json:"online"`

	// Version Gateway binary version string (e.g. "0.1.0" or the git short-sha for dev builds).
	Version *string `json:"version,omitempty"`
}

// GlobalToolPolicies Global tool policy configuration returned by GET /api/v1/security/tool-policies and accepted by PUT /api/v1/security/tool-policies.
type GlobalToolPolicies struct {
	// DefaultPolicy Default policy for any tool not listed in policies.
	DefaultPolicy GlobalToolPoliciesDefaultPolicy `json:"default_policy"`

	// Policies Per-tool policy overrides. Keys are canonical tool names; values are the policy to apply. Never null — empty object when no overrides are configured.
	Policies map[string]GlobalToolPoliciesPolicies `json:"policies"`
}

// GlobalToolPoliciesDefaultPolicy Default policy for any tool not listed in policies.
type GlobalToolPoliciesDefaultPolicy string

// GlobalToolPoliciesPolicies defines model for GlobalToolPolicies.Policies.
type GlobalToolPoliciesPolicies string

// HealthResponse Response from GET /health. Returns HTTP 200 when the gateway is up. No authentication required.
type HealthResponse struct {
	// Status Always "ok" when the gateway is healthy.
	Status HealthResponseStatus `json:"status"`
}

// HealthResponseStatus Always "ok" when the gateway is healthy.
type HealthResponseStatus string

// LoginRequest Credentials for authenticating an existing user.
type LoginRequest struct {
	// Password The user's password. Maximum 72 characters (bcrypt limit).
	Password string `json:"password"`

	// Username The user's login name.
	Username string `json:"username"`
}

// LoginResponse Returned on successful login, register-admin, or onboarding/complete. Contains the bearer token to use in subsequent Authorization headers, the role of the authenticated user, and the username.
type LoginResponse struct {
	// Role RBAC role of the authenticated user.
	Role LoginResponseRole `json:"role"`

	// Token Canonical opaque bearer token format used by Omnipus. The prefix "omnipus_" (8 characters) followed by 64 lowercase hex characters (32 random bytes), giving a total length of 72 characters. Used in Authorization headers, WS AuthFrame, and rotate-token responses.
	Token string `json:"token"`

	// Username The authenticated user's login name.
	Username string `json:"username"`

	// Warning Non-fatal advisory message. Present on onboarding/complete when the credential store is locked and the API key was stored in plaintext.
	Warning *string `json:"warning,omitempty"`
}

// LoginResponseRole RBAC role of the authenticated user.
type LoginResponseRole string

// McpServer An MCP server entry as returned by GET /mcp-servers and POST /mcp-servers.
type McpServer struct {
	// Id Unique MCP server identifier.
	Id string `json:"id"`

	// Name Human-readable server name.
	Name string `json:"name"`

	// Status Current connection status of the MCP server.
	Status McpServerStatus `json:"status"`

	// ToolCount Number of tools exposed by this server.
	ToolCount int `json:"tool_count"`

	// Tools List of tool names exposed by this server. Absent when tool_count is 0 or when the server has not yet enumerated its tools.
	Tools *[]string `json:"tools,omitempty"`

	// Transport Transport mechanism used by this MCP server. "stdio" for local process-based servers, "sse" or "http" for remote HTTP-based servers.
	Transport McpServerTransport `json:"transport"`
}

// McpServerStatus Current connection status of the MCP server.
type McpServerStatus string

// McpServerTransport Transport mechanism used by this MCP server. "stdio" for local process-based servers, "sse" or "http" for remote HTTP-based servers.
type McpServerTransport string

// McpServerCreate Request body for POST /mcp-servers. Adds a new MCP server to the gateway config.
type McpServerCreate struct {
	// Args Command-line arguments to pass to the server process.
	Args *[]string `json:"args,omitempty"`

	// Command Command to start the MCP server process (stdio transport).
	Command string `json:"command"`

	// Env Environment variable overrides passed to the MCP server process. Only applicable for stdio transport. Each key-value pair is injected into the server process environment at startup.
	Env *map[string]string `json:"env,omitempty"`

	// Name Human-readable server name.
	Name string `json:"name"`

	// Transport Transport mechanism to use for this MCP server. Use "stdio" for local process-based servers, "sse" or "http" for remote HTTP-based servers (both are handled identically by the gateway).
	Transport McpServerCreateTransport `json:"transport"`
}

// McpServerCreateTransport Transport mechanism to use for this MCP server. Use "stdio" for local process-based servers, "sse" or "http" for remote HTTP-based servers (both are handled identically by the gateway).
type McpServerCreateTransport string

// McpServerToolsResponse Response from GET /mcp-servers/{id}/tools. Returns the list of tool names exposed by a specific MCP server.
type McpServerToolsResponse struct {
	// Tools List of tool names exposed by the MCP server.
	Tools []string `json:"tools"`
}

// McpToolCallRequest Request body for POST /api/v1/tools/mcp. Invokes a tool on a specific MCP server by name, passing optional arguments.
type McpToolCallRequest struct {
	// Arguments Key-value arguments to pass to the tool. Shape is tool-specific.
	Arguments *map[string]interface{} `json:"arguments,omitempty"`

	// ServerId The MCP server ID to invoke the tool on.
	ServerId string `json:"server_id"`

	// ToolName The name of the tool to call on the MCP server.
	ToolName string `json:"tool_name"`
}

// McpToolCallResponse Response from POST /api/v1/tools/mcp. Contains the result returned by the MCP server tool.
type McpToolCallResponse struct {
	// Error Error message if the tool call failed on the MCP server side. Only present when the call returned an error result.
	Error *string `json:"error,omitempty"`

	// Result The tool's return value. Shape is tool-specific; may be any JSON type.
	Result interface{} `json:"result"`
}

// McpToolsListResponse Response from GET /api/v1/tools/mcp. Returns all configured MCP servers with their status for the agent tool picker UI.
type McpToolsListResponse = []McpToolsListResponse_Item

// McpToolsListResponse_Item defines model for McpToolsListResponse.Item.
type McpToolsListResponse_Item struct {
	// Args Arguments passed to the MCP server command.
	Args *[]string `json:"args,omitempty"`

	// Command The command used to start the MCP server.
	Command *string `json:"command,omitempty"`

	// Enabled Whether the MCP server is currently enabled.
	Enabled bool `json:"enabled"`

	// Id Unique MCP server identifier (same as the config key name).
	Id string `json:"id"`

	// Name Display name for the MCP server.
	Name                 string                 `json:"name"`
	AdditionalProperties map[string]interface{} `json:"-"`
}

// MeInfo Response from GET /api/v1/me. Returns the authenticated user's role, used for RBAC gating in the SPA.
type MeInfo struct {
	// Role RBAC role of the current authenticated user.
	Role MeInfoRole `json:"role"`
}

// MeInfoRole RBAC role of the current authenticated user.
type MeInfoRole string

// Message A single transcript entry (session.TranscriptEntry on the Go side). Maps to the Message interface in src/lib/api.ts. The SPA reads this from GET /sessions/{id}/messages.
type Message struct {
	// AgentId ID of the agent that produced this entry (FR-002). Always present.
	AgentId string `json:"agent_id"`

	// Attachments File attachments associated with this message.
	Attachments *[]struct {
		// MimeType MIME type of the attachment.
		MimeType string `json:"mime_type"`

		// Path Relative path within the session workspace.
		Path string `json:"path"`

		// Size File size in bytes.
		Size int64 `json:"size"`

		// Type Attachment category. Aligned with MediaPart.type enum.
		Type MessageAttachmentsType `json:"type"`
	} `json:"attachments,omitempty"`

	// CancelMethod How the cancel was applied — present only on type="turn_canceled" entries (FR-15). "graceful" lets the in-flight tool finish; "hard" interrupts immediately.
	CancelMethod *MessageCancelMethod `json:"cancel_method,omitempty"`

	// CanceledByChannel Channel that originated the cancel request — present only on type="turn_canceled" entries (FR-15).
	CanceledByChannel *string `json:"canceled_by_channel,omitempty"`

	// CanceledByUser Username of the actor who triggered the cancel — present only on type="turn_canceled" entries (FR-15).
	CanceledByUser *string `json:"canceled_by_user,omitempty"`

	// Content Raw markdown/text content of the message.
	Content *string `json:"content,omitempty"`

	// Cost USD cost for this entry. Absent when zero.
	Cost *float64 `json:"cost,omitempty"`

	// DescendantsCanceled IDs of descendant turns that were canceled in cascade — present only on type="turn_canceled" entries (FR-6a).
	DescendantsCanceled *[]string `json:"descendants_canceled,omitempty"`

	// Id Unique message identifier.
	Id string `json:"id"`

	// MessagesCompacted Number of messages compacted (present only on compaction entries).
	MessagesCompacted *int `json:"messages_compacted,omitempty"`

	// Role Author role. Absent on compaction entries.
	Role *MessageRole `json:"role,omitempty"`

	// Status Completion status of this message turn.
	Status *MessageStatus `json:"status,omitempty"`

	// Summary Compaction summary text (present only on type=compaction entries).
	Summary *string `json:"summary,omitempty"`

	// Timestamp RFC3339 timestamp when this entry was recorded.
	Timestamp time.Time `json:"timestamp"`

	// Tokens Token count for this entry (input + output). Absent when zero.
	Tokens *int `json:"tokens,omitempty"`

	// ToolCalls Tool invocations made during this message turn.
	ToolCalls *[]struct {
		// DurationMs Elapsed time in milliseconds. Absent when still running.
		DurationMs *int64 `json:"duration_ms,omitempty"`

		// Id Unique tool call identifier (ToolCallID type on the Go side).
		Id string `json:"id"`

		// Parameters Input parameters passed to the tool.
		Parameters *map[string]interface{} `json:"parameters,omitempty"`

		// ParentToolCallId Parent tool call ID for nested subagent tool invocations.
		ParentToolCallId *string `json:"parent_tool_call_id,omitempty"`

		// Result Return value from the tool. Shape is tool-specific.
		Result *map[string]interface{} `json:"result,omitempty"`

		// Status Outcome of the tool call.
		Status MessageToolCallsStatus `json:"status"`

		// Tool Tool name as registered in the tool registry (e.g. "workspace.shell", "web_search").
		Tool string `json:"tool"`
	} `json:"tool_calls,omitempty"`

	// Truncated Set to true on the last assistant entry when a turn is canceled mid-stream (FR-14). Only present when true. The SPA renders an "(interrupted)" suffix on the bubble when this is set.
	Truncated *bool `json:"truncated,omitempty"`

	// TurnId Turn identifier — present only on type="turn_canceled" entries (FR-15). Identifies the turn that was canceled.
	TurnId *string `json:"turn_id,omitempty"`

	// Type Entry classification. Absent or empty means "message" (backwards compatible). "compaction" entries summarize pruned context; "system" entries are internal markers; "tool_call" entries record tool invocations; "turn_canceled" entries mark a turn that was canceled mid-stream (FR-15). The Go-side EntryType constant set is the source of truth (`pkg/session/daypartition.go`).
	Type *MessageType `json:"type,omitempty"`
}

// MessageAttachmentsType Attachment category. Aligned with MediaPart.type enum.
type MessageAttachmentsType string

// MessageCancelMethod How the cancel was applied — present only on type="turn_canceled" entries (FR-15). "graceful" lets the in-flight tool finish; "hard" interrupts immediately.
type MessageCancelMethod string

// MessageRole Author role. Absent on compaction entries.
type MessageRole string

// MessageStatus Completion status of this message turn.
type MessageStatus string

// MessageToolCallsStatus Outcome of the tool call.
type MessageToolCallsStatus string

// MessageType Entry classification. Absent or empty means "message" (backwards compatible). "compaction" entries summarize pruned context; "system" entries are internal markers; "tool_call" entries record tool invocations; "turn_canceled" entries mark a turn that was canceled mid-stream (FR-15). The Go-side EntryType constant set is the source of truth (`pkg/session/daypartition.go`).
type MessageType string

// OnboardingCompleteRequest Body for POST /onboarding/complete. Atomically sets up the first LLM provider and creates the initial admin account. CSRF-exempt (no cookie exists at this point).
type OnboardingCompleteRequest struct {
	// Admin Initial admin account credentials.
	Admin struct {
		// Password Admin password. Minimum 8 characters.
		Password string `json:"password"`

		// Username Admin login name.
		Username string `json:"username"`
	} `json:"admin"`

	// Provider LLM provider configuration to persist.
	Provider struct {
		// ApiKey API key for the provider. Stored encrypted (AES-256-GCM) in credentials.json.
		ApiKey string `json:"api_key"`

		// Id Provider protocol identifier (e.g. "anthropic", "openai", "openrouter", "gemini"). Must be a known protocol; unknown values are rejected with 400.
		Id string `json:"id"`

		// Model Default model to use for this provider. When omitted, a sensible default is chosen per provider (e.g. "claude-sonnet-4-6" for anthropic, "gpt-4o" for openai).
		Model *string `json:"model,omitempty"`
	} `json:"provider"`
}

// OnboardingCompleteResponse Returned on successful login, register-admin, or onboarding/complete. Contains the bearer token to use in subsequent Authorization headers, the role of the authenticated user, and the username.
type OnboardingCompleteResponse struct {
	// Role RBAC role of the authenticated user.
	Role OnboardingCompleteResponseRole `json:"role"`

	// Token Canonical opaque bearer token format used by Omnipus. The prefix "omnipus_" (8 characters) followed by 64 lowercase hex characters (32 random bytes), giving a total length of 72 characters. Used in Authorization headers, WS AuthFrame, and rotate-token responses.
	Token string `json:"token"`

	// Username The authenticated user's login name.
	Username string `json:"username"`

	// Warning Non-fatal advisory message. Present on onboarding/complete when the credential store is locked and the API key was stored in plaintext.
	Warning *string `json:"warning,omitempty"`
}

// OnboardingCompleteResponseRole RBAC role of the authenticated user.
type OnboardingCompleteResponseRole string

// OnboardingStatusResponse Response from PATCH /api/v1/state when marking onboarding complete. Confirms that onboarding has been completed.
type OnboardingStatusResponse struct {
	// OnboardingComplete True when onboarding has been successfully marked as complete.
	OnboardingComplete bool `json:"onboarding_complete"`
}

// OperationResult Generic success/failure envelope for simple admin operations. Used by endpoints that perform an action and return only whether it succeeded.
type OperationResult struct {
	// Error Human-readable error message. Present only when success=false.
	Error *string `json:"error,omitempty"`

	// Success True when the operation succeeded.
	Success bool `json:"success"`
}

// PendingRestartEntry A single config key that has been written to disk but not yet applied — the running value diverges from the persisted value. Returned in the array from GET /api/v1/config/pending-restart.
type PendingRestartEntry struct {
	// AppliedValue Value currently applied to the running process (boot-time snapshot).
	AppliedValue interface{} `json:"applied_value"`

	// Key Dotted config key path (e.g. "sandbox.mode", "gateway.port"). Only RestartGatedKeys appear here — hot-reload keys never appear.
	Key string `json:"key"`

	// PersistedValue Value currently on disk (what will be applied after restart).
	PersistedValue interface{} `json:"persisted_value"`
}

// ProbeProviderRequest Body for POST /onboarding/probe-provider. Tests an API key against a provider and returns available models. Non-persistent — nothing is written to disk. CSRF-exempt. Returns 409 once onboarding is complete.
type ProbeProviderRequest struct {
	// ApiKey API key to test against the provider.
	ApiKey string `json:"api_key"`

	// Endpoint Optional override for the provider's API base URL. When omitted, the server uses the provider's well-known default endpoint.
	Endpoint *string `json:"endpoint,omitempty"`

	// Id Provider protocol identifier. Must be one of the recognized protocol names that Omnipus can connect to. Validated server-side against the known protocol registry (pkg/providers.IsKnownProtocol).
	Id ProbeProviderRequestId `json:"id"`
}

// ProbeProviderRequestId Provider protocol identifier. Must be one of the recognized protocol names that Omnipus can connect to. Validated server-side against the known protocol registry (pkg/providers.IsKnownProtocol).
type ProbeProviderRequestId string

// ProbeProviderResponse Response from POST /onboarding/probe-provider. Always HTTP 200. success=true means the API key was accepted; success=false means the upstream rejected it (the error field explains why).
type ProbeProviderResponse struct {
	// Error Human-readable error from the upstream provider. Present only when success=false.
	Error *string `json:"error,omitempty"`

	// Models List of model IDs returned by the provider. Present only when success=true.
	Models *[]string `json:"models,omitempty"`

	// Success Whether the provider accepted the API key.
	Success bool `json:"success"`
}

// PromptGuardResponse Prompt injection guard level returned by GET /api/v1/security/prompt-guard.
type PromptGuardResponse struct {
	// Level Current prompt injection detection strictness level.
	Level PromptGuardResponseLevel `json:"level"`

	// RequiresRestart Always false — prompt guard is hot-reloaded.
	RequiresRestart bool `json:"requires_restart"`
}

// PromptGuardResponseLevel Current prompt injection detection strictness level.
type PromptGuardResponseLevel string

// PromptGuardUpdateRequest Request body for PUT /api/v1/security/prompt-guard. Updates the prompt injection detection strictness level.
type PromptGuardUpdateRequest struct {
	// Level New prompt injection detection strictness level.
	Level PromptGuardUpdateRequestLevel `json:"level"`
}

// PromptGuardUpdateRequestLevel New prompt injection detection strictness level.
type PromptGuardUpdateRequestLevel string

// PromptGuardUpdateResponse Response from PUT /api/v1/security/prompt-guard. Returns save status and the currently active level.
type PromptGuardUpdateResponse struct {
	// AppliedLevel The prompt guard level now active.
	AppliedLevel PromptGuardUpdateResponseAppliedLevel `json:"applied_level"`

	// RequiresRestart False when hot-reload succeeded. True when hot-reload failed (warning will be present).
	RequiresRestart bool `json:"requires_restart"`

	// Saved True when the configuration was successfully persisted to disk.
	Saved bool `json:"saved"`

	// Warning Present when hot-reload failed — config is saved but restart is required.
	Warning *string `json:"warning,omitempty"`
}

// PromptGuardUpdateResponseAppliedLevel The prompt guard level now active.
type PromptGuardUpdateResponseAppliedLevel string

// Provider A single LLM provider entry as returned by GET /providers and PUT /providers/{id}. Describes the provider's connection status, the resolved model list, and any non-fatal warnings encountered when fetching the upstream model catalogue.
type Provider struct {
	// DisplayName Branded display name for UI presentation (e.g. "OpenRouter", "Anthropic"). Falls back to name when absent.
	DisplayName *string `json:"display_name,omitempty"`

	// Error Fatal error message when status is "error". Absent for connected/disconnected providers.
	Error *string `json:"error,omitempty"`

	// HasApiKey True when the provider has a stored API key in credentials. The key itself is never returned. Absent on legacy entries that predate this field — treat as false when absent.
	HasApiKey *bool `json:"has_api_key,omitempty"`

	// Id Provider identifier (e.g. "anthropic", "openai", "openrouter").
	Id string `json:"id"`

	// Models Alphabetically sorted list of model IDs available from this provider, fetched from the upstream /models endpoint when an API key is present. Empty array when the upstream fetch fails or no key is configured.
	Models []string `json:"models"`

	// Name Human-readable provider name (may be the same as id for unknown providers).
	Name string `json:"name"`

	// Status "connected" when at least one API key is configured for this provider. "disconnected" when no key is available or on the fallback default entry. "error" when the provider is configured but the upstream returned a non-retryable error.
	Status ProviderStatus `json:"status"`

	// Warning Non-fatal advisory message (e.g. "could not fetch upstream model list: ..."). Absent when there are no warnings.
	Warning *string `json:"warning,omitempty"`
}

// ProviderStatus "connected" when at least one API key is configured for this provider. "disconnected" when no key is available or on the fallback default entry. "error" when the provider is configured but the upstream returned a non-retryable error.
type ProviderStatus string

// ProviderUpdateRequest Request body for PUT /api/v1/providers/{id}. Adds or updates an LLM provider configuration. On new providers, api_key is required. On existing providers, api_key may be omitted to keep the current key.
type ProviderUpdateRequest struct {
	// ApiKey API key for the provider. Stored encrypted (AES-256-GCM) in credentials.json. Required when adding a new provider; optional when updating an existing one (omit to leave the current key unchanged).
	ApiKey *string `json:"api_key,omitempty"`

	// Model Default model to use for this provider. Defaults to "default" when not specified on new providers.
	Model *string `json:"model,omitempty"`
}

// RateLimitConfig Rate limit configuration returned by GET /api/v1/security/rate-limits and accepted by PUT /api/v1/security/rate-limits.
type RateLimitConfig struct {
	// DailyCostCap Maximum allowed daily LLM cost in USD. 0 = unlimited. Only present in GET responses (mapped from daily_cost_cap_usd).
	DailyCostCap *float64 `json:"daily_cost_cap,omitempty"`

	// DailyCostCapUsd Maximum allowed daily LLM cost in USD. 0 = unlimited. Used in PUT request body.
	DailyCostCapUsd *float64 `json:"daily_cost_cap_usd,omitempty"`

	// DailyCostUsd Current cumulative LLM spending for today (UTC). Only present in GET responses.
	DailyCostUsd *float64 `json:"daily_cost_usd,omitempty"`

	// Enabled True when any rate limit cap is configured. Derived from whether any limit field is non-zero. Only present in GET responses.
	Enabled *bool `json:"enabled,omitempty"`

	// MaxAgentLlmCallsPerHour Maximum LLM API calls per agent per hour. 0 = unlimited.
	MaxAgentLlmCallsPerHour *int64 `json:"max_agent_llm_calls_per_hour,omitempty"`

	// MaxAgentToolCallsPerMinute Maximum tool calls per agent per minute. 0 = unlimited.
	MaxAgentToolCallsPerMinute *int64 `json:"max_agent_tool_calls_per_minute,omitempty"`
}

// RateLimitsResponse Response from GET /api/v1/security/rate-limits. Returns the current rate-limit configuration and the live daily LLM cost.
type RateLimitsResponse struct {
	// DailyCostCap Configured daily cost cap in USD. 0 means unlimited.
	DailyCostCap float64 `json:"daily_cost_cap"`

	// DailyCostUsd Live daily LLM cost accumulated so far today.
	DailyCostUsd float64 `json:"daily_cost_usd"`
	Enabled      bool    `json:"enabled"`

	// MaxAgentLlmCallsPerHour Maximum LLM calls per hour across all agents. 0 means unlimited.
	MaxAgentLlmCallsPerHour int64 `json:"max_agent_llm_calls_per_hour"`

	// MaxAgentToolCallsPerMinute Maximum tool calls per minute across all agents. 0 means unlimited.
	MaxAgentToolCallsPerMinute int64 `json:"max_agent_tool_calls_per_minute"`
}

// RateLimitsUpdateRequest Request body for PUT /api/v1/security/rate-limits. Partial update — any subset of the three cap fields. Strict type validation rejects JSON strings in numeric fields, floats in integer fields, negative values, NaN/Inf, and overflow. Changes are hot-reloaded.
type RateLimitsUpdateRequest struct {
	// DailyCostCapUsd Daily cost cap in USD. 0 = unlimited.
	DailyCostCapUsd *float64 `json:"daily_cost_cap_usd,omitempty"`

	// MaxAgentLlmCallsPerHour Maximum LLM calls per hour. 0 = unlimited.
	MaxAgentLlmCallsPerHour *int64 `json:"max_agent_llm_calls_per_hour,omitempty"`

	// MaxAgentToolCallsPerMinute Maximum tool calls per minute. 0 = unlimited.
	MaxAgentToolCallsPerMinute *int64 `json:"max_agent_tool_calls_per_minute,omitempty"`
}

// RateLimitsUpdateResponse Response from PUT /api/v1/security/rate-limits. Returns save status and the applied configuration.
type RateLimitsUpdateResponse struct {
	// Applied The effective configuration after the update. Present only when hot-reload succeeded.
	Applied *struct {
		// DailyCostCapUsd Applied daily cost cap in USD.
		DailyCostCapUsd *float64 `json:"daily_cost_cap_usd,omitempty"`

		// MaxAgentLlmCallsPerHour Applied LLM calls per hour limit.
		MaxAgentLlmCallsPerHour *int64 `json:"max_agent_llm_calls_per_hour,omitempty"`

		// MaxAgentToolCallsPerMinute Applied tool calls per minute limit.
		MaxAgentToolCallsPerMinute *int64 `json:"max_agent_tool_calls_per_minute,omitempty"`
	} `json:"applied,omitempty"`

	// RequiresRestart Always false for rate limits — they are hot-reloaded. Set to true when hot-reload failed (warning will be present).
	RequiresRestart bool `json:"requires_restart"`

	// Saved True when the configuration was successfully persisted to disk.
	Saved bool `json:"saved"`

	// Warning Present when hot-reload failed — config is saved but restart is required.
	Warning *string `json:"warning,omitempty"`
}

// RegisterAdminRequest Body for POST /auth/register-admin. Creates the first admin user (fails 409 if one already exists).
type RegisterAdminRequest struct {
	// Password Password for the new admin account. Minimum 8 characters, maximum 72 (bcrypt limit).
	Password string `json:"password"`

	// Username Must start with an alphanumeric character and contain only letters, digits, dots, dashes, and underscores. Length 2-63 characters.
	Username string `json:"username"`
}

// RestoreBackupRequest Request body for POST /api/v1/restore. Extracts a backup tar.gz archive over ~/.omnipus/, skipping config.json to preserve current settings.
type RestoreBackupRequest struct {
	// Filename Name of the backup file (without path). Must not contain path separators or traversal sequences. Must end with .tar.gz.
	Filename string `json:"filename"`
}

// RetentionConfig Session log retention configuration returned by GET /api/v1/security/retention.
type RetentionConfig struct {
	// Disabled When true, retention sweeps are disabled and session logs are kept forever.
	Disabled *bool `json:"disabled,omitempty"`

	// SessionDays Number of days to retain session logs. 0 means use the system default (90 days). Only present when a custom retention period is set.
	SessionDays *int `json:"session_days,omitempty"`
}

// RetentionSweepResult Result of a POST /api/v1/security/retention/sweep on-demand sweep operation.
type RetentionSweepResult struct {
	// Removed Number of session directories removed during the sweep.
	Removed int `json:"removed"`

	// SkippedReason Present when the sweep was skipped without removing anything. Currently only "disabled" (retention is configured as disabled).
	SkippedReason *string `json:"skipped_reason,omitempty"`
}

// RetentionUpdateRequest Request body for PUT /api/v1/security/retention. Partial update — any subset of the two retention fields. Strict type validation rejects JSON strings for session_days, floats with fractional parts for session_days, and non-boolean values for disabled. An empty body {} is accepted as a no-op.
type RetentionUpdateRequest struct {
	// Disabled When true, retention sweeps are disabled and session logs are kept forever. Strings ("true"/"false") and numbers are rejected with 400.
	Disabled *bool `json:"disabled,omitempty"`

	// SessionDays Number of days to retain session logs. 0 means use the system default (90 days). Floats and strings are rejected with 400.
	SessionDays *int `json:"session_days,omitempty"`
}

// RetentionUpdateResponse Response from PUT /api/v1/security/retention. Returns save status and the currently active retention settings.
type RetentionUpdateResponse struct {
	// Disabled When true, retention sweeps are disabled and session logs are kept forever.
	Disabled bool `json:"disabled"`

	// RequiresRestart Always false — retention config is hot-reloaded.
	RequiresRestart bool `json:"requires_restart"`

	// Saved True when the configuration was successfully persisted to disk.
	Saved bool `json:"saved"`

	// SessionDays Number of days to retain session logs. 0 = system default (90 days).
	SessionDays int `json:"session_days"`
}

// RotateTokenResponse Response from POST /api/v1/config/gateway/rotate-token. Returns the newly generated bearer token. The caller must immediately update any stored token references — the previous token is no longer valid once the gateway processes the next request with the new token active.
type RotateTokenResponse struct {
	// Token Canonical opaque bearer token format used by Omnipus. The prefix "omnipus_" (8 characters) followed by 64 lowercase hex characters (32 random bytes), giving a total length of 72 characters. Used in Authorization headers, WS AuthFrame, and rotate-token responses.
	Token string `json:"token"`
}

// SandboxConfig Sandbox configuration returned by GET /api/v1/security/sandbox-config and as part of PUT /api/v1/security/sandbox-config responses.
type SandboxConfig struct {
	// AllowNetworkOutbound Whether outbound network access is permitted from the sandbox.
	AllowNetworkOutbound *bool `json:"allow_network_outbound,omitempty"`

	// AllowedPaths File system paths the sandboxed process may access. Empty array means use only default allowed paths.
	AllowedPaths *[]string `json:"allowed_paths,omitempty"`

	// AppliedMode The mode the gateway is currently enforcing. Differs from `mode` when the operator saved a change but has not restarted yet.
	AppliedMode *string `json:"applied_mode,omitempty"`

	// DefaultProfile Global fallback sandbox profile applied to new custom agents that do not pick their own profile. Empty string means use hardcoded default.
	DefaultProfile *SandboxConfigDefaultProfile `json:"default_profile,omitempty"`

	// Mode Configured sandbox enforcement mode.
	Mode *SandboxConfigMode `json:"mode,omitempty"`

	// RequiresRestart Present in PUT responses. True when the change requires a gateway restart to take effect (mode, allowed_paths, default_profile).
	RequiresRestart *bool `json:"requires_restart,omitempty"`

	// Saved Present in PUT responses. Always true on success.
	Saved *bool `json:"saved,omitempty"`

	// ShellDenyPatterns Global fallback shell command deny-list (regex entries). Per-agent custom patterns extend this list.
	ShellDenyPatterns *[]string `json:"shell_deny_patterns,omitempty"`

	// Ssrf Nested SSRF config block for backward-compatible clients.
	Ssrf *struct {
		AllowInternal *[]string `json:"allow_internal,omitempty"`
		Enabled       *bool     `json:"enabled,omitempty"`
	} `json:"ssrf,omitempty"`

	// SsrfAllowInternal IP addresses, hostnames, or CIDR ranges that are allowed to receive outbound requests even when SSRF protection is enabled. Empty array means block all internal addresses.
	SsrfAllowInternal *[]string `json:"ssrf_allow_internal,omitempty"`

	// SsrfEnabled Whether SSRF (server-side request forgery) protection is active.
	SsrfEnabled *bool `json:"ssrf_enabled,omitempty"`
}

// SandboxConfigDefaultProfile Global fallback sandbox profile applied to new custom agents that do not pick their own profile. Empty string means use hardcoded default.
type SandboxConfigDefaultProfile string

// SandboxConfigMode Configured sandbox enforcement mode.
type SandboxConfigMode string

// SandboxConfigUpdate Partial-update body for PUT /security/sandbox-config. All fields are optional — only fields present in the request are updated. At least one field must be supplied (the server returns 400 otherwise). Flat fields take precedence over nested equivalents when both are present in the same request body. mode, allowed_paths, and default_profile are restart-gated (the response includes requires_restart=true when any of these change). ssrf.allow_internal and shell_deny_patterns are hot-reloaded.
type SandboxConfigUpdate struct {
	// AllowNetworkOutbound Allow agent tool calls to make outbound network connections.
	AllowNetworkOutbound *bool `json:"allow_network_outbound,omitempty"`

	// AllowedPaths List of host filesystem paths the agent is allowed to read/write. Restart-gated. Must be absolute paths; empty list clears all exceptions.
	AllowedPaths *[]string `json:"allowed_paths,omitempty"`

	// DefaultProfile Default sandbox profile applied to new custom agents that do not pick their own profile. Restart-gated. Empty string means "inherit global default".
	DefaultProfile *SandboxConfigUpdateDefaultProfile `json:"default_profile,omitempty"`

	// Mode Kernel sandbox enforcement mode. "off" = no kernel enforcement (god-mode). "permissive" = log violations but allow. "enforce" = block violations. Restart-gated.
	Mode *SandboxConfigUpdateMode `json:"mode,omitempty"`

	// ShellDenyPatterns Global fallback list of Go regexp patterns to block in shell commands. Per-agent custom_deny_patterns extend this list. Hot-reloaded.
	ShellDenyPatterns *[]string `json:"shell_deny_patterns,omitempty"`

	// Ssrf Nested SSRF configuration sub-object. Flat fields take precedence.
	Ssrf *struct {
		// AllowInternal CIDR ranges or IP addresses the agent may reach despite SSRF blocking.
		AllowInternal *[]string `json:"allow_internal,omitempty"`
	} `json:"ssrf,omitempty"`

	// SsrfAllowInternal Flat version of ssrf.allow_internal. Takes precedence when both are present. CIDR ranges or IP addresses the agent may reach despite SSRF blocking.
	SsrfAllowInternal *[]string `json:"ssrf_allow_internal,omitempty"`

	// SsrfEnabled Enable SSRF (server-side request forgery) protection for HTTP tool calls.
	SsrfEnabled *bool `json:"ssrf_enabled,omitempty"`
}

// SandboxConfigUpdateDefaultProfile Default sandbox profile applied to new custom agents that do not pick their own profile. Restart-gated. Empty string means "inherit global default".
type SandboxConfigUpdateDefaultProfile string

// SandboxConfigUpdateMode Kernel sandbox enforcement mode. "off" = no kernel enforcement (god-mode). "permissive" = log violations but allow. "enforce" = block violations. Restart-gated.
type SandboxConfigUpdateMode string

// SandboxStatus Runtime sandbox backend status returned by GET /api/v1/security/sandbox-status.
type SandboxStatus struct {
	// AbiVersion Landlock ABI version. Present on Linux with Landlock support.
	AbiVersion *int `json:"abi_version,omitempty"`

	// AuditOnly True when the sandbox is in permissive (audit-only) mode — policy violations are logged but not blocked.
	AuditOnly *bool `json:"audit_only,omitempty"`

	// Available Whether the backend is available on this platform.
	Available bool `json:"available"`

	// Backend Name of the active sandbox backend.
	Backend string `json:"backend"`

	// BindPortsCount Number of bind-port allow-list rules installed by the kernel. Zero on FallbackBackend, Mode=Off, or Landlock ABI < 4.
	BindPortsCount int `json:"bind_ports_count"`

	// BlockedSyscalls List of syscall names blocked by seccomp (when active).
	BlockedSyscalls *[]string `json:"blocked_syscalls,omitempty"`

	// DisabledBy Reason the sandbox is disabled, if applicable. E.g. "config" or "kernel".
	DisabledBy *string `json:"disabled_by,omitempty"`

	// IssueRef Set when a known kernel incompatibility is flagged. Do NOT hard-code the literal issue number in the SPA.
	IssueRef *string `json:"issue_ref,omitempty"`

	// KernelLevel Whether the backend can enforce at the kernel level. True for Landlock on Linux 5.13+. False for the fallback (app-level) backend.
	KernelLevel bool `json:"kernel_level"`

	// LandlockEnforced Whether Landlock file-system access rules are enforced.
	LandlockEnforced *bool `json:"landlock_enforced,omitempty"`

	// LandlockFeatures Landlock feature flags active on this kernel.
	LandlockFeatures *[]string `json:"landlock_features,omitempty"`

	// Mode Current sandbox enforcement mode (from ApplyState).
	Mode *string `json:"mode,omitempty"`

	// Notes Human-readable notes about the sandbox state or limitations.
	Notes *[]string `json:"notes,omitempty"`

	// PolicyApplied Whether kernel-level enforcement is actually live on this process. A kernel-capable backend may not have policy applied if Apply() was not called yet (e.g. sandbox mode is off).
	PolicyApplied bool `json:"policy_applied"`

	// SeccompEnabled Whether seccomp BPF filtering is currently active.
	SeccompEnabled bool `json:"seccomp_enabled"`

	// SeccompEnforced Whether seccomp syscall filtering is enforced.
	SeccompEnforced *bool `json:"seccomp_enforced,omitempty"`
}

// Session Session metadata object (maps to session.UnifiedMeta + session.SessionMeta). Returned in list and detail endpoints. The SPA maps this through rawToSession() which reads stats.message_count, stats.tokens_total, and stats.cost.
type Session struct {
	// ActiveAgentId The agent ID currently handling this session (multi-agent sessions only).
	ActiveAgentId *string `json:"active_agent_id,omitempty"`

	// AgentId ID of the primary agent that owns this session.
	AgentId string `json:"agent_id"`

	// AgentIds All agent IDs that have participated in this session (multi-agent sessions). For legacy single-agent sessions this field is absent; callers should fall back to [agent_id] when agent_ids is undefined.
	AgentIds *[]string `json:"agent_ids,omitempty"`

	// Channel Channel identifier that initiated this session (e.g. "webchat", "telegram"). Always present (may be empty string for legacy sessions).
	Channel string `json:"channel"`

	// CompactionSummaries Per-agent compaction summaries (multi-agent sessions only).
	CompactionSummaries *map[string]string `json:"compaction_summaries,omitempty"`

	// CreatedAt RFC3339 timestamp when the session was created.
	CreatedAt time.Time `json:"created_at"`

	// Id Unique session identifier (UUID).
	Id string `json:"id"`

	// LastCompactionSummary Summary of the last context compaction pass (present only when compaction has occurred).
	LastCompactionSummary *string `json:"last_compaction_summary,omitempty"`

	// Model LLM model name used in this session (may be empty for legacy sessions).
	Model *string `json:"model,omitempty"`

	// Partitions List of JSONL partition file names (e.g. ["2026-05-16.jsonl"]). Always present as an array (may be empty for new sessions with no messages). One partition per day, so 3650 covers ~10 years of daily partitions.
	Partitions []string `json:"partitions"`

	// ProjectId Associated project ID (optional, future v0.3 feature).
	ProjectId *string `json:"project_id,omitempty"`

	// Provider Provider identifier (e.g. "anthropic", "openai") for this session.
	Provider *string `json:"provider,omitempty"`

	// Stats Aggregated statistics for a session transcript.
	Stats struct {
		// Cost Total USD cost for this session (based on provider pricing).
		Cost float64 `json:"cost"`

		// MessageCount Number of transcript entries in this session.
		MessageCount int `json:"message_count"`

		// TokensIn Total input tokens consumed across all messages in this session.
		TokensIn int `json:"tokens_in"`

		// TokensOut Total output tokens generated across all messages in this session.
		TokensOut int `json:"tokens_out"`

		// TokensTotal Sum of tokens_in and tokens_out.
		TokensTotal int `json:"tokens_total"`

		// ToolCalls Total number of tool calls made in this session.
		ToolCalls int `json:"tool_calls"`
	} `json:"stats"`

	// Status Current lifecycle status of the session.
	Status SessionStatus `json:"status"`

	// TaskId Associated task ID when this session was created to service a task.
	TaskId *string `json:"task_id,omitempty"`

	// Title Human-readable session title. May be auto-generated or user-renamed.
	Title string `json:"title"`

	// Type Session classification. Legacy sessions without a type field are treated as "chat" by the SPA via rawToSession(). Defaults to "chat" on creation.
	Type *SessionType `json:"type,omitempty"`

	// UpdatedAt RFC3339 timestamp of the last modification to session metadata or transcript.
	UpdatedAt time.Time `json:"updated_at"`
}

// SessionStatus Current lifecycle status of the session.
type SessionStatus string

// SessionType Session classification. Legacy sessions without a type field are treated as "chat" by the SPA via rawToSession(). Defaults to "chat" on creation.
type SessionType string

// SessionCreateRequest Body for POST /sessions. Creates a new session for an agent.
type SessionCreateRequest struct {
	// AgentId Agent ID that will own this session. Defaults to "main" when omitted. Must reference an existing agent (400 if not found).
	AgentId *string `json:"agent_id,omitempty"`

	// Type Session type. Defaults to "chat" when omitted.
	Type *SessionCreateRequestType `json:"type,omitempty"`
}

// SessionCreateRequestType Session type. Defaults to "chat" when omitted.
type SessionCreateRequestType string

// SessionDetail Full session detail as returned by GET /sessions/{id}. Contains the session metadata plus the complete ordered transcript.
type SessionDetail struct {
	// AgentRemoved True when the agent that owned this session has been deleted from the config. Used by the SPA to display a banner informing the user that the original agent no longer exists. Absent (or false) in the common case.
	AgentRemoved *bool `json:"agent_removed,omitempty"`

	// Messages Ordered list of transcript entries for this session. Capped at 100000 messages to bound response payload size.
	Messages []struct {
		// AgentId ID of the agent that produced this entry (FR-002). Always present.
		AgentId string `json:"agent_id"`

		// Attachments File attachments associated with this message.
		Attachments *[]struct {
			// MimeType MIME type of the attachment.
			MimeType string `json:"mime_type"`

			// Path Relative path within the session workspace.
			Path string `json:"path"`

			// Size File size in bytes.
			Size int64 `json:"size"`

			// Type Attachment category. Aligned with MediaPart.type enum.
			Type SessionDetailMessagesAttachmentsType `json:"type"`
		} `json:"attachments,omitempty"`

		// CancelMethod How the cancel was applied — present only on type="turn_canceled" entries (FR-15). "graceful" lets the in-flight tool finish; "hard" interrupts immediately.
		CancelMethod *SessionDetailMessagesCancelMethod `json:"cancel_method,omitempty"`

		// CanceledByChannel Channel that originated the cancel request — present only on type="turn_canceled" entries (FR-15).
		CanceledByChannel *string `json:"canceled_by_channel,omitempty"`

		// CanceledByUser Username of the actor who triggered the cancel — present only on type="turn_canceled" entries (FR-15).
		CanceledByUser *string `json:"canceled_by_user,omitempty"`

		// Content Raw markdown/text content of the message.
		Content *string `json:"content,omitempty"`

		// Cost USD cost for this entry. Absent when zero.
		Cost *float64 `json:"cost,omitempty"`

		// DescendantsCanceled IDs of descendant turns that were canceled in cascade — present only on type="turn_canceled" entries (FR-6a).
		DescendantsCanceled *[]string `json:"descendants_canceled,omitempty"`

		// Id Unique message identifier.
		Id string `json:"id"`

		// MessagesCompacted Number of messages compacted (present only on compaction entries).
		MessagesCompacted *int `json:"messages_compacted,omitempty"`

		// Role Author role. Absent on compaction entries.
		Role *SessionDetailMessagesRole `json:"role,omitempty"`

		// Status Completion status of this message turn.
		Status *SessionDetailMessagesStatus `json:"status,omitempty"`

		// Summary Compaction summary text (present only on type=compaction entries).
		Summary *string `json:"summary,omitempty"`

		// Timestamp RFC3339 timestamp when this entry was recorded.
		Timestamp time.Time `json:"timestamp"`

		// Tokens Token count for this entry (input + output). Absent when zero.
		Tokens *int `json:"tokens,omitempty"`

		// ToolCalls Tool invocations made during this message turn.
		ToolCalls *[]struct {
			// DurationMs Elapsed time in milliseconds. Absent when still running.
			DurationMs *int64 `json:"duration_ms,omitempty"`

			// Id Unique tool call identifier (ToolCallID type on the Go side).
			Id string `json:"id"`

			// Parameters Input parameters passed to the tool.
			Parameters *map[string]interface{} `json:"parameters,omitempty"`

			// ParentToolCallId Parent tool call ID for nested subagent tool invocations.
			ParentToolCallId *string `json:"parent_tool_call_id,omitempty"`

			// Result Return value from the tool. Shape is tool-specific.
			Result *map[string]interface{} `json:"result,omitempty"`

			// Status Outcome of the tool call.
			Status SessionDetailMessagesToolCallsStatus `json:"status"`

			// Tool Tool name as registered in the tool registry (e.g. "workspace.shell", "web_search").
			Tool string `json:"tool"`
		} `json:"tool_calls,omitempty"`

		// Truncated Set to true on the last assistant entry when a turn is canceled mid-stream (FR-14). Only present when true. The SPA renders an "(interrupted)" suffix on the bubble when this is set.
		Truncated *bool `json:"truncated,omitempty"`

		// TurnId Turn identifier — present only on type="turn_canceled" entries (FR-15). Identifies the turn that was canceled.
		TurnId *string `json:"turn_id,omitempty"`

		// Type Entry classification. Absent or empty means "message" (backwards compatible). "compaction" entries summarize pruned context; "system" entries are internal markers; "tool_call" entries record tool invocations; "turn_canceled" entries mark a turn that was canceled mid-stream (FR-15). The Go-side EntryType constant set is the source of truth (`pkg/session/daypartition.go`).
		Type *SessionDetailMessagesType `json:"type,omitempty"`
	} `json:"messages"`

	// Session Session metadata object (maps to session.UnifiedMeta + session.SessionMeta). Returned in list and detail endpoints. The SPA maps this through rawToSession() which reads stats.message_count, stats.tokens_total, and stats.cost.
	Session struct {
		// ActiveAgentId The agent ID currently handling this session (multi-agent sessions only).
		ActiveAgentId *string `json:"active_agent_id,omitempty"`

		// AgentId ID of the primary agent that owns this session.
		AgentId string `json:"agent_id"`

		// AgentIds All agent IDs that have participated in this session (multi-agent sessions). For legacy single-agent sessions this field is absent; callers should fall back to [agent_id] when agent_ids is undefined.
		AgentIds *[]string `json:"agent_ids,omitempty"`

		// Channel Channel identifier that initiated this session (e.g. "webchat", "telegram"). Always present (may be empty string for legacy sessions).
		Channel string `json:"channel"`

		// CompactionSummaries Per-agent compaction summaries (multi-agent sessions only).
		CompactionSummaries *map[string]string `json:"compaction_summaries,omitempty"`

		// CreatedAt RFC3339 timestamp when the session was created.
		CreatedAt time.Time `json:"created_at"`

		// Id Unique session identifier (UUID).
		Id string `json:"id"`

		// LastCompactionSummary Summary of the last context compaction pass (present only when compaction has occurred).
		LastCompactionSummary *string `json:"last_compaction_summary,omitempty"`

		// Model LLM model name used in this session (may be empty for legacy sessions).
		Model *string `json:"model,omitempty"`

		// Partitions List of JSONL partition file names (e.g. ["2026-05-16.jsonl"]). Always present as an array (may be empty for new sessions with no messages). One partition per day, so 3650 covers ~10 years of daily partitions.
		Partitions []string `json:"partitions"`

		// ProjectId Associated project ID (optional, future v0.3 feature).
		ProjectId *string `json:"project_id,omitempty"`

		// Provider Provider identifier (e.g. "anthropic", "openai") for this session.
		Provider *string `json:"provider,omitempty"`

		// Stats Aggregated statistics for a session transcript.
		Stats struct {
			// Cost Total USD cost for this session (based on provider pricing).
			Cost float64 `json:"cost"`

			// MessageCount Number of transcript entries in this session.
			MessageCount int `json:"message_count"`

			// TokensIn Total input tokens consumed across all messages in this session.
			TokensIn int `json:"tokens_in"`

			// TokensOut Total output tokens generated across all messages in this session.
			TokensOut int `json:"tokens_out"`

			// TokensTotal Sum of tokens_in and tokens_out.
			TokensTotal int `json:"tokens_total"`

			// ToolCalls Total number of tool calls made in this session.
			ToolCalls int `json:"tool_calls"`
		} `json:"stats"`

		// Status Current lifecycle status of the session.
		Status SessionDetailSessionStatus `json:"status"`

		// TaskId Associated task ID when this session was created to service a task.
		TaskId *string `json:"task_id,omitempty"`

		// Title Human-readable session title. May be auto-generated or user-renamed.
		Title string `json:"title"`

		// Type Session classification. Legacy sessions without a type field are treated as "chat" by the SPA via rawToSession(). Defaults to "chat" on creation.
		Type *SessionDetailSessionType `json:"type,omitempty"`

		// UpdatedAt RFC3339 timestamp of the last modification to session metadata or transcript.
		UpdatedAt time.Time `json:"updated_at"`
	} `json:"session"`
}

// SessionDetailMessagesAttachmentsType Attachment category. Aligned with MediaPart.type enum.
type SessionDetailMessagesAttachmentsType string

// SessionDetailMessagesCancelMethod How the cancel was applied — present only on type="turn_canceled" entries (FR-15). "graceful" lets the in-flight tool finish; "hard" interrupts immediately.
type SessionDetailMessagesCancelMethod string

// SessionDetailMessagesRole Author role. Absent on compaction entries.
type SessionDetailMessagesRole string

// SessionDetailMessagesStatus Completion status of this message turn.
type SessionDetailMessagesStatus string

// SessionDetailMessagesToolCallsStatus Outcome of the tool call.
type SessionDetailMessagesToolCallsStatus string

// SessionDetailMessagesType Entry classification. Absent or empty means "message" (backwards compatible). "compaction" entries summarize pruned context; "system" entries are internal markers; "tool_call" entries record tool invocations; "turn_canceled" entries mark a turn that was canceled mid-stream (FR-15). The Go-side EntryType constant set is the source of truth (`pkg/session/daypartition.go`).
type SessionDetailMessagesType string

// SessionDetailSessionStatus Current lifecycle status of the session.
type SessionDetailSessionStatus string

// SessionDetailSessionType Session classification. Legacy sessions without a type field are treated as "chat" by the SPA via rawToSession(). Defaults to "chat" on creation.
type SessionDetailSessionType string

// SessionRenameRequest Body for PUT /sessions/{id}. Renames a session.
type SessionRenameRequest struct {
	// Title New title for the session.
	Title string `json:"title"`
}

// SessionScopeRequest Body for PUT /security/session-scope. Updates the DM session scoping strategy.
type SessionScopeRequest struct {
	// DmScope New DM session scoping strategy. Must be exactly one of the four canonical values. Changes are saved to disk immediately but require a gateway restart to apply (requires_restart will be true in the response).
	DmScope SessionScopeRequestDmScope `json:"dm_scope"`
}

// SessionScopeRequestDmScope New DM session scoping strategy. Must be exactly one of the four canonical values. Changes are saved to disk immediately but require a gateway restart to apply (requires_restart will be true in the response).
type SessionScopeRequestDmScope string

// SessionScopeResponse Response from GET /security/session-scope.
type SessionScopeResponse struct {
	// DmScope Current DM session scoping strategy. Controls how incoming direct messages are routed to session threads. Changes require a gateway restart to take effect.
	DmScope SessionScopeResponseDmScope `json:"dm_scope"`
}

// SessionScopeResponseDmScope Current DM session scoping strategy. Controls how incoming direct messages are routed to session threads. Changes require a gateway restart to take effect.
type SessionScopeResponseDmScope string

// SessionScopeUpdateResponse Response from PUT /api/v1/security/session-scope. Returns save status and the currently active scope (before restart).
type SessionScopeUpdateResponse struct {
	// AppliedDmScope The dm_scope currently active (the value before restart takes effect).
	AppliedDmScope string `json:"applied_dm_scope"`

	// RequiresRestart Always true — session routing requires a gateway restart to take effect.
	RequiresRestart bool `json:"requires_restart"`

	// Saved True when the configuration was successfully persisted to disk.
	Saved bool `json:"saved"`

	// Warning Present when hot-reload failed — config is saved but restart is required.
	Warning *string `json:"warning,omitempty"`
}

// SessionStats Aggregated statistics for a session transcript.
type SessionStats struct {
	// Cost Total USD cost for this session (based on provider pricing).
	Cost float64 `json:"cost"`

	// MessageCount Number of transcript entries in this session.
	MessageCount int `json:"message_count"`

	// TokensIn Total input tokens consumed across all messages in this session.
	TokensIn int `json:"tokens_in"`

	// TokensOut Total output tokens generated across all messages in this session.
	TokensOut int `json:"tokens_out"`

	// TokensTotal Sum of tokens_in and tokens_out.
	TokensTotal int `json:"tokens_total"`

	// ToolCalls Total number of tool calls made in this session.
	ToolCalls int `json:"tool_calls"`
}

// Skill A single installed skill as returned by GET /skills. Skills are SKILL.md/package bundles loaded from ~/.omnipus/skills/ that extend agent capabilities. Each skill has an ID, version, and human-readable metadata.
type Skill struct {
	// AgentAssignment ID of the agent this skill is assigned to, when the skill is bound to a specific agent rather than globally available. Absent for globally assigned skills.
	AgentAssignment *string `json:"agent_assignment,omitempty"`

	// Author Skill author or publisher name.
	Author *string `json:"author,omitempty"`

	// Description Short description of what the skill does.
	Description *string `json:"description,omitempty"`

	// Id Unique skill identifier (typically the skill directory name or npm package name).
	Id string `json:"id"`

	// Name Human-readable skill name.
	Name string `json:"name"`

	// Status "active" when the skill is loaded and its tools are available to agents. "disabled" when the skill has been installed but deactivated. "inactive" when the skill is installed but not currently activated. "error" when the skill failed to load (malformed SKILL.md, missing dependency, etc.).
	Status SkillStatus `json:"status"`

	// Verified True when the skill has been verified by the Omnipus team. Unverified skills require explicit trust grant before use.
	Verified bool `json:"verified"`

	// Version Semantic version string (e.g. "1.2.3"). Must follow semver format.
	Version string `json:"version"`
}

// SkillStatus "active" when the skill is loaded and its tools are available to agents. "disabled" when the skill has been installed but deactivated. "inactive" when the skill is installed but not currently activated. "error" when the skill failed to load (malformed SKILL.md, missing dependency, etc.).
type SkillStatus string

// SkillInstallRequest Request body for POST /api/v1/skills/install. Installs a skill from the ClawHub registry by name.
type SkillInstallRequest struct {
	// Name Skill name to install from the ClawHub registry.
	Name string `json:"name"`
}

// SkillTrustResponse Skill trust level returned by GET /api/v1/security/skill-trust.
type SkillTrustResponse struct {
	// Level Current skill trust level. Controls how unverified community skills are handled.
	Level SkillTrustResponseLevel `json:"level"`
}

// SkillTrustResponseLevel Current skill trust level. Controls how unverified community skills are handled.
type SkillTrustResponseLevel string

// SkillTrustUpdateRequest Request body for PUT /api/v1/security/skill-trust. Updates the skill trust level; controls how unverified community skills are handled.
type SkillTrustUpdateRequest struct {
	// Level New skill trust level.
	Level SkillTrustUpdateRequestLevel `json:"level"`
}

// SkillTrustUpdateRequestLevel New skill trust level.
type SkillTrustUpdateRequestLevel string

// SkillTrustUpdateResponse Response from PUT /api/v1/security/skill-trust. Returns save status and the now-active skill trust level.
type SkillTrustUpdateResponse struct {
	// AppliedLevel The skill trust level now active.
	AppliedLevel SkillTrustUpdateResponseAppliedLevel `json:"applied_level"`

	// RequiresRestart Always false — skill trust is hot-reloaded.
	RequiresRestart bool `json:"requires_restart"`

	// Saved True when the configuration was successfully persisted to disk.
	Saved bool `json:"saved"`

	// Warning Present when allow_all is selected — warns that hash verification is disabled.
	Warning *string `json:"warning,omitempty"`
}

// SkillTrustUpdateResponseAppliedLevel The skill trust level now active.
type SkillTrustUpdateResponseAppliedLevel string

// SseChatRequest Request body for POST /api/v1/chat (SSE streaming endpoint). Sends a user message to the agent and streams the response via Server-Sent Events.
type SseChatRequest struct {
	// Message The user message to send to the agent. Must not be empty.
	Message string `json:"message"`
}

// StorageStats Storage statistics returned by GET /api/v1/storage/stats. Reports session count, workspace disk usage, memory entry count, and any non-fatal warnings encountered while collecting the stats.
type StorageStats struct {
	// MemoryEntryCount Total number of memory entries across all agent stores.
	MemoryEntryCount int `json:"memory_entry_count"`

	// OldestSessionDate RFC3339 timestamp of the oldest session. Absent when no sessions exist.
	OldestSessionDate *time.Time `json:"oldest_session_date,omitempty"`

	// SessionCount Total number of sessions across all agent stores.
	SessionCount int `json:"session_count"`

	// Warnings Non-fatal errors encountered while collecting stats (e.g. unreadable agent stores). The response is still returned when warnings are present.
	Warnings *[]string `json:"warnings,omitempty"`

	// WorkspaceSizeBytes Total size in bytes of all agent workspace directories.
	WorkspaceSizeBytes int64 `json:"workspace_size_bytes"`
}

// Task A task record as returned by GET /tasks, GET /tasks/{id}/subtasks, and POST /tasks. Maps to the task.Task struct on the Go side.
type Task struct {
	// AgentId ID of the agent assigned to this task. Absent when unassigned.
	AgentId *string `json:"agent_id,omitempty"`

	// AgentName Display name of the assigned agent. Absent when unassigned.
	AgentName *string `json:"agent_name,omitempty"`

	// Artifacts Paths to output files or artifact references produced by the task.
	Artifacts *[]string `json:"artifacts,omitempty"`

	// CompletedAt RFC3339 timestamp when the task completed or failed. Absent while running.
	CompletedAt *time.Time `json:"completed_at,omitempty"`

	// CreatedAt RFC3339 timestamp when the task was created.
	CreatedAt *time.Time `json:"created_at,omitempty"`

	// CreatedBy Username of the user who created the task.
	CreatedBy *string `json:"created_by,omitempty"`

	// Id Unique task identifier (UUID).
	Id string `json:"id"`

	// ParentTaskId ID of the parent task (for subtasks). Absent on top-level tasks.
	ParentTaskId *string `json:"parent_task_id,omitempty"`

	// Priority Task priority (higher = more urgent). Default is 0.
	Priority int `json:"priority"`

	// Prompt Full task description / prompt given to the agent.
	Prompt string `json:"prompt"`

	// Result Text result produced by the agent on completion. Absent while running.
	Result *string `json:"result,omitempty"`

	// SessionId Session ID created when the task was started.
	SessionId *string `json:"session_id,omitempty"`

	// StartedAt RFC3339 timestamp when the task was started. Absent until started.
	StartedAt *time.Time `json:"started_at,omitempty"`

	// Status Current lifecycle status of the task.
	Status TaskStatus `json:"status"`

	// Title Human-readable task title.
	Title string `json:"title"`

	// TriggerType How the task was triggered.
	TriggerType TaskTriggerType `json:"trigger_type"`
}

// TaskStatus Current lifecycle status of the task.
type TaskStatus string

// TaskTriggerType How the task was triggered.
type TaskTriggerType string

// TaskAcceptedResponse Response from POST /api/v1/tasks/{id}/start (HTTP 202 Accepted). Confirms that the task has been queued for execution.
type TaskAcceptedResponse struct {
	// Status Acceptance status. Always "accepted".
	Status TaskAcceptedResponseStatus `json:"status"`

	// TaskId The ID of the task that was accepted for execution.
	TaskId string `json:"task_id"`
}

// TaskAcceptedResponseStatus Acceptance status. Always "accepted".
type TaskAcceptedResponseStatus string

// TaskCreateRequest Request body for POST /api/v1/tasks. Creates a new task. The fields name/description are backward-compat aliases for title/prompt.
type TaskCreateRequest struct {
	// AgentId Agent to assign the task to.
	AgentId *string `json:"agent_id,omitempty"`

	// Description Backward-compat alias for prompt.
	Description *string `json:"description,omitempty"`

	// Name Backward-compat alias for title.
	Name *string `json:"name,omitempty"`

	// ParentTaskId Parent task ID (for creating subtasks).
	ParentTaskId *string `json:"parent_task_id,omitempty"`

	// Priority Task priority (higher = more urgent). Defaults to 3.
	Priority *int `json:"priority,omitempty"`

	// Prompt Task description / prompt for the agent.
	Prompt *string `json:"prompt,omitempty"`

	// Title Task title.
	Title string `json:"title"`

	// TriggerType How the task was triggered. Defaults to "manual".
	TriggerType *TaskCreateRequestTriggerType `json:"trigger_type,omitempty"`
}

// TaskCreateRequestTriggerType How the task was triggered. Defaults to "manual".
type TaskCreateRequestTriggerType string

// TaskUpdateRequest Request body for PUT /api/v1/tasks/{id}. Updates fields on an existing task. All fields are optional — only provided fields are updated. The fields name/description are backward-compat aliases for title/result.
type TaskUpdateRequest struct {
	// AgentId Agent to re-assign the task to.
	AgentId *string `json:"agent_id,omitempty"`

	// Artifacts List of artifact paths produced by the task.
	Artifacts *[]string `json:"artifacts,omitempty"`

	// CompletedAt When the task completed execution.
	CompletedAt *time.Time `json:"completed_at,omitempty"`

	// Description Backward-compat alias for result.
	Description *string `json:"description,omitempty"`

	// Name Backward-compat alias for title.
	Name *string `json:"name,omitempty"`

	// Priority New task priority.
	Priority *int `json:"priority,omitempty"`

	// Result Task result or output summary.
	Result *string `json:"result,omitempty"`

	// StartedAt When the task started execution.
	StartedAt *time.Time `json:"started_at,omitempty"`

	// Status New task status.
	Status *TaskUpdateRequestStatus `json:"status,omitempty"`

	// Title New task title.
	Title *string `json:"title,omitempty"`
}

// TaskUpdateRequestStatus New task status.
type TaskUpdateRequestStatus string

// ToolApprovalActionRequest Request body for POST /api/v1/tool-approvals/{approval_id}. Resolves a pending tool call approval by approving, denying, or cancelling it. For tools with RequiresAdminAsk=true the caller must hold the admin role (FR-015).
type ToolApprovalActionRequest struct {
	// Action Action to take on this approval.
	Action ToolApprovalActionRequestAction `json:"action"`
}

// ToolApprovalActionRequestAction Action to take on this approval.
type ToolApprovalActionRequestAction string

// ToolApprovalResponse Response from POST /api/v1/tool-approvals/{approval_id}. Confirms that the approval action was processed.
type ToolApprovalResponse struct {
	// Action The action that was applied.
	Action ToolApprovalResponseAction `json:"action"`

	// ApprovalId The approval ID that was resolved.
	ApprovalId string `json:"approval_id"`

	// Status Result status. Always "ok" when the action was accepted.
	Status ToolApprovalResponseStatus `json:"status"`
}

// ToolApprovalResponseAction The action that was applied.
type ToolApprovalResponseAction string

// ToolApprovalResponseStatus Result status. Always "ok" when the action was accepted.
type ToolApprovalResponseStatus string

// ToolCall A single tool invocation recorded in a transcript entry. Maps to session.ToolCall on the Go side and ToolCall interface in src/lib/api.ts.
type ToolCall struct {
	// DurationMs Elapsed time in milliseconds. Absent when still running.
	DurationMs *int64 `json:"duration_ms,omitempty"`

	// Id Unique tool call identifier (ToolCallID type on the Go side).
	Id string `json:"id"`

	// Parameters Input parameters passed to the tool.
	Parameters *map[string]interface{} `json:"parameters,omitempty"`

	// ParentToolCallId Parent tool call ID for nested subagent tool invocations.
	ParentToolCallId *string `json:"parent_tool_call_id,omitempty"`

	// Result Return value from the tool. Shape is tool-specific.
	Result *map[string]interface{} `json:"result,omitempty"`

	// Status Outcome of the tool call.
	Status ToolCallStatus `json:"status"`

	// Tool Tool name as registered in the tool registry (e.g. "workspace.shell", "web_search").
	Tool string `json:"tool"`
}

// ToolCallStatus Outcome of the tool call.
type ToolCallStatus string

// ToolPolicy A policy value governing whether a tool call is allowed, requires approval, or is denied.
type ToolPolicy string

// ToolRegistryEntry A single entry in the central tool registry snapshot returned by GET /api/v1/tools (FR-027).
type ToolRegistryEntry struct {
	// Category Tool category prefix derived from the tool name (e.g. "workspace", "browser", "system") or "general".
	Category string `json:"category"`

	// Description Human-readable description of what the tool does.
	Description string `json:"description"`

	// Name Canonical tool name (e.g. "workspace.shell", "browser.navigate").
	Name string `json:"name"`

	// Scope Tool visibility scope.
	Scope ToolRegistryEntryScope `json:"scope"`

	// Source Origin of the tool registration. "builtin" = compiled-in Go tool; "mcp" = MCP server tool.
	Source ToolRegistryEntrySource `json:"source"`
}

// ToolRegistryEntryScope Tool visibility scope.
type ToolRegistryEntryScope string

// ToolRegistryEntrySource Origin of the tool registration. "builtin" = compiled-in Go tool; "mcp" = MCP server tool.
type ToolRegistryEntrySource string

// UploadFilesResponse Response from POST /api/v1/upload (HTTP 201). Returns the list of uploaded files with their metadata.
type UploadFilesResponse struct {
	// Files Uploaded file metadata entries.
	Files []UploadedFile `json:"files"`
}

// UploadedFile Metadata for a single successfully uploaded file, as returned in the POST /upload response body's "files" array. Callers use the path field to construct the /api/v1/uploads/{session_id}/{filename} download URL.
type UploadedFile struct {
	// ContentType Detected MIME type of the uploaded file.
	ContentType string `json:"content_type"`

	// Name Sanitised filename as stored on disk.
	Name string `json:"name"`

	// Path Relative path within the uploads directory for constructing a download URL. Format: "uploads/{session_id}/{filename}".
	Path string `json:"path"`

	// Ref media:// ref registered for this file in the media store. Present when the server could register the file (always, for now). The SPA echoes this ref back in the message frame's "media" array so the agent loop can thread the file into the LLM content array as a multimodal content block. Empty if registration failed (the file is still downloadable via path).
	Ref *string `json:"ref,omitempty"`

	// Size File size in bytes.
	Size int64 `json:"size"`
}

// User Represents a gateway user account as returned by GET /users and POST /users. Password hashes and token hashes are NEVER included in responses — only the boolean presence flags are exposed.
type User struct {
	// HasActiveToken True when the user's token_hash is non-empty (i.e. a bearer token is currently issued).
	HasActiveToken bool `json:"has_active_token"`

	// HasPassword True when the user's password_hash is non-empty (i.e. a password has been set).
	HasPassword bool `json:"has_password"`

	// Role RBAC role. Case-sensitive.
	Role UserRole `json:"role"`

	// Username Login name. Immutable after creation.
	Username string `json:"username"`
}

// UserRole RBAC role. Case-sensitive.
type UserRole string

// UserContextRequest Request body for PUT /api/v1/user-context. Replaces the entire content of USER.md in the default workspace. Passing an empty string clears the file.
type UserContextRequest struct {
	// Content Full replacement content for USER.md. May be empty to clear the file. Maximum 262144 bytes (256 KB). The underlying filesystem write via fileutil.WriteFileAtomic provides the physical limit; this schema constraint enforces a reasonable upper bound at the API layer.
	Content string `json:"content"`
}

// UserContextResponse Response from GET /api/v1/user-context and PUT /api/v1/user-context. Returns the current content of USER.md in the default workspace. An empty string means the file does not exist or has not been written yet.
type UserContextResponse struct {
	// Content Current content of USER.md. Empty string when the file does not exist or has not been set yet.
	Content string `json:"content"`
}

// UserCreateRequest Body for POST /users. Creates a new user account. Admin-only.
type UserCreateRequest struct {
	// Password Initial password. Minimum 8 characters, maximum 72 (bcrypt limit).
	Password string `json:"password"`

	// Role RBAC role. Case-sensitive; exactly "admin" or "user".
	Role UserCreateRequestRole `json:"role"`

	// Username Must start with an alphanumeric and contain only letters, digits, dots, dashes, and underscores. Length 2-63 characters.
	Username string `json:"username"`
}

// UserCreateRequestRole RBAC role. Case-sensitive; exactly "admin" or "user".
type UserCreateRequestRole string

// UserCreateResponse Returned with HTTP 201 on successful POST /users. Contains the new user's identity fields. No token is issued — the user must log in explicitly.
type UserCreateResponse struct {
	// RequiresRestart Present and true when config was saved to disk but the in-memory hot-reload failed. The gateway must be restarted for the user to be able to log in.
	RequiresRestart *bool `json:"requires_restart,omitempty"`

	// Role The created user's RBAC role.
	Role UserCreateResponseRole `json:"role"`

	// Username The created user's login name.
	Username string `json:"username"`

	// Warning Human-readable explanation when requires_restart is true.
	Warning *string `json:"warning,omitempty"`
}

// UserCreateResponseRole The created user's RBAC role.
type UserCreateResponseRole string

// UserDeleteResponse Returned on successful DELETE /users/{username}.
type UserDeleteResponse struct {
	// Deleted Always true on success.
	Deleted bool `json:"deleted"`

	// RequiresRestart Present and true when hot-reload failed after the deletion.
	RequiresRestart *bool `json:"requires_restart,omitempty"`

	// Username The deleted user's login name.
	Username string `json:"username"`

	// Warning Human-readable explanation when requires_restart is true.
	Warning *string `json:"warning,omitempty"`
}

// UserResetPasswordRequest Body for PUT /users/{username}/password. Admin resets another user's password. This is NOT the self-change-password endpoint — that is POST /auth/change-password. After a successful reset the target user's bearer token is also invalidated, requiring them to log in again with the new password.
type UserResetPasswordRequest struct {
	// Password New password for the target user. Minimum 8 characters, maximum 72 (bcrypt limit).
	Password string `json:"password"`
}

// UserResetPasswordResponse Returned on successful PUT /users/{username}/password.
type UserResetPasswordResponse struct {
	// PasswordReset Always true on success.
	PasswordReset bool `json:"password_reset"`

	// RequiresRestart Present and true when hot-reload failed after the password reset.
	RequiresRestart *bool `json:"requires_restart,omitempty"`

	// Username The affected user's login name.
	Username string `json:"username"`

	// Warning Human-readable explanation when requires_restart is true.
	Warning *string `json:"warning,omitempty"`
}

// UserRoleChangeRequest Body for PATCH /users/{username}/role. Changes a user's RBAC role. Admin-only.
type UserRoleChangeRequest struct {
	// Role New role. Case-sensitive; exactly "admin" or "user".
	Role UserRoleChangeRequestRole `json:"role"`
}

// UserRoleChangeRequestRole New role. Case-sensitive; exactly "admin" or "user".
type UserRoleChangeRequestRole string

// UserRoleChangeResponse Returned on successful PATCH /users/{username}/role.
type UserRoleChangeResponse struct {
	// RequiresRestart Present and true when hot-reload failed after the role change.
	RequiresRestart *bool `json:"requires_restart,omitempty"`

	// Role The new role.
	Role UserRoleChangeResponseRole `json:"role"`

	// Username The affected user's login name.
	Username string `json:"username"`

	// Warning Human-readable explanation when requires_restart is true.
	Warning *string `json:"warning,omitempty"`
}

// UserRoleChangeResponseRole The new role.
type UserRoleChangeResponseRole string

// ValidateTokenResponse Response from GET /api/v1/auth/validate. Confirms the current bearer token is valid and returns the associated user's role.
type ValidateTokenResponse struct {
	// Role The RBAC role of the authenticated user.
	Role ValidateTokenResponseRole `json:"role"`

	// Username The authenticated user's login name.
	Username string `json:"username"`
}

// ValidateTokenResponseRole The RBAC role of the authenticated user.
type ValidateTokenResponseRole string

// VersionResponse Response from GET /api/v1/version. Returns build identity information. Used by the frontend to detect version drift and show "New version available" prompts (issue #110). No authentication required.
type VersionResponse struct {
	// BuildSha VCS revision SHA embedded at build time via debug.ReadBuildInfo(). Value is "dev" when built outside a version-controlled tree or when vcs.revision is not set (e.g. go run). Otherwise a 7-40 character lowercase hex SHA.
	BuildSha string `json:"build_sha"`

	// Version Omnipus gateway version string (e.g. "0.1.0"). Must follow semver format.
	Version string `json:"version"`
}

// N400BadRequest Standard error envelope returned by all non-2xx responses.
type N400BadRequest = ErrorResponse

// N401Unauthorized Standard error envelope returned by all non-2xx responses.
type N401Unauthorized = ErrorResponse

// N403Forbidden Standard error envelope returned by all non-2xx responses.
type N403Forbidden = ErrorResponse

// N404NotFound Standard error envelope returned by all non-2xx responses.
type N404NotFound = ErrorResponse

// N409Conflict Standard error envelope returned by all non-2xx responses.
type N409Conflict = ErrorResponse

// N422UnprocessableEntity Standard error envelope returned by all non-2xx responses.
type N422UnprocessableEntity = ErrorResponse

// N429TooManyRequests Standard error envelope returned by all non-2xx responses.
type N429TooManyRequests = ErrorResponse

// N500InternalServerError Standard error envelope returned by all non-2xx responses.
type N500InternalServerError = ErrorResponse

// N503ServiceUnavailable Standard error envelope returned by all non-2xx responses.
type N503ServiceUnavailable = ErrorResponse

// bearerAuthContextKey is the context key for BearerAuth security scheme
type bearerAuthContextKey string

// ConfigureChannelJSONBody defines parameters for ConfigureChannel.
type ConfigureChannelJSONBody map[string]interface{}

// DeleteCredential200JSONResponseBodyStatus defines parameters for DeleteCredential.
type DeleteCredential200JSONResponseBodyStatus string

// RestoreBackup200JSONResponseBodyStatus defines parameters for RestoreBackup.
type RestoreBackup200JSONResponseBodyStatus string

// UpdateExecAllowlistJSONBody defines parameters for UpdateExecAllowlist.
type UpdateExecAllowlistJSONBody struct {
	// AllowedBinaries List of allowed binary name patterns.
	AllowedBinaries []string `json:"allowed_binaries"`
}

// ListSessionsParams defines parameters for ListSessions.
type ListSessionsParams struct {
	// AgentId Filter by agent ID.
	AgentId *string `form:"agent_id,omitempty" json:"agent_id,omitempty"`

	// Type Filter by session type.
	Type *ListSessionsParamsType `form:"type,omitempty" json:"type,omitempty"`
}

// ListSessionsParamsType defines parameters for ListSessions.
type ListSessionsParamsType string

// ListSessions200JSONResponseBody0 defines parameters for ListSessions.
type ListSessions200JSONResponseBody0 = []Session

// ListSessions200JSONResponseBody1 defines parameters for ListSessions.
type ListSessions200JSONResponseBody1 struct {
	// PartialErrors Opaque error tokens (agent ID + sanitized reason).
	PartialErrors []string  `json:"partial_errors"`
	Sessions      []Session `json:"sessions"`
}

// ListSessions200JSONResponseBody defines parameters for ListSessions.
type ListSessions200JSONResponseBody struct {
	union json.RawMessage
}

// ClearAllSessions200JSONResponseBodyStatus defines parameters for ClearAllSessions.
type ClearAllSessions200JSONResponseBodyStatus string

// ListTasksParams defines parameters for ListTasks.
type ListTasksParams struct {
	// Status Filter tasks by status.
	Status *ListTasksParamsStatus `form:"status,omitempty" json:"status,omitempty"`
}

// ListTasksParamsStatus defines parameters for ListTasks.
type ListTasksParamsStatus string

// UploadFilesMultipartBody defines parameters for UploadFiles.
type UploadFilesMultipartBody struct {
	// Files One or more files to upload.
	Files *[]openapi_types.File `json:"files,omitempty"`

	// SessionId Session ID (alternative to query parameter).
	SessionId *string `json:"session_id,omitempty"`
}

// UploadFilesParams defines parameters for UploadFiles.
type UploadFilesParams struct {
	// SessionId Session ID to associate the uploaded files with. May also be supplied as a multipart form field.
	SessionId *string `form:"session_id,omitempty" json:"session_id,omitempty"`
}

// CreateAgentJSONRequestBody defines body for CreateAgent for application/json ContentType.
type CreateAgentJSONRequestBody = AgentCreateRequest

// PatchAgentOwnershipJSONRequestBody defines body for PatchAgentOwnership for application/json ContentType.
type PatchAgentOwnershipJSONRequestBody = AgentOwnershipUpdateRequest

// UpdateAgentJSONRequestBody defines body for UpdateAgent for application/json ContentType.
type UpdateAgentJSONRequestBody = AgentUpdateRequest

// UpdateAgentToolsJSONRequestBody defines body for UpdateAgentTools for application/json ContentType.
type UpdateAgentToolsJSONRequestBody = AgentToolsUpdateRequest

// ChangePasswordJSONRequestBody defines body for ChangePassword for application/json ContentType.
type ChangePasswordJSONRequestBody = ChangePasswordRequest

// LoginJSONRequestBody defines body for Login for application/json ContentType.
type LoginJSONRequestBody = LoginRequest

// RegisterAdminJSONRequestBody defines body for RegisterAdmin for application/json ContentType.
type RegisterAdminJSONRequestBody = RegisterAdminRequest

// ConfigureChannelJSONRequestBody defines body for ConfigureChannel for application/json ContentType.
type ConfigureChannelJSONRequestBody ConfigureChannelJSONBody

// SetChannelRoutingJSONRequestBody defines body for SetChannelRouting for application/json ContentType.
type SetChannelRoutingJSONRequestBody = ChannelRouting

// PostChatJSONRequestBody defines body for PostChat for application/json ContentType.
type PostChatJSONRequestBody = SseChatRequest

// SetCredentialJSONRequestBody defines body for SetCredential for application/json ContentType.
type SetCredentialJSONRequestBody = CredentialSetRequest

// AddMcpServerJSONRequestBody defines body for AddMcpServer for application/json ContentType.
type AddMcpServerJSONRequestBody = McpServerCreate

// CompleteOnboardingJSONRequestBody defines body for CompleteOnboarding for application/json ContentType.
type CompleteOnboardingJSONRequestBody = OnboardingCompleteRequest

// ProbeProviderJSONRequestBody defines body for ProbeProvider for application/json ContentType.
type ProbeProviderJSONRequestBody = ProbeProviderRequest

// UpdateProviderJSONRequestBody defines body for UpdateProvider for application/json ContentType.
type UpdateProviderJSONRequestBody = ProviderUpdateRequest

// RestoreBackupJSONRequestBody defines body for RestoreBackup for application/json ContentType.
type RestoreBackupJSONRequestBody = RestoreBackupRequest

// UpdateAuditLogToggleJSONRequestBody defines body for UpdateAuditLogToggle for application/json ContentType.
type UpdateAuditLogToggleJSONRequestBody = AuditLogToggleRequest

// UpdateExecAllowlistJSONRequestBody defines body for UpdateExecAllowlist for application/json ContentType.
type UpdateExecAllowlistJSONRequestBody UpdateExecAllowlistJSONBody

// UpdatePromptGuardJSONRequestBody defines body for UpdatePromptGuard for application/json ContentType.
type UpdatePromptGuardJSONRequestBody = PromptGuardUpdateRequest

// UpdateRateLimitsJSONRequestBody defines body for UpdateRateLimits for application/json ContentType.
type UpdateRateLimitsJSONRequestBody = RateLimitsUpdateRequest

// UpdateRetentionJSONRequestBody defines body for UpdateRetention for application/json ContentType.
type UpdateRetentionJSONRequestBody = RetentionConfig

// UpdateSandboxConfigJSONRequestBody defines body for UpdateSandboxConfig for application/json ContentType.
type UpdateSandboxConfigJSONRequestBody = SandboxConfigUpdate

// UpdateSessionScopeJSONRequestBody defines body for UpdateSessionScope for application/json ContentType.
type UpdateSessionScopeJSONRequestBody = SessionScopeRequest

// UpdateSkillTrustJSONRequestBody defines body for UpdateSkillTrust for application/json ContentType.
type UpdateSkillTrustJSONRequestBody = SkillTrustUpdateRequest

// UpdateGlobalToolPoliciesJSONRequestBody defines body for UpdateGlobalToolPolicies for application/json ContentType.
type UpdateGlobalToolPoliciesJSONRequestBody = GlobalToolPolicies

// CreateSessionJSONRequestBody defines body for CreateSession for application/json ContentType.
type CreateSessionJSONRequestBody = SessionCreateRequest

// RenameSessionJSONRequestBody defines body for RenameSession for application/json ContentType.
type RenameSessionJSONRequestBody = SessionRenameRequest

// InstallSkillJSONRequestBody defines body for InstallSkill for application/json ContentType.
type InstallSkillJSONRequestBody = SkillInstallRequest

// PatchAppStateJSONRequestBody defines body for PatchAppState for application/json ContentType.
type PatchAppStateJSONRequestBody = AppStatePatchRequest

// CreateTaskJSONRequestBody defines body for CreateTask for application/json ContentType.
type CreateTaskJSONRequestBody = TaskCreateRequest

// UpdateTaskJSONRequestBody defines body for UpdateTask for application/json ContentType.
type UpdateTaskJSONRequestBody = TaskUpdateRequest

// PostToolApprovalJSONRequestBody defines body for PostToolApproval for application/json ContentType.
type PostToolApprovalJSONRequestBody = ToolApprovalActionRequest

// CallMcpToolJSONRequestBody defines body for CallMcpTool for application/json ContentType.
type CallMcpToolJSONRequestBody = McpToolCallRequest

// UploadFilesMultipartRequestBody defines body for UploadFiles for multipart/form-data ContentType.
type UploadFilesMultipartRequestBody UploadFilesMultipartBody

// PutUserContextJSONRequestBody defines body for PutUserContext for application/json ContentType.
type PutUserContextJSONRequestBody = UserContextRequest

// CreateUserJSONRequestBody defines body for CreateUser for application/json ContentType.
type CreateUserJSONRequestBody = UserCreateRequest

// ResetUserPasswordJSONRequestBody defines body for ResetUserPassword for application/json ContentType.
type ResetUserPasswordJSONRequestBody = UserResetPasswordRequest

// ChangeUserRoleJSONRequestBody defines body for ChangeUserRole for application/json ContentType.
type ChangeUserRoleJSONRequestBody = UserRoleChangeRequest

// Getter for additional properties for ChannelConfigureRequest. Returns the specified
// element and whether it was found
func (a ChannelConfigureRequest) Get(fieldName string) (value interface{}, found bool) {
	if a.AdditionalProperties != nil {
		value, found = a.AdditionalProperties[fieldName]
	}
	return
}

// Setter for additional properties for ChannelConfigureRequest
func (a *ChannelConfigureRequest) Set(fieldName string, value interface{}) {
	if a.AdditionalProperties == nil {
		a.AdditionalProperties = make(map[string]interface{})
	}
	a.AdditionalProperties[fieldName] = value
}

// Override default JSON handling for ChannelConfigureRequest to handle AdditionalProperties
func (a *ChannelConfigureRequest) UnmarshalJSON(b []byte) error {
	object := make(map[string]json.RawMessage)
	err := json.Unmarshal(b, &object)
	if err != nil {
		return err
	}

	if raw, found := object["app_id"]; found {
		err = json.Unmarshal(raw, &a.AppId)
		if err != nil {
			return fmt.Errorf("error reading 'app_id': %w", err)
		}
		delete(object, "app_id")
	}

	if raw, found := object["app_secret"]; found {
		err = json.Unmarshal(raw, &a.AppSecret)
		if err != nil {
			return fmt.Errorf("error reading 'app_secret': %w", err)
		}
		delete(object, "app_secret")
	}

	if raw, found := object["bot_token"]; found {
		err = json.Unmarshal(raw, &a.BotToken)
		if err != nil {
			return fmt.Errorf("error reading 'bot_token': %w", err)
		}
		delete(object, "bot_token")
	}

	if raw, found := object["token"]; found {
		err = json.Unmarshal(raw, &a.Token)
		if err != nil {
			return fmt.Errorf("error reading 'token': %w", err)
		}
		delete(object, "token")
	}

	if raw, found := object["webhook_secret"]; found {
		err = json.Unmarshal(raw, &a.WebhookSecret)
		if err != nil {
			return fmt.Errorf("error reading 'webhook_secret': %w", err)
		}
		delete(object, "webhook_secret")
	}

	if len(object) != 0 {
		a.AdditionalProperties = make(map[string]interface{})
		for fieldName, fieldBuf := range object {
			var fieldVal interface{}
			err := json.Unmarshal(fieldBuf, &fieldVal)
			if err != nil {
				return fmt.Errorf("error unmarshaling field %s: %w", fieldName, err)
			}
			a.AdditionalProperties[fieldName] = fieldVal
		}
	}
	return nil
}

// Override default JSON handling for ChannelConfigureRequest to handle AdditionalProperties
func (a ChannelConfigureRequest) MarshalJSON() ([]byte, error) {
	var err error
	object := make(map[string]json.RawMessage)

	if a.AppId != nil {
		object["app_id"], err = json.Marshal(a.AppId)
		if err != nil {
			return nil, fmt.Errorf("error marshaling 'app_id': %w", err)
		}
	}

	if a.AppSecret != nil {
		object["app_secret"], err = json.Marshal(a.AppSecret)
		if err != nil {
			return nil, fmt.Errorf("error marshaling 'app_secret': %w", err)
		}
	}

	if a.BotToken != nil {
		object["bot_token"], err = json.Marshal(a.BotToken)
		if err != nil {
			return nil, fmt.Errorf("error marshaling 'bot_token': %w", err)
		}
	}

	if a.Token != nil {
		object["token"], err = json.Marshal(a.Token)
		if err != nil {
			return nil, fmt.Errorf("error marshaling 'token': %w", err)
		}
	}

	if a.WebhookSecret != nil {
		object["webhook_secret"], err = json.Marshal(a.WebhookSecret)
		if err != nil {
			return nil, fmt.Errorf("error marshaling 'webhook_secret': %w", err)
		}
	}

	for fieldName, field := range a.AdditionalProperties {
		object[fieldName], err = json.Marshal(field)
		if err != nil {
			return nil, fmt.Errorf("error marshaling '%s': %w", fieldName, err)
		}
	}
	return json.Marshal(object)
}

// Getter for additional properties for McpToolsListResponse_Item. Returns the specified
// element and whether it was found
func (a McpToolsListResponse_Item) Get(fieldName string) (value interface{}, found bool) {
	if a.AdditionalProperties != nil {
		value, found = a.AdditionalProperties[fieldName]
	}
	return
}

// Setter for additional properties for McpToolsListResponse_Item
func (a *McpToolsListResponse_Item) Set(fieldName string, value interface{}) {
	if a.AdditionalProperties == nil {
		a.AdditionalProperties = make(map[string]interface{})
	}
	a.AdditionalProperties[fieldName] = value
}

// Override default JSON handling for McpToolsListResponse_Item to handle AdditionalProperties
func (a *McpToolsListResponse_Item) UnmarshalJSON(b []byte) error {
	object := make(map[string]json.RawMessage)
	err := json.Unmarshal(b, &object)
	if err != nil {
		return err
	}

	if raw, found := object["args"]; found {
		err = json.Unmarshal(raw, &a.Args)
		if err != nil {
			return fmt.Errorf("error reading 'args': %w", err)
		}
		delete(object, "args")
	}

	if raw, found := object["command"]; found {
		err = json.Unmarshal(raw, &a.Command)
		if err != nil {
			return fmt.Errorf("error reading 'command': %w", err)
		}
		delete(object, "command")
	}

	if raw, found := object["enabled"]; found {
		err = json.Unmarshal(raw, &a.Enabled)
		if err != nil {
			return fmt.Errorf("error reading 'enabled': %w", err)
		}
		delete(object, "enabled")
	}

	if raw, found := object["id"]; found {
		err = json.Unmarshal(raw, &a.Id)
		if err != nil {
			return fmt.Errorf("error reading 'id': %w", err)
		}
		delete(object, "id")
	}

	if raw, found := object["name"]; found {
		err = json.Unmarshal(raw, &a.Name)
		if err != nil {
			return fmt.Errorf("error reading 'name': %w", err)
		}
		delete(object, "name")
	}

	if len(object) != 0 {
		a.AdditionalProperties = make(map[string]interface{})
		for fieldName, fieldBuf := range object {
			var fieldVal interface{}
			err := json.Unmarshal(fieldBuf, &fieldVal)
			if err != nil {
				return fmt.Errorf("error unmarshaling field %s: %w", fieldName, err)
			}
			a.AdditionalProperties[fieldName] = fieldVal
		}
	}
	return nil
}

// Override default JSON handling for McpToolsListResponse_Item to handle AdditionalProperties
func (a McpToolsListResponse_Item) MarshalJSON() ([]byte, error) {
	var err error
	object := make(map[string]json.RawMessage)

	if a.Args != nil {
		object["args"], err = json.Marshal(a.Args)
		if err != nil {
			return nil, fmt.Errorf("error marshaling 'args': %w", err)
		}
	}

	if a.Command != nil {
		object["command"], err = json.Marshal(a.Command)
		if err != nil {
			return nil, fmt.Errorf("error marshaling 'command': %w", err)
		}
	}

	object["enabled"], err = json.Marshal(a.Enabled)
	if err != nil {
		return nil, fmt.Errorf("error marshaling 'enabled': %w", err)
	}

	object["id"], err = json.Marshal(a.Id)
	if err != nil {
		return nil, fmt.Errorf("error marshaling 'id': %w", err)
	}

	object["name"], err = json.Marshal(a.Name)
	if err != nil {
		return nil, fmt.Errorf("error marshaling 'name': %w", err)
	}

	for fieldName, field := range a.AdditionalProperties {
		object[fieldName], err = json.Marshal(field)
		if err != nil {
			return nil, fmt.Errorf("error marshaling '%s': %w", fieldName, err)
		}
	}
	return json.Marshal(object)
}

// AsListSessions200JSONResponseBody0 returns the union data inside the ListSessions200JSONResponseBody as a ListSessions200JSONResponseBody0
func (t ListSessions200JSONResponseBody) AsListSessions200JSONResponseBody0() (ListSessions200JSONResponseBody0, error) {
	var body ListSessions200JSONResponseBody0
	err := json.Unmarshal(t.union, &body)
	return body, err
}

// FromListSessions200JSONResponseBody0 overwrites any union data inside the ListSessions200JSONResponseBody as the provided ListSessions200JSONResponseBody0
func (t *ListSessions200JSONResponseBody) FromListSessions200JSONResponseBody0(v ListSessions200JSONResponseBody0) error {
	b, err := json.Marshal(v)
	t.union = b
	return err
}

// MergeListSessions200JSONResponseBody0 performs a merge with any union data inside the ListSessions200JSONResponseBody, using the provided ListSessions200JSONResponseBody0
func (t *ListSessions200JSONResponseBody) MergeListSessions200JSONResponseBody0(v ListSessions200JSONResponseBody0) error {
	b, err := json.Marshal(v)
	if err != nil {
		return err
	}

	merged, err := runtime.JSONMerge(t.union, b)
	t.union = merged
	return err
}

// AsListSessions200JSONResponseBody1 returns the union data inside the ListSessions200JSONResponseBody as a ListSessions200JSONResponseBody1
func (t ListSessions200JSONResponseBody) AsListSessions200JSONResponseBody1() (ListSessions200JSONResponseBody1, error) {
	var body ListSessions200JSONResponseBody1
	err := json.Unmarshal(t.union, &body)
	return body, err
}

// FromListSessions200JSONResponseBody1 overwrites any union data inside the ListSessions200JSONResponseBody as the provided ListSessions200JSONResponseBody1
func (t *ListSessions200JSONResponseBody) FromListSessions200JSONResponseBody1(v ListSessions200JSONResponseBody1) error {
	b, err := json.Marshal(v)
	t.union = b
	return err
}

// MergeListSessions200JSONResponseBody1 performs a merge with any union data inside the ListSessions200JSONResponseBody, using the provided ListSessions200JSONResponseBody1
func (t *ListSessions200JSONResponseBody) MergeListSessions200JSONResponseBody1(v ListSessions200JSONResponseBody1) error {
	b, err := json.Marshal(v)
	if err != nil {
		return err
	}

	merged, err := runtime.JSONMerge(t.union, b)
	t.union = merged
	return err
}

func (t ListSessions200JSONResponseBody) MarshalJSON() ([]byte, error) {
	b, err := t.union.MarshalJSON()
	return b, err
}

func (t *ListSessions200JSONResponseBody) UnmarshalJSON(b []byte) error {
	err := t.union.UnmarshalJSON(b)
	return err
}
