report

type Activity struct {
	// Entries is the number of audit entries in the period.
	Entries int `json:"entries"`
	// FirstEntry and LastEntry are the earliest and latest timestamps among
	// them; omitted when there are none.
	FirstEntry *time.Time `json:"first_entry,omitempty"`
	LastEntry  *time.Time `json:"last_entry,omitempty"`
	// Decisions always lists ALLOW, DENY and REQUIRE_APPROVAL, in that
	// order, then any other value found.
	Decisions  []Count `json:"decisions"`
	Scopes     Tally   `json:"scopes"`
	Transports Tally   `json:"transports"`
	Tenants    Tally   `json:"tenants"`
	Agents     Tally   `json:"agents"`
	// DenyRules and ApprovalRules are the matched rules of DENY and
	// REQUIRE_APPROVAL entries. A DENY no rule matched counts as
	// "(default deny)".
	DenyRules     Tally `json:"deny_rules"`
	ApprovalRules Tally `json:"approval_rules"`
	// AgentsSeen and SessionsSeen list the agent and session ids (entries
	// without a session id are not counted as a session).
	AgentsSeen   NameList `json:"agents_seen"`
	SessionsSeen NameList `json:"sessions_seen"`
	// RedactedEntries counts entries holding "[REDACTED]", the mask the
	// server's --audit-redact writes. UnmaskedSecretEntries counts entries
	// whose request or reason still matches one of the built-in secret
	// patterns.
	RedactedEntries       int `json:"redacted_entries"`
	UnmaskedSecretEntries int `json:"unmasked_secret_entries"`
	// UnsealedEntries counts entries in the period without a seal (no hash
	// or no seq). In server mode it is the only seal evidence per entry.
	UnsealedEntries int `json:"unsealed_entries"`
}

type Approvals struct {
	// Requested counts approval ids first sent for approval in the period.
	Requested int `json:"requested"`
	// Approved and Denied count approval ids whose human decision shows in
	// the period (allow:approved or deny:approved entries).
	Approved int `json:"approved"`
	Denied   int `json:"denied"`
	// NoOutcome counts ids requested in the period with no approved or
	// denied entry in it: timed out, resolved but never retried, resolved
	// after the period, or still pending.
	NoOutcome int `json:"no_outcome"`
	// TimedOut is always null: the audit log does not record time-outs.
	// They are among NoOutcome.
	TimedOut *int `json:"timed_out"`
}

type Check struct {
	Name string `json:"name"`
	// Status is pass, warn, fail or unknown (it can't be told from what the
	// report read).
	Status string `json:"status"`
	Detail string `json:"detail"`
}

type Control struct {
	Criterion string `json:"criterion"`
	Title     string `json:"title"`
	// Shows is what this report holds that bears on the criterion.
	Shows string `json:"shows"`
	// Where names the report's sections that hold it.
	Where []string `json:"where"`
}

type Count struct {
	Name  string `json:"name"`
	Count int    `json:"count"`
}

type Head struct {
	Seq       uint64     `json:"seq"`
	Hash      string     `json:"hash"`
	SegmentID string     `json:"segment_id,omitempty"`
	At        *time.Time `json:"at,omitempty"`
}

type Integrity struct {
	Method string `json:"method"`
	Status string `json:"status"`
	// Summary is one sentence for a person.
	Summary string `json:"summary"`
	// Seals says how the entries are sealed, e.g. "hmac-sha256 key
	// 3f9a…" or "sha256", in the order they appear. Empty when unknown.
	Seals []string `json:"seals,omitempty"`
	// KeyBased is true for an HMAC key, false for plain SHA-256, nil when
	// not sealed or not known. It is read from the log's _meta header,
	// which anyone who can write the file can forge: only Status intact
	// confirms it.
	KeyBased *bool `json:"key_based"`
	// Head is the latest seal anchor: the last sealed entry's seq and hash.
	Head *Head `json:"head,omitempty"`
	// Verify is audit verify's full report (verify method only).
	Verify *audit.VerifyReport `json:"verify,omitempty"`
}

type NameList struct {
	Count     int      `json:"count"`
	Names     []string `json:"names"`
	Truncated bool     `json:"truncated"`
}

type Period struct {
	Since time.Time `json:"since"`
	Until time.Time `json:"until"`
}

type PolicyFile struct {
	Path string `json:"path"`
	// SHA256 is the hex SHA-256 of the file's bytes when the report was
	// made.
	SHA256 string `json:"sha256"`
	// Found says how the file was chosen: "--policy", "AGENTGUARD_POLICY",
	// "the default" or "found automatically".
	Found string `json:"found"`
}

type Report struct {
	FormatVersion int `json:"format_version"`
	// GeneratedAt is when the report was made (UTC).
	GeneratedAt time.Time `json:"generated_at"`
	// AgentGuardVersion is the version of the binary that made the report,
	// e.g. "1.4.0 (abc1234)".
	AgentGuardVersion string `json:"agentguard_version"`
	Period            Period `json:"period"`
	Source            Source `json:"source"`
	// Policy is the policy file the report names, or nil when none was
	// given or found.
	Policy    *PolicyFile `json:"policy"`
	Integrity Integrity   `json:"integrity"`
	Activity  Activity    `json:"activity"`
	Approvals Approvals   `json:"approvals"`
	Posture   []Check     `json:"posture"`
	Controls  []Control   `json:"controls"`
	// Limits says what the report can't show. Read it with the numbers.
	Limits []string `json:"limits"`
}

type Source struct {
	Mode string `json:"mode"`
	// AuditLog is the live audit file (file mode).
	AuditLog string `json:"audit_log,omitempty"`
	// Files are the files read, oldest first, by base name (file mode).
	Files []string `json:"files,omitempty"`
	// BadLines counts lines in those files that are not audit entries
	// (file mode; always 0 in server mode, where the server skips them).
	BadLines int `json:"bad_lines"`
	// ReadErrors are files that could not be read to the end (file mode).
	// Entries before the error are in the report.
	ReadErrors []string `json:"read_errors,omitempty"`
	// Server is the server's URL and Tenant the tenant asked for (server
	// mode; Tenant is "local" for the legacy /v1/audit route).
	Server string `json:"server,omitempty"`
	Tenant string `json:"tenant,omitempty"`
	// Fetched counts the entries the server returned, and OutsidePeriod
	// those of them the report dropped because their timestamp is outside
	// the period: a server older than 1.4 does not filter by time.
	Fetched       int `json:"fetched,omitempty"`
	OutsidePeriod int `json:"outside_period,omitempty"`
	// AuthRequired is whether the server refused an audit query that
	// carried no API key (server mode). nil when it was not checked.
	AuthRequired *bool `json:"auth_required,omitempty"`
	// Warnings say why the entries may be incomplete, e.g. the server's
	// live file rotated while the report read it.
	Warnings []string `json:"warnings,omitempty"`
}

type Tally struct {
	Distinct int     `json:"distinct"`
	Top      []Count `json:"top"`
}