model

type ActionRoute struct {
	ID      string       `yaml:"id" json:"id"`
	Match   MatchFilter  `yaml:"match" json:"match"`
	Actions []ActionSpec `yaml:"actions" json:"actions"`
}

type ActionRouteSet struct {
	Routes []ActionRoute `yaml:"routes" json:"routes"`
}

type ActionSpec struct {
	Type    string            `yaml:"type" json:"type"` // webhook, email, script
	URL     string            `yaml:"url,omitempty"`    // for webhook
	Headers map[string]string `yaml:"headers,omitempty"`

	Command string   `yaml:"command,omitempty"` // for script
	Args    []string `yaml:"args,omitempty"`    // optional args
}

type Agent struct {
	AgentID  string            `json:"agent_id"`
	HostID   string            `json:"host_id"`
	Hostname string            `json:"hostname"`
	IP       string            `json:"ip"`
	OS       string            `json:"os"`
	Arch     string            `json:"arch"`
	Version  string            `json:"version"`
	Labels   map[string]string `json:"labels"`

	EndpointID    string    `json:"endpoint_id"` // Computed from HostID
	LastSeen      time.Time `json:"last_seen"`
	Status        string    `json:"status"` // online/offline
	Since         string    `json:"since"`  // How long in current state
	StartTime     time.Time `json:"-"`
	UptimeSeconds float64   `json:"uptime_seconds"`
	Updated       bool      `json:"-"` // For in-memory use only
}

type AlertInstance struct {
	ID         string            `json:"id"`
	RuleID     string            `json:"rule_id"`
	EndpointID string            `json:"endpoint_id,omitempty"`
	State      string            `json:"state"`       // "ok", "firing", "resolved", "no_data"
	Previous   string            `json:"previous"`    // previous state
	Scope      string            `json:"scope"`       // "global", "endpoint", "agent", "user", "cloud" etc
	Target     string            `json:"target"`      // e.g. "endpoint_id", "agent_id", "user_id"
	FirstFired time.Time         `json:"first_fired"` // when it first started firing
	LastFired  time.Time         `json:"last_fired"`  // when it last evaluated as firing
	LastOK     time.Time         `json:"last_ok"`     // last time condition returned OK
	LastValue  float64           `json:"last_value"`  // most recent value
	Level      string            `json:"level"`       // from rule (info/warning/critical)
	Message    string            `json:"message"`     // expanded from template
	Labels     map[string]string `json:"labels"`
	ResolvedAt *time.Time        `json:"resolved_at,omitempty"` // when it was resolved
}

type AlertQuery struct {
	RuleID string
	State  string
	Level  string
	Target string
	Scope  string
	Sort   string // e.g. "first_fired desc"
	Limit  int
	Offset int
	Order  string
	Tags   map[string]string
}

type AlertRule struct {
	ID          string        `json:"id" yaml:"id"`
	Name        string        `json:"name" yaml:"name"`
	Description string        `json:"description,omitempty" yaml:"description,omitempty"`
	Message     string        `json:"message" yaml:"message"` // message template for alert
	Level       string        `json:"level" yaml:"level"`     // info, warning, critical
	Enabled     bool          `json:"enabled" yaml:"enabled"`
	Type        string        `json:"type" yaml:"type"` // metric, log, event, composite
	Match       MatchCriteria `json:"match" yaml:"match"`
	Scope       Scope         `json:"scope" yaml:"scope"`
	Expression  Expression    `json:"expression" yaml:"expression"`
	Actions     []string      `json:"actions" yaml:"actions"`
	Options     Options       `json:"options" yaml:"options"`
}

type AlertSummary struct {
	RuleID     string    `json:"rule_id"`
	State      string    `json:"state"`       // "firing", "resolved", etc.
	LastChange time.Time `json:"last_change"` // based on LastFired
}

type AnsibleCommandResult struct {
	Output       string
	ExitCode     int
	ErrorMessage string
	Duration     time.Duration
	StartedAt    time.Time
	Changed      bool                   // was something changed?
	Stats        map[string]interface{} // from parsed play recap
}

type CommandRequest struct {
	AgentID     string   `json:"agent_id"`       // Unique identifier for the agent
	CommandType string   `json:"command_type"`   // e.g., "shell" or "ansible"
	CommandData string   `json:"command_data"`   // The actual shell command or playbook content
	Args        []string `json:"args,omitempty"` // Optional arguments for shell commands
}

type CommandResponse struct {
	Success      bool
	Output       string
	ErrorMessage string
}

type CommandResult struct {
	EndpointID   string `json:"endpoint_id"`
	Output       string `json:"output"`
	Success      bool   `json:"success"`
	ErrorMessage string `json:"error_message,omitempty"`
	Timestamp    string `json:"timestamp"` // ISO format
}

type Container struct {
	ContainerID string
	Name        string
	ImageName   string
	ImageID     string
	Runtime     string
	Status      string
	Heartbeat   string
	EndpointID  string
	HostID      string
	LastSeen    time.Time
	Labels      map[string]string
	Updated     bool
}

type DataPoint struct {
	// --- Common fields ---
	Attributes     map[string]string `json:"attributes,omitempty"`      // OTLP attribute map
	StartTimestamp time.Time         `json:"start_timestamp,omitempty"` // for cumulative metrics (Sum/Counter/Histogram)
	Timestamp      time.Time         `json:"timestamp"`                 // point timestamp

	// --- Depending on metric type: one of these is non-zero/non-nil ---
	// Gauge or Sum (counter)
	Value float64 `json:"value,omitempty"`

	// Histogram
	Count          uint64    `json:"count,omitempty"`
	Sum            float64   `json:"sum,omitempty"`
	BucketCounts   []uint64  `json:"bucket_counts,omitempty"`
	ExplicitBounds []float64 `json:"explicit_bounds,omitempty"`

	// Summary (percentiles)
	QuantileValues []QuantileValue `json:"quantile_values,omitempty"`

	// Exemplars (trace/span IDs for sampled measurements)
	Exemplars []Exemplar `json:"exemplars,omitempty"`
}

type Endpoint struct {
	EndpointID    string            `json:"endpoint_id"` // Computed from HostID
	HostID        string            `json:"host_id"`
	Hostname      string            `json:"hostname"`
	ContainerName string            `json:"container_name,omitempty"` // Only for containers
	IP            string            `json:"ip"`
	OS            string            `json:"os,omitempty"`
	Arch          string            `json:"arch,omitempty"`
	Version       string            `json:"version,omitempty"`
	Labels        map[string]string `json:"labels"`
	ContainerID   string            `json:"container_id,omitempty"` // Only for containers
	Name          string            `json:"name,omitempty"`         // Only for containers
	ImageName     string            `json:"image_name,omitempty"`   // Only for containers
	ImageID       string            `json:"image_id,omitempty"`     // Only for containers
	Runtime       string            `json:"runtime,omitempty"`      // Only for containers
	LastSeen      time.Time         `json:"last_seen"`
	Status        string            `json:"status"` // online/offline
	UptimeSeconds float64           `json:"uptime_seconds"`
	Updated       bool              `json:"-"` // For in-memory use only
}

type EventEntry struct {
	ID         string            `json:"id"`
	Timestamp  time.Time         `json:"timestamp"`
	Level      string            `json:"level"`    // info, warning, critical
	Type       string            `json:"type"`     // event type (system / alert)
	Category   string            `json:"category"` // metric, log, system, security
	Message    string            `json:"message"`
	Source     string            `json:"source"` // metric name, log source, etc.
	Scope      string            `json:"scope"`  // "endpoint", "system", etc.
	Target     string            `json:"target"` // "host-123", "gosight-core", etc.
	EndpointID string            `json:"endpoint_id"`
	Meta       map[string]string `json:"meta"` // additional tags/labels

}

type EventFilter struct {
	Limit      int
	Level      string
	HostID     string
	EndpointID string
	Type       string
	Category   string
	Scope      string
	Target     string
	Source     string
	Contains   string
	Start      *time.Time
	End        *time.Time
	SortOrder  string // "asc" or "desc"
}

type Exemplar struct {
	Value              float64           `json:"value"`              // exemplar value
	Timestamp          time.Time         `json:"timestamp"`          // when exemplar was recorded
	TraceID            string            `json:"trace_id,omitempty"` // 16-byte hex
	SpanID             string            `json:"span_id,omitempty"`  // 8-byte hex
	FilteredAttributes map[string]string `json:"filtered_attributes,omitempty"`
}

type Expression struct {
	Operator string      `json:"operator" yaml:"operator"`                     // >, <, =, !=, contains, regex
	Value    interface{} `json:"value" yaml:"value"`                           // number or string
	Datatype string      `json:"datatype,omitempty" yaml:"datatype,omitempty"` // percent, numeric, status
}

type LogEntry struct {
	// --- OTLP Timestamps (log record fields) ---
	Timestamp         time.Time `json:"timestamp"`                    // event time
	ObservedTimestamp time.Time `json:"observed_timestamp,omitempty"` // when collector saw it

	// --- OTLP Severity / Name / Body ----
	SeverityText   string `json:"severity_text,omitempty"`   // e.g. "ERROR", "INFO"
	SeverityNumber int32  `json:"severity_number,omitempty"` // numeric enum
	Name           string `json:"name,omitempty"`            // optional log name/event name

	Body string `json:"body,omitempty"` // the actual log payload

	// --- Trace correlation (to link logs ↔ traces) ----
	TraceID string `json:"trace_id,omitempty"` // 16-byte hex
	SpanID  string `json:"span_id,omitempty"`  // 8-byte hex
	Flags   uint32 `json:"flags,omitempty"`    // trace_flags

	//     since severity+attributes/body often suffice.) ---
	Level    string `json:"level,omitempty"`    // optional high-level level
	Message  string `json:"message,omitempty"`  // optional duplicate of Body
	Source   string `json:"source,omitempty"`   // e.g. "journald", "nginx"
	Category string `json:"category,omitempty"` // e.g. "auth", "system", "app"

	PID int `json:"pid,omitempty"` // process ID, if you extract from attributes

	// Structured “fields” (e.g. JSON‐style sub‐fields)
	Fields map[string]string `json:"fields,omitempty"`

	// Custom labels/tags (user-defined or enriched)
	Labels map[string]string `json:"labels,omitempty"`

	// Any extra OTLP attributes you haven’t mapped above
	Attributes map[string]interface{} `json:"attributes,omitempty"`

	// Now just reference the unified Meta
	Meta *Meta `json:"meta,omitempty"`
}

type LogFilter struct {
	// Time range filter
	Start time.Time // Filter logs from this time onward
	End   time.Time // Filter logs until this time

	// Filtering by log properties
	EndpointID    string // Filter by endpoint ID (e.g., "host-123", "container-xyz")
	Target        string // Filter by target (e.g., "gosight-core", "host-123")
	Level         string // Filter by log level (e.g., "info", "warning", "error")
	Category      string // Filter by category (e.g., "system", "metric", "security")
	Source        string // Filter by source (e.g., "docker", "podman", "system")
	Contains      string // Filter by a substring match in the message
	Unit          string // Filter by systemd unit name (e.g., "nginx.service")
	AppName       string // Filter by application name (e.g., "nginx", "sshd")
	Service       string // For syslog/Windows Event Log
	EventID       string
	User          string
	ContainerID   string // if inside a container
	Platform      string
	ContainerName string // Windows event ID, etc.
	Meta          map[string]string
	Labels        map[string]string // Additional labels to filter by
	Extra         map[string]string
	Fields        map[string]string // Additional fields to filter by
	// Limit and sorting
	Limit  int    // Max number of logs to return
	Order  string // Order direction: "asc" or "desc"
	Cursor time.Time
	Offset int
}

type LogMeta struct {
	Platform      string            `json:"platform,omitempty"`       // journald, eventlog, syslog, etc.
	AppName       string            `json:"app_name,omitempty"`       // e.g., nginx, sshd
	AppVersion    string            `json:"app_version,omitempty"`    // if known
	ContainerID   string            `json:"container_id,omitempty"`   // if inside a container
	ContainerName string            `json:"container_name,omitempty"` // optional
	Unit          string            `json:"unit,omitempty"`           // For journald: systemd unit name
	Service       string            `json:"service,omitempty"`        // For syslog/Windows Event Log
	EventID       string            `json:"event_id,omitempty"`       // Windows event ID, etc.
	User          string            `json:"user,omitempty"`           // User associated with log entry
	Executable    string            `json:"exe,omitempty"`            // Path to binary if available
	Path          string            `json:"path,omitempty"`           // Original source log path
	Extra         map[string]string `json:"extra,omitempty"`          // For collector-specific fields
}

type LogPayload struct {
	AgentID    string
	HostID     string
	Hostname   string
	EndpointID string
	Timestamp  time.Time
	Logs       []LogEntry
	Meta       *Meta
}

type MatchCriteria struct {
	EndpointIDs []string          `json:"endpoint_ids,omitempty" yaml:"endpoint_ids,omitempty"`
	Labels      map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`
	Category    string            `json:"category,omitempty" yaml:"category,omitempty"`
	Source      string            `json:"source,omitempty" yaml:"source,omitempty"`
	Scope       string            `json:"scope,omitempty" yaml:"scope,omitempty"`
}

type MatchFilter struct {
	Level  string            `yaml:"level,omitempty" json:"level,omitempty"`     // warning, critical, etc
	RuleID string            `yaml:"rule_id,omitempty" json:"rule_id,omitempty"` // specific rule
	Tags   map[string]string `yaml:"tags,omitempty" json:"tags,omitempty"`       // meta.Tags match
}

type Meta struct {
	// --- Agent / Host / Endpoint context ---
	AgentID      string `json:"agent_id"`      // Unique ID for the agent
	AgentVersion string `json:"agent_version"` // Version of the agent

	HostID     string `json:"host_id"`     // Unique ID for the host
	EndpointID string `json:"endpoint_id"` // Unique ID for the endpoint
	ResourceID string `json:"resource_id"` // Unique ID for the resource
	Kind       string `json:"kind"`        // e.g. "host", "container", "service"

	Hostname           string `json:"hostname"`
	IPAddress          string `json:"ip_address"`
	OS                 string `json:"os,omitempty"`
	OSVersion          string `json:"os_version,omitempty"`
	Platform           string `json:"platform,omitempty"`
	PlatformFamily     string `json:"platform_family,omitempty"`
	PlatformVersion    string `json:"platform_version,omitempty"`
	KernelArchitecture string `json:"kernel_architecture,omitempty"`
	KernelVersion      string `json:"kernel_version,omitempty"`
	Architecture       string `json:"architecture,omitempty"`

	VirtualizationSystem string `json:"virtualization_system,omitempty"`
	VirtualizationRole   string `json:"virtualization_role,omitempty"`

	// --- Cloud / IaaS context ---
	CloudProvider    string `json:"cloud_provider,omitempty"` // AWS, Azure, GCP
	Region           string `json:"region,omitempty"`
	AvailabilityZone string `json:"availability_zone,omitempty"` // or Zone
	InstanceID       string `json:"instance_id,omitempty"`
	InstanceType     string `json:"instance_type,omitempty"`
	AccountID        string `json:"account_id,omitempty"`
	ProjectID        string `json:"project_id,omitempty"`     // GCP
	ResourceGroup    string `json:"resource_group,omitempty"` // Azure
	VPCID            string `json:"vpc_id,omitempty"`         // AWS, GCP
	SubnetID         string `json:"subnet_id,omitempty"`      // AWS, GCP, Azure
	ImageID          string `json:"image_id,omitempty"`       // AMI, Image, etc.
	ServiceID        string `json:"service_id,omitempty"`     // if a managed service is the source

	// --- Kubernetes / Container context ---
	ContainerID        string            `json:"container_id,omitempty"`
	ContainerName      string            `json:"container_name,omitempty"`
	ContainerImageID   string            `json:"container_image_id,omitempty"`
	ContainerImageName string            `json:"container_image_name,omitempty"`
	PodName            string            `json:"pod_name,omitempty"`
	PodUID             string            `json:"pod_uid,omitempty"`
	PodLabels          map[string]string `json:"pod_labels,omitempty"`
	PodAnnotations     map[string]string `json:"pod_annotations,omitempty"`
	DeploymentName     string            `json:"deployment_name,omitempty"`
	OwnerKind          string            `json:"owner_kind,omitempty"` // e.g. "Deployment", "ReplicaSet"
	OwnerName          string            `json:"owner_name,omitempty"`
	Namespace          string            `json:"namespace,omitempty"`
	NamespaceUID       string            `json:"namespace_uid,omitempty"`
	ClusterName        string            `json:"cluster_name,omitempty"`
	ClusterUID         string            `json:"cluster_uid,omitempty"`
	NodeName           string            `json:"node_name,omitempty"`
	NodeLabels         map[string]string `json:"node_labels,omitempty"`
	ServiceAccount     string            `json:"service_account,omitempty"`

	// --- Application / OTel Resource / Service context ---
	ServiceName               string `json:"service_name,omitempty"`           // OTel: service.name
	ServiceNamespace          string `json:"service_namespace,omitempty"`      // OTel: service.namespace
	ServiceInstanceID         string `json:"service_instance_id,omitempty"`    // OTel: service.instance.id
	ServiceVersion            string `json:"service_version,omitempty"`        // OTel: service.version
	TelemetrySDKName          string `json:"telemetry_sdk_name,omitempty"`     // OTel: telemetry.sdk.name
	TelemetrySDKVersion       string `json:"telemetry_sdk_version,omitempty"`  // OTel: telemetry.sdk.version
	TelemetrySDKLanguage      string `json:"telemetry_sdk_language,omitempty"` // OTel: telemetry.sdk.language
	InstrumentationLibrary    string `json:"instrumentation_library,omitempty"`
	InstrumentationLibVersion string `json:"instrumentation_lib_version,omitempty"`

	Application string `json:"application,omitempty"`
	Environment string `json:"environment,omitempty"` // dev, staging, prod
	Service     string `json:"service,omitempty"`     // if a microservice
	Version     string `json:"version,omitempty"`

	// --- Process / Runtime context ---
	ProcessID      int    `json:"process_id,omitempty"`
	ProcessName    string `json:"process_name,omitempty"`
	RuntimeName    string `json:"runtime_name,omitempty"`    // e.g. "go", "java"
	RuntimeVersion string `json:"runtime_version,omitempty"` // e.g. "go1.20"

	// --- Networking / Mesh / Security context ---
	PublicIP         string                 `json:"public_ip,omitempty"`
	PrivateIP        string                 `json:"private_ip,omitempty"`
	MACAddress       string                 `json:"mac_address,omitempty"`
	NetworkInterface string                 `json:"network_interface,omitempty"`
	MeshPeerVersion  string                 `json:"mesh_peer_version,omitempty"`
	MTLSEnabled      bool                   `json:"mtls_enabled,omitempty"`
	TLSVersion       string                 `json:"tls_version,omitempty"`
	CipherSuite      string                 `json:"cipher_suite,omitempty"`
	AuthMethod       string                 `json:"auth_method,omitempty"` // e.g. "oauth2", "api_key", "mtls"
	User             string                 `json:"user,omitempty"`        // OS‐level user or app‐level user
	JWTClaims        map[string]interface{} `json:"jwt_claims,omitempty"`

	// --- Deployment / CI-CD context ---
	DeploymentID   string `json:"deployment_id,omitempty"`
	GitCommitHash  string `json:"git_commit,omitempty"`
	BuildTimestamp string `json:"build_timestamp,omitempty"`

	// --- Log‐specific fields (formerly in LogMeta) ---
	AppName    string            `json:"app_name,omitempty"`    // e.g. "nginx", "mysvc"
	AppVersion string            `json:"app_version,omitempty"` // if known (e.g. "1.4.2")
	Unit       string            `json:"unit,omitempty"`        // systemd unit name (for journald)
	EventID    string            `json:"event_id,omitempty"`    // Windows Event ID or similar
	Executable string            `json:"exe,omitempty"`         // path to binary, if available
	Path       string            `json:"path,omitempty"`        // original source log path (e.g. "/var/log/nginx/error.log")
	Extra      map[string]string `json:"extra,omitempty"`       // any collector‐specific fields you previously put in LogMeta

	// --- Custom / User-defined tags & labels ---
	Labels map[string]string `json:"labels,omitempty"` // System-generated labels
	Tags   map[string]string `json:"tags,omitempty"`   // User-defined tags
}

type Metric struct {
	// Basic identity fields
	Namespace    string `json:"namespace,omitempty"`    // optional “namespace” (e.g., user‐defined grouping)
	SubNamespace string `json:"subnamespace,omitempty"` // optional
	Name         string `json:"name"`                   // metric name (OTLP: metric.name)
	Description  string `json:"description,omitempty"`  // OTLP: metric description
	Unit         string `json:"unit,omitempty"`         // OTLP: metric unit (e.g., "ms", "MiB")

	Source string `json:"source,omitempty"` // gopsutils, prometheus, etc.

	// DataType indicates how to interpret the DataPoints slice.
	// Common values: "gauge", "sum", "histogram", "summary", etc.
	DataType string `json:"type,omitempty"`

	// For "sum" (cumulative/counter) metrics, indicates aggregation temporality:
	//   "cumulative" or "delta"
	AggregationTemporality string `json:"aggregation_temporality,omitempty"`

	// Each metric may carry zero or more DataPoints (usually at least one).
	DataPoints []DataPoint `json:"data_points,omitempty"`

	// StorageResolution is your existing retention/rollup hint.
	StorageResolution int `json:"resolution,omitempty"`

	Meta *Meta `json:"meta,omitempty"` // optional metadata about the metric
}

type MetricPayload struct {
	AgentID    string    `json:"agent_id"`
	HostID     string    `json:"host_id"`
	Hostname   string    `json:"hostname"`
	EndpointID string    `json:"endpoint_id"`
	Metrics    []Metric  `json:"metrics"`
	Meta       *Meta     `json:"meta,omitempty"`
	Timestamp  time.Time `json:"timestamp"`
}

type MetricPoint struct {
	Timestamp int64   `json:"timestamp"` // Unix ms
	Value     float64 `json:"value"`     // Metric value
}

type MetricRow struct {
	Value     float64           `json:"value"`
	Labels    map[string]string `json:"tags"`
	Timestamp int64             `json:"timestamp"` // Unix ms
}

type MetricSelector struct {
	Name         string
	Namespace    string
	SubNamespace string
	Instant      bool // true = stat card, false = chart or long term
}

type NetworkDevice struct {
	ID        string    `db:"id"`         // UUID primary key
	Name      string    `db:"name"`       // human-readable label
	Vendor    string    `db:"vendor"`     // e.g. "sonicwall", "fortinet"
	Address   string    `db:"address"`    // IP or hostname
	Port      int       `db:"port"`       // syslog port (default 514)
	Protocol  string    `db:"protocol"`   // "udp", "tcp"
	Format    string    `db:"format"`     // "rfc3164", "rfc5424", "cef", etc.
	Facility  string    `db:"facility"`   // syslog facility, e.g. "local0"
	SyslogID  string    `db:"syslog_id"`  // vendor tag or hostname override
	RateLimit int       `db:"rate_limit"` // events/sec throttle (optional)
	CreatedAt time.Time `db:"created_at"` // record creation time
	UpdatedAt time.Time `db:"updated_at"` // record update time
	Status    string    `db:"status"`     // "enabled", "disabled"
}

type NetworkDeviceFilter struct {
	Name      string
	Vendor    string
	Address   string
	Port      int
	Protocol  string
	Format    string
	Facility  string
	SyslogID  string
	RateLimit int
	Limit     int
	Order     string
	Offset    int
	Status    string
}

type Options struct {
	Cooldown        string `json:"cooldown,omitempty" yaml:"cooldown,omitempty"`
	EvalInterval    string `json:"eval_interval,omitempty" yaml:"eval_interval,omitempty"`
	RepeatInterval  string `json:"repeat_interval,omitempty" yaml:"repeat_interval,omitempty"`
	NotifyOnResolve bool   `json:"notify_on_resolve,omitempty" yaml:"notify_on_resolve,omitempty"`
}

type Point struct {
	Timestamp string  `json:"timestamp"`
	Value     float64 `json:"value"`
}

type ProcessInfo struct {
	PID        int               `json:"pid"`
	PPID       int               `json:"ppid"`
	User       string            `json:"user"`
	Executable string            `json:"exe"`
	Cmdline    string            `json:"cmdline"`
	CPUPercent float64           `json:"cpu_percent"`
	MemPercent float64           `json:"mem_percent"`
	Threads    int               `json:"threads"`
	StartTime  time.Time         `json:"start_time"`
	Labels     map[string]string `json:"labels,omitempty"` // container_id, container_name, etc
}

type ProcessPayload struct {
	AgentID    string        `json:"agent_id"`
	HostID     string        `json:"host_id"`
	Hostname   string        `json:"hostname"`
	EndpointID string        `json:"endpoint_id"`
	Processes  []ProcessInfo `json:"processes"`
	Meta       *Meta         `json:"meta,omitempty"`
	Timestamp  time.Time     `json:"timestamp"`
}

type ProcessQueryFilter struct {
	EndpointID      string
	Start           time.Time
	End             time.Time
	MinCPU          float64
	MaxCPU          float64
	MinMemory       float64
	MaxMemory       float64
	User            string
	PID             int
	PPID            int
	ExeContains     string
	CmdlineContains string
	Labels          map[string]string
	SortBy          string
	SortDesc        bool
	Limit           int
	Offset          int
}

type ProcessSnapshot struct {
	Timestamp  time.Time     `json:"timestamp"`
	HostID     string        `json:"host_id"`
	EndpointID string        `json:"endpoint_id"`
	Processes  []ProcessInfo `json:"processes"`
	Meta       *Meta         `json:"meta"` // Same as metric/log meta
}

type QuantileValue struct {
	Quantile float64 `json:"quantile"` // e.g., 0.5 for p50
	Value    float64 `json:"value"`
}

type Resource struct {
	// ID is the unique identifier for this resource, generated from kind and labels.
	// Format: <kind>-<short-sha1-of-identifying-labels>
	// Example: "host-a1b2c3d4", "container-e5f6g7h8"
	ID string `json:"id" db:"id"`

	// Kind specifies the type of resource (agent, host, container, app, syslog).
	// This determines the resource's position in the hierarchy and its capabilities.
	Kind string `json:"kind" db:"kind"`

	// Name is the primary identifier for the resource, typically derived from
	// system metadata like hostname, container name, or service name.
	Name string `json:"name" db:"name"`

	// DisplayName is a human-readable name for UI display purposes.
	// May be the same as Name or a more descriptive variant.
	DisplayName string `json:"display_name" db:"display_name"`

	// Group provides logical grouping of resources, typically based on
	// environment, team, or deployment context.
	Group string `json:"group" db:"group_name"`

	// ParentID references the parent resource in the hierarchy.
	// Empty for root resources (agents and standalone syslog sources).
	ParentID string `json:"parent_id" db:"parent_id"`

	// Labels contains system-generated, immutable key-value pairs used for
	// resource identification and telemetry correlation. These are set by
	// agents and discovery processes and should not be modified by users.
	//
	// Common labels include:
	//   - agent_id: Unique agent identifier
	//   - host_id: Unique host identifier
	//   - container_id: Container runtime identifier
	//   - service: Service or application name
	Labels map[string]string `json:"labels"`

	// Tags contains user-defined, mutable key-value pairs for organization,
	// filtering, and operational metadata. These can be modified through
	// the API and UI for resource management.
	//
	// Common tags include:
	//   - env: Environment (prod, staging, dev)
	//   - team: Owning team
	//   - critical: Criticality level
	//   - version: Application version
	Tags map[string]string `json:"tags"`

	// Status indicates the current operational state of the resource.
	// This is independent of telemetry heartbeat and represents the
	// actual condition of the resource.
	Status string `json:"status" db:"status"`

	// LastSeen is the timestamp of the most recent telemetry or heartbeat
	// from this resource. Used for staleness detection and health monitoring.
	LastSeen time.Time `json:"last_seen" db:"last_seen"`

	// FirstSeen is the timestamp when this resource was first discovered
	// and registered in the system. Immutable after creation.
	FirstSeen time.Time `json:"first_seen" db:"first_seen"`

	// CreatedAt is the timestamp when this resource record was created
	// in the database. Used for auditing and lifecycle tracking.
	CreatedAt time.Time `json:"created_at" db:"created_at"`

	// UpdatedAt is the timestamp of the most recent update to this
	// resource record. Updated on any field modification.
	UpdatedAt time.Time `json:"updated_at" db:"updated_at"`

	// Location specifies the physical or logical location of the resource.
	// Examples: datacenter, region, availability zone, rack.
	Location string `json:"location" db:"location"`

	// Environment indicates the deployment environment context.
	// Examples: production, staging, development, test.
	Environment string `json:"environment" db:"environment"`

	// Owner identifies the team, user, or service responsible for this resource.
	// Used for accountability and access control.
	Owner string `json:"owner" db:"owner"`

	// Platform specifies the underlying platform or cloud provider.
	// Examples: aws, gcp, azure, kubernetes, bare-metal.
	Platform string `json:"platform" db:"platform"`

	// Runtime indicates the container runtime or execution environment.
	// Examples: docker, containerd, cri-o, runc.
	Runtime string `json:"runtime" db:"runtime"`

	// Version contains version information for the resource, such as
	// agent version, OS version, or application version.
	Version string `json:"version" db:"version"`

	// OS specifies the operating system running on the resource.
	// Examples: linux, windows, darwin.
	OS string `json:"os" db:"os"`

	// Arch indicates the processor architecture of the resource.
	// Examples: amd64, arm64, x86.
	Arch string `json:"arch" db:"arch"`

	// IPAddress contains the primary IP address associated with the resource.
	// Used for network-based correlation and connectivity information.
	IPAddress string `json:"ip_address" db:"ip_address"`

	// ResourceType provides additional classification within a kind.
	// Examples: "vm", "bare-metal", "serverless" for hosts.
	ResourceType string `json:"resource_type" db:"resource_type"`

	// Cluster identifies the cluster or orchestration group this resource
	// belongs to. Commonly used in Kubernetes and container environments.
	Cluster string `json:"cluster" db:"cluster"`

	// Namespace provides logical isolation within a cluster or platform.
	// Examples: Kubernetes namespace, Docker compose project.
	Namespace string `json:"namespace" db:"namespace"`

	// Annotations contains extended metadata for UI display, automation,
	// and integration purposes. Unlike tags, these are typically managed
	// by the system and external tools rather than users.
	Annotations map[string]string `json:"annotations"`

	// Updated is a transient flag indicating whether this resource has
	// been modified and needs to be persisted. Not stored in database.
	Updated bool `json:"-" db:"-"`
}

type ResourceFilter struct {
	// Kinds filters resources by their type (agent, host, container, app, syslog).
	// If empty, all kinds are included.
	Kinds []string `json:"kinds"`

	// Groups filters resources by their logical grouping.
	// If empty, all groups are included.
	Groups []string `json:"groups"`

	// Status filters resources by their operational state.
	// If empty, all statuses are included.
	Status []string `json:"status"`

	// Labels filters resources that have all specified label key-value pairs.
	// All specified labels must match (AND logic).
	Labels map[string]string `json:"labels"`

	// Tags filters resources that have all specified tag key-value pairs.
	// All specified tags must match (AND logic).
	Tags map[string]string `json:"tags"`

	// Environment filters resources by their deployment environment.
	// If empty, all environments are included.
	Environment []string `json:"environment"`

	// Owner filters resources by their assigned owner.
	// If empty, all owners are included.
	Owner []string `json:"owner"`

	// LastSeenSince filters resources that have been seen since the specified time.
	// Used for staleness detection and active resource queries.
	LastSeenSince *time.Time `json:"last_seen_since"`
}

type ResourceSearchQuery struct {
	// Query is the search text to match against resource names, labels, and tags.
	// Supports full-text search syntax and boolean operators.
	Query string `json:"query"`

	// Kinds restricts search to specific resource types.
	// If empty, all kinds are searched.
	Kinds []string `json:"kinds"`

	// Groups restricts search to specific resource groups.
	// If empty, all groups are searched.
	Groups []string `json:"groups"`

	// Status restricts search to resources with specific operational states.
	// If empty, all statuses are searched.
	Status []string `json:"status"`

	// Labels restricts search to resources with specific labels.
	// Applied as additional filters on top of the text query.
	Labels map[string]string `json:"labels"`

	// Tags restricts search to resources with specific tags.
	// Applied as additional filters on top of the text query.
	Tags map[string]string `json:"tags"`

	// Limit specifies the maximum number of results to return.
	// Default and maximum values are enforced by the implementation.
	Limit int `json:"limit"`

	// Offset specifies the number of results to skip for pagination.
	// Used in combination with Limit for result paging.
	Offset int `json:"offset"`
}

type Scope struct {
	Namespace    string `json:"namespace,omitempty" yaml:"namespace,omitempty"`
	SubNamespace string `json:"subnamespace,omitempty" yaml:"subnamespace,omitempty"`
	Metric       string `json:"metric,omitempty" yaml:"metric,omitempty"`
}

type ShellCommandResult struct {
	Output       string        // Full stdout and stderr combined
	ExitCode     int           // Actual exit code (0 = success)
	ErrorMessage string        // Error description if command failed (e.g. exec errors)
	Duration     time.Duration // How long it took to run
	StartedAt    time.Time     // Optional: when the command started
}

type SpanEvent struct {
	Name       string            `json:"name"`
	Timestamp  time.Time         `json:"timestamp"`
	Attributes map[string]string `json:"attributes,omitempty"`
}

type StatisticValues struct {
	Minimum     float64 `json:"min"`
	Maximum     float64 `json:"max"`
	SampleCount int     `json:"count"`
	Sum         float64 `json:"sum"`
}

type StoredLog struct {
	LogID string   `json:"log_id"`
	Log   LogEntry `json:"log"`
	Meta  *Meta    `json:"meta,omitempty"` // from LogPayload
}

type Tag struct {
	EndpointID string
	Key        string
	Value      string
}

type TracePayload struct {
	Meta   *Meta       `json:"meta"`
	Traces []TraceSpan `json:"traces"`
}

type TraceSpan struct {
	TraceID      string `json:"trace_id"`
	SpanID       string `json:"span_id"`
	ParentSpanID string `json:"parent_span_id,omitempty"`
	Name         string `json:"name"`
	ServiceName  string `json:"service_name,omitempty"`
	EndpointID   string `json:"endpoint_id,omitempty"`
	AgentID      string `json:"agent_id,omitempty"`
	HostID       string `json:"host_id,omitempty"`

	StartTime  time.Time `json:"start_time"`
	EndTime    time.Time `json:"end_time"`
	DurationMs float64   `json:"duration_ms"`

	StatusCode    string `json:"status_code,omitempty"` // "OK", "ERROR", etc.
	StatusMessage string `json:"status_message,omitempty"`

	Attributes map[string]string `json:"attributes,omitempty"` // OpenTelemetry key-value pairs

	Events        []SpanEvent       `json:"events,omitempty"`
	ResourceAttrs map[string]string `json:"resource_attrs,omitempty"` // service.name, host.name, etc.
	Meta          *Meta             `json:"meta,omitempty"`           // Additional metadata for the span
}