htmlexport

type Claim struct {
	Label string
	Body  string
}

type Command struct {
	Line string
	What string
}

type DiffBlock struct {
	// Label is the step coordinate, showing both ordinals when alignment put
	// different ones opposite each other.
	Label string
	// RunA and RunB name the two runs, so the side-by-side columns are
	// headed by the thing they are rather than by "A" and "B".
	RunA      string
	RunB      string
	AnchorA   string
	AnchorB   string
	StepA     int // -1 when the pair has no counterpart on that side
	StepB     int
	Operation string
	Target    string
	Actor     string
	Classes   []string
	// Coords is where in the chain and how far into the run — "hop 3, t+60s".
	Coords string

	// Rows are the field-level findings, one per differing path.
	Rows []DiffRow
	// Reordered is the same-elements-different-sequence finding, which is
	// the divergence that reads as "nothing changed" to every other tool.
	Reordered *ReorderView

	// Missing names the run that has no counterpart step, for an insertion
	// or a deletion.
	MissingFrom string
	// Truncated is set when the pair carried more field-level changes than
	// the engine keeps.
	Truncated     bool
	NoiseFiltered []string
	// Opaque marks a digest-only difference.
	Opaque bool
	// Suppressed marks a difference the downstream heuristic hid from the
	// causal view.
	Suppressed bool
}

type DiffRow struct {
	Path string
	A    string
	B    string
	// Kind is changed | only-in-A | only-in-B.
	Kind  string
	Class string
	// Gloss is a display convention the renderer added, never something the
	// bytes say — currently only the minor-units reading of a `_cents`
	// field. Stated separately so it can never be mistaken for stored data.
	GlossA string
	GlossB string
}

type DiffView struct {
	RunA, RunB     string
	CountA, CountB int
	// Summary is the headline sentence.
	Summary string
	// Aligner names the tier that produced the pairing (Q85), so the reader
	// knows whether steps were matched by stored key or by sequence.
	Aligner     string
	AlignerNote string

	First    *DiffBlock
	Featured *DiffBlock
	// FeaturedIsFirst is true when the engine featured the first divergence
	// itself — there is nothing after it to show. Templates cannot compare
	// pointers, and this is the comparison they need.
	FeaturedIsFirst bool
	// FeaturedIsConsequence distinguishes the strong claim ("this value came
	// out of that step and went into this one") from the weak one ("a later
	// difference").
	FeaturedIsConsequence bool
	FeaturedTitle         string
	LinkText              string

	// All is every difference in aligned order, including the suppressed
	// ones. The default terminal view hides them behind a count; the page
	// has room to show them, and the suppression note still names the rule.
	All []DiffBlock
	// Opaque are the pairs whose only difference is a payload-slot digest:
	// the receipt records that customer-held content changed, not what
	// changed in it. Never named as a cause.
	Opaque []DiffBlock

	SuppressedCount int
	SuppressionNote string
	OpaqueNote      string

	// Warnings are the handoffs to `behalf why`: the featured step sits on a
	// receipt whose stored attribution is not `verified`.
	Warnings []DiffWarning
	// AttributionNote states a run-wide authority difference that the action
	// diff deliberately does not count.
	AttributionNote    string
	WeakestA, WeakestB string
}

type DiffWarning struct {
	Operation string
	RunID     string
	Actor     string
	State     string
	Command   string
	// Unattributed is set when the receipt carries no delegation chain at
	// all, which is a different sentence from a weak one.
	Unattributed bool
}

type HopView struct {
	Depth    int
	MaxDepth int
	Label    string
	JKT      string
	// Status is the stored per-hop three-state: verified, asserted, broken
	// (Q12, D5).
	Status string
	// StatusWord is the display form; asserted is named, never collapsed
	// into failure.
	StatusWord string
	Method     string
	// Evidence is the human-readable evidence column: what makes this hop
	// verified, or empty when nothing does.
	Evidence    string
	EvidenceRef string

	// Checked and NotChecked are the per-state statement of what was and
	// was not established. Every `asserted` hop carries them; so does every
	// other state, because an unqualified "verified" is the more dangerous
	// half.
	Checked    []string
	NotChecked []string

	Intent string
	Scope  string
	// Attenuation is the read-time comparison against the parent hop,
	// stamped with the comparator version (Q11, Q13). Only shown when it
	// says something the reader must not miss.
	Attenuation       string
	AttenuationReason string

	Credential  why.Credential
	RootBinding *why.RootBinding
	Carriage    string
	JTI         string
	ParHash     string
	Exp         string
}

type LogIdentity struct {
	Dir      string
	Origin   string
	TreeSize uint64
	RootHex  string
	// Checkpoint is the signed note verbatim, as written in the log dir.
	Checkpoint string
	// Available is false when the checkpoint could not be read or did not
	// verify. The page then says so rather than showing a blank identity.
	Available bool
	// Commands are the verification commands, in the order to run them.
	Commands []Command
}

type Options struct {
	// LogDir is the tlog-tiles directory to read. Required.
	LogDir string
	// Runs is one or two run ids. One renders the single-run page; two
	// render the diff-led comparison.
	Runs []string
	// Store is the customer's payload CAS. A nil store is legal and
	// common: every slot then resolves `missing` and renders as a
	// placeholder, which is the normal path (Q83).
	Store *cas.Store
	// Aliases turns key thumbprints into display labels (Q16). Labels are
	// asserted, never evidence, and the page says so.
	Aliases why.Aliases

	// Now stamps the document's generation time. Zero means time.Now.
	Now time.Time
	// CollapseBytes and MaxInlineBytes override the defaults above.
	CollapseBytes  int
	MaxInlineBytes int
}

type Page struct {
	// Title is the document title and the <h1>.
	Title string
	// Subtitle names what the page is: one run, or two runs compared.
	Subtitle string
	// GeneratedAt is when this rendering was produced, RFC 3339 UTC. It is
	// a property of the RENDERING, never of the evidence: the receipts
	// carry their own capture times and this does not touch them.
	GeneratedAt string
	// Pair is true when two runs were given and the page leads with a diff.
	Pair bool

	Log   LogIdentity
	Diff  *DiffView
	Runs  []*RunView
	Trust TrustBlock

	// Notes collect anything this rendering could not show honestly from
	// the stored data — a missing checkpoint, an unreadable alias map. They
	// are printed on the page, not swallowed.
	Notes []string

	// Findings counts the payload slots whose stored bytes contradict the
	// digest committed in their signed receipt, across every run on the
	// page. The caller's warning line hangs off this.
	Findings int
}

type ReceiptView struct {
	Step      int
	Anchor    string
	LogIndex  uint64
	LeafHash  string
	ReceiptID string
	Kind      string
	RunID     string

	CapturedAt string
	// Elapsed is the offset from the run's first capture — "t+60s".
	Elapsed string

	Operation string
	Target    string
	Outcome   string
	OutcomeOK bool
	Amount    string
	Currency  string

	Actor    string
	ActorJKT string

	// Attribution and Class are the stored rollup and the stored attribution
	// class (Q12, §8), read and never recomputed.
	Attribution string
	Class       string

	Hops         []HopView
	VerifiedHops int
	TotalHops    int
	// Excess is the read-time scope finding: the operation exceeded the
	// ceiling the chain delegated. Recorded, never enforced (Q11, Q45).
	Excess *why.ScopeExcess

	Slots []SlotView
	// Findings is how many of this receipt's slots are tamper findings.
	Findings int
	// Differs marks a receipt the diff named as differing from its
	// counterpart, so the timeline can point at it.
	Differs bool
}

type ReorderView struct {
	Path  string
	Count int
	Index int
	// Fields are the differing sub-fields, named once because both sides
	// show the same fields in the same order.
	Fields []string
	RowsA  []string
	RowsB  []string
	// GlossA and GlossB parallel Rows with the renderer's display
	// conventions, empty where none applies.
	GlossA []string
	GlossB []string
}

type Rollup struct {
	Denominator int
	Rows        []RollupRow
	// Note states what the denominator is and where the numerators come
	// from — the reproducibility half of Q86.
	Note string
}

type RollupRow struct {
	State   string
	Count   int
	Percent string
	// Width is the bar segment's width. It is a CSS length by type, so the
	// template writes it into a style attribute without the escaper having
	// to guess whether a computed string is safe there.
	Width template.CSS
}

type RunView struct {
	ID      string
	Started string
	Ended   string
	// Status is `ok` unless some receipt records a failed operation. It is
	// not a completeness claim: run completeness is marked by a session-end
	// receipt, and the frozen kind enum has no such kind yet (Q82).
	Status string
	// Receipts is every receipt in the run view — log-index order filtered
	// to the run, the authoritative reconstruction order (Q58, Q82).
	Receipts []*ReceiptView
	// Actions counts the action-family receipts: the denominator of the
	// attribution metric (Q6, Q86).
	Actions int
	// Actor names the human at the root of the delegation chain — who the
	// run was carried out on behalf of. A display label off the local alias
	// map (Q16): asserted, never evidence.
	Actor    string
	ActorJKT string
	// Attribution is the run's weakest stored rollup (Q12).
	Attribution string
	// Rollup is the Q86 metric: the share of action receipts at each
	// verification state, with its denominator stated.
	Rollup Rollup
	// PayloadSummary counts the resolved slot states across the run.
	PayloadSummary string
	// Findings is how many slots contradicted their commitment.
	Findings int
	// Anchor is the run section's html id.
	Anchor string
}

type SlotView struct {
	Label       string
	Role        string
	State       string
	Committed   string
	Custody     string
	ContentType string
	Size        int
	SizeText    string
	Digest      string
	Ref         string
	CauseRef    string
	Subjects    []string

	// Placeholder is the typed stand-in for a non-present slot, rendered by
	// internal/payload so the HTML and the NDJSON say the same thing.
	Placeholder string

	// Content is the rendered payload: pretty-printed when the bytes are
	// JSON, verbatim when they are text, a typed summary when they are
	// binary. Non-empty only for a present slot.
	Content string
	// Language hints the content kind for display: "json", "text" or
	// "binary".
	Language string
	// Collapsed is true when the content starts behind its disclosure
	// control because it is long.
	Collapsed bool
	// Truncated is set when the content exceeded MaxInlineBytes; Omitted is
	// how many bytes were left out.
	Truncated bool
	Omitted   int

	// Tampered marks the payload cover-up: bytes in the store that do not
	// hash to the digest the signed receipt commits to.
	Tampered bool
	Mismatch *payload.Mismatch
	// Err records a lookup that failed for a reason that is neither absence
	// nor a mismatch — a bad mount, a permission denial. Such a slot is
	// `unreadable` too, and is deliberately NOT a tamper finding.
	Err string

	// ManifestFields is how many field digests the receipt committed for
	// this slot (Q37); zero means whole-blob only, which is a gap in the
	// evidence rather than a clean bill.
	ManifestFields int
}

type StateNote struct {
	State string
	Body  string
}

type TrustBlock struct {
	Proves    []Claim
	NotProves []Claim
	States    []StateNote
	Footnote  string
}