api

type CDSClient struct {
	// Issuer is the iss the EHR signs with.
	Issuer string `yaml:"issuer" json:"issuer"`
	// JWKSURL is where its public keys are published.
	JWKSURL string `yaml:"jwks_url" json:"jwksUrl"`
	// DaVinciVersion is the CRD release the EHR speaks, "2.1" or "2.2", when its requests do not say (requestedVersion);
	// empty leaves it to the server's -davinci-version.
	DaVinciVersion string `yaml:"davinci_version,omitempty" json:"davinciVersion,omitempty"`
	// contains filtered or unexported fields
}

type CMS0057Status struct {
	FHIR       bool   `json:"fhir"`
	BaseURL    string `json:"baseUrl"`
	SMART      bool   `json:"smart"`
	BulkExport bool   `json:"bulkExport"`
	PayerAPIs  bool   `json:"payerApis"`
	Consent    bool   `json:"consentRequired"`
	// Subscriptions is topic-based FHIR subscriptions (encounter and appointment notifications).
	Subscriptions bool `json:"subscriptions"`
	ReadOnly      bool `json:"readOnly"`
}

type ChannelRepo struct {
	// Dir is where channel files live.
	Dir string
	// contains filtered or unexported fields
}

type ChannelState struct {
	Name      string     `json:"name"`
	Running   bool       `json:"running"`
	StartedAt *time.Time `json:"startedAt,omitempty"`
	Error     string     `json:"error,omitempty"`

	Received    int64 `json:"received"`
	Delivered   int64 `json:"delivered"`
	Filtered    int64 `json:"filtered"`
	Partial     int64 `json:"partial"`
	Failed      int64 `json:"failed"`
	Unparseable int64 `json:"unparseable"`

	Destinations []DestinationState `json:"destinations,omitempty"`
}

type ChannelSummary struct {
	Name        string `json:"name"`
	Description string `json:"description,omitempty"`

	// Group is what this channel is filed under. Empty means ungrouped, which is a legitimate answer
	// and not a missing value - a site with nine channels should not be made to invent a taxonomy.
	Group        string   `json:"group,omitempty"`
	Enabled      bool     `json:"enabled"`
	Listen       string   `json:"listen"`
	SourceType   string   `json:"sourceType"`
	AckWhen      string   `json:"ackWhen"`
	Filter       string   `json:"filter,omitempty"`
	Destinations []string `json:"destinations"`
	Reads        []string `json:"reads,omitempty"`
	File         string   `json:"file"`
}

type ClusterControl interface {
	Status(ctx context.Context) (cluster.Status, error)
	Runs(tenant, channel string) bool
	SetDesired(ctx context.Context, tenant, channel string, running bool, by string) error
	StepDown(ctx context.Context, d time.Duration, by string) error
	Move(ctx context.Context, tenant, channel, toNode, by string) error
	IsLeader() bool
	// RunningOn names the server running a channel, "" when none does.
	RunningOn(ctx context.Context, tenant, channel string) string
}

type ComponentView struct {
	Number int    `json:"number"`
	Path   string `json:"path"`
	Name   string `json:"name,omitempty"`
	Value  string `json:"value"`
}

type DemoAccount struct {
	Username string
	Password string
}

type DestinationState struct {
	Name      string `json:"name"`
	Delivered int64  `json:"delivered"`
	Failed    int64  `json:"failed"`
	Filtered  int64  `json:"filtered"`
}

type DirectContact struct {
	// Address is a Direct address, or a domain for a domain-bound certificate that covers every address at it.
	Address      string `json:"address"`
	Name         string `json:"name,omitempty"`
	Organisation string `json:"organisation,omitempty"`
	Notes        string `json:"notes,omitempty"`
	// Source says where the certificate came from: dns, upload, or none yet.
	Source  string            `json:"source"`
	Added   time.Time         `json:"added"`
	Updated time.Time         `json:"updated"`
	Certs   []directCertShown `json:"certificates"`
}

type Drugs struct {
	Formulary *formulary.File
	// FormularyBase is the public Da Vinci US Drug Formulary endpoint's address.
	FormularyBase string
	RTPB          rtpb.Options
	// EPA answers SCRIPT ePA; its Submit is nil when PAS is off, which leaves initiation working and PARequests refused.
	EPA *epa.Service
	// ReplyChannel names the channel unsolicited ePA responses are routed to, or "".
	ReplyChannel string
}

type FieldView struct {
	Number      int             `json:"number"`
	Path        string          `json:"path"`
	Name        string          `json:"name"`
	Description string          `json:"description,omitempty"`
	Value       string          `json:"value"`
	Raw         string          `json:"raw"`
	Empty       bool            `json:"empty"`
	Repeats     int             `json:"repeats,omitempty"`
	Meaning     string          `json:"meaning,omitempty"`
	Components  []ComponentView `json:"components,omitempty"`
}

type Figure struct {
	Rows []FigureRow `json:"rows"`
	// Note says what the figure covers (the window, the source); Unavailable, when set, is why it could not be computed.
	Note        string `json:"note,omitempty"`
	Unavailable string `json:"unavailable,omitempty"`
	Empty       string `json:"empty,omitempty"`
	// Links are downloads that go with the figure, such as each partner's connection sheet.
	Links []FigureLink `json:"links,omitempty"`
}

type FigureLink struct {
	Label string `json:"label"`
	Href  string `json:"href"`
}

type FigureRow struct {
	Label string `json:"label"`
	Value string `json:"value"`
	Tone  string `json:"tone,omitempty"`
}

type FrictionFunnel struct {
	FirstSignIn  *time.Time `json:"firstSignIn,omitempty"`
	FirstChannel *time.Time `json:"firstChannel,omitempty"`
	FirstMessage *time.Time `json:"firstMessage,omitempty"`

	ChannelCount int   `json:"channelCount"`
	MessageCount int64 `json:"messageCount"`

	// Delivered is how many messages reached a destination. The number that separates a channel somebody configured from one that
	// does the job: a channel can receive for weeks and deliver nothing, and from inside the interface that looks like traffic.
	Delivered int64 `json:"delivered"`

	// StuckAt names the first step that has not happened, rather than leaving a reader to work it out from four timestamps. The whole
	// value of the funnel is in saying where somebody stopped, and a report that needs interpreting gets interpreted by whoever wrote
	// the software.
	StuckAt string `json:"stuckAt"`

	// MinutesToFirstMessage is from being able to sign in to a message actually arriving. The single most useful number here, and the
	// one a person watching over somebody's shoulder would have been timing.
	MinutesToFirstMessage *float64 `json:"minutesToFirstMessage,omitempty"`
}

type FrictionReport struct {
	// Refusals are the messages hit most often, worst first. The point of the whole report.
	Refusals []store.FrictionGroup `json:"refusals"`

	// Total is every refusal recorded, so the list above can be read as a sample of something rather than as everything.
	Total int `json:"total"`

	// Funnel is how far the installation has got. Derived from records that already existed rather than newly written, because a
	// milestone this code records about itself is worth less than one it has to go and find.
	Funnel FrictionFunnel `json:"funnel"`
}

type LDAPConfig struct {
	// Directory talks to the directory.
	Directory *ldap.Directory

	// Settings are the loaded configuration, for role mapping and the button label.
	Settings *ldap.Config
}

type MCPSettings struct {
	// Enabled is the switch; without it /mcp answers 404.
	Enabled func() bool
	// CallsPerMinute bounds tool calls per token; 0 is 60.
	CallsPerMinute func() int
	// Origins are browser origins allowed to call /mcp, beside this server's own. Requests with no Origin (agents, CLIs)
	// are allowed; a browser page on another origin is refused, which is what MCP asks of a server for DNS rebinding.
	Origins []string
}

type MeasureService interface {
	ListMeasures(ctx context.Context) ([]fhirserver.MeasureSummary, error)
	MeasureJSON(ctx context.Context, id string) ([]byte, error)
	PutMeasure(ctx context.Context, raw []byte) (string, error)
	DeleteMeasure(ctx context.Context, id string) error
	EvaluateMeasure(ctx context.Context, req fhirserver.EvaluateMeasureRequest, caller *fhirserver.Caller) (map[string]any, error)
}

type MessageView struct {
	MessageType  string        `json:"messageType"`
	TriggerEvent string        `json:"triggerEvent"`
	EventMeaning string        `json:"eventMeaning,omitempty"`
	ControlID    string        `json:"controlId"`
	Version      string        `json:"version"`
	Sender       string        `json:"sender"`
	Segments     []SegmentView `json:"segments"`
	Separators   string        `json:"separators"`
}

type OIDCConfig struct {
	// Issuer is the identity provider's issuer URL.
	Issuer string

	// ClientID and ClientSecret identify Perfuse to the provider.
	ClientID     string
	ClientSecret string

	// RedirectURL is where the provider sends the browser back. Must match what is registered with the provider exactly.
	RedirectURL string

	// Scopes are requested at sign-in. Empty asks for openid, profile and email.
	Scopes []string

	// Roles maps the provider's groups to Perfuse roles.
	Roles *oidc.RoleMapping

	// CreateUsers allows a first-time sign-in to create an account. Defaults to false.
	//
	// False is the safe default and the useful one to explain: with it off, somebody has to exist in Perfuse before they
	// can sign in, so the directory decides who they are and Perfuse decides who is allowed in. With it on, anybody the
	// directory vouches for and whose groups map to a role gets an account - which is what most sites want, and is a
	// decision they should make deliberately.
	CreateUsers bool

	// Label is what the sign-in button says. Defaults to naming the issuer's host.
	Label string

	// Provider is the discovered provider, filled in at startup.
	Provider *oidc.Provider

	// Keys are the provider's signing keys.
	Keys *oidc.KeySet
}

type Runtime struct {
	// Channels supplies channel definitions from disk.
	Repo *ChannelRepo
	// Messages persists what each channel handled. Optional.
	Messages *msgstore.Store
	// FHIR is the embedded FHIR store, if one is configured.
	FHIR *fhirserver.Store
	// Metrics collects what the engine is doing. Optional; when nil the metrics
	// endpoints say so rather than returning empty series that look like an idle
	// system.
	Metrics *metrics.Collector

	// Queues is the durable delivery queue, nil when queueing is unavailable.
	Queues *engine.Queues

	// Admit bounds deliveries in flight, shared with every channel this runtime starts.
	//
	// The same controller the engine uses, on purpose. A channel started from the interface must draw on the
	// same descriptor budget as one started at boot, or the limit is per channel and therefore not a limit.
	Admit *admit.Controller

	// Terminology counts the values mapping tables did not have; nil when there is no database.
	Terminology *terminology.Store

	// QueryState records what a DICOM query source has already seen, nil when there is no database.
	//
	// A channel that polls an archive refuses to start without it rather than running stateless: with nothing to
	// remember it re-emits every matching study on every poll, which against a real archive is a message storm that
	// looks like the archive malfunctioning.
	QueryState engine.DICOMQueryState

	// PHIWatch watches the traffic of every channel this runtime starts for the patterns a breach looks like. Nil
	// when it is off.
	PHIWatch *compliance.Monitor

	// Tracer exports message traces. Nil when tracing is not configured.
	Tracer *trace.Tracer

	// Contracts checks each channel's contract against recent traffic, on a timer.
	//
	// Nil when nothing has a contract. Created lazily by EnableContracts so a server with no contracts does
	// no work and holds no state for them.
	Contracts *contractChecker

	// Tenant is which tenant this runtime serves. Empty in single-tenant operation,
	// which reports as the default tenant in metrics rather than as an empty label.
	Tenant tenant.ID

	// Admission is asked before each received message on every channel of this runtime; nil admits everything. It is
	// the tenant's limits (tenant.Gate), so one customer cannot crowd out the rest of a shared server.
	Admission func() error

	// Gate, on a server in a cluster, refuses to start a channel another server runs: the error says where.
	Gate func(name string) error
	// Expected, on a server in a cluster, says whether a channel not running here counts as down: one another server
	// runs does not.
	Expected func(name string) bool
	// contains filtered or unexported fields
}

type SAMLConfig struct {
	// EntityID identifies Perfuse to the identity provider, and is the audience the assertion must be addressed to.
	EntityID string

	// ACSURL is where the identity provider posts its response. It has to match what is registered there exactly.
	ACSURL string

	// IdPSSOURL is where the browser is sent to sign in.
	IdPSSOURL string

	// IdPCertPEM is the certificate that signs responses, and the only one trusted. A certificate carried inside a response is
	// never used: see internal/saml/embeddedcert_test.go for what that would cost.
	IdPCertPEM string

	// GroupsAttribute names the assertion attribute carrying group membership.
	//
	// There is no standard for this and no useful default. Entra sends "groups", Okta usually sends whatever the administrator
	// named in the app configuration, ADFS sends a claim URI. Guessing would produce a sign-in that works and grants nobody
	// anything, which reads as a broken product rather than as a missing setting.
	GroupsAttribute string

	// Roles maps the provider's groups to Perfuse roles.
	Roles *oidc.RoleMapping

	// CreateUsers allows a first sign-in to create an account. False is the safe default, as with OIDC.
	CreateUsers bool

	// AllowUnsolicited accepts a response that answers no request this server sent, which is how a portal tile works. Off by
	// default: it is also what lets a captured response be posted into somebody else's browser.
	AllowUnsolicited bool

	// Label is what the sign-in button says.
	Label string

	// SP is built at startup so a bad certificate is reported then rather than at somebody's first sign-in.
	SP *saml.ServiceProvider
}

type SegmentView struct {
	Index       int         `json:"index"`
	Name        string      `json:"name"`
	Description string      `json:"description"`
	Known       bool        `json:"known"`
	Raw         string      `json:"raw"`
	Fields      []FieldView `json:"fields"`
}

type Server struct {
	// Channels manages the channel files on disk.
	Channels *ChannelRepo
	// Alerts is the alert evaluator, nil when alerting is off.
	Alerts *alerts.Evaluator
	// PHIWatch is the patient-data access monitor, nil when it is off (serve -watch-access=false).
	PHIWatch *compliance.Monitor
	// Terminology holds imported code systems and the values mapping tables did not have; nil without a database.
	Terminology *terminology.Store

	// PatientIndex is the master patient index; nil when the server keeps none (serve -mpi).
	PatientIndex *mpi.Store

	// Privacy answers data protection requests (GDPR, UK GDPR); nil without a database.
	Privacy *privacy.Service

	// Cluster is this server's place in a cluster of servers sharing one store; nil for a server on its own.
	Cluster ClusterControl
	// SNMP is the SNMP agent and trap sender, nil when SNMP is off.
	SNMP *snmp.Service

	// Store holds users, sessions and the audit log.
	Store *store.Store
	// Log receives request and error events.
	Log *slog.Logger
	// OIDC configures federated sign-in. Nil when it is not configured.
	OIDC *OIDCConfig

	// SAML is SAML 2.0 sign-in, nil when not configured.
	SAML *SAMLConfig

	// PasskeyRPID is the relying party identifier passkeys are registered for: a bare domain.
	//
	// This is what binds a credential to this site and makes it unphishable. Empty disables passkeys, because there is no
	// safe default: guessing it from a request's Host header would let whoever controls DNS decide what a credential is
	// bound to, which is the one thing the value exists to prevent.
	PasskeyRPID string

	// Demo is a shared sign-in shown on the sign-in page, for a public demonstration server. Nil: none.
	Demo *DemoAccount

	// PasskeyRPName is what the authenticator shows a person when they register.
	PasskeyRPName string

	// PasskeyOrigins are the exact origins accepted, scheme and port included.
	PasskeyOrigins []string

	// SCIMDefaultRole is the role an account gets when the identity provider does not say.
	//
	// Viewer unless an operator changes it, and the default is downward on purpose: an account whose role could not be
	// determined should be able to read and nothing else. Defaulting upward would hand out administrator to anybody the
	// provider failed to describe, and provisioning failures are exactly the case where a description goes missing.
	SCIMDefaultRole store.Role

	// SCIMEnabled turns the provisioning endpoints on.
	//
	// Off by default. These endpoints create and delete accounts, so an installation that is not being provisioned by an
	// identity provider should not expose them at all - an endpoint nobody uses is one nobody is watching.
	SCIMEnabled bool

	// PasskeyAttestation is what an operator requires of an authenticator's own attestation.
	//
	// Zero verifies nothing and claims nothing, which is the right default: attestation answers "which device", not
	// "is this legitimate", and the origin binding does the security work either way.
	PasskeyAttestation webauthn.AttestationPolicy

	// Restart asks the server to stop cleanly and start again, reading its settings afresh. Nil when the process cannot
	// restart itself, and the console then says so rather than offering a button that does nothing.
	Restart func()

	// MetricsAccessFn supplies the configured metrics access mode, superseding MetricsOpen when set.
	//
	// A function so the setting applies without a restart, read at request time. Nil falls back to the flags.
	MetricsAccessFn func() string

	// MetricsToken is a dedicated credential for the Prometheus scrape endpoint.
	//
	// Separate from an API token because a scraper cannot sign in, cannot hold a cookie and should not hold a
	// credential that also permits writes. Empty means no scrape token is configured, and then only a signed-in
	// operator can read metrics.
	MetricsToken string

	// MetricsOpen serves metrics to anybody who can reach the port.
	//
	// Was the only behaviour, and remains available because plenty of installations really do have the port bound to a
	// private interface. Named rather than implied so it shows up in the command line of any server running this way:
	// "we thought it was firewalled" is how this turns into a finding.
	MetricsOpen bool

	// SettingsPaths are the configuration files the interface may edit.
	//
	// Paths rather than parsed values, because the interface edits the same files the flags point at. Keeping a second
	// copy of these settings in the database would raise the question of which one wins, and the answer would be
	// discovered during an incident.
	SettingsPaths SettingsFiles

	// Startup describes what the process was started with, for the read-only half of the settings page.
	//
	// Shown rather than hidden. Somebody diagnosing a problem needs to know how the process was started, and "not
	// shown anywhere" is how a wrong flag survives for months.
	Startup StartupSettings

	// Started is when this process began, for the settings page.
	Started time.Time

	// LDAP configures directory sign-in. Nil when it is not configured.
	//
	// Separate from OIDC rather than one "external identity" field, because both can be configured at once and they
	// answer different problems: OIDC needs a browser that can reach the provider, and a directory does not.
	LDAP *LDAPConfig

	// SecureCookies marks the session cookie Secure. It should be on whenever
	// the server is reachable over anything but plain localhost.
	SecureCookies bool
	// StaticHandler serves the built front end, if one is embedded.
	StaticHandler http.Handler

	// Repos hands out a channel repository per tenant. Nil in single-tenant
	// operation, where Channels is used directly.
	Repos *TenantRepos

	// Runtimes hands out one engine per tenant, nil in single-tenant operation.
	//
	// When set it takes precedence over Runtime, and handlers must reach engines
	// through runtimeFor rather than reading Runtime - a test enforces that,
	// because it is the mistake review cannot catch across sixty handlers.
	Runtimes *TenantRuntimes

	// Runtime owns the running engine. When nil, the interface can edit channels
	// but not run them, and the endpoints that need it say so rather than
	// pretending.
	Runtime *Runtime

	// Version is reported by the probe endpoints. During a rollback, which build
	// is answering is the only question anybody has.
	Version string

	// Settings is every option an operator may change, and the file they live in.
	//
	// Nil on a server started without one, which is legitimate: the engine runs on declared defaults and the settings
	// area says it cannot save rather than presenting a form whose button fails.
	Settings *settings.Store

	// Branding holds a customer's logo, so an installation can present itself as their product.
	//
	// Optional: nil means the built-in mark, and an upload is refused rather than kept in memory.
	Branding *branding.Store

	// FleetLabel names this instance in a fleet view. Empty means the hostname.
	//
	// Configured rather than taken from anything in a message, following the rule
	// that user-visible labels never come from message content.
	FleetLabel string

	// PeersFile is where fleet peers are stored, and empty when this server has nowhere to put them.
	//
	// Needed because peers can now be added from the interface. Without a path the Fleet section says so rather
	// than offering a form whose save would fail.
	PeersFile string

	// SelfURL is this server's own address, used only to refuse a peer that points back here.
	//
	// A self-referencing peer polls this instance through its own HTTP stack and then appears twice in the fleet
	// view - once as this server and once as a peer - which reads as two machines and is one.
	SelfURL string

	// PublicURL is where patients' phones and other organisations reach this server, for the SMART Health Links it hosts. Defaults to
	// SelfURL, which is right only when the two are the same machine name.
	PublicURL string

	// SHLAllowHTTP lets a received SMART Health Link point at plain HTTP. Off: only tests and a laboratory want it.
	SHLAllowHTTP bool

	// Dashboards says which dashboard each role and directory group opens on (-dashboards). Nil: everyone opens on operations.
	Dashboards *dashboards.Assignments

	// ECRTriggers are the trigger codes the case report preview uses: the RCTC when the server was given one (-rctc), else nil
	// for the built-in sample.
	ECRTriggers *publichealth.TriggerSet

	// CRD is the Da Vinci Coverage Requirements Discovery rules, when the payer's CDS service is on.
	CRD *crd.Rules
	// PAS is the FHIR server answering Da Vinci PAS, for the reviewer queue; nil or without PAS, the queue says it is off.
	PAS *fhirserver.Server

	// SMART is the built-in SMART authorization server, and the files its apps and people are kept in, which Users →
	// SMART apps edits. Nil without -smart-clients.
	SMART            *smartauth.Server
	SMARTClientsFile string
	SMARTUsersFile   string

	// VPN reads the partner tunnels listed in -vpn; nil without it.
	VPN *vpn.Monitor

	// DTRPackage runs this server's own DTR $questionnaire-package on a Parameters body, for the console. Nil when no FHIR endpoint
	// is served.
	DTRPackage func(ctx context.Context, params []byte) (status int, body []byte)

	// DICOMweb is the imaging archive served at /dicomweb, nil without -dicomweb-archive; DICOMwebCORS are the browser
	// origins (a viewer such as OHIF served elsewhere) allowed to call it.
	DICOMweb     *dicomweb.Archive
	DICOMwebCORS []string

	// Drugs is the formulary, Real-Time Prescription Benefit and NCPDP SCRIPT ePA, nil without -formulary.
	Drugs *Drugs

	// XDS is the IHE XDS.b registry and repository and XCA responding gateway, nil without -xds. FHIRStore is this server's
	// FHIR store, which MHD resolves patients from and PIXm and PDQm answer from; nil without -fhir.
	XDS *xds.Registry

	// DirectDir is the Direct address book: one PEM file per correspondent, which a direct destination's recipient_certs_dir
	// reads (and which it reads by default).
	DirectDir string

	// ViewsDir keeps SQL on FHIR ViewDefinitions; RunView runs one over the FHIR store (nil without -fhir).
	ViewsDir string
	RunView  ViewRunner
	// Measures evaluates digital quality measures over the FHIR store (nil without -fhir).
	Measures MeasureService

	FHIRStore *fhirserver.Store

	// MCP is the Model Context Protocol server at /mcp, off unless its Enabled says so. FHIRHandler is the FHIR endpoint
	// (with /fhir stripped), which MCP's fhir_search calls with the agent's own token; nil without -fhir.
	MCP         *MCPSettings
	FHIRHandler http.Handler

	// PatientSummary builds this server's own International Patient Summary for a patient, for Health links. Nil when
	// no FHIR endpoint is served.
	PatientSummary func(ctx context.Context, patientID string) (status int, body []byte)

	// CDSClients are the EHRs trusted to call it with signed JWTs.
	CDSClients []*CDSClient

	// TLSCertFile and TLSKeyFile are the server's own certificate and key, when it was started with them.
	//
	// Held as paths rather than as a loaded key pair so they can be read at the moment they are used. Signing is
	// rare, the files are small, and a cached key means a replaced certificate keeps producing signatures against
	// the old one until somebody restarts - with nothing on screen to explain why.
	TLSCertFile string
	TLSKeyFile  string

	// TSAURL is the RFC 3161 time-stamping authority for DSDR signatures on claims attachments. Without one a signature stops
	// short of the XAdES-X-L the guide asks for, and says so.
	TSAURL string

	// CMS0057 describes the FHIR endpoint, so the CMS-0057 page can say which payer APIs this instance can answer.
	CMS0057 CMS0057Status

	// TEFCA is this instance's participation in national exchange, nil when it does not participate.
	//
	// Held as a Participant rather than as a configuration, because a Participant cannot exchange without auditing -
	// there is no unaudited path through it, so nothing here has to remember to record anything.
	TEFCA *tefca.Participant

	// TEFCAAudit is the trail, kept separately so the audit view can read the file rather than only memory.
	TEFCAAudit *tefca.PersistentAuditLog

	// Fleet polls other instances, nil when no peers are configured.
	//
	// Any instance can be the aggregator, because the console ships inside every
	// binary. Mirth needed a separate product for this - a plug-in registering
	// with a Command Center server - because its administrator is a desktop
	// application and there was nowhere in that design to put a fleet view.
	Fleet *peers.Fleet
	// contains filtered or unexported fields
}

type SettingsFiles struct {
	// Alerts is the alert rules file, from -alerts.
	Alerts string

	// OIDC is the single sign-on configuration, from -oidc.
	OIDC string

	// LDAP is the directory configuration, from -ldap.
	LDAP string

	// SAML is the SAML 2.0 sign-in configuration, from -saml.
	SAML string

	// Peers is the fleet peer list, from -peers.
	Peers string
}

type StartupSettings struct {
	Addr           string   `json:"addr"`
	ChannelsDir    string   `json:"channelsDir"`
	DatabasePath   string   `json:"databasePath"`
	TLS            bool     `json:"tls"`
	MultiTenant    bool     `json:"multiTenant"`
	EngineRunning  bool     `json:"engineRunning"`
	FHIRServing    bool     `json:"fhirServing"`
	StoreMessages  bool     `json:"storeMessages"`
	StorePayloads  bool     `json:"storePayloads"`
	RetentionDays  int      `json:"retentionDays"`
	AllowMetadata  bool     `json:"allowMetadataEgress"`
	JSONLogs       bool     `json:"jsonLogs"`
	Version        string   `json:"version"`
	GoVersion      string   `json:"goVersion"`
	Platform       string   `json:"platform"`
	StartedAt      string   `json:"startedAt"`
	CommandLine    []string `json:"commandLine"`
	FleetLabel     string   `json:"fleetLabel,omitempty"`
	TraceEndpoint  string   `json:"traceEndpoint,omitempty"`
	AlertWebhook   bool     `json:"alertWebhook"`
	AlertSeverity  string   `json:"alertSeverity,omitempty"`
	AuthMethods    []string `json:"authMethods"`
	MetadataReason string   `json:"metadataReason,omitempty"`
}

type TenantRepos struct {
	// contains filtered or unexported fields
}

type TenantRuntimes struct {

	// LimitsFor reads a tenant's limits. Nil: no limits are enforced.
	LimitsFor func(context.Context, tenant.ID) (tenant.Limits, error)

	// PHIWatch is the server's patient-data access monitor, given to every tenant's runtime; nil watches nothing.
	// Its channel names carry the tenant (watchName), so one tenant's traffic is never another's baseline.
	PHIWatch *compliance.Monitor
	// contains filtered or unexported fields
}

type Trend struct {
	// Verdicts is the window, oldest first, for a sparkline.
	Verdicts []contractVerdict `json:"verdicts"`

	// Checks is how many are in the window, and Failing how many of those did not hold. A rate is unreadable
	// without both.
	Checks  int `json:"checks"`
	Failing int `json:"failing"`

	// ChangedAt is when the current outcome first appeared, or nil when the whole window agrees. This is the answer
	// to "when did this start", which is the first question after "what changed".
	ChangedAt *time.Time `json:"changedAt,omitempty"`

	// ObservedSince is when this instance started watching. The interface needs it to avoid claiming a duration it
	// cannot support: if ChangedAt equals the first entry, the change may well have happened before we were
	// looking.
	ObservedSince time.Time `json:"observedSince"`

	// FromStartOfWindow is true when the current outcome runs all the way back to the oldest entry, meaning the
	// real change happened earlier than anything recorded - so a duration derived from ChangedAt is a floor, not a
	// measurement.
	FromStartOfWindow bool `json:"fromStartOfWindow"`

	// Flapping reports the outcome changing repeatedly rather than once. It matters because a feed alternating
	// between holding and failing is a different problem from one that broke and stayed broken, and the same
	// number of failures describes both.
	Flapping bool `json:"flapping"`
}

type ValidationFailure struct {
	Problems []string
}

type ViewRunner func(ctx context.Context, v *sof.View, patients []string, limit int) ([]sof.Row, bool, error)