notify

const (
	// AdminBell is the bell of an admin nobody confines — a single-tenant
	// install's admin, or the supertenant's: every broadcast except routine
	// file activity nobody was addressed by (personalEvents).
	AdminBell Bell = iota
	// TenantAdminBell is a tenant admin's: only the broadcasts that name a
	// file (fileBroadcastEvents), because only those can be placed in a
	// tenant. An operator alarm names no storage and would be dropped after
	// it had already taken a place on the page.
	TenantAdminBell
	// MemberBell is everybody else's: only memberBroadcastEvents.
	MemberBell
	// PlatformAdminBell is the bell of an administrator of the supertenant on
	// a multi-tenant install, the platform operator: AdminBell's, less a new
	// encryption request (platformOmitted). Such a request is the tenant's
	// own administrators' to decide; the operator sees it on Admin ->
	// Encryption and is not told of each one (operator decision 2026-10-03).
	// The platform's own requests reach the operator addressed to them
	// (e2epolicy announce), never as a broadcast.
	PlatformAdminBell
)

const (
	EventReplicaFail          EventType = "replica_fail"
	EventReplicaFailSpike     EventType = "replica_fail_spike"
	EventReplicaReconcileDone EventType = "replica_reconcile_done"
	EventReplicaStatusReport  EventType = "replica_status_report"
	EventPrimaryReadFail      EventType = "primary_read_fail"
	EventQuotaNearFull        EventType = "quota_near_full"
	EventQuotaFull            EventType = "quota_full"
	EventQueueStuck           EventType = "queue_stuck"
	EventAuthFailSpike        EventType = "auth_fail_spike"
	// EventAuthProviderDown fires when an operating-system sign-in provider the
	// administrator switched on cannot start (the machine changed, the API is
	// gone). The provider is left out of the running set; every other way in
	// keeps working. Once per distinct reason.
	EventAuthProviderDown EventType = "auth_provider_down"
	// EventLDAPLegacyAccountElsewhere fires ONCE per older directory account
	// (keyed by a bare login name before the e-mail rule) that a sign-in by the
	// same name found in ANOTHER tenant. The account is left alone — the tenant
	// boundary is not crossed — and the person gets the first sign-in rule in
	// their own tenant; the platform operator decides what, if anything, to do
	// (auth.AdoptAccount, LegacyAccountElsewhere). Meta `provider`, `account`,
	// `account_tenant`, `login_tenant`, and the sentence per language
	// (`title_<lang>`, `body_<lang>`, from srvtext).
	EventLDAPLegacyAccountElsewhere EventType = "ldap_legacy_account_elsewhere"
	// EventTenantDomainSuspended / EventTenantDomainRestored tell a tenant's
	// administrators (one notification each, UserID set) that the CNAME of
	// the tenant's own domain stopped pointing at its platform subdomain, so
	// the domain stopped routing, or that it points there again
	// (tenantdomain.Service.Check, docs/TENANT-ADMIN.md). Meta `domain`,
	// `reason`, and the sentence per language (`title_<lang>`, `body_<lang>`).
	EventTenantDomainSuspended EventType = "tenant_domain_suspended"
	EventTenantDomainRestored  EventType = "tenant_domain_restored"
	// EventPermissionGaps tells administrators that some saved roles allow a
	// permission but not the one carved out of it - adding files but not
	// encrypting - as a save on a version without the newer permission
	// leaves them (perm/gaps.go, internal/permgap). Admin -> Roles lists them
	// with one click to give the permission back. Once per new gap: a
	// broadcast to the administrators nobody confines, and one notification
	// each to a tenant's administrators about the tenant's own roles. Meta
	// `count`, and the sentence per language (`title_<lang>`, `body_<lang>`).
	EventPermissionGaps EventType = "permission_gaps"
	EventDiskFull       EventType = "disk_full"
	// EventUpdateAvailable fires ONCE per newly published release — the
	// "already announced" mark is persisted, so a restart loop cannot turn it
	// into a stream.
	EventUpdateAvailable EventType = "update_available"
	// EventUpdateApplied fires after a self-upgrade replaced the binary. The
	// version moving is exactly the kind of change an operator must find in
	// the log even if nobody was watching when it happened.
	EventUpdateApplied EventType = "update_applied"

	// An installed app following the source it came from
	// (wasmplugin/updates.go). Operator alarms like the two above: an app is
	// the platform operator's to manage, so nobody else is told. Meta carries
	// `plugin` (its name), `plugin_label_<lang>` (its label in every language
	// it has), `version` (the version found or reached) and, per event,
	// `from`, `added`, `error`.
	//
	// EventAppUpdated: an administrator's approved change of an app's
	// version — an upgrade, or going back (meta `rollback`). Since 0.48
	// nothing updates itself (wasmplugin/versions.go afterUpgrade).
	EventAppUpdated EventType = "app_updated"
	// EventAppUpdateAvailable: a newer version waits for the administrator.
	// Once per version.
	EventAppUpdateAvailable EventType = "app_update_available"
	// EventAppUpdateNeedsApproval: a newer version asks for permissions the
	// app was not granted (meta `added`), or a language pack now brings a
	// module (meta `adds_module`). Nothing moves until an administrator
	// reviews it. Once per version.
	EventAppUpdateNeedsApproval EventType = "app_update_needs_approval"
	// EventAppUpdateFailed: an automatic update was tried and undone — the
	// app runs the version it had (meta `error`). Written only by filex 0.47,
	// which updated apps by itself; kept so its rows still read.
	EventAppUpdateFailed EventType = "app_update_failed"
	// EventPluginUpdateAvailable: a binary STORAGE plugin's source has a
	// newer version for this platform (plugin/updates.go). Meta `plugin`,
	// `version`. Once per version; nothing is installed until an
	// administrator reviews it.
	EventPluginUpdateAvailable EventType = "plugin_update_available"
	// EventPluginRequested: somebody who may not install plugins — an API key:
	// an agent, a script, the CLI — left a request to install or upgrade one,
	// and it waits for an administrator on the Plugins page
	// (internal/pluginreq). Meta `plugin`, `plugin_label_<lang>` (an app's
	// label in every language it has; a storage plugin's name), `version`,
	// `kind` (app | storage), `op` (install | upgrade), `requester`,
	// `request_id`, `reason`. Once per request: asking again for the same
	// source answers the pending request and tells nobody.
	EventPluginRequested EventType = "plugin_requested"
)

const (
	EventFileUploaded EventType = "file.uploaded"
	// EventFileUpdated fires when a write REPLACED the bytes of a file that
	// already existed, where file.uploaded means the write created it. Both
	// come from the same post-write gate (internal/writehook), so every write
	// surface — editor save, browser re-upload, WebDAV PUT, S3 PutObject,
	// SFTP/FTPS/NFS, the AI/MCP surface — splits them the same way.
	//
	// ⚠ Adding it NARROWS file.uploaded: a subscriber that watched
	// file.uploaded to see edits stops hearing them and has to subscribe to
	// file.updated as well. That is deliberate — an event called "uploaded"
	// that also fires for an in-place edit cannot be filtered by anyone.
	EventFileUpdated EventType = "file.updated"
	// EventFileUploadFailed fires when bytes filex already acknowledged could
	// not be written to the storage driver — the staged upload path answers the
	// client before it transfers, so a failure after that point is invisible
	// unless it is announced (issue #16).
	EventFileUploadFailed EventType = "file.upload_failed"
	EventFileDeleted      EventType = "file.deleted"
	EventFileMoved        EventType = "file.moved"
	EventFileTrashed      EventType = "file.trashed"
	EventShareCreated     EventType = "share.created"
	EventDropReceived     EventType = "drop.received"
	/* koru:k2 av */
	// EventFileInfected fires when the async ClamAV scan flags an
	// uploaded file; the payload carries the node plus a `signature`
	// meta field, and the file is quarantined into trash.
	EventFileInfected EventType = "file.infected"
	/* calisma:d3 comments */
	// EventCommentAdded fires when a user comments on a file/folder
	// node (v0.6 "Çalışma" (Work)). The payload carries the node (path/name),
	// the actor, and meta {comment_id, body (first 200 chars)}.
	EventCommentAdded EventType = "comment.added"
	// Archive events describe the completed user operation rather than each
	// low-level file write it performed. Extraction can create hundreds of
	// files; one completion event is useful, hundreds of "new file" alerts are
	// not.
	EventArchiveCreated   EventType = "archive.created"
	EventArchiveExtracted EventType = "archive.extracted"
	// EventE2EEscrowUsed fires when an encrypted folder was opened with the
	// operator's ESCROW key rather than its owner's passphrase. Not the
	// recovery key — that one the owner holds; escrow means somebody else's
	// key was used on their folder, which is why the owner is told. The payload
	// carries the node plus meta {escrow_kid, storage, folder} and, when the
	// caller was authenticated, actor_email.
	//
	// It was written as an inline notify.EventType("e2e.escrow_used") in the
	// handler, which is why it never appeared in the admin UI's list: an
	// event that is not a constant here is invisible to everything that reads
	// this block. catalog_test.go now refuses that shape.
	EventE2EEscrowUsed EventType = "e2e.escrow_used"
	// EventE2EPasswordChanged fires when an encrypted folder's password was
	// changed — or reset with its recovery key — in the web UI, which
	// announces it after writing the new key file (the change happens in the
	// browser; the server sees no password). It goes to the folder's OWNER,
	// who may not be the person who changed it: a change you did not make is
	// how you learn somebody else holds your password or recovery key. Meta
	// carries {storage, folder, via: "password"|"recovery_key", rekey} and,
	// when the caller was signed in, actor_email.
	EventE2EPasswordChanged EventType = "e2e.password_changed"
	// EventE2ERequestCreated fires when somebody asks to encrypt in a folder
	// under their tenant's `approval` policy (internal/e2epolicy
	// requests.go) and the request waits for an administrator. ONE broadcast
	// placed on the folder (its NodeRef — for a single file, the folder it is
	// in): the bell hands it to the administrators of the tenant that storage
	// belongs to — and to the platform operator — and to nobody else (bell.go
	// fileBroadcastEvents), and a webhook gets one delivery. Meta carries
	// {request_id, target_kind: "folder"|"file", storage, requester, reason}.
	// ⚠ target_kind, not kind: meta.kind picks another event's file wording.
	EventE2ERequestCreated EventType = "e2e.request_created"
	// EventE2ERequestDecided fires when an administrator approved or rejected
	// an encryption request. Addressed to the person who asked, and to nobody
	// else; the node is the request's folder. Meta carries {request_id,
	// target_kind, storage, decision: "approved"|"rejected", note, decider}.
	EventE2ERequestDecided EventType = "e2e.request_decided"
	// EventPluginNotice is an app plugin (internal/wasmplugin) speaking to
	// people through the notify_send host function: a signature request, a
	// finished conversion, anything the plugin's author phrased. The row's
	// Title/Body are the plugin's English text; meta carries `plugin` (its
	// name), `title_en`/`title_tr`/`body_en`/`body_tr` for the reader's
	// language, and `job` when sent from a queued action.
	EventPluginNotice EventType = "plugin.notice"
	// EventAdminTest is the admin notifications page's "Send test
	// notification": one broadcast through the bell and every webhook, so an
	// operator can see the plumbing work. It names nothing and is meant for
	// every bell (bell.go → everyoneEvents); e2e 109 seeds a non-admin's bell
	// with it.
	EventAdminTest EventType = "admin_test"
	// EventNotificationDigest is one person's digest (digest.go): the
	// notifications of the kinds they did not mark urgent, held for the
	// window an administrator set and told in this one row, folder by folder.
	// Addressed to that person. Meta carries `count`, `groups` (per folder:
	// `storage`, `path`, `name`, `counts` by event, `encrypted`), `other` (the
	// counts of rows that name no folder), `from`/`to` (the window) and, for a
	// digest of one, `item` (that row's event and meta).
	//
	// ⚠ Delivered only to a webhook target that names it in its allow-list:
	// every row it sums up was delivered to the webhooks on its own, so a
	// target with an empty list (everything) and the legacy global webhook do
	// not receive it twice over.
	EventNotificationDigest EventType = "notification.digest"
)

const (
	SeverityInfo     Severity = "info"
	SeverityWarning  Severity = "warning"
	SeverityError    Severity = "error"
	SeverityCritical Severity = "critical"
)

const (
	// WebhookStatusPending — the webhook attempt has not yet been made.
	WebhookStatusPending WebhookStatus = "pending"
	// WebhookStatusSent — the upstream returned 2xx within the budget.
	WebhookStatusSent WebhookStatus = "sent"
	// WebhookStatusFailed — exhausted retries; the operator should
	// investigate.
	WebhookStatusFailed WebhookStatus = "failed"
	// WebhookStatusSkipped — no webhook URL configured. The in-app
	// row still exists.
	WebhookStatusSkipped WebhookStatus = "skipped"
)