observability

type BaselineSummary struct {
	Deviations int            `json:"deviations"`
	ByStatus   map[string]int `json:"by_status,omitempty"`
}

type ContextSummary struct {
	Sessions  int `json:"sessions"`
	Attempts  int `json:"attempts"`
	ToolCalls int `json:"tool_calls"`
	Processes int `json:"processes"`
	Snapshots int `json:"snapshots"`
}

type CorrelationGap struct {
	EventID               string   `json:"event_id"`
	RawEventID            string   `json:"raw_event_id,omitempty"`
	Source                string   `json:"source"`
	Type                  string   `json:"type"`
	Missing               []string `json:"missing"`
	CorrelationMethod     string   `json:"correlation_method,omitempty"`
	CorrelationConfidence float64  `json:"correlation_confidence"`
	ContainerID           string   `json:"container_id,omitempty"`
	CgroupID              string   `json:"cgroup_id,omitempty"`
	PID                   int64    `json:"pid,omitempty"`
	PPID                  int64    `json:"ppid,omitempty"`
	CreatedAt             string   `json:"created_at"`
	SuggestedBinding      string   `json:"suggested_binding"`
}

type CoverageOptions struct {
	RunID string
	Limit int
}

type CoverageReport struct {
	SchemaVersion string           `json:"schema_version"`
	RunID         string           `json:"run_id"`
	ResultSetID   string           `json:"result_set_id"`
	PageHash      string           `json:"page_hash"`
	Summary       CoverageSummary  `json:"summary"`
	MissingFields map[string]int   `json:"missing_fields"`
	BySource      map[string]int   `json:"by_source"`
	ByType        map[string]int   `json:"by_type"`
	Gaps          []CorrelationGap `json:"gaps,omitempty"`
	NextSteps     []string         `json:"next_steps"`
}

type CoverageSummary struct {
	RuntimeEvents         int     `json:"runtime_events"`
	FullyCorrelated       int     `json:"fully_correlated"`
	MissingSession        int     `json:"missing_session"`
	MissingToolCall       int     `json:"missing_tool_call"`
	MissingProcess        int     `json:"missing_process"`
	FullyCorrelatedRatio  float64 `json:"fully_correlated_ratio"`
	ToolCallCoverageRatio float64 `json:"tool_call_coverage_ratio"`
	ProcessCoverageRatio  float64 `json:"process_coverage_ratio"`
	CorrelationGapCount   int     `json:"correlation_gap_count"`
}

type EventContext struct {
	SessionID  string `json:"session_id,omitempty"`
	AttemptID  string `json:"attempt_id,omitempty"`
	ToolCallID string `json:"tool_call_id,omitempty"`
	ProcessID  string `json:"process_id,omitempty"`
	SnapshotID string `json:"snapshot_id,omitempty"`
}

type EventDetail struct {
	ID                    string         `json:"id"`
	Type                  string         `json:"type"`
	Source                string         `json:"source"`
	Time                  string         `json:"time"`
	Summary               string         `json:"summary"`
	ObjectRef             string         `json:"object_ref,omitempty"`
	CorrelationMethod     string         `json:"correlation_method,omitempty"`
	CorrelationConfidence float64        `json:"correlation_confidence,omitempty"`
	Evidence              map[string]any `json:"evidence,omitempty"`
}

type EventOptions struct {
	RunID   string
	EventID string
}

type EventReport struct {
	SchemaVersion    string            `json:"schema_version"`
	RunID            string            `json:"run_id"`
	ResultSetID      string            `json:"result_set_id"`
	PageHash         string            `json:"page_hash"`
	Event            EventDetail       `json:"event"`
	Context          EventContext      `json:"context"`
	Query            QuerySurface      `json:"query"`
	RelatedRisks     []EvidenceSummary `json:"related_risks,omitempty"`
	RelatedPolicies  []EvidenceSummary `json:"related_policies,omitempty"`
	RelatedResponses []EvidenceSummary `json:"related_responses,omitempty"`
	RecommendedViews []string          `json:"recommended_views"`
}

type EvidenceSummary struct {
	Ref     string `json:"ref"`
	Type    string `json:"type"`
	Source  string `json:"source"`
	Summary string `json:"summary"`
}

type FlowItem struct {
	Time            string   `json:"time"`
	Lane            string   `json:"lane,omitempty"`
	Correlation     string   `json:"correlation_status,omitempty"`
	ToolCallID      string   `json:"tool_call_id,omitempty"`
	ProcessID       string   `json:"process_id,omitempty"`
	EventID         string   `json:"event_id"`
	EventType       string   `json:"event_type"`
	EventSource     string   `json:"event_source"`
	RiskSignals     []string `json:"risk_signals,omitempty"`
	PolicyDecisions []string `json:"policy_decisions,omitempty"`
	ResponseActions []string `json:"response_actions,omitempty"`
	Summary         string   `json:"summary"`
	Drilldowns      []string `json:"drilldowns"`
}

type FlowOptions struct {
	RunID string
	Limit int
}

type FlowReport struct {
	SchemaVersion string     `json:"schema_version"`
	RunID         string     `json:"run_id"`
	ResultSetID   string     `json:"result_set_id"`
	PageHash      string     `json:"page_hash"`
	FlowCount     int        `json:"flow_count"`
	Flows         []FlowItem `json:"flows"`
}

type ProcessDetail struct {
	ID        string         `json:"id"`
	StartedAt string         `json:"started_at,omitempty"`
	EndedAt   string         `json:"ended_at,omitempty"`
	Summary   string         `json:"summary,omitempty"`
	Evidence  map[string]any `json:"evidence,omitempty"`
	ObjectRef string         `json:"object_ref,omitempty"`
}

type ProcessOptions struct {
	RunID     string
	ProcessID string
}

type ProcessReport struct {
	SchemaVersion    string            `json:"schema_version"`
	RunID            string            `json:"run_id"`
	ResultSetID      string            `json:"result_set_id"`
	PageHash         string            `json:"page_hash"`
	Process          ProcessDetail     `json:"process"`
	Context          EventContext      `json:"context"`
	Query            QuerySurface      `json:"query"`
	RuntimeEvents    []EvidenceSummary `json:"runtime_events,omitempty"`
	RelatedRisks     []EvidenceSummary `json:"related_risks,omitempty"`
	RelatedPolicies  []EvidenceSummary `json:"related_policies,omitempty"`
	RelatedResponses []EvidenceSummary `json:"related_responses,omitempty"`
	RecommendedViews []string          `json:"recommended_views"`
}

type QuerySurface struct {
	Lane              string   `json:"lane,omitempty"`
	CorrelationStatus string   `json:"correlation_status,omitempty"`
	Drilldowns        []string `json:"drilldowns,omitempty"`
}

type ResponseSummary struct {
	Actions  int            `json:"actions"`
	ByAction map[string]int `json:"by_action,omitempty"`
	ByStatus map[string]int `json:"by_status,omitempty"`
}

type RiskSummary struct {
	Signals         int            `json:"signals"`
	PolicyDecisions int            `json:"policy_decisions"`
	BySeverity      map[string]int `json:"by_severity,omitempty"`
	ByDecision      map[string]int `json:"by_decision,omitempty"`
}

type RuntimeSummary struct {
	Events                int     `json:"events"`
	EventsWithSession     int     `json:"events_with_session"`
	EventsWithToolCall    int     `json:"events_with_tool_call"`
	EventsWithProcess     int     `json:"events_with_process"`
	ToolCallCoverageRatio float64 `json:"tool_call_coverage_ratio"`
	ProcessCoverageRatio  float64 `json:"process_coverage_ratio"`
}

type ScopeSummary struct {
	ToolCallID            string            `json:"tool_call_id"`
	SessionID             string            `json:"session_id,omitempty"`
	AttemptID             string            `json:"attempt_id,omitempty"`
	Command               string            `json:"command,omitempty"`
	Status                string            `json:"status,omitempty"`
	StartedAt             string            `json:"started_at,omitempty"`
	EndedAt               string            `json:"ended_at,omitempty"`
	ProcessCount          int               `json:"process_count"`
	RuntimeEvents         int               `json:"runtime_events"`
	RuntimeEventsByType   map[string]int    `json:"runtime_events_by_type,omitempty"`
	RiskSignals           int               `json:"risk_signals"`
	RiskBySeverity        map[string]int    `json:"risk_by_severity,omitempty"`
	PolicyDecisions       int               `json:"policy_decisions"`
	ResponseActions       int               `json:"response_actions"`
	ResponseByAction      map[string]int    `json:"response_by_action,omitempty"`
	EvidenceRefs          []EvidenceSummary `json:"evidence_refs,omitempty"`
	RecommendedDrilldowns []string          `json:"recommended_drilldowns"`
}

type ScopesOptions struct {
	RunID string
	Limit int
}

type ScopesReport struct {
	SchemaVersion string         `json:"schema_version"`
	RunID         string         `json:"run_id"`
	ResultSetID   string         `json:"result_set_id"`
	PageHash      string         `json:"page_hash"`
	ScopeCount    int            `json:"scope_count"`
	Scopes        []ScopeSummary `json:"scopes"`
}

type SignalSummary struct {
	Total       int            `json:"total"`
	ByDimension map[string]int `json:"by_dimension,omitempty"`
}

type Summary struct {
	SchemaVersion    string            `json:"schema_version"`
	RunID            string            `json:"run_id"`
	ResultSetID      string            `json:"result_set_id"`
	PageHash         string            `json:"page_hash"`
	EventCount       int               `json:"event_count"`
	Application      ContextSummary    `json:"application"`
	Runtime          RuntimeSummary    `json:"runtime"`
	Windows          WindowSummary     `json:"windows"`
	Risk             RiskSummary       `json:"risk"`
	Baseline         BaselineSummary   `json:"baseline"`
	Response         ResponseSummary   `json:"response"`
	Signals          SignalSummary     `json:"signals"`
	EventTypes       map[string]int    `json:"event_types"`
	Sources          map[string]int    `json:"sources"`
	TopEvidenceRefs  []EvidenceSummary `json:"top_evidence_refs,omitempty"`
	RecommendedViews []string          `json:"recommended_views"`
}

type SummaryOptions struct {
	RunID string
	TopN  int
}

type WindowSummary struct {
	WindowCount       int            `json:"window_count"`
	WindowSeconds     []int          `json:"window_seconds,omitempty"`
	AggregateWindow   int            `json:"aggregate_window_seconds,omitempty"`
	EventCount        int            `json:"event_count"`
	ResolvedCount     int            `json:"resolved_count"`
	UnresolvedCount   int            `json:"unresolved_count"`
	HighRiskCount     int            `json:"high_risk_count"`
	ByType            map[string]int `json:"by_type,omitempty"`
	BySource          map[string]int `json:"by_source,omitempty"`
	LatestWindowStart string         `json:"latest_window_start,omitempty"`
}