telemetry

type BatchRecord struct {
	ID             string `json:"id"`
	RunID          string `json:"run_id"`
	Format         string `json:"format"`
	Path           string `json:"path"`
	FileSHA256     string `json:"file_sha256"`
	Read           int    `json:"read"`
	Ingested       int    `json:"ingested"`
	Skipped        int    `json:"skipped"`
	Failed         int    `json:"failed"`
	EventIDsSHA256 string `json:"event_ids_sha256"`
	CreatedAt      string `json:"created_at"`
}

type CorrelationBinding struct {
	ID            string   `json:"id"`
	RunID         string   `json:"run_id,omitempty"`
	SessionID     string   `json:"session_id,omitempty"`
	AttemptID     string   `json:"attempt_id,omitempty"`
	ToolCallID    string   `json:"tool_call_id,omitempty"`
	ProcessID     string   `json:"process_id,omitempty"`
	ContainerID   string   `json:"container_id,omitempty"`
	CgroupID      string   `json:"cgroup_id,omitempty"`
	RootPID       int64    `json:"root_pid,omitempty"`
	PID           int64    `json:"pid,omitempty"`
	StartedAt     string   `json:"started_at,omitempty"`
	EndedAt       string   `json:"ended_at,omitempty"`
	BindingSource string   `json:"binding_source,omitempty"`
	Confidence    float64  `json:"confidence"`
	IdentityKeys  []string `json:"identity_keys,omitempty"`
}

type CorrelationContext struct {
	RunID      string `json:"run_id,omitempty"`
	SessionID  string `json:"session_id,omitempty"`
	AttemptID  string `json:"attempt_id,omitempty"`
	ToolCallID string `json:"tool_call_id,omitempty"`
	ProcessID  string `json:"process_id,omitempty"`
	SnapshotID string `json:"snapshot_id,omitempty"`
}

type CorrelationEvent struct {
	ID         string `json:"id"`
	Type       string `json:"type"`
	Source     string `json:"source"`
	RawEventID string `json:"raw_event_id,omitempty"`
	CreatedAt  string `json:"created_at"`
}

type CorrelationEvidence struct {
	Event           CorrelationEvent    `json:"event"`
	RawIdentity     CorrelationIdentity `json:"raw_identity"`
	ResolvedContext CorrelationContext  `json:"resolved_context"`
	Binding         *CorrelationBinding `json:"binding,omitempty"`
	Match           CorrelationMatch    `json:"match"`
	Drilldowns      []string            `json:"drilldowns,omitempty"`
}

type CorrelationIdentity struct {
	RunID       string   `json:"run_id,omitempty"`
	ProcessID   string   `json:"process_id,omitempty"`
	ContainerID string   `json:"container_id,omitempty"`
	CgroupID    string   `json:"cgroup_id,omitempty"`
	PID         int64    `json:"pid,omitempty"`
	TGID        int64    `json:"tgid,omitempty"`
	PPID        int64    `json:"ppid,omitempty"`
	Keys        []string `json:"keys,omitempty"`
}

type CorrelationMatch struct {
	Status      string   `json:"status"`
	Method      string   `json:"method"`
	Confidence  float64  `json:"confidence"`
	BindingID   string   `json:"binding_id,omitempty"`
	MatchedKeys []string `json:"matched_keys,omitempty"`
	Reason      string   `json:"reason"`
	TimeWindow  string   `json:"time_window,omitempty"`
}

type CorrelationReport struct {
	SchemaVersion string                `json:"schema_version"`
	RunID         string                `json:"run_id,omitempty"`
	EventID       string                `json:"event_id,omitempty"`
	ResultSetID   string                `json:"result_set_id"`
	PageHash      string                `json:"page_hash"`
	Count         int                   `json:"count"`
	Items         []CorrelationEvidence `json:"correlations"`
}

type CorrelationReportOptions struct {
	RunID   string
	EventID string
}

type EventExplanation struct {
	Receiver              string   `json:"receiver"`
	SourceFormat          string   `json:"source_format"`
	RawEventID            string   `json:"raw_event_id,omitempty"`
	NormalizedEventType   string   `json:"normalized_event_type"`
	SchemaStatus          string   `json:"schema_status"`
	SchemaError           string   `json:"schema_error,omitempty"`
	IdentityKeys          []string `json:"identity_keys,omitempty"`
	CorrelationMethod     string   `json:"correlation_method,omitempty"`
	CorrelationConfidence float64  `json:"correlation_confidence,omitempty"`
	CorrelationClass      string   `json:"correlation_class,omitempty"`
	CorrelationStatus     string   `json:"correlation_status"`
}

type EventRecord struct {
	ID                    string  `json:"id"`
	RunID                 string  `json:"run_id"`
	SessionID             string  `json:"session_id"`
	ToolCallID            string  `json:"tool_call_id"`
	ProcessID             string  `json:"process_id"`
	SnapshotID            string  `json:"snapshot_id"`
	RawEventID            string  `json:"raw_event_id"`
	CorrelationMethod     string  `json:"correlation_method"`
	CorrelationConfidence float64 `json:"correlation_confidence"`
	CorrelationClass      string  `json:"correlation_class,omitempty"`
	BindingSource         string  `json:"binding_source,omitempty"`
	SelfLaunched          bool    `json:"self_launched,omitempty"`
	ContainerID           string  `json:"container_id"`
	CgroupID              string  `json:"cgroup_id"`
	PID                   int64   `json:"pid"`
	TGID                  int64   `json:"tgid"`
	PPID                  int64   `json:"ppid"`
	Source                string  `json:"source"`
	EventType             string  `json:"event_type"`
	Payload               string  `json:"payload"`
	CreatedAt             string  `json:"created_at"`
}

type EventWindow struct {
	RunID           string `json:"run_id"`
	SessionID       string `json:"session_id,omitempty"`
	ToolCallID      string `json:"tool_call_id,omitempty"`
	Source          string `json:"source"`
	EventType       string `json:"event_type"`
	WindowSeconds   int    `json:"window_seconds"`
	WindowStart     string `json:"window_start"`
	EventCount      int    `json:"event_count"`
	ResolvedCount   int    `json:"resolved_count"`
	UnresolvedCount int    `json:"unresolved_count"`
	HighRiskCount   int    `json:"high_risk_count"`
	UpdatedAt       string `json:"updated_at"`
}

type EventWindowFilter struct {
	RunID         string `json:"run_id,omitempty"`
	SessionID     string `json:"session_id,omitempty"`
	ToolCallID    string `json:"tool_call_id,omitempty"`
	Type          string `json:"type,omitempty"`
	Source        string `json:"source,omitempty"`
	WindowSeconds int    `json:"window_seconds,omitempty"`
}

type EventWindowResult struct {
	SchemaVersion string            `json:"schema_version"`
	Filter        EventWindowFilter `json:"filter"`
	WindowCount   int               `json:"window_count"`
	ResultSetID   string            `json:"result_set_id"`
	PageHash      string            `json:"page_hash"`
	Windows       []EventWindow     `json:"windows"`
}

type FalcoIngestOptions struct {
	Path       string
	RunID      string
	SessionID  string
	AttemptID  string
	ToolCallID string
	ProcessID  string
	SnapshotID string
	RolloutID  string
}

type Filter struct {
	RunID      string
	SessionID  string
	Type       string
	ToolCallID string
}

type IngestEvent struct {
	RunID       string
	RolloutID   string
	AttemptID   string
	SessionID   string
	ToolCallID  string
	ProcessID   string
	SnapshotID  string
	RawEventID  string
	ContainerID string
	CgroupID    string
	PID         int64
	TGID        int64
	PPID        int64
	Timestamp   string
	Source      string
	EventType   string
	Payload     string
	// BindingSource records which binding tier produced this event's
	// correlation (e.g. ai_asserted, zero_sdk_record, control_plane). When the
	// event is resolved against a stored binding it is overwritten from the
	// matched binding; callers with directly-provided context may set it so the
	// self-launched dimension is preserved on the provided_context path.
	BindingSource string
}

type JSONLIngestOptions struct {
	Format     string
	Path       string
	RunID      string
	SessionID  string
	AttemptID  string
	ToolCallID string
	ProcessID  string
	SnapshotID string
	RolloutID  string
	// ExcludePathPrefixes drops file-oriented events whose path is under any of
	// these prefixes. Used to keep the streaming sensor from observing (and
	// ingesting, and thereby generating more of) AgentProvenance's OWN I/O --
	// its data-dir snapshot copies and store DB writes -- which otherwise forms
	// a self-feedback storm that buries and drops real scope events.
	ExcludePathPrefixes []string
	// ExcludeCgroupIDs drops events whose cgroup id matches -- typically the
	// supervisor's own cgroup, so the sensor never ingests its own process's
	// activity. A second, cgroup-granular guard alongside ExcludePathPrefixes.
	ExcludeCgroupIDs []string
	// DropUncorrelated, when set, discards events that resolve to no tracked
	// scope (method unresolved / confidence 0). The always-on streaming sensor
	// sees host-wide activity; events belonging to no ToolCallScope are host
	// noise. Persisting them pollutes the store and -- because the ingest batch
	// references them -- fails per-run graph verify. Dropping them keeps a
	// capture clean and verifiable. Off by default (a per-node security
	// deployment may want unattributed activity retained).
	DropUncorrelated bool
}

type JSONLIngestResult struct {
	BatchID           string          `json:"batch_id,omitempty"`
	Format            string          `json:"format"`
	Path              string          `json:"path"`
	FileSHA256        string          `json:"file_sha256,omitempty"`
	Read              int             `json:"read"`
	Ingested          int             `json:"ingested"`
	Skipped           int             `json:"skipped"`
	Failed            int             `json:"failed"`
	EventIDs          []string        `json:"event_ids,omitempty"`
	EventIDsSHA256    string          `json:"event_ids_sha256,omitempty"`
	Excluded          int             `json:"excluded,omitempty"`
	Dropped           int             `json:"dropped_uncorrelated,omitempty"`
	PolicyDecisions   int             `json:"policy_decisions"`
	PolicyDecisionIDs []string        `json:"policy_decision_ids,omitempty"`
	ReceiverSummary   ReceiverSummary `json:"receiver_summary"`
	Rows              []RowResult     `json:"row_results,omitempty"`
	RowsTruncated     bool            `json:"row_results_truncated,omitempty"`
	Errors            []string        `json:"errors,omitempty"`
}

type ListOptions struct {
	Filter Filter
	Limit  int
	Cursor string
}

type ListResult struct {
	SchemaVersion string        `json:"schema_version"`
	Filter        Filter        `json:"filter"`
	Limit         int           `json:"limit"`
	Cursor        string        `json:"cursor,omitempty"`
	NextCursor    string        `json:"next_cursor,omitempty"`
	HasMore       bool          `json:"has_more"`
	EventCount    int           `json:"event_count"`
	TotalCount    int           `json:"total_count"`
	ResultSetID   string        `json:"result_set_id"`
	PageHash      string        `json:"page_hash"`
	Events        []EventRecord `json:"events"`
}

type NativeStream struct {
	// contains filtered or unexported fields
}

type NativeStreamOptions struct {
	Ingest           JSONLIngestOptions
	BatchEvents      int
	BatchBytes       int64
	FlushInterval    time.Duration
	PendingTTL       time.Duration
	MaxQueuedBytes   int64
	MaxQueuedBatches int
	PolicyEnabled    bool
}

type NativeStreamStatus struct {
	Counters              map[string]int64 `json:"counters"`
	QueuedBatches         int              `json:"queued_batches"`
	QueuedBytes           int64            `json:"queued_bytes"`
	PendingEvents         int64            `json:"pending_events"`
	CleanupPendingBatches int              `json:"cleanup_pending_batches"`
	LastError             string           `json:"last_error,omitempty"`
}

type ProducerCoverageHealth struct {
	CorrelationRatio float64 `json:"correlation_ratio"`
	HasSensorDrops   bool    `json:"has_sensor_drops"`
	Complete         bool    `json:"complete"`
}

type ProducerEventHealth struct {
	RuntimeEvents       int            `json:"runtime_events"`
	CorrelatedEvents    int            `json:"correlated_events"`
	UncorrelatedEvents  int            `json:"uncorrelated_events"`
	SensorDroppedEvents int64          `json:"sensor_dropped_events"`
	BySource            map[string]int `json:"by_source"`
}

type ProducerHealthOptions struct {
	RunID          string
	MaxQueued      int
	MaxQueuedBytes int64
	MaxBatchBytes  int64
	DropPolicy     string
}

type ProducerHealthReport struct {
	SchemaVersion string                 `json:"schema_version"`
	GeneratedAt   string                 `json:"generated_at"`
	RunID         string                 `json:"run_id,omitempty"`
	Limits        ProducerLimits         `json:"limits"`
	Spool         ProducerSpoolHealth    `json:"spool"`
	Events        ProducerEventHealth    `json:"events"`
	Coverage      ProducerCoverageHealth `json:"coverage"`
	// NativeCapture is node-wide even when RunID filters the event view: an
	// unresolved or dropped row cannot honestly be assigned to a particular run.
	NativeCapture NativeStreamStatus `json:"native_node_capture"`
}

type ProducerLimits struct {
	MaxQueuedBatches int    `json:"max_queued_batches"`
	MaxQueuedBytes   int64  `json:"max_queued_bytes"`
	MaxBatchBytes    int64  `json:"max_batch_bytes"`
	DropPolicy       string `json:"drop_policy"`
}

type ProducerSpoolHealth struct {
	ReceivedBatches   int            `json:"received_batches"`
	QueuedBatches     int            `json:"queued_batches"`
	QueuedBytes       int64          `json:"queued_bytes"`
	ProcessingBatches int            `json:"processing_batches"`
	ProcessedBatches  int            `json:"processed_batches"`
	DroppedBatches    int            `json:"dropped_batches"`
	DroppedBytes      int64          `json:"dropped_bytes"`
	FailedBatches     int            `json:"failed_batches"`
	IngestedEvents    int            `json:"ingested_events"`
	FailedEvents      int            `json:"failed_events"`
	ByStatus          map[string]int `json:"by_status"`
}

type ReceiverSummary struct {
	DetectedFormats map[string]int `json:"detected_formats,omitempty"`
	EventTypes      map[string]int `json:"event_types,omitempty"`
	IdentityKeys    map[string]int `json:"identity_keys,omitempty"`
	Resolved        int            `json:"resolved"`
	Unresolved      int            `json:"unresolved"`
	Skipped         int            `json:"skipped"`
	Failed          int            `json:"failed"`
}

type RetentionOptions struct {
	RunID     string        `json:"run_id,omitempty"`
	OlderThan time.Duration `json:"-"`
	Cutoff    string        `json:"cutoff,omitempty"`
	MaxDelete int           `json:"max_delete"`
}

type RetentionResult struct {
	SchemaVersion string   `json:"schema_version"`
	RunID         string   `json:"run_id,omitempty"`
	Cutoff        string   `json:"cutoff"`
	MaxDelete     int      `json:"max_delete"`
	Scanned       int      `json:"scanned"`
	Deleted       int      `json:"deleted"`
	Protected     int      `json:"protected"`
	DeletedIDs    []string `json:"deleted_ids,omitempty"`
}

type RowResult struct {
	Line              int      `json:"line"`
	Status            string   `json:"status"`
	DetectedFormat    string   `json:"detected_format,omitempty"`
	EventID           string   `json:"event_id,omitempty"`
	EventType         string   `json:"event_type,omitempty"`
	Source            string   `json:"source,omitempty"`
	RawEventID        string   `json:"raw_event_id,omitempty"`
	IdentityKeys      []string `json:"identity_keys,omitempty"`
	CorrelationMethod string   `json:"correlation_method,omitempty"`
	Error             string   `json:"error,omitempty"`
}

type SpoolBackpressureError struct {
	Queued         int    `json:"queued"`
	QueuedBytes    int64  `json:"queued_bytes"`
	IncomingBytes  int64  `json:"incoming_bytes"`
	MaxQueued      int    `json:"max_queued"`
	MaxQueuedBytes int64  `json:"max_queued_bytes"`
	MaxBatchBytes  int64  `json:"max_batch_bytes"`
	Reason         string `json:"reason"`
}

type SpoolBatch struct {
	ID            string `json:"id"`
	RunID         string `json:"run_id"`
	Format        string `json:"format"`
	SourcePath    string `json:"source_path"`
	SpoolPath     string `json:"spool_path"`
	FileSHA256    string `json:"file_sha256"`
	SizeBytes     int64  `json:"size_bytes"`
	Status        string `json:"status"`
	Priority      int    `json:"priority"`
	Attempts      int    `json:"attempts"`
	PolicyEnabled bool   `json:"policy_enabled"`
	IngestBatchID string `json:"ingest_batch_id"`
	IngestedCount int    `json:"ingested_count"`
	FailedCount   int    `json:"failed_count"`
	Error         string `json:"error"`
	CreatedAt     string `json:"created_at"`
	UpdatedAt     string `json:"updated_at"`
	ProcessedAt   string `json:"processed_at"`
	DroppedAt     string `json:"dropped_at"`
	DropReason    string `json:"drop_reason"`
}

type SpoolEnqueueRequest struct {
	Format         string
	RunID          string
	SourcePath     string
	PolicyEnabled  bool
	MaxQueued      int
	MaxQueuedBytes int64
	MaxBatchBytes  int64
	DropPolicy     string
}

type SpoolProcessResult struct {
	Processed int                   `json:"processed"`
	Failed    int                   `json:"failed"`
	Batches   []SpoolProcessedBatch `json:"batches,omitempty"`
	Errors    []string              `json:"errors,omitempty"`
}

type SpoolProcessedBatch struct {
	ID                  string `json:"id"`
	IngestBatchID       string `json:"ingest_batch_id"`
	IngestedCount       int    `json:"ingested_count"`
	FailedCount         int    `json:"failed_count"`
	RowResultsTruncated bool   `json:"row_results_truncated,omitempty"`
}

type SpoolQueueStats struct {
	QueuedBatches int   `json:"queued_batches"`
	QueuedBytes   int64 `json:"queued_bytes"`
}

type SpoolService struct {
	DB    *sql.DB
	Paths store.Paths
}