investigate

type AuditRecord struct {
	RequestID       string    `json:"request_id"`
	Time            time.Time `json:"time"`
	Requester       string    `json:"requester"`
	Purpose         string    `json:"purpose"`
	Tool            string    `json:"tool"`
	Language        string    `json:"language,omitempty"`
	QueryHash       string    `json:"query_hash,omitempty"`
	Scope           Scope     `json:"scope"`
	Window          *Window   `json:"window,omitempty"`
	Limits          Limits    `json:"limits"`
	Source          string    `json:"source,omitempty"`
	Outcome         string    `json:"outcome"`
	Truncated       bool      `json:"truncated"`
	Limitations     int       `json:"limitations,omitempty"`
	ErrorClass      string    `json:"error_class,omitempty"`
	DurationMs      int64     `json:"duration_ms"`
	RetainedFinding bool      `json:"retained_finding,omitempty"`
}

type Error struct {
	Class string
	Msg   string
}

type EvidenceReader interface {
	Peek(ruleID string, n int) []evidence.Sample
}

type ExecOptions struct {
	Node      string
	Queryable storage.Queryable
	// Retention reports the local TSDB retention; nil means unknown.
	Retention func() time.Duration
	// PodLogRoot is the /var/log/pods tree; empty disables pod log reads.
	PodLogRoot string
	Enrich     logs.EnrichFunc
	// HostLogPaths are the administrator-allowlisted host log files and directories.
	HostLogPaths []string
	Journal      logql.LineSource
	Evidence     EvidenceReader
	Limits       config.Investigation
	Redactor     *redact.Redactor
	// LookbackDelta is the PromQL staleness window.
	LookbackDelta time.Duration
	// ReadMaxLines and ReadMaxBytes bound lines held by one on-demand read before the pipeline runs.
	ReadMaxLines     int
	ReadMaxBytes     int64
	ReadMaxScanBytes int64
	Clock            func() time.Time
}

type Executor struct {
	// contains filtered or unexported fields
}

type GraphEdge struct {
	From  string         `json:"from"`
	Type  string         `json:"type"`
	To    string         `json:"to"`
	Attrs map[string]any `json:"attrs,omitempty"`
}

type Limits struct {
	MaxLines   int   `json:"max_lines,omitempty"`
	MaxBytes   int64 `json:"max_bytes,omitempty"`
	MaxSeries  int   `json:"max_series,omitempty"`
	MaxSamples int   `json:"max_samples,omitempty"`
	TimeoutMs  int64 `json:"timeout_ms,omitempty"`
}

type LogLine struct {
	Source string            `json:"source,omitempty"`
	Time   time.Time         `json:"time"`
	Labels map[string]string `json:"labels"`
	Text   string            `json:"text"`
}

type NodeRouter interface {
	Nodes() []string
	Run(ctx context.Context, node string, t nodeapi.Task) (nodeapi.TaskResult, error)
}

type NodeStatus struct {
	Node        string `json:"node"`
	Status      string `json:"status"`
	Error       string `json:"error,omitempty"`
	RetentionMs int64  `json:"retention_ms,omitempty"`
	Truncated   bool   `json:"truncated,omitempty"`
}

type Options struct {
	Role string
	// State returns a snapshot that is not mutated while a call reads it.
	State       func() *protocol.State
	Local       *Executor
	Nodes       NodeRouter
	Coordinator storage.Queryable
	Lookback    []config.Lookback
	HTTPClient  *http.Client
	Limits      config.Investigation
	Audit       func(AuditRecord)
	SaveFinding func(findings.Observation) error
	Clock       func() time.Time
	Redactor    *redact.Redactor
}

type Point struct {
	T int64
	V float64
}

type Request struct {
	RequestID string  `json:"request_id,omitempty"`
	Requester string  `json:"requester"`
	Purpose   string  `json:"purpose"`
	Scope     Scope   `json:"scope"`
	Window    *Window `json:"window,omitempty"`
	Limits    Limits  `json:"limits"`
}

type ResourceRef struct {
	UID       string `json:"uid,omitempty"`
	Kind      string `json:"kind,omitempty"`
	Namespace string `json:"namespace,omitempty"`
	Name      string `json:"name,omitempty"`
}

type Result struct {
	Source      string   `json:"source"`
	Window      Window   `json:"window"`
	Limits      Limits   `json:"limits"`
	Truncated   bool     `json:"truncated"`
	Limitations []string `json:"limitations"`
	QueryHash   string   `json:"query_hash,omitempty"`
	Language    string   `json:"language,omitempty"`
	Query       string   `json:"query,omitempty"`
	Executed    string   `json:"executed_query,omitempty"`
	RetentionMs int64    `json:"retention_ms,omitempty"`
	Data        any      `json:"data"`
}

type Scope struct {
	Cluster    bool          `json:"cluster,omitempty"`
	Namespaces []string      `json:"namespaces,omitempty"`
	Resources  []ResourceRef `json:"resources,omitempty"`
	Nodes      []string      `json:"nodes,omitempty"`
}

type Series struct {
	Source string            `json:"source,omitempty"`
	Metric map[string]string `json:"metric"`
	Points []Point           `json:"values"`
}

type Service struct {
	// contains filtered or unexported fields
}

type StateResource struct {
	UID       string         `json:"uid"`
	Kind      string         `json:"kind"`
	Namespace string         `json:"namespace,omitempty"`
	Name      string         `json:"name"`
	Fields    map[string]any `json:"fields,omitempty"`
}

type TaskQuery struct {
	Query      string   `json:"query"`
	StartMs    int64    `json:"start_ms"`
	EndMs      int64    `json:"end_ms"`
	StepMs     int64    `json:"step_ms,omitempty"`
	Forward    bool     `json:"forward,omitempty"`
	Namespaces []string `json:"namespaces,omitempty"`
	Pods       []string `json:"pods,omitempty"`
	Nodes      []string `json:"nodes,omitempty"`
	Limits     Limits   `json:"limits"`
}

type TaskResponse struct {
	Data        Telemetry `json:"data"`
	Truncated   bool      `json:"truncated"`
	Limitations []string  `json:"limitations,omitempty"`
	RetentionMs int64     `json:"retention_ms,omitempty"`
}

type Telemetry struct {
	ResultType string       `json:"result_type"`
	Series     []Series     `json:"series,omitempty"`
	Lines      []LogLine    `json:"lines,omitempty"`
	Nodes      []NodeStatus `json:"nodes,omitempty"`
}

type Window struct {
	Start int64 `json:"start"`
	End   int64 `json:"end"`
}