model

type AST struct {
	Dialect            DBDialect
	RawSQL             string
	Normalized         string
	StmtType           StmtType
	IsMulti            bool
	Tables             []ObjectRef
	Columns            []string
	DirectProjections  []DirectProjectionRef
	ProjectionLineages []ProjectionLineage
	HasWhere           bool
	WhereTautology     bool
	HasLimit           bool
	HasGroupBy         bool
	IsPureAggregate    bool
	Functions          []string
	Operations         []string
	Explain            *ExplainInfo
}

type Agent struct {
	ID         string
	TenantID   string
	Name       string
	Owner      *string
	Status     string
	APIKeyHash string
	Level      string
	ExpiresAt  *time.Time
	CreatedAt  time.Time
	UpdatedAt  time.Time
	// TaskGrantID is set only on an Agent authenticated with a temporary task
	// key. It is never persisted as an Agent field.
	TaskGrantID string
	// TaskGrantIssuerUserID is bound from the authenticated task key before
	// SQL validation so denied attempts retain their issuer in traffic audit.
	// It is runtime-only and is never serialized or persisted as Agent data.
	TaskGrantIssuerUserID string `json:"-"`
}

type Approval struct {
	ID                    string
	TenantID              string
	RequesterUserID       *string
	AuditID               *int64
	AgentID               *string
	DatasourceID          *string
	DatasourceFingerprint *string
	SQLRaw                *string
	SQLNorm               *string
	Reason                *string
	RequestReason         *string
	DecisionComment       *string
	Seal                  *string
	Status                string
	Approver              *string
	DecidedAt             *time.Time
	ExpiresAt             *time.Time
	ClaimedAt             *time.Time
	FinishedAt            *time.Time
	ExecutionAuditID      *int64
	OutcomeCode           *string
	CreatedAt             time.Time
	UpdatedAt             time.Time
}

type Assessment struct {
	Decision     Decision
	Risk         RiskLevel
	StmtType     StmtType
	Hits         []RuleHit
	EstScanRows  int64
	Reason       string
	Suggestion   string
	Normalized   string
	Objects      []ObjectRef
	StageLatency map[string]int64
}

type AuditFilter struct {
	TimeStart    *time.Time
	TimeEnd      *time.Time
	AgentID      *string
	Actor        *string
	DatasourceID *string
	SessionID    *string
	MCPTool      *string
	Action       *string
	ErrorCode    *string
	EventUUID    *string
	TaskGrantID  *string
	Decisions    []string
	StmtTypes    []string
	RiskMin      *int
	RiskMax      *int
	Keyword      string
	ObjectLike   string
	RuleLike     string
}

type AuditLog struct {
	ID             int64
	TenantID       string `json:"tenant_id,omitempty"`
	TS             time.Time
	AgentID        *string
	DatasourceID   *string
	SessionID      *string
	ConversationID *string
	MCPTool        *string
	DBType         *string
	SQLRaw         *string
	SQLNorm        *string
	StmtType       *string
	Objects        *string
	Decision       string
	RuleHits       *string
	RiskLevel      *int
	EstRows        *int64
	RowsReturned   *int
	LatencyMS      *int64
	ClientIP       *string
	ModelName      *string
	ErrorMsg       *string
	ErrorCode      *string `json:"error_code,omitempty"`
	Action         *string
	ActorType      *string
	ActorID        *string
	DetailsJSON    *string
	EventUUID      *string
}

type AuditPage struct {
	Total    int64
	Page     int
	PageSize int
	List     []AuditLog
}

type ColumnDependency struct {
	Origin ColumnOrigin
	Role   DependencyRole
}

type ColumnOrigin struct {
	Relation ObjectRef
	Column   string
	Route    LineageRoute
}

type DBDialect string

type DBErrorCode string

type Datasource struct {
	ID            string
	TenantID      string
	Name          string
	DBType        string
	Host          string
	Port          int
	Database      string
	Username      string
	PasswordEnc   string
	ConnLimit     int
	StmtTimeoutMS int
	RowLimit      int
	TLSMode       string
	TLSServerName string
	TLSCAFile     string
	// TrustServerCertificate is only accepted with SQL Server verify-full mode
	// for controlled development environments. It must remain false in
	// production because it disables server identity verification.
	TrustServerCertificate bool
	CreatedAt              time.Time
	UpdatedAt              time.Time
}

type DatasourceCategory string

type DatasourceTypeSpec struct {
	Category         DatasourceCategory
	DisplayName      string
	DefaultPort      int
	RequiresDatabase bool
	RequiresUsername bool
	RequiresPassword bool
}

type Decision string

type DependencyRole string

type DirectProjectionRef struct {
	Column  string
	Offset  int
	FromEnd bool
	Source  ObjectRef
}

type ExplainInfo struct {
	EstScanRows int64
	EstCost     float64
	UsesIndex   bool
	SeqScan     bool
	Raw         string
}

type LineageArm struct {
	Kind              LineageKind
	Operation         string
	Status            LineageStatus
	Dependencies      []ColumnDependency
	PossibleRelations []ObjectRef
}

type LineageKind string

type LineageRoute uint8

type LineageStatus string

type ManagementAuditOutbox struct {
	EventUUID     string
	TenantID      string
	Action        string
	ActorType     string
	ActorID       string
	DetailsJSON   string
	CreatedAt     time.Time
	Attempts      int
	ClaimedBy     string
	ClaimedAt     *time.Time
	LastError     string
	NextAttemptAt time.Time
	DeliveredAt   *time.Time
}

type MaskRule struct {
	ID                string
	TenantID          string
	DatasourceID      *string
	SchemaName        string
	TableName         string
	ColumnName        string
	SensitiveType     string
	Algo              string
	Enabled           bool
	RangeBucketWidth  *int64
	RangeBucketOffset *int64
	RangeGranularity  *string
	CreatedAt         time.Time
	UpdatedAt         time.Time
}

type ObjectRef struct {
	Schema string
	Table  string
	Alias  string
}

type Permission struct {
	Code        string `json:"code"`
	Description string `json:"description"`
}

type Policy struct {
	ID                    string
	TenantID              string
	AgentID               string
	DatasourceID          string
	ObjectType            string
	ObjectName            string
	Columns               *string
	RowFilter             *string
	Action                string
	RelationBindingID     *string
	Revision              int64
	LegacyUnrepresentable bool
	RelationBinding       *RelationPolicyBinding
	ColumnPermissions     []PolicyColumnPermission
	ColumnStaging         []PolicyColumnPermissionStaging
	CreatedAt             time.Time
	UpdatedAt             time.Time
}

type PolicyColumnPermission struct {
	PolicyID             string
	TenantID             string
	RelationEnrollmentID string
	ColumnOrdinal        int
	ColumnName           string
	ColumnTypeDigest     string
	Usage                string
	ParentRevision       int64
}

type PolicyColumnPermissionStaging struct {
	PolicyID       string
	TenantID       string
	TokenOrdinal   int
	LegacyToken    string
	RequestedUsage string
	SourceCSVHash  string
	BindStatus     string
	ErrorCode      *string
}

type PolicyDecision struct {
	AllowedTables []string
	DeniedTables  []string
	ColumnACL     map[string][]string
	Level         string
}

type ProjectionLineage struct {
	SelectIndex int
	OutputName  string
	Variadic    bool
	SetOp       string
	Arms        []LineageArm
}

type QueryResult struct {
	Columns   []string
	Rows      [][]string
	RowCount  int
	Truncated bool
	LatencyMS int64
}

type RedactionKeyVersion struct {
	ID             string
	TenantID       string
	State          string
	Commitment     string
	Label          string
	ConfigRevision string
	CreatedAt      time.Time
	UpdatedAt      time.Time
	ActivatedAt    *time.Time
	RetiredAt      *time.Time
}

type RelationPolicyBinding struct {
	ID                 string
	TenantID           string
	PolicyID           string
	DatasourceID       string
	SchemaName         string
	RelationName       string
	StableObjectID     *string
	CatalogFingerprint *string
	Status             string
	Revision           int64
	CreatedAt          time.Time
	UpdatedAt          time.Time
}

type RiskLevel int

type Role struct {
	ID          string    `json:"id"`
	TenantID    string    `json:"tenant_id"`
	Name        string    `json:"name"`
	Description string    `json:"description"`
	Builtin     bool      `json:"builtin"`
	ParentIDs   []string  `json:"parent_role_ids"`
	Permissions []string  `json:"permissions"`
	CreatedAt   time.Time `json:"created_at"`
	UpdatedAt   time.Time `json:"updated_at"`
}

type Rule struct {
	ID          string
	TenantID    string
	DBType      string
	Title       string
	RiskLevel   int
	PatternType string
	Definition  string
	Enabled     bool
	Builtin     bool
	CreatedAt   time.Time
	UpdatedAt   time.Time
}

type RuleContext struct {
	Agent      *Agent
	Datasource *Datasource
	AST        *AST
	Policy     *PolicyDecision
}

type RuleHit struct {
	RuleID     string
	Risk       RiskLevel
	Decision   Decision
	Message    string
	Suggestion string
}

type StmtType string

type TaskReadGrant struct {
	ID           string
	TenantID     string
	IssuerUserID string
	AgentID      string
	DatasourceID string
	SQLSHA256    string
	KeyHash      string
	MaxUses      *int64
	UsedCount    int64
	ExpiresAt    time.Time
	RevokedAt    *time.Time
	CreatedAt    time.Time
}

type TaskReadGrantRequest struct {
	ID              string
	TenantID        string
	RequesterUserID string
	AgentID         string
	DatasourceID    string
	SQLSHA256       string
	SQLCiphertext   string
	RequestDigest   string
	IdempotencyKey  string
	MaxUses         *int64
	ExpiresAt       time.Time
	Status          string
	ReviewerUserID  *string
	ReviewedAt      *time.Time
	IssuedAt        *time.Time
	GrantID         *string
	GrantRevokedAt  *time.Time
	CreatedAt       time.Time
}

type Tenant struct {
	ID        string    `json:"id"`
	Name      string    `json:"name"`
	Status    string    `json:"status"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}

type User struct {
	ID              string    `json:"id"`
	TenantID        string    `json:"tenant_id"`
	Username        string    `json:"username"`
	DisplayName     string    `json:"display_name"`
	PasswordHash    string    `json:"-"`
	Status          string    `json:"status"`
	AuthProvider    string    `json:"auth_provider"`
	ExternalSubject *string   `json:"external_subject,omitempty"`
	CreatedAt       time.Time `json:"created_at"`
	UpdatedAt       time.Time `json:"updated_at"`
}