raglit

type ACL struct {
	Owner      string     `json:"owner"`
	Visibility Visibility `json:"visibility"`
}

type Assembler struct {

	// MinChars: absorb sub-floor siblings up to this size (0 disables the floor).
	// MaxChars: never absorb past this.
	MinChars, MaxChars int
	// contains filtered or unexported fields
}

type AttachmentMove struct {
	Archive string `json:"archive"`
	OldPath string `json:"old_path"`
	NewPath string `json:"new_path"`
	// Err is set when this one could not be moved. The migration continues: a
	// half-moved corpus with a report is recoverable, a migration that stops at
	// the first bad file leaves nobody knowing which side of it they are on.
	Err string `json:"error,omitempty"`
}

type AttestationRow struct {
	Doc       string
	Seq       int
	Unit      string
	Kind      string
	Blanket   bool
	Text      string
	Label     string
	Note      string
	Statement string
	Payload   string
	RuledBy   string
	Auth      string
	RuledAt   string
}

type AuditEvent struct {
	Op string `json:"op"`
	// At is when the event was appended, not when a person decided — the decision
	// date lives on the payload. Both matter and they are not the same: a ruling
	// made in July and imported in September is one of each.
	At string `json:"at"`
	By string `json:"by,omitempty"`

	Relation   *Mark           `json:"relation,omitempty"`
	Slice      *Slice          `json:"slice,omitempty"`
	SliceID    string          `json:"slice_id,omitempty"`
	Correction *PageCorrection `json:"correction,omitempty"`
	Withdrawal *Withdrawal     `json:"withdrawal,omitempty"`
	// RestorePath names the document a doc.restore returns to the corpus.
	RestorePath string `json:"restore_path,omitempty"`
	// Authority names the reading a person ruled governs for a source. See
	// ReadingAuthority — it is a ruling, so it lives in the trail rather than in
	// the index, which is derived and thrown away by a reindex.
	Authority *ReadingAuthority `json:"authority,omitempty"`
}

type AuthConfig struct {
	// Issuer is the OIDC issuer URL (discovery at <issuer>/.well-known/
	// openid-configuration). Empty → the daemon does not authenticate.
	Issuer string `json:"issuer,omitempty"`
	// Audience is the token's required aud: the client id (or project id) the
	// IdP issues raglit tokens for.
	Audience string `json:"audience,omitempty"`
	// Admin is the principal ("<iss>#<sub>") that owns every index without an
	// acl.json — the indexes from before auth. Required when Issuer is set.
	Admin string `json:"admin,omitempty"`
	// ClientID and RedirectURL turn on BROWSER login (authorization code +
	// PKCE, session cookie) for the review UI. ClientID is a public (no secret)
	// web/user-agent application at the IdP; RedirectURL is
	// <daemon public URL>/auth/callback, registered there exactly. Both empty →
	// the browser gets 401 like any client without a token.
	ClientID    string `json:"client_id,omitempty"`
	RedirectURL string `json:"redirect_url,omitempty"`
	// TokenCommand prints a bearer token on stdout. The client runs it when
	// $RAGLIT_TOKEN is unset, and again after a 401. A headless client (a
	// Zitadel machine user) puts its client-credentials exchange here.
	TokenCommand string `json:"token_command,omitempty"`
}

type Block struct {
	ProbeFromPage int `json:"probe_from_page"`
	ProbeToPage   int `json:"probe_to_page"`
	MatchFromPage int `json:"match_from_page"`
	MatchToPage   int `json:"match_to_page"`
	// Runs is how many separate identical spans the block was chained from. 1
	// means the region is identical throughout; a high count on a short block
	// means the two copies differ constantly, which is itself the finding.
	Runs int `json:"runs"`
	// MatchedChars is folded characters proved identical inside the block;
	// SpanChars is the block's extent on the probe side. Agreement is their ratio.
	MatchedChars int `json:"matched_chars"`
	SpanChars    int `json:"span_chars"`
	// Gaps are the disagreements inside the block, largest first, capped.
	Gaps []Gap `json:"gaps,omitempty"`
	// contains filtered or unexported fields
}

type BranchChange struct {
	Path       string `json:"path"`
	Change     string `json:"change"` // "added", "changed", "same" (a copy with the parent's bytes) or "deleted"
	Hash       string `json:"hash,omitempty"`
	ParentHash string `json:"parent_hash,omitempty"`
	Title      string `json:"title,omitempty"`
}

type BranchInfo struct {
	Name           string `json:"name"`
	Parent         string `json:"parent"`
	CreatedAt      int64  `json:"created_at"`
	LastAccessedAt int64  `json:"last_accessed_at"`
	Documents      int    `json:"documents"`
}

type BranchMeta struct {
	Parent         string `json:"parent"`
	Root           string `json:"root,omitempty"`
	ParentRoot     string `json:"parent_root,omitempty"`
	CreatedAt      int64  `json:"created_at"`
	LastAccessedAt int64  `json:"last_accessed_at"`
}

type Changes struct {
	Root     string
	Paths    []string
	Degraded bool
}

type ChannelStat struct {
	Model    string `json:"model"`
	Width    int    `json:"width"`
	InFlight int    `json:"in_flight"`
	Peak     int    `json:"peak"`
	Calls    int    `json:"calls"`
	N429     int    `json:"n_429"`
	// Chilled is true while backpressure is still holding the width down.
	Chilled bool `json:"chilled,omitempty"`
}

type Channels struct {

	// Max is the widest any channel may grow. 0 → maxChannelWidth.
	//
	// The one knob worth configuring, because the ceiling is the only part of
	// this that depends on WHAT KIND of endpoint is behind it rather than on
	// evidence. A local card serving one model at a time is never going past a
	// handful; a hosted provider bought for throughput will take far more, and
	// there the ceiling — not the provider — would be the limit. Everything else
	// is learned.
	Max int
	// contains filtered or unexported fields
}

type Chatter interface {
	ChatStream(ctx context.Context, messages []llm.Message, tools []llm.ToolDef,
		opts *llm.ChatOpts) (<-chan llm.StreamChunk, error)
}

type CodeSegmenter interface {
	// ForPath names the language of a path, from its extension. ok is false
	// for a file the segmenter cannot parse.
	ForPath(path string) (lang string, ok bool)
	// Symbols returns the declarations of content, parsed as lang.
	Symbols(lang string, content []byte) ([]CodeSpan, error)
	// Sections returns one span per heading section of a Markdown document.
	Sections(content []byte) ([]CodeSpan, error)
	// Runtime names the parser and its version. It is in the pool recipe,
	// because two parsers can cut the same file differently.
	Runtime() string
}

type CodeSpan struct {
	Sym, Class string
	StartLine  int
	EndLine    int
	// CommentStartLine is the first line of the doc comment above the
	// declaration, 0 when there is none.
	CommentStartLine int
	// BodyStartLine is the line where a callable's body begins, 0 when it has
	// none.
	BodyStartLine int
}

type Confidence int

type Config struct {
	BaseURL     string `json:"base_url"`
	APIKey      string `json:"api_key"`
	VisionModel string `json:"vision_model"`
	EmbedModel  string `json:"embed_model"`
	// AudioModel names oidio's transcriber, which reads a recording so raglit can
	// index the transcript and review the reading. Empty → audio ingest is
	// unavailable and an audio job says so; a corpus of documents needs no
	// transcriber.
	//
	// Through corrallm — which is how oidio is actually deployed — the ids are
	// "oidio-stt-diarize" (speaker-labelled segments) and "oidio-stt" (plain
	// text), served from the SAME endpoint as the vision and embed models.
	// Standalone, oidio calls the same two "stt-diarize" and "stt".
	AudioModel string `json:"audio_model,omitempty"`
	// AudioBaseURL overrides where the transcriber lives. Empty → BaseURL, which
	// is right whenever oidio is behind the same broker as everything else.
	//
	// This started as a REQUIRED field of its own, on the reasoning that oidio is
	// a separate process on :8077 and assuming one gateway fronts both would make
	// a working setup unreachable. The :8077 in oidio's own example config is its
	// standalone-dev address; the deployment puts it under corrallm, whose
	// OpenAI proxy already re-exports it alongside the vision and embed models on
	// one base URL. So the separate endpoint is the exception, not the rule, and
	// the field earns its keep as an override rather than a second thing to set.
	AudioBaseURL string `json:"audio_base_url,omitempty"`
	// EmbedLimitChars caps a fragment's size to what the embed model accepts as one
	// input — probed once and stored (DiscoverEmbedLimit), so the deterministic
	// fragmenter's ceiling is bounded by the model, not by taste. 0 = not probed
	// (the fragmenter falls back to FragWindow uncapped).
	EmbedLimitChars int `json:"embed_limit_chars,omitempty"`
	// EmbedLimitTokens is the same limit in the unit the embedder counts in, and
	// it is the one that decides. EmbedLimitChars is a conversion of it at two
	// characters per token; a scanned court brief is 1.57, so a fragment can sit
	// inside the character ceiling and still be refused. 0 = not established.
	EmbedLimitTokens int `json:"embed_limit_tokens,omitempty"`
	// SegmentInputLimitTokens caps ONE segmentation REQUEST — prompt, carried-over
	// fragment and page text — to what the chat endpoint accepts, asked once and
	// stored (the server's own n_ctx where it states one, else llm.DiscoverContext).
	// The mirror of EmbedLimitChars on the other side of the call: that one bounds
	// what comes back, this one bounds what is sent.
	//
	// TOKENS, because that is the unit every endpoint states its limit in.
	// EmbedLimitChars stays in characters because it sizes a fragment, and the
	// conversion between the two is not a constant: measured with the model's own
	// tokenizer, this corpus runs 4.66 chars/token on prose and 1.16 on a survey
	// legal description.
	//
	// 0 = not established (no cap). Set it to override on a proxy that accepts a
	// prompt its backend will later refuse — which cannot be measured from
	// outside.
	SegmentInputLimitTokens int `json:"segment_input_limit_tokens,omitempty"`
	// FragWindow / FragStride / FragFloor tune the deterministic overlapping-window
	// text fragmenter (chars). 0 → defaults (1000 / 750 / 300; see fragment.go). window > stride
	// gives the overlap; floor folds a short tail. They feed frag_recipe, so a
	// change marks the affected documents for reprocessing.
	FragWindow int `json:"frag_window,omitempty"`
	FragStride int `json:"frag_stride,omitempty"`
	FragFloor  int `json:"frag_floor,omitempty"`
	// TranscriptionModel and DescribeModel are the per-kind ingest models (F11):
	// when ingest descends a page into zones, it reads each zone with the model
	// for its KIND — text zones go to the transcription model, diagram/figure
	// zones to the multimodal describer. A transcription model (chandra-ocr-2)
	// reads drawings poorly and a describer is wasted on paragraphs, so one
	// VisionModel covering both roles costs whichever side it was chosen for.
	//
	// Both empty → routing is a no-op: every zone is read by VisionModel exactly
	// as today, which is the live default (init does not ask for these). Set
	// only one and the other kind keeps reading VisionModel; set both and a page
	// can be split across two models. A zone whose kind is neither text nor
	// diagram/figure falls back to VisionModel either way.
	TranscriptionModel string `json:"transcription_model,omitempty"`
	DescribeModel      string `json:"describe_model,omitempty"`
	// IdentityModel names the chat model that says what a document IS — a
	// caption, a summary and a kind, asked once per document on the assembled
	// transcript (identity.go). Empty → the segment model, else the vision
	// model; set this to caption with a different text model than either.
	IdentityModel string `json:"identity_model,omitempty"`
	// IdentityProvider is IdentityModel's provider. Empty → the legacy
	// base_url/api_key, as before providers. Unused when IdentityModel is empty:
	// identity then runs on the segment model and its provider.
	IdentityProvider string `json:"identity_provider,omitempty"`
	// IdentitySlots is how many captioning requests are in the model at once.
	// 0 → DefaultIdentitySlots (2), which is what this endpoint serves
	// concurrently. Raising it past what the server actually runs does not make
	// anything faster: the extra requests wait INSIDE the server, where raglit
	// cannot see them, cannot resume them, and cannot tell them apart from an
	// ingest job's OCR call waiting for the same slot.
	IdentitySlots int `json:"identity_slots,omitempty"`
	// SessionBranchTTLHours is how long a session branch ("idx@session")
	// outlives its last write before the daemon deletes it. 0 → 168 (7 days:
	// USER 2026-10-30, "7 day to save thrash").
	SessionBranchTTLHours int `json:"session_branch_ttl_hours,omitempty"`

	// ModelChannelMax caps how wide any one model's admission channel may grow
	// (modelchan.go). 0 → the built-in ceiling.
	//
	// Every other number in that controller is LEARNED — a model starts at one
	// slot and widens only while calls succeed, halving whenever the server
	// pushes back. This is the exception, because the right ceiling depends on
	// what kind of endpoint is behind the name and no amount of evidence
	// distinguishes "has not said no yet" from "will take a hundred": a card
	// serving one model locally is never going past a handful, while a hosted
	// provider bought for throughput will, and there the ceiling would be the
	// only thing limiting it.
	ModelChannelMax int `json:"model_channel_max,omitempty"`
	// NoIdentity turns document identity off. Documents then carry only the
	// filename they arrived with — which for a scanner-named corpus is a list
	// nobody can navigate, so this is for a corpus whose names are already good
	// (a code tree) or an endpoint you do not want the extra call on.
	NoIdentity bool `json:"no_identity,omitempty"`
	// CodeSegmenter cuts source files at their declarations and Markdown at
	// its headings (KindCode), one fragment per declaration or section, each
	// with its lines and symbol path. raglitd's segmenter is poly-lsp-mcp's
	// tree-sitter segment package (cmd/raglit/codesegment.go). False → code
	// and Markdown are read into windows, as before. Turning it on changes the
	// KindCode pool key, so a changed file is cut again on its next ingest. An
	// unchanged file is not: the unchanged-bytes check skips it before the pool
	// key is looked at, so files indexed before the switch keep their windows
	// until `raglit ingest --fresh` re-reads them.
	// The daemon flag --code-segmenter turns it on as well.
	CodeSegmenter bool `json:"code_segmenter,omitempty"`
	// DefaultIndex is the index used when a command gives no --index. Empty →
	// "default". Set it in the wizard to make one named index your working default.
	DefaultIndex string `json:"default_index,omitempty"`
	// Project names this project. On the SHARED daemon it namespaces every index
	// this client touches (daemon index = "<project>__<local>"), so two projects
	// both using index "default" don't collide, and a project's "search all" stays
	// within its own indexes. Required to start a daemon-routed client (serve/CLI);
	// --embedded/--db (single-session, in-process) don't need it. Set in the wizard.
	Project string `json:"project,omitempty"`
	// Shared lists OTHER project namespaces this project also SEARCHES (reads only).
	// A "search all" spans "<project>__*" plus each "<shared>__*", so common docs
	// (e.g. ~/doc indexed once under a project named "shared") are visible from
	// every project that opts in — without duplicating them per project. Writes
	// (ingest/branch) still target this project only. Empty → fully isolated.
	Shared []string `json:"shared,omitempty"`
	// Watch, when true, tells the daemon to keep this project's configured source
	// roots fresh: after you register it (a `raglit sync` with watch:true, or
	// `raglit watch`), the daemon re-scans the roots on an interval and re-ingests
	// changed files / drops deleted ones. Needs `indexes` (the roots to watch).
	Watch bool `json:"watch,omitempty"`

	// WritebackTranscriptionMd materialises <doc>.raglit-transcription.md beside
	// every ingested document, project-wide. A per-index setting of the same name
	// overrides this for that index.
	WritebackTranscriptionMd bool `json:"writeback_transcription_md,omitempty"`
	// ExtractEmailAttachments writes a mail archive's attachments into
	// <archive>.raglit-attachments/ beside it, project-wide, so the documents
	// inside an .eml/.mbox become ordinary files the next sync indexes. A
	// per-index setting of the same name overrides this for that index.
	ExtractEmailAttachments bool `json:"extract_email_attachments,omitempty"`
	// SegmentModel splits transcribed TEXT into fragments. Empty → the vision
	// model, which is what this always used to be.
	//
	// They are different jobs and the best model for one is not the best for the
	// other. The segmenter is asked for a structured tool call over text; an OCR
	// specialist is chosen for reading pixels and need not do the first well.
	// Measured on a 2-page 1947 deed, same cached OCR, four arms:
	//
	//	chandra + markup     degraded — no valid JSON
	//	Qwen    + markup     done, dropped 1184 of 1234 chars
	//	chandra + flattened  degraded — no valid JSON
	//	Qwen    + flattened  done, clean
	//
	// Corpus-wide the same split: chandra degraded 29 of 116 documents (25%),
	// Qwen 4 of 254 (1.6%).
	SegmentModel string `json:"segment_model,omitempty"`
	// DaemonURL, when set, makes this a CLIENT config: commands route to the
	// raglit daemon at this URL (http(s)://host:port) instead of opening a local
	// index. The daemon owns storage (scoped per index, under its own home), so
	// the local .raglit/ then holds config only. Precedence for the effective
	// daemon: --daemon flag > $RAGLIT_DAEMON > this. Empty → local (embedded) mode.
	DaemonURL string `json:"daemon_url,omitempty"`
	// OCR configures the cheap tier — either as the cascade's first pass or as
	// the vision model's spelling reference (OCRConfig.Mode). Zero value →
	// VLM-only (every page transcribed by the vision model).
	OCR OCRConfig `json:"ocr,omitempty"`
	// ImageEmbed optionally configures an image embedder for FIGURES: when its
	// Model is set, a figure is embedded from its IMAGE instead of its description.
	// nomic-embed-vision-v1.5 shares nomic-embed-text's space, so image figures stay
	// searchable by the same text query — requires EmbedModel to be nomic-embed-text.
	ImageEmbed ImageEmbedConfig `json:"image_embed,omitempty"`

	// Ignore is this config's default exclude globs (project-scoped — it does not
	// affect other projects' configs). Merged with a built-in default (dot-dirs,
	// node_modules, vendor) and the per-index / per-root ignores; ignore wins.
	Ignore []string `json:"ignore,omitempty"`
	// Gitignore, when nil or true, also honors each root's .gitignore chain.
	Gitignore *bool `json:"gitignore,omitempty"`
	// Indexes declares named indexes and the source roots + rules that feed them,
	// for `raglit sync`. Multi-index: one project can define several.
	Indexes map[string]IndexConfig `json:"indexes,omitempty"`
	// Auth turns on OIDC for the daemon and tells a client how to get a token.
	// Nil → no auth, every index readable by anyone who can reach the daemon.
	Auth *AuthConfig `json:"auth,omitempty"`

	// Providers are named model endpoints, and each role picks one
	// (USER 2026-10-22: provider, then model — set from the UI). A role with
	// no provider uses BaseURL/APIKey above, so a config written before
	// providers existed behaves exactly as it did.
	Providers       map[string]Provider `json:"providers,omitempty"`
	VisionProvider  string              `json:"vision_provider,omitempty"`
	EmbedProvider   string              `json:"embed_provider,omitempty"`
	SegmentProvider string              `json:"segment_provider,omitempty"`
	AudioProvider   string              `json:"audio_provider,omitempty"`
}

type ContextProber interface {
	// ContextWindow is the limit as the SERVER states it (llama.cpp /props),
	// ok=false when it does not state one.
	ContextWindow(ctx context.Context) (int, bool)
	// DiscoverContext measures it by overflowing, which costs O(log N) requests
	// and returns a lower bound. The fallback, not the first choice.
	DiscoverContext(ctx context.Context) (int, error)
}

type Coverage struct {
	Parent    string  `json:"parent"`
	Pages     int     `json:"pages"`
	Covered   int     `json:"covered"`
	Uncovered []int   `json:"uncovered,omitempty"`
	Overlaps  [][]int `json:"overlaps,omitempty"` // [page, count] for pages in >1 slice
}

type DPIDecision struct {
	DPI       int
	Reason    string  // "need" | "cap" | "native" | "base"
	CapDPI    int     // what the token budget allowed
	NativeDPI int     // what the source holds (0 = unknown)
	NeedDPI   int     // what the glyph measurement asked for
	WantDPI   int     // the resolution asked for, BEFORE the cap
	Tiles     int     // canvases needed to deliver WantDPI
	Density   float64 // tokens/sq in delivered at DPI
}

type DiffShape struct {
	Pages int `json:"pages"`
	// Clean is pages matching at 1.0, Noisy is pages disagreeing a little
	// (>= NoisyFloor), Divergent is pages disagreeing a lot.
	Clean     int `json:"clean"`
	Noisy     int `json:"noisy"`
	Divergent int `json:"divergent"`
	Missing   int `json:"missing"`
}

type DocContent struct {
	Path      string        `json:"path"`
	Title     string        `json:"title"`
	Pages     []DocPageText `json:"pages"`
	Text      string        `json:"text"`
	Truncated bool          `json:"truncated"`
	Figures   []FigureRef   `json:"figures,omitempty"`
}

type DocCost struct {
	Path         string
	Hash         string
	Passages     int
	Embeddings   int
	PageReads    int
	Bytes        int64   // passage text + embeddings + saved original and page images
	ModelSeconds float64 // import jobs that did model work (not pooled, not unchanged)
}

type DocDiff struct {
	// SameBytes short-circuits everything below it.
	SameBytes bool `json:"same_bytes"`
	// Match is the whole-document alignment: relation, coverage, blocks, gaps,
	// and the numeric tokens that differ. Reused rather than recomputed so a
	// diff and a `similar` report of the same pair can never disagree.
	Match DocMatch `json:"match"`
	// Pages is one row per page of A, in page order.
	Pages []PagePair `json:"pages"`
	// OnlyInB lists pages of B that no page of A matched — the other half of
	// "what is missing", which a table keyed on A cannot show.
	OnlyInB []int `json:"only_in_b,omitempty"`
	// Shape summarises where the disagreement lives, which is the actual input
	// to the copy-versus-version decision.
	Shape DiffShape `json:"shape"`
}

type DocFields struct {
	Type   string          `json:"type"`
	Fields json.RawMessage `json:"fields"`
	// Source is 'machine' or 'person'. A person's extraction is never
	// regenerated over — the same rule a person's caption follows.
	Source   string `json:"source,omitempty"`
	Model    string `json:"model,omitempty"`
	At       int64  `json:"at,omitempty"`
	TextHash string `json:"text_hash,omitempty"`
	// TypeHash fingerprints the type DEFINITION these fields were read under
	// (DocType.Hash), so an extraction that answers a schema's older questions
	// can be told from one that answers its current ones. Empty means unknown,
	// which is treated as stale.
	TypeHash string `json:"type_hash,omitempty"`
}

type DocIdentity struct {
	Name    string `json:"name"`
	Summary string `json:"summary"`
	Kind    string `json:"kind"`
	// ContentTags are 3–5 short noun phrases describing what the document is
	// ABOUT (subject matter, entities, procedures). Open vocabulary but
	// constrained in shape; see validateIdentity.
	ContentTags []string `json:"content_tags,omitempty"`
	// RoleTags are 1–3 terms from identityRoleKinds describing what job the
	// document does in the corpus (documentation, reference, overview…).
	// Closed vocabulary so they stay groupable and filterable.
	RoleTags []string `json:"role_tags,omitempty"`
	// DocType is which of the INDEX's registered document types this resolved
	// as, empty for none. Its vocabulary is per-index and authored (doctype.go),
	// unlike Kind, which is raglit's and closed. A document that resolves as one
	// is asked to fill out that type's schema; most documents resolve as none,
	// and that is the normal case rather than a failure.
	DocType string `json:"doc_type,omitempty"`
	// Source is 'machine' (a model read the transcript) or 'person' (someone
	// corrected it). A person's identity is never overwritten by a re-run.
	Source string `json:"source,omitempty"`
	Model  string `json:"model,omitempty"`
	At     int64  `json:"at,omitempty"` // unix nanos
	// TextHash fingerprints the text this caption was written from, so a
	// transcript that changes underneath it can be detected. See
	// documents.gen_text_hash.
	TextHash string `json:"text_hash,omitempty"`
}

type DocKind int

type DocMatch struct {
	Path  string `json:"path"`
	Title string `json:"title,omitempty"`

	Relation Relation `json:"relation"`

	// Jaccard is |A∩B|/|A∪B| over distinct shingles: "are these the same
	// document". Exact, not estimated.
	Jaccard float64 `json:"jaccard"`
	// ContainProbe is |A∩B|/|A| — how much of the PROBE occurs in this document.
	// ContainMatch is the reverse. Asymmetric on purpose; a single number here
	// cannot express "wholly inside".
	ContainProbe float64 `json:"contain_probe"`
	ContainMatch float64 `json:"contain_match"`

	// BlockCoverProbe / BlockCoverMatch are the fraction of each side covered by
	// runs of at least MinRunChars. These are the numbers Relation is decided on,
	// because they are the ones shared boilerplate cannot inflate.
	BlockCoverProbe float64 `json:"block_cover_probe"`
	BlockCoverMatch float64 `json:"block_cover_match"`

	SharedShingles int `json:"shared_shingles"`
	ProbeShingles  int `json:"probe_shingles"`
	MatchShingles  int `json:"match_shingles"`

	// GenericChars is how much of the PROBE was excluded as corpus-generic (an
	// email footer, a caption repeated across unrelated filings). Reported rather
	// than applied silently: masking is the one step that can hide a real
	// duplicate, so when a document is mostly generic the person reading the
	// result has to be able to see that is why the score is low.
	GenericChars int `json:"generic_chars,omitempty"`

	// MatchedChars is the total folded characters proved identical, counting
	// overlaps once. Coverage alone cannot be acted on for a short document: 0.83
	// of a 400-character email is a signature block, and 0.83 of a deed is a deed.
	MatchedChars int `json:"matched_chars"`

	Blocks []Block `json:"blocks,omitempty"`

	// NumericOnlyInProbe / NumericOnlyInMatch are numeric tokens (auditor file
	// numbers, distances, bearings, dollar amounts, dates) that appear inside the
	// aligned region on ONE side only.
	//
	// This is the headline finding for a legal corpus and it is cheap. Two copies
	// of one deed that align at 0.97 and disagree about "25.00" versus "30.00" are
	// not a housekeeping problem; in this matter there is an open question about
	// which of two 25-foot strips a plat depicts, and one exhibit's OCR was found
	// fabricated outright. A digits-level diff over the aligned span puts that in
	// front of a person instead of averaging it into a score.
	NumericOnlyInProbe []string `json:"numeric_only_in_probe,omitempty"`
	NumericOnlyInMatch []string `json:"numeric_only_in_match,omitempty"`
}

type DocPageText struct {
	Page int    `json:"page"`
	Text string `json:"text"`
}

type DocRef struct {
	Path  string `json:"path"`
	Title string `json:"title"`
}

type DocSummary struct {
	Path      string         `json:"path"`
	Title     string         `json:"title"`
	Fragments int            `json:"fragments"`
	Pages     int            `json:"pages"`     // OCR-tracked pages (page ≥ 1)
	Vision    int            `json:"vision"`    // pages that used the VLM
	FragMode  string         `json:"frag_mode"` // how it was fragmented: text-overlap | llm-seg | code | sections
	Engines   map[string]int `json:"engines"`   // engine → page count
	// AddedAt is when the document was last really ingested (Unix nanoseconds).
	// A re-ingest of an unchanged file is skipped before commit (worker.go), so
	// it does not move AddedAt.
	AddedAt int64 `json:"added_at"`
	// SrcSize / SrcMtime are the source file's bytes and modified time (unix
	// seconds); 0 when unknown (srcstat.go).
	SrcSize  int64 `json:"src_size,omitempty"`
	SrcMtime int64 `json:"src_mtime,omitempty"`
	// ContentHash is documents.content_hash: the sha256 hex of the raw source
	// bytes, not of the extracted text, and the same value as
	// Store.DocumentHash; "" for a document never hashed.
	ContentHash string `json:"content_hash,omitempty"`
	// GenName / GenKind / GenSource are what the document IS (identity.go), for a
	// list a person can navigate. Both names travel: the caption is what a reader
	// needs, and the filename is what everything else joins on — and where they
	// disagree, THAT is the finding.
	GenName   string `json:"gen_name,omitempty"`
	GenKind   string `json:"gen_kind,omitempty"`
	GenSource string `json:"gen_source,omitempty"` // machine | person
	// GenSummary is the generated account of what the document covers, and
	// GenModel the model that wrote the caption (empty for a person's). Carried
	// so a list can show what a document is without a request per row.
	GenSummary string `json:"gen_summary,omitempty"`
	GenModel   string `json:"gen_model,omitempty"`
	// GenContentTags / GenRoleTags are the document's tags (identity.go):
	// what it is about, and what job it does in the corpus.
	GenContentTags []string `json:"gen_content_tags,omitempty"`
	GenRoleTags    []string `json:"gen_role_tags,omitempty"`
}

type DocType struct {
	Name string `json:"name"`
	// Description is one line saying how to RECOGNISE one — it is what the
	// identity call is shown when choosing among the registered types, so it
	// describes the document, not the fields.
	Description string `json:"description,omitempty"`
	// Prompt is the extraction instruction: how to read these fields out of this
	// kind of document, including what its conventions mean. Travels with the
	// schema because a schema alone produces a confidently filled-in form.
	Prompt string `json:"prompt,omitempty"`
	// Schema is a JSON Schema object describing the fields — the `parameters` of
	// the extraction tool call.
	Schema json.RawMessage `json:"schema,omitempty"`
	// Gold is the documents the schema was proposed from, kept so a revision can
	// be judged against the same examples rather than whatever is at hand.
	Gold      []string `json:"gold,omitempty"`
	Model     string   `json:"model,omitempty"`
	CreatedAt int64    `json:"created_at,omitempty"`
	UpdatedAt int64    `json:"updated_at,omitempty"`
}

type Document struct {
	Path      string
	Title     string
	Fragments []Fragment
}

type EmailAttachmentRef struct {
	Name string `json:"name"`
	Mime string `json:"mime,omitempty"`
	Size int64  `json:"size,omitempty"`
	Sum  string `json:"sum,omitempty"`
	// Path is the extracted file beside the archive, when extraction ran and the
	// bytes are on disk. Empty means the attachment was seen and not extracted —
	// which is a different statement from "there is no attachment", and the UI
	// must not render them the same way.
	Path string `json:"path,omitempty"`
}

type EmailHeader struct {
	Name  string `json:"name"`
	Value string `json:"value"`
}

type EmailMessage struct {
	// Page is the page number this message occupies in the indexed document, so
	// a citation from search lands on the same message a reader is looking at.
	Page int `json:"page"`
	// Depth is enclosure: 0 is a top-level message in the archive, 1 is a message
	// forwarded inside one, and so on. This is the thread structure.
	Depth   int    `json:"depth"`
	From    string `json:"from,omitempty"`
	To      string `json:"to,omitempty"`
	Cc      string `json:"cc,omitempty"`
	Date    string `json:"date,omitempty"`
	Subject string `json:"subject,omitempty"`
	// Headers is EVERY header, name and value, sorted. The page text keeps four
	// and counts the rest; this is the rest.
	Headers []EmailHeader `json:"headers,omitempty"`
	Body    string        `json:"body,omitempty"`
	// Attachments are what this message carried, whether or not extraction ran.
	// "A 4 MB PDF called survey.pdf was sent on this date" is itself evidence.
	Attachments []EmailAttachmentRef `json:"attachments,omitempty"`
	// Notes is structure the reader could not parse, carried rather than dropped.
	Notes []string `json:"notes,omitempty"`
}

type Embedder struct {
	Client      VectorClient
	Model       string
	DocPrefix   string
	QueryPrefix string
	// BatchLimitChars caps ONE embed request's total input. 0 → a conservative
	// default. The server's limit applies to the whole request, so this bounds
	// the batch, not the individual fragment.
	BatchLimitChars int
}

type EnqueueItem struct {
	URL, Title string
	Fresh      bool
}

type EnqueueResult struct {
	ID  int64
	Err error
}

type ErrIdentityTooShort struct{ Chars int }

type ErrSegmentShort struct {
	Page    int
	In, Out int
}

type Fetched struct {
	Data        []byte
	Title       string // basename, for the document title
	IsPDF       bool   // route to OCR vs plain-text fragmenting
	ContentType string // HTTP Content-Type, for format routing (empty for local files)
}

type FieldsCoverage struct {
	Type      string `json:"type"`
	Resolved  int    `json:"resolved"`
	Extracted int    `json:"extracted"`
	// Stale is extractions that answer an older schema or an older transcript.
	// Counted separately from Extracted because "88 of 88 extracted" over a
	// schema edited yesterday is a coverage report that lies.
	Stale int `json:"stale,omitempty"`
}

type FieldsStale string

type FigureHit struct {
	MediaID     int64   `json:"media_id"`
	Path        string  `json:"path"`
	Title       string  `json:"title"`
	Page        int     `json:"page"`
	Description string  `json:"description"`
	ImagePath   string  `json:"image_path"`
	FragmentID  int64   `json:"fragment_id"`
	Score       float64 `json:"score"`
}

type FigureRef struct {
	Page        int    `json:"page"`
	Kind        string `json:"kind"`
	Description string `json:"description"`
	ImagePath   string `json:"image_path,omitempty"`
	Bbox        string `json:"bbox,omitempty"`
}

type Finder struct {
	Store *Store
	// Limit caps fragments pulled from the index per query before collapsing to
	// documents. Default 20.
	Limit int
}

type FoldRecord struct {
	Hash      string `json:"hash"`
	Layer     string `json:"layer"`
	Source    string `json:"source"`    // the layer document's path
	BasePath  string `json:"base_path"` // the base document's path (an upload URL)
	Title     string `json:"title,omitempty"`
	By        string `json:"by"`
	FoldedAt  string `json:"folded_at"`
	Settled   bool   `json:"settled"` // provenance note and source notes copied
	SettledAt string `json:"settled_at,omitempty"`
}

type FoldReport struct {
	ProjectID     string       `json:"project_id"`
	Base          string       `json:"base"`
	DryRun        bool         `json:"dry_run"`
	LayersScanned []string     `json:"layers_scanned"` // public layers read
	Folded        []FoldRecord `json:"folded"`
	AlreadyInBase int          `json:"already_in_base"` // layer documents whose content the base holds
	Settled       int          `json:"settled"`         // earlier folds whose notes were copied this run
	Pending       int          `json:"pending"`         // earlier folds still importing
	Skipped       []string     `json:"skipped,omitempty"`
}

type FoldedPage struct {
	Page  int
	Start int
	End   int
}

type FoldedText struct {
	// Raw is the text the fold was taken of — pages joined by PageJoin. Offs
	// indexes into this.
	Raw string
	// Body is the fold: lowercase letters and digits only, no separators.
	Body string
	// Offs[i] is the byte offset in Raw of the i'th byte of Body.
	Offs []int
	// Pages are page boundaries in FOLDED (Body) offsets, in page order.
	Pages []FoldedPage
}

type FragConfig struct {
	Window, Stride, Floor int
	EmbedLimit            int
	FigurePrompt          int
	// SegmentInputLimit caps ONE segmentation request — prompt, carried-over
	// fragment and page text together — at what the chat endpoint accepts, IN
	// TOKENS, which is the unit the endpoint counts in. Distinct from EmbedLimit,
	// which bounds the fragments that come BACK, in characters, because that
	// limit belongs to the embedder. Measuring only the second is how a page too
	// big to send reached the endpoint and failed the document. 0 → unknown, no
	// cap.
	SegmentInputLimit int
	// TokenCounter counts tokens as the serving model does, when the endpoint can
	// (llm.Client.CountTokens). nil → sizes are estimated from a ratio learned
	// per document instead. The difference is not cosmetic: measured with the
	// model's own tokenizer, this corpus runs 4.66 characters per token on prose
	// and 1.16 on a survey legal description.
	TokenCounter TokenCounter
	// EmbedLimitTokens and EmbedTokenCounter are the same pair for the EMBEDDER,
	// and they are a separate model with a separate tokenizer — nomic-embed-text
	// answers in BERT ids where the chat model answers in its own.
	//
	// This is the limit that actually refused documents. EmbedLimit above is a
	// character number converted from the embedder's 8192-token context at an
	// assumed two characters per token, i.e. 16128 — and a scanned court brief
	// reaches 10240 tokens inside that, so the fragment was allowed, sent, and
	// refused with a 500 that failed the whole document at the embed stage.
	// Characters cannot express this limit; only tokens can.
	EmbedLimitTokens  int
	EmbedTokenCounter TokenCounter
}

type Fragment struct {
	Page int    // 1-based page number (0 for pageless sources like plain text)
	Ord  int    // fragment order within the page
	Text string // the searchable text
	// StartLine and EndLine are the half-open [StartLine, EndLine) 1-based line
	// span of Text in the source, 0/0 for unknown. Stored as given.
	StartLine, EndLine int
	// Symbol is the dotted symbol path the fragment is ("Server.Start"), empty
	// for none. It is part of the fragment's content id.
	Symbol string
}

type GCPolicy struct {
	MaxBytes     int64         // trim total payload bytes below this (LRU)
	MaxEntries   int           // trim entry count below this (LRU)
	MaxAgeUnused time.Duration // also evict anything unused at least this long
}

type Gap struct {
	ProbePage int    `json:"probe_page"`
	MatchPage int    `json:"match_page"`
	ProbeText string `json:"probe_text"`
	MatchText string `json:"match_text"`
}

type GibberishConfig struct {
	// MinMeanConfidence: pages whose mean recognizer confidence is
	// below this fall back. PP-OCR reports >0.9 mean on clean print;
	// 0.55 only catches genuinely struggling pages.
	MinMeanConfidence float64 `json:"min_mean_confidence"`
	// MinWordlikeFraction: fraction of whitespace tokens that must
	// look like words (letters with vowels, or numbers). Below this,
	// the text is mostly symbol-soup → fall back. Only applied once
	// the page has at least MinTokensForLexical tokens (short pages
	// have too few tokens for a stable ratio).
	MinWordlikeFraction float64 `json:"min_wordlike_fraction"`
	// MinTokensForLexical gates the lexical test: pages with fewer
	// tokens than this are judged on confidence alone.
	MinTokensForLexical int `json:"min_tokens_for_lexical"`
	// MaxJunkRuneFraction: fraction of replacement (U+FFFD) /
	// control runes above which the page is junk regardless of
	// confidence. Catches mojibake the recognizer was "confident"
	// about.
	MaxJunkRuneFraction float64 `json:"max_junk_rune_fraction"`
}

type Hit struct {
	ID    int64 // fragment id (stable key for fusing rankings)
	Path  string
	Title string
	Page  int
	Ord   int
	Text  string
	Score float64
	// StartLine and EndLine are the fragment's half-open 1-based line span in
	// its source, 0/0 when unknown (llm-seg, a paged document, an older index).
	StartLine, EndLine int
	// Symbol is the fragment's dotted symbol path, empty for none.
	Symbol string
	// ContentID is the fragment's stable id (contentid.go): the same across a
	// re-ingest of unchanged text, unlike ID. See Store.FragmentExists.
	ContentID string
	// Origin is empty for the document's own words, and names what a machine
	// made otherwise: "identity" for a generated caption/summary (identity.go),
	// "described" for a model's account of an IMAGE (indextext.go) — the 700
	// words chandra writes about a photograph, naming a car's make and its
	// licence plate, none of which anybody wrote down.
	//
	// These rank in the same list on purpose: a summary is how a document whose
	// body never says "purchase and sale agreement" becomes findable by that
	// query, and a description is the only way a photograph is findable at all.
	// But they are a machine's words, so every renderer says so and nothing
	// quotes from them.
	Origin string
	// Trust is how far the text of this hit can be relied on, and about WHAT.
	// Nil when nothing is recorded about how the document was read, which is not
	// a claim of reliability — see HitTrust.
	Trust *HitTrust
	// Similarity is the cosine of the query and fragment vectors, set on a hit
	// a vector search ranked. Nil when the vector side did not rank it (bm25,
	// or a hybrid hit outside the vector pool). Score in hybrid is a fused
	// rank, so a fixed cut-off reads this instead.
	Similarity *float64
	// Matched is the distinct query terms the fragment contains, in query
	// order, and QueryTerms how many terms the query had after stopwords. A
	// long query matched on one word is a weak hit whatever its bm25.
	Matched    []string
	QueryTerms int
	// contains filtered or unexported fields
}

type HitTrust struct {
	// Method is what produced the text: text-layer, vision-ocr, oidio-asr…
	Method string `json:"method,omitempty"`
	// Level is machine, adapted or attested — whether a person has been through it.
	Level string `json:"level,omitempty"`
	// DescribedPct is how much of the DOCUMENT is a model's description rather
	// than a transcription, or DescribedUnmeasured when it cannot be known.
	DescribedPct int `json:"described_pct,omitempty"`
	// Facets is the per-facet confidence: text, speaker, layout, subject. A facet
	// that is absent is NOT claimed rather than distrusted.
	Facets map[string]Confidence `json:"facets,omitempty"`
	// Summary renders Facets weakest-first for a reader ("subject 80%", "text 90%").
	Summary []string `json:"summary,omitempty"`
	// RuledBy is the person who ruled, when one has.
	RuledBy string `json:"ruled_by,omitempty"`
}

type Home string

type Identifier struct {
	Client Chatter
	// Model is recorded on the document, so a caption can be told from one a
	// different model wrote (and from a person's).
	Model      string
	MaxRetries int // JSON fix-loop attempts after the first try (default 2)
	// contains filtered or unexported fields
}

type IdentityAsk struct {
	// Text is the document's own words, as indexed.
	Text string
	// TagContext is the index's established tag vocabulary (Store.TagContext),
	// so new tags align with terms the corpus already uses.
	TagContext string
	// IndexHint is what the corpus owner says about reading this collection
	// (Store.IndexHint).
	IndexHint string
	// DocTypes are the index's registered document types, which the answer may
	// choose one of. Empty → the doc_type field is not asked for at all, which
	// is right for an index that has registered none.
	DocTypes []DocType
	// Path is the document's path, which picks the caption profile and, for a
	// profile that shows it, is quoted in the prompt.
	Path string
	// Profile is the caption rules (profileFor); nil means legal.
	Profile *captionProfile
}

type IdentityJob struct {
	ID    int64  `json:"id"`
	Path  string `json:"path"`
	State string `json:"state"` // pending|running|done|skipped|error
	Force bool   `json:"force,omitempty"`
	// Mode is WHICH ask this job is: IdentityAskFull, IdentityAskTags (leave the
	// caption alone — the backfill for a corpus captioned before tags existed)
	// or IdentityAskFields (fill out the schema of the type it resolved as).
	Mode       string `json:"mode,omitempty"`
	Error      string `json:"error,omitempty"`
	EnqueuedAt int64  `json:"enqueued_at,omitempty"`
	StartedAt  int64  `json:"started_at,omitempty"`
	FinishedAt int64  `json:"finished_at,omitempty"`
}

type IdentityQueueStatus struct {
	Pending int `json:"pending"`
	Running int `json:"running"`
	Done    int `json:"done"`
	// Skipped is documents there was nothing to caption for — a scanned page with
	// forty characters on it, an empty attachment. Its own state rather than a
	// failure: nothing went wrong, nothing will go better next time, and counting
	// it as failed puts a permanent red number on a corpus that is fine. Kept out
	// of the re-queue for the same reason.
	Skipped int `json:"skipped"`
	Failed  int `json:"failed"`
}

type IdentityStatus struct {
	Path string `json:"path"`
	DocIdentity
}

type IdentityWorker struct {
	Store *Store
	// Slots is how many model calls are in flight. 0 → DefaultIdentitySlots.
	Slots int
	// IdlePoll is how long Run waits when the queue is empty. Default 2s.
	IdlePoll time.Duration
	// OnDone, when set, is called for each finished job — for a CLI that wants
	// to print progress. Called from the committer, one at a time.
	OnDone func(job IdentityJob, id DocIdentity, err error)
	// OnReclaim, when set, reports rows requeued from a dead process at the top
	// of a Drain. Worth saying out loud: those documents are about to be redone,
	// so a count that does not match what was asked for has an explanation.
	OnReclaim func(n int)
}

type ImageEmbedConfig struct {
	Model  string `json:"model,omitempty"`   // e.g. nomic-embed-vision-v1.5; empty → disabled
	URL    string `json:"url,omitempty"`     // full endpoint; empty → Nomic Atlas image API
	APIKey string `json:"api_key,omitempty"` // empty → reuse the main api_key
}

type ImageEmbedder interface {
	EmbedImage(ctx context.Context, mime string, data []byte) ([]float32, error)
	// Aligned reports whether the image vectors share the text query embedder's
	// space, so a text query can cosine against them (true for nomic-vision paired
	// with nomic-text). False → image vectors are stored but not text-searchable.
	Aligned() bool
}

type IndexConfig struct {
	Roots   []Root   `json:"roots,omitempty"`
	Include []string `json:"include,omitempty"` // a file must match one to be indexed
	Ignore  []string `json:"ignore,omitempty"`  // merged with project + built-in ignore
	// WritebackTranscriptionMd NO LONGER DOES ANYTHING, and is kept only so an
	// existing config still parses.
	//
	// It made ingest write <doc>.raglit-transcription.md beside every document it
	// read — 407 files into one legal evidence tree, each duplicating text raglit
	// already held in `pages`, in the fragments, and on /api/doc-detail. raglit
	// then needed IsGeneratedSidecar, a builtinIgnore entry and a refusal inside
	// the writer itself to avoid tripping over its own output.
	//
	// `raglit transcribe` still writes one. The difference is that a person asked.
	WritebackTranscriptionMd bool `json:"writeback_transcription_md,omitempty"`
	// ExtractEmailAttachments writes a mail archive's attachments into
	// <archive>.raglit-attachments/ beside it, with a MANIFEST.md recording which
	// message each came from. Off by default for the same reason: an archive can
	// carry 69 files and putting them in somebody's corpus uninvited is not an
	// indexer's call. Unlike a transcription the extracted files ARE indexable —
	// they are originals that travelled inside an envelope, not derived output —
	// so the next `sync` picks them up as ordinary files.
	ExtractEmailAttachments bool `json:"extract_email_attachments,omitempty"`
	// OCRStrategy names an entry in OCRConfig.Strategies. Empty → the project's
	// OCR.Strategy, else today's behavior.
	//
	// Per index because that is the grain at which document KIND is already
	// declared here: `records/` is recorded surveys and `correspondence/` is
	// letters, and they want different amounts of work per page. Attaching the
	// policy to the corpus rather than to the command is the whole point — a
	// strategy retyped as a flag is one that gets forgotten.
	OCRStrategy string `json:"ocr_strategy,omitempty"`
}

type IndexDigest struct {
	// Name is the index this describes. Set by a caller reporting across
	// several; a store does not know what it is called.
	Name string `json:"index,omitempty"`
	// Path is the subtree this digest was computed over, empty for the whole
	// index. Reported because a digest of the whole index shown for a
	// path-scoped search claims coverage the subtree does not have.
	Path      string     `json:"path,omitempty"`
	Documents int        `json:"documents"`
	Untagged  int        `json:"untagged,omitempty"`
	Kinds     []TagCount `json:"kinds,omitempty"`
	Content   []TagCount `json:"content,omitempty"`
	Roles     []TagCount `json:"roles,omitempty"`
	// Types is the index's SCHEMAED documents — which registered document types
	// its documents resolved as, and how many of each have been extracted. Part
	// of the digest because "this corpus holds 88 work orders whose fields are
	// readable" is the single most useful thing that can be said about an index
	// that has any, and nothing else says it.
	Types []FieldsCoverage `json:"types,omitempty"`
	// About is the generated paragraph, when one has been written and still
	// matches the corpus it was written from. See IndexAbout.
	About string `json:"about,omitempty"`
	// AboutStale marks an About written from a materially different corpus —
	// present so a caller can show it AND say it is behind, rather than
	// choosing between a stale summary and none.
	AboutStale bool `json:"about_stale,omitempty"`
}

type IndexMeta struct {
	Owner      string
	Visibility Visibility
	Bytes      int64 // the index home on disk, every file in it
	Status     Status
}

type Job struct {
	ID         int64
	URL        string
	Title      string
	State      JobState
	Error      string
	Fragments  int
	EnqueuedAt int64
	StartedAt  int64
	FinishedAt int64
	// Fresh re-reads the document even when nothing changed: it skips both the
	// unchanged-bytes fast path and the cross-index pool. The escape hatch for a
	// cached result that is wrong for a reason the cache key cannot see.
	Fresh bool
}

type JobInfo struct {
	ID        int64  `json:"id"`
	URL       string `json:"url"`
	Title     string `json:"title"`
	State     string `json:"state"`
	Error     string `json:"error"`
	Fragments int    `json:"fragments"`
	Mode      string `json:"mode"` // 'llm' | 'offline' | ” — segmentation mode
	// Lane is which scheduler ran it: 'heavy' (vision/OCR, one GPU slot) or
	// 'light' (everything else, several at once). See lane.go.
	Lane       string `json:"lane"`
	EnqueuedAt int64  `json:"enqueued_at"`
	StartedAt  int64  `json:"started_at"`
	FinishedAt int64  `json:"finished_at"`
}

type JobStage struct {
	// ID is the row's own identity, and the only stable one a stage has: a
	// RETRIED job appends a whole second run under the same job_id with seq
	// restarting at 1, so (job_id, seq) names up to four different rows. Job 927
	// on the fence-dispute index is four runs.
	ID     int64  `json:"id"`
	Seq    int    `json:"seq"`
	Name   string `json:"name"`
	Engine string `json:"engine"`
	State  string `json:"state"`
	Detail string `json:"detail"`
	At     int64  `json:"at"`
}

type JobState string

type JudgementStore struct {
	// contains filtered or unexported fields
}

type Judgements interface {
	// Relations
	PutRelation(m Mark) error
	Relation(a, b string) (Mark, bool, error)
	Relations() ([]Mark, error)
	RelationsFor(doc string) ([]Mark, error)

	// Slices
	PutSlice(sl Slice) error
	DeleteSlice(id string) error
	Slice(id string) (Slice, bool, error)
	Slices() ([]Slice, error)
	SlicesOf(parent string) ([]Slice, error)
	SliceParents() ([]string, error)
	CoverageOf(parent string, pages int) (Coverage, error)

	// Page readings
	PutPageCorrection(c PageCorrection) error
	PageCorrections(doc string) (map[int]PageCorrection, error)
	PageReadings(doc string, page int) []PageCorrection

	// Provenance
	History(kind, subject string) ([]AuditEvent, error)

	// Notification
	OnTranscriptionChange(fn func(TranscriptionChange))

	Close() error
}

type Key struct {
	ID        string   `json:"id"`
	Hash      string   `json:"hash,omitempty"`
	Kind      string   `json:"kind"`
	Principal string   `json:"principal"`
	Issuer    string   `json:"issuer"`
	Parent    string   `json:"parent,omitempty"`
	Read      []string `json:"read,omitempty"`
	Write     []string `json:"write,omitempty"`
	Roots     []string `json:"roots,omitempty"`
	Label     string   `json:"label,omitempty"`
	CreatedAt int64    `json:"created_at"`
	LastUsed  int64    `json:"last_used,omitempty"`
	Revoked   bool     `json:"revoked,omitempty"`
}

type KeyStore struct {
	// contains filtered or unexported fields
}