app

type BeginInput struct {
	Now     time.Time
	TraceID string

	Session            SessionWire
	Principal          domain.PrincipalRef
	Workspace          domain.WorkspaceRef
	GlobalPolicy       domain.PolicyMetadata
	ClientHints        domain.ClientHints
	FirstMessageDigest string

	// WorkspaceMatchRequired rejects the turn when a workspace id is required but missing on the request.
	WorkspaceMatchRequired bool
}

type BeginResult struct {
	Record          domain.Record
	TurnID          domain.TurnID
	IsNew           bool
	Response        ResponseMetadata
	EffectivePolicy domain.PolicyMetadata
}

type ClientInputLine struct {
	Role    string
	Ordinal int
	Parts   []string // part kinds in order (text, tool_result, …)
}

type ClientTurnRecordInput struct {
	Now       time.Time
	TraceID   string
	SessionID domain.SessionID
	TurnID    domain.TurnID
	Policy    domain.PolicyMetadata
	Lines     []ClientInputLine
}

type EntropyMaterial struct {
	PrincipalID        string
	AgentDigest        string
	FirstMessageDigest string
}

type GateRecording interface {
	RecordClientTurnAfterGate(ctx context.Context, in ClientTurnRecordInput) error
	RecordPostHookStreamEvent(ctx context.Context, in StreamEventRecordInput) error
}

type Generator interface {
	NewSessionID(ctx context.Context, material EntropyMaterial) (domain.SessionID, error)
	NewResumeToken(ctx context.Context, material EntropyMaterial) (domain.ResumeToken, domain.TokenFingerprint, error)
}

type LineageALeg struct {
	ALegID                string
	ContinuityKey         string
	WeightedFirstConsumed bool
}

type LineageStore interface {
	CreateALeg(ctx context.Context, continuityKey string) (LineageALeg, error)
	FetchALeg(ctx context.Context, aLegID string) (LineageALeg, error)
	SetWeightedFirstConsumed(ctx context.Context, aLegID string, consumed bool) error
}

type Manager struct {
	// contains filtered or unexported fields
}

type ManagerConfig struct {
	// ResumeWindow is inactivity-based resume limit; zero means unbounded.
	ResumeWindow time.Duration
	// StoreDurable is true when the secure-session store is durable (e.g. SQLite).
	StoreDurable bool
	// RequireDurableStore rejects BeginTurn when durable evidence is required but StoreDurable is false.
	RequireDurableStore bool
	// FingerprintKey fingerprints resume tokens (must match store configuration).
	FingerprintKey []byte
	// ObserveActivityTouch, when set, is called with wall time spent in last-activity [Store.TouchActivity] in BeginTurn.
	ObserveActivityTouch func(seconds float64)
	// ResumeFingerprintPrincipalOnly when true fingerprints resume tokens using only [PrincipalRef.ID]
	// as domain-separation material (HMAC still includes raw token bytes). Agent/client digest drift
	// does not invalidate resumes (see secure_session.resume_token_bind_principal_only).
	ResumeFingerprintPrincipalOnly bool
}

type RandGenerator struct {
	// contains filtered or unexported fields
}

type Recorder struct {
	// contains filtered or unexported fields
}

type ResponseMetadata struct {
	SessionID   string
	ResumeToken domain.ResumeToken
}

type SessionUsageRollup interface {
	UsageTokenTotals(ctx context.Context, id domain.SessionID) (inputTokens, outputTokens int64, err error)
}

type SessionWire struct {
	ClientSessionID string
	ContinuityKey   string
	ALegID          string
	SessionID       string
	ResumeToken     string
}

type Store interface {
	Create(ctx context.Context, rec domain.CreateRecord) (domain.Record, error)
	LoadByID(ctx context.Context, id domain.SessionID) (domain.Record, error)
	LoadByResumeFingerprint(ctx context.Context, fp domain.TokenFingerprint) (domain.Record, error)
	LoadByALegID(ctx context.Context, aLegID string) (domain.Record, error)
	TouchActivity(ctx context.Context, id domain.SessionID, at time.Time, source domain.ActivitySource) error
	AppendAttemptTrace(ctx context.Context, trace domain.AttemptTrace) error
	UpdateAttemptOutcome(ctx context.Context, outcome domain.AttemptOutcome) error
	// AppendTranscript appends a row; durable implementations allocate the next seq in the same
	// transaction as the insert (item.Seq is ignored there). NextTranscriptSeq remains a best-effort preview.
	AppendTranscript(ctx context.Context, item domain.TranscriptItem) error
	// NextTranscriptSeq returns the next monotonic sequence number for a new transcript row for the session.
	NextTranscriptSeq(ctx context.Context, id domain.SessionID) (int64, error)
	AddUsage(ctx context.Context, delta domain.UsageDelta) error
	// NextAuditSeq returns the next monotonic sequence number for a new audit entry for the session.
	NextAuditSeq(ctx context.Context, id domain.SessionID) (int64, error)
	// AppendAudit appends a row; durable implementations allocate the next seq in the same transaction
	// as the insert (item.Seq is ignored there). NextAuditSeq remains a best-effort preview.
	AppendAudit(ctx context.Context, item domain.AuditItem) error
	Audit(ctx context.Context, id domain.SessionID, opts domain.ReadOptions) ([]domain.AuditItem, error)
	Summary(ctx context.Context, query domain.SummaryQuery) ([]domain.Summary, error)
	Transcript(ctx context.Context, id domain.SessionID, opts domain.ReadOptions) ([]domain.TranscriptItem, error)
	// ListAttemptEvidence returns chronological B-leg attempts for operator diagnostics (bounded by opts.Limit, default 100).
	ListAttemptEvidence(ctx context.Context, id domain.SessionID, opts domain.ReadOptions) ([]domain.AttemptEvidence, error)
	CheckReadiness(ctx context.Context, policy domain.PolicyMetadata) error
	// Quarantine performs an atomic, idempotent transition to SessionStatusQuarantined.
	// Durable implementations update status and append a minimal session audit row in one transaction.
	// A second identical quarantine must succeed without duplicating terminal state.
	Quarantine(ctx context.Context, in domain.QuarantineInput) error
}

type StreamEventRecordInput struct {
	Now       time.Time
	TraceID   string
	SessionID domain.SessionID
	TurnID    domain.TurnID
	BLegID    string
	BackendID string
	Policy    domain.PolicyMetadata

	EventKind string
	// EventPayloadJSON is a redacted JSON snapshot of the canonical event (never raw resume tokens).
	EventPayloadJSON string

	IsUsageEvent bool
	InputTokens  int64
	OutputTokens int64

	CacheReadTokens          int64
	CacheWriteTokens         int64
	NonCachedInputTokens     int64
	ReasoningTokens          int64
	NonReasoningOutputTokens int64
	TotalTokens              int64
	CostNanoUnits            int64
	CostMinorUnits           int64
	Currency                 string
	CostSource               string
	RawUsageJSON             string
	BillingUnavailable       bool

	RequestStartedAt         time.Time
	FirstRemoteEventAt       time.Time
	FirstMeaningfulTokenAt   time.Time
	RemoteCompletedAt        time.Time
	ProxyCompletedAt         time.Time
	TTFTMillis               int64
	RemoteDurationMillis     int64
	CompletionDurationMillis int64
	CompletionTPSMilli       int64

	// ProviderCorrelationJSON holds non-authoritative provider correlation (never session authority).
	ProviderCorrelationJSON string
}

type TurnOutcome struct {
	Kind TurnOutcomeKind
}

type TurnOutcomeKind int