panorama

type AccessResolver func(r *http.Request, applicationID string) (ApplicationAccess, error)

type Application struct {
	ID      string
	Name    string
	CanView bool
}

type ApplicationAccess struct {
	Exists    bool
	CanView   bool
	CanEdit   bool
	Protected bool
}

type ArchiMateExport struct {
	// Instance names the Atlas the landscape was read from — a host, as the reader
	// knows it. Never a credential and never a peer's address: this is the server the
	// reader is already looking at.
	Instance string
	// GeneratedAt is when, in Unix seconds. Zero says so rather than inventing one.
	GeneratedAt int64
}

type Binding struct {
	ElementID   string `json:"elementId"`
	ElementType string `json:"elementType"`
	// ElementName is what the architect called it. The mesh overlay shows it, and
	// for an element Atlas has no resource for it is the only name there is.
	ElementName string   `json:"elementName,omitempty"`
	Key         string   `json:"key"`
	Values      []string `json:"values"`
}

type BindingCandidate struct {
	ID   string `json:"id"`
	Name string `json:"name"`
}

type BindingCandidates struct {
	Key string `json:"key"`
	// Supported is false when this server cannot resolve the kind at all. Without
	// it an empty list would read as "there are none", which is a different and
	// wrong answer.
	Supported  bool               `json:"supported"`
	Candidates []BindingCandidate `json:"candidates"`
}

type BindingSet struct {
	ContractVersion int       `json:"contractVersion"`
	Bindings        []Binding `json:"bindings"`
	Problems        []Problem `json:"problems"`
}

type Bucket struct {
	At    int64   `json:"at"`
	Value float64 `json:"value"`
}

type C4Element struct {
	ID          string `json:"id"`
	Type        string `json:"type"`
	Name        string `json:"name,omitempty"`
	Description string `json:"description,omitempty"`
	// Parent is the enclosing element, from a composition or aggregation.
	Parent     string `json:"parent,omitempty"`
	SourceType string `json:"sourceType"`
}

type C4Loss struct {
	ID         string `json:"id"`
	SourceType string `json:"sourceType"`
	Name       string `json:"name,omitempty"`
	Reason     string `json:"reason"`
}

type C4Projection struct {
	Notation       string `json:"notation"`
	SourceNotation string `json:"sourceNotation"`
	SourceModelID  string `json:"sourceModelId"`
	SourceRevision int64  `json:"sourceRevision"`
	MappingVersion int    `json:"mappingVersion"`
	// ReadOnly is always true and is in the payload on purpose: a consumer must not
	// be able to mistake a projection for a source document.
	ReadOnly      bool             `json:"readOnly"`
	Elements      []C4Element      `json:"elements"`
	Relationships []C4Relationship `json:"relationships"`
	Dropped       []C4Loss         `json:"dropped"`
}

type C4Relationship struct {
	ID         string `json:"id"`
	Source     string `json:"source"`
	Target     string `json:"target"`
	Name       string `json:"name,omitempty"`
	SourceType string `json:"sourceType"`
}

type Call struct {
	ElementID string
	// ElementIndex is the same element by the identity the per-element counters are
	// keyed on (ADR-0080). It is what lets this edge carry a traversal count.
	ElementIndex    int32
	CalledProcessID string
	TargetKey       uint64
}

type Catalog struct {
	Applications map[string]ResourceRef
	Processes    map[string]ResourceRef
	Connectors   map[string]ResourceRef
	JobTypes     map[string]ResourceRef
	Runtimes     map[string]ResourceRef
	Targets      map[string]ResourceRef
	Releases     map[string]ResourceRef
	// Capabilities and ValueStreams are the business-architecture register (ADR-0305),
	// bound as ADR-0308 decides. Unlike the maps above they are not filtered per caller, and that is
	// a property of the register rather than an omission here: a capability record is
	// readable by any signed-in identity, because it says what the organisation must
	// be able to do and nothing about what this server runs. What *is* scoped are the
	// processes a capability names as its realisations, and those are resolved
	// elsewhere, through their own sharing scope.
	Capabilities map[string]ResourceRef
	ValueStreams map[string]ResourceRef
}

type CatalogEdge struct {
	From string
	To   string
	Kind string
}

type CatalogResolver func(r *http.Request) (Catalog, error)

type Clock func() time.Time

type ContextDocument struct {
	ContractVersion int             `json:"contractVersion"`
	ElementID       string          `json:"elementId"`
	ObservedAt      int64           `json:"observedAt"`
	Window          ContextWindow   `json:"window"`
	Results         []ContextResult `json:"results"`
	// Truncated reports that results were dropped to stay inside the bound, so a
	// short answer is not read as a complete one.
	Truncated bool           `json:"truncated"`
	Limits    []ContextLimit `json:"limits"`
}

type ContextLimit struct {
	Limit  string `json:"limit"`
	Reason string `json:"reason"`
}

type ContextQuery struct {
	Key    string
	Value  string
	Window ContextWindow
}

type ContextResolver func(r *http.Request, queries []ContextQuery) ([]ContextResult, error)

type ContextResult struct {
	Source string `json:"source"`
	Key    string `json:"key"`
	Value  string `json:"value"`
	State  string `json:"state"`
	// Reason is why the state is what it is, in the source's own words. It is
	// required for every state except available: a source that could not answer owes
	// the reader a sentence, and one that could does not need to explain itself.
	Reason   string            `json:"reason,omitempty"`
	Measures []Measure         `json:"measures,omitempty"`
	Detail   map[string]string `json:"detail,omitempty"`
}

type ContextWindow struct {
	Window string `json:"window"`
	From   int64  `json:"from"`
	To     int64  `json:"to"`
}

type Decision struct {
	ID      string
	Name    string
	CanView bool
}

type DecisionUse struct {
	DecisionID string
	// ElementIndex is the calling business rule task. See [Call.ElementIndex].
	ElementIndex int32
}

type Draft struct {
	ProcessID     string
	Name          string
	ApplicationID string
	CanView       bool
}

type DriftDocument struct {
	ContractVersion int          `json:"contractVersion"`
	Entries         []DriftEntry `json:"entries"`
	// Since is the moment from which this document can speak, or zero when this
	// model has never been read. It is the honest bound on every question asked of
	// it: nothing before it can be answered, whether or not anything happened.
	//
	// While nothing has been dropped that is when the journal *started watching*,
	// not the oldest entry it holds — a quiet hour is a real answer, and dating the
	// document from its first entry would throw that hour away. Once entries have
	// been dropped it is the oldest retained entry instead, because everything
	// before that one genuinely is gone.
	Since int64 `json:"since"`
	// Truncated reports that entries were dropped to stay inside the bound, so an
	// empty stretch is not read as a quiet one.
	Truncated bool         `json:"truncated"`
	Limits    []DriftLimit `json:"limits"`
}

type DriftEntry struct {
	ElementID string `json:"elementId"`
	Key       string `json:"key"`
	Value     string `json:"value"`
	// From is the state this value was last seen in, and To the state it is in
	// now. Both travel because the direction is the finding: healthy → degraded and
	// degraded → healthy are the same transition seen from opposite sides, and one
	// of them is somebody's incident and the other is somebody's fix.
	From string `json:"from"`
	To   string `json:"to"`
	// Reason is the new state's own sentence, kept so an entry read a week later
	// still says what happened rather than only that something did.
	Reason string `json:"reason,omitempty"`
	At     int64  `json:"at"`
}

type DriftLimit struct {
	Limit  string `json:"limit"`
	Reason string `json:"reason"`
}

type Edge struct {
	From string `json:"from"`
	To   string `json:"to"`
	Kind string `json:"kind"`
	// Taken is how many times the elements behind this edge were activated, summed:
	// two business rule tasks calling one decision are one edge reached from two
	// places, and the count is theirs together (ADR-0400). It is read from the
	// cumulative per-element counter ADR-0080 already maintains, so it costs a join
	// rather than an index.
	//
	// **Nil and zero are different facts.** Nil means the counter was not read — the
	// same absence [Process.Runtime] uses — or that this edge kind has no element to
	// anchor on. Zero means it was read and nothing has taken this path, which is a
	// real answer and the one that must never be rendered as a verdict: a quarterly
	// reconciliation, a compensation branch and an error handler are each correctly
	// zero for months and each load-bearing.
	Taken *int64 `json:"taken,omitempty"`
	// Promoted is how many applications an estate join stands for (ADR-0402 §4): one
	// edge between two domains, and the number of recorded promotions along it. Zero
	// on every other kind of edge, where it would be a claim about nothing.
	Promoted int `json:"promoted,omitempty"`
	// TakenSince is when the counting started, in Unix seconds: the moment the source
	// definition was deployed, because the counter is keyed by definition key and a
	// redeploy starts a fresh one. It is the window without which Taken says nothing,
	// so it travels with it and is zero exactly when Taken is nil.
	TakenSince int64 `json:"takenSince,omitempty"`
}

type ElementKind struct {
	// Type is the xsi:type written into the document — the standard's own name,
	// because the document is an interchange format and not Atlas's private store.
	Type string `json:"type"`
	// Label is what a person reads in the palette; Layer groups it there.
	Label string `json:"label"`
	Layer string `json:"layer"`
	// Aspect is the element's role in the standard's structure/behaviour split, and
	// it is what most of the relationship rules below are actually about. Carrying
	// it makes those rules readable as the sentences the specification states,
	// rather than as a list of type pairs somebody has to trust.
	Aspect string `json:"aspect"`
}

type EstateDomain struct {
	// ID addresses the domain: the deployment target's id, or this runtime's own handle.
	//
	// Deliberately not the runtime id, although ADR-0401 §1 makes
	// `(runtimeId, key)` an entity's estate-wide name. A peer that never answered has no
	// runtime id to be named by, and §3 says such a peer is still a shape on the picture —
	// so the node is addressed by what an operator configured, which always exists, and
	// the runtime id travels beside it where the peer actually reported one.
	ID   string
	Name string
	// RuntimeID is what the domain said it was, and empty where it said nothing.
	RuntimeID string
	// Holds is how many nodes that domain's own landscape holds, where it answered. It is
	// the number that makes §2's budget legible to a reader: a domain standing for 400
	// nodes and one standing for four are the same size on this picture, and only this says
	// they are not.
	Holds int
	// Restricted is how many of [EstateDomain.Holds] were placeholders standing in for
	// what the credential that drew this domain may not see. It is the other half of
	// [EstateDomain.DrawnBy]: naming the credential says who looked, and this says how
	// much of the domain that look did not reach.
	Restricted int
	// State and Reason are the observation the collector resolved (ADR-0189 §6), including
	// [StateUnserved].
	State  string
	Reason string
	// Applications maps a local application id to the id the same application has on this
	// domain, as a promotion recorded it. Only peers have it, and its size is what the join
	// stands for.
	Applications map[string]string
	// DrawnBy names the credential whose reach produced this domain's answer, because §1
	// requires the picture to state whose credential drew each subgraph: a federated read is
	// as wide as the credential that made it, and an incompleteness that is stated is a
	// fact while one that is not is a discovery.
	//
	// Empty for this runtime, which was drawn for the reader by the reader's own rights.
	DrawnBy string
}

type Fact struct {
	Source string
	State  string
	Reason string
	// Detail is a small, flat set of specifics — a version, a count — for a reader
	// who wants the number behind the sentence. It is bounded on the way out
	// (see boundDetail): this document is fetched per model view, and an unbounded
	// detail object is how one becomes too big to render.
	Detail map[string]string
}

type Facts struct {
	Applications map[string]Fact
	Processes    map[string]Fact
	Connectors   map[string]Fact
	JobTypes     map[string]Fact
	Runtimes     map[string]Fact
	Targets      map[string]Fact
	Releases     map[string]Fact
}

type FactsResolver func(r *http.Request) (Facts, error)

type Graph struct {
	Nodes []Node `json:"nodes"`
	Edges []Edge `json:"edges"`
	// RuntimeID is the runtime that derived this subgraph, and it is the half that
	// makes every key in the document mean something (ADR-0401 §1). A node id here
	// carries a key, a key carries its partition but not its installation, and two
	// installations both mint partition 0 counter 1 — so "a bare key is never
	// published estate-wide", and this is what stops these from being bare.
	//
	// Qualifying the document rather than each id is deliberate: the estate-wide name
	// is the pair `(runtimeId, key)`, and both halves already existed, so nothing new
	// is minted and no shipped id scheme moves. A reader stitching several subgraphs
	// is the one that has to qualify per node, and it has what it needs to.
	//
	// Empty where the server could not read its own identity, which is a fact about
	// the reading and not an estate of one: an absent runtime id means these keys
	// cannot be placed, and a consumer must refuse to join them rather than assume
	// they are local.
	RuntimeID string `json:"runtimeId,omitempty"`
	// Restricted is how many placeholder nodes stand in for resources this caller
	// may not see. The legend states it, so a filtered picture says that it is
	// filtered instead of looking complete.
	Restricted int `json:"restricted"`
	// Clustered reports that the graph exceeded its size budget and collapsed to
	// applications.
	Clustered bool `json:"clustered"`
	// The desired-versus-observed comparison, when a model was overlaid.
	// Modeled counts what a model declares and Atlas does not have; Unmodeled counts
	// what Atlas has and no model mentions.
	Modeled   int `json:"modeled"`
	Unmodeled int `json:"unmodeled"`
	// OutOfScope counts bindings to kinds this picture does not draw — releases,
	// deployment targets, runtimes. They are neither matched nor absent, and the
	// count keeps that visible instead of silently dropping them.
	OutOfScope int `json:"outOfScope"`
	// Status is the severity summary and, as importantly, the declaration of which
	// observation states this build cannot produce at all (ADR-0211 §4).
	Status Status `json:"status"`
	// ObservedAt is when this picture was derived, in Unix seconds, and zero when
	// the caller supplied no clock.
	//
	// It is on the payload rather than left to the reader's own clock because the
	// picture outlives the tab it was drawn in: ADR-0211 §10 requires an exported
	// landscape to carry its observation time *into* the artifact, and a time the
	// browser invented would date the export rather than the facts in it. The two
	// differ by however long the file sat unsaved, and by all of history once
	// somebody re-exports a stale tab.
	ObservedAt int64 `json:"observedAt,omitempty"`
}

type IDGenerator func() (string, error)

type IncidentSite struct {
	// ElementID is the BPMN element id, which is what an operator searches the
	// diagram for.
	ElementID string `json:"elementId"`
	// ElementType is the BPMN type ("ServiceTask", "CallActivity", …), so the id
	// reads as a thing rather than as a string.
	ElementType string `json:"elementType,omitempty"`
	// Count is how many incidents are parked on this element.
	Count int `json:"count"`
	// Message is the first one seen here, not a summary of all of them: several
	// incidents on one element usually share a cause, and inventing a combined
	// sentence would be writing a message nobody produced. Operations has the rest.
	Message string `json:"message,omitempty"`
}

type Journal struct {
	// contains filtered or unexported fields
}

type Landscape struct {
	// RuntimeID is the runtime these facts were read off — this server, for a local
	// collection (ADR-0401 §1). Every process here inherits it unless it carries its
	// own, which is what a subgraph read from a peer would.
	RuntimeID    string
	Applications []Application
	Processes    []Process
	// Drafts are the saved diagrams nobody has deployed, and are empty unless the
	// caller asked for them — see [Draft].
	Drafts    []Draft
	Workers   []Worker
	Decisions []Decision
	// Catalogs and Products are the service catalogue (ADR-0312), drawn always
	// rather than on request like the drafts: a catalogue is part of what this
	// server runs, not a plan somebody saved, and an installation that does not use
	// the portal has none and pays nothing for them.
	Catalogs []ProductCatalog
	Products []Product
	// Targets are the peers this server can promote to, and what asking them
	// produced. Filled in two halves: the collector names them on the run loop, and
	// [ReachOut] supplies each one's state off it.
	Targets []Target
	// PartialStatus reports that the server stopped counting parked work before it
	// had seen all of it. It travels with the landscape because only the collector
	// knows it, and it must reach the payload: without it a process the scan never
	// reached would be published as healthy on no evidence at all.
	PartialStatus bool
	// ObservedAt is when these facts were read off the server, in Unix seconds, and
	// zero from a collector that does not date its work.
	//
	// It is on the landscape rather than only in [Options] because a collector may
	// answer from something it read earlier: the facts are what is dated, and a
	// picture stamped with the moment it was *served* would claim a freshness nobody
	// measured — the undated "all green" of §10, with a timestamp on it, which is
	// worse than none. A collector that reads afresh every time sets it to now and
	// nothing changes.
	ObservedAt int64
}

type LandscapeCollector func(r *http.Request) (Landscape, ReachOut, error)

type LayoutChange struct {
	// NodeID is the view node's `identifier`, not the element it references. A view
	// may place the same element more than once, and each placement moves on its own.
	NodeID string `json:"nodeId"`
	X      int    `json:"x"`
	Y      int    `json:"y"`
	W      int    `json:"w"`
	H      int    `json:"h"`
}

type Measure struct {
	// Name is the stable identifier a client may key on; Label is what a person
	// reads. Both travel because one of them is a contract and the other is prose,
	// and using either for both jobs makes it impossible to change the prose.
	Name  string `json:"name"`
	Label string `json:"label"`
	// Total is the measure across the whole window. It is carried rather than left
	// to be summed from the buckets, because for a gauge the sum of the buckets is
	// not the total and a client cannot tell which kind it has.
	Total   float64  `json:"total"`
	Buckets []Bucket `json:"buckets"`
}

type Mesh struct {
	// contains filtered or unexported fields
}

type Model struct {
	ID            string `json:"id"`
	ApplicationID string `json:"applicationId"`
	Name          string `json:"name"`
	Notation      string `json:"notation"`
	Revision      int64  `json:"revision"`
	XML           string `json:"xml"`
	CreatedAt     int64  `json:"createdAt"`
	CreatedBy     string `json:"createdBy,omitempty"`
	UpdatedAt     int64  `json:"updatedAt"`
	UpdatedBy     string `json:"updatedBy,omitempty"`
}

type ModelElement struct {
	ElementID   string
	ElementType string
	Name        string
	Key         string
	Values      []string
}

type NewElement struct {
	// Type is an ArchiMate element type from the authoring subset. Anything else is
	// refused: this writer will not create what the canvas cannot draw rules for.
	Type string `json:"type"`
	Name string `json:"name"`
	// ViewID is the view the new shape is placed on, and the geometry is where.
	ViewID string `json:"viewId"`
	X      int    `json:"x"`
	Y      int    `json:"y"`
	W      int    `json:"w"`
	H      int    `json:"h"`
}

type NewRelationship struct {
	Type   string `json:"type"`
	Source string `json:"source"`
	Target string `json:"target"`
	ViewID string `json:"viewId"`
}

type Node struct {
	ID         string `json:"id"`
	Kind       string `json:"kind"`
	Name       string `json:"name,omitempty"`
	Provenance string `json:"provenance"`
	// Application is the owning application's node id, for grouping. Empty on
	// application, restricted, and unresolved nodes.
	Application string `json:"application,omitempty"`
	// Catalog is the catalogue node a product is grouped under, and empty on every
	// other kind. It is its home catalogue (ADR-0315) where that catalogue is on this
	// picture, and otherwise the first catalogue here that offers it — a product
	// whose home this reader cannot see is still somewhere, and a collapsed picture
	// has to put it there.
	//
	// Separate from Application rather than sharing it: that field carries a process
	// application, and one field holding two kinds of container is how a reader ends
	// up asking which one they have.
	Catalog string `json:"catalog,omitempty"`
	// ProductState and ApprovalKind are a product node's two catalogue facets, and
	// are empty on every other kind — see [Product.State] and [Product.Approval]
	// for why each carries the store's own spelling rather than a flag.
	//
	// ProductState is deliberately *not* the State field further down. That one is
	// the observation state behind Severity — whether this thing is healthy — and
	// these two are what the catalogue says the offering is. A withdrawn product
	// whose provisioning process is green is an ordinary state of affairs, and one
	// field answering both questions is how a reader ends up reading the wrong one.
	//
	// They reach only products this caller may see: a product they may not is drawn
	// as a restricted placeholder of another kind entirely and never gets here, so
	// no facet of a hidden offering leaves the server.
	ProductState string `json:"productState,omitempty"`
	ApprovalKind string `json:"approvalKind,omitempty"`
	// ProcessID and Version identify a process node well enough to navigate to the
	// Operations view (L2) without a second lookup. On a definition node they are the
	// identity itself rather than a navigation aid (ADR-0401 §2).
	ProcessID string `json:"processId,omitempty"`
	Version   int32  `json:"version,omitempty"`
	// RuntimeID is the runtime holding this deployment — the other half of its
	// estate-wide name (ADR-0401 §1). Empty on a definition node, which belongs to no
	// runtime, and on the kinds that are estate-wide by nature: a capability, a value
	// stream, a product and a published interface are named without one, and needing
	// to qualify one of those by the server it sits on would mean it was modelled at
	// the wrong altitude.
	//
	// Not to be confused with Runtime further down, which is instance counters. This
	// field says *where* the deployment is; that one says what has run in it.
	RuntimeID string `json:"runtimeId,omitempty"`
	// Definition is the definition node a deployment realises, and is set only where
	// that definition is drawn — which is where it has more than one deployment. Empty
	// otherwise, including on the single-runtime case that is every installation
	// today: the definition is still known there, it is simply the deployment's own
	// (ProcessID, Version) and needs no second node to hold it.
	Definition string `json:"definition,omitempty"`
	// WorkerType is a worker node's Worker Type ("rest", "mail", …). Never its
	// endpoint and never its credential reference — see [Worker].
	WorkerType string `json:"workerType,omitempty"`
	// The ArchiMate element bound to this node, when a model binds one. ModelName is
	// carried beside Name rather than replacing it: the architect's name and the
	// Atlas name are allowed to differ, and the difference is informative.
	ModelElementID   string `json:"modelElementId,omitempty"`
	ModelElementType string `json:"modelElementType,omitempty"`
	ModelName        string `json:"modelName,omitempty"`
	// State is the observation state behind Severity (ADR-0189 §6), kept beside it
	// because the three classes are a reading aid and never a replacement: an
	// operator acting on a finding needs the state, not the color.
	State    string `json:"state"`
	Severity string `json:"severity"`
	// Reason is the sentence behind this node's severity, in the words of whatever
	// observed it. Empty on a node with nothing to report.
	Reason string `json:"reason,omitempty"`
	// SeverityFrom names the descendant a node inherited its severity from, and is
	// empty when the severity is the node's own. ADR-0211 §4 requires it: a red
	// parent that cannot say which child is red is not actionable.
	SeverityFrom string `json:"severityFrom,omitempty"`
	// Holds is how many nodes a domain's own landscape holds (ADR-0402 §2), and zero on
	// every other kind. It is what makes the estate's budget legible: a domain standing
	// for four hundred nodes and one standing for four are the same size on the picture,
	// and only this says they are not.
	Holds int `json:"holds,omitempty"`
	// DrawnBy names the credential whose reach produced a domain's answer (ADR-0402 §1),
	// and is empty on every other kind and on this runtime's own domain. A federated read
	// is as wide as the credential that made it, and the picture states that rather than
	// leaving a reader to discover it.
	DrawnBy string `json:"drawnBy,omitempty"`
	// Restricted is how many of a domain's [Holds] nodes stood in as placeholders for
	// resources the credential that drew it may not see. Set on a domain node only,
	// and read against that node rather than against the picture: [Graph.Restricted]
	// counts what *this* reader may not see in *this* graph, and this counts what
	// somebody else's credential could not see in somebody else's.
	//
	// Keeping the two apart is the whole point of ADR-0402 §1's disclosure rule. A
	// federated subgraph is as wide as the credential that fetched it (ADR-0410), so a
	// domain whose reach covered half of it has to say so beside the count — an
	// incompleteness that is stated is a fact, one that is not is a discovery.
	Restricted int `json:"restricted,omitempty"`
	// Incidents is how many unresolved incidents the engine holds against this node.
	// Only a process node can carry one — an incident belongs to a token, and only a
	// process has tokens — so it is absent everywhere else rather than zero, because
	// "no incidents" and "cannot have incidents" are different facts.
	//
	// It is a count, not a severity: the state above already says what class this
	// node is in, and this says how much of it there is. A node with a count is
	// always in a state that reports one, so the two can never disagree.
	Incidents int `json:"incidents,omitempty"`
	// OldestIncident is when the earliest unresolved incident on this node was
	// raised, as Unix nanoseconds. It is the one number that says *how long this has
	// been wrong*, which is the question a count cannot answer: four hundred
	// incidents raised in the last five minutes is a worker that has just fallen
	// over, and three standing since Friday is a process nobody is coming back to.
	//
	// The oldest rather than the newest, and rather than an average. The newest says
	// only that something happened lately, which Runtime.LastActivity already says
	// better; an average is not a fact about any incident, so nothing can be pointed
	// at. The oldest is the age of the *problem* — a process where one token parked
	// on Friday and three hundred piled up behind it has been stuck since Friday.
	//
	// A collapsed application carries the earliest of the processes it stands for,
	// by the same argument its summed count makes: it is standing in for them.
	//
	// Absent rather than zero where there is nothing to date, which includes an
	// incident raised before the engine recorded the moment: "not known" and "raised
	// at the epoch" are different facts and only one of them is drawable.
	OldestIncident int64 `json:"oldestIncident,omitempty"`
	// Sites are where in the process that work is parked (see [IncidentSite]).
	//
	// Only a process node carries them, and a collapsed application deliberately
	// does not: an element id without the process it belongs to is not something
	// anybody can act on, and a list of them from six different processes would read
	// as one broken diagram. The collapsed node keeps the summed count, which is the
	// part that survives losing the context.
	Sites []IncidentSite `json:"sites,omitempty"`
	// Children is how many nodes a collapsed application stands for. Set only when
	// the graph is clustered.
	Children int `json:"children,omitempty"`
	// Runtime is the engine's instance tally for this node (see [Runtime]).
	//
	// A process node carries its own. A *collapsed* application carries the sum of
	// the processes it stands for, for the same reason it carries their summed
	// incident count: it is standing in for them, and reporting one child's number
	// against the whole would understate it. An uncollapsed application carries
	// none — its processes are on screen with their own — and no other kind can have
	// instances at all, which is why this is absent rather than zero.
	Runtime *Runtime `json:"runtime,omitempty"`
}

type Notation struct {
	ID             string                  `json:"id"`
	Label          string                  `json:"label"`
	Short          string                  `json:"short"`
	Projection     bool                    `json:"projection"`
	MappingVersion int                     `json:"mappingVersion"`
	Types          map[string]NotationType `json:"types"`
	// Relations is the same for the edges between those kinds. A kind absent from it
	// is drawn as the plain derived line and named in the loss list, exactly as an
	// absent node kind keeps its derived outline.
	Relations map[string]NotationRelation `json:"relations"`
	Loss      []string                    `json:"loss"`
}

type NotationRelation struct {
	Name string `json:"name"`
	Type string `json:"type,omitempty"`
	Flip bool   `json:"flip,omitempty"`
}

type NotationType struct {
	Name string `json:"name"`
	Type string `json:"type,omitempty"`
}

type Observation struct {
	ElementID   string `json:"elementId"`
	ElementType string `json:"elementType"`
	Key         string `json:"key"`
	Value       string `json:"value"`

	Source string `json:"source"`
	// State is one of ADR-0189 §6's seven; Severity is ADR-0211 §4's three-class
	// reading of it. Both travel: the class is what makes a hundred elements
	// legible at a glance, and the state is what somebody acts on.
	State    string `json:"state"`
	Severity string `json:"severity"`
	Reason   string `json:"reason,omitempty"`
	// ObservedAt is when this was read, in Unix seconds. It is on every observation
	// rather than only on the document, because the next slice resolves some of
	// them from remote nodes and those will not share one instant.
	ObservedAt int64             `json:"observedAt"`
	Detail     map[string]string `json:"detail,omitempty"`
	// ChangedAt and PreviousState are what the drift journal knows about this
	// value's last transition (ADR-0189 P5). They are on the observation rather
	// than only in the journal because "degraded" and "degraded since nine this
	// morning" are different findings, and the second is the one somebody acts on.
	// Both are absent when nothing has been seen to change — which is not the same
	// as nothing having changed, and is why the journal publishes its limits.
	ChangedAt     int64  `json:"changedAt,omitempty"`
	PreviousState string `json:"previousState,omitempty"`
}

type ObservationDocument struct {
	ContractVersion int `json:"contractVersion"`
	// ObservedAt is when this document was computed. Every observation in it was
	// read while serving this request — nothing here is cached — which is what
	// makes one timestamp meaningful for the whole document today.
	ObservedAt   int64              `json:"observedAt"`
	Observations []Observation      `json:"observations"`
	Summary      ObservationSummary `json:"summary"`
	// Unavailable names the observation states this document cannot produce at all.
	// It is empty now that peers are asked: every one of ADR-0189 §6's states is
	// reachable here. The field stays, because an empty list is a claim somebody
	// can check — and because the landscape mesh, which draws no deployment
	// targets, still has two it cannot produce and publishes them in the same shape.
	Unavailable []UnavailableState `json:"unavailable"`
	// Problems are the extractor's, carried through exactly as binding resolution
	// carries them: a declaration that was refused is as much a finding as one that
	// resolved.
	Problems []Problem `json:"problems"`
}

type ObservationSummary struct {
	OK        int `json:"ok"`
	Attention int `json:"attention"`
	Critical  int `json:"critical"`
	Unknown   int `json:"unknown"`
}

type Options struct {
	// Subject is which of the two pictures to derive; empty is the landscape.
	Subject string
	// Overlays are the Panorama models compared against this landscape. Empty
	// leaves the mesh exactly as the derivation alone made it.
	Overlays []Overlay
	// MaxNodes is the size budget (ADR-0211 §7). Zero means unlimited. Over budget
	// the graph collapses to applications and says so, rather than returning a graph
	// the browser cannot lay out — or, worse, a truncated one that looks complete.
	MaxNodes int
	// ObservedAt is when the landscape this graph derives from was read, in Unix
	// seconds. Zero omits it, which is what a caller with no clock gets — and is
	// deliberately not "now": a derivation that invented a timestamp would be
	// claiming a freshness nobody measured.
	ObservedAt int64
}

type Overlay struct {
	ModelID   string
	ModelName string
	Elements  []ModelElement
}

type OverlayCollector func(r *http.Request) ([]Overlay, error)

type Problem struct {
	Severity string `json:"severity"`
	Message  string `json:"message"`
}

type Process struct {
	Key       uint64
	ProcessID string
	Name      string
	Version   int32
	// RuntimeID is the runtime holding this deployment (ADR-0401 §1). Empty means the
	// runtime deriving the graph, which is every process a local collector reads — a
	// server does not have to tell itself where it is.
	RuntimeID     string
	ApplicationID string
	CanView       bool
	Calls         []Call
	Workers       []WorkerUse
	Decisions     []DecisionUse
	// State is the observation state (ADR-0189 §6) the server read for this
	// process, and Reason is the sentence behind it. Empty means unbound: no
	// observation applies, which is not a finding.
	State  string
	Reason string
	// Incidents is how many unresolved incidents the engine holds against this
	// definition. It is the count behind Reason rather than a second opinion about
	// it, carried as a number so a reader can sort by it and a picture can show
	// which of two degraded processes is the worse one.
	Incidents int
	// OldestIncident is when the earliest of them was raised, as Unix nanoseconds,
	// and zero where there are none — or where every one of them predates the field
	// (ADR-0272's RaisedAt), which is a fact about the record rather than about the
	// process and must not be read as "raised at the epoch".
	OldestIncident int64
	// Sites are the places in this process where that work is parked.
	Sites []IncidentSite
	// DeployedAt is when this definition was deployed, in Unix seconds. It is the
	// window every traversal count on this process's edges is counted over, because
	// the counter is keyed by definition key and a redeploy starts a fresh one.
	DeployedAt int64
	// ElementVisits is the cumulative activation count of this definition's elements,
	// keyed by element index — ADR-0080's maintained counter, read in O(elements).
	//
	// Nil when the collector could not read it, which is the same distinction Runtime
	// makes below and for the same reason: an unread counter and an element nothing has
	// reached are different facts, and only one of them is worth saying out loud. An
	// element absent from a non-nil map has been read and holds nothing, which is zero.
	ElementVisits map[int32]int64
	// Runtime is what the engine has recorded about this definition's instances:
	// how many are live, how many have finished, and when it last did anything. It
	// is nil where the collector could not read it, which is not the same fact as
	// zero — a process nothing has ever run and a counter that failed to read are
	// different things, and only one of them is worth saying out loud.
	Runtime *Runtime
}

type Product struct {
	ID          string
	Name        string
	HomeCatalog string
	CanView     bool
	// ProvisionProcess and DeprovisionProcess are BPMN process ids, which is what a
	// product binds: what runs is whatever is deployed when the order line is
	// reached, so the binding names an id and never a version.
	ProvisionProcess   string
	DeprovisionProcess string
	// State is the item's catalogue state as the store spells it — "draft",
	// "active", "withdrawn" (see [catalog.State]) — and it is carried rather than
	// reduced to a flag.
	//
	// Three values and not a boolean, because the two that are not active are not
	// the same thing and a reader narrowing by this is usually asking about
	// precisely that difference: a draft is an item somebody is still writing, a
	// withdrawn one is an item that was real and was retired. Collapsed into
	// "not active" they become one heap, and "what did we retire" — the question
	// that sends somebody to this picture in the first place — can no longer be
	// asked at all.
	State string
	// Approval is the item's approval rule kind, as [catalog.ApprovalKind] spells
	// it: "none", "fixed", "role", "superior", or the name a registered process is
	// known by. Empty from a store that has no rule on the item.
	//
	// The kind and not a "needs approval" boolean, for the reason above and one
	// more: the set is open — a fifth kind is modelled and registered under a name
	// rather than built in — so the fact is a string this package must not try to
	// enumerate. Whether that adds up to "requires approval" is a reading, and a
	// reading belongs where the picture is drawn.
	Approval string
}

type ProductCatalog struct {
	ID      string
	Name    string
	CanView bool
	// Items are the products this catalogue offers, by id.
	Items []string
	Edges []CatalogEdge
}

type ReachOut func(ctx context.Context, land *Landscape)

type Refusal struct {
	Reason  string `json:"reason"`
	Message string `json:"message"`
}

type RelationshipKind struct {
	Type  string `json:"type"`
	Label string `json:"label"`
	// Rule is the sentence from the specification this implements, in plain words.
	// It travels to the browser so a refusal can say *why* rather than only that it
	// was refused: "you cannot draw that" teaches nobody the notation.
	Rule string `json:"rule"`
}

type Resolution struct {
	ContractVersion int               `json:"contractVersion"`
	Bindings        []ResolvedBinding `json:"bindings"`
	// Unresolved counts values that are forbidden or missing. It is the number a
	// listing shows as a badge: a model whose bindings no longer resolve is drifting
	// from the instance it describes, and that is worth seeing without opening it.
	Unresolved int `json:"unresolved"`
	// Problems are the extractor's, carried through: a caller needs to hear about
	// declarations that were refused as much as about the ones that stood.
	Problems []Problem `json:"problems"`
}

type ResolvedBinding struct {
	ElementID   string          `json:"elementId"`
	ElementType string          `json:"elementType"`
	Key         string          `json:"key"`
	Values      []ResolvedValue `json:"values"`
}

type ResolvedValue struct {
	Value  string `json:"value"`
	Status string `json:"status"`
	Name   string `json:"name,omitempty"`
}

type ResourceRef struct {
	ID      string
	Name    string
	CanView bool
}

type Runtime struct {
	// Running is how many instances of this definition are live right now.
	Running int `json:"running"`
	// Finished is how many have completed or been terminated. It never decreases —
	// there is no un-finishing — so it is a lifetime total rather than a rate.
	Finished int `json:"finished"`
	// LastActivity is the Unix-nano timestamp of the most recent lifecycle event of
	// any of its instances, or zero for a definition nothing has ever run. Zero is
	// meaningful here in a way it is not for the counts: no activity ever is exactly
	// what a definition nobody has started reports.
	LastActivity int64 `json:"lastActivity,omitempty"`
}

type Service struct {

	// Limits are the installation's resource budgets. New sets them to
	// [limits.Default]; the server overwrites them with its own once it has read the
	// environment, so every ceiling in this service is the one operators configured
	// (ADR-0291).
	Limits limits.Limits
	// contains filtered or unexported fields
}

type Status struct {
	OK        int `json:"ok"`
	Attention int `json:"attention"`
	Critical  int `json:"critical"`
	// Unknown counts the nodes with no applicable observation. It is stated rather
	// than folded into ok, because "nothing is wrong here" and "nothing here is
	// watched" are the two answers a status view must never merge.
	Unknown int `json:"unknown"`
	// Partial reports that the incident scan hit its bound before it finished, so
	// some parked work went uncounted and a node's ok is a floor rather than a
	// verdict.
	Partial bool `json:"partial,omitempty"`
	// Unavailable names the observation states this build cannot produce at all.
	Unavailable []UnavailableState `json:"unavailable"`
}

type Store struct {
	*sidecar.Store[Model]
}

type Subset struct {
	Version       int                `json:"version"`
	Elements      []ElementKind      `json:"elements"`
	Relationships []RelationshipKind `json:"relationships"`
	// Matrix is the permitted relationship types for every ordered pair of element
	// types in the subset, keyed "Source>Target". It is precomputed and sent whole
	// rather than asked for pair by pair: the canvas needs an answer during a drag,
	// and a network round trip per pointer move is not an answer.
	Matrix map[string][]string `json:"matrix"`
	// Limits says what this subset is not, in the same shape every other Panorama
	// answer publishes its limits.
	Limits []SubsetLimit `json:"limits"`
}

type SubsetLimit struct {
	Limit  string `json:"limit"`
	Reason string `json:"reason"`
}

type Summary struct {
	ID            string `json:"id"`
	ApplicationID string `json:"applicationId"`
	Name          string `json:"name"`
	Notation      string `json:"notation"`
	Revision      int64  `json:"revision"`
	CreatedAt     int64  `json:"createdAt"`
	CreatedBy     string `json:"createdBy,omitempty"`
	UpdatedAt     int64  `json:"updatedAt"`
	UpdatedBy     string `json:"updatedBy,omitempty"`
}

type Target struct {
	ID   string
	Name string
	// State is the observation state ReachOut resolved (ADR-0189 §6), and Reason the
	// sentence behind it. Empty means the peer was never asked — which is not the
	// same as unreachable, and is what a landscape derived while the loop was closing
	// would carry.
	State  string
	Reason string
}

type UnavailableState struct {
	State  string `json:"state"`
	Reason string `json:"reason"`
}

type ValidationResult struct {
	Valid           bool      `json:"valid"`
	Notation        string    `json:"notation"`
	Namespace       string    `json:"namespace,omitempty"`
	ModelIdentifier string    `json:"modelIdentifier,omitempty"`
	Name            string    `json:"name,omitempty"`
	Elements        int       `json:"elements"`
	Relationships   int       `json:"relationships"`
	Views           int       `json:"views"`
	Problems        []Problem `json:"problems"`
}

type Worker struct {
	ID             string
	Name           string
	Type           string
	CanView        bool
	Endpoint       string
	CredentialsRef string
	// State and Reason are this worker's observation, as on [Process].
	State  string
	Reason string
}

type WorkerUse struct {
	ElementID string
	// ElementIndex is the same element by the identity the per-element counters are
	// keyed on. See [Call.ElementIndex].
	ElementIndex int32
	Name         string
	TargetID     string
}