catalog

type Approval struct {
	Kind ApprovalKind `json:"kind"`
	// Ref names the principal for KindFixed or the group for KindRole. It is empty
	// for the kinds that need no target, and Publish refuses a rule that needs one
	// and has none.
	Ref string `json:"ref,omitempty"`
}

type ApprovalKind string

type ApproverLookup interface {
	// Account reports whether this names an account that can hold a task. Matched
	// the way an assignee is matched: by username, ignoring case.
	Account(username string) bool
	// Group reports whether this names a group, by id or by name, ignoring case —
	// which is the order and the tolerance candidate groups are matched with.
	Group(ref string) bool
}

type ApproverProblem struct {
	ItemID string `json:"itemId"`
	// HomeCatalog is where the product is maintained, because that is where the
	// reader has to go to correct it.
	HomeCatalog string `json:"homeCatalog"`
	Kind        string `json:"kind"`
	// Ref is what the rule names, echoed exactly. A reference that differs from
	// what its author believes they typed is the ordinary case here, so the report
	// shows the stored string rather than a tidied one.
	Ref string `json:"ref"`
	// Why is written for the person who has to fix it, and names the thing that
	// does not exist rather than the rule that is invalid.
	Why string `json:"why"`
}

type ApproverReport struct {
	// Checked is how many products were examined, so an empty Problems list can be
	// read as "none of 240" rather than as "nothing was looked at".
	Checked  int               `json:"checked"`
	Problems []ApproverProblem `json:"problems"`
}

type Catalog struct {
	ID    string            `json:"id"`
	Texts map[string]string `json:"texts"`
	// Rank resolves the one-catalogue-per-user rule against directory group
	// membership, which is many-to-many: the highest rank a user reaches wins.
	// Ranks are unique across catalogues, and Publish refuses a tie rather than
	// falling back to an id nobody chose.
	Rank int `json:"rank"`
	// Languages are the language tags this catalogue offers. A release proves every
	// item it carries has a text for each, and a companion record forbids declaring
	// one the portal interface does not have.
	Languages []string `json:"languages"`
	// Items are the item ids this catalogue offers, whatever their home.
	Items []string `json:"items"`
	// Groups are the directory or Atlas groups whose members reach this catalogue.
	Groups []string `json:"groups,omitempty"`
	// Members are the object axis (ADR-0071/0180/0278): the role says a caller may
	// maintain catalogues at all, this says which ones. Without it a product
	// manager can rebuild and publish every customer's catalogue, with nothing in
	// the way but not knowing an id — which ADR-0278 states plainly is not an
	// access control.
	Members []Member `json:"members,omitempty"`
	// Theme is this catalogue's appearance, empty for the instance's own. Set by
	// an administrator rather than by whoever maintains the catalogue
	// (decision 12).
	Theme Theme `json:"theme,omitempty"`
	// Edges are the structure and precedence between the items this catalogue
	// offers. They belong to the catalogue rather than to the items because they
	// are what its release is computed from, and because the same two products can
	// relate differently in two catalogues.
	Edges []Edge `json:"edges,omitempty"`
	// OwnerID is whoever created it, because creation is the one moment where
	// there is nobody to ask. The owner may always read, write and share.
	OwnerID string `json:"ownerId,omitempty"`
	// Revision is optimistic concurrency, the same field and the same rule
	// [Item.Revision] and the capability map carry.
	//
	// A catalogue's patch is partial, so it cannot clear a field nobody mentioned
	// the way a product's full replace could. What it can still lose is a list:
	// Items, Edges and Members are replaced whole when sent, and the surfaces that
	// send them compute the new value from a snapshot — adding one product posts
	// every product plus that one. Two maintainers adding a product a second apart,
	// and the second write is the first one's disappearance, with no error and no
	// trace.
	//
	// Zero in a patch means the caller stated no precondition and the write is
	// unconditional, which is right for a form whose every field is on the screen
	// in front of somebody. The caller holding a snapshot is the one that should
	// say so. A catalogue itself is never at zero: it is created at one, so there
	// is always a revision to hold on to.
	//
	// Every writer advances it, and that is not a detail — a path that changes a
	// catalogue without advancing it is a path whose changes a stale caller
	// overwrites in silence. TestEveryWriterAdvancesTheRevision names them all.
	Revision  int64 `json:"revision"`
	CreatedAt int64 `json:"createdAt"`
	UpdatedAt int64 `json:"updatedAt"`
}

type Edge struct {
	From string   `json:"from"`
	To   string   `json:"to"`
	Kind EdgeKind `json:"kind"`
}

type EdgeKind string

type FulfilmentProblem struct {
	// ItemID and HomeCatalog are empty for a problem on the shared path, which
	// belongs to no single product and stops every order alike.
	ItemID      string `json:"itemId,omitempty"`
	HomeCatalog string `json:"homeCatalog,omitempty"`
	// Stage says where on the path this sits: "order", "approval", "provision" or
	// "deprovision". It is what tells a reader whether nothing can be ordered at
	// all or only this one service cannot be given back.
	Stage string `json:"stage"`
	// ProcessID is the process the binding names, echoed exactly.
	ProcessID string `json:"processId"`
	// JobType is set where the process is deployed and one of its job types is
	// unserved. Empty where the process itself is missing.
	JobType string `json:"jobType,omitempty"`
	// Why is written for the person who has to fix it and names the thing that is
	// absent, not the binding that is invalid.
	Why string `json:"why"`
}

type FulfilmentReport struct {
	// Checked is how many offered services were examined, so an empty Problems
	// list reads as "none of 10" rather than as "nothing was looked at".
	Checked int `json:"checked"`
	// Releases names the releases the products came from, so a reader can tell
	// whether the report is about what they just published.
	Releases []string            `json:"releases"`
	Problems []FulfilmentProblem `json:"problems"`
}

type Import struct {
	Items []Item `json:"items"`
	Edges []Edge `json:"edges"`
	// Skipped names what was left out and why, in the model's own words where it
	// has them.
	Skipped []string `json:"skipped"`
}

type Input struct {
	// CatalogID names the catalogue this publish is *of*. Everything computed
	// below — the schedule, the structure, the standing lists — is that one
	// catalogue's, and [Items] and [Edges] are its own.
	//
	// The other catalogues are here for one question, and only one: a rank is
	// unique across the set, so a tie can only be seen against everybody else. It
	// was easy to miss that the rest of the set is not the subject, and missing it
	// cost a real defect — every other catalogue's products were resolved against
	// *this* catalogue's item list, so every one of them came back "unknown item",
	// and a catalogue could be published only while every other catalogue was
	// empty. Publishing A blamed B, publishing B blamed A, and neither message
	// named the catalogue the caller had asked to publish.
	//
	// Empty means "there is no other catalogue to be", which is true of a single
	// one and of nothing else — see [Publish], which refuses the ambiguous case
	// rather than picking a reading.
	CatalogID string
	Catalogs  []Catalog
	Items     []Item
	Edges     []Edge
}

type Item struct {
	ID string `json:"id"`
	// HomeCatalog is the catalogue whose scope governs editing this item. An item
	// is referenced by catalogues rather than owned by one — it legitimately appears
	// in several — so scope cannot be inherited from "the catalogue it is in", and a
	// per-item member list is the per-artifact ACL ADR-0071 refused. One home, and
	// every other catalogue includes it read-only.
	HomeCatalog string `json:"homeCatalog"`
	State       State  `json:"state"`
	// Texts holds the item's name per language tag. A release proves it carries one
	// for every language its catalogue declares.
	Texts map[string]string `json:"texts"`
	// Descriptions is what this product *is*, per language tag, beside the name
	// Texts carries. Empty is the ordinary state for a product whose name says
	// enough, and means no description anywhere rather than an empty one.
	//
	// # Why per language and not one string
	//
	// Every other text a person reads off a product is per locale, and this is the
	// one somebody reads when the name was not enough — which is exactly when not
	// being able to read it matters. A catalogue declaring German and French could
	// otherwise translate the name of a thing and not the sentence explaining it.
	//
	// It is deliberately not Keywords, which is flat for the opposite reason:
	// keywords are for *finding* and a searcher's language is not the catalogue's,
	// while a description is for *showing* and is read in the language the portal
	// is being read in.
	//
	// # What a release demands of it
	//
	// Nothing, until there is one. A product with no description publishes, because
	// not every product needs a paragraph. A product with a description in one of
	// the catalogue's declared languages and not another does not, because that is
	// a portal where one audience is told what the thing is and the other is shown
	// an empty panel — the half-translated catalogue the name check already
	// refuses, in the field a reader turns to second.
	Descriptions map[string]string `json:"descriptions,omitempty"`
	Lifecycle    Lifecycle         `json:"lifecycle,omitempty"`
	Variants     []Variant         `json:"variants,omitempty"`
	Approval     Approval          `json:"approval"`
	// ProvisionProcess and DeprovisionProcess are the BPMN process ids bound to this
	// item. Both are required to publish: a catalogue that can only grant is not a
	// lifecycle, and the day somebody must revoke at scale is the wrong day to find
	// the process was never written.
	ProvisionProcess   string `json:"provisionProcess"`
	DeprovisionProcess string `json:"deprovisionProcess"`
	// MultipleAllowed says whether a principal may hold this item more than once —
	// two licences, two mailboxes. Where it is false the basket marks an item the
	// orderer already holds as held, and skips it.
	MultipleAllowed bool `json:"multipleAllowed,omitempty"`
	// Targets is what this item is called in the systems that actually hold it, and
	// it is what lets a commissioning load attribute a right it found to this item
	// (ADR-0333). Empty is the ordinary state for an
	// item nothing outside Atlas grants, and it means no load will ever name it.
	//
	// Several are allowed: one service is legitimately two groups. The same ref
	// twice is not, and [Publish] refuses it — an observation matching two items
	// cannot be attributed, and guessing between them would write evidence Atlas
	// invented.
	Targets []TargetRef `json:"targets,omitempty"`
	// MaxDays is how long a right this product grants may last, in days, or zero
	// for one that does not end (ADR-0344). It is a
	// **ceiling declared as policy** — nobody holds this for more than ninety days
	// — and not a date somebody chose; an order cannot yet name a shorter end
	// within it.
	//
	// It reaches a grant through the release, like the bindings and the approval
	// rule beside it: a ceiling relaxed in the catalogue next week must not lengthen
	// a right granted this week under the stricter one.
	//
	// It never applies to an adopted or legacy right. A commissioning load records
	// a found right's start as the moment it was found, so a ceiling measured from
	// it would schedule an entire estate to expire on the anniversary of the day
	// somebody switched the portal on.
	MaxDays int `json:"maxDays,omitempty"`
	// Eligible narrows the catalogue's audience for this one product: the group ids
	// whose members may **receive** it. Empty is the ordinary case and means no
	// narrowing (ADR-0347).
	//
	// # Why an item needs this when a catalogue already has an audience
	//
	// Because a person sees exactly one catalogue — the highest-ranked one their
	// groups reach — so "put it in a narrower catalogue" is not a workaround. A
	// second catalogue does not give anybody a second shop; it is simply hidden
	// behind the one they already reach. A product that should be available to part
	// of a catalogue's audience could not be expressed at all.
	//
	// # Why empty is not fail-open
	//
	// [Catalog.ReachedBy] is fail-closed and stays the gate: nothing here is
	// reachable by somebody outside the catalogue's audience, whatever this says.
	// This only ever *narrows* that, so an empty list inherits a restriction rather
	// than removing one — the opposite of a catalogue with no groups, which would
	// otherwise be a shop open to everybody while somebody is still filling it.
	//
	// # Who is checked
	//
	// The **recipient**, never the orderer. A manager ordering a workplace for a
	// new hire is the ordinary case and must keep working; the question this
	// answers is who may end up holding the thing, and that is the person it is
	// for. It reaches an order through the release like the ceiling and the
	// approval rule beside it, so a restriction relaxed next week cannot retroact
	// on an order placed this week and a restriction *added* next week cannot
	// invalidate one already approved.
	Eligible []string `json:"eligible,omitempty"`
	// Keywords are the words somebody might search for that are not the product's
	// name: synonyms, the vendor's own term, the abbreviation everybody uses, the
	// thing it replaced (ADR-0355).
	//
	// # Why this exists rather than searching the name alone
	//
	// The story it serves names the case exactly: find a service *when the exact
	// product name is not known*. A search over names answers only for somebody who
	// already knows what the thing is called, which is the person who least needs
	// a search.
	//
	// # Why one flat list and not one per language
	//
	// Every other text on an item is per locale, and this deliberately is not. A
	// synonym list is for **finding**, not for displaying, and a searcher's language
	// is not the catalogue's: somebody reading a German catalogue types "laptop" as
	// readily as "Notebook", and an abbreviation like "M365" belongs to no language
	// at all. Splitting the list by locale would hide a term from exactly the person
	// who needed it, and would ask a product manager to maintain in two places what
	// they think of once.
	//
	// It travels into the release like everything else here, so a term added next
	// week does not change what an order placed this week was placed against — which
	// matters less for a search than for a rule, and is still the property that
	// makes a release a release.
	Keywords []string `json:"keywords,omitempty"`
	// ConfigForm names the Atlas form somebody fills in when they order this
	// product: the cost centre, the site, the employee number — whatever this one
	// product needs that its name does not say
	// (ADR-0358). Empty is the
	// ordinary case and means the product is fully described by what it is.
	//
	// # Why a form id and not a field list of its own
	//
	// Atlas already has forms: a definition with an id, an editor, a renderer, a
	// generator, and two surfaces rendering them. A second way to declare "these
	// are the fields somebody fills in" would be a second thing to author, a second
	// thing to render, and a second set of field types to keep level with the
	// first. The catalogue names an id and interprets nothing.
	//
	// # What the catalogue does *not* do with it
	//
	// It never resolves it. The form store is the `api` package's and this package
	// cannot see it, exactly as it cannot see which processes are deployed — and
	// for the same reason the two provisioning bindings are stored as plain ids.
	// The authoring screen offers only forms that exist, which is where that check
	// belongs: at the moment somebody chooses, not at the moment somebody orders.
	//
	// # Why the release freezes the id and not the form
	//
	// A release freezes what an order was placed against, and the reason is always
	// the same: a rule relaxed next week must not change what somebody was held to
	// this week. That argument is about *rules*. A form is a set of questions, and
	// what has to survive is the **answers** — which the order line carries, with
	// their field keys, for as long as the order exists. "Cost centre 4711" stays
	// true whatever the form does afterwards.
	//
	// The honest cost is stated in the record: a form that gains a field next week
	// leaves every earlier order without a value for it, and a provisioning process
	// that reads it finds nothing. That is true of every variable a process reads
	// and is the process's business; copying a form-js document into every release
	// would put a rendering artifact inside a design-time model that has kept
	// rendering out of itself on purpose, and would send it to every browser that
	// opens the portal.
	ConfigForm string `json:"configForm,omitempty"`
	// Price is what this product costs, written as the catalogue's maintainer wants
	// it read — "CHF 1'200.–", "49.– / Monat", "im Grundpaket enthalten"
	// (ADR-0361). Empty is the ordinary case
	// and means the catalogue says nothing about cost.
	//
	// # Why a string and not a number with a currency
	//
	// Because it is **displayed and never computed**. A number invites a total, a
	// total invites two products in different currencies, and that invites a rate
	// and a date — a money model, decided by an installation's finance rules and not
	// by this package. Everything that makes a price *arithmetic* is absent on
	// purpose, and a string is the honest shape of "this is what it says on the
	// shelf".
	//
	// The cost of that is stated rather than hidden: nothing can add these up. The
	// surface that needs a figure most is the approval, and an approval decides one
	// line — so the one number it shows is the one number it needs. A basket total
	// would need the money model above, and that is a different measure.
	//
	// # Why it is frozen into the release like a rule
	//
	// It is not a rule, and it travels like one anyway. An approver saw a figure and
	// decided on it; a catalogue edit next week must not make the record show a
	// different figure than the one that was approved. That is the same sentence as
	// the approval rule's and the ceiling's, and it is the reason this is on the
	// line as well as in the release.
	Price string `json:"price,omitempty"`
	// Category is the heading this product sits under in the portal — "Arbeitsplatz",
	// "Kommunikation", "Fachanwendungen" (ADR-0360).
	// Empty is the ordinary case and puts the product under the heading the portal
	// names for products that have none.
	//
	// # Why a field and not an entity
	//
	// Because it is **a heading and nothing else**. An entity would carry its own
	// texts, its own ordering, its own visibility and its own lifecycle, and each of
	// those is a thing to publish, migrate and get wrong. A heading has none of them:
	// it is the word above a column.
	//
	// The costs are real and stated rather than hidden. A category has **no ordering
	// of its own** — there is nothing on a string to sort by, and inventing a rank
	// here would be the entity arriving through the back door, so the portal sorts
	// alphabetically. And two spellings are two categories, with nothing to notice
	// that "Arbeitsplatz" and "Arbeitsplätze" were meant as one.
	//
	// If either of those turns out to matter, the answer is the entity, and this
	// field is what it would be migrated from.
	//
	// # What this string is, now that the heading is translatable
	// (ADR-0412)
	//
	// The third cost ADR-0360 recorded was that a heading has no translation. It has
	// one now, in [Item.CategoryTexts] below — and this field did not become it. It
	// is **the key**: what the portal groups by, what a search hit sets to open the
	// cascade at the right column, and what an already published release already
	// holds. The translations are how it is *rendered*.
	//
	// That split is the whole of the decision, and it is what makes the change
	// additive. Had the string become a map, two products would be one category when
	// their German agreed and two when their French did not — a heading that splits
	// in a language nobody publishing it reads. Grouping by one value that no reader
	// ever has to see keeps "same category" a fact about the catalogue rather than
	// about the reader.
	//
	// Where translations are present the key never has to be a word: a stable slug
	// survives the maintainer deciding the German wording was wrong. Where they are
	// absent — every product written before the field existed, every single-language
	// catalogue — the key is the word, and it is what every language renders. That
	// is the old behaviour exactly, which is why no stored record had to be migrated.
	Category string `json:"category,omitempty"`
	// CategoryTexts is [Item.Category] per language tag: the heading as the reader
	// of this portal reads it, where the key above is what everything groups by.
	//
	// Empty is the ordinary state and means the key renders in every language — the
	// state of every product written before this field and of every catalogue that
	// declares one language.
	//
	// # What a release demands of it
	//
	// The rule [Item.Descriptions] follows, for the same reason: optional as a
	// whole, all-or-nothing once there is one. A heading translated into German and
	// not French is a portal where one audience reads its own column head and the
	// other reads somebody else's, and nothing says so, because the fallback renders
	// and looks deliberate.
	//
	// Beside that, a translation without a key is refused. It would put the product
	// in the bucket for products carrying no heading — under a column head reading
	// "Ohne Kategorie", while holding the word for one in four languages.
	CategoryTexts map[string]string `json:"categoryTexts,omitempty"`
	// ProductGroup is the group this product sits in, one level below its category:
	// the portal's cascade reads Kategorie > Produktgruppe > Produkt > Services.
	//
	// A string on the product, exactly like [Item.Category] above, and for the same
	// reasons — see the paragraph there, which applies word for word. What is worth
	// adding is what the pairing means, because "a chain" sounds like more than this
	// is: the group has no record and therefore **no category of its own**. The
	// product carries both strings and the chain is assembled per product — this
	// product is in category X, group Y — so the group→category relation is only
	// ever read off the products that carry both.
	//
	// Two consequences, and neither is an error state. A group whose products sit
	// in two categories appears under both, because nothing anywhere claims a group
	// belongs to one. And a group with no products does not exist, exactly as a
	// category with none does not.
	ProductGroup string `json:"productGroup,omitempty"`
	// ProductGroupTexts is [Item.ProductGroup] per language tag, exactly as
	// [Item.CategoryTexts] is the heading's — same split into a key that groups and
	// texts that render, same all-or-nothing rule at publication, same reason. See
	// the paragraphs there.
	ProductGroupTexts map[string]string `json:"productGroupTexts,omitempty"`
	// Revision is optimistic concurrency, the same field and the same rule the
	// capability map uses: a write that states a revision is refused when the
	// stored record has moved past it, rather than silently overwriting somebody
	// else's edit (ADR-0376).
	//
	// # Why this and not the timestamp beside it
	//
	// Because a caller has to be able to send it back unchanged, and
	// [Item.UpdatedAt] is Unix nanoseconds — around 1.8e18, past the 2^53 where a
	// float64 stops representing integers exactly. Every JSON client that decodes
	// numbers as doubles, which is most of them and every MCP client, would return
	// a value a few hundred nanoseconds off and be told its write was stale. A
	// revision counts in ones, so it stays exact for more writes than a catalogue
	// will ever see.
	//
	// Zero means the caller stated no precondition and the write is unconditional,
	// which is what the Console sends: it renders every field and posts every
	// field, so the record it overwrites is the record on the screen in front of
	// somebody. A product stored before this field existed also reads zero, so its
	// first write is unconditional and every write after it can be guarded.
	Revision  int64 `json:"revision"`
	CreatedAt int64 `json:"createdAt"`
	UpdatedAt int64 `json:"updatedAt"`
}

type Lifecycle struct {
	From  int64 `json:"from,omitempty"`
	Until int64 `json:"until,omitempty"`
}

type Member struct {
	Ref  PrincipalRef `json:"ref"`
	Role MemberRole   `json:"role"`
}

type MemberRole string

type PrincipalRef struct {
	Type string `json:"type"`
	ID   string `json:"id"`
}

type Problem struct {
	// Catalog and Item name where the problem is, either or both empty when it
	// belongs to the whole input (a cycle, a rank tie).
	Catalog string `json:"catalog,omitempty"`
	Item    string `json:"item,omitempty"`
	Message string `json:"message"`
}

type ProcessLookup interface {
	// JobTypesOf returns the job types the tasks of this process id carry, and
	// whether any executable definition carries that id at all. The newest
	// deployed version answers, because that is the one an instance starts on.
	JobTypesOf(processID string) (jobTypes []string, deployed bool)
	// Served reports whether anything works that job type: the engine itself, a
	// worker seen pulling it, or — for a user task — a person.
	Served(jobType string) bool
}

type Release struct {
	// ID, CatalogID and CreatedAt identify the release. They are assigned by
	// whoever publishes it; [Publish] computes the rest.
	ID        string `json:"id,omitempty"`
	CatalogID string `json:"catalogId,omitempty"`
	CreatedAt int64  `json:"createdAt,omitempty"`
	// Items are the item definitions as they stood when this was published, sorted
	// by id, and they are copies rather than references.
	//
	// This is the whole of the snapshot rule. An order names one release; if the
	// release pointed at rows that keep changing, an approval pending for a week
	// could be approving something else by the time it is granted. Only value data
	// is copied, so an edit to the catalogue afterwards cannot reach in here.
	Items []Item `json:"items,omitempty"`
	// Waves is every item in the input, grouped into rounds: nothing in a wave
	// depends on anything in the same wave, and everything it does depend on is in
	// an earlier one. An order names one release and follows this schedule; it
	// never recomputes it.
	//
	// A flat sequence was the first shape and could not carry the failure
	// behaviour the shop requires: a failing line must stop only the lines that
	// depend on it, and a list has already discarded the reason each item sits
	// where it does. Waves keep it — a failure stops its own successors, and the
	// rest of its wave and every independent branch continue.
	Waves [][]string `json:"waves"`
	// Requires holds each item's direct preconditions, sorted, with no entry for an
	// item that has none.
	//
	// Waves are the right unit to *run* in and the wrong unit to *start on*. At a
	// wave boundary all that is known is "the previous wave is done", which cannot
	// distinguish a line whose precondition failed from one whose precondition is
	// in the same wave and succeeded — so a wave-wide barrier either starts a line
	// whose precondition is missing, or holds one whose preconditions are all
	// there. Both are wrong, so the edges travel with the schedule and [Blocked] is
	// what the fulfilment process asks when a line fails.
	Requires map[string][]string `json:"requires,omitempty"`
	// Excludes is what must never be held together with what
	// (ADR-0342), sorted, with no entry for an item that
	// excludes nothing.
	//
	// **Every pair appears under both ids.** EdgeExcludes is the only symmetric
	// edge kind, and a release recording one direction would make each reader
	// responsible for knowing which — a reader that got it wrong would find half
	// the violations and report the estate as half clean.
	Excludes map[string][]string `json:"excludes,omitempty"`
	// Includes and Options are the structure: what a product is made of, and what
	// is offered alongside it. Both are direct edges, sorted, with no entry for a
	// product made of nothing.
	//
	// They are kept apart because they mean opposite things to a basket. An
	// inclusion is a consequence of ordering the whole — integral, never
	// deselectable — and an option is an offer. Merging them would order a second
	// screen for everybody who orders a workplace.
	Includes map[string][]string `json:"includes,omitempty"`
	Options  map[string][]string `json:"options,omitempty"`
	// WithoutApproval names every item orderable with no approval at all, sorted.
	// It is a standing list rather than a report somebody has to think to run,
	// because the role that defines approval rules is the role that publishes them.
	WithoutApproval []string `json:"withoutApproval"`
}

type Service struct {

	// Limits are the installation's resource budgets. New sets them to
	// [limits.Default]; the server overwrites them with its own once it has read
	// the environment.
	Limits limits.Limits

	// Approvers resolves an approval rule's reference to somebody, for the report
	// in approverreport.go. It is a settable field for the reason Limits is: the
	// accounts and the groups belong to the server, which builds this service
	// before it has them.
	//
	// Nil is a real state and not a bug — a Service built by a test that does not
	// care about approvals has none — so the report refuses rather than guessing.
	// Both guesses are available and both are worse than a refusal: every
	// reference unresolvable reports the whole catalogue as broken, and every one
	// resolvable reports a clean estate nobody checked.
	Approvers ApproverLookup

	// Processes answers what is deployed and what is worked, for the report in
	// fulfilmentreport.go. Settable for Approvers' reason and nil for Approvers'
	// reason: the deployments and the workers belong to the server, and a Service
	// built without them refuses the report rather than guessing at it.
	Processes ProcessLookup
	// contains filtered or unexported fields
}

type State string

type Store struct {
	// contains filtered or unexported fields
}

type TargetRef struct {
	// System is the target system's name in the installation's own vocabulary —
	// "entra", "ad", "jira". Atlas never interprets it; it only requires that an
	// observation and the item it should match agree on the spelling.
	System string `json:"system"`
	// Ref is the right as that system reports it. Compared literally, case and all:
	// a distinguished name differing only in case is two different strings to the
	// directory that issued them, and normalising here would attribute a right to
	// an item on a similarity Atlas invented.
	Ref string `json:"ref"`
}

type Theme struct {
	// Accent is the source brand colour as #rgb or #rrggbb, lower case.
	Accent string `json:"accent,omitempty"`
	// Typeface names one of [Typefaces]. It is a choice from a list rather than a
	// URL on purpose: a web-font URL would reach a third party on every portal
	// page load, carrying the visitor's address there — an outbound dependency on
	// pages that must render when nothing else is reachable, and a data flow an
	// operator in public administration cannot accept on a customer-facing
	// surface.
	Typeface string `json:"typeface,omitempty"`
}

type TranslationReport struct {
	// Checked is how many products were looked at, so a quiet report can be told
	// from an empty one.
	Checked int `json:"checked"`
	// Catalogs are the ids this report covers, sorted: the ones the caller may
	// maintain. A caller who maintains none gets an empty list rather than a 403,
	// because having nothing to maintain is not a refusal.
	Catalogs []string `json:"catalogs"`
	// Gaps is every place a product says something in one declared language and
	// not in another, each naming the catalogue and the product it is about.
	Gaps []Problem `json:"gaps"`
}

type Unpublished struct {
	// Released reports whether a release exists, and the two fields after it
	// identify the newest one.
	Released  bool   `json:"released"`
	ReleaseID string `json:"releaseId,omitempty"`
	// ReleasedAt is when it was published, in the server's own seconds.
	ReleasedAt int64 `json:"releasedAt,omitempty"`

	// Added is offered now and absent from the release: publishing puts it in front
	// of people.
	Added []UnpublishedItem `json:"added"`
	// Removed is in the release and no longer offered: **the portal is still
	// offering it**, and publishing is what takes it away. This is the one a
	// maintainer cannot otherwise see, because it is gone from every screen they
	// have and present on the one they do not.
	Removed []UnpublishedItem `json:"removed"`
	// Changed is offered in both and edited since: the portal is showing an older
	// name, price, state or description than the catalogue holds.
	Changed []UnpublishedItem `json:"changed"`
}

type UnpublishedItem struct {
	ID string `json:"id"`
	// Texts is the item's name per language. For a removed product it is the
	// **frozen** copy's, because that is the name on the portal right now, and
	// naming it any other way would describe something the reader cannot see.
	Texts map[string]string `json:"texts,omitempty"`
	// State is the live record's, and empty for a removed product whose record is
	// no longer readable here.
	State State `json:"state,omitempty"`
}

type Variant struct {
	ID    string            `json:"id"`
	Texts map[string]string `json:"texts"`
}