policy

type AgentTask struct {
	EnrichTask
}

type CommitPolicyAlert struct {
	ID       types.AlertID     `json:"id"`
	Schema   types.AlertSchema `json:"schema"`
	Metadata alert.Metadata    `json:"metadata"`
	Data     any               `json:"data"`
}

type CommitPolicyInput struct {
	Alert  CommitPolicyAlert `json:"alert"`
	Enrich EnrichResults     `json:"enrich"`
}

type CommitPolicyResult struct {
	Title       string            `json:"title,omitempty"`
	Description string            `json:"description,omitempty"`
	Channel     string            `json:"channel,omitempty"`
	Attr        []alert.Attribute `json:"attr,omitempty"`
	Publish     types.PublishType `json:"publish,omitempty"`
}

type Contents map[string]string

type EnrichPolicyResult struct {
	Query []QueryTask `json:"query"`
	Agent []AgentTask `json:"agent"`
}

type EnrichResults map[string]any // key: task ID, value: result data

type EnrichTask struct {
	ID     string                   `json:"id"`
	Prompt string                   `json:"prompt,omitempty"` // File path
	Inline string                   `json:"inline,omitempty"` // Inline prompt
	Format types.GenAIContentFormat `json:"format"`           // "text" or "json"
}

type QueryFunc func(ctx context.Context, query string, data any, result any, queryOptions ...opaq.QueryOption) error

type QueryTask struct {
	EnrichTask
}

type TaskType string

type TestData struct {
	// Metafiles is the metadata (README) of the test data that is generated by the AI.
	Metafiles map[types.AlertSchema]map[string]string
	// Data is the test data that is from the original alert or modified.
	Data map[types.AlertSchema]map[string]any
}

type TestDataSet struct {
	Detect *TestData `json:"detect"`
	Ignore *TestData `json:"ignore"`
}