domain

type Account struct {
	ID   AccountID `json:"id"`
	Name string    `json:"name"`
}

type AccountID string

type AccountSummary struct {
	ReadyForUse bool

	// Health.
	Health ServiceHealth

	// Service counts.
	ServiceCount     int64
	ActiveServices   int64
	OkServices       int64
	DisabledServices int64
	InactiveServices int64

	// Event counts.
	EventCount    int64
	AnalyzedCount int64

	// Policy counts.
	PendingPolicyCount         int64
	ApprovedPolicyCount        int64
	DismissedPolicyCount       int64
	PolicyPendingCriticalCount int64
	PolicyPendingHighCount     int64
	PolicyPendingMediumCount   int64
	PolicyPendingLowCount      int64

	// Service-level throughput (ground truth).
	TotalServiceVolumePerHour *float64
	TotalServiceCostPerHour   *float64

	// Log event throughput (discovered events). Nil when unmeasured.
	TotalCostPerHour       *float64
	TotalCostPerHourBytes  *float64
	TotalCostPerHourVolume *float64
	TotalVolumePerHour     *float64
	TotalBytesPerHour      *float64

	// Estimated savings from pending policies. Nil when unmeasured.
	EstimatedCostPerHour       *float64
	EstimatedCostPerHourBytes  *float64
	EstimatedCostPerHourVolume *float64
	EstimatedVolumePerHour     *float64
	EstimatedBytesPerHour      *float64

	// Observed impact from approved policies (before/after). Nil when unmeasured.
	ObservedCostBefore       *float64
	ObservedCostBeforeBytes  *float64
	ObservedCostBeforeVolume *float64
	ObservedCostAfter        *float64
	ObservedCostAfterBytes   *float64
	ObservedCostAfterVolume  *float64
	ObservedVolumeBefore     *float64
	ObservedVolumeAfter      *float64
	ObservedBytesBefore      *float64
	ObservedBytesAfter       *float64
}

type AnalysisEnvelope map[string]json.RawMessage

type Attr struct {
	Key   string
	Value string
}

type Block struct {
	Index      int         `json:"index"`
	Type       BlockType   `json:"type"`
	Text       *TextBlock  `json:"text,omitempty"`
	Thinking   *Thinking   `json:"thinking,omitempty"`
	ToolUse    *ToolUse    `json:"tool_use,omitempty"`
	ToolResult *ToolResult `json:"tool_result,omitempty"`
}

type BlockType string

type BotTrafficAnalysis struct {
	UserAgentField FieldPath `json:"user_agent_field"`         // Path to user-agent attribute
	BotProportion  *float64  `json:"bot_proportion,omitempty"` // Fraction of traffic identified as bot/crawler (0.0–1.0)
	// contains filtered or unexported fields
}

type BrokenRecordsAnalysis struct {
	MinIntervalSeconds int `json:"min_interval_seconds"` // Suggested minimum interval between kept events (1-30s)
	// contains filtered or unexported fields
}

type CategoryType string

type CommodityTrafficAnalysis struct {
	MinIntervalSeconds int `json:"min_interval_seconds"` // Suggested minimum interval between kept events (1-30s)
	// contains filtered or unexported fields
}

type ComplianceAnalysisEnvelope struct {
	PIILeakage         *PIILeakageAnalysis         `json:"pii_leakage,omitempty"`
	SecretsLeakage     *SecretsLeakageAnalysis     `json:"secrets_leakage,omitempty"`
	PHILeakage         *PHILeakageAnalysis         `json:"phi_leakage,omitempty"`
	PaymentDataLeakage *PaymentDataLeakageAnalysis `json:"payment_data_leakage,omitempty"`
}

type ComplianceCategorySummary struct {
	Category       PolicyCategory // One of the 4 compliance categories
	DisplayName    string         // Human-readable name from control plane
	Principle      string         // One-liner explaining what this category catches
	LeakingCount   int64          // Policies with observed sensitive data
	AtRiskCount    int64          // Policies without observed data (but flagged)
	FixedCount     int64          // Approved policies
	VolumePerHour  float64        // Total volume across all policies in this category
	ServiceCount   int            // Number of unique services affected
	UniqueServices []string
}

type CompliancePolicy struct {
	Category      PolicyCategory   // One of: pii_leakage, secrets_leakage, phi_leakage, payment_data_leakage
	LogEventName  string           // Log event name
	ServiceName   string           // Service name
	Fields        []SensitiveField // Parsed from analysis JSON
	VolumePerHour *float64         // Log event volume; nil when unmeasured
	AnyObserved   bool             // True if any field has observed sensitive data
}

type ConstantVariesEvidence struct {
	Constant     []FieldValue
	Varying      []VaryingField
	ExampleCount int
}

type ContextEntity struct {
	EntityType string `json:"entity_type"` // "service", "log_event", "policy", etc.
	EntityID   string `json:"entity_id"`
}

type ContextSource string

type Conversation struct {
	ID          ConversationID `json:"id"`
	WorkspaceID WorkspaceID    `json:"workspace_id"`
	Title       string         `json:"title"`
	CreatedAt   time.Time      `json:"created_at"`
	UpdatedAt   time.Time      `json:"updated_at"`
}

type ConversationID string

type DatadogAccountID string

type DatadogRegion struct {
	Site DatadogSite
	Name string
	Desc string
}

type DatadogSite string

type DeadWeightAnalysis struct {
	// contains filtered or unexported fields
}

type DebugArtifactsAnalysis struct {
	// contains filtered or unexported fields
}

type DuplicateFieldsAnalysis struct {
	Pairs []DuplicatePair `json:"pairs"` // Duplicate field pairs to deduplicate
	// contains filtered or unexported fields
}

type DuplicatePair struct {
	Remove []FieldPath `json:"remove"` // Duplicate field paths to remove
	Keep   FieldPath   `json:"keep"`   // Canonical field path to keep
}

type Evidence interface {
	// contains filtered or unexported methods
}

type FieldListEvidence struct {
	Fields        []FieldSize
	TotalBytes    float64 // Sum of targeted fields' bytes
	EventAvgBytes float64 // Whole-event average bytes (baseline)
	BytesFraction float64 // TotalBytes / EventAvgBytes
}

type FieldPath []string

type FieldSize struct {
	Key           string  // Dot-key (e.g. "http.request.body")
	BytesPerEvent float64 // Average bytes this field contributes per event
}

type FieldValue struct {
	Key   string
	Value string
}

type HealthChecksAnalysis struct {
	// contains filtered or unexported fields
}

type HighlightedExampleEvidence struct {
	Attrs        []FieldValue // All attributes from the example, ordered with relevant first
	RelevantKeys []FieldPath  // Keys that should be visually highlighted
}

type InstrumentationBloatAnalysis struct {
	Fields []FieldPath `json:"fields"` // Attribute paths to remove
	// contains filtered or unexported fields
}

type LogEventStatus struct {
	Name                       string
	VolumePerHour              *float64
	BytesPerHour               *float64
	CostPerHourUSD             *float64
	PendingPolicyCount         int64
	ApprovedPolicyCount        int64
	PolicyPendingCriticalCount int64
	PolicyPendingHighCount     int64
	PolicyPendingMediumCount   int64
	PolicyPendingLowCount      int64
}

type LogExample struct {
	Body       string         `json:"body"`
	Severity   string         `json:"severity_text"`
	Attributes map[string]any `json:"attributes"`
}

type MalformedAnalysis struct {
	// contains filtered or unexported fields
}

type Message struct {
	ID             MessageID      `json:"id"`
	ConversationID ConversationID `json:"conversation_id"`
	Role           Role           `json:"role"`
	Content        []Block        `json:"content"`
	Model          string         `json:"model,omitempty"`
	StopReason     string         `json:"stop_reason,omitempty"`
	CreatedAt      time.Time      `json:"created_at"`
}

type MessageID string

type Organization struct {
	ID                   OrganizationID       `json:"id"`
	Name                 string               `json:"name"`
	WorkosOrganizationID WorkosOrganizationID `json:"workos_organization_id,omitempty"`
}

type OrganizationID string

type OversizedFieldsAnalysis struct {
	Fields []FieldPath `json:"fields"` // Attribute paths to truncate
	// contains filtered or unexported fields
}

type PHILeakageAnalysis struct {
	Fields []SensitiveField `json:"fields"`
	// contains filtered or unexported fields
}

type PIILeakageAnalysis struct {
	Fields []SensitiveField `json:"fields"`
	// contains filtered or unexported fields
}

type PaymentDataLeakageAnalysis struct {
	Fields []SensitiveField `json:"fields"`
	// contains filtered or unexported fields
}

type Policy struct {
	ID                  PolicyID
	ServiceName         string
	LogEventName        string
	Category            PolicyCategory
	CategoryType        CategoryType
	Action              PolicyAction
	Status              PolicyStatus
	Severity            PolicySeverity
	CategoryDisplayName string

	// Metrics (nil = not measured)
	VolumePerHour          *float64
	BytesPerHour           *float64
	EstimatedCostPerHour   *float64
	EstimatedVolumePerHour *float64
	EstimatedBytesPerHour  *float64
	SurvivalRate           *float64

	// Event-level baselines from log_events.
	EventBaselineAvgBytes      *float64 // Trailing 7-day avg bytes per event
	EventBaselineVolumePerHour *float64 // Trailing 7-day volume per hour

	// Per-field byte sizes from log_event_fields, keyed by dot-path (e.g. "http.status").
	// Populated for quality categories via PolicyCard. nil for other categories.
	FieldSizes map[string]float64

	// Parsed from JSON
	Analysis     PolicyAnalysis // nil if analysis JSON is empty or unparseable
	Examples     []LogExample   // parsed, infrastructure stripped
	RelevantKeys []FieldPath    // attribute paths relevant to this category
}

type PolicyAction string

type PolicyAnalysis interface {
	Category() PolicyCategory
	Rationale() string
	Subtitle() string
	ActionDetail() string
	RelevantKeys() []FieldPath
}

type PolicyCard struct {
	PolicyID               string
	ServiceName            string
	LogEventName           string
	Category               string
	CategoryType           string
	Action                 string
	Status                 string
	Severity               string
	CategoryDisplayName    string
	VolumePerHour          *float64
	BytesPerHour           *float64
	EstimatedCostPerHour   *float64
	EstimatedVolumePerHour *float64
	EstimatedBytesPerHour  *float64
	SurvivalRate           *float64
	Analysis               string // Raw category-keyed JSON from log_event_policies.analysis
	Examples               string // Raw JSON array from log_events.examples

	// Event-level baselines from log_events.
	EventBaselineAvgBytes      *float64 // Trailing 7-day avg bytes per event
	EventBaselineVolumePerHour *float64 // Trailing 7-day volume per hour

	// Per-field byte sizes from log_event_fields, keyed by dot-path (e.g. "http.status").
	// Populated by the sqlite layer for quality categories. nil for other categories.
	FieldSizes map[string]float64
}

type PolicyCategory string

type PolicyCategoryStatus struct {
	Category    PolicyCategory
	DisplayName string // Human-readable name from control plane (e.g. "Bot Traffic")
	Principle   string // One-liner explaining what this category catches

	PendingCount   int64
	ApprovedCount  int64
	DismissedCount int64
	ObservedCount  int64 // Compliance only: pending policies where sensitive data was observed (leaking)

	// Severity breakdown of pending policies.
	PolicyPendingCriticalCount int64
	PolicyPendingHighCount     int64
	PolicyPendingMediumCount   int64
	PolicyPendingLowCount      int64

	// Estimated impact from pending policies.
	EstimatedVolumePerHour *float64
	EstimatedBytesPerHour  *float64
	EstimatedCostPerHour   *float64

	// Volume discovery coverage.
	EventsWithVolumes int64 // Log events in this category that have volume data
	TotalEvents       int64 // Total log events in this category

	// What policies in this category do.
	Action PolicyAction
}

type PolicyID string

type PolicyImpact struct {
	VolumeFrom  string // "883.7k evt/hr"
	VolumeTo    string // "~8.8k evt/hr"
	VolumePct   string // "▼ 99%"
	StorageFrom string // "3.5 GB/hr"
	StorageTo   string // "~35 MB/hr"
	StoragePct  string // "▼ 99%"
	Savings     string // "~$16.3k/yr"
}

type PolicySeverity string

type PolicyStatus string

type RedundantEventsAnalysis struct {
	// contains filtered or unexported fields
}

type Role string

type SecretsLeakageAnalysis struct {
	Fields []SensitiveField `json:"fields"`
	// contains filtered or unexported fields
}

type SensitiveField struct {
	Path     FieldPath `json:"path"`     // Attribute path, e.g. ["attributes", "user", "email"]
	Types    []string  `json:"types"`    // Types of sensitive data this field could contain
	Observed bool      `json:"observed"` // True if actual sensitive data was seen in log values
}

type ServiceHealth string

type ServiceID string

type ServiceStatus struct {
	Name   string
	Health ServiceHealth

	// Event counts.
	LogEventCount         int64
	LogEventAnalyzedCount int64

	// Policy counts.
	PolicyPendingCount         int64
	PolicyApprovedCount        int64
	PolicyDismissedCount       int64
	PolicyPendingCriticalCount int64
	PolicyPendingHighCount     int64
	PolicyPendingMediumCount   int64
	PolicyPendingLowCount      int64

	// Service-level throughput (ground truth from service_log_volumes). Nil when unmeasured.
	ServiceVolumePerHour        *float64
	ServiceDebugVolumePerHour   *float64
	ServiceInfoVolumePerHour    *float64
	ServiceWarnVolumePerHour    *float64
	ServiceErrorVolumePerHour   *float64
	ServiceOtherVolumePerHour   *float64
	ServiceCostPerHourVolumeUSD *float64

	// Log event throughput (discovered events subset). Nil when unmeasured.
	LogEventVolumePerHour        *float64
	LogEventBytesPerHour         *float64
	LogEventCostPerHourUSD       *float64
	LogEventCostPerHourBytesUSD  *float64
	LogEventCostPerHourVolumeUSD *float64

	// Estimated savings from pending policies. Nil when unmeasured.
	EstimatedVolumeReductionPerHour     *float64
	EstimatedBytesReductionPerHour      *float64
	EstimatedCostReductionPerHourUSD    *float64
	EstimatedCostReductionPerHourBytes  *float64
	EstimatedCostReductionPerHourVolume *float64

	// Observed impact from approved policies (before/after). Nil when unmeasured.
	ObservedVolumePerHourBefore        *float64
	ObservedVolumePerHourAfter         *float64
	ObservedBytesPerHourBefore         *float64
	ObservedBytesPerHourAfter          *float64
	ObservedCostPerHourBeforeUSD       *float64
	ObservedCostPerHourBeforeBytesUSD  *float64
	ObservedCostPerHourBeforeVolumeUSD *float64
	ObservedCostPerHourAfterUSD        *float64
	ObservedCostPerHourAfterBytesUSD   *float64
	ObservedCostPerHourAfterVolumeUSD  *float64
}

type TextBlock struct {
	Content string `json:"content"`
}

type Thinking struct {
	Content string `json:"content"`
}

type ToolInputDelta struct {
	ToolUseID string `json:"tool_use_id"`
	Delta     string `json:"delta"`
}

type ToolResult struct {
	ToolUseID string         `json:"tool_use_id"`
	IsError   bool           `json:"is_error,omitempty"`
	Error     string         `json:"error,omitempty"`
	Content   map[string]any `json:"content,omitempty"`
}

type ToolUse struct {
	ID            string          `json:"id"`
	Name          string          `json:"name"`
	Input         json.RawMessage `json:"input"`
	InputComplete bool            `json:"-"` // True when input is fully received (after content_block_stop)
}

type VaryingField struct {
	Key    string
	Values []string // deduplicated, up to 4
}

type WastePolicy struct {
	LogEventName               string
	ServiceName                string
	VolumePerHour              *float64 // Current throughput in events/hour; nil when unmeasured
	BytesPerHour               *float64 // Current throughput in bytes/hour; nil when unmeasured
	EstimatedCostPerHour       *float64 // Estimated cost reduction (total); nil when unmeasured
	EstimatedCostPerHourBytes  *float64 // Estimated cost reduction from bytes; nil when unmeasured
	EstimatedCostPerHourVolume *float64 // Estimated cost reduction from volume; nil when unmeasured
	EstimatedBytesPerHour      *float64 // Estimated bytes reduction; nil when unmeasured
	EstimatedVolumePerHour     *float64 // Estimated volume reduction; nil when unmeasured
}

type WorkosOrganizationID string

type Workspace struct {
	ID   WorkspaceID `json:"id"`
	Name string      `json:"name"`
}

type WorkspaceID string

type WrongLevelAnalysis struct {
	CurrentLevel   string `json:"current_level"`   // Normalized level the event currently uses (debug, info, warn, error)
	SuggestedLevel string `json:"suggested_level"` // Normalized level the event should use
	// contains filtered or unexported fields
}