model

type Agent struct {
	ID      string // the LIST id ("agent-…") - used for op:agent / op:logs / kill
	Address string // the /128 - the identity, and the SSE ?agent= narrow selector
	Label   string
	FQDN    string
	PTR     string
	State   string // active / pending / released / …
	Contact string // opt-in public contact (may be empty - never fabricate)
	Created int64  // epoch ms (allocated_at)

	// Counters from op:agent (zero until detail is fetched; fail-open to zero, never 500).
	LastSeen          int64
	DNSQueries        int64
	DNSBlocked        int64
	DNSNxdomain       int64
	Packets           int64
	BytesUp           int64
	BytesDown         int64
	ConnectionsActive int64
	ConnectionsTotal  int64

	// Detailed reports whether op:agent has populated the counters (vs. a list-only row).
	Detailed bool
	// SeenInStream marks an agent discovered via the live stream / logs but possibly
	// absent from op:list (the caveat: op:list may miss connect-created agents).
	SeenInStream bool
}

type Event struct {
	TsMicros int64  // epoch microseconds (native stream unit; ms sources are scaled up)
	Kind     string // dns | conn | alloc | hb
	Node     string // emitting ns box (e.g. "ns1")
	Agent    string // the agent id
	Addr128  string // the /128 (the join key for the dns→conn chain)

	// dns
	QName    string
	QType    string
	RCode    string
	Decision string // lowercase: allow/block/sinkhole/rewrite/refused
	Source   string // cache/graph/upstream/tenant-block/authoritative
	Answer   string // null today - render "-"
	LatUS    int64  // dns latency, microseconds

	// conn (egress)
	Proto     string
	PeerHost  string
	PeerPort  int
	BytesUp   int64
	BytesDown int64
	PktUp     int64 // relay read/write EVENT counts (chattiness), not wire packets
	PktDown   int64
	DurUS     int64 // conn duration, microseconds
	Reason    string
	ClientSrc string // masked original-client source prefix

	// alloc
	Action string // allocate | release
	// contains filtered or unexported fields
}