Events and alerts

export const zEvent = z.object({
  id: z.string().min(1),
  runId: z.string().min(1),
  /** Threaded from the first byte. Without it an event cannot be joined to its run. */
  correlationId: z.string().min(1),
  type: zEventType,
  agentId: z.string().optional(),
  severity: z.enum(['debug', 'info', 'warn', 'error']),
  ts: zISO,
  payload: z.record(z.string(), z.unknown()).default({}),
}).strict();

export const zEventType = z.enum([
  'phase_start',
  'phase_end',
  'agent_spawn',
  'agent_reap',
  'tool_call',
  'tool_result',
  'finding',
  'heartbeat',
  'approval_request',
  'approval_decision',
  /** Replaced budget_warn/budget_exceeded when cost stopped being terminal. */
  'threshold_breach',
  /** A discovered host; outside the authorized apex it needs HITL confirm. */
  'scope_expansion',
  /** Declared coverage not achieved — a first-class run output. */
  'coverage_gap',
  'error',
  'log',

  // ── emitted by the harness SDK; added in contract 1.4.0 ──────────────────
  /** A tool call that FAILED. Distinct from tool_result: it cost a round trip and returned nothing. */
  'tool_error',
  /** A slot switched to its fallback. Raised ONCE per slot per run. Also an alert key. */
  'mcp.fallback_used',
  /** A slot has nothing healthy behind it — a lost capability, not a slow one. */
  'mcp.no_healthy_tool',
  'model_call',
  'model_error',
  /** A model whose price is unknown, so its spend records as $0. Emitted once. */
  'model_price_unknown',
]);

export const zHeartbeat = z.object({
  runId: z.string().min(1),
  agentId: z.string().min(1),
  ts: zISO,
  phase: z.string().min(1),
  spend: zSpend,
  /** Monotonic per run. The engine persists the last acked seq, so a re-dialed
   *  stream replays from that cursor and delivery is idempotent by (runId, seq). */
  seq: z.number().int().nonnegative(),
}).strict();

export const zAlertUrgency = z.enum(['info', 'digest', 'warn', 'urgent', 'critical']);
/** Analyst and ops are different people with different urgencies. */
export const zAlertAudience = z.enum(['analyst', 'ops', 'both']);

export const zAlert = z.object({
  key: zAlertKey,
  urgency: zAlertUrgency,
  audience: zAlertAudience,
  raisedAt: zISO,
  /** What the alert is about: runId, tenantId, scheduleId, mcpId… */
  subject: z.record(z.string(), z.string()).default({}),
  message: z.string().min(1),
  acknowledgedAt: zISO.optional(),
  acknowledgedBy: z.string().optional(),
}).strict();

export const zThresholdBreach = z.object({
  metric: z.enum(['cost_usd', 'tokens', 'tool_calls', 'evidence_bytes']),
  threshold: z.number(),
  actual: z.number(),
  alertedAt: zISO,
});