policy

type APIKeyAuth struct {
	Header     string `yaml:"header"`     // HTTP header name (e.g. X-API-Key)
	Credential string `yaml:"credential"` // Keychain secret name
}

type AgentConfig struct {
	Name        string `yaml:"name"`
	Description string `yaml:"description"`
}

type CanonicalAgentConfig struct {
	Name        string `json:"name"`
	Description string `json:"description,omitempty"`
}

type CanonicalCredential struct {
	ID      string `json:"id"`
	Type    string `json:"type,omitempty"`
	Header  string `json:"header,omitempty"`
	Service string `json:"service,omitempty"`
	Path    string `json:"path,omitempty"`
}

type CanonicalEgressRule struct {
	Domain        string `json:"domain,omitempty"`
	CIDR          string `json:"cidr,omitempty"`
	Ports         []int  `json:"ports"`
	AllowWildcard *bool  `json:"allow_wildcard,omitempty"`
	AllowPrivate  *bool  `json:"allow_private,omitempty"`
}

type CanonicalHook struct {
	Name string `json:"name"`
	URL  string `json:"url"`
}

type CanonicalIngressRule struct {
	Path string `json:"path"`
	Port int    `json:"port"`
}

type CanonicalMCPServer struct {
	Name         string            `json:"name"`
	URL          string            `json:"url,omitempty"`
	Headers      map[string]string `json:"headers,omitempty"`
	Transport    string            `json:"transport,omitempty"`
	AllowedTools []string          `json:"allowed_tools,omitempty"`
	AuthMode     string            `json:"auth_mode,omitempty"`
}

type CanonicalPolicy struct {
	Version     string                 `json:"version"`
	Agent       CanonicalAgentConfig   `json:"agent"`
	Egress      []CanonicalEgressRule  `json:"egress,omitempty"`
	Credentials []CanonicalCredential  `json:"credentials,omitempty"`
	MCPServers  []CanonicalMCPServer   `json:"mcp_servers,omitempty"`
	Hooks       []CanonicalHook        `json:"hooks,omitempty"`
	Ingress     []CanonicalIngressRule `json:"ingress,omitempty"`
}

type Credential struct {
	ID      string `yaml:"id"`
	Type    string `yaml:"type"`
	Header  string `yaml:"header"`
	Value   string `yaml:"value"`
	Service string `yaml:"service"`
	Path    string `yaml:"path"`
	// Mode is required for direct-lease credentials: "file" or "env".
	Mode string `yaml:"mode"`
	// Reason is required for direct-lease credentials.
	Reason string `yaml:"reason"`
	// OAuth fields (type: oauth).
	TokenEndpoint          string `yaml:"token_endpoint,omitempty"`
	ClientID               string `yaml:"client_id,omitempty"`
	RefreshTokenCredential string `yaml:"refresh_token_credential,omitempty"`
}

type CredentialRule struct {
	ID     string               `yaml:"id"`
	Header string               `yaml:"header,omitempty"`
	Value  string               `yaml:"value,omitempty"`
	OAuth  *OAuthCredentialRule `yaml:"oauth,omitempty"`
}

type EgressRule struct {
	Domain        string       `yaml:"domain"`
	CIDR          string       `yaml:"cidr"`
	Ports         []int        `yaml:"ports"`
	Methods       []string     `yaml:"methods"`
	AllowWildcard *bool        `yaml:"allow_wildcard"`
	AllowPrivate  *bool        `yaml:"allow_private"`
	Credential    string       `yaml:"credential"`
	MCPServerID   string       `yaml:"mcp_server_id"` // if set, this rule applies to MCP server egress
	Timeout       string       `yaml:"timeout,omitempty"`
	Retry         *RetryConfig `yaml:"retry,omitempty"`
}

type Guardrail struct {
	Type       string `yaml:"type"`
	Pattern    string `yaml:"pattern,omitempty"`
	Action     string `yaml:"action,omitempty"`
	Provider   string `yaml:"provider,omitempty"`
	Credential string `yaml:"credential,omitempty"`
	URL        string `yaml:"url,omitempty"`
}

type Hook struct {
	Name   string `yaml:"name"`
	URL    string `yaml:"url"`
	Secret string `yaml:"secret"`
}

type IngressAuth struct {
	Type   string      `yaml:"type"`              // "jwt" or "api_key"
	JWT    *JWTAuth    `yaml:"jwt,omitempty"`     // JWT auth config
	APIKey *APIKeyAuth `yaml:"api_key,omitempty"` // API key auth config
}

type IngressRule struct {
	Path string `yaml:"path"`
	Port int    `yaml:"port"`
}

type JWTAuth struct {
	Issuer   string `yaml:"issuer"`
	Audience string `yaml:"audience"`
	JWKSURL  string `yaml:"jwks_url"`
}

type LLMBudget struct {
	MaxTokens           int `yaml:"max_tokens"`             // total tokens per invoke
	MaxTokensPerRequest int `yaml:"max_tokens_per_request"` // per-LLM-call limit
}

type LLMProviderLock struct {
	AllowedEndpoints []string `yaml:"allowed_endpoints"`
}

type LLMRateLimit struct {
	RequestsPerMinute int `yaml:"requests_per_minute"`
	TokensPerMinute   int `yaml:"tokens_per_minute"`
}

type MCPServer struct {
	Name          string            `yaml:"name"`
	URL           string            `yaml:"url"`
	Headers       map[string]string `yaml:"headers"`
	Transport     string            `yaml:"transport"`
	Command       string            `yaml:"command"`
	Args          []string          `yaml:"args"`
	Endpoint      string            `yaml:"endpoint"`
	AllowedTools  []string          `yaml:"allowed_tools"`
	DeniedTools   []string          `yaml:"denied_tools,omitempty"`
	Env           map[string]string `yaml:"env"`
	AuthMode      string            `yaml:"auth_mode"`
	EgressBinding string            `yaml:"egress_binding"`
}

type OAuthCredentialRule struct {
	TokenEndpoint          string `yaml:"tokenEndpoint"`
	ClientID               string `yaml:"clientId"`
	RefreshTokenCredential string `yaml:"refreshTokenCredential"`
}

type Observability struct {
	CostTracking bool   `yaml:"cost_tracking"`
	OTelEndpoint string `yaml:"otel_endpoint,omitempty"`
}

type Policy struct {
	Version         string           `yaml:"version"`
	Agent           AgentConfig      `yaml:"agent"`
	Egress          []EgressRule     `yaml:"egress"`
	Credentials     []Credential     `yaml:"credentials"`
	MCPServers      []MCPServer      `yaml:"mcp_servers"`
	Hooks           []Hook           `yaml:"hooks"`
	Ingress         []IngressRule    `yaml:"ingress"`
	LLMBudget       *LLMBudget       `yaml:"llm_budget,omitempty"`
	LLMRateLimit    *LLMRateLimit    `yaml:"llm_rate_limit,omitempty"`
	LLMProviderLock *LLMProviderLock `yaml:"llm_provider_lock,omitempty"`
	IngressAuth     *IngressAuth     `yaml:"ingress_auth,omitempty"`
	Guardrails      []Guardrail      `yaml:"guardrails,omitempty"`
	Transformations *Transformation  `yaml:"transformations,omitempty"`
	Observability   *Observability   `yaml:"observability,omitempty"`
}

type PolicyDelta struct {
	EgressAdded        []string `json:"egress_added,omitempty"`
	EgressRemoved      []string `json:"egress_removed,omitempty"`
	CredentialsAdded   []string `json:"credentials_added,omitempty"`
	CredentialsRemoved []string `json:"credentials_removed,omitempty"`
	MCPToolsAdded      []string `json:"mcp_tools_added,omitempty"`
	MCPToolsRemoved    []string `json:"mcp_tools_removed,omitempty"`
	IngressAdded       []string `json:"ingress_added,omitempty"`
	IngressRemoved     []string `json:"ingress_removed,omitempty"`
	HooksAdded         []string `json:"hooks_added,omitempty"`
	HooksRemoved       []string `json:"hooks_removed,omitempty"`
}

type RequestTransform struct {
	InjectHeaders      map[string]string `yaml:"inject_headers,omitempty"`
	InjectSystemPrompt string            `yaml:"inject_system_prompt,omitempty"`
}

type ResponseTransform struct {
	RemoveHeaders []string `yaml:"remove_headers,omitempty"`
}

type RetryConfig struct {
	MaxAttempts int    `yaml:"max_attempts"`
	Backoff     string `yaml:"backoff"`     // "exponential", "linear", or "fixed"
	MaxBackoff  string `yaml:"max_backoff"` // max backoff duration
}

type Transformation struct {
	Request  *RequestTransform  `yaml:"request,omitempty"`
	Response *ResponseTransform `yaml:"response,omitempty"`
}

type ValidationError struct {
	Field    string `json:"field"`
	Message  string `json:"message"`
	Severity string `json:"severity"` // "error" or "warning"
}