gate

type ApprovalTokenError struct {
	Code string
	Err  error
}

type ApprovalValidationOptions struct {
	Now                             time.Time
	ExpectedIntentDigest            string
	ExpectedPolicyDigest            string
	ExpectedDelegationBindingDigest string
	RequiredScope                   []string
	TargetCount                     int
	OperationCount                  int
}

type ApprovedScriptMatch struct {
	Matched   bool
	PatternID string
	Reason    string
}

type BuildApprovalAuditOptions struct {
	CreatedAt         time.Time
	ProducerVersion   string
	TraceID           string
	ToolName          string
	IntentDigest      string
	PolicyDigest      string
	RequiredApprovals int
	Entries           []schemagate.ApprovalAuditEntry
}

type BuildBrokerCredentialRecordOptions struct {
	CreatedAt            time.Time
	ProducerVersion      string
	TraceID              string
	ToolName             string
	Identity             string
	Broker               string
	Reference            string
	CredentialSource     string
	CredentialAccessType string
	CredentialIssuer     string
	CredentialSubject    string
	CredentialOwner      string
	Scope                []string
	CredentialRef        string
	TargetBinding        string
	RunBinding           string
	JobBinding           string
	RequestDigest        string
	IssuedAt             time.Time
	ExpiresAt            time.Time
	TTLSeconds           int64
}

type BuildDelegationAuditOptions struct {
	CreatedAt          time.Time
	ProducerVersion    string
	TraceID            string
	ToolName           string
	IntentDigest       string
	PolicyDigest       string
	DelegationRequired bool
	DelegationRef      string
	Entries            []schemagate.DelegationAuditEntry
}

type BuildPolicyExplainOptions struct {
	ProducerVersion        string
	CreatedAt              time.Time
	RequiredApprovals      int
	ValidApprovals         int
	ApprovalAuditPath      string
	DelegationAuditPath    string
	CredentialEvidencePath string
	TraceID                string
	TracePath              string
}

type DataflowPolicy struct {
	Enabled               bool     `yaml:"enabled"`
	TaintedSources        []string `yaml:"tainted_sources"`
	DestinationKinds      []string `yaml:"destination_kinds"`
	DestinationValues     []string `yaml:"destination_values"`
	DestinationOperations []string `yaml:"destination_operations"`
	Action                string   `yaml:"action"`
	ReasonCode            string   `yaml:"reason_code"`
	Violation             string   `yaml:"violation"`
}

type DelegationChainValidationOptions struct {
	Now                  time.Time
	RequiredScope        []string
	ExpectedIntentDigest string
	ExpectedPolicyDigest string
}

type DelegationChainValidationResult struct {
	Complete            bool
	RequiredDelegations int
	ValidDelegations    int
	ValidTokenIDs       []string
	Entries             []schemagate.DelegationAuditEntry
}

type DelegationTokenError struct {
	Code string
	Err  error
}

type DelegationValidationOptions struct {
	Now                  time.Time
	ExpectedDelegator    string
	ExpectedDelegate     string
	RequiredScope        []string
	ExpectedIntentDigest string
	ExpectedPolicyDigest string
}

type EmitTraceOptions struct {
	ProducerVersion            string
	CorrelationID              string
	ApprovalTokenRef           string
	DelegationTokenRef         string
	DelegationReasonCodes      []string
	LatencyMS                  float64
	ContextSource              string
	CompositeRiskClass         string
	StepVerdicts               []schemagate.TraceStepVerdict
	PreApproved                bool
	PatternID                  string
	RegistryReason             string
	FreezeWindow               *schemagate.FreezeWindowDecision
	Sandbox                    *schemagate.SandboxDecision
	KillSwitch                 *schemagate.KillSwitchDecision
	BrokerCredentialRef        string
	BrokerCredentialSource     string
	BrokerCredentialAccessType string
	BrokerCredentialIssuer     string
	BrokerRequestDigest        string
	BrokerTargetBinding        string
	BrokerRunBinding           string
	BrokerJobBinding           string
	MCPTrust                   *schemagate.MCPTrustDecision
	SigningPrivateKey          ed25519.PrivateKey
	TracePath                  string
}

type EmitTraceResult struct {
	Trace        schemagate.TraceRecord
	TracePath    string
	PolicyDigest string
	IntentDigest string
}

type EndpointPolicy struct {
	Enabled           bool     `yaml:"enabled"`
	PathAllowlist     []string `yaml:"path_allowlist"`
	PathDenylist      []string `yaml:"path_denylist"`
	DomainAllowlist   []string `yaml:"domain_allowlist"`
	DomainDenylist    []string `yaml:"domain_denylist"`
	EgressClasses     []string `yaml:"egress_classes"`
	Action            string   `yaml:"action"`
	DestructiveAction string   `yaml:"destructive_action"`
	ReasonCode        string   `yaml:"reason_code"`
	Violation         string   `yaml:"violation"`
}

type EvalOptions struct {
	ProducerVersion         string
	WrkrInventory           map[string]WrkrToolMetadata
	WrkrSource              string
	VerifiedContextEnvelope *schemacontext.Envelope
	EvaluationTime          time.Time
	ContextEvidenceNow      time.Time
	KillSwitchState         *schemagate.KillSwitchState
	KillSwitchStateError    error
	RequireKillSwitchState  bool
}

type EvalOutcome struct {
	Result                   schemagate.GateResult
	PreparedIntent           schemagate.IntentRequest
	MatchedRule              string
	MinApprovals             int
	RequireDistinctApprovers bool
	RequireBrokerCredential  bool
	RequireDelegation        bool
	RequiredDelegationScopes []string
	BrokerReference          string
	BrokerScopes             []string
	RateLimit                RateLimitPolicy
	DestructiveBudget        RateLimitPolicy
	DataflowTriggered        bool
	Script                   bool
	StepCount                int
	ScriptHash               string
	CompositeRiskClass       string
	StepVerdicts             []schemagate.TraceStepVerdict
	ContextSource            string
	PreApproved              bool
	PatternID                string
	RegistryReason           string
	FreezeWindow             *schemagate.FreezeWindowDecision
	Sandbox                  *schemagate.SandboxDecision
	KillSwitch               *schemagate.KillSwitchDecision
	MCPTrust                 *schemagate.MCPTrustDecision
}

type FailClosedPolicy struct {
	Enabled                bool     `yaml:"enabled"`
	RiskClasses            []string `yaml:"risk_classes"`
	RequiredFields         []string `yaml:"required_fields"`
	RequiredHighRiskFields []string `yaml:"required_high_risk_fields"`
}

type FreezeWindowPolicy struct {
	Enabled      bool                `yaml:"enabled"`
	Timezone     string              `yaml:"timezone"`
	Effect       string              `yaml:"effect"`
	Reason       string              `yaml:"reason"`
	Environments []string            `yaml:"environments"`
	RiskClasses  []string            `yaml:"risk_classes"`
	Windows      []FreezeWindowRange `yaml:"windows"`
}

type FreezeWindowRange struct {
	Name  string `yaml:"name"`
	Start string `yaml:"start"`
	End   string `yaml:"end"`
}

type IntentBrokerBinding struct {
	ExpectedCredentialRef string
	TargetBinding         string
	RunBinding            string
	JobBinding            string
}

type KillSwitchJournalRecord struct {
	SchemaID        string    `json:"schema_id"`
	SchemaVersion   string    `json:"schema_version"`
	CreatedAt       time.Time `json:"created_at"`
	ProducerVersion string    `json:"producer_version"`
	Source          string    `json:"source"`
	TraceID         string    `json:"trace_id,omitempty"`
	JobID           string    `json:"job_id,omitempty"`
	ToolName        string    `json:"tool_name,omitempty"`
	AgentID         string    `json:"agent_id,omitempty"`
	Identity        string    `json:"identity,omitempty"`
	ReasonCodes     []string  `json:"reason_codes,omitempty"`
	MatchedEntryIDs []string  `json:"matched_entry_ids,omitempty"`
}

type LegacyPolicyContractError struct {
	Fields []LegacyPolicyFieldMigration
}

type LegacyPolicyFieldMigration struct {
	Field             string   `json:"field"`
	ReplacementFields []string `json:"replacement_fields,omitempty"`
	Note              string   `json:"note,omitempty"`
}

type MCPTrustPolicy struct {
	Enabled             bool     `yaml:"enabled"`
	SnapshotPath        string   `yaml:"snapshot"`
	Action              string   `yaml:"action"`
	RequiredRiskClasses []string `yaml:"required_risk_classes"`
	MinScore            float64  `yaml:"min_score"`
	MaxAge              string   `yaml:"max_age"`
	PublisherAllowlist  []string `yaml:"publisher_allowlist"`
	RequireRegistry     bool     `yaml:"require_registry"`
}

type MintApprovalTokenOptions struct {
	ProducerVersion         string
	ApproverIdentity        string
	ReasonCode              string
	IntentDigest            string
	PolicyDigest            string
	DelegationBindingDigest string
	Scope                   []string
	MaxTargets              int
	MaxOps                  int
	TTL                     time.Duration
	Now                     time.Time
	SigningPrivateKey       ed25519.PrivateKey
	TokenPath               string
}

type MintApprovalTokenResult struct {
	Token     schemagate.ApprovalToken
	TokenPath string
}

type MintDelegationTokenOptions struct {
	ProducerVersion   string
	DelegatorIdentity string
	DelegateIdentity  string
	Scope             []string
	ScopeClass        string
	IntentDigest      string
	PolicyDigest      string
	TTL               time.Duration
	Now               time.Time
	SigningPrivateKey ed25519.PrivateKey
	TokenPath         string
}

type MintDelegationTokenResult struct {
	Token     schemagate.DelegationToken
	TokenPath string
}

type MintSayTokenOptions struct {
	ProducerVersion    string
	CommitmentClass    string
	IntentDigest       string
	PolicyDigest       string
	CallID             string
	TurnIndex          int
	CallSeq            int
	Currency           string
	QuoteMinCents      int64
	QuoteMaxCents      int64
	RefundCeilingCents int64
	TTL                time.Duration
	Now                time.Time
	SigningPrivateKey  ed25519.PrivateKey
	TokenPath          string
}

type MintSayTokenResult struct {
	Token     schemavoice.SayToken
	TokenPath string
}

type Policy struct {
	SchemaID       string           `yaml:"schema_id"`
	SchemaVersion  string           `yaml:"schema_version"`
	DefaultVerdict string           `yaml:"default_verdict"`
	DefaultAction  string           `yaml:"default_action"`
	Scripts        ScriptPolicy     `yaml:"scripts"`
	FailClosed     FailClosedPolicy `yaml:"fail_closed"`
	MCPTrust       MCPTrustPolicy   `yaml:"mcp_trust"`
	Rules          []PolicyRule     `yaml:"rules"`
	// contains filtered or unexported fields
}

type PolicyMatch struct {
	ToolName                   string              `yaml:"tool_name"`
	ToolNames                  []string            `yaml:"tool_names"`
	RiskClasses                []string            `yaml:"risk_classes"`
	TargetKinds                []string            `yaml:"target_kinds"`
	TargetValues               []string            `yaml:"target_values"`
	EndpointClass              []string            `yaml:"endpoint_class"`
	EndpointClasses            []string            `yaml:"endpoint_classes"`
	DiscoveryMethods           []string            `yaml:"discovery_method"`
	ToolAnnotations            ToolAnnotationMatch `yaml:"tool_annotations"`
	SkillPublishers            []string            `yaml:"skill_publishers"`
	SkillSources               []string            `yaml:"skill_sources"`
	DataClasses                []string            `yaml:"data_classes"`
	DestinationKinds           []string            `yaml:"destination_kinds"`
	DestinationValues          []string            `yaml:"destination_values"`
	DestinationOps             []string            `yaml:"destination_operations"`
	ProvenanceSources          []string            `yaml:"provenance_sources"`
	Identities                 []string            `yaml:"identities"`
	WorkspacePrefixes          []string            `yaml:"workspace_prefixes"`
	ContextToolNames           []string            `yaml:"context_tool_names"`
	ContextDataClasses         []string            `yaml:"context_data_classes"`
	ContextEndpointClasses     []string            `yaml:"context_endpoint_classes"`
	ContextAutonomyLevels      []string            `yaml:"context_autonomy_levels"`
	RequireDelegation          bool                `yaml:"require_delegation"`
	AllowedDelegatorIdentities []string            `yaml:"allowed_delegator_identities"`
	AllowedDelegateIdentities  []string            `yaml:"allowed_delegate_identities"`
	DelegationScopes           []string            `yaml:"delegation_scopes"`
	MaxDelegationDepth         *int                `yaml:"max_delegation_depth"`
}

type PolicyRule struct {
	Name                           string             `yaml:"name"`
	Priority                       int                `yaml:"priority"`
	Effect                         string             `yaml:"effect"`
	Action                         string             `yaml:"action"`
	Match                          PolicyMatch        `yaml:"match"`
	Endpoint                       EndpointPolicy     `yaml:"endpoint"`
	ReasonCodes                    []string           `yaml:"reason_codes"`
	Violations                     []string           `yaml:"violations"`
	RequireDeclaredAgent           bool               `yaml:"require_declared_agent"`
	AllowedAgentIDs                []string           `yaml:"allowed_agent_ids"`
	DeniedAgentIDs                 []string           `yaml:"denied_agent_ids"`
	RequiredAgentManifestDigest    string             `yaml:"required_agent_manifest_digest"`
	AllowedAgentManifestPublishers []string           `yaml:"allowed_agent_manifest_publishers"`
	AllowedAgentManifestSources    []string           `yaml:"allowed_agent_manifest_sources"`
	RequiredAgentLifecycleStates   []string           `yaml:"required_agent_lifecycle_states"`
	RequireAgentOwner              bool               `yaml:"require_agent_owner"`
	RequireUnexpiredAgent          bool               `yaml:"require_unexpired_agent"`
	BlockStandingCredentials       bool               `yaml:"block_standing_credentials"`
	AllowedCredentialSources       []string           `yaml:"allowed_credential_sources"`
	AllowedCredentialIssuers       []string           `yaml:"allowed_credential_issuers"`
	AllowedCredentialAccessTypes   []string           `yaml:"allowed_credential_access_types"`
	MaxCredentialTTLSeconds        int64              `yaml:"max_credential_ttl_seconds"`
	RequireJITCredential           bool               `yaml:"require_jit_credential"`
	MinApprovals                   int                `yaml:"min_approvals"`
	RequireDistinctApprovers       bool               `yaml:"require_distinct_approvers"`
	RequireContextEvidence         bool               `yaml:"require_context_evidence"`
	RequiredContextEvidenceMode    string             `yaml:"required_context_evidence_mode"`
	MaxContextAgeSeconds           int64              `yaml:"max_context_age_seconds"`
	RequireBrokerCredential        bool               `yaml:"require_broker_credential"`
	BrokerReference                string             `yaml:"broker_reference"`
	BrokerScopes                   []string           `yaml:"broker_scopes"`
	FreezeWindow                   FreezeWindowPolicy `yaml:"freeze_window"`
	Sandbox                        SandboxPolicy      `yaml:"sandbox"`
	RateLimit                      RateLimitPolicy    `yaml:"rate_limit"`
	DestructiveBudget              RateLimitPolicy    `yaml:"destructive_budget"`
	Dataflow                       DataflowPolicy     `yaml:"dataflow"`
}

type RateLimitDecision struct {
	Allowed   bool   `json:"allowed"`
	Limit     int    `json:"limit"`
	Used      int    `json:"used"`
	Remaining int    `json:"remaining"`
	Scope     string `json:"scope"`
	Key       string `json:"key"`
}

type RateLimitPolicy struct {
	Requests int    `yaml:"requests"`
	Window   string `yaml:"window"`
	Scope    string `yaml:"scope"`
}

type SandboxPolicy struct {
	Enabled                     bool     `yaml:"enabled"`
	AllowedNetworkModes         []string `yaml:"allowed_network_modes"`
	AllowedWritablePathPrefixes []string `yaml:"allowed_writable_path_prefixes"`
	RequiredReadOnlyRoots       []string `yaml:"required_read_only_roots"`
	AllowedEnvExposureModes     []string `yaml:"allowed_env_exposure_modes"`
	MaxTimeoutSeconds           int64    `yaml:"max_timeout_seconds"`
	AllowedFilesystemIsolations []string `yaml:"allowed_filesystem_isolations"`
	AllowedUserModes            []string `yaml:"allowed_user_modes"`
}

type SayTokenError struct {
	Code string
	Err  error
}

type SayTokenValidationOptions struct {
	Now                     time.Time
	ExpectedIntentDigest    string
	ExpectedPolicyDigest    string
	ExpectedCallID          string
	ExpectedTurnIndex       int
	ExpectedCallSeq         int
	ExpectedCommitmentClass string
}

type ScriptPolicy struct {
	MaxSteps             int  `yaml:"max_steps"`
	RequireApprovalAbove int  `yaml:"require_approval_above"`
	BlockMixedRisk       bool `yaml:"block_mixed_risk"`
}

type ToolAnnotationMatch struct {
	ReadOnlyHint    *bool `yaml:"readOnlyHint"`
	DestructiveHint *bool `yaml:"destructiveHint"`
	IdempotentHint  *bool `yaml:"idempotentHint"`
	OpenWorldHint   *bool `yaml:"openWorldHint"`
}

type WrkrInventory struct {
	Path    string
	ModTime time.Time
	Tools   map[string]WrkrToolMetadata
}

type WrkrToolMetadata struct {
	ToolName      string
	DataClass     string
	EndpointClass string
	AutonomyLevel string
}