pac

type Artifact struct {
	// JS is the generated FindProxyForURL script.
	JS string
	// Digest is the SHA-256 hex of JS — the HTTP ETag source. It covers the
	// ACTUAL bytes served, including a request-Host-derived proxy host when
	// the fallback is active.
	Digest string
	// Fingerprint is the SHA-256 hex of the canonical normalized config,
	// independent of the request-derived fallback host.
	Fingerprint string
	// CompilerVersion is the generator contract version.
	CompilerVersion string
	// GeneratedAt is when this artifact was built (metadata only; never
	// hashed, so it cannot break determinism).
	GeneratedAt time.Time
	// Warnings carries normalization warnings (dropped legacy junk, dedupes,
	// host-fallback advisory).
	Warnings []ValidationIssue
	// ProxyChain is the effective directive chain, e.g. ["PROXY p:8080"] or
	// ["DIRECT"] in the degenerate no-host case.
	ProxyChain []string
	// HostFallback is true when the proxy hostname was derived from the
	// request's Host header rather than configuration. Fallback-mode
	// responses vary per request host and must not be shared-cached.
	HostFallback bool
}

type ArtifactCache struct {
	// contains filtered or unexported fields
}

type Config struct {
	// ProxyHost is the hostname or IP of this proxy, e.g. "proxy.corp.com".
	// If empty the /proxy.pac endpoint uses the hostname from the request's
	// Host header (stripping the port, which belongs to the UI — not the proxy).
	ProxyHost string `json:"proxyHost"`
	// ProxyPort is the port the proxy server listens on.
	// If zero it falls back to the runtime proxy port set at startup.
	ProxyPort int `json:"proxyPort"`
	// Exclusions is the list of host patterns that should bypass the proxy.
	// Supports bare domains ("corp.local"), wildcard prefixes ("*.corp.local"),
	// and IP CIDR ranges ("192.168.0.0/16").
	Exclusions []string `json:"exclusions"`
}

type DestinationImpact struct {
	Host         string         `json:"host"`
	Category     ImpactCategory `json:"category"`
	OldDirective string         `json:"oldDirective"`
	NewDirective string         `json:"newDirective"`
}

type ExclusionKind int

type ImpactCategory = string

type ImpactReport struct {
	// Source names where the sample came from ("observed" | "test_vectors").
	Source string `json:"source"`
	// Sampled is how many destinations were evaluated.
	Sampled int `json:"sampled"`
	// Counts is the per-category tally.
	Counts map[string]int `json:"counts"`
	// Movements lists the destinations that changed (unchanged omitted).
	Movements []DestinationImpact `json:"movements"`
	// UnreachableRules/ShadowedRules/DuplicateRules are static analysis of
	// the candidate's rule list, independent of the sample.
	UnreachableRules []string `json:"unreachableRules,omitempty"`
	ShadowedRules    []string `json:"shadowedRules,omitempty"`
	DuplicateRules   []string `json:"duplicateRules,omitempty"`
	// Notes carries caveats (e.g. CIDR outcomes undetermined without IPs).
	Notes []string `json:"notes,omitempty"`
}

type LifecycleState struct {
	ByID    map[string]*ProfileLifecycle
	Path    string
	ModTime time.Time
}

type LifecycleStore struct {
	// contains filtered or unexported fields
}

type Normalized struct {
	// ProxyHost is the validated proxy hostname/IP, or "" when the request
	// Host header fallback is in effect.
	ProxyHost string
	// ProxyPort is the configured port (0 = auto: startup default, then 8080).
	ProxyPort int
	// Exclusions preserves configured order with duplicates removed.
	Exclusions []NormalizedExclusion
	// Warnings collects non-fatal normalization notes (dropped entries in
	// lenient mode, dedupes, host-fallback advisory).
	Warnings []ValidationIssue
}

type NormalizedExclusion struct {
	Kind ExclusionKind
	// Host is the lowercased, IDNA-punycoded, trailing-dot-stripped hostname
	// (KindDomain/KindWildcard, without the "*." prefix) or the IP literal
	// text (KindHostLiteral).
	Host string
	// CIDRIP/CIDRMask/CIDRPrefix carry the parsed IPv4 network (KindCIDR).
	// CIDRIP is the masked network base address.
	CIDRIP     string
	CIDRMask   string
	CIDRPrefix int
	// Raw is the entry as configured (trimmed), for error reporting.
	Raw string
}

type Pool struct {
	ID        string         `json:"id"`
	Name      string         `json:"name"`
	Endpoints []PoolEndpoint `json:"endpoints"`
}

type PoolEndpoint struct {
	Host string `json:"host"`
	Port int    `json:"port"`
}

type Profile struct {
	ID          string `json:"id"`
	Name        string `json:"name"`
	Description string `json:"description,omitempty"`
	Enabled     bool   `json:"enabled"`
	// PoolID names the profile's default pool (required).
	PoolID string `json:"poolId"`
	// Rules are evaluated in order before the terminal chain.
	Rules []Rule `json:"rules,omitempty"`
	// PrivateNetworks is PrivateDirect or PrivateProxy.
	PrivateNetworks string `json:"privateNetworks"`
	// AvailabilityMode is ModeSecure, ModeBalanced, or ModeAvailability.
	AvailabilityMode string `json:"availabilityMode"`
	// Revision increments on every mutation of this profile.
	Revision int64 `json:"revision"`
}

type ProfileDiff struct {
	RulesAdded         []string `json:"rulesAdded,omitempty"`
	RulesRemoved       []string `json:"rulesRemoved,omitempty"`
	RulesReordered     bool     `json:"rulesReordered"`
	PoolChanged        bool     `json:"poolChanged"`
	OldPool            string   `json:"oldPool,omitempty"`
	NewPool            string   `json:"newPool,omitempty"`
	AvailabilityChange string   `json:"availabilityChange,omitempty"` // "old→new"
	PrivateNetChange   string   `json:"privateNetChange,omitempty"`
	NewDirectPaths     []string `json:"newDirectPaths,omitempty"`
	RemovedDirectPaths []string `json:"removedDirectPaths,omitempty"`
	// SecuritySensitive is true when the change widens DIRECT exposure,
	// weakens availability toward fail-open, or flips private-network to
	// direct — the changes a reviewer must look at first.
	SecuritySensitive bool `json:"securitySensitive"`
}

type ProfileLifecycle struct {
	// ProfileID ties the lifecycle to its profile.
	ProfileID string `json:"profileId"`
	// Draft is the mutable working copy (edited by PUT). It becomes a
	// published revision on Publish.
	Draft Profile `json:"draft"`
	// DraftDirty reports whether the draft diverges from the active revision.
	DraftDirty bool `json:"draftDirty"`
	// ActiveN is the currently-serving published revision number (0 = none
	// published yet).
	ActiveN int64 `json:"activeN"`
	// Revisions is the append-only immutable history, oldest first.
	Revisions []PublishedRevision `json:"revisions"`
}

type ProfileState struct {
	Cfg     ProfilesConfig
	Path    string
	ModTime time.Time
}

type ProfileStore struct {
	// contains filtered or unexported fields
}

type ProfilesConfig struct {
	Profiles []Profile `json:"profiles"`
	Pools    []Pool    `json:"pools"`
}

type PublishCheck struct {
	OK                   bool              `json:"ok"`
	RequiresConfirmation bool              `json:"requiresConfirmation"`
	Issues               []ValidationIssue `json:"issues,omitempty"`
	// Digest is the compiled artifact digest of the candidate (empty when
	// compilation/validation failed).
	Digest string `json:"digest,omitempty"`
	// NewDirectPaths lists rule descriptions whose publish would newly make
	// DIRECT reachable that the active revision did not (drives the typed
	// confirmation).
	NewDirectPaths []string `json:"newDirectPaths,omitempty"`
}

type PublishGuardCode = string

type PublishedRevision struct {
	// N is the monotonic revision number (1-based, never reused).
	N int64 `json:"n"`
	// Spec is the exact profile content published at revision N (immutable).
	Spec Profile `json:"spec"`
	// Digest is the SHA-256 of the compiled artifact at publish time — the
	// convergence oracle and the "restore exact prior artifact" anchor.
	Digest string `json:"digest"`
	// Author is the admin identity that published this revision.
	Author string `json:"author"`
	// Reason is the operator-supplied change reason.
	Reason string `json:"reason,omitempty"`
	// TS is the publish timestamp (RFC3339); set by the caller (the engine
	// takes no wall clock).
	TS string `json:"ts"`
}

type Rule struct {
	// Kind is one of RuleKind*.
	Kind string `json:"kind"`
	// Pattern is the kind-specific match target (domain, suffix, glob, CIDR).
	Pattern string `json:"pattern"`
	// Scheme optionally restricts the rule to "http" or "https" URLs.
	Scheme string `json:"scheme,omitempty"`
	// Port optionally restricts the rule to an explicit destination port as
	// it appears in the URL (default ports are omitted by clients and cannot
	// be matched — documented limitation).
	Port int `json:"port,omitempty"`
	// Action is ActionUsePool or ActionDirect.
	Action string `json:"action"`
	// PoolID optionally overrides the profile's pool for ActionUsePool.
	PoolID string `json:"poolId,omitempty"`
}

type SimInput struct {
	// URL is the full request URL (scheme + authority; path is advisory —
	// clients strip it for https). Optional if Host is set.
	URL string `json:"url"`
	// Host is the destination hostname or IP literal. Derived from URL when
	// empty.
	Host string `json:"host"`
	// Scheme overrides the scheme parsed from URL (http/https).
	Scheme string `json:"scheme"`
	// Port is the destination port as it would appear in the URL authority
	// (0 = none/default; default ports are unmatchable, as for real clients).
	Port int `json:"port"`
	// ResolvedIP optionally supplies the host's resolved IPv4 address so
	// cidr4 / private-network rules can be evaluated deterministically. When
	// empty, those rules yield OutcomeUndeterminedDNS.
	ResolvedIP string `json:"resolvedIp"`
}

type SimMatchedRule struct {
	// Index is the 0-based rule index, or -1 for a non-rule decision.
	Index int `json:"index"`
	// Kind is the rule kind, or a synthetic label: "plain-host",
	// "private-network", "terminal".
	Kind string `json:"kind"`
	// Pattern is the rule pattern (empty for synthetic decisions).
	Pattern string `json:"pattern,omitempty"`
	// Action is the rule action or the synthetic decision's effect.
	Action string `json:"action"`
}

type SimResult struct {
	// Directive is the PAC return string (e.g. "PROXY a:8080; DIRECT").
	Directive string `json:"directive"`
	// Outcome is OutcomeMatched or OutcomeUndeterminedDNS.
	Outcome string `json:"outcome"`
	// MatchedRule describes the deciding rule/branch.
	MatchedRule SimMatchedRule `json:"matchedRule"`
	// Reason is a human-readable explanation of the decision.
	Reason string `json:"reason"`
	// PoolID is the pool whose chain was selected (empty for DIRECT).
	PoolID string `json:"poolId,omitempty"`
	// Chain is the ordered failover directive list.
	Chain []string `json:"chain"`
	// DirectPossible reports whether this decision can yield DIRECT (either
	// the directive is/contains DIRECT, or availability mode appends it).
	DirectPossible bool `json:"directPossible"`
	// Warnings carries evaluation notes (e.g. undetermined DNS).
	Warnings []string `json:"warnings,omitempty"`
	// CompilerVersion and Revision pin the semantics used.
	CompilerVersion string `json:"compilerVersion"`
	Revision        int64  `json:"revision"`
}

type State struct {
	Cfg         Config
	Path        string
	DefaultPort int
	ModTime     time.Time
}

type Store struct {
	// contains filtered or unexported fields
}

type ValidationIssue struct {
	// Field names the config field: "proxyHost", "proxyPort", "exclusions".
	Field string `json:"field"`
	// Entry is the offending exclusion entry, when applicable.
	Entry string `json:"entry,omitempty"`
	// Code is a stable machine-readable issue code (Issue* constants).
	Code string `json:"code"`
	// Message is the human-readable explanation.
	Message string `json:"message"`
}