agenticgovernance

type Bucket struct {
	// Capacity is maximum tokens
	Capacity int

	// RefillRate is tokens added per second
	RefillRate float64

	// Current token count
	Current int

	// LastRefill timestamp
	LastRefill time.Time
	// contains filtered or unexported fields
}

type ChainResult struct {
	// OriginalMessage is the input message
	OriginalMessage *Message

	// ModifiedMessage is the potentially altered message
	ModifiedMessage *Message

	// Allowed indicates whether the message should proceed
	Allowed bool

	// FiltersApplied lists filters that were run
	FiltersApplied []string

	// Modifications lists filters that modified the message
	Modifications []string

	// Violations contains any detected violations
	Violations []*Violation
}

type Component struct {
	// contains filtered or unexported fields
}

type Config struct {
	FilterChain          FilterChainConfig     `json:"filter_chain" schema:"type:object,description:Filter chain configuration,category:basic"`
	Violations           ViolationConfig       `json:"violations" schema:"type:object,description:Violation handling configuration,category:basic"`
	Ports                *component.PortConfig `json:"ports,omitempty" schema:"type:ports,description:Port configuration,category:basic"`
	StreamName           string                `json:"stream_name,omitempty" schema:"type:string,description:JetStream stream name,category:advanced,default:AGENT"`
	ConsumerNameSuffix   string                `json:"consumer_name_suffix,omitempty" schema:"type:string,description:Consumer name suffix for uniqueness,category:advanced"`
	EnableToolGovernance bool                  `` /* 159-byte string literal not displayed */
}

type Content struct {
	// Text is the main message text
	Text string `json:"text"`

	// Metadata holds additional message context
	Metadata map[string]any `json:"metadata,omitempty"`
}

type ContentFilter struct {
	// Policies to enforce
	Policies []*ContentPolicy

	// BlockThreshold for immediate blocking (0.0-1.0)
	BlockThreshold float64

	// WarnThreshold for logging warnings (0.0-1.0)
	WarnThreshold float64
}

type ContentFilterConfig struct {
	BlockThreshold float64            `json:"block_threshold" schema:"type:float,description:Block threshold (0.0-1.0),category:basic,default:0.90"`
	WarnThreshold  float64            `json:"warn_threshold" schema:"type:float,description:Warning threshold (0.0-1.0),category:basic,default:0.70"`
	Policies       []ContentPolicyDef `json:"policies,omitempty" schema:"type:array,description:Content policies,category:basic"`
	EnabledDefault []string           `json:"enabled_default,omitempty" schema:"type:array,description:Default policies to enable,category:basic"`
}

type ContentPolicy struct {
	// Name is the policy identifier
	Name string

	// Keywords to match (case-insensitive)
	Keywords []string

	// Patterns for regex-based matching
	Patterns []*regexp.Regexp

	// Action when policy is violated
	Action PolicyAction

	// Severity of violations
	Severity Severity

	// Categories this policy covers
	Categories []string

	// Weight for scoring (default 1.0)
	Weight float64
}

type ContentPolicyDef struct {
	Name       string       `json:"name" schema:"type:string,description:Policy identifier,category:basic"`
	Keywords   []string     `json:"keywords,omitempty" schema:"type:array,description:Keywords to match,category:basic"`
	Patterns   []string     `json:"patterns,omitempty" schema:"type:array,description:Regex patterns,category:basic"`
	Action     PolicyAction `json:"action" schema:"type:string,description:Action on violation,category:basic,default:block"`
	Severity   Severity     `json:"severity" schema:"type:string,description:Violation severity,category:basic,default:high"`
	Categories []string     `json:"categories,omitempty" schema:"type:array,description:Policy categories,category:advanced"`
}

type Filter interface {
	// Name returns the unique filter identifier
	Name() string

	// Process examines a message and returns a filtering decision
	Process(ctx context.Context, msg *Message) (*FilterResult, error)
}

type FilterChain struct {
	// Filters to apply in order
	Filters []Filter

	// Policy determines behavior when a filter blocks
	Policy ViolationPolicy
	// contains filtered or unexported fields
}

type FilterChainBuilder struct {
	// contains filtered or unexported fields
}

type FilterChainConfig struct {
	Policy  ViolationPolicy `` /* 135-byte string literal not displayed */
	Filters []FilterConfig  `json:"filters" schema:"type:array,description:Ordered list of filters to apply,category:basic"`
}

type FilterConfig struct {
	Name    string `` /* 182-byte string literal not displayed */
	Enabled bool   `json:"enabled" schema:"type:bool,description:Whether this filter is enabled,category:basic,default:true"`

	// PII filter config
	PIIConfig *PIIFilterConfig `json:"pii_config,omitempty" schema:"type:object,description:PII filter configuration,category:advanced"`

	// Injection filter config
	InjectionConfig *InjectionFilterConfig `json:"injection_config,omitempty" schema:"type:object,description:Injection filter configuration,category:advanced"`

	// Injection classifier (embedding tier) config — ADR-043 Phase 2.
	// Peer to InjectionConfig; the regex tier and the classifier
	// tier are separate filter slots so the chain orders them and
	// operators disable either independently.
	ClassifierConfig *InjectionClassifierConfig `` /* 138-byte string literal not displayed */

	// Content filter config
	ContentConfig *ContentFilterConfig `json:"content_config,omitempty" schema:"type:object,description:Content filter configuration,category:advanced"`

	// Rate limiter config
	RateLimitConfig *RateLimitFilterConfig `json:"rate_limit_config,omitempty" schema:"type:object,description:Rate limit filter configuration,category:advanced"`

	// Tool call governance config
	ToolCallConfig *ToolCallFilterConfig `` /* 126-byte string literal not displayed */
}

type FilterResult struct {
	// Allowed indicates whether the message should proceed
	Allowed bool

	// Modified contains the potentially altered message (nil if unchanged)
	// Used for redaction filters that modify content
	Modified *Message

	// Violation contains details if a policy was violated
	Violation *Violation

	// Confidence indicates the filter's certainty (0.0-1.0)
	Confidence float64

	// Metadata provides additional context for downstream processing
	Metadata map[string]any
}

type InjectionClassifierConfig struct {
	// Threshold is the cosine-similarity floor for a positive
	// match. Below this score, the verdict is "no match" and the
	// filter falls through. Operators tune this after running
	// `task adr043:measure` against their benign slice.
	Threshold float64 `` /* 131-byte string literal not displayed */

	// ShadowMode emits the verdict (metrics + violation record)
	// but does not block. The recommended posture during the
	// first deployment until the operator has confirmed the
	// false-positive rate is acceptable.
	ShadowMode bool `json:"shadow_mode" schema:"type:bool,description:Emit verdict but never block (calibration mode),category:basic,default:true"`

	// CorpusSources lists the JSONL corpus files to load. Each
	// entry produces one DomainExamples. Phase 2 ships a single
	// vendored seed; Phase 3+ adds detonator-written corpora and
	// vendored public sources. At least one source is required;
	// validation rejects empty lists at boot.
	CorpusSources []InjectionCorpusSource `json:"corpus_sources,omitempty" schema:"type:array,description:Corpus files to load,category:advanced"`
}

type InjectionClassifierFilter struct {
	// contains filtered or unexported fields
}

type InjectionCorpusSource struct {
	Domain  string `json:"domain" schema:"type:string,description:Tag identifying this corpus,category:basic"`
	Version string `json:"version" schema:"type:string,description:Corpus revision,category:basic"`
	Path    string `json:"path" schema:"type:string,description:JSONL file path,category:basic"`
}

type InjectionFilter struct {
	// Patterns contains known injection patterns
	Patterns []*InjectionPattern

	// ConfidenceThreshold determines when to block (0.0-1.0)
	ConfidenceThreshold float64
}

type InjectionFilterConfig struct {
	ConfidenceThreshold float64               `` /* 131-byte string literal not displayed */
	Patterns            []InjectionPatternDef `json:"patterns,omitempty" schema:"type:array,description:Injection patterns to detect,category:advanced"`
	EnabledPatterns     []string              `json:"enabled_patterns,omitempty" schema:"type:array,description:Built-in pattern names to enable,category:basic"`
}

type InjectionMatch struct {
	PatternName string
	Description string
	Severity    Severity
	Confidence  float64
	MatchStart  int
	MatchEnd    int
}

type InjectionPattern struct {
	// Name is a human-readable identifier
	Name string

	// Pattern is the regex to match
	Pattern *regexp.Regexp

	// Description explains the attack technique
	Description string

	// Severity indicates the threat level
	Severity Severity

	// Confidence is the certainty of this pattern (0.0-1.0)
	Confidence float64

	// Examples provides sample attacks for testing
	Examples []string
}

type InjectionPatternDef struct {
	Name        string   `json:"name" schema:"type:string,description:Pattern identifier,category:basic"`
	Pattern     string   `json:"pattern" schema:"type:string,description:Regex pattern,category:basic"`
	Description string   `json:"description" schema:"type:string,description:Pattern description,category:basic"`
	Severity    Severity `json:"severity" schema:"type:string,description:Violation severity,category:basic,default:high"`
	Confidence  float64  `json:"confidence" schema:"type:float,description:Detection confidence,category:advanced,default:0.90"`
}

type Message struct {
	// ID is unique message identifier
	ID string `json:"id"`

	// Type is message type: task, request, or response
	Type MessageType `json:"type"`

	// UserID of the user who initiated the message
	UserID string `json:"user_id"`

	// SessionID of the session
	SessionID string `json:"session_id"`

	// ChannelID where message originated
	ChannelID string `json:"channel_id"`

	// Timestamp when message was created
	Timestamp time.Time `json:"timestamp"`

	// Content holds the message payload
	Content Content `json:"content"`
}

type MessageType string

type PIIDetection struct {
	Type       PIIType
	Value      string
	Start      int
	End        int
	Confidence float64
}

type PIIFilter struct {
	// Patterns maps PII types to their detection patterns
	Patterns map[PIIType]*PIIPattern

	// Strategy determines how detected PII is handled
	Strategy RedactionStrategy

	// MaskChar is the character used for masking
	MaskChar string

	// AllowedPII lists PII types that are permitted through
	AllowedPII map[PIIType]bool

	// ConfidenceThreshold for detection (0.0-1.0)
	ConfidenceThreshold float64
}

type PIIFilterConfig struct {
	Types               []PIIType         `json:"types" schema:"type:array,description:PII types to detect,category:basic"`
	Strategy            RedactionStrategy `json:"strategy" schema:"type:string,description:Redaction strategy (mask hash remove label),category:basic,default:label"`
	MaskChar            string            `json:"mask_char,omitempty" schema:"type:string,description:Masking character for mask strategy,category:advanced,default:*"`
	ConfidenceThreshold float64           `json:"confidence_threshold" schema:"type:float,description:Confidence threshold (0.0-1.0),category:advanced,default:0.85"`
	AllowedTypes        []PIIType         `json:"allowed_types,omitempty" schema:"type:array,description:PII types allowed through without redaction,category:advanced"`
	CustomPatterns      []PIIPatternDef   `json:"custom_patterns,omitempty" schema:"type:array,description:Custom PII patterns,category:advanced"`
}

type PIIPattern struct {
	Type        PIIType
	Regex       *regexp.Regexp
	Validator   func(string) bool // Optional additional validation
	Replacement string
	Confidence  float64
}

type PIIPatternDef struct {
	Type        PIIType `json:"type" schema:"type:string,description:PII type identifier,category:basic"`
	Pattern     string  `json:"pattern" schema:"type:string,description:Regex pattern,category:basic"`
	Replacement string  `json:"replacement" schema:"type:string,description:Replacement text,category:basic"`
	Confidence  float64 `json:"confidence" schema:"type:float,description:Detection confidence,category:advanced,default:0.90"`
}

type PIIType string

type PolicyAction string

type PolicyViolation struct {
	PolicyName string
	Score      float64
	Action     PolicyAction
	Severity   Severity
	Matches    []string
}

type RateLimitAlgo string

type RateLimitDef struct {
	RequestsPerMinute int `json:"requests_per_minute" schema:"type:int,description:Maximum requests per minute,category:basic,default:60"`
	TokensPerHour     int `json:"tokens_per_hour,omitempty" schema:"type:int,description:Maximum tokens per hour,category:basic,default:100000"`
}

type RateLimitFilterConfig struct {
	PerUser    RateLimitDef     `json:"per_user" schema:"type:object,description:Per-user rate limits,category:basic"`
	PerSession RateLimitDef     `json:"per_session,omitempty" schema:"type:object,description:Per-session rate limits,category:basic"`
	Global     RateLimitDef     `json:"global,omitempty" schema:"type:object,description:Global rate limits,category:basic"`
	Algorithm  RateLimitAlgo    `json:"algorithm" schema:"type:string,description:Rate limiting algorithm,category:advanced,default:token_bucket"`
	Storage    RateLimitStorage `json:"storage,omitempty" schema:"type:object,description:Storage configuration,category:advanced"`
}

type RateLimitStorage struct {
	Type   string `json:"type" schema:"type:string,description:Storage type (memory kv),category:advanced,default:memory"`
	Bucket string `json:"bucket,omitempty" schema:"type:string,description:KV bucket name,category:advanced"`
}

type RateLimiter struct {
	// UserLimits maps user IDs to their buckets
	UserLimits sync.Map

	// SessionLimits maps session IDs to their buckets
	SessionLimits sync.Map

	// GlobalBucket for system-wide limits
	GlobalBucket *Bucket

	// Config holds rate limit configuration
	Config *RateLimitFilterConfig

	// Cleanup interval for expired buckets
	CleanupInterval time.Duration
}

type RedactionStrategy string

type RegistryInterface interface {
	RegisterWithConfig(component.RegistrationConfig) error
}

type Severity string

type ToolCallFilter struct {
	// BlockedCommandPatterns are substrings that block bash commands.
	BlockedCommandPatterns []string

	// BlockedURLPatterns are substrings that block http_request URLs.
	BlockedURLPatterns []string
	// contains filtered or unexported fields
}

type ToolCallFilterConfig struct {
	// BlockedCommandPatterns are additional substrings that block bash
	// commands. Matched case-insensitively. Appended to safety defaults.
	BlockedCommandPatterns []string `` /* 149-byte string literal not displayed */

	// BlockedURLPatterns are additional substrings that block
	// http_request URLs. Matched case-insensitively. Appended to safety
	// defaults.
	BlockedURLPatterns []string `` /* 149-byte string literal not displayed */
}

type Violation struct {
	// ID is unique violation identifier
	ID string `json:"violation_id"`

	// FilterName indicates which filter detected violation
	FilterName string `json:"filter_type"`

	// Severity indicates threat/impact level
	Severity Severity `json:"severity"`

	// Confidence in detection (0.0-1.0)
	Confidence float64 `json:"confidence"`

	// Timestamp when violation occurred
	Timestamp time.Time `json:"timestamp"`

	// UserID of the violating user
	UserID string `json:"user_id"`

	// SessionID of the session
	SessionID string `json:"session_id"`

	// ChannelID where violation occurred
	ChannelID string `json:"channel_id"`

	// OriginalContent is the content that violated policy (redacted for audit)
	OriginalContent string `json:"original_content,omitempty"`

	// Details contains filter-specific violation information
	Details map[string]any `json:"details,omitempty"`

	// Action taken in response
	Action ViolationAction `json:"action_taken"`

	// Metadata for context
	Metadata map[string]any `json:"metadata,omitempty"`
}

type ViolationAction string

type ViolationConfig struct {
	Store               string     `json:"store" schema:"type:string,description:KV bucket for violations,category:basic,default:GOVERNANCE_VIOLATIONS"`
	RetentionDays       int        `json:"retention_days" schema:"type:int,description:Violation retention in days,category:basic,default:90"`
	NotifyUser          bool       `json:"notify_user" schema:"type:bool,description:Send error messages to users,category:basic,default:true"`
	NotifyAdminSeverity []Severity `` /* 127-byte string literal not displayed */
	AdminSubject        string     `` /* 142-byte string literal not displayed */
}

type ViolationHandler struct {
	// contains filtered or unexported fields
}

type ViolationPolicy string