exchange

const (
	// Prefix is the top-level runtime key prefix for standard exchange values.
	Prefix = "plugin.exchange."

	// KeyDecisionSources stores stable analytics source names selected by policy-aware components.
	KeyDecisionSources = Prefix + "decision_sources"

	// KeyFeaturePrefix is the prefix for standard feature-marker runtime keys.
	KeyFeaturePrefix = Prefix + "feature."

	// KeyGeoIP stores GeoIP and ASN enrichment fields.
	KeyGeoIP = Prefix + "geoip"

	// KeyGeoIPReputation stores reputation scores and decision hints.
	KeyGeoIPReputation = Prefix + "geoip_reputation"

	// KeyFailedLoginHotspot stores failed-login hotspot counters.
	KeyFailedLoginHotspot = Prefix + "failed_login_hotspot"

	// KeyAccountProtection stores account-protection state.
	KeyAccountProtection = Prefix + "account_protection"

	// KeyGlobalPattern stores global pattern counters.
	KeyGlobalPattern = Prefix + "global_pattern"

	// KeyDynamicResponse stores dynamic response diagnostics.
	KeyDynamicResponse = Prefix + "dynamic_response"

	// KeyHaveIBeenPwned stores safe Have I Been Pwned result fields.
	KeyHaveIBeenPwned = Prefix + "haveibeenpwnd"
)

const (
	// FeatureBlocklist identifies external blocklist policy decisions.
	FeatureBlocklist = "blocklist"

	// FeatureRBL identifies built-in RBL policy decisions.
	FeatureRBL = "rbl"

	// FeatureBruteForce identifies built-in brute-force policy decisions.
	FeatureBruteForce = "brute_force"

	// FeatureGeoIPPolicy identifies delegated GeoIP policy decisions.
	FeatureGeoIPPolicy = "geoip_policyd"

	// FeatureFailedLoginHotspot identifies failed-login hotspot decisions.
	FeatureFailedLoginHotspot = "failed_login_hotspot"

	// FeatureAccountProtection identifies account-protection policy decisions.
	FeatureAccountProtection = "account_protection"

	// FeatureGeoIPReputation identifies reputation-based GeoIP decisions.
	FeatureGeoIPReputation = "geoip_reputation"

	// FeatureGlobalPattern identifies global-pattern policy decisions.
	FeatureGlobalPattern = "global_pattern"

	// FeatureDynamicResponse identifies dynamic response decisions.
	FeatureDynamicResponse = "dynamic_response"

	// FeatureHaveIBeenPwned identifies Have I Been Pwned decisions.
	FeatureHaveIBeenPwned = "haveibeenpwnd"
)

const (
	// FieldTriggered marks a feature marker as contributing to the selected decision.
	FieldTriggered = "triggered"

	// FieldDecision stores a bounded decision hint such as "suspicious".
	FieldDecision = "decision"

	// FieldSource stores a low-cardinality producer or data-source name.
	FieldSource = "source"

	// FieldReason stores an optional bounded reason string.
	FieldReason = "reason"

	// FieldHashInfo stores the HIBP short prefix/count value used by analytics.
	FieldHashInfo = "hash_info"

	// FieldLeaked stores whether HIBP reported a leaked password hash.
	FieldLeaked = "leaked"

	// FieldCount stores a non-negative HIBP leak count.
	FieldCount = "count"
)

const (
	// FieldPrivacyLookupState stores the privacy lookup availability state.
	FieldPrivacyLookupState = "privacy_lookup_state"
	// FieldPrivacyDetected stores the aggregate privacy detection result.
	FieldPrivacyDetected = "privacy_detected"
	// FieldPrivacyClasses stores stable matched privacy classes.
	FieldPrivacyClasses = "privacy_classes"
	// FieldPrivacyPrimaryClass stores the selected primary privacy class.
	FieldPrivacyPrimaryClass = "privacy_primary_class"
	// FieldPrivacyConfidence stores evidence confidence, not authentication risk.
	FieldPrivacyConfidence = "privacy_confidence"
	// FieldPrivacySourceAuthorities stores stable evidence authority classes.
	FieldPrivacySourceAuthorities = "privacy_source_authorities"
	// FieldPrivacyDataStale stores whether the evaluated evidence is stale.
	FieldPrivacyDataStale = "privacy_data_stale"
	// FieldPrivacyDataAgeSeconds stores the non-negative evidence age.
	FieldPrivacyDataAgeSeconds = "privacy_data_age_seconds"
	// FieldIsTorExitNode stores official Tor exit evidence.
	FieldIsTorExitNode = "is_tor_exit_node"
	// FieldIsKnownVPNExit stores known VPN exit evidence.
	FieldIsKnownVPNExit = "is_known_vpn_exit"
	// FieldIsCommunityVPNExit stores community VPN exit evidence.
	FieldIsCommunityVPNExit = "is_community_vpn_exit"
	// FieldIsPublicProxy stores public proxy evidence.
	FieldIsPublicProxy = "is_public_proxy"
	// FieldIsPrivacyRelay stores privacy relay evidence.
	FieldIsPrivacyRelay = "is_privacy_relay"
	// FieldIsHostingNetwork stores hosting or cloud network evidence.
	FieldIsHostingNetwork = "is_hosting_network"
	// FieldIsSharedEgress stores operator-approved shared public egress evidence.
	FieldIsSharedEgress = "is_shared_egress"
)