gateway

type Breaker struct {
	Threshold int           // consecutive failures that open the circuit (default 5)
	Cooldown  time.Duration // open time before a half-open probe (default 30s)
	// contains filtered or unexported fields
}

type BudgetCheck struct {
	budget.Principal
}

type BudgetClient struct {
	URL, Token        string // URL: .../api/v1/gateway/budget
	TTL, Grace, Flush time.Duration
	Client            *http.Client
	Now               func() time.Time
	Log               *slog.Logger
	// contains filtered or unexported fields
}

type BudgetUsage struct {
	Batch   string          `json:"batch"`
	Records []budget.Record `json:"records"`
}

type BudgetVerdict struct {
	Budgets []budget.Status `json:"budgets"`
}

type Decision struct {
	Ring          string
	Release       string
	Experiment    string
	Variant       string
	UpstreamName  string
	Upstream      string // URL; "" = leave Kong's default service
	UpstreamModel string // "" = leave the model untouched
	// Route is the ordered attempt list (failover order) for the alias;
	// UpstreamName/UpstreamModel/Upstream are its first element. halo-kong
	// uses only those; halo-proxy walks Route.
	Route   []policy.RouteTarget
	Headers map[string]string
	Shadow  []ShadowTarget
}

type DirectoryClient struct {
	URL, Token string
	TTL, Grace time.Duration
	Client     *http.Client
	Now        func() time.Time
	Log        *slog.Logger
	// FailClosed: refuse (ErrDirectoryUnavailable) instead of failing open
	// when the directory cannot be asked (DirectoryFailClosed).
	FailClosed bool
	// contains filtered or unexported fields
}

type DirectoryEntry struct {
	Active bool     `json:"active"`
	Groups []string `json:"groups,omitempty"`
}

type Estimate struct {
	RequestBytes int
	// MaxOutput is the request's maximum output tokens (MaxOutputTokens); 0 = none.
	MaxOutput int64
	// OutputCeiling caps the output estimate when MaxOutput is 0 (0 = DefaultOutputCeiling).
	OutputCeiling int64
	// ServerStateInput is the input to charge when the request makes the
	// provider bill input its bytes do not show (ServerStateInput true); 0 = it does not.
	ServerStateInput int64
	// Reasoning: the request enables hidden reasoning (ReasoningBudget), so
	// the output estimate is at least ThinkingBudget, or the output limit when
	// ThinkingBudget is 0: reasoning tokens are billed as output but never
	// streamed, so a stream cut before the final usage event shows none of them.
	Reasoning      bool
	ThinkingBudget int64
	// Background: an OpenAI Responses background request; its response is
	// queued (usage null), so the output is charged at the limit.
	Background bool
}

type Finding struct {
	Gate   string // GatePosture | GateVersion
	Mode   string // policy.GateWarn | policy.GateEnforce
	Reason string
}

type KillEnvelope struct {
	Payload   []byte `json:"payload"`   // base64 in JSON
	Signature []byte `json:"signature"` // base64 in JSON
}

type KillList struct {
	Version     uint64   `json:"version"` // grows with every kill/unkill; informational
	Experiments []string `json:"experiments"`
	// Toggles are killed feature-toggle names: treated as off everywhere, whatever
	// their rules say. Part of the signed payload, so covered by the same
	// signature, freshness and monotonicity checks as Experiments.
	Toggles  []string  `json:"toggles,omitempty"`
	IssuedAt time.Time `json:"issuedAt"`
}

type KillSwitch struct {
	URL      string
	Token    string
	PubKey   ed25519.PublicKey
	Interval time.Duration // default DefaultKillInterval
	MaxAge   time.Duration // default DefaultKillMaxAge
	Client   *http.Client  // default: 10s timeout, no redirects
	Log      *slog.Logger
	Now      func() time.Time
	// contains filtered or unexported fields
}

type Outbound struct {
	Path     string
	RawQuery string
	SetQuery bool // replace the client's query string with RawQuery (else keep it)
	Body     []byte
	// SSE: the response is a Bedrock event stream the anthropic-messages client
	// cannot read; convert it with EventStreamToSSE.
	SSE bool
}

type PostureClient struct {
	URL, Token string
	TTL, Grace time.Duration
	Client     *http.Client
	Now        func() time.Time
	Log        *slog.Logger
	// contains filtered or unexported fields
}

type PostureVerdict struct {
	Compliant bool   `json:"compliant"`
	Reason    string `json:"reason,omitempty"`
}

type Rejection struct {
	Status   int
	Protocol string // selects the error body shape
	Message  string
	Code     string // OpenAI Responses error code; "" = derived from Status
	// RetryAfter, when > 0, is sent as Retry-After (whole seconds, rounded up).
	RetryAfter time.Duration
}

type RequestInfo struct {
	UserID     string // from the auth gateway's identity header only
	Groups     []string
	ModelAlias string
	SessionID  string
	Harness    string
	Protocol   string
	FirstTurn  bool
	// AnyTurn: a parsed, replayable model call at any step of a session
	// (eligible for shadow experiments with turns: all).
	AnyTurn bool
	// Workload: the verified caller is a CI / cloud workload (ADR-0023). It
	// gets no experiment or shadow unless policy workloads.experiments is true.
	Workload bool
	// Agent: the verified caller is a delegated agent acting for UserID
	// (ADR-0024). It gets no experiment or shadow unless policy
	// agents.experiments is true (and, for a workload root, workloads.experiments).
	Agent bool
}

type Result struct {
	Decision Decision
	Protocol string
	// ClearHeaders are client-supplied x-halo-* names to drop (all of them; the
	// ones Decision sets are then re-set with gateway-owned values).
	ClearHeaders []string
	// Path/Body are the rewritten forms; Rewritten is false when unchanged.
	Path      string
	Body      []byte
	Rewritten bool
	// RewriteErr is non-nil when a rewrite was needed but failed (Reject is
	// then set too: an un-rewritten alias must never reach the upstream).
	RewriteErr error
	// Reject, when non-nil, must be answered by the adapter itself; the
	// request must NOT be forwarded.
	Reject *Rejection
}

type RouteRow struct {
	Alias      string      `json:"alias"`
	Ring       string      `json:"ring"`
	Experiment string      `json:"experiment,omitempty"` // traffic-axis experiment that supplied the route
	Variant    string      `json:"variant,omitempty"`
	Targets    []TargetRow `json:"targets"`
}

type ShadowTarget struct {
	Experiment string
	Variant    string
	Upstream   string // URL
	Model      string
}

type Snapshot struct {
	// contains filtered or unexported fields
}

type TargetRow struct {
	Order          int      `json:"order"`
	Selected       bool     `json:"selected"`
	Upstream       string   `json:"upstream"`
	Kind           string   `json:"kind"`
	Model          string   `json:"model"`
	Weight         float64  `json:"weight,omitempty"`
	Priority       int      `json:"priority"`
	TimeoutSeconds int      `json:"timeoutSeconds,omitempty"`
	SkippedBy      []string `json:"skippedByHarnesses,omitempty"` // harnesses whose wire protocol this target cannot serve
}

type Tool struct {
	Name   string
	Hosted bool
}

type UsageResult struct {
	Usage budget.Usage // field-wise maximum over every usage object read
	Found bool         // at least one usage object was read
	// Complete: the upstream body reached its clean end (EOF) and a usage
	// object was read, so Usage is the provider's final count. A client that
	// hangs up early, an upstream cut, a Content-Encoding the tap cannot decode
	// or a body without usage leave it false: charge EstimateUsage instead.
	Complete bool
	Bytes    int64 // response bytes seen (decoded bytes when the tap decoded them)
	// Streamed: the body was an SSE or AWS event stream the tap decoded, so
	// OutputText and OutputEvents measure the generated output.
	Streamed bool
	// OutputText is the UTF-8 bytes of generated output (text, thinking, tool
	// arguments) in the stream's delta events, without framing or JSON
	// escaping; OutputEvents counts those events.
	OutputText, OutputEvents int64
}