tenancy

const (
	// RetryLater is come back later.
	RetryLater Answer = iota + 1
	// Reauthorize is the credential is bad.
	Reauthorize
	// WidenScope is the credential's scope is too narrow.
	WidenScope
	// AskOperator is the deployment's configuration decides.
	AskOperator
	// FixRequest is the request itself is wrong.
	FixRequest
	// StartOver is begin a new session or listen.
	StartOver
	// NoAnswer is none given.
	NoAnswer
)

const (
	// AxisNone is the axis of [KeyNone].
	AxisNone Axis = iota
	// AxisRequest is one request: bounding it bounds what a request may cost,
	// never what a caller may hold.
	AxisRequest
	// AxisPreAdmission is before a tenant exists, where the address, the source
	// or a refused credential's digest is the only key available.
	AxisPreAdmission
	// AxisRequester is a tenant, a credential or something one credential
	// holds.
	AxisRequester
	// AxisProcess is the process or the deployment, which no caller can
	// multiply.
	AxisProcess
)

const (
	// CapacityNone states none: a structure with no capacity at all.
	CapacityNone Capacity = iota
	// RefuseNewcomer refuses what arrives.
	RefuseNewcomer
	// ReclaimOwnThenRefuse takes back something the same key holds, and
	// refuses when there is nothing to take.
	ReclaimOwnThenRefuse
	// EvictAcrossKeys takes a holding from another key to admit this one.
	// [Validate] requires a recorded decision for it (INV-005).
	EvictAcrossKeys
	// StopCounting stops tracking new keys rather than evicting a record.
	StopCounting
	// EvictOldest evicts the record nearest its expiry.
	EvictOldest
	// WaitThenRefuse queues for a bounded time, then refuses.
	WaitThenRefuse
)

const (
	// Gate is an HTTP status from the gate, before the SDK, with a JSON-RPC
	// body carrying the request id.
	Gate Channel = iota + 1
	// RPC is an in-band JSON-RPC error.
	RPC
	// ToolError is a tools/call result with isError set.
	ToolError
	// EmptyCompletion is a completion with no values.
	EmptyCompletion
	// Withheld is a narrowed surface whose answer names the cause.
	Withheld
	// Absent is a narrowed surface where the action or tool is missing.
	Absent
	// Unknown is a narrowed surface whose answer calls the action unknown.
	Unknown
	// ListenEnd is a subscriptions/listen ended with a completion result
	// carrying a watch-end reason.
	ListenEnd
	// SessionClose is a stateful session closed; later requests get 404.
	SessionClose
	// Silent is no visible refusal: uncounted, delayed or rebuilt.
	Silent
	// Startup is the process refusing to start.
	Startup
)

const (
	// ClassT is keyed on the tenant itself.
	ClassT Class = iota + 1
	// ClassE is a property of the tenant or instance, resolved with the
	// entry's own credential.
	ClassE
	// ClassC is a property of the credential: validity, authority, admission.
	ClassC
	// ClassR bounds or ends something the entry itself holds.
	ClassR
	// ClassQ is scoped to a request, a session or a URI.
	ClassQ
	// ClassA is before admission, where no tenant exists yet.
	ClassA
	// ClassP is the process or the deployment.
	ClassP
	// ClassU is an allowance keyed on the entry whose stated reason names no
	// unit.
	ClassU
	// ClassD is an allowance keyed on the entry whose reason is per user or
	// per process, so one tenant with N credentials holds N units of it. A
	// class D row always carries a finding.
	ClassD
)

const (
	// Valued decisions have their constants in values.go, and the sites alias
	// them.
	Valued Disposition = iota + 1
	// Ruled decisions are a predicate or a mapping, declared by symbol; nothing
	// moves.
	Ruled
	// Promoted decisions are rules whose function lives in the register.
	Promoted
	// Mechanism rows say how a decision is carried out. They choose no key and
	// no value.
	Mechanism
	// RequestBound rows are the per-request bounds, the RQB rows: declared so
	// that one list holds every requirement, and not owned.
	RequestBound
)

const (
	// EraAny is every era the refusal's methods exist in.
	EraAny Era = iota
	// EraLegacy is protocol 2025-11-25, with initialize and optional sessions.
	EraLegacy
	// EraModern is protocol 2026-07-28, stateless.
	EraModern
	// EraStdio is the stdio transport, where no HTTP status exists.
	EraStdio
)

const (
	// KeyNone is no key. As a [Decision.StdioKey] it says the decision does
	// not exist on stdio.
	KeyNone Key = iota
	// KeyRequest is one request, argument set or watched URI (class Q).
	KeyRequest
	// KeyCredential is the raw token a request presents (IDN-001).
	KeyCredential
	// KeyEntry is one credential on one instance: the pool entry (IDN-002).
	KeyEntry
	// KeyOwner is the random name of one entry build (IDN-003).
	KeyOwner
	// KeyTenant is the pair (canonical instance URL, GitLab user id)
	// (spec: The tenant).
	KeyTenant
	// KeyVerified is the (instance, token) pair the OAuth identity cache is
	// keyed on (ADM-002, ADM-003, ADM-005). The rejected-token cache hashes
	// the same pair, and is [KeyRefused]'s (ADM-006).
	KeyVerified
	// KeyApplication is the OAuth application uid a token was issued to
	// (spec: The tenant).
	KeyApplication
	// KeySession is an SDK session id, recorded to an owner (IDN-010).
	KeySession
	// KeyAddress is the charged client address (IDN-004).
	KeyAddress
	// KeySource is the socket peer, with every header ignored (IDN-005).
	KeySource
	// KeyRefused is a credential GitLab refused, held as a digest: what
	// AUB-003 counts and what ADM-006 remembers.
	KeyRefused
	// KeyUnbound is every request no credential was bound to (IDN-007).
	KeyUnbound
	// KeyProcess is the running binary.
	KeyProcess
	// KeyDeployment is the operator's configuration.
	KeyDeployment
)

const (
	// Rule is a predicate or a mapping.
	Rule Kind = iota + 1
	// Ceiling is at most N held at once per key.
	Ceiling
	// Rate is a refill rate and a burst per key, or a pause keyed like one.
	Rate
	// Budget is events counted per key inside a window, then a block.
	Budget
	// Lifetime is how long an admission, a record, a build or a holding lasts.
	Lifetime
	// Bound is what one request may cost.
	Bound
	// Share is a portion promised to every key. [Validate] refuses it on any
	// key a caller can mint.
	Share
)

const (
	// MalformedNone states none: a value no operator writes.
	MalformedNone Malformed = iota
	// RefuseStartup refuses to start.
	RefuseStartup
	// WarnKeepDefault warns and keeps the default.
	WarnKeepDefault
	// AcceptsAny is a switch every value of which means something (IDN-013:
	// anything but "off" enables it).
	AcceptsAny
)

const (
	// Unmetered methods are charged to no bucket (RTC-004): initialize,
	// resources/list, prompts/list and every method not named below. They
	// reach no upstream and cost little to answer, and metering something
	// cheap buys nothing and costs a concept.
	Unmetered Meter = iota
	// MeterToolResult is tools/call, charged to the entry's tool-call bucket
	// and refused as a successful result flagged with isError, so the model
	// receives a retryable diagnostic (RTC-001).
	MeterToolResult
	// MeterToolRPC is resources/read, resources/subscribe,
	// subscriptions/listen and prompts/get, charged to the same bucket as
	// tools/call because to GitLab a read is a read whichever MCP method asked
	// for it, and a limit that metered one door left the others open. Their
	// results carry no error flag, so each is refused with a JSON-RPC error
	// carrying [CodeTooManyRequests] (RTC-001).
	MeterToolRPC
	// MeterCatalog is tools/list, charged to the catalog bucket derived from
	// the tool-call one and refused with [CodeTooManyRequests]; the server's
	// own in-memory listings are exempt (RTC-003). It is charged first to the
	// bucket the whole process shares, in the tools it lists, which refuses
	// with the same code (RTC-007).
	MeterCatalog
	// MeterCompletion is completion/complete, charged to the completion
	// bucket derived from the tool-call one and refused with an empty
	// completion, never an error (RTC-002).
	MeterCompletion
)

const (
	// NotMintable is a key no caller can produce another value of.
	NotMintable MintCost = iota
	// MintFree costs nothing: an invented string, a new request, a new session.
	MintFree
	// MintAddress costs another client address.
	MintAddress
	// MintCredential costs another credential of the same GitLab user.
	MintCredential
	// MintPrincipal costs another GitLab user, which on self-managed any user
	// with a personal project can create as a project bot (spec: Two axes).
	MintPrincipal
)

const (
	// Identify is "who is this request?".
	Identify Question = iota + 1
	// Admit is "may this credential enter, and for how long?".
	Admit
	// Authorize is "what may it do?".
	Authorize
	// Allow is "what may it hold or spend?".
	Allow
	// End is "what happens when it exceeds, or when the server ends what it
	// held?".
	End
)

const (
	// RetryAfterNone carries no Retry-After header.
	RetryAfterNone RetryAfter = iota
	// RetryAfterFixed is a register constant ([UpstreamRetryAfter]).
	RetryAfterFixed
	// RetryAfterUpstreamOrFixed is GitLab's own Retry-After, else the
	// constant (ADM-002).
	RetryAfterUpstreamOrFixed
	// RetryAfterLongestBlock is the longest block holding the request, at
	// least one second (AUB-001 to AUB-003).
	RetryAfterLongestBlock
)

const (
	// Alias is a package-level const or var whose initializer is the register
	// constant [Site.Reads].
	Alias Role = iota + 1
	// Arg is a call argument: inside the function [Site.Name], the calls to
	// [Site.Call] pass the register constant at index [Site.Arg].
	Arg
	// Pin is a site that keeps its own literal, held equal to the register
	// constant [Site.Reads] (the second statements of issue 958's duplicated
	// defaults).
	Pin
	// Enforce is a function or var that applies the decision.
	Enforce
	// Refuse is a function, const or var that holds a refusal's text, or
	// builds its literal.
	Refuse
	// Reason is the declaration whose comment states the decision's reason.
	Reason
	// Charge is a function that charges an authentication budget.
	Charge
	// Derive is a symbol that computes a value of a key.
	Derive
)

const (
	// SourceNone is a decision with no value, or a ceiling nothing bounds,
	// which checkProcessAbsent holds to a finding. HLD-010 was that ceiling
	// until issue 951 bounded the stateful sessions.
	SourceNone Source = iota
	// Constant is a value no operator can change.
	Constant
	// Configurable is a value with a flag and a GITLAB_MCP_ variable.
	Configurable
	// EnvOnly is a value only an environment variable changes.
	EnvOnly
	// OptionOnly is a value only a Go option changes, which no operator can
	// reach.
	OptionOnly
	// Derived is a value computed from another decision's, or from a limit
	// the process is started under (HLD-011, from its descriptor limit, and
	// HLD-010, from HLD-011's). No operator sets it, as none sets a constant.
	Derived
)

const (
	// UnitNone is the unit of a reason that names none.
	UnitNone Unit = iota
	// UnitRequest is one request.
	UnitRequest
	// UnitCredential is one credential, or anything held per credential.
	UnitCredential
	// UnitPrincipal is one GitLab user on one instance.
	UnitPrincipal
	// UnitSession is one session.
	UnitSession
	// UnitApplication is one OAuth application.
	UnitApplication
	// UnitAddress is one client address.
	UnitAddress
	// UnitProcess is the process.
	UnitProcess
)

const (
	// ZeroUnset has not been declared. [Validate] refuses it on a valued row.
	ZeroUnset Zero = iota
	// ZeroNotApplicable is a value no operator can set to zero.
	ZeroNotApplicable
	// ZeroRefused refuses startup.
	ZeroRefused
	// ZeroOff switches the decision off.
	ZeroOff
	// ZeroOffKeepsCount switches the ceiling off and keeps counting, because
	// another decision reads the count.
	ZeroOffKeepsCount
	// ZeroSelectsDefault replaces a zero with the default.
	ZeroSelectsDefault
)