aifirewall

type Baseline struct {
	Version    string              `json:"version" yaml:"version"`
	Ref        string              `json:"ref" yaml:"ref"`
	Guardrails []BaselineGuardrail `json:"guardrails" yaml:"guardrails"`
}

type BaselineGuardrail struct {
	ID          string   `json:"id" yaml:"id"` // stable; the key for excludes
	Name        string   `json:"name" yaml:"name"`
	Description string   `json:"description" yaml:"description"`
	RuleType    string   `json:"ruleType" yaml:"ruleType"`
	Action      string   `json:"action" yaml:"action"`
	Pattern     string   `json:"pattern" yaml:"pattern"`
	Priority    int      `json:"priority" yaml:"priority"`
	Enabled     bool     `json:"enabled" yaml:"enabled"`
	Tags        []string `json:"tags" yaml:"tags"`
	Severity    string   `json:"severity" yaml:"severity"`
}

type BaselineSpec struct {
	Enabled bool     `yaml:"enabled"`
	Ref     string   `yaml:"ref,omitempty"`
	Exclude []string `yaml:"exclude,omitempty"` // baseline guardrail ids
}

type Change struct {
	Kind   Kind   `json:"kind"`
	Op     Op     `json:"op"`
	Target string `json:"target"`
	Detail string `json:"detail,omitempty"`

	// Populated for execution.
	Guardrail *GuardrailSpec `json:"-"`
	Model     *ModelSpec     `json:"-"`
	Provider  *ProviderSpec  `json:"-"`
	UUID      string         `json:"-"`
	Enable    *bool          `json:"-"`
}

type Check struct {
	ID       string   `json:"id"`
	Severity Severity `json:"severity"`
	Client   string   `json:"client,omitempty"`
	Message  string   `json:"message"`
}

type Client struct {
	ID          string
	DisplayName string

	// Manual clients have no user-editable config for the API base URL — the
	// setting lives in application state. We detect them and tell the user where
	// to paste the URL; we never write. Fabricating a config file for these would
	// produce a file the application ignores, and a status check that lies.
	Manual bool

	// Wire is the request format this client speaks. A client can only be wired
	// if the gateway proxies this wire for the target provider: Codex speaks the
	// OpenAI Responses API (its config no longer accepts any other wire_api), and
	// Claude Code speaks the Anthropic Messages API. Empty means the client is
	// happy with whatever the provider's SDK speaks.
	Wire string

	// Providers restricts the client to these provider slugs. Empty means every
	// provider that can be wired by environment variable.
	Providers []string

	// DefaultScope is used when --scope is not given.
	DefaultScope Scope
}

type Detected struct {
	Client  Client
	Scope   Scope
	Path    string
	State   State
	BaseURL string // whatever base URL the client is configured with, if any
	Model   string // the model it has pinned, if any
	// KeyEnvSet records, per provider API-key variable, whether the environment
	// holds a value. Only names and set/unset are recorded — never the value.
	KeyEnvSet map[string]bool
	// WiredProviders holds the providers this client actually points at the
	// gateway for. The shell can be wired for one provider and not another, and a
	// provider nobody has wired must not produce findings about its key.
	WiredProviders map[string]bool
}

type Gateway struct {
	BaseURL  string
	WireAPIs map[string][]string
}

type Guardrail struct {
	Name     string
	RuleType string
	Pattern  string
	Enabled  bool
	Priority int
}

type GuardrailSpec struct {
	Name       string `yaml:"name"`
	BaselineID string `yaml:"baselineId,omitempty"`
	RuleType   string `yaml:"ruleType"`
	Action     string `yaml:"action"`
	Pattern    string `yaml:"pattern"`
	Priority   int    `yaml:"priority,omitempty"`
	Enabled    *bool  `yaml:"enabled,omitempty"`
}

type KeySourceSpec struct {
	FromEnv  string `yaml:"fromEnv,omitempty"`
	FromFile string `yaml:"fromFile,omitempty"`
}

type Kind string

type ModelSpec struct {
	Slug        string `yaml:"slug"`
	Provider    string `yaml:"provider,omitempty"`
	AnyProvider bool   `yaml:"anyProvider,omitempty"`
	Action      string `yaml:"action"` // allow | deny
}

type Op string

type Options struct {
	Gateway string // https://guardrails.vulnetix.com
	OrgUUID string
	APIKey  string // the Vulnetix API key; only written when EmbedKey

	// Targets are the providers to wire, already filtered to those the org has a
	// BYOK key for.
	Targets []Provider

	// Model pins a default model in the agent configs that take one.
	Model string

	// EmbedKey writes the literal API key instead of a reference to
	// $VULNETIX_API_KEY. Opt-in, because it puts a credential in a file.
	EmbedKey bool

	Home  string
	Root  string // git root, "" when not in a repository
	Scope Scope
}

type Paths struct {
	// Config is the file we write, or would write.
	Config string
	// Secrets is a second file that must hold the API key, when the client cannot
	// read it from the environment. Empty for every client that can.
	Secrets string
	// Detect are additional paths whose presence means the client is installed,
	// even when Config does not exist yet.
	Detect []string
}

type Policy struct {
	// ProviderAction maps a provider slug to "allow", "deny", or "" (default).
	ProviderAction map[string]string
	// ProviderHasKey maps a provider slug to whether a BYOK key is stored.
	ProviderHasKey map[string]bool
	// ModelAction maps "provider/model" to "allow" or "deny".
	ModelAction map[string]string
	// AllowlistMode holds the providers with at least one allow entry. For those,
	// a model that is not on the list is refused — the single most surprising
	// semantic in the product, and the reason a "not denied" model can still fail.
	AllowlistMode map[string]bool
	Guardrails    []Guardrail
	Gateway       *Gateway
}

type PolicyFile struct {
	APIVersion string         `yaml:"apiVersion"`
	Kind       string         `yaml:"kind"`
	Metadata   PolicyMetadata `yaml:"metadata,omitempty"`
	Spec       PolicySpec     `yaml:"spec"`
}

type PolicyMetadata struct {
	// Org guards against applying one org's policy to another — the commonest way
	// to do real damage with a config file. Apply refuses on a mismatch.
	Org string `yaml:"org,omitempty"`
}

type PolicySpec struct {
	// Prune lets apply delete server objects this file does not mention. Off by
	// default: a CLI apply must not silently destroy guardrails someone created
	// in the dashboard.
	Prune bool `yaml:"prune,omitempty"`

	Settings   *SettingsSpec   `yaml:"settings,omitempty"`
	Baseline   *BaselineSpec   `yaml:"baseline,omitempty"`
	Providers  []ProviderSpec  `yaml:"providers,omitempty"`
	Models     []ModelSpec     `yaml:"models,omitempty"`
	Guardrails []GuardrailSpec `yaml:"guardrails,omitempty"`
}

type Provider struct {
	Slug        string
	DisplayName string

	// APIKeyEnv is the variable an SDK reads its credential from. For a wired
	// client this must hold the Vulnetix API key, not the provider's.
	APIKeyEnv string

	// BaseURLEnv lists the variables that SDKs genuinely honour for overriding
	// the API host — verified, not guessed. An empty list means no SDK reads an
	// environment variable for this provider's base URL, so the only way to route
	// it through the gateway is to set base_url in code (see `ai-firewall
	// snippet`). Inventing a plausible-looking variable here would be worse than
	// useless: the user would believe they were protected while their traffic
	// went straight to the provider.
	BaseURLEnv []string

	// Wire is the request format this provider's SDKs speak.
	Wire string

	// Verified records whether the BaseURLEnv list was confirmed against the
	// SDK's source, as opposed to its documentation.
	Verified bool
}

type ProviderSpec struct {
	Slug   string         `yaml:"slug"`
	Action string         `yaml:"action"` // allow | deny | default
	Key    *KeySourceSpec `yaml:"key,omitempty"`
}

type Scope string

type ServerGuardrail struct {
	UUID     string
	RuleType string
	Action   string
	Pattern  string
	Priority int
	Enabled  bool
}

type ServerState struct {
	Providers   map[string]string // slug -> action ("" = default)
	HasKey      map[string]bool
	Models      map[string]string // "provider/model" -> action
	Guardrails  map[string]ServerGuardrail
	LogsEnabled bool
}

type SettingsSpec struct {
	LogsEnabled *bool `yaml:"logsEnabled,omitempty"`
}

type Severity string

type Snippet struct {
	Lang string
	SDK  string
	File string
	// Provider pins the snippet to one provider when the SDK only speaks to it.
	Provider string
	// Wire is the request format the SDK in this snippet speaks. A snippet cannot
	// be rendered for a provider that does not serve it — an OpenAI-shaped call
	// against Anthropic would be built from the wrong base URL and 404.
	Wire string
	// Note explains why this snippet exists, when the reason is not obvious.
	Note string
}

type SnippetData struct {
	GatewayURL string
	Provider   string
	OrgUUID    string
	Model      string
	KeyEnv     string
}

type State string