policy

type AcquireInput struct {
	Policy   *Policy
	Keys     []*hostkey.HostKey
	Excluded []*hostkey.HostKey
	Model    *model.Model
	Host     *host.Host
	Provider string
}

type Acquisition struct {
	Key         *hostkey.HostKey
	Reservation *pkgratelimit.Reservation
}

type KeySelection = keypool.KeySelection

type Policy struct {
	Meta meta.Metadata `json:"metadata" yaml:"metadata"`
	Spec Spec          `json:"spec"     yaml:"spec"`
}

type RLBinding struct {
	Models      []string `json:"models"      yaml:"models"      validate:"required,min=1,dive,min=1"`
	RateLimitID string   `json:"rateLimitId" yaml:"rateLimitId" validate:"required,uuid"`
}

type Service struct {
	// contains filtered or unexported fields
}

type SnapshotReader interface {
	Policy(id string) (*Policy, bool)
	RateLimit(id string) (*ratelimit.RateLimit, bool)
}

type Spec struct {
	// Models is the catalog grant — a list of ref strings parsed by
	// app/modelref. See its package doc for the grammar. Each entry can
	// match a single binding ("anthropic/claude-opus-4-7@bedrock"), all
	// hosts for a model ("anthropic/claude-opus-4-7" or trailing @*),
	// or every model under a provider ("anthropic" or "anthropic/*").
	//
	// Patterns expand against the live catalog at snapshot build time,
	// so a wildcard automatically includes models added later.
	//
	// **Empty Models AND empty ModelIDs is treated as an implicit
	// wildcard**: every model reachable through the policy's HostKeys is
	// allowed. The hostkey-coverage check at routing time is the real
	// authorization gate in that case; Models/ModelIDs, when set, narrow
	// that gate. Deprecated models are hidden from the implicit wildcard
	// unless Spec.IncludeDeprecated.
	Models []string `json:"models,omitempty" yaml:"models,omitempty" validate:"omitempty,dive,min=1"`

	// ModelIDs is the legacy literal-ID grant — exact Model UUIDs, no
	// wildcards. Coexists with Models during the transition; the
	// snapshot expands both into the same bindingsByPolicy index.
	// New grants should prefer Models. See Models above for the
	// empty-list = implicit-wildcard rule.
	ModelIDs []string `json:"modelIds,omitempty" yaml:"modelIds,omitempty" validate:"omitempty,dive,uuid"`

	// HostKeyIDs is the set of HostKeys this Policy can draw from
	// (m:n with ProviderKey). Order is significant for KeySelectionPrioritized.
	HostKeyIDs []string `json:"hostKeyIds,omitempty" yaml:"hostKeyIds,omitempty" validate:"omitempty,dive,uuid"`

	// RateLimitID is a single RateLimit applied uniformly to every model
	// the policy grants. Mutually exclusive with RLBindings — pick one or
	// the other (or neither for an uncapped policy). The flat form is the
	// common case for user-authored policies that don't differentiate
	// caps per model.
	RateLimitID string `json:"rateLimitId,omitempty" yaml:"rateLimitId,omitempty" validate:"omitempty,uuid"`

	// RLBindings declares per-model rate-limit mappings. Use this when
	// caps vary by the model being called (the typical host-tier case
	// where, e.g., gpt-4o has different TPM than gpt-4o-mini at the same
	// upstream tier). At request time the first binding whose Models
	// matches the requested model contributes its RateLimit's rules; a
	// model not covered by any binding is uncapped at this policy.
	//
	// Each binding must declare at least one entry in Models. Mutually
	// exclusive with RateLimitID — Validate rejects setting both.
	RLBindings []RLBinding `json:"rlBindings,omitempty" yaml:"rlBindings,omitempty" validate:"omitempty,dive"`

	// KeySelection is the algorithm used to pick a ProviderKey from the
	// healthy pool. Defaults to prioritized. The enum lives in app/keypool
	// (the consumer); policy re-exports the constants via type aliases
	// for backward source-compatibility.
	KeySelection keypool.KeySelection `` /* 130-byte string literal not displayed */

	// SkipDefaultLimits opts out of the implicit "every Policy targeting an
	// auth-required Provider must enforce at least requests + tokens" rule
	// performed by the composition layer.
	SkipDefaultLimits bool `json:"skipDefaultLimits,omitempty" yaml:"skipDefaultLimits,omitempty"`

	// IncludeDeprecated controls whether wildcard Models entries expand
	// to models whose Spec.Deprecation.Status is "deprecated" or
	// "sunset". Default false (deprecated models excluded). Literal
	// grants in Models always resolve regardless — if you explicitly
	// name a deprecated model by slug, you mean to grant it.
	IncludeDeprecated bool `json:"includeDeprecated,omitempty" yaml:"includeDeprecated,omitempty"`

	// Enabled defaults to true when nil.
	Enabled *bool `json:"enabled,omitempty" yaml:"enabled,omitempty"`

	// PayloadLoggingEnabled opts every request authorized by this policy
	// into full request/response body capture by the payloadlog observer.
	// Off by default. A RelayKey may also opt in independently; either
	// being set enables capture for the request.
	PayloadLoggingEnabled bool `json:"payloadLoggingEnabled,omitempty" yaml:"payloadLoggingEnabled,omitempty"`
}

type Store struct {
	// contains filtered or unexported fields
}