hostkey

type HostKey struct {
	Meta meta.Metadata `json:"metadata" yaml:"metadata"`
	Spec Spec          `json:"spec"     yaml:"spec"`

	// Resolved is the cleartext value reconstructed at load time (read from
	// the env var or decrypted from PG). Runtime-only; never serialized.
	Resolved string `json:"-" yaml:"-"`
	// KeyHash is sha256 hex (first 6 bytes) of Resolved, for telemetry.
	KeyHash string `json:"-" yaml:"-"`

	// Derived: populated by the control-API enrich step from the catalog
	// snapshot; not stored and not loaded from YAML. Lists every user
	// Policy whose Spec.HostKeyIDs references this HostKey, so the admin
	// UI can show where a key is in use.
	Policies []PolicyRef `json:"policies,omitempty" yaml:"-"`
}

type PolicyRef struct {
	ID   string `json:"id"`
	Name string `json:"name"`
}

type RotateResult struct {
	Rotated    int
	NewVersion int32
}

type Spec struct {
	// HostID is the id of the Host this key authenticates to. Required.
	// Replaces the pre-refactor Meta.Owner pointing at a Host.
	HostID string `json:"hostId" yaml:"hostId" validate:"required"`

	// PolicyID is the id of the host-owned tier Policy this key mirrors.
	// Required: every key must declare an upstream tier so the pipeline
	// has rate-limit rules to apply. The referenced Policy must be host-
	// owned (Owner.Kind=host) AND its Owner.ID must equal HostID — i.e.
	// a key can only mirror a policy belonging to its own host. Cross-
	// entity validation lives in the composition layer.
	PolicyID    string    `json:"policyId" yaml:"policyId" validate:"required"`
	ValueFrom   ValueFrom `json:"valueFrom"             yaml:"valueFrom"             validate:"required"`
	DefaultTier string    `json:"defaultTier,omitempty" yaml:"defaultTier,omitempty" validate:"omitempty,slug"`
	Enabled     *bool     `json:"enabled,omitempty"     yaml:"enabled,omitempty"` // nil = true

	// PricingStrategy selects how this credential's spend is accounted.
	// "api": per-token metered — the cost is real spend and counts toward
	// future budget enforcement. "sub": flat-rate subscription — the cost
	// computed from the binding's pricing is a reference/"would-have-cost"
	// figure only, never enforced. Empty defaults to "api". The value must
	// be one of the credential's Host.Spec.PricingStrategies (the host's
	// menu of offered billing modes); that membership is a composition-layer
	// invariant, like Spec.PolicyID belonging to the host.
	PricingStrategy string `json:"pricingStrategy,omitempty" yaml:"pricingStrategy,omitempty" validate:"omitempty,oneof=api sub"`

	// Value is cleartext on the write path for ValueKindStored. Accepted
	// from JSON and YAML inputs; never returned on reads — Store.Get
	// never repopulates it, and marshalSpec strips it before any JSONB
	// persistence. The `omitempty` tag combined with that read-side
	// invariant keeps cleartext out of GET responses.
	Value string `json:"value,omitempty" yaml:"value,omitempty"`
}

type Store struct {
	// contains filtered or unexported fields
}

type ValueFrom struct {
	Kind ValueKind `json:"kind"          yaml:"kind"          validate:"required,oneof=env stored oauth"`
	Env  string    `json:"env,omitempty" yaml:"env,omitempty"`
	// Provider selects the oauth:<provider> settings section (refresh
	// endpoints + client). Required for ValueKindOAuth, empty otherwise.
	Provider string `json:"provider,omitempty" yaml:"provider,omitempty"`
}

type ValueKind string