Enum RateLimitUnit 

pub enum RateLimitUnit {
    Second,
    Minute,
    Hour,
}

Typed closed-set enum for the three canonical :politicas :rate-limit :window units — Second / Minute / Hour — the rate_limit_codec round-trips losslessly ("<n>/s" / "<n>/m" / "<n>/h").

The {"s" ↔ 1s, "m" ↔ 60s, "h" ↔ 3600s} bijection every consumer of the :politicas :rate-limit unit surface reads from ([rate_limit_codec::parse]’s unit → Duration dispatch, [rate_limit_codec::render]’s Duration → unit projection, the [is_canonical_rate_limit_window] predicate the AplicacaoSpec::validate_politicas gate keys off, the future M4 per-Aplicacao Envoy config reconciler’s local_rate_limit.token_bucket.fill_interval projection) now lives inside this typed enum’s match self arms — a future rate-limit-unit addition (a "d" day suffix once Envoy’s rate_limit_action grows daily-bucket support) is one new variant plus the exhaustiveness arms on the four methods, so every consumer picks it up by compile-time construction rather than a runtime table-scan miss.

The prior RATE_LIMIT_UNIT_TABLE: &[(&str, u64)] slice-of-tuples was scanned via find_map at every projection call — an untyped runtime walk that carried no compile-time link between the parse arm’s accepted suffixes, the render arm’s emitted suffixes, and the validate gate’s accepted windows. A future rate-limit-unit addition that landed one row without threading through the other consumers (or a copy-paste flip that collapsed two rows onto one suffix) would silently split the accepted-set across the three consumers — the parse arm accepts "d" and rejects "s", the render arm emits "h" for a 24h window that parse can’t round-trip, the validate gate misses one canonical window. Lifting the pairs onto a typed closed-set enum with exhaustive match arms makes any such half-landed extension a caixa-core build error (the compiler enforces arm coverage on every method), not a silent per-consumer drift surfacing at apply time. Same “closed-set typed-enum discriminator” discipline the sibling PlacementStrategy (cc8f749), crate::supervisor::RestartStrategy, crate::supervisor::RestartPolicy, crate::upgrade::UpgradeInstruction, and crate::CaixaKind closed-set typed enums carry on their respective closed-set axes — extended onto the seventh closed-set typed-enum discriminator axis on the caixa typed surface (the :politicas :rate-limit :window canonical-unit axis).

Variants

Second

1-second window — canonical author-surface suffix "s" ("<n>/s"), maps onto Envoy’s local_rate_limit.token_bucket.fill_interval with a 1s magnitude.

Minute

1-minute window — canonical author-surface suffix "m" ("<n>/m"), maps onto Envoy’s local_rate_limit.token_bucket.fill_interval with a 60s magnitude.

Hour

1-hour window — canonical author-surface suffix "h" ("<n>/h"), maps onto Envoy’s local_rate_limit.token_bucket.fill_interval with a 3600s magnitude.

Implementations

impl RateLimitUnit

pub const fn is_second(&self) -> bool

pub const fn is_minute(&self) -> bool

pub const fn is_hour(&self) -> bool

impl RateLimitUnit

pub const ALL: &'static [Self]

Exhaustive iteration surface for every consumer that reads the full canonical-unit set (the byte-parity witness against the prior RATE_LIMIT_UNIT_TABLE shape, the future M4 admission webhook’s accepted-suffix listing in its rejection body, any future round-trip fuzz harness). A future variant addition to RateLimitUnit extends this slice as a single edit and every consumer picks up the new entry by construction — the compiler- checked exhaustiveness on the sibling method match arms is the build-time guarantee that no arm forgets to grow.

pub const fn as_suffix(self) -> &'static str

Canonical author-surface suffix — the "s" / "m" / "h" byte- string every <n>/<unit> rate-limit shape carries after its / separator. The single source of truth the codec’s parse and render arms both dispatch on: the parse arm matches an incoming suffix against every RateLimitUnit::ALL entry’s as_suffix output; the render arm emits the entry’s as_suffix verbatim after the rate magnitude.

pub const fn window(self) -> Duration

Canonical Duration for this unit — the token-bucket refill period the RateLimit::window axis carries when the surrounding slot’s :rate-limit author surface named this unit.

pub fn from_suffix(suffix: &str) -> Option<Self>

Parse the <n>/<unit>-shaped suffix into the typed enum, or None when suffix is outside the closed-set arm-string set Self::as_suffix emits. The single str → Self projection [rate_limit_codec::parse] consumes.

pub const fn from_window(window: Duration) -> Option<Self>

Recognize a canonical rate-limit Duration as one of the three arms, or None when window carries sub-second residue or a second-magnitude outside the closed-set arm-window set Self::window emits. The single Duration → Self projection [rate_limit_codec::render] + [is_canonical_rate_limit_window] both consume.

pub const fn — the reverse Duration → Self projection now carries the same const-eval-surface posture the sibling pub const fn Self::as_suffix / Self::window scalar- projection accessors on this closed-set typed enum already carry, and the paired pub const fn RateLimit::canonical_unit typed-RateLimit-projection sibling composes through in const context. Routes byte-for-byte through the peer pub const fn Self::window canonical-Duration projection so any future arm-magnitude edit on the sibling accessor reaches this reverse resolver by construction — the s == Self::<Arm>.window().as_secs() per-arm probes each dispatch through one pub const fn on the substrate primitive rather than a hand-authored per-arm second- magnitude literal that would silently drift on any future Self::window arm-magnitude edit.

Prior to the const lift the body dispatched through Self::ALL.iter().copied().find(|u| u.window() == window) — an iterator-driven linear scan whose iterator methods (.iter() / .copied() / .find()) and Duration-side PartialEq dispatch each carry non-const bounds on stable Rust 1.94, so any downstream substrate-side const-context consumer of the reverse resolver (a module-scope const _:() = assert!(RateLimitUnit::from_window(<canonical>).is_some()) invariant pin on a typed fixture, a future M4 mesh.pleme.io/v1alpha1/Aplicacao CR materializer admission- webhook const fn per-:politicas canonical-window floor over a typed RateLimit scalar, any future const fn per-:contratos-edge rate-limit-override overlay resolver over the substrate primitive that wants to fan on the canonical unit at compile time) surfaced as a downstream E0015 far from the resolver’s own declaration. The pub const fn posture closes the drift structurally at caixa-core build time.

Pinned load-bearing at the substrate-primitive level by [tests::rate_limit_unit_from_window_accessor_is_const_fn] (const- eval-surface pin via const fn wrapper) and [tests::rate_limit_unit_from_window_composes_through_window_accessor] (composition-witness pin against the peer Self::window scalar dispatch).

pub fn window_from_suffix(suffix: &str) -> Option<Duration>

Canonical rate-limit Duration for a unit suffix, or None when suffix is outside the closed-set arm-string set Self::as_suffix emits. Composes Self::from_suffix with Self::window — the single &str → Duration projection [rate_limit_codec::parse] consumes.

The peer Duration → &'static str axis folded onto the substrate primitive RateLimit::canonical_unit typed accessor once both production consumers ([rate_limit_codec::render] and AplicacaoSpec::validate_politicas’s canonical-window gate) migrated (61421a6): the free helper’s Duration → &str projection is now the two-step composition rl.canonical_unit().map(RateLimitUnit::as_suffix) every consumer reads through the typed accessor. This lift closes the peer &str → Duration axis by folding the vestigial module-private rate_limit_window_from_unit delegate onto this associated method — the codec’s parse arm and every future wire-side consumer of the &str → Duration projection (a future admission-webhook that reads a :rate-limit shape off a CR spec’s raw string value before it’s promoted to a validated typed slot, a future feira lint shape-probe that reads the author-surface bytes verbatim) now reach for exactly one typed dispatch on the substrate primitive.

Same “closed-set typed-enum discriminator with canonical projections per axis” discipline the sibling Self::as_suffix / Self::window / Self::from_suffix / Self::from_window methods carry — this associated method closes the fifth (and last unlifted) projection axis on the arm-table, so the closed-set enum now owns every str ↔ Duration ↔ Self typed dispatch every consumer of the :politicas :rate-limit :window axis reaches through. A future rate-limit-unit addition (a "d" day suffix once Envoy’s rate_limit_action grows daily-bucket support, a "ms" sub-second window once high-throughput per-edge policies come into scope per MESH-COMPOSITION §III.2 #3) is one new variant plus one arm per method — the compiler enforces exhaustiveness on every consumer’s match self arms and picks the new unit up by construction across all five projections.

Trait Implementations

impl AsRef<str> for RateLimitUnit

Substrate-canonical AsRef<str> projection on the M3 :politicas :rate-limit closed-set typed unit-suffix enum — routes through the same RateLimitUnit::as_suffix pub const fn scalar accessor the paired std::fmt::Display impl already delegates through, so any future consumer that binds a RateLimitUnit through the standard-library impl AsRef<str> bound (a std::process::Command::arg shell-out that composes the canonical suffix into an Envoy sidecar config-CLI’s per-:politicas --rate-limit-unit <s|m|h> arg on the future CiliumClusterwideEnvoyConfig overlay MESH-COMPOSITION §III.2 #3 names, a tracing::field::Value::Str-arm structured-log recorder on the future app-operator’s per-:politicas :rate-limit reconcile step, a std::collections::HashMap lookup keyed on the canonical suffix through map.get::<str>(unit.as_ref()) on a future per-unit token-bucket-refill dispatch table the future M4 admission-webhook rejection body composes) reaches the paired "s" / "m" / "h" byte-string through one substrate-primitive dispatch rather than an open-coded .as_suffix() re-inlining at every wire-up.

Deliberately routes through the canonical suffix axis, not the second-magnitude RateLimitUnit::window axis — AsRef<str> and [fmt::Display] land on the same author-surface-canonical byte- string the codec’s parse and render arms both dispatch on, while the token-bucket-refill period stays reachable only through the explicit RateLimitUnit::window / RateLimitUnit::from_window paths.

Same “route the trait impl through the substrate-primitive accessor” discipline the sibling crate::CaixaVersion AsRef<str> impl (16d5c7e), the paired M2 crate::supervisor::RestartStrategy AsRef<str> impl (63eb1a4), the paired M2 crate::supervisor::RestartPolicy AsRef<str> impl (419ea81), the M3 PlacementStrategy AsRef<str> impl (d86edd2), and the top-level crate::CaixaKind AsRef<str> impl (cd2091f) carry — closes the substrate primitive’s AsRef<str> projection axis onto the last remaining closed-set typed enum with a [fmt::Display] surface, so every closed-set typed enum / newtype on the caixa surface (top-level :kind, both M2 :supervisor-slot per-child and sibling-restart typed enums, the M3 :placement :estrategia typed enum, the M3 :politicas :rate-limit unit-suffix typed enum, and the :versao typed newtype) now carries the paired AsRef<str> + [fmt::Display] + as_* triple through one lifted-const family.

Pinned load-bearing by [tests::rate_limit_unit_as_ref_str_routes_through_as_suffix_accessor] (byte-parity pin against RateLimitUnit::as_suffix across the three-arm closed set) and [tests::rate_limit_unit_as_ref_str_routes_through_display_via_shared_accessor] (three-path convergence: AsRef<str> + Display + as_suffix all resolve to the same byte-string per arm) — any future silent detour that routes the impl through a divergent projection (a per-arm inline match self { … } re-inlining that opens a compile- time link to the un-lifted arm-literal, a swap onto the second-magnitude RateLimitUnit::window axis that would collide the canonical-suffix / token-bucket-refill two-axis split) trips at caixa-core test time under assert_eq! rather than at a downstream impl AsRef<str>-bound consumer’s silent split.

fn as_ref(&self) -> &str

Converts this type into a shared reference of the (usually inferred) input type.

impl Clone for RateLimitUnit

fn clone(&self) -> RateLimitUnit

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for RateLimitUnit

impl Debug for RateLimitUnit

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for RateLimitUnit

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for RateLimitUnit

Route std::fmt::Display through RateLimitUnit::as_suffix, so every consumer that formats a canonical rate-limit unit as user- facing text (future M4 admission-webhook rejection bodies naming the accepted-suffix set, future feira app graph per-:politicas unit column) lands on the same "s" / "m" / "h" byte-string the codec’s parse arm accepts and the render arm emits. Same as_str-through-Display convergence discipline the sibling PlacementStrategy, crate::CaixaKind, crate::supervisor::RestartStrategy, and crate::supervisor::RestartPolicy closed-set typed enums carry.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for RateLimitUnit

impl Hash for RateLimitUnit

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for RateLimitUnit

fn eq(&self, other: &RateLimitUnit) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for RateLimitUnit

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for RateLimitUnit