axonflow-sdk-rust 0.11.0

// Code generated by tools/gen-authzen-types. DO NOT EDIT.
//
// Source: testdata/authzen-surface.json
//   artifact:        axonflow-authzen-surface v1
//   profile:         axonflow-authzen-profile-2026-08-29
//   contract schema: 2026-08-29
//   schema digest:   sha256:04f63f4d97215faa9fbf2b6a5152630f7310edbe47440b975d0f66ad63df811f
//
// Regenerate with:
//
//     cargo run -p axonflow-authzen-codegen
//
// Editing this file by hand is pointless: tests/authzen_generated_types_are_current.rs
// regenerates it in memory and compares bytes, so a hand edit fails CI on the next run.

use super::attribute::AttributeMap;
use serde::{Deserialize, Serialize};
use std::collections::BTreeMap;

/// The profile a Policy Enforcement Point negotiates to receive anything
/// beyond the boolean decision.
///
/// AuthZEN 1.0's response is a bare boolean. The four-valued state, the
/// obligations, the approval challenge and the safe reason code all ride in
/// the response context and are returned ONLY to a caller that asked for them
/// by version, because handing a partial interpretation to a caller that
/// cannot act on it is worse than handing it the boolean it understands.
pub const AUTHZEN_PROFILE_V1: &str = "axonflow-authzen-profile-2026-08-29";

/// The contract version these types were generated from. It is the value the
/// server echoes in [`AuthZenResponseContext::schema_version`].
pub const AUTHZEN_CONTRACT_SCHEMA_VERSION: &str = "2026-08-29";

/// The one route the AuthZEN surface is served on, and the request header the
/// profile is negotiated with. Both are generated from the platform's contract
/// through the artifact, not written here: a rename on the platform is a
/// regenerate-and-diff failure in this SDK, not a 404 in production
/// (axonflow-enterprise#3603).
pub const AUTHZEN_PATH: &str = "/api/v1/access/evaluation";
pub const AUTHZEN_PROFILE_HEADER: &str = "X-Axonflow-AuthZEN-Profile";

/// A closed set of values the server may send.
///
/// The `Unknown` variant is not a failure mode, it is a ROUND TRIP: a value a
/// newer server added after this build survives decode, re-encode and logging
/// intact instead of collapsing onto a neighbouring constant. It is, however,
/// a reason not to branch on the value as though it were one of the known
/// ones - use [`AuthZenErrorCode::is_known`].
///
/// `#[non_exhaustive]` because `Unknown` does not make this enum additive
/// for a downstream crate. A match over the known variants plus
/// `Unknown(_)` is exhaustive TODAY, and stops compiling the moment the
/// artifact gains a value - which is exactly what ADR-065 does at v11.
/// With the attribute, that same match needs a `_` arm and a new value is
/// a minor release rather than a breaking one.
#[derive(Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(from = "String", into = "String")]
#[non_exhaustive]
pub enum AuthZenErrorCode {
    /// `malformed_envelope`
    MalformedEnvelope,
    /// `incomplete_evaluation`
    IncompleteEvaluation,
    /// `unsupported_subject`
    UnsupportedSubject,
    /// `unsupported_action`
    UnsupportedAction,
    /// `unsupported_resource`
    UnsupportedResource,
    /// `unevaluable_attribute`
    UnevaluableAttribute,
    /// `missing_evaluable_content`
    MissingEvaluableContent,
    /// `evaluation_unavailable`
    EvaluationUnavailable,
    /// A value this build does not know, carried verbatim.
    Unknown(String),
}

impl AuthZenErrorCode {
    /// Every wire value this build knows, in artifact order.
    ///
    /// This is the set a refusal names in its `supported` list, so it is the
    /// list a diagnostic should print rather than one written beside it.
    pub const KNOWN_WIRE_VALUES: &'static [&'static str] = &[
        "malformed_envelope",
        "incomplete_evaluation",
        "unsupported_subject",
        "unsupported_action",
        "unsupported_resource",
        "unevaluable_attribute",
        "missing_evaluable_content",
        "evaluation_unavailable",
    ];

    /// The wire value.
    pub fn as_str(&self) -> &str {
        match self {
            Self::MalformedEnvelope => "malformed_envelope",
            Self::IncompleteEvaluation => "incomplete_evaluation",
            Self::UnsupportedSubject => "unsupported_subject",
            Self::UnsupportedAction => "unsupported_action",
            Self::UnsupportedResource => "unsupported_resource",
            Self::UnevaluableAttribute => "unevaluable_attribute",
            Self::MissingEvaluableContent => "missing_evaluable_content",
            Self::EvaluationUnavailable => "evaluation_unavailable",
            Self::Unknown(v) => v.as_str(),
        }
    }

    /// Whether this is a value this build knows.
    ///
    /// A false result is not necessarily an error - a newer server may send a
    /// value added after this SDK was built. It IS a reason not to treat it as
    /// equivalent to any known value.
    pub fn is_known(&self) -> bool {
        !matches!(self, Self::Unknown(_))
    }
}

impl From<String> for AuthZenErrorCode {
    fn from(v: String) -> Self {
        match v.as_str() {
            "malformed_envelope" => Self::MalformedEnvelope,
            "incomplete_evaluation" => Self::IncompleteEvaluation,
            "unsupported_subject" => Self::UnsupportedSubject,
            "unsupported_action" => Self::UnsupportedAction,
            "unsupported_resource" => Self::UnsupportedResource,
            "unevaluable_attribute" => Self::UnevaluableAttribute,
            "missing_evaluable_content" => Self::MissingEvaluableContent,
            "evaluation_unavailable" => Self::EvaluationUnavailable,
            _ => Self::Unknown(v),
        }
    }
}

impl From<AuthZenErrorCode> for String {
    fn from(v: AuthZenErrorCode) -> Self {
        v.as_str().to_string()
    }
}

impl std::fmt::Display for AuthZenErrorCode {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.write_str(self.as_str())
    }
}

/// A closed set of values the server may send.
///
/// The `Unknown` variant is not a failure mode, it is a ROUND TRIP: a value a
/// newer server added after this build survives decode, re-encode and logging
/// intact instead of collapsing onto a neighbouring constant. It is, however,
/// a reason not to branch on the value as though it were one of the known
/// ones - use [`AuthZenCategory::is_known`].
///
/// `#[non_exhaustive]` because `Unknown` does not make this enum additive
/// for a downstream crate. A match over the known variants plus
/// `Unknown(_)` is exhaustive TODAY, and stops compiling the moment the
/// artifact gains a value - which is exactly what ADR-065 does at v11.
/// With the attribute, that same match needs a `_` arm and a new value is
/// a minor release rather than a breaking one.
#[derive(Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(from = "String", into = "String")]
#[non_exhaustive]
pub enum AuthZenCategory {
    /// `allowed`
    Allowed,
    /// `not_permitted`
    NotPermitted,
    /// `approval_required`
    ApprovalRequired,
    /// `temporarily_unavailable`
    TemporarilyUnavailable,
    /// `invalid_request`
    InvalidRequest,
    /// A value this build does not know, carried verbatim.
    Unknown(String),
}

impl AuthZenCategory {
    /// Every wire value this build knows, in artifact order.
    ///
    /// This is the set a refusal names in its `supported` list, so it is the
    /// list a diagnostic should print rather than one written beside it.
    pub const KNOWN_WIRE_VALUES: &'static [&'static str] = &[
        "allowed",
        "not_permitted",
        "approval_required",
        "temporarily_unavailable",
        "invalid_request",
    ];

    /// The wire value.
    pub fn as_str(&self) -> &str {
        match self {
            Self::Allowed => "allowed",
            Self::NotPermitted => "not_permitted",
            Self::ApprovalRequired => "approval_required",
            Self::TemporarilyUnavailable => "temporarily_unavailable",
            Self::InvalidRequest => "invalid_request",
            Self::Unknown(v) => v.as_str(),
        }
    }

    /// Whether this is a value this build knows.
    ///
    /// A false result is not necessarily an error - a newer server may send a
    /// value added after this SDK was built. It IS a reason not to treat it as
    /// equivalent to any known value.
    pub fn is_known(&self) -> bool {
        !matches!(self, Self::Unknown(_))
    }
}

impl From<String> for AuthZenCategory {
    fn from(v: String) -> Self {
        match v.as_str() {
            "allowed" => Self::Allowed,
            "not_permitted" => Self::NotPermitted,
            "approval_required" => Self::ApprovalRequired,
            "temporarily_unavailable" => Self::TemporarilyUnavailable,
            "invalid_request" => Self::InvalidRequest,
            _ => Self::Unknown(v),
        }
    }
}

impl From<AuthZenCategory> for String {
    fn from(v: AuthZenCategory) -> Self {
        v.as_str().to_string()
    }
}

impl std::fmt::Display for AuthZenCategory {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.write_str(self.as_str())
    }
}

/// A closed set of values the server may send.
///
/// The `Unknown` variant is not a failure mode, it is a ROUND TRIP: a value a
/// newer server added after this build survives decode, re-encode and logging
/// intact instead of collapsing onto a neighbouring constant. It is, however,
/// a reason not to branch on the value as though it were one of the known
/// ones - use [`AuthZenIdentifierKind::is_known`].
///
/// `#[non_exhaustive]` because `Unknown` does not make this enum additive
/// for a downstream crate. A match over the known variants plus
/// `Unknown(_)` is exhaustive TODAY, and stops compiling the moment the
/// artifact gains a value - which is exactly what ADR-065 does at v11.
/// With the attribute, that same match needs a `_` arm and a new value is
/// a minor release rather than a breaking one.
#[derive(Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(from = "String", into = "String")]
#[non_exhaustive]
pub enum AuthZenIdentifierKind {
    /// `organization`
    Organization,
    /// `principal`
    Principal,
    /// `group`
    Group,
    /// `resource`
    Resource,
    /// `action`
    Action,
    /// `tool`
    Tool,
    /// `client`
    Client,
    /// `session`
    Session,
    /// A value this build does not know, carried verbatim.
    Unknown(String),
}

impl AuthZenIdentifierKind {
    /// Every wire value this build knows, in artifact order.
    ///
    /// This is the set a refusal names in its `supported` list, so it is the
    /// list a diagnostic should print rather than one written beside it.
    pub const KNOWN_WIRE_VALUES: &'static [&'static str] = &[
        "organization",
        "principal",
        "group",
        "resource",
        "action",
        "tool",
        "client",
        "session",
    ];

    /// The wire value.
    pub fn as_str(&self) -> &str {
        match self {
            Self::Organization => "organization",
            Self::Principal => "principal",
            Self::Group => "group",
            Self::Resource => "resource",
            Self::Action => "action",
            Self::Tool => "tool",
            Self::Client => "client",
            Self::Session => "session",
            Self::Unknown(v) => v.as_str(),
        }
    }

    /// Whether this is a value this build knows.
    ///
    /// A false result is not necessarily an error - a newer server may send a
    /// value added after this SDK was built. It IS a reason not to treat it as
    /// equivalent to any known value.
    pub fn is_known(&self) -> bool {
        !matches!(self, Self::Unknown(_))
    }
}

impl From<String> for AuthZenIdentifierKind {
    fn from(v: String) -> Self {
        match v.as_str() {
            "organization" => Self::Organization,
            "principal" => Self::Principal,
            "group" => Self::Group,
            "resource" => Self::Resource,
            "action" => Self::Action,
            "tool" => Self::Tool,
            "client" => Self::Client,
            "session" => Self::Session,
            _ => Self::Unknown(v),
        }
    }
}

impl From<AuthZenIdentifierKind> for String {
    fn from(v: AuthZenIdentifierKind) -> Self {
        v.as_str().to_string()
    }
}

impl std::fmt::Display for AuthZenIdentifierKind {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.write_str(self.as_str())
    }
}

/// A closed set of values the server may send.
///
/// The `Unknown` variant is not a failure mode, it is a ROUND TRIP: a value a
/// newer server added after this build survives decode, re-encode and logging
/// intact instead of collapsing onto a neighbouring constant. It is, however,
/// a reason not to branch on the value as though it were one of the known
/// ones - use [`AuthZenObligationType::is_known`].
///
/// `#[non_exhaustive]` because `Unknown` does not make this enum additive
/// for a downstream crate. A match over the known variants plus
/// `Unknown(_)` is exhaustive TODAY, and stops compiling the moment the
/// artifact gains a value - which is exactly what ADR-065 does at v11.
/// With the attribute, that same match needs a `_` arm and a new value is
/// a minor release rather than a breaking one.
#[derive(Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(from = "String", into = "String")]
#[non_exhaustive]
pub enum AuthZenObligationType {
    /// `approval_challenge`
    ApprovalChallenge,
    /// `field_remove`
    FieldRemove,
    /// `field_redact`
    FieldRedact,
    /// `field_hash`
    FieldHash,
    /// `field_mask`
    FieldMask,
    /// `field_annotate`
    FieldAnnotate,
    /// `field_tokenize`
    FieldTokenize,
    /// `schema_transform`
    SchemaTransform,
    /// `response_filter`
    ResponseFilter,
    /// `route_restriction`
    RouteRestriction,
    /// `step_up_authentication`
    StepUpAuthentication,
    /// `quota_reservation`
    QuotaReservation,
    /// `immutable_audit`
    ImmutableAudit,
    /// `notification`
    Notification,
    /// A value this build does not know, carried verbatim.
    Unknown(String),
}

impl AuthZenObligationType {
    /// Every wire value this build knows, in artifact order.
    ///
    /// This is the set a refusal names in its `supported` list, so it is the
    /// list a diagnostic should print rather than one written beside it.
    pub const KNOWN_WIRE_VALUES: &'static [&'static str] = &[
        "approval_challenge",
        "field_remove",
        "field_redact",
        "field_hash",
        "field_mask",
        "field_annotate",
        "field_tokenize",
        "schema_transform",
        "response_filter",
        "route_restriction",
        "step_up_authentication",
        "quota_reservation",
        "immutable_audit",
        "notification",
    ];

    /// The wire value.
    pub fn as_str(&self) -> &str {
        match self {
            Self::ApprovalChallenge => "approval_challenge",
            Self::FieldRemove => "field_remove",
            Self::FieldRedact => "field_redact",
            Self::FieldHash => "field_hash",
            Self::FieldMask => "field_mask",
            Self::FieldAnnotate => "field_annotate",
            Self::FieldTokenize => "field_tokenize",
            Self::SchemaTransform => "schema_transform",
            Self::ResponseFilter => "response_filter",
            Self::RouteRestriction => "route_restriction",
            Self::StepUpAuthentication => "step_up_authentication",
            Self::QuotaReservation => "quota_reservation",
            Self::ImmutableAudit => "immutable_audit",
            Self::Notification => "notification",
            Self::Unknown(v) => v.as_str(),
        }
    }

    /// Whether this is a value this build knows.
    ///
    /// A false result is not necessarily an error - a newer server may send a
    /// value added after this SDK was built. It IS a reason not to treat it as
    /// equivalent to any known value.
    pub fn is_known(&self) -> bool {
        !matches!(self, Self::Unknown(_))
    }
}

impl From<String> for AuthZenObligationType {
    fn from(v: String) -> Self {
        match v.as_str() {
            "approval_challenge" => Self::ApprovalChallenge,
            "field_remove" => Self::FieldRemove,
            "field_redact" => Self::FieldRedact,
            "field_hash" => Self::FieldHash,
            "field_mask" => Self::FieldMask,
            "field_annotate" => Self::FieldAnnotate,
            "field_tokenize" => Self::FieldTokenize,
            "schema_transform" => Self::SchemaTransform,
            "response_filter" => Self::ResponseFilter,
            "route_restriction" => Self::RouteRestriction,
            "step_up_authentication" => Self::StepUpAuthentication,
            "quota_reservation" => Self::QuotaReservation,
            "immutable_audit" => Self::ImmutableAudit,
            "notification" => Self::Notification,
            _ => Self::Unknown(v),
        }
    }
}

impl From<AuthZenObligationType> for String {
    fn from(v: AuthZenObligationType) -> Self {
        v.as_str().to_string()
    }
}

impl std::fmt::Display for AuthZenObligationType {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.write_str(self.as_str())
    }
}

/// A closed set of values the server may send.
///
/// The `Unknown` variant is not a failure mode, it is a ROUND TRIP: a value a
/// newer server added after this build survives decode, re-encode and logging
/// intact instead of collapsing onto a neighbouring constant. It is, however,
/// a reason not to branch on the value as though it were one of the known
/// ones - use [`AuthZenOperationalState::is_known`].
///
/// `#[non_exhaustive]` because `Unknown` does not make this enum additive
/// for a downstream crate. A match over the known variants plus
/// `Unknown(_)` is exhaustive TODAY, and stops compiling the moment the
/// artifact gains a value - which is exactly what ADR-065 does at v11.
/// With the attribute, that same match needs a `_` arm and a new value is
/// a minor release rather than a breaking one.
#[derive(Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(from = "String", into = "String")]
#[non_exhaustive]
pub enum AuthZenOperationalState {
    /// `ALLOW`
    Allow,
    /// `DENY`
    Deny,
    /// `CHALLENGE`
    Challenge,
    /// `ERROR`
    Error,
    /// A value this build does not know, carried verbatim.
    Unknown(String),
}

impl AuthZenOperationalState {
    /// Every wire value this build knows, in artifact order.
    ///
    /// This is the set a refusal names in its `supported` list, so it is the
    /// list a diagnostic should print rather than one written beside it.
    pub const KNOWN_WIRE_VALUES: &'static [&'static str] = &["ALLOW", "DENY", "CHALLENGE", "ERROR"];

    /// The wire value.
    pub fn as_str(&self) -> &str {
        match self {
            Self::Allow => "ALLOW",
            Self::Deny => "DENY",
            Self::Challenge => "CHALLENGE",
            Self::Error => "ERROR",
            Self::Unknown(v) => v.as_str(),
        }
    }

    /// Whether this is a value this build knows.
    ///
    /// A false result is not necessarily an error - a newer server may send a
    /// value added after this SDK was built. It IS a reason not to treat it as
    /// equivalent to any known value.
    pub fn is_known(&self) -> bool {
        !matches!(self, Self::Unknown(_))
    }
}

impl From<String> for AuthZenOperationalState {
    fn from(v: String) -> Self {
        match v.as_str() {
            "ALLOW" => Self::Allow,
            "DENY" => Self::Deny,
            "CHALLENGE" => Self::Challenge,
            "ERROR" => Self::Error,
            _ => Self::Unknown(v),
        }
    }
}

impl From<AuthZenOperationalState> for String {
    fn from(v: AuthZenOperationalState) -> Self {
        v.as_str().to_string()
    }
}

impl std::fmt::Display for AuthZenOperationalState {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.write_str(self.as_str())
    }
}

/// A closed set of values the server may send.
///
/// The `Unknown` variant is not a failure mode, it is a ROUND TRIP: a value a
/// newer server added after this build survives decode, re-encode and logging
/// intact instead of collapsing onto a neighbouring constant. It is, however,
/// a reason not to branch on the value as though it were one of the known
/// ones - use [`AuthZenReasonCode::is_known`].
///
/// `#[non_exhaustive]` because `Unknown` does not make this enum additive
/// for a downstream crate. A match over the known variants plus
/// `Unknown(_)` is exhaustive TODAY, and stops compiling the moment the
/// artifact gains a value - which is exactly what ADR-065 does at v11.
/// With the attribute, that same match needs a `_` arm and a new value is
/// a minor release rather than a breaking one.
#[derive(Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(from = "String", into = "String")]
#[non_exhaustive]
pub enum AuthZenReasonCode {
    /// `permitted`
    Permitted,
    /// `approval_required`
    ApprovalRequired,
    /// `explicit_constraint`
    ExplicitConstraint,
    /// `no_matching_permission`
    NoMatchingPermission,
    /// `unknown_constraint`
    UnknownConstraint,
    /// `unknown_permission`
    UnknownPermission,
    /// `unknown_requirement`
    UnknownRequirement,
    /// `invalid_input`
    InvalidInput,
    /// `evaluation_error`
    EvaluationError,
    /// `unsupported_obligation`
    UnsupportedObligation,
    /// `obligation_conflict`
    ObligationConflict,
    /// `unknown_action`
    UnknownAction,
    /// `unknown_realm`
    UnknownRealm,
    /// `schema_violation`
    SchemaViolation,
    /// `delegation_depth_exceeded`
    DelegationDepthExceeded,
    /// `budget_exhausted`
    BudgetExhausted,
    /// `binding_mismatch`
    BindingMismatch,
    /// `approval_unsatisfiable`
    ApprovalUnsatisfiable,
    /// `approval_expired`
    ApprovalExpired,
    /// `authoring_rejected`
    AuthoringRejected,
    /// A value this build does not know, carried verbatim.
    Unknown(String),
}

impl AuthZenReasonCode {
    /// Every wire value this build knows, in artifact order.
    ///
    /// This is the set a refusal names in its `supported` list, so it is the
    /// list a diagnostic should print rather than one written beside it.
    pub const KNOWN_WIRE_VALUES: &'static [&'static str] = &[
        "permitted",
        "approval_required",
        "explicit_constraint",
        "no_matching_permission",
        "unknown_constraint",
        "unknown_permission",
        "unknown_requirement",
        "invalid_input",
        "evaluation_error",
        "unsupported_obligation",
        "obligation_conflict",
        "unknown_action",
        "unknown_realm",
        "schema_violation",
        "delegation_depth_exceeded",
        "budget_exhausted",
        "binding_mismatch",
        "approval_unsatisfiable",
        "approval_expired",
        "authoring_rejected",
    ];

    /// The wire value.
    pub fn as_str(&self) -> &str {
        match self {
            Self::Permitted => "permitted",
            Self::ApprovalRequired => "approval_required",
            Self::ExplicitConstraint => "explicit_constraint",
            Self::NoMatchingPermission => "no_matching_permission",
            Self::UnknownConstraint => "unknown_constraint",
            Self::UnknownPermission => "unknown_permission",
            Self::UnknownRequirement => "unknown_requirement",
            Self::InvalidInput => "invalid_input",
            Self::EvaluationError => "evaluation_error",
            Self::UnsupportedObligation => "unsupported_obligation",
            Self::ObligationConflict => "obligation_conflict",
            Self::UnknownAction => "unknown_action",
            Self::UnknownRealm => "unknown_realm",
            Self::SchemaViolation => "schema_violation",
            Self::DelegationDepthExceeded => "delegation_depth_exceeded",
            Self::BudgetExhausted => "budget_exhausted",
            Self::BindingMismatch => "binding_mismatch",
            Self::ApprovalUnsatisfiable => "approval_unsatisfiable",
            Self::ApprovalExpired => "approval_expired",
            Self::AuthoringRejected => "authoring_rejected",
            Self::Unknown(v) => v.as_str(),
        }
    }

    /// Whether this is a value this build knows.
    ///
    /// A false result is not necessarily an error - a newer server may send a
    /// value added after this SDK was built. It IS a reason not to treat it as
    /// equivalent to any known value.
    pub fn is_known(&self) -> bool {
        !matches!(self, Self::Unknown(_))
    }
}

impl From<String> for AuthZenReasonCode {
    fn from(v: String) -> Self {
        match v.as_str() {
            "permitted" => Self::Permitted,
            "approval_required" => Self::ApprovalRequired,
            "explicit_constraint" => Self::ExplicitConstraint,
            "no_matching_permission" => Self::NoMatchingPermission,
            "unknown_constraint" => Self::UnknownConstraint,
            "unknown_permission" => Self::UnknownPermission,
            "unknown_requirement" => Self::UnknownRequirement,
            "invalid_input" => Self::InvalidInput,
            "evaluation_error" => Self::EvaluationError,
            "unsupported_obligation" => Self::UnsupportedObligation,
            "obligation_conflict" => Self::ObligationConflict,
            "unknown_action" => Self::UnknownAction,
            "unknown_realm" => Self::UnknownRealm,
            "schema_violation" => Self::SchemaViolation,
            "delegation_depth_exceeded" => Self::DelegationDepthExceeded,
            "budget_exhausted" => Self::BudgetExhausted,
            "binding_mismatch" => Self::BindingMismatch,
            "approval_unsatisfiable" => Self::ApprovalUnsatisfiable,
            "approval_expired" => Self::ApprovalExpired,
            "authoring_rejected" => Self::AuthoringRejected,
            _ => Self::Unknown(v),
        }
    }
}

impl From<AuthZenReasonCode> for String {
    fn from(v: AuthZenReasonCode) -> Self {
        v.as_str().to_string()
    }
}

impl std::fmt::Display for AuthZenReasonCode {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.write_str(self.as_str())
    }
}

/// One immutable threshold clause: a quorum of distinct approvers drawn from
/// a named eligible set. It is named here rather than inlined under
/// approval_requirement so it corresponds one-to-one with the Go
/// ApprovalClause, which is what lets the drift guard compare it and every
/// SDK generate it as a type rather than an anonymous shape.
#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct AuthZenApprovalClause {
    pub quorum: i64,

    pub eligible: Vec<AuthZenIdentifier>,
}

impl AuthZenApprovalClause {
    /// Builds a value carrying every member the contract requires.
    ///
    /// Optional members start empty and are set by assignment, so a member
    /// added to the contract later becomes a compile error at NO call site
    /// that did not want it - which is the point of not deriving `Default`
    /// here.
    pub fn new(quorum: i64, eligible: Vec<AuthZenIdentifier>) -> Self {
        Self { quorum, eligible }
    }
}

impl AuthZenApprovalClause {
    /// Reports whether this value carries what the server requires.
    ///
    /// `at` is the JSON Pointer this value sits at in the envelope, so a
    /// refusal names the same member the server would name. Pass `""` at the
    /// root.
    pub fn validate(&self, at: &str) -> Result<(), AuthZenError> {
        if self.eligible.is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::MalformedEnvelope,
                "eligible needs at least 1 entry",
            )
            .at(&format!("{at}/eligible")));
        }
        for (i, v) in self.eligible.iter().enumerate() {
            v.validate(&format!("{at}/eligible/{i}"))?;
        }
        Ok(())
    }
}

/// A conjunction of immutable threshold clauses. Clauses are never collapsed
/// by pool intersection or union.
#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct AuthZenApprovalRequirement {
    pub all_of: Vec<AuthZenApprovalClause>,

    pub separation_of_duties: bool,

    pub expires_at: String,
}

impl AuthZenApprovalRequirement {
    /// Builds a value carrying every member the contract requires.
    ///
    /// Optional members start empty and are set by assignment, so a member
    /// added to the contract later becomes a compile error at NO call site
    /// that did not want it - which is the point of not deriving `Default`
    /// here.
    pub fn new(
        all_of: Vec<AuthZenApprovalClause>,
        separation_of_duties: bool,
        expires_at: impl Into<String>,
    ) -> Self {
        Self {
            all_of,
            separation_of_duties,
            expires_at: expires_at.into(),
        }
    }
}

impl AuthZenApprovalRequirement {
    /// Reports whether this value carries what the server requires.
    ///
    /// `at` is the JSON Pointer this value sits at in the envelope, so a
    /// refusal names the same member the server would name. Pass `""` at the
    /// root.
    pub fn validate(&self, at: &str) -> Result<(), AuthZenError> {
        if self.all_of.is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::MalformedEnvelope,
                "all_of needs at least 1 entry",
            )
            .at(&format!("{at}/all_of")));
        }
        for (i, v) in self.all_of.iter().enumerate() {
            v.validate(&format!("{at}/all_of/{i}"))?;
        }
        if self.expires_at.is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::IncompleteEvaluation,
                "expires_at is required",
            )
            .at(&format!("{at}/expires_at")));
        }
        Ok(())
    }
}

/// The AuthZEN action object.
#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct AuthZenAction {
    pub name: String,

    #[serde(default, skip_serializing_if = "AttributeMap::is_empty")]
    pub properties: AttributeMap,
}

impl AuthZenAction {
    /// Builds a value carrying every member the contract requires.
    ///
    /// Optional members start empty and are set by assignment, so a member
    /// added to the contract later becomes a compile error at NO call site
    /// that did not want it - which is the point of not deriving `Default`
    /// here.
    pub fn new(name: impl Into<String>) -> Self {
        Self {
            name: name.into(),
            properties: AttributeMap::new(),
        }
    }
}

impl AuthZenAction {
    /// Reports whether this value carries what the server requires.
    ///
    /// `at` is the JSON Pointer this value sits at in the envelope, so a
    /// refusal names the same member the server would name. Pass `""` at the
    /// root.
    pub fn validate(&self, at: &str) -> Result<(), AuthZenError> {
        if self.name.is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::IncompleteEvaluation,
                "name is required",
            )
            .at(&format!("{at}/name")));
        }
        self.properties.validate(&format!("{at}/properties"))?;
        Ok(())
    }
}

/// The plural envelope: a shared subject, action, resource and context at the
/// top level, with one entry per decision. The number of decisions is fixed
/// by the MAPPING, never by argument data, so an empty evaluations array is
/// malformed rather than a request for zero decisions.
#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct AuthZenBulk {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub subject: Option<AuthZenSubject>,

    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub action: Option<AuthZenAction>,

    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub resource: Option<AuthZenResource>,

    #[serde(default, skip_serializing_if = "AttributeMap::is_empty")]
    pub context: AttributeMap,

    pub evaluations: Vec<AuthZenRequest>,
}

impl AuthZenBulk {
    /// Builds a value carrying every member the contract requires.
    ///
    /// Optional members start empty and are set by assignment, so a member
    /// added to the contract later becomes a compile error at NO call site
    /// that did not want it - which is the point of not deriving `Default`
    /// here.
    pub fn new(evaluations: Vec<AuthZenRequest>) -> Self {
        Self {
            subject: None,
            action: None,
            resource: None,
            context: AttributeMap::new(),
            evaluations,
        }
    }
}

impl AuthZenBulk {
    /// Reports whether this value carries what the server requires.
    ///
    /// `at` is the JSON Pointer this value sits at in the envelope, so a
    /// refusal names the same member the server would name. Pass `""` at the
    /// root.
    pub fn validate(&self, at: &str) -> Result<(), AuthZenError> {
        if let Some(v) = self.subject.as_ref() {
            v.validate(&format!("{at}/subject"))?;
        }
        if let Some(v) = self.action.as_ref() {
            v.validate(&format!("{at}/action"))?;
        }
        if let Some(v) = self.resource.as_ref() {
            v.validate(&format!("{at}/resource"))?;
        }
        self.context.validate(&format!("{at}/context"))?;
        if self.evaluations.is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::MalformedEnvelope,
                "evaluations needs at least 1 entry",
            )
            .at(&format!("{at}/evaluations")));
        }
        for (i, v) in self.evaluations.iter().enumerate() {
            v.validate(&format!("{at}/evaluations/{i}"))?;
        }
        Ok(())
    }
}

/// The top level. Exactly two members are defined and exactly one may be
/// PRESENT. Presence is decided on the KEY SET, not on a decoded pointer, so
/// {"evaluation": {...}, "evaluations": null} carries both declared members
/// and is malformed.
#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct AuthZenEnvelope {
    /// The singular member. Unlike a plural entry it has no shared base to
    /// inherit from, so it must carry its own subject, action and resource.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub evaluation: Option<AuthZenRequest>,

    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub evaluations: Option<AuthZenBulk>,
}

impl AuthZenEnvelope {
    /// Reports whether this value carries what the server requires.
    ///
    /// `at` is the JSON Pointer this value sits at in the envelope, so a
    /// refusal names the same member the server would name. Pass `""` at the
    /// root.
    pub fn validate(&self, at: &str) -> Result<(), AuthZenError> {
        let mut present = 0;
        if self.evaluation.is_some() {
            present += 1;
        }
        if self.evaluations.is_some() {
            present += 1;
        }
        if present != 1 {
            return Err(AuthZenError::new(
                AuthZenErrorCode::MalformedEnvelope,
                format!("exactly one of evaluation or evaluations must be present, {present} are"),
            )
            .at(at));
        }
        if let Some(v) = self.evaluation.as_ref() {
            if v.action.is_none() {
                return Err(AuthZenError::new(
                    AuthZenErrorCode::IncompleteEvaluation,
                    "evaluation has no action; it has no shared base to inherit one from",
                )
                .at(&format!("{at}/evaluation/action")));
            }
        }
        if let Some(v) = self.evaluation.as_ref() {
            if v.resource.is_none() {
                return Err(AuthZenError::new(
                    AuthZenErrorCode::IncompleteEvaluation,
                    "evaluation has no resource; it has no shared base to inherit one from",
                )
                .at(&format!("{at}/evaluation/resource")));
            }
        }
        if let Some(v) = self.evaluation.as_ref() {
            if v.subject.is_none() {
                return Err(AuthZenError::new(
                    AuthZenErrorCode::IncompleteEvaluation,
                    "evaluation has no subject; it has no shared base to inherit one from",
                )
                .at(&format!("{at}/evaluation/subject")));
            }
        }
        if let Some(v) = self.evaluation.as_ref() {
            v.validate(&format!("{at}/evaluation"))?;
        }
        if let Some(v) = self.evaluations.as_ref() {
            v.validate(&format!("{at}/evaluations"))?;
        }
        Ok(())
    }
}

/// The structured refusal body, returned when a request could not be
/// EVALUATED. It is a separate shape from the response rather than an extra
/// member on it, because a refusal is not a decision: a response carrying
/// decision=false says the request was evaluated and denied, and returning
/// that for a request that was never evaluated would make 'denied' and
/// 'unevaluable' the same event in every audit and every client branch.
#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
pub struct AuthZenError {
    pub code: AuthZenErrorCode,

    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub pointer: Option<String>,

    pub message: String,

    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub supported: Vec<String>,

    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub request_id: Option<String>,
}

impl AuthZenError {
    /// Builds a value carrying every member the contract requires.
    ///
    /// Optional members start empty and are set by assignment, so a member
    /// added to the contract later becomes a compile error at NO call site
    /// that did not want it - which is the point of not deriving `Default`
    /// here.
    pub fn new(code: AuthZenErrorCode, message: impl Into<String>) -> Self {
        Self {
            code,
            pointer: None,
            message: message.into(),
            supported: Vec::new(),
            request_id: None,
        }
    }
}

impl AuthZenError {
    /// Reports whether this value carries what the server requires.
    ///
    /// `at` is the JSON Pointer this value sits at in the envelope, so a
    /// refusal names the same member the server would name. Pass `""` at the
    /// root.
    pub fn validate(&self, at: &str) -> Result<(), AuthZenError> {
        if self.code.as_str().is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::IncompleteEvaluation,
                "code is required",
            )
            .at(&format!("{at}/code")));
        }
        if self.message.is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::IncompleteEvaluation,
                "message is required",
            )
            .at(&format!("{at}/message")));
        }
        Ok(())
    }
}

/// One subject-action-resource-context evaluation. Every member is
/// structurally OPTIONAL here because a plural-envelope entry inherits any
/// member it omits from the envelope's shared base. The completeness
/// invariant - that the MERGED entry carries a subject, an action and a
/// resource - is a cross-object property this document cannot express, and
/// AuthZENEnvelope.Project enforces it. A validator that passes this schema
/// has therefore NOT established completeness, which is why the singular
/// member below carries its own required list.
#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct AuthZenRequest {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub subject: Option<AuthZenSubject>,

    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub action: Option<AuthZenAction>,

    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub resource: Option<AuthZenResource>,

    #[serde(default, skip_serializing_if = "AttributeMap::is_empty")]
    pub context: AttributeMap,
}

impl AuthZenRequest {
    /// Reports whether this value carries what the server requires.
    ///
    /// `at` is the JSON Pointer this value sits at in the envelope, so a
    /// refusal names the same member the server would name. Pass `""` at the
    /// root.
    pub fn validate(&self, at: &str) -> Result<(), AuthZenError> {
        if let Some(v) = self.subject.as_ref() {
            v.validate(&format!("{at}/subject"))?;
        }
        if let Some(v) = self.action.as_ref() {
            v.validate(&format!("{at}/action"))?;
        }
        if let Some(v) = self.resource.as_ref() {
            v.validate(&format!("{at}/resource"))?;
        }
        self.context.validate(&format!("{at}/context"))?;
        Ok(())
    }
}

/// The AuthZEN resource object.
#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct AuthZenResource {
    pub r#type: String,

    pub id: String,

    #[serde(default, skip_serializing_if = "AttributeMap::is_empty")]
    pub properties: AttributeMap,
}

impl AuthZenResource {
    /// Builds a value carrying every member the contract requires.
    ///
    /// Optional members start empty and are set by assignment, so a member
    /// added to the contract later becomes a compile error at NO call site
    /// that did not want it - which is the point of not deriving `Default`
    /// here.
    pub fn new(r#type: impl Into<String>, id: impl Into<String>) -> Self {
        Self {
            r#type: r#type.into(),
            id: id.into(),
            properties: AttributeMap::new(),
        }
    }
}

impl AuthZenResource {
    /// Reports whether this value carries what the server requires.
    ///
    /// `at` is the JSON Pointer this value sits at in the envelope, so a
    /// refusal names the same member the server would name. Pass `""` at the
    /// root.
    pub fn validate(&self, at: &str) -> Result<(), AuthZenError> {
        if self.r#type.is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::IncompleteEvaluation,
                "type is required",
            )
            .at(&format!("{at}/type")));
        }
        if self.id.is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::IncompleteEvaluation,
                "id is required",
            )
            .at(&format!("{at}/id")));
        }
        self.properties.validate(&format!("{at}/properties"))?;
        Ok(())
    }
}

/// The AuthZEN reply. `decision` is the collapsed boolean: ALLOW is true and
/// every other state is false. It is the only member an un-negotiated
/// enforcement point receives.
#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct AuthZenResponse {
    pub decision: bool,

    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub context: Option<AuthZenResponseContext>,
}

impl AuthZenResponse {
    /// Builds a value carrying every member the contract requires.
    ///
    /// Optional members start empty and are set by assignment, so a member
    /// added to the contract later becomes a compile error at NO call site
    /// that did not want it - which is the point of not deriving `Default`
    /// here.
    pub fn new(decision: bool) -> Self {
        Self {
            decision,
            context: None,
        }
    }
}

impl AuthZenResponse {
    /// Reports whether this value carries what the server requires.
    ///
    /// `at` is the JSON Pointer this value sits at in the envelope, so a
    /// refusal names the same member the server would name. Pass `""` at the
    /// root.
    pub fn validate(&self, at: &str) -> Result<(), AuthZenError> {
        if let Some(v) = self.context.as_ref() {
            v.validate(&format!("{at}/context"))?;
        }
        Ok(())
    }
}

/// The versioned AxonFlow profile payload. It is present only for a Policy
/// Enforcement Point that NEGOTIATED the profile; one that did not receives
/// the boolean alone, because handing a partial interpretation to a plane
/// that cannot act on it is the failure ADR-065 invariant 12 forbids.
#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct AuthZenResponseContext {
    /// The only value the server sends is `axonflow-authzen-profile-2026-08-29`.
    pub profile: String,

    pub state: AuthZenOperationalState,

    pub category: AuthZenCategory,

    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub reason: Option<AuthZenReasonCode>,

    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub obligations: Vec<AuthZenObligation>,

    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub approval: Option<AuthZenApprovalRequirement>,

    pub decision_id: String,

    pub schema_version: String,
}

impl AuthZenResponseContext {
    /// Builds a value carrying every member the contract requires.
    ///
    /// Optional members start empty and are set by assignment, so a member
    /// added to the contract later becomes a compile error at NO call site
    /// that did not want it - which is the point of not deriving `Default`
    /// here.
    pub fn new(
        profile: impl Into<String>,
        state: AuthZenOperationalState,
        category: AuthZenCategory,
        decision_id: impl Into<String>,
        schema_version: impl Into<String>,
    ) -> Self {
        Self {
            profile: profile.into(),
            state,
            category,
            reason: None,
            obligations: Vec::new(),
            approval: None,
            decision_id: decision_id.into(),
            schema_version: schema_version.into(),
        }
    }
}

impl AuthZenResponseContext {
    /// Reports whether this value carries what the server requires.
    ///
    /// `at` is the JSON Pointer this value sits at in the envelope, so a
    /// refusal names the same member the server would name. Pass `""` at the
    /// root.
    pub fn validate(&self, at: &str) -> Result<(), AuthZenError> {
        if self.profile.is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::IncompleteEvaluation,
                "profile is required",
            )
            .at(&format!("{at}/profile")));
        }
        let v = &self.profile;
        if v.as_str() != "axonflow-authzen-profile-2026-08-29" {
            return Err(AuthZenError::new(
                AuthZenErrorCode::MalformedEnvelope,
                format!("profile must be axonflow-authzen-profile-2026-08-29, got {v:?}"),
            )
            .at(&format!("{at}/profile"))
            .supporting(["axonflow-authzen-profile-2026-08-29"]));
        }
        if self.state.as_str().is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::IncompleteEvaluation,
                "state is required",
            )
            .at(&format!("{at}/state")));
        }
        if self.category.as_str().is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::IncompleteEvaluation,
                "category is required",
            )
            .at(&format!("{at}/category")));
        }
        for (i, v) in self.obligations.iter().enumerate() {
            v.validate(&format!("{at}/obligations/{i}"))?;
        }
        if let Some(v) = self.approval.as_ref() {
            v.validate(&format!("{at}/approval"))?;
        }
        if self.decision_id.is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::IncompleteEvaluation,
                "decision_id is required",
            )
            .at(&format!("{at}/decision_id")));
        }
        if self.schema_version.is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::IncompleteEvaluation,
                "schema_version is required",
            )
            .at(&format!("{at}/schema_version")));
        }
        Ok(())
    }
}

/// The AuthZEN subject object. type and id are canonical identifier
/// components; a display name, an email or a token claim is never one of
/// them.
#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct AuthZenSubject {
    pub r#type: String,

    pub id: String,

    #[serde(default, skip_serializing_if = "AttributeMap::is_empty")]
    pub properties: AttributeMap,
}

impl AuthZenSubject {
    /// Builds a value carrying every member the contract requires.
    ///
    /// Optional members start empty and are set by assignment, so a member
    /// added to the contract later becomes a compile error at NO call site
    /// that did not want it - which is the point of not deriving `Default`
    /// here.
    pub fn new(r#type: impl Into<String>, id: impl Into<String>) -> Self {
        Self {
            r#type: r#type.into(),
            id: id.into(),
            properties: AttributeMap::new(),
        }
    }
}

impl AuthZenSubject {
    /// Reports whether this value carries what the server requires.
    ///
    /// `at` is the JSON Pointer this value sits at in the envelope, so a
    /// refusal names the same member the server would name. Pass `""` at the
    /// root.
    pub fn validate(&self, at: &str) -> Result<(), AuthZenError> {
        if self.r#type.is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::IncompleteEvaluation,
                "type is required",
            )
            .at(&format!("{at}/type")));
        }
        if self.id.is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::IncompleteEvaluation,
                "id is required",
            )
            .at(&format!("{at}/id")));
        }
        self.properties.validate(&format!("{at}/properties"))?;
        Ok(())
    }
}

/// A canonical identifier. Display names, emails, token claims, connector
/// names and aliases are never identifiers.
#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct AuthZenIdentifier {
    pub kind: AuthZenIdentifierKind,

    pub r#type: String,

    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub qualifier: Option<String>,

    pub local: String,
}

impl AuthZenIdentifier {
    /// Builds a value carrying every member the contract requires.
    ///
    /// Optional members start empty and are set by assignment, so a member
    /// added to the contract later becomes a compile error at NO call site
    /// that did not want it - which is the point of not deriving `Default`
    /// here.
    pub fn new(
        kind: AuthZenIdentifierKind,
        r#type: impl Into<String>,
        local: impl Into<String>,
    ) -> Self {
        Self {
            kind,
            r#type: r#type.into(),
            qualifier: None,
            local: local.into(),
        }
    }
}

impl AuthZenIdentifier {
    /// Reports whether this value carries what the server requires.
    ///
    /// `at` is the JSON Pointer this value sits at in the envelope, so a
    /// refusal names the same member the server would name. Pass `""` at the
    /// root.
    pub fn validate(&self, at: &str) -> Result<(), AuthZenError> {
        if self.kind.as_str().is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::IncompleteEvaluation,
                "kind is required",
            )
            .at(&format!("{at}/kind")));
        }
        if self.r#type.is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::IncompleteEvaluation,
                "type is required",
            )
            .at(&format!("{at}/type")));
        }
        if self.local.is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::IncompleteEvaluation,
                "local is required",
            )
            .at(&format!("{at}/local")));
        }
        Ok(())
    }
}

/// One typed instruction owned by a named enforcement component.
#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct AuthZenObligation {
    pub r#type: AuthZenObligationType,

    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub target: Option<String>,

    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    pub params: BTreeMap<String, String>,

    pub mandatory: bool,

    pub source_policy: String,

    pub schema_version: i64,
}

impl AuthZenObligation {
    /// Builds a value carrying every member the contract requires.
    ///
    /// Optional members start empty and are set by assignment, so a member
    /// added to the contract later becomes a compile error at NO call site
    /// that did not want it - which is the point of not deriving `Default`
    /// here.
    pub fn new(
        r#type: AuthZenObligationType,
        mandatory: bool,
        source_policy: impl Into<String>,
        schema_version: i64,
    ) -> Self {
        Self {
            r#type,
            target: None,
            params: BTreeMap::new(),
            mandatory,
            source_policy: source_policy.into(),
            schema_version,
        }
    }
}

impl AuthZenObligation {
    /// Reports whether this value carries what the server requires.
    ///
    /// `at` is the JSON Pointer this value sits at in the envelope, so a
    /// refusal names the same member the server would name. Pass `""` at the
    /// root.
    pub fn validate(&self, at: &str) -> Result<(), AuthZenError> {
        if self.r#type.as_str().is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::IncompleteEvaluation,
                "type is required",
            )
            .at(&format!("{at}/type")));
        }
        if let Some(v) = self.target.as_ref() {
            if v.chars().count() < 1 {
                return Err(AuthZenError::new(
                    AuthZenErrorCode::IncompleteEvaluation,
                    "target needs at least 1 character",
                )
                .at(&format!("{at}/target")));
            }
        }
        if self.source_policy.is_empty() {
            return Err(AuthZenError::new(
                AuthZenErrorCode::IncompleteEvaluation,
                "source_policy is required",
            )
            .at(&format!("{at}/source_policy")));
        }
        Ok(())
    }
}