Module payload 

The data contracts the reference passes between the configuration surface, the block hook, and the response-side pass.

• BlockPayload is the reference on_block payload, key for key (build_block_payload, which stays facade-side next to the redaction it runs the path through).
• RequestBits / ResponseBits are the plain views the response processor reads and the adapter fill in; ResponseModifierFn is the reference custom_response_modifier seam over them.

The types live in the engine so the unified SecurityConfig surface (the next slice of the fieldization train) can type every hook field without reaching into a framework layer; the facade re-exports them under their historical paths.

Structs

BlockPayload

The reference block payload, key for key (build_block_payload). path arrives pre-redacted; status_code is None on the passive-mode path, where no response is ever sent.

RequestBits

The plain request view the response-side pass reads: method, path, resolved client identity, and the Origin header when the request carried one.

ResponseBits

The mutable response view the response-side pass and the custom_response_modifier seam write.

Constants

ON_BLOCK_EXCLUDED_CHECK_NAMES

The check names the reference never fires the block hook for (ON_BLOCK_EXCLUDED_CHECK_NAMES): the two application-authored checks and the HTTPS redirect, which is not a block.

Type Aliases

OnBlockHook

The on_block callback type: sync, best-effort, never fatal (SecurityConfig.on_block).

OnErrorFn

The on_error callback type (SecurityConfig.on_error, the reference Callable[[str, BaseException, dict], None]).

ResponseModifierFn

The custom_response_modifier callback type (SecurityConfig.custom_response_modifier).