Module matcher 

Compile Shield config into runtime matchers, limiters, and rules.

Structs

CompiledProfile

A compiled limit tier: the GCRA shaper, the per-window count reported in the RateLimit-Limit header, and the window itself (the fleet-gate epoch length).

CompiledRule

A compiled rate-limit rule.

Enums

KeySource

How a rule derives its limit key.

Phase

Whether a rule can be decided before auth runs, or needs validated claims.

Functions

compile_profile

Compile a single limit profile from its config.

compile_profiles

Compile every named profile.

compile_rules

Compile rules, validating that any pinned profile names an existing tier. Each rule’s phase is derived from its key: a jwt_claim key needs validated claims and runs after auth; every other key runs before auth.

short_hash

A short, stable, non-reversible hash (128-bit hex) of input. Used both to fingerprint rules and to de-identify key values before they reach the shared store, and deterministic across instances so reconciliation keys agree.