Module config 

Configuration schema v1 for the gateway (frozen domain vocabulary).

The types in this module model the source form of a dwara configuration file. Compilation into a runtime snapshot is a later concern (config-compile pipeline); here we define strict, self-describing types:

• every struct rejects unknown fields (deny_unknown_fields),
• field order follows declaration order on serialization,
• the root type Gateway exports a JSON Schema via schemars.

YAML <-> typed conversions are provided by parse_gateway (YAML text to typed value, with path-precise error messages) and gateway_to_yaml (typed value back to normalized YAML text). Round-trip guarantee: parse_gateway(gateway_to_yaml(cfg)) always succeeds and yields a value that serializes to the identical normalized text (stable normalization, not byte-identity with the original input).

Submodules carry the parts of the config CONTRACT that are more than serde shapes: credentials defines the credential selector/stored-hash formats every credential holder must agree on plus the ${...} secret-reference grammar (DW-045), limits the numeric bounds validation enforces, net the trusted-proxy IP/CIDR grammar shared by validation and the runtime matchers, versioning the HTTP-date and media-type grammar of the API versioning aids (DW-048), and transforms the JSON-pointer grammar and shapes of the request/response transforms and security-header injection (DW-028). cache carries the route-scoped response-caching grammar (DW-037), and ai the AI provider/model grammar of the provider-adapter pack (DW-075).

Modules

ai

The ai: configuration block (DW-075): AI provider adapters.

cache

Route-scoped response caching grammar (DW-037, feature analysis 5-Protocol “Response caching”): the config shape of a route’s cache policy and the compiled form the dataplane’s response cache consumes.

credentials

Credential hashing: the selector and stored-hash formats of the credential schema contract (DW-018/DW-019, peppered per #124).

includes

Config includes and file-based profiles (CFG-01, #180).

limits

Schema-validation limits: numeric bounds the config compiler enforces and runtime code must respect.

mesh

Service mesh config schema (DW-107).

net

Minimal IP/CIDR support for trusted-proxy and IP-ACL matching (DW-009/DW-020).

quotas

Pure quota types shared by the state-store and Redis-backed quota implementations (DW-033, DW-155).

ssrf

SSRF egress filter (SEC-13).

transforms

Request/response transformation grammar (DW-028): the config shapes for header/query manipulation and JSON-pointer body transforms, the shared JSON-Pointer grammar validation and the runtime agree on, and the security-header injection policy (feature analysis 4.12 and the 5-Security “security header injection” row).

versioning

API-versioning grammar (DW-048): the two shared vocabularies the versioning aids need beyond serde shapes — HTTP-dates (RFC 9110 IMF-fixdate) and media types (RFC 9110 type/subtype tokens).

Structs

AcmeConfig

SEC-02: ACME (Let’s Encrypt) certificate automation configuration. The gateway acts as an ACME client: orders certificates for the configured domains, completes the challenge (HTTP-01 or TLS-ALPN-01), and installs the issued certificates into the hot-reloadable TLS termination/SNI resolver. Renewal runs automatically before expiry.

ActiveHealth

Active health check knobs (DW-013). A block with no keys enables HTTP probes with the defaults.

AdaptiveRateLimit

Adaptive + origin-driven rate-limit tuning (DW-089, policies[].adaptive): an EWMA of upstream error rate and latency dynamically scales this policy’s rate-limit quotas at check time (the factor multiplies the effective cost of each request against the GCRA bucket), and upstream-originated signals trigger an immediate backoff. The factor is bounded [min_factor, max_factor] (never 0, never unbounded); tightening under stress is faster than relaxing when healthy (asymmetric, so the gateway errs toward protecting upstreams). origin_signals selects which upstream response signals the controller honors (currently retry_after).

AdminApiToken

One hashed API token with a role.

AdminApiTokensConfig

SEC-01: API token authentication for the admin API. Tokens are hashed (SHA-256) at rest; the config lists token hashes, not plaintext tokens. A client presents a token via Authorization: Bearer <token>.

AdminAuditConfig

SEC-01: Admin audit log configuration.

AdminConfig

Admin listener configuration (DW-022).

AdminRbacBinding

One certificate-fingerprint-to-role binding.

AdminRbacConfig

SEC-01: Admin RBAC configuration. Maps client certificate fingerprints to roles. A valid certificate with no binding is denied (fail-closed).

AdminTlsConfig

mTLS material for the admin listener (DW-022). Unlike dataplane listeners there is no mode: the admin listener always terminates TLS and always requires a client certificate chaining to client_ca_file.

AdmissionQueue

Bounded admission queue config (DW-053, gateway.admission_queue).

AgentPrincipal

AI-16 (#204): First-class agent principal metadata. Attached to a Consumer with consumer_type: agent to carry agent-specific attribution and permission data.

AnalyticsConfig

The embedded analytics store config (DW-043, gateway.analytics).

AnalyticsDimension

One custom analytics dimension (DW-043, analytics.dimensions[]).

AnalyticsExports

Scheduled usage-report exports (DW-120, analytics.exports).

AnalyticsInsights

ML traffic insights config (DW-092, analytics.insights).

AnalyticsLiveSketches

Live in-process sketches config (DW-092, analytics.live_sketches).

AnalyticsReplayCapture

Replay time-travel debugging capture config (DW-102, analytics.replay_capture). Opt-in capture of request detail (redacted headers, auth identity) into the raw analytics table for offline replay against candidate configs. The capture reuses the existing fire-and-forget analytics writer path and the existing PII redaction patterns (ai::redaction); body capture is OFF by default (PII risk).

AnalyticsRetention

Per-granularity retention (DW-043, analytics.retention).

AnalyticsSampledDegradation

Sampled degradation config (REL-10, #221). See AnalyticsConfig::sampled_degradation.

AnalyticsStreamConfig

Real-time access-record stream (DW-121, gateway.analytics_stream).

AnalyticsStreamKafka

The Kafka batch sink (SCALE-08, #187, gateway.analytics_stream.sink.kafka). Produces each flushed batch as NDJSON messages to a Kafka topic via a Kafka REST Proxy (HTTP-based, no native client dependency). The REST Proxy endpoint receives the batch as an HTTP POST with the Content-Type: application/vnd.kafka.binary.v2+json media type; each NDJSON line becomes a Kafka message value (base64 encoded per the REST Proxy spec). TLS is via https://; SASL auth is via headers (e.g. Authorization: Basic ...).

AnalyticsStreamWebhook

The webhook batch sink (DW-121, gateway.analytics_stream.sink.webhook). Same URL/header/retry grammar as gateway.webhooks[] (DW-044) — the delivery engine is shared — minus the events filter (a record stream has no kinds to filter: every record goes to the sink).

AnomalyPolicy

Anomaly scoring policy (DW-090, policies[].anomaly): lightweight statistical detection of abusive request patterns. Each enabled signal produces a normalized [0, 1] score from the request shape (header entropy, header count/bytes, path length/depth, query count, body size, unusual method); the overall score is the average of the configured signals’ scores. A score at or above threshold is blocked (403 anomaly_blocked) unless dry_run is set.

Authz

Route-level authorization rules (DW-020, feature analysis 4.7).

BodySchema

A minimal JSON-Schema subset (DW-047) for request-body validation.

BreakerConfig

Per-upstream circuit breaker knobs (DW-015). All fields default; a breaker: block with no keys enables the breaker with the defaults.

CanaryAnalysis

Auto-canary analysis (DW-091): metrics-driven promotion/rollback of canary split weights. A background controller compares the canary side against the baseline on error rate or latency; on regression it rolls the canary weight back (toward 0), on success it promotes (toward the total weight). Severe regression (>2x the rollback threshold) triggers an immediate rollback to 0. The total weight stays constant: when the canary weight changes, the baseline absorbs the difference, preserving the hash distribution for existing sessions (the DW-040 invariant). Weight changes are TRANSIENT (a Generation swap) and revert on config reload.

CanaryRule

One canary analysis rule (DW-091): a metric to compare and the threshold that triggers the rule.

CertPin

A single certificate pin: the SHA-256 hash of the upstream certificate’s SubjectPublicKeyInfo (SPKI), as lowercase hex (64 chars). Pinning the SPKI (rather than the full certificate) allows rotation of the leaf certificate as long as the key pair is unchanged.

CertPinningConfig

DW-109 / SEC-04: certificate pinning configuration for an upstream. Holds a list of allowed SPKI SHA-256 hashes (lowercase hex, 64 chars). A peer cert whose SPKI hash matches ANY entry is accepted; otherwise the connection is rejected (fail-closed).

CompiledContentTypeFilter

Snapshot-compiled form of a compression policy’s content-type prefix lists (DW-027): every include/exclude entry trimmed and lowercased once at snapshot-compile time; the request path compares the response’s (lowercased) media type against the precomputed prefixes instead of re-normalizing config strings per response. Same placement rationale as CompiledCorsOrigins.

CompiledCorsOrigins

Snapshot-compiled form of a cors.allowed_origins list (DW-027): the wildcard flag plus the normalized form of every specific entry, computed once at snapshot-compile time so the request path never re-parses config strings (per-request work is the request’s own origin only). Lives in config beside normalize_origin because the compiled set is the grammar’s runtime consumer: snapshot builds it into the route table (snapshot::RouteTable) and dataplane::cors matches against it. Validation has already rejected entries that do not normalize, so compilation drops nothing on any publishable config; entries that would fail normalization are skipped exactly as the pre-compiled matcher was.

CompiledDeprecation

Snapshot-compiled form of a Deprecation block (DW-048): the emitted header VALUES, precomputed at snapshot-compile time — the HTTP-date strings are parsed once here (never per response) and the RFC 9745 structured date is rendered from the parsed seconds. Lives in config beside CompiledCorsOrigins for the same reason: snapshot builds it into the route table and dataplane::versioning consumes it. Validation has already rejected unparseable dates, so compilation drops nothing on any publishable config; entries that would fail are skipped exactly like the CORS matcher’s fallback.

Compression

Route-scoped response compression policy (DW-027, feature analysis 4.13).

ConfigConvergenceConfig

Config convergence config (DW-054, gateway.config_convergence).

ConfigError

Error produced when a configuration document fails to parse.

Consumer

Identity of an API caller (app/team/user); owns credentials, quotas, and the analytics identity.

ConsumerQuotas

Per-consumer request budgets (DW-033): daily and/or monthly request caps in fixed UTC calendar windows, counted by the state store’s quota counters. At least one budget must be set and every set budget must be > 0 (validation); a budget of 0 would deny the consumer’s first request and is expressed by omitting the field instead.

Cors

Route-scoped CORS policy (DW-027, feature analysis 4.14).

CrsRule

SEC-08 (#212): A single OWASP CRS-compatible WAF rule. Each rule has a numeric ID (CRS convention: 9xxxx), a severity level, a phase (1 = request headers, 2 = request body), a list of tags, a regex pattern, and the inspection targets to apply the pattern to. Rules are evaluated in order; matching rules add their severity to the request’s anomaly score. The request is blocked when the score exceeds the configured threshold.

Deprecation

Route-level API deprecation policy (DW-048): automates the RFC deprecation signal headers on every response of the route.

DnsDiscovery

DNS-based dynamic upstream discovery (DW-042): when present on an upstream, a background discovery task resolves hostname via DNS, watches the record TTL, and re-resolves when the TTL expires (or at refresh_interval_s, whichever comes first), updating the upstream’s endpoint set live — without a restart. The endpoints field becomes the INITIAL/fallback set: used until the first resolution completes and as a fallback when DNS fails and fail_open is true. When absent, endpoints remain static (the current behavior — no change).

Endpoint

One address:port inside an upstream.

FaultAbort

Abort fault injection (DW-062): short-circuit the request with a configured HTTP status, sampled by percentage.

FaultDelay

Delay fault injection (DW-062): inject a fixed delay before forwarding the request, sampled by percentage.

FaultInjection

Fault injection configuration (DW-062, routes[].fault_injection). Percentage-based delays and aborts for chaos testing. A delay injects a fixed latency before the request is forwarded; an abort short-circuits with a configured status without contacting the upstream. Both may be present simultaneously — the abort is evaluated first, and if it does not fire, the delay is applied.

FilterChainConfig

SCALE-12 (#191): per-phase dry-run configuration. When dry-run is enabled for a phase, the phase executes its checks but does NOT enforce (reject/block). Failures are logged as warnings and the request continues. This enables safe policy rollout: enable a phase in dry-run mode, observe the would-be rejections, then switch to enforcement.

FleetConfig

Fleet operations config (DW-098, gateway.fleet).

FleetUpgradeConfig

Rolling-upgrade and version-skew policy (DW-098, gateway.fleet.upgrade).

FleetUpgradeOrderEntry

A label-selector entry in the upgrade order list.

Gateway

Root of a dwara configuration: one gateway process, N listeners, and one compiled config generation.

GeoipConfig

The GeoIP database config (DW-050, gateway.geoip). One MaxMind- format database serves both country and ASN predicates (a GeoLite2-Country, GeoLite2-ASN, or combined database — whichever subtrees it carries are the ones the rules can use). The file is opened at startup (a failed open is LOUD but non-fatal: the gateway serves with geo lookups resolving UNKNOWN) and hot-reloaded: the watcher swaps the reader when the file changes, with no restart.

GeoipRules

GeoIP allow/deny rules on the effective client IP (DW-050, authorization.geoip). Countries are ISO 3166-1 alpha-2 codes (case-insensitive in config, compared uppercase); ASNs are plain numbers. Evaluation mirrors allowed_consumers/denied_consumers: a denied match rejects (403) regardless of the allow lists; a NON-EMPTY allow list admits only matches; empty allow lists constrain nothing. The UNKNOWN case (unresolvable address, no database) matches neither side.

GlobalWaf

SEC-08 (#212): Global WAF policy with CRS-compatible rules. When enabled, the rules are evaluated on every request (regardless of route-level WAF config). The anomaly score is accumulated across all matching rules; the request is blocked when the score exceeds the threshold. Rule exclusions can disable specific rules by ID or tag. The paranoia level controls which rules are active (1 = default, 2 = more aggressive, 3 = paranoid, 4 = very paranoid).

GraphqlFederation

Federation passthrough config (DP-11, #256, routes[].graphql.federation).

GraphqlPersistedQueries

Persisted-query enforcement config (DW-099, routes[].graphql.persisted_queries).

GraphqlTranslation

REST <-> GraphQL translation config (DW-100, routes[].translation.graphql).

GrpcWeb

Route-scoped gRPC-Web policy (DW-101, routes[].grpc_web).

GrpcWebDescriptor

A .proto descriptor file entry (DW-101, routes[].grpc_web.transcoding.descriptors[]).

GrpcWebTranscoding

gRPC-Web JSON transcoding configuration (DW-101, routes[].grpc_web.transcoding).

HedgeConfig

Request hedging configuration (DW-063, upstreams[].retries.hedge).

HmacAuth

Gateway-wide HMAC request-signing policy (DW-036). The credential itself (key id + secret) lives on a consumer (credentials: [{type: hmac, ...}]); this block carries the VERIFICATION policy that applies to every signed request.

Http2ListenerConfig

HTTP/2 flow-control tuning for a listener (PERF-11, #244, listeners[].http2). Every field is optional; an omitted field keeps the process-wide default from DWARA_H2_* env vars. This allows per-listener tuning for streaming (SSE) workloads where larger windows reduce flow-control stalls on long-lived streams.

IpAcl

IP access control on the effective client IP (DW-020, feature analysis 4.15). Entries are IP addresses (e.g. 10.1.2.3) or CIDRs (e.g. 10.0.0.0/8); anything else fails config validation (the same parser as gateway.trusted_proxies). Evaluation order: the deny list first (a match rejects with 403 regardless of the allow list), then the allow list, then default for IPs matched by neither.

JwtProvider

One JWT verification provider (DW-019).

L4Config

L4 proxying configuration for a tcp or udp listener (DW-103).

LicenseConfig

Enterprise license configuration (DW-032, gateway.license).

LifecycleConfig

API lifecycle management config (DW-110, gateway.lifecycle).

LifecycleJourneyConfig

Journey recorder config (DW-110, gateway.lifecycle.journey).

LifecyclePortalConfig

Developer portal config (DW-110, gateway.lifecycle.portal).

LifecyclePortalSpec

One OpenAPI spec source for the developer portal (DW-110, gateway.lifecycle.portal.specs[]).

LifecycleProfilesConfig

Environment profile overlays config (DW-110, gateway.lifecycle.profiles).

Listener

Entry point: bind address + port + TLS termination (or passthrough) config.

ListenerTls

TLS handling for a listener: terminate at the edge or pass through.

LocalityContext

DW-094 (Ent): the edge’s locality context — its region and zone. Threaded into the balancer at request time to enable locality-aware endpoint selection. When both region and zone are None, the balancer skips locality filtering (the OSS behavior).

Maintenance

Route maintenance mode (DW-041): a per-route availability state that short-circuits every matched request with a gateway-generated 503.

MirrorConfig

Shadow traffic mirroring configuration (DW-062, routes[].mirror). Fire-and-forget duplicate requests to a named mirror upstream; the mirror response is discarded and never impacts the primary request’s latency. A percentage controls sampling.

MockAction

A canned response served without any upstream contact (DW-047, routes[].action.mock). The body comes from either body (an inline string) or body_file (a path relative to the config file directory); exactly one of the two may be set, or neither for an empty body. delay_ms simulates latency (useful for testing timeouts and retries against a mock). Validation rejects a status outside 100..=599, a delay_ms above 30000, and setting both body and body_file.

MtlsConsumerMapping

mTLS client-certificate consumer mapping (DW-035, gateway.mtls_consumer_mapping).

MtlsFingerprintMapping

One fingerprint-to-consumer mapping entry (DW-035, mtls_consumer_mapping.consumers[]).

MtlsForwardHeaders

Identity-forwarding headers for mTLS client auth (DW-035, gateway.mtls_forward_headers).

NameValueMatch

One query-parameter or cookie criterion: the parameter/cookie must be present; when value is given it must equal that exact string.

NanoServiceAction

A WASM route handler (nano-service) action (DW-106, routes[].action with type: nano_service). The gateway loads the named WASM module, calls its handle export with the serialized request (method, path, headers, body), and returns the response the module produces (status, headers, body). No upstream is contacted.

OAuth2ClientCredentials

OAuth2 client-credentials configuration for an upstream (DW-035, upstreams[].oauth2_client_credentials).

OAuth2Mtls

mTLS client certificate for an OAuth2 token endpoint (DW-035, oauth2_client_credentials.mtls).

OidcLoginConfig

SEC-05: OIDC browser login flow configuration for a route. The gateway redirects unauthenticated browser requests to the IdP, exchanges the authorization code for tokens, sets a session cookie, and validates the cookie on subsequent requests.

OidcProvider

One OIDC provider (DW-034): an OpenID Connect issuer whose Bearer tokens are validated by token introspection (RFC 7662) rather than local JWT signature verification. The gateway fetches the issuer’s discovery document ({issuer}/.well-known/openid-configuration) to learn the introspection, revocation, authorization, and token endpoints, then introspects presented Bearer tokens (caching the result keyed by token hash with a configurable TTL). The provider also backs the authorization-code + PKCE relying-party flow, token exchange (RFC 8693), and token revocation (RFC 7009).

OpenApiMeta

OpenAPI import metadata attached to a route (DW-047). No runtime effect; purely for traceability from the generated config back to the source spec operation.

PassiveHealth

Passive health / outlier detection knobs (DW-012). All fields default; a health: block with no keys enables ejection with the defaults.

PathMatch

How a route’s path pattern is interpreted.

PeakEwmaConfig

Peak-EWMA load-balancing tuning (DW-090, upstreams[].peak_ewma). Only consulted when load_balancer: peak_ewma; ignored otherwise.

PluginConfig

A plugin definition (DW-055 / DW-119). Each plugin is either a proxy-wasm .wasm module loaded at startup (wasm) or a compiled-in native Rust filter (native), run on the request pipeline phases it declares. Routes reference plugins by name. Exactly one of wasm or native must be set (validation enforces this).

PluginLimitsConfig

Resource limits for a proxy-wasm plugin (DW-055 decision 4; §9.3).

PluginRegistryConfig

SCALE-12 (#192)/DW-165: plugin registry configuration. When present, signatures of source:-referenced artifacts are verified against the registry’s pinned public keys and resolved artifacts are cached in the registry’s cache directory. This enables fleet-consistent plugin pinning: all gateways in a fleet reference the same registry and get the same signed artifacts.

PluginSourceConfig

SCALE-12 (#192)/DW-165: remote/signed plugin source configuration. The gateway resolves the .wasm artifact at every publish: cache lookup first, then a download from url on a miss, then SHA-256 digest verification (mandatory) and Ed25519 signature verification (when configured) — only then is the artifact loaded. Resolution failures are fail-closed per plugin (Crashed at publish, its routes answer 500), never a partial load.

Policy

Named reusable rule bundle (rate limit, timeouts, …); attachable at several scopes. Plugin-backed phases arrive with the M3 plugin system.

RateLimit

Local GCRA-style rate limit.

RateLimitRule

One rate-limit rule (DW-017): a key selector plus one or more stacked windows. selector names the request attributes that form the counter key (all listed attributes are joined into ONE key, so [ip, route] limits each (client IP, route) pair independently); requests_per carries the sustained rates per window (at least one window must be present); burst is the bucket size (defaults to the window’s request count).

RateRequestsPer

Sustained rates per window (DW-017). At least one field must be set and every set field must be > 0; each set field becomes one stacked GCRA cell (a request must satisfy ALL set windows).

RedisCacheConfig

Distributed Redis-backed response cache config (SCALE-04, #183, gateway.redis_cache, ent feature).

RedisHaConfig

Redis HA and multi-region config (SCALE-11, #248). Embedded in each Redis-backed config block (rate limiter, quotas, cache) to control the connection topology and per-request timeout.

RedisQuotaConfig

Distributed Redis-backed consumer request quotas config (DW-155, gateway.redis_quotas).

RedisRateLimiterConfig

Distributed Redis-backed GCRA rate limiter config (DW-031, gateway.redis_rate_limiter).

RequestLimits

Route-scoped request size limits (DW-027, feature analysis 4.16).

RequestValidation

Route-scoped request-body validation (DW-047, routes[].request_validation).

RetryConfig

Upstream retry knobs (DW-014). All fields default; a retries: block with no keys is equivalent to retries off (attempts defaults to 0).

Route

Match rules (path/host/method/header) plus action and attached policies.

RouteGraphql

Route-scoped GraphQL awareness config (DW-099, routes[].graphql).

RouteMatch

Matching rules for incoming requests.

RouteSlo

Per-route SLO objectives (DW-052, routes[].slo).

RouteWaf

Route-scoped WAF-lite config (DW-051, routes[].waf).

RouteWebsocket

Route-scoped WebSocket policy (DW-039, routes[].websocket).

Service

The logical API being exposed: base path, version, default policies; targets exactly one upstream, or a weighted split of upstreams since DW-040 (canary / blue-green).

ServiceSplit

Weighted traffic split across upstreams (DW-040, services[].split): canary releases and blue-green switches at the SERVICE level — each target is a full upstream (its own endpoints, protocol, health, and balancer), so a canary pool is isolated from the stable one by construction. The pick is a deterministic weighted hash (see Service::split): ratios hold statistically per request and exactly per session when sticky affinity is on.

SniRoute

One SNI-to-upstream routing rule for TLS passthrough.

SoapTranslation

SOAP/XML translation config (DW-100, routes[].translation.soap).

SplitTarget

One weighted target of a service split (DW-040).

StickyAffinity

Cookie affinity for a service (DW-040, services[].sticky).

Timeouts

Timeout hints, in milliseconds.

TlsCertificate

One SNI-scoped certificate pair for TLS termination.

TokenBudget

An AI token budget (DW-078, policies[].token_budget): limits of TOTALS over windows — provider-reported tokens per minute and/or cost per UTC calendar day, enforced per consumer or shared per policy (team). See the ai::budget module docs for the check-then-spend contract.

Translation

Route-scoped protocol translation policy (DW-100, routes[].translation).

Upstream

Load-balancing pool: algorithm, protocol, endpoints.

UpstreamLocality

DW-094 (Ent): locality-aware routing and data residency configuration for an upstream. Controls how the balancer uses endpoint region/ zone fields to filter or prefer endpoints.

UpstreamMtls

SEC-03: upstream mTLS client certificate configuration. Reuses the two-path shape (cert file + key file) proven by the OAuth2 mTLS config (OAuth2Mtls).

UpstreamPoolConfig

DP-03: hyper connection-pool and HTTP/2 tuning for an upstream (upstreams[].pool). Every field is optional; an omitted field keeps hyper-util’s built-in default (the same value the gateway used before this block existed), so the block is purely additive. Validation rejects zero/negative-forbidden values; the runtime clamps nothing beyond the documented bounds.

Webhook

One alert/event webhook target (DW-044, gateway.webhooks[]). Compiled per generation into an events::webhook::WebhookTarget (secret references resolved at compile time, URL decomposed); see that module for the delivery contract.

Enums

AcmeChallenge

ACME challenge type.

AdditionalProperties

The additionalProperties keyword accepts either a boolean or a nested schema; this union models both.

AdminRole

Admin roles.

AgentPermissionLevel

AI-16 (#204): Agent permission levels for first-class agent principals. Mirrors the Permission enum in the MCP module but lives in config for declarative assignment.

AiEndpoint

AI-02: which AI endpoint a route serves. The chat endpoint (the default) uses the full adapter translation pipeline (DW-075). The other endpoints are proxied as a passthrough: the request body is forwarded to the provider’s upstream as-is, and the response is returned as-is. Model governance (allowlist check) still applies using the model field from the request body.

AiIngressDialect

AI-05 (#195): The client-facing request dialect for an AI route. Determines how the gateway parses the incoming request body.

AnalyticsExportFormat

One export output format (DW-120, analytics.exports.formats[]). Closed set: csv, json, parquet_csv.

AnalyticsExportWindow

One export schedule kind (DW-120, analytics.exports.window). Closed set; fixed UTC calendar windows.

AnalyticsStreamSink

The access-record stream’s sink (DW-121, gateway.analytics_stream.sink). Closed set, internally tagged (type: webhook or type: kafka): webhook ships today; kafka (SCALE-08, #187) produces NDJSON batches to a Kafka topic via a Kafka REST Proxy (HTTP-based, no native client dependency). The variant payloads carry their own deny_unknown_fields, so a misspelled knob inside a sink is still a rejected config.

AnomalySignal

One anomaly signal (DW-090). Each produces a normalized [0, 1] sub-score from one request-shape dimension.

CanaryMetric

The metric a canary rule compares (DW-091).

CompressionAlgorithm

One response compression algorithm (DW-027).

ConsumerType

The principal kind of a consumer (DW-113): user (the default — a human or application calling the gateway) or agent (a bot principal with bot credentials, per-agent quotas/token budgets, tool allowlists, and a session audit trail). Agent traffic is identifiable, governable, and billable; the type threads through Identity into analytics for typed attribution.

Credential

One authenticator bound to a consumer: API key, JWT issuer/audience binding, mTLS client-certificate match, or HMAC signing key (DW-036).

DimensionSource

The source of a custom analytics dimension value (DW-093). The default (when source is absent) is DimensionSource::Header, preserving the original DW-043 header-only config shape.

FilterPhase

SCALE-12 (#191): formalized request-pipeline filter phases. The default order is the order the variants are declared (the same order the dataplane has always executed them). Per-route filter_chain overrides can reorder a subset of these phases; phases not listed in an override keep their default relative order.

HashOn

What to hash for consistent-hash load balancers (ip_hash and maglev). DP-07 (#236): extends the hash key source beyond the client IP to support cookie-based sticky sessions and header-based affinity.

IpAclDefault

Fallback decision of an IpAcl for IPs matched by neither list.

ListenerProtocol

LoadBalancer

LocalityMode

DW-094 (Ent): locality routing mode.

OriginSignal

One upstream-originated signal the adaptive controller honors (DW-089).

PathMatchKind

PathRewrite

Path rewrite applied before proxying (DW-010). Exactly one variant per proxy action; there is no rewrite chaining in v1. All variants operate on the path component only — the inbound query string is re-attached untouched.

PluginPhase

The phases a plugin can hook (DW-055, §9.3 phase contract).

ProbeKind

Kind of active health probe.

RateLimitSelector

One attribute of a rate-limit key (DW-017).

RedisTopology

Redis deployment topology (SCALE-11, #248). Controls how the gateway connects to Redis for the distributed rate limiter, quotas, and shared cache. The default single mode uses one Redis URL (the existing behavior). sentinel mode resolves the master through a Sentinel deployment. cluster mode connects to a Redis Cluster.

RouteAction

What the gateway does when a route matches.

TlsMode

TokenBudgetScope

The budget’s key scope (DW-078).

TranslationKind

The protocol translation direction (DW-100, routes[].translation.kind).

UpstreamProtocol

VersionSkewPolicyConfig

The version-skew policy, mirroring the CP/DP cluster_sync::VersionSkewPolicy but living in the config schema (so the gateway config carries it, not just the controller runtime).

ZeroRttPolicy

0-RTT (early data) acceptance policy for HTTP/3 (DW-088).

Constants

ANALYTICS_DEFAULT_RETENTION_MS

Default per-granularity retention (ms), indexed [raw, 1m, 5m, 1h, 1d] — a week of traffic at every granularity a week query wants, bounded disk at the 1-minute grain (DW-043). Lives in config (the lowest consuming domain) so both validation and the analytics store read ONE definition.

CURRENT_CONFIG_VERSION

CFG-03 (#239): the current config schema version. Increment when the schema gains a breaking change (removed fields, renamed fields, changed semantics). The dwara lint command warns when a config’s version is older than this; dwara migrate upgrades configs to this version.

DEFAULT_HMAC_CLOCK_SKEW_SECS

Default hmac_auth.max_clock_skew_secs (±5 minutes, DW-036 §4.6).

DEFAULT_MAINTENANCE_RETRY_AFTER_SECS

Default maintenance.retry_after_secs (DW-041).

DEFAULT_STREAM_BATCH_MAX

Default analytics_stream.batch_max (DW-121): records per flushed batch.

DEFAULT_STREAM_BUFFER

Default analytics_stream.buffer (DW-121): the bounded record channel’s capacity when the block is absent at boot (the stream is always constructed so a live reload can arm it). Lives in config with the retention defaults — the lowest consuming domain — so validation docs, the stream, and the binary read one definition.

DEFAULT_STREAM_FLUSH_MS

Default analytics_stream.flush_ms (DW-121): maximum batch latency.

DEFAULT_STREAM_WEBHOOK_ATTEMPTS

Default analytics_stream.sink.webhook.max_attempts (DW-121).

DEFAULT_STREAM_WEBHOOK_BACKOFF_BASE_MS

Default analytics_stream.sink.webhook.backoff_base_ms (DW-121).

DEFAULT_STREAM_WEBHOOK_BACKOFF_CAP_MS

Default analytics_stream.sink.webhook.backoff_cap_ms (DW-121).

DEFAULT_STREAM_WEBHOOK_TIMEOUT_MS

Default analytics_stream.sink.webhook.timeout_ms (DW-121): a batch carries up to batch_max records, so its budget starts heavier than the alert webhook’s 2000 but stays far under the one-minute ceiling.

DEFAULT_WEBHOOK_ATTEMPTS

Default gateway.webhooks[].max_attempts (DW-044).

DEFAULT_WEBHOOK_BACKOFF_BASE_MS

Default gateway.webhooks[].backoff_base_ms (DW-044).

DEFAULT_WEBHOOK_BACKOFF_CAP_MS

Default gateway.webhooks[].backoff_cap_ms (DW-044).

DEFAULT_WEBHOOK_TIMEOUT_MS

Default gateway.webhooks[].timeout_ms (DW-044): one shared delivery budget, generous for a remote alerting endpoint, small enough that a hung target cannot pile up deliveries.

Functions

gateway_to_yaml

Serialize a Gateway to normalized YAML text.

json_schema

Build the JSON Schema for the root Gateway type.

normalize_origin

Canonical form of one origin (DW-027): lowercase scheme and host, default port dropped, no userinfo, no path/query — the exact string the runtime CORS matcher compares request Origin values against and validation checks config entries with. None when the input is not a well-formed http(s) origin. Lives in config (the lowest consuming domain) so validation (snapshot::validate) and matching (dataplane::cors) share one grammar, the same way net.rs owns the IP/CIDR grammar.

parse_gateway

Parse a YAML configuration document into a Gateway, rejecting invalid input with path-precise error messages.