Crate dwara_core 

Gateway core: the shared config model, routing types, swappable trait definitions, listener/TLS machinery, and dataplane assembly consumed by the bin/admin/cli crates.

Organization

This crate is organized as a set of domain directories (bounded contexts) behind this facade:

• config — configuration schema and the parse_gateway entry point
• extensions — the OSS/Ent edition boundary as a type boundary
• snapshot — the config compile pipeline (validate -> compile -> publish)
• observability — tracing, metrics, and access logging
• events — the in-process event bus and webhook delivery (DW-044)
• state — SQLite-backed durable state and schema migrations
• security — TLS, authentication, authorization
• resilience — passive health, retries, circuit breaker, adaptive + origin-driven rate-limit tuning (DW-089)
• dataplane — the reverse-proxy request path, its upstreams, and active health probing
• supervision — bounded panic-respawn supervision for accept loops, shared by the bin and admin accept surfaces
• error — the facade-level aggregate error::Error over the domain error types, for boundary propagation

Dependency direction

Dependencies point downward only; a domain may never be depended on by a domain above it:

Domain	May depend on
config	(nothing)
extensions	config
observability	(nothing)
events	config, observability
snapshot	config, events
state	config
analytics	config, observability, extensions
security	config, state, observability
resilience	config, snapshot, extensions, observability, events
plugins	config (native filter trait + unified dispatch chain;
the wasm domain bridges its instances in via a generic adapter,
so plugins never imports wasm — see DW-119)
ai	config (provider-adapter pack, DW-075: the canonical chat
vocabulary, the pure-translation ai::adapter::ProviderAdapter
seam, and the compiled alias table; the transport lives in
dataplane, which calls into it)
lifecycle	config, observability, analytics (DW-110: API
lifecycle management – developer portal, environment profiles,
API journey recorder; feature-gated behind api_lifecycle)
mesh	config, observability (DW-107: service mesh mode –
sidecar traffic interception + SPIFFE/SPIRE mTLS identity; the
mTLS TLS integration point is a documented seam into security,
kept as a hand-off so the dependency direction stays downward;
feature-gated behind mesh, Ent-only)
dataplane	all of the above
supervision	(nothing — pure task plumbing, no domain imports)

(dwara-bin, dwara-admin, and dwara-cli depend on this crate.)

Path compatibility

The modules were originally flat at the crate root. To keep every pre-restructure path (e.g. dwara_core::proxy::handle, dwara_core::config::parse_gateway, dwara_core::tls) compiling unchanged, the crate root re-exports each moved module as a path alias: dwara_core::proxy and dwara_core::dataplane::proxy (and likewise for upstream, balance, hardening, health, active, retries, breaker, tls, authn, authz, store, migrations) denote the same module. The aliases are #[doc(hidden)]: they still compile but stay out of the rendered docs. Use the domain-qualified path in new code (dwara_core::dataplane::proxy, dwara_core::security::tls).

Modules

aggregation

API aggregation (DW-061 spec, DP-09 runtime / #237).

ai

The AI provider-adapter pack (DW-075): one client dialect in, three provider dialects out.

analytics

Analytics bounded context (DW-043): the embedded analytics store.

cel

CEL (Common Expression Language) engine (DW-058).

config

Configuration schema v1 for the gateway (frozen domain vocabulary).

dataplane

Dataplane bounded context: the request-serving path.

error

Facade-level aggregate error.

events

In-process event bus (DW-044, feature analysis section 5 “Platform”): the notice plumbing behind alert & event webhooks.

extensions

Extension points: the OSS/Ent edition boundary as a type boundary (DW-004).

k8s_gateway

Kubernetes Gateway API translator (DW-064).

lifecycle

API lifecycle management (DW-110).

mcp

Agent-operable administration via MCP (DW-112).

mesh

Service mesh mode (DW-107): sidecar traffic interception plus SPIFFE/SPIRE mTLS identity.

observability

Observability substrate (DW-021, feature analysis sections 4.17 and 4.19): tracing spans per request phase, structured JSON access logs, Prometheus metrics, request IDs, and the unified error envelope.

openapi

OpenAPI response validation (DW-070, #258).

plugins

Native plugin filters and the unified plugin dispatch chain (DW-119).

resilience

Resilience bounded context: keeping upstream traffic alive and shed.

security

Security bounded context: establishing and enforcing caller identity.

snapshot

Config compile pipeline: validate -> compile -> publish (feature analysis section 9.2).

state

State bounded context: durable gateway state.

supervision

Panic supervision for accept loops (#120, #130).

synthetic

Synthetic monitoring (DW-071, DP-10 / #238).

wasm

proxy-wasm host (DW-055).