authzen_types_gen.go

// Code generated by scripts/gen_authzen_types. DO NOT EDIT.
//
// Source: testdata/authzen-surface.json
//   artifact:        axonflow-authzen-surface v1
//   profile:         axonflow-authzen-profile-2026-08-29
//   contract schema: 2026-08-29
//   schema digest:   sha256:04f63f4d97215faa9fbf2b6a5152630f7310edbe47440b975d0f66ad63df811f
//
// Regenerate with:
//
//	go run ./scripts/gen_authzen_types
//
// Editing this file by hand is pointless: authzen_types_gen_test.go regenerates
// it in memory and compares bytes, so a hand edit fails CI on the next run.

package axonflow

import (
	"bytes"
	"encoding/json"
	"fmt"
)

// AuthZENProfileV1 is the profile a Policy Enforcement Point negotiates to
// receive anything beyond the boolean decision.
//
// AuthZEN 1.0's response is a bare boolean. The four-valued state, the
// obligations, the approval challenge and the safe reason code all ride in the
// response context and are returned ONLY to a caller that asked for them by
// version, because handing a partial interpretation to a caller that cannot act
// on it is worse than handing it the boolean it understands.
const AuthZENProfileV1 = "axonflow-authzen-profile-2026-08-29"

// AuthZENContractSchemaVersion is the contract version these types were
// generated from. It is the value the server echoes in
// AuthZENResponseContext.SchemaVersion.
const AuthZENContractSchemaVersion = "2026-08-29"

// AuthZENPath is the one route the AuthZEN surface is served on, and
// AuthZENProfileHeader the request header the profile is negotiated with.
// Both are generated from the platform's contract through the artifact, not
// written here: a rename on the platform is a single-source change that
// TestCommittedTypesAreCurrent turns red in this SDK (#3603).
const (
	AuthZENPath          = "/api/v1/access/evaluation"
	AuthZENProfileHeader = "X-Axonflow-AuthZEN-Profile"
)

// AuthZENErrorCode is a closed set of values the server may send.
//
// It is a string type rather than an integer so an unrecognised value from a
// newer server round-trips instead of decoding to a neighbouring constant.
// Use Valid to tell a known value from one this build does not know.
type AuthZENErrorCode string

const (
	AuthZENErrorCodeMalformedEnvelope       AuthZENErrorCode = "malformed_envelope"
	AuthZENErrorCodeIncompleteEvaluation    AuthZENErrorCode = "incomplete_evaluation"
	AuthZENErrorCodeUnsupportedSubject      AuthZENErrorCode = "unsupported_subject"
	AuthZENErrorCodeUnsupportedAction       AuthZENErrorCode = "unsupported_action"
	AuthZENErrorCodeUnsupportedResource     AuthZENErrorCode = "unsupported_resource"
	AuthZENErrorCodeUnevaluableAttribute    AuthZENErrorCode = "unevaluable_attribute"
	AuthZENErrorCodeMissingEvaluableContent AuthZENErrorCode = "missing_evaluable_content"
	AuthZENErrorCodeEvaluationUnavailable   AuthZENErrorCode = "evaluation_unavailable"
)

// AllAuthZENErrorCodes returns every value this build knows, in declaration order.
func AllAuthZENErrorCodes() []AuthZENErrorCode {
	return []AuthZENErrorCode{
		AuthZENErrorCodeMalformedEnvelope,
		AuthZENErrorCodeIncompleteEvaluation,
		AuthZENErrorCodeUnsupportedSubject,
		AuthZENErrorCodeUnsupportedAction,
		AuthZENErrorCodeUnsupportedResource,
		AuthZENErrorCodeUnevaluableAttribute,
		AuthZENErrorCodeMissingEvaluableContent,
		AuthZENErrorCodeEvaluationUnavailable,
	}
}

// Valid reports whether v is a value this build knows.
//
// A false result is not necessarily an error: a newer server may send a value
// added after this SDK was built. It IS a reason not to branch on the value as
// though it were one of the known ones.
func (v AuthZENErrorCode) Valid() bool {
	for _, known := range AllAuthZENErrorCodes() {
		if known == v {
			return true
		}
	}
	return false
}

// AuthZENCategory is a closed set of values the server may send.
//
// It is a string type rather than an integer so an unrecognised value from a
// newer server round-trips instead of decoding to a neighbouring constant.
// Use Valid to tell a known value from one this build does not know.
type AuthZENCategory string

const (
	AuthZENCategoryAllowed                AuthZENCategory = "allowed"
	AuthZENCategoryNotPermitted           AuthZENCategory = "not_permitted"
	AuthZENCategoryApprovalRequired       AuthZENCategory = "approval_required"
	AuthZENCategoryTemporarilyUnavailable AuthZENCategory = "temporarily_unavailable"
	AuthZENCategoryInvalidRequest         AuthZENCategory = "invalid_request"
)

// AllAuthZENCategories returns every value this build knows, in declaration order.
func AllAuthZENCategories() []AuthZENCategory {
	return []AuthZENCategory{
		AuthZENCategoryAllowed,
		AuthZENCategoryNotPermitted,
		AuthZENCategoryApprovalRequired,
		AuthZENCategoryTemporarilyUnavailable,
		AuthZENCategoryInvalidRequest,
	}
}

// Valid reports whether v is a value this build knows.
//
// A false result is not necessarily an error: a newer server may send a value
// added after this SDK was built. It IS a reason not to branch on the value as
// though it were one of the known ones.
func (v AuthZENCategory) Valid() bool {
	for _, known := range AllAuthZENCategories() {
		if known == v {
			return true
		}
	}
	return false
}

// AuthZENIdentifierKind is a closed set of values the server may send.
//
// It is a string type rather than an integer so an unrecognised value from a
// newer server round-trips instead of decoding to a neighbouring constant.
// Use Valid to tell a known value from one this build does not know.
type AuthZENIdentifierKind string

const (
	AuthZENIdentifierKindOrganization AuthZENIdentifierKind = "organization"
	AuthZENIdentifierKindPrincipal    AuthZENIdentifierKind = "principal"
	AuthZENIdentifierKindGroup        AuthZENIdentifierKind = "group"
	AuthZENIdentifierKindResource     AuthZENIdentifierKind = "resource"
	AuthZENIdentifierKindAction       AuthZENIdentifierKind = "action"
	AuthZENIdentifierKindTool         AuthZENIdentifierKind = "tool"
	AuthZENIdentifierKindClient       AuthZENIdentifierKind = "client"
	AuthZENIdentifierKindSession      AuthZENIdentifierKind = "session"
)

// AllAuthZENIdentifierKinds returns every value this build knows, in declaration order.
func AllAuthZENIdentifierKinds() []AuthZENIdentifierKind {
	return []AuthZENIdentifierKind{
		AuthZENIdentifierKindOrganization,
		AuthZENIdentifierKindPrincipal,
		AuthZENIdentifierKindGroup,
		AuthZENIdentifierKindResource,
		AuthZENIdentifierKindAction,
		AuthZENIdentifierKindTool,
		AuthZENIdentifierKindClient,
		AuthZENIdentifierKindSession,
	}
}

// Valid reports whether v is a value this build knows.
//
// A false result is not necessarily an error: a newer server may send a value
// added after this SDK was built. It IS a reason not to branch on the value as
// though it were one of the known ones.
func (v AuthZENIdentifierKind) Valid() bool {
	for _, known := range AllAuthZENIdentifierKinds() {
		if known == v {
			return true
		}
	}
	return false
}

// AuthZENObligationType is a closed set of values the server may send.
//
// It is a string type rather than an integer so an unrecognised value from a
// newer server round-trips instead of decoding to a neighbouring constant.
// Use Valid to tell a known value from one this build does not know.
type AuthZENObligationType string

const (
	AuthZENObligationTypeApprovalChallenge    AuthZENObligationType = "approval_challenge"
	AuthZENObligationTypeFieldRemove          AuthZENObligationType = "field_remove"
	AuthZENObligationTypeFieldRedact          AuthZENObligationType = "field_redact"
	AuthZENObligationTypeFieldHash            AuthZENObligationType = "field_hash"
	AuthZENObligationTypeFieldMask            AuthZENObligationType = "field_mask"
	AuthZENObligationTypeFieldAnnotate        AuthZENObligationType = "field_annotate"
	AuthZENObligationTypeFieldTokenize        AuthZENObligationType = "field_tokenize"
	AuthZENObligationTypeSchemaTransform      AuthZENObligationType = "schema_transform"
	AuthZENObligationTypeResponseFilter       AuthZENObligationType = "response_filter"
	AuthZENObligationTypeRouteRestriction     AuthZENObligationType = "route_restriction"
	AuthZENObligationTypeStepUpAuthentication AuthZENObligationType = "step_up_authentication"
	AuthZENObligationTypeQuotaReservation     AuthZENObligationType = "quota_reservation"
	AuthZENObligationTypeImmutableAudit       AuthZENObligationType = "immutable_audit"
	AuthZENObligationTypeNotification         AuthZENObligationType = "notification"
)

// AllAuthZENObligationTypes returns every value this build knows, in declaration order.
func AllAuthZENObligationTypes() []AuthZENObligationType {
	return []AuthZENObligationType{
		AuthZENObligationTypeApprovalChallenge,
		AuthZENObligationTypeFieldRemove,
		AuthZENObligationTypeFieldRedact,
		AuthZENObligationTypeFieldHash,
		AuthZENObligationTypeFieldMask,
		AuthZENObligationTypeFieldAnnotate,
		AuthZENObligationTypeFieldTokenize,
		AuthZENObligationTypeSchemaTransform,
		AuthZENObligationTypeResponseFilter,
		AuthZENObligationTypeRouteRestriction,
		AuthZENObligationTypeStepUpAuthentication,
		AuthZENObligationTypeQuotaReservation,
		AuthZENObligationTypeImmutableAudit,
		AuthZENObligationTypeNotification,
	}
}

// Valid reports whether v is a value this build knows.
//
// A false result is not necessarily an error: a newer server may send a value
// added after this SDK was built. It IS a reason not to branch on the value as
// though it were one of the known ones.
func (v AuthZENObligationType) Valid() bool {
	for _, known := range AllAuthZENObligationTypes() {
		if known == v {
			return true
		}
	}
	return false
}

// AuthZENOperationalState is a closed set of values the server may send.
//
// It is a string type rather than an integer so an unrecognised value from a
// newer server round-trips instead of decoding to a neighbouring constant.
// Use Valid to tell a known value from one this build does not know.
type AuthZENOperationalState string

const (
	AuthZENOperationalStateAllow     AuthZENOperationalState = "ALLOW"
	AuthZENOperationalStateDeny      AuthZENOperationalState = "DENY"
	AuthZENOperationalStateChallenge AuthZENOperationalState = "CHALLENGE"
	AuthZENOperationalStateError     AuthZENOperationalState = "ERROR"
)

// AllAuthZENOperationalStates returns every value this build knows, in declaration order.
func AllAuthZENOperationalStates() []AuthZENOperationalState {
	return []AuthZENOperationalState{
		AuthZENOperationalStateAllow,
		AuthZENOperationalStateDeny,
		AuthZENOperationalStateChallenge,
		AuthZENOperationalStateError,
	}
}

// Valid reports whether v is a value this build knows.
//
// A false result is not necessarily an error: a newer server may send a value
// added after this SDK was built. It IS a reason not to branch on the value as
// though it were one of the known ones.
func (v AuthZENOperationalState) Valid() bool {
	for _, known := range AllAuthZENOperationalStates() {
		if known == v {
			return true
		}
	}
	return false
}

// AuthZENReasonCode is a closed set of values the server may send.
//
// It is a string type rather than an integer so an unrecognised value from a
// newer server round-trips instead of decoding to a neighbouring constant.
// Use Valid to tell a known value from one this build does not know.
type AuthZENReasonCode string

const (
	AuthZENReasonCodePermitted               AuthZENReasonCode = "permitted"
	AuthZENReasonCodeApprovalRequired        AuthZENReasonCode = "approval_required"
	AuthZENReasonCodeExplicitConstraint      AuthZENReasonCode = "explicit_constraint"
	AuthZENReasonCodeNoMatchingPermission    AuthZENReasonCode = "no_matching_permission"
	AuthZENReasonCodeUnknownConstraint       AuthZENReasonCode = "unknown_constraint"
	AuthZENReasonCodeUnknownPermission       AuthZENReasonCode = "unknown_permission"
	AuthZENReasonCodeUnknownRequirement      AuthZENReasonCode = "unknown_requirement"
	AuthZENReasonCodeInvalidInput            AuthZENReasonCode = "invalid_input"
	AuthZENReasonCodeEvaluationError         AuthZENReasonCode = "evaluation_error"
	AuthZENReasonCodeUnsupportedObligation   AuthZENReasonCode = "unsupported_obligation"
	AuthZENReasonCodeObligationConflict      AuthZENReasonCode = "obligation_conflict"
	AuthZENReasonCodeUnknownAction           AuthZENReasonCode = "unknown_action"
	AuthZENReasonCodeUnknownRealm            AuthZENReasonCode = "unknown_realm"
	AuthZENReasonCodeSchemaViolation         AuthZENReasonCode = "schema_violation"
	AuthZENReasonCodeDelegationDepthExceeded AuthZENReasonCode = "delegation_depth_exceeded"
	AuthZENReasonCodeBudgetExhausted         AuthZENReasonCode = "budget_exhausted"
	AuthZENReasonCodeBindingMismatch         AuthZENReasonCode = "binding_mismatch"
	AuthZENReasonCodeApprovalUnsatisfiable   AuthZENReasonCode = "approval_unsatisfiable"
	AuthZENReasonCodeApprovalExpired         AuthZENReasonCode = "approval_expired"
	AuthZENReasonCodeAuthoringRejected       AuthZENReasonCode = "authoring_rejected"
)

// AllAuthZENReasonCodes returns every value this build knows, in declaration order.
func AllAuthZENReasonCodes() []AuthZENReasonCode {
	return []AuthZENReasonCode{
		AuthZENReasonCodePermitted,
		AuthZENReasonCodeApprovalRequired,
		AuthZENReasonCodeExplicitConstraint,
		AuthZENReasonCodeNoMatchingPermission,
		AuthZENReasonCodeUnknownConstraint,
		AuthZENReasonCodeUnknownPermission,
		AuthZENReasonCodeUnknownRequirement,
		AuthZENReasonCodeInvalidInput,
		AuthZENReasonCodeEvaluationError,
		AuthZENReasonCodeUnsupportedObligation,
		AuthZENReasonCodeObligationConflict,
		AuthZENReasonCodeUnknownAction,
		AuthZENReasonCodeUnknownRealm,
		AuthZENReasonCodeSchemaViolation,
		AuthZENReasonCodeDelegationDepthExceeded,
		AuthZENReasonCodeBudgetExhausted,
		AuthZENReasonCodeBindingMismatch,
		AuthZENReasonCodeApprovalUnsatisfiable,
		AuthZENReasonCodeApprovalExpired,
		AuthZENReasonCodeAuthoringRejected,
	}
}

// Valid reports whether v is a value this build knows.
//
// A false result is not necessarily an error: a newer server may send a value
// added after this SDK was built. It IS a reason not to branch on the value as
// though it were one of the known ones.
func (v AuthZENReasonCode) Valid() bool {
	for _, known := range AllAuthZENReasonCodes() {
		if known == v {
			return true
		}
	}
	return false
}

// AuthZENApprovalClause is One immutable threshold clause: a quorum of distinct approvers drawn
// from a named eligible set. It is named here rather than inlined under
// approval_requirement so it corresponds one-to-one with the Go
// ApprovalClause, which is what lets the drift guard compare it and every
// SDK generate it as a type rather than an anonymous shape.
type AuthZENApprovalClause struct {
	Quorum int `json:"quorum"`

	Eligible []AuthZENIdentifier `json:"eligible"`
}

// UnmarshalJSON decodes v and REFUSES a payload that omits, or explicitly
// nulls, a required member whose zero value the wire may legitimately carry:
// quorum.
//
// Absent and false, absent and 0, are the same bytes to encoding/json and
// different statements on the wire. Silently reading the first as the second
// is a fail-open wherever the member decides an enforcement question — an
// obligation that lost `mandatory` in transit reads as advisory, an approval
// clause that lost `quorum` reads as needing nobody. Validate cannot close
// this: it runs after the decode, by which point the distinction is gone.
//
// An explicit null is refused alongside an absent member because it decodes
// to the same zero value while being present in the object — a presence test
// that only looked for the key would pass it straight through.
//
// The second pass decodes STRICTLY, and that is load-bearing rather than
// tidy. encoding/json hands a json.Unmarshaler the raw bytes and applies
// none of the enclosing Decoder's settings inside it, so the moment a type
// on this surface grows an UnmarshalJSON, a caller's outer
// DisallowUnknownFields stops reaching this subtree — silently. authzen.go
// sets exactly that on the response path, and its reason applies here
// verbatim: an unknown member in a decision is a server speaking a profile
// this build does not understand, and quietly dropping it means acting on a
// partial reading of an authorization decision. Re-asserting strictness on
// the inner decoder keeps the guard continuous through every nested type
// that has one of these methods, instead of leaving a hole shaped like
// whichever types happened to need a presence check.
func (v *AuthZENApprovalClause) UnmarshalJSON(data []byte) error {
	var members map[string]json.RawMessage
	if err := json.Unmarshal(data, &members); err != nil {
		return fmt.Errorf("AuthZENApprovalClause: %w", err)
	}
	// A whole-object null decodes to a NIL map, not an empty one, and every
	// member below would then be reported as absent - naming a cause this
	// code did not observe. Say the thing that is actually true.
	if members == nil {
		return fmt.Errorf("AuthZENApprovalClause: the value is null, not an object")
	}
	for _, member := range []string{"quorum"} {
		raw, ok := members[member]
		if !ok {
			return fmt.Errorf("AuthZENApprovalClause: required member %q is absent; "+
				"it would decode to its zero value, which is a value this member may legitimately carry, "+
				"so the absence cannot be recovered after decoding", member)
		}
		if string(raw) == "null" {
			return fmt.Errorf("AuthZENApprovalClause: required member %q is null; "+
				"it would decode to its zero value, indistinguishable from a sent one", member)
		}
	}
	// The alias sheds this method, so the second pass is the ordinary
	// field-by-field decode rather than an infinite recursion into here.
	type plain AuthZENApprovalClause
	var decoded plain
	dec := json.NewDecoder(bytes.NewReader(data))
	dec.DisallowUnknownFields()
	if err := dec.Decode(&decoded); err != nil {
		return fmt.Errorf("AuthZENApprovalClause: %w", err)
	}
	*v = AuthZENApprovalClause(decoded)
	return nil
}

// Validate reports whether v carries what the server requires.
//
// Calling it is optional: the server enforces the same rules and answers with
// a typed AuthZENError. It exists so a caller can fail before a round trip.
func (v *AuthZENApprovalClause) Validate() error {
	if v == nil {
		return fmt.Errorf("AuthZENApprovalClause: is nil")
	}
	if v.Eligible == nil {
		return fmt.Errorf("AuthZENApprovalClause: eligible is required")
	}
	if len(v.Eligible) < 1 {
		return fmt.Errorf("AuthZENApprovalClause: eligible needs at least 1 entry")
	}
	for i := range v.Eligible {
		if err := v.Eligible[i].Validate(); err != nil {
			return fmt.Errorf("AuthZENApprovalClause.eligible[%d]: %w", i, err)
		}
	}
	return nil
}

// AuthZENApprovalRequirement is A conjunction of immutable threshold clauses. Clauses are never
// collapsed by pool intersection or union.
type AuthZENApprovalRequirement struct {
	AllOf []AuthZENApprovalClause `json:"all_of"`

	SeparationOfDuties bool `json:"separation_of_duties"`

	ExpiresAt string `json:"expires_at"`
}

// UnmarshalJSON decodes v and REFUSES a payload that omits, or explicitly
// nulls, a required member whose zero value the wire may legitimately carry:
// separation_of_duties.
//
// Absent and false, absent and 0, are the same bytes to encoding/json and
// different statements on the wire. Silently reading the first as the second
// is a fail-open wherever the member decides an enforcement question — an
// obligation that lost `mandatory` in transit reads as advisory, an approval
// clause that lost `quorum` reads as needing nobody. Validate cannot close
// this: it runs after the decode, by which point the distinction is gone.
//
// An explicit null is refused alongside an absent member because it decodes
// to the same zero value while being present in the object — a presence test
// that only looked for the key would pass it straight through.
//
// The second pass decodes STRICTLY, and that is load-bearing rather than
// tidy. encoding/json hands a json.Unmarshaler the raw bytes and applies
// none of the enclosing Decoder's settings inside it, so the moment a type
// on this surface grows an UnmarshalJSON, a caller's outer
// DisallowUnknownFields stops reaching this subtree — silently. authzen.go
// sets exactly that on the response path, and its reason applies here
// verbatim: an unknown member in a decision is a server speaking a profile
// this build does not understand, and quietly dropping it means acting on a
// partial reading of an authorization decision. Re-asserting strictness on
// the inner decoder keeps the guard continuous through every nested type
// that has one of these methods, instead of leaving a hole shaped like
// whichever types happened to need a presence check.
func (v *AuthZENApprovalRequirement) UnmarshalJSON(data []byte) error {
	var members map[string]json.RawMessage
	if err := json.Unmarshal(data, &members); err != nil {
		return fmt.Errorf("AuthZENApprovalRequirement: %w", err)
	}
	// A whole-object null decodes to a NIL map, not an empty one, and every
	// member below would then be reported as absent - naming a cause this
	// code did not observe. Say the thing that is actually true.
	if members == nil {
		return fmt.Errorf("AuthZENApprovalRequirement: the value is null, not an object")
	}
	for _, member := range []string{"separation_of_duties"} {
		raw, ok := members[member]
		if !ok {
			return fmt.Errorf("AuthZENApprovalRequirement: required member %q is absent; "+
				"it would decode to its zero value, which is a value this member may legitimately carry, "+
				"so the absence cannot be recovered after decoding", member)
		}
		if string(raw) == "null" {
			return fmt.Errorf("AuthZENApprovalRequirement: required member %q is null; "+
				"it would decode to its zero value, indistinguishable from a sent one", member)
		}
	}
	// The alias sheds this method, so the second pass is the ordinary
	// field-by-field decode rather than an infinite recursion into here.
	type plain AuthZENApprovalRequirement
	var decoded plain
	dec := json.NewDecoder(bytes.NewReader(data))
	dec.DisallowUnknownFields()
	if err := dec.Decode(&decoded); err != nil {
		return fmt.Errorf("AuthZENApprovalRequirement: %w", err)
	}
	*v = AuthZENApprovalRequirement(decoded)
	return nil
}

// Validate reports whether v carries what the server requires.
//
// Calling it is optional: the server enforces the same rules and answers with
// a typed AuthZENError. It exists so a caller can fail before a round trip.
func (v *AuthZENApprovalRequirement) Validate() error {
	if v == nil {
		return fmt.Errorf("AuthZENApprovalRequirement: is nil")
	}
	if v.AllOf == nil {
		return fmt.Errorf("AuthZENApprovalRequirement: all_of is required")
	}
	if len(v.AllOf) < 1 {
		return fmt.Errorf("AuthZENApprovalRequirement: all_of needs at least 1 entry")
	}
	for i := range v.AllOf {
		if err := v.AllOf[i].Validate(); err != nil {
			return fmt.Errorf("AuthZENApprovalRequirement.all_of[%d]: %w", i, err)
		}
	}
	if v.ExpiresAt == "" {
		return fmt.Errorf("AuthZENApprovalRequirement: expires_at is required")
	}
	return nil
}

// AuthZENAction is The AuthZEN action object.
type AuthZENAction struct {
	Name string `json:"name"`

	Properties map[string]any `json:"properties,omitempty"`
}

// Validate reports whether v carries what the server requires.
//
// Calling it is optional: the server enforces the same rules and answers with
// a typed AuthZENError. It exists so a caller can fail before a round trip.
func (v *AuthZENAction) Validate() error {
	if v == nil {
		return fmt.Errorf("AuthZENAction: is nil")
	}
	if v.Name == "" {
		return fmt.Errorf("AuthZENAction: name is required")
	}
	return nil
}

// AuthZENBulk is The plural envelope: a shared subject, action, resource and context at
// the top level, with one entry per decision. The number of decisions is
// fixed by the MAPPING, never by argument data, so an empty evaluations
// array is malformed rather than a request for zero decisions.
type AuthZENBulk struct {
	Subject *AuthZENSubject `json:"subject,omitempty"`

	Action *AuthZENAction `json:"action,omitempty"`

	Resource *AuthZENResource `json:"resource,omitempty"`

	Context map[string]any `json:"context,omitempty"`

	Evaluations []AuthZENRequest `json:"evaluations"`
}

// Validate reports whether v carries what the server requires.
//
// Calling it is optional: the server enforces the same rules and answers with
// a typed AuthZENError. It exists so a caller can fail before a round trip.
func (v *AuthZENBulk) Validate() error {
	if v == nil {
		return fmt.Errorf("AuthZENBulk: is nil")
	}
	if v.Subject != nil {
		if err := v.Subject.Validate(); err != nil {
			return fmt.Errorf("AuthZENBulk.subject: %w", err)
		}
	}
	if v.Action != nil {
		if err := v.Action.Validate(); err != nil {
			return fmt.Errorf("AuthZENBulk.action: %w", err)
		}
	}
	if v.Resource != nil {
		if err := v.Resource.Validate(); err != nil {
			return fmt.Errorf("AuthZENBulk.resource: %w", err)
		}
	}
	if v.Evaluations == nil {
		return fmt.Errorf("AuthZENBulk: evaluations is required")
	}
	if len(v.Evaluations) < 1 {
		return fmt.Errorf("AuthZENBulk: evaluations needs at least 1 entry")
	}
	for i := range v.Evaluations {
		if err := v.Evaluations[i].Validate(); err != nil {
			return fmt.Errorf("AuthZENBulk.evaluations[%d]: %w", i, err)
		}
	}
	return nil
}

// AuthZENEnvelope is The top level. Exactly two members are defined and exactly one may be
// PRESENT. Presence is decided on the KEY SET, not on a decoded pointer,
// so {"evaluation": {...}, "evaluations": null} carries both declared
// members and is malformed.
type AuthZENEnvelope struct {
	// The singular member. Unlike a plural entry it has no shared base to
	// inherit from, so it must carry its own subject, action and resource.
	Evaluation *AuthZENRequest `json:"evaluation,omitempty"`

	Evaluations *AuthZENBulk `json:"evaluations,omitempty"`
}

// Validate reports whether v carries what the server requires.
//
// Calling it is optional: the server enforces the same rules and answers with
// a typed AuthZENError. It exists so a caller can fail before a round trip.
func (v *AuthZENEnvelope) Validate() error {
	if v == nil {
		return fmt.Errorf("AuthZENEnvelope: is nil")
	}
	{
		set := 0
		if v.Evaluation != nil {
			set++
		}
		if v.Evaluations != nil {
			set++
		}
		if set != 1 {
			return fmt.Errorf("AuthZENEnvelope: exactly one of evaluation or evaluations must be set, %d are", set)
		}
	}
	if v.Evaluation != nil && v.Evaluation.Action == nil {
		return fmt.Errorf("AuthZENEnvelope: evaluation has no action; it has no shared base to inherit one from")
	}
	if v.Evaluation != nil && v.Evaluation.Resource == nil {
		return fmt.Errorf("AuthZENEnvelope: evaluation has no resource; it has no shared base to inherit one from")
	}
	if v.Evaluation != nil && v.Evaluation.Subject == nil {
		return fmt.Errorf("AuthZENEnvelope: evaluation has no subject; it has no shared base to inherit one from")
	}
	if v.Evaluation != nil {
		if err := v.Evaluation.Validate(); err != nil {
			return fmt.Errorf("AuthZENEnvelope.evaluation: %w", err)
		}
	}
	if v.Evaluations != nil {
		if err := v.Evaluations.Validate(); err != nil {
			return fmt.Errorf("AuthZENEnvelope.evaluations: %w", err)
		}
	}
	return nil
}

// AuthZENError is The structured refusal body, returned when a request could not be
// EVALUATED. It is a separate shape from the response rather than an extra
// member on it, because a refusal is not a decision: a response carrying
// decision=false says the request was evaluated and denied, and returning
// that for a request that was never evaluated would make 'denied' and
// 'unevaluable' the same event in every audit and every client branch.
type AuthZENError struct {
	Code AuthZENErrorCode `json:"code"`

	Pointer string `json:"pointer,omitempty"`

	Message string `json:"message"`

	Supported []string `json:"supported,omitempty"`

	RequestID string `json:"request_id,omitempty"`
}

// Validate reports whether v carries what the server requires.
//
// Calling it is optional: the server enforces the same rules and answers with
// a typed AuthZENError. It exists so a caller can fail before a round trip.
func (v *AuthZENError) Validate() error {
	if v == nil {
		return fmt.Errorf("AuthZENError: is nil")
	}
	if v.Code == "" {
		return fmt.Errorf("AuthZENError: code is required")
	}
	if v.Message == "" {
		return fmt.Errorf("AuthZENError: message is required")
	}
	return nil
}

// AuthZENRequest is One subject-action-resource-context evaluation. Every member is
// structurally OPTIONAL here because a plural-envelope entry inherits any
// member it omits from the envelope's shared base. The completeness
// invariant - that the MERGED entry carries a subject, an action and a
// resource - is a cross-object property this document cannot express, and
// AuthZENEnvelope.Project enforces it. A validator that passes this schema
// has therefore NOT established completeness, which is why the singular
// member below carries its own required list.
type AuthZENRequest struct {
	Subject *AuthZENSubject `json:"subject,omitempty"`

	Action *AuthZENAction `json:"action,omitempty"`

	Resource *AuthZENResource `json:"resource,omitempty"`

	Context map[string]any `json:"context,omitempty"`
}

// Validate reports whether v carries what the server requires.
//
// Calling it is optional: the server enforces the same rules and answers with
// a typed AuthZENError. It exists so a caller can fail before a round trip.
func (v *AuthZENRequest) Validate() error {
	if v == nil {
		return fmt.Errorf("AuthZENRequest: is nil")
	}
	if v.Subject != nil {
		if err := v.Subject.Validate(); err != nil {
			return fmt.Errorf("AuthZENRequest.subject: %w", err)
		}
	}
	if v.Action != nil {
		if err := v.Action.Validate(); err != nil {
			return fmt.Errorf("AuthZENRequest.action: %w", err)
		}
	}
	if v.Resource != nil {
		if err := v.Resource.Validate(); err != nil {
			return fmt.Errorf("AuthZENRequest.resource: %w", err)
		}
	}
	return nil
}

// AuthZENResource is The AuthZEN resource object.
type AuthZENResource struct {
	Type string `json:"type"`

	ID string `json:"id"`

	Properties map[string]any `json:"properties,omitempty"`
}

// Validate reports whether v carries what the server requires.
//
// Calling it is optional: the server enforces the same rules and answers with
// a typed AuthZENError. It exists so a caller can fail before a round trip.
func (v *AuthZENResource) Validate() error {
	if v == nil {
		return fmt.Errorf("AuthZENResource: is nil")
	}
	if v.Type == "" {
		return fmt.Errorf("AuthZENResource: type is required")
	}
	if v.ID == "" {
		return fmt.Errorf("AuthZENResource: id is required")
	}
	return nil
}

// AuthZENResponse is The AuthZEN reply. `decision` is the collapsed boolean: ALLOW is true
// and every other state is false. It is the only member an un-negotiated
// enforcement point receives.
type AuthZENResponse struct {
	Decision bool `json:"decision"`

	Context *AuthZENResponseContext `json:"context,omitempty"`
}

// UnmarshalJSON decodes v and REFUSES a payload that omits, or explicitly
// nulls, a required member whose zero value the wire may legitimately carry:
// decision.
//
// Absent and false, absent and 0, are the same bytes to encoding/json and
// different statements on the wire. Silently reading the first as the second
// is a fail-open wherever the member decides an enforcement question — an
// obligation that lost `mandatory` in transit reads as advisory, an approval
// clause that lost `quorum` reads as needing nobody. Validate cannot close
// this: it runs after the decode, by which point the distinction is gone.
//
// An explicit null is refused alongside an absent member because it decodes
// to the same zero value while being present in the object — a presence test
// that only looked for the key would pass it straight through.
//
// The second pass decodes STRICTLY, and that is load-bearing rather than
// tidy. encoding/json hands a json.Unmarshaler the raw bytes and applies
// none of the enclosing Decoder's settings inside it, so the moment a type
// on this surface grows an UnmarshalJSON, a caller's outer
// DisallowUnknownFields stops reaching this subtree — silently. authzen.go
// sets exactly that on the response path, and its reason applies here
// verbatim: an unknown member in a decision is a server speaking a profile
// this build does not understand, and quietly dropping it means acting on a
// partial reading of an authorization decision. Re-asserting strictness on
// the inner decoder keeps the guard continuous through every nested type
// that has one of these methods, instead of leaving a hole shaped like
// whichever types happened to need a presence check.
func (v *AuthZENResponse) UnmarshalJSON(data []byte) error {
	var members map[string]json.RawMessage
	if err := json.Unmarshal(data, &members); err != nil {
		return fmt.Errorf("AuthZENResponse: %w", err)
	}
	// A whole-object null decodes to a NIL map, not an empty one, and every
	// member below would then be reported as absent - naming a cause this
	// code did not observe. Say the thing that is actually true.
	if members == nil {
		return fmt.Errorf("AuthZENResponse: the value is null, not an object")
	}
	for _, member := range []string{"decision"} {
		raw, ok := members[member]
		if !ok {
			return fmt.Errorf("AuthZENResponse: required member %q is absent; "+
				"it would decode to its zero value, which is a value this member may legitimately carry, "+
				"so the absence cannot be recovered after decoding", member)
		}
		if string(raw) == "null" {
			return fmt.Errorf("AuthZENResponse: required member %q is null; "+
				"it would decode to its zero value, indistinguishable from a sent one", member)
		}
	}
	// The alias sheds this method, so the second pass is the ordinary
	// field-by-field decode rather than an infinite recursion into here.
	type plain AuthZENResponse
	var decoded plain
	dec := json.NewDecoder(bytes.NewReader(data))
	dec.DisallowUnknownFields()
	if err := dec.Decode(&decoded); err != nil {
		return fmt.Errorf("AuthZENResponse: %w", err)
	}
	*v = AuthZENResponse(decoded)
	return nil
}

// Validate reports whether v carries what the server requires.
//
// Calling it is optional: the server enforces the same rules and answers with
// a typed AuthZENError. It exists so a caller can fail before a round trip.
func (v *AuthZENResponse) Validate() error {
	if v == nil {
		return fmt.Errorf("AuthZENResponse: is nil")
	}
	if v.Context != nil {
		if err := v.Context.Validate(); err != nil {
			return fmt.Errorf("AuthZENResponse.context: %w", err)
		}
	}
	return nil
}

// AuthZENResponseContext is The versioned AxonFlow profile payload. It is present only for a Policy
// Enforcement Point that NEGOTIATED the profile; one that did not receives
// the boolean alone, because handing a partial interpretation to a plane
// that cannot act on it is the failure ADR-065 invariant 12 forbids.
type AuthZENResponseContext struct {
	// The only value the server sends is "axonflow-authzen-profile-2026-08-29".
	Profile string `json:"profile"`

	State AuthZENOperationalState `json:"state"`

	Category AuthZENCategory `json:"category"`

	Reason AuthZENReasonCode `json:"reason,omitempty"`

	Obligations []AuthZENObligation `json:"obligations,omitempty"`

	Approval *AuthZENApprovalRequirement `json:"approval,omitempty"`

	DecisionID string `json:"decision_id"`

	SchemaVersion string `json:"schema_version"`
}

// Validate reports whether v carries what the server requires.
//
// Calling it is optional: the server enforces the same rules and answers with
// a typed AuthZENError. It exists so a caller can fail before a round trip.
func (v *AuthZENResponseContext) Validate() error {
	if v == nil {
		return fmt.Errorf("AuthZENResponseContext: is nil")
	}
	if v.Profile == "" {
		return fmt.Errorf("AuthZENResponseContext: profile is required")
	}
	if v.State == "" {
		return fmt.Errorf("AuthZENResponseContext: state is required")
	}
	if v.Category == "" {
		return fmt.Errorf("AuthZENResponseContext: category is required")
	}
	for i := range v.Obligations {
		if err := v.Obligations[i].Validate(); err != nil {
			return fmt.Errorf("AuthZENResponseContext.obligations[%d]: %w", i, err)
		}
	}
	if v.Approval != nil {
		if err := v.Approval.Validate(); err != nil {
			return fmt.Errorf("AuthZENResponseContext.approval: %w", err)
		}
	}
	if v.DecisionID == "" {
		return fmt.Errorf("AuthZENResponseContext: decision_id is required")
	}
	if v.SchemaVersion == "" {
		return fmt.Errorf("AuthZENResponseContext: schema_version is required")
	}
	return nil
}

// AuthZENSubject is The AuthZEN subject object. type and id are canonical identifier
// components; a display name, an email or a token claim is never one of
// them.
type AuthZENSubject struct {
	Type string `json:"type"`

	ID string `json:"id"`

	Properties map[string]any `json:"properties,omitempty"`
}

// Validate reports whether v carries what the server requires.
//
// Calling it is optional: the server enforces the same rules and answers with
// a typed AuthZENError. It exists so a caller can fail before a round trip.
func (v *AuthZENSubject) Validate() error {
	if v == nil {
		return fmt.Errorf("AuthZENSubject: is nil")
	}
	if v.Type == "" {
		return fmt.Errorf("AuthZENSubject: type is required")
	}
	if v.ID == "" {
		return fmt.Errorf("AuthZENSubject: id is required")
	}
	return nil
}

// AuthZENIdentifier is A canonical identifier. Display names, emails, token claims, connector
// names and aliases are never identifiers.
type AuthZENIdentifier struct {
	Kind AuthZENIdentifierKind `json:"kind"`

	Type string `json:"type"`

	Qualifier string `json:"qualifier,omitempty"`

	Local string `json:"local"`
}

// Validate reports whether v carries what the server requires.
//
// Calling it is optional: the server enforces the same rules and answers with
// a typed AuthZENError. It exists so a caller can fail before a round trip.
func (v *AuthZENIdentifier) Validate() error {
	if v == nil {
		return fmt.Errorf("AuthZENIdentifier: is nil")
	}
	if v.Kind == "" {
		return fmt.Errorf("AuthZENIdentifier: kind is required")
	}
	if v.Type == "" {
		return fmt.Errorf("AuthZENIdentifier: type is required")
	}
	if v.Local == "" {
		return fmt.Errorf("AuthZENIdentifier: local is required")
	}
	return nil
}

// AuthZENObligation is One typed instruction owned by a named enforcement component.
type AuthZENObligation struct {
	Type AuthZENObligationType `json:"type"`

	Target string `json:"target,omitempty"`

	Params map[string]string `json:"params,omitempty"`

	Mandatory bool `json:"mandatory"`

	SourcePolicy string `json:"source_policy"`

	SchemaVersion int `json:"schema_version"`
}

// UnmarshalJSON decodes v and REFUSES a payload that omits, or explicitly
// nulls, a required member whose zero value the wire may legitimately carry:
// mandatory, schema_version.
//
// Absent and false, absent and 0, are the same bytes to encoding/json and
// different statements on the wire. Silently reading the first as the second
// is a fail-open wherever the member decides an enforcement question — an
// obligation that lost `mandatory` in transit reads as advisory, an approval
// clause that lost `quorum` reads as needing nobody. Validate cannot close
// this: it runs after the decode, by which point the distinction is gone.
//
// An explicit null is refused alongside an absent member because it decodes
// to the same zero value while being present in the object — a presence test
// that only looked for the key would pass it straight through.
//
// The second pass decodes STRICTLY, and that is load-bearing rather than
// tidy. encoding/json hands a json.Unmarshaler the raw bytes and applies
// none of the enclosing Decoder's settings inside it, so the moment a type
// on this surface grows an UnmarshalJSON, a caller's outer
// DisallowUnknownFields stops reaching this subtree — silently. authzen.go
// sets exactly that on the response path, and its reason applies here
// verbatim: an unknown member in a decision is a server speaking a profile
// this build does not understand, and quietly dropping it means acting on a
// partial reading of an authorization decision. Re-asserting strictness on
// the inner decoder keeps the guard continuous through every nested type
// that has one of these methods, instead of leaving a hole shaped like
// whichever types happened to need a presence check.
func (v *AuthZENObligation) UnmarshalJSON(data []byte) error {
	var members map[string]json.RawMessage
	if err := json.Unmarshal(data, &members); err != nil {
		return fmt.Errorf("AuthZENObligation: %w", err)
	}
	// A whole-object null decodes to a NIL map, not an empty one, and every
	// member below would then be reported as absent - naming a cause this
	// code did not observe. Say the thing that is actually true.
	if members == nil {
		return fmt.Errorf("AuthZENObligation: the value is null, not an object")
	}
	for _, member := range []string{"mandatory", "schema_version"} {
		raw, ok := members[member]
		if !ok {
			return fmt.Errorf("AuthZENObligation: required member %q is absent; "+
				"it would decode to its zero value, which is a value this member may legitimately carry, "+
				"so the absence cannot be recovered after decoding", member)
		}
		if string(raw) == "null" {
			return fmt.Errorf("AuthZENObligation: required member %q is null; "+
				"it would decode to its zero value, indistinguishable from a sent one", member)
		}
	}
	// The alias sheds this method, so the second pass is the ordinary
	// field-by-field decode rather than an infinite recursion into here.
	type plain AuthZENObligation
	var decoded plain
	dec := json.NewDecoder(bytes.NewReader(data))
	dec.DisallowUnknownFields()
	if err := dec.Decode(&decoded); err != nil {
		return fmt.Errorf("AuthZENObligation: %w", err)
	}
	*v = AuthZENObligation(decoded)
	return nil
}

// Validate reports whether v carries what the server requires.
//
// Calling it is optional: the server enforces the same rules and answers with
// a typed AuthZENError. It exists so a caller can fail before a round trip.
func (v *AuthZENObligation) Validate() error {
	if v == nil {
		return fmt.Errorf("AuthZENObligation: is nil")
	}
	if v.Type == "" {
		return fmt.Errorf("AuthZENObligation: type is required")
	}
	if v.SourcePolicy == "" {
		return fmt.Errorf("AuthZENObligation: source_policy is required")
	}
	return nil
}