end_point_blank 0.2.1 → 0.6.0

data/lib/end_point_blank/authorization.rb

@@ -9,9 +9,17 @@ module EndPointBlank
         EndPointBlank::Configuration.instance
       end
 
-      def header(hostname = nil)
+      # Builds an outbound Authorization header value.
+      # @param base_url [String, nil] the URL you are about to call, with any
+      #   query string and fragment removed. If given, a token covering it is
+      #   used (minting one if necessary) and returned as a Bearer header.
+      #   Called with no argument this is the Basic form -- which is what the
+      #   calls to intake itself use, since intake already holds this
+      #   service's own credential.
+      # @return [String] "Bearer <token>" or "Basic <credentials>"
+      def header(base_url = nil)
         token = nil
-        token = EndPointBlank::AccessTokens.token(hostname) if hostname
+        token = EndPointBlank::AccessTokens.token(base_url) if base_url
 
         if token
           "Bearer " + token

data/lib/end_point_blank/base_url.rb

@@ -0,0 +1,218 @@
+# frozen_string_literal: true
+
+module EndPointBlank
+  # Resolves the base URL the caller used -- scheme, host and port -- from a
+  # Rack env.
+  #
+  # This deliberately does not go through Rack::Request#host / #scheme / #port.
+  # Rack, Express, the servlet spec and Plug each resolve "host" differently
+  # (Rack takes the last X-Forwarded-Host hop, Express the first, WSGI and Plug
+  # neither), which is precisely why the same request produced five different
+  # answers across the five clients. The env is read directly so that this
+  # algorithm is the same one implemented in the JS, Python, Java and Elixir
+  # libraries.
+  #
+  # Forwarded headers are honored when `trust_proxy_headers` is on, which it is
+  # by default: `host` was already caller-controlled in every client (all five
+  # read the Host header), so this opens no new hole for the field that matters
+  # most, and taking the LAST hop means that behind a proxy that appends, the
+  # value is the proxy's own observation rather than anything the caller
+  # planted. A directly-exposed deployment -- where nothing sits in front to
+  # overwrite the headers -- can set the flag to false, and then only the
+  # connection and the Host header are consulted.
+  #
+  # The flag arrives as an argument rather than being read from Configuration
+  # here, so that this module stays framework- and configuration-free and both
+  # states are directly testable.
+  module BaseUrl
+    HOSTNAME = /\A[a-z0-9._-]+\z/
+    IPV6 = /\A\[[0-9a-f:.]+\]\z/
+    SCHEME = /\A[a-z][a-z0-9+.-]{0,31}\z/
+    DEFAULT_PORTS = { "http" => 80, "https" => 443 }.freeze
+
+    module_function
+
+    # Returns a Hash carrying only the fields that resolved to a usable value.
+    # A field that could not be resolved is absent, never nil: the receiver has
+    # to be able to tell "this SDK did not report a port" from "the port is
+    # null".
+    #
+    # With trust_proxy_headers: false the three X-Forwarded-* headers are not
+    # read at all, so the request is never treated as proxied and the
+    # connection's scheme and port stay evidence.
+    def from_rack_env(env, trust_proxy_headers: true)
+      return {} unless env.is_a?(Hash)
+
+      forwarded_scheme = trust_proxy_headers ? clean_scheme(last_hop(env["HTTP_X_FORWARDED_PROTO"])) : nil
+      forwarded_host_part, forwarded_host_authority_port =
+        trust_proxy_headers ? split_authority(last_hop(env["HTTP_X_FORWARDED_HOST"])) : [nil, nil]
+      forwarded_host = clean_host(forwarded_host_part)
+      forwarded_port = trust_proxy_headers ? parse_port(last_hop(env["HTTP_X_FORWARDED_PORT"])) : nil
+
+      # Evidence is judged AFTER validation, not on raw header presence: a
+      # malformed header (e.g. "X-Forwarded-Port: not-a-port") parses to
+      # nothing and so must never count as proxy evidence, or an
+      # unauthenticated caller could blank an otherwise-valid field just by
+      # sending garbage.
+      #
+      # Only a forwarded scheme or port counts as evidence strong enough to
+      # distrust the raw connection. A forwarded Host alone does not: some
+      # proxies rewrite only the Host header and pass scheme/port through
+      # unchanged, so a valid X-Forwarded-Host by itself says nothing about
+      # whether the connection's own scheme/port belong to the proxy or the
+      # caller.
+      proxied = !forwarded_scheme.nil? || !forwarded_port.nil?
+
+      # A malformed X-Forwarded-Host (wrong shape, or too long -- see
+      # clean_host) gets the same treatment as a malformed proto or port: it
+      # is ignored entirely and falls back to the direct Host header, exactly
+      # as if the header were absent, rather than leaving host unresolved.
+      host_part, authority_port =
+        if forwarded_host
+          [forwarded_host_part, forwarded_host_authority_port]
+        else
+          split_authority(host_authority(env))
+        end
+
+      scheme = forwarded_scheme || (proxied ? nil : clean_scheme(env["rack.url_scheme"]))
+      host = forwarded_host || clean_host(host_part)
+      port_candidate = forwarded_port ||
+                       parse_port(authority_port) ||
+                       (proxied ? nil : parse_port(env["SERVER_PORT"]))
+      port = usable_port(port_candidate, scheme)
+
+      resolved = {}
+      resolved[:scheme] = scheme if scheme
+      resolved[:host] = host if host
+      resolved[:port] = port if port
+      resolved
+    end
+
+    # The hostname alone, for the authorize path.
+    #
+    # Deliberately NOT from_rack_env(env)[:host]: reads the Host header only,
+    # never the forwarded chain, however trust_proxy_headers is set. The
+    # value feeds `target_hostname` and the access-token cache key, and the
+    # portal resolves an application environment from it -- a value matching
+    # no registered row is a hard 422 with no fallback, not a cache miss.
+    #
+    # Composed from the same split_authority/clean_host pair from_rack_env
+    # uses, so IPv6 bracketing, lowercasing, and shape and length validation
+    # are identical between the two; only the authority's source differs.
+    def hostname_from_rack_env(env)
+      return nil unless env.is_a?(Hash)
+
+      host_part, _authority_port = split_authority(host_authority(env))
+      clean_host(host_part)
+    end
+
+    # A proxy that appends writes its own observation last. A proxy that
+    # overwrites (nginx, Caddy, ALB) emits one value, where first and last are
+    # the same thing.
+    def last_hop(value)
+      return nil unless value.is_a?(String)
+
+      hops = value.split(",").map(&:strip).reject(&:empty?)
+      hops.last
+    end
+
+    # The authority the caller named, for both resolution paths.
+    #
+    # An empty Host header is treated as ABSENT, not as a present-but-unusable
+    # value. A caller that sends `Host:` with nothing after it has said nothing
+    # about which host it meant, so there is nothing there to prefer over
+    # SERVER_NAME. Falling through concedes no control the caller did not
+    # already have either: SERVER_NAME is a server-side value, not one a
+    # request can steer.
+    #
+    # On the authorize path the alternative is worse than cosmetic. Resolving
+    # the host to nil there drops the request to Basic auth and skips the token
+    # mint entirely, where falling through yields a usable
+    # application-environment lookup key.
+    #
+    # This CHANGES Ruby's behavior: an empty Host header used to resolve the
+    # host to nil. `env["HTTP_HOST"] || env["SERVER_NAME"]` stops at "" because
+    # "" is truthy in Ruby. Python, Java and JS already fell through, because
+    # "" is falsy there; Ruby and Elixir stopped, because "" is truthy in both.
+    # One expression written five times, diverging only on the empty case. It
+    # now lives at one site per SDK, and this comment is why.
+    #
+    # `.to_s.empty?` so a nil Host header takes the same branch as an empty one.
+    def host_authority(env)
+      host = env["HTTP_HOST"]
+      host.to_s.empty? ? env["SERVER_NAME"] : host
+    end
+
+    # "api.example.com:8443" -> ["api.example.com", "8443"]
+    # "[2001:db8::1]:8443"   -> ["[2001:db8::1]", "8443"]
+    def split_authority(value)
+      return [nil, nil] unless value.is_a?(String)
+
+      authority = value.strip
+      if authority.start_with?("[")
+        head, bracket, tail = authority.partition("]")
+        return [nil, nil] if bracket.empty?
+
+        ["#{head}]", tail.start_with?(":") ? tail[1..] : nil]
+      elsif authority.count(":") == 1
+        host, _, port = authority.partition(":")
+        [host, port]
+      else
+        [authority, nil]
+      end
+    end
+
+    # Normalize, then validate. "HTTPS" and "https:" both have to reach intake
+    # as "https": JS's location.protocol and Node's URL#protocol keep the
+    # colon, nothing pins the case, and intake never rewrites a stored row --
+    # two spellings of the same scheme would split the dominant-triple
+    # grouping forever. delete_suffix removes one colon, not all of them, so
+    # "https::" still fails the shape check rather than sneaking through.
+    def clean_scheme(value)
+      return nil unless value.is_a?(String)
+
+      scheme = value.strip.downcase.delete_suffix(":")
+      scheme.match?(SCHEME) ? scheme : nil
+    end
+
+    # DNS caps a hostname at 253 characters, and the receiving column is
+    # varchar(255). No web-server adapter validates the length of
+    # X-Forwarded-Host, so without this a caller could make the SDK report an
+    # arbitrarily long value; dropped, not truncated, because a truncated
+    # hostname is a plausible-looking WRONG one and the portal reads `host`
+    # verbatim to assemble a base URL.
+    def clean_host(value)
+      return nil unless value.is_a?(String)
+
+      host = value.strip.downcase
+      return nil if host.empty? || host.bytesize > 253
+
+      host.match?(HOSTNAME) || host.match?(IPV6) ? host : nil
+    end
+
+    # Numeric validation only -- 1..65535, nothing scheme-aware. Used both to
+    # decide whether a forwarded/authority port counts as a usable value and
+    # as a port candidate; default-port omission happens exactly once, in
+    # usable_port, against the FINAL resolved scheme, so it can never be
+    # skipped just because the scheme happened to resolve from a different
+    # source than the port did.
+    def parse_port(value)
+      port = Integer(value.to_s.strip, 10, exception: false)
+      return nil if port.nil? || port < 1 || port > 65_535
+
+      port
+    end
+
+    # A port is reported only when it can be classified against a resolved
+    # scheme. With no scheme, "default" is meaningless, so an unclassifiable
+    # port is withheld entirely rather than guessed at -- the same origin must
+    # never be reportable two ways depending on which headers happened to
+    # arrive.
+    def usable_port(candidate, scheme)
+      return nil if candidate.nil? || scheme.nil?
+      return nil if DEFAULT_PORTS[scheme] == candidate
+
+      candidate
+    end
+  end
+end

data/lib/end_point_blank/commands/endpoint_authorize.rb

@@ -1,5 +1,6 @@
 #!/bin/ruby
 
+require 'json'
 require_relative 'http'
 require_relative 'authentication_cache'
 
@@ -19,35 +20,56 @@ module EndPointBlank
           method      = request.request_method
           path        = request.route_uri_pattern.to_s.gsub(/\([^)]*\)/, '')
           app_name    = Configuration.instance.app_name
-          cache_key   = "epb_auth:#{client_auth}:#{path}:#{method}:#{app_name}"
+          # The version is part of the key because authorization is decided per
+          # endpoint version, and so is the deprecation carried back with it.
+          # Without it, two callers on different versions of the same route share
+          # one entry: whichever authorizes first decides both, so a client on a
+          # deprecated version can get no warning, or one on a current version
+          # can be told it is retiring.
+          version     = VersionFinder.new.find(request)
+          cache_key   = "epb_auth:#{client_auth}:#{path}:#{method}:#{app_name}:#{version}"
 
           cache = AuthenticationCache.instance
-          return CachedResponse.new(201, '') if cache.exists?(cache_key)
+          # The cached value is the authorize response body, not a truthy
+          # marker.
+          #
+          # It has to be, for two reasons. Callers parse the body — a cache hit
+          # returning '' made JSON.parse raise, so a cached authorization became
+          # a 500 rather than a fast success. And the body is where the
+          # deprecation block lives; without it the Deprecation and Sunset
+          # headers would appear only on cache misses, which reads as a flaky
+          # feature rather than a missing one.
+          if (cached = cache.retrieve(cache_key))
+            return CachedResponse.new(201, cached)
+          end
 
-          hostname = request.host
-          auth = Authorization.header(hostname)
+          # Host header only, never the forwarded chain -- see
+          # BaseUrl.hostname_from_rack_env. request.host would read
+          # X-Forwarded-Host unconditionally.
+          hostname = EndPointBlank::BaseUrl.hostname_from_rack_env(request.env)
           body = {
             path: path,
             http_method: method,
             client_auth: client_auth,
             target_hostname: hostname,
             application: app_name,
-            endpoint_version: VersionFinder.new.find(request),
+            endpoint_version: version,
             source_ip: request.remote_ip,
             uuid: request.uuid
           }
-          response = Http.post(configuration.authorize_url, auth, body)
 
-          if response&.status == 401 && auth.to_s.start_with?("Bearer ")
-            EndPointBlank::AccessTokens.instance.remove(hostname)
-            auth = Authorization.header(hostname)
-            response = Http.post(configuration.authorize_url, auth, body)
-          end
+          # Basic, not Bearer. This call is to intake, which already holds
+          # this service's credential -- minting a token to present it back
+          # was a hop that bought nothing. With no Bearer there is no stale
+          # token, so the 401 retry that used to live here is gone: a 401 now
+          # means the credential is wrong, which is worth surfacing rather
+          # than retrying.
+          response = Http.post(configuration.authorize_url, Authorization.header, body)
 
           return nil if response.nil?
           EndPointBlank.logger.info "Authentication response: #{response.status} - #{response.body}"
           if response.status == 201
-            cache.store(cache_key, true)
+            cache.store(cache_key, response.body)
           elsif response.status > 299
             EndPointBlank.logger.error "Failed to authorize endpoint: #{response.status} - #{response.body}"
           end

data/lib/end_point_blank/commands/endpoint_update.rb

@@ -110,7 +110,7 @@ module EndPointBlank
             nil
           else
             controller_class = "#{route.defaults[:controller].camelize}Controller".constantize
-            versions = controller_class.respond_to?(:versions) ? controller_class.versions(route.defaults[:action].to_sym) : {}
+            versions = controller_class.respond_to?(:versions) ? controller_class.versions(route.defaults[:action].to_sym) : []
             {
               path: route.path.spec.to_s.gsub(/\([^)]*\)/, ''),
               http_method: route.verb,

data/lib/end_point_blank/commands/generate_access_token.rb

@@ -12,8 +12,8 @@ module EndPointBlank
           EndPointBlank::Configuration.instance
         end
 
-        def token(hostname)
-          body = {hostname: hostname}
+        def token(base_url)
+          body = {base_url: base_url}
           if configuration.token_ttl
             body[:token_ttl] = configuration.token_ttl
           end
@@ -23,7 +23,7 @@ module EndPointBlank
             body: body.to_json,
             **EndPointBlank::Commands::Http::TIMEOUT_OPTIONS
           )
-          EndPointBlank.logger.info "Authentication response: #{response.status} - #{response.body}"
+          EndPointBlank.logger.info "Authentication response: #{response.status}"
           parsed_body = response.body.is_a?(String) ? JSON.parse(response.body) : response.body
           parsed_body.transform_keys(&:to_sym)
         rescue => e

data/lib/end_point_blank/configuration.rb

@@ -15,7 +15,7 @@ module EndPointBlank
 
     attr_accessor :worker_count, :log_mode,
                   :version_finder, :application_version, :token_ttl, :cache_ttl,
-                  :masking_rules, :mask_hook, :logger
+                  :masking_rules, :mask_hook, :logger, :trust_proxy_headers
 
     def initialize
       @worker_count = 4
@@ -23,6 +23,7 @@ module EndPointBlank
       @cache_ttl = 300
       @masking_rules = []
       @mask_hook = nil
+      @trust_proxy_headers = true
     end
 
     # Returns the configured client id, falling back to the

data/lib/end_point_blank/deprecation_headers.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+require "time"
+
+module EndPointBlank
+  # Formats the deprecation facts returned by an authorize call into the
+  # standard response headers.
+  #
+  #   Deprecation  RFC 9745 — an Item Structured Header Date: "@1688169599"
+  #   Sunset       RFC 8594 — an HTTP-date: "Sat, 31 Dec 2018 23:59:59 GMT"
+  #
+  # RFC 9745 permits a past value ("was deprecated at that date"), which is what
+  # EndPointBlank emits: deprecation takes effect when it is declared.
+  #
+  # Pure and stateless on purpose. The SDK does not know what a lifecycle is —
+  # it relays two timestamps the portal already decided about, and this turns
+  # them into two strings. That keeps the vectors in
+  # docs/superpowers/specs/2026-08-01-header-vectors.md assertable without
+  # constructing a request.
+  module DeprecationHeaders
+    DEPRECATION = "Deprecation"
+    SUNSET = "Sunset"
+
+    # Fixed English abbreviations. Ruby's %a/%b are locale-independent, but
+    # spelling them out removes the question entirely — a server running under a
+    # different locale must still emit an HTTP-date.
+    DAYS = %w[Sun Mon Tue Wed Thu Fri Sat].freeze
+    MONTHS = %w[Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec].freeze
+
+    class << self
+      # @param deprecation [Hash, nil] the authorize response's "deprecation"
+      #   block: {"deprecated_at" => iso8601, "sunset_at" => iso8601 | nil}
+      # @return [Hash] header name => value; empty when there is nothing to say
+      def build(deprecation)
+        return {} unless deprecation.is_a?(Hash)
+
+        headers = {}
+
+        if (at = parse(deprecation["deprecated_at"] || deprecation[:deprecated_at]))
+          headers[DEPRECATION] = deprecation_value(at)
+        end
+
+        if (at = parse(deprecation["sunset_at"] || deprecation[:sunset_at]))
+          headers[SUNSET] = sunset_value(at)
+        end
+
+        headers
+      end
+
+      # "@1688169599" — no quotes, no sub-second precision.
+      def deprecation_value(time)
+        "@#{time.to_i}"
+      end
+
+      # "Sat, 31 Dec 2018 23:59:59 GMT" — day-of-month zero padded, always GMT.
+      def sunset_value(time)
+        t = time.utc
+        format(
+          "%s, %02d %s %04d %02d:%02d:%02d GMT",
+          DAYS[t.wday], t.day, MONTHS[t.month - 1], t.year, t.hour, t.min, t.sec
+        )
+      end
+
+      private
+
+      # Never raise into the provider's response path. A malformed timestamp
+      # from the portal is a bug worth no header; it is not worth a 500 on a
+      # request that already succeeded.
+      #
+      # Types are matched rather than coerced. `Time.parse(12345)` does not
+      # raise — it happily returns a date in 2012 — so a `to_s` here would turn
+      # a nonsense value into a plausible-looking header, which is the one
+      # outcome worse than no header at all.
+      def parse(value)
+        case value
+        when Time then value.utc
+        when String then parse_string(value)
+        end
+      end
+
+      def parse_string(value)
+        return nil if value.empty?
+
+        Time.parse(value).utc
+      rescue ArgumentError, TypeError
+        nil
+      end
+    end
+  end
+end

data/lib/end_point_blank/middleware/rack/report_interaction.rb

@@ -19,6 +19,14 @@ module EndPointBlank
 
           status, headers, body = @app.call(env)
 
+          # RFC 9745 / RFC 8594. The provider writes no code for this: the
+          # portal decided the version is deprecated, authorize relayed the
+          # dates, and this attaches them to the response their consumer
+          # already receives.
+          ::EndPointBlank::DeprecationHeaders
+            .build(::EndPointBlank::Rack::EnvStore.deprecation)
+            .each { |name, value| headers[name] = value }
+
           [status, headers, body]
         rescue ::EndPointBlank::UnauthorizedError => e
           # We don't want to log unauthorized errors as they are expected to happen

data/lib/end_point_blank/rack/env_store.rb

@@ -1,8 +1,28 @@
 module EndPointBlank
   module Rack
+    # Per-request state, keyed off the Rack env.
+    #
+    # Only the env itself is held in a thread-local; everything derived from a
+    # request lives *inside* that env. That distinction is the whole point.
+    #
+    # Threads are reused between requests, so a thread-local is correct only for
+    # as long as something reliably clears it — here, the middleware's `ensure`.
+    # Anything that set a value without that middleware in the stack would
+    # strand it on the thread, and the next request served by that thread could
+    # read the previous caller's data: their app-environment id on our audit
+    # row, their sunset date on our response.
+    #
+    # The env is per-request by construction. The server builds a fresh hash per
+    # request and `set/1` replaces it wholesale at the top of the middleware, so
+    # a stranded value is unreachable even if `clear/0` never runs. Correctness
+    # stops depending on cleanup happening.
+    #
+    # Outside a Rack request there is nowhere to put anything and no response to
+    # decorate, so the writers are no-ops and the readers return nil.
     class EnvStore
       KEY = 'end_point_blank.rack_env'.freeze
       SOURCE_ENV_ID_KEY = 'end_point_blank.source_application_environment_id'.freeze
+      DEPRECATION_KEY = 'end_point_blank.deprecation'.freeze
 
       def self.set(env)
         Thread.current[KEY] = env
@@ -17,18 +37,42 @@ module EndPointBlank
         env && ::Rack::Request.new(env)
       end
 
+      # The calling service's application environment, resolved by `authorize!`
+      # and stamped onto every audit row for this request.
       def self.set_source_application_environment_id(id)
-        Thread.current[SOURCE_ENV_ID_KEY] = id
+        put(SOURCE_ENV_ID_KEY, id)
       end
 
       def self.source_application_environment_id
-        Thread.current[SOURCE_ENV_ID_KEY]
+        fetch(SOURCE_ENV_ID_KEY)
+      end
+
+      # The authorize response's deprecation block, stashed on the way in so the
+      # response middleware can turn it into `Deprecation` and `Sunset` headers
+      # on the way out.
+      def self.set_deprecation(deprecation)
+        put(DEPRECATION_KEY, deprecation)
+      end
+
+      def self.deprecation
+        fetch(DEPRECATION_KEY)
       end
 
       def self.clear
         Thread.current[KEY] = nil
-        Thread.current[SOURCE_ENV_ID_KEY] = nil
       end
+
+      def self.put(key, value)
+        env = get
+        env[key] = value if env
+      end
+      private_class_method :put
+
+      def self.fetch(key)
+        env = get
+        env && env[key]
+      end
+      private_class_method :fetch
     end
   end
-end
+end

data/lib/end_point_blank/rack/headers.rb

@@ -3,6 +3,8 @@ module EndPointBlank
     module Headers
       def self.extract
         env = ::EndPointBlank::Rack::EnvStore.get
+        return {} if env.nil?
+
         env.select { |k,v| k.start_with? 'HTTP_'}.
           transform_keys { |k| k.sub(/^HTTP_/, '').split('_').map(&:capitalize).join('-') }
       end

data/lib/end_point_blank/rails/authorized.rb

@@ -17,6 +17,9 @@ module EndPointBlank
         result_json = JSON.parse(result.body)
         app_env_id = result_json['data'][0]['source_application_environment_id']
         ::EndPointBlank::Rack::EnvStore.set_source_application_environment_id(app_env_id)
+        # Present only when the called version is deprecated; the middleware
+        # turns it into Deprecation / Sunset headers on the way out.
+        ::EndPointBlank::Rack::EnvStore.set_deprecation(result_json['deprecation'])
       end
 
       private

data/lib/end_point_blank/rails/versioned.rb

@@ -4,15 +4,20 @@ module EndPointBlank
       extend ActiveSupport::Concern
 
       class_methods do
-        # Define versioning for specific actions
+        # Record which versions specific actions serve.
+        #
+        # Lifecycle state (Current, Deprecated, ...) is NOT declared here. It is
+        # managed in the EndPointBlank portal, where changing it does not require
+        # shipping code. This reports which versions exist, not what they mean.
+        #
         # @param versions [Array<String>] List of version strings (e.g., ["v1", "v2"])
         # @param options [Hash] Options hash with :only or :except keys
         # @option options [Array<Symbol>] :only Actions to include in versioning
         # @option options [Array<Symbol>] :except Actions to exclude from versioning
         #
         # Example:
-        #   version ["v1", "v2"], only: [:index], state: "Current"
-        #   version ["v3"], except: [:destroy], state: "Deprecated"
+        #   version ["v1", "v2"], only: [:index]
+        #   version ["v3"], except: [:destroy]
         def version(values, options = {})
           versions = Array(values)
           @versioning_config ||= {}
@@ -20,23 +25,16 @@ module EndPointBlank
           actions = determine_actions(options)
 
           actions.each do |action|
-            @versioning_config[action] ||= {}
-            state = options[:state] || "__default__"
-            @versioning_config[action][state] ||= []
-            @versioning_config[action][state] = (@versioning_config[action][state] + versions).uniq
+            # uniq preserves declaration order, so the manifest stays stable
+            # between deploys instead of churning.
+            @versioning_config[action] = ((@versioning_config[action] || []) + versions).uniq
           end
         end
 
-        # Returns the versioning configuration hash
-        # @return [Hash] Hash mapping action names to their version arrays
-        #
-        # Example return value:
-        #   {
-        #     index: ["v1", "v2"],
-        #     show: ["v1"]
-        #   }
+        # Versions the given action serves.
+        # @return [Array<String>] e.g. ["v1", "v2"]; empty when none declared.
         def versions(action)
-          @versioning_config&.fetch(action, {}) || {}
+          @versioning_config&.fetch(action, []) || []
         end
 
         private

data/lib/end_point_blank/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module EndPointBlank
-  VERSION = "0.2.1"
+  VERSION = "0.6.0"
 end

data/lib/end_point_blank/writers/request_writer.rb

@@ -26,11 +26,10 @@ module EndPointBlank
         version = Commands::VersionFinder.new.find(request)
         headers = ::EndPointBlank::Rack::Headers.extract
 
-        payload = {
+        {
           app_name: EndPointBlank::Configuration.instance.app_name,
           env: SessionConfiguration.env_name,
           uuid: request_uuid(env),
-          host: request.host,
           status: request_status(request),
           headers: headers,
           path: request.path,
@@ -38,7 +37,12 @@ module EndPointBlank
           endpoint_version: version,
           request: request_body(request),
           sent_at: Time.now.utc.iso8601(3)
-        }
+        }.merge(
+          ::EndPointBlank::BaseUrl.from_rack_env(
+            env,
+            trust_proxy_headers: EndPointBlank::Configuration.instance.trust_proxy_headers
+          )
+        )
       end
 
       def write()

data/lib/end_point_blank/writers/response_writer.rb

@@ -36,6 +36,7 @@ module EndPointBlank
             body: truncate(normalize_body(body)),
             sent_at: Time.now.utc.iso8601(3),
             route: route,
+            method: request&.request_method,
             data: data,
             source_application_environment_id: source_application_environment_id
         }