foil-server 0.3.4 → 0.4.0

data/spec/sealed-token.md

@@ -11,20 +11,44 @@ This document is the language-agnostic contract for verifying those tokens in pu
 - Confidentiality and integrity: AES-256-GCM
 - Compression: zlib deflate/inflate
 
-## Payload format
+## Payload formats
 
-After base64 decoding, the byte layout is:
+After base64 decoding, use the first byte to select the token version. Reject
+any version other than `0x01` or `0x02`.
+
+### Version `0x01`
+
+The legacy single-recipient byte layout is:
 
 - `version` - 1 byte
 - `nonce` - 12 bytes
 - `ciphertext` - variable length
 - `tag` - 16 bytes
 
-Current version:
-
-- `0x01`
-
-Reject any token whose version byte is not `0x01`.
+### Version `0x02`
+
+The multi-recipient envelope used for independently issued and rotating secret
+keys has this byte layout:
+
+- `version` - 1 byte (`0x02`)
+- `recipient_count` - unsigned 16-bit big-endian integer, 1 through 256
+- `payload_nonce` - 12 bytes
+- `payload_ciphertext_length` - unsigned 32-bit big-endian integer
+- `payload_ciphertext` - zlib-compressed JSON encrypted with a random 32-byte content key
+- `payload_tag` - 16 bytes
+- one fixed-size recipient entry per recipient:
+  - `recipient_id` - `sha256(UTF8(normalized_secret) || 0x00 || UTF8("sealed-results-recipient-id"))`; `0x00` is one NUL byte, and this domain-separated identifier must never expose `normalized_secret`
+  - `wrap_nonce` - 12 bytes
+  - `wrapped_content_key` - 32 bytes
+  - `wrap_tag` - 16 bytes
+
+The payload cipher authenticates
+`UTF8("foil-sealed-results-v2") || 0x00 || UTF8("payload") || 0x00 || header || ordered_recipient_ids`
+as AAD, where each `0x00` is one NUL byte. This binds the complete recipient
+set to the payload. Each content-key wrapper uses the existing derived token key
+and authenticates
+`UTF8("foil-sealed-results-v2") || 0x00 || UTF8("recipient") || 0x00 || recipient_id`
+as AAD.
 
 ## Secret normalization
 
@@ -42,22 +66,27 @@ Normalization rules:
 
 Derive the AES key as:
 
-- `sha256(normalized_secret + "\0sealed-results")`
+- `sha256(UTF8(normalized_secret) || 0x00 || UTF8("sealed-results"))`, where `0x00` is one NUL byte
 
 Use the raw 32-byte digest as the AES-256-GCM key.
 
 ## Verification steps
 
-1. Base64 decode the token
-2. Parse the version byte, nonce, ciphertext, and tag
-3. Normalize the caller's secret material
-4. Derive the AES-256-GCM key
-5. Decrypt using:
-   - algorithm: `aes-256-gcm`
-   - nonce: parsed 12-byte nonce
-   - tag: parsed 16-byte authentication tag
-6. Inflate the decrypted bytes with zlib
-7. Parse the inflated UTF-8 JSON payload
+1. Base64 decode the token.
+2. Parse the version byte.
+3. Normalize the caller's secret material and derive the AES-256-GCM token key.
+4. For version `0x01`:
+   - parse the 12-byte nonce, ciphertext, and 16-byte authentication tag
+   - decrypt the ciphertext with the derived token key, parsed nonce, and tag
+5. For version `0x02`:
+   - parse and bounds-check the header, payload ciphertext, payload tag, and exactly `recipient_count` fixed-size recipient entries
+   - compute the caller's `recipient_id` and select its matching entry; reject the token if no entry matches
+   - build the wrapper AAD from the fixed prefix, NUL separators, and matching `recipient_id`
+   - decrypt `wrapped_content_key` with the derived token key, matching `wrap_nonce`, `wrap_tag`, and wrapper AAD
+   - concatenate every recipient entry's `recipient_id` in encoded order and build the payload AAD from the fixed prefix, NUL separators, encoded header, and ordered IDs
+   - decrypt `payload_ciphertext` with the unwrapped 32-byte content key, `payload_nonce`, `payload_tag`, and payload AAD
+6. Inflate the decrypted payload bytes with zlib.
+7. Parse the inflated UTF-8 JSON payload.
 
 Any failure in decoding, parsing, authentication, decompression, or JSON parsing must be treated as verification failure.
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: foil-server
 version: !ruby/object:Gem::Version
-  version: 0.3.4
+  version: 0.4.0
 platform: ruby
 authors:
 - ABXY Labs
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-20 00:00:00.000000000 Z
+date: 2026-10-05 00:00:00.000000000 Z
 dependencies: []
 description: Customer-facing Ruby SDK for Foil Sessions, Fingerprints, Organizations,
   and sealed token verification.
@@ -24,28 +24,14 @@ files:
 - lib/foil/server/client.rb
 - lib/foil/server/crypto_support.rb
 - lib/foil/server/errors.rb
-- lib/foil/server/gate_delivery.rb
 - lib/foil/server/sealed_token.rb
 - lib/foil/server/types.rb
 - lib/foil/server/version.rb
+- lib/foil/server/webhooks.rb
 - spec/LICENSE
 - spec/README.md
 - spec/fixtures/api/fingerprints/detail.json
 - spec/fixtures/api/fingerprints/list.json
-- spec/fixtures/api/gate/agent-token-revoke.json
-- spec/fixtures/api/gate/agent-token-verify.json
-- spec/fixtures/api/gate/login-session-consume.json
-- spec/fixtures/api/gate/login-session-create.json
-- spec/fixtures/api/gate/registry-detail.json
-- spec/fixtures/api/gate/registry-list.json
-- spec/fixtures/api/gate/service-create.json
-- spec/fixtures/api/gate/service-detail.json
-- spec/fixtures/api/gate/service-disable.json
-- spec/fixtures/api/gate/service-update.json
-- spec/fixtures/api/gate/services-list.json
-- spec/fixtures/api/gate/session-ack.json
-- spec/fixtures/api/gate/session-create.json
-- spec/fixtures/api/gate/session-poll.json
 - spec/fixtures/api/organizations/api-key-create.json
 - spec/fixtures/api/organizations/api-key-list.json
 - spec/fixtures/api/organizations/api-key-revoke.json
@@ -60,14 +46,11 @@ files:
 - spec/fixtures/errors/missing-api-key.json
 - spec/fixtures/errors/not-found.json
 - spec/fixtures/errors/validation-error.json
-- spec/fixtures/gate-delivery/approved-webhook-payload.valid.json
-- spec/fixtures/gate-delivery/delivery-request.json
-- spec/fixtures/gate-delivery/env-policy.json
-- spec/fixtures/gate-delivery/vector.v1.json
-- spec/fixtures/gate-delivery/webhook-signature.json
 - spec/fixtures/manifest.json
 - spec/fixtures/sealed-token/invalid.json
 - spec/fixtures/sealed-token/vector.v1.json
+- spec/fixtures/sealed-token/vector.v2.json
+- spec/fixtures/webhooks/signature.json
 - spec/openapi.json
 - spec/sealed-token.md
 homepage: https://github.com/abxy-labs/foil-server-ruby

data/lib/foil/server/gate_delivery.rb

@@ -1,332 +0,0 @@
-require "base64"
-require "digest"
-require "json"
-require "openssl"
-
-module Foil
-  module Server
-    module GateDelivery
-      GATE_DELIVERY_VERSION = 1
-      GATE_DELIVERY_ALGORITHM = "x25519-hkdf-sha256/aes-256-gcm"
-      GATE_AGENT_TOKEN_ENV_SUFFIX = "_GATE_AGENT_TOKEN"
-      BLOCKED_GATE_ENV_VAR_KEYS = %w[
-        BASH_ENV
-        BROWSER
-        CDPATH
-        DYLD_INSERT_LIBRARIES
-        DYLD_LIBRARY_PATH
-        EDITOR
-        ENV
-        GIT_ASKPASS
-        GIT_SSH_COMMAND
-        HOME
-        LD_LIBRARY_PATH
-        LD_PRELOAD
-        NODE_OPTIONS
-        NODE_PATH
-        PATH
-        PERL5OPT
-        PERLLIB
-        PROMPT_COMMAND
-        PYTHONHOME
-        PYTHONPATH
-        PYTHONSTARTUP
-        RUBYLIB
-        RUBYOPT
-        SHELLOPTS
-        SSH_ASKPASS
-        VISUAL
-        XDG_CONFIG_HOME
-      ].freeze
-      BLOCKED_GATE_ENV_VAR_PREFIXES = %w[NPM_CONFIG_ BUN_CONFIG_ GIT_CONFIG_].freeze
-      WEBHOOK_EVENT_TYPES = %w[
-        session.fingerprint.calculated
-        session.result.persisted
-        gate.session.approved
-        webhook.test
-      ].freeze
-      GATE_DELIVERY_HKDF_INFO = "foil-gate-delivery:v1".b.freeze
-      X25519_SPKI_PREFIX = ["302a300506032b656e032100"].pack("H*").freeze
-
-      module_function
-
-      def derive_gate_agent_token_env_key(service_id)
-        normalized = service_id.to_s.strip.gsub(/[^A-Za-z0-9]+/, "_").gsub(/^_+|_+$/, "").gsub(/_+/, "_").upcase
-        raise ArgumentError, "service_id is required to derive a Gate agent token env key" if normalized.empty?
-
-        return "FOIL#{GATE_AGENT_TOKEN_ENV_SUFFIX}" if ["FOIL", "FOIL"].include?(normalized)
-
-        "#{normalized}#{GATE_AGENT_TOKEN_ENV_SUFFIX}"
-      end
-
-      def is_gate_managed_env_var_key(key)
-        key == "FOIL_AGENT_TOKEN" || key.to_s.end_with?(GATE_AGENT_TOKEN_ENV_SUFFIX)
-      end
-
-      def is_blocked_gate_env_var_key(key)
-        normalized = key.to_s.strip.upcase
-        BLOCKED_GATE_ENV_VAR_KEYS.include?(normalized) || BLOCKED_GATE_ENV_VAR_PREFIXES.any? { |prefix| normalized.start_with?(prefix) }
-      end
-
-      def raw_x25519_public_key_from_key_object(public_key)
-        if public_key.respond_to?(:raw_public_key)
-          raw_public_key = public_key.raw_public_key
-          raise ArgumentError, "X25519 public key must be 32 bytes" unless raw_public_key.bytesize == 32
-
-          return raw_public_key
-        end
-
-        der = public_key.public_to_der
-        raise ArgumentError, "Unexpected X25519 public key encoding" unless der.bytesize == X25519_SPKI_PREFIX.bytesize + 32
-        raise ArgumentError, "Unexpected X25519 public key prefix" unless der.byteslice(0, X25519_SPKI_PREFIX.bytesize) == X25519_SPKI_PREFIX
-
-        der.byteslice(X25519_SPKI_PREFIX.bytesize, 32)
-      end
-
-      def key_id_for_raw_x25519_public_key(raw_public_key)
-        raise ArgumentError, "X25519 public key must be 32 bytes" unless raw_public_key.bytesize == 32
-
-        Base64.urlsafe_encode64(Digest::SHA256.digest(raw_public_key), padding: false)
-      end
-
-      def create_delivery_key_pair
-        CryptoSupport.ensure_supported_runtime!
-        private_key = OpenSSL::PKey.generate_key("X25519")
-        raw_public_key = raw_x25519_public_key_from_key_object(private_key)
-        {
-          delivery: {
-            version: GATE_DELIVERY_VERSION,
-            algorithm: GATE_DELIVERY_ALGORITHM,
-            key_id: key_id_for_raw_x25519_public_key(raw_public_key),
-            public_key: Base64.urlsafe_encode64(raw_public_key, padding: false)
-          },
-          private_key: private_key
-        }
-      end
-
-      def export_delivery_private_key_pkcs8(private_key)
-        CryptoSupport.ensure_supported_runtime!
-        Base64.urlsafe_encode64(private_key.private_to_der, padding: false)
-      end
-
-      def import_delivery_private_key_pkcs8(value)
-        CryptoSupport.ensure_supported_runtime!
-        OpenSSL::PKey.read(b64url_decode(value, "delivery.private_key_pkcs8"))
-      end
-
-      def validate_gate_delivery_request(value)
-        candidate = symbolize(value)
-        raise ArgumentError, "delivery.version must be 1" unless candidate[:version] == GATE_DELIVERY_VERSION
-        raise ArgumentError, "delivery.algorithm must be #{GATE_DELIVERY_ALGORITHM}" unless candidate[:algorithm] == GATE_DELIVERY_ALGORITHM
-        raise ArgumentError, "delivery.public_key is required" if candidate[:public_key].to_s.empty?
-        raise ArgumentError, "delivery.key_id is required" if candidate[:key_id].to_s.empty?
-
-        raw_public_key = b64url_decode(candidate[:public_key], "delivery.public_key")
-        raise ArgumentError, "delivery.public_key must be a raw X25519 public key" unless raw_public_key.bytesize == 32
-        raise ArgumentError, "delivery.key_id does not match delivery.public_key" unless key_id_for_raw_x25519_public_key(raw_public_key) == candidate[:key_id]
-
-        {
-          version: GATE_DELIVERY_VERSION,
-          algorithm: GATE_DELIVERY_ALGORITHM,
-          key_id: candidate[:key_id],
-          public_key: candidate[:public_key]
-        }
-      end
-
-      def create_encrypted_delivery_response(input)
-        {
-          encrypted_delivery: encrypt_gate_delivery_payload(
-            input.fetch(:delivery),
-            {
-              version: GATE_DELIVERY_VERSION,
-              outputs: input.fetch(:outputs)
-            }
-          )
-        }
-      end
-
-      def create_gate_approved_webhook_response(input)
-        create_encrypted_delivery_response(input)
-      end
-
-      def validate_encrypted_gate_delivery_envelope(value)
-        candidate = symbolize(value)
-        raise ArgumentError, "encrypted_delivery.version must be 1" unless candidate[:version] == GATE_DELIVERY_VERSION
-        raise ArgumentError, "encrypted_delivery.algorithm must be #{GATE_DELIVERY_ALGORITHM}" unless candidate[:algorithm] == GATE_DELIVERY_ALGORITHM
-        %i[key_id ephemeral_public_key salt iv ciphertext tag].each do |field|
-          raise ArgumentError, "encrypted_delivery.#{field} is required" if candidate[field].to_s.empty?
-        end
-        raise ArgumentError, "encrypted_delivery.ephemeral_public_key must be 32 bytes" unless b64url_decode(candidate[:ephemeral_public_key], "encrypted_delivery.ephemeral_public_key").bytesize == 32
-        raise ArgumentError, "encrypted_delivery.salt must be 32 bytes" unless b64url_decode(candidate[:salt], "encrypted_delivery.salt").bytesize == 32
-        raise ArgumentError, "encrypted_delivery.iv must be 12 bytes" unless b64url_decode(candidate[:iv], "encrypted_delivery.iv").bytesize == 12
-        raise ArgumentError, "encrypted_delivery.tag must be 16 bytes" unless b64url_decode(candidate[:tag], "encrypted_delivery.tag").bytesize == 16
-
-        candidate
-      end
-
-      def encrypt_gate_delivery_payload(delivery, payload)
-        CryptoSupport.ensure_supported_runtime!
-        validated_delivery = validate_gate_delivery_request(delivery)
-        payload = symbolize(payload)
-        raise ArgumentError, "Gate delivery payload version must be 1" unless payload[:version] == GATE_DELIVERY_VERSION
-
-        recipient_public_key = OpenSSL::PKey.read(X25519_SPKI_PREFIX + b64url_decode(validated_delivery[:public_key], "delivery.public_key"))
-        ephemeral_private_key = OpenSSL::PKey.generate_key("X25519")
-        shared_secret = ephemeral_private_key.derive(recipient_public_key)
-        salt = OpenSSL::Random.random_bytes(32)
-        iv = OpenSSL::Random.random_bytes(12)
-        key = OpenSSL::KDF.hkdf(shared_secret, salt: salt, info: GATE_DELIVERY_HKDF_INFO, length: 32, hash: "SHA256")
-
-        cipher = OpenSSL::Cipher.new("aes-256-gcm")
-        cipher.encrypt
-        cipher.key = key
-        cipher.iv = iv
-        ciphertext = cipher.update(JSON.generate(compact_payload(payload))) + cipher.final
-        tag = cipher.auth_tag
-
-        {
-          version: GATE_DELIVERY_VERSION,
-          algorithm: GATE_DELIVERY_ALGORITHM,
-          key_id: validated_delivery[:key_id],
-          ephemeral_public_key: Base64.urlsafe_encode64(raw_x25519_public_key_from_key_object(ephemeral_private_key), padding: false),
-          salt: Base64.urlsafe_encode64(salt, padding: false),
-          iv: Base64.urlsafe_encode64(iv, padding: false),
-          ciphertext: Base64.urlsafe_encode64(ciphertext, padding: false),
-          tag: Base64.urlsafe_encode64(tag, padding: false)
-        }
-      end
-
-      def decrypt_gate_delivery_envelope(private_key, envelope)
-        CryptoSupport.ensure_supported_runtime!
-        validated = validate_encrypted_gate_delivery_envelope(envelope)
-        shared_secret = private_key.derive(
-          OpenSSL::PKey.read(X25519_SPKI_PREFIX + b64url_decode(validated[:ephemeral_public_key], "encrypted_delivery.ephemeral_public_key"))
-        )
-        key = OpenSSL::KDF.hkdf(
-          shared_secret,
-          salt: b64url_decode(validated[:salt], "encrypted_delivery.salt"),
-          info: GATE_DELIVERY_HKDF_INFO,
-          length: 32,
-          hash: "SHA256"
-        )
-        cipher = OpenSSL::Cipher.new("aes-256-gcm")
-        cipher.decrypt
-        cipher.key = key
-        cipher.iv = b64url_decode(validated[:iv], "encrypted_delivery.iv")
-        cipher.auth_tag = b64url_decode(validated[:tag], "encrypted_delivery.tag")
-        cipher.auth_data = ""
-        plaintext = cipher.update(b64url_decode(validated[:ciphertext], "encrypted_delivery.ciphertext")) + cipher.final
-        payload = JSON.parse(plaintext)
-        raise ArgumentError, "encrypted_delivery payload must be an object" unless payload.is_a?(Hash)
-
-        symbolize(payload).tap do |candidate|
-          raise ArgumentError, "encrypted_delivery payload version must be 1" unless candidate[:version] == GATE_DELIVERY_VERSION
-          raise ArgumentError, "encrypted_delivery payload outputs must be an object" unless candidate[:outputs].is_a?(Hash)
-          candidate[:outputs].each do |key_name, item|
-            raise ArgumentError, "encrypted_delivery output #{key_name} must be a string" unless item.is_a?(String)
-          end
-        end
-      rescue JSON::ParserError
-        raise ArgumentError, "encrypted_delivery decrypted to invalid JSON"
-      end
-
-      def validate_gate_approved_webhook_payload(value)
-        candidate = symbolize(value)
-        raise ArgumentError, "webhook payload must not include event; use the webhook event envelope type" if candidate.key?(:event)
-        raise ArgumentError, "service_id is required" if candidate[:service_id].to_s.empty?
-        raise ArgumentError, "gate_session_id is required" if candidate[:gate_session_id].to_s.empty?
-        raise ArgumentError, "gate_account_id is required" if candidate[:gate_account_id].to_s.empty?
-        raise ArgumentError, "account_name is required" if candidate[:account_name].to_s.empty?
-        raise ArgumentError, "metadata must be an object or null" unless candidate[:metadata].nil? || candidate[:metadata].is_a?(Hash)
-        raise ArgumentError, "foil must be an object" unless candidate[:foil].is_a?(Hash)
-        verdict = candidate[:foil][:verdict]
-        raise ArgumentError, "foil.verdict is invalid" unless %w[bot human inconclusive].include?(verdict)
-        score = candidate[:foil][:score]
-        raise ArgumentError, "foil.score must be a number or null" unless score.nil? || score.is_a?(Numeric)
-
-        {
-          service_id: candidate[:service_id],
-          gate_session_id: candidate[:gate_session_id],
-          gate_account_id: candidate[:gate_account_id],
-          account_name: candidate[:account_name],
-          metadata: candidate[:metadata]&.dup,
-          foil: {
-            verdict: verdict,
-            score: score
-          },
-          delivery: validate_gate_delivery_request(candidate[:delivery])
-        }
-      end
-
-      def verify_gate_webhook_signature(secret:, timestamp:, raw_body:, signature:, max_age_seconds: 300, now_seconds: nil)
-        parsed_timestamp = Integer(timestamp)
-        current = now_seconds || Time.now.to_i
-        return false if (current - parsed_timestamp).abs > max_age_seconds
-
-        expected = OpenSSL::HMAC.hexdigest("SHA256", secret, "#{timestamp}.#{raw_body}")
-        secure_compare(expected, signature)
-      rescue ArgumentError
-        false
-      end
-
-      def parse_webhook_event(raw_body)
-        envelope = symbolize(JSON.parse(raw_body))
-        raise ArgumentError, "webhook event object must be webhook_event" unless envelope[:object] == "webhook_event"
-        raise ArgumentError, "webhook event id is required" if envelope[:id].to_s.empty?
-        raise ArgumentError, "webhook event type is required" if envelope[:type].to_s.empty?
-        raise ArgumentError, "unsupported webhook event type: #{envelope[:type]}" unless WEBHOOK_EVENT_TYPES.include?(envelope[:type])
-        raise ArgumentError, "webhook event created timestamp is required" if envelope[:created].to_s.empty?
-        raise ArgumentError, "webhook event data must be an object" unless envelope[:data].is_a?(Hash)
-
-        envelope[:data] = validate_gate_approved_webhook_payload(envelope[:data]) if envelope[:type] == "gate.session.approved"
-        envelope
-      end
-
-      def verify_and_parse_webhook_event(secret:, timestamp:, raw_body:, signature:, max_age_seconds: 300, now_seconds: nil)
-        unless verify_gate_webhook_signature(secret: secret, timestamp: timestamp, raw_body: raw_body, signature: signature, max_age_seconds: max_age_seconds, now_seconds: now_seconds)
-          raise ArgumentError, "Invalid Foil webhook signature"
-        end
-        parse_webhook_event(raw_body)
-      end
-
-      def symbolize(value)
-        case value
-        when Array
-          value.map { |item| symbolize(item) }
-        when Hash
-          value.each_with_object({}) do |(key, item), memo|
-            memo[key.to_sym] = symbolize(item)
-          end
-        else
-          value
-        end
-      end
-      private_class_method :symbolize
-
-      def compact_payload(payload)
-        {
-          version: payload[:version],
-          outputs: payload[:outputs],
-          **(payload[:ack_token] ? { ack_token: payload[:ack_token] } : {})
-        }
-      end
-      private_class_method :compact_payload
-
-      def b64url_decode(value, label)
-        Base64.urlsafe_decode64(value.to_s)
-      rescue ArgumentError => error
-        raise ArgumentError, "Invalid #{label}: #{error.message}"
-      end
-      private_class_method :b64url_decode
-
-      def secure_compare(left, right)
-        return false unless left.bytesize == right.bytesize
-
-        result = 0
-        left.bytes.zip(right.bytes) { |a, b| result |= a ^ b }
-        result.zero?
-      end
-      private_class_method :secure_compare
-    end
-  end
-end

data/spec/fixtures/api/gate/agent-token-revoke.json

@@ -1,3 +0,0 @@
-{
-  "status": 204
-}

data/spec/fixtures/api/gate/agent-token-verify.json

@@ -1,12 +0,0 @@
-{
-  "data": {
-    "valid": true,
-    "gate_account_id": "gacct_0123456789abcdefghjkmnpqrs",
-    "status": "active",
-    "created_at": "2026-04-01T12:00:00.000Z",
-    "expires_at": "2026-06-30T12:00:00.000Z"
-  },
-  "meta": {
-    "request_id": "req_0123456789abcdef0123456789abcdef"
-  }
-}

data/spec/fixtures/api/gate/login-session-consume.json

@@ -1,10 +0,0 @@
-{
-  "data": {
-    "object": "gate_dashboard_login",
-    "gate_account_id": "gacct_0123456789abcdefghjkmnpqrs",
-    "account_name": "my-project"
-  },
-  "meta": {
-    "request_id": "req_0123456789abcdef0123456789abcdef"
-  }
-}

data/spec/fixtures/api/gate/login-session-create.json

@@ -1,12 +0,0 @@
-{
-  "data": {
-    "object": "gate_login_session",
-    "id": "gate_1123456789abcdefghjkmnpqrs",
-    "status": "pending",
-    "consent_url": "https://usefoil.com/gate?session=gate_1123456789abcdefghjkmnpqrs",
-    "expires_at": "2026-04-04T20:20:00.000Z"
-  },
-  "meta": {
-    "request_id": "req_0123456789abcdef0123456789abcdef"
-  }
-}

data/spec/fixtures/api/gate/registry-detail.json

@@ -1,45 +0,0 @@
-{
-  "data": {
-    "id": "foil",
-    "status": "active",
-    "discoverable": true,
-    "name": "Foil",
-    "description": "Detect AI agents and malicious users",
-    "website": "https://usefoil.com",
-    "dashboard_login_url": "https://dashboard.usefoil.com/auth/gate",
-    "env_vars": [
-      {
-        "name": "Publishable key",
-        "key": "FOIL_PUBLISHABLE_KEY",
-        "secret": false
-      },
-      {
-        "name": "Secret key",
-        "key": "FOIL_SECRET_KEY",
-        "secret": true
-      }
-    ],
-    "docs_url": "https://usefoil.com/docs",
-    "sdks": [
-      {
-        "label": "Node",
-        "install": "npm install @abxy/foil-server",
-        "url": "https://www.npmjs.com/package/@abxy/foil-server"
-      }
-    ],
-    "branding": {
-      "logo_url": "https://usefoil.com/logo.png",
-      "primary_color": "#117BE7",
-      "secondary_color": "#0B5CAD",
-      "ascii_art": "FOIL",
-      "verified": true
-    },
-    "consent": {
-      "terms_url": "https://usefoil.com/terms",
-      "privacy_url": "https://usefoil.com/privacy"
-    }
-  },
-  "meta": {
-    "request_id": "req_0123456789abcdef0123456789abcdef"
-  }
-}

data/spec/fixtures/api/gate/registry-list.json

@@ -1,47 +0,0 @@
-{
-  "data": [
-    {
-      "id": "foil",
-      "status": "active",
-      "discoverable": true,
-      "name": "Foil",
-      "description": "Detect AI agents and malicious users",
-      "website": "https://usefoil.com",
-      "dashboard_login_url": "https://dashboard.usefoil.com/auth/gate",
-      "env_vars": [
-        {
-          "name": "Publishable key",
-          "key": "FOIL_PUBLISHABLE_KEY",
-          "secret": false
-        },
-        {
-          "name": "Secret key",
-          "key": "FOIL_SECRET_KEY",
-          "secret": true
-        }
-      ],
-      "docs_url": "https://usefoil.com/docs",
-      "sdks": [
-        {
-          "label": "Node",
-          "install": "npm install @abxy/foil-server",
-          "url": "https://www.npmjs.com/package/@abxy/foil-server"
-        }
-      ],
-      "branding": {
-        "logo_url": "https://usefoil.com/logo.png",
-        "primary_color": "#117BE7",
-        "secondary_color": "#0B5CAD",
-        "ascii_art": "FOIL",
-        "verified": true
-      },
-      "consent": {
-        "terms_url": "https://usefoil.com/terms",
-        "privacy_url": "https://usefoil.com/privacy"
-      }
-    }
-  ],
-  "meta": {
-    "request_id": "req_0123456789abcdef0123456789abcdef"
-  }
-}

data/spec/fixtures/api/gate/service-create.json

@@ -1,49 +0,0 @@
-{
-  "data": {
-    "object": "gate_service",
-    "id": "acme_prod",
-    "status": "active",
-    "discoverable": false,
-    "name": "Acme Production",
-    "description": "Acme production signup flow",
-    "website": "https://acme.example.com",
-    "dashboard_login_url": "https://dashboard.acme.example.com/auth/gate",
-    "env_vars": [
-      {
-        "name": "Publishable key",
-        "key": "ACME_PUBLISHABLE_KEY",
-        "secret": false
-      },
-      {
-        "name": "Secret key",
-        "key": "ACME_SECRET_KEY",
-        "secret": true
-      }
-    ],
-    "docs_url": "https://docs.acme.example.com/signup",
-    "sdks": [
-      {
-        "label": "Node",
-        "install": "npm install @acme/sdk",
-        "url": "https://www.npmjs.com/package/@acme/sdk"
-      }
-    ],
-    "branding": {
-      "logo_url": "https://acme.example.com/logo.png",
-      "primary_color": "#117BE7",
-      "secondary_color": "#0B5CAD",
-      "ascii_art": "ACME",
-      "verified": false
-    },
-    "consent": {
-      "terms_url": "https://acme.example.com/terms",
-      "privacy_url": "https://acme.example.com/privacy"
-    },
-    "created_at": "2026-04-03T20:00:00.000Z",
-    "updated_at": "2026-04-03T20:00:00.000Z",
-    "webhook_endpoint_id": "we_0123456789abcdef0123456789abcdef"
-  },
-  "meta": {
-    "request_id": "req_0123456789abcdef0123456789abcdef"
-  }
-}