@tangle-network/agent-interface 5.2.1 → 5.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (37) hide show
  1. package/dist/agent-candidate-code-schema.d.ts +63 -14
  2. package/dist/agent-candidate-code-schema.js +2 -1
  3. package/dist/agent-candidate-execution-plan-schema.d.ts +262 -20
  4. package/dist/agent-candidate-execution-plan-schema.js +30 -7
  5. package/dist/agent-candidate-profile-schema.d.ts +63 -8
  6. package/dist/agent-candidate-profile-schema.js +2 -0
  7. package/dist/agent-candidate-promotion-schema.d.ts +952 -100
  8. package/dist/agent-candidate-receipt-schema.d.ts +104 -8
  9. package/dist/agent-candidate-schema-common.d.ts +30 -3
  10. package/dist/agent-candidate-schema-common.js +14 -8
  11. package/dist/agent-candidate-schema.d.ts +72 -10
  12. package/dist/agent-candidate.d.ts +12 -4
  13. package/dist/agent-execution-preparation-receipt.d.ts +2 -0
  14. package/dist/agent-execution-preparation.js +4 -2
  15. package/dist/agent-profile-materialization.d.ts +1 -1
  16. package/dist/agent-profile-materialization.js +3 -0
  17. package/dist/agent-profile.d.ts +6 -0
  18. package/dist/environment-interactive-control.d.ts +10 -0
  19. package/dist/environment-interactive-start.d.ts +33 -6
  20. package/dist/environment-profile-capabilities.d.ts +18 -0
  21. package/dist/environment-profile-capabilities.js +2 -0
  22. package/dist/environment-provider.d.ts +1 -0
  23. package/dist/environment-provider.js +1 -0
  24. package/dist/environment-runtime.d.ts +176 -18
  25. package/dist/environment-runtime.js +14 -1
  26. package/dist/harness-capabilities.js +1 -1
  27. package/dist/index.d.ts +1 -0
  28. package/dist/index.js +1 -0
  29. package/dist/portable-context-transfer.d.ts +33 -6
  30. package/dist/profile-diff.d.ts +4 -3
  31. package/dist/profile-diff.js +3 -0
  32. package/dist/profile-schema.d.ts +50 -21
  33. package/dist/profile-schema.js +6 -13
  34. package/dist/proxy-secrets.d.ts +329 -0
  35. package/dist/proxy-secrets.js +183 -0
  36. package/fixtures/proxy-secret-wire-v1.json +1119 -0
  37. package/package.json +2 -1
package/fixtures/proxy-secret-wire-v1.json ADDED
@@ -0,0 +1,1119 @@
1
+ {
2
+ "protocolVersion": 1,
3
+ "declarations": [
4
+ {
5
+ "name": "bearer",
6
+ "value": {
7
+ "envName": "REPORTS_TOKEN",
8
+ "secretRef": {
9
+ "kind": "secret-ref",
10
+ "key": "reporting-api"
11
+ },
12
+ "hosts": [
13
+ "reports.example.com"
14
+ ],
15
+ "presentation": {
16
+ "type": "bearer"
17
+ }
18
+ },
19
+ "valid": true
20
+ },
21
+ {
22
+ "name": "uppercase-host",
23
+ "value": {
24
+ "envName": "REPORTS_TOKEN",
25
+ "secretRef": {
26
+ "kind": "secret-ref",
27
+ "key": "reporting-api"
28
+ },
29
+ "hosts": [
30
+ "Reports.example.com"
31
+ ],
32
+ "presentation": {
33
+ "type": "bearer"
34
+ }
35
+ },
36
+ "valid": false
37
+ },
38
+ {
39
+ "name": "alternate-port",
40
+ "value": {
41
+ "envName": "REPORTS_TOKEN",
42
+ "secretRef": {
43
+ "kind": "secret-ref",
44
+ "key": "reporting-api"
45
+ },
46
+ "hosts": [
47
+ "reports.example.com:8443"
48
+ ],
49
+ "presentation": {
50
+ "type": "bearer"
51
+ }
52
+ },
53
+ "valid": false
54
+ },
55
+ {
56
+ "name": "wildcard",
57
+ "value": {
58
+ "envName": "REPORTS_TOKEN",
59
+ "secretRef": {
60
+ "kind": "secret-ref",
61
+ "key": "reporting-api"
62
+ },
63
+ "hosts": [
64
+ "*.example.com"
65
+ ],
66
+ "presentation": {
67
+ "type": "bearer"
68
+ }
69
+ },
70
+ "valid": false
71
+ },
72
+ {
73
+ "name": "ip",
74
+ "value": {
75
+ "envName": "REPORTS_TOKEN",
76
+ "secretRef": {
77
+ "kind": "secret-ref",
78
+ "key": "reporting-api"
79
+ },
80
+ "hosts": [
81
+ "127.0.0.1"
82
+ ],
83
+ "presentation": {
84
+ "type": "bearer"
85
+ }
86
+ },
87
+ "valid": false
88
+ },
89
+ {
90
+ "name": "dot-path",
91
+ "value": {
92
+ "envName": "REPORTS_TOKEN",
93
+ "secretRef": {
94
+ "kind": "secret-ref",
95
+ "key": "reporting-api"
96
+ },
97
+ "hosts": [
98
+ "reports.example.com"
99
+ ],
100
+ "presentation": {
101
+ "type": "bearer"
102
+ },
103
+ "paths": [
104
+ "/v1/../admin"
105
+ ]
106
+ },
107
+ "valid": false
108
+ },
109
+ {
110
+ "name": "encoded-path",
111
+ "value": {
112
+ "envName": "REPORTS_TOKEN",
113
+ "secretRef": {
114
+ "kind": "secret-ref",
115
+ "key": "reporting-api"
116
+ },
117
+ "hosts": [
118
+ "reports.example.com"
119
+ ],
120
+ "presentation": {
121
+ "type": "bearer"
122
+ },
123
+ "paths": [
124
+ "/v1/%2fadmin"
125
+ ]
126
+ },
127
+ "valid": false
128
+ },
129
+ {
130
+ "name": "query-path",
131
+ "value": {
132
+ "envName": "REPORTS_TOKEN",
133
+ "secretRef": {
134
+ "kind": "secret-ref",
135
+ "key": "reporting-api"
136
+ },
137
+ "hosts": [
138
+ "reports.example.com"
139
+ ],
140
+ "presentation": {
141
+ "type": "bearer"
142
+ },
143
+ "paths": [
144
+ "/v1?x=y"
145
+ ]
146
+ },
147
+ "valid": false
148
+ },
149
+ {
150
+ "name": "slash-path",
151
+ "value": {
152
+ "envName": "REPORTS_TOKEN",
153
+ "secretRef": {
154
+ "kind": "secret-ref",
155
+ "key": "reporting-api"
156
+ },
157
+ "hosts": [
158
+ "reports.example.com"
159
+ ],
160
+ "presentation": {
161
+ "type": "bearer"
162
+ },
163
+ "paths": [
164
+ "//v1"
165
+ ]
166
+ },
167
+ "valid": false
168
+ },
169
+ {
170
+ "name": "basic-colon",
171
+ "value": {
172
+ "envName": "REPORTS_TOKEN",
173
+ "secretRef": {
174
+ "kind": "secret-ref",
175
+ "key": "reporting-api"
176
+ },
177
+ "hosts": [
178
+ "reports.example.com"
179
+ ],
180
+ "presentation": {
181
+ "type": "basic",
182
+ "username": "user:name"
183
+ }
184
+ },
185
+ "valid": false
186
+ },
187
+ {
188
+ "name": "header-duplicate-selector",
189
+ "value": {
190
+ "envName": "REPORTS_TOKEN",
191
+ "secretRef": {
192
+ "kind": "secret-ref",
193
+ "key": "reporting-api"
194
+ },
195
+ "hosts": [
196
+ "reports.example.com"
197
+ ],
198
+ "presentation": {
199
+ "type": "header",
200
+ "name": "bad name"
201
+ }
202
+ },
203
+ "valid": false
204
+ },
205
+ {
206
+ "name": "basic",
207
+ "value": {
208
+ "envName": "REPORTS_TOKEN",
209
+ "secretRef": {
210
+ "kind": "secret-ref",
211
+ "key": "reporting-api"
212
+ },
213
+ "hosts": [
214
+ "reports.example.com"
215
+ ],
216
+ "presentation": {
217
+ "type": "basic",
218
+ "username": "public-user"
219
+ }
220
+ },
221
+ "valid": true
222
+ },
223
+ {
224
+ "name": "header",
225
+ "value": {
226
+ "envName": "REPORTS_TOKEN",
227
+ "secretRef": {
228
+ "kind": "secret-ref",
229
+ "key": "reporting-api"
230
+ },
231
+ "hosts": [
232
+ "reports.example.com"
233
+ ],
234
+ "presentation": {
235
+ "type": "header",
236
+ "name": "X-Api-Key"
237
+ }
238
+ },
239
+ "valid": true
240
+ },
241
+ {
242
+ "name": "query",
243
+ "value": {
244
+ "envName": "REPORTS_TOKEN",
245
+ "secretRef": {
246
+ "kind": "secret-ref",
247
+ "key": "reporting-api"
248
+ },
249
+ "hosts": [
250
+ "reports.example.com"
251
+ ],
252
+ "presentation": {
253
+ "type": "query",
254
+ "name": "api_key"
255
+ }
256
+ },
257
+ "valid": true
258
+ }
259
+ ],
260
+ "wireCases": [
261
+ {
262
+ "name": "exact-bearer",
263
+ "request": {
264
+ "scheme": "https",
265
+ "authority": "reports.example.com",
266
+ "sni": "reports.example.com",
267
+ "method": "POST",
268
+ "path": "/v1/events/one",
269
+ "headers": [
270
+ [
271
+ "Authorization",
272
+ "Bearer opaque-placeholder"
273
+ ]
274
+ ],
275
+ "query": ""
276
+ },
277
+ "authorized": true,
278
+ "reason": "complete credential component",
279
+ "binding": {
280
+ "envName": "REPORTS_TOKEN",
281
+ "secretRef": {
282
+ "kind": "secret-ref",
283
+ "key": "reporting-api"
284
+ },
285
+ "hosts": [
286
+ "reports.example.com"
287
+ ],
288
+ "methods": [
289
+ "POST"
290
+ ],
291
+ "paths": [
292
+ "/v1/events/*"
293
+ ],
294
+ "presentation": {
295
+ "type": "bearer"
296
+ }
297
+ },
298
+ "placeholder": "opaque-placeholder"
299
+ },
300
+ {
301
+ "name": "substring",
302
+ "request": {
303
+ "scheme": "https",
304
+ "authority": "reports.example.com",
305
+ "sni": "reports.example.com",
306
+ "method": "POST",
307
+ "path": "/v1/events/one",
308
+ "headers": [
309
+ [
310
+ "Authorization",
311
+ "Bearer prefixopaque-placeholder"
312
+ ]
313
+ ],
314
+ "query": ""
315
+ },
316
+ "authorized": false,
317
+ "reason": "embedded placeholder",
318
+ "binding": {
319
+ "envName": "REPORTS_TOKEN",
320
+ "secretRef": {
321
+ "kind": "secret-ref",
322
+ "key": "reporting-api"
323
+ },
324
+ "hosts": [
325
+ "reports.example.com"
326
+ ],
327
+ "methods": [
328
+ "POST"
329
+ ],
330
+ "paths": [
331
+ "/v1/events/*"
332
+ ],
333
+ "presentation": {
334
+ "type": "bearer"
335
+ }
336
+ },
337
+ "placeholder": "opaque-placeholder"
338
+ },
339
+ {
340
+ "name": "duplicate-header",
341
+ "request": {
342
+ "scheme": "https",
343
+ "authority": "reports.example.com",
344
+ "sni": "reports.example.com",
345
+ "method": "POST",
346
+ "path": "/v1/events/one",
347
+ "headers": [
348
+ [
349
+ "Authorization",
350
+ "Bearer opaque-placeholder"
351
+ ],
352
+ [
353
+ "authorization",
354
+ "Bearer opaque-placeholder"
355
+ ]
356
+ ],
357
+ "query": ""
358
+ },
359
+ "authorized": false,
360
+ "reason": "case-insensitive duplicate",
361
+ "binding": {
362
+ "envName": "REPORTS_TOKEN",
363
+ "secretRef": {
364
+ "kind": "secret-ref",
365
+ "key": "reporting-api"
366
+ },
367
+ "hosts": [
368
+ "reports.example.com"
369
+ ],
370
+ "methods": [
371
+ "POST"
372
+ ],
373
+ "paths": [
374
+ "/v1/events/*"
375
+ ],
376
+ "presentation": {
377
+ "type": "bearer"
378
+ }
379
+ },
380
+ "placeholder": "opaque-placeholder"
381
+ },
382
+ {
383
+ "name": "duplicate-query",
384
+ "request": {
385
+ "scheme": "https",
386
+ "authority": "reports.example.com",
387
+ "sni": "reports.example.com",
388
+ "method": "POST",
389
+ "path": "/v1/events/one",
390
+ "headers": [],
391
+ "query": "api_key=opaque-placeholder&api_key=opaque-placeholder"
392
+ },
393
+ "authorized": false,
394
+ "reason": "duplicate decoded selector",
395
+ "binding": {
396
+ "envName": "REPORTS_TOKEN",
397
+ "secretRef": {
398
+ "kind": "secret-ref",
399
+ "key": "reporting-api"
400
+ },
401
+ "hosts": [
402
+ "reports.example.com"
403
+ ],
404
+ "methods": [
405
+ "POST"
406
+ ],
407
+ "paths": [
408
+ "/v1/events/*"
409
+ ],
410
+ "presentation": {
411
+ "type": "query",
412
+ "name": "api_key"
413
+ }
414
+ },
415
+ "placeholder": "opaque-placeholder"
416
+ },
417
+ {
418
+ "name": "query-spill",
419
+ "request": {
420
+ "scheme": "https",
421
+ "authority": "reports.example.com",
422
+ "sni": "reports.example.com",
423
+ "method": "POST",
424
+ "path": "/v1/events/one",
425
+ "headers": [],
426
+ "query": "other=opaque-placeholder"
427
+ },
428
+ "authorized": false,
429
+ "reason": "wrong selector",
430
+ "binding": {
431
+ "envName": "REPORTS_TOKEN",
432
+ "secretRef": {
433
+ "kind": "secret-ref",
434
+ "key": "reporting-api"
435
+ },
436
+ "hosts": [
437
+ "reports.example.com"
438
+ ],
439
+ "methods": [
440
+ "POST"
441
+ ],
442
+ "paths": [
443
+ "/v1/events/*"
444
+ ],
445
+ "presentation": {
446
+ "type": "query",
447
+ "name": "api_key"
448
+ }
449
+ },
450
+ "placeholder": "opaque-placeholder"
451
+ },
452
+ {
453
+ "name": "encoded-query-duplicate",
454
+ "request": {
455
+ "scheme": "https",
456
+ "authority": "reports.example.com",
457
+ "sni": "reports.example.com",
458
+ "method": "POST",
459
+ "path": "/v1/events/one",
460
+ "headers": [],
461
+ "query": "api_key=opaque-placeholder&api%5fkey=opaque-placeholder"
462
+ },
463
+ "authorized": false,
464
+ "reason": "duplicate after one percent decode",
465
+ "binding": {
466
+ "envName": "REPORTS_TOKEN",
467
+ "secretRef": {
468
+ "kind": "secret-ref",
469
+ "key": "reporting-api"
470
+ },
471
+ "hosts": [
472
+ "reports.example.com"
473
+ ],
474
+ "methods": [
475
+ "POST"
476
+ ],
477
+ "paths": [
478
+ "/v1/events/*"
479
+ ],
480
+ "presentation": {
481
+ "type": "query",
482
+ "name": "api_key"
483
+ }
484
+ },
485
+ "placeholder": "opaque-placeholder"
486
+ },
487
+ {
488
+ "name": "encoded-slash",
489
+ "request": {
490
+ "scheme": "https",
491
+ "authority": "reports.example.com",
492
+ "sni": "reports.example.com",
493
+ "method": "POST",
494
+ "path": "/v1/events%2fone",
495
+ "headers": [
496
+ [
497
+ "Authorization",
498
+ "Bearer opaque-placeholder"
499
+ ]
500
+ ],
501
+ "query": ""
502
+ },
503
+ "authorized": false,
504
+ "reason": "noncanonical path",
505
+ "binding": {
506
+ "envName": "REPORTS_TOKEN",
507
+ "secretRef": {
508
+ "kind": "secret-ref",
509
+ "key": "reporting-api"
510
+ },
511
+ "hosts": [
512
+ "reports.example.com"
513
+ ],
514
+ "methods": [
515
+ "POST"
516
+ ],
517
+ "paths": [
518
+ "/v1/events/*"
519
+ ],
520
+ "presentation": {
521
+ "type": "bearer"
522
+ }
523
+ },
524
+ "placeholder": "opaque-placeholder"
525
+ },
526
+ {
527
+ "name": "authority-sni",
528
+ "request": {
529
+ "scheme": "https",
530
+ "authority": "reports.example.com",
531
+ "sni": "other.example.com",
532
+ "method": "POST",
533
+ "path": "/v1/events/one",
534
+ "headers": [
535
+ [
536
+ "Authorization",
537
+ "Bearer opaque-placeholder"
538
+ ]
539
+ ],
540
+ "query": ""
541
+ },
542
+ "authorized": false,
543
+ "reason": "authority and SNI must agree",
544
+ "binding": {
545
+ "envName": "REPORTS_TOKEN",
546
+ "secretRef": {
547
+ "kind": "secret-ref",
548
+ "key": "reporting-api"
549
+ },
550
+ "hosts": [
551
+ "reports.example.com"
552
+ ],
553
+ "methods": [
554
+ "POST"
555
+ ],
556
+ "paths": [
557
+ "/v1/events/*"
558
+ ],
559
+ "presentation": {
560
+ "type": "bearer"
561
+ }
562
+ },
563
+ "placeholder": "opaque-placeholder"
564
+ },
565
+ {
566
+ "name": "http",
567
+ "request": {
568
+ "scheme": "http",
569
+ "authority": "reports.example.com",
570
+ "sni": "reports.example.com",
571
+ "method": "POST",
572
+ "path": "/v1/events/one",
573
+ "headers": [
574
+ [
575
+ "Authorization",
576
+ "Bearer opaque-placeholder"
577
+ ]
578
+ ],
579
+ "query": ""
580
+ },
581
+ "authorized": false,
582
+ "reason": "HTTPS required",
583
+ "binding": {
584
+ "envName": "REPORTS_TOKEN",
585
+ "secretRef": {
586
+ "kind": "secret-ref",
587
+ "key": "reporting-api"
588
+ },
589
+ "hosts": [
590
+ "reports.example.com"
591
+ ],
592
+ "methods": [
593
+ "POST"
594
+ ],
595
+ "paths": [
596
+ "/v1/events/*"
597
+ ],
598
+ "presentation": {
599
+ "type": "bearer"
600
+ }
601
+ },
602
+ "placeholder": "opaque-placeholder"
603
+ },
604
+ {
605
+ "name": "alternate-port",
606
+ "request": {
607
+ "scheme": "https",
608
+ "authority": "reports.example.com:8443",
609
+ "sni": "reports.example.com",
610
+ "method": "POST",
611
+ "path": "/v1/events/one",
612
+ "headers": [
613
+ [
614
+ "Authorization",
615
+ "Bearer opaque-placeholder"
616
+ ]
617
+ ],
618
+ "query": ""
619
+ },
620
+ "authorized": false,
621
+ "reason": "443 only",
622
+ "binding": {
623
+ "envName": "REPORTS_TOKEN",
624
+ "secretRef": {
625
+ "kind": "secret-ref",
626
+ "key": "reporting-api"
627
+ },
628
+ "hosts": [
629
+ "reports.example.com"
630
+ ],
631
+ "methods": [
632
+ "POST"
633
+ ],
634
+ "paths": [
635
+ "/v1/events/*"
636
+ ],
637
+ "presentation": {
638
+ "type": "bearer"
639
+ }
640
+ },
641
+ "placeholder": "opaque-placeholder"
642
+ },
643
+ {
644
+ "name": "wrong-basic-user",
645
+ "request": {
646
+ "scheme": "https",
647
+ "authority": "reports.example.com",
648
+ "sni": "reports.example.com",
649
+ "method": "POST",
650
+ "path": "/v1/events/one",
651
+ "headers": [
652
+ [
653
+ "Authorization",
654
+ "Basic d3Jvbmc6b3BhcXVlLXBsYWNlaG9sZGVy"
655
+ ]
656
+ ],
657
+ "query": ""
658
+ },
659
+ "authorized": false,
660
+ "reason": "public username differs",
661
+ "binding": {
662
+ "envName": "REPORTS_TOKEN",
663
+ "secretRef": {
664
+ "kind": "secret-ref",
665
+ "key": "reporting-api"
666
+ },
667
+ "hosts": [
668
+ "reports.example.com"
669
+ ],
670
+ "methods": [
671
+ "POST"
672
+ ],
673
+ "paths": [
674
+ "/v1/events/*"
675
+ ],
676
+ "presentation": {
677
+ "type": "basic",
678
+ "username": "public-user"
679
+ }
680
+ },
681
+ "placeholder": "opaque-placeholder"
682
+ },
683
+ {
684
+ "name": "exact-basic",
685
+ "binding": {
686
+ "envName": "REPORTS_TOKEN",
687
+ "secretRef": {
688
+ "kind": "secret-ref",
689
+ "key": "reporting-api"
690
+ },
691
+ "hosts": [
692
+ "reports.example.com"
693
+ ],
694
+ "methods": [
695
+ "POST"
696
+ ],
697
+ "paths": [
698
+ "/v1/events/*"
699
+ ],
700
+ "presentation": {
701
+ "type": "basic",
702
+ "username": "public-user"
703
+ }
704
+ },
705
+ "placeholder": "opaque-placeholder",
706
+ "request": {
707
+ "scheme": "https",
708
+ "authority": "reports.example.com",
709
+ "sni": "reports.example.com",
710
+ "method": "POST",
711
+ "path": "/v1/events/one",
712
+ "headers": [
713
+ [
714
+ "Authorization",
715
+ "Basic cHVibGljLXVzZXI6b3BhcXVlLXBsYWNlaG9sZGVy"
716
+ ]
717
+ ],
718
+ "query": ""
719
+ },
720
+ "authorized": true,
721
+ "reason": "exact selected component over HTTPS/443"
722
+ },
723
+ {
724
+ "name": "exact-header",
725
+ "binding": {
726
+ "envName": "REPORTS_TOKEN",
727
+ "secretRef": {
728
+ "kind": "secret-ref",
729
+ "key": "reporting-api"
730
+ },
731
+ "hosts": [
732
+ "reports.example.com"
733
+ ],
734
+ "methods": [
735
+ "POST"
736
+ ],
737
+ "paths": [
738
+ "/v1/events/*"
739
+ ],
740
+ "presentation": {
741
+ "type": "header",
742
+ "name": "X-Api-Key"
743
+ }
744
+ },
745
+ "placeholder": "opaque-placeholder",
746
+ "request": {
747
+ "scheme": "https",
748
+ "authority": "reports.example.com",
749
+ "sni": "reports.example.com",
750
+ "method": "POST",
751
+ "path": "/v1/events/one",
752
+ "headers": [
753
+ [
754
+ "x-api-key",
755
+ "opaque-placeholder"
756
+ ]
757
+ ],
758
+ "query": ""
759
+ },
760
+ "authorized": true,
761
+ "reason": "exact selected component over HTTPS/443"
762
+ },
763
+ {
764
+ "name": "exact-query",
765
+ "binding": {
766
+ "envName": "REPORTS_TOKEN",
767
+ "secretRef": {
768
+ "kind": "secret-ref",
769
+ "key": "reporting-api"
770
+ },
771
+ "hosts": [
772
+ "reports.example.com"
773
+ ],
774
+ "methods": [
775
+ "POST"
776
+ ],
777
+ "paths": [
778
+ "/v1/events/*"
779
+ ],
780
+ "presentation": {
781
+ "type": "query",
782
+ "name": "api_key"
783
+ }
784
+ },
785
+ "placeholder": "opaque-placeholder",
786
+ "request": {
787
+ "scheme": "https",
788
+ "authority": "reports.example.com",
789
+ "sni": "reports.example.com",
790
+ "method": "POST",
791
+ "path": "/v1/events/one",
792
+ "headers": [],
793
+ "query": "api_key=opaque-placeholder"
794
+ },
795
+ "authorized": true,
796
+ "reason": "exact selected component over HTTPS/443"
797
+ },
798
+ {
799
+ "name": "explicit-443",
800
+ "binding": {
801
+ "envName": "REPORTS_TOKEN",
802
+ "secretRef": {
803
+ "kind": "secret-ref",
804
+ "key": "reporting-api"
805
+ },
806
+ "hosts": [
807
+ "reports.example.com"
808
+ ],
809
+ "methods": [
810
+ "POST"
811
+ ],
812
+ "paths": [
813
+ "/v1/events/*"
814
+ ],
815
+ "presentation": {
816
+ "type": "bearer"
817
+ }
818
+ },
819
+ "placeholder": "opaque-placeholder",
820
+ "request": {
821
+ "scheme": "https",
822
+ "authority": "reports.example.com:443",
823
+ "sni": "reports.example.com",
824
+ "method": "POST",
825
+ "path": "/v1/events/one",
826
+ "headers": [
827
+ [
828
+ "Authorization",
829
+ "Bearer opaque-placeholder"
830
+ ]
831
+ ],
832
+ "query": ""
833
+ },
834
+ "authorized": true,
835
+ "reason": "exact selected component over HTTPS/443"
836
+ },
837
+ {
838
+ "name": "wrong-host",
839
+ "request": {
840
+ "scheme": "https",
841
+ "authority": "other.example.com",
842
+ "sni": "other.example.com",
843
+ "method": "POST",
844
+ "path": "/v1/events/one",
845
+ "headers": [
846
+ [
847
+ "Authorization",
848
+ "Bearer opaque-placeholder"
849
+ ]
850
+ ],
851
+ "query": ""
852
+ },
853
+ "authorized": false,
854
+ "reason": "undeclared host",
855
+ "binding": {
856
+ "envName": "REPORTS_TOKEN",
857
+ "secretRef": {
858
+ "kind": "secret-ref",
859
+ "key": "reporting-api"
860
+ },
861
+ "hosts": [
862
+ "reports.example.com"
863
+ ],
864
+ "methods": [
865
+ "POST"
866
+ ],
867
+ "paths": [
868
+ "/v1/events/*"
869
+ ],
870
+ "presentation": {
871
+ "type": "bearer"
872
+ }
873
+ },
874
+ "placeholder": "opaque-placeholder"
875
+ },
876
+ {
877
+ "name": "wrong-method",
878
+ "request": {
879
+ "scheme": "https",
880
+ "authority": "reports.example.com",
881
+ "sni": "reports.example.com",
882
+ "method": "GET",
883
+ "path": "/v1/events/one",
884
+ "headers": [
885
+ [
886
+ "Authorization",
887
+ "Bearer opaque-placeholder"
888
+ ]
889
+ ],
890
+ "query": ""
891
+ },
892
+ "authorized": false,
893
+ "reason": "undeclared method",
894
+ "binding": {
895
+ "envName": "REPORTS_TOKEN",
896
+ "secretRef": {
897
+ "kind": "secret-ref",
898
+ "key": "reporting-api"
899
+ },
900
+ "hosts": [
901
+ "reports.example.com"
902
+ ],
903
+ "methods": [
904
+ "POST"
905
+ ],
906
+ "paths": [
907
+ "/v1/events/*"
908
+ ],
909
+ "presentation": {
910
+ "type": "bearer"
911
+ }
912
+ },
913
+ "placeholder": "opaque-placeholder"
914
+ },
915
+ {
916
+ "name": "wrong-path",
917
+ "request": {
918
+ "scheme": "https",
919
+ "authority": "reports.example.com",
920
+ "sni": "reports.example.com",
921
+ "method": "POST",
922
+ "path": "/v1/eventspill",
923
+ "headers": [
924
+ [
925
+ "Authorization",
926
+ "Bearer opaque-placeholder"
927
+ ]
928
+ ],
929
+ "query": ""
930
+ },
931
+ "authorized": false,
932
+ "reason": "subtree boundary",
933
+ "binding": {
934
+ "envName": "REPORTS_TOKEN",
935
+ "secretRef": {
936
+ "kind": "secret-ref",
937
+ "key": "reporting-api"
938
+ },
939
+ "hosts": [
940
+ "reports.example.com"
941
+ ],
942
+ "methods": [
943
+ "POST"
944
+ ],
945
+ "paths": [
946
+ "/v1/events/*"
947
+ ],
948
+ "presentation": {
949
+ "type": "bearer"
950
+ }
951
+ },
952
+ "placeholder": "opaque-placeholder"
953
+ },
954
+ {
955
+ "name": "subtree-base",
956
+ "request": {
957
+ "scheme": "https",
958
+ "authority": "reports.example.com",
959
+ "sni": "reports.example.com",
960
+ "method": "POST",
961
+ "path": "/v1/events",
962
+ "headers": [
963
+ [
964
+ "Authorization",
965
+ "Bearer opaque-placeholder"
966
+ ]
967
+ ],
968
+ "query": ""
969
+ },
970
+ "authorized": false,
971
+ "reason": "subtree does not include base path",
972
+ "binding": {
973
+ "envName": "REPORTS_TOKEN",
974
+ "secretRef": {
975
+ "kind": "secret-ref",
976
+ "key": "reporting-api"
977
+ },
978
+ "hosts": [
979
+ "reports.example.com"
980
+ ],
981
+ "methods": [
982
+ "POST"
983
+ ],
984
+ "paths": [
985
+ "/v1/events/*"
986
+ ],
987
+ "presentation": {
988
+ "type": "bearer"
989
+ }
990
+ },
991
+ "placeholder": "opaque-placeholder"
992
+ },
993
+ {
994
+ "name": "encoded-dot",
995
+ "request": {
996
+ "scheme": "https",
997
+ "authority": "reports.example.com",
998
+ "sni": "reports.example.com",
999
+ "method": "POST",
1000
+ "path": "/v1/events/%2e%2e/admin",
1001
+ "headers": [
1002
+ [
1003
+ "Authorization",
1004
+ "Bearer opaque-placeholder"
1005
+ ]
1006
+ ],
1007
+ "query": ""
1008
+ },
1009
+ "authorized": false,
1010
+ "reason": "all encoded paths refused",
1011
+ "binding": {
1012
+ "envName": "REPORTS_TOKEN",
1013
+ "secretRef": {
1014
+ "kind": "secret-ref",
1015
+ "key": "reporting-api"
1016
+ },
1017
+ "hosts": [
1018
+ "reports.example.com"
1019
+ ],
1020
+ "methods": [
1021
+ "POST"
1022
+ ],
1023
+ "paths": [
1024
+ "/v1/events/*"
1025
+ ],
1026
+ "presentation": {
1027
+ "type": "bearer"
1028
+ }
1029
+ },
1030
+ "placeholder": "opaque-placeholder"
1031
+ },
1032
+ {
1033
+ "name": "duplicate-named-header",
1034
+ "request": {
1035
+ "scheme": "https",
1036
+ "authority": "reports.example.com",
1037
+ "sni": "reports.example.com",
1038
+ "method": "POST",
1039
+ "path": "/v1/events/one",
1040
+ "headers": [
1041
+ [
1042
+ "X-Api-Key",
1043
+ "opaque-placeholder"
1044
+ ],
1045
+ [
1046
+ "x-api-key",
1047
+ "opaque-placeholder"
1048
+ ]
1049
+ ],
1050
+ "query": ""
1051
+ },
1052
+ "authorized": false,
1053
+ "reason": "case-insensitive duplicate selected header",
1054
+ "binding": {
1055
+ "envName": "REPORTS_TOKEN",
1056
+ "secretRef": {
1057
+ "kind": "secret-ref",
1058
+ "key": "reporting-api"
1059
+ },
1060
+ "hosts": [
1061
+ "reports.example.com"
1062
+ ],
1063
+ "methods": [
1064
+ "POST"
1065
+ ],
1066
+ "paths": [
1067
+ "/v1/events/*"
1068
+ ],
1069
+ "presentation": {
1070
+ "type": "header",
1071
+ "name": "X-Api-Key"
1072
+ }
1073
+ },
1074
+ "placeholder": "opaque-placeholder"
1075
+ },
1076
+ {
1077
+ "name": "malformed-query",
1078
+ "request": {
1079
+ "scheme": "https",
1080
+ "authority": "reports.example.com",
1081
+ "sni": "reports.example.com",
1082
+ "method": "POST",
1083
+ "path": "/v1/events/one",
1084
+ "headers": [],
1085
+ "query": "api_key=%ZZ"
1086
+ },
1087
+ "authorized": false,
1088
+ "reason": "malformed strict percent decoding",
1089
+ "binding": {
1090
+ "envName": "REPORTS_TOKEN",
1091
+ "secretRef": {
1092
+ "kind": "secret-ref",
1093
+ "key": "reporting-api"
1094
+ },
1095
+ "hosts": [
1096
+ "reports.example.com"
1097
+ ],
1098
+ "methods": [
1099
+ "POST"
1100
+ ],
1101
+ "paths": [
1102
+ "/v1/events/*"
1103
+ ],
1104
+ "presentation": {
1105
+ "type": "query",
1106
+ "name": "api_key"
1107
+ }
1108
+ },
1109
+ "placeholder": "opaque-placeholder"
1110
+ }
1111
+ ],
1112
+ "semantics": {
1113
+ "request": "complete HTTP request metadata; headers preserve duplicate wire fields; query is raw query without ?; path is raw path without query",
1114
+ "authorized": "true means this synthetic placeholder component can be substituted; false forbids credential substitution and must fail closed if the protected placeholder is used",
1115
+ "placeholder": "synthetic non-secret bytes, scoped only to this case",
1116
+ "authority": "SNI and authority must identify declared FQDN; omitted port and explicit :443 equivalent",
1117
+ "paths": "all percent-encoded request paths refused in v1"
1118
+ }
1119
+ }