@tangle-network/agent-interface 5.2.1 → 5.3.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (37) hide show
  1. package/dist/agent-candidate-code-schema.d.ts +63 -14
  2. package/dist/agent-candidate-code-schema.js +2 -1
  3. package/dist/agent-candidate-execution-plan-schema.d.ts +262 -20
  4. package/dist/agent-candidate-execution-plan-schema.js +30 -7
  5. package/dist/agent-candidate-profile-schema.d.ts +63 -8
  6. package/dist/agent-candidate-profile-schema.js +2 -0
  7. package/dist/agent-candidate-promotion-schema.d.ts +952 -100
  8. package/dist/agent-candidate-receipt-schema.d.ts +104 -8
  9. package/dist/agent-candidate-schema-common.d.ts +30 -3
  10. package/dist/agent-candidate-schema-common.js +14 -8
  11. package/dist/agent-candidate-schema.d.ts +72 -10
  12. package/dist/agent-candidate.d.ts +12 -4
  13. package/dist/agent-execution-preparation-receipt.d.ts +2 -0
  14. package/dist/agent-execution-preparation.js +4 -2
  15. package/dist/agent-profile-materialization.d.ts +1 -1
  16. package/dist/agent-profile-materialization.js +3 -0
  17. package/dist/agent-profile.d.ts +6 -0
  18. package/dist/environment-interactive-control.d.ts +10 -0
  19. package/dist/environment-interactive-start.d.ts +33 -6
  20. package/dist/environment-profile-capabilities.d.ts +18 -0
  21. package/dist/environment-profile-capabilities.js +2 -0
  22. package/dist/environment-provider.d.ts +1 -0
  23. package/dist/environment-provider.js +1 -0
  24. package/dist/environment-runtime.d.ts +176 -18
  25. package/dist/environment-runtime.js +14 -1
  26. package/dist/harness-capabilities.js +1 -1
  27. package/dist/index.d.ts +1 -0
  28. package/dist/index.js +1 -0
  29. package/dist/portable-context-transfer.d.ts +33 -6
  30. package/dist/profile-diff.d.ts +4 -3
  31. package/dist/profile-diff.js +3 -0
  32. package/dist/profile-schema.d.ts +50 -21
  33. package/dist/profile-schema.js +6 -13
  34. package/dist/proxy-secrets.d.ts +329 -0
  35. package/dist/proxy-secrets.js +183 -0
  36. package/fixtures/proxy-secret-wire-v1.json +1173 -0
  37. package/package.json +2 -1
package/fixtures/proxy-secret-wire-v1.json ADDED
@@ -0,0 +1,1173 @@
1
+ {
2
+ "protocolVersion": 1,
3
+ "declarations": [
4
+ {
5
+ "name": "bearer",
6
+ "value": {
7
+ "envName": "REPORTS_TOKEN",
8
+ "secretRef": {
9
+ "kind": "secret-ref",
10
+ "key": "reporting-api"
11
+ },
12
+ "hosts": [
13
+ "reports.example.com"
14
+ ],
15
+ "presentation": {
16
+ "type": "bearer"
17
+ }
18
+ },
19
+ "valid": true
20
+ },
21
+ {
22
+ "name": "uppercase-host",
23
+ "value": {
24
+ "envName": "REPORTS_TOKEN",
25
+ "secretRef": {
26
+ "kind": "secret-ref",
27
+ "key": "reporting-api"
28
+ },
29
+ "hosts": [
30
+ "Reports.example.com"
31
+ ],
32
+ "presentation": {
33
+ "type": "bearer"
34
+ }
35
+ },
36
+ "valid": false
37
+ },
38
+ {
39
+ "name": "alternate-port",
40
+ "value": {
41
+ "envName": "REPORTS_TOKEN",
42
+ "secretRef": {
43
+ "kind": "secret-ref",
44
+ "key": "reporting-api"
45
+ },
46
+ "hosts": [
47
+ "reports.example.com:8443"
48
+ ],
49
+ "presentation": {
50
+ "type": "bearer"
51
+ }
52
+ },
53
+ "valid": false
54
+ },
55
+ {
56
+ "name": "wildcard",
57
+ "value": {
58
+ "envName": "REPORTS_TOKEN",
59
+ "secretRef": {
60
+ "kind": "secret-ref",
61
+ "key": "reporting-api"
62
+ },
63
+ "hosts": [
64
+ "*.example.com"
65
+ ],
66
+ "presentation": {
67
+ "type": "bearer"
68
+ }
69
+ },
70
+ "valid": false
71
+ },
72
+ {
73
+ "name": "ip",
74
+ "value": {
75
+ "envName": "REPORTS_TOKEN",
76
+ "secretRef": {
77
+ "kind": "secret-ref",
78
+ "key": "reporting-api"
79
+ },
80
+ "hosts": [
81
+ "127.0.0.1"
82
+ ],
83
+ "presentation": {
84
+ "type": "bearer"
85
+ }
86
+ },
87
+ "valid": false
88
+ },
89
+ {
90
+ "name": "dot-path",
91
+ "value": {
92
+ "envName": "REPORTS_TOKEN",
93
+ "secretRef": {
94
+ "kind": "secret-ref",
95
+ "key": "reporting-api"
96
+ },
97
+ "hosts": [
98
+ "reports.example.com"
99
+ ],
100
+ "presentation": {
101
+ "type": "bearer"
102
+ },
103
+ "paths": [
104
+ "/v1/../admin"
105
+ ]
106
+ },
107
+ "valid": false
108
+ },
109
+ {
110
+ "name": "encoded-path",
111
+ "value": {
112
+ "envName": "REPORTS_TOKEN",
113
+ "secretRef": {
114
+ "kind": "secret-ref",
115
+ "key": "reporting-api"
116
+ },
117
+ "hosts": [
118
+ "reports.example.com"
119
+ ],
120
+ "presentation": {
121
+ "type": "bearer"
122
+ },
123
+ "paths": [
124
+ "/v1/%2fadmin"
125
+ ]
126
+ },
127
+ "valid": false
128
+ },
129
+ {
130
+ "name": "query-path",
131
+ "value": {
132
+ "envName": "REPORTS_TOKEN",
133
+ "secretRef": {
134
+ "kind": "secret-ref",
135
+ "key": "reporting-api"
136
+ },
137
+ "hosts": [
138
+ "reports.example.com"
139
+ ],
140
+ "presentation": {
141
+ "type": "bearer"
142
+ },
143
+ "paths": [
144
+ "/v1?x=y"
145
+ ]
146
+ },
147
+ "valid": false
148
+ },
149
+ {
150
+ "name": "slash-path",
151
+ "value": {
152
+ "envName": "REPORTS_TOKEN",
153
+ "secretRef": {
154
+ "kind": "secret-ref",
155
+ "key": "reporting-api"
156
+ },
157
+ "hosts": [
158
+ "reports.example.com"
159
+ ],
160
+ "presentation": {
161
+ "type": "bearer"
162
+ },
163
+ "paths": [
164
+ "//v1"
165
+ ]
166
+ },
167
+ "valid": false
168
+ },
169
+ {
170
+ "name": "basic-colon",
171
+ "value": {
172
+ "envName": "REPORTS_TOKEN",
173
+ "secretRef": {
174
+ "kind": "secret-ref",
175
+ "key": "reporting-api"
176
+ },
177
+ "hosts": [
178
+ "reports.example.com"
179
+ ],
180
+ "presentation": {
181
+ "type": "basic",
182
+ "username": "user:name"
183
+ }
184
+ },
185
+ "valid": false
186
+ },
187
+ {
188
+ "name": "header-duplicate-selector",
189
+ "value": {
190
+ "envName": "REPORTS_TOKEN",
191
+ "secretRef": {
192
+ "kind": "secret-ref",
193
+ "key": "reporting-api"
194
+ },
195
+ "hosts": [
196
+ "reports.example.com"
197
+ ],
198
+ "presentation": {
199
+ "type": "header",
200
+ "name": "bad name"
201
+ }
202
+ },
203
+ "valid": false
204
+ },
205
+ {
206
+ "name": "basic",
207
+ "value": {
208
+ "envName": "REPORTS_TOKEN",
209
+ "secretRef": {
210
+ "kind": "secret-ref",
211
+ "key": "reporting-api"
212
+ },
213
+ "hosts": [
214
+ "reports.example.com"
215
+ ],
216
+ "presentation": {
217
+ "type": "basic",
218
+ "username": "public-user"
219
+ }
220
+ },
221
+ "valid": true
222
+ },
223
+ {
224
+ "name": "header",
225
+ "value": {
226
+ "envName": "REPORTS_TOKEN",
227
+ "secretRef": {
228
+ "kind": "secret-ref",
229
+ "key": "reporting-api"
230
+ },
231
+ "hosts": [
232
+ "reports.example.com"
233
+ ],
234
+ "presentation": {
235
+ "type": "header",
236
+ "name": "X-Api-Key"
237
+ }
238
+ },
239
+ "valid": true
240
+ },
241
+ {
242
+ "name": "query",
243
+ "value": {
244
+ "envName": "REPORTS_TOKEN",
245
+ "secretRef": {
246
+ "kind": "secret-ref",
247
+ "key": "reporting-api"
248
+ },
249
+ "hosts": [
250
+ "reports.example.com"
251
+ ],
252
+ "presentation": {
253
+ "type": "query",
254
+ "name": "api_key"
255
+ }
256
+ },
257
+ "valid": true
258
+ },
259
+ {
260
+ "name": "keep-alive-header",
261
+ "value": {
262
+ "envName": "REPORTS_TOKEN",
263
+ "secretRef": {
264
+ "kind": "secret-ref",
265
+ "key": "reporting-api"
266
+ },
267
+ "hosts": [
268
+ "reports.example.com"
269
+ ],
270
+ "presentation": {
271
+ "type": "header",
272
+ "name": "Keep-Alive"
273
+ }
274
+ },
275
+ "valid": false
276
+ },
277
+ {
278
+ "name": "proxy-connection-header",
279
+ "value": {
280
+ "envName": "REPORTS_TOKEN",
281
+ "secretRef": {
282
+ "kind": "secret-ref",
283
+ "key": "reporting-api"
284
+ },
285
+ "hosts": [
286
+ "reports.example.com"
287
+ ],
288
+ "presentation": {
289
+ "type": "header",
290
+ "name": "pRoXy-CoNnEcTiOn"
291
+ }
292
+ },
293
+ "valid": false
294
+ },
295
+ {
296
+ "name": "proxy-authenticate-header",
297
+ "value": {
298
+ "envName": "REPORTS_TOKEN",
299
+ "secretRef": {
300
+ "kind": "secret-ref",
301
+ "key": "reporting-api"
302
+ },
303
+ "hosts": [
304
+ "reports.example.com"
305
+ ],
306
+ "presentation": {
307
+ "type": "header",
308
+ "name": "Proxy-Authenticate"
309
+ }
310
+ },
311
+ "valid": false
312
+ }
313
+ ],
314
+ "wireCases": [
315
+ {
316
+ "name": "exact-bearer",
317
+ "request": {
318
+ "scheme": "https",
319
+ "authority": "reports.example.com",
320
+ "sni": "reports.example.com",
321
+ "method": "POST",
322
+ "path": "/v1/events/one",
323
+ "headers": [
324
+ [
325
+ "Authorization",
326
+ "Bearer opaque-placeholder"
327
+ ]
328
+ ],
329
+ "query": ""
330
+ },
331
+ "authorized": true,
332
+ "reason": "complete credential component",
333
+ "binding": {
334
+ "envName": "REPORTS_TOKEN",
335
+ "secretRef": {
336
+ "kind": "secret-ref",
337
+ "key": "reporting-api"
338
+ },
339
+ "hosts": [
340
+ "reports.example.com"
341
+ ],
342
+ "methods": [
343
+ "POST"
344
+ ],
345
+ "paths": [
346
+ "/v1/events/*"
347
+ ],
348
+ "presentation": {
349
+ "type": "bearer"
350
+ }
351
+ },
352
+ "placeholder": "opaque-placeholder"
353
+ },
354
+ {
355
+ "name": "substring",
356
+ "request": {
357
+ "scheme": "https",
358
+ "authority": "reports.example.com",
359
+ "sni": "reports.example.com",
360
+ "method": "POST",
361
+ "path": "/v1/events/one",
362
+ "headers": [
363
+ [
364
+ "Authorization",
365
+ "Bearer prefixopaque-placeholder"
366
+ ]
367
+ ],
368
+ "query": ""
369
+ },
370
+ "authorized": false,
371
+ "reason": "embedded placeholder",
372
+ "binding": {
373
+ "envName": "REPORTS_TOKEN",
374
+ "secretRef": {
375
+ "kind": "secret-ref",
376
+ "key": "reporting-api"
377
+ },
378
+ "hosts": [
379
+ "reports.example.com"
380
+ ],
381
+ "methods": [
382
+ "POST"
383
+ ],
384
+ "paths": [
385
+ "/v1/events/*"
386
+ ],
387
+ "presentation": {
388
+ "type": "bearer"
389
+ }
390
+ },
391
+ "placeholder": "opaque-placeholder"
392
+ },
393
+ {
394
+ "name": "duplicate-header",
395
+ "request": {
396
+ "scheme": "https",
397
+ "authority": "reports.example.com",
398
+ "sni": "reports.example.com",
399
+ "method": "POST",
400
+ "path": "/v1/events/one",
401
+ "headers": [
402
+ [
403
+ "Authorization",
404
+ "Bearer opaque-placeholder"
405
+ ],
406
+ [
407
+ "authorization",
408
+ "Bearer opaque-placeholder"
409
+ ]
410
+ ],
411
+ "query": ""
412
+ },
413
+ "authorized": false,
414
+ "reason": "case-insensitive duplicate",
415
+ "binding": {
416
+ "envName": "REPORTS_TOKEN",
417
+ "secretRef": {
418
+ "kind": "secret-ref",
419
+ "key": "reporting-api"
420
+ },
421
+ "hosts": [
422
+ "reports.example.com"
423
+ ],
424
+ "methods": [
425
+ "POST"
426
+ ],
427
+ "paths": [
428
+ "/v1/events/*"
429
+ ],
430
+ "presentation": {
431
+ "type": "bearer"
432
+ }
433
+ },
434
+ "placeholder": "opaque-placeholder"
435
+ },
436
+ {
437
+ "name": "duplicate-query",
438
+ "request": {
439
+ "scheme": "https",
440
+ "authority": "reports.example.com",
441
+ "sni": "reports.example.com",
442
+ "method": "POST",
443
+ "path": "/v1/events/one",
444
+ "headers": [],
445
+ "query": "api_key=opaque-placeholder&api_key=opaque-placeholder"
446
+ },
447
+ "authorized": false,
448
+ "reason": "duplicate decoded selector",
449
+ "binding": {
450
+ "envName": "REPORTS_TOKEN",
451
+ "secretRef": {
452
+ "kind": "secret-ref",
453
+ "key": "reporting-api"
454
+ },
455
+ "hosts": [
456
+ "reports.example.com"
457
+ ],
458
+ "methods": [
459
+ "POST"
460
+ ],
461
+ "paths": [
462
+ "/v1/events/*"
463
+ ],
464
+ "presentation": {
465
+ "type": "query",
466
+ "name": "api_key"
467
+ }
468
+ },
469
+ "placeholder": "opaque-placeholder"
470
+ },
471
+ {
472
+ "name": "query-spill",
473
+ "request": {
474
+ "scheme": "https",
475
+ "authority": "reports.example.com",
476
+ "sni": "reports.example.com",
477
+ "method": "POST",
478
+ "path": "/v1/events/one",
479
+ "headers": [],
480
+ "query": "other=opaque-placeholder"
481
+ },
482
+ "authorized": false,
483
+ "reason": "wrong selector",
484
+ "binding": {
485
+ "envName": "REPORTS_TOKEN",
486
+ "secretRef": {
487
+ "kind": "secret-ref",
488
+ "key": "reporting-api"
489
+ },
490
+ "hosts": [
491
+ "reports.example.com"
492
+ ],
493
+ "methods": [
494
+ "POST"
495
+ ],
496
+ "paths": [
497
+ "/v1/events/*"
498
+ ],
499
+ "presentation": {
500
+ "type": "query",
501
+ "name": "api_key"
502
+ }
503
+ },
504
+ "placeholder": "opaque-placeholder"
505
+ },
506
+ {
507
+ "name": "encoded-query-duplicate",
508
+ "request": {
509
+ "scheme": "https",
510
+ "authority": "reports.example.com",
511
+ "sni": "reports.example.com",
512
+ "method": "POST",
513
+ "path": "/v1/events/one",
514
+ "headers": [],
515
+ "query": "api_key=opaque-placeholder&api%5fkey=opaque-placeholder"
516
+ },
517
+ "authorized": false,
518
+ "reason": "duplicate after one percent decode",
519
+ "binding": {
520
+ "envName": "REPORTS_TOKEN",
521
+ "secretRef": {
522
+ "kind": "secret-ref",
523
+ "key": "reporting-api"
524
+ },
525
+ "hosts": [
526
+ "reports.example.com"
527
+ ],
528
+ "methods": [
529
+ "POST"
530
+ ],
531
+ "paths": [
532
+ "/v1/events/*"
533
+ ],
534
+ "presentation": {
535
+ "type": "query",
536
+ "name": "api_key"
537
+ }
538
+ },
539
+ "placeholder": "opaque-placeholder"
540
+ },
541
+ {
542
+ "name": "encoded-slash",
543
+ "request": {
544
+ "scheme": "https",
545
+ "authority": "reports.example.com",
546
+ "sni": "reports.example.com",
547
+ "method": "POST",
548
+ "path": "/v1/events%2fone",
549
+ "headers": [
550
+ [
551
+ "Authorization",
552
+ "Bearer opaque-placeholder"
553
+ ]
554
+ ],
555
+ "query": ""
556
+ },
557
+ "authorized": false,
558
+ "reason": "noncanonical path",
559
+ "binding": {
560
+ "envName": "REPORTS_TOKEN",
561
+ "secretRef": {
562
+ "kind": "secret-ref",
563
+ "key": "reporting-api"
564
+ },
565
+ "hosts": [
566
+ "reports.example.com"
567
+ ],
568
+ "methods": [
569
+ "POST"
570
+ ],
571
+ "paths": [
572
+ "/v1/events/*"
573
+ ],
574
+ "presentation": {
575
+ "type": "bearer"
576
+ }
577
+ },
578
+ "placeholder": "opaque-placeholder"
579
+ },
580
+ {
581
+ "name": "authority-sni",
582
+ "request": {
583
+ "scheme": "https",
584
+ "authority": "reports.example.com",
585
+ "sni": "other.example.com",
586
+ "method": "POST",
587
+ "path": "/v1/events/one",
588
+ "headers": [
589
+ [
590
+ "Authorization",
591
+ "Bearer opaque-placeholder"
592
+ ]
593
+ ],
594
+ "query": ""
595
+ },
596
+ "authorized": false,
597
+ "reason": "authority and SNI must agree",
598
+ "binding": {
599
+ "envName": "REPORTS_TOKEN",
600
+ "secretRef": {
601
+ "kind": "secret-ref",
602
+ "key": "reporting-api"
603
+ },
604
+ "hosts": [
605
+ "reports.example.com"
606
+ ],
607
+ "methods": [
608
+ "POST"
609
+ ],
610
+ "paths": [
611
+ "/v1/events/*"
612
+ ],
613
+ "presentation": {
614
+ "type": "bearer"
615
+ }
616
+ },
617
+ "placeholder": "opaque-placeholder"
618
+ },
619
+ {
620
+ "name": "http",
621
+ "request": {
622
+ "scheme": "http",
623
+ "authority": "reports.example.com",
624
+ "sni": "reports.example.com",
625
+ "method": "POST",
626
+ "path": "/v1/events/one",
627
+ "headers": [
628
+ [
629
+ "Authorization",
630
+ "Bearer opaque-placeholder"
631
+ ]
632
+ ],
633
+ "query": ""
634
+ },
635
+ "authorized": false,
636
+ "reason": "HTTPS required",
637
+ "binding": {
638
+ "envName": "REPORTS_TOKEN",
639
+ "secretRef": {
640
+ "kind": "secret-ref",
641
+ "key": "reporting-api"
642
+ },
643
+ "hosts": [
644
+ "reports.example.com"
645
+ ],
646
+ "methods": [
647
+ "POST"
648
+ ],
649
+ "paths": [
650
+ "/v1/events/*"
651
+ ],
652
+ "presentation": {
653
+ "type": "bearer"
654
+ }
655
+ },
656
+ "placeholder": "opaque-placeholder"
657
+ },
658
+ {
659
+ "name": "alternate-port",
660
+ "request": {
661
+ "scheme": "https",
662
+ "authority": "reports.example.com:8443",
663
+ "sni": "reports.example.com",
664
+ "method": "POST",
665
+ "path": "/v1/events/one",
666
+ "headers": [
667
+ [
668
+ "Authorization",
669
+ "Bearer opaque-placeholder"
670
+ ]
671
+ ],
672
+ "query": ""
673
+ },
674
+ "authorized": false,
675
+ "reason": "443 only",
676
+ "binding": {
677
+ "envName": "REPORTS_TOKEN",
678
+ "secretRef": {
679
+ "kind": "secret-ref",
680
+ "key": "reporting-api"
681
+ },
682
+ "hosts": [
683
+ "reports.example.com"
684
+ ],
685
+ "methods": [
686
+ "POST"
687
+ ],
688
+ "paths": [
689
+ "/v1/events/*"
690
+ ],
691
+ "presentation": {
692
+ "type": "bearer"
693
+ }
694
+ },
695
+ "placeholder": "opaque-placeholder"
696
+ },
697
+ {
698
+ "name": "wrong-basic-user",
699
+ "request": {
700
+ "scheme": "https",
701
+ "authority": "reports.example.com",
702
+ "sni": "reports.example.com",
703
+ "method": "POST",
704
+ "path": "/v1/events/one",
705
+ "headers": [
706
+ [
707
+ "Authorization",
708
+ "Basic d3Jvbmc6b3BhcXVlLXBsYWNlaG9sZGVy"
709
+ ]
710
+ ],
711
+ "query": ""
712
+ },
713
+ "authorized": false,
714
+ "reason": "public username differs",
715
+ "binding": {
716
+ "envName": "REPORTS_TOKEN",
717
+ "secretRef": {
718
+ "kind": "secret-ref",
719
+ "key": "reporting-api"
720
+ },
721
+ "hosts": [
722
+ "reports.example.com"
723
+ ],
724
+ "methods": [
725
+ "POST"
726
+ ],
727
+ "paths": [
728
+ "/v1/events/*"
729
+ ],
730
+ "presentation": {
731
+ "type": "basic",
732
+ "username": "public-user"
733
+ }
734
+ },
735
+ "placeholder": "opaque-placeholder"
736
+ },
737
+ {
738
+ "name": "exact-basic",
739
+ "binding": {
740
+ "envName": "REPORTS_TOKEN",
741
+ "secretRef": {
742
+ "kind": "secret-ref",
743
+ "key": "reporting-api"
744
+ },
745
+ "hosts": [
746
+ "reports.example.com"
747
+ ],
748
+ "methods": [
749
+ "POST"
750
+ ],
751
+ "paths": [
752
+ "/v1/events/*"
753
+ ],
754
+ "presentation": {
755
+ "type": "basic",
756
+ "username": "public-user"
757
+ }
758
+ },
759
+ "placeholder": "opaque-placeholder",
760
+ "request": {
761
+ "scheme": "https",
762
+ "authority": "reports.example.com",
763
+ "sni": "reports.example.com",
764
+ "method": "POST",
765
+ "path": "/v1/events/one",
766
+ "headers": [
767
+ [
768
+ "Authorization",
769
+ "Basic cHVibGljLXVzZXI6b3BhcXVlLXBsYWNlaG9sZGVy"
770
+ ]
771
+ ],
772
+ "query": ""
773
+ },
774
+ "authorized": true,
775
+ "reason": "exact selected component over HTTPS/443"
776
+ },
777
+ {
778
+ "name": "exact-header",
779
+ "binding": {
780
+ "envName": "REPORTS_TOKEN",
781
+ "secretRef": {
782
+ "kind": "secret-ref",
783
+ "key": "reporting-api"
784
+ },
785
+ "hosts": [
786
+ "reports.example.com"
787
+ ],
788
+ "methods": [
789
+ "POST"
790
+ ],
791
+ "paths": [
792
+ "/v1/events/*"
793
+ ],
794
+ "presentation": {
795
+ "type": "header",
796
+ "name": "X-Api-Key"
797
+ }
798
+ },
799
+ "placeholder": "opaque-placeholder",
800
+ "request": {
801
+ "scheme": "https",
802
+ "authority": "reports.example.com",
803
+ "sni": "reports.example.com",
804
+ "method": "POST",
805
+ "path": "/v1/events/one",
806
+ "headers": [
807
+ [
808
+ "x-api-key",
809
+ "opaque-placeholder"
810
+ ]
811
+ ],
812
+ "query": ""
813
+ },
814
+ "authorized": true,
815
+ "reason": "exact selected component over HTTPS/443"
816
+ },
817
+ {
818
+ "name": "exact-query",
819
+ "binding": {
820
+ "envName": "REPORTS_TOKEN",
821
+ "secretRef": {
822
+ "kind": "secret-ref",
823
+ "key": "reporting-api"
824
+ },
825
+ "hosts": [
826
+ "reports.example.com"
827
+ ],
828
+ "methods": [
829
+ "POST"
830
+ ],
831
+ "paths": [
832
+ "/v1/events/*"
833
+ ],
834
+ "presentation": {
835
+ "type": "query",
836
+ "name": "api_key"
837
+ }
838
+ },
839
+ "placeholder": "opaque-placeholder",
840
+ "request": {
841
+ "scheme": "https",
842
+ "authority": "reports.example.com",
843
+ "sni": "reports.example.com",
844
+ "method": "POST",
845
+ "path": "/v1/events/one",
846
+ "headers": [],
847
+ "query": "api_key=opaque-placeholder"
848
+ },
849
+ "authorized": true,
850
+ "reason": "exact selected component over HTTPS/443"
851
+ },
852
+ {
853
+ "name": "explicit-443",
854
+ "binding": {
855
+ "envName": "REPORTS_TOKEN",
856
+ "secretRef": {
857
+ "kind": "secret-ref",
858
+ "key": "reporting-api"
859
+ },
860
+ "hosts": [
861
+ "reports.example.com"
862
+ ],
863
+ "methods": [
864
+ "POST"
865
+ ],
866
+ "paths": [
867
+ "/v1/events/*"
868
+ ],
869
+ "presentation": {
870
+ "type": "bearer"
871
+ }
872
+ },
873
+ "placeholder": "opaque-placeholder",
874
+ "request": {
875
+ "scheme": "https",
876
+ "authority": "reports.example.com:443",
877
+ "sni": "reports.example.com",
878
+ "method": "POST",
879
+ "path": "/v1/events/one",
880
+ "headers": [
881
+ [
882
+ "Authorization",
883
+ "Bearer opaque-placeholder"
884
+ ]
885
+ ],
886
+ "query": ""
887
+ },
888
+ "authorized": true,
889
+ "reason": "exact selected component over HTTPS/443"
890
+ },
891
+ {
892
+ "name": "wrong-host",
893
+ "request": {
894
+ "scheme": "https",
895
+ "authority": "other.example.com",
896
+ "sni": "other.example.com",
897
+ "method": "POST",
898
+ "path": "/v1/events/one",
899
+ "headers": [
900
+ [
901
+ "Authorization",
902
+ "Bearer opaque-placeholder"
903
+ ]
904
+ ],
905
+ "query": ""
906
+ },
907
+ "authorized": false,
908
+ "reason": "undeclared host",
909
+ "binding": {
910
+ "envName": "REPORTS_TOKEN",
911
+ "secretRef": {
912
+ "kind": "secret-ref",
913
+ "key": "reporting-api"
914
+ },
915
+ "hosts": [
916
+ "reports.example.com"
917
+ ],
918
+ "methods": [
919
+ "POST"
920
+ ],
921
+ "paths": [
922
+ "/v1/events/*"
923
+ ],
924
+ "presentation": {
925
+ "type": "bearer"
926
+ }
927
+ },
928
+ "placeholder": "opaque-placeholder"
929
+ },
930
+ {
931
+ "name": "wrong-method",
932
+ "request": {
933
+ "scheme": "https",
934
+ "authority": "reports.example.com",
935
+ "sni": "reports.example.com",
936
+ "method": "GET",
937
+ "path": "/v1/events/one",
938
+ "headers": [
939
+ [
940
+ "Authorization",
941
+ "Bearer opaque-placeholder"
942
+ ]
943
+ ],
944
+ "query": ""
945
+ },
946
+ "authorized": false,
947
+ "reason": "undeclared method",
948
+ "binding": {
949
+ "envName": "REPORTS_TOKEN",
950
+ "secretRef": {
951
+ "kind": "secret-ref",
952
+ "key": "reporting-api"
953
+ },
954
+ "hosts": [
955
+ "reports.example.com"
956
+ ],
957
+ "methods": [
958
+ "POST"
959
+ ],
960
+ "paths": [
961
+ "/v1/events/*"
962
+ ],
963
+ "presentation": {
964
+ "type": "bearer"
965
+ }
966
+ },
967
+ "placeholder": "opaque-placeholder"
968
+ },
969
+ {
970
+ "name": "wrong-path",
971
+ "request": {
972
+ "scheme": "https",
973
+ "authority": "reports.example.com",
974
+ "sni": "reports.example.com",
975
+ "method": "POST",
976
+ "path": "/v1/eventspill",
977
+ "headers": [
978
+ [
979
+ "Authorization",
980
+ "Bearer opaque-placeholder"
981
+ ]
982
+ ],
983
+ "query": ""
984
+ },
985
+ "authorized": false,
986
+ "reason": "subtree boundary",
987
+ "binding": {
988
+ "envName": "REPORTS_TOKEN",
989
+ "secretRef": {
990
+ "kind": "secret-ref",
991
+ "key": "reporting-api"
992
+ },
993
+ "hosts": [
994
+ "reports.example.com"
995
+ ],
996
+ "methods": [
997
+ "POST"
998
+ ],
999
+ "paths": [
1000
+ "/v1/events/*"
1001
+ ],
1002
+ "presentation": {
1003
+ "type": "bearer"
1004
+ }
1005
+ },
1006
+ "placeholder": "opaque-placeholder"
1007
+ },
1008
+ {
1009
+ "name": "subtree-base",
1010
+ "request": {
1011
+ "scheme": "https",
1012
+ "authority": "reports.example.com",
1013
+ "sni": "reports.example.com",
1014
+ "method": "POST",
1015
+ "path": "/v1/events",
1016
+ "headers": [
1017
+ [
1018
+ "Authorization",
1019
+ "Bearer opaque-placeholder"
1020
+ ]
1021
+ ],
1022
+ "query": ""
1023
+ },
1024
+ "authorized": false,
1025
+ "reason": "subtree does not include base path",
1026
+ "binding": {
1027
+ "envName": "REPORTS_TOKEN",
1028
+ "secretRef": {
1029
+ "kind": "secret-ref",
1030
+ "key": "reporting-api"
1031
+ },
1032
+ "hosts": [
1033
+ "reports.example.com"
1034
+ ],
1035
+ "methods": [
1036
+ "POST"
1037
+ ],
1038
+ "paths": [
1039
+ "/v1/events/*"
1040
+ ],
1041
+ "presentation": {
1042
+ "type": "bearer"
1043
+ }
1044
+ },
1045
+ "placeholder": "opaque-placeholder"
1046
+ },
1047
+ {
1048
+ "name": "encoded-dot",
1049
+ "request": {
1050
+ "scheme": "https",
1051
+ "authority": "reports.example.com",
1052
+ "sni": "reports.example.com",
1053
+ "method": "POST",
1054
+ "path": "/v1/events/%2e%2e/admin",
1055
+ "headers": [
1056
+ [
1057
+ "Authorization",
1058
+ "Bearer opaque-placeholder"
1059
+ ]
1060
+ ],
1061
+ "query": ""
1062
+ },
1063
+ "authorized": false,
1064
+ "reason": "all encoded paths refused",
1065
+ "binding": {
1066
+ "envName": "REPORTS_TOKEN",
1067
+ "secretRef": {
1068
+ "kind": "secret-ref",
1069
+ "key": "reporting-api"
1070
+ },
1071
+ "hosts": [
1072
+ "reports.example.com"
1073
+ ],
1074
+ "methods": [
1075
+ "POST"
1076
+ ],
1077
+ "paths": [
1078
+ "/v1/events/*"
1079
+ ],
1080
+ "presentation": {
1081
+ "type": "bearer"
1082
+ }
1083
+ },
1084
+ "placeholder": "opaque-placeholder"
1085
+ },
1086
+ {
1087
+ "name": "duplicate-named-header",
1088
+ "request": {
1089
+ "scheme": "https",
1090
+ "authority": "reports.example.com",
1091
+ "sni": "reports.example.com",
1092
+ "method": "POST",
1093
+ "path": "/v1/events/one",
1094
+ "headers": [
1095
+ [
1096
+ "X-Api-Key",
1097
+ "opaque-placeholder"
1098
+ ],
1099
+ [
1100
+ "x-api-key",
1101
+ "opaque-placeholder"
1102
+ ]
1103
+ ],
1104
+ "query": ""
1105
+ },
1106
+ "authorized": false,
1107
+ "reason": "case-insensitive duplicate selected header",
1108
+ "binding": {
1109
+ "envName": "REPORTS_TOKEN",
1110
+ "secretRef": {
1111
+ "kind": "secret-ref",
1112
+ "key": "reporting-api"
1113
+ },
1114
+ "hosts": [
1115
+ "reports.example.com"
1116
+ ],
1117
+ "methods": [
1118
+ "POST"
1119
+ ],
1120
+ "paths": [
1121
+ "/v1/events/*"
1122
+ ],
1123
+ "presentation": {
1124
+ "type": "header",
1125
+ "name": "X-Api-Key"
1126
+ }
1127
+ },
1128
+ "placeholder": "opaque-placeholder"
1129
+ },
1130
+ {
1131
+ "name": "malformed-query",
1132
+ "request": {
1133
+ "scheme": "https",
1134
+ "authority": "reports.example.com",
1135
+ "sni": "reports.example.com",
1136
+ "method": "POST",
1137
+ "path": "/v1/events/one",
1138
+ "headers": [],
1139
+ "query": "api_key=%ZZ"
1140
+ },
1141
+ "authorized": false,
1142
+ "reason": "malformed strict percent decoding",
1143
+ "binding": {
1144
+ "envName": "REPORTS_TOKEN",
1145
+ "secretRef": {
1146
+ "kind": "secret-ref",
1147
+ "key": "reporting-api"
1148
+ },
1149
+ "hosts": [
1150
+ "reports.example.com"
1151
+ ],
1152
+ "methods": [
1153
+ "POST"
1154
+ ],
1155
+ "paths": [
1156
+ "/v1/events/*"
1157
+ ],
1158
+ "presentation": {
1159
+ "type": "query",
1160
+ "name": "api_key"
1161
+ }
1162
+ },
1163
+ "placeholder": "opaque-placeholder"
1164
+ }
1165
+ ],
1166
+ "semantics": {
1167
+ "request": "complete HTTP request metadata; headers preserve duplicate wire fields; query is raw query without ?; path is raw path without query",
1168
+ "authorized": "true means this synthetic placeholder component can be substituted; false forbids credential substitution and must fail closed if the protected placeholder is used",
1169
+ "placeholder": "synthetic non-secret bytes, scoped only to this case",
1170
+ "authority": "SNI and authority must identify declared FQDN; omitted port and explicit :443 equivalent",
1171
+ "paths": "all percent-encoded request paths refused in v1"
1172
+ }
1173
+ }