venafi-connector-machine 1.0.2 → 1.0.4

package/bundle.mjs

@@ -31160,6 +31160,32 @@ if !strings.HasPrefix(certPEM, "-----BEGIN CERTIFICATE-----") {
 }
 \`\`\`
 
+### 26. Default/Fallback Binding Must Be Assigned BEFORE Discovery Type Filtering
+
+**The problem**: If a connector has both a default binding type (e.g., "unbound" for certificates with no object references) and a \`discoveryTypes\` filter, incorrect ordering silently drops certificates.
+
+**The symptom**: Discovery returns only certificates with explicit bindings. Unbound certificates are silently excluded \u2014 no error, no log message.
+
+**Wrong order** (unbound assigned after filter):
+\`\`\`go
+bindings := findBindings(cert)        // returns [] for unbound certs
+bindings = filterByType(bindings)      // filters empty list \u2192 returns nil \u2192 CERT DROPPED
+if len(bindings) == 0 {
+    bindings = []{{"unbound", cert}}   // never reached!
+}
+\`\`\`
+
+**Correct order** (unbound assigned before filter):
+\`\`\`go
+bindings := findBindings(cert)        // returns [] for unbound certs
+if len(bindings) == 0 {
+    bindings = []{{"unbound", cert}}   // assigned FIRST
+}
+bindings = filterByType(bindings)      // can now properly include/exclude "unbound"
+\`\`\`
+
+This is a logic trap because the default assignment and the filter are independent concerns that interact badly when ordered wrong. Any connector with a catch-all binding type AND a discovery type filter will hit this bug.
+
 ---
 
 ## Things That Were Challenging But Eventually Worked
@@ -33170,6 +33196,7 @@ ${LESSONS_LEARNED}
 23. **certificateBundle.certificateChain is an ARRAY** \u2014 Venafi Cloud sends it as \`["base64cert1", "base64cert2"]\`, not a single string. Manifest must declare \`{ "type": "array", "items": { "contentEncoding": "base64", "type": "string" } }\`. Go struct uses \`[][]byte\` (auto base64 decode) or \`[]string\` (manual decode)
 24. **Certificate chain ordering is undocumented** \u2014 Venafi Cloud sends the chain array but the ordering guarantee is not documented. Pass through in received order and note this assumption. Targets with strict ordering requirements may need issuer/subject-based re-sorting
 25. **REST API discovery: convert base64 DER to PEM** \u2014 when a target API returns certs as base64-encoded DER, you MUST convert to PEM for the discovery response (\`base64.Decode \u2192 pem.EncodeToMemory\`). Validate with \`strings.HasPrefix(cert, "-----BEGIN CERTIFICATE-----")\`
+26. **Default binding must be assigned BEFORE discovery type filtering** \u2014 if "unbound" (or any fallback binding) is assigned after the filter runs, unbound certs are silently dropped. Always: find bindings \u2192 assign default if empty \u2192 then filter
 `;
 }
 function getRESTClientPattern(args) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "venafi-connector-machine",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "MCP server providing machine connector-specific knowledge, templates, and tools for building Venafi TLS Protect Cloud machine connectors",
   "main": "bundle.mjs",
   "type": "module",
@@ -41,4 +41,4 @@
     "typescript": "^5.7.0",
     "@types/node": "^22.0.0"
   }
-}
+}