#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct DestinationBinding {
/// Allowed target domains (e.g., `["api.stripe.com"]`).

/// At least one domain must be specified.

pub allowed_domains: Vec<String>,
/// Optional allowed path patterns. Supports `*` (single segment) and `**` (multi-segment).

#[serde(default, skip_serializing_if = "Option::is_none")]
pub allowed_paths: Option<Vec<String>>,
/// Optional allowed HTTP methods (e.g., `["GET", "POST"]`).

/// If `None`, all methods are allowed.

#[serde(default, skip_serializing_if = "Option::is_none")]
pub allowed_methods: Option<Vec<String>>,
/// Optional allowed ports. Defaults to `[443]` if not specified.

#[serde(default, skip_serializing_if = "Option::is_none")]
pub allowed_ports: Option<Vec<u16>>,
/// Whether TLS is required. Defaults to `true`.

#[serde(default = "default_true")]
pub require_tls: bool,
/// Whether subdomains of allowed domains are also allowed. Defaults to `false`.

#[serde(default)]
pub allow_subdomains: bool
}

pub fn new(allowed_domains: Vec<String>) -> ArsenalResult<Self>;

pub fn validate(&self) -> ArsenalResult<()>;

#[must_use]
pub fn is_domain_allowed(&self, domain: &str) -> bool;

#[must_use]
pub fn is_method_allowed(&self, method: &str) -> bool;

#[must_use]
pub fn is_port_allowed(&self, port: u16) -> bool;

#[must_use]
pub fn is_path_allowed(&self, path: &str) -> bool;

#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
pub enum VariablePrefix {
    /// OAuth 2.0 token
    OAuth2,
    /// OAuth 1.0 token
    OAuth1,
    /// API key
    ApiKey,
    /// HTTP Basic authentication
    Basic,
    /// Bearer token
    Bearer,
    /// Client certificate
    Cert,
    /// Custom credential type
    Custom,
}

#[must_use]
pub const fn as_str(&self) -> &'static str;

pub fn from_str_prefix(s: &str) -> ArsenalResult<Self>;

#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
pub struct TemplateVariable {
/// Full variable name (e.g., `OAUTH2_STRIPE_TOKEN`).

/// Must match `[A-Z][A-Z0-9_]{1,63}`.

pub name: String,
/// The credential type prefix parsed from the name.

pub prefix: VariablePrefix
}

pub fn new(name: impl Into<String>) -> ArsenalResult<Self>;

#[must_use]
pub fn name(&self) -> &str;

#[must_use]
pub const fn prefix(&self) -> VariablePrefix;

#[must_use]
pub fn parse_template_variables(input: &str) -> Vec<TemplateVariable>;

pub fn validate_variable_name(name: &str) -> ArsenalResult<()>;

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ProxyRequest {
/// HTTP method (GET, POST, PUT, DELETE, etc.)

pub method: String,
/// Target URL (may contain `{{VARIABLE}}` placeholders)

pub url: String,
/// Optional HTTP headers (may contain `{{VARIABLE}}` placeholders)

#[serde(default, skip_serializing_if = "Option::is_none")]
pub headers: Option<BTreeMap<String, String>>,
/// Optional request body bytes

#[serde(default, skip_serializing_if = "Option::is_none")]
pub body: Option<Vec<u8>>,
/// Base64-encoded capability token authorizing this request

pub capability_token: String,
/// Optional timeout in milliseconds (default: 30000, max: 300000)

#[serde(default, skip_serializing_if = "Option::is_none")]
pub timeout_ms: Option<u64>
}

pub fn validate(&self) -> ArsenalResult<()>;

#[must_use]
pub fn effective_timeout_ms(&self) -> u64;

#[must_use]
pub fn extract_variables(&self) -> Vec<TemplateVariable>;

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ProxyResponse {
/// HTTP status code from the target API

pub status: u16,
/// Response headers (sanitized — credential headers stripped)

pub headers: BTreeMap<String, String>,
/// Response body bytes

pub body: Vec<u8>,
/// Metadata about how the proxy processed the request

pub proxy_metadata: ProxyMetadata
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ProxyMetadata {
/// Names of variables that were resolved (never values)

pub variables_resolved: Vec<String>,
/// Whether the destination binding was verified

pub destination_verified: bool,
/// Whether the agent fingerprint was verified

pub fingerprint_verified: bool,
/// Status of human consent for credential usage

pub consent_status: ConsentStatus,
/// End-to-end proxy latency in milliseconds

pub latency_ms: u64,
/// Unique request ID for audit correlation

pub request_id: Uuid
}

#[must_use]
pub fn new(request_id: Uuid) -> Self;

#[derive(Debug, Clone, Default, Serialize, Deserialize)]
pub struct VariableResolutionTable {

}

#[must_use]
pub fn new() -> Self;

pub fn register(
        &mut self,
        variable_name: impl Into<String>,
        secret_ref: SecretRef,
    ) -> ArsenalResult<()>;

pub fn unregister(&mut self, variable_name: &str) -> bool;

#[must_use]
pub fn resolve(&self, variable_name: &str) -> Option<&SecretRef>;

#[must_use]
pub fn variable_names(&self) -> Vec<&str>;

#[must_use]
pub fn len(&self) -> usize;

#[must_use]
pub fn is_empty(&self) -> bool;

#[must_use]
pub fn entries(&self) -> &BTreeMap<String, SecretRef>;