schema_version: 3
provider: fai
name: http-request
version: 0.1.0

provides:
  - capability: http.request
    version: 0.1.0

inputs:
  method:
    type: text
    description:
      en: |
        HTTP method as uppercase string. Supported: GET, POST,
        PUT, PATCH, DELETE, HEAD, OPTIONS.
      de: |
        HTTP-Methode in Großbuchstaben. Unterstützt: GET, POST,
        PUT, PATCH, DELETE, HEAD, OPTIONS.
  url:
    type: text
    description:
      en: |
        Full URL including scheme. Use https:// for production;
        http:// is permitted so loopback and air-gapped internal
        services work, but operator policy can clamp it.
      de: |
        Vollständige URL inkl. Schema. https:// für Produktion;
        http:// erlaubt für Loopback / interne Services, kann
        per Operator-Policy eingeschränkt werden.
  headers:
    type: text
    description:
      en: |
        Optional headers as JSON object string, e.g.
        '{"Accept":"application/json","X-Tenant":"acme"}'.
        Empty = no extra headers (Content-Type is auto-set when
        body is non-empty and not already JSON-shaped).
      de: |
        Optionale Header als JSON-Objekt-String, z. B.
        '{"Accept":"application/json","X-Tenant":"acme"}'.
        Leer = keine zusätzlichen Header (Content-Type wird
        automatisch gesetzt, wenn body nicht-leer und nicht
        bereits JSON-geformt ist).
  body:
    type: text
    description:
      en: |
        Optional request body. Treated as UTF-8 text — binary
        payloads should use a future `http.request-bytes`
        variant.
      de: |
        Optionaler Request-Body. UTF-8-Text — binäre Payloads
        sollen eine künftige `http.request-bytes`-Variante
        nutzen.

outputs:
  status:
    type: text
    description:
      en: |
        HTTP status code as decimal text (e.g. "200", "404").
        Text rather than number so the audit-log entry stays
        operator-readable without JSON re-parsing.
      de: |
        HTTP-Statuscode als Dezimal-Text (z. B. "200", "404").
        Text statt Zahl, damit der Audit-Log-Eintrag ohne
        JSON-Re-Parsing operator-lesbar bleibt.
  headers:
    type: text
    description:
      en: |
        Response headers serialised as a JSON object (same shape
        as the input format) so downstream flow steps can pluck
        values like Content-Type or rate-limit headers.
      de: |
        Response-Header als JSON-Objekt serialisiert (gleiche
        Form wie das Input-Format), damit nachgelagerte Schritte
        Werte wie Content-Type oder Rate-Limit-Header abgreifen
        können.
  body:
    type: text
    description:
      en: |
        Response body as UTF-8 text. Non-UTF-8 responses come
        through with replacement characters; binary uses the
        bytes-shaped variant (future).
      de: |
        Response-Body als UTF-8-Text. Nicht-UTF-8-Antworten
        kommen mit Replacement-Zeichen durch; binär verwendet
        die bytes-Variante (zukünftig).

# Permissions required.
#
# v0.1.0 declares the broadest net: permission needed to call
# arbitrary URLs. Operators clamp this per-host via their
# operator-policy ceiling — installing http.request against a
# policy that disallows wildcards fails fast at install time.
permissions:
  - "net: *"