Naftiko Trusted Header Forward Proxy Capability

naftiko: 1.0.0-alpha2
info:
  title: Naftiko Trusted Header Forward Proxy Capability
  description: A capability that injects a Naftiko-trusted header (signed JWT with capability id + caller) when forwarding to upstream APIs.
  tags: [Naftiko, Trust, Proxy]
  created: '2026-05-01'
  modified: '2026-05-04'
binds:
- namespace: naftiko-env
  keys: {NAFTIKO_API_KEY: NAFTIKO_API_KEY}
capability:
  consumes:
  - namespace: naftiko-trust
    type: http
    baseUri: https://api.naftiko.com
    authentication: {type: bearer, token: '{{NAFTIKO_API_KEY}}'}
    resources:
    - {name: trusted-tokens, path: /v1/trust/tokens, operations: [{name: mint-trusted-token, method: POST}]}
    - {name: token-introspect, path: /v1/trust/tokens/introspect, operations: [{name: introspect-trusted-token, method: POST}]}
  exposes:
  - type: rest
    address: 0.0.0.0
    port: 8080
    namespace: naftiko-trusted-header-forward-proxy-capability-rest
    description: REST surface for trusted-token minting.
    resources:
    - {name: token, path: /tokens, operations: [{method: POST, name: mint-trusted-token, call: naftiko-trust.mint-trusted-token}]}
  - type: mcp
    address: 0.0.0.0
    port: 3010
    namespace: naftiko-trusted-header-forward-proxy-capability-mcp
    description: MCP for trusted-token minting.
    tools:
    - {name: mint-trusted-token, call: naftiko-trust.mint-trusted-token}
    - {name: introspect-trusted-token, call: naftiko-trust.introspect-trusted-token}
  - type: skill
    address: 0.0.0.0
    port: 3011
    namespace: naftiko-trusted-header-forward-proxy-capability-skills
    description: Skill for trusted-header forward proxy.
    skills:
    - name: naftiko-trusted-header-forward-proxy-capability
      description: Trusted-header forward proxy.
      location: file:///opt/naftiko/skills/naftiko-trusted-header-forward-proxy-capability
      allowed-tools: mint-trusted-token,introspect-trusted-token
      tools:
      - {name: mint-trusted-token, from: {sourceNamespace: naftiko-trusted-header-forward-proxy-capability-mcp, action: mint-trusted-token}}
      - {name: introspect-trusted-token, from: {sourceNamespace: naftiko-trusted-header-forward-proxy-capability-mcp, action: introspect-trusted-token}}