# Request and result guide

Every example below is an executable fixture from `tests/cases.json`. The same cases run as MoonBit white-box tests on every backend (`fixtures_wbtest.mbt`) and through the Node CLI (`scripts/check.mjs`). Assertions cover the listed result fields; additional output fields are documented by the API and other fixtures. Error cases intentionally reject the request. This file is generated by `scripts/fixtures.py`.

## layer merge

Later layers override earlier ones key by key; origins record the override chain for every path.

```json
{
  "layers": [
    {
      "name": "base",
      "value": {
        "db": {
          "host": "local",
          "port": 1
        }
      }
    },
    {
      "name": "prod",
      "value": {
        "db": {
          "port": 2
        }
      }
    }
  ]
}
```

Expected result fields:

```json
{
  "config/db/host": "local",
  "config/db/port": 2,
  "origins//db/port": [
    "base",
    "prod"
  ]
}
```

## interpolation keeps type

A whole-string reference keeps the referenced type; an embedded reference is rendered into the text.

```json
{
  "layers": [
    {
      "name": "x",
      "value": {
        "n": 3,
        "copy": "${config:/n}",
        "message": "n=${config:/n}"
      }
    }
  ]
}
```

Expected result fields:

```json
{
  "config/copy": 3,
  "config/message": "n=3"
}
```

## secret aliases

Secrecy propagates from a secret environment variable through scalar and container aliases; masked lists every redacted path in code-unit order.

```json
{
  "layers": [
    {
      "name": "x",
      "value": {
        "db": {
          "password": "${env:KEY}"
        },
        "alias": "${config:/db}"
      }
    }
  ],
  "env": {
    "KEY": "secret"
  },
  "secret_env": [
    "KEY"
  ]
}
```

Expected result fields:

```json
{
  "config/db/password": "***",
  "config/alias": "***",
  "masked": [
    "/alias",
    "/db/password"
  ]
}
```

## unique arrays

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "x": [
          1,
          2
        ]
      }
    },
    {
      "name": "b",
      "value": {
        "x": [
          2,
          3
        ]
      }
    }
  ],
  "arrays": "unique"
}
```

Expected result fields:

```json
{
  "config/x": [
    1,
    2,
    3
  ]
}
```

## replace arrays by default

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "x": [
          1,
          2
        ]
      }
    },
    {
      "name": "b",
      "value": {
        "x": [
          3
        ]
      }
    }
  ]
}
```

Expected result fields:

```json
{
  "config/x": [
    3
  ],
  "origins//x": [
    "a",
    "b"
  ]
}
```

## append arrays

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "x": [
          1,
          2
        ]
      }
    },
    {
      "name": "b",
      "value": {
        "x": [
          2,
          3
        ]
      }
    }
  ],
  "arrays": "append"
}
```

Expected result fields:

```json
{
  "config/x": [
    1,
    2,
    2,
    3
  ],
  "origins//x/2": [
    "b"
  ]
}
```

## per-path array strategies

The arrays field accepts per-path JSON Pointer assignments; unassigned arrays keep the default replace strategy.

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "steps": [
          "checkout"
        ],
        "targets": [
          "js"
        ],
        "ignored": [
          1
        ]
      }
    },
    {
      "name": "b",
      "value": {
        "steps": [
          "test"
        ],
        "targets": [
          "js",
          "wasm"
        ],
        "ignored": [
          2
        ]
      }
    }
  ],
  "arrays": {
    "append": [
      "/steps"
    ],
    "unique": [
      "/targets"
    ]
  }
}
```

Expected result fields:

```json
{
  "config/steps": [
    "checkout",
    "test"
  ],
  "config/targets": [
    "js",
    "wasm"
  ],
  "config/ignored": [
    2
  ]
}
```

## per-path strategy default

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "x": [
          1
        ],
        "y": [
          1
        ]
      }
    },
    {
      "name": "b",
      "value": {
        "x": [
          2
        ],
        "y": [
          2
        ]
      }
    }
  ],
  "arrays": {
    "default": "append",
    "replace": [
      "/x"
    ]
  }
}
```

Expected result fields:

```json
{
  "config/x": [
    2
  ],
  "config/y": [
    1,
    2
  ]
}
```

## array strategy assigned twice

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "x": []
      }
    }
  ],
  "arrays": {
    "append": [
      "/x"
    ],
    "unique": [
      "/x"
    ]
  }
}
```

Expected: nonzero exit with an input error.

## unknown path strategy

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "x": []
      }
    }
  ],
  "arrays": {
    "merge": [
      "/x"
    ]
  }
}
```

Expected: nonzero exit with an input error.

## unknown array strategy

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "x": [
          1
        ]
      }
    }
  ],
  "arrays": "merge"
}
```

Expected: nonzero exit with an input error.

## deep path merge

Twelve nested levels merge and are traceable; nesting beyond 128 levels is rejected.

```json
{
  "layers": [
    {
      "name": "base",
      "value": {
        "a": {
          "b": {
            "c": {
              "d": {
                "e": {
                  "f": {
                    "g": {
                      "h": {
                        "i": {
                          "j": {
                            "k": {
                              "l": 1
                            }
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    },
    {
      "name": "deep",
      "value": {
        "a": {
          "b": {
            "c": {
              "d": {
                "e": {
                  "f": {
                    "g": {
                      "h": {
                        "i": {
                          "j": {
                            "k": {
                              "l": 2
                            }
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  ]
}
```

Expected result fields:

```json
{
  "config/a/b/c/d/e/f/g/h/i/j/k/l": 2,
  "origins//a/b/c/d/e/f/g/h/i/j/k/l": [
    "base",
    "deep"
  ]
}
```

## non-strict scalar replaces object

Without strict_types a layer may replace a container by a scalar; the origins show which layer did it.

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "x": {
          "y": 1
        }
      }
    },
    {
      "name": "b",
      "value": {
        "x": 5
      }
    }
  ]
}
```

Expected result fields:

```json
{
  "config/x": 5,
  "origins//x": [
    "a",
    "b"
  ]
}
```

## shadowed overrides are listed

Every replacement of a different value names the layer that was overridden and the layer that did it; re-setting the same value is not shadowing.

```json
{
  "layers": [
    {
      "name": "defaults",
      "value": {
        "db": {
          "port": 1
        },
        "same": 7
      }
    },
    {
      "name": "prod",
      "value": {
        "db": {
          "port": 2
        },
        "same": 7
      }
    }
  ]
}
```

Expected result fields:

```json
{
  "shadowed/0/path": "/db/port",
  "shadowed/0/layer": "defaults",
  "shadowed/0/by": "prod"
}
```

## identical overlay is not shadowing

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "x": 1
      }
    },
    {
      "name": "b",
      "value": {
        "x": 1
      }
    }
  ]
}
```

Expected result fields:

```json
{
  "shadowed": [],
  "config/x": 1
}
```

## shadowing follows layer order

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "x": 1
      }
    },
    {
      "name": "b",
      "value": {
        "x": 2
      }
    },
    {
      "name": "c",
      "value": {
        "x": 3
      }
    }
  ]
}
```

Expected result fields:

```json
{
  "shadowed/0/layer": "a",
  "shadowed/0/by": "b",
  "shadowed/1/layer": "b",
  "shadowed/1/by": "c"
}
```

## strict types allow null base

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "x": null
      }
    },
    {
      "name": "b",
      "value": {
        "x": 1
      }
    }
  ],
  "strict_types": true
}
```

Expected result fields:

```json
{
  "config/x": 1
}
```

## missing env

```json
{
  "layers": [
    {
      "name": "x",
      "value": {
        "a": "${env:MISSING}"
      }
    }
  ]
}
```

Expected: nonzero exit with an input error.

## cycle

```json
{
  "layers": [
    {
      "name": "x",
      "value": {
        "a": "${config:/b}",
        "b": "${config:/a}"
      }
    }
  ]
}
```

Expected: nonzero exit with an input error.

## type conflict

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "x": 1
      }
    },
    {
      "name": "b",
      "value": {
        "x": "a"
      }
    }
  ],
  "strict_types": true
}
```

Expected: nonzero exit with an input error.

## embedded structured reference

```json
{
  "layers": [
    {
      "name": "x",
      "value": {
        "obj": {
          "k": 1
        },
        "text": "v=${config:/obj}"
      }
    }
  ]
}
```

Expected: nonzero exit with an input error.

## unterminated interpolation

```json
{
  "layers": [
    {
      "name": "x",
      "value": {
        "a": "${env:HOME"
      }
    }
  ],
  "env": {
    "HOME": "h"
  }
}
```

Expected: nonzero exit with an input error.

## non-pointer config reference

```json
{
  "layers": [
    {
      "name": "x",
      "value": {
        "a": 1,
        "b": "${config:a}"
      }
    }
  ]
}
```

Expected: nonzero exit with an input error.

## missing config reference

```json
{
  "layers": [
    {
      "name": "x",
      "value": {
        "b": "${config:/nope}"
      }
    }
  ]
}
```

Expected: nonzero exit with an input error.

## env reference default

A :-literal fallback is used only when the target is absent; an empty string value is present and wins over the fallback.

```json
{
  "layers": [
    {
      "name": "x",
      "value": {
        "missing": "${env:NOPE:-fallback}",
        "present": "${env:SET:-unused}"
      }
    }
  ],
  "env": {
    "SET": "value"
  }
}
```

Expected result fields:

```json
{
  "config/missing": "fallback",
  "config/present": "value"
}
```

## config reference default

A whole-string reference to a present path still preserves the referenced type; only absent paths fall back to the literal text.

```json
{
  "layers": [
    {
      "name": "x",
      "value": {
        "n": 5,
        "missing": "${config:/nope:-zero}",
        "present": "${config:/n:-0}"
      }
    }
  ]
}
```

Expected result fields:

```json
{
  "config/missing": "zero",
  "config/present": 5
}
```

## empty env value is present

```json
{
  "layers": [
    {
      "name": "x",
      "value": {
        "a": "${env:EMPTY:-fallback}"
      }
    }
  ],
  "env": {
    "EMPTY": ""
  }
}
```

Expected result fields:

```json
{
  "config/a": ""
}
```

## fallback does not unmask secrets

A fallback is plain text, but a secret referenced elsewhere in the same string still masks the whole value.

```json
{
  "layers": [
    {
      "name": "x",
      "value": {
        "combo": "a=${env:S}-${env:NOPE:-plain}"
      }
    }
  ],
  "env": {
    "S": "sec"
  },
  "secret_env": [
    "S"
  ]
}
```

Expected result fields:

```json
{
  "config/combo": "***",
  "masked": [
    "/combo"
  ]
}
```

## embedded env and config references

```json
{
  "layers": [
    {
      "name": "x",
      "value": {
        "port": 5,
        "url": "host=${env:HOST}:${config:/port}"
      }
    }
  ],
  "env": {
    "HOST": "h"
  }
}
```

Expected result fields:

```json
{
  "config/url": "host=h:5"
}
```

## sensitive path with reveal

reveal=true returns plaintext in config; the redacted report is always available alongside it.

```json
{
  "layers": [
    {
      "name": "x",
      "value": {
        "db": {
          "password": "plain",
          "host": "h"
        }
      }
    }
  ],
  "sensitive": [
    "/db/password"
  ],
  "reveal": true
}
```

Expected result fields:

```json
{
  "config/db/password": "plain",
  "redacted/db/password": "***",
  "redacted/db/host": "h"
}
```

## sensitive keys mask by name

sensitive_keys designates every path whose last key equals one of the names (exact, case-sensitive) wherever it appears; a reference to a container that holds such a key is masked as a whole.

```json
{
  "layers": [
    {
      "name": "x",
      "value": {
        "db": {
          "password": "pw",
          "host": "h",
          "Password": "case"
        },
        "api": {
          "token": "t"
        },
        "alias": "${config:/db}"
      }
    }
  ],
  "sensitive_keys": [
    "password",
    "token"
  ]
}
```

Expected result fields:

```json
{
  "config/db/password": "***",
  "config/api/token": "***",
  "config/db/host": "h",
  "config/db/Password": "case",
  "config/alias": "***",
  "masked": [
    "/alias",
    "/api/token",
    "/db/password"
  ]
}
```

## empty sensitive key rejected

```json
{
  "layers": [
    {
      "name": "x",
      "value": {
        "a": 1
      }
    }
  ],
  "sensitive_keys": [
    ""
  ]
}
```

Expected: nonzero exit with an input error.

## numeric constraint wrong type

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "x": "text"
      }
    }
  ],
  "constraints": [
    {
      "path": "/x",
      "min": 1
    }
  ]
}
```

Expected result fields:

```json
{
  "valid": false,
  "issues/0/reason": "numeric minimum requires number"
}
```

## constraint first failure

Clauses are checked in the order type, enum, min, max and the first violated clause is reported.

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "x": "text"
      }
    }
  ],
  "constraints": [
    {
      "path": "/x",
      "type": "number",
      "min": 1
    }
  ]
}
```

Expected result fields:

```json
{
  "valid": false,
  "issues/0/path": "/x",
  "issues/0/reason": "type mismatch"
}
```

## required missing

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "x": 1
      }
    }
  ],
  "constraints": [
    {
      "path": "/missing",
      "required": true
    },
    {
      "path": "/also-missing"
    }
  ]
}
```

Expected result fields:

```json
{
  "valid": false,
  "issues/0/path": "/missing",
  "issues/0/reason": "required value missing"
}
```

## constraints satisfied

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "mode": "fast",
        "workers": 4
      }
    }
  ],
  "constraints": [
    {
      "path": "/mode",
      "type": "string",
      "enum": [
        "fast",
        "safe"
      ]
    },
    {
      "path": "/workers",
      "type": "number",
      "min": 1,
      "max": 64
    }
  ]
}
```

Expected result fields:

```json
{
  "valid": true,
  "issues": []
}
```

## unknown constraint type

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "x": 1
      }
    }
  ],
  "constraints": [
    {
      "path": "/x",
      "type": "integer"
    }
  ]
}
```

Expected: nonzero exit with an input error.

## pattern constraints

pattern is an unanchored search in the toolchain's regex dialect (explicit classes such as [0-9]; no \\d shorthands); anchor with ^ and $ to match the whole value. min_length and max_length count UTF-16 code units of strings or elements of arrays.

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "version": "v12",
        "stage": "prod",
        "name": "abc",
        "tags": [
          "a",
          "b"
        ]
      }
    }
  ],
  "constraints": [
    {
      "path": "/version",
      "pattern": "^v[0-9]+$"
    },
    {
      "path": "/stage",
      "pattern": "^(dev|prod)$"
    },
    {
      "path": "/name",
      "min_length": 2,
      "max_length": 8
    },
    {
      "path": "/tags",
      "min_length": 1,
      "max_length": 3
    }
  ]
}
```

Expected result fields:

```json
{
  "valid": true,
  "issues": []
}
```

## pattern mismatch

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "version": "latest"
      }
    }
  ],
  "constraints": [
    {
      "path": "/version",
      "pattern": "^v[0-9]+$"
    }
  ]
}
```

Expected result fields:

```json
{
  "valid": false,
  "issues/0/reason": "pattern mismatch"
}
```

## pattern requires string

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "version": 12
      }
    }
  ],
  "constraints": [
    {
      "path": "/version",
      "pattern": "^v[0-9]+$"
    }
  ]
}
```

Expected result fields:

```json
{
  "issues/0/reason": "pattern requires string"
}
```

## invalid constraint pattern

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "x": "a"
      }
    }
  ],
  "constraints": [
    {
      "path": "/x",
      "pattern": "(unclosed"
    }
  ]
}
```

Expected: nonzero exit with an input error.

## length violations

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "name": "ab",
        "tags": [
          "a",
          "b",
          "c"
        ],
        "n": 5
      }
    }
  ],
  "constraints": [
    {
      "path": "/name",
      "min_length": 3
    },
    {
      "path": "/tags",
      "max_length": 2
    },
    {
      "path": "/n",
      "min_length": 1
    }
  ]
}
```

Expected result fields:

```json
{
  "issues/0/reason": "below minimum length",
  "issues/1/reason": "above maximum length",
  "issues/2/reason": "length requires string or array"
}
```

## unknown constraint clause

Clause names are validated so a misspelled clause cannot silently pass.

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "x": 1
      }
    }
  ],
  "constraints": [
    {
      "path": "/x",
      "maximum": 3
    }
  ]
}
```

Expected: nonzero exit with an input error.

## layer sources

A layer may carry a free-form source label (the host adapter uses the file name) which the report echoes in layer order.

```json
{
  "layers": [
    {
      "name": "defaults",
      "value": {
        "a": 1
      },
      "source": "defaults.toml"
    },
    {
      "name": "prod",
      "value": {
        "a": 2
      },
      "source": "prod.json"
    }
  ]
}
```

Expected result fields:

```json
{
  "layers/0/name": "defaults",
  "layers/0/source": "defaults.toml",
  "layers/1/source": "prod.json",
  "config/a": 2
}
```

## duplicate layer name

```json
{
  "layers": [
    {
      "name": "a",
      "value": {
        "x": 1
      }
    },
    {
      "name": "a",
      "value": {
        "x": 2
      }
    }
  ]
}
```

Expected: nonzero exit with an input error.

## export canonical text

export renders the resolved configuration as canonical JSON: object keys sorted, no whitespace, arrays in order.

```json
{
  "operation": "export",
  "layers": [
    {
      "name": "b",
      "value": {
        "z": 1,
        "a": {
          "y": [
            2,
            1
          ],
          "x": "${config:/z}"
        }
      }
    },
    {
      "name": "o",
      "value": {
        "a": {
          "w": true
        }
      }
    }
  ]
}
```

Expected result fields:

```json
{
  "text": "{\"a\":{\"w\":true,\"x\":1,\"y\":[2,1]},\"z\":1}",
  "redacted": true,
  "valid": true
}
```

## export hides secrets unless revealed

```json
{
  "operation": "export",
  "layers": [
    {
      "name": "x",
      "value": {
        "token": "${env:T}"
      }
    }
  ],
  "env": {
    "T": "s3cret"
  },
  "secret_env": [
    "T"
  ]
}
```

Expected result fields:

```json
{
  "text": "{\"token\":\"***\"}",
  "redacted": true
}
```

## flat export maps pointers to leaves

flat renders one entry per leaf, keys sorted in code-unit order; empty containers are leaves.

```json
{
  "operation": "export",
  "format": "flat",
  "layers": [
    {
      "name": "x",
      "value": {
        "b": {
          "c": [
            1,
            {
              "d": null
            }
          ]
        },
        "a": 1
      }
    }
  ]
}
```

Expected result fields:

```json
{
  "format": "flat",
  "text": "{\"/a\":1,\"/b/c/0\":1,\"/b/c/1/d\":null}"
}
```

## dotenv export

dotenv keys come from the pointer: segments upper-cased, non-alphanumerics become _, segments joined with _. Values are bare unless they are empty or contain whitespace, quotes, # or =; then JSON-quoted.

```json
{
  "operation": "export",
  "format": "dotenv",
  "layers": [
    {
      "name": "x",
      "value": {
        "database": {
          "host": "db.example",
          "port": 5432,
          "password": "${env:P}"
        },
        "debug": true,
        "motd": "hello world #1",
        "empty": ""
      }
    }
  ],
  "env": {
    "P": "pw"
  },
  "secret_env": [
    "P"
  ]
}
```

Expected result fields:

```json
{
  "format": "dotenv",
  "text": "DATABASE_HOST=db.example\nDATABASE_PASSWORD=***\nDATABASE_PORT=5432\nDEBUG=true\nEMPTY=\"\"\nMOTD=\"hello world #1\"\n"
}
```

## dotenv key collision

Two pointers that derive the same dotenv key are rejected instead of silently overwriting.

```json
{
  "operation": "export",
  "format": "dotenv",
  "layers": [
    {
      "name": "x",
      "value": {
        "a-b": 1,
        "a_b": 2
      }
    }
  ]
}
```

Expected: nonzero exit with an input error.

## unknown export format

```json
{
  "operation": "export",
  "format": "yaml",
  "layers": [
    {
      "name": "x",
      "value": {
        "a": 1
      }
    }
  ]
}
```

Expected: nonzero exit with an input error.

## export orders keys by code unit

Keys are ordered by UTF-16 code units (RFC 8785 order): shorter keys do not sort first.

```json
{
  "operation": "export",
  "layers": [
    {
      "name": "x",
      "value": {
        "db": 1,
        "cache": 2,
        "10": 3,
        "9": 4
      }
    }
  ]
}
```

Expected result fields:

```json
{
  "text": "{\"10\":3,\"9\":4,\"cache\":2,\"db\":1}"
}
```

## diff reports origins

Each change names the layers that produced the value on both sides, so an abnormal override can be located.

```json
{
  "operation": "diff",
  "old": {
    "layers": [
      {
        "name": "base",
        "value": {
          "db": {
            "port": 1,
            "host": "h"
          }
        }
      }
    ]
  },
  "new": {
    "layers": [
      {
        "name": "base",
        "value": {
          "db": {
            "port": 1,
            "host": "h"
          }
        }
      },
      {
        "name": "prod",
        "value": {
          "db": {
            "port": 2
          },
          "cache": true
        }
      }
    ]
  }
}
```

Expected result fields:

```json
{
  "equal": false,
  "changes/0/path": "/cache",
  "changes/0/type": "added",
  "changes/0/after_origins": [
    "prod"
  ],
  "changes/1/path": "/db/port",
  "changes/1/type": "changed",
  "changes/1/before": 1,
  "changes/1/after": 2,
  "changes/1/before_origins": [
    "base"
  ],
  "changes/1/after_origins": [
    "base",
    "prod"
  ]
}
```

## diff cannot see hidden secret changes

Diff compares redacted values by design; two different hidden secrets compare equal.

```json
{
  "operation": "diff",
  "old": {
    "layers": [
      {
        "name": "x",
        "value": {
          "k": "${env:S}"
        }
      }
    ],
    "env": {
      "S": "one"
    },
    "secret_env": [
      "S"
    ]
  },
  "new": {
    "layers": [
      {
        "name": "x",
        "value": {
          "k": "${env:S}"
        }
      }
    ],
    "env": {
      "S": "two"
    },
    "secret_env": [
      "S"
    ]
  }
}
```

Expected result fields:

```json
{
  "equal": true,
  "redacted": true
}
```

## diff reports masked override by origin

When a hidden value is overridden, the diff reports the changed origin chain without revealing either value.

```json
{
  "operation": "diff",
  "old": {
    "layers": [
      {
        "name": "defaults",
        "value": {
          "key": "${env:K}"
        }
      }
    ],
    "env": {
      "K": "k1"
    },
    "sensitive": [
      "/key"
    ]
  },
  "new": {
    "layers": [
      {
        "name": "defaults",
        "value": {
          "key": "${env:K}"
        }
      },
      {
        "name": "tenant",
        "value": {
          "key": "hardcoded"
        }
      }
    ],
    "env": {
      "K": "k1"
    },
    "sensitive": [
      "/key"
    ]
  }
}
```

Expected result fields:

```json
{
  "equal": false,
  "changes/0/path": "/key",
  "changes/0/type": "masked_override",
  "changes/0/before_origins": [
    "defaults"
  ],
  "changes/0/after_origins": [
    "defaults",
    "tenant"
  ]
}
```

## diff ignores designated subtrees

Changes at or below an ignored pointer are dropped from the report, which also silences masked overrides there; the applied pointers are echoed.

```json
{
  "operation": "diff",
  "ignore": [
    "/build",
    "/meta/stamp"
  ],
  "old": {
    "layers": [
      {
        "name": "a",
        "value": {
          "build": {
            "time": 1,
            "host": "x"
          },
          "meta": {
            "stamp": 1,
            "owner": "ops"
          },
          "port": 1
        }
      }
    ]
  },
  "new": {
    "layers": [
      {
        "name": "a",
        "value": {
          "build": {
            "time": 2,
            "host": "y"
          },
          "meta": {
            "stamp": 2,
            "owner": "ops"
          },
          "port": 2
        }
      }
    ]
  }
}
```

Expected result fields:

```json
{
  "equal": false,
  "changes/0/path": "/port",
  "ignored": [
    "/build",
    "/meta/stamp"
  ]
}
```

## diff is equal when only ignored paths differ

```json
{
  "operation": "diff",
  "ignore": [
    "/build"
  ],
  "old": {
    "layers": [
      {
        "name": "a",
        "value": {
          "build": {
            "time": 1
          },
          "port": 1
        }
      }
    ]
  },
  "new": {
    "layers": [
      {
        "name": "a",
        "value": {
          "build": {
            "time": 2
          },
          "port": 1
        }
      }
    ]
  }
}
```

Expected result fields:

```json
{
  "equal": true,
  "changes": []
}
```

## unknown operation

```json
{
  "operation": "bogus",
  "layers": []
}
```

Expected: nonzero exit with an input error.

## infer derives constraints from observations

infer resolves the configuration after every layer and derives one constraint per surviving leaf: the consistent observed type, an enum when few distinct strings were seen, numeric bounds, and required. The inferred set is checked against every observation, so valid is guaranteed true.

```json
{
  "operation": "infer",
  "layers": [
    {
      "name": "dev",
      "value": {
        "db": {
          "host": "db.dev",
          "port": 5432,
          "level": "debug"
        }
      }
    },
    {
      "name": "prod",
      "value": {
        "db": {
          "host": "db.prod",
          "port": 6543,
          "level": "info",
          "password": "pw"
        }
      }
    }
  ],
  "sensitive": [
    "/db/password"
  ]
}
```

Expected result fields:

```json
{
  "constraints/0/path": "/db/host",
  "constraints/0/type": "string",
  "constraints/0/enum": [
    "db.dev",
    "db.prod"
  ],
  "constraints/2/path": "/db/port",
  "constraints/2/min": 5432,
  "constraints/2/max": 6543,
  "constraint_count": 3,
  "path_count": 3,
  "valid": true
}
```

## infer never reports masked paths

Paths that are masked in any observation are skipped entirely, so secret values cannot leak into an inferred enum.

```json
{
  "operation": "infer",
  "layers": [
    {
      "name": "a",
      "value": {
        "password": "pw"
      }
    },
    {
      "name": "b",
      "value": {
        "password": "pw2"
      }
    }
  ],
  "sensitive": [
    "/password"
  ]
}
```

Expected result fields:

```json
{
  "constraints": [],
  "constraint_count": 0,
  "valid": true
}
```

## infer max_enum bounds enums

max_enum (1-64, default 8) controls when a string set becomes an enum; here the two hosts stay unconstrained while the port keeps its bounds.

```json
{
  "operation": "infer",
  "max_enum": 1,
  "layers": [
    {
      "name": "a",
      "value": {
        "host": "one",
        "port": 1
      }
    },
    {
      "name": "b",
      "value": {
        "host": "two",
        "port": 2
      }
    }
  ]
}
```

Expected result fields:

```json
{
  "constraints/0/type": "string",
  "constraints/1/min": 1,
  "constraints/1/max": 2
}
```

## infer mixed types omit the type clause

When observations disagree on the type, only required is inferred; strict_types would have rejected such layers already.

```json
{
  "operation": "infer",
  "layers": [
    {
      "name": "a",
      "value": {
        "x": 1
      }
    },
    {
      "name": "b",
      "value": {
        "x": "one"
      }
    }
  ]
}
```

Expected result fields:

```json
{
  "constraints/0/path": "/x",
  "constraints/0/required": true
}
```

## infer rejects bad max_enum

```json
{
  "operation": "infer",
  "max_enum": 0,
  "layers": [
    {
      "name": "a",
      "value": {
        "x": 1
      }
    }
  ]
}
```

Expected: nonzero exit with an input error.

## followup value-free secret audit

```json
{
  "operation": "audit",
  "layers": [
    {
      "name": "base",
      "value": {
        "db": {
          "password": "fixture-secret",
          "port": 1
        }
      }
    },
    {
      "name": "prod",
      "value": {
        "db": {
          "port": 2
        }
      }
    }
  ],
  "sensitive": [
    "/db/password"
  ],
  "reveal": true
}
```

Expected result fields:

```json
{
  "values_included": false,
  "path_count": 4,
  "masked": [
    "/db/password"
  ],
  "paths/2/type": "redacted",
  "paths/3/layers": [
    "base",
    "prod"
  ],
  "valid": true
}
```

## followup empty audit

```json
{
  "operation": "audit",
  "layers": []
}
```

Expected result fields:

```json
{
  "path_count": 1,
  "values_included": false
}
```

## followup canonical pointer error

```json
{
  "layers": [
    {
      "name": "x",
      "value": {
        "a": [
          1
        ],
        "b": "${config:/a/0.0}"
      }
    }
  ]
}
```

Expected: nonzero exit with an input error.

## Host adapter

```sh
python -B scripts/files.py MANIFEST.json
```

A manifest is a request whose layers may name `file` entries (`.json` or `.toml`, resolved inside the manifest directory) or `dir` entries (expanded to one layer per `.json`/`.toml` file in name order, named `DIR/FILE`), and may list `allow_environment` names copied from the process environment. Read the current boundaries before using this adapter.