rules:
  - name: Modal CLI Token Pair
    id: kingfisher.modal.1
    pattern: |
      (?x)
      (?P<TOKEN_ID>
        (?:ak|as)-[A-Za-z0-9]{22}
      )
      \b
      (?:.|[\n\r]){0,80}?
      \b
      (
        (?:ak|as)-[A-Za-z0-9]{22}
      )
      \b
    pattern_requirements:
      min_digits: 2
    min_entropy: 2.8
    confidence: high
    examples:
      - "modal token set --token-id ak-BJbwFRtNnI4Y11oxC4hngY --token-secret as-sRul9S1EAi9qNlq3G6NTIb"
    references:
      - https://modal.com/docs/reference/cli/token
      - https://modal.com/docs/reference/modal.Client
      - https://modal.com/docs/reference/modal.App
    validation:
      type: Grpc
      content:
        request:
          # Use the same handshake call as the Modal SDK (`client.hello()`).
          url: https://api.modal.com/modal.client.ModalClient/ClientHello
          headers:
            content-type: application/grpc
            te: trailers
            x-modal-token-id: "{{ TOKEN_ID }}"
            x-modal-token-secret: "{{ TOKEN }}"
            x-modal-client-type: "1"
            # Modal uses this for compatibility checks; "0" is rejected as deprecated.
            x-modal-client-version: "1.0.0"
            x-modal-python-version: "3.11.0"
            x-modal-platform: kingfisher
            x-modal-node: kingfisher
          body: "\u0000\u0000\u0000\u0000\u0000"
          response_matcher:
            - report_response: true
            - type: HeaderMatch
              header: grpc-status
              expected: ["0"]

  # - name: Modal Token Secret
  #   id: kingfisher.modal.2
  #   pattern: |
  #     (?x)
  #     \b
  #     (
  #       as-[A-Za-z0-9]{22}
  #     )
  #     \b
  #   pattern_requirements:
  #     min_digits: 2
  #   min_entropy: 3.0
  #   confidence: medium
  #   examples:
  #     - "as-aB1cD2eF3gH4iJ5kL6mN7P"
  #   references:
  #     - https://modal.com/docs/reference/cli/token
  #     - https://modal.com/docs/reference/modal.Client
  #     - https://modal.com/docs/reference/modal.App