ReadonlydirectionWhich way data moves across this boundary.
Optional ReadonlyhandlingThe declared data-safety state of this field's value AT this specific
boundary crossing -- e.g. a field that arrives "encrypted" on an
"input" endpoint and is sent back out "redacted" on an "output"
endpoint. Declared only, same presence-only discipline as every other
field in this vocabulary: this records what a developer states about
handling at this crossing, never that data-cap has verified the field's
actual runtime value matches the claim.
ReadonlykindWhat kind of boundary this is.
ReadonlynameShort identifier, e.g. "stripe-api", "postgres:users" -- a semantic label, not a sentence.
Optional ReadonlyurlA literal, trackable location for this endpoint -- a URL, a route path, a table:column reference. Distinct from name (a short label): this is meant to be compared/matched across capabilities (e.g. flagging two capabilities that declare the same URL as likely-duplicate fetches), not just read by a person.
One declared data-flow boundary an operation crosses. A getter/ subscription's endpoints are typically
"input"(whereexecute/subscribeacquires data from); a mutator's are typically"output"(where it sends data to) -- nothing enforces the typical case, since this is documentation, not a runtime contract.