@absolutejs/secrets 0.4.0 → 0.5.1

package/dist/manifest.json

@@ -0,0 +1,234 @@
+{
+	"contract": 1,
+	"identity": {
+		"accent": "#0d9488",
+		"category": "infrastructure",
+		"description": "One `createSecretBroker()` for resolving, caching, rotating, and log-scrubbing credentials. Pluggable adapters (env vars, encrypted file, in-memory, composite), sha256 fingerprints safe for logs, an audit hook on every lookup, and `redact()` / `redactStream()` that strip known secrets out of anything headed for a log sink.",
+		"docsUrl": "https://github.com/absolutejs/secrets",
+		"name": "@absolutejs/secrets",
+		"tagline": "Keep API keys and passwords out of your code and logs."
+	},
+	"implements": [
+		{
+			"contract": "secrets/adapter",
+			"factory": "envAdapter",
+			"from": "@absolutejs/secrets",
+			"settings": {
+				"type": "object",
+				"properties": {
+					"prefix": {
+						"description": "Only environment variables starting with this prefix are treated as secrets, looked up without it (prefix 'ABS_SECRET_' makes STRIPE_KEY read ABS_SECRET_STRIPE_KEY).",
+						"examples": [
+							"ABS_SECRET_"
+						],
+						"title": "Variable prefix",
+						"type": "string"
+					}
+				}
+			},
+			"title": "Environment variables (simplest — reads process.env)",
+			"wiring": {
+				"code": "envAdapter(${settings})",
+				"imports": [
+					{
+						"from": "@absolutejs/secrets",
+						"names": [
+							"envAdapter"
+						]
+					}
+				]
+			}
+		},
+		{
+			"contract": "secrets/adapter",
+			"factory": "inMemoryAdapter",
+			"from": "@absolutejs/secrets",
+			"settings": {
+				"type": "object",
+				"properties": {}
+			},
+			"title": "In memory (development only — values reset on restart)",
+			"wiring": {
+				"code": "inMemoryAdapter()",
+				"imports": [
+					{
+						"from": "@absolutejs/secrets",
+						"names": [
+							"inMemoryAdapter"
+						]
+					}
+				]
+			}
+		},
+		{
+			"contract": "secrets/adapter",
+			"factory": "encryptedFileAdapter",
+			"from": "@absolutejs/secrets",
+			"requires": {
+				"env": [
+					{
+						"description": "Master passphrase that unlocks the encrypted secrets file. Keep it out of the repo (password manager, host env).",
+						"key": "SECRETS_MASTER_PASSPHRASE",
+						"secret": true
+					}
+				]
+			},
+			"settings": {
+				"type": "object",
+				"required": [
+					"path"
+				],
+				"properties": {
+					"path": {
+						"default": "./var/secrets.enc.json",
+						"description": "Where the encrypted file lives. Safe to commit to a private repo — values are AES-256-GCM encrypted; only the master passphrase unlocks them.",
+						"title": "Encrypted file location",
+						"type": "string"
+					}
+				}
+			},
+			"title": "Encrypted file (durable — unlocked by a master passphrase)",
+			"wiring": {
+				"code": "encryptedFileAdapter({ key: { passphrase: ${env.SECRETS_MASTER_PASSPHRASE} ?? '', type: 'passphrase' }, ...${settings} })",
+				"imports": [
+					{
+						"from": "@absolutejs/secrets",
+						"names": [
+							"encryptedFileAdapter"
+						]
+					}
+				]
+			}
+		}
+	],
+	"settings": {
+		"type": "object",
+		"properties": {
+			"cacheTtlMs": {
+				"description": "How long a fetched secret is reused before asking the store again, in milliseconds. Default is 1 minute.",
+				"minimum": 0,
+				"title": "Secret cache lifetime",
+				"x-group": "caching",
+				"type": "number"
+			},
+			"cacheTtlOverrides": {
+				"description": "Per-secret cache lifetimes (milliseconds) that override the default. Use a short lifetime for high-impact keys like admin tokens.",
+				"title": "Per-secret cache lifetimes",
+				"x-group": "caching",
+				"type": "object",
+				"patternProperties": {
+					"^(.*)$": {
+						"minimum": 0,
+						"type": "number"
+					}
+				}
+			},
+			"redactionEncodings": {
+				"description": "Which forms of a secret get scrubbed from logs. Add 'base64' to also catch secrets hidden inside tokens and cookies.",
+				"title": "Scrubbed encodings",
+				"x-group": "redaction",
+				"type": "array",
+				"items": {
+					"anyOf": [
+						{
+							"const": "plain",
+							"type": "string"
+						},
+						{
+							"const": "base64",
+							"type": "string"
+						}
+					]
+				}
+			},
+			"redactionMinLength": {
+				"description": "Secrets shorter than this are not scrubbed from logs, to avoid blanking coincidental short matches. Default 8.",
+				"minimum": 1,
+				"title": "Minimum length to scrub",
+				"x-group": "redaction",
+				"type": "integer"
+			}
+		}
+	},
+	"slots": {
+		"adapter": {
+			"configPath": "adapter",
+			"contract": "secrets/adapter",
+			"description": "Where your secret values live",
+			"known": [
+				"@absolutejs/secrets#env",
+				"@absolutejs/secrets#memory",
+				"@absolutejs/secrets#encrypted-file"
+			],
+			"required": true
+		}
+	},
+	"wiring": [
+		{
+			"id": "default",
+			"server": {
+				"code": "const secrets = createSecretBroker({ adapter: ${slot.adapter}, ...${settings} });",
+				"imports": [
+					{
+						"from": "@absolutejs/secrets",
+						"names": [
+							"createSecretBroker"
+						]
+					}
+				],
+				"placement": "module-scope"
+			},
+			"title": "Create the secret broker"
+		}
+	],
+	"tools": {
+		"check_secret": {
+			"annotations": {
+				"readOnlyHint": true
+			},
+			"description": "Check whether a named secret is configured. Reports presence and a log-safe sha256 fingerprint — never the value.",
+			"input": {
+				"type": "object",
+				"required": [
+					"name"
+				],
+				"properties": {
+					"name": {
+						"minLength": 1,
+						"type": "string"
+					}
+				}
+			},
+			"kind": "runtime"
+		},
+		"redact_text": {
+			"annotations": {
+				"readOnlyHint": true
+			},
+			"description": "Preview redaction: returns the given text with every known (cached) secret replaced by [REDACTED:name]. Useful to check a log line or error message is safe to share. Only secrets the broker has already resolved are scrubbed.",
+			"input": {
+				"type": "object",
+				"required": [
+					"text"
+				],
+				"properties": {
+					"text": {
+						"type": "string"
+					}
+				}
+			},
+			"kind": "runtime"
+		},
+		"secret_stats": {
+			"annotations": {
+				"readOnlyHint": true
+			},
+			"description": "Cumulative broker counters since the server started: resolves (hits/misses/errors), rotations, and how often redaction actually fired.",
+			"input": {
+				"type": "object",
+				"properties": {}
+			},
+			"kind": "runtime"
+		}
+	}
+}

package/package.json

@@ -1,17 +1,24 @@
 {
   "name": "@absolutejs/secrets",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "Host-side secret broker for multi-tenant Bun runtimes. Pluggable adapters (env-var, in-memory, composite, encrypted-file); audit hook per resolve; safe fingerprints for logs; redact() walks known secrets out of arbitrary text before it lands in a log sink.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/absolutejs/secrets.git"
   },
+  "homepage": "https://github.com/absolutejs/secrets",
+  "bugs": {
+    "url": "https://github.com/absolutejs/secrets/issues"
+  },
   "main": "./dist/index.js",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "type": "module",
   "license": "BSL-1.1",
   "author": "Alex Kahn",
+  "absolutejs": {
+    "manifestContract": 1
+  },
   "publishConfig": {
     "access": "public"
   },
@@ -26,7 +33,7 @@
     "rotation"
   ],
   "scripts": {
-    "build": "rm -rf dist && bun build src/index.ts --outdir dist --sourcemap --target=bun && tsc --project tsconfig.build.json",
+    "build": "rm -rf dist && bun build src/index.ts src/manifest.ts --outdir dist --sourcemap --target=bun && tsc --project tsconfig.build.json && absolute-manifest emit",
     "test": "bun test tests/",
     "typecheck": "tsc --noEmit",
     "format": "prettier --write \"./**/*.{ts,json,md}\"",
@@ -34,7 +41,9 @@
     "release": "bun run format && bun run check:package && bun publish"
   },
   "dependencies": {
-    "@absolutejs/telemetry": "^0.0.2"
+    "@absolutejs/manifest": "^0.1.0",
+    "@absolutejs/telemetry": "^0.0.2",
+    "@sinclair/typebox": "^0.34.0"
   },
   "peerDependencies": {
     "bun-types": "^1.3.14"
@@ -50,7 +59,16 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
       "default": "./dist/index.js"
-    }
+    },
+    "./manifest": {
+      "types": "./dist/manifest.d.ts",
+      "import": "./dist/manifest.js",
+      "default": "./dist/manifest.js"
+    },
+    "./manifest.json": "./dist/manifest.json"
   },
-  "files": ["dist", "README.md"]
+  "files": [
+    "dist",
+    "README.md"
+  ]
 }