@danypops/vehicle-core 0.12.5 → 0.13.0

package/dist/vehicle-contract.d.ts

@@ -4,6 +4,17 @@ export type JsonValue = JsonPrimitive | readonly JsonValue[] | {
     readonly [key: string]: JsonValue;
 };
 export type JsonSchema = Readonly<Record<string, JsonValue>>;
+/** Shared defense-in-depth vocabulary for credential-shaped fields at every Vehicle projection boundary. */
+export declare const VEHICLE_CREDENTIAL_FIELD_NAMES: readonly ["password", "token", "accessToken", "refreshToken", "apiKey", "secret", "authorization", "credential"];
+/** Case/separator-insensitive credential-name check used as a fallback when a schema annotation is missing. */
+export declare function isVehicleCredentialFieldName(name: string): boolean;
+/**
+ * JSON Schema property annotation consumed by human-facing Vehicle adapters.
+ * `omit` hides the field; `summarize` may show shape/size but never its value.
+ * Standard `writeOnly: true` and `format: "password"` always imply omission.
+ */
+export declare const VEHICLE_SCHEMA_PRESENTATION_EXTENSION: "x-vehicle-presentation";
+export type VehicleSchemaPresentation = "omit" | "summarize";
 export interface VehicleSchemaIssue {
     readonly path: readonly (string | number)[];
     readonly message: string;

package/dist/vehicle-contract.js

@@ -1,3 +1,25 @@
+/** Shared defense-in-depth vocabulary for credential-shaped fields at every Vehicle projection boundary. */
+export const VEHICLE_CREDENTIAL_FIELD_NAMES = Object.freeze([
+    "password",
+    "token",
+    "accessToken",
+    "refreshToken",
+    "apiKey",
+    "secret",
+    "authorization",
+    "credential",
+]);
+const NORMALIZED_VEHICLE_CREDENTIAL_FIELD_NAMES = new Set(VEHICLE_CREDENTIAL_FIELD_NAMES.map((name) => name.replace(/[^a-z0-9]/gi, "").toLowerCase()));
+/** Case/separator-insensitive credential-name check used as a fallback when a schema annotation is missing. */
+export function isVehicleCredentialFieldName(name) {
+    return NORMALIZED_VEHICLE_CREDENTIAL_FIELD_NAMES.has(name.replace(/[^a-z0-9]/gi, "").toLowerCase());
+}
+/**
+ * JSON Schema property annotation consumed by human-facing Vehicle adapters.
+ * `omit` hides the field; `summarize` may show shape/size but never its value.
+ * Standard `writeOnly: true` and `format: "password"` always imply omission.
+ */
+export const VEHICLE_SCHEMA_PRESENTATION_EXTENSION = "x-vehicle-presentation";
 export function defineVehicleSchema(codec) {
     return Object.freeze({
         jsonSchema: cloneJson(codec.jsonSchema),

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@danypops/vehicle-core",
-	"version": "0.12.5",
+	"version": "0.13.0",
 	"description": "Vehicle's runtime-neutral wire contract: operation descriptors, schema codecs, failure shapes. Zero runtime dependencies, zero Bun-specific code -- the one thing every Vehicle client and server package depends on.",
 	"license": "MIT",
 	"type": "module",

package/src/vehicle-contract.ts

@@ -4,6 +4,35 @@ export type JsonPrimitive = string | number | boolean | null;
 export type JsonValue = JsonPrimitive | readonly JsonValue[] | { readonly [key: string]: JsonValue };
 export type JsonSchema = Readonly<Record<string, JsonValue>>;
 
+/** Shared defense-in-depth vocabulary for credential-shaped fields at every Vehicle projection boundary. */
+export const VEHICLE_CREDENTIAL_FIELD_NAMES = Object.freeze([
+	"password",
+	"token",
+	"accessToken",
+	"refreshToken",
+	"apiKey",
+	"secret",
+	"authorization",
+	"credential",
+] as const);
+
+const NORMALIZED_VEHICLE_CREDENTIAL_FIELD_NAMES = new Set(
+	VEHICLE_CREDENTIAL_FIELD_NAMES.map((name) => name.replace(/[^a-z0-9]/gi, "").toLowerCase()),
+);
+
+/** Case/separator-insensitive credential-name check used as a fallback when a schema annotation is missing. */
+export function isVehicleCredentialFieldName(name: string): boolean {
+	return NORMALIZED_VEHICLE_CREDENTIAL_FIELD_NAMES.has(name.replace(/[^a-z0-9]/gi, "").toLowerCase());
+}
+
+/**
+ * JSON Schema property annotation consumed by human-facing Vehicle adapters.
+ * `omit` hides the field; `summarize` may show shape/size but never its value.
+ * Standard `writeOnly: true` and `format: "password"` always imply omission.
+ */
+export const VEHICLE_SCHEMA_PRESENTATION_EXTENSION = "x-vehicle-presentation" as const;
+export type VehicleSchemaPresentation = "omit" | "summarize";
+
 export interface VehicleSchemaIssue {
 	readonly path: readonly (string | number)[];
 	readonly message: string;