@envseal/protocol 0.1.0

package/dist/schemas.js

@@ -0,0 +1,205 @@
+import { z } from 'zod';
+export const ManifestEntry = z
+    .object({
+    key: z.string().regex(/^[A-Z][A-Z0-9_]{0,63}$/),
+    description: z.string().max(280),
+    required: z.boolean().default(true),
+    secret: z.boolean().default(true),
+    format: z
+        .object({
+        pattern: z.string().optional(),
+        minLength: z.number().int().optional(),
+        maxLength: z.number().int().optional(),
+        example: z.string().optional(),
+    })
+        .optional(),
+    provider: z
+        .object({
+        id: z.string(),
+        name: z.string(),
+        signupUrl: z.string().url().optional(),
+        docsUrl: z.string().url().optional(),
+        rotateUrl: z.string().url().optional(),
+        scopesNeeded: z.array(z.string()).optional(),
+    })
+        .optional(),
+    verify: z
+        .object({
+        method: z.enum(['GET', 'POST']),
+        url: z.string().url(),
+        headerTemplate: z.record(z.string()),
+        expectStatus: z.array(z.number().int()).default([200]),
+    })
+        .optional(),
+    sink: z
+        .enum(['dotenv', 'keychain', 'sops', 'onepassword', 'doppler', 'vault', 'external'])
+        .default('dotenv'),
+    rotation: z.object({ maxAgeDays: z.number().int() }).optional(),
+})
+    .strict()
+    .superRefine((entry, ctx) => {
+    if (!entry.verify) {
+        return;
+    }
+    if (!entry.verify.url.startsWith('https://')) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['verify', 'url'],
+            message: 'verify.url must start with https://',
+        });
+    }
+    if (entry.verify.url.includes('{{value}}')) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['verify', 'url'],
+            message: 'verify.url must not contain {{value}}',
+        });
+    }
+});
+export const Manifest = z
+    .object({
+    $schema: z.string().optional(),
+    version: z.literal(1),
+    entries: z.array(ManifestEntry).default([]),
+})
+    .strict();
+export const KeyStatus = z
+    .object({
+    key: z.string(),
+    declared: z.boolean(),
+    present: z.boolean(),
+    sink: z.string(),
+    // Nullable because "we have not validated THIS value" is a real state and
+    // must not be reported as true. env_describe deliberately does not
+    // re-evaluate a model-supplied format.pattern against a stored secret —
+    // doing so is a chosen-predicate oracle over the value.
+    formatValid: z.boolean().nullable(),
+    lengthBucket: z.string(),
+    fingerprint: z.string(),
+    lastVerified: z.string().nullable(),
+    verifyResult: z
+        .enum(['ok', 'auth_failed', 'forbidden', 'rate_limited', 'network_error', 'no_probe', 'probe_not_approved'])
+        .nullable(),
+    source: z.enum(['user-prompt', 'preexisting', 'ci', 'imported']),
+    rotationDue: z.string().nullable(),
+})
+    .strict();
+export const Ticket = z
+    .object({
+    ticket: z.string(),
+    nonce: z.string(),
+    surface: z.enum(['loopback-browser', 'native-dialog', 'ide', 'tty', 'none']),
+    expiresAt: z.string(),
+    userMessage: z.string(),
+})
+    .strict();
+export const TicketKeyOutcome = z.enum([
+    'stored',
+    'skipped',
+    'cancelled',
+    'invalid_format',
+    'verify_failed',
+    'timeout',
+]);
+export const TicketOutcome = z
+    .object({
+    ticket: z.string(),
+    state: z.enum(['pending', 'resolved', 'expired', 'cancelled']),
+    keys: z
+        .array(z
+        .object({
+        key: z.string(),
+        outcome: TicketKeyOutcome,
+    })
+        .strict())
+        .default([]),
+})
+    .strict();
+export const VerifyResult = z
+    .object({
+    key: z.string(),
+    result: z.enum(['ok', 'auth_failed', 'forbidden', 'rate_limited', 'network_error', 'no_probe', 'probe_not_approved']),
+    message: z.string(),
+    checkedAt: z.string(),
+})
+    .strict();
+export const ExecResult = z
+    .object({
+    exitCode: z.number().int().nullable(),
+    stdout: z.string(),
+    stderr: z.string(),
+    timedOut: z.boolean(),
+    redactedCount: z.number().int(),
+})
+    .strict();
+export const DeclareResult = z
+    .object({
+    added: z.array(z.string()).default([]),
+    updated: z.array(z.string()).default([]),
+    unchanged: z.array(z.string()).default([]),
+})
+    .strict();
+export const RevokeResult = z
+    .object({
+    key: z.string(),
+    removed: z.boolean(),
+    rotateUrl: z.string().nullable(),
+})
+    .strict();
+export const RevokeResults = z.array(RevokeResult);
+export const ManifestStatus = z
+    .object({
+    projectRoot: z.string(),
+    manifestPath: z.string().nullable(),
+    entries: z.array(KeyStatus),
+    missingRequired: z.array(z.string()).default([]),
+})
+    .strict();
+export const EnvDescribeInput = z
+    .object({
+    scope: z.string().optional(),
+})
+    .strict();
+export const EnvDeclareInput = z
+    .object({
+    entries: z.array(ManifestEntry).min(1),
+})
+    .strict();
+export const EnvRequestInput = z
+    .object({
+    keys: z.array(z.string()).min(1),
+    reason: z.string().min(1).max(280),
+})
+    .strict();
+export const EnvAwaitInput = z
+    .object({
+    ticket: z.string(),
+    timeoutMs: z.number().int().min(1000).max(120000).default(90000),
+})
+    .strict();
+export const EnvVerifyInput = z
+    .object({
+    keys: z.array(z.string()).min(1),
+})
+    .strict();
+export const EnvUseInput = z
+    .object({
+    keys: z.array(z.string()).min(1),
+    command: z.array(z.string()).min(1),
+})
+    .strict();
+export const EnvRevokeInput = z
+    .object({
+    keys: z.array(z.string()).min(1),
+})
+    .strict();
+export const INPUT_SCHEMAS = {
+    env_describe: EnvDescribeInput,
+    env_declare: EnvDeclareInput,
+    env_request: EnvRequestInput,
+    env_await: EnvAwaitInput,
+    env_verify: EnvVerifyInput,
+    env_use: EnvUseInput,
+    env_revoke: EnvRevokeInput,
+};
+//# sourceMappingURL=schemas.js.map

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@envseal/protocol",
+  "version": "0.1.0",
+  "type": "module",
+  "license": "Apache-2.0",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.map"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "dependencies": {
+    "zod": "^3.24.1"
+  },
+  "devDependencies": {
+    "tsx": "^4.19.2",
+    "zod-to-json-schema": "^3.24.1"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json && pnpm gen:schemas",
+    "gen:schemas": "tsx scripts/gen-schemas.ts",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
+}