@envseal/sdk 0.1.3 → 0.1.5

package/dist/confirm.d.ts

@@ -26,6 +26,8 @@ import type { Prompter } from '@envseal/prompters';
  */
 /** Value-entry key name carrying the `env_use` confirmation. */
 export declare const CONFIRM_KEY_USE = "APPROVE";
+/** Value-entry key name carrying the `env_revoke` confirmation. */
+export declare const CONFIRM_KEY_REVOKE = "APPROVE_REVOKE";
 /** Value-entry key name carrying the `env_verify` probe-consent question. */
 export declare const CONFIRM_KEY_PROBE = "APPROVE_PROBE";
 export interface ConfirmSurface {
@@ -46,6 +48,7 @@ export declare function useConfirmationBody(info: {
     networkEgress: boolean;
     target?: TargetInfo;
 }, projectRoot: string): string;
+export declare function revokeConfirmationBody(keys: string[], projectRoot: string): string;
 export declare function probeConfirmationBody(entry: ManifestEntry): string | null;
 /**
  * `onConfirm` for the Broker: gates `env_use`.
@@ -56,6 +59,13 @@ export declare function probeConfirmationBody(entry: ManifestEntry): string | nu
  * or for a silence — the defect this project already fixed once in the CLI.
  */
 export declare function createUseConfirm(surface: ConfirmSurface): NonNullable<BrokerOptions['onConfirm']>;
+/**
+ * `onRevokeConfirm` for the Broker: gates `env_revoke`.
+ *
+ * Same ask/outcome mapping as createUseConfirm. Throws rather than returning
+ * false when no human could be asked or when the ask expired unanswered.
+ */
+export declare function createRevokeConfirm(surface: ConfirmSurface): NonNullable<BrokerOptions['onRevokeConfirm']>;
 /**
  * `onApprovalNeeded` for the Broker: PLAN.md §6.4 probe consent for
  * `env_verify` against a host that is not registry-allowlisted.

package/dist/confirm.js

@@ -1,5 +1,5 @@
 import { randomBytes } from 'node:crypto';
-import { useConfirmationBody as sharedUseConfirmationBody, escapeForDisplay as coreEscapeForDisplay, displayArg as coreDisplayArg, } from '@envseal/core';
+import { useConfirmationBody as sharedUseConfirmationBody, revokeConfirmationBody as sharedRevokeConfirmationBody, escapeForDisplay as coreEscapeForDisplay, displayArg as coreDisplayArg, } from '@envseal/core';
 import { SepError, zero } from '@envseal/protocol';
 import { makeDisplayNonce } from '@envseal/prompters';
 /**
@@ -27,6 +27,8 @@ import { makeDisplayNonce } from '@envseal/prompters';
  */
 /** Value-entry key name carrying the `env_use` confirmation. */
 export const CONFIRM_KEY_USE = 'APPROVE';
+/** Value-entry key name carrying the `env_revoke` confirmation. */
+export const CONFIRM_KEY_REVOKE = 'APPROVE_REVOKE';
 /** Value-entry key name carrying the `env_verify` probe-consent question. */
 export const CONFIRM_KEY_PROBE = 'APPROVE_PROBE';
 const DEFAULT_TIMEOUT_MS = 120_000;
@@ -46,6 +48,9 @@ export const displayArg = coreDisplayArg;
 export function useConfirmationBody(info, projectRoot) {
     return sharedUseConfirmationBody(info, projectRoot);
 }
+export function revokeConfirmationBody(keys, projectRoot) {
+    return sharedRevokeConfirmationBody(keys, projectRoot);
+}
 export function probeConfirmationBody(entry) {
     const probe = entry.verify;
     if (!probe) {
@@ -160,6 +165,50 @@ export function createUseConfirm(surface) {
         }
     };
 }
+/**
+ * `onRevokeConfirm` for the Broker: gates `env_revoke`.
+ *
+ * Same ask/outcome mapping as createUseConfirm. Throws rather than returning
+ * false when no human could be asked or when the ask expired unanswered.
+ */
+export function createRevokeConfirm(surface) {
+    return async (keys) => {
+        const outcome = await ask(surface, CONFIRM_KEY_REVOKE, 'Approve removing stored credentials? Nothing has been removed yet.', revokeConfirmationBody(keys, surface.projectRoot));
+        switch (outcome) {
+            case 'approved':
+                return true;
+            case 'denied':
+                return false;
+            case 'timed-out':
+                throw new SepError({
+                    code: 'SEP_TICKET_EXPIRED',
+                    userMessage: 'The env_revoke confirmation closed after its timeout with nobody answering it. Nothing was ' +
+                        'removed. This is not a denial: ask the user to approve it, then call env_revoke again.',
+                });
+            case 'no-surface':
+                throw new SepError({
+                    code: 'SEP_NO_INTERACTIVE_SURFACE',
+                    userMessage: 'env_revoke needs the user to confirm before stored credentials are removed, ' +
+                        'but there is no interactive surface here to ask on (this is what CI looks like to envseal). ' +
+                        'Nothing was removed. ' +
+                        'There is no flag or environment variable that skips this prompt in this binding: the request ' +
+                        'came from a model, and the confirmation is the only control on it. ' +
+                        'Run `envseal revoke` yourself in a session that has a browser or a terminal.',
+                });
+            case 'busy':
+                throw new SepError({
+                    code: 'SEP_RATE_LIMITED',
+                    userMessage: 'Another envseal confirmation is already open. Answer that one first, then call env_revoke again.',
+                });
+            case 'too-large':
+                throw new SepError({
+                    code: 'SEP_FORMAT_INVALID',
+                    userMessage: 'This revoke request is too large to display in a confirmation dialog, and envseal will not ask ' +
+                        'anyone to approve something it cannot show them. Revoke fewer keys at once.',
+                });
+        }
+    };
+}
 /**
  * `onApprovalNeeded` for the Broker: PLAN.md §6.4 probe consent for
  * `env_verify` against a host that is not registry-allowlisted.
@@ -172,7 +221,7 @@ export function createUseConfirm(surface) {
  */
 export function createProbeApproval(surface) {
     return async (entry) => {
-        const outcome = await ask(surface, CONFIRM_KEY_PROBE, `Approve sending ${entry.key} to a host that is not on envseal's allowlist? Nothing has been sent yet.`, probeConfirmationBody(entry));
+        const outcome = await ask(surface, CONFIRM_KEY_PROBE, `Approve sending ${escapeForDisplay(entry.key)} to a host that is not on envseal's allowlist? Nothing has been sent yet.`, probeConfirmationBody(entry));
         return outcome === 'approved';
     };
 }

package/dist/index.d.ts

@@ -12,6 +12,6 @@ export type Dialect = 'openai' | 'anthropic' | 'gemini';
 export declare function toolsFor(dialect: Dialect): unknown[];
 export declare function dispatch(broker: Broker, name: string, args: unknown): Promise<unknown>;
 export { SEP_TOOL_NAMES } from '@envseal/protocol';
-export { createUseConfirm, createProbeApproval, annotateVerifyResults, CONFIRM_KEY_USE, CONFIRM_KEY_PROBE, } from './confirm.js';
+export { createUseConfirm, createRevokeConfirm, createProbeApproval, annotateVerifyResults, CONFIRM_KEY_USE, CONFIRM_KEY_REVOKE, CONFIRM_KEY_PROBE, } from './confirm.js';
 export type { ConfirmSurface } from './confirm.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -3,7 +3,7 @@ import { Broker } from '@envseal/core';
 import { selectPrompter } from '@envseal/prompters';
 import { SEP_TOOL_NAMES, INPUT_SCHEMAS, isSepError, } from '@envseal/protocol';
 import { zodToJsonSchema } from 'zod-to-json-schema';
-import { annotateVerifyResults, createProbeApproval, createUseConfirm } from './confirm.js';
+import { annotateVerifyResults, createProbeApproval, createRevokeConfirm, createUseConfirm } from './confirm.js';
 export function createBroker(opts) {
     const root = opts?.root ?? findProjectRoot(process.cwd());
     // Resolved lazily and memoised: `selectPrompter()` is async and this factory
@@ -25,6 +25,7 @@ export function createBroker(opts) {
         // reports the absent callback as SEP_CONFIRMATION_DENIED — blaming a user
         // who was never asked. See confirm.ts.
         onConfirm: createUseConfirm(surface),
+        onRevokeConfirm: createRevokeConfirm(surface),
         onApprovalNeeded: createProbeApproval(surface),
     };
     return new Broker(brokerOpts);
@@ -71,7 +72,7 @@ const TOOL_DESCRIPTIONS = {
         'It will NOT print the secrets to you, will NOT export them into your own environment, and refuses to ' +
         'run without explicit user confirmation. ' +
         'To check whether a key exists instead of running a command, call env_describe.',
-    env_revoke: 'Removes stored credentials. Records in the audit log and emits the provider ' +
+    env_revoke: 'Removes stored credentials after user confirmation. Records in the audit log and emits the provider ' +
         'rotation URL so you can help the user invalidate the old key.',
 };
 export function toolsFor(dialect) {
@@ -219,5 +220,5 @@ export async function dispatch(broker, name, args) {
     }
 }
 export { SEP_TOOL_NAMES } from '@envseal/protocol';
-export { createUseConfirm, createProbeApproval, annotateVerifyResults, CONFIRM_KEY_USE, CONFIRM_KEY_PROBE, } from './confirm.js';
+export { createUseConfirm, createRevokeConfirm, createProbeApproval, annotateVerifyResults, CONFIRM_KEY_USE, CONFIRM_KEY_REVOKE, CONFIRM_KEY_PROBE, } from './confirm.js';
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envseal/sdk",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "type": "module",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
@@ -21,10 +21,10 @@
   },
   "dependencies": {
     "zod-to-json-schema": "^3.24.1",
-    "@envseal/protocol": "0.1.3",
-    "@envseal/core": "0.1.3",
-    "@envseal/registry": "0.1.3",
-    "@envseal/prompters": "0.1.3"
+    "@envseal/protocol": "0.1.5",
+    "@envseal/core": "0.1.5",
+    "@envseal/registry": "0.1.5",
+    "@envseal/prompters": "0.1.5"
   },
   "devDependencies": {
     "vitest": "^2.1.8"