@griffin-app/griffin-ts 0.1.14 → 0.1.15

package/src/secrets.test.ts

@@ -3,46 +3,32 @@ import { secret, isSecretRef } from "./secrets.js";
 
 describe("Secret References", () => {
   describe("Basic Secret Creation", () => {
-    it("should create environment variable secret", () => {
-      const ref = secret("env:API_KEY");
+    it("should create secret with ref only", () => {
+      const ref = secret("API_KEY");
 
       expect(ref).toEqual({
         $secret: {
-          provider: "env",
           ref: "API_KEY",
         },
       });
     });
 
-    it("should create AWS Secrets Manager secret", () => {
-      const ref = secret("aws:prod/api-key");
+    it("should create secret with alphanumeric and underscore", () => {
+      const ref = secret("my_secret_123");
 
       expect(ref).toEqual({
         $secret: {
-          provider: "aws",
-          ref: "prod/api-key",
+          ref: "my_secret_123",
         },
       });
     });
 
-    it("should create Vault secret", () => {
-      const ref = secret("vault:secret/data/api");
+    it("should trim ref", () => {
+      const ref = secret("  API_KEY  ");
 
       expect(ref).toEqual({
         $secret: {
-          provider: "vault",
-          ref: "secret/data/api",
-        },
-      });
-    });
-
-    it("should create Doppler secret", () => {
-      const ref = secret("doppler:backend/prod/API_KEY");
-
-      expect(ref).toEqual({
-        $secret: {
-          provider: "doppler",
-          ref: "backend/prod/API_KEY",
+          ref: "API_KEY",
         },
       });
     });
@@ -50,39 +36,36 @@ describe("Secret References", () => {
 
   describe("Secret Options", () => {
     it("should include version when specified", () => {
-      const ref = secret("aws:prod/api-key", { version: "v1.2.3" });
+      const ref = secret("prod_api_key", { version: "v1.2.3" });
 
       expect(ref).toEqual({
         $secret: {
-          provider: "aws",
-          ref: "prod/api-key",
+          ref: "prod_api_key",
           version: "v1.2.3",
         },
       });
     });
 
     it("should include field when specified", () => {
-      const ref = secret("aws:prod/db-credentials", { field: "password" });
+      const ref = secret("db_credentials", { field: "password" });
 
       expect(ref).toEqual({
         $secret: {
-          provider: "aws",
-          ref: "prod/db-credentials",
+          ref: "db_credentials",
           field: "password",
         },
       });
     });
 
     it("should include both version and field", () => {
-      const ref = secret("aws:prod/db-credentials", {
+      const ref = secret("db_credentials", {
         version: "latest",
         field: "username",
       });
 
       expect(ref).toEqual({
         $secret: {
-          provider: "aws",
-          ref: "prod/db-credentials",
+          ref: "db_credentials",
           version: "latest",
           field: "username",
         },
@@ -90,83 +73,65 @@ describe("Secret References", () => {
     });
   });
 
-  describe("Provider Formats", () => {
-    it("should handle various provider names", () => {
-      expect(secret("custom:my-secret")).toEqual({
-        $secret: { provider: "custom", ref: "my-secret" },
-      });
-
-      expect(secret("gcp:my-secret")).toEqual({
-        $secret: { provider: "gcp", ref: "my-secret" },
+  describe("Valid Names", () => {
+    it("should accept names starting with letter", () => {
+      expect(secret("API_KEY")).toEqual({
+        $secret: { ref: "API_KEY" },
       });
-
-      expect(secret("azure:my-secret")).toEqual({
-        $secret: { provider: "azure", ref: "my-secret" },
+      expect(secret("DatabasePassword")).toEqual({
+        $secret: { ref: "DatabasePassword" },
       });
     });
 
-    it("should handle refs with multiple slashes", () => {
-      const ref = secret("aws:path/to/nested/secret");
-
-      expect(ref).toEqual({
-        $secret: {
-          provider: "aws",
-          ref: "path/to/nested/secret",
-        },
+    it("should accept names starting with underscore", () => {
+      expect(secret("_private_key")).toEqual({
+        $secret: { ref: "_private_key" },
       });
     });
 
-    it("should handle refs with special characters", () => {
-      const ref = secret("env:API_KEY_123");
-
-      expect(ref).toEqual({
-        $secret: {
-          provider: "env",
-          ref: "API_KEY_123",
-        },
+    it("should accept alphanumeric and underscores", () => {
+      expect(secret("API_KEY_123")).toEqual({
+        $secret: { ref: "API_KEY_123" },
       });
     });
+  });
 
-    it("should handle refs with hyphens and underscores", () => {
-      const ref = secret("aws:prod/my-api_key-v2");
+  describe("Error Handling", () => {
+    it("should throw error when ref is empty", () => {
+      expect(() => secret("")).toThrow("Secret ref cannot be empty");
+    });
 
-      expect(ref).toEqual({
-        $secret: {
-          provider: "aws",
-          ref: "prod/my-api_key-v2",
-        },
-      });
+    it("should throw error when ref is only whitespace", () => {
+      expect(() => secret("   ")).toThrow("Secret ref cannot be empty");
     });
-  });
 
-  describe("Error Handling", () => {
-    it("should throw error when missing colon", () => {
-      expect(() => secret("no-colon-here")).toThrow(
-        'Secret path must include provider: "provider:path"',
+    it("should throw error when ref starts with number", () => {
+      expect(() => secret("123_KEY")).toThrow(
+        "Secret ref must start with a letter or underscore",
       );
     });
 
-    it("should throw error when provider is empty", () => {
-      expect(() => secret(":my-secret")).toThrow(
-        "Secret path must have a provider name before the colon",
+    it("should throw error when ref contains hyphen", () => {
+      expect(() => secret("api-key")).toThrow(
+        "Secret ref must start with a letter or underscore",
       );
     });
 
-    it("should throw error when ref is empty", () => {
-      expect(() => secret("aws:")).toThrow(
-        "Secret path must have a reference after the colon",
+    it("should throw error when ref contains special characters", () => {
+      expect(() => secret("api.key")).toThrow(
+        "Secret ref must start with a letter or underscore",
       );
     });
   });
 
   describe("Type Guard", () => {
     it("should identify valid secret refs", () => {
-      const ref = secret("env:API_KEY");
+      const ref = secret("API_KEY");
       expect(isSecretRef(ref)).toBe(true);
     });
 
     it("should identify secret refs with options", () => {
-      const ref = secret("aws:key", { version: "v1", field: "password" });
+      const ref = secret("key", { version: "v1", field: "password" });
       expect(isSecretRef(ref)).toBe(true);
     });
 
@@ -187,27 +152,16 @@ describe("Secret References", () => {
       expect(isSecretRef({ $secret: null })).toBe(false);
       expect(isSecretRef({ $secret: "string" })).toBe(false);
       expect(isSecretRef({ $secret: {} })).toBe(false);
-      expect(isSecretRef({ $secret: { provider: "aws" } })).toBe(false);
-      expect(isSecretRef({ $secret: { ref: "key" } })).toBe(false);
+      expect(isSecretRef({ $secret: { ref: "key" } })).toBe(true); // valid - only ref required
     });
 
     it("should accept valid $secret structure", () => {
+      expect(isSecretRef({ $secret: { ref: "key" } })).toBe(true);
+      expect(isSecretRef({ $secret: { ref: "VAR", version: "v1" } })).toBe(
+        true,
+      );
       expect(
-        isSecretRef({
-          $secret: { provider: "aws", ref: "key" },
-        }),
-      ).toBe(true);
-
-      expect(
-        isSecretRef({
-          $secret: { provider: "env", ref: "VAR", version: "v1" },
-        }),
-      ).toBe(true);
-
-      expect(
-        isSecretRef({
-          $secret: { provider: "vault", ref: "path", field: "password" },
-        }),
+        isSecretRef({ $secret: { ref: "path", field: "password" } }),
       ).toBe(true);
     });
   });
@@ -215,31 +169,30 @@ describe("Secret References", () => {
   describe("Integration Examples", () => {
     it("should work in header configurations", () => {
       const headers = {
-        Authorization: secret("env:API_TOKEN"),
-        "X-API-Key": secret("aws:prod/api-key"),
+        Authorization: secret("API_TOKEN"),
+        "X-API-Key": secret("API_KEY"),
       };
 
       expect(headers["Authorization"]).toEqual({
-        $secret: { provider: "env", ref: "API_TOKEN" },
+        $secret: { ref: "API_TOKEN" },
       });
       expect(headers["X-API-Key"]).toEqual({
-        $secret: { provider: "aws", ref: "prod/api-key" },
+        $secret: { ref: "API_KEY" },
       });
     });
 
     it("should work in body configurations", () => {
       const body = {
-        apiKey: secret("env:API_KEY"),
-        dbPassword: secret("aws:prod/db-password", { field: "password" }),
+        apiKey: secret("API_KEY"),
+        dbPassword: secret("db_credentials", { field: "password" }),
       };
 
       expect(body.apiKey).toEqual({
-        $secret: { provider: "env", ref: "API_KEY" },
+        $secret: { ref: "API_KEY" },
       });
       expect(body.dbPassword).toEqual({
         $secret: {
-          provider: "aws",
-          ref: "prod/db-password",
+          ref: "db_credentials",
           field: "password",
         },
       });
@@ -250,49 +203,17 @@ describe("Secret References", () => {
         database: {
           host: "localhost",
           credentials: {
-            username: secret("vault:db/username"),
-            password: secret("vault:db/password"),
+            username: secret("db_username"),
+            password: secret("db_password"),
           },
         },
       };
 
       expect(config.database.credentials.username).toEqual({
-        $secret: { provider: "vault", ref: "db/username" },
+        $secret: { ref: "db_username" },
       });
       expect(config.database.credentials.password).toEqual({
-        $secret: { provider: "vault", ref: "db/password" },
-      });
-    });
-  });
-
-  describe("Real-world Provider Examples", () => {
-    it("should handle AWS Secrets Manager paths", () => {
-      expect(secret("aws:production/api/key")).toEqual({
-        $secret: { provider: "aws", ref: "production/api/key" },
-      });
-
-      expect(secret("aws:prod/rds/credentials")).toEqual({
-        $secret: { provider: "aws", ref: "prod/rds/credentials" },
-      });
-    });
-
-    it("should handle HashiCorp Vault paths", () => {
-      expect(secret("vault:secret/data/api")).toEqual({
-        $secret: { provider: "vault", ref: "secret/data/api" },
-      });
-
-      expect(secret("vault:kv/prod/database")).toEqual({
-        $secret: { provider: "vault", ref: "kv/prod/database" },
-      });
-    });
-
-    it("should handle environment variables", () => {
-      expect(secret("env:DATABASE_URL")).toEqual({
-        $secret: { provider: "env", ref: "DATABASE_URL" },
-      });
-
-      expect(secret("env:API_KEY")).toEqual({
-        $secret: { provider: "env", ref: "API_KEY" },
+        $secret: { ref: "db_password" },
       });
     });
   });

package/src/secrets.ts

@@ -7,15 +7,12 @@ export interface SecretOptions {
   field?: string;
 }
 
+const SECRET_REF_REGEX = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
 /**
  * Create a secret reference for use in endpoint headers or body.
  *
- * @param path - Provider-qualified path in format "provider:path"
- *   Examples:
- *   - "env:API_KEY" - Environment variable
- *   - "aws:prod/api-key" - AWS Secrets Manager
- *   - "vault:secret/data/api" - HashiCorp Vault
- *   - "doppler:backend/prod/API_KEY" - Doppler
+ * @param ref - Secret name (alphanumeric and underscore only)
  *
  * @param options - Optional version pinning or field extraction
  *
@@ -25,40 +22,26 @@ export interface SecretOptions {
  *   method: GET,
  *   path: "/api/data",
  *   headers: {
- *     "Authorization": secret("aws:prod/api-key"),
- *     "X-API-Key": secret("env:LOCAL_API_KEY"),
+ *     "Authorization": secret("API_KEY"),
+ *     "X-API-Key": secret("LOCAL_API_KEY"),
  *   },
  * })
  * ```
  */
-export function secret(path: string, options?: SecretOptions): SecretRef {
-  const colonIndex = path.indexOf(":");
-
-  if (colonIndex === -1) {
-    throw new Error(
-      `Secret path must include provider: "provider:path" (e.g., "aws:my-secret", "env:API_KEY"). Got: "${path}"`,
-    );
-  }
-
-  if (colonIndex === 0) {
-    throw new Error(
-      `Secret path must have a provider name before the colon. Got: "${path}"`,
-    );
+export function secret(ref: string, options?: SecretOptions): SecretRef {
+  const trimmed = ref.trim();
+  if (!trimmed.length) {
+    throw new Error("Secret ref cannot be empty");
   }
-
-  if (colonIndex === path.length - 1) {
+  if (!SECRET_REF_REGEX.test(trimmed)) {
     throw new Error(
-      `Secret path must have a reference after the colon. Got: "${path}"`,
+      `Secret ref must start with a letter or underscore and contain only letters, numbers, and underscores. Got: "${ref}"`,
     );
   }
 
-  const provider = path.slice(0, colonIndex);
-  const ref = path.slice(colonIndex + 1);
-
   return {
     $secret: {
-      provider,
-      ref,
+      ref: trimmed,
       ...(options?.version !== undefined && { version: options.version }),
       ...(options?.field !== undefined && { field: options.field }),
     },
@@ -83,10 +66,7 @@ export function isSecretRef(value: unknown): value is SecretRef {
   }
 
   const secretData = obj.$secret as Record<string, unknown>;
-  return (
-    typeof secretData.provider === "string" &&
-    typeof secretData.ref === "string"
-  );
+  return typeof secretData.ref === "string";
 }
 
 /**

package/src/sequential-builder.test.ts

@@ -399,17 +399,14 @@ describe("Sequential Test Builder", () => {
           base: "http://localhost:3000",
           response_format: "JSON",
           headers: {
-            Authorization: secret("env:API_TOKEN"),
+            Authorization: secret("API_TOKEN"),
           },
         })
         .build();
 
       const endpoint = monitor.nodes[0] as any;
       expect(endpoint.headers.Authorization).toEqual({
-        $secret: {
-          provider: "env",
-          ref: "API_TOKEN",
-        },
+        $secret: { ref: "API_TOKEN" },
       });
     });
 
@@ -424,17 +421,14 @@ describe("Sequential Test Builder", () => {
           base: "http://localhost:3000",
           response_format: "JSON",
           body: {
-            apiKey: secret("aws:prod/api-key"),
+            apiKey: secret("API_KEY"),
           },
         })
         .build();
 
       const endpoint = monitor.nodes[0] as any;
       expect(endpoint.body.apiKey).toEqual({
-        $secret: {
-          provider: "aws",
-          ref: "prod/api-key",
-        },
+        $secret: { ref: "API_KEY" },
       });
     });