@kya-os/cli 2.0.0 → 2.0.2

package/node_modules/@kya-os/contracts/dist/tool-protection/index.js

@@ -0,0 +1,499 @@
+"use strict";
+/**
+ * MCP-I Tool Protection Specification
+ *
+ * Core types for tool protection with delegation requirements.
+ *
+ * Consent Flow: type='none' → 2 screens, others → 3 screens (Auth→Consent→Success).
+ * DelegationCredential (VC) is created when user confirms on Consent Screen.
+ *
+ * @module @kya-os/contracts/tool-protection
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONSENT_PROVIDER_TYPES = exports.DelegationRequiredErrorDataSchema = exports.ToolProtectionResponseSchema = exports.ToolProtectionMapSchema = exports.ToolProtectionSchema = exports.AuthorizationRequirementSchema = exports.AuthRequiredError = exports.AuthRequiredErrorDataSchema = exports.AUTHORIZATION_TYPES = void 0;
+exports.isToolProtection = isToolProtection;
+exports.isToolProtectionMap = isToolProtectionMap;
+exports.isToolProtectionResponse = isToolProtectionResponse;
+exports.isDelegationRequiredErrorData = isDelegationRequiredErrorData;
+exports.isAuthorizationRequirement = isAuthorizationRequirement;
+exports.hasOAuthAuthorization = hasOAuthAuthorization;
+exports.hasPasswordAuthorization = hasPasswordAuthorization;
+exports.hasVerifiableCredentialAuthorization = hasVerifiableCredentialAuthorization;
+exports.hasApiKeyAuthorization = hasApiKeyAuthorization;
+exports.validateToolProtection = validateToolProtection;
+exports.validateToolProtectionMap = validateToolProtectionMap;
+exports.validateToolProtectionResponse = validateToolProtectionResponse;
+exports.validateDelegationRequiredErrorData = validateDelegationRequiredErrorData;
+exports.toolRequiresDelegation = toolRequiresDelegation;
+exports.getToolRequiredScopes = getToolRequiredScopes;
+exports.getToolRiskLevel = getToolRiskLevel;
+exports.createDelegationRequiredError = createDelegationRequiredError;
+exports.normalizeToolProtection = normalizeToolProtection;
+exports.determineConsentProviderType = determineConsentProviderType;
+exports.getAuthorizationTypeLabel = getAuthorizationTypeLabel;
+exports.getAuthorizationTypeKey = getAuthorizationTypeKey;
+exports.normalizeAuthorizationType = normalizeAuthorizationType;
+const zod_1 = require("zod");
+const schemas_1 = require("../vault/schemas");
+/** Canonical authorization type values for type safety */
+exports.AUTHORIZATION_TYPES = {
+    /** @deprecated Use OAUTH2 instead. Will be removed in v2.0.0. */
+    OAUTH: 'oauth',
+    /** OAuth 2.0 provider authentication (canonical) */
+    OAUTH2: 'oauth2',
+    PASSWORD: 'password',
+    MDL: 'mdl',
+    IDV: 'idv',
+    VERIFIABLE_CREDENTIAL: 'verifiable_credential',
+    /** WebAuthn/Passkey authentication */
+    WEBAUTHN: 'webauthn',
+    /** Sign-In with Ethereum (EIP-4361) */
+    SIWE: 'siwe',
+    /** API Key from per-user vault */
+    APIKEY: 'apikey',
+    NONE: 'none',
+};
+exports.AuthRequiredErrorDataSchema = zod_1.z.object({
+    error: zod_1.z.literal('auth_required'),
+    type: zod_1.z.enum(['apikey', 'oauth', 'credential']),
+    envVarNames: zod_1.z.array(zod_1.z.string()).optional(),
+    configUrl: zod_1.z.string(),
+    message: zod_1.z.string(),
+});
+/**
+ * Error class thrown when required auth is missing and no fallback exists.
+ *
+ * Caught by the tool-call handler in agent.ts and serialized as a
+ * machine-readable MCP tool result so clients can present actionable UI.
+ */
+class AuthRequiredError extends Error {
+    constructor(opts) {
+        const message = opts.message ??
+            (opts.type === 'apikey' && opts.envVarNames?.length
+                ? `API key required: configure ${opts.envVarNames.join(', ')} in your project settings.`
+                : 'Authentication required to use this tool.');
+        super(message);
+        this.name = 'AuthRequiredError';
+        this.type = opts.type;
+        this.envVarNames = opts.envVarNames;
+        this.configUrl = opts.configUrl;
+    }
+    /** Serialize to the wire format MCP clients expect */
+    toJSON() {
+        return {
+            error: 'auth_required',
+            type: this.type,
+            ...(this.envVarNames && { envVarNames: this.envVarNames }),
+            configUrl: this.configUrl,
+            message: this.message,
+        };
+    }
+}
+exports.AuthRequiredError = AuthRequiredError;
+/**
+ * Zod Schemas for Validation
+ */
+exports.AuthorizationRequirementSchema = zod_1.z.discriminatedUnion('type', [
+    // Deprecated: 'oauth' is an alias for 'oauth2'
+    // Will be removed in v2.0.0. Use 'oauth2' instead.
+    zod_1.z.object({
+        type: zod_1.z.literal('oauth'),
+        provider: zod_1.z.string(),
+        requiredScopes: zod_1.z.array(zod_1.z.string()).optional(),
+    }),
+    // OAuth 2.0 provider authentication (canonical)
+    zod_1.z.object({
+        type: zod_1.z.literal('oauth2'),
+        provider: zod_1.z.string(),
+        requiredScopes: zod_1.z.array(zod_1.z.string()).optional(),
+    }),
+    zod_1.z.object({
+        type: zod_1.z.literal('password'),
+        provider: zod_1.z.string(),
+    }),
+    zod_1.z.object({
+        type: zod_1.z.literal('mdl'),
+        issuer: zod_1.z.string(),
+        credentialType: zod_1.z.string().optional(),
+    }),
+    zod_1.z.object({
+        type: zod_1.z.literal('idv'),
+        provider: zod_1.z.string(),
+        verificationLevel: zod_1.z.enum(['basic', 'enhanced', 'loa3']).optional(),
+    }),
+    zod_1.z.object({
+        type: zod_1.z.literal('verifiable_credential'),
+        credentialType: zod_1.z.string(),
+        issuer: zod_1.z.string().optional(),
+    }),
+    // Deprecated: 'credential' is an alias for 'verifiable_credential'
+    // Will be removed in v2.0.0. Use 'verifiable_credential' instead.
+    zod_1.z.object({
+        type: zod_1.z.literal('credential'),
+        credentialType: zod_1.z.string(),
+        issuer: zod_1.z.string().optional(),
+    }),
+    // WebAuthn/Passkey authentication
+    zod_1.z.object({
+        type: zod_1.z.literal('webauthn'),
+        rpId: zod_1.z.string().optional(),
+        userVerification: zod_1.z.enum(['required', 'preferred', 'discouraged']).optional(),
+    }),
+    // Sign-In with Ethereum (EIP-4361)
+    zod_1.z.object({
+        type: zod_1.z.literal('siwe'),
+        chainId: zod_1.z.number().optional(),
+        domain: zod_1.z.string().optional(),
+    }),
+    // API Key from per-user vault
+    zod_1.z.object({
+        type: zod_1.z.literal('apikey'),
+        envVarNames: zod_1.z.array(schemas_1.envVarNameSchema).min(1),
+        headerMapping: zod_1.z.record(zod_1.z.string(), zod_1.z.string()),
+    }),
+    zod_1.z.object({
+        type: zod_1.z.literal('none'),
+    }),
+]);
+exports.ToolProtectionSchema = zod_1.z.object({
+    requiresDelegation: zod_1.z.boolean(),
+    requiredScopes: zod_1.z.array(zod_1.z.string()),
+    riskLevel: zod_1.z.enum(['low', 'medium', 'high', 'critical']).optional(),
+    oauthProvider: zod_1.z.string().optional(), // Phase 2: Tool-specific OAuth provider
+    authorization: exports.AuthorizationRequirementSchema.optional(),
+});
+exports.ToolProtectionMapSchema = zod_1.z.record(zod_1.z.string(), exports.ToolProtectionSchema);
+exports.ToolProtectionResponseSchema = zod_1.z.object({
+    toolProtections: exports.ToolProtectionMapSchema,
+    metadata: zod_1.z.object({
+        lastUpdated: zod_1.z.string().optional(),
+        version: zod_1.z.string().optional(),
+        source: zod_1.z.string().optional()
+    }).optional()
+});
+exports.DelegationRequiredErrorDataSchema = zod_1.z.object({
+    toolName: zod_1.z.string(),
+    requiredScopes: zod_1.z.array(zod_1.z.string()),
+    consentUrl: zod_1.z.string().optional(),
+    authorizationUrl: zod_1.z.string().optional(),
+    reason: zod_1.z.string().optional()
+});
+/**
+ * Type Guards
+ */
+function isToolProtection(obj) {
+    return exports.ToolProtectionSchema.safeParse(obj).success;
+}
+function isToolProtectionMap(obj) {
+    return exports.ToolProtectionMapSchema.safeParse(obj).success;
+}
+function isToolProtectionResponse(obj) {
+    return exports.ToolProtectionResponseSchema.safeParse(obj).success;
+}
+function isDelegationRequiredErrorData(obj) {
+    return exports.DelegationRequiredErrorDataSchema.safeParse(obj).success;
+}
+/**
+ * Type guard to check if an object is a valid AuthorizationRequirement
+ */
+function isAuthorizationRequirement(obj) {
+    return exports.AuthorizationRequirementSchema.safeParse(obj).success;
+}
+/**
+ * Type guard to check if a ToolProtection has OAuth authorization
+ * Checks for both 'oauth' (deprecated) and 'oauth2' (canonical)
+ */
+function hasOAuthAuthorization(protection) {
+    return protection.authorization?.type === 'oauth' || protection.authorization?.type === 'oauth2';
+}
+/**
+ * Type guard to check if a ToolProtection has password authorization
+ */
+function hasPasswordAuthorization(protection) {
+    return protection.authorization?.type === 'password';
+}
+/**
+ * Type guard to check if a ToolProtection requires a Verifiable Credential
+ *
+ * Note: Also returns true for deprecated 'credential' type (normalized to verifiable_credential)
+ */
+function hasVerifiableCredentialAuthorization(protection) {
+    return (protection.authorization?.type === 'verifiable_credential' ||
+        protection.authorization?.type === 'credential');
+}
+/**
+ * Type guard to check if a ToolProtection has API Key (vault) authorization
+ */
+function hasApiKeyAuthorization(protection) {
+    return protection.authorization?.type === 'apikey';
+}
+/**
+ * Validation Functions
+ */
+function validateToolProtection(obj) {
+    return exports.ToolProtectionSchema.parse(obj);
+}
+function validateToolProtectionMap(obj) {
+    return exports.ToolProtectionMapSchema.parse(obj);
+}
+function validateToolProtectionResponse(obj) {
+    return exports.ToolProtectionResponseSchema.parse(obj);
+}
+function validateDelegationRequiredErrorData(obj) {
+    return exports.DelegationRequiredErrorDataSchema.parse(obj);
+}
+/**
+ * Utility Functions
+ */
+/**
+ * Check if a tool requires delegation
+ */
+function toolRequiresDelegation(toolName, protections) {
+    const protection = protections[toolName];
+    return protection?.requiresDelegation ?? false;
+}
+/**
+ * Get required scopes for a tool
+ */
+function getToolRequiredScopes(toolName, protections) {
+    const protection = protections[toolName];
+    return protection?.requiredScopes ?? [];
+}
+/**
+ * Get risk level for a tool
+ */
+function getToolRiskLevel(toolName, protections) {
+    return protections[toolName]?.riskLevel;
+}
+/**
+ * Create a delegation required error
+ */
+function createDelegationRequiredError(toolName, requiredScopes, consentUrl) {
+    return {
+        toolName,
+        requiredScopes,
+        consentUrl,
+        authorizationUrl: consentUrl // Include both for compatibility
+    };
+}
+/**
+ * Normalize tool protection configuration
+ * Migrates legacy oauthProvider field to authorization object
+ *
+ * - Migrates `oauthProvider` → `authorization: { type: 'oauth', provider: ... }`
+ * - Ensures `authorization` field is present when `requiresDelegation=true`
+ * - Returns fully normalized ToolProtection object
+ *
+ * @param raw - Raw tool protection data (may have legacy fields or be partial)
+ * @returns Normalized ToolProtection object
+ *
+ * // TODO: Remove normalizeToolProtection() when all tools migrated (target: Phase 3)
+ */
+function normalizeToolProtection(raw) {
+    // Ensure we have required fields (provide defaults for partial input)
+    const normalized = {
+        requiresDelegation: raw.requiresDelegation ?? false,
+        requiredScopes: raw.requiredScopes ?? [],
+        ...(raw.riskLevel && { riskLevel: raw.riskLevel }),
+        ...(raw.oauthProvider && { oauthProvider: raw.oauthProvider }),
+    };
+    // If authorization is already present, use it
+    if (raw.authorization) {
+        normalized.authorization = raw.authorization;
+        return normalized;
+    }
+    // Migrate oauthProvider to authorization
+    if (raw.oauthProvider) {
+        normalized.authorization = {
+            type: 'oauth',
+            provider: raw.oauthProvider,
+        };
+        // Keep oauthProvider for backward compatibility until Phase 3
+        return normalized;
+    }
+    // Default for requiresDelegation=true without specific auth: type='none' (consent only)
+    // But ONLY if authorization is missing entirely
+    if (normalized.requiresDelegation && !normalized.authorization && !normalized.oauthProvider) {
+        // We don't automatically set type='none' here to allow
+        // ProviderResolver to do its scope inference fallback logic.
+        // The fallback logic will eventually be moved into an AuthorizationService.
+        return normalized;
+    }
+    return normalized;
+}
+// =============================================================================
+// CONSENT PROVIDER TYPES - Records what auth method was USED (not required)
+// =============================================================================
+/** Consent provider types - stored in delegation metadata to track auth method used */
+exports.CONSENT_PROVIDER_TYPES = {
+    /** Consent-only mode - no authentication, just clickwrap agreement */
+    NONE: 'none',
+    /** OAuth2 provider authentication */
+    OAUTH2: 'oauth2',
+    /** Password-based authentication (email/password, username/password) */
+    PASSWORD: 'password',
+    /** @deprecated Use PASSWORD instead. Alias for backward compatibility */
+    CREDENTIAL: 'credential',
+    /** Email magic link authentication */
+    MAGIC_LINK: 'magic_link',
+    /** One-time password (SMS/email code) */
+    OTP: 'otp',
+};
+/**
+ * Determine consent provider type based on available identity information
+ *
+ * This is the single source of truth for consent provider type determination.
+ *
+ * @param hasOAuthIdentity - Whether OAuth identity is available
+ * @param isPasswordFlow - Whether this is a password/credential flow
+ * @param isMagicLinkFlow - Whether this is a magic link flow
+ * @param isOtpFlow - Whether this is an OTP flow
+ * @returns The consent provider type
+ */
+function determineConsentProviderType(hasOAuthIdentity, isPasswordFlow = false, isMagicLinkFlow = false, isOtpFlow = false) {
+    if (isPasswordFlow) {
+        return exports.CONSENT_PROVIDER_TYPES.PASSWORD;
+    }
+    if (isMagicLinkFlow) {
+        return exports.CONSENT_PROVIDER_TYPES.MAGIC_LINK;
+    }
+    if (isOtpFlow) {
+        return exports.CONSENT_PROVIDER_TYPES.OTP;
+    }
+    if (hasOAuthIdentity) {
+        return exports.CONSENT_PROVIDER_TYPES.OAUTH2;
+    }
+    return exports.CONSENT_PROVIDER_TYPES.NONE;
+}
+/**
+ * Get a human-readable label for an authorization requirement type
+ */
+function getAuthorizationTypeLabel(auth) {
+    switch (auth.type) {
+        case 'oauth':
+        case 'oauth2':
+            return auth.provider
+                ? auth.provider.charAt(0).toUpperCase() + auth.provider.slice(1)
+                : 'OAuth Provider';
+        case 'password':
+            return 'Password Authentication';
+        case 'mdl':
+            return "Mobile Driver's License";
+        case 'idv':
+            return 'Identity Verification';
+        case 'verifiable_credential':
+            return auth.credentialType || 'Verifiable Credential';
+        case 'credential':
+            // Deprecated: treat as verifiable_credential
+            return auth.credentialType || 'Verifiable Credential';
+        case 'webauthn':
+            return 'Passkey / WebAuthn';
+        case 'siwe':
+            return 'Sign-In with Ethereum';
+        case 'apikey':
+            return 'API Key (Vault)';
+        case 'none':
+            return 'Consent Only';
+        default:
+            // TypeScript exhaustiveness check
+            const _exhaustive = auth;
+            return 'Unknown';
+    }
+}
+/**
+ * Get a unique key for an authorization requirement (for React keys, caching, etc.)
+ */
+function getAuthorizationTypeKey(auth) {
+    switch (auth.type) {
+        case 'oauth':
+            // Keep original key format for backward compatibility with existing cache entries
+            // Handle undefined provider gracefully (may come from loose API response types)
+            return auth.provider ? `oauth:${auth.provider}` : 'oauth';
+        case 'oauth2':
+            return auth.provider ? `oauth2:${auth.provider}` : 'oauth2';
+        case 'password':
+            return auth.provider ? `password:${auth.provider}` : 'password';
+        case 'mdl':
+            // Keep trailing colon for backward compatibility with existing cache entries
+            return `mdl:${auth.issuer || 'unknown'}:${auth.credentialType || ''}`;
+        case 'idv':
+            // Keep trailing colon for backward compatibility with existing cache entries
+            return `idv:${auth.provider || 'unknown'}:${auth.verificationLevel || ''}`;
+        case 'verifiable_credential':
+            return `vc:${auth.issuer || 'any'}:${auth.credentialType || 'unknown'}`;
+        case 'credential':
+            // Deprecated: treat as verifiable_credential
+            return `vc:${auth.issuer || 'any'}:${auth.credentialType || 'unknown'}`;
+        case 'webauthn':
+            return `webauthn:${auth.rpId || 'default'}`;
+        case 'siwe':
+            return `siwe:${auth.chainId || 1}:${auth.domain || 'any'}`;
+        case 'apikey':
+            return `apikey:${[...auth.envVarNames].sort().join(',')}`;
+        case 'none':
+            return 'none';
+        default:
+            // TypeScript exhaustiveness check
+            const _exhaustive = auth;
+            return 'unknown';
+    }
+}
+/**
+ * Normalize authorization requirement type
+ *
+ * Normalizes deprecated types to their canonical equivalents:
+ * - 'oauth' → 'oauth2'
+ * - 'credential' → 'verifiable_credential'
+ *
+ * This function should be called at runtime boundaries when processing
+ * authorization requirements.
+ *
+ * @param auth - Authorization requirement (may contain deprecated types)
+ * @param options - Normalization options
+ * @returns Normalized authorization requirement
+ *
+ * @example
+ * ```typescript
+ * const normalized = normalizeAuthorizationType(
+ *   { type: 'oauth', provider: 'github' },
+ *   { warn: true }
+ * );
+ * // Returns: { type: 'oauth2', provider: 'github' }
+ * // Logs: DEPRECATION warning
+ * ```
+ */
+function normalizeAuthorizationType(auth, options = {}) {
+    const { warn = true, logger = console.warn } = options;
+    // Normalize 'oauth' to 'oauth2'
+    if (auth.type === 'oauth') {
+        if (warn) {
+            logger(`DEPRECATION: Authorization type 'oauth' is deprecated and will be removed in v2.0.0. ` +
+                `Please update to 'oauth2'. ` +
+                `See https://github.com/modelcontextprotocol-identity/xmcp-i/blob/main/docs/migrations/oauth-to-oauth2.md`);
+        }
+        // Normalize to oauth2
+        const normalized = {
+            type: 'oauth2',
+            provider: auth.provider,
+            ...(auth.requiredScopes !== undefined && { requiredScopes: auth.requiredScopes }),
+        };
+        return normalized;
+    }
+    // Normalize 'credential' to 'verifiable_credential'
+    if (auth.type === 'credential') {
+        if (warn) {
+            logger(`DEPRECATION: Authorization type 'credential' is deprecated and will be removed in v2.0.0. ` +
+                `Please update to 'verifiable_credential'. ` +
+                `See https://github.com/modelcontextprotocol-identity/xmcp-i/blob/main/docs/migrations/credential-to-verifiable_credential.md`);
+        }
+        // Normalize to verifiable_credential
+        const normalized = {
+            type: 'verifiable_credential',
+            credentialType: auth.credentialType,
+            ...(auth.issuer !== undefined && { issuer: auth.issuer }),
+        };
+        return normalized;
+    }
+    // No normalization needed
+    return auth;
+}

package/node_modules/@kya-os/contracts/dist/utils/validation.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Shared validation utilities for mcpi packages
+ * Consolidates common validation patterns to follow DRY principles
+ */
+import { z } from "zod";
+/**
+ * Generic validation result type
+ */
+export interface ValidationResult<T = any> {
+    valid: boolean;
+    data?: T;
+    errors: string[];
+}
+/**
+ * Generic validation function with helpful error messages
+ */
+export declare function validateInput<T>(schema: z.ZodSchema<T>, data: unknown, context?: string): ValidationResult<T>;
+/**
+ * Validate object has required properties
+ */
+export declare function hasRequiredProperties(obj: any, properties: string[], context?: string): ValidationResult;
+/**
+ * Validate string format patterns
+ */
+export declare const StringValidators: {
+    did: (value: string) => boolean;
+    kid: (value: string) => boolean;
+    url: (value: string) => boolean;
+    projectName: (value: string) => boolean;
+};

package/node_modules/@kya-os/contracts/dist/utils/validation.js

@@ -0,0 +1,69 @@
+"use strict";
+/**
+ * Shared validation utilities for mcpi packages
+ * Consolidates common validation patterns to follow DRY principles
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StringValidators = void 0;
+exports.validateInput = validateInput;
+exports.hasRequiredProperties = hasRequiredProperties;
+/**
+ * Generic validation function with helpful error messages
+ */
+function validateInput(schema, data, context) {
+    const result = schema.safeParse(data);
+    if (result.success) {
+        return {
+            valid: true,
+            data: result.data,
+            errors: [],
+        };
+    }
+    const errors = result.error.errors.map((err) => {
+        const path = err.path.length > 0 ? ` at ${err.path.join(".")}` : "";
+        const contextStr = context ? ` (${context})` : "";
+        return `${err.message}${path}${contextStr}`;
+    });
+    return {
+        valid: false,
+        errors,
+    };
+}
+/**
+ * Validate object has required properties
+ */
+function hasRequiredProperties(obj, properties, context) {
+    if (typeof obj !== "object" || obj === null) {
+        return {
+            valid: false,
+            errors: [`Expected object${context ? ` for ${context}` : ""}`],
+        };
+    }
+    const missing = properties.filter((prop) => !(prop in obj));
+    if (missing.length > 0) {
+        return {
+            valid: false,
+            errors: [
+                `Missing required properties: ${missing.join(", ")}${context ? ` in ${context}` : ""}`,
+            ],
+        };
+    }
+    return { valid: true, errors: [] };
+}
+/**
+ * Validate string format patterns
+ */
+exports.StringValidators = {
+    did: (value) => /^did:[a-z0-9]+:[a-zA-Z0-9._-]+$/.test(value),
+    kid: (value) => /^[a-zA-Z0-9._-]+$/.test(value),
+    url: (value) => {
+        try {
+            new URL(value);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    projectName: (value) => /^[a-z0-9-]+$/.test(value) && value.length >= 1 && value.length <= 214,
+};

package/node_modules/@kya-os/contracts/dist/vault/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Vault Contracts
+ *
+ * Shared schemas, types, and audit events for the per-user API key vault.
+ *
+ * @module @kya-os/contracts/vault
+ */
+export { ENV_VAR_PATTERN, envVarNameSchema, upsertSecretSchema, resolveSecretsRequestSchema, resolveSecretsResponseSchema } from './schemas';
+export type { UpsertSecretInput, ResolveSecretsRequest, ResolveSecretsResponse } from './types';

package/node_modules/@kya-os/contracts/dist/vault/index.js

@@ -0,0 +1,16 @@
+"use strict";
+/**
+ * Vault Contracts
+ *
+ * Shared schemas, types, and audit events for the per-user API key vault.
+ *
+ * @module @kya-os/contracts/vault
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSecretsResponseSchema = exports.resolveSecretsRequestSchema = exports.upsertSecretSchema = exports.envVarNameSchema = exports.ENV_VAR_PATTERN = void 0;
+var schemas_1 = require("./schemas");
+Object.defineProperty(exports, "ENV_VAR_PATTERN", { enumerable: true, get: function () { return schemas_1.ENV_VAR_PATTERN; } });
+Object.defineProperty(exports, "envVarNameSchema", { enumerable: true, get: function () { return schemas_1.envVarNameSchema; } });
+Object.defineProperty(exports, "upsertSecretSchema", { enumerable: true, get: function () { return schemas_1.upsertSecretSchema; } });
+Object.defineProperty(exports, "resolveSecretsRequestSchema", { enumerable: true, get: function () { return schemas_1.resolveSecretsRequestSchema; } });
+Object.defineProperty(exports, "resolveSecretsResponseSchema", { enumerable: true, get: function () { return schemas_1.resolveSecretsResponseSchema; } });