@ninedeploy/schemas 0.2.7 → 0.3.0

package/dist/ninedeployManifest.js

@@ -0,0 +1,284 @@
+import { z } from 'zod';
+import { envVarName, httpPath, repoBaseDir, slug } from './common.js';
+/**
+ * `.ninedeploy` manifest schema — project-side declarative config for how
+ * NineDeploy should build, run and route a service. Committed to the repo,
+ * so it must NEVER carry secrets, tokens or connection strings; the loader
+ * enforces that with a regex scan (see apps/server/src/lib/secretScan.ts).
+ *
+ * Merge precedence at apply time: panel/DB > manifest > auto-detect. The
+ * manifest fills empty panel fields; an operator who explicitly set something
+ * in the panel wins.
+ */
+// ── Runtime ────────────────────────────────────────────────────────────────
+export const runtimeType = z.enum([
+    'auto',
+    'node',
+    'python',
+    'go',
+    'ruby',
+    'php',
+    'java',
+    'rust',
+    'static',
+]);
+export const runtime = z
+    .object({
+    type: runtimeType.default('auto'),
+    /**
+     * Pinned language version. Format `<major>` or `<major>.<minor>` or
+     * `<major>.<minor>.<patch>`. For example `20`, `20.18`, `3.12`.
+     */
+    version: z
+        .string()
+        .regex(/^\d+(?:\.\d+){0,2}$/, 'must be a numeric version like 20 or 3.12')
+        .max(20)
+        .optional(),
+})
+    .strict();
+// ── Build ──────────────────────────────────────────────────────────────────
+export const build = z
+    .object({
+    install: z.string().min(1).max(500).optional(),
+    build: z.string().min(1).max(500).optional(),
+    start: z.string().min(1).max(500).optional(),
+    baseDir: repoBaseDir.optional(),
+    dockerfile: z.string().min(1).max(200).optional(),
+})
+    .strict();
+// ── Run ────────────────────────────────────────────────────────────────────
+export const restartPolicy = z
+    .union([
+    z.enum(['no', 'always', 'unless-stopped']),
+    z
+        .string()
+        .regex(/^on-failure(?::[1-9]\d{0,2})?$/, 'must be on-failure or on-failure:N (1-999, no leading zero)'),
+])
+    .optional();
+export const run = z
+    .object({
+    port: z.number().int().min(1).max(65535).optional(),
+    healthcheck: httpPath.optional(),
+    restart: restartPolicy,
+})
+    .strict();
+// ── Static ─────────────────────────────────────────────────────────────────
+const noTraversalSegments = (value) => !value.split('/').some((segment) => segment === '..' || segment === '.');
+const isRelativePath = (value) => !value.startsWith('/');
+export const staticConfig = z
+    .object({
+    spa: z.boolean().default(false),
+    root: z
+        .string()
+        .min(1)
+        .max(200)
+        .regex(/^[A-Za-z0-9._/-]+$/, 'must be a relative path with allowed characters')
+        .refine(noTraversalSegments, { message: 'path must not contain . or .. segments' })
+        .refine(isRelativePath, { message: 'path must be relative (no leading "/")' })
+        .optional(),
+})
+    .strict();
+// ── Env ────────────────────────────────────────────────────────────────────
+export const env = z
+    .object({
+    /** Required env var names. Values stay in the panel's env vault. */
+    required: z.array(envVarName.max(100)).max(100).default([]),
+    /** Managed-DB attach alias: env-key → attachment-env-key. */
+    aliases: z.record(z.string(), envVarName).optional(),
+})
+    .strict();
+// ── Phases (Nixpacks ince ayar) ────────────────────────────────────────────
+export const phases = z
+    .object({
+    setup: z
+        .object({
+        pkgs: z.array(z.string().min(1).max(100)).max(50).default([]),
+    })
+        .strict()
+        .optional(),
+    build: z
+        .object({
+        cmds: z.array(z.string().min(1).max(500)).max(20).default([]),
+    })
+        .strict()
+        .optional(),
+})
+    .strict();
+// ── Resources ──────────────────────────────────────────────────────────────
+export const resources = z
+    .object({
+    cpuShares: z.number().int().min(0).max(262144).optional(),
+    memMb: z.number().int().min(0).max(1_048_576).optional(),
+})
+    .strict();
+// ── Hooks ──────────────────────────────────────────────────────────────────
+export const hooks = z
+    .object({
+    preBuild: z.string().min(1).max(500).optional(),
+    postBuild: z.string().min(1).max(500).optional(),
+    preStop: z.string().min(1).max(500).optional(),
+})
+    .strict();
+// ── Watch (monorepo) ──────────────────────────────────────────────────────
+export const watch = z
+    .object({
+    paths: z.array(z.string().min(1).max(200)).max(50).default([]),
+})
+    .strict();
+// ── Routes ─────────────────────────────────────────────────────────────────
+export const rateLimit = z
+    .object({
+    average: z.number().int().min(0).max(100_000),
+    burst: z.number().int().min(0).max(100_000),
+})
+    .strict();
+export const route = z
+    .object({
+    host: z
+        .string()
+        .min(3)
+        .max(253)
+        .regex(/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)(?:\.(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?))*$/, 'must be a valid hostname'),
+    path: z
+        .string()
+        .min(1)
+        .max(200)
+        .regex(/^\/.*$/, 'must start with "/"')
+        .default('/'),
+    ssl: z.boolean().default(true),
+    redirectWww: z.boolean().optional(),
+    headers: z.record(z.string().min(1).max(200), z.string().min(1).max(2000)).optional(),
+    ipAllowlist: z
+        .array(z
+        .string()
+        .min(1)
+        .max(64)
+        .regex(/^[\d./]+$/, 'must be a CIDR like 1.2.3.4/32'))
+        .max(50)
+        .optional(),
+    rateLimit: rateLimit.optional(),
+})
+    .strict();
+// ── Previews ──────────────────────────────────────────────────────────────
+export const previews = z
+    .object({
+    enabled: z.boolean().default(false),
+    /**
+     * Hostname template. `{n}` is replaced by the PR number. Example:
+     * `pr-{n}.previews.example.com`. Must contain `{n}` when enabled.
+     */
+    pattern: z
+        .string()
+        .min(1)
+        .max(200)
+        .regex(/^[A-Za-z0-9._/{}*-]+$/, 'must be a hostname template (letters, digits, dot, dash, underscore, slash, brace, asterisk)')
+        .refine(noTraversalSegments, { message: 'pattern must not contain . or .. segments' })
+        .optional(),
+    maxActive: z.number().int().min(1).max(50).default(5),
+    autoDestroyOnClose: z.boolean().default(true),
+})
+    .strict()
+    .refine((p) => !p.enabled || (p.pattern != null && p.pattern.includes('{n}')), {
+    message: 'previews.pattern must contain {n} when previews.enabled is true',
+    path: ['pattern'],
+});
+// ── Volume ────────────────────────────────────────────────────────────────
+export const volumeBackups = z
+    .object({
+    schedule: z
+        .string()
+        .min(1)
+        .max(100)
+        .regex(/^[\d*\/,\-A-Za-z\s]+$/, 'must look like a cron expression (digits, *, /, comma, dash, letters, space)'),
+    retention: z.number().int().min(1).max(365).default(7),
+})
+    .strict();
+export const volume = z
+    .object({
+    mount: z
+        .string()
+        .min(1)
+        .max(200)
+        .regex(/^[A-Za-z0-9._/-]+$/, 'must be a path inside the container')
+        .refine(noTraversalSegments, { message: 'mount must not contain . or .. segments' })
+        .optional(),
+    backups: volumeBackups.optional(),
+})
+    .strict();
+// ── Database (managed DB attach hint) ─────────────────────────────────────
+export const database = z
+    .object({
+    ref: slug,
+    env: envVarName,
+})
+    .strict();
+// ── Network ───────────────────────────────────────────────────────────────
+export const network = z
+    .object({
+    publishPort: z.number().int().min(1).max(65535).optional(),
+    aliases: z.array(z.string().min(1).max(100).regex(/^[A-Za-z0-9._-]+$/)).max(20).default([]),
+})
+    .strict();
+// ── Notifications (channel-name references) ──────────────────────────────
+export const notifications = z
+    .object({
+    onDeploy: z.array(z.string().min(1).max(100)).max(20).default([]),
+    onFailure: z.array(z.string().min(1).max(100)).max(20).default([]),
+    onAlert: z.array(z.string().min(1).max(100)).max(20).default([]),
+})
+    .strict();
+// ── Alerts ────────────────────────────────────────────────────────────────
+export const alertWhen = z.enum([
+    'deployFailed',
+    'restartLoop',
+    'highMemory',
+    'highCpu',
+    'certExpiry',
+]);
+export const alert = z
+    .object({
+    when: alertWhen,
+    channel: z.string().min(1).max(100),
+    thresholdPct: z.number().int().min(1).max(100).optional(),
+})
+    .strict()
+    .refine((a) => a.when !== 'highMemory' && a.when !== 'highCpu' ? true : a.thresholdPct != null, {
+    message: 'thresholdPct is required for highMemory/highCpu alerts',
+    path: ['thresholdPct'],
+});
+// ── Top-level manifest ────────────────────────────────────────────────────
+export const ninedeployManifest = z
+    .object({
+    version: z.literal('1'),
+    runtime: runtime.optional(),
+    build: build.optional(),
+    run: run.optional(),
+    static: staticConfig.optional(),
+    env: env.optional(),
+    phases: phases.optional(),
+    resources: resources.optional(),
+    hooks: hooks.optional(),
+    watch: watch.optional(),
+    routes: z.array(route).max(50).optional(),
+    previews: previews.optional(),
+    volume: volume.optional(),
+    database: database.optional(),
+    network: network.optional(),
+    notifications: notifications.optional(),
+    alerts: z.array(alert).max(20).optional(),
+})
+    .strict();
+/**
+ * The list of filenames the loader checks, in priority order. The first one
+ * found in the repo root is used.
+ */
+export const NINEDEPLOY_MANIFEST_FILENAMES = [
+    '.ninedeploy',
+    '.ninedeploy.yml',
+    '.ninedeploy.yaml',
+    'ninedeploy.yml',
+    'ninedeploy.yaml',
+];
+/** Maximum allowed size of a `.ninedeploy` file (bytes). Larger files are refused. */
+export const NINEDEPLOY_MANIFEST_MAX_BYTES = 16 * 1024;
+//# sourceMappingURL=ninedeployManifest.js.map

package/dist/ninedeployManifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ninedeployManifest.js","sourceRoot":"","sources":["../src/ninedeployManifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEtE;;;;;;;;;GASG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,MAAM;IACN,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;CACT,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC;KACrB,MAAM,CAAC;IACN,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;IACjC;;;OAGG;IACH,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,KAAK,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;SACzE,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC5C,OAAO,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,KAAK,CAAC;IACL,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC1C,CAAC;SACE,MAAM,EAAE;SACR,KAAK,CACJ,gCAAgC,EAChC,6DAA6D,CAC9D;CACJ,CAAC;KACD,QAAQ,EAAE,CAAC;AAId,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC;KACjB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IACnD,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,aAAa;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAW,EAAE,CACrD,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC;AAE3E,MAAM,cAAc,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAE1E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/B,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,oBAAoB,EAAE,iDAAiD,CAAC;SAC9E,MAAM,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;SAClF,MAAM,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;SAC7E,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC;KACjB,MAAM,CAAC;IACN,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3D,6DAA6D;IAC7D,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC9D,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC9D,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IACzD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE;CACzD,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,6EAA6E;AAC7E,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/D,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,8EAA8E;AAC9E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CACJ,0HAA0H,EAC1H,0BAA0B,CAC3B;IACH,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,QAAQ,EAAE,qBAAqB,CAAC;SACtC,OAAO,CAAC,GAAG,CAAC;IACf,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrF,WAAW,EAAE,CAAC;SACX,KAAK,CACJ,CAAC;SACE,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,KAAK,CAAC,WAAW,EAAE,gCAAgC,CAAC,CACxD;SACA,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;IACb,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE;CAChC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,6EAA6E;AAC7E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC;KACtB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC;;;OAGG;IACH,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CACJ,uBAAuB,EACvB,8FAA8F,CAC/F;SACA,MAAM,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;SACrF,QAAQ,EAAE;IACb,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC9C,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE;IAC7E,OAAO,EAAE,iEAAiE;IAC1E,IAAI,EAAE,CAAC,SAAS,CAAC;CAClB,CAAC,CAAC;AAGL,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CACJ,uBAAuB,EACvB,8EAA8E,CAC/E;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACvD,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,oBAAoB,EAAE,qCAAqC,CAAC;SAClE,MAAM,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;SACnF,QAAQ,EAAE;IACb,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,6EAA6E;AAC7E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC;KACtB,MAAM,CAAC;IACN,GAAG,EAAE,IAAI;IACT,GAAG,EAAE,UAAU;CAChB,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,6EAA6E;AAC7E,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC;KACrB,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IAC1D,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC5F,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,4EAA4E;AAC5E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACjE,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,6EAA6E;AAC7E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC;IAC9B,cAAc;IACd,aAAa;IACb,YAAY;IACZ,SAAS;IACT,YAAY;CACb,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,IAAI,EACjF;IACE,OAAO,EAAE,wDAAwD;IACjE,IAAI,EAAE,CAAC,cAAc,CAAC;CACvB,CACF,CAAC;AAGJ,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE;IACvB,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;IACnB,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;IACnB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;IACzB,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE;IACvB,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;IACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,aAAa,EAAE,aAAa,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,aAAa;IACb,iBAAiB;IACjB,kBAAkB;IAClB,gBAAgB;IAChB,iBAAiB;CACT,CAAC;AAGX,sFAAsF;AACtF,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,IAAI,CAAC"}

package/dist/project.d.ts

@@ -7,8 +7,8 @@ import { z } from 'zod';
 export declare const createProject: z.ZodObject<{
     name: z.ZodString;
     slug: z.ZodOptional<z.ZodString>;
-    description: z.ZodOptional<z.ZodString>;
-    workspaceId: z.ZodOptional<z.ZodNumber>;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    workspaceId: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
 }, z.core.$strip>;
 export type CreateProject = z.infer<typeof createProject>;
 export type CreateProjectInput = CreateProject;
@@ -23,6 +23,8 @@ export type ProjectPatchInput = ProjectPatch;
 export interface ProjectEntry {
     id: number;
     workspaceId?: number | null;
+    /** Display name of the owning workspace. Resolved server-side. */
+    workspaceName?: string | null;
     name: string;
     slug: string;
     description: string | null;

package/dist/project.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;GAIG;AAEH,eAAO,MAAM,aAAa;;;;;iBAKxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAC1D,MAAM,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAE/C,eAAO,MAAM,YAAY;;;;iBAMoD,CAAC;AAC9E,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACxD,MAAM,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAE7C,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB"}
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;GAIG;AAEH,eAAO,MAAM,aAAa;;;;;iBAKxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAC1D,MAAM,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAE/C,eAAO,MAAM,YAAY;;;;iBAMoD,CAAC;AAC9E,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACxD,MAAM,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAE7C,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/project.js

@@ -8,8 +8,8 @@ import { slug } from './common.js';
 export const createProject = z.object({
     name: z.string().trim().min(2).max(63),
     slug: slug.optional(),
-    description: z.string().trim().max(500).optional(),
-    workspaceId: z.number().int().positive().optional(),
+    description: z.string().trim().max(500).nullable().optional(),
+    workspaceId: z.number().int().positive().nullable().optional(),
 });
 export const projectPatch = z
     .object({

package/dist/project.js.map

@@ -1 +1 @@
-{"version":3,"file":"project.js","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC;;;;GAIG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC/D,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC"}
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC;;;;GAIG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC/D,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC/D,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC"}

package/dist/secretScan.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Secret-pattern scanner for `.ninedeploy` manifests.
+ *
+ * The manifest is committed to the repo, so it must NEVER carry real
+ * credentials, tokens or connection strings. This module is a defensive net:
+ * patterns are matched against the raw text, and any hit fails the load.
+ *
+ * The list is intentionally explicit (named patterns) rather than a generic
+ * entropy heuristic — false positives are user-hostile (legitimate values
+ * that look credential-like should pass). Every regex is also bounded to
+ * avoid runaway matching on long inputs.
+ *
+ * Lives in `@ninedeploy/schemas` (not in `@ninedeploy/server`) because the
+ * CLI also needs to run the scan in `ninedeploy manifest validate`. Anything
+ * that loads a manifest — server, CLI, future MCP tool — should reuse this.
+ */
+/** A single rule: a human-readable name plus a regex that MUST match the
+ *  *beginning* of a credential — anchoring left keeps the regex from firing
+ *  on substrings inside longer strings. */
+export interface SecretPattern {
+    readonly id: string;
+    readonly description: string;
+    readonly regex: RegExp;
+}
+export declare const SECRET_PATTERNS: ReadonlyArray<SecretPattern>;
+/** A single secret-pattern hit in scanned text. */
+export interface SecretHit {
+    patternId: string;
+    description: string;
+    /** Index in the original text where the match starts. */
+    start: number;
+    /** Index in the original text where the match ends. */
+    end: number;
+    /** A redacted preview of the matched text (first 4 chars + … + last 2). */
+    redacted: string;
+}
+/**
+ * Run every secret pattern across `text` and return every hit.
+ *
+ * The scan is non-overlapping and bounded — each regex is `\b`-anchored or
+ * scheme-anchored, so a single credential can never span more than one match.
+ */
+export declare function scanForSecrets(text: string): SecretHit[];
+/** Returns true if the text contains anything that looks like a secret. */
+export declare function hasSecret(text: string): boolean;
+/**
+ * Replace the middle of a string with `…` for safe logging. Keeps the first
+ * 4 and last 2 characters when the input is long enough; otherwise just
+ * emits `<redacted:N>` so the length is still visible.
+ */
+export declare function redact(value: string): string;
+//# sourceMappingURL=secretScan.d.ts.map

package/dist/secretScan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretScan.d.ts","sourceRoot":"","sources":["../src/secretScan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;2CAE2C;AAC3C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,aAAa,CAkExD,CAAC;AAEF,mDAAmD;AACnD,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,CAmBxD;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAG5C"}

package/dist/secretScan.js

@@ -0,0 +1,125 @@
+/**
+ * Secret-pattern scanner for `.ninedeploy` manifests.
+ *
+ * The manifest is committed to the repo, so it must NEVER carry real
+ * credentials, tokens or connection strings. This module is a defensive net:
+ * patterns are matched against the raw text, and any hit fails the load.
+ *
+ * The list is intentionally explicit (named patterns) rather than a generic
+ * entropy heuristic — false positives are user-hostile (legitimate values
+ * that look credential-like should pass). Every regex is also bounded to
+ * avoid runaway matching on long inputs.
+ *
+ * Lives in `@ninedeploy/schemas` (not in `@ninedeploy/server`) because the
+ * CLI also needs to run the scan in `ninedeploy manifest validate`. Anything
+ * that loads a manifest — server, CLI, future MCP tool — should reuse this.
+ */
+export const SECRET_PATTERNS = [
+    {
+        id: 'aws-access-key',
+        description: 'AWS access key id (AKIA…)',
+        regex: /AKIA[0-9A-Z]{16}\b/,
+    },
+    {
+        id: 'github-pat-classic',
+        description: 'GitHub personal access token (ghp_…)',
+        regex: /\bghp_[A-Za-z0-9]{36}\b/,
+    },
+    {
+        id: 'github-pat-fine-grained',
+        description: 'GitHub fine-grained PAT (github_pat_…)',
+        regex: /\bgithub_pat_[A-Za-z0-9_]{82}\b/,
+    },
+    {
+        id: 'gitlab-pat',
+        description: 'GitLab personal access token (glpat-…)',
+        regex: /\bglpat-[A-Za-z0-9_-]{20,}\b/,
+    },
+    {
+        id: 'slack-token',
+        description: 'Slack token (xox[baprs]-…)',
+        regex: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/,
+    },
+    {
+        id: 'stripe-live-secret',
+        description: 'Stripe live secret key (sk_live_…)',
+        regex: /\bsk_live_[A-Za-z0-9]{24,}\b/,
+    },
+    {
+        id: 'stripe-live-restricted',
+        description: 'Stripe live restricted key (rk_live_…)',
+        regex: /\brk_live_[A-Za-z0-9]{24,}\b/,
+    },
+    {
+        id: 'openai-secret',
+        description: 'OpenAI API key (sk-…)',
+        regex: /\bsk-[A-Za-z0-9]{48,}\b/,
+    },
+    {
+        id: 'anthropic-key',
+        description: 'Anthropic API key (sk-ant-…)',
+        regex: /\bsk-ant-[A-Za-z0-9_-]{40,}\b/,
+    },
+    {
+        id: 'discord-webhook',
+        description: 'Discord webhook URL (discord…/api/webhooks/…)',
+        regex: /https?:\/\/(?:[A-Za-z0-9-]+\.)?discord(?:app)?\.com\/api\/webhooks\/\d+\/[A-Za-z0-9_-]+/,
+    },
+    {
+        id: 'database-url-credentials',
+        description: 'Database URL with embedded credentials (scheme://user:pass@…)',
+        regex: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqps?|mssql):\/\/[^\s:@'"]+:[^\s@'"]{3,}@/i,
+    },
+    {
+        id: 'private-key',
+        description: 'PEM private key block',
+        regex: /-----BEGIN [A-Z ]+PRIVATE KEY-----/,
+    },
+    {
+        id: 'jwt-bearer',
+        description: 'Bearer JWT in a literal value',
+        regex: /\bBearer\s+eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/,
+    },
+];
+/**
+ * Run every secret pattern across `text` and return every hit.
+ *
+ * The scan is non-overlapping and bounded — each regex is `\b`-anchored or
+ * scheme-anchored, so a single credential can never span more than one match.
+ */
+export function scanForSecrets(text) {
+    const hits = [];
+    for (const pattern of SECRET_PATTERNS) {
+        // Reset stateful `g` regexes (defensive — none of ours use `g` today).
+        pattern.regex.lastIndex = 0;
+        const match = pattern.regex.exec(text);
+        if (!match || match.index === undefined)
+            continue;
+        const start = match.index;
+        const end = start + match[0].length;
+        hits.push({
+            patternId: pattern.id,
+            description: pattern.description,
+            start,
+            end,
+            redacted: redact(match[0]),
+        });
+    }
+    // Sort by start position so the redacted-log line reads in document order.
+    return hits.sort((a, b) => a.start - b.start);
+}
+/** Returns true if the text contains anything that looks like a secret. */
+export function hasSecret(text) {
+    return scanForSecrets(text).length > 0;
+}
+/**
+ * Replace the middle of a string with `…` for safe logging. Keeps the first
+ * 4 and last 2 characters when the input is long enough; otherwise just
+ * emits `<redacted:N>` so the length is still visible.
+ */
+export function redact(value) {
+    if (value.length <= 8)
+        return `<redacted:${value.length}>`;
+    return `${value.slice(0, 4)}…${value.slice(-2)} (len=${value.length})`;
+}
+//# sourceMappingURL=secretScan.js.map

package/dist/secretScan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretScan.js","sourceRoot":"","sources":["../src/secretScan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAWH,MAAM,CAAC,MAAM,eAAe,GAAiC;IAC3D;QACE,EAAE,EAAE,gBAAgB;QACpB,WAAW,EAAE,2BAA2B;QACxC,KAAK,EAAE,oBAAoB;KAC5B;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,WAAW,EAAE,sCAAsC;QACnD,KAAK,EAAE,yBAAyB;KACjC;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,WAAW,EAAE,wCAAwC;QACrD,KAAK,EAAE,iCAAiC;KACzC;IACD;QACE,EAAE,EAAE,YAAY;QAChB,WAAW,EAAE,wCAAwC;QACrD,KAAK,EAAE,8BAA8B;KACtC;IACD;QACE,EAAE,EAAE,aAAa;QACjB,WAAW,EAAE,4BAA4B;QACzC,KAAK,EAAE,kCAAkC;KAC1C;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,WAAW,EAAE,oCAAoC;QACjD,KAAK,EAAE,8BAA8B;KACtC;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,wCAAwC;QACrD,KAAK,EAAE,8BAA8B;KACtC;IACD;QACE,EAAE,EAAE,eAAe;QACnB,WAAW,EAAE,uBAAuB;QACpC,KAAK,EAAE,yBAAyB;KACjC;IACD;QACE,EAAE,EAAE,eAAe;QACnB,WAAW,EAAE,8BAA8B;QAC3C,KAAK,EAAE,+BAA+B;KACvC;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,+CAA+C;QAC5D,KAAK,EAAE,yFAAyF;KACjG;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,WAAW,EAAE,+DAA+D;QAC5E,KAAK,EAAE,gGAAgG;KACxG;IACD;QACE,EAAE,EAAE,aAAa;QACjB,WAAW,EAAE,uBAAuB;QACpC,KAAK,EAAE,oCAAoC;KAC5C;IACD;QACE,EAAE,EAAE,YAAY;QAChB,WAAW,EAAE,+BAA+B;QAC5C,KAAK,EAAE,4EAA4E;KACpF;CACF,CAAC;AAcF;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,uEAAuE;QACvE,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,SAAS;QAClD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC1B,MAAM,GAAG,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC;YACR,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,KAAK;YACL,GAAG;YACH,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IACD,2EAA2E;IAC3E,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,aAAa,KAAK,CAAC,MAAM,GAAG,CAAC;IAC3D,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,MAAM,GAAG,CAAC;AACzE,CAAC"}