@restormel/validate 0.1.0

package/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 Allotment Technology Ltd
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

package/README.md

@@ -0,0 +1,37 @@
+# @restormel/validate
+
+Restormel Validate is an **open-source** CLI for validating provider credentials and configuration. It is designed to be CI-friendly and to act as an **entrypoint** into the Restormel Platform.
+
+## Install
+
+```bash
+npx @restormel/validate
+```
+
+Or install in a repo:
+
+```bash
+pnpm add -D @restormel/validate
+```
+
+## Usage
+
+```bash
+restormel-validate
+```
+
+### Output formats
+
+```bash
+restormel-validate --format json
+restormel-validate --format json --out validate.json
+```
+
+### Modes / CI behavior
+
+- Default behavior is CI-friendly: **exit 1** if any known-provider key is invalid.\n- Use `--fail-on warn` or `--fail-on none` to relax gating.\n- Use `--strict` as a preset for CI (fail on invalid).
+
+## Exit codes
+
+- `0`: all checks passed\n- `1`: failed checks (per `--fail-on` policy)\n- `2`: usage/config error (unexpected failure)
+

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,128 @@
+#!/usr/bin/env node
+/**
+ * @restormel/validate — standalone OSS validation entrypoint.
+ */
+import { Command } from "commander";
+import chalk from "chalk";
+import { openaiProvider, anthropicProvider, googleProvider, } from "@restormel/keys";
+import { readStore } from "./store.js";
+const PROVIDERS = {
+    openai: openaiProvider,
+    anthropic: anthropicProvider,
+    google: googleProvider,
+};
+function exitCodeFor(report, failOn) {
+    if (failOn === "none")
+        return 0;
+    if (failOn === "warn") {
+        const hasFail = report.checks.some((c) => c.status === "fail");
+        return hasFail ? 1 : 0;
+    }
+    // invalid
+    return report.ok ? 0 : 1;
+}
+function writeOutput(report, format) {
+    if (format === "json") {
+        process.stdout.write(JSON.stringify(report, null, 2) + "\n");
+        return;
+    }
+    console.log(chalk.cyan("Restormel Validate"));
+    console.log("");
+    for (const c of report.checks) {
+        const icon = c.status === "ok" ? chalk.green("✓") : c.status === "warn" ? chalk.yellow("○") : chalk.red("✗");
+        const label = chalk.white(c.label);
+        const msg = c.message ? chalk.gray(`— ${c.message}`) : "";
+        console.log(`${icon} ${label} ${msg}`.trimEnd());
+    }
+    console.log("");
+    console.log(report.ok ? chalk.green("OK") : chalk.red("Issues found"));
+}
+async function runValidate() {
+    const cwd = process.cwd();
+    const store = await readStore(cwd);
+    const checks = [];
+    if (store.keys.length === 0) {
+        checks.push({
+            id: "keys",
+            label: "Stored keys",
+            status: "warn",
+            message: "no keys to validate",
+        });
+        return { ok: true, cwd, checks };
+    }
+    let allValid = true;
+    for (const k of store.keys) {
+        const provider = PROVIDERS[k.provider];
+        if (!provider) {
+            checks.push({
+                id: `key:${k.id}`,
+                label: `Key (${k.provider})`,
+                status: "warn",
+                message: "unknown provider (skipped)",
+                details: { provider: k.provider, id: k.id, mask: k.mask, label: k.label },
+            });
+            continue;
+        }
+        const result = await provider.validateKey(k.apiKey);
+        if (result.valid) {
+            checks.push({
+                id: `key:${k.id}`,
+                label: `Key (${k.provider})`,
+                status: "ok",
+                message: k.mask ?? k.id,
+            });
+        }
+        else {
+            allValid = false;
+            checks.push({
+                id: `key:${k.id}`,
+                label: `Key (${k.provider})`,
+                status: "fail",
+                message: (result.errors?.[0] ?? "Invalid").toString(),
+                details: { provider: k.provider, id: k.id, mask: k.mask, label: k.label },
+            });
+        }
+    }
+    return { ok: allValid, cwd, checks };
+}
+async function main() {
+    const program = new Command();
+    program
+        .name("restormel-validate")
+        .description("Restormel Validate — open-source CLI for credential and configuration validation")
+        .version("0.1.0")
+        .option("--format <format>", "Output format: text|json", "text")
+        .option("--out <path>", "Write JSON output to a file (requires --format json)")
+        .option("--fail-on <mode>", "Fail policy: invalid|warn|none", "invalid")
+        .option("--strict", "Preset for CI: --fail-on invalid", false);
+    program.parse();
+    const opts = program.opts();
+    const format = (opts.format ?? "text");
+    if (format !== "text" && format !== "json") {
+        console.error(chalk.red("Invalid --format. Use text or json."));
+        process.exit(2);
+    }
+    if (opts.out && format !== "json") {
+        console.error(chalk.red("--out requires --format json."));
+        process.exit(2);
+    }
+    const failOn = (opts.strict ? "invalid" : (opts.failOn ?? "invalid"));
+    if (failOn !== "invalid" && failOn !== "warn" && failOn !== "none") {
+        console.error(chalk.red("Invalid --fail-on. Use invalid, warn, or none."));
+        process.exit(2);
+    }
+    try {
+        const report = await runValidate();
+        if (opts.out) {
+            const { writeFile } = await import("fs/promises");
+            await writeFile(opts.out, JSON.stringify(report, null, 2) + "\n", "utf-8");
+        }
+        writeOutput(report, format);
+        process.exit(exitCodeFor(report, failOn));
+    }
+    catch (e) {
+        console.error(chalk.red("Validate failed:"), e instanceof Error ? e.message : String(e));
+        process.exit(2);
+    }
+}
+void main();

package/dist/store.d.ts

@@ -0,0 +1,15 @@
+export declare const STORE_DIR = ".restormel";
+export declare const STORE_FILENAME = "key-store.json";
+export interface StoredKey {
+    id: string;
+    provider: string;
+    label?: string;
+    /** Masked for display only (e.g. sk-...abc). Never log or expose. */
+    mask?: string;
+}
+export interface KeyStoreData {
+    keys: Array<StoredKey & {
+        apiKey: string;
+    }>;
+}
+export declare function readStore(cwd: string): Promise<KeyStoreData>;

package/dist/store.js

@@ -0,0 +1,25 @@
+/**
+ * Local key store. Lives under .restormel/ and must be in .gitignore.
+ * Contains secrets; validate never prints raw keys.
+ */
+import { readFile } from "fs/promises";
+import { existsSync } from "fs";
+import { join } from "path";
+export const STORE_DIR = ".restormel";
+export const STORE_FILENAME = "key-store.json";
+function storePath(cwd) {
+    return join(cwd, STORE_DIR, STORE_FILENAME);
+}
+export async function readStore(cwd) {
+    const path = storePath(cwd);
+    if (!existsSync(path))
+        return { keys: [] };
+    try {
+        const raw = await readFile(path, "utf-8");
+        const data = JSON.parse(raw);
+        return Array.isArray(data.keys) ? data : { keys: [] };
+    }
+    catch {
+        return { keys: [] };
+    }
+}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@restormel/validate",
+  "version": "0.1.0",
+  "description": "Restormel Validate — open-source CLI for credential and configuration validation.",
+  "keywords": [
+    "restormel",
+    "validate",
+    "credentials",
+    "cli",
+    "byok",
+    "llm"
+  ],
+  "author": "Allotment Technology Ltd",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Allotment-Technology-Ltd/restormel-keys.git"
+  },
+  "homepage": "https://github.com/Allotment-Technology-Ltd/restormel-keys#readme",
+  "bugs": {
+    "url": "https://github.com/Allotment-Technology-Ltd/restormel-keys/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "restormel-validate": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@restormel/keys": "workspace:*",
+    "chalk": "^5.3.0",
+    "commander": "^12.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.5.0",
+    "typescript": "^5.7.2",
+    "vitest": "^4.1.0"
+  },
+  "engines": {
+    "node": ">=18"
+  }
+}