Initial Commit

packages/api-stack/api/api-manifest/src/schema/secrets.ts

@@ -0,0 +1,20 @@
+import z from "zod";
+
+const SECRET_NAME_RE = /^[A-Z][A-Z0-9_]*$/;
+
+/**
+ * Secret-name declarations. Host loads values from its secret store
+ * adapter (env, Bun.secrets, Vault, …) and fails fast when any
+ * `required: true` entry is missing at boot.
+ */
+export const secretSchema = z.object({
+    name: z
+        .string()
+        .regex(SECRET_NAME_RE, "secret name must be SCREAMING_SNAKE_CASE"),
+    required: z.boolean(),
+});
+
+export const secretsSchema = z.array(secretSchema).readonly();
+
+export type Secret = z.infer<typeof secretSchema>;
+export type Secrets = z.infer<typeof secretsSchema>;