import z from "zod";

const SECRET_NAME_RE = /^[A-Z][A-Z0-9_]*$/;

/**
 * Secret-name declarations. Host loads values from its secret store
 * adapter (env, Bun.secrets, Vault, …) and fails fast when any
 * `required: true` entry is missing at boot.
 */
export const secretSchema = z.object({
    name: z
        .string()
        .regex(SECRET_NAME_RE, "secret name must be SCREAMING_SNAKE_CASE"),
    required: z.boolean(),
});

export const secretsSchema = z.array(secretSchema).readonly();

export type Secret = z.infer<typeof secretSchema>;
export type Secrets = z.infer<typeof secretsSchema>;