gistfile1.txt

// secret.state v1: Zod mirror of the unified secret reading shape.
//
// The ENFORCED source of truth is the secret.state v1 JSON Schema in
// supabase/migrations/20260809000000_reading_schema_validation.sql, which
// the DB validates on every create_reading. This Zod copy gives field-level
// errors at the scanner BEFORE the DB call (jsonb_matches_schema only
// returns a boolean). Keep it in sync with that migration and with the
// copy in the other scanners. It is copied, not a shared workspace package,
// because scanners deploy as standalone services (tsc dist + npm deps),
// which cannot resolve a private workspace dependency at runtime.
import { z } from 'zod'

export const secretStateV1 = z.strictObject({
  schema_version: z.literal(1),
  id: z.string(),
  provider: z.string(),
  kind: z.enum([
    'api_key',
    'env_var',
    'oauth_token',
    'service_account_key',
    'deploy_key',
    'webhook_secret',
  ]),
  name: z.string(),
  scope: z.strictObject({
    level: z.string(),
    ref: z.string().nullable(),
  }),
  sensitivity: z.enum(['sensitive', 'encrypted', 'plain']),
  status: z.enum(['active', 'inactive', 'archived', 'expired', 'unknown']),
  created_at: z.string().nullable(),
  expires_at: z.string().nullable(),
  created_by: z.string().nullable(),
  hint: z.string().nullable(),
  meta: z.record(z.string(), z.unknown()),
})

export type SecretStateV1 = z.infer<typeof secretStateV1>

// Validate facts right before create_reading so a malformed reading fails
// loudly at the source (with a field path) instead of as an opaque DB
// schema rejection.
export function parseSecretStateV1(facts: unknown): SecretStateV1 {
  return secretStateV1.parse(facts)
}