mirror of
https://github.com/profullstack/logicsrc.git
synced 2026-10-03 13:17:07 +00:00
* Add the LogicSRC OpenCreds specification Leaving a password manager means writing every secret you own to disk in the clear, and losing whatever the spreadsheet had no column for. A CSV is plaintext by construction, lossy by omission, and carries no integrity: nothing in it says which rows were meant to be there, so a truncated import looks exactly like a complete one. The same gap showed up inside LogicSRC. `logicsrc credentials` moves .env secrets and SSH keys through end-to-end-encrypted team vaults, but it can only model a key/value pair. A card, a passport, a login with a TOTP seed, or an OAuth account with a refresh token are all things people already keep in a vault, and none of them are a key/value pair. OpenCreds defines three things: the item, the vault, and the database. - Six item types (login, card, identity, note, key, account) as one record with a type and a named field group, so everything the user typed lives in a single encrypted blob. Codes 1-4 match MarkSyncr's deployed vault and are not renumbered; compatibility is cheaper than elegance. - AES-256-GCM over that record with the item id bound as AAD. Without it, anyone with storage write access could move a low-value login's ciphertext into a high-value row and watch what the user does next. - A key hierarchy where the user key is random, not derived, so a password change re-wraps 32 bytes rather than re-encrypting a vault. The auth hash comes out of a different HKDF label than the wrap key, which is what lets it reach a server at all. - A portable .opencreds file, encrypted by default, whose header is the AAD over the payload -- so the manifest is authenticated by the same tag as the data and a truncated import fails rather than reporting success. The plaintext form exists because people move to products that read nothing else; it is opt-in, confirmed, 0600, and labelled "protected": false in its own header. Namespaces are carried as data, not fixed by the spec: labels are compiled into every ciphertext a vault has written, so editing one does not migrate a vault, it makes it undecryptable. MarkSyncr's deployed vault is conformant by declaring `marksyncr`. Ships: prd/0004, nine spec pages under docs/opencreds/, six JSON Schemas, the @logicsrc/opencreds reference implementation with CSV importers for five products, `logicsrc vault` and the standalone `opencreds` binary, and the spec page at logicsrc.com/opencreds. `vault` rather than `creds` because `creds` is already an alias of `logicsrc credentials`, and the two are different: one moves a pair between providers, the other stores a record. @logicsrc/validators now registers every schema by $id before compiling, so the database schema can $ref the item and manifest schemas rather than restating them. 120 tests, including CLI end-to-end coverage of the masking rules, exit codes, and the manifest-mismatch path. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QRQrfuwuYKKV5UB9kLHuX5 * Make the OpenCreds conformance claim executable The conformance page described a fixture suite and an `opencreds conformance` command that did not exist. A specification that documents a conformance surface it cannot run is a specification nobody can hold to, including us. `opencreds conformance` now runs the requirement list as code -- one check per C-number, carrying its own id and level -- and emits the report shape the spec publishes. It exits 2 when a MUST does not pass, so it can gate CI directly. The reference implementation reports 29 passed, 0 failed, 1 skipped; the skip is C19, because key management for the team profile lives in @logicsrc/plugin-credential-sharing rather than in this package, and a skipped MAY does not affect conformance. Fixtures are generated (`--emit-fixtures <dir>`) rather than hand-written. A vector produced by an implementation and then verified by it is worth more than a JSON file someone typed: the typed file drifts silently when the format moves, and the generated one cannot. Fourteen files, including an invalid/ set every conforming reader must reject -- a wrong field group, a weak KDF, an unregistered namespace, a short payload and a tampered manifest. The CLI requirements stay with the end-to-end tests that drive the real binary through a child process; a command cannot meaningfully check its own exit codes, and a masked value that is only masked in the library is not masked. conformance.md and cli.md now describe what ships. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QRQrfuwuYKKV5UB9kLHuX5 * Add @logicsrc/opencreds to the lockfile `npm ci` refuses a lockfile that does not match package.json, and the new workspace package plus the CLI's dependency on it were never recorded: the worktree was bootstrapped by hardlinking node_modules rather than installing, so npm was never asked to update the lock. Adds the workspace link and the package entry. No dependency versions move. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QRQrfuwuYKKV5UB9kLHuX5 * Register PRD 0004, and stop the fixtures looking like real secrets Two CI failures, both mine. `prd/README.md` is generated by `logicsrc prd index --write` and the scaffold test asserts it is current, so adding a PRD without regenerating it leaves the repo's own conformance check failing. Regenerated. The MCP test asserts the next free PRD id against the live prd/ directory — its comment says it advances with every PRD added — so it moves to 0005. ThreatCrush flagged three of the example strings: a PEM header in the item-model docs and in the conformance fixture, and an `sk_live_` prefixed token. All placeholders, none real, but the finding is the scanner working. A fixture only has to exercise the field, and a real-looking private key header or live-key prefix sitting in the tree trains both the scanner and the people reading its output to shrug at exactly the shape that matters. Replaced with obvious placeholders rather than suppressing the rule. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QRQrfuwuYKKV5UB9kLHuX5 --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
134 lines
8.2 KiB
TypeScript
134 lines
8.2 KiB
TypeScript
/**
|
|
* Every LogicSRC JSON Schema, keyed by kind.
|
|
*
|
|
* Schemas are imported through @logicsrc/schemas package exports rather than by
|
|
* a relative path across the repository. A relative import works in the
|
|
* monorepo and breaks the moment this package is published: "../../schemas/..."
|
|
* resolves outside the published tarball, so an installed @logicsrc/validators
|
|
* could not load a single schema.
|
|
*/
|
|
import agentSchema from "@logicsrc/schemas/agent" with { type: "json" };
|
|
import accountAuditEventSchema from "@logicsrc/schemas/account-audit-event" with { type: "json" };
|
|
import accountGrantSchema from "@logicsrc/schemas/account-grant" with { type: "json" };
|
|
import accountProviderSchema from "@logicsrc/schemas/account-provider" with { type: "json" };
|
|
import connectedAccountSchema from "@logicsrc/schemas/connected-account" with { type: "json" };
|
|
import emailMessageSchema from "@logicsrc/schemas/email-message" with { type: "json" };
|
|
import eventSchema from "@logicsrc/schemas/event" with { type: "json" };
|
|
import pluginSchema from "@logicsrc/schemas/plugin" with { type: "json" };
|
|
import pullRequestSchema from "@logicsrc/schemas/pull-request" with { type: "json" };
|
|
import repoSchema from "@logicsrc/schemas/repo" with { type: "json" };
|
|
import runSchema from "@logicsrc/schemas/run" with { type: "json" };
|
|
import socialPostSchema from "@logicsrc/schemas/social-post" with { type: "json" };
|
|
import taskSchema from "@logicsrc/schemas/task" with { type: "json" };
|
|
import agentadAdSchema from "@logicsrc/schemas/agentad-ad" with { type: "json" };
|
|
import agentadPlacementSchema from "@logicsrc/schemas/agentad-placement" with { type: "json" };
|
|
import agentadAdRequestSchema from "@logicsrc/schemas/agentad-ad-request" with { type: "json" };
|
|
import agentadAdResponseSchema from "@logicsrc/schemas/agentad-ad-response" with { type: "json" };
|
|
import agentadImpressionSchema from "@logicsrc/schemas/agentad-impression" with { type: "json" };
|
|
import agentadClickSchema from "@logicsrc/schemas/agentad-click" with { type: "json" };
|
|
import agentadCampaignSchema from "@logicsrc/schemas/agentad-campaign" with { type: "json" };
|
|
import credentialProviderSchema from "@logicsrc/schemas/credential-provider" with { type: "json" };
|
|
import credentialSyncPlanSchema from "@logicsrc/schemas/credential-sync-plan" with { type: "json" };
|
|
import credentialSyncRunSchema from "@logicsrc/schemas/credential-sync-run" with { type: "json" };
|
|
import credentialAuditEventSchema from "@logicsrc/schemas/credential-audit-event" with { type: "json" };
|
|
import openprdPrdSchema from "@logicsrc/schemas/openprd-prd" with { type: "json" };
|
|
import ontologyManifestSchema from "@logicsrc/schemas/openontology-manifest" with { type: "json" };
|
|
import ontologyNamespaceSchema from "@logicsrc/schemas/openontology-namespace" with { type: "json" };
|
|
import ontologyEntityTypeSchema from "@logicsrc/schemas/openontology-entity-type" with { type: "json" };
|
|
import ontologyPropertySchema from "@logicsrc/schemas/openontology-property" with { type: "json" };
|
|
import ontologyRelationshipTypeSchema from "@logicsrc/schemas/openontology-relationship-type" with { type: "json" };
|
|
import ontologyConstraintSchema from "@logicsrc/schemas/openontology-constraint" with { type: "json" };
|
|
import ontologyQuerySchema from "@logicsrc/schemas/openontology-query" with { type: "json" };
|
|
import ontologyActionSchema from "@logicsrc/schemas/openontology-action" with { type: "json" };
|
|
import ontologyEntitySchema from "@logicsrc/schemas/openontology-entity" with { type: "json" };
|
|
import ontologyClaimSchema from "@logicsrc/schemas/openontology-claim" with { type: "json" };
|
|
import ontologySourceSchema from "@logicsrc/schemas/openontology-source" with { type: "json" };
|
|
import ontologyEvidenceSchema from "@logicsrc/schemas/openontology-evidence" with { type: "json" };
|
|
import ontologyChangeSetSchema from "@logicsrc/schemas/openontology-changeset" with { type: "json" };
|
|
import ontologyReviewSchema from "@logicsrc/schemas/openontology-review" with { type: "json" };
|
|
import ontologyApprovalSchema from "@logicsrc/schemas/openontology-approval" with { type: "json" };
|
|
import ontologyEventSchema from "@logicsrc/schemas/openontology-event" with { type: "json" };
|
|
import ontologyPackageSchema from "@logicsrc/schemas/openontology-package" with { type: "json" };
|
|
|
|
import ocManifestSchema from "@logicsrc/schemas/opencontext-manifest" with { type: "json" };
|
|
import ocObjectSchema from "@logicsrc/schemas/opencontext-object" with { type: "json" };
|
|
import ocBundleSchema from "@logicsrc/schemas/opencontext-bundle" with { type: "json" };
|
|
import ocRoleSchema from "@logicsrc/schemas/opencontext-role" with { type: "json" };
|
|
import ocProvenanceSchema from "@logicsrc/schemas/opencontext-provenance" with { type: "json" };
|
|
import ocDecisionSchema from "@logicsrc/schemas/opencontext-decision" with { type: "json" };
|
|
import ocDiagnosticSchema from "@logicsrc/schemas/opencontext-diagnostic" with { type: "json" };
|
|
import ocAuditEventSchema from "@logicsrc/schemas/opencontext-audit-event" with { type: "json" };
|
|
|
|
// OpenCreds. The database schema $refs the item and manifest schemas by $id,
|
|
// so all six are registered together in index.ts before anything is compiled.
|
|
import credsItemSchema from "@logicsrc/schemas/opencreds-item" with { type: "json" };
|
|
import credsEnvelopeSchema from "@logicsrc/schemas/opencreds-envelope" with { type: "json" };
|
|
import credsVaultMetaSchema from "@logicsrc/schemas/opencreds-vault-meta" with { type: "json" };
|
|
import credsManifestSchema from "@logicsrc/schemas/opencreds-manifest" with { type: "json" };
|
|
import credsDatabaseSchema from "@logicsrc/schemas/opencreds-database" with { type: "json" };
|
|
import credsAuditEventSchema from "@logicsrc/schemas/opencreds-audit-event" with { type: "json" };
|
|
|
|
export const schemas = {
|
|
agent: agentSchema,
|
|
"account-audit-event": accountAuditEventSchema,
|
|
"account-grant": accountGrantSchema,
|
|
"account-provider": accountProviderSchema,
|
|
"connected-account": connectedAccountSchema,
|
|
"email-message": emailMessageSchema,
|
|
event: eventSchema,
|
|
plugin: pluginSchema,
|
|
"pull-request": pullRequestSchema,
|
|
repo: repoSchema,
|
|
run: runSchema,
|
|
"social-post": socialPostSchema,
|
|
task: taskSchema,
|
|
"agentad-ad": agentadAdSchema,
|
|
"agentad-placement": agentadPlacementSchema,
|
|
"agentad-ad-request": agentadAdRequestSchema,
|
|
"agentad-ad-response": agentadAdResponseSchema,
|
|
"agentad-impression": agentadImpressionSchema,
|
|
"agentad-click": agentadClickSchema,
|
|
"agentad-campaign": agentadCampaignSchema,
|
|
"credential-provider": credentialProviderSchema,
|
|
"credential-sync-plan": credentialSyncPlanSchema,
|
|
"credential-sync-run": credentialSyncRunSchema,
|
|
"credential-audit-event": credentialAuditEventSchema,
|
|
"openprd-prd": openprdPrdSchema,
|
|
"openontology-manifest": ontologyManifestSchema,
|
|
"openontology-namespace": ontologyNamespaceSchema,
|
|
"openontology-entity-type": ontologyEntityTypeSchema,
|
|
"openontology-property": ontologyPropertySchema,
|
|
"openontology-relationship-type": ontologyRelationshipTypeSchema,
|
|
"openontology-constraint": ontologyConstraintSchema,
|
|
"openontology-query": ontologyQuerySchema,
|
|
"openontology-action": ontologyActionSchema,
|
|
"openontology-entity": ontologyEntitySchema,
|
|
"openontology-claim": ontologyClaimSchema,
|
|
"openontology-source": ontologySourceSchema,
|
|
"openontology-evidence": ontologyEvidenceSchema,
|
|
"openontology-changeset": ontologyChangeSetSchema,
|
|
"openontology-review": ontologyReviewSchema,
|
|
"openontology-approval": ontologyApprovalSchema,
|
|
"openontology-event": ontologyEventSchema,
|
|
"openontology-package": ontologyPackageSchema,
|
|
"opencontext-manifest": ocManifestSchema,
|
|
"opencontext-object": ocObjectSchema,
|
|
"opencontext-bundle": ocBundleSchema,
|
|
"opencontext-role": ocRoleSchema,
|
|
"opencontext-provenance": ocProvenanceSchema,
|
|
"opencontext-decision": ocDecisionSchema,
|
|
"opencontext-diagnostic": ocDiagnosticSchema,
|
|
"opencontext-audit-event": ocAuditEventSchema,
|
|
"opencreds-item": credsItemSchema,
|
|
"opencreds-envelope": credsEnvelopeSchema,
|
|
"opencreds-vault-meta": credsVaultMetaSchema,
|
|
"opencreds-manifest": credsManifestSchema,
|
|
"opencreds-database": credsDatabaseSchema,
|
|
"opencreds-audit-event": credsAuditEventSchema
|
|
} as const;
|
|
|
|
export type SchemaKind = keyof typeof schemas;
|
|
|
|
export function isSchemaKind(value: string): value is SchemaKind {
|
|
return Object.hasOwn(schemas, value);
|
|
}
|