# secret-delivery domain contract v0.1.0
#
# JSON shape piped to stdin (or written to context file) for any integration mode
# step that consumes the secret-delivery domain.
#
# Provisioning's context assembler fills this structure from:
#   - SOPS-encrypted workspace secrets
#   - Component output values (e.g. registry URL from zot component)
#   - Cabling literals (static values declared in integrations/<mode-id>.ncl)

let _SecretEntry = {
  value  | String
         | doc "Plaintext secret value — decrypted by provisioning before delivery",
  source | [| 'sops, 'component_output, 'literal |],
  label  | String | optional
        | doc "Human-readable label for audit logs",
} in

let _SecretDeliveryContext = {
  schema_version | String | default = "0.1.0",
  workspace      | String
                 | doc "Workspace identifier that sourced these secrets",
  mode_id        | String
                 | doc "Integration mode id that requested this delivery",
  secrets | { _ | _SecretEntry }
          | doc "Map of logical secret name → resolved entry",
  metadata | {
    delivered_at | String
                 | doc "ISO-8601 timestamp of delivery",
    provisioning_version | String | optional,
  } | optional,
} in

{
  SecretEntry            = _SecretEntry,
  SecretDeliveryContext  = _SecretDeliveryContext,
}