PR Custody

feat(credential-grammar): add request value grammar package

@2nishantgdraftchecks n/achecks…feat/encryption-templating-pr1-grammar → master28 files · +2509 −0updated 2d ago

▸Description

Stack: #10645 (this PR) ← #10646 (template compiler + renderer) ← #10647 (shadow parity mode)

New private package @composio/credential-grammar — the shared contract between Apollo's credential renderer and the future credential proxy:

nodes: closed Zod grammar (literal / enc / fn / concat), AuthOverlay + RenderedRequest containers; sign directive reserved (parses, resolution fails closed with sign_not_implemented)
resolver: pure fail-closed resolution parameterized by {decrypt} with depth/node/byte/envelope limits; decrypts memoized per distinct envelope
fn registry: base64 + hmac_sha256 ported byte-identical from Apollo's evalFieldFunctions.ts
envelope codec seam: krs1./krc1. transport prefixes; INSECURE dev0 plaintext codec on a separate ./insecure-dev entrypoint, rejected at the transport boundary both ways
transport: body-only JSON serialization with envelope prefix enforcement and fail-closed size budget
static payloads: origins / refresh_urls schemas, fail-closed lookups, exact-origin matcher
proxy stub: in-process stand-in (validate → destination check → resolve → assemble) for tests, shadow mode, and local dev until the proxy exists
vectors/*.json: pure-JSON cross-language test vectors (future Go parity)

113 tests; lint + tsgo clean. CI workflow mirrors pkg-auth-config-vitest.

🤖 Generated with Claude Code

loading diff…