hasna.contract.json

{
  "schema": "hasna.service_contract.v1",
  "name": "secrets",
  "class": "service",
  "contractVersion": "v1",
  "kitVersion": "0.4.2",
  "description": "Agent-friendly secrets vault: CLI + MCP + HTTP serve + SDK. Local mode uses SQLite at ~/.hasna/secrets/vault.db; cloud mode (HASNA_SECRETS_STORAGE_MODE=cloud) is PURE REMOTE per Amendment A1 with all reads/writes hitting the shared cloud Postgres. The deployed secrets-serve enforces strict API-key auth (@hasna/contracts).",
  "bins": [
    "secrets",
    "secrets-mcp",
    "secrets-serve"
  ],
  "storage": {
    "mode": "cloud",
    "envPrefix": "HASNA_SECRETS_",
    "aliasEnvPrefix": "SECRETS_",
    "databaseUrlSecretRef": "hasna/oss/secrets/database-url",
    "sqlitePath": "~/.hasna/secrets/vault.db"
  },
  "metadata": {
    "serve": {
      "healthPath": "/health",
      "readyPath": "/ready",
      "versionPath": "/version",
      "apiBase": "/v1",
      "auth": "api-key",
      "signingSecretEnv": "HASNA_SECRETS_API_SIGNING_KEY"
    }
  }
}