From d2b6e56224cdbbe129c907c86a4da1f25068b31c Mon Sep 17 00:00:00 2001
From: cem <cem@talp.ai>
Date: Fri, 26 Jun 2026 13:15:43 +0000
Subject: [PATCH] security: add .gitignore, lockfile, and tighten envelope
 schema

- Add .gitignore to prevent accidental commits of secrets (.env, *.pem,
  *.key), node_modules, OS files, and editor artifacts
- Add package-lock.json for reproducible builds and supply-chain safety
- Tighten protocol envelope schema:
  - Set additionalProperties to false (prevent unexpected field injection)
  - Add date-time format constraint on created_at
  - Add minLength and pattern constraint on kind (lowercase dotted identifiers)

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .gitignore                    | 31 +++++++++++++++++++++++++++++++
 package-lock.json             | 15 +++++++++++++++
 protocol/envelope.schema.json |  7 +++----
 3 files changed, 49 insertions(+), 4 deletions(-)
 create mode 100644 .gitignore
 create mode 100644 package-lock.json

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..6315a55
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,31 @@
+# dependencies
+node_modules/
+
+# environment and secrets
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+*.pfx
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# editor / IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# logs
+*.log
+npm-debug.log*
+
+# build output
+dist/
+build/
+out/
diff --git a/package-lock.json b/package-lock.json
new file mode 100644
index 0000000..dcea0e0
--- /dev/null
+++ b/package-lock.json
@@ -0,0 +1,15 @@
+{
+  "name": "@gsm-foundation/graphite",
+  "version": "0.0.0-incubating",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "@gsm-foundation/graphite",
+      "version": "0.0.0-incubating",
+      "engines": {
+        "node": ">=18"
+      }
+    }
+  }
+}
diff --git a/protocol/envelope.schema.json b/protocol/envelope.schema.json
index c36d683..d721538 100644
--- a/protocol/envelope.schema.json
+++ b/protocol/envelope.schema.json
@@ -5,11 +5,10 @@
   "required": ["protocol", "kind", "created_at", "payload"],
   "properties": {
     "protocol": { "type": "string", "pattern": "^graphite/[0-9]+\\.[0-9]+$" },
-    "kind": { "type": "string" },
-    "created_at": { "type": "string" },
+    "kind": { "type": "string", "minLength": 1, "pattern": "^[a-z][a-z0-9_.]*$" },
+    "created_at": { "type": "string", "format": "date-time" },
     "gate": { "type": "object" },
     "payload": { "type": "object" }
   },
-  "additionalProperties": true
+  "additionalProperties": false
 }
-