bytes Model

Defines a model to enforce validation for binary data.

model: bytes

Configuration (* required)

model: bytes

const

Specifies the model is bytes.

validate

enum [ strict, lenient ] as string, or object | Default: strict

Controls how strictly the model enforces conformance. strict rejects data that doesn't conform; lenient passes non-conforming data through unmodified. Can also be set independently for decode and encode.

validate:
  decode: lenient
  encode: strict

validate.decode

enum [ strict, lenient ]

Validation mode applied when decoding the value.

validate.encode

enum [ strict, lenient ]

Validation mode applied when encoding the value.

transforms

Available in Zilla Plus

object

Defines a transform applied to the model's value. encryption encrypts the value on encode; on decode, a session authorized by guarded gets the decrypted value back, and a session that isn't falls back to disclosure — redact or hash — if configured, or otherwise has the value omitted.

transforms:
  guarded:
    api-keys:
      - ssn:decrypt
  encryption:
    vault:
      vault0:
        - kek0
        - kek1
  disclosure:
    action: redact

transforms.guarded

object as map of named array of string

Restricts the transform to sessions authorized by the referenced guard for one of the listed roles. An authorized session gets the value's real value — decrypted, when encryption is configured, unless encryption sets its own nested guarded. An unauthorized session falls back to disclosure if configured, or otherwise has the value omitted.

guarded:
  api-keys:
    - ssn:decrypt

transforms.disclosure

Available in Zilla Plus

object

Defines the fallback applied to the value for a session not authorized by guarded — or, when paired with encryption, a session unable to decrypt it. Without disclosure, such a session simply has the value omitted.

disclosure.action*

enum [ omit, redact, hash ]

redact replaces the value with a fixed placeholder, omit removes the value, and hash replaces the value with a keyed hash using secret. Unlike the string model, bytes has no mask action.

disclosure.secret

string

The key used to compute the hash when action is hash.

transforms.encryption

Available in Zilla Plus

object

Encrypts the value on encode, using a key encryption key (KEK) chain resolved from a vault, and decrypts it back on decode for a session authorized by guarded.

encryption:
  vault:
    vault0:
      - kek0
      - kek1
  guarded:
    api-keys:
      - ssn:decrypt

encryption.vault*

object as map of named array of string

References a single named vault and the ordered chain of key aliases used to wrap the data encryption key.

encryption.guarded

object as map of named array of string

Overrides the transform's guarded specifically for gating decryption of the value. A disclosure fallback still uses the transform's guarded to decide which sessions it applies to.