OptionalauditDocumentation-level assertion that this variable's handling must be auditable. Overrides the contract's own auditRequired for this key.
OptionalauthenticatorThe kind of authenticator/secret this variable holds (e.g. "api-key", "oauth-client-secret", "database-password", "tls-certificate") -- feeds the NIST SP 800-53 IA-5 rotation-compliance report's "authenticator type" column (IA-5's main statement requires an organization-defined rotation period "by authenticator type," so this is what a generator groups/labels by).
Deliberately an open string, not a closed union -- same "open vocabulary" pattern as
sensitivity: an org's own authenticator taxonomy is its own, and IA-5 itself never
names a fixed set of types either.
OptionaldataWhere this variable's value is/must be stored (a region, or a permitted set of regions). Overrides the contract's own dataResidency for this key.
OptionaldeprecatedMarks this variable as being phased out. Independent of expiresAt (a rotation/sunset date) and of the contract-level active switch (on/off, not a phase-out signal).
OptionaldeprecatedWhy this variable is deprecated, and/or what to use instead. Only meaningful alongside deprecated: true.
OptionaldescriptionHuman-readable explanation of what this variable is and what it controls.
OptionalevidenceDeveloper-supplied evidence assertions for this variable -- verified over time, unlike every other field above, which is declared and never verified. Kept structurally separate for exactly that reason; see VariableEvidenceDocs.
OptionalexpiresISO date string (e.g. "2026-06-01") -- when this variable's current value stops being valid (a key rotation deadline, a sunset date, etc.).
OptionallastISO date string -- the last time this variable's value was actually rotated. Paired with
rotationPeriod to compute rotation compliance. Independent of expiresAt, which
states when the current value stops being valid, not when it was last changed -- a value can
be freshly rotated and still have a near-term expiresAt (a short-lived token), or long overdue
for rotation while its expiresAt (if any) is still comfortably in the future.
OptionallegalThe legal basis this variable's collection/use relies on -- framework-agnostic (e.g. "user consent," "contractual necessity"), never a specific statute name. Overrides the contract's own legalBasis for this key.
OptionalmetadataStructured, unsupported-key documentation -- any primitive or object value, for anything that doesn't warrant its own named field. A previously-supported top-level key belongs in a named field above instead of here once one exists for it.
OptionalownerWho owns this variable (a team, a handle, whatever your org uses). Overrides the contract's own owner for this key.
OptionalpurposeWhy this variable's value is collected/used -- a framework-agnostic fact (pairs with legalBasis; a specific citation like a GDPR article belongs in metadata instead). Overrides the contract's own purpose for this key.
OptionalrefreshHow to get a new value before/when it expires (e.g. "Rotate in the Stripe dashboard, then redeploy.").
OptionalremoveISO date string -- by when a deprecated variable must be removed. Only meaningful alongside deprecated: true.
OptionalrenamedThe previous environment variable name this one replaces, if this declaration is the result of a rename. Lets the Change Model correlate a remove+add pair into a single rename entry instead of two unrelated changes.
OptionalrequiredDocumentation-level assertion that this variable must be set. Independent of how (or whether) a validator actually enforces it.
OptionalretentionDescriptive retention policy (e.g. "delete after 90 days"). A policy statement, not a computed value -- unlike expiresAt, nothing parses or evaluates this. Overrides the contract's own retention for this key.
OptionalrotationHow often this variable's value must be rotated, in organization-defined terms (e.g. "90
days", "P90D", "6 months") -- IA-5's own "organization-defined time period" per authenticator
type (the time-based half of IA-5's two-trigger rotation model). Paired with
lastRotatedAt so a generator can compute whether rotation is actually current, rather
than only recording that a period was declared; see lifecycle-model.ts's
computeRotationStatus() for exactly how the two combine with expiresAt.
OptionalrotationIA-5's event-based rotation triggers that apply to this variable (e.g. "suspected compromise",
"personnel change", "system update") -- the event-based half of IA-5's two-trigger rotation
model. Structured and additive alongside the existing free-text refreshInstructions
rather than replacing it: this is a list a generator can render as its own column,
refreshInstructions stays prose ("how to actually rotate it"). Presence-only -- env-cap has
no way to observe whether a listed event actually occurred, so declaring this never by itself
changes a computed rotation-compliance status (see lifecycle-model.ts); it only makes the
event-based trigger's existence visible in generated output.
OptionalsensitivityHow sensitive this variable's value is. Overrides the contract's own sensitivity for this
key.
Deliberately an open string, not a closed union: an org's own sensitivity vocabulary is its
own, and a level env-cap doesn't recognize is always honored, never dropped. The generator
still reports a NONSTANDARD_SENSITIVITY_LEVEL finding (severity info, never blocking) for
anything outside secret/credential/pii/config, so vocabulary drift stays visible
without being enforced.
OptionalsetupExplicit, actionable instructions for obtaining this variable's value the first time --
where refreshInstructions is "how to rotate it once you already have one," this is "how to
get one at all" (e.g. "Create a restricted API key in the Stripe dashboard under Developers ->
API keys, scoped to read/write Charges."). A named field specifically so this can render as
its own labeled line in generated docs, rather than requiring a metadata.setup-style
convention with no dedicated rendering or type checking.
Per-variable documentation. Every field is optional and unconstrained on purpose -- there is no required shape, so documenting a variable never fights the type checker, and you can add a field the generator doesn't know about yet without it being rejected.