@dcdr/contracts 2.3.0 → 2.4.0

package/README.md

@@ -403,6 +403,14 @@ See full feature matrix: [docs/TIERS_FEATURE_MATRIX.md](docs/TIERS_FEATURE_MATRI
 
 ---
 
+## Managed storage credentials
+
+Cloud-managed assets keep tenant-visible storage descriptors and concrete secrets separate:
+
+- `DcdrAssetStorageDescriptor` stays secret-free and travels through entitlements.
+- Backend/runtime secret exchange uses the shared `storage.credentials.contract` surface.
+- Current runtime support resolves Google Cloud service-account credentials for managed buckets and leaves room for future `S3`, `FTP`, and `NAS` credential kinds without changing the public asset upload/get/delete routes.
+
 ## More docs
 
 ### Core concepts

package/dist/index.d.ts

@@ -18,6 +18,8 @@ export * from "./subscription.contract";
 export * from "./runtime.client";
 export * from "./utils.contract";
 export * from "./cache.contract";
+export * from "./storage.credentials.contract";
 export * from "./prompt-variable-schema.contract";
 export * from "./registry.stats.contract";
+export { ASSET_TYPE_VALUES, ASSET_TYPE_LABELS, DcdrAssetScope, DcdrAssetMetadata, DcdrAssetMetadataAttributes, DcdrAssetStorageDescriptor, DcdrAssetUploadRequest, DcdrAssetUploadResponse, DcdrAssetGetRequest, DcdrAssetGetResponse, DcdrAssetDeleteRequest, DcdrAssetDeleteResponse, } from "./asset.contract";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mCAAmC,CAAC;AAClD,cAAc,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mCAAmC,CAAC;AAClD,cAAc,2BAA2B,CAAC;AAM1C,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,2BAA2B,EAC3B,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -14,6 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DcdrAssetScope = exports.ASSET_TYPE_LABELS = exports.ASSET_TYPE_VALUES = void 0;
 __exportStar(require("./control.contract"), exports);
 __exportStar(require("./errors.contract"), exports);
 __exportStar(require("./execution.contract"), exports);
@@ -34,5 +35,14 @@ __exportStar(require("./subscription.contract"), exports);
 __exportStar(require("./runtime.client"), exports);
 __exportStar(require("./utils.contract"), exports);
 __exportStar(require("./cache.contract"), exports);
+__exportStar(require("./storage.credentials.contract"), exports);
 __exportStar(require("./prompt-variable-schema.contract"), exports);
 __exportStar(require("./registry.stats.contract"), exports);
+// Asset contract surface — symbols not already re-exported via execution.contract.
+// AssetType, ExecutionAssetDatasource*, ExecutionAssetReference are already in
+// scope through execution.contract; only the managed-asset lifecycle types and
+// the canonical constants are missing from the root barrel.
+var asset_contract_1 = require("./asset.contract");
+Object.defineProperty(exports, "ASSET_TYPE_VALUES", { enumerable: true, get: function () { return asset_contract_1.ASSET_TYPE_VALUES; } });
+Object.defineProperty(exports, "ASSET_TYPE_LABELS", { enumerable: true, get: function () { return asset_contract_1.ASSET_TYPE_LABELS; } });
+Object.defineProperty(exports, "DcdrAssetScope", { enumerable: true, get: function () { return asset_contract_1.DcdrAssetScope; } });

package/dist/storage.credentials.contract.d.ts

@@ -0,0 +1,90 @@
+import { ExecutionAssetDatasourceType } from "./asset.contract";
+/**
+ * Concrete credential payload kinds used by backend-managed asset storages.
+ *
+ * Notes
+ * - This is intentionally separate from `ExecutionAssetDatasourceType`.
+ * - `datasourceType` describes the storage family (`S3`, `FTP`, `NAS`).
+ * - `kind` describes the exact credential material returned to runtime.
+ */
+export declare enum AssetStorageCredentialsKind {
+    GOOGLE_CLOUD_SERVICE_ACCOUNT = "GOOGLE_CLOUD_SERVICE_ACCOUNT",
+    S3_ACCESS_KEY = "S3_ACCESS_KEY",
+    FTP_BASIC = "FTP_BASIC",
+    NAS_BASIC = "NAS_BASIC"
+}
+/**
+ * Google Cloud service-account credentials used by the current managed-bucket runtime slice.
+ */
+export interface AssetStorageGoogleCloudServiceAccountCredentials {
+    projectId: string;
+    clientEmail: string;
+    privateKey: string;
+}
+/**
+ * S3-compatible access-key credentials for future object-storage backends.
+ */
+export interface AssetStorageS3AccessKeyCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+    forcePathStyle?: boolean;
+}
+/**
+ * FTP credentials for future file-transfer-backed asset storages.
+ */
+export interface AssetStorageFtpBasicCredentials {
+    host: string;
+    port?: number;
+    username: string;
+    password: string;
+    secure?: boolean;
+    passive?: boolean;
+}
+/**
+ * NAS credentials for future share/path-backed asset storages.
+ */
+export interface AssetStorageNasBasicCredentials {
+    sharePath: string;
+    username?: string;
+    password?: string;
+    domain?: string;
+}
+/**
+ * Backend-resolved credential payload for a managed asset storage datasource.
+ *
+ * Notes
+ * - Keep this additive and secret-bearing: backend/runtime only, never UI-facing.
+ * - Optional transport/location hints allow backend to remain source-of-truth for
+ *   container, endpoint, region, or base-path overrides when they are not fully
+ *   represented in tenant entitlements.
+ */
+export interface AssetStorageCredentialsContract {
+    kind: AssetStorageCredentialsKind;
+    datasourceType: ExecutionAssetDatasourceType;
+    endpoint?: string;
+    container?: string;
+    region?: string;
+    basePath?: string;
+    googleCloudServiceAccount?: AssetStorageGoogleCloudServiceAccountCredentials;
+    s3AccessKey?: AssetStorageS3AccessKeyCredentials;
+    ftpBasic?: AssetStorageFtpBasicCredentials;
+    nasBasic?: AssetStorageNasBasicCredentials;
+}
+/**
+ * Request sent by runtime to backend to resolve one tenant-visible storage/datasource.
+ */
+export interface ResolveAssetStorageCredentialsRequest {
+    storageId?: string;
+    datasourceId?: string;
+}
+/**
+ * Backend response containing the concrete credentials for one tenant storage datasource.
+ */
+export interface ResolveAssetStorageCredentialsResponse {
+    storageId: string;
+    datasourceId: string;
+    credentials: AssetStorageCredentialsContract;
+    expiresAtMs?: number;
+}
+//# sourceMappingURL=storage.credentials.contract.d.ts.map

package/dist/storage.credentials.contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.credentials.contract.d.ts","sourceRoot":"","sources":["../src/storage.credentials.contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAEhE;;;;;;;GAOG;AACH,oBAAY,2BAA2B;IACrC,4BAA4B,iCAAiC;IAC7D,aAAa,kBAAkB;IAC/B,SAAS,cAAc;IACvB,SAAS,cAAc;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,gDAAgD;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,kCAAkC;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,2BAA2B,CAAC;IAClC,cAAc,EAAE,4BAA4B,CAAC;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yBAAyB,CAAC,EAAE,gDAAgD,CAAC;IAC7E,WAAW,CAAC,EAAE,kCAAkC,CAAC;IACjD,QAAQ,CAAC,EAAE,+BAA+B,CAAC;IAC3C,QAAQ,CAAC,EAAE,+BAA+B,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,qCAAqC;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,sCAAsC;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,+BAA+B,CAAC;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/dist/storage.credentials.contract.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AssetStorageCredentialsKind = void 0;
+/**
+ * Concrete credential payload kinds used by backend-managed asset storages.
+ *
+ * Notes
+ * - This is intentionally separate from `ExecutionAssetDatasourceType`.
+ * - `datasourceType` describes the storage family (`S3`, `FTP`, `NAS`).
+ * - `kind` describes the exact credential material returned to runtime.
+ */
+var AssetStorageCredentialsKind;
+(function (AssetStorageCredentialsKind) {
+    AssetStorageCredentialsKind["GOOGLE_CLOUD_SERVICE_ACCOUNT"] = "GOOGLE_CLOUD_SERVICE_ACCOUNT";
+    AssetStorageCredentialsKind["S3_ACCESS_KEY"] = "S3_ACCESS_KEY";
+    AssetStorageCredentialsKind["FTP_BASIC"] = "FTP_BASIC";
+    AssetStorageCredentialsKind["NAS_BASIC"] = "NAS_BASIC";
+})(AssetStorageCredentialsKind || (exports.AssetStorageCredentialsKind = AssetStorageCredentialsKind = {}));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dcdr/contracts",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "homepage": "https://dcdr.ai",
   "description": "TypeScript contracts and runtime client for DCDR intent-based AI execution",
   "private": false,
@@ -48,30 +48,59 @@
     "node": "22.22.0"
   },
   "exports": {
-    ".": "./dist/index.js",
-    "./asset.contract": "./dist/asset.contract.js",
-    "./runtime.client": "./dist/runtime.client.js",
-    "./cache.contract": "./dist/cache.contract.js",
-    "./capabilities.contract": "./dist/capabilities.contract.js",
-    "./control.contract": "./dist/control.contract.js",
-    "./credentials.contract": "./dist/credentials.contract.js",
-    "./subscription.contract": "./dist/subscription.contract.js",
-    "./utils.contract": "./dist/utils.contract.js",
-    "./prompt-variable-schema.contract": "./dist/prompt-variable-schema.contract.js",
-    "./registry.stats.contract": "./dist/registry.stats.contract.js",
-    "./http.contract": "./dist/http.contract.js",
-    "./entitlements.contract": "./dist/entitlements.contract.js",
-    "./errors.contract": "./dist/errors.contract.js",
-    "./execution.contract": "./dist/execution.contract.js",
-    "./implementations.contract": "./dist/implementations.contract.js",
-    "./intent.contract": "./dist/intent.contract.js",
-    "./logs.contract": "./dist/logs.contract.js",
-    "./messages.contract": "./dist/messages.contract.js",
-    "./policies.contract": "./dist/policies.contract.js",
-    "./prompts.contract": "./dist/prompts.contract.js",
-    "./provider.contract": "./dist/provider.contract.js",
-    "./service-tokens.contract": "./dist/service-tokens.contract.js",
-    "./session.contract": "./dist/session.contract.js"
+    ".": { "types": "./dist/index.d.ts", "default": "./dist/index.js" },
+    "./asset.contract": { "types": "./dist/asset.contract.d.ts", "default": "./dist/asset.contract.js" },
+    "./storage.credentials.contract": { "types": "./dist/storage.credentials.contract.d.ts", "default": "./dist/storage.credentials.contract.js" },
+    "./runtime.client": { "types": "./dist/runtime.client.d.ts", "default": "./dist/runtime.client.js" },
+    "./cache.contract": { "types": "./dist/cache.contract.d.ts", "default": "./dist/cache.contract.js" },
+    "./capabilities.contract": { "types": "./dist/capabilities.contract.d.ts", "default": "./dist/capabilities.contract.js" },
+    "./control.contract": { "types": "./dist/control.contract.d.ts", "default": "./dist/control.contract.js" },
+    "./credentials.contract": { "types": "./dist/credentials.contract.d.ts", "default": "./dist/credentials.contract.js" },
+    "./subscription.contract": { "types": "./dist/subscription.contract.d.ts", "default": "./dist/subscription.contract.js" },
+    "./utils.contract": { "types": "./dist/utils.contract.d.ts", "default": "./dist/utils.contract.js" },
+    "./prompt-variable-schema.contract": { "types": "./dist/prompt-variable-schema.contract.d.ts", "default": "./dist/prompt-variable-schema.contract.js" },
+    "./registry.stats.contract": { "types": "./dist/registry.stats.contract.d.ts", "default": "./dist/registry.stats.contract.js" },
+    "./http.contract": { "types": "./dist/http.contract.d.ts", "default": "./dist/http.contract.js" },
+    "./entitlements.contract": { "types": "./dist/entitlements.contract.d.ts", "default": "./dist/entitlements.contract.js" },
+    "./errors.contract": { "types": "./dist/errors.contract.d.ts", "default": "./dist/errors.contract.js" },
+    "./execution.contract": { "types": "./dist/execution.contract.d.ts", "default": "./dist/execution.contract.js" },
+    "./implementations.contract": { "types": "./dist/implementations.contract.d.ts", "default": "./dist/implementations.contract.js" },
+    "./intent.contract": { "types": "./dist/intent.contract.d.ts", "default": "./dist/intent.contract.js" },
+    "./logs.contract": { "types": "./dist/logs.contract.d.ts", "default": "./dist/logs.contract.js" },
+    "./messages.contract": { "types": "./dist/messages.contract.d.ts", "default": "./dist/messages.contract.js" },
+    "./policies.contract": { "types": "./dist/policies.contract.d.ts", "default": "./dist/policies.contract.js" },
+    "./prompts.contract": { "types": "./dist/prompts.contract.d.ts", "default": "./dist/prompts.contract.js" },
+    "./provider.contract": { "types": "./dist/provider.contract.d.ts", "default": "./dist/provider.contract.js" },
+    "./service-tokens.contract": { "types": "./dist/service-tokens.contract.d.ts", "default": "./dist/service-tokens.contract.js" },
+    "./session.contract": { "types": "./dist/session.contract.d.ts", "default": "./dist/session.contract.js" }
+  },
+  "typesVersions": {
+    "*": {
+      "asset.contract": ["dist/asset.contract.d.ts"],
+      "storage.credentials.contract": ["dist/storage.credentials.contract.d.ts"],
+      "runtime.client": ["dist/runtime.client.d.ts"],
+      "cache.contract": ["dist/cache.contract.d.ts"],
+      "capabilities.contract": ["dist/capabilities.contract.d.ts"],
+      "control.contract": ["dist/control.contract.d.ts"],
+      "credentials.contract": ["dist/credentials.contract.d.ts"],
+      "subscription.contract": ["dist/subscription.contract.d.ts"],
+      "utils.contract": ["dist/utils.contract.d.ts"],
+      "prompt-variable-schema.contract": ["dist/prompt-variable-schema.contract.d.ts"],
+      "registry.stats.contract": ["dist/registry.stats.contract.d.ts"],
+      "http.contract": ["dist/http.contract.d.ts"],
+      "entitlements.contract": ["dist/entitlements.contract.d.ts"],
+      "errors.contract": ["dist/errors.contract.d.ts"],
+      "execution.contract": ["dist/execution.contract.d.ts"],
+      "implementations.contract": ["dist/implementations.contract.d.ts"],
+      "intent.contract": ["dist/intent.contract.d.ts"],
+      "logs.contract": ["dist/logs.contract.d.ts"],
+      "messages.contract": ["dist/messages.contract.d.ts"],
+      "policies.contract": ["dist/policies.contract.d.ts"],
+      "prompts.contract": ["dist/prompts.contract.d.ts"],
+      "provider.contract": ["dist/provider.contract.d.ts"],
+      "service-tokens.contract": ["dist/service-tokens.contract.d.ts"],
+      "session.contract": ["dist/session.contract.d.ts"]
+    }
   },
   "dependencies": {
     "class-validator": "^0.15.1"