@tangle-network/sdk-provider-claude-code 0.6.2 → 0.6.4

package/dist/index.mjs

@@ -178,6 +178,12 @@ function managedModelProxyUrl(input) {
 	const runtimeHome = input.runtimeHome?.trim();
 	return proxiedModelUrl(binding.baseUrl, input.upstream, { ...runtimeHome ? { runtimeHome } : {} });
 }
+//#endregion
+//#region ../runtime-contracts/dist/declared-secrets.js
+/** Bound values stay at the proxy. Declarations carry metadata only and are
+* revalidated at every rebuild; an unbound name keeps box delivery unless the store's policy binds it.
+* A declaration may bind several hosts: one credential, one slot and placeholder, many vendor hosts. */
+const MAX_SECRET_VALUE_LENGTH = 65536;
 new Set([
 	...Object.keys(MODEL_PROXY_TOKENS),
 	"TANGLE_API_KEY",
@@ -238,6 +244,48 @@ const HARNESS_WARM_TRANSPORT_ENV = {
 	}
 };
 //#endregion
+//#region ../runtime-contracts/dist/model-key-refresh.js
+const batchCredentialOwner = {
+	allocationId: z.uuid(),
+	ownerId: z.string().min(1).max(256)
+};
+z.strictObject({
+	...batchCredentialOwner,
+	childKeyId: z.string().min(1).max(200).optional(),
+	keyExpiresAt: z.iso.datetime({ offset: true }).optional()
+});
+const batchCredentialIdentity = {
+	...batchCredentialOwner,
+	expiresAt: z.iso.datetime({ offset: true })
+};
+z.discriminatedUnion("operation", [
+	z.strictObject({
+		operation: z.literal("batch-allocate"),
+		...batchCredentialIdentity,
+		admissionDeadlineMs: z.number().int().positive(),
+		sourceKey: z.string().min(1).max(4096)
+	}),
+	z.strictObject({
+		operation: z.literal("batch-rotate"),
+		...batchCredentialIdentity
+	}),
+	z.strictObject({
+		operation: z.literal("batch-release"),
+		...batchCredentialIdentity,
+		childKeyId: z.string().min(1).max(200).optional()
+	})
+]);
+z.union([z.object({
+	refreshed: z.literal(true),
+	apiKey: z.string().min(1),
+	keyId: z.string().min(1),
+	baseUrl: z.string().url(),
+	expiresAt: z.iso.datetime({ offset: true })
+}), z.object({
+	refreshed: z.literal(false),
+	reason: z.string().min(1)
+})]);
+//#endregion
 //#region ../runtime-contracts/dist/proxy-secret-materialization.js
 const syntheticHeader = {
 	alg: "HS256",
@@ -255,16 +303,24 @@ function isSyntheticPlaceholder(material) {
 	const prefix = placeholderPrefix(material.slot, material.grant.placeholderFormat, material.issuerExpiresAt);
 	return material.placeholder.startsWith(prefix) && /^[A-Za-z0-9_-]{43}$/.test(material.placeholder.slice(prefix.length));
 }
-z.array(z.strictObject({
+z.array(z.preprocess((input) => {
+	if (input && typeof input === "object" && "issuerExpiresAt" in input && (!("executionExpiresAt" in input) || input.executionExpiresAt === void 0) && (!("native" in input) || input.native === void 0)) return {
+		...input,
+		executionExpiresAt: input.issuerExpiresAt
+	};
+	return input;
+}, z.strictObject({
 	binding: ProxySecretBindingSchema,
 	grant: ProxySecretGrantSchema,
 	placeholder: z.string().min(1),
 	slot: z.string().refine(isDeclaredSecretSlotEnvVar),
-	issuerExpiresAt: z.iso.datetime()
-})).superRefine((materials, ctx) => {
+	issuerExpiresAt: z.iso.datetime(),
+	executionExpiresAt: z.iso.datetime(),
+	native: z.unknown().optional()
+}))).superRefine((materials, ctx) => {
 	const bindings = ProxySecretsSchema.safeParse(materials.map((m) => m.binding));
 	const unique = (values) => new Set(values).size === values.length;
-	if (!bindings.success || !unique(materials.map((m) => m.slot)) || !unique(materials.map((m) => m.placeholder)) || !unique(materials.map((m) => m.grant.grantId)) || new Set(materials.map((m) => m.grant.epoch)).size > 1 || new Set(materials.map((m) => m.grant.sandboxId)).size > 1 || materials.some((material) => !isSyntheticPlaceholder(material)) || materials.some(({ binding, grant, issuerExpiresAt }) => !isProxySecretScopeAttenuation(binding, grant.scope) || !proxySecretPresentationsEqual(binding.presentation, grant.presentation) || (binding.placeholderFormat ?? "opaque") !== grant.placeholderFormat || Date.parse(grant.expiresAt) > Date.parse(issuerExpiresAt))) ctx.addIssue({
+	if (!bindings.success || !unique(materials.map((m) => m.slot)) || !unique(materials.map((m) => m.placeholder)) || !unique(materials.map((m) => m.grant.grantId)) || new Set(materials.map((m) => m.grant.epoch)).size > 1 || new Set(materials.map((m) => m.grant.sandboxId)).size > 1 || materials.some((material) => !isSyntheticPlaceholder(material)) || materials.some(({ binding, grant, issuerExpiresAt, executionExpiresAt }) => !isProxySecretScopeAttenuation(binding, grant.scope) || !proxySecretPresentationsEqual(binding.presentation, grant.presentation) || (binding.placeholderFormat ?? "opaque") !== grant.placeholderFormat || Date.parse(grant.expiresAt) > Date.parse(executionExpiresAt) || Date.parse(executionExpiresAt) > Date.parse(issuerExpiresAt))) ctx.addIssue({
 		code: "custom",
 		message: "Invalid proxy secret materialization"
 	});
@@ -274,6 +330,114 @@ ProxySecretUpdateControlsSchema.extend({
 	proxySecretGrants: ProxySecretReceiptSchema.options[0].shape.bindings,
 	expectedProxySecretGeneration: ProxySecretUpdateControlsSchema.shape.expectedProxySecretGeneration.unwrap()
 }).strict().refine((body) => new Set(body.proxySecretGrants.map((b) => b.envName)).size === body.proxySecretGrants.length);
+const sourceBindingSchema = ProxySecretReceiptSchema.options[0].shape.bindings.element;
+const sourceRevisionSchema = z.iso.datetime();
+const sourceLeaseTokenSchema = z.uuid();
+const sourceAuthority = {
+	binding: sourceBindingSchema,
+	issuerExpiresAt: z.iso.datetime()
+};
+z.discriminatedUnion("operation", [
+	z.strictObject({
+		operation: z.literal("read"),
+		...sourceAuthority,
+		rekey: z.literal(true).optional()
+	}),
+	z.strictObject({
+		operation: z.literal("lease"),
+		...sourceAuthority,
+		expectedUpdatedAt: sourceRevisionSchema,
+		leaseExpiresAt: z.iso.datetime(),
+		leaseToken: sourceLeaseTokenSchema.optional()
+	}),
+	z.strictObject({
+		operation: z.literal("commit"),
+		...sourceAuthority,
+		expectedUpdatedAt: sourceRevisionSchema,
+		leaseToken: sourceLeaseTokenSchema,
+		value: z.string().min(1).max(MAX_SECRET_VALUE_LENGTH)
+	}),
+	z.strictObject({
+		operation: z.literal("release"),
+		...sourceAuthority,
+		leaseToken: sourceLeaseTokenSchema
+	})
+]);
+const sourceMetadataSchema = z.strictObject({
+	secretId: z.string().min(1),
+	key: ProxySecretBindingSchema.shape.secretRef.shape.key,
+	updatedAt: sourceRevisionSchema
+});
+const sourceSnapshotSchema = sourceMetadataSchema.extend({ value: z.string().min(1).max(MAX_SECRET_VALUE_LENGTH) });
+z.discriminatedUnion("operation", [
+	z.strictObject({
+		operation: z.literal("read"),
+		source: sourceSnapshotSchema,
+		binding: sourceBindingSchema,
+		refreshExpiresAt: z.iso.datetime()
+	}),
+	z.strictObject({
+		operation: z.literal("lease"),
+		source: sourceSnapshotSchema,
+		leaseToken: sourceLeaseTokenSchema,
+		leaseExpiresAt: z.iso.datetime(),
+		phase: z.enum([
+			"leased",
+			"started",
+			"replay"
+		]).default("leased")
+	}),
+	z.strictObject({
+		operation: z.literal("commit"),
+		source: sourceMetadataSchema
+	}),
+	z.strictObject({
+		operation: z.literal("release"),
+		released: z.literal(true)
+	})
+]);
+const nativeCredentialProtocolSchema = z.enum([
+	"legacy",
+	"canonical",
+	"unselected"
+]);
+z.strictObject({
+	nativeCredentialProtocol: nativeCredentialProtocolSchema,
+	priorExposure: z.boolean(),
+	containerId: z.string().min(1),
+	expectedProxySecretGeneration: ProxySecretUpdateControlsSchema.shape.expectedProxySecretGeneration,
+	authorityExpiresAt: z.iso.datetime().optional()
+});
+ownPropertyRecordSchema(z.strictObject({
+	revision: ProxySecretGrantSchema.shape.identity.shape.revision,
+	value: z.string().min(1).max(MAX_SECRET_VALUE_LENGTH),
+	refresh: z.strictObject({
+		revision: sourceRevisionSchema,
+		leaseToken: sourceLeaseTokenSchema
+	}).optional()
+}));
+z.strictObject({
+	grant: ProxySecretGrantSchema,
+	value: z.string().min(1).max(MAX_SECRET_VALUE_LENGTH),
+	expectedUpdatedAt: sourceRevisionSchema.optional(),
+	replayOnly: z.boolean().optional(),
+	leaseExpiresAt: z.iso.datetime()
+});
+z.discriminatedUnion("status", [
+	z.strictObject({
+		status: z.literal("refreshed"),
+		value: z.string().min(1).max(MAX_SECRET_VALUE_LENGTH),
+		sourceExpiresAt: z.iso.datetime().optional()
+	}),
+	z.strictObject({
+		status: z.literal("nonrefreshable"),
+		reason: z.string().min(1)
+	}),
+	z.strictObject({
+		status: z.literal("refused"),
+		reason: z.string().min(1)
+	})
+]);
 //#endregion
 //#region ../runtime-contracts/dist/runtime-environment.js
 const SAFE_ENV_VAR_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/sdk-provider-claude-code",
-  "version": "0.6.2",
+  "version": "0.6.4",
   "type": "module",
   "exports": {
     ".": {
@@ -17,9 +17,9 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.32.2",
     "@tangle-network/agent-interface": "^5.10.20",
-    "@tangle-network/agent-profile-materialize": "1.1.56",
+    "@tangle-network/agent-profile-materialize": "1.1.57",
     "@tangle-network/sdk-cli-runner": "0.3.9",
-    "@tangle-network/sdk-provider-cli-base": "0.13.19",
+    "@tangle-network/sdk-provider-cli-base": "0.13.21",
     "@tangle-network/sdk-session-persistence": "0.7.5",
     "zod": "4.6.7"
   },
@@ -35,8 +35,8 @@
     "registry": "https://registry.npmjs.org"
   },
   "tangleRelease": {
-    "sourceSha": "7f35269c55c7dbf9cc12ef1fd210bd1f9f8eab58",
-    "mergedAt": "2026-11-06T21:08:17-08:00"
+    "sourceSha": "11ec864cf47315566ae4b07a883e1c8637783d85",
+    "mergedAt": "2026-11-07T01:24:01-08:00"
   },
   "scripts": {
     "build": "tsdown",