@treeseed/sdk 0.10.28 → 0.12.4

package/dist/secrets-capability.d.ts

@@ -0,0 +1,421 @@
+export declare const TREESEED_SECRET_CUSTODY_MODES: readonly ["github_actions_secret_enclave", "client_encrypted_escrow", "metadata_only_reentry", "host_env_injection", "bootstrap_service_secret", "provider_owned_secret", "external_vault_reference"];
+export declare const TREESEED_V1_REPOSITORY_CREDENTIAL_PROVIDERS: readonly ["github-app"];
+export declare const TREESEED_SECRET_CLASSES: readonly ["repository_access", "workflow_secret", "host_runtime_secret", "provider_runtime_secret", "bootstrap_service_secret", "customer_project_secret"];
+export declare const TREESEED_PROVIDER_WORKSPACE_ACCESS_MODES: readonly ["full_repository_workspace", "brokered_file_collection", "workflow_operation_only"];
+export declare const TREESEED_WORKFLOW_OPERATION_DISPATCH_MODES: readonly ["allowlisted"];
+export declare const TREESEED_SECRET_METADATA_RECORD_STATUSES: readonly ["active", "migrated", "tombstoned", "blocked"];
+export declare const TREESEED_GITHUB_REPOSITORY_GRANT_STATUSES: readonly ["active", "drifted", "revoked", "blocked"];
+export declare const TREESEED_GITHUB_APP_INSTALLATION_STATUSES: readonly ["active", "drifted", "revoked", "suspended", "blocked"];
+export declare const TREESEED_GITHUB_APP_TOKEN_ISSUANCE_STATUSES: readonly ["issued", "expired", "revoked", "blocked"];
+export declare const TREESEED_WORKFLOW_OPERATION_RECORD_STATUSES: readonly ["active", "blocked", "drifted", "archived"];
+export declare const TREESEED_WORKFLOW_DISPATCH_RECORD_STATUSES: readonly ["queued", "dispatched", "running", "succeeded", "failed", "cancelled", "blocked"];
+export declare const TREESEED_TREEDX_CREDENTIAL_ISSUANCE_STATUSES: readonly ["issued", "expired", "revoked", "blocked"];
+export declare const TREESEED_TREEDX_CREDENTIAL_BRIDGE_OPERATIONS: readonly ["clone", "fetch", "save", "commit", "push", "pull_request", "repository_update"];
+export declare const TREESEED_SECRET_CAPABILITY_FAIL_CLOSED_CODES: readonly ["github_grant_revoked", "github_grant_drifted", "github_installation_missing", "github_installation_revoked", "github_installation_suspended", "github_repository_removed", "github_account_mismatch", "github_permission_drift", "github_app_token_blocked", "github_environment_missing", "workflow_trust_drift", "workflow_dispatch_blocked", "treedx_credential_expired", "treedx_credential_revoked", "assignment_lease_revoked"];
+export declare const TREESEED_CLIENT_ENCRYPTED_ESCROW_STATUSES: readonly ["active", "migrated", "expired", "tombstoned", "reentry_required"];
+export type TreeseedSecretCustodyMode = (typeof TREESEED_SECRET_CUSTODY_MODES)[number];
+export type TreeseedV1RepositoryCredentialProvider = (typeof TREESEED_V1_REPOSITORY_CREDENTIAL_PROVIDERS)[number];
+export type TreeseedSecretClass = (typeof TREESEED_SECRET_CLASSES)[number];
+export type TreeseedProviderWorkspaceAccessMode = (typeof TREESEED_PROVIDER_WORKSPACE_ACCESS_MODES)[number];
+export type TreeseedWorkflowOperationDispatchMode = (typeof TREESEED_WORKFLOW_OPERATION_DISPATCH_MODES)[number];
+export type TreeseedSecretMetadataRecordStatus = (typeof TREESEED_SECRET_METADATA_RECORD_STATUSES)[number];
+export type TreeseedGitHubRepositoryGrantStatus = (typeof TREESEED_GITHUB_REPOSITORY_GRANT_STATUSES)[number];
+export type TreeseedGitHubAppInstallationStatus = (typeof TREESEED_GITHUB_APP_INSTALLATION_STATUSES)[number];
+export type TreeseedGitHubAppTokenIssuanceStatus = (typeof TREESEED_GITHUB_APP_TOKEN_ISSUANCE_STATUSES)[number];
+export type TreeseedWorkflowOperationRecordStatus = (typeof TREESEED_WORKFLOW_OPERATION_RECORD_STATUSES)[number];
+export type TreeseedWorkflowDispatchRecordStatus = (typeof TREESEED_WORKFLOW_DISPATCH_RECORD_STATUSES)[number];
+export type TreeseedTreeDxCredentialIssuanceStatus = (typeof TREESEED_TREEDX_CREDENTIAL_ISSUANCE_STATUSES)[number];
+export type TreeseedTreeDxCredentialBridgeOperation = (typeof TREESEED_TREEDX_CREDENTIAL_BRIDGE_OPERATIONS)[number];
+export type TreeseedSecretCapabilityFailClosedCode = (typeof TREESEED_SECRET_CAPABILITY_FAIL_CLOSED_CODES)[number];
+export type TreeseedClientEncryptedEscrowStatus = (typeof TREESEED_CLIENT_ENCRYPTED_ESCROW_STATUSES)[number];
+export type TreeseedSecretOwnerKind = 'customer' | 'treeseed' | 'provider';
+export type TreeseedRepositoryAuthorityDefault = 'github-app' | 'github-actions-secret-enclave';
+export type TreeseedGitHubSecretScope = 'repository' | 'environment';
+export interface TreeseedSecretOwner {
+    kind: TreeseedSecretOwnerKind | string;
+    teamId?: string | null;
+    projectId?: string | null;
+    providerId?: string | null;
+}
+export interface TreeseedSecretMetadata {
+    id: string;
+    name: string;
+    secretClass: TreeseedSecretClass | string;
+    custodyMode: TreeseedSecretCustodyMode | string;
+    owner: TreeseedSecretOwner;
+    apiDecryptable?: boolean;
+    plaintextAllowed?: boolean;
+    metadata?: Record<string, unknown>;
+}
+export interface TreeseedSecretMetadataRecord extends TreeseedSecretMetadata {
+    teamId: string;
+    projectId?: string | null;
+    status: TreeseedSecretMetadataRecordStatus | string;
+    githubSecretTarget?: {
+        repository?: string | null;
+        environment?: string | null;
+        secretName?: string | null;
+        scope?: TreeseedGitHubSecretScope | string | null;
+    } | null;
+    escrowRecordId?: string | null;
+    failClosedCode?: TreeseedSecretCapabilityFailClosedCode | string | null;
+    createdAt?: string;
+    updatedAt?: string;
+    tombstonedAt?: string | null;
+}
+export interface TreeseedClientEncryptedEscrowMetadata {
+    id: string;
+    secretId: string;
+    ciphertext?: string | null;
+    ciphertextRef: string;
+    algorithm: string;
+    nonce?: string | null;
+    salt?: string | null;
+    kdf?: string | null;
+    kdfParams?: Record<string, unknown> | null;
+    wrappingKeyId: string;
+    encryptionVersion?: string | null;
+    createdByClientId?: string | null;
+    createdAt?: string | null;
+    expiresAt?: string | null;
+    deploymentIntent?: {
+        targetMode?: 'github_actions_secret_enclave' | 'host_env_injection' | 'metadata_only_reentry' | string;
+        repository?: string | null;
+        environment?: string | null;
+        secretName?: string | null;
+        hostKind?: string | null;
+        hostId?: string | null;
+        metadata?: Record<string, unknown>;
+    } | null;
+    migratedTo?: 'github_actions_secret_enclave' | 'host_env_injection' | 'metadata_only_reentry' | null;
+    tombstonedAt?: string | null;
+    metadata?: Record<string, unknown>;
+}
+export interface TreeseedClientEncryptedEscrowEnvelopeInput extends TreeseedClientEncryptedEscrowMetadata {
+    teamId?: string | null;
+    projectId?: string | null;
+    status?: TreeseedClientEncryptedEscrowStatus | string;
+}
+export interface TreeseedClientEncryptedEscrowStatusSummary {
+    status: TreeseedClientEncryptedEscrowStatus | string;
+    escrowed: boolean;
+    migrated: boolean;
+    expired: boolean;
+    tombstoned: boolean;
+    reentryRequired: boolean;
+    migrationTarget?: string | null;
+    expiresAt?: string | null;
+}
+export interface TreeseedGitHubRepositoryGrantRecord {
+    id: string;
+    teamId: string;
+    projectId?: string | null;
+    repository: string;
+    installationId?: string | null;
+    accountLogin?: string | null;
+    accountId?: string | null;
+    status: TreeseedGitHubRepositoryGrantStatus | string;
+    permissions?: Record<string, unknown>;
+    environments?: string[];
+    driftCode?: TreeseedSecretCapabilityFailClosedCode | string | null;
+    observedAt?: string | null;
+    revokedAt?: string | null;
+    metadata?: Record<string, unknown>;
+    createdAt?: string;
+    updatedAt?: string;
+}
+export interface TreeseedGitHubAppInstallationRecord {
+    id: string;
+    teamId: string;
+    installationId: string;
+    accountLogin?: string | null;
+    accountId?: string | null;
+    accountType?: string | null;
+    status: TreeseedGitHubAppInstallationStatus | string;
+    permissions?: Record<string, unknown>;
+    repositorySelection?: string | null;
+    driftCode?: TreeseedSecretCapabilityFailClosedCode | string | null;
+    observedAt?: string | null;
+    revokedAt?: string | null;
+    suspendedAt?: string | null;
+    metadata?: Record<string, unknown>;
+    createdAt?: string;
+    updatedAt?: string;
+}
+export interface TreeseedGitHubAppTokenIssuanceRecord {
+    id: string;
+    teamId: string;
+    projectId?: string | null;
+    assignmentId?: string | null;
+    providerId?: string | null;
+    workdayId?: string | null;
+    operationId?: string | null;
+    repository: string;
+    installationId: string;
+    status: TreeseedGitHubAppTokenIssuanceStatus | string;
+    tokenPrefix?: string | null;
+    tokenHash?: string | null;
+    permissions?: Record<string, unknown>;
+    allowedOperations?: string[];
+    expiresAt?: string | null;
+    issuedAt?: string | null;
+    revokedAt?: string | null;
+    failClosedCode?: TreeseedSecretCapabilityFailClosedCode | string | null;
+    metadata?: Record<string, unknown>;
+    createdAt?: string;
+    updatedAt?: string;
+}
+export interface TreeseedWorkflowOperationRecord extends TreeseedWorkflowOperationContract {
+    teamId: string;
+    projectId?: string | null;
+    status: TreeseedWorkflowOperationRecordStatus | string;
+    failClosedCode?: TreeseedSecretCapabilityFailClosedCode | string | null;
+    createdAt?: string;
+    updatedAt?: string;
+    blockedAt?: string | null;
+}
+export interface TreeseedWorkflowDispatchRecord {
+    id: string;
+    teamId: string;
+    projectId?: string | null;
+    workflowOperationId: string;
+    platformOperationId?: string | null;
+    repository: string;
+    workflowFile: string;
+    ref?: string | null;
+    status: TreeseedWorkflowDispatchRecordStatus | string;
+    inputs?: Record<string, unknown>;
+    result?: Record<string, unknown> | null;
+    failClosedCode?: TreeseedSecretCapabilityFailClosedCode | string | null;
+    createdAt?: string;
+    updatedAt?: string;
+    dispatchedAt?: string | null;
+    completedAt?: string | null;
+}
+export interface TreeseedTreeDxCredentialIssuanceRecord {
+    id: string;
+    teamId: string;
+    projectId: string;
+    assignmentId?: string | null;
+    repository?: string | null;
+    credentialProvider: 'github-app';
+    status: TreeseedTreeDxCredentialIssuanceStatus | string;
+    tokenPrefix?: string | null;
+    tokenHash?: string | null;
+    scopes?: string[];
+    allowedOperations?: string[];
+    expiresAt?: string | null;
+    issuedAt?: string | null;
+    revokedAt?: string | null;
+    failClosedCode?: TreeseedSecretCapabilityFailClosedCode | string | null;
+    metadata?: Record<string, unknown>;
+    createdAt?: string;
+    updatedAt?: string;
+}
+export interface TreeseedTreeDxCredentialBridgeRequest {
+    teamId: string;
+    projectId: string;
+    repository: string;
+    installationId: string;
+    operation: TreeseedTreeDxCredentialBridgeOperation | string;
+    credentialId?: string | null;
+    ref?: string | null;
+    paths?: string[];
+    assignmentId?: string | null;
+    providerId?: string | null;
+    workdayId?: string | null;
+    actor?: Record<string, unknown> | null;
+    policy?: {
+        allowedRefs?: string[];
+        allowedPathPrefixes?: string[];
+        requireAssignment?: boolean;
+        requireProvider?: boolean;
+        requireWorkday?: boolean;
+    } | null;
+    metadata?: Record<string, unknown>;
+}
+export interface TreeseedTreeDxCredentialBridgeCredential {
+    id: string;
+    type: 'token';
+    username: 'x-access-token' | string;
+    token: string;
+    expiresAt?: string | null;
+    provider: 'github-app' | string;
+    repository: string;
+    allowedOperations: string[];
+    issuanceId?: string | null;
+}
+export interface TreeseedGitHubAppRepositoryCredentialProviderConfig {
+    type: 'github-app';
+    appIdEnv?: string;
+    privateKeySecretRef?: string;
+    webhookSecretRef?: string;
+    installationSelection?: 'owner' | 'repository' | 'explicit';
+    requiredPermissions?: {
+        contents?: 'read' | 'write';
+        metadata?: 'read';
+        actions?: 'read' | 'write';
+        secrets?: 'read' | 'write';
+        environments?: 'read' | 'write';
+        [key: string]: string | undefined;
+    };
+    metadata?: Record<string, unknown>;
+}
+export interface TreeseedRepositoryCredentialProviderRegistry {
+    githubApp?: TreeseedGitHubAppRepositoryCredentialProviderConfig;
+}
+export interface TreeseedGitHubActionsSecretStoreConfig {
+    type: 'github-actions';
+    defaultScope: TreeseedGitHubSecretScope;
+    protectedEnvironments?: string[];
+    requiredSecretNamePrefix?: string;
+    allowRepositorySecrets?: boolean;
+    allowEnvironmentSecrets?: boolean;
+    metadata?: Record<string, unknown>;
+}
+export interface TreeseedGitHubActionsSecretPublicKeyMetadata {
+    repository: string;
+    scope: TreeseedGitHubSecretScope | string;
+    environment?: string | null;
+    keyId: string;
+    key: string;
+    observedAt?: string | null;
+    metadata?: Record<string, unknown>;
+}
+export interface TreeseedGitHubActionsEncryptedSecretDeployment {
+    secretId?: string | null;
+    repository: string;
+    scope: TreeseedGitHubSecretScope | string;
+    environment?: string | null;
+    secretName: string;
+    encryptedValue: string;
+    keyId: string;
+    metadata?: Record<string, unknown>;
+}
+export interface TreeseedWorkflowOperationInputContract {
+    name: string;
+    required?: boolean;
+    secretBearing?: boolean;
+    allowedValues?: string[];
+}
+export interface TreeseedWorkflowOperationTrustPolicy {
+    protectedRefs?: string[];
+    protectedEnvironments?: string[];
+    allowedWorkflowFiles?: string[];
+    artifactPolicy?: 'none' | 'metadata_only' | 'allowlisted';
+    cachePolicy?: 'disabled' | 'metadata_only' | 'allowlisted';
+    allowUntrustedCheckout?: boolean;
+    allowLocalActions?: boolean;
+    timeoutSeconds?: number;
+    concurrencyGroup?: string | null;
+    outputObservation?: 'status_only' | 'metadata_and_artifacts';
+    cloudAccess?: {
+        oidcPreferred?: boolean;
+        longLivedSecrets?: boolean;
+        diagnosticOnly?: boolean;
+    } | null;
+}
+export interface TreeseedTrustedExecutionSet {
+    id: string;
+    repository: string;
+    protectedRefs: string[];
+    protectedEnvironments?: string[];
+    allowedWorkflowFiles: string[];
+    allowProviderSuppliedCommands?: boolean;
+    allowLocalActions?: boolean;
+    allowUntrustedCheckout?: boolean;
+    metadata?: Record<string, unknown>;
+}
+export interface TreeseedWorkflowOperationContract {
+    id: string;
+    name: string;
+    repository: string;
+    workflowFile: string;
+    secretBearing: boolean;
+    trustedExecutionSetId: string;
+    dispatch: {
+        mode: TreeseedWorkflowOperationDispatchMode | string;
+        arbitraryDispatch?: boolean;
+    };
+    inputs?: TreeseedWorkflowOperationInputContract[];
+    secretClasses?: Array<TreeseedSecretClass | string>;
+    providerSuppliedCommandsAllowed?: boolean;
+    trustPolicy?: TreeseedWorkflowOperationTrustPolicy;
+    metadata?: Record<string, unknown>;
+}
+export interface TreeseedWorkflowOperationsRegistry {
+    trustedExecutionSets?: TreeseedTrustedExecutionSet[];
+    operations?: TreeseedWorkflowOperationContract[];
+}
+export interface TreeseedClientEncryptedEscrowRegistry {
+    enabled: boolean;
+    defaultAlgorithm?: string;
+    metadataRecords?: TreeseedClientEncryptedEscrowMetadata[];
+    metadata?: Record<string, unknown>;
+}
+export interface TreeseedTreeDxCredentialBridgeConfig {
+    enabled: boolean;
+    credentialProvider: 'github-app';
+    allowedOperations: Array<'clone' | 'fetch' | 'save' | 'commit' | 'push'>;
+    tokenTtlSeconds?: number;
+    metadata?: Record<string, unknown>;
+}
+export interface TreeseedSecretWrappingConfig {
+    clientSideOnlyForCustomerProjectSecrets: boolean;
+    teamRecoveryKeySupported?: boolean;
+    metadata?: Record<string, unknown>;
+}
+export interface TreeseedRepositoryAuthorityDefaults {
+    repositoryCredentialProvider: TreeseedRepositoryAuthorityDefault;
+    secretStore: 'github-actions';
+    workflowDispatch: 'allowlisted-github-actions';
+    metadata?: Record<string, unknown>;
+}
+export interface TreeseedCapacityProviderWorkspaceDefaults {
+    accessMode: TreeseedProviderWorkspaceAccessMode;
+    receivesSecrets: false;
+    receivesCredentialHandles: boolean;
+    workflowOperationHandlesOnly?: boolean;
+    metadata?: Record<string, unknown>;
+}
+export interface TreeseedSecretsCapabilityRegistry {
+    repositoryCredentialProviders: TreeseedRepositoryCredentialProviderRegistry;
+    githubActionsSecretStore?: TreeseedGitHubActionsSecretStoreConfig;
+    workflowOperations?: TreeseedWorkflowOperationsRegistry;
+    clientEncryptedEscrow?: TreeseedClientEncryptedEscrowRegistry;
+    treeDxCredentialBridge?: TreeseedTreeDxCredentialBridgeConfig;
+    secretWrapping?: TreeseedSecretWrappingConfig;
+    repositoryAuthorityDefaults?: TreeseedRepositoryAuthorityDefaults;
+    capacityProviderWorkspaceDefaults?: TreeseedCapacityProviderWorkspaceDefaults;
+    secrets?: TreeseedSecretMetadata[];
+}
+export interface TreeseedSecretsCapabilityRegistryProblem {
+    path: string;
+    code: 'unsupported_repository_credential_provider' | 'api_decryptable_customer_secret' | 'arbitrary_secret_workflow_dispatch' | 'provider_secret_delegation' | 'plaintext_escrow_material' | 'invalid_secret_custody_target' | 'invalid_registry';
+    message: string;
+}
+export interface TreeseedSecretsCapabilityRegistryValidation {
+    ok: boolean;
+    problems: TreeseedSecretsCapabilityRegistryProblem[];
+    registry: TreeseedSecretsCapabilityRegistry | null;
+}
+export declare function containsTreeseedPlaintextSecretMaterial(value: unknown): boolean;
+export declare function isTreeseedSecretCustodyMode(value: unknown): value is TreeseedSecretCustodyMode;
+export declare function isTreeseedV1RepositoryCredentialProvider(value: unknown): value is TreeseedV1RepositoryCredentialProvider;
+export declare function requiresClientSideSecretMaterial(mode: TreeseedSecretCustodyMode | string): boolean;
+export declare function isApiServiceDecryptableCustomerSecret(metadata: Pick<TreeseedSecretMetadata, 'owner' | 'apiDecryptable'>): boolean;
+export declare function validateTreeseedWritableSecretMetadata(input: unknown, path?: string): TreeseedSecretsCapabilityRegistryProblem[];
+export declare function assertTreeseedWritableSecretMetadata(input: unknown): TreeseedSecretMetadata;
+export declare function validateTreeseedClientEncryptedEscrowMetadata(input: unknown, path?: string): TreeseedSecretsCapabilityRegistryProblem[];
+export declare function assertTreeseedClientEncryptedEscrowMetadata(input: unknown): TreeseedClientEncryptedEscrowMetadata;
+export declare function buildTreeseedClientEncryptedEscrowEnvelope(input: TreeseedClientEncryptedEscrowEnvelopeInput): TreeseedClientEncryptedEscrowEnvelopeInput;
+export declare function summarizeTreeseedClientEncryptedEscrowStatus(input: Pick<TreeseedClientEncryptedEscrowEnvelopeInput, 'status' | 'expiresAt' | 'migratedTo' | 'tombstonedAt'>, now?: Date): TreeseedClientEncryptedEscrowStatusSummary;
+export declare function summarizeTreeseedWorkflowCloudAccessDiagnostics(operation: Pick<TreeseedWorkflowOperationContract, 'secretBearing' | 'trustPolicy' | 'metadata'>): Array<{
+    code: 'oidc_preferred_for_cloud_access';
+    severity: 'warning';
+    message: string;
+}>;
+export declare function validateTreeseedGitHubActionsEncryptedSecretDeployment(input: unknown, path?: string): TreeseedSecretsCapabilityRegistryProblem[];
+export declare function assertTreeseedGitHubActionsEncryptedSecretDeployment(input: unknown): TreeseedGitHubActionsEncryptedSecretDeployment;
+export declare function validateTreeseedSecretsCapabilityRegistry(input: unknown): TreeseedSecretsCapabilityRegistryValidation;
+export declare function assertTreeseedSecretsCapabilityRegistry(input: unknown): TreeseedSecretsCapabilityRegistry;