@treeseed/sdk 0.12.62 → 0.13.0-rc.10

package/dist/secrets-capability.d.ts

@@ -1,421 +0,0 @@
-export declare const TREESEED_SECRET_CUSTODY_MODES: readonly ["github_actions_secret_enclave", "client_encrypted_escrow", "metadata_only_reentry", "host_env_injection", "bootstrap_service_secret", "provider_owned_secret", "external_vault_reference"];
-export declare const TREESEED_V1_REPOSITORY_CREDENTIAL_PROVIDERS: readonly ["github-app"];
-export declare const TREESEED_SECRET_CLASSES: readonly ["repository_access", "workflow_secret", "host_runtime_secret", "provider_runtime_secret", "bootstrap_service_secret", "customer_project_secret"];
-export declare const TREESEED_PROVIDER_WORKSPACE_ACCESS_MODES: readonly ["full_repository_workspace", "brokered_file_collection", "workflow_operation_only"];
-export declare const TREESEED_WORKFLOW_OPERATION_DISPATCH_MODES: readonly ["allowlisted"];
-export declare const TREESEED_SECRET_METADATA_RECORD_STATUSES: readonly ["active", "migrated", "tombstoned", "blocked"];
-export declare const TREESEED_GITHUB_REPOSITORY_GRANT_STATUSES: readonly ["active", "drifted", "revoked", "blocked"];
-export declare const TREESEED_GITHUB_APP_INSTALLATION_STATUSES: readonly ["active", "drifted", "revoked", "suspended", "blocked"];
-export declare const TREESEED_GITHUB_APP_TOKEN_ISSUANCE_STATUSES: readonly ["issued", "expired", "revoked", "blocked"];
-export declare const TREESEED_WORKFLOW_OPERATION_RECORD_STATUSES: readonly ["active", "blocked", "drifted", "archived"];
-export declare const TREESEED_WORKFLOW_DISPATCH_RECORD_STATUSES: readonly ["queued", "dispatched", "running", "succeeded", "failed", "cancelled", "blocked"];
-export declare const TREESEED_TREEDX_CREDENTIAL_ISSUANCE_STATUSES: readonly ["issued", "expired", "revoked", "blocked"];
-export declare const TREESEED_TREEDX_CREDENTIAL_BRIDGE_OPERATIONS: readonly ["clone", "fetch", "save", "commit", "push", "pull_request", "repository_update"];
-export declare const TREESEED_SECRET_CAPABILITY_FAIL_CLOSED_CODES: readonly ["github_grant_revoked", "github_grant_drifted", "github_installation_missing", "github_installation_revoked", "github_installation_suspended", "github_repository_removed", "github_account_mismatch", "github_permission_drift", "github_app_token_blocked", "github_environment_missing", "workflow_trust_drift", "workflow_dispatch_blocked", "treedx_credential_expired", "treedx_credential_revoked", "assignment_lease_revoked"];
-export declare const TREESEED_CLIENT_ENCRYPTED_ESCROW_STATUSES: readonly ["active", "migrated", "expired", "tombstoned", "reentry_required"];
-export type TreeseedSecretCustodyMode = (typeof TREESEED_SECRET_CUSTODY_MODES)[number];
-export type TreeseedV1RepositoryCredentialProvider = (typeof TREESEED_V1_REPOSITORY_CREDENTIAL_PROVIDERS)[number];
-export type TreeseedSecretClass = (typeof TREESEED_SECRET_CLASSES)[number];
-export type TreeseedProviderWorkspaceAccessMode = (typeof TREESEED_PROVIDER_WORKSPACE_ACCESS_MODES)[number];
-export type TreeseedWorkflowOperationDispatchMode = (typeof TREESEED_WORKFLOW_OPERATION_DISPATCH_MODES)[number];
-export type TreeseedSecretMetadataRecordStatus = (typeof TREESEED_SECRET_METADATA_RECORD_STATUSES)[number];
-export type TreeseedGitHubRepositoryGrantStatus = (typeof TREESEED_GITHUB_REPOSITORY_GRANT_STATUSES)[number];
-export type TreeseedGitHubAppInstallationStatus = (typeof TREESEED_GITHUB_APP_INSTALLATION_STATUSES)[number];
-export type TreeseedGitHubAppTokenIssuanceStatus = (typeof TREESEED_GITHUB_APP_TOKEN_ISSUANCE_STATUSES)[number];
-export type TreeseedWorkflowOperationRecordStatus = (typeof TREESEED_WORKFLOW_OPERATION_RECORD_STATUSES)[number];
-export type TreeseedWorkflowDispatchRecordStatus = (typeof TREESEED_WORKFLOW_DISPATCH_RECORD_STATUSES)[number];
-export type TreeseedTreeDxCredentialIssuanceStatus = (typeof TREESEED_TREEDX_CREDENTIAL_ISSUANCE_STATUSES)[number];
-export type TreeseedTreeDxCredentialBridgeOperation = (typeof TREESEED_TREEDX_CREDENTIAL_BRIDGE_OPERATIONS)[number];
-export type TreeseedSecretCapabilityFailClosedCode = (typeof TREESEED_SECRET_CAPABILITY_FAIL_CLOSED_CODES)[number];
-export type TreeseedClientEncryptedEscrowStatus = (typeof TREESEED_CLIENT_ENCRYPTED_ESCROW_STATUSES)[number];
-export type TreeseedSecretOwnerKind = 'customer' | 'treeseed' | 'provider';
-export type TreeseedRepositoryAuthorityDefault = 'github-app' | 'github-actions-secret-enclave';
-export type TreeseedGitHubSecretScope = 'repository' | 'environment';
-export interface TreeseedSecretOwner {
-    kind: TreeseedSecretOwnerKind | string;
-    teamId?: string | null;
-    projectId?: string | null;
-    providerId?: string | null;
-}
-export interface TreeseedSecretMetadata {
-    id: string;
-    name: string;
-    secretClass: TreeseedSecretClass | string;
-    custodyMode: TreeseedSecretCustodyMode | string;
-    owner: TreeseedSecretOwner;
-    apiDecryptable?: boolean;
-    plaintextAllowed?: boolean;
-    metadata?: Record<string, unknown>;
-}
-export interface TreeseedSecretMetadataRecord extends TreeseedSecretMetadata {
-    teamId: string;
-    projectId?: string | null;
-    status: TreeseedSecretMetadataRecordStatus | string;
-    githubSecretTarget?: {
-        repository?: string | null;
-        environment?: string | null;
-        secretName?: string | null;
-        scope?: TreeseedGitHubSecretScope | string | null;
-    } | null;
-    escrowRecordId?: string | null;
-    failClosedCode?: TreeseedSecretCapabilityFailClosedCode | string | null;
-    createdAt?: string;
-    updatedAt?: string;
-    tombstonedAt?: string | null;
-}
-export interface TreeseedClientEncryptedEscrowMetadata {
-    id: string;
-    secretId: string;
-    ciphertext?: string | null;
-    ciphertextRef: string;
-    algorithm: string;
-    nonce?: string | null;
-    salt?: string | null;
-    kdf?: string | null;
-    kdfParams?: Record<string, unknown> | null;
-    wrappingKeyId: string;
-    encryptionVersion?: string | null;
-    createdByClientId?: string | null;
-    createdAt?: string | null;
-    expiresAt?: string | null;
-    deploymentIntent?: {
-        targetMode?: 'github_actions_secret_enclave' | 'host_env_injection' | 'metadata_only_reentry' | string;
-        repository?: string | null;
-        environment?: string | null;
-        secretName?: string | null;
-        hostKind?: string | null;
-        hostId?: string | null;
-        metadata?: Record<string, unknown>;
-    } | null;
-    migratedTo?: 'github_actions_secret_enclave' | 'host_env_injection' | 'metadata_only_reentry' | null;
-    tombstonedAt?: string | null;
-    metadata?: Record<string, unknown>;
-}
-export interface TreeseedClientEncryptedEscrowEnvelopeInput extends TreeseedClientEncryptedEscrowMetadata {
-    teamId?: string | null;
-    projectId?: string | null;
-    status?: TreeseedClientEncryptedEscrowStatus | string;
-}
-export interface TreeseedClientEncryptedEscrowStatusSummary {
-    status: TreeseedClientEncryptedEscrowStatus | string;
-    escrowed: boolean;
-    migrated: boolean;
-    expired: boolean;
-    tombstoned: boolean;
-    reentryRequired: boolean;
-    migrationTarget?: string | null;
-    expiresAt?: string | null;
-}
-export interface TreeseedGitHubRepositoryGrantRecord {
-    id: string;
-    teamId: string;
-    projectId?: string | null;
-    repository: string;
-    installationId?: string | null;
-    accountLogin?: string | null;
-    accountId?: string | null;
-    status: TreeseedGitHubRepositoryGrantStatus | string;
-    permissions?: Record<string, unknown>;
-    environments?: string[];
-    driftCode?: TreeseedSecretCapabilityFailClosedCode | string | null;
-    observedAt?: string | null;
-    revokedAt?: string | null;
-    metadata?: Record<string, unknown>;
-    createdAt?: string;
-    updatedAt?: string;
-}
-export interface TreeseedGitHubAppInstallationRecord {
-    id: string;
-    teamId: string;
-    installationId: string;
-    accountLogin?: string | null;
-    accountId?: string | null;
-    accountType?: string | null;
-    status: TreeseedGitHubAppInstallationStatus | string;
-    permissions?: Record<string, unknown>;
-    repositorySelection?: string | null;
-    driftCode?: TreeseedSecretCapabilityFailClosedCode | string | null;
-    observedAt?: string | null;
-    revokedAt?: string | null;
-    suspendedAt?: string | null;
-    metadata?: Record<string, unknown>;
-    createdAt?: string;
-    updatedAt?: string;
-}
-export interface TreeseedGitHubAppTokenIssuanceRecord {
-    id: string;
-    teamId: string;
-    projectId?: string | null;
-    assignmentId?: string | null;
-    providerId?: string | null;
-    workdayId?: string | null;
-    operationId?: string | null;
-    repository: string;
-    installationId: string;
-    status: TreeseedGitHubAppTokenIssuanceStatus | string;
-    tokenPrefix?: string | null;
-    tokenHash?: string | null;
-    permissions?: Record<string, unknown>;
-    allowedOperations?: string[];
-    expiresAt?: string | null;
-    issuedAt?: string | null;
-    revokedAt?: string | null;
-    failClosedCode?: TreeseedSecretCapabilityFailClosedCode | string | null;
-    metadata?: Record<string, unknown>;
-    createdAt?: string;
-    updatedAt?: string;
-}
-export interface TreeseedWorkflowOperationRecord extends TreeseedWorkflowOperationContract {
-    teamId: string;
-    projectId?: string | null;
-    status: TreeseedWorkflowOperationRecordStatus | string;
-    failClosedCode?: TreeseedSecretCapabilityFailClosedCode | string | null;
-    createdAt?: string;
-    updatedAt?: string;
-    blockedAt?: string | null;
-}
-export interface TreeseedWorkflowDispatchRecord {
-    id: string;
-    teamId: string;
-    projectId?: string | null;
-    workflowOperationId: string;
-    platformOperationId?: string | null;
-    repository: string;
-    workflowFile: string;
-    ref?: string | null;
-    status: TreeseedWorkflowDispatchRecordStatus | string;
-    inputs?: Record<string, unknown>;
-    result?: Record<string, unknown> | null;
-    failClosedCode?: TreeseedSecretCapabilityFailClosedCode | string | null;
-    createdAt?: string;
-    updatedAt?: string;
-    dispatchedAt?: string | null;
-    completedAt?: string | null;
-}
-export interface TreeseedTreeDxCredentialIssuanceRecord {
-    id: string;
-    teamId: string;
-    projectId: string;
-    assignmentId?: string | null;
-    repository?: string | null;
-    credentialProvider: 'github-app';
-    status: TreeseedTreeDxCredentialIssuanceStatus | string;
-    tokenPrefix?: string | null;
-    tokenHash?: string | null;
-    scopes?: string[];
-    allowedOperations?: string[];
-    expiresAt?: string | null;
-    issuedAt?: string | null;
-    revokedAt?: string | null;
-    failClosedCode?: TreeseedSecretCapabilityFailClosedCode | string | null;
-    metadata?: Record<string, unknown>;
-    createdAt?: string;
-    updatedAt?: string;
-}
-export interface TreeseedTreeDxCredentialBridgeRequest {
-    teamId: string;
-    projectId: string;
-    repository: string;
-    installationId: string;
-    operation: TreeseedTreeDxCredentialBridgeOperation | string;
-    credentialId?: string | null;
-    ref?: string | null;
-    paths?: string[];
-    assignmentId?: string | null;
-    providerId?: string | null;
-    workdayId?: string | null;
-    actor?: Record<string, unknown> | null;
-    policy?: {
-        allowedRefs?: string[];
-        allowedPathPrefixes?: string[];
-        requireAssignment?: boolean;
-        requireProvider?: boolean;
-        requireWorkday?: boolean;
-    } | null;
-    metadata?: Record<string, unknown>;
-}
-export interface TreeseedTreeDxCredentialBridgeCredential {
-    id: string;
-    type: 'token';
-    username: 'x-access-token' | string;
-    token: string;
-    expiresAt?: string | null;
-    provider: 'github-app' | string;
-    repository: string;
-    allowedOperations: string[];
-    issuanceId?: string | null;
-}
-export interface TreeseedGitHubAppRepositoryCredentialProviderConfig {
-    type: 'github-app';
-    appIdEnv?: string;
-    privateKeySecretRef?: string;
-    webhookSecretRef?: string;
-    installationSelection?: 'owner' | 'repository' | 'explicit';
-    requiredPermissions?: {
-        contents?: 'read' | 'write';
-        metadata?: 'read';
-        actions?: 'read' | 'write';
-        secrets?: 'read' | 'write';
-        environments?: 'read' | 'write';
-        [key: string]: string | undefined;
-    };
-    metadata?: Record<string, unknown>;
-}
-export interface TreeseedRepositoryCredentialProviderRegistry {
-    githubApp?: TreeseedGitHubAppRepositoryCredentialProviderConfig;
-}
-export interface TreeseedGitHubActionsSecretStoreConfig {
-    type: 'github-actions';
-    defaultScope: TreeseedGitHubSecretScope;
-    protectedEnvironments?: string[];
-    requiredSecretNamePrefix?: string;
-    allowRepositorySecrets?: boolean;
-    allowEnvironmentSecrets?: boolean;
-    metadata?: Record<string, unknown>;
-}
-export interface TreeseedGitHubActionsSecretPublicKeyMetadata {
-    repository: string;
-    scope: TreeseedGitHubSecretScope | string;
-    environment?: string | null;
-    keyId: string;
-    key: string;
-    observedAt?: string | null;
-    metadata?: Record<string, unknown>;
-}
-export interface TreeseedGitHubActionsEncryptedSecretDeployment {
-    secretId?: string | null;
-    repository: string;
-    scope: TreeseedGitHubSecretScope | string;
-    environment?: string | null;
-    secretName: string;
-    encryptedValue: string;
-    keyId: string;
-    metadata?: Record<string, unknown>;
-}
-export interface TreeseedWorkflowOperationInputContract {
-    name: string;
-    required?: boolean;
-    secretBearing?: boolean;
-    allowedValues?: string[];
-}
-export interface TreeseedWorkflowOperationTrustPolicy {
-    protectedRefs?: string[];
-    protectedEnvironments?: string[];
-    allowedWorkflowFiles?: string[];
-    artifactPolicy?: 'none' | 'metadata_only' | 'allowlisted';
-    cachePolicy?: 'disabled' | 'metadata_only' | 'allowlisted';
-    allowUntrustedCheckout?: boolean;
-    allowLocalActions?: boolean;
-    timeoutSeconds?: number;
-    concurrencyGroup?: string | null;
-    outputObservation?: 'status_only' | 'metadata_and_artifacts';
-    cloudAccess?: {
-        oidcPreferred?: boolean;
-        longLivedSecrets?: boolean;
-        diagnosticOnly?: boolean;
-    } | null;
-}
-export interface TreeseedTrustedExecutionSet {
-    id: string;
-    repository: string;
-    protectedRefs: string[];
-    protectedEnvironments?: string[];
-    allowedWorkflowFiles: string[];
-    allowProviderSuppliedCommands?: boolean;
-    allowLocalActions?: boolean;
-    allowUntrustedCheckout?: boolean;
-    metadata?: Record<string, unknown>;
-}
-export interface TreeseedWorkflowOperationContract {
-    id: string;
-    name: string;
-    repository: string;
-    workflowFile: string;
-    secretBearing: boolean;
-    trustedExecutionSetId: string;
-    dispatch: {
-        mode: TreeseedWorkflowOperationDispatchMode | string;
-        arbitraryDispatch?: boolean;
-    };
-    inputs?: TreeseedWorkflowOperationInputContract[];
-    secretClasses?: Array<TreeseedSecretClass | string>;
-    providerSuppliedCommandsAllowed?: boolean;
-    trustPolicy?: TreeseedWorkflowOperationTrustPolicy;
-    metadata?: Record<string, unknown>;
-}
-export interface TreeseedWorkflowOperationsRegistry {
-    trustedExecutionSets?: TreeseedTrustedExecutionSet[];
-    operations?: TreeseedWorkflowOperationContract[];
-}
-export interface TreeseedClientEncryptedEscrowRegistry {
-    enabled: boolean;
-    defaultAlgorithm?: string;
-    metadataRecords?: TreeseedClientEncryptedEscrowMetadata[];
-    metadata?: Record<string, unknown>;
-}
-export interface TreeseedTreeDxCredentialBridgeConfig {
-    enabled: boolean;
-    credentialProvider: 'github-app';
-    allowedOperations: Array<'clone' | 'fetch' | 'save' | 'commit' | 'push'>;
-    tokenTtlSeconds?: number;
-    metadata?: Record<string, unknown>;
-}
-export interface TreeseedSecretWrappingConfig {
-    clientSideOnlyForCustomerProjectSecrets: boolean;
-    teamRecoveryKeySupported?: boolean;
-    metadata?: Record<string, unknown>;
-}
-export interface TreeseedRepositoryAuthorityDefaults {
-    repositoryCredentialProvider: TreeseedRepositoryAuthorityDefault;
-    secretStore: 'github-actions';
-    workflowDispatch: 'allowlisted-github-actions';
-    metadata?: Record<string, unknown>;
-}
-export interface TreeseedCapacityProviderWorkspaceDefaults {
-    accessMode: TreeseedProviderWorkspaceAccessMode;
-    receivesSecrets: false;
-    receivesCredentialHandles: boolean;
-    workflowOperationHandlesOnly?: boolean;
-    metadata?: Record<string, unknown>;
-}
-export interface TreeseedSecretsCapabilityRegistry {
-    repositoryCredentialProviders: TreeseedRepositoryCredentialProviderRegistry;
-    githubActionsSecretStore?: TreeseedGitHubActionsSecretStoreConfig;
-    workflowOperations?: TreeseedWorkflowOperationsRegistry;
-    clientEncryptedEscrow?: TreeseedClientEncryptedEscrowRegistry;
-    treeDxCredentialBridge?: TreeseedTreeDxCredentialBridgeConfig;
-    secretWrapping?: TreeseedSecretWrappingConfig;
-    repositoryAuthorityDefaults?: TreeseedRepositoryAuthorityDefaults;
-    capacityProviderWorkspaceDefaults?: TreeseedCapacityProviderWorkspaceDefaults;
-    secrets?: TreeseedSecretMetadata[];
-}
-export interface TreeseedSecretsCapabilityRegistryProblem {
-    path: string;
-    code: 'unsupported_repository_credential_provider' | 'api_decryptable_customer_secret' | 'arbitrary_secret_workflow_dispatch' | 'provider_secret_delegation' | 'plaintext_escrow_material' | 'invalid_secret_custody_target' | 'invalid_registry';
-    message: string;
-}
-export interface TreeseedSecretsCapabilityRegistryValidation {
-    ok: boolean;
-    problems: TreeseedSecretsCapabilityRegistryProblem[];
-    registry: TreeseedSecretsCapabilityRegistry | null;
-}
-export declare function containsTreeseedPlaintextSecretMaterial(value: unknown): boolean;
-export declare function isTreeseedSecretCustodyMode(value: unknown): value is TreeseedSecretCustodyMode;
-export declare function isTreeseedV1RepositoryCredentialProvider(value: unknown): value is TreeseedV1RepositoryCredentialProvider;
-export declare function requiresClientSideSecretMaterial(mode: TreeseedSecretCustodyMode | string): boolean;
-export declare function isApiServiceDecryptableCustomerSecret(metadata: Pick<TreeseedSecretMetadata, 'owner' | 'apiDecryptable'>): boolean;
-export declare function validateTreeseedWritableSecretMetadata(input: unknown, path?: string): TreeseedSecretsCapabilityRegistryProblem[];
-export declare function assertTreeseedWritableSecretMetadata(input: unknown): TreeseedSecretMetadata;
-export declare function validateTreeseedClientEncryptedEscrowMetadata(input: unknown, path?: string): TreeseedSecretsCapabilityRegistryProblem[];
-export declare function assertTreeseedClientEncryptedEscrowMetadata(input: unknown): TreeseedClientEncryptedEscrowMetadata;
-export declare function buildTreeseedClientEncryptedEscrowEnvelope(input: TreeseedClientEncryptedEscrowEnvelopeInput): TreeseedClientEncryptedEscrowEnvelopeInput;
-export declare function summarizeTreeseedClientEncryptedEscrowStatus(input: Pick<TreeseedClientEncryptedEscrowEnvelopeInput, 'status' | 'expiresAt' | 'migratedTo' | 'tombstonedAt'>, now?: Date): TreeseedClientEncryptedEscrowStatusSummary;
-export declare function summarizeTreeseedWorkflowCloudAccessDiagnostics(operation: Pick<TreeseedWorkflowOperationContract, 'secretBearing' | 'trustPolicy' | 'metadata'>): Array<{
-    code: 'oidc_preferred_for_cloud_access';
-    severity: 'warning';
-    message: string;
-}>;
-export declare function validateTreeseedGitHubActionsEncryptedSecretDeployment(input: unknown, path?: string): TreeseedSecretsCapabilityRegistryProblem[];
-export declare function assertTreeseedGitHubActionsEncryptedSecretDeployment(input: unknown): TreeseedGitHubActionsEncryptedSecretDeployment;
-export declare function validateTreeseedSecretsCapabilityRegistry(input: unknown): TreeseedSecretsCapabilityRegistryValidation;
-export declare function assertTreeseedSecretsCapabilityRegistry(input: unknown): TreeseedSecretsCapabilityRegistry;