@treeseed/sdk 0.13.0-rc.104 → 0.13.0-rc.106

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (13) hide show
  1. package/dist/.treeseed-build-complete.json +1 -1
  2. package/dist/deployment/hosted-topology-template.d.ts +7 -7
  3. package/dist/deployment/hosted-topology.d.ts +28 -28
  4. package/dist/development/schemas.d.ts +12 -12
  5. package/dist/entrypoints/clients/control-plane-client.d.ts +2 -1
  6. package/dist/identity/contracts.d.ts +59 -4
  7. package/dist/identity/contracts.js +17 -0
  8. package/dist/operator-contracts/canonical-command-tree.js +3 -8
  9. package/dist/operator-contracts/catalog/hosted-topology-operations.d.ts +4 -4
  10. package/dist/operator-contracts/catalog/services/identity-commands.d.ts +2 -0
  11. package/dist/operator-contracts/catalog/services/identity-commands.js +12 -0
  12. package/dist/operator-contracts/control-plane-operations.d.ts +4 -4
  13. package/package.json +2 -2
package/dist/.treeseed-build-complete.json CHANGED
@@ -1 +1 @@
1
- {"completedAt":"2026-09-09T07:10:39.587Z"}
1
+ {"completedAt":"2026-09-09T09:45:52.473Z"}
package/dist/deployment/hosted-topology-template.d.ts CHANGED
@@ -333,20 +333,20 @@ export declare const hostedTopologyArtifactInputsSchema: z.ZodObject<{
333
333
  digest: z.ZodString;
334
334
  identity: z.ZodString;
335
335
  }, "strict", z.ZodTypeAny, {
336
- kind: "oci-image";
337
336
  identity: string;
337
+ kind: "oci-image";
338
338
  digest: string;
339
339
  }, {
340
- kind: "oci-image";
341
340
  identity: string;
341
+ kind: "oci-image";
342
342
  digest: string;
343
343
  }>, {
344
- kind: "oci-image";
345
344
  identity: string;
345
+ kind: "oci-image";
346
346
  digest: string;
347
347
  }, {
348
- kind: "oci-image";
349
348
  identity: string;
349
+ kind: "oci-image";
350
350
  digest: string;
351
351
  }>]>>;
352
352
  }, "strict", z.ZodTypeAny, {
@@ -362,8 +362,8 @@ export declare const hostedTopologyArtifactInputsSchema: z.ZodObject<{
362
362
  source: string;
363
363
  mediaType: string;
364
364
  } | {
365
- kind: "oci-image";
366
365
  identity: string;
366
+ kind: "oci-image";
367
367
  digest: string;
368
368
  }>;
369
369
  }, {
@@ -379,8 +379,8 @@ export declare const hostedTopologyArtifactInputsSchema: z.ZodObject<{
379
379
  source: string;
380
380
  mediaType: string;
381
381
  } | {
382
- kind: "oci-image";
383
382
  identity: string;
383
+ kind: "oci-image";
384
384
  digest: string;
385
385
  }>;
386
386
  }>;
@@ -434,8 +434,8 @@ export declare function compileHostedTopologyTemplate(input: {
434
434
  source: string;
435
435
  mediaType: string;
436
436
  } | {
437
- kind: "oci-image";
438
437
  identity: string;
438
+ kind: "oci-image";
439
439
  digest: string;
440
440
  }>;
441
441
  deploymentId: string;
package/dist/deployment/hosted-topology.d.ts CHANGED
@@ -178,20 +178,20 @@ export declare const hostedArtifactSchema: z.ZodUnion<[z.ZodObject<{
178
178
  digest: z.ZodString;
179
179
  identity: z.ZodString;
180
180
  }, "strict", z.ZodTypeAny, {
181
- kind: "oci-image";
182
181
  identity: string;
182
+ kind: "oci-image";
183
183
  digest: string;
184
184
  }, {
185
- kind: "oci-image";
186
185
  identity: string;
186
+ kind: "oci-image";
187
187
  digest: string;
188
188
  }>, {
189
- kind: "oci-image";
190
189
  identity: string;
190
+ kind: "oci-image";
191
191
  digest: string;
192
192
  }, {
193
- kind: "oci-image";
194
193
  identity: string;
194
+ kind: "oci-image";
195
195
  digest: string;
196
196
  }>]>;
197
197
  declare const hostedConnectionSnapshotSchema: z.ZodEffects<z.ZodObject<{
@@ -380,20 +380,20 @@ export declare const hostedTopologyDeclarationSchema: z.ZodEffects<z.ZodObject<{
380
380
  digest: z.ZodString;
381
381
  identity: z.ZodString;
382
382
  }, "strict", z.ZodTypeAny, {
383
- kind: "oci-image";
384
383
  identity: string;
384
+ kind: "oci-image";
385
385
  digest: string;
386
386
  }, {
387
- kind: "oci-image";
388
387
  identity: string;
388
+ kind: "oci-image";
389
389
  digest: string;
390
390
  }>, {
391
- kind: "oci-image";
392
391
  identity: string;
392
+ kind: "oci-image";
393
393
  digest: string;
394
394
  }, {
395
- kind: "oci-image";
396
395
  identity: string;
396
+ kind: "oci-image";
397
397
  digest: string;
398
398
  }>]>>;
399
399
  resources: z.ZodArray<z.ZodObject<{
@@ -543,8 +543,8 @@ export declare const hostedTopologyDeclarationSchema: z.ZodEffects<z.ZodObject<{
543
543
  source: string;
544
544
  mediaType: string;
545
545
  } | {
546
- kind: "oci-image";
547
546
  identity: string;
547
+ kind: "oci-image";
548
548
  digest: string;
549
549
  }>;
550
550
  deploymentId: string;
@@ -599,8 +599,8 @@ export declare const hostedTopologyDeclarationSchema: z.ZodEffects<z.ZodObject<{
599
599
  source: string;
600
600
  mediaType: string;
601
601
  } | {
602
- kind: "oci-image";
603
602
  identity: string;
603
+ kind: "oci-image";
604
604
  digest: string;
605
605
  }>;
606
606
  deploymentId: string;
@@ -655,8 +655,8 @@ export declare const hostedTopologyDeclarationSchema: z.ZodEffects<z.ZodObject<{
655
655
  source: string;
656
656
  mediaType: string;
657
657
  } | {
658
- kind: "oci-image";
659
658
  identity: string;
659
+ kind: "oci-image";
660
660
  digest: string;
661
661
  }>;
662
662
  deploymentId: string;
@@ -711,8 +711,8 @@ export declare const hostedTopologyDeclarationSchema: z.ZodEffects<z.ZodObject<{
711
711
  source: string;
712
712
  mediaType: string;
713
713
  } | {
714
- kind: "oci-image";
715
714
  identity: string;
715
+ kind: "oci-image";
716
716
  digest: string;
717
717
  }>;
718
718
  deploymentId: string;
@@ -875,20 +875,20 @@ export declare const hostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<{
875
875
  digest: z.ZodString;
876
876
  identity: z.ZodString;
877
877
  }, "strict", z.ZodTypeAny, {
878
- kind: "oci-image";
879
878
  identity: string;
879
+ kind: "oci-image";
880
880
  digest: string;
881
881
  }, {
882
- kind: "oci-image";
883
882
  identity: string;
883
+ kind: "oci-image";
884
884
  digest: string;
885
885
  }>, {
886
- kind: "oci-image";
887
886
  identity: string;
887
+ kind: "oci-image";
888
888
  digest: string;
889
889
  }, {
890
- kind: "oci-image";
891
890
  identity: string;
891
+ kind: "oci-image";
892
892
  digest: string;
893
893
  }>]>>;
894
894
  readonly providerConnections: z.ZodRecord<z.ZodEnum<["cloudflare", "railway"]>, z.ZodEffects<z.ZodObject<{
@@ -1150,8 +1150,8 @@ export declare const hostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<{
1150
1150
  source: string;
1151
1151
  mediaType: string;
1152
1152
  } | {
1153
- kind: "oci-image";
1154
1153
  identity: string;
1154
+ kind: "oci-image";
1155
1155
  digest: string;
1156
1156
  }>;
1157
1157
  planId: string;
@@ -1235,8 +1235,8 @@ export declare const hostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<{
1235
1235
  source: string;
1236
1236
  mediaType: string;
1237
1237
  } | {
1238
- kind: "oci-image";
1239
1238
  identity: string;
1239
+ kind: "oci-image";
1240
1240
  digest: string;
1241
1241
  }>;
1242
1242
  planId: string;
@@ -1320,8 +1320,8 @@ export declare const hostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<{
1320
1320
  source: string;
1321
1321
  mediaType: string;
1322
1322
  } | {
1323
- kind: "oci-image";
1324
1323
  identity: string;
1324
+ kind: "oci-image";
1325
1325
  digest: string;
1326
1326
  }>;
1327
1327
  planId: string;
@@ -1405,8 +1405,8 @@ export declare const hostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<{
1405
1405
  source: string;
1406
1406
  mediaType: string;
1407
1407
  } | {
1408
- kind: "oci-image";
1409
1408
  identity: string;
1409
+ kind: "oci-image";
1410
1410
  digest: string;
1411
1411
  }>;
1412
1412
  planId: string;
@@ -1561,20 +1561,20 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodEffects<z.ZodObjec
1561
1561
  digest: z.ZodString;
1562
1562
  identity: z.ZodString;
1563
1563
  }, "strict", z.ZodTypeAny, {
1564
- kind: "oci-image";
1565
1564
  identity: string;
1565
+ kind: "oci-image";
1566
1566
  digest: string;
1567
1567
  }, {
1568
- kind: "oci-image";
1569
1568
  identity: string;
1569
+ kind: "oci-image";
1570
1570
  digest: string;
1571
1571
  }>, {
1572
- kind: "oci-image";
1573
1572
  identity: string;
1573
+ kind: "oci-image";
1574
1574
  digest: string;
1575
1575
  }, {
1576
- kind: "oci-image";
1577
1576
  identity: string;
1577
+ kind: "oci-image";
1578
1578
  digest: string;
1579
1579
  }>]>>;
1580
1580
  providerConnections: z.ZodRecord<z.ZodEnum<["cloudflare", "railway"]>, z.ZodEffects<z.ZodObject<{
@@ -1835,8 +1835,8 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodEffects<z.ZodObjec
1835
1835
  source: string;
1836
1836
  mediaType: string;
1837
1837
  } | {
1838
- kind: "oci-image";
1839
1838
  identity: string;
1839
+ kind: "oci-image";
1840
1840
  digest: string;
1841
1841
  }>;
1842
1842
  planId: string;
@@ -1920,8 +1920,8 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodEffects<z.ZodObjec
1920
1920
  source: string;
1921
1921
  mediaType: string;
1922
1922
  } | {
1923
- kind: "oci-image";
1924
1923
  identity: string;
1924
+ kind: "oci-image";
1925
1925
  digest: string;
1926
1926
  }>;
1927
1927
  planId: string;
@@ -2005,8 +2005,8 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodEffects<z.ZodObjec
2005
2005
  source: string;
2006
2006
  mediaType: string;
2007
2007
  } | {
2008
- kind: "oci-image";
2009
2008
  identity: string;
2009
+ kind: "oci-image";
2010
2010
  digest: string;
2011
2011
  }>;
2012
2012
  planId: string;
@@ -2090,8 +2090,8 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodEffects<z.ZodObjec
2090
2090
  source: string;
2091
2091
  mediaType: string;
2092
2092
  } | {
2093
- kind: "oci-image";
2094
2093
  identity: string;
2094
+ kind: "oci-image";
2095
2095
  digest: string;
2096
2096
  }>;
2097
2097
  planId: string;
package/dist/development/schemas.d.ts CHANGED
@@ -3115,15 +3115,15 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
3115
3115
  digest: z.ZodString;
3116
3116
  integrity: z.ZodOptional<z.ZodString>;
3117
3117
  }, "strict", z.ZodTypeAny, {
3118
- kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle";
3119
3118
  identity: string;
3119
+ kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle";
3120
3120
  digest: string;
3121
3121
  projectId: string;
3122
3122
  targetId: string;
3123
3123
  integrity?: string | undefined;
3124
3124
  }, {
3125
- kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle";
3126
3125
  identity: string;
3126
+ kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle";
3127
3127
  digest: string;
3128
3128
  projectId: string;
3129
3129
  targetId: string;
@@ -3175,8 +3175,8 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
3175
3175
  recipeDigest: string;
3176
3176
  }[];
3177
3177
  artifacts: {
3178
- kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle";
3179
3178
  identity: string;
3179
+ kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle";
3180
3180
  digest: string;
3181
3181
  projectId: string;
3182
3182
  targetId: string;
@@ -3212,8 +3212,8 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
3212
3212
  recipeDigest: string;
3213
3213
  }[];
3214
3214
  artifacts: {
3215
- kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle";
3216
3215
  identity: string;
3216
+ kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle";
3217
3217
  digest: string;
3218
3218
  projectId: string;
3219
3219
  targetId: string;
@@ -3249,8 +3249,8 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
3249
3249
  recipeDigest: string;
3250
3250
  }[];
3251
3251
  artifacts: {
3252
- kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle";
3253
3252
  identity: string;
3253
+ kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle";
3254
3254
  digest: string;
3255
3255
  projectId: string;
3256
3256
  targetId: string;
@@ -3286,8 +3286,8 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
3286
3286
  recipeDigest: string;
3287
3287
  }[];
3288
3288
  artifacts: {
3289
- kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle";
3290
3289
  identity: string;
3290
+ kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle";
3291
3291
  digest: string;
3292
3292
  projectId: string;
3293
3293
  targetId: string;
@@ -3359,15 +3359,15 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
3359
3359
  mediaType: z.ZodString;
3360
3360
  size: z.ZodOptional<z.ZodNumber>;
3361
3361
  }, "strict", z.ZodTypeAny, {
3362
- kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle" | "sbom" | "compatibility-attestation" | "component-manifest" | "compose" | "provenance";
3363
3362
  identity: string;
3363
+ kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle" | "sbom" | "compatibility-attestation" | "component-manifest" | "compose" | "provenance";
3364
3364
  id: string;
3365
3365
  digest: string;
3366
3366
  mediaType: string;
3367
3367
  size?: number | undefined;
3368
3368
  }, {
3369
- kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle" | "sbom" | "compatibility-attestation" | "component-manifest" | "compose" | "provenance";
3370
3369
  identity: string;
3370
+ kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle" | "sbom" | "compatibility-attestation" | "component-manifest" | "compose" | "provenance";
3371
3371
  id: string;
3372
3372
  digest: string;
3373
3373
  mediaType: string;
@@ -3429,8 +3429,8 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
3429
3429
  workflowRunId: string;
3430
3430
  };
3431
3431
  artifacts: {
3432
- kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle" | "sbom" | "compatibility-attestation" | "component-manifest" | "compose" | "provenance";
3433
3432
  identity: string;
3433
+ kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle" | "sbom" | "compatibility-attestation" | "component-manifest" | "compose" | "provenance";
3434
3434
  id: string;
3435
3435
  digest: string;
3436
3436
  mediaType: string;
@@ -3468,8 +3468,8 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
3468
3468
  workflowRunId: string;
3469
3469
  };
3470
3470
  artifacts: {
3471
- kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle" | "sbom" | "compatibility-attestation" | "component-manifest" | "compose" | "provenance";
3472
3471
  identity: string;
3472
+ kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle" | "sbom" | "compatibility-attestation" | "component-manifest" | "compose" | "provenance";
3473
3473
  id: string;
3474
3474
  digest: string;
3475
3475
  mediaType: string;
@@ -3507,8 +3507,8 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
3507
3507
  workflowRunId: string;
3508
3508
  };
3509
3509
  artifacts: {
3510
- kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle" | "sbom" | "compatibility-attestation" | "component-manifest" | "compose" | "provenance";
3511
3510
  identity: string;
3511
+ kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle" | "sbom" | "compatibility-attestation" | "component-manifest" | "compose" | "provenance";
3512
3512
  id: string;
3513
3513
  digest: string;
3514
3514
  mediaType: string;
@@ -3546,8 +3546,8 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
3546
3546
  workflowRunId: string;
3547
3547
  };
3548
3548
  artifacts: {
3549
- kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle" | "sbom" | "compatibility-attestation" | "component-manifest" | "compose" | "provenance";
3550
3549
  identity: string;
3550
+ kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle" | "sbom" | "compatibility-attestation" | "component-manifest" | "compose" | "provenance";
3551
3551
  id: string;
3552
3552
  digest: string;
3553
3553
  mediaType: string;
package/dist/entrypoints/clients/control-plane-client.d.ts CHANGED
@@ -1,6 +1,7 @@
1
1
  import type { ControlPlaneOperationBinding, ControlPlaneOperationBody, ControlPlaneOperationOutput, ControlPlaneOperationPath, ControlPlaneOperationQuery, OAuthScope } from '../../operator-contracts/control-plane-operation.js';
2
2
  import type { ApiPrincipal } from '../../operator-contracts/oauth.js';
3
3
  import type { InputRequired } from '../../operator-contracts/mcp.js';
4
+ import type { PublicClientSessionBinding } from '../../identity/contracts.js';
4
5
  export declare const DEFAULT_CONTROL_PLANE_BASE_URL = "http://127.0.0.1:3002";
5
6
  export declare const CONTROL_PLANE_BASE_URL_ENV = "TREESEED_API_BASE_URL";
6
7
  export interface ControlPlaneServerProfile {
@@ -8,7 +9,7 @@ export interface ControlPlaneServerProfile {
8
9
  label: string;
9
10
  baseUrl: string;
10
11
  }
11
- export interface ControlPlaneServerSession {
12
+ export interface ControlPlaneServerSession extends PublicClientSessionBinding {
12
13
  serverId: string;
13
14
  audience: string;
14
15
  accessToken: string;
package/dist/identity/contracts.d.ts CHANGED
@@ -23,6 +23,61 @@ export declare const resourceTokenRequestSchema: z.ZodObject<{
23
23
  scopes: string[];
24
24
  }>;
25
25
  export type ResourceTokenRequest = z.infer<typeof resourceTokenRequestSchema>;
26
+ /** RFC 9728 resource discovery. Unknown extensions are not authority. Consumers
27
+ * must match resource exactly and explicitly select one advertised issuer.
28
+ * TreeSeed credentials are transported only in the Authorization header.
29
+ */
30
+ export declare const protectedResourceMetadataSchema: z.ZodObject<{
31
+ resource: z.ZodEffects<z.ZodString, string, string>;
32
+ authorization_servers: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">, string[], string[]>;
33
+ scopes_supported: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, string[], string[]>>;
34
+ bearer_methods_supported: z.ZodOptional<z.ZodArray<z.ZodLiteral<"header">, "many">>;
35
+ resource_documentation: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
36
+ }, "strip", z.ZodTypeAny, {
37
+ resource: string;
38
+ authorization_servers: string[];
39
+ scopes_supported?: string[] | undefined;
40
+ bearer_methods_supported?: "header"[] | undefined;
41
+ resource_documentation?: string | undefined;
42
+ }, {
43
+ resource: string;
44
+ authorization_servers: string[];
45
+ scopes_supported?: string[] | undefined;
46
+ bearer_methods_supported?: "header"[] | undefined;
47
+ resource_documentation?: string | undefined;
48
+ }>;
49
+ export type ProtectedResourceMetadata = z.infer<typeof protectedResourceMetadataSchema>;
50
+ /** Persist with encrypted native-client tokens. Refresh must revalidate this
51
+ * issuer/subject and client; email or an API URL cannot substitute for it. */
52
+ export declare const publicClientSessionBindingSchema: z.ZodObject<{
53
+ identity: z.ZodObject<{
54
+ issuer: z.ZodEffects<z.ZodString, string, string>;
55
+ subject: z.ZodEffects<z.ZodString, string, string>;
56
+ }, "strict", z.ZodTypeAny, {
57
+ issuer: string;
58
+ subject: string;
59
+ }, {
60
+ issuer: string;
61
+ subject: string;
62
+ }>;
63
+ clientId: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
64
+ scopes: z.ZodEffects<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, string[], string[]>;
65
+ }, "strict", z.ZodTypeAny, {
66
+ scopes: string[];
67
+ identity: {
68
+ issuer: string;
69
+ subject: string;
70
+ };
71
+ clientId: string;
72
+ }, {
73
+ scopes: string[];
74
+ identity: {
75
+ issuer: string;
76
+ subject: string;
77
+ };
78
+ clientId: string;
79
+ }>;
80
+ export type PublicClientSessionBinding = z.infer<typeof publicClientSessionBindingSchema>;
26
81
  /** Implemented by Identity; implementations must isolate caches by resource and authority. */
27
82
  export interface IdentityCredentials {
28
83
  token(request: ResourceTokenRequest): Promise<string>;
@@ -55,12 +110,12 @@ export declare const identityPrincipalSchema: z.ZodObject<{
55
110
  scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
56
111
  }, "strict", z.ZodTypeAny, {
57
112
  scopes: string[];
58
- principalId: string;
59
- kind: "human" | "service" | "provider" | "agent";
60
113
  identity: {
61
114
  issuer: string;
62
115
  subject: string;
63
116
  };
117
+ principalId: string;
118
+ kind: "human" | "service" | "provider" | "agent";
64
119
  audience: string;
65
120
  actor?: {
66
121
  issuer: string;
@@ -68,12 +123,12 @@ export declare const identityPrincipalSchema: z.ZodObject<{
68
123
  } | undefined;
69
124
  }, {
70
125
  scopes: string[];
71
- principalId: string;
72
- kind: "human" | "service" | "provider" | "agent";
73
126
  identity: {
74
127
  issuer: string;
75
128
  subject: string;
76
129
  };
130
+ principalId: string;
131
+ kind: "human" | "service" | "provider" | "agent";
77
132
  audience: string;
78
133
  actor?: {
79
134
  issuer: string;
package/dist/identity/contracts.js CHANGED
@@ -18,6 +18,21 @@ const resourceTokenRequestSchema = z.object({
18
18
  resource: identityEndpointSchema,
19
19
  scopes
20
20
  }).strict();
21
+ const protectedResourceMetadataSchema = z.object({
22
+ resource: identityEndpointSchema,
23
+ authorization_servers: z.array(identityEndpointSchema).min(1).max(16).refine(
24
+ (value) => new Set(value).size === value.length,
25
+ "Authorization servers must be unique."
26
+ ),
27
+ scopes_supported: scopes.refine((value) => value.length <= 256 && value.every((scope) => scope.length <= 128), "Scope inventory is too large.").optional(),
28
+ bearer_methods_supported: z.array(z.literal("header")).length(1).optional(),
29
+ resource_documentation: identityEndpointSchema.optional()
30
+ });
31
+ const publicClientSessionBindingSchema = z.object({
32
+ identity: externalIdentitySchema,
33
+ clientId: identifier.refine((value) => value.length <= 256, "Client identifier is too long."),
34
+ scopes: scopes.refine((value) => value.length <= 256, "Scope inventory is too large.")
35
+ }).strict();
21
36
  const identityPrincipalSchema = z.object({
22
37
  principalId: identifier,
23
38
  kind: z.enum(["human", "service", "provider", "agent"]),
@@ -51,5 +66,7 @@ export {
51
66
  federationRelationshipSchema,
52
67
  identityEndpointSchema,
53
68
  identityPrincipalSchema,
69
+ protectedResourceMetadataSchema,
70
+ publicClientSessionBindingSchema,
54
71
  resourceTokenRequestSchema
55
72
  };
package/dist/operator-contracts/canonical-command-tree.js CHANGED
@@ -1,5 +1,6 @@
1
1
  import { commandPaths } from "./catalog/infrastructure/command-tree-paths.js";
2
2
  import { managedSecretCommands } from "./catalog/services/secret-commands.js";
3
+ import { identityLoginCommand } from "./catalog/services/identity-commands.js";
3
4
  import { hostProviderEnvironmentBranch, PROVIDER_ENVIRONMENT_COMMAND_BINDINGS, providerEnvironmentBranches } from "./catalog/provider-environment-commands.js";
4
5
  const unavailable = (reason = "This capability is not enabled until its control-plane operation is accepted.") => ({
5
6
  kind: "unavailable",
@@ -15,7 +16,7 @@ const aiNode = () => field("path", "nodeId", "context", "node", true);
15
16
  const aiInstance = () => [field("path", "teamId", "context", "team", true), field("path", "instanceId", "context", "node", true)];
16
17
  const operationBindings = {
17
18
  ...PROVIDER_ENVIRONMENT_COMMAND_BINDINGS,
18
- "auth login": protocol("protocol.oauth.device.login"),
19
+ "auth login": protocol("protocol.identity.login"),
19
20
  "auth logout": protocol("protocol.oauth.revoke"),
20
21
  "auth status": operation("accounts.current.show"),
21
22
  "users create": protocol("protocol.accounts.create"),
@@ -305,13 +306,7 @@ function userCreate() {
305
306
  return value;
306
307
  }
307
308
  function authLogin() {
308
- const value = leaf("login", "mutation");
309
- if (value.nodeType !== "leaf") throw new Error("Authentication login must be a leaf command.");
310
- value.options = [
311
- ...value.options ?? [],
312
- { name: "--timeout", description: "Maximum seconds to wait for device authorization.", type: "number" }
313
- ];
314
- return value;
309
+ return identityLoginCommand(leaf("login", "mutation"));
315
310
  }
316
311
  function libraryRead(segment, extraArguments = [], extraOptions = []) {
317
312
  return {
package/dist/operator-contracts/catalog/hosted-topology-operations.d.ts CHANGED
@@ -46,8 +46,8 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
46
46
  source: string;
47
47
  mediaType: string;
48
48
  } | {
49
- kind: "oci-image";
50
49
  identity: string;
50
+ kind: "oci-image";
51
51
  digest: string;
52
52
  }>;
53
53
  deploymentId: string;
@@ -117,8 +117,8 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
117
117
  source: string;
118
118
  mediaType: string;
119
119
  } | {
120
- kind: "oci-image";
121
120
  identity: string;
121
+ kind: "oci-image";
122
122
  digest: string;
123
123
  }>;
124
124
  planId: string;
@@ -277,8 +277,8 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
277
277
  source: string;
278
278
  mediaType: string;
279
279
  } | {
280
- kind: "oci-image";
281
280
  identity: string;
281
+ kind: "oci-image";
282
282
  digest: string;
283
283
  }>;
284
284
  planId: string;
@@ -363,8 +363,8 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
363
363
  source: string;
364
364
  mediaType: string;
365
365
  } | {
366
- kind: "oci-image";
367
366
  identity: string;
367
+ kind: "oci-image";
368
368
  digest: string;
369
369
  }>;
370
370
  planId: string;
package/dist/operator-contracts/catalog/services/identity-commands.d.ts ADDED
@@ -0,0 +1,2 @@
1
+ import type { CommandNodeDescriptor } from '../../command-tree.js';
2
+ export declare function identityLoginCommand(value: CommandNodeDescriptor): CommandNodeDescriptor;
package/dist/operator-contracts/catalog/services/identity-commands.js ADDED
@@ -0,0 +1,12 @@
1
+ function identityLoginCommand(value) {
2
+ if (value.nodeType !== "leaf") throw new Error("Authentication login must be a leaf command.");
3
+ return { ...value, options: [
4
+ ...value.options ?? [],
5
+ { name: "--timeout", description: "Maximum seconds to wait for identity authorization.", type: "number" },
6
+ { name: "--device", description: "Use headless device authorization instead of local browser PKCE.", type: "boolean" },
7
+ { name: "--issuer", description: "Choose an authorization server advertised by the selected API.", type: "string" }
8
+ ] };
9
+ }
10
+ export {
11
+ identityLoginCommand
12
+ };
package/dist/operator-contracts/control-plane-operations.d.ts CHANGED
@@ -102,8 +102,8 @@ export declare const CONTROL_PLANE_OPERATIONS: {
102
102
  source: string;
103
103
  mediaType: string;
104
104
  } | {
105
- kind: "oci-image";
106
105
  identity: string;
106
+ kind: "oci-image";
107
107
  digest: string;
108
108
  }>;
109
109
  deploymentId: string;
@@ -173,8 +173,8 @@ export declare const CONTROL_PLANE_OPERATIONS: {
173
173
  source: string;
174
174
  mediaType: string;
175
175
  } | {
176
- kind: "oci-image";
177
176
  identity: string;
177
+ kind: "oci-image";
178
178
  digest: string;
179
179
  }>;
180
180
  planId: string;
@@ -333,8 +333,8 @@ export declare const CONTROL_PLANE_OPERATIONS: {
333
333
  source: string;
334
334
  mediaType: string;
335
335
  } | {
336
- kind: "oci-image";
337
336
  identity: string;
337
+ kind: "oci-image";
338
338
  digest: string;
339
339
  }>;
340
340
  planId: string;
@@ -419,8 +419,8 @@ export declare const CONTROL_PLANE_OPERATIONS: {
419
419
  source: string;
420
420
  mediaType: string;
421
421
  } | {
422
- kind: "oci-image";
423
422
  identity: string;
423
+ kind: "oci-image";
424
424
  digest: string;
425
425
  }>;
426
426
  planId: string;
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@treeseed/sdk",
3
- "version": "0.13.0-rc.104",
3
+ "version": "0.13.0-rc.106",
4
4
  "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
5
5
  "license": "Apache-2.0",
6
6
  "repository": {
@@ -61,7 +61,7 @@
61
61
  "devDependencies": {
62
62
  "@types/node": "^24.6.0",
63
63
  "tsx": "^4.21.0",
64
- "vitest": "^4.1.2"
64
+ "vitest": "4.1.11"
65
65
  },
66
66
  "exports": {
67
67
  "./identity": {