@treeseed/sdk 0.13.0-rc.107 → 0.13.0-rc.109

package/dist/deployment/schemas.d.ts

@@ -5121,8 +5121,8 @@ export declare const hostInitializationProfileSchema: z.ZodEffects<z.ZodObject<{
     }>, "many">>;
 }, "strict", z.ZodTypeAny, {
     id: string;
-    role: string;
     schemaVersion: "treeseed.host-initialization-profile/v1";
+    role: string;
     runtime: {
         environment: "development" | "production" | "track-default";
         management: "managed";
@@ -5139,8 +5139,8 @@ export declare const hostInitializationProfileSchema: z.ZodEffects<z.ZodObject<{
     };
 }, {
     id: string;
-    role: string;
     schemaVersion: "treeseed.host-initialization-profile/v1";
+    role: string;
     runtime: {
         environment: "development" | "production" | "track-default";
         management: "managed";
@@ -5157,8 +5157,8 @@ export declare const hostInitializationProfileSchema: z.ZodEffects<z.ZodObject<{
     }[] | undefined;
 }>, {
     id: string;
-    role: string;
     schemaVersion: "treeseed.host-initialization-profile/v1";
+    role: string;
     runtime: {
         environment: "development" | "production" | "track-default";
         management: "managed";
@@ -5175,8 +5175,8 @@ export declare const hostInitializationProfileSchema: z.ZodEffects<z.ZodObject<{
     };
 }, {
     id: string;
-    role: string;
     schemaVersion: "treeseed.host-initialization-profile/v1";
+    role: string;
     runtime: {
         environment: "development" | "production" | "track-default";
         management: "managed";
@@ -7221,8 +7221,8 @@ export declare const releaseCatalogSchema: z.ZodEffects<z.ZodObject<{
         }>, "many">>;
     }, "strict", z.ZodTypeAny, {
         id: string;
-        role: string;
         schemaVersion: "treeseed.host-initialization-profile/v1";
+        role: string;
         runtime: {
             environment: "development" | "production" | "track-default";
             management: "managed";
@@ -7239,8 +7239,8 @@ export declare const releaseCatalogSchema: z.ZodEffects<z.ZodObject<{
         };
     }, {
         id: string;
-        role: string;
         schemaVersion: "treeseed.host-initialization-profile/v1";
+        role: string;
         runtime: {
             environment: "development" | "production" | "track-default";
             management: "managed";
@@ -7257,8 +7257,8 @@ export declare const releaseCatalogSchema: z.ZodEffects<z.ZodObject<{
         }[] | undefined;
     }>, {
         id: string;
-        role: string;
         schemaVersion: "treeseed.host-initialization-profile/v1";
+        role: string;
         runtime: {
             environment: "development" | "production" | "track-default";
             management: "managed";
@@ -7275,8 +7275,8 @@ export declare const releaseCatalogSchema: z.ZodEffects<z.ZodObject<{
         };
     }, {
         id: string;
-        role: string;
         schemaVersion: "treeseed.host-initialization-profile/v1";
+        role: string;
         runtime: {
             environment: "development" | "production" | "track-default";
             management: "managed";
@@ -7457,8 +7457,8 @@ export declare const releaseCatalogSchema: z.ZodEffects<z.ZodObject<{
     } | null;
     hostProfiles: {
         id: string;
-        role: string;
         schemaVersion: "treeseed.host-initialization-profile/v1";
+        role: string;
         runtime: {
             environment: "development" | "production" | "track-default";
             management: "managed";
@@ -7638,8 +7638,8 @@ export declare const releaseCatalogSchema: z.ZodEffects<z.ZodObject<{
     } | null;
     hostProfiles?: {
         id: string;
-        role: string;
         schemaVersion: "treeseed.host-initialization-profile/v1";
+        role: string;
         runtime: {
             environment: "development" | "production" | "track-default";
             management: "managed";
@@ -7819,8 +7819,8 @@ export declare const releaseCatalogSchema: z.ZodEffects<z.ZodObject<{
     } | null;
     hostProfiles: {
         id: string;
-        role: string;
         schemaVersion: "treeseed.host-initialization-profile/v1";
+        role: string;
         runtime: {
             environment: "development" | "production" | "track-default";
             management: "managed";
@@ -8000,8 +8000,8 @@ export declare const releaseCatalogSchema: z.ZodEffects<z.ZodObject<{
     } | null;
     hostProfiles?: {
         id: string;
-        role: string;
         schemaVersion: "treeseed.host-initialization-profile/v1";
+        role: string;
         runtime: {
             environment: "development" | "production" | "track-default";
             management: "managed";
@@ -8322,8 +8322,8 @@ export declare const hostReceiptSchema: z.ZodObject<{
     completedAt: z.ZodString;
 }, "strict", z.ZodTypeAny, {
     state: "degraded" | "rolled-back" | "known-good";
-    role: string;
     schemaVersion: "treeseed.host-receipt/v1";
+    role: string;
     packages: {
         version: string;
         name: string;
@@ -8352,8 +8352,8 @@ export declare const hostReceiptSchema: z.ZodObject<{
     }[];
 }, {
     state: "degraded" | "rolled-back" | "known-good";
-    role: string;
     schemaVersion: "treeseed.host-receipt/v1";
+    role: string;
     packages: {
         version: string;
         name: string;

package/dist/development/schemas.d.ts

@@ -2141,11 +2141,11 @@ export declare const developmentRuntimeSchema: z.ZodEffects<z.ZodEffects<z.ZodOb
         } | undefined;
     }>, "many">;
 }, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.development-runtime/v2";
     project: {
         id: string;
         repository: string;
     };
-    schemaVersion: "treeseed.development-runtime/v2";
     targets: {
         kind: "package-watch" | "live-web" | "live-api" | "rebuild-restart" | "local-companion";
         id: string;
@@ -2289,11 +2289,11 @@ export declare const developmentRuntimeSchema: z.ZodEffects<z.ZodEffects<z.ZodOb
         restoreOnFailure: boolean;
     };
 }, {
+    schemaVersion: "treeseed.development-runtime/v2";
     project: {
         id: string;
         repository: string;
     };
-    schemaVersion: "treeseed.development-runtime/v2";
     targets: {
         kind: "package-watch" | "live-web" | "live-api" | "rebuild-restart" | "local-companion";
         id: string;
@@ -2437,11 +2437,11 @@ export declare const developmentRuntimeSchema: z.ZodEffects<z.ZodEffects<z.ZodOb
         restoreOnFailure?: boolean | undefined;
     };
 }>, {
+    schemaVersion: "treeseed.development-runtime/v2";
     project: {
         id: string;
         repository: string;
     };
-    schemaVersion: "treeseed.development-runtime/v2";
     targets: {
         kind: "package-watch" | "live-web" | "live-api" | "rebuild-restart" | "local-companion";
         id: string;
@@ -2585,11 +2585,11 @@ export declare const developmentRuntimeSchema: z.ZodEffects<z.ZodEffects<z.ZodOb
         restoreOnFailure: boolean;
     };
 }, {
+    schemaVersion: "treeseed.development-runtime/v2";
     project: {
         id: string;
         repository: string;
     };
-    schemaVersion: "treeseed.development-runtime/v2";
     targets: {
         kind: "package-watch" | "live-web" | "live-api" | "rebuild-restart" | "local-companion";
         id: string;
@@ -2733,11 +2733,11 @@ export declare const developmentRuntimeSchema: z.ZodEffects<z.ZodEffects<z.ZodOb
         restoreOnFailure?: boolean | undefined;
     };
 }>, {
+    schemaVersion: "treeseed.development-runtime/v2";
     project: {
         id: string;
         repository: string;
     };
-    schemaVersion: "treeseed.development-runtime/v2";
     targets: {
         kind: "package-watch" | "live-web" | "live-api" | "rebuild-restart" | "local-companion";
         id: string;

package/dist/identity/index.d.ts

@@ -1,2 +1,3 @@
 export * from './contracts.js';
 export * from './browser-session.js';
+export * from './runtime.js';

package/dist/identity/index.js

@@ -1,2 +1,3 @@
 export * from "./contracts.js";
 export * from "./browser-session.js";
+export * from "./runtime.js";

package/dist/identity/runtime.d.ts

@@ -0,0 +1,166 @@
+import { z } from 'zod';
+/** Portable API authentication wiring. Deployment resolves protected bootstrap
+ * references; these declarations contain neither secret values nor file paths.
+ * Application authorization and issuer/subject mappings remain in the API DB.
+ */
+export declare const identityApiRuntimeSchema: z.ZodEffects<z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.identity-api-runtime/v1">;
+    issuer: z.ZodEffects<z.ZodString, string, string>;
+    resource: z.ZodEffects<z.ZodString, string, string>;
+    scopes: z.ZodEffects<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, string[], string[]>;
+    sessionKeys: z.ZodObject<{
+        id: z.ZodString;
+        active: z.ZodObject<{
+            version: z.ZodNumber;
+            credentialReference: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            version: number;
+            credentialReference: string;
+        }, {
+            version: number;
+            credentialReference: string;
+        }>;
+        historical: z.ZodArray<z.ZodObject<{
+            version: z.ZodNumber;
+            credentialReference: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            version: number;
+            credentialReference: string;
+        }, {
+            version: number;
+            credentialReference: string;
+        }>, "many">;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        active: {
+            version: number;
+            credentialReference: string;
+        };
+        historical: {
+            version: number;
+            credentialReference: string;
+        }[];
+    }, {
+        id: string;
+        active: {
+            version: number;
+            credentialReference: string;
+        };
+        historical: {
+            version: number;
+            credentialReference: string;
+        }[];
+    }>;
+    applications: z.ZodArray<z.ZodObject<{
+        clientId: z.ZodString;
+        workloadPrincipalId: z.ZodString;
+        redirectUri: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+        scopes: z.ZodEffects<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, string[], string[]>;
+        signingKeyReference: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        scopes: string[];
+        clientId: string;
+        redirectUri: string;
+        workloadPrincipalId: string;
+        signingKeyReference: string;
+    }, {
+        scopes: string[];
+        clientId: string;
+        redirectUri: string;
+        workloadPrincipalId: string;
+        signingKeyReference: string;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    issuer: string;
+    resource: string;
+    scopes: string[];
+    schemaVersion: "treeseed.identity-api-runtime/v1";
+    sessionKeys: {
+        id: string;
+        active: {
+            version: number;
+            credentialReference: string;
+        };
+        historical: {
+            version: number;
+            credentialReference: string;
+        }[];
+    };
+    applications: {
+        scopes: string[];
+        clientId: string;
+        redirectUri: string;
+        workloadPrincipalId: string;
+        signingKeyReference: string;
+    }[];
+}, {
+    issuer: string;
+    resource: string;
+    scopes: string[];
+    schemaVersion: "treeseed.identity-api-runtime/v1";
+    sessionKeys: {
+        id: string;
+        active: {
+            version: number;
+            credentialReference: string;
+        };
+        historical: {
+            version: number;
+            credentialReference: string;
+        }[];
+    };
+    applications: {
+        scopes: string[];
+        clientId: string;
+        redirectUri: string;
+        workloadPrincipalId: string;
+        signingKeyReference: string;
+    }[];
+}>, {
+    issuer: string;
+    resource: string;
+    scopes: string[];
+    schemaVersion: "treeseed.identity-api-runtime/v1";
+    sessionKeys: {
+        id: string;
+        active: {
+            version: number;
+            credentialReference: string;
+        };
+        historical: {
+            version: number;
+            credentialReference: string;
+        }[];
+    };
+    applications: {
+        scopes: string[];
+        clientId: string;
+        redirectUri: string;
+        workloadPrincipalId: string;
+        signingKeyReference: string;
+    }[];
+}, {
+    issuer: string;
+    resource: string;
+    scopes: string[];
+    schemaVersion: "treeseed.identity-api-runtime/v1";
+    sessionKeys: {
+        id: string;
+        active: {
+            version: number;
+            credentialReference: string;
+        };
+        historical: {
+            version: number;
+            credentialReference: string;
+        }[];
+    };
+    applications: {
+        scopes: string[];
+        clientId: string;
+        redirectUri: string;
+        workloadPrincipalId: string;
+        signingKeyReference: string;
+    }[];
+}>;
+export type IdentityApiRuntime = z.infer<typeof identityApiRuntimeSchema>;

package/dist/identity/runtime.js

@@ -0,0 +1,47 @@
+import { z } from "zod";
+import { identityEndpointSchema, resourceTokenRequestSchema } from "./contracts.js";
+const reference = z.string().regex(/^[a-z][a-z0-9-]{0,62}$/u);
+const clientId = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/u);
+const scopes = resourceTokenRequestSchema.shape.scopes.refine((value) => value.length <= 256 && value.every((scope) => scope.length <= 128), "Bounded scope inventory required.");
+const sessionKey = z.object({ version: z.number().int().positive(), credentialReference: reference }).strict();
+const identityApiRuntimeSchema = z.object({
+  schemaVersion: z.literal("treeseed.identity-api-runtime/v1"),
+  issuer: identityEndpointSchema,
+  resource: identityEndpointSchema,
+  scopes,
+  sessionKeys: z.object({
+    id: reference,
+    active: sessionKey,
+    historical: z.array(sessionKey).max(8)
+  }).strict(),
+  applications: z.array(z.object({
+    clientId,
+    workloadPrincipalId: clientId,
+    redirectUri: identityEndpointSchema.refine((value) => !value.includes("*"), "Exact callback required."),
+    scopes,
+    signingKeyReference: reference
+  }).strict()).max(128)
+}).strict().superRefine((value, context) => {
+  const fail = (message) => context.addIssue({ code: z.ZodIssueCode.custom, message });
+  const versions = /* @__PURE__ */ new Set(), references = /* @__PURE__ */ new Set(), identities = /* @__PURE__ */ new Set(), callbacks = /* @__PURE__ */ new Set();
+  for (const key of [value.sessionKeys.active, ...value.sessionKeys.historical]) {
+    if (versions.has(key.version) || references.has(key.credentialReference)) fail("Session key versions and references must be unique.");
+    if (key !== value.sessionKeys.active && key.version >= value.sessionKeys.active.version) fail("Historical session keys must precede the active version.");
+    versions.add(key.version);
+    references.add(key.credentialReference);
+  }
+  for (const application of value.applications) {
+    for (const id of [application.clientId, application.workloadPrincipalId]) {
+      if (identities.has(id)) fail("Application clients and workload principals must be independently registered.");
+      identities.add(id);
+    }
+    if (callbacks.has(application.redirectUri)) fail("Applications must have distinct exact callbacks.");
+    callbacks.add(application.redirectUri);
+    if (references.has(application.signingKeyReference)) fail("Session encryption and application signing keys must be independent.");
+    references.add(application.signingKeyReference);
+    if (application.scopes.some((scope) => !value.scopes.includes(scope))) fail("Application scopes must be supported by the selected API resource.");
+  }
+});
+export {
+  identityApiRuntimeSchema
+};

package/dist/operator-contracts/canonical-command-tree.js

@@ -62,6 +62,8 @@ const operationBindings = {
   "host config plan": local("local.host.config.plan"),
   "host config apply": local("local.host.config.apply"),
   "host config adopt": local("local.host.config.adopt"),
+  "host postgres transfer prepare": local("local.host.postgres.transfer.prepare"),
+  "host postgres transfer status": local("local.host.postgres.transfer.status"),
   "host topology": local("local.host.topology"),
   "host connections": local("local.host.connections"),
   "host provider status": local("local.host.provider.status"),
@@ -405,6 +407,7 @@ const commandTree = {
       leaf("reconcile", "mutation", void 0, "authority"),
       leaf("events"),
       branch("config", [leaf("show"), leaf("plan", "read", "file"), leaf("apply", "mutation", "file", "authority"), configurationAdopt()]),
+      branch("postgres", [branch("transfer", [leaf("prepare", "mutation", "file", "authority"), leaf("status")])]),
       leaf("topology"),
       leaf("connections"),
       branch("provider", [leaf("status"), branch("credentials", [leaf("list"), leaf("status"), hostProviderCredentialInitialize()]), hostProviderEnvironmentBranch()]),

package/dist/operator-contracts/catalog/hosted-topology-operations.d.ts

@@ -126,8 +126,8 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
             stackId: string;
             stateBackend: {
                 type: "s3";
-                key: string;
                 schemaVersion: "treeseed.hosted-state-backend/v1";
+                key: string;
                 teamId: string;
                 environment: "production" | "staging";
                 deploymentId: string;
@@ -286,8 +286,8 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
             stackId: string;
             stateBackend: {
                 type: "s3";
-                key: string;
                 schemaVersion: "treeseed.hosted-state-backend/v1";
+                key: string;
                 teamId: string;
                 environment: "production" | "staging";
                 deploymentId: string;
@@ -372,8 +372,8 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
             stackId: string;
             stateBackend: {
                 type: "s3";
-                key: string;
                 schemaVersion: "treeseed.hosted-state-backend/v1";
+                key: string;
                 teamId: string;
                 environment: "production" | "staging";
                 deploymentId: string;

package/dist/operator-contracts/control-plane-operations.d.ts

@@ -182,8 +182,8 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                     stackId: string;
                     stateBackend: {
                         type: "s3";
-                        key: string;
                         schemaVersion: "treeseed.hosted-state-backend/v1";
+                        key: string;
                         teamId: string;
                         environment: "production" | "staging";
                         deploymentId: string;
@@ -342,8 +342,8 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                     stackId: string;
                     stateBackend: {
                         type: "s3";
-                        key: string;
                         schemaVersion: "treeseed.hosted-state-backend/v1";
+                        key: string;
                         teamId: string;
                         environment: "production" | "staging";
                         deploymentId: string;
@@ -428,8 +428,8 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                     stackId: string;
                     stateBackend: {
                         type: "s3";
-                        key: string;
                         schemaVersion: "treeseed.hosted-state-backend/v1";
+                        key: string;
                         teamId: string;
                         environment: "production" | "staging";
                         deploymentId: string;

package/dist/platform/contracts.d.ts

@@ -164,8 +164,8 @@ export declare const projectCreatePlanSchema: z.ZodObject<{
     ok: z.ZodBoolean;
     blockers: z.ZodArray<z.ZodString, "many">;
 }, "strict", z.ZodTypeAny, {
-    slug: string;
     schemaVersion: "treeseed.platform-project-create-plan/v1";
+    slug: string;
     repository: {
         name: string;
         owner: string;
@@ -187,8 +187,8 @@ export declare const projectCreatePlanSchema: z.ZodObject<{
     }[];
     observationDigest: string;
 }, {
-    slug: string;
     schemaVersion: "treeseed.platform-project-create-plan/v1";
+    slug: string;
     repository: {
         name: string;
         owner: string;
@@ -256,8 +256,8 @@ export declare const projectCreateReceiptSchema: z.ZodObject<{
         step: "project" | "library" | "repository" | "template" | "inventory";
     }>, "many">;
 }, "strict", z.ZodTypeAny, {
-    slug: string;
     schemaVersion: "treeseed.platform-project-create-receipt/v1";
+    slug: string;
     repository: {
         name: string;
         owner: string;
@@ -279,8 +279,8 @@ export declare const projectCreateReceiptSchema: z.ZodObject<{
     libraryBindingId: string;
     inventoryVersion: number;
 }, {
-    slug: string;
     schemaVersion: "treeseed.platform-project-create-receipt/v1";
+    slug: string;
     repository: {
         name: string;
         owner: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.107",
+  "version": "0.13.0-rc.109",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {