@treeseed/sdk 0.13.0-rc.11 → 0.13.0-rc.111

package/dist/identity/runtime.d.ts

@@ -0,0 +1,186 @@
+import { z } from 'zod';
+/** Portable API authentication wiring. Deployment resolves protected bootstrap
+ * references; these declarations contain neither secret values nor file paths.
+ * Application authorization and issuer/subject mappings remain in the API DB.
+ */
+export declare const identityApiRuntimeSchema: z.ZodEffects<z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.identity-api-runtime/v1">;
+    issuer: z.ZodEffects<z.ZodString, string, string>;
+    resource: z.ZodEffects<z.ZodString, string, string>;
+    /** Explicit enrollment policy, never inferred from issuer or email domain. */
+    registration: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodBoolean;
+    }, "strict", z.ZodTypeAny, {
+        enabled: boolean;
+    }, {
+        enabled: boolean;
+    }>>;
+    scopes: z.ZodEffects<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, string[], string[]>;
+    sessionKeys: z.ZodObject<{
+        id: z.ZodString;
+        active: z.ZodObject<{
+            version: z.ZodNumber;
+            credentialReference: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            version: number;
+            credentialReference: string;
+        }, {
+            version: number;
+            credentialReference: string;
+        }>;
+        historical: z.ZodArray<z.ZodObject<{
+            version: z.ZodNumber;
+            credentialReference: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            version: number;
+            credentialReference: string;
+        }, {
+            version: number;
+            credentialReference: string;
+        }>, "many">;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        active: {
+            version: number;
+            credentialReference: string;
+        };
+        historical: {
+            version: number;
+            credentialReference: string;
+        }[];
+    }, {
+        id: string;
+        active: {
+            version: number;
+            credentialReference: string;
+        };
+        historical: {
+            version: number;
+            credentialReference: string;
+        }[];
+    }>;
+    applications: z.ZodArray<z.ZodObject<{
+        clientId: z.ZodString;
+        workloadPrincipalId: z.ZodString;
+        redirectUri: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+        scopes: z.ZodEffects<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, string[], string[]>;
+        signingKeyReference: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        scopes: string[];
+        clientId: string;
+        redirectUri: string;
+        workloadPrincipalId: string;
+        signingKeyReference: string;
+    }, {
+        scopes: string[];
+        clientId: string;
+        redirectUri: string;
+        workloadPrincipalId: string;
+        signingKeyReference: string;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    issuer: string;
+    resource: string;
+    scopes: string[];
+    schemaVersion: "treeseed.identity-api-runtime/v1";
+    sessionKeys: {
+        id: string;
+        active: {
+            version: number;
+            credentialReference: string;
+        };
+        historical: {
+            version: number;
+            credentialReference: string;
+        }[];
+    };
+    applications: {
+        scopes: string[];
+        clientId: string;
+        redirectUri: string;
+        workloadPrincipalId: string;
+        signingKeyReference: string;
+    }[];
+    registration?: {
+        enabled: boolean;
+    } | undefined;
+}, {
+    issuer: string;
+    resource: string;
+    scopes: string[];
+    schemaVersion: "treeseed.identity-api-runtime/v1";
+    sessionKeys: {
+        id: string;
+        active: {
+            version: number;
+            credentialReference: string;
+        };
+        historical: {
+            version: number;
+            credentialReference: string;
+        }[];
+    };
+    applications: {
+        scopes: string[];
+        clientId: string;
+        redirectUri: string;
+        workloadPrincipalId: string;
+        signingKeyReference: string;
+    }[];
+    registration?: {
+        enabled: boolean;
+    } | undefined;
+}>, {
+    issuer: string;
+    resource: string;
+    scopes: string[];
+    schemaVersion: "treeseed.identity-api-runtime/v1";
+    sessionKeys: {
+        id: string;
+        active: {
+            version: number;
+            credentialReference: string;
+        };
+        historical: {
+            version: number;
+            credentialReference: string;
+        }[];
+    };
+    applications: {
+        scopes: string[];
+        clientId: string;
+        redirectUri: string;
+        workloadPrincipalId: string;
+        signingKeyReference: string;
+    }[];
+    registration?: {
+        enabled: boolean;
+    } | undefined;
+}, {
+    issuer: string;
+    resource: string;
+    scopes: string[];
+    schemaVersion: "treeseed.identity-api-runtime/v1";
+    sessionKeys: {
+        id: string;
+        active: {
+            version: number;
+            credentialReference: string;
+        };
+        historical: {
+            version: number;
+            credentialReference: string;
+        }[];
+    };
+    applications: {
+        scopes: string[];
+        clientId: string;
+        redirectUri: string;
+        workloadPrincipalId: string;
+        signingKeyReference: string;
+    }[];
+    registration?: {
+        enabled: boolean;
+    } | undefined;
+}>;
+export type IdentityApiRuntime = z.infer<typeof identityApiRuntimeSchema>;

package/dist/identity/runtime.js

@@ -0,0 +1,49 @@
+import { z } from "zod";
+import { identityEndpointSchema, resourceTokenRequestSchema } from "./contracts.js";
+const reference = z.string().regex(/^[a-z][a-z0-9-]{0,62}$/u);
+const clientId = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/u);
+const scopes = resourceTokenRequestSchema.shape.scopes.refine((value) => value.length <= 256 && value.every((scope) => scope.length <= 128), "Bounded scope inventory required.");
+const sessionKey = z.object({ version: z.number().int().positive(), credentialReference: reference }).strict();
+const identityApiRuntimeSchema = z.object({
+  schemaVersion: z.literal("treeseed.identity-api-runtime/v1"),
+  issuer: identityEndpointSchema,
+  resource: identityEndpointSchema,
+  /** Explicit enrollment policy, never inferred from issuer or email domain. */
+  registration: z.object({ enabled: z.boolean() }).strict().optional(),
+  scopes,
+  sessionKeys: z.object({
+    id: reference,
+    active: sessionKey,
+    historical: z.array(sessionKey).max(8)
+  }).strict(),
+  applications: z.array(z.object({
+    clientId,
+    workloadPrincipalId: clientId,
+    redirectUri: identityEndpointSchema.refine((value) => !value.includes("*"), "Exact callback required."),
+    scopes,
+    signingKeyReference: reference
+  }).strict()).max(128)
+}).strict().superRefine((value, context) => {
+  const fail = (message) => context.addIssue({ code: z.ZodIssueCode.custom, message });
+  const versions = /* @__PURE__ */ new Set(), references = /* @__PURE__ */ new Set(), identities = /* @__PURE__ */ new Set(), callbacks = /* @__PURE__ */ new Set();
+  for (const key of [value.sessionKeys.active, ...value.sessionKeys.historical]) {
+    if (versions.has(key.version) || references.has(key.credentialReference)) fail("Session key versions and references must be unique.");
+    if (key !== value.sessionKeys.active && key.version >= value.sessionKeys.active.version) fail("Historical session keys must precede the active version.");
+    versions.add(key.version);
+    references.add(key.credentialReference);
+  }
+  for (const application of value.applications) {
+    for (const id of [application.clientId, application.workloadPrincipalId]) {
+      if (identities.has(id)) fail("Application clients and workload principals must be independently registered.");
+      identities.add(id);
+    }
+    if (callbacks.has(application.redirectUri)) fail("Applications must have distinct exact callbacks.");
+    callbacks.add(application.redirectUri);
+    if (references.has(application.signingKeyReference)) fail("Session encryption and application signing keys must be independent.");
+    references.add(application.signingKeyReference);
+    if (application.scopes.some((scope) => !value.scopes.includes(scope))) fail("Application scopes must be supported by the selected API resource.");
+  }
+});
+export {
+  identityApiRuntimeSchema
+};

package/dist/model-registry/agent-operational-models.js

@@ -23,7 +23,7 @@ const data = (key, alias = key) => field(key, { aliases: alias === key ? [] : [a
 function buildAgentOperationalModelRegistry(repoRoot) {
   const lifecycle = { id: id(), title: title(), status: field("status", { filterable: true, contentKeys: ["status"], writeContentKey: "status" }), team_id: ref("team_id", "teamId"), project_id: ref("project_id", "projectId"), workday_id: ref("workday_id", "workdayId"), assignment_id: ref("assignment_id", "assignmentId"), updated_at: updated() };
   return {
-    agent_context_query: model({ name: "agent_context_query", aliases: ["agent_context_queries"], collection: "agent-context-queries", entityType: "AgentContextQuery", repoRoot, fields: { id: id(), title: title(), description: data("description"), revision: data("revision"), maturity: data("maturity"), purpose: data("purpose"), query: data("query"), target: data("target"), scope: data("scope"), code_scopes: data("code_scopes", "codeScopes"), relations: refs("relations", "relations"), depth: data("depth"), result_limit: data("result_limit", "resultLimit"), context_budget: data("context_budget", "contextBudget"), token_budget: data("token_budget", "tokenBudget"), format: data("format"), filters: data("filters"), required: data("required") } }),
+    agent_context_query: model({ name: "agent_context_query", aliases: ["agent_context_queries"], collection: "agent-context-queries", entityType: "AgentContextQuery", repoRoot, fields: { id: id(), title: title(), description: data("description"), revision: data("revision"), maturity: data("maturity"), purpose: data("purpose"), query: data("query"), target: data("target"), scope: data("scope"), code_scopes: data("code_scopes", "codeScopes"), relations: refs("relations", "relations"), depth: data("depth"), result_limit: data("result_limit", "resultLimit"), context_budget: data("context_budget", "contextBudget"), token_budget: data("token_budget", "tokenBudget"), format: data("format"), filters: data("filters"), sources: data("sources"), requirement: data("requirement"), priority: data("priority"), minimum_budget: data("minimum_budget", "minimumBudget"), maximum_budget: data("maximum_budget", "maximumBudget"), summarization: data("summarization") } }),
     agent_context_query_set: model({ name: "agent_context_query_set", aliases: ["agent_context_query_sets"], collection: "agent-context-query-sets", entityType: "AgentContextQuerySet", repoRoot, fields: { id: id(), title: title(), description: data("description"), revision: data("revision"), query_refs: refs("query_refs", "queryRefs"), merge_policy: data("merge_policy", "mergePolicy") }, references: [{ field: "query_refs", edgeType: "REFERENCES", targetModels: ["agent_context_query"], multiple: true }] }),
     agent_instruction_template: model({ name: "agent_instruction_template", aliases: ["agent_instruction_templates"], collection: "agent-instruction-templates", entityType: "AgentInstructionTemplate", repoRoot, fields: { id: id(), title: title(), description: data("description"), revision: data("revision"), kind: data("kind"), instructions: data("instructions"), output_skeleton: data("output_skeleton", "outputSkeleton"), variables: refs("variables", "variables"), applies_to_profiles: refs("applies_to_profiles", "appliesToProfiles") } }),
     discussion_topic: model({ name: "discussion_topic", aliases: ["discussion_topics"], collection: "discussion-topics", entityType: "DiscussionTopic", repoRoot, fields: { id: id(), title: title(), description: data("description"), slug: field("slug", { filterable: true, contentKeys: ["slug"], writeContentKey: "slug" }), group_ids: refs("group_ids", "groupIds"), parent_topic_id: ref("parent_topic_id", "parentTopicId"), status: field("status", { filterable: true, contentKeys: ["status"], writeContentKey: "status" }) }, references: [{ field: "parent_topic_id", edgeType: "PARENT_OF", targetModels: ["discussion_topic"] }] }),