@treeseed/sdk 0.13.0-rc.11 → 0.13.0-rc.111

package/dist/secrets-capability/shared-resources.d.ts

@@ -0,0 +1,376 @@
+import { z } from 'zod';
+export declare const organizationSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    version: number;
+    name: string;
+}, {
+    id: string;
+    version: number;
+    name: string;
+}>;
+export declare const organizationMemberSchema: z.ZodObject<{
+    organizationId: z.ZodString;
+    userId: z.ZodString;
+    role: z.ZodEnum<["owner", "admin", "member"]>;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    version: number;
+    role: "owner" | "admin" | "member";
+    organizationId: string;
+    userId: string;
+}, {
+    version: number;
+    role: "owner" | "admin" | "member";
+    organizationId: string;
+    userId: string;
+}>;
+export declare const organizationTeamSchema: z.ZodObject<{
+    teamId: z.ZodString;
+    organizationId: z.ZodNullable<z.ZodString>;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    version: number;
+    teamId: string;
+    organizationId: string | null;
+}, {
+    version: number;
+    teamId: string;
+    organizationId: string | null;
+}>;
+export declare const organizationTeamInvitationSchema: z.ZodObject<{
+    id: z.ZodString;
+    organizationId: z.ZodString;
+    teamId: z.ZodString;
+    organizationAuthorizedBy: z.ZodString;
+    teamAuthorizedBy: z.ZodNullable<z.ZodString>;
+    expiresAt: z.ZodString;
+    status: z.ZodEnum<["pending", "accepted", "rejected", "revoked", "expired"]>;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    status: "rejected" | "revoked" | "expired" | "pending" | "accepted";
+    id: string;
+    version: number;
+    expiresAt: string;
+    teamId: string;
+    organizationId: string;
+    organizationAuthorizedBy: string;
+    teamAuthorizedBy: string | null;
+}, {
+    status: "rejected" | "revoked" | "expired" | "pending" | "accepted";
+    id: string;
+    version: number;
+    expiresAt: string;
+    teamId: string;
+    organizationId: string;
+    organizationAuthorizedBy: string;
+    teamAuthorizedBy: string | null;
+}>;
+export declare const sharedResourceSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+    kind: z.ZodLiteral<"connection">;
+    id: z.ZodString;
+    ownerTeamId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    kind: "connection";
+    id: string;
+    ownerTeamId: string;
+}, {
+    kind: "connection";
+    id: string;
+    ownerTeamId: string;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"vault">;
+    id: z.ZodString;
+    ownerTeamId: z.ZodNullable<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    kind: "vault";
+    id: string;
+    ownerTeamId: string | null;
+}, {
+    kind: "vault";
+    id: string;
+    ownerTeamId: string | null;
+}>]>;
+export declare const sharedResourceGrantSchema: z.ZodEffects<z.ZodObject<{
+    id: z.ZodString;
+    resource: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"connection">;
+        id: z.ZodString;
+        ownerTeamId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "connection";
+        id: string;
+        ownerTeamId: string;
+    }, {
+        kind: "connection";
+        id: string;
+        ownerTeamId: string;
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"vault">;
+        id: z.ZodString;
+        ownerTeamId: z.ZodNullable<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        kind: "vault";
+        id: string;
+        ownerTeamId: string | null;
+    }, {
+        kind: "vault";
+        id: string;
+        ownerTeamId: string | null;
+    }>]>;
+    recipientTeamId: z.ZodString;
+    authority: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"organization">;
+        organizationId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "organization";
+        organizationId: string;
+    }, {
+        kind: "organization";
+        organizationId: string;
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"deployment">;
+        audiencePolicyId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "deployment";
+        audiencePolicyId: string;
+    }, {
+        kind: "deployment";
+        audiencePolicyId: string;
+    }>]>;
+    origin: z.ZodEnum<["explicit", "default-policy"]>;
+    defaultPolicyId: z.ZodNullable<z.ZodString>;
+    permissions: z.ZodArray<z.ZodString, "many">;
+    scope: z.ZodObject<{
+        environment: z.ZodEnum<["staging", "production", "shared"]>;
+        resourceIds: z.ZodArray<z.ZodString, "many">;
+        projectIds: z.ZodArray<z.ZodString, "many">;
+        assignmentIds: z.ZodArray<z.ZodString, "many">;
+    }, "strict", z.ZodTypeAny, {
+        environment: "production" | "staging" | "shared";
+        projectIds: string[];
+        resourceIds: string[];
+        assignmentIds: string[];
+    }, {
+        environment: "production" | "staging" | "shared";
+        projectIds: string[];
+        resourceIds: string[];
+        assignmentIds: string[];
+    }>;
+    limits: z.ZodObject<{
+        maxConcurrentOperations: z.ZodNumber;
+        maxOperationsPerWindow: z.ZodNumber;
+        windowSeconds: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        maxConcurrentOperations: number;
+        maxOperationsPerWindow: number;
+        windowSeconds: number;
+    }, {
+        maxConcurrentOperations: number;
+        maxOperationsPerWindow: number;
+        windowSeconds: number;
+    }>;
+    status: z.ZodEnum<["active", "revoked"]>;
+    version: z.ZodNumber;
+    expiresAt: z.ZodNullable<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    status: "active" | "revoked";
+    resource: {
+        kind: "connection";
+        id: string;
+        ownerTeamId: string;
+    } | {
+        kind: "vault";
+        id: string;
+        ownerTeamId: string | null;
+    };
+    id: string;
+    version: number;
+    expiresAt: string | null;
+    scope: {
+        environment: "production" | "staging" | "shared";
+        projectIds: string[];
+        resourceIds: string[];
+        assignmentIds: string[];
+    };
+    origin: "explicit" | "default-policy";
+    authority: {
+        kind: "organization";
+        organizationId: string;
+    } | {
+        kind: "deployment";
+        audiencePolicyId: string;
+    };
+    limits: {
+        maxConcurrentOperations: number;
+        maxOperationsPerWindow: number;
+        windowSeconds: number;
+    };
+    permissions: string[];
+    recipientTeamId: string;
+    defaultPolicyId: string | null;
+}, {
+    status: "active" | "revoked";
+    resource: {
+        kind: "connection";
+        id: string;
+        ownerTeamId: string;
+    } | {
+        kind: "vault";
+        id: string;
+        ownerTeamId: string | null;
+    };
+    id: string;
+    version: number;
+    expiresAt: string | null;
+    scope: {
+        environment: "production" | "staging" | "shared";
+        projectIds: string[];
+        resourceIds: string[];
+        assignmentIds: string[];
+    };
+    origin: "explicit" | "default-policy";
+    authority: {
+        kind: "organization";
+        organizationId: string;
+    } | {
+        kind: "deployment";
+        audiencePolicyId: string;
+    };
+    limits: {
+        maxConcurrentOperations: number;
+        maxOperationsPerWindow: number;
+        windowSeconds: number;
+    };
+    permissions: string[];
+    recipientTeamId: string;
+    defaultPolicyId: string | null;
+}>, {
+    status: "active" | "revoked";
+    resource: {
+        kind: "connection";
+        id: string;
+        ownerTeamId: string;
+    } | {
+        kind: "vault";
+        id: string;
+        ownerTeamId: string | null;
+    };
+    id: string;
+    version: number;
+    expiresAt: string | null;
+    scope: {
+        environment: "production" | "staging" | "shared";
+        projectIds: string[];
+        resourceIds: string[];
+        assignmentIds: string[];
+    };
+    origin: "explicit" | "default-policy";
+    authority: {
+        kind: "organization";
+        organizationId: string;
+    } | {
+        kind: "deployment";
+        audiencePolicyId: string;
+    };
+    limits: {
+        maxConcurrentOperations: number;
+        maxOperationsPerWindow: number;
+        windowSeconds: number;
+    };
+    permissions: string[];
+    recipientTeamId: string;
+    defaultPolicyId: string | null;
+}, {
+    status: "active" | "revoked";
+    resource: {
+        kind: "connection";
+        id: string;
+        ownerTeamId: string;
+    } | {
+        kind: "vault";
+        id: string;
+        ownerTeamId: string | null;
+    };
+    id: string;
+    version: number;
+    expiresAt: string | null;
+    scope: {
+        environment: "production" | "staging" | "shared";
+        projectIds: string[];
+        resourceIds: string[];
+        assignmentIds: string[];
+    };
+    origin: "explicit" | "default-policy";
+    authority: {
+        kind: "organization";
+        organizationId: string;
+    } | {
+        kind: "deployment";
+        audiencePolicyId: string;
+    };
+    limits: {
+        maxConcurrentOperations: number;
+        maxOperationsPerWindow: number;
+        windowSeconds: number;
+    };
+    permissions: string[];
+    recipientTeamId: string;
+    defaultPolicyId: string | null;
+}>;
+export type SharedResourceGrant = z.infer<typeof sharedResourceGrantSchema>;
+export declare const serviceBindingSchema: z.ZodEffects<z.ZodObject<{
+    id: z.ZodString;
+    teamId: z.ZodString;
+    projectId: z.ZodString;
+    capability: z.ZodString;
+    environment: z.ZodEnum<["staging", "production", "shared"]>;
+    connectionId: z.ZodString;
+    ownerTeamId: z.ZodString;
+    grantId: z.ZodNullable<z.ZodString>;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    version: number;
+    projectId: string;
+    teamId: string;
+    environment: "production" | "staging" | "shared";
+    capability: string;
+    connectionId: string;
+    grantId: string | null;
+    ownerTeamId: string;
+}, {
+    id: string;
+    version: number;
+    projectId: string;
+    teamId: string;
+    environment: "production" | "staging" | "shared";
+    capability: string;
+    connectionId: string;
+    grantId: string | null;
+    ownerTeamId: string;
+}>, {
+    id: string;
+    version: number;
+    projectId: string;
+    teamId: string;
+    environment: "production" | "staging" | "shared";
+    capability: string;
+    connectionId: string;
+    grantId: string | null;
+    ownerTeamId: string;
+}, {
+    id: string;
+    version: number;
+    projectId: string;
+    teamId: string;
+    environment: "production" | "staging" | "shared";
+    capability: string;
+    connectionId: string;
+    grantId: string | null;
+    ownerTeamId: string;
+}>;
+export type ServiceBinding = z.infer<typeof serviceBindingSchema>;

package/dist/secrets-capability/shared-resources.js

@@ -0,0 +1,91 @@
+import { z } from "zod";
+const id = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u);
+const version = z.number().int().nonnegative().safe();
+const environment = z.enum(["staging", "production", "shared"]);
+const timestamp = z.string().datetime();
+const organizationSchema = z.object({
+  id,
+  name: z.string().trim().min(1).max(160),
+  version
+}).strict();
+const organizationMemberSchema = z.object({
+  organizationId: id,
+  userId: id,
+  role: z.enum(["owner", "admin", "member"]),
+  version
+}).strict();
+const organizationTeamSchema = z.object({
+  teamId: id,
+  organizationId: id.nullable(),
+  version
+}).strict();
+const organizationTeamInvitationSchema = z.object({
+  id,
+  organizationId: id,
+  teamId: id,
+  organizationAuthorizedBy: id,
+  teamAuthorizedBy: id.nullable(),
+  expiresAt: timestamp,
+  status: z.enum(["pending", "accepted", "rejected", "revoked", "expired"]),
+  version
+}).strict();
+const sharedResourceSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("connection"), id, ownerTeamId: id }).strict(),
+  z.object({ kind: z.literal("vault"), id, ownerTeamId: id.nullable() }).strict()
+]);
+const sharedResourceGrantSchema = z.object({
+  id,
+  resource: sharedResourceSchema,
+  recipientTeamId: id,
+  authority: z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("organization"), organizationId: id }).strict(),
+    z.object({ kind: z.literal("deployment"), audiencePolicyId: id }).strict()
+  ]),
+  origin: z.enum(["explicit", "default-policy"]),
+  defaultPolicyId: id.nullable(),
+  permissions: z.array(id).min(1),
+  scope: z.object({
+    environment,
+    resourceIds: z.array(z.string().min(1).max(512)).min(1),
+    projectIds: z.array(id),
+    assignmentIds: z.array(id)
+  }).strict(),
+  limits: z.object({
+    maxConcurrentOperations: z.number().int().positive().safe(),
+    maxOperationsPerWindow: z.number().int().positive().safe(),
+    windowSeconds: z.number().int().positive().safe()
+  }).strict(),
+  status: z.enum(["active", "revoked"]),
+  version,
+  expiresAt: timestamp.nullable()
+}).strict().superRefine((grant, context) => {
+  if (grant.origin === "default-policy" !== (grant.defaultPolicyId !== null))
+    context.addIssue({ code: "custom", path: ["defaultPolicyId"], message: "Default grants require exactly one policy reference." });
+  if (grant.authority.kind === "organization" && grant.resource.ownerTeamId === null)
+    context.addIssue({ code: "custom", path: ["resource", "ownerTeamId"], message: "Organization resources require an owning team." });
+  if (grant.scope.resourceIds.includes("*"))
+    context.addIssue({ code: "custom", path: ["scope", "resourceIds"], message: "Unbounded resource grants are prohibited." });
+});
+const serviceBindingSchema = z.object({
+  id,
+  teamId: id,
+  projectId: id,
+  capability: id,
+  environment,
+  connectionId: id,
+  ownerTeamId: id,
+  grantId: id.nullable(),
+  version
+}).strict().superRefine((binding, context) => {
+  if (binding.teamId !== binding.ownerTeamId && binding.grantId === null)
+    context.addIssue({ code: "custom", path: ["grantId"], message: "Shared bindings require a grant." });
+});
+export {
+  organizationMemberSchema,
+  organizationSchema,
+  organizationTeamInvitationSchema,
+  organizationTeamSchema,
+  serviceBindingSchema,
+  sharedResourceGrantSchema,
+  sharedResourceSchema
+};

package/dist/secrets-capability/vault-contracts.d.ts

@@ -0,0 +1,132 @@
+import { z } from 'zod';
+/** Configuration validation is not DNS/routing authorization; Deployment enforces transport policy. */
+export declare const vaultDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    ownerTeamId: z.ZodNullable<z.ZodString>;
+    displayName: z.ZodString;
+    backend: z.ZodEnum<["managed-openbao", "external-openbao", "hashicorp-vault"]>;
+    endpoint: z.ZodEffects<z.ZodString, string, string>;
+    secretsMount: z.ZodEffects<z.ZodString, string, string>;
+    namespace: z.ZodNullable<z.ZodEffects<z.ZodString, string, string>>;
+    networkRouteId: z.ZodString;
+    tlsTrustId: z.ZodString;
+    authentication: z.ZodObject<{
+        method: z.ZodLiteral<"approle">;
+        mount: z.ZodEffects<z.ZodString, string, string>;
+        roleId: z.ZodString;
+        bootstrapCredentialRef: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        method: "approle";
+        mount: string;
+        roleId: string;
+        bootstrapCredentialRef: string;
+    }, {
+        method: "approle";
+        mount: string;
+        roleId: string;
+        bootstrapCredentialRef: string;
+    }>;
+    status: z.ZodEnum<["unverified", "ready", "unavailable", "revoked"]>;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    status: "revoked" | "ready" | "unavailable" | "unverified";
+    id: string;
+    version: number;
+    authentication: {
+        method: "approle";
+        mount: string;
+        roleId: string;
+        bootstrapCredentialRef: string;
+    };
+    displayName: string;
+    endpoint: string;
+    namespace: string | null;
+    backend: "managed-openbao" | "external-openbao" | "hashicorp-vault";
+    ownerTeamId: string | null;
+    secretsMount: string;
+    networkRouteId: string;
+    tlsTrustId: string;
+}, {
+    status: "revoked" | "ready" | "unavailable" | "unverified";
+    id: string;
+    version: number;
+    authentication: {
+        method: "approle";
+        mount: string;
+        roleId: string;
+        bootstrapCredentialRef: string;
+    };
+    displayName: string;
+    endpoint: string;
+    namespace: string | null;
+    backend: "managed-openbao" | "external-openbao" | "hashicorp-vault";
+    ownerTeamId: string | null;
+    secretsMount: string;
+    networkRouteId: string;
+    tlsTrustId: string;
+}>;
+export type VaultDescriptor = z.infer<typeof vaultDescriptorSchema>;
+export declare const vaultAllocationSchema: z.ZodObject<{
+    id: z.ZodString;
+    vaultId: z.ZodString;
+    teamId: z.ZodString;
+    grantId: z.ZodNullable<z.ZodString>;
+    pathPrefix: z.ZodEffects<z.ZodString, string, string>;
+    permissions: z.ZodArray<z.ZodEnum<["read", "write", "delete"]>, "many">;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    version: number;
+    teamId: string;
+    grantId: string | null;
+    permissions: ("read" | "write" | "delete")[];
+    vaultId: string;
+    pathPrefix: string;
+}, {
+    id: string;
+    version: number;
+    teamId: string;
+    grantId: string | null;
+    permissions: ("read" | "write" | "delete")[];
+    vaultId: string;
+    pathPrefix: string;
+}>;
+export declare const vaultCredentialReferenceSchema: z.ZodDiscriminatedUnion<"mode", [z.ZodObject<{
+    mode: z.ZodLiteral<"managed">;
+    vaultId: z.ZodString;
+    allocationId: z.ZodString;
+    recordPath: z.ZodEffects<z.ZodString, string, string>;
+}, "strict", z.ZodTypeAny, {
+    mode: "managed";
+    vaultId: string;
+    allocationId: string;
+    recordPath: string;
+}, {
+    mode: "managed";
+    vaultId: string;
+    allocationId: string;
+    recordPath: string;
+}>, z.ZodObject<{
+    mode: z.ZodLiteral<"existing">;
+    vaultId: z.ZodString;
+    allocationId: z.ZodString;
+    recordPath: z.ZodEffects<z.ZodString, string, string>;
+    fieldMapping: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>;
+    pinnedVersion: z.ZodNullable<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    mode: "existing";
+    vaultId: string;
+    allocationId: string;
+    recordPath: string;
+    fieldMapping: Record<string, string>;
+    pinnedVersion: number | null;
+}, {
+    mode: "existing";
+    vaultId: string;
+    allocationId: string;
+    recordPath: string;
+    fieldMapping: Record<string, string>;
+    pinnedVersion: number | null;
+}>]>;
+export type VaultCredentialReference = z.infer<typeof vaultCredentialReferenceSchema>;
+export declare function assertCredentialRecordMutation(reference: VaultCredentialReference): void;

package/dist/secrets-capability/vault-contracts.js

@@ -0,0 +1,56 @@
+import { z } from "zod";
+const id = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u);
+const path = z.string().min(1).max(512).refine((value) => value.split("/").every((segment) => /^[A-Za-z0-9][A-Za-z0-9_.-]*$/u.test(segment)), "Canonical relative vault path required.");
+const endpoint = z.string().url().refine((value) => {
+  const url = new URL(value);
+  return url.protocol === "https:" && !url.username && !url.password && !url.search && !url.hash && url.pathname === "/";
+}, "HTTPS origin without credentials, query or fragment required.");
+const vaultDescriptorSchema = z.object({
+  id,
+  ownerTeamId: id.nullable(),
+  displayName: z.string().trim().min(1).max(160),
+  backend: z.enum(["managed-openbao", "external-openbao", "hashicorp-vault"]),
+  endpoint,
+  secretsMount: path,
+  namespace: path.nullable(),
+  networkRouteId: id,
+  tlsTrustId: id,
+  authentication: z.object({
+    method: z.literal("approle"),
+    mount: path,
+    roleId: z.string().min(1).max(256),
+    bootstrapCredentialRef: id
+  }).strict(),
+  status: z.enum(["unverified", "ready", "unavailable", "revoked"]),
+  version: z.number().int().nonnegative().safe()
+}).strict();
+const vaultAllocationSchema = z.object({
+  id,
+  vaultId: id,
+  teamId: id,
+  grantId: id.nullable(),
+  pathPrefix: path,
+  permissions: z.array(z.enum(["read", "write", "delete"])).min(1),
+  version: z.number().int().nonnegative().safe()
+}).strict();
+const vaultCredentialReferenceSchema = z.discriminatedUnion("mode", [
+  z.object({ mode: z.literal("managed"), vaultId: id, allocationId: id, recordPath: path }).strict(),
+  z.object({
+    mode: z.literal("existing"),
+    vaultId: id,
+    allocationId: id,
+    recordPath: path,
+    fieldMapping: z.record(id, id).refine((value) => Object.keys(value).length > 0, "At least one field mapping is required."),
+    pinnedVersion: z.number().int().positive().safe().nullable()
+  }).strict()
+]);
+function assertCredentialRecordMutation(reference) {
+  vaultCredentialReferenceSchema.parse(reference);
+  if (reference.mode === "existing") throw new Error("existing_secret_read_only");
+}
+export {
+  assertCredentialRecordMutation,
+  vaultAllocationSchema,
+  vaultCredentialReferenceSchema,
+  vaultDescriptorSchema
+};