@treeseed/sdk 0.13.0-rc.112 → 0.13.0-rc.114
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/.treeseed-build-complete.json +1 -1
- package/dist/capacity-provider/client.d.ts +43 -0
- package/dist/capacity-provider/client.js +11 -0
- package/dist/capacity-provider/environment-catalog.d.ts +4 -4
- package/dist/capacity-provider/source-workspace.d.ts +379 -2
- package/dist/capacity-provider/source-workspace.js +38 -1
- package/dist/operator-contracts/control-plane-operations.d.ts +6 -0
- package/dist/operator-contracts/control-plane-operations.js +2 -0
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"completedAt":"2026-09-
|
|
1
|
+
{"completedAt":"2026-09-11T00:17:39.136Z"}
|
|
@@ -2,6 +2,7 @@ import type { ProviderAssignmentLifecycleRequest, ProviderAssignmentLifecycleRes
|
|
|
2
2
|
import type { ProviderRuntimeEventInput } from '../agent-capacity/contracts/capacity/workdays/workday-records.js';
|
|
3
3
|
import type { CapacityProviderIdentity, CapacityProviderIdentityRotationRequest, CapacityProviderSignedProof, ProviderAccessTokenIssue, ProviderAvailabilitySession, ProviderCredentialIssuanceAuthorization, ProviderRegistrationRequest, ProviderRegistrationSubmission, ProviderTeamCredentialIssue } from './contracts/index.js';
|
|
4
4
|
import type { ProviderDiscussionResponseRequest } from '../operator-contracts/communication/contracts.js';
|
|
5
|
+
import { type SourceWorkspaceRequest } from './source-workspace.js';
|
|
5
6
|
export interface ProviderProtocolClientOptions {
|
|
6
7
|
controlPlaneUrl: string;
|
|
7
8
|
accessToken?: string;
|
|
@@ -44,6 +45,48 @@ export declare class ProviderProtocolClient {
|
|
|
44
45
|
startAssignmentExecution(assignmentId: string, request: Record<string, unknown>): Promise<Record<string, unknown>>;
|
|
45
46
|
startAssignmentCloseout(assignmentId: string, request: Record<string, unknown>): Promise<Record<string, unknown>>;
|
|
46
47
|
preflightAssignmentCompletion(assignmentId: string, request: Record<string, unknown>): Promise<Record<string, unknown>>;
|
|
48
|
+
/** Host provider transport only; the recipient key belongs to the trusted source fetch worker. */
|
|
49
|
+
authorizeAssignmentSource(assignmentId: string, request: SourceWorkspaceRequest): Promise<{
|
|
50
|
+
repository: {
|
|
51
|
+
provider: "github";
|
|
52
|
+
name: string;
|
|
53
|
+
owner: string;
|
|
54
|
+
ref: string;
|
|
55
|
+
cloneUrl: string;
|
|
56
|
+
};
|
|
57
|
+
authorization: {
|
|
58
|
+
id: string;
|
|
59
|
+
expiresAt: string;
|
|
60
|
+
schemaVersion: "treeseed.source-workspace-authorization/v1";
|
|
61
|
+
providerId: string;
|
|
62
|
+
issuedAt: string;
|
|
63
|
+
assignmentId: string;
|
|
64
|
+
source: {
|
|
65
|
+
commit: string;
|
|
66
|
+
projectId: string;
|
|
67
|
+
teamId: string;
|
|
68
|
+
profile: "source-only";
|
|
69
|
+
repositoryId: string;
|
|
70
|
+
controlPlaneId: string;
|
|
71
|
+
formatVersion: 1;
|
|
72
|
+
};
|
|
73
|
+
mode: "analysis" | "work";
|
|
74
|
+
attempt: number;
|
|
75
|
+
publication: "denied" | "candidate-only";
|
|
76
|
+
credentialBindingId: string;
|
|
77
|
+
};
|
|
78
|
+
credential: {
|
|
79
|
+
id: string;
|
|
80
|
+
nonce: string;
|
|
81
|
+
expiresAt: string;
|
|
82
|
+
schemaVersion: "treeseed.source-credential-delivery/v1";
|
|
83
|
+
algorithm: "x25519-hkdf-sha256-chacha20-poly1305";
|
|
84
|
+
ciphertext: string;
|
|
85
|
+
tag: string;
|
|
86
|
+
authorizationId: string;
|
|
87
|
+
ephemeralPublicKey: string;
|
|
88
|
+
};
|
|
89
|
+
}>;
|
|
47
90
|
respondToAssignmentDiscussion(assignmentId: string, request: ProviderDiscussionResponseRequest, idempotencyKey: string): Promise<{
|
|
48
91
|
status: "responded" | "abstained";
|
|
49
92
|
schemaVersion: "treeseed.provider-discussion-response-receipt/v1";
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { ControlPlaneClient, ControlPlaneClientError } from "../entrypoints/clients/control-plane-client.js";
|
|
2
2
|
import { CONTROL_PLANE_OPERATIONS } from "../operator-contracts/index.js";
|
|
3
|
+
import { sourceWorkspaceRequestSchema, sourceWorkspaceResponseSchema } from "./source-workspace.js";
|
|
3
4
|
class CapacityProviderApiError extends Error {
|
|
4
5
|
constructor(message, status, payload) {
|
|
5
6
|
super(message);
|
|
@@ -126,6 +127,16 @@ class ProviderProtocolClient {
|
|
|
126
127
|
preflightAssignmentCompletion(assignmentId, request) {
|
|
127
128
|
return this.invoke(CONTROL_PLANE_OPERATIONS.providers.completionPreflight, { path: { assignmentId }, body: request });
|
|
128
129
|
}
|
|
130
|
+
/** Host provider transport only; the recipient key belongs to the trusted source fetch worker. */
|
|
131
|
+
async authorizeAssignmentSource(assignmentId, request) {
|
|
132
|
+
const body = sourceWorkspaceRequestSchema.parse(request);
|
|
133
|
+
const response = sourceWorkspaceResponseSchema.parse(await this.invoke(
|
|
134
|
+
CONTROL_PLANE_OPERATIONS.providers.sourceWorkspace,
|
|
135
|
+
{ path: { assignmentId }, body }
|
|
136
|
+
));
|
|
137
|
+
if (response.authorization.assignmentId !== assignmentId) throw new CapacityProviderApiError("Source authority assignment correlation failed.", 502, { code: "source_authority_mismatch" });
|
|
138
|
+
return response;
|
|
139
|
+
}
|
|
129
140
|
respondToAssignmentDiscussion(assignmentId, request, idempotencyKey) {
|
|
130
141
|
return this.invoke(CONTROL_PLANE_OPERATIONS.providers.discussionResponse, { path: { assignmentId }, body: request }, { idempotencyKey });
|
|
131
142
|
}
|
|
@@ -823,7 +823,7 @@ export declare const providerSandboxEnvironmentAvailabilitySchema: z.ZodObject<{
|
|
|
823
823
|
checkedAt: z.ZodString;
|
|
824
824
|
reason: z.ZodNullable<z.ZodString>;
|
|
825
825
|
}, "strict", z.ZodTypeAny, {
|
|
826
|
-
status: "ready" | "failed" | "
|
|
826
|
+
status: "ready" | "failed" | "quarantined" | "pulling";
|
|
827
827
|
version: string;
|
|
828
828
|
reason: string | null;
|
|
829
829
|
contractDigest: string;
|
|
@@ -831,7 +831,7 @@ export declare const providerSandboxEnvironmentAvailabilitySchema: z.ZodObject<{
|
|
|
831
831
|
entryId: string;
|
|
832
832
|
checkedAt: string;
|
|
833
833
|
}, {
|
|
834
|
-
status: "ready" | "failed" | "
|
|
834
|
+
status: "ready" | "failed" | "quarantined" | "pulling";
|
|
835
835
|
version: string;
|
|
836
836
|
reason: string | null;
|
|
837
837
|
contractDigest: string;
|
|
@@ -841,7 +841,7 @@ export declare const providerSandboxEnvironmentAvailabilitySchema: z.ZodObject<{
|
|
|
841
841
|
}>, "many">;
|
|
842
842
|
}, "strict", z.ZodTypeAny, {
|
|
843
843
|
entries: {
|
|
844
|
-
status: "ready" | "failed" | "
|
|
844
|
+
status: "ready" | "failed" | "quarantined" | "pulling";
|
|
845
845
|
version: string;
|
|
846
846
|
reason: string | null;
|
|
847
847
|
contractDigest: string;
|
|
@@ -855,7 +855,7 @@ export declare const providerSandboxEnvironmentAvailabilitySchema: z.ZodObject<{
|
|
|
855
855
|
catalogGeneration: number;
|
|
856
856
|
}, {
|
|
857
857
|
entries: {
|
|
858
|
-
status: "ready" | "failed" | "
|
|
858
|
+
status: "ready" | "failed" | "quarantined" | "pulling";
|
|
859
859
|
version: string;
|
|
860
860
|
reason: string | null;
|
|
861
861
|
contractDigest: string;
|
|
@@ -183,7 +183,7 @@ export declare const sourceWorkspaceLeaseSchema: z.ZodObject<{
|
|
|
183
183
|
expiresAt: z.ZodString;
|
|
184
184
|
}, "strict", z.ZodTypeAny, {
|
|
185
185
|
id: string;
|
|
186
|
-
state: "active" | "released" | "
|
|
186
|
+
state: "active" | "released" | "exporting" | "quarantined";
|
|
187
187
|
expiresAt: string;
|
|
188
188
|
schemaVersion: "treeseed.source-workspace-lease/v1";
|
|
189
189
|
createdAt: string;
|
|
@@ -205,7 +205,7 @@ export declare const sourceWorkspaceLeaseSchema: z.ZodObject<{
|
|
|
205
205
|
workspaceDigest: string;
|
|
206
206
|
}, {
|
|
207
207
|
id: string;
|
|
208
|
-
state: "active" | "released" | "
|
|
208
|
+
state: "active" | "released" | "exporting" | "quarantined";
|
|
209
209
|
expiresAt: string;
|
|
210
210
|
schemaVersion: "treeseed.source-workspace-lease/v1";
|
|
211
211
|
createdAt: string;
|
|
@@ -342,3 +342,380 @@ export type SourceWorkspaceKey = z.infer<typeof sourceWorkspaceKeySchema>;
|
|
|
342
342
|
export type SourceWorkspaceAuthorization = z.infer<typeof sourceWorkspaceAuthorizationSchema>;
|
|
343
343
|
export type SourceWorkspaceLease = z.infer<typeof sourceWorkspaceLeaseSchema>;
|
|
344
344
|
export type SourceCandidateReceipt = z.infer<typeof sourceCandidateReceiptSchema>;
|
|
345
|
+
/** Provider-manager transport only. Recipient is an ephemeral host key, never a guest key. */
|
|
346
|
+
export declare const sourceWorkspaceRequestSchema: z.ZodObject<{
|
|
347
|
+
runnerId: z.ZodString;
|
|
348
|
+
leaseToken: z.ZodString;
|
|
349
|
+
recipientPublicKey: z.ZodString;
|
|
350
|
+
}, "strict", z.ZodTypeAny, {
|
|
351
|
+
runnerId: string;
|
|
352
|
+
leaseToken: string;
|
|
353
|
+
recipientPublicKey: string;
|
|
354
|
+
}, {
|
|
355
|
+
runnerId: string;
|
|
356
|
+
leaseToken: string;
|
|
357
|
+
recipientPublicKey: string;
|
|
358
|
+
}>;
|
|
359
|
+
export declare const sourceCredentialDeliverySchema: z.ZodObject<{
|
|
360
|
+
schemaVersion: z.ZodLiteral<"treeseed.source-credential-delivery/v1">;
|
|
361
|
+
id: z.ZodString;
|
|
362
|
+
authorizationId: z.ZodString;
|
|
363
|
+
algorithm: z.ZodLiteral<"x25519-hkdf-sha256-chacha20-poly1305">;
|
|
364
|
+
ephemeralPublicKey: z.ZodString;
|
|
365
|
+
nonce: z.ZodString;
|
|
366
|
+
ciphertext: z.ZodString;
|
|
367
|
+
tag: z.ZodString;
|
|
368
|
+
expiresAt: z.ZodString;
|
|
369
|
+
}, "strict", z.ZodTypeAny, {
|
|
370
|
+
id: string;
|
|
371
|
+
nonce: string;
|
|
372
|
+
expiresAt: string;
|
|
373
|
+
schemaVersion: "treeseed.source-credential-delivery/v1";
|
|
374
|
+
algorithm: "x25519-hkdf-sha256-chacha20-poly1305";
|
|
375
|
+
ciphertext: string;
|
|
376
|
+
tag: string;
|
|
377
|
+
authorizationId: string;
|
|
378
|
+
ephemeralPublicKey: string;
|
|
379
|
+
}, {
|
|
380
|
+
id: string;
|
|
381
|
+
nonce: string;
|
|
382
|
+
expiresAt: string;
|
|
383
|
+
schemaVersion: "treeseed.source-credential-delivery/v1";
|
|
384
|
+
algorithm: "x25519-hkdf-sha256-chacha20-poly1305";
|
|
385
|
+
ciphertext: string;
|
|
386
|
+
tag: string;
|
|
387
|
+
authorizationId: string;
|
|
388
|
+
ephemeralPublicKey: string;
|
|
389
|
+
}>;
|
|
390
|
+
export declare const sourceWorkspaceResponseSchema: z.ZodEffects<z.ZodObject<{
|
|
391
|
+
authorization: z.ZodEffects<z.ZodObject<{
|
|
392
|
+
schemaVersion: z.ZodLiteral<"treeseed.source-workspace-authorization/v1">;
|
|
393
|
+
id: z.ZodString;
|
|
394
|
+
providerId: z.ZodString;
|
|
395
|
+
assignmentId: z.ZodString;
|
|
396
|
+
attempt: z.ZodNumber;
|
|
397
|
+
source: z.ZodObject<{
|
|
398
|
+
controlPlaneId: z.ZodString;
|
|
399
|
+
teamId: z.ZodString;
|
|
400
|
+
projectId: z.ZodString;
|
|
401
|
+
repositoryId: z.ZodString;
|
|
402
|
+
commit: z.ZodString;
|
|
403
|
+
formatVersion: z.ZodLiteral<1>;
|
|
404
|
+
profile: z.ZodLiteral<"source-only">;
|
|
405
|
+
}, "strict", z.ZodTypeAny, {
|
|
406
|
+
commit: string;
|
|
407
|
+
projectId: string;
|
|
408
|
+
teamId: string;
|
|
409
|
+
profile: "source-only";
|
|
410
|
+
repositoryId: string;
|
|
411
|
+
controlPlaneId: string;
|
|
412
|
+
formatVersion: 1;
|
|
413
|
+
}, {
|
|
414
|
+
commit: string;
|
|
415
|
+
projectId: string;
|
|
416
|
+
teamId: string;
|
|
417
|
+
profile: "source-only";
|
|
418
|
+
repositoryId: string;
|
|
419
|
+
controlPlaneId: string;
|
|
420
|
+
formatVersion: 1;
|
|
421
|
+
}>;
|
|
422
|
+
mode: z.ZodEnum<["analysis", "work"]>;
|
|
423
|
+
publication: z.ZodEnum<["denied", "candidate-only"]>;
|
|
424
|
+
credentialBindingId: z.ZodString;
|
|
425
|
+
issuedAt: z.ZodString;
|
|
426
|
+
expiresAt: z.ZodString;
|
|
427
|
+
}, "strict", z.ZodTypeAny, {
|
|
428
|
+
id: string;
|
|
429
|
+
expiresAt: string;
|
|
430
|
+
schemaVersion: "treeseed.source-workspace-authorization/v1";
|
|
431
|
+
providerId: string;
|
|
432
|
+
issuedAt: string;
|
|
433
|
+
assignmentId: string;
|
|
434
|
+
source: {
|
|
435
|
+
commit: string;
|
|
436
|
+
projectId: string;
|
|
437
|
+
teamId: string;
|
|
438
|
+
profile: "source-only";
|
|
439
|
+
repositoryId: string;
|
|
440
|
+
controlPlaneId: string;
|
|
441
|
+
formatVersion: 1;
|
|
442
|
+
};
|
|
443
|
+
mode: "analysis" | "work";
|
|
444
|
+
attempt: number;
|
|
445
|
+
publication: "denied" | "candidate-only";
|
|
446
|
+
credentialBindingId: string;
|
|
447
|
+
}, {
|
|
448
|
+
id: string;
|
|
449
|
+
expiresAt: string;
|
|
450
|
+
schemaVersion: "treeseed.source-workspace-authorization/v1";
|
|
451
|
+
providerId: string;
|
|
452
|
+
issuedAt: string;
|
|
453
|
+
assignmentId: string;
|
|
454
|
+
source: {
|
|
455
|
+
commit: string;
|
|
456
|
+
projectId: string;
|
|
457
|
+
teamId: string;
|
|
458
|
+
profile: "source-only";
|
|
459
|
+
repositoryId: string;
|
|
460
|
+
controlPlaneId: string;
|
|
461
|
+
formatVersion: 1;
|
|
462
|
+
};
|
|
463
|
+
mode: "analysis" | "work";
|
|
464
|
+
attempt: number;
|
|
465
|
+
publication: "denied" | "candidate-only";
|
|
466
|
+
credentialBindingId: string;
|
|
467
|
+
}>, {
|
|
468
|
+
id: string;
|
|
469
|
+
expiresAt: string;
|
|
470
|
+
schemaVersion: "treeseed.source-workspace-authorization/v1";
|
|
471
|
+
providerId: string;
|
|
472
|
+
issuedAt: string;
|
|
473
|
+
assignmentId: string;
|
|
474
|
+
source: {
|
|
475
|
+
commit: string;
|
|
476
|
+
projectId: string;
|
|
477
|
+
teamId: string;
|
|
478
|
+
profile: "source-only";
|
|
479
|
+
repositoryId: string;
|
|
480
|
+
controlPlaneId: string;
|
|
481
|
+
formatVersion: 1;
|
|
482
|
+
};
|
|
483
|
+
mode: "analysis" | "work";
|
|
484
|
+
attempt: number;
|
|
485
|
+
publication: "denied" | "candidate-only";
|
|
486
|
+
credentialBindingId: string;
|
|
487
|
+
}, {
|
|
488
|
+
id: string;
|
|
489
|
+
expiresAt: string;
|
|
490
|
+
schemaVersion: "treeseed.source-workspace-authorization/v1";
|
|
491
|
+
providerId: string;
|
|
492
|
+
issuedAt: string;
|
|
493
|
+
assignmentId: string;
|
|
494
|
+
source: {
|
|
495
|
+
commit: string;
|
|
496
|
+
projectId: string;
|
|
497
|
+
teamId: string;
|
|
498
|
+
profile: "source-only";
|
|
499
|
+
repositoryId: string;
|
|
500
|
+
controlPlaneId: string;
|
|
501
|
+
formatVersion: 1;
|
|
502
|
+
};
|
|
503
|
+
mode: "analysis" | "work";
|
|
504
|
+
attempt: number;
|
|
505
|
+
publication: "denied" | "candidate-only";
|
|
506
|
+
credentialBindingId: string;
|
|
507
|
+
}>;
|
|
508
|
+
repository: z.ZodObject<{
|
|
509
|
+
provider: z.ZodLiteral<"github">;
|
|
510
|
+
owner: z.ZodString;
|
|
511
|
+
name: z.ZodString;
|
|
512
|
+
cloneUrl: z.ZodString;
|
|
513
|
+
ref: z.ZodString;
|
|
514
|
+
}, "strict", z.ZodTypeAny, {
|
|
515
|
+
provider: "github";
|
|
516
|
+
name: string;
|
|
517
|
+
owner: string;
|
|
518
|
+
ref: string;
|
|
519
|
+
cloneUrl: string;
|
|
520
|
+
}, {
|
|
521
|
+
provider: "github";
|
|
522
|
+
name: string;
|
|
523
|
+
owner: string;
|
|
524
|
+
ref: string;
|
|
525
|
+
cloneUrl: string;
|
|
526
|
+
}>;
|
|
527
|
+
credential: z.ZodObject<{
|
|
528
|
+
schemaVersion: z.ZodLiteral<"treeseed.source-credential-delivery/v1">;
|
|
529
|
+
id: z.ZodString;
|
|
530
|
+
authorizationId: z.ZodString;
|
|
531
|
+
algorithm: z.ZodLiteral<"x25519-hkdf-sha256-chacha20-poly1305">;
|
|
532
|
+
ephemeralPublicKey: z.ZodString;
|
|
533
|
+
nonce: z.ZodString;
|
|
534
|
+
ciphertext: z.ZodString;
|
|
535
|
+
tag: z.ZodString;
|
|
536
|
+
expiresAt: z.ZodString;
|
|
537
|
+
}, "strict", z.ZodTypeAny, {
|
|
538
|
+
id: string;
|
|
539
|
+
nonce: string;
|
|
540
|
+
expiresAt: string;
|
|
541
|
+
schemaVersion: "treeseed.source-credential-delivery/v1";
|
|
542
|
+
algorithm: "x25519-hkdf-sha256-chacha20-poly1305";
|
|
543
|
+
ciphertext: string;
|
|
544
|
+
tag: string;
|
|
545
|
+
authorizationId: string;
|
|
546
|
+
ephemeralPublicKey: string;
|
|
547
|
+
}, {
|
|
548
|
+
id: string;
|
|
549
|
+
nonce: string;
|
|
550
|
+
expiresAt: string;
|
|
551
|
+
schemaVersion: "treeseed.source-credential-delivery/v1";
|
|
552
|
+
algorithm: "x25519-hkdf-sha256-chacha20-poly1305";
|
|
553
|
+
ciphertext: string;
|
|
554
|
+
tag: string;
|
|
555
|
+
authorizationId: string;
|
|
556
|
+
ephemeralPublicKey: string;
|
|
557
|
+
}>;
|
|
558
|
+
}, "strict", z.ZodTypeAny, {
|
|
559
|
+
repository: {
|
|
560
|
+
provider: "github";
|
|
561
|
+
name: string;
|
|
562
|
+
owner: string;
|
|
563
|
+
ref: string;
|
|
564
|
+
cloneUrl: string;
|
|
565
|
+
};
|
|
566
|
+
authorization: {
|
|
567
|
+
id: string;
|
|
568
|
+
expiresAt: string;
|
|
569
|
+
schemaVersion: "treeseed.source-workspace-authorization/v1";
|
|
570
|
+
providerId: string;
|
|
571
|
+
issuedAt: string;
|
|
572
|
+
assignmentId: string;
|
|
573
|
+
source: {
|
|
574
|
+
commit: string;
|
|
575
|
+
projectId: string;
|
|
576
|
+
teamId: string;
|
|
577
|
+
profile: "source-only";
|
|
578
|
+
repositoryId: string;
|
|
579
|
+
controlPlaneId: string;
|
|
580
|
+
formatVersion: 1;
|
|
581
|
+
};
|
|
582
|
+
mode: "analysis" | "work";
|
|
583
|
+
attempt: number;
|
|
584
|
+
publication: "denied" | "candidate-only";
|
|
585
|
+
credentialBindingId: string;
|
|
586
|
+
};
|
|
587
|
+
credential: {
|
|
588
|
+
id: string;
|
|
589
|
+
nonce: string;
|
|
590
|
+
expiresAt: string;
|
|
591
|
+
schemaVersion: "treeseed.source-credential-delivery/v1";
|
|
592
|
+
algorithm: "x25519-hkdf-sha256-chacha20-poly1305";
|
|
593
|
+
ciphertext: string;
|
|
594
|
+
tag: string;
|
|
595
|
+
authorizationId: string;
|
|
596
|
+
ephemeralPublicKey: string;
|
|
597
|
+
};
|
|
598
|
+
}, {
|
|
599
|
+
repository: {
|
|
600
|
+
provider: "github";
|
|
601
|
+
name: string;
|
|
602
|
+
owner: string;
|
|
603
|
+
ref: string;
|
|
604
|
+
cloneUrl: string;
|
|
605
|
+
};
|
|
606
|
+
authorization: {
|
|
607
|
+
id: string;
|
|
608
|
+
expiresAt: string;
|
|
609
|
+
schemaVersion: "treeseed.source-workspace-authorization/v1";
|
|
610
|
+
providerId: string;
|
|
611
|
+
issuedAt: string;
|
|
612
|
+
assignmentId: string;
|
|
613
|
+
source: {
|
|
614
|
+
commit: string;
|
|
615
|
+
projectId: string;
|
|
616
|
+
teamId: string;
|
|
617
|
+
profile: "source-only";
|
|
618
|
+
repositoryId: string;
|
|
619
|
+
controlPlaneId: string;
|
|
620
|
+
formatVersion: 1;
|
|
621
|
+
};
|
|
622
|
+
mode: "analysis" | "work";
|
|
623
|
+
attempt: number;
|
|
624
|
+
publication: "denied" | "candidate-only";
|
|
625
|
+
credentialBindingId: string;
|
|
626
|
+
};
|
|
627
|
+
credential: {
|
|
628
|
+
id: string;
|
|
629
|
+
nonce: string;
|
|
630
|
+
expiresAt: string;
|
|
631
|
+
schemaVersion: "treeseed.source-credential-delivery/v1";
|
|
632
|
+
algorithm: "x25519-hkdf-sha256-chacha20-poly1305";
|
|
633
|
+
ciphertext: string;
|
|
634
|
+
tag: string;
|
|
635
|
+
authorizationId: string;
|
|
636
|
+
ephemeralPublicKey: string;
|
|
637
|
+
};
|
|
638
|
+
}>, {
|
|
639
|
+
repository: {
|
|
640
|
+
provider: "github";
|
|
641
|
+
name: string;
|
|
642
|
+
owner: string;
|
|
643
|
+
ref: string;
|
|
644
|
+
cloneUrl: string;
|
|
645
|
+
};
|
|
646
|
+
authorization: {
|
|
647
|
+
id: string;
|
|
648
|
+
expiresAt: string;
|
|
649
|
+
schemaVersion: "treeseed.source-workspace-authorization/v1";
|
|
650
|
+
providerId: string;
|
|
651
|
+
issuedAt: string;
|
|
652
|
+
assignmentId: string;
|
|
653
|
+
source: {
|
|
654
|
+
commit: string;
|
|
655
|
+
projectId: string;
|
|
656
|
+
teamId: string;
|
|
657
|
+
profile: "source-only";
|
|
658
|
+
repositoryId: string;
|
|
659
|
+
controlPlaneId: string;
|
|
660
|
+
formatVersion: 1;
|
|
661
|
+
};
|
|
662
|
+
mode: "analysis" | "work";
|
|
663
|
+
attempt: number;
|
|
664
|
+
publication: "denied" | "candidate-only";
|
|
665
|
+
credentialBindingId: string;
|
|
666
|
+
};
|
|
667
|
+
credential: {
|
|
668
|
+
id: string;
|
|
669
|
+
nonce: string;
|
|
670
|
+
expiresAt: string;
|
|
671
|
+
schemaVersion: "treeseed.source-credential-delivery/v1";
|
|
672
|
+
algorithm: "x25519-hkdf-sha256-chacha20-poly1305";
|
|
673
|
+
ciphertext: string;
|
|
674
|
+
tag: string;
|
|
675
|
+
authorizationId: string;
|
|
676
|
+
ephemeralPublicKey: string;
|
|
677
|
+
};
|
|
678
|
+
}, {
|
|
679
|
+
repository: {
|
|
680
|
+
provider: "github";
|
|
681
|
+
name: string;
|
|
682
|
+
owner: string;
|
|
683
|
+
ref: string;
|
|
684
|
+
cloneUrl: string;
|
|
685
|
+
};
|
|
686
|
+
authorization: {
|
|
687
|
+
id: string;
|
|
688
|
+
expiresAt: string;
|
|
689
|
+
schemaVersion: "treeseed.source-workspace-authorization/v1";
|
|
690
|
+
providerId: string;
|
|
691
|
+
issuedAt: string;
|
|
692
|
+
assignmentId: string;
|
|
693
|
+
source: {
|
|
694
|
+
commit: string;
|
|
695
|
+
projectId: string;
|
|
696
|
+
teamId: string;
|
|
697
|
+
profile: "source-only";
|
|
698
|
+
repositoryId: string;
|
|
699
|
+
controlPlaneId: string;
|
|
700
|
+
formatVersion: 1;
|
|
701
|
+
};
|
|
702
|
+
mode: "analysis" | "work";
|
|
703
|
+
attempt: number;
|
|
704
|
+
publication: "denied" | "candidate-only";
|
|
705
|
+
credentialBindingId: string;
|
|
706
|
+
};
|
|
707
|
+
credential: {
|
|
708
|
+
id: string;
|
|
709
|
+
nonce: string;
|
|
710
|
+
expiresAt: string;
|
|
711
|
+
schemaVersion: "treeseed.source-credential-delivery/v1";
|
|
712
|
+
algorithm: "x25519-hkdf-sha256-chacha20-poly1305";
|
|
713
|
+
ciphertext: string;
|
|
714
|
+
tag: string;
|
|
715
|
+
authorizationId: string;
|
|
716
|
+
ephemeralPublicKey: string;
|
|
717
|
+
};
|
|
718
|
+
}>;
|
|
719
|
+
export type SourceCredentialDelivery = z.infer<typeof sourceCredentialDeliverySchema>;
|
|
720
|
+
export type SourceWorkspaceRequest = z.infer<typeof sourceWorkspaceRequestSchema>;
|
|
721
|
+
export type SourceWorkspaceResponse = z.infer<typeof sourceWorkspaceResponseSchema>;
|
|
@@ -57,9 +57,46 @@ const sourceCandidateReceiptSchema = z.object({
|
|
|
57
57
|
verification: z.object({ objectClosure: z.literal(true), ancestry: z.literal(true), authority: z.literal(true) }).strict(),
|
|
58
58
|
persistedAt: z.string().datetime()
|
|
59
59
|
}).strict();
|
|
60
|
+
const sourceWorkspaceRequestSchema = z.object({
|
|
61
|
+
runnerId: id,
|
|
62
|
+
leaseToken: z.string().min(1).max(4096),
|
|
63
|
+
recipientPublicKey: z.string().regex(/^[A-Za-z0-9+/]{43}=$/u)
|
|
64
|
+
}).strict();
|
|
65
|
+
const sourceCredentialDeliverySchema = z.object({
|
|
66
|
+
schemaVersion: z.literal("treeseed.source-credential-delivery/v1"),
|
|
67
|
+
id,
|
|
68
|
+
authorizationId: id,
|
|
69
|
+
algorithm: z.literal("x25519-hkdf-sha256-chacha20-poly1305"),
|
|
70
|
+
ephemeralPublicKey: z.string().regex(/^[A-Za-z0-9+/]{43}=$/u),
|
|
71
|
+
nonce: z.string().regex(/^[A-Za-z0-9+/]{16}$/u),
|
|
72
|
+
ciphertext: z.string().min(1).max(16384),
|
|
73
|
+
tag: z.string().regex(/^[A-Za-z0-9+/]{22}==$/u),
|
|
74
|
+
expiresAt: z.string().datetime()
|
|
75
|
+
}).strict();
|
|
76
|
+
const sourceWorkspaceResponseSchema = z.object({
|
|
77
|
+
authorization: sourceWorkspaceAuthorizationSchema,
|
|
78
|
+
repository: z.object({
|
|
79
|
+
provider: z.literal("github"),
|
|
80
|
+
owner: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9-]{0,99}$/u),
|
|
81
|
+
name: z.string().regex(/^[a-zA-Z0-9_][a-zA-Z0-9_.-]{0,99}$/u),
|
|
82
|
+
cloneUrl: z.string().url().startsWith("https://github.com/"),
|
|
83
|
+
ref: id
|
|
84
|
+
}).strict(),
|
|
85
|
+
credential: sourceCredentialDeliverySchema
|
|
86
|
+
}).strict().superRefine((value, context) => {
|
|
87
|
+
if (value.repository.cloneUrl !== `https://github.com/${value.repository.owner}/${value.repository.name}.git`) {
|
|
88
|
+
context.addIssue({ code: z.ZodIssueCode.custom, path: ["repository", "cloneUrl"], message: "Source transport must match its provider repository." });
|
|
89
|
+
}
|
|
90
|
+
if (value.credential.authorizationId !== value.authorization.id || value.credential.expiresAt !== value.authorization.expiresAt) {
|
|
91
|
+
context.addIssue({ code: z.ZodIssueCode.custom, path: ["credential"], message: "Source credential delivery must match exact authorization and lifetime." });
|
|
92
|
+
}
|
|
93
|
+
});
|
|
60
94
|
export {
|
|
61
95
|
sourceCandidateReceiptSchema,
|
|
96
|
+
sourceCredentialDeliverySchema,
|
|
62
97
|
sourceWorkspaceAuthorizationSchema,
|
|
63
98
|
sourceWorkspaceKeySchema,
|
|
64
|
-
sourceWorkspaceLeaseSchema
|
|
99
|
+
sourceWorkspaceLeaseSchema,
|
|
100
|
+
sourceWorkspaceRequestSchema,
|
|
101
|
+
sourceWorkspaceResponseSchema
|
|
65
102
|
};
|
|
@@ -2567,6 +2567,12 @@ export declare const CONTROL_PLANE_OPERATIONS: {
|
|
|
2567
2567
|
readonly assignmentExplanation: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
|
|
2568
2568
|
assignmentId: string;
|
|
2569
2569
|
}, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
|
|
2570
|
+
readonly sourceWorkspace: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
|
|
2571
|
+
assignmentId: string;
|
|
2572
|
+
}, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
|
|
2573
|
+
readonly sourceCandidate: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
|
|
2574
|
+
assignmentId: string;
|
|
2575
|
+
}, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
|
|
2570
2576
|
readonly renewAssignment: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
|
|
2571
2577
|
assignmentId: string;
|
|
2572
2578
|
}, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
|
|
@@ -481,6 +481,8 @@ const CONTROL_PLANE_OPERATIONS = {
|
|
|
481
481
|
nextAssignment: noPathProvider("providers.assignments.next", "POST", "/v1/provider/assignments/next"),
|
|
482
482
|
assignment: providerPath("providers.assignments.show", "GET", "/v1/provider/assignments/{assignmentId}", { assignmentId: z.string().min(1) }, { read: true }),
|
|
483
483
|
assignmentExplanation: providerPath("providers.assignments.explain", "GET", "/v1/provider/assignments/{assignmentId}/explanation", { assignmentId: z.string().min(1) }, { read: true }),
|
|
484
|
+
sourceWorkspace: providerPath("providers.assignments.source.authorize", "POST", "/v1/provider/assignments/{assignmentId}/source-workspace", { assignmentId: z.string().min(1) }, { redactedPaths: ["body.leaseToken", "output.credential.ciphertext"] }),
|
|
485
|
+
sourceCandidate: providerPath("providers.assignments.source.candidate", "POST", "/v1/provider/assignments/{assignmentId}/source-candidates", { assignmentId: z.string().min(1) }, { redactedPaths: ["body.leaseToken"] }),
|
|
484
486
|
renewAssignment: providerPath("providers.assignments.renew", "POST", "/v1/provider/assignments/{assignmentId}/renew", { assignmentId: z.string().min(1) }),
|
|
485
487
|
startExecution: providerPath("providers.assignments.execution.start", "POST", "/v1/provider/assignments/{assignmentId}/execution-start", { assignmentId: z.string().min(1) }),
|
|
486
488
|
startCloseout: providerPath("providers.assignments.closeout.start", "POST", "/v1/provider/assignments/{assignmentId}/closeout-start", { assignmentId: z.string().min(1) }),
|