@treeseed/sdk 0.13.0-rc.53 → 0.13.0-rc.55

package/dist/operator-contracts/inbox/contracts.js

@@ -0,0 +1,134 @@
+import { z } from "zod";
+const inboxItemKindSchema = z.enum(["proposal", "question"]);
+const inboxItemStatusSchema = z.enum(["outstanding", "answered", "approved", "rejected", "closed", "deleted"]);
+const inboxActionKindSchema = z.enum(["publish_revision", "approve", "reject", "comment", "answer", "reply", "reopen"]);
+const inboxProvenanceSchema = z.object({
+  repositoryId: z.string().nullable(),
+  contentPath: z.string().nullable(),
+  commitSha: z.string().nullable(),
+  digest: z.string().nullable()
+}).strict();
+const inboxActionDescriptorSchema = z.object({
+  action: inboxActionKindSchema,
+  label: z.string(),
+  enabled: z.boolean(),
+  reason: z.string().nullable(),
+  requiresFeedback: z.boolean(),
+  confirmation: z.enum(["never", "input_required"])
+}).strict();
+const inboxCommentSchema = z.object({
+  id: z.string(),
+  parentId: z.string().nullable(),
+  kind: z.enum(["comment", "answer", "reply"]),
+  authorId: z.string(),
+  authorLabel: z.string(),
+  markdown: z.string(),
+  createdAt: z.string().datetime(),
+  provenance: inboxProvenanceSchema
+}).strict();
+const inboxItemSchema = z.object({
+  schemaVersion: z.literal("treeseed.inbox-item/v1"),
+  id: z.string(),
+  teamId: z.string(),
+  projectId: z.string(),
+  projectSlug: z.string(),
+  kind: inboxItemKindSchema,
+  title: z.string(),
+  markdown: z.string(),
+  status: inboxItemStatusSchema,
+  authorId: z.string(),
+  authorLabel: z.string(),
+  version: z.number().int().positive(),
+  discussionId: z.string().nullable(),
+  createdAt: z.string().datetime(),
+  updatedAt: z.string().datetime(),
+  provenance: inboxProvenanceSchema,
+  availableActions: z.array(inboxActionDescriptorSchema),
+  comments: z.array(inboxCommentSchema),
+  etag: z.string()
+}).strict();
+const inboxItemSummarySchema = inboxItemSchema.pick({
+  id: true,
+  teamId: true,
+  projectId: true,
+  projectSlug: true,
+  kind: true,
+  title: true,
+  status: true,
+  authorId: true,
+  authorLabel: true,
+  version: true,
+  createdAt: true,
+  updatedAt: true,
+  etag: true
+});
+const inboxItemPageSchema = z.object({
+  schemaVersion: z.literal("treeseed.inbox-page/v1"),
+  items: z.array(inboxItemSummarySchema),
+  cursor: z.string().nullable()
+}).strict();
+const inboxEventSchema = z.object({
+  schemaVersion: z.literal("treeseed.inbox-event/v1"),
+  sequence: z.string(),
+  id: z.string(),
+  teamId: z.string(),
+  itemId: z.string().nullable(),
+  type: z.enum(["item.created", "item.updated", "item.deleted", "draft.updated", "comment.created", "question.answered", "question.reopened", "proposal.revised", "proposal.decided"]),
+  actorId: z.string(),
+  occurredAt: z.string().datetime(),
+  summary: z.string(),
+  payload: z.record(z.unknown())
+}).strict();
+const inboxTimelineSchema = z.object({ events: z.array(inboxEventSchema), cursor: z.string() }).strict();
+const inboxDraftPurposeSchema = z.enum(["feedback", "proposal_revision"]);
+const inboxDraftSchema = z.object({
+  schemaVersion: z.literal("treeseed.inbox-draft/v1"),
+  itemId: z.string(),
+  purpose: inboxDraftPurposeSchema,
+  markdown: z.string(),
+  baseVersion: z.number().int().positive(),
+  revision: z.number().int().nonnegative(),
+  updatedAt: z.string().datetime(),
+  etag: z.string()
+}).strict();
+const inboxDraftWriteSchema = z.object({ markdown: z.string().max(1e5), baseVersion: z.number().int().positive() }).strict();
+const inboxQuestionCreateSchema = z.object({
+  projectId: z.string(),
+  title: z.string().trim().min(1).max(180),
+  markdown: z.string().trim().min(1).max(1e5),
+  recipients: z.array(z.string()).max(64).default([]),
+  relatedObjectives: z.array(z.string()).max(64).default([])
+}).strict();
+const inboxActionRequestSchema = z.object({
+  action: inboxActionKindSchema,
+  markdown: z.string().max(1e5).optional(),
+  parentId: z.string().optional(),
+  changeReason: z.string().max(2e3).optional(),
+  draftRevision: z.number().int().nonnegative().optional()
+}).strict();
+const inboxMutationReceiptSchema = z.object({
+  schemaVersion: z.literal("treeseed.inbox-mutation-receipt/v1"),
+  item: inboxItemSchema,
+  action: inboxActionKindSchema.optional(),
+  replayed: z.boolean(),
+  receipts: z.array(z.record(z.unknown())).default([])
+}).strict();
+export {
+  inboxActionDescriptorSchema,
+  inboxActionKindSchema,
+  inboxActionRequestSchema,
+  inboxCommentSchema,
+  inboxDraftPurposeSchema,
+  inboxDraftSchema,
+  inboxDraftWriteSchema,
+  inboxEventSchema,
+  inboxItemKindSchema,
+  inboxItemPageSchema,
+  inboxItemSchema,
+  inboxItemStatusSchema,
+  inboxItemSummarySchema,
+  inboxMutationReceiptSchema,
+  inboxProvenanceSchema,
+  inboxQuestionCreateSchema,
+  inboxTimelineSchema
+};

package/dist/operator-contracts/index.d.ts

@@ -8,4 +8,5 @@ export * from './mcp.js';
 export * from './oauth.js';
 export * from './communication/contracts.js';
 export * from './communication/addressing.js';
+export * from './inbox/contracts.js';
 export * from './seed/seed-bundle.js';

package/dist/operator-contracts/index.js

@@ -8,4 +8,5 @@ export * from "./mcp.js";
 export * from "./oauth.js";
 export * from "./communication/contracts.js";
 export * from "./communication/addressing.js";
+export * from "./inbox/contracts.js";
 export * from "./seed/seed-bundle.js";

package/dist/operator-contracts/mcp.js

@@ -10,7 +10,7 @@ const TREESEED_MCP_PROMPTS = [
   { name: "research", description: "Research a governed TreeSeed question and accumulate knowledge.", argumentSchemaId: "treeseed.prompt.objective/v1", requiredScopes: ["treeseed:read"] },
   { name: "governance-review", description: "Review a proposal or decision using current governance evidence.", argumentSchemaId: "treeseed.prompt.objective/v1", requiredScopes: ["treeseed:read"] },
   { name: "workday-planning", description: "Plan a time-based workday without bypassing API authority.", argumentSchemaId: "treeseed.prompt.objective/v1", requiredScopes: ["treeseed:read"] },
-  { name: "project-agent-chat", description: "Prepare an explicit governed project-agent chat invocation.", argumentSchemaId: "treeseed.prompt.objective/v1", requiredScopes: ["treeseed:read"] }
+  { name: "project-agent-chat", description: "Prepare an explicit governed team-topic chat invocation for project agents.", argumentSchemaId: "treeseed.prompt.objective/v1", requiredScopes: ["treeseed:read"] }
 ];
 function resourcePath(restPath) {
   const [root, version, ...segments] = restPath.split("/");

package/dist/security/encrypted-envelope.d.ts

@@ -0,0 +1,177 @@
+import { z } from 'zod';
+export declare const encryptedEnvelopeAadSchema: z.ZodObject<{
+    purpose: z.ZodString;
+    teamId: z.ZodOptional<z.ZodString>;
+    resourceType: z.ZodString;
+    resourceId: z.ZodString;
+    topicId: z.ZodOptional<z.ZodString>;
+    sendId: z.ZodOptional<z.ZodString>;
+    invocationId: z.ZodOptional<z.ZodString>;
+    assignmentId: z.ZodOptional<z.ZodString>;
+    sequence: z.ZodOptional<z.ZodNumber>;
+    eventType: z.ZodOptional<z.ZodString>;
+    schemaVersion: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    purpose: string;
+    resourceType: string;
+    resourceId: string;
+    schemaVersion: string;
+    teamId?: string | undefined;
+    topicId?: string | undefined;
+    sendId?: string | undefined;
+    invocationId?: string | undefined;
+    assignmentId?: string | undefined;
+    sequence?: number | undefined;
+    eventType?: string | undefined;
+}, {
+    purpose: string;
+    resourceType: string;
+    resourceId: string;
+    schemaVersion: string;
+    teamId?: string | undefined;
+    topicId?: string | undefined;
+    sendId?: string | undefined;
+    invocationId?: string | undefined;
+    assignmentId?: string | undefined;
+    sequence?: number | undefined;
+    eventType?: string | undefined;
+}>;
+export declare const encryptedEnvelopeSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.encrypted-envelope/v1">;
+    algorithm: z.ZodLiteral<"aes-256-gcm">;
+    keyProvider: z.ZodString;
+    keyId: z.ZodString;
+    keyVersion: z.ZodNumber;
+    wrappedDek: z.ZodObject<{
+        nonce: z.ZodString;
+        authenticationTag: z.ZodString;
+        ciphertext: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        nonce: string;
+        authenticationTag: string;
+        ciphertext: string;
+    }, {
+        nonce: string;
+        authenticationTag: string;
+        ciphertext: string;
+    }>;
+    payload: z.ZodObject<{
+        nonce: z.ZodString;
+        authenticationTag: z.ZodString;
+        ciphertext: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        nonce: string;
+        authenticationTag: string;
+        ciphertext: string;
+    }, {
+        nonce: string;
+        authenticationTag: string;
+        ciphertext: string;
+    }>;
+    aad: z.ZodObject<{
+        purpose: z.ZodString;
+        teamId: z.ZodOptional<z.ZodString>;
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+        topicId: z.ZodOptional<z.ZodString>;
+        sendId: z.ZodOptional<z.ZodString>;
+        invocationId: z.ZodOptional<z.ZodString>;
+        assignmentId: z.ZodOptional<z.ZodString>;
+        sequence: z.ZodOptional<z.ZodNumber>;
+        eventType: z.ZodOptional<z.ZodString>;
+        schemaVersion: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        purpose: string;
+        resourceType: string;
+        resourceId: string;
+        schemaVersion: string;
+        teamId?: string | undefined;
+        topicId?: string | undefined;
+        sendId?: string | undefined;
+        invocationId?: string | undefined;
+        assignmentId?: string | undefined;
+        sequence?: number | undefined;
+        eventType?: string | undefined;
+    }, {
+        purpose: string;
+        resourceType: string;
+        resourceId: string;
+        schemaVersion: string;
+        teamId?: string | undefined;
+        topicId?: string | undefined;
+        sendId?: string | undefined;
+        invocationId?: string | undefined;
+        assignmentId?: string | undefined;
+        sequence?: number | undefined;
+        eventType?: string | undefined;
+    }>;
+    aadDigest: z.ZodString;
+    ciphertextDigest: z.ZodString;
+    createdAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.encrypted-envelope/v1";
+    algorithm: "aes-256-gcm";
+    keyProvider: string;
+    keyId: string;
+    keyVersion: number;
+    wrappedDek: {
+        nonce: string;
+        authenticationTag: string;
+        ciphertext: string;
+    };
+    payload: {
+        nonce: string;
+        authenticationTag: string;
+        ciphertext: string;
+    };
+    aad: {
+        purpose: string;
+        resourceType: string;
+        resourceId: string;
+        schemaVersion: string;
+        teamId?: string | undefined;
+        topicId?: string | undefined;
+        sendId?: string | undefined;
+        invocationId?: string | undefined;
+        assignmentId?: string | undefined;
+        sequence?: number | undefined;
+        eventType?: string | undefined;
+    };
+    aadDigest: string;
+    ciphertextDigest: string;
+    createdAt: string;
+}, {
+    schemaVersion: "treeseed.encrypted-envelope/v1";
+    algorithm: "aes-256-gcm";
+    keyProvider: string;
+    keyId: string;
+    keyVersion: number;
+    wrappedDek: {
+        nonce: string;
+        authenticationTag: string;
+        ciphertext: string;
+    };
+    payload: {
+        nonce: string;
+        authenticationTag: string;
+        ciphertext: string;
+    };
+    aad: {
+        purpose: string;
+        resourceType: string;
+        resourceId: string;
+        schemaVersion: string;
+        teamId?: string | undefined;
+        topicId?: string | undefined;
+        sendId?: string | undefined;
+        invocationId?: string | undefined;
+        assignmentId?: string | undefined;
+        sequence?: number | undefined;
+        eventType?: string | undefined;
+    };
+    aadDigest: string;
+    ciphertextDigest: string;
+    createdAt: string;
+}>;
+export type EncryptedEnvelopeAad = z.infer<typeof encryptedEnvelopeAadSchema>;
+export type EncryptedEnvelope = z.infer<typeof encryptedEnvelopeSchema>;

package/dist/security/encrypted-envelope.js

@@ -0,0 +1,34 @@
+import { z } from "zod";
+const base64Url = z.string().min(1).regex(/^[A-Za-z0-9_-]+$/u);
+const digest = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+const identifier = z.string().regex(/^[a-z][a-z0-9._-]{0,127}$/u);
+const encryptedEnvelopeAadSchema = z.object({
+  purpose: identifier,
+  teamId: z.string().min(1).max(256).optional(),
+  resourceType: identifier,
+  resourceId: z.string().min(1).max(512),
+  topicId: z.string().min(1).max(256).optional(),
+  sendId: z.string().min(1).max(256).optional(),
+  invocationId: z.string().min(1).max(256).optional(),
+  assignmentId: z.string().min(1).max(256).optional(),
+  sequence: z.number().int().nonnegative().optional(),
+  eventType: z.string().min(1).max(256).optional(),
+  schemaVersion: z.string().min(1).max(128)
+}).strict();
+const encryptedEnvelopeSchema = z.object({
+  schemaVersion: z.literal("treeseed.encrypted-envelope/v1"),
+  algorithm: z.literal("aes-256-gcm"),
+  keyProvider: identifier,
+  keyId: identifier,
+  keyVersion: z.number().int().positive(),
+  wrappedDek: z.object({ nonce: base64Url, authenticationTag: base64Url, ciphertext: base64Url }).strict(),
+  payload: z.object({ nonce: base64Url, authenticationTag: base64Url, ciphertext: base64Url }).strict(),
+  aad: encryptedEnvelopeAadSchema,
+  aadDigest: digest,
+  ciphertextDigest: digest,
+  createdAt: z.string().datetime()
+}).strict();
+export {
+  encryptedEnvelopeAadSchema,
+  encryptedEnvelopeSchema
+};

package/dist/security/envelope-codec.d.ts

@@ -0,0 +1,38 @@
+import { type EncryptedEnvelope, type EncryptedEnvelopeAad } from './encrypted-envelope.js';
+export interface EnvelopeKeyProvider {
+    readonly id: string;
+    active(): {
+        id: string;
+        version: number;
+        key: Uint8Array;
+    };
+    resolve(id: string, version: number): Uint8Array | undefined;
+}
+export declare class EncryptedEnvelopeCodec {
+    private readonly keys;
+    constructor(keys: EnvelopeKeyProvider);
+    encrypt(plaintext: Uint8Array | string, aad: EncryptedEnvelopeAad): EncryptedEnvelope;
+    decrypt(input: EncryptedEnvelope): Buffer;
+    authenticate(input: EncryptedEnvelope): boolean;
+    rewrap(input: EncryptedEnvelope): EncryptedEnvelope;
+}
+export declare class StaticEnvelopeKeyProvider implements EnvelopeKeyProvider {
+    private readonly activeKey;
+    private readonly historical;
+    readonly id: string;
+    constructor(id: string, activeKey: {
+        id: string;
+        version: number;
+        key: Uint8Array;
+    }, historical?: Array<{
+        id: string;
+        version: number;
+        key: Uint8Array;
+    }>);
+    active(): {
+        id: string;
+        version: number;
+        key: Uint8Array;
+    };
+    resolve(id: string, version: number): Uint8Array<ArrayBufferLike> | undefined;
+}

package/dist/security/envelope-codec.js

@@ -0,0 +1,96 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { encryptedEnvelopeSchema } from "./encrypted-envelope.js";
+function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (value && typeof value === "object") return `{${Object.entries(value).filter(([, item]) => item !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(",")}}`;
+  return JSON.stringify(value);
+}
+const digest = (value) => `sha256:${createHash("sha256").update(value).digest("hex")}`;
+const encode = (value) => Buffer.from(value).toString("base64url");
+const decode = (value) => {
+  const decoded = Buffer.from(value, "base64url");
+  if (decoded.toString("base64url") !== value) throw new Error("Encrypted envelope contains a non-canonical base64url value.");
+  return decoded;
+};
+function seal(key, plaintext, aad) {
+  if (key.byteLength !== 32) throw new Error("Envelope keys must contain exactly 32 bytes.");
+  const nonce = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, nonce);
+  cipher.setAAD(Buffer.from(aad));
+  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  return { nonce: encode(nonce), authenticationTag: encode(cipher.getAuthTag()), ciphertext: encode(ciphertext) };
+}
+function open(key, value, aad) {
+  const decipher = createDecipheriv("aes-256-gcm", key, decode(value.nonce));
+  decipher.setAAD(Buffer.from(aad));
+  decipher.setAuthTag(decode(value.authenticationTag));
+  return Buffer.concat([decipher.update(decode(value.ciphertext)), decipher.final()]);
+}
+class EncryptedEnvelopeCodec {
+  constructor(keys) {
+    this.keys = keys;
+  }
+  keys;
+  encrypt(plaintext, aad) {
+    const active = this.keys.active();
+    const aadValue = canonical(aad);
+    const dek = randomBytes(32);
+    const payload = seal(dek, typeof plaintext === "string" ? Buffer.from(plaintext) : plaintext, aadValue);
+    const wrappedDek = seal(active.key, dek, `${aadValue}:dek`);
+    return encryptedEnvelopeSchema.parse({
+      schemaVersion: "treeseed.encrypted-envelope/v1",
+      algorithm: "aes-256-gcm",
+      keyProvider: this.keys.id,
+      keyId: active.id,
+      keyVersion: active.version,
+      wrappedDek,
+      payload,
+      aad,
+      aadDigest: digest(aadValue),
+      ciphertextDigest: digest(decode(payload.ciphertext)),
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+  decrypt(input) {
+    const envelope = encryptedEnvelopeSchema.parse(input);
+    const aad = canonical(envelope.aad);
+    if (digest(aad) !== envelope.aadDigest || digest(decode(envelope.payload.ciphertext)) !== envelope.ciphertextDigest) throw new Error("Encrypted envelope digest verification failed.");
+    const key = this.keys.resolve(envelope.keyId, envelope.keyVersion);
+    if (!key) throw new Error(`Encrypted envelope key ${envelope.keyId}:${envelope.keyVersion} is unavailable.`);
+    const dek = open(key, envelope.wrappedDek, `${aad}:dek`);
+    return open(dek, envelope.payload, aad);
+  }
+  authenticate(input) {
+    this.decrypt(input);
+    return true;
+  }
+  rewrap(input) {
+    const envelope = encryptedEnvelopeSchema.parse(input);
+    const prior = this.keys.resolve(envelope.keyId, envelope.keyVersion);
+    if (!prior) throw new Error(`Encrypted envelope key ${envelope.keyId}:${envelope.keyVersion} is unavailable.`);
+    const aad = canonical(envelope.aad);
+    const dek = open(prior, envelope.wrappedDek, `${aad}:dek`);
+    const active = this.keys.active();
+    return encryptedEnvelopeSchema.parse({ ...envelope, keyProvider: this.keys.id, keyId: active.id, keyVersion: active.version, wrappedDek: seal(active.key, dek, `${aad}:dek`) });
+  }
+}
+class StaticEnvelopeKeyProvider {
+  constructor(id, activeKey, historical = []) {
+    this.activeKey = activeKey;
+    this.historical = historical;
+    this.id = id;
+  }
+  activeKey;
+  historical;
+  id;
+  active() {
+    return this.activeKey;
+  }
+  resolve(id, version) {
+    return [this.activeKey, ...this.historical].find((entry) => entry.id === id && entry.version === version)?.key;
+  }
+}
+export {
+  EncryptedEnvelopeCodec,
+  StaticEnvelopeKeyProvider
+};

package/dist/security/index.d.ts

@@ -0,0 +1,2 @@
+export * from './encrypted-envelope.js';
+export * from './envelope-codec.js';

package/dist/security/index.js

@@ -0,0 +1,2 @@
+export * from "./encrypted-envelope.js";
+export * from "./envelope-codec.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.53",
+  "version": "0.13.0-rc.55",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {
@@ -62,6 +62,10 @@
     "vitest": "^4.1.2"
   },
   "exports": {
+    "./security": {
+      "types": "./dist/security/index.d.ts",
+      "default": "./dist/security/index.js"
+    },
     "./development": {
       "types": "./dist/development/index.d.ts",
       "default": "./dist/development/index.js"