@treeseed/sdk 0.13.0-rc.53 → 0.13.0-rc.55

package/dist/deployment/schemas.js

@@ -111,7 +111,18 @@ const hostConfigurationSchema = z.object({
   secrets: z.record(identifier, z.object({
     provider: z.enum(["file", "systemd-credential", "vault", "aws-secrets-manager"]),
     reference: z.string().min(1)
-  }).strict())
+  }).strict()),
+  security: z.object({
+    sandbox: z.object({
+      required: z.boolean(),
+      runtime: z.literal("kata-runtime-rs-qemu"),
+      brokerSocket: z.string().startsWith("/run/treeseed/"),
+      modelGateway: z.object({ provider: z.literal("openai"), upstreamBaseUrl: z.literal("https://api.openai.com"), allowedModels: z.array(z.string().min(1)).min(1) }).strict(),
+      profiles: z.array(z.object({ id: z.enum(["read", "unit", "integration", "platform", "connected"]), guestImage: z.string().min(1), guestImageDigest: digest }).strict()).min(1)
+    }).strict(),
+    providerVolume: z.object({ encryption: z.literal("luks2"), backingPath: z.string().startsWith("/"), mountPath: z.string().startsWith("/"), sizeBytes: z.number().int().min(1073741824), unlock: z.enum(["tpm2", "systemd-credential"]), recoveryRequired: z.literal(true) }).strict(),
+    applicationEncryption: z.object({ provider: z.literal("systemd-credential"), activeKeyVersion: z.number().int().positive(), diagnosticsKeyVersion: z.number().int().positive() }).strict()
+  }).strict().optional()
 }).strict();
 const packageEndpointSchema = z.object({
   id: identifier,
@@ -313,6 +324,16 @@ const hostRecoverySchema = z.object({
   backupId: identifier.nullable(),
   completedAt: z.string().datetime().nullable()
 }).strict();
+const hostSecurityReceiptSchema = z.object({
+  schemaVersion: z.literal("treeseed.host-security-receipt/v1"),
+  receiptId: identifier,
+  hostId: identifier,
+  sandbox: z.object({ runtime: z.literal("kata-runtime-rs-qemu"), kvmReady: z.boolean(), brokerReady: z.boolean(), guestImageDigests: z.array(digest) }).strict(),
+  providerVolume: z.object({ encrypted: z.boolean(), format: z.literal("luks2"), mountPath: z.string().startsWith("/"), unlock: z.enum(["tpm2", "systemd-credential"]) }).strict(),
+  keys: z.object({ provider: z.literal("systemd-credential"), activeCredentialVersion: z.number().int().positive(), activeDiagnosticsVersion: z.number().int().positive(), recoveryBundleVerified: z.boolean() }).strict(),
+  state: z.enum(["planned", "migrating", "known-good", "blocked"]),
+  completedAt: z.string().datetime()
+}).strict();
 export {
   componentReleaseSchema,
   deploymentTrackSchema,
@@ -326,6 +347,7 @@ export {
   hostReceiptSchema,
   hostRecoverySchema,
   hostRoleSchema,
+  hostSecurityReceiptSchema,
   hostUpdateSchema,
   integrationReleaseSchema,
   packageEndpointSchema,

package/dist/development/schemas.d.ts

@@ -2829,8 +2829,9 @@ export declare const developmentSessionSchema: z.ZodObject<{
         targetId?: string | undefined;
     }>, "many">;
 }, "strict", z.ZodTypeAny, {
-    status: "planning" | "active" | "degraded" | "restoring" | "stopped" | "expired";
     schemaVersion: "treeseed.development-session/v1";
+    status: "planning" | "active" | "degraded" | "restoring" | "stopped" | "expired";
+    createdAt: string;
     targets: {
         projectId: string;
         targetId: string;
@@ -2842,7 +2843,6 @@ export declare const developmentSessionSchema: z.ZodObject<{
     sessionId: string;
     actor: string;
     hostId: string;
-    createdAt: string;
     expiresAt: string;
     repositories: {
         dirty: boolean;
@@ -2867,8 +2867,9 @@ export declare const developmentSessionSchema: z.ZodObject<{
         targetId?: string | undefined;
     }[];
 }, {
-    status: "planning" | "active" | "degraded" | "restoring" | "stopped" | "expired";
     schemaVersion: "treeseed.development-session/v1";
+    status: "planning" | "active" | "degraded" | "restoring" | "stopped" | "expired";
+    createdAt: string;
     targets: {
         projectId: string;
         targetId: string;
@@ -2880,7 +2881,6 @@ export declare const developmentSessionSchema: z.ZodObject<{
     sessionId: string;
     actor: string;
     hostId: string;
-    createdAt: string;
     expiresAt: string;
     repositories: {
         dirty: boolean;
@@ -2993,6 +2993,8 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
     }>;
     promotable: z.ZodBoolean;
 }, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.development-candidate/v1";
+    createdAt: string;
     artifacts: {
         kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle";
         projectId: string;
@@ -3001,9 +3003,7 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
         integrity?: string | undefined;
     }[];
-    schemaVersion: "treeseed.development-candidate/v1";
     sessionId: string;
-    createdAt: string;
     candidateId: string;
     source: {
         dirty: boolean;
@@ -3030,6 +3030,8 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
     };
     promotable: boolean;
 }, {
+    schemaVersion: "treeseed.development-candidate/v1";
+    createdAt: string;
     artifacts: {
         kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle";
         projectId: string;
@@ -3038,9 +3040,7 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
         integrity?: string | undefined;
     }[];
-    schemaVersion: "treeseed.development-candidate/v1";
     sessionId: string;
-    createdAt: string;
     candidateId: string;
     source: {
         dirty: boolean;
@@ -3067,6 +3067,8 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
     };
     promotable: boolean;
 }>, {
+    schemaVersion: "treeseed.development-candidate/v1";
+    createdAt: string;
     artifacts: {
         kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle";
         projectId: string;
@@ -3075,9 +3077,7 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
         integrity?: string | undefined;
     }[];
-    schemaVersion: "treeseed.development-candidate/v1";
     sessionId: string;
-    createdAt: string;
     candidateId: string;
     source: {
         dirty: boolean;
@@ -3104,6 +3104,8 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
     };
     promotable: boolean;
 }, {
+    schemaVersion: "treeseed.development-candidate/v1";
+    createdAt: string;
     artifacts: {
         kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle";
         projectId: string;
@@ -3112,9 +3114,7 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
         integrity?: string | undefined;
     }[];
-    schemaVersion: "treeseed.development-candidate/v1";
     sessionId: string;
-    createdAt: string;
     candidateId: string;
     source: {
         dirty: boolean;
@@ -3152,15 +3152,15 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
         workflowRunId: z.ZodString;
         createdAt: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        id: string;
         createdAt: string;
+        id: string;
         receiptDigest: string;
         sourceCommit: string;
         stagingRef: string;
         workflowRunId: string;
     }, {
-        id: string;
         createdAt: string;
+        id: string;
         receiptDigest: string;
         sourceCommit: string;
         stagingRef: string;
@@ -3244,9 +3244,10 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
         completedAt: string;
     }>;
 }, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.release-evidence/v1";
     candidate: {
-        id: string;
         createdAt: string;
+        id: string;
         receiptDigest: string;
         sourceCommit: string;
         stagingRef: string;
@@ -3260,7 +3261,6 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
         size?: number | undefined;
     }[];
-    schemaVersion: "treeseed.release-evidence/v1";
     compatibilityAttestations: {
         digest: string;
         contractId: string;
@@ -3283,9 +3283,10 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
     }[];
 }, {
+    schemaVersion: "treeseed.release-evidence/v1";
     candidate: {
-        id: string;
         createdAt: string;
+        id: string;
         receiptDigest: string;
         sourceCommit: string;
         stagingRef: string;
@@ -3299,7 +3300,6 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
         size?: number | undefined;
     }[];
-    schemaVersion: "treeseed.release-evidence/v1";
     verification: {
         status: "passed";
         operations: string[];
@@ -3322,9 +3322,10 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
     }[] | undefined;
 }>, {
+    schemaVersion: "treeseed.release-evidence/v1";
     candidate: {
-        id: string;
         createdAt: string;
+        id: string;
         receiptDigest: string;
         sourceCommit: string;
         stagingRef: string;
@@ -3338,7 +3339,6 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
         size?: number | undefined;
     }[];
-    schemaVersion: "treeseed.release-evidence/v1";
     compatibilityAttestations: {
         digest: string;
         contractId: string;
@@ -3361,9 +3361,10 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
     }[];
 }, {
+    schemaVersion: "treeseed.release-evidence/v1";
     candidate: {
-        id: string;
         createdAt: string;
+        id: string;
         receiptDigest: string;
         sourceCommit: string;
         stagingRef: string;
@@ -3377,7 +3378,6 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
         size?: number | undefined;
     }[];
-    schemaVersion: "treeseed.release-evidence/v1";
     verification: {
         status: "passed";
         operations: string[];

package/dist/operator-contracts/canonical-command-tree.js

@@ -14,7 +14,11 @@ const operationBindings = {
   "auth logout": protocol("protocol.oauth.revoke"),
   "auth status": operation("accounts.current.show"),
   "users create": protocol("protocol.accounts.create"),
-  "send": operation("communications.send", [field("path", "teamId", "context", "team", true), field("path", "channel", "argument", "channel", true), field("body", "message", "argument", "message", true), field("body", "projectId", "context", "project", true), field("body", "recipients", "option", "to"), field("body", "timeoutSeconds", "option", "timeout", false, "integer")]),
+  "send": operation("communications.send", [field("path", "teamId", "context", "team", true), field("path", "channel", "argument", "channel"), field("body", "message", "argument", "message"), field("body", "recipients", "option", "to"), field("body", "timeoutSeconds", "option", "timeout", false, "integer")]),
+  "topics list": operation("communications.topics.list", [field("path", "teamId", "context", "team", true), ...page()]),
+  "topics show": operation("communications.topics.show", [field("path", "teamId", "context", "team", true), field("path", "channel", "argument", "topic", true)]),
+  "topics subscribe": operation("communications.topics.subscriptions.put", [field("path", "teamId", "context", "team", true), field("path", "channel", "argument", "topic", true), field("body", "agent", "argument", "agent", true)]),
+  "topics unsubscribe": operation("communications.topics.subscriptions.delete", [field("path", "teamId", "context", "team", true), field("path", "channel", "argument", "topic", true), field("body", "agent", "argument", "agent", true)]),
   "teams list": operation("teams.list", page()),
   "teams current": local("local.teams.current"),
   "teams use": local("local.teams.use"),
@@ -47,6 +51,18 @@ const operationBindings = {
   "host topology": local("local.host.topology"),
   "host connections": local("local.host.connections"),
   "host provider status": local("local.host.provider.status"),
+  "host storage status": local("local.host.storage.status"),
+  "host storage connect": local("local.host.storage.connect"),
+  "host storage reconcile": local("local.host.storage.reconcile"),
+  "host storage rotate": local("local.host.storage.rotate"),
+  "host security plan": local("local.host.security.plan"),
+  "host security initialize": local("local.host.security.initialize"),
+  "host security status": local("local.host.security.status"),
+  "host security verify": local("local.host.security.verify"),
+  "host security rotate": local("local.host.security.rotate"),
+  "host security recovery verify": local("local.host.security.recovery.verify"),
+  "host sandbox status": local("local.host.sandbox.status"),
+  "host sandbox doctor": local("local.host.sandbox.doctor"),
   "host fleet status": local("local.host.fleet.status"),
   "host recovery status": local("local.host.recovery.status"),
   "host recovery retry": local("local.host.recovery.retry"),
@@ -166,7 +182,7 @@ function branch(segment, children) {
   return { nodeType: "branch", segment, description: `${segment[0].toUpperCase()}${segment.slice(1)} operations.`, children };
 }
 function configurationAdopt() {
-  const value = leaf("adopt", "mutation", "file", "authority");
+  const value = leaf("adopt", "mutation", "file", "destructive");
   if (value.nodeType !== "leaf") throw new Error("Configuration adoption must be a leaf command.");
   value.options = [...value.options ?? [], { name: "--confirm", description: "Confirm replacement of the installed configuration identity.", type: "boolean" }];
   return value;
@@ -178,6 +194,35 @@ function hostReset() {
   value.options = [...value.options ?? [], { name: "--confirm", description: "Confirm deletion of all manager-owned component data and receipts.", type: "boolean" }];
   return value;
 }
+function hostSecurityInitialize() {
+  const value = leaf("initialize", "mutation", void 0, "credential");
+  if (value.nodeType !== "leaf") throw new Error("Host security initialization must be a leaf command.");
+  value.description = "Initialize the encrypted provider volume, application keys, and offline recovery bundle.";
+  value.options = [...value.options ?? [], { name: "--recovery-bundle", description: "Absolute path for the new encrypted offline recovery bundle.", type: "string", required: true }, { name: "--confirm", description: "Confirm provider-state migration and volume formatting.", type: "boolean", required: true }];
+  return value;
+}
+function hostSecurityRotate() {
+  const value = leaf("rotate", "mutation", "target", "credential");
+  if (value.nodeType !== "leaf") throw new Error("Host security rotation must be a leaf command.");
+  value.options = [
+    ...value.options ?? [],
+    { name: "--recovery-bundle", description: "Absolute path to the currently authenticated recovery bundle.", type: "string", required: true },
+    { name: "--new-recovery-bundle", description: "Absolute non-existing path for the replacement recovery bundle.", type: "string", required: true },
+    { name: "--confirm", description: "Confirm creation and activation of a new key generation.", type: "boolean", required: true }
+  ];
+  return value;
+}
+function hostRecoveryVerify() {
+  return {
+    nodeType: "leaf",
+    segment: "verify",
+    description: "Authenticate and inventory an offline recovery bundle without revealing secrets.",
+    kind: "read",
+    options: [{ name: "--bundle", description: "Absolute recovery bundle path.", type: "string", required: true }],
+    resultSchemaId: "treeseed.host-recovery-verification/v1",
+    execution: unavailable()
+  };
+}
 function aiModeSet() {
   const value = leaf("set", "mutation", "mode", "authority");
   if (value.nodeType !== "leaf") throw new Error("AI mode set must be a leaf command.");
@@ -246,7 +291,14 @@ const commandTree = {
   schemaVersion: "treeseed.command-tree/v1",
   executable: "trsd",
   commands: [
-    { nodeType: "leaf", segment: "send", description: "Send a message to addressed project agents in a team discussion topic.", kind: "mutation", arguments: [{ name: "channel", description: "Team discussion-topic channel.", required: true }, { name: "message", description: "Markdown message containing agent addresses.", required: true }], options: [planOption, { name: "--team", description: "One-command team override.", type: "string" }, { name: "--project", description: "Project for agent resolution and the topic stream.", type: "string", required: true }, { name: "--to", description: "Deprecated validation-only address list.", type: "string[]" }, { name: "--timeout", description: "Maximum seconds to wait for the complete response chain.", type: "number", defaultValue: 1800 }, { name: "--no-wait", description: "Return immediately after durable admission.", type: "boolean" }, { name: "--wait", description: "Deprecated wait duration in seconds.", type: "number" }], authorization: { capability: "agents.execute", confirmation: "never" }, resultSchemaId: "treeseed.communication-send-receipt/v2", execution: unavailable() },
+    { nodeType: "leaf", segment: "inbox", description: "Open the active team governance inbox.", kind: "read", options: [{ name: "--project", description: "Initial project filter.", type: "string" }, { name: "--type", description: "Initial proposal, question, or all filter.", type: "string" }, { name: "--all", description: "Include completed and decided items.", type: "boolean" }], resultSchemaId: "treeseed.inbox-session/v1", execution: local("local.inbox") },
+    { nodeType: "leaf", segment: "send", description: "Send a message or open the interactive team topic browser.", kind: "mutation", arguments: [{ name: "channel", description: "Optional team discussion topic to preselect.", required: false }, { name: "message", description: "Markdown message containing agent addresses.", required: false }], options: [planOption, { name: "--team", description: "One-command team override.", type: "string" }, { name: "--to", description: "Deprecated validation-only address list.", type: "string[]" }, { name: "--timeout", description: "Optional maximum seconds to listen for the complete response chain.", type: "number" }, { name: "--no-wait", description: "Return immediately after durable admission.", type: "boolean" }, { name: "--wait", description: "Deprecated wait duration in seconds.", type: "number" }, { name: "--json-stream", description: "Emit ordered communication events as NDJSON.", type: "boolean" }, { name: "--diagnostics", description: "Diagnostic detail: metadata or full.", type: "string" }], authorization: { capability: "agents.execute", confirmation: "never" }, resultSchemaId: "treeseed.communication-send-receipt/v4", execution: unavailable() },
+    branch("topics", [
+      { nodeType: "leaf", segment: "list", description: "List discussion topics and active listeners.", kind: "read", options: [{ name: "--status", description: "Topic status.", type: "string" }, { name: "--limit", description: "Maximum topics.", type: "number" }, { name: "--cursor", description: "Pagination cursor.", type: "string" }], resultSchemaId: "treeseed.communication-topic-page/v1", execution: unavailable() },
+      { nodeType: "leaf", segment: "show", description: "Show a discussion topic and its listeners.", kind: "read", arguments: [{ name: "topic", description: "Discussion topic.", required: true }], resultSchemaId: "treeseed.communication-topic/v1", execution: unavailable() },
+      { nodeType: "leaf", segment: "subscribe", description: "Subscribe an agent to a discussion topic.", kind: "mutation", arguments: [{ name: "topic", description: "Discussion topic.", required: true }, { name: "agent", description: "@project/agent handle.", required: true }], options: [planOption], authorization: { capability: "agents.execute", confirmation: "never" }, resultSchemaId: "treeseed.communication-topic-subscription-receipt/v1", execution: unavailable() },
+      { nodeType: "leaf", segment: "unsubscribe", description: "Remove an agent subscription from a discussion topic.", kind: "mutation", arguments: [{ name: "topic", description: "Discussion topic.", required: true }, { name: "agent", description: "@project/agent handle.", required: true }], options: [planOption], authorization: { capability: "agents.execute", confirmation: "never" }, resultSchemaId: "treeseed.communication-topic-subscription-receipt/v1", execution: unavailable() }
+    ]),
     branch("auth", [authLogin(), leaf("logout", "mutation"), leaf("status")]),
     branch("users", [userCreate()]),
     branch("teams", [leaf("list"), { nodeType: "leaf", segment: "current", description: "Show the active team for this authenticated server session.", kind: "read", resultSchemaId: "treeseed.command.teams.current/v1", execution: unavailable() }, { nodeType: "leaf", segment: "use", description: "Select the active team for this authenticated server session.", kind: "mutation", arguments: [{ name: "team", description: "Team UUID or unambiguous slug.", required: true }], options: [planOption], authorization: { capability: "teams.read", confirmation: "never" }, resultSchemaId: "treeseed.command.teams.use/v1", execution: unavailable() }]),
@@ -275,6 +327,14 @@ const commandTree = {
       leaf("topology"),
       leaf("connections"),
       branch("provider", [leaf("status")]),
+      branch("storage", [
+        leaf("status"),
+        addOptions(leaf("connect", "mutation", "backend", "credential"), [{ name: "--account-id", description: "Optional Cloudflare account ID when the bootstrap authority reaches multiple accounts.", type: "string" }]),
+        leaf("reconcile", "mutation", void 0, "authority"),
+        leaf("rotate", "mutation", "backend", "credential")
+      ]),
+      branch("security", [leaf("plan"), hostSecurityInitialize(), leaf("status"), leaf("verify"), hostSecurityRotate(), branch("recovery", [hostRecoveryVerify()])]),
+      branch("sandbox", [leaf("status"), leaf("doctor")]),
       branch("fleet", [leaf("status")]),
       branch("update", [leaf("status"), leaf("check", "mutation"), leaf("apply", "mutation", void 0, "authority"), leaf("channel", "mutation", "track", "authority"), leaf("pause", "mutation", void 0, "authority"), leaf("resume", "mutation", void 0, "authority")]),
       branch("component", [leaf("list"), leaf("status", "read", "component"), leaf("enable", "mutation", "component", "authority"), leaf("disable", "mutation", "component", "destructive")]),