@treeseed/sdk 0.13.0-rc.54 → 0.13.0-rc.55

package/dist/deployment/schemas.js

@@ -111,7 +111,18 @@ const hostConfigurationSchema = z.object({
   secrets: z.record(identifier, z.object({
     provider: z.enum(["file", "systemd-credential", "vault", "aws-secrets-manager"]),
     reference: z.string().min(1)
-  }).strict())
+  }).strict()),
+  security: z.object({
+    sandbox: z.object({
+      required: z.boolean(),
+      runtime: z.literal("kata-runtime-rs-qemu"),
+      brokerSocket: z.string().startsWith("/run/treeseed/"),
+      modelGateway: z.object({ provider: z.literal("openai"), upstreamBaseUrl: z.literal("https://api.openai.com"), allowedModels: z.array(z.string().min(1)).min(1) }).strict(),
+      profiles: z.array(z.object({ id: z.enum(["read", "unit", "integration", "platform", "connected"]), guestImage: z.string().min(1), guestImageDigest: digest }).strict()).min(1)
+    }).strict(),
+    providerVolume: z.object({ encryption: z.literal("luks2"), backingPath: z.string().startsWith("/"), mountPath: z.string().startsWith("/"), sizeBytes: z.number().int().min(1073741824), unlock: z.enum(["tpm2", "systemd-credential"]), recoveryRequired: z.literal(true) }).strict(),
+    applicationEncryption: z.object({ provider: z.literal("systemd-credential"), activeKeyVersion: z.number().int().positive(), diagnosticsKeyVersion: z.number().int().positive() }).strict()
+  }).strict().optional()
 }).strict();
 const packageEndpointSchema = z.object({
   id: identifier,
@@ -313,6 +324,16 @@ const hostRecoverySchema = z.object({
   backupId: identifier.nullable(),
   completedAt: z.string().datetime().nullable()
 }).strict();
+const hostSecurityReceiptSchema = z.object({
+  schemaVersion: z.literal("treeseed.host-security-receipt/v1"),
+  receiptId: identifier,
+  hostId: identifier,
+  sandbox: z.object({ runtime: z.literal("kata-runtime-rs-qemu"), kvmReady: z.boolean(), brokerReady: z.boolean(), guestImageDigests: z.array(digest) }).strict(),
+  providerVolume: z.object({ encrypted: z.boolean(), format: z.literal("luks2"), mountPath: z.string().startsWith("/"), unlock: z.enum(["tpm2", "systemd-credential"]) }).strict(),
+  keys: z.object({ provider: z.literal("systemd-credential"), activeCredentialVersion: z.number().int().positive(), activeDiagnosticsVersion: z.number().int().positive(), recoveryBundleVerified: z.boolean() }).strict(),
+  state: z.enum(["planned", "migrating", "known-good", "blocked"]),
+  completedAt: z.string().datetime()
+}).strict();
 export {
   componentReleaseSchema,
   deploymentTrackSchema,
@@ -326,6 +347,7 @@ export {
   hostReceiptSchema,
   hostRecoverySchema,
   hostRoleSchema,
+  hostSecurityReceiptSchema,
   hostUpdateSchema,
   integrationReleaseSchema,
   packageEndpointSchema,

package/dist/development/schemas.d.ts

@@ -2829,8 +2829,9 @@ export declare const developmentSessionSchema: z.ZodObject<{
         targetId?: string | undefined;
     }>, "many">;
 }, "strict", z.ZodTypeAny, {
-    status: "planning" | "active" | "degraded" | "restoring" | "stopped" | "expired";
     schemaVersion: "treeseed.development-session/v1";
+    status: "planning" | "active" | "degraded" | "restoring" | "stopped" | "expired";
+    createdAt: string;
     targets: {
         projectId: string;
         targetId: string;
@@ -2842,7 +2843,6 @@ export declare const developmentSessionSchema: z.ZodObject<{
     sessionId: string;
     actor: string;
     hostId: string;
-    createdAt: string;
     expiresAt: string;
     repositories: {
         dirty: boolean;
@@ -2867,8 +2867,9 @@ export declare const developmentSessionSchema: z.ZodObject<{
         targetId?: string | undefined;
     }[];
 }, {
-    status: "planning" | "active" | "degraded" | "restoring" | "stopped" | "expired";
     schemaVersion: "treeseed.development-session/v1";
+    status: "planning" | "active" | "degraded" | "restoring" | "stopped" | "expired";
+    createdAt: string;
     targets: {
         projectId: string;
         targetId: string;
@@ -2880,7 +2881,6 @@ export declare const developmentSessionSchema: z.ZodObject<{
     sessionId: string;
     actor: string;
     hostId: string;
-    createdAt: string;
     expiresAt: string;
     repositories: {
         dirty: boolean;
@@ -2993,6 +2993,8 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
     }>;
     promotable: z.ZodBoolean;
 }, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.development-candidate/v1";
+    createdAt: string;
     artifacts: {
         kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle";
         projectId: string;
@@ -3001,9 +3003,7 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
         integrity?: string | undefined;
     }[];
-    schemaVersion: "treeseed.development-candidate/v1";
     sessionId: string;
-    createdAt: string;
     candidateId: string;
     source: {
         dirty: boolean;
@@ -3030,6 +3030,8 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
     };
     promotable: boolean;
 }, {
+    schemaVersion: "treeseed.development-candidate/v1";
+    createdAt: string;
     artifacts: {
         kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle";
         projectId: string;
@@ -3038,9 +3040,7 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
         integrity?: string | undefined;
     }[];
-    schemaVersion: "treeseed.development-candidate/v1";
     sessionId: string;
-    createdAt: string;
     candidateId: string;
     source: {
         dirty: boolean;
@@ -3067,6 +3067,8 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
     };
     promotable: boolean;
 }>, {
+    schemaVersion: "treeseed.development-candidate/v1";
+    createdAt: string;
     artifacts: {
         kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle";
         projectId: string;
@@ -3075,9 +3077,7 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
         integrity?: string | undefined;
     }[];
-    schemaVersion: "treeseed.development-candidate/v1";
     sessionId: string;
-    createdAt: string;
     candidateId: string;
     source: {
         dirty: boolean;
@@ -3104,6 +3104,8 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
     };
     promotable: boolean;
 }, {
+    schemaVersion: "treeseed.development-candidate/v1";
+    createdAt: string;
     artifacts: {
         kind: "npm-package" | "oci-image" | "archive" | "executable" | "contract-bundle";
         projectId: string;
@@ -3112,9 +3114,7 @@ export declare const developmentCandidateSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
         integrity?: string | undefined;
     }[];
-    schemaVersion: "treeseed.development-candidate/v1";
     sessionId: string;
-    createdAt: string;
     candidateId: string;
     source: {
         dirty: boolean;
@@ -3152,15 +3152,15 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
         workflowRunId: z.ZodString;
         createdAt: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        id: string;
         createdAt: string;
+        id: string;
         receiptDigest: string;
         sourceCommit: string;
         stagingRef: string;
         workflowRunId: string;
     }, {
-        id: string;
         createdAt: string;
+        id: string;
         receiptDigest: string;
         sourceCommit: string;
         stagingRef: string;
@@ -3244,9 +3244,10 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
         completedAt: string;
     }>;
 }, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.release-evidence/v1";
     candidate: {
-        id: string;
         createdAt: string;
+        id: string;
         receiptDigest: string;
         sourceCommit: string;
         stagingRef: string;
@@ -3260,7 +3261,6 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
         size?: number | undefined;
     }[];
-    schemaVersion: "treeseed.release-evidence/v1";
     compatibilityAttestations: {
         digest: string;
         contractId: string;
@@ -3283,9 +3283,10 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
     }[];
 }, {
+    schemaVersion: "treeseed.release-evidence/v1";
     candidate: {
-        id: string;
         createdAt: string;
+        id: string;
         receiptDigest: string;
         sourceCommit: string;
         stagingRef: string;
@@ -3299,7 +3300,6 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
         size?: number | undefined;
     }[];
-    schemaVersion: "treeseed.release-evidence/v1";
     verification: {
         status: "passed";
         operations: string[];
@@ -3322,9 +3322,10 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
     }[] | undefined;
 }>, {
+    schemaVersion: "treeseed.release-evidence/v1";
     candidate: {
-        id: string;
         createdAt: string;
+        id: string;
         receiptDigest: string;
         sourceCommit: string;
         stagingRef: string;
@@ -3338,7 +3339,6 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
         size?: number | undefined;
     }[];
-    schemaVersion: "treeseed.release-evidence/v1";
     compatibilityAttestations: {
         digest: string;
         contractId: string;
@@ -3361,9 +3361,10 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
     }[];
 }, {
+    schemaVersion: "treeseed.release-evidence/v1";
     candidate: {
-        id: string;
         createdAt: string;
+        id: string;
         receiptDigest: string;
         sourceCommit: string;
         stagingRef: string;
@@ -3377,7 +3378,6 @@ export declare const releaseEvidenceSchema: z.ZodEffects<z.ZodObject<{
         digest: string;
         size?: number | undefined;
     }[];
-    schemaVersion: "treeseed.release-evidence/v1";
     verification: {
         status: "passed";
         operations: string[];

package/dist/operator-contracts/canonical-command-tree.js

@@ -55,6 +55,14 @@ const operationBindings = {
   "host storage connect": local("local.host.storage.connect"),
   "host storage reconcile": local("local.host.storage.reconcile"),
   "host storage rotate": local("local.host.storage.rotate"),
+  "host security plan": local("local.host.security.plan"),
+  "host security initialize": local("local.host.security.initialize"),
+  "host security status": local("local.host.security.status"),
+  "host security verify": local("local.host.security.verify"),
+  "host security rotate": local("local.host.security.rotate"),
+  "host security recovery verify": local("local.host.security.recovery.verify"),
+  "host sandbox status": local("local.host.sandbox.status"),
+  "host sandbox doctor": local("local.host.sandbox.doctor"),
   "host fleet status": local("local.host.fleet.status"),
   "host recovery status": local("local.host.recovery.status"),
   "host recovery retry": local("local.host.recovery.retry"),
@@ -186,6 +194,35 @@ function hostReset() {
   value.options = [...value.options ?? [], { name: "--confirm", description: "Confirm deletion of all manager-owned component data and receipts.", type: "boolean" }];
   return value;
 }
+function hostSecurityInitialize() {
+  const value = leaf("initialize", "mutation", void 0, "credential");
+  if (value.nodeType !== "leaf") throw new Error("Host security initialization must be a leaf command.");
+  value.description = "Initialize the encrypted provider volume, application keys, and offline recovery bundle.";
+  value.options = [...value.options ?? [], { name: "--recovery-bundle", description: "Absolute path for the new encrypted offline recovery bundle.", type: "string", required: true }, { name: "--confirm", description: "Confirm provider-state migration and volume formatting.", type: "boolean", required: true }];
+  return value;
+}
+function hostSecurityRotate() {
+  const value = leaf("rotate", "mutation", "target", "credential");
+  if (value.nodeType !== "leaf") throw new Error("Host security rotation must be a leaf command.");
+  value.options = [
+    ...value.options ?? [],
+    { name: "--recovery-bundle", description: "Absolute path to the currently authenticated recovery bundle.", type: "string", required: true },
+    { name: "--new-recovery-bundle", description: "Absolute non-existing path for the replacement recovery bundle.", type: "string", required: true },
+    { name: "--confirm", description: "Confirm creation and activation of a new key generation.", type: "boolean", required: true }
+  ];
+  return value;
+}
+function hostRecoveryVerify() {
+  return {
+    nodeType: "leaf",
+    segment: "verify",
+    description: "Authenticate and inventory an offline recovery bundle without revealing secrets.",
+    kind: "read",
+    options: [{ name: "--bundle", description: "Absolute recovery bundle path.", type: "string", required: true }],
+    resultSchemaId: "treeseed.host-recovery-verification/v1",
+    execution: unavailable()
+  };
+}
 function aiModeSet() {
   const value = leaf("set", "mutation", "mode", "authority");
   if (value.nodeType !== "leaf") throw new Error("AI mode set must be a leaf command.");
@@ -296,6 +333,8 @@ const commandTree = {
         leaf("reconcile", "mutation", void 0, "authority"),
         leaf("rotate", "mutation", "backend", "credential")
       ]),
+      branch("security", [leaf("plan"), hostSecurityInitialize(), leaf("status"), leaf("verify"), hostSecurityRotate(), branch("recovery", [hostRecoveryVerify()])]),
+      branch("sandbox", [leaf("status"), leaf("doctor")]),
       branch("fleet", [leaf("status")]),
       branch("update", [leaf("status"), leaf("check", "mutation"), leaf("apply", "mutation", void 0, "authority"), leaf("channel", "mutation", "track", "authority"), leaf("pause", "mutation", void 0, "authority"), leaf("resume", "mutation", void 0, "authority")]),
       branch("component", [leaf("list"), leaf("status", "read", "component"), leaf("enable", "mutation", "component", "authority"), leaf("disable", "mutation", "component", "destructive")]),

package/dist/operator-contracts/catalog/communication-operations.d.ts

@@ -7,18 +7,22 @@ export declare function communicationOperations(): {
         timeoutSeconds?: number | undefined;
         recipients?: string[] | undefined;
     }, {
-        status: "failed" | "running" | "partial" | "complete" | "queued";
+        teamId: string;
+        sendId: string;
         schemaVersion: "treeseed.communication-send-receipt/v4";
+        status: "failed" | "running" | "partial" | "complete" | "queued";
+        createdAt: string;
         targets: {
+            invocationId: string | null;
             status: "failed" | "running" | "cancelled" | "queued" | "responded" | "abstained";
             projectId: string;
             completedAt: string | null;
             agentSlug: string;
             capacity: {
+                assignmentId: string | null;
                 status: string | null;
                 completedAt: string | null;
                 providerId: string | null;
-                assignmentId: string | null;
                 executionProviderId: string | null;
                 laneId: string | null;
                 lanePurpose: string | null;
@@ -48,7 +52,6 @@ export declare function communicationOperations(): {
                 traceEvents: Record<string, unknown>[];
                 fullPayload?: Record<string, unknown> | undefined;
             };
-            invocationId: string | null;
             projectSlug: string;
             definitionRevision: string;
             revisions: {
@@ -69,27 +72,32 @@ export declare function communicationOperations(): {
             acknowledgedAt: string | null;
             leaseAcceptedAt: string | null;
         }[];
-        createdAt: string;
         responses: {
+            invocationId: string;
+            assignmentId: string | null;
             status: "failed" | "cancelled" | "responded" | "abstained";
-            projectId: string;
             createdAt: string;
+            projectId: string;
             agentSlug: string;
-            assignmentId: string | null;
-            invocationId: string;
             projectSlug: string;
             requirement: "required" | "optional";
             messageRef: string;
             markdown: string;
         }[];
-        teamId: string;
         channel: string;
         topic: {
             id: string;
             slug: string;
         };
         events: {
+            teamId: string;
+            topicId: string;
+            sendId: string | null;
+            invocationId: string | null;
+            assignmentId: string | null;
+            sequence: number;
             type: "message.posted" | "mention.acknowledged" | "response_lease.accepted" | "agent.progress" | "agent.response" | "agent.abstained" | "agent.failed";
+            payload: Record<string, unknown>;
             id: string;
             actor: {
                 kind: "control-plane" | "provider" | "agent" | "user";
@@ -97,17 +105,9 @@ export declare function communicationOperations(): {
                 handle: string | null;
             };
             summary: string;
-            teamId: string;
             channel: string;
-            assignmentId: string | null;
-            sequence: number;
-            topicId: string;
             occurredAt: string;
-            sendId: string | null;
-            invocationId: string | null;
-            payload: Record<string, unknown>;
         }[];
-        sendId: string;
         updatedAt: string;
         projectStreams: {
             id: string;
@@ -124,18 +124,22 @@ export declare function communicationOperations(): {
     }, {
         diagnostics?: "metadata" | "full" | undefined;
     }, undefined, {
-        status: "failed" | "running" | "partial" | "complete" | "queued";
+        teamId: string;
+        sendId: string;
         schemaVersion: "treeseed.communication-send-receipt/v4";
+        status: "failed" | "running" | "partial" | "complete" | "queued";
+        createdAt: string;
         targets: {
+            invocationId: string | null;
             status: "failed" | "running" | "cancelled" | "queued" | "responded" | "abstained";
             projectId: string;
             completedAt: string | null;
             agentSlug: string;
             capacity: {
+                assignmentId: string | null;
                 status: string | null;
                 completedAt: string | null;
                 providerId: string | null;
-                assignmentId: string | null;
                 executionProviderId: string | null;
                 laneId: string | null;
                 lanePurpose: string | null;
@@ -165,7 +169,6 @@ export declare function communicationOperations(): {
                 traceEvents: Record<string, unknown>[];
                 fullPayload?: Record<string, unknown> | undefined;
             };
-            invocationId: string | null;
             projectSlug: string;
             definitionRevision: string;
             revisions: {
@@ -186,27 +189,32 @@ export declare function communicationOperations(): {
             acknowledgedAt: string | null;
             leaseAcceptedAt: string | null;
         }[];
-        createdAt: string;
         responses: {
+            invocationId: string;
+            assignmentId: string | null;
             status: "failed" | "cancelled" | "responded" | "abstained";
-            projectId: string;
             createdAt: string;
+            projectId: string;
             agentSlug: string;
-            assignmentId: string | null;
-            invocationId: string;
             projectSlug: string;
             requirement: "required" | "optional";
             messageRef: string;
             markdown: string;
         }[];
-        teamId: string;
         channel: string;
         topic: {
             id: string;
             slug: string;
         };
         events: {
+            teamId: string;
+            topicId: string;
+            sendId: string | null;
+            invocationId: string | null;
+            assignmentId: string | null;
+            sequence: number;
             type: "message.posted" | "mention.acknowledged" | "response_lease.accepted" | "agent.progress" | "agent.response" | "agent.abstained" | "agent.failed";
+            payload: Record<string, unknown>;
             id: string;
             actor: {
                 kind: "control-plane" | "provider" | "agent" | "user";
@@ -214,17 +222,9 @@ export declare function communicationOperations(): {
                 handle: string | null;
             };
             summary: string;
-            teamId: string;
             channel: string;
-            assignmentId: string | null;
-            sequence: number;
-            topicId: string;
             occurredAt: string;
-            sendId: string | null;
-            invocationId: string | null;
-            payload: Record<string, unknown>;
         }[];
-        sendId: string;
         updatedAt: string;
         projectStreams: {
             id: string;
@@ -243,10 +243,10 @@ export declare function communicationOperations(): {
         limit?: number | undefined;
     }, undefined, {
         items: {
+            teamId: string;
             status: "active" | "archived";
-            id: string;
             createdAt: string;
-            teamId: string;
+            id: string;
             updatedAt: string;
             slug: string;
             streams: {
@@ -272,10 +272,10 @@ export declare function communicationOperations(): {
         teamId: string;
         channel: string;
     }, {}, undefined, {
+        teamId: string;
         status: "active" | "archived";
-        id: string;
         createdAt: string;
-        teamId: string;
+        id: string;
         updatedAt: string;
         slug: string;
         streams: {
@@ -306,10 +306,10 @@ export declare function communicationOperations(): {
     }, undefined, {
         cursor: string | null;
         topic: {
+            teamId: string;
             status: "active" | "archived";
-            id: string;
             createdAt: string;
-            teamId: string;
+            id: string;
             updatedAt: string;
             slug: string;
             streams: {
@@ -330,7 +330,14 @@ export declare function communicationOperations(): {
             }[];
         };
         events: {
+            teamId: string;
+            topicId: string;
+            sendId: string | null;
+            invocationId: string | null;
+            assignmentId: string | null;
+            sequence: number;
             type: "message.posted" | "mention.acknowledged" | "response_lease.accepted" | "agent.progress" | "agent.response" | "agent.abstained" | "agent.failed";
+            payload: Record<string, unknown>;
             id: string;
             actor: {
                 kind: "control-plane" | "provider" | "agent" | "user";
@@ -338,15 +345,8 @@ export declare function communicationOperations(): {
                 handle: string | null;
             };
             summary: string;
-            teamId: string;
             channel: string;
-            assignmentId: string | null;
-            sequence: number;
-            topicId: string;
             occurredAt: string;
-            sendId: string | null;
-            invocationId: string | null;
-            payload: Record<string, unknown>;
         }[];
     }>;
     topicsSubscribe: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
@@ -398,10 +398,10 @@ export declare function providerDiscussionResponseOperation(): import("../contro
     markdown?: string | undefined;
     outcome?: "responded" | "abstained" | undefined;
 }, {
-    status: "responded" | "abstained";
-    schemaVersion: "treeseed.provider-discussion-response-receipt/v1";
-    assignmentId: string;
     invocationId: string;
+    assignmentId: string;
+    schemaVersion: "treeseed.provider-discussion-response-receipt/v1";
+    status: "responded" | "abstained";
     messageRef: string;
     settledAt: string;
 }>;
@@ -420,11 +420,11 @@ export declare function providerCommunicationLifecycleOperations(): {
     traceEvent: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
         assignmentId: string;
     }, {}, {
+        sequence: number;
         type: string;
+        payload: Record<string, unknown>;
         summary: string;
-        sequence: number;
         occurredAt: string;
-        payload: Record<string, unknown>;
         runnerId: string;
         leaseToken: string;
         protectedPayload?: Record<string, unknown> | undefined;