@treeseed/sdk 0.13.0-rc.72 → 0.13.0-rc.74

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1 +1 @@
1
- {"completedAt":"2026-09-02T02:59:22.984Z"}
1
+ {"completedAt":"2026-09-02T03:24:42.316Z"}
@@ -1,6 +1,22 @@
1
1
  import { z } from 'zod';
2
2
  export declare const hostedProviderSchema: z.ZodEnum<["cloudflare", "railway"]>;
3
3
  export declare const hostedResourceKindSchema: z.ZodEnum<["admin-application", "dns-record", "tls-policy", "api-proxy", "control-plane-api", "postgresql", "operations-runner", "treedx-service"]>;
4
+ declare const hostedConnectionSnapshotSchema: z.ZodEffects<z.ZodObject<{
5
+ connectionRef: z.ZodString;
6
+ nonSecretConfig: z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
7
+ }, "strict", z.ZodTypeAny, {
8
+ connectionRef: string;
9
+ nonSecretConfig: Record<string, string | number | boolean>;
10
+ }, {
11
+ connectionRef: string;
12
+ nonSecretConfig: Record<string, string | number | boolean>;
13
+ }>, {
14
+ connectionRef: string;
15
+ nonSecretConfig: Record<string, string | number | boolean>;
16
+ }, {
17
+ connectionRef: string;
18
+ nonSecretConfig: Record<string, string | number | boolean>;
19
+ }>;
4
20
  export declare const hostedTopologyDeclarationSchema: z.ZodEffects<z.ZodObject<{
5
21
  schemaVersion: z.ZodLiteral<"treeseed.hosted-topology/v1">;
6
22
  id: z.ZodString;
@@ -321,19 +337,148 @@ export declare const hostedResourceObservationSchema: z.ZodObject<{
321
337
  observedDigest: string | null;
322
338
  observedAt: string;
323
339
  }>;
324
- export declare const hostedTopologyPlanSchema: z.ZodObject<{
325
- schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-plan/v1">;
326
- planId: z.ZodString;
327
- planDigest: z.ZodString;
328
- declarationDigest: z.ZodString;
329
- topologyId: z.ZodString;
330
- environment: z.ZodEnum<["staging", "production"]>;
331
- platformCommit: z.ZodString;
332
- actions: z.ZodArray<z.ZodObject<{
340
+ export declare const hostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<{
341
+ readonly schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-plan/v1">;
342
+ readonly planId: z.ZodString;
343
+ readonly planDigest: z.ZodString;
344
+ readonly declarationDigest: z.ZodString;
345
+ readonly topologyId: z.ZodString;
346
+ readonly environment: z.ZodEnum<["staging", "production"]>;
347
+ readonly platformCommit: z.ZodString;
348
+ readonly artifacts: z.ZodRecord<z.ZodString, z.ZodObject<{
349
+ digest: z.ZodString;
350
+ source: z.ZodString;
351
+ }, "strict", z.ZodTypeAny, {
352
+ digest: string;
353
+ source: string;
354
+ }, {
355
+ digest: string;
356
+ source: string;
357
+ }>>;
358
+ readonly providerConnections: z.ZodRecord<z.ZodEnum<["cloudflare", "railway"]>, z.ZodEffects<z.ZodObject<{
359
+ connectionRef: z.ZodString;
360
+ nonSecretConfig: z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
361
+ }, "strict", z.ZodTypeAny, {
362
+ connectionRef: string;
363
+ nonSecretConfig: Record<string, string | number | boolean>;
364
+ }, {
365
+ connectionRef: string;
366
+ nonSecretConfig: Record<string, string | number | boolean>;
367
+ }>, {
368
+ connectionRef: string;
369
+ nonSecretConfig: Record<string, string | number | boolean>;
370
+ }, {
371
+ connectionRef: string;
372
+ nonSecretConfig: Record<string, string | number | boolean>;
373
+ }>>;
374
+ readonly actions: z.ZodArray<z.ZodObject<{
333
375
  resourceId: z.ZodString;
334
376
  provider: z.ZodEnum<["cloudflare", "railway"]>;
335
377
  kind: z.ZodEnum<["admin-application", "dns-record", "tls-policy", "api-proxy", "control-plane-api", "postgresql", "operations-runner", "treedx-service"]>;
336
378
  action: z.ZodEnum<["create", "adopt", "update", "noop"]>;
379
+ desiredResource: z.ZodObject<{
380
+ id: z.ZodString;
381
+ provider: z.ZodEnum<["cloudflare", "railway"]>;
382
+ kind: z.ZodEnum<["admin-application", "dns-record", "tls-policy", "api-proxy", "control-plane-api", "postgresql", "operations-runner", "treedx-service"]>;
383
+ dependsOn: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
384
+ parameters: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodObject<{
385
+ input: z.ZodString;
386
+ }, "strict", z.ZodTypeAny, {
387
+ input: string;
388
+ }, {
389
+ input: string;
390
+ }>, z.ZodObject<{
391
+ artifact: z.ZodString;
392
+ }, "strict", z.ZodTypeAny, {
393
+ artifact: string;
394
+ }, {
395
+ artifact: string;
396
+ }>, z.ZodObject<{
397
+ resourceOutput: z.ZodObject<{
398
+ resourceId: z.ZodString;
399
+ output: z.ZodString;
400
+ }, "strict", z.ZodTypeAny, {
401
+ resourceId: string;
402
+ output: string;
403
+ }, {
404
+ resourceId: string;
405
+ output: string;
406
+ }>;
407
+ }, "strict", z.ZodTypeAny, {
408
+ resourceOutput: {
409
+ resourceId: string;
410
+ output: string;
411
+ };
412
+ }, {
413
+ resourceOutput: {
414
+ resourceId: string;
415
+ output: string;
416
+ };
417
+ }>, z.ZodObject<{
418
+ literal: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>;
419
+ }, "strict", z.ZodTypeAny, {
420
+ literal: string | number | boolean;
421
+ }, {
422
+ literal: string | number | boolean;
423
+ }>]>>>;
424
+ adoption: z.ZodObject<{
425
+ mode: z.ZodLiteral<"adopt-or-create">;
426
+ externalIdInput: z.ZodOptional<z.ZodString>;
427
+ replacement: z.ZodLiteral<"forbidden">;
428
+ }, "strict", z.ZodTypeAny, {
429
+ mode: "adopt-or-create";
430
+ replacement: "forbidden";
431
+ externalIdInput?: string | undefined;
432
+ }, {
433
+ mode: "adopt-or-create";
434
+ replacement: "forbidden";
435
+ externalIdInput?: string | undefined;
436
+ }>;
437
+ }, "strict", z.ZodTypeAny, {
438
+ id: string;
439
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
440
+ provider: "cloudflare" | "railway";
441
+ dependsOn: string[];
442
+ parameters: Record<string, {
443
+ input: string;
444
+ } | {
445
+ artifact: string;
446
+ } | {
447
+ resourceOutput: {
448
+ resourceId: string;
449
+ output: string;
450
+ };
451
+ } | {
452
+ literal: string | number | boolean;
453
+ }>;
454
+ adoption: {
455
+ mode: "adopt-or-create";
456
+ replacement: "forbidden";
457
+ externalIdInput?: string | undefined;
458
+ };
459
+ }, {
460
+ id: string;
461
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
462
+ provider: "cloudflare" | "railway";
463
+ adoption: {
464
+ mode: "adopt-or-create";
465
+ replacement: "forbidden";
466
+ externalIdInput?: string | undefined;
467
+ };
468
+ dependsOn?: string[] | undefined;
469
+ parameters?: Record<string, {
470
+ input: string;
471
+ } | {
472
+ artifact: string;
473
+ } | {
474
+ resourceOutput: {
475
+ resourceId: string;
476
+ output: string;
477
+ };
478
+ } | {
479
+ literal: string | number | boolean;
480
+ }> | undefined;
481
+ }>;
337
482
  desiredDigest: z.ZodString;
338
483
  previousDigest: z.ZodNullable<z.ZodString>;
339
484
  providerResourceId: z.ZodNullable<z.ZodString>;
@@ -343,6 +488,29 @@ export declare const hostedTopologyPlanSchema: z.ZodObject<{
343
488
  kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
344
489
  provider: "cloudflare" | "railway";
345
490
  providerResourceId: string | null;
491
+ desiredResource: {
492
+ id: string;
493
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
494
+ provider: "cloudflare" | "railway";
495
+ dependsOn: string[];
496
+ parameters: Record<string, {
497
+ input: string;
498
+ } | {
499
+ artifact: string;
500
+ } | {
501
+ resourceOutput: {
502
+ resourceId: string;
503
+ output: string;
504
+ };
505
+ } | {
506
+ literal: string | number | boolean;
507
+ }>;
508
+ adoption: {
509
+ mode: "adopt-or-create";
510
+ replacement: "forbidden";
511
+ externalIdInput?: string | undefined;
512
+ };
513
+ };
346
514
  desiredDigest: string;
347
515
  previousDigest: string | null;
348
516
  }, {
@@ -351,10 +519,33 @@ export declare const hostedTopologyPlanSchema: z.ZodObject<{
351
519
  kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
352
520
  provider: "cloudflare" | "railway";
353
521
  providerResourceId: string | null;
522
+ desiredResource: {
523
+ id: string;
524
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
525
+ provider: "cloudflare" | "railway";
526
+ adoption: {
527
+ mode: "adopt-or-create";
528
+ replacement: "forbidden";
529
+ externalIdInput?: string | undefined;
530
+ };
531
+ dependsOn?: string[] | undefined;
532
+ parameters?: Record<string, {
533
+ input: string;
534
+ } | {
535
+ artifact: string;
536
+ } | {
537
+ resourceOutput: {
538
+ resourceId: string;
539
+ output: string;
540
+ };
541
+ } | {
542
+ literal: string | number | boolean;
543
+ }> | undefined;
544
+ };
354
545
  desiredDigest: string;
355
546
  previousDigest: string | null;
356
547
  }>, "many">;
357
- blockers: z.ZodArray<z.ZodObject<{
548
+ readonly blockers: z.ZodArray<z.ZodObject<{
358
549
  code: z.ZodEnum<["connection-unavailable", "dependency-cycle", "observation-unhealthy", "adoption-drift"]>;
359
550
  resourceId: z.ZodOptional<z.ZodString>;
360
551
  message: z.ZodString;
@@ -367,8 +558,8 @@ export declare const hostedTopologyPlanSchema: z.ZodObject<{
367
558
  message: string;
368
559
  resourceId?: string | undefined;
369
560
  }>, "many">;
370
- approvalRequired: z.ZodBoolean;
371
- executable: z.ZodLiteral<false>;
561
+ readonly approvalRequired: z.ZodBoolean;
562
+ readonly executable: z.ZodLiteral<false>;
372
563
  }, "strict", z.ZodTypeAny, {
373
564
  schemaVersion: "treeseed.hosted-topology-plan/v1";
374
565
  blockers: {
@@ -383,12 +574,43 @@ export declare const hostedTopologyPlanSchema: z.ZodObject<{
383
574
  kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
384
575
  provider: "cloudflare" | "railway";
385
576
  providerResourceId: string | null;
577
+ desiredResource: {
578
+ id: string;
579
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
580
+ provider: "cloudflare" | "railway";
581
+ dependsOn: string[];
582
+ parameters: Record<string, {
583
+ input: string;
584
+ } | {
585
+ artifact: string;
586
+ } | {
587
+ resourceOutput: {
588
+ resourceId: string;
589
+ output: string;
590
+ };
591
+ } | {
592
+ literal: string | number | boolean;
593
+ }>;
594
+ adoption: {
595
+ mode: "adopt-or-create";
596
+ replacement: "forbidden";
597
+ externalIdInput?: string | undefined;
598
+ };
599
+ };
386
600
  desiredDigest: string;
387
601
  previousDigest: string | null;
388
602
  }[];
389
603
  environment: "production" | "staging";
390
604
  executable: false;
605
+ artifacts: Record<string, {
606
+ digest: string;
607
+ source: string;
608
+ }>;
391
609
  planId: string;
610
+ providerConnections: Partial<Record<"cloudflare" | "railway", {
611
+ connectionRef: string;
612
+ nonSecretConfig: Record<string, string | number | boolean>;
613
+ }>>;
392
614
  declarationDigest: string;
393
615
  topologyId: string;
394
616
  platformCommit: string;
@@ -407,12 +629,153 @@ export declare const hostedTopologyPlanSchema: z.ZodObject<{
407
629
  kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
408
630
  provider: "cloudflare" | "railway";
409
631
  providerResourceId: string | null;
632
+ desiredResource: {
633
+ id: string;
634
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
635
+ provider: "cloudflare" | "railway";
636
+ adoption: {
637
+ mode: "adopt-or-create";
638
+ replacement: "forbidden";
639
+ externalIdInput?: string | undefined;
640
+ };
641
+ dependsOn?: string[] | undefined;
642
+ parameters?: Record<string, {
643
+ input: string;
644
+ } | {
645
+ artifact: string;
646
+ } | {
647
+ resourceOutput: {
648
+ resourceId: string;
649
+ output: string;
650
+ };
651
+ } | {
652
+ literal: string | number | boolean;
653
+ }> | undefined;
654
+ };
410
655
  desiredDigest: string;
411
656
  previousDigest: string | null;
412
657
  }[];
413
658
  environment: "production" | "staging";
414
659
  executable: false;
660
+ artifacts: Record<string, {
661
+ digest: string;
662
+ source: string;
663
+ }>;
415
664
  planId: string;
665
+ providerConnections: Partial<Record<"cloudflare" | "railway", {
666
+ connectionRef: string;
667
+ nonSecretConfig: Record<string, string | number | boolean>;
668
+ }>>;
669
+ declarationDigest: string;
670
+ topologyId: string;
671
+ platformCommit: string;
672
+ approvalRequired: boolean;
673
+ }>, {
674
+ schemaVersion: "treeseed.hosted-topology-plan/v1";
675
+ blockers: {
676
+ code: "connection-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
677
+ message: string;
678
+ resourceId?: string | undefined;
679
+ }[];
680
+ planDigest: string;
681
+ actions: {
682
+ action: "noop" | "create" | "adopt" | "update";
683
+ resourceId: string;
684
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
685
+ provider: "cloudflare" | "railway";
686
+ providerResourceId: string | null;
687
+ desiredResource: {
688
+ id: string;
689
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
690
+ provider: "cloudflare" | "railway";
691
+ dependsOn: string[];
692
+ parameters: Record<string, {
693
+ input: string;
694
+ } | {
695
+ artifact: string;
696
+ } | {
697
+ resourceOutput: {
698
+ resourceId: string;
699
+ output: string;
700
+ };
701
+ } | {
702
+ literal: string | number | boolean;
703
+ }>;
704
+ adoption: {
705
+ mode: "adopt-or-create";
706
+ replacement: "forbidden";
707
+ externalIdInput?: string | undefined;
708
+ };
709
+ };
710
+ desiredDigest: string;
711
+ previousDigest: string | null;
712
+ }[];
713
+ environment: "production" | "staging";
714
+ executable: false;
715
+ artifacts: Record<string, {
716
+ digest: string;
717
+ source: string;
718
+ }>;
719
+ planId: string;
720
+ providerConnections: Partial<Record<"cloudflare" | "railway", {
721
+ connectionRef: string;
722
+ nonSecretConfig: Record<string, string | number | boolean>;
723
+ }>>;
724
+ declarationDigest: string;
725
+ topologyId: string;
726
+ platformCommit: string;
727
+ approvalRequired: boolean;
728
+ }, {
729
+ schemaVersion: "treeseed.hosted-topology-plan/v1";
730
+ blockers: {
731
+ code: "connection-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
732
+ message: string;
733
+ resourceId?: string | undefined;
734
+ }[];
735
+ planDigest: string;
736
+ actions: {
737
+ action: "noop" | "create" | "adopt" | "update";
738
+ resourceId: string;
739
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
740
+ provider: "cloudflare" | "railway";
741
+ providerResourceId: string | null;
742
+ desiredResource: {
743
+ id: string;
744
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
745
+ provider: "cloudflare" | "railway";
746
+ adoption: {
747
+ mode: "adopt-or-create";
748
+ replacement: "forbidden";
749
+ externalIdInput?: string | undefined;
750
+ };
751
+ dependsOn?: string[] | undefined;
752
+ parameters?: Record<string, {
753
+ input: string;
754
+ } | {
755
+ artifact: string;
756
+ } | {
757
+ resourceOutput: {
758
+ resourceId: string;
759
+ output: string;
760
+ };
761
+ } | {
762
+ literal: string | number | boolean;
763
+ }> | undefined;
764
+ };
765
+ desiredDigest: string;
766
+ previousDigest: string | null;
767
+ }[];
768
+ environment: "production" | "staging";
769
+ executable: false;
770
+ artifacts: Record<string, {
771
+ digest: string;
772
+ source: string;
773
+ }>;
774
+ planId: string;
775
+ providerConnections: Partial<Record<"cloudflare" | "railway", {
776
+ connectionRef: string;
777
+ nonSecretConfig: Record<string, string | number | boolean>;
778
+ }>>;
416
779
  declarationDigest: string;
417
780
  topologyId: string;
418
781
  platformCommit: string;
@@ -440,7 +803,30 @@ export declare const hostedTopologyApprovalSchema: z.ZodObject<{
440
803
  approvedBy: string;
441
804
  approvedAt: string;
442
805
  }>;
443
- export declare const authorizedHostedTopologyPlanSchema: z.ZodObject<Omit<{
806
+ export declare const authorizedHostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<Omit<{
807
+ executable: z.ZodLiteral<true>;
808
+ approval: z.ZodNullable<z.ZodObject<{
809
+ schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-approval/v1">;
810
+ planDigest: z.ZodString;
811
+ environment: z.ZodEnum<["staging", "production"]>;
812
+ decision: z.ZodLiteral<"approved">;
813
+ approvedBy: z.ZodString;
814
+ approvedAt: z.ZodString;
815
+ }, "strict", z.ZodTypeAny, {
816
+ schemaVersion: "treeseed.hosted-topology-approval/v1";
817
+ planDigest: string;
818
+ environment: "production" | "staging";
819
+ decision: "approved";
820
+ approvedBy: string;
821
+ approvedAt: string;
822
+ }, {
823
+ schemaVersion: "treeseed.hosted-topology-approval/v1";
824
+ planDigest: string;
825
+ environment: "production" | "staging";
826
+ decision: "approved";
827
+ approvedBy: string;
828
+ approvedAt: string;
829
+ }>>;
444
830
  schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-plan/v1">;
445
831
  planId: z.ZodString;
446
832
  planDigest: z.ZodString;
@@ -448,11 +834,140 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodObject<Omit<{
448
834
  topologyId: z.ZodString;
449
835
  environment: z.ZodEnum<["staging", "production"]>;
450
836
  platformCommit: z.ZodString;
837
+ artifacts: z.ZodRecord<z.ZodString, z.ZodObject<{
838
+ digest: z.ZodString;
839
+ source: z.ZodString;
840
+ }, "strict", z.ZodTypeAny, {
841
+ digest: string;
842
+ source: string;
843
+ }, {
844
+ digest: string;
845
+ source: string;
846
+ }>>;
847
+ providerConnections: z.ZodRecord<z.ZodEnum<["cloudflare", "railway"]>, z.ZodEffects<z.ZodObject<{
848
+ connectionRef: z.ZodString;
849
+ nonSecretConfig: z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
850
+ }, "strict", z.ZodTypeAny, {
851
+ connectionRef: string;
852
+ nonSecretConfig: Record<string, string | number | boolean>;
853
+ }, {
854
+ connectionRef: string;
855
+ nonSecretConfig: Record<string, string | number | boolean>;
856
+ }>, {
857
+ connectionRef: string;
858
+ nonSecretConfig: Record<string, string | number | boolean>;
859
+ }, {
860
+ connectionRef: string;
861
+ nonSecretConfig: Record<string, string | number | boolean>;
862
+ }>>;
451
863
  actions: z.ZodArray<z.ZodObject<{
452
864
  resourceId: z.ZodString;
453
865
  provider: z.ZodEnum<["cloudflare", "railway"]>;
454
866
  kind: z.ZodEnum<["admin-application", "dns-record", "tls-policy", "api-proxy", "control-plane-api", "postgresql", "operations-runner", "treedx-service"]>;
455
867
  action: z.ZodEnum<["create", "adopt", "update", "noop"]>;
868
+ desiredResource: z.ZodObject<{
869
+ id: z.ZodString;
870
+ provider: z.ZodEnum<["cloudflare", "railway"]>;
871
+ kind: z.ZodEnum<["admin-application", "dns-record", "tls-policy", "api-proxy", "control-plane-api", "postgresql", "operations-runner", "treedx-service"]>;
872
+ dependsOn: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
873
+ parameters: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodObject<{
874
+ input: z.ZodString;
875
+ }, "strict", z.ZodTypeAny, {
876
+ input: string;
877
+ }, {
878
+ input: string;
879
+ }>, z.ZodObject<{
880
+ artifact: z.ZodString;
881
+ }, "strict", z.ZodTypeAny, {
882
+ artifact: string;
883
+ }, {
884
+ artifact: string;
885
+ }>, z.ZodObject<{
886
+ resourceOutput: z.ZodObject<{
887
+ resourceId: z.ZodString;
888
+ output: z.ZodString;
889
+ }, "strict", z.ZodTypeAny, {
890
+ resourceId: string;
891
+ output: string;
892
+ }, {
893
+ resourceId: string;
894
+ output: string;
895
+ }>;
896
+ }, "strict", z.ZodTypeAny, {
897
+ resourceOutput: {
898
+ resourceId: string;
899
+ output: string;
900
+ };
901
+ }, {
902
+ resourceOutput: {
903
+ resourceId: string;
904
+ output: string;
905
+ };
906
+ }>, z.ZodObject<{
907
+ literal: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>;
908
+ }, "strict", z.ZodTypeAny, {
909
+ literal: string | number | boolean;
910
+ }, {
911
+ literal: string | number | boolean;
912
+ }>]>>>;
913
+ adoption: z.ZodObject<{
914
+ mode: z.ZodLiteral<"adopt-or-create">;
915
+ externalIdInput: z.ZodOptional<z.ZodString>;
916
+ replacement: z.ZodLiteral<"forbidden">;
917
+ }, "strict", z.ZodTypeAny, {
918
+ mode: "adopt-or-create";
919
+ replacement: "forbidden";
920
+ externalIdInput?: string | undefined;
921
+ }, {
922
+ mode: "adopt-or-create";
923
+ replacement: "forbidden";
924
+ externalIdInput?: string | undefined;
925
+ }>;
926
+ }, "strict", z.ZodTypeAny, {
927
+ id: string;
928
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
929
+ provider: "cloudflare" | "railway";
930
+ dependsOn: string[];
931
+ parameters: Record<string, {
932
+ input: string;
933
+ } | {
934
+ artifact: string;
935
+ } | {
936
+ resourceOutput: {
937
+ resourceId: string;
938
+ output: string;
939
+ };
940
+ } | {
941
+ literal: string | number | boolean;
942
+ }>;
943
+ adoption: {
944
+ mode: "adopt-or-create";
945
+ replacement: "forbidden";
946
+ externalIdInput?: string | undefined;
947
+ };
948
+ }, {
949
+ id: string;
950
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
951
+ provider: "cloudflare" | "railway";
952
+ adoption: {
953
+ mode: "adopt-or-create";
954
+ replacement: "forbidden";
955
+ externalIdInput?: string | undefined;
956
+ };
957
+ dependsOn?: string[] | undefined;
958
+ parameters?: Record<string, {
959
+ input: string;
960
+ } | {
961
+ artifact: string;
962
+ } | {
963
+ resourceOutput: {
964
+ resourceId: string;
965
+ output: string;
966
+ };
967
+ } | {
968
+ literal: string | number | boolean;
969
+ }> | undefined;
970
+ }>;
456
971
  desiredDigest: z.ZodString;
457
972
  previousDigest: z.ZodNullable<z.ZodString>;
458
973
  providerResourceId: z.ZodNullable<z.ZodString>;
@@ -462,6 +977,29 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodObject<Omit<{
462
977
  kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
463
978
  provider: "cloudflare" | "railway";
464
979
  providerResourceId: string | null;
980
+ desiredResource: {
981
+ id: string;
982
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
983
+ provider: "cloudflare" | "railway";
984
+ dependsOn: string[];
985
+ parameters: Record<string, {
986
+ input: string;
987
+ } | {
988
+ artifact: string;
989
+ } | {
990
+ resourceOutput: {
991
+ resourceId: string;
992
+ output: string;
993
+ };
994
+ } | {
995
+ literal: string | number | boolean;
996
+ }>;
997
+ adoption: {
998
+ mode: "adopt-or-create";
999
+ replacement: "forbidden";
1000
+ externalIdInput?: string | undefined;
1001
+ };
1002
+ };
465
1003
  desiredDigest: string;
466
1004
  previousDigest: string | null;
467
1005
  }, {
@@ -470,6 +1008,29 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodObject<Omit<{
470
1008
  kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
471
1009
  provider: "cloudflare" | "railway";
472
1010
  providerResourceId: string | null;
1011
+ desiredResource: {
1012
+ id: string;
1013
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
1014
+ provider: "cloudflare" | "railway";
1015
+ adoption: {
1016
+ mode: "adopt-or-create";
1017
+ replacement: "forbidden";
1018
+ externalIdInput?: string | undefined;
1019
+ };
1020
+ dependsOn?: string[] | undefined;
1021
+ parameters?: Record<string, {
1022
+ input: string;
1023
+ } | {
1024
+ artifact: string;
1025
+ } | {
1026
+ resourceOutput: {
1027
+ resourceId: string;
1028
+ output: string;
1029
+ };
1030
+ } | {
1031
+ literal: string | number | boolean;
1032
+ }> | undefined;
1033
+ };
473
1034
  desiredDigest: string;
474
1035
  previousDigest: string | null;
475
1036
  }>, "many">;
@@ -487,31 +1048,131 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodObject<Omit<{
487
1048
  resourceId?: string | undefined;
488
1049
  }>, "many">;
489
1050
  approvalRequired: z.ZodBoolean;
490
- } & {
491
- executable: z.ZodLiteral<true>;
492
- approval: z.ZodNullable<z.ZodObject<{
493
- schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-approval/v1">;
494
- planDigest: z.ZodString;
495
- environment: z.ZodEnum<["staging", "production"]>;
496
- decision: z.ZodLiteral<"approved">;
497
- approvedBy: z.ZodString;
498
- approvedAt: z.ZodString;
499
- }, "strict", z.ZodTypeAny, {
1051
+ }, "approvalRequired">, "strict", z.ZodTypeAny, {
1052
+ schemaVersion: "treeseed.hosted-topology-plan/v1";
1053
+ blockers: {
1054
+ code: "connection-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
1055
+ message: string;
1056
+ resourceId?: string | undefined;
1057
+ }[];
1058
+ planDigest: string;
1059
+ actions: {
1060
+ action: "noop" | "create" | "adopt" | "update";
1061
+ resourceId: string;
1062
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
1063
+ provider: "cloudflare" | "railway";
1064
+ providerResourceId: string | null;
1065
+ desiredResource: {
1066
+ id: string;
1067
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
1068
+ provider: "cloudflare" | "railway";
1069
+ dependsOn: string[];
1070
+ parameters: Record<string, {
1071
+ input: string;
1072
+ } | {
1073
+ artifact: string;
1074
+ } | {
1075
+ resourceOutput: {
1076
+ resourceId: string;
1077
+ output: string;
1078
+ };
1079
+ } | {
1080
+ literal: string | number | boolean;
1081
+ }>;
1082
+ adoption: {
1083
+ mode: "adopt-or-create";
1084
+ replacement: "forbidden";
1085
+ externalIdInput?: string | undefined;
1086
+ };
1087
+ };
1088
+ desiredDigest: string;
1089
+ previousDigest: string | null;
1090
+ }[];
1091
+ environment: "production" | "staging";
1092
+ executable: true;
1093
+ artifacts: Record<string, {
1094
+ digest: string;
1095
+ source: string;
1096
+ }>;
1097
+ planId: string;
1098
+ providerConnections: Partial<Record<"cloudflare" | "railway", {
1099
+ connectionRef: string;
1100
+ nonSecretConfig: Record<string, string | number | boolean>;
1101
+ }>>;
1102
+ declarationDigest: string;
1103
+ topologyId: string;
1104
+ platformCommit: string;
1105
+ approval: {
500
1106
  schemaVersion: "treeseed.hosted-topology-approval/v1";
501
1107
  planDigest: string;
502
1108
  environment: "production" | "staging";
503
1109
  decision: "approved";
504
1110
  approvedBy: string;
505
1111
  approvedAt: string;
506
- }, {
1112
+ } | null;
1113
+ }, {
1114
+ schemaVersion: "treeseed.hosted-topology-plan/v1";
1115
+ blockers: {
1116
+ code: "connection-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
1117
+ message: string;
1118
+ resourceId?: string | undefined;
1119
+ }[];
1120
+ planDigest: string;
1121
+ actions: {
1122
+ action: "noop" | "create" | "adopt" | "update";
1123
+ resourceId: string;
1124
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
1125
+ provider: "cloudflare" | "railway";
1126
+ providerResourceId: string | null;
1127
+ desiredResource: {
1128
+ id: string;
1129
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
1130
+ provider: "cloudflare" | "railway";
1131
+ adoption: {
1132
+ mode: "adopt-or-create";
1133
+ replacement: "forbidden";
1134
+ externalIdInput?: string | undefined;
1135
+ };
1136
+ dependsOn?: string[] | undefined;
1137
+ parameters?: Record<string, {
1138
+ input: string;
1139
+ } | {
1140
+ artifact: string;
1141
+ } | {
1142
+ resourceOutput: {
1143
+ resourceId: string;
1144
+ output: string;
1145
+ };
1146
+ } | {
1147
+ literal: string | number | boolean;
1148
+ }> | undefined;
1149
+ };
1150
+ desiredDigest: string;
1151
+ previousDigest: string | null;
1152
+ }[];
1153
+ environment: "production" | "staging";
1154
+ executable: true;
1155
+ artifacts: Record<string, {
1156
+ digest: string;
1157
+ source: string;
1158
+ }>;
1159
+ planId: string;
1160
+ providerConnections: Partial<Record<"cloudflare" | "railway", {
1161
+ connectionRef: string;
1162
+ nonSecretConfig: Record<string, string | number | boolean>;
1163
+ }>>;
1164
+ declarationDigest: string;
1165
+ topologyId: string;
1166
+ platformCommit: string;
1167
+ approval: {
507
1168
  schemaVersion: "treeseed.hosted-topology-approval/v1";
508
1169
  planDigest: string;
509
1170
  environment: "production" | "staging";
510
1171
  decision: "approved";
511
1172
  approvedBy: string;
512
1173
  approvedAt: string;
513
- }>>;
514
- }, "approvalRequired">, "strict", z.ZodTypeAny, {
1174
+ } | null;
1175
+ }>, {
515
1176
  schemaVersion: "treeseed.hosted-topology-plan/v1";
516
1177
  blockers: {
517
1178
  code: "connection-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
@@ -525,12 +1186,43 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodObject<Omit<{
525
1186
  kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
526
1187
  provider: "cloudflare" | "railway";
527
1188
  providerResourceId: string | null;
1189
+ desiredResource: {
1190
+ id: string;
1191
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
1192
+ provider: "cloudflare" | "railway";
1193
+ dependsOn: string[];
1194
+ parameters: Record<string, {
1195
+ input: string;
1196
+ } | {
1197
+ artifact: string;
1198
+ } | {
1199
+ resourceOutput: {
1200
+ resourceId: string;
1201
+ output: string;
1202
+ };
1203
+ } | {
1204
+ literal: string | number | boolean;
1205
+ }>;
1206
+ adoption: {
1207
+ mode: "adopt-or-create";
1208
+ replacement: "forbidden";
1209
+ externalIdInput?: string | undefined;
1210
+ };
1211
+ };
528
1212
  desiredDigest: string;
529
1213
  previousDigest: string | null;
530
1214
  }[];
531
1215
  environment: "production" | "staging";
532
1216
  executable: true;
1217
+ artifacts: Record<string, {
1218
+ digest: string;
1219
+ source: string;
1220
+ }>;
533
1221
  planId: string;
1222
+ providerConnections: Partial<Record<"cloudflare" | "railway", {
1223
+ connectionRef: string;
1224
+ nonSecretConfig: Record<string, string | number | boolean>;
1225
+ }>>;
534
1226
  declarationDigest: string;
535
1227
  topologyId: string;
536
1228
  platformCommit: string;
@@ -556,12 +1248,43 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodObject<Omit<{
556
1248
  kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
557
1249
  provider: "cloudflare" | "railway";
558
1250
  providerResourceId: string | null;
1251
+ desiredResource: {
1252
+ id: string;
1253
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
1254
+ provider: "cloudflare" | "railway";
1255
+ adoption: {
1256
+ mode: "adopt-or-create";
1257
+ replacement: "forbidden";
1258
+ externalIdInput?: string | undefined;
1259
+ };
1260
+ dependsOn?: string[] | undefined;
1261
+ parameters?: Record<string, {
1262
+ input: string;
1263
+ } | {
1264
+ artifact: string;
1265
+ } | {
1266
+ resourceOutput: {
1267
+ resourceId: string;
1268
+ output: string;
1269
+ };
1270
+ } | {
1271
+ literal: string | number | boolean;
1272
+ }> | undefined;
1273
+ };
559
1274
  desiredDigest: string;
560
1275
  previousDigest: string | null;
561
1276
  }[];
562
1277
  environment: "production" | "staging";
563
1278
  executable: true;
1279
+ artifacts: Record<string, {
1280
+ digest: string;
1281
+ source: string;
1282
+ }>;
564
1283
  planId: string;
1284
+ providerConnections: Partial<Record<"cloudflare" | "railway", {
1285
+ connectionRef: string;
1286
+ nonSecretConfig: Record<string, string | number | boolean>;
1287
+ }>>;
565
1288
  declarationDigest: string;
566
1289
  topologyId: string;
567
1290
  platformCommit: string;
@@ -779,7 +1502,7 @@ export type HostedTopologyReceipt = z.infer<typeof hostedTopologyReceiptSchema>;
779
1502
  export declare function planHostedTopology(input: {
780
1503
  declaration: HostedTopologyDeclaration;
781
1504
  observations: HostedResourceObservation[];
782
- availableConnections: string[];
1505
+ connections: Partial<Record<z.infer<typeof hostedProviderSchema>, z.input<typeof hostedConnectionSnapshotSchema>>>;
783
1506
  }): HostedTopologyPlan;
784
1507
  export declare function authorizeHostedTopologyPlan(planInput: HostedTopologyPlan, approvalInput?: HostedTopologyApproval): AuthorizedHostedTopologyPlan;
785
1508
  export declare function verifyHostedTopologyReadback(input: {
@@ -824,3 +1547,4 @@ export declare function authorizeHostedTopologyRollback(rollbackInput: z.input<t
824
1547
  rollbackDigest: string;
825
1548
  };
826
1549
  };
1550
+ export {};
@@ -27,6 +27,23 @@ const resourceProviderKinds = {
27
27
  };
28
28
  const sensitiveKey = /(?:credential|password|private.?key|registration.?code|secret|token)/iu;
29
29
  const personalPath = /(?:^|[\s'"`:=])(?:\/home\/[^/\s]+|\/Users\/[^/\s]+|[A-Za-z]:\\Users\\[^\\\s]+)/u;
30
+ const runtimeScalar = z.union([z.string().max(4096), z.number().finite(), z.boolean()]);
31
+ const runtimeInputName = z.string().regex(/^[A-Za-z][A-Za-z0-9._-]{0,63}$/u);
32
+ const hostedConnectionSnapshotSchema = z.object({
33
+ connectionRef: identifier,
34
+ nonSecretConfig: z.record(runtimeInputName, runtimeScalar)
35
+ }).strict().superRefine((snapshot, context) => {
36
+ for (const key of Object.keys(snapshot.nonSecretConfig)) if (sensitiveKey.test(key))
37
+ context.addIssue({ code: z.ZodIssueCode.custom, path: ["nonSecretConfig", key], message: "Hosted provider snapshots cannot contain credential-like fields." });
38
+ });
39
+ const hostedResourceDeclarationSchema = z.object({
40
+ id: identifier,
41
+ provider: hostedProviderSchema,
42
+ kind: hostedResourceKindSchema,
43
+ dependsOn: z.array(identifier).default([]),
44
+ parameters: z.record(identifier, parameterSchema).default({}),
45
+ adoption: z.object({ mode: z.literal("adopt-or-create"), externalIdInput: identifier.optional(), replacement: z.literal("forbidden") }).strict()
46
+ }).strict();
30
47
  const hostedTopologyDeclarationSchema = z.object({
31
48
  schemaVersion: z.literal("treeseed.hosted-topology/v1"),
32
49
  id: identifier,
@@ -35,14 +52,7 @@ const hostedTopologyDeclarationSchema = z.object({
35
52
  platform: z.object({ repository: z.literal("treeseed-ai/platform"), commit: gitCommit }).strict(),
36
53
  providerConnections: z.record(hostedProviderSchema, z.object({ connectionRef: identifier }).strict()),
37
54
  artifacts: z.record(identifier, z.object({ digest, source: z.string().url() }).strict()),
38
- resources: z.array(z.object({
39
- id: identifier,
40
- provider: hostedProviderSchema,
41
- kind: hostedResourceKindSchema,
42
- dependsOn: z.array(identifier).default([]),
43
- parameters: z.record(identifier, parameterSchema).default({}),
44
- adoption: z.object({ mode: z.literal("adopt-or-create"), externalIdInput: identifier.optional(), replacement: z.literal("forbidden") }).strict()
45
- }).strict()).min(1)
55
+ resources: z.array(hostedResourceDeclarationSchema).min(1)
46
56
  }).strict().superRefine((declaration, context) => {
47
57
  const ids = declaration.resources.map(({ id }) => id);
48
58
  if (new Set(ids).size !== ids.length) context.addIssue({ code: z.ZodIssueCode.custom, path: ["resources"], message: "Hosted topology resource identities must be unique." });
@@ -63,7 +73,7 @@ const hostedResourceObservationSchema = z.object({
63
73
  observedDigest: digest.nullable(),
64
74
  observedAt: timestamp
65
75
  }).strict();
66
- const hostedTopologyPlanSchema = z.object({
76
+ const hostedTopologyPlanShape = {
67
77
  schemaVersion: z.literal("treeseed.hosted-topology-plan/v1"),
68
78
  planId: z.string().regex(/^topology-plan-[a-f0-9]{16}$/u),
69
79
  planDigest: digest,
@@ -71,11 +81,14 @@ const hostedTopologyPlanSchema = z.object({
71
81
  topologyId: identifier,
72
82
  environment: z.enum(["staging", "production"]),
73
83
  platformCommit: gitCommit,
84
+ artifacts: z.record(identifier, z.object({ digest, source: z.string().url() }).strict()),
85
+ providerConnections: z.record(hostedProviderSchema, hostedConnectionSnapshotSchema),
74
86
  actions: z.array(z.object({
75
87
  resourceId: identifier,
76
88
  provider: hostedProviderSchema,
77
89
  kind: hostedResourceKindSchema,
78
90
  action: z.enum(["create", "adopt", "update", "noop"]),
91
+ desiredResource: hostedResourceDeclarationSchema,
79
92
  desiredDigest: digest,
80
93
  previousDigest: digest.nullable(),
81
94
  providerResourceId: z.string().min(1).max(512).nullable()
@@ -83,7 +96,32 @@ const hostedTopologyPlanSchema = z.object({
83
96
  blockers: z.array(z.object({ code: z.enum(["connection-unavailable", "dependency-cycle", "observation-unhealthy", "adoption-drift"]), resourceId: identifier.optional(), message: z.string().min(1) }).strict()),
84
97
  approvalRequired: z.boolean(),
85
98
  executable: z.literal(false)
86
- }).strict();
99
+ };
100
+ function verifyPlanBinding(plan, context) {
101
+ for (const [index, action] of plan.actions.entries()) {
102
+ const desired = hostedResourceDeclarationSchema.parse(action.desiredResource);
103
+ if (desired.id !== action.resourceId || desired.provider !== action.provider || desired.kind !== action.kind)
104
+ context.addIssue({ code: z.ZodIssueCode.custom, path: ["actions", index, "desiredResource"], message: "Hosted plan action identity must match its desired resource specification." });
105
+ if (deploymentDigest(desired) !== action.desiredDigest)
106
+ context.addIssue({ code: z.ZodIssueCode.custom, path: ["actions", index, "desiredDigest"], message: "Hosted plan desired digest must bind its complete desired resource specification." });
107
+ if (!plan.providerConnections[action.provider] && !plan.blockers.some((blocker) => blocker.code === "connection-unavailable"))
108
+ context.addIssue({ code: z.ZodIssueCode.custom, path: ["providerConnections", action.provider], message: `Hosted plan is missing the selected ${action.provider} connection snapshot.` });
109
+ }
110
+ const core = {
111
+ declarationDigest: plan.declarationDigest,
112
+ topologyId: plan.topologyId,
113
+ environment: plan.environment,
114
+ platformCommit: plan.platformCommit,
115
+ artifacts: plan.artifacts,
116
+ providerConnections: plan.providerConnections,
117
+ actions: plan.actions,
118
+ blockers: plan.blockers
119
+ };
120
+ const expected = deploymentDigest(core);
121
+ if (expected !== plan.planDigest || plan.planId !== `topology-plan-${expected.slice(7, 23)}`)
122
+ context.addIssue({ code: z.ZodIssueCode.custom, path: ["planDigest"], message: "Hosted topology plan identity must bind the exact canonical plan." });
123
+ }
124
+ const hostedTopologyPlanSchema = z.object(hostedTopologyPlanShape).strict().superRefine(verifyPlanBinding);
87
125
  const hostedTopologyApprovalSchema = z.object({
88
126
  schemaVersion: z.literal("treeseed.hosted-topology-approval/v1"),
89
127
  planDigest: digest,
@@ -92,10 +130,11 @@ const hostedTopologyApprovalSchema = z.object({
92
130
  approvedBy: z.string().min(1).max(256),
93
131
  approvedAt: timestamp
94
132
  }).strict();
95
- const authorizedHostedTopologyPlanSchema = hostedTopologyPlanSchema.extend({
133
+ const authorizedHostedTopologyPlanSchema = z.object({
134
+ ...hostedTopologyPlanShape,
96
135
  executable: z.literal(true),
97
136
  approval: hostedTopologyApprovalSchema.nullable()
98
- }).omit({ approvalRequired: true });
137
+ }).strict().omit({ approvalRequired: true }).superRefine(verifyPlanBinding);
99
138
  const hostedTopologyReceiptSchema = z.object({
100
139
  schemaVersion: z.literal("treeseed.hosted-topology-receipt/v1"),
101
140
  receiptId: z.string().regex(/^topology-receipt-[a-f0-9]{16}$/u),
@@ -170,7 +209,12 @@ function planHostedTopology(input) {
170
209
  };
171
210
  const observations = observationMap(input.observations, normalizedDeclaration);
172
211
  const blockers = [];
173
- for (const [provider, binding] of Object.entries(normalizedDeclaration.providerConnections)) if (!input.availableConnections.includes(binding.connectionRef)) blockers.push({ code: "connection-unavailable", message: `${provider} connection ${binding.connectionRef} is unavailable.` });
212
+ const providerConnections = {};
213
+ for (const [provider, binding] of Object.entries(normalizedDeclaration.providerConnections)) {
214
+ const snapshot = input.connections[provider];
215
+ if (!snapshot || snapshot.connectionRef !== binding.connectionRef) blockers.push({ code: "connection-unavailable", message: `${provider} connection ${binding.connectionRef} is unavailable.` });
216
+ else providerConnections[provider] = hostedConnectionSnapshotSchema.parse(snapshot);
217
+ }
174
218
  for (const resourceId of cycleMembers(normalizedDeclaration)) blockers.push({ code: "dependency-cycle", resourceId, message: `Hosted resource ${resourceId} participates in a dependency cycle.` });
175
219
  const actions = normalizedDeclaration.resources.map((resource) => {
176
220
  const desiredDigest = deploymentDigest(resource);
@@ -182,10 +226,28 @@ function planHostedTopology(input) {
182
226
  else if (observation.managedBy === "external") blockers.push({ code: "adoption-drift", resourceId: resource.id, message: `External resource ${resource.id} differs from the declaration and cannot be replaced.` });
183
227
  else action = "update";
184
228
  }
185
- return { resourceId: resource.id, provider: resource.provider, kind: resource.kind, action, desiredDigest, previousDigest: observation?.observedDigest ?? null, providerResourceId: observation?.providerResourceId ?? null };
229
+ return {
230
+ resourceId: resource.id,
231
+ provider: resource.provider,
232
+ kind: resource.kind,
233
+ action,
234
+ desiredResource: resource,
235
+ desiredDigest,
236
+ previousDigest: observation?.observedDigest ?? null,
237
+ providerResourceId: observation?.providerResourceId ?? null
238
+ };
186
239
  });
187
240
  const declarationDigest = deploymentDigest(normalizedDeclaration);
188
- const core = { declarationDigest, topologyId: declaration.id, environment: declaration.environment, platformCommit: declaration.platform.commit, actions, blockers };
241
+ const core = {
242
+ declarationDigest,
243
+ topologyId: declaration.id,
244
+ environment: declaration.environment,
245
+ platformCommit: declaration.platform.commit,
246
+ artifacts: normalizedDeclaration.artifacts,
247
+ providerConnections,
248
+ actions,
249
+ blockers
250
+ };
189
251
  const planDigest = deploymentDigest(core);
190
252
  return hostedTopologyPlanSchema.parse({ schemaVersion: "treeseed.hosted-topology-plan/v1", planId: `topology-plan-${planDigest.slice(7, 23)}`, planDigest, ...core, approvalRequired: actions.some(({ action }) => action !== "noop"), executable: false });
191
253
  }
@@ -56,12 +56,43 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
56
56
  kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
57
57
  provider: "cloudflare" | "railway";
58
58
  providerResourceId: string | null;
59
+ desiredResource: {
60
+ id: string;
61
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
62
+ provider: "cloudflare" | "railway";
63
+ adoption: {
64
+ mode: "adopt-or-create";
65
+ replacement: "forbidden";
66
+ externalIdInput?: string | undefined;
67
+ };
68
+ dependsOn?: string[] | undefined;
69
+ parameters?: Record<string, {
70
+ input: string;
71
+ } | {
72
+ artifact: string;
73
+ } | {
74
+ resourceOutput: {
75
+ resourceId: string;
76
+ output: string;
77
+ };
78
+ } | {
79
+ literal: string | number | boolean;
80
+ }> | undefined;
81
+ };
59
82
  desiredDigest: string;
60
83
  previousDigest: string | null;
61
84
  }[];
62
85
  environment: "production" | "staging";
63
86
  executable: false;
87
+ artifacts: Record<string, {
88
+ digest: string;
89
+ source: string;
90
+ }>;
64
91
  planId: string;
92
+ providerConnections: Partial<Record<"cloudflare" | "railway", {
93
+ connectionRef: string;
94
+ nonSecretConfig: Record<string, string | number | boolean>;
95
+ }>>;
65
96
  declarationDigest: string;
66
97
  topologyId: string;
67
98
  platformCommit: string;
@@ -92,12 +123,43 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
92
123
  kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
93
124
  provider: "cloudflare" | "railway";
94
125
  providerResourceId: string | null;
126
+ desiredResource: {
127
+ id: string;
128
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
129
+ provider: "cloudflare" | "railway";
130
+ adoption: {
131
+ mode: "adopt-or-create";
132
+ replacement: "forbidden";
133
+ externalIdInput?: string | undefined;
134
+ };
135
+ dependsOn?: string[] | undefined;
136
+ parameters?: Record<string, {
137
+ input: string;
138
+ } | {
139
+ artifact: string;
140
+ } | {
141
+ resourceOutput: {
142
+ resourceId: string;
143
+ output: string;
144
+ };
145
+ } | {
146
+ literal: string | number | boolean;
147
+ }> | undefined;
148
+ };
95
149
  desiredDigest: string;
96
150
  previousDigest: string | null;
97
151
  }[];
98
152
  environment: "production" | "staging";
99
153
  executable: false;
154
+ artifacts: Record<string, {
155
+ digest: string;
156
+ source: string;
157
+ }>;
100
158
  planId: string;
159
+ providerConnections: Partial<Record<"cloudflare" | "railway", {
160
+ connectionRef: string;
161
+ nonSecretConfig: Record<string, string | number | boolean>;
162
+ }>>;
101
163
  declarationDigest: string;
102
164
  topologyId: string;
103
165
  platformCommit: string;
@@ -59,12 +59,43 @@ export declare const CONTROL_PLANE_OPERATIONS: {
59
59
  kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
60
60
  provider: "cloudflare" | "railway";
61
61
  providerResourceId: string | null;
62
+ desiredResource: {
63
+ id: string;
64
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
65
+ provider: "cloudflare" | "railway";
66
+ adoption: {
67
+ mode: "adopt-or-create";
68
+ replacement: "forbidden";
69
+ externalIdInput?: string | undefined;
70
+ };
71
+ dependsOn?: string[] | undefined;
72
+ parameters?: Record<string, {
73
+ input: string;
74
+ } | {
75
+ artifact: string;
76
+ } | {
77
+ resourceOutput: {
78
+ resourceId: string;
79
+ output: string;
80
+ };
81
+ } | {
82
+ literal: string | number | boolean;
83
+ }> | undefined;
84
+ };
62
85
  desiredDigest: string;
63
86
  previousDigest: string | null;
64
87
  }[];
65
88
  environment: "production" | "staging";
66
89
  executable: false;
90
+ artifacts: Record<string, {
91
+ digest: string;
92
+ source: string;
93
+ }>;
67
94
  planId: string;
95
+ providerConnections: Partial<Record<"cloudflare" | "railway", {
96
+ connectionRef: string;
97
+ nonSecretConfig: Record<string, string | number | boolean>;
98
+ }>>;
68
99
  declarationDigest: string;
69
100
  topologyId: string;
70
101
  platformCommit: string;
@@ -95,12 +126,43 @@ export declare const CONTROL_PLANE_OPERATIONS: {
95
126
  kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
96
127
  provider: "cloudflare" | "railway";
97
128
  providerResourceId: string | null;
129
+ desiredResource: {
130
+ id: string;
131
+ kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
132
+ provider: "cloudflare" | "railway";
133
+ adoption: {
134
+ mode: "adopt-or-create";
135
+ replacement: "forbidden";
136
+ externalIdInput?: string | undefined;
137
+ };
138
+ dependsOn?: string[] | undefined;
139
+ parameters?: Record<string, {
140
+ input: string;
141
+ } | {
142
+ artifact: string;
143
+ } | {
144
+ resourceOutput: {
145
+ resourceId: string;
146
+ output: string;
147
+ };
148
+ } | {
149
+ literal: string | number | boolean;
150
+ }> | undefined;
151
+ };
98
152
  desiredDigest: string;
99
153
  previousDigest: string | null;
100
154
  }[];
101
155
  environment: "production" | "staging";
102
156
  executable: false;
157
+ artifacts: Record<string, {
158
+ digest: string;
159
+ source: string;
160
+ }>;
103
161
  planId: string;
162
+ providerConnections: Partial<Record<"cloudflare" | "railway", {
163
+ connectionRef: string;
164
+ nonSecretConfig: Record<string, string | number | boolean>;
165
+ }>>;
104
166
  declarationDigest: string;
105
167
  topologyId: string;
106
168
  platformCommit: string;
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@treeseed/sdk",
3
- "version": "0.13.0-rc.72",
3
+ "version": "0.13.0-rc.74",
4
4
  "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
5
5
  "license": "Apache-2.0",
6
6
  "repository": {