@treeseed/sdk 0.13.0-rc.73 → 0.13.0-rc.75

package/dist/.treeseed-build-complete.json

@@ -1 +1 @@
-{"completedAt":"2026-09-02T03:14:56.048Z"}
+{"completedAt":"2026-09-02T03:41:16.944Z"}

package/dist/deployment/hosted-topology.d.ts

@@ -1,6 +1,22 @@
 import { z } from 'zod';
 export declare const hostedProviderSchema: z.ZodEnum<["cloudflare", "railway"]>;
 export declare const hostedResourceKindSchema: z.ZodEnum<["admin-application", "dns-record", "tls-policy", "api-proxy", "control-plane-api", "postgresql", "operations-runner", "treedx-service"]>;
+declare const hostedConnectionSnapshotSchema: z.ZodEffects<z.ZodObject<{
+    connectionRef: z.ZodString;
+    nonSecretConfig: z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+}, "strict", z.ZodTypeAny, {
+    connectionRef: string;
+    nonSecretConfig: Record<string, string | number | boolean>;
+}, {
+    connectionRef: string;
+    nonSecretConfig: Record<string, string | number | boolean>;
+}>, {
+    connectionRef: string;
+    nonSecretConfig: Record<string, string | number | boolean>;
+}, {
+    connectionRef: string;
+    nonSecretConfig: Record<string, string | number | boolean>;
+}>;
 export declare const hostedTopologyDeclarationSchema: z.ZodEffects<z.ZodObject<{
     schemaVersion: z.ZodLiteral<"treeseed.hosted-topology/v1">;
     id: z.ZodString;
@@ -329,6 +345,32 @@ export declare const hostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<{
     readonly topologyId: z.ZodString;
     readonly environment: z.ZodEnum<["staging", "production"]>;
     readonly platformCommit: z.ZodString;
+    readonly artifacts: z.ZodRecord<z.ZodString, z.ZodObject<{
+        digest: z.ZodString;
+        source: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        digest: string;
+        source: string;
+    }, {
+        digest: string;
+        source: string;
+    }>>;
+    readonly providerConnections: z.ZodRecord<z.ZodEnum<["cloudflare", "railway"]>, z.ZodEffects<z.ZodObject<{
+        connectionRef: z.ZodString;
+        nonSecretConfig: z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, "strict", z.ZodTypeAny, {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }, {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>, {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }, {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>>;
     readonly actions: z.ZodArray<z.ZodObject<{
         resourceId: z.ZodString;
         provider: z.ZodEnum<["cloudflare", "railway"]>;
@@ -560,7 +602,15 @@ export declare const hostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<{
     }[];
     environment: "production" | "staging";
     executable: false;
+    artifacts: Record<string, {
+        digest: string;
+        source: string;
+    }>;
     planId: string;
+    providerConnections: Partial<Record<"cloudflare" | "railway", {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>>;
     declarationDigest: string;
     topologyId: string;
     platformCommit: string;
@@ -607,7 +657,15 @@ export declare const hostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<{
     }[];
     environment: "production" | "staging";
     executable: false;
+    artifacts: Record<string, {
+        digest: string;
+        source: string;
+    }>;
     planId: string;
+    providerConnections: Partial<Record<"cloudflare" | "railway", {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>>;
     declarationDigest: string;
     topologyId: string;
     platformCommit: string;
@@ -654,7 +712,15 @@ export declare const hostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<{
     }[];
     environment: "production" | "staging";
     executable: false;
+    artifacts: Record<string, {
+        digest: string;
+        source: string;
+    }>;
     planId: string;
+    providerConnections: Partial<Record<"cloudflare" | "railway", {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>>;
     declarationDigest: string;
     topologyId: string;
     platformCommit: string;
@@ -701,7 +767,15 @@ export declare const hostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<{
     }[];
     environment: "production" | "staging";
     executable: false;
+    artifacts: Record<string, {
+        digest: string;
+        source: string;
+    }>;
     planId: string;
+    providerConnections: Partial<Record<"cloudflare" | "railway", {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>>;
     declarationDigest: string;
     topologyId: string;
     platformCommit: string;
@@ -760,6 +834,32 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodEffects<z.ZodObjec
     topologyId: z.ZodString;
     environment: z.ZodEnum<["staging", "production"]>;
     platformCommit: z.ZodString;
+    artifacts: z.ZodRecord<z.ZodString, z.ZodObject<{
+        digest: z.ZodString;
+        source: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        digest: string;
+        source: string;
+    }, {
+        digest: string;
+        source: string;
+    }>>;
+    providerConnections: z.ZodRecord<z.ZodEnum<["cloudflare", "railway"]>, z.ZodEffects<z.ZodObject<{
+        connectionRef: z.ZodString;
+        nonSecretConfig: z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, "strict", z.ZodTypeAny, {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }, {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>, {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }, {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>>;
     actions: z.ZodArray<z.ZodObject<{
         resourceId: z.ZodString;
         provider: z.ZodEnum<["cloudflare", "railway"]>;
@@ -990,7 +1090,15 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodEffects<z.ZodObjec
     }[];
     environment: "production" | "staging";
     executable: true;
+    artifacts: Record<string, {
+        digest: string;
+        source: string;
+    }>;
     planId: string;
+    providerConnections: Partial<Record<"cloudflare" | "railway", {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>>;
     declarationDigest: string;
     topologyId: string;
     platformCommit: string;
@@ -1044,7 +1152,15 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodEffects<z.ZodObjec
     }[];
     environment: "production" | "staging";
     executable: true;
+    artifacts: Record<string, {
+        digest: string;
+        source: string;
+    }>;
     planId: string;
+    providerConnections: Partial<Record<"cloudflare" | "railway", {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>>;
     declarationDigest: string;
     topologyId: string;
     platformCommit: string;
@@ -1098,7 +1214,15 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodEffects<z.ZodObjec
     }[];
     environment: "production" | "staging";
     executable: true;
+    artifacts: Record<string, {
+        digest: string;
+        source: string;
+    }>;
     planId: string;
+    providerConnections: Partial<Record<"cloudflare" | "railway", {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>>;
     declarationDigest: string;
     topologyId: string;
     platformCommit: string;
@@ -1152,7 +1276,15 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodEffects<z.ZodObjec
     }[];
     environment: "production" | "staging";
     executable: true;
+    artifacts: Record<string, {
+        digest: string;
+        source: string;
+    }>;
     planId: string;
+    providerConnections: Partial<Record<"cloudflare" | "railway", {
+        connectionRef: string;
+        nonSecretConfig: Record<string, string | number | boolean>;
+    }>>;
     declarationDigest: string;
     topologyId: string;
     platformCommit: string;
@@ -1370,7 +1502,7 @@ export type HostedTopologyReceipt = z.infer<typeof hostedTopologyReceiptSchema>;
 export declare function planHostedTopology(input: {
     declaration: HostedTopologyDeclaration;
     observations: HostedResourceObservation[];
-    availableConnections: string[];
+    connections: Partial<Record<z.infer<typeof hostedProviderSchema>, z.input<typeof hostedConnectionSnapshotSchema>>>;
 }): HostedTopologyPlan;
 export declare function authorizeHostedTopologyPlan(planInput: HostedTopologyPlan, approvalInput?: HostedTopologyApproval): AuthorizedHostedTopologyPlan;
 export declare function verifyHostedTopologyReadback(input: {
@@ -1415,3 +1547,4 @@ export declare function authorizeHostedTopologyRollback(rollbackInput: z.input<t
         rollbackDigest: string;
     };
 };
+export {};

package/dist/deployment/hosted-topology.js

@@ -27,6 +27,15 @@ const resourceProviderKinds = {
 };
 const sensitiveKey = /(?:credential|password|private.?key|registration.?code|secret|token)/iu;
 const personalPath = /(?:^|[\s'"`:=])(?:\/home\/[^/\s]+|\/Users\/[^/\s]+|[A-Za-z]:\\Users\\[^\\\s]+)/u;
+const runtimeScalar = z.union([z.string().max(4096), z.number().finite(), z.boolean()]);
+const runtimeInputName = z.string().regex(/^[A-Za-z][A-Za-z0-9._-]{0,63}$/u);
+const hostedConnectionSnapshotSchema = z.object({
+  connectionRef: identifier,
+  nonSecretConfig: z.record(runtimeInputName, runtimeScalar)
+}).strict().superRefine((snapshot, context) => {
+  for (const key of Object.keys(snapshot.nonSecretConfig)) if (sensitiveKey.test(key))
+    context.addIssue({ code: z.ZodIssueCode.custom, path: ["nonSecretConfig", key], message: "Hosted provider snapshots cannot contain credential-like fields." });
+});
 const hostedResourceDeclarationSchema = z.object({
   id: identifier,
   provider: hostedProviderSchema,
@@ -72,6 +81,8 @@ const hostedTopologyPlanShape = {
   topologyId: identifier,
   environment: z.enum(["staging", "production"]),
   platformCommit: gitCommit,
+  artifacts: z.record(identifier, z.object({ digest, source: z.string().url() }).strict()),
+  providerConnections: z.record(hostedProviderSchema, hostedConnectionSnapshotSchema),
   actions: z.array(z.object({
     resourceId: identifier,
     provider: hostedProviderSchema,
@@ -93,12 +104,16 @@ function verifyPlanBinding(plan, context) {
       context.addIssue({ code: z.ZodIssueCode.custom, path: ["actions", index, "desiredResource"], message: "Hosted plan action identity must match its desired resource specification." });
     if (deploymentDigest(desired) !== action.desiredDigest)
       context.addIssue({ code: z.ZodIssueCode.custom, path: ["actions", index, "desiredDigest"], message: "Hosted plan desired digest must bind its complete desired resource specification." });
+    if (!plan.providerConnections[action.provider] && !plan.blockers.some((blocker) => blocker.code === "connection-unavailable"))
+      context.addIssue({ code: z.ZodIssueCode.custom, path: ["providerConnections", action.provider], message: `Hosted plan is missing the selected ${action.provider} connection snapshot.` });
   }
   const core = {
     declarationDigest: plan.declarationDigest,
     topologyId: plan.topologyId,
     environment: plan.environment,
     platformCommit: plan.platformCommit,
+    artifacts: plan.artifacts,
+    providerConnections: plan.providerConnections,
     actions: plan.actions,
     blockers: plan.blockers
   };
@@ -194,7 +209,12 @@ function planHostedTopology(input) {
   };
   const observations = observationMap(input.observations, normalizedDeclaration);
   const blockers = [];
-  for (const [provider, binding] of Object.entries(normalizedDeclaration.providerConnections)) if (!input.availableConnections.includes(binding.connectionRef)) blockers.push({ code: "connection-unavailable", message: `${provider} connection ${binding.connectionRef} is unavailable.` });
+  const providerConnections = {};
+  for (const [provider, binding] of Object.entries(normalizedDeclaration.providerConnections)) {
+    const snapshot = input.connections[provider];
+    if (!snapshot || snapshot.connectionRef !== binding.connectionRef) blockers.push({ code: "connection-unavailable", message: `${provider} connection ${binding.connectionRef} is unavailable.` });
+    else providerConnections[provider] = hostedConnectionSnapshotSchema.parse(snapshot);
+  }
   for (const resourceId of cycleMembers(normalizedDeclaration)) blockers.push({ code: "dependency-cycle", resourceId, message: `Hosted resource ${resourceId} participates in a dependency cycle.` });
   const actions = normalizedDeclaration.resources.map((resource) => {
     const desiredDigest = deploymentDigest(resource);
@@ -218,7 +238,16 @@ function planHostedTopology(input) {
     };
   });
   const declarationDigest = deploymentDigest(normalizedDeclaration);
-  const core = { declarationDigest, topologyId: declaration.id, environment: declaration.environment, platformCommit: declaration.platform.commit, actions, blockers };
+  const core = {
+    declarationDigest,
+    topologyId: declaration.id,
+    environment: declaration.environment,
+    platformCommit: declaration.platform.commit,
+    artifacts: normalizedDeclaration.artifacts,
+    providerConnections,
+    actions,
+    blockers
+  };
   const planDigest = deploymentDigest(core);
   return hostedTopologyPlanSchema.parse({ schemaVersion: "treeseed.hosted-topology-plan/v1", planId: `topology-plan-${planDigest.slice(7, 23)}`, planDigest, ...core, approvalRequired: actions.some(({ action }) => action !== "noop"), executable: false });
 }

package/dist/operator-contracts/catalog/hosted-topology-operations.d.ts

@@ -84,7 +84,15 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
         }[];
         environment: "production" | "staging";
         executable: false;
+        artifacts: Record<string, {
+            digest: string;
+            source: string;
+        }>;
         planId: string;
+        providerConnections: Partial<Record<"cloudflare" | "railway", {
+            connectionRef: string;
+            nonSecretConfig: Record<string, string | number | boolean>;
+        }>>;
         declarationDigest: string;
         topologyId: string;
         platformCommit: string;
@@ -143,7 +151,15 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
             }[];
             environment: "production" | "staging";
             executable: false;
+            artifacts: Record<string, {
+                digest: string;
+                source: string;
+            }>;
             planId: string;
+            providerConnections: Partial<Record<"cloudflare" | "railway", {
+                connectionRef: string;
+                nonSecretConfig: Record<string, string | number | boolean>;
+            }>>;
             declarationDigest: string;
             topologyId: string;
             platformCommit: string;

package/dist/operator-contracts/control-plane-operations.d.ts

@@ -87,7 +87,15 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                 }[];
                 environment: "production" | "staging";
                 executable: false;
+                artifacts: Record<string, {
+                    digest: string;
+                    source: string;
+                }>;
                 planId: string;
+                providerConnections: Partial<Record<"cloudflare" | "railway", {
+                    connectionRef: string;
+                    nonSecretConfig: Record<string, string | number | boolean>;
+                }>>;
                 declarationDigest: string;
                 topologyId: string;
                 platformCommit: string;
@@ -146,7 +154,15 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                     }[];
                     environment: "production" | "staging";
                     executable: false;
+                    artifacts: Record<string, {
+                        digest: string;
+                        source: string;
+                    }>;
                     planId: string;
+                    providerConnections: Partial<Record<"cloudflare" | "railway", {
+                        connectionRef: string;
+                        nonSecretConfig: Record<string, string | number | boolean>;
+                    }>>;
                     declarationDigest: string;
                     topologyId: string;
                     platformCommit: string;

package/dist/secrets-capability/service-provider-contracts.js

@@ -115,7 +115,10 @@ const SERVICE_PROVIDER_CATALOG = [
     documentationUrl: "https://developers.cloudflare.com/fundamentals/api/get-started/create-token/",
     description: "Connect a Cloudflare account with separately scoped capability tokens.",
     knowledgePageIds: ["provider.cloudflare"],
-    connectionFields: [field("accountId", "Account ID", "The non-secret Cloudflare account identifier.")],
+    connectionFields: [
+      field("accountId", "Account ID", "The non-secret Cloudflare account identifier."),
+      field("zoneId", "Zone ID", "Optional non-secret zone identifier used by reviewed DNS and TLS topology resources.", false)
+    ],
     capabilities: [
       { type: "frontend-hosting", label: "Frontend hosting", description: "Pages and Workers application hosting.", credentialProfileIds: ["cloudflare-runtime"], status: "available" },
       { type: "dns-management", label: "DNS management", description: "Scoped DNS record management.", credentialProfileIds: ["cloudflare-dns"], status: "available" },
@@ -134,7 +137,11 @@ const SERVICE_PROVIDER_CATALOG = [
     documentationUrl: "https://docs.railway.com/guides/public-api",
     description: "Connect a Railway workspace for future backend and private infrastructure.",
     knowledgePageIds: ["provider.railway"],
-    connectionFields: [field("workspaceId", "Workspace ID", "The non-secret Railway workspace identifier.")],
+    connectionFields: [
+      field("workspaceId", "Workspace ID", "The non-secret Railway workspace identifier."),
+      field("projectId", "Project ID", "Optional non-secret project identifier used to adopt a reviewed hosted topology.", false),
+      field("environmentId", "Environment ID", "Optional non-secret environment identifier used to target reviewed hosted deployments.", false)
+    ],
     capabilities: [
       { type: "backend-hosting", label: "Backend hosting", description: "API and backend service hosting.", credentialProfileIds: ["railway-workspace"], status: "available" },
       { type: "database-hosting", label: "Database hosting", description: "Managed database placement.", credentialProfileIds: ["railway-workspace"], status: "available" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.73",
+  "version": "0.13.0-rc.75",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {