@treeseed/sdk 0.13.0-rc.90 → 0.13.0-rc.92

package/dist/secrets-capability/shared-access.d.ts

@@ -0,0 +1,51 @@
+import { type SharedResourceGrant, type ServiceBinding } from './shared-resources.js';
+export interface SharedAccessRequest {
+    resourceKind: 'connection' | 'vault';
+    resourceId: string;
+    ownerTeamId: string | null;
+    teamId: string;
+    permission: string;
+    environment: 'staging' | 'production' | 'shared';
+    resourceIdWithinProvider: string;
+    projectId?: string;
+    assignmentId?: string;
+}
+export interface CurrentSharingAuthority {
+    actorCanUse: boolean;
+    ownerOrganizationId: string | null;
+    recipientOrganizationId: string | null;
+    deploymentAudiencePolicyId: string | null;
+}
+/** Pure policy check only. API supplies fresh trusted authority and atomically reserves quota before execution. */
+export declare function authorizeSharedGrant(input: SharedResourceGrant, request: SharedAccessRequest, authority: CurrentSharingAuthority, now: Date): {
+    grantId: string;
+    grantVersion: number;
+    limits: {
+        maxConcurrentOperations: number;
+        maxOperationsPerWindow: number;
+        windowSeconds: number;
+    };
+};
+export interface BindingSelection {
+    teamId: string;
+    projectId: string;
+    capability: string;
+    environment: ServiceBinding['environment'];
+}
+/** Once bound, never consult a lower-priority default. Eligibility is evaluated by the API after selection. */
+export declare function selectServiceBinding(request: BindingSelection, pinned: ServiceBinding | null, defaults: {
+    explicit: ServiceBinding[];
+    team: ServiceBinding[];
+    organization: ServiceBinding[];
+    deployment: ServiceBinding[];
+}): {
+    id: string;
+    version: number;
+    projectId: string;
+    teamId: string;
+    environment: "production" | "staging" | "shared";
+    capability: string;
+    connectionId: string;
+    grantId: string | null;
+    ownerTeamId: string;
+};

package/dist/secrets-capability/shared-access.js

@@ -0,0 +1,36 @@
+import { sharedResourceGrantSchema, serviceBindingSchema } from "./shared-resources.js";
+function authorizeSharedGrant(input, request, authority, now) {
+  const grant = sharedResourceGrantSchema.parse(input);
+  const deny = (reason) => {
+    throw new Error(reason);
+  };
+  if (!Number.isFinite(now.getTime())) deny("invalid_authorization_time");
+  if (!authority.actorCanUse) deny("actor_not_authorized");
+  if (grant.status !== "active" || grant.expiresAt && Date.parse(grant.expiresAt) <= now.getTime()) deny("grant_inactive");
+  if (grant.recipientTeamId !== request.teamId || grant.resource.kind !== request.resourceKind || grant.resource.id !== request.resourceId || grant.resource.ownerTeamId !== request.ownerTeamId) deny("grant_resource_mismatch");
+  if (grant.authority.kind === "organization") {
+    if (authority.ownerOrganizationId !== grant.authority.organizationId || authority.recipientOrganizationId !== grant.authority.organizationId) deny("organization_membership_required");
+  } else if (authority.deploymentAudiencePolicyId !== grant.authority.audiencePolicyId) deny("deployment_audience_required");
+  if (!grant.permissions.includes(request.permission) || grant.scope.environment !== request.environment || !grant.scope.resourceIds.includes(request.resourceIdWithinProvider)) deny("grant_scope_mismatch");
+  if (grant.scope.projectIds.length && (!request.projectId || !grant.scope.projectIds.includes(request.projectId))) deny("project_scope_mismatch");
+  if (grant.scope.assignmentIds.length && (!request.assignmentId || !grant.scope.assignmentIds.includes(request.assignmentId))) deny("assignment_scope_mismatch");
+  return { grantId: grant.id, grantVersion: grant.version, limits: { ...grant.limits } };
+}
+function selectServiceBinding(request, pinned, defaults) {
+  const matches = (value) => value.teamId === request.teamId && value.projectId === request.projectId && value.capability === request.capability && value.environment === request.environment;
+  if (pinned) {
+    const binding = serviceBindingSchema.parse(pinned);
+    if (!matches(binding)) throw new Error("binding_scope_mismatch");
+    return binding;
+  }
+  for (const tier of ["explicit", "team", "organization", "deployment"]) {
+    const candidates = defaults[tier].map((value) => serviceBindingSchema.parse(value)).filter(matches);
+    if (candidates.length > 1) throw new Error("ambiguous_service_default");
+    if (candidates[0]) return candidates[0];
+  }
+  throw new Error("service_binding_unavailable");
+}
+export {
+  authorizeSharedGrant,
+  selectServiceBinding
+};

package/dist/secrets-capability/shared-resources.d.ts

@@ -0,0 +1,376 @@
+import { z } from 'zod';
+export declare const organizationSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    version: number;
+    name: string;
+}, {
+    id: string;
+    version: number;
+    name: string;
+}>;
+export declare const organizationMemberSchema: z.ZodObject<{
+    organizationId: z.ZodString;
+    userId: z.ZodString;
+    role: z.ZodEnum<["owner", "admin", "member"]>;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    role: "owner" | "admin" | "member";
+    version: number;
+    organizationId: string;
+    userId: string;
+}, {
+    role: "owner" | "admin" | "member";
+    version: number;
+    organizationId: string;
+    userId: string;
+}>;
+export declare const organizationTeamSchema: z.ZodObject<{
+    teamId: z.ZodString;
+    organizationId: z.ZodNullable<z.ZodString>;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    version: number;
+    teamId: string;
+    organizationId: string | null;
+}, {
+    version: number;
+    teamId: string;
+    organizationId: string | null;
+}>;
+export declare const organizationTeamInvitationSchema: z.ZodObject<{
+    id: z.ZodString;
+    organizationId: z.ZodString;
+    teamId: z.ZodString;
+    organizationAuthorizedBy: z.ZodString;
+    teamAuthorizedBy: z.ZodNullable<z.ZodString>;
+    expiresAt: z.ZodString;
+    status: z.ZodEnum<["pending", "accepted", "rejected", "revoked", "expired"]>;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    status: "rejected" | "revoked" | "expired" | "pending" | "accepted";
+    id: string;
+    version: number;
+    teamId: string;
+    expiresAt: string;
+    organizationId: string;
+    organizationAuthorizedBy: string;
+    teamAuthorizedBy: string | null;
+}, {
+    status: "rejected" | "revoked" | "expired" | "pending" | "accepted";
+    id: string;
+    version: number;
+    teamId: string;
+    expiresAt: string;
+    organizationId: string;
+    organizationAuthorizedBy: string;
+    teamAuthorizedBy: string | null;
+}>;
+export declare const sharedResourceSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+    kind: z.ZodLiteral<"connection">;
+    id: z.ZodString;
+    ownerTeamId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    kind: "connection";
+    id: string;
+    ownerTeamId: string;
+}, {
+    kind: "connection";
+    id: string;
+    ownerTeamId: string;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"vault">;
+    id: z.ZodString;
+    ownerTeamId: z.ZodNullable<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    kind: "vault";
+    id: string;
+    ownerTeamId: string | null;
+}, {
+    kind: "vault";
+    id: string;
+    ownerTeamId: string | null;
+}>]>;
+export declare const sharedResourceGrantSchema: z.ZodEffects<z.ZodObject<{
+    id: z.ZodString;
+    resource: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"connection">;
+        id: z.ZodString;
+        ownerTeamId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "connection";
+        id: string;
+        ownerTeamId: string;
+    }, {
+        kind: "connection";
+        id: string;
+        ownerTeamId: string;
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"vault">;
+        id: z.ZodString;
+        ownerTeamId: z.ZodNullable<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        kind: "vault";
+        id: string;
+        ownerTeamId: string | null;
+    }, {
+        kind: "vault";
+        id: string;
+        ownerTeamId: string | null;
+    }>]>;
+    recipientTeamId: z.ZodString;
+    authority: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"organization">;
+        organizationId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "organization";
+        organizationId: string;
+    }, {
+        kind: "organization";
+        organizationId: string;
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"deployment">;
+        audiencePolicyId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "deployment";
+        audiencePolicyId: string;
+    }, {
+        kind: "deployment";
+        audiencePolicyId: string;
+    }>]>;
+    origin: z.ZodEnum<["explicit", "default-policy"]>;
+    defaultPolicyId: z.ZodNullable<z.ZodString>;
+    permissions: z.ZodArray<z.ZodString, "many">;
+    scope: z.ZodObject<{
+        environment: z.ZodEnum<["staging", "production", "shared"]>;
+        resourceIds: z.ZodArray<z.ZodString, "many">;
+        projectIds: z.ZodArray<z.ZodString, "many">;
+        assignmentIds: z.ZodArray<z.ZodString, "many">;
+    }, "strict", z.ZodTypeAny, {
+        environment: "production" | "staging" | "shared";
+        projectIds: string[];
+        resourceIds: string[];
+        assignmentIds: string[];
+    }, {
+        environment: "production" | "staging" | "shared";
+        projectIds: string[];
+        resourceIds: string[];
+        assignmentIds: string[];
+    }>;
+    limits: z.ZodObject<{
+        maxConcurrentOperations: z.ZodNumber;
+        maxOperationsPerWindow: z.ZodNumber;
+        windowSeconds: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        maxConcurrentOperations: number;
+        maxOperationsPerWindow: number;
+        windowSeconds: number;
+    }, {
+        maxConcurrentOperations: number;
+        maxOperationsPerWindow: number;
+        windowSeconds: number;
+    }>;
+    status: z.ZodEnum<["active", "revoked"]>;
+    version: z.ZodNumber;
+    expiresAt: z.ZodNullable<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    status: "revoked" | "active";
+    id: string;
+    version: number;
+    scope: {
+        environment: "production" | "staging" | "shared";
+        projectIds: string[];
+        resourceIds: string[];
+        assignmentIds: string[];
+    };
+    expiresAt: string | null;
+    origin: "explicit" | "default-policy";
+    resource: {
+        kind: "connection";
+        id: string;
+        ownerTeamId: string;
+    } | {
+        kind: "vault";
+        id: string;
+        ownerTeamId: string | null;
+    };
+    authority: {
+        kind: "organization";
+        organizationId: string;
+    } | {
+        kind: "deployment";
+        audiencePolicyId: string;
+    };
+    limits: {
+        maxConcurrentOperations: number;
+        maxOperationsPerWindow: number;
+        windowSeconds: number;
+    };
+    permissions: string[];
+    recipientTeamId: string;
+    defaultPolicyId: string | null;
+}, {
+    status: "revoked" | "active";
+    id: string;
+    version: number;
+    scope: {
+        environment: "production" | "staging" | "shared";
+        projectIds: string[];
+        resourceIds: string[];
+        assignmentIds: string[];
+    };
+    expiresAt: string | null;
+    origin: "explicit" | "default-policy";
+    resource: {
+        kind: "connection";
+        id: string;
+        ownerTeamId: string;
+    } | {
+        kind: "vault";
+        id: string;
+        ownerTeamId: string | null;
+    };
+    authority: {
+        kind: "organization";
+        organizationId: string;
+    } | {
+        kind: "deployment";
+        audiencePolicyId: string;
+    };
+    limits: {
+        maxConcurrentOperations: number;
+        maxOperationsPerWindow: number;
+        windowSeconds: number;
+    };
+    permissions: string[];
+    recipientTeamId: string;
+    defaultPolicyId: string | null;
+}>, {
+    status: "revoked" | "active";
+    id: string;
+    version: number;
+    scope: {
+        environment: "production" | "staging" | "shared";
+        projectIds: string[];
+        resourceIds: string[];
+        assignmentIds: string[];
+    };
+    expiresAt: string | null;
+    origin: "explicit" | "default-policy";
+    resource: {
+        kind: "connection";
+        id: string;
+        ownerTeamId: string;
+    } | {
+        kind: "vault";
+        id: string;
+        ownerTeamId: string | null;
+    };
+    authority: {
+        kind: "organization";
+        organizationId: string;
+    } | {
+        kind: "deployment";
+        audiencePolicyId: string;
+    };
+    limits: {
+        maxConcurrentOperations: number;
+        maxOperationsPerWindow: number;
+        windowSeconds: number;
+    };
+    permissions: string[];
+    recipientTeamId: string;
+    defaultPolicyId: string | null;
+}, {
+    status: "revoked" | "active";
+    id: string;
+    version: number;
+    scope: {
+        environment: "production" | "staging" | "shared";
+        projectIds: string[];
+        resourceIds: string[];
+        assignmentIds: string[];
+    };
+    expiresAt: string | null;
+    origin: "explicit" | "default-policy";
+    resource: {
+        kind: "connection";
+        id: string;
+        ownerTeamId: string;
+    } | {
+        kind: "vault";
+        id: string;
+        ownerTeamId: string | null;
+    };
+    authority: {
+        kind: "organization";
+        organizationId: string;
+    } | {
+        kind: "deployment";
+        audiencePolicyId: string;
+    };
+    limits: {
+        maxConcurrentOperations: number;
+        maxOperationsPerWindow: number;
+        windowSeconds: number;
+    };
+    permissions: string[];
+    recipientTeamId: string;
+    defaultPolicyId: string | null;
+}>;
+export type SharedResourceGrant = z.infer<typeof sharedResourceGrantSchema>;
+export declare const serviceBindingSchema: z.ZodEffects<z.ZodObject<{
+    id: z.ZodString;
+    teamId: z.ZodString;
+    projectId: z.ZodString;
+    capability: z.ZodString;
+    environment: z.ZodEnum<["staging", "production", "shared"]>;
+    connectionId: z.ZodString;
+    ownerTeamId: z.ZodString;
+    grantId: z.ZodNullable<z.ZodString>;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    version: number;
+    projectId: string;
+    teamId: string;
+    environment: "production" | "staging" | "shared";
+    capability: string;
+    connectionId: string;
+    grantId: string | null;
+    ownerTeamId: string;
+}, {
+    id: string;
+    version: number;
+    projectId: string;
+    teamId: string;
+    environment: "production" | "staging" | "shared";
+    capability: string;
+    connectionId: string;
+    grantId: string | null;
+    ownerTeamId: string;
+}>, {
+    id: string;
+    version: number;
+    projectId: string;
+    teamId: string;
+    environment: "production" | "staging" | "shared";
+    capability: string;
+    connectionId: string;
+    grantId: string | null;
+    ownerTeamId: string;
+}, {
+    id: string;
+    version: number;
+    projectId: string;
+    teamId: string;
+    environment: "production" | "staging" | "shared";
+    capability: string;
+    connectionId: string;
+    grantId: string | null;
+    ownerTeamId: string;
+}>;
+export type ServiceBinding = z.infer<typeof serviceBindingSchema>;

package/dist/secrets-capability/shared-resources.js

@@ -0,0 +1,91 @@
+import { z } from "zod";
+const id = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u);
+const version = z.number().int().nonnegative().safe();
+const environment = z.enum(["staging", "production", "shared"]);
+const timestamp = z.string().datetime();
+const organizationSchema = z.object({
+  id,
+  name: z.string().trim().min(1).max(160),
+  version
+}).strict();
+const organizationMemberSchema = z.object({
+  organizationId: id,
+  userId: id,
+  role: z.enum(["owner", "admin", "member"]),
+  version
+}).strict();
+const organizationTeamSchema = z.object({
+  teamId: id,
+  organizationId: id.nullable(),
+  version
+}).strict();
+const organizationTeamInvitationSchema = z.object({
+  id,
+  organizationId: id,
+  teamId: id,
+  organizationAuthorizedBy: id,
+  teamAuthorizedBy: id.nullable(),
+  expiresAt: timestamp,
+  status: z.enum(["pending", "accepted", "rejected", "revoked", "expired"]),
+  version
+}).strict();
+const sharedResourceSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("connection"), id, ownerTeamId: id }).strict(),
+  z.object({ kind: z.literal("vault"), id, ownerTeamId: id.nullable() }).strict()
+]);
+const sharedResourceGrantSchema = z.object({
+  id,
+  resource: sharedResourceSchema,
+  recipientTeamId: id,
+  authority: z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("organization"), organizationId: id }).strict(),
+    z.object({ kind: z.literal("deployment"), audiencePolicyId: id }).strict()
+  ]),
+  origin: z.enum(["explicit", "default-policy"]),
+  defaultPolicyId: id.nullable(),
+  permissions: z.array(id).min(1),
+  scope: z.object({
+    environment,
+    resourceIds: z.array(z.string().min(1).max(512)).min(1),
+    projectIds: z.array(id),
+    assignmentIds: z.array(id)
+  }).strict(),
+  limits: z.object({
+    maxConcurrentOperations: z.number().int().positive().safe(),
+    maxOperationsPerWindow: z.number().int().positive().safe(),
+    windowSeconds: z.number().int().positive().safe()
+  }).strict(),
+  status: z.enum(["active", "revoked"]),
+  version,
+  expiresAt: timestamp.nullable()
+}).strict().superRefine((grant, context) => {
+  if (grant.origin === "default-policy" !== (grant.defaultPolicyId !== null))
+    context.addIssue({ code: "custom", path: ["defaultPolicyId"], message: "Default grants require exactly one policy reference." });
+  if (grant.authority.kind === "organization" && grant.resource.ownerTeamId === null)
+    context.addIssue({ code: "custom", path: ["resource", "ownerTeamId"], message: "Organization resources require an owning team." });
+  if (grant.scope.resourceIds.includes("*"))
+    context.addIssue({ code: "custom", path: ["scope", "resourceIds"], message: "Unbounded resource grants are prohibited." });
+});
+const serviceBindingSchema = z.object({
+  id,
+  teamId: id,
+  projectId: id,
+  capability: id,
+  environment,
+  connectionId: id,
+  ownerTeamId: id,
+  grantId: id.nullable(),
+  version
+}).strict().superRefine((binding, context) => {
+  if (binding.teamId !== binding.ownerTeamId && binding.grantId === null)
+    context.addIssue({ code: "custom", path: ["grantId"], message: "Shared bindings require a grant." });
+});
+export {
+  organizationMemberSchema,
+  organizationSchema,
+  organizationTeamInvitationSchema,
+  organizationTeamSchema,
+  serviceBindingSchema,
+  sharedResourceGrantSchema,
+  sharedResourceSchema
+};

package/dist/secrets-capability/vault-contracts.d.ts

@@ -0,0 +1,132 @@
+import { z } from 'zod';
+/** Configuration validation is not DNS/routing authorization; Deployment enforces transport policy. */
+export declare const vaultDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    ownerTeamId: z.ZodNullable<z.ZodString>;
+    displayName: z.ZodString;
+    backend: z.ZodEnum<["managed-openbao", "external-openbao", "hashicorp-vault"]>;
+    endpoint: z.ZodEffects<z.ZodString, string, string>;
+    secretsMount: z.ZodEffects<z.ZodString, string, string>;
+    namespace: z.ZodNullable<z.ZodEffects<z.ZodString, string, string>>;
+    networkRouteId: z.ZodString;
+    tlsTrustId: z.ZodString;
+    authentication: z.ZodObject<{
+        method: z.ZodLiteral<"approle">;
+        mount: z.ZodEffects<z.ZodString, string, string>;
+        roleId: z.ZodString;
+        bootstrapCredentialRef: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        method: "approle";
+        mount: string;
+        roleId: string;
+        bootstrapCredentialRef: string;
+    }, {
+        method: "approle";
+        mount: string;
+        roleId: string;
+        bootstrapCredentialRef: string;
+    }>;
+    status: z.ZodEnum<["unverified", "ready", "unavailable", "revoked"]>;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    status: "revoked" | "ready" | "unavailable" | "unverified";
+    id: string;
+    version: number;
+    authentication: {
+        method: "approle";
+        mount: string;
+        roleId: string;
+        bootstrapCredentialRef: string;
+    };
+    displayName: string;
+    endpoint: string;
+    namespace: string | null;
+    backend: "managed-openbao" | "external-openbao" | "hashicorp-vault";
+    ownerTeamId: string | null;
+    secretsMount: string;
+    networkRouteId: string;
+    tlsTrustId: string;
+}, {
+    status: "revoked" | "ready" | "unavailable" | "unverified";
+    id: string;
+    version: number;
+    authentication: {
+        method: "approle";
+        mount: string;
+        roleId: string;
+        bootstrapCredentialRef: string;
+    };
+    displayName: string;
+    endpoint: string;
+    namespace: string | null;
+    backend: "managed-openbao" | "external-openbao" | "hashicorp-vault";
+    ownerTeamId: string | null;
+    secretsMount: string;
+    networkRouteId: string;
+    tlsTrustId: string;
+}>;
+export type VaultDescriptor = z.infer<typeof vaultDescriptorSchema>;
+export declare const vaultAllocationSchema: z.ZodObject<{
+    id: z.ZodString;
+    vaultId: z.ZodString;
+    teamId: z.ZodString;
+    grantId: z.ZodNullable<z.ZodString>;
+    pathPrefix: z.ZodEffects<z.ZodString, string, string>;
+    permissions: z.ZodArray<z.ZodEnum<["read", "write", "delete"]>, "many">;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    version: number;
+    teamId: string;
+    grantId: string | null;
+    permissions: ("read" | "write" | "delete")[];
+    vaultId: string;
+    pathPrefix: string;
+}, {
+    id: string;
+    version: number;
+    teamId: string;
+    grantId: string | null;
+    permissions: ("read" | "write" | "delete")[];
+    vaultId: string;
+    pathPrefix: string;
+}>;
+export declare const vaultCredentialReferenceSchema: z.ZodDiscriminatedUnion<"mode", [z.ZodObject<{
+    mode: z.ZodLiteral<"managed">;
+    vaultId: z.ZodString;
+    allocationId: z.ZodString;
+    recordPath: z.ZodEffects<z.ZodString, string, string>;
+}, "strict", z.ZodTypeAny, {
+    mode: "managed";
+    vaultId: string;
+    allocationId: string;
+    recordPath: string;
+}, {
+    mode: "managed";
+    vaultId: string;
+    allocationId: string;
+    recordPath: string;
+}>, z.ZodObject<{
+    mode: z.ZodLiteral<"existing">;
+    vaultId: z.ZodString;
+    allocationId: z.ZodString;
+    recordPath: z.ZodEffects<z.ZodString, string, string>;
+    fieldMapping: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>;
+    pinnedVersion: z.ZodNullable<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    mode: "existing";
+    vaultId: string;
+    allocationId: string;
+    recordPath: string;
+    fieldMapping: Record<string, string>;
+    pinnedVersion: number | null;
+}, {
+    mode: "existing";
+    vaultId: string;
+    allocationId: string;
+    recordPath: string;
+    fieldMapping: Record<string, string>;
+    pinnedVersion: number | null;
+}>]>;
+export type VaultCredentialReference = z.infer<typeof vaultCredentialReferenceSchema>;
+export declare function assertCredentialRecordMutation(reference: VaultCredentialReference): void;