@treeseed/sdk 0.13.0-rc.91 → 0.13.0-rc.92

package/dist/secrets-capability/service-provider-contracts.js

@@ -1,9 +1,7 @@
-const SERVICE_PROVIDER_IDS = ["github", "cloudflare", "railway"];
+const SERVICE_PROVIDER_IDS = ["github", "cloudflare", "railway", "hyperstack"];
 const SERVICE_CAPABILITY_TYPES = [
   "repository-hosting",
   "workflow-execution",
-  "workflow-configuration",
-  "secret-enclave",
   "frontend-hosting",
   "backend-hosting",
   "dns-management",
@@ -12,7 +10,9 @@ const SERVICE_CAPABILITY_TYPES = [
   "database-hosting",
   "capacity-runtime-hosting",
   "private-knowledge-index-hosting",
-  "artifact-hosting"
+  "artifact-hosting",
+  "ai-inference-hosting",
+  "ai-training-hosting"
 ];
 const SERVICE_CONNECTION_STATUSES = [
   "draft",
@@ -49,9 +49,7 @@ const SERVICE_PROVIDER_CATALOG = [
     ],
     capabilities: [
       { type: "repository-hosting", label: "Repository hosting", description: "Own source and knowledge repositories.", credentialProfileIds: ["github-repository-app", "github-repository-token"], status: "available" },
-      { type: "workflow-execution", label: "Workflow execution", description: "Run allowlisted GitHub Actions workflows.", credentialProfileIds: ["github-workflow-app", "github-workflow-token"], status: "available" },
-      { type: "workflow-configuration", label: "Workflow configuration", description: "Manage the scoped variables required by allowlisted workflows.", credentialProfileIds: ["github-workflow-app", "github-workflow-token"], status: "available" },
-      { type: "secret-enclave", label: "Actions secret enclave", description: "Write GitHub-encrypted values to Actions without making them readable by TreeSeed.", credentialProfileIds: ["github-workflow-app", "github-workflow-token"], status: "available" }
+      { type: "workflow-execution", label: "Run workflows", description: "Run project workflows and supply their declared configuration securely. Vault credentials remain authoritative; provider secrets are delivery destinations.", credentialProfileIds: ["github-workflow-app", "github-workflow-token"], status: "available" }
     ],
     credentialProfiles: [
       {
@@ -81,10 +79,10 @@ const SERVICE_PROVIDER_CATALOG = [
       {
         id: "github-workflow-app",
         label: "Workflow Connector App",
-        description: "Installation authority for dispatch, run observation, and separately enabled secret and variable configuration.",
-        capabilities: ["workflow-execution", "workflow-configuration", "secret-enclave"],
+        description: "Installation authority for workflow execution and explicitly declared configuration delivery.",
+        capabilities: ["workflow-execution"],
         fields: [],
-        permissions: ["Metadata: read", "Contents: read", "Actions: read and write", "Secrets: read and write", "Variables: read and write"],
+        permissions: ["Metadata: read", "Contents: read", "Actions: read and write", "Only when declared: Secrets write and/or Variables write"],
         sharing: "capability-scoped",
         unattendedCompatible: true,
         authoritySchemes: ["app-installation"],
@@ -93,10 +91,10 @@ const SERVICE_PROVIDER_CATALOG = [
       {
         id: "github-workflow-token",
         label: "Workflow token authority",
-        description: "Fine-grained token authority for Actions and explicitly enabled secret or variable scopes.",
-        capabilities: ["workflow-execution", "workflow-configuration", "secret-enclave"],
+        description: "Fine-grained token authority for workflow execution and explicitly declared configuration delivery.",
+        capabilities: ["workflow-execution"],
         fields: [field("accessToken", "Fine-grained token", "Stored in core OpenBao; used only by authorized operations.", true, true)],
-        permissions: ["Metadata: read", "Contents: read", "Actions: read and write", "Secrets: read and write", "Variables: read and write"],
+        permissions: ["Metadata: read", "Contents: read", "Actions: read and write", "Only when declared: Secrets write and/or Variables write"],
         sharing: "capability-scoped",
         unattendedCompatible: true,
         authoritySchemes: ["openbao"],
@@ -112,26 +110,18 @@ const SERVICE_PROVIDER_CATALOG = [
     description: "Connect a Cloudflare account with separately scoped capability tokens.",
     knowledgePageIds: ["provider.cloudflare"],
     connectionFields: [
-      field("deploymentEnvironment", "Deployment environment", "The exact TreeSeed deployment environment. Use staging or production; one connection must never span both."),
       field("accountId", "Account ID", "The non-secret Cloudflare account identifier."),
-      field("zoneId", "Zone ID", "Optional non-secret zone identifier used by reviewed DNS and TLS topology resources.", false),
-      field("stateBucket", "OpenTofu state bucket", "Optional R2 bucket name used only by a state-backend connection.", false),
-      field("stateEndpoint", "OpenTofu state endpoint", "Optional HTTPS S3-compatible R2 endpoint used only by a state-backend connection.", false),
-      field("stateRegion", "OpenTofu state region", "Optional S3-compatible region; omit to use auto.", false),
-      field("stateEncryptionKeyRef", "State encryption key reference", "Optional non-secret team-vault key name used to encrypt this backend state.", false)
+      { ...field("domain", "Domain", "Enter the domain listed in Cloudflare (for example, example.com), without https:// or a path. TreeSeed verifies its zone when you check the DNS account access.", false), requiredForCapabilities: ["dns-management"], placeholder: "example.com", pattern: "(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?\\.)+[a-zA-Z](?:[a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?" }
     ],
     capabilities: [
       { type: "frontend-hosting", label: "Frontend hosting", description: "Pages and Workers application hosting.", credentialProfileIds: ["cloudflare-runtime"], status: "available" },
       { type: "dns-management", label: "DNS management", description: "Scoped DNS record management.", credentialProfileIds: ["cloudflare-dns"], status: "available" },
-      { type: "object-storage", label: "Object storage", description: "R2-backed immutable publication, private artifact storage, and scoped S3 state access.", credentialProfileIds: ["cloudflare-storage", "s3-state-session"], status: "available" },
-      { type: "state-encryption", label: "State encryption", description: "Independent encryption authority for OpenTofu state and plan files.", credentialProfileIds: ["opentofu-state-encryption"], status: "available" }
+      { type: "object-storage", label: "Object storage", description: "R2-backed immutable publication and private artifact storage.", credentialProfileIds: ["cloudflare-storage"], status: "available" }
     ],
     credentialProfiles: [
       { id: "cloudflare-runtime", label: "Pages and Workers token", description: "A token limited to application deployment resources.", capabilities: ["frontend-hosting"], fields: [field("apiToken", "API token", "Stored in core OpenBao and used only by authorized operations.", true, true)], permissions: ["Account: Workers Scripts Edit", "Account: Pages Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["openbao"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
-      { id: "cloudflare-dns", label: "DNS token", description: "A token restricted to selected zones.", capabilities: ["dns-management"], fields: [field("apiToken", "DNS API token", "Encrypted separately from deployment authority.", true, true)], permissions: ["Zone: DNS Edit for only the managed zones"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["openbao"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
-      { id: "cloudflare-storage", label: "Storage management authority", description: "Vault-custodied token used only to reconcile authorized R2 resources.", capabilities: ["object-storage"], fields: [field("apiToken", "Storage API token", "Encrypted separately and used only to reconcile authorized R2 resources.", true, true)], permissions: ["Account: Workers R2 Storage Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["openbao"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
-      { id: "s3-state-session", label: "OpenTofu state session", description: "S3-compatible credentials limited to the selected team state prefix.", capabilities: ["object-storage"], fields: [field("accessKeyId", "R2 access key ID", "Vault-custodied S3-compatible access key identifier for encrypted OpenTofu state.", true, true), field("secretAccessKey", "R2 secret access key", "Vault-custodied S3-compatible secret key for encrypted OpenTofu state.", true, true), field("sessionToken", "R2 session token", "Optional short-lived S3-compatible session token.", false, true)], permissions: ["Object read and write for only the managed team state prefix"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["openbao"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
-      { id: "opentofu-state-encryption", label: "OpenTofu state encryption", description: "Independent encryption material that is never stored with the R2 state object.", capabilities: ["state-encryption"], fields: [field("stateEncryptionKey", "OpenTofu state encryption key", "A 32-byte hexadecimal key stored separately in core OpenBao.", true, true)], permissions: ["Encrypt and decrypt only the selected team OpenTofu state"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["openbao"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] }
+      { id: "cloudflare-dns", label: "DNS token", description: "A token restricted to the domain you entered. Zone Read lets TreeSeed find its zone; DNS Edit lets it manage records.", capabilities: ["dns-management"], fields: [field("apiToken", "DNS API token", "Encrypted separately from deployment authority.", true, true)], permissions: ["Zone: Zone Read for the managed domain", "Zone: DNS Edit for the managed domain"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["openbao"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
+      { id: "cloudflare-storage", label: "Storage management authority", description: "Vault-custodied token used only to reconcile authorized R2 resources.", capabilities: ["object-storage"], fields: [field("apiToken", "Storage API token", "Encrypted separately and used only to reconcile authorized R2 resources.", true, true)], permissions: ["Account: Workers R2 Storage Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["openbao"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] }
     ]
   },
   {
@@ -150,14 +140,13 @@ const SERVICE_PROVIDER_CATALOG = [
     capabilities: [
       { type: "backend-hosting", label: "Backend hosting", description: "API and backend service hosting.", credentialProfileIds: ["railway-workspace"], status: "available" },
       { type: "database-hosting", label: "Database hosting", description: "Managed database placement.", credentialProfileIds: ["railway-workspace"], status: "available" },
-      { type: "capacity-runtime-hosting", label: "Capacity runtime hosting", description: "Future capacity provider placement.", credentialProfileIds: ["railway-workspace"], status: "planned" },
       { type: "private-knowledge-index-hosting", label: "Private knowledge hosting", description: "Private TreeDX knowledge-plane placement.", credentialProfileIds: ["railway-workspace"], status: "available" }
     ],
     credentialProfiles: [{
       id: "railway-workspace",
       label: "Railway workspace token",
       description: "Railway currently exposes broad workspace authority. Sharing it increases the blast radius across enabled capabilities.",
-      capabilities: ["backend-hosting", "database-hosting", "capacity-runtime-hosting", "private-knowledge-index-hosting"],
+      capabilities: ["backend-hosting", "database-hosting", "private-knowledge-index-hosting"],
       fields: [field("apiToken", "Workspace token", "Stored in core OpenBao and used only by authorized operations.", true, true)],
       permissions: ["Workspace access required by the selected operations"],
       sharing: "provider-shared",
@@ -165,6 +154,31 @@ const SERVICE_PROVIDER_CATALOG = [
       authoritySchemes: ["openbao"],
       knowledgePageIds: ["provider.railway", "services.credentials", "vault.rotation"]
     }]
+  },
+  {
+    id: "hyperstack",
+    label: "Hyperstack",
+    logoKey: "hyperstack",
+    documentationUrl: "https://docs.hyperstack.cloud/docs/api-reference/quickstart/",
+    description: "Host TreeAI inference and training on rented GPUs. This is AI hosting, not capacity-provider hosting.",
+    knowledgePageIds: ["provider.hyperstack"],
+    connectionFields: [],
+    capabilities: [
+      { type: "ai-inference-hosting", label: "Provide AI service", description: "Host the TreeAI vLLM inference engine on a rented GPU.", credentialProfileIds: ["hyperstack-runtime"], status: "available" },
+      { type: "ai-training-hosting", label: "Run training", description: "Host the TreeAI Axolotl training engine, independently or alongside inference with managed GPU admission.", credentialProfileIds: ["hyperstack-runtime"], status: "available" }
+    ],
+    credentialProfiles: [{
+      id: "hyperstack-runtime",
+      label: "Hyperstack API key",
+      description: "Authorize GPU hosting. Saving this key does not rent a machine. Deployments select hardware, schedules and storage separately.",
+      capabilities: ["ai-inference-hosting", "ai-training-hosting"],
+      fields: [field("apiToken", "API key", "Stored in your team vault and used only for authorized hosting operations.", true, true)],
+      permissions: ["Read environments for account verification", "Manage virtual machines and attached resources for deployment"],
+      sharing: "provider-shared",
+      unattendedCompatible: true,
+      authoritySchemes: ["openbao"],
+      knowledgePageIds: ["provider.hyperstack", "services.credentials", "vault.rotation"]
+    }]
   }
 ];
 function getServiceProviderDefinition(providerId) {

package/dist/secrets-capability/shared-access.d.ts

@@ -0,0 +1,51 @@
+import { type SharedResourceGrant, type ServiceBinding } from './shared-resources.js';
+export interface SharedAccessRequest {
+    resourceKind: 'connection' | 'vault';
+    resourceId: string;
+    ownerTeamId: string | null;
+    teamId: string;
+    permission: string;
+    environment: 'staging' | 'production' | 'shared';
+    resourceIdWithinProvider: string;
+    projectId?: string;
+    assignmentId?: string;
+}
+export interface CurrentSharingAuthority {
+    actorCanUse: boolean;
+    ownerOrganizationId: string | null;
+    recipientOrganizationId: string | null;
+    deploymentAudiencePolicyId: string | null;
+}
+/** Pure policy check only. API supplies fresh trusted authority and atomically reserves quota before execution. */
+export declare function authorizeSharedGrant(input: SharedResourceGrant, request: SharedAccessRequest, authority: CurrentSharingAuthority, now: Date): {
+    grantId: string;
+    grantVersion: number;
+    limits: {
+        maxConcurrentOperations: number;
+        maxOperationsPerWindow: number;
+        windowSeconds: number;
+    };
+};
+export interface BindingSelection {
+    teamId: string;
+    projectId: string;
+    capability: string;
+    environment: ServiceBinding['environment'];
+}
+/** Once bound, never consult a lower-priority default. Eligibility is evaluated by the API after selection. */
+export declare function selectServiceBinding(request: BindingSelection, pinned: ServiceBinding | null, defaults: {
+    explicit: ServiceBinding[];
+    team: ServiceBinding[];
+    organization: ServiceBinding[];
+    deployment: ServiceBinding[];
+}): {
+    id: string;
+    version: number;
+    projectId: string;
+    teamId: string;
+    environment: "production" | "staging" | "shared";
+    capability: string;
+    connectionId: string;
+    grantId: string | null;
+    ownerTeamId: string;
+};

package/dist/secrets-capability/shared-access.js

@@ -0,0 +1,36 @@
+import { sharedResourceGrantSchema, serviceBindingSchema } from "./shared-resources.js";
+function authorizeSharedGrant(input, request, authority, now) {
+  const grant = sharedResourceGrantSchema.parse(input);
+  const deny = (reason) => {
+    throw new Error(reason);
+  };
+  if (!Number.isFinite(now.getTime())) deny("invalid_authorization_time");
+  if (!authority.actorCanUse) deny("actor_not_authorized");
+  if (grant.status !== "active" || grant.expiresAt && Date.parse(grant.expiresAt) <= now.getTime()) deny("grant_inactive");
+  if (grant.recipientTeamId !== request.teamId || grant.resource.kind !== request.resourceKind || grant.resource.id !== request.resourceId || grant.resource.ownerTeamId !== request.ownerTeamId) deny("grant_resource_mismatch");
+  if (grant.authority.kind === "organization") {
+    if (authority.ownerOrganizationId !== grant.authority.organizationId || authority.recipientOrganizationId !== grant.authority.organizationId) deny("organization_membership_required");
+  } else if (authority.deploymentAudiencePolicyId !== grant.authority.audiencePolicyId) deny("deployment_audience_required");
+  if (!grant.permissions.includes(request.permission) || grant.scope.environment !== request.environment || !grant.scope.resourceIds.includes(request.resourceIdWithinProvider)) deny("grant_scope_mismatch");
+  if (grant.scope.projectIds.length && (!request.projectId || !grant.scope.projectIds.includes(request.projectId))) deny("project_scope_mismatch");
+  if (grant.scope.assignmentIds.length && (!request.assignmentId || !grant.scope.assignmentIds.includes(request.assignmentId))) deny("assignment_scope_mismatch");
+  return { grantId: grant.id, grantVersion: grant.version, limits: { ...grant.limits } };
+}
+function selectServiceBinding(request, pinned, defaults) {
+  const matches = (value) => value.teamId === request.teamId && value.projectId === request.projectId && value.capability === request.capability && value.environment === request.environment;
+  if (pinned) {
+    const binding = serviceBindingSchema.parse(pinned);
+    if (!matches(binding)) throw new Error("binding_scope_mismatch");
+    return binding;
+  }
+  for (const tier of ["explicit", "team", "organization", "deployment"]) {
+    const candidates = defaults[tier].map((value) => serviceBindingSchema.parse(value)).filter(matches);
+    if (candidates.length > 1) throw new Error("ambiguous_service_default");
+    if (candidates[0]) return candidates[0];
+  }
+  throw new Error("service_binding_unavailable");
+}
+export {
+  authorizeSharedGrant,
+  selectServiceBinding
+};

package/dist/secrets-capability/shared-resources.d.ts

@@ -0,0 +1,376 @@
+import { z } from 'zod';
+export declare const organizationSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    version: number;
+    name: string;
+}, {
+    id: string;
+    version: number;
+    name: string;
+}>;
+export declare const organizationMemberSchema: z.ZodObject<{
+    organizationId: z.ZodString;
+    userId: z.ZodString;
+    role: z.ZodEnum<["owner", "admin", "member"]>;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    role: "owner" | "admin" | "member";
+    version: number;
+    organizationId: string;
+    userId: string;
+}, {
+    role: "owner" | "admin" | "member";
+    version: number;
+    organizationId: string;
+    userId: string;
+}>;
+export declare const organizationTeamSchema: z.ZodObject<{
+    teamId: z.ZodString;
+    organizationId: z.ZodNullable<z.ZodString>;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    version: number;
+    teamId: string;
+    organizationId: string | null;
+}, {
+    version: number;
+    teamId: string;
+    organizationId: string | null;
+}>;
+export declare const organizationTeamInvitationSchema: z.ZodObject<{
+    id: z.ZodString;
+    organizationId: z.ZodString;
+    teamId: z.ZodString;
+    organizationAuthorizedBy: z.ZodString;
+    teamAuthorizedBy: z.ZodNullable<z.ZodString>;
+    expiresAt: z.ZodString;
+    status: z.ZodEnum<["pending", "accepted", "rejected", "revoked", "expired"]>;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    status: "rejected" | "revoked" | "expired" | "pending" | "accepted";
+    id: string;
+    version: number;
+    teamId: string;
+    expiresAt: string;
+    organizationId: string;
+    organizationAuthorizedBy: string;
+    teamAuthorizedBy: string | null;
+}, {
+    status: "rejected" | "revoked" | "expired" | "pending" | "accepted";
+    id: string;
+    version: number;
+    teamId: string;
+    expiresAt: string;
+    organizationId: string;
+    organizationAuthorizedBy: string;
+    teamAuthorizedBy: string | null;
+}>;
+export declare const sharedResourceSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+    kind: z.ZodLiteral<"connection">;
+    id: z.ZodString;
+    ownerTeamId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    kind: "connection";
+    id: string;
+    ownerTeamId: string;
+}, {
+    kind: "connection";
+    id: string;
+    ownerTeamId: string;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"vault">;
+    id: z.ZodString;
+    ownerTeamId: z.ZodNullable<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    kind: "vault";
+    id: string;
+    ownerTeamId: string | null;
+}, {
+    kind: "vault";
+    id: string;
+    ownerTeamId: string | null;
+}>]>;
+export declare const sharedResourceGrantSchema: z.ZodEffects<z.ZodObject<{
+    id: z.ZodString;
+    resource: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"connection">;
+        id: z.ZodString;
+        ownerTeamId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "connection";
+        id: string;
+        ownerTeamId: string;
+    }, {
+        kind: "connection";
+        id: string;
+        ownerTeamId: string;
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"vault">;
+        id: z.ZodString;
+        ownerTeamId: z.ZodNullable<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        kind: "vault";
+        id: string;
+        ownerTeamId: string | null;
+    }, {
+        kind: "vault";
+        id: string;
+        ownerTeamId: string | null;
+    }>]>;
+    recipientTeamId: z.ZodString;
+    authority: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"organization">;
+        organizationId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "organization";
+        organizationId: string;
+    }, {
+        kind: "organization";
+        organizationId: string;
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"deployment">;
+        audiencePolicyId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "deployment";
+        audiencePolicyId: string;
+    }, {
+        kind: "deployment";
+        audiencePolicyId: string;
+    }>]>;
+    origin: z.ZodEnum<["explicit", "default-policy"]>;
+    defaultPolicyId: z.ZodNullable<z.ZodString>;
+    permissions: z.ZodArray<z.ZodString, "many">;
+    scope: z.ZodObject<{
+        environment: z.ZodEnum<["staging", "production", "shared"]>;
+        resourceIds: z.ZodArray<z.ZodString, "many">;
+        projectIds: z.ZodArray<z.ZodString, "many">;
+        assignmentIds: z.ZodArray<z.ZodString, "many">;
+    }, "strict", z.ZodTypeAny, {
+        environment: "production" | "staging" | "shared";
+        projectIds: string[];
+        resourceIds: string[];
+        assignmentIds: string[];
+    }, {
+        environment: "production" | "staging" | "shared";
+        projectIds: string[];
+        resourceIds: string[];
+        assignmentIds: string[];
+    }>;
+    limits: z.ZodObject<{
+        maxConcurrentOperations: z.ZodNumber;
+        maxOperationsPerWindow: z.ZodNumber;
+        windowSeconds: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        maxConcurrentOperations: number;
+        maxOperationsPerWindow: number;
+        windowSeconds: number;
+    }, {
+        maxConcurrentOperations: number;
+        maxOperationsPerWindow: number;
+        windowSeconds: number;
+    }>;
+    status: z.ZodEnum<["active", "revoked"]>;
+    version: z.ZodNumber;
+    expiresAt: z.ZodNullable<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    status: "revoked" | "active";
+    id: string;
+    version: number;
+    scope: {
+        environment: "production" | "staging" | "shared";
+        projectIds: string[];
+        resourceIds: string[];
+        assignmentIds: string[];
+    };
+    expiresAt: string | null;
+    origin: "explicit" | "default-policy";
+    resource: {
+        kind: "connection";
+        id: string;
+        ownerTeamId: string;
+    } | {
+        kind: "vault";
+        id: string;
+        ownerTeamId: string | null;
+    };
+    authority: {
+        kind: "organization";
+        organizationId: string;
+    } | {
+        kind: "deployment";
+        audiencePolicyId: string;
+    };
+    limits: {
+        maxConcurrentOperations: number;
+        maxOperationsPerWindow: number;
+        windowSeconds: number;
+    };
+    permissions: string[];
+    recipientTeamId: string;
+    defaultPolicyId: string | null;
+}, {
+    status: "revoked" | "active";
+    id: string;
+    version: number;
+    scope: {
+        environment: "production" | "staging" | "shared";
+        projectIds: string[];
+        resourceIds: string[];
+        assignmentIds: string[];
+    };
+    expiresAt: string | null;
+    origin: "explicit" | "default-policy";
+    resource: {
+        kind: "connection";
+        id: string;
+        ownerTeamId: string;
+    } | {
+        kind: "vault";
+        id: string;
+        ownerTeamId: string | null;
+    };
+    authority: {
+        kind: "organization";
+        organizationId: string;
+    } | {
+        kind: "deployment";
+        audiencePolicyId: string;
+    };
+    limits: {
+        maxConcurrentOperations: number;
+        maxOperationsPerWindow: number;
+        windowSeconds: number;
+    };
+    permissions: string[];
+    recipientTeamId: string;
+    defaultPolicyId: string | null;
+}>, {
+    status: "revoked" | "active";
+    id: string;
+    version: number;
+    scope: {
+        environment: "production" | "staging" | "shared";
+        projectIds: string[];
+        resourceIds: string[];
+        assignmentIds: string[];
+    };
+    expiresAt: string | null;
+    origin: "explicit" | "default-policy";
+    resource: {
+        kind: "connection";
+        id: string;
+        ownerTeamId: string;
+    } | {
+        kind: "vault";
+        id: string;
+        ownerTeamId: string | null;
+    };
+    authority: {
+        kind: "organization";
+        organizationId: string;
+    } | {
+        kind: "deployment";
+        audiencePolicyId: string;
+    };
+    limits: {
+        maxConcurrentOperations: number;
+        maxOperationsPerWindow: number;
+        windowSeconds: number;
+    };
+    permissions: string[];
+    recipientTeamId: string;
+    defaultPolicyId: string | null;
+}, {
+    status: "revoked" | "active";
+    id: string;
+    version: number;
+    scope: {
+        environment: "production" | "staging" | "shared";
+        projectIds: string[];
+        resourceIds: string[];
+        assignmentIds: string[];
+    };
+    expiresAt: string | null;
+    origin: "explicit" | "default-policy";
+    resource: {
+        kind: "connection";
+        id: string;
+        ownerTeamId: string;
+    } | {
+        kind: "vault";
+        id: string;
+        ownerTeamId: string | null;
+    };
+    authority: {
+        kind: "organization";
+        organizationId: string;
+    } | {
+        kind: "deployment";
+        audiencePolicyId: string;
+    };
+    limits: {
+        maxConcurrentOperations: number;
+        maxOperationsPerWindow: number;
+        windowSeconds: number;
+    };
+    permissions: string[];
+    recipientTeamId: string;
+    defaultPolicyId: string | null;
+}>;
+export type SharedResourceGrant = z.infer<typeof sharedResourceGrantSchema>;
+export declare const serviceBindingSchema: z.ZodEffects<z.ZodObject<{
+    id: z.ZodString;
+    teamId: z.ZodString;
+    projectId: z.ZodString;
+    capability: z.ZodString;
+    environment: z.ZodEnum<["staging", "production", "shared"]>;
+    connectionId: z.ZodString;
+    ownerTeamId: z.ZodString;
+    grantId: z.ZodNullable<z.ZodString>;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    version: number;
+    projectId: string;
+    teamId: string;
+    environment: "production" | "staging" | "shared";
+    capability: string;
+    connectionId: string;
+    grantId: string | null;
+    ownerTeamId: string;
+}, {
+    id: string;
+    version: number;
+    projectId: string;
+    teamId: string;
+    environment: "production" | "staging" | "shared";
+    capability: string;
+    connectionId: string;
+    grantId: string | null;
+    ownerTeamId: string;
+}>, {
+    id: string;
+    version: number;
+    projectId: string;
+    teamId: string;
+    environment: "production" | "staging" | "shared";
+    capability: string;
+    connectionId: string;
+    grantId: string | null;
+    ownerTeamId: string;
+}, {
+    id: string;
+    version: number;
+    projectId: string;
+    teamId: string;
+    environment: "production" | "staging" | "shared";
+    capability: string;
+    connectionId: string;
+    grantId: string | null;
+    ownerTeamId: string;
+}>;
+export type ServiceBinding = z.infer<typeof serviceBindingSchema>;