@treeseed/sdk 0.13.0-rc.91 → 0.13.0-rc.92

package/dist/secrets-capability/shared-resources.js

@@ -0,0 +1,91 @@
+import { z } from "zod";
+const id = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u);
+const version = z.number().int().nonnegative().safe();
+const environment = z.enum(["staging", "production", "shared"]);
+const timestamp = z.string().datetime();
+const organizationSchema = z.object({
+  id,
+  name: z.string().trim().min(1).max(160),
+  version
+}).strict();
+const organizationMemberSchema = z.object({
+  organizationId: id,
+  userId: id,
+  role: z.enum(["owner", "admin", "member"]),
+  version
+}).strict();
+const organizationTeamSchema = z.object({
+  teamId: id,
+  organizationId: id.nullable(),
+  version
+}).strict();
+const organizationTeamInvitationSchema = z.object({
+  id,
+  organizationId: id,
+  teamId: id,
+  organizationAuthorizedBy: id,
+  teamAuthorizedBy: id.nullable(),
+  expiresAt: timestamp,
+  status: z.enum(["pending", "accepted", "rejected", "revoked", "expired"]),
+  version
+}).strict();
+const sharedResourceSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("connection"), id, ownerTeamId: id }).strict(),
+  z.object({ kind: z.literal("vault"), id, ownerTeamId: id.nullable() }).strict()
+]);
+const sharedResourceGrantSchema = z.object({
+  id,
+  resource: sharedResourceSchema,
+  recipientTeamId: id,
+  authority: z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("organization"), organizationId: id }).strict(),
+    z.object({ kind: z.literal("deployment"), audiencePolicyId: id }).strict()
+  ]),
+  origin: z.enum(["explicit", "default-policy"]),
+  defaultPolicyId: id.nullable(),
+  permissions: z.array(id).min(1),
+  scope: z.object({
+    environment,
+    resourceIds: z.array(z.string().min(1).max(512)).min(1),
+    projectIds: z.array(id),
+    assignmentIds: z.array(id)
+  }).strict(),
+  limits: z.object({
+    maxConcurrentOperations: z.number().int().positive().safe(),
+    maxOperationsPerWindow: z.number().int().positive().safe(),
+    windowSeconds: z.number().int().positive().safe()
+  }).strict(),
+  status: z.enum(["active", "revoked"]),
+  version,
+  expiresAt: timestamp.nullable()
+}).strict().superRefine((grant, context) => {
+  if (grant.origin === "default-policy" !== (grant.defaultPolicyId !== null))
+    context.addIssue({ code: "custom", path: ["defaultPolicyId"], message: "Default grants require exactly one policy reference." });
+  if (grant.authority.kind === "organization" && grant.resource.ownerTeamId === null)
+    context.addIssue({ code: "custom", path: ["resource", "ownerTeamId"], message: "Organization resources require an owning team." });
+  if (grant.scope.resourceIds.includes("*"))
+    context.addIssue({ code: "custom", path: ["scope", "resourceIds"], message: "Unbounded resource grants are prohibited." });
+});
+const serviceBindingSchema = z.object({
+  id,
+  teamId: id,
+  projectId: id,
+  capability: id,
+  environment,
+  connectionId: id,
+  ownerTeamId: id,
+  grantId: id.nullable(),
+  version
+}).strict().superRefine((binding, context) => {
+  if (binding.teamId !== binding.ownerTeamId && binding.grantId === null)
+    context.addIssue({ code: "custom", path: ["grantId"], message: "Shared bindings require a grant." });
+});
+export {
+  organizationMemberSchema,
+  organizationSchema,
+  organizationTeamInvitationSchema,
+  organizationTeamSchema,
+  serviceBindingSchema,
+  sharedResourceGrantSchema,
+  sharedResourceSchema
+};

package/dist/secrets-capability/vault-contracts.d.ts

@@ -0,0 +1,132 @@
+import { z } from 'zod';
+/** Configuration validation is not DNS/routing authorization; Deployment enforces transport policy. */
+export declare const vaultDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    ownerTeamId: z.ZodNullable<z.ZodString>;
+    displayName: z.ZodString;
+    backend: z.ZodEnum<["managed-openbao", "external-openbao", "hashicorp-vault"]>;
+    endpoint: z.ZodEffects<z.ZodString, string, string>;
+    secretsMount: z.ZodEffects<z.ZodString, string, string>;
+    namespace: z.ZodNullable<z.ZodEffects<z.ZodString, string, string>>;
+    networkRouteId: z.ZodString;
+    tlsTrustId: z.ZodString;
+    authentication: z.ZodObject<{
+        method: z.ZodLiteral<"approle">;
+        mount: z.ZodEffects<z.ZodString, string, string>;
+        roleId: z.ZodString;
+        bootstrapCredentialRef: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        method: "approle";
+        mount: string;
+        roleId: string;
+        bootstrapCredentialRef: string;
+    }, {
+        method: "approle";
+        mount: string;
+        roleId: string;
+        bootstrapCredentialRef: string;
+    }>;
+    status: z.ZodEnum<["unverified", "ready", "unavailable", "revoked"]>;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    status: "revoked" | "ready" | "unavailable" | "unverified";
+    id: string;
+    version: number;
+    authentication: {
+        method: "approle";
+        mount: string;
+        roleId: string;
+        bootstrapCredentialRef: string;
+    };
+    displayName: string;
+    endpoint: string;
+    namespace: string | null;
+    backend: "managed-openbao" | "external-openbao" | "hashicorp-vault";
+    ownerTeamId: string | null;
+    secretsMount: string;
+    networkRouteId: string;
+    tlsTrustId: string;
+}, {
+    status: "revoked" | "ready" | "unavailable" | "unverified";
+    id: string;
+    version: number;
+    authentication: {
+        method: "approle";
+        mount: string;
+        roleId: string;
+        bootstrapCredentialRef: string;
+    };
+    displayName: string;
+    endpoint: string;
+    namespace: string | null;
+    backend: "managed-openbao" | "external-openbao" | "hashicorp-vault";
+    ownerTeamId: string | null;
+    secretsMount: string;
+    networkRouteId: string;
+    tlsTrustId: string;
+}>;
+export type VaultDescriptor = z.infer<typeof vaultDescriptorSchema>;
+export declare const vaultAllocationSchema: z.ZodObject<{
+    id: z.ZodString;
+    vaultId: z.ZodString;
+    teamId: z.ZodString;
+    grantId: z.ZodNullable<z.ZodString>;
+    pathPrefix: z.ZodEffects<z.ZodString, string, string>;
+    permissions: z.ZodArray<z.ZodEnum<["read", "write", "delete"]>, "many">;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    version: number;
+    teamId: string;
+    grantId: string | null;
+    permissions: ("read" | "write" | "delete")[];
+    vaultId: string;
+    pathPrefix: string;
+}, {
+    id: string;
+    version: number;
+    teamId: string;
+    grantId: string | null;
+    permissions: ("read" | "write" | "delete")[];
+    vaultId: string;
+    pathPrefix: string;
+}>;
+export declare const vaultCredentialReferenceSchema: z.ZodDiscriminatedUnion<"mode", [z.ZodObject<{
+    mode: z.ZodLiteral<"managed">;
+    vaultId: z.ZodString;
+    allocationId: z.ZodString;
+    recordPath: z.ZodEffects<z.ZodString, string, string>;
+}, "strict", z.ZodTypeAny, {
+    mode: "managed";
+    vaultId: string;
+    allocationId: string;
+    recordPath: string;
+}, {
+    mode: "managed";
+    vaultId: string;
+    allocationId: string;
+    recordPath: string;
+}>, z.ZodObject<{
+    mode: z.ZodLiteral<"existing">;
+    vaultId: z.ZodString;
+    allocationId: z.ZodString;
+    recordPath: z.ZodEffects<z.ZodString, string, string>;
+    fieldMapping: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>;
+    pinnedVersion: z.ZodNullable<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    mode: "existing";
+    vaultId: string;
+    allocationId: string;
+    recordPath: string;
+    fieldMapping: Record<string, string>;
+    pinnedVersion: number | null;
+}, {
+    mode: "existing";
+    vaultId: string;
+    allocationId: string;
+    recordPath: string;
+    fieldMapping: Record<string, string>;
+    pinnedVersion: number | null;
+}>]>;
+export type VaultCredentialReference = z.infer<typeof vaultCredentialReferenceSchema>;
+export declare function assertCredentialRecordMutation(reference: VaultCredentialReference): void;

package/dist/secrets-capability/vault-contracts.js

@@ -0,0 +1,56 @@
+import { z } from "zod";
+const id = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u);
+const path = z.string().min(1).max(512).refine((value) => value.split("/").every((segment) => /^[A-Za-z0-9][A-Za-z0-9_.-]*$/u.test(segment)), "Canonical relative vault path required.");
+const endpoint = z.string().url().refine((value) => {
+  const url = new URL(value);
+  return url.protocol === "https:" && !url.username && !url.password && !url.search && !url.hash && url.pathname === "/";
+}, "HTTPS origin without credentials, query or fragment required.");
+const vaultDescriptorSchema = z.object({
+  id,
+  ownerTeamId: id.nullable(),
+  displayName: z.string().trim().min(1).max(160),
+  backend: z.enum(["managed-openbao", "external-openbao", "hashicorp-vault"]),
+  endpoint,
+  secretsMount: path,
+  namespace: path.nullable(),
+  networkRouteId: id,
+  tlsTrustId: id,
+  authentication: z.object({
+    method: z.literal("approle"),
+    mount: path,
+    roleId: z.string().min(1).max(256),
+    bootstrapCredentialRef: id
+  }).strict(),
+  status: z.enum(["unverified", "ready", "unavailable", "revoked"]),
+  version: z.number().int().nonnegative().safe()
+}).strict();
+const vaultAllocationSchema = z.object({
+  id,
+  vaultId: id,
+  teamId: id,
+  grantId: id.nullable(),
+  pathPrefix: path,
+  permissions: z.array(z.enum(["read", "write", "delete"])).min(1),
+  version: z.number().int().nonnegative().safe()
+}).strict();
+const vaultCredentialReferenceSchema = z.discriminatedUnion("mode", [
+  z.object({ mode: z.literal("managed"), vaultId: id, allocationId: id, recordPath: path }).strict(),
+  z.object({
+    mode: z.literal("existing"),
+    vaultId: id,
+    allocationId: id,
+    recordPath: path,
+    fieldMapping: z.record(id, id).refine((value) => Object.keys(value).length > 0, "At least one field mapping is required."),
+    pinnedVersion: z.number().int().positive().safe().nullable()
+  }).strict()
+]);
+function assertCredentialRecordMutation(reference) {
+  vaultCredentialReferenceSchema.parse(reference);
+  if (reference.mode === "existing") throw new Error("existing_secret_read_only");
+}
+export {
+  assertCredentialRecordMutation,
+  vaultAllocationSchema,
+  vaultCredentialReferenceSchema,
+  vaultDescriptorSchema
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.91",
+  "version": "0.13.0-rc.92",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {