@treeseed/sdk 0.13.0-rc.91 → 0.13.0-rc.93

package/dist/secrets-capability/shared-resources.js

@@ -0,0 +1,91 @@
+import { z } from "zod";
+const id = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u);
+const version = z.number().int().nonnegative().safe();
+const environment = z.enum(["staging", "production", "shared"]);
+const timestamp = z.string().datetime();
+const organizationSchema = z.object({
+  id,
+  name: z.string().trim().min(1).max(160),
+  version
+}).strict();
+const organizationMemberSchema = z.object({
+  organizationId: id,
+  userId: id,
+  role: z.enum(["owner", "admin", "member"]),
+  version
+}).strict();
+const organizationTeamSchema = z.object({
+  teamId: id,
+  organizationId: id.nullable(),
+  version
+}).strict();
+const organizationTeamInvitationSchema = z.object({
+  id,
+  organizationId: id,
+  teamId: id,
+  organizationAuthorizedBy: id,
+  teamAuthorizedBy: id.nullable(),
+  expiresAt: timestamp,
+  status: z.enum(["pending", "accepted", "rejected", "revoked", "expired"]),
+  version
+}).strict();
+const sharedResourceSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("connection"), id, ownerTeamId: id }).strict(),
+  z.object({ kind: z.literal("vault"), id, ownerTeamId: id.nullable() }).strict()
+]);
+const sharedResourceGrantSchema = z.object({
+  id,
+  resource: sharedResourceSchema,
+  recipientTeamId: id,
+  authority: z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("organization"), organizationId: id }).strict(),
+    z.object({ kind: z.literal("deployment"), audiencePolicyId: id }).strict()
+  ]),
+  origin: z.enum(["explicit", "default-policy"]),
+  defaultPolicyId: id.nullable(),
+  permissions: z.array(id).min(1),
+  scope: z.object({
+    environment,
+    resourceIds: z.array(z.string().min(1).max(512)).min(1),
+    projectIds: z.array(id),
+    assignmentIds: z.array(id)
+  }).strict(),
+  limits: z.object({
+    maxConcurrentOperations: z.number().int().positive().safe(),
+    maxOperationsPerWindow: z.number().int().positive().safe(),
+    windowSeconds: z.number().int().positive().safe()
+  }).strict(),
+  status: z.enum(["active", "revoked"]),
+  version,
+  expiresAt: timestamp.nullable()
+}).strict().superRefine((grant, context) => {
+  if (grant.origin === "default-policy" !== (grant.defaultPolicyId !== null))
+    context.addIssue({ code: "custom", path: ["defaultPolicyId"], message: "Default grants require exactly one policy reference." });
+  if (grant.authority.kind === "organization" && grant.resource.ownerTeamId === null)
+    context.addIssue({ code: "custom", path: ["resource", "ownerTeamId"], message: "Organization resources require an owning team." });
+  if (grant.scope.resourceIds.includes("*"))
+    context.addIssue({ code: "custom", path: ["scope", "resourceIds"], message: "Unbounded resource grants are prohibited." });
+});
+const serviceBindingSchema = z.object({
+  id,
+  teamId: id,
+  projectId: id,
+  capability: id,
+  environment,
+  connectionId: id,
+  ownerTeamId: id,
+  grantId: id.nullable(),
+  version
+}).strict().superRefine((binding, context) => {
+  if (binding.teamId !== binding.ownerTeamId && binding.grantId === null)
+    context.addIssue({ code: "custom", path: ["grantId"], message: "Shared bindings require a grant." });
+});
+export {
+  organizationMemberSchema,
+  organizationSchema,
+  organizationTeamInvitationSchema,
+  organizationTeamSchema,
+  serviceBindingSchema,
+  sharedResourceGrantSchema,
+  sharedResourceSchema
+};

package/dist/secrets-capability/vault-contracts.d.ts

@@ -0,0 +1,132 @@
+import { z } from 'zod';
+/** Configuration validation is not DNS/routing authorization; Deployment enforces transport policy. */
+export declare const vaultDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    ownerTeamId: z.ZodNullable<z.ZodString>;
+    displayName: z.ZodString;
+    backend: z.ZodEnum<["managed-openbao", "external-openbao", "hashicorp-vault"]>;
+    endpoint: z.ZodEffects<z.ZodString, string, string>;
+    secretsMount: z.ZodEffects<z.ZodString, string, string>;
+    namespace: z.ZodNullable<z.ZodEffects<z.ZodString, string, string>>;
+    networkRouteId: z.ZodString;
+    tlsTrustId: z.ZodString;
+    authentication: z.ZodObject<{
+        method: z.ZodLiteral<"approle">;
+        mount: z.ZodEffects<z.ZodString, string, string>;
+        roleId: z.ZodString;
+        bootstrapCredentialRef: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        method: "approle";
+        mount: string;
+        roleId: string;
+        bootstrapCredentialRef: string;
+    }, {
+        method: "approle";
+        mount: string;
+        roleId: string;
+        bootstrapCredentialRef: string;
+    }>;
+    status: z.ZodEnum<["unverified", "ready", "unavailable", "revoked"]>;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    status: "revoked" | "ready" | "unavailable" | "unverified";
+    id: string;
+    version: number;
+    authentication: {
+        method: "approle";
+        mount: string;
+        roleId: string;
+        bootstrapCredentialRef: string;
+    };
+    displayName: string;
+    endpoint: string;
+    namespace: string | null;
+    backend: "managed-openbao" | "external-openbao" | "hashicorp-vault";
+    ownerTeamId: string | null;
+    secretsMount: string;
+    networkRouteId: string;
+    tlsTrustId: string;
+}, {
+    status: "revoked" | "ready" | "unavailable" | "unverified";
+    id: string;
+    version: number;
+    authentication: {
+        method: "approle";
+        mount: string;
+        roleId: string;
+        bootstrapCredentialRef: string;
+    };
+    displayName: string;
+    endpoint: string;
+    namespace: string | null;
+    backend: "managed-openbao" | "external-openbao" | "hashicorp-vault";
+    ownerTeamId: string | null;
+    secretsMount: string;
+    networkRouteId: string;
+    tlsTrustId: string;
+}>;
+export type VaultDescriptor = z.infer<typeof vaultDescriptorSchema>;
+export declare const vaultAllocationSchema: z.ZodObject<{
+    id: z.ZodString;
+    vaultId: z.ZodString;
+    teamId: z.ZodString;
+    grantId: z.ZodNullable<z.ZodString>;
+    pathPrefix: z.ZodEffects<z.ZodString, string, string>;
+    permissions: z.ZodArray<z.ZodEnum<["read", "write", "delete"]>, "many">;
+    version: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    version: number;
+    teamId: string;
+    grantId: string | null;
+    permissions: ("read" | "write" | "delete")[];
+    vaultId: string;
+    pathPrefix: string;
+}, {
+    id: string;
+    version: number;
+    teamId: string;
+    grantId: string | null;
+    permissions: ("read" | "write" | "delete")[];
+    vaultId: string;
+    pathPrefix: string;
+}>;
+export declare const vaultCredentialReferenceSchema: z.ZodDiscriminatedUnion<"mode", [z.ZodObject<{
+    mode: z.ZodLiteral<"managed">;
+    vaultId: z.ZodString;
+    allocationId: z.ZodString;
+    recordPath: z.ZodEffects<z.ZodString, string, string>;
+}, "strict", z.ZodTypeAny, {
+    mode: "managed";
+    vaultId: string;
+    allocationId: string;
+    recordPath: string;
+}, {
+    mode: "managed";
+    vaultId: string;
+    allocationId: string;
+    recordPath: string;
+}>, z.ZodObject<{
+    mode: z.ZodLiteral<"existing">;
+    vaultId: z.ZodString;
+    allocationId: z.ZodString;
+    recordPath: z.ZodEffects<z.ZodString, string, string>;
+    fieldMapping: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodString>, Record<string, string>, Record<string, string>>;
+    pinnedVersion: z.ZodNullable<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    mode: "existing";
+    vaultId: string;
+    allocationId: string;
+    recordPath: string;
+    fieldMapping: Record<string, string>;
+    pinnedVersion: number | null;
+}, {
+    mode: "existing";
+    vaultId: string;
+    allocationId: string;
+    recordPath: string;
+    fieldMapping: Record<string, string>;
+    pinnedVersion: number | null;
+}>]>;
+export type VaultCredentialReference = z.infer<typeof vaultCredentialReferenceSchema>;
+export declare function assertCredentialRecordMutation(reference: VaultCredentialReference): void;

package/dist/secrets-capability/vault-contracts.js

@@ -0,0 +1,56 @@
+import { z } from "zod";
+const id = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u);
+const path = z.string().min(1).max(512).refine((value) => value.split("/").every((segment) => /^[A-Za-z0-9][A-Za-z0-9_.-]*$/u.test(segment)), "Canonical relative vault path required.");
+const endpoint = z.string().url().refine((value) => {
+  const url = new URL(value);
+  return url.protocol === "https:" && !url.username && !url.password && !url.search && !url.hash && url.pathname === "/";
+}, "HTTPS origin without credentials, query or fragment required.");
+const vaultDescriptorSchema = z.object({
+  id,
+  ownerTeamId: id.nullable(),
+  displayName: z.string().trim().min(1).max(160),
+  backend: z.enum(["managed-openbao", "external-openbao", "hashicorp-vault"]),
+  endpoint,
+  secretsMount: path,
+  namespace: path.nullable(),
+  networkRouteId: id,
+  tlsTrustId: id,
+  authentication: z.object({
+    method: z.literal("approle"),
+    mount: path,
+    roleId: z.string().min(1).max(256),
+    bootstrapCredentialRef: id
+  }).strict(),
+  status: z.enum(["unverified", "ready", "unavailable", "revoked"]),
+  version: z.number().int().nonnegative().safe()
+}).strict();
+const vaultAllocationSchema = z.object({
+  id,
+  vaultId: id,
+  teamId: id,
+  grantId: id.nullable(),
+  pathPrefix: path,
+  permissions: z.array(z.enum(["read", "write", "delete"])).min(1),
+  version: z.number().int().nonnegative().safe()
+}).strict();
+const vaultCredentialReferenceSchema = z.discriminatedUnion("mode", [
+  z.object({ mode: z.literal("managed"), vaultId: id, allocationId: id, recordPath: path }).strict(),
+  z.object({
+    mode: z.literal("existing"),
+    vaultId: id,
+    allocationId: id,
+    recordPath: path,
+    fieldMapping: z.record(id, id).refine((value) => Object.keys(value).length > 0, "At least one field mapping is required."),
+    pinnedVersion: z.number().int().positive().safe().nullable()
+  }).strict()
+]);
+function assertCredentialRecordMutation(reference) {
+  vaultCredentialReferenceSchema.parse(reference);
+  if (reference.mode === "existing") throw new Error("existing_secret_read_only");
+}
+export {
+  assertCredentialRecordMutation,
+  vaultAllocationSchema,
+  vaultCredentialReferenceSchema,
+  vaultDescriptorSchema
+};

package/dist/treedx/client.d.ts

@@ -290,6 +290,10 @@ export declare const TREESEED_TREEDX_OPERATIONS: {
             projectId: string;
             repoId: string;
         }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly refresh: ControlPlaneOperationBinding<{
+            projectId: string;
+            repoId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
     };
 };
 type TreeDxProxyMethod<TOperation extends ControlPlaneOperationBinding<any, any, any, any>> = (input: ControlPlaneInvocation<ControlPlaneOperationPath<TOperation>, ControlPlaneOperationQuery<TOperation>, ControlPlaneOperationBody<TOperation>>, options?: ControlPlaneOperationCallOptions) => Promise<ControlPlaneResponseEnvelope<ControlPlaneOperationOutput<TOperation>>>;
@@ -588,6 +592,10 @@ export declare class TreeSeedTreeDxClient {
                 projectId: string;
                 repoId: string;
             }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+            readonly refresh: ControlPlaneOperationBinding<{
+                projectId: string;
+                repoId: string;
+            }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
         };
     };
     readonly proxy: TreeDxProxyGroups<typeof TREESEED_TREEDX_OPERATIONS>;

package/dist/treedx/contract.d.ts

@@ -13,11 +13,11 @@ export declare function treeDxProxyOperationMapping(): {
 export declare function validateTreeDxProxyOperationMapping(): string[];
 export declare function createTreeDxServiceContractReceipt(controlPlaneCatalogDigest: `sha256:${string}`, evidence: TreeDxAdoptionEvidence): Promise<{
     readonly schema: "treeseed.treedx-service-contract/v1";
-    readonly treedxPackageVersion: "0.3.0-rc.4";
+    readonly treedxPackageVersion: "0.3.0-rc.17";
     readonly treedxOpenapiVersion: "0.11.1";
-    readonly treedxOpenapiDigest: "sha256:7c045a99cb0e5ddfb750f060206db374fce86f94dbefecd377bf3e8a5e182ff4";
-    readonly treedxOperationInventoryDigest: "sha256:a9a36b3def243d1fb58f149dd1f93fc6c56e4193eecc1bb4184c0c20b36e54f0";
-    readonly treedxGeneratedTypesDigest: "sha256:ff51298be834c3931e725fe017e0def59a23c80998740b2ba1ddbd5ac5e5eca5";
+    readonly treedxOpenapiDigest: "sha256:90b040cc8372e1359e77c1a4e7c23c930365202c5eb0a9d4ca865d2f11eb48e1";
+    readonly treedxOperationInventoryDigest: "sha256:4f481063ad858cbade4d5fa19c529aca4f108c3e70f12c55ed645c8b412bb17b";
+    readonly treedxGeneratedTypesDigest: "sha256:b920eba21f37637c5907d2377a5c55ea5084f5c92100dceeb10b03f7749a74b2";
     readonly treedxSourceCommit: string;
     readonly treedxPackageArtifactDigest: `sha256:${string}`;
     readonly controlPlaneCatalogDigest: `sha256:${string}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.91",
+  "version": "0.13.0-rc.93",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {
@@ -51,7 +51,7 @@
     "standards:release-evidence": "node --import tsx ./scripts/standards/create-release-evidence.ts"
   },
   "dependencies": {
-    "@treeseed/treedx": "0.3.0-rc.4",
+    "@treeseed/treedx": "0.3.0-rc.17",
     "esbuild": "^0.28.0",
     "libsodium-wrappers-sumo": "0.8.4",
     "typescript": "^5.9.3",