@treeseed/sdk 0.10.28 → 0.12.4

package/dist/platform/env.yaml

@@ -1,9 +1,9 @@
 entries:
-  GH_TOKEN:
+  TREESEED_GITHUB_TOKEN:
     label: GitHub access token
     group: auth
-    description: Personal access token used by Treeseed for GitHub CLI automation, repository setup, CI secret sync, and GitHub Copilot SDK-backed workflows.
-    howToGet: "Create a GitHub fine-grained personal access token scoped to the TreeSeed repository. Required repository permissions: Contents read/write, Environments read/write, Secrets and variables read/write, Actions and workflows read/write, Pull requests read/write, Issues read/write. Then paste it here as GH_TOKEN."
+    description: Personal access token used by Treeseed for GitHub CLI automation, repository setup, CI secret sync, and repository-scoped GitHub workflows.
+    howToGet: "Create a GitHub fine-grained personal access token scoped to the TreeSeed repository. Required repository permissions: Contents read/write, Environments read/write, Secrets and variables read/write, Actions and workflows read/write, Pull requests read/write, Issues read/write. Then paste it here as TREESEED_GITHUB_TOKEN."
     sensitivity: secret
     targets:
       - local-runtime
@@ -23,15 +23,87 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
-  RAILWAY_API_TOKEN:
+  TREESEED_GITHUB_COPILOT_TOKEN:
+    label: GitHub Copilot access token
+    group: auth
+    description: Account-scoped GitHub token used only by Treeseed GitHub Copilot SDK-backed execution providers.
+    howToGet: "Create a GitHub fine-grained personal access token for the account with an active Copilot subscription. Enable the Copilot Requests permission, then store it as TREESEED_GITHUB_COPILOT_TOKEN. If omitted, the Copilot adapter can fall back to TREESEED_GITHUB_TOKEN for compatibility."
+    sensitivity: secret
+    targets:
+      - local-runtime
+      - github-secret
+      - railway-secret
+    scopes:
+      - local
+      - staging
+      - prod
+    storage: scoped
+    requirement: optional
+    purposes:
+      - config
+    validation:
+      kind: nonempty
+      minLength: 8
+    sourcePriority:
+      - machine-config
+      - process-env
+  TREESEED_DOCKERHUB_USERNAME:
+    label: Docker Hub username
+    group: docker
+    description: Docker Hub username used by Treeseed package release workflows to publish container images such as treeseed/treedx and treeseed/treedx-profiler.
+    howToGet: Use the Docker Hub account or organization user that owns the Treeseed images.
+    sensitivity: plain
+    targets:
+      - local-runtime
+      - github-variable
+    scopes:
+      - staging
+      - prod
+    storage: shared
+    requirement: optional
+    purposes:
+      - deploy
+      - config
+    validation:
+      kind: nonempty
+    sourcePriority:
+      - machine-config
+      - process-env
+  TREESEED_DOCKERHUB_TOKEN:
+    label: Docker Hub token
+    group: docker
+    description: Docker Hub access token used by Treeseed production release workflows to publish semantic TreeDX service and profiler images.
+    howToGet: Create a Docker Hub access token with permission to push the Treeseed images, then store it through Treeseed config as TREESEED_DOCKERHUB_TOKEN.
+    sensitivity: secret
+    targets:
+      - local-runtime
+      - github-secret
+    scopes:
+      - staging
+      - prod
+    storage: shared
+    requirement: optional
+    purposes:
+      - deploy
+      - config
+    validation:
+      kind: nonempty
+      minLength: 8
+    sourcePriority:
+      - machine-config
+      - process-env
+  TREESEED_RAILWAY_API_TOKEN:
     label: Railway API token
     group: auth
     description: Account-level Railway API token used by Treeseed to provision, reconcile, deploy, and inspect Market Railway services.
-    howToGet: Create a Railway account API token with access to the Treeseed Market project/workspace, then store it through Treeseed config as RAILWAY_API_TOKEN.
+    howToGet: Create a Railway account API token with access to the Treeseed Market project/workspace, then store it through Treeseed config as TREESEED_RAILWAY_API_TOKEN.
     sensitivity: secret
     targets:
       - local-runtime
       - github-secret
+      - railway-secret
+    serviceTargets:
+      - operationsRunner
     scopes:
       - local
       - staging
@@ -49,6 +121,56 @@ entries:
       - process-env
     relevanceRef: railwayManagedEnabled
     requiredWhenRef: railwayManagedEnabled
+  TREESEED_RAILWAY_WORKSPACE:
+    label: Railway workspace
+    group: railway
+    description: Railway workspace Treeseed should use when listing or creating projects during bootstrap and config reconciliation.
+    howToGet: In Railway, use the workspace slug or name shown in the workspace switcher.
+    sensitivity: plain
+    targets:
+      - local-runtime
+      - github-variable
+      - railway-var
+    scopes:
+      - staging
+      - prod
+    storage: shared
+    requirement: optional
+    purposes:
+      - deploy
+      - destroy
+      - config
+    validation:
+      kind: nonempty
+    sourcePriority:
+      - machine-config
+      - process-env
+    relevanceRef: railwayManagedEnabled
+    requiredWhenRef: railwayManagedEnabled
+  TREESEED_RAILWAY_PROJECT_ID:
+    label: Railway project ID
+    group: hosting
+    visibility: system
+    description: Railway project identifier used by hosted deploy workflows and reconciliation helpers for the active environment.
+    howToGet: Treeseed can derive or persist this after Railway project reconciliation. Override it only when targeting a known Railway project ID.
+    sensitivity: plain
+    targets:
+      - github-variable
+      - railway-var
+    scopes:
+      - staging
+      - prod
+    storage: scoped
+    requirement: optional
+    purposes:
+      - deploy
+      - config
+    validation:
+      kind: nonempty
+    sourcePriority:
+      - machine-config
+      - process-env
+    relevanceRef: railwayManagedEnabled
   TREESEED_GITHUB_OWNER:
     label: GitHub repository owner
     group: github
@@ -113,11 +235,11 @@ entries:
       - machine-config
       - process-env
     defaultValueRef: githubRepositoryVisibilityDefault
-  CLOUDFLARE_API_TOKEN:
+  TREESEED_CLOUDFLARE_API_TOKEN:
     label: Cloudflare API token
     group: auth
-    description: Account-level Cloudflare API token used by Wrangler, Workers AI, and CI to manage Pages, Workers, Workers KV, D1, Queues, DNS, secrets, and deploys.
-    howToGet: "Create a Cloudflare account-level API token scoped to the target domain and account. Required permissions: Account Cloudflare Pages edit, Account Workers Scripts edit, Account Workers KV Storage edit, Account D1 edit, Account Queues edit, Zone DNS edit, Workers AI Read, and Workers AI Edit for model execution. If TREESEED_COMMIT_AI_GATEWAY_ID is configured, also grant AI Gateway Read/Run access for the gateway. Then paste it here as CLOUDFLARE_API_TOKEN."
+    description: Account-level Cloudflare API token used by Wrangler, Workers AI, and CI to manage Pages, Workers, Workers KV, D1, R2, Queues, Turnstile, DNS, cache settings, secrets, and deploys.
+    howToGet: "Create a Cloudflare account-level API token scoped to the target account and domain. Account permissions: Pages Write, Workers Scripts Write, Workers KV Storage Write, Workers R2 Storage Write, D1 Write, Queues Write, Turnstile Sites Write, Account Rulesets Write, and Account Rule Lists Write. Zone permissions for the target domain: Zone Read, DNS Write, Cache Settings Write, and SSL and Certificates Write. Cloudflare API docs may call Cache Settings Write the Cache Rules permission and Account Rule Lists Write the Account Filter Lists permission. If TREESEED_COMMIT_AI_GATEWAY_ID or Workers AI model execution is configured, also grant AI Gateway Run and Workers AI Write. Then paste it here as TREESEED_CLOUDFLARE_API_TOKEN."
     sensitivity: secret
     targets:
       - local-runtime
@@ -139,7 +261,7 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
-  CLOUDFLARE_ACCOUNT_ID:
+  TREESEED_CLOUDFLARE_ACCOUNT_ID:
     label: Cloudflare account ID
     group: cloudflare
     description: Identifies the Cloudflare account Treeseed should provision, deploy into, and use for Workers AI commit message generation.
@@ -169,7 +291,7 @@ entries:
   TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME:
     label: Cloudflare Pages project name
     group: cloudflare
-    description: Production Pages project used for the Treeseed web deployment.
+    description: Static Cloudflare Pages project used for all Treeseed web environments.
     howToGet: Treeseed can default this from the site slug. Override it if the Cloudflare Pages project should use a different name.
     sensitivity: plain
     targets:
@@ -190,10 +312,10 @@ entries:
       - process-env
     defaultValueRef: pagesProjectNameDefault
   TREESEED_CLOUDFLARE_PAGES_PREVIEW_PROJECT_NAME:
-    label: Cloudflare staging Pages project
+    label: Cloudflare preview Pages project
     group: cloudflare
-    description: Staging Pages project used for non-production Treeseed web deployments.
-    howToGet: Treeseed can default this from the production Pages project name with a -staging suffix.
+    description: Legacy alias for the shared Cloudflare Pages project used by non-production branch deployments. Do not configure a separate project per environment.
+    howToGet: Treeseed defaults this to TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME so staging deploys use the shared Pages project preview environment.
     sensitivity: plain
     targets:
       - local-runtime
@@ -303,7 +425,7 @@ entries:
     validation:
       kind: enum
       values:
-        - market_control_plane
+        - treeseed_control_plane
         - hosted_project
         - self_hosted_project
     sourcePriority:
@@ -340,10 +462,10 @@ entries:
       - treeseed.site.yaml
     defaultValueRef: hostingRegistrationDefault
   TREESEED_CENTRAL_MARKET_API_BASE_URL:
-    label: Treeseed central market API base URL
+    label: Treeseed central API base URL
     group: hosting
     description: Base URL for the always-available central TreeSeed market used when no team-specific specialized market is selected.
-    howToGet: The production TreeSeed market defaults to https://api.treeseed.ai. Set this only when an environment should use another central-compatible market endpoint.
+    howToGet: The production TreeSeed market defaults to https://api.treeseed.dev. Set this only when an environment should use another central-compatible market endpoint.
     sensitivity: plain
     targets:
       - github-variable
@@ -364,11 +486,11 @@ entries:
       - process-env
       - treeseed.site.yaml
     defaultValueRef: centralMarketBaseUrlDefault
-  TREESEED_MARKET_API_BASE_URL:
-    label: Treeseed default market API base URL
+  TREESEED_API_BASE_URL:
+    label: Treeseed default API base URL
     group: hosting
     description: Primary market control-plane API URL used by hosted and optionally registered self-hosted project platforms.
-    howToGet: The production TreeSeed market defaults to https://api.treeseed.ai. Set this to a staging, enterprise, or specialized market endpoint when that environment should register with a different market.
+    howToGet: The production TreeSeed market defaults to https://api.treeseed.dev. Set this to a staging, enterprise, or specialized market endpoint when that environment should register with a different market.
     sensitivity: plain
     targets:
       - github-variable
@@ -390,20 +512,22 @@ entries:
     relevanceRef: projectRegistrationEnabled
     requiredWhenRef: projectRegistrationEnabled
     defaultValueRef: marketBaseUrlDefault
-  TREESEED_MARKET_DATABASE_URL:
-    label: Market PostgreSQL database URL
+  TREESEED_DATABASE_URL:
+    label: Treeseed PostgreSQL database URL
     group: hosting
-    cluster: hosting:market-control-plane
+    cluster: hosting:treeseed-control-plane
     visibility: system
-    description: Railway PostgreSQL connection URL for Market control-plane tables. Browser/UI code must never receive this value.
-    howToGet: Provision the managed Market PostgreSQL resource through Treeseed/Railway reconciliation and store the generated connection URL as a service secret.
+    description: PostgreSQL connection URL for Treeseed control-plane tables. Local development derives this from the managed local API Postgres configuration; hosted environments receive the reconciled Railway PostgreSQL connection URL. Browser/UI code must never receive this value.
+    howToGet: For local development, Treeseed derives this from the local API Postgres port and database defaults. For staging and production, provision the managed Treeseed PostgreSQL resource through Treeseed/Railway reconciliation and store the generated connection URL as a service secret.
     sensitivity: secret
     targets:
+      - local-runtime
       - railway-secret
     serviceTargets:
       - api
-      - marketOperationsRunner
+      - operationsRunner
     scopes:
+      - local
       - staging
       - prod
     storage: scoped
@@ -414,27 +538,30 @@ entries:
     validation:
       kind: url
     sourcePriority:
+      - generated
       - machine-config
       - process-env
       - treeseed.site.yaml
+    localDefaultValueRef: localApiDatabaseUrlDefault
   TREESEED_PLATFORM_RUNNER_SECRET:
-    label: Market operations runner secret
+    label: Treeseed operations runner secret
     group: hosting
-    cluster: hosting:market-operations-runner
+    cluster: hosting:operations-runner
     visibility: system
-    description: Bearer credential used only by the TreeSeed-owned Market operations runner to claim and update platform operation jobs.
+    description: Bearer credential used only by the TreeSeed-owned Treeseed operations runner to claim and update platform operation jobs.
     howToGet: Generate a strong secret with `openssl rand -base64 48` and store it through `treeseed config` for staging and production.
     sensitivity: secret
     targets:
+      - github-secret
       - railway-secret
     serviceTargets:
       - api
-      - marketOperationsRunner
+      - operationsRunner
     scopes:
       - staging
       - prod
     storage: scoped
-    requirement: conditional
+    requirement: optional
     purposes:
       - deploy
       - config
@@ -446,17 +573,17 @@ entries:
       - process-env
     defaultValueRef: generatedSecret
   TREESEED_PLATFORM_RUNNER_ID:
-    label: Market operations runner ID
+    label: Treeseed operations runner ID
     group: hosting
-    cluster: hosting:market-operations-runner
+    cluster: hosting:operations-runner
     visibility: system
-    description: Stable identity for the TreeSeed-owned Market operations runner service in each environment.
+    description: Stable identity for the TreeSeed-owned Treeseed operations runner service in each environment.
     howToGet: Treeseed derives this from the environment. Override it only when replacing a runner identity deliberately.
     sensitivity: plain
     targets:
       - railway-var
     serviceTargets:
-      - marketOperationsRunner
+      - operationsRunner
     scopes:
       - staging
       - prod
@@ -473,17 +600,17 @@ entries:
       - treeseed.site.yaml
     defaultValueRef: platformRunnerIdDefault
   TREESEED_PLATFORM_RUNNER_DATA_DIR:
-    label: Market operations runner data directory
+    label: Treeseed operations runner data directory
     group: hosting
-    cluster: hosting:market-operations-runner
+    cluster: hosting:operations-runner
     visibility: system
-    description: Writable data directory mounted into the Market operations runner for repository workspaces and operation state.
+    description: Writable data directory mounted into the Treeseed operations runner for repository workspaces and operation state.
     howToGet: Use `/data` for Railway runner services with an attached volume.
     sensitivity: plain
     targets:
       - railway-var
     serviceTargets:
-      - marketOperationsRunner
+      - operationsRunner
     scopes:
       - staging
       - prod
@@ -500,17 +627,17 @@ entries:
       - treeseed.site.yaml
     defaultValueRef: platformRunnerDataDirDefault
   TREESEED_PLATFORM_RUNNER_ENVIRONMENT:
-    label: Market operations runner environment
+    label: Treeseed operations runner environment
     group: hosting
-    cluster: hosting:market-operations-runner
+    cluster: hosting:operations-runner
     visibility: system
-    description: Runtime environment label reported by the Market operations runner in registration and heartbeat records.
+    description: Runtime environment label reported by the Treeseed operations runner in registration and heartbeat records.
     howToGet: Treeseed derives this from the selected environment.
     sensitivity: plain
     targets:
       - railway-var
     serviceTargets:
-      - marketOperationsRunner
+      - operationsRunner
     scopes:
       - staging
       - prod
@@ -526,11 +653,186 @@ entries:
       - process-env
       - treeseed.site.yaml
     defaultValueRef: platformRunnerEnvironmentDefault
+  TREESEED_CREDENTIAL_SESSION_SECRET:
+    label: Treeseed credential session secret
+    group: hosting
+    cluster: hosting:treeseed-control-plane
+    visibility: system
+    description: Secret used by the API and operations runner to encrypt provider credential session payloads.
+    howToGet: Generate a strong random secret and store it through `treeseed config` for staging and production.
+    sensitivity: secret
+    targets:
+      - github-secret
+      - railway-secret
+    serviceTargets:
+      - api
+      - operationsRunner
+    scopes:
+      - staging
+      - prod
+    storage: scoped
+    requirement: conditional
+    purposes:
+      - deploy
+      - config
+    validation:
+      kind: nonempty
+      minLength: 24
+    sourcePriority:
+      - machine-config
+      - process-env
+    defaultValueRef: generatedSecret
+  TREESEED_STRIPE_SECRET_KEY:
+    label: Stripe platform secret key
+    group: commerce
+    cluster: hosting:treeseed-control-plane
+    visibility: system
+    description: Platform Stripe secret key used only by the API for Connect onboarding, Product/Price mirror sync, PaymentIntent confirmation, subscriptions, webhook reconciliation, and connected-account refunds.
+    howToGet: "Stripe Dashboard -> Developers -> API keys. Use test mode first. Prefer a restricted key when available with access for Connect accounts, account links, login links, Products, Prices, PaymentIntents, Customers, Subscriptions, Refunds, and webhook event reads as needed. Store with `npx trsd config set TREESEED_STRIPE_SECRET_KEY --environment local|staging|prod`; never place Stripe secret keys in plaintext env files and never request vendor-provided Stripe secret keys."
+    sensitivity: secret
+    targets:
+      - local-runtime
+      - railway-secret
+    serviceTargets:
+      - api
+    scopes:
+      - local
+      - staging
+      - prod
+    storage: scoped
+    requirement: optional
+    purposes:
+      - deploy
+      - config
+    validation:
+      kind: nonempty
+    sourcePriority:
+      - machine-config
+      - process-env
+  TREESEED_STRIPE_PUBLISHABLE_KEY:
+    label: Stripe publishable key
+    group: commerce
+    cluster: hosting:treeseed-control-plane
+    visibility: system
+    description: Platform Stripe publishable key returned by `/v1/commerce/stripe/config` for root-market Stripe Elements checkout surfaces. Admin must not initialize Stripe Elements.
+    howToGet: "Stripe Dashboard -> Developers -> API keys. Copy the publishable key for the same test/live mode as TREESEED_STRIPE_SECRET_KEY and store it with `npx trsd config set TREESEED_STRIPE_PUBLISHABLE_KEY --environment local|staging|prod`."
+    sensitivity: plain
+    targets:
+      - local-runtime
+      - railway-var
+      - config-file
+    serviceTargets:
+      - api
+    scopes:
+      - local
+      - staging
+      - prod
+    storage: shared
+    requirement: optional
+    purposes:
+      - deploy
+      - config
+    validation:
+      kind: nonempty
+    sourcePriority:
+      - machine-config
+      - process-env
+      - treeseed.site.yaml
+  TREESEED_STRIPE_WEBHOOK_SECRET:
+    label: Stripe webhook signing secret
+    group: commerce
+    cluster: hosting:treeseed-control-plane
+    visibility: system
+    description: Stripe webhook endpoint signing secret used by the API to verify connected-account payment and subscription events.
+    howToGet: "Stripe Dashboard -> Developers -> Webhooks. Add endpoint `<TREESEED_API_BASE_URL>/v1/commerce/webhooks/stripe`; for local development use the Stripe CLI to forward to the local API. Subscribe to payment_intent.succeeded, payment_intent.payment_failed, payment_intent.canceled, customer.subscription.created, customer.subscription.updated, customer.subscription.deleted, invoice.payment_succeeded, and invoice.payment_failed. Copy the signing secret and store it with `npx trsd config set TREESEED_STRIPE_WEBHOOK_SECRET --environment local|staging|prod`."
+    sensitivity: secret
+    targets:
+      - local-runtime
+      - railway-secret
+    serviceTargets:
+      - api
+    scopes:
+      - local
+      - staging
+      - prod
+    storage: scoped
+    requirement: optional
+    purposes:
+      - deploy
+      - config
+    validation:
+      kind: nonempty
+    sourcePriority:
+      - machine-config
+      - process-env
+  TREESEED_STRIPE_MODE:
+    label: Stripe mode
+    group: commerce
+    cluster: hosting:treeseed-control-plane
+    visibility: system
+    description: Stripe environment mode used by marketplace seller onboarding, mirror sync, checkout, webhooks, subscriptions, and refunds. Defaults to test for local and staging.
+    howToGet: "Set `test` for local and staging with `npx trsd config set TREESEED_STRIPE_MODE test --environment local|staging`. Set `live` in production only after Connect onboarding, webhook verification, local/staging marketplace acceptance, and Stripe production readiness are complete."
+    sensitivity: plain
+    targets:
+      - local-runtime
+      - railway-var
+      - config-file
+    serviceTargets:
+      - api
+    scopes:
+      - local
+      - staging
+      - prod
+    storage: shared
+    requirement: optional
+    purposes:
+      - deploy
+      - config
+    validation:
+      kind: enum
+      values:
+        - test
+        - live
+    sourcePriority:
+      - machine-config
+      - process-env
+      - treeseed.site.yaml
+  TREESEED_STRIPE_CONNECT_ACCOUNT_TYPE:
+    label: Stripe Connect account type
+    group: commerce
+    cluster: hosting:treeseed-control-plane
+    visibility: system
+    description: Canonical Stripe Connect account model for approved vendor onboarding. TreeSeed creates hosted onboarding links and vendors never provide raw Stripe secret keys.
+    howToGet: "Keep this set to `express` with `npx trsd config set TREESEED_STRIPE_CONNECT_ACCOUNT_TYPE express --environment local|staging|prod` unless a future documented phase changes the Connect account model."
+    sensitivity: plain
+    targets:
+      - local-runtime
+      - railway-var
+      - config-file
+    serviceTargets:
+      - api
+    scopes:
+      - local
+      - staging
+      - prod
+    storage: shared
+    requirement: optional
+    purposes:
+      - deploy
+      - config
+    validation:
+      kind: enum
+      values:
+        - express
+    sourcePriority:
+      - machine-config
+      - process-env
+      - treeseed.site.yaml
   TREESEED_CATALOG_MARKET_API_BASE_URLS:
-    label: Treeseed catalog market API URLs
+    label: Treeseed catalog API URLs
     group: hosting
-    description: Comma-separated market API base URLs that contribute templates, knowledge packs, and shared resources to the integrated catalog.
-    howToGet: Start with the production TreeSeed market at https://api.treeseed.ai and add specialized team or enterprise market API URLs as needed.
+    description: Comma-separated API base URLs that contribute templates, knowledge packs, and shared resources to the integrated catalog.
+    howToGet: Start with the production TreeSeed market at https://api.treeseed.dev and add specialized team or enterprise API URLs as needed.
     sensitivity: plain
     targets:
       - github-variable
@@ -601,3 +903,224 @@ entries:
     relevanceRef: projectRegistrationEnabled
     requiredWhenRef: projectRegistrationEnabled
     defaultValueRef: hostingProjectIdDefault
+  TREESEED_SECRET_CAPABILITY_PROOF_REPO:
+    label: Secret capability proof repository
+    group: secrets-capability
+    description: GitHub repository slug used by guarded secret-capability live proof planning.
+    howToGet: Set to owner/name for a dedicated test repository when running the optional plan-only live proof.
+    sensitivity: plain
+    targets:
+      - local-runtime
+    scopes:
+      - local
+      - staging
+      - prod
+    storage: scoped
+    requirement: optional
+    purposes:
+      - dev
+      - config
+    validation:
+      kind: nonempty
+    sourcePriority:
+      - machine-config
+      - process-env
+  TREESEED_SECRET_CAPABILITY_PROOF_WORKFLOW:
+    label: Secret capability proof workflow
+    group: secrets-capability
+    description: Workflow file name used by guarded secret-capability live proof planning.
+    howToGet: Set to the allowlisted workflow file in the proof repository, such as secret-capability-proof.yml.
+    sensitivity: plain
+    targets:
+      - local-runtime
+    scopes:
+      - local
+      - staging
+      - prod
+    storage: scoped
+    requirement: optional
+    purposes:
+      - dev
+      - config
+    validation:
+      kind: nonempty
+    sourcePriority:
+      - machine-config
+      - process-env
+  TREESEED_SECRET_CAPABILITY_PROOF_REF:
+    label: Secret capability proof ref
+    group: secrets-capability
+    description: Branch or ref used by guarded secret-capability live proof planning.
+    howToGet: Set to the protected branch or ref used for the plan-only proof.
+    sensitivity: plain
+    targets:
+      - local-runtime
+    scopes:
+      - local
+      - staging
+      - prod
+    storage: scoped
+    requirement: optional
+    purposes:
+      - dev
+      - config
+    validation:
+      kind: nonempty
+    sourcePriority:
+      - machine-config
+      - process-env
+  TREESEED_CAPACITY_ACCEPTANCE_API_URL:
+    label: Capacity acceptance API URL
+    group: capacity-provider
+    description: Market API base URL used by live capacity runtime acceptance proof.
+    howToGet: Set to the staging or local API base URL when running capacity provider live acceptance.
+    sensitivity: plain
+    targets:
+      - local-runtime
+    scopes:
+      - local
+      - staging
+      - prod
+    storage: scoped
+    requirement: optional
+    purposes:
+      - dev
+      - config
+    validation:
+      kind: url
+    sourcePriority:
+      - machine-config
+      - process-env
+  TREESEED_CAPACITY_ACCEPTANCE_ADMIN_TOKEN:
+    label: Capacity acceptance admin token
+    group: capacity-provider
+    description: Admin bearer token used only by live capacity runtime acceptance proof.
+    howToGet: Create a scoped test/admin token for the acceptance environment and store it through Treeseed config.
+    sensitivity: secret
+    targets:
+      - local-runtime
+    scopes:
+      - local
+      - staging
+      - prod
+    storage: scoped
+    requirement: optional
+    purposes:
+      - dev
+      - config
+    validation:
+      kind: nonempty
+      minLength: 8
+    sourcePriority:
+      - machine-config
+      - process-env
+  TREESEED_CAPACITY_ACCEPTANCE_TEAM_ID:
+    label: Capacity acceptance team ID
+    group: capacity-provider
+    description: Team id used by live capacity runtime acceptance proof.
+    howToGet: Use a dedicated test team id in the target Market environment.
+    sensitivity: plain
+    targets:
+      - local-runtime
+    scopes:
+      - local
+      - staging
+      - prod
+    storage: scoped
+    requirement: optional
+    purposes:
+      - dev
+      - config
+    validation:
+      kind: nonempty
+    sourcePriority:
+      - machine-config
+      - process-env
+  TREESEED_CAPACITY_ACCEPTANCE_PROJECT_ID:
+    label: Capacity acceptance project ID
+    group: capacity-provider
+    description: Project id used by live capacity runtime acceptance proof.
+    howToGet: Use a dedicated test project id in the target Market environment.
+    sensitivity: plain
+    targets:
+      - local-runtime
+    scopes:
+      - local
+      - staging
+      - prod
+    storage: scoped
+    requirement: optional
+    purposes:
+      - dev
+      - config
+    validation:
+      kind: nonempty
+    sourcePriority:
+      - machine-config
+      - process-env
+  TREESEED_CAPACITY_ACCEPTANCE_PROVIDER_ID:
+    label: Capacity acceptance provider ID
+    group: capacity-provider
+    description: Provider id used by live capacity runtime acceptance proof.
+    howToGet: Use the provider id assigned to the test capacity provider.
+    sensitivity: plain
+    targets:
+      - local-runtime
+    scopes:
+      - local
+      - staging
+      - prod
+    storage: scoped
+    requirement: optional
+    purposes:
+      - dev
+      - config
+    validation:
+      kind: nonempty
+    sourcePriority:
+      - machine-config
+      - process-env
+  TREESEED_CAPACITY_ACCEPTANCE_AGENT_CLASS_ID:
+    label: Capacity acceptance agent class ID
+    group: capacity-provider
+    description: Agent class id used by live capacity runtime acceptance proof.
+    howToGet: Use an agent class available to the acceptance test project.
+    sensitivity: plain
+    targets:
+      - local-runtime
+    scopes:
+      - local
+      - staging
+      - prod
+    storage: scoped
+    requirement: optional
+    purposes:
+      - dev
+      - config
+    validation:
+      kind: nonempty
+    sourcePriority:
+      - machine-config
+      - process-env
+  TREESEED_CAPACITY_ACCEPTANCE_MODE:
+    label: Capacity acceptance mode
+    group: capacity-provider
+    description: Work mode requested by live capacity runtime acceptance proof.
+    howToGet: Leave unset to use planning, or set a supported project mode for the proof.
+    sensitivity: plain
+    targets:
+      - local-runtime
+    scopes:
+      - local
+      - staging
+      - prod
+    storage: scoped
+    requirement: optional
+    purposes:
+      - dev
+      - config
+    validation:
+      kind: nonempty
+    sourcePriority:
+      - machine-config
+      - process-env