@treeseed/sdk 0.12.62 → 0.13.0-rc.10

package/dist/secrets-capability/service-provider-contracts.js

@@ -0,0 +1,183 @@
+const SERVICE_PROVIDER_IDS = ["github", "cloudflare", "railway", "openbao"];
+const SERVICE_CAPABILITY_TYPES = [
+  "repository-hosting",
+  "workflow-execution",
+  "workflow-configuration",
+  "secret-enclave",
+  "frontend-hosting",
+  "backend-hosting",
+  "dns-management",
+  "object-storage",
+  "database-hosting",
+  "capacity-runtime-hosting",
+  "private-knowledge-index-hosting",
+  "artifact-hosting"
+];
+const SERVICE_CONNECTION_STATUSES = [
+  "draft",
+  "active",
+  "degraded",
+  "validation-failed",
+  "reentry-required",
+  "reauthorization-required",
+  "disconnected"
+];
+const SERVICE_CAPABILITY_STATUSES = ["configured", "disabled", "blocked", "planned"];
+const CREDENTIAL_AUTHORITY_SCHEMES = [
+  "app-installation",
+  "api-token",
+  "oauth-token",
+  "environment-reference",
+  "client-encrypted",
+  "external-vault",
+  "workload-identity"
+];
+const field = (key, label, description, required = true, sensitive = false) => ({
+  key,
+  label,
+  description,
+  required,
+  sensitive,
+  input: sensitive ? "password" : "text"
+});
+const SERVICE_PROVIDER_CATALOG = [
+  {
+    id: "github",
+    label: "GitHub",
+    logoKey: "github",
+    documentationUrl: "https://docs.github.com/apps/creating-github-apps",
+    description: "Connect an organization through a GitHub App installation.",
+    knowledgePageIds: ["provider.github"],
+    connectionFields: [
+      field("organization", "Organization", "The organization or account that owns repositories.")
+    ],
+    capabilities: [
+      { type: "repository-hosting", label: "Repository hosting", description: "Own source and knowledge repositories.", credentialProfileIds: ["github-repository-app", "github-repository-token"], status: "available" },
+      { type: "workflow-execution", label: "Workflow execution", description: "Run allowlisted GitHub Actions workflows.", credentialProfileIds: ["github-workflow-app", "github-workflow-token"], status: "available" },
+      { type: "workflow-configuration", label: "Workflow configuration", description: "Manage the scoped variables required by allowlisted workflows.", credentialProfileIds: ["github-workflow-app", "github-workflow-token"], status: "available" },
+      { type: "secret-enclave", label: "Actions secret enclave", description: "Write GitHub-encrypted values to Actions without making them readable by TreeSeed.", credentialProfileIds: ["github-workflow-app", "github-workflow-token"], status: "available" }
+    ],
+    credentialProfiles: [
+      {
+        id: "github-repository-app",
+        label: "Repository Connector App",
+        description: "Installation authority narrowed to one repository for guarded Git reads and writes.",
+        capabilities: ["repository-hosting"],
+        fields: [],
+        permissions: ["Metadata: read", "Contents: read and write"],
+        sharing: "capability-scoped",
+        unattendedCompatible: true,
+        authoritySchemes: ["app-installation"],
+        knowledgePageIds: ["provider.github", "services.credentials", "vault.rotation"]
+      },
+      {
+        id: "github-repository-token",
+        label: "Repository token authority",
+        description: "Fine-grained token authority restricted to selected repositories and Contents access.",
+        capabilities: ["repository-hosting"],
+        fields: [field("accessToken", "Fine-grained token", "Encrypted before leaving this browser.", true, true)],
+        permissions: ["Metadata: read", "Contents: read and write"],
+        sharing: "capability-scoped",
+        unattendedCompatible: false,
+        authoritySchemes: ["api-token", "environment-reference", "client-encrypted", "external-vault"],
+        knowledgePageIds: ["provider.github", "services.credentials", "vault.rotation"]
+      },
+      {
+        id: "github-workflow-app",
+        label: "Workflow Connector App",
+        description: "Installation authority for dispatch, run observation, and separately enabled secret and variable configuration.",
+        capabilities: ["workflow-execution", "workflow-configuration", "secret-enclave"],
+        fields: [],
+        permissions: ["Metadata: read", "Contents: read", "Actions: read and write", "Secrets: read and write", "Variables: read and write"],
+        sharing: "capability-scoped",
+        unattendedCompatible: true,
+        authoritySchemes: ["app-installation"],
+        knowledgePageIds: ["provider.github", "services.credentials", "vault.rotation"]
+      },
+      {
+        id: "github-workflow-token",
+        label: "Workflow token authority",
+        description: "Fine-grained token authority for Actions and explicitly enabled secret or variable scopes.",
+        capabilities: ["workflow-execution", "workflow-configuration", "secret-enclave"],
+        fields: [field("accessToken", "Fine-grained token", "Encrypted before leaving this browser.", true, true)],
+        permissions: ["Metadata: read", "Contents: read", "Actions: read and write", "Secrets: read and write", "Variables: read and write"],
+        sharing: "capability-scoped",
+        unattendedCompatible: false,
+        authoritySchemes: ["api-token", "environment-reference", "client-encrypted", "external-vault"],
+        knowledgePageIds: ["provider.github", "services.credentials", "vault.rotation"]
+      }
+    ]
+  },
+  {
+    id: "cloudflare",
+    label: "Cloudflare",
+    logoKey: "cloudflare",
+    documentationUrl: "https://developers.cloudflare.com/fundamentals/api/get-started/create-token/",
+    description: "Connect a Cloudflare account with separately scoped capability tokens.",
+    knowledgePageIds: ["provider.cloudflare"],
+    connectionFields: [field("accountId", "Account ID", "The non-secret Cloudflare account identifier.")],
+    capabilities: [
+      { type: "frontend-hosting", label: "Frontend hosting", description: "Future Pages and Workers application hosting.", credentialProfileIds: ["cloudflare-runtime"], status: "available" },
+      { type: "dns-management", label: "DNS management", description: "Future scoped DNS record management.", credentialProfileIds: ["cloudflare-dns"], status: "planned" },
+      { type: "object-storage", label: "Object storage", description: "R2-backed immutable publication and private artifact storage.", credentialProfileIds: ["cloudflare-storage"], status: "available" }
+    ],
+    credentialProfiles: [
+      { id: "cloudflare-runtime", label: "Pages and Workers token", description: "A token limited to application deployment resources.", capabilities: ["frontend-hosting"], fields: [field("apiToken", "API token", "Encrypted in this browser and used only for authorized frontend operations.", true, true)], permissions: ["Account: Workers Scripts Edit", "Account: Pages Edit"], sharing: "capability-scoped", unattendedCompatible: false, knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
+      { id: "cloudflare-dns", label: "DNS token", description: "A token restricted to selected zones.", capabilities: ["dns-management"], fields: [field("apiToken", "DNS API token", "Encrypted separately from deployment authority.", true, true)], permissions: ["Zone: DNS Edit for only the managed zones"], sharing: "capability-scoped", unattendedCompatible: false, knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
+      { id: "cloudflare-storage", label: "Storage token", description: "A token limited to R2 resources.", capabilities: ["object-storage"], fields: [field("apiToken", "Storage API token", "Encrypted separately from runtime and DNS authority.", true, true)], permissions: ["Account: Workers R2 Storage Edit"], sharing: "capability-scoped", unattendedCompatible: false, knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] }
+    ]
+  },
+  {
+    id: "railway",
+    label: "Railway",
+    logoKey: "railway",
+    documentationUrl: "https://docs.railway.com/guides/public-api",
+    description: "Connect a Railway workspace for future backend and private infrastructure.",
+    knowledgePageIds: ["provider.railway"],
+    connectionFields: [field("workspaceId", "Workspace ID", "The non-secret Railway workspace identifier.")],
+    capabilities: [
+      { type: "backend-hosting", label: "Backend hosting", description: "Future API and backend service hosting.", credentialProfileIds: ["railway-workspace"], status: "available" },
+      { type: "database-hosting", label: "Database hosting", description: "Future managed database placement.", credentialProfileIds: ["railway-workspace"], status: "planned" },
+      { type: "capacity-runtime-hosting", label: "Capacity runtime hosting", description: "Future capacity provider placement.", credentialProfileIds: ["railway-workspace"], status: "planned" },
+      { type: "private-knowledge-index-hosting", label: "Private knowledge hosting", description: "Future private TreeDX knowledge-plane placement.", credentialProfileIds: ["railway-workspace"], status: "planned" }
+    ],
+    credentialProfiles: [{
+      id: "railway-workspace",
+      label: "Railway workspace token",
+      description: "Railway currently exposes broad workspace authority. Sharing it increases the blast radius across enabled capabilities.",
+      capabilities: ["backend-hosting", "database-hosting", "capacity-runtime-hosting", "private-knowledge-index-hosting"],
+      fields: [field("apiToken", "Workspace token", "Encrypted in this browser. TreeSeed will request explicit authorization before interactive use.", true, true)],
+      permissions: ["Workspace access required by the selected operations"],
+      sharing: "provider-shared",
+      unattendedCompatible: false,
+      knowledgePageIds: ["provider.railway", "services.credentials", "vault.rotation"]
+    }]
+  },
+  {
+    id: "openbao",
+    label: "OpenBao / HashiCorp Vault",
+    logoKey: "vault",
+    documentationUrl: "https://openbao.org/docs/auth/jwt/",
+    description: "Reference an external vault through workload identity; no long-lived vault token is stored.",
+    knowledgePageIds: ["provider.openbao", "services.external-vault"],
+    connectionFields: [field("address", "Vault address", "The HTTPS endpoint for the vault."), field("mount", "Secrets mount", "The mount containing TreeSeed-managed references."), field("role", "Workload identity role", "The OIDC/JWT role used by the operations runner.")],
+    capabilities: [{ type: "secret-enclave", label: "External secret vault", description: "Resolve approved secret references through workload identity.", credentialProfileIds: [], status: "available" }],
+    credentialProfiles: []
+  }
+];
+function getServiceProviderDefinition(providerId) {
+  return SERVICE_PROVIDER_CATALOG.find((provider) => provider.id === providerId);
+}
+function serviceProviderSupportsCapability(providerId, capability) {
+  return Boolean(getServiceProviderDefinition(providerId)?.capabilities.some((item) => item.type === capability));
+}
+export {
+  CREDENTIAL_AUTHORITY_SCHEMES,
+  SERVICE_CAPABILITY_STATUSES,
+  SERVICE_CAPABILITY_TYPES,
+  SERVICE_CONNECTION_STATUSES,
+  SERVICE_PROVIDER_CATALOG,
+  SERVICE_PROVIDER_IDS,
+  getServiceProviderDefinition,
+  serviceProviderSupportsCapability
+};

package/dist/secrets-capability/service-vault-contracts.d.ts

@@ -0,0 +1,61 @@
+export declare const SERVICE_VAULT_ENCRYPTION_VERSION: "service-vault-v1";
+export declare const SERVICE_VAULT_AEAD_ALGORITHM: "xchacha20-poly1305-ietf";
+export declare const SERVICE_VAULT_KEY_AGREEMENT: "x25519-sealed-box";
+export declare const SERVICE_VAULT_KDF: "argon2id";
+export type EncryptedCredentialEnvelope = {
+    version: typeof SERVICE_VAULT_ENCRYPTION_VERSION;
+    algorithm: typeof SERVICE_VAULT_AEAD_ALGORITHM;
+    ciphertext: string;
+    nonce: string;
+    wrappedKey: string;
+    wrappedKeyNonce: string;
+    associatedData: string;
+    associatedDataDigest: string;
+    fingerprint: string;
+};
+export type EncryptedPrivateKeyEnvelope = {
+    version: typeof SERVICE_VAULT_ENCRYPTION_VERSION;
+    algorithm: typeof SERVICE_VAULT_AEAD_ALGORITHM;
+    kdf: {
+        algorithm: typeof SERVICE_VAULT_KDF;
+        opsLimit: number;
+        memLimit: number;
+        salt: string;
+    };
+    nonce: string;
+    ciphertext: string;
+    publicKey: string;
+};
+export type TeamVaultGrantEnvelope = {
+    version: typeof SERVICE_VAULT_ENCRYPTION_VERSION;
+    algorithm: typeof SERVICE_VAULT_KEY_AGREEMENT;
+    recipientPublicKey: string;
+    wrappedTeamVaultKey: string;
+};
+export type SecretOperationLease = {
+    id: string;
+    teamId: string;
+    connectionId: string;
+    capabilityType: string;
+    purpose: 'provider-connection-validation' | 'remote-git-publication' | 'workflow-dispatch' | 'workflow-configuration';
+    resourceScope: Record<string, string>;
+    credentialProfileId: string;
+    actorUserId: string;
+    requiredFields: string[];
+    publicKey: string;
+    status: 'awaiting-runner' | 'pending' | 'ready' | 'consumed' | 'expired' | 'cancelled' | 'failed';
+    expiresAt: string;
+    consumedAt?: string | null;
+    operationCorrelationId: string;
+};
+export type ServiceVaultAssociatedData = {
+    teamId: string;
+    connectionId: string;
+    credentialProfileId: string;
+    field: string;
+    purpose: string;
+    version: number;
+};
+export declare function containsForbiddenPlaintextSecretMaterial(value: unknown, path?: string): string[];
+export declare function canonicalServiceVaultAssociatedData(input: ServiceVaultAssociatedData): string;
+export declare function validateEncryptedCredentialEnvelope(value: unknown): value is EncryptedCredentialEnvelope;

package/dist/secrets-capability/service-vault-contracts.js

@@ -0,0 +1,39 @@
+const SERVICE_VAULT_ENCRYPTION_VERSION = "service-vault-v1";
+const SERVICE_VAULT_AEAD_ALGORITHM = "xchacha20-poly1305-ietf";
+const SERVICE_VAULT_KEY_AGREEMENT = "x25519-sealed-box";
+const SERVICE_VAULT_KDF = "argon2id";
+const FORBIDDEN_SECRET_KEYS = /(?:passphrase|password|plaintext|derivedKey|privateKey|apiToken|accessToken|secretValue|credentialValue)$/iu;
+function containsForbiddenPlaintextSecretMaterial(value, path = "") {
+  if (!value || typeof value !== "object") return [];
+  const failures = [];
+  for (const [key, entry] of Object.entries(value)) {
+    const nextPath = path ? `${path}.${key}` : key;
+    if (FORBIDDEN_SECRET_KEYS.test(key) && typeof entry === "string" && entry.trim()) failures.push(nextPath);
+    if (entry && typeof entry === "object") failures.push(...containsForbiddenPlaintextSecretMaterial(entry, nextPath));
+  }
+  return failures;
+}
+function canonicalServiceVaultAssociatedData(input) {
+  return JSON.stringify({
+    teamId: input.teamId,
+    connectionId: input.connectionId,
+    credentialProfileId: input.credentialProfileId,
+    field: input.field,
+    purpose: input.purpose,
+    version: input.version
+  });
+}
+function validateEncryptedCredentialEnvelope(value) {
+  if (!value || typeof value !== "object") return false;
+  const envelope = value;
+  return envelope.version === SERVICE_VAULT_ENCRYPTION_VERSION && envelope.algorithm === SERVICE_VAULT_AEAD_ALGORITHM && [envelope.ciphertext, envelope.nonce, envelope.wrappedKey, envelope.wrappedKeyNonce, envelope.associatedData, envelope.associatedDataDigest, envelope.fingerprint].every((field) => typeof field === "string" && field.length > 0);
+}
+export {
+  SERVICE_VAULT_AEAD_ALGORITHM,
+  SERVICE_VAULT_ENCRYPTION_VERSION,
+  SERVICE_VAULT_KDF,
+  SERVICE_VAULT_KEY_AGREEMENT,
+  canonicalServiceVaultAssociatedData,
+  containsForbiddenPlaintextSecretMaterial,
+  validateEncryptedCredentialEnvelope
+};

package/dist/secrets-capability/workflow-operation-contracts.d.ts

@@ -0,0 +1,95 @@
+export type WorkflowConfigurationScope = 'repository' | 'environment' | 'organization';
+export type WorkflowConfigurationRequirement = {
+    name: string;
+    scope: WorkflowConfigurationScope;
+    environment?: string | null;
+    required: boolean;
+};
+export type ProjectWorkflowOperation = {
+    id: string;
+    projectId: string;
+    teamId: string;
+    workflowBindingId: string;
+    repositoryBindingId: string;
+    workflowId: string;
+    refPolicy: string[];
+    allowedInputs: Record<string, {
+        required: boolean;
+        pattern?: string;
+        maximumLength?: number;
+    }>;
+    requiredSecrets: WorkflowConfigurationRequirement[];
+    requiredVariables: WorkflowConfigurationRequirement[];
+    actorPolicy: string[];
+    modePolicy: Array<'planning' | 'acting' | 'operator'>;
+    version: number;
+};
+export type WorkflowOperationRun = {
+    id: string;
+    operationId: string;
+    projectId: string;
+    teamId: string;
+    actorType: 'user' | 'operator' | 'capacity_provider';
+    actorId: string;
+    mode: 'planning' | 'acting' | 'operator';
+    assignmentId?: string | null;
+    handleId?: string | null;
+    providerId: string;
+    providerRunId?: string | null;
+    providerRunUrl?: string | null;
+    sourceSha: string;
+    ref: string;
+    correlationId: string;
+    status: 'authorizing' | 'queued' | 'running' | 'cancelling' | 'completed' | 'failed' | 'cancelled' | 'unknown';
+    artifacts: WorkflowOperationArtifact[];
+    createdAt: string;
+    updatedAt: string;
+};
+export type WorkflowOperationArtifact = {
+    id: string;
+    name: string;
+    sizeBytes: number;
+    expired: boolean;
+    digest?: string | null;
+    createdAt?: string | null;
+    expiresAt?: string | null;
+};
+export interface WorkflowExecutionAdapter {
+    readonly providerId: string;
+    dispatch(input: {
+        operation: ProjectWorkflowOperation;
+        run: WorkflowOperationRun;
+        inputs: Record<string, string>;
+    }): Promise<{
+        providerRunId: string;
+        providerRunUrl?: string | null;
+    }>;
+    observe(run: WorkflowOperationRun): Promise<WorkflowOperationRun>;
+    cancel(run: WorkflowOperationRun): Promise<WorkflowOperationRun>;
+}
+export interface WorkflowConfigurationAdapter {
+    readonly providerId: string;
+    listPresence(input: {
+        repositoryId: string;
+        requirements: WorkflowConfigurationRequirement[];
+    }): Promise<Record<string, boolean>>;
+    putEncryptedSecret(input: {
+        repositoryId: string;
+        requirement: WorkflowConfigurationRequirement;
+        keyId: string;
+        ciphertext: string;
+    }): Promise<void>;
+    deleteSecret(input: {
+        repositoryId: string;
+        requirement: WorkflowConfigurationRequirement;
+    }): Promise<void>;
+    readVariables(input: {
+        repositoryId: string;
+        requirements: WorkflowConfigurationRequirement[];
+    }): Promise<Record<string, string>>;
+    putVariable(input: {
+        repositoryId: string;
+        requirement: WorkflowConfigurationRequirement;
+        value: string;
+    }): Promise<void>;
+}

package/dist/standards/canonicalize.d.ts

@@ -0,0 +1,10 @@
+import type { StandardsDigest, StandardsFingerprint } from './contracts.js';
+type JsonPrimitive = boolean | number | string | null;
+export type CanonicalJsonValue = JsonPrimitive | CanonicalJsonValue[] | {
+    [key: string]: CanonicalJsonValue;
+};
+export declare function canonicalizeStandardsValue(value: unknown): CanonicalJsonValue;
+export declare function canonicalStandardsJson(value: unknown): string;
+export declare function standardsSha256(value: unknown): Promise<StandardsDigest>;
+export declare function fingerprintStandardsValue(value: unknown): Promise<StandardsFingerprint>;
+export {};

package/dist/standards/canonicalize.js

@@ -0,0 +1,43 @@
+import { StandardsError } from "./errors.js";
+function canonicalValue(value, seen, path) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new StandardsError("standards_invalid_digest_input", "Canonical JSON does not accept non-finite numbers.", path);
+    return Object.is(value, -0) ? 0 : value;
+  }
+  if (typeof value !== "object") {
+    throw new StandardsError("standards_invalid_digest_input", `Canonical JSON does not accept ${typeof value}.`, path);
+  }
+  if (seen.has(value)) throw new StandardsError("standards_invalid_digest_input", "Canonical JSON does not accept cyclic values.", path);
+  seen.add(value);
+  try {
+    if (Array.isArray(value)) {
+      return value.map((entry, index) => canonicalValue(entry, seen, `${path}[${index}]`));
+    }
+    const record = value;
+    return Object.fromEntries(Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => [key, canonicalValue(record[key], seen, `${path}.${key}`)]));
+  } finally {
+    seen.delete(value);
+  }
+}
+function canonicalizeStandardsValue(value) {
+  return canonicalValue(value, /* @__PURE__ */ new Set(), "$");
+}
+function canonicalStandardsJson(value) {
+  return JSON.stringify(canonicalizeStandardsValue(value));
+}
+async function standardsSha256(value) {
+  const bytes = new TextEncoder().encode(canonicalStandardsJson(value));
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
+  const hex = Array.from(new Uint8Array(digest), (entry) => entry.toString(16).padStart(2, "0")).join("");
+  return `sha256:${hex}`;
+}
+async function fingerprintStandardsValue(value) {
+  return { algorithm: "sha256", digest: await standardsSha256(value) };
+}
+export {
+  canonicalStandardsJson,
+  canonicalizeStandardsValue,
+  fingerprintStandardsValue,
+  standardsSha256
+};

package/dist/standards/compatibility-attestation.d.ts

@@ -0,0 +1,23 @@
+import type { CompatibilityClassification, SemanticBumpResult, SemanticVersionRequirement, StandardsDigest, StandardsEvidenceReference } from './contracts.js';
+export interface CompatibilityFinding {
+    code: string;
+    path: string;
+    message: string;
+    classification: CompatibilityClassification;
+}
+export interface StandardsCompatibilityAttestation {
+    schemaVersion: 1;
+    contractId: string;
+    baselineBundle: StandardsDigest;
+    candidateBundle: StandardsDigest;
+    result: SemanticBumpResult;
+    findings: CompatibilityFinding[];
+    evidence: StandardsEvidenceReference[];
+}
+export declare function declaredSemanticBump(baselineVersion: string, candidateVersion: string): SemanticVersionRequirement;
+export declare function requiredSemanticBump(classification: CompatibilityClassification, baselineVersion?: string): SemanticVersionRequirement;
+export declare function semanticBumpResult(classification: CompatibilityClassification, declared: SemanticVersionRequirement, baselineVersion?: string): SemanticBumpResult;
+export declare function createCompatibilityAttestation(input: Omit<StandardsCompatibilityAttestation, 'schemaVersion' | 'findings' | 'evidence'> & {
+    findings: CompatibilityFinding[];
+    evidence: StandardsEvidenceReference[];
+}): StandardsCompatibilityAttestation;

package/dist/standards/compatibility-attestation.js

@@ -0,0 +1,40 @@
+const bumpRank = { none: 0, patch: 1, minor: 2, major: 3 };
+function semanticVersionParts(version) {
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:-[0-9A-Za-z.-]+)?$/u.exec(version);
+  if (!match) throw new Error(`Invalid semantic version "${version}".`);
+  return { major: Number(match[1]), minor: Number(match[2]), patch: Number(match[3]) };
+}
+function declaredSemanticBump(baselineVersion, candidateVersion) {
+  const baseline = semanticVersionParts(baselineVersion);
+  const candidate = semanticVersionParts(candidateVersion);
+  if (candidate.major < baseline.major || candidate.major === baseline.major && candidate.minor < baseline.minor || candidate.major === baseline.major && candidate.minor === baseline.minor && candidate.patch < baseline.patch) {
+    throw new Error(`Candidate version ${candidateVersion} cannot precede baseline ${baselineVersion}.`);
+  }
+  if (candidate.major > baseline.major) return "major";
+  if (candidate.minor > baseline.minor) return "minor";
+  if (candidate.patch > baseline.patch) return "patch";
+  return "none";
+}
+function requiredSemanticBump(classification, baselineVersion) {
+  if (classification === "breaking") return baselineVersion && semanticVersionParts(baselineVersion).major === 0 ? "minor" : "major";
+  if (classification === "compatible_addition") return "minor";
+  return "patch";
+}
+function semanticBumpResult(classification, declared, baselineVersion) {
+  const required = requiredSemanticBump(classification, baselineVersion);
+  return { classification, required, declared, sufficient: bumpRank[declared] >= bumpRank[required] };
+}
+function createCompatibilityAttestation(input) {
+  return {
+    ...input,
+    schemaVersion: 1,
+    findings: [...input.findings].sort((left, right) => `${left.path}:${left.code}`.localeCompare(`${right.path}:${right.code}`)),
+    evidence: [...input.evidence].sort((left, right) => `${left.kind}:${left.uri}`.localeCompare(`${right.kind}:${right.uri}`))
+  };
+}
+export {
+  createCompatibilityAttestation,
+  declaredSemanticBump,
+  requiredSemanticBump,
+  semanticBumpResult
+};

package/dist/standards/composition.d.ts

@@ -0,0 +1,15 @@
+import type { StandardsDigest } from './contracts.js';
+export interface StandardsCompositionMember {
+    packageName: string;
+    packageVersion: string;
+    sourceCommit: string;
+    packageDigest: StandardsDigest;
+    contractBundleDigest: StandardsDigest;
+    compatibilityAttestationDigests: StandardsDigest[];
+}
+export interface StandardsComposition {
+    schemaVersion: 1;
+    id: string;
+    members: StandardsCompositionMember[];
+}
+export declare function createStandardsComposition(input: Omit<StandardsComposition, 'schemaVersion'>): StandardsComposition;

package/dist/standards/composition.js

@@ -0,0 +1,14 @@
+import { StandardsError } from "./errors.js";
+function createStandardsComposition(input) {
+  const names = input.members.map((member) => member.packageName);
+  const duplicate = names.find((name, index) => names.indexOf(name) !== index);
+  if (duplicate) throw new StandardsError("standards_duplicate_identity", `Duplicate composition package: ${duplicate}.`, "members");
+  const members = [...input.members].sort((left, right) => left.packageName.localeCompare(right.packageName)).map((member) => ({
+    ...member,
+    compatibilityAttestationDigests: [...member.compatibilityAttestationDigests].sort()
+  }));
+  return { schemaVersion: 1, id: input.id, members };
+}
+export {
+  createStandardsComposition
+};

package/dist/standards/contract-bundle.d.ts

@@ -0,0 +1,8 @@
+import type { StandardsContractDescriptor, StandardsEvidenceReference, StandardsPackageIdentity } from './contracts.js';
+export interface StandardsContractBundle {
+    schemaVersion: 1;
+    package: StandardsPackageIdentity;
+    contracts: StandardsContractDescriptor[];
+    evidence: StandardsEvidenceReference[];
+}
+export declare function createStandardsContractBundle(input: Omit<StandardsContractBundle, 'schemaVersion'>): StandardsContractBundle;

package/dist/standards/contract-bundle.js

@@ -0,0 +1,23 @@
+import { StandardsError } from "./errors.js";
+function requireUnique(values, path) {
+  const duplicate = values.find((value, index) => values.indexOf(value) !== index);
+  if (duplicate) throw new StandardsError("standards_duplicate_identity", `Duplicate standards identity: ${duplicate}.`, path);
+}
+function sortedUnique(values, path) {
+  requireUnique(values, path);
+  return [...values].sort();
+}
+function createStandardsContractBundle(input) {
+  requireUnique(input.contracts.map((contract) => contract.id), "contracts");
+  const contracts = [...input.contracts].sort((left, right) => left.id.localeCompare(right.id)).map((contract) => ({
+    ...contract,
+    entrypoints: sortedUnique(contract.entrypoints, `contracts.${contract.id}.entrypoints`),
+    guarantees: sortedUnique(contract.guarantees, `contracts.${contract.id}.guarantees`),
+    deprecations: sortedUnique(contract.deprecations, `contracts.${contract.id}.deprecations`)
+  }));
+  const evidence = [...input.evidence].sort((left, right) => `${left.kind}:${left.uri}`.localeCompare(`${right.kind}:${right.uri}`));
+  return { schemaVersion: 1, package: { ...input.package }, contracts, evidence };
+}
+export {
+  createStandardsContractBundle
+};

package/dist/standards/contracts.d.ts

@@ -0,0 +1,39 @@
+export type StandardsDigest = `sha256:${string}`;
+export type StandardsContractFamily = 'typescript' | 'openapi' | 'json-schema' | 'behavioral';
+export type CompatibilityClassification = 'unchanged' | 'compatible_addition' | 'breaking';
+export type SemanticVersionRequirement = 'none' | 'patch' | 'minor' | 'major';
+export interface StandardsEvidenceReference {
+    kind: 'source' | 'artifact' | 'test' | 'provider_receipt';
+    uri: string;
+    digest?: StandardsDigest;
+}
+export interface StandardsArtifactReference {
+    path: string;
+    mediaType: string;
+    digest: StandardsDigest;
+}
+export interface StandardsPackageIdentity {
+    name: string;
+    version: string;
+    sourceCommit: string;
+    artifactDigest: StandardsDigest;
+}
+export interface StandardsContractDescriptor {
+    id: string;
+    family: StandardsContractFamily;
+    version: string;
+    artifact: StandardsArtifactReference;
+    entrypoints: string[];
+    guarantees: string[];
+    deprecations: string[];
+}
+export interface StandardsFingerprint {
+    algorithm: 'sha256';
+    digest: StandardsDigest;
+}
+export interface SemanticBumpResult {
+    classification: CompatibilityClassification;
+    required: SemanticVersionRequirement;
+    declared: SemanticVersionRequirement;
+    sufficient: boolean;
+}

package/dist/standards/errors.d.ts

@@ -0,0 +1,6 @@
+export type StandardsErrorCode = 'standards_invalid_contract' | 'standards_invalid_digest_input' | 'standards_invalid_semantic_version' | 'standards_duplicate_identity';
+export declare class StandardsError extends Error {
+    readonly code: StandardsErrorCode;
+    readonly path?: string;
+    constructor(code: StandardsErrorCode, message: string, path?: string);
+}

package/dist/standards/errors.js

@@ -0,0 +1,13 @@
+class StandardsError extends Error {
+  code;
+  path;
+  constructor(code, message, path) {
+    super(message);
+    this.name = "StandardsError";
+    this.code = code;
+    this.path = path;
+  }
+}
+export {
+  StandardsError
+};

package/dist/standards/index.d.ts

@@ -0,0 +1,8 @@
+export * from './canonicalize.js';
+export * from './compatibility-attestation.js';
+export * from './composition.js';
+export * from './contract-bundle.js';
+export * from './contracts.js';
+export * from './errors.js';
+export * from './portfolio-entry.js';
+export * from './package-manifest.js';

package/dist/standards/index.js

@@ -0,0 +1,8 @@
+export * from "./canonicalize.js";
+export * from "./compatibility-attestation.js";
+export * from "./composition.js";
+export * from "./contract-bundle.js";
+export * from "./contracts.js";
+export * from "./errors.js";
+export * from "./portfolio-entry.js";
+export * from "./package-manifest.js";