@treeseed/sdk 0.13.0-rc.1 → 0.13.0-rc.3

package/dist/agent-capacity/contracts/index.d.ts

@@ -14,7 +14,6 @@ export * from './support/failure-records.js';
 export * from './support/financial-records.js';
 export * from './support/time-capacity.js';
 export * from './support/authority/execution-mode.js';
-export * from './support/operator-surface.js';
 export * from './support/planning-records.js';
 export * from './support/research-citation.js';
 export * from './support/research-source-policy.js';

package/dist/agent-capacity/contracts/index.js

@@ -14,7 +14,6 @@ export * from "./support/failure-records.js";
 export * from "./support/financial-records.js";
 export * from "./support/time-capacity.js";
 export * from "./support/authority/execution-mode.js";
-export * from "./support/operator-surface.js";
 export * from "./support/planning-records.js";
 export * from "./support/research-citation.js";
 export * from "./support/research-source-policy.js";

package/dist/capacity/agents/agent-capacity.d.ts

@@ -1,2 +1,36 @@
 export type { AgentKernelPolicy, AgentKernelProfile, ProjectAgentClass, ProjectAgentClassStatus } from '../../agent-capacity/contracts/projects/agents/project-agent-class.js';
-export * from '../../agent-capacity/index.js';
+export * from '../../agent-capacity/allocation.js';
+export * from '../../agent-capacity/artifacts.js';
+export { deriveAgentRuntimeStatus } from '../../agent-capacity/authoring/agent-definition-authoring.js';
+export { compileDefaultChatActivityProfile } from '../../agent-capacity/authoring/chat-activity-profile.js';
+export { validateGroupDefinition, validateGroupEdgeDefinition } from '../../agent-capacity/authoring/group-definition-authoring.js';
+export * from '../../agent-capacity/authority/agent-authority-presets.js';
+export * from '../../agent-capacity/authority/assignment-authority-probe.js';
+export * from '../../agent-capacity/artifact-mutation-receipt.js';
+export * from '../../agent-capacity/cooperative-planning.js';
+export * from '../../agent-capacity/planning-graph.js';
+export * from '../../agent-capacity/policy/index.js';
+export * from '../../agent-capacity/validation/index.js';
+export * from '../../agent-capacity/workday.js';
+export * from '../../agent-capacity/contracts/capacity/assignments/assignment-records.js';
+export * from '../../agent-capacity/contracts/capacity/communication/communication-records.js';
+export * from '../../agent-capacity/contracts/capacity/providers/supply-policy.js';
+export * from '../../agent-capacity/contracts/capacity/workdays/workday-records.js';
+export * from '../../agent-capacity/contracts/configuration/configuration.js';
+export * from '../../agent-capacity/contracts/operations/research-workflow.js';
+export * from '../../agent-capacity/contracts/operations/workflow-promotion.js';
+export * from '../../agent-capacity/contracts/projects/agents/project-agent-class.js';
+export * from '../../agent-capacity/contracts/runtime/runtime-observability.js';
+export * from '../../agent-capacity/contracts/support/decision-work.js';
+export * from '../../agent-capacity/contracts/support/agent-lab-monitoring.js';
+export * from '../../agent-capacity/contracts/support/agent-atlas.js';
+export * from '../../agent-capacity/contracts/support/failure-records.js';
+export * from '../../agent-capacity/contracts/support/financial-records.js';
+export * from '../../agent-capacity/contracts/support/time-capacity.js';
+export * from '../../agent-capacity/contracts/support/authority/execution-mode.js';
+export * from '../../agent-capacity/contracts/support/planning-records.js';
+export * from '../../agent-capacity/contracts/support/research-citation.js';
+export * from '../../agent-capacity/contracts/support/research-source-policy.js';
+export * from '../../governance/groups/contracts.js';
+export * from '../../governance/groups/membership.js';
+export * from '../../governance/groups/signal-scope.js';

package/dist/capacity/agents/agent-capacity.js

@@ -1 +1,41 @@
-export * from "../../agent-capacity/index.js";
+export * from "../../agent-capacity/allocation.js";
+export * from "../../agent-capacity/artifacts.js";
+import { deriveAgentRuntimeStatus } from "../../agent-capacity/authoring/agent-definition-authoring.js";
+import { compileDefaultChatActivityProfile } from "../../agent-capacity/authoring/chat-activity-profile.js";
+import { validateGroupDefinition, validateGroupEdgeDefinition } from "../../agent-capacity/authoring/group-definition-authoring.js";
+export * from "../../agent-capacity/authority/agent-authority-presets.js";
+export * from "../../agent-capacity/authority/assignment-authority-probe.js";
+export * from "../../agent-capacity/artifact-mutation-receipt.js";
+export * from "../../agent-capacity/cooperative-planning.js";
+export * from "../../agent-capacity/planning-graph.js";
+export * from "../../agent-capacity/policy/index.js";
+export * from "../../agent-capacity/validation/index.js";
+export * from "../../agent-capacity/workday.js";
+export * from "../../agent-capacity/contracts/capacity/assignments/assignment-records.js";
+export * from "../../agent-capacity/contracts/capacity/communication/communication-records.js";
+export * from "../../agent-capacity/contracts/capacity/providers/supply-policy.js";
+export * from "../../agent-capacity/contracts/capacity/workdays/workday-records.js";
+export * from "../../agent-capacity/contracts/configuration/configuration.js";
+export * from "../../agent-capacity/contracts/operations/research-workflow.js";
+export * from "../../agent-capacity/contracts/operations/workflow-promotion.js";
+export * from "../../agent-capacity/contracts/projects/agents/project-agent-class.js";
+export * from "../../agent-capacity/contracts/runtime/runtime-observability.js";
+export * from "../../agent-capacity/contracts/support/decision-work.js";
+export * from "../../agent-capacity/contracts/support/agent-lab-monitoring.js";
+export * from "../../agent-capacity/contracts/support/agent-atlas.js";
+export * from "../../agent-capacity/contracts/support/failure-records.js";
+export * from "../../agent-capacity/contracts/support/financial-records.js";
+export * from "../../agent-capacity/contracts/support/time-capacity.js";
+export * from "../../agent-capacity/contracts/support/authority/execution-mode.js";
+export * from "../../agent-capacity/contracts/support/planning-records.js";
+export * from "../../agent-capacity/contracts/support/research-citation.js";
+export * from "../../agent-capacity/contracts/support/research-source-policy.js";
+export * from "../../governance/groups/contracts.js";
+export * from "../../governance/groups/membership.js";
+export * from "../../governance/groups/signal-scope.js";
+export {
+  compileDefaultChatActivityProfile,
+  deriveAgentRuntimeStatus,
+  validateGroupDefinition,
+  validateGroupEdgeDefinition
+};

package/dist/market-client/projects/agents/contracts/agent-deployments.d.ts

@@ -1,5 +1,5 @@
 import { MarketClient } from '../../../../entrypoints/clients/market-client.js';
-import type { AgentDeploymentBindings } from '../../../../agent-capacity/index.js';
+import type { AgentDeploymentBindings } from '../../../../agent-capacity/authoring/agent-deployment.js';
 export type AgentDeploymentRequest = {
     sourceProjectId: string;
     targetProjectId: string;

package/dist/operator-contracts/canonical-command-tree.d.ts

@@ -0,0 +1,3 @@
+import type { CommandTreeDescriptor } from './command-tree.js';
+export declare const TREESEED_COMMAND_TREE_V1: CommandTreeDescriptor;
+export declare function listCommandPaths(tree?: CommandTreeDescriptor): string[];

package/dist/operator-contracts/canonical-command-tree.js

@@ -0,0 +1,81 @@
+const planOption = { name: "--plan", description: "Return the exact proposed outcome without mutation.", type: "boolean" };
+function leaf(segment, kind = "read", argument, confirmation = "never") {
+  const value = {
+    segment,
+    description: `${segment[0].toUpperCase()}${segment.slice(1)} the selected resource.`,
+    kind,
+    arguments: argument ? [{ name: argument, description: `${argument} identity or path.`, required: true }] : void 0,
+    options: kind === "mutation" ? [planOption] : void 0,
+    authorization: kind === "mutation" ? { capability: `command.${segment}`, confirmation } : void 0,
+    resultSchemaId: `treeseed.command.${segment}/v1`
+  };
+  return { nodeType: "leaf", ...value };
+}
+function branch(segment, children) {
+  return { nodeType: "branch", segment, description: `${segment[0].toUpperCase()}${segment.slice(1)} operations.`, children };
+}
+const TREESEED_COMMAND_TREE_V1 = {
+  schemaVersion: "treeseed.command-tree/v1",
+  executable: "trsd",
+  commands: [
+    branch("auth", [leaf("login", "mutation", void 0, "credential"), leaf("logout", "mutation"), leaf("status")]),
+    branch("secrets", [leaf("list"), leaf("status"), leaf("unlock", "mutation", void 0, "credential"), leaf("lock", "mutation"), leaf("rotate", "mutation", void 0, "credential")]),
+    branch("agents", [
+      leaf("list"),
+      leaf("show", "read", "agent"),
+      leaf("validate"),
+      leaf("diff"),
+      leaf("diagnose"),
+      branch("classes", [leaf("list"), leaf("show", "read", "class")]),
+      branch("bindings", [leaf("list"), leaf("show", "read", "binding"), leaf("explain", "read", "binding")])
+    ]),
+    branch("providers", [
+      leaf("list"),
+      leaf("show", "read", "provider"),
+      leaf("status", "read", "provider"),
+      leaf("diagnose", "read", "provider"),
+      leaf("connect", "mutation", void 0, "credential"),
+      leaf("disconnect", "mutation", "connection", "destructive"),
+      branch("requests", [leaf("list"), leaf("show", "read", "request"), leaf("approve", "mutation", "request", "authority"), leaf("reject", "mutation", "request", "authority")]),
+      branch("credentials", [leaf("status", "read", "connection"), leaf("rotate", "mutation", "connection", "credential"), leaf("revoke", "mutation", "connection", "irreversible")]),
+      branch("offers", [leaf("show", "read", "connection"), leaf("validate", "read", "file"), leaf("plan", "read", "file"), leaf("apply", "mutation", "file", "authority")])
+    ]),
+    branch("capacity", [leaf("status"), leaf("explain"), leaf("usage"), leaf("ledger"), leaf("audit")]),
+    branch("plans", [leaf("list"), leaf("show", "read", "plan"), leaf("explain", "read", "plan"), { nodeType: "leaf", segment: "diff", description: "Compare two API-derived plans.", kind: "read", arguments: [{ name: "left", description: "Left plan identity.", required: true }, { name: "right", description: "Right plan identity.", required: true }], resultSchemaId: "treeseed.command.plans.diff/v1" }]),
+    branch("workdays", [
+      branch("profiles", [leaf("list"), leaf("show", "read", "profile"), leaf("validate", "read", "file")]),
+      leaf("plan"),
+      leaf("start", "mutation", void 0, "authority"),
+      leaf("list"),
+      leaf("show", "read", "workday"),
+      leaf("watch", "read", "workday"),
+      leaf("pause", "mutation", "workday", "authority"),
+      leaf("resume", "mutation", "workday", "authority"),
+      leaf("stop", "mutation", "workday", "destructive"),
+      leaf("cancel", "mutation", "workday", "destructive"),
+      branch("schedules", [leaf("list"), leaf("show", "read", "schedule"), leaf("plan"), leaf("start", "mutation", void 0, "authority"), leaf("pause", "mutation", "schedule", "authority"), leaf("resume", "mutation", "schedule", "authority"), leaf("retire", "mutation", "schedule", "destructive")])
+    ]),
+    branch("assignments", [leaf("list"), leaf("show", "read", "assignment"), leaf("explain", "read", "assignment"), leaf("watch", "read", "assignment"), leaf("retry", "mutation", "assignment", "authority"), leaf("cancel", "mutation", "assignment", "destructive"), leaf("artifacts", "read", "assignment")]),
+    leaf("save", "mutation"),
+    leaf("stage", "mutation", void 0, "authority"),
+    leaf("release", "mutation", void 0, "production"),
+    leaf("status"),
+    leaf("diagnose")
+  ]
+};
+function listCommandPaths(tree = TREESEED_COMMAND_TREE_V1) {
+  const paths = [];
+  const visit = (nodes, parent) => {
+    for (const node of nodes) {
+      const path = [...parent, node.segment];
+      if (node.nodeType === "leaf") paths.push(path.join(" "));
+      else visit(node.children, path);
+    }
+  };
+  visit(tree.commands, []);
+  return paths;
+}
+export {
+  TREESEED_COMMAND_TREE_V1,
+  listCommandPaths
+};

package/dist/operator-contracts/command-tree.d.ts

@@ -0,0 +1,79 @@
+export type CommandOperationKind = 'read' | 'mutation';
+export type CommandExecutionMode = 'execute' | 'plan';
+export type CommandErrorCategory = 'unknown_command' | 'invalid_input' | 'ambiguous_context' | 'authentication_required' | 'authorization_denied' | 'confirmation_required' | 'policy_blocked' | 'stale_preflight' | 'conflict' | 'not_found' | 'provider_unavailable' | 'rate_limited' | 'internal_error';
+export interface CommandArgumentDescriptor {
+    name: string;
+    description: string;
+    required: boolean;
+    multiple?: boolean;
+}
+export interface CommandOptionDescriptor {
+    name: `--${string}`;
+    description: string;
+    type: 'boolean' | 'string' | 'number' | 'string[]';
+    required?: boolean;
+    defaultValue?: boolean | string | number | string[];
+    sensitive?: boolean;
+}
+export interface CommandAuthorizationDescriptor {
+    capability: string;
+    confirmation: 'never' | 'destructive' | 'credential' | 'authority' | 'production' | 'irreversible';
+}
+export interface CommandLeafDescriptor {
+    segment: string;
+    description: string;
+    kind: CommandOperationKind;
+    arguments?: CommandArgumentDescriptor[];
+    options?: CommandOptionDescriptor[];
+    authorization?: CommandAuthorizationDescriptor;
+    resultSchemaId: string;
+}
+export interface CommandBranchDescriptor {
+    segment: string;
+    description: string;
+    children: CommandNodeDescriptor[];
+}
+export type CommandNodeDescriptor = ({
+    nodeType: 'branch';
+} & CommandBranchDescriptor) | ({
+    nodeType: 'leaf';
+} & CommandLeafDescriptor);
+export interface CommandTreeDescriptor {
+    schemaVersion: 'treeseed.command-tree/v1';
+    executable: 'trsd';
+    commands: CommandNodeDescriptor[];
+}
+export interface CommandBlocker {
+    code: string;
+    message: string;
+    path?: string;
+}
+export interface CommandReceiptReference {
+    kind: string;
+    id: string;
+    digest?: string;
+    uri?: string;
+}
+export interface CommandResultEnvelope<TResult = unknown> {
+    schemaVersion: 'treeseed.command-result/v1';
+    commandPath: string[];
+    mode: CommandExecutionMode;
+    ok: boolean;
+    result: TResult | null;
+    error: {
+        category: CommandErrorCategory;
+        code: string;
+        message: string;
+    } | null;
+    warnings: string[];
+    blockers: CommandBlocker[];
+    receipts: CommandReceiptReference[];
+    nextActions: string[];
+}
+export interface CommandTreeDiagnostic {
+    code: string;
+    path: string;
+    message: string;
+}
+export declare function validateCommandTree(tree: CommandTreeDescriptor): CommandTreeDiagnostic[];
+export declare function createCommandResult<TResult>(input: Omit<CommandResultEnvelope<TResult>, 'schemaVersion'>): CommandResultEnvelope<TResult>;

package/dist/operator-contracts/command-tree.js

@@ -0,0 +1,53 @@
+const SEGMENT = /^[a-z][a-z0-9]*$/;
+const FORBIDDEN_AGENT_MANAGEMENT_OPTIONS = /* @__PURE__ */ new Set([
+  "--commit",
+  "--commit-sha",
+  "--source-ref",
+  "--expected-base",
+  "--expected-commit",
+  "--branch",
+  "--checkpoint",
+  "--integration"
+]);
+function validateCommandTree(tree) {
+  const diagnostics = [];
+  if (tree.schemaVersion !== "treeseed.command-tree/v1") diagnostics.push({ code: "schema_version_invalid", path: "schemaVersion", message: "Command tree schemaVersion must be treeseed.command-tree/v1." });
+  if (tree.executable !== "trsd") diagnostics.push({ code: "executable_invalid", path: "executable", message: "trsd is the only public executable." });
+  const visit = (nodes, parent) => {
+    const segments = /* @__PURE__ */ new Set();
+    for (const [index, node] of nodes.entries()) {
+      const path = [...parent, node.segment];
+      const diagnosticPath = `commands.${path.join(".")}`;
+      if (!SEGMENT.test(node.segment)) diagnostics.push({ code: "command_segment_invalid", path: diagnosticPath, message: "Command path segments must be lowercase alphanumeric words without colons or hyphens." });
+      if (segments.has(node.segment)) diagnostics.push({ code: "command_path_duplicate", path: diagnosticPath, message: `Duplicate command segment ${node.segment}.` });
+      segments.add(node.segment);
+      const raw = node;
+      if ("alias" in raw || "aliases" in raw) diagnostics.push({ code: "command_alias_forbidden", path: diagnosticPath, message: "Public command aliases are forbidden." });
+      if (node.nodeType === "branch") {
+        if ("kind" in raw || "resultSchemaId" in raw || "options" in raw || "arguments" in raw) diagnostics.push({ code: "command_node_ambiguous", path: diagnosticPath, message: "Intermediate command nodes cannot also declare leaf behavior." });
+        if (!Array.isArray(node.children) || node.children.length === 0) diagnostics.push({ code: "command_branch_empty", path: diagnosticPath, message: "Intermediate command nodes must contain at least one child." });
+        visit(node.children ?? [], path);
+        continue;
+      }
+      if ("children" in raw) diagnostics.push({ code: "command_node_ambiguous", path: diagnosticPath, message: "Leaf command nodes cannot contain child commands." });
+      if (!node.resultSchemaId.trim()) diagnostics.push({ code: "result_schema_required", path: `${diagnosticPath}.resultSchemaId`, message: "Leaf commands require a stable result schema." });
+      const optionNames = /* @__PURE__ */ new Set();
+      for (const option of node.options ?? []) {
+        if (optionNames.has(option.name)) diagnostics.push({ code: "command_option_duplicate", path: `${diagnosticPath}.options.${index}`, message: `Duplicate option ${option.name}.` });
+        optionNames.add(option.name);
+        if (option.name === "--execute") diagnostics.push({ code: "execute_option_forbidden", path: `${diagnosticPath}.options.${option.name}`, message: "Mutations execute by default; --plan is the only dry-run switch." });
+        if (parent[0] === "agents" && FORBIDDEN_AGENT_MANAGEMENT_OPTIONS.has(option.name)) diagnostics.push({ code: "agent_internal_option_forbidden", path: `${diagnosticPath}.options.${option.name}`, message: "Agent management commands cannot expose repository integration mechanics." });
+      }
+      if (node.kind === "mutation" && !optionNames.has("--plan")) diagnostics.push({ code: "mutation_plan_option_required", path: `${diagnosticPath}.options`, message: "Every mutation must expose universal zero-mutation --plan mode." });
+    }
+  };
+  visit(tree.commands, []);
+  return diagnostics;
+}
+function createCommandResult(input) {
+  return { schemaVersion: "treeseed.command-result/v1", ...input };
+}
+export {
+  createCommandResult,
+  validateCommandTree
+};

package/dist/operator-contracts/index.d.ts

@@ -0,0 +1,4 @@
+export * from './command-tree.js';
+export * from './canonical-command-tree.js';
+export * from './workday-profile.js';
+export * from './workday-lifecycle.js';

package/dist/operator-contracts/index.js

@@ -0,0 +1,4 @@
+export * from "./command-tree.js";
+export * from "./canonical-command-tree.js";
+export * from "./workday-profile.js";
+export * from "./workday-lifecycle.js";

package/dist/operator-contracts/workday-lifecycle.d.ts

@@ -0,0 +1,157 @@
+import { type WorkdayBorrowingEvidence } from './workday-profile.js';
+export type WorkdayDemandMode = 'planning' | 'acting';
+export interface WorkdayIntent {
+    schemaVersion: 'treeseed.workday-intent/v1';
+    teamId: string;
+    profileId: string;
+    projects: 'all' | string[];
+    startsAt: string;
+    endsAt?: string;
+    durationSeconds?: number;
+    objectiveFilters?: string[];
+    operatorConstraints?: {
+        providerIds?: string[];
+        maxConcurrency?: number;
+        reservePercent?: number;
+    };
+}
+export interface WorkdayActingAuthorityEvidence {
+    decisionId: string;
+    decisionStatus: 'approved';
+    executionInputId: string;
+    executionInputStatus: 'accepted';
+    estimateId: string;
+    capacityPlanId: string;
+    capacityPlanDigest: string;
+}
+export interface WorkdaySelectedDemand {
+    id: string;
+    projectId: string;
+    sourceType: string;
+    sourceId: string;
+    mode: WorkdayDemandMode;
+    classSlug: string;
+    requestedSeconds: number;
+    priority: number;
+    actingAuthority?: WorkdayActingAuthorityEvidence;
+}
+export interface WorkdayClassAccounting {
+    classSlug: string;
+    allocatedSeconds: number;
+    borrowedSeconds: number;
+    lentSeconds: number;
+    idleSeconds: number;
+    reservedSeconds: number;
+    activeSeconds: number;
+    releasedSeconds: number;
+    overrunSeconds: number;
+}
+export interface WorkdayPreflightReceipt {
+    schemaVersion: 'treeseed.workday-preflight/v1';
+    id: string;
+    teamId: string;
+    intentDigest: string;
+    profileId: string;
+    profileVersion: string;
+    profileGeneration: number;
+    profileDigest: string;
+    demandSetDigest: string;
+    providerCapacityDigest: string;
+    authorizationDigest: string;
+    reservationDigest: string;
+    selectedDemands: WorkdaySelectedDemand[];
+    classAccounting: WorkdayClassAccounting[];
+    borrowing: WorkdayBorrowingEvidence[];
+    startsAt: string;
+    endsAt: string;
+    maxConcurrency: number;
+    reserveSeconds: number;
+    preflightDigest: string;
+    expiresAt: string;
+}
+export interface WorkdayPreflightObservation {
+    profileGeneration: number;
+    profileDigest: string;
+    demandSetDigest: string;
+    providerCapacityDigest: string;
+    authorizationDigest: string;
+    reservationDigest: string;
+}
+export interface WorkdayStartRequest {
+    preflightId: string;
+    preflightDigest: string;
+    idempotencyKey: string;
+}
+export interface WorkdayStartReceipt {
+    schemaVersion: 'treeseed.workday-start-receipt/v1';
+    workdayId: string;
+    preflightId: string;
+    preflightDigest: string;
+    acceptedCapacityPlanIds: string[];
+    assignmentIds: string[];
+    reservationIds: string[];
+    startedAt: string;
+    providerReceiptRefs: string[];
+    transactionReceiptId: string;
+}
+export interface WorkdaySchedule {
+    schemaVersion: 'treeseed.workday-schedule/v1';
+    id: string;
+    teamId: string;
+    profileId: string;
+    profileVersion: string;
+    projectScope: 'all' | string[];
+    cadence: {
+        timezone: string;
+        expression: string;
+    };
+    durationSeconds: number;
+    status: 'active' | 'paused' | 'retired';
+    nextStartAt: string | null;
+}
+export interface WorkdaySettlement {
+    schemaVersion: 'treeseed.workday-settlement/v1';
+    workdayId: string;
+    status: 'completed' | 'cancelled' | 'failed' | 'degraded';
+    preflightDigest: string;
+    classAccounting: WorkdayClassAccounting[];
+    assignmentIds: string[];
+    releasedReservationIds: string[];
+    artifactRefs: string[];
+    startedAt: string;
+    completedAt: string;
+    settlementDigest: string;
+}
+export interface RepositoryProfileGenerationReceipt {
+    schemaVersion: 'treeseed.repository-profile-generation/v1';
+    repository: string;
+    ref: string;
+    commit: string;
+    path: string;
+    profileId: string;
+    profileVersion: string;
+    profileDigest: string;
+    generation: number;
+    indexedAt: string;
+}
+export interface RepositoryProfileReconciliationReceipt {
+    schemaVersion: 'treeseed.repository-profile-reconciliation/v1';
+    repository: string;
+    observedCommit: string;
+    previousGeneration: number | null;
+    acceptedGeneration: number;
+    profileDigests: string[];
+    status: 'created' | 'updated' | 'unchanged' | 'rejected';
+    diagnostics: string[];
+    receiptDigest: string;
+}
+export interface WorkdayLifecycleDiagnostic {
+    code: string;
+    path: string;
+    message: string;
+}
+export declare function validateWorkdayIntent(intent: WorkdayIntent): WorkdayLifecycleDiagnostic[];
+export declare function validateSelectedDemand(demand: WorkdaySelectedDemand): WorkdayLifecycleDiagnostic[];
+export declare function validateWorkdayPreflight(receipt: WorkdayPreflightReceipt, now?: Date): WorkdayLifecycleDiagnostic[];
+export declare function validateWorkdayPreflightFreshness(receipt: WorkdayPreflightReceipt, observed: WorkdayPreflightObservation): WorkdayLifecycleDiagnostic[];
+export declare function validateWorkdaySettlement(settlement: WorkdaySettlement): WorkdayLifecycleDiagnostic[];

package/dist/operator-contracts/workday-lifecycle.js

@@ -0,0 +1,65 @@
+import { validateWorkdayBorrowingEvidence } from "./workday-profile.js";
+function validateWorkdayIntent(intent) {
+  const diagnostics = [];
+  if (intent.schemaVersion !== "treeseed.workday-intent/v1") diagnostics.push({ code: "schema_version_invalid", path: "schemaVersion", message: "Unsupported workday intent schema." });
+  if (!intent.teamId.trim()) diagnostics.push({ code: "team_required", path: "teamId", message: "Team identity is required." });
+  if (!intent.profileId.trim()) diagnostics.push({ code: "profile_required", path: "profileId", message: "Allocation profile identity is required." });
+  if (intent.endsAt === void 0 === (intent.durationSeconds === void 0)) diagnostics.push({ code: "time_range_ambiguous", path: "endsAt", message: "Specify exactly one of endsAt or durationSeconds." });
+  const start = Date.parse(intent.startsAt);
+  if (!Number.isFinite(start)) diagnostics.push({ code: "start_invalid", path: "startsAt", message: "startsAt must be an ISO timestamp." });
+  if (intent.endsAt !== void 0 && (!Number.isFinite(Date.parse(intent.endsAt)) || Date.parse(intent.endsAt) <= start)) diagnostics.push({ code: "end_invalid", path: "endsAt", message: "endsAt must be a valid timestamp after startsAt." });
+  if (intent.durationSeconds !== void 0 && (!Number.isInteger(intent.durationSeconds) || intent.durationSeconds <= 0)) diagnostics.push({ code: "duration_invalid", path: "durationSeconds", message: "durationSeconds must be a positive integer." });
+  return diagnostics;
+}
+function validateSelectedDemand(demand) {
+  const diagnostics = [];
+  if (demand.requestedSeconds <= 0 || !Number.isInteger(demand.requestedSeconds)) diagnostics.push({ code: "requested_seconds_invalid", path: "requestedSeconds", message: "Demand duration must be a positive integer." });
+  if (demand.mode === "acting" && !demand.actingAuthority) diagnostics.push({ code: "acting_authority_required", path: "actingAuthority", message: "Acting demand requires approved decision, accepted execution input, estimate, and API-derived capacity plan evidence." });
+  if (demand.mode === "acting" && demand.actingAuthority && (demand.actingAuthority.decisionStatus !== "approved" || demand.actingAuthority.executionInputStatus !== "accepted")) diagnostics.push({ code: "acting_authority_invalid", path: "actingAuthority", message: "Acting authority must bind an approved decision and accepted execution input." });
+  if (demand.mode === "acting" && demand.actingAuthority && [demand.actingAuthority.decisionId, demand.actingAuthority.executionInputId, demand.actingAuthority.estimateId, demand.actingAuthority.capacityPlanId, demand.actingAuthority.capacityPlanDigest].some((value) => !value.trim())) diagnostics.push({ code: "acting_authority_identity_missing", path: "actingAuthority", message: "Acting authority must bind non-empty decision, execution, estimate, capacity-plan, and plan-digest identities." });
+  return diagnostics;
+}
+function validateWorkdayPreflight(receipt, now = /* @__PURE__ */ new Date()) {
+  const diagnostics = receipt.selectedDemands.flatMap((demand, index) => validateSelectedDemand(demand).map((diagnostic) => ({ ...diagnostic, path: `selectedDemands.${index}.${diagnostic.path}` })));
+  if (receipt.schemaVersion !== "treeseed.workday-preflight/v1") diagnostics.push({ code: "schema_version_invalid", path: "schemaVersion", message: "Unsupported workday preflight schema." });
+  if (!Number.isInteger(receipt.profileGeneration) || receipt.profileGeneration <= 0) diagnostics.push({ code: "profile_generation_invalid", path: "profileGeneration", message: "Profile generation must be a positive integer." });
+  for (const field of ["intentDigest", "profileDigest", "demandSetDigest", "providerCapacityDigest", "authorizationDigest", "reservationDigest", "preflightDigest"]) {
+    if (!receipt[field].trim()) diagnostics.push({ code: "digest_required", path: field, message: `${field} is required.` });
+  }
+  const expiry = Date.parse(receipt.expiresAt);
+  if (!Number.isFinite(expiry)) diagnostics.push({ code: "preflight_expiry_invalid", path: "expiresAt", message: "Preflight expiry must be a valid timestamp." });
+  else if (expiry <= now.getTime()) diagnostics.push({ code: "preflight_expired", path: "expiresAt", message: "Workday preflight has expired and must be regenerated." });
+  if (!Number.isFinite(Date.parse(receipt.startsAt)) || !Number.isFinite(Date.parse(receipt.endsAt)) || Date.parse(receipt.endsAt) <= Date.parse(receipt.startsAt)) diagnostics.push({ code: "preflight_time_range_invalid", path: "endsAt", message: "Preflight must bind a valid time range." });
+  if (!Number.isInteger(receipt.maxConcurrency) || receipt.maxConcurrency <= 0) diagnostics.push({ code: "preflight_concurrency_invalid", path: "maxConcurrency", message: "Preflight concurrency must be a positive integer." });
+  if (!Number.isFinite(receipt.reserveSeconds) || receipt.reserveSeconds < 0) diagnostics.push({ code: "preflight_reserve_invalid", path: "reserveSeconds", message: "Preflight reserve seconds must be finite and non-negative." });
+  for (const [index, evidence] of receipt.borrowing.entries()) diagnostics.push(...validateWorkdayBorrowingEvidence(evidence).map((diagnostic) => ({ ...diagnostic, path: `borrowing.${index}.${diagnostic.path}` })));
+  if (new Set(receipt.selectedDemands.map((demand) => demand.id)).size !== receipt.selectedDemands.length) diagnostics.push({ code: "preflight_demand_duplicate", path: "selectedDemands", message: "Preflight demand identities must be unique." });
+  return diagnostics;
+}
+function validateWorkdayPreflightFreshness(receipt, observed) {
+  const diagnostics = [];
+  for (const field of ["profileGeneration", "profileDigest", "demandSetDigest", "providerCapacityDigest", "authorizationDigest", "reservationDigest"]) {
+    if (receipt[field] !== observed[field]) diagnostics.push({ code: "preflight_state_changed", path: field, message: `${field} changed after preflight; generate a fresh plan.` });
+  }
+  return diagnostics;
+}
+function validateWorkdaySettlement(settlement) {
+  const diagnostics = [];
+  if (settlement.schemaVersion !== "treeseed.workday-settlement/v1") diagnostics.push({ code: "schema_version_invalid", path: "schemaVersion", message: "Unsupported workday settlement schema." });
+  for (const [index, accounting] of settlement.classAccounting.entries()) {
+    for (const [field, value] of Object.entries(accounting).filter(([field2]) => field2 !== "classSlug")) {
+      if (!Number.isFinite(value) || value < 0) diagnostics.push({ code: "settlement_accounting_invalid", path: `classAccounting.${index}.${field}`, message: "Settlement seconds must be finite and non-negative." });
+    }
+    if (accounting.lentSeconds > accounting.allocatedSeconds + accounting.borrowedSeconds) diagnostics.push({ code: "settlement_lending_invalid", path: `classAccounting.${index}.lentSeconds`, message: "A class cannot lend more capacity than it held." });
+  }
+  if (!settlement.preflightDigest.trim() || !settlement.settlementDigest.trim()) diagnostics.push({ code: "settlement_digest_required", path: "settlementDigest", message: "Settlement must bind its preflight and final accounting digests." });
+  if (!Number.isFinite(Date.parse(settlement.startedAt)) || !Number.isFinite(Date.parse(settlement.completedAt)) || Date.parse(settlement.completedAt) < Date.parse(settlement.startedAt)) diagnostics.push({ code: "settlement_time_range_invalid", path: "completedAt", message: "Settlement must bind a valid completion time at or after workday start." });
+  return diagnostics;
+}
+export {
+  validateSelectedDemand,
+  validateWorkdayIntent,
+  validateWorkdayPreflight,
+  validateWorkdayPreflightFreshness,
+  validateWorkdaySettlement
+};

package/dist/operator-contracts/workday-profile.d.ts

@@ -0,0 +1,66 @@
+export type WorkdayDemandSourcePolicy = 'approved-decisions' | 'planning-inputs' | 'questions' | 'proposals' | 'knowledge-gaps' | 'reliability-campaigns';
+export interface WorkdayClassAllocation {
+    classSlug: string;
+    minimumPercent: number;
+    targetPercent: number;
+    maximumPercent: number;
+    mayLend: boolean;
+    mayBorrow: boolean;
+}
+export interface WorkdayAllocationProfile {
+    schemaVersion: 'treeseed.workday-allocation-profile/v1';
+    id: string;
+    version: string;
+    projects: 'all' | string[];
+    excludedClassSlugs?: Record<string, string[]>;
+    classes: WorkdayClassAllocation[];
+    demandSources: WorkdayDemandSourcePolicy[];
+    actingDecisionRequired: true;
+    defaultDurationSeconds: number;
+    maxConcurrency: number;
+    reservePercent: number;
+    prioritization: {
+        strategy: 'priority-then-age' | 'age-then-priority' | 'weighted-fair';
+        starvationLimitSeconds: number;
+    };
+}
+export interface ProjectAgentClassMembership {
+    projectId: string;
+    agentId: string;
+    classSlug: string;
+    status: 'active' | 'paused' | 'archived';
+}
+export interface ProjectAgentIdentity {
+    projectId: string;
+    agentId: string;
+}
+export interface ProjectClassCatalog {
+    projectId: string;
+    classSlugs: string[];
+}
+export interface WorkdayProfileDiagnostic {
+    code: string;
+    path: string;
+    message: string;
+}
+export interface WorkdayBorrowingEvidence {
+    workdayId: string;
+    borrowerClassSlug: string;
+    lenderClassSlug: string;
+    borrowedSeconds: number;
+    lendingPermitted: boolean;
+    borrowingPermitted: boolean;
+    lenderAllocatedSecondsBefore: number;
+    lenderAllocatedSecondsAfter: number;
+    lenderMinimumSeconds: number;
+    borrowerAllocatedSecondsBefore: number;
+    borrowerAllocatedSecondsAfter: number;
+    borrowerMaximumSeconds: number;
+    profileId: string;
+    profileVersion: string;
+    profileDigest: string;
+}
+export declare function validateOneClassPerProjectAgent(memberships: ProjectAgentClassMembership[], expectedAgents?: ProjectAgentIdentity[]): WorkdayProfileDiagnostic[];
+export declare function validateWorkdayAllocationProfile(profile: WorkdayAllocationProfile, classCatalogs?: ProjectClassCatalog[]): WorkdayProfileDiagnostic[];
+export declare function normalizeWorkdayAllocationProfile(profile: WorkdayAllocationProfile): WorkdayAllocationProfile;
+export declare function validateWorkdayBorrowingEvidence(evidence: WorkdayBorrowingEvidence): WorkdayProfileDiagnostic[];

package/dist/operator-contracts/workday-profile.js

@@ -0,0 +1,89 @@
+const PERCENT_TOLERANCE = 1e-6;
+const PROFILE_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+function validateOneClassPerProjectAgent(memberships, expectedAgents = []) {
+  const diagnostics = [];
+  const byAgent = /* @__PURE__ */ new Map();
+  for (const membership of memberships) {
+    const key = `${membership.projectId}:${membership.agentId}`;
+    byAgent.set(key, [...byAgent.get(key) ?? [], membership]);
+  }
+  for (const [key, values] of byAgent) {
+    if (values.length !== 1) diagnostics.push({ code: "agent_class_membership_multiple", path: `memberships.${key}`, message: "Each project agent must have exactly one allocation-class membership." });
+    if (values.some((value) => value.status !== "active")) diagnostics.push({ code: "agent_class_membership_inactive", path: `memberships.${key}`, message: "The single allocation-class membership must be active." });
+  }
+  for (const agent of expectedAgents) {
+    const key = `${agent.projectId}:${agent.agentId}`;
+    if (!byAgent.has(key)) diagnostics.push({ code: "agent_class_membership_missing", path: `memberships.${key}`, message: "Each project agent must have exactly one allocation-class membership." });
+  }
+  return diagnostics;
+}
+function validateWorkdayAllocationProfile(profile, classCatalogs) {
+  const diagnostics = [];
+  if (profile.schemaVersion !== "treeseed.workday-allocation-profile/v1") diagnostics.push({ code: "schema_version_invalid", path: "schemaVersion", message: "Unsupported workday allocation profile schema." });
+  if (!profile.id.trim()) diagnostics.push({ code: "profile_id_required", path: "id", message: "Profile id is required." });
+  if (!PROFILE_VERSION.test(profile.version)) diagnostics.push({ code: "profile_version_invalid", path: "version", message: "Profile version must be a semantic version." });
+  if (profile.actingDecisionRequired !== true) diagnostics.push({ code: "acting_decision_requirement_invalid", path: "actingDecisionRequired", message: "Acting work must require an approved decision." });
+  if (profile.projects !== "all" && profile.projects.length === 0) diagnostics.push({ code: "project_scope_empty", path: "projects", message: "Profile project scope must select at least one project or all." });
+  if (profile.demandSources.length === 0) diagnostics.push({ code: "demand_sources_empty", path: "demandSources", message: "At least one governed demand source is required." });
+  if (new Set(profile.demandSources).size !== profile.demandSources.length) diagnostics.push({ code: "demand_source_duplicate", path: "demandSources", message: "Demand sources must be unique." });
+  if (!Number.isInteger(profile.defaultDurationSeconds) || profile.defaultDurationSeconds <= 0) diagnostics.push({ code: "duration_invalid", path: "defaultDurationSeconds", message: "Default duration must be a positive integer number of seconds." });
+  if (!Number.isInteger(profile.maxConcurrency) || profile.maxConcurrency <= 0) diagnostics.push({ code: "concurrency_invalid", path: "maxConcurrency", message: "Maximum concurrency must be a positive integer." });
+  if (!Number.isFinite(profile.reservePercent) || profile.reservePercent < 0 || profile.reservePercent > 100) diagnostics.push({ code: "reserve_invalid", path: "reservePercent", message: "Reserve percent must be between 0 and 100." });
+  if (!Number.isFinite(profile.prioritization.starvationLimitSeconds) || profile.prioritization.starvationLimitSeconds <= 0) diagnostics.push({ code: "starvation_limit_invalid", path: "prioritization.starvationLimitSeconds", message: "Starvation limit must be positive." });
+  const classSlugs = /* @__PURE__ */ new Set();
+  let minimumTotal = 0;
+  let targetTotal = 0;
+  let maximumTotal = 0;
+  for (const [index, allocation] of profile.classes.entries()) {
+    const path = `classes.${index}`;
+    if (!allocation.classSlug.trim()) diagnostics.push({ code: "class_slug_required", path: `${path}.classSlug`, message: "Class slug is required." });
+    if (classSlugs.has(allocation.classSlug)) diagnostics.push({ code: "class_slug_duplicate", path: `${path}.classSlug`, message: `Class ${allocation.classSlug} is declared more than once.` });
+    classSlugs.add(allocation.classSlug);
+    const values = [allocation.minimumPercent, allocation.targetPercent, allocation.maximumPercent];
+    if (values.some((value) => !Number.isFinite(value) || value < 0 || value > 100) || allocation.minimumPercent > allocation.targetPercent || allocation.targetPercent > allocation.maximumPercent) diagnostics.push({ code: "class_allocation_invalid", path, message: "Class allocation must satisfy 0 <= minimum <= target <= maximum <= 100." });
+    minimumTotal += allocation.minimumPercent;
+    targetTotal += allocation.targetPercent;
+    maximumTotal += allocation.maximumPercent;
+  }
+  if (minimumTotal > 100 + PERCENT_TOLERANCE) diagnostics.push({ code: "minimum_total_invalid", path: "classes", message: "Class minimum percentages cannot total more than 100." });
+  if (Math.abs(targetTotal - 100) > PERCENT_TOLERANCE) diagnostics.push({ code: "target_total_invalid", path: "classes", message: "Class target percentages must total exactly 100." });
+  if (maximumTotal < 100 - PERCENT_TOLERANCE) diagnostics.push({ code: "maximum_total_invalid", path: "classes", message: "Class maximum percentages must total at least 100." });
+  const selectedProjects = classCatalogs === void 0 ? [] : profile.projects === "all" ? classCatalogs.map((catalog) => catalog.projectId) : profile.projects;
+  for (const projectId of selectedProjects) {
+    const catalog = classCatalogs?.find((candidate) => candidate.projectId === projectId);
+    if (!catalog) {
+      diagnostics.push({ code: "project_class_catalog_missing", path: `projects.${projectId}`, message: `No class catalog exists for selected project ${projectId}.` });
+      continue;
+    }
+    const exclusions = new Set(profile.excludedClassSlugs?.[projectId] ?? []);
+    for (const classSlug of classSlugs) {
+      if (!catalog.classSlugs.includes(classSlug) && !exclusions.has(classSlug)) diagnostics.push({ code: "class_missing_from_project", path: `projects.${projectId}.${classSlug}`, message: `Class ${classSlug} is missing from project ${projectId} and is not explicitly excluded.` });
+    }
+  }
+  return diagnostics;
+}
+function normalizeWorkdayAllocationProfile(profile) {
+  return {
+    ...profile,
+    projects: profile.projects === "all" ? "all" : [...new Set(profile.projects)].sort(),
+    excludedClassSlugs: profile.excludedClassSlugs ? Object.fromEntries(Object.entries(profile.excludedClassSlugs).sort(([left], [right]) => left.localeCompare(right)).map(([projectId, slugs]) => [projectId, [...new Set(slugs)].sort()])) : void 0,
+    classes: [...profile.classes].sort((left, right) => left.classSlug.localeCompare(right.classSlug)),
+    demandSources: [...new Set(profile.demandSources)].sort()
+  };
+}
+function validateWorkdayBorrowingEvidence(evidence) {
+  const diagnostics = [];
+  if (!evidence.lendingPermitted) diagnostics.push({ code: "lending_not_permitted", path: "lendingPermitted", message: "The profile does not permit the lender to lend capacity." });
+  if (!evidence.borrowingPermitted) diagnostics.push({ code: "borrowing_not_permitted", path: "borrowingPermitted", message: "The profile does not permit the borrower to borrow capacity." });
+  if (evidence.borrowedSeconds <= 0) diagnostics.push({ code: "borrowed_seconds_invalid", path: "borrowedSeconds", message: "Borrowed seconds must be positive." });
+  if (evidence.lenderAllocatedSecondsAfter < evidence.lenderMinimumSeconds) diagnostics.push({ code: "lender_minimum_violated", path: "lenderAllocatedSecondsAfter", message: "Borrowing cannot reduce the lender below its minimum." });
+  if (evidence.borrowerAllocatedSecondsAfter > evidence.borrowerMaximumSeconds) diagnostics.push({ code: "borrower_maximum_violated", path: "borrowerAllocatedSecondsAfter", message: "Borrowing cannot raise the borrower above its maximum." });
+  if (evidence.lenderAllocatedSecondsBefore - evidence.lenderAllocatedSecondsAfter !== evidence.borrowedSeconds || evidence.borrowerAllocatedSecondsAfter - evidence.borrowerAllocatedSecondsBefore !== evidence.borrowedSeconds) diagnostics.push({ code: "borrowing_accounting_mismatch", path: "borrowedSeconds", message: "Lender and borrower deltas must exactly equal the borrowed seconds." });
+  return diagnostics;
+}
+export {
+  normalizeWorkdayAllocationProfile,
+  validateOneClassPerProjectAgent,
+  validateWorkdayAllocationProfile,
+  validateWorkdayBorrowingEvidence
+};

package/dist/scripts/packages/publish-package.js

@@ -2,7 +2,8 @@ import { execFileSync, spawnSync } from 'node:child_process';
 import { resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createHash } from 'node:crypto';
-import { readFileSync } from 'node:fs';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { assertPackageReleaseTag, packageReleaseVersion } from './release-version.js';
 const packageRoot = resolve(fileURLToPath(new URL('../..', import.meta.url)));
 const extraArgs = process.argv.slice(2);
@@ -37,6 +38,41 @@ catch (error) {
     process.exit(1);
 }
 const npmArgs = ['publish', packageArtifact, '--access', 'public', '--tag', release.npmDistTag];
+const dryRun = extraArgs.includes('--dry-run');
+if (!dryRun) {
+    let existingVersion = false;
+    try {
+        execFileSync('npm', ['view', `${evidence.packageName}@${evidence.packageVersion}`, 'version', '--json', '--prefer-online'], {
+            cwd: packageRoot,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        existingVersion = true;
+    }
+    catch (error) {
+        const output = `${String(error.stdout ?? '')}\n${String(error.stderr ?? '')}`;
+        if (!output.includes('E404') && !output.includes('ETARGET'))
+            throw error;
+    }
+    if (existingVersion) {
+        const destination = mkdtempSync(resolve(tmpdir(), 'treeseed-sdk-existing-'));
+        let existingDigest = '';
+        try {
+            const packed = JSON.parse(execFileSync('npm', [
+                'pack', `${evidence.packageName}@${evidence.packageVersion}`, '--json', '--ignore-scripts', '--prefer-online',
+                '--pack-destination', destination,
+            ], { cwd: packageRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'inherit'] }));
+            existingDigest = `sha256:${createHash('sha256').update(readFileSync(resolve(destination, packed[0].filename))).digest('hex')}`;
+            if (existingDigest !== evidence.packageDigest) {
+                throw new Error(`Published SDK digest ${existingDigest} does not match sealed evidence ${evidence.packageDigest}.`);
+            }
+        }
+        finally {
+            rmSync(destination, { recursive: true, force: true });
+        }
+        console.log(JSON.stringify({ ok: true, adoptedExisting: true, packageVersion: evidence.packageVersion, packageDigest: existingDigest }));
+        process.exit(0);
+    }
+}
 if (process.env.GITHUB_ACTIONS === 'true') {
     npmArgs.push('--provenance');
 }

package/dist/scripts/packages/published-package-readback.js

@@ -0,0 +1,61 @@
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+export class RegistryPropagationError extends Error {
+}
+const retryableRegistryFailure = (error) => {
+    if (error instanceof RegistryPropagationError)
+        return true;
+    const output = `${String(error.stdout ?? '')}\n${String(error.stderr ?? '')}\n${error instanceof Error ? error.message : String(error)}`;
+    return ['E404', 'ETARGET', 'EAI_AGAIN', 'ECONNRESET', 'ETIMEDOUT', 'E502', 'E503', 'E504', 'FETCH_ERROR']
+        .some((marker) => output.includes(marker));
+};
+export async function readBackPublishedPackage(input) {
+    const now = input.now ?? Date.now;
+    const delay = input.delay ?? ((milliseconds) => new Promise((resolveDelay) => setTimeout(resolveDelay, milliseconds)));
+    const deadline = now() + (input.deadlineMs ?? 120_000);
+    const perCallTimeout = input.perCallTimeoutMs ?? 15_000;
+    const execNpm = input.execNpm ?? ((args, timeout) => execFileSync('npm', args, {
+        cwd: input.cwd,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+        timeout,
+    }));
+    const readArtifact = input.readArtifact ?? readFileSync;
+    const remainingTimeout = () => Math.max(1, Math.min(perCallTimeout, deadline - now()));
+    const waitForPropagation = async (error) => {
+        if (!retryableRegistryFailure(error) || now() >= deadline)
+            throw error;
+        await delay(Math.min(3000, Math.max(1, deadline - now())));
+    };
+    let observedDigest = '';
+    let tags = {};
+    while (!observedDigest) {
+        try {
+            const packed = JSON.parse(execNpm([
+                'pack', `${input.packageName}@${input.packageVersion}`, '--json', '--ignore-scripts', '--prefer-online',
+                '--pack-destination', input.destination,
+            ], remainingTimeout()));
+            observedDigest = `sha256:${createHash('sha256').update(readArtifact(resolve(input.destination, packed[0].filename))).digest('hex')}`;
+        }
+        catch (error) {
+            await waitForPropagation(error);
+        }
+    }
+    if (observedDigest !== input.packageDigest)
+        throw new Error(`Published SDK digest ${observedDigest} does not match ${input.packageDigest}.`);
+    while (tags.rc !== input.packageVersion) {
+        try {
+            tags = JSON.parse(execNpm(['view', input.packageName, 'dist-tags', '--json', '--prefer-online'], remainingTimeout()));
+            if (tags.latest !== input.latestDistTag)
+                throw new Error(`npm latest changed from ${input.latestDistTag} to ${tags.latest ?? 'nothing'}.`);
+            if (tags.rc !== input.packageVersion)
+                throw new RegistryPropagationError(`npm rc points to ${tags.rc ?? 'nothing'}, expected ${input.packageVersion}.`);
+        }
+        catch (error) {
+            await waitForPropagation(error);
+        }
+    }
+    return { packageVersion: input.packageVersion, packageDigest: observedDigest, rc: tags.rc, latest: tags.latest };
+}

package/dist/scripts/packages/verify-published-package.js

@@ -1,37 +1,14 @@
-import { execFileSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
 import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { resolve } from 'node:path';
+import { readBackPublishedPackage } from './published-package-readback.js';
 const root = resolve(import.meta.dirname, '../..');
 const evidence = JSON.parse(readFileSync(resolve(root, '.treeseed/standards/release-evidence.json'), 'utf8'));
 const baseline = JSON.parse(readFileSync(resolve(root, '.treeseed/standards/baseline/receipt.json'), 'utf8'));
 const destination = mkdtempSync(resolve(tmpdir(), 'treeseed-sdk-published-'));
 try {
-    let observedDigest = '';
-    let tags = {};
-    for (let attempt = 0; attempt < 6; attempt += 1) {
-        try {
-            const packed = JSON.parse(execFileSync('npm', [
-                'pack', `${evidence.packageName}@${evidence.packageVersion}`, '--json', '--ignore-scripts', '--pack-destination', destination,
-            ], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'inherit'] }));
-            observedDigest = `sha256:${createHash('sha256').update(readFileSync(resolve(destination, packed[0].filename))).digest('hex')}`;
-            tags = JSON.parse(execFileSync('npm', ['view', evidence.packageName, 'dist-tags', '--json'], { cwd: root, encoding: 'utf8' }));
-            break;
-        }
-        catch (error) {
-            if (attempt === 5)
-                throw error;
-            await new Promise((resolveDelay) => setTimeout(resolveDelay, 3000));
-        }
-    }
-    if (observedDigest !== evidence.packageDigest)
-        throw new Error(`Published SDK digest ${observedDigest} does not match ${evidence.packageDigest}.`);
-    if (tags.rc !== evidence.packageVersion)
-        throw new Error(`npm rc points to ${tags.rc ?? 'nothing'}, expected ${evidence.packageVersion}.`);
-    if (tags.latest !== baseline.latestDistTag)
-        throw new Error(`npm latest changed from ${baseline.latestDistTag} to ${tags.latest ?? 'nothing'}.`);
-    console.log(JSON.stringify({ ok: true, packageVersion: evidence.packageVersion, packageDigest: observedDigest, rc: tags.rc, latest: tags.latest }));
+    const result = await readBackPublishedPackage({ ...evidence, latestDistTag: baseline.latestDistTag, destination, cwd: root });
+    console.log(JSON.stringify({ ok: true, ...result }));
 }
 finally {
     rmSync(destination, { recursive: true, force: true });

package/dist/scripts/standards/package-acceptance.js

@@ -6,6 +6,7 @@ const required = [
     'dist/standards/index.js', 'dist/standards/index.d.ts',
     'dist/standards/typescript/index.js', 'dist/standards/typescript/index.d.ts',
     'dist/standards/openapi/index.js', 'dist/standards/openapi/index.d.ts',
+    'dist/operator-contracts/index.js', 'dist/operator-contracts/index.d.ts',
     '.treeseed/standards/contract-models.json', '.treeseed/standards/contract-bundle.json',
     '.treeseed/standards/typescript-public-api.json', '.treeseed/standards/openapi.json',
 ];
@@ -13,7 +14,7 @@ const missing = required.filter((path) => !existsSync(resolve(root, path)));
 if (missing.length)
     throw new Error(`Missing standards package outputs: ${missing.join(', ')}.`);
 const packageJson = JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8'));
-for (const specifier of ['./standards', './standards/typescript', './standards/openapi']) {
+for (const specifier of ['./standards', './standards/typescript', './standards/openapi', './operator-contracts']) {
     if (!packageJson.exports[specifier])
         throw new Error(`Missing package export ${specifier}.`);
 }

package/dist/scripts/standards/verify-api-consumer.js

@@ -28,8 +28,12 @@ try {
     const observed = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: worktree, encoding: 'utf8' }).trim();
     if (observed !== sourceCommit)
         throw new Error(`API consumer checkout resolved ${observed}, expected ${sourceCommit}.`);
-    execFileSync('npm', ['install', '--ignore-scripts', '--no-audit', '--no-fund', '--save-exact', tarball], { cwd: worktree, stdio: 'inherit' });
+    execFileSync('npm', ['install', '--ignore-scripts', '--no-audit', '--no-fund', '--no-save', tarball], { cwd: worktree, stdio: 'inherit' });
     execFileSync('npm', ['run', 'build'], { cwd: worktree, stdio: 'inherit' });
+    // The complete API release gate imports every runtime module and executes the
+    // local HTTP acceptance campaign. Focused contract tests alone cannot prove
+    // that the packed SDK satisfies the consumer's full runtime boundary.
+    execFileSync('npm', ['run', 'verify:direct'], { cwd: worktree, stdio: 'inherit' });
     const testResultPath = resolve(worktree, '.treeseed-sdk-consumer-results.json');
     execFileSync('npx', [
         'vitest', 'run', '--config', './vitest.config.js',
@@ -37,6 +41,7 @@ try {
         'tests/contract/api/provider-assignment-capability-handles.test.ts',
         'tests/contract/api/api-route-descriptors.test.ts',
         'tests/unit/governance/content-validation.test.ts',
+        'tests/unit/services/capacity/workdays/planning-profile-input-source.test.ts',
     ], { cwd: worktree, stdio: 'inherit' });
     const testResult = JSON.parse(readFileSync(testResultPath, 'utf8'));
     if (!testResult.success || testResult.numPassedTestSuites !== testResult.numTotalTestSuites
@@ -48,7 +53,7 @@ try {
         .trim().split('\n').filter(Boolean).sort();
     if (finalHead !== sourceCommit || consumerCommits !== 0)
         throw new Error('API consumer verification created or adopted a source commit.');
-    if (JSON.stringify(changedPaths) !== JSON.stringify(['package-lock.json', 'package.json'])) {
+    if (changedPaths.length !== 0) {
         throw new Error(`API consumer verification changed unexpected tracked paths: ${changedPaths.join(', ')}.`);
     }
     execFileSync('git', ['diff', '--cached', '--quiet'], { cwd: worktree, stdio: 'ignore' });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.1",
+  "version": "0.13.0-rc.3",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "Apache-2.0",
   "repository": {
@@ -135,6 +135,10 @@
       "types": "./dist/standards/openapi/index.d.ts",
       "default": "./dist/standards/openapi/index.js"
     },
+    "./operator-contracts": {
+      "types": "./dist/operator-contracts/index.d.ts",
+      "default": "./dist/operator-contracts/index.js"
+    },
     "./sdk": {
       "types": "./dist/entrypoints/models/sdk.d.ts",
       "default": "./dist/entrypoints/models/sdk.js"