@treeseed/sdk 0.13.0-rc.106 → 0.13.0-rc.107

package/dist/.treeseed-build-complete.json

@@ -1 +1 @@
-{"completedAt":"2026-09-09T09:45:52.473Z"}
+{"completedAt":"2026-09-09T10:44:07.411Z"}

package/dist/capacity-provider/capability-ontology.d.ts

@@ -816,10 +816,10 @@ export declare const capabilityConformanceSchema: z.ZodObject<{
     }>;
 }, "strict", z.ZodTypeAny, {
     status: "revoked" | "passed" | "failed";
+    expiresAt: string | null;
     schemaVersion: "treeseed.capability-conformance/v1";
     providerId: string;
     issuedAt: string;
-    expiresAt: string | null;
     capability: {
         id: string;
         version: string;
@@ -838,10 +838,10 @@ export declare const capabilityConformanceSchema: z.ZodObject<{
     evidenceDigest: string;
 }, {
     status: "revoked" | "passed" | "failed";
+    expiresAt: string | null;
     schemaVersion: "treeseed.capability-conformance/v1";
     providerId: string;
     issuedAt: string;
-    expiresAt: string | null;
     capability: {
         id: string;
         version: string;
@@ -1089,10 +1089,10 @@ export declare const capabilityOfferSchema: z.ZodObject<{
         }>;
     }, "strict", z.ZodTypeAny, {
         status: "revoked" | "passed" | "failed";
+        expiresAt: string | null;
         schemaVersion: "treeseed.capability-conformance/v1";
         providerId: string;
         issuedAt: string;
-        expiresAt: string | null;
         capability: {
             id: string;
             version: string;
@@ -1111,10 +1111,10 @@ export declare const capabilityOfferSchema: z.ZodObject<{
         evidenceDigest: string;
     }, {
         status: "revoked" | "passed" | "failed";
+        expiresAt: string | null;
         schemaVersion: "treeseed.capability-conformance/v1";
         providerId: string;
         issuedAt: string;
-        expiresAt: string | null;
         capability: {
             id: string;
             version: string;
@@ -1300,10 +1300,10 @@ export declare const capabilityOfferSchema: z.ZodObject<{
     }>;
     conformance: {
         status: "revoked" | "passed" | "failed";
+        expiresAt: string | null;
         schemaVersion: "treeseed.capability-conformance/v1";
         providerId: string;
         issuedAt: string;
-        expiresAt: string | null;
         capability: {
             id: string;
             version: string;
@@ -1381,10 +1381,10 @@ export declare const capabilityOfferSchema: z.ZodObject<{
     }>;
     conformance: {
         status: "revoked" | "passed" | "failed";
+        expiresAt: string | null;
         schemaVersion: "treeseed.capability-conformance/v1";
         providerId: string;
         issuedAt: string;
-        expiresAt: string | null;
         capability: {
             id: string;
             version: string;

package/dist/capacity-provider/contracts/environment-profiles.d.ts

@@ -156,12 +156,12 @@ export declare const assignmentEnvironmentGrantSchema: z.ZodEffects<z.ZodObject<
     issuedAt: z.ZodString;
     expiresAt: z.ZodString;
 }, "strict", z.ZodTypeAny, {
+    expiresAt: string;
     schemaVersion: "treeseed.assignment-environment-grant/v1";
     projectId: string;
     teamId: string;
     providerId: string;
     issuedAt: string;
-    expiresAt: string;
     variables: string[];
     assignmentId: string;
     profileId: string;
@@ -179,12 +179,12 @@ export declare const assignmentEnvironmentGrantSchema: z.ZodEffects<z.ZodObject<
     };
     grantId: string;
 }, {
+    expiresAt: string;
     schemaVersion: "treeseed.assignment-environment-grant/v1";
     projectId: string;
     teamId: string;
     providerId: string;
     issuedAt: string;
-    expiresAt: string;
     variables: string[];
     assignmentId: string;
     profileId: string;
@@ -202,12 +202,12 @@ export declare const assignmentEnvironmentGrantSchema: z.ZodEffects<z.ZodObject<
     };
     grantId: string;
 }>, {
+    expiresAt: string;
     schemaVersion: "treeseed.assignment-environment-grant/v1";
     projectId: string;
     teamId: string;
     providerId: string;
     issuedAt: string;
-    expiresAt: string;
     variables: string[];
     assignmentId: string;
     profileId: string;
@@ -225,12 +225,12 @@ export declare const assignmentEnvironmentGrantSchema: z.ZodEffects<z.ZodObject<
     };
     grantId: string;
 }, {
+    expiresAt: string;
     schemaVersion: "treeseed.assignment-environment-grant/v1";
     projectId: string;
     teamId: string;
     providerId: string;
     issuedAt: string;
-    expiresAt: string;
     variables: string[];
     assignmentId: string;
     profileId: string;

package/dist/deployment/ai/storage.d.ts

@@ -23,46 +23,46 @@ export declare const aiStorageProofSchema: z.ZodEffects<z.ZodObject<{
     nonce: z.ZodString;
 }, "strict", z.ZodTypeAny, {
     service: "inference" | "training" | "lab";
+    nonce: string;
     key: string;
     schemaVersion: "treeseed.ai-storage-proof/v1";
     action: "read" | "write" | "list" | "delete";
     projectId: string;
     teamId: string;
     issuedAt: number;
-    nonce: string;
     nodeId: string;
     storeId: "managed-inference" | "managed-training" | "managed-lab";
 }, {
     service: "inference" | "training" | "lab";
+    nonce: string;
     key: string;
     schemaVersion: "treeseed.ai-storage-proof/v1";
     action: "read" | "write" | "list" | "delete";
     projectId: string;
     teamId: string;
     issuedAt: number;
-    nonce: string;
     nodeId: string;
     storeId: "managed-inference" | "managed-training" | "managed-lab";
 }>, {
     service: "inference" | "training" | "lab";
+    nonce: string;
     key: string;
     schemaVersion: "treeseed.ai-storage-proof/v1";
     action: "read" | "write" | "list" | "delete";
     projectId: string;
     teamId: string;
     issuedAt: number;
-    nonce: string;
     nodeId: string;
     storeId: "managed-inference" | "managed-training" | "managed-lab";
 }, {
     service: "inference" | "training" | "lab";
+    nonce: string;
     key: string;
     schemaVersion: "treeseed.ai-storage-proof/v1";
     action: "read" | "write" | "list" | "delete";
     projectId: string;
     teamId: string;
     issuedAt: number;
-    nonce: string;
     nodeId: string;
     storeId: "managed-inference" | "managed-training" | "managed-lab";
 }>;
@@ -81,46 +81,46 @@ export declare const aiStorageRequestSchema: z.ZodObject<{
         nonce: z.ZodString;
     }, "strict", z.ZodTypeAny, {
         service: "inference" | "training" | "lab";
+        nonce: string;
         key: string;
         schemaVersion: "treeseed.ai-storage-proof/v1";
         action: "read" | "write" | "list" | "delete";
         projectId: string;
         teamId: string;
         issuedAt: number;
-        nonce: string;
         nodeId: string;
         storeId: "managed-inference" | "managed-training" | "managed-lab";
     }, {
         service: "inference" | "training" | "lab";
+        nonce: string;
         key: string;
         schemaVersion: "treeseed.ai-storage-proof/v1";
         action: "read" | "write" | "list" | "delete";
         projectId: string;
         teamId: string;
         issuedAt: number;
-        nonce: string;
         nodeId: string;
         storeId: "managed-inference" | "managed-training" | "managed-lab";
     }>, {
         service: "inference" | "training" | "lab";
+        nonce: string;
         key: string;
         schemaVersion: "treeseed.ai-storage-proof/v1";
         action: "read" | "write" | "list" | "delete";
         projectId: string;
         teamId: string;
         issuedAt: number;
-        nonce: string;
         nodeId: string;
         storeId: "managed-inference" | "managed-training" | "managed-lab";
     }, {
         service: "inference" | "training" | "lab";
+        nonce: string;
         key: string;
         schemaVersion: "treeseed.ai-storage-proof/v1";
         action: "read" | "write" | "list" | "delete";
         projectId: string;
         teamId: string;
         issuedAt: number;
-        nonce: string;
         nodeId: string;
         storeId: "managed-inference" | "managed-training" | "managed-lab";
     }>;
@@ -128,13 +128,13 @@ export declare const aiStorageRequestSchema: z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     proof: {
         service: "inference" | "training" | "lab";
+        nonce: string;
         key: string;
         schemaVersion: "treeseed.ai-storage-proof/v1";
         action: "read" | "write" | "list" | "delete";
         projectId: string;
         teamId: string;
         issuedAt: number;
-        nonce: string;
         nodeId: string;
         storeId: "managed-inference" | "managed-training" | "managed-lab";
     };
@@ -142,13 +142,13 @@ export declare const aiStorageRequestSchema: z.ZodObject<{
 }, {
     proof: {
         service: "inference" | "training" | "lab";
+        nonce: string;
         key: string;
         schemaVersion: "treeseed.ai-storage-proof/v1";
         action: "read" | "write" | "list" | "delete";
         projectId: string;
         teamId: string;
         issuedAt: number;
-        nonce: string;
         nodeId: string;
         storeId: "managed-inference" | "managed-training" | "managed-lab";
     };

package/dist/deployment/ai-mode.d.ts

@@ -79,13 +79,13 @@ export declare const aiModeTransitionReceiptSchema: z.ZodObject<{
     completedAt: z.ZodNullable<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
     resource: "ai-gpu";
+    state: "degraded" | "running" | "succeeded" | "planned" | "postponed" | "rolled-back";
     schemaVersion: "treeseed.ai-mode-transition-receipt/v1";
     steps: {
         id: "close-inference" | "drain-inference" | "stop-vllm" | "start-training" | "open-training" | "close-training" | "drain-training" | "stop-training" | "start-vllm" | "warm-vllm" | "open-inference" | "rollback";
         state: "pending" | "failed" | "running" | "succeeded" | "skipped";
         completedAt: string | null;
     }[];
-    state: "degraded" | "running" | "succeeded" | "planned" | "postponed" | "rolled-back";
     completedAt: string | null;
     idempotencyKey: string;
     transitionId: string;
@@ -100,13 +100,13 @@ export declare const aiModeTransitionReceiptSchema: z.ZodObject<{
     startedAt: string;
 }, {
     resource: "ai-gpu";
+    state: "degraded" | "running" | "succeeded" | "planned" | "postponed" | "rolled-back";
     schemaVersion: "treeseed.ai-mode-transition-receipt/v1";
     steps: {
         id: "close-inference" | "drain-inference" | "stop-vllm" | "start-training" | "open-training" | "close-training" | "drain-training" | "stop-training" | "start-vllm" | "warm-vllm" | "open-inference" | "rollback";
         state: "pending" | "failed" | "running" | "succeeded" | "skipped";
         completedAt: string | null;
     }[];
-    state: "degraded" | "running" | "succeeded" | "planned" | "postponed" | "rolled-back";
     completedAt: string | null;
     idempotencyKey: string;
     transitionId: string;
@@ -172,13 +172,13 @@ export declare const aiModeStatusSchema: z.ZodObject<{
         completedAt: z.ZodNullable<z.ZodString>;
     }, "strict", z.ZodTypeAny, {
         resource: "ai-gpu";
+        state: "degraded" | "running" | "succeeded" | "planned" | "postponed" | "rolled-back";
         schemaVersion: "treeseed.ai-mode-transition-receipt/v1";
         steps: {
             id: "close-inference" | "drain-inference" | "stop-vllm" | "start-training" | "open-training" | "close-training" | "drain-training" | "stop-training" | "start-vllm" | "warm-vllm" | "open-inference" | "rollback";
             state: "pending" | "failed" | "running" | "succeeded" | "skipped";
             completedAt: string | null;
         }[];
-        state: "degraded" | "running" | "succeeded" | "planned" | "postponed" | "rolled-back";
         completedAt: string | null;
         idempotencyKey: string;
         transitionId: string;
@@ -193,13 +193,13 @@ export declare const aiModeStatusSchema: z.ZodObject<{
         startedAt: string;
     }, {
         resource: "ai-gpu";
+        state: "degraded" | "running" | "succeeded" | "planned" | "postponed" | "rolled-back";
         schemaVersion: "treeseed.ai-mode-transition-receipt/v1";
         steps: {
             id: "close-inference" | "drain-inference" | "stop-vllm" | "start-training" | "open-training" | "close-training" | "drain-training" | "stop-training" | "start-vllm" | "warm-vllm" | "open-inference" | "rollback";
             state: "pending" | "failed" | "running" | "succeeded" | "skipped";
             completedAt: string | null;
         }[];
-        state: "degraded" | "running" | "succeeded" | "planned" | "postponed" | "rolled-back";
         completedAt: string | null;
         idempotencyKey: string;
         transitionId: string;
@@ -250,13 +250,13 @@ export declare const aiModeStatusSchema: z.ZodObject<{
         completedAt: z.ZodNullable<z.ZodString>;
     }, "strict", z.ZodTypeAny, {
         resource: "ai-gpu";
+        state: "degraded" | "running" | "succeeded" | "planned" | "postponed" | "rolled-back";
         schemaVersion: "treeseed.ai-mode-transition-receipt/v1";
         steps: {
             id: "close-inference" | "drain-inference" | "stop-vllm" | "start-training" | "open-training" | "close-training" | "drain-training" | "stop-training" | "start-vllm" | "warm-vllm" | "open-inference" | "rollback";
             state: "pending" | "failed" | "running" | "succeeded" | "skipped";
             completedAt: string | null;
         }[];
-        state: "degraded" | "running" | "succeeded" | "planned" | "postponed" | "rolled-back";
         completedAt: string | null;
         idempotencyKey: string;
         transitionId: string;
@@ -271,13 +271,13 @@ export declare const aiModeStatusSchema: z.ZodObject<{
         startedAt: string;
     }, {
         resource: "ai-gpu";
+        state: "degraded" | "running" | "succeeded" | "planned" | "postponed" | "rolled-back";
         schemaVersion: "treeseed.ai-mode-transition-receipt/v1";
         steps: {
             id: "close-inference" | "drain-inference" | "stop-vllm" | "start-training" | "open-training" | "close-training" | "drain-training" | "stop-training" | "start-vllm" | "warm-vllm" | "open-inference" | "rollback";
             state: "pending" | "failed" | "running" | "succeeded" | "skipped";
             completedAt: string | null;
         }[];
-        state: "degraded" | "running" | "succeeded" | "planned" | "postponed" | "rolled-back";
         completedAt: string | null;
         idempotencyKey: string;
         transitionId: string;
@@ -302,13 +302,13 @@ export declare const aiModeStatusSchema: z.ZodObject<{
     } | null;
     activeTransition: {
         resource: "ai-gpu";
+        state: "degraded" | "running" | "succeeded" | "planned" | "postponed" | "rolled-back";
         schemaVersion: "treeseed.ai-mode-transition-receipt/v1";
         steps: {
             id: "close-inference" | "drain-inference" | "stop-vllm" | "start-training" | "open-training" | "close-training" | "drain-training" | "stop-training" | "start-vllm" | "warm-vllm" | "open-inference" | "rollback";
             state: "pending" | "failed" | "running" | "succeeded" | "skipped";
             completedAt: string | null;
         }[];
-        state: "degraded" | "running" | "succeeded" | "planned" | "postponed" | "rolled-back";
         completedAt: string | null;
         idempotencyKey: string;
         transitionId: string;
@@ -324,13 +324,13 @@ export declare const aiModeStatusSchema: z.ZodObject<{
     } | null;
     lastReceipt: {
         resource: "ai-gpu";
+        state: "degraded" | "running" | "succeeded" | "planned" | "postponed" | "rolled-back";
         schemaVersion: "treeseed.ai-mode-transition-receipt/v1";
         steps: {
             id: "close-inference" | "drain-inference" | "stop-vllm" | "start-training" | "open-training" | "close-training" | "drain-training" | "stop-training" | "start-vllm" | "warm-vllm" | "open-inference" | "rollback";
             state: "pending" | "failed" | "running" | "succeeded" | "skipped";
             completedAt: string | null;
         }[];
-        state: "degraded" | "running" | "succeeded" | "planned" | "postponed" | "rolled-back";
         completedAt: string | null;
         idempotencyKey: string;
         transitionId: string;
@@ -355,13 +355,13 @@ export declare const aiModeStatusSchema: z.ZodObject<{
     } | null;
     activeTransition: {
         resource: "ai-gpu";
+        state: "degraded" | "running" | "succeeded" | "planned" | "postponed" | "rolled-back";
         schemaVersion: "treeseed.ai-mode-transition-receipt/v1";
         steps: {
             id: "close-inference" | "drain-inference" | "stop-vllm" | "start-training" | "open-training" | "close-training" | "drain-training" | "stop-training" | "start-vllm" | "warm-vllm" | "open-inference" | "rollback";
             state: "pending" | "failed" | "running" | "succeeded" | "skipped";
             completedAt: string | null;
         }[];
-        state: "degraded" | "running" | "succeeded" | "planned" | "postponed" | "rolled-back";
         completedAt: string | null;
         idempotencyKey: string;
         transitionId: string;
@@ -377,13 +377,13 @@ export declare const aiModeStatusSchema: z.ZodObject<{
     } | null;
     lastReceipt: {
         resource: "ai-gpu";
+        state: "degraded" | "running" | "succeeded" | "planned" | "postponed" | "rolled-back";
         schemaVersion: "treeseed.ai-mode-transition-receipt/v1";
         steps: {
             id: "close-inference" | "drain-inference" | "stop-vllm" | "start-training" | "open-training" | "close-training" | "drain-training" | "stop-training" | "start-vllm" | "warm-vllm" | "open-inference" | "rollback";
             state: "pending" | "failed" | "running" | "succeeded" | "skipped";
             completedAt: string | null;
         }[];
-        state: "degraded" | "running" | "succeeded" | "planned" | "postponed" | "rolled-back";
         completedAt: string | null;
         idempotencyKey: string;
         transitionId: string;

package/dist/deployment/hosted-topology.d.ts

@@ -2193,6 +2193,7 @@ export declare const hostedTopologyReceiptSchema: z.ZodObject<{
     state: z.ZodLiteral<"known-good">;
     completedAt: z.ZodString;
 }, "strict", z.ZodTypeAny, {
+    state: "known-good";
     schemaVersion: "treeseed.hosted-topology-receipt/v1";
     resources: {
         kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
@@ -2206,7 +2207,6 @@ export declare const hostedTopologyReceiptSchema: z.ZodObject<{
     }[];
     planDigest: string;
     teamId: string;
-    state: "known-good";
     environment: "production" | "staging";
     completedAt: string;
     receiptId: string;
@@ -2227,6 +2227,7 @@ export declare const hostedTopologyReceiptSchema: z.ZodObject<{
         observedAt: string;
     }[];
 }, {
+    state: "known-good";
     schemaVersion: "treeseed.hosted-topology-receipt/v1";
     resources: {
         kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
@@ -2240,7 +2241,6 @@ export declare const hostedTopologyReceiptSchema: z.ZodObject<{
     }[];
     planDigest: string;
     teamId: string;
-    state: "known-good";
     environment: "production" | "staging";
     completedAt: string;
     receiptId: string;

package/dist/deployment/schemas.d.ts

@@ -8222,6 +8222,7 @@ export declare const hostUpdateSchema: z.ZodObject<{
     }>;
     state: z.ZodEnum<["planned", "draining", "applying", "healthy", "failed", "rolled-back"]>;
 }, "strict", z.ZodTypeAny, {
+    state: "failed" | "planned" | "rolled-back" | "draining" | "applying" | "healthy";
     schemaVersion: "treeseed.host-update/v1";
     components: {
         from: string | null;
@@ -8229,7 +8230,6 @@ export declare const hostUpdateSchema: z.ZodObject<{
         componentId: string;
         imageDigests: string[];
     }[];
-    state: "failed" | "planned" | "rolled-back" | "draining" | "applying" | "healthy";
     activation: {
         policy: "maintenance-window" | "continuous";
         eligibleAt: string;
@@ -8240,6 +8240,7 @@ export declare const hostUpdateSchema: z.ZodObject<{
     fromCatalogDigest: string;
     toCatalogDigest: string;
 }, {
+    state: "failed" | "planned" | "rolled-back" | "draining" | "applying" | "healthy";
     schemaVersion: "treeseed.host-update/v1";
     components: {
         from: string | null;
@@ -8247,7 +8248,6 @@ export declare const hostUpdateSchema: z.ZodObject<{
         componentId: string;
         imageDigests: string[];
     }[];
-    state: "failed" | "planned" | "rolled-back" | "draining" | "applying" | "healthy";
     activation: {
         policy: "maintenance-window" | "continuous";
         eligibleAt: string;
@@ -8321,9 +8321,9 @@ export declare const hostReceiptSchema: z.ZodObject<{
     }>, "many">;
     completedAt: z.ZodString;
 }, "strict", z.ZodTypeAny, {
+    state: "degraded" | "rolled-back" | "known-good";
     role: string;
     schemaVersion: "treeseed.host-receipt/v1";
-    state: "degraded" | "rolled-back" | "known-good";
     packages: {
         version: string;
         name: string;
@@ -8351,9 +8351,9 @@ export declare const hostReceiptSchema: z.ZodObject<{
         runtimeDigest: string;
     }[];
 }, {
+    state: "degraded" | "rolled-back" | "known-good";
     role: string;
     schemaVersion: "treeseed.host-receipt/v1";
-    state: "degraded" | "rolled-back" | "known-good";
     packages: {
         version: string;
         name: string;
@@ -8406,8 +8406,8 @@ export declare const hostBackupSchema: z.ZodObject<{
     createdAt: z.ZodString;
     verifiedAt: z.ZodNullable<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
-    schemaVersion: "treeseed.host-backup/v1";
     state: "pending" | "failed" | "complete" | "verified";
+    schemaVersion: "treeseed.host-backup/v1";
     createdAt: string;
     artifacts: {
         digest: string;
@@ -8420,8 +8420,8 @@ export declare const hostBackupSchema: z.ZodObject<{
     backupId: string;
     verifiedAt: string | null;
 }, {
-    schemaVersion: "treeseed.host-backup/v1";
     state: "pending" | "failed" | "complete" | "verified";
+    schemaVersion: "treeseed.host-backup/v1";
     createdAt: string;
     artifacts: {
         digest: string;
@@ -8446,8 +8446,8 @@ export declare const hostMigrationSchema: z.ZodObject<{
     sourceWritersStopped: z.ZodBoolean;
     completedAt: z.ZodNullable<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
-    schemaVersion: "treeseed.host-migration/v1";
     state: "pending" | "failed" | "rolled-back" | "verified" | "quiesced" | "copied" | "activated";
+    schemaVersion: "treeseed.host-migration/v1";
     operation: string;
     completedAt: string | null;
     componentId: string;
@@ -8457,8 +8457,8 @@ export declare const hostMigrationSchema: z.ZodObject<{
     toGeneration: number;
     sourceWritersStopped: boolean;
 }, {
-    schemaVersion: "treeseed.host-migration/v1";
     state: "pending" | "failed" | "rolled-back" | "verified" | "quiesced" | "copied" | "activated";
+    schemaVersion: "treeseed.host-migration/v1";
     operation: string;
     completedAt: string | null;
     componentId: string;
@@ -8480,9 +8480,9 @@ export declare const hostRecoverySchema: z.ZodObject<{
     backupId: z.ZodNullable<z.ZodString>;
     completedAt: z.ZodNullable<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
+    state: "pending" | "failed" | "running" | "healthy";
     schemaVersion: "treeseed.host-recovery/v1";
     action: "rollback" | "retry" | "restore";
-    state: "pending" | "failed" | "running" | "healthy";
     completedAt: string | null;
     componentId: string | null;
     receiptId: string;
@@ -8491,9 +8491,9 @@ export declare const hostRecoverySchema: z.ZodObject<{
     trigger: "operator" | "health-gate" | "boot" | "interrupted-update";
     targetGeneration: number;
 }, {
+    state: "pending" | "failed" | "running" | "healthy";
     schemaVersion: "treeseed.host-recovery/v1";
     action: "rollback" | "retry" | "restore";
-    state: "pending" | "failed" | "running" | "healthy";
     completedAt: string | null;
     componentId: string | null;
     receiptId: string;
@@ -8580,8 +8580,8 @@ export declare const hostSecurityReceiptSchema: z.ZodObject<{
         activeDiagnosticsVersion: number;
         recoveryBundleVerified: boolean;
     };
-    schemaVersion: "treeseed.host-security-receipt/v1";
     state: "blocked" | "planned" | "known-good" | "migrating";
+    schemaVersion: "treeseed.host-security-receipt/v1";
     hostId: string;
     completedAt: string;
     sandbox: {
@@ -8604,8 +8604,8 @@ export declare const hostSecurityReceiptSchema: z.ZodObject<{
         activeDiagnosticsVersion: number;
         recoveryBundleVerified: boolean;
     };
-    schemaVersion: "treeseed.host-security-receipt/v1";
     state: "blocked" | "planned" | "known-good" | "migrating";
+    schemaVersion: "treeseed.host-security-receipt/v1";
     hostId: string;
     completedAt: string;
     sandbox: {

package/dist/identity/browser-session.d.ts

@@ -0,0 +1,233 @@
+import { z } from 'zod';
+/** Encrypted, single-use server-side state; never an application cookie value. */
+export declare const browserLoginTransactionSchema: z.ZodObject<{
+    state: z.ZodString;
+    nonce: z.ZodString;
+    verifier: z.ZodString;
+    expiresAt: z.ZodNumber;
+    issuer: z.ZodEffects<z.ZodString, string, string>;
+    clientId: z.ZodString;
+    redirectUri: z.ZodEffects<z.ZodString, string, string>;
+    resource: z.ZodEffects<z.ZodString, string, string>;
+    scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
+}, "strict", z.ZodTypeAny, {
+    issuer: string;
+    resource: string;
+    scopes: string[];
+    clientId: string;
+    state: string;
+    nonce: string;
+    verifier: string;
+    expiresAt: number;
+    redirectUri: string;
+}, {
+    issuer: string;
+    resource: string;
+    scopes: string[];
+    clientId: string;
+    state: string;
+    nonce: string;
+    verifier: string;
+    expiresAt: number;
+    redirectUri: string;
+}>;
+export type BrowserLoginTransaction = z.infer<typeof browserLoginTransactionSchema>;
+/** Private BFF protocol, authenticated with a registered application workload.
+ * These operations are not user/browser or agent-tool credential endpoints.
+ * The server chooses the app namespace from authentication, not request fields.
+ */
+export declare const BROWSER_SESSION_BRIDGE_PATH = "/internal/identity/browser/v1";
+export declare const BROWSER_SESSION_PERMISSION = "identity:sessions:manage";
+export declare const BROWSER_SESSION_SCOPE = "treeseed:identity:sessions";
+export declare const browserSessionRequests: {
+    begin: z.ZodObject<{
+        browserBinding: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        browserBinding: string;
+    }, {
+        browserBinding: string;
+    }>;
+    finish: z.ZodObject<{
+        browserBinding: z.ZodString;
+        callback: z.ZodEffects<z.ZodString, string, string>;
+    }, "strict", z.ZodTypeAny, {
+        browserBinding: string;
+        callback: string;
+    }, {
+        browserBinding: string;
+        callback: string;
+    }>;
+    credentials: z.ZodObject<{
+        handle: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        handle: string;
+    }, {
+        handle: string;
+    }>;
+    logout: z.ZodObject<{
+        handle: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        handle: string;
+    }, {
+        handle: string;
+    }>;
+};
+export declare const browserSessionResponses: {
+    begin: z.ZodObject<{
+        authorizationUrl: z.ZodEffects<z.ZodString, string, string>;
+    }, "strict", z.ZodTypeAny, {
+        authorizationUrl: string;
+    }, {
+        authorizationUrl: string;
+    }>;
+    finish: z.ZodObject<{
+        handle: z.ZodString;
+        expiresAt: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        expiresAt: string;
+        handle: string;
+    }, {
+        expiresAt: string;
+        handle: string;
+    }>;
+    credentials: z.ZodEffects<z.ZodObject<{
+        accessToken: z.ZodString;
+        resource: z.ZodEffects<z.ZodString, string, string>;
+        expiresAt: z.ZodNumber;
+        principal: z.ZodObject<{
+            principalId: z.ZodEffects<z.ZodString, string, string>;
+            kind: z.ZodEnum<["human", "service", "provider", "agent"]>;
+            identity: z.ZodObject<{
+                issuer: z.ZodEffects<z.ZodString, string, string>;
+                subject: z.ZodEffects<z.ZodString, string, string>;
+            }, "strict", z.ZodTypeAny, {
+                issuer: string;
+                subject: string;
+            }, {
+                issuer: string;
+                subject: string;
+            }>;
+            actor: z.ZodOptional<z.ZodObject<{
+                issuer: z.ZodEffects<z.ZodString, string, string>;
+                subject: z.ZodEffects<z.ZodString, string, string>;
+            }, "strict", z.ZodTypeAny, {
+                issuer: string;
+                subject: string;
+            }, {
+                issuer: string;
+                subject: string;
+            }>>;
+            audience: z.ZodEffects<z.ZodString, string, string>;
+            scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
+        }, "strict", z.ZodTypeAny, {
+            scopes: string[];
+            identity: {
+                issuer: string;
+                subject: string;
+            };
+            principalId: string;
+            kind: "human" | "service" | "provider" | "agent";
+            audience: string;
+            actor?: {
+                issuer: string;
+                subject: string;
+            } | undefined;
+        }, {
+            scopes: string[];
+            identity: {
+                issuer: string;
+                subject: string;
+            };
+            principalId: string;
+            kind: "human" | "service" | "provider" | "agent";
+            audience: string;
+            actor?: {
+                issuer: string;
+                subject: string;
+            } | undefined;
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        resource: string;
+        expiresAt: number;
+        accessToken: string;
+        principal: {
+            scopes: string[];
+            identity: {
+                issuer: string;
+                subject: string;
+            };
+            principalId: string;
+            kind: "human" | "service" | "provider" | "agent";
+            audience: string;
+            actor?: {
+                issuer: string;
+                subject: string;
+            } | undefined;
+        };
+    }, {
+        resource: string;
+        expiresAt: number;
+        accessToken: string;
+        principal: {
+            scopes: string[];
+            identity: {
+                issuer: string;
+                subject: string;
+            };
+            principalId: string;
+            kind: "human" | "service" | "provider" | "agent";
+            audience: string;
+            actor?: {
+                issuer: string;
+                subject: string;
+            } | undefined;
+        };
+    }>, {
+        resource: string;
+        expiresAt: number;
+        accessToken: string;
+        principal: {
+            scopes: string[];
+            identity: {
+                issuer: string;
+                subject: string;
+            };
+            principalId: string;
+            kind: "human" | "service" | "provider" | "agent";
+            audience: string;
+            actor?: {
+                issuer: string;
+                subject: string;
+            } | undefined;
+        };
+    }, {
+        resource: string;
+        expiresAt: number;
+        accessToken: string;
+        principal: {
+            scopes: string[];
+            identity: {
+                issuer: string;
+                subject: string;
+            };
+            principalId: string;
+            kind: "human" | "service" | "provider" | "agent";
+            audience: string;
+            actor?: {
+                issuer: string;
+                subject: string;
+            } | undefined;
+        };
+    }>;
+    logout: z.ZodObject<{
+        loggedOut: z.ZodLiteral<true>;
+        upstreamRevoked: z.ZodBoolean;
+    }, "strict", z.ZodTypeAny, {
+        loggedOut: true;
+        upstreamRevoked: boolean;
+    }, {
+        loggedOut: true;
+        upstreamRevoked: boolean;
+    }>;
+};
+export type BrowserSessionCredentials = z.infer<typeof browserSessionResponses.credentials>;

package/dist/identity/browser-session.js

@@ -0,0 +1,51 @@
+import { z } from "zod";
+import { identityEndpointSchema, identityPrincipalSchema, resourceTokenRequestSchema } from "./contracts.js";
+const opaque = z.string().regex(/^[A-Za-z0-9_-]{43}$/u);
+const clientId = z.string().min(1).max(256);
+const authorizationUrl = z.string().url().max(8192).superRefine((value, context) => {
+  const url = new URL(value);
+  if (url.protocol !== "https:" || url.username || url.password || url.hash)
+    context.addIssue({ code: z.ZodIssueCode.custom, message: "Authorization URLs require HTTPS without credentials or fragments." });
+});
+const browserLoginTransactionSchema = z.object({
+  state: opaque,
+  nonce: opaque,
+  verifier: opaque,
+  expiresAt: z.number().int().positive(),
+  issuer: identityEndpointSchema,
+  clientId,
+  redirectUri: identityEndpointSchema,
+  resource: identityEndpointSchema,
+  scopes: resourceTokenRequestSchema.shape.scopes
+}).strict();
+const BROWSER_SESSION_BRIDGE_PATH = "/internal/identity/browser/v1";
+const BROWSER_SESSION_PERMISSION = "identity:sessions:manage";
+const BROWSER_SESSION_SCOPE = "treeseed:identity:sessions";
+const browserSessionRequests = {
+  begin: z.object({ browserBinding: opaque }).strict(),
+  finish: z.object({ browserBinding: opaque, callback: authorizationUrl }).strict(),
+  credentials: z.object({ handle: opaque }).strict(),
+  logout: z.object({ handle: opaque }).strict()
+};
+const browserSessionResponses = {
+  begin: z.object({ authorizationUrl }).strict(),
+  finish: z.object({ handle: opaque, expiresAt: z.string().datetime() }).strict(),
+  credentials: z.object({
+    accessToken: z.string().min(1).max(16384),
+    resource: identityEndpointSchema,
+    expiresAt: z.number().int().positive(),
+    principal: identityPrincipalSchema
+  }).strict().superRefine((value, context) => {
+    if (value.resource !== value.principal.audience || value.principal.kind !== "human")
+      context.addIssue({ code: z.ZodIssueCode.custom, message: "Browser credentials require a human principal for this resource." });
+  }),
+  logout: z.object({ loggedOut: z.literal(true), upstreamRevoked: z.boolean() }).strict()
+};
+export {
+  BROWSER_SESSION_BRIDGE_PATH,
+  BROWSER_SESSION_PERMISSION,
+  BROWSER_SESSION_SCOPE,
+  browserLoginTransactionSchema,
+  browserSessionRequests,
+  browserSessionResponses
+};

package/dist/identity/index.d.ts

@@ -1 +1,2 @@
 export * from './contracts.js';
+export * from './browser-session.js';

package/dist/identity/index.js

@@ -1 +1,2 @@
 export * from "./contracts.js";
+export * from "./browser-session.js";

package/dist/operator-contracts/catalog/hosted-topology-operations.d.ts

@@ -155,6 +155,7 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
     }, {}, undefined, {
         operation: Record<string, unknown> | null;
         receipt: {
+            state: "known-good";
             schemaVersion: "treeseed.hosted-topology-receipt/v1";
             resources: {
                 kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
@@ -168,7 +169,6 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
             }[];
             planDigest: string;
             teamId: string;
-            state: "known-good";
             environment: "production" | "staging";
             completedAt: string;
             receiptId: string;

package/dist/operator-contracts/catalog/inbox-operations.d.ts

@@ -3,8 +3,8 @@ export declare function inboxOperations(): {
         teamId: string;
     }, {
         kind?: "all" | "proposal" | "question" | undefined;
-        projectId?: string | undefined;
         state?: "all" | "outstanding" | undefined;
+        projectId?: string | undefined;
         cursor?: string | undefined;
         limit?: number | undefined;
     }, undefined, {

package/dist/operator-contracts/control-plane-operations.d.ts

@@ -211,6 +211,7 @@ export declare const CONTROL_PLANE_OPERATIONS: {
             }, {}, undefined, {
                 operation: Record<string, unknown> | null;
                 receipt: {
+                    state: "known-good";
                     schemaVersion: "treeseed.hosted-topology-receipt/v1";
                     resources: {
                         kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
@@ -224,7 +225,6 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                     }[];
                     planDigest: string;
                     teamId: string;
-                    state: "known-good";
                     environment: "production" | "staging";
                     completedAt: string;
                     receiptId: string;
@@ -622,8 +622,8 @@ export declare const CONTROL_PLANE_OPERATIONS: {
             teamId: string;
         }, {
             kind?: "all" | "proposal" | "question" | undefined;
-            projectId?: string | undefined;
             state?: "all" | "outstanding" | undefined;
+            projectId?: string | undefined;
             cursor?: string | undefined;
             limit?: number | undefined;
         }, undefined, {

package/dist/operator-contracts/knowledge/contracts.d.ts

@@ -40,9 +40,9 @@ export declare const knowledgeShareSchema: z.ZodEffects<z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     status: "active" | "revoked" | "expired";
     id: string;
+    expiresAt: string | null;
     schemaVersion: "treeseed.knowledge-share/v1";
     createdAt: string;
-    expiresAt: string | null;
     operations: ("read" | "context" | "query" | "graph")[];
     paths: string[];
     updatedAt: string;
@@ -68,9 +68,9 @@ export declare const knowledgeShareSchema: z.ZodEffects<z.ZodObject<{
 }>, {
     status: "active" | "revoked" | "expired";
     id: string;
+    expiresAt: string | null;
     schemaVersion: "treeseed.knowledge-share/v1";
     createdAt: string;
-    expiresAt: string | null;
     operations: ("read" | "context" | "query" | "graph")[];
     paths: string[];
     updatedAt: string;

package/dist/platform/contracts.d.ts

@@ -311,20 +311,20 @@ export declare const providerRegistrationRequestSchema: z.ZodObject<{
     state: z.ZodEnum<["pending-approval", "approved", "rejected", "revoked"]>;
     createdAt: z.ZodString;
 }, "strict", z.ZodTypeAny, {
+    state: "pending-approval" | "approved" | "rejected" | "revoked";
     schemaVersion: "treeseed.provider-registration-request/v1";
     requestId: string;
     teamId: string;
     publicKey: string;
     capabilities: string[];
-    state: "pending-approval" | "approved" | "rejected" | "revoked";
     createdAt: string;
 }, {
+    state: "pending-approval" | "approved" | "rejected" | "revoked";
     schemaVersion: "treeseed.provider-registration-request/v1";
     requestId: string;
     teamId: string;
     publicKey: string;
     capabilities: string[];
-    state: "pending-approval" | "approved" | "rejected" | "revoked";
     createdAt: string;
 }>;
 export declare const providerSessionSchema: z.ZodObject<{
@@ -335,18 +335,18 @@ export declare const providerSessionSchema: z.ZodObject<{
     expiresAt: z.ZodString;
     token: z.ZodString;
 }, "strict", z.ZodTypeAny, {
+    expiresAt: string;
     schemaVersion: "treeseed.provider-session/v1";
     providerId: string;
     scope: string[];
     issuedAt: string;
-    expiresAt: string;
     token: string;
 }, {
+    expiresAt: string;
     schemaVersion: "treeseed.provider-session/v1";
     providerId: string;
     scope: string[];
     issuedAt: string;
-    expiresAt: string;
     token: string;
 }>;
 export declare const environmentProfileDescriptorSchema: z.ZodObject<{
@@ -399,8 +399,8 @@ export declare const assignmentEnvironmentGrantSchema: z.ZodObject<{
     }>;
     expiresAt: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    schemaVersion: "treeseed.assignment-environment-grant/v1";
     expiresAt: string;
+    schemaVersion: "treeseed.assignment-environment-grant/v1";
     variables: string[];
     assignmentId: string;
     profileId: string;
@@ -409,8 +409,8 @@ export declare const assignmentEnvironmentGrantSchema: z.ZodObject<{
         destinations: string[];
     };
 }, {
-    schemaVersion: "treeseed.assignment-environment-grant/v1";
     expiresAt: string;
+    schemaVersion: "treeseed.assignment-environment-grant/v1";
     variables: string[];
     assignmentId: string;
     profileId: string;

package/dist/secrets-capability/shared-resources.d.ts

@@ -54,8 +54,8 @@ export declare const organizationTeamInvitationSchema: z.ZodObject<{
     status: "rejected" | "revoked" | "expired" | "pending" | "accepted";
     id: string;
     version: number;
-    teamId: string;
     expiresAt: string;
+    teamId: string;
     organizationId: string;
     organizationAuthorizedBy: string;
     teamAuthorizedBy: string | null;
@@ -63,8 +63,8 @@ export declare const organizationTeamInvitationSchema: z.ZodObject<{
     status: "rejected" | "revoked" | "expired" | "pending" | "accepted";
     id: string;
     version: number;
-    teamId: string;
     expiresAt: string;
+    teamId: string;
     organizationId: string;
     organizationAuthorizedBy: string;
     teamAuthorizedBy: string | null;
@@ -189,13 +189,13 @@ export declare const sharedResourceGrantSchema: z.ZodEffects<z.ZodObject<{
     };
     id: string;
     version: number;
+    expiresAt: string | null;
     scope: {
         environment: "production" | "staging" | "shared";
         projectIds: string[];
         resourceIds: string[];
         assignmentIds: string[];
     };
-    expiresAt: string | null;
     origin: "explicit" | "default-policy";
     authority: {
         kind: "organization";
@@ -225,13 +225,13 @@ export declare const sharedResourceGrantSchema: z.ZodEffects<z.ZodObject<{
     };
     id: string;
     version: number;
+    expiresAt: string | null;
     scope: {
         environment: "production" | "staging" | "shared";
         projectIds: string[];
         resourceIds: string[];
         assignmentIds: string[];
     };
-    expiresAt: string | null;
     origin: "explicit" | "default-policy";
     authority: {
         kind: "organization";
@@ -261,13 +261,13 @@ export declare const sharedResourceGrantSchema: z.ZodEffects<z.ZodObject<{
     };
     id: string;
     version: number;
+    expiresAt: string | null;
     scope: {
         environment: "production" | "staging" | "shared";
         projectIds: string[];
         resourceIds: string[];
         assignmentIds: string[];
     };
-    expiresAt: string | null;
     origin: "explicit" | "default-policy";
     authority: {
         kind: "organization";
@@ -297,13 +297,13 @@ export declare const sharedResourceGrantSchema: z.ZodEffects<z.ZodObject<{
     };
     id: string;
     version: number;
+    expiresAt: string | null;
     scope: {
         environment: "production" | "staging" | "shared";
         projectIds: string[];
         resourceIds: string[];
         assignmentIds: string[];
     };
-    expiresAt: string | null;
     origin: "explicit" | "default-policy";
     authority: {
         kind: "organization";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.106",
+  "version": "0.13.0-rc.107",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {