@treeseed/sdk 0.13.0-rc.11 → 0.13.0-rc.111

package/dist/treedx/contract.js

@@ -0,0 +1,63 @@
+import { TREEDX_OPENAPI_CONTRACT, TREEDX_OPENAPI_OPERATIONS } from "@treeseed/treedx";
+import { CONTROL_PLANE_CATALOG } from "../operator-contracts/control-plane-operations.js";
+import { standardsSha256 } from "../standards/canonicalize.js";
+const TREESEED_TREEDX_SERVICE_CONTRACT_SCHEMA = "treeseed.treedx-service-contract/v1";
+const TREESEED_PRIVATE_TREEDX_OPERATION_IDS = /* @__PURE__ */ new Set([
+  "createDevToken",
+  "putCapabilityGrant",
+  "listCapabilityGrants",
+  "listAuditEvents",
+  "proxyInternalFederationRequest",
+  "exportInternalFederationMirror",
+  "importInternalFederationMirror",
+  "putRepositoryPlacement",
+  "createMigration",
+  "getMigration",
+  "putMirror",
+  "syncMirror",
+  "promoteMirror",
+  "execWorkspace"
+]);
+function treeDxProxyOperationMapping() {
+  return CONTROL_PLANE_CATALOG.operations.filter((operation) => operation.upstream?.service === "treedx").map((operation) => ({
+    treeseedOperationId: operation.operationId,
+    treedxOperationId: operation.upstream.operationId,
+    contractVersion: operation.upstream.contractVersion,
+    contractDigest: operation.upstream.contractDigest
+  })).sort((left, right) => left.treeseedOperationId.localeCompare(right.treeseedOperationId));
+}
+function validateTreeDxProxyOperationMapping() {
+  const authoritativeIds = new Set(TREEDX_OPENAPI_OPERATIONS.map((operation) => operation.operationId));
+  const diagnostics = [];
+  for (const mapping of treeDxProxyOperationMapping()) {
+    if (!authoritativeIds.has(mapping.treedxOperationId)) diagnostics.push(`unknown_upstream_operation:${mapping.treedxOperationId}`);
+    if (TREESEED_PRIVATE_TREEDX_OPERATION_IDS.has(mapping.treedxOperationId)) diagnostics.push(`private_upstream_operation:${mapping.treedxOperationId}`);
+    if (mapping.contractVersion !== TREEDX_OPENAPI_CONTRACT.openapiVersion) diagnostics.push(`contract_version_drift:${mapping.treeseedOperationId}`);
+    if (mapping.contractDigest !== TREEDX_OPENAPI_CONTRACT.openapiSha256) diagnostics.push(`contract_digest_drift:${mapping.treeseedOperationId}`);
+  }
+  return diagnostics.sort();
+}
+async function createTreeDxServiceContractReceipt(controlPlaneCatalogDigest, evidence) {
+  const operationMapping = treeDxProxyOperationMapping();
+  return {
+    schema: TREESEED_TREEDX_SERVICE_CONTRACT_SCHEMA,
+    treedxPackageVersion: TREEDX_OPENAPI_CONTRACT.packageVersion,
+    treedxOpenapiVersion: TREEDX_OPENAPI_CONTRACT.openapiVersion,
+    treedxOpenapiDigest: TREEDX_OPENAPI_CONTRACT.openapiSha256,
+    treedxOperationInventoryDigest: TREEDX_OPENAPI_CONTRACT.operationInventorySha256,
+    treedxGeneratedTypesDigest: TREEDX_OPENAPI_CONTRACT.generatedTypesSha256,
+    treedxSourceCommit: evidence.treedxSourceCommit,
+    treedxPackageArtifactDigest: evidence.treedxPackageArtifactDigest,
+    controlPlaneCatalogDigest,
+    operationMapping,
+    operationMappingDigest: await standardsSha256(operationMapping),
+    compatibility: TREEDX_OPENAPI_CONTRACT.compatibility
+  };
+}
+export {
+  TREESEED_PRIVATE_TREEDX_OPERATION_IDS,
+  TREESEED_TREEDX_SERVICE_CONTRACT_SCHEMA,
+  createTreeDxServiceContractReceipt,
+  treeDxProxyOperationMapping,
+  validateTreeDxProxyOperationMapping
+};

package/dist/treedx/index.d.ts

@@ -0,0 +1,3 @@
+export * from './client.js';
+export * from './contract.js';
+export type * from './types.js';

package/dist/treedx/index.js

@@ -0,0 +1,2 @@
+export * from "./client.js";
+export * from "./contract.js";

package/dist/treedx/types.d.ts

@@ -1,7 +1,8 @@
-export * from './types/tree-dx-actor.js';
-export * from './types/tree-dx-artifact-list-response.js';
-export * from './types/tree-dx-context-request.js';
-export * from './types/tree-dx-changeset.js';
-export * from './types/tree-dx-exec-result.js';
-export * from './types/tree-dx-list-tree-request.js';
-export * from './types/tree-dx-push-request.js';
+export type { TreeDxApiErrorPayload, TreeDxCursor, TreeDxJson, TreeDxPage, TreeDxRecord, } from '@treeseed/treedx/treedx/types';
+export interface TreeSeedTreeDxResourceLink {
+    type: 'resource_link';
+    uri: `treeseed://dx/projects/${string}/${string}`;
+    name: string;
+    mimeType?: string;
+    expiresAt?: string;
+}

package/dist/treedx/types.js

@@ -1,7 +0,0 @@
-export * from "./types/tree-dx-actor.js";
-export * from "./types/tree-dx-artifact-list-response.js";
-export * from "./types/tree-dx-context-request.js";
-export * from "./types/tree-dx-changeset.js";
-export * from "./types/tree-dx-exec-result.js";
-export * from "./types/tree-dx-list-tree-request.js";
-export * from "./types/tree-dx-push-request.js";

package/dist/types/agents/agent-activity-profile.d.ts

@@ -1,9 +1,21 @@
-import { AgentActivityExecutionConfig, AgentActivityPermissions, AgentActivityPlanningIntent, AgentActivityPromptConfig, AgentActivityType, AgentBranchPolicy, AgentOutputContract, AgentQuestionPolicy, AgentSignalPolicy, AgentToolPolicy, EngineeringHandlerKind, ExecutionProviderKind, ExecutionProviderPressure, ExecutionProviderQuotaVisibility, ExecutionResourceNeedKind } from './agent-trigger-kinds.js';
+import { AgentActivityExecutionConfig, AgentActivityPermissions, AgentActivityPlanningIntent, AgentActivityPromptConfig, AgentActivityType, AgentBranchPolicy, AgentOutputContract, AgentQuestionPolicy, AgentReasoningEffort, AgentSignalPolicy, AgentToolPolicy, EngineeringHandlerKind, ExecutionProviderKind, ExecutionProviderPressure, ExecutionProviderQuotaVisibility, ExecutionResourceNeedKind } from './agent-trigger-kinds.js';
 import type { AgentAuthorityPresetId } from '../../agent-capacity/authority/agent-authority-presets.js';
 export interface AgentContentRevisionRef {
     id: string;
     revision: number;
 }
+export interface AgentCapabilityConfigurationValue {
+    value: unknown;
+    requirement: 'required' | 'preferred';
+}
+export interface AgentCapabilityRequirement {
+    capabilityId: string;
+    versionRange: string;
+    requirement: 'required' | 'preferred';
+    alternativeGroup?: string | null;
+    requiredFeatures?: string[];
+    configuration?: Record<string, AgentCapabilityConfigurationValue>;
+}
 export interface AgentActivityProfile {
     activityType?: AgentActivityType;
     enabled: boolean;
@@ -15,6 +27,7 @@ export interface AgentActivityProfile {
     contextQueryRefs?: AgentContentRevisionRef[];
     contextQuerySetRefs?: AgentContentRevisionRef[];
     instructionTemplateRefs?: AgentContentRevisionRef[];
+    capabilityRequirements?: AgentCapabilityRequirement[];
     artifactTriggers?: Array<{
         event: string;
         artifactKind: string;
@@ -27,15 +40,6 @@ export interface AgentActivityProfile {
         requiredArtifactKinds?: string[];
         blockOnOpenQuestions?: boolean;
     };
-    providerOverrides?: {
-        requiredCapabilities?: string[];
-        disallowedProviderIds?: string[];
-        promptRef?: string;
-        instructionTemplateRefs?: AgentContentRevisionRef[];
-        maxRuntimeSeconds?: number;
-        maxTotalTokens?: number;
-        maxCostAmount?: number;
-    };
     tools: AgentToolPolicy;
     signals?: AgentSignalPolicy;
     outputs: AgentOutputContract;
@@ -48,7 +52,8 @@ export interface AgentChatProfileConfiguration {
     foundation: 'discussion-v1';
     responseStyle?: string;
     promptTask?: string;
-    requiredCapabilities?: string[];
+    reasoningEffort?: AgentReasoningEffort;
+    capabilityRequirements?: AgentCapabilityRequirement[];
     maxRuntimeSeconds?: number;
     maxTotalTokens?: number;
     warningTokens?: number;
@@ -81,11 +86,9 @@ export interface AgentDefinition {
     chatProfile?: AgentChatProfileConfiguration;
 }
 export interface AgentExecutionConfig {
-    provider?: string;
-    model?: string;
     approvalPolicy?: 'never' | 'on_request' | 'always' | string;
     sandboxMode?: 'read_only' | 'workspace_write' | string;
-    reasoningEffort?: 'low' | 'medium' | 'high' | string;
+    reasoningEffort?: AgentReasoningEffort;
     allowedPaths?: string[];
     forbiddenPaths?: string[];
     worktree?: {
@@ -99,30 +102,10 @@ export interface AgentExecutionConfig {
     leaseSeconds: number;
     retryLimit: number;
     branchPrefix: string;
-    providerProfile?: AgentProviderProfile;
 }
 export type AgentProviderFallbackPolicy = 'allow_substitution' | 'require_same_model_class' | 'fail_if_unavailable' | 'ask_for_approval';
-export interface AgentExecutionProviderPreference {
-    providerId?: string;
-    provider?: string;
-    model?: string;
-    modelClass?: string;
-    weight: number;
-    reason?: string;
-}
-export interface AgentProviderFallback {
-    providerId?: string;
-    provider?: string;
-    model?: string;
-    modelClass?: string;
-    maxQualityPenalty?: number;
-}
 export interface AgentProviderProfile {
-    requiredCapabilities: string[];
-    preferredExecutionProviders: AgentExecutionProviderPreference[];
-    acceptableFallbacks: AgentProviderFallback[];
-    disallowedProviders?: string[];
-    disallowedRegions?: string[];
+    capabilityRequirements: AgentCapabilityRequirement[];
     fallbackPolicy: AgentProviderFallbackPolicy;
 }
 export interface ExecutionResourceNeed {
@@ -145,7 +128,6 @@ export interface ExecutionCapabilitySupply {
     executionProviderId: string;
     kind: ExecutionProviderKind;
     capabilities: string[];
-    aliases?: string[];
     grants: string[];
     availability?: Record<string, unknown>;
     pressure?: ExecutionProviderPressure;

package/dist/types/agents/agent-trigger-kinds.d.ts

@@ -7,8 +7,7 @@ export declare const AGENT_ACTIVITY_TYPES: readonly ["planning", "estimating", "
 export declare const ENGINEERING_HANDLER_KINDS: readonly ["writer", "actor", "estimate", "releaser", "reporter"];
 export declare const AGENT_CLI_ALLOW_TOOLS: readonly ["shell(git)", "shell(npm)", "web"];
 export declare const EXECUTION_RESOURCE_NEED_KINDS: readonly ["repository", "treedx_workspace", "workflow", "secret", "external_issue", "external_job"];
-export declare const EXECUTION_PROVIDER_KINDS: readonly ["ai_model", "human_issue_queue", "deterministic_workflow", "local_process"];
-export declare const BUILT_IN_AGENT_EXECUTION_PROVIDER_IDS: readonly ["codex", "opencode", "copilot", "jira", "github_issues", "discord", "workflow", "platform-operation"];
+export declare const EXECUTION_PROVIDER_KINDS: readonly ["ai_model", "human_issue_queue", "deterministic_workflow"];
 export declare const EXECUTION_RUN_STATUSES: readonly ["accepted", "running", "waiting", "blocked", "completed", "returned", "failed", "cancelled"];
 export declare const EXECUTION_PROVIDER_PRESSURE_STATES: readonly ["idle", "normal", "busy", "throttled", "exhausted"];
 export declare const EXECUTION_PROVIDER_QUOTA_VISIBILITIES: readonly ["opaque", "partial", "exact"];
@@ -18,11 +17,11 @@ export type AgentMessageStatus = (typeof AGENT_MESSAGE_STATUSES)[number];
 export type AgentRunStatus = (typeof AGENT_RUN_STATUSES)[number];
 export type AgentHandlerKind = string;
 export type AgentActivityType = (typeof AGENT_ACTIVITY_TYPES)[number];
+export type AgentReasoningEffort = 'minimal' | 'low' | 'medium' | 'high' | 'xhigh';
 export type EngineeringHandlerKind = (typeof ENGINEERING_HANDLER_KINDS)[number];
 export type AgentCliAllowTool = (typeof AGENT_CLI_ALLOW_TOOLS)[number];
 export type ExecutionResourceNeedKind = (typeof EXECUTION_RESOURCE_NEED_KINDS)[number] | string;
 export type ExecutionProviderKind = (typeof EXECUTION_PROVIDER_KINDS)[number] | string;
-export type BuiltInAgentExecutionProviderId = (typeof BUILT_IN_AGENT_EXECUTION_PROVIDER_IDS)[number];
 export type ExecutionRunStatus = (typeof EXECUTION_RUN_STATUSES)[number];
 export type ExecutionProviderPressure = (typeof EXECUTION_PROVIDER_PRESSURE_STATES)[number];
 export type ExecutionProviderQuotaVisibility = (typeof EXECUTION_PROVIDER_QUOTA_VISIBILITIES)[number];
@@ -152,7 +151,7 @@ export interface AgentActivityPromptConfig {
     templates?: Record<string, string>;
 }
 export interface AgentActivityExecutionConfig {
-    requiredCapabilities?: string[];
+    reasoningEffort?: AgentReasoningEffort;
     maxRuntimeSeconds?: number;
     closeoutWarningSeconds?: number;
     maxRetries?: number;
@@ -185,5 +184,4 @@ export interface AgentActivityPlanningIntent {
         signals?: AgentSignalPolicy;
     }>;
     requiresArtifactKinds?: string[];
-    proposalTypes?: string[];
 }

package/dist/types/agents/agent-trigger-kinds.js

@@ -54,18 +54,7 @@ const EXECUTION_RESOURCE_NEED_KINDS = [
 const EXECUTION_PROVIDER_KINDS = [
   "ai_model",
   "human_issue_queue",
-  "deterministic_workflow",
-  "local_process"
-];
-const BUILT_IN_AGENT_EXECUTION_PROVIDER_IDS = [
-  "codex",
-  "opencode",
-  "copilot",
-  "jira",
-  "github_issues",
-  "discord",
-  "workflow",
-  "platform-operation"
+  "deterministic_workflow"
 ];
 const EXECUTION_RUN_STATUSES = [
   "accepted",
@@ -97,7 +86,6 @@ export {
   AGENT_PERMISSION_OPERATIONS,
   AGENT_RUN_STATUSES,
   AGENT_TRIGGER_KINDS,
-  BUILT_IN_AGENT_EXECUTION_PROVIDER_IDS,
   ENGINEERING_HANDLER_KINDS,
   EXECUTION_PROVIDER_KINDS,
   EXECUTION_PROVIDER_PRESSURE_STATES,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.11",
+  "version": "0.13.0-rc.111",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,6 +30,7 @@
     "build:dist": "node --import tsx ./scripts/build/build-dist.ts",
     "check:file-lengths": "node --import tsx ./scripts/verification/check-file-lengths.ts && npm run check:file-architecture",
     "check:file-architecture": "node --import tsx ./scripts/verification/check-file-architecture.ts",
+    "prepare": "npm run build:dist",
     "prepack": "npm run build:dist",
     "test": "npm run test:contracts",
     "test:contracts": "vitest run --config ./vitest.contracts.config.ts",
@@ -41,6 +42,7 @@
     "release:verify": "npm run check:file-lengths && node --import tsx ./scripts/packages/release-verify.ts",
     "release:publish": "node --import tsx ./scripts/packages/publish-package.ts",
     "release:readback": "node --import tsx ./scripts/packages/verify-published-package.ts",
+    "release:verify-custody": "node --import tsx ./scripts/packages/verify-release-custody.ts",
     "standards:baseline": "node --import tsx ./scripts/standards/acquire-accepted-baseline.ts",
     "standards:build": "node --import tsx ./scripts/standards/build-contract-bundle.ts",
     "standards:compatibility": "node --import tsx ./scripts/standards/compare-compatibility.ts",
@@ -49,7 +51,9 @@
     "standards:release-evidence": "node --import tsx ./scripts/standards/create-release-evidence.ts"
   },
   "dependencies": {
+    "@treeseed/treedx": "0.3.0-rc.17",
     "esbuild": "^0.28.0",
+    "libsodium-wrappers-sumo": "0.8.4",
     "typescript": "^5.9.3",
     "yaml": "^2.8.1",
     "zod": "^3.25.76"
@@ -57,9 +61,29 @@
   "devDependencies": {
     "@types/node": "^24.6.0",
     "tsx": "^4.21.0",
-    "vitest": "^4.1.2"
+    "vitest": "4.1.11"
   },
   "exports": {
+    "./identity": {
+      "types": "./dist/identity/index.d.ts",
+      "default": "./dist/identity/index.js"
+    },
+    "./platform": {
+      "types": "./dist/platform/index.d.ts",
+      "default": "./dist/platform/index.js"
+    },
+    "./security": {
+      "types": "./dist/security/index.d.ts",
+      "default": "./dist/security/index.js"
+    },
+    "./development": {
+      "types": "./dist/development/index.d.ts",
+      "default": "./dist/development/index.js"
+    },
+    "./deployment": {
+      "types": "./dist/deployment/index.d.ts",
+      "default": "./dist/deployment/index.js"
+    },
     "./standards": {
       "types": "./dist/standards/index.d.ts",
       "default": "./dist/standards/index.js"
@@ -80,6 +104,30 @@
       "types": "./dist/operator-contracts/index.d.ts",
       "default": "./dist/operator-contracts/index.js"
     },
+    "./guarantees": {
+      "types": "./dist/guarantees/index.d.ts",
+      "default": "./dist/guarantees/index.js"
+    },
+    "./site-contracts/platform": {
+      "types": "./dist/site-contracts/platform.d.ts",
+      "default": "./dist/site-contracts/platform.js"
+    },
+    "./site-contracts/plugin": {
+      "types": "./dist/site-contracts/plugin.d.ts",
+      "default": "./dist/site-contracts/plugin.js"
+    },
+    "./site-contracts/cloudflare": {
+      "types": "./dist/site-contracts/cloudflare.d.ts",
+      "default": "./dist/site-contracts/cloudflare.js"
+    },
+    "./site-contracts/catalog": {
+      "types": "./dist/site-contracts/catalog.d.ts",
+      "default": "./dist/site-contracts/catalog.js"
+    },
+    "./field-aliases": {
+      "types": "./dist/entrypoints/models/field-aliases.d.ts",
+      "default": "./dist/entrypoints/models/field-aliases.js"
+    },
     "./control-plane-client": {
       "types": "./dist/entrypoints/clients/control-plane-client.d.ts",
       "default": "./dist/entrypoints/clients/control-plane-client.js"
@@ -112,25 +160,30 @@
       "types": "./dist/content/validation/index.d.ts",
       "default": "./dist/content/validation/index.js"
     },
-    "./treedx/client": {
-      "types": "./dist/treedx/support/client.d.ts",
-      "import": "./dist/treedx/support/client.js",
-      "default": "./dist/treedx/support/client.js"
+    "./treedx": {
+      "types": "./dist/treedx/index.d.ts",
+      "default": "./dist/treedx/index.js"
     },
-    "./treedx/auth": {
-      "types": "./dist/treedx/accounts/auth.d.ts",
-      "import": "./dist/treedx/accounts/auth.js",
-      "default": "./dist/treedx/accounts/auth.js"
+    "./treedx/client": {
+      "types": "./dist/treedx/client.d.ts",
+      "default": "./dist/treedx/client.js"
     },
     "./treedx/types": {
       "types": "./dist/treedx/types.d.ts",
-      "import": "./dist/treedx/types.js",
       "default": "./dist/treedx/types.js"
     },
+    "./treeai": {
+      "types": "./dist/treeai/index.d.ts",
+      "default": "./dist/treeai/index.js"
+    },
     "./capacity-provider": {
       "types": "./dist/capacity/providers/capacity-provider.d.ts",
       "default": "./dist/capacity/providers/capacity-provider.js"
     },
+    "./capacity-provider/sandbox": {
+      "types": "./dist/capacity-provider/sandbox.d.ts",
+      "default": "./dist/capacity-provider/sandbox.js"
+    },
     "./capacity-provider/contracts": {
       "types": "./dist/capacity-provider/contracts/index.d.ts",
       "default": "./dist/capacity-provider/contracts/index.js"

package/dist/secrets-capability/service-vault-contracts.d.ts

@@ -1,61 +0,0 @@
-export declare const SERVICE_VAULT_ENCRYPTION_VERSION: "service-vault-v1";
-export declare const SERVICE_VAULT_AEAD_ALGORITHM: "xchacha20-poly1305-ietf";
-export declare const SERVICE_VAULT_KEY_AGREEMENT: "x25519-sealed-box";
-export declare const SERVICE_VAULT_KDF: "argon2id";
-export type EncryptedCredentialEnvelope = {
-    version: typeof SERVICE_VAULT_ENCRYPTION_VERSION;
-    algorithm: typeof SERVICE_VAULT_AEAD_ALGORITHM;
-    ciphertext: string;
-    nonce: string;
-    wrappedKey: string;
-    wrappedKeyNonce: string;
-    associatedData: string;
-    associatedDataDigest: string;
-    fingerprint: string;
-};
-export type EncryptedPrivateKeyEnvelope = {
-    version: typeof SERVICE_VAULT_ENCRYPTION_VERSION;
-    algorithm: typeof SERVICE_VAULT_AEAD_ALGORITHM;
-    kdf: {
-        algorithm: typeof SERVICE_VAULT_KDF;
-        opsLimit: number;
-        memLimit: number;
-        salt: string;
-    };
-    nonce: string;
-    ciphertext: string;
-    publicKey: string;
-};
-export type TeamVaultGrantEnvelope = {
-    version: typeof SERVICE_VAULT_ENCRYPTION_VERSION;
-    algorithm: typeof SERVICE_VAULT_KEY_AGREEMENT;
-    recipientPublicKey: string;
-    wrappedTeamVaultKey: string;
-};
-export type SecretOperationLease = {
-    id: string;
-    teamId: string;
-    connectionId: string;
-    capabilityType: string;
-    purpose: 'provider-connection-validation' | 'remote-git-publication' | 'workflow-dispatch' | 'workflow-configuration';
-    resourceScope: Record<string, string>;
-    credentialProfileId: string;
-    actorUserId: string;
-    requiredFields: string[];
-    publicKey: string;
-    status: 'awaiting-runner' | 'pending' | 'ready' | 'consumed' | 'expired' | 'cancelled' | 'failed';
-    expiresAt: string;
-    consumedAt?: string | null;
-    operationCorrelationId: string;
-};
-export type ServiceVaultAssociatedData = {
-    teamId: string;
-    connectionId: string;
-    credentialProfileId: string;
-    field: string;
-    purpose: string;
-    version: number;
-};
-export declare function containsForbiddenPlaintextSecretMaterial(value: unknown, path?: string): string[];
-export declare function canonicalServiceVaultAssociatedData(input: ServiceVaultAssociatedData): string;
-export declare function validateEncryptedCredentialEnvelope(value: unknown): value is EncryptedCredentialEnvelope;

package/dist/secrets-capability/service-vault-contracts.js

@@ -1,39 +0,0 @@
-const SERVICE_VAULT_ENCRYPTION_VERSION = "service-vault-v1";
-const SERVICE_VAULT_AEAD_ALGORITHM = "xchacha20-poly1305-ietf";
-const SERVICE_VAULT_KEY_AGREEMENT = "x25519-sealed-box";
-const SERVICE_VAULT_KDF = "argon2id";
-const FORBIDDEN_SECRET_KEYS = /(?:passphrase|password|plaintext|derivedKey|privateKey|apiToken|accessToken|secretValue|credentialValue)$/iu;
-function containsForbiddenPlaintextSecretMaterial(value, path = "") {
-  if (!value || typeof value !== "object") return [];
-  const failures = [];
-  for (const [key, entry] of Object.entries(value)) {
-    const nextPath = path ? `${path}.${key}` : key;
-    if (FORBIDDEN_SECRET_KEYS.test(key) && typeof entry === "string" && entry.trim()) failures.push(nextPath);
-    if (entry && typeof entry === "object") failures.push(...containsForbiddenPlaintextSecretMaterial(entry, nextPath));
-  }
-  return failures;
-}
-function canonicalServiceVaultAssociatedData(input) {
-  return JSON.stringify({
-    teamId: input.teamId,
-    connectionId: input.connectionId,
-    credentialProfileId: input.credentialProfileId,
-    field: input.field,
-    purpose: input.purpose,
-    version: input.version
-  });
-}
-function validateEncryptedCredentialEnvelope(value) {
-  if (!value || typeof value !== "object") return false;
-  const envelope = value;
-  return envelope.version === SERVICE_VAULT_ENCRYPTION_VERSION && envelope.algorithm === SERVICE_VAULT_AEAD_ALGORITHM && [envelope.ciphertext, envelope.nonce, envelope.wrappedKey, envelope.wrappedKeyNonce, envelope.associatedData, envelope.associatedDataDigest, envelope.fingerprint].every((field) => typeof field === "string" && field.length > 0);
-}
-export {
-  SERVICE_VAULT_AEAD_ALGORITHM,
-  SERVICE_VAULT_ENCRYPTION_VERSION,
-  SERVICE_VAULT_KDF,
-  SERVICE_VAULT_KEY_AGREEMENT,
-  canonicalServiceVaultAssociatedData,
-  containsForbiddenPlaintextSecretMaterial,
-  validateEncryptedCredentialEnvelope
-};

package/dist/treedx/accounts/auth.d.ts

@@ -1,17 +0,0 @@
-export interface TreeDxHs256TokenInput {
-    secret: string;
-    issuer: string;
-    audience: string;
-    actorId: string;
-    tenantId: string;
-    repoIds?: string[];
-    capabilities?: string[];
-    refs?: string[];
-    paths?: string[];
-    projectId?: string;
-    capacityWorkdayRunId?: string;
-    ttlSeconds?: number;
-    nowEpochSeconds?: number;
-    jti?: string;
-}
-export declare function mintTreeDxHs256Token(input: TreeDxHs256TokenInput): string;

package/dist/treedx/accounts/auth.js

@@ -1,48 +0,0 @@
-import { createHmac, randomUUID } from "node:crypto";
-function required(value, owner) {
-  const normalized = value.trim();
-  if (!normalized) throw new Error(`${owner} is required to mint a TreeDX token.`);
-  return normalized;
-}
-function normalizedStrings(values, fallback) {
-  const normalized = values?.map((value) => String(value).trim()).filter(Boolean) ?? [];
-  return normalized.length > 0 ? [...new Set(normalized)] : fallback;
-}
-function base64urlJson(value) {
-  return Buffer.from(JSON.stringify(value)).toString("base64url");
-}
-function mintTreeDxHs256Token(input) {
-  const secret = required(input.secret, "secret");
-  const issuer = required(input.issuer, "issuer");
-  const audience = required(input.audience, "audience");
-  const actorId = required(input.actorId, "actorId");
-  const tenantId = required(input.tenantId, "tenantId");
-  const ttlSeconds = input.ttlSeconds ?? 300;
-  if (!Number.isInteger(ttlSeconds) || ttlSeconds < 30 || ttlSeconds > 3600) {
-    throw new Error("ttlSeconds must be an integer between 30 and 3600.");
-  }
-  const now = input.nowEpochSeconds ?? Math.floor(Date.now() / 1e3);
-  if (!Number.isInteger(now) || now < 0) throw new Error("nowEpochSeconds must be a nonnegative integer.");
-  const payload = {
-    iss: issuer,
-    aud: audience,
-    sub: actorId,
-    jti: input.jti?.trim() || randomUUID(),
-    iat: now,
-    nbf: now - 5,
-    exp: now + ttlSeconds,
-    treedx_actor_id: actorId,
-    treedx_tenant_id: tenantId,
-    treedx_repo_ids: normalizedStrings(input.repoIds, ["*"]),
-    treedx_capabilities: normalizedStrings(input.capabilities, []),
-    treedx_refs: normalizedStrings(input.refs, ["*"]),
-    treedx_paths: normalizedStrings(input.paths, ["**"]),
-    ...input.projectId?.trim() ? { treeseed_project_id: input.projectId.trim() } : {},
-    ...input.capacityWorkdayRunId?.trim() ? { treeseed_capacity_workday_run_id: input.capacityWorkdayRunId.trim() } : {}
-  };
-  const signingInput = `${base64urlJson({ alg: "HS256", typ: "JWT" })}.${base64urlJson(payload)}`;
-  return `${signingInput}.${createHmac("sha256", secret).update(signingInput).digest("base64url")}`;
-}
-export {
-  mintTreeDxHs256Token
-};

package/dist/treedx/client/accounts/contracts/auth-mode.d.ts

@@ -1,3 +0,0 @@
-import { TreeDxClient } from "../../../support/client.js";
-import type { TreeDxAuthMode } from "../../../types.js";
-export declare function authModeMethod(this: TreeDxClient): Promise<TreeDxAuthMode>;

package/dist/treedx/client/accounts/contracts/auth-mode.js

@@ -1,6 +0,0 @@
-function authModeMethod() {
-  return this.request("GET", "/api/v1/auth/mode");
-}
-export {
-  authModeMethod
-};

package/dist/treedx/client/build/creation/build-context.d.ts

@@ -1,3 +0,0 @@
-import { TreeDxClient } from '../../../support/client.js';
-import type { TreeDxContextRequest, TreeDxContextResult } from '../../../types.js';
-export declare function buildContextMethod(this: TreeDxClient, input: TreeDxContextRequest): Promise<TreeDxContextResult>;

package/dist/treedx/client/build/creation/build-context.js

@@ -1,7 +0,0 @@
-function buildContextMethod(input) {
-  const { repoId, ...body } = input;
-  return this.request("POST", `/api/v1/repos/${encodeURIComponent(this.repoId(repoId))}/context/build`, body, { tokenRequired: true });
-}
-export {
-  buildContextMethod
-};

package/dist/treedx/client/build/creation/build-snapshot.d.ts

@@ -1,3 +0,0 @@
-import { TreeDxClient } from '../../../support/client.js';
-import type { TreeDxSnapshot, TreeDxSnapshotBuildRequest } from '../../../types.js';
-export declare function buildSnapshotMethod(this: TreeDxClient, input?: TreeDxSnapshotBuildRequest): Promise<TreeDxSnapshot>;

package/dist/treedx/client/build/creation/build-snapshot.js

@@ -1,8 +0,0 @@
-import { firstPayload } from "../../../support/client.js";
-function buildSnapshotMethod(input = {}) {
-  const { repoId, ...body } = input;
-  return this.request("POST", `/api/v1/repos/${encodeURIComponent(this.repoId(repoId))}/snapshots/build`, body, { tokenRequired: true }).then((payload) => firstPayload(payload, ["snapshot"]));
-}
-export {
-  buildSnapshotMethod
-};

package/dist/treedx/client/capacity/allocations/contracts/put-capability-grant.d.ts

@@ -1,3 +0,0 @@
-import { TreeDxClient } from "../../../../support/client.js";
-import type { TreeDxCapabilityGrant } from "../../../../types.js";
-export declare function putCapabilityGrantMethod(this: TreeDxClient, input: TreeDxCapabilityGrant): Promise<TreeDxCapabilityGrant>;

package/dist/treedx/client/capacity/allocations/contracts/put-capability-grant.js

@@ -1,7 +0,0 @@
-import { firstPayload } from "../../../../support/client.js";
-function putCapabilityGrantMethod(input) {
-  return this.request("POST", "/api/v1/policy/grants", input, { tokenRequired: true }).then((payload) => firstPayload(payload, ["grant"]));
-}
-export {
-  putCapabilityGrantMethod
-};

package/dist/treedx/client/capacity/allocations/queries/list-capability-grants.d.ts

@@ -1,6 +0,0 @@
-import { TreeDxClient } from "../../../../support/client.js";
-import type { TreeDxCapabilityGrant } from "../../../../types.js";
-export declare function listCapabilityGrantsMethod(this: TreeDxClient, input?: {
-    actorId?: string;
-    repoId?: string;
-}): Promise<TreeDxCapabilityGrant[]>;

package/dist/treedx/client/capacity/allocations/queries/list-capability-grants.js

@@ -1,10 +0,0 @@
-import { firstPayload } from "../../../../support/client.js";
-function listCapabilityGrantsMethod(input = {}) {
-  return this.request("GET", "/api/v1/policy/grants", void 0, {
-    query: input,
-    tokenRequired: true
-  }).then((payload) => firstPayload(payload, ["grants"]));
-}
-export {
-  listCapabilityGrantsMethod
-};