@treeseed/sdk 0.13.0-rc.11 → 0.13.0-rc.111

package/dist/capacity-provider/capability-ontology.js

@@ -0,0 +1,221 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+const digest = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+const semver = z.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u);
+const identifier = z.string().regex(/^[a-z][a-z0-9.-]{1,191}$/u);
+const capabilityId = z.string().regex(/^(?:treeseed\.[a-z][a-z0-9.-]*|provider\.[a-f0-9]{16,64}\.[a-z][a-z0-9.-]*)$/u);
+const jsonSchema = z.record(z.unknown());
+const capabilityReferenceSchema = z.object({ id: capabilityId, version: semver, digest }).strict();
+const artifactContractSchema = z.object({ id: identifier, version: semver, digest, mediaTypes: z.array(z.string().min(1)).default([]) }).strict();
+const configurationFieldSchema = z.object({
+  key: identifier,
+  description: z.string().min(1),
+  schema: jsonSchema,
+  requirementSupport: z.array(z.enum(["required", "preferred"])).min(1),
+  securityCritical: z.boolean().default(false)
+}).strict();
+const capabilityDefinitionSchema = z.object({
+  schemaVersion: z.literal("treeseed.capability-definition/v1"),
+  id: capabilityId,
+  version: semver,
+  digest,
+  family: z.enum(["coordination", "research", "data", "engineering", "publishing", "external-work"]),
+  title: z.string().min(1),
+  description: z.string().min(1),
+  status: z.enum(["active", "deprecated", "revoked"]),
+  features: z.array(identifier),
+  inputs: z.array(artifactContractSchema),
+  outputs: z.array(artifactContractSchema),
+  configuration: z.array(configurationFieldSchema),
+  permissionClasses: z.array(identifier),
+  contextModes: z.array(identifier),
+  interactionModes: z.array(identifier),
+  implies: z.array(capabilityReferenceSchema),
+  conflicts: z.array(capabilityReferenceSchema),
+  qualificationTier: z.enum(["signed-attestation", "automated-suite", "reviewed-certification"]),
+  createdAt: z.string().datetime()
+}).strict();
+const capabilityOntologySchema = z.object({
+  schemaVersion: z.literal("treeseed.capability-ontology/v1"),
+  generation: z.number().int().positive(),
+  digest,
+  definitions: z.array(capabilityDefinitionSchema),
+  createdAt: z.string().datetime(),
+  signature: z.object({ keyId: identifier, algorithm: z.enum(["Ed25519", "release-catalog"]), value: z.string().min(1) }).strict()
+}).strict().superRefine((catalog, context) => {
+  const keys = catalog.definitions.map((entry) => `${entry.id}@${entry.version}`);
+  if (new Set(keys).size !== keys.length) context.addIssue({ code: z.ZodIssueCode.custom, path: ["definitions"], message: "Capability definitions must be unique by id and version." });
+});
+const configuredValueSchema = z.object({ value: z.unknown(), requirement: z.enum(["required", "preferred"]) }).strict();
+const capabilityDemandSchema = z.object({
+  schemaVersion: z.literal("treeseed.capability-demand/v1"),
+  ontologyGeneration: z.number().int().positive(),
+  requirements: z.array(z.object({
+    capabilityId,
+    versionRange: z.string().min(1),
+    requirement: z.enum(["required", "preferred"]),
+    alternativeGroup: identifier.nullable().default(null),
+    requiredFeatures: z.array(identifier).default([]),
+    configuration: z.record(configuredValueSchema).default({})
+  }).strict()).min(1),
+  resolved: z.array(capabilityReferenceSchema),
+  permissionClasses: z.array(identifier),
+  contextModes: z.array(identifier),
+  inputContracts: z.array(artifactContractSchema),
+  outputContracts: z.array(artifactContractSchema),
+  demandDigest: digest
+}).strict();
+const capabilityConformanceSchema = z.object({
+  schemaVersion: z.literal("treeseed.capability-conformance/v1"),
+  providerId: z.string().min(1),
+  capability: capabilityReferenceSchema,
+  tier: z.enum(["signed-attestation", "automated-suite", "reviewed-certification"]),
+  status: z.enum(["passed", "failed", "revoked"]),
+  evidenceDigest: digest,
+  suite: z.object({ id: identifier, version: semver }).strict().nullable(),
+  issuedAt: z.string().datetime(),
+  expiresAt: z.string().datetime().nullable(),
+  signature: z.object({ keyId: identifier, algorithm: z.literal("Ed25519"), value: z.string().min(1) }).strict()
+}).strict();
+const providerContextCapacitySchema = z.discriminatedUnion("mode", [
+  z.object({
+    mode: z.literal("bounded"),
+    measurement: z.enum(["tokens", "bytes", "items"]),
+    defaultInitial: z.number().int().positive(),
+    maximum: z.number().int().positive(),
+    reservedOutput: z.number().int().nonnegative().default(0),
+    transportPayloadBytes: z.number().int().positive(),
+    measurementProvenance: z.object({ provider: identifier, implementation: z.string().min(1), version: z.string().min(1).nullable() }).strict()
+  }).strict(),
+  z.object({
+    mode: z.literal("unbounded"),
+    measurement: z.enum(["tokens", "bytes", "items"]).nullable().default(null),
+    transportPayloadBytes: z.number().int().positive(),
+    measurementProvenance: z.object({ provider: identifier, implementation: z.string().min(1), version: z.string().min(1).nullable() }).strict()
+  }).strict()
+]).superRefine((value, context) => {
+  if (value.mode === "bounded" && value.defaultInitial > value.maximum) context.addIssue({ code: z.ZodIssueCode.custom, path: ["defaultInitial"], message: "Default initial context cannot exceed the maximum." });
+  if (value.mode === "bounded" && value.measurement === "tokens" && value.reservedOutput >= value.maximum) context.addIssue({ code: z.ZodIssueCode.custom, path: ["reservedOutput"], message: "Reserved output must leave room for input context." });
+});
+const capabilityOfferSchema = z.object({
+  schemaVersion: z.literal("treeseed.capability-offer/v2"),
+  offerId: identifier,
+  capabilities: z.array(capabilityReferenceSchema).min(1),
+  features: z.array(identifier),
+  configurationSupport: z.record(z.object({ required: z.boolean(), preferred: z.boolean() }).strict()),
+  permissionClasses: z.array(identifier),
+  contextModes: z.array(identifier),
+  inputContracts: z.array(artifactContractSchema),
+  outputContracts: z.array(artifactContractSchema),
+  interactionModes: z.array(identifier),
+  conformance: z.array(capabilityConformanceSchema).min(1),
+  contextCapacity: providerContextCapacitySchema,
+  limits: z.record(z.unknown()),
+  commercial: z.object({ currency: z.string().min(3).max(3).nullable(), estimatedCost: z.number().nonnegative().nullable() }).strict(),
+  region: z.string().min(1).nullable(),
+  trust: z.array(identifier),
+  offerDigest: digest
+}).strict();
+const capabilityNegotiationReceiptSchema = z.object({
+  schemaVersion: z.literal("treeseed.capability-negotiation/v1"),
+  demandDigest: digest,
+  offerDigest: digest,
+  eligible: z.boolean(),
+  resolvedCapabilities: z.array(capabilityReferenceSchema),
+  omittedPreferred: z.array(z.string()),
+  reasons: z.array(z.string()),
+  receiptDigest: digest
+}).strict();
+function canonical(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  return `{${Object.entries(value).filter(([, item]) => item !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(",")}}`;
+}
+function capabilityContractDigest(value) {
+  return `sha256:${createHash("sha256").update(canonical(value)).digest("hex")}`;
+}
+function capabilityDefinitionDigest(value) {
+  return capabilityContractDigest(value);
+}
+function capabilityOfferDigest(value) {
+  return capabilityContractDigest(value);
+}
+function capabilityDemandDigest(value) {
+  return capabilityContractDigest(value);
+}
+function semverSatisfies(version, range) {
+  const parse = (input) => /^([0-9]+)\.([0-9]+)\.([0-9]+)(?:-|$)/u.exec(input)?.slice(1, 4).map(Number) ?? null;
+  const actual = parse(version);
+  if (!actual) return false;
+  const compare = (left, right) => left[0] - right[0] || left[1] - right[1] || left[2] - right[2];
+  if (range.includes("||")) return range.split("||").some((part) => semverSatisfies(version, part.trim()));
+  if (/\s/u.test(range.trim())) return range.trim().split(/\s+/u).every((part) => semverSatisfies(version, part));
+  for (const operator of [">=", "<=", ">", "<"]) if (range.startsWith(operator)) {
+    const expected = parse(range.slice(operator.length));
+    if (!expected) return false;
+    const result = compare(actual, expected);
+    return operator === ">=" ? result >= 0 : operator === "<=" ? result <= 0 : operator === ">" ? result > 0 : result < 0;
+  }
+  if (range.startsWith("^")) {
+    const expected = parse(range.slice(1));
+    if (!expected || compare(actual, expected) < 0) return false;
+    return expected[0] > 0 ? actual[0] === expected[0] : expected[1] > 0 ? actual[0] === 0 && actual[1] === expected[1] : compare(actual, [0, 0, expected[2] + 1]) < 0;
+  }
+  if (range.startsWith("~")) {
+    const expected = parse(range.slice(1));
+    return Boolean(expected && actual[0] === expected[0] && actual[1] === expected[1] && compare(actual, expected) >= 0);
+  }
+  if (/^\d+\.x$/u.test(range)) return actual[0] === Number(range.split(".")[0]);
+  const exact = parse(range);
+  return Boolean(exact && compare(actual, exact) === 0);
+}
+function negotiateCapabilityOffer(demand, offer) {
+  const reasons = [], omittedPreferred = [], resolvedCapabilities = [];
+  const alternatives = /* @__PURE__ */ new Map();
+  for (const requirement of demand.requirements) {
+    const candidates = offer.capabilities.filter((capability) => capability.id === requirement.capabilityId && semverSatisfies(capability.version, requirement.versionRange));
+    const compatible = candidates.find((capability) => demand.resolved.some((resolved) => resolved.id === capability.id && resolved.version === capability.version && resolved.digest === capability.digest));
+    const featureCompatible = compatible && requirement.requiredFeatures.every((feature) => offer.features.includes(feature));
+    const configMissing = Object.entries(requirement.configuration).filter(([key, configured]) => configured.requirement === "required" && offer.configurationSupport[key]?.required !== true).map(([key]) => key);
+    const satisfied = Boolean(featureCompatible && configMissing.length === 0);
+    if (requirement.alternativeGroup) {
+      const group = alternatives.get(requirement.alternativeGroup) ?? { satisfied: false, required: false };
+      alternatives.set(requirement.alternativeGroup, { satisfied: group.satisfied || satisfied, required: group.required || requirement.requirement === "required" });
+    } else if (!satisfied && requirement.requirement === "required") reasons.push(`missing_required_capability:${requirement.capabilityId}`);
+    else if (!satisfied) omittedPreferred.push(`capability:${requirement.capabilityId}`);
+    if (satisfied && compatible) resolvedCapabilities.push(compatible);
+    for (const [key, configured] of Object.entries(requirement.configuration)) if (configured.requirement === "preferred" && offer.configurationSupport[key]?.preferred !== true) omittedPreferred.push(`configuration:${requirement.capabilityId}:${key}`);
+  }
+  for (const [group, state] of alternatives) if (!state.satisfied && state.required) reasons.push(`missing_required_alternative:${group}`);
+  else if (!state.satisfied) omittedPreferred.push(`alternative:${group}`);
+  for (const permission of demand.permissionClasses) if (!offer.permissionClasses.includes(permission)) reasons.push(`missing_permission_support:${permission}`);
+  for (const mode of demand.contextModes) if (!offer.contextModes.includes(mode)) reasons.push(`missing_context_mode:${mode}`);
+  for (const contract of demand.inputContracts) if (!offer.inputContracts.some((candidate) => candidate.id === contract.id && candidate.version === contract.version && candidate.digest === contract.digest)) reasons.push(`missing_input_contract:${contract.id}`);
+  for (const contract of demand.outputContracts) if (!offer.outputContracts.some((candidate) => candidate.id === contract.id && candidate.version === contract.version && candidate.digest === contract.digest)) reasons.push(`missing_output_contract:${contract.id}`);
+  const material = {
+    schemaVersion: "treeseed.capability-negotiation/v1",
+    demandDigest: demand.demandDigest,
+    offerDigest: offer.offerDigest,
+    eligible: reasons.length === 0,
+    resolvedCapabilities,
+    omittedPreferred: [...new Set(omittedPreferred)].sort(),
+    reasons: [...new Set(reasons)].sort()
+  };
+  return capabilityNegotiationReceiptSchema.parse({ ...material, receiptDigest: capabilityContractDigest(material) });
+}
+export {
+  capabilityConformanceSchema,
+  capabilityContractDigest,
+  capabilityDefinitionDigest,
+  capabilityDefinitionSchema,
+  capabilityDemandDigest,
+  capabilityDemandSchema,
+  capabilityNegotiationReceiptSchema,
+  capabilityOfferDigest,
+  capabilityOfferSchema,
+  capabilityOntologySchema,
+  capabilityReferenceSchema,
+  negotiateCapabilityOffer,
+  providerContextCapacitySchema,
+  semverSatisfies
+};

package/dist/capacity-provider/client.d.ts

@@ -1,6 +1,7 @@
 import type { ProviderAssignmentLifecycleRequest, ProviderAssignmentLifecycleResult, ProviderNextAssignmentRequest } from '../capacity/agents/agent-capacity.js';
 import type { ProviderRuntimeEventInput } from '../agent-capacity/contracts/capacity/workdays/workday-records.js';
 import type { CapacityProviderIdentity, CapacityProviderIdentityRotationRequest, CapacityProviderSignedProof, ProviderAccessTokenIssue, ProviderAvailabilitySession, ProviderCredentialIssuanceAuthorization, ProviderRegistrationRequest, ProviderRegistrationSubmission, ProviderTeamCredentialIssue } from './contracts/index.js';
+import type { ProviderDiscussionResponseRequest } from '../operator-contracts/communication/contracts.js';
 export interface ProviderProtocolClientOptions {
     controlPlaneUrl: string;
     accessToken?: string;
@@ -43,6 +44,29 @@ export declare class ProviderProtocolClient {
     startAssignmentExecution(assignmentId: string, request: Record<string, unknown>): Promise<Record<string, unknown>>;
     startAssignmentCloseout(assignmentId: string, request: Record<string, unknown>): Promise<Record<string, unknown>>;
     preflightAssignmentCompletion(assignmentId: string, request: Record<string, unknown>): Promise<Record<string, unknown>>;
+    respondToAssignmentDiscussion(assignmentId: string, request: ProviderDiscussionResponseRequest, idempotencyKey: string): Promise<{
+        status: "responded" | "abstained";
+        schemaVersion: "treeseed.provider-discussion-response-receipt/v1";
+        assignmentId: string;
+        invocationId: string;
+        messageRef: string;
+        settledAt: string;
+    }>;
+    acknowledgeCommunicationNotification(assignmentId: string, request: {
+        providerId: string;
+        runnerId: string;
+        observedAt: string;
+    }): Promise<Record<string, unknown>>;
+    createCommunicationTraceEvent(assignmentId: string, request: {
+        leaseToken: string;
+        runnerId: string;
+        sequence: number;
+        type: string;
+        occurredAt: string;
+        summary: string;
+        payload: Record<string, unknown>;
+        protectedPayload?: Record<string, unknown>;
+    }): Promise<Record<string, unknown>>;
     returnAssignment(assignmentId: string, request?: ProviderAssignmentLifecycleRequest): Promise<ProviderAssignmentLifecycleResult>;
     completeAssignment(assignmentId: string, request?: ProviderAssignmentLifecycleRequest): Promise<ProviderAssignmentLifecycleResult>;
     failAssignment(assignmentId: string, request?: ProviderAssignmentLifecycleRequest): Promise<ProviderAssignmentLifecycleResult>;

package/dist/capacity-provider/client.js

@@ -48,11 +48,12 @@ class ProviderProtocolClient {
         fetchImpl: this.fetchImpl,
         userAgent: this.userAgent
       });
+      const idempotencyKey = options.idempotencyKey ?? (operation.descriptor.idempotency.required ? globalThis.crypto.randomUUID() : void 0);
       const response = await client.invoke(operation, {
         path: input.path ?? {},
         query: input.query ?? {},
         body: input.body
-      }, { authorization, headers: options.headers, idempotencyKey: options.idempotencyKey, signal: controller.signal });
+      }, { authorization, headers: options.headers, idempotencyKey, signal: controller.signal });
       return response.data;
     } catch (error) {
       if (error instanceof CapacityProviderApiError) throw error;
@@ -125,6 +126,15 @@ class ProviderProtocolClient {
   preflightAssignmentCompletion(assignmentId, request) {
     return this.invoke(CONTROL_PLANE_OPERATIONS.providers.completionPreflight, { path: { assignmentId }, body: request });
   }
+  respondToAssignmentDiscussion(assignmentId, request, idempotencyKey) {
+    return this.invoke(CONTROL_PLANE_OPERATIONS.providers.discussionResponse, { path: { assignmentId }, body: request }, { idempotencyKey });
+  }
+  acknowledgeCommunicationNotification(assignmentId, request) {
+    return this.invoke(CONTROL_PLANE_OPERATIONS.providers.notificationAcknowledge, { path: { assignmentId }, body: request });
+  }
+  createCommunicationTraceEvent(assignmentId, request) {
+    return this.invoke(CONTROL_PLANE_OPERATIONS.providers.traceEvent, { path: { assignmentId }, body: request });
+  }
   returnAssignment(assignmentId, request = {}) {
     return this.invoke(CONTROL_PLANE_OPERATIONS.providers.returnAssignment, { path: { assignmentId }, body: request });
   }

package/dist/capacity-provider/contracts/environment-profiles.d.ts

@@ -0,0 +1,255 @@
+import { z } from 'zod';
+export declare const providerRegistrationCodeStatusSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.provider-registration-code-status/v1">;
+    teamId: z.ZodString;
+    generation: z.ZodNumber;
+    codePrefix: z.ZodString;
+    rotatedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.provider-registration-code-status/v1";
+    teamId: string;
+    rotatedAt: string;
+    generation: number;
+    codePrefix: string;
+}, {
+    schemaVersion: "treeseed.provider-registration-code-status/v1";
+    teamId: string;
+    rotatedAt: string;
+    generation: number;
+    codePrefix: string;
+}>;
+export declare const providerRegistrationCodeReceiptSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.provider-registration-code-receipt/v1">;
+    teamId: z.ZodString;
+    generation: z.ZodNumber;
+    codePrefix: z.ZodString;
+    registrationCode: z.ZodString;
+    rotatedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.provider-registration-code-receipt/v1";
+    teamId: string;
+    rotatedAt: string;
+    generation: number;
+    codePrefix: string;
+    registrationCode: string;
+}, {
+    schemaVersion: "treeseed.provider-registration-code-receipt/v1";
+    teamId: string;
+    rotatedAt: string;
+    generation: number;
+    codePrefix: string;
+    registrationCode: string;
+}>;
+export declare const providerEnvironmentVariableDescriptorSchema: z.ZodObject<{
+    name: z.ZodString;
+    available: z.ZodBoolean;
+    rotatedAt: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    name: string;
+    available: boolean;
+    rotatedAt?: string | undefined;
+}, {
+    name: string;
+    available: boolean;
+    rotatedAt?: string | undefined;
+}>;
+export declare const providerEnvironmentProfileDescriptorSchema: z.ZodEffects<z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.provider-environment-profile/v1">;
+    id: z.ZodString;
+    generation: z.ZodNumber;
+    variables: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        available: z.ZodBoolean;
+        rotatedAt: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        name: string;
+        available: boolean;
+        rotatedAt?: string | undefined;
+    }, {
+        name: string;
+        available: boolean;
+        rotatedAt?: string | undefined;
+    }>, "many">;
+    updatedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    schemaVersion: "treeseed.provider-environment-profile/v1";
+    variables: {
+        name: string;
+        available: boolean;
+        rotatedAt?: string | undefined;
+    }[];
+    generation: number;
+    updatedAt: string;
+}, {
+    id: string;
+    schemaVersion: "treeseed.provider-environment-profile/v1";
+    variables: {
+        name: string;
+        available: boolean;
+        rotatedAt?: string | undefined;
+    }[];
+    generation: number;
+    updatedAt: string;
+}>, {
+    id: string;
+    schemaVersion: "treeseed.provider-environment-profile/v1";
+    variables: {
+        name: string;
+        available: boolean;
+        rotatedAt?: string | undefined;
+    }[];
+    generation: number;
+    updatedAt: string;
+}, {
+    id: string;
+    schemaVersion: "treeseed.provider-environment-profile/v1";
+    variables: {
+        name: string;
+        available: boolean;
+        rotatedAt?: string | undefined;
+    }[];
+    generation: number;
+    updatedAt: string;
+}>;
+export declare const assignmentEnvironmentGrantSchema: z.ZodEffects<z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.assignment-environment-grant/v1">;
+    grantId: z.ZodString;
+    assignmentId: z.ZodString;
+    providerId: z.ZodString;
+    teamId: z.ZodString;
+    projectId: z.ZodString;
+    profileId: z.ZodString;
+    variables: z.ZodArray<z.ZodString, "many">;
+    network: z.ZodObject<{
+        allowed: z.ZodBoolean;
+        destinations: z.ZodArray<z.ZodString, "many">;
+    }, "strict", z.ZodTypeAny, {
+        allowed: boolean;
+        destinations: string[];
+    }, {
+        allowed: boolean;
+        destinations: string[];
+    }>;
+    policy: z.ZodObject<{
+        handlerDeclarationDigest: z.ZodString;
+        providerOfferDigest: z.ZodString;
+        providerPermissionDigest: z.ZodString;
+        teamApprovalDigest: z.ZodString;
+        assignmentGrantDigest: z.ZodString;
+        sandboxPolicyDigest: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        handlerDeclarationDigest: string;
+        providerOfferDigest: string;
+        providerPermissionDigest: string;
+        teamApprovalDigest: string;
+        assignmentGrantDigest: string;
+        sandboxPolicyDigest: string;
+    }, {
+        handlerDeclarationDigest: string;
+        providerOfferDigest: string;
+        providerPermissionDigest: string;
+        teamApprovalDigest: string;
+        assignmentGrantDigest: string;
+        sandboxPolicyDigest: string;
+    }>;
+    issuedAt: z.ZodString;
+    expiresAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    expiresAt: string;
+    schemaVersion: "treeseed.assignment-environment-grant/v1";
+    projectId: string;
+    teamId: string;
+    providerId: string;
+    issuedAt: string;
+    variables: string[];
+    assignmentId: string;
+    profileId: string;
+    network: {
+        allowed: boolean;
+        destinations: string[];
+    };
+    policy: {
+        handlerDeclarationDigest: string;
+        providerOfferDigest: string;
+        providerPermissionDigest: string;
+        teamApprovalDigest: string;
+        assignmentGrantDigest: string;
+        sandboxPolicyDigest: string;
+    };
+    grantId: string;
+}, {
+    expiresAt: string;
+    schemaVersion: "treeseed.assignment-environment-grant/v1";
+    projectId: string;
+    teamId: string;
+    providerId: string;
+    issuedAt: string;
+    variables: string[];
+    assignmentId: string;
+    profileId: string;
+    network: {
+        allowed: boolean;
+        destinations: string[];
+    };
+    policy: {
+        handlerDeclarationDigest: string;
+        providerOfferDigest: string;
+        providerPermissionDigest: string;
+        teamApprovalDigest: string;
+        assignmentGrantDigest: string;
+        sandboxPolicyDigest: string;
+    };
+    grantId: string;
+}>, {
+    expiresAt: string;
+    schemaVersion: "treeseed.assignment-environment-grant/v1";
+    projectId: string;
+    teamId: string;
+    providerId: string;
+    issuedAt: string;
+    variables: string[];
+    assignmentId: string;
+    profileId: string;
+    network: {
+        allowed: boolean;
+        destinations: string[];
+    };
+    policy: {
+        handlerDeclarationDigest: string;
+        providerOfferDigest: string;
+        providerPermissionDigest: string;
+        teamApprovalDigest: string;
+        assignmentGrantDigest: string;
+        sandboxPolicyDigest: string;
+    };
+    grantId: string;
+}, {
+    expiresAt: string;
+    schemaVersion: "treeseed.assignment-environment-grant/v1";
+    projectId: string;
+    teamId: string;
+    providerId: string;
+    issuedAt: string;
+    variables: string[];
+    assignmentId: string;
+    profileId: string;
+    network: {
+        allowed: boolean;
+        destinations: string[];
+    };
+    policy: {
+        handlerDeclarationDigest: string;
+        providerOfferDigest: string;
+        providerPermissionDigest: string;
+        teamApprovalDigest: string;
+        assignmentGrantDigest: string;
+        sandboxPolicyDigest: string;
+    };
+    grantId: string;
+}>;
+export type ProviderRegistrationCodeStatus = z.infer<typeof providerRegistrationCodeStatusSchema>;
+export type ProviderRegistrationCodeReceipt = z.infer<typeof providerRegistrationCodeReceiptSchema>;
+export type ProviderEnvironmentVariableDescriptor = z.infer<typeof providerEnvironmentVariableDescriptorSchema>;
+export type ProviderEnvironmentProfileDescriptor = z.infer<typeof providerEnvironmentProfileDescriptorSchema>;
+export type AssignmentEnvironmentGrant = z.infer<typeof assignmentEnvironmentGrantSchema>;

package/dist/capacity-provider/contracts/environment-profiles.js

@@ -0,0 +1,71 @@
+import { z } from "zod";
+const identifier = z.string().regex(/^[a-z][a-z0-9._-]{0,127}$/u);
+const digest = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+const variableName = z.string().regex(/^[A-Z_][A-Z0-9_]*$/u);
+const maximumGrantLifetimeMs = 24 * 60 * 60 * 1e3;
+const providerRegistrationCodeStatusSchema = z.object({
+  schemaVersion: z.literal("treeseed.provider-registration-code-status/v1"),
+  teamId: z.string().min(1),
+  generation: z.number().int().positive(),
+  codePrefix: z.string().min(1),
+  rotatedAt: z.string().datetime()
+}).strict();
+const providerRegistrationCodeReceiptSchema = z.object({
+  schemaVersion: z.literal("treeseed.provider-registration-code-receipt/v1"),
+  teamId: z.string().min(1),
+  generation: z.number().int().positive(),
+  codePrefix: z.string().min(1),
+  registrationCode: z.string().min(16),
+  rotatedAt: z.string().datetime()
+}).strict();
+const providerEnvironmentVariableDescriptorSchema = z.object({
+  name: variableName,
+  available: z.boolean(),
+  rotatedAt: z.string().datetime().optional()
+}).strict();
+const providerEnvironmentProfileDescriptorSchema = z.object({
+  schemaVersion: z.literal("treeseed.provider-environment-profile/v1"),
+  id: identifier,
+  generation: z.number().int().positive(),
+  variables: z.array(providerEnvironmentVariableDescriptorSchema),
+  updatedAt: z.string().datetime()
+}).strict().superRefine((profile, context) => {
+  const names = /* @__PURE__ */ new Set();
+  for (const [index, variable] of profile.variables.entries()) {
+    if (names.has(variable.name)) context.addIssue({ code: z.ZodIssueCode.custom, path: ["variables", index, "name"], message: "Environment variable names must be unique within a profile." });
+    names.add(variable.name);
+  }
+});
+const assignmentEnvironmentGrantSchema = z.object({
+  schemaVersion: z.literal("treeseed.assignment-environment-grant/v1"),
+  grantId: identifier,
+  assignmentId: z.string().min(1),
+  providerId: z.string().min(1),
+  teamId: z.string().min(1),
+  projectId: z.string().min(1),
+  profileId: identifier,
+  variables: z.array(variableName).min(1),
+  network: z.object({ allowed: z.boolean(), destinations: z.array(z.string().min(1)) }).strict(),
+  policy: z.object({
+    handlerDeclarationDigest: digest,
+    providerOfferDigest: digest,
+    providerPermissionDigest: digest,
+    teamApprovalDigest: digest,
+    assignmentGrantDigest: digest,
+    sandboxPolicyDigest: digest
+  }).strict(),
+  issuedAt: z.string().datetime(),
+  expiresAt: z.string().datetime()
+}).strict().superRefine((grant, context) => {
+  if (new Set(grant.variables).size !== grant.variables.length) context.addIssue({ code: z.ZodIssueCode.custom, path: ["variables"], message: "Granted environment variables must be unique." });
+  if (Date.parse(grant.expiresAt) <= Date.parse(grant.issuedAt)) context.addIssue({ code: z.ZodIssueCode.custom, path: ["expiresAt"], message: "Environment grants must expire after issuance." });
+  if (Date.parse(grant.expiresAt) - Date.parse(grant.issuedAt) > maximumGrantLifetimeMs) context.addIssue({ code: z.ZodIssueCode.custom, path: ["expiresAt"], message: "Environment grants cannot exceed 24 hours." });
+  if (!grant.network.allowed && grant.network.destinations.length) context.addIssue({ code: z.ZodIssueCode.custom, path: ["network", "destinations"], message: "Denied network authority cannot declare destinations." });
+});
+export {
+  assignmentEnvironmentGrantSchema,
+  providerEnvironmentProfileDescriptorSchema,
+  providerEnvironmentVariableDescriptorSchema,
+  providerRegistrationCodeReceiptSchema,
+  providerRegistrationCodeStatusSchema
+};