@treeseed/sdk 0.13.0-rc.112 → 0.13.0-rc.113

package/dist/.treeseed-build-complete.json

@@ -1 +1 @@
-{"completedAt":"2026-09-10T22:11:14.723Z"}
+{"completedAt":"2026-09-10T23:14:23.976Z"}

package/dist/capacity-provider/source-workspace.d.ts

@@ -342,3 +342,380 @@ export type SourceWorkspaceKey = z.infer<typeof sourceWorkspaceKeySchema>;
 export type SourceWorkspaceAuthorization = z.infer<typeof sourceWorkspaceAuthorizationSchema>;
 export type SourceWorkspaceLease = z.infer<typeof sourceWorkspaceLeaseSchema>;
 export type SourceCandidateReceipt = z.infer<typeof sourceCandidateReceiptSchema>;
+/** Provider-manager transport only. Recipient is an ephemeral host key, never a guest key. */
+export declare const sourceWorkspaceRequestSchema: z.ZodObject<{
+    runnerId: z.ZodString;
+    leaseToken: z.ZodString;
+    recipientPublicKey: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    runnerId: string;
+    leaseToken: string;
+    recipientPublicKey: string;
+}, {
+    runnerId: string;
+    leaseToken: string;
+    recipientPublicKey: string;
+}>;
+export declare const sourceCredentialDeliverySchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.source-credential-delivery/v1">;
+    id: z.ZodString;
+    authorizationId: z.ZodString;
+    algorithm: z.ZodLiteral<"x25519-hkdf-sha256-chacha20-poly1305">;
+    ephemeralPublicKey: z.ZodString;
+    nonce: z.ZodString;
+    ciphertext: z.ZodString;
+    tag: z.ZodString;
+    expiresAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    nonce: string;
+    expiresAt: string;
+    schemaVersion: "treeseed.source-credential-delivery/v1";
+    algorithm: "x25519-hkdf-sha256-chacha20-poly1305";
+    ciphertext: string;
+    tag: string;
+    authorizationId: string;
+    ephemeralPublicKey: string;
+}, {
+    id: string;
+    nonce: string;
+    expiresAt: string;
+    schemaVersion: "treeseed.source-credential-delivery/v1";
+    algorithm: "x25519-hkdf-sha256-chacha20-poly1305";
+    ciphertext: string;
+    tag: string;
+    authorizationId: string;
+    ephemeralPublicKey: string;
+}>;
+export declare const sourceWorkspaceResponseSchema: z.ZodEffects<z.ZodObject<{
+    authorization: z.ZodEffects<z.ZodObject<{
+        schemaVersion: z.ZodLiteral<"treeseed.source-workspace-authorization/v1">;
+        id: z.ZodString;
+        providerId: z.ZodString;
+        assignmentId: z.ZodString;
+        attempt: z.ZodNumber;
+        source: z.ZodObject<{
+            controlPlaneId: z.ZodString;
+            teamId: z.ZodString;
+            projectId: z.ZodString;
+            repositoryId: z.ZodString;
+            commit: z.ZodString;
+            formatVersion: z.ZodLiteral<1>;
+            profile: z.ZodLiteral<"source-only">;
+        }, "strict", z.ZodTypeAny, {
+            commit: string;
+            projectId: string;
+            teamId: string;
+            profile: "source-only";
+            repositoryId: string;
+            controlPlaneId: string;
+            formatVersion: 1;
+        }, {
+            commit: string;
+            projectId: string;
+            teamId: string;
+            profile: "source-only";
+            repositoryId: string;
+            controlPlaneId: string;
+            formatVersion: 1;
+        }>;
+        mode: z.ZodEnum<["analysis", "work"]>;
+        publication: z.ZodEnum<["denied", "candidate-only"]>;
+        credentialBindingId: z.ZodString;
+        issuedAt: z.ZodString;
+        expiresAt: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        expiresAt: string;
+        schemaVersion: "treeseed.source-workspace-authorization/v1";
+        providerId: string;
+        issuedAt: string;
+        assignmentId: string;
+        source: {
+            commit: string;
+            projectId: string;
+            teamId: string;
+            profile: "source-only";
+            repositoryId: string;
+            controlPlaneId: string;
+            formatVersion: 1;
+        };
+        mode: "analysis" | "work";
+        attempt: number;
+        publication: "denied" | "candidate-only";
+        credentialBindingId: string;
+    }, {
+        id: string;
+        expiresAt: string;
+        schemaVersion: "treeseed.source-workspace-authorization/v1";
+        providerId: string;
+        issuedAt: string;
+        assignmentId: string;
+        source: {
+            commit: string;
+            projectId: string;
+            teamId: string;
+            profile: "source-only";
+            repositoryId: string;
+            controlPlaneId: string;
+            formatVersion: 1;
+        };
+        mode: "analysis" | "work";
+        attempt: number;
+        publication: "denied" | "candidate-only";
+        credentialBindingId: string;
+    }>, {
+        id: string;
+        expiresAt: string;
+        schemaVersion: "treeseed.source-workspace-authorization/v1";
+        providerId: string;
+        issuedAt: string;
+        assignmentId: string;
+        source: {
+            commit: string;
+            projectId: string;
+            teamId: string;
+            profile: "source-only";
+            repositoryId: string;
+            controlPlaneId: string;
+            formatVersion: 1;
+        };
+        mode: "analysis" | "work";
+        attempt: number;
+        publication: "denied" | "candidate-only";
+        credentialBindingId: string;
+    }, {
+        id: string;
+        expiresAt: string;
+        schemaVersion: "treeseed.source-workspace-authorization/v1";
+        providerId: string;
+        issuedAt: string;
+        assignmentId: string;
+        source: {
+            commit: string;
+            projectId: string;
+            teamId: string;
+            profile: "source-only";
+            repositoryId: string;
+            controlPlaneId: string;
+            formatVersion: 1;
+        };
+        mode: "analysis" | "work";
+        attempt: number;
+        publication: "denied" | "candidate-only";
+        credentialBindingId: string;
+    }>;
+    repository: z.ZodObject<{
+        provider: z.ZodLiteral<"github">;
+        owner: z.ZodString;
+        name: z.ZodString;
+        cloneUrl: z.ZodString;
+        ref: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        provider: "github";
+        name: string;
+        owner: string;
+        ref: string;
+        cloneUrl: string;
+    }, {
+        provider: "github";
+        name: string;
+        owner: string;
+        ref: string;
+        cloneUrl: string;
+    }>;
+    credential: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<"treeseed.source-credential-delivery/v1">;
+        id: z.ZodString;
+        authorizationId: z.ZodString;
+        algorithm: z.ZodLiteral<"x25519-hkdf-sha256-chacha20-poly1305">;
+        ephemeralPublicKey: z.ZodString;
+        nonce: z.ZodString;
+        ciphertext: z.ZodString;
+        tag: z.ZodString;
+        expiresAt: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        nonce: string;
+        expiresAt: string;
+        schemaVersion: "treeseed.source-credential-delivery/v1";
+        algorithm: "x25519-hkdf-sha256-chacha20-poly1305";
+        ciphertext: string;
+        tag: string;
+        authorizationId: string;
+        ephemeralPublicKey: string;
+    }, {
+        id: string;
+        nonce: string;
+        expiresAt: string;
+        schemaVersion: "treeseed.source-credential-delivery/v1";
+        algorithm: "x25519-hkdf-sha256-chacha20-poly1305";
+        ciphertext: string;
+        tag: string;
+        authorizationId: string;
+        ephemeralPublicKey: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    repository: {
+        provider: "github";
+        name: string;
+        owner: string;
+        ref: string;
+        cloneUrl: string;
+    };
+    authorization: {
+        id: string;
+        expiresAt: string;
+        schemaVersion: "treeseed.source-workspace-authorization/v1";
+        providerId: string;
+        issuedAt: string;
+        assignmentId: string;
+        source: {
+            commit: string;
+            projectId: string;
+            teamId: string;
+            profile: "source-only";
+            repositoryId: string;
+            controlPlaneId: string;
+            formatVersion: 1;
+        };
+        mode: "analysis" | "work";
+        attempt: number;
+        publication: "denied" | "candidate-only";
+        credentialBindingId: string;
+    };
+    credential: {
+        id: string;
+        nonce: string;
+        expiresAt: string;
+        schemaVersion: "treeseed.source-credential-delivery/v1";
+        algorithm: "x25519-hkdf-sha256-chacha20-poly1305";
+        ciphertext: string;
+        tag: string;
+        authorizationId: string;
+        ephemeralPublicKey: string;
+    };
+}, {
+    repository: {
+        provider: "github";
+        name: string;
+        owner: string;
+        ref: string;
+        cloneUrl: string;
+    };
+    authorization: {
+        id: string;
+        expiresAt: string;
+        schemaVersion: "treeseed.source-workspace-authorization/v1";
+        providerId: string;
+        issuedAt: string;
+        assignmentId: string;
+        source: {
+            commit: string;
+            projectId: string;
+            teamId: string;
+            profile: "source-only";
+            repositoryId: string;
+            controlPlaneId: string;
+            formatVersion: 1;
+        };
+        mode: "analysis" | "work";
+        attempt: number;
+        publication: "denied" | "candidate-only";
+        credentialBindingId: string;
+    };
+    credential: {
+        id: string;
+        nonce: string;
+        expiresAt: string;
+        schemaVersion: "treeseed.source-credential-delivery/v1";
+        algorithm: "x25519-hkdf-sha256-chacha20-poly1305";
+        ciphertext: string;
+        tag: string;
+        authorizationId: string;
+        ephemeralPublicKey: string;
+    };
+}>, {
+    repository: {
+        provider: "github";
+        name: string;
+        owner: string;
+        ref: string;
+        cloneUrl: string;
+    };
+    authorization: {
+        id: string;
+        expiresAt: string;
+        schemaVersion: "treeseed.source-workspace-authorization/v1";
+        providerId: string;
+        issuedAt: string;
+        assignmentId: string;
+        source: {
+            commit: string;
+            projectId: string;
+            teamId: string;
+            profile: "source-only";
+            repositoryId: string;
+            controlPlaneId: string;
+            formatVersion: 1;
+        };
+        mode: "analysis" | "work";
+        attempt: number;
+        publication: "denied" | "candidate-only";
+        credentialBindingId: string;
+    };
+    credential: {
+        id: string;
+        nonce: string;
+        expiresAt: string;
+        schemaVersion: "treeseed.source-credential-delivery/v1";
+        algorithm: "x25519-hkdf-sha256-chacha20-poly1305";
+        ciphertext: string;
+        tag: string;
+        authorizationId: string;
+        ephemeralPublicKey: string;
+    };
+}, {
+    repository: {
+        provider: "github";
+        name: string;
+        owner: string;
+        ref: string;
+        cloneUrl: string;
+    };
+    authorization: {
+        id: string;
+        expiresAt: string;
+        schemaVersion: "treeseed.source-workspace-authorization/v1";
+        providerId: string;
+        issuedAt: string;
+        assignmentId: string;
+        source: {
+            commit: string;
+            projectId: string;
+            teamId: string;
+            profile: "source-only";
+            repositoryId: string;
+            controlPlaneId: string;
+            formatVersion: 1;
+        };
+        mode: "analysis" | "work";
+        attempt: number;
+        publication: "denied" | "candidate-only";
+        credentialBindingId: string;
+    };
+    credential: {
+        id: string;
+        nonce: string;
+        expiresAt: string;
+        schemaVersion: "treeseed.source-credential-delivery/v1";
+        algorithm: "x25519-hkdf-sha256-chacha20-poly1305";
+        ciphertext: string;
+        tag: string;
+        authorizationId: string;
+        ephemeralPublicKey: string;
+    };
+}>;
+export type SourceCredentialDelivery = z.infer<typeof sourceCredentialDeliverySchema>;
+export type SourceWorkspaceRequest = z.infer<typeof sourceWorkspaceRequestSchema>;
+export type SourceWorkspaceResponse = z.infer<typeof sourceWorkspaceResponseSchema>;

package/dist/capacity-provider/source-workspace.js

@@ -57,9 +57,46 @@ const sourceCandidateReceiptSchema = z.object({
   verification: z.object({ objectClosure: z.literal(true), ancestry: z.literal(true), authority: z.literal(true) }).strict(),
   persistedAt: z.string().datetime()
 }).strict();
+const sourceWorkspaceRequestSchema = z.object({
+  runnerId: id,
+  leaseToken: z.string().min(1).max(4096),
+  recipientPublicKey: z.string().regex(/^[A-Za-z0-9+/]{43}=$/u)
+}).strict();
+const sourceCredentialDeliverySchema = z.object({
+  schemaVersion: z.literal("treeseed.source-credential-delivery/v1"),
+  id,
+  authorizationId: id,
+  algorithm: z.literal("x25519-hkdf-sha256-chacha20-poly1305"),
+  ephemeralPublicKey: z.string().regex(/^[A-Za-z0-9+/]{43}=$/u),
+  nonce: z.string().regex(/^[A-Za-z0-9+/]{16}$/u),
+  ciphertext: z.string().min(1).max(16384),
+  tag: z.string().regex(/^[A-Za-z0-9+/]{22}==$/u),
+  expiresAt: z.string().datetime()
+}).strict();
+const sourceWorkspaceResponseSchema = z.object({
+  authorization: sourceWorkspaceAuthorizationSchema,
+  repository: z.object({
+    provider: z.literal("github"),
+    owner: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9-]{0,99}$/u),
+    name: z.string().regex(/^[a-zA-Z0-9_][a-zA-Z0-9_.-]{0,99}$/u),
+    cloneUrl: z.string().url().startsWith("https://github.com/"),
+    ref: id
+  }).strict(),
+  credential: sourceCredentialDeliverySchema
+}).strict().superRefine((value, context) => {
+  if (value.repository.cloneUrl !== `https://github.com/${value.repository.owner}/${value.repository.name}.git`) {
+    context.addIssue({ code: z.ZodIssueCode.custom, path: ["repository", "cloneUrl"], message: "Source transport must match its provider repository." });
+  }
+  if (value.credential.authorizationId !== value.authorization.id || value.credential.expiresAt !== value.authorization.expiresAt) {
+    context.addIssue({ code: z.ZodIssueCode.custom, path: ["credential"], message: "Source credential delivery must match exact authorization and lifetime." });
+  }
+});
 export {
   sourceCandidateReceiptSchema,
+  sourceCredentialDeliverySchema,
   sourceWorkspaceAuthorizationSchema,
   sourceWorkspaceKeySchema,
-  sourceWorkspaceLeaseSchema
+  sourceWorkspaceLeaseSchema,
+  sourceWorkspaceRequestSchema,
+  sourceWorkspaceResponseSchema
 };

package/dist/operator-contracts/control-plane-operations.d.ts

@@ -2567,6 +2567,12 @@ export declare const CONTROL_PLANE_OPERATIONS: {
         readonly assignmentExplanation: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
             assignmentId: string;
         }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly sourceWorkspace: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+            assignmentId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly sourceCandidate: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+            assignmentId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
         readonly renewAssignment: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
             assignmentId: string;
         }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;

package/dist/operator-contracts/control-plane-operations.js

@@ -481,6 +481,8 @@ const CONTROL_PLANE_OPERATIONS = {
     nextAssignment: noPathProvider("providers.assignments.next", "POST", "/v1/provider/assignments/next"),
     assignment: providerPath("providers.assignments.show", "GET", "/v1/provider/assignments/{assignmentId}", { assignmentId: z.string().min(1) }, { read: true }),
     assignmentExplanation: providerPath("providers.assignments.explain", "GET", "/v1/provider/assignments/{assignmentId}/explanation", { assignmentId: z.string().min(1) }, { read: true }),
+    sourceWorkspace: providerPath("providers.assignments.source.authorize", "POST", "/v1/provider/assignments/{assignmentId}/source-workspace", { assignmentId: z.string().min(1) }, { redactedPaths: ["body.leaseToken", "output.credential.ciphertext"] }),
+    sourceCandidate: providerPath("providers.assignments.source.candidate", "POST", "/v1/provider/assignments/{assignmentId}/source-candidates", { assignmentId: z.string().min(1) }, { redactedPaths: ["body.leaseToken"] }),
     renewAssignment: providerPath("providers.assignments.renew", "POST", "/v1/provider/assignments/{assignmentId}/renew", { assignmentId: z.string().min(1) }),
     startExecution: providerPath("providers.assignments.execution.start", "POST", "/v1/provider/assignments/{assignmentId}/execution-start", { assignmentId: z.string().min(1) }),
     startCloseout: providerPath("providers.assignments.closeout.start", "POST", "/v1/provider/assignments/{assignmentId}/closeout-start", { assignmentId: z.string().min(1) }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.112",
+  "version": "0.13.0-rc.113",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {