@treeseed/sdk 0.13.0-rc.113 → 0.13.0-rc.115

package/dist/.treeseed-build-complete.json

@@ -1 +1 @@
-{"completedAt":"2026-09-10T23:14:23.976Z"}
+{"completedAt":"2026-09-11T00:53:42.630Z"}

package/dist/capacity-provider/client.d.ts

@@ -2,6 +2,8 @@ import type { ProviderAssignmentLifecycleRequest, ProviderAssignmentLifecycleRes
 import type { ProviderRuntimeEventInput } from '../agent-capacity/contracts/capacity/workdays/workday-records.js';
 import type { CapacityProviderIdentity, CapacityProviderIdentityRotationRequest, CapacityProviderSignedProof, ProviderAccessTokenIssue, ProviderAvailabilitySession, ProviderCredentialIssuanceAuthorization, ProviderRegistrationRequest, ProviderRegistrationSubmission, ProviderTeamCredentialIssue } from './contracts/index.js';
 import type { ProviderDiscussionResponseRequest } from '../operator-contracts/communication/contracts.js';
+import { type SourceWorkspaceRequest } from './source-workspace.js';
+import { type SourceCandidateRequest, type SourceChunkRequest } from './source/candidate.js';
 export interface ProviderProtocolClientOptions {
     controlPlaneUrl: string;
     accessToken?: string;
@@ -44,6 +46,89 @@ export declare class ProviderProtocolClient {
     startAssignmentExecution(assignmentId: string, request: Record<string, unknown>): Promise<Record<string, unknown>>;
     startAssignmentCloseout(assignmentId: string, request: Record<string, unknown>): Promise<Record<string, unknown>>;
     preflightAssignmentCompletion(assignmentId: string, request: Record<string, unknown>): Promise<Record<string, unknown>>;
+    /** Host provider transport only; the recipient key belongs to the trusted source fetch worker. */
+    authorizeAssignmentSource(assignmentId: string, request: SourceWorkspaceRequest): Promise<{
+        repository: {
+            provider: "github";
+            name: string;
+            owner: string;
+            ref: string;
+            cloneUrl: string;
+        };
+        authorization: {
+            id: string;
+            expiresAt: string;
+            schemaVersion: "treeseed.source-workspace-authorization/v1";
+            providerId: string;
+            issuedAt: string;
+            assignmentId: string;
+            source: {
+                commit: string;
+                projectId: string;
+                teamId: string;
+                profile: "source-only";
+                repositoryId: string;
+                controlPlaneId: string;
+                formatVersion: 1;
+            };
+            mode: "analysis" | "work";
+            attempt: number;
+            publication: "denied" | "candidate-only";
+            credentialBindingId: string;
+        };
+        credential: {
+            id: string;
+            nonce: string;
+            expiresAt: string;
+            schemaVersion: "treeseed.source-credential-delivery/v1";
+            algorithm: "x25519-hkdf-sha256-chacha20-poly1305";
+            ciphertext: string;
+            tag: string;
+            authorizationId: string;
+            ephemeralPublicKey: string;
+        };
+        sourceBundle?: {
+            digest: string;
+            bytes: number;
+            artifactId: string;
+            chunks: string[];
+        } | undefined;
+    }>;
+    /** Bounded host-only transfer. The API verifies registered-provider signatures and live publication authority. */
+    publishAssignmentSourceCandidate(assignmentId: string, request: SourceCandidateRequest): Promise<Record<string, unknown> | {
+        id: string;
+        schemaVersion: "treeseed.source-candidate-receipt/v1";
+        commit: string;
+        source: {
+            commit: string;
+            projectId: string;
+            teamId: string;
+            profile: "source-only";
+            repositoryId: string;
+            controlPlaneId: string;
+            formatVersion: 1;
+        };
+        verification: {
+            authority: true;
+            objectClosure: true;
+            ancestry: true;
+        };
+        bundle: {
+            digest: string;
+            bytes: number;
+            artifactId: string;
+        };
+        leaseId: string;
+        parentCandidateId: string | null;
+        persistedAt: string;
+    }>;
+    /** Source artifacts are accessible only through a current assignment, never ambient team access. */
+    readAssignmentSourceChunk(assignmentId: string, request: SourceChunkRequest): Promise<{
+        content: string;
+        digest: string;
+        index: number;
+        artifactId: string;
+    }>;
     respondToAssignmentDiscussion(assignmentId: string, request: ProviderDiscussionResponseRequest, idempotencyKey: string): Promise<{
         status: "responded" | "abstained";
         schemaVersion: "treeseed.provider-discussion-response-receipt/v1";

package/dist/capacity-provider/client.js

@@ -1,5 +1,7 @@
 import { ControlPlaneClient, ControlPlaneClientError } from "../entrypoints/clients/control-plane-client.js";
 import { CONTROL_PLANE_OPERATIONS } from "../operator-contracts/index.js";
+import { sourceWorkspaceRequestSchema, sourceWorkspaceResponseSchema, sourceCandidateReceiptSchema } from "./source-workspace.js";
+import { sourceCandidateRequestSchema, sourceChunkRequestSchema, sourceChunkResponseSchema } from "./source/candidate.js";
 class CapacityProviderApiError extends Error {
   constructor(message, status, payload) {
     super(message);
@@ -126,6 +128,36 @@ class ProviderProtocolClient {
   preflightAssignmentCompletion(assignmentId, request) {
     return this.invoke(CONTROL_PLANE_OPERATIONS.providers.completionPreflight, { path: { assignmentId }, body: request });
   }
+  /** Host provider transport only; the recipient key belongs to the trusted source fetch worker. */
+  async authorizeAssignmentSource(assignmentId, request) {
+    const body = sourceWorkspaceRequestSchema.parse(request);
+    const response = sourceWorkspaceResponseSchema.parse(await this.invoke(
+      CONTROL_PLANE_OPERATIONS.providers.sourceWorkspace,
+      { path: { assignmentId }, body }
+    ));
+    if (response.authorization.assignmentId !== assignmentId) throw new CapacityProviderApiError("Source authority assignment correlation failed.", 502, { code: "source_authority_mismatch" });
+    return response;
+  }
+  /** Bounded host-only transfer. The API verifies registered-provider signatures and live publication authority. */
+  async publishAssignmentSourceCandidate(assignmentId, request) {
+    const body = sourceCandidateRequestSchema.parse(request);
+    if (body.candidate.attestation.assignmentId !== assignmentId) throw new CapacityProviderApiError("Candidate assignment correlation failed.", 400, { code: "source_candidate_mismatch" });
+    const response = await this.invoke(CONTROL_PLANE_OPERATIONS.providers.sourceCandidate, { path: { assignmentId }, body });
+    if (body.action === "commit") {
+      const receipt = sourceCandidateReceiptSchema.parse(response);
+      if (receipt.leaseId !== body.candidate.attestation.leaseId || receipt.commit !== body.candidate.attestation.commit || receipt.bundle.digest !== body.candidate.attestation.bundle.digest || JSON.stringify(receipt.source) !== JSON.stringify(body.candidate.attestation.source)) throw new CapacityProviderApiError("Candidate receipt correlation failed.", 502, { code: "source_candidate_receipt_mismatch" });
+      return receipt;
+    }
+    if (response.accepted !== true || response.index !== body.index || response.digest !== body.candidate.attestation.bundle.chunks[body.index]) throw new CapacityProviderApiError("Candidate chunk receipt correlation failed.", 502, { code: "source_candidate_chunk_mismatch" });
+    return response;
+  }
+  /** Source artifacts are accessible only through a current assignment, never ambient team access. */
+  async readAssignmentSourceChunk(assignmentId, request) {
+    const body = sourceChunkRequestSchema.parse(request);
+    const response = sourceChunkResponseSchema.parse(await this.invoke(CONTROL_PLANE_OPERATIONS.providers.sourceChunk, { path: { assignmentId }, body }));
+    if (response.artifactId !== body.artifactId || response.index !== body.index) throw new CapacityProviderApiError("Source chunk correlation failed.", 502, { code: "source_chunk_mismatch" });
+    return response;
+  }
   respondToAssignmentDiscussion(assignmentId, request, idempotencyKey) {
     return this.invoke(CONTROL_PLANE_OPERATIONS.providers.discussionResponse, { path: { assignmentId }, body: request }, { idempotencyKey });
   }

package/dist/capacity-provider/environment-catalog.d.ts

@@ -823,7 +823,7 @@ export declare const providerSandboxEnvironmentAvailabilitySchema: z.ZodObject<{
         checkedAt: z.ZodString;
         reason: z.ZodNullable<z.ZodString>;
     }, "strict", z.ZodTypeAny, {
-        status: "ready" | "failed" | "pulling" | "quarantined";
+        status: "ready" | "failed" | "quarantined" | "pulling";
         version: string;
         reason: string | null;
         contractDigest: string;
@@ -831,7 +831,7 @@ export declare const providerSandboxEnvironmentAvailabilitySchema: z.ZodObject<{
         entryId: string;
         checkedAt: string;
     }, {
-        status: "ready" | "failed" | "pulling" | "quarantined";
+        status: "ready" | "failed" | "quarantined" | "pulling";
         version: string;
         reason: string | null;
         contractDigest: string;
@@ -841,7 +841,7 @@ export declare const providerSandboxEnvironmentAvailabilitySchema: z.ZodObject<{
     }>, "many">;
 }, "strict", z.ZodTypeAny, {
     entries: {
-        status: "ready" | "failed" | "pulling" | "quarantined";
+        status: "ready" | "failed" | "quarantined" | "pulling";
         version: string;
         reason: string | null;
         contractDigest: string;
@@ -855,7 +855,7 @@ export declare const providerSandboxEnvironmentAvailabilitySchema: z.ZodObject<{
     catalogGeneration: number;
 }, {
     entries: {
-        status: "ready" | "failed" | "pulling" | "quarantined";
+        status: "ready" | "failed" | "quarantined" | "pulling";
         version: string;
         reason: string | null;
         contractDigest: string;

package/dist/capacity-provider/sandbox.d.ts

@@ -1,2 +1,3 @@
 export * from './sandbox-contracts.js';
 export * from './source-workspace.js';
+export * from './source/candidate.js';

package/dist/capacity-provider/sandbox.js

@@ -1,2 +1,3 @@
 export * from "./sandbox-contracts.js";
 export * from "./source-workspace.js";
+export * from "./source/candidate.js";