@treeseed/sdk 0.13.0-rc.12 → 0.13.0-rc.121

package/dist/capacity-provider/contracts/environment-profiles.js

@@ -0,0 +1,71 @@
+import { z } from "zod";
+const identifier = z.string().regex(/^[a-z][a-z0-9._-]{0,127}$/u);
+const digest = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+const variableName = z.string().regex(/^[A-Z_][A-Z0-9_]*$/u);
+const maximumGrantLifetimeMs = 24 * 60 * 60 * 1e3;
+const providerRegistrationCodeStatusSchema = z.object({
+  schemaVersion: z.literal("treeseed.provider-registration-code-status/v1"),
+  teamId: z.string().min(1),
+  generation: z.number().int().positive(),
+  codePrefix: z.string().min(1),
+  rotatedAt: z.string().datetime()
+}).strict();
+const providerRegistrationCodeReceiptSchema = z.object({
+  schemaVersion: z.literal("treeseed.provider-registration-code-receipt/v1"),
+  teamId: z.string().min(1),
+  generation: z.number().int().positive(),
+  codePrefix: z.string().min(1),
+  registrationCode: z.string().min(16),
+  rotatedAt: z.string().datetime()
+}).strict();
+const providerEnvironmentVariableDescriptorSchema = z.object({
+  name: variableName,
+  available: z.boolean(),
+  rotatedAt: z.string().datetime().optional()
+}).strict();
+const providerEnvironmentProfileDescriptorSchema = z.object({
+  schemaVersion: z.literal("treeseed.provider-environment-profile/v1"),
+  id: identifier,
+  generation: z.number().int().positive(),
+  variables: z.array(providerEnvironmentVariableDescriptorSchema),
+  updatedAt: z.string().datetime()
+}).strict().superRefine((profile, context) => {
+  const names = /* @__PURE__ */ new Set();
+  for (const [index, variable] of profile.variables.entries()) {
+    if (names.has(variable.name)) context.addIssue({ code: z.ZodIssueCode.custom, path: ["variables", index, "name"], message: "Environment variable names must be unique within a profile." });
+    names.add(variable.name);
+  }
+});
+const assignmentEnvironmentGrantSchema = z.object({
+  schemaVersion: z.literal("treeseed.assignment-environment-grant/v1"),
+  grantId: identifier,
+  assignmentId: z.string().min(1),
+  providerId: z.string().min(1),
+  teamId: z.string().min(1),
+  projectId: z.string().min(1),
+  profileId: identifier,
+  variables: z.array(variableName).min(1),
+  network: z.object({ allowed: z.boolean(), destinations: z.array(z.string().min(1)) }).strict(),
+  policy: z.object({
+    handlerDeclarationDigest: digest,
+    providerOfferDigest: digest,
+    providerPermissionDigest: digest,
+    teamApprovalDigest: digest,
+    assignmentGrantDigest: digest,
+    sandboxPolicyDigest: digest
+  }).strict(),
+  issuedAt: z.string().datetime(),
+  expiresAt: z.string().datetime()
+}).strict().superRefine((grant, context) => {
+  if (new Set(grant.variables).size !== grant.variables.length) context.addIssue({ code: z.ZodIssueCode.custom, path: ["variables"], message: "Granted environment variables must be unique." });
+  if (Date.parse(grant.expiresAt) <= Date.parse(grant.issuedAt)) context.addIssue({ code: z.ZodIssueCode.custom, path: ["expiresAt"], message: "Environment grants must expire after issuance." });
+  if (Date.parse(grant.expiresAt) - Date.parse(grant.issuedAt) > maximumGrantLifetimeMs) context.addIssue({ code: z.ZodIssueCode.custom, path: ["expiresAt"], message: "Environment grants cannot exceed 24 hours." });
+  if (!grant.network.allowed && grant.network.destinations.length) context.addIssue({ code: z.ZodIssueCode.custom, path: ["network", "destinations"], message: "Denied network authority cannot declare destinations." });
+});
+export {
+  assignmentEnvironmentGrantSchema,
+  providerEnvironmentProfileDescriptorSchema,
+  providerEnvironmentVariableDescriptorSchema,
+  providerRegistrationCodeReceiptSchema,
+  providerRegistrationCodeStatusSchema
+};

package/dist/capacity-provider/contracts/governance.d.ts

@@ -1,4 +1,6 @@
 import type { ResearchSourcePolicy } from '../../agent-capacity/contracts/support/research-source-policy.js';
+import type { CapabilityOffer } from '../capability-ontology.js';
+import type { CapabilityAccountingObservation } from '../../agent-capacity/contracts/capacity/workdays/capability-accounting.js';
 export declare const CAPACITY_PROVIDER_IDENTITY_ALGORITHM: "Ed25519";
 export declare const CAPACITY_PROVIDER_PROOF_TTL_SECONDS = 300;
 export declare const CAPACITY_PROVIDER_ACCESS_TOKEN_TTL_SECONDS = 900;
@@ -236,32 +238,39 @@ export interface CapacityExecutionProvider {
 }
 /** Optional provider-global lane that narrows an execution provider's limits. */
 export interface CapacityProviderLane {
-    schemaVersion: 1;
+    schemaVersion: 2;
     id: string;
     providerId: string;
-    executionProviderId: string;
     displayName: string;
     purpose: import('../../agent-capacity/contracts/capacity/communication/communication-records.js').ProviderLanePurpose;
     status: CapacityProviderLaneStatus;
+    priority: number;
+    reservedConcurrentWorkers: number;
+    borrowWhenIdle: boolean;
+    lendWhenIdle: boolean;
+    reclaimPolicy: 'admission';
+    queueLimit: number;
+    timeoutSeconds: number;
     capabilities: string[];
-    maxConcurrentRunners: number;
+    maxConcurrentWorkers: number;
     minimumAssignmentDuration?: MinimumAssignmentDuration;
-    nativeLimits: CapacityExecutionProviderNativeLimit[];
     metadata?: Record<string, unknown>;
     createdAt: string;
     updatedAt: string;
 }
 export interface ProviderLaneSnapshot {
     id: string;
-    executionProviderId: string;
     purpose: import('../../agent-capacity/contracts/capacity/communication/communication-records.js').ProviderLanePurpose;
     status: CapacityProviderLaneStatus;
+    priority: number;
+    reservedConcurrentWorkers: number;
+    borrowedWorkers: number;
+    lentWorkers: number;
+    queuedAssignments: number;
     capabilities: string[];
-    maxConcurrentRunners: number;
-    activeRunners: number;
+    maxConcurrentWorkers: number;
+    activeWorkers: number;
     minimumAssignmentDuration?: MinimumAssignmentDuration;
-    preferred?: boolean;
-    nativeLimits: Record<string, unknown>;
 }
 export type MinimumAssignmentDuration = {
     amount: number;
@@ -275,28 +284,35 @@ export type MinimumAssignmentDuration = {
         holidayDates?: string[];
     };
 };
-export interface ProviderExecutionProviderSnapshot {
+export interface ProviderExecutionAdapterSnapshot {
     id: string;
     adapter: string;
+    isolation: 'microvm' | 'process' | 'worker';
     status: 'available' | 'degraded' | 'unavailable';
     capabilities: string[];
-    maxConcurrentRunners: number;
-    activeRunners: number;
+    laneIds: string[];
+    maxConcurrentWorkers: number;
+    activeWorkers: number;
     minimumAssignmentDuration?: MinimumAssignmentDuration;
     nativeLimits: Record<string, unknown>;
     observations?: Record<string, unknown>;
-    lanes: ProviderLaneSnapshot[];
+    accountingObservation?: {
+        modelUsage: CapabilityAccountingObservation;
+        capabilityUsage: Record<string, CapabilityAccountingObservation>;
+    };
 }
 export interface ProviderAvailabilitySnapshot {
     sequence: number;
     availableFrom: string;
     availableUntil?: string | null;
     pressure: 'idle' | 'normal' | 'busy' | 'throttled' | 'exhausted';
-    maxConcurrentAssignments: number;
+    maxConcurrentWorkers: number;
     activeAssignmentIds: string[];
-    executionProviders: ProviderExecutionProviderSnapshot[];
-    communicationReady: boolean;
-    communicationBlockers: string[];
+    reservedWorkers: number;
+    borrowedWorkers: number;
+    availableWorkers: number;
+    adapters: ProviderExecutionAdapterSnapshot[];
+    lanes: ProviderLaneSnapshot[];
     capabilities: string[];
     constraints?: Record<string, unknown>;
 }
@@ -335,9 +351,37 @@ export interface CapacityProviderJoinInput {
     registrationKeyRef: string;
     offer: ProviderSupplyOffer;
 }
-export interface CapacityProviderManifestV2 {
-    schemaVersion: 2;
-    providerClass: 'agent' | 'platform-operation';
+export interface CapacityProviderSandboxProfile {
+    id: string;
+    contract?: {
+        id: string;
+        version: string;
+        digest: string;
+        capabilities: string[];
+    };
+    guestImage: string;
+    guestImageDigest: string;
+    lineage: {
+        baseImageDigest: string;
+        provenanceDigest: string;
+        architectures: Array<'amd64' | 'arm64'>;
+        signature: {
+            keyId: string;
+            algorithm: 'cosign' | 'Ed25519';
+            value: string;
+        };
+    };
+    defaultDenyNetwork: true;
+    resources: {
+        cpuCores: number;
+        memoryBytes: number;
+        diskBytes: number;
+        processLimit: number;
+        outputBytes: number;
+    };
+}
+export interface CapacityProviderManifestV5 {
+    schemaVersion: 5;
     ownership: {
         type: 'team' | 'external';
         teamId?: string;
@@ -350,8 +394,19 @@ export interface CapacityProviderManifestV2 {
         privateKeyRef: string;
         displayName: string;
     };
-    supplyCeilings: {
-        maxConcurrentAssignments: number;
+    ontology: {
+        generation: number;
+        digest: string;
+    };
+    capacity: {
+        maxConcurrentWorkers: number;
+        cpuCores?: number;
+        memoryBytes?: number;
+        accelerators?: Array<{
+            kind: string;
+            count: number;
+            memoryBytes?: number;
+        }>;
         maxActiveSeconds?: number;
         maxInputTokens?: number;
         maxOutputTokens?: number;
@@ -359,16 +414,36 @@ export interface CapacityProviderManifestV2 {
         currency?: string;
         maxAttempts?: number;
     };
-    credentialBindings?: Array<{
+    credentialProfiles?: Array<{
         id: string;
-        source: 'service-vault' | 'process-environment';
+        source: 'service-vault';
         reference: string;
         required: boolean;
     }>;
-    defaultExecutionProviderId?: string;
-    executionProviders: Array<{
+    lanes: Array<{
+        id: string;
+        purpose: import('../../agent-capacity/contracts/capacity/communication/communication-records.js').ProviderLanePurpose;
+        priority: number;
+        reservedConcurrentWorkers: number;
+        maxConcurrentWorkers: number;
+        borrowWhenIdle: boolean;
+        lendWhenIdle: boolean;
+        reclaimPolicy: 'admission';
+        queueLimit: number;
+        timeoutSeconds: number;
+        minimumAssignmentDuration?: MinimumAssignmentDuration;
+        capabilities?: string[];
+    }>;
+    sandbox: {
+        required: true;
+        brokerSocket: string;
+        runtime: 'kata-runtime-rs-qemu';
+        profiles: CapacityProviderSandboxProfile[];
+    };
+    adapters: Array<{
         id: string;
         adapter: string;
+        isolation: 'microvm';
         profile?: string;
         module?: string;
         protocol?: 'responses' | 'chat-completions';
@@ -376,24 +451,23 @@ export interface CapacityProviderManifestV2 {
             endpointRef?: string;
             baseUrl?: string;
             model?: string;
+            reasoningEffort?: 'minimal' | 'low' | 'medium' | 'high' | 'xhigh';
         };
-        credentialBindings?: string[];
+        credentialProfiles?: string[];
+        laneIds: string[];
+        maxConcurrentWorkers: number;
         healthProbe?: string;
         versionConstraint?: string;
         configurationDigest?: string;
         minimumAssignmentDuration?: MinimumAssignmentDuration;
         nativeLimits: Record<string, unknown>;
         researchSourcePolicy?: ResearchSourcePolicy;
-        capabilities?: string[];
-        lanes?: Array<{
-            id: string;
-            purpose: import('../../agent-capacity/contracts/capacity/communication/communication-records.js').ProviderLanePurpose;
-            maxConcurrentRunners: number;
-            minimumAssignmentDuration?: MinimumAssignmentDuration;
-            capabilities?: string[];
-            nativeLimits?: Record<string, unknown>;
+        offers: Array<{
+            offer: CapabilityOffer;
+            sandboxProfileId: string;
         }>;
     }>;
     connections: ProviderConnectionConfig[];
     metadata?: Record<string, unknown>;
 }
+export type CapacityProviderManifest = CapacityProviderManifestV5;

package/dist/capacity-provider/contracts/index.d.ts

@@ -1,2 +1,3 @@
 export * from './capacity-facts.js';
+export * from './environment-profiles.js';
 export * from './governance.js';

package/dist/capacity-provider/contracts/index.js

@@ -1,2 +1,3 @@
 export * from "./capacity-facts.js";
+export * from "./environment-profiles.js";
 export * from "./governance.js";

package/dist/capacity-provider/core-capability-catalog.d.ts

@@ -0,0 +1,47 @@
+export declare const CORE_CAPABILITY_ONTOLOGY_GENERATION = 3;
+export declare const CORE_CAPABILITY_ONTOLOGY_CREATED_AT = "2026-08-30T00:00:00.000Z";
+export declare const CORE_CAPABILITY_DEFINITIONS: {
+    status: "active" | "revoked" | "deprecated";
+    id: string;
+    version: string;
+    schemaVersion: "treeseed.capability-definition/v1";
+    digest: string;
+    inputs: {
+        id: string;
+        version: string;
+        digest: string;
+        mediaTypes: string[];
+    }[];
+    createdAt: string;
+    outputs: {
+        id: string;
+        version: string;
+        digest: string;
+        mediaTypes: string[];
+    }[];
+    description: string;
+    configuration: {
+        key: string;
+        description: string;
+        schema: Record<string, unknown>;
+        requirementSupport: ("required" | "preferred")[];
+        securityCritical: boolean;
+    }[];
+    family: "research" | "coordination" | "data" | "engineering" | "publishing" | "external-work";
+    title: string;
+    features: string[];
+    permissionClasses: string[];
+    contextModes: string[];
+    interactionModes: string[];
+    implies: {
+        id: string;
+        version: string;
+        digest: string;
+    }[];
+    conflicts: {
+        id: string;
+        version: string;
+        digest: string;
+    }[];
+    qualificationTier: "signed-attestation" | "automated-suite" | "reviewed-certification";
+}[];

package/dist/capacity-provider/core-capability-catalog.js

@@ -0,0 +1,49 @@
+import { capabilityDefinitionDigest, capabilityDefinitionSchema } from "./capability-ontology.js";
+const CORE_CAPABILITY_ONTOLOGY_GENERATION = 3;
+const CORE_CAPABILITY_ONTOLOGY_CREATED_AT = "2026-08-30T00:00:00.000Z";
+const createdAt = CORE_CAPABILITY_ONTOLOGY_CREATED_AT;
+const services = {
+  coordination: ["conversation", "question-answering", "planning", "estimation", "review", "reporting", "human-task-routing", "decision-support"],
+  research: ["web", "literature", "market", "repository", "dataset-discovery", "retrieval", "extraction", "verification", "citation", "synthesis", "experimentation"],
+  data: ["source-connection", "extraction", "ingestion", "synchronization", "schema-inference", "schema-mapping", "normalization", "transformation", "enrichment", "entity-resolution", "validation", "quality-analysis", "lineage", "statistical-analysis", "visualization", "export"],
+  engineering: ["architecture", "repository-analysis", "code-change", "refactoring", "dependency-update", "build", "unit-testing", "integration-testing", "end-to-end-testing", "debugging", "review", "security-analysis", "performance-analysis", "accessibility", "infrastructure", "deployment", "release", "operations"],
+  publishing: ["drafting", "editing", "translation", "structured-content", "documentation", "cms", "repository", "package-artifact", "site-build", "site-deployment", "syndication", "release-notes"],
+  "external-work": ["ticket-management", "workflow-execution", "notification", "human-service-fulfillment", "artifact-delivery"]
+};
+function definition(family, service) {
+  const configuration = [
+    ["instructions.system", "Provider-neutral system instruction delivery."],
+    ["instructions.task", "Provider-neutral task instruction delivery."],
+    ["instructions.templates", "Immutable instruction template delivery."],
+    ["context.queries", "Resolved context query manifest delivery."],
+    ["tools.policy", "Assignment-scoped tool policy enforcement."],
+    ["intelligence.reasoning-effort", "Provider-neutral reasoning effort requested by the agent activity profile."]
+  ].map(([key, description]) => ({ key, description, schema: {}, requirementSupport: ["required", "preferred"], securityCritical: true }));
+  const material = {
+    schemaVersion: "treeseed.capability-definition/v1",
+    id: `treeseed.${family}.${service}`,
+    version: "1.0.0",
+    family,
+    title: service.split("-").map((part) => `${part[0]?.toUpperCase()}${part.slice(1)}`).join(" "),
+    description: `Standard TreeSeed ${family} capability for ${service.replaceAll("-", " ")}.`,
+    status: "active",
+    features: [],
+    inputs: [],
+    outputs: [],
+    configuration,
+    permissionClasses: ["content-policy", "repository-policy", "network-policy", "shell-policy", "tool-policy"],
+    contextModes: ["inline", "manifest"],
+    interactionModes: ["asynchronous", "interactive"],
+    implies: [],
+    conflicts: [],
+    qualificationTier: ["security-analysis", "deployment", "release", "operations", "human-service-fulfillment"].includes(service) ? "automated-suite" : "signed-attestation",
+    createdAt
+  };
+  return capabilityDefinitionSchema.parse({ ...material, digest: capabilityDefinitionDigest(material) });
+}
+const CORE_CAPABILITY_DEFINITIONS = Object.entries(services).flatMap(([family, values]) => values.map((service) => definition(family, service)));
+export {
+  CORE_CAPABILITY_DEFINITIONS,
+  CORE_CAPABILITY_ONTOLOGY_CREATED_AT,
+  CORE_CAPABILITY_ONTOLOGY_GENERATION
+};