@treeseed/sdk 0.13.0-rc.12 → 0.13.0-rc.121

package/dist/operator-contracts/catalog/admin-account-team-operations.js

@@ -0,0 +1,52 @@
+import { z } from "zod";
+import { defineOperation } from "../operation-builder.js";
+const empty = z.object({}).strict();
+const none = z.undefined();
+const record = z.record(z.unknown());
+function operation(operationId, method, path, pathShape, options) {
+  const read = method === "GET";
+  const riskClass = options.risk ?? "ordinary";
+  return defineOperation({
+    operationId,
+    description: `${read ? "Read" : "Apply"} ${operationId}.`,
+    rest: { method, path },
+    ...Object.keys(pathShape).length ? { parameters: `treeseed.${operationId}.parameters/v1` } : {},
+    capability: options.capability,
+    authentication: options.authentication ?? "oauth",
+    oauthScopes: options.authentication === "anonymous" ? [] : [read ? "treeseed:read" : "treeseed:projects:write"],
+    kind: read ? "read" : "mutation",
+    riskClass,
+    confirmation: riskClass === "ordinary" ? "never" : "input_required",
+    surfaces: options.surfaces ?? ["rest"],
+    cacheScope: options.cacheScope ?? (read ? "principal" : "none"),
+    pagination: options.pagination ?? "none",
+    concurrencyRequired: options.concurrency,
+    redactedPaths: options.redactedPaths
+  }, {
+    path: z.object(pathShape).strict(),
+    query: read ? record : empty,
+    body: read ? none : record,
+    output: record
+  });
+}
+const adminAccountOperations = {
+  publicProfile: operation("accounts.profile.public.show", "GET", "/v1/users/by-username/{username}/profile", { username: z.string().min(1) }, { capability: "accounts.public.read", authentication: "anonymous", cacheScope: "public", surfaces: ["rest", "mcp_resource"] }),
+  updateUsername: operation("accounts.username.update", "PATCH", "/v1/auth/web/username", {}, { capability: "accounts.write", concurrency: true }),
+  notificationPreferences: operation("accounts.notification.preferences.show", "GET", "/v1/auth/web/notifications/preferences", {}, { capability: "accounts.read" }),
+  updateNotificationPreferences: operation("accounts.notification.preferences.update", "PUT", "/v1/auth/web/notifications/preferences", {}, { capability: "accounts.write", concurrency: true }),
+  themes: operation("accounts.themes.list", "GET", "/v1/auth/web/themes", {}, { capability: "accounts.read", pagination: "cursor" }),
+  createTheme: operation("accounts.themes.create", "POST", "/v1/auth/web/themes", {}, { capability: "accounts.write" }),
+  updateTheme: operation("accounts.themes.update", "PUT", "/v1/auth/web/themes/{themeId}", { themeId: z.string().min(1) }, { capability: "accounts.write", concurrency: true }),
+  deleteTheme: operation("accounts.themes.delete", "DELETE", "/v1/auth/web/themes/{themeId}", { themeId: z.string().min(1) }, { capability: "accounts.write", risk: "destructive", concurrency: true }),
+  unlinkProvider: operation("accounts.providers.unlink", "DELETE", "/v1/auth/web/providers/{identityId}", { identityId: z.string().min(1) }, { capability: "accounts.write", risk: "credential" })
+};
+const adminTeamOperations = {
+  revokeInvite: operation("teams.invites.revoke", "DELETE", "/v1/teams/{teamId}/invites/{inviteId}", { teamId: z.string().min(1), inviteId: z.string().min(1) }, { capability: "teams.write", risk: "destructive", concurrency: true }),
+  resendInvite: operation("teams.invites.resend", "POST", "/v1/teams/{teamId}/invites/{inviteId}/resend", { teamId: z.string().min(1), inviteId: z.string().min(1) }, { capability: "teams.write" }),
+  memberRemovalBlockers: operation("teams.members.removal.blockers", "GET", "/v1/teams/{teamId}/members/{membershipId}/removal-blockers", { teamId: z.string().min(1), membershipId: z.string().min(1) }, { capability: "teams.read" }),
+  remove: operation("teams.delete", "DELETE", "/v1/teams/{teamId}/permanent-delete", { teamId: z.string().min(1) }, { capability: "teams.delete", risk: "irreversible", concurrency: true, redactedPaths: ["body.confirmation", "body.currentPassword", "body.reauthenticationGrantId"] })
+};
+export {
+  adminAccountOperations,
+  adminTeamOperations
+};

package/dist/operator-contracts/catalog/agents/agent-team-clone-operations.d.ts

@@ -0,0 +1,75 @@
+export declare const AGENT_TEAM_CLONE_OPERATIONS: {
+    readonly plan: import("../../control-plane-operation.js").ControlPlaneOperationBinding<{
+        teamId: string;
+    }, {}, {
+        sourceProject: string;
+        targetProjects?: string[] | undefined;
+        allEligible?: boolean | undefined;
+    }, {
+        schemaVersion: "treeseed.agent-team-clone-plan/v1";
+        targets: {
+            name: string;
+            slug: string;
+            repository: string;
+            commit: string;
+            action: "noop" | "create" | "update";
+            projectId: string;
+            definitions: {
+                path: string;
+                desiredDigest: string;
+                agentClass: string;
+                sourceDigest: string;
+            }[];
+        }[];
+        digest: string;
+        teamId: string;
+        source: {
+            name: string;
+            slug: string;
+            repository: string;
+            commit: string;
+            projectId: string;
+        };
+    }>;
+    readonly apply: import("../../control-plane-operation.js").ControlPlaneOperationBinding<{
+        teamId: string;
+    }, {}, {
+        schemaVersion: "treeseed.agent-team-clone-plan/v1";
+        targets: {
+            name: string;
+            slug: string;
+            repository: string;
+            commit: string;
+            action: "noop" | "create" | "update";
+            projectId: string;
+            definitions: {
+                path: string;
+                desiredDigest: string;
+                agentClass: string;
+                sourceDigest: string;
+            }[];
+        }[];
+        digest: string;
+        teamId: string;
+        source: {
+            name: string;
+            slug: string;
+            repository: string;
+            commit: string;
+            projectId: string;
+        };
+    }, {
+        schemaVersion: "treeseed.agent-team-clone-receipt/v1";
+        targets: {
+            repository: string;
+            commit: string;
+            action: "noop" | "created" | "updated";
+            projectId: string;
+            definitionCount: number;
+        }[];
+        noop: boolean;
+        planDigest: string;
+        teamId: string;
+        mutation: boolean;
+    }>;
+};

package/dist/operator-contracts/catalog/agents/agent-team-clone-operations.js

@@ -0,0 +1,42 @@
+import { z } from "zod";
+import { agentTeamClonePlanSchema, agentTeamCloneReceiptSchema, agentTeamCloneRequestSchema } from "../../../agent-capacity/contracts/operations/agent-team-clone.js";
+import { defineOperation } from "../../operation-builder.js";
+const path = z.object({ teamId: z.string().trim().min(1) }).strict();
+const empty = z.object({}).strict();
+const AGENT_TEAM_CLONE_OPERATIONS = {
+  plan: defineOperation({
+    operationId: "agents.team.clone.plan",
+    description: "Plan an exact agent-team clone into selected projects.",
+    rest: { method: "POST", path: "/v1/teams/{teamId}/agent-team-clones/plan" },
+    parameters: "treeseed.agents.team.clone.plan.parameters/v1",
+    capability: "agents.read",
+    authentication: "oauth",
+    oauthScopes: ["treeseed:read"],
+    kind: "read",
+    riskClass: "ordinary",
+    confirmation: "never",
+    surfaces: ["rest", "cli", "mcp_tool"],
+    cacheScope: "none",
+    pagination: "none",
+    idempotencyRequired: false
+  }, { path, query: empty, body: agentTeamCloneRequestSchema, output: agentTeamClonePlanSchema }),
+  apply: defineOperation({
+    operationId: "agents.team.clone.apply",
+    description: "Apply an unchanged exact agent-team clone plan.",
+    rest: { method: "POST", path: "/v1/teams/{teamId}/agent-team-clones/apply" },
+    parameters: "treeseed.agents.team.clone.apply.parameters/v1",
+    capability: "agents.write",
+    authentication: "oauth",
+    oauthScopes: ["treeseed:projects:write"],
+    kind: "mutation",
+    riskClass: "authority",
+    confirmation: "input_required",
+    surfaces: ["rest", "cli", "mcp_tool"],
+    cacheScope: "none",
+    pagination: "none",
+    idempotencyRequired: true
+  }, { path, query: empty, body: agentTeamClonePlanSchema, output: agentTeamCloneReceiptSchema })
+};
+export {
+  AGENT_TEAM_CLONE_OPERATIONS
+};

package/dist/operator-contracts/catalog/capability-ontology-operations.d.ts

@@ -0,0 +1,163 @@
+export declare function capabilityOntologyOperations(): {
+    list: import("../control-plane-operation.js").ControlPlaneOperationBinding<{}, {
+        status?: "active" | "revoked" | "deprecated" | undefined;
+        family?: string | undefined;
+        cursor?: string | undefined;
+        limit?: number | undefined;
+        namespace?: string | undefined;
+    }, undefined, {
+        generation: number;
+        items: {
+            status: "active" | "revoked" | "deprecated";
+            id: string;
+            version: string;
+            schemaVersion: "treeseed.capability-definition/v1";
+            digest: string;
+            inputs: {
+                id: string;
+                version: string;
+                digest: string;
+                mediaTypes?: string[] | undefined;
+            }[];
+            createdAt: string;
+            outputs: {
+                id: string;
+                version: string;
+                digest: string;
+                mediaTypes?: string[] | undefined;
+            }[];
+            description: string;
+            configuration: {
+                key: string;
+                description: string;
+                schema: Record<string, unknown>;
+                requirementSupport: ("required" | "preferred")[];
+                securityCritical?: boolean | undefined;
+            }[];
+            family: "research" | "coordination" | "data" | "engineering" | "publishing" | "external-work";
+            title: string;
+            features: string[];
+            permissionClasses: string[];
+            contextModes: string[];
+            interactionModes: string[];
+            implies: {
+                id: string;
+                version: string;
+                digest: string;
+            }[];
+            conflicts: {
+                id: string;
+                version: string;
+                digest: string;
+            }[];
+            qualificationTier: "signed-attestation" | "automated-suite" | "reviewed-certification";
+        }[];
+        ontologyDigest: string;
+        nextCursor: string | null;
+    }>;
+    show: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
+        capabilityId: string;
+    }, {
+        version?: string | undefined;
+    }, undefined, {
+        status: "active" | "revoked" | "deprecated";
+        id: string;
+        version: string;
+        schemaVersion: "treeseed.capability-definition/v1";
+        digest: string;
+        inputs: {
+            id: string;
+            version: string;
+            digest: string;
+            mediaTypes?: string[] | undefined;
+        }[];
+        createdAt: string;
+        outputs: {
+            id: string;
+            version: string;
+            digest: string;
+            mediaTypes?: string[] | undefined;
+        }[];
+        description: string;
+        configuration: {
+            key: string;
+            description: string;
+            schema: Record<string, unknown>;
+            requirementSupport: ("required" | "preferred")[];
+            securityCritical?: boolean | undefined;
+        }[];
+        family: "research" | "coordination" | "data" | "engineering" | "publishing" | "external-work";
+        title: string;
+        features: string[];
+        permissionClasses: string[];
+        contextModes: string[];
+        interactionModes: string[];
+        implies: {
+            id: string;
+            version: string;
+            digest: string;
+        }[];
+        conflicts: {
+            id: string;
+            version: string;
+            digest: string;
+        }[];
+        qualificationTier: "signed-attestation" | "automated-suite" | "reviewed-certification";
+    }>;
+    generation: import("../control-plane-operation.js").ControlPlaneOperationBinding<{}, {}, undefined, {
+        schemaVersion: "treeseed.capability-ontology/v1";
+        digest: string;
+        createdAt: string;
+        generation: number;
+        signature: {
+            value: string;
+            algorithm: "Ed25519" | "release-catalog";
+            keyId: string;
+        };
+        definitions: {
+            status: "active" | "revoked" | "deprecated";
+            id: string;
+            version: string;
+            schemaVersion: "treeseed.capability-definition/v1";
+            digest: string;
+            inputs: {
+                id: string;
+                version: string;
+                digest: string;
+                mediaTypes?: string[] | undefined;
+            }[];
+            createdAt: string;
+            outputs: {
+                id: string;
+                version: string;
+                digest: string;
+                mediaTypes?: string[] | undefined;
+            }[];
+            description: string;
+            configuration: {
+                key: string;
+                description: string;
+                schema: Record<string, unknown>;
+                requirementSupport: ("required" | "preferred")[];
+                securityCritical?: boolean | undefined;
+            }[];
+            family: "research" | "coordination" | "data" | "engineering" | "publishing" | "external-work";
+            title: string;
+            features: string[];
+            permissionClasses: string[];
+            contextModes: string[];
+            interactionModes: string[];
+            implies: {
+                id: string;
+                version: string;
+                digest: string;
+            }[];
+            conflicts: {
+                id: string;
+                version: string;
+                digest: string;
+            }[];
+            qualificationTier: "signed-attestation" | "automated-suite" | "reviewed-certification";
+        }[];
+    }>;
+};

package/dist/operator-contracts/catalog/capability-ontology-operations.js

@@ -0,0 +1,24 @@
+import { z } from "zod";
+import { capabilityDefinitionSchema, capabilityOntologySchema } from "../../capacity-provider/capability-ontology.js";
+import { defineOperation } from "../operation-builder.js";
+const none = z.undefined(), empty = z.object({}).strict();
+function capabilityOntologyOperations() {
+  return {
+    list: defineOperation({ operationId: "capabilities.list", description: "List standardized execution capabilities from the active ontology generation.", rest: { method: "GET", path: "/v1/capability-ontology" }, parameters: "treeseed.capabilities.list.parameters/v1", capability: "capabilities.read", authentication: "oauth", oauthScopes: ["treeseed:read"], kind: "read", riskClass: "ordinary", confirmation: "never", surfaces: ["rest", "cli", "mcp_tool", "mcp_resource"], cacheScope: "principal", pagination: "cursor" }, {
+      path: empty,
+      query: z.object({ family: z.string().optional(), status: z.enum(["active", "deprecated", "revoked"]).optional(), namespace: z.string().optional(), limit: z.coerce.number().int().min(1).max(500).optional(), cursor: z.string().optional() }).strict(),
+      body: none,
+      output: z.object({ generation: z.number().int().positive(), ontologyDigest: z.string(), items: z.array(capabilityDefinitionSchema), nextCursor: z.string().nullable() }).strict()
+    }),
+    show: defineOperation({ operationId: "capabilities.show", description: "Read one exact standardized execution capability.", rest: { method: "GET", path: "/v1/capability-ontology/{capabilityId}" }, parameters: "treeseed.capabilities.show.parameters/v1", capability: "capabilities.read", authentication: "oauth", oauthScopes: ["treeseed:read"], kind: "read", riskClass: "ordinary", confirmation: "never", surfaces: ["rest", "cli", "mcp_tool", "mcp_resource"], cacheScope: "principal", pagination: "none" }, {
+      path: z.object({ capabilityId: z.string().min(1) }).strict(),
+      query: z.object({ version: z.string().optional() }).strict(),
+      body: none,
+      output: capabilityDefinitionSchema
+    }),
+    generation: defineOperation({ operationId: "capabilities.generation.show", description: "Read the complete active immutable capability ontology.", rest: { method: "GET", path: "/v1/capability-ontology/generations/active" }, capability: "capabilities.read", authentication: "oauth", oauthScopes: ["treeseed:read"], kind: "read", riskClass: "ordinary", confirmation: "never", surfaces: ["rest", "mcp_resource"], cacheScope: "principal", pagination: "none" }, { path: empty, query: empty, body: none, output: capabilityOntologySchema })
+  };
+}
+export {
+  capabilityOntologyOperations
+};

package/dist/operator-contracts/catalog/commands/command-tree-builders.d.ts

@@ -0,0 +1,60 @@
+import type { CommandLeafDescriptor, CommandNodeDescriptor } from '../../command-tree.js';
+type Execution = CommandLeafDescriptor['execution'];
+export declare const unavailable: (reason?: string) => Execution;
+export declare const protocol: (handlerId: `protocol.${string}`) => Execution;
+export declare const local: (handlerId: `local.${string}`) => Execution;
+export declare const field: (target: "path" | "query" | "body", name: string, source: "argument" | "context" | "option", sourceName?: string, required?: boolean, transform?: "identity" | "integer" | "csv") => {
+    target: "path" | "query" | "body";
+    field: string;
+    source: "argument" | "context" | "option";
+    name: string;
+    required: boolean;
+    transform: "integer" | "identity" | "csv";
+};
+export declare const operation: (operationId: `${string}.${string}`, input?: ReturnType<typeof field>[]) => Execution;
+export declare const page: () => {
+    target: "path" | "query" | "body";
+    field: string;
+    source: "argument" | "context" | "option";
+    name: string;
+    required: boolean;
+    transform: "integer" | "identity" | "csv";
+}[];
+export declare const aiNode: () => {
+    target: "path" | "query" | "body";
+    field: string;
+    source: "argument" | "context" | "option";
+    name: string;
+    required: boolean;
+    transform: "integer" | "identity" | "csv";
+};
+export declare const aiInstance: () => {
+    target: "path" | "query" | "body";
+    field: string;
+    source: "argument" | "context" | "option";
+    name: string;
+    required: boolean;
+    transform: "integer" | "identity" | "csv";
+}[];
+export declare const planOption: {
+    name: string;
+    description: string;
+    type: "boolean";
+};
+export declare function leaf(segment: string, kind?: 'read' | 'mutation', argument?: string, confirmation?: 'never' | 'destructive' | 'credential' | 'authority' | 'production' | 'irreversible'): CommandNodeDescriptor;
+export declare function branch(segment: string, children: CommandNodeDescriptor[]): CommandNodeDescriptor;
+export declare function addOptions(node: CommandNodeDescriptor, options: NonNullable<CommandLeafDescriptor['options']>): CommandNodeDescriptor;
+export declare function configurationAdopt(): CommandNodeDescriptor;
+export declare function hostReset(): CommandNodeDescriptor;
+export declare function hostUninstall(): CommandNodeDescriptor;
+export declare function hostInitialize(): CommandNodeDescriptor;
+export declare function hostSecurityInitialize(): CommandNodeDescriptor;
+export declare function hostSecurityRotate(): CommandNodeDescriptor;
+export declare function hostProviderCredentialInitialize(): CommandNodeDescriptor;
+export declare function hostRecoveryVerify(): CommandNodeDescriptor;
+export declare function aiModeSet(): CommandNodeDescriptor;
+export declare function userCreate(): CommandNodeDescriptor;
+export declare function authLogin(): CommandNodeDescriptor;
+export declare function libraryRead(segment: string, extraArguments?: string[], extraOptions?: CommandLeafDescriptor['options']): CommandNodeDescriptor;
+export declare function developmentCommand(segment: string, kind: 'read' | 'mutation', argument?: string, options?: NonNullable<CommandLeafDescriptor['options']>): CommandNodeDescriptor;
+export {};

package/dist/operator-contracts/catalog/commands/command-tree-builders.js

@@ -0,0 +1,191 @@
+import { identityLoginCommand } from "../services/identity-commands.js";
+const unavailable = (reason = "This capability is not enabled until its control-plane operation is accepted.") => ({
+  kind: "unavailable",
+  code: "standards_migration_not_enabled",
+  reason
+});
+const protocol = (handlerId) => ({ kind: "protocol", handlerId });
+const local = (handlerId) => ({ kind: "local", handlerId });
+const field = (target, name, source, sourceName = name, required = false, transform = "identity") => ({ target, field: name, source, name: sourceName, required, transform });
+const operation = (operationId, input = []) => ({ kind: "operation", operationId, input });
+const page = () => [field("query", "status", "option"), field("query", "limit", "option", "limit", false, "integer"), field("query", "cursor", "option")];
+const aiNode = () => field("path", "nodeId", "context", "node", true);
+const aiInstance = () => [field("path", "teamId", "context", "team", true), field("path", "instanceId", "context", "node", true)];
+const planOption = { name: "--plan", description: "Return the exact proposed outcome without mutation.", type: "boolean" };
+function leaf(segment, kind = "read", argument, confirmation = "never") {
+  const value = {
+    segment,
+    description: `${segment[0].toUpperCase()}${segment.slice(1)} the selected resource.`,
+    kind,
+    arguments: argument ? [{ name: argument, description: `${argument} identity or path.`, required: true }] : void 0,
+    options: kind === "mutation" ? [planOption] : void 0,
+    authorization: kind === "mutation" ? { capability: `command.${segment}`, confirmation } : void 0,
+    resultSchemaId: `treeseed.command.${segment}/v1`,
+    execution: unavailable()
+  };
+  return { nodeType: "leaf", ...value };
+}
+function branch(segment, children) {
+  return { nodeType: "branch", segment, description: `${segment[0].toUpperCase()}${segment.slice(1)} operations.`, children };
+}
+function addOptions(node, options) {
+  if (node.nodeType === "leaf") node.options = [...node.options ?? [], ...options];
+  return node;
+}
+function configurationAdopt() {
+  const value = leaf("adopt", "mutation", "file", "destructive");
+  if (value.nodeType !== "leaf") throw new Error("Configuration adoption must be a leaf command.");
+  value.options = [...value.options ?? [], { name: "--confirm", description: "Confirm replacement of the installed configuration identity.", type: "boolean" }];
+  return value;
+}
+function hostReset() {
+  const value = leaf("reset", "mutation", void 0, "irreversible");
+  if (value.nodeType !== "leaf") throw new Error("Host reset must be a leaf command.");
+  value.description = "Stop managed components, erase their state, and reconcile a fresh unseeded platform.";
+  value.options = [...value.options ?? [], { name: "--confirm", description: "Confirm deletion of all manager-owned component data and receipts.", type: "boolean" }];
+  return value;
+}
+function hostUninstall() {
+  const value = leaf("uninstall", "mutation", void 0, "irreversible");
+  if (value.nodeType !== "leaf") throw new Error("Host uninstall must be a leaf command.");
+  value.description = "Plan or remove every inventoried TreeSeed-owned host resource while preserving unrelated infrastructure and source repositories.";
+  value.options = [
+    ...value.options ?? [],
+    { name: "--confirm", description: "Confirm removal of the reviewed TreeSeed resource inventory.", type: "boolean" },
+    { name: "--purge-security", description: "Separately select destruction of encrypted state, credentials, users, and groups.", type: "boolean" },
+    { name: "--yes", description: "Confirm non-interactive execution after reviewing the plan.", type: "boolean" }
+  ];
+  value.resultSchemaId = "treeseed.host-uninstall-result/v1";
+  return value;
+}
+function hostInitialize() {
+  const value = leaf("initialize", "mutation", void 0, "authority");
+  if (value.nodeType !== "leaf") throw new Error("Host initialize must be a leaf command.");
+  value.description = "Initialize the generic host foundation from an immutable catalog-bound profile.";
+  value.options = [
+    ...value.options ?? [],
+    { name: "--input-file", description: "Team capacity installation configuration downloaded from Admin. Values are never printed.", type: "string" },
+    { name: "--profile", description: "Catalog-bound host initialization profile.", type: "string", required: true },
+    { name: "--confirm", description: "Confirm installation of the reviewed profile plan.", type: "boolean" },
+    { name: "--yes", description: "Confirm non-interactive execution after reviewing the plan.", type: "boolean" }
+  ];
+  value.resultSchemaId = "treeseed.host-initialization-result/v1";
+  return value;
+}
+function hostSecurityInitialize() {
+  const value = leaf("initialize", "mutation", void 0, "credential");
+  if (value.nodeType !== "leaf") throw new Error("Host security initialization must be a leaf command.");
+  value.description = "Initialize the encrypted provider volume, application keys, and offline recovery bundle.";
+  value.options = [...value.options ?? [], { name: "--recovery-bundle", description: "Absolute path for the new encrypted offline recovery bundle.", type: "string", required: true }, { name: "--confirm", description: "Confirm provider-state migration and volume formatting.", type: "boolean", required: true }];
+  return value;
+}
+function hostSecurityRotate() {
+  const value = leaf("rotate", "mutation", "target", "credential");
+  if (value.nodeType !== "leaf") throw new Error("Host security rotation must be a leaf command.");
+  value.options = [
+    ...value.options ?? [],
+    { name: "--recovery-bundle", description: "Absolute path to the currently authenticated recovery bundle.", type: "string", required: true },
+    { name: "--new-recovery-bundle", description: "Absolute non-existing path for the replacement recovery bundle.", type: "string", required: true },
+    { name: "--confirm", description: "Confirm creation and activation of a new key generation.", type: "boolean", required: true }
+  ];
+  return value;
+}
+function hostProviderCredentialInitialize() {
+  const value = leaf("initialize", "mutation", "initializer", "credential");
+  if (value.nodeType !== "leaf") throw new Error("Provider credential initialization must be a leaf command.");
+  value.description = "Initialize an execution-provider credential through its registered host initializer.";
+  value.options = [...value.options ?? [], { name: "--source", description: "Registered credential source to use instead of automatic selection.", type: "string" }];
+  return value;
+}
+function hostRecoveryVerify() {
+  return {
+    nodeType: "leaf",
+    segment: "verify",
+    description: "Authenticate and inventory an offline recovery bundle without revealing secrets.",
+    kind: "read",
+    options: [{ name: "--bundle", description: "Absolute recovery bundle path.", type: "string", required: true }],
+    resultSchemaId: "treeseed.host-recovery-verification/v1",
+    execution: unavailable()
+  };
+}
+function aiModeSet() {
+  const value = leaf("set", "mutation", "mode", "authority");
+  if (value.nodeType !== "leaf") throw new Error("AI mode set must be a leaf command.");
+  value.description = "Transition the exclusive AI GPU resource to awake or sleep.";
+  value.options = [
+    ...value.options ?? [],
+    { name: "--idempotency-key", description: "Replay-safe transition identity.", type: "string" },
+    { name: "--drain-timeout", description: "Maximum drain wait in seconds.", type: "number" }
+  ];
+  value.authorization = { capability: "host.ai.mode", confirmation: "authority" };
+  value.resultSchemaId = "treeseed.ai-mode-transition-receipt/v1";
+  return value;
+}
+function userCreate() {
+  const value = leaf("create", "mutation");
+  if (value.nodeType !== "leaf") throw new Error("User creation must be a leaf command.");
+  value.description = "Create a local TreeSeed user with a securely prompted password.";
+  value.options = [
+    ...value.options ?? [],
+    { name: "--email", description: "Email address for the new user.", type: "string" },
+    { name: "--username", description: "Unique username for the new user.", type: "string" },
+    { name: "--display-name", description: "Human-readable display name.", type: "string" },
+    { name: "--timeout", description: "Maximum seconds to wait for registration.", type: "number" }
+  ];
+  return value;
+}
+function authLogin() {
+  return identityLoginCommand(leaf("login", "mutation"));
+}
+function libraryRead(segment, extraArguments = [], extraOptions = []) {
+  return {
+    nodeType: "leaf",
+    segment,
+    description: `${segment[0].toUpperCase()}${segment.slice(1)} project library knowledge.`,
+    kind: "read",
+    arguments: ["project", ...extraArguments].map((name) => ({ name, description: `${name} value.`, required: true })),
+    options: [{ name: "--ref", description: "Earlier historical revision; omit for the current library.", type: "string" }, ...extraOptions],
+    resultSchemaId: `treeseed.command.library.${segment}/v1`,
+    execution: local(`local.library.${segment}`)
+  };
+}
+function developmentCommand(segment, kind, argument, options = []) {
+  return {
+    nodeType: "leaf",
+    segment,
+    description: `${segment[0].toUpperCase()}${segment.slice(1)} a local development session.`,
+    kind,
+    arguments: argument ? [{ name: argument, description: `${argument} value.`, required: true }] : void 0,
+    options: [...kind === "mutation" ? [planOption] : [], ...options],
+    authorization: kind === "mutation" ? { capability: `development.${segment}`, confirmation: "never" } : void 0,
+    resultSchemaId: `treeseed.command.dev.${segment}/v1`,
+    execution: local(`local.dev.${segment}`)
+  };
+}
+export {
+  addOptions,
+  aiInstance,
+  aiModeSet,
+  aiNode,
+  authLogin,
+  branch,
+  configurationAdopt,
+  developmentCommand,
+  field,
+  hostInitialize,
+  hostProviderCredentialInitialize,
+  hostRecoveryVerify,
+  hostReset,
+  hostSecurityInitialize,
+  hostSecurityRotate,
+  hostUninstall,
+  leaf,
+  libraryRead,
+  local,
+  operation,
+  page,
+  planOption,
+  protocol,
+  unavailable,
+  userCreate
+};