@treeseed/sdk 0.13.0-rc.12 → 0.13.0-rc.121

package/dist/operator-contracts/control-plane-operations.js

@@ -1,48 +1,20 @@
 import { z } from "zod";
-import {
-  CONTROL_PLANE_OPERATION_SCHEMA_VERSION
-} from "./control-plane-operation.js";
-const empty = z.object({}).strict();
-const none = z.undefined();
-const record = z.record(z.unknown());
-const payload = record;
-function define(definition, schema) {
-  const { parameters, redactedPaths = [], idempotencyRequired, concurrencyRequired, ...descriptor } = definition;
-  const mutation = definition.kind === "mutation";
-  return {
-    descriptor: {
-      ...descriptor,
-      schemaVersion: CONTROL_PLANE_OPERATION_SCHEMA_VERSION,
-      schemas: {
-        input: `treeseed.${definition.operationId}.input/v1`,
-        output: `treeseed.${definition.operationId}.output/v1`,
-        errors: "treeseed.problem/v1",
-        ...parameters ? { parameters } : {}
-      },
-      idempotency: { required: idempotencyRequired ?? mutation, header: "Idempotency-Key" },
-      concurrency: { required: concurrencyRequired ?? false, readHeader: "ETag", writeHeader: "If-Match" },
-      audited: definition.surfaces.some((surface) => surface !== "internal"),
-      receipt: mutation,
-      redactedPaths
-    },
-    schema
-  };
-}
-function read(operationId, path, capability, surfaces = ["rest"]) {
-  return define({
-    operationId,
-    description: `Read ${operationId}.`,
-    rest: { method: "GET", path },
-    capability,
-    oauthScopes: ["treeseed:read"],
-    kind: "read",
-    riskClass: "ordinary",
-    confirmation: "never",
-    surfaces,
-    cacheScope: "principal",
-    pagination: "none"
-  }, { path: empty, query: empty, body: none, output: payload });
-}
+import { defineOperation as define, defineTreeDxProxyOperation as treedxProxy, defineReadOperation as read } from "./operation-builder.js";
+import { communicationOperations, providerCommunicationLifecycleOperations, providerDiscussionResponseOperation } from "./catalog/communication-operations.js";
+import { inboxOperations } from "./catalog/inbox-operations.js";
+import { WORKDAY_PROFILE_OPERATIONS } from "./catalog/workdays/profile-operations.js";
+import { adminAccountOperations, adminTeamOperations } from "./catalog/admin-account-team-operations.js";
+import { TREEAI_CONTROL_PLANE_OPERATIONS } from "./catalog/treeai-operations.js";
+import { capabilityOntologyOperations } from "./catalog/capability-ontology-operations.js";
+import { knowledgeShareOperations } from "./catalog/knowledge-share-operations.js";
+import { PROVIDER_ENVIRONMENT_OPERATIONS } from "./catalog/provider-environment-operations.js";
+import { HOSTED_TOPOLOGY_OPERATIONS } from "./catalog/hosted-topology-operations.js";
+import { AI_INSTANCE_OPERATIONS } from "./catalog/infrastructure/ai-instance-operations.js";
+import { SECRET_OPERATIONS } from "./catalog/services/secret-operations.js";
+import { buildControlPlaneCatalog, flattenControlPlaneOperations } from "./catalog/control-plane-catalog.js";
+import { EXECUTION_OPERATIONS } from "./catalog/execution/execution-operations.js";
+import { AGENT_TEAM_CLONE_OPERATIONS } from "./catalog/agents/agent-team-clone-operations.js";
+const empty = z.object({}).strict(), none = z.undefined(), record = z.record(z.unknown()), payload = record;
 function providerPath(operationId, method, path, pathShape, options = {}) {
   const kind = options.read ? "read" : "mutation";
   return define({
@@ -51,7 +23,8 @@ function providerPath(operationId, method, path, pathShape, options = {}) {
     rest: { method, path },
     parameters: `treeseed.${operationId}.parameters/v1`,
     capability: "providers.execute",
-    oauthScopes: ["treeseed:execution"],
+    authentication: options.authentication ?? "provider",
+    oauthScopes: [],
     kind,
     riskClass: "ordinary",
     confirmation: "never",
@@ -66,7 +39,8 @@ const noPathProvider = (operationId, method, path, options = {}) => define({
   description: `${options.read ? "Read" : "Apply"} ${operationId}.`,
   rest: { method, path },
   capability: "providers.execute",
-  oauthScopes: ["treeseed:execution"],
+  authentication: options.authentication ?? "provider",
+  oauthScopes: [],
   kind: options.read ? "read" : "mutation",
   riskClass: "ordinary",
   confirmation: "never",
@@ -75,6 +49,24 @@ const noPathProvider = (operationId, method, path, options = {}) => define({
   pagination: "none",
   redactedPaths: options.redactedPaths
 }, { path: empty, query: empty, body: method === "GET" ? none : record, output: payload });
+function postRead(operationId, path, pathShape, capability, scopes, surfaces) {
+  return define({
+    operationId,
+    description: `Read ${operationId}.`,
+    rest: { method: "POST", path },
+    ...Object.keys(pathShape).length ? { parameters: `treeseed.${operationId}.parameters/v1` } : {},
+    capability,
+    authentication: "oauth",
+    oauthScopes: scopes,
+    kind: "read",
+    riskClass: "ordinary",
+    confirmation: "never",
+    surfaces,
+    cacheScope: "none",
+    pagination: "none",
+    idempotencyRequired: false
+  }, { path: z.object(pathShape).strict(), query: empty, body: record, output: payload });
+}
 function resource(operationId, method, path, pathShape, options = { capability: "control-plane.use" }) {
   const kind = method === "GET" ? "read" : "mutation";
   const riskClass = options.risk ?? "ordinary";
@@ -84,18 +76,24 @@ function resource(operationId, method, path, pathShape, options = { capability:
     rest: { method, path },
     ...Object.keys(pathShape).length ? { parameters: `treeseed.${operationId}.parameters/v1` } : {},
     capability: options.capability,
+    authentication: options.authentication ?? ((options.scopes ?? (kind === "read" ? ["treeseed:read"] : ["treeseed:projects:write"])).length ? "oauth" : "anonymous"),
     oauthScopes: options.scopes ?? (kind === "read" ? ["treeseed:read"] : ["treeseed:projects:write"]),
     kind,
     riskClass,
     confirmation: riskClass === "ordinary" ? "never" : "input_required",
     surfaces: options.surfaces ?? ["rest"],
-    cacheScope: kind === "read" ? "principal" : "none",
+    cacheScope: options.cacheScope ?? (kind === "read" ? "principal" : "none"),
     pagination: options.pagination ?? "none",
     concurrencyRequired: options.concurrency,
     redactedPaths: options.redactedPaths
   }, { path: z.object(pathShape).strict(), query: kind === "read" ? record : empty, body: kind === "read" ? none : record, output: payload });
 }
 const CONTROL_PLANE_OPERATIONS = {
+  aiInstances: AI_INSTANCE_OPERATIONS,
+  infrastructure: { topology: HOSTED_TOPOLOGY_OPERATIONS },
+  capabilities: capabilityOntologyOperations(),
+  inbox: inboxOperations(),
+  treeai: TREEAI_CONTROL_PLANE_OPERATIONS,
   status: {
     show: read("status.show", "/v1/status", "status.read", ["rest", "cli", "mcp_tool", "mcp_resource"])
   },
@@ -116,7 +114,7 @@ const CONTROL_PLANE_OPERATIONS = {
       surfaces: ["rest", "cli", "mcp_tool"],
       cacheScope: "principal",
       pagination: "cursor"
-    }, { path: empty, query: z.object({ teamId: z.string().min(1).optional(), limit: z.number().int().positive().max(200).optional(), cursor: z.string().min(1).optional() }).strict(), body: none, output: payload }),
+    }, { path: empty, query: z.object({ teamId: z.string().min(1).optional(), limit: z.coerce.number().int().positive().max(200).optional(), cursor: z.string().min(1).optional() }).strict(), body: none, output: payload }),
     show: resource("projects.show", "GET", "/v1/projects/{projectId}", { projectId: z.string().min(1) }, { capability: "projects.read", surfaces: ["rest", "cli", "mcp_tool", "mcp_resource"] }),
     create: resource("projects.create", "POST", "/v1/teams/{teamId}/projects", { teamId: z.string().min(1) }, { capability: "projects.write", surfaces: ["rest", "cli", "mcp_tool"] }),
     update: resource("projects.update", "PUT", "/v1/projects/{projectId}", { projectId: z.string().min(1) }, { capability: "projects.write", surfaces: ["rest", "cli", "mcp_tool"], concurrency: true }),
@@ -131,6 +129,7 @@ const CONTROL_PLANE_OPERATIONS = {
     updateRepositoryTopology: resource("projects.repository.update", "PUT", "/v1/projects/{projectId}/repository-topology", { projectId: z.string().min(1) }, { capability: "repositories.write", concurrency: true })
   },
   accounts: {
+    ...adminAccountOperations,
     current: resource("accounts.current.show", "GET", "/v1/me", {}, { capability: "accounts.read", surfaces: ["rest", "cli", "mcp_resource"] }),
     register: resource("accounts.register", "POST", "/v1/auth/web/sign-up", {}, { capability: "accounts.register", scopes: [], redactedPaths: ["body.password"] }),
     confirmEmail: resource("accounts.email.confirm", "POST", "/v1/auth/web/confirm-email", {}, { capability: "accounts.register", scopes: [], redactedPaths: ["body.token"] }),
@@ -154,15 +153,16 @@ const CONTROL_PLANE_OPERATIONS = {
     readNotification: resource("accounts.notifications.read", "POST", "/v1/auth/web/notifications/{notificationId}/read", { notificationId: z.string().min(1) }, { capability: "accounts.write" })
   },
   teams: {
+    ...adminTeamOperations,
     list: resource("teams.list", "GET", "/v1/teams", {}, { capability: "teams.read", surfaces: ["rest", "cli", "mcp_tool"], pagination: "cursor" }),
     create: resource("teams.create", "POST", "/v1/teams", {}, { capability: "teams.write", surfaces: ["rest", "cli", "mcp_tool"] }),
-    profile: resource("teams.profile.show", "GET", "/v1/teams/by-name/{name}/profile", { name: z.string().min(1) }, { capability: "teams.read", surfaces: ["rest", "mcp_resource"] }),
+    profile: resource("teams.profile.show", "GET", "/v1/teams/by-name/{name}/profile", { name: z.string().min(1) }, { capability: "teams.read", scopes: [], authentication: "anonymous", cacheScope: "public", surfaces: ["rest", "mcp_resource"] }),
     update: resource("teams.update", "PATCH", "/v1/teams/{teamId}", { teamId: z.string().min(1) }, { capability: "teams.write", concurrency: true }),
     access: resource("teams.access.show", "GET", "/v1/teams/{teamId}/access", { teamId: z.string().min(1) }, { capability: "teams.read" }),
     members: resource("teams.members.list", "GET", "/v1/teams/{teamId}/members", { teamId: z.string().min(1) }, { capability: "teams.read", pagination: "cursor" }),
     invite: resource("teams.invites.create", "POST", "/v1/teams/{teamId}/invites", { teamId: z.string().min(1) }, { capability: "teams.write" }),
     invites: resource("teams.invites.list", "GET", "/v1/teams/{teamId}/invites", { teamId: z.string().min(1) }, { capability: "teams.read", pagination: "cursor" }),
-    inviteShow: resource("teams.invites.show", "GET", "/v1/team-invites/{token}", { token: z.string().min(1) }, { capability: "teams.join", scopes: [], redactedPaths: ["path.token"] }),
+    inviteShow: resource("teams.invites.show", "GET", "/v1/team-invites/{token}", { token: z.string().min(1) }, { capability: "teams.join", scopes: [], authentication: "signed_request", redactedPaths: ["path.token"] }),
     inviteAccept: resource("teams.invites.accept", "POST", "/v1/team-invites/{token}/accept", { token: z.string().min(1) }, { capability: "teams.join", redactedPaths: ["path.token"] }),
     updateMember: resource("teams.members.update", "PATCH", "/v1/teams/{teamId}/members/{membershipId}", { teamId: z.string().min(1), membershipId: z.string().min(1) }, { capability: "teams.write", concurrency: true }),
     removeMember: resource("teams.members.delete", "DELETE", "/v1/teams/{teamId}/members/{membershipId}", { teamId: z.string().min(1), membershipId: z.string().min(1) }, { capability: "teams.write", risk: "destructive", concurrency: true }),
@@ -178,6 +178,7 @@ const CONTROL_PLANE_OPERATIONS = {
     updateStatus: resource("discussions.status.update", "POST", "/v1/discussions/{discussionId}/status", { discussionId: z.string().min(1) }, { capability: "discussions.write", scopes: ["treeseed:knowledge:write"], concurrency: true })
   },
   knowledge: {
+    ...knowledgeShareOperations(),
     library: resource("knowledge.library.list", "GET", "/v1/knowledge/library", {}, { capability: "knowledge.read", surfaces: ["rest", "mcp_tool", "mcp_resource"], pagination: "cursor" }),
     reader: resource("knowledge.reader.show", "GET", "/v1/knowledge/reader", {}, { capability: "knowledge.read", surfaces: ["rest", "mcp_resource"] }),
     context: resource("knowledge.context.show", "GET", "/v1/knowledge/context", {}, { capability: "knowledge.read", surfaces: ["rest", "mcp_tool"] }),
@@ -185,41 +186,49 @@ const CONTROL_PLANE_OPERATIONS = {
     search: resource("knowledge.search", "GET", "/v1/knowledge/search", {}, { capability: "knowledge.read", surfaces: ["rest", "mcp_tool"], pagination: "cursor" }),
     teamCatalog: resource("knowledge.catalog.team", "GET", "/v1/teams/{teamId}/knowledge/catalog", { teamId: z.string().min(1) }, { capability: "knowledge.read", pagination: "cursor" }),
     projectCatalog: resource("knowledge.catalog.project", "GET", "/v1/projects/{projectId}/knowledge/catalog", { projectId: z.string().min(1) }, { capability: "knowledge.read", pagination: "cursor" }),
-    createWorkspace: resource("knowledge.workspaces.create", "POST", "/v1/projects/{projectId}/knowledge/workspaces", { projectId: z.string().min(1) }, { capability: "knowledge.write", scopes: ["treeseed:knowledge:write"] }),
-    workspace: resource("knowledge.workspaces.show", "GET", "/v1/knowledge/workspaces/{workspaceId}", { workspaceId: z.string().min(1) }, { capability: "knowledge.read" }),
-    workspaceContent: resource("knowledge.workspaces.content.show", "GET", "/v1/knowledge/workspaces/{workspaceId}/content", { workspaceId: z.string().min(1) }, { capability: "knowledge.read" }),
-    updateWorkspaceContent: resource("knowledge.workspaces.content.update", "PUT", "/v1/knowledge/workspaces/{workspaceId}/content", { workspaceId: z.string().min(1) }, { capability: "knowledge.write", scopes: ["treeseed:knowledge:write"], concurrency: true }),
-    workspaceDiff: resource("knowledge.workspaces.diff", "GET", "/v1/knowledge/workspaces/{workspaceId}/diff", { workspaceId: z.string().min(1) }, { capability: "knowledge.read" }),
-    abandonWorkspace: resource("knowledge.workspaces.abandon", "POST", "/v1/knowledge/workspaces/{workspaceId}/abandon", { workspaceId: z.string().min(1) }, { capability: "knowledge.write", scopes: ["treeseed:knowledge:write"], risk: "destructive", concurrency: true }),
-    submitWorkspace: resource("knowledge.workspaces.submit", "POST", "/v1/knowledge/workspaces/{workspaceId}/submit", { workspaceId: z.string().min(1) }, { capability: "knowledge.write", scopes: ["treeseed:knowledge:write"], concurrency: true }),
-    reviews: resource("knowledge.reviews.list", "GET", "/v1/teams/{teamId}/knowledge/reviews", { teamId: z.string().min(1) }, { capability: "knowledge.review", pagination: "cursor" }),
+    createWorkspace: resource("knowledge.workspaces.create", "POST", "/v1/projects/{projectId}/knowledge/workspaces", { projectId: z.string().min(1) }, { capability: "knowledge.write", scopes: ["treeseed:knowledge:write"], surfaces: ["rest", "cli"] }),
+    workspace: resource("knowledge.workspaces.show", "GET", "/v1/knowledge/workspaces/{workspaceId}", { workspaceId: z.string().min(1) }, { capability: "knowledge.read", surfaces: ["rest", "cli"] }),
+    workspaceContent: resource("knowledge.workspaces.content.show", "GET", "/v1/knowledge/workspaces/{workspaceId}/content", { workspaceId: z.string().min(1) }, { capability: "knowledge.read", surfaces: ["rest", "cli"] }),
+    updateWorkspaceContent: resource("knowledge.workspaces.content.update", "PUT", "/v1/knowledge/workspaces/{workspaceId}/content", { workspaceId: z.string().min(1) }, { capability: "knowledge.write", scopes: ["treeseed:knowledge:write"], surfaces: ["rest", "cli"], concurrency: true }),
+    workspaceDiff: resource("knowledge.workspaces.diff", "GET", "/v1/knowledge/workspaces/{workspaceId}/diff", { workspaceId: z.string().min(1) }, { capability: "knowledge.read", surfaces: ["rest", "cli"] }),
+    abandonWorkspace: resource("knowledge.workspaces.abandon", "POST", "/v1/knowledge/workspaces/{workspaceId}/abandon", { workspaceId: z.string().min(1) }, { capability: "knowledge.write", scopes: ["treeseed:knowledge:write"], surfaces: ["rest", "cli"], risk: "destructive", concurrency: true }),
+    submitWorkspace: resource("knowledge.workspaces.submit", "POST", "/v1/knowledge/workspaces/{workspaceId}/submit", { workspaceId: z.string().min(1) }, { capability: "knowledge.write", scopes: ["treeseed:knowledge:write"], surfaces: ["rest", "cli"], concurrency: true }),
+    reviews: resource("knowledge.reviews.list", "GET", "/v1/teams/{teamId}/knowledge/reviews", { teamId: z.string().min(1) }, { capability: "knowledge.review", surfaces: ["rest", "cli"], pagination: "cursor" }),
     commentReview: resource("knowledge.reviews.comments.create", "POST", "/v1/knowledge/reviews/{reviewId}/comments", { reviewId: z.string().min(1) }, { capability: "knowledge.review", scopes: ["treeseed:knowledge:write"] }),
-    decideReview: resource("knowledge.reviews.decide", "POST", "/v1/knowledge/reviews/{reviewId}/decision", { reviewId: z.string().min(1) }, { capability: "knowledge.review", scopes: ["treeseed:knowledge:write"], concurrency: true }),
-    publishReview: resource("knowledge.reviews.publish", "POST", "/v1/knowledge/reviews/{reviewId}/publish", { reviewId: z.string().min(1) }, { capability: "knowledge.publish", scopes: ["treeseed:knowledge:write"], concurrency: true })
+    decideReview: resource("knowledge.reviews.decide", "POST", "/v1/knowledge/reviews/{reviewId}/decision", { reviewId: z.string().min(1) }, { capability: "knowledge.review", scopes: ["treeseed:knowledge:write"], surfaces: ["rest", "cli"], concurrency: true }),
+    publishReview: resource("knowledge.reviews.publish", "POST", "/v1/knowledge/reviews/{reviewId}/publish", { reviewId: z.string().min(1) }, { capability: "knowledge.publish", scopes: ["treeseed:knowledge:write"], surfaces: ["rest", "cli"], concurrency: true })
   },
   governance: {
-    proposals: resource("governance.proposals.list", "GET", "/v1/projects/{projectId}/proposals", { projectId: z.string().min(1) }, { capability: "governance.read", surfaces: ["rest", "mcp_tool", "mcp_resource"], pagination: "cursor" }),
-    createProposal: resource("governance.proposals.create", "POST", "/v1/projects/{projectId}/proposals", { projectId: z.string().min(1) }, { capability: "governance.write", scopes: ["treeseed:governance:write"], surfaces: ["rest", "mcp_tool"] }),
-    proposal: resource("governance.proposals.show", "GET", "/v1/projects/{projectId}/proposals/{proposalId}", { projectId: z.string().min(1), proposalId: z.string().min(1) }, { capability: "governance.read", surfaces: ["rest", "mcp_resource"] }),
-    updateProposal: resource("governance.proposals.update", "PATCH", "/v1/projects/{projectId}/proposals/{proposalId}", { projectId: z.string().min(1), proposalId: z.string().min(1) }, { capability: "governance.write", scopes: ["treeseed:governance:write"], concurrency: true }),
-    openProposal: resource("governance.proposals.open", "POST", "/v1/projects/{projectId}/proposals/{proposalId}/open", { projectId: z.string().min(1), proposalId: z.string().min(1) }, { capability: "governance.write", scopes: ["treeseed:governance:write"], concurrency: true }),
-    startVoting: resource("governance.proposals.voting.start", "POST", "/v1/projects/{projectId}/proposals/{proposalId}/start-voting", { projectId: z.string().min(1), proposalId: z.string().min(1) }, { capability: "governance.write", scopes: ["treeseed:governance:write"], concurrency: true }),
-    vote: resource("governance.proposals.vote", "POST", "/v1/projects/{projectId}/proposals/{proposalId}/vote", { projectId: z.string().min(1), proposalId: z.string().min(1) }, { capability: "governance.write", scopes: ["treeseed:governance:write"] }),
-    evaluate: resource("governance.proposals.evaluate", "POST", "/v1/projects/{projectId}/proposals/{proposalId}/evaluate", { projectId: z.string().min(1), proposalId: z.string().min(1) }, { capability: "governance.decide", scopes: ["treeseed:governance:write"], concurrency: true }),
+    proposals: resource("governance.proposals.list", "GET", "/v1/projects/{projectId}/proposals", { projectId: z.string().min(1) }, { capability: "governance.read", surfaces: ["rest", "cli", "mcp_tool", "mcp_resource"], pagination: "cursor" }),
+    createProposal: resource("governance.proposals.create", "POST", "/v1/projects/{projectId}/proposals", { projectId: z.string().min(1) }, { capability: "governance.write", scopes: ["treeseed:governance:write"], surfaces: ["rest", "cli", "mcp_tool"] }),
+    proposal: resource("governance.proposals.show", "GET", "/v1/projects/{projectId}/proposals/{proposalId}", { projectId: z.string().min(1), proposalId: z.string().min(1) }, { capability: "governance.read", surfaces: ["rest", "cli", "mcp_resource"] }),
+    updateProposal: resource("governance.proposals.update", "PATCH", "/v1/projects/{projectId}/proposals/{proposalId}", { projectId: z.string().min(1), proposalId: z.string().min(1) }, { capability: "governance.write", scopes: ["treeseed:governance:write"], surfaces: ["rest", "cli"], concurrency: true }),
+    resolveProposalFeedback: resource("governance.proposals.feedback.resolve", "POST", "/v1/projects/{projectId}/proposals/{proposalId}/feedback/{feedbackId}/resolve", { projectId: z.string().min(1), proposalId: z.string().min(1), feedbackId: z.string().min(1) }, { capability: "governance.write", scopes: ["treeseed:governance:write"], surfaces: ["rest", "cli"], concurrency: true }),
+    openProposal: resource("governance.proposals.open", "POST", "/v1/projects/{projectId}/proposals/{proposalId}/open", { projectId: z.string().min(1), proposalId: z.string().min(1) }, { capability: "governance.write", scopes: ["treeseed:governance:write"], surfaces: ["rest", "cli"], concurrency: true }),
+    startVoting: resource("governance.proposals.voting.start", "POST", "/v1/projects/{projectId}/proposals/{proposalId}/start-voting", { projectId: z.string().min(1), proposalId: z.string().min(1) }, { capability: "governance.write", scopes: ["treeseed:governance:write"], surfaces: ["rest", "cli"], concurrency: true }),
+    vote: resource("governance.proposals.vote", "POST", "/v1/projects/{projectId}/proposals/{proposalId}/vote", { projectId: z.string().min(1), proposalId: z.string().min(1) }, { capability: "governance.write", scopes: ["treeseed:governance:write"], surfaces: ["rest", "cli"] }),
+    evaluate: resource("governance.proposals.evaluate", "POST", "/v1/projects/{projectId}/proposals/{proposalId}/evaluate", { projectId: z.string().min(1), proposalId: z.string().min(1) }, { capability: "governance.decide", scopes: ["treeseed:governance:write"], surfaces: ["rest", "cli"], concurrency: true }),
     withdraw: resource("governance.proposals.withdraw", "POST", "/v1/projects/{projectId}/proposals/{proposalId}/withdraw", { projectId: z.string().min(1), proposalId: z.string().min(1) }, { capability: "governance.write", scopes: ["treeseed:governance:write"], risk: "destructive", concurrency: true }),
     supersede: resource("governance.proposals.supersede", "POST", "/v1/projects/{projectId}/proposals/{proposalId}/supersede", { projectId: z.string().min(1), proposalId: z.string().min(1) }, { capability: "governance.write", scopes: ["treeseed:governance:write"], concurrency: true }),
     proposalEvents: resource("governance.proposals.events", "GET", "/v1/projects/{projectId}/proposals/{proposalId}/events", { projectId: z.string().min(1), proposalId: z.string().min(1) }, { capability: "governance.read", pagination: "cursor" }),
-    decisions: resource("governance.decisions.list", "GET", "/v1/projects/{projectId}/decisions", { projectId: z.string().min(1) }, { capability: "governance.read", surfaces: ["rest", "mcp_tool", "mcp_resource"], pagination: "cursor" }),
-    decision: resource("governance.decisions.show", "GET", "/v1/projects/{projectId}/decisions/{decisionId}", { projectId: z.string().min(1), decisionId: z.string().min(1) }, { capability: "governance.read", surfaces: ["rest", "mcp_resource"] }),
+    decisions: resource("governance.decisions.list", "GET", "/v1/projects/{projectId}/decisions", { projectId: z.string().min(1) }, { capability: "governance.read", surfaces: ["rest", "cli", "mcp_tool", "mcp_resource"], pagination: "cursor" }),
+    decision: resource("governance.decisions.show", "GET", "/v1/projects/{projectId}/decisions/{decisionId}", { projectId: z.string().min(1), decisionId: z.string().min(1) }, { capability: "governance.read", surfaces: ["rest", "cli", "mcp_resource"] }),
     decisionEvents: resource("governance.decisions.events", "GET", "/v1/projects/{projectId}/decisions/{decisionId}/events", { projectId: z.string().min(1), decisionId: z.string().min(1) }, { capability: "governance.read", pagination: "cursor" }),
     approvals: resource("governance.approvals.list", "GET", "/v1/projects/{projectId}/approvals", { projectId: z.string().min(1) }, { capability: "governance.read", pagination: "cursor" }),
     approval: resource("governance.approvals.show", "GET", "/v1/projects/{projectId}/approvals/{approvalId}", { projectId: z.string().min(1), approvalId: z.string().min(1) }, { capability: "governance.read" }),
     decideApproval: resource("governance.approvals.decide", "POST", "/v1/projects/{projectId}/approvals/{approvalId}/decision", { projectId: z.string().min(1), approvalId: z.string().min(1) }, { capability: "governance.decide", scopes: ["treeseed:governance:write"], risk: "authority", concurrency: true })
   },
+  execution: EXECUTION_OPERATIONS,
+  research: {
+    createWorkflow: resource("research.workflows.create", "POST", "/v1/projects/{projectId}/research-workflows", { projectId: z.string().min(1) }, { capability: "research.write", scopes: ["treeseed:knowledge:write"], surfaces: ["rest", "mcp_tool"] }),
+    workflows: resource("research.workflows.list", "GET", "/v1/projects/{projectId}/research-workflows", { projectId: z.string().min(1) }, { capability: "research.read", surfaces: ["rest", "mcp_tool", "mcp_resource"], pagination: "cursor" }),
+    workflow: resource("research.workflows.show", "GET", "/v1/research-workflows/{workflowId}", { workflowId: z.string().min(1) }, { capability: "research.read", surfaces: ["rest", "mcp_resource"] }),
+    completeStage: resource("research.workflows.stages.complete", "POST", "/v1/research-workflows/{workflowId}/stages/{stage}/complete", { workflowId: z.string().min(1), stage: z.string().min(1) }, { capability: "research.write", scopes: ["treeseed:knowledge:write"], surfaces: ["rest", "mcp_tool"], concurrency: true })
+  },
   repositories: {
     githubSetup: resource("repositories.github.setup", "POST", "/v1/provider-connectors/github/{kind}/setup", { kind: z.string().min(1) }, { capability: "repositories.connect", scopes: ["treeseed:projects:write"], risk: "authority" }),
-    githubCallback: resource("repositories.github.callback", "GET", "/v1/provider-connectors/github/{kind}/callback", { kind: z.string().min(1) }, { capability: "repositories.connect", scopes: [] }),
-    githubWebhook: resource("repositories.github.webhook", "POST", "/v1/provider-webhooks/github/{kind}", { kind: z.string().min(1) }, { capability: "repositories.webhook", scopes: [], redactedPaths: ["body"] }),
+    githubCallback: resource("repositories.github.callback", "GET", "/v1/provider-connectors/github/{kind}/callback", { kind: z.string().min(1) }, { capability: "repositories.connect", scopes: [], authentication: "signed_request" }),
+    githubWebhook: resource("repositories.github.webhook", "POST", "/v1/provider-webhooks/github/{kind}", { kind: z.string().min(1) }, { capability: "repositories.webhook", scopes: [], authentication: "signed_request", redactedPaths: ["body"] }),
     workflowOperations: resource("repositories.workflows.list", "GET", "/v1/projects/{projectId}/workflow-operations", { projectId: z.string().min(1) }, { capability: "workflows.read", pagination: "cursor" }),
     workflowRuns: resource("repositories.workflow.runs.list", "GET", "/v1/projects/{projectId}/workflow-operation-runs", { projectId: z.string().min(1) }, { capability: "workflows.read", pagination: "cursor" }),
     updateWorkflow: resource("repositories.workflows.update", "PUT", "/v1/projects/{projectId}/workflow-operations/{operationId}", { projectId: z.string().min(1), operationId: z.string().min(1) }, { capability: "workflows.write", concurrency: true }),
@@ -236,42 +245,56 @@ const CONTROL_PLANE_OPERATIONS = {
     deleteWorkflowVariable: resource("repositories.workflow.variables.delete", "DELETE", "/v1/projects/{projectId}/workflow-configuration/variables/{name}", { projectId: z.string().min(1), name: z.string().min(1) }, { capability: "workflows.write", risk: "destructive", concurrency: true })
   },
   services: {
+    ...SECRET_OPERATIONS,
     providers: resource("services.providers.list", "GET", "/v1/service-providers", {}, { capability: "services.read", surfaces: ["rest", "cli", "mcp_tool"] }),
     connections: resource("services.connections.list", "GET", "/v1/teams/{teamId}/services", { teamId: z.string().min(1) }, { capability: "services.read", surfaces: ["rest", "cli", "mcp_tool"], pagination: "cursor" }),
     connection: resource("services.connections.show", "GET", "/v1/teams/{teamId}/services/{connectionId}", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "services.read", surfaces: ["rest", "cli", "mcp_resource"] }),
-    createConnection: resource("services.connections.create", "POST", "/v1/teams/{teamId}/services", { teamId: z.string().min(1) }, { capability: "services.write", surfaces: ["rest", "cli", "mcp_tool"] }),
+    createConnection: resource("services.connections.create", "POST", "/v1/teams/{teamId}/services", { teamId: z.string().min(1) }, { capability: "services.write", surfaces: ["rest", "cli", "mcp_tool"], risk: "credential" }),
     updateConnection: resource("services.connections.update", "PUT", "/v1/teams/{teamId}/services/{connectionId}", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "services.write", surfaces: ["rest", "cli", "mcp_tool"], concurrency: true }),
     disconnect: resource("services.connections.disconnect", "DELETE", "/v1/teams/{teamId}/services/{connectionId}", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "services.write", surfaces: ["rest", "cli", "mcp_tool"], risk: "destructive", concurrency: true }),
-    authorities: resource("services.credential.authorities.list", "GET", "/v1/teams/{teamId}/services/{connectionId}/credential-authorities", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "secrets.read", surfaces: ["rest", "cli"], pagination: "cursor" }),
-    putAuthority: resource("services.credential.authorities.put", "PUT", "/v1/teams/{teamId}/services/{connectionId}/credential-authorities/{profileId}", { teamId: z.string().min(1), connectionId: z.string().min(1), profileId: z.string().min(1) }, { capability: "secrets.write", surfaces: ["rest", "cli"], risk: "credential", concurrency: true, redactedPaths: ["body"] })
+    authorities: resource("services.credential.authorities.list", "GET", "/v1/teams/{teamId}/services/{connectionId}/credential-authorities", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "secrets.read", surfaces: ["rest", "cli"], pagination: "cursor" })
   },
   agents: {
+    teamClone: AGENT_TEAM_CLONE_OPERATIONS,
     list: resource("agents.list", "GET", "/v1/projects/{projectId}/agents", { projectId: z.string().min(1) }, { capability: "agents.read", surfaces: ["rest", "cli", "mcp_tool"], pagination: "cursor" }),
     show: resource("agents.show", "GET", "/v1/projects/{projectId}/agents/{agentSlug}", { projectId: z.string().min(1), agentSlug: z.string().min(1) }, { capability: "agents.read", surfaces: ["rest", "cli", "mcp_resource"] }),
+    handlers: resource("agents.handlers.list", "GET", "/v1/projects/{projectId}/agent-handlers", { projectId: z.string().min(1) }, { capability: "agents.read", surfaces: ["rest", "cli", "mcp_tool"] }),
+    handler: resource("agents.handlers.show", "GET", "/v1/projects/{projectId}/agent-handlers/{handlerId}", { projectId: z.string().min(1), handlerId: z.string().min(1) }, { capability: "agents.read", surfaces: ["rest", "cli", "mcp_resource"] }),
+    validateProfile: resource("agents.profiles.validate", "GET", "/v1/projects/{projectId}/agents/{agentSlug}/validation", { projectId: z.string().min(1), agentSlug: z.string().min(1) }, { capability: "agents.read", surfaces: ["rest", "cli", "mcp_tool"] }),
     classes: resource("agents.classes.list", "GET", "/v1/projects/{projectId}/agent-classes", { projectId: z.string().min(1) }, { capability: "agents.read", surfaces: ["rest", "cli"], pagination: "cursor" }),
     classShow: resource("agents.classes.show", "GET", "/v1/projects/{projectId}/agent-classes/{classId}", { projectId: z.string().min(1), classId: z.string().min(1) }, { capability: "agents.read", surfaces: ["rest", "cli"] }),
     artifacts: resource("agents.artifacts.list", "GET", "/v1/projects/{projectId}/agent-artifacts", { projectId: z.string().min(1) }, { capability: "agents.read", pagination: "cursor" }),
     artifact: resource("agents.artifacts.show", "GET", "/v1/projects/{projectId}/agent-artifacts/{artifactId}", { projectId: z.string().min(1), artifactId: z.string().min(1) }, { capability: "agents.read" })
   },
+  communications: {
+    ...communicationOperations(),
+    invocations: resource("communications.invocations.list", "GET", "/v1/teams/{teamId}/agent-invocations", { teamId: z.string().min(1) }, { capability: "agents.read", surfaces: ["rest", "mcp_tool", "mcp_resource"], pagination: "cursor" }),
+    invocation: resource("communications.invocations.show", "GET", "/v1/teams/{teamId}/agent-invocations/{invocationId}", { teamId: z.string().min(1), invocationId: z.string().min(1) }, { capability: "agents.read", surfaces: ["rest", "mcp_resource"] }),
+    status: resource("communications.status.show", "GET", "/v1/teams/{teamId}/communication-status", { teamId: z.string().min(1) }, { capability: "agents.read", surfaces: ["rest", "mcp_tool", "mcp_resource"] }),
+    handoffs: resource("communications.handoffs.list", "GET", "/v1/teams/{teamId}/operation-handoffs", { teamId: z.string().min(1) }, { capability: "agents.read", surfaces: ["rest", "mcp_resource"], pagination: "cursor" }),
+    clientActions: resource("communications.client.actions.list", "GET", "/v1/teams/{teamId}/client-actions", { teamId: z.string().min(1) }, { capability: "agents.read", surfaces: ["rest", "mcp_resource"], pagination: "cursor" }),
+    cancelInvocation: resource("communications.invocations.cancel", "POST", "/v1/teams/{teamId}/agent-invocations/{invocationId}/cancel", { teamId: z.string().min(1), invocationId: z.string().min(1) }, { capability: "agents.execute", scopes: ["treeseed:execution"], surfaces: ["rest", "mcp_tool"], risk: "destructive", concurrency: true })
+  },
   capacity: {
     availability: resource("capacity.status", "GET", "/v1/teams/{teamId}/capacity/availability-sessions", { teamId: z.string().min(1) }, { capability: "capacity.read", surfaces: ["rest", "cli", "mcp_tool"], pagination: "cursor" }),
+    explain: resource("capacity.explain", "GET", "/v1/teams/{teamId}/capacity/explanation", { teamId: z.string().min(1) }, { capability: "capacity.read", surfaces: ["rest", "cli", "mcp_tool"] }),
     usage: resource("capacity.usage", "GET", "/v1/teams/{teamId}/capacity/usage", { teamId: z.string().min(1) }, { capability: "capacity.read", surfaces: ["rest", "cli", "mcp_tool"] }),
     ledger: resource("capacity.ledger", "GET", "/v1/teams/{teamId}/capacity/ledger", { teamId: z.string().min(1) }, { capability: "capacity.read", surfaces: ["rest", "cli"], pagination: "cursor" }),
+    audit: resource("capacity.audit", "GET", "/v1/teams/{teamId}/capacity/audit", { teamId: z.string().min(1) }, { capability: "capacity.read", surfaces: ["rest", "cli"], pagination: "cursor" }),
+    lanes: resource("capacity.lanes.list", "GET", "/v1/teams/{teamId}/capacity/lanes", { teamId: z.string().min(1) }, { capability: "capacity.read", surfaces: ["rest", "mcp_tool"], pagination: "cursor" }),
     grants: resource("capacity.grants.list", "GET", "/v1/teams/{teamId}/capacity-grants", { teamId: z.string().min(1) }, { capability: "capacity.read", pagination: "cursor" }),
     grant: resource("capacity.grants.show", "GET", "/v1/teams/{teamId}/capacity-grants/{grantId}", { teamId: z.string().min(1), grantId: z.string().min(1) }, { capability: "capacity.read" })
   },
-  plans: {
-    list: resource("plans.list", "GET", "/v1/decisions/{decisionId}/capacity-plans", { decisionId: z.string().min(1) }, { capability: "plans.read", surfaces: ["rest", "cli", "mcp_tool"], pagination: "cursor" }),
-    show: resource("plans.show", "GET", "/v1/capacity-plans/{capacityPlanId}", { capacityPlanId: z.string().min(1) }, { capability: "plans.read", surfaces: ["rest", "cli", "mcp_resource"] })
-  },
   workdays: {
+    ...WORKDAY_PROFILE_OPERATIONS,
     list: resource("workdays.list", "GET", "/v1/teams/{teamId}/workday-runs", { teamId: z.string().min(1) }, { capability: "workdays.read", surfaces: ["rest", "cli", "mcp_tool"], pagination: "cursor" }),
     preflight: resource("workdays.plan", "POST", "/v1/teams/{teamId}/workday-runs/preflight", { teamId: z.string().min(1) }, { capability: "workdays.execute", scopes: ["treeseed:execution"], surfaces: ["rest", "cli", "mcp_tool"] }),
-    start: resource("workdays.start", "POST", "/v1/teams/{teamId}/workday-runs", { teamId: z.string().min(1) }, { capability: "workdays.execute", scopes: ["treeseed:execution"], surfaces: ["rest", "cli", "mcp_tool"] }),
+    start: resource("workdays.start", "POST", "/v1/teams/{teamId}/workday-runs", { teamId: z.string().min(1) }, { capability: "workdays.execute", scopes: ["treeseed:execution"], surfaces: ["rest", "cli", "mcp_tool"], risk: "authority" }),
     show: resource("workdays.show", "GET", "/v1/teams/{teamId}/workday-runs/{runId}", { teamId: z.string().min(1), runId: z.string().min(1) }, { capability: "workdays.read", surfaces: ["rest", "cli", "mcp_resource"] }),
+    stop: resource("workdays.stop", "POST", "/v1/teams/{teamId}/workday-runs/{runId}/stop", { teamId: z.string().min(1), runId: z.string().min(1) }, { capability: "workdays.execute", scopes: ["treeseed:execution"], surfaces: ["rest", "cli", "mcp_tool"], risk: "authority" }),
     events: resource("workdays.events.list", "GET", "/v1/teams/{teamId}/workday-runs/{runId}/events", { teamId: z.string().min(1), runId: z.string().min(1) }, { capability: "workdays.read", pagination: "cursor" }),
     schedules: resource("workdays.schedules.list", "GET", "/v1/teams/{teamId}/workday-schedules", { teamId: z.string().min(1) }, { capability: "workdays.read", surfaces: ["rest", "cli"], pagination: "cursor" }),
-    createSchedule: resource("workdays.schedules.create", "POST", "/v1/teams/{teamId}/workday-schedules", { teamId: z.string().min(1) }, { capability: "workdays.execute", scopes: ["treeseed:execution"], surfaces: ["rest", "cli"] }),
+    createSchedule: resource("workdays.schedules.create", "POST", "/v1/teams/{teamId}/workday-schedules", { teamId: z.string().min(1) }, { capability: "workdays.execute", scopes: ["treeseed:execution"], surfaces: ["rest", "cli"], risk: "authority" }),
     updateSchedule: resource("workdays.schedules.update", "PATCH", "/v1/teams/{teamId}/workday-schedules/{scheduleId}", { teamId: z.string().min(1), scheduleId: z.string().min(1) }, { capability: "workdays.execute", scopes: ["treeseed:execution"], surfaces: ["rest", "cli"], concurrency: true })
   },
   assignments: {
@@ -279,25 +302,29 @@ const CONTROL_PLANE_OPERATIONS = {
     show: resource("assignments.show", "GET", "/v1/teams/{teamId}/capacity/assignments/{assignmentId}", { teamId: z.string().min(1), assignmentId: z.string().min(1) }, { capability: "assignments.read", surfaces: ["rest", "cli", "mcp_resource"] }),
     explain: resource("assignments.explain", "GET", "/v1/teams/{teamId}/capacity/assignments/{assignmentId}/explanation", { teamId: z.string().min(1), assignmentId: z.string().min(1) }, { capability: "assignments.read", surfaces: ["rest", "cli", "mcp_tool"] }),
     cancel: resource("assignments.cancel", "POST", "/v1/teams/{teamId}/capacity/assignments/{assignmentId}/cancel", { teamId: z.string().min(1), assignmentId: z.string().min(1) }, { capability: "assignments.execute", scopes: ["treeseed:execution"], surfaces: ["rest", "cli", "mcp_tool"], risk: "destructive" }),
-    retry: resource("assignments.retry", "POST", "/v1/teams/{teamId}/capacity/assignments/{assignmentId}/requeue", { teamId: z.string().min(1), assignmentId: z.string().min(1) }, { capability: "assignments.execute", scopes: ["treeseed:execution"], surfaces: ["rest", "cli", "mcp_tool"] })
+    retry: resource("assignments.retry", "POST", "/v1/teams/{teamId}/capacity/assignments/{assignmentId}/requeue", { teamId: z.string().min(1), assignmentId: z.string().min(1) }, { capability: "assignments.execute", scopes: ["treeseed:execution"], surfaces: ["rest", "cli", "mcp_tool"], risk: "authority" })
   },
   operations: {
-    list: resource("operations.list", "GET", "/v1/platform/operations", {}, { capability: "operations.read", surfaces: ["rest", "mcp_tool"], pagination: "cursor" }),
+    list: resource("operations.list", "GET", "/v1/platform/operations", {}, { capability: "operations.read", surfaces: ["rest", "cli", "mcp_tool"], pagination: "cursor" }),
     create: resource("operations.create", "POST", "/v1/platform/operations", {}, { capability: "operations.execute", scopes: ["treeseed:execution"] }),
-    show: resource("operations.show", "GET", "/v1/platform/operations/{operationId}", { operationId: z.string().min(1) }, { capability: "operations.read", surfaces: ["rest", "mcp_resource"] }),
+    show: resource("operations.show", "GET", "/v1/platform/operations/{operationId}", { operationId: z.string().min(1) }, { capability: "operations.read", surfaces: ["rest", "cli", "mcp_resource"] }),
     events: resource("operations.events.list", "GET", "/v1/platform/operations/{operationId}/events", { operationId: z.string().min(1) }, { capability: "operations.read", pagination: "cursor" }),
     cancel: resource("operations.cancel", "POST", "/v1/platform/operations/{operationId}/cancel", { operationId: z.string().min(1) }, { capability: "operations.execute", scopes: ["treeseed:execution"], risk: "destructive" }),
-    retry: resource("operations.retry", "POST", "/v1/platform/operations/{operationId}/retry", { operationId: z.string().min(1) }, { capability: "operations.execute", scopes: ["treeseed:execution"] })
+    retry: resource("operations.retry", "POST", "/v1/platform/operations/{operationId}/retry", { operationId: z.string().min(1) }, { capability: "operations.execute", scopes: ["treeseed:execution"], surfaces: ["rest", "cli"] })
   },
   seeds: {
     runs: resource("seeds.runs.list", "GET", "/v1/seeds/runs", {}, { capability: "seeds.read", pagination: "cursor" }),
     run: resource("seeds.runs.show", "GET", "/v1/seeds/runs/{runId}", { runId: z.string().min(1) }, { capability: "seeds.read" }),
-    plan: resource("seeds.plan", "POST", "/v1/seeds/{name}/plan", { name: z.string().min(1) }, { capability: "seeds.write", scopes: ["treeseed:admin"] }),
-    apply: resource("seeds.apply", "POST", "/v1/seeds/{name}/apply", { name: z.string().min(1) }, { capability: "seeds.write", scopes: ["treeseed:admin"], risk: "authority" }),
+    validate: postRead("seeds.validate", "/v1/seeds/validate", {}, "seeds.read", ["treeseed:admin"], ["rest", "cli"]),
+    plan: postRead("seeds.plan", "/v1/seeds/{name}/plan", { name: z.string().min(1) }, "seeds.write", ["treeseed:admin"], ["rest", "cli"]),
+    apply: resource("seeds.apply", "POST", "/v1/seeds/{name}/apply", { name: z.string().min(1) }, { capability: "seeds.write", scopes: ["treeseed:admin"], surfaces: ["rest", "cli"], risk: "authority" }),
+    show: resource("seeds.show", "GET", "/v1/seeds/{name}", { name: z.string().min(1) }, { capability: "seeds.read", scopes: ["treeseed:admin"], surfaces: ["rest", "cli"] }),
+    verify: postRead("seeds.verify", "/v1/seeds/{name}/verify", { name: z.string().min(1) }, "seeds.read", ["treeseed:admin"], ["rest", "cli"]),
+    reconcile: resource("seeds.reconcile", "POST", "/v1/seeds/{name}/reconcile", { name: z.string().min(1) }, { capability: "seeds.write", scopes: ["treeseed:admin"], risk: "authority" }),
     resolveResources: resource("seeds.resources.resolve", "POST", "/v1/seeds/resources/resolve", {}, { capability: "seeds.read", scopes: ["treeseed:admin"] })
   },
   feedback: {
-    create: resource("feedback.create", "POST", "/v1/feedback", {}, { capability: "feedback.write", scopes: [], surfaces: ["rest", "mcp_tool"] }),
+    create: resource("feedback.create", "POST", "/v1/feedback", {}, { capability: "feedback.write", authentication: "oauth", scopes: [], surfaces: ["rest", "mcp_tool"] }),
     list: resource("feedback.list", "GET", "/v1/admin/feedback", {}, { capability: "feedback.admin", scopes: ["treeseed:admin"], pagination: "cursor" }),
     show: resource("feedback.show", "GET", "/v1/admin/feedback/{feedbackId}", { feedbackId: z.string().min(1) }, { capability: "feedback.admin", scopes: ["treeseed:admin"] }),
     updateStatus: resource("feedback.status.update", "PATCH", "/v1/admin/feedback/{feedbackId}/status", { feedbackId: z.string().min(1) }, { capability: "feedback.admin", scopes: ["treeseed:admin"], concurrency: true })
@@ -309,11 +336,126 @@ const CONTROL_PLANE_OPERATIONS = {
     actions: resource("realtime.actions.list", "GET", "/v1/client-sessions/{sessionId}/actions", { sessionId: z.string().min(1) }, { capability: "realtime.read", pagination: "cursor" }),
     actionResult: resource("realtime.actions.result", "POST", "/v1/client-sessions/{sessionId}/actions/{actionId}/result", { sessionId: z.string().min(1), actionId: z.string().min(1) }, { capability: "realtime.write" })
   },
+  treedx: {
+    library: resource("treedx.library.show", "GET", "/v1/projects/{projectId}/treedx-library", { projectId: z.string().min(1) }, { capability: "treedx.read", surfaces: ["rest", "cli", "mcp_resource"] }),
+    bindLibrary: resource("treedx.library.bind", "POST", "/v1/projects/{projectId}/treedx-library", { projectId: z.string().min(1) }, { capability: "treedx.write", surfaces: ["rest", "cli"] }),
+    serviceContract: treedxProxy("treedx.service.contract", null, "GET", "/v1/dx/projects/{projectId}/service-contract", { projectId: z.string().min(1) }, { surfaces: ["rest", "cli", "mcp_resource"] }),
+    health: treedxProxy("treedx.health.show", "getHealth", "GET", "/v1/dx/projects/{projectId}/health", { projectId: z.string().min(1) }, { surfaces: ["rest", "cli", "mcp_tool", "mcp_resource"] }),
+    readiness: treedxProxy("treedx.readiness.show", "getReadiness", "GET", "/v1/dx/projects/{projectId}/readiness", { projectId: z.string().min(1) }, { surfaces: ["rest", "cli", "mcp_resource"] }),
+    version: treedxProxy("treedx.version.show", "getVersion", "GET", "/v1/dx/projects/{projectId}/version", { projectId: z.string().min(1) }, { surfaces: ["rest", "cli", "mcp_resource"] }),
+    capabilities: treedxProxy("treedx.capabilities.list", "listCapabilities", "GET", "/v1/dx/projects/{projectId}/capabilities", { projectId: z.string().min(1) }, { surfaces: ["rest", "cli", "mcp_tool", "mcp_resource"] }),
+    effectiveScope: treedxProxy("treedx.scope.show", "getEffectiveScope", "GET", "/v1/dx/projects/{projectId}/effective-scope", { projectId: z.string().min(1) }, { surfaces: ["rest", "mcp_resource"] }),
+    repositories: {
+      list: treedxProxy("treedx.repositories.list", "listRepositories", "GET", "/v1/dx/projects/{projectId}/repos", { projectId: z.string().min(1) }, { pagination: "cursor" }),
+      create: treedxProxy("treedx.repositories.create", "createRepository", "POST", "/v1/dx/projects/{projectId}/repos", { projectId: z.string().min(1) }),
+      show: treedxProxy("treedx.repositories.show", "getRepository", "GET", "/v1/dx/projects/{projectId}/repos/{repoId}", { projectId: z.string().min(1), repoId: z.string().min(1) }),
+      retire: treedxProxy("treedx.repositories.retire", "retireRepository", "DELETE", "/v1/dx/projects/{projectId}/repos/{repoId}", { projectId: z.string().min(1), repoId: z.string().min(1) }, { risk: "destructive", surfaces: ["internal"] }),
+      status: treedxProxy("treedx.repositories.status", "getRepositoryStatus", "GET", "/v1/dx/projects/{projectId}/repos/{repoId}/status", { projectId: z.string().min(1), repoId: z.string().min(1) }),
+      refs: treedxProxy("treedx.repositories.refs", "listRepositoryRefs", "GET", "/v1/dx/projects/{projectId}/repos/{repoId}/refs", { projectId: z.string().min(1), repoId: z.string().min(1) }),
+      sync: treedxProxy("treedx.repositories.sync", "syncRepository", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/sync", { projectId: z.string().min(1), repoId: z.string().min(1) }),
+      push: treedxProxy("treedx.repositories.push", "pushRepository", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/push", { projectId: z.string().min(1), repoId: z.string().min(1) }, { risk: "authority" }),
+      promoteRef: treedxProxy("treedx.repositories.refs.promote", "promoteRepositoryRef", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/refs/promote", { projectId: z.string().min(1), repoId: z.string().min(1) }, { risk: "authority" }),
+      retireRef: treedxProxy("treedx.repositories.refs.retire", "retireRepositoryRef", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/refs/retire", { projectId: z.string().min(1), repoId: z.string().min(1) }, { risk: "destructive" }),
+      readFiles: treedxProxy("treedx.repositories.files.read", "readRepositoryFile", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/files/read", { projectId: z.string().min(1), repoId: z.string().min(1) }, { read: true }),
+      listPaths: treedxProxy("treedx.repositories.paths.list", "listRepositoryPaths", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/paths/list", { projectId: z.string().min(1), repoId: z.string().min(1) }, { read: true, pagination: "cursor" }),
+      searchFiles: treedxProxy("treedx.repositories.files.search", "searchRepositoryFiles", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/files/search", { projectId: z.string().min(1), repoId: z.string().min(1) }, { read: true, pagination: "cursor" }),
+      query: treedxProxy("treedx.repositories.query", "queryRepository", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/query", { projectId: z.string().min(1), repoId: z.string().min(1) }, { read: true })
+    },
+    workspaces: {
+      list: treedxProxy("treedx.workspaces.list", null, "GET", "/v1/dx/projects/{projectId}/workspaces", { projectId: z.string().min(1) }, { surfaces: ["rest", "cli", "mcp_tool", "mcp_resource"], pagination: "cursor" }),
+      create: treedxProxy("treedx.workspaces.create", "createWorkspace", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/workspaces", { projectId: z.string().min(1), repoId: z.string().min(1) }),
+      show: treedxProxy("treedx.workspaces.show", "getWorkspace", "GET", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}", { projectId: z.string().min(1), workspaceId: z.string().min(1) }, { surfaces: ["rest", "cli", "mcp_tool", "mcp_resource"] }),
+      status: treedxProxy("treedx.workspaces.status", "getWorkspaceStatus", "GET", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/status", { projectId: z.string().min(1), workspaceId: z.string().min(1) }),
+      diff: treedxProxy("treedx.workspaces.diff", "getWorkspaceDiff", "GET", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/diff", { projectId: z.string().min(1), workspaceId: z.string().min(1) }),
+      tree: treedxProxy("treedx.workspaces.tree", "listWorkspaceTree", "GET", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/tree", { projectId: z.string().min(1), workspaceId: z.string().min(1) }),
+      close: treedxProxy("treedx.workspaces.close", "closeWorkspace", "POST", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/close", { projectId: z.string().min(1), workspaceId: z.string().min(1) }),
+      abandon: treedxProxy("treedx.workspaces.abandon", "abandonWorkspace", "POST", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/abandon", { projectId: z.string().min(1), workspaceId: z.string().min(1) }, { risk: "destructive", surfaces: ["rest", "cli", "mcp_tool"] })
+    },
+    files: {
+      read: treedxProxy("treedx.workspaces.files.read", "readWorkspaceFile", "GET", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/files", { projectId: z.string().min(1), workspaceId: z.string().min(1) }),
+      write: treedxProxy("treedx.workspaces.files.write", "writeWorkspaceFile", "PUT", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/files", { projectId: z.string().min(1), workspaceId: z.string().min(1) }),
+      writeBatch: treedxProxy("treedx.workspaces.files.batch", "writeWorkspaceFiles", "PUT", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/files/batch", { projectId: z.string().min(1), workspaceId: z.string().min(1) }),
+      patch: treedxProxy("treedx.workspaces.files.patch", "patchWorkspaceFile", "PATCH", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/files", { projectId: z.string().min(1), workspaceId: z.string().min(1) }),
+      remove: treedxProxy("treedx.workspaces.files.delete", "deleteWorkspaceFile", "DELETE", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/files", { projectId: z.string().min(1), workspaceId: z.string().min(1) }, { risk: "destructive" }),
+      search: treedxProxy("treedx.workspaces.files.search", "searchWorkspace", "POST", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/search", { projectId: z.string().min(1), workspaceId: z.string().min(1) }, { read: true, pagination: "cursor" }),
+      applyChangeset: treedxProxy("treedx.workspaces.changesets.apply", "applyWorkspaceChangeset", "POST", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/changesets", { projectId: z.string().min(1), workspaceId: z.string().min(1) }),
+      commit: treedxProxy("treedx.workspaces.commit", "commitWorkspace", "POST", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/commit", { projectId: z.string().min(1), workspaceId: z.string().min(1) })
+    },
+    blobs: {
+      read: treedxProxy("treedx.repositories.blobs.read", "readRepositoryBlob", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/blobs/read", { projectId: z.string().min(1), repoId: z.string().min(1) }, { read: true }),
+      write: treedxProxy("treedx.workspaces.blobs.write", "writeWorkspaceBlob", "POST", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/blobs/write", { projectId: z.string().min(1), workspaceId: z.string().min(1) }),
+      remove: treedxProxy("treedx.workspaces.blobs.delete", "deleteWorkspaceBlob", "POST", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/blobs/delete", { projectId: z.string().min(1), workspaceId: z.string().min(1) }, { risk: "destructive" }),
+      download: treedxProxy("treedx.workspaces.blobs.download", "downloadWorkspaceBlob", "GET", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/blobs/download", { projectId: z.string().min(1), workspaceId: z.string().min(1) }, { surfaces: ["rest", "mcp_tool"] }),
+      upload: treedxProxy("treedx.workspaces.blobs.upload", "uploadWorkspaceBlob", "PUT", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/blobs/upload", { projectId: z.string().min(1), workspaceId: z.string().min(1) }),
+      createUpload: treedxProxy("treedx.workspaces.blobs.uploads.create", "createWorkspaceBlobUpload", "POST", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/blobs/uploads", { projectId: z.string().min(1), workspaceId: z.string().min(1) }),
+      uploadPart: treedxProxy("treedx.workspaces.blobs.uploads.parts.write", "uploadWorkspaceBlobPart", "PUT", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/blobs/uploads/{uploadId}/parts/{partNumber}", { projectId: z.string().min(1), workspaceId: z.string().min(1), uploadId: z.string().min(1), partNumber: z.string().min(1) }),
+      completeUpload: treedxProxy("treedx.workspaces.blobs.uploads.complete", "completeWorkspaceBlobUpload", "POST", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/blobs/uploads/{uploadId}/complete", { projectId: z.string().min(1), workspaceId: z.string().min(1), uploadId: z.string().min(1) }),
+      abortUpload: treedxProxy("treedx.workspaces.blobs.uploads.abort", "abortWorkspaceBlobUpload", "DELETE", "/v1/dx/projects/{projectId}/workspaces/{workspaceId}/blobs/uploads/{uploadId}", { projectId: z.string().min(1), workspaceId: z.string().min(1), uploadId: z.string().min(1) }, { risk: "destructive" })
+    },
+    graph: {
+      refresh: treedxProxy("treedx.repositories.graph.refresh", "refreshRepositoryGraph", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/graph/refresh", { projectId: z.string().min(1), repoId: z.string().min(1) }),
+      refreshJob: treedxProxy("treedx.repositories.graph.jobs.show", "getGraphRefreshJob", "GET", "/v1/dx/projects/{projectId}/repos/{repoId}/graph/jobs/{jobId}", { projectId: z.string().min(1), repoId: z.string().min(1), jobId: z.string().min(1) }),
+      query: treedxProxy("treedx.repositories.graph.query", "queryRepositoryGraph", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/graph/query", { projectId: z.string().min(1), repoId: z.string().min(1) }, { read: true }),
+      node: treedxProxy("treedx.repositories.graph.nodes.show", "getGraphNode", "GET", "/v1/dx/projects/{projectId}/repos/{repoId}/graph/nodes/{nodeId}", { projectId: z.string().min(1), repoId: z.string().min(1), nodeId: z.string().min(1) }),
+      related: treedxProxy("treedx.repositories.graph.related", "getRelatedGraphNodes", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/graph/related", { projectId: z.string().min(1), repoId: z.string().min(1) }, { read: true }),
+      subgraph: treedxProxy("treedx.repositories.graph.subgraph", "getGraphSubgraph", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/graph/subgraph", { projectId: z.string().min(1), repoId: z.string().min(1) }, { read: true }),
+      searchFiles: treedxProxy("treedx.repositories.graph.files.search", "searchGraphFiles", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/graph/search/files", { projectId: z.string().min(1), repoId: z.string().min(1) }, { read: true }),
+      searchSections: treedxProxy("treedx.repositories.graph.sections.search", "searchGraphSections", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/graph/search/sections", { projectId: z.string().min(1), repoId: z.string().min(1) }, { read: true }),
+      searchEntities: treedxProxy("treedx.repositories.graph.entities.search", "searchGraphEntities", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/graph/search/entities", { projectId: z.string().min(1), repoId: z.string().min(1) }, { read: true })
+    },
+    context: {
+      build: treedxProxy("treedx.repositories.context.build", "buildContext", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/context/build", { projectId: z.string().min(1), repoId: z.string().min(1) }, { read: true }),
+      parse: treedxProxy("treedx.repositories.context.parse", "parseContextQuery", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/context/parse", { projectId: z.string().min(1), repoId: z.string().min(1) }, { read: true })
+    },
+    federated: {
+      search: treedxProxy("treedx.federated.search", "federatedSearch", "POST", "/v1/dx/projects/{projectId}/search", { projectId: z.string().min(1) }, { read: true, pagination: "cursor" }),
+      query: treedxProxy("treedx.federated.query", "federatedQuery", "POST", "/v1/dx/projects/{projectId}/query", { projectId: z.string().min(1) }, { read: true }),
+      context: treedxProxy("treedx.federated.context", "federatedContextBuild", "POST", "/v1/dx/projects/{projectId}/context", { projectId: z.string().min(1) }, { read: true }),
+      graph: treedxProxy("treedx.federated.graph", "federatedGraphQuery", "POST", "/v1/dx/projects/{projectId}/graph", { projectId: z.string().min(1) }, { read: true })
+    },
+    snapshots: {
+      build: treedxProxy("treedx.repositories.snapshots.build", "buildSnapshot", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/snapshots", { projectId: z.string().min(1), repoId: z.string().min(1) }),
+      show: treedxProxy("treedx.repositories.snapshots.show", "getSnapshot", "GET", "/v1/dx/projects/{projectId}/repos/{repoId}/snapshots/{snapshotId}", { projectId: z.string().min(1), repoId: z.string().min(1), snapshotId: z.string().min(1) })
+    },
+    artifacts: {
+      export: treedxProxy("treedx.repositories.artifacts.export", "exportArtifact", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/artifacts", { projectId: z.string().min(1), repoId: z.string().min(1) }),
+      list: treedxProxy("treedx.repositories.artifacts.list", "listArtifacts", "GET", "/v1/dx/projects/{projectId}/repos/{repoId}/artifacts", { projectId: z.string().min(1), repoId: z.string().min(1) }, { pagination: "cursor" }),
+      show: treedxProxy("treedx.repositories.artifacts.show", "getArtifact", "GET", "/v1/dx/projects/{projectId}/repos/{repoId}/artifacts/{artifactId}", { projectId: z.string().min(1), repoId: z.string().min(1), artifactId: z.string().min(1) }),
+      remove: treedxProxy("treedx.repositories.artifacts.delete", "deleteArtifact", "DELETE", "/v1/dx/projects/{projectId}/repos/{repoId}/artifacts/{artifactId}", { projectId: z.string().min(1), repoId: z.string().min(1), artifactId: z.string().min(1) }, { risk: "destructive" })
+    },
+    searchIndex: {
+      status: treedxProxy("treedx.repositories.search.index.status", "getSearchIndexStatus", "GET", "/v1/dx/projects/{projectId}/repos/{repoId}/search-index", { projectId: z.string().min(1), repoId: z.string().min(1) }),
+      refresh: treedxProxy("treedx.repositories.search.index.refresh", "refreshSearchIndex", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/search-index/refresh", { projectId: z.string().min(1), repoId: z.string().min(1) })
+    }
+  },
   providers: {
-    register: noPathProvider("providers.register", "POST", "/v1/provider-registrations", { redactedPaths: ["body.registrationKey"] }),
-    registration: providerPath("providers.registration.show", "GET", "/v1/provider-registrations/{requestId}", { requestId: z.string().min(1) }, { read: true }),
-    exchangeCredential: providerPath("providers.registration.credential", "POST", "/v1/provider-registrations/{requestId}/credential", { requestId: z.string().min(1) }, { redactedPaths: ["body.proof"] }),
-    issueAccessToken: noPathProvider("providers.token.issue", "POST", "/v1/provider/access-tokens", { redactedPaths: ["body.credential", "body.proof"] }),
+    capabilityProposal: noPathProvider("providers.capabilities.propose", "POST", "/v1/provider/capability-proposals"),
+    capabilityProposalStatus: providerPath("providers.capabilities.proposal.show", "GET", "/v1/provider/capability-proposals/{proposalId}", { proposalId: z.string().min(1) }, { read: true }),
+    list: resource("providers.list", "GET", "/v1/teams/{teamId}/capacity-providers", { teamId: z.string().min(1) }, { capability: "providers.read", surfaces: ["rest", "cli", "mcp_tool"], pagination: "cursor" }),
+    show: resource("providers.show", "GET", "/v1/teams/{teamId}/capacity-providers/{providerId}", { teamId: z.string().min(1), providerId: z.string().min(1) }, { capability: "providers.read", surfaces: ["rest", "cli", "mcp_resource"] }),
+    status: resource("providers.status", "GET", "/v1/teams/{teamId}/capacity-providers/{providerId}/status", { teamId: z.string().min(1), providerId: z.string().min(1) }, { capability: "providers.read", surfaces: ["rest", "cli", "mcp_tool"] }),
+    diagnose: resource("providers.diagnose", "GET", "/v1/teams/{teamId}/capacity-providers/{providerId}/diagnosis", { teamId: z.string().min(1), providerId: z.string().min(1) }, { capability: "providers.read", surfaces: ["rest", "cli", "mcp_tool"] }),
+    offers: resource("providers.offers.show", "GET", "/v1/teams/{teamId}/capacity-providers/{providerId}/offers", { teamId: z.string().min(1), providerId: z.string().min(1) }, { capability: "providers.read", surfaces: ["rest", "cli", "mcp_resource"] }),
+    connect: resource("providers.connect", "POST", "/v1/teams/{teamId}/capacity-provider-connections", { teamId: z.string().min(1) }, { capability: "providers.write", scopes: ["treeseed:admin"], surfaces: ["rest", "cli"], risk: "credential", redactedPaths: ["body.enrollmentToken"] }),
+    registrationCode: PROVIDER_ENVIRONMENT_OPERATIONS.registrationCode,
+    disconnect: resource("providers.disconnect", "POST", "/v1/teams/{teamId}/capacity-provider-connections/{connectionId}/disconnect", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "providers.write", scopes: ["treeseed:admin"], surfaces: ["rest", "cli"], risk: "destructive" }),
+    requests: {
+      list: resource("providers.requests.list", "GET", "/v1/teams/{teamId}/capacity-provider-requests", { teamId: z.string().min(1) }, { capability: "providers.read", surfaces: ["rest", "cli"], pagination: "cursor" }),
+      show: resource("providers.requests.show", "GET", "/v1/teams/{teamId}/capacity-provider-requests/{requestId}", { teamId: z.string().min(1), requestId: z.string().min(1) }, { capability: "providers.read", surfaces: ["rest", "cli"] }),
+      approve: resource("providers.requests.approve", "POST", "/v1/teams/{teamId}/capacity-provider-requests/{requestId}/approve", { teamId: z.string().min(1), requestId: z.string().min(1) }, { capability: "providers.write", scopes: ["treeseed:admin"], surfaces: ["rest", "cli"], risk: "authority" }),
+      reject: resource("providers.requests.reject", "POST", "/v1/teams/{teamId}/capacity-provider-requests/{requestId}/reject", { teamId: z.string().min(1), requestId: z.string().min(1) }, { capability: "providers.write", scopes: ["treeseed:admin"], surfaces: ["rest", "cli"], risk: "authority" })
+    },
+    credentials: {
+      status: resource("providers.credentials.status", "GET", "/v1/teams/{teamId}/capacity-provider-connections/{connectionId}/credentials", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "providers.read", surfaces: ["rest", "cli"] }),
+      rotate: resource("providers.credentials.rotate", "POST", "/v1/teams/{teamId}/capacity-provider-connections/{connectionId}/credentials/rotate", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "providers.write", scopes: ["treeseed:admin"], surfaces: ["rest", "cli"], risk: "credential" }),
+      revoke: resource("providers.credentials.revoke", "POST", "/v1/teams/{teamId}/capacity-provider-connections/{connectionId}/credentials/revoke", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "providers.write", scopes: ["treeseed:admin"], surfaces: ["rest", "cli"], risk: "irreversible" })
+    },
+    environmentProfiles: PROVIDER_ENVIRONMENT_OPERATIONS.environmentProfiles,
+    environmentGrants: PROVIDER_ENVIRONMENT_OPERATIONS.environmentGrants,
+    register: noPathProvider("providers.register", "POST", "/v1/provider-registrations", { authentication: "signed_request", redactedPaths: ["body.registrationKey"] }),
+    registration: providerPath("providers.registration.show", "GET", "/v1/provider-registrations/{requestId}", { requestId: z.string().min(1) }, { authentication: "signed_request", read: true }),
+    exchangeCredential: providerPath("providers.registration.credential", "POST", "/v1/provider-registrations/{requestId}/credential", { requestId: z.string().min(1) }, { authentication: "signed_request", redactedPaths: ["body.proof"] }),
+    issueAccessToken: noPathProvider("providers.token.issue", "POST", "/v1/provider/access-tokens", { authentication: "signed_request", redactedPaths: ["body.credential", "body.proof"] }),
     leaveMembership: noPathProvider("providers.membership.leave", "POST", "/v1/provider/membership/leave"),
     rotateIdentity: noPathProvider("providers.identity.rotate", "POST", "/v1/provider/identity/rotate", { redactedPaths: ["body.oldProof", "body.newProof"] }),
     rotateCredential: noPathProvider("providers.credential.rotate", "POST", "/v1/provider/credential-rotation"),
@@ -323,10 +465,13 @@ const CONTROL_PLANE_OPERATIONS = {
     nextAssignment: noPathProvider("providers.assignments.next", "POST", "/v1/provider/assignments/next"),
     assignment: providerPath("providers.assignments.show", "GET", "/v1/provider/assignments/{assignmentId}", { assignmentId: z.string().min(1) }, { read: true }),
     assignmentExplanation: providerPath("providers.assignments.explain", "GET", "/v1/provider/assignments/{assignmentId}/explanation", { assignmentId: z.string().min(1) }, { read: true }),
+    sourceWorkspace: providerPath("providers.assignments.source.authorize", "POST", "/v1/provider/assignments/{assignmentId}/source-workspace", { assignmentId: z.string().min(1) }, { redactedPaths: ["body.leaseToken", "output.credential.ciphertext"] }),
     renewAssignment: providerPath("providers.assignments.renew", "POST", "/v1/provider/assignments/{assignmentId}/renew", { assignmentId: z.string().min(1) }),
     startExecution: providerPath("providers.assignments.execution.start", "POST", "/v1/provider/assignments/{assignmentId}/execution-start", { assignmentId: z.string().min(1) }),
     startCloseout: providerPath("providers.assignments.closeout.start", "POST", "/v1/provider/assignments/{assignmentId}/closeout-start", { assignmentId: z.string().min(1) }),
     completionPreflight: providerPath("providers.assignments.completion.preflight", "POST", "/v1/provider/assignments/{assignmentId}/completion-preflight", { assignmentId: z.string().min(1) }),
+    discussionResponse: providerDiscussionResponseOperation(),
+    ...providerCommunicationLifecycleOperations(),
     returnAssignment: providerPath("providers.assignments.return", "POST", "/v1/provider/assignments/{assignmentId}/return", { assignmentId: z.string().min(1) }),
     completeAssignment: providerPath("providers.assignments.complete", "POST", "/v1/provider/assignments/{assignmentId}/complete", { assignmentId: z.string().min(1) }),
     failAssignment: providerPath("providers.assignments.fail", "POST", "/v1/provider/assignments/{assignmentId}/fail", { assignmentId: z.string().min(1) }),
@@ -339,16 +484,8 @@ const CONTROL_PLANE_OPERATIONS = {
     workflowRun: providerPath("providers.assignments.workflow.show", "GET", "/v1/provider/assignments/{assignmentId}/workflow-runs/{runId}", { assignmentId: z.string().min(1), runId: z.string().min(1) }, { read: true })
   }
 };
-function flatten(value, output = []) {
-  if (value && typeof value === "object" && "descriptor" in value && "schema" in value) output.push(value);
-  else if (value && typeof value === "object") for (const child of Object.values(value)) flatten(child, output);
-  return output;
-}
-const CONTROL_PLANE_OPERATION_LIST = Object.freeze(flatten(CONTROL_PLANE_OPERATIONS));
-const CONTROL_PLANE_CATALOG = Object.freeze({
-  schemaVersion: "treeseed.control-plane-catalog/v1",
-  operations: CONTROL_PLANE_OPERATION_LIST.map((operation) => operation.descriptor)
-});
+const CONTROL_PLANE_OPERATION_LIST = Object.freeze(flattenControlPlaneOperations(CONTROL_PLANE_OPERATIONS));
+const CONTROL_PLANE_CATALOG = buildControlPlaneCatalog(CONTROL_PLANE_OPERATION_LIST);
 function controlPlaneOperation(operationId) {
   const operation = CONTROL_PLANE_OPERATION_LIST.find((candidate) => candidate.descriptor.operationId === operationId);
   if (!operation) throw new Error(`Unknown control-plane operation ${operationId}.`);