@treeseed/sdk 0.13.0-rc.12 → 0.13.0-rc.121

package/dist/agent-capacity/contracts/operations/workflow-promotion.d.ts

@@ -1,24 +0,0 @@
-import type { EngineeringAssignmentGraphRoles } from '../support/decision-work.js';
-export interface EngineeringWorkflowPromotionConfigV1 {
-    schemaVersion: 1;
-    id: string;
-    projectId: string;
-    decisionId: string;
-    objectiveId: string;
-    exactBaseRef: string;
-    roles: EngineeringAssignmentGraphRoles;
-    includeResearch?: boolean;
-    includeArchitecture?: boolean;
-    requireLinkedProposal?: boolean;
-    requireRevisionCycle?: boolean;
-    seconds?: Partial<Record<'research' | 'architecture' | 'test' | 'implementation' | 'verification' | 'review' | 'documentation' | 'release' | 'operations', number>>;
-    metadata?: Record<string, unknown>;
-}
-export interface EngineeringWorkflowPromotionValidation {
-    ok: boolean;
-    diagnostics: Array<{
-        code: string;
-        path: string;
-        message: string;
-    }>;
-}

package/dist/agent-capacity/policy/capacity/allocations/allocation-hierarchy.d.ts

@@ -1,29 +0,0 @@
-import type { CapacityAdmissionCounterClaim, CapacityAdmissionReasonCode, CapacityAllocationSetV2 } from '../../../allocation.js';
-interface AllocationHierarchyInput {
-    allocation: CapacityAllocationSetV2;
-    workdayId: string;
-    totalSeconds: number;
-    requestedSeconds: number;
-    selectedSliceIds: string[];
-    committedBySlice: Record<string, number>;
-    committedBorrowedByRule?: Record<string, number>;
-    reserveCommittedSeconds?: number;
-    approvedBorrowingRuleIds?: string[];
-}
-export interface AllocationHierarchyDecision {
-    reasons: CapacityAdmissionReasonCode[];
-    explanation: Array<{
-        gate: string;
-        allowed: boolean;
-        remaining?: number;
-        detail?: string;
-    }>;
-    counterClaims: CapacityAdmissionCounterClaim[];
-    maxReservableSeconds: number;
-    requiresApproval: boolean;
-    calculations: Record<string, unknown>;
-    priorityBand: 'minimum' | 'target' | 'normal' | 'overflow';
-    priorityScore: number;
-}
-export declare function evaluateAllocationHierarchy(input: AllocationHierarchyInput): AllocationHierarchyDecision;
-export {};

package/dist/agent-capacity/policy/capacity/allocations/allocation-hierarchy.js

@@ -1,110 +0,0 @@
-function sliceLimits(allocation, totalSeconds, slice, cache = /* @__PURE__ */ new Map()) {
-  const cached = cache.get(slice.id);
-  if (cached) return cached;
-  const parent = slice.parentSliceId ? allocation.slices.find((candidate) => candidate.id === slice.parentSliceId) : null;
-  const basis = parent ? sliceLimits(allocation, totalSeconds, parent, cache).target : totalSeconds;
-  const limits = {
-    min: basis * slice.policy.minPercent / 100,
-    target: basis * slice.policy.targetPercent / 100,
-    max: basis * slice.policy.maxPercent / 100,
-    hard: basis * slice.policy.hardCapPercent / 100
-  };
-  cache.set(slice.id, limits);
-  return limits;
-}
-function claim(id, scope, scopeId, periodKey, hardLimit, amount) {
-  return amount > 0 ? { id, scope, scopeId, periodKey, hardLimit, amount, release: "settlement-difference" } : null;
-}
-function evaluateAllocationHierarchy(input) {
-  const reasons = [];
-  const explanation = [];
-  const counterClaims = [];
-  const calculations = {};
-  const approved = new Set(input.approvedBorrowingRuleIds ?? []);
-  const cache = /* @__PURE__ */ new Map();
-  let remaining = Number.POSITIVE_INFINITY;
-  let requiresApproval = false;
-  let priorityScore = 4;
-  for (const sliceId of input.selectedSliceIds) {
-    const slice = input.allocation.slices.find((candidate) => candidate.id === sliceId);
-    if (!slice) {
-      reasons.push("allocation_slice_missing");
-      explanation.push({ gate: `allocation:${sliceId}`, allowed: false, detail: "selected slice does not exist" });
-      continue;
-    }
-    const limits = sliceLimits(input.allocation, input.totalSeconds, slice, cache);
-    const committed = input.committedBySlice[sliceId] ?? 0;
-    const normalAvailable = Math.max(0, limits.max - committed);
-    const overflowAvailable = Math.max(0, limits.hard - Math.max(committed, limits.max));
-    let available = normalAvailable;
-    let overflowSource = "none";
-    let overflowRuleId = null;
-    let overflowSourceAvailable = 0;
-    if (overflowAvailable > 0) {
-      const rule = input.allocation.borrowingRules.find((candidate) => candidate.toSliceId === sliceId);
-      if (rule) {
-        const donor = input.allocation.slices.find((candidate) => candidate.id === rule.fromSliceId);
-        if (donor) {
-          const donorLimits = sliceLimits(input.allocation, input.totalSeconds, donor, cache);
-          const donorCommitted = input.committedBySlice[donor.id] ?? 0;
-          const donorAvailable = Math.max(0, donorLimits.target - Math.max(donorCommitted, donorLimits.min));
-          const ruleLimit = donorLimits.target * rule.maxPercent / 100;
-          const ruleAvailable = Math.max(0, ruleLimit - (input.committedBorrowedByRule?.[rule.id] ?? 0));
-          overflowSource = "borrowing-rule";
-          overflowRuleId = rule.id;
-          overflowSourceAvailable = Math.min(donorAvailable, ruleAvailable);
-        }
-      } else if (!slice.parentSliceId) {
-        overflowSource = "reserve";
-        overflowSourceAvailable = Math.max(0, input.totalSeconds * input.allocation.reservePolicy.percent / 100 - (input.reserveCommittedSeconds ?? 0));
-      }
-    }
-    const usableOverflow = Math.min(overflowAvailable, overflowSourceAvailable);
-    if (input.allocation.reservePolicy.overflow === "borrow") available += usableOverflow;
-    else if (input.requestedSeconds > normalAvailable && input.allocation.reservePolicy.overflow === "approval-required") {
-      requiresApproval = true;
-      reasons.push("allocation_borrowing_approval_required");
-    }
-    if (overflowRuleId) {
-      const rule = input.allocation.borrowingRules.find((candidate) => candidate.id === overflowRuleId);
-      if (rule.requiresApproval && !approved.has(rule.id) && input.requestedSeconds > normalAvailable) {
-        requiresApproval = true;
-        reasons.push("allocation_borrowing_approval_required");
-        available = normalAvailable;
-      }
-    }
-    if (input.requestedSeconds > available && !reasons.includes("allocation_borrowing_approval_required")) {
-      reasons.push(input.allocation.reservePolicy.overflow === "deny" ? "allocation_borrowing_denied" : "allocation_hard_cap_exhausted");
-    }
-    remaining = Math.min(remaining, available);
-    const ownAmount = Math.min(input.requestedSeconds, normalAvailable);
-    const overflowAmount = Math.max(0, input.requestedSeconds - ownAmount);
-    const ownClaim = claim(`allocation-slice:${input.allocation.id}:${slice.id}:${input.workdayId}`, "allocation-slice", `${input.allocation.id}:${slice.id}`, input.workdayId, limits.max, ownAmount);
-    if (ownClaim) counterClaims.push(ownClaim);
-    if (overflowAmount > 0 && overflowAmount <= usableOverflow && input.allocation.reservePolicy.overflow === "borrow") {
-      const overflowClaim = claim(`allocation-overflow:${input.allocation.id}:${slice.id}:${input.workdayId}`, "allocation-overflow", `${input.allocation.id}:${slice.id}`, input.workdayId, Math.max(0, limits.hard - limits.max), overflowAmount);
-      if (overflowClaim) counterClaims.push(overflowClaim);
-      if (overflowSource === "reserve") {
-        const reserveClaim = claim(`allocation-reserve:${input.allocation.id}:${input.workdayId}`, "allocation-reserve", input.allocation.id, input.workdayId, input.totalSeconds * input.allocation.reservePolicy.percent / 100, overflowAmount);
-        if (reserveClaim) counterClaims.push(reserveClaim);
-      } else if (overflowRuleId) {
-        const rule = input.allocation.borrowingRules.find((candidate) => candidate.id === overflowRuleId);
-        const donor = input.allocation.slices.find((candidate) => candidate.id === rule.fromSliceId);
-        const donorLimits = sliceLimits(input.allocation, input.totalSeconds, donor, cache);
-        const donorClaim = claim(`allocation-slice:${input.allocation.id}:${donor.id}:${input.workdayId}`, "allocation-slice", `${input.allocation.id}:${donor.id}`, input.workdayId, donorLimits.target, overflowAmount);
-        const ruleClaim = claim(`allocation-borrow:${input.allocation.id}:${rule.id}:${input.workdayId}`, "allocation-borrow", `${input.allocation.id}:${rule.id}`, input.workdayId, donorLimits.target * rule.maxPercent / 100, overflowAmount);
-        if (donorClaim) counterClaims.push(donorClaim);
-        if (ruleClaim) counterClaims.push(ruleClaim);
-      }
-    }
-    const position = committed < limits.min ? "below-minimum" : committed < limits.target ? "below-target" : committed < limits.max ? "above-target" : "overflow";
-    priorityScore = Math.min(priorityScore, position === "below-minimum" ? 4 : position === "below-target" ? 3 : position === "above-target" ? 2 : 1);
-    calculations[sliceId] = { committed, ...limits, normalAvailable, overflowAvailable, overflowSource, overflowSourceAvailable, usableOverflow, position };
-    explanation.push({ gate: `allocation:${sliceId}`, allowed: input.requestedSeconds <= available, remaining: available, detail: JSON.stringify(calculations[sliceId]) });
-  }
-  const priorityBand = priorityScore === 4 ? "minimum" : priorityScore === 3 ? "target" : priorityScore === 2 ? "normal" : "overflow";
-  return { reasons: [...new Set(reasons)], explanation, counterClaims, maxReservableSeconds: Number.isFinite(remaining) ? Math.max(0, remaining) : 0, requiresApproval, calculations, priorityBand, priorityScore };
-}
-export {
-  evaluateAllocationHierarchy
-};

package/dist/agent-capacity/validation/workflow-promotion.d.ts

@@ -1,2 +0,0 @@
-import type { EngineeringWorkflowPromotionValidation } from '../contracts/operations/workflow-promotion.js';
-export declare function validateEngineeringWorkflowPromotionConfig(value: unknown): EngineeringWorkflowPromotionValidation;

package/dist/agent-capacity/validation/workflow-promotion.js

@@ -1,34 +0,0 @@
-const REQUIRED_ROLES = ["tester", "engineer", "reviewer", "technicalWriter", "releaser"];
-function text(value) {
-  return typeof value === "string" && value.trim() ? value.trim() : null;
-}
-function validateEngineeringWorkflowPromotionConfig(value) {
-  const diagnostics = [];
-  const input = value && typeof value === "object" && !Array.isArray(value) ? value : {};
-  if (input.schemaVersion !== 1) diagnostics.push({ code: "schema_version_invalid", path: "schemaVersion", message: "schemaVersion must be 1." });
-  for (const field of ["id", "projectId", "decisionId", "objectiveId", "exactBaseRef"]) {
-    if (!text(input[field])) diagnostics.push({ code: "field_required", path: field, message: `${field} is required.` });
-  }
-  if (text(input.exactBaseRef) && !/^[0-9a-f]{7,64}$/iu.test(input.exactBaseRef)) {
-    diagnostics.push({ code: "exact_base_ref_invalid", path: "exactBaseRef", message: "exactBaseRef must be an immutable hexadecimal commit id." });
-  }
-  const roles = input.roles && typeof input.roles === "object" ? input.roles : {};
-  for (const role of REQUIRED_ROLES) {
-    if (!text(roles[role])) diagnostics.push({ code: "role_required", path: `roles.${role}`, message: `${role} role is required.` });
-  }
-  for (const optional of ["operations", "researcher", "architect"]) {
-    if (roles[optional] != null && !text(roles[optional])) diagnostics.push({ code: "role_invalid", path: `roles.${optional}`, message: `${optional} must be a non-empty string when supplied.` });
-  }
-  if (input.includeResearch === true && !text(roles.researcher)) diagnostics.push({ code: "researcher_role_required", path: "roles.researcher", message: "includeResearch requires a researcher role." });
-  if (input.includeArchitecture === true && !text(roles.architect)) diagnostics.push({ code: "architect_role_required", path: "roles.architect", message: "includeArchitecture requires an architect role." });
-  if (input.requireRevisionCycle != null && typeof input.requireRevisionCycle !== "boolean") {
-    diagnostics.push({ code: "revision_cycle_invalid", path: "requireRevisionCycle", message: "requireRevisionCycle must be boolean when supplied." });
-  }
-  for (const [stage, amount] of Object.entries(input.seconds ?? {})) {
-    if (!Number.isFinite(amount) || Number(amount) <= 0) diagnostics.push({ code: "time_invalid", path: `seconds.${stage}`, message: "Stage agent time must be positive finite seconds." });
-  }
-  return { ok: diagnostics.length === 0, diagnostics };
-}
-export {
-  validateEngineeringWorkflowPromotionConfig
-};

package/dist/operator-contracts/workday-profile.d.ts

@@ -1,72 +0,0 @@
-export type WorkdayDemandSourcePolicy = 'approved-decisions' | 'planning-inputs' | 'questions' | 'proposals' | 'knowledge-gaps' | 'reliability-campaigns';
-export interface WorkdayClassAllocation {
-    classSlug: string;
-    minimumPercent: number;
-    targetPercent: number;
-    maximumPercent: number;
-    mayLend: boolean;
-    mayBorrow: boolean;
-}
-export interface WorkdayAllocationProfile {
-    schemaVersion: 'treeseed.workday-allocation-profile/v1';
-    id: string;
-    version: string;
-    projects: 'all' | string[];
-    excludedClassSlugs?: Record<string, string[]>;
-    classes: WorkdayClassAllocation[];
-    demandSources: WorkdayDemandSourcePolicy[];
-    actingDecisionRequired: true;
-    defaultDurationSeconds: number;
-    maxConcurrency: number;
-    reservePercent: number;
-    prioritization: {
-        strategy: 'priority-then-age' | 'age-then-priority' | 'weighted-fair';
-        starvationLimitSeconds: number;
-    };
-}
-export interface RepositoryWorkdayProfileBundle {
-    schemaVersion: 'treeseed.workday-allocation-profile-bundle/v1';
-    profiles: WorkdayAllocationProfile[];
-}
-export interface ProjectAgentClassMembership {
-    projectId: string;
-    agentId: string;
-    classSlug: string;
-    status: 'active' | 'paused' | 'archived';
-}
-export interface ProjectAgentIdentity {
-    projectId: string;
-    agentId: string;
-}
-export interface ProjectClassCatalog {
-    projectId: string;
-    classSlugs: string[];
-}
-export interface WorkdayProfileDiagnostic {
-    code: string;
-    path: string;
-    message: string;
-}
-export interface WorkdayBorrowingEvidence {
-    workdayId: string;
-    borrowerClassSlug: string;
-    lenderClassSlug: string;
-    borrowedSeconds: number;
-    lendingPermitted: boolean;
-    borrowingPermitted: boolean;
-    lenderAllocatedSecondsBefore: number;
-    lenderAllocatedSecondsAfter: number;
-    lenderMinimumSeconds: number;
-    borrowerAllocatedSecondsBefore: number;
-    borrowerAllocatedSecondsAfter: number;
-    borrowerMaximumSeconds: number;
-    profileId: string;
-    profileVersion: string;
-    profileDigest: string;
-}
-export declare function validateOneClassPerProjectAgent(memberships: ProjectAgentClassMembership[], expectedAgents?: ProjectAgentIdentity[]): WorkdayProfileDiagnostic[];
-export declare function validateWorkdayAllocationProfile(profile: WorkdayAllocationProfile, classCatalogs?: ProjectClassCatalog[]): WorkdayProfileDiagnostic[];
-export declare function normalizeWorkdayAllocationProfile(profile: WorkdayAllocationProfile): WorkdayAllocationProfile;
-export declare function validateRepositoryWorkdayProfileBundle(bundle: RepositoryWorkdayProfileBundle, classCatalogs?: ProjectClassCatalog[]): WorkdayProfileDiagnostic[];
-export declare function normalizeRepositoryWorkdayProfileBundle(bundle: RepositoryWorkdayProfileBundle): RepositoryWorkdayProfileBundle;
-export declare function validateWorkdayBorrowingEvidence(evidence: WorkdayBorrowingEvidence): WorkdayProfileDiagnostic[];

package/dist/operator-contracts/workday-profile.js

@@ -1,106 +0,0 @@
-const PERCENT_TOLERANCE = 1e-6;
-const PROFILE_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
-function validateOneClassPerProjectAgent(memberships, expectedAgents = []) {
-  const diagnostics = [];
-  const byAgent = /* @__PURE__ */ new Map();
-  for (const membership of memberships) {
-    const key = `${membership.projectId}:${membership.agentId}`;
-    byAgent.set(key, [...byAgent.get(key) ?? [], membership]);
-  }
-  for (const [key, values] of byAgent) {
-    if (values.length !== 1) diagnostics.push({ code: "agent_class_membership_multiple", path: `memberships.${key}`, message: "Each project agent must have exactly one allocation-class membership." });
-    if (values.some((value) => value.status !== "active")) diagnostics.push({ code: "agent_class_membership_inactive", path: `memberships.${key}`, message: "The single allocation-class membership must be active." });
-  }
-  for (const agent of expectedAgents) {
-    const key = `${agent.projectId}:${agent.agentId}`;
-    if (!byAgent.has(key)) diagnostics.push({ code: "agent_class_membership_missing", path: `memberships.${key}`, message: "Each project agent must have exactly one allocation-class membership." });
-  }
-  return diagnostics;
-}
-function validateWorkdayAllocationProfile(profile, classCatalogs) {
-  const diagnostics = [];
-  if (profile.schemaVersion !== "treeseed.workday-allocation-profile/v1") diagnostics.push({ code: "schema_version_invalid", path: "schemaVersion", message: "Unsupported workday allocation profile schema." });
-  if (!profile.id.trim()) diagnostics.push({ code: "profile_id_required", path: "id", message: "Profile id is required." });
-  if (!PROFILE_VERSION.test(profile.version)) diagnostics.push({ code: "profile_version_invalid", path: "version", message: "Profile version must be a semantic version." });
-  if (profile.actingDecisionRequired !== true) diagnostics.push({ code: "acting_decision_requirement_invalid", path: "actingDecisionRequired", message: "Acting work must require an approved decision." });
-  if (profile.projects !== "all" && profile.projects.length === 0) diagnostics.push({ code: "project_scope_empty", path: "projects", message: "Profile project scope must select at least one project or all." });
-  if (profile.demandSources.length === 0) diagnostics.push({ code: "demand_sources_empty", path: "demandSources", message: "At least one governed demand source is required." });
-  if (new Set(profile.demandSources).size !== profile.demandSources.length) diagnostics.push({ code: "demand_source_duplicate", path: "demandSources", message: "Demand sources must be unique." });
-  if (!Number.isInteger(profile.defaultDurationSeconds) || profile.defaultDurationSeconds <= 0) diagnostics.push({ code: "duration_invalid", path: "defaultDurationSeconds", message: "Default duration must be a positive integer number of seconds." });
-  if (!Number.isInteger(profile.maxConcurrency) || profile.maxConcurrency <= 0) diagnostics.push({ code: "concurrency_invalid", path: "maxConcurrency", message: "Maximum concurrency must be a positive integer." });
-  if (!Number.isFinite(profile.reservePercent) || profile.reservePercent < 0 || profile.reservePercent > 100) diagnostics.push({ code: "reserve_invalid", path: "reservePercent", message: "Reserve percent must be between 0 and 100." });
-  if (!Number.isFinite(profile.prioritization.starvationLimitSeconds) || profile.prioritization.starvationLimitSeconds <= 0) diagnostics.push({ code: "starvation_limit_invalid", path: "prioritization.starvationLimitSeconds", message: "Starvation limit must be positive." });
-  const classSlugs = /* @__PURE__ */ new Set();
-  let minimumTotal = 0;
-  let targetTotal = 0;
-  let maximumTotal = 0;
-  for (const [index, allocation] of profile.classes.entries()) {
-    const path = `classes.${index}`;
-    if (!allocation.classSlug.trim()) diagnostics.push({ code: "class_slug_required", path: `${path}.classSlug`, message: "Class slug is required." });
-    if (classSlugs.has(allocation.classSlug)) diagnostics.push({ code: "class_slug_duplicate", path: `${path}.classSlug`, message: `Class ${allocation.classSlug} is declared more than once.` });
-    classSlugs.add(allocation.classSlug);
-    const values = [allocation.minimumPercent, allocation.targetPercent, allocation.maximumPercent];
-    if (values.some((value) => !Number.isFinite(value) || value < 0 || value > 100) || allocation.minimumPercent > allocation.targetPercent || allocation.targetPercent > allocation.maximumPercent) diagnostics.push({ code: "class_allocation_invalid", path, message: "Class allocation must satisfy 0 <= minimum <= target <= maximum <= 100." });
-    minimumTotal += allocation.minimumPercent;
-    targetTotal += allocation.targetPercent;
-    maximumTotal += allocation.maximumPercent;
-  }
-  if (minimumTotal > 100 + PERCENT_TOLERANCE) diagnostics.push({ code: "minimum_total_invalid", path: "classes", message: "Class minimum percentages cannot total more than 100." });
-  if (Math.abs(targetTotal - 100) > PERCENT_TOLERANCE) diagnostics.push({ code: "target_total_invalid", path: "classes", message: "Class target percentages must total exactly 100." });
-  if (maximumTotal < 100 - PERCENT_TOLERANCE) diagnostics.push({ code: "maximum_total_invalid", path: "classes", message: "Class maximum percentages must total at least 100." });
-  const selectedProjects = classCatalogs === void 0 ? [] : profile.projects === "all" ? classCatalogs.map((catalog) => catalog.projectId) : profile.projects;
-  for (const projectId of selectedProjects) {
-    const catalog = classCatalogs?.find((candidate) => candidate.projectId === projectId);
-    if (!catalog) {
-      diagnostics.push({ code: "project_class_catalog_missing", path: `projects.${projectId}`, message: `No class catalog exists for selected project ${projectId}.` });
-      continue;
-    }
-    const exclusions = new Set(profile.excludedClassSlugs?.[projectId] ?? []);
-    for (const classSlug of classSlugs) {
-      if (!catalog.classSlugs.includes(classSlug) && !exclusions.has(classSlug)) diagnostics.push({ code: "class_missing_from_project", path: `projects.${projectId}.${classSlug}`, message: `Class ${classSlug} is missing from project ${projectId} and is not explicitly excluded.` });
-    }
-  }
-  return diagnostics;
-}
-function normalizeWorkdayAllocationProfile(profile) {
-  return {
-    ...profile,
-    projects: profile.projects === "all" ? "all" : [...new Set(profile.projects)].sort(),
-    excludedClassSlugs: profile.excludedClassSlugs ? Object.fromEntries(Object.entries(profile.excludedClassSlugs).sort(([left], [right]) => left.localeCompare(right)).map(([projectId, slugs]) => [projectId, [...new Set(slugs)].sort()])) : void 0,
-    classes: [...profile.classes].sort((left, right) => left.classSlug.localeCompare(right.classSlug)),
-    demandSources: [...new Set(profile.demandSources)].sort()
-  };
-}
-function validateRepositoryWorkdayProfileBundle(bundle, classCatalogs) {
-  const diagnostics = [];
-  if (bundle.schemaVersion !== "treeseed.workday-allocation-profile-bundle/v1") diagnostics.push({ code: "bundle_schema_version_invalid", path: "schemaVersion", message: "Unsupported repository workday profile bundle schema." });
-  if (!Array.isArray(bundle.profiles) || bundle.profiles.length === 0) diagnostics.push({ code: "bundle_profiles_empty", path: "profiles", message: "A repository workday profile bundle must contain at least one profile." });
-  const profileIds = /* @__PURE__ */ new Set();
-  for (const [index, profile] of (Array.isArray(bundle.profiles) ? bundle.profiles : []).entries()) {
-    if (profileIds.has(profile.id)) diagnostics.push({ code: "bundle_profile_id_duplicate", path: `profiles.${index}.id`, message: `Stable profile id ${profile.id} is declared more than once; a repository bundle contains exactly one current generation per profile.` });
-    profileIds.add(profile.id);
-    diagnostics.push(...validateWorkdayAllocationProfile(profile, classCatalogs).map((diagnostic) => ({ ...diagnostic, path: `profiles.${index}.${diagnostic.path}` })));
-  }
-  return diagnostics;
-}
-function normalizeRepositoryWorkdayProfileBundle(bundle) {
-  return { schemaVersion: "treeseed.workday-allocation-profile-bundle/v1", profiles: [...bundle.profiles].map(normalizeWorkdayAllocationProfile).sort((left, right) => left.id.localeCompare(right.id) || left.version.localeCompare(right.version)) };
-}
-function validateWorkdayBorrowingEvidence(evidence) {
-  const diagnostics = [];
-  if (!evidence.lendingPermitted) diagnostics.push({ code: "lending_not_permitted", path: "lendingPermitted", message: "The profile does not permit the lender to lend capacity." });
-  if (!evidence.borrowingPermitted) diagnostics.push({ code: "borrowing_not_permitted", path: "borrowingPermitted", message: "The profile does not permit the borrower to borrow capacity." });
-  if (evidence.borrowedSeconds <= 0) diagnostics.push({ code: "borrowed_seconds_invalid", path: "borrowedSeconds", message: "Borrowed seconds must be positive." });
-  if (evidence.lenderAllocatedSecondsAfter < evidence.lenderMinimumSeconds) diagnostics.push({ code: "lender_minimum_violated", path: "lenderAllocatedSecondsAfter", message: "Borrowing cannot reduce the lender below its minimum." });
-  if (evidence.borrowerAllocatedSecondsAfter > evidence.borrowerMaximumSeconds) diagnostics.push({ code: "borrower_maximum_violated", path: "borrowerAllocatedSecondsAfter", message: "Borrowing cannot raise the borrower above its maximum." });
-  if (evidence.lenderAllocatedSecondsBefore - evidence.lenderAllocatedSecondsAfter !== evidence.borrowedSeconds || evidence.borrowerAllocatedSecondsAfter - evidence.borrowerAllocatedSecondsBefore !== evidence.borrowedSeconds) diagnostics.push({ code: "borrowing_accounting_mismatch", path: "borrowedSeconds", message: "Lender and borrower deltas must exactly equal the borrowed seconds." });
-  return diagnostics;
-}
-export {
-  normalizeRepositoryWorkdayProfileBundle,
-  normalizeWorkdayAllocationProfile,
-  validateOneClassPerProjectAgent,
-  validateRepositoryWorkdayProfileBundle,
-  validateWorkdayAllocationProfile,
-  validateWorkdayBorrowingEvidence
-};

package/dist/secrets-capability/service-vault-contracts.d.ts

@@ -1,61 +0,0 @@
-export declare const SERVICE_VAULT_ENCRYPTION_VERSION: "service-vault-v1";
-export declare const SERVICE_VAULT_AEAD_ALGORITHM: "xchacha20-poly1305-ietf";
-export declare const SERVICE_VAULT_KEY_AGREEMENT: "x25519-sealed-box";
-export declare const SERVICE_VAULT_KDF: "argon2id";
-export type EncryptedCredentialEnvelope = {
-    version: typeof SERVICE_VAULT_ENCRYPTION_VERSION;
-    algorithm: typeof SERVICE_VAULT_AEAD_ALGORITHM;
-    ciphertext: string;
-    nonce: string;
-    wrappedKey: string;
-    wrappedKeyNonce: string;
-    associatedData: string;
-    associatedDataDigest: string;
-    fingerprint: string;
-};
-export type EncryptedPrivateKeyEnvelope = {
-    version: typeof SERVICE_VAULT_ENCRYPTION_VERSION;
-    algorithm: typeof SERVICE_VAULT_AEAD_ALGORITHM;
-    kdf: {
-        algorithm: typeof SERVICE_VAULT_KDF;
-        opsLimit: number;
-        memLimit: number;
-        salt: string;
-    };
-    nonce: string;
-    ciphertext: string;
-    publicKey: string;
-};
-export type TeamVaultGrantEnvelope = {
-    version: typeof SERVICE_VAULT_ENCRYPTION_VERSION;
-    algorithm: typeof SERVICE_VAULT_KEY_AGREEMENT;
-    recipientPublicKey: string;
-    wrappedTeamVaultKey: string;
-};
-export type SecretOperationLease = {
-    id: string;
-    teamId: string;
-    connectionId: string;
-    capabilityType: string;
-    purpose: 'provider-connection-validation' | 'remote-git-publication' | 'workflow-dispatch' | 'workflow-configuration';
-    resourceScope: Record<string, string>;
-    credentialProfileId: string;
-    actorUserId: string;
-    requiredFields: string[];
-    publicKey: string;
-    status: 'awaiting-runner' | 'pending' | 'ready' | 'consumed' | 'expired' | 'cancelled' | 'failed';
-    expiresAt: string;
-    consumedAt?: string | null;
-    operationCorrelationId: string;
-};
-export type ServiceVaultAssociatedData = {
-    teamId: string;
-    connectionId: string;
-    credentialProfileId: string;
-    field: string;
-    purpose: string;
-    version: number;
-};
-export declare function containsForbiddenPlaintextSecretMaterial(value: unknown, path?: string): string[];
-export declare function canonicalServiceVaultAssociatedData(input: ServiceVaultAssociatedData): string;
-export declare function validateEncryptedCredentialEnvelope(value: unknown): value is EncryptedCredentialEnvelope;

package/dist/secrets-capability/service-vault-contracts.js

@@ -1,39 +0,0 @@
-const SERVICE_VAULT_ENCRYPTION_VERSION = "service-vault-v1";
-const SERVICE_VAULT_AEAD_ALGORITHM = "xchacha20-poly1305-ietf";
-const SERVICE_VAULT_KEY_AGREEMENT = "x25519-sealed-box";
-const SERVICE_VAULT_KDF = "argon2id";
-const FORBIDDEN_SECRET_KEYS = /(?:passphrase|password|plaintext|derivedKey|privateKey|apiToken|accessToken|secretValue|credentialValue)$/iu;
-function containsForbiddenPlaintextSecretMaterial(value, path = "") {
-  if (!value || typeof value !== "object") return [];
-  const failures = [];
-  for (const [key, entry] of Object.entries(value)) {
-    const nextPath = path ? `${path}.${key}` : key;
-    if (FORBIDDEN_SECRET_KEYS.test(key) && typeof entry === "string" && entry.trim()) failures.push(nextPath);
-    if (entry && typeof entry === "object") failures.push(...containsForbiddenPlaintextSecretMaterial(entry, nextPath));
-  }
-  return failures;
-}
-function canonicalServiceVaultAssociatedData(input) {
-  return JSON.stringify({
-    teamId: input.teamId,
-    connectionId: input.connectionId,
-    credentialProfileId: input.credentialProfileId,
-    field: input.field,
-    purpose: input.purpose,
-    version: input.version
-  });
-}
-function validateEncryptedCredentialEnvelope(value) {
-  if (!value || typeof value !== "object") return false;
-  const envelope = value;
-  return envelope.version === SERVICE_VAULT_ENCRYPTION_VERSION && envelope.algorithm === SERVICE_VAULT_AEAD_ALGORITHM && [envelope.ciphertext, envelope.nonce, envelope.wrappedKey, envelope.wrappedKeyNonce, envelope.associatedData, envelope.associatedDataDigest, envelope.fingerprint].every((field) => typeof field === "string" && field.length > 0);
-}
-export {
-  SERVICE_VAULT_AEAD_ALGORITHM,
-  SERVICE_VAULT_ENCRYPTION_VERSION,
-  SERVICE_VAULT_KDF,
-  SERVICE_VAULT_KEY_AGREEMENT,
-  canonicalServiceVaultAssociatedData,
-  containsForbiddenPlaintextSecretMaterial,
-  validateEncryptedCredentialEnvelope
-};

package/dist/treedx/accounts/auth.d.ts

@@ -1,17 +0,0 @@
-export interface TreeDxHs256TokenInput {
-    secret: string;
-    issuer: string;
-    audience: string;
-    actorId: string;
-    tenantId: string;
-    repoIds?: string[];
-    capabilities?: string[];
-    refs?: string[];
-    paths?: string[];
-    projectId?: string;
-    capacityWorkdayRunId?: string;
-    ttlSeconds?: number;
-    nowEpochSeconds?: number;
-    jti?: string;
-}
-export declare function mintTreeDxHs256Token(input: TreeDxHs256TokenInput): string;

package/dist/treedx/accounts/auth.js

@@ -1,48 +0,0 @@
-import { createHmac, randomUUID } from "node:crypto";
-function required(value, owner) {
-  const normalized = value.trim();
-  if (!normalized) throw new Error(`${owner} is required to mint a TreeDX token.`);
-  return normalized;
-}
-function normalizedStrings(values, fallback) {
-  const normalized = values?.map((value) => String(value).trim()).filter(Boolean) ?? [];
-  return normalized.length > 0 ? [...new Set(normalized)] : fallback;
-}
-function base64urlJson(value) {
-  return Buffer.from(JSON.stringify(value)).toString("base64url");
-}
-function mintTreeDxHs256Token(input) {
-  const secret = required(input.secret, "secret");
-  const issuer = required(input.issuer, "issuer");
-  const audience = required(input.audience, "audience");
-  const actorId = required(input.actorId, "actorId");
-  const tenantId = required(input.tenantId, "tenantId");
-  const ttlSeconds = input.ttlSeconds ?? 300;
-  if (!Number.isInteger(ttlSeconds) || ttlSeconds < 30 || ttlSeconds > 3600) {
-    throw new Error("ttlSeconds must be an integer between 30 and 3600.");
-  }
-  const now = input.nowEpochSeconds ?? Math.floor(Date.now() / 1e3);
-  if (!Number.isInteger(now) || now < 0) throw new Error("nowEpochSeconds must be a nonnegative integer.");
-  const payload = {
-    iss: issuer,
-    aud: audience,
-    sub: actorId,
-    jti: input.jti?.trim() || randomUUID(),
-    iat: now,
-    nbf: now - 5,
-    exp: now + ttlSeconds,
-    treedx_actor_id: actorId,
-    treedx_tenant_id: tenantId,
-    treedx_repo_ids: normalizedStrings(input.repoIds, ["*"]),
-    treedx_capabilities: normalizedStrings(input.capabilities, []),
-    treedx_refs: normalizedStrings(input.refs, ["*"]),
-    treedx_paths: normalizedStrings(input.paths, ["**"]),
-    ...input.projectId?.trim() ? { treeseed_project_id: input.projectId.trim() } : {},
-    ...input.capacityWorkdayRunId?.trim() ? { treeseed_capacity_workday_run_id: input.capacityWorkdayRunId.trim() } : {}
-  };
-  const signingInput = `${base64urlJson({ alg: "HS256", typ: "JWT" })}.${base64urlJson(payload)}`;
-  return `${signingInput}.${createHmac("sha256", secret).update(signingInput).digest("base64url")}`;
-}
-export {
-  mintTreeDxHs256Token
-};

package/dist/treedx/client/accounts/contracts/auth-mode.d.ts

@@ -1,3 +0,0 @@
-import { TreeDxClient } from "../../../support/client.js";
-import type { TreeDxAuthMode } from "../../../types.js";
-export declare function authModeMethod(this: TreeDxClient): Promise<TreeDxAuthMode>;

package/dist/treedx/client/accounts/contracts/auth-mode.js

@@ -1,6 +0,0 @@
-function authModeMethod() {
-  return this.request("GET", "/api/v1/auth/mode");
-}
-export {
-  authModeMethod
-};

package/dist/treedx/client/build/creation/build-context.d.ts

@@ -1,3 +0,0 @@
-import { TreeDxClient } from '../../../support/client.js';
-import type { TreeDxContextRequest, TreeDxContextResult } from '../../../types.js';
-export declare function buildContextMethod(this: TreeDxClient, input: TreeDxContextRequest): Promise<TreeDxContextResult>;

package/dist/treedx/client/build/creation/build-context.js

@@ -1,7 +0,0 @@
-function buildContextMethod(input) {
-  const { repoId, ...body } = input;
-  return this.request("POST", `/api/v1/repos/${encodeURIComponent(this.repoId(repoId))}/context/build`, body, { tokenRequired: true });
-}
-export {
-  buildContextMethod
-};

package/dist/treedx/client/build/creation/build-snapshot.d.ts

@@ -1,3 +0,0 @@
-import { TreeDxClient } from '../../../support/client.js';
-import type { TreeDxSnapshot, TreeDxSnapshotBuildRequest } from '../../../types.js';
-export declare function buildSnapshotMethod(this: TreeDxClient, input?: TreeDxSnapshotBuildRequest): Promise<TreeDxSnapshot>;

package/dist/treedx/client/build/creation/build-snapshot.js

@@ -1,8 +0,0 @@
-import { firstPayload } from "../../../support/client.js";
-function buildSnapshotMethod(input = {}) {
-  const { repoId, ...body } = input;
-  return this.request("POST", `/api/v1/repos/${encodeURIComponent(this.repoId(repoId))}/snapshots/build`, body, { tokenRequired: true }).then((payload) => firstPayload(payload, ["snapshot"]));
-}
-export {
-  buildSnapshotMethod
-};

package/dist/treedx/client/capacity/allocations/contracts/put-capability-grant.d.ts

@@ -1,3 +0,0 @@
-import { TreeDxClient } from "../../../../support/client.js";
-import type { TreeDxCapabilityGrant } from "../../../../types.js";
-export declare function putCapabilityGrantMethod(this: TreeDxClient, input: TreeDxCapabilityGrant): Promise<TreeDxCapabilityGrant>;

package/dist/treedx/client/capacity/allocations/contracts/put-capability-grant.js

@@ -1,7 +0,0 @@
-import { firstPayload } from "../../../../support/client.js";
-function putCapabilityGrantMethod(input) {
-  return this.request("POST", "/api/v1/policy/grants", input, { tokenRequired: true }).then((payload) => firstPayload(payload, ["grant"]));
-}
-export {
-  putCapabilityGrantMethod
-};

package/dist/treedx/client/capacity/allocations/queries/list-capability-grants.d.ts

@@ -1,6 +0,0 @@
-import { TreeDxClient } from "../../../../support/client.js";
-import type { TreeDxCapabilityGrant } from "../../../../types.js";
-export declare function listCapabilityGrantsMethod(this: TreeDxClient, input?: {
-    actorId?: string;
-    repoId?: string;
-}): Promise<TreeDxCapabilityGrant[]>;

package/dist/treedx/client/capacity/allocations/queries/list-capability-grants.js

@@ -1,10 +0,0 @@
-import { firstPayload } from "../../../../support/client.js";
-function listCapabilityGrantsMethod(input = {}) {
-  return this.request("GET", "/api/v1/policy/grants", void 0, {
-    query: input,
-    tokenRequired: true
-  }).then((payload) => firstPayload(payload, ["grants"]));
-}
-export {
-  listCapabilityGrantsMethod
-};