@treeseed/sdk 0.13.0-rc.19 → 0.13.0-rc.20

package/dist/content/validation/portable-content-data.d.ts

@@ -132,18 +132,18 @@ export declare function validatePortableContentData(model: string, value: unknow
                 mergeTargetBeforeSave: import("zod").ZodOptional<import("zod").ZodBoolean>;
             }, "strict", import("zod").ZodTypeAny, {
                 kind: "read-only" | "main-planning-content" | "staging-content" | "assignment-feature" | "staging-release";
-                base: "main" | "staging";
+                base: "staging" | "main";
                 prefix?: string | undefined;
-                target?: "main" | "staging" | undefined;
+                target?: "staging" | "main" | undefined;
                 branchNameTemplate?: string | undefined;
                 worktree?: string | undefined;
                 updateBaseBeforeRun?: boolean | undefined;
                 mergeTargetBeforeSave?: boolean | undefined;
             }, {
                 kind: "read-only" | "main-planning-content" | "staging-content" | "assignment-feature" | "staging-release";
-                base: "main" | "staging";
+                base: "staging" | "main";
                 prefix?: string | undefined;
-                target?: "main" | "staging" | undefined;
+                target?: "staging" | "main" | undefined;
                 branchNameTemplate?: string | undefined;
                 worktree?: string | undefined;
                 updateBaseBeforeRun?: boolean | undefined;
@@ -858,9 +858,9 @@ export declare function validatePortableContentData(model: string, value: unknow
             };
             branchPolicy: {
                 kind: "read-only" | "main-planning-content" | "staging-content" | "assignment-feature" | "staging-release";
-                base: "main" | "staging";
+                base: "staging" | "main";
                 prefix?: string | undefined;
-                target?: "main" | "staging" | undefined;
+                target?: "staging" | "main" | undefined;
                 branchNameTemplate?: string | undefined;
                 worktree?: string | undefined;
                 updateBaseBeforeRun?: boolean | undefined;
@@ -1031,9 +1031,9 @@ export declare function validatePortableContentData(model: string, value: unknow
             };
             branchPolicy: {
                 kind: "read-only" | "main-planning-content" | "staging-content" | "assignment-feature" | "staging-release";
-                base: "main" | "staging";
+                base: "staging" | "main";
                 prefix?: string | undefined;
-                target?: "main" | "staging" | undefined;
+                target?: "staging" | "main" | undefined;
                 branchNameTemplate?: string | undefined;
                 worktree?: string | undefined;
                 updateBaseBeforeRun?: boolean | undefined;
@@ -1204,9 +1204,9 @@ export declare function validatePortableContentData(model: string, value: unknow
             };
             branchPolicy: {
                 kind: "read-only" | "main-planning-content" | "staging-content" | "assignment-feature" | "staging-release";
-                base: "main" | "staging";
+                base: "staging" | "main";
                 prefix?: string | undefined;
-                target?: "main" | "staging" | undefined;
+                target?: "staging" | "main" | undefined;
                 branchNameTemplate?: string | undefined;
                 worktree?: string | undefined;
                 updateBaseBeforeRun?: boolean | undefined;
@@ -1377,9 +1377,9 @@ export declare function validatePortableContentData(model: string, value: unknow
             };
             branchPolicy: {
                 kind: "read-only" | "main-planning-content" | "staging-content" | "assignment-feature" | "staging-release";
-                base: "main" | "staging";
+                base: "staging" | "main";
                 prefix?: string | undefined;
-                target?: "main" | "staging" | undefined;
+                target?: "staging" | "main" | undefined;
                 branchNameTemplate?: string | undefined;
                 worktree?: string | undefined;
                 updateBaseBeforeRun?: boolean | undefined;
@@ -1652,9 +1652,9 @@ export declare function validatePortableContentData(model: string, value: unknow
             supportsReconcile: boolean;
         };
         offer: {
-            priceModel: "subscription" | "free" | "private" | "contact" | "one_time" | "one_time_current_version" | "subscription_updates" | "professional_hosting" | "scoped_contract" | "external";
-            license?: string | undefined;
+            priceModel: "private" | "subscription" | "free" | "contact" | "one_time" | "one_time_current_version" | "subscription_updates" | "professional_hosting" | "scoped_contract" | "external";
             support?: string | undefined;
+            license?: string | undefined;
         };
         relatedBooks: string[];
         relatedKnowledge: string[];
@@ -1682,11 +1682,11 @@ export declare function validatePortableContentData(model: string, value: unknow
         } & {
             [k: string]: unknown;
         };
+        fixture?: string | undefined;
         budget?: {
             maxTokens: number;
             maxContextItems: number;
         } | undefined;
-        fixture?: string | undefined;
         queryRef?: {
             id: string;
             revision: number;
@@ -1796,7 +1796,7 @@ export declare function validatePortableContentData(model: string, value: unknow
         } | undefined;
     } | {
         id: string;
-        status: "completed" | "cancelled" | "failed" | "pending" | "running" | "waiting" | "suspended" | "admitted" | "leased";
+        status: "completed" | "cancelled" | "failed" | "admitted" | "running" | "suspended" | "pending" | "waiting" | "leased";
         projectId: string;
         teamId: string;
         title: string;
@@ -1894,7 +1894,7 @@ export declare function validatePortableContentData(model: string, value: unknow
         date?: Date | undefined;
         draft?: boolean | undefined;
         author?: string | undefined;
-        feedback_kind?: "question" | "support" | "concern" | "response" | undefined;
+        feedback_kind?: "support" | "question" | "concern" | "response" | undefined;
         entity_refs?: {
             id: string;
             model: string;

package/dist/operator-contracts/canonical-command-tree.js

@@ -21,15 +21,29 @@ const operationBindings = {
   "agents show": operation("agents.show", [field("path", "projectId", "context", "project", true), field("path", "agentSlug", "argument", "agent", true)]),
   "agents classes list": operation("agents.classes.list", [field("path", "projectId", "context", "project", true)]),
   "agents classes show": operation("agents.classes.show", [field("path", "projectId", "context", "project", true), field("path", "classId", "argument", "class", true)]),
-  "providers list": operation("services.providers.list", page()),
-  "providers show": operation("services.connections.show", [field("path", "teamId", "context", "team", true), field("path", "connectionId", "argument", "provider", true)]),
-  "providers status": operation("services.connections.show", [field("path", "teamId", "context", "team", true), field("path", "connectionId", "argument", "provider", true)]),
-  "providers connect": operation("services.connections.create", [field("path", "teamId", "context", "team", true), field("body", "providerId", "option", "provider", true)]),
-  "providers disconnect": operation("services.connections.disconnect", [field("path", "teamId", "context", "team", true), field("path", "connectionId", "argument", "connection", true), field("body", "reason", "option")]),
-  "providers credentials status": operation("services.credential.authorities.list", [field("path", "teamId", "context", "team", true), field("path", "connectionId", "argument", "connection", true)]),
+  "providers list": operation("providers.list", [field("path", "teamId", "context", "team", true), ...page()]),
+  "providers show": operation("providers.show", [field("path", "teamId", "context", "team", true), field("path", "providerId", "argument", "provider", true)]),
+  "providers status": operation("providers.status", [field("path", "teamId", "context", "team", true), field("path", "providerId", "argument", "provider", true)]),
+  "providers diagnose": operation("providers.diagnose", [field("path", "teamId", "context", "team", true), field("path", "providerId", "argument", "provider", true)]),
+  "providers connect": operation("providers.connect", [field("path", "teamId", "context", "team", true)]),
+  "providers disconnect": operation("providers.disconnect", [field("path", "teamId", "context", "team", true), field("path", "connectionId", "argument", "connection", true), field("body", "reason", "option")]),
+  "providers requests list": operation("providers.requests.list", [field("path", "teamId", "context", "team", true), ...page()]),
+  "providers requests show": operation("providers.requests.show", [field("path", "teamId", "context", "team", true), field("path", "requestId", "argument", "request", true)]),
+  "providers requests approve": operation("providers.requests.approve", [field("path", "teamId", "context", "team", true), field("path", "requestId", "argument", "request", true)]),
+  "providers requests reject": operation("providers.requests.reject", [field("path", "teamId", "context", "team", true), field("path", "requestId", "argument", "request", true)]),
+  "providers credentials status": operation("providers.credentials.status", [field("path", "teamId", "context", "team", true), field("path", "connectionId", "argument", "connection", true)]),
+  "providers credentials rotate": operation("providers.credentials.rotate", [field("path", "teamId", "context", "team", true), field("path", "connectionId", "argument", "connection", true)]),
+  "providers credentials revoke": operation("providers.credentials.revoke", [field("path", "teamId", "context", "team", true), field("path", "connectionId", "argument", "connection", true)]),
   "capacity status": operation("capacity.status", [field("path", "teamId", "context", "team", true), ...page()]),
+  "capacity explain": operation("capacity.explain", [field("path", "teamId", "context", "team", true)]),
   "capacity usage": operation("capacity.usage", [field("path", "teamId", "context", "team", true)]),
   "capacity ledger": operation("capacity.ledger", [field("path", "teamId", "context", "team", true), ...page()]),
+  "capacity audit": operation("capacity.audit", [field("path", "teamId", "context", "team", true), ...page()]),
+  "seeds validate": operation("seeds.validate", [field("body", "file", "argument", "file", true)]),
+  "seeds plan": operation("seeds.plan", [field("path", "name", "context", "seed", true), field("body", "file", "argument", "file", true)]),
+  "seeds apply": operation("seeds.apply", [field("path", "name", "context", "seed", true), field("body", "file", "argument", "file", true)]),
+  "seeds show": operation("seeds.show", [field("path", "name", "argument", "seed", true)]),
+  "seeds verify": operation("seeds.verify", [field("path", "name", "argument", "seed", true)]),
   "plans list": operation("plans.list", [field("path", "decisionId", "option", "decision", true), ...page()]),
   "plans show": operation("plans.show", [field("path", "capacityPlanId", "argument", "plan", true)]),
   "workdays plan": operation("workdays.plan", [field("path", "teamId", "context", "team", true), field("body", "profile", "option"), field("body", "projects", "option", "projects", false, "csv"), field("body", "start", "option"), field("body", "end", "option"), field("body", "duration", "option", "duration", false, "integer"), field("body", "objective", "option")]),
@@ -99,6 +113,7 @@ const commandTree = {
       branch("credentials", [leaf("status", "read", "connection"), leaf("rotate", "mutation", "connection", "credential"), leaf("revoke", "mutation", "connection", "irreversible")]),
       branch("offers", [leaf("show", "read", "connection"), leaf("validate", "read", "file"), leaf("plan", "read", "file"), leaf("apply", "mutation", "file", "authority")])
     ]),
+    branch("seeds", [leaf("validate", "read", "file"), leaf("plan", "read", "file"), leaf("apply", "mutation", "file", "authority"), leaf("show", "read", "seed"), leaf("verify", "read", "seed")]),
     branch("capacity", [leaf("status"), leaf("explain"), leaf("usage"), leaf("ledger"), leaf("audit")]),
     branch("plans", [leaf("list"), leaf("show", "read", "plan"), leaf("explain", "read", "plan"), { nodeType: "leaf", segment: "diff", description: "Compare two API-derived plans.", kind: "read", arguments: [{ name: "left", description: "Left plan identity.", required: true }, { name: "right", description: "Right plan identity.", required: true }], resultSchemaId: "treeseed.command.plans.diff/v1", execution: unavailable() }]),
     branch("workdays", [

package/dist/operator-contracts/control-plane-operations.d.ts

@@ -466,12 +466,21 @@ export declare const CONTROL_PLANE_OPERATIONS: {
         readonly availability: ControlPlaneOperationBinding<{
             teamId: string;
         }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly explain: ControlPlaneOperationBinding<{
+            teamId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
         readonly usage: ControlPlaneOperationBinding<{
             teamId: string;
         }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
         readonly ledger: ControlPlaneOperationBinding<{
             teamId: string;
         }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly audit: ControlPlaneOperationBinding<{
+            teamId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly lanes: ControlPlaneOperationBinding<{
+            teamId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
         readonly grants: ControlPlaneOperationBinding<{
             teamId: string;
         }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
@@ -559,12 +568,22 @@ export declare const CONTROL_PLANE_OPERATIONS: {
         readonly run: ControlPlaneOperationBinding<{
             runId: string;
         }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly validate: ControlPlaneOperationBinding<{}, {}, Record<string, unknown>, Record<string, unknown>>;
         readonly plan: ControlPlaneOperationBinding<{
             name: string;
-        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        }, {}, Record<string, unknown>, Record<string, unknown>>;
         readonly apply: ControlPlaneOperationBinding<{
             name: string;
         }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly show: ControlPlaneOperationBinding<{
+            name: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly verify: ControlPlaneOperationBinding<{
+            name: string;
+        }, {}, Record<string, unknown>, Record<string, unknown>>;
+        readonly reconcile: ControlPlaneOperationBinding<{
+            name: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
         readonly resolveResources: ControlPlaneOperationBinding<{}, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
     };
     readonly feedback: {
@@ -880,6 +899,59 @@ export declare const CONTROL_PLANE_OPERATIONS: {
         };
     };
     readonly providers: {
+        readonly list: ControlPlaneOperationBinding<{
+            teamId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly show: ControlPlaneOperationBinding<{
+            teamId: string;
+            providerId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly status: ControlPlaneOperationBinding<{
+            teamId: string;
+            providerId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly diagnose: ControlPlaneOperationBinding<{
+            teamId: string;
+            providerId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly connect: ControlPlaneOperationBinding<{
+            teamId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly disconnect: ControlPlaneOperationBinding<{
+            teamId: string;
+            connectionId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly requests: {
+            readonly list: ControlPlaneOperationBinding<{
+                teamId: string;
+            }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+            readonly show: ControlPlaneOperationBinding<{
+                teamId: string;
+                requestId: string;
+            }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+            readonly approve: ControlPlaneOperationBinding<{
+                teamId: string;
+                requestId: string;
+            }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+            readonly reject: ControlPlaneOperationBinding<{
+                teamId: string;
+                requestId: string;
+            }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        };
+        readonly credentials: {
+            readonly status: ControlPlaneOperationBinding<{
+                teamId: string;
+                connectionId: string;
+            }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+            readonly rotate: ControlPlaneOperationBinding<{
+                teamId: string;
+                connectionId: string;
+            }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+            readonly revoke: ControlPlaneOperationBinding<{
+                teamId: string;
+                connectionId: string;
+            }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        };
         readonly register: ControlPlaneOperationBinding<{}, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
         readonly registration: ControlPlaneOperationBinding<{
             requestId: string;

package/dist/operator-contracts/control-plane-operations.js

@@ -54,6 +54,24 @@ const noPathProvider = (operationId, method, path, options = {}) => define({
   pagination: "none",
   redactedPaths: options.redactedPaths
 }, { path: empty, query: empty, body: method === "GET" ? none : record, output: payload });
+function postRead(operationId, path, pathShape, capability, scopes, surfaces) {
+  return define({
+    operationId,
+    description: `Read ${operationId}.`,
+    rest: { method: "POST", path },
+    ...Object.keys(pathShape).length ? { parameters: `treeseed.${operationId}.parameters/v1` } : {},
+    capability,
+    authentication: "oauth",
+    oauthScopes: scopes,
+    kind: "read",
+    riskClass: "ordinary",
+    confirmation: "never",
+    surfaces,
+    cacheScope: "none",
+    pagination: "none",
+    idempotencyRequired: false
+  }, { path: z.object(pathShape).strict(), query: empty, body: record, output: payload });
+}
 function resource(operationId, method, path, pathShape, options = { capability: "control-plane.use" }) {
   const kind = method === "GET" ? "read" : "mutation";
   const riskClass = options.risk ?? "ordinary";
@@ -273,8 +291,11 @@ const CONTROL_PLANE_OPERATIONS = {
   },
   capacity: {
     availability: resource("capacity.status", "GET", "/v1/teams/{teamId}/capacity/availability-sessions", { teamId: z.string().min(1) }, { capability: "capacity.read", surfaces: ["rest", "cli", "mcp_tool"], pagination: "cursor" }),
+    explain: resource("capacity.explain", "GET", "/v1/teams/{teamId}/capacity/explanation", { teamId: z.string().min(1) }, { capability: "capacity.read", surfaces: ["rest", "cli", "mcp_tool"] }),
     usage: resource("capacity.usage", "GET", "/v1/teams/{teamId}/capacity/usage", { teamId: z.string().min(1) }, { capability: "capacity.read", surfaces: ["rest", "cli", "mcp_tool"] }),
     ledger: resource("capacity.ledger", "GET", "/v1/teams/{teamId}/capacity/ledger", { teamId: z.string().min(1) }, { capability: "capacity.read", surfaces: ["rest", "cli"], pagination: "cursor" }),
+    audit: resource("capacity.audit", "GET", "/v1/teams/{teamId}/capacity/audit", { teamId: z.string().min(1) }, { capability: "capacity.read", surfaces: ["rest", "cli"], pagination: "cursor" }),
+    lanes: resource("capacity.lanes.list", "GET", "/v1/teams/{teamId}/capacity/lanes", { teamId: z.string().min(1) }, { capability: "capacity.read", surfaces: ["rest", "mcp_tool"], pagination: "cursor" }),
     grants: resource("capacity.grants.list", "GET", "/v1/teams/{teamId}/capacity-grants", { teamId: z.string().min(1) }, { capability: "capacity.read", pagination: "cursor" }),
     grant: resource("capacity.grants.show", "GET", "/v1/teams/{teamId}/capacity-grants/{grantId}", { teamId: z.string().min(1), grantId: z.string().min(1) }, { capability: "capacity.read" })
   },
@@ -310,8 +331,12 @@ const CONTROL_PLANE_OPERATIONS = {
   seeds: {
     runs: resource("seeds.runs.list", "GET", "/v1/seeds/runs", {}, { capability: "seeds.read", pagination: "cursor" }),
     run: resource("seeds.runs.show", "GET", "/v1/seeds/runs/{runId}", { runId: z.string().min(1) }, { capability: "seeds.read" }),
-    plan: resource("seeds.plan", "POST", "/v1/seeds/{name}/plan", { name: z.string().min(1) }, { capability: "seeds.write", scopes: ["treeseed:admin"] }),
-    apply: resource("seeds.apply", "POST", "/v1/seeds/{name}/apply", { name: z.string().min(1) }, { capability: "seeds.write", scopes: ["treeseed:admin"], risk: "authority" }),
+    validate: postRead("seeds.validate", "/v1/seeds/validate", {}, "seeds.read", ["treeseed:admin"], ["rest", "cli"]),
+    plan: postRead("seeds.plan", "/v1/seeds/{name}/plan", { name: z.string().min(1) }, "seeds.write", ["treeseed:admin"], ["rest", "cli"]),
+    apply: resource("seeds.apply", "POST", "/v1/seeds/{name}/apply", { name: z.string().min(1) }, { capability: "seeds.write", scopes: ["treeseed:admin"], surfaces: ["rest", "cli"], risk: "authority" }),
+    show: resource("seeds.show", "GET", "/v1/seeds/{name}", { name: z.string().min(1) }, { capability: "seeds.read", scopes: ["treeseed:admin"], surfaces: ["rest", "cli"] }),
+    verify: postRead("seeds.verify", "/v1/seeds/{name}/verify", { name: z.string().min(1) }, "seeds.read", ["treeseed:admin"], ["rest", "cli"]),
+    reconcile: resource("seeds.reconcile", "POST", "/v1/seeds/{name}/reconcile", { name: z.string().min(1) }, { capability: "seeds.write", scopes: ["treeseed:admin"], risk: "authority" }),
     resolveResources: resource("seeds.resources.resolve", "POST", "/v1/seeds/resources/resolve", {}, { capability: "seeds.read", scopes: ["treeseed:admin"] })
   },
   feedback: {
@@ -418,6 +443,23 @@ const CONTROL_PLANE_OPERATIONS = {
     }
   },
   providers: {
+    list: resource("providers.list", "GET", "/v1/teams/{teamId}/capacity-providers", { teamId: z.string().min(1) }, { capability: "providers.read", surfaces: ["rest", "cli", "mcp_tool"], pagination: "cursor" }),
+    show: resource("providers.show", "GET", "/v1/teams/{teamId}/capacity-providers/{providerId}", { teamId: z.string().min(1), providerId: z.string().min(1) }, { capability: "providers.read", surfaces: ["rest", "cli", "mcp_resource"] }),
+    status: resource("providers.status", "GET", "/v1/teams/{teamId}/capacity-providers/{providerId}/status", { teamId: z.string().min(1), providerId: z.string().min(1) }, { capability: "providers.read", surfaces: ["rest", "cli", "mcp_tool"] }),
+    diagnose: resource("providers.diagnose", "GET", "/v1/teams/{teamId}/capacity-providers/{providerId}/diagnosis", { teamId: z.string().min(1), providerId: z.string().min(1) }, { capability: "providers.read", surfaces: ["rest", "cli", "mcp_tool"] }),
+    connect: resource("providers.connect", "POST", "/v1/teams/{teamId}/capacity-provider-connections", { teamId: z.string().min(1) }, { capability: "providers.write", scopes: ["treeseed:admin"], surfaces: ["rest", "cli"], risk: "credential", redactedPaths: ["body.enrollmentToken"] }),
+    disconnect: resource("providers.disconnect", "POST", "/v1/teams/{teamId}/capacity-provider-connections/{connectionId}/disconnect", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "providers.write", scopes: ["treeseed:admin"], surfaces: ["rest", "cli"], risk: "destructive" }),
+    requests: {
+      list: resource("providers.requests.list", "GET", "/v1/teams/{teamId}/capacity-provider-requests", { teamId: z.string().min(1) }, { capability: "providers.read", surfaces: ["rest", "cli"], pagination: "cursor" }),
+      show: resource("providers.requests.show", "GET", "/v1/teams/{teamId}/capacity-provider-requests/{requestId}", { teamId: z.string().min(1), requestId: z.string().min(1) }, { capability: "providers.read", surfaces: ["rest", "cli"] }),
+      approve: resource("providers.requests.approve", "POST", "/v1/teams/{teamId}/capacity-provider-requests/{requestId}/approve", { teamId: z.string().min(1), requestId: z.string().min(1) }, { capability: "providers.write", scopes: ["treeseed:admin"], surfaces: ["rest", "cli"], risk: "authority" }),
+      reject: resource("providers.requests.reject", "POST", "/v1/teams/{teamId}/capacity-provider-requests/{requestId}/reject", { teamId: z.string().min(1), requestId: z.string().min(1) }, { capability: "providers.write", scopes: ["treeseed:admin"], surfaces: ["rest", "cli"], risk: "authority" })
+    },
+    credentials: {
+      status: resource("providers.credentials.status", "GET", "/v1/teams/{teamId}/capacity-provider-connections/{connectionId}/credentials", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "providers.read", surfaces: ["rest", "cli"] }),
+      rotate: resource("providers.credentials.rotate", "POST", "/v1/teams/{teamId}/capacity-provider-connections/{connectionId}/credentials/rotate", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "providers.write", scopes: ["treeseed:admin"], surfaces: ["rest", "cli"], risk: "credential" }),
+      revoke: resource("providers.credentials.revoke", "POST", "/v1/teams/{teamId}/capacity-provider-connections/{connectionId}/credentials/revoke", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "providers.write", scopes: ["treeseed:admin"], surfaces: ["rest", "cli"], risk: "irreversible" })
+    },
     register: noPathProvider("providers.register", "POST", "/v1/provider-registrations", { redactedPaths: ["body.registrationKey"] }),
     registration: providerPath("providers.registration.show", "GET", "/v1/provider-registrations/{requestId}", { requestId: z.string().min(1) }, { read: true }),
     exchangeCredential: providerPath("providers.registration.credential", "POST", "/v1/provider-registrations/{requestId}/credential", { requestId: z.string().min(1) }, { redactedPaths: ["body.proof"] }),

package/dist/operator-contracts/index.d.ts

@@ -6,3 +6,4 @@ export * from './control-plane-operation.js';
 export * from './control-plane-operations.js';
 export * from './mcp.js';
 export * from './oauth.js';
+export * from './seed/seed-bundle.js';

package/dist/operator-contracts/index.js

@@ -6,3 +6,4 @@ export * from "./control-plane-operation.js";
 export * from "./control-plane-operations.js";
 export * from "./mcp.js";
 export * from "./oauth.js";
+export * from "./seed/seed-bundle.js";

package/dist/operator-contracts/seed/seed-bundle.d.ts

@@ -0,0 +1,123 @@
+import type { ProviderLanePurpose } from '../../agent-capacity/contracts/capacity/communication/communication-records.js';
+export declare const SEED_BUNDLE_SCHEMA_VERSION: "treeseed.seed-bundle/v2";
+export type SeedEnvironment = 'local' | 'staging' | 'prod' | string;
+export interface SeedTeamResource {
+    key: string;
+    slug: string;
+    name: string;
+    displayName: string;
+    profileSummary?: string;
+}
+export interface SeedUserMembershipResource {
+    key: string;
+    team: string;
+    principal: {
+        kind: 'user';
+        email: string;
+    };
+    roles: string[];
+    missingUser: 'defer' | 'reject';
+}
+export interface SeedServicePrincipalMembershipResource {
+    key: string;
+    team: string;
+    principal: {
+        kind: 'service-principal';
+        key: string;
+        displayName: string;
+        interactiveLogin: false;
+    };
+    roles: string[];
+}
+export type SeedMembershipResource = SeedUserMembershipResource | SeedServicePrincipalMembershipResource;
+export interface SeedRepositoryPolicy {
+    visibility: 'public' | 'private';
+    lifecycle: 'adopt' | 'create-or-adopt';
+    deletionPolicy: 'retain';
+    defaultBranch: string;
+    stagingBranch: string;
+    issues: boolean;
+    actions: boolean;
+    workflows: string[];
+}
+export interface SeedRepositoryResource {
+    key: string;
+    project: string;
+    role: 'primary' | 'content' | 'fixture' | 'support' | 'template';
+    provider: 'github';
+    owner: string;
+    name: string;
+    gitUrl: string;
+    defaultBranch: string;
+    checkoutPath?: string;
+    submodulePath?: string;
+    repositoryPolicy: SeedRepositoryPolicy;
+    metadata?: Record<string, unknown>;
+}
+export interface SeedProjectResource {
+    key: string;
+    team: string;
+    slug: string;
+    name: string;
+    description: string;
+    kind: string;
+    primaryRepository: string;
+    metadata?: Record<string, unknown>;
+}
+export interface SeedCapacityProviderPrerequisite {
+    key: string;
+    team: string;
+    environments: SeedEnvironment[];
+    manifestDigest: `sha256:${string}`;
+    manifestRef: string;
+    approval: 'trusted-local-owner';
+    projects: string[];
+    allowedModes: Array<'planning' | 'acting'>;
+    requiredLanePurposes: ProviderLanePurpose[];
+}
+export interface SeedBundleV2 {
+    schemaVersion: typeof SEED_BUNDLE_SCHEMA_VERSION;
+    name: string;
+    version: number;
+    description: string;
+    environments: SeedEnvironment[];
+    digest: `sha256:${string}`;
+    resources: {
+        teams: SeedTeamResource[];
+        memberships: SeedMembershipResource[];
+        projects: SeedProjectResource[];
+        repositories: SeedRepositoryResource[];
+    };
+    runtime: {
+        capacityProviders: SeedCapacityProviderPrerequisite[];
+    };
+}
+export interface SeedResourceReceipt {
+    resourceKey: string;
+    action: 'create' | 'adopt' | 'update' | 'noop' | 'blocked';
+    resourceId?: string;
+    digest: `sha256:${string}`;
+    readBackAt?: string;
+    blockers?: string[];
+}
+export interface SeedReconciliationReceipt {
+    schemaVersion: 'treeseed.seed-reconciliation-receipt/v1';
+    runId: string;
+    seedName: string;
+    seedVersion: number;
+    seedDigest: `sha256:${string}`;
+    mode: 'plan' | 'apply' | 'verify';
+    status: 'planned' | 'waiting_provider' | 'verified' | 'blocked' | 'failed';
+    resources: SeedResourceReceipt[];
+    providerRequestIds: string[];
+    createdAt: string;
+    completedAt?: string;
+}
+export interface SeedBundleDiagnostic {
+    code: string;
+    path: string;
+    message: string;
+}
+export declare function canonicalSeedBundlePayload(bundle: Omit<SeedBundleV2, 'digest'> | SeedBundleV2): string;
+export declare function digestSeedBundle(bundle: Omit<SeedBundleV2, 'digest'> | SeedBundleV2): Promise<`sha256:${string}`>;
+export declare function validateSeedBundle(bundle: SeedBundleV2): SeedBundleDiagnostic[];

package/dist/operator-contracts/seed/seed-bundle.js

@@ -0,0 +1,50 @@
+const SEED_BUNDLE_SCHEMA_VERSION = "treeseed.seed-bundle/v2";
+function text(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function canonical(value) {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => [key, canonical(entry)]));
+}
+function canonicalSeedBundlePayload(bundle) {
+  const { digest: _digest, ...payload } = bundle;
+  return JSON.stringify(canonical(payload));
+}
+async function digestSeedBundle(bundle) {
+  const bytes = new TextEncoder().encode(canonicalSeedBundlePayload(bundle));
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
+  return `sha256:${Array.from(new Uint8Array(digest), (value) => value.toString(16).padStart(2, "0")).join("")}`;
+}
+function validateSeedBundle(bundle) {
+  const diagnostics = [];
+  const add = (code, path, message) => diagnostics.push({ code, path, message });
+  if (bundle?.schemaVersion !== SEED_BUNDLE_SCHEMA_VERSION) add("seed_bundle_schema_invalid", "schemaVersion", `schemaVersion must be ${SEED_BUNDLE_SCHEMA_VERSION}.`);
+  if (!text(bundle?.name) || !Number.isInteger(bundle?.version) || bundle.version < 1) add("seed_bundle_identity_invalid", "name", "Seed name and positive version are required.");
+  if (!/^sha256:[a-f0-9]{64}$/u.test(bundle?.digest ?? "")) add("seed_bundle_digest_invalid", "digest", "Seed digest must be an exact SHA-256 digest.");
+  const teams = new Set((bundle?.resources?.teams ?? []).map((entry) => entry.key));
+  const projects = new Set((bundle?.resources?.projects ?? []).map((entry) => entry.key));
+  const repositories = new Set((bundle?.resources?.repositories ?? []).map((entry) => entry.key));
+  const allKeys = [...teams, ...projects, ...repositories, ...(bundle?.resources?.memberships ?? []).map((entry) => entry.key)];
+  if (new Set(allKeys).size !== allKeys.length) add("seed_bundle_resource_key_duplicate", "resources", "Every resource key must be globally unique.");
+  for (const [index, membership] of (bundle?.resources?.memberships ?? []).entries()) {
+    if (!teams.has(membership.team)) add("seed_bundle_membership_team_unknown", `resources.memberships[${index}].team`, "Membership references an unknown team.");
+    if (membership.principal.kind === "service-principal" && membership.principal.interactiveLogin !== false) add("seed_bundle_service_principal_interactive_forbidden", `resources.memberships[${index}].principal.interactiveLogin`, "Service principals cannot log in interactively.");
+  }
+  for (const [index, project] of (bundle?.resources?.projects ?? []).entries()) {
+    if (!teams.has(project.team)) add("seed_bundle_project_team_unknown", `resources.projects[${index}].team`, "Project references an unknown team.");
+    if (!repositories.has(project.primaryRepository)) add("seed_bundle_primary_repository_unknown", `resources.projects[${index}].primaryRepository`, "Project primary repository is missing.");
+  }
+  for (const [index, provider] of (bundle?.runtime?.capacityProviders ?? []).entries()) {
+    if (!teams.has(provider.team)) add("seed_bundle_provider_team_unknown", `runtime.capacityProviders[${index}].team`, "Provider references an unknown team.");
+    for (const project of provider.projects) if (!projects.has(project)) add("seed_bundle_provider_project_unknown", `runtime.capacityProviders[${index}].projects`, `Provider references unknown project ${project}.`);
+    for (const purpose of ["communication", "platform", "workday"]) if (!provider.requiredLanePurposes.includes(purpose)) add("seed_bundle_provider_lane_required", `runtime.capacityProviders[${index}].requiredLanePurposes`, `Provider prerequisite requires the ${purpose} lane.`);
+  }
+  return diagnostics;
+}
+export {
+  SEED_BUNDLE_SCHEMA_VERSION,
+  canonicalSeedBundlePayload,
+  digestSeedBundle,
+  validateSeedBundle
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.19",
+  "version": "0.13.0-rc.20",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {