@treeseed/sdk 0.13.0-rc.2 → 0.13.0-rc.21

package/dist/entrypoints/clients/control-plane-client.d.ts

@@ -0,0 +1,114 @@
+import type { ControlPlaneOperationBinding, ControlPlaneOperationBody, ControlPlaneOperationOutput, ControlPlaneOperationPath, ControlPlaneOperationQuery, OAuthScope } from '../../operator-contracts/control-plane-operation.js';
+import type { ApiPrincipal } from '../../operator-contracts/oauth.js';
+import type { InputRequired } from '../../operator-contracts/mcp.js';
+export declare const DEFAULT_CONTROL_PLANE_BASE_URL = "http://127.0.0.1:3002";
+export declare const CONTROL_PLANE_BASE_URL_ENV = "TREESEED_API_BASE_URL";
+export interface ControlPlaneServerProfile {
+    serverId: string;
+    label: string;
+    baseUrl: string;
+}
+export interface ControlPlaneServerSession {
+    serverId: string;
+    audience: string;
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt?: string;
+    principal?: ApiPrincipal | null;
+}
+export interface ControlPlaneServerRegistry {
+    version: 1;
+    activeServerId: string;
+    servers: ControlPlaneServerProfile[];
+}
+export interface OAuthDeviceAuthorizationReceipt {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete?: string;
+    expiresIn: number;
+    interval: number;
+}
+export interface OAuthTokenReceipt {
+    tokenType: 'Bearer';
+    accessToken: string;
+    expiresIn: number;
+    refreshToken?: string;
+    scope: OAuthScope[];
+    audience: string;
+    principal?: ApiPrincipal | null;
+}
+export interface ControlPlaneClientOptions {
+    profile: ControlPlaneServerProfile;
+    accessToken?: string | null;
+    fetchImpl?: typeof fetch;
+    userAgent?: string;
+}
+export interface ControlPlaneResponseEnvelope<T> {
+    data: T;
+    meta?: Record<string, unknown>;
+    links?: Record<string, string>;
+}
+export interface ProblemDetails {
+    type: string;
+    title: string;
+    status: number;
+    detail?: string;
+    instance?: string;
+    code: string;
+    requestId?: string;
+    traceId?: string;
+    fields?: Record<string, string[]>;
+    inputRequired?: InputRequired;
+}
+export interface ControlPlaneCallOptions {
+    method?: 'DELETE' | 'GET' | 'PATCH' | 'POST' | 'PUT';
+    path: `/v1/${string}` | '/openapi.json';
+    input?: unknown;
+    headers?: Record<string, string>;
+    idempotencyKey?: string;
+    ifMatch?: string;
+    authorization?: string | null;
+    signal?: AbortSignal;
+}
+export interface ControlPlaneOperationCallOptions {
+    headers?: Record<string, string>;
+    idempotencyKey?: string;
+    ifMatch?: string;
+    authorization?: string | null;
+    signal?: AbortSignal;
+}
+export interface ControlPlaneInvocation<TPath, TQuery, TBody> {
+    path: TPath;
+    query: TQuery;
+    body: TBody;
+}
+export declare class ControlPlaneClientError extends Error {
+    readonly status: number;
+    readonly problem: ProblemDetails;
+    readonly responseHeaders: Headers;
+    constructor(message: string, status: number, problem: ProblemDetails, responseHeaders: Headers);
+}
+export declare function normalizeControlPlaneBaseUrl(value: string): string;
+export declare function defaultLocalControlPlaneServer(env?: Record<string, string | undefined>): ControlPlaneServerProfile;
+export declare function normalizeControlPlaneServerRegistry(state: ControlPlaneServerRegistry): {
+    version: 1;
+    activeServerId: string;
+    servers: ControlPlaneServerProfile[];
+};
+export declare function resolveControlPlaneServer(selector: string | null | undefined, registry: ControlPlaneServerRegistry): ControlPlaneServerProfile;
+export declare class ControlPlaneClient {
+    readonly options: ControlPlaneClientOptions;
+    readonly baseUrl: string;
+    readonly accessToken: string | null;
+    readonly fetchImpl: typeof fetch;
+    readonly userAgent?: string;
+    constructor(options: ControlPlaneClientOptions);
+    invoke<TOperation extends ControlPlaneOperationBinding<any, any, any, any>>(binding: TOperation, input: ControlPlaneInvocation<ControlPlaneOperationPath<TOperation>, ControlPlaneOperationQuery<TOperation>, ControlPlaneOperationBody<TOperation>>, options?: ControlPlaneOperationCallOptions): Promise<ControlPlaneResponseEnvelope<ControlPlaneOperationOutput<TOperation>>>;
+    authorizeDevice(clientId: string, scope: OAuthScope[], signal?: AbortSignal): Promise<OAuthDeviceAuthorizationReceipt>;
+    exchangeDeviceCode(clientId: string, deviceCode: string, signal?: AbortSignal): Promise<OAuthTokenReceipt>;
+    refreshAccessToken(clientId: string, refreshToken: string, signal?: AbortSignal): Promise<OAuthTokenReceipt>;
+    revokeToken(clientId: string, token: string, signal?: AbortSignal): Promise<void>;
+    private exchangeOAuthToken;
+    private request;
+}

package/dist/entrypoints/clients/control-plane-client.js

@@ -0,0 +1,186 @@
+import { controlPlaneOperation } from "../../operator-contracts/control-plane-operations.js";
+const DEFAULT_CONTROL_PLANE_BASE_URL = "http://127.0.0.1:3002";
+const CONTROL_PLANE_BASE_URL_ENV = "TREESEED_API_BASE_URL";
+class ControlPlaneClientError extends Error {
+  constructor(message, status, problem, responseHeaders) {
+    super(message);
+    this.status = status;
+    this.problem = problem;
+    this.responseHeaders = responseHeaders;
+    this.name = "ControlPlaneClientError";
+  }
+  status;
+  problem;
+  responseHeaders;
+}
+function normalizeControlPlaneBaseUrl(value) {
+  const normalized = value.trim().replace(/\/+$/u, "");
+  if (!/^https?:\/\//u.test(normalized)) throw new Error("Control-plane server URLs must use HTTP or HTTPS.");
+  return normalized;
+}
+function defaultLocalControlPlaneServer(env = process.env) {
+  return {
+    serverId: "local",
+    label: "Local TreeSeed control plane",
+    baseUrl: normalizeControlPlaneBaseUrl(env[CONTROL_PLANE_BASE_URL_ENV] ?? DEFAULT_CONTROL_PLANE_BASE_URL)
+  };
+}
+function normalizeServer(profile) {
+  const serverId = profile.serverId.trim();
+  if (!serverId) throw new Error("Control-plane server IDs cannot be empty.");
+  return { serverId, label: profile.label.trim() || serverId, baseUrl: normalizeControlPlaneBaseUrl(profile.baseUrl) };
+}
+function normalizeControlPlaneServerRegistry(state) {
+  const servers = [...new Map(state.servers.map((entry) => {
+    const normalized = normalizeServer(entry);
+    return [normalized.serverId, normalized];
+  })).values()].sort((left, right) => left.serverId.localeCompare(right.serverId));
+  if (servers.length === 0) throw new Error("A control-plane server registry requires at least one server.");
+  const activeServerId = servers.some((entry) => entry.serverId === state.activeServerId) ? state.activeServerId : servers[0].serverId;
+  return { version: 1, activeServerId, servers };
+}
+function resolveControlPlaneServer(selector, registry) {
+  const value = selector?.trim();
+  if (value && /^https?:\/\//iu.test(value)) {
+    return normalizeServer({ serverId: value.replace(/^https?:\/\//iu, "").replace(/[^a-z0-9._-]+/giu, "-"), label: value, baseUrl: value });
+  }
+  const normalized = normalizeControlPlaneServerRegistry(registry);
+  const serverId = value || normalized.activeServerId;
+  const profile = normalized.servers.find((entry) => entry.serverId === serverId);
+  if (!profile) throw new Error(`Unknown control-plane server "${serverId}".`);
+  return profile;
+}
+async function responsePayload(response) {
+  const contentType = response.headers.get("content-type") ?? "";
+  if (contentType.includes("json")) return response.json();
+  const text = await response.text();
+  return text.length > 0 ? text : null;
+}
+function problemFrom(payload, status) {
+  const source = payload && typeof payload === "object" ? payload : {};
+  return {
+    type: typeof source.type === "string" ? source.type : "about:blank",
+    title: typeof source.title === "string" ? source.title : "Control-plane request failed",
+    status,
+    detail: typeof source.detail === "string" ? source.detail : void 0,
+    instance: typeof source.instance === "string" ? source.instance : void 0,
+    code: typeof source.code === "string" ? source.code : "control_plane_request_failed",
+    requestId: typeof source.requestId === "string" ? source.requestId : void 0,
+    traceId: typeof source.traceId === "string" ? source.traceId : void 0,
+    fields: source.fields && typeof source.fields === "object" ? source.fields : void 0,
+    inputRequired: source.inputRequired && typeof source.inputRequired === "object" ? source.inputRequired : void 0
+  };
+}
+class ControlPlaneClient {
+  constructor(options) {
+    this.options = options;
+    this.baseUrl = normalizeControlPlaneBaseUrl(options.profile.baseUrl);
+    this.accessToken = options.accessToken ?? null;
+    this.fetchImpl = options.fetchImpl ?? fetch;
+    this.userAgent = options.userAgent;
+  }
+  options;
+  baseUrl;
+  accessToken;
+  fetchImpl;
+  userAgent;
+  async invoke(binding, input, options = {}) {
+    if (controlPlaneOperation(binding.descriptor.operationId) !== binding) {
+      throw new Error(`Operation ${binding.descriptor.operationId} is not the authoritative catalog binding.`);
+    }
+    const rest = binding.descriptor.rest;
+    if (!rest) throw new Error(`Operation ${binding.descriptor.operationId} has no REST binding.`);
+    const pathInput = binding.schema.path.parse(input.path);
+    const queryInput = binding.schema.query.parse(input.query);
+    const bodyInput = binding.schema.body.parse(input.body);
+    let path = rest.path;
+    path = path.replace(/\{([A-Za-z][A-Za-z0-9]*)\}/gu, (_match, name) => {
+      const value = pathInput[name];
+      if (typeof value !== "string" && typeof value !== "number") throw new Error(`Operation ${binding.descriptor.operationId} requires path parameter ${name}.`);
+      return encodeURIComponent(String(value));
+    });
+    if (path.includes("{")) throw new Error(`Operation ${binding.descriptor.operationId} has unresolved path parameters.`);
+    const query = new URLSearchParams();
+    for (const [name, value] of Object.entries(queryInput)) {
+      if (value === void 0 || value === null) continue;
+      for (const item of Array.isArray(value) ? value : [value]) query.append(name, String(item));
+    }
+    const queryString = query.toString();
+    const response = await this.request({
+      method: rest.method,
+      path: `${path}${queryString ? `?${queryString}` : ""}`,
+      input: rest.method === "GET" ? void 0 : bodyInput,
+      ...options
+    });
+    return { ...response, data: binding.schema.output.parse(response.data) };
+  }
+  async authorizeDevice(clientId, scope, signal) {
+    const response = await this.fetchImpl(`${this.baseUrl}/oauth/device_authorization`, { method: "POST", headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ client_id: clientId, scope: scope.join(" ") }), signal });
+    const payload = await responsePayload(response);
+    if (!response.ok) throw new ControlPlaneClientError(String(payload.error_description ?? payload.error ?? "Device authorization failed."), response.status, problemFrom(payload, response.status), response.headers);
+    return { deviceCode: String(payload.device_code), userCode: String(payload.user_code), verificationUri: String(payload.verification_uri), verificationUriComplete: typeof payload.verification_uri_complete === "string" ? payload.verification_uri_complete : void 0, expiresIn: Number(payload.expires_in), interval: Number(payload.interval) };
+  }
+  async exchangeDeviceCode(clientId, deviceCode, signal) {
+    return this.exchangeOAuthToken({ client_id: clientId, grant_type: "urn:ietf:params:oauth:grant-type:device_code", device_code: deviceCode }, signal);
+  }
+  async refreshAccessToken(clientId, refreshToken, signal) {
+    return this.exchangeOAuthToken({ client_id: clientId, grant_type: "refresh_token", refresh_token: refreshToken }, signal);
+  }
+  async revokeToken(clientId, token, signal) {
+    const response = await this.fetchImpl(`${this.baseUrl}/oauth/revoke`, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ client_id: clientId, token }), signal });
+    if (!response.ok) throw new ControlPlaneClientError("Token revocation failed.", response.status, problemFrom(await responsePayload(response), response.status), response.headers);
+  }
+  async exchangeOAuthToken(values, signal) {
+    const response = await this.fetchImpl(`${this.baseUrl}/oauth/token`, { method: "POST", headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" }, body: new URLSearchParams(values), signal });
+    const payload = await responsePayload(response);
+    if (!response.ok) {
+      const problem = problemFrom(payload, response.status);
+      problem.code = typeof payload.error === "string" ? payload.error : problem.code;
+      problem.detail = typeof payload.error_description === "string" ? payload.error_description : problem.detail;
+      throw new ControlPlaneClientError(problem.detail ?? problem.code, response.status, problem, response.headers);
+    }
+    return { tokenType: "Bearer", accessToken: String(payload.access_token), refreshToken: typeof payload.refresh_token === "string" ? payload.refresh_token : void 0, expiresIn: Number(payload.expires_in), scope: String(payload.scope ?? "").split(/\s+/u).filter(Boolean), audience: String(payload.audience ?? this.baseUrl), principal: payload.principal && typeof payload.principal === "object" ? payload.principal : void 0 };
+  }
+  async request(options) {
+    const headers = new Headers(options.headers);
+    headers.set("accept", "application/json, application/problem+json");
+    if (options.authorization !== null) {
+      const authorization = options.authorization ?? (this.accessToken ? `Bearer ${this.accessToken}` : null);
+      if (authorization) headers.set("authorization", authorization);
+    }
+    if (this.userAgent) headers.set("user-agent", this.userAgent);
+    if (options.idempotencyKey) headers.set("idempotency-key", options.idempotencyKey);
+    if (options.ifMatch) headers.set("if-match", options.ifMatch);
+    if (options.input !== void 0) headers.set("content-type", "application/json");
+    const response = await this.fetchImpl(`${this.baseUrl}${options.path}`, {
+      method: options.method ?? "GET",
+      headers,
+      body: options.input === void 0 ? void 0 : JSON.stringify(options.input),
+      signal: options.signal
+    });
+    const payload = await responsePayload(response);
+    if (!response.ok) {
+      const problem = problemFrom(payload, response.status);
+      throw new ControlPlaneClientError(problem.detail ?? problem.title, response.status, problem, response.headers);
+    }
+    if (!payload || typeof payload !== "object" || !("data" in payload)) {
+      throw new ControlPlaneClientError("The control plane returned an invalid success envelope.", 502, {
+        type: "https://treeseed.dev/problems/invalid-upstream-response",
+        title: "Invalid control-plane response",
+        status: 502,
+        code: "control_plane_response_invalid"
+      }, response.headers);
+    }
+    return payload;
+  }
+}
+export {
+  CONTROL_PLANE_BASE_URL_ENV,
+  ControlPlaneClient,
+  ControlPlaneClientError,
+  DEFAULT_CONTROL_PLANE_BASE_URL,
+  defaultLocalControlPlaneServer,
+  normalizeControlPlaneBaseUrl,
+  normalizeControlPlaneServerRegistry,
+  resolveControlPlaneServer
+};

package/dist/entrypoints/models/sdk-types.d.ts

@@ -1,10 +1,3 @@
-export * from '../../sdk-types/commerce/capacity/commerce-capacity-listing-input.js';
-export * from '../../sdk-types/commerce/catalog/upsert-catalog-item-request.js';
-export * from '../../sdk-types/commerce/governance/commerce-governance-states.js';
-export * from '../../sdk-types/commerce/payments/commerce-entitlement.js';
-export * from '../../sdk-types/commerce/payments/commerce-subscription-statuses.js';
-export * from '../../sdk-types/commerce/services/commerce-service-contract.js';
-export * from '../../sdk-types/commerce/vendors/commerce-stripe-onboarding-request-input.js';
 export * from '../../sdk-types/configuration/sdk-dispatch-credential-source.js';
 export * from '../../sdk-types/governance/commons/commons-question-input.js';
 export * from '../../sdk-types/support/planning-policy.js';
@@ -14,3 +7,4 @@ export * from '../../sdk-types/support/sdk-model-names.js';
 export * from '../../sdk-types/support/sdk-search-request.js';
 export * from '../../sdk-types/treedx/graph/sdk-graph-query-request.js';
 export * from '../../projects/projects-core/project-workflow.js';
+export * from '../../sdk-types/control-plane/resource-requests.js';

package/dist/entrypoints/models/sdk-types.js

@@ -1,10 +1,3 @@
-export * from "../../sdk-types/commerce/capacity/commerce-capacity-listing-input.js";
-export * from "../../sdk-types/commerce/catalog/upsert-catalog-item-request.js";
-export * from "../../sdk-types/commerce/governance/commerce-governance-states.js";
-export * from "../../sdk-types/commerce/payments/commerce-entitlement.js";
-export * from "../../sdk-types/commerce/payments/commerce-subscription-statuses.js";
-export * from "../../sdk-types/commerce/services/commerce-service-contract.js";
-export * from "../../sdk-types/commerce/vendors/commerce-stripe-onboarding-request-input.js";
 export * from "../../sdk-types/configuration/sdk-dispatch-credential-source.js";
 export * from "../../sdk-types/governance/commons/commons-question-input.js";
 export * from "../../sdk-types/support/planning-policy.js";
@@ -14,3 +7,4 @@ export * from "../../sdk-types/support/sdk-model-names.js";
 export * from "../../sdk-types/support/sdk-search-request.js";
 export * from "../../sdk-types/treedx/graph/sdk-graph-query-request.js";
 export * from "../../projects/projects-core/project-workflow.js";
+export * from "../../sdk-types/control-plane/resource-requests.js";

package/dist/knowledge/index.d.ts

@@ -1,9 +1 @@
 export * from './contracts.js';
-export * from './catalog.js';
-export * from './authoring.js';
-export * from './markdown.js';
-export * from './routes.js';
-export * from './collaboration.js';
-export * from './publication.js';
-export * from './editorial-context.js';
-export * from './editorial-review.js';

package/dist/knowledge/index.js

@@ -1,9 +1 @@
 export * from "./contracts.js";
-export * from "./catalog.js";
-export * from "./authoring.js";
-export * from "./markdown.js";
-export * from "./routes.js";
-export * from "./collaboration.js";
-export * from "./publication.js";
-export * from "./editorial-context.js";
-export * from "./editorial-review.js";

package/dist/operator-contracts/canonical-command-tree.js

@@ -1,3 +1,75 @@
+const unavailable = (reason = "This capability is not enabled until its control-plane operation is accepted.") => ({
+  kind: "unavailable",
+  code: "standards_migration_not_enabled",
+  reason
+});
+const protocol = (handlerId) => ({ kind: "protocol", handlerId });
+const local = (handlerId) => ({ kind: "local", handlerId });
+const field = (target, name, source, sourceName = name, required = false, transform = "identity") => ({ target, field: name, source, name: sourceName, required, transform });
+const operation = (operationId, input = []) => ({ kind: "operation", operationId, input });
+const page = () => [field("query", "status", "option"), field("query", "limit", "option", "limit", false, "integer"), field("query", "cursor", "option")];
+const operationBindings = {
+  "auth login": protocol("protocol.oauth.device.login"),
+  "auth logout": protocol("protocol.oauth.revoke"),
+  "auth status": operation("accounts.current.show"),
+  "secrets list": local("local.secrets.list"),
+  "secrets status": local("local.secrets.status"),
+  "secrets unlock": local("local.secrets.unlock"),
+  "secrets lock": local("local.secrets.lock"),
+  "secrets rotate": local("local.secrets.rotate"),
+  "agents list": operation("agents.list", [field("path", "projectId", "context", "project", true), ...page()]),
+  "agents show": operation("agents.show", [field("path", "projectId", "context", "project", true), field("path", "agentSlug", "argument", "agent", true)]),
+  "agents classes list": operation("agents.classes.list", [field("path", "projectId", "context", "project", true)]),
+  "agents classes show": operation("agents.classes.show", [field("path", "projectId", "context", "project", true), field("path", "classId", "argument", "class", true)]),
+  "providers list": operation("providers.list", [field("path", "teamId", "context", "team", true), ...page()]),
+  "providers show": operation("providers.show", [field("path", "teamId", "context", "team", true), field("path", "providerId", "argument", "provider", true)]),
+  "providers status": operation("providers.status", [field("path", "teamId", "context", "team", true), field("path", "providerId", "argument", "provider", true)]),
+  "providers diagnose": operation("providers.diagnose", [field("path", "teamId", "context", "team", true), field("path", "providerId", "argument", "provider", true)]),
+  "providers connect": operation("providers.connect", [field("path", "teamId", "context", "team", true)]),
+  "providers disconnect": operation("providers.disconnect", [field("path", "teamId", "context", "team", true), field("path", "connectionId", "argument", "connection", true), field("body", "reason", "option")]),
+  "providers requests list": operation("providers.requests.list", [field("path", "teamId", "context", "team", true), ...page()]),
+  "providers requests show": operation("providers.requests.show", [field("path", "teamId", "context", "team", true), field("path", "requestId", "argument", "request", true)]),
+  "providers requests approve": operation("providers.requests.approve", [field("path", "teamId", "context", "team", true), field("path", "requestId", "argument", "request", true)]),
+  "providers requests reject": operation("providers.requests.reject", [field("path", "teamId", "context", "team", true), field("path", "requestId", "argument", "request", true)]),
+  "providers credentials status": operation("providers.credentials.status", [field("path", "teamId", "context", "team", true), field("path", "connectionId", "argument", "connection", true)]),
+  "providers credentials rotate": operation("providers.credentials.rotate", [field("path", "teamId", "context", "team", true), field("path", "connectionId", "argument", "connection", true)]),
+  "providers credentials revoke": operation("providers.credentials.revoke", [field("path", "teamId", "context", "team", true), field("path", "connectionId", "argument", "connection", true)]),
+  "capacity status": operation("capacity.status", [field("path", "teamId", "context", "team", true), ...page()]),
+  "capacity explain": operation("capacity.explain", [field("path", "teamId", "context", "team", true)]),
+  "capacity usage": operation("capacity.usage", [field("path", "teamId", "context", "team", true)]),
+  "capacity ledger": operation("capacity.ledger", [field("path", "teamId", "context", "team", true), ...page()]),
+  "capacity audit": operation("capacity.audit", [field("path", "teamId", "context", "team", true), ...page()]),
+  "seeds validate": operation("seeds.validate", [field("body", "file", "argument", "file", true)]),
+  "seeds plan": operation("seeds.plan", [field("path", "name", "context", "seed", true), field("body", "file", "argument", "file", true)]),
+  "seeds apply": operation("seeds.apply", [field("path", "name", "context", "seed", true), field("body", "file", "argument", "file", true)]),
+  "seeds show": operation("seeds.show", [field("path", "name", "argument", "seed", true)]),
+  "seeds verify": operation("seeds.verify", [field("path", "name", "argument", "seed", true)]),
+  "plans list": operation("plans.list", [field("path", "decisionId", "option", "decision", true), ...page()]),
+  "plans show": operation("plans.show", [field("path", "capacityPlanId", "argument", "plan", true)]),
+  "workdays plan": operation("workdays.plan", [field("path", "teamId", "context", "team", true), field("body", "profile", "option"), field("body", "projects", "option", "projects", false, "csv"), field("body", "start", "option"), field("body", "end", "option"), field("body", "duration", "option", "duration", false, "integer"), field("body", "objective", "option")]),
+  "workdays start": operation("workdays.start", [field("path", "teamId", "context", "team", true), field("body", "preflightId", "option", "preflight", true), field("body", "digest", "option", "digest", true)]),
+  "workdays list": operation("workdays.list", [field("path", "teamId", "context", "team", true), ...page()]),
+  "workdays show": operation("workdays.show", [field("path", "teamId", "context", "team", true), field("path", "runId", "argument", "workday", true)]),
+  "workdays schedules list": operation("workdays.schedules.list", [field("path", "teamId", "context", "team", true)]),
+  "workdays schedules start": operation("workdays.schedules.create", [field("path", "teamId", "context", "team", true), field("body", "profile", "option"), field("body", "projects", "option", "projects", false, "csv"), field("body", "duration", "option", "duration", false, "integer")]),
+  "assignments list": operation("assignments.list", [field("path", "teamId", "context", "team", true), ...page()]),
+  "assignments show": operation("assignments.show", [field("path", "teamId", "context", "team", true), field("path", "assignmentId", "argument", "assignment", true)]),
+  "assignments explain": operation("assignments.explain", [field("path", "teamId", "context", "team", true), field("path", "assignmentId", "argument", "assignment", true)]),
+  "assignments retry": operation("assignments.retry", [field("path", "teamId", "context", "team", true), field("path", "assignmentId", "argument", "assignment", true), field("body", "reason", "option")]),
+  "assignments cancel": operation("assignments.cancel", [field("path", "teamId", "context", "team", true), field("path", "assignmentId", "argument", "assignment", true), field("body", "reason", "option")]),
+  "projects treedx show": operation("treedx.library.show", [field("path", "projectId", "argument", "project", true)]),
+  "projects treedx bind": operation("treedx.library.bind", [field("path", "projectId", "argument", "project", true), field("body", "connectionId", "option", "connection", true)]),
+  "projects treedx status": operation("treedx.health.show", [field("path", "projectId", "argument", "project", true)]),
+  "projects treedx diagnose": operation("treedx.service.contract", [field("path", "projectId", "argument", "project", true)]),
+  "projects treedx capabilities": operation("treedx.capabilities.list", [field("path", "projectId", "argument", "project", true)]),
+  "projects treedx workspaces list": operation("treedx.workspaces.list", [field("path", "projectId", "argument", "project", true), ...page()]),
+  "projects treedx workspaces show": operation("treedx.workspaces.show", [field("path", "projectId", "context", "project", true), field("path", "workspaceId", "argument", "workspace", true)]),
+  "projects treedx workspaces abandon": operation("treedx.workspaces.abandon", [field("path", "projectId", "context", "project", true), field("path", "workspaceId", "argument", "workspace", true)]),
+  "status": operation("status.show"),
+  "save": unavailable("Unified GitHub-backed save is intentionally fail-closed during this cutover."),
+  "stage": unavailable("Unified GitHub-backed stage is intentionally fail-closed during this cutover."),
+  "release": unavailable("Production release is intentionally fail-closed during this cutover.")
+};
 const planOption = { name: "--plan", description: "Return the exact proposed outcome without mutation.", type: "boolean" };
 function leaf(segment, kind = "read", argument, confirmation = "never") {
   const value = {
@@ -7,14 +79,15 @@ function leaf(segment, kind = "read", argument, confirmation = "never") {
     arguments: argument ? [{ name: argument, description: `${argument} identity or path.`, required: true }] : void 0,
     options: kind === "mutation" ? [planOption] : void 0,
     authorization: kind === "mutation" ? { capability: `command.${segment}`, confirmation } : void 0,
-    resultSchemaId: `treeseed.command.${segment}/v1`
+    resultSchemaId: `treeseed.command.${segment}/v1`,
+    execution: unavailable()
   };
   return { nodeType: "leaf", ...value };
 }
 function branch(segment, children) {
   return { nodeType: "branch", segment, description: `${segment[0].toUpperCase()}${segment.slice(1)} operations.`, children };
 }
-const TREESEED_COMMAND_TREE_V1 = {
+const commandTree = {
   schemaVersion: "treeseed.command-tree/v1",
   executable: "trsd",
   commands: [
@@ -40,11 +113,12 @@ const TREESEED_COMMAND_TREE_V1 = {
       branch("credentials", [leaf("status", "read", "connection"), leaf("rotate", "mutation", "connection", "credential"), leaf("revoke", "mutation", "connection", "irreversible")]),
       branch("offers", [leaf("show", "read", "connection"), leaf("validate", "read", "file"), leaf("plan", "read", "file"), leaf("apply", "mutation", "file", "authority")])
     ]),
+    branch("seeds", [leaf("validate", "read", "file"), leaf("plan", "read", "file"), leaf("apply", "mutation", "file", "authority"), leaf("show", "read", "seed"), leaf("verify", "read", "seed")]),
     branch("capacity", [leaf("status"), leaf("explain"), leaf("usage"), leaf("ledger"), leaf("audit")]),
-    branch("plans", [leaf("list"), leaf("show", "read", "plan"), leaf("explain", "read", "plan"), { nodeType: "leaf", segment: "diff", description: "Compare two API-derived plans.", kind: "read", arguments: [{ name: "left", description: "Left plan identity.", required: true }, { name: "right", description: "Right plan identity.", required: true }], resultSchemaId: "treeseed.command.plans.diff/v1" }]),
+    branch("plans", [leaf("list"), leaf("show", "read", "plan"), leaf("explain", "read", "plan"), { nodeType: "leaf", segment: "diff", description: "Compare two API-derived plans.", kind: "read", arguments: [{ name: "left", description: "Left plan identity.", required: true }, { name: "right", description: "Right plan identity.", required: true }], resultSchemaId: "treeseed.command.plans.diff/v1", execution: unavailable() }]),
     branch("workdays", [
       branch("profiles", [leaf("list"), leaf("show", "read", "profile"), leaf("validate", "read", "file")]),
-      leaf("plan"),
+      leaf("plan", "mutation"),
       leaf("start", "mutation", void 0, "authority"),
       leaf("list"),
       leaf("show", "read", "workday"),
@@ -56,6 +130,14 @@ const TREESEED_COMMAND_TREE_V1 = {
       branch("schedules", [leaf("list"), leaf("show", "read", "schedule"), leaf("plan"), leaf("start", "mutation", void 0, "authority"), leaf("pause", "mutation", "schedule", "authority"), leaf("resume", "mutation", "schedule", "authority"), leaf("retire", "mutation", "schedule", "destructive")])
     ]),
     branch("assignments", [leaf("list"), leaf("show", "read", "assignment"), leaf("explain", "read", "assignment"), leaf("watch", "read", "assignment"), leaf("retry", "mutation", "assignment", "authority"), leaf("cancel", "mutation", "assignment", "destructive"), leaf("artifacts", "read", "assignment")]),
+    branch("projects", [branch("treedx", [
+      leaf("show", "read", "project"),
+      leaf("bind", "mutation", "project"),
+      leaf("status", "read", "project"),
+      leaf("diagnose", "read", "project"),
+      leaf("capabilities", "read", "project"),
+      branch("workspaces", [leaf("list", "read", "project"), leaf("show", "read", "workspace"), leaf("abandon", "mutation", "workspace", "destructive")])
+    ])]),
     leaf("save", "mutation"),
     leaf("stage", "mutation", void 0, "authority"),
     leaf("release", "mutation", void 0, "production"),
@@ -63,6 +145,15 @@ const TREESEED_COMMAND_TREE_V1 = {
     leaf("diagnose")
   ]
 };
+function attachExecution(nodes, parent = []) {
+  for (const node of nodes) {
+    const path = [...parent, node.segment];
+    if (node.nodeType === "branch") attachExecution(node.children, path);
+    else node.execution = operationBindings[path.join(" ")] ?? node.execution;
+  }
+}
+attachExecution(commandTree.commands);
+const TREESEED_COMMAND_TREE_V1 = commandTree;
 function listCommandPaths(tree = TREESEED_COMMAND_TREE_V1) {
   const paths = [];
   const visit = (nodes, parent) => {

package/dist/operator-contracts/command-tree.d.ts

@@ -1,3 +1,4 @@
+import type { ControlPlaneOperationBinding } from './control-plane-operation.js';
 export type CommandOperationKind = 'read' | 'mutation';
 export type CommandExecutionMode = 'execute' | 'plan';
 export type CommandErrorCategory = 'unknown_command' | 'invalid_input' | 'ambiguous_context' | 'authentication_required' | 'authorization_denied' | 'confirmation_required' | 'policy_blocked' | 'stale_preflight' | 'conflict' | 'not_found' | 'provider_unavailable' | 'rate_limited' | 'internal_error';
@@ -19,6 +20,31 @@ export interface CommandAuthorizationDescriptor {
     capability: string;
     confirmation: 'never' | 'destructive' | 'credential' | 'authority' | 'production' | 'irreversible';
 }
+export type CommandInputSource = 'argument' | 'context' | 'option';
+export type CommandInputTarget = 'path' | 'query' | 'body';
+export interface CommandInputBinding {
+    field: string;
+    source: CommandInputSource;
+    name: string;
+    target: CommandInputTarget;
+    required?: boolean;
+    transform?: 'identity' | 'integer' | 'csv';
+}
+export type CommandExecutionBinding = {
+    kind: 'operation';
+    operationId: `${string}.${string}`;
+    input: CommandInputBinding[];
+} | {
+    kind: 'protocol';
+    handlerId: `protocol.${string}`;
+} | {
+    kind: 'local';
+    handlerId: `local.${string}`;
+} | {
+    kind: 'unavailable';
+    code: string;
+    reason: string;
+};
 export interface CommandLeafDescriptor {
     segment: string;
     description: string;
@@ -27,6 +53,7 @@ export interface CommandLeafDescriptor {
     options?: CommandOptionDescriptor[];
     authorization?: CommandAuthorizationDescriptor;
     resultSchemaId: string;
+    execution: CommandExecutionBinding;
 }
 export interface CommandBranchDescriptor {
     segment: string;
@@ -76,4 +103,5 @@ export interface CommandTreeDiagnostic {
     message: string;
 }
 export declare function validateCommandTree(tree: CommandTreeDescriptor): CommandTreeDiagnostic[];
+export declare function validateCommandOperationBindings(tree: CommandTreeDescriptor, operations: readonly ControlPlaneOperationBinding<any, any, any, any>[]): CommandTreeDiagnostic[];
 export declare function createCommandResult<TResult>(input: Omit<CommandResultEnvelope<TResult>, 'schemaVersion'>): CommandResultEnvelope<TResult>;

package/dist/operator-contracts/command-tree.js

@@ -1,3 +1,4 @@
+import { ZodUndefined } from "zod";
 const SEGMENT = /^[a-z][a-z0-9]*$/;
 const FORBIDDEN_AGENT_MANAGEMENT_OPTIONS = /* @__PURE__ */ new Set([
   "--commit",
@@ -31,6 +32,17 @@ function validateCommandTree(tree) {
       }
       if ("children" in raw) diagnostics.push({ code: "command_node_ambiguous", path: diagnosticPath, message: "Leaf command nodes cannot contain child commands." });
       if (!node.resultSchemaId.trim()) diagnostics.push({ code: "result_schema_required", path: `${diagnosticPath}.resultSchemaId`, message: "Leaf commands require a stable result schema." });
+      if (!node.execution) diagnostics.push({ code: "command_execution_required", path: `${diagnosticPath}.execution`, message: "Every leaf must declare one authoritative execution binding." });
+      if (node.execution?.kind === "operation") {
+        const targets = /* @__PURE__ */ new Set();
+        for (const binding of node.execution.input) {
+          const key = `${binding.target}.${binding.field}`;
+          if (targets.has(key)) diagnostics.push({ code: "command_input_target_duplicate", path: `${diagnosticPath}.execution.input`, message: `Duplicate command input target ${key}.` });
+          targets.add(key);
+          if (!binding.field.trim() || !binding.name.trim()) diagnostics.push({ code: "command_input_binding_invalid", path: `${diagnosticPath}.execution.input`, message: "Command input bindings require field and source names." });
+        }
+      }
+      if (node.execution?.kind === "unavailable" && (!node.execution.code.trim() || !node.execution.reason.trim())) diagnostics.push({ code: "command_unavailable_reason_required", path: `${diagnosticPath}.execution`, message: "Unavailable commands require a stable code and explanation." });
       const optionNames = /* @__PURE__ */ new Set();
       for (const option of node.options ?? []) {
         if (optionNames.has(option.name)) diagnostics.push({ code: "command_option_duplicate", path: `${diagnosticPath}.options.${index}`, message: `Duplicate option ${option.name}.` });
@@ -44,10 +56,47 @@ function validateCommandTree(tree) {
   visit(tree.commands, []);
   return diagnostics;
 }
+function validateCommandOperationBindings(tree, operations) {
+  const diagnostics = [];
+  const catalog = new Map(operations.map((operation) => [operation.descriptor.operationId, operation]));
+  const visit = (nodes, parent) => {
+    for (const node of nodes) {
+      const path = [...parent, node.segment];
+      if (node.nodeType === "branch") {
+        visit(node.children, path);
+        continue;
+      }
+      if (node.execution.kind !== "operation") continue;
+      const binding = catalog.get(node.execution.operationId);
+      const diagnosticPath = `commands.${path.join(".")}.execution`;
+      if (!binding) {
+        diagnostics.push({ code: "command_operation_unknown", path: diagnosticPath, message: `Unknown control-plane operation ${node.execution.operationId}.` });
+        continue;
+      }
+      if (!binding.descriptor.surfaces.includes("cli")) diagnostics.push({ code: "command_operation_surface_missing", path: diagnosticPath, message: `Operation ${node.execution.operationId} does not declare the CLI surface.` });
+      if (binding.descriptor.kind !== node.kind) diagnostics.push({ code: "command_operation_kind_mismatch", path: diagnosticPath, message: `Command and operation ${node.execution.operationId} disagree about mutation behavior.` });
+      const expectedConfirmation = binding.descriptor.confirmation === "input_required" ? binding.descriptor.riskClass : "never";
+      if ((node.authorization?.confirmation ?? "never") !== expectedConfirmation) diagnostics.push({ code: "command_operation_confirmation_mismatch", path: diagnosticPath, message: `Command and operation ${node.execution.operationId} disagree about confirmation.` });
+      const shapes = {
+        path: "shape" in binding.schema.path ? Object.keys(binding.schema.path.shape) : null,
+        query: "shape" in binding.schema.query ? Object.keys(binding.schema.query.shape) : null,
+        body: "shape" in binding.schema.body ? Object.keys(binding.schema.body.shape) : null
+      };
+      for (const input of node.execution.input) {
+        const keys = shapes[input.target];
+        const undefinedSchema = binding.schema[input.target] instanceof ZodUndefined;
+        if (keys !== null && !keys.includes(input.field) || undefinedSchema) diagnostics.push({ code: "command_operation_input_unknown", path: `${diagnosticPath}.input.${input.target}.${input.field}`, message: `Operation ${node.execution.operationId} does not accept ${input.target} field ${input.field}.` });
+      }
+    }
+  };
+  visit(tree.commands, []);
+  return diagnostics.sort((left, right) => `${left.path}:${left.code}`.localeCompare(`${right.path}:${right.code}`));
+}
 function createCommandResult(input) {
   return { schemaVersion: "treeseed.command-result/v1", ...input };
 }
 export {
   createCommandResult,
+  validateCommandOperationBindings,
   validateCommandTree
 };