@treeseed/sdk 0.13.0-rc.53 → 0.13.0-rc.55

package/dist/agent-capacity/validation/agent-lab-forensics-schema.d.ts

@@ -19,9 +19,9 @@ export declare const agentActivityQuerySchema: z.ZodObject<{
     type?: string | string[] | undefined;
     limit?: number | undefined;
     agent?: string | string[] | undefined;
+    after?: number | undefined;
     agentClass?: string | string[] | undefined;
     severity?: string | string[] | undefined;
-    after?: number | undefined;
 }>;
 export declare const agentActivityPageSchema: z.ZodObject<{
     items: z.ZodArray<z.ZodType<AgentActivityEvent, z.ZodTypeDef, AgentActivityEvent>, "many">;

package/dist/capacity-provider/client.d.ts

@@ -45,13 +45,28 @@ export declare class ProviderProtocolClient {
     startAssignmentCloseout(assignmentId: string, request: Record<string, unknown>): Promise<Record<string, unknown>>;
     preflightAssignmentCompletion(assignmentId: string, request: Record<string, unknown>): Promise<Record<string, unknown>>;
     respondToAssignmentDiscussion(assignmentId: string, request: ProviderDiscussionResponseRequest, idempotencyKey: string): Promise<{
-        status: "responded" | "abstained";
-        schemaVersion: "treeseed.provider-discussion-response-receipt/v1";
-        assignmentId: string;
         invocationId: string;
+        assignmentId: string;
+        schemaVersion: "treeseed.provider-discussion-response-receipt/v1";
+        status: "responded" | "abstained";
         messageRef: string;
         settledAt: string;
     }>;
+    acknowledgeCommunicationNotification(assignmentId: string, request: {
+        providerId: string;
+        runnerId: string;
+        observedAt: string;
+    }): Promise<Record<string, unknown>>;
+    createCommunicationTraceEvent(assignmentId: string, request: {
+        leaseToken: string;
+        runnerId: string;
+        sequence: number;
+        type: string;
+        occurredAt: string;
+        summary: string;
+        payload: Record<string, unknown>;
+        protectedPayload?: Record<string, unknown>;
+    }): Promise<Record<string, unknown>>;
     returnAssignment(assignmentId: string, request?: ProviderAssignmentLifecycleRequest): Promise<ProviderAssignmentLifecycleResult>;
     completeAssignment(assignmentId: string, request?: ProviderAssignmentLifecycleRequest): Promise<ProviderAssignmentLifecycleResult>;
     failAssignment(assignmentId: string, request?: ProviderAssignmentLifecycleRequest): Promise<ProviderAssignmentLifecycleResult>;

package/dist/capacity-provider/client.js

@@ -129,6 +129,12 @@ class ProviderProtocolClient {
   respondToAssignmentDiscussion(assignmentId, request, idempotencyKey) {
     return this.invoke(CONTROL_PLANE_OPERATIONS.providers.discussionResponse, { path: { assignmentId }, body: request }, { idempotencyKey });
   }
+  acknowledgeCommunicationNotification(assignmentId, request) {
+    return this.invoke(CONTROL_PLANE_OPERATIONS.providers.notificationAcknowledge, { path: { assignmentId }, body: request });
+  }
+  createCommunicationTraceEvent(assignmentId, request) {
+    return this.invoke(CONTROL_PLANE_OPERATIONS.providers.traceEvent, { path: { assignmentId }, body: request });
+  }
   returnAssignment(assignmentId, request = {}) {
     return this.invoke(CONTROL_PLANE_OPERATIONS.providers.returnAssignment, { path: { assignmentId }, body: request });
   }

package/dist/capacity-provider/contracts/governance.d.ts

@@ -285,7 +285,7 @@ export type MinimumAssignmentDuration = {
 export interface ProviderExecutionAdapterSnapshot {
     id: string;
     adapter: string;
-    isolation: 'process' | 'worker';
+    isolation: 'microvm' | 'process' | 'worker';
     status: 'available' | 'degraded' | 'unavailable';
     capabilities: string[];
     laneIds: string[];
@@ -421,3 +421,30 @@ export interface CapacityProviderManifestV3 {
     connections: ProviderConnectionConfig[];
     metadata?: Record<string, unknown>;
 }
+export interface CapacityProviderSandboxProfile {
+    id: 'read' | 'unit' | 'integration' | 'platform' | 'connected' | string;
+    guestImage: string;
+    guestImageDigest: string;
+    defaultDenyNetwork: true;
+    resources: {
+        cpuCores: number;
+        memoryBytes: number;
+        diskBytes: number;
+        processLimit: number;
+        outputBytes: number;
+    };
+}
+export interface CapacityProviderManifestV4 extends Omit<CapacityProviderManifestV3, 'schemaVersion' | 'adapters'> {
+    schemaVersion: 4;
+    sandbox: {
+        required: true;
+        brokerSocket: string;
+        runtime: 'kata-runtime-rs-qemu';
+        profiles: CapacityProviderSandboxProfile[];
+    };
+    adapters: Array<Omit<CapacityProviderManifestV3['adapters'][number], 'isolation'> & {
+        isolation: 'microvm' | 'process' | 'worker';
+        sandboxProfileIds?: string[];
+    }>;
+}
+export type CapacityProviderManifest = CapacityProviderManifestV3 | CapacityProviderManifestV4;

package/dist/capacity-provider/index.d.ts

@@ -1,3 +1,4 @@
 export * from './client.js';
 export * from './contracts/index.js';
 export * from './validation.js';
+export * from './sandbox-contracts.js';

package/dist/capacity-provider/index.js

@@ -1,3 +1,4 @@
 export * from "./client.js";
 export * from "./contracts/index.js";
 export * from "./validation.js";
+export * from "./sandbox-contracts.js";

package/dist/capacity-provider/sandbox-contracts.d.ts

@@ -0,0 +1,422 @@
+import { z } from 'zod';
+declare const sandboxProfile: z.ZodEnum<["read", "unit", "integration", "platform", "connected"]>;
+export declare const sandboxAssignmentSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.sandbox-assignment/v1">;
+    assignmentId: z.ZodString;
+    attempt: z.ZodNumber;
+    runnerId: z.ZodString;
+    providerId: z.ZodString;
+    teamId: z.ZodString;
+    projectId: z.ZodString;
+    profile: z.ZodEnum<["read", "unit", "integration", "platform", "connected"]>;
+    guestImage: z.ZodString;
+    guestImageDigest: z.ZodString;
+    identityManifestDigest: z.ZodString;
+    contextManifestDigest: z.ZodString;
+    resources: z.ZodObject<{
+        cpuCores: z.ZodNumber;
+        memoryBytes: z.ZodNumber;
+        diskBytes: z.ZodNumber;
+        durationSeconds: z.ZodNumber;
+        processLimit: z.ZodNumber;
+        outputBytes: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        cpuCores: number;
+        memoryBytes: number;
+        diskBytes: number;
+        durationSeconds: number;
+        processLimit: number;
+        outputBytes: number;
+    }, {
+        cpuCores: number;
+        memoryBytes: number;
+        diskBytes: number;
+        durationSeconds: number;
+        processLimit: number;
+        outputBytes: number;
+    }>;
+    inputs: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        digest: z.ZodString;
+        bytes: z.ZodNumber;
+        disposition: z.ZodEnum<["read-only", "copy-on-write"]>;
+        mediaType: z.ZodString;
+        targetPath: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        mediaType: string;
+        digest: string;
+        bytes: number;
+        disposition: "read-only" | "copy-on-write";
+        targetPath: string;
+    }, {
+        id: string;
+        mediaType: string;
+        digest: string;
+        bytes: number;
+        disposition: "read-only" | "copy-on-write";
+        targetPath: string;
+    }>, "many">;
+    outputs: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        path: z.ZodString;
+        mediaType: z.ZodString;
+        maxBytes: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        path: string;
+        id: string;
+        mediaType: string;
+        maxBytes: number;
+    }, {
+        path: string;
+        id: string;
+        mediaType: string;
+        maxBytes: number;
+    }>, "many">;
+    network: z.ZodObject<{
+        defaultDeny: z.ZodLiteral<true>;
+        relayUrl: z.ZodString;
+        allowedServices: z.ZodArray<z.ZodString, "many">;
+        connectedDevelopmentSessionId: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        defaultDeny: true;
+        relayUrl: string;
+        allowedServices: string[];
+        connectedDevelopmentSessionId?: string | undefined;
+    }, {
+        defaultDeny: true;
+        relayUrl: string;
+        allowedServices: string[];
+        connectedDevelopmentSessionId?: string | undefined;
+    }>;
+    modelPolicy: z.ZodObject<{
+        provider: z.ZodString;
+        model: z.ZodString;
+        capabilities: z.ZodArray<z.ZodString, "many">;
+        maxInputTokens: z.ZodOptional<z.ZodNumber>;
+        maxOutputTokens: z.ZodOptional<z.ZodNumber>;
+        maxCost: z.ZodOptional<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+        provider: string;
+        capabilities: string[];
+        model: string;
+        maxInputTokens?: number | undefined;
+        maxOutputTokens?: number | undefined;
+        maxCost?: number | undefined;
+    }, {
+        provider: string;
+        capabilities: string[];
+        model: string;
+        maxInputTokens?: number | undefined;
+        maxOutputTokens?: number | undefined;
+        maxCost?: number | undefined;
+    }>;
+    credentialHandles: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        profileId: z.ZodString;
+        revealAllowed: z.ZodLiteral<false>;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        profileId: string;
+        revealAllowed: false;
+    }, {
+        id: string;
+        profileId: string;
+        revealAllowed: false;
+    }>, "many">;
+    treeDxHandleIds: z.ZodArray<z.ZodString, "many">;
+    leaseExpiresAt: z.ZodString;
+    signature: z.ZodObject<{
+        keyId: z.ZodString;
+        algorithm: z.ZodLiteral<"Ed25519">;
+        value: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        value: string;
+        algorithm: "Ed25519";
+        keyId: string;
+    }, {
+        value: string;
+        algorithm: "Ed25519";
+        keyId: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    teamId: string;
+    assignmentId: string;
+    schemaVersion: "treeseed.sandbox-assignment/v1";
+    outputs: {
+        path: string;
+        id: string;
+        mediaType: string;
+        maxBytes: number;
+    }[];
+    resources: {
+        cpuCores: number;
+        memoryBytes: number;
+        diskBytes: number;
+        durationSeconds: number;
+        processLimit: number;
+        outputBytes: number;
+    };
+    projectId: string;
+    profile: "read" | "unit" | "integration" | "platform" | "connected";
+    network: {
+        defaultDeny: true;
+        relayUrl: string;
+        allowedServices: string[];
+        connectedDevelopmentSessionId?: string | undefined;
+    };
+    guestImage: string;
+    guestImageDigest: string;
+    providerId: string;
+    runnerId: string;
+    leaseExpiresAt: string;
+    attempt: number;
+    identityManifestDigest: string;
+    contextManifestDigest: string;
+    inputs: {
+        id: string;
+        mediaType: string;
+        digest: string;
+        bytes: number;
+        disposition: "read-only" | "copy-on-write";
+        targetPath: string;
+    }[];
+    modelPolicy: {
+        provider: string;
+        capabilities: string[];
+        model: string;
+        maxInputTokens?: number | undefined;
+        maxOutputTokens?: number | undefined;
+        maxCost?: number | undefined;
+    };
+    credentialHandles: {
+        id: string;
+        profileId: string;
+        revealAllowed: false;
+    }[];
+    treeDxHandleIds: string[];
+    signature: {
+        value: string;
+        algorithm: "Ed25519";
+        keyId: string;
+    };
+}, {
+    teamId: string;
+    assignmentId: string;
+    schemaVersion: "treeseed.sandbox-assignment/v1";
+    outputs: {
+        path: string;
+        id: string;
+        mediaType: string;
+        maxBytes: number;
+    }[];
+    resources: {
+        cpuCores: number;
+        memoryBytes: number;
+        diskBytes: number;
+        durationSeconds: number;
+        processLimit: number;
+        outputBytes: number;
+    };
+    projectId: string;
+    profile: "read" | "unit" | "integration" | "platform" | "connected";
+    network: {
+        defaultDeny: true;
+        relayUrl: string;
+        allowedServices: string[];
+        connectedDevelopmentSessionId?: string | undefined;
+    };
+    guestImage: string;
+    guestImageDigest: string;
+    providerId: string;
+    runnerId: string;
+    leaseExpiresAt: string;
+    attempt: number;
+    identityManifestDigest: string;
+    contextManifestDigest: string;
+    inputs: {
+        id: string;
+        mediaType: string;
+        digest: string;
+        bytes: number;
+        disposition: "read-only" | "copy-on-write";
+        targetPath: string;
+    }[];
+    modelPolicy: {
+        provider: string;
+        capabilities: string[];
+        model: string;
+        maxInputTokens?: number | undefined;
+        maxOutputTokens?: number | undefined;
+        maxCost?: number | undefined;
+    };
+    credentialHandles: {
+        id: string;
+        profileId: string;
+        revealAllowed: false;
+    }[];
+    treeDxHandleIds: string[];
+    signature: {
+        value: string;
+        algorithm: "Ed25519";
+        keyId: string;
+    };
+}>;
+export declare const sandboxEventSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.sandbox-event/v1">;
+    sandboxId: z.ZodString;
+    assignmentId: z.ZodString;
+    sequence: z.ZodNumber;
+    occurredAt: z.ZodString;
+    type: z.ZodEnum<["sandbox.created", "sandbox.ready", "execution.started", "execution.progress", "tool.requested", "tool.completed", "execution.completed", "execution.failed", "sandbox.destroyed"]>;
+    payload: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strict", z.ZodTypeAny, {
+    assignmentId: string;
+    sequence: number;
+    schemaVersion: "treeseed.sandbox-event/v1";
+    type: "sandbox.created" | "sandbox.ready" | "execution.started" | "execution.progress" | "tool.requested" | "tool.completed" | "execution.completed" | "execution.failed" | "sandbox.destroyed";
+    payload: Record<string, unknown>;
+    occurredAt: string;
+    sandboxId: string;
+}, {
+    assignmentId: string;
+    sequence: number;
+    schemaVersion: "treeseed.sandbox-event/v1";
+    type: "sandbox.created" | "sandbox.ready" | "execution.started" | "execution.progress" | "tool.requested" | "tool.completed" | "execution.completed" | "execution.failed" | "sandbox.destroyed";
+    occurredAt: string;
+    sandboxId: string;
+    payload?: Record<string, unknown> | undefined;
+}>;
+export declare const sandboxLeaseRenewalSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.sandbox-lease-renewal/v1">;
+    sandboxId: z.ZodString;
+    assignmentId: z.ZodString;
+    providerId: z.ZodString;
+    teamId: z.ZodString;
+    leaseExpiresAt: z.ZodString;
+    issuedAt: z.ZodString;
+    signature: z.ZodObject<{
+        keyId: z.ZodString;
+        algorithm: z.ZodLiteral<"Ed25519">;
+        value: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        value: string;
+        algorithm: "Ed25519";
+        keyId: string;
+    }, {
+        value: string;
+        algorithm: "Ed25519";
+        keyId: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    teamId: string;
+    assignmentId: string;
+    schemaVersion: "treeseed.sandbox-lease-renewal/v1";
+    providerId: string;
+    leaseExpiresAt: string;
+    issuedAt: string;
+    signature: {
+        value: string;
+        algorithm: "Ed25519";
+        keyId: string;
+    };
+    sandboxId: string;
+}, {
+    teamId: string;
+    assignmentId: string;
+    schemaVersion: "treeseed.sandbox-lease-renewal/v1";
+    providerId: string;
+    leaseExpiresAt: string;
+    issuedAt: string;
+    signature: {
+        value: string;
+        algorithm: "Ed25519";
+        keyId: string;
+    };
+    sandboxId: string;
+}>;
+export declare const sandboxResultSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.sandbox-result/v1">;
+    sandboxId: z.ZodString;
+    assignmentId: z.ZodString;
+    status: z.ZodEnum<["completed", "failed", "cancelled", "expired"]>;
+    summary: z.ZodString;
+    responseMarkdown: z.ZodOptional<z.ZodString>;
+    artifacts: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        path: z.ZodString;
+        digest: z.ZodString;
+        mediaType: z.ZodString;
+        bytes: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        path: string;
+        id: string;
+        mediaType: string;
+        digest: string;
+        bytes: number;
+    }, {
+        path: string;
+        id: string;
+        mediaType: string;
+        digest: string;
+        bytes: number;
+    }>, "many">;
+    usage: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    diagnostics: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    teardown: z.ZodObject<{
+        verified: z.ZodBoolean;
+        completedAt: z.ZodNullable<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        completedAt: string | null;
+        verified: boolean;
+    }, {
+        completedAt: string | null;
+        verified: boolean;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    assignmentId: string;
+    schemaVersion: "treeseed.sandbox-result/v1";
+    status: "expired" | "failed" | "completed" | "cancelled";
+    artifacts: {
+        path: string;
+        id: string;
+        mediaType: string;
+        digest: string;
+        bytes: number;
+    }[];
+    summary: string;
+    usage: Record<string, unknown>;
+    diagnostics: Record<string, unknown>;
+    sandboxId: string;
+    teardown: {
+        completedAt: string | null;
+        verified: boolean;
+    };
+    responseMarkdown?: string | undefined;
+}, {
+    assignmentId: string;
+    schemaVersion: "treeseed.sandbox-result/v1";
+    status: "expired" | "failed" | "completed" | "cancelled";
+    artifacts: {
+        path: string;
+        id: string;
+        mediaType: string;
+        digest: string;
+        bytes: number;
+    }[];
+    summary: string;
+    sandboxId: string;
+    teardown: {
+        completedAt: string | null;
+        verified: boolean;
+    };
+    usage?: Record<string, unknown> | undefined;
+    diagnostics?: Record<string, unknown> | undefined;
+    responseMarkdown?: string | undefined;
+}>;
+export type SandboxAssignment = z.infer<typeof sandboxAssignmentSchema>;
+export type SandboxEvent = z.infer<typeof sandboxEventSchema>;
+export type SandboxLeaseRenewal = z.infer<typeof sandboxLeaseRenewalSchema>;
+export type SandboxResult = z.infer<typeof sandboxResultSchema>;
+export type SandboxEnvironmentProfile = z.infer<typeof sandboxProfile>;
+export {};

package/dist/capacity-provider/sandbox-contracts.js

@@ -0,0 +1,71 @@
+import { z } from "zod";
+const identifier = z.string().regex(/^[a-z][a-z0-9._-]{0,127}$/u);
+const digest = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+const sandboxProfile = z.enum(["read", "unit", "integration", "platform", "connected"]);
+const sandboxAssignmentSchema = z.object({
+  schemaVersion: z.literal("treeseed.sandbox-assignment/v1"),
+  assignmentId: z.string().min(1),
+  attempt: z.number().int().positive(),
+  runnerId: z.string().min(1),
+  providerId: z.string().min(1),
+  teamId: z.string().min(1),
+  projectId: z.string().min(1),
+  profile: sandboxProfile,
+  guestImage: z.string().min(1),
+  guestImageDigest: digest,
+  identityManifestDigest: digest,
+  contextManifestDigest: digest,
+  resources: z.object({
+    cpuCores: z.number().positive(),
+    memoryBytes: z.number().int().positive(),
+    diskBytes: z.number().int().positive(),
+    durationSeconds: z.number().int().positive(),
+    processLimit: z.number().int().positive(),
+    outputBytes: z.number().int().positive()
+  }).strict(),
+  inputs: z.array(z.object({ id: identifier, digest, bytes: z.number().int().nonnegative(), disposition: z.enum(["read-only", "copy-on-write"]), mediaType: z.string().min(1), targetPath: z.string().startsWith("/workspace/") }).strict()),
+  outputs: z.array(z.object({ id: identifier, path: z.string().startsWith("/run/treeseed-output/"), mediaType: z.string().min(1), maxBytes: z.number().int().positive() }).strict()),
+  network: z.object({ defaultDeny: z.literal(true), relayUrl: z.string().url().startsWith("https://"), allowedServices: z.array(identifier), connectedDevelopmentSessionId: z.string().min(1).optional() }).strict(),
+  modelPolicy: z.object({ provider: identifier, model: z.string().min(1), capabilities: z.array(identifier), maxInputTokens: z.number().int().positive().optional(), maxOutputTokens: z.number().int().positive().optional(), maxCost: z.number().nonnegative().optional() }).strict(),
+  credentialHandles: z.array(z.object({ id: identifier, profileId: identifier, revealAllowed: z.literal(false) }).strict()),
+  treeDxHandleIds: z.array(z.string().min(1)),
+  leaseExpiresAt: z.string().datetime(),
+  signature: z.object({ keyId: identifier, algorithm: z.literal("Ed25519"), value: z.string().min(1) }).strict()
+}).strict();
+const sandboxEventSchema = z.object({
+  schemaVersion: z.literal("treeseed.sandbox-event/v1"),
+  sandboxId: z.string().min(1),
+  assignmentId: z.string().min(1),
+  sequence: z.number().int().nonnegative(),
+  occurredAt: z.string().datetime(),
+  type: z.enum(["sandbox.created", "sandbox.ready", "execution.started", "execution.progress", "tool.requested", "tool.completed", "execution.completed", "execution.failed", "sandbox.destroyed"]),
+  payload: z.record(z.unknown()).default({})
+}).strict();
+const sandboxLeaseRenewalSchema = z.object({
+  schemaVersion: z.literal("treeseed.sandbox-lease-renewal/v1"),
+  sandboxId: z.string().min(1),
+  assignmentId: z.string().min(1),
+  providerId: z.string().min(1),
+  teamId: z.string().min(1),
+  leaseExpiresAt: z.string().datetime(),
+  issuedAt: z.string().datetime(),
+  signature: z.object({ keyId: identifier, algorithm: z.literal("Ed25519"), value: z.string().min(1) }).strict()
+}).strict();
+const sandboxResultSchema = z.object({
+  schemaVersion: z.literal("treeseed.sandbox-result/v1"),
+  sandboxId: z.string().min(1),
+  assignmentId: z.string().min(1),
+  status: z.enum(["completed", "failed", "cancelled", "expired"]),
+  summary: z.string(),
+  responseMarkdown: z.string().optional(),
+  artifacts: z.array(z.object({ id: identifier, path: z.string().startsWith("/run/treeseed-output/"), digest, mediaType: z.string().min(1), bytes: z.number().int().nonnegative() }).strict()),
+  usage: z.record(z.unknown()).default({}),
+  diagnostics: z.record(z.unknown()).default({}),
+  teardown: z.object({ verified: z.boolean(), completedAt: z.string().datetime().nullable() }).strict()
+}).strict();
+export {
+  sandboxAssignmentSchema,
+  sandboxEventSchema,
+  sandboxLeaseRenewalSchema,
+  sandboxResultSchema
+};

package/dist/capacity-provider/validation.d.ts

@@ -1,4 +1,4 @@
-import { type CapacityProviderManifestV3, type CapacityProviderProofPayload, type CapacityProviderPublicJwk, type ProviderSupplyOffer } from './contracts/index.js';
+import { type CapacityProviderManifestV3, type CapacityProviderManifestV4, type CapacityProviderProofPayload, type CapacityProviderPublicJwk, type ProviderSupplyOffer } from './contracts/index.js';
 export interface CapacityProviderContractDiagnostic {
     code: string;
     path: string;
@@ -20,6 +20,7 @@ export declare function validateCapacityProviderProofPayload(payload: CapacityPr
 }): CapacityProviderContractValidation;
 export declare function validateProviderSupplyOffer(offer: ProviderSupplyOffer, path?: string): CapacityProviderContractValidation;
 export declare function validateCapacityProviderManifestV3(manifest: CapacityProviderManifestV3): CapacityProviderContractValidation;
+export declare function validateCapacityProviderManifestV4(manifest: CapacityProviderManifestV4): CapacityProviderContractValidation;
 export declare function capacityProviderSecurityDefaults(): {
     proofTtlSeconds: number;
     accessTokenTtlSeconds: number;

package/dist/capacity-provider/validation.js

@@ -175,6 +175,28 @@ function validateCapacityProviderManifestV3(manifest) {
   if (explicitShare > 100) add(diagnostics, "provider_connection_share_exceeded", "connections", "Explicit connection shares may not exceed 100 percent.");
   return result(diagnostics);
 }
+function validateCapacityProviderManifestV4(manifest) {
+  const compatible = {
+    ...manifest,
+    schemaVersion: 3,
+    adapters: manifest.adapters.map((adapter) => ({ ...adapter, isolation: adapter.isolation === "microvm" ? "process" : adapter.isolation }))
+  };
+  const diagnostics = validateCapacityProviderManifestV3(compatible).diagnostics;
+  if (manifest.schemaVersion !== 4) add(diagnostics, "provider_manifest_schema_invalid", "schemaVersion", "Capacity provider manifest schemaVersion must be 4.");
+  if (manifest.sandbox?.required !== true || manifest.sandbox?.runtime !== "kata-runtime-rs-qemu") add(diagnostics, "provider_sandbox_required", "sandbox", "Manifest v4 requires the Kata runtime-rs QEMU sandbox.");
+  if (!manifest.sandbox?.brokerSocket?.startsWith("/run/treeseed/")) add(diagnostics, "provider_sandbox_socket_invalid", "sandbox.brokerSocket", "Sandbox broker socket must remain under /run/treeseed.");
+  const profiles = new Set((manifest.sandbox?.profiles ?? []).map((profile) => profile.id));
+  for (const [index, profile] of (manifest.sandbox?.profiles ?? []).entries()) {
+    if (!["read", "unit", "integration", "platform", "connected"].includes(profile.id)) add(diagnostics, "provider_sandbox_profile_invalid", `sandbox.profiles[${index}].id`, "Sandbox profile must be one of read, unit, integration, platform, or connected.");
+    if (!/^sha256:[a-f0-9]{64}$/u.test(profile.guestImageDigest)) add(diagnostics, "provider_sandbox_image_digest_invalid", `sandbox.profiles[${index}].guestImageDigest`, "Guest images require an immutable SHA-256 digest.");
+    if (profile.defaultDenyNetwork !== true) add(diagnostics, "provider_sandbox_network_policy_invalid", `sandbox.profiles[${index}].defaultDenyNetwork`, "Sandbox networking must default deny.");
+  }
+  for (const [index, adapter] of manifest.adapters.entries()) {
+    if (adapter.isolation !== "microvm") add(diagnostics, "provider_v4_microvm_required", `adapters[${index}].isolation`, "Manifest v4 adapters must use microvm isolation.");
+    for (const profile of adapter.sandboxProfileIds ?? []) if (!profiles.has(profile)) add(diagnostics, "provider_sandbox_profile_unknown", `adapters[${index}].sandboxProfileIds`, `Unknown sandbox profile ${profile}.`);
+  }
+  return result(diagnostics);
+}
 function capacityProviderSecurityDefaults() {
   return {
     proofTtlSeconds: CAPACITY_PROVIDER_PROOF_TTL_SECONDS,
@@ -188,6 +210,7 @@ export {
   nonEmpty,
   result,
   validateCapacityProviderManifestV3,
+  validateCapacityProviderManifestV4,
   validateCapacityProviderProofPayload,
   validateCapacityProviderPublicJwk,
   validateProviderSupplyOffer