@treeseed/sdk 0.13.0-rc.54 → 0.13.0-rc.56

package/dist/capacity-provider/sandbox-contracts.js

@@ -0,0 +1,86 @@
+import { z } from "zod";
+const identifier = z.string().regex(/^[a-z][a-z0-9._-]{0,127}$/u);
+const digest = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+const sandboxProfile = identifier;
+const sandboxAssignmentSchema = z.object({
+  schemaVersion: z.literal("treeseed.sandbox-assignment/v1"),
+  assignmentId: z.string().min(1),
+  attempt: z.number().int().positive(),
+  runnerId: z.string().min(1),
+  providerId: z.string().min(1),
+  teamId: z.string().min(1),
+  projectId: z.string().min(1),
+  profile: sandboxProfile,
+  environmentContract: z.object({ id: identifier, version: z.string().regex(/^\d+\.\d+\.\d+$/u), digest, capabilities: z.array(identifier) }).strict().optional(),
+  guestImage: z.string().min(1),
+  guestImageDigest: digest,
+  identityManifestDigest: digest,
+  contextManifestDigest: digest,
+  resources: z.object({
+    cpuCores: z.number().positive(),
+    memoryBytes: z.number().int().positive(),
+    diskBytes: z.number().int().positive(),
+    durationSeconds: z.number().int().positive(),
+    processLimit: z.number().int().positive(),
+    outputBytes: z.number().int().positive()
+  }).strict(),
+  inputs: z.array(z.object({ id: identifier, digest, bytes: z.number().int().nonnegative(), disposition: z.enum(["read-only", "copy-on-write"]), mediaType: z.string().min(1), targetPath: z.string().startsWith("/workspace/") }).strict()),
+  outputs: z.array(z.object({ id: identifier, path: z.string().startsWith("/run/treeseed-output/"), mediaType: z.string().min(1), maxBytes: z.number().int().positive() }).strict()),
+  network: z.object({ defaultDeny: z.literal(true), relayUrl: z.string().url().startsWith("https://"), allowedServices: z.array(identifier), connectedDevelopmentSessionId: z.string().min(1).optional() }).strict(),
+  modelPolicy: z.object({ provider: identifier, model: z.string().min(1), capabilities: z.array(identifier), maxInputTokens: z.number().int().positive().optional(), maxOutputTokens: z.number().int().positive().optional(), maxCost: z.number().nonnegative().optional() }).strict(),
+  credentialHandles: z.array(z.object({ id: identifier, profileId: identifier, revealAllowed: z.literal(false) }).strict()),
+  treeDxHandleIds: z.array(z.string().min(1)),
+  leaseExpiresAt: z.string().datetime(),
+  signature: z.object({ keyId: identifier, algorithm: z.literal("Ed25519"), value: z.string().min(1) }).strict()
+}).strict();
+const sandboxEventSchema = z.object({
+  schemaVersion: z.literal("treeseed.sandbox-event/v1"),
+  sandboxId: z.string().min(1),
+  assignmentId: z.string().min(1),
+  sequence: z.number().int().nonnegative(),
+  occurredAt: z.string().datetime(),
+  type: z.enum(["sandbox.created", "sandbox.ready", "execution.started", "execution.progress", "tool.requested", "tool.completed", "execution.completed", "execution.failed", "sandbox.destroyed"]),
+  payload: z.record(z.unknown()).default({})
+}).strict();
+const sandboxLeaseRenewalSchema = z.object({
+  schemaVersion: z.literal("treeseed.sandbox-lease-renewal/v1"),
+  sandboxId: z.string().min(1),
+  assignmentId: z.string().min(1),
+  providerId: z.string().min(1),
+  teamId: z.string().min(1),
+  leaseExpiresAt: z.string().datetime(),
+  issuedAt: z.string().datetime(),
+  signature: z.object({ keyId: identifier, algorithm: z.literal("Ed25519"), value: z.string().min(1) }).strict()
+}).strict();
+const sandboxResultSchema = z.object({
+  schemaVersion: z.literal("treeseed.sandbox-result/v1"),
+  sandboxId: z.string().min(1),
+  assignmentId: z.string().min(1),
+  status: z.enum(["completed", "failed", "cancelled", "expired"]),
+  summary: z.string(),
+  responseMarkdown: z.string().optional(),
+  artifacts: z.array(z.object({ id: identifier, path: z.string().startsWith("/run/treeseed-output/"), digest, mediaType: z.string().min(1), bytes: z.number().int().nonnegative() }).strict()),
+  usage: z.record(z.unknown()).default({}),
+  diagnostics: z.record(z.unknown()).default({}),
+  teardown: z.object({ verified: z.boolean(), completedAt: z.string().datetime().nullable() }).strict()
+}).strict();
+const providerEnvironmentReceiptSchema = z.object({
+  schemaVersion: z.literal("treeseed.provider-environment-receipt/v1"),
+  assignmentId: z.string().min(1),
+  offerId: identifier,
+  providerId: z.string().min(1),
+  imageDigest: digest,
+  baseLineage: z.object({ baseImageDigest: digest, provenanceDigest: digest, architectures: z.array(z.enum(["amd64", "arm64"])).min(1) }).strict(),
+  securityAttestationDigest: digest,
+  brokerVersion: z.string().min(1),
+  teardown: z.object({ verified: z.boolean(), completedAt: z.string().datetime().nullable() }).strict(),
+  createdAt: z.string().datetime(),
+  signature: z.object({ keyId: identifier, algorithm: z.literal("Ed25519"), value: z.string().min(1) }).strict()
+}).strict();
+export {
+  providerEnvironmentReceiptSchema,
+  sandboxAssignmentSchema,
+  sandboxEventSchema,
+  sandboxLeaseRenewalSchema,
+  sandboxResultSchema
+};

package/dist/capacity-provider/validation.d.ts

@@ -1,4 +1,4 @@
-import { type CapacityProviderManifestV3, type CapacityProviderProofPayload, type CapacityProviderPublicJwk, type ProviderSupplyOffer } from './contracts/index.js';
+import { type CapacityProviderManifestV3, type CapacityProviderManifestV4, type CapacityProviderManifestV5, type CapacityProviderProofPayload, type CapacityProviderPublicJwk, type ProviderSupplyOffer } from './contracts/index.js';
 export interface CapacityProviderContractDiagnostic {
     code: string;
     path: string;
@@ -20,6 +20,8 @@ export declare function validateCapacityProviderProofPayload(payload: CapacityPr
 }): CapacityProviderContractValidation;
 export declare function validateProviderSupplyOffer(offer: ProviderSupplyOffer, path?: string): CapacityProviderContractValidation;
 export declare function validateCapacityProviderManifestV3(manifest: CapacityProviderManifestV3): CapacityProviderContractValidation;
+export declare function validateCapacityProviderManifestV4(manifest: CapacityProviderManifestV4): CapacityProviderContractValidation;
+export declare function validateCapacityProviderManifestV5(manifest: CapacityProviderManifestV5): CapacityProviderContractValidation;
 export declare function capacityProviderSecurityDefaults(): {
     proofTtlSeconds: number;
     accessTokenTtlSeconds: number;

package/dist/capacity-provider/validation.js

@@ -175,6 +175,60 @@ function validateCapacityProviderManifestV3(manifest) {
   if (explicitShare > 100) add(diagnostics, "provider_connection_share_exceeded", "connections", "Explicit connection shares may not exceed 100 percent.");
   return result(diagnostics);
 }
+function validateCapacityProviderManifestV4(manifest) {
+  const compatible = {
+    ...manifest,
+    schemaVersion: 3,
+    adapters: manifest.adapters.map((adapter) => ({ ...adapter, isolation: adapter.isolation === "microvm" ? "process" : adapter.isolation }))
+  };
+  const diagnostics = validateCapacityProviderManifestV3(compatible).diagnostics;
+  if (manifest.schemaVersion !== 4) add(diagnostics, "provider_manifest_schema_invalid", "schemaVersion", "Capacity provider manifest schemaVersion must be 4.");
+  if (manifest.sandbox?.required !== true || manifest.sandbox?.runtime !== "kata-runtime-rs-qemu") add(diagnostics, "provider_sandbox_required", "sandbox", "Manifest v4 requires the Kata runtime-rs QEMU sandbox.");
+  if (!manifest.sandbox?.brokerSocket?.startsWith("/run/treeseed/")) add(diagnostics, "provider_sandbox_socket_invalid", "sandbox.brokerSocket", "Sandbox broker socket must remain under /run/treeseed.");
+  const profiles = new Set((manifest.sandbox?.profiles ?? []).map((profile) => profile.id));
+  for (const [index, profile] of (manifest.sandbox?.profiles ?? []).entries()) {
+    if (!/^[a-z][a-z0-9._-]{0,127}$/u.test(profile.id)) add(diagnostics, "provider_sandbox_profile_invalid", `sandbox.profiles[${index}].id`, "Sandbox profile id must be a provider-local identifier.");
+    if (profile.contract) {
+      if (!/^[a-z][a-z0-9._-]{0,127}$/u.test(profile.contract.id) || !/^\d+\.\d+\.\d+$/u.test(profile.contract.version) || !/^sha256:[a-f0-9]{64}$/u.test(profile.contract.digest)) add(diagnostics, "provider_sandbox_contract_invalid", `sandbox.profiles[${index}].contract`, "Portable sandbox contracts require an id, exact semantic version, and immutable digest.");
+      if (!Array.isArray(profile.contract.capabilities) || profile.contract.capabilities.some((capability) => !/^[a-z][a-z0-9._-]{0,127}$/u.test(capability))) add(diagnostics, "provider_sandbox_contract_capabilities_invalid", `sandbox.profiles[${index}].contract.capabilities`, "Sandbox contract capabilities must be portable identifiers.");
+    }
+    if (!/^sha256:[a-f0-9]{64}$/u.test(profile.guestImageDigest)) add(diagnostics, "provider_sandbox_image_digest_invalid", `sandbox.profiles[${index}].guestImageDigest`, "Guest images require an immutable SHA-256 digest.");
+    if (profile.defaultDenyNetwork !== true) add(diagnostics, "provider_sandbox_network_policy_invalid", `sandbox.profiles[${index}].defaultDenyNetwork`, "Sandbox networking must default deny.");
+  }
+  for (const [index, adapter] of manifest.adapters.entries()) {
+    if (adapter.isolation !== "microvm") add(diagnostics, "provider_v4_microvm_required", `adapters[${index}].isolation`, "Manifest v4 adapters must use microvm isolation.");
+    for (const profile of adapter.sandboxProfileIds ?? []) if (!profiles.has(profile)) add(diagnostics, "provider_sandbox_profile_unknown", `adapters[${index}].sandboxProfileIds`, `Unknown sandbox profile ${profile}.`);
+    for (const [purpose, profile] of Object.entries(adapter.defaultSandboxProfiles ?? {})) if (!profiles.has(profile)) add(diagnostics, "provider_sandbox_default_unknown", `adapters[${index}].defaultSandboxProfiles.${purpose}`, `Unknown default sandbox profile ${profile}.`);
+  }
+  return result(diagnostics);
+}
+function validateCapacityProviderManifestV5(manifest) {
+  const compatible = { ...manifest, schemaVersion: 4, adapters: manifest.adapters.map((adapter) => ({
+    ...adapter,
+    capabilities: [...new Set(adapter.offers.flatMap(({ offer }) => offer.capabilities.map(({ id }) => id)))],
+    sandboxProfileIds: [...new Set(adapter.offers.map(({ sandboxProfileId }) => sandboxProfileId))],
+    defaultSandboxProfiles: void 0
+  })) };
+  const diagnostics = validateCapacityProviderManifestV4(compatible).diagnostics.filter((entry) => entry.code !== "provider_sandbox_default_unknown");
+  if (manifest.schemaVersion !== 5) add(diagnostics, "provider_manifest_schema_invalid", "schemaVersion", "Capacity provider manifest schemaVersion must be 5.");
+  if (!Number.isInteger(manifest.ontology?.generation) || manifest.ontology.generation < 1 || !/^sha256:[a-f0-9]{64}$/u.test(manifest.ontology?.digest ?? "")) add(diagnostics, "provider_ontology_binding_invalid", "ontology", "Manifest v5 requires an exact ontology generation and digest.");
+  const profiles = new Set(manifest.sandbox.profiles.map(({ id }) => id)), offerIds = /* @__PURE__ */ new Set();
+  for (const [profileIndex, profile] of manifest.sandbox.profiles.entries()) {
+    if (!profile.lineage || !/^sha256:[a-f0-9]{64}$/u.test(profile.lineage.baseImageDigest) || !/^sha256:[a-f0-9]{64}$/u.test(profile.lineage.provenanceDigest) || !profile.lineage.architectures.length || !profile.lineage.signature.value) add(diagnostics, "provider_sandbox_lineage_required", `sandbox.profiles[${profileIndex}].lineage`, "Manifest v5 sandbox images require signed exact sandbox-base lineage and architectures.");
+  }
+  for (const [adapterIndex, adapter] of manifest.adapters.entries()) {
+    if (!adapter.offers.length) add(diagnostics, "provider_adapter_offers_required", `adapters[${adapterIndex}].offers`, "Every v5 adapter must expose at least one standardized capability offer.");
+    for (const [offerIndex, binding] of adapter.offers.entries()) {
+      const path = `adapters[${adapterIndex}].offers[${offerIndex}]`;
+      if (offerIds.has(binding.offer.offerId)) add(diagnostics, "provider_offer_id_duplicate", `${path}.offer.offerId`, "Offer ids must be provider-global unique.");
+      offerIds.add(binding.offer.offerId);
+      if (!profiles.has(binding.sandboxProfileId)) add(diagnostics, "provider_offer_sandbox_unknown", `${path}.sandboxProfileId`, "Offer references an unknown provider-local sandbox profile.");
+      if (binding.offer.capabilities.some((reference) => !reference.id.startsWith("treeseed.") && !reference.id.startsWith("provider."))) add(diagnostics, "provider_offer_capability_namespace_invalid", `${path}.offer.capabilities`, "Offers require standardized TreeSeed or provider capability references.");
+      if (binding.offer.conformance.some((entry) => entry.status !== "passed")) add(diagnostics, "provider_offer_conformance_failed", `${path}.offer.conformance`, "Only passing capability conformance may be advertised.");
+    }
+  }
+  return result(diagnostics);
+}
 function capacityProviderSecurityDefaults() {
   return {
     proofTtlSeconds: CAPACITY_PROVIDER_PROOF_TTL_SECONDS,
@@ -188,6 +242,8 @@ export {
   nonEmpty,
   result,
   validateCapacityProviderManifestV3,
+  validateCapacityProviderManifestV4,
+  validateCapacityProviderManifestV5,
   validateCapacityProviderProofPayload,
   validateCapacityProviderPublicJwk,
   validateProviderSupplyOffer