@treeseed/sdk 0.13.0-rc.55 → 0.13.0-rc.56

package/dist/capacity-provider/capability-ontology.js

@@ -0,0 +1,200 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+const digest = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+const semver = z.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u);
+const identifier = z.string().regex(/^[a-z][a-z0-9.-]{1,191}$/u);
+const capabilityId = z.string().regex(/^(?:treeseed\.[a-z][a-z0-9.-]*|provider\.[a-f0-9]{16,64}\.[a-z][a-z0-9.-]*)$/u);
+const jsonSchema = z.record(z.unknown());
+const capabilityReferenceSchema = z.object({ id: capabilityId, version: semver, digest }).strict();
+const artifactContractSchema = z.object({ id: identifier, version: semver, digest, mediaTypes: z.array(z.string().min(1)).default([]) }).strict();
+const configurationFieldSchema = z.object({
+  key: identifier,
+  description: z.string().min(1),
+  schema: jsonSchema,
+  requirementSupport: z.array(z.enum(["required", "preferred"])).min(1),
+  securityCritical: z.boolean().default(false)
+}).strict();
+const capabilityDefinitionSchema = z.object({
+  schemaVersion: z.literal("treeseed.capability-definition/v1"),
+  id: capabilityId,
+  version: semver,
+  digest,
+  family: z.enum(["coordination", "research", "data", "engineering", "publishing", "external-work"]),
+  title: z.string().min(1),
+  description: z.string().min(1),
+  status: z.enum(["active", "deprecated", "revoked"]),
+  features: z.array(identifier),
+  inputs: z.array(artifactContractSchema),
+  outputs: z.array(artifactContractSchema),
+  configuration: z.array(configurationFieldSchema),
+  permissionClasses: z.array(identifier),
+  contextModes: z.array(identifier),
+  interactionModes: z.array(identifier),
+  implies: z.array(capabilityReferenceSchema),
+  conflicts: z.array(capabilityReferenceSchema),
+  qualificationTier: z.enum(["signed-attestation", "automated-suite", "reviewed-certification"]),
+  createdAt: z.string().datetime()
+}).strict();
+const capabilityOntologySchema = z.object({
+  schemaVersion: z.literal("treeseed.capability-ontology/v1"),
+  generation: z.number().int().positive(),
+  digest,
+  definitions: z.array(capabilityDefinitionSchema),
+  aliases: z.record(capabilityId),
+  createdAt: z.string().datetime(),
+  signature: z.object({ keyId: identifier, algorithm: z.enum(["Ed25519", "release-catalog"]), value: z.string().min(1) }).strict()
+}).strict().superRefine((catalog, context) => {
+  const keys = catalog.definitions.map((entry) => `${entry.id}@${entry.version}`);
+  if (new Set(keys).size !== keys.length) context.addIssue({ code: z.ZodIssueCode.custom, path: ["definitions"], message: "Capability definitions must be unique by id and version." });
+});
+const configuredValueSchema = z.object({ value: z.unknown(), requirement: z.enum(["required", "preferred"]) }).strict();
+const capabilityDemandSchema = z.object({
+  schemaVersion: z.literal("treeseed.capability-demand/v1"),
+  ontologyGeneration: z.number().int().positive(),
+  requirements: z.array(z.object({
+    capabilityId,
+    versionRange: z.string().min(1),
+    requirement: z.enum(["required", "preferred"]),
+    alternativeGroup: identifier.nullable().default(null),
+    requiredFeatures: z.array(identifier).default([]),
+    configuration: z.record(configuredValueSchema).default({})
+  }).strict()).min(1),
+  resolved: z.array(capabilityReferenceSchema),
+  permissionClasses: z.array(identifier),
+  contextModes: z.array(identifier),
+  inputContracts: z.array(artifactContractSchema),
+  outputContracts: z.array(artifactContractSchema),
+  demandDigest: digest
+}).strict();
+const capabilityConformanceSchema = z.object({
+  schemaVersion: z.literal("treeseed.capability-conformance/v1"),
+  providerId: z.string().min(1),
+  capability: capabilityReferenceSchema,
+  tier: z.enum(["signed-attestation", "automated-suite", "reviewed-certification"]),
+  status: z.enum(["passed", "failed", "revoked"]),
+  evidenceDigest: digest,
+  suite: z.object({ id: identifier, version: semver }).strict().nullable(),
+  issuedAt: z.string().datetime(),
+  expiresAt: z.string().datetime().nullable(),
+  signature: z.object({ keyId: identifier, algorithm: z.literal("Ed25519"), value: z.string().min(1) }).strict()
+}).strict();
+const capabilityOfferSchema = z.object({
+  schemaVersion: z.literal("treeseed.capability-offer/v1"),
+  offerId: identifier,
+  capabilities: z.array(capabilityReferenceSchema).min(1),
+  features: z.array(identifier),
+  configurationSupport: z.record(z.object({ required: z.boolean(), preferred: z.boolean() }).strict()),
+  permissionClasses: z.array(identifier),
+  contextModes: z.array(identifier),
+  inputContracts: z.array(artifactContractSchema),
+  outputContracts: z.array(artifactContractSchema),
+  interactionModes: z.array(identifier),
+  conformance: z.array(capabilityConformanceSchema).min(1),
+  limits: z.record(z.unknown()),
+  commercial: z.object({ currency: z.string().min(3).max(3).nullable(), estimatedCost: z.number().nonnegative().nullable() }).strict(),
+  region: z.string().min(1).nullable(),
+  trust: z.array(identifier),
+  offerDigest: digest
+}).strict();
+const capabilityNegotiationReceiptSchema = z.object({
+  schemaVersion: z.literal("treeseed.capability-negotiation/v1"),
+  demandDigest: digest,
+  offerDigest: digest,
+  eligible: z.boolean(),
+  resolvedCapabilities: z.array(capabilityReferenceSchema),
+  omittedPreferred: z.array(z.string()),
+  reasons: z.array(z.string()),
+  receiptDigest: digest
+}).strict();
+function canonical(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  return `{${Object.entries(value).filter(([, item]) => item !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(",")}}`;
+}
+function capabilityContractDigest(value) {
+  return `sha256:${createHash("sha256").update(canonical(value)).digest("hex")}`;
+}
+function capabilityDefinitionDigest(value) {
+  return capabilityContractDigest(value);
+}
+function capabilityOfferDigest(value) {
+  return capabilityContractDigest(value);
+}
+function capabilityDemandDigest(value) {
+  return capabilityContractDigest(value);
+}
+function semverSatisfies(version, range) {
+  const parse = (input) => /^([0-9]+)\.([0-9]+)\.([0-9]+)(?:-|$)/u.exec(input)?.slice(1, 4).map(Number) ?? null;
+  const actual = parse(version);
+  if (!actual) return false;
+  const compare = (left, right) => left[0] - right[0] || left[1] - right[1] || left[2] - right[2];
+  if (range.includes("||")) return range.split("||").some((part) => semverSatisfies(version, part.trim()));
+  if (/\s/u.test(range.trim())) return range.trim().split(/\s+/u).every((part) => semverSatisfies(version, part));
+  for (const operator of [">=", "<=", ">", "<"]) if (range.startsWith(operator)) {
+    const expected = parse(range.slice(operator.length));
+    if (!expected) return false;
+    const result = compare(actual, expected);
+    return operator === ">=" ? result >= 0 : operator === "<=" ? result <= 0 : operator === ">" ? result > 0 : result < 0;
+  }
+  if (range.startsWith("^")) {
+    const expected = parse(range.slice(1));
+    if (!expected || compare(actual, expected) < 0) return false;
+    return expected[0] > 0 ? actual[0] === expected[0] : expected[1] > 0 ? actual[0] === 0 && actual[1] === expected[1] : compare(actual, [0, 0, expected[2] + 1]) < 0;
+  }
+  if (range.startsWith("~")) {
+    const expected = parse(range.slice(1));
+    return Boolean(expected && actual[0] === expected[0] && actual[1] === expected[1] && compare(actual, expected) >= 0);
+  }
+  if (/^\d+\.x$/u.test(range)) return actual[0] === Number(range.split(".")[0]);
+  const exact = parse(range);
+  return Boolean(exact && compare(actual, exact) === 0);
+}
+function negotiateCapabilityOffer(demand, offer) {
+  const reasons = [], omittedPreferred = [], resolvedCapabilities = [];
+  const alternatives = /* @__PURE__ */ new Map();
+  for (const requirement of demand.requirements) {
+    const candidates = offer.capabilities.filter((capability) => capability.id === requirement.capabilityId && semverSatisfies(capability.version, requirement.versionRange));
+    const compatible = candidates.find((capability) => demand.resolved.some((resolved) => resolved.id === capability.id && resolved.version === capability.version && resolved.digest === capability.digest));
+    const featureCompatible = compatible && requirement.requiredFeatures.every((feature) => offer.features.includes(feature));
+    const configMissing = Object.entries(requirement.configuration).filter(([key, configured]) => configured.requirement === "required" && offer.configurationSupport[key]?.required !== true).map(([key]) => key);
+    const satisfied = Boolean(featureCompatible && configMissing.length === 0);
+    if (requirement.alternativeGroup) {
+      const group = alternatives.get(requirement.alternativeGroup) ?? { satisfied: false, required: false };
+      alternatives.set(requirement.alternativeGroup, { satisfied: group.satisfied || satisfied, required: group.required || requirement.requirement === "required" });
+    } else if (!satisfied && requirement.requirement === "required") reasons.push(`missing_required_capability:${requirement.capabilityId}`);
+    else if (!satisfied) omittedPreferred.push(`capability:${requirement.capabilityId}`);
+    if (satisfied && compatible) resolvedCapabilities.push(compatible);
+    for (const [key, configured] of Object.entries(requirement.configuration)) if (configured.requirement === "preferred" && offer.configurationSupport[key]?.preferred !== true) omittedPreferred.push(`configuration:${requirement.capabilityId}:${key}`);
+  }
+  for (const [group, state] of alternatives) if (!state.satisfied && state.required) reasons.push(`missing_required_alternative:${group}`);
+  else if (!state.satisfied) omittedPreferred.push(`alternative:${group}`);
+  for (const permission of demand.permissionClasses) if (!offer.permissionClasses.includes(permission)) reasons.push(`missing_permission_support:${permission}`);
+  for (const mode of demand.contextModes) if (!offer.contextModes.includes(mode)) reasons.push(`missing_context_mode:${mode}`);
+  for (const contract of demand.inputContracts) if (!offer.inputContracts.some((candidate) => candidate.id === contract.id && candidate.version === contract.version && candidate.digest === contract.digest)) reasons.push(`missing_input_contract:${contract.id}`);
+  for (const contract of demand.outputContracts) if (!offer.outputContracts.some((candidate) => candidate.id === contract.id && candidate.version === contract.version && candidate.digest === contract.digest)) reasons.push(`missing_output_contract:${contract.id}`);
+  const material = {
+    schemaVersion: "treeseed.capability-negotiation/v1",
+    demandDigest: demand.demandDigest,
+    offerDigest: offer.offerDigest,
+    eligible: reasons.length === 0,
+    resolvedCapabilities,
+    omittedPreferred: [...new Set(omittedPreferred)].sort(),
+    reasons: [...new Set(reasons)].sort()
+  };
+  return capabilityNegotiationReceiptSchema.parse({ ...material, receiptDigest: capabilityContractDigest(material) });
+}
+export {
+  capabilityConformanceSchema,
+  capabilityContractDigest,
+  capabilityDefinitionDigest,
+  capabilityDefinitionSchema,
+  capabilityDemandDigest,
+  capabilityDemandSchema,
+  capabilityNegotiationReceiptSchema,
+  capabilityOfferDigest,
+  capabilityOfferSchema,
+  capabilityOntologySchema,
+  capabilityReferenceSchema,
+  negotiateCapabilityOffer,
+  semverSatisfies
+};

package/dist/capacity-provider/contracts/governance.d.ts

@@ -1,4 +1,5 @@
 import type { ResearchSourcePolicy } from '../../agent-capacity/contracts/support/research-source-policy.js';
+import type { CapabilityOffer } from '../capability-ontology.js';
 export declare const CAPACITY_PROVIDER_IDENTITY_ALGORITHM: "Ed25519";
 export declare const CAPACITY_PROVIDER_PROOF_TTL_SECONDS = 300;
 export declare const CAPACITY_PROVIDER_ACCESS_TOKEN_TTL_SECONDS = 900;
@@ -422,9 +423,25 @@ export interface CapacityProviderManifestV3 {
     metadata?: Record<string, unknown>;
 }
 export interface CapacityProviderSandboxProfile {
-    id: 'read' | 'unit' | 'integration' | 'platform' | 'connected' | string;
+    id: string;
+    contract?: {
+        id: string;
+        version: string;
+        digest: string;
+        capabilities: string[];
+    };
     guestImage: string;
     guestImageDigest: string;
+    lineage?: {
+        baseImageDigest: string;
+        provenanceDigest: string;
+        architectures: Array<'amd64' | 'arm64'>;
+        signature: {
+            keyId: string;
+            algorithm: 'cosign' | 'Ed25519';
+            value: string;
+        };
+    };
     defaultDenyNetwork: true;
     resources: {
         cpuCores: number;
@@ -445,6 +462,24 @@ export interface CapacityProviderManifestV4 extends Omit<CapacityProviderManifes
     adapters: Array<Omit<CapacityProviderManifestV3['adapters'][number], 'isolation'> & {
         isolation: 'microvm' | 'process' | 'worker';
         sandboxProfileIds?: string[];
+        defaultSandboxProfiles?: {
+            conversation: string;
+            execution: string;
+        };
+    }>;
+}
+export interface CapacityProviderManifestV5 extends Omit<CapacityProviderManifestV4, 'schemaVersion' | 'adapters'> {
+    schemaVersion: 5;
+    ontology: {
+        generation: number;
+        digest: string;
+    };
+    adapters: Array<Omit<CapacityProviderManifestV4['adapters'][number], 'capabilities' | 'sandboxProfileIds' | 'defaultSandboxProfiles'> & {
+        isolation: 'microvm';
+        offers: Array<{
+            offer: CapabilityOffer;
+            sandboxProfileId: string;
+        }>;
     }>;
 }
-export type CapacityProviderManifest = CapacityProviderManifestV3 | CapacityProviderManifestV4;
+export type CapacityProviderManifest = CapacityProviderManifestV3 | CapacityProviderManifestV4 | CapacityProviderManifestV5;

package/dist/capacity-provider/core-capability-catalog.d.ts

@@ -0,0 +1,47 @@
+export declare const CORE_CAPABILITY_DEFINITIONS: {
+    schemaVersion: "treeseed.capability-definition/v1";
+    status: "active" | "deprecated" | "revoked";
+    createdAt: string;
+    id: string;
+    outputs: {
+        id: string;
+        digest: string;
+        version: string;
+        mediaTypes: string[];
+    }[];
+    digest: string;
+    version: string;
+    configuration: {
+        key: string;
+        schema: Record<string, unknown>;
+        description: string;
+        requirementSupport: ("required" | "preferred")[];
+        securityCritical: boolean;
+    }[];
+    family: "research" | "coordination" | "data" | "engineering" | "publishing" | "external-work";
+    description: string;
+    title: string;
+    features: string[];
+    inputs: {
+        id: string;
+        digest: string;
+        version: string;
+        mediaTypes: string[];
+    }[];
+    permissionClasses: string[];
+    contextModes: string[];
+    interactionModes: string[];
+    implies: {
+        id: string;
+        digest: string;
+        version: string;
+    }[];
+    conflicts: {
+        id: string;
+        digest: string;
+        version: string;
+    }[];
+    qualificationTier: "signed-attestation" | "automated-suite" | "reviewed-certification";
+}[];
+export declare const LEGACY_CAPABILITY_ALIASES: Record<string, string>;
+export declare function resolveLegacyCapability(value: string, activityType?: string): string | null;

package/dist/capacity-provider/core-capability-catalog.js

@@ -0,0 +1,63 @@
+import { capabilityDefinitionDigest, capabilityDefinitionSchema } from "./capability-ontology.js";
+const createdAt = "2026-08-29T00:00:00.000Z";
+const services = {
+  coordination: ["conversation", "question-answering", "planning", "estimation", "review", "reporting", "human-task-routing", "decision-support"],
+  research: ["web", "literature", "market", "repository", "dataset-discovery", "retrieval", "extraction", "verification", "citation", "synthesis", "experimentation"],
+  data: ["source-connection", "extraction", "ingestion", "synchronization", "schema-inference", "schema-mapping", "normalization", "transformation", "enrichment", "entity-resolution", "validation", "quality-analysis", "lineage", "statistical-analysis", "visualization", "export"],
+  engineering: ["architecture", "repository-analysis", "code-change", "refactoring", "dependency-update", "build", "unit-testing", "integration-testing", "end-to-end-testing", "debugging", "review", "security-analysis", "performance-analysis", "accessibility", "infrastructure", "deployment", "release", "operations"],
+  publishing: ["drafting", "editing", "translation", "structured-content", "documentation", "cms", "repository", "package-artifact", "site-build", "site-deployment", "syndication", "release-notes"],
+  "external-work": ["ticket-management", "workflow-execution", "notification", "human-service-fulfillment", "artifact-delivery"]
+};
+function definition(family, service) {
+  const configuration = [
+    ["instructions.system", "Provider-neutral system instruction delivery."],
+    ["instructions.task", "Provider-neutral task instruction delivery."],
+    ["instructions.templates", "Immutable instruction template delivery."],
+    ["context.queries", "Resolved context query manifest delivery."],
+    ["tools.policy", "Assignment-scoped tool policy enforcement."]
+  ].map(([key, description]) => ({ key, description, schema: {}, requirementSupport: ["required", "preferred"], securityCritical: true }));
+  const material = {
+    schemaVersion: "treeseed.capability-definition/v1",
+    id: `treeseed.${family}.${service}`,
+    version: "1.0.0",
+    family,
+    title: service.split("-").map((part) => `${part[0]?.toUpperCase()}${part.slice(1)}`).join(" "),
+    description: `Standard TreeSeed ${family} capability for ${service.replaceAll("-", " ")}.`,
+    status: "active",
+    features: [],
+    inputs: [],
+    outputs: [],
+    configuration,
+    permissionClasses: ["content-policy", "repository-policy", "network-policy", "shell-policy", "tool-policy"],
+    contextModes: ["inline", "manifest"],
+    interactionModes: ["asynchronous", "interactive"],
+    implies: [],
+    conflicts: [],
+    qualificationTier: ["security-analysis", "deployment", "release", "operations", "human-service-fulfillment"].includes(service) ? "automated-suite" : "signed-attestation",
+    createdAt
+  };
+  return capabilityDefinitionSchema.parse({ ...material, digest: capabilityDefinitionDigest(material) });
+}
+const CORE_CAPABILITY_DEFINITIONS = Object.entries(services).flatMap(([family, values]) => values.map((service) => definition(family, service)));
+const LEGACY_CAPABILITY_ALIASES = {
+  communication: "treeseed.coordination.conversation",
+  reporting: "treeseed.coordination.reporting",
+  "terminal-reporting": "treeseed.coordination.reporting",
+  "independent-review": "treeseed.engineering.review",
+  "governed-revision": "treeseed.engineering.code-change",
+  repository_work: "treeseed.engineering.repository-analysis",
+  "repository-read": "treeseed.engineering.repository-analysis",
+  research: "treeseed.research.synthesis",
+  planning: "treeseed.coordination.planning"
+};
+function resolveLegacyCapability(value, activityType) {
+  if (value === "agent-execution") return { chat: "treeseed.coordination.conversation", acting: "treeseed.engineering.code-change", reviewing: "treeseed.engineering.review", estimating: "treeseed.coordination.estimation", reporting: "treeseed.coordination.reporting", planning: "treeseed.coordination.planning" }[activityType ?? ""] ?? null;
+  if (value === "repository_work" && activityType === "acting") return "treeseed.engineering.code-change";
+  if (value.startsWith("engineering:")) return value.endsWith(":review") ? "treeseed.engineering.review" : "treeseed.engineering.code-change";
+  return LEGACY_CAPABILITY_ALIASES[value] ?? (value.startsWith("treeseed.") || value.startsWith("provider.") ? value : null);
+}
+export {
+  CORE_CAPABILITY_DEFINITIONS,
+  LEGACY_CAPABILITY_ALIASES,
+  resolveLegacyCapability
+};