@treeseed/sdk 0.13.0-rc.55 → 0.13.0-rc.56

package/dist/capacity-provider/environment-catalog.js

@@ -0,0 +1,116 @@
+import { createHash, createPublicKey, verify } from "node:crypto";
+import { z } from "zod";
+const identifier = z.string().regex(/^[a-z][a-z0-9._-]{0,127}$/u);
+const digest = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+const version = z.string().regex(/^\d+\.\d+\.\d+$/u);
+const sandboxEnvironmentContractSchema = z.object({
+  id: identifier,
+  version,
+  digest,
+  capabilities: z.array(identifier)
+}).strict();
+const provenance = z.object({
+  sourceRepository: z.string().url(),
+  sourceRevision: z.union([z.string().regex(/^[a-f0-9]{40}$/u), digest]),
+  buildRecipeDigest: digest,
+  sbomDigest: digest,
+  signature: z.object({ keyId: identifier, algorithm: z.enum(["Ed25519", "cosign"]), value: z.string().min(1) }).strict()
+}).strict();
+const sandboxEnvironmentCatalogEntrySchema = z.object({
+  id: identifier,
+  version,
+  kind: z.enum(["base", "extension"]),
+  contract: sandboxEnvironmentContractSchema,
+  image: z.object({ reference: z.string().min(1), digest, architectures: z.array(z.enum(["amd64", "arm64"])).min(1), operatingSystem: z.literal("linux") }).strict(),
+  derivedFrom: z.array(z.object({ entryId: identifier, version, imageDigest: digest }).strict()).min(1).nullable(),
+  provenance,
+  qualification: z.object({ suiteId: identifier, suiteVersion: version, evidenceDigest: digest, status: z.literal("passed"), completedAt: z.string().datetime() }).strict(),
+  status: z.enum(["active", "deprecated", "revoked"]),
+  createdAt: z.string().datetime()
+}).strict().superRefine((entry, context) => {
+  if (new Set(entry.image.architectures).size !== entry.image.architectures.length) context.addIssue({ code: z.ZodIssueCode.custom, path: ["image", "architectures"], message: "Image architectures must be unique." });
+  if (entry.kind === "base" && entry.derivedFrom !== null) context.addIssue({ code: z.ZodIssueCode.custom, path: ["derivedFrom"], message: "Base environments cannot derive from another catalog entry." });
+  if (entry.kind === "extension" && entry.derivedFrom === null) context.addIssue({ code: z.ZodIssueCode.custom, path: ["derivedFrom"], message: "Extended environments require exact catalog bases." });
+});
+const sandboxEnvironmentCatalogSchema = z.object({
+  schemaVersion: z.literal("treeseed.sandbox-environment-catalog/v1"),
+  generation: z.number().int().positive(),
+  catalogDigest: digest,
+  rootPolicy: z.object({ allowedBaseImageDigests: z.array(digest).min(1) }).strict(),
+  entries: z.array(sandboxEnvironmentCatalogEntrySchema),
+  createdAt: z.string().datetime(),
+  signature: z.object({ keyId: identifier, algorithm: z.literal("Ed25519"), value: z.string().min(1) }).strict()
+}).strict().superRefine((catalog, context) => {
+  const entries = new Map(catalog.entries.map((entry) => [`${entry.id}@${entry.version}`, entry]));
+  for (const [index, entry] of catalog.entries.entries()) {
+    if (entry.kind === "base" && !catalog.rootPolicy.allowedBaseImageDigests.includes(entry.image.digest)) context.addIssue({ code: z.ZodIssueCode.custom, path: ["entries", index, "image", "digest"], message: "Base image is not an allowed catalog root." });
+    if (entry.kind !== "extension" || !entry.derivedFrom) continue;
+    const parentArchitectures = /* @__PURE__ */ new Set();
+    for (const [parentIndex, reference] of entry.derivedFrom.entries()) {
+      const parent = entries.get(`${reference.entryId}@${reference.version}`);
+      if (!parent || parent.image.digest !== reference.imageDigest) {
+        context.addIssue({ code: z.ZodIssueCode.custom, path: ["entries", index, "derivedFrom", parentIndex], message: "Environment extension does not bind an exact entry in this catalog." });
+        continue;
+      }
+      const pending = [parent], seen = /* @__PURE__ */ new Set(), roots = [];
+      while (pending.length) {
+        const current = pending.pop(), key = `${current.id}@${current.version}`;
+        if (seen.has(key)) {
+          roots.length = 0;
+          break;
+        }
+        seen.add(key);
+        if (current.kind === "base") {
+          roots.push(current);
+          continue;
+        }
+        for (const ancestor of current.derivedFrom ?? []) {
+          const resolved = entries.get(`${ancestor.entryId}@${ancestor.version}`);
+          if (!resolved || resolved.image.digest !== ancestor.imageDigest) {
+            roots.length = 0;
+            pending.length = 0;
+            break;
+          }
+          pending.push(resolved);
+        }
+      }
+      if (!roots.length || roots.some((root) => !catalog.rootPolicy.allowedBaseImageDigests.includes(root.image.digest))) context.addIssue({ code: z.ZodIssueCode.custom, path: ["entries", index, "derivedFrom", parentIndex], message: "Environment extension does not resolve to an allowed catalog root." });
+      else for (const root of roots) for (const architecture of root.image.architectures) parentArchitectures.add(architecture);
+    }
+    for (const architecture of entry.image.architectures) if (!parentArchitectures.has(architecture)) context.addIssue({ code: z.ZodIssueCode.custom, path: ["entries", index, "derivedFrom"], message: `Environment extension has no allowed ${architecture} base.` });
+  }
+});
+const providerSandboxEnvironmentAvailabilitySchema = z.object({
+  schemaVersion: z.literal("treeseed.provider-sandbox-environments/v1"),
+  providerId: z.string().min(1),
+  catalogGeneration: z.number().int().positive(),
+  catalogDigest: digest,
+  entries: z.array(z.object({ entryId: identifier, version, contractDigest: digest, imageDigest: digest, status: z.enum(["pulling", "ready", "failed", "quarantined"]), checkedAt: z.string().datetime(), reason: z.string().min(1).nullable() }).strict())
+}).strict();
+function canonical(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(",")}}`;
+}
+function sandboxEnvironmentCatalogDigest(value) {
+  return `sha256:${createHash("sha256").update(canonical(value)).digest("hex")}`;
+}
+function sandboxEnvironmentCatalogSigningBytes(value) {
+  return Buffer.from(canonical({ ...value, signature: { ...value.signature, value: "" } }));
+}
+function verifySandboxEnvironmentCatalog(value, publicJwk) {
+  const catalog = sandboxEnvironmentCatalogSchema.parse(value);
+  const { catalogDigest, signature: _signature, ...material } = catalog;
+  if (sandboxEnvironmentCatalogDigest(material) !== catalogDigest) throw new Error("Sandbox environment catalog digest does not match its canonical content.");
+  if (!verify(null, sandboxEnvironmentCatalogSigningBytes(catalog), createPublicKey({ key: publicJwk, format: "jwk" }), Buffer.from(catalog.signature.value, "base64url"))) throw new Error("Sandbox environment catalog signature is invalid.");
+  return catalog;
+}
+export {
+  providerSandboxEnvironmentAvailabilitySchema,
+  sandboxEnvironmentCatalogDigest,
+  sandboxEnvironmentCatalogEntrySchema,
+  sandboxEnvironmentCatalogSchema,
+  sandboxEnvironmentCatalogSigningBytes,
+  sandboxEnvironmentContractSchema,
+  verifySandboxEnvironmentCatalog
+};

package/dist/capacity-provider/index.d.ts

@@ -2,3 +2,6 @@ export * from './client.js';
 export * from './contracts/index.js';
 export * from './validation.js';
 export * from './sandbox-contracts.js';
+export * from './environment-catalog.js';
+export * from './capability-ontology.js';
+export * from './core-capability-catalog.js';

package/dist/capacity-provider/index.js

@@ -2,3 +2,6 @@ export * from "./client.js";
 export * from "./contracts/index.js";
 export * from "./validation.js";
 export * from "./sandbox-contracts.js";
+export * from "./environment-catalog.js";
+export * from "./capability-ontology.js";
+export * from "./core-capability-catalog.js";

package/dist/capacity-provider/sandbox-contracts.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-declare const sandboxProfile: z.ZodEnum<["read", "unit", "integration", "platform", "connected"]>;
+declare const sandboxProfile: z.ZodString;
 export declare const sandboxAssignmentSchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<"treeseed.sandbox-assignment/v1">;
     assignmentId: z.ZodString;
@@ -8,7 +8,23 @@ export declare const sandboxAssignmentSchema: z.ZodObject<{
     providerId: z.ZodString;
     teamId: z.ZodString;
     projectId: z.ZodString;
-    profile: z.ZodEnum<["read", "unit", "integration", "platform", "connected"]>;
+    profile: z.ZodString;
+    environmentContract: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        version: z.ZodString;
+        digest: z.ZodString;
+        capabilities: z.ZodArray<z.ZodString, "many">;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        digest: string;
+        version: string;
+        capabilities: string[];
+    }, {
+        id: string;
+        digest: string;
+        version: string;
+        capabilities: string[];
+    }>>;
     guestImage: z.ZodString;
     guestImageDigest: z.ZodString;
     identityManifestDigest: z.ZodString;
@@ -158,7 +174,7 @@ export declare const sandboxAssignmentSchema: z.ZodObject<{
         outputBytes: number;
     };
     projectId: string;
-    profile: "read" | "unit" | "integration" | "platform" | "connected";
+    profile: string;
     network: {
         defaultDeny: true;
         relayUrl: string;
@@ -169,10 +185,6 @@ export declare const sandboxAssignmentSchema: z.ZodObject<{
     guestImageDigest: string;
     providerId: string;
     runnerId: string;
-    leaseExpiresAt: string;
-    attempt: number;
-    identityManifestDigest: string;
-    contextManifestDigest: string;
     inputs: {
         id: string;
         mediaType: string;
@@ -181,6 +193,15 @@ export declare const sandboxAssignmentSchema: z.ZodObject<{
         disposition: "read-only" | "copy-on-write";
         targetPath: string;
     }[];
+    signature: {
+        value: string;
+        algorithm: "Ed25519";
+        keyId: string;
+    };
+    leaseExpiresAt: string;
+    attempt: number;
+    identityManifestDigest: string;
+    contextManifestDigest: string;
     modelPolicy: {
         provider: string;
         capabilities: string[];
@@ -195,11 +216,12 @@ export declare const sandboxAssignmentSchema: z.ZodObject<{
         revealAllowed: false;
     }[];
     treeDxHandleIds: string[];
-    signature: {
-        value: string;
-        algorithm: "Ed25519";
-        keyId: string;
-    };
+    environmentContract?: {
+        id: string;
+        digest: string;
+        version: string;
+        capabilities: string[];
+    } | undefined;
 }, {
     teamId: string;
     assignmentId: string;
@@ -219,7 +241,7 @@ export declare const sandboxAssignmentSchema: z.ZodObject<{
         outputBytes: number;
     };
     projectId: string;
-    profile: "read" | "unit" | "integration" | "platform" | "connected";
+    profile: string;
     network: {
         defaultDeny: true;
         relayUrl: string;
@@ -230,10 +252,6 @@ export declare const sandboxAssignmentSchema: z.ZodObject<{
     guestImageDigest: string;
     providerId: string;
     runnerId: string;
-    leaseExpiresAt: string;
-    attempt: number;
-    identityManifestDigest: string;
-    contextManifestDigest: string;
     inputs: {
         id: string;
         mediaType: string;
@@ -242,6 +260,15 @@ export declare const sandboxAssignmentSchema: z.ZodObject<{
         disposition: "read-only" | "copy-on-write";
         targetPath: string;
     }[];
+    signature: {
+        value: string;
+        algorithm: "Ed25519";
+        keyId: string;
+    };
+    leaseExpiresAt: string;
+    attempt: number;
+    identityManifestDigest: string;
+    contextManifestDigest: string;
     modelPolicy: {
         provider: string;
         capabilities: string[];
@@ -256,11 +283,12 @@ export declare const sandboxAssignmentSchema: z.ZodObject<{
         revealAllowed: false;
     }[];
     treeDxHandleIds: string[];
-    signature: {
-        value: string;
-        algorithm: "Ed25519";
-        keyId: string;
-    };
+    environmentContract?: {
+        id: string;
+        digest: string;
+        version: string;
+        capabilities: string[];
+    } | undefined;
 }>;
 export declare const sandboxEventSchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<"treeseed.sandbox-event/v1">;
@@ -313,26 +341,26 @@ export declare const sandboxLeaseRenewalSchema: z.ZodObject<{
     assignmentId: string;
     schemaVersion: "treeseed.sandbox-lease-renewal/v1";
     providerId: string;
-    leaseExpiresAt: string;
-    issuedAt: string;
     signature: {
         value: string;
         algorithm: "Ed25519";
         keyId: string;
     };
+    issuedAt: string;
+    leaseExpiresAt: string;
     sandboxId: string;
 }, {
     teamId: string;
     assignmentId: string;
     schemaVersion: "treeseed.sandbox-lease-renewal/v1";
     providerId: string;
-    leaseExpiresAt: string;
-    issuedAt: string;
     signature: {
         value: string;
         algorithm: "Ed25519";
         keyId: string;
     };
+    issuedAt: string;
+    leaseExpiresAt: string;
     sandboxId: string;
 }>;
 export declare const sandboxResultSchema: z.ZodObject<{
@@ -414,9 +442,102 @@ export declare const sandboxResultSchema: z.ZodObject<{
     diagnostics?: Record<string, unknown> | undefined;
     responseMarkdown?: string | undefined;
 }>;
+export declare const providerEnvironmentReceiptSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.provider-environment-receipt/v1">;
+    assignmentId: z.ZodString;
+    offerId: z.ZodString;
+    providerId: z.ZodString;
+    imageDigest: z.ZodString;
+    baseLineage: z.ZodObject<{
+        baseImageDigest: z.ZodString;
+        provenanceDigest: z.ZodString;
+        architectures: z.ZodArray<z.ZodEnum<["amd64", "arm64"]>, "many">;
+    }, "strict", z.ZodTypeAny, {
+        baseImageDigest: string;
+        provenanceDigest: string;
+        architectures: ("amd64" | "arm64")[];
+    }, {
+        baseImageDigest: string;
+        provenanceDigest: string;
+        architectures: ("amd64" | "arm64")[];
+    }>;
+    securityAttestationDigest: z.ZodString;
+    brokerVersion: z.ZodString;
+    teardown: z.ZodObject<{
+        verified: z.ZodBoolean;
+        completedAt: z.ZodNullable<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        completedAt: string | null;
+        verified: boolean;
+    }, {
+        completedAt: string | null;
+        verified: boolean;
+    }>;
+    createdAt: z.ZodString;
+    signature: z.ZodObject<{
+        keyId: z.ZodString;
+        algorithm: z.ZodLiteral<"Ed25519">;
+        value: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        value: string;
+        algorithm: "Ed25519";
+        keyId: string;
+    }, {
+        value: string;
+        algorithm: "Ed25519";
+        keyId: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    assignmentId: string;
+    schemaVersion: "treeseed.provider-environment-receipt/v1";
+    createdAt: string;
+    providerId: string;
+    signature: {
+        value: string;
+        algorithm: "Ed25519";
+        keyId: string;
+    };
+    offerId: string;
+    teardown: {
+        completedAt: string | null;
+        verified: boolean;
+    };
+    imageDigest: string;
+    baseLineage: {
+        baseImageDigest: string;
+        provenanceDigest: string;
+        architectures: ("amd64" | "arm64")[];
+    };
+    securityAttestationDigest: string;
+    brokerVersion: string;
+}, {
+    assignmentId: string;
+    schemaVersion: "treeseed.provider-environment-receipt/v1";
+    createdAt: string;
+    providerId: string;
+    signature: {
+        value: string;
+        algorithm: "Ed25519";
+        keyId: string;
+    };
+    offerId: string;
+    teardown: {
+        completedAt: string | null;
+        verified: boolean;
+    };
+    imageDigest: string;
+    baseLineage: {
+        baseImageDigest: string;
+        provenanceDigest: string;
+        architectures: ("amd64" | "arm64")[];
+    };
+    securityAttestationDigest: string;
+    brokerVersion: string;
+}>;
 export type SandboxAssignment = z.infer<typeof sandboxAssignmentSchema>;
 export type SandboxEvent = z.infer<typeof sandboxEventSchema>;
 export type SandboxLeaseRenewal = z.infer<typeof sandboxLeaseRenewalSchema>;
 export type SandboxResult = z.infer<typeof sandboxResultSchema>;
+export type ProviderEnvironmentReceipt = z.infer<typeof providerEnvironmentReceiptSchema>;
 export type SandboxEnvironmentProfile = z.infer<typeof sandboxProfile>;
 export {};

package/dist/capacity-provider/sandbox-contracts.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 const identifier = z.string().regex(/^[a-z][a-z0-9._-]{0,127}$/u);
 const digest = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
-const sandboxProfile = z.enum(["read", "unit", "integration", "platform", "connected"]);
+const sandboxProfile = identifier;
 const sandboxAssignmentSchema = z.object({
   schemaVersion: z.literal("treeseed.sandbox-assignment/v1"),
   assignmentId: z.string().min(1),
@@ -11,6 +11,7 @@ const sandboxAssignmentSchema = z.object({
   teamId: z.string().min(1),
   projectId: z.string().min(1),
   profile: sandboxProfile,
+  environmentContract: z.object({ id: identifier, version: z.string().regex(/^\d+\.\d+\.\d+$/u), digest, capabilities: z.array(identifier) }).strict().optional(),
   guestImage: z.string().min(1),
   guestImageDigest: digest,
   identityManifestDigest: digest,
@@ -63,7 +64,21 @@ const sandboxResultSchema = z.object({
   diagnostics: z.record(z.unknown()).default({}),
   teardown: z.object({ verified: z.boolean(), completedAt: z.string().datetime().nullable() }).strict()
 }).strict();
+const providerEnvironmentReceiptSchema = z.object({
+  schemaVersion: z.literal("treeseed.provider-environment-receipt/v1"),
+  assignmentId: z.string().min(1),
+  offerId: identifier,
+  providerId: z.string().min(1),
+  imageDigest: digest,
+  baseLineage: z.object({ baseImageDigest: digest, provenanceDigest: digest, architectures: z.array(z.enum(["amd64", "arm64"])).min(1) }).strict(),
+  securityAttestationDigest: digest,
+  brokerVersion: z.string().min(1),
+  teardown: z.object({ verified: z.boolean(), completedAt: z.string().datetime().nullable() }).strict(),
+  createdAt: z.string().datetime(),
+  signature: z.object({ keyId: identifier, algorithm: z.literal("Ed25519"), value: z.string().min(1) }).strict()
+}).strict();
 export {
+  providerEnvironmentReceiptSchema,
   sandboxAssignmentSchema,
   sandboxEventSchema,
   sandboxLeaseRenewalSchema,

package/dist/capacity-provider/validation.d.ts

@@ -1,4 +1,4 @@
-import { type CapacityProviderManifestV3, type CapacityProviderManifestV4, type CapacityProviderProofPayload, type CapacityProviderPublicJwk, type ProviderSupplyOffer } from './contracts/index.js';
+import { type CapacityProviderManifestV3, type CapacityProviderManifestV4, type CapacityProviderManifestV5, type CapacityProviderProofPayload, type CapacityProviderPublicJwk, type ProviderSupplyOffer } from './contracts/index.js';
 export interface CapacityProviderContractDiagnostic {
     code: string;
     path: string;
@@ -21,6 +21,7 @@ export declare function validateCapacityProviderProofPayload(payload: CapacityPr
 export declare function validateProviderSupplyOffer(offer: ProviderSupplyOffer, path?: string): CapacityProviderContractValidation;
 export declare function validateCapacityProviderManifestV3(manifest: CapacityProviderManifestV3): CapacityProviderContractValidation;
 export declare function validateCapacityProviderManifestV4(manifest: CapacityProviderManifestV4): CapacityProviderContractValidation;
+export declare function validateCapacityProviderManifestV5(manifest: CapacityProviderManifestV5): CapacityProviderContractValidation;
 export declare function capacityProviderSecurityDefaults(): {
     proofTtlSeconds: number;
     accessTokenTtlSeconds: number;

package/dist/capacity-provider/validation.js

@@ -187,13 +187,45 @@ function validateCapacityProviderManifestV4(manifest) {
   if (!manifest.sandbox?.brokerSocket?.startsWith("/run/treeseed/")) add(diagnostics, "provider_sandbox_socket_invalid", "sandbox.brokerSocket", "Sandbox broker socket must remain under /run/treeseed.");
   const profiles = new Set((manifest.sandbox?.profiles ?? []).map((profile) => profile.id));
   for (const [index, profile] of (manifest.sandbox?.profiles ?? []).entries()) {
-    if (!["read", "unit", "integration", "platform", "connected"].includes(profile.id)) add(diagnostics, "provider_sandbox_profile_invalid", `sandbox.profiles[${index}].id`, "Sandbox profile must be one of read, unit, integration, platform, or connected.");
+    if (!/^[a-z][a-z0-9._-]{0,127}$/u.test(profile.id)) add(diagnostics, "provider_sandbox_profile_invalid", `sandbox.profiles[${index}].id`, "Sandbox profile id must be a provider-local identifier.");
+    if (profile.contract) {
+      if (!/^[a-z][a-z0-9._-]{0,127}$/u.test(profile.contract.id) || !/^\d+\.\d+\.\d+$/u.test(profile.contract.version) || !/^sha256:[a-f0-9]{64}$/u.test(profile.contract.digest)) add(diagnostics, "provider_sandbox_contract_invalid", `sandbox.profiles[${index}].contract`, "Portable sandbox contracts require an id, exact semantic version, and immutable digest.");
+      if (!Array.isArray(profile.contract.capabilities) || profile.contract.capabilities.some((capability) => !/^[a-z][a-z0-9._-]{0,127}$/u.test(capability))) add(diagnostics, "provider_sandbox_contract_capabilities_invalid", `sandbox.profiles[${index}].contract.capabilities`, "Sandbox contract capabilities must be portable identifiers.");
+    }
     if (!/^sha256:[a-f0-9]{64}$/u.test(profile.guestImageDigest)) add(diagnostics, "provider_sandbox_image_digest_invalid", `sandbox.profiles[${index}].guestImageDigest`, "Guest images require an immutable SHA-256 digest.");
     if (profile.defaultDenyNetwork !== true) add(diagnostics, "provider_sandbox_network_policy_invalid", `sandbox.profiles[${index}].defaultDenyNetwork`, "Sandbox networking must default deny.");
   }
   for (const [index, adapter] of manifest.adapters.entries()) {
     if (adapter.isolation !== "microvm") add(diagnostics, "provider_v4_microvm_required", `adapters[${index}].isolation`, "Manifest v4 adapters must use microvm isolation.");
     for (const profile of adapter.sandboxProfileIds ?? []) if (!profiles.has(profile)) add(diagnostics, "provider_sandbox_profile_unknown", `adapters[${index}].sandboxProfileIds`, `Unknown sandbox profile ${profile}.`);
+    for (const [purpose, profile] of Object.entries(adapter.defaultSandboxProfiles ?? {})) if (!profiles.has(profile)) add(diagnostics, "provider_sandbox_default_unknown", `adapters[${index}].defaultSandboxProfiles.${purpose}`, `Unknown default sandbox profile ${profile}.`);
+  }
+  return result(diagnostics);
+}
+function validateCapacityProviderManifestV5(manifest) {
+  const compatible = { ...manifest, schemaVersion: 4, adapters: manifest.adapters.map((adapter) => ({
+    ...adapter,
+    capabilities: [...new Set(adapter.offers.flatMap(({ offer }) => offer.capabilities.map(({ id }) => id)))],
+    sandboxProfileIds: [...new Set(adapter.offers.map(({ sandboxProfileId }) => sandboxProfileId))],
+    defaultSandboxProfiles: void 0
+  })) };
+  const diagnostics = validateCapacityProviderManifestV4(compatible).diagnostics.filter((entry) => entry.code !== "provider_sandbox_default_unknown");
+  if (manifest.schemaVersion !== 5) add(diagnostics, "provider_manifest_schema_invalid", "schemaVersion", "Capacity provider manifest schemaVersion must be 5.");
+  if (!Number.isInteger(manifest.ontology?.generation) || manifest.ontology.generation < 1 || !/^sha256:[a-f0-9]{64}$/u.test(manifest.ontology?.digest ?? "")) add(diagnostics, "provider_ontology_binding_invalid", "ontology", "Manifest v5 requires an exact ontology generation and digest.");
+  const profiles = new Set(manifest.sandbox.profiles.map(({ id }) => id)), offerIds = /* @__PURE__ */ new Set();
+  for (const [profileIndex, profile] of manifest.sandbox.profiles.entries()) {
+    if (!profile.lineage || !/^sha256:[a-f0-9]{64}$/u.test(profile.lineage.baseImageDigest) || !/^sha256:[a-f0-9]{64}$/u.test(profile.lineage.provenanceDigest) || !profile.lineage.architectures.length || !profile.lineage.signature.value) add(diagnostics, "provider_sandbox_lineage_required", `sandbox.profiles[${profileIndex}].lineage`, "Manifest v5 sandbox images require signed exact sandbox-base lineage and architectures.");
+  }
+  for (const [adapterIndex, adapter] of manifest.adapters.entries()) {
+    if (!adapter.offers.length) add(diagnostics, "provider_adapter_offers_required", `adapters[${adapterIndex}].offers`, "Every v5 adapter must expose at least one standardized capability offer.");
+    for (const [offerIndex, binding] of adapter.offers.entries()) {
+      const path = `adapters[${adapterIndex}].offers[${offerIndex}]`;
+      if (offerIds.has(binding.offer.offerId)) add(diagnostics, "provider_offer_id_duplicate", `${path}.offer.offerId`, "Offer ids must be provider-global unique.");
+      offerIds.add(binding.offer.offerId);
+      if (!profiles.has(binding.sandboxProfileId)) add(diagnostics, "provider_offer_sandbox_unknown", `${path}.sandboxProfileId`, "Offer references an unknown provider-local sandbox profile.");
+      if (binding.offer.capabilities.some((reference) => !reference.id.startsWith("treeseed.") && !reference.id.startsWith("provider."))) add(diagnostics, "provider_offer_capability_namespace_invalid", `${path}.offer.capabilities`, "Offers require standardized TreeSeed or provider capability references.");
+      if (binding.offer.conformance.some((entry) => entry.status !== "passed")) add(diagnostics, "provider_offer_conformance_failed", `${path}.offer.conformance`, "Only passing capability conformance may be advertised.");
+    }
   }
   return result(diagnostics);
 }
@@ -211,6 +243,7 @@ export {
   result,
   validateCapacityProviderManifestV3,
   validateCapacityProviderManifestV4,
+  validateCapacityProviderManifestV5,
   validateCapacityProviderProofPayload,
   validateCapacityProviderPublicJwk,
   validateProviderSupplyOffer