@treeseed/sdk 0.13.0-rc.55 → 0.13.0-rc.57

package/dist/deployment/schemas.d.ts

@@ -1,5 +1,149 @@
 import { z } from 'zod';
 export declare const deploymentTrackSchema: z.ZodEnum<["stable", "development"]>;
+export declare const hostCredentialInitializerSchema: z.ZodEffects<z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.host-credential-initializer/v1">;
+    id: z.ZodString;
+    displayName: z.ZodString;
+    description: z.ZodString;
+    credentialId: z.ZodString;
+    sources: z.ZodArray<z.ZodEffects<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        kind: z.ZodEnum<["file", "secret"]>;
+        prompt: z.ZodString;
+        suggestedPaths: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        contentType: z.ZodEnum<["application/json", "text/plain"]>;
+        minimumBytes: z.ZodNumber;
+        maximumBytes: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        kind: "secret" | "file";
+        id: string;
+        label: string;
+        prompt: string;
+        suggestedPaths: string[];
+        contentType: "application/json" | "text/plain";
+        minimumBytes: number;
+        maximumBytes: number;
+    }, {
+        kind: "secret" | "file";
+        id: string;
+        label: string;
+        prompt: string;
+        contentType: "application/json" | "text/plain";
+        minimumBytes: number;
+        maximumBytes: number;
+        suggestedPaths?: string[] | undefined;
+    }>, {
+        kind: "secret" | "file";
+        id: string;
+        label: string;
+        prompt: string;
+        suggestedPaths: string[];
+        contentType: "application/json" | "text/plain";
+        minimumBytes: number;
+        maximumBytes: number;
+    }, {
+        kind: "secret" | "file";
+        id: string;
+        label: string;
+        prompt: string;
+        contentType: "application/json" | "text/plain";
+        minimumBytes: number;
+        maximumBytes: number;
+        suggestedPaths?: string[] | undefined;
+    }>, "many">;
+    activation: z.ZodObject<{
+        kind: z.ZodLiteral<"sandbox-model-gateway">;
+        authenticationModes: z.ZodRecord<z.ZodString, z.ZodEnum<["api-key", "subscription-file"]>>;
+    }, "strict", z.ZodTypeAny, {
+        kind: "sandbox-model-gateway";
+        authenticationModes: Record<string, "api-key" | "subscription-file">;
+    }, {
+        kind: "sandbox-model-gateway";
+        authenticationModes: Record<string, "api-key" | "subscription-file">;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.host-credential-initializer/v1";
+    id: string;
+    displayName: string;
+    description: string;
+    credentialId: string;
+    sources: {
+        kind: "secret" | "file";
+        id: string;
+        label: string;
+        prompt: string;
+        suggestedPaths: string[];
+        contentType: "application/json" | "text/plain";
+        minimumBytes: number;
+        maximumBytes: number;
+    }[];
+    activation: {
+        kind: "sandbox-model-gateway";
+        authenticationModes: Record<string, "api-key" | "subscription-file">;
+    };
+}, {
+    schemaVersion: "treeseed.host-credential-initializer/v1";
+    id: string;
+    displayName: string;
+    description: string;
+    credentialId: string;
+    sources: {
+        kind: "secret" | "file";
+        id: string;
+        label: string;
+        prompt: string;
+        contentType: "application/json" | "text/plain";
+        minimumBytes: number;
+        maximumBytes: number;
+        suggestedPaths?: string[] | undefined;
+    }[];
+    activation: {
+        kind: "sandbox-model-gateway";
+        authenticationModes: Record<string, "api-key" | "subscription-file">;
+    };
+}>, {
+    schemaVersion: "treeseed.host-credential-initializer/v1";
+    id: string;
+    displayName: string;
+    description: string;
+    credentialId: string;
+    sources: {
+        kind: "secret" | "file";
+        id: string;
+        label: string;
+        prompt: string;
+        suggestedPaths: string[];
+        contentType: "application/json" | "text/plain";
+        minimumBytes: number;
+        maximumBytes: number;
+    }[];
+    activation: {
+        kind: "sandbox-model-gateway";
+        authenticationModes: Record<string, "api-key" | "subscription-file">;
+    };
+}, {
+    schemaVersion: "treeseed.host-credential-initializer/v1";
+    id: string;
+    displayName: string;
+    description: string;
+    credentialId: string;
+    sources: {
+        kind: "secret" | "file";
+        id: string;
+        label: string;
+        prompt: string;
+        contentType: "application/json" | "text/plain";
+        minimumBytes: number;
+        maximumBytes: number;
+        suggestedPaths?: string[] | undefined;
+    }[];
+    activation: {
+        kind: "sandbox-model-gateway";
+        authenticationModes: Record<string, "api-key" | "subscription-file">;
+    };
+}>;
+export type HostCredentialInitializer = z.infer<typeof hostCredentialInitializerSchema>;
 export declare const hostRoleSchema: z.ZodUnion<[z.ZodEnum<["integrated", "capacity-provider", "control-plane", "knowledge", "ai-gpu", "edge"]>, z.ZodString]>;
 export declare const hostConnectionBindingSchema: z.ZodEffects<z.ZodUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"local">;
@@ -1167,15 +1311,15 @@ export declare const hostConfigurationSchema: z.ZodObject<{
                 allowedModels: string[];
             }>;
             profiles: z.ZodArray<z.ZodObject<{
-                id: z.ZodEnum<["read", "unit", "integration", "platform", "connected"]>;
+                id: z.ZodString;
                 guestImage: z.ZodString;
                 guestImageDigest: z.ZodString;
             }, "strict", z.ZodTypeAny, {
-                id: "read" | "unit" | "integration" | "platform" | "connected";
+                id: string;
                 guestImage: string;
                 guestImageDigest: string;
             }, {
-                id: "read" | "unit" | "integration" | "platform" | "connected";
+                id: string;
                 guestImage: string;
                 guestImageDigest: string;
             }>, "many">;
@@ -1189,7 +1333,7 @@ export declare const hostConfigurationSchema: z.ZodObject<{
                 allowedModels: string[];
             };
             profiles: {
-                id: "read" | "unit" | "integration" | "platform" | "connected";
+                id: string;
                 guestImage: string;
                 guestImageDigest: string;
             }[];
@@ -1203,7 +1347,7 @@ export declare const hostConfigurationSchema: z.ZodObject<{
                 allowedModels: string[];
             };
             profiles: {
-                id: "read" | "unit" | "integration" | "platform" | "connected";
+                id: string;
                 guestImage: string;
                 guestImageDigest: string;
             }[];
@@ -1254,7 +1398,7 @@ export declare const hostConfigurationSchema: z.ZodObject<{
                 allowedModels: string[];
             };
             profiles: {
-                id: "read" | "unit" | "integration" | "platform" | "connected";
+                id: string;
                 guestImage: string;
                 guestImageDigest: string;
             }[];
@@ -1283,7 +1427,7 @@ export declare const hostConfigurationSchema: z.ZodObject<{
                 allowedModels: string[];
             };
             profiles: {
-                id: "read" | "unit" | "integration" | "platform" | "connected";
+                id: string;
                 guestImage: string;
                 guestImageDigest: string;
             }[];
@@ -1423,7 +1567,7 @@ export declare const hostConfigurationSchema: z.ZodObject<{
                 allowedModels: string[];
             };
             profiles: {
-                id: "read" | "unit" | "integration" | "platform" | "connected";
+                id: string;
                 guestImage: string;
                 guestImageDigest: string;
             }[];
@@ -1563,7 +1707,7 @@ export declare const hostConfigurationSchema: z.ZodObject<{
                 allowedModels: string[];
             };
             profiles: {
-                id: "read" | "unit" | "integration" | "platform" | "connected";
+                id: string;
                 guestImage: string;
                 guestImageDigest: string;
             }[];
@@ -3965,12 +4109,12 @@ export declare const integrationReleaseSchema: z.ZodEffects<z.ZodObject<{
             url: string;
         };
     }[];
+    release: string;
+    compatibilityId: string;
     platform: {
         repository: "treeseed-ai/platform";
         commit: string;
     };
-    release: string;
-    compatibilityId: string;
     deployment: {
         repository: "treeseed-ai/deployment";
         commit: string;
@@ -4005,12 +4149,12 @@ export declare const integrationReleaseSchema: z.ZodEffects<z.ZodObject<{
             url: string;
         };
     }[];
+    release: string;
+    compatibilityId: string;
     platform: {
         repository: "treeseed-ai/platform";
         commit: string;
     };
-    release: string;
-    compatibilityId: string;
     deployment: {
         repository: "treeseed-ai/deployment";
         commit: string;
@@ -4045,12 +4189,12 @@ export declare const integrationReleaseSchema: z.ZodEffects<z.ZodObject<{
             url: string;
         };
     }[];
+    release: string;
+    compatibilityId: string;
     platform: {
         repository: "treeseed-ai/platform";
         commit: string;
     };
-    release: string;
-    compatibilityId: string;
     deployment: {
         repository: "treeseed-ai/deployment";
         commit: string;
@@ -4085,12 +4229,12 @@ export declare const integrationReleaseSchema: z.ZodEffects<z.ZodObject<{
             url: string;
         };
     }[];
+    release: string;
+    compatibilityId: string;
     platform: {
         repository: "treeseed-ai/platform";
         commit: string;
     };
-    release: string;
-    compatibilityId: string;
     deployment: {
         repository: "treeseed-ai/deployment";
         commit: string;
@@ -6281,6 +6425,11 @@ export declare const hostUpdateSchema: z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     schemaVersion: "treeseed.host-update/v1";
     state: "failed" | "planned" | "rolled-back" | "draining" | "applying" | "healthy";
+    activation: {
+        policy: "maintenance-window" | "continuous";
+        eligibleAt: string;
+        jitterSeconds: number;
+    };
     track: "stable" | "development";
     components: {
         from: string | null;
@@ -6291,14 +6440,14 @@ export declare const hostUpdateSchema: z.ZodObject<{
     updateId: string;
     fromCatalogDigest: string;
     toCatalogDigest: string;
+}, {
+    schemaVersion: "treeseed.host-update/v1";
+    state: "failed" | "planned" | "rolled-back" | "draining" | "applying" | "healthy";
     activation: {
         policy: "maintenance-window" | "continuous";
         eligibleAt: string;
         jitterSeconds: number;
     };
-}, {
-    schemaVersion: "treeseed.host-update/v1";
-    state: "failed" | "planned" | "rolled-back" | "draining" | "applying" | "healthy";
     track: "stable" | "development";
     components: {
         from: string | null;
@@ -6309,11 +6458,6 @@ export declare const hostUpdateSchema: z.ZodObject<{
     updateId: string;
     fromCatalogDigest: string;
     toCatalogDigest: string;
-    activation: {
-        policy: "maintenance-window" | "continuous";
-        eligibleAt: string;
-        jitterSeconds: number;
-    };
 }>;
 export declare const hostReceiptSchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<"treeseed.host-receipt/v1">;

package/dist/deployment/schemas.js

@@ -15,6 +15,31 @@ const localAlias = z.string().regex(
 const binding = z.string().regex(/^(?:\[[0-9a-f:]+\]|[^:]+):[1-9][0-9]{0,4}$/iu);
 const httpsUrl = z.string().url().refine((value) => new URL(value).protocol === "https:", "Remote TreeSeed connections require HTTPS.");
 const deploymentTrackSchema = z.enum(["stable", "development"]);
+const hostCredentialInitializerSchema = z.object({
+  schemaVersion: z.literal("treeseed.host-credential-initializer/v1"),
+  id: identifier,
+  displayName: z.string().min(1).max(128),
+  description: z.string().min(1).max(1024),
+  credentialId: identifier,
+  sources: z.array(z.object({
+    id: identifier,
+    label: z.string().min(1).max(128),
+    kind: z.enum(["file", "secret"]),
+    prompt: z.string().min(1).max(256),
+    suggestedPaths: z.array(z.string().min(1).max(4096)).max(16).default([]),
+    contentType: z.enum(["application/json", "text/plain"]),
+    minimumBytes: z.number().int().positive().max(1048576),
+    maximumBytes: z.number().int().positive().max(1048576)
+  }).strict().refine((source) => source.maximumBytes >= source.minimumBytes, "Credential source maximum must be at least its minimum.")).min(1),
+  activation: z.object({
+    kind: z.literal("sandbox-model-gateway"),
+    authenticationModes: z.record(identifier, z.enum(["api-key", "subscription-file"]))
+  }).strict()
+}).strict().superRefine((initializer, context) => {
+  for (const source of initializer.sources) if (!initializer.activation.authenticationModes[source.id]) {
+    context.addIssue({ code: z.ZodIssueCode.custom, path: ["activation", "authenticationModes", source.id], message: "Every credential source requires an activation mode." });
+  }
+});
 const hostRoleSchema = z.union([
   z.enum(["integrated", "capacity-provider", "control-plane", "knowledge", "ai-gpu", "edge"]),
   identifier
@@ -118,7 +143,7 @@ const hostConfigurationSchema = z.object({
       runtime: z.literal("kata-runtime-rs-qemu"),
       brokerSocket: z.string().startsWith("/run/treeseed/"),
       modelGateway: z.object({ provider: z.literal("openai"), upstreamBaseUrl: z.literal("https://api.openai.com"), allowedModels: z.array(z.string().min(1)).min(1) }).strict(),
-      profiles: z.array(z.object({ id: z.enum(["read", "unit", "integration", "platform", "connected"]), guestImage: z.string().min(1), guestImageDigest: digest }).strict()).min(1)
+      profiles: z.array(z.object({ id: identifier, guestImage: z.string().min(1), guestImageDigest: digest }).strict()).min(1)
     }).strict(),
     providerVolume: z.object({ encryption: z.literal("luks2"), backingPath: z.string().startsWith("/"), mountPath: z.string().startsWith("/"), sizeBytes: z.number().int().min(1073741824), unlock: z.enum(["tpm2", "systemd-credential"]), recoveryRequired: z.literal(true) }).strict(),
     applicationEncryption: z.object({ provider: z.literal("systemd-credential"), activeKeyVersion: z.number().int().positive(), diagnosticsKeyVersion: z.number().int().positive() }).strict()
@@ -342,6 +367,7 @@ export {
   hostComponentSchema,
   hostConfigurationSchema,
   hostConnectionBindingSchema,
+  hostCredentialInitializerSchema,
   hostMigrationSchema,
   hostPlanSchema,
   hostReceiptSchema,

package/dist/operator-contracts/canonical-command-tree.js

@@ -19,6 +19,8 @@ const operationBindings = {
   "topics show": operation("communications.topics.show", [field("path", "teamId", "context", "team", true), field("path", "channel", "argument", "topic", true)]),
   "topics subscribe": operation("communications.topics.subscriptions.put", [field("path", "teamId", "context", "team", true), field("path", "channel", "argument", "topic", true), field("body", "agent", "argument", "agent", true)]),
   "topics unsubscribe": operation("communications.topics.subscriptions.delete", [field("path", "teamId", "context", "team", true), field("path", "channel", "argument", "topic", true), field("body", "agent", "argument", "agent", true)]),
+  "capabilities list": operation("capabilities.list", [field("query", "status", "option"), field("query", "family", "option"), field("query", "namespace", "option"), field("query", "limit", "option", "limit", false, "integer"), field("query", "cursor", "option")]),
+  "capabilities show": operation("capabilities.show", [field("path", "capabilityId", "argument", "capability", true), field("query", "version", "option")]),
   "teams list": operation("teams.list", page()),
   "teams current": local("local.teams.current"),
   "teams use": local("local.teams.use"),
@@ -51,6 +53,9 @@ const operationBindings = {
   "host topology": local("local.host.topology"),
   "host connections": local("local.host.connections"),
   "host provider status": local("local.host.provider.status"),
+  "host provider credentials list": local("local.host.provider.credentials.list"),
+  "host provider credentials status": local("local.host.provider.credentials.status"),
+  "host provider credentials initialize": local("local.host.provider.credentials.initialize"),
   "host storage status": local("local.host.storage.status"),
   "host storage connect": local("local.host.storage.connect"),
   "host storage reconcile": local("local.host.storage.reconcile"),
@@ -212,6 +217,13 @@ function hostSecurityRotate() {
   ];
   return value;
 }
+function hostProviderCredentialInitialize() {
+  const value = leaf("initialize", "mutation", "initializer", "credential");
+  if (value.nodeType !== "leaf") throw new Error("Provider credential initialization must be a leaf command.");
+  value.description = "Initialize an execution-provider credential through its registered host initializer.";
+  value.options = [...value.options ?? [], { name: "--source", description: "Registered credential source to use instead of automatic selection.", type: "string" }];
+  return value;
+}
 function hostRecoveryVerify() {
   return {
     nodeType: "leaf",
@@ -299,6 +311,10 @@ const commandTree = {
       { nodeType: "leaf", segment: "subscribe", description: "Subscribe an agent to a discussion topic.", kind: "mutation", arguments: [{ name: "topic", description: "Discussion topic.", required: true }, { name: "agent", description: "@project/agent handle.", required: true }], options: [planOption], authorization: { capability: "agents.execute", confirmation: "never" }, resultSchemaId: "treeseed.communication-topic-subscription-receipt/v1", execution: unavailable() },
       { nodeType: "leaf", segment: "unsubscribe", description: "Remove an agent subscription from a discussion topic.", kind: "mutation", arguments: [{ name: "topic", description: "Discussion topic.", required: true }, { name: "agent", description: "@project/agent handle.", required: true }], options: [planOption], authorization: { capability: "agents.execute", confirmation: "never" }, resultSchemaId: "treeseed.communication-topic-subscription-receipt/v1", execution: unavailable() }
     ]),
+    branch("capabilities", [
+      { nodeType: "leaf", segment: "list", description: "List standardized services in the active capability ontology.", kind: "read", options: [{ name: "--family", description: "Capability family filter.", type: "string" }, { name: "--namespace", description: "Namespace filter.", type: "string" }, { name: "--status", description: "Definition status.", type: "string" }, { name: "--limit", description: "Maximum definitions.", type: "number" }, { name: "--cursor", description: "Pagination cursor.", type: "string" }], resultSchemaId: "treeseed.capability-page/v1", execution: unavailable() },
+      { nodeType: "leaf", segment: "show", description: "Show one standardized capability definition.", kind: "read", arguments: [{ name: "capability", description: "Namespaced capability ID.", required: true }], options: [{ name: "--version", description: "Exact semantic version.", type: "string" }], resultSchemaId: "treeseed.capability-definition/v1", execution: unavailable() }
+    ]),
     branch("auth", [authLogin(), leaf("logout", "mutation"), leaf("status")]),
     branch("users", [userCreate()]),
     branch("teams", [leaf("list"), { nodeType: "leaf", segment: "current", description: "Show the active team for this authenticated server session.", kind: "read", resultSchemaId: "treeseed.command.teams.current/v1", execution: unavailable() }, { nodeType: "leaf", segment: "use", description: "Select the active team for this authenticated server session.", kind: "mutation", arguments: [{ name: "team", description: "Team UUID or unambiguous slug.", required: true }], options: [planOption], authorization: { capability: "teams.read", confirmation: "never" }, resultSchemaId: "treeseed.command.teams.use/v1", execution: unavailable() }]),
@@ -326,7 +342,7 @@ const commandTree = {
       branch("config", [leaf("show"), leaf("plan", "read", "file"), leaf("apply", "mutation", "file", "authority"), configurationAdopt()]),
       leaf("topology"),
       leaf("connections"),
-      branch("provider", [leaf("status")]),
+      branch("provider", [leaf("status"), branch("credentials", [leaf("list"), leaf("status"), hostProviderCredentialInitialize()])]),
       branch("storage", [
         leaf("status"),
         addOptions(leaf("connect", "mutation", "backend", "credential"), [{ name: "--account-id", description: "Optional Cloudflare account ID when the bootstrap authority reaches multiple accounts.", type: "string" }]),

package/dist/operator-contracts/catalog/capability-ontology-operations.d.ts

@@ -0,0 +1,164 @@
+export declare function capabilityOntologyOperations(): {
+    list: import("../control-plane-operation.js").ControlPlaneOperationBinding<{}, {
+        status?: "active" | "deprecated" | "revoked" | undefined;
+        family?: string | undefined;
+        cursor?: string | undefined;
+        limit?: number | undefined;
+        namespace?: string | undefined;
+    }, undefined, {
+        generation: number;
+        items: {
+            schemaVersion: "treeseed.capability-definition/v1";
+            status: "active" | "deprecated" | "revoked";
+            createdAt: string;
+            id: string;
+            outputs: {
+                id: string;
+                digest: string;
+                version: string;
+                mediaTypes?: string[] | undefined;
+            }[];
+            digest: string;
+            version: string;
+            description: string;
+            configuration: {
+                key: string;
+                description: string;
+                schema: Record<string, unknown>;
+                requirementSupport: ("required" | "preferred")[];
+                securityCritical?: boolean | undefined;
+            }[];
+            family: "research" | "coordination" | "data" | "engineering" | "publishing" | "external-work";
+            title: string;
+            features: string[];
+            inputs: {
+                id: string;
+                digest: string;
+                version: string;
+                mediaTypes?: string[] | undefined;
+            }[];
+            permissionClasses: string[];
+            contextModes: string[];
+            interactionModes: string[];
+            implies: {
+                id: string;
+                digest: string;
+                version: string;
+            }[];
+            conflicts: {
+                id: string;
+                digest: string;
+                version: string;
+            }[];
+            qualificationTier: "signed-attestation" | "automated-suite" | "reviewed-certification";
+        }[];
+        ontologyDigest: string;
+        nextCursor: string | null;
+    }>;
+    show: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
+        capabilityId: string;
+    }, {
+        version?: string | undefined;
+    }, undefined, {
+        schemaVersion: "treeseed.capability-definition/v1";
+        status: "active" | "deprecated" | "revoked";
+        createdAt: string;
+        id: string;
+        outputs: {
+            id: string;
+            digest: string;
+            version: string;
+            mediaTypes?: string[] | undefined;
+        }[];
+        digest: string;
+        version: string;
+        description: string;
+        configuration: {
+            key: string;
+            description: string;
+            schema: Record<string, unknown>;
+            requirementSupport: ("required" | "preferred")[];
+            securityCritical?: boolean | undefined;
+        }[];
+        family: "research" | "coordination" | "data" | "engineering" | "publishing" | "external-work";
+        title: string;
+        features: string[];
+        inputs: {
+            id: string;
+            digest: string;
+            version: string;
+            mediaTypes?: string[] | undefined;
+        }[];
+        permissionClasses: string[];
+        contextModes: string[];
+        interactionModes: string[];
+        implies: {
+            id: string;
+            digest: string;
+            version: string;
+        }[];
+        conflicts: {
+            id: string;
+            digest: string;
+            version: string;
+        }[];
+        qualificationTier: "signed-attestation" | "automated-suite" | "reviewed-certification";
+    }>;
+    generation: import("../control-plane-operation.js").ControlPlaneOperationBinding<{}, {}, undefined, {
+        schemaVersion: "treeseed.capability-ontology/v1";
+        createdAt: string;
+        generation: number;
+        digest: string;
+        aliases: Record<string, string>;
+        definitions: {
+            schemaVersion: "treeseed.capability-definition/v1";
+            status: "active" | "deprecated" | "revoked";
+            createdAt: string;
+            id: string;
+            outputs: {
+                id: string;
+                digest: string;
+                version: string;
+                mediaTypes?: string[] | undefined;
+            }[];
+            digest: string;
+            version: string;
+            description: string;
+            configuration: {
+                key: string;
+                description: string;
+                schema: Record<string, unknown>;
+                requirementSupport: ("required" | "preferred")[];
+                securityCritical?: boolean | undefined;
+            }[];
+            family: "research" | "coordination" | "data" | "engineering" | "publishing" | "external-work";
+            title: string;
+            features: string[];
+            inputs: {
+                id: string;
+                digest: string;
+                version: string;
+                mediaTypes?: string[] | undefined;
+            }[];
+            permissionClasses: string[];
+            contextModes: string[];
+            interactionModes: string[];
+            implies: {
+                id: string;
+                digest: string;
+                version: string;
+            }[];
+            conflicts: {
+                id: string;
+                digest: string;
+                version: string;
+            }[];
+            qualificationTier: "signed-attestation" | "automated-suite" | "reviewed-certification";
+        }[];
+        signature: {
+            value: string;
+            algorithm: "Ed25519" | "release-catalog";
+            keyId: string;
+        };
+    }>;
+};

package/dist/operator-contracts/catalog/capability-ontology-operations.js

@@ -0,0 +1,24 @@
+import { z } from "zod";
+import { capabilityDefinitionSchema, capabilityOntologySchema } from "../../capacity-provider/capability-ontology.js";
+import { defineOperation } from "../operation-builder.js";
+const none = z.undefined(), empty = z.object({}).strict();
+function capabilityOntologyOperations() {
+  return {
+    list: defineOperation({ operationId: "capabilities.list", description: "List standardized execution capabilities from the active ontology generation.", rest: { method: "GET", path: "/v1/capability-ontology" }, parameters: "treeseed.capabilities.list.parameters/v1", capability: "capabilities.read", authentication: "oauth", oauthScopes: ["treeseed:read"], kind: "read", riskClass: "ordinary", confirmation: "never", surfaces: ["rest", "cli", "mcp_tool", "mcp_resource"], cacheScope: "principal", pagination: "cursor" }, {
+      path: empty,
+      query: z.object({ family: z.string().optional(), status: z.enum(["active", "deprecated", "revoked"]).optional(), namespace: z.string().optional(), limit: z.coerce.number().int().min(1).max(500).optional(), cursor: z.string().optional() }).strict(),
+      body: none,
+      output: z.object({ generation: z.number().int().positive(), ontologyDigest: z.string(), items: z.array(capabilityDefinitionSchema), nextCursor: z.string().nullable() }).strict()
+    }),
+    show: defineOperation({ operationId: "capabilities.show", description: "Read one exact standardized execution capability.", rest: { method: "GET", path: "/v1/capability-ontology/{capabilityId}" }, parameters: "treeseed.capabilities.show.parameters/v1", capability: "capabilities.read", authentication: "oauth", oauthScopes: ["treeseed:read"], kind: "read", riskClass: "ordinary", confirmation: "never", surfaces: ["rest", "cli", "mcp_tool", "mcp_resource"], cacheScope: "principal", pagination: "none" }, {
+      path: z.object({ capabilityId: z.string().min(1) }).strict(),
+      query: z.object({ version: z.string().optional() }).strict(),
+      body: none,
+      output: capabilityDefinitionSchema
+    }),
+    generation: defineOperation({ operationId: "capabilities.generation.show", description: "Read the complete active immutable capability ontology.", rest: { method: "GET", path: "/v1/capability-ontology/generations/active" }, capability: "capabilities.read", authentication: "oauth", oauthScopes: ["treeseed:read"], kind: "read", riskClass: "ordinary", confirmation: "never", surfaces: ["rest", "mcp_resource"], cacheScope: "principal", pagination: "none" }, { path: empty, query: empty, body: none, output: capabilityOntologySchema })
+  };
+}
+export {
+  capabilityOntologyOperations
+};

package/dist/operator-contracts/catalog/control-plane-catalog.d.ts

@@ -0,0 +1,6 @@
+import type { ControlPlaneOperationBinding, ControlPlaneOperationDescriptor } from '../control-plane-operation.js';
+export declare function flattenControlPlaneOperations(value: unknown, output?: ControlPlaneOperationBinding<any, any, any, any>[]): ControlPlaneOperationBinding<any, any, any, any>[];
+export declare function buildControlPlaneCatalog(operations: readonly ControlPlaneOperationBinding<any, any, any, any>[]): Readonly<{
+    schemaVersion: "treeseed.control-plane-catalog/v1";
+    operations: ControlPlaneOperationDescriptor[];
+}>;

package/dist/operator-contracts/catalog/control-plane-catalog.js

@@ -0,0 +1,18 @@
+function flattenControlPlaneOperations(value, output = []) {
+  if (value && typeof value === "object" && "descriptor" in value && "schema" in value) {
+    output.push(value);
+  } else if (value && typeof value === "object") {
+    for (const child of Object.values(value)) flattenControlPlaneOperations(child, output);
+  }
+  return output;
+}
+function buildControlPlaneCatalog(operations) {
+  return Object.freeze({
+    schemaVersion: "treeseed.control-plane-catalog/v1",
+    operations: operations.map((operation) => operation.descriptor)
+  });
+}
+export {
+  buildControlPlaneCatalog,
+  flattenControlPlaneOperations
+};