@treeseed/sdk 0.13.0-rc.6 → 0.13.0-rc.60

package/dist/operator-contracts/inbox/contracts.js

@@ -0,0 +1,134 @@
+import { z } from "zod";
+const inboxItemKindSchema = z.enum(["proposal", "question"]);
+const inboxItemStatusSchema = z.enum(["outstanding", "answered", "approved", "rejected", "closed", "deleted"]);
+const inboxActionKindSchema = z.enum(["publish_revision", "approve", "reject", "comment", "answer", "reply", "reopen"]);
+const inboxProvenanceSchema = z.object({
+  repositoryId: z.string().nullable(),
+  contentPath: z.string().nullable(),
+  commitSha: z.string().nullable(),
+  digest: z.string().nullable()
+}).strict();
+const inboxActionDescriptorSchema = z.object({
+  action: inboxActionKindSchema,
+  label: z.string(),
+  enabled: z.boolean(),
+  reason: z.string().nullable(),
+  requiresFeedback: z.boolean(),
+  confirmation: z.enum(["never", "input_required"])
+}).strict();
+const inboxCommentSchema = z.object({
+  id: z.string(),
+  parentId: z.string().nullable(),
+  kind: z.enum(["comment", "answer", "reply"]),
+  authorId: z.string(),
+  authorLabel: z.string(),
+  markdown: z.string(),
+  createdAt: z.string().datetime(),
+  provenance: inboxProvenanceSchema
+}).strict();
+const inboxItemSchema = z.object({
+  schemaVersion: z.literal("treeseed.inbox-item/v1"),
+  id: z.string(),
+  teamId: z.string(),
+  projectId: z.string(),
+  projectSlug: z.string(),
+  kind: inboxItemKindSchema,
+  title: z.string(),
+  markdown: z.string(),
+  status: inboxItemStatusSchema,
+  authorId: z.string(),
+  authorLabel: z.string(),
+  version: z.number().int().positive(),
+  discussionId: z.string().nullable(),
+  createdAt: z.string().datetime(),
+  updatedAt: z.string().datetime(),
+  provenance: inboxProvenanceSchema,
+  availableActions: z.array(inboxActionDescriptorSchema),
+  comments: z.array(inboxCommentSchema),
+  etag: z.string()
+}).strict();
+const inboxItemSummarySchema = inboxItemSchema.pick({
+  id: true,
+  teamId: true,
+  projectId: true,
+  projectSlug: true,
+  kind: true,
+  title: true,
+  status: true,
+  authorId: true,
+  authorLabel: true,
+  version: true,
+  createdAt: true,
+  updatedAt: true,
+  etag: true
+});
+const inboxItemPageSchema = z.object({
+  schemaVersion: z.literal("treeseed.inbox-page/v1"),
+  items: z.array(inboxItemSummarySchema),
+  cursor: z.string().nullable()
+}).strict();
+const inboxEventSchema = z.object({
+  schemaVersion: z.literal("treeseed.inbox-event/v1"),
+  sequence: z.string(),
+  id: z.string(),
+  teamId: z.string(),
+  itemId: z.string().nullable(),
+  type: z.enum(["item.created", "item.updated", "item.deleted", "draft.updated", "comment.created", "question.answered", "question.reopened", "proposal.revised", "proposal.decided"]),
+  actorId: z.string(),
+  occurredAt: z.string().datetime(),
+  summary: z.string(),
+  payload: z.record(z.unknown())
+}).strict();
+const inboxTimelineSchema = z.object({ events: z.array(inboxEventSchema), cursor: z.string() }).strict();
+const inboxDraftPurposeSchema = z.enum(["feedback", "proposal_revision"]);
+const inboxDraftSchema = z.object({
+  schemaVersion: z.literal("treeseed.inbox-draft/v1"),
+  itemId: z.string(),
+  purpose: inboxDraftPurposeSchema,
+  markdown: z.string(),
+  baseVersion: z.number().int().positive(),
+  revision: z.number().int().nonnegative(),
+  updatedAt: z.string().datetime(),
+  etag: z.string()
+}).strict();
+const inboxDraftWriteSchema = z.object({ markdown: z.string().max(1e5), baseVersion: z.number().int().positive() }).strict();
+const inboxQuestionCreateSchema = z.object({
+  projectId: z.string(),
+  title: z.string().trim().min(1).max(180),
+  markdown: z.string().trim().min(1).max(1e5),
+  recipients: z.array(z.string()).max(64).default([]),
+  relatedObjectives: z.array(z.string()).max(64).default([])
+}).strict();
+const inboxActionRequestSchema = z.object({
+  action: inboxActionKindSchema,
+  markdown: z.string().max(1e5).optional(),
+  parentId: z.string().optional(),
+  changeReason: z.string().max(2e3).optional(),
+  draftRevision: z.number().int().nonnegative().optional()
+}).strict();
+const inboxMutationReceiptSchema = z.object({
+  schemaVersion: z.literal("treeseed.inbox-mutation-receipt/v1"),
+  item: inboxItemSchema,
+  action: inboxActionKindSchema.optional(),
+  replayed: z.boolean(),
+  receipts: z.array(z.record(z.unknown())).default([])
+}).strict();
+export {
+  inboxActionDescriptorSchema,
+  inboxActionKindSchema,
+  inboxActionRequestSchema,
+  inboxCommentSchema,
+  inboxDraftPurposeSchema,
+  inboxDraftSchema,
+  inboxDraftWriteSchema,
+  inboxEventSchema,
+  inboxItemKindSchema,
+  inboxItemPageSchema,
+  inboxItemSchema,
+  inboxItemStatusSchema,
+  inboxItemSummarySchema,
+  inboxMutationReceiptSchema,
+  inboxProvenanceSchema,
+  inboxQuestionCreateSchema,
+  inboxTimelineSchema
+};

package/dist/operator-contracts/index.d.ts

@@ -3,5 +3,11 @@ export * from './canonical-command-tree.js';
 export * from './workday-profile.js';
 export * from './workday-lifecycle.js';
 export * from './control-plane-operation.js';
+export * from './control-plane-operations.js';
 export * from './mcp.js';
 export * from './oauth.js';
+export * from './communication/contracts.js';
+export * from './communication/addressing.js';
+export * from './inbox/contracts.js';
+export * from '../capacity-provider/capability-ontology.js';
+export * from './seed/seed-bundle.js';

package/dist/operator-contracts/index.js

@@ -3,5 +3,11 @@ export * from "./canonical-command-tree.js";
 export * from "./workday-profile.js";
 export * from "./workday-lifecycle.js";
 export * from "./control-plane-operation.js";
+export * from "./control-plane-operations.js";
 export * from "./mcp.js";
 export * from "./oauth.js";
+export * from "./communication/contracts.js";
+export * from "./communication/addressing.js";
+export * from "./inbox/contracts.js";
+export * from "../capacity-provider/capability-ontology.js";
+export * from "./seed/seed-bundle.js";

package/dist/operator-contracts/mcp.d.ts

@@ -34,6 +34,7 @@ export interface InputRequired {
     prompt: string;
     confirmation: ConfirmationState;
 }
+export declare function encodeConfirmationState(state: ConfirmationState): string;
 export interface McpToolDescriptor {
     name: string;
     description: string;
@@ -74,5 +75,9 @@ export interface McpCatalog {
         resourceSubscriptions: true;
     };
 }
+export declare const TREESEED_MCP_PROMPTS: readonly McpPromptDescriptor[];
+export declare function operationToMcpResource(operation: ControlPlaneOperationDescriptor): McpResourceDescriptor | null;
 export declare function operationToMcpTool(operation: ControlPlaneOperationDescriptor): McpToolDescriptor | null;
 export declare function buildMcpTools(operations: readonly ControlPlaneOperationDescriptor[]): McpToolDescriptor[];
+export declare function buildMcpResources(operations: readonly ControlPlaneOperationDescriptor[]): McpResourceDescriptor[];
+export declare function buildMcpCatalog(operations: readonly ControlPlaneOperationDescriptor[]): McpCatalog;

package/dist/operator-contracts/mcp.js

@@ -1,4 +1,44 @@
 const MCP_PROTOCOL_VERSION = "2026-07-28";
+function encodeConfirmationState(state) {
+  const bytes = new TextEncoder().encode(JSON.stringify(state));
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/gu, "");
+}
+const TREESEED_MCP_PROMPTS = [
+  { name: "operate", description: "Operate TreeSeed through currently discoverable capabilities.", argumentSchemaId: "treeseed.prompt.objective/v1", requiredScopes: ["treeseed:read"] },
+  { name: "research", description: "Research a governed TreeSeed question and accumulate knowledge.", argumentSchemaId: "treeseed.prompt.objective/v1", requiredScopes: ["treeseed:read"] },
+  { name: "governance-review", description: "Review a proposal or decision using current governance evidence.", argumentSchemaId: "treeseed.prompt.objective/v1", requiredScopes: ["treeseed:read"] },
+  { name: "workday-planning", description: "Plan a time-based workday without bypassing API authority.", argumentSchemaId: "treeseed.prompt.objective/v1", requiredScopes: ["treeseed:read"] },
+  { name: "project-agent-chat", description: "Prepare an explicit governed team-topic chat invocation for project agents.", argumentSchemaId: "treeseed.prompt.objective/v1", requiredScopes: ["treeseed:read"] }
+];
+function resourcePath(restPath) {
+  const [root, version, ...segments] = restPath.split("/");
+  if (root !== "" || version !== "v1" || segments.length === 0) throw new Error(`MCP resource requires a versioned control-plane REST path: ${restPath}`);
+  const path = segments.join("/");
+  if (path === "me") return "accounts/current";
+  return path.replace(/^platform\/operations(?=\/|$)/u, "operations").replace(/^capacity-plans(?=\/|$)/u, "plans").replace(/\/workday-runs(?=\/|$)/u, "/workdays").replace(/\/capacity\/assignments(?=\/|$)/u, "/assignments");
+}
+function operationToMcpResource(operation) {
+  if (!operation.surfaces.includes("mcp_resource")) return null;
+  if (operation.kind !== "read" || operation.rest.method !== "GET") {
+    throw new Error(`MCP resource operation ${operation.operationId} must be a read-only GET operation.`);
+  }
+  const uriTemplate = `treeseed://${resourcePath(operation.rest.path)}`;
+  const parameters = (value) => [...value.matchAll(/\{([^}]+)\}/gu)].map((match) => match[1]).sort();
+  if (JSON.stringify(parameters(uriTemplate)) !== JSON.stringify(parameters(operation.rest.path))) {
+    throw new Error(`MCP resource ${operation.operationId} must preserve its REST path parameter names.`);
+  }
+  return {
+    uriTemplate,
+    name: operation.operationId,
+    description: operation.description,
+    mimeType: "application/json",
+    operationId: operation.operationId,
+    subscribable: true,
+    ...operation.operationId === "status.show" ? { cacheTtlSeconds: 10 } : {}
+  };
+}
 function operationToMcpTool(operation) {
   if (!operation.surfaces.includes("mcp_tool")) return null;
   return {
@@ -16,8 +56,29 @@ function operationToMcpTool(operation) {
 function buildMcpTools(operations) {
   return operations.map(operationToMcpTool).filter((tool) => tool !== null).sort((left, right) => left.name.localeCompare(right.name));
 }
+function buildMcpResources(operations) {
+  const resources = operations.map(operationToMcpResource).filter((resource) => resource !== null).sort((left, right) => left.uriTemplate.localeCompare(right.uriTemplate));
+  const uriTemplates = new Set(resources.map(({ uriTemplate }) => uriTemplate));
+  if (uriTemplates.size !== resources.length) throw new Error("MCP resource URI templates must be unique.");
+  return resources;
+}
+function buildMcpCatalog(operations) {
+  return {
+    schemaVersion: "treeseed.mcp-catalog/v1",
+    protocolVersion: MCP_PROTOCOL_VERSION,
+    tools: buildMcpTools(operations),
+    resources: buildMcpResources(operations),
+    prompts: [...TREESEED_MCP_PROMPTS],
+    capabilities: { completion: true, progress: true, cancellation: true, inputRequired: true, resourceSubscriptions: true }
+  };
+}
 export {
   MCP_PROTOCOL_VERSION,
+  TREESEED_MCP_PROMPTS,
+  buildMcpCatalog,
+  buildMcpResources,
   buildMcpTools,
+  encodeConfirmationState,
+  operationToMcpResource,
   operationToMcpTool
 };

package/dist/operator-contracts/oauth.d.ts

@@ -1,4 +1,17 @@
 import type { OAuthScope } from './control-plane-operation.js';
+export declare const OAUTH_CLIENT_IDS: {
+    readonly cli: "trsd";
+    readonly admin: "treeseed-admin";
+};
+export type OAuthClientId = typeof OAUTH_CLIENT_IDS[keyof typeof OAUTH_CLIENT_IDS];
+export interface ApiPrincipal {
+    id: string;
+    displayName?: string;
+    scopes: string[];
+    roles: string[];
+    permissions: string[];
+    metadata?: Record<string, unknown>;
+}
 export interface OAuthAuthorizationServerMetadata {
     issuer: string;
     authorization_endpoint: string;
@@ -10,6 +23,36 @@ export interface OAuthAuthorizationServerMetadata {
     code_challenge_methods_supported: ['S256'];
     scopes_supported: OAuthScope[];
 }
+export interface OAuthAuthorizationPresentation {
+    schemaVersion: 'treeseed.oauth.authorization-presentation/v1';
+    clientId: string;
+    clientName: string;
+    redirectUri: string;
+    redirectOrigin: string;
+    responseType: 'code';
+    codeChallenge: string;
+    codeChallengeMethod: 'S256';
+    scopes: OAuthScope[];
+    state: string | null;
+}
+export interface OAuthAuthorizationDecisionRequest {
+    clientId: string;
+    redirectUri: string;
+    responseType: 'code';
+    codeChallenge: string;
+    codeChallengeMethod: 'S256';
+    scope: OAuthScope[];
+    state?: string | null;
+    decision: 'approve' | 'deny';
+    identifier?: string;
+    password?: string;
+}
+export interface OAuthAuthorizationDecisionResult {
+    schemaVersion: 'treeseed.oauth.authorization-decision/v1';
+    approved: boolean;
+    redirectTo: string;
+    expiresIn?: number;
+}
 export interface OAuthProtectedResourceMetadata {
     resource: string;
     authorization_servers: string[];
@@ -28,6 +71,16 @@ export interface OAuthDeviceAuthorizationResponse {
     expiresIn: number;
     interval: number;
 }
+/** Safe browser presentation of a pending device grant. It never contains the device code. */
+export interface OAuthDeviceApprovalPresentation {
+    schemaVersion: 'treeseed.oauth.device-approval-presentation/v1';
+    clientId: string;
+    clientName: string;
+    userCode: string;
+    scopes: OAuthScope[];
+    expiresAt: string;
+    status: 'pending';
+}
 export interface OAuthTokenReceipt {
     tokenType: 'Bearer';
     accessToken: string;

package/dist/operator-contracts/oauth.js

@@ -0,0 +1,7 @@
+const OAUTH_CLIENT_IDS = {
+  cli: "trsd",
+  admin: "treeseed-admin"
+};
+export {
+  OAUTH_CLIENT_IDS
+};

package/dist/operator-contracts/operation-builder.d.ts

@@ -0,0 +1,17 @@
+import { z } from 'zod';
+import { type ControlPlaneOperationBinding, type ControlPlaneOperationDescriptor } from './control-plane-operation.js';
+type Definition = Omit<ControlPlaneOperationDescriptor, 'schemaVersion' | 'schemas' | 'idempotency' | 'concurrency' | 'audited' | 'receipt' | 'redactedPaths' | 'authentication'> & {
+    parameters?: string;
+    redactedPaths?: string[];
+    idempotencyRequired?: boolean;
+    concurrencyRequired?: boolean;
+    authentication?: ControlPlaneOperationDescriptor['authentication'];
+};
+export declare function defineOperation<TPath, TQuery, TBody, TOutput>(definition: Definition, schema: ControlPlaneOperationBinding<TPath, TQuery, TBody, TOutput>['schema']): ControlPlaneOperationBinding<TPath, TQuery, TBody, TOutput>;
+export declare function defineTreeDxProxyOperation<T extends z.ZodRawShape>(operationId: `${string}.${string}`, upstreamOperationId: string | null, method: 'DELETE' | 'GET' | 'PATCH' | 'POST' | 'PUT', path: `/v1/${string}`, pathShape: T, options?: {
+    read?: boolean;
+    risk?: ControlPlaneOperationDescriptor['riskClass'];
+    surfaces?: ControlPlaneOperationDescriptor['surfaces'];
+    pagination?: ControlPlaneOperationDescriptor['pagination'];
+}): ControlPlaneOperationBinding<z.objectUtil.addQuestionMarks<z.baseObjectOutputType<T>, any> extends infer T_1 ? { [k in keyof T_1]: T_1[k]; } : never, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+export {};

package/dist/operator-contracts/operation-builder.js

@@ -0,0 +1,61 @@
+import { z } from "zod";
+import { TREEDX_OPENAPI_CONTRACT } from "@treeseed/treedx/openapi";
+import {
+  CONTROL_PLANE_OPERATION_SCHEMA_VERSION
+} from "./control-plane-operation.js";
+function defineOperation(definition, schema) {
+  const { parameters, redactedPaths = [], idempotencyRequired, concurrencyRequired, ...descriptor } = definition;
+  const mutation = definition.kind === "mutation";
+  return {
+    descriptor: {
+      ...descriptor,
+      authentication: definition.authentication ?? (definition.oauthScopes.length ? "oauth" : "anonymous"),
+      schemaVersion: CONTROL_PLANE_OPERATION_SCHEMA_VERSION,
+      schemas: {
+        input: `treeseed.${definition.operationId}.input/v1`,
+        output: `treeseed.${definition.operationId}.output/v1`,
+        errors: "treeseed.problem/v1",
+        ...parameters ? { parameters } : {}
+      },
+      idempotency: { required: idempotencyRequired ?? mutation, header: "Idempotency-Key" },
+      concurrency: { required: concurrencyRequired ?? false, readHeader: "ETag", writeHeader: "If-Match" },
+      audited: definition.surfaces.some((surface) => surface !== "internal"),
+      receipt: mutation,
+      redactedPaths
+    },
+    schema
+  };
+}
+const empty = z.object({}).strict();
+const none = z.undefined();
+const record = z.record(z.unknown());
+function defineTreeDxProxyOperation(operationId, upstreamOperationId, method, path, pathShape, options = {}) {
+  const kind = options.read ?? method === "GET" ? "read" : "mutation";
+  const riskClass = options.risk ?? "ordinary";
+  const surfaces = options.surfaces ?? ["rest", "mcp_tool", ...method === "GET" ? ["mcp_resource"] : []];
+  return defineOperation({
+    operationId,
+    description: `${kind === "read" ? "Read" : "Apply"} ${operationId} through the project-scoped TreeDX proxy.`,
+    ...surfaces.includes("rest") ? { rest: { method, path } } : {},
+    ...Object.keys(pathShape).length ? { parameters: `treeseed.${operationId}.parameters/v1` } : {},
+    capability: kind === "read" ? "treedx.read" : "treedx.write",
+    authentication: "oauth_or_provider",
+    oauthScopes: kind === "read" ? ["treeseed:read"] : ["treeseed:projects:write"],
+    kind,
+    riskClass,
+    confirmation: riskClass === "ordinary" ? "never" : "input_required",
+    surfaces,
+    cacheScope: kind === "read" ? "project" : "none",
+    pagination: options.pagination ?? "none",
+    ...upstreamOperationId ? { upstream: { service: "treedx", operationId: upstreamOperationId, contractVersion: TREEDX_OPENAPI_CONTRACT.openapiVersion, contractDigest: TREEDX_OPENAPI_CONTRACT.openapiSha256 } } : {}
+  }, {
+    path: z.object(pathShape).strict(),
+    query: method === "GET" ? record : empty,
+    body: method === "GET" ? none : record,
+    output: record
+  });
+}
+export {
+  defineOperation,
+  defineTreeDxProxyOperation
+};

package/dist/operator-contracts/seed/seed-bundle.d.ts

@@ -0,0 +1,138 @@
+import type { ProviderLanePurpose } from '../../agent-capacity/contracts/capacity/communication/communication-records.js';
+export declare const SEED_BUNDLE_SCHEMA_VERSION: "treeseed.seed-bundle/v3";
+export declare const HISTORICAL_SEED_BUNDLE_SCHEMA_VERSION: "treeseed.seed-bundle/v2";
+export type SeedEnvironment = 'local' | 'staging' | 'prod' | string;
+export interface SeedTeamResource {
+    key: string;
+    slug: string;
+    name: string;
+    displayName: string;
+    profileSummary?: string;
+}
+export interface SeedUserMembershipResource {
+    key: string;
+    team: string;
+    principal: {
+        kind: 'user';
+        email: string;
+    };
+    roles: string[];
+    missingUser: 'defer' | 'reject';
+}
+export interface SeedServicePrincipalMembershipResource {
+    key: string;
+    team: string;
+    principal: {
+        kind: 'service-principal';
+        key: string;
+        displayName: string;
+        interactiveLogin: false;
+    };
+    roles: string[];
+}
+export type SeedMembershipResource = SeedUserMembershipResource | SeedServicePrincipalMembershipResource;
+export interface SeedRepositoryPolicy {
+    visibility: 'public' | 'private';
+    lifecycle: 'adopt' | 'create-or-adopt';
+    deletionPolicy: 'retain';
+    defaultBranch: string;
+    stagingBranch: string;
+    issues: boolean;
+    actions: boolean;
+    workflows: string[];
+}
+export interface SeedRepositoryResource {
+    key: string;
+    project: string;
+    role: 'primary' | 'library' | 'fixture' | 'support' | 'template';
+    provider: 'github';
+    owner: string;
+    name: string;
+    gitUrl: string;
+    defaultBranch: string;
+    checkoutPath?: string;
+    submodulePath?: string;
+    repositoryPolicy: SeedRepositoryPolicy;
+    metadata?: Record<string, unknown>;
+}
+export interface SeedProjectResource {
+    key: string;
+    team: string;
+    slug: string;
+    name: string;
+    description: string;
+    kind: string;
+    primaryRepository?: string;
+    libraryRepository: string;
+    metadata?: Record<string, unknown>;
+}
+export interface SeedCapacityProviderPrerequisite {
+    key: string;
+    team: string;
+    environments: SeedEnvironment[];
+    manifestDigest: `sha256:${string}`;
+    manifestRef: string;
+    approval: 'trusted-local-owner';
+    projects: string[];
+    allowedModes: Array<'planning' | 'acting'>;
+    requiredLanePurposes: ProviderLanePurpose[];
+}
+interface SeedBundleBody {
+    name: string;
+    version: number;
+    description: string;
+    environments: SeedEnvironment[];
+    digest: `sha256:${string}`;
+    resources: {
+        teams: SeedTeamResource[];
+        memberships: SeedMembershipResource[];
+        projects: SeedProjectResource[];
+        repositories: SeedRepositoryResource[];
+    };
+    runtime: {
+        capacityProviders: SeedCapacityProviderPrerequisite[];
+    };
+}
+export interface SeedBundleV3 extends SeedBundleBody {
+    schemaVersion: typeof SEED_BUNDLE_SCHEMA_VERSION;
+}
+/** Historical receipt shape. It is decodable, but cannot be planned or applied. */
+export interface SeedBundleV2 extends Omit<SeedBundleBody, 'resources'> {
+    schemaVersion: typeof HISTORICAL_SEED_BUNDLE_SCHEMA_VERSION;
+    resources: Omit<SeedBundleBody['resources'], 'projects'> & {
+        projects: Array<Omit<SeedProjectResource, 'libraryRepository'> & {
+            libraryRepository?: string;
+        }>;
+    };
+}
+export type SeedBundle = SeedBundleV3 | SeedBundleV2;
+export interface SeedResourceReceipt {
+    resourceKey: string;
+    action: 'create' | 'adopt' | 'update' | 'noop' | 'blocked';
+    resourceId?: string;
+    digest: `sha256:${string}`;
+    readBackAt?: string;
+    blockers?: string[];
+}
+export interface SeedReconciliationReceipt {
+    schemaVersion: 'treeseed.seed-reconciliation-receipt/v1';
+    runId: string;
+    seedName: string;
+    seedVersion: number;
+    seedDigest: `sha256:${string}`;
+    mode: 'plan' | 'apply' | 'verify';
+    status: 'planned' | 'waiting_provider' | 'verified' | 'blocked' | 'failed';
+    resources: SeedResourceReceipt[];
+    providerRequestIds: string[];
+    createdAt: string;
+    completedAt?: string;
+}
+export interface SeedBundleDiagnostic {
+    code: string;
+    path: string;
+    message: string;
+}
+export declare function canonicalSeedBundlePayload(bundle: Omit<SeedBundle, 'digest'> | SeedBundle): string;
+export declare function digestSeedBundle(bundle: Omit<SeedBundle, 'digest'> | SeedBundle): Promise<`sha256:${string}`>;
+export declare function validateSeedBundle(bundle: SeedBundle): SeedBundleDiagnostic[];
+export {};

package/dist/operator-contracts/seed/seed-bundle.js

@@ -0,0 +1,68 @@
+const SEED_BUNDLE_SCHEMA_VERSION = "treeseed.seed-bundle/v3";
+const HISTORICAL_SEED_BUNDLE_SCHEMA_VERSION = "treeseed.seed-bundle/v2";
+function text(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function canonical(value) {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => [key, canonical(entry)]));
+}
+function canonicalSeedBundlePayload(bundle) {
+  const { digest: _digest, ...payload } = bundle;
+  return JSON.stringify(canonical(payload));
+}
+async function digestSeedBundle(bundle) {
+  const bytes = new TextEncoder().encode(canonicalSeedBundlePayload(bundle));
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
+  return `sha256:${Array.from(new Uint8Array(digest), (value) => value.toString(16).padStart(2, "0")).join("")}`;
+}
+function validateSeedBundle(bundle) {
+  const diagnostics = [];
+  const add = (code, path, message) => diagnostics.push({ code, path, message });
+  if (bundle?.schemaVersion === HISTORICAL_SEED_BUNDLE_SCHEMA_VERSION) {
+    add("seed_bundle_v2_migration_required", "schemaVersion", `Historical v2 bundles remain readable but must be migrated to ${SEED_BUNDLE_SCHEMA_VERSION} before planning or apply.`);
+  } else if (bundle?.schemaVersion !== SEED_BUNDLE_SCHEMA_VERSION) {
+    add("seed_bundle_schema_invalid", "schemaVersion", `schemaVersion must be ${SEED_BUNDLE_SCHEMA_VERSION}.`);
+  }
+  if (!text(bundle?.name) || !Number.isInteger(bundle?.version) || bundle.version < 1) add("seed_bundle_identity_invalid", "name", "Seed name and positive version are required.");
+  if (!/^sha256:[a-f0-9]{64}$/u.test(bundle?.digest ?? "")) add("seed_bundle_digest_invalid", "digest", "Seed digest must be an exact SHA-256 digest.");
+  const teams = new Set((bundle?.resources?.teams ?? []).map((entry) => entry.key));
+  const projects = new Set((bundle?.resources?.projects ?? []).map((entry) => entry.key));
+  const repositories = new Set((bundle?.resources?.repositories ?? []).map((entry) => entry.key));
+  const allKeys = [...teams, ...projects, ...repositories, ...(bundle?.resources?.memberships ?? []).map((entry) => entry.key)];
+  if (new Set(allKeys).size !== allKeys.length) add("seed_bundle_resource_key_duplicate", "resources", "Every resource key must be globally unique.");
+  for (const [index, membership] of (bundle?.resources?.memberships ?? []).entries()) {
+    if (!teams.has(membership.team)) add("seed_bundle_membership_team_unknown", `resources.memberships[${index}].team`, "Membership references an unknown team.");
+    if (membership.principal.kind === "service-principal" && membership.principal.interactiveLogin !== false) add("seed_bundle_service_principal_interactive_forbidden", `resources.memberships[${index}].principal.interactiveLogin`, "Service principals cannot log in interactively.");
+  }
+  for (const [index, project] of (bundle?.resources?.projects ?? []).entries()) {
+    if (!teams.has(project.team)) add("seed_bundle_project_team_unknown", `resources.projects[${index}].team`, "Project references an unknown team.");
+    if (!project.primaryRepository && project.kind !== "content") add("seed_bundle_primary_repository_required", `resources.projects[${index}].primaryRepository`, "Non-content projects require a primary source repository.");
+    if (project.primaryRepository && !repositories.has(project.primaryRepository)) add("seed_bundle_primary_repository_unknown", `resources.projects[${index}].primaryRepository`, "Project primary repository is missing.");
+    if (!project.libraryRepository) add("seed_bundle_library_repository_required", `resources.projects[${index}].libraryRepository`, "Every project requires one library repository.");
+    if (project.libraryRepository && !repositories.has(project.libraryRepository)) add("seed_bundle_library_repository_unknown", `resources.projects[${index}].libraryRepository`, "Project library repository is missing.");
+  }
+  for (const [index, repository] of (bundle?.resources?.repositories ?? []).entries()) {
+    if (repository.role === "content") add("seed_bundle_content_repository_renamed", `resources.repositories[${index}].role`, "Repository-backed knowledge uses role library.");
+  }
+  for (const [index, project] of (bundle?.resources?.projects ?? []).entries()) {
+    const library = (bundle?.resources?.repositories ?? []).find((entry) => entry.key === project.libraryRepository);
+    if (library && (library.role !== "library" || library.project !== project.key)) add("seed_bundle_library_repository_mismatch", `resources.projects[${index}].libraryRepository`, "libraryRepository must reference a library-role repository owned by this project.");
+    const projectLibraries = (bundle?.resources?.repositories ?? []).filter((entry) => entry.project === project.key && entry.role === "library");
+    if (projectLibraries.length !== 1) add("seed_bundle_library_repository_count_invalid", `resources.projects[${index}].libraryRepository`, "Every project must declare exactly one library-role repository.");
+  }
+  for (const [index, provider] of (bundle?.runtime?.capacityProviders ?? []).entries()) {
+    if (!teams.has(provider.team)) add("seed_bundle_provider_team_unknown", `runtime.capacityProviders[${index}].team`, "Provider references an unknown team.");
+    for (const project of provider.projects) if (!projects.has(project)) add("seed_bundle_provider_project_unknown", `runtime.capacityProviders[${index}].projects`, `Provider references unknown project ${project}.`);
+    for (const purpose of ["communication", "platform", "workday"]) if (!provider.requiredLanePurposes.includes(purpose)) add("seed_bundle_provider_lane_required", `runtime.capacityProviders[${index}].requiredLanePurposes`, `Provider prerequisite requires the ${purpose} lane.`);
+  }
+  return diagnostics;
+}
+export {
+  HISTORICAL_SEED_BUNDLE_SCHEMA_VERSION,
+  SEED_BUNDLE_SCHEMA_VERSION,
+  canonicalSeedBundlePayload,
+  digestSeedBundle,
+  validateSeedBundle
+};

package/dist/sdk-types/configuration/sdk-dispatch-credential-source.d.ts

@@ -8,7 +8,7 @@ export type SdkDispatchCredentialSource = {
 };
 export interface SdkDispatchConfig {
     projectId: string;
-    marketBaseUrl: string;
+    controlPlaneBaseUrl: string;
     policy?: SdkDispatchPolicy;
     credentialSource?: SdkDispatchCredentialSource;
     fetchImpl?: typeof fetch;