@treeseed/sdk 0.13.0-rc.6 → 0.13.0-rc.8

package/dist/entrypoints/clients/control-plane-client.js

@@ -1,5 +1,19 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, resolve } from "node:path";
+import {
+  decryptRemoteAuthSessions,
+  encryptRemoteAuthSessions,
+  loadMachineKey,
+  loadRemoteAuthPayload,
+  writeRemoteAuthPayload
+} from "../../operations/services/config-runtime/configuration/create-default-machine-config.js";
+import { getRemoteAuthPaths } from "../../operations/services/config-runtime/accounts/ensure-secret-session-for-config.js";
 const DEFAULT_CONTROL_PLANE_BASE_URL = "http://127.0.0.1:3002";
 const CONTROL_PLANE_BASE_URL_ENV = "TREESEED_API_BASE_URL";
+const CONTROL_PLANE_SERVER_REGISTRY_PATH = ".treeseed/config/servers.json";
+const CONTROL_PLANE_SERVER_SESSIONS_PATH = ".treeseed/config/remote-auth.json";
+const machineKeySessionCustody = { loadKey: loadMachineKey };
 class ControlPlaneClientError extends Error {
   constructor(message, status, problem, responseHeaders) {
     super(message);
@@ -12,7 +26,7 @@ class ControlPlaneClientError extends Error {
   problem;
   responseHeaders;
 }
-function normalizeBaseUrl(value) {
+function normalizeControlPlaneBaseUrl(value) {
   const normalized = value.trim().replace(/\/+$/u, "");
   if (!/^https?:\/\//u.test(normalized)) throw new Error("Control-plane server URLs must use HTTP or HTTPS.");
   return normalized;
@@ -21,9 +35,88 @@ function defaultLocalControlPlaneServer(env = process.env) {
   return {
     serverId: "local",
     label: "Local TreeSeed control plane",
-    baseUrl: normalizeBaseUrl(env[CONTROL_PLANE_BASE_URL_ENV] ?? DEFAULT_CONTROL_PLANE_BASE_URL)
+    baseUrl: normalizeControlPlaneBaseUrl(env[CONTROL_PLANE_BASE_URL_ENV] ?? DEFAULT_CONTROL_PLANE_BASE_URL)
   };
 }
+function registryPath(env = process.env) {
+  return resolve(env.HOME?.trim() || homedir(), CONTROL_PLANE_SERVER_REGISTRY_PATH);
+}
+function normalizeServer(profile) {
+  const serverId = profile.serverId.trim();
+  if (!serverId) throw new Error("Control-plane server IDs cannot be empty.");
+  return { serverId, label: profile.label.trim() || serverId, baseUrl: normalizeControlPlaneBaseUrl(profile.baseUrl) };
+}
+function loadControlPlaneServerRegistry(env = process.env) {
+  const local = defaultLocalControlPlaneServer(env);
+  const path = registryPath(env);
+  if (!existsSync(path)) return { version: 1, activeServerId: local.serverId, servers: [local] };
+  const parsed = JSON.parse(readFileSync(path, "utf8"));
+  const byId = /* @__PURE__ */ new Map([[local.serverId, local]]);
+  for (const value of Array.isArray(parsed.servers) ? parsed.servers : []) {
+    const normalized = normalizeServer(value);
+    byId.set(normalized.serverId, normalized);
+  }
+  const servers = [...byId.values()].sort((left, right) => left.serverId.localeCompare(right.serverId));
+  const activeServerId = servers.some((entry) => entry.serverId === parsed.activeServerId) ? parsed.activeServerId : local.serverId;
+  return { version: 1, activeServerId, servers };
+}
+function writeControlPlaneServerRegistry(state, env = process.env) {
+  const path = registryPath(env);
+  const servers = [...new Map(state.servers.map((entry) => {
+    const normalized = normalizeServer(entry);
+    return [normalized.serverId, normalized];
+  })).values()].sort((left, right) => left.serverId.localeCompare(right.serverId));
+  const activeServerId = servers.some((entry) => entry.serverId === state.activeServerId) ? state.activeServerId : "local";
+  const next = { version: 1, activeServerId, servers };
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(next, null, 2)}
+`, { encoding: "utf8", mode: 384 });
+  return next;
+}
+function resolveControlPlaneServer(selector, env = process.env) {
+  const value = selector?.trim();
+  if (value && /^https?:\/\//iu.test(value)) {
+    return normalizeServer({ serverId: value.replace(/^https?:\/\//iu, "").replace(/[^a-z0-9._-]+/giu, "-"), label: value, baseUrl: value });
+  }
+  const registry = loadControlPlaneServerRegistry(env);
+  const serverId = value || registry.activeServerId;
+  const profile = registry.servers.find((entry) => entry.serverId === serverId);
+  if (!profile) throw new Error(`Unknown control-plane server "${serverId}".`);
+  return profile;
+}
+function resolveControlPlaneServerSession(root, server, custody = machineKeySessionCustody) {
+  const serverId = typeof server === "string" ? server : server.serverId;
+  const session = readServerSessions(root, custody)[serverId] ?? null;
+  if (session && typeof server !== "string" && session.audience !== normalizeControlPlaneBaseUrl(server.baseUrl)) {
+    throw new Error(`Stored session audience does not match control-plane server "${server.serverId}".`);
+  }
+  return session;
+}
+function setControlPlaneServerSession(root, session, custody = machineKeySessionCustody) {
+  const normalized = { ...session, audience: normalizeControlPlaneBaseUrl(session.audience) };
+  const sessions = readServerSessions(root, custody);
+  sessions[session.serverId] = normalized;
+  writeServerSessions(root, sessions, custody);
+  return normalized;
+}
+function clearControlPlaneServerSession(root, serverId, custody = machineKeySessionCustody) {
+  if (!serverId) {
+    writeServerSessions(root, {}, custody);
+    return;
+  }
+  const sessions = readServerSessions(root, custody);
+  delete sessions[serverId];
+  writeServerSessions(root, sessions, custody);
+}
+function readServerSessions(root, custody) {
+  if (!existsSync(getRemoteAuthPaths(root).authPath)) return {};
+  const sessions = decryptRemoteAuthSessions(loadRemoteAuthPayload(root), custody.loadKey(root));
+  return Object.fromEntries(Object.entries(sessions).map(([serverId, session]) => [serverId, { serverId, ...session }]));
+}
+function writeServerSessions(root, sessions, custody) {
+  const values = Object.fromEntries(Object.entries(sessions).map(([serverId, session]) => [serverId, session]));
+  writeRemoteAuthPayload(root, { version: 1, sessions: encryptRemoteAuthSessions(values, custody.loadKey(root)) });
+}
 async function responsePayload(response) {
   const contentType = response.headers.get("content-type") ?? "";
   if (contentType.includes("json")) return response.json();
@@ -47,7 +140,7 @@ function problemFrom(payload, status) {
 class ControlPlaneClient {
   constructor(options) {
     this.options = options;
-    this.baseUrl = normalizeBaseUrl(options.profile.baseUrl);
+    this.baseUrl = normalizeControlPlaneBaseUrl(options.profile.baseUrl);
     this.accessToken = options.accessToken ?? null;
     this.fetchImpl = options.fetchImpl ?? fetch;
     this.userAgent = options.userAgent;
@@ -57,6 +150,34 @@ class ControlPlaneClient {
   accessToken;
   fetchImpl;
   userAgent;
+  async callOperation(binding, input, options = {}) {
+    const rest = binding.descriptor.rest;
+    if (!rest) throw new Error(`Operation ${binding.descriptor.operationId} has no REST binding.`);
+    if (/[:*]/u.test(rest.path)) throw new Error(`Operation ${binding.descriptor.operationId} requires generated path parameters.`);
+    return this.call({ method: rest.method, path: rest.path, input: rest.method === "GET" ? void 0 : input, ...options });
+  }
+  async authorizeDevice(clientId, scope, signal) {
+    const response = await this.fetchImpl(`${this.baseUrl}/oauth/device_authorization`, { method: "POST", headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ client_id: clientId, scope: scope.join(" ") }), signal });
+    const payload = await responsePayload(response);
+    if (!response.ok) throw new ControlPlaneClientError(String(payload.error_description ?? payload.error ?? "Device authorization failed."), response.status, problemFrom(payload, response.status), response.headers);
+    return { deviceCode: String(payload.device_code), userCode: String(payload.user_code), verificationUri: String(payload.verification_uri), verificationUriComplete: typeof payload.verification_uri_complete === "string" ? payload.verification_uri_complete : void 0, expiresIn: Number(payload.expires_in), interval: Number(payload.interval) };
+  }
+  async exchangeDeviceCode(clientId, deviceCode, signal) {
+    return this.exchangeOAuthToken({ client_id: clientId, grant_type: "urn:ietf:params:oauth:grant-type:device_code", device_code: deviceCode }, signal);
+  }
+  async refreshAccessToken(clientId, refreshToken, signal) {
+    return this.exchangeOAuthToken({ client_id: clientId, grant_type: "refresh_token", refresh_token: refreshToken }, signal);
+  }
+  async revokeToken(clientId, token, signal) {
+    const response = await this.fetchImpl(`${this.baseUrl}/oauth/revoke`, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ client_id: clientId, token }), signal });
+    if (!response.ok) throw new ControlPlaneClientError("Token revocation failed.", response.status, problemFrom(await responsePayload(response), response.status), response.headers);
+  }
+  async exchangeOAuthToken(values, signal) {
+    const response = await this.fetchImpl(`${this.baseUrl}/oauth/token`, { method: "POST", headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" }, body: new URLSearchParams(values), signal });
+    const payload = await responsePayload(response);
+    if (!response.ok) throw new ControlPlaneClientError(String(payload.error_description ?? payload.error ?? "OAuth token exchange failed."), response.status, problemFrom(payload, response.status), response.headers);
+    return { tokenType: "Bearer", accessToken: String(payload.access_token), refreshToken: typeof payload.refresh_token === "string" ? payload.refresh_token : void 0, expiresIn: Number(payload.expires_in), scope: String(payload.scope ?? "").split(/\s+/u).filter(Boolean), audience: String(payload.audience ?? this.baseUrl), principal: payload.principal && typeof payload.principal === "object" ? payload.principal : void 0 };
+  }
   async call(options) {
     const headers = new Headers(options.headers);
     headers.set("accept", "application/json, application/problem+json");
@@ -89,8 +210,17 @@ class ControlPlaneClient {
 }
 export {
   CONTROL_PLANE_BASE_URL_ENV,
+  CONTROL_PLANE_SERVER_REGISTRY_PATH,
+  CONTROL_PLANE_SERVER_SESSIONS_PATH,
   ControlPlaneClient,
   ControlPlaneClientError,
   DEFAULT_CONTROL_PLANE_BASE_URL,
-  defaultLocalControlPlaneServer
+  clearControlPlaneServerSession,
+  defaultLocalControlPlaneServer,
+  loadControlPlaneServerRegistry,
+  normalizeControlPlaneBaseUrl,
+  resolveControlPlaneServer,
+  resolveControlPlaneServerSession,
+  setControlPlaneServerSession,
+  writeControlPlaneServerRegistry
 };

package/dist/entrypoints/models/sdk-types.d.ts

@@ -1,10 +1,3 @@
-export * from '../../sdk-types/commerce/capacity/commerce-capacity-listing-input.js';
-export * from '../../sdk-types/commerce/catalog/upsert-catalog-item-request.js';
-export * from '../../sdk-types/commerce/governance/commerce-governance-states.js';
-export * from '../../sdk-types/commerce/payments/commerce-entitlement.js';
-export * from '../../sdk-types/commerce/payments/commerce-subscription-statuses.js';
-export * from '../../sdk-types/commerce/services/commerce-service-contract.js';
-export * from '../../sdk-types/commerce/vendors/commerce-stripe-onboarding-request-input.js';
 export * from '../../sdk-types/configuration/sdk-dispatch-credential-source.js';
 export * from '../../sdk-types/governance/commons/commons-question-input.js';
 export * from '../../sdk-types/support/planning-policy.js';
@@ -14,3 +7,4 @@ export * from '../../sdk-types/support/sdk-model-names.js';
 export * from '../../sdk-types/support/sdk-search-request.js';
 export * from '../../sdk-types/treedx/graph/sdk-graph-query-request.js';
 export * from '../../projects/projects-core/project-workflow.js';
+export * from '../../sdk-types/control-plane/resource-requests.js';

package/dist/entrypoints/models/sdk-types.js

@@ -1,10 +1,3 @@
-export * from "../../sdk-types/commerce/capacity/commerce-capacity-listing-input.js";
-export * from "../../sdk-types/commerce/catalog/upsert-catalog-item-request.js";
-export * from "../../sdk-types/commerce/governance/commerce-governance-states.js";
-export * from "../../sdk-types/commerce/payments/commerce-entitlement.js";
-export * from "../../sdk-types/commerce/payments/commerce-subscription-statuses.js";
-export * from "../../sdk-types/commerce/services/commerce-service-contract.js";
-export * from "../../sdk-types/commerce/vendors/commerce-stripe-onboarding-request-input.js";
 export * from "../../sdk-types/configuration/sdk-dispatch-credential-source.js";
 export * from "../../sdk-types/governance/commons/commons-question-input.js";
 export * from "../../sdk-types/support/planning-policy.js";
@@ -14,3 +7,4 @@ export * from "../../sdk-types/support/sdk-model-names.js";
 export * from "../../sdk-types/support/sdk-search-request.js";
 export * from "../../sdk-types/treedx/graph/sdk-graph-query-request.js";
 export * from "../../projects/projects-core/project-workflow.js";
+export * from "../../sdk-types/control-plane/resource-requests.js";

package/dist/guarantees/contracts/parse-agent-guarantee-proof.js

@@ -50,7 +50,7 @@ function command(value, index, variant, issues) {
   if (args.some((entry) => PLACEHOLDER.test(entry))) issues.push(`${path}.args contains unresolved placeholders.`);
   const action = `${args[0]}.${args[1] ?? ""}`;
   for (const selector of EXACT_SELECTORS[action] ?? []) if (!args.includes(selector)) issues.push(`${path} ${action} requires exact selector ${selector}.`);
-  if (["capacity", "governance", "projects"].includes(args[0]) && !args.includes("--market")) issues.push(`${path} must name the exact --market.`);
+  if (["capacity", "governance", "projects"].includes(args[0]) && !args.includes("--server")) issues.push(`${path} must name the exact --server.`);
   if (!COMMAND_KINDS.has(kind)) issues.push(`${path}.kind is invalid.`);
   if (!Number.isInteger(expectedExitCode) || expectedExitCode < 0) issues.push(`${path}.expectedExitCode must be a nonnegative integer.`);
   if (kind === "read" && args.includes("--execute")) issues.push(`${path} classifies an executing mutation as a read.`);

package/dist/guarantees/index/run-verifier-command.d.ts

@@ -32,7 +32,7 @@ export declare function apiAcceptanceEnvironment(environment: string, runState?:
 export declare function apiAcceptanceBaseUrl(environment: string): string;
 export declare function isLoopbackUrl(value: string): boolean;
 export declare function defaultGuaranteeVerifierExecutor(input: GuaranteeVerifierExecutionInput): Promise<GuaranteeVerifierExecutionResult>;
-export declare function sceneAuthRoleForGuarantee(manifest: GuaranteeManifest): "owner" | "admin" | "member" | undefined;
+export declare function sceneAuthRoleForGuarantee(manifest: GuaranteeManifest): "admin" | "owner" | "member" | undefined;
 export declare function browserForGuaranteeDevice(device: string | undefined): "firefox" | "webkit" | "chromium";
 export declare function sceneDeviceRunsForGuarantee(devices: string[]): {
     id: string;

package/dist/index/operations-and-workflows.d.ts

@@ -1,4 +1,3 @@
-export { PLATFORM_OPERATION_ENDPOINTS, PLATFORM_OPERATION_NAMESPACES, PLATFORM_OPERATION_SCOPES, PLATFORM_OPERATION_STATUSES, PLATFORM_OPERATION_TARGETS, PlatformOperationApiError, PlatformRunnerClient, assertPlatformOperation, assertPlatformOperationEvent, assertPlatformOperationOkEnvelope, buildPlatformRunnerAuthHeaders, createPlatformOperationExecutorRegistry, derivePlatformOperationNavigation, isPlatformOperationSuccessful, isPlatformOperationTerminal, pollPlatformOperation, runPlatformOperationOnce, type PlatformOperation, type PlatformOperationEvent, type PlatformOperationNavigationResult, type PlatformOperationPollOptions, type PlatformOperationPollResult } from '../operations/platform-operations.js';
 export { cancelGitHubWorkflowRun, formatGitHubWorkflowFailure, getGitHubWorkflowFileStatus, getLatestGitHubWorkflowRun, waitForGitHubWorkflowRunCompletion, type GitHubWorkflowCancellationResult, type GitHubWorkflowFailureSummary, type GitHubWorkflowFailureSummaryInput, type GitHubWorkflowFileStatus, type GitHubWorkflowProgressEvent } from '../operations/services/repositories/github-api.js';
 export { collectHostedServiceChecks, type HostedServiceCheck, type HostedServiceCheckReport, type HostedServiceCheckStatus, type HostedServiceType, type ObservedRailwayServiceState } from '../operations/services/hosting/audit/hosted-service-checks.js';
 export { inspectRepositoryGitLocks, inspectWorkspaceGitLocks, recoverGitLocks, runGitBatch, runRepositoryGit, type GitBatchOperation, type GitLockDiagnostic, type GitRunnerMode, type GitRunnerResult, type GitWorkspaceLockDiagnostics } from '../operations/services/operations/git-runner.js';

package/dist/index/operations-and-workflows.js

@@ -1,22 +1,3 @@
-import {
-  PLATFORM_OPERATION_ENDPOINTS,
-  PLATFORM_OPERATION_NAMESPACES,
-  PLATFORM_OPERATION_SCOPES,
-  PLATFORM_OPERATION_STATUSES,
-  PLATFORM_OPERATION_TARGETS,
-  PlatformOperationApiError,
-  PlatformRunnerClient,
-  assertPlatformOperation,
-  assertPlatformOperationEvent,
-  assertPlatformOperationOkEnvelope,
-  buildPlatformRunnerAuthHeaders,
-  createPlatformOperationExecutorRegistry,
-  derivePlatformOperationNavigation,
-  isPlatformOperationSuccessful,
-  isPlatformOperationTerminal,
-  pollPlatformOperation,
-  runPlatformOperationOnce
-} from "../operations/platform-operations.js";
 import {
   cancelGitHubWorkflowRun,
   formatGitHubWorkflowFailure,
@@ -106,14 +87,7 @@ import {
 export {
   AGENT_MESSAGE_KINDS,
   OperationsSdk,
-  PLATFORM_OPERATION_ENDPOINTS,
-  PLATFORM_OPERATION_NAMESPACES,
-  PLATFORM_OPERATION_SCOPES,
-  PLATFORM_OPERATION_STATUSES,
-  PLATFORM_OPERATION_TARGETS,
   PROJECT_JOB_STATUSES,
-  PlatformOperationApiError,
-  PlatformRunnerClient,
   RELEASE_STATES,
   SHARE_PACKAGE_STATES,
   TRESEED_OPERATION_SPECS,
@@ -121,18 +95,12 @@ export {
   WorkflowSdk,
   applyPlatformWorkset,
   assertIsolatedRepositoryStorage,
-  assertPlatformOperation,
-  assertPlatformOperationEvent,
-  assertPlatformOperationOkEnvelope,
-  buildPlatformRunnerAuthHeaders,
   cancelGitHubWorkflowRun,
   collectHostedServiceChecks,
   collectReconcileStatus,
   createIntegratedDevPlan,
-  createPlatformOperationExecutorRegistry,
   createReconcileRegistry,
   deriveDesiredUnits,
-  derivePlatformOperationNavigation,
   destroyTargetUnits,
   discoverPackageAdapters,
   executeSdkOperation,
@@ -148,8 +116,6 @@ export {
   inspectRepositoryGitLocks,
   inspectWorkspaceGitLocks,
   integrationChangeSetReceiptId,
-  isPlatformOperationSuccessful,
-  isPlatformOperationTerminal,
   listDevInstances,
   listOperationNames,
   listSdkDispatchCapabilities,
@@ -160,7 +126,6 @@ export {
   planPackageDevelopmentImage,
   planPlatformWorkset,
   planReconciliation,
-  pollPlatformOperation,
   readDevInstance,
   readMixProjectVersion,
   reconcileTarget,
@@ -173,7 +138,6 @@ export {
   runGitBatch,
   runManagedDev,
   runPackageImageWorkflow,
-  runPlatformOperationOnce,
   runRepositoryGit,
   runVerifyDriver,
   stopDevInstance,

package/dist/index/platform-and-hosting.d.ts

@@ -2,7 +2,6 @@ export { compileDesiredResourceGraph, compileDesiredUnitsFromGraph, convertDesir
 export { loadPlatformConfig, type PlatformConfigInput } from '../platform/configuration/config.js';
 export { githubRepositoryCredentialEnvName, resolveGitHubCredentialForRepository, type GitHubCredentialResolution } from '../operations/services/configuration/github-credentials.js';
 export { deployRailwayServiceInstance, ensureRailwayEnvironment, ensureRailwayGeneratedServiceDomain, ensureRailwayProject, ensureRailwayService, ensureRailwayServiceInstanceConfiguration, ensureRailwayServiceVolume, getRailwayAuthProfile, listRailwayEnvironments, listRailwayProjects, listRailwayServiceDomains, listRailwayServices, listRailwayVariables, normalizeRailwayEnvironmentName, resolveRailwayApiToken, resolveRailwayApiUrl, resolveRailwayWorkspace, resolveRailwayWorkspaceContext, upsertRailwayVariables } from '../operations/services/hosting/railway/railway-api.js';
-export { buildTemplateMarketPackage } from '../operations/services/support/market-packaging.js';
 export { collectDependencyStatus, collectToolStatus, createManagedToolEnv, formatDependencyReport, installDependencies, resolveToolBinary, resolveToolCommand, type ToolStatusResult } from '../entrypoints/runtime/managed-dependencies.js';
 export * from '../configuration/service-credentials.js';
-export { API_BASE_URL_ENV, CATALOG_MARKET_API_BASE_URLS_ENV, MARKET_API_BASE_URL_ENV, DEFAULT_MARKET_BASE_URL, MarketClient, MarketClientError, addMarketProfile, clearMarketSession, listIntegratedMarketCatalog, loadMarketRegistryState, removeMarketProfile, resolveCatalogMarketProfiles, resolveDefaultCentralMarketBaseUrl, resolveIntegratedCatalogArtifactDownload, resolveMarketProfile, resolveMarketSession, setActiveMarketProfile, setMarketSession, verifyArtifactBytes, writeMarketRegistryState } from '../entrypoints/clients/market-client.js';
+export { CONTROL_PLANE_BASE_URL_ENV, CONTROL_PLANE_SERVER_REGISTRY_PATH, ControlPlaneClient, ControlPlaneClientError, clearControlPlaneServerSession, defaultLocalControlPlaneServer, loadControlPlaneServerRegistry, resolveControlPlaneServer, resolveControlPlaneServerSession, setControlPlaneServerSession, writeControlPlaneServerRegistry, } from '../entrypoints/clients/control-plane-client.js';

package/dist/index/platform-and-hosting.js

@@ -32,9 +32,6 @@ import {
   resolveRailwayWorkspaceContext,
   upsertRailwayVariables
 } from "../operations/services/hosting/railway/railway-api.js";
-import {
-  buildTemplateMarketPackage
-} from "../operations/services/support/market-packaging.js";
 import {
   collectDependencyStatus,
   collectToolStatus,
@@ -46,43 +43,31 @@ import {
 } from "../entrypoints/runtime/managed-dependencies.js";
 export * from "../configuration/service-credentials.js";
 import {
-  API_BASE_URL_ENV,
-  CATALOG_MARKET_API_BASE_URLS_ENV,
-  MARKET_API_BASE_URL_ENV,
-  DEFAULT_MARKET_BASE_URL,
-  MarketClient,
-  MarketClientError,
-  addMarketProfile,
-  clearMarketSession,
-  listIntegratedMarketCatalog,
-  loadMarketRegistryState,
-  removeMarketProfile,
-  resolveCatalogMarketProfiles,
-  resolveDefaultCentralMarketBaseUrl,
-  resolveIntegratedCatalogArtifactDownload,
-  resolveMarketProfile,
-  resolveMarketSession,
-  setActiveMarketProfile,
-  setMarketSession,
-  verifyArtifactBytes,
-  writeMarketRegistryState
-} from "../entrypoints/clients/market-client.js";
+  CONTROL_PLANE_BASE_URL_ENV,
+  CONTROL_PLANE_SERVER_REGISTRY_PATH,
+  ControlPlaneClient,
+  ControlPlaneClientError,
+  clearControlPlaneServerSession,
+  defaultLocalControlPlaneServer,
+  loadControlPlaneServerRegistry,
+  resolveControlPlaneServer,
+  resolveControlPlaneServerSession,
+  setControlPlaneServerSession,
+  writeControlPlaneServerRegistry
+} from "../entrypoints/clients/control-plane-client.js";
 export {
-  API_BASE_URL_ENV,
-  CATALOG_MARKET_API_BASE_URLS_ENV,
-  DEFAULT_MARKET_BASE_URL,
-  MARKET_API_BASE_URL_ENV,
-  MarketClient,
-  MarketClientError,
-  addMarketProfile,
-  buildTemplateMarketPackage,
-  clearMarketSession,
+  CONTROL_PLANE_BASE_URL_ENV,
+  CONTROL_PLANE_SERVER_REGISTRY_PATH,
+  ControlPlaneClient,
+  ControlPlaneClientError,
+  clearControlPlaneServerSession,
   collectDependencyStatus,
   collectToolStatus,
   compileDesiredResourceGraph,
   compileDesiredUnitsFromGraph,
   convertDesiredResourceToReconcileUnit,
   createManagedToolEnv,
+  defaultLocalControlPlaneServer,
   deployRailwayServiceInstance,
   ensureRailwayEnvironment,
   ensureRailwayGeneratedServiceDomain,
@@ -94,22 +79,17 @@ export {
   getRailwayAuthProfile,
   githubRepositoryCredentialEnvName,
   installDependencies,
-  listIntegratedMarketCatalog,
   listRailwayEnvironments,
   listRailwayProjects,
   listRailwayServiceDomains,
   listRailwayServices,
   listRailwayVariables,
-  loadMarketRegistryState,
+  loadControlPlaneServerRegistry,
   loadPlatformConfig,
   normalizeRailwayEnvironmentName,
-  removeMarketProfile,
-  resolveCatalogMarketProfiles,
-  resolveDefaultCentralMarketBaseUrl,
+  resolveControlPlaneServer,
+  resolveControlPlaneServerSession,
   resolveGitHubCredentialForRepository,
-  resolveIntegratedCatalogArtifactDownload,
-  resolveMarketProfile,
-  resolveMarketSession,
   resolveRailwayApiToken,
   resolveRailwayApiUrl,
   resolveRailwayWorkspace,
@@ -117,9 +97,7 @@ export {
   resolveToolBinary,
   resolveToolCommand,
   selectDesiredResources,
-  setActiveMarketProfile,
-  setMarketSession,
+  setControlPlaneServerSession,
   upsertRailwayVariables,
-  verifyArtifactBytes,
-  writeMarketRegistryState
+  writeControlPlaneServerRegistry
 };

package/dist/index/public-contracts.d.ts

@@ -1,7 +1,4 @@
 export { DEFAULT_STARTER_TEMPLATE_ID, TEMPLATE_ID_ALIASES, normalizeTemplateId } from '../entrypoints/models/sdk-types.js';
 export * from '../feedback/index.js';
-export * from '../gateway/admin-passthrough.js';
-export * from '../gateway/admin-route-inventory.js';
-export * from '../gateway/health.js';
 export type { AgentMessageKind, AgentMessageRecord, AgentStatusRecord, ApprovalRequest, CanonicalTaskState, CatalogArtifactVersion, CatalogItem, CatalogItemFilters, CatalogItemOfferMode, CreateApprovalRequestRequest, DecideApprovalRequestRequest, NativeCapacityAvailability, NativeCapacityInput, NativeCapacitySummary, DirectBoardItemSummary, HybridExecutionPhase, HybridExecutionPlan, InboxItem, LinkedProjectRecordRef, ListApprovalRequestsRequest, NativeReservationDebitAggregate, PlannedTaskNode, PlanningAdmissionResult, PlanningPolicy, PredictiveReservePolicy, ProjectCapabilityGrant, ProjectCapacityDiagnostics, ProjectEnvironmentName, ProjectJobStatus, ProjectOverviewSummary, ReleaseDetail, ReleaseState, ReleaseSummary, RemoteJob, RemoteJobEvent, RemoteJobStatus, RepositoryWorkState, ReservePrediction, SdkContentEntry, SdkContextPack, SdkContextPackRequest, SdkCursorEntity, SdkDispatchCapability, SdkDispatchConfig, SdkDispatchCredentialSource, SdkDispatchExecutionClass, SdkDispatchNamespace, SdkDispatchPolicy, SdkDispatchRequest, SdkDispatchResult, SdkDispatchTarget, SdkFilterCondition, SdkFollowRequest, SdkGetRequest, SdkGraphDslParseResult, SdkGraphDslRelation, SdkGraphEdge, SdkGraphEdgeType, SdkGraphModelConfig, SdkGraphNode, SdkGraphNodeType, SdkGraphPathExplanation, SdkGraphQueryOptions, SdkGraphQueryRequest, SdkGraphQueryResult, SdkGraphQueryStage, SdkGraphQueryView, SdkGraphRankingBuildInput, SdkGraphRankingDiagnostics, SdkGraphRankingIndex, SdkGraphRankingNodeResult, SdkGraphRankingProvider, SdkGraphRankingQueryRequest, SdkGraphRankingQueryResult, SdkGraphRankingSearchRequest, SdkGraphRefreshPayload, SdkGraphRefreshRequest, SdkGraphSearchOptions, SdkGraphSearchResult, SdkGraphSeed, SdkGraphSeedResolution, SdkGraphTraversalResult, SdkGraphWhereFilter, SdkJsonEnvelope, SdkLeaseEntity, SdkMessageEntity, SdkModelDefinition, SdkModelFieldBinding, SdkModelName, SdkModelRegistry, SdkMutationRequest, SdkOperation, SdkPickRequest, SdkPickResult, SdkRunEntity, SdkSearchRequest, SdkSubscriptionEntity, SdkTemplateCatalogEntry, SdkTemplateCatalogPublisher, SdkTemplateCatalogResponse, SdkTemplateCatalogSource, SdkUpdateRequest, SharePackageState, SharePackageStatus, TaskAdmissionDecision, TaskAdmissionOutcome, TaskAdmissionPolicy, TaskCheckpointArtifact, TaskClassification, TaskConcurrencyClass, TaskMutationScope, TaskPlanProposal, TaskRiskClass, TeamHomeSummary, TeamMemberSummary, TeamStorageLocator, UpsertCatalogArtifactVersionRequest, UpsertCatalogItemRequest, UpsertTeamInboxItemRequest, UpsertTeamStorageLocatorRequest, UtilityEstimate, UtilityPolicy, WorkstreamDetail, WorkstreamEvent, WorkstreamState, WorkstreamSummary } from '../entrypoints/models/sdk-types.js';
 export * from '../knowledge/index.js';

package/dist/index/public-contracts.js

@@ -4,9 +4,6 @@ import {
   normalizeTemplateId
 } from "../entrypoints/models/sdk-types.js";
 export * from "../feedback/index.js";
-export * from "../gateway/admin-passthrough.js";
-export * from "../gateway/admin-route-inventory.js";
-export * from "../gateway/health.js";
 export * from "../knowledge/index.js";
 export {
   DEFAULT_STARTER_TEMPLATE_ID,

package/dist/index/templates-and-catalog.d.ts

@@ -1 +1 @@
-export { RemoteTemplateCatalogClient, parseTemplateCatalogResponse } from '../commerce/catalog/template-catalog.js';
+export { RemoteTemplateCatalogClient, parseTemplateCatalogResponse } from '../templates/template-catalog.js';

package/dist/index/templates-and-catalog.js

@@ -1,4 +1,4 @@
-import { RemoteTemplateCatalogClient, parseTemplateCatalogResponse } from "../commerce/catalog/template-catalog.js";
+import { RemoteTemplateCatalogClient, parseTemplateCatalogResponse } from "../templates/template-catalog.js";
 export {
   RemoteTemplateCatalogClient,
   parseTemplateCatalogResponse

package/dist/local-dev/managed-dev-process-spec.js

@@ -65,7 +65,6 @@ function localApiEnvironment(apiPort, webPort) {
 function localWebEnvironment(apiPort, webPort) {
   const apiBaseUrl = `http://127.0.0.1:${apiPort}`;
   return {
-    TREESEED_MARKET_API_BASE_URL: apiBaseUrl,
     TREESEED_API_BASE_URL: apiBaseUrl,
     TREESEED_SITE_URL: `http://127.0.0.1:${webPort}`,
     TREESEED_CAPACITY_ACCEPTANCE_API_URL: apiBaseUrl,

package/dist/operations/providers/default/preflight-operation.d.ts

@@ -37,16 +37,16 @@ export declare class TemplateOperation extends BaseOperation {
             displayName: string;
             description: string;
             summary: string;
-            status: import("../../../entrypoints/models/sdk-types.js").SdkTemplateCatalogStatus;
+            status: import("../../../sdk-types/control-plane/resource-requests.js").SdkTemplateCatalogStatus;
             featured: boolean;
-            category: import("../../../entrypoints/models/sdk-types.js").SdkTemplateCategory;
+            category: import("../../../sdk-types/control-plane/resource-requests.js").SdkTemplateCategory;
             tags: string[];
             publisher: import("../../../index.js").SdkTemplateCatalogPublisher;
             templateVersion: string;
             templateApiVersion: number;
             minCliVersion: string;
             minCoreVersion: string | undefined;
-            fulfillmentMode: "git" | "r2" | "packaged";
+            fulfillmentMode: "packaged" | "git" | "r2";
             source: import("../../../index.js").SdkTemplateCatalogSource;
         };
     }> | import("../../operations-types.js").OperationResult<{
@@ -59,16 +59,16 @@ export declare class TemplateOperation extends BaseOperation {
             displayName: string;
             description: string;
             summary: string;
-            status: import("../../../entrypoints/models/sdk-types.js").SdkTemplateCatalogStatus;
+            status: import("../../../sdk-types/control-plane/resource-requests.js").SdkTemplateCatalogStatus;
             featured: boolean;
-            category: import("../../../entrypoints/models/sdk-types.js").SdkTemplateCategory;
+            category: import("../../../sdk-types/control-plane/resource-requests.js").SdkTemplateCategory;
             tags: string[];
             publisher: import("../../../index.js").SdkTemplateCatalogPublisher;
             templateVersion: string;
             templateApiVersion: number;
             minCliVersion: string;
             minCoreVersion: string | undefined;
-            fulfillmentMode: "git" | "r2" | "packaged";
+            fulfillmentMode: "packaged" | "git" | "r2";
             source: import("../../../index.js").SdkTemplateCatalogSource;
         }[];
     }>>;

package/dist/operations/services/config-runtime/configuration/create-default-machine-config.d.ts

@@ -71,6 +71,7 @@ export declare function decryptRemoteAuthSessions(payload: any, key: any): {
         accessToken: string;
         refreshToken: string;
         expiresAt: any;
+        audience: any;
         principal: any;
     };
 };
@@ -89,6 +90,7 @@ export declare function encryptRemoteAuthSessions(sessions: any, key: any): {
             ciphertext: string;
         } | null;
         expiresAt: any;
+        audience: any;
         principal: any;
     };
 };

package/dist/operations/services/config-runtime/configuration/create-default-machine-config.js

@@ -146,6 +146,7 @@ function decryptRemoteAuthSessions(payload, key) {
         accessToken: decryptValue(entry.accessToken, key),
         refreshToken: decryptValue(entry.refreshToken, key),
         expiresAt: typeof entry.expiresAt === "string" ? entry.expiresAt : "",
+        audience: typeof entry.audience === "string" ? entry.audience : "",
         principal: entry.principal ?? null
       }
     ])
@@ -159,6 +160,7 @@ function encryptRemoteAuthSessions(sessions, key) {
         accessToken: entry.accessToken ? encryptValue(entry.accessToken, key) : null,
         refreshToken: entry.refreshToken ? encryptValue(entry.refreshToken, key) : null,
         expiresAt: entry.expiresAt ?? "",
+        audience: entry.audience ?? "",
         principal: entry.principal ?? null
       }
     ])

package/dist/operations/services/config-runtime/configuration/list-relevant-config-entries.js

@@ -4,7 +4,7 @@ import {
   isEnvironmentEntryRequired,
   validateEnvironmentValues
 } from "../../../../platform/configuration/environment.js";
-import { ensureGitignoreEntries, ensureRailwayIgnoreEntries, migrateLegacyScopedSharedEntries } from "../commerce/catalog/resolve-template-catalog-endpoint.js";
+import { ensureGitignoreEntries, ensureRailwayIgnoreEntries, migrateLegacyScopedSharedEntries } from "../templates/catalog/template-catalog-settings.js";
 import { getMachineConfigPaths } from "../hosting/load-tenant-deploy-config.js";
 import { collectConfigSeedValues, collectEnvironmentContext, setMachineEnvironmentValue } from "../support/resolve-entry-value-from-buckets.js";
 import { loadMachineConfig } from "../support/rotate-machine-key-passphrase.js";

package/dist/operations/services/config-runtime/support/resolve-entry-value-from-buckets.js

@@ -7,7 +7,7 @@ import {
 import {
   KeyAgentError
 } from "../../configuration/key-agent.js";
-import { decryptMachineEnvironmentBucket } from "../commerce/catalog/resolve-template-catalog-endpoint.js";
+import { decryptMachineEnvironmentBucket } from "../templates/catalog/template-catalog-settings.js";
 import { encryptValue, loadMachineKey } from "../configuration/create-default-machine-config.js";
 import { PROVIDER_CONTROL_ENV_KEYS, filterEnvironmentValuesByRegistry, warnDeprecatedLocalEnvFiles } from "../configuration/machine-config-relative-path.js";
 import { loadOptionalTenantManifest, loadTenantDeployConfig } from "../hosting/load-tenant-deploy-config.js";

package/dist/operations/services/config-runtime/support/rotate-machine-key-passphrase.d.ts

@@ -15,6 +15,7 @@ export declare function loadRemoteAuthState(tenantRoot: any): {
             accessToken: string;
             refreshToken: string;
             expiresAt: any;
+            audience: any;
             principal: any;
         };
     };
@@ -30,6 +31,7 @@ export declare function setRemoteSession(tenantRoot: any, { hostId, accessToken,
     accessToken: string;
     refreshToken: string;
     expiresAt: any;
+    audience: any;
     principal: any;
 };
 export declare function clearRemoteSession(tenantRoot: any, hostId: any): {
@@ -39,6 +41,7 @@ export declare function clearRemoteSession(tenantRoot: any, hostId: any): {
             accessToken: string;
             refreshToken: string;
             expiresAt: any;
+            audience: any;
             principal: any;
         };
     };
@@ -47,6 +50,7 @@ export declare function resolveRemoteSession(tenantRoot: any, hostId: any): {
     accessToken: string;
     refreshToken: string;
     expiresAt: any;
+    audience: any;
     principal: any;
 } | null;
 export declare function loadMachineConfig(tenantRoot: any): any;

package/dist/operations/services/config-runtime/{commerce/catalog/resolve-template-catalog-endpoint.d.ts → templates/catalog/template-catalog-settings.d.ts}

@@ -1,4 +1,5 @@
 import { SharedStorageMigrationNotice } from '../../accounts/ensure-secret-session-for-config.js';
+/** Resolve the independently hosted template registry endpoint. */
 export declare function resolveTemplateCatalogEndpoint(startRoot?: string, env?: NodeJS.ProcessEnv): string;
 export declare function resolveTemplateCatalogCachePath(startRoot?: string): string;
 export declare function ensureGitignoreEntries(tenantRoot: any): string;

package/dist/operations/services/configuration/config-runtime.d.ts

@@ -1,6 +1,6 @@
 export * from '../config-runtime/accounts/ensure-secret-session-for-config.js';
 export * from '../config-runtime/agents/ensure-act-verification-tooling.js';
-export * from '../config-runtime/commerce/catalog/resolve-template-catalog-endpoint.js';
+export * from '../config-runtime/templates/catalog/template-catalog-settings.js';
 export * from '../config-runtime/configuration/create-default-machine-config.js';
 export * from '../config-runtime/configuration/create-git-hub-config-sync-units.js';
 export * from '../config-runtime/configuration/configuration-generation.js';