@treeseed/sdk 0.13.0-rc.68 → 0.13.0-rc.70

package/dist/.treeseed-build-complete.json

@@ -1 +1 @@
-{"completedAt":"2026-09-01T09:57:27.022Z"}
+{"completedAt":"2026-09-01T21:09:39.160Z"}

package/dist/capacity-provider/contracts/environment-profiles.d.ts

@@ -0,0 +1,255 @@
+import { z } from 'zod';
+export declare const providerRegistrationCodeStatusSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.provider-registration-code-status/v1">;
+    teamId: z.ZodString;
+    generation: z.ZodNumber;
+    codePrefix: z.ZodString;
+    rotatedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.provider-registration-code-status/v1";
+    teamId: string;
+    rotatedAt: string;
+    generation: number;
+    codePrefix: string;
+}, {
+    schemaVersion: "treeseed.provider-registration-code-status/v1";
+    teamId: string;
+    rotatedAt: string;
+    generation: number;
+    codePrefix: string;
+}>;
+export declare const providerRegistrationCodeReceiptSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.provider-registration-code-receipt/v1">;
+    teamId: z.ZodString;
+    generation: z.ZodNumber;
+    codePrefix: z.ZodString;
+    registrationCode: z.ZodString;
+    rotatedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.provider-registration-code-receipt/v1";
+    teamId: string;
+    rotatedAt: string;
+    generation: number;
+    codePrefix: string;
+    registrationCode: string;
+}, {
+    schemaVersion: "treeseed.provider-registration-code-receipt/v1";
+    teamId: string;
+    rotatedAt: string;
+    generation: number;
+    codePrefix: string;
+    registrationCode: string;
+}>;
+export declare const providerEnvironmentVariableDescriptorSchema: z.ZodObject<{
+    name: z.ZodString;
+    available: z.ZodBoolean;
+    rotatedAt: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    name: string;
+    available: boolean;
+    rotatedAt?: string | undefined;
+}, {
+    name: string;
+    available: boolean;
+    rotatedAt?: string | undefined;
+}>;
+export declare const providerEnvironmentProfileDescriptorSchema: z.ZodEffects<z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.provider-environment-profile/v1">;
+    id: z.ZodString;
+    generation: z.ZodNumber;
+    variables: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        available: z.ZodBoolean;
+        rotatedAt: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        name: string;
+        available: boolean;
+        rotatedAt?: string | undefined;
+    }, {
+        name: string;
+        available: boolean;
+        rotatedAt?: string | undefined;
+    }>, "many">;
+    updatedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.provider-environment-profile/v1";
+    id: string;
+    variables: {
+        name: string;
+        available: boolean;
+        rotatedAt?: string | undefined;
+    }[];
+    generation: number;
+    updatedAt: string;
+}, {
+    schemaVersion: "treeseed.provider-environment-profile/v1";
+    id: string;
+    variables: {
+        name: string;
+        available: boolean;
+        rotatedAt?: string | undefined;
+    }[];
+    generation: number;
+    updatedAt: string;
+}>, {
+    schemaVersion: "treeseed.provider-environment-profile/v1";
+    id: string;
+    variables: {
+        name: string;
+        available: boolean;
+        rotatedAt?: string | undefined;
+    }[];
+    generation: number;
+    updatedAt: string;
+}, {
+    schemaVersion: "treeseed.provider-environment-profile/v1";
+    id: string;
+    variables: {
+        name: string;
+        available: boolean;
+        rotatedAt?: string | undefined;
+    }[];
+    generation: number;
+    updatedAt: string;
+}>;
+export declare const assignmentEnvironmentGrantSchema: z.ZodEffects<z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.assignment-environment-grant/v1">;
+    grantId: z.ZodString;
+    assignmentId: z.ZodString;
+    providerId: z.ZodString;
+    teamId: z.ZodString;
+    projectId: z.ZodString;
+    profileId: z.ZodString;
+    variables: z.ZodArray<z.ZodString, "many">;
+    network: z.ZodObject<{
+        allowed: z.ZodBoolean;
+        destinations: z.ZodArray<z.ZodString, "many">;
+    }, "strict", z.ZodTypeAny, {
+        allowed: boolean;
+        destinations: string[];
+    }, {
+        allowed: boolean;
+        destinations: string[];
+    }>;
+    policy: z.ZodObject<{
+        handlerDeclarationDigest: z.ZodString;
+        providerOfferDigest: z.ZodString;
+        providerPermissionDigest: z.ZodString;
+        teamApprovalDigest: z.ZodString;
+        assignmentGrantDigest: z.ZodString;
+        sandboxPolicyDigest: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        handlerDeclarationDigest: string;
+        providerOfferDigest: string;
+        providerPermissionDigest: string;
+        teamApprovalDigest: string;
+        assignmentGrantDigest: string;
+        sandboxPolicyDigest: string;
+    }, {
+        handlerDeclarationDigest: string;
+        providerOfferDigest: string;
+        providerPermissionDigest: string;
+        teamApprovalDigest: string;
+        assignmentGrantDigest: string;
+        sandboxPolicyDigest: string;
+    }>;
+    issuedAt: z.ZodString;
+    expiresAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.assignment-environment-grant/v1";
+    projectId: string;
+    teamId: string;
+    providerId: string;
+    issuedAt: string;
+    expiresAt: string;
+    variables: string[];
+    assignmentId: string;
+    profileId: string;
+    network: {
+        allowed: boolean;
+        destinations: string[];
+    };
+    policy: {
+        handlerDeclarationDigest: string;
+        providerOfferDigest: string;
+        providerPermissionDigest: string;
+        teamApprovalDigest: string;
+        assignmentGrantDigest: string;
+        sandboxPolicyDigest: string;
+    };
+    grantId: string;
+}, {
+    schemaVersion: "treeseed.assignment-environment-grant/v1";
+    projectId: string;
+    teamId: string;
+    providerId: string;
+    issuedAt: string;
+    expiresAt: string;
+    variables: string[];
+    assignmentId: string;
+    profileId: string;
+    network: {
+        allowed: boolean;
+        destinations: string[];
+    };
+    policy: {
+        handlerDeclarationDigest: string;
+        providerOfferDigest: string;
+        providerPermissionDigest: string;
+        teamApprovalDigest: string;
+        assignmentGrantDigest: string;
+        sandboxPolicyDigest: string;
+    };
+    grantId: string;
+}>, {
+    schemaVersion: "treeseed.assignment-environment-grant/v1";
+    projectId: string;
+    teamId: string;
+    providerId: string;
+    issuedAt: string;
+    expiresAt: string;
+    variables: string[];
+    assignmentId: string;
+    profileId: string;
+    network: {
+        allowed: boolean;
+        destinations: string[];
+    };
+    policy: {
+        handlerDeclarationDigest: string;
+        providerOfferDigest: string;
+        providerPermissionDigest: string;
+        teamApprovalDigest: string;
+        assignmentGrantDigest: string;
+        sandboxPolicyDigest: string;
+    };
+    grantId: string;
+}, {
+    schemaVersion: "treeseed.assignment-environment-grant/v1";
+    projectId: string;
+    teamId: string;
+    providerId: string;
+    issuedAt: string;
+    expiresAt: string;
+    variables: string[];
+    assignmentId: string;
+    profileId: string;
+    network: {
+        allowed: boolean;
+        destinations: string[];
+    };
+    policy: {
+        handlerDeclarationDigest: string;
+        providerOfferDigest: string;
+        providerPermissionDigest: string;
+        teamApprovalDigest: string;
+        assignmentGrantDigest: string;
+        sandboxPolicyDigest: string;
+    };
+    grantId: string;
+}>;
+export type ProviderRegistrationCodeStatus = z.infer<typeof providerRegistrationCodeStatusSchema>;
+export type ProviderRegistrationCodeReceipt = z.infer<typeof providerRegistrationCodeReceiptSchema>;
+export type ProviderEnvironmentVariableDescriptor = z.infer<typeof providerEnvironmentVariableDescriptorSchema>;
+export type ProviderEnvironmentProfileDescriptor = z.infer<typeof providerEnvironmentProfileDescriptorSchema>;
+export type AssignmentEnvironmentGrant = z.infer<typeof assignmentEnvironmentGrantSchema>;

package/dist/capacity-provider/contracts/environment-profiles.js

@@ -0,0 +1,71 @@
+import { z } from "zod";
+const identifier = z.string().regex(/^[a-z][a-z0-9._-]{0,127}$/u);
+const digest = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+const variableName = z.string().regex(/^[A-Z_][A-Z0-9_]*$/u);
+const maximumGrantLifetimeMs = 24 * 60 * 60 * 1e3;
+const providerRegistrationCodeStatusSchema = z.object({
+  schemaVersion: z.literal("treeseed.provider-registration-code-status/v1"),
+  teamId: z.string().min(1),
+  generation: z.number().int().positive(),
+  codePrefix: z.string().min(1),
+  rotatedAt: z.string().datetime()
+}).strict();
+const providerRegistrationCodeReceiptSchema = z.object({
+  schemaVersion: z.literal("treeseed.provider-registration-code-receipt/v1"),
+  teamId: z.string().min(1),
+  generation: z.number().int().positive(),
+  codePrefix: z.string().min(1),
+  registrationCode: z.string().min(16),
+  rotatedAt: z.string().datetime()
+}).strict();
+const providerEnvironmentVariableDescriptorSchema = z.object({
+  name: variableName,
+  available: z.boolean(),
+  rotatedAt: z.string().datetime().optional()
+}).strict();
+const providerEnvironmentProfileDescriptorSchema = z.object({
+  schemaVersion: z.literal("treeseed.provider-environment-profile/v1"),
+  id: identifier,
+  generation: z.number().int().positive(),
+  variables: z.array(providerEnvironmentVariableDescriptorSchema),
+  updatedAt: z.string().datetime()
+}).strict().superRefine((profile, context) => {
+  const names = /* @__PURE__ */ new Set();
+  for (const [index, variable] of profile.variables.entries()) {
+    if (names.has(variable.name)) context.addIssue({ code: z.ZodIssueCode.custom, path: ["variables", index, "name"], message: "Environment variable names must be unique within a profile." });
+    names.add(variable.name);
+  }
+});
+const assignmentEnvironmentGrantSchema = z.object({
+  schemaVersion: z.literal("treeseed.assignment-environment-grant/v1"),
+  grantId: identifier,
+  assignmentId: z.string().min(1),
+  providerId: z.string().min(1),
+  teamId: z.string().min(1),
+  projectId: z.string().min(1),
+  profileId: identifier,
+  variables: z.array(variableName).min(1),
+  network: z.object({ allowed: z.boolean(), destinations: z.array(z.string().min(1)) }).strict(),
+  policy: z.object({
+    handlerDeclarationDigest: digest,
+    providerOfferDigest: digest,
+    providerPermissionDigest: digest,
+    teamApprovalDigest: digest,
+    assignmentGrantDigest: digest,
+    sandboxPolicyDigest: digest
+  }).strict(),
+  issuedAt: z.string().datetime(),
+  expiresAt: z.string().datetime()
+}).strict().superRefine((grant, context) => {
+  if (new Set(grant.variables).size !== grant.variables.length) context.addIssue({ code: z.ZodIssueCode.custom, path: ["variables"], message: "Granted environment variables must be unique." });
+  if (Date.parse(grant.expiresAt) <= Date.parse(grant.issuedAt)) context.addIssue({ code: z.ZodIssueCode.custom, path: ["expiresAt"], message: "Environment grants must expire after issuance." });
+  if (Date.parse(grant.expiresAt) - Date.parse(grant.issuedAt) > maximumGrantLifetimeMs) context.addIssue({ code: z.ZodIssueCode.custom, path: ["expiresAt"], message: "Environment grants cannot exceed 24 hours." });
+  if (!grant.network.allowed && grant.network.destinations.length) context.addIssue({ code: z.ZodIssueCode.custom, path: ["network", "destinations"], message: "Denied network authority cannot declare destinations." });
+});
+export {
+  assignmentEnvironmentGrantSchema,
+  providerEnvironmentProfileDescriptorSchema,
+  providerEnvironmentVariableDescriptorSchema,
+  providerRegistrationCodeReceiptSchema,
+  providerRegistrationCodeStatusSchema
+};

package/dist/capacity-provider/contracts/index.d.ts

@@ -1,2 +1,3 @@
 export * from './capacity-facts.js';
+export * from './environment-profiles.js';
 export * from './governance.js';

package/dist/capacity-provider/contracts/index.js

@@ -1,2 +1,3 @@
 export * from "./capacity-facts.js";
+export * from "./environment-profiles.js";
 export * from "./governance.js";

package/dist/entrypoints/clients/control-plane-client.js

@@ -173,7 +173,11 @@ class ControlPlaneClient {
         code: "control_plane_response_invalid"
       }, response.headers);
     }
-    return payload;
+    const envelope = payload;
+    const etag = response.headers.get("etag");
+    const contractDigest = response.headers.get("x-treeseed-contract-digest");
+    if (!etag && !contractDigest) return envelope;
+    return { ...envelope, meta: { ...envelope.meta ?? {}, ...etag ? { etag } : {}, ...contractDigest ? { contractDigest } : {} } };
   }
 }
 export {

package/dist/operator-contracts/canonical-command-tree.js

@@ -1,3 +1,4 @@
+import { hostProviderEnvironmentBranch, PROVIDER_ENVIRONMENT_COMMAND_BINDINGS, providerEnvironmentBranches } from "./catalog/provider-environment-commands.js";
 const unavailable = (reason = "This capability is not enabled until its control-plane operation is accepted.") => ({
   kind: "unavailable",
   code: "standards_migration_not_enabled",
@@ -10,6 +11,7 @@ const operation = (operationId, input = []) => ({ kind: "operation", operationId
 const page = () => [field("query", "status", "option"), field("query", "limit", "option", "limit", false, "integer"), field("query", "cursor", "option")];
 const aiNode = () => field("path", "nodeId", "context", "node", true);
 const operationBindings = {
+  ...PROVIDER_ENVIRONMENT_COMMAND_BINDINGS,
   "auth login": protocol("protocol.oauth.device.login"),
   "auth logout": protocol("protocol.oauth.revoke"),
   "auth status": operation("accounts.current.show"),
@@ -393,7 +395,7 @@ const commandTree = {
       branch("config", [leaf("show"), leaf("plan", "read", "file"), leaf("apply", "mutation", "file", "authority"), configurationAdopt()]),
       leaf("topology"),
       leaf("connections"),
-      branch("provider", [leaf("status"), branch("credentials", [leaf("list"), leaf("status"), hostProviderCredentialInitialize()])]),
+      branch("provider", [leaf("status"), branch("credentials", [leaf("list"), leaf("status"), hostProviderCredentialInitialize()]), hostProviderEnvironmentBranch()]),
       branch("storage", [
         leaf("status"),
         addOptions(leaf("connect", "mutation", "backend", "credential"), [{ name: "--account-id", description: "Optional Cloudflare account ID when the bootstrap authority reaches multiple accounts.", type: "string" }]),
@@ -428,6 +430,7 @@ const commandTree = {
       leaf("diagnose", "read", "provider"),
       leaf("connect", "mutation", void 0, "credential"),
       leaf("disconnect", "mutation", "connection", "destructive"),
+      ...providerEnvironmentBranches(),
       branch("requests", [leaf("list"), leaf("show", "read", "request"), leaf("approve", "mutation", "request", "authority"), leaf("reject", "mutation", "request", "authority")]),
       branch("credentials", [leaf("status", "read", "connection"), leaf("rotate", "mutation", "connection", "credential"), leaf("revoke", "mutation", "connection", "irreversible")]),
       branch("offers", [leaf("show", "read", "connection"), leaf("validate", "read", "file"), leaf("plan", "read", "file"), leaf("apply", "mutation", "file", "authority")])

package/dist/operator-contracts/catalog/provider-environment-commands.d.ts

@@ -0,0 +1,4 @@
+import type { CommandExecutionBinding, CommandNodeDescriptor } from '../command-tree.js';
+export declare const PROVIDER_ENVIRONMENT_COMMAND_BINDINGS: Record<string, CommandExecutionBinding>;
+export declare function hostProviderEnvironmentBranch(): CommandNodeDescriptor;
+export declare function providerEnvironmentBranches(): CommandNodeDescriptor[];

package/dist/operator-contracts/catalog/provider-environment-commands.js

@@ -0,0 +1,69 @@
+const plan = { name: "--plan", description: "Return the exact proposed outcome without mutation.", type: "boolean" };
+const local = (handlerId) => ({ kind: "local", handlerId });
+const operation = (operationId, input) => ({ kind: "operation", operationId, input });
+const path = (field, source, name, required = true) => ({ target: "path", field, source, name, required, transform: "identity" });
+const PROVIDER_ENVIRONMENT_COMMAND_BINDINGS = {
+  "host provider environment list": local("local.host.provider.environment.list"),
+  "host provider environment show": local("local.host.provider.environment.show"),
+  "host provider environment status": local("local.host.provider.environment.status"),
+  "host provider environment set": local("local.host.provider.environment.set"),
+  "host provider environment import": local("local.host.provider.environment.import"),
+  "host provider environment unset": local("local.host.provider.environment.unset"),
+  "host provider environment rotate": local("local.host.provider.environment.rotate"),
+  "host provider environment verify": local("local.host.provider.environment.verify"),
+  "providers registration code status": operation("providers.registration.code.status", [path("teamId", "context", "team")]),
+  "providers registration code reveal": operation("providers.registration.code.reveal", [path("teamId", "context", "team")]),
+  "providers registration code rotate": operation("providers.registration.code.rotate", [path("teamId", "context", "team")]),
+  "providers environments list": operation("providers.environment.profiles.list", [path("teamId", "context", "team"), path("providerId", "argument", "provider"), { target: "query", field: "status", source: "option", name: "status", transform: "identity" }, { target: "query", field: "limit", source: "option", name: "limit", transform: "integer" }, { target: "query", field: "cursor", source: "option", name: "cursor", transform: "identity" }]),
+  "providers environments show": operation("providers.environment.profiles.show", [path("teamId", "context", "team"), path("providerId", "argument", "provider"), path("profileId", "argument", "profile")]),
+  "providers environments grant": operation("providers.environment.grants.put", [path("teamId", "context", "team"), path("assignmentId", "argument", "assignment"), { target: "body", field: "file", source: "option", name: "input", required: true, transform: "identity" }]),
+  "providers environments revoke": operation("providers.environment.grants.revoke", [path("teamId", "context", "team"), path("assignmentId", "argument", "assignment")])
+};
+const profileArguments = [{ name: "profile", description: "Provider-local environment profile.", required: true }];
+const valueArguments = [...profileArguments, { name: "name", description: "Environment variable name.", required: true }];
+const localMutation = (segment, confirmation, description) => ({
+  segment,
+  description,
+  kind: "mutation",
+  arguments: valueArguments,
+  options: [plan, ...segment === "unset" ? [] : [{ name: "--stdin", description: "Read the replacement value from standard input instead of the hidden prompt.", type: "boolean" }]],
+  authorization: { capability: "host.provider.environment.write", confirmation },
+  resultSchemaId: "treeseed.provider-environment-profile/v1",
+  execution: local(`local.host.provider.environment.${segment}`)
+});
+function hostProviderEnvironmentBranch() {
+  const read = (segment) => ({ segment, description: `${segment} a provider-local environment profile.`, kind: "read", arguments: profileArguments, resultSchemaId: "treeseed.provider-environment-profile/v1", execution: local(`local.host.provider.environment.${segment}`) });
+  return { nodeType: "branch", segment: "environment", description: "Provider-local environment profile operations.", children: [
+    { nodeType: "leaf", segment: "list", description: "List provider-local environment profiles without values.", kind: "read", resultSchemaId: "treeseed.provider-environment-profile-page/v1", execution: local("local.host.provider.environment.list") },
+    { nodeType: "leaf", ...read("show") },
+    { nodeType: "leaf", ...read("status") },
+    { nodeType: "leaf", ...localMutation("set", "credential", "Set one provider-local environment value through a hidden prompt or standard input.") },
+    {
+      nodeType: "leaf",
+      segment: "import",
+      description: "Import provider-local environment values from an env file.",
+      kind: "mutation",
+      arguments: profileArguments,
+      options: [plan, { name: "--env-file", description: "Local env file whose values remain under provider custody.", type: "string", required: true }],
+      authorization: { capability: "host.provider.environment.write", confirmation: "credential" },
+      resultSchemaId: "treeseed.provider-environment-profile/v1",
+      execution: local("local.host.provider.environment.import")
+    },
+    { nodeType: "leaf", ...localMutation("unset", "destructive", "Remove one provider-local environment value.") },
+    { nodeType: "leaf", ...localMutation("rotate", "credential", "Replace one provider-local environment value and advance its generation.") },
+    { nodeType: "leaf", ...read("verify") }
+  ] };
+}
+function providerEnvironmentBranches() {
+  const remote = { kind: "unavailable", code: "standards_migration_not_enabled", reason: "Execution binding is attached from the canonical operation map." };
+  const leaf = (segment, kind, arguments_, confirmation = "never", options = kind === "mutation" ? [plan] : void 0) => ({ nodeType: "leaf", segment, description: `${segment} provider environment authority.`, kind, arguments: arguments_, options, authorization: kind === "mutation" ? { capability: `command.${segment}`, confirmation } : void 0, resultSchemaId: `treeseed.command.${segment}/v1`, execution: remote });
+  return [
+    { nodeType: "branch", segment: "registration", description: "Team provider registration operations.", children: [{ nodeType: "branch", segment: "code", description: "Team provider registration-code operations.", children: [leaf("status", "read", void 0), leaf("reveal", "mutation", void 0, "credential"), leaf("rotate", "mutation", void 0, "credential")] }] },
+    { nodeType: "branch", segment: "environments", description: "Provider environment descriptor and grant operations.", children: [leaf("list", "read", [{ name: "provider", description: "Provider identity.", required: true }]), leaf("show", "read", [{ name: "provider", description: "Provider identity.", required: true }, { name: "profile", description: "Profile identity.", required: true }]), leaf("grant", "mutation", [{ name: "assignment", description: "Assignment identity.", required: true }], "authority", [plan, { name: "--input", description: "Digest-bound environment grant document.", type: "string", required: true }]), leaf("revoke", "mutation", [{ name: "assignment", description: "Assignment identity.", required: true }], "destructive")] }
+  ];
+}
+export {
+  PROVIDER_ENVIRONMENT_COMMAND_BINDINGS,
+  hostProviderEnvironmentBranch,
+  providerEnvironmentBranches
+};

package/dist/operator-contracts/catalog/provider-environment-operations.d.ts

@@ -0,0 +1,41 @@
+export declare const PROVIDER_ENVIRONMENT_OPERATIONS: {
+    readonly registrationCode: {
+        readonly status: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
+            teamId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly reveal: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
+            teamId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly rotate: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
+            teamId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+    };
+    readonly environmentProfiles: {
+        readonly list: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
+            teamId: string;
+            providerId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly show: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
+            teamId: string;
+            providerId: string;
+            profileId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly publish: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
+            profileId: string;
+        }, {}, Record<string, unknown>, Record<string, unknown>>;
+    };
+    readonly environmentGrants: {
+        readonly show: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
+            teamId: string;
+            assignmentId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly put: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
+            teamId: string;
+            assignmentId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly revoke: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
+            teamId: string;
+            assignmentId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+    };
+};

package/dist/operator-contracts/catalog/provider-environment-operations.js

@@ -0,0 +1,61 @@
+import { z } from "zod";
+import { defineOperation } from "../operation-builder.js";
+const empty = z.object({}).strict();
+const none = z.undefined();
+const record = z.record(z.unknown());
+function teamOperation(operationId, method, path, pathShape, options = {}) {
+  const kind = method === "GET" ? "read" : "mutation";
+  const riskClass = options.risk ?? "ordinary";
+  return defineOperation({
+    operationId,
+    description: `${kind === "read" ? "Read" : "Apply"} ${operationId}.`,
+    rest: { method, path },
+    parameters: `treeseed.${operationId}.parameters/v1`,
+    capability: options.capability ?? (kind === "read" ? "providers.read" : "providers.write"),
+    authentication: "oauth",
+    oauthScopes: kind === "read" ? ["treeseed:read"] : ["treeseed:admin"],
+    kind,
+    riskClass,
+    confirmation: riskClass === "ordinary" ? "never" : "input_required",
+    surfaces: ["rest", "cli"],
+    cacheScope: kind === "read" ? "principal" : "none",
+    pagination: options.pagination ?? "none",
+    concurrencyRequired: options.concurrency ?? ["DELETE", "PUT"].includes(method),
+    redactedPaths: options.redactedPaths
+  }, { path: z.object(pathShape).strict(), query: kind === "read" ? record : empty, body: kind === "read" ? none : record, output: record });
+}
+const providerPublish = defineOperation({
+  operationId: "providers.environment.profiles.publish",
+  description: "Publish a value-free provider environment profile descriptor.",
+  rest: { method: "PUT", path: "/v1/provider/environment-profiles/{profileId}" },
+  parameters: "treeseed.providers.environment.profiles.publish.parameters/v1",
+  capability: "providers.execute",
+  authentication: "provider",
+  oauthScopes: [],
+  kind: "mutation",
+  riskClass: "ordinary",
+  confirmation: "never",
+  surfaces: ["rest"],
+  cacheScope: "none",
+  pagination: "none"
+}, { path: z.object({ profileId: z.string().min(1) }).strict(), query: empty, body: record, output: record });
+const PROVIDER_ENVIRONMENT_OPERATIONS = {
+  registrationCode: {
+    status: teamOperation("providers.registration.code.status", "GET", "/v1/teams/{teamId}/capacity-provider-registration-code", { teamId: z.string().min(1) }),
+    reveal: teamOperation("providers.registration.code.reveal", "POST", "/v1/teams/{teamId}/capacity-provider-registration-code/reveal", { teamId: z.string().min(1) }, { risk: "credential", redactedPaths: ["output.registrationCode"] }),
+    rotate: teamOperation("providers.registration.code.rotate", "POST", "/v1/teams/{teamId}/capacity-provider-registration-code/rotate", { teamId: z.string().min(1) }, { risk: "credential", redactedPaths: ["output.registrationCode"], concurrency: true })
+  },
+  environmentProfiles: {
+    list: teamOperation("providers.environment.profiles.list", "GET", "/v1/teams/{teamId}/capacity-providers/{providerId}/environment-profiles", { teamId: z.string().min(1), providerId: z.string().min(1) }, { pagination: "cursor" }),
+    show: teamOperation("providers.environment.profiles.show", "GET", "/v1/teams/{teamId}/capacity-providers/{providerId}/environment-profiles/{profileId}", { teamId: z.string().min(1), providerId: z.string().min(1), profileId: z.string().min(1) }),
+    publish: providerPublish
+  },
+  environmentGrants: {
+    show: teamOperation("providers.environment.grants.show", "GET", "/v1/teams/{teamId}/assignments/{assignmentId}/environment-grant", { teamId: z.string().min(1), assignmentId: z.string().min(1) }),
+    put: teamOperation("providers.environment.grants.put", "PUT", "/v1/teams/{teamId}/assignments/{assignmentId}/environment-grant", { teamId: z.string().min(1), assignmentId: z.string().min(1) }, { risk: "authority" }),
+    revoke: teamOperation("providers.environment.grants.revoke", "DELETE", "/v1/teams/{teamId}/assignments/{assignmentId}/environment-grant", { teamId: z.string().min(1), assignmentId: z.string().min(1) }, { risk: "destructive" })
+  }
+};
+export {
+  PROVIDER_ENVIRONMENT_OPERATIONS
+};

package/dist/operator-contracts/control-plane-operations.d.ts

@@ -1955,6 +1955,17 @@ export declare const CONTROL_PLANE_OPERATIONS: {
         readonly connect: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
             teamId: string;
         }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly registrationCode: {
+            readonly status: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+                teamId: string;
+            }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+            readonly reveal: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+                teamId: string;
+            }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+            readonly rotate: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+                teamId: string;
+            }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        };
         readonly disconnect: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
             teamId: string;
             connectionId: string;
@@ -1990,6 +2001,34 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                 connectionId: string;
             }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
         };
+        readonly environmentProfiles: {
+            readonly list: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+                teamId: string;
+                providerId: string;
+            }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+            readonly show: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+                teamId: string;
+                providerId: string;
+                profileId: string;
+            }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+            readonly publish: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+                profileId: string;
+            }, {}, Record<string, unknown>, Record<string, unknown>>;
+        };
+        readonly environmentGrants: {
+            readonly show: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+                teamId: string;
+                assignmentId: string;
+            }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+            readonly put: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+                teamId: string;
+                assignmentId: string;
+            }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+            readonly revoke: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+                teamId: string;
+                assignmentId: string;
+            }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        };
         readonly register: import("./control-plane-operation.js").ControlPlaneOperationBinding<{}, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
         readonly registration: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
             requestId: string;

package/dist/operator-contracts/control-plane-operations.js

@@ -6,6 +6,7 @@ import { adminAccountOperations, adminTeamOperations } from "./catalog/admin-acc
 import { TREEAI_CONTROL_PLANE_OPERATIONS } from "./catalog/treeai-operations.js";
 import { capabilityOntologyOperations } from "./catalog/capability-ontology-operations.js";
 import { knowledgeShareOperations } from "./catalog/knowledge-share-operations.js";
+import { PROVIDER_ENVIRONMENT_OPERATIONS } from "./catalog/provider-environment-operations.js";
 import { buildControlPlaneCatalog, flattenControlPlaneOperations } from "./catalog/control-plane-catalog.js";
 const empty = z.object({}).strict();
 const none = z.undefined();
@@ -465,6 +466,7 @@ const CONTROL_PLANE_OPERATIONS = {
     status: resource("providers.status", "GET", "/v1/teams/{teamId}/capacity-providers/{providerId}/status", { teamId: z.string().min(1), providerId: z.string().min(1) }, { capability: "providers.read", surfaces: ["rest", "cli", "mcp_tool"] }),
     diagnose: resource("providers.diagnose", "GET", "/v1/teams/{teamId}/capacity-providers/{providerId}/diagnosis", { teamId: z.string().min(1), providerId: z.string().min(1) }, { capability: "providers.read", surfaces: ["rest", "cli", "mcp_tool"] }),
     connect: resource("providers.connect", "POST", "/v1/teams/{teamId}/capacity-provider-connections", { teamId: z.string().min(1) }, { capability: "providers.write", scopes: ["treeseed:admin"], surfaces: ["rest", "cli"], risk: "credential", redactedPaths: ["body.enrollmentToken"] }),
+    registrationCode: PROVIDER_ENVIRONMENT_OPERATIONS.registrationCode,
     disconnect: resource("providers.disconnect", "POST", "/v1/teams/{teamId}/capacity-provider-connections/{connectionId}/disconnect", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "providers.write", scopes: ["treeseed:admin"], surfaces: ["rest", "cli"], risk: "destructive" }),
     requests: {
       list: resource("providers.requests.list", "GET", "/v1/teams/{teamId}/capacity-provider-requests", { teamId: z.string().min(1) }, { capability: "providers.read", surfaces: ["rest", "cli"], pagination: "cursor" }),
@@ -477,6 +479,8 @@ const CONTROL_PLANE_OPERATIONS = {
       rotate: resource("providers.credentials.rotate", "POST", "/v1/teams/{teamId}/capacity-provider-connections/{connectionId}/credentials/rotate", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "providers.write", scopes: ["treeseed:admin"], surfaces: ["rest", "cli"], risk: "credential" }),
       revoke: resource("providers.credentials.revoke", "POST", "/v1/teams/{teamId}/capacity-provider-connections/{connectionId}/credentials/revoke", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "providers.write", scopes: ["treeseed:admin"], surfaces: ["rest", "cli"], risk: "irreversible" })
     },
+    environmentProfiles: PROVIDER_ENVIRONMENT_OPERATIONS.environmentProfiles,
+    environmentGrants: PROVIDER_ENVIRONMENT_OPERATIONS.environmentGrants,
     register: noPathProvider("providers.register", "POST", "/v1/provider-registrations", { authentication: "signed_request", redactedPaths: ["body.registrationKey"] }),
     registration: providerPath("providers.registration.show", "GET", "/v1/provider-registrations/{requestId}", { requestId: z.string().min(1) }, { authentication: "signed_request", read: true }),
     exchangeCredential: providerPath("providers.registration.credential", "POST", "/v1/provider-registrations/{requestId}/credential", { requestId: z.string().min(1) }, { authentication: "signed_request", redactedPaths: ["body.proof"] }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.68",
+  "version": "0.13.0-rc.70",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {