@treeseed/sdk 0.13.0-rc.8 → 0.13.0-rc.80

package/dist/capacity-provider/sandbox-contracts.js

@@ -0,0 +1,86 @@
+import { z } from "zod";
+const identifier = z.string().regex(/^[a-z][a-z0-9._-]{0,127}$/u);
+const digest = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+const sandboxProfile = identifier;
+const sandboxAssignmentSchema = z.object({
+  schemaVersion: z.literal("treeseed.sandbox-assignment/v1"),
+  assignmentId: z.string().min(1),
+  attempt: z.number().int().positive(),
+  runnerId: z.string().min(1),
+  providerId: z.string().min(1),
+  teamId: z.string().min(1),
+  projectId: z.string().min(1),
+  profile: sandboxProfile,
+  environmentContract: z.object({ id: identifier, version: z.string().regex(/^\d+\.\d+\.\d+$/u), digest, capabilities: z.array(identifier) }).strict().optional(),
+  guestImage: z.string().min(1),
+  guestImageDigest: digest,
+  identityManifestDigest: digest,
+  contextManifestDigest: digest,
+  resources: z.object({
+    cpuCores: z.number().positive(),
+    memoryBytes: z.number().int().positive(),
+    diskBytes: z.number().int().positive(),
+    durationSeconds: z.number().int().positive(),
+    processLimit: z.number().int().positive(),
+    outputBytes: z.number().int().positive()
+  }).strict(),
+  inputs: z.array(z.object({ id: identifier, digest, bytes: z.number().int().nonnegative(), disposition: z.enum(["read-only", "copy-on-write"]), mediaType: z.string().min(1), targetPath: z.string().startsWith("/workspace/") }).strict()),
+  outputs: z.array(z.object({ id: identifier, path: z.string().startsWith("/run/treeseed-output/"), mediaType: z.string().min(1), maxBytes: z.number().int().positive() }).strict()),
+  network: z.object({ defaultDeny: z.literal(true), relayUrl: z.string().url().startsWith("https://"), allowedServices: z.array(identifier), connectedDevelopmentSessionId: z.string().min(1).optional() }).strict(),
+  modelPolicy: z.object({ provider: identifier, model: z.string().min(1), reasoningEffort: z.enum(["minimal", "low", "medium", "high", "xhigh"]).optional(), capabilities: z.array(identifier), maxInputTokens: z.number().int().positive().optional(), maxOutputTokens: z.number().int().positive().optional(), maxCost: z.number().nonnegative().optional() }).strict(),
+  credentialHandles: z.array(z.object({ id: identifier, profileId: identifier, revealAllowed: z.literal(false) }).strict()),
+  treeDxHandleIds: z.array(z.string().min(1)),
+  leaseExpiresAt: z.string().datetime(),
+  signature: z.object({ keyId: identifier, algorithm: z.literal("Ed25519"), value: z.string().min(1) }).strict()
+}).strict();
+const sandboxEventSchema = z.object({
+  schemaVersion: z.literal("treeseed.sandbox-event/v1"),
+  sandboxId: z.string().min(1),
+  assignmentId: z.string().min(1),
+  sequence: z.number().int().nonnegative(),
+  occurredAt: z.string().datetime(),
+  type: z.enum(["sandbox.created", "sandbox.ready", "execution.started", "execution.progress", "tool.requested", "tool.completed", "execution.completed", "execution.failed", "sandbox.destroyed"]),
+  payload: z.record(z.unknown()).default({})
+}).strict();
+const sandboxLeaseRenewalSchema = z.object({
+  schemaVersion: z.literal("treeseed.sandbox-lease-renewal/v1"),
+  sandboxId: z.string().min(1),
+  assignmentId: z.string().min(1),
+  providerId: z.string().min(1),
+  teamId: z.string().min(1),
+  leaseExpiresAt: z.string().datetime(),
+  issuedAt: z.string().datetime(),
+  signature: z.object({ keyId: identifier, algorithm: z.literal("Ed25519"), value: z.string().min(1) }).strict()
+}).strict();
+const sandboxResultSchema = z.object({
+  schemaVersion: z.literal("treeseed.sandbox-result/v1"),
+  sandboxId: z.string().min(1),
+  assignmentId: z.string().min(1),
+  status: z.enum(["completed", "failed", "cancelled", "expired"]),
+  summary: z.string(),
+  responseMarkdown: z.string().optional(),
+  artifacts: z.array(z.object({ id: identifier, path: z.string().startsWith("/run/treeseed-output/"), digest, mediaType: z.string().min(1), bytes: z.number().int().nonnegative() }).strict()),
+  usage: z.record(z.unknown()).default({}),
+  diagnostics: z.record(z.unknown()).default({}),
+  teardown: z.object({ verified: z.boolean(), completedAt: z.string().datetime().nullable() }).strict()
+}).strict();
+const providerEnvironmentReceiptSchema = z.object({
+  schemaVersion: z.literal("treeseed.provider-environment-receipt/v1"),
+  assignmentId: z.string().min(1),
+  offerId: identifier,
+  providerId: z.string().min(1),
+  imageDigest: digest,
+  baseLineage: z.object({ baseImageDigest: digest, provenanceDigest: digest, architectures: z.array(z.enum(["amd64", "arm64"])).min(1) }).strict(),
+  securityAttestationDigest: digest,
+  brokerVersion: z.string().min(1),
+  teardown: z.object({ verified: z.boolean(), completedAt: z.string().datetime().nullable() }).strict(),
+  createdAt: z.string().datetime(),
+  signature: z.object({ keyId: identifier, algorithm: z.literal("Ed25519"), value: z.string().min(1) }).strict()
+}).strict();
+export {
+  providerEnvironmentReceiptSchema,
+  sandboxAssignmentSchema,
+  sandboxEventSchema,
+  sandboxLeaseRenewalSchema,
+  sandboxResultSchema
+};

package/dist/capacity-provider/sandbox.d.ts

@@ -0,0 +1 @@
+export * from './sandbox-contracts.js';

package/dist/capacity-provider/sandbox.js

@@ -0,0 +1 @@
+export * from "./sandbox-contracts.js";

package/dist/capacity-provider/validation.d.ts

@@ -1,4 +1,4 @@
-import { type CapacityProviderManifestV2, type CapacityProviderProofPayload, type CapacityProviderPublicJwk, type ProviderSupplyOffer } from './contracts/index.js';
+import { type CapacityProviderManifestV5, type CapacityProviderProofPayload, type CapacityProviderPublicJwk, type ProviderSupplyOffer } from './contracts/index.js';
 export interface CapacityProviderContractDiagnostic {
     code: string;
     path: string;
@@ -19,7 +19,7 @@ export declare function validateCapacityProviderProofPayload(payload: CapacityPr
     expectedAudience?: string;
 }): CapacityProviderContractValidation;
 export declare function validateProviderSupplyOffer(offer: ProviderSupplyOffer, path?: string): CapacityProviderContractValidation;
-export declare function validateCapacityProviderManifestV2(manifest: CapacityProviderManifestV2): CapacityProviderContractValidation;
+export declare function validateCapacityProviderManifestV5(manifest: CapacityProviderManifestV5): CapacityProviderContractValidation;
 export declare function capacityProviderSecurityDefaults(): {
     proofTtlSeconds: number;
     accessTokenTtlSeconds: number;

package/dist/capacity-provider/validation.js

@@ -55,84 +55,92 @@ function validateProviderSupplyOffer(offer, path = "offer") {
   if (!Array.isArray(offer.capabilities) || offer.capabilities.some((entry) => !nonEmpty(entry))) add(diagnostics, "provider_offer_capabilities_invalid", `${path}.capabilities`, "Offer capabilities must be non-empty strings.");
   return result(diagnostics);
 }
-function validateCapacityProviderManifestV2(manifest) {
+function validateCapacityProviderManifestV5(manifest) {
   const diagnostics = [];
-  if (manifest?.schemaVersion !== 2) add(diagnostics, "provider_manifest_schema_invalid", "schemaVersion", "Capacity provider manifest schemaVersion must be 2.");
-  if (!["agent", "platform-operation"].includes(manifest?.providerClass)) add(diagnostics, "provider_manifest_class_invalid", "providerClass", "providerClass must be agent or platform-operation.");
+  if (manifest?.schemaVersion !== 5) add(diagnostics, "provider_manifest_schema_invalid", "schemaVersion", "Capacity provider manifest schemaVersion must be 5.");
+  if ("providerClass" in manifest) add(diagnostics, "provider_manifest_legacy_class_forbidden", "providerClass", "Provider classes are not part of the unified battery contract.");
   if (!["team", "external"].includes(manifest?.ownership?.type)) add(diagnostics, "provider_manifest_ownership_invalid", "ownership.type", "ownership.type must be team or external.");
   if (manifest?.ownership?.type === "team" && !nonEmpty(manifest.ownership.teamId)) add(diagnostics, "provider_manifest_owner_team_required", "ownership.teamId", "Team-owned providers require ownership.teamId.");
   if (!nonEmpty(manifest?.configuration?.generation)) add(diagnostics, "provider_manifest_generation_required", "configuration.generation", "An immutable desired configuration generation is required.");
   if (!nonEmpty(manifest?.identity?.privateKeyRef) || !manifest.identity.privateKeyRef.includes("://")) add(diagnostics, "provider_manifest_identity_ref_invalid", "identity.privateKeyRef", "Provider identity must use an encrypted secret reference.");
   if (!nonEmpty(manifest?.identity?.displayName)) add(diagnostics, "provider_manifest_identity_name_required", "identity.displayName", "Provider identity displayName is required.");
-  if (!Number.isInteger(manifest?.supplyCeilings?.maxConcurrentAssignments) || manifest.supplyCeilings.maxConcurrentAssignments < 1) add(diagnostics, "provider_manifest_concurrency_invalid", "supplyCeilings.maxConcurrentAssignments", "Provider concurrency must be a positive integer.");
+  if (!Number.isInteger(manifest?.capacity?.maxConcurrentWorkers) || manifest.capacity.maxConcurrentWorkers < 1) add(diagnostics, "provider_manifest_concurrency_invalid", "capacity.maxConcurrentWorkers", "Provider worker concurrency must be a positive integer.");
+  for (const field of ["cpuCores", "memoryBytes"]) {
+    const value = manifest?.capacity?.[field];
+    if (value !== void 0 && (!Number.isFinite(value) || value <= 0)) add(diagnostics, "provider_manifest_resource_capacity_invalid", `capacity.${field}`, `${field} must be greater than zero when configured.`);
+  }
+  for (const [index, accelerator] of (manifest?.capacity?.accelerators ?? []).entries()) {
+    if (!nonEmpty(accelerator.kind)) add(diagnostics, "provider_manifest_accelerator_kind_required", `capacity.accelerators[${index}].kind`, "Accelerator kind is required.");
+    if (!Number.isInteger(accelerator.count) || accelerator.count < 1) add(diagnostics, "provider_manifest_accelerator_count_invalid", `capacity.accelerators[${index}].count`, "Accelerator count must be a positive integer.");
+  }
   for (const field of ["maxActiveSeconds", "maxInputTokens", "maxOutputTokens", "maxCost", "maxAttempts"]) {
-    const value = manifest?.supplyCeilings?.[field];
-    if (value !== void 0 && (!Number.isFinite(value) || value <= 0)) add(diagnostics, "provider_manifest_supply_ceiling_invalid", `supplyCeilings.${field}`, `${field} must be greater than zero when configured.`);
+    const value = manifest?.capacity?.[field];
+    if (value !== void 0 && (!Number.isFinite(value) || value <= 0)) add(diagnostics, "provider_manifest_supply_ceiling_invalid", `capacity.${field}`, `${field} must be greater than zero when configured.`);
   }
-  if (manifest?.supplyCeilings?.maxCost !== void 0 && !nonEmpty(manifest.supplyCeilings.currency)) add(diagnostics, "provider_manifest_supply_currency_required", "supplyCeilings.currency", "A currency is required when maxCost is configured.");
+  if (manifest?.capacity?.maxCost !== void 0 && !nonEmpty(manifest.capacity.currency)) add(diagnostics, "provider_manifest_supply_currency_required", "capacity.currency", "A currency is required when maxCost is configured.");
   const bindingIds = /* @__PURE__ */ new Set();
-  for (const [index, binding] of (manifest?.credentialBindings ?? []).entries()) {
-    const path = `credentialBindings[${index}]`;
+  for (const [index, binding] of (manifest?.credentialProfiles ?? []).entries()) {
+    const path = `credentialProfiles[${index}]`;
     if (!nonEmpty(binding.id) || bindingIds.has(binding.id)) add(diagnostics, "provider_manifest_credential_binding_id_invalid", `${path}.id`, "Credential binding IDs must be non-empty and unique.");
     bindingIds.add(binding.id);
-    if (!["service-vault", "process-environment"].includes(binding.source)) add(diagnostics, "provider_manifest_credential_binding_source_invalid", `${path}.source`, "Credential bindings must use service-vault or process-environment.");
+    if (binding.source !== "service-vault") add(diagnostics, "provider_manifest_credential_binding_source_invalid", `${path}.source`, "Credential bindings must use the service vault.");
     if (!nonEmpty(binding.reference)) add(diagnostics, "provider_manifest_credential_binding_reference_required", `${path}.reference`, "Credential binding reference is required.");
-    if (binding.source === "process-environment" && !/^TREESEED_[A-Z0-9_]+$/u.test(binding.reference)) add(diagnostics, "provider_manifest_credential_environment_invalid", `${path}.reference`, "Process-environment bindings must name a TREESEED_* variable.");
   }
-  if (!Array.isArray(manifest?.executionProviders) || manifest.executionProviders.length === 0) add(diagnostics, "provider_manifest_execution_providers_required", "executionProviders", "At least one execution provider is required.");
-  const executionProviderIds = /* @__PURE__ */ new Set();
+  if (!Array.isArray(manifest?.lanes) || manifest.lanes.length === 0) add(diagnostics, "provider_manifest_lanes_required", "lanes", "At least one provider lane is required.");
   const laneIds = /* @__PURE__ */ new Set();
-  for (const [index, executionProvider] of (manifest?.executionProviders ?? []).entries()) {
-    const path = `executionProviders[${index}]`;
-    if (!nonEmpty(executionProvider.id) || executionProviderIds.has(executionProvider.id)) add(diagnostics, "provider_execution_provider_id_invalid", `${path}.id`, "Execution provider id must be non-empty and unique.");
-    executionProviderIds.add(executionProvider.id);
-    if (!nonEmpty(executionProvider.adapter)) add(diagnostics, "provider_execution_provider_adapter_required", `${path}.adapter`, "Execution provider adapter is required.");
-    for (const entry of validateExecutionProviderRuntimeConfiguration(executionProvider, path).diagnostics) add(diagnostics, entry.code, entry.path, entry.message);
-    for (const bindingId of executionProvider.credentialBindings ?? []) if (!bindingIds.has(bindingId)) add(diagnostics, "provider_execution_provider_credential_unknown", `${path}.credentialBindings`, `Execution provider references unknown credential binding ${bindingId}.`);
-    if (!executionProvider.nativeLimits || typeof executionProvider.nativeLimits !== "object" || Array.isArray(executionProvider.nativeLimits)) add(diagnostics, "provider_execution_provider_limits_invalid", `${path}.nativeLimits`, "Execution provider nativeLimits must be an object.");
-    const minimumDuration = executionProvider.minimumAssignmentDuration;
+  let reservedWorkers = 0;
+  const purposes = /* @__PURE__ */ new Set();
+  for (const [laneIndex, lane] of (manifest?.lanes ?? []).entries()) {
+    const lanePath = `lanes[${laneIndex}]`;
+    if (!nonEmpty(lane.id) || laneIds.has(lane.id)) add(diagnostics, "provider_lane_id_invalid", `${lanePath}.id`, "Provider lane id must be non-empty and provider-global unique.");
+    laneIds.add(lane.id);
+    purposes.add(lane.purpose);
+    if (!["communication", "platform", "workday"].includes(lane.purpose)) add(diagnostics, "provider_lane_purpose_invalid", `${lanePath}.purpose`, "Provider lane purpose must be communication, platform, or workday.");
+    if (!Number.isInteger(lane.priority) || lane.priority < 1) add(diagnostics, "provider_lane_priority_invalid", `${lanePath}.priority`, "Provider lane priority must be a positive integer.");
+    if (!Number.isInteger(lane.reservedConcurrentWorkers) || lane.reservedConcurrentWorkers < 0) add(diagnostics, "provider_lane_reservation_invalid", `${lanePath}.reservedConcurrentWorkers`, "Reserved workers must be a non-negative integer.");
+    if (!Number.isInteger(lane.maxConcurrentWorkers) || lane.maxConcurrentWorkers < 1 || lane.maxConcurrentWorkers > manifest.capacity.maxConcurrentWorkers) add(diagnostics, "provider_lane_concurrency_invalid", `${lanePath}.maxConcurrentWorkers`, "Lane concurrency must be positive and no greater than provider capacity.");
+    if (lane.reservedConcurrentWorkers > lane.maxConcurrentWorkers) add(diagnostics, "provider_lane_reservation_exceeds_maximum", `${lanePath}.reservedConcurrentWorkers`, "Lane reservation may not exceed its maximum.");
+    reservedWorkers += Number.isInteger(lane.reservedConcurrentWorkers) ? lane.reservedConcurrentWorkers : 0;
+    if (lane.reclaimPolicy !== "admission") add(diagnostics, "provider_lane_reclaim_policy_invalid", `${lanePath}.reclaimPolicy`, "Borrowed capacity is reclaimed through admission control, never worker termination.");
+    if (!Number.isInteger(lane.queueLimit) || lane.queueLimit < 0) add(diagnostics, "provider_lane_queue_limit_invalid", `${lanePath}.queueLimit`, "Lane queueLimit must be a non-negative integer.");
+    if (!Number.isInteger(lane.timeoutSeconds) || lane.timeoutSeconds < 1) add(diagnostics, "provider_lane_timeout_invalid", `${lanePath}.timeoutSeconds`, "Lane timeoutSeconds must be a positive integer.");
+    if (lane.capabilities && lane.capabilities.some((entry) => !nonEmpty(entry))) add(diagnostics, "provider_lane_capabilities_invalid", `${lanePath}.capabilities`, "Provider lane capabilities must be non-empty strings.");
+    const minimumDuration = lane.minimumAssignmentDuration;
     if (minimumDuration !== void 0) {
-      if (!Number.isInteger(minimumDuration.amount) || minimumDuration.amount < 1) add(diagnostics, "provider_execution_provider_minimum_duration_invalid", `${path}.minimumAssignmentDuration.amount`, "Minimum assignment duration amount must be a positive integer.");
-      if (!["seconds", "business-days"].includes(minimumDuration.unit)) add(diagnostics, "provider_execution_provider_minimum_duration_unit_invalid", `${path}.minimumAssignmentDuration.unit`, "Minimum assignment duration unit must be seconds or business-days.");
+      if (!Number.isInteger(minimumDuration.amount) || minimumDuration.amount < 1) add(diagnostics, "provider_lane_minimum_duration_invalid", `${lanePath}.minimumAssignmentDuration.amount`, "Minimum assignment duration amount must be a positive integer.");
+      if (!["seconds", "business-days"].includes(minimumDuration.unit)) add(diagnostics, "provider_lane_minimum_duration_unit_invalid", `${lanePath}.minimumAssignmentDuration.unit`, "Minimum assignment duration unit must be seconds or business-days.");
       if (minimumDuration.unit === "business-days") {
         try {
           new Intl.DateTimeFormat("en", { timeZone: minimumDuration.calendar?.timeZone }).format();
         } catch {
-          add(diagnostics, "provider_execution_provider_minimum_duration_timezone_invalid", `${path}.minimumAssignmentDuration.calendar.timeZone`, "Business-day duration requires a valid IANA time zone.");
+          add(diagnostics, "provider_lane_minimum_duration_timezone_invalid", `${lanePath}.minimumAssignmentDuration.calendar.timeZone`, "Business-day duration requires a valid IANA time zone.");
         }
         const weekdays = minimumDuration.calendar?.weekdays ?? [1, 2, 3, 4, 5];
-        if (!Array.isArray(weekdays) || weekdays.length === 0 || weekdays.some((day) => !Number.isInteger(day) || day < 1 || day > 7) || new Set(weekdays).size !== weekdays.length) add(diagnostics, "provider_execution_provider_minimum_duration_weekdays_invalid", `${path}.minimumAssignmentDuration.calendar.weekdays`, "Business weekdays must be unique ISO weekday numbers from 1 through 7.");
-        if ((minimumDuration.calendar?.holidayDates ?? []).some((date) => !/^\d{4}-\d{2}-\d{2}$/u.test(date))) add(diagnostics, "provider_execution_provider_minimum_duration_holidays_invalid", `${path}.minimumAssignmentDuration.calendar.holidayDates`, "Business-day holidays must use YYYY-MM-DD dates.");
-      }
-    }
-    if (executionProvider.researchSourcePolicy !== void 0) {
-      for (const diagnostic of validateResearchSourcePolicy(executionProvider.researchSourcePolicy).diagnostics) {
-        add(diagnostics, diagnostic.code, `${path}.researchSourcePolicy.${diagnostic.path}`, diagnostic.message);
-      }
-    }
-    for (const [laneIndex, lane] of (executionProvider.lanes ?? []).entries()) {
-      const lanePath = `${path}.lanes[${laneIndex}]`;
-      if (!nonEmpty(lane.id) || laneIds.has(lane.id)) add(diagnostics, "provider_lane_id_invalid", `${lanePath}.id`, "Provider lane id must be non-empty and provider-global unique.");
-      laneIds.add(lane.id);
-      if (!["communication", "operation"].includes(lane.purpose)) add(diagnostics, "provider_lane_purpose_invalid", `${lanePath}.purpose`, "Provider lane purpose must be communication or operation.");
-      if (!Number.isInteger(lane.maxConcurrentRunners) || lane.maxConcurrentRunners < 1) add(diagnostics, "provider_lane_concurrency_invalid", `${lanePath}.maxConcurrentRunners`, "Provider lane concurrency must be a positive integer.");
-      const laneMinimum = lane.minimumAssignmentDuration;
-      if (laneMinimum !== void 0) {
-        if (!Number.isInteger(laneMinimum.amount) || laneMinimum.amount < 1) add(diagnostics, "provider_lane_minimum_duration_invalid", `${lanePath}.minimumAssignmentDuration.amount`, "Lane minimum assignment duration amount must be a positive integer.");
-        if (!["seconds", "business-days"].includes(laneMinimum.unit)) add(diagnostics, "provider_lane_minimum_duration_unit_invalid", `${lanePath}.minimumAssignmentDuration.unit`, "Lane minimum assignment duration unit must be seconds or business-days.");
-        if (laneMinimum.unit === "business-days") {
-          try {
-            new Intl.DateTimeFormat("en", { timeZone: laneMinimum.calendar?.timeZone }).format();
-          } catch {
-            add(diagnostics, "provider_lane_minimum_duration_timezone_invalid", `${lanePath}.minimumAssignmentDuration.calendar.timeZone`, "Business-day lane duration requires a valid IANA time zone.");
-          }
-        }
+        if (!Array.isArray(weekdays) || weekdays.length === 0 || weekdays.some((day) => !Number.isInteger(day) || day < 1 || day > 7) || new Set(weekdays).size !== weekdays.length) add(diagnostics, "provider_lane_minimum_duration_weekdays_invalid", `${lanePath}.minimumAssignmentDuration.calendar.weekdays`, "Business weekdays must be unique ISO weekday numbers from 1 through 7.");
+        if ((minimumDuration.calendar?.holidayDates ?? []).some((date) => !/^\d{4}-\d{2}-\d{2}$/u.test(date))) add(diagnostics, "provider_lane_minimum_duration_holidays_invalid", `${lanePath}.minimumAssignmentDuration.calendar.holidayDates`, "Business-day holidays must use YYYY-MM-DD dates.");
       }
-      if (lane.capabilities && lane.capabilities.some((entry) => !nonEmpty(entry))) add(diagnostics, "provider_lane_capabilities_invalid", `${lanePath}.capabilities`, "Provider lane capabilities must be non-empty strings.");
     }
   }
-  if (manifest?.defaultExecutionProviderId !== void 0 && !executionProviderIds.has(manifest.defaultExecutionProviderId)) {
-    add(diagnostics, "provider_default_execution_provider_unknown", "defaultExecutionProviderId", "The default execution provider must reference a configured execution provider id.");
+  if (reservedWorkers > manifest?.capacity?.maxConcurrentWorkers) add(diagnostics, "provider_lane_reservations_exceed_capacity", "lanes", "Total reserved workers may not exceed provider capacity.");
+  for (const purpose of ["communication", "platform", "workday"]) if (!purposes.has(purpose)) add(diagnostics, "provider_lane_purpose_required", "lanes", `Unified providers require a ${purpose} lane.`);
+  const communication = (manifest?.lanes ?? []).find((lane) => lane.purpose === "communication");
+  if (communication && communication.reservedConcurrentWorkers < 1) add(diagnostics, "provider_communication_reservation_required", "lanes", "Communication requires at least one reserved worker.");
+  if (communication && (manifest?.lanes ?? []).some((lane) => lane.purpose !== "communication" && lane.priority >= communication.priority)) add(diagnostics, "provider_communication_priority_invalid", "lanes", "Communication must have the highest lane priority.");
+  if (!Array.isArray(manifest?.adapters) || manifest.adapters.length === 0) add(diagnostics, "provider_manifest_adapters_required", "adapters", "At least one execution adapter is required.");
+  const adapterIds = /* @__PURE__ */ new Set();
+  for (const [index, adapter] of (manifest?.adapters ?? []).entries()) {
+    const path = `adapters[${index}]`;
+    if (!nonEmpty(adapter.id) || adapterIds.has(adapter.id)) add(diagnostics, "provider_adapter_id_invalid", `${path}.id`, "Adapter id must be non-empty and unique.");
+    adapterIds.add(adapter.id);
+    if (!nonEmpty(adapter.adapter)) add(diagnostics, "provider_adapter_required", `${path}.adapter`, "Adapter implementation is required.");
+    if (adapter.isolation !== "microvm") add(diagnostics, "provider_adapter_isolation_invalid", `${path}.isolation`, "Adapters must use microVM isolation.");
+    if (!Number.isInteger(adapter.maxConcurrentWorkers) || adapter.maxConcurrentWorkers < 1 || adapter.maxConcurrentWorkers > manifest.capacity.maxConcurrentWorkers) add(diagnostics, "provider_adapter_concurrency_invalid", `${path}.maxConcurrentWorkers`, "Adapter concurrency must be positive and no greater than provider capacity.");
+    if (!Array.isArray(adapter.laneIds) || adapter.laneIds.length === 0) add(diagnostics, "provider_adapter_lanes_required", `${path}.laneIds`, "Every adapter must serve at least one lane.");
+    for (const laneId of adapter.laneIds ?? []) if (!laneIds.has(laneId)) add(diagnostics, "provider_adapter_lane_unknown", `${path}.laneIds`, `Adapter references unknown lane ${laneId}.`);
+    for (const bindingId of adapter.credentialProfiles ?? []) if (!bindingIds.has(bindingId)) add(diagnostics, "provider_adapter_credential_unknown", `${path}.credentialProfiles`, `Adapter references unknown credential profile ${bindingId}.`);
+    if (!adapter.nativeLimits || typeof adapter.nativeLimits !== "object" || Array.isArray(adapter.nativeLimits)) add(diagnostics, "provider_adapter_limits_invalid", `${path}.nativeLimits`, "Adapter nativeLimits must be an object.");
+    for (const entry of validateExecutionProviderRuntimeConfiguration(adapter, path).diagnostics) add(diagnostics, entry.code, entry.path, entry.message);
+    if (adapter.researchSourcePolicy !== void 0) for (const diagnostic of validateResearchSourcePolicy(adapter.researchSourcePolicy).diagnostics) add(diagnostics, diagnostic.code, `${path}.researchSourcePolicy.${diagnostic.path}`, diagnostic.message);
   }
   if (!Array.isArray(manifest?.connections)) add(diagnostics, "provider_manifest_connections_required", "connections", "connections must be an array.");
   const ids = /* @__PURE__ */ new Set();
@@ -163,6 +171,34 @@ function validateCapacityProviderManifestV2(manifest) {
   }
   if (providerIds.size > 1) add(diagnostics, "provider_connection_identity_mismatch", "connections", "Every connection in one provider manifest must reference the same global provider identity.");
   if (explicitShare > 100) add(diagnostics, "provider_connection_share_exceeded", "connections", "Explicit connection shares may not exceed 100 percent.");
+  if (manifest.sandbox?.required !== true || manifest.sandbox?.runtime !== "kata-runtime-rs-qemu") add(diagnostics, "provider_sandbox_required", "sandbox", "Capacity providers require the Kata runtime-rs QEMU sandbox.");
+  if (!manifest.sandbox?.brokerSocket?.startsWith("/run/treeseed/")) add(diagnostics, "provider_sandbox_socket_invalid", "sandbox.brokerSocket", "Sandbox broker socket must remain under /run/treeseed.");
+  const profiles = new Set((manifest.sandbox?.profiles ?? []).map((profile) => profile.id));
+  for (const [index, profile] of (manifest.sandbox?.profiles ?? []).entries()) {
+    if (!/^[a-z][a-z0-9._-]{0,127}$/u.test(profile.id)) add(diagnostics, "provider_sandbox_profile_invalid", `sandbox.profiles[${index}].id`, "Sandbox profile id must be a provider-local identifier.");
+    if (profile.contract) {
+      if (!/^[a-z][a-z0-9._-]{0,127}$/u.test(profile.contract.id) || !/^\d+\.\d+\.\d+$/u.test(profile.contract.version) || !/^sha256:[a-f0-9]{64}$/u.test(profile.contract.digest)) add(diagnostics, "provider_sandbox_contract_invalid", `sandbox.profiles[${index}].contract`, "Portable sandbox contracts require an id, exact semantic version, and immutable digest.");
+      if (!Array.isArray(profile.contract.capabilities) || profile.contract.capabilities.some((capability) => !/^[a-z][a-z0-9._-]{0,127}$/u.test(capability))) add(diagnostics, "provider_sandbox_contract_capabilities_invalid", `sandbox.profiles[${index}].contract.capabilities`, "Sandbox contract capabilities must be portable identifiers.");
+    }
+    if (!/^sha256:[a-f0-9]{64}$/u.test(profile.guestImageDigest)) add(diagnostics, "provider_sandbox_image_digest_invalid", `sandbox.profiles[${index}].guestImageDigest`, "Guest images require an immutable SHA-256 digest.");
+    if (profile.defaultDenyNetwork !== true) add(diagnostics, "provider_sandbox_network_policy_invalid", `sandbox.profiles[${index}].defaultDenyNetwork`, "Sandbox networking must default deny.");
+  }
+  if (!Number.isInteger(manifest.ontology?.generation) || manifest.ontology.generation < 1 || !/^sha256:[a-f0-9]{64}$/u.test(manifest.ontology?.digest ?? "")) add(diagnostics, "provider_ontology_binding_invalid", "ontology", "Manifest v5 requires an exact ontology generation and digest.");
+  const offerIds = /* @__PURE__ */ new Set();
+  for (const [profileIndex, profile] of manifest.sandbox.profiles.entries()) {
+    if (!profile.lineage || !/^sha256:[a-f0-9]{64}$/u.test(profile.lineage.baseImageDigest) || !/^sha256:[a-f0-9]{64}$/u.test(profile.lineage.provenanceDigest) || !profile.lineage.architectures.length || !profile.lineage.signature.value) add(diagnostics, "provider_sandbox_lineage_required", `sandbox.profiles[${profileIndex}].lineage`, "Manifest v5 sandbox images require signed exact sandbox-base lineage and architectures.");
+  }
+  for (const [adapterIndex, adapter] of manifest.adapters.entries()) {
+    if (!adapter.offers.length) add(diagnostics, "provider_adapter_offers_required", `adapters[${adapterIndex}].offers`, "Every v5 adapter must expose at least one standardized capability offer.");
+    for (const [offerIndex, binding] of adapter.offers.entries()) {
+      const path = `adapters[${adapterIndex}].offers[${offerIndex}]`;
+      if (offerIds.has(binding.offer.offerId)) add(diagnostics, "provider_offer_id_duplicate", `${path}.offer.offerId`, "Offer ids must be provider-global unique.");
+      offerIds.add(binding.offer.offerId);
+      if (!profiles.has(binding.sandboxProfileId)) add(diagnostics, "provider_offer_sandbox_unknown", `${path}.sandboxProfileId`, "Offer references an unknown provider-local sandbox profile.");
+      if (binding.offer.capabilities.some((reference) => !reference.id.startsWith("treeseed.") && !reference.id.startsWith("provider."))) add(diagnostics, "provider_offer_capability_namespace_invalid", `${path}.offer.capabilities`, "Offers require standardized TreeSeed or provider capability references.");
+      if (binding.offer.conformance.some((entry) => entry.status !== "passed")) add(diagnostics, "provider_offer_conformance_failed", `${path}.offer.conformance`, "Only passing capability conformance may be advertised.");
+    }
+  }
   return result(diagnostics);
 }
 function capacityProviderSecurityDefaults() {
@@ -177,7 +213,7 @@ export {
   capacityProviderSecurityDefaults,
   nonEmpty,
   result,
-  validateCapacityProviderManifestV2,
+  validateCapacityProviderManifestV5,
   validateCapacityProviderProofPayload,
   validateCapacityProviderPublicJwk,
   validateProviderSupplyOffer

package/dist/configuration/secrets-capability.d.ts

@@ -2,4 +2,3 @@ export * from '../secrets-capability/service-provider-contracts.js';
 export * from '../secrets-capability/provider-operation-contracts.js';
 export * from '../secrets-capability/workflow-operation-contracts.js';
 export * from '../secrets-capability/service-vault-contracts.js';
-export * from '../secrets-capability/service-vault-crypto.js';

package/dist/configuration/secrets-capability.js

@@ -2,4 +2,3 @@ export * from "../secrets-capability/service-provider-contracts.js";
 export * from "../secrets-capability/provider-operation-contracts.js";
 export * from "../secrets-capability/workflow-operation-contracts.js";
 export * from "../secrets-capability/service-vault-contracts.js";
-export * from "../secrets-capability/service-vault-crypto.js";

package/dist/content/contracts.d.ts

@@ -0,0 +1,12 @@
+export type ContentAction = 'describe' | 'query' | 'read' | 'create' | 'update' | 'link' | 'validate' | 'commit';
+export type ContentModel = 'page' | 'note' | 'question' | 'proposal' | 'decision' | 'book' | 'knowledge' | 'objective' | 'person' | 'agent' | 'discussion' | 'discussion_message' | 'discussion_event' | 'group' | 'group_edge' | 'agent_context_query' | 'agent_context_query_set' | 'agent_instruction_template' | 'discussion_topic' | 'assignment_plan' | 'assignment_status' | 'assignment_summary' | 'agent_evaluation';
+export interface ContentReference {
+    model: ContentModel;
+    collection: string;
+    slug: string;
+    id?: string;
+    path?: string;
+    href?: string;
+    subjectId?: string;
+    subjectField?: string;
+}