@treeseed/sdk 0.13.0-rc.8 → 0.13.0-rc.81

package/dist/development/schemas.js

@@ -0,0 +1,199 @@
+import { z } from "zod";
+const identifier = z.string().regex(/^[a-z][a-z0-9.-]{1,63}$/u);
+const digest = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+const gitCommit = z.string().regex(/^[a-f0-9]{40}$/u);
+const relativePath = z.string().min(1).max(512).refine((value) => {
+  if (value.startsWith("/") || value.includes("\\") || value.includes("\0")) return false;
+  return !value.split("/").some((part) => part === ".." || part === "");
+}, "Paths must be safe, normalized, repository-relative paths.");
+const environmentName = z.string().regex(/^[A-Z][A-Z0-9_]{0,127}$/u);
+const localAlias = z.string().regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*\.localhost$/u);
+const developmentModeSchema = z.enum(["released", "candidate", "live"]);
+const developmentTargetKindSchema = z.enum(["package-watch", "live-web", "live-api", "rebuild-restart", "local-companion"]);
+const developmentReactionSchema = z.enum(["reload", "restart", "rebuild", "stale", "manual", "none"]);
+const developmentStatePolicySchema = z.enum(["stateless", "ephemeral", "clone", "shared-compatible"]);
+const operationSchema = z.object({
+  command: z.string().min(1).max(256),
+  args: z.array(z.string().max(4096)).max(64).default([]),
+  cwd: relativePath.optional(),
+  environment: z.record(environmentName, z.string().max(16384)).default({}),
+  timeoutSeconds: z.number().int().positive().max(86400).default(600)
+}).strict();
+const readinessSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("marker"), path: relativePath, timeoutSeconds: z.number().int().positive().max(3600) }).strict(),
+  z.object({ kind: z.literal("http"), path: z.string().startsWith("/"), expectedStatus: z.number().int().min(100).max(599).default(200), timeoutSeconds: z.number().int().positive().max(3600) }).strict(),
+  z.object({ kind: z.literal("tcp"), timeoutSeconds: z.number().int().positive().max(3600) }).strict(),
+  z.object({ kind: z.literal("process"), graceSeconds: z.number().int().nonnegative().max(600).default(2) }).strict()
+]);
+const endpointSchema = z.object({
+  id: identifier,
+  protocol: z.enum(["http", "https", "tcp"]),
+  port: z.number().int().min(1).max(65535),
+  canonicalAlias: localAlias.optional(),
+  visibility: z.enum(["host", "loopback", "private"]),
+  authentication: z.enum(["none", "application", "mtls"]).default("none")
+}).strict().superRefine((endpoint, context) => {
+  if (endpoint.visibility === "host" && !endpoint.canonicalAlias) context.addIssue({ code: z.ZodIssueCode.custom, path: ["canonicalAlias"], message: "Host-visible endpoints require a canonical .localhost alias." });
+  if (endpoint.visibility !== "host" && endpoint.canonicalAlias) context.addIssue({ code: z.ZodIssueCode.custom, path: ["canonicalAlias"], message: "Only host-visible endpoints may request a canonical alias." });
+});
+const outputSchema = z.object({
+  path: relativePath,
+  mediaType: z.string().min(1).max(256),
+  completionMarker: relativePath.optional(),
+  digestAlgorithm: z.literal("sha256").default("sha256")
+}).strict();
+const dependencySchema = z.object({
+  id: identifier,
+  target: identifier,
+  capability: identifier.optional(),
+  locality: z.enum(["local", "remote", "either"]).default("either"),
+  reaction: developmentReactionSchema
+}).strict();
+const freezeSchema = z.object({
+  kind: z.enum(["npm-package", "oci-image", "archive", "executable"]),
+  operation: operationSchema,
+  artifacts: z.array(relativePath).min(1),
+  contractOperations: z.array(operationSchema).default([])
+}).strict();
+const developmentTargetSchema = z.object({
+  id: identifier,
+  kind: developmentTargetKindSchema,
+  platforms: z.array(z.enum(["linux-amd64", "linux-arm64", "darwin-arm64", "darwin-amd64"])).min(1),
+  runtimeRequirements: z.array(z.string().min(1).max(128)).default([]),
+  sourceRoots: z.array(relativePath).min(1),
+  ignoredPaths: z.array(relativePath).default([]),
+  operations: z.object({
+    setup: operationSchema.optional(),
+    watch: operationSchema.optional(),
+    build: operationSchema.optional(),
+    start: operationSchema.optional(),
+    stop: operationSchema.optional(),
+    verify: operationSchema.optional(),
+    cleanup: operationSchema.optional()
+  }).strict(),
+  ready: readinessSchema,
+  outputs: z.array(outputSchema).default([]),
+  endpoints: z.array(endpointSchema).default([]),
+  dependencies: z.array(dependencySchema).default([]),
+  statePolicy: developmentStatePolicySchema,
+  migrationPolicy: z.enum(["none", "explicit-review", "disposable-only"]),
+  secretRefs: z.record(environmentName, identifier).default({}),
+  shutdown: z.object({ drainOperation: operationSchema.optional(), graceSeconds: z.number().int().nonnegative().max(3600).default(30), activeWorkPolicy: z.enum(["block", "drain", "cancel-authorized"]).default("block") }).strict(),
+  resources: z.object({ cpuCores: z.number().positive().optional(), memoryBytes: z.number().int().positive().optional(), diskBytes: z.number().int().positive().optional() }).strict().default({}),
+  logs: z.array(relativePath).default([]),
+  forbiddenOperations: z.array(z.string().min(1).max(128)).default([]),
+  freeze: freezeSchema.optional(),
+  promotion: z.object({ liveAdmissible: z.literal(false), candidateRequiresVerification: z.literal(true) }).strict()
+}).strict().superRefine((target, context) => {
+  const endpoints = target.endpoints.map((entry) => entry.id);
+  if (new Set(endpoints).size !== endpoints.length) context.addIssue({ code: z.ZodIssueCode.custom, path: ["endpoints"], message: "Development endpoint IDs must be unique." });
+  if (target.kind === "package-watch" && target.endpoints.length) context.addIssue({ code: z.ZodIssueCode.custom, path: ["endpoints"], message: "Package-watch targets cannot own service endpoints." });
+  if (target.kind === "local-companion" && target.endpoints.some((entry) => entry.visibility !== "loopback")) context.addIssue({ code: z.ZodIssueCode.custom, path: ["endpoints"], message: "Local companions must remain loopback-only." });
+  if (target.kind !== "package-watch" && target.ready.kind === "marker") context.addIssue({ code: z.ZodIssueCode.custom, path: ["ready"], message: "Service targets require process, TCP, or HTTP readiness." });
+  if (target.statePolicy === "shared-compatible" && target.migrationPolicy !== "explicit-review") context.addIssue({ code: z.ZodIssueCode.custom, path: ["migrationPolicy"], message: "Shared state requires explicit migration review." });
+});
+const developmentRuntimeSchema = z.object({
+  schemaVersion: z.literal("treeseed.development-runtime/v1"),
+  project: z.object({ id: identifier, repository: z.string().regex(/^[a-z0-9_.-]+\/[a-z0-9_.-]+$/iu) }).strict(),
+  defaults: z.object({ leaseSeconds: z.number().int().min(60).max(86400).default(14400), restoreOnFailure: z.boolean().default(true) }).strict(),
+  targets: z.array(developmentTargetSchema).min(1)
+}).strict().superRefine((runtime, context) => {
+  const ids = runtime.targets.map((target) => target.id);
+  if (new Set(ids).size !== ids.length) context.addIssue({ code: z.ZodIssueCode.custom, path: ["targets"], message: "Development target IDs must be unique." });
+});
+const repositoryClosureSchema = z.object({
+  projectId: identifier,
+  repository: z.string().min(1),
+  worktree: z.string().min(1),
+  commit: gitCommit,
+  branch: z.string().min(1).nullable(),
+  dirty: z.boolean(),
+  dirtyDigest: digest.nullable(),
+  recipeDigest: digest
+}).strict();
+const developmentSessionSchema = z.object({
+  schemaVersion: z.literal("treeseed.development-session/v1"),
+  sessionId: identifier,
+  actor: z.string().min(1).max(256),
+  hostId: identifier,
+  createdAt: z.string().datetime(),
+  expiresAt: z.string().datetime(),
+  status: z.enum(["planning", "active", "degraded", "restoring", "stopped", "expired"]),
+  repositories: z.array(repositoryClosureSchema),
+  targets: z.array(z.object({ projectId: identifier, targetId: identifier, mode: developmentModeSchema, generation: z.number().int().nonnegative(), health: z.enum(["pending", "ready", "degraded", "stopped"]), reaction: developmentReactionSchema.optional() }).strict()),
+  leases: z.array(z.object({ kind: z.enum(["alias", "component", "state", "secret"]), resource: z.string().min(1), acquiredAt: z.string().datetime(), expiresAt: z.string().datetime() }).strict()),
+  restoredReceiptId: identifier.nullable(),
+  blockers: z.array(z.object({ code: identifier, message: z.string().min(1), targetId: identifier.optional() }).strict())
+}).strict();
+const developmentCandidateSchema = z.object({
+  schemaVersion: z.literal("treeseed.development-candidate/v1"),
+  candidateId: identifier,
+  sessionId: identifier,
+  createdAt: z.string().datetime(),
+  source: z.array(repositoryClosureSchema),
+  artifacts: z.array(z.object({ projectId: identifier, targetId: identifier, kind: z.enum(["npm-package", "oci-image", "archive", "executable", "contract-bundle"]), identity: z.string().min(1), digest, integrity: z.string().min(1).optional() }).strict()).min(1),
+  configurationDigest: digest,
+  dependencyGenerations: z.record(z.number().int().nonnegative()),
+  compatibilityAttestations: z.array(z.object({ contractId: z.string().min(1), digest, compatible: z.boolean(), minimumBump: z.enum(["none", "patch", "minor", "major"]) }).strict()),
+  verification: z.object({ status: z.enum(["pending", "passed", "failed"]), operations: z.array(z.string().min(1)), completedAt: z.string().datetime().nullable() }).strict(),
+  promotable: z.boolean()
+}).strict().superRefine((candidate, context) => {
+  if (candidate.source.some((source) => source.dirty) && candidate.promotable) context.addIssue({ code: z.ZodIssueCode.custom, path: ["promotable"], message: "Candidates containing dirty source cannot be promotable." });
+  if (candidate.verification.status !== "passed" && candidate.promotable) context.addIssue({ code: z.ZodIssueCode.custom, path: ["promotable"], message: "Only verified candidates can be promotable." });
+  if (candidate.promotable && candidate.source.some((source) => !Object.keys(candidate.dependencyGenerations).some((key) => key === source.projectId || key.startsWith(`${source.projectId}.`)))) {
+    context.addIssue({ code: z.ZodIssueCode.custom, path: ["dependencyGenerations"], message: "Promotable candidates must bind a completed generation for every source project." });
+  }
+});
+const releaseArtifactSchema = z.object({
+  id: identifier,
+  kind: z.enum(["npm-package", "oci-image", "archive", "executable", "sbom", "contract-bundle", "compatibility-attestation", "component-manifest", "compose", "provenance"]),
+  identity: z.string().min(1).max(2048),
+  digest,
+  mediaType: z.string().min(1).max(256),
+  size: z.number().int().nonnegative().optional()
+}).strict();
+const releaseEvidenceSchema = z.object({
+  schemaVersion: z.literal("treeseed.release-evidence/v1"),
+  candidate: z.object({
+    id: identifier,
+    receiptDigest: digest,
+    sourceCommit: gitCommit,
+    stagingRef: z.string().min(1).max(256),
+    workflowRunId: z.string().regex(/^[1-9][0-9]*$/u),
+    createdAt: z.string().datetime()
+  }).strict(),
+  packages: z.array(z.object({
+    projectId: identifier,
+    name: z.string().min(1).max(256),
+    version: z.string().min(1).max(128),
+    minimumBump: z.enum(["none", "patch", "minor", "major"])
+  }).strict()).min(1),
+  artifacts: z.array(releaseArtifactSchema).min(1),
+  contractBundles: z.array(z.object({ id: identifier, digest }).strict()).default([]),
+  compatibilityAttestations: z.array(z.object({ contractId: z.string().min(1), digest, compatible: z.literal(true), minimumBump: z.enum(["none", "patch", "minor", "major"]) }).strict()).default([]),
+  verification: z.object({
+    status: z.literal("passed"),
+    operations: z.array(z.string().min(1)).min(1),
+    completedAt: z.string().datetime()
+  }).strict()
+}).strict().superRefine((evidence, context) => {
+  const identities = evidence.artifacts.map((artifact) => artifact.identity);
+  if (new Set(identities).size !== identities.length) context.addIssue({ code: z.ZodIssueCode.custom, path: ["artifacts"], message: "Release artifact identities must be unique." });
+  for (const bundle of evidence.contractBundles) {
+    if (!evidence.artifacts.some((artifact) => artifact.kind === "contract-bundle" && artifact.digest === bundle.digest)) context.addIssue({ code: z.ZodIssueCode.custom, path: ["contractBundles"], message: `Contract bundle ${bundle.id} is not present in artifact custody.` });
+  }
+  for (const attestation of evidence.compatibilityAttestations) {
+    if (!evidence.artifacts.some((artifact) => artifact.kind === "compatibility-attestation" && artifact.digest === attestation.digest)) context.addIssue({ code: z.ZodIssueCode.custom, path: ["compatibilityAttestations"], message: `Compatibility attestation ${attestation.contractId} is not present in artifact custody.` });
+  }
+});
+export {
+  developmentCandidateSchema,
+  developmentModeSchema,
+  developmentReactionSchema,
+  developmentRuntimeSchema,
+  developmentSessionSchema,
+  developmentStatePolicySchema,
+  developmentTargetKindSchema,
+  developmentTargetSchema,
+  releaseEvidenceSchema
+};

package/dist/entrypoints/clients/control-plane-client.d.ts

@@ -1,9 +1,8 @@
-import type { ControlPlaneOperationDescriptor, OAuthScope } from '../../operator-contracts/control-plane-operation.js';
-import type { ApiPrincipal } from './remote.js';
+import type { ControlPlaneOperationBinding, ControlPlaneOperationBody, ControlPlaneOperationOutput, ControlPlaneOperationPath, ControlPlaneOperationQuery, OAuthScope } from '../../operator-contracts/control-plane-operation.js';
+import type { ApiPrincipal } from '../../operator-contracts/oauth.js';
+import type { InputRequired } from '../../operator-contracts/mcp.js';
 export declare const DEFAULT_CONTROL_PLANE_BASE_URL = "http://127.0.0.1:3002";
 export declare const CONTROL_PLANE_BASE_URL_ENV = "TREESEED_API_BASE_URL";
-export declare const CONTROL_PLANE_SERVER_REGISTRY_PATH = ".treeseed/config/servers.json";
-export declare const CONTROL_PLANE_SERVER_SESSIONS_PATH = ".treeseed/config/remote-auth.json";
 export interface ControlPlaneServerProfile {
     serverId: string;
     label: string;
@@ -16,9 +15,11 @@ export interface ControlPlaneServerSession {
     refreshToken?: string;
     expiresAt?: string;
     principal?: ApiPrincipal | null;
-}
-export interface ControlPlaneSessionCustody {
-    loadKey(root: string): Buffer;
+    activeTeam?: {
+        id: string;
+        slug: string;
+        name: string;
+    } | null;
 }
 export interface ControlPlaneServerRegistry {
     version: 1;
@@ -42,11 +43,6 @@ export interface OAuthTokenReceipt {
     audience: string;
     principal?: ApiPrincipal | null;
 }
-export interface ControlPlaneOperationBinding<TInput = unknown, TOutput = unknown> {
-    descriptor: ControlPlaneOperationDescriptor;
-    readonly __input?: TInput;
-    readonly __output?: TOutput;
-}
 export interface ControlPlaneClientOptions {
     profile: ControlPlaneServerProfile;
     accessToken?: string | null;
@@ -68,6 +64,7 @@ export interface ProblemDetails {
     requestId?: string;
     traceId?: string;
     fields?: Record<string, string[]>;
+    inputRequired?: InputRequired;
 }
 export interface ControlPlaneCallOptions {
     method?: 'DELETE' | 'GET' | 'PATCH' | 'POST' | 'PUT';
@@ -76,14 +73,21 @@ export interface ControlPlaneCallOptions {
     headers?: Record<string, string>;
     idempotencyKey?: string;
     ifMatch?: string;
+    authorization?: string | null;
     signal?: AbortSignal;
 }
 export interface ControlPlaneOperationCallOptions {
     headers?: Record<string, string>;
     idempotencyKey?: string;
     ifMatch?: string;
+    authorization?: string | null;
     signal?: AbortSignal;
 }
+export interface ControlPlaneInvocation<TPath, TQuery, TBody> {
+    path: TPath;
+    query: TQuery;
+    body: TBody;
+}
 export declare class ControlPlaneClientError extends Error {
     readonly status: number;
     readonly problem: ProblemDetails;
@@ -92,19 +96,12 @@ export declare class ControlPlaneClientError extends Error {
 }
 export declare function normalizeControlPlaneBaseUrl(value: string): string;
 export declare function defaultLocalControlPlaneServer(env?: Record<string, string | undefined>): ControlPlaneServerProfile;
-export declare function loadControlPlaneServerRegistry(env?: Record<string, string | undefined>): ControlPlaneServerRegistry;
-export declare function writeControlPlaneServerRegistry(state: ControlPlaneServerRegistry, env?: Record<string, string | undefined>): ControlPlaneServerRegistry;
-export declare function resolveControlPlaneServer(selector?: string | null, env?: Record<string, string | undefined>): ControlPlaneServerProfile;
-export declare function resolveControlPlaneServerSession(root: string, server: string | ControlPlaneServerProfile, custody?: ControlPlaneSessionCustody): ControlPlaneServerSession | null;
-export declare function setControlPlaneServerSession(root: string, session: ControlPlaneServerSession, custody?: ControlPlaneSessionCustody): {
-    audience: string;
-    serverId: string;
-    accessToken: string;
-    refreshToken?: string;
-    expiresAt?: string;
-    principal?: ApiPrincipal | null;
+export declare function normalizeControlPlaneServerRegistry(state: ControlPlaneServerRegistry): {
+    version: 1;
+    activeServerId: string;
+    servers: ControlPlaneServerProfile[];
 };
-export declare function clearControlPlaneServerSession(root: string, serverId?: string | null, custody?: ControlPlaneSessionCustody): void;
+export declare function resolveControlPlaneServer(selector: string | null | undefined, registry: ControlPlaneServerRegistry): ControlPlaneServerProfile;
 export declare class ControlPlaneClient {
     readonly options: ControlPlaneClientOptions;
     readonly baseUrl: string;
@@ -112,11 +109,11 @@ export declare class ControlPlaneClient {
     readonly fetchImpl: typeof fetch;
     readonly userAgent?: string;
     constructor(options: ControlPlaneClientOptions);
-    callOperation<TInput, TOutput>(binding: ControlPlaneOperationBinding<TInput, TOutput>, input: TInput, options?: ControlPlaneOperationCallOptions): Promise<ControlPlaneResponseEnvelope<TOutput>>;
+    invoke<TOperation extends ControlPlaneOperationBinding<any, any, any, any>>(binding: TOperation, input: ControlPlaneInvocation<ControlPlaneOperationPath<TOperation>, ControlPlaneOperationQuery<TOperation>, ControlPlaneOperationBody<TOperation>>, options?: ControlPlaneOperationCallOptions): Promise<ControlPlaneResponseEnvelope<ControlPlaneOperationOutput<TOperation>>>;
     authorizeDevice(clientId: string, scope: OAuthScope[], signal?: AbortSignal): Promise<OAuthDeviceAuthorizationReceipt>;
     exchangeDeviceCode(clientId: string, deviceCode: string, signal?: AbortSignal): Promise<OAuthTokenReceipt>;
     refreshAccessToken(clientId: string, refreshToken: string, signal?: AbortSignal): Promise<OAuthTokenReceipt>;
     revokeToken(clientId: string, token: string, signal?: AbortSignal): Promise<void>;
     private exchangeOAuthToken;
-    call<T>(options: ControlPlaneCallOptions): Promise<ControlPlaneResponseEnvelope<T>>;
+    private request;
 }

package/dist/entrypoints/clients/control-plane-client.js

@@ -1,19 +1,6 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, resolve } from "node:path";
-import {
-  decryptRemoteAuthSessions,
-  encryptRemoteAuthSessions,
-  loadMachineKey,
-  loadRemoteAuthPayload,
-  writeRemoteAuthPayload
-} from "../../operations/services/config-runtime/configuration/create-default-machine-config.js";
-import { getRemoteAuthPaths } from "../../operations/services/config-runtime/accounts/ensure-secret-session-for-config.js";
+import { controlPlaneOperation } from "../../operator-contracts/control-plane-operations.js";
 const DEFAULT_CONTROL_PLANE_BASE_URL = "http://127.0.0.1:3002";
 const CONTROL_PLANE_BASE_URL_ENV = "TREESEED_API_BASE_URL";
-const CONTROL_PLANE_SERVER_REGISTRY_PATH = ".treeseed/config/servers.json";
-const CONTROL_PLANE_SERVER_SESSIONS_PATH = ".treeseed/config/remote-auth.json";
-const machineKeySessionCustody = { loadKey: loadMachineKey };
 class ControlPlaneClientError extends Error {
   constructor(message, status, problem, responseHeaders) {
     super(message);
@@ -38,85 +25,31 @@ function defaultLocalControlPlaneServer(env = process.env) {
     baseUrl: normalizeControlPlaneBaseUrl(env[CONTROL_PLANE_BASE_URL_ENV] ?? DEFAULT_CONTROL_PLANE_BASE_URL)
   };
 }
-function registryPath(env = process.env) {
-  return resolve(env.HOME?.trim() || homedir(), CONTROL_PLANE_SERVER_REGISTRY_PATH);
-}
 function normalizeServer(profile) {
   const serverId = profile.serverId.trim();
   if (!serverId) throw new Error("Control-plane server IDs cannot be empty.");
   return { serverId, label: profile.label.trim() || serverId, baseUrl: normalizeControlPlaneBaseUrl(profile.baseUrl) };
 }
-function loadControlPlaneServerRegistry(env = process.env) {
-  const local = defaultLocalControlPlaneServer(env);
-  const path = registryPath(env);
-  if (!existsSync(path)) return { version: 1, activeServerId: local.serverId, servers: [local] };
-  const parsed = JSON.parse(readFileSync(path, "utf8"));
-  const byId = /* @__PURE__ */ new Map([[local.serverId, local]]);
-  for (const value of Array.isArray(parsed.servers) ? parsed.servers : []) {
-    const normalized = normalizeServer(value);
-    byId.set(normalized.serverId, normalized);
-  }
-  const servers = [...byId.values()].sort((left, right) => left.serverId.localeCompare(right.serverId));
-  const activeServerId = servers.some((entry) => entry.serverId === parsed.activeServerId) ? parsed.activeServerId : local.serverId;
-  return { version: 1, activeServerId, servers };
-}
-function writeControlPlaneServerRegistry(state, env = process.env) {
-  const path = registryPath(env);
+function normalizeControlPlaneServerRegistry(state) {
   const servers = [...new Map(state.servers.map((entry) => {
     const normalized = normalizeServer(entry);
     return [normalized.serverId, normalized];
   })).values()].sort((left, right) => left.serverId.localeCompare(right.serverId));
-  const activeServerId = servers.some((entry) => entry.serverId === state.activeServerId) ? state.activeServerId : "local";
-  const next = { version: 1, activeServerId, servers };
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(next, null, 2)}
-`, { encoding: "utf8", mode: 384 });
-  return next;
+  if (servers.length === 0) throw new Error("A control-plane server registry requires at least one server.");
+  const activeServerId = servers.some((entry) => entry.serverId === state.activeServerId) ? state.activeServerId : servers[0].serverId;
+  return { version: 1, activeServerId, servers };
 }
-function resolveControlPlaneServer(selector, env = process.env) {
+function resolveControlPlaneServer(selector, registry) {
   const value = selector?.trim();
   if (value && /^https?:\/\//iu.test(value)) {
     return normalizeServer({ serverId: value.replace(/^https?:\/\//iu, "").replace(/[^a-z0-9._-]+/giu, "-"), label: value, baseUrl: value });
   }
-  const registry = loadControlPlaneServerRegistry(env);
-  const serverId = value || registry.activeServerId;
-  const profile = registry.servers.find((entry) => entry.serverId === serverId);
+  const normalized = normalizeControlPlaneServerRegistry(registry);
+  const serverId = value || normalized.activeServerId;
+  const profile = normalized.servers.find((entry) => entry.serverId === serverId);
   if (!profile) throw new Error(`Unknown control-plane server "${serverId}".`);
   return profile;
 }
-function resolveControlPlaneServerSession(root, server, custody = machineKeySessionCustody) {
-  const serverId = typeof server === "string" ? server : server.serverId;
-  const session = readServerSessions(root, custody)[serverId] ?? null;
-  if (session && typeof server !== "string" && session.audience !== normalizeControlPlaneBaseUrl(server.baseUrl)) {
-    throw new Error(`Stored session audience does not match control-plane server "${server.serverId}".`);
-  }
-  return session;
-}
-function setControlPlaneServerSession(root, session, custody = machineKeySessionCustody) {
-  const normalized = { ...session, audience: normalizeControlPlaneBaseUrl(session.audience) };
-  const sessions = readServerSessions(root, custody);
-  sessions[session.serverId] = normalized;
-  writeServerSessions(root, sessions, custody);
-  return normalized;
-}
-function clearControlPlaneServerSession(root, serverId, custody = machineKeySessionCustody) {
-  if (!serverId) {
-    writeServerSessions(root, {}, custody);
-    return;
-  }
-  const sessions = readServerSessions(root, custody);
-  delete sessions[serverId];
-  writeServerSessions(root, sessions, custody);
-}
-function readServerSessions(root, custody) {
-  if (!existsSync(getRemoteAuthPaths(root).authPath)) return {};
-  const sessions = decryptRemoteAuthSessions(loadRemoteAuthPayload(root), custody.loadKey(root));
-  return Object.fromEntries(Object.entries(sessions).map(([serverId, session]) => [serverId, { serverId, ...session }]));
-}
-function writeServerSessions(root, sessions, custody) {
-  const values = Object.fromEntries(Object.entries(sessions).map(([serverId, session]) => [serverId, session]));
-  writeRemoteAuthPayload(root, { version: 1, sessions: encryptRemoteAuthSessions(values, custody.loadKey(root)) });
-}
 async function responsePayload(response) {
   const contentType = response.headers.get("content-type") ?? "";
   if (contentType.includes("json")) return response.json();
@@ -134,7 +67,8 @@ function problemFrom(payload, status) {
     code: typeof source.code === "string" ? source.code : "control_plane_request_failed",
     requestId: typeof source.requestId === "string" ? source.requestId : void 0,
     traceId: typeof source.traceId === "string" ? source.traceId : void 0,
-    fields: source.fields && typeof source.fields === "object" ? source.fields : void 0
+    fields: source.fields && typeof source.fields === "object" ? source.fields : void 0,
+    inputRequired: source.inputRequired && typeof source.inputRequired === "object" ? source.inputRequired : void 0
   };
 }
 class ControlPlaneClient {
@@ -150,15 +84,40 @@ class ControlPlaneClient {
   accessToken;
   fetchImpl;
   userAgent;
-  async callOperation(binding, input, options = {}) {
+  async invoke(binding, input, options = {}) {
+    if (controlPlaneOperation(binding.descriptor.operationId) !== binding) {
+      throw new Error(`Operation ${binding.descriptor.operationId} is not the authoritative catalog binding.`);
+    }
     const rest = binding.descriptor.rest;
     if (!rest) throw new Error(`Operation ${binding.descriptor.operationId} has no REST binding.`);
-    if (/[:*]/u.test(rest.path)) throw new Error(`Operation ${binding.descriptor.operationId} requires generated path parameters.`);
-    return this.call({ method: rest.method, path: rest.path, input: rest.method === "GET" ? void 0 : input, ...options });
+    const pathInput = binding.schema.path.parse(input.path);
+    const queryInput = binding.schema.query.parse(input.query);
+    const bodyInput = binding.schema.body.parse(input.body);
+    let path = rest.path;
+    path = path.replace(/\{([A-Za-z][A-Za-z0-9]*)\}/gu, (_match, name) => {
+      const value = pathInput[name];
+      if (typeof value !== "string" && typeof value !== "number") throw new Error(`Operation ${binding.descriptor.operationId} requires path parameter ${name}.`);
+      return encodeURIComponent(String(value));
+    });
+    if (path.includes("{")) throw new Error(`Operation ${binding.descriptor.operationId} has unresolved path parameters.`);
+    const query = new URLSearchParams();
+    for (const [name, value] of Object.entries(queryInput)) {
+      if (value === void 0 || value === null) continue;
+      for (const item of Array.isArray(value) ? value : [value]) query.append(name, String(item));
+    }
+    const queryString = query.toString();
+    const response = await this.request({
+      method: rest.method,
+      path: `${path}${queryString ? `?${queryString}` : ""}`,
+      input: rest.method === "GET" ? void 0 : bodyInput,
+      ...options
+    });
+    return { ...response, data: binding.schema.output.parse(response.data) };
   }
   async authorizeDevice(clientId, scope, signal) {
     const response = await this.fetchImpl(`${this.baseUrl}/oauth/device_authorization`, { method: "POST", headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ client_id: clientId, scope: scope.join(" ") }), signal });
-    const payload = await responsePayload(response);
+    const rawPayload = await responsePayload(response);
+    const payload = rawPayload && typeof rawPayload === "object" ? rawPayload : {};
     if (!response.ok) throw new ControlPlaneClientError(String(payload.error_description ?? payload.error ?? "Device authorization failed."), response.status, problemFrom(payload, response.status), response.headers);
     return { deviceCode: String(payload.device_code), userCode: String(payload.user_code), verificationUri: String(payload.verification_uri), verificationUriComplete: typeof payload.verification_uri_complete === "string" ? payload.verification_uri_complete : void 0, expiresIn: Number(payload.expires_in), interval: Number(payload.interval) };
   }
@@ -174,14 +133,23 @@ class ControlPlaneClient {
   }
   async exchangeOAuthToken(values, signal) {
     const response = await this.fetchImpl(`${this.baseUrl}/oauth/token`, { method: "POST", headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" }, body: new URLSearchParams(values), signal });
-    const payload = await responsePayload(response);
-    if (!response.ok) throw new ControlPlaneClientError(String(payload.error_description ?? payload.error ?? "OAuth token exchange failed."), response.status, problemFrom(payload, response.status), response.headers);
+    const rawPayload = await responsePayload(response);
+    const payload = rawPayload && typeof rawPayload === "object" ? rawPayload : {};
+    if (!response.ok) {
+      const problem = problemFrom(rawPayload, response.status);
+      problem.code = typeof payload.error === "string" ? payload.error : problem.code;
+      problem.detail = typeof payload.error_description === "string" ? payload.error_description : problem.detail;
+      throw new ControlPlaneClientError(problem.detail ?? problem.code, response.status, problem, response.headers);
+    }
     return { tokenType: "Bearer", accessToken: String(payload.access_token), refreshToken: typeof payload.refresh_token === "string" ? payload.refresh_token : void 0, expiresIn: Number(payload.expires_in), scope: String(payload.scope ?? "").split(/\s+/u).filter(Boolean), audience: String(payload.audience ?? this.baseUrl), principal: payload.principal && typeof payload.principal === "object" ? payload.principal : void 0 };
   }
-  async call(options) {
+  async request(options) {
     const headers = new Headers(options.headers);
     headers.set("accept", "application/json, application/problem+json");
-    if (this.accessToken) headers.set("authorization", `Bearer ${this.accessToken}`);
+    if (options.authorization !== null) {
+      const authorization = options.authorization ?? (this.accessToken ? `Bearer ${this.accessToken}` : null);
+      if (authorization) headers.set("authorization", authorization);
+    }
     if (this.userAgent) headers.set("user-agent", this.userAgent);
     if (options.idempotencyKey) headers.set("idempotency-key", options.idempotencyKey);
     if (options.ifMatch) headers.set("if-match", options.ifMatch);
@@ -205,22 +173,20 @@ class ControlPlaneClient {
         code: "control_plane_response_invalid"
       }, response.headers);
     }
-    return payload;
+    const envelope = payload;
+    const etag = response.headers.get("etag");
+    const contractDigest = response.headers.get("x-treeseed-contract-digest");
+    if (!etag && !contractDigest) return envelope;
+    return { ...envelope, meta: { ...envelope.meta ?? {}, ...etag ? { etag } : {}, ...contractDigest ? { contractDigest } : {} } };
   }
 }
 export {
   CONTROL_PLANE_BASE_URL_ENV,
-  CONTROL_PLANE_SERVER_REGISTRY_PATH,
-  CONTROL_PLANE_SERVER_SESSIONS_PATH,
   ControlPlaneClient,
   ControlPlaneClientError,
   DEFAULT_CONTROL_PLANE_BASE_URL,
-  clearControlPlaneServerSession,
   defaultLocalControlPlaneServer,
-  loadControlPlaneServerRegistry,
   normalizeControlPlaneBaseUrl,
-  resolveControlPlaneServer,
-  resolveControlPlaneServerSession,
-  setControlPlaneServerSession,
-  writeControlPlaneServerRegistry
+  normalizeControlPlaneServerRegistry,
+  resolveControlPlaneServer
 };

package/dist/graph/context-query-contracts.d.ts

@@ -23,9 +23,24 @@ export interface DeclarativeContextQuery {
         maxCharacters?: number;
     };
     tokenBudget?: number;
+    sources?: Array<{
+        scope: 'current-project' | 'team-library';
+    } | {
+        scope: 'same-team';
+        projectIds?: string[];
+        projectSlugs?: string[];
+    } | {
+        scope: 'shared-team';
+        teamId: string;
+        projectIds?: string[];
+    }>;
+    requirement?: 'required' | 'preferred';
+    priority?: number;
+    minimumBudget?: number;
+    maximumBudget?: number;
+    summarization?: 'none' | 'deterministic' | 'provider';
     format?: DeclarativeContextQueryFormat;
     filters?: Record<string, unknown>;
-    required?: boolean;
 }
 export type HandlerContextPackSource = 'agent_spec' | 'content_frontmatter' | 'work_package' | 'task_payload' | 'default_role_context';
 export interface DeclarativeContextQuerySourceRef {

package/dist/graph/context-query-contracts.js

@@ -68,6 +68,11 @@ function compileDeclarativeContextQuery(query, options = {}) {
   }
   if (query.resultLimit !== void 0 && !asPositiveInteger(query.resultLimit)) errors.push(`Context query "${id || "<unknown>"}" resultLimit must be a positive integer.`);
   if (query.tokenBudget !== void 0 && !asPositiveInteger(query.tokenBudget)) errors.push(`Context query "${id || "<unknown>"}" tokenBudget must be a positive integer.`);
+  if (query.minimumBudget !== void 0 && !asPositiveInteger(query.minimumBudget)) errors.push(`Context query "${id || "<unknown>"}" minimumBudget must be a positive integer.`);
+  if (query.maximumBudget !== void 0 && !asPositiveInteger(query.maximumBudget)) errors.push(`Context query "${id || "<unknown>"}" maximumBudget must be a positive integer.`);
+  if (query.minimumBudget !== void 0 && query.maximumBudget !== void 0 && query.minimumBudget > query.maximumBudget) errors.push(`Context query "${id || "<unknown>"}" minimumBudget cannot exceed maximumBudget.`);
+  if (query.priority !== void 0 && (!Number.isInteger(query.priority) || query.priority < 0 || query.priority > 100)) errors.push(`Context query "${id || "<unknown>"}" priority must be an integer from 0 through 100.`);
+  if (query.sources?.some((source) => source.scope === "shared-team" && !source.teamId.trim())) errors.push(`Context query "${id || "<unknown>"}" shared-team sources require a teamId.`);
   const scope = query.scope === void 0 ? void 0 : normalizeString(query.scope);
   if (scope !== void 0 && (!scope || !scope.startsWith("/"))) {
     errors.push(`Context query "${id || "<unknown>"}" scope must start with "/".`);

package/dist/guarantees/evidence-trust.d.ts

@@ -0,0 +1,32 @@
+import type { GuaranteeDiagnostic, GuaranteeVerifierResult } from './index.js';
+export interface UiEvidenceTrustInput {
+    requestedDevice: {
+        id: string;
+        viewport: {
+            width: number;
+            height: number;
+        };
+        isMobile: boolean;
+        hasTouch: boolean;
+    };
+    actualDevice: {
+        id: string;
+        viewport: {
+            width: number;
+            height: number;
+        };
+        isMobile: boolean;
+        hasTouch: boolean;
+    };
+    consoleErrors?: Array<{
+        message: string;
+        asserted?: boolean;
+    }>;
+    networkErrors?: Array<{
+        status?: number;
+        message: string;
+        asserted?: boolean;
+    }>;
+}
+export declare function validateUiEvidenceTrust(input: UiEvidenceTrustInput): GuaranteeDiagnostic[];
+export declare function runUiEvidenceTrustVerifier(): GuaranteeVerifierResult;