@treeseed/sdk 0.13.0-rc.91 → 0.13.0-rc.93

package/dist/deployment/ai-hosting.js

@@ -0,0 +1,63 @@
+import { z } from "zod";
+const id = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u);
+const name = z.string().trim().min(1).max(128);
+const digest = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+const time = z.string().regex(/^(?:[01][0-9]|2[0-3]):[0-5][0-9]$/u);
+const aiHostingScheduleSchema = z.object({
+  timeZone: z.string().refine((value) => {
+    try {
+      new Intl.DateTimeFormat("en", { timeZone: value });
+      return true;
+    } catch {
+      return false;
+    }
+  }, "Use an IANA time zone."),
+  weekdays: z.array(z.number().int().min(1).max(7)).min(1).max(7),
+  start: time,
+  end: time,
+  startupLeadMinutes: z.number().int().min(0).max(120),
+  idleAction: z.literal("hibernate"),
+  activeWorkPolicy: z.literal("drain-and-checkpoint")
+}).strict().superRefine((value, context) => {
+  if (new Set(value.weekdays).size !== value.weekdays.length) context.addIssue({ code: "custom", path: ["weekdays"], message: "Choose each weekday once." });
+  if (value.start >= value.end) context.addIssue({ code: "custom", path: ["end"], message: "End must follow start on the same local day." });
+});
+const storage = z.object({
+  bindingId: id,
+  purpose: z.enum(["datasets", "models", "checkpoints", "artifacts"]),
+  access: z.enum(["read", "write"])
+}).strict();
+const component = z.object({ componentId: z.enum(["ai-inference", "ai-training"]), releaseDigest: digest }).strict();
+const aiHostingDeploymentSchema = z.object({
+  schemaVersion: z.literal("treeseed.ai-hosting-deployment/v1"),
+  teamId: id,
+  projectId: id,
+  deploymentId: id,
+  environment: z.enum(["staging", "production"]),
+  provider: z.literal("hyperstack"),
+  hostingBindingId: id,
+  components: z.array(component).min(1).max(2),
+  machine: z.object({ name, environmentName: name, flavorName: name, imageName: name, keypairName: name, volumeName: name }).strict(),
+  gpuAdmission: z.literal("exclusive-engine"),
+  storage: z.array(storage).min(1).max(16),
+  schedule: aiHostingScheduleSchema.optional()
+}).strict().superRefine((value, context) => {
+  if (new Set(value.components.map((item) => item.componentId)).size !== value.components.length)
+    context.addIssue({ code: "custom", path: ["components"], message: "Each engine can be selected once." });
+  if (!value.storage.some((item) => item.purpose === "models" && item.access === "read"))
+    context.addIssue({ code: "custom", path: ["storage"], message: "An authorized model read binding is required." });
+  if (value.components.some((item) => item.componentId === "ai-training")) {
+    for (const [purpose, access] of [["datasets", "read"], ["checkpoints", "write"]])
+      if (!value.storage.some((item) => item.purpose === purpose && item.access === access))
+        context.addIssue({ code: "custom", path: ["storage"], message: `Training requires ${purpose} ${access} access.` });
+  }
+});
+const AI_HOSTING_TARGETS = [
+  { id: "ai-inference", project: "ai", engine: "vllm", capability: "ai-inference-hosting", runtimeOwner: "ai", infrastructureOwner: "deployment" },
+  { id: "ai-training", project: "ai", engine: "axolotl", capability: "ai-training-hosting", runtimeOwner: "ai", infrastructureOwner: "deployment" }
+];
+export {
+  AI_HOSTING_TARGETS,
+  aiHostingDeploymentSchema,
+  aiHostingScheduleSchema
+};

package/dist/deployment/ai-instance.d.ts

@@ -0,0 +1,48 @@
+import { z } from 'zod';
+export declare const aiInstanceDraftSchema: z.ZodEffects<z.ZodObject<{
+    name: z.ZodString;
+    projectId: z.ZodString;
+    purpose: z.ZodEnum<["inference", "training", "both"]>;
+    hostingConnectionId: z.ZodString;
+    storageConnectionId: z.ZodNullable<z.ZodString>;
+    model: z.ZodString;
+    schedule: z.ZodEnum<["always", "weekdays"]>;
+    timeZone: z.ZodEffects<z.ZodString, string, string>;
+}, "strict", z.ZodTypeAny, {
+    name: string;
+    projectId: string;
+    purpose: "inference" | "training" | "both";
+    timeZone: string;
+    schedule: "weekdays" | "always";
+    hostingConnectionId: string;
+    storageConnectionId: string | null;
+    model: string;
+}, {
+    name: string;
+    projectId: string;
+    purpose: "inference" | "training" | "both";
+    timeZone: string;
+    schedule: "weekdays" | "always";
+    hostingConnectionId: string;
+    storageConnectionId: string | null;
+    model: string;
+}>, {
+    name: string;
+    projectId: string;
+    purpose: "inference" | "training" | "both";
+    timeZone: string;
+    schedule: "weekdays" | "always";
+    hostingConnectionId: string;
+    storageConnectionId: string | null;
+    model: string;
+}, {
+    name: string;
+    projectId: string;
+    purpose: "inference" | "training" | "both";
+    timeZone: string;
+    schedule: "weekdays" | "always";
+    hostingConnectionId: string;
+    storageConnectionId: string | null;
+    model: string;
+}>;
+export type AiInstanceDraft = z.infer<typeof aiInstanceDraftSchema>;

package/dist/deployment/ai-instance.js

@@ -0,0 +1,23 @@
+import { z } from "zod";
+const aiInstanceDraftSchema = z.object({
+  name: z.string().trim().min(1).max(128),
+  projectId: z.string().min(1).max(128),
+  purpose: z.enum(["inference", "training", "both"]),
+  hostingConnectionId: z.string().min(1).max(128),
+  storageConnectionId: z.string().min(1).max(128).nullable(),
+  model: z.string().trim().min(1).max(512),
+  schedule: z.enum(["always", "weekdays"]),
+  timeZone: z.string().refine((value) => {
+    try {
+      new Intl.DateTimeFormat("en", { timeZone: value });
+      return true;
+    } catch {
+      return false;
+    }
+  }, "Use an IANA time zone.")
+}).strict().superRefine((value, context) => {
+  if (value.purpose !== "inference" && !value.storageConnectionId) context.addIssue({ code: "custom", path: ["storageConnectionId"], message: "Training requires a storage connection." });
+});
+export {
+  aiInstanceDraftSchema
+};

package/dist/deployment/index.d.ts

@@ -3,5 +3,7 @@ export * from './canonical.js';
 export * from './catalog.js';
 export * from './topology.js';
 export * from './ai-mode.js';
+export * from './ai-hosting.js';
+export * from './ai-instance.js';
 export * from './hosted-topology.js';
 export * from './hosted-topology-template.js';

package/dist/deployment/index.js

@@ -3,5 +3,7 @@ export * from "./canonical.js";
 export * from "./catalog.js";
 export * from "./topology.js";
 export * from "./ai-mode.js";
+export * from "./ai-hosting.js";
+export * from "./ai-instance.js";
 export * from "./hosted-topology.js";
 export * from "./hosted-topology-template.js";

package/dist/operator-contracts/canonical-command-tree.js

@@ -1,3 +1,4 @@
+import { commandPaths } from "./catalog/infrastructure/command-tree-paths.js";
 import { managedSecretCommands } from "./catalog/services/secret-commands.js";
 import { hostProviderEnvironmentBranch, PROVIDER_ENVIRONMENT_COMMAND_BINDINGS, providerEnvironmentBranches } from "./catalog/provider-environment-commands.js";
 const unavailable = (reason = "This capability is not enabled until its control-plane operation is accepted.") => ({
@@ -230,6 +231,7 @@ function hostInitialize() {
   value.description = "Initialize the generic host foundation from an immutable catalog-bound profile.";
   value.options = [
     ...value.options ?? [],
+    { name: "--input-file", description: "Team capacity installation configuration downloaded from Admin. Values are never printed.", type: "string" },
     { name: "--profile", description: "Catalog-bound host initialization profile.", type: "string", required: true },
     { name: "--confirm", description: "Confirm installation of the reviewed profile plan.", type: "boolean" },
     { name: "--yes", description: "Confirm non-interactive execution after reviewing the plan.", type: "boolean" }
@@ -515,16 +517,7 @@ function attachExecution(nodes, parent = []) {
 attachExecution(commandTree.commands);
 const TREESEED_COMMAND_TREE_V1 = commandTree;
 function listCommandPaths(tree = TREESEED_COMMAND_TREE_V1) {
-  const paths = [];
-  const visit = (nodes, parent) => {
-    for (const node of nodes) {
-      const path = [...parent, node.segment];
-      if (node.nodeType === "leaf") paths.push(path.join(" "));
-      else visit(node.children, path);
-    }
-  };
-  visit(tree.commands, []);
-  return paths;
+  return commandPaths(tree);
 }
 export {
   TREESEED_COMMAND_TREE_V1,

package/dist/operator-contracts/catalog/communication-operations.d.ts

@@ -33,8 +33,8 @@ export declare function communicationOperations(): {
                 resources: Record<string, unknown>;
                 selection: {
                     capabilities: string[];
-                    parameters: Record<string, unknown>;
                     model: string | null;
+                    parameters: Record<string, unknown>;
                 };
                 reason: string | null;
                 provider: {
@@ -150,8 +150,8 @@ export declare function communicationOperations(): {
                 resources: Record<string, unknown>;
                 selection: {
                     capabilities: string[];
-                    parameters: Record<string, unknown>;
                     model: string | null;
+                    parameters: Record<string, unknown>;
                 };
                 reason: string | null;
                 provider: {

package/dist/operator-contracts/catalog/infrastructure/ai-instance-operations.d.ts

@@ -0,0 +1,29 @@
+export declare const AI_INSTANCE_OPERATIONS: {
+    list: import("../../control-plane-operation.js").ControlPlaneOperationBinding<{
+        teamId: string;
+    }, {
+        cursor?: string | undefined;
+        limit?: number | undefined;
+    }, undefined, Record<string, unknown>>;
+    show: import("../../control-plane-operation.js").ControlPlaneOperationBinding<{
+        teamId: string;
+        instanceId: string;
+    }, {}, undefined, Record<string, unknown>>;
+    put: import("../../control-plane-operation.js").ControlPlaneOperationBinding<{
+        teamId: string;
+        instanceId: string;
+    }, {}, {
+        name: string;
+        projectId: string;
+        purpose: "inference" | "training" | "both";
+        timeZone: string;
+        schedule: "weekdays" | "always";
+        hostingConnectionId: string;
+        storageConnectionId: string | null;
+        model: string;
+    }, Record<string, unknown>>;
+    remove: import("../../control-plane-operation.js").ControlPlaneOperationBinding<{
+        teamId: string;
+        instanceId: string;
+    }, {}, {}, Record<string, unknown>>;
+};

package/dist/operator-contracts/catalog/infrastructure/ai-instance-operations.js

@@ -0,0 +1,18 @@
+import { z } from "zod";
+import { defineOperation } from "../../operation-builder.js";
+import { aiInstanceDraftSchema } from "../../../deployment/ai-instance.js";
+const team = z.object({ teamId: z.string().min(1) }).strict(), instance = team.extend({ instanceId: z.string().uuid() });
+const empty = z.object({}).strict(), record = z.record(z.unknown());
+function descriptor(action, method, path) {
+  const read = method === "GET";
+  return { operationId: `ai.instances.${action}`, description: `${action} a team-owned AI configuration; no cloud provisioning.`, rest: { method, path }, parameters: `treeseed.ai.instances.${action}.parameters/v1`, capability: read ? "infrastructure.read" : "infrastructure.write", authentication: "oauth", oauthScopes: read ? ["treeseed:read"] : ["treeseed:admin"], kind: read ? "read" : "mutation", riskClass: "ordinary", confirmation: "never", surfaces: ["rest", "cli"], cacheScope: read ? "principal" : "none", pagination: "none", concurrencyRequired: !read };
+}
+const AI_INSTANCE_OPERATIONS = {
+  list: defineOperation({ ...descriptor("list", "GET", "/v1/teams/{teamId}/ai-instances"), pagination: "cursor" }, { path: team, query: z.object({ cursor: z.string().optional(), limit: z.coerce.number().int().min(1).max(100).optional() }).strict(), body: z.undefined(), output: record }),
+  show: defineOperation(descriptor("show", "GET", "/v1/teams/{teamId}/ai-instances/{instanceId}"), { path: instance, query: empty, body: z.undefined(), output: record }),
+  put: defineOperation(descriptor("put", "PUT", "/v1/teams/{teamId}/ai-instances/{instanceId}"), { path: instance, query: empty, body: aiInstanceDraftSchema, output: record }),
+  remove: defineOperation(descriptor("remove", "DELETE", "/v1/teams/{teamId}/ai-instances/{instanceId}"), { path: instance, query: empty, body: empty, output: record })
+};
+export {
+  AI_INSTANCE_OPERATIONS
+};

package/dist/operator-contracts/catalog/infrastructure/command-tree-paths.d.ts

@@ -0,0 +1,3 @@
+import type { CommandTreeDescriptor } from '../../command-tree.js';
+/** Enumerate leaves without depending on the canonical command inventory. */
+export declare function commandPaths(tree: CommandTreeDescriptor): string[];

package/dist/operator-contracts/catalog/infrastructure/command-tree-paths.js

@@ -0,0 +1,15 @@
+function commandPaths(tree) {
+  const paths = [];
+  const visit = (nodes, parent) => {
+    for (const node of nodes) {
+      const path = [...parent, node.segment];
+      if (node.nodeType === "leaf") paths.push(path.join(" "));
+      else visit(node.children, path);
+    }
+  };
+  visit(tree.commands, []);
+  return paths;
+}
+export {
+  commandPaths
+};

package/dist/operator-contracts/communication/contracts.d.ts

@@ -108,12 +108,12 @@ export declare const communicationDiagnosticSchema: z.ZodObject<{
         parameters: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     }, "strict", z.ZodTypeAny, {
         capabilities: string[];
-        parameters: Record<string, unknown>;
         model: string | null;
+        parameters: Record<string, unknown>;
     }, {
         capabilities: string[];
-        parameters: Record<string, unknown>;
         model: string | null;
+        parameters: Record<string, unknown>;
     }>;
     identityManifest: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     contextManifest: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
@@ -126,8 +126,8 @@ export declare const communicationDiagnosticSchema: z.ZodObject<{
     resources: Record<string, unknown>;
     selection: {
         capabilities: string[];
-        parameters: Record<string, unknown>;
         model: string | null;
+        parameters: Record<string, unknown>;
     };
     reason: string | null;
     provider: {
@@ -146,8 +146,8 @@ export declare const communicationDiagnosticSchema: z.ZodObject<{
     resources: Record<string, unknown>;
     selection: {
         capabilities: string[];
-        parameters: Record<string, unknown>;
         model: string | null;
+        parameters: Record<string, unknown>;
     };
     reason: string | null;
     provider: {
@@ -264,12 +264,12 @@ export declare const communicationTargetSchema: z.ZodObject<{
             parameters: z.ZodRecord<z.ZodString, z.ZodUnknown>;
         }, "strict", z.ZodTypeAny, {
             capabilities: string[];
-            parameters: Record<string, unknown>;
             model: string | null;
+            parameters: Record<string, unknown>;
         }, {
             capabilities: string[];
-            parameters: Record<string, unknown>;
             model: string | null;
+            parameters: Record<string, unknown>;
         }>;
         identityManifest: z.ZodRecord<z.ZodString, z.ZodUnknown>;
         contextManifest: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
@@ -282,8 +282,8 @@ export declare const communicationTargetSchema: z.ZodObject<{
         resources: Record<string, unknown>;
         selection: {
             capabilities: string[];
-            parameters: Record<string, unknown>;
             model: string | null;
+            parameters: Record<string, unknown>;
         };
         reason: string | null;
         provider: {
@@ -302,8 +302,8 @@ export declare const communicationTargetSchema: z.ZodObject<{
         resources: Record<string, unknown>;
         selection: {
             capabilities: string[];
-            parameters: Record<string, unknown>;
             model: string | null;
+            parameters: Record<string, unknown>;
         };
         reason: string | null;
         provider: {
@@ -343,8 +343,8 @@ export declare const communicationTargetSchema: z.ZodObject<{
         resources: Record<string, unknown>;
         selection: {
             capabilities: string[];
-            parameters: Record<string, unknown>;
             model: string | null;
+            parameters: Record<string, unknown>;
         };
         reason: string | null;
         provider: {
@@ -402,8 +402,8 @@ export declare const communicationTargetSchema: z.ZodObject<{
         resources: Record<string, unknown>;
         selection: {
             capabilities: string[];
-            parameters: Record<string, unknown>;
             model: string | null;
+            parameters: Record<string, unknown>;
         };
         reason: string | null;
         provider: {
@@ -609,12 +609,12 @@ export declare const communicationSendReceiptSchema: z.ZodObject<{
                 parameters: z.ZodRecord<z.ZodString, z.ZodUnknown>;
             }, "strict", z.ZodTypeAny, {
                 capabilities: string[];
-                parameters: Record<string, unknown>;
                 model: string | null;
+                parameters: Record<string, unknown>;
             }, {
                 capabilities: string[];
-                parameters: Record<string, unknown>;
                 model: string | null;
+                parameters: Record<string, unknown>;
             }>;
             identityManifest: z.ZodRecord<z.ZodString, z.ZodUnknown>;
             contextManifest: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
@@ -627,8 +627,8 @@ export declare const communicationSendReceiptSchema: z.ZodObject<{
             resources: Record<string, unknown>;
             selection: {
                 capabilities: string[];
-                parameters: Record<string, unknown>;
                 model: string | null;
+                parameters: Record<string, unknown>;
             };
             reason: string | null;
             provider: {
@@ -647,8 +647,8 @@ export declare const communicationSendReceiptSchema: z.ZodObject<{
             resources: Record<string, unknown>;
             selection: {
                 capabilities: string[];
-                parameters: Record<string, unknown>;
                 model: string | null;
+                parameters: Record<string, unknown>;
             };
             reason: string | null;
             provider: {
@@ -688,8 +688,8 @@ export declare const communicationSendReceiptSchema: z.ZodObject<{
             resources: Record<string, unknown>;
             selection: {
                 capabilities: string[];
-                parameters: Record<string, unknown>;
                 model: string | null;
+                parameters: Record<string, unknown>;
             };
             reason: string | null;
             provider: {
@@ -747,8 +747,8 @@ export declare const communicationSendReceiptSchema: z.ZodObject<{
             resources: Record<string, unknown>;
             selection: {
                 capabilities: string[];
-                parameters: Record<string, unknown>;
                 model: string | null;
+                parameters: Record<string, unknown>;
             };
             reason: string | null;
             provider: {
@@ -911,8 +911,8 @@ export declare const communicationSendReceiptSchema: z.ZodObject<{
             resources: Record<string, unknown>;
             selection: {
                 capabilities: string[];
-                parameters: Record<string, unknown>;
                 model: string | null;
+                parameters: Record<string, unknown>;
             };
             reason: string | null;
             provider: {
@@ -1022,8 +1022,8 @@ export declare const communicationSendReceiptSchema: z.ZodObject<{
             resources: Record<string, unknown>;
             selection: {
                 capabilities: string[];
-                parameters: Record<string, unknown>;
                 model: string | null;
+                parameters: Record<string, unknown>;
             };
             reason: string | null;
             provider: {

package/dist/operator-contracts/control-plane-operations.d.ts

@@ -1,5 +1,34 @@
 import type { ControlPlaneOperationDescriptor } from './control-plane-operation.js';
 export declare const CONTROL_PLANE_OPERATIONS: {
+    readonly aiInstances: {
+        list: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+            teamId: string;
+        }, {
+            cursor?: string | undefined;
+            limit?: number | undefined;
+        }, undefined, Record<string, unknown>>;
+        show: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+            teamId: string;
+            instanceId: string;
+        }, {}, undefined, Record<string, unknown>>;
+        put: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+            teamId: string;
+            instanceId: string;
+        }, {}, {
+            name: string;
+            projectId: string;
+            purpose: "inference" | "training" | "both";
+            timeZone: string;
+            schedule: "weekdays" | "always";
+            hostingConnectionId: string;
+            storageConnectionId: string | null;
+            model: string;
+        }, Record<string, unknown>>;
+        remove: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+            teamId: string;
+            instanceId: string;
+        }, {}, {}, Record<string, unknown>>;
+    };
     readonly infrastructure: {
         readonly topology: {
             readonly plan: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
@@ -1533,8 +1562,8 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                     resources: Record<string, unknown>;
                     selection: {
                         capabilities: string[];
-                        parameters: Record<string, unknown>;
                         model: string | null;
+                        parameters: Record<string, unknown>;
                     };
                     reason: string | null;
                     provider: {
@@ -1650,8 +1679,8 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                     resources: Record<string, unknown>;
                     selection: {
                         capabilities: string[];
-                        parameters: Record<string, unknown>;
                         model: string | null;
+                        parameters: Record<string, unknown>;
                     };
                     reason: string | null;
                     provider: {
@@ -2326,6 +2355,10 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                 projectId: string;
                 repoId: string;
             }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+            readonly refresh: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+                projectId: string;
+                repoId: string;
+            }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
         };
     };
     readonly providers: {

package/dist/operator-contracts/control-plane-operations.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { defineOperation as define, defineTreeDxProxyOperation as treedxProxy } from "./operation-builder.js";
+import { defineOperation as define, defineTreeDxProxyOperation as treedxProxy, defineReadOperation as read } from "./operation-builder.js";
 import { communicationOperations, providerCommunicationLifecycleOperations, providerDiscussionResponseOperation } from "./catalog/communication-operations.js";
 import { inboxOperations } from "./catalog/inbox-operations.js";
 import { adminAccountOperations, adminTeamOperations } from "./catalog/admin-account-team-operations.js";
@@ -8,25 +8,10 @@ import { capabilityOntologyOperations } from "./catalog/capability-ontology-oper
 import { knowledgeShareOperations } from "./catalog/knowledge-share-operations.js";
 import { PROVIDER_ENVIRONMENT_OPERATIONS } from "./catalog/provider-environment-operations.js";
 import { HOSTED_TOPOLOGY_OPERATIONS } from "./catalog/hosted-topology-operations.js";
+import { AI_INSTANCE_OPERATIONS } from "./catalog/infrastructure/ai-instance-operations.js";
 import { SECRET_OPERATIONS } from "./catalog/services/secret-operations.js";
 import { buildControlPlaneCatalog, flattenControlPlaneOperations } from "./catalog/control-plane-catalog.js";
 const empty = z.object({}).strict(), none = z.undefined(), record = z.record(z.unknown()), payload = record;
-function read(operationId, path, capability, surfaces = ["rest"]) {
-  return define({
-    operationId,
-    description: `Read ${operationId}.`,
-    rest: { method: "GET", path },
-    capability,
-    authentication: "oauth",
-    oauthScopes: ["treeseed:read"],
-    kind: "read",
-    riskClass: "ordinary",
-    confirmation: "never",
-    surfaces,
-    cacheScope: "principal",
-    pagination: "none"
-  }, { path: empty, query: empty, body: none, output: payload });
-}
 function providerPath(operationId, method, path, pathShape, options = {}) {
   const kind = options.read ? "read" : "mutation";
   return define({
@@ -101,6 +86,7 @@ function resource(operationId, method, path, pathShape, options = { capability:
   }, { path: z.object(pathShape).strict(), query: kind === "read" ? record : empty, body: kind === "read" ? none : record, output: payload });
 }
 const CONTROL_PLANE_OPERATIONS = {
+  aiInstances: AI_INSTANCE_OPERATIONS,
   infrastructure: { topology: HOSTED_TOPOLOGY_OPERATIONS },
   capabilities: capabilityOntologyOperations(),
   inbox: inboxOperations(),
@@ -455,7 +441,8 @@ const CONTROL_PLANE_OPERATIONS = {
       remove: treedxProxy("treedx.repositories.artifacts.delete", "deleteArtifact", "DELETE", "/v1/dx/projects/{projectId}/repos/{repoId}/artifacts/{artifactId}", { projectId: z.string().min(1), repoId: z.string().min(1), artifactId: z.string().min(1) }, { risk: "destructive" })
     },
     searchIndex: {
-      status: treedxProxy("treedx.repositories.search.index.status", "getSearchIndexStatus", "GET", "/v1/dx/projects/{projectId}/repos/{repoId}/search-index", { projectId: z.string().min(1), repoId: z.string().min(1) })
+      status: treedxProxy("treedx.repositories.search.index.status", "getSearchIndexStatus", "GET", "/v1/dx/projects/{projectId}/repos/{repoId}/search-index", { projectId: z.string().min(1), repoId: z.string().min(1) }),
+      refresh: treedxProxy("treedx.repositories.search.index.refresh", "refreshSearchIndex", "POST", "/v1/dx/projects/{projectId}/repos/{repoId}/search-index/refresh", { projectId: z.string().min(1), repoId: z.string().min(1) })
     }
   },
   providers: {

package/dist/operator-contracts/operation-builder.d.ts

@@ -7,6 +7,7 @@ type Definition = Omit<ControlPlaneOperationDescriptor, 'schemaVersion' | 'schem
     concurrencyRequired?: boolean;
     authentication?: ControlPlaneOperationDescriptor['authentication'];
 };
+export declare function defineReadOperation(operationId: `${string}.${string}`, path: `/v1/${string}`, capability: string, surfaces?: ControlPlaneOperationDescriptor['surfaces']): ControlPlaneOperationBinding<{}, {}, undefined, Record<string, unknown>>;
 export declare function defineOperation<TPath, TQuery, TBody, TOutput>(definition: Definition, schema: ControlPlaneOperationBinding<TPath, TQuery, TBody, TOutput>['schema']): ControlPlaneOperationBinding<TPath, TQuery, TBody, TOutput>;
 export declare function defineTreeDxProxyOperation<T extends z.ZodRawShape>(operationId: `${string}.${string}`, upstreamOperationId: string | null, method: 'DELETE' | 'GET' | 'PATCH' | 'POST' | 'PUT', path: `/v1/${string}`, pathShape: T, options?: {
     read?: boolean;

package/dist/operator-contracts/operation-builder.js

@@ -3,6 +3,22 @@ import { TREEDX_OPENAPI_CONTRACT } from "@treeseed/treedx/openapi";
 import {
   CONTROL_PLANE_OPERATION_SCHEMA_VERSION
 } from "./control-plane-operation.js";
+function defineReadOperation(operationId, path, capability, surfaces = ["rest"]) {
+  return defineOperation({
+    operationId,
+    description: `Read ${operationId}.`,
+    rest: { method: "GET", path },
+    capability,
+    authentication: "oauth",
+    oauthScopes: ["treeseed:read"],
+    kind: "read",
+    riskClass: "ordinary",
+    confirmation: "never",
+    surfaces,
+    cacheScope: "principal",
+    pagination: "none"
+  }, { path: z.object({}).strict(), query: z.object({}).strict(), body: z.undefined(), output: z.record(z.unknown()) });
+}
 function defineOperation(definition, schema) {
   const { parameters, redactedPaths = [], idempotencyRequired, concurrencyRequired, ...descriptor } = definition;
   const mutation = definition.kind === "mutation";
@@ -57,5 +73,6 @@ function defineTreeDxProxyOperation(operationId, upstreamOperationId, method, pa
 }
 export {
   defineOperation,
+  defineReadOperation,
   defineTreeDxProxyOperation
 };

package/dist/secrets-capability/github-actions-encryption.js

@@ -1,5 +1,5 @@
-import sodium from "libsodium-wrappers-sumo";
 async function encryptGitHubActionsSecret(value, providerPublicKey) {
+  const { default: sodium } = await import("libsodium-wrappers-sumo");
   await sodium.ready;
   if (!value) throw new Error("GitHub Actions secret value is required.");
   const key = sodium.from_base64(providerPublicKey, sodium.base64_variants.ORIGINAL);

package/dist/secrets-capability/provider-operation-contracts.d.ts

@@ -1,6 +1,20 @@
 import type { CredentialAuthorityScheme, ServiceCapabilityType } from './service-provider-contracts.js';
 export declare const PROVIDER_ADAPTER_KINDS: readonly ["repository-hosting", "workflow-execution", "workflow-configuration", "object-storage", "webhook-ingress"];
 export type ProviderAdapterKind = (typeof PROVIDER_ADAPTER_KINDS)[number];
+/** Bounded delivery requirements attached to a workflow-execution binding.
+ * Values and vault login material never belong in this declaration.
+ */
+export type WorkflowConfigurationDeclaration = {
+    workflowPath: string;
+    repositoryBindingId: string;
+    kind: 'secrets' | 'variables';
+    scope: 'repository' | 'environment';
+    environment?: string | null;
+    names: string[];
+};
+export type WorkflowConfigurationPolicy = {
+    workflowConfiguration: WorkflowConfigurationDeclaration[];
+};
 export type ProviderCredentialAuthority = {
     id: string;
     teamId: string;

package/dist/secrets-capability/service-provider-contracts.d.ts

@@ -1,5 +1,5 @@
-export declare const SERVICE_PROVIDER_IDS: readonly ["github", "cloudflare", "railway"];
-export declare const SERVICE_CAPABILITY_TYPES: readonly ["repository-hosting", "workflow-execution", "workflow-configuration", "secret-enclave", "frontend-hosting", "backend-hosting", "dns-management", "object-storage", "state-encryption", "database-hosting", "capacity-runtime-hosting", "private-knowledge-index-hosting", "artifact-hosting"];
+export declare const SERVICE_PROVIDER_IDS: readonly ["github", "cloudflare", "railway", "hyperstack"];
+export declare const SERVICE_CAPABILITY_TYPES: readonly ["repository-hosting", "workflow-execution", "frontend-hosting", "backend-hosting", "dns-management", "object-storage", "state-encryption", "database-hosting", "capacity-runtime-hosting", "private-knowledge-index-hosting", "artifact-hosting", "ai-inference-hosting", "ai-training-hosting"];
 export declare const SERVICE_CONNECTION_STATUSES: readonly ["draft", "active", "degraded", "validation-failed", "reentry-required", "reauthorization-required", "disconnected"];
 export declare const SERVICE_CAPABILITY_STATUSES: readonly ["configured", "disabled", "blocked", "planned"];
 export type ServiceProviderId = (typeof SERVICE_PROVIDER_IDS)[number];
@@ -11,6 +11,8 @@ export type ServiceFieldDefinition = {
     label: string;
     description: string;
     required: boolean;
+    requiredForCapabilities?: ServiceCapabilityType[];
+    pattern?: string;
     sensitive: boolean;
     input: 'text' | 'password' | 'url';
     placeholder?: string;