@treeseed/sdk 0.13.0-rc.71 → 0.13.0-rc.72

package/dist/.treeseed-build-complete.json

@@ -1 +1 @@
-{"completedAt":"2026-09-02T02:46:28.673Z"}
+{"completedAt":"2026-09-02T02:59:22.984Z"}

package/dist/deployment/hosted-topology.d.ts

@@ -705,6 +705,7 @@ export declare const hostedTopologyRollbackSchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-rollback/v1">;
     rollbackId: z.ZodString;
     sourceReceiptId: z.ZodString;
+    environment: z.ZodEnum<["staging", "production"]>;
     operations: z.ZodArray<z.ZodObject<{
         resourceId: z.ZodString;
         action: z.ZodEnum<["restore", "delete-created", "noop"]>;
@@ -724,6 +725,7 @@ export declare const hostedTopologyRollbackSchema: z.ZodObject<{
     rollbackDigest: z.ZodString;
 }, "strict", z.ZodTypeAny, {
     schemaVersion: "treeseed.hosted-topology-rollback/v1";
+    environment: "production" | "staging";
     operations: {
         action: "noop" | "restore" | "delete-created";
         resourceId: string;
@@ -735,6 +737,7 @@ export declare const hostedTopologyRollbackSchema: z.ZodObject<{
     rollbackDigest: string;
 }, {
     schemaVersion: "treeseed.hosted-topology-rollback/v1";
+    environment: "production" | "staging";
     operations: {
         action: "noop" | "restore" | "delete-created";
         resourceId: string;
@@ -745,6 +748,28 @@ export declare const hostedTopologyRollbackSchema: z.ZodObject<{
     sourceReceiptId: string;
     rollbackDigest: string;
 }>;
+export declare const hostedTopologyRollbackApprovalSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-rollback-approval/v1">;
+    rollbackDigest: z.ZodString;
+    environment: z.ZodEnum<["staging", "production"]>;
+    decision: z.ZodLiteral<"approved">;
+    approvedBy: z.ZodString;
+    approvedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.hosted-topology-rollback-approval/v1";
+    environment: "production" | "staging";
+    decision: "approved";
+    approvedBy: string;
+    approvedAt: string;
+    rollbackDigest: string;
+}, {
+    schemaVersion: "treeseed.hosted-topology-rollback-approval/v1";
+    environment: "production" | "staging";
+    decision: "approved";
+    approvedBy: string;
+    approvedAt: string;
+    rollbackDigest: string;
+}>;
 export type HostedTopologyDeclaration = z.infer<typeof hostedTopologyDeclarationSchema>;
 export type HostedResourceObservation = z.infer<typeof hostedResourceObservationSchema>;
 export type HostedTopologyPlan = z.infer<typeof hostedTopologyPlanSchema>;
@@ -765,6 +790,7 @@ export declare function verifyHostedTopologyReadback(input: {
 }): HostedTopologyReceipt;
 export declare function planHostedTopologyRollback(receiptInput: HostedTopologyReceipt): {
     schemaVersion: "treeseed.hosted-topology-rollback/v1";
+    environment: "production" | "staging";
     operations: {
         action: "noop" | "restore" | "delete-created";
         resourceId: string;
@@ -775,3 +801,26 @@ export declare function planHostedTopologyRollback(receiptInput: HostedTopologyR
     sourceReceiptId: string;
     rollbackDigest: string;
 };
+export declare function authorizeHostedTopologyRollback(rollbackInput: z.input<typeof hostedTopologyRollbackSchema>, approvalInput: z.input<typeof hostedTopologyRollbackApprovalSchema>): {
+    rollback: {
+        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        environment: "production" | "staging";
+        operations: {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }[];
+        rollbackId: string;
+        sourceReceiptId: string;
+        rollbackDigest: string;
+    };
+    approval: {
+        schemaVersion: "treeseed.hosted-topology-rollback-approval/v1";
+        environment: "production" | "staging";
+        decision: "approved";
+        approvedBy: string;
+        approvedAt: string;
+        rollbackDigest: string;
+    };
+};

package/dist/deployment/hosted-topology.js

@@ -113,6 +113,7 @@ const hostedTopologyRollbackSchema = z.object({
   schemaVersion: z.literal("treeseed.hosted-topology-rollback/v1"),
   rollbackId: z.string().regex(/^topology-rollback-[a-f0-9]{16}$/u),
   sourceReceiptId: z.string().regex(/^topology-receipt-[a-f0-9]{16}$/u),
+  environment: z.enum(["staging", "production"]),
   operations: z.array(z.object({
     resourceId: identifier,
     action: z.enum(["restore", "delete-created", "noop"]),
@@ -121,6 +122,14 @@ const hostedTopologyRollbackSchema = z.object({
   }).strict()),
   rollbackDigest: digest
 }).strict();
+const hostedTopologyRollbackApprovalSchema = z.object({
+  schemaVersion: z.literal("treeseed.hosted-topology-rollback-approval/v1"),
+  rollbackDigest: digest,
+  environment: z.enum(["staging", "production"]),
+  decision: z.literal("approved"),
+  approvedBy: z.string().min(1).max(256),
+  approvedAt: timestamp
+}).strict();
 function observationMap(items, declaration) {
   const resources = new Map(declaration.resources.map((resource) => [resource.id, resource]));
   const observations = /* @__PURE__ */ new Map();
@@ -211,10 +220,16 @@ function planHostedTopologyRollback(receiptInput) {
     return { resourceId: resource.resourceId, action: !prior || prior.state === "missing" ? "delete-created" : prior.observedDigest === resource.observedDigest ? "noop" : "restore", providerResourceId: resource.providerResourceId, targetDigest: prior?.observedDigest ?? null };
   }).sort((left, right) => left.resourceId.localeCompare(right.resourceId));
   const rollbackDigest = deploymentDigest({ sourceReceiptId: receipt.receiptId, operations });
-  return hostedTopologyRollbackSchema.parse({ schemaVersion: "treeseed.hosted-topology-rollback/v1", rollbackId: `topology-rollback-${rollbackDigest.slice(7, 23)}`, sourceReceiptId: receipt.receiptId, operations, rollbackDigest });
+  return hostedTopologyRollbackSchema.parse({ schemaVersion: "treeseed.hosted-topology-rollback/v1", rollbackId: `topology-rollback-${rollbackDigest.slice(7, 23)}`, sourceReceiptId: receipt.receiptId, environment: receipt.environment, operations, rollbackDigest });
+}
+function authorizeHostedTopologyRollback(rollbackInput, approvalInput) {
+  const rollback = hostedTopologyRollbackSchema.parse(rollbackInput), approval = hostedTopologyRollbackApprovalSchema.parse(approvalInput);
+  if (approval.rollbackDigest !== rollback.rollbackDigest || approval.environment !== rollback.environment) throw new Error("Hosted topology rollback approval does not bind the exact rollback and environment.");
+  return { rollback, approval };
 }
 export {
   authorizeHostedTopologyPlan,
+  authorizeHostedTopologyRollback,
   authorizedHostedTopologyPlanSchema,
   hostedProviderSchema,
   hostedResourceKindSchema,
@@ -223,6 +238,7 @@ export {
   hostedTopologyDeclarationSchema,
   hostedTopologyPlanSchema,
   hostedTopologyReceiptSchema,
+  hostedTopologyRollbackApprovalSchema,
   hostedTopologyRollbackSchema,
   planHostedTopology,
   planHostedTopologyRollback,

package/dist/operator-contracts/canonical-command-tree.js

@@ -34,6 +34,10 @@ const operationBindings = {
   "platform verify": local("local.platform.verify"),
   "platform workset": local("local.platform.workset"),
   "platform project create": local("local.platform.project.create"),
+  "platform topology plan": local("local.platform.topology.plan"),
+  "platform topology apply": local("local.platform.topology.apply"),
+  "platform topology status": local("local.platform.topology.status"),
+  "platform topology rollback": local("local.platform.topology.rollback"),
   "host status": local("local.host.status"),
   "host doctor": local("local.host.doctor"),
   "host plan": local("local.host.plan"),
@@ -358,6 +362,12 @@ const commandTree = {
       { nodeType: "leaf", segment: "workset", description: "Plan or safely materialize exact primary source checkouts beneath packages/.", kind: "mutation", options: [planOption, { name: "--apply", description: "Apply the frozen workset plan.", type: "boolean" }, { name: "--yes", description: "Confirm the planned checkout mutations.", type: "boolean" }, { name: "--profile", description: "Composable source profile; repeat to union profiles.", type: "string[]" }, { name: "--project", description: "Explicit project slug; repeat to select projects.", type: "string[]" }, { name: "--exclude", description: "Project slug to exclude; repeat as needed.", type: "string[]" }, { name: "--json", description: "Emit the stable command-result envelope.", type: "boolean" }], authorization: { capability: "development.workset", confirmation: "never" }, resultSchemaId: "treeseed.platform-workset-result/v1", execution: local("local.platform.workset") },
       branch("project", [
         { nodeType: "leaf", segment: "create", description: "Plan or reconcile a project, repository, template, library binding, and live inventory without writing application source into Platform Git.", kind: "mutation", arguments: [{ name: "slug", description: "Portable project slug.", required: true }], options: [planOption, { name: "--apply", description: "Apply the accepted creation plan.", type: "boolean" }, { name: "--yes", description: "Confirm authority-bearing project creation.", type: "boolean" }, { name: "--template", description: "Published template identity.", type: "string", required: true }, { name: "--json", description: "Emit the stable command-result envelope.", type: "boolean" }], authorization: { capability: "projects.create", confirmation: "authority" }, resultSchemaId: "treeseed.platform-project-create-result/v1", execution: local("local.platform.project.create") }
+      ]),
+      branch("topology", [
+        { nodeType: "leaf", segment: "plan", description: "Plan Cloudflare and Railway reconciliation from a portable hosted-topology declaration.", kind: "read", arguments: [{ name: "file", description: "Hosted topology YAML or JSON declaration.", required: true }], resultSchemaId: "treeseed.hosted-topology-plan/v1", execution: local("local.platform.topology.plan") },
+        { nodeType: "leaf", segment: "apply", description: "Apply an exact reviewed hosted-topology plan through the operations runner.", kind: "mutation", arguments: [{ name: "plan", description: "Exact plan JSON file.", required: true }], options: [planOption, { name: "--approval", description: "Exact environment approval JSON file.", type: "string", required: true }, { name: "--yes", description: "Confirm the authority-bearing mutation.", type: "boolean" }], authorization: { capability: "infrastructure.write", confirmation: "authority" }, resultSchemaId: "treeseed.platform-operation/v1", execution: local("local.platform.topology.apply") },
+        { nodeType: "leaf", segment: "status", description: "Read the latest hosted-topology operation and known-good receipt.", kind: "read", resultSchemaId: "treeseed.infrastructure.topology.status.output/v1", execution: local("local.platform.topology.status") },
+        { nodeType: "leaf", segment: "rollback", description: "Restore exact prior hosted-topology state from a known-good receipt.", kind: "mutation", arguments: [{ name: "rollback", description: "Exact rollback JSON file.", required: true }], options: [planOption, { name: "--approval", description: "Exact rollback approval JSON file.", type: "string", required: true }, { name: "--yes", description: "Confirm the destructive rollback.", type: "boolean" }], authorization: { capability: "infrastructure.write", confirmation: "destructive" }, resultSchemaId: "treeseed.platform-operation/v1", execution: local("local.platform.topology.rollback") }
       ])
     ]),
     branch("dev", [

package/dist/operator-contracts/catalog/hosted-topology-operations.d.ts

@@ -0,0 +1,168 @@
+export declare const HOSTED_TOPOLOGY_OPERATIONS: {
+    readonly plan: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
+        teamId: string;
+    }, {}, {
+        declaration: {
+            schemaVersion: "treeseed.hosted-topology/v1";
+            resources: {
+                id: string;
+                kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                provider: "cloudflare" | "railway";
+                adoption: {
+                    mode: "adopt-or-create";
+                    replacement: "forbidden";
+                    externalIdInput?: string | undefined;
+                };
+                dependsOn?: string[] | undefined;
+                parameters?: Record<string, {
+                    input: string;
+                } | {
+                    artifact: string;
+                } | {
+                    resourceOutput: {
+                        resourceId: string;
+                        output: string;
+                    };
+                } | {
+                    literal: string | number | boolean;
+                }> | undefined;
+            }[];
+            id: string;
+            platform: {
+                repository: "treeseed-ai/platform";
+                commit: string;
+            };
+            mutation: "approval-required";
+            environment: "production" | "staging";
+            artifacts: Record<string, {
+                digest: string;
+                source: string;
+            }>;
+            providerConnections: Partial<Record<"cloudflare" | "railway", {
+                connectionRef: string;
+            }>>;
+        };
+    }, {
+        schemaVersion: "treeseed.hosted-topology-plan/v1";
+        blockers: {
+            code: "connection-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+            message: string;
+            resourceId?: string | undefined;
+        }[];
+        planDigest: string;
+        actions: {
+            action: "noop" | "create" | "adopt" | "update";
+            resourceId: string;
+            kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+            provider: "cloudflare" | "railway";
+            providerResourceId: string | null;
+            desiredDigest: string;
+            previousDigest: string | null;
+        }[];
+        environment: "production" | "staging";
+        executable: false;
+        planId: string;
+        declarationDigest: string;
+        topologyId: string;
+        platformCommit: string;
+        approvalRequired: boolean;
+    }>;
+    readonly apply: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
+        teamId: string;
+    }, {}, {
+        approval: {
+            schemaVersion: "treeseed.hosted-topology-approval/v1";
+            planDigest: string;
+            environment: "production" | "staging";
+            decision: "approved";
+            approvedBy: string;
+            approvedAt: string;
+        };
+        plan: {
+            schemaVersion: "treeseed.hosted-topology-plan/v1";
+            blockers: {
+                code: "connection-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+                message: string;
+                resourceId?: string | undefined;
+            }[];
+            planDigest: string;
+            actions: {
+                action: "noop" | "create" | "adopt" | "update";
+                resourceId: string;
+                kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                provider: "cloudflare" | "railway";
+                providerResourceId: string | null;
+                desiredDigest: string;
+                previousDigest: string | null;
+            }[];
+            environment: "production" | "staging";
+            executable: false;
+            planId: string;
+            declarationDigest: string;
+            topologyId: string;
+            platformCommit: string;
+            approvalRequired: boolean;
+        };
+    }, Record<string, unknown>>;
+    readonly status: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
+        teamId: string;
+    }, {}, undefined, {
+        operation: Record<string, unknown> | null;
+        receipt: {
+            schemaVersion: "treeseed.hosted-topology-receipt/v1";
+            resources: {
+                state: "missing" | "degraded" | "healthy";
+                resourceId: string;
+                kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                provider: "cloudflare" | "railway";
+                providerResourceId: string | null;
+                managedBy: "external" | "treeseed" | null;
+                observedDigest: string | null;
+                observedAt: string;
+            }[];
+            planDigest: string;
+            state: "known-good";
+            environment: "production" | "staging";
+            completedAt: string;
+            receiptId: string;
+            declarationDigest: string;
+            topologyId: string;
+            platformCommit: string;
+            previousResources: {
+                state: "missing" | "degraded" | "healthy";
+                resourceId: string;
+                kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                provider: "cloudflare" | "railway";
+                providerResourceId: string | null;
+                managedBy: "external" | "treeseed" | null;
+                observedDigest: string | null;
+                observedAt: string;
+            }[];
+        } | null;
+    }>;
+    readonly rollback: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
+        teamId: string;
+    }, {}, {
+        rollback: {
+            schemaVersion: "treeseed.hosted-topology-rollback/v1";
+            environment: "production" | "staging";
+            operations: {
+                action: "noop" | "restore" | "delete-created";
+                resourceId: string;
+                providerResourceId: string;
+                targetDigest: string | null;
+            }[];
+            rollbackId: string;
+            sourceReceiptId: string;
+            rollbackDigest: string;
+        };
+        approval: {
+            schemaVersion: "treeseed.hosted-topology-rollback-approval/v1";
+            environment: "production" | "staging";
+            decision: "approved";
+            approvedBy: string;
+            approvedAt: string;
+            rollbackDigest: string;
+        };
+    }, Record<string, unknown>>;
+};

package/dist/operator-contracts/catalog/hosted-topology-operations.js

@@ -0,0 +1,77 @@
+import { z } from "zod";
+import { hostedTopologyApprovalSchema, hostedTopologyDeclarationSchema, hostedTopologyPlanSchema, hostedTopologyReceiptSchema, hostedTopologyRollbackApprovalSchema, hostedTopologyRollbackSchema } from "../../deployment/hosted-topology.js";
+import { defineOperation } from "../operation-builder.js";
+const teamPath = z.object({ teamId: z.string().min(1) }).strict();
+const empty = z.object({}).strict();
+const none = z.undefined();
+const operationReceipt = z.record(z.unknown());
+const HOSTED_TOPOLOGY_OPERATIONS = {
+  plan: defineOperation({
+    operationId: "infrastructure.topology.plan",
+    description: "Plan exact hosted topology reconciliation from authoritative provider observations.",
+    rest: { method: "POST", path: "/v1/teams/{teamId}/infrastructure/topology/plan" },
+    parameters: "treeseed.infrastructure.topology.plan.parameters/v1",
+    capability: "infrastructure.read",
+    authentication: "oauth",
+    oauthScopes: ["treeseed:read"],
+    kind: "read",
+    riskClass: "ordinary",
+    confirmation: "never",
+    surfaces: ["rest", "cli"],
+    cacheScope: "none",
+    pagination: "none",
+    idempotencyRequired: false
+  }, { path: teamPath, query: empty, body: z.object({ declaration: hostedTopologyDeclarationSchema }).strict(), output: hostedTopologyPlanSchema }),
+  apply: defineOperation({
+    operationId: "infrastructure.topology.apply",
+    description: "Apply an exact approved hosted topology plan through the operations runner.",
+    rest: { method: "POST", path: "/v1/teams/{teamId}/infrastructure/topology/apply" },
+    parameters: "treeseed.infrastructure.topology.apply.parameters/v1",
+    capability: "infrastructure.write",
+    authentication: "oauth",
+    oauthScopes: ["treeseed:admin"],
+    kind: "mutation",
+    riskClass: "authority",
+    confirmation: "input_required",
+    surfaces: ["rest", "cli"],
+    cacheScope: "none",
+    pagination: "none",
+    concurrencyRequired: true,
+    redactedPaths: ["body.approval.approvedBy"]
+  }, { path: teamPath, query: empty, body: z.object({ plan: hostedTopologyPlanSchema, approval: hostedTopologyApprovalSchema }).strict(), output: operationReceipt }),
+  status: defineOperation({
+    operationId: "infrastructure.topology.status",
+    description: "Read the latest authoritative hosted topology receipt and operation state.",
+    rest: { method: "GET", path: "/v1/teams/{teamId}/infrastructure/topology" },
+    parameters: "treeseed.infrastructure.topology.status.parameters/v1",
+    capability: "infrastructure.read",
+    authentication: "oauth",
+    oauthScopes: ["treeseed:read"],
+    kind: "read",
+    riskClass: "ordinary",
+    confirmation: "never",
+    surfaces: ["rest", "cli"],
+    cacheScope: "principal",
+    pagination: "none"
+  }, { path: teamPath, query: empty, body: none, output: z.object({ receipt: hostedTopologyReceiptSchema.nullable(), operation: operationReceipt.nullable() }).strict() }),
+  rollback: defineOperation({
+    operationId: "infrastructure.topology.rollback",
+    description: "Restore exact prior hosted topology lineage from a known-good receipt.",
+    rest: { method: "POST", path: "/v1/teams/{teamId}/infrastructure/topology/rollback" },
+    parameters: "treeseed.infrastructure.topology.rollback.parameters/v1",
+    capability: "infrastructure.write",
+    authentication: "oauth",
+    oauthScopes: ["treeseed:admin"],
+    kind: "mutation",
+    riskClass: "destructive",
+    confirmation: "input_required",
+    surfaces: ["rest", "cli"],
+    cacheScope: "none",
+    pagination: "none",
+    concurrencyRequired: true,
+    redactedPaths: ["body.approval.approvedBy"]
+  }, { path: teamPath, query: empty, body: z.object({ rollback: hostedTopologyRollbackSchema, approval: hostedTopologyRollbackApprovalSchema }).strict(), output: operationReceipt })
+};
+export {
+  HOSTED_TOPOLOGY_OPERATIONS
+};

package/dist/operator-contracts/control-plane-operations.d.ts

@@ -1,5 +1,175 @@
 import type { ControlPlaneOperationDescriptor } from './control-plane-operation.js';
 export declare const CONTROL_PLANE_OPERATIONS: {
+    readonly infrastructure: {
+        readonly topology: {
+            readonly plan: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+                teamId: string;
+            }, {}, {
+                declaration: {
+                    schemaVersion: "treeseed.hosted-topology/v1";
+                    resources: {
+                        id: string;
+                        kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                        provider: "cloudflare" | "railway";
+                        adoption: {
+                            mode: "adopt-or-create";
+                            replacement: "forbidden";
+                            externalIdInput?: string | undefined;
+                        };
+                        dependsOn?: string[] | undefined;
+                        parameters?: Record<string, {
+                            input: string;
+                        } | {
+                            artifact: string;
+                        } | {
+                            resourceOutput: {
+                                resourceId: string;
+                                output: string;
+                            };
+                        } | {
+                            literal: string | number | boolean;
+                        }> | undefined;
+                    }[];
+                    id: string;
+                    platform: {
+                        repository: "treeseed-ai/platform";
+                        commit: string;
+                    };
+                    mutation: "approval-required";
+                    environment: "production" | "staging";
+                    artifacts: Record<string, {
+                        digest: string;
+                        source: string;
+                    }>;
+                    providerConnections: Partial<Record<"cloudflare" | "railway", {
+                        connectionRef: string;
+                    }>>;
+                };
+            }, {
+                schemaVersion: "treeseed.hosted-topology-plan/v1";
+                blockers: {
+                    code: "connection-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+                    message: string;
+                    resourceId?: string | undefined;
+                }[];
+                planDigest: string;
+                actions: {
+                    action: "noop" | "create" | "adopt" | "update";
+                    resourceId: string;
+                    kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                    provider: "cloudflare" | "railway";
+                    providerResourceId: string | null;
+                    desiredDigest: string;
+                    previousDigest: string | null;
+                }[];
+                environment: "production" | "staging";
+                executable: false;
+                planId: string;
+                declarationDigest: string;
+                topologyId: string;
+                platformCommit: string;
+                approvalRequired: boolean;
+            }>;
+            readonly apply: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+                teamId: string;
+            }, {}, {
+                approval: {
+                    schemaVersion: "treeseed.hosted-topology-approval/v1";
+                    planDigest: string;
+                    environment: "production" | "staging";
+                    decision: "approved";
+                    approvedBy: string;
+                    approvedAt: string;
+                };
+                plan: {
+                    schemaVersion: "treeseed.hosted-topology-plan/v1";
+                    blockers: {
+                        code: "connection-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+                        message: string;
+                        resourceId?: string | undefined;
+                    }[];
+                    planDigest: string;
+                    actions: {
+                        action: "noop" | "create" | "adopt" | "update";
+                        resourceId: string;
+                        kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                        provider: "cloudflare" | "railway";
+                        providerResourceId: string | null;
+                        desiredDigest: string;
+                        previousDigest: string | null;
+                    }[];
+                    environment: "production" | "staging";
+                    executable: false;
+                    planId: string;
+                    declarationDigest: string;
+                    topologyId: string;
+                    platformCommit: string;
+                    approvalRequired: boolean;
+                };
+            }, Record<string, unknown>>;
+            readonly status: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+                teamId: string;
+            }, {}, undefined, {
+                operation: Record<string, unknown> | null;
+                receipt: {
+                    schemaVersion: "treeseed.hosted-topology-receipt/v1";
+                    resources: {
+                        state: "missing" | "degraded" | "healthy";
+                        resourceId: string;
+                        kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                        provider: "cloudflare" | "railway";
+                        providerResourceId: string | null;
+                        managedBy: "external" | "treeseed" | null;
+                        observedDigest: string | null;
+                        observedAt: string;
+                    }[];
+                    planDigest: string;
+                    state: "known-good";
+                    environment: "production" | "staging";
+                    completedAt: string;
+                    receiptId: string;
+                    declarationDigest: string;
+                    topologyId: string;
+                    platformCommit: string;
+                    previousResources: {
+                        state: "missing" | "degraded" | "healthy";
+                        resourceId: string;
+                        kind: "admin-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                        provider: "cloudflare" | "railway";
+                        providerResourceId: string | null;
+                        managedBy: "external" | "treeseed" | null;
+                        observedDigest: string | null;
+                        observedAt: string;
+                    }[];
+                } | null;
+            }>;
+            readonly rollback: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+                teamId: string;
+            }, {}, {
+                rollback: {
+                    schemaVersion: "treeseed.hosted-topology-rollback/v1";
+                    environment: "production" | "staging";
+                    operations: {
+                        action: "noop" | "restore" | "delete-created";
+                        resourceId: string;
+                        providerResourceId: string;
+                        targetDigest: string | null;
+                    }[];
+                    rollbackId: string;
+                    sourceReceiptId: string;
+                    rollbackDigest: string;
+                };
+                approval: {
+                    schemaVersion: "treeseed.hosted-topology-rollback-approval/v1";
+                    environment: "production" | "staging";
+                    decision: "approved";
+                    approvedBy: string;
+                    approvedAt: string;
+                    rollbackDigest: string;
+                };
+            }, Record<string, unknown>>;
+        };
+    };
     readonly capabilities: {
         list: import("./control-plane-operation.js").ControlPlaneOperationBinding<{}, {
             status?: "revoked" | "active" | "deprecated" | undefined;

package/dist/operator-contracts/control-plane-operations.js

@@ -7,11 +7,9 @@ import { TREEAI_CONTROL_PLANE_OPERATIONS } from "./catalog/treeai-operations.js"
 import { capabilityOntologyOperations } from "./catalog/capability-ontology-operations.js";
 import { knowledgeShareOperations } from "./catalog/knowledge-share-operations.js";
 import { PROVIDER_ENVIRONMENT_OPERATIONS } from "./catalog/provider-environment-operations.js";
+import { HOSTED_TOPOLOGY_OPERATIONS } from "./catalog/hosted-topology-operations.js";
 import { buildControlPlaneCatalog, flattenControlPlaneOperations } from "./catalog/control-plane-catalog.js";
-const empty = z.object({}).strict();
-const none = z.undefined();
-const record = z.record(z.unknown());
-const payload = record;
+const empty = z.object({}).strict(), none = z.undefined(), record = z.record(z.unknown()), payload = record;
 function read(operationId, path, capability, surfaces = ["rest"]) {
   return define({
     operationId,
@@ -102,6 +100,7 @@ function resource(operationId, method, path, pathShape, options = { capability:
   }, { path: z.object(pathShape).strict(), query: kind === "read" ? record : empty, body: kind === "read" ? none : record, output: payload });
 }
 const CONTROL_PLANE_OPERATIONS = {
+  infrastructure: { topology: HOSTED_TOPOLOGY_OPERATIONS },
   capabilities: capabilityOntologyOperations(),
   inbox: inboxOperations(),
   treeai: TREEAI_CONTROL_PLANE_OPERATIONS,

package/dist/secrets-capability/service-provider-contracts.js

@@ -117,14 +117,14 @@ const SERVICE_PROVIDER_CATALOG = [
     knowledgePageIds: ["provider.cloudflare"],
     connectionFields: [field("accountId", "Account ID", "The non-secret Cloudflare account identifier.")],
     capabilities: [
-      { type: "frontend-hosting", label: "Frontend hosting", description: "Future Pages and Workers application hosting.", credentialProfileIds: ["cloudflare-runtime"], status: "available" },
-      { type: "dns-management", label: "DNS management", description: "Future scoped DNS record management.", credentialProfileIds: ["cloudflare-dns"], status: "planned" },
+      { type: "frontend-hosting", label: "Frontend hosting", description: "Pages and Workers application hosting.", credentialProfileIds: ["cloudflare-runtime"], status: "available" },
+      { type: "dns-management", label: "DNS management", description: "Scoped DNS record management.", credentialProfileIds: ["cloudflare-dns"], status: "available" },
       { type: "object-storage", label: "Object storage", description: "R2-backed immutable publication and private artifact storage.", credentialProfileIds: ["cloudflare-storage"], status: "available" }
     ],
     credentialProfiles: [
-      { id: "cloudflare-runtime", label: "Pages and Workers token", description: "A token limited to application deployment resources.", capabilities: ["frontend-hosting"], fields: [field("apiToken", "API token", "Encrypted in this browser and used only for authorized frontend operations.", true, true)], permissions: ["Account: Workers Scripts Edit", "Account: Pages Edit"], sharing: "capability-scoped", unattendedCompatible: false, knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
-      { id: "cloudflare-dns", label: "DNS token", description: "A token restricted to selected zones.", capabilities: ["dns-management"], fields: [field("apiToken", "DNS API token", "Encrypted separately from deployment authority.", true, true)], permissions: ["Zone: DNS Edit for only the managed zones"], sharing: "capability-scoped", unattendedCompatible: false, knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
-      { id: "cloudflare-storage", label: "Storage token", description: "A token limited to R2 resources.", capabilities: ["object-storage"], fields: [field("apiToken", "Storage API token", "Encrypted separately from runtime and DNS authority.", true, true)], permissions: ["Account: Workers R2 Storage Edit"], sharing: "capability-scoped", unattendedCompatible: false, knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] }
+      { id: "cloudflare-runtime", label: "Pages and Workers token", description: "A token limited to application deployment resources.", capabilities: ["frontend-hosting"], fields: [field("apiToken", "API token", "Encrypted in this browser and used only for authorized frontend operations.", true, true)], permissions: ["Account: Workers Scripts Edit", "Account: Pages Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
+      { id: "cloudflare-dns", label: "DNS token", description: "A token restricted to selected zones.", capabilities: ["dns-management"], fields: [field("apiToken", "DNS API token", "Encrypted separately from deployment authority.", true, true)], permissions: ["Zone: DNS Edit for only the managed zones"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
+      { id: "cloudflare-storage", label: "Storage token", description: "A token limited to R2 resources.", capabilities: ["object-storage"], fields: [field("apiToken", "Storage API token", "Encrypted separately from runtime and DNS authority.", true, true)], permissions: ["Account: Workers R2 Storage Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] }
     ]
   },
   {
@@ -136,10 +136,10 @@ const SERVICE_PROVIDER_CATALOG = [
     knowledgePageIds: ["provider.railway"],
     connectionFields: [field("workspaceId", "Workspace ID", "The non-secret Railway workspace identifier.")],
     capabilities: [
-      { type: "backend-hosting", label: "Backend hosting", description: "Future API and backend service hosting.", credentialProfileIds: ["railway-workspace"], status: "available" },
-      { type: "database-hosting", label: "Database hosting", description: "Future managed database placement.", credentialProfileIds: ["railway-workspace"], status: "planned" },
+      { type: "backend-hosting", label: "Backend hosting", description: "API and backend service hosting.", credentialProfileIds: ["railway-workspace"], status: "available" },
+      { type: "database-hosting", label: "Database hosting", description: "Managed database placement.", credentialProfileIds: ["railway-workspace"], status: "available" },
       { type: "capacity-runtime-hosting", label: "Capacity runtime hosting", description: "Future capacity provider placement.", credentialProfileIds: ["railway-workspace"], status: "planned" },
-      { type: "private-knowledge-index-hosting", label: "Private knowledge hosting", description: "Future private TreeDX knowledge-plane placement.", credentialProfileIds: ["railway-workspace"], status: "planned" }
+      { type: "private-knowledge-index-hosting", label: "Private knowledge hosting", description: "Private TreeDX knowledge-plane placement.", credentialProfileIds: ["railway-workspace"], status: "available" }
     ],
     credentialProfiles: [{
       id: "railway-workspace",
@@ -149,7 +149,8 @@ const SERVICE_PROVIDER_CATALOG = [
       fields: [field("apiToken", "Workspace token", "Encrypted in this browser. TreeSeed will request explicit authorization before interactive use.", true, true)],
       permissions: ["Workspace access required by the selected operations"],
       sharing: "provider-shared",
-      unattendedCompatible: false,
+      unattendedCompatible: true,
+      authoritySchemes: ["environment-reference", "external-vault", "workload-identity"],
       knowledgePageIds: ["provider.railway", "services.credentials", "vault.rotation"]
     }]
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.71",
+  "version": "0.13.0-rc.72",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {