@treeseed/sdk 0.13.0-rc.75 → 0.13.0-rc.77

package/dist/.treeseed-build-complete.json

@@ -1 +1 @@
-{"completedAt":"2026-09-02T03:41:16.944Z"}
+{"completedAt":"2026-09-02T05:04:54.660Z"}

package/dist/deployment/hosted-topology.d.ts

@@ -1493,12 +1493,175 @@ export declare const hostedTopologyRollbackApprovalSchema: z.ZodObject<{
     approvedAt: string;
     rollbackDigest: string;
 }>;
+export declare const hostedTopologyRollbackExecutionSchema: z.ZodEffects<z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-rollback-execution/v1">;
+    rollback: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-rollback/v1">;
+        rollbackId: z.ZodString;
+        sourceReceiptId: z.ZodString;
+        environment: z.ZodEnum<["staging", "production"]>;
+        operations: z.ZodArray<z.ZodObject<{
+            resourceId: z.ZodString;
+            action: z.ZodEnum<["restore", "delete-created", "noop"]>;
+            providerResourceId: z.ZodString;
+            targetDigest: z.ZodNullable<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }, {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }>, "many">;
+        rollbackDigest: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        environment: "production" | "staging";
+        operations: {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }[];
+        rollbackId: string;
+        sourceReceiptId: string;
+        rollbackDigest: string;
+    }, {
+        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        environment: "production" | "staging";
+        operations: {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }[];
+        rollbackId: string;
+        sourceReceiptId: string;
+        rollbackDigest: string;
+    }>;
+    sourceReceiptId: z.ZodString;
+    topologyId: z.ZodString;
+    environment: z.ZodEnum<["staging", "production"]>;
+    sourcePlanDigest: z.ZodString;
+    targetPlanDigest: z.ZodString;
+    executionDigest: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
+    environment: "production" | "staging";
+    rollback: {
+        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        environment: "production" | "staging";
+        operations: {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }[];
+        rollbackId: string;
+        sourceReceiptId: string;
+        rollbackDigest: string;
+    };
+    topologyId: string;
+    sourceReceiptId: string;
+    sourcePlanDigest: string;
+    targetPlanDigest: string;
+    executionDigest: string;
+}, {
+    schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
+    environment: "production" | "staging";
+    rollback: {
+        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        environment: "production" | "staging";
+        operations: {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }[];
+        rollbackId: string;
+        sourceReceiptId: string;
+        rollbackDigest: string;
+    };
+    topologyId: string;
+    sourceReceiptId: string;
+    sourcePlanDigest: string;
+    targetPlanDigest: string;
+    executionDigest: string;
+}>, {
+    schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
+    environment: "production" | "staging";
+    rollback: {
+        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        environment: "production" | "staging";
+        operations: {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }[];
+        rollbackId: string;
+        sourceReceiptId: string;
+        rollbackDigest: string;
+    };
+    topologyId: string;
+    sourceReceiptId: string;
+    sourcePlanDigest: string;
+    targetPlanDigest: string;
+    executionDigest: string;
+}, {
+    schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
+    environment: "production" | "staging";
+    rollback: {
+        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        environment: "production" | "staging";
+        operations: {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }[];
+        rollbackId: string;
+        sourceReceiptId: string;
+        rollbackDigest: string;
+    };
+    topologyId: string;
+    sourceReceiptId: string;
+    sourcePlanDigest: string;
+    targetPlanDigest: string;
+    executionDigest: string;
+}>;
+export declare const hostedTopologyRollbackExecutionApprovalSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-rollback-execution-approval/v1">;
+    executionDigest: z.ZodString;
+    environment: z.ZodEnum<["staging", "production"]>;
+    decision: z.ZodLiteral<"approved">;
+    approvedBy: z.ZodString;
+    approvedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: "treeseed.hosted-topology-rollback-execution-approval/v1";
+    environment: "production" | "staging";
+    decision: "approved";
+    approvedBy: string;
+    approvedAt: string;
+    executionDigest: string;
+}, {
+    schemaVersion: "treeseed.hosted-topology-rollback-execution-approval/v1";
+    environment: "production" | "staging";
+    decision: "approved";
+    approvedBy: string;
+    approvedAt: string;
+    executionDigest: string;
+}>;
 export type HostedTopologyDeclaration = z.infer<typeof hostedTopologyDeclarationSchema>;
 export type HostedResourceObservation = z.infer<typeof hostedResourceObservationSchema>;
 export type HostedTopologyPlan = z.infer<typeof hostedTopologyPlanSchema>;
 export type HostedTopologyApproval = z.infer<typeof hostedTopologyApprovalSchema>;
 export type AuthorizedHostedTopologyPlan = z.infer<typeof authorizedHostedTopologyPlanSchema>;
 export type HostedTopologyReceipt = z.infer<typeof hostedTopologyReceiptSchema>;
+export type HostedTopologyRollbackExecution = z.infer<typeof hostedTopologyRollbackExecutionSchema>;
 export declare function planHostedTopology(input: {
     declaration: HostedTopologyDeclaration;
     observations: HostedResourceObservation[];
@@ -1547,4 +1710,63 @@ export declare function authorizeHostedTopologyRollback(rollbackInput: z.input<t
         rollbackDigest: string;
     };
 };
+export declare function planHostedTopologyRollbackExecution(input: {
+    rollback: z.input<typeof hostedTopologyRollbackSchema>;
+    sourceReceipt: z.input<typeof hostedTopologyReceiptSchema>;
+    sourcePlan: z.input<typeof hostedTopologyPlanSchema> | z.input<typeof authorizedHostedTopologyPlanSchema>;
+    targetPlan: z.input<typeof hostedTopologyPlanSchema>;
+}): {
+    schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
+    environment: "production" | "staging";
+    rollback: {
+        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        environment: "production" | "staging";
+        operations: {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }[];
+        rollbackId: string;
+        sourceReceiptId: string;
+        rollbackDigest: string;
+    };
+    topologyId: string;
+    sourceReceiptId: string;
+    sourcePlanDigest: string;
+    targetPlanDigest: string;
+    executionDigest: string;
+};
+export declare function authorizeHostedTopologyRollbackExecution(executionInput: z.input<typeof hostedTopologyRollbackExecutionSchema>, approvalInput: z.input<typeof hostedTopologyRollbackExecutionApprovalSchema>): {
+    execution: {
+        schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
+        environment: "production" | "staging";
+        rollback: {
+            schemaVersion: "treeseed.hosted-topology-rollback/v1";
+            environment: "production" | "staging";
+            operations: {
+                action: "noop" | "restore" | "delete-created";
+                resourceId: string;
+                providerResourceId: string;
+                targetDigest: string | null;
+            }[];
+            rollbackId: string;
+            sourceReceiptId: string;
+            rollbackDigest: string;
+        };
+        topologyId: string;
+        sourceReceiptId: string;
+        sourcePlanDigest: string;
+        targetPlanDigest: string;
+        executionDigest: string;
+    };
+    approval: {
+        schemaVersion: "treeseed.hosted-topology-rollback-execution-approval/v1";
+        environment: "production" | "staging";
+        decision: "approved";
+        approvedBy: string;
+        approvedAt: string;
+        executionDigest: string;
+    };
+};
 export {};

package/dist/deployment/hosted-topology.js

@@ -169,6 +169,34 @@ const hostedTopologyRollbackApprovalSchema = z.object({
   approvedBy: z.string().min(1).max(256),
   approvedAt: timestamp
 }).strict();
+const hostedTopologyRollbackExecutionSchema = z.object({
+  schemaVersion: z.literal("treeseed.hosted-topology-rollback-execution/v1"),
+  rollback: hostedTopologyRollbackSchema,
+  sourceReceiptId: z.string().regex(/^topology-receipt-[a-f0-9]{16}$/u),
+  topologyId: identifier,
+  environment: z.enum(["staging", "production"]),
+  sourcePlanDigest: digest,
+  targetPlanDigest: digest,
+  executionDigest: digest
+}).strict().superRefine((execution, context) => {
+  const core = {
+    rollback: execution.rollback,
+    sourceReceiptId: execution.sourceReceiptId,
+    topologyId: execution.topologyId,
+    environment: execution.environment,
+    sourcePlanDigest: execution.sourcePlanDigest,
+    targetPlanDigest: execution.targetPlanDigest
+  };
+  if (deploymentDigest(core) !== execution.executionDigest) context.addIssue({ code: z.ZodIssueCode.custom, path: ["executionDigest"], message: "Hosted rollback execution digest does not bind its complete source and target closure." });
+});
+const hostedTopologyRollbackExecutionApprovalSchema = z.object({
+  schemaVersion: z.literal("treeseed.hosted-topology-rollback-execution-approval/v1"),
+  executionDigest: digest,
+  environment: z.enum(["staging", "production"]),
+  decision: z.literal("approved"),
+  approvedBy: z.string().min(1).max(256),
+  approvedAt: timestamp
+}).strict();
 function observationMap(items, declaration) {
   const resources = new Map(declaration.resources.map((resource) => [resource.id, resource]));
   const observations = /* @__PURE__ */ new Map();
@@ -289,9 +317,46 @@ function authorizeHostedTopologyRollback(rollbackInput, approvalInput) {
   if (approval.rollbackDigest !== rollback.rollbackDigest || approval.environment !== rollback.environment) throw new Error("Hosted topology rollback approval does not bind the exact rollback and environment.");
   return { rollback, approval };
 }
+function planHostedTopologyRollbackExecution(input) {
+  const rollback = hostedTopologyRollbackSchema.parse(input.rollback), sourceReceipt = hostedTopologyReceiptSchema.parse(input.sourceReceipt);
+  const sourcePlan = input.sourcePlan && typeof input.sourcePlan === "object" && "approval" in input.sourcePlan ? authorizedHostedTopologyPlanSchema.parse(input.sourcePlan) : hostedTopologyPlanSchema.parse(input.sourcePlan);
+  const targetPlan = hostedTopologyPlanSchema.parse(input.targetPlan);
+  if (sourceReceipt.receiptId !== rollback.sourceReceiptId || sourceReceipt.planDigest !== sourcePlan.planDigest) throw new Error("Hosted rollback execution source receipt is stale.");
+  if ([sourceReceipt.environment, sourcePlan.environment, targetPlan.environment].some((environment) => environment !== rollback.environment)) throw new Error("Hosted rollback execution environment does not match its source and target plans.");
+  if (sourceReceipt.topologyId !== sourcePlan.topologyId || sourcePlan.topologyId !== targetPlan.topologyId) throw new Error("Hosted rollback execution topology identity changed.");
+  const sourceActions = new Map(sourcePlan.actions.map((action) => [action.resourceId, action]));
+  const sourceResources = new Map(sourceReceipt.resources.map((resource) => [resource.resourceId, resource]));
+  const targetActions = new Map(targetPlan.actions.map((action) => [action.resourceId, action]));
+  if (sourceResources.size !== sourceActions.size || rollback.operations.length !== sourceActions.size || new Set(rollback.operations.map(({ resourceId }) => resourceId)).size !== sourceActions.size) throw new Error("Hosted rollback execution does not cover the complete source resource set.");
+  for (const operation of rollback.operations) {
+    const source = sourceActions.get(operation.resourceId), observed = sourceResources.get(operation.resourceId), target = targetActions.get(operation.resourceId);
+    if (!source || !observed || observed.providerResourceId !== operation.providerResourceId) throw new Error(`Hosted rollback execution source mismatch for ${operation.resourceId}.`);
+    if (operation.action === "delete-created") {
+      if (target) throw new Error(`Hosted rollback execution target must remove created resource ${operation.resourceId}.`);
+    } else if (!target || !operation.targetDigest || target.desiredDigest !== operation.targetDigest || target.provider !== source.provider || target.kind !== source.kind) {
+      throw new Error(`Hosted rollback execution target specification mismatch for ${operation.resourceId}.`);
+    }
+  }
+  if ([...targetActions.keys()].some((resourceId) => !sourceActions.has(resourceId))) throw new Error("Hosted rollback execution target introduces an unapproved resource.");
+  const core = {
+    rollback,
+    sourceReceiptId: sourceReceipt.receiptId,
+    topologyId: sourceReceipt.topologyId,
+    environment: rollback.environment,
+    sourcePlanDigest: sourcePlan.planDigest,
+    targetPlanDigest: targetPlan.planDigest
+  };
+  return hostedTopologyRollbackExecutionSchema.parse({ schemaVersion: "treeseed.hosted-topology-rollback-execution/v1", ...core, executionDigest: deploymentDigest(core) });
+}
+function authorizeHostedTopologyRollbackExecution(executionInput, approvalInput) {
+  const execution = hostedTopologyRollbackExecutionSchema.parse(executionInput), approval = hostedTopologyRollbackExecutionApprovalSchema.parse(approvalInput);
+  if (approval.executionDigest !== execution.executionDigest || approval.environment !== execution.environment) throw new Error("Hosted rollback execution approval does not bind the exact source, target, and environment.");
+  return { execution, approval };
+}
 export {
   authorizeHostedTopologyPlan,
   authorizeHostedTopologyRollback,
+  authorizeHostedTopologyRollbackExecution,
   authorizedHostedTopologyPlanSchema,
   hostedProviderSchema,
   hostedResourceKindSchema,
@@ -301,8 +366,11 @@ export {
   hostedTopologyPlanSchema,
   hostedTopologyReceiptSchema,
   hostedTopologyRollbackApprovalSchema,
+  hostedTopologyRollbackExecutionApprovalSchema,
+  hostedTopologyRollbackExecutionSchema,
   hostedTopologyRollbackSchema,
   planHostedTopology,
   planHostedTopologyRollback,
+  planHostedTopologyRollbackExecution,
   verifyHostedTopologyReadback
 };

package/dist/secrets-capability/service-provider-contracts.js

@@ -116,6 +116,7 @@ const SERVICE_PROVIDER_CATALOG = [
     description: "Connect a Cloudflare account with separately scoped capability tokens.",
     knowledgePageIds: ["provider.cloudflare"],
     connectionFields: [
+      field("deploymentEnvironment", "Deployment environment", "The exact TreeSeed deployment environment. Use staging or production; one connection must never span both."),
       field("accountId", "Account ID", "The non-secret Cloudflare account identifier."),
       field("zoneId", "Zone ID", "Optional non-secret zone identifier used by reviewed DNS and TLS topology resources.", false)
     ],
@@ -127,7 +128,7 @@ const SERVICE_PROVIDER_CATALOG = [
     credentialProfiles: [
       { id: "cloudflare-runtime", label: "Pages and Workers token", description: "A token limited to application deployment resources.", capabilities: ["frontend-hosting"], fields: [field("apiToken", "API token", "Encrypted in this browser and used only for authorized frontend operations.", true, true)], permissions: ["Account: Workers Scripts Edit", "Account: Pages Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
       { id: "cloudflare-dns", label: "DNS token", description: "A token restricted to selected zones.", capabilities: ["dns-management"], fields: [field("apiToken", "DNS API token", "Encrypted separately from deployment authority.", true, true)], permissions: ["Zone: DNS Edit for only the managed zones"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
-      { id: "cloudflare-storage", label: "Storage token", description: "A token limited to R2 resources.", capabilities: ["object-storage"], fields: [field("apiToken", "Storage API token", "Encrypted separately from runtime and DNS authority.", true, true)], permissions: ["Account: Workers R2 Storage Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] }
+      { id: "cloudflare-storage", label: "Storage authority", description: "Vault-custodied R2 management and S3-compatible state credentials, isolated from runtime and DNS authority.", capabilities: ["object-storage"], fields: [field("apiToken", "Storage API token", "Encrypted separately and used only to reconcile authorized R2 resources.", true, true), field("accessKeyId", "R2 access key ID", "Vault-custodied S3-compatible access key identifier for encrypted OpenTofu state.", true, true), field("secretAccessKey", "R2 secret access key", "Vault-custodied S3-compatible secret key for encrypted OpenTofu state.", true, true)], permissions: ["Account: Workers R2 Storage Edit", "Object read and write for only the managed state bucket"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] }
     ]
   },
   {
@@ -138,6 +139,7 @@ const SERVICE_PROVIDER_CATALOG = [
     description: "Connect a Railway workspace for future backend and private infrastructure.",
     knowledgePageIds: ["provider.railway"],
     connectionFields: [
+      field("deploymentEnvironment", "Deployment environment", "The exact TreeSeed deployment environment. Use staging or production; one connection must never span both."),
       field("workspaceId", "Workspace ID", "The non-secret Railway workspace identifier."),
       field("projectId", "Project ID", "Optional non-secret project identifier used to adopt a reviewed hosted topology.", false),
       field("environmentId", "Environment ID", "Optional non-secret environment identifier used to target reviewed hosted deployments.", false)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.75",
+  "version": "0.13.0-rc.77",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {