@treeseed/sdk 0.13.0-rc.82 → 0.13.0-rc.84

package/dist/.treeseed-build-complete.json

@@ -1 +1 @@
-{"completedAt":"2026-09-03T03:47:38.642Z"}
+{"completedAt":"2026-09-03T07:35:45.110Z"}

package/dist/agent-capacity/artifact-mutation-receipt.d.ts

@@ -1,7 +1,7 @@
 export declare const ARTIFACT_MUTATION_RECEIPT_SCHEMA: "treeseed.artifact-mutation-receipt/v1";
 export type ArtifactMutationKind = 'treedx-content' | 'source-checkpoint';
 export type ArtifactMutationPhase = 'provisional' | 'integrated';
-import type { AgentWorkExecutionMode, UpstreamMutationPolicy } from './contracts/support/execution-mode.js';
+import type { AgentWorkExecutionMode, UpstreamMutationPolicy } from './contracts/support/authority/execution-mode.js';
 export interface ArtifactMutationEvidence {
     ref: string;
     digest?: string | null;

package/dist/agent-capacity/contracts/capacity/assignments/assignment-records.d.ts

@@ -1,5 +1,5 @@
 export type AgentExecutionMode = 'planning' | 'acting';
-export type AgentWorkExecutionMode = import('../../support/execution-mode.js').AgentWorkExecutionMode;
+import type { AgentWorkExecutionMode } from '../../support/authority/execution-mode.js';
 export type ProviderAssignmentStatus = 'pending' | 'leased' | 'running' | 'completed' | 'failed' | 'returned' | 'expired' | 'cancelled';
 export type ProviderAssignmentLeaseState = 'unleased' | 'leased' | 'released' | 'expired';
 export type AgentModeRunStatus = 'queued' | 'running' | 'succeeded' | 'failed' | 'cancelled';

package/dist/agent-capacity/contracts/capacity/workdays/workday-records.d.ts

@@ -1,6 +1,6 @@
 /** Portable durable records shared by workday control-plane and operator consumers. */
 import type { WorkdayAgentSelection } from '../../../workday.js';
-import type { AgentWorkExecutionMode } from '../../support/execution-mode.js';
+import type { AgentWorkExecutionMode } from '../../support/authority/execution-mode.js';
 export type CapacityWorkdayRunStatus = 'queued' | 'running' | 'completed' | 'cancelled' | 'failed' | 'degraded';
 export type CapacityWorkdayEventStatus = 'recorded' | 'active' | 'completed' | 'warning' | 'error' | 'failed';
 export type CapacityWorkdayDemandSource = 'objective' | 'question' | 'proposal' | 'decision-review' | 'knowledge-gap' | 'release-readiness' | 'idle-intent' | 'planning-input' | 'capacity-plan' | 'assignment-completion' | 'assignment-blockage' | 'workday-summary' | 'handoff' | 'research-workflow';

package/dist/agent-capacity/contracts/runtime/runtime-observability.d.ts

@@ -1,9 +1,9 @@
 import type { CapacityPageInfo } from '../../../capacity/capacity-core/capacity-pagination.js';
 import type { ExecutionCapabilityDemand, ExecutionCapabilitySupply } from '../../../types/agents.js';
-import type { AgentCapacityEnvelope, AgentExecutionMode, AgentModeRun, DecisionExecutionInput, ProviderAssignment, ProviderAssignmentSynthesisSource, TreeDxProxyHandle, WorkdayCapacityEnvelope } from '../capacity/assignments/assignment-records.js';
-import type { AgentKernelPolicy, AgentKernelProfile } from '../projects/agents/project-agent-class.js';
+import type { AgentCapacityEnvelope, AgentExecutionMode, AgentModeRun, AgentModeRunUsageSettlement, DecisionExecutionInput, ProviderAssignment, ProviderAssignmentSynthesisSource, TreeDxProxyHandle, WorkdayCapacityEnvelope } from '../capacity/assignments/assignment-records.js';
+import type { AgentKernelPolicy, AgentKernelProfile, ProjectAgentClass } from '../projects/agents/project-agent-class.js';
 import type { CapacityLedgerEntry, CapacityReservation, CapacityUsageActual } from '../support/financial-records.js';
-import type { WorkdayCapacityEnvelopeRecord } from '../support/planning-records.js';
+import type { DecisionPlanningStatus, WorkdayCapacityEnvelopeRecord } from '../support/planning-records.js';
 export type AgentKernelModeExecutionStatus = 'completed' | 'waiting' | 'failed' | 'returned';
 export type AgentKernelModeFallbackCode = 'assignment_missing_project_or_agent' | 'assignment_governance_provenance_missing' | 'assignment_lease_expired' | 'assignment_mode_not_allowed' | 'assignment_missing_capacity_envelope' | 'assignment_missing_decision_input' | 'assignment_handler_failed' | 'assignment_project_not_synced' | 'assignment_agent_not_found' | 'assignment_insufficient_capability' | 'assignment_decision_not_ready' | 'assignment_capacity_plan_not_accepted' | 'assignment_capacity_not_reserved' | 'assignment_capability_handle_invalid' | 'assignment_capability_handle_secret_material' | 'assignment_capability_handle_write_not_ready' | 'assignment_capability_handle_workspace_denied' | 'assignment_repository_ref_scope_invalid' | 'assignment_workflow_operation_denied' | 'assignment_eligibility_capability_mismatch' | 'assignment_retry_policy_exceeded' | 'assignment_treedx_proxy_scope_invalid' | 'assignment_fallback_quota_exceeded' | 'assignment_output_invalid';
 export interface AgentCapacityPlan {

package/dist/agent-capacity/contracts/support/decision-work.d.ts

@@ -189,7 +189,7 @@ export interface DecisionAssignmentGraph {
     edges: DecisionAssignmentGraphEdge[];
     compiledAt?: string | null;
     compiledBy: 'api-control-plane';
-    executionMode?: import('./execution-mode.js').AgentWorkExecutionMode;
+    executionMode?: import('./authority/execution-mode.js').AgentWorkExecutionMode;
     metadata?: Record<string, unknown>;
 }
 export interface DecisionAssignmentGraphRecord extends DecisionAssignmentGraph {

package/dist/configuration/secrets-capability.d.ts

@@ -2,3 +2,4 @@ export * from '../secrets-capability/service-provider-contracts.js';
 export * from '../secrets-capability/provider-operation-contracts.js';
 export * from '../secrets-capability/workflow-operation-contracts.js';
 export * from '../secrets-capability/service-vault-contracts.js';
+export * from '../secrets-capability/service-vault-crypto.js';

package/dist/configuration/secrets-capability.js

@@ -2,3 +2,4 @@ export * from "../secrets-capability/service-provider-contracts.js";
 export * from "../secrets-capability/provider-operation-contracts.js";
 export * from "../secrets-capability/workflow-operation-contracts.js";
 export * from "../secrets-capability/service-vault-contracts.js";
+export * from "../secrets-capability/service-vault-crypto.js";

package/dist/operator-contracts/catalog/hosted-topology-operations.d.ts

@@ -59,92 +59,8 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
                 connectionRef: string;
             }>>;
         };
-    }, {
-        schemaVersion: "treeseed.hosted-topology-plan/v1";
-        blockers: {
-            code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
-            message: string;
-            resourceId?: string | undefined;
-        }[];
-        planDigest: string;
-        actions: {
-            action: "noop" | "create" | "adopt" | "update";
-            resourceId: string;
-            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
-            provider: "cloudflare" | "railway";
-            providerResourceId: string | null;
-            desiredResource: {
-                id: string;
-                kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
-                provider: "cloudflare" | "railway";
-                adoption: {
-                    mode: "adopt-or-create";
-                    replacement: "forbidden";
-                    externalIdInput?: string | undefined;
-                };
-                dependsOn?: string[] | undefined;
-                parameters?: Record<string, {
-                    input: string;
-                } | {
-                    artifact: string;
-                } | {
-                    resourceOutput: {
-                        resourceId: string;
-                        output: string;
-                    };
-                } | {
-                    literal: string | number | boolean;
-                }> | undefined;
-            };
-            desiredDigest: string;
-            previousDigest: string | null;
-        }[];
-        teamId: string;
-        environment: "production" | "staging";
-        executable: false;
-        artifacts: Record<string, {
-            digest: string;
-            source: string;
-            kind: "archive";
-            format: "tar+gzip";
-        } | {
-            digest: string;
-            source: string;
-            kind: "file";
-            mediaType: string;
-        } | {
-            digest: string;
-            kind: "oci-image";
-            identity: string;
-        }>;
-        planId: string;
-        deploymentId: string;
-        stackId: string;
-        stateBackend: {
-            key: string;
-            type: "s3";
-            schemaVersion: "treeseed.hosted-state-backend/v1";
-            teamId: string;
-            environment: "production" | "staging";
-            deploymentId: string;
-            stackId: string;
-            connectionRef: string;
-            bucket: string;
-            region: string;
-            encryptionKeyRef: string;
-            bindingDigest: string;
-            endpoint?: string | undefined;
-            usePathStyle?: boolean | undefined;
-        } | null;
-        providerConnections: Partial<Record<"cloudflare" | "railway", {
-            connectionRef: string;
-            nonSecretConfig: Record<string, string | number | boolean>;
-        }>>;
-        declarationDigest: string;
-        topologyId: string;
-        platformCommit: string;
-        approvalRequired: boolean;
-    }>;
+        credentialLeaseIds?: string[] | undefined;
+    }, Record<string, unknown>>;
     readonly apply: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
         teamId: string;
     }, {}, {
@@ -246,6 +162,7 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
             platformCommit: string;
             approvalRequired: boolean;
         };
+        credentialLeaseIds?: string[] | undefined;
     }, Record<string, unknown>>;
     readonly status: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
         teamId: string;
@@ -290,34 +207,220 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
     readonly rollback: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
         teamId: string;
     }, {}, {
-        rollback: {
-            schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        approval: {
+            schemaVersion: "treeseed.hosted-topology-rollback-execution-approval/v1";
             teamId: string;
             environment: "production" | "staging";
-            operations: {
-                action: "noop" | "restore" | "delete-created";
-                resourceId: string;
-                providerResourceId: string;
-                targetDigest: string | null;
-            }[];
             deploymentId: string;
             stackId: string;
             backendBindingDigest: string;
-            rollbackId: string;
-            sourceReceiptId: string;
-            rollbackDigest: string;
+            decision: "approved";
+            approvedBy: string;
+            approvedAt: string;
+            executionDigest: string;
         };
-        approval: {
-            schemaVersion: "treeseed.hosted-topology-rollback-approval/v1";
+        execution: {
+            schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
             teamId: string;
             environment: "production" | "staging";
+            rollback: {
+                schemaVersion: "treeseed.hosted-topology-rollback/v1";
+                teamId: string;
+                environment: "production" | "staging";
+                operations: {
+                    action: "noop" | "restore" | "delete-created";
+                    resourceId: string;
+                    providerResourceId: string;
+                    targetDigest: string | null;
+                }[];
+                deploymentId: string;
+                stackId: string;
+                backendBindingDigest: string;
+                rollbackId: string;
+                sourceReceiptId: string;
+                rollbackDigest: string;
+            };
             deploymentId: string;
             stackId: string;
+            topologyId: string;
             backendBindingDigest: string;
-            decision: "approved";
-            approvedBy: string;
-            approvedAt: string;
-            rollbackDigest: string;
+            sourceReceiptId: string;
+            sourcePlanDigest: string;
+            targetPlanDigest: string;
+            executionDigest: string;
+        };
+        sourcePlan: {
+            schemaVersion: "treeseed.hosted-topology-plan/v1";
+            blockers: {
+                code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+                message: string;
+                resourceId?: string | undefined;
+            }[];
+            planDigest: string;
+            actions: {
+                action: "noop" | "create" | "adopt" | "update";
+                resourceId: string;
+                kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                provider: "cloudflare" | "railway";
+                providerResourceId: string | null;
+                desiredResource: {
+                    id: string;
+                    kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                    provider: "cloudflare" | "railway";
+                    adoption: {
+                        mode: "adopt-or-create";
+                        replacement: "forbidden";
+                        externalIdInput?: string | undefined;
+                    };
+                    dependsOn?: string[] | undefined;
+                    parameters?: Record<string, {
+                        input: string;
+                    } | {
+                        artifact: string;
+                    } | {
+                        resourceOutput: {
+                            resourceId: string;
+                            output: string;
+                        };
+                    } | {
+                        literal: string | number | boolean;
+                    }> | undefined;
+                };
+                desiredDigest: string;
+                previousDigest: string | null;
+            }[];
+            teamId: string;
+            environment: "production" | "staging";
+            executable: false;
+            artifacts: Record<string, {
+                digest: string;
+                source: string;
+                kind: "archive";
+                format: "tar+gzip";
+            } | {
+                digest: string;
+                source: string;
+                kind: "file";
+                mediaType: string;
+            } | {
+                digest: string;
+                kind: "oci-image";
+                identity: string;
+            }>;
+            planId: string;
+            deploymentId: string;
+            stackId: string;
+            stateBackend: {
+                key: string;
+                type: "s3";
+                schemaVersion: "treeseed.hosted-state-backend/v1";
+                teamId: string;
+                environment: "production" | "staging";
+                deploymentId: string;
+                stackId: string;
+                connectionRef: string;
+                bucket: string;
+                region: string;
+                encryptionKeyRef: string;
+                bindingDigest: string;
+                endpoint?: string | undefined;
+                usePathStyle?: boolean | undefined;
+            } | null;
+            providerConnections: Partial<Record<"cloudflare" | "railway", {
+                connectionRef: string;
+                nonSecretConfig: Record<string, string | number | boolean>;
+            }>>;
+            declarationDigest: string;
+            topologyId: string;
+            platformCommit: string;
+            approvalRequired: boolean;
+        };
+        targetPlan: {
+            schemaVersion: "treeseed.hosted-topology-plan/v1";
+            blockers: {
+                code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+                message: string;
+                resourceId?: string | undefined;
+            }[];
+            planDigest: string;
+            actions: {
+                action: "noop" | "create" | "adopt" | "update";
+                resourceId: string;
+                kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                provider: "cloudflare" | "railway";
+                providerResourceId: string | null;
+                desiredResource: {
+                    id: string;
+                    kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                    provider: "cloudflare" | "railway";
+                    adoption: {
+                        mode: "adopt-or-create";
+                        replacement: "forbidden";
+                        externalIdInput?: string | undefined;
+                    };
+                    dependsOn?: string[] | undefined;
+                    parameters?: Record<string, {
+                        input: string;
+                    } | {
+                        artifact: string;
+                    } | {
+                        resourceOutput: {
+                            resourceId: string;
+                            output: string;
+                        };
+                    } | {
+                        literal: string | number | boolean;
+                    }> | undefined;
+                };
+                desiredDigest: string;
+                previousDigest: string | null;
+            }[];
+            teamId: string;
+            environment: "production" | "staging";
+            executable: false;
+            artifacts: Record<string, {
+                digest: string;
+                source: string;
+                kind: "archive";
+                format: "tar+gzip";
+            } | {
+                digest: string;
+                source: string;
+                kind: "file";
+                mediaType: string;
+            } | {
+                digest: string;
+                kind: "oci-image";
+                identity: string;
+            }>;
+            planId: string;
+            deploymentId: string;
+            stackId: string;
+            stateBackend: {
+                key: string;
+                type: "s3";
+                schemaVersion: "treeseed.hosted-state-backend/v1";
+                teamId: string;
+                environment: "production" | "staging";
+                deploymentId: string;
+                stackId: string;
+                connectionRef: string;
+                bucket: string;
+                region: string;
+                encryptionKeyRef: string;
+                bindingDigest: string;
+                endpoint?: string | undefined;
+                usePathStyle?: boolean | undefined;
+            } | null;
+            providerConnections: Partial<Record<"cloudflare" | "railway", {
+                connectionRef: string;
+                nonSecretConfig: Record<string, string | number | boolean>;
+            }>>;
+            declarationDigest: string;
+            topologyId: string;
+            platformCommit: string;
+            approvalRequired: boolean;
         };
+        credentialLeaseIds?: string[] | undefined;
     }, Record<string, unknown>>;
 };

package/dist/operator-contracts/catalog/hosted-topology-operations.js

@@ -1,10 +1,11 @@
 import { z } from "zod";
-import { hostedTopologyApprovalSchema, hostedTopologyDeclarationSchema, hostedTopologyPlanSchema, hostedTopologyReceiptSchema, hostedTopologyRollbackApprovalSchema, hostedTopologyRollbackSchema } from "../../deployment/hosted-topology.js";
+import { hostedTopologyApprovalSchema, hostedTopologyDeclarationSchema, hostedTopologyPlanSchema, hostedTopologyReceiptSchema, hostedTopologyRollbackExecutionApprovalSchema, hostedTopologyRollbackExecutionSchema } from "../../deployment/hosted-topology.js";
 import { defineOperation } from "../operation-builder.js";
 const teamPath = z.object({ teamId: z.string().min(1) }).strict();
 const empty = z.object({}).strict();
 const none = z.undefined();
 const operationReceipt = z.record(z.unknown());
+const credentialLeaseIds = z.array(z.string().min(1)).min(1).optional();
 const HOSTED_TOPOLOGY_OPERATIONS = {
   plan: defineOperation({
     operationId: "infrastructure.topology.plan",
@@ -21,7 +22,7 @@ const HOSTED_TOPOLOGY_OPERATIONS = {
     cacheScope: "none",
     pagination: "none",
     idempotencyRequired: false
-  }, { path: teamPath, query: empty, body: z.object({ declaration: hostedTopologyDeclarationSchema }).strict(), output: hostedTopologyPlanSchema }),
+  }, { path: teamPath, query: empty, body: z.object({ declaration: hostedTopologyDeclarationSchema, credentialLeaseIds }).strict(), output: operationReceipt }),
   apply: defineOperation({
     operationId: "infrastructure.topology.apply",
     description: "Apply an exact approved hosted topology plan through the operations runner.",
@@ -38,7 +39,7 @@ const HOSTED_TOPOLOGY_OPERATIONS = {
     pagination: "none",
     concurrencyRequired: true,
     redactedPaths: ["body.approval.approvedBy"]
-  }, { path: teamPath, query: empty, body: z.object({ plan: hostedTopologyPlanSchema, approval: hostedTopologyApprovalSchema }).strict(), output: operationReceipt }),
+  }, { path: teamPath, query: empty, body: z.object({ plan: hostedTopologyPlanSchema, approval: hostedTopologyApprovalSchema, credentialLeaseIds }).strict(), output: operationReceipt }),
   status: defineOperation({
     operationId: "infrastructure.topology.status",
     description: "Read the latest authoritative hosted topology receipt and operation state.",
@@ -70,7 +71,13 @@ const HOSTED_TOPOLOGY_OPERATIONS = {
     pagination: "none",
     concurrencyRequired: true,
     redactedPaths: ["body.approval.approvedBy"]
-  }, { path: teamPath, query: empty, body: z.object({ rollback: hostedTopologyRollbackSchema, approval: hostedTopologyRollbackApprovalSchema }).strict(), output: operationReceipt })
+  }, { path: teamPath, query: empty, body: z.object({
+    execution: hostedTopologyRollbackExecutionSchema,
+    approval: hostedTopologyRollbackExecutionApprovalSchema,
+    sourcePlan: hostedTopologyPlanSchema,
+    targetPlan: hostedTopologyPlanSchema,
+    credentialLeaseIds
+  }).strict(), output: operationReceipt })
 };
 export {
   HOSTED_TOPOLOGY_OPERATIONS

package/dist/operator-contracts/catalog/services/service-vault-operations.d.ts

@@ -0,0 +1,17 @@
+export declare const SERVICE_VAULT_OPERATIONS: {
+    readonly userVaultKey: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly putUserVaultKey: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly teamVault: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly initializeTeamVault: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly resetTeamVault: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly rotateTeamVault: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly vaultGrantCandidates: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly createVaultGrant: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly deleteVaultGrant: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly vaultCredentialEnvelopes: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly credentialEnvelopes: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly putCredentialEnvelope: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly createOperationLease: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly operationLease: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly putOperationLeasePayload: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+};

package/dist/operator-contracts/catalog/services/service-vault-operations.js

@@ -0,0 +1,158 @@
+import { z } from "zod";
+import { defineOperation } from "../../operation-builder.js";
+const empty = z.object({}).strict();
+const none = z.undefined();
+const record = z.record(z.unknown());
+const teamPath = z.object({ teamId: z.string().min(1) }).strict();
+function vaultOperation(operationId, method, path, pathSchema, options = {}) {
+  const read = method === "GET", risk = options.risk ?? "ordinary";
+  return defineOperation({
+    operationId,
+    description: `${read ? "Read" : "Apply"} ${operationId}.`,
+    rest: { method, path },
+    capability: read ? "secrets.read" : "secrets.write",
+    ...path.includes("{") ? { parameters: `treeseed.${operationId}.parameters/v1` } : {},
+    authentication: "oauth",
+    oauthScopes: read ? ["treeseed:read"] : ["treeseed:projects:write"],
+    kind: read ? "read" : "mutation",
+    riskClass: risk,
+    confirmation: risk === "ordinary" ? "never" : "input_required",
+    surfaces: ["rest"],
+    cacheScope: read ? "principal" : "none",
+    pagination: "none",
+    redactedPaths: options.redactedPaths
+  }, { path: pathSchema, query: read ? record : empty, body: read ? none : options.body ?? record, output: options.output ?? record });
+}
+const nullableRecord = record.nullable(), records = z.array(record);
+const encryptedPrivateKeyEnvelope = z.object({
+  version: z.literal("service-vault-v1"),
+  algorithm: z.literal("xchacha20-poly1305-ietf"),
+  kdf: z.object({ algorithm: z.literal("argon2id"), opsLimit: z.number().int().positive(), memLimit: z.number().int().positive(), salt: z.string().min(1) }).strict(),
+  nonce: z.string().min(1),
+  ciphertext: z.string().min(1),
+  publicKey: z.string().min(1)
+}).strict();
+const encryptedCredentialEnvelope = z.object({
+  version: z.literal("service-vault-v1"),
+  algorithm: z.literal("xchacha20-poly1305-ietf"),
+  ciphertext: z.string().min(1),
+  nonce: z.string().min(1),
+  wrappedKey: z.string().min(1),
+  wrappedKeyNonce: z.string().min(1),
+  associatedData: z.string().min(1),
+  associatedDataDigest: z.string().min(1),
+  fingerprint: z.string().min(1)
+}).strict();
+const SERVICE_VAULT_OPERATIONS = {
+  userVaultKey: vaultOperation("services.vault.user.key.show", "GET", "/v1/users/me/vault-key", empty, { output: nullableRecord }),
+  putUserVaultKey: vaultOperation(
+    "services.vault.user.key.put",
+    "PUT",
+    "/v1/users/me/vault-key",
+    empty,
+    { risk: "credential", redactedPaths: ["body.encryptedPrivateKeyEnvelope"], body: z.object({ publicKey: z.string().min(1), encryptedPrivateKeyEnvelope }).strict() }
+  ),
+  teamVault: vaultOperation("services.vault.team.show", "GET", "/v1/teams/{teamId}/vault", teamPath, { output: nullableRecord }),
+  initializeTeamVault: vaultOperation(
+    "services.vault.team.initialize",
+    "POST",
+    "/v1/teams/{teamId}/vault",
+    teamPath,
+    { risk: "credential", redactedPaths: ["body.wrappedTeamVaultKey"], body: z.object({ userVaultKeyId: z.string().min(1), wrappedTeamVaultKey: z.string().min(1), encryptionVersion: z.literal("service-vault-v1") }).strict() }
+  ),
+  resetTeamVault: vaultOperation(
+    "services.vault.team.reset",
+    "POST",
+    "/v1/teams/{teamId}/vault/reset",
+    teamPath,
+    { risk: "destructive", redactedPaths: ["body.wrappedTeamVaultKey", "body.currentPassword"], body: z.object({ userVaultKeyId: z.string().min(1), wrappedTeamVaultKey: z.string().min(1), encryptionVersion: z.literal("service-vault-v1"), confirmation: z.string().min(1), currentPassword: z.string().min(1) }).strict() }
+  ),
+  rotateTeamVault: vaultOperation(
+    "services.vault.team.rotate",
+    "POST",
+    "/v1/teams/{teamId}/vault/rotate",
+    teamPath,
+    { risk: "credential", redactedPaths: ["body.envelopes", "body.grants"], body: z.object({
+      expectedKeyVersion: z.number().int().positive(),
+      envelopes: z.array(z.object({ id: z.string().min(1), envelope: encryptedCredentialEnvelope }).strict()),
+      grants: z.array(z.object({ userId: z.string().min(1), userVaultKeyId: z.string().min(1), wrappedTeamVaultKey: z.string().min(1) }).strict()).min(1)
+    }).strict() }
+  ),
+  vaultGrantCandidates: vaultOperation("services.vault.grant.candidates.list", "GET", "/v1/teams/{teamId}/vault/grant-candidates", teamPath, { output: records }),
+  createVaultGrant: vaultOperation(
+    "services.vault.grants.create",
+    "POST",
+    "/v1/teams/{teamId}/vault/grants",
+    teamPath,
+    { risk: "credential", redactedPaths: ["body.wrappedTeamVaultKey"], body: z.object({ userId: z.string().min(1), userVaultKeyId: z.string().min(1), wrappedTeamVaultKey: z.string().min(1) }).strict() }
+  ),
+  deleteVaultGrant: vaultOperation(
+    "services.vault.grants.delete",
+    "DELETE",
+    "/v1/teams/{teamId}/vault/grants/{grantId}",
+    z.object({ teamId: z.string().min(1), grantId: z.string().min(1) }).strict(),
+    { risk: "destructive" }
+  ),
+  vaultCredentialEnvelopes: vaultOperation(
+    "services.vault.credential.envelopes.list",
+    "GET",
+    "/v1/teams/{teamId}/vault/credential-envelopes",
+    teamPath,
+    { output: records }
+  ),
+  credentialEnvelopes: vaultOperation(
+    "services.credential.envelopes.list",
+    "GET",
+    "/v1/teams/{teamId}/services/{connectionId}/credential-envelopes",
+    z.object({ teamId: z.string().min(1), connectionId: z.string().min(1) }).strict(),
+    { output: records }
+  ),
+  putCredentialEnvelope: vaultOperation(
+    "services.credential.envelopes.put",
+    "POST",
+    "/v1/teams/{teamId}/services/{connectionId}/credential-envelopes",
+    z.object({ teamId: z.string().min(1), connectionId: z.string().min(1) }).strict(),
+    { risk: "credential", redactedPaths: ["body.envelope"], body: z.object({ definitionId: z.string().min(1), fieldKey: z.string().min(1), keyVersion: z.number().int().positive(), envelope: encryptedCredentialEnvelope }).strict() }
+  ),
+  createOperationLease: vaultOperation(
+    "services.operation.leases.create",
+    "POST",
+    "/v1/teams/{teamId}/service-operation-leases",
+    teamPath,
+    { risk: "authority", body: z.object({
+      connectionId: z.string().min(1),
+      capabilityType: z.string().min(1),
+      credentialProfileId: z.string().min(1),
+      purpose: z.enum([
+        "provider-connection-validation",
+        "remote-git-publication",
+        "workflow-dispatch",
+        "workflow-configuration",
+        "hosted-topology-plan",
+        "hosted-topology-apply",
+        "hosted-topology-readback",
+        "hosted-topology-rollback"
+      ]),
+      idempotencyKey: z.string().min(1).optional(),
+      resourceScope: record.optional(),
+      hostedBinding: record.optional(),
+      authorityRequests: z.array(record).optional()
+    }).strict() }
+  ),
+  operationLease: vaultOperation(
+    "services.operation.leases.show",
+    "GET",
+    "/v1/teams/{teamId}/service-operation-leases/{leaseId}",
+    z.object({ teamId: z.string().min(1), leaseId: z.string().min(1) }).strict()
+  ),
+  putOperationLeasePayload: vaultOperation(
+    "services.operation.leases.payload.put",
+    "PUT",
+    "/v1/teams/{teamId}/service-operation-leases/{leaseId}/payload",
+    z.object({ teamId: z.string().min(1), leaseId: z.string().min(1) }).strict(),
+    { risk: "credential", redactedPaths: ["body.sealedPayload"], body: z.object({ sealedPayload: z.string().min(1) }).strict() }
+  )
+};
+export {
+  SERVICE_VAULT_OPERATIONS
+};