@treeseed/sdk 0.13.0-rc.82 → 0.13.0-rc.84

package/dist/operator-contracts/control-plane-operations.d.ts

@@ -62,92 +62,8 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                         connectionRef: string;
                     }>>;
                 };
-            }, {
-                schemaVersion: "treeseed.hosted-topology-plan/v1";
-                blockers: {
-                    code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
-                    message: string;
-                    resourceId?: string | undefined;
-                }[];
-                planDigest: string;
-                actions: {
-                    action: "noop" | "create" | "adopt" | "update";
-                    resourceId: string;
-                    kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
-                    provider: "cloudflare" | "railway";
-                    providerResourceId: string | null;
-                    desiredResource: {
-                        id: string;
-                        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
-                        provider: "cloudflare" | "railway";
-                        adoption: {
-                            mode: "adopt-or-create";
-                            replacement: "forbidden";
-                            externalIdInput?: string | undefined;
-                        };
-                        dependsOn?: string[] | undefined;
-                        parameters?: Record<string, {
-                            input: string;
-                        } | {
-                            artifact: string;
-                        } | {
-                            resourceOutput: {
-                                resourceId: string;
-                                output: string;
-                            };
-                        } | {
-                            literal: string | number | boolean;
-                        }> | undefined;
-                    };
-                    desiredDigest: string;
-                    previousDigest: string | null;
-                }[];
-                teamId: string;
-                environment: "production" | "staging";
-                executable: false;
-                artifacts: Record<string, {
-                    digest: string;
-                    source: string;
-                    kind: "archive";
-                    format: "tar+gzip";
-                } | {
-                    digest: string;
-                    source: string;
-                    kind: "file";
-                    mediaType: string;
-                } | {
-                    digest: string;
-                    kind: "oci-image";
-                    identity: string;
-                }>;
-                planId: string;
-                deploymentId: string;
-                stackId: string;
-                stateBackend: {
-                    key: string;
-                    type: "s3";
-                    schemaVersion: "treeseed.hosted-state-backend/v1";
-                    teamId: string;
-                    environment: "production" | "staging";
-                    deploymentId: string;
-                    stackId: string;
-                    connectionRef: string;
-                    bucket: string;
-                    region: string;
-                    encryptionKeyRef: string;
-                    bindingDigest: string;
-                    endpoint?: string | undefined;
-                    usePathStyle?: boolean | undefined;
-                } | null;
-                providerConnections: Partial<Record<"cloudflare" | "railway", {
-                    connectionRef: string;
-                    nonSecretConfig: Record<string, string | number | boolean>;
-                }>>;
-                declarationDigest: string;
-                topologyId: string;
-                platformCommit: string;
-                approvalRequired: boolean;
-            }>;
+                credentialLeaseIds?: string[] | undefined;
+            }, Record<string, unknown>>;
             readonly apply: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
                 teamId: string;
             }, {}, {
@@ -249,6 +165,7 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                     platformCommit: string;
                     approvalRequired: boolean;
                 };
+                credentialLeaseIds?: string[] | undefined;
             }, Record<string, unknown>>;
             readonly status: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
                 teamId: string;
@@ -293,35 +210,221 @@ export declare const CONTROL_PLANE_OPERATIONS: {
             readonly rollback: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
                 teamId: string;
             }, {}, {
-                rollback: {
-                    schemaVersion: "treeseed.hosted-topology-rollback/v1";
+                approval: {
+                    schemaVersion: "treeseed.hosted-topology-rollback-execution-approval/v1";
                     teamId: string;
                     environment: "production" | "staging";
-                    operations: {
-                        action: "noop" | "restore" | "delete-created";
-                        resourceId: string;
-                        providerResourceId: string;
-                        targetDigest: string | null;
-                    }[];
                     deploymentId: string;
                     stackId: string;
                     backendBindingDigest: string;
-                    rollbackId: string;
-                    sourceReceiptId: string;
-                    rollbackDigest: string;
+                    decision: "approved";
+                    approvedBy: string;
+                    approvedAt: string;
+                    executionDigest: string;
                 };
-                approval: {
-                    schemaVersion: "treeseed.hosted-topology-rollback-approval/v1";
+                execution: {
+                    schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
                     teamId: string;
                     environment: "production" | "staging";
+                    rollback: {
+                        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+                        teamId: string;
+                        environment: "production" | "staging";
+                        operations: {
+                            action: "noop" | "restore" | "delete-created";
+                            resourceId: string;
+                            providerResourceId: string;
+                            targetDigest: string | null;
+                        }[];
+                        deploymentId: string;
+                        stackId: string;
+                        backendBindingDigest: string;
+                        rollbackId: string;
+                        sourceReceiptId: string;
+                        rollbackDigest: string;
+                    };
                     deploymentId: string;
                     stackId: string;
+                    topologyId: string;
                     backendBindingDigest: string;
-                    decision: "approved";
-                    approvedBy: string;
-                    approvedAt: string;
-                    rollbackDigest: string;
+                    sourceReceiptId: string;
+                    sourcePlanDigest: string;
+                    targetPlanDigest: string;
+                    executionDigest: string;
+                };
+                sourcePlan: {
+                    schemaVersion: "treeseed.hosted-topology-plan/v1";
+                    blockers: {
+                        code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+                        message: string;
+                        resourceId?: string | undefined;
+                    }[];
+                    planDigest: string;
+                    actions: {
+                        action: "noop" | "create" | "adopt" | "update";
+                        resourceId: string;
+                        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                        provider: "cloudflare" | "railway";
+                        providerResourceId: string | null;
+                        desiredResource: {
+                            id: string;
+                            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                            provider: "cloudflare" | "railway";
+                            adoption: {
+                                mode: "adopt-or-create";
+                                replacement: "forbidden";
+                                externalIdInput?: string | undefined;
+                            };
+                            dependsOn?: string[] | undefined;
+                            parameters?: Record<string, {
+                                input: string;
+                            } | {
+                                artifact: string;
+                            } | {
+                                resourceOutput: {
+                                    resourceId: string;
+                                    output: string;
+                                };
+                            } | {
+                                literal: string | number | boolean;
+                            }> | undefined;
+                        };
+                        desiredDigest: string;
+                        previousDigest: string | null;
+                    }[];
+                    teamId: string;
+                    environment: "production" | "staging";
+                    executable: false;
+                    artifacts: Record<string, {
+                        digest: string;
+                        source: string;
+                        kind: "archive";
+                        format: "tar+gzip";
+                    } | {
+                        digest: string;
+                        source: string;
+                        kind: "file";
+                        mediaType: string;
+                    } | {
+                        digest: string;
+                        kind: "oci-image";
+                        identity: string;
+                    }>;
+                    planId: string;
+                    deploymentId: string;
+                    stackId: string;
+                    stateBackend: {
+                        key: string;
+                        type: "s3";
+                        schemaVersion: "treeseed.hosted-state-backend/v1";
+                        teamId: string;
+                        environment: "production" | "staging";
+                        deploymentId: string;
+                        stackId: string;
+                        connectionRef: string;
+                        bucket: string;
+                        region: string;
+                        encryptionKeyRef: string;
+                        bindingDigest: string;
+                        endpoint?: string | undefined;
+                        usePathStyle?: boolean | undefined;
+                    } | null;
+                    providerConnections: Partial<Record<"cloudflare" | "railway", {
+                        connectionRef: string;
+                        nonSecretConfig: Record<string, string | number | boolean>;
+                    }>>;
+                    declarationDigest: string;
+                    topologyId: string;
+                    platformCommit: string;
+                    approvalRequired: boolean;
+                };
+                targetPlan: {
+                    schemaVersion: "treeseed.hosted-topology-plan/v1";
+                    blockers: {
+                        code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+                        message: string;
+                        resourceId?: string | undefined;
+                    }[];
+                    planDigest: string;
+                    actions: {
+                        action: "noop" | "create" | "adopt" | "update";
+                        resourceId: string;
+                        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                        provider: "cloudflare" | "railway";
+                        providerResourceId: string | null;
+                        desiredResource: {
+                            id: string;
+                            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                            provider: "cloudflare" | "railway";
+                            adoption: {
+                                mode: "adopt-or-create";
+                                replacement: "forbidden";
+                                externalIdInput?: string | undefined;
+                            };
+                            dependsOn?: string[] | undefined;
+                            parameters?: Record<string, {
+                                input: string;
+                            } | {
+                                artifact: string;
+                            } | {
+                                resourceOutput: {
+                                    resourceId: string;
+                                    output: string;
+                                };
+                            } | {
+                                literal: string | number | boolean;
+                            }> | undefined;
+                        };
+                        desiredDigest: string;
+                        previousDigest: string | null;
+                    }[];
+                    teamId: string;
+                    environment: "production" | "staging";
+                    executable: false;
+                    artifacts: Record<string, {
+                        digest: string;
+                        source: string;
+                        kind: "archive";
+                        format: "tar+gzip";
+                    } | {
+                        digest: string;
+                        source: string;
+                        kind: "file";
+                        mediaType: string;
+                    } | {
+                        digest: string;
+                        kind: "oci-image";
+                        identity: string;
+                    }>;
+                    planId: string;
+                    deploymentId: string;
+                    stackId: string;
+                    stateBackend: {
+                        key: string;
+                        type: "s3";
+                        schemaVersion: "treeseed.hosted-state-backend/v1";
+                        teamId: string;
+                        environment: "production" | "staging";
+                        deploymentId: string;
+                        stackId: string;
+                        connectionRef: string;
+                        bucket: string;
+                        region: string;
+                        encryptionKeyRef: string;
+                        bindingDigest: string;
+                        endpoint?: string | undefined;
+                        usePathStyle?: boolean | undefined;
+                    } | null;
+                    providerConnections: Partial<Record<"cloudflare" | "railway", {
+                        connectionRef: string;
+                        nonSecretConfig: Record<string, string | number | boolean>;
+                    }>>;
+                    declarationDigest: string;
+                    topologyId: string;
+                    platformCommit: string;
+                    approvalRequired: boolean;
                 };
+                credentialLeaseIds?: string[] | undefined;
             }, Record<string, unknown>>;
         };
     };
@@ -1323,6 +1426,21 @@ export declare const CONTROL_PLANE_OPERATIONS: {
             profileId: string;
             connectionId: string;
         }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly userVaultKey: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly putUserVaultKey: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly teamVault: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly initializeTeamVault: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly resetTeamVault: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly rotateTeamVault: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly vaultGrantCandidates: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly createVaultGrant: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly deleteVaultGrant: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly vaultCredentialEnvelopes: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly credentialEnvelopes: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly putCredentialEnvelope: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly createOperationLease: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly operationLease: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly putOperationLeasePayload: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
     };
     readonly agents: {
         readonly list: import("./control-plane-operation.js").ControlPlaneOperationBinding<{

package/dist/operator-contracts/control-plane-operations.js

@@ -8,6 +8,7 @@ import { capabilityOntologyOperations } from "./catalog/capability-ontology-oper
 import { knowledgeShareOperations } from "./catalog/knowledge-share-operations.js";
 import { PROVIDER_ENVIRONMENT_OPERATIONS } from "./catalog/provider-environment-operations.js";
 import { HOSTED_TOPOLOGY_OPERATIONS } from "./catalog/hosted-topology-operations.js";
+import { SERVICE_VAULT_OPERATIONS } from "./catalog/services/service-vault-operations.js";
 import { buildControlPlaneCatalog, flattenControlPlaneOperations } from "./catalog/control-plane-catalog.js";
 const empty = z.object({}).strict(), none = z.undefined(), record = z.record(z.unknown()), payload = record;
 function read(operationId, path, capability, surfaces = ["rest"]) {
@@ -277,6 +278,7 @@ const CONTROL_PLANE_OPERATIONS = {
     deleteWorkflowVariable: resource("repositories.workflow.variables.delete", "DELETE", "/v1/projects/{projectId}/workflow-configuration/variables/{name}", { projectId: z.string().min(1), name: z.string().min(1) }, { capability: "workflows.write", risk: "destructive", concurrency: true })
   },
   services: {
+    ...SERVICE_VAULT_OPERATIONS,
     providers: resource("services.providers.list", "GET", "/v1/service-providers", {}, { capability: "services.read", surfaces: ["rest", "cli", "mcp_tool"] }),
     connections: resource("services.connections.list", "GET", "/v1/teams/{teamId}/services", { teamId: z.string().min(1) }, { capability: "services.read", surfaces: ["rest", "cli", "mcp_tool"], pagination: "cursor" }),
     connection: resource("services.connections.show", "GET", "/v1/teams/{teamId}/services/{connectionId}", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "services.read", surfaces: ["rest", "cli", "mcp_resource"] }),
@@ -335,12 +337,12 @@ const CONTROL_PLANE_OPERATIONS = {
     retry: resource("assignments.retry", "POST", "/v1/teams/{teamId}/capacity/assignments/{assignmentId}/requeue", { teamId: z.string().min(1), assignmentId: z.string().min(1) }, { capability: "assignments.execute", scopes: ["treeseed:execution"], surfaces: ["rest", "cli", "mcp_tool"], risk: "authority" })
   },
   operations: {
-    list: resource("operations.list", "GET", "/v1/platform/operations", {}, { capability: "operations.read", surfaces: ["rest", "mcp_tool"], pagination: "cursor" }),
+    list: resource("operations.list", "GET", "/v1/platform/operations", {}, { capability: "operations.read", surfaces: ["rest", "cli", "mcp_tool"], pagination: "cursor" }),
     create: resource("operations.create", "POST", "/v1/platform/operations", {}, { capability: "operations.execute", scopes: ["treeseed:execution"] }),
-    show: resource("operations.show", "GET", "/v1/platform/operations/{operationId}", { operationId: z.string().min(1) }, { capability: "operations.read", surfaces: ["rest", "mcp_resource"] }),
+    show: resource("operations.show", "GET", "/v1/platform/operations/{operationId}", { operationId: z.string().min(1) }, { capability: "operations.read", surfaces: ["rest", "cli", "mcp_resource"] }),
     events: resource("operations.events.list", "GET", "/v1/platform/operations/{operationId}/events", { operationId: z.string().min(1) }, { capability: "operations.read", pagination: "cursor" }),
     cancel: resource("operations.cancel", "POST", "/v1/platform/operations/{operationId}/cancel", { operationId: z.string().min(1) }, { capability: "operations.execute", scopes: ["treeseed:execution"], risk: "destructive" }),
-    retry: resource("operations.retry", "POST", "/v1/platform/operations/{operationId}/retry", { operationId: z.string().min(1) }, { capability: "operations.execute", scopes: ["treeseed:execution"] })
+    retry: resource("operations.retry", "POST", "/v1/platform/operations/{operationId}/retry", { operationId: z.string().min(1) }, { capability: "operations.execute", scopes: ["treeseed:execution"], surfaces: ["rest", "cli"] })
   },
   seeds: {
     runs: resource("seeds.runs.list", "GET", "/v1/seeds/runs", {}, { capability: "seeds.read", pagination: "cursor" }),

package/dist/secrets-capability/service-provider-contracts.js

@@ -130,9 +130,9 @@ const SERVICE_PROVIDER_CATALOG = [
       { type: "object-storage", label: "Object storage", description: "R2-backed immutable publication and private artifact storage.", credentialProfileIds: ["cloudflare-storage"], status: "available" }
     ],
     credentialProfiles: [
-      { id: "cloudflare-runtime", label: "Pages and Workers token", description: "A token limited to application deployment resources.", capabilities: ["frontend-hosting"], fields: [field("apiToken", "API token", "Encrypted in this browser and used only for authorized frontend operations.", true, true)], permissions: ["Account: Workers Scripts Edit", "Account: Pages Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
-      { id: "cloudflare-dns", label: "DNS token", description: "A token restricted to selected zones.", capabilities: ["dns-management"], fields: [field("apiToken", "DNS API token", "Encrypted separately from deployment authority.", true, true)], permissions: ["Zone: DNS Edit for only the managed zones"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
-      { id: "cloudflare-storage", label: "Storage authority", description: "Vault-custodied R2 management and S3-compatible state credentials, isolated from runtime and DNS authority.", capabilities: ["object-storage"], fields: [field("apiToken", "Storage API token", "Encrypted separately and used only to reconcile authorized R2 resources.", true, true), field("accessKeyId", "R2 access key ID", "Vault-custodied S3-compatible access key identifier for encrypted OpenTofu state.", true, true), field("secretAccessKey", "R2 secret access key", "Vault-custodied S3-compatible secret key for encrypted OpenTofu state.", true, true)], permissions: ["Account: Workers R2 Storage Edit", "Object read and write for only the managed state bucket"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] }
+      { id: "cloudflare-runtime", label: "Pages and Workers token", description: "A token limited to application deployment resources.", capabilities: ["frontend-hosting"], fields: [field("apiToken", "API token", "Encrypted in this browser and used only for authorized frontend operations.", true, true)], permissions: ["Account: Workers Scripts Edit", "Account: Pages Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
+      { id: "cloudflare-dns", label: "DNS token", description: "A token restricted to selected zones.", capabilities: ["dns-management"], fields: [field("apiToken", "DNS API token", "Encrypted separately from deployment authority.", true, true)], permissions: ["Zone: DNS Edit for only the managed zones"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
+      { id: "cloudflare-storage", label: "Storage authority", description: "Vault-custodied R2 management and S3-compatible state credentials, isolated from runtime and DNS authority.", capabilities: ["object-storage"], fields: [field("apiToken", "Storage API token", "Encrypted separately and used only to reconcile authorized R2 resources.", true, true), field("accessKeyId", "R2 access key ID", "Vault-custodied S3-compatible access key identifier for encrypted OpenTofu state.", true, true), field("secretAccessKey", "R2 secret access key", "Vault-custodied S3-compatible secret key for encrypted OpenTofu state.", true, true), field("stateEncryptionKey", "OpenTofu state encryption key", "Generated in the browser and encrypted separately; never store this key with the R2 state object.", true, true)], permissions: ["Account: Workers R2 Storage Edit", "Object read and write for only the managed state bucket"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] }
     ]
   },
   {
@@ -163,7 +163,7 @@ const SERVICE_PROVIDER_CATALOG = [
       permissions: ["Workspace access required by the selected operations"],
       sharing: "provider-shared",
       unattendedCompatible: true,
-      authoritySchemes: ["environment-reference", "external-vault", "workload-identity"],
+      authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"],
       knowledgePageIds: ["provider.railway", "services.credentials", "vault.rotation"]
     }]
   },

package/dist/secrets-capability/service-vault-contracts.d.ts

@@ -2,6 +2,9 @@ export declare const SERVICE_VAULT_ENCRYPTION_VERSION: "service-vault-v1";
 export declare const SERVICE_VAULT_AEAD_ALGORITHM: "xchacha20-poly1305-ietf";
 export declare const SERVICE_VAULT_KEY_AGREEMENT: "x25519-sealed-box";
 export declare const SERVICE_VAULT_KDF: "argon2id";
+export declare const SECRET_OPERATION_PURPOSES: readonly ["provider-connection-validation", "remote-git-publication", "workflow-dispatch", "workflow-configuration", "hosted-topology-plan", "hosted-topology-apply", "hosted-topology-readback", "hosted-topology-rollback"];
+export type SecretOperationPurpose = (typeof SECRET_OPERATION_PURPOSES)[number];
+export type HostedSecretOperationPurpose = Extract<SecretOperationPurpose, `hosted-topology-${string}`>;
 export type EncryptedCredentialEnvelope = {
     version: typeof SERVICE_VAULT_ENCRYPTION_VERSION;
     algorithm: typeof SERVICE_VAULT_AEAD_ALGORITHM;
@@ -37,7 +40,7 @@ export type SecretOperationLease = {
     teamId: string;
     connectionId: string;
     capabilityType: string;
-    purpose: 'provider-connection-validation' | 'remote-git-publication' | 'workflow-dispatch' | 'workflow-configuration';
+    purpose: SecretOperationPurpose;
     resourceScope: Record<string, string>;
     credentialProfileId: string;
     actorUserId: string;
@@ -47,6 +50,47 @@ export type SecretOperationLease = {
     expiresAt: string;
     consumedAt?: string | null;
     operationCorrelationId: string;
+    hostedBinding?: HostedSecretOperationBinding;
+    authorityRequests?: SecretOperationAuthorityRequest[];
+};
+export type HostedSecretOperationBinding = {
+    subjectType: 'declaration' | 'plan' | 'rollback';
+    subjectDigest: string;
+    deploymentId: string;
+    stackId: string;
+    environment: 'staging' | 'production';
+};
+export type SecretOperationAuthorityRequest = {
+    requestId: string;
+    connectionId: string;
+    credentialProfileId: string;
+    provider: 'cloudflare' | 'railway' | 'treeseed';
+    purpose: 'provider' | 'state-backend' | 'state-encryption';
+    capabilities: string[];
+    requiredFields: string[];
+    secretRef?: string;
+};
+export type SealedSecretOperationPayload = {
+    schemaVersion: 'treeseed.sealed-secret-operation-payload/v1';
+    leaseId: string;
+    teamId: string;
+    operationCorrelationId: string;
+    hostedBinding: HostedSecretOperationBinding;
+    algorithm: typeof SERVICE_VAULT_KEY_AGREEMENT;
+    ciphertext: string;
+};
+export type SecretOperationCredentialBundle = {
+    schemaVersion: 'treeseed.secret-operation-credential-bundle/v1';
+    leaseId: string;
+    teamId: string;
+    operationCorrelationId: string;
+    hostedBinding: HostedSecretOperationBinding;
+    materials: Array<{
+        requestId: string;
+        connectionId: string;
+        credentialProfileId: string;
+        values: Record<string, string>;
+    }>;
 };
 export type ServiceVaultAssociatedData = {
     teamId: string;
@@ -58,4 +102,7 @@ export type ServiceVaultAssociatedData = {
 };
 export declare function containsForbiddenPlaintextSecretMaterial(value: unknown, path?: string): string[];
 export declare function canonicalServiceVaultAssociatedData(input: ServiceVaultAssociatedData): string;
+export declare function canonicalHostedSecretOperationBinding(input: HostedSecretOperationBinding): string;
+export declare function validateHostedSecretOperationBinding(value: unknown): value is HostedSecretOperationBinding;
+export declare function validateSealedSecretOperationPayload(value: unknown): value is SealedSecretOperationPayload;
 export declare function validateEncryptedCredentialEnvelope(value: unknown): value is EncryptedCredentialEnvelope;

package/dist/secrets-capability/service-vault-contracts.js

@@ -2,6 +2,16 @@ const SERVICE_VAULT_ENCRYPTION_VERSION = "service-vault-v1";
 const SERVICE_VAULT_AEAD_ALGORITHM = "xchacha20-poly1305-ietf";
 const SERVICE_VAULT_KEY_AGREEMENT = "x25519-sealed-box";
 const SERVICE_VAULT_KDF = "argon2id";
+const SECRET_OPERATION_PURPOSES = [
+  "provider-connection-validation",
+  "remote-git-publication",
+  "workflow-dispatch",
+  "workflow-configuration",
+  "hosted-topology-plan",
+  "hosted-topology-apply",
+  "hosted-topology-readback",
+  "hosted-topology-rollback"
+];
 const FORBIDDEN_SECRET_KEYS = /(?:passphrase|password|plaintext|derivedKey|privateKey|apiToken|accessToken|secretValue|credentialValue)$/iu;
 function containsForbiddenPlaintextSecretMaterial(value, path = "") {
   if (!value || typeof value !== "object") return [];
@@ -23,17 +33,42 @@ function canonicalServiceVaultAssociatedData(input) {
     version: input.version
   });
 }
+const digest = /^sha256:[a-f0-9]{64}$/u;
+const identifier = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+function canonicalHostedSecretOperationBinding(input) {
+  return JSON.stringify({
+    subjectType: input.subjectType,
+    subjectDigest: input.subjectDigest,
+    deploymentId: input.deploymentId,
+    stackId: input.stackId,
+    environment: input.environment
+  });
+}
+function validateHostedSecretOperationBinding(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const binding = value;
+  return ["declaration", "plan", "rollback"].includes(String(binding.subjectType)) && digest.test(String(binding.subjectDigest)) && identifier.test(String(binding.deploymentId)) && identifier.test(String(binding.stackId)) && ["staging", "production"].includes(String(binding.environment));
+}
+function validateSealedSecretOperationPayload(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const payload = value;
+  return payload.schemaVersion === "treeseed.sealed-secret-operation-payload/v1" && payload.algorithm === SERVICE_VAULT_KEY_AGREEMENT && [payload.leaseId, payload.teamId, payload.operationCorrelationId, payload.ciphertext].every((field) => typeof field === "string" && field.length > 0) && validateHostedSecretOperationBinding(payload.hostedBinding);
+}
 function validateEncryptedCredentialEnvelope(value) {
   if (!value || typeof value !== "object") return false;
   const envelope = value;
   return envelope.version === SERVICE_VAULT_ENCRYPTION_VERSION && envelope.algorithm === SERVICE_VAULT_AEAD_ALGORITHM && [envelope.ciphertext, envelope.nonce, envelope.wrappedKey, envelope.wrappedKeyNonce, envelope.associatedData, envelope.associatedDataDigest, envelope.fingerprint].every((field) => typeof field === "string" && field.length > 0);
 }
 export {
+  SECRET_OPERATION_PURPOSES,
   SERVICE_VAULT_AEAD_ALGORITHM,
   SERVICE_VAULT_ENCRYPTION_VERSION,
   SERVICE_VAULT_KDF,
   SERVICE_VAULT_KEY_AGREEMENT,
+  canonicalHostedSecretOperationBinding,
   canonicalServiceVaultAssociatedData,
   containsForbiddenPlaintextSecretMaterial,
-  validateEncryptedCredentialEnvelope
+  validateEncryptedCredentialEnvelope,
+  validateHostedSecretOperationBinding,
+  validateSealedSecretOperationPayload
 };

package/dist/secrets-capability/service-vault-crypto.d.ts

@@ -0,0 +1,20 @@
+import { type EncryptedCredentialEnvelope, type EncryptedPrivateKeyEnvelope, type TeamVaultGrantEnvelope } from '@treeseed/sdk/secrets-capability';
+export declare function createServiceVaultKey(): Promise<Uint8Array>;
+export declare function createServiceVaultUserKeyPair(): Promise<{
+    publicKey: string;
+    privateKey: Uint8Array;
+}>;
+export declare function encryptServiceVaultPrivateKey(privateKey: Uint8Array, publicKey: string, passphrase: string, options?: {
+    opsLimit?: number;
+    memLimit?: number;
+}): Promise<EncryptedPrivateKeyEnvelope>;
+export declare function decryptServiceVaultPrivateKey(envelope: EncryptedPrivateKeyEnvelope, passphrase: string): Promise<Uint8Array>;
+export declare function createTeamVaultGrant(teamVaultKey: Uint8Array, recipientPublicKey: string): Promise<TeamVaultGrantEnvelope>;
+export declare function openTeamVaultGrant(grant: TeamVaultGrantEnvelope, recipientPrivateKey: Uint8Array): Promise<Uint8Array>;
+export declare function encryptServiceCredential(plaintext: string, teamVaultKey: Uint8Array, associatedData: string): Promise<EncryptedCredentialEnvelope>;
+export declare function decryptServiceCredential(envelope: EncryptedCredentialEnvelope, teamVaultKey: Uint8Array, expectedAssociatedData: string): Promise<string>;
+export declare function rewrapServiceCredential(envelope: EncryptedCredentialEnvelope, currentTeamVaultKey: Uint8Array, replacementTeamVaultKey: Uint8Array): Promise<EncryptedCredentialEnvelope>;
+export declare function sealSecretOperationPayload(values: Record<string, string>, operationPublicKey: string): Promise<string>;
+export declare function encryptGitHubActionsSecret(value: string, providerPublicKey: string): Promise<string>;
+export declare function openSecretOperationPayload(sealedPayload: string, operationPublicKey: string, operationPrivateKey: Uint8Array): Promise<Record<string, string>>;
+export declare function clearServiceVaultKey(value: Uint8Array | undefined): void;