@treeseed/sdk 0.13.0-rc.83 → 0.13.0-rc.85

package/dist/.treeseed-build-complete.json

@@ -1 +1 @@
-{"completedAt":"2026-09-03T07:04:23.401Z"}
+{"completedAt":"2026-09-03T08:31:01.823Z"}

package/dist/operator-contracts/catalog/hosted-topology-operations.d.ts

@@ -59,92 +59,8 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
                 connectionRef: string;
             }>>;
         };
-    }, {
-        schemaVersion: "treeseed.hosted-topology-plan/v1";
-        blockers: {
-            code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
-            message: string;
-            resourceId?: string | undefined;
-        }[];
-        planDigest: string;
-        actions: {
-            action: "noop" | "create" | "adopt" | "update";
-            resourceId: string;
-            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
-            provider: "cloudflare" | "railway";
-            providerResourceId: string | null;
-            desiredResource: {
-                id: string;
-                kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
-                provider: "cloudflare" | "railway";
-                adoption: {
-                    mode: "adopt-or-create";
-                    replacement: "forbidden";
-                    externalIdInput?: string | undefined;
-                };
-                dependsOn?: string[] | undefined;
-                parameters?: Record<string, {
-                    input: string;
-                } | {
-                    artifact: string;
-                } | {
-                    resourceOutput: {
-                        resourceId: string;
-                        output: string;
-                    };
-                } | {
-                    literal: string | number | boolean;
-                }> | undefined;
-            };
-            desiredDigest: string;
-            previousDigest: string | null;
-        }[];
-        teamId: string;
-        environment: "production" | "staging";
-        executable: false;
-        artifacts: Record<string, {
-            digest: string;
-            source: string;
-            kind: "archive";
-            format: "tar+gzip";
-        } | {
-            digest: string;
-            source: string;
-            kind: "file";
-            mediaType: string;
-        } | {
-            digest: string;
-            kind: "oci-image";
-            identity: string;
-        }>;
-        planId: string;
-        deploymentId: string;
-        stackId: string;
-        stateBackend: {
-            key: string;
-            type: "s3";
-            schemaVersion: "treeseed.hosted-state-backend/v1";
-            teamId: string;
-            environment: "production" | "staging";
-            deploymentId: string;
-            stackId: string;
-            connectionRef: string;
-            bucket: string;
-            region: string;
-            encryptionKeyRef: string;
-            bindingDigest: string;
-            endpoint?: string | undefined;
-            usePathStyle?: boolean | undefined;
-        } | null;
-        providerConnections: Partial<Record<"cloudflare" | "railway", {
-            connectionRef: string;
-            nonSecretConfig: Record<string, string | number | boolean>;
-        }>>;
-        declarationDigest: string;
-        topologyId: string;
-        platformCommit: string;
-        approvalRequired: boolean;
-    }>;
+        credentialLeaseIds?: string[] | undefined;
+    }, Record<string, unknown>>;
     readonly apply: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
         teamId: string;
     }, {}, {
@@ -246,6 +162,7 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
             platformCommit: string;
             approvalRequired: boolean;
         };
+        credentialLeaseIds?: string[] | undefined;
     }, Record<string, unknown>>;
     readonly status: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
         teamId: string;
@@ -290,34 +207,220 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
     readonly rollback: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
         teamId: string;
     }, {}, {
-        rollback: {
-            schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        approval: {
+            schemaVersion: "treeseed.hosted-topology-rollback-execution-approval/v1";
             teamId: string;
             environment: "production" | "staging";
-            operations: {
-                action: "noop" | "restore" | "delete-created";
-                resourceId: string;
-                providerResourceId: string;
-                targetDigest: string | null;
-            }[];
             deploymentId: string;
             stackId: string;
             backendBindingDigest: string;
-            rollbackId: string;
-            sourceReceiptId: string;
-            rollbackDigest: string;
+            decision: "approved";
+            approvedBy: string;
+            approvedAt: string;
+            executionDigest: string;
         };
-        approval: {
-            schemaVersion: "treeseed.hosted-topology-rollback-approval/v1";
+        execution: {
+            schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
             teamId: string;
             environment: "production" | "staging";
+            rollback: {
+                schemaVersion: "treeseed.hosted-topology-rollback/v1";
+                teamId: string;
+                environment: "production" | "staging";
+                operations: {
+                    action: "noop" | "restore" | "delete-created";
+                    resourceId: string;
+                    providerResourceId: string;
+                    targetDigest: string | null;
+                }[];
+                deploymentId: string;
+                stackId: string;
+                backendBindingDigest: string;
+                rollbackId: string;
+                sourceReceiptId: string;
+                rollbackDigest: string;
+            };
             deploymentId: string;
             stackId: string;
+            topologyId: string;
             backendBindingDigest: string;
-            decision: "approved";
-            approvedBy: string;
-            approvedAt: string;
-            rollbackDigest: string;
+            sourceReceiptId: string;
+            sourcePlanDigest: string;
+            targetPlanDigest: string;
+            executionDigest: string;
+        };
+        sourcePlan: {
+            schemaVersion: "treeseed.hosted-topology-plan/v1";
+            blockers: {
+                code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+                message: string;
+                resourceId?: string | undefined;
+            }[];
+            planDigest: string;
+            actions: {
+                action: "noop" | "create" | "adopt" | "update";
+                resourceId: string;
+                kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                provider: "cloudflare" | "railway";
+                providerResourceId: string | null;
+                desiredResource: {
+                    id: string;
+                    kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                    provider: "cloudflare" | "railway";
+                    adoption: {
+                        mode: "adopt-or-create";
+                        replacement: "forbidden";
+                        externalIdInput?: string | undefined;
+                    };
+                    dependsOn?: string[] | undefined;
+                    parameters?: Record<string, {
+                        input: string;
+                    } | {
+                        artifact: string;
+                    } | {
+                        resourceOutput: {
+                            resourceId: string;
+                            output: string;
+                        };
+                    } | {
+                        literal: string | number | boolean;
+                    }> | undefined;
+                };
+                desiredDigest: string;
+                previousDigest: string | null;
+            }[];
+            teamId: string;
+            environment: "production" | "staging";
+            executable: false;
+            artifacts: Record<string, {
+                digest: string;
+                source: string;
+                kind: "archive";
+                format: "tar+gzip";
+            } | {
+                digest: string;
+                source: string;
+                kind: "file";
+                mediaType: string;
+            } | {
+                digest: string;
+                kind: "oci-image";
+                identity: string;
+            }>;
+            planId: string;
+            deploymentId: string;
+            stackId: string;
+            stateBackend: {
+                key: string;
+                type: "s3";
+                schemaVersion: "treeseed.hosted-state-backend/v1";
+                teamId: string;
+                environment: "production" | "staging";
+                deploymentId: string;
+                stackId: string;
+                connectionRef: string;
+                bucket: string;
+                region: string;
+                encryptionKeyRef: string;
+                bindingDigest: string;
+                endpoint?: string | undefined;
+                usePathStyle?: boolean | undefined;
+            } | null;
+            providerConnections: Partial<Record<"cloudflare" | "railway", {
+                connectionRef: string;
+                nonSecretConfig: Record<string, string | number | boolean>;
+            }>>;
+            declarationDigest: string;
+            topologyId: string;
+            platformCommit: string;
+            approvalRequired: boolean;
+        };
+        targetPlan: {
+            schemaVersion: "treeseed.hosted-topology-plan/v1";
+            blockers: {
+                code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+                message: string;
+                resourceId?: string | undefined;
+            }[];
+            planDigest: string;
+            actions: {
+                action: "noop" | "create" | "adopt" | "update";
+                resourceId: string;
+                kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                provider: "cloudflare" | "railway";
+                providerResourceId: string | null;
+                desiredResource: {
+                    id: string;
+                    kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                    provider: "cloudflare" | "railway";
+                    adoption: {
+                        mode: "adopt-or-create";
+                        replacement: "forbidden";
+                        externalIdInput?: string | undefined;
+                    };
+                    dependsOn?: string[] | undefined;
+                    parameters?: Record<string, {
+                        input: string;
+                    } | {
+                        artifact: string;
+                    } | {
+                        resourceOutput: {
+                            resourceId: string;
+                            output: string;
+                        };
+                    } | {
+                        literal: string | number | boolean;
+                    }> | undefined;
+                };
+                desiredDigest: string;
+                previousDigest: string | null;
+            }[];
+            teamId: string;
+            environment: "production" | "staging";
+            executable: false;
+            artifacts: Record<string, {
+                digest: string;
+                source: string;
+                kind: "archive";
+                format: "tar+gzip";
+            } | {
+                digest: string;
+                source: string;
+                kind: "file";
+                mediaType: string;
+            } | {
+                digest: string;
+                kind: "oci-image";
+                identity: string;
+            }>;
+            planId: string;
+            deploymentId: string;
+            stackId: string;
+            stateBackend: {
+                key: string;
+                type: "s3";
+                schemaVersion: "treeseed.hosted-state-backend/v1";
+                teamId: string;
+                environment: "production" | "staging";
+                deploymentId: string;
+                stackId: string;
+                connectionRef: string;
+                bucket: string;
+                region: string;
+                encryptionKeyRef: string;
+                bindingDigest: string;
+                endpoint?: string | undefined;
+                usePathStyle?: boolean | undefined;
+            } | null;
+            providerConnections: Partial<Record<"cloudflare" | "railway", {
+                connectionRef: string;
+                nonSecretConfig: Record<string, string | number | boolean>;
+            }>>;
+            declarationDigest: string;
+            topologyId: string;
+            platformCommit: string;
+            approvalRequired: boolean;
         };
+        credentialLeaseIds?: string[] | undefined;
     }, Record<string, unknown>>;
 };

package/dist/operator-contracts/catalog/hosted-topology-operations.js

@@ -1,10 +1,11 @@
 import { z } from "zod";
-import { hostedTopologyApprovalSchema, hostedTopologyDeclarationSchema, hostedTopologyPlanSchema, hostedTopologyReceiptSchema, hostedTopologyRollbackApprovalSchema, hostedTopologyRollbackSchema } from "../../deployment/hosted-topology.js";
+import { hostedTopologyApprovalSchema, hostedTopologyDeclarationSchema, hostedTopologyPlanSchema, hostedTopologyReceiptSchema, hostedTopologyRollbackExecutionApprovalSchema, hostedTopologyRollbackExecutionSchema } from "../../deployment/hosted-topology.js";
 import { defineOperation } from "../operation-builder.js";
 const teamPath = z.object({ teamId: z.string().min(1) }).strict();
 const empty = z.object({}).strict();
 const none = z.undefined();
 const operationReceipt = z.record(z.unknown());
+const credentialLeaseIds = z.array(z.string().min(1)).min(1).optional();
 const HOSTED_TOPOLOGY_OPERATIONS = {
   plan: defineOperation({
     operationId: "infrastructure.topology.plan",
@@ -21,7 +22,7 @@ const HOSTED_TOPOLOGY_OPERATIONS = {
     cacheScope: "none",
     pagination: "none",
     idempotencyRequired: false
-  }, { path: teamPath, query: empty, body: z.object({ declaration: hostedTopologyDeclarationSchema }).strict(), output: hostedTopologyPlanSchema }),
+  }, { path: teamPath, query: empty, body: z.object({ declaration: hostedTopologyDeclarationSchema, credentialLeaseIds }).strict(), output: operationReceipt }),
   apply: defineOperation({
     operationId: "infrastructure.topology.apply",
     description: "Apply an exact approved hosted topology plan through the operations runner.",
@@ -38,7 +39,7 @@ const HOSTED_TOPOLOGY_OPERATIONS = {
     pagination: "none",
     concurrencyRequired: true,
     redactedPaths: ["body.approval.approvedBy"]
-  }, { path: teamPath, query: empty, body: z.object({ plan: hostedTopologyPlanSchema, approval: hostedTopologyApprovalSchema }).strict(), output: operationReceipt }),
+  }, { path: teamPath, query: empty, body: z.object({ plan: hostedTopologyPlanSchema, approval: hostedTopologyApprovalSchema, credentialLeaseIds }).strict(), output: operationReceipt }),
   status: defineOperation({
     operationId: "infrastructure.topology.status",
     description: "Read the latest authoritative hosted topology receipt and operation state.",
@@ -70,7 +71,13 @@ const HOSTED_TOPOLOGY_OPERATIONS = {
     pagination: "none",
     concurrencyRequired: true,
     redactedPaths: ["body.approval.approvedBy"]
-  }, { path: teamPath, query: empty, body: z.object({ rollback: hostedTopologyRollbackSchema, approval: hostedTopologyRollbackApprovalSchema }).strict(), output: operationReceipt })
+  }, { path: teamPath, query: empty, body: z.object({
+    execution: hostedTopologyRollbackExecutionSchema,
+    approval: hostedTopologyRollbackExecutionApprovalSchema,
+    sourcePlan: hostedTopologyPlanSchema,
+    targetPlan: hostedTopologyPlanSchema,
+    credentialLeaseIds
+  }).strict(), output: operationReceipt })
 };
 export {
   HOSTED_TOPOLOGY_OPERATIONS

package/dist/operator-contracts/catalog/services/service-vault-operations.d.ts

@@ -1,17 +1,17 @@
 export declare const SERVICE_VAULT_OPERATIONS: {
-    readonly userVaultKey: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-    readonly putUserVaultKey: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-    readonly teamVault: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-    readonly initializeTeamVault: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-    readonly resetTeamVault: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-    readonly rotateTeamVault: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-    readonly vaultGrantCandidates: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-    readonly createVaultGrant: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-    readonly deleteVaultGrant: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-    readonly vaultCredentialEnvelopes: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-    readonly credentialEnvelopes: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-    readonly putCredentialEnvelope: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-    readonly createOperationLease: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-    readonly operationLease: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-    readonly putOperationLeasePayload: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+    readonly userVaultKey: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly putUserVaultKey: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly teamVault: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly initializeTeamVault: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly resetTeamVault: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly rotateTeamVault: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly vaultGrantCandidates: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly createVaultGrant: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly deleteVaultGrant: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly vaultCredentialEnvelopes: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly credentialEnvelopes: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly putCredentialEnvelope: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly createOperationLease: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly operationLease: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+    readonly putOperationLeasePayload: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
 };

package/dist/operator-contracts/catalog/services/service-vault-operations.js

@@ -21,46 +21,70 @@ function vaultOperation(operationId, method, path, pathSchema, options = {}) {
     cacheScope: read ? "principal" : "none",
     pagination: "none",
     redactedPaths: options.redactedPaths
-  }, { path: pathSchema, query: read ? record : empty, body: read ? none : record, output: record });
+  }, { path: pathSchema, query: read ? record : empty, body: read ? none : options.body ?? record, output: options.output ?? record });
 }
+const nullableRecord = record.nullable(), records = z.array(record);
+const encryptedPrivateKeyEnvelope = z.object({
+  version: z.literal("service-vault-v1"),
+  algorithm: z.literal("xchacha20-poly1305-ietf"),
+  kdf: z.object({ algorithm: z.literal("argon2id"), opsLimit: z.number().int().positive(), memLimit: z.number().int().positive(), salt: z.string().min(1) }).strict(),
+  nonce: z.string().min(1),
+  ciphertext: z.string().min(1),
+  publicKey: z.string().min(1)
+}).strict();
+const encryptedCredentialEnvelope = z.object({
+  version: z.literal("service-vault-v1"),
+  algorithm: z.literal("xchacha20-poly1305-ietf"),
+  ciphertext: z.string().min(1),
+  nonce: z.string().min(1),
+  wrappedKey: z.string().min(1),
+  wrappedKeyNonce: z.string().min(1),
+  associatedData: z.string().min(1),
+  associatedDataDigest: z.string().min(1),
+  fingerprint: z.string().min(1)
+}).strict();
 const SERVICE_VAULT_OPERATIONS = {
-  userVaultKey: vaultOperation("services.vault.user.key.show", "GET", "/v1/users/me/vault-key", empty),
+  userVaultKey: vaultOperation("services.vault.user.key.show", "GET", "/v1/users/me/vault-key", empty, { output: nullableRecord }),
   putUserVaultKey: vaultOperation(
     "services.vault.user.key.put",
     "PUT",
     "/v1/users/me/vault-key",
     empty,
-    { risk: "credential", redactedPaths: ["body.encryptedPrivateKeyEnvelope"] }
+    { risk: "credential", redactedPaths: ["body.encryptedPrivateKeyEnvelope"], body: z.object({ publicKey: z.string().min(1), encryptedPrivateKeyEnvelope }).strict() }
   ),
-  teamVault: vaultOperation("services.vault.team.show", "GET", "/v1/teams/{teamId}/vault", teamPath),
+  teamVault: vaultOperation("services.vault.team.show", "GET", "/v1/teams/{teamId}/vault", teamPath, { output: nullableRecord }),
   initializeTeamVault: vaultOperation(
     "services.vault.team.initialize",
     "POST",
     "/v1/teams/{teamId}/vault",
     teamPath,
-    { risk: "credential", redactedPaths: ["body.wrappedTeamVaultKey"] }
+    { risk: "credential", redactedPaths: ["body.wrappedTeamVaultKey"], body: z.object({ userVaultKeyId: z.string().min(1), wrappedTeamVaultKey: z.string().min(1), encryptionVersion: z.literal("service-vault-v1") }).strict() }
   ),
   resetTeamVault: vaultOperation(
     "services.vault.team.reset",
     "POST",
     "/v1/teams/{teamId}/vault/reset",
     teamPath,
-    { risk: "destructive", redactedPaths: ["body.wrappedTeamVaultKey", "body.currentPassword"] }
+    { risk: "destructive", redactedPaths: ["body.wrappedTeamVaultKey", "body.currentPassword"], body: z.object({ userVaultKeyId: z.string().min(1), wrappedTeamVaultKey: z.string().min(1), encryptionVersion: z.literal("service-vault-v1"), confirmation: z.string().min(1), currentPassword: z.string().min(1) }).strict() }
   ),
   rotateTeamVault: vaultOperation(
     "services.vault.team.rotate",
     "POST",
     "/v1/teams/{teamId}/vault/rotate",
     teamPath,
-    { risk: "credential", redactedPaths: ["body.envelopes", "body.grants"] }
+    { risk: "credential", redactedPaths: ["body.envelopes", "body.grants"], body: z.object({
+      expectedKeyVersion: z.number().int().positive(),
+      envelopes: z.array(z.object({ id: z.string().min(1), envelope: encryptedCredentialEnvelope }).strict()),
+      grants: z.array(z.object({ userId: z.string().min(1), userVaultKeyId: z.string().min(1), wrappedTeamVaultKey: z.string().min(1) }).strict()).min(1)
+    }).strict() }
   ),
-  vaultGrantCandidates: vaultOperation("services.vault.grant.candidates.list", "GET", "/v1/teams/{teamId}/vault/grant-candidates", teamPath),
+  vaultGrantCandidates: vaultOperation("services.vault.grant.candidates.list", "GET", "/v1/teams/{teamId}/vault/grant-candidates", teamPath, { output: records }),
   createVaultGrant: vaultOperation(
     "services.vault.grants.create",
     "POST",
     "/v1/teams/{teamId}/vault/grants",
     teamPath,
-    { risk: "credential", redactedPaths: ["body.wrappedTeamVaultKey"] }
+    { risk: "credential", redactedPaths: ["body.wrappedTeamVaultKey"], body: z.object({ userId: z.string().min(1), userVaultKeyId: z.string().min(1), wrappedTeamVaultKey: z.string().min(1) }).strict() }
   ),
   deleteVaultGrant: vaultOperation(
     "services.vault.grants.delete",
@@ -73,27 +97,47 @@ const SERVICE_VAULT_OPERATIONS = {
     "services.vault.credential.envelopes.list",
     "GET",
     "/v1/teams/{teamId}/vault/credential-envelopes",
-    teamPath
+    teamPath,
+    { output: records }
   ),
   credentialEnvelopes: vaultOperation(
     "services.credential.envelopes.list",
     "GET",
     "/v1/teams/{teamId}/services/{connectionId}/credential-envelopes",
-    z.object({ teamId: z.string().min(1), connectionId: z.string().min(1) }).strict()
+    z.object({ teamId: z.string().min(1), connectionId: z.string().min(1) }).strict(),
+    { output: records }
   ),
   putCredentialEnvelope: vaultOperation(
     "services.credential.envelopes.put",
     "POST",
     "/v1/teams/{teamId}/services/{connectionId}/credential-envelopes",
     z.object({ teamId: z.string().min(1), connectionId: z.string().min(1) }).strict(),
-    { risk: "credential", redactedPaths: ["body.envelope"] }
+    { risk: "credential", redactedPaths: ["body.envelope"], body: z.object({ definitionId: z.string().min(1), fieldKey: z.string().min(1), keyVersion: z.number().int().positive(), envelope: encryptedCredentialEnvelope }).strict() }
   ),
   createOperationLease: vaultOperation(
     "services.operation.leases.create",
     "POST",
     "/v1/teams/{teamId}/service-operation-leases",
     teamPath,
-    { risk: "authority" }
+    { risk: "authority", body: z.object({
+      connectionId: z.string().min(1),
+      capabilityType: z.string().min(1),
+      credentialProfileId: z.string().min(1),
+      purpose: z.enum([
+        "provider-connection-validation",
+        "remote-git-publication",
+        "workflow-dispatch",
+        "workflow-configuration",
+        "hosted-topology-plan",
+        "hosted-topology-apply",
+        "hosted-topology-readback",
+        "hosted-topology-rollback"
+      ]),
+      idempotencyKey: z.string().min(1).optional(),
+      resourceScope: record.optional(),
+      hostedBinding: record.optional(),
+      authorityRequests: z.array(record).optional()
+    }).strict() }
   ),
   operationLease: vaultOperation(
     "services.operation.leases.show",
@@ -106,7 +150,7 @@ const SERVICE_VAULT_OPERATIONS = {
     "PUT",
     "/v1/teams/{teamId}/service-operation-leases/{leaseId}/payload",
     z.object({ teamId: z.string().min(1), leaseId: z.string().min(1) }).strict(),
-    { risk: "credential", redactedPaths: ["body.sealedPayload"] }
+    { risk: "credential", redactedPaths: ["body.sealedPayload"], body: z.object({ sealedPayload: z.string().min(1) }).strict() }
   )
 };
 export {

package/dist/operator-contracts/control-plane-operations.d.ts

@@ -62,92 +62,8 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                         connectionRef: string;
                     }>>;
                 };
-            }, {
-                schemaVersion: "treeseed.hosted-topology-plan/v1";
-                blockers: {
-                    code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
-                    message: string;
-                    resourceId?: string | undefined;
-                }[];
-                planDigest: string;
-                actions: {
-                    action: "noop" | "create" | "adopt" | "update";
-                    resourceId: string;
-                    kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
-                    provider: "cloudflare" | "railway";
-                    providerResourceId: string | null;
-                    desiredResource: {
-                        id: string;
-                        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
-                        provider: "cloudflare" | "railway";
-                        adoption: {
-                            mode: "adopt-or-create";
-                            replacement: "forbidden";
-                            externalIdInput?: string | undefined;
-                        };
-                        dependsOn?: string[] | undefined;
-                        parameters?: Record<string, {
-                            input: string;
-                        } | {
-                            artifact: string;
-                        } | {
-                            resourceOutput: {
-                                resourceId: string;
-                                output: string;
-                            };
-                        } | {
-                            literal: string | number | boolean;
-                        }> | undefined;
-                    };
-                    desiredDigest: string;
-                    previousDigest: string | null;
-                }[];
-                teamId: string;
-                environment: "production" | "staging";
-                executable: false;
-                artifacts: Record<string, {
-                    digest: string;
-                    source: string;
-                    kind: "archive";
-                    format: "tar+gzip";
-                } | {
-                    digest: string;
-                    source: string;
-                    kind: "file";
-                    mediaType: string;
-                } | {
-                    digest: string;
-                    kind: "oci-image";
-                    identity: string;
-                }>;
-                planId: string;
-                deploymentId: string;
-                stackId: string;
-                stateBackend: {
-                    key: string;
-                    type: "s3";
-                    schemaVersion: "treeseed.hosted-state-backend/v1";
-                    teamId: string;
-                    environment: "production" | "staging";
-                    deploymentId: string;
-                    stackId: string;
-                    connectionRef: string;
-                    bucket: string;
-                    region: string;
-                    encryptionKeyRef: string;
-                    bindingDigest: string;
-                    endpoint?: string | undefined;
-                    usePathStyle?: boolean | undefined;
-                } | null;
-                providerConnections: Partial<Record<"cloudflare" | "railway", {
-                    connectionRef: string;
-                    nonSecretConfig: Record<string, string | number | boolean>;
-                }>>;
-                declarationDigest: string;
-                topologyId: string;
-                platformCommit: string;
-                approvalRequired: boolean;
-            }>;
+                credentialLeaseIds?: string[] | undefined;
+            }, Record<string, unknown>>;
             readonly apply: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
                 teamId: string;
             }, {}, {
@@ -249,6 +165,7 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                     platformCommit: string;
                     approvalRequired: boolean;
                 };
+                credentialLeaseIds?: string[] | undefined;
             }, Record<string, unknown>>;
             readonly status: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
                 teamId: string;
@@ -293,35 +210,221 @@ export declare const CONTROL_PLANE_OPERATIONS: {
             readonly rollback: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
                 teamId: string;
             }, {}, {
-                rollback: {
-                    schemaVersion: "treeseed.hosted-topology-rollback/v1";
+                approval: {
+                    schemaVersion: "treeseed.hosted-topology-rollback-execution-approval/v1";
                     teamId: string;
                     environment: "production" | "staging";
-                    operations: {
-                        action: "noop" | "restore" | "delete-created";
-                        resourceId: string;
-                        providerResourceId: string;
-                        targetDigest: string | null;
-                    }[];
                     deploymentId: string;
                     stackId: string;
                     backendBindingDigest: string;
-                    rollbackId: string;
-                    sourceReceiptId: string;
-                    rollbackDigest: string;
+                    decision: "approved";
+                    approvedBy: string;
+                    approvedAt: string;
+                    executionDigest: string;
                 };
-                approval: {
-                    schemaVersion: "treeseed.hosted-topology-rollback-approval/v1";
+                execution: {
+                    schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
                     teamId: string;
                     environment: "production" | "staging";
+                    rollback: {
+                        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+                        teamId: string;
+                        environment: "production" | "staging";
+                        operations: {
+                            action: "noop" | "restore" | "delete-created";
+                            resourceId: string;
+                            providerResourceId: string;
+                            targetDigest: string | null;
+                        }[];
+                        deploymentId: string;
+                        stackId: string;
+                        backendBindingDigest: string;
+                        rollbackId: string;
+                        sourceReceiptId: string;
+                        rollbackDigest: string;
+                    };
                     deploymentId: string;
                     stackId: string;
+                    topologyId: string;
                     backendBindingDigest: string;
-                    decision: "approved";
-                    approvedBy: string;
-                    approvedAt: string;
-                    rollbackDigest: string;
+                    sourceReceiptId: string;
+                    sourcePlanDigest: string;
+                    targetPlanDigest: string;
+                    executionDigest: string;
+                };
+                sourcePlan: {
+                    schemaVersion: "treeseed.hosted-topology-plan/v1";
+                    blockers: {
+                        code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+                        message: string;
+                        resourceId?: string | undefined;
+                    }[];
+                    planDigest: string;
+                    actions: {
+                        action: "noop" | "create" | "adopt" | "update";
+                        resourceId: string;
+                        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                        provider: "cloudflare" | "railway";
+                        providerResourceId: string | null;
+                        desiredResource: {
+                            id: string;
+                            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                            provider: "cloudflare" | "railway";
+                            adoption: {
+                                mode: "adopt-or-create";
+                                replacement: "forbidden";
+                                externalIdInput?: string | undefined;
+                            };
+                            dependsOn?: string[] | undefined;
+                            parameters?: Record<string, {
+                                input: string;
+                            } | {
+                                artifact: string;
+                            } | {
+                                resourceOutput: {
+                                    resourceId: string;
+                                    output: string;
+                                };
+                            } | {
+                                literal: string | number | boolean;
+                            }> | undefined;
+                        };
+                        desiredDigest: string;
+                        previousDigest: string | null;
+                    }[];
+                    teamId: string;
+                    environment: "production" | "staging";
+                    executable: false;
+                    artifacts: Record<string, {
+                        digest: string;
+                        source: string;
+                        kind: "archive";
+                        format: "tar+gzip";
+                    } | {
+                        digest: string;
+                        source: string;
+                        kind: "file";
+                        mediaType: string;
+                    } | {
+                        digest: string;
+                        kind: "oci-image";
+                        identity: string;
+                    }>;
+                    planId: string;
+                    deploymentId: string;
+                    stackId: string;
+                    stateBackend: {
+                        key: string;
+                        type: "s3";
+                        schemaVersion: "treeseed.hosted-state-backend/v1";
+                        teamId: string;
+                        environment: "production" | "staging";
+                        deploymentId: string;
+                        stackId: string;
+                        connectionRef: string;
+                        bucket: string;
+                        region: string;
+                        encryptionKeyRef: string;
+                        bindingDigest: string;
+                        endpoint?: string | undefined;
+                        usePathStyle?: boolean | undefined;
+                    } | null;
+                    providerConnections: Partial<Record<"cloudflare" | "railway", {
+                        connectionRef: string;
+                        nonSecretConfig: Record<string, string | number | boolean>;
+                    }>>;
+                    declarationDigest: string;
+                    topologyId: string;
+                    platformCommit: string;
+                    approvalRequired: boolean;
+                };
+                targetPlan: {
+                    schemaVersion: "treeseed.hosted-topology-plan/v1";
+                    blockers: {
+                        code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
+                        message: string;
+                        resourceId?: string | undefined;
+                    }[];
+                    planDigest: string;
+                    actions: {
+                        action: "noop" | "create" | "adopt" | "update";
+                        resourceId: string;
+                        kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                        provider: "cloudflare" | "railway";
+                        providerResourceId: string | null;
+                        desiredResource: {
+                            id: string;
+                            kind: "admin-application" | "pages-application" | "dns-record" | "tls-policy" | "api-proxy" | "control-plane-api" | "postgresql" | "operations-runner" | "treedx-service";
+                            provider: "cloudflare" | "railway";
+                            adoption: {
+                                mode: "adopt-or-create";
+                                replacement: "forbidden";
+                                externalIdInput?: string | undefined;
+                            };
+                            dependsOn?: string[] | undefined;
+                            parameters?: Record<string, {
+                                input: string;
+                            } | {
+                                artifact: string;
+                            } | {
+                                resourceOutput: {
+                                    resourceId: string;
+                                    output: string;
+                                };
+                            } | {
+                                literal: string | number | boolean;
+                            }> | undefined;
+                        };
+                        desiredDigest: string;
+                        previousDigest: string | null;
+                    }[];
+                    teamId: string;
+                    environment: "production" | "staging";
+                    executable: false;
+                    artifacts: Record<string, {
+                        digest: string;
+                        source: string;
+                        kind: "archive";
+                        format: "tar+gzip";
+                    } | {
+                        digest: string;
+                        source: string;
+                        kind: "file";
+                        mediaType: string;
+                    } | {
+                        digest: string;
+                        kind: "oci-image";
+                        identity: string;
+                    }>;
+                    planId: string;
+                    deploymentId: string;
+                    stackId: string;
+                    stateBackend: {
+                        key: string;
+                        type: "s3";
+                        schemaVersion: "treeseed.hosted-state-backend/v1";
+                        teamId: string;
+                        environment: "production" | "staging";
+                        deploymentId: string;
+                        stackId: string;
+                        connectionRef: string;
+                        bucket: string;
+                        region: string;
+                        encryptionKeyRef: string;
+                        bindingDigest: string;
+                        endpoint?: string | undefined;
+                        usePathStyle?: boolean | undefined;
+                    } | null;
+                    providerConnections: Partial<Record<"cloudflare" | "railway", {
+                        connectionRef: string;
+                        nonSecretConfig: Record<string, string | number | boolean>;
+                    }>>;
+                    declarationDigest: string;
+                    topologyId: string;
+                    platformCommit: string;
+                    approvalRequired: boolean;
                 };
+                credentialLeaseIds?: string[] | undefined;
             }, Record<string, unknown>>;
         };
     };
@@ -1323,21 +1426,21 @@ export declare const CONTROL_PLANE_OPERATIONS: {
             profileId: string;
             connectionId: string;
         }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-        readonly userVaultKey: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-        readonly putUserVaultKey: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-        readonly teamVault: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-        readonly initializeTeamVault: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-        readonly resetTeamVault: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-        readonly rotateTeamVault: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-        readonly vaultGrantCandidates: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-        readonly createVaultGrant: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-        readonly deleteVaultGrant: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-        readonly vaultCredentialEnvelopes: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-        readonly credentialEnvelopes: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-        readonly putCredentialEnvelope: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-        readonly createOperationLease: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-        readonly operationLease: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-        readonly putOperationLeasePayload: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly userVaultKey: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly putUserVaultKey: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly teamVault: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly initializeTeamVault: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly resetTeamVault: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly rotateTeamVault: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly vaultGrantCandidates: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly createVaultGrant: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly deleteVaultGrant: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly vaultCredentialEnvelopes: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly credentialEnvelopes: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly putCredentialEnvelope: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly createOperationLease: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly operationLease: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        readonly putOperationLeasePayload: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
     };
     readonly agents: {
         readonly list: import("./control-plane-operation.js").ControlPlaneOperationBinding<{

package/dist/secrets-capability/service-provider-contracts.d.ts

@@ -1,5 +1,5 @@
 export declare const SERVICE_PROVIDER_IDS: readonly ["github", "cloudflare", "railway", "openbao"];
-export declare const SERVICE_CAPABILITY_TYPES: readonly ["repository-hosting", "workflow-execution", "workflow-configuration", "secret-enclave", "frontend-hosting", "backend-hosting", "dns-management", "object-storage", "database-hosting", "capacity-runtime-hosting", "private-knowledge-index-hosting", "artifact-hosting"];
+export declare const SERVICE_CAPABILITY_TYPES: readonly ["repository-hosting", "workflow-execution", "workflow-configuration", "secret-enclave", "frontend-hosting", "backend-hosting", "dns-management", "object-storage", "state-encryption", "database-hosting", "capacity-runtime-hosting", "private-knowledge-index-hosting", "artifact-hosting"];
 export declare const SERVICE_CONNECTION_STATUSES: readonly ["draft", "active", "degraded", "validation-failed", "reentry-required", "reauthorization-required", "disconnected"];
 export declare const SERVICE_CAPABILITY_STATUSES: readonly ["configured", "disabled", "blocked", "planned"];
 export type ServiceProviderId = (typeof SERVICE_PROVIDER_IDS)[number];

package/dist/secrets-capability/service-provider-contracts.js

@@ -8,6 +8,7 @@ const SERVICE_CAPABILITY_TYPES = [
   "backend-hosting",
   "dns-management",
   "object-storage",
+  "state-encryption",
   "database-hosting",
   "capacity-runtime-hosting",
   "private-knowledge-index-hosting",
@@ -127,12 +128,15 @@ const SERVICE_PROVIDER_CATALOG = [
     capabilities: [
       { type: "frontend-hosting", label: "Frontend hosting", description: "Pages and Workers application hosting.", credentialProfileIds: ["cloudflare-runtime"], status: "available" },
       { type: "dns-management", label: "DNS management", description: "Scoped DNS record management.", credentialProfileIds: ["cloudflare-dns"], status: "available" },
-      { type: "object-storage", label: "Object storage", description: "R2-backed immutable publication and private artifact storage.", credentialProfileIds: ["cloudflare-storage"], status: "available" }
+      { type: "object-storage", label: "Object storage", description: "R2-backed immutable publication, private artifact storage, and scoped S3 state access.", credentialProfileIds: ["cloudflare-storage", "s3-state-session"], status: "available" },
+      { type: "state-encryption", label: "State encryption", description: "Independent encryption authority for OpenTofu state and plan files.", credentialProfileIds: ["opentofu-state-encryption"], status: "available" }
     ],
     credentialProfiles: [
       { id: "cloudflare-runtime", label: "Pages and Workers token", description: "A token limited to application deployment resources.", capabilities: ["frontend-hosting"], fields: [field("apiToken", "API token", "Encrypted in this browser and used only for authorized frontend operations.", true, true)], permissions: ["Account: Workers Scripts Edit", "Account: Pages Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
       { id: "cloudflare-dns", label: "DNS token", description: "A token restricted to selected zones.", capabilities: ["dns-management"], fields: [field("apiToken", "DNS API token", "Encrypted separately from deployment authority.", true, true)], permissions: ["Zone: DNS Edit for only the managed zones"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
-      { id: "cloudflare-storage", label: "Storage authority", description: "Vault-custodied R2 management and S3-compatible state credentials, isolated from runtime and DNS authority.", capabilities: ["object-storage"], fields: [field("apiToken", "Storage API token", "Encrypted separately and used only to reconcile authorized R2 resources.", true, true), field("accessKeyId", "R2 access key ID", "Vault-custodied S3-compatible access key identifier for encrypted OpenTofu state.", true, true), field("secretAccessKey", "R2 secret access key", "Vault-custodied S3-compatible secret key for encrypted OpenTofu state.", true, true), field("stateEncryptionKey", "OpenTofu state encryption key", "Generated in the browser and encrypted separately; never store this key with the R2 state object.", true, true)], permissions: ["Account: Workers R2 Storage Edit", "Object read and write for only the managed state bucket"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] }
+      { id: "cloudflare-storage", label: "Storage management authority", description: "Vault-custodied token used only to reconcile authorized R2 resources.", capabilities: ["object-storage"], fields: [field("apiToken", "Storage API token", "Encrypted separately and used only to reconcile authorized R2 resources.", true, true)], permissions: ["Account: Workers R2 Storage Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
+      { id: "s3-state-session", label: "OpenTofu state session", description: "S3-compatible credentials limited to the selected team state prefix.", capabilities: ["object-storage"], fields: [field("accessKeyId", "R2 access key ID", "Vault-custodied S3-compatible access key identifier for encrypted OpenTofu state.", true, true), field("secretAccessKey", "R2 secret access key", "Vault-custodied S3-compatible secret key for encrypted OpenTofu state.", true, true), field("sessionToken", "R2 session token", "Optional short-lived S3-compatible session token.", false, true)], permissions: ["Object read and write for only the managed team state prefix"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
+      { id: "opentofu-state-encryption", label: "OpenTofu state encryption", description: "Independent encryption material that is never stored with the R2 state object.", capabilities: ["state-encryption"], fields: [field("stateEncryptionKey", "OpenTofu state encryption key", "Generated in the browser as a 32-byte hexadecimal key and encrypted separately.", true, true)], permissions: ["Encrypt and decrypt only the selected team OpenTofu state"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] }
     ]
   },
   {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.83",
+  "version": "0.13.0-rc.85",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {