@treeseed/sdk 0.13.0-rc.84 → 0.13.0-rc.86

package/dist/.treeseed-build-complete.json

@@ -1 +1 @@
-{"completedAt":"2026-09-03T07:35:45.110Z"}
+{"completedAt":"2026-09-03T11:02:09.609Z"}

package/dist/content/validation/content-model-schemas.d.ts

@@ -21917,7 +21917,7 @@ export declare function describeContentFrontmatterSchema(model: PortableContentM
 }>;
 /** A JSON-safe description derived directly from the canonical validation schema. */
 export declare function describeContentFrontmatterContract(model: PortableContentModel): {
-    model: "knowledge" | "decision" | "agent" | "objective" | "workday" | "proposal" | "question" | "group" | "discussion" | "page" | "person" | "note" | "book" | "discussion_message" | "discussion_event" | "group_edge" | "agent_context_query" | "agent_context_query_set" | "agent_instruction_template" | "discussion_topic" | "assignment_plan" | "assignment_status" | "assignment_summary" | "agent_evaluation" | "agent_test" | "template_product";
+    model: "knowledge" | "agent" | "decision" | "objective" | "workday" | "proposal" | "question" | "group" | "discussion" | "page" | "person" | "note" | "book" | "discussion_message" | "discussion_event" | "group_edge" | "agent_context_query" | "agent_context_query_set" | "agent_instruction_template" | "discussion_topic" | "assignment_plan" | "assignment_status" | "assignment_summary" | "agent_evaluation" | "agent_test" | "template_product";
     fields: {
         [k: string]: Record<string, unknown>;
     };

package/dist/deployment/hosted-topology-template.d.ts

@@ -6,7 +6,7 @@ export declare const hostedTopologyTemplateSchema: z.ZodEffects<z.ZodObject<{
     deploymentId: z.ZodString;
     stackId: z.ZodString;
     environment: z.ZodEnum<["staging", "production"]>;
-    mutation: z.ZodLiteral<"approval-required">;
+    mutation: z.ZodLiteral<"agent-authorized">;
     stateBackend: z.ZodObject<{
         connectionRef: z.ZodString;
     }, "strict", z.ZodTypeAny, {
@@ -160,7 +160,7 @@ export declare const hostedTopologyTemplateSchema: z.ZodEffects<z.ZodObject<{
         };
     }[];
     id: string;
-    mutation: "approval-required";
+    mutation: "agent-authorized";
     environment: "production" | "staging";
     deploymentId: string;
     stackId: string;
@@ -200,7 +200,7 @@ export declare const hostedTopologyTemplateSchema: z.ZodEffects<z.ZodObject<{
         }> | undefined;
     }[];
     id: string;
-    mutation: "approval-required";
+    mutation: "agent-authorized";
     environment: "production" | "staging";
     deploymentId: string;
     stackId: string;
@@ -240,7 +240,7 @@ export declare const hostedTopologyTemplateSchema: z.ZodEffects<z.ZodObject<{
         };
     }[];
     id: string;
-    mutation: "approval-required";
+    mutation: "agent-authorized";
     environment: "production" | "staging";
     deploymentId: string;
     stackId: string;
@@ -280,7 +280,7 @@ export declare const hostedTopologyTemplateSchema: z.ZodEffects<z.ZodObject<{
         }> | undefined;
     }[];
     id: string;
-    mutation: "approval-required";
+    mutation: "agent-authorized";
     environment: "production" | "staging";
     deploymentId: string;
     stackId: string;
@@ -421,7 +421,7 @@ export declare function compileHostedTopologyTemplate(input: {
         repository: "treeseed-ai/platform";
         commit: string;
     };
-    mutation: "approval-required";
+    mutation: "agent-authorized";
     environment: "production" | "staging";
     artifacts: Record<string, {
         digest: string;

package/dist/deployment/hosted-topology-template.js

@@ -9,7 +9,7 @@ const hostedTopologyTemplateSchema = z.object({
   deploymentId: custodyIdentifier,
   stackId: custodyIdentifier,
   environment: z.enum(["staging", "production"]),
-  mutation: z.literal("approval-required"),
+  mutation: z.literal("agent-authorized"),
   stateBackend: z.object({ connectionRef: identifier }).strict(),
   providerConnections: z.record(hostedProviderSchema, z.object({ connectionRef: identifier }).strict()),
   artifactBindings: z.record(identifier, z.object({ input: identifier, kind: z.enum(["archive", "file", "oci-image"]) }).strict()),

package/dist/deployment/hosted-topology.d.ts

@@ -320,7 +320,7 @@ export declare const hostedTopologyDeclarationSchema: z.ZodEffects<z.ZodObject<{
     deploymentId: z.ZodString;
     stackId: z.ZodString;
     environment: z.ZodEnum<["staging", "production"]>;
-    mutation: z.ZodLiteral<"approval-required">;
+    mutation: z.ZodLiteral<"agent-authorized">;
     platform: z.ZodObject<{
         repository: z.ZodLiteral<"treeseed-ai/platform">;
         commit: z.ZodString;
@@ -530,7 +530,7 @@ export declare const hostedTopologyDeclarationSchema: z.ZodEffects<z.ZodObject<{
         repository: "treeseed-ai/platform";
         commit: string;
     };
-    mutation: "approval-required";
+    mutation: "agent-authorized";
     environment: "production" | "staging";
     artifacts: Record<string, {
         digest: string;
@@ -586,7 +586,7 @@ export declare const hostedTopologyDeclarationSchema: z.ZodEffects<z.ZodObject<{
         repository: "treeseed-ai/platform";
         commit: string;
     };
-    mutation: "approval-required";
+    mutation: "agent-authorized";
     environment: "production" | "staging";
     artifacts: Record<string, {
         digest: string;
@@ -642,7 +642,7 @@ export declare const hostedTopologyDeclarationSchema: z.ZodEffects<z.ZodObject<{
         repository: "treeseed-ai/platform";
         commit: string;
     };
-    mutation: "approval-required";
+    mutation: "agent-authorized";
     environment: "production" | "staging";
     artifacts: Record<string, {
         digest: string;
@@ -698,7 +698,7 @@ export declare const hostedTopologyDeclarationSchema: z.ZodEffects<z.ZodObject<{
         repository: "treeseed-ai/platform";
         commit: string;
     };
-    mutation: "approval-required";
+    mutation: "agent-authorized";
     environment: "production" | "staging";
     artifacts: Record<string, {
         digest: string;
@@ -1094,7 +1094,7 @@ export declare const hostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<{
         message: string;
         resourceId?: string | undefined;
     }>, "many">;
-    readonly approvalRequired: z.ZodBoolean;
+    readonly authorization: z.ZodLiteral<"authenticated-agent">;
     readonly executable: z.ZodLiteral<false>;
 }, "strict", z.ZodTypeAny, {
     schemaVersion: "treeseed.hosted-topology-plan/v1";
@@ -1180,7 +1180,7 @@ export declare const hostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<{
     declarationDigest: string;
     topologyId: string;
     platformCommit: string;
-    approvalRequired: boolean;
+    authorization: "authenticated-agent";
 }, {
     schemaVersion: "treeseed.hosted-topology-plan/v1";
     blockers: {
@@ -1265,7 +1265,7 @@ export declare const hostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<{
     declarationDigest: string;
     topologyId: string;
     platformCommit: string;
-    approvalRequired: boolean;
+    authorization: "authenticated-agent";
 }>, {
     schemaVersion: "treeseed.hosted-topology-plan/v1";
     blockers: {
@@ -1350,7 +1350,7 @@ export declare const hostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<{
     declarationDigest: string;
     topologyId: string;
     platformCommit: string;
-    approvalRequired: boolean;
+    authorization: "authenticated-agent";
 }, {
     schemaVersion: "treeseed.hosted-topology-plan/v1";
     blockers: {
@@ -1435,78 +1435,10 @@ export declare const hostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<{
     declarationDigest: string;
     topologyId: string;
     platformCommit: string;
-    approvalRequired: boolean;
+    authorization: "authenticated-agent";
 }>;
-export declare const hostedTopologyApprovalSchema: z.ZodObject<{
-    schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-approval/v1">;
-    planDigest: z.ZodString;
-    teamId: z.ZodString;
-    deploymentId: z.ZodString;
-    stackId: z.ZodString;
-    environment: z.ZodEnum<["staging", "production"]>;
-    backendBindingDigest: z.ZodString;
-    decision: z.ZodLiteral<"approved">;
-    approvedBy: z.ZodString;
-    approvedAt: z.ZodString;
-}, "strict", z.ZodTypeAny, {
-    schemaVersion: "treeseed.hosted-topology-approval/v1";
-    planDigest: string;
-    teamId: string;
-    environment: "production" | "staging";
-    deploymentId: string;
-    stackId: string;
-    backendBindingDigest: string;
-    decision: "approved";
-    approvedBy: string;
-    approvedAt: string;
-}, {
-    schemaVersion: "treeseed.hosted-topology-approval/v1";
-    planDigest: string;
-    teamId: string;
-    environment: "production" | "staging";
-    deploymentId: string;
-    stackId: string;
-    backendBindingDigest: string;
-    decision: "approved";
-    approvedBy: string;
-    approvedAt: string;
-}>;
-export declare const authorizedHostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<Omit<{
+export declare const authorizedHostedTopologyPlanSchema: z.ZodEffects<z.ZodObject<{
     executable: z.ZodLiteral<true>;
-    approval: z.ZodNullable<z.ZodObject<{
-        schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-approval/v1">;
-        planDigest: z.ZodString;
-        teamId: z.ZodString;
-        deploymentId: z.ZodString;
-        stackId: z.ZodString;
-        environment: z.ZodEnum<["staging", "production"]>;
-        backendBindingDigest: z.ZodString;
-        decision: z.ZodLiteral<"approved">;
-        approvedBy: z.ZodString;
-        approvedAt: z.ZodString;
-    }, "strict", z.ZodTypeAny, {
-        schemaVersion: "treeseed.hosted-topology-approval/v1";
-        planDigest: string;
-        teamId: string;
-        environment: "production" | "staging";
-        deploymentId: string;
-        stackId: string;
-        backendBindingDigest: string;
-        decision: "approved";
-        approvedBy: string;
-        approvedAt: string;
-    }, {
-        schemaVersion: "treeseed.hosted-topology-approval/v1";
-        planDigest: string;
-        teamId: string;
-        environment: "production" | "staging";
-        deploymentId: string;
-        stackId: string;
-        backendBindingDigest: string;
-        decision: "approved";
-        approvedBy: string;
-        approvedAt: string;
-    }>>;
     schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-plan/v1">;
     planId: z.ZodString;
     planDigest: z.ZodString;
@@ -1848,8 +1780,8 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodEffects<z.ZodObjec
         message: string;
         resourceId?: string | undefined;
     }>, "many">;
-    approvalRequired: z.ZodBoolean;
-}, "approvalRequired">, "strict", z.ZodTypeAny, {
+    authorization: z.ZodLiteral<"authenticated-agent">;
+}, "strict", z.ZodTypeAny, {
     schemaVersion: "treeseed.hosted-topology-plan/v1";
     blockers: {
         code: "connection-unavailable" | "state-backend-unavailable" | "dependency-cycle" | "observation-unhealthy" | "adoption-drift";
@@ -1933,18 +1865,7 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodEffects<z.ZodObjec
     declarationDigest: string;
     topologyId: string;
     platformCommit: string;
-    approval: {
-        schemaVersion: "treeseed.hosted-topology-approval/v1";
-        planDigest: string;
-        teamId: string;
-        environment: "production" | "staging";
-        deploymentId: string;
-        stackId: string;
-        backendBindingDigest: string;
-        decision: "approved";
-        approvedBy: string;
-        approvedAt: string;
-    } | null;
+    authorization: "authenticated-agent";
 }, {
     schemaVersion: "treeseed.hosted-topology-plan/v1";
     blockers: {
@@ -2029,18 +1950,7 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodEffects<z.ZodObjec
     declarationDigest: string;
     topologyId: string;
     platformCommit: string;
-    approval: {
-        schemaVersion: "treeseed.hosted-topology-approval/v1";
-        planDigest: string;
-        teamId: string;
-        environment: "production" | "staging";
-        deploymentId: string;
-        stackId: string;
-        backendBindingDigest: string;
-        decision: "approved";
-        approvedBy: string;
-        approvedAt: string;
-    } | null;
+    authorization: "authenticated-agent";
 }>, {
     schemaVersion: "treeseed.hosted-topology-plan/v1";
     blockers: {
@@ -2125,18 +2035,7 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodEffects<z.ZodObjec
     declarationDigest: string;
     topologyId: string;
     platformCommit: string;
-    approval: {
-        schemaVersion: "treeseed.hosted-topology-approval/v1";
-        planDigest: string;
-        teamId: string;
-        environment: "production" | "staging";
-        deploymentId: string;
-        stackId: string;
-        backendBindingDigest: string;
-        decision: "approved";
-        approvedBy: string;
-        approvedAt: string;
-    } | null;
+    authorization: "authenticated-agent";
 }, {
     schemaVersion: "treeseed.hosted-topology-plan/v1";
     blockers: {
@@ -2221,18 +2120,7 @@ export declare const authorizedHostedTopologyPlanSchema: z.ZodEffects<z.ZodObjec
     declarationDigest: string;
     topologyId: string;
     platformCommit: string;
-    approval: {
-        schemaVersion: "treeseed.hosted-topology-approval/v1";
-        planDigest: string;
-        teamId: string;
-        environment: "production" | "staging";
-        deploymentId: string;
-        stackId: string;
-        backendBindingDigest: string;
-        decision: "approved";
-        approvedBy: string;
-        approvedAt: string;
-    } | null;
+    authorization: "authenticated-agent";
 }>;
 export declare const hostedTopologyReceiptSchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-receipt/v1">;
@@ -2373,7 +2261,7 @@ export declare const hostedTopologyReceiptSchema: z.ZodObject<{
         observedAt: string;
     }[];
 }>;
-export declare const hostedTopologyRollbackSchema: z.ZodObject<{
+export declare const hostedTopologyRollbackSchema: z.ZodEffects<z.ZodObject<{
     schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-rollback/v1">;
     rollbackId: z.ZodString;
     sourceReceiptId: z.ZodString;
@@ -2431,44 +2319,42 @@ export declare const hostedTopologyRollbackSchema: z.ZodObject<{
     rollbackId: string;
     sourceReceiptId: string;
     rollbackDigest: string;
-}>;
-export declare const hostedTopologyRollbackApprovalSchema: z.ZodObject<{
-    schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-rollback-approval/v1">;
-    rollbackDigest: z.ZodString;
-    teamId: z.ZodString;
-    deploymentId: z.ZodString;
-    stackId: z.ZodString;
-    environment: z.ZodEnum<["staging", "production"]>;
-    backendBindingDigest: z.ZodString;
-    decision: z.ZodLiteral<"approved">;
-    approvedBy: z.ZodString;
-    approvedAt: z.ZodString;
-}, "strict", z.ZodTypeAny, {
-    schemaVersion: "treeseed.hosted-topology-rollback-approval/v1";
+}>, {
+    schemaVersion: "treeseed.hosted-topology-rollback/v1";
     teamId: string;
     environment: "production" | "staging";
+    operations: {
+        action: "noop" | "restore" | "delete-created";
+        resourceId: string;
+        providerResourceId: string;
+        targetDigest: string | null;
+    }[];
     deploymentId: string;
     stackId: string;
     backendBindingDigest: string;
-    decision: "approved";
-    approvedBy: string;
-    approvedAt: string;
+    rollbackId: string;
+    sourceReceiptId: string;
     rollbackDigest: string;
 }, {
-    schemaVersion: "treeseed.hosted-topology-rollback-approval/v1";
+    schemaVersion: "treeseed.hosted-topology-rollback/v1";
     teamId: string;
     environment: "production" | "staging";
+    operations: {
+        action: "noop" | "restore" | "delete-created";
+        resourceId: string;
+        providerResourceId: string;
+        targetDigest: string | null;
+    }[];
     deploymentId: string;
     stackId: string;
     backendBindingDigest: string;
-    decision: "approved";
-    approvedBy: string;
-    approvedAt: string;
+    rollbackId: string;
+    sourceReceiptId: string;
     rollbackDigest: string;
 }>;
 export declare const hostedTopologyRollbackExecutionSchema: z.ZodEffects<z.ZodObject<{
     schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-rollback-execution/v1">;
-    rollback: z.ZodObject<{
+    rollback: z.ZodEffects<z.ZodObject<{
         schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-rollback/v1">;
         rollbackId: z.ZodString;
         sourceReceiptId: z.ZodString;
@@ -2526,6 +2412,38 @@ export declare const hostedTopologyRollbackExecutionSchema: z.ZodEffects<z.ZodOb
         rollbackId: string;
         sourceReceiptId: string;
         rollbackDigest: string;
+    }>, {
+        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        teamId: string;
+        environment: "production" | "staging";
+        operations: {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }[];
+        deploymentId: string;
+        stackId: string;
+        backendBindingDigest: string;
+        rollbackId: string;
+        sourceReceiptId: string;
+        rollbackDigest: string;
+    }, {
+        schemaVersion: "treeseed.hosted-topology-rollback/v1";
+        teamId: string;
+        environment: "production" | "staging";
+        operations: {
+            action: "noop" | "restore" | "delete-created";
+            resourceId: string;
+            providerResourceId: string;
+            targetDigest: string | null;
+        }[];
+        deploymentId: string;
+        stackId: string;
+        backendBindingDigest: string;
+        rollbackId: string;
+        sourceReceiptId: string;
+        rollbackDigest: string;
     }>;
     sourceReceiptId: z.ZodString;
     topologyId: z.ZodString;
@@ -2654,45 +2572,10 @@ export declare const hostedTopologyRollbackExecutionSchema: z.ZodEffects<z.ZodOb
     targetPlanDigest: string;
     executionDigest: string;
 }>;
-export declare const hostedTopologyRollbackExecutionApprovalSchema: z.ZodObject<{
-    schemaVersion: z.ZodLiteral<"treeseed.hosted-topology-rollback-execution-approval/v1">;
-    executionDigest: z.ZodString;
-    teamId: z.ZodString;
-    deploymentId: z.ZodString;
-    stackId: z.ZodString;
-    environment: z.ZodEnum<["staging", "production"]>;
-    backendBindingDigest: z.ZodString;
-    decision: z.ZodLiteral<"approved">;
-    approvedBy: z.ZodString;
-    approvedAt: z.ZodString;
-}, "strict", z.ZodTypeAny, {
-    schemaVersion: "treeseed.hosted-topology-rollback-execution-approval/v1";
-    teamId: string;
-    environment: "production" | "staging";
-    deploymentId: string;
-    stackId: string;
-    backendBindingDigest: string;
-    decision: "approved";
-    approvedBy: string;
-    approvedAt: string;
-    executionDigest: string;
-}, {
-    schemaVersion: "treeseed.hosted-topology-rollback-execution-approval/v1";
-    teamId: string;
-    environment: "production" | "staging";
-    deploymentId: string;
-    stackId: string;
-    backendBindingDigest: string;
-    decision: "approved";
-    approvedBy: string;
-    approvedAt: string;
-    executionDigest: string;
-}>;
 export type HostedTopologyDeclaration = z.infer<typeof hostedTopologyDeclarationSchema>;
 export type HostedStateBackend = z.infer<typeof hostedStateBackendSchema>;
 export type HostedResourceObservation = z.infer<typeof hostedResourceObservationSchema>;
 export type HostedTopologyPlan = z.infer<typeof hostedTopologyPlanSchema>;
-export type HostedTopologyApproval = z.infer<typeof hostedTopologyApprovalSchema>;
 export type AuthorizedHostedTopologyPlan = z.infer<typeof authorizedHostedTopologyPlanSchema>;
 export type HostedTopologyReceipt = z.infer<typeof hostedTopologyReceiptSchema>;
 export type HostedTopologyRollbackExecution = z.infer<typeof hostedTopologyRollbackExecutionSchema>;
@@ -2702,7 +2585,7 @@ export declare function planHostedTopology(input: {
     connections: Partial<Record<z.infer<typeof hostedProviderSchema>, z.input<typeof hostedConnectionSnapshotSchema>>>;
     stateBackend?: z.input<typeof hostedStateBackendSchema>;
 }): HostedTopologyPlan;
-export declare function authorizeHostedTopologyPlan(planInput: HostedTopologyPlan, approvalInput?: HostedTopologyApproval): AuthorizedHostedTopologyPlan;
+export declare function authorizeHostedTopologyPlan(planInput: HostedTopologyPlan): AuthorizedHostedTopologyPlan;
 export declare function verifyHostedTopologyReadback(input: {
     plan: AuthorizedHostedTopologyPlan;
     previousResources: HostedResourceObservation[];
@@ -2726,7 +2609,7 @@ export declare function planHostedTopologyRollback(receiptInput: HostedTopologyR
     sourceReceiptId: string;
     rollbackDigest: string;
 };
-export declare function authorizeHostedTopologyRollback(rollbackInput: z.input<typeof hostedTopologyRollbackSchema>, approvalInput: z.input<typeof hostedTopologyRollbackApprovalSchema>): {
+export declare function authorizeHostedTopologyRollback(rollbackInput: z.input<typeof hostedTopologyRollbackSchema>): {
     rollback: {
         schemaVersion: "treeseed.hosted-topology-rollback/v1";
         teamId: string;
@@ -2744,18 +2627,6 @@ export declare function authorizeHostedTopologyRollback(rollbackInput: z.input<t
         sourceReceiptId: string;
         rollbackDigest: string;
     };
-    approval: {
-        schemaVersion: "treeseed.hosted-topology-rollback-approval/v1";
-        teamId: string;
-        environment: "production" | "staging";
-        deploymentId: string;
-        stackId: string;
-        backendBindingDigest: string;
-        decision: "approved";
-        approvedBy: string;
-        approvedAt: string;
-        rollbackDigest: string;
-    };
 };
 export declare function planHostedTopologyRollbackExecution(input: {
     rollback: z.input<typeof hostedTopologyRollbackSchema>;
@@ -2792,7 +2663,7 @@ export declare function planHostedTopologyRollbackExecution(input: {
     targetPlanDigest: string;
     executionDigest: string;
 };
-export declare function authorizeHostedTopologyRollbackExecution(executionInput: z.input<typeof hostedTopologyRollbackExecutionSchema>, approvalInput: z.input<typeof hostedTopologyRollbackExecutionApprovalSchema>): {
+export declare function authorizeHostedTopologyRollbackExecution(executionInput: z.input<typeof hostedTopologyRollbackExecutionSchema>): {
     execution: {
         schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
         teamId: string;
@@ -2823,17 +2694,5 @@ export declare function authorizeHostedTopologyRollbackExecution(executionInput:
         targetPlanDigest: string;
         executionDigest: string;
     };
-    approval: {
-        schemaVersion: "treeseed.hosted-topology-rollback-execution-approval/v1";
-        teamId: string;
-        environment: "production" | "staging";
-        deploymentId: string;
-        stackId: string;
-        backendBindingDigest: string;
-        decision: "approved";
-        approvedBy: string;
-        approvedAt: string;
-        executionDigest: string;
-    };
 };
 export {};

package/dist/deployment/hosted-topology.js

@@ -91,7 +91,7 @@ const hostedTopologyDeclarationSchema = z.object({
   deploymentId: custodyIdentifier,
   stackId: custodyIdentifier,
   environment: hostedEnvironmentSchema,
-  mutation: z.literal("approval-required"),
+  mutation: z.literal("agent-authorized"),
   platform: z.object({ repository: z.literal("treeseed-ai/platform"), commit: gitCommit }).strict(),
   stateBackend: z.object({ connectionRef: identifier }).strict(),
   providerConnections: z.record(hostedProviderSchema, z.object({ connectionRef: identifier }).strict()),
@@ -146,7 +146,7 @@ const hostedTopologyPlanShape = {
     providerResourceId: z.string().min(1).max(512).nullable()
   }).strict()),
   blockers: z.array(z.object({ code: z.enum(["connection-unavailable", "state-backend-unavailable", "dependency-cycle", "observation-unhealthy", "adoption-drift"]), resourceId: identifier.optional(), message: z.string().min(1) }).strict()),
-  approvalRequired: z.boolean(),
+  authorization: z.literal("authenticated-agent"),
   executable: z.literal(false)
 };
 function verifyPlanBinding(plan, context) {
@@ -173,30 +173,18 @@ function verifyPlanBinding(plan, context) {
     artifacts: plan.artifacts,
     providerConnections: plan.providerConnections,
     actions: plan.actions,
-    blockers: plan.blockers
+    blockers: plan.blockers,
+    authorization: plan.authorization
   };
   const expected = deploymentDigest(core);
   if (expected !== plan.planDigest || plan.planId !== `topology-plan-${expected.slice(7, 23)}`)
     context.addIssue({ code: z.ZodIssueCode.custom, path: ["planDigest"], message: "Hosted topology plan identity must bind the exact canonical plan." });
 }
 const hostedTopologyPlanSchema = z.object(hostedTopologyPlanShape).strict().superRefine(verifyPlanBinding);
-const hostedTopologyApprovalSchema = z.object({
-  schemaVersion: z.literal("treeseed.hosted-topology-approval/v1"),
-  planDigest: digest,
-  teamId: custodyIdentifier,
-  deploymentId: custodyIdentifier,
-  stackId: custodyIdentifier,
-  environment: hostedEnvironmentSchema,
-  backendBindingDigest: digest,
-  decision: z.literal("approved"),
-  approvedBy: z.string().min(1).max(256),
-  approvedAt: timestamp
-}).strict();
 const authorizedHostedTopologyPlanSchema = z.object({
   ...hostedTopologyPlanShape,
-  executable: z.literal(true),
-  approval: hostedTopologyApprovalSchema.nullable()
-}).strict().omit({ approvalRequired: true }).superRefine(verifyPlanBinding);
+  executable: z.literal(true)
+}).strict().superRefine(verifyPlanBinding);
 const hostedTopologyReceiptSchema = z.object({
   schemaVersion: z.literal("treeseed.hosted-topology-receipt/v1"),
   receiptId: z.string().regex(/^topology-receipt-[a-f0-9]{16}$/u),
@@ -230,19 +218,19 @@ const hostedTopologyRollbackSchema = z.object({
     targetDigest: digest.nullable()
   }).strict()),
   rollbackDigest: digest
-}).strict();
-const hostedTopologyRollbackApprovalSchema = z.object({
-  schemaVersion: z.literal("treeseed.hosted-topology-rollback-approval/v1"),
-  rollbackDigest: digest,
-  teamId: custodyIdentifier,
-  deploymentId: custodyIdentifier,
-  stackId: custodyIdentifier,
-  environment: hostedEnvironmentSchema,
-  backendBindingDigest: digest,
-  decision: z.literal("approved"),
-  approvedBy: z.string().min(1).max(256),
-  approvedAt: timestamp
-}).strict();
+}).strict().superRefine((rollback, context) => {
+  const core = {
+    sourceReceiptId: rollback.sourceReceiptId,
+    teamId: rollback.teamId,
+    deploymentId: rollback.deploymentId,
+    stackId: rollback.stackId,
+    environment: rollback.environment,
+    backendBindingDigest: rollback.backendBindingDigest,
+    operations: rollback.operations
+  };
+  if (deploymentDigest(core) !== rollback.rollbackDigest || rollback.rollbackId !== `topology-rollback-${rollback.rollbackDigest.slice(7, 23)}`)
+    context.addIssue({ code: z.ZodIssueCode.custom, path: ["rollbackDigest"], message: "Hosted topology rollback identity must bind the exact rollback custody and operations." });
+});
 const hostedTopologyRollbackExecutionSchema = z.object({
   schemaVersion: z.literal("treeseed.hosted-topology-rollback-execution/v1"),
   rollback: hostedTopologyRollbackSchema,
@@ -271,18 +259,6 @@ const hostedTopologyRollbackExecutionSchema = z.object({
   };
   if (deploymentDigest(core) !== execution.executionDigest) context.addIssue({ code: z.ZodIssueCode.custom, path: ["executionDigest"], message: "Hosted rollback execution digest does not bind its complete source and target closure." });
 });
-const hostedTopologyRollbackExecutionApprovalSchema = z.object({
-  schemaVersion: z.literal("treeseed.hosted-topology-rollback-execution-approval/v1"),
-  executionDigest: digest,
-  teamId: custodyIdentifier,
-  deploymentId: custodyIdentifier,
-  stackId: custodyIdentifier,
-  environment: hostedEnvironmentSchema,
-  backendBindingDigest: digest,
-  decision: z.literal("approved"),
-  approvedBy: z.string().min(1).max(256),
-  approvedAt: timestamp
-}).strict();
 function observationMap(items, declaration) {
   const resources = new Map(declaration.resources.map((resource) => [resource.id, resource]));
   const observations = /* @__PURE__ */ new Map();
@@ -372,20 +348,17 @@ function planHostedTopology(input) {
     artifacts: normalizedDeclaration.artifacts,
     providerConnections,
     actions,
-    blockers
+    blockers,
+    authorization: "authenticated-agent"
   };
   const planDigest = deploymentDigest(core);
-  return hostedTopologyPlanSchema.parse({ schemaVersion: "treeseed.hosted-topology-plan/v1", planId: `topology-plan-${planDigest.slice(7, 23)}`, planDigest, ...core, approvalRequired: actions.some(({ action }) => action !== "noop"), executable: false });
+  return hostedTopologyPlanSchema.parse({ schemaVersion: "treeseed.hosted-topology-plan/v1", planId: `topology-plan-${planDigest.slice(7, 23)}`, planDigest, ...core, executable: false });
 }
-function authorizeHostedTopologyPlan(planInput, approvalInput) {
+function authorizeHostedTopologyPlan(planInput) {
   const plan = hostedTopologyPlanSchema.parse(planInput);
   if (plan.blockers.length) throw new Error("Hosted topology plan has unresolved blockers.");
   if (!plan.stateBackend) throw new Error("Hosted topology plan has no state backend authority.");
-  const approval = approvalInput ? hostedTopologyApprovalSchema.parse(approvalInput) : null;
-  if (plan.approvalRequired && !approval) throw new Error("Hosted topology mutation requires environment approval.");
-  if (approval && (approval.planDigest !== plan.planDigest || approval.teamId !== plan.teamId || approval.deploymentId !== plan.deploymentId || approval.stackId !== plan.stackId || approval.environment !== plan.environment || approval.backendBindingDigest !== plan.stateBackend.bindingDigest)) throw new Error("Hosted topology approval does not bind the exact plan custody and backend.");
-  const { approvalRequired: _approvalRequired, ...approvedPlan } = plan;
-  return authorizedHostedTopologyPlanSchema.parse({ ...approvedPlan, executable: true, approval });
+  return authorizedHostedTopologyPlanSchema.parse({ ...plan, executable: true });
 }
 function verifyHostedTopologyReadback(input) {
   const plan = authorizedHostedTopologyPlanSchema.parse(input.plan);
@@ -428,14 +401,12 @@ function planHostedTopologyRollback(receiptInput) {
   const rollbackDigest = deploymentDigest({ sourceReceiptId: receipt.receiptId, ...custody, operations });
   return hostedTopologyRollbackSchema.parse({ schemaVersion: "treeseed.hosted-topology-rollback/v1", rollbackId: `topology-rollback-${rollbackDigest.slice(7, 23)}`, sourceReceiptId: receipt.receiptId, ...custody, operations, rollbackDigest });
 }
-function authorizeHostedTopologyRollback(rollbackInput, approvalInput) {
-  const rollback = hostedTopologyRollbackSchema.parse(rollbackInput), approval = hostedTopologyRollbackApprovalSchema.parse(approvalInput);
-  if (approval.rollbackDigest !== rollback.rollbackDigest || approval.teamId !== rollback.teamId || approval.deploymentId !== rollback.deploymentId || approval.stackId !== rollback.stackId || approval.environment !== rollback.environment || approval.backendBindingDigest !== rollback.backendBindingDigest) throw new Error("Hosted topology rollback approval does not bind the exact rollback custody and backend.");
-  return { rollback, approval };
+function authorizeHostedTopologyRollback(rollbackInput) {
+  return { rollback: hostedTopologyRollbackSchema.parse(rollbackInput) };
 }
 function planHostedTopologyRollbackExecution(input) {
   const rollback = hostedTopologyRollbackSchema.parse(input.rollback), sourceReceipt = hostedTopologyReceiptSchema.parse(input.sourceReceipt);
-  const sourcePlan = input.sourcePlan && typeof input.sourcePlan === "object" && "approval" in input.sourcePlan ? authorizedHostedTopologyPlanSchema.parse(input.sourcePlan) : hostedTopologyPlanSchema.parse(input.sourcePlan);
+  const sourcePlan = input.sourcePlan && typeof input.sourcePlan === "object" && input.sourcePlan.executable === true ? authorizedHostedTopologyPlanSchema.parse(input.sourcePlan) : hostedTopologyPlanSchema.parse(input.sourcePlan);
   const targetPlan = hostedTopologyPlanSchema.parse(input.targetPlan);
   if (sourceReceipt.receiptId !== rollback.sourceReceiptId || sourceReceipt.planDigest !== sourcePlan.planDigest) throw new Error("Hosted rollback execution source receipt is stale.");
   const custody = { teamId: rollback.teamId, deploymentId: rollback.deploymentId, stackId: rollback.stackId, environment: rollback.environment, backendBindingDigest: rollback.backendBindingDigest };
@@ -458,7 +429,7 @@ function planHostedTopologyRollbackExecution(input) {
       throw new Error(`Hosted rollback execution target specification mismatch for ${operation.resourceId}.`);
     }
   }
-  if ([...targetActions.keys()].some((resourceId) => !sourceActions.has(resourceId))) throw new Error("Hosted rollback execution target introduces an unapproved resource.");
+  if ([...targetActions.keys()].some((resourceId) => !sourceActions.has(resourceId))) throw new Error("Hosted rollback execution target introduces an unauthorized resource.");
   const core = {
     rollback,
     sourceReceiptId: sourceReceipt.receiptId,
@@ -469,10 +440,8 @@ function planHostedTopologyRollbackExecution(input) {
   };
   return hostedTopologyRollbackExecutionSchema.parse({ schemaVersion: "treeseed.hosted-topology-rollback-execution/v1", ...core, executionDigest: deploymentDigest(core) });
 }
-function authorizeHostedTopologyRollbackExecution(executionInput, approvalInput) {
-  const execution = hostedTopologyRollbackExecutionSchema.parse(executionInput), approval = hostedTopologyRollbackExecutionApprovalSchema.parse(approvalInput);
-  if (approval.executionDigest !== execution.executionDigest || approval.teamId !== execution.teamId || approval.deploymentId !== execution.deploymentId || approval.stackId !== execution.stackId || approval.environment !== execution.environment || approval.backendBindingDigest !== execution.backendBindingDigest) throw new Error("Hosted rollback execution approval does not bind the exact source target custody and backend.");
-  return { execution, approval };
+function authorizeHostedTopologyRollbackExecution(executionInput) {
+  return { execution: hostedTopologyRollbackExecutionSchema.parse(executionInput) };
 }
 export {
   authorizeHostedTopologyPlan,
@@ -486,12 +455,9 @@ export {
   hostedResourceKindSchema,
   hostedResourceObservationSchema,
   hostedStateBackendSchema,
-  hostedTopologyApprovalSchema,
   hostedTopologyDeclarationSchema,
   hostedTopologyPlanSchema,
   hostedTopologyReceiptSchema,
-  hostedTopologyRollbackApprovalSchema,
-  hostedTopologyRollbackExecutionApprovalSchema,
   hostedTopologyRollbackExecutionSchema,
   hostedTopologyRollbackSchema,
   hostedTopologyStateKey,

package/dist/operator-contracts/canonical-command-tree.js

@@ -365,9 +365,9 @@ const commandTree = {
       ]),
       branch("topology", [
         { nodeType: "leaf", segment: "plan", description: "Plan Cloudflare and Railway reconciliation from a portable hosted-topology declaration or template.", kind: "read", arguments: [{ name: "file", description: "Hosted topology YAML or JSON declaration or template.", required: true }], options: [{ name: "--artifacts", description: "Exact runtime artifact-input YAML or JSON required by a portable template.", type: "string" }], resultSchemaId: "treeseed.hosted-topology-plan/v1", execution: local("local.platform.topology.plan") },
-        { nodeType: "leaf", segment: "apply", description: "Apply an exact reviewed hosted-topology plan through the operations runner.", kind: "mutation", arguments: [{ name: "plan", description: "Exact plan JSON file.", required: true }], options: [planOption, { name: "--approval", description: "Exact environment approval JSON file.", type: "string", required: true }, { name: "--yes", description: "Confirm the authority-bearing mutation.", type: "boolean" }], authorization: { capability: "infrastructure.write", confirmation: "authority" }, resultSchemaId: "treeseed.platform-operation/v1", execution: local("local.platform.topology.apply") },
+        { nodeType: "leaf", segment: "apply", description: "Apply an exact agent-authorized hosted-topology plan through the operations runner.", kind: "mutation", arguments: [{ name: "plan", description: "Exact plan JSON file.", required: true }], options: [planOption, { name: "--yes", description: "Confirm the authority-bearing mutation.", type: "boolean" }], authorization: { capability: "infrastructure.write", confirmation: "authority" }, resultSchemaId: "treeseed.platform-operation/v1", execution: local("local.platform.topology.apply") },
         { nodeType: "leaf", segment: "status", description: "Read the latest hosted-topology operation and known-good receipt.", kind: "read", resultSchemaId: "treeseed.infrastructure.topology.status.output/v1", execution: local("local.platform.topology.status") },
-        { nodeType: "leaf", segment: "rollback", description: "Restore exact prior hosted-topology state from a known-good receipt.", kind: "mutation", arguments: [{ name: "rollback", description: "Exact rollback JSON file.", required: true }], options: [planOption, { name: "--approval", description: "Exact rollback approval JSON file.", type: "string", required: true }, { name: "--yes", description: "Confirm the destructive rollback.", type: "boolean" }], authorization: { capability: "infrastructure.write", confirmation: "destructive" }, resultSchemaId: "treeseed.platform-operation/v1", execution: local("local.platform.topology.rollback") }
+        { nodeType: "leaf", segment: "rollback", description: "Restore exact prior hosted-topology state from a known-good receipt.", kind: "mutation", arguments: [{ name: "rollback", description: "Exact rollback JSON file.", required: true }], options: [planOption, { name: "--yes", description: "Confirm the destructive rollback.", type: "boolean" }], authorization: { capability: "infrastructure.write", confirmation: "destructive" }, resultSchemaId: "treeseed.platform-operation/v1", execution: local("local.platform.topology.rollback") }
       ])
     ]),
     branch("dev", [

package/dist/operator-contracts/catalog/hosted-topology-operations.d.ts

@@ -33,7 +33,7 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
                 repository: "treeseed-ai/platform";
                 commit: string;
             };
-            mutation: "approval-required";
+            mutation: "agent-authorized";
             environment: "production" | "staging";
             artifacts: Record<string, {
                 digest: string;
@@ -64,18 +64,6 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
     readonly apply: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
         teamId: string;
     }, {}, {
-        approval: {
-            schemaVersion: "treeseed.hosted-topology-approval/v1";
-            planDigest: string;
-            teamId: string;
-            environment: "production" | "staging";
-            deploymentId: string;
-            stackId: string;
-            backendBindingDigest: string;
-            decision: "approved";
-            approvedBy: string;
-            approvedAt: string;
-        };
         plan: {
             schemaVersion: "treeseed.hosted-topology-plan/v1";
             blockers: {
@@ -160,7 +148,7 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
             declarationDigest: string;
             topologyId: string;
             platformCommit: string;
-            approvalRequired: boolean;
+            authorization: "authenticated-agent";
         };
         credentialLeaseIds?: string[] | undefined;
     }, Record<string, unknown>>;
@@ -207,18 +195,6 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
     readonly rollback: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
         teamId: string;
     }, {}, {
-        approval: {
-            schemaVersion: "treeseed.hosted-topology-rollback-execution-approval/v1";
-            teamId: string;
-            environment: "production" | "staging";
-            deploymentId: string;
-            stackId: string;
-            backendBindingDigest: string;
-            decision: "approved";
-            approvedBy: string;
-            approvedAt: string;
-            executionDigest: string;
-        };
         execution: {
             schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
             teamId: string;
@@ -333,7 +309,7 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
             declarationDigest: string;
             topologyId: string;
             platformCommit: string;
-            approvalRequired: boolean;
+            authorization: "authenticated-agent";
         };
         targetPlan: {
             schemaVersion: "treeseed.hosted-topology-plan/v1";
@@ -419,7 +395,7 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
             declarationDigest: string;
             topologyId: string;
             platformCommit: string;
-            approvalRequired: boolean;
+            authorization: "authenticated-agent";
         };
         credentialLeaseIds?: string[] | undefined;
     }, Record<string, unknown>>;

package/dist/operator-contracts/catalog/hosted-topology-operations.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { hostedTopologyApprovalSchema, hostedTopologyDeclarationSchema, hostedTopologyPlanSchema, hostedTopologyReceiptSchema, hostedTopologyRollbackExecutionApprovalSchema, hostedTopologyRollbackExecutionSchema } from "../../deployment/hosted-topology.js";
+import { hostedTopologyDeclarationSchema, hostedTopologyPlanSchema, hostedTopologyReceiptSchema, hostedTopologyRollbackExecutionSchema } from "../../deployment/hosted-topology.js";
 import { defineOperation } from "../operation-builder.js";
 const teamPath = z.object({ teamId: z.string().min(1) }).strict();
 const empty = z.object({}).strict();
@@ -25,7 +25,7 @@ const HOSTED_TOPOLOGY_OPERATIONS = {
   }, { path: teamPath, query: empty, body: z.object({ declaration: hostedTopologyDeclarationSchema, credentialLeaseIds }).strict(), output: operationReceipt }),
   apply: defineOperation({
     operationId: "infrastructure.topology.apply",
-    description: "Apply an exact approved hosted topology plan through the operations runner.",
+    description: "Apply an exact agent-authorized hosted topology plan through the operations runner.",
     rest: { method: "POST", path: "/v1/teams/{teamId}/infrastructure/topology/apply" },
     parameters: "treeseed.infrastructure.topology.apply.parameters/v1",
     capability: "infrastructure.write",
@@ -37,9 +37,8 @@ const HOSTED_TOPOLOGY_OPERATIONS = {
     surfaces: ["rest", "cli"],
     cacheScope: "none",
     pagination: "none",
-    concurrencyRequired: true,
-    redactedPaths: ["body.approval.approvedBy"]
-  }, { path: teamPath, query: empty, body: z.object({ plan: hostedTopologyPlanSchema, approval: hostedTopologyApprovalSchema, credentialLeaseIds }).strict(), output: operationReceipt }),
+    concurrencyRequired: true
+  }, { path: teamPath, query: empty, body: z.object({ plan: hostedTopologyPlanSchema, credentialLeaseIds }).strict(), output: operationReceipt }),
   status: defineOperation({
     operationId: "infrastructure.topology.status",
     description: "Read the latest authoritative hosted topology receipt and operation state.",
@@ -69,11 +68,9 @@ const HOSTED_TOPOLOGY_OPERATIONS = {
     surfaces: ["rest", "cli"],
     cacheScope: "none",
     pagination: "none",
-    concurrencyRequired: true,
-    redactedPaths: ["body.approval.approvedBy"]
+    concurrencyRequired: true
   }, { path: teamPath, query: empty, body: z.object({
     execution: hostedTopologyRollbackExecutionSchema,
-    approval: hostedTopologyRollbackExecutionApprovalSchema,
     sourcePlan: hostedTopologyPlanSchema,
     targetPlan: hostedTopologyPlanSchema,
     credentialLeaseIds

package/dist/operator-contracts/control-plane-operations.d.ts

@@ -36,7 +36,7 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                         repository: "treeseed-ai/platform";
                         commit: string;
                     };
-                    mutation: "approval-required";
+                    mutation: "agent-authorized";
                     environment: "production" | "staging";
                     artifacts: Record<string, {
                         digest: string;
@@ -67,18 +67,6 @@ export declare const CONTROL_PLANE_OPERATIONS: {
             readonly apply: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
                 teamId: string;
             }, {}, {
-                approval: {
-                    schemaVersion: "treeseed.hosted-topology-approval/v1";
-                    planDigest: string;
-                    teamId: string;
-                    environment: "production" | "staging";
-                    deploymentId: string;
-                    stackId: string;
-                    backendBindingDigest: string;
-                    decision: "approved";
-                    approvedBy: string;
-                    approvedAt: string;
-                };
                 plan: {
                     schemaVersion: "treeseed.hosted-topology-plan/v1";
                     blockers: {
@@ -163,7 +151,7 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                     declarationDigest: string;
                     topologyId: string;
                     platformCommit: string;
-                    approvalRequired: boolean;
+                    authorization: "authenticated-agent";
                 };
                 credentialLeaseIds?: string[] | undefined;
             }, Record<string, unknown>>;
@@ -210,18 +198,6 @@ export declare const CONTROL_PLANE_OPERATIONS: {
             readonly rollback: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
                 teamId: string;
             }, {}, {
-                approval: {
-                    schemaVersion: "treeseed.hosted-topology-rollback-execution-approval/v1";
-                    teamId: string;
-                    environment: "production" | "staging";
-                    deploymentId: string;
-                    stackId: string;
-                    backendBindingDigest: string;
-                    decision: "approved";
-                    approvedBy: string;
-                    approvedAt: string;
-                    executionDigest: string;
-                };
                 execution: {
                     schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
                     teamId: string;
@@ -336,7 +312,7 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                     declarationDigest: string;
                     topologyId: string;
                     platformCommit: string;
-                    approvalRequired: boolean;
+                    authorization: "authenticated-agent";
                 };
                 targetPlan: {
                     schemaVersion: "treeseed.hosted-topology-plan/v1";
@@ -422,7 +398,7 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                     declarationDigest: string;
                     topologyId: string;
                     platformCommit: string;
-                    approvalRequired: boolean;
+                    authorization: "authenticated-agent";
                 };
                 credentialLeaseIds?: string[] | undefined;
             }, Record<string, unknown>>;

package/dist/secrets-capability/service-provider-contracts.d.ts

@@ -1,5 +1,5 @@
 export declare const SERVICE_PROVIDER_IDS: readonly ["github", "cloudflare", "railway", "openbao"];
-export declare const SERVICE_CAPABILITY_TYPES: readonly ["repository-hosting", "workflow-execution", "workflow-configuration", "secret-enclave", "frontend-hosting", "backend-hosting", "dns-management", "object-storage", "database-hosting", "capacity-runtime-hosting", "private-knowledge-index-hosting", "artifact-hosting"];
+export declare const SERVICE_CAPABILITY_TYPES: readonly ["repository-hosting", "workflow-execution", "workflow-configuration", "secret-enclave", "frontend-hosting", "backend-hosting", "dns-management", "object-storage", "state-encryption", "database-hosting", "capacity-runtime-hosting", "private-knowledge-index-hosting", "artifact-hosting"];
 export declare const SERVICE_CONNECTION_STATUSES: readonly ["draft", "active", "degraded", "validation-failed", "reentry-required", "reauthorization-required", "disconnected"];
 export declare const SERVICE_CAPABILITY_STATUSES: readonly ["configured", "disabled", "blocked", "planned"];
 export type ServiceProviderId = (typeof SERVICE_PROVIDER_IDS)[number];

package/dist/secrets-capability/service-provider-contracts.js

@@ -8,6 +8,7 @@ const SERVICE_CAPABILITY_TYPES = [
   "backend-hosting",
   "dns-management",
   "object-storage",
+  "state-encryption",
   "database-hosting",
   "capacity-runtime-hosting",
   "private-knowledge-index-hosting",
@@ -127,12 +128,15 @@ const SERVICE_PROVIDER_CATALOG = [
     capabilities: [
       { type: "frontend-hosting", label: "Frontend hosting", description: "Pages and Workers application hosting.", credentialProfileIds: ["cloudflare-runtime"], status: "available" },
       { type: "dns-management", label: "DNS management", description: "Scoped DNS record management.", credentialProfileIds: ["cloudflare-dns"], status: "available" },
-      { type: "object-storage", label: "Object storage", description: "R2-backed immutable publication and private artifact storage.", credentialProfileIds: ["cloudflare-storage"], status: "available" }
+      { type: "object-storage", label: "Object storage", description: "R2-backed immutable publication, private artifact storage, and scoped S3 state access.", credentialProfileIds: ["cloudflare-storage", "s3-state-session"], status: "available" },
+      { type: "state-encryption", label: "State encryption", description: "Independent encryption authority for OpenTofu state and plan files.", credentialProfileIds: ["opentofu-state-encryption"], status: "available" }
     ],
     credentialProfiles: [
       { id: "cloudflare-runtime", label: "Pages and Workers token", description: "A token limited to application deployment resources.", capabilities: ["frontend-hosting"], fields: [field("apiToken", "API token", "Encrypted in this browser and used only for authorized frontend operations.", true, true)], permissions: ["Account: Workers Scripts Edit", "Account: Pages Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
       { id: "cloudflare-dns", label: "DNS token", description: "A token restricted to selected zones.", capabilities: ["dns-management"], fields: [field("apiToken", "DNS API token", "Encrypted separately from deployment authority.", true, true)], permissions: ["Zone: DNS Edit for only the managed zones"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
-      { id: "cloudflare-storage", label: "Storage authority", description: "Vault-custodied R2 management and S3-compatible state credentials, isolated from runtime and DNS authority.", capabilities: ["object-storage"], fields: [field("apiToken", "Storage API token", "Encrypted separately and used only to reconcile authorized R2 resources.", true, true), field("accessKeyId", "R2 access key ID", "Vault-custodied S3-compatible access key identifier for encrypted OpenTofu state.", true, true), field("secretAccessKey", "R2 secret access key", "Vault-custodied S3-compatible secret key for encrypted OpenTofu state.", true, true), field("stateEncryptionKey", "OpenTofu state encryption key", "Generated in the browser and encrypted separately; never store this key with the R2 state object.", true, true)], permissions: ["Account: Workers R2 Storage Edit", "Object read and write for only the managed state bucket"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] }
+      { id: "cloudflare-storage", label: "Storage management authority", description: "Vault-custodied token used only to reconcile authorized R2 resources.", capabilities: ["object-storage"], fields: [field("apiToken", "Storage API token", "Encrypted separately and used only to reconcile authorized R2 resources.", true, true)], permissions: ["Account: Workers R2 Storage Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
+      { id: "s3-state-session", label: "OpenTofu state session", description: "S3-compatible credentials limited to the selected team state prefix.", capabilities: ["object-storage"], fields: [field("accessKeyId", "R2 access key ID", "Vault-custodied S3-compatible access key identifier for encrypted OpenTofu state.", true, true), field("secretAccessKey", "R2 secret access key", "Vault-custodied S3-compatible secret key for encrypted OpenTofu state.", true, true), field("sessionToken", "R2 session token", "Optional short-lived S3-compatible session token.", false, true)], permissions: ["Object read and write for only the managed team state prefix"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
+      { id: "opentofu-state-encryption", label: "OpenTofu state encryption", description: "Independent encryption material that is never stored with the R2 state object.", capabilities: ["state-encryption"], fields: [field("stateEncryptionKey", "OpenTofu state encryption key", "Generated in the browser as a 32-byte hexadecimal key and encrypted separately.", true, true)], permissions: ["Encrypt and decrypt only the selected team OpenTofu state"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] }
     ]
   },
   {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.84",
+  "version": "0.13.0-rc.86",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {