@treeseed/sdk 0.13.0-rc.85 → 0.13.0-rc.87

package/dist/deployment/hosted-topology.js

@@ -91,7 +91,7 @@ const hostedTopologyDeclarationSchema = z.object({
   deploymentId: custodyIdentifier,
   stackId: custodyIdentifier,
   environment: hostedEnvironmentSchema,
-  mutation: z.literal("approval-required"),
+  mutation: z.literal("agent-authorized"),
   platform: z.object({ repository: z.literal("treeseed-ai/platform"), commit: gitCommit }).strict(),
   stateBackend: z.object({ connectionRef: identifier }).strict(),
   providerConnections: z.record(hostedProviderSchema, z.object({ connectionRef: identifier }).strict()),
@@ -146,7 +146,7 @@ const hostedTopologyPlanShape = {
     providerResourceId: z.string().min(1).max(512).nullable()
   }).strict()),
   blockers: z.array(z.object({ code: z.enum(["connection-unavailable", "state-backend-unavailable", "dependency-cycle", "observation-unhealthy", "adoption-drift"]), resourceId: identifier.optional(), message: z.string().min(1) }).strict()),
-  approvalRequired: z.boolean(),
+  authorization: z.literal("authenticated-agent"),
   executable: z.literal(false)
 };
 function verifyPlanBinding(plan, context) {
@@ -173,30 +173,18 @@ function verifyPlanBinding(plan, context) {
     artifacts: plan.artifacts,
     providerConnections: plan.providerConnections,
     actions: plan.actions,
-    blockers: plan.blockers
+    blockers: plan.blockers,
+    authorization: plan.authorization
   };
   const expected = deploymentDigest(core);
   if (expected !== plan.planDigest || plan.planId !== `topology-plan-${expected.slice(7, 23)}`)
     context.addIssue({ code: z.ZodIssueCode.custom, path: ["planDigest"], message: "Hosted topology plan identity must bind the exact canonical plan." });
 }
 const hostedTopologyPlanSchema = z.object(hostedTopologyPlanShape).strict().superRefine(verifyPlanBinding);
-const hostedTopologyApprovalSchema = z.object({
-  schemaVersion: z.literal("treeseed.hosted-topology-approval/v1"),
-  planDigest: digest,
-  teamId: custodyIdentifier,
-  deploymentId: custodyIdentifier,
-  stackId: custodyIdentifier,
-  environment: hostedEnvironmentSchema,
-  backendBindingDigest: digest,
-  decision: z.literal("approved"),
-  approvedBy: z.string().min(1).max(256),
-  approvedAt: timestamp
-}).strict();
 const authorizedHostedTopologyPlanSchema = z.object({
   ...hostedTopologyPlanShape,
-  executable: z.literal(true),
-  approval: hostedTopologyApprovalSchema.nullable()
-}).strict().omit({ approvalRequired: true }).superRefine(verifyPlanBinding);
+  executable: z.literal(true)
+}).strict().superRefine(verifyPlanBinding);
 const hostedTopologyReceiptSchema = z.object({
   schemaVersion: z.literal("treeseed.hosted-topology-receipt/v1"),
   receiptId: z.string().regex(/^topology-receipt-[a-f0-9]{16}$/u),
@@ -230,19 +218,19 @@ const hostedTopologyRollbackSchema = z.object({
     targetDigest: digest.nullable()
   }).strict()),
   rollbackDigest: digest
-}).strict();
-const hostedTopologyRollbackApprovalSchema = z.object({
-  schemaVersion: z.literal("treeseed.hosted-topology-rollback-approval/v1"),
-  rollbackDigest: digest,
-  teamId: custodyIdentifier,
-  deploymentId: custodyIdentifier,
-  stackId: custodyIdentifier,
-  environment: hostedEnvironmentSchema,
-  backendBindingDigest: digest,
-  decision: z.literal("approved"),
-  approvedBy: z.string().min(1).max(256),
-  approvedAt: timestamp
-}).strict();
+}).strict().superRefine((rollback, context) => {
+  const core = {
+    sourceReceiptId: rollback.sourceReceiptId,
+    teamId: rollback.teamId,
+    deploymentId: rollback.deploymentId,
+    stackId: rollback.stackId,
+    environment: rollback.environment,
+    backendBindingDigest: rollback.backendBindingDigest,
+    operations: rollback.operations
+  };
+  if (deploymentDigest(core) !== rollback.rollbackDigest || rollback.rollbackId !== `topology-rollback-${rollback.rollbackDigest.slice(7, 23)}`)
+    context.addIssue({ code: z.ZodIssueCode.custom, path: ["rollbackDigest"], message: "Hosted topology rollback identity must bind the exact rollback custody and operations." });
+});
 const hostedTopologyRollbackExecutionSchema = z.object({
   schemaVersion: z.literal("treeseed.hosted-topology-rollback-execution/v1"),
   rollback: hostedTopologyRollbackSchema,
@@ -271,18 +259,6 @@ const hostedTopologyRollbackExecutionSchema = z.object({
   };
   if (deploymentDigest(core) !== execution.executionDigest) context.addIssue({ code: z.ZodIssueCode.custom, path: ["executionDigest"], message: "Hosted rollback execution digest does not bind its complete source and target closure." });
 });
-const hostedTopologyRollbackExecutionApprovalSchema = z.object({
-  schemaVersion: z.literal("treeseed.hosted-topology-rollback-execution-approval/v1"),
-  executionDigest: digest,
-  teamId: custodyIdentifier,
-  deploymentId: custodyIdentifier,
-  stackId: custodyIdentifier,
-  environment: hostedEnvironmentSchema,
-  backendBindingDigest: digest,
-  decision: z.literal("approved"),
-  approvedBy: z.string().min(1).max(256),
-  approvedAt: timestamp
-}).strict();
 function observationMap(items, declaration) {
   const resources = new Map(declaration.resources.map((resource) => [resource.id, resource]));
   const observations = /* @__PURE__ */ new Map();
@@ -372,20 +348,17 @@ function planHostedTopology(input) {
     artifacts: normalizedDeclaration.artifacts,
     providerConnections,
     actions,
-    blockers
+    blockers,
+    authorization: "authenticated-agent"
   };
   const planDigest = deploymentDigest(core);
-  return hostedTopologyPlanSchema.parse({ schemaVersion: "treeseed.hosted-topology-plan/v1", planId: `topology-plan-${planDigest.slice(7, 23)}`, planDigest, ...core, approvalRequired: actions.some(({ action }) => action !== "noop"), executable: false });
+  return hostedTopologyPlanSchema.parse({ schemaVersion: "treeseed.hosted-topology-plan/v1", planId: `topology-plan-${planDigest.slice(7, 23)}`, planDigest, ...core, executable: false });
 }
-function authorizeHostedTopologyPlan(planInput, approvalInput) {
+function authorizeHostedTopologyPlan(planInput) {
   const plan = hostedTopologyPlanSchema.parse(planInput);
   if (plan.blockers.length) throw new Error("Hosted topology plan has unresolved blockers.");
   if (!plan.stateBackend) throw new Error("Hosted topology plan has no state backend authority.");
-  const approval = approvalInput ? hostedTopologyApprovalSchema.parse(approvalInput) : null;
-  if (plan.approvalRequired && !approval) throw new Error("Hosted topology mutation requires environment approval.");
-  if (approval && (approval.planDigest !== plan.planDigest || approval.teamId !== plan.teamId || approval.deploymentId !== plan.deploymentId || approval.stackId !== plan.stackId || approval.environment !== plan.environment || approval.backendBindingDigest !== plan.stateBackend.bindingDigest)) throw new Error("Hosted topology approval does not bind the exact plan custody and backend.");
-  const { approvalRequired: _approvalRequired, ...approvedPlan } = plan;
-  return authorizedHostedTopologyPlanSchema.parse({ ...approvedPlan, executable: true, approval });
+  return authorizedHostedTopologyPlanSchema.parse({ ...plan, executable: true });
 }
 function verifyHostedTopologyReadback(input) {
   const plan = authorizedHostedTopologyPlanSchema.parse(input.plan);
@@ -428,14 +401,12 @@ function planHostedTopologyRollback(receiptInput) {
   const rollbackDigest = deploymentDigest({ sourceReceiptId: receipt.receiptId, ...custody, operations });
   return hostedTopologyRollbackSchema.parse({ schemaVersion: "treeseed.hosted-topology-rollback/v1", rollbackId: `topology-rollback-${rollbackDigest.slice(7, 23)}`, sourceReceiptId: receipt.receiptId, ...custody, operations, rollbackDigest });
 }
-function authorizeHostedTopologyRollback(rollbackInput, approvalInput) {
-  const rollback = hostedTopologyRollbackSchema.parse(rollbackInput), approval = hostedTopologyRollbackApprovalSchema.parse(approvalInput);
-  if (approval.rollbackDigest !== rollback.rollbackDigest || approval.teamId !== rollback.teamId || approval.deploymentId !== rollback.deploymentId || approval.stackId !== rollback.stackId || approval.environment !== rollback.environment || approval.backendBindingDigest !== rollback.backendBindingDigest) throw new Error("Hosted topology rollback approval does not bind the exact rollback custody and backend.");
-  return { rollback, approval };
+function authorizeHostedTopologyRollback(rollbackInput) {
+  return { rollback: hostedTopologyRollbackSchema.parse(rollbackInput) };
 }
 function planHostedTopologyRollbackExecution(input) {
   const rollback = hostedTopologyRollbackSchema.parse(input.rollback), sourceReceipt = hostedTopologyReceiptSchema.parse(input.sourceReceipt);
-  const sourcePlan = input.sourcePlan && typeof input.sourcePlan === "object" && "approval" in input.sourcePlan ? authorizedHostedTopologyPlanSchema.parse(input.sourcePlan) : hostedTopologyPlanSchema.parse(input.sourcePlan);
+  const sourcePlan = input.sourcePlan && typeof input.sourcePlan === "object" && input.sourcePlan.executable === true ? authorizedHostedTopologyPlanSchema.parse(input.sourcePlan) : hostedTopologyPlanSchema.parse(input.sourcePlan);
   const targetPlan = hostedTopologyPlanSchema.parse(input.targetPlan);
   if (sourceReceipt.receiptId !== rollback.sourceReceiptId || sourceReceipt.planDigest !== sourcePlan.planDigest) throw new Error("Hosted rollback execution source receipt is stale.");
   const custody = { teamId: rollback.teamId, deploymentId: rollback.deploymentId, stackId: rollback.stackId, environment: rollback.environment, backendBindingDigest: rollback.backendBindingDigest };
@@ -458,7 +429,7 @@ function planHostedTopologyRollbackExecution(input) {
       throw new Error(`Hosted rollback execution target specification mismatch for ${operation.resourceId}.`);
     }
   }
-  if ([...targetActions.keys()].some((resourceId) => !sourceActions.has(resourceId))) throw new Error("Hosted rollback execution target introduces an unapproved resource.");
+  if ([...targetActions.keys()].some((resourceId) => !sourceActions.has(resourceId))) throw new Error("Hosted rollback execution target introduces an unauthorized resource.");
   const core = {
     rollback,
     sourceReceiptId: sourceReceipt.receiptId,
@@ -469,10 +440,8 @@ function planHostedTopologyRollbackExecution(input) {
   };
   return hostedTopologyRollbackExecutionSchema.parse({ schemaVersion: "treeseed.hosted-topology-rollback-execution/v1", ...core, executionDigest: deploymentDigest(core) });
 }
-function authorizeHostedTopologyRollbackExecution(executionInput, approvalInput) {
-  const execution = hostedTopologyRollbackExecutionSchema.parse(executionInput), approval = hostedTopologyRollbackExecutionApprovalSchema.parse(approvalInput);
-  if (approval.executionDigest !== execution.executionDigest || approval.teamId !== execution.teamId || approval.deploymentId !== execution.deploymentId || approval.stackId !== execution.stackId || approval.environment !== execution.environment || approval.backendBindingDigest !== execution.backendBindingDigest) throw new Error("Hosted rollback execution approval does not bind the exact source target custody and backend.");
-  return { execution, approval };
+function authorizeHostedTopologyRollbackExecution(executionInput) {
+  return { execution: hostedTopologyRollbackExecutionSchema.parse(executionInput) };
 }
 export {
   authorizeHostedTopologyPlan,
@@ -486,12 +455,9 @@ export {
   hostedResourceKindSchema,
   hostedResourceObservationSchema,
   hostedStateBackendSchema,
-  hostedTopologyApprovalSchema,
   hostedTopologyDeclarationSchema,
   hostedTopologyPlanSchema,
   hostedTopologyReceiptSchema,
-  hostedTopologyRollbackApprovalSchema,
-  hostedTopologyRollbackExecutionApprovalSchema,
   hostedTopologyRollbackExecutionSchema,
   hostedTopologyRollbackSchema,
   hostedTopologyStateKey,

package/dist/operator-contracts/canonical-command-tree.js

@@ -365,9 +365,9 @@ const commandTree = {
       ]),
       branch("topology", [
         { nodeType: "leaf", segment: "plan", description: "Plan Cloudflare and Railway reconciliation from a portable hosted-topology declaration or template.", kind: "read", arguments: [{ name: "file", description: "Hosted topology YAML or JSON declaration or template.", required: true }], options: [{ name: "--artifacts", description: "Exact runtime artifact-input YAML or JSON required by a portable template.", type: "string" }], resultSchemaId: "treeseed.hosted-topology-plan/v1", execution: local("local.platform.topology.plan") },
-        { nodeType: "leaf", segment: "apply", description: "Apply an exact reviewed hosted-topology plan through the operations runner.", kind: "mutation", arguments: [{ name: "plan", description: "Exact plan JSON file.", required: true }], options: [planOption, { name: "--approval", description: "Exact environment approval JSON file.", type: "string", required: true }, { name: "--yes", description: "Confirm the authority-bearing mutation.", type: "boolean" }], authorization: { capability: "infrastructure.write", confirmation: "authority" }, resultSchemaId: "treeseed.platform-operation/v1", execution: local("local.platform.topology.apply") },
+        { nodeType: "leaf", segment: "apply", description: "Apply an exact agent-authorized hosted-topology plan through the operations runner.", kind: "mutation", arguments: [{ name: "plan", description: "Exact plan JSON file.", required: true }], options: [planOption, { name: "--yes", description: "Confirm the authority-bearing mutation.", type: "boolean" }], authorization: { capability: "infrastructure.write", confirmation: "authority" }, resultSchemaId: "treeseed.platform-operation/v1", execution: local("local.platform.topology.apply") },
         { nodeType: "leaf", segment: "status", description: "Read the latest hosted-topology operation and known-good receipt.", kind: "read", resultSchemaId: "treeseed.infrastructure.topology.status.output/v1", execution: local("local.platform.topology.status") },
-        { nodeType: "leaf", segment: "rollback", description: "Restore exact prior hosted-topology state from a known-good receipt.", kind: "mutation", arguments: [{ name: "rollback", description: "Exact rollback JSON file.", required: true }], options: [planOption, { name: "--approval", description: "Exact rollback approval JSON file.", type: "string", required: true }, { name: "--yes", description: "Confirm the destructive rollback.", type: "boolean" }], authorization: { capability: "infrastructure.write", confirmation: "destructive" }, resultSchemaId: "treeseed.platform-operation/v1", execution: local("local.platform.topology.rollback") }
+        { nodeType: "leaf", segment: "rollback", description: "Restore exact prior hosted-topology state from a known-good receipt.", kind: "mutation", arguments: [{ name: "rollback", description: "Exact rollback JSON file.", required: true }], options: [planOption, { name: "--yes", description: "Confirm the destructive rollback.", type: "boolean" }], authorization: { capability: "infrastructure.write", confirmation: "destructive" }, resultSchemaId: "treeseed.platform-operation/v1", execution: local("local.platform.topology.rollback") }
       ])
     ]),
     branch("dev", [

package/dist/operator-contracts/catalog/hosted-topology-operations.d.ts

@@ -33,7 +33,7 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
                 repository: "treeseed-ai/platform";
                 commit: string;
             };
-            mutation: "approval-required";
+            mutation: "agent-authorized";
             environment: "production" | "staging";
             artifacts: Record<string, {
                 digest: string;
@@ -59,23 +59,10 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
                 connectionRef: string;
             }>>;
         };
-        credentialLeaseIds?: string[] | undefined;
     }, Record<string, unknown>>;
     readonly apply: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
         teamId: string;
     }, {}, {
-        approval: {
-            schemaVersion: "treeseed.hosted-topology-approval/v1";
-            planDigest: string;
-            teamId: string;
-            environment: "production" | "staging";
-            deploymentId: string;
-            stackId: string;
-            backendBindingDigest: string;
-            decision: "approved";
-            approvedBy: string;
-            approvedAt: string;
-        };
         plan: {
             schemaVersion: "treeseed.hosted-topology-plan/v1";
             blockers: {
@@ -160,9 +147,8 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
             declarationDigest: string;
             topologyId: string;
             platformCommit: string;
-            approvalRequired: boolean;
+            authorization: "authenticated-agent";
         };
-        credentialLeaseIds?: string[] | undefined;
     }, Record<string, unknown>>;
     readonly status: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
         teamId: string;
@@ -207,18 +193,6 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
     readonly rollback: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
         teamId: string;
     }, {}, {
-        approval: {
-            schemaVersion: "treeseed.hosted-topology-rollback-execution-approval/v1";
-            teamId: string;
-            environment: "production" | "staging";
-            deploymentId: string;
-            stackId: string;
-            backendBindingDigest: string;
-            decision: "approved";
-            approvedBy: string;
-            approvedAt: string;
-            executionDigest: string;
-        };
         execution: {
             schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
             teamId: string;
@@ -333,7 +307,7 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
             declarationDigest: string;
             topologyId: string;
             platformCommit: string;
-            approvalRequired: boolean;
+            authorization: "authenticated-agent";
         };
         targetPlan: {
             schemaVersion: "treeseed.hosted-topology-plan/v1";
@@ -419,8 +393,7 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
             declarationDigest: string;
             topologyId: string;
             platformCommit: string;
-            approvalRequired: boolean;
+            authorization: "authenticated-agent";
         };
-        credentialLeaseIds?: string[] | undefined;
     }, Record<string, unknown>>;
 };

package/dist/operator-contracts/catalog/hosted-topology-operations.js

@@ -1,11 +1,10 @@
 import { z } from "zod";
-import { hostedTopologyApprovalSchema, hostedTopologyDeclarationSchema, hostedTopologyPlanSchema, hostedTopologyReceiptSchema, hostedTopologyRollbackExecutionApprovalSchema, hostedTopologyRollbackExecutionSchema } from "../../deployment/hosted-topology.js";
+import { hostedTopologyDeclarationSchema, hostedTopologyPlanSchema, hostedTopologyReceiptSchema, hostedTopologyRollbackExecutionSchema } from "../../deployment/hosted-topology.js";
 import { defineOperation } from "../operation-builder.js";
 const teamPath = z.object({ teamId: z.string().min(1) }).strict();
 const empty = z.object({}).strict();
 const none = z.undefined();
 const operationReceipt = z.record(z.unknown());
-const credentialLeaseIds = z.array(z.string().min(1)).min(1).optional();
 const HOSTED_TOPOLOGY_OPERATIONS = {
   plan: defineOperation({
     operationId: "infrastructure.topology.plan",
@@ -22,10 +21,10 @@ const HOSTED_TOPOLOGY_OPERATIONS = {
     cacheScope: "none",
     pagination: "none",
     idempotencyRequired: false
-  }, { path: teamPath, query: empty, body: z.object({ declaration: hostedTopologyDeclarationSchema, credentialLeaseIds }).strict(), output: operationReceipt }),
+  }, { path: teamPath, query: empty, body: z.object({ declaration: hostedTopologyDeclarationSchema }).strict(), output: operationReceipt }),
   apply: defineOperation({
     operationId: "infrastructure.topology.apply",
-    description: "Apply an exact approved hosted topology plan through the operations runner.",
+    description: "Apply an exact agent-authorized hosted topology plan through the operations runner.",
     rest: { method: "POST", path: "/v1/teams/{teamId}/infrastructure/topology/apply" },
     parameters: "treeseed.infrastructure.topology.apply.parameters/v1",
     capability: "infrastructure.write",
@@ -37,9 +36,8 @@ const HOSTED_TOPOLOGY_OPERATIONS = {
     surfaces: ["rest", "cli"],
     cacheScope: "none",
     pagination: "none",
-    concurrencyRequired: true,
-    redactedPaths: ["body.approval.approvedBy"]
-  }, { path: teamPath, query: empty, body: z.object({ plan: hostedTopologyPlanSchema, approval: hostedTopologyApprovalSchema, credentialLeaseIds }).strict(), output: operationReceipt }),
+    concurrencyRequired: true
+  }, { path: teamPath, query: empty, body: z.object({ plan: hostedTopologyPlanSchema }).strict(), output: operationReceipt }),
   status: defineOperation({
     operationId: "infrastructure.topology.status",
     description: "Read the latest authoritative hosted topology receipt and operation state.",
@@ -69,14 +67,11 @@ const HOSTED_TOPOLOGY_OPERATIONS = {
     surfaces: ["rest", "cli"],
     cacheScope: "none",
     pagination: "none",
-    concurrencyRequired: true,
-    redactedPaths: ["body.approval.approvedBy"]
+    concurrencyRequired: true
   }, { path: teamPath, query: empty, body: z.object({
     execution: hostedTopologyRollbackExecutionSchema,
-    approval: hostedTopologyRollbackExecutionApprovalSchema,
     sourcePlan: hostedTopologyPlanSchema,
-    targetPlan: hostedTopologyPlanSchema,
-    credentialLeaseIds
+    targetPlan: hostedTopologyPlanSchema
   }).strict(), output: operationReceipt })
 };
 export {

package/dist/operator-contracts/catalog/services/secret-operations.d.ts

@@ -0,0 +1,62 @@
+export declare const SECRET_OPERATIONS: {
+    readonly credentialStatus: import("../../control-plane-operation.js").ControlPlaneOperationBinding<{
+        teamId: string;
+        profileId: string;
+        connectionId: string;
+    }, {}, {
+        expectedVersion: number;
+    } | undefined, {
+        version: number;
+        teamId: string;
+        profileId: string;
+        connectionId: string;
+        configured: boolean;
+        custody: "openbao";
+        fields: string[];
+    }>;
+    readonly putCredentials: import("../../control-plane-operation.js").ControlPlaneOperationBinding<{
+        teamId: string;
+        profileId: string;
+        connectionId: string;
+    }, {}, {
+        expectedVersion: number;
+    } | undefined, {
+        version: number;
+        teamId: string;
+        profileId: string;
+        connectionId: string;
+        configured: boolean;
+        custody: "openbao";
+        fields: string[];
+    }>;
+    readonly deleteCredentials: import("../../control-plane-operation.js").ControlPlaneOperationBinding<{
+        teamId: string;
+        profileId: string;
+        connectionId: string;
+    }, {}, {
+        expectedVersion: number;
+    } | undefined, {
+        version: number;
+        teamId: string;
+        profileId: string;
+        connectionId: string;
+        configured: boolean;
+        custody: "openbao";
+        fields: string[];
+    }>;
+    readonly validateCredentials: import("../../control-plane-operation.js").ControlPlaneOperationBinding<{
+        teamId: string;
+        profileId: string;
+        connectionId: string;
+    }, {}, {
+        expectedVersion: number;
+    } | undefined, {
+        version: number;
+        teamId: string;
+        profileId: string;
+        connectionId: string;
+        configured: boolean;
+        custody: "openbao";
+        fields: string[];
+    }>;
+};

package/dist/operator-contracts/catalog/services/secret-operations.js

@@ -0,0 +1,51 @@
+import { z } from "zod";
+import { defineOperation } from "../../operation-builder.js";
+const id = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u);
+const path = z.object({ teamId: id, connectionId: id, profileId: id }).strict();
+const version = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER - 1);
+const descriptor = z.object({
+  teamId: id,
+  connectionId: id,
+  profileId: id,
+  custody: z.literal("openbao"),
+  version,
+  configured: z.boolean(),
+  fields: z.array(id)
+}).strict();
+const put = z.object({
+  expectedVersion: version,
+  values: z.record(z.string().max(1024 * 1024)).refine((v) => Object.keys(v).length > 0 && Object.keys(v).length <= 128)
+}).strict();
+function operation(name, method) {
+  const read = method === "GET";
+  return defineOperation({
+    operationId: `services.credentials.${name}`,
+    description: `${name} managed service credentials.`,
+    rest: { method, path: `/v1/teams/{teamId}/services/{connectionId}/credentials/{profileId}${name === "validate" ? "/validate" : ""}` },
+    parameters: `treeseed.services.credentials.${name}.parameters/v1`,
+    capability: read ? "secrets.read" : "secrets.write",
+    authentication: "oauth",
+    oauthScopes: read ? ["treeseed:read"] : ["treeseed:projects:write"],
+    kind: read ? "read" : "mutation",
+    riskClass: read ? "ordinary" : "credential",
+    confirmation: read ? "never" : "input_required",
+    surfaces: ["rest"],
+    cacheScope: "none",
+    pagination: "none",
+    redactedPaths: ["body.values"]
+  }, {
+    path,
+    query: z.object({}).strict(),
+    body: read ? z.undefined() : name === "put" ? put : z.object({ expectedVersion: version }).strict(),
+    output: name === "validate" ? z.object({ ok: z.boolean() }).strict() : descriptor
+  });
+}
+const SECRET_OPERATIONS = {
+  credentialStatus: operation("show", "GET"),
+  putCredentials: operation("put", "PUT"),
+  deleteCredentials: operation("delete", "DELETE"),
+  validateCredentials: operation("validate", "POST")
+};
+export {
+  SECRET_OPERATIONS
+};

package/dist/operator-contracts/control-plane-operations.d.ts

@@ -36,7 +36,7 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                         repository: "treeseed-ai/platform";
                         commit: string;
                     };
-                    mutation: "approval-required";
+                    mutation: "agent-authorized";
                     environment: "production" | "staging";
                     artifacts: Record<string, {
                         digest: string;
@@ -62,23 +62,10 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                         connectionRef: string;
                     }>>;
                 };
-                credentialLeaseIds?: string[] | undefined;
             }, Record<string, unknown>>;
             readonly apply: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
                 teamId: string;
             }, {}, {
-                approval: {
-                    schemaVersion: "treeseed.hosted-topology-approval/v1";
-                    planDigest: string;
-                    teamId: string;
-                    environment: "production" | "staging";
-                    deploymentId: string;
-                    stackId: string;
-                    backendBindingDigest: string;
-                    decision: "approved";
-                    approvedBy: string;
-                    approvedAt: string;
-                };
                 plan: {
                     schemaVersion: "treeseed.hosted-topology-plan/v1";
                     blockers: {
@@ -163,9 +150,8 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                     declarationDigest: string;
                     topologyId: string;
                     platformCommit: string;
-                    approvalRequired: boolean;
+                    authorization: "authenticated-agent";
                 };
-                credentialLeaseIds?: string[] | undefined;
             }, Record<string, unknown>>;
             readonly status: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
                 teamId: string;
@@ -210,18 +196,6 @@ export declare const CONTROL_PLANE_OPERATIONS: {
             readonly rollback: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
                 teamId: string;
             }, {}, {
-                approval: {
-                    schemaVersion: "treeseed.hosted-topology-rollback-execution-approval/v1";
-                    teamId: string;
-                    environment: "production" | "staging";
-                    deploymentId: string;
-                    stackId: string;
-                    backendBindingDigest: string;
-                    decision: "approved";
-                    approvedBy: string;
-                    approvedAt: string;
-                    executionDigest: string;
-                };
                 execution: {
                     schemaVersion: "treeseed.hosted-topology-rollback-execution/v1";
                     teamId: string;
@@ -336,7 +310,7 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                     declarationDigest: string;
                     topologyId: string;
                     platformCommit: string;
-                    approvalRequired: boolean;
+                    authorization: "authenticated-agent";
                 };
                 targetPlan: {
                     schemaVersion: "treeseed.hosted-topology-plan/v1";
@@ -422,9 +396,8 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                     declarationDigest: string;
                     topologyId: string;
                     platformCommit: string;
-                    approvalRequired: boolean;
+                    authorization: "authenticated-agent";
                 };
-                credentialLeaseIds?: string[] | undefined;
             }, Record<string, unknown>>;
         };
     };
@@ -1421,26 +1394,66 @@ export declare const CONTROL_PLANE_OPERATIONS: {
             teamId: string;
             connectionId: string;
         }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-        readonly putAuthority: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+        readonly credentialStatus: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
             teamId: string;
             profileId: string;
             connectionId: string;
-        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-        readonly userVaultKey: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly putUserVaultKey: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly teamVault: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly initializeTeamVault: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly resetTeamVault: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly rotateTeamVault: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly vaultGrantCandidates: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly createVaultGrant: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly deleteVaultGrant: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly vaultCredentialEnvelopes: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly credentialEnvelopes: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly putCredentialEnvelope: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly createOperationLease: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly operationLease: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly putOperationLeasePayload: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        }, {}, {
+            expectedVersion: number;
+        } | undefined, {
+            version: number;
+            teamId: string;
+            profileId: string;
+            connectionId: string;
+            configured: boolean;
+            custody: "openbao";
+            fields: string[];
+        }>;
+        readonly putCredentials: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+            teamId: string;
+            profileId: string;
+            connectionId: string;
+        }, {}, {
+            expectedVersion: number;
+        } | undefined, {
+            version: number;
+            teamId: string;
+            profileId: string;
+            connectionId: string;
+            configured: boolean;
+            custody: "openbao";
+            fields: string[];
+        }>;
+        readonly deleteCredentials: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+            teamId: string;
+            profileId: string;
+            connectionId: string;
+        }, {}, {
+            expectedVersion: number;
+        } | undefined, {
+            version: number;
+            teamId: string;
+            profileId: string;
+            connectionId: string;
+            configured: boolean;
+            custody: "openbao";
+            fields: string[];
+        }>;
+        readonly validateCredentials: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+            teamId: string;
+            profileId: string;
+            connectionId: string;
+        }, {}, {
+            expectedVersion: number;
+        } | undefined, {
+            version: number;
+            teamId: string;
+            profileId: string;
+            connectionId: string;
+            configured: boolean;
+            custody: "openbao";
+            fields: string[];
+        }>;
     };
     readonly agents: {
         readonly list: import("./control-plane-operation.js").ControlPlaneOperationBinding<{

package/dist/operator-contracts/control-plane-operations.js

@@ -8,7 +8,7 @@ import { capabilityOntologyOperations } from "./catalog/capability-ontology-oper
 import { knowledgeShareOperations } from "./catalog/knowledge-share-operations.js";
 import { PROVIDER_ENVIRONMENT_OPERATIONS } from "./catalog/provider-environment-operations.js";
 import { HOSTED_TOPOLOGY_OPERATIONS } from "./catalog/hosted-topology-operations.js";
-import { SERVICE_VAULT_OPERATIONS } from "./catalog/services/service-vault-operations.js";
+import { SECRET_OPERATIONS } from "./catalog/services/secret-operations.js";
 import { buildControlPlaneCatalog, flattenControlPlaneOperations } from "./catalog/control-plane-catalog.js";
 const empty = z.object({}).strict(), none = z.undefined(), record = z.record(z.unknown()), payload = record;
 function read(operationId, path, capability, surfaces = ["rest"]) {
@@ -278,15 +278,14 @@ const CONTROL_PLANE_OPERATIONS = {
     deleteWorkflowVariable: resource("repositories.workflow.variables.delete", "DELETE", "/v1/projects/{projectId}/workflow-configuration/variables/{name}", { projectId: z.string().min(1), name: z.string().min(1) }, { capability: "workflows.write", risk: "destructive", concurrency: true })
   },
   services: {
-    ...SERVICE_VAULT_OPERATIONS,
+    ...SECRET_OPERATIONS,
     providers: resource("services.providers.list", "GET", "/v1/service-providers", {}, { capability: "services.read", surfaces: ["rest", "cli", "mcp_tool"] }),
     connections: resource("services.connections.list", "GET", "/v1/teams/{teamId}/services", { teamId: z.string().min(1) }, { capability: "services.read", surfaces: ["rest", "cli", "mcp_tool"], pagination: "cursor" }),
     connection: resource("services.connections.show", "GET", "/v1/teams/{teamId}/services/{connectionId}", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "services.read", surfaces: ["rest", "cli", "mcp_resource"] }),
     createConnection: resource("services.connections.create", "POST", "/v1/teams/{teamId}/services", { teamId: z.string().min(1) }, { capability: "services.write", surfaces: ["rest", "cli", "mcp_tool"], risk: "credential" }),
     updateConnection: resource("services.connections.update", "PUT", "/v1/teams/{teamId}/services/{connectionId}", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "services.write", surfaces: ["rest", "cli", "mcp_tool"], concurrency: true }),
     disconnect: resource("services.connections.disconnect", "DELETE", "/v1/teams/{teamId}/services/{connectionId}", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "services.write", surfaces: ["rest", "cli", "mcp_tool"], risk: "destructive", concurrency: true }),
-    authorities: resource("services.credential.authorities.list", "GET", "/v1/teams/{teamId}/services/{connectionId}/credential-authorities", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "secrets.read", surfaces: ["rest", "cli"], pagination: "cursor" }),
-    putAuthority: resource("services.credential.authorities.put", "PUT", "/v1/teams/{teamId}/services/{connectionId}/credential-authorities/{profileId}", { teamId: z.string().min(1), connectionId: z.string().min(1), profileId: z.string().min(1) }, { capability: "secrets.write", surfaces: ["rest", "cli"], risk: "credential", concurrency: true, redactedPaths: ["body"] })
+    authorities: resource("services.credential.authorities.list", "GET", "/v1/teams/{teamId}/services/{connectionId}/credential-authorities", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "secrets.read", surfaces: ["rest", "cli"], pagination: "cursor" })
   },
   agents: {
     list: resource("agents.list", "GET", "/v1/projects/{projectId}/agents", { projectId: z.string().min(1) }, { capability: "agents.read", surfaces: ["rest", "cli", "mcp_tool"], pagination: "cursor" }),