@treeseed/sdk 0.13.0-rc.85 → 0.13.0-rc.87

package/dist/secrets-capability/github-actions-encryption.d.ts

@@ -0,0 +1,2 @@
+/** GitHub's upload protocol, not a TreeSeed custody implementation. */
+export declare function encryptGitHubActionsSecret(value: string, providerPublicKey: string): Promise<string>;

package/dist/secrets-capability/github-actions-encryption.js

@@ -0,0 +1,11 @@
+import sodium from "libsodium-wrappers-sumo";
+async function encryptGitHubActionsSecret(value, providerPublicKey) {
+  await sodium.ready;
+  if (!value) throw new Error("GitHub Actions secret value is required.");
+  const key = sodium.from_base64(providerPublicKey, sodium.base64_variants.ORIGINAL);
+  if (key.length !== sodium.crypto_box_PUBLICKEYBYTES) throw new Error("Invalid GitHub public key.");
+  return sodium.to_base64(sodium.crypto_box_seal(value, key), sodium.base64_variants.ORIGINAL);
+}
+export {
+  encryptGitHubActionsSecret
+};

package/dist/secrets-capability/provider-operation-contracts.d.ts

@@ -9,7 +9,7 @@ export type ProviderCredentialAuthority = {
     scheme: CredentialAuthorityScheme;
     reference: string;
     capabilities: ServiceCapabilityType[];
-    status: 'ready' | 'interactive-only' | 'reauthorization-required' | 'revoked';
+    status: 'ready' | 'reauthorization-required' | 'revoked';
     version: number;
 };
 export type ProjectRemoteRepositoryBinding = {

package/dist/secrets-capability/secret-contracts.d.ts

@@ -0,0 +1,33 @@
+import { z } from 'zod';
+export declare const secretScopeSchema: z.ZodObject<{
+    team: z.ZodString;
+    project: z.ZodString;
+    environment: z.ZodString;
+    purpose: z.ZodString;
+    name: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    project: string;
+    name: string;
+    team: string;
+    purpose: string;
+    environment: string;
+}, {
+    project: string;
+    name: string;
+    team: string;
+    purpose: string;
+    environment: string;
+}>;
+export type SecretScope = z.infer<typeof secretScopeSchema>;
+export declare const SECRET_CUSTODY_BACKENDS: readonly ["openbao", "os"];
+export declare function canonicalSecretPath(input: SecretScope): string;
+export type HostedSecretOperationBinding = {
+    subjectType: 'declaration' | 'plan' | 'rollback';
+    subjectDigest: string;
+    deploymentId: string;
+    stackId: string;
+    environment: 'staging' | 'production';
+};
+export declare function containsForbiddenPlaintextSecretMaterial(value: unknown, path?: string): string[];
+export declare function canonicalHostedSecretOperationBinding(input: HostedSecretOperationBinding): string;
+export declare function validateHostedSecretOperationBinding(value: unknown): value is HostedSecretOperationBinding;

package/dist/secrets-capability/secret-contracts.js

@@ -0,0 +1,49 @@
+import { z } from "zod";
+const segment = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u);
+const secretScopeSchema = z.object({
+  team: segment,
+  project: segment,
+  environment: segment,
+  purpose: segment,
+  name: segment
+}).strict();
+const SECRET_CUSTODY_BACKENDS = ["openbao", "os"];
+function canonicalSecretPath(input) {
+  const s = secretScopeSchema.parse(input);
+  return `teams/${s.team}/projects/${s.project}/environments/${s.environment}/purposes/${s.purpose}/secrets/${s.name}`;
+}
+const FORBIDDEN_SECRET_KEYS = /(?:passphrase|password|plaintext|derivedKey|privateKey|apiToken|accessToken|secretValue|credentialValue)$/iu;
+function containsForbiddenPlaintextSecretMaterial(value, path = "") {
+  if (!value || typeof value !== "object") return [];
+  const failures = [];
+  for (const [key, entry] of Object.entries(value)) {
+    const nextPath = path ? `${path}.${key}` : key;
+    if (FORBIDDEN_SECRET_KEYS.test(key) && typeof entry === "string" && entry.trim()) failures.push(nextPath);
+    if (entry && typeof entry === "object") failures.push(...containsForbiddenPlaintextSecretMaterial(entry, nextPath));
+  }
+  return failures;
+}
+const digest = /^sha256:[a-f0-9]{64}$/u;
+const identifier = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+function canonicalHostedSecretOperationBinding(input) {
+  return JSON.stringify({
+    subjectType: input.subjectType,
+    subjectDigest: input.subjectDigest,
+    deploymentId: input.deploymentId,
+    stackId: input.stackId,
+    environment: input.environment
+  });
+}
+function validateHostedSecretOperationBinding(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const binding = value;
+  return ["declaration", "plan", "rollback"].includes(String(binding.subjectType)) && digest.test(String(binding.subjectDigest)) && identifier.test(String(binding.deploymentId)) && identifier.test(String(binding.stackId)) && ["staging", "production"].includes(String(binding.environment));
+}
+export {
+  SECRET_CUSTODY_BACKENDS,
+  canonicalHostedSecretOperationBinding,
+  canonicalSecretPath,
+  containsForbiddenPlaintextSecretMaterial,
+  secretScopeSchema,
+  validateHostedSecretOperationBinding
+};

package/dist/secrets-capability/service-provider-contracts.d.ts

@@ -1,4 +1,4 @@
-export declare const SERVICE_PROVIDER_IDS: readonly ["github", "cloudflare", "railway", "openbao"];
+export declare const SERVICE_PROVIDER_IDS: readonly ["github", "cloudflare", "railway"];
 export declare const SERVICE_CAPABILITY_TYPES: readonly ["repository-hosting", "workflow-execution", "workflow-configuration", "secret-enclave", "frontend-hosting", "backend-hosting", "dns-management", "object-storage", "state-encryption", "database-hosting", "capacity-runtime-hosting", "private-knowledge-index-hosting", "artifact-hosting"];
 export declare const SERVICE_CONNECTION_STATUSES: readonly ["draft", "active", "degraded", "validation-failed", "reentry-required", "reauthorization-required", "disconnected"];
 export declare const SERVICE_CAPABILITY_STATUSES: readonly ["configured", "disabled", "blocked", "planned"];
@@ -27,7 +27,7 @@ export type CredentialProfileDefinition = {
     authoritySchemes?: CredentialAuthorityScheme[];
     knowledgePageIds: string[];
 };
-export declare const CREDENTIAL_AUTHORITY_SCHEMES: readonly ["app-installation", "api-token", "oauth-token", "environment-reference", "client-encrypted", "external-vault", "workload-identity"];
+export declare const CREDENTIAL_AUTHORITY_SCHEMES: readonly ["app-installation", "openbao"];
 export type CredentialAuthorityScheme = (typeof CREDENTIAL_AUTHORITY_SCHEMES)[number];
 export type ServiceCapabilityDefinition = {
     type: ServiceCapabilityType;

package/dist/secrets-capability/service-provider-contracts.js

@@ -1,4 +1,4 @@
-const SERVICE_PROVIDER_IDS = ["github", "cloudflare", "railway", "openbao"];
+const SERVICE_PROVIDER_IDS = ["github", "cloudflare", "railway"];
 const SERVICE_CAPABILITY_TYPES = [
   "repository-hosting",
   "workflow-execution",
@@ -26,12 +26,7 @@ const SERVICE_CONNECTION_STATUSES = [
 const SERVICE_CAPABILITY_STATUSES = ["configured", "disabled", "blocked", "planned"];
 const CREDENTIAL_AUTHORITY_SCHEMES = [
   "app-installation",
-  "api-token",
-  "oauth-token",
-  "environment-reference",
-  "client-encrypted",
-  "external-vault",
-  "workload-identity"
+  "openbao"
 ];
 const field = (key, label, description, required = true, sensitive = false) => ({
   key,
@@ -76,11 +71,11 @@ const SERVICE_PROVIDER_CATALOG = [
         label: "Repository token authority",
         description: "Fine-grained token authority restricted to selected repositories and Contents access.",
         capabilities: ["repository-hosting"],
-        fields: [field("accessToken", "Fine-grained token", "Encrypted before leaving this browser.", true, true)],
+        fields: [field("accessToken", "Fine-grained token", "Stored in core OpenBao; used only by authorized operations.", true, true)],
         permissions: ["Metadata: read", "Contents: read and write"],
         sharing: "capability-scoped",
-        unattendedCompatible: false,
-        authoritySchemes: ["api-token", "environment-reference", "client-encrypted", "external-vault"],
+        unattendedCompatible: true,
+        authoritySchemes: ["openbao"],
         knowledgePageIds: ["provider.github", "services.credentials", "vault.rotation"]
       },
       {
@@ -100,11 +95,11 @@ const SERVICE_PROVIDER_CATALOG = [
         label: "Workflow token authority",
         description: "Fine-grained token authority for Actions and explicitly enabled secret or variable scopes.",
         capabilities: ["workflow-execution", "workflow-configuration", "secret-enclave"],
-        fields: [field("accessToken", "Fine-grained token", "Encrypted before leaving this browser.", true, true)],
+        fields: [field("accessToken", "Fine-grained token", "Stored in core OpenBao; used only by authorized operations.", true, true)],
         permissions: ["Metadata: read", "Contents: read", "Actions: read and write", "Secrets: read and write", "Variables: read and write"],
         sharing: "capability-scoped",
-        unattendedCompatible: false,
-        authoritySchemes: ["api-token", "environment-reference", "client-encrypted", "external-vault"],
+        unattendedCompatible: true,
+        authoritySchemes: ["openbao"],
         knowledgePageIds: ["provider.github", "services.credentials", "vault.rotation"]
       }
     ]
@@ -132,11 +127,11 @@ const SERVICE_PROVIDER_CATALOG = [
       { type: "state-encryption", label: "State encryption", description: "Independent encryption authority for OpenTofu state and plan files.", credentialProfileIds: ["opentofu-state-encryption"], status: "available" }
     ],
     credentialProfiles: [
-      { id: "cloudflare-runtime", label: "Pages and Workers token", description: "A token limited to application deployment resources.", capabilities: ["frontend-hosting"], fields: [field("apiToken", "API token", "Encrypted in this browser and used only for authorized frontend operations.", true, true)], permissions: ["Account: Workers Scripts Edit", "Account: Pages Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
-      { id: "cloudflare-dns", label: "DNS token", description: "A token restricted to selected zones.", capabilities: ["dns-management"], fields: [field("apiToken", "DNS API token", "Encrypted separately from deployment authority.", true, true)], permissions: ["Zone: DNS Edit for only the managed zones"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
-      { id: "cloudflare-storage", label: "Storage management authority", description: "Vault-custodied token used only to reconcile authorized R2 resources.", capabilities: ["object-storage"], fields: [field("apiToken", "Storage API token", "Encrypted separately and used only to reconcile authorized R2 resources.", true, true)], permissions: ["Account: Workers R2 Storage Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
-      { id: "s3-state-session", label: "OpenTofu state session", description: "S3-compatible credentials limited to the selected team state prefix.", capabilities: ["object-storage"], fields: [field("accessKeyId", "R2 access key ID", "Vault-custodied S3-compatible access key identifier for encrypted OpenTofu state.", true, true), field("secretAccessKey", "R2 secret access key", "Vault-custodied S3-compatible secret key for encrypted OpenTofu state.", true, true), field("sessionToken", "R2 session token", "Optional short-lived S3-compatible session token.", false, true)], permissions: ["Object read and write for only the managed team state prefix"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
-      { id: "opentofu-state-encryption", label: "OpenTofu state encryption", description: "Independent encryption material that is never stored with the R2 state object.", capabilities: ["state-encryption"], fields: [field("stateEncryptionKey", "OpenTofu state encryption key", "Generated in the browser as a 32-byte hexadecimal key and encrypted separately.", true, true)], permissions: ["Encrypt and decrypt only the selected team OpenTofu state"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] }
+      { id: "cloudflare-runtime", label: "Pages and Workers token", description: "A token limited to application deployment resources.", capabilities: ["frontend-hosting"], fields: [field("apiToken", "API token", "Stored in core OpenBao and used only by authorized operations.", true, true)], permissions: ["Account: Workers Scripts Edit", "Account: Pages Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["openbao"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
+      { id: "cloudflare-dns", label: "DNS token", description: "A token restricted to selected zones.", capabilities: ["dns-management"], fields: [field("apiToken", "DNS API token", "Encrypted separately from deployment authority.", true, true)], permissions: ["Zone: DNS Edit for only the managed zones"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["openbao"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
+      { id: "cloudflare-storage", label: "Storage management authority", description: "Vault-custodied token used only to reconcile authorized R2 resources.", capabilities: ["object-storage"], fields: [field("apiToken", "Storage API token", "Encrypted separately and used only to reconcile authorized R2 resources.", true, true)], permissions: ["Account: Workers R2 Storage Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["openbao"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
+      { id: "s3-state-session", label: "OpenTofu state session", description: "S3-compatible credentials limited to the selected team state prefix.", capabilities: ["object-storage"], fields: [field("accessKeyId", "R2 access key ID", "Vault-custodied S3-compatible access key identifier for encrypted OpenTofu state.", true, true), field("secretAccessKey", "R2 secret access key", "Vault-custodied S3-compatible secret key for encrypted OpenTofu state.", true, true), field("sessionToken", "R2 session token", "Optional short-lived S3-compatible session token.", false, true)], permissions: ["Object read and write for only the managed team state prefix"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["openbao"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
+      { id: "opentofu-state-encryption", label: "OpenTofu state encryption", description: "Independent encryption material that is never stored with the R2 state object.", capabilities: ["state-encryption"], fields: [field("stateEncryptionKey", "OpenTofu state encryption key", "A 32-byte hexadecimal key stored separately in core OpenBao.", true, true)], permissions: ["Encrypt and decrypt only the selected team OpenTofu state"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["openbao"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] }
     ]
   },
   {
@@ -163,24 +158,13 @@ const SERVICE_PROVIDER_CATALOG = [
       label: "Railway workspace token",
       description: "Railway currently exposes broad workspace authority. Sharing it increases the blast radius across enabled capabilities.",
       capabilities: ["backend-hosting", "database-hosting", "capacity-runtime-hosting", "private-knowledge-index-hosting"],
-      fields: [field("apiToken", "Workspace token", "Encrypted in this browser. TreeSeed will request explicit authorization before interactive use.", true, true)],
+      fields: [field("apiToken", "Workspace token", "Stored in core OpenBao and used only by authorized operations.", true, true)],
       permissions: ["Workspace access required by the selected operations"],
       sharing: "provider-shared",
       unattendedCompatible: true,
-      authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"],
+      authoritySchemes: ["openbao"],
       knowledgePageIds: ["provider.railway", "services.credentials", "vault.rotation"]
     }]
-  },
-  {
-    id: "openbao",
-    label: "OpenBao / HashiCorp Vault",
-    logoKey: "vault",
-    documentationUrl: "https://openbao.org/docs/auth/jwt/",
-    description: "Reference an external vault through workload identity; no long-lived vault token is stored.",
-    knowledgePageIds: ["provider.openbao", "services.external-vault"],
-    connectionFields: [field("address", "Vault address", "The HTTPS endpoint for the vault."), field("mount", "Secrets mount", "The mount containing TreeSeed-managed references."), field("role", "Workload identity role", "The OIDC/JWT role used by the operations runner.")],
-    capabilities: [{ type: "secret-enclave", label: "External secret vault", description: "Resolve approved secret references through workload identity.", credentialProfileIds: [], status: "available" }],
-    credentialProfiles: []
   }
 ];
 function getServiceProviderDefinition(providerId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.85",
+  "version": "0.13.0-rc.87",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {

package/dist/operator-contracts/catalog/services/service-vault-operations.d.ts

@@ -1,17 +0,0 @@
-export declare const SERVICE_VAULT_OPERATIONS: {
-    readonly userVaultKey: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly putUserVaultKey: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly teamVault: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly initializeTeamVault: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly resetTeamVault: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly rotateTeamVault: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly vaultGrantCandidates: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly createVaultGrant: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly deleteVaultGrant: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly vaultCredentialEnvelopes: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly credentialEnvelopes: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly putCredentialEnvelope: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly createOperationLease: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly operationLease: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly putOperationLeasePayload: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-};

package/dist/operator-contracts/catalog/services/service-vault-operations.js

@@ -1,158 +0,0 @@
-import { z } from "zod";
-import { defineOperation } from "../../operation-builder.js";
-const empty = z.object({}).strict();
-const none = z.undefined();
-const record = z.record(z.unknown());
-const teamPath = z.object({ teamId: z.string().min(1) }).strict();
-function vaultOperation(operationId, method, path, pathSchema, options = {}) {
-  const read = method === "GET", risk = options.risk ?? "ordinary";
-  return defineOperation({
-    operationId,
-    description: `${read ? "Read" : "Apply"} ${operationId}.`,
-    rest: { method, path },
-    capability: read ? "secrets.read" : "secrets.write",
-    ...path.includes("{") ? { parameters: `treeseed.${operationId}.parameters/v1` } : {},
-    authentication: "oauth",
-    oauthScopes: read ? ["treeseed:read"] : ["treeseed:projects:write"],
-    kind: read ? "read" : "mutation",
-    riskClass: risk,
-    confirmation: risk === "ordinary" ? "never" : "input_required",
-    surfaces: ["rest"],
-    cacheScope: read ? "principal" : "none",
-    pagination: "none",
-    redactedPaths: options.redactedPaths
-  }, { path: pathSchema, query: read ? record : empty, body: read ? none : options.body ?? record, output: options.output ?? record });
-}
-const nullableRecord = record.nullable(), records = z.array(record);
-const encryptedPrivateKeyEnvelope = z.object({
-  version: z.literal("service-vault-v1"),
-  algorithm: z.literal("xchacha20-poly1305-ietf"),
-  kdf: z.object({ algorithm: z.literal("argon2id"), opsLimit: z.number().int().positive(), memLimit: z.number().int().positive(), salt: z.string().min(1) }).strict(),
-  nonce: z.string().min(1),
-  ciphertext: z.string().min(1),
-  publicKey: z.string().min(1)
-}).strict();
-const encryptedCredentialEnvelope = z.object({
-  version: z.literal("service-vault-v1"),
-  algorithm: z.literal("xchacha20-poly1305-ietf"),
-  ciphertext: z.string().min(1),
-  nonce: z.string().min(1),
-  wrappedKey: z.string().min(1),
-  wrappedKeyNonce: z.string().min(1),
-  associatedData: z.string().min(1),
-  associatedDataDigest: z.string().min(1),
-  fingerprint: z.string().min(1)
-}).strict();
-const SERVICE_VAULT_OPERATIONS = {
-  userVaultKey: vaultOperation("services.vault.user.key.show", "GET", "/v1/users/me/vault-key", empty, { output: nullableRecord }),
-  putUserVaultKey: vaultOperation(
-    "services.vault.user.key.put",
-    "PUT",
-    "/v1/users/me/vault-key",
-    empty,
-    { risk: "credential", redactedPaths: ["body.encryptedPrivateKeyEnvelope"], body: z.object({ publicKey: z.string().min(1), encryptedPrivateKeyEnvelope }).strict() }
-  ),
-  teamVault: vaultOperation("services.vault.team.show", "GET", "/v1/teams/{teamId}/vault", teamPath, { output: nullableRecord }),
-  initializeTeamVault: vaultOperation(
-    "services.vault.team.initialize",
-    "POST",
-    "/v1/teams/{teamId}/vault",
-    teamPath,
-    { risk: "credential", redactedPaths: ["body.wrappedTeamVaultKey"], body: z.object({ userVaultKeyId: z.string().min(1), wrappedTeamVaultKey: z.string().min(1), encryptionVersion: z.literal("service-vault-v1") }).strict() }
-  ),
-  resetTeamVault: vaultOperation(
-    "services.vault.team.reset",
-    "POST",
-    "/v1/teams/{teamId}/vault/reset",
-    teamPath,
-    { risk: "destructive", redactedPaths: ["body.wrappedTeamVaultKey", "body.currentPassword"], body: z.object({ userVaultKeyId: z.string().min(1), wrappedTeamVaultKey: z.string().min(1), encryptionVersion: z.literal("service-vault-v1"), confirmation: z.string().min(1), currentPassword: z.string().min(1) }).strict() }
-  ),
-  rotateTeamVault: vaultOperation(
-    "services.vault.team.rotate",
-    "POST",
-    "/v1/teams/{teamId}/vault/rotate",
-    teamPath,
-    { risk: "credential", redactedPaths: ["body.envelopes", "body.grants"], body: z.object({
-      expectedKeyVersion: z.number().int().positive(),
-      envelopes: z.array(z.object({ id: z.string().min(1), envelope: encryptedCredentialEnvelope }).strict()),
-      grants: z.array(z.object({ userId: z.string().min(1), userVaultKeyId: z.string().min(1), wrappedTeamVaultKey: z.string().min(1) }).strict()).min(1)
-    }).strict() }
-  ),
-  vaultGrantCandidates: vaultOperation("services.vault.grant.candidates.list", "GET", "/v1/teams/{teamId}/vault/grant-candidates", teamPath, { output: records }),
-  createVaultGrant: vaultOperation(
-    "services.vault.grants.create",
-    "POST",
-    "/v1/teams/{teamId}/vault/grants",
-    teamPath,
-    { risk: "credential", redactedPaths: ["body.wrappedTeamVaultKey"], body: z.object({ userId: z.string().min(1), userVaultKeyId: z.string().min(1), wrappedTeamVaultKey: z.string().min(1) }).strict() }
-  ),
-  deleteVaultGrant: vaultOperation(
-    "services.vault.grants.delete",
-    "DELETE",
-    "/v1/teams/{teamId}/vault/grants/{grantId}",
-    z.object({ teamId: z.string().min(1), grantId: z.string().min(1) }).strict(),
-    { risk: "destructive" }
-  ),
-  vaultCredentialEnvelopes: vaultOperation(
-    "services.vault.credential.envelopes.list",
-    "GET",
-    "/v1/teams/{teamId}/vault/credential-envelopes",
-    teamPath,
-    { output: records }
-  ),
-  credentialEnvelopes: vaultOperation(
-    "services.credential.envelopes.list",
-    "GET",
-    "/v1/teams/{teamId}/services/{connectionId}/credential-envelopes",
-    z.object({ teamId: z.string().min(1), connectionId: z.string().min(1) }).strict(),
-    { output: records }
-  ),
-  putCredentialEnvelope: vaultOperation(
-    "services.credential.envelopes.put",
-    "POST",
-    "/v1/teams/{teamId}/services/{connectionId}/credential-envelopes",
-    z.object({ teamId: z.string().min(1), connectionId: z.string().min(1) }).strict(),
-    { risk: "credential", redactedPaths: ["body.envelope"], body: z.object({ definitionId: z.string().min(1), fieldKey: z.string().min(1), keyVersion: z.number().int().positive(), envelope: encryptedCredentialEnvelope }).strict() }
-  ),
-  createOperationLease: vaultOperation(
-    "services.operation.leases.create",
-    "POST",
-    "/v1/teams/{teamId}/service-operation-leases",
-    teamPath,
-    { risk: "authority", body: z.object({
-      connectionId: z.string().min(1),
-      capabilityType: z.string().min(1),
-      credentialProfileId: z.string().min(1),
-      purpose: z.enum([
-        "provider-connection-validation",
-        "remote-git-publication",
-        "workflow-dispatch",
-        "workflow-configuration",
-        "hosted-topology-plan",
-        "hosted-topology-apply",
-        "hosted-topology-readback",
-        "hosted-topology-rollback"
-      ]),
-      idempotencyKey: z.string().min(1).optional(),
-      resourceScope: record.optional(),
-      hostedBinding: record.optional(),
-      authorityRequests: z.array(record).optional()
-    }).strict() }
-  ),
-  operationLease: vaultOperation(
-    "services.operation.leases.show",
-    "GET",
-    "/v1/teams/{teamId}/service-operation-leases/{leaseId}",
-    z.object({ teamId: z.string().min(1), leaseId: z.string().min(1) }).strict()
-  ),
-  putOperationLeasePayload: vaultOperation(
-    "services.operation.leases.payload.put",
-    "PUT",
-    "/v1/teams/{teamId}/service-operation-leases/{leaseId}/payload",
-    z.object({ teamId: z.string().min(1), leaseId: z.string().min(1) }).strict(),
-    { risk: "credential", redactedPaths: ["body.sealedPayload"], body: z.object({ sealedPayload: z.string().min(1) }).strict() }
-  )
-};
-export {
-  SERVICE_VAULT_OPERATIONS
-};

package/dist/secrets-capability/service-vault-contracts.d.ts

@@ -1,108 +0,0 @@
-export declare const SERVICE_VAULT_ENCRYPTION_VERSION: "service-vault-v1";
-export declare const SERVICE_VAULT_AEAD_ALGORITHM: "xchacha20-poly1305-ietf";
-export declare const SERVICE_VAULT_KEY_AGREEMENT: "x25519-sealed-box";
-export declare const SERVICE_VAULT_KDF: "argon2id";
-export declare const SECRET_OPERATION_PURPOSES: readonly ["provider-connection-validation", "remote-git-publication", "workflow-dispatch", "workflow-configuration", "hosted-topology-plan", "hosted-topology-apply", "hosted-topology-readback", "hosted-topology-rollback"];
-export type SecretOperationPurpose = (typeof SECRET_OPERATION_PURPOSES)[number];
-export type HostedSecretOperationPurpose = Extract<SecretOperationPurpose, `hosted-topology-${string}`>;
-export type EncryptedCredentialEnvelope = {
-    version: typeof SERVICE_VAULT_ENCRYPTION_VERSION;
-    algorithm: typeof SERVICE_VAULT_AEAD_ALGORITHM;
-    ciphertext: string;
-    nonce: string;
-    wrappedKey: string;
-    wrappedKeyNonce: string;
-    associatedData: string;
-    associatedDataDigest: string;
-    fingerprint: string;
-};
-export type EncryptedPrivateKeyEnvelope = {
-    version: typeof SERVICE_VAULT_ENCRYPTION_VERSION;
-    algorithm: typeof SERVICE_VAULT_AEAD_ALGORITHM;
-    kdf: {
-        algorithm: typeof SERVICE_VAULT_KDF;
-        opsLimit: number;
-        memLimit: number;
-        salt: string;
-    };
-    nonce: string;
-    ciphertext: string;
-    publicKey: string;
-};
-export type TeamVaultGrantEnvelope = {
-    version: typeof SERVICE_VAULT_ENCRYPTION_VERSION;
-    algorithm: typeof SERVICE_VAULT_KEY_AGREEMENT;
-    recipientPublicKey: string;
-    wrappedTeamVaultKey: string;
-};
-export type SecretOperationLease = {
-    id: string;
-    teamId: string;
-    connectionId: string;
-    capabilityType: string;
-    purpose: SecretOperationPurpose;
-    resourceScope: Record<string, string>;
-    credentialProfileId: string;
-    actorUserId: string;
-    requiredFields: string[];
-    publicKey: string;
-    status: 'awaiting-runner' | 'pending' | 'ready' | 'consumed' | 'expired' | 'cancelled' | 'failed';
-    expiresAt: string;
-    consumedAt?: string | null;
-    operationCorrelationId: string;
-    hostedBinding?: HostedSecretOperationBinding;
-    authorityRequests?: SecretOperationAuthorityRequest[];
-};
-export type HostedSecretOperationBinding = {
-    subjectType: 'declaration' | 'plan' | 'rollback';
-    subjectDigest: string;
-    deploymentId: string;
-    stackId: string;
-    environment: 'staging' | 'production';
-};
-export type SecretOperationAuthorityRequest = {
-    requestId: string;
-    connectionId: string;
-    credentialProfileId: string;
-    provider: 'cloudflare' | 'railway' | 'treeseed';
-    purpose: 'provider' | 'state-backend' | 'state-encryption';
-    capabilities: string[];
-    requiredFields: string[];
-    secretRef?: string;
-};
-export type SealedSecretOperationPayload = {
-    schemaVersion: 'treeseed.sealed-secret-operation-payload/v1';
-    leaseId: string;
-    teamId: string;
-    operationCorrelationId: string;
-    hostedBinding: HostedSecretOperationBinding;
-    algorithm: typeof SERVICE_VAULT_KEY_AGREEMENT;
-    ciphertext: string;
-};
-export type SecretOperationCredentialBundle = {
-    schemaVersion: 'treeseed.secret-operation-credential-bundle/v1';
-    leaseId: string;
-    teamId: string;
-    operationCorrelationId: string;
-    hostedBinding: HostedSecretOperationBinding;
-    materials: Array<{
-        requestId: string;
-        connectionId: string;
-        credentialProfileId: string;
-        values: Record<string, string>;
-    }>;
-};
-export type ServiceVaultAssociatedData = {
-    teamId: string;
-    connectionId: string;
-    credentialProfileId: string;
-    field: string;
-    purpose: string;
-    version: number;
-};
-export declare function containsForbiddenPlaintextSecretMaterial(value: unknown, path?: string): string[];
-export declare function canonicalServiceVaultAssociatedData(input: ServiceVaultAssociatedData): string;
-export declare function canonicalHostedSecretOperationBinding(input: HostedSecretOperationBinding): string;
-export declare function validateHostedSecretOperationBinding(value: unknown): value is HostedSecretOperationBinding;
-export declare function validateSealedSecretOperationPayload(value: unknown): value is SealedSecretOperationPayload;
-export declare function validateEncryptedCredentialEnvelope(value: unknown): value is EncryptedCredentialEnvelope;

package/dist/secrets-capability/service-vault-contracts.js

@@ -1,74 +0,0 @@
-const SERVICE_VAULT_ENCRYPTION_VERSION = "service-vault-v1";
-const SERVICE_VAULT_AEAD_ALGORITHM = "xchacha20-poly1305-ietf";
-const SERVICE_VAULT_KEY_AGREEMENT = "x25519-sealed-box";
-const SERVICE_VAULT_KDF = "argon2id";
-const SECRET_OPERATION_PURPOSES = [
-  "provider-connection-validation",
-  "remote-git-publication",
-  "workflow-dispatch",
-  "workflow-configuration",
-  "hosted-topology-plan",
-  "hosted-topology-apply",
-  "hosted-topology-readback",
-  "hosted-topology-rollback"
-];
-const FORBIDDEN_SECRET_KEYS = /(?:passphrase|password|plaintext|derivedKey|privateKey|apiToken|accessToken|secretValue|credentialValue)$/iu;
-function containsForbiddenPlaintextSecretMaterial(value, path = "") {
-  if (!value || typeof value !== "object") return [];
-  const failures = [];
-  for (const [key, entry] of Object.entries(value)) {
-    const nextPath = path ? `${path}.${key}` : key;
-    if (FORBIDDEN_SECRET_KEYS.test(key) && typeof entry === "string" && entry.trim()) failures.push(nextPath);
-    if (entry && typeof entry === "object") failures.push(...containsForbiddenPlaintextSecretMaterial(entry, nextPath));
-  }
-  return failures;
-}
-function canonicalServiceVaultAssociatedData(input) {
-  return JSON.stringify({
-    teamId: input.teamId,
-    connectionId: input.connectionId,
-    credentialProfileId: input.credentialProfileId,
-    field: input.field,
-    purpose: input.purpose,
-    version: input.version
-  });
-}
-const digest = /^sha256:[a-f0-9]{64}$/u;
-const identifier = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
-function canonicalHostedSecretOperationBinding(input) {
-  return JSON.stringify({
-    subjectType: input.subjectType,
-    subjectDigest: input.subjectDigest,
-    deploymentId: input.deploymentId,
-    stackId: input.stackId,
-    environment: input.environment
-  });
-}
-function validateHostedSecretOperationBinding(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const binding = value;
-  return ["declaration", "plan", "rollback"].includes(String(binding.subjectType)) && digest.test(String(binding.subjectDigest)) && identifier.test(String(binding.deploymentId)) && identifier.test(String(binding.stackId)) && ["staging", "production"].includes(String(binding.environment));
-}
-function validateSealedSecretOperationPayload(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const payload = value;
-  return payload.schemaVersion === "treeseed.sealed-secret-operation-payload/v1" && payload.algorithm === SERVICE_VAULT_KEY_AGREEMENT && [payload.leaseId, payload.teamId, payload.operationCorrelationId, payload.ciphertext].every((field) => typeof field === "string" && field.length > 0) && validateHostedSecretOperationBinding(payload.hostedBinding);
-}
-function validateEncryptedCredentialEnvelope(value) {
-  if (!value || typeof value !== "object") return false;
-  const envelope = value;
-  return envelope.version === SERVICE_VAULT_ENCRYPTION_VERSION && envelope.algorithm === SERVICE_VAULT_AEAD_ALGORITHM && [envelope.ciphertext, envelope.nonce, envelope.wrappedKey, envelope.wrappedKeyNonce, envelope.associatedData, envelope.associatedDataDigest, envelope.fingerprint].every((field) => typeof field === "string" && field.length > 0);
-}
-export {
-  SECRET_OPERATION_PURPOSES,
-  SERVICE_VAULT_AEAD_ALGORITHM,
-  SERVICE_VAULT_ENCRYPTION_VERSION,
-  SERVICE_VAULT_KDF,
-  SERVICE_VAULT_KEY_AGREEMENT,
-  canonicalHostedSecretOperationBinding,
-  canonicalServiceVaultAssociatedData,
-  containsForbiddenPlaintextSecretMaterial,
-  validateEncryptedCredentialEnvelope,
-  validateHostedSecretOperationBinding,
-  validateSealedSecretOperationPayload
-};

package/dist/secrets-capability/service-vault-crypto.d.ts

@@ -1,20 +0,0 @@
-import { type EncryptedCredentialEnvelope, type EncryptedPrivateKeyEnvelope, type TeamVaultGrantEnvelope } from '@treeseed/sdk/secrets-capability';
-export declare function createServiceVaultKey(): Promise<Uint8Array>;
-export declare function createServiceVaultUserKeyPair(): Promise<{
-    publicKey: string;
-    privateKey: Uint8Array;
-}>;
-export declare function encryptServiceVaultPrivateKey(privateKey: Uint8Array, publicKey: string, passphrase: string, options?: {
-    opsLimit?: number;
-    memLimit?: number;
-}): Promise<EncryptedPrivateKeyEnvelope>;
-export declare function decryptServiceVaultPrivateKey(envelope: EncryptedPrivateKeyEnvelope, passphrase: string): Promise<Uint8Array>;
-export declare function createTeamVaultGrant(teamVaultKey: Uint8Array, recipientPublicKey: string): Promise<TeamVaultGrantEnvelope>;
-export declare function openTeamVaultGrant(grant: TeamVaultGrantEnvelope, recipientPrivateKey: Uint8Array): Promise<Uint8Array>;
-export declare function encryptServiceCredential(plaintext: string, teamVaultKey: Uint8Array, associatedData: string): Promise<EncryptedCredentialEnvelope>;
-export declare function decryptServiceCredential(envelope: EncryptedCredentialEnvelope, teamVaultKey: Uint8Array, expectedAssociatedData: string): Promise<string>;
-export declare function rewrapServiceCredential(envelope: EncryptedCredentialEnvelope, currentTeamVaultKey: Uint8Array, replacementTeamVaultKey: Uint8Array): Promise<EncryptedCredentialEnvelope>;
-export declare function sealSecretOperationPayload(values: Record<string, string>, operationPublicKey: string): Promise<string>;
-export declare function encryptGitHubActionsSecret(value: string, providerPublicKey: string): Promise<string>;
-export declare function openSecretOperationPayload(sealedPayload: string, operationPublicKey: string, operationPrivateKey: Uint8Array): Promise<Record<string, string>>;
-export declare function clearServiceVaultKey(value: Uint8Array | undefined): void;