@treeseed/sdk 0.13.0-rc.86 → 0.13.0-rc.88

package/dist/.treeseed-build-complete.json

@@ -1 +1 @@
-{"completedAt":"2026-09-03T11:02:09.609Z"}
+{"completedAt":"2026-09-05T04:21:52.801Z"}

package/dist/configuration/secrets-capability.d.ts

@@ -1,5 +1,5 @@
 export * from '../secrets-capability/service-provider-contracts.js';
 export * from '../secrets-capability/provider-operation-contracts.js';
 export * from '../secrets-capability/workflow-operation-contracts.js';
-export * from '../secrets-capability/service-vault-contracts.js';
-export * from '../secrets-capability/service-vault-crypto.js';
+export * from '../secrets-capability/secret-contracts.js';
+export * from '../secrets-capability/github-actions-encryption.js';

package/dist/configuration/secrets-capability.js

@@ -1,5 +1,5 @@
 export * from "../secrets-capability/service-provider-contracts.js";
 export * from "../secrets-capability/provider-operation-contracts.js";
 export * from "../secrets-capability/workflow-operation-contracts.js";
-export * from "../secrets-capability/service-vault-contracts.js";
-export * from "../secrets-capability/service-vault-crypto.js";
+export * from "../secrets-capability/secret-contracts.js";
+export * from "../secrets-capability/github-actions-encryption.js";

package/dist/operator-contracts/canonical-command-tree.js

@@ -1,3 +1,4 @@
+import { managedSecretCommands } from "./catalog/services/secret-commands.js";
 import { hostProviderEnvironmentBranch, PROVIDER_ENVIRONMENT_COMMAND_BINDINGS, providerEnvironmentBranches } from "./catalog/provider-environment-commands.js";
 const unavailable = (reason = "This capability is not enabled until its control-plane operation is accepted.") => ({
   kind: "unavailable",
@@ -30,7 +31,6 @@ const operationBindings = {
   "secrets status": local("local.secrets.status"),
   "secrets unlock": local("local.secrets.unlock"),
   "secrets lock": local("local.secrets.lock"),
-  "secrets rotate": local("local.secrets.rotate"),
   "platform verify": local("local.platform.verify"),
   "platform workset": local("local.platform.workset"),
   "platform project create": local("local.platform.project.create"),
@@ -356,7 +356,8 @@ const commandTree = {
     branch("auth", [authLogin(), leaf("logout", "mutation"), leaf("status")]),
     branch("users", [userCreate()]),
     branch("teams", [leaf("list"), { nodeType: "leaf", segment: "current", description: "Show the active team for this authenticated server session.", kind: "read", resultSchemaId: "treeseed.command.teams.current/v1", execution: unavailable() }, { nodeType: "leaf", segment: "use", description: "Select the active team for this authenticated server session.", kind: "mutation", arguments: [{ name: "team", description: "Team UUID or unambiguous slug.", required: true }], options: [planOption], authorization: { capability: "teams.read", confirmation: "never" }, resultSchemaId: "treeseed.command.teams.use/v1", execution: unavailable() }]),
-    branch("secrets", [leaf("list"), leaf("status"), leaf("unlock", "mutation", void 0, "credential"), leaf("lock", "mutation"), leaf("rotate", "mutation", void 0, "credential")]),
+    branch("secrets", [leaf("list"), leaf("status"), leaf("unlock", "mutation", void 0, "credential"), leaf("lock", "mutation")]),
+    managedSecretCommands,
     branch("platform", [
       { nodeType: "leaf", segment: "verify", description: "Verify a declarative Platform repository without package checkouts or a control-plane API.", kind: "read", arguments: [{ name: "root", description: "Platform root; defaults to the current directory.", required: false }], options: [{ name: "--profile", description: "Composable profile to verify.", type: "string[]" }, { name: "--json", description: "Emit the stable command-result envelope.", type: "boolean" }], resultSchemaId: "treeseed.platform-verification/v1", execution: local("local.platform.verify") },
       { nodeType: "leaf", segment: "workset", description: "Plan or safely materialize exact primary source checkouts beneath packages/.", kind: "mutation", options: [planOption, { name: "--apply", description: "Apply the frozen workset plan.", type: "boolean" }, { name: "--yes", description: "Confirm the planned checkout mutations.", type: "boolean" }, { name: "--profile", description: "Composable source profile; repeat to union profiles.", type: "string[]" }, { name: "--project", description: "Explicit project slug; repeat to select projects.", type: "string[]" }, { name: "--exclude", description: "Project slug to exclude; repeat as needed.", type: "string[]" }, { name: "--json", description: "Emit the stable command-result envelope.", type: "boolean" }], authorization: { capability: "development.workset", confirmation: "never" }, resultSchemaId: "treeseed.platform-workset-result/v1", execution: local("local.platform.workset") },

package/dist/operator-contracts/catalog/hosted-topology-operations.d.ts

@@ -59,7 +59,6 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
                 connectionRef: string;
             }>>;
         };
-        credentialLeaseIds?: string[] | undefined;
     }, Record<string, unknown>>;
     readonly apply: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
         teamId: string;
@@ -150,7 +149,6 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
             platformCommit: string;
             authorization: "authenticated-agent";
         };
-        credentialLeaseIds?: string[] | undefined;
     }, Record<string, unknown>>;
     readonly status: import("../control-plane-operation.js").ControlPlaneOperationBinding<{
         teamId: string;
@@ -397,6 +395,5 @@ export declare const HOSTED_TOPOLOGY_OPERATIONS: {
             platformCommit: string;
             authorization: "authenticated-agent";
         };
-        credentialLeaseIds?: string[] | undefined;
     }, Record<string, unknown>>;
 };

package/dist/operator-contracts/catalog/hosted-topology-operations.js

@@ -5,7 +5,6 @@ const teamPath = z.object({ teamId: z.string().min(1) }).strict();
 const empty = z.object({}).strict();
 const none = z.undefined();
 const operationReceipt = z.record(z.unknown());
-const credentialLeaseIds = z.array(z.string().min(1)).min(1).optional();
 const HOSTED_TOPOLOGY_OPERATIONS = {
   plan: defineOperation({
     operationId: "infrastructure.topology.plan",
@@ -22,7 +21,7 @@ const HOSTED_TOPOLOGY_OPERATIONS = {
     cacheScope: "none",
     pagination: "none",
     idempotencyRequired: false
-  }, { path: teamPath, query: empty, body: z.object({ declaration: hostedTopologyDeclarationSchema, credentialLeaseIds }).strict(), output: operationReceipt }),
+  }, { path: teamPath, query: empty, body: z.object({ declaration: hostedTopologyDeclarationSchema }).strict(), output: operationReceipt }),
   apply: defineOperation({
     operationId: "infrastructure.topology.apply",
     description: "Apply an exact agent-authorized hosted topology plan through the operations runner.",
@@ -38,7 +37,7 @@ const HOSTED_TOPOLOGY_OPERATIONS = {
     cacheScope: "none",
     pagination: "none",
     concurrencyRequired: true
-  }, { path: teamPath, query: empty, body: z.object({ plan: hostedTopologyPlanSchema, credentialLeaseIds }).strict(), output: operationReceipt }),
+  }, { path: teamPath, query: empty, body: z.object({ plan: hostedTopologyPlanSchema }).strict(), output: operationReceipt }),
   status: defineOperation({
     operationId: "infrastructure.topology.status",
     description: "Read the latest authoritative hosted topology receipt and operation state.",
@@ -72,8 +71,7 @@ const HOSTED_TOPOLOGY_OPERATIONS = {
   }, { path: teamPath, query: empty, body: z.object({
     execution: hostedTopologyRollbackExecutionSchema,
     sourcePlan: hostedTopologyPlanSchema,
-    targetPlan: hostedTopologyPlanSchema,
-    credentialLeaseIds
+    targetPlan: hostedTopologyPlanSchema
   }).strict(), output: operationReceipt })
 };
 export {

package/dist/operator-contracts/catalog/services/secret-commands.d.ts

@@ -0,0 +1,2 @@
+import type { CommandNodeDescriptor } from '../../command-tree.js';
+export declare const managedSecretCommands: CommandNodeDescriptor;

package/dist/operator-contracts/catalog/services/secret-commands.js

@@ -0,0 +1,31 @@
+const managedSecretCommands = {
+  nodeType: "branch",
+  segment: "services",
+  description: "Team service credentials.",
+  children: [{
+    nodeType: "branch",
+    segment: "credentials",
+    description: "Manage credentials in core OpenBao.",
+    children: ["show", "put", "delete", "validate"].map((name) => ({
+      nodeType: "leaf",
+      segment: name,
+      description: `${name} an exact service credential profile.`,
+      kind: name === "show" ? "read" : "mutation",
+      arguments: [{ name: "connection", description: "Service connection ID.", required: true }, { name: "profile", description: "Credential profile ID.", required: true }],
+      options: [
+        { name: "--team", description: "Authorized team ID.", type: "string" },
+        ...name === "show" ? [] : [
+          { name: "--plan", description: "Inspect the proposed operation without mutation or secret input.", type: "boolean" },
+          { name: "--expected-version", description: "Exact current credential version; zero for first creation.", type: "number", required: true }
+        ],
+        ...name === "put" ? [{ name: "--stdin", description: "Read the credential field object as JSON from standard input.", type: "boolean" }] : []
+      ],
+      authorization: { capability: name === "show" ? "secrets.read" : "secrets.write", confirmation: "never" },
+      resultSchemaId: `treeseed.services.credentials.${name}/v1`,
+      execution: { kind: "local", handlerId: `local.services.credentials.${name}` }
+    }))
+  }]
+};
+export {
+  managedSecretCommands
+};

package/dist/operator-contracts/catalog/services/secret-operations.d.ts

@@ -0,0 +1,62 @@
+export declare const SECRET_OPERATIONS: {
+    readonly credentialStatus: import("../../control-plane-operation.js").ControlPlaneOperationBinding<{
+        teamId: string;
+        profileId: string;
+        connectionId: string;
+    }, {}, {
+        expectedVersion: number;
+    } | undefined, {
+        version: number;
+        teamId: string;
+        profileId: string;
+        connectionId: string;
+        configured: boolean;
+        custody: "openbao";
+        fields: string[];
+    }>;
+    readonly putCredentials: import("../../control-plane-operation.js").ControlPlaneOperationBinding<{
+        teamId: string;
+        profileId: string;
+        connectionId: string;
+    }, {}, {
+        expectedVersion: number;
+    } | undefined, {
+        version: number;
+        teamId: string;
+        profileId: string;
+        connectionId: string;
+        configured: boolean;
+        custody: "openbao";
+        fields: string[];
+    }>;
+    readonly deleteCredentials: import("../../control-plane-operation.js").ControlPlaneOperationBinding<{
+        teamId: string;
+        profileId: string;
+        connectionId: string;
+    }, {}, {
+        expectedVersion: number;
+    } | undefined, {
+        version: number;
+        teamId: string;
+        profileId: string;
+        connectionId: string;
+        configured: boolean;
+        custody: "openbao";
+        fields: string[];
+    }>;
+    readonly validateCredentials: import("../../control-plane-operation.js").ControlPlaneOperationBinding<{
+        teamId: string;
+        profileId: string;
+        connectionId: string;
+    }, {}, {
+        expectedVersion: number;
+    } | undefined, {
+        version: number;
+        teamId: string;
+        profileId: string;
+        connectionId: string;
+        configured: boolean;
+        custody: "openbao";
+        fields: string[];
+    }>;
+};

package/dist/operator-contracts/catalog/services/secret-operations.js

@@ -0,0 +1,51 @@
+import { z } from "zod";
+import { defineOperation } from "../../operation-builder.js";
+const id = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u);
+const path = z.object({ teamId: id, connectionId: id, profileId: id }).strict();
+const version = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER - 1);
+const descriptor = z.object({
+  teamId: id,
+  connectionId: id,
+  profileId: id,
+  custody: z.literal("openbao"),
+  version,
+  configured: z.boolean(),
+  fields: z.array(id)
+}).strict();
+const put = z.object({
+  expectedVersion: version,
+  values: z.record(z.string().max(1024 * 1024)).refine((v) => Object.keys(v).length > 0 && Object.keys(v).length <= 128)
+}).strict();
+function operation(name, method) {
+  const read = method === "GET";
+  return defineOperation({
+    operationId: `services.credentials.${name}`,
+    description: `${name} managed service credentials.`,
+    rest: { method, path: `/v1/teams/{teamId}/services/{connectionId}/credentials/{profileId}${name === "validate" ? "/validate" : ""}` },
+    parameters: `treeseed.services.credentials.${name}.parameters/v1`,
+    capability: read ? "secrets.read" : "secrets.write",
+    authentication: "oauth",
+    oauthScopes: read ? ["treeseed:read"] : ["treeseed:projects:write"],
+    kind: read ? "read" : "mutation",
+    riskClass: read ? "ordinary" : "credential",
+    confirmation: read ? "never" : "input_required",
+    surfaces: ["rest"],
+    cacheScope: "none",
+    pagination: "none",
+    redactedPaths: ["body.values"]
+  }, {
+    path,
+    query: z.object({}).strict(),
+    body: read ? z.undefined() : name === "put" ? put : z.object({ expectedVersion: version }).strict(),
+    output: name === "validate" ? z.object({ ok: z.boolean() }).strict() : descriptor
+  });
+}
+const SECRET_OPERATIONS = {
+  credentialStatus: operation("show", "GET"),
+  putCredentials: operation("put", "PUT"),
+  deleteCredentials: operation("delete", "DELETE"),
+  validateCredentials: operation("validate", "POST")
+};
+export {
+  SECRET_OPERATIONS
+};

package/dist/operator-contracts/control-plane-operations.d.ts

@@ -62,7 +62,6 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                         connectionRef: string;
                     }>>;
                 };
-                credentialLeaseIds?: string[] | undefined;
             }, Record<string, unknown>>;
             readonly apply: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
                 teamId: string;
@@ -153,7 +152,6 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                     platformCommit: string;
                     authorization: "authenticated-agent";
                 };
-                credentialLeaseIds?: string[] | undefined;
             }, Record<string, unknown>>;
             readonly status: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
                 teamId: string;
@@ -400,7 +398,6 @@ export declare const CONTROL_PLANE_OPERATIONS: {
                     platformCommit: string;
                     authorization: "authenticated-agent";
                 };
-                credentialLeaseIds?: string[] | undefined;
             }, Record<string, unknown>>;
         };
     };
@@ -1397,26 +1394,66 @@ export declare const CONTROL_PLANE_OPERATIONS: {
             teamId: string;
             connectionId: string;
         }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-        readonly putAuthority: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+        readonly credentialStatus: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
             teamId: string;
             profileId: string;
             connectionId: string;
-        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
-        readonly userVaultKey: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly putUserVaultKey: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly teamVault: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly initializeTeamVault: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly resetTeamVault: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly rotateTeamVault: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly vaultGrantCandidates: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly createVaultGrant: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly deleteVaultGrant: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly vaultCredentialEnvelopes: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly credentialEnvelopes: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly putCredentialEnvelope: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly createOperationLease: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly operationLease: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-        readonly putOperationLeasePayload: import("./control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
+        }, {}, {
+            expectedVersion: number;
+        } | undefined, {
+            version: number;
+            teamId: string;
+            profileId: string;
+            connectionId: string;
+            configured: boolean;
+            custody: "openbao";
+            fields: string[];
+        }>;
+        readonly putCredentials: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+            teamId: string;
+            profileId: string;
+            connectionId: string;
+        }, {}, {
+            expectedVersion: number;
+        } | undefined, {
+            version: number;
+            teamId: string;
+            profileId: string;
+            connectionId: string;
+            configured: boolean;
+            custody: "openbao";
+            fields: string[];
+        }>;
+        readonly deleteCredentials: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+            teamId: string;
+            profileId: string;
+            connectionId: string;
+        }, {}, {
+            expectedVersion: number;
+        } | undefined, {
+            version: number;
+            teamId: string;
+            profileId: string;
+            connectionId: string;
+            configured: boolean;
+            custody: "openbao";
+            fields: string[];
+        }>;
+        readonly validateCredentials: import("./control-plane-operation.js").ControlPlaneOperationBinding<{
+            teamId: string;
+            profileId: string;
+            connectionId: string;
+        }, {}, {
+            expectedVersion: number;
+        } | undefined, {
+            version: number;
+            teamId: string;
+            profileId: string;
+            connectionId: string;
+            configured: boolean;
+            custody: "openbao";
+            fields: string[];
+        }>;
     };
     readonly agents: {
         readonly list: import("./control-plane-operation.js").ControlPlaneOperationBinding<{

package/dist/operator-contracts/control-plane-operations.js

@@ -8,7 +8,7 @@ import { capabilityOntologyOperations } from "./catalog/capability-ontology-oper
 import { knowledgeShareOperations } from "./catalog/knowledge-share-operations.js";
 import { PROVIDER_ENVIRONMENT_OPERATIONS } from "./catalog/provider-environment-operations.js";
 import { HOSTED_TOPOLOGY_OPERATIONS } from "./catalog/hosted-topology-operations.js";
-import { SERVICE_VAULT_OPERATIONS } from "./catalog/services/service-vault-operations.js";
+import { SECRET_OPERATIONS } from "./catalog/services/secret-operations.js";
 import { buildControlPlaneCatalog, flattenControlPlaneOperations } from "./catalog/control-plane-catalog.js";
 const empty = z.object({}).strict(), none = z.undefined(), record = z.record(z.unknown()), payload = record;
 function read(operationId, path, capability, surfaces = ["rest"]) {
@@ -278,15 +278,14 @@ const CONTROL_PLANE_OPERATIONS = {
     deleteWorkflowVariable: resource("repositories.workflow.variables.delete", "DELETE", "/v1/projects/{projectId}/workflow-configuration/variables/{name}", { projectId: z.string().min(1), name: z.string().min(1) }, { capability: "workflows.write", risk: "destructive", concurrency: true })
   },
   services: {
-    ...SERVICE_VAULT_OPERATIONS,
+    ...SECRET_OPERATIONS,
     providers: resource("services.providers.list", "GET", "/v1/service-providers", {}, { capability: "services.read", surfaces: ["rest", "cli", "mcp_tool"] }),
     connections: resource("services.connections.list", "GET", "/v1/teams/{teamId}/services", { teamId: z.string().min(1) }, { capability: "services.read", surfaces: ["rest", "cli", "mcp_tool"], pagination: "cursor" }),
     connection: resource("services.connections.show", "GET", "/v1/teams/{teamId}/services/{connectionId}", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "services.read", surfaces: ["rest", "cli", "mcp_resource"] }),
     createConnection: resource("services.connections.create", "POST", "/v1/teams/{teamId}/services", { teamId: z.string().min(1) }, { capability: "services.write", surfaces: ["rest", "cli", "mcp_tool"], risk: "credential" }),
     updateConnection: resource("services.connections.update", "PUT", "/v1/teams/{teamId}/services/{connectionId}", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "services.write", surfaces: ["rest", "cli", "mcp_tool"], concurrency: true }),
     disconnect: resource("services.connections.disconnect", "DELETE", "/v1/teams/{teamId}/services/{connectionId}", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "services.write", surfaces: ["rest", "cli", "mcp_tool"], risk: "destructive", concurrency: true }),
-    authorities: resource("services.credential.authorities.list", "GET", "/v1/teams/{teamId}/services/{connectionId}/credential-authorities", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "secrets.read", surfaces: ["rest", "cli"], pagination: "cursor" }),
-    putAuthority: resource("services.credential.authorities.put", "PUT", "/v1/teams/{teamId}/services/{connectionId}/credential-authorities/{profileId}", { teamId: z.string().min(1), connectionId: z.string().min(1), profileId: z.string().min(1) }, { capability: "secrets.write", surfaces: ["rest", "cli"], risk: "credential", concurrency: true, redactedPaths: ["body"] })
+    authorities: resource("services.credential.authorities.list", "GET", "/v1/teams/{teamId}/services/{connectionId}/credential-authorities", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "secrets.read", surfaces: ["rest", "cli"], pagination: "cursor" })
   },
   agents: {
     list: resource("agents.list", "GET", "/v1/projects/{projectId}/agents", { projectId: z.string().min(1) }, { capability: "agents.read", surfaces: ["rest", "cli", "mcp_tool"], pagination: "cursor" }),

package/dist/secrets-capability/github-actions-encryption.d.ts

@@ -0,0 +1,2 @@
+/** GitHub's upload protocol, not a TreeSeed custody implementation. */
+export declare function encryptGitHubActionsSecret(value: string, providerPublicKey: string): Promise<string>;

package/dist/secrets-capability/github-actions-encryption.js

@@ -0,0 +1,11 @@
+import sodium from "libsodium-wrappers-sumo";
+async function encryptGitHubActionsSecret(value, providerPublicKey) {
+  await sodium.ready;
+  if (!value) throw new Error("GitHub Actions secret value is required.");
+  const key = sodium.from_base64(providerPublicKey, sodium.base64_variants.ORIGINAL);
+  if (key.length !== sodium.crypto_box_PUBLICKEYBYTES) throw new Error("Invalid GitHub public key.");
+  return sodium.to_base64(sodium.crypto_box_seal(value, key), sodium.base64_variants.ORIGINAL);
+}
+export {
+  encryptGitHubActionsSecret
+};

package/dist/secrets-capability/provider-operation-contracts.d.ts

@@ -9,7 +9,7 @@ export type ProviderCredentialAuthority = {
     scheme: CredentialAuthorityScheme;
     reference: string;
     capabilities: ServiceCapabilityType[];
-    status: 'ready' | 'interactive-only' | 'reauthorization-required' | 'revoked';
+    status: 'ready' | 'reauthorization-required' | 'revoked';
     version: number;
 };
 export type ProjectRemoteRepositoryBinding = {

package/dist/secrets-capability/secret-contracts.d.ts

@@ -0,0 +1,33 @@
+import { z } from 'zod';
+export declare const secretScopeSchema: z.ZodObject<{
+    team: z.ZodString;
+    project: z.ZodString;
+    environment: z.ZodString;
+    purpose: z.ZodString;
+    name: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    project: string;
+    name: string;
+    team: string;
+    purpose: string;
+    environment: string;
+}, {
+    project: string;
+    name: string;
+    team: string;
+    purpose: string;
+    environment: string;
+}>;
+export type SecretScope = z.infer<typeof secretScopeSchema>;
+export declare const SECRET_CUSTODY_BACKENDS: readonly ["openbao", "os"];
+export declare function canonicalSecretPath(input: SecretScope): string;
+export type HostedSecretOperationBinding = {
+    subjectType: 'declaration' | 'plan' | 'rollback';
+    subjectDigest: string;
+    deploymentId: string;
+    stackId: string;
+    environment: 'staging' | 'production';
+};
+export declare function containsForbiddenPlaintextSecretMaterial(value: unknown, path?: string): string[];
+export declare function canonicalHostedSecretOperationBinding(input: HostedSecretOperationBinding): string;
+export declare function validateHostedSecretOperationBinding(value: unknown): value is HostedSecretOperationBinding;

package/dist/secrets-capability/secret-contracts.js

@@ -0,0 +1,49 @@
+import { z } from "zod";
+const segment = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u);
+const secretScopeSchema = z.object({
+  team: segment,
+  project: segment,
+  environment: segment,
+  purpose: segment,
+  name: segment
+}).strict();
+const SECRET_CUSTODY_BACKENDS = ["openbao", "os"];
+function canonicalSecretPath(input) {
+  const s = secretScopeSchema.parse(input);
+  return `teams/${s.team}/projects/${s.project}/environments/${s.environment}/purposes/${s.purpose}/secrets/${s.name}`;
+}
+const FORBIDDEN_SECRET_KEYS = /(?:passphrase|password|plaintext|derivedKey|privateKey|apiToken|accessToken|secretValue|credentialValue)$/iu;
+function containsForbiddenPlaintextSecretMaterial(value, path = "") {
+  if (!value || typeof value !== "object") return [];
+  const failures = [];
+  for (const [key, entry] of Object.entries(value)) {
+    const nextPath = path ? `${path}.${key}` : key;
+    if (FORBIDDEN_SECRET_KEYS.test(key) && typeof entry === "string" && entry.trim()) failures.push(nextPath);
+    if (entry && typeof entry === "object") failures.push(...containsForbiddenPlaintextSecretMaterial(entry, nextPath));
+  }
+  return failures;
+}
+const digest = /^sha256:[a-f0-9]{64}$/u;
+const identifier = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+function canonicalHostedSecretOperationBinding(input) {
+  return JSON.stringify({
+    subjectType: input.subjectType,
+    subjectDigest: input.subjectDigest,
+    deploymentId: input.deploymentId,
+    stackId: input.stackId,
+    environment: input.environment
+  });
+}
+function validateHostedSecretOperationBinding(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const binding = value;
+  return ["declaration", "plan", "rollback"].includes(String(binding.subjectType)) && digest.test(String(binding.subjectDigest)) && identifier.test(String(binding.deploymentId)) && identifier.test(String(binding.stackId)) && ["staging", "production"].includes(String(binding.environment));
+}
+export {
+  SECRET_CUSTODY_BACKENDS,
+  canonicalHostedSecretOperationBinding,
+  canonicalSecretPath,
+  containsForbiddenPlaintextSecretMaterial,
+  secretScopeSchema,
+  validateHostedSecretOperationBinding
+};

package/dist/secrets-capability/service-provider-contracts.d.ts

@@ -1,4 +1,4 @@
-export declare const SERVICE_PROVIDER_IDS: readonly ["github", "cloudflare", "railway", "openbao"];
+export declare const SERVICE_PROVIDER_IDS: readonly ["github", "cloudflare", "railway"];
 export declare const SERVICE_CAPABILITY_TYPES: readonly ["repository-hosting", "workflow-execution", "workflow-configuration", "secret-enclave", "frontend-hosting", "backend-hosting", "dns-management", "object-storage", "state-encryption", "database-hosting", "capacity-runtime-hosting", "private-knowledge-index-hosting", "artifact-hosting"];
 export declare const SERVICE_CONNECTION_STATUSES: readonly ["draft", "active", "degraded", "validation-failed", "reentry-required", "reauthorization-required", "disconnected"];
 export declare const SERVICE_CAPABILITY_STATUSES: readonly ["configured", "disabled", "blocked", "planned"];
@@ -27,7 +27,7 @@ export type CredentialProfileDefinition = {
     authoritySchemes?: CredentialAuthorityScheme[];
     knowledgePageIds: string[];
 };
-export declare const CREDENTIAL_AUTHORITY_SCHEMES: readonly ["app-installation", "api-token", "oauth-token", "environment-reference", "client-encrypted", "external-vault", "workload-identity"];
+export declare const CREDENTIAL_AUTHORITY_SCHEMES: readonly ["app-installation", "openbao"];
 export type CredentialAuthorityScheme = (typeof CREDENTIAL_AUTHORITY_SCHEMES)[number];
 export type ServiceCapabilityDefinition = {
     type: ServiceCapabilityType;

package/dist/secrets-capability/service-provider-contracts.js

@@ -1,4 +1,4 @@
-const SERVICE_PROVIDER_IDS = ["github", "cloudflare", "railway", "openbao"];
+const SERVICE_PROVIDER_IDS = ["github", "cloudflare", "railway"];
 const SERVICE_CAPABILITY_TYPES = [
   "repository-hosting",
   "workflow-execution",
@@ -26,12 +26,7 @@ const SERVICE_CONNECTION_STATUSES = [
 const SERVICE_CAPABILITY_STATUSES = ["configured", "disabled", "blocked", "planned"];
 const CREDENTIAL_AUTHORITY_SCHEMES = [
   "app-installation",
-  "api-token",
-  "oauth-token",
-  "environment-reference",
-  "client-encrypted",
-  "external-vault",
-  "workload-identity"
+  "openbao"
 ];
 const field = (key, label, description, required = true, sensitive = false) => ({
   key,
@@ -76,11 +71,11 @@ const SERVICE_PROVIDER_CATALOG = [
         label: "Repository token authority",
         description: "Fine-grained token authority restricted to selected repositories and Contents access.",
         capabilities: ["repository-hosting"],
-        fields: [field("accessToken", "Fine-grained token", "Encrypted before leaving this browser.", true, true)],
+        fields: [field("accessToken", "Fine-grained token", "Stored in core OpenBao; used only by authorized operations.", true, true)],
         permissions: ["Metadata: read", "Contents: read and write"],
         sharing: "capability-scoped",
-        unattendedCompatible: false,
-        authoritySchemes: ["api-token", "environment-reference", "client-encrypted", "external-vault"],
+        unattendedCompatible: true,
+        authoritySchemes: ["openbao"],
         knowledgePageIds: ["provider.github", "services.credentials", "vault.rotation"]
       },
       {
@@ -100,11 +95,11 @@ const SERVICE_PROVIDER_CATALOG = [
         label: "Workflow token authority",
         description: "Fine-grained token authority for Actions and explicitly enabled secret or variable scopes.",
         capabilities: ["workflow-execution", "workflow-configuration", "secret-enclave"],
-        fields: [field("accessToken", "Fine-grained token", "Encrypted before leaving this browser.", true, true)],
+        fields: [field("accessToken", "Fine-grained token", "Stored in core OpenBao; used only by authorized operations.", true, true)],
         permissions: ["Metadata: read", "Contents: read", "Actions: read and write", "Secrets: read and write", "Variables: read and write"],
         sharing: "capability-scoped",
-        unattendedCompatible: false,
-        authoritySchemes: ["api-token", "environment-reference", "client-encrypted", "external-vault"],
+        unattendedCompatible: true,
+        authoritySchemes: ["openbao"],
         knowledgePageIds: ["provider.github", "services.credentials", "vault.rotation"]
       }
     ]
@@ -132,11 +127,11 @@ const SERVICE_PROVIDER_CATALOG = [
       { type: "state-encryption", label: "State encryption", description: "Independent encryption authority for OpenTofu state and plan files.", credentialProfileIds: ["opentofu-state-encryption"], status: "available" }
     ],
     credentialProfiles: [
-      { id: "cloudflare-runtime", label: "Pages and Workers token", description: "A token limited to application deployment resources.", capabilities: ["frontend-hosting"], fields: [field("apiToken", "API token", "Encrypted in this browser and used only for authorized frontend operations.", true, true)], permissions: ["Account: Workers Scripts Edit", "Account: Pages Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
-      { id: "cloudflare-dns", label: "DNS token", description: "A token restricted to selected zones.", capabilities: ["dns-management"], fields: [field("apiToken", "DNS API token", "Encrypted separately from deployment authority.", true, true)], permissions: ["Zone: DNS Edit for only the managed zones"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
-      { id: "cloudflare-storage", label: "Storage management authority", description: "Vault-custodied token used only to reconcile authorized R2 resources.", capabilities: ["object-storage"], fields: [field("apiToken", "Storage API token", "Encrypted separately and used only to reconcile authorized R2 resources.", true, true)], permissions: ["Account: Workers R2 Storage Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
-      { id: "s3-state-session", label: "OpenTofu state session", description: "S3-compatible credentials limited to the selected team state prefix.", capabilities: ["object-storage"], fields: [field("accessKeyId", "R2 access key ID", "Vault-custodied S3-compatible access key identifier for encrypted OpenTofu state.", true, true), field("secretAccessKey", "R2 secret access key", "Vault-custodied S3-compatible secret key for encrypted OpenTofu state.", true, true), field("sessionToken", "R2 session token", "Optional short-lived S3-compatible session token.", false, true)], permissions: ["Object read and write for only the managed team state prefix"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
-      { id: "opentofu-state-encryption", label: "OpenTofu state encryption", description: "Independent encryption material that is never stored with the R2 state object.", capabilities: ["state-encryption"], fields: [field("stateEncryptionKey", "OpenTofu state encryption key", "Generated in the browser as a 32-byte hexadecimal key and encrypted separately.", true, true)], permissions: ["Encrypt and decrypt only the selected team OpenTofu state"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] }
+      { id: "cloudflare-runtime", label: "Pages and Workers token", description: "A token limited to application deployment resources.", capabilities: ["frontend-hosting"], fields: [field("apiToken", "API token", "Stored in core OpenBao and used only by authorized operations.", true, true)], permissions: ["Account: Workers Scripts Edit", "Account: Pages Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["openbao"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
+      { id: "cloudflare-dns", label: "DNS token", description: "A token restricted to selected zones.", capabilities: ["dns-management"], fields: [field("apiToken", "DNS API token", "Encrypted separately from deployment authority.", true, true)], permissions: ["Zone: DNS Edit for only the managed zones"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["openbao"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
+      { id: "cloudflare-storage", label: "Storage management authority", description: "Vault-custodied token used only to reconcile authorized R2 resources.", capabilities: ["object-storage"], fields: [field("apiToken", "Storage API token", "Encrypted separately and used only to reconcile authorized R2 resources.", true, true)], permissions: ["Account: Workers R2 Storage Edit"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["openbao"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
+      { id: "s3-state-session", label: "OpenTofu state session", description: "S3-compatible credentials limited to the selected team state prefix.", capabilities: ["object-storage"], fields: [field("accessKeyId", "R2 access key ID", "Vault-custodied S3-compatible access key identifier for encrypted OpenTofu state.", true, true), field("secretAccessKey", "R2 secret access key", "Vault-custodied S3-compatible secret key for encrypted OpenTofu state.", true, true), field("sessionToken", "R2 session token", "Optional short-lived S3-compatible session token.", false, true)], permissions: ["Object read and write for only the managed team state prefix"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["openbao"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] },
+      { id: "opentofu-state-encryption", label: "OpenTofu state encryption", description: "Independent encryption material that is never stored with the R2 state object.", capabilities: ["state-encryption"], fields: [field("stateEncryptionKey", "OpenTofu state encryption key", "A 32-byte hexadecimal key stored separately in core OpenBao.", true, true)], permissions: ["Encrypt and decrypt only the selected team OpenTofu state"], sharing: "capability-scoped", unattendedCompatible: true, authoritySchemes: ["openbao"], knowledgePageIds: ["provider.cloudflare", "services.credentials", "vault.rotation"] }
     ]
   },
   {
@@ -163,24 +158,13 @@ const SERVICE_PROVIDER_CATALOG = [
       label: "Railway workspace token",
       description: "Railway currently exposes broad workspace authority. Sharing it increases the blast radius across enabled capabilities.",
       capabilities: ["backend-hosting", "database-hosting", "capacity-runtime-hosting", "private-knowledge-index-hosting"],
-      fields: [field("apiToken", "Workspace token", "Encrypted in this browser. TreeSeed will request explicit authorization before interactive use.", true, true)],
+      fields: [field("apiToken", "Workspace token", "Stored in core OpenBao and used only by authorized operations.", true, true)],
       permissions: ["Workspace access required by the selected operations"],
       sharing: "provider-shared",
       unattendedCompatible: true,
-      authoritySchemes: ["environment-reference", "client-encrypted", "external-vault", "workload-identity"],
+      authoritySchemes: ["openbao"],
       knowledgePageIds: ["provider.railway", "services.credentials", "vault.rotation"]
     }]
-  },
-  {
-    id: "openbao",
-    label: "OpenBao / HashiCorp Vault",
-    logoKey: "vault",
-    documentationUrl: "https://openbao.org/docs/auth/jwt/",
-    description: "Reference an external vault through workload identity; no long-lived vault token is stored.",
-    knowledgePageIds: ["provider.openbao", "services.external-vault"],
-    connectionFields: [field("address", "Vault address", "The HTTPS endpoint for the vault."), field("mount", "Secrets mount", "The mount containing TreeSeed-managed references."), field("role", "Workload identity role", "The OIDC/JWT role used by the operations runner.")],
-    capabilities: [{ type: "secret-enclave", label: "External secret vault", description: "Resolve approved secret references through workload identity.", credentialProfileIds: [], status: "available" }],
-    credentialProfiles: []
   }
 ];
 function getServiceProviderDefinition(providerId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.86",
+  "version": "0.13.0-rc.88",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {

package/dist/operator-contracts/catalog/services/service-vault-operations.d.ts

@@ -1,17 +0,0 @@
-export declare const SERVICE_VAULT_OPERATIONS: {
-    readonly userVaultKey: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly putUserVaultKey: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly teamVault: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly initializeTeamVault: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly resetTeamVault: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly rotateTeamVault: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly vaultGrantCandidates: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly createVaultGrant: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly deleteVaultGrant: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly vaultCredentialEnvelopes: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly credentialEnvelopes: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly putCredentialEnvelope: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly createOperationLease: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly operationLease: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-    readonly putOperationLeasePayload: import("../../control-plane-operation.js").ControlPlaneOperationBinding<any, {}, any, any>;
-};

package/dist/operator-contracts/catalog/services/service-vault-operations.js

@@ -1,158 +0,0 @@
-import { z } from "zod";
-import { defineOperation } from "../../operation-builder.js";
-const empty = z.object({}).strict();
-const none = z.undefined();
-const record = z.record(z.unknown());
-const teamPath = z.object({ teamId: z.string().min(1) }).strict();
-function vaultOperation(operationId, method, path, pathSchema, options = {}) {
-  const read = method === "GET", risk = options.risk ?? "ordinary";
-  return defineOperation({
-    operationId,
-    description: `${read ? "Read" : "Apply"} ${operationId}.`,
-    rest: { method, path },
-    capability: read ? "secrets.read" : "secrets.write",
-    ...path.includes("{") ? { parameters: `treeseed.${operationId}.parameters/v1` } : {},
-    authentication: "oauth",
-    oauthScopes: read ? ["treeseed:read"] : ["treeseed:projects:write"],
-    kind: read ? "read" : "mutation",
-    riskClass: risk,
-    confirmation: risk === "ordinary" ? "never" : "input_required",
-    surfaces: ["rest"],
-    cacheScope: read ? "principal" : "none",
-    pagination: "none",
-    redactedPaths: options.redactedPaths
-  }, { path: pathSchema, query: read ? record : empty, body: read ? none : options.body ?? record, output: options.output ?? record });
-}
-const nullableRecord = record.nullable(), records = z.array(record);
-const encryptedPrivateKeyEnvelope = z.object({
-  version: z.literal("service-vault-v1"),
-  algorithm: z.literal("xchacha20-poly1305-ietf"),
-  kdf: z.object({ algorithm: z.literal("argon2id"), opsLimit: z.number().int().positive(), memLimit: z.number().int().positive(), salt: z.string().min(1) }).strict(),
-  nonce: z.string().min(1),
-  ciphertext: z.string().min(1),
-  publicKey: z.string().min(1)
-}).strict();
-const encryptedCredentialEnvelope = z.object({
-  version: z.literal("service-vault-v1"),
-  algorithm: z.literal("xchacha20-poly1305-ietf"),
-  ciphertext: z.string().min(1),
-  nonce: z.string().min(1),
-  wrappedKey: z.string().min(1),
-  wrappedKeyNonce: z.string().min(1),
-  associatedData: z.string().min(1),
-  associatedDataDigest: z.string().min(1),
-  fingerprint: z.string().min(1)
-}).strict();
-const SERVICE_VAULT_OPERATIONS = {
-  userVaultKey: vaultOperation("services.vault.user.key.show", "GET", "/v1/users/me/vault-key", empty, { output: nullableRecord }),
-  putUserVaultKey: vaultOperation(
-    "services.vault.user.key.put",
-    "PUT",
-    "/v1/users/me/vault-key",
-    empty,
-    { risk: "credential", redactedPaths: ["body.encryptedPrivateKeyEnvelope"], body: z.object({ publicKey: z.string().min(1), encryptedPrivateKeyEnvelope }).strict() }
-  ),
-  teamVault: vaultOperation("services.vault.team.show", "GET", "/v1/teams/{teamId}/vault", teamPath, { output: nullableRecord }),
-  initializeTeamVault: vaultOperation(
-    "services.vault.team.initialize",
-    "POST",
-    "/v1/teams/{teamId}/vault",
-    teamPath,
-    { risk: "credential", redactedPaths: ["body.wrappedTeamVaultKey"], body: z.object({ userVaultKeyId: z.string().min(1), wrappedTeamVaultKey: z.string().min(1), encryptionVersion: z.literal("service-vault-v1") }).strict() }
-  ),
-  resetTeamVault: vaultOperation(
-    "services.vault.team.reset",
-    "POST",
-    "/v1/teams/{teamId}/vault/reset",
-    teamPath,
-    { risk: "destructive", redactedPaths: ["body.wrappedTeamVaultKey", "body.currentPassword"], body: z.object({ userVaultKeyId: z.string().min(1), wrappedTeamVaultKey: z.string().min(1), encryptionVersion: z.literal("service-vault-v1"), confirmation: z.string().min(1), currentPassword: z.string().min(1) }).strict() }
-  ),
-  rotateTeamVault: vaultOperation(
-    "services.vault.team.rotate",
-    "POST",
-    "/v1/teams/{teamId}/vault/rotate",
-    teamPath,
-    { risk: "credential", redactedPaths: ["body.envelopes", "body.grants"], body: z.object({
-      expectedKeyVersion: z.number().int().positive(),
-      envelopes: z.array(z.object({ id: z.string().min(1), envelope: encryptedCredentialEnvelope }).strict()),
-      grants: z.array(z.object({ userId: z.string().min(1), userVaultKeyId: z.string().min(1), wrappedTeamVaultKey: z.string().min(1) }).strict()).min(1)
-    }).strict() }
-  ),
-  vaultGrantCandidates: vaultOperation("services.vault.grant.candidates.list", "GET", "/v1/teams/{teamId}/vault/grant-candidates", teamPath, { output: records }),
-  createVaultGrant: vaultOperation(
-    "services.vault.grants.create",
-    "POST",
-    "/v1/teams/{teamId}/vault/grants",
-    teamPath,
-    { risk: "credential", redactedPaths: ["body.wrappedTeamVaultKey"], body: z.object({ userId: z.string().min(1), userVaultKeyId: z.string().min(1), wrappedTeamVaultKey: z.string().min(1) }).strict() }
-  ),
-  deleteVaultGrant: vaultOperation(
-    "services.vault.grants.delete",
-    "DELETE",
-    "/v1/teams/{teamId}/vault/grants/{grantId}",
-    z.object({ teamId: z.string().min(1), grantId: z.string().min(1) }).strict(),
-    { risk: "destructive" }
-  ),
-  vaultCredentialEnvelopes: vaultOperation(
-    "services.vault.credential.envelopes.list",
-    "GET",
-    "/v1/teams/{teamId}/vault/credential-envelopes",
-    teamPath,
-    { output: records }
-  ),
-  credentialEnvelopes: vaultOperation(
-    "services.credential.envelopes.list",
-    "GET",
-    "/v1/teams/{teamId}/services/{connectionId}/credential-envelopes",
-    z.object({ teamId: z.string().min(1), connectionId: z.string().min(1) }).strict(),
-    { output: records }
-  ),
-  putCredentialEnvelope: vaultOperation(
-    "services.credential.envelopes.put",
-    "POST",
-    "/v1/teams/{teamId}/services/{connectionId}/credential-envelopes",
-    z.object({ teamId: z.string().min(1), connectionId: z.string().min(1) }).strict(),
-    { risk: "credential", redactedPaths: ["body.envelope"], body: z.object({ definitionId: z.string().min(1), fieldKey: z.string().min(1), keyVersion: z.number().int().positive(), envelope: encryptedCredentialEnvelope }).strict() }
-  ),
-  createOperationLease: vaultOperation(
-    "services.operation.leases.create",
-    "POST",
-    "/v1/teams/{teamId}/service-operation-leases",
-    teamPath,
-    { risk: "authority", body: z.object({
-      connectionId: z.string().min(1),
-      capabilityType: z.string().min(1),
-      credentialProfileId: z.string().min(1),
-      purpose: z.enum([
-        "provider-connection-validation",
-        "remote-git-publication",
-        "workflow-dispatch",
-        "workflow-configuration",
-        "hosted-topology-plan",
-        "hosted-topology-apply",
-        "hosted-topology-readback",
-        "hosted-topology-rollback"
-      ]),
-      idempotencyKey: z.string().min(1).optional(),
-      resourceScope: record.optional(),
-      hostedBinding: record.optional(),
-      authorityRequests: z.array(record).optional()
-    }).strict() }
-  ),
-  operationLease: vaultOperation(
-    "services.operation.leases.show",
-    "GET",
-    "/v1/teams/{teamId}/service-operation-leases/{leaseId}",
-    z.object({ teamId: z.string().min(1), leaseId: z.string().min(1) }).strict()
-  ),
-  putOperationLeasePayload: vaultOperation(
-    "services.operation.leases.payload.put",
-    "PUT",
-    "/v1/teams/{teamId}/service-operation-leases/{leaseId}/payload",
-    z.object({ teamId: z.string().min(1), leaseId: z.string().min(1) }).strict(),
-    { risk: "credential", redactedPaths: ["body.sealedPayload"], body: z.object({ sealedPayload: z.string().min(1) }).strict() }
-  )
-};
-export {
-  SERVICE_VAULT_OPERATIONS
-};

package/dist/secrets-capability/service-vault-contracts.d.ts

@@ -1,108 +0,0 @@
-export declare const SERVICE_VAULT_ENCRYPTION_VERSION: "service-vault-v1";
-export declare const SERVICE_VAULT_AEAD_ALGORITHM: "xchacha20-poly1305-ietf";
-export declare const SERVICE_VAULT_KEY_AGREEMENT: "x25519-sealed-box";
-export declare const SERVICE_VAULT_KDF: "argon2id";
-export declare const SECRET_OPERATION_PURPOSES: readonly ["provider-connection-validation", "remote-git-publication", "workflow-dispatch", "workflow-configuration", "hosted-topology-plan", "hosted-topology-apply", "hosted-topology-readback", "hosted-topology-rollback"];
-export type SecretOperationPurpose = (typeof SECRET_OPERATION_PURPOSES)[number];
-export type HostedSecretOperationPurpose = Extract<SecretOperationPurpose, `hosted-topology-${string}`>;
-export type EncryptedCredentialEnvelope = {
-    version: typeof SERVICE_VAULT_ENCRYPTION_VERSION;
-    algorithm: typeof SERVICE_VAULT_AEAD_ALGORITHM;
-    ciphertext: string;
-    nonce: string;
-    wrappedKey: string;
-    wrappedKeyNonce: string;
-    associatedData: string;
-    associatedDataDigest: string;
-    fingerprint: string;
-};
-export type EncryptedPrivateKeyEnvelope = {
-    version: typeof SERVICE_VAULT_ENCRYPTION_VERSION;
-    algorithm: typeof SERVICE_VAULT_AEAD_ALGORITHM;
-    kdf: {
-        algorithm: typeof SERVICE_VAULT_KDF;
-        opsLimit: number;
-        memLimit: number;
-        salt: string;
-    };
-    nonce: string;
-    ciphertext: string;
-    publicKey: string;
-};
-export type TeamVaultGrantEnvelope = {
-    version: typeof SERVICE_VAULT_ENCRYPTION_VERSION;
-    algorithm: typeof SERVICE_VAULT_KEY_AGREEMENT;
-    recipientPublicKey: string;
-    wrappedTeamVaultKey: string;
-};
-export type SecretOperationLease = {
-    id: string;
-    teamId: string;
-    connectionId: string;
-    capabilityType: string;
-    purpose: SecretOperationPurpose;
-    resourceScope: Record<string, string>;
-    credentialProfileId: string;
-    actorUserId: string;
-    requiredFields: string[];
-    publicKey: string;
-    status: 'awaiting-runner' | 'pending' | 'ready' | 'consumed' | 'expired' | 'cancelled' | 'failed';
-    expiresAt: string;
-    consumedAt?: string | null;
-    operationCorrelationId: string;
-    hostedBinding?: HostedSecretOperationBinding;
-    authorityRequests?: SecretOperationAuthorityRequest[];
-};
-export type HostedSecretOperationBinding = {
-    subjectType: 'declaration' | 'plan' | 'rollback';
-    subjectDigest: string;
-    deploymentId: string;
-    stackId: string;
-    environment: 'staging' | 'production';
-};
-export type SecretOperationAuthorityRequest = {
-    requestId: string;
-    connectionId: string;
-    credentialProfileId: string;
-    provider: 'cloudflare' | 'railway' | 'treeseed';
-    purpose: 'provider' | 'state-backend' | 'state-encryption';
-    capabilities: string[];
-    requiredFields: string[];
-    secretRef?: string;
-};
-export type SealedSecretOperationPayload = {
-    schemaVersion: 'treeseed.sealed-secret-operation-payload/v1';
-    leaseId: string;
-    teamId: string;
-    operationCorrelationId: string;
-    hostedBinding: HostedSecretOperationBinding;
-    algorithm: typeof SERVICE_VAULT_KEY_AGREEMENT;
-    ciphertext: string;
-};
-export type SecretOperationCredentialBundle = {
-    schemaVersion: 'treeseed.secret-operation-credential-bundle/v1';
-    leaseId: string;
-    teamId: string;
-    operationCorrelationId: string;
-    hostedBinding: HostedSecretOperationBinding;
-    materials: Array<{
-        requestId: string;
-        connectionId: string;
-        credentialProfileId: string;
-        values: Record<string, string>;
-    }>;
-};
-export type ServiceVaultAssociatedData = {
-    teamId: string;
-    connectionId: string;
-    credentialProfileId: string;
-    field: string;
-    purpose: string;
-    version: number;
-};
-export declare function containsForbiddenPlaintextSecretMaterial(value: unknown, path?: string): string[];
-export declare function canonicalServiceVaultAssociatedData(input: ServiceVaultAssociatedData): string;
-export declare function canonicalHostedSecretOperationBinding(input: HostedSecretOperationBinding): string;
-export declare function validateHostedSecretOperationBinding(value: unknown): value is HostedSecretOperationBinding;
-export declare function validateSealedSecretOperationPayload(value: unknown): value is SealedSecretOperationPayload;
-export declare function validateEncryptedCredentialEnvelope(value: unknown): value is EncryptedCredentialEnvelope;

package/dist/secrets-capability/service-vault-contracts.js

@@ -1,74 +0,0 @@
-const SERVICE_VAULT_ENCRYPTION_VERSION = "service-vault-v1";
-const SERVICE_VAULT_AEAD_ALGORITHM = "xchacha20-poly1305-ietf";
-const SERVICE_VAULT_KEY_AGREEMENT = "x25519-sealed-box";
-const SERVICE_VAULT_KDF = "argon2id";
-const SECRET_OPERATION_PURPOSES = [
-  "provider-connection-validation",
-  "remote-git-publication",
-  "workflow-dispatch",
-  "workflow-configuration",
-  "hosted-topology-plan",
-  "hosted-topology-apply",
-  "hosted-topology-readback",
-  "hosted-topology-rollback"
-];
-const FORBIDDEN_SECRET_KEYS = /(?:passphrase|password|plaintext|derivedKey|privateKey|apiToken|accessToken|secretValue|credentialValue)$/iu;
-function containsForbiddenPlaintextSecretMaterial(value, path = "") {
-  if (!value || typeof value !== "object") return [];
-  const failures = [];
-  for (const [key, entry] of Object.entries(value)) {
-    const nextPath = path ? `${path}.${key}` : key;
-    if (FORBIDDEN_SECRET_KEYS.test(key) && typeof entry === "string" && entry.trim()) failures.push(nextPath);
-    if (entry && typeof entry === "object") failures.push(...containsForbiddenPlaintextSecretMaterial(entry, nextPath));
-  }
-  return failures;
-}
-function canonicalServiceVaultAssociatedData(input) {
-  return JSON.stringify({
-    teamId: input.teamId,
-    connectionId: input.connectionId,
-    credentialProfileId: input.credentialProfileId,
-    field: input.field,
-    purpose: input.purpose,
-    version: input.version
-  });
-}
-const digest = /^sha256:[a-f0-9]{64}$/u;
-const identifier = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
-function canonicalHostedSecretOperationBinding(input) {
-  return JSON.stringify({
-    subjectType: input.subjectType,
-    subjectDigest: input.subjectDigest,
-    deploymentId: input.deploymentId,
-    stackId: input.stackId,
-    environment: input.environment
-  });
-}
-function validateHostedSecretOperationBinding(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const binding = value;
-  return ["declaration", "plan", "rollback"].includes(String(binding.subjectType)) && digest.test(String(binding.subjectDigest)) && identifier.test(String(binding.deploymentId)) && identifier.test(String(binding.stackId)) && ["staging", "production"].includes(String(binding.environment));
-}
-function validateSealedSecretOperationPayload(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const payload = value;
-  return payload.schemaVersion === "treeseed.sealed-secret-operation-payload/v1" && payload.algorithm === SERVICE_VAULT_KEY_AGREEMENT && [payload.leaseId, payload.teamId, payload.operationCorrelationId, payload.ciphertext].every((field) => typeof field === "string" && field.length > 0) && validateHostedSecretOperationBinding(payload.hostedBinding);
-}
-function validateEncryptedCredentialEnvelope(value) {
-  if (!value || typeof value !== "object") return false;
-  const envelope = value;
-  return envelope.version === SERVICE_VAULT_ENCRYPTION_VERSION && envelope.algorithm === SERVICE_VAULT_AEAD_ALGORITHM && [envelope.ciphertext, envelope.nonce, envelope.wrappedKey, envelope.wrappedKeyNonce, envelope.associatedData, envelope.associatedDataDigest, envelope.fingerprint].every((field) => typeof field === "string" && field.length > 0);
-}
-export {
-  SECRET_OPERATION_PURPOSES,
-  SERVICE_VAULT_AEAD_ALGORITHM,
-  SERVICE_VAULT_ENCRYPTION_VERSION,
-  SERVICE_VAULT_KDF,
-  SERVICE_VAULT_KEY_AGREEMENT,
-  canonicalHostedSecretOperationBinding,
-  canonicalServiceVaultAssociatedData,
-  containsForbiddenPlaintextSecretMaterial,
-  validateEncryptedCredentialEnvelope,
-  validateHostedSecretOperationBinding,
-  validateSealedSecretOperationPayload
-};

package/dist/secrets-capability/service-vault-crypto.d.ts

@@ -1,20 +0,0 @@
-import { type EncryptedCredentialEnvelope, type EncryptedPrivateKeyEnvelope, type TeamVaultGrantEnvelope } from '@treeseed/sdk/secrets-capability';
-export declare function createServiceVaultKey(): Promise<Uint8Array>;
-export declare function createServiceVaultUserKeyPair(): Promise<{
-    publicKey: string;
-    privateKey: Uint8Array;
-}>;
-export declare function encryptServiceVaultPrivateKey(privateKey: Uint8Array, publicKey: string, passphrase: string, options?: {
-    opsLimit?: number;
-    memLimit?: number;
-}): Promise<EncryptedPrivateKeyEnvelope>;
-export declare function decryptServiceVaultPrivateKey(envelope: EncryptedPrivateKeyEnvelope, passphrase: string): Promise<Uint8Array>;
-export declare function createTeamVaultGrant(teamVaultKey: Uint8Array, recipientPublicKey: string): Promise<TeamVaultGrantEnvelope>;
-export declare function openTeamVaultGrant(grant: TeamVaultGrantEnvelope, recipientPrivateKey: Uint8Array): Promise<Uint8Array>;
-export declare function encryptServiceCredential(plaintext: string, teamVaultKey: Uint8Array, associatedData: string): Promise<EncryptedCredentialEnvelope>;
-export declare function decryptServiceCredential(envelope: EncryptedCredentialEnvelope, teamVaultKey: Uint8Array, expectedAssociatedData: string): Promise<string>;
-export declare function rewrapServiceCredential(envelope: EncryptedCredentialEnvelope, currentTeamVaultKey: Uint8Array, replacementTeamVaultKey: Uint8Array): Promise<EncryptedCredentialEnvelope>;
-export declare function sealSecretOperationPayload(values: Record<string, string>, operationPublicKey: string): Promise<string>;
-export declare function encryptGitHubActionsSecret(value: string, providerPublicKey: string): Promise<string>;
-export declare function openSecretOperationPayload(sealedPayload: string, operationPublicKey: string, operationPrivateKey: Uint8Array): Promise<Record<string, string>>;
-export declare function clearServiceVaultKey(value: Uint8Array | undefined): void;

package/dist/secrets-capability/service-vault-crypto.js

@@ -1,210 +0,0 @@
-import sodium from "libsodium-wrappers-sumo";
-import {
-  SERVICE_VAULT_AEAD_ALGORITHM,
-  SERVICE_VAULT_ENCRYPTION_VERSION,
-  SERVICE_VAULT_KDF,
-  SERVICE_VAULT_KEY_AGREEMENT
-} from "@treeseed/sdk/secrets-capability";
-const b64 = () => sodium.base64_variants.ORIGINAL;
-const encode = (value) => sodium.to_base64(value, b64());
-const decode = (value) => sodium.from_base64(value, b64());
-const hash = (value, key = null) => encode(sodium.crypto_generichash(32, value, key));
-async function ready() {
-  await sodium.ready;
-  return sodium;
-}
-function validKey(value, length, label) {
-  if (!(value instanceof Uint8Array) || value.length !== length) throw new Error(`${label} is invalid.`);
-  return value;
-}
-async function createServiceVaultKey() {
-  const crypto = await ready();
-  return crypto.randombytes_buf(crypto.crypto_aead_xchacha20poly1305_ietf_KEYBYTES);
-}
-async function createServiceVaultUserKeyPair() {
-  const crypto = await ready(), pair = crypto.crypto_box_keypair();
-  return { publicKey: encode(pair.publicKey), privateKey: pair.privateKey };
-}
-async function encryptServiceVaultPrivateKey(privateKey, publicKey, passphrase, options = {}) {
-  const crypto = await ready();
-  validKey(privateKey, crypto.crypto_box_SECRETKEYBYTES, "Service-vault private key");
-  validKey(decode(publicKey), crypto.crypto_box_PUBLICKEYBYTES, "Service-vault public key");
-  if (passphrase.length < 12) throw new Error("Service-vault passphrase must contain at least 12 characters.");
-  const salt = crypto.randombytes_buf(crypto.crypto_pwhash_SALTBYTES);
-  const opsLimit = options.opsLimit ?? crypto.crypto_pwhash_OPSLIMIT_MODERATE;
-  const memLimit = options.memLimit ?? crypto.crypto_pwhash_MEMLIMIT_MODERATE;
-  const key = crypto.crypto_pwhash(
-    crypto.crypto_aead_xchacha20poly1305_ietf_KEYBYTES,
-    passphrase,
-    salt,
-    opsLimit,
-    memLimit,
-    crypto.crypto_pwhash_ALG_ARGON2ID13
-  );
-  const nonce = crypto.randombytes_buf(crypto.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
-  try {
-    return {
-      version: SERVICE_VAULT_ENCRYPTION_VERSION,
-      algorithm: SERVICE_VAULT_AEAD_ALGORITHM,
-      kdf: { algorithm: SERVICE_VAULT_KDF, opsLimit, memLimit, salt: encode(salt) },
-      nonce: encode(nonce),
-      ciphertext: encode(crypto.crypto_aead_xchacha20poly1305_ietf_encrypt(privateKey, publicKey, null, nonce, key)),
-      publicKey
-    };
-  } finally {
-    crypto.memzero(key);
-  }
-}
-async function decryptServiceVaultPrivateKey(envelope, passphrase) {
-  const crypto = await ready();
-  if (envelope.version !== SERVICE_VAULT_ENCRYPTION_VERSION || envelope.algorithm !== SERVICE_VAULT_AEAD_ALGORITHM || envelope.kdf.algorithm !== SERVICE_VAULT_KDF) throw new Error("Service-vault private-key envelope is unsupported.");
-  if (!Number.isSafeInteger(envelope.kdf.opsLimit) || !Number.isSafeInteger(envelope.kdf.memLimit) || envelope.kdf.opsLimit < crypto.crypto_pwhash_OPSLIMIT_INTERACTIVE || envelope.kdf.opsLimit > crypto.crypto_pwhash_OPSLIMIT_SENSITIVE || envelope.kdf.memLimit < crypto.crypto_pwhash_MEMLIMIT_INTERACTIVE || envelope.kdf.memLimit > crypto.crypto_pwhash_MEMLIMIT_SENSITIVE)
-    throw new Error("Service-vault private-key KDF parameters are invalid.");
-  const key = crypto.crypto_pwhash(
-    crypto.crypto_aead_xchacha20poly1305_ietf_KEYBYTES,
-    passphrase,
-    decode(envelope.kdf.salt),
-    envelope.kdf.opsLimit,
-    envelope.kdf.memLimit,
-    crypto.crypto_pwhash_ALG_ARGON2ID13
-  );
-  try {
-    return validKey(crypto.crypto_aead_xchacha20poly1305_ietf_decrypt(
-      null,
-      decode(envelope.ciphertext),
-      envelope.publicKey,
-      decode(envelope.nonce),
-      key
-    ), crypto.crypto_box_SECRETKEYBYTES, "Decrypted service-vault private key");
-  } catch {
-    throw new Error("Service-vault passphrase or private-key envelope is invalid.");
-  } finally {
-    crypto.memzero(key);
-  }
-}
-async function createTeamVaultGrant(teamVaultKey, recipientPublicKey) {
-  const crypto = await ready();
-  validKey(teamVaultKey, crypto.crypto_aead_xchacha20poly1305_ietf_KEYBYTES, "Team vault key");
-  const publicKey = validKey(decode(recipientPublicKey), crypto.crypto_box_PUBLICKEYBYTES, "Recipient public key");
-  return {
-    version: SERVICE_VAULT_ENCRYPTION_VERSION,
-    algorithm: SERVICE_VAULT_KEY_AGREEMENT,
-    recipientPublicKey,
-    wrappedTeamVaultKey: encode(crypto.crypto_box_seal(teamVaultKey, publicKey))
-  };
-}
-async function openTeamVaultGrant(grant, recipientPrivateKey) {
-  const crypto = await ready();
-  if (grant.version !== SERVICE_VAULT_ENCRYPTION_VERSION || grant.algorithm !== SERVICE_VAULT_KEY_AGREEMENT)
-    throw new Error("Team vault grant is unsupported.");
-  const publicKey = validKey(decode(grant.recipientPublicKey), crypto.crypto_box_PUBLICKEYBYTES, "Recipient public key");
-  validKey(recipientPrivateKey, crypto.crypto_box_SECRETKEYBYTES, "Recipient private key");
-  try {
-    return validKey(
-      crypto.crypto_box_seal_open(decode(grant.wrappedTeamVaultKey), publicKey, recipientPrivateKey),
-      crypto.crypto_aead_xchacha20poly1305_ietf_KEYBYTES,
-      "Unwrapped team vault key"
-    );
-  } catch {
-    throw new Error("Team vault grant cannot be opened by this user key.");
-  }
-}
-async function encryptServiceCredential(plaintext, teamVaultKey, associatedData) {
-  const crypto = await ready();
-  validKey(teamVaultKey, crypto.crypto_aead_xchacha20poly1305_ietf_KEYBYTES, "Team vault key");
-  if (!plaintext || !associatedData) throw new Error("Credential value and associated data are required.");
-  const dataKey = crypto.crypto_aead_xchacha20poly1305_ietf_keygen();
-  const nonce = crypto.randombytes_buf(crypto.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
-  const wrappedKeyNonce = crypto.randombytes_buf(crypto.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
-  try {
-    return {
-      version: SERVICE_VAULT_ENCRYPTION_VERSION,
-      algorithm: SERVICE_VAULT_AEAD_ALGORITHM,
-      ciphertext: encode(crypto.crypto_aead_xchacha20poly1305_ietf_encrypt(plaintext, associatedData, null, nonce, dataKey)),
-      nonce: encode(nonce),
-      wrappedKey: encode(crypto.crypto_aead_xchacha20poly1305_ietf_encrypt(dataKey, associatedData, null, wrappedKeyNonce, teamVaultKey)),
-      wrappedKeyNonce: encode(wrappedKeyNonce),
-      associatedData,
-      associatedDataDigest: hash(associatedData),
-      fingerprint: hash(plaintext, teamVaultKey)
-    };
-  } finally {
-    crypto.memzero(dataKey);
-  }
-}
-async function decryptServiceCredential(envelope, teamVaultKey, expectedAssociatedData) {
-  const crypto = await ready();
-  validKey(teamVaultKey, crypto.crypto_aead_xchacha20poly1305_ietf_KEYBYTES, "Team vault key");
-  if (envelope.version !== SERVICE_VAULT_ENCRYPTION_VERSION || envelope.algorithm !== SERVICE_VAULT_AEAD_ALGORITHM || envelope.associatedData !== expectedAssociatedData || envelope.associatedDataDigest !== hash(expectedAssociatedData))
-    throw new Error("Credential envelope binding is invalid.");
-  let dataKey;
-  try {
-    dataKey = crypto.crypto_aead_xchacha20poly1305_ietf_decrypt(
-      null,
-      decode(envelope.wrappedKey),
-      expectedAssociatedData,
-      decode(envelope.wrappedKeyNonce),
-      teamVaultKey
-    );
-    return crypto.crypto_aead_xchacha20poly1305_ietf_decrypt(
-      null,
-      decode(envelope.ciphertext),
-      expectedAssociatedData,
-      decode(envelope.nonce),
-      dataKey,
-      "text"
-    );
-  } catch {
-    throw new Error("Credential envelope cannot be decrypted.");
-  } finally {
-    if (dataKey) crypto.memzero(dataKey);
-  }
-}
-async function rewrapServiceCredential(envelope, currentTeamVaultKey, replacementTeamVaultKey) {
-  const plaintext = await decryptServiceCredential(envelope, currentTeamVaultKey, envelope.associatedData);
-  return encryptServiceCredential(plaintext, replacementTeamVaultKey, envelope.associatedData);
-}
-async function sealSecretOperationPayload(values, operationPublicKey) {
-  const crypto = await ready();
-  if (!Object.keys(values).length || Object.values(values).some((value) => typeof value !== "string" || !value))
-    throw new Error("Secret operation payload must contain only non-empty string values.");
-  const payload = JSON.stringify(Object.fromEntries(Object.entries(values).sort(([left], [right]) => left.localeCompare(right))));
-  return encode(crypto.crypto_box_seal(payload, validKey(decode(operationPublicKey), crypto.crypto_box_PUBLICKEYBYTES, "Operation public key")));
-}
-async function encryptGitHubActionsSecret(value, providerPublicKey) {
-  const crypto = await ready();
-  if (!value) throw new Error("GitHub Actions secret value is required.");
-  return encode(crypto.crypto_box_seal(
-    value,
-    validKey(decode(providerPublicKey), crypto.crypto_box_PUBLICKEYBYTES, "GitHub public key")
-  ));
-}
-async function openSecretOperationPayload(sealedPayload, operationPublicKey, operationPrivateKey) {
-  const crypto = await ready();
-  try {
-    const plaintext = crypto.crypto_box_seal_open(decode(sealedPayload), decode(operationPublicKey), operationPrivateKey, "text");
-    const parsed = JSON.parse(plaintext);
-    if (!parsed || Array.isArray(parsed) || Object.values(parsed).some((value) => typeof value !== "string" || !value)) throw new Error();
-    return parsed;
-  } catch {
-    throw new Error("Secret operation payload cannot be opened.");
-  }
-}
-function clearServiceVaultKey(value) {
-  value?.fill(0);
-}
-export {
-  clearServiceVaultKey,
-  createServiceVaultKey,
-  createServiceVaultUserKeyPair,
-  createTeamVaultGrant,
-  decryptServiceCredential,
-  decryptServiceVaultPrivateKey,
-  encryptGitHubActionsSecret,
-  encryptServiceCredential,
-  encryptServiceVaultPrivateKey,
-  openSecretOperationPayload,
-  openTeamVaultGrant,
-  rewrapServiceCredential,
-  sealSecretOperationPayload
-};