@treeseed/sdk 0.13.0-rc.87 → 0.13.0-rc.89

package/dist/.treeseed-build-complete.json

@@ -1 +1 @@
-{"completedAt":"2026-09-05T03:40:21.329Z"}
+{"completedAt":"2026-09-05T04:40:44.268Z"}

package/dist/operator-contracts/canonical-command-tree.js

@@ -1,3 +1,4 @@
+import { managedSecretCommands } from "./catalog/services/secret-commands.js";
 import { hostProviderEnvironmentBranch, PROVIDER_ENVIRONMENT_COMMAND_BINDINGS, providerEnvironmentBranches } from "./catalog/provider-environment-commands.js";
 const unavailable = (reason = "This capability is not enabled until its control-plane operation is accepted.") => ({
   kind: "unavailable",
@@ -30,7 +31,6 @@ const operationBindings = {
   "secrets status": local("local.secrets.status"),
   "secrets unlock": local("local.secrets.unlock"),
   "secrets lock": local("local.secrets.lock"),
-  "secrets rotate": local("local.secrets.rotate"),
   "platform verify": local("local.platform.verify"),
   "platform workset": local("local.platform.workset"),
   "platform project create": local("local.platform.project.create"),
@@ -356,7 +356,8 @@ const commandTree = {
     branch("auth", [authLogin(), leaf("logout", "mutation"), leaf("status")]),
     branch("users", [userCreate()]),
     branch("teams", [leaf("list"), { nodeType: "leaf", segment: "current", description: "Show the active team for this authenticated server session.", kind: "read", resultSchemaId: "treeseed.command.teams.current/v1", execution: unavailable() }, { nodeType: "leaf", segment: "use", description: "Select the active team for this authenticated server session.", kind: "mutation", arguments: [{ name: "team", description: "Team UUID or unambiguous slug.", required: true }], options: [planOption], authorization: { capability: "teams.read", confirmation: "never" }, resultSchemaId: "treeseed.command.teams.use/v1", execution: unavailable() }]),
-    branch("secrets", [leaf("list"), leaf("status"), leaf("unlock", "mutation", void 0, "credential"), leaf("lock", "mutation"), leaf("rotate", "mutation", void 0, "credential")]),
+    branch("secrets", [leaf("list"), leaf("status"), leaf("unlock", "mutation", void 0, "credential"), leaf("lock", "mutation")]),
+    managedSecretCommands,
     branch("platform", [
       { nodeType: "leaf", segment: "verify", description: "Verify a declarative Platform repository without package checkouts or a control-plane API.", kind: "read", arguments: [{ name: "root", description: "Platform root; defaults to the current directory.", required: false }], options: [{ name: "--profile", description: "Composable profile to verify.", type: "string[]" }, { name: "--json", description: "Emit the stable command-result envelope.", type: "boolean" }], resultSchemaId: "treeseed.platform-verification/v1", execution: local("local.platform.verify") },
       { nodeType: "leaf", segment: "workset", description: "Plan or safely materialize exact primary source checkouts beneath packages/.", kind: "mutation", options: [planOption, { name: "--apply", description: "Apply the frozen workset plan.", type: "boolean" }, { name: "--yes", description: "Confirm the planned checkout mutations.", type: "boolean" }, { name: "--profile", description: "Composable source profile; repeat to union profiles.", type: "string[]" }, { name: "--project", description: "Explicit project slug; repeat to select projects.", type: "string[]" }, { name: "--exclude", description: "Project slug to exclude; repeat as needed.", type: "string[]" }, { name: "--json", description: "Emit the stable command-result envelope.", type: "boolean" }], authorization: { capability: "development.workset", confirmation: "never" }, resultSchemaId: "treeseed.platform-workset-result/v1", execution: local("local.platform.workset") },

package/dist/operator-contracts/catalog/services/secret-commands.d.ts

@@ -0,0 +1,2 @@
+import type { CommandNodeDescriptor } from '../../command-tree.js';
+export declare const managedSecretCommands: CommandNodeDescriptor;

package/dist/operator-contracts/catalog/services/secret-commands.js

@@ -0,0 +1,31 @@
+const managedSecretCommands = {
+  nodeType: "branch",
+  segment: "services",
+  description: "Team service credentials.",
+  children: [{
+    nodeType: "branch",
+    segment: "credentials",
+    description: "Manage credentials in core OpenBao.",
+    children: ["show", "put", "delete", "validate"].map((name) => ({
+      nodeType: "leaf",
+      segment: name,
+      description: `${name} an exact service credential profile.`,
+      kind: name === "show" ? "read" : "mutation",
+      arguments: [{ name: "connection", description: "Service connection ID.", required: true }, { name: "profile", description: "Credential profile ID.", required: true }],
+      options: [
+        { name: "--team", description: "Authorized team ID.", type: "string" },
+        ...name === "show" ? [] : [
+          { name: "--plan", description: "Inspect the proposed operation without mutation or secret input.", type: "boolean" },
+          { name: "--expected-version", description: "Exact current credential version; zero for first creation.", type: "number", required: true }
+        ],
+        ...name === "put" ? [{ name: "--stdin", description: "Read the credential field object as JSON from standard input.", type: "boolean" }] : []
+      ],
+      authorization: { capability: name === "show" ? "secrets.read" : "secrets.write", confirmation: "never" },
+      resultSchemaId: `treeseed.services.credentials.${name}/v1`,
+      execution: { kind: "local", handlerId: `local.services.credentials.${name}` }
+    }))
+  }]
+};
+export {
+  managedSecretCommands
+};

package/dist/operator-contracts/catalog/services/secret-operations.js

@@ -28,7 +28,7 @@ function operation(name, method) {
     oauthScopes: read ? ["treeseed:read"] : ["treeseed:projects:write"],
     kind: read ? "read" : "mutation",
     riskClass: read ? "ordinary" : "credential",
-    confirmation: read ? "never" : "input_required",
+    confirmation: "never",
     surfaces: ["rest"],
     cacheScope: "none",
     pagination: "none",

package/dist/operator-contracts/control-plane-operation.js

@@ -56,8 +56,9 @@ function validateControlPlaneCatalog(catalog) {
       diagnostics.push({ code: "upstream_binding_invalid", path: `${path}.upstream`, message: "Upstream bindings require an operation ID and exact SHA-256 contract digest." });
     }
     const elevatedRisk = operation.riskClass !== "ordinary";
-    if (elevatedRisk !== (operation.confirmation === "input_required")) {
-      diagnostics.push({ code: "confirmation_policy_invalid", path: `${path}.confirmation`, message: "Elevated-risk operations require input_required; ordinary operations must not." });
+    const directCredential = operation.riskClass === "credential" && operation.confirmation === "never" && operation.authentication === "oauth" && operation.redactedPaths.includes("body.values");
+    if (!directCredential && elevatedRisk !== (operation.confirmation === "input_required")) {
+      diagnostics.push({ code: "confirmation_policy_invalid", path: `${path}.confirmation`, message: "Elevated-risk operations require input_required unless authenticated credential input is explicitly redacted; ordinary operations must not." });
     }
     if (operation.kind === "read" && (operation.idempotency.required || operation.concurrency.required || operation.receipt)) {
       diagnostics.push({ code: "read_mutation_contract_invalid", path, message: "Read operations cannot require mutation idempotency, write concurrency, or mutation receipts." });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.87",
+  "version": "0.13.0-rc.89",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {