@apifuse/provider-sdk 2.2.0-beta.56 → 2.2.0-beta.58

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @apifuse/provider-sdk Changelog
 
+## 2.2.0-beta.58
+
+- Release candidate for main commit e137940caa8bc32ce768571a6197651e581c2270.
+
+## 2.2.0-beta.57
+
+- Release candidate for main commit 4087dafdeab771eb91691884ce7315b8c399f863.
+
 ## 2.2.0-beta.56
 
 - Release candidate for main commit 390167b3f51488be0beba25a1ea5eb425d3bf839.

package/README.md

@@ -115,9 +115,10 @@ the bad request path; provider/runtime failures include `code`, `message`, and
 - **`invalid_request` on `/v1/{operation}`**: confirm the request body includes
   `requestId` and `input`. Omit `connection` for public/no-auth operations;
   never send `connection: null`.
-- **Credential-backed operations**: declare `credential.keys`, then pass matching
-  local-only values through `connection.secrets`. Read them in handlers with
-  `ctx.credential.get("key")` or `ctx.credential.getAccessToken()`.
+- **Credential-backed operations**: declare `credential.keys`, except when
+  `auth.mode` is `platform-managed`; that auth declaration implies an unfiltered
+  credential capability. Pass local-only values through `connection.secrets` and
+  read them with `ctx.credential.get("key")` or `ctx.credential.getAccessToken()`.
 - **Provider env secrets**: declare `secrets[]`, set values in your shell or
   `.env`, and read only those names through `ctx.env.get("NAME")`. The SDK
   enforces presence of `required: true` declarations before handlers and auth

package/SUBMISSION.md

@@ -46,7 +46,8 @@ Fix all blockers before submitting:
 - Missing fixture request or response.
 - Fixture data does not parse against schemas.
 - Missing `healthCheck` or `healthCheckUnsupported` on any Operation.
-- Credential-backed auth mode without declared credential keys.
+- User-managed credential auth mode without declared credential keys
+  (`platform-managed` auth instead implies the credential capability and forbids keys).
 - High-confidence secret or token material in source, README, package metadata, or fixtures.
 - SDK-native source blockers: prefixed Provider ids, `vendor/` SDK shims or imports, raw `.describe()` prose instead of `describeKey`, raw global `fetch()` calls, and excessive `as Type` assertions.
 

package/dist/cli/migrate-operation-declaration.d.ts

@@ -45,6 +45,7 @@ export type OperationDeclarationRepositoryResult = {
     readonly providerRoot: string;
     readonly changedFiles: readonly string[];
     readonly operationCount: number;
+    readonly notes: readonly OperationDeclarationNote[];
     readonly sidecar?: string;
     readonly localeTodoCount: number;
 } | {
@@ -53,9 +54,15 @@ export type OperationDeclarationRepositoryResult = {
     readonly refusals: readonly OperationDeclarationRefusal[];
     /** Operations that were independently migratable before repository-atomic refusal. */
     readonly operationCount: number;
+    readonly notes: readonly OperationDeclarationNote[];
     readonly changedFiles: readonly string[];
     readonly localeTodoCount: number;
 };
+export type OperationDeclarationNote = {
+    readonly code: "runtime_composed_registry";
+    readonly path: string;
+    readonly initializer: string;
+};
 /** Run the file transform repository-wide, committing writes only if every file is provable. */
 export declare function migrateOperationDeclarationRepository(providerRootInput: string, options?: {
     readonly check?: boolean;

package/dist/cli/migrate-operation-declaration.js

@@ -68,7 +68,8 @@ function migrateOperationDeclarationInternal(sourceText, fileName, options, cont
     }
     const constObjects = collectModuleConstObjects(source);
     const constArrays = collectModuleConstArrays(source);
-    const discovery = discoverOperationSites(source, fileName, constObjects, options.operationIds, context.operationSites, context.excludedBindings);
+    const discovery = discoverOperationSites(source, fileName, constObjects, options.operationIds, context.operationSites, context.excludedBindings, context.runtimeComposedInitializers);
+    context.recordDiscoveredSites?.(discovery.discoveredCount);
     if (discovery.refusals.length > 0) {
         return { status: "refused", refusals: discovery.refusals };
     }
@@ -599,14 +600,15 @@ function replaceExampleLocaleMember(member, newName, localeKey, source) {
         text: `${newName}: ${JSON.stringify(localeKey)}`,
     };
 }
-function discoverOperationSites(source, fileName, constObjects, operationIds, operationSites, excludedBindings) {
+function discoverOperationSites(source, fileName, constObjects, operationIds, operationSites, excludedBindings, runtimeComposedInitializers) {
     const sitesByStart = new Map();
+    const discoveredStarts = new Set();
     const localIds = new Map(operationIds ?? []);
     const localExcludedBindings = new Set(excludedBindings ?? []);
     const refusals = [];
     const operationFactories = collectSimpleOperationFactories(source);
     const factoryCallIds = new Map();
-    for (const map of collectOperationsMaps(source, constObjects, fileName, refusals)) {
+    for (const map of collectOperationsMaps(source, constObjects, fileName, refusals, runtimeComposedInitializers)) {
         for (const property of map.properties) {
             if (ts.isSpreadAssignment(property))
                 continue;
@@ -680,12 +682,15 @@ function discoverOperationSites(source, fileName, constObjects, operationIds, op
         if (ts.isCallExpression(node) && isOperationHelperCall(node)) {
             const argument = operationArgument(node);
             const bindingName = enclosingBindingName(node);
+            const unwrappedArgument = unwrapExpression(argument);
+            if (unwrappedArgument !== undefined && ts.isObjectLiteralExpression(unwrappedArgument)) {
+                discoveredStarts.add(unwrappedArgument.getStart(source));
+            }
             if (bindingName !== undefined && localExcludedBindings.has(bindingName))
                 return;
             const operationKey = (bindingName === undefined ? undefined : localIds.get(bindingName)) ??
                 bindingName ??
                 "<anonymous>";
-            const unwrappedArgument = unwrapExpression(argument);
             if (unwrappedArgument === undefined || !ts.isObjectLiteralExpression(unwrappedArgument)) {
                 refusals.push(refusal(fileName, operationKey, "non_literal", "Operation helper argument must be an object literal."));
             }
@@ -711,8 +716,11 @@ function discoverOperationSites(source, fileName, constObjects, operationIds, op
         ts.forEachChild(node, visit);
     };
     visit(source);
+    for (const start of sitesByStart.keys())
+        discoveredStarts.add(start);
     return {
         sites: [...sitesByStart.values()].sort((left, right) => left.object.getStart(source) - right.object.getStart(source)),
+        discoveredCount: discoveredStarts.size,
         refusals,
     };
 }
@@ -741,7 +749,7 @@ function collectSimpleOperationFactories(source) {
     }
     return factories;
 }
-function collectOperationsMaps(source, constObjects, fileName, refusals) {
+function collectOperationsMaps(source, constObjects, fileName, refusals, runtimeComposedInitializers) {
     const maps = new Map();
     const inspect = (expression, label) => {
         const unwrapped = unwrapExpression(expression);
@@ -758,6 +766,8 @@ function collectOperationsMaps(source, constObjects, fileName, refusals) {
             return;
         }
         if (ts.isCallExpression(unwrapped)) {
+            if (runtimeComposedInitializers?.has(expression.getStart(source)) === true)
+                return;
             refusals.push(refusal(fileName, label, "factory_composed_operations", "The operations map is produced by a factory call and cannot be statically enumerated."));
         }
     };
@@ -1274,6 +1284,7 @@ export function migrateOperationDeclarationRepository(providerRootInput, options
     const todos = [];
     const refusals = [...repositoryIndex.refusals];
     let operationCount = 0;
+    let repositoryDiscoveredCount = 0;
     for (const sourcePath of sourceFiles) {
         const relativePath = slash(relative(providerRoot, sourcePath));
         const result = migrateOperationDeclarationInternal(readFileSync(sourcePath, "utf8"), relativePath, {
@@ -1283,6 +1294,10 @@ export function migrateOperationDeclarationRepository(providerRootInput, options
             operationSites: repositoryIndex.operationSites.get(sourcePath),
             excludedBindings: repositoryIndex.excludedBindings.get(sourcePath),
             staticObjectResolver: repositoryIndex.staticObjectResolverFor(sourcePath),
+            runtimeComposedInitializers: repositoryIndex.runtimeComposedInitializers.get(sourcePath),
+            recordDiscoveredSites: (count) => {
+                repositoryDiscoveredCount += count;
+            },
         });
         if (result.status === "refused") {
             refusals.push(...result.refusals);
@@ -1295,7 +1310,18 @@ export function migrateOperationDeclarationRepository(providerRootInput, options
             todos.push(...result.localeTodos);
         }
     }
-    if (repositoryIndex.declarations.length > 0 && repositoryIndex.discoveredCount === 0) {
+    const notes = repositoryDiscoveredCount === 0
+        ? []
+        : repositoryIndex.declarations.flatMap((declaration) => declaration.runtimeInitializer === undefined
+            ? []
+            : [
+                {
+                    code: "runtime_composed_registry",
+                    path: slash(relative(providerRoot, declaration.path)),
+                    initializer: declaration.runtimeInitializer,
+                },
+            ]);
+    if (repositoryIndex.declarations.length > 0 && repositoryDiscoveredCount === 0) {
         for (const declaration of repositoryIndex.declarations) {
             refusals.push(refusal(slash(relative(providerRoot, declaration.path)), "<operations>", "no_operations_discovered", `Provider construct ${declaration.construct} declares operations via unresolved initializer ${JSON.stringify(declaration.initializer.getText(declaration.initializer.getSourceFile()))}, but repository-wide discovery found zero operation sites.`));
         }
@@ -1309,6 +1335,7 @@ export function migrateOperationDeclarationRepository(providerRootInput, options
             providerRoot,
             refusals,
             operationCount,
+            notes,
             changedFiles,
             localeTodoCount: todos.length,
         };
@@ -1322,6 +1349,7 @@ export function migrateOperationDeclarationRepository(providerRootInput, options
             providerRoot,
             changedFiles: [],
             operationCount,
+            notes,
             localeTodoCount: 0,
         };
     }
@@ -1338,6 +1366,7 @@ export function migrateOperationDeclarationRepository(providerRootInput, options
         providerRoot,
         changedFiles,
         operationCount,
+        notes,
         sidecar,
         localeTodoCount: todos.length,
     };
@@ -1489,12 +1518,12 @@ function buildRepositoryOperationIndex(sourceFiles, providerRoot) {
     const operationIds = buildOperationIdIndex(sourceFiles);
     const operationSites = new Map();
     const excludedBindings = new Map();
+    const runtimeComposedInitializers = new Map();
     const refusals = [];
     const declarations = [];
     const indexedProviderProperties = new Set();
     const factoryIds = new Map();
     const bindingCandidates = new Map();
-    let discoveredCount = 0;
     const relativePath = (path) => slash(relative(providerRoot, path));
     const resolutionRefusal = (path, operationKey, detail) => {
         refusals.push(refusal(relativePath(path), operationKey, "non_literal", detail));
@@ -1749,7 +1778,6 @@ function buildRepositoryOperationIndex(sourceFiles, providerRoot) {
         }
         sites.set(start, operationId);
         operationSites.set(path, sites);
-        discoveredCount += 1;
     };
     const classifyEntry = (entry) => {
         const resolved = resolveLocatedExpression(entry.value, new Set());
@@ -1793,7 +1821,6 @@ function buildRepositoryOperationIndex(sourceFiles, providerRoot) {
             };
             factory.ids.add(entry.operationId);
             factoryIds.set(key, factory);
-            discoveredCount += 1;
             return;
         }
         resolutionRefusal(resolved.value.path, entry.operationId, `Operation initializer ${JSON.stringify(expression.getText(resolved.value.source))} is not a raw object, operation helper, or simple same-file factory call.`);
@@ -1803,10 +1830,23 @@ function buildRepositoryOperationIndex(sourceFiles, providerRoot) {
         if (indexedProviderProperties.has(key))
             return;
         indexedProviderProperties.add(key);
-        declarations.push({ path, construct, initializer: node.initializer });
+        const resolvedInitializer = resolveLocatedExpression({ path, source, expression: node.initializer }, new Set());
+        let runtimeInitializer;
+        if (resolvedInitializer.status === "resolved") {
+            const resolvedExpression = unwrapExpression(resolvedInitializer.value.expression);
+            if (resolvedExpression !== undefined && ts.isCallExpression(resolvedExpression)) {
+                runtimeInitializer = resolvedExpression.getText(resolvedInitializer.value.source);
+                const initializers = runtimeComposedInitializers.get(path) ?? new Set();
+                initializers.add(node.initializer.getStart(source));
+                runtimeComposedInitializers.set(path, initializers);
+            }
+        }
+        declarations.push({ path, construct, initializer: node.initializer, runtimeInitializer });
         const flattened = flattenRegistry({ path, source, expression: node.initializer }, new Set());
         if ("detail" in flattened) {
-            resolutionRefusal(path, "<operations>", flattened.detail);
+            if (runtimeInitializer === undefined) {
+                resolutionRefusal(path, "<operations>", flattened.detail);
+            }
         }
         else {
             for (const entry of flattened.entries.values())
@@ -1919,9 +1959,9 @@ function buildRepositoryOperationIndex(sourceFiles, providerRoot) {
         operationIds,
         operationSites,
         excludedBindings,
+        runtimeComposedInitializers,
         refusals,
         declarations,
-        discoveredCount,
         staticObjectResolverFor: (currentPath) => (expression, source) => resolveStaticObject(expression, sources.has(source.fileName) ? source.fileName : currentPath),
     };
 }

package/dist/cli/templates/provider/README.md.tpl

@@ -109,8 +109,10 @@ Structured errors return an `error` object with `code`, `message`,
 
 - `invalid_request`: include `requestId` and `input`; omit `connection` for
   public/no-auth operations and never send `connection: null`.
-- Credentials: declare `credential.keys`, pass local-only values through
-  `connection.secrets`, and read them with `ctx.credential`.
+- Credentials: declare `credential.keys` unless `auth.mode` is `platform-managed`;
+  that mode implies an unfiltered credential capability and forbids key declarations.
+  Pass local-only values through `connection.secrets` and read them with
+  `ctx.credential`.
 - Auth flow: call `/auth/start`, then `/auth/continue` with the same `flowId`;
   carry returned `contextPatch` values into the next request's `context`.
 - Stealth/browser runtime: keep access-sensitive operations on `ctx.stealth.fetch()` with

package/dist/define.d.ts

@@ -78,6 +78,7 @@ export interface ProviderDeclaration {
     secrets?: ProviderSecretDeclaration[];
     /** Declares the environment capability binding. A bare object states use without configuration. */
     env?: Record<string, never> | true;
+    /** Declares credential keys; platform-managed auth declares this capability without key filtering. */
     credential?: CredentialDeclaration;
     /** Declares provider context metadata; this does not add a `ctx.context` member. */
     context?: ContextDeclaration;

package/dist/engine.js

@@ -75,6 +75,8 @@ export const PROVIDER_CAPABILITY_KEYS = [
 ];
 const CAPABILITY_KEY_SET = new Set(PROVIDER_CAPABILITY_KEYS);
 function declaresCapability(provider, capability) {
+    if (capability === "credential" && provider.auth?.mode === "platform-managed")
+        return true;
     return Object.hasOwn(provider, capability) && provider[capability] !== undefined;
 }
 function attachmentError(provider, capability) {

package/dist/lint.js

@@ -246,7 +246,7 @@ function lintAuthModel(provider) {
             rule: "platform-managed-no-credential-keys",
             level: "error",
             field: "credential.keys",
-            message: `${providerLabel} must not declare credential.keys for platform-managed auth mode.`,
+            message: `${providerLabel} must not declare credential.keys because platform-managed auth mode already implies the unfiltered credential capability.`,
         });
     }
     const authFlowSource = getAuthFlowSource(provider);

package/dist/types.d.ts

@@ -1860,8 +1860,9 @@ export interface ProviderRuntimeState {
 /**
  * The operation context exposed for one provider declaration. Capability
  * bindings are present only when their corresponding declaration is present;
- * trace and request remain ambient runtime bindings. Omitting the type
- * parameter preserves the legacy full context shape for existing annotations.
+ * platform-managed auth itself declares the credential binding. Trace and
+ * request remain ambient runtime bindings. Omitting the type parameter
+ * preserves the legacy full context shape for existing annotations.
  */
 export type ProviderContext<TConfig = Record<string, unknown>> = {
     request?: ProviderRequestContext;
@@ -1870,6 +1871,12 @@ export type ProviderContext<TConfig = Record<string, unknown>> = {
     env: EnvContext;
 } : Record<never, never>) & ("credential" extends keyof TConfig ? {
     credential: CredentialContext;
+} : TConfig extends {
+    auth: {
+        mode: "platform-managed";
+    };
+} ? {
+    credential: CredentialContext;
 } : Record<never, never>) & ("http" extends keyof TConfig ? {
     http: HttpClient;
 } : Record<never, never>) & ("files" extends keyof TConfig ? string extends keyof TConfig ? {

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "2.2.0-beta.56",
+	"version": "2.2.0-beta.58",
 	"name": "@apifuse/provider-sdk",
 	"private": false,
 	"type": "module",

package/src/cli/__tests__/fixtures/migrate-operation-declaration/discovery-runtime-composed-index.ts.txt

@@ -0,0 +1,3 @@
+import { makeRegistry } from "./operations/registry";
+
+export default buildProvider({ operations: makeRegistry({ publicOnly: true }) });

package/src/cli/__tests__/fixtures/migrate-operation-declaration/discovery-runtime-composed-one.ts.txt

@@ -0,0 +1,6 @@
+export const firstOperation = defineOperation<ProviderContext>()({
+	annotations: { readOnly: true },
+	input: FirstInputSchema,
+	output: FirstOutputSchema,
+	handler: firstHandler,
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/discovery-runtime-composed-two.ts.txt

@@ -0,0 +1,6 @@
+export const secondOperation = defineOperation<ProviderContext>()({
+	annotations: { readOnly: true },
+	input: SecondInputSchema,
+	output: SecondOutputSchema,
+	handler: secondHandler,
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/discovery-runtime-mixed-index.ts.txt

@@ -0,0 +1,14 @@
+import { makeRegistry } from "./operations/registry";
+
+const literalOperation = defineOperation<ProviderContext>()({
+	annotations: { readOnly: true },
+	input: LiteralInputSchema,
+	output: LiteralOutputSchema,
+	handler: literalHandler,
+});
+
+export const literalProvider = buildProvider({
+	operations: { literal: literalOperation },
+});
+
+export default buildProvider({ operations: makeRegistry({ publicOnly: true }) });

package/src/cli/__tests__/fixtures/migrate-operation-declaration/discovery-runtime-registry.ts.txt

@@ -0,0 +1,3 @@
+export function makeRegistry(_options: { publicOnly: boolean }) {
+	return {};
+}

package/src/cli/migrate-operation-declaration.ts

@@ -141,6 +141,8 @@ type RepositoryMigrationContext = {
 	readonly operationSites?: ReadonlyMap<number, string>;
 	readonly excludedBindings?: ReadonlySet<string>;
 	readonly staticObjectResolver?: StaticObjectResolver;
+	readonly runtimeComposedInitializers?: ReadonlySet<number>;
+	readonly recordDiscoveredSites?: (count: number) => void;
 };
 
 type OperationSite = {
@@ -194,7 +196,9 @@ function migrateOperationDeclarationInternal(
 		options.operationIds,
 		context.operationSites,
 		context.excludedBindings,
+		context.runtimeComposedInitializers,
 	);
+	context.recordDiscoveredSites?.(discovery.discoveredCount);
 	if (discovery.refusals.length > 0) {
 		return { status: "refused", refusals: discovery.refusals };
 	}
@@ -1047,18 +1051,27 @@ function discoverOperationSites(
 	operationIds: ReadonlyMap<string, string> | undefined,
 	operationSites: ReadonlyMap<number, string> | undefined,
 	excludedBindings: ReadonlySet<string> | undefined,
+	runtimeComposedInitializers: ReadonlySet<number> | undefined,
 ): {
 	readonly sites: OperationSite[];
+	readonly discoveredCount: number;
 	readonly refusals: OperationDeclarationRefusal[];
 } {
 	const sitesByStart = new Map<number, OperationSite>();
+	const discoveredStarts = new Set<number>();
 	const localIds = new Map(operationIds ?? []);
 	const localExcludedBindings = new Set(excludedBindings ?? []);
 	const refusals: OperationDeclarationRefusal[] = [];
 	const operationFactories = collectSimpleOperationFactories(source);
 	const factoryCallIds = new Map<string, Set<string>>();
 
-	for (const map of collectOperationsMaps(source, constObjects, fileName, refusals)) {
+	for (const map of collectOperationsMaps(
+		source,
+		constObjects,
+		fileName,
+		refusals,
+		runtimeComposedInitializers,
+	)) {
 		for (const property of map.properties) {
 			if (ts.isSpreadAssignment(property)) continue;
 			const key = staticPropertyName(property.name);
@@ -1145,12 +1158,15 @@ function discoverOperationSites(
 		if (ts.isCallExpression(node) && isOperationHelperCall(node)) {
 			const argument = operationArgument(node);
 			const bindingName = enclosingBindingName(node);
+			const unwrappedArgument = unwrapExpression(argument);
+			if (unwrappedArgument !== undefined && ts.isObjectLiteralExpression(unwrappedArgument)) {
+				discoveredStarts.add(unwrappedArgument.getStart(source));
+			}
 			if (bindingName !== undefined && localExcludedBindings.has(bindingName)) return;
 			const operationKey =
 				(bindingName === undefined ? undefined : localIds.get(bindingName)) ??
 				bindingName ??
 				"<anonymous>";
-			const unwrappedArgument = unwrapExpression(argument);
 			if (unwrappedArgument === undefined || !ts.isObjectLiteralExpression(unwrappedArgument)) {
 				refusals.push(
 					refusal(
@@ -1181,10 +1197,12 @@ function discoverOperationSites(
 		ts.forEachChild(node, visit);
 	};
 	visit(source);
+	for (const start of sitesByStart.keys()) discoveredStarts.add(start);
 	return {
 		sites: [...sitesByStart.values()].sort(
 			(left, right) => left.object.getStart(source) - right.object.getStart(source),
 		),
+		discoveredCount: discoveredStarts.size,
 		refusals,
 	};
 }
@@ -1223,6 +1241,7 @@ function collectOperationsMaps(
 	constObjects: ReadonlyMap<string, TS.ObjectLiteralExpression>,
 	fileName: string,
 	refusals: OperationDeclarationRefusal[],
+	runtimeComposedInitializers?: ReadonlySet<number>,
 ): TS.ObjectLiteralExpression[] {
 	const maps = new Map<number, TS.ObjectLiteralExpression>();
 	const inspect = (expression: TS.Expression, label: string): void => {
@@ -1238,6 +1257,7 @@ function collectOperationsMaps(
 			return;
 		}
 		if (ts.isCallExpression(unwrapped)) {
+			if (runtimeComposedInitializers?.has(expression.getStart(source)) === true) return;
 			refusals.push(
 				refusal(
 					fileName,
@@ -1893,6 +1913,7 @@ export type OperationDeclarationRepositoryResult =
 			readonly providerRoot: string;
 			readonly changedFiles: readonly string[];
 			readonly operationCount: number;
+			readonly notes: readonly OperationDeclarationNote[];
 			readonly sidecar?: string;
 			readonly localeTodoCount: number;
 	  }
@@ -1902,10 +1923,17 @@ export type OperationDeclarationRepositoryResult =
 			readonly refusals: readonly OperationDeclarationRefusal[];
 			/** Operations that were independently migratable before repository-atomic refusal. */
 			readonly operationCount: number;
+			readonly notes: readonly OperationDeclarationNote[];
 			readonly changedFiles: readonly string[];
 			readonly localeTodoCount: number;
 	  };
 
+export type OperationDeclarationNote = {
+	readonly code: "runtime_composed_registry";
+	readonly path: string;
+	readonly initializer: string;
+};
+
 /** Run the file transform repository-wide, committing writes only if every file is provable. */
 export function migrateOperationDeclarationRepository(
 	providerRootInput: string,
@@ -1920,6 +1948,7 @@ export function migrateOperationDeclarationRepository(
 	const todos: LocaleTodo[] = [];
 	const refusals: OperationDeclarationRefusal[] = [...repositoryIndex.refusals];
 	let operationCount = 0;
+	let repositoryDiscoveredCount = 0;
 
 	for (const sourcePath of sourceFiles) {
 		const relativePath = slash(relative(providerRoot, sourcePath));
@@ -1934,6 +1963,10 @@ export function migrateOperationDeclarationRepository(
 				operationSites: repositoryIndex.operationSites.get(sourcePath),
 				excludedBindings: repositoryIndex.excludedBindings.get(sourcePath),
 				staticObjectResolver: repositoryIndex.staticObjectResolverFor(sourcePath),
+				runtimeComposedInitializers: repositoryIndex.runtimeComposedInitializers.get(sourcePath),
+				recordDiscoveredSites: (count) => {
+					repositoryDiscoveredCount += count;
+				},
 			},
 		);
 		if (result.status === "refused") {
@@ -1947,7 +1980,21 @@ export function migrateOperationDeclarationRepository(
 			todos.push(...result.localeTodos);
 		}
 	}
-	if (repositoryIndex.declarations.length > 0 && repositoryIndex.discoveredCount === 0) {
+	const notes: OperationDeclarationNote[] =
+		repositoryDiscoveredCount === 0
+			? []
+			: repositoryIndex.declarations.flatMap((declaration) =>
+					declaration.runtimeInitializer === undefined
+						? []
+						: [
+								{
+									code: "runtime_composed_registry" as const,
+									path: slash(relative(providerRoot, declaration.path)),
+									initializer: declaration.runtimeInitializer,
+								},
+							],
+				);
+	if (repositoryIndex.declarations.length > 0 && repositoryDiscoveredCount === 0) {
 		for (const declaration of repositoryIndex.declarations) {
 			refusals.push(
 				refusal(
@@ -1970,6 +2017,7 @@ export function migrateOperationDeclarationRepository(
 			providerRoot,
 			refusals,
 			operationCount,
+			notes,
 			changedFiles,
 			localeTodoCount: todos.length,
 		};
@@ -1984,6 +2032,7 @@ export function migrateOperationDeclarationRepository(
 			providerRoot,
 			changedFiles: [],
 			operationCount,
+			notes,
 			localeTodoCount: 0,
 		};
 	}
@@ -2000,6 +2049,7 @@ export function migrateOperationDeclarationRepository(
 		providerRoot,
 		changedFiles,
 		operationCount,
+		notes,
 		sidecar,
 		localeTodoCount: todos.length,
 	};
@@ -2180,15 +2230,16 @@ type ProviderOperationsDeclaration = {
 	readonly path: string;
 	readonly construct: string;
 	readonly initializer: TS.Expression;
+	readonly runtimeInitializer?: string;
 };
 
 type RepositoryOperationIndex = {
 	readonly operationIds: Map<string, Map<string, string>>;
 	readonly operationSites: Map<string, Map<number, string>>;
 	readonly excludedBindings: Map<string, Set<string>>;
+	readonly runtimeComposedInitializers: Map<string, Set<number>>;
 	readonly refusals: OperationDeclarationRefusal[];
 	readonly declarations: ProviderOperationsDeclaration[];
-	readonly discoveredCount: number;
 	readonly staticObjectResolverFor: (path: string) => StaticObjectResolver;
 };
 
@@ -2205,12 +2256,12 @@ function buildRepositoryOperationIndex(
 	const operationIds = buildOperationIdIndex(sourceFiles);
 	const operationSites = new Map<string, Map<number, string>>();
 	const excludedBindings = new Map<string, Set<string>>();
+	const runtimeComposedInitializers = new Map<string, Set<number>>();
 	const refusals: OperationDeclarationRefusal[] = [];
 	const declarations: ProviderOperationsDeclaration[] = [];
 	const indexedProviderProperties = new Set<string>();
 	const factoryIds = new Map<string, { path: string; name: string; ids: Set<string> }>();
 	const bindingCandidates = new Map<string, { path: string; name: string; ids: Set<string> }>();
-	let discoveredCount = 0;
 
 	const relativePath = (path: string): string => slash(relative(providerRoot, path));
 	const resolutionRefusal = (path: string, operationKey: string, detail: string): void => {
@@ -2489,7 +2540,6 @@ function buildRepositoryOperationIndex(
 		}
 		sites.set(start, operationId);
 		operationSites.set(path, sites);
-		discoveredCount += 1;
 	};
 
 	const classifyEntry = (entry: RegistryEntry): void => {
@@ -2543,7 +2593,6 @@ function buildRepositoryOperationIndex(
 			};
 			factory.ids.add(entry.operationId);
 			factoryIds.set(key, factory);
-			discoveredCount += 1;
 			return;
 		}
 		resolutionRefusal(
@@ -2562,10 +2611,26 @@ function buildRepositoryOperationIndex(
 		const key = `${path}\0${node.getStart(source)}`;
 		if (indexedProviderProperties.has(key)) return;
 		indexedProviderProperties.add(key);
-		declarations.push({ path, construct, initializer: node.initializer });
+		const resolvedInitializer = resolveLocatedExpression(
+			{ path, source, expression: node.initializer },
+			new Set(),
+		);
+		let runtimeInitializer: string | undefined;
+		if (resolvedInitializer.status === "resolved") {
+			const resolvedExpression = unwrapExpression(resolvedInitializer.value.expression);
+			if (resolvedExpression !== undefined && ts.isCallExpression(resolvedExpression)) {
+				runtimeInitializer = resolvedExpression.getText(resolvedInitializer.value.source);
+				const initializers = runtimeComposedInitializers.get(path) ?? new Set<number>();
+				initializers.add(node.initializer.getStart(source));
+				runtimeComposedInitializers.set(path, initializers);
+			}
+		}
+		declarations.push({ path, construct, initializer: node.initializer, runtimeInitializer });
 		const flattened = flattenRegistry({ path, source, expression: node.initializer }, new Set());
 		if ("detail" in flattened) {
-			resolutionRefusal(path, "<operations>", flattened.detail);
+			if (runtimeInitializer === undefined) {
+				resolutionRefusal(path, "<operations>", flattened.detail);
+			}
 		} else {
 			for (const entry of flattened.entries.values()) classifyEntry(entry);
 		}
@@ -2691,9 +2756,9 @@ function buildRepositoryOperationIndex(
 		operationIds,
 		operationSites,
 		excludedBindings,
+		runtimeComposedInitializers,
 		refusals,
 		declarations,
-		discoveredCount,
 		staticObjectResolverFor: (currentPath) => (expression, source) =>
 			resolveStaticObject(expression, sources.has(source.fileName) ? source.fileName : currentPath),
 	};

package/src/cli/templates/provider/README.md.tpl

@@ -109,8 +109,10 @@ Structured errors return an `error` object with `code`, `message`,
 
 - `invalid_request`: include `requestId` and `input`; omit `connection` for
   public/no-auth operations and never send `connection: null`.
-- Credentials: declare `credential.keys`, pass local-only values through
-  `connection.secrets`, and read them with `ctx.credential`.
+- Credentials: declare `credential.keys` unless `auth.mode` is `platform-managed`;
+  that mode implies an unfiltered credential capability and forbids key declarations.
+  Pass local-only values through `connection.secrets` and read them with
+  `ctx.credential`.
 - Auth flow: call `/auth/start`, then `/auth/continue` with the same `flowId`;
   carry returned `contextPatch` values into the next request's `context`.
 - Stealth/browser runtime: keep access-sensitive operations on `ctx.stealth.fetch()` with

package/src/define.ts

@@ -600,6 +600,7 @@ export interface ProviderDeclaration {
 	secrets?: ProviderSecretDeclaration[];
 	/** Declares the environment capability binding. A bare object states use without configuration. */
 	env?: Record<string, never> | true;
+	/** Declares credential keys; platform-managed auth declares this capability without key filtering. */
 	credential?: CredentialDeclaration;
 	/** Declares provider context metadata; this does not add a `ctx.context` member. */
 	context?: ContextDeclaration;

package/src/engine.ts

@@ -199,6 +199,7 @@ function declaresCapability(
 	provider: ProviderDefinition,
 	capability: ProviderCapabilityKey,
 ): boolean {
+	if (capability === "credential" && provider.auth?.mode === "platform-managed") return true;
 	return Object.hasOwn(provider, capability) && provider[capability] !== undefined;
 }
 

package/src/lint.ts

@@ -398,7 +398,7 @@ function lintAuthModel(provider: {
 			rule: "platform-managed-no-credential-keys",
 			level: "error",
 			field: "credential.keys",
-			message: `${providerLabel} must not declare credential.keys for platform-managed auth mode.`,
+			message: `${providerLabel} must not declare credential.keys because platform-managed auth mode already implies the unfiltered credential capability.`,
 		});
 	}
 

package/src/types.ts

@@ -2266,8 +2266,9 @@ export interface ProviderRuntimeState {
 /**
  * The operation context exposed for one provider declaration. Capability
  * bindings are present only when their corresponding declaration is present;
- * trace and request remain ambient runtime bindings. Omitting the type
- * parameter preserves the legacy full context shape for existing annotations.
+ * platform-managed auth itself declares the credential binding. Trace and
+ * request remain ambient runtime bindings. Omitting the type parameter
+ * preserves the legacy full context shape for existing annotations.
  */
 export type ProviderContext<TConfig = Record<string, unknown>> = {
 	request?: ProviderRequestContext;
@@ -2276,7 +2277,9 @@ export type ProviderContext<TConfig = Record<string, unknown>> = {
 	& ("env" extends keyof TConfig ? { env: EnvContext } : Record<never, never>)
 	& ("credential" extends keyof TConfig
 		? { credential: CredentialContext }
-		: Record<never, never>)
+		: TConfig extends { auth: { mode: "platform-managed" } }
+			? { credential: CredentialContext }
+			: Record<never, never>)
 	& ("http" extends keyof TConfig ? { http: HttpClient } : Record<never, never>)
 	& ("files" extends keyof TConfig
 		? string extends keyof TConfig