@apifuse/provider-sdk 2.2.0-beta.57 → 2.2.0-beta.58

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # @apifuse/provider-sdk Changelog
 
+## 2.2.0-beta.58
+
+- Release candidate for main commit e137940caa8bc32ce768571a6197651e581c2270.
+
 ## 2.2.0-beta.57
 
 - Release candidate for main commit 4087dafdeab771eb91691884ce7315b8c399f863.

package/README.md

@@ -115,9 +115,10 @@ the bad request path; provider/runtime failures include `code`, `message`, and
 - **`invalid_request` on `/v1/{operation}`**: confirm the request body includes
   `requestId` and `input`. Omit `connection` for public/no-auth operations;
   never send `connection: null`.
-- **Credential-backed operations**: declare `credential.keys`, then pass matching
-  local-only values through `connection.secrets`. Read them in handlers with
-  `ctx.credential.get("key")` or `ctx.credential.getAccessToken()`.
+- **Credential-backed operations**: declare `credential.keys`, except when
+  `auth.mode` is `platform-managed`; that auth declaration implies an unfiltered
+  credential capability. Pass local-only values through `connection.secrets` and
+  read them with `ctx.credential.get("key")` or `ctx.credential.getAccessToken()`.
 - **Provider env secrets**: declare `secrets[]`, set values in your shell or
   `.env`, and read only those names through `ctx.env.get("NAME")`. The SDK
   enforces presence of `required: true` declarations before handlers and auth

package/SUBMISSION.md

@@ -46,7 +46,8 @@ Fix all blockers before submitting:
 - Missing fixture request or response.
 - Fixture data does not parse against schemas.
 - Missing `healthCheck` or `healthCheckUnsupported` on any Operation.
-- Credential-backed auth mode without declared credential keys.
+- User-managed credential auth mode without declared credential keys
+  (`platform-managed` auth instead implies the credential capability and forbids keys).
 - High-confidence secret or token material in source, README, package metadata, or fixtures.
 - SDK-native source blockers: prefixed Provider ids, `vendor/` SDK shims or imports, raw `.describe()` prose instead of `describeKey`, raw global `fetch()` calls, and excessive `as Type` assertions.
 

package/dist/cli/templates/provider/README.md.tpl

@@ -109,8 +109,10 @@ Structured errors return an `error` object with `code`, `message`,
 
 - `invalid_request`: include `requestId` and `input`; omit `connection` for
   public/no-auth operations and never send `connection: null`.
-- Credentials: declare `credential.keys`, pass local-only values through
-  `connection.secrets`, and read them with `ctx.credential`.
+- Credentials: declare `credential.keys` unless `auth.mode` is `platform-managed`;
+  that mode implies an unfiltered credential capability and forbids key declarations.
+  Pass local-only values through `connection.secrets` and read them with
+  `ctx.credential`.
 - Auth flow: call `/auth/start`, then `/auth/continue` with the same `flowId`;
   carry returned `contextPatch` values into the next request's `context`.
 - Stealth/browser runtime: keep access-sensitive operations on `ctx.stealth.fetch()` with

package/dist/define.d.ts

@@ -78,6 +78,7 @@ export interface ProviderDeclaration {
     secrets?: ProviderSecretDeclaration[];
     /** Declares the environment capability binding. A bare object states use without configuration. */
     env?: Record<string, never> | true;
+    /** Declares credential keys; platform-managed auth declares this capability without key filtering. */
     credential?: CredentialDeclaration;
     /** Declares provider context metadata; this does not add a `ctx.context` member. */
     context?: ContextDeclaration;

package/dist/engine.js

@@ -75,6 +75,8 @@ export const PROVIDER_CAPABILITY_KEYS = [
 ];
 const CAPABILITY_KEY_SET = new Set(PROVIDER_CAPABILITY_KEYS);
 function declaresCapability(provider, capability) {
+    if (capability === "credential" && provider.auth?.mode === "platform-managed")
+        return true;
     return Object.hasOwn(provider, capability) && provider[capability] !== undefined;
 }
 function attachmentError(provider, capability) {

package/dist/lint.js

@@ -246,7 +246,7 @@ function lintAuthModel(provider) {
             rule: "platform-managed-no-credential-keys",
             level: "error",
             field: "credential.keys",
-            message: `${providerLabel} must not declare credential.keys for platform-managed auth mode.`,
+            message: `${providerLabel} must not declare credential.keys because platform-managed auth mode already implies the unfiltered credential capability.`,
         });
     }
     const authFlowSource = getAuthFlowSource(provider);

package/dist/types.d.ts

@@ -1860,8 +1860,9 @@ export interface ProviderRuntimeState {
 /**
  * The operation context exposed for one provider declaration. Capability
  * bindings are present only when their corresponding declaration is present;
- * trace and request remain ambient runtime bindings. Omitting the type
- * parameter preserves the legacy full context shape for existing annotations.
+ * platform-managed auth itself declares the credential binding. Trace and
+ * request remain ambient runtime bindings. Omitting the type parameter
+ * preserves the legacy full context shape for existing annotations.
  */
 export type ProviderContext<TConfig = Record<string, unknown>> = {
     request?: ProviderRequestContext;
@@ -1870,6 +1871,12 @@ export type ProviderContext<TConfig = Record<string, unknown>> = {
     env: EnvContext;
 } : Record<never, never>) & ("credential" extends keyof TConfig ? {
     credential: CredentialContext;
+} : TConfig extends {
+    auth: {
+        mode: "platform-managed";
+    };
+} ? {
+    credential: CredentialContext;
 } : Record<never, never>) & ("http" extends keyof TConfig ? {
     http: HttpClient;
 } : Record<never, never>) & ("files" extends keyof TConfig ? string extends keyof TConfig ? {

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "2.2.0-beta.57",
+	"version": "2.2.0-beta.58",
 	"name": "@apifuse/provider-sdk",
 	"private": false,
 	"type": "module",

package/src/cli/templates/provider/README.md.tpl

@@ -109,8 +109,10 @@ Structured errors return an `error` object with `code`, `message`,
 
 - `invalid_request`: include `requestId` and `input`; omit `connection` for
   public/no-auth operations and never send `connection: null`.
-- Credentials: declare `credential.keys`, pass local-only values through
-  `connection.secrets`, and read them with `ctx.credential`.
+- Credentials: declare `credential.keys` unless `auth.mode` is `platform-managed`;
+  that mode implies an unfiltered credential capability and forbids key declarations.
+  Pass local-only values through `connection.secrets` and read them with
+  `ctx.credential`.
 - Auth flow: call `/auth/start`, then `/auth/continue` with the same `flowId`;
   carry returned `contextPatch` values into the next request's `context`.
 - Stealth/browser runtime: keep access-sensitive operations on `ctx.stealth.fetch()` with

package/src/define.ts

@@ -600,6 +600,7 @@ export interface ProviderDeclaration {
 	secrets?: ProviderSecretDeclaration[];
 	/** Declares the environment capability binding. A bare object states use without configuration. */
 	env?: Record<string, never> | true;
+	/** Declares credential keys; platform-managed auth declares this capability without key filtering. */
 	credential?: CredentialDeclaration;
 	/** Declares provider context metadata; this does not add a `ctx.context` member. */
 	context?: ContextDeclaration;

package/src/engine.ts

@@ -199,6 +199,7 @@ function declaresCapability(
 	provider: ProviderDefinition,
 	capability: ProviderCapabilityKey,
 ): boolean {
+	if (capability === "credential" && provider.auth?.mode === "platform-managed") return true;
 	return Object.hasOwn(provider, capability) && provider[capability] !== undefined;
 }
 

package/src/lint.ts

@@ -398,7 +398,7 @@ function lintAuthModel(provider: {
 			rule: "platform-managed-no-credential-keys",
 			level: "error",
 			field: "credential.keys",
-			message: `${providerLabel} must not declare credential.keys for platform-managed auth mode.`,
+			message: `${providerLabel} must not declare credential.keys because platform-managed auth mode already implies the unfiltered credential capability.`,
 		});
 	}
 

package/src/types.ts

@@ -2266,8 +2266,9 @@ export interface ProviderRuntimeState {
 /**
  * The operation context exposed for one provider declaration. Capability
  * bindings are present only when their corresponding declaration is present;
- * trace and request remain ambient runtime bindings. Omitting the type
- * parameter preserves the legacy full context shape for existing annotations.
+ * platform-managed auth itself declares the credential binding. Trace and
+ * request remain ambient runtime bindings. Omitting the type parameter
+ * preserves the legacy full context shape for existing annotations.
  */
 export type ProviderContext<TConfig = Record<string, unknown>> = {
 	request?: ProviderRequestContext;
@@ -2276,7 +2277,9 @@ export type ProviderContext<TConfig = Record<string, unknown>> = {
 	& ("env" extends keyof TConfig ? { env: EnvContext } : Record<never, never>)
 	& ("credential" extends keyof TConfig
 		? { credential: CredentialContext }
-		: Record<never, never>)
+		: TConfig extends { auth: { mode: "platform-managed" } }
+			? { credential: CredentialContext }
+			: Record<never, never>)
 	& ("http" extends keyof TConfig ? { http: HttpClient } : Record<never, never>)
 	& ("files" extends keyof TConfig
 		? string extends keyof TConfig