@keemakr/operator-sdk 0.3.0 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keemakr/operator-sdk",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "The keemakr connector contract: defineProvider + ConnectionProvider/ConnectionOperation types + OperationContext (governed fetch) + the connector manifest schema, shared by keemakr-core's built-in adapters and external connector repos. One shape, two consumers.",
   "type": "module",
   "license": "MIT",

package/src/conformance/index.ts

@@ -68,6 +68,15 @@ export async function runConformance(
     !manifest.auth_kind || provider.authKind === manifest.auth_kind,
     `code '${provider.authKind}' vs manifest '${manifest.auth_kind ?? '—'}'`,
   );
+  // The credential alias is a reviewed dependency: when either side declares
+  // it, both must, and they must agree (a code-only alias would ride a
+  // connection reviewers never saw).
+  add(
+    'credential-alias',
+    'credential alias matches the manifest (when either declares it)',
+    (provider.credentialProvider ?? null) === (manifest.credential_provider ?? null),
+    `code '${provider.credentialProvider ?? '—'}' vs manifest '${manifest.credential_provider ?? '—'}'`,
+  );
 
   // 6 — code may not claim MORE network than the reviewed manifest.
   const undeclared = (provider.allowedDomains ?? []).filter(

package/src/index.ts

@@ -130,6 +130,17 @@ export interface ConnectionProvider {
   // omit it (first-party).
   publisher?: string;
 
+  // Credential alias — the agent-tool chain's "one key opens many doors" seam.
+  // A connector that fronts one facet of a wider platform (an Apify actor, a
+  // Composio toolkit) declares the provider whose TENANT CONNECTION it rides:
+  // when a tenant has no row for THIS provider, getConnection falls back to the
+  // alias provider's row (tenant connects 'apify' once; every actor connector
+  // works). A tenant-pasted key for this provider still wins — the alias is the
+  // fallback, not the override. Refresh semantics follow the ALIAS provider's
+  // adapter. One hop only; the alias must name a concrete provider, never
+  // another aliased one.
+  credentialProvider?: string;
+
   // Inline connect-form spec for api_key / app_password shapes. Omitted by pure
   // oauth2 adapters (they render a Connect button instead). For a dual-mode
   // provider (WordPress), this describes the NON-oauth fallback form; the UI

package/src/manifest.ts

@@ -92,6 +92,14 @@ export const connectorManifestSchema = z
     allowed_domains: z
       .array(z.string().regex(domainPattern, 'each entry is a bare host or *.host, optional :port'))
       .min(1, 'declare at least one allowed domain'),
+    // Credential alias (see ConnectionProvider.credentialProvider): the provider
+    // whose tenant connection this connector rides when the tenant has not
+    // connected THIS provider directly. Declared here so reviewers see the
+    // dependency; the adapter's copy is authoritative at runtime.
+    credential_provider: z
+      .string()
+      .regex(kebab, 'credential_provider must be a lowercase-kebab provider key')
+      .optional(),
     // Connector-level config keys the platform must supply (resolved from the
     // encrypted config store — values are set by staff at publish, never bundled).
     env: z