@treeseed/sdk 0.13.0-rc.11 → 0.13.0-rc.13

package/dist/operator-contracts/control-plane-operation.d.ts

@@ -7,6 +7,7 @@ export type ControlPlaneConfirmationPolicy = 'never' | 'input_required';
 export type ControlPlaneOperationSurface = 'rest' | 'cli' | 'mcp_tool' | 'mcp_resource' | 'internal';
 export type ControlPlaneCacheScope = 'none' | 'principal' | 'team' | 'project' | 'public';
 export type ControlPlanePaginationKind = 'none' | 'cursor';
+export type ControlPlaneAuthenticationKind = 'anonymous' | 'oauth' | 'provider' | 'signed_request';
 export interface ControlPlaneRestBinding {
     method: ControlPlaneHttpMethod;
     path: `/v1/${string}`;
@@ -33,6 +34,7 @@ export interface ControlPlaneOperationDescriptor {
     rest?: ControlPlaneRestBinding;
     schemas: ControlPlaneSchemaBinding;
     capability: string;
+    authentication: ControlPlaneAuthenticationKind;
     oauthScopes: OAuthScope[];
     kind: ControlPlaneOperationKind;
     riskClass: ControlPlaneRiskClass;

package/dist/operator-contracts/control-plane-operation.js

@@ -44,6 +44,15 @@ function validateControlPlaneCatalog(catalog) {
     for (const scope of operation.oauthScopes) {
       if (!TREESEED_OAUTH_SCOPES.includes(scope)) diagnostics.push({ code: "oauth_scope_invalid", path: `${path}.oauthScopes`, message: `Unknown OAuth scope ${scope}.` });
     }
+    if (operation.authentication === "oauth" && operation.oauthScopes.length === 0) {
+      diagnostics.push({ code: "oauth_scope_required", path: `${path}.oauthScopes`, message: "OAuth-authenticated operations require at least one OAuth scope." });
+    }
+    if (operation.authentication !== "oauth" && operation.oauthScopes.length > 0) {
+      diagnostics.push({ code: "oauth_scope_forbidden", path: `${path}.oauthScopes`, message: "Only OAuth-authenticated operations may declare OAuth scopes." });
+    }
+    if (operation.authentication === "provider" && operation.capability !== "providers.execute") {
+      diagnostics.push({ code: "provider_auth_capability_invalid", path: `${path}.capability`, message: "Provider-authenticated operations require providers.execute." });
+    }
     for (const duplicate of duplicates(operation.surfaces)) diagnostics.push({ code: "surface_duplicate", path: `${path}.surfaces`, message: `Duplicate operation surface ${duplicate}.` });
     for (const duplicate of duplicates(operation.oauthScopes)) diagnostics.push({ code: "oauth_scope_duplicate", path: `${path}.oauthScopes`, message: `Duplicate OAuth scope ${duplicate}.` });
     const elevatedRisk = operation.riskClass !== "ordinary";

package/dist/operator-contracts/control-plane-operations.d.ts

@@ -314,6 +314,36 @@ export declare const CONTROL_PLANE_OPERATIONS: {
             projectId: string;
         }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
     };
+    readonly services: {
+        readonly providers: ControlPlaneOperationBinding<{}, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly connections: ControlPlaneOperationBinding<{
+            teamId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly connection: ControlPlaneOperationBinding<{
+            teamId: string;
+            connectionId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly createConnection: ControlPlaneOperationBinding<{
+            teamId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly updateConnection: ControlPlaneOperationBinding<{
+            teamId: string;
+            connectionId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly disconnect: ControlPlaneOperationBinding<{
+            teamId: string;
+            connectionId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly authorities: ControlPlaneOperationBinding<{
+            teamId: string;
+            connectionId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+        readonly putAuthority: ControlPlaneOperationBinding<{
+            teamId: string;
+            profileId: string;
+            connectionId: string;
+        }, {}, Record<string, unknown> | undefined, Record<string, unknown>>;
+    };
     readonly agents: {
         readonly list: ControlPlaneOperationBinding<{
             projectId: string;

package/dist/operator-contracts/control-plane-operations.js

@@ -12,6 +12,7 @@ function define(definition, schema) {
   return {
     descriptor: {
       ...descriptor,
+      authentication: definition.authentication ?? (definition.oauthScopes.length ? "oauth" : "anonymous"),
       schemaVersion: CONTROL_PLANE_OPERATION_SCHEMA_VERSION,
       schemas: {
         input: `treeseed.${definition.operationId}.input/v1`,
@@ -34,6 +35,7 @@ function read(operationId, path, capability, surfaces = ["rest"]) {
     description: `Read ${operationId}.`,
     rest: { method: "GET", path },
     capability,
+    authentication: "oauth",
     oauthScopes: ["treeseed:read"],
     kind: "read",
     riskClass: "ordinary",
@@ -51,7 +53,8 @@ function providerPath(operationId, method, path, pathShape, options = {}) {
     rest: { method, path },
     parameters: `treeseed.${operationId}.parameters/v1`,
     capability: "providers.execute",
-    oauthScopes: ["treeseed:execution"],
+    authentication: "provider",
+    oauthScopes: [],
     kind,
     riskClass: "ordinary",
     confirmation: "never",
@@ -66,7 +69,8 @@ const noPathProvider = (operationId, method, path, options = {}) => define({
   description: `${options.read ? "Read" : "Apply"} ${operationId}.`,
   rest: { method, path },
   capability: "providers.execute",
-  oauthScopes: ["treeseed:execution"],
+  authentication: "provider",
+  oauthScopes: [],
   kind: options.read ? "read" : "mutation",
   riskClass: "ordinary",
   confirmation: "never",
@@ -84,6 +88,7 @@ function resource(operationId, method, path, pathShape, options = { capability:
     rest: { method, path },
     ...Object.keys(pathShape).length ? { parameters: `treeseed.${operationId}.parameters/v1` } : {},
     capability: options.capability,
+    authentication: options.authentication ?? ((options.scopes ?? (kind === "read" ? ["treeseed:read"] : ["treeseed:projects:write"])).length ? "oauth" : "anonymous"),
     oauthScopes: options.scopes ?? (kind === "read" ? ["treeseed:read"] : ["treeseed:projects:write"]),
     kind,
     riskClass,
@@ -162,7 +167,7 @@ const CONTROL_PLANE_OPERATIONS = {
     members: resource("teams.members.list", "GET", "/v1/teams/{teamId}/members", { teamId: z.string().min(1) }, { capability: "teams.read", pagination: "cursor" }),
     invite: resource("teams.invites.create", "POST", "/v1/teams/{teamId}/invites", { teamId: z.string().min(1) }, { capability: "teams.write" }),
     invites: resource("teams.invites.list", "GET", "/v1/teams/{teamId}/invites", { teamId: z.string().min(1) }, { capability: "teams.read", pagination: "cursor" }),
-    inviteShow: resource("teams.invites.show", "GET", "/v1/team-invites/{token}", { token: z.string().min(1) }, { capability: "teams.join", scopes: [], redactedPaths: ["path.token"] }),
+    inviteShow: resource("teams.invites.show", "GET", "/v1/team-invites/{token}", { token: z.string().min(1) }, { capability: "teams.join", scopes: [], authentication: "signed_request", redactedPaths: ["path.token"] }),
     inviteAccept: resource("teams.invites.accept", "POST", "/v1/team-invites/{token}/accept", { token: z.string().min(1) }, { capability: "teams.join", redactedPaths: ["path.token"] }),
     updateMember: resource("teams.members.update", "PATCH", "/v1/teams/{teamId}/members/{membershipId}", { teamId: z.string().min(1), membershipId: z.string().min(1) }, { capability: "teams.write", concurrency: true }),
     removeMember: resource("teams.members.delete", "DELETE", "/v1/teams/{teamId}/members/{membershipId}", { teamId: z.string().min(1), membershipId: z.string().min(1) }, { capability: "teams.write", risk: "destructive", concurrency: true }),
@@ -218,8 +223,8 @@ const CONTROL_PLANE_OPERATIONS = {
   },
   repositories: {
     githubSetup: resource("repositories.github.setup", "POST", "/v1/provider-connectors/github/{kind}/setup", { kind: z.string().min(1) }, { capability: "repositories.connect", scopes: ["treeseed:projects:write"], risk: "authority" }),
-    githubCallback: resource("repositories.github.callback", "GET", "/v1/provider-connectors/github/{kind}/callback", { kind: z.string().min(1) }, { capability: "repositories.connect", scopes: [] }),
-    githubWebhook: resource("repositories.github.webhook", "POST", "/v1/provider-webhooks/github/{kind}", { kind: z.string().min(1) }, { capability: "repositories.webhook", scopes: [], redactedPaths: ["body"] }),
+    githubCallback: resource("repositories.github.callback", "GET", "/v1/provider-connectors/github/{kind}/callback", { kind: z.string().min(1) }, { capability: "repositories.connect", scopes: [], authentication: "signed_request" }),
+    githubWebhook: resource("repositories.github.webhook", "POST", "/v1/provider-webhooks/github/{kind}", { kind: z.string().min(1) }, { capability: "repositories.webhook", scopes: [], authentication: "signed_request", redactedPaths: ["body"] }),
     workflowOperations: resource("repositories.workflows.list", "GET", "/v1/projects/{projectId}/workflow-operations", { projectId: z.string().min(1) }, { capability: "workflows.read", pagination: "cursor" }),
     workflowRuns: resource("repositories.workflow.runs.list", "GET", "/v1/projects/{projectId}/workflow-operation-runs", { projectId: z.string().min(1) }, { capability: "workflows.read", pagination: "cursor" }),
     updateWorkflow: resource("repositories.workflows.update", "PUT", "/v1/projects/{projectId}/workflow-operations/{operationId}", { projectId: z.string().min(1), operationId: z.string().min(1) }, { capability: "workflows.write", concurrency: true }),
@@ -235,6 +240,16 @@ const CONTROL_PLANE_OPERATIONS = {
     putWorkflowVariable: resource("repositories.workflow.variables.put", "PUT", "/v1/projects/{projectId}/workflow-configuration/variables/{name}", { projectId: z.string().min(1), name: z.string().min(1) }, { capability: "workflows.write", concurrency: true }),
     deleteWorkflowVariable: resource("repositories.workflow.variables.delete", "DELETE", "/v1/projects/{projectId}/workflow-configuration/variables/{name}", { projectId: z.string().min(1), name: z.string().min(1) }, { capability: "workflows.write", risk: "destructive", concurrency: true })
   },
+  services: {
+    providers: resource("services.providers.list", "GET", "/v1/service-providers", {}, { capability: "services.read", surfaces: ["rest", "cli", "mcp_tool"] }),
+    connections: resource("services.connections.list", "GET", "/v1/teams/{teamId}/services", { teamId: z.string().min(1) }, { capability: "services.read", surfaces: ["rest", "cli", "mcp_tool"], pagination: "cursor" }),
+    connection: resource("services.connections.show", "GET", "/v1/teams/{teamId}/services/{connectionId}", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "services.read", surfaces: ["rest", "cli", "mcp_resource"] }),
+    createConnection: resource("services.connections.create", "POST", "/v1/teams/{teamId}/services", { teamId: z.string().min(1) }, { capability: "services.write", surfaces: ["rest", "cli", "mcp_tool"] }),
+    updateConnection: resource("services.connections.update", "PUT", "/v1/teams/{teamId}/services/{connectionId}", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "services.write", surfaces: ["rest", "cli", "mcp_tool"], concurrency: true }),
+    disconnect: resource("services.connections.disconnect", "DELETE", "/v1/teams/{teamId}/services/{connectionId}", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "services.write", surfaces: ["rest", "cli", "mcp_tool"], risk: "destructive", concurrency: true }),
+    authorities: resource("services.credential.authorities.list", "GET", "/v1/teams/{teamId}/services/{connectionId}/credential-authorities", { teamId: z.string().min(1), connectionId: z.string().min(1) }, { capability: "secrets.read", surfaces: ["rest", "cli"], pagination: "cursor" }),
+    putAuthority: resource("services.credential.authorities.put", "PUT", "/v1/teams/{teamId}/services/{connectionId}/credential-authorities/{profileId}", { teamId: z.string().min(1), connectionId: z.string().min(1), profileId: z.string().min(1) }, { capability: "secrets.write", surfaces: ["rest", "cli"], risk: "credential", concurrency: true, redactedPaths: ["body"] })
+  },
   agents: {
     list: resource("agents.list", "GET", "/v1/projects/{projectId}/agents", { projectId: z.string().min(1) }, { capability: "agents.read", surfaces: ["rest", "cli", "mcp_tool"], pagination: "cursor" }),
     show: resource("agents.show", "GET", "/v1/projects/{projectId}/agents/{agentSlug}", { projectId: z.string().min(1), agentSlug: z.string().min(1) }, { capability: "agents.read", surfaces: ["rest", "cli", "mcp_resource"] }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.13.0-rc.11",
+  "version": "0.13.0-rc.13",
   "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
   "license": "Apache-2.0",
   "repository": {