@treeseed/sdk 0.13.0-rc.12 → 0.13.0-rc.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/dist/operator-contracts/control-plane-operation.d.ts +2 -0
  2. package/dist/operator-contracts/control-plane-operation.js +9 -0
  3. package/dist/operator-contracts/control-plane-operations.js +10 -5
  4. package/package.json +1 -1
package/dist/operator-contracts/control-plane-operation.d.ts CHANGED
@@ -7,6 +7,7 @@ export type ControlPlaneConfirmationPolicy = 'never' | 'input_required';
7
7
  export type ControlPlaneOperationSurface = 'rest' | 'cli' | 'mcp_tool' | 'mcp_resource' | 'internal';
8
8
  export type ControlPlaneCacheScope = 'none' | 'principal' | 'team' | 'project' | 'public';
9
9
  export type ControlPlanePaginationKind = 'none' | 'cursor';
10
+ export type ControlPlaneAuthenticationKind = 'anonymous' | 'oauth' | 'provider' | 'signed_request';
10
11
  export interface ControlPlaneRestBinding {
11
12
  method: ControlPlaneHttpMethod;
12
13
  path: `/v1/${string}`;
@@ -33,6 +34,7 @@ export interface ControlPlaneOperationDescriptor {
33
34
  rest?: ControlPlaneRestBinding;
34
35
  schemas: ControlPlaneSchemaBinding;
35
36
  capability: string;
37
+ authentication: ControlPlaneAuthenticationKind;
36
38
  oauthScopes: OAuthScope[];
37
39
  kind: ControlPlaneOperationKind;
38
40
  riskClass: ControlPlaneRiskClass;
package/dist/operator-contracts/control-plane-operation.js CHANGED
@@ -44,6 +44,15 @@ function validateControlPlaneCatalog(catalog) {
44
44
  for (const scope of operation.oauthScopes) {
45
45
  if (!TREESEED_OAUTH_SCOPES.includes(scope)) diagnostics.push({ code: "oauth_scope_invalid", path: `${path}.oauthScopes`, message: `Unknown OAuth scope ${scope}.` });
46
46
  }
47
+ if (operation.authentication === "oauth" && operation.oauthScopes.length === 0) {
48
+ diagnostics.push({ code: "oauth_scope_required", path: `${path}.oauthScopes`, message: "OAuth-authenticated operations require at least one OAuth scope." });
49
+ }
50
+ if (operation.authentication !== "oauth" && operation.oauthScopes.length > 0) {
51
+ diagnostics.push({ code: "oauth_scope_forbidden", path: `${path}.oauthScopes`, message: "Only OAuth-authenticated operations may declare OAuth scopes." });
52
+ }
53
+ if (operation.authentication === "provider" && operation.capability !== "providers.execute") {
54
+ diagnostics.push({ code: "provider_auth_capability_invalid", path: `${path}.capability`, message: "Provider-authenticated operations require providers.execute." });
55
+ }
47
56
  for (const duplicate of duplicates(operation.surfaces)) diagnostics.push({ code: "surface_duplicate", path: `${path}.surfaces`, message: `Duplicate operation surface ${duplicate}.` });
48
57
  for (const duplicate of duplicates(operation.oauthScopes)) diagnostics.push({ code: "oauth_scope_duplicate", path: `${path}.oauthScopes`, message: `Duplicate OAuth scope ${duplicate}.` });
49
58
  const elevatedRisk = operation.riskClass !== "ordinary";
package/dist/operator-contracts/control-plane-operations.js CHANGED
@@ -12,6 +12,7 @@ function define(definition, schema) {
12
12
  return {
13
13
  descriptor: {
14
14
  ...descriptor,
15
+ authentication: definition.authentication ?? (definition.oauthScopes.length ? "oauth" : "anonymous"),
15
16
  schemaVersion: CONTROL_PLANE_OPERATION_SCHEMA_VERSION,
16
17
  schemas: {
17
18
  input: `treeseed.${definition.operationId}.input/v1`,
@@ -34,6 +35,7 @@ function read(operationId, path, capability, surfaces = ["rest"]) {
34
35
  description: `Read ${operationId}.`,
35
36
  rest: { method: "GET", path },
36
37
  capability,
38
+ authentication: "oauth",
37
39
  oauthScopes: ["treeseed:read"],
38
40
  kind: "read",
39
41
  riskClass: "ordinary",
@@ -51,7 +53,8 @@ function providerPath(operationId, method, path, pathShape, options = {}) {
51
53
  rest: { method, path },
52
54
  parameters: `treeseed.${operationId}.parameters/v1`,
53
55
  capability: "providers.execute",
54
- oauthScopes: ["treeseed:execution"],
56
+ authentication: "provider",
57
+ oauthScopes: [],
55
58
  kind,
56
59
  riskClass: "ordinary",
57
60
  confirmation: "never",
@@ -66,7 +69,8 @@ const noPathProvider = (operationId, method, path, options = {}) => define({
66
69
  description: `${options.read ? "Read" : "Apply"} ${operationId}.`,
67
70
  rest: { method, path },
68
71
  capability: "providers.execute",
69
- oauthScopes: ["treeseed:execution"],
72
+ authentication: "provider",
73
+ oauthScopes: [],
70
74
  kind: options.read ? "read" : "mutation",
71
75
  riskClass: "ordinary",
72
76
  confirmation: "never",
@@ -84,6 +88,7 @@ function resource(operationId, method, path, pathShape, options = { capability:
84
88
  rest: { method, path },
85
89
  ...Object.keys(pathShape).length ? { parameters: `treeseed.${operationId}.parameters/v1` } : {},
86
90
  capability: options.capability,
91
+ authentication: options.authentication ?? ((options.scopes ?? (kind === "read" ? ["treeseed:read"] : ["treeseed:projects:write"])).length ? "oauth" : "anonymous"),
87
92
  oauthScopes: options.scopes ?? (kind === "read" ? ["treeseed:read"] : ["treeseed:projects:write"]),
88
93
  kind,
89
94
  riskClass,
@@ -162,7 +167,7 @@ const CONTROL_PLANE_OPERATIONS = {
162
167
  members: resource("teams.members.list", "GET", "/v1/teams/{teamId}/members", { teamId: z.string().min(1) }, { capability: "teams.read", pagination: "cursor" }),
163
168
  invite: resource("teams.invites.create", "POST", "/v1/teams/{teamId}/invites", { teamId: z.string().min(1) }, { capability: "teams.write" }),
164
169
  invites: resource("teams.invites.list", "GET", "/v1/teams/{teamId}/invites", { teamId: z.string().min(1) }, { capability: "teams.read", pagination: "cursor" }),
165
- inviteShow: resource("teams.invites.show", "GET", "/v1/team-invites/{token}", { token: z.string().min(1) }, { capability: "teams.join", scopes: [], redactedPaths: ["path.token"] }),
170
+ inviteShow: resource("teams.invites.show", "GET", "/v1/team-invites/{token}", { token: z.string().min(1) }, { capability: "teams.join", scopes: [], authentication: "signed_request", redactedPaths: ["path.token"] }),
166
171
  inviteAccept: resource("teams.invites.accept", "POST", "/v1/team-invites/{token}/accept", { token: z.string().min(1) }, { capability: "teams.join", redactedPaths: ["path.token"] }),
167
172
  updateMember: resource("teams.members.update", "PATCH", "/v1/teams/{teamId}/members/{membershipId}", { teamId: z.string().min(1), membershipId: z.string().min(1) }, { capability: "teams.write", concurrency: true }),
168
173
  removeMember: resource("teams.members.delete", "DELETE", "/v1/teams/{teamId}/members/{membershipId}", { teamId: z.string().min(1), membershipId: z.string().min(1) }, { capability: "teams.write", risk: "destructive", concurrency: true }),
@@ -218,8 +223,8 @@ const CONTROL_PLANE_OPERATIONS = {
218
223
  },
219
224
  repositories: {
220
225
  githubSetup: resource("repositories.github.setup", "POST", "/v1/provider-connectors/github/{kind}/setup", { kind: z.string().min(1) }, { capability: "repositories.connect", scopes: ["treeseed:projects:write"], risk: "authority" }),
221
- githubCallback: resource("repositories.github.callback", "GET", "/v1/provider-connectors/github/{kind}/callback", { kind: z.string().min(1) }, { capability: "repositories.connect", scopes: [] }),
222
- githubWebhook: resource("repositories.github.webhook", "POST", "/v1/provider-webhooks/github/{kind}", { kind: z.string().min(1) }, { capability: "repositories.webhook", scopes: [], redactedPaths: ["body"] }),
226
+ githubCallback: resource("repositories.github.callback", "GET", "/v1/provider-connectors/github/{kind}/callback", { kind: z.string().min(1) }, { capability: "repositories.connect", scopes: [], authentication: "signed_request" }),
227
+ githubWebhook: resource("repositories.github.webhook", "POST", "/v1/provider-webhooks/github/{kind}", { kind: z.string().min(1) }, { capability: "repositories.webhook", scopes: [], authentication: "signed_request", redactedPaths: ["body"] }),
223
228
  workflowOperations: resource("repositories.workflows.list", "GET", "/v1/projects/{projectId}/workflow-operations", { projectId: z.string().min(1) }, { capability: "workflows.read", pagination: "cursor" }),
224
229
  workflowRuns: resource("repositories.workflow.runs.list", "GET", "/v1/projects/{projectId}/workflow-operation-runs", { projectId: z.string().min(1) }, { capability: "workflows.read", pagination: "cursor" }),
225
230
  updateWorkflow: resource("repositories.workflows.update", "PUT", "/v1/projects/{projectId}/workflow-operations/{operationId}", { projectId: z.string().min(1), operationId: z.string().min(1) }, { capability: "workflows.write", concurrency: true }),
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@treeseed/sdk",
3
- "version": "0.13.0-rc.12",
3
+ "version": "0.13.0-rc.13",
4
4
  "description": "Portable TreeSeed contracts, standards, and typed remote control-plane clients.",
5
5
  "license": "Apache-2.0",
6
6
  "repository": {