Add connector v2 admin operations

cmd/attesto/main.go

@@ -1002,14 +1002,23 @@ func (a *app) marketplaceInit(args []string) error {
 	repositoryURL := fs.String("repository-url", "", "public release source URL")
 	docsURL := fs.String("docs-url", "", "public documentation URL")
 	capabilitiesRaw := fs.String("capabilities", "", "comma-separated capabilities")
+	providerURL := fs.String("provider-url", "", "provider website URL")
+	authMode := fs.String("auth-mode", "", "connector auth mode")
+	authScopesRaw := fs.String("auth-scopes", "", "comma-separated provider scopes")
+	syncModesRaw := fs.String("sync-modes", "", "comma-separated sync modes")
+	eventTypesRaw := fs.String("event-types", "", "comma-separated source event types")
+	canaryRef := fs.String("canary-ref", "", "real canary/test-account evidence reference")
 	if err := fs.Parse(args); err != nil {
 		return err
 	}
 	if *output == "" {
 		return errors.New("output is required")
 	}
+	authScopes := splitCSV(*authScopesRaw)
+	syncModes := splitCSV(*syncModesRaw)
+	eventTypes := splitCSV(*eventTypesRaw)
 	manifest := connectorkit.Manifest{
-		SchemaVersion: "1.0",
+		SchemaVersion: "attesto.connector.v2",
 		Slug:          *slug,
 		Name:          *name,
 		Version:       *version,
@@ -1036,6 +1045,62 @@ func (a *app) marketplaceInit(args []string) error {
 			"secretScan":     true,
 		},
 		SupportedLanguages: []string{"en", "nl", "de", "fr", "es", "pl", "it"},
+		Provider: map[string]any{
+			"id":         *slug,
+			"name":       *name,
+			"websiteUrl": *providerURL,
+		},
+		Auth: map[string]any{
+			"mode":   *authMode,
+			"scopes": authScopes,
+		},
+		Sync: map[string]any{
+			"modes":           syncModes,
+			"supportsReplay":  true,
+			"rateLimitPolicy": "provider-documented",
+		},
+		EventTypes: eventTypes,
+		SourceTime: map[string]any{
+			"required":       true,
+			"timezonePolicy": "source-timestamp-with-offset-required",
+		},
+		ConfigSchema: map[string]any{"type": "object"},
+		SecretSchema: map[string]any{"type": "object"},
+		Diagnostics: map[string]any{
+			"providerAuthStatus":  true,
+			"replayConflictCheck": true,
+			"revocationCheck":     true,
+			"syncLag":             true,
+			"testConnection":      true,
+		},
+		Runtime: map[string]any{
+			"officialConnectorKit": true,
+			"sdkSurfaces":          []string{"python", "typescript", "go", "cli"},
+			"requiredMethods": []string{
+				"metadata",
+				"validateConfig",
+				"testConnection",
+				"sync",
+				"handleWebhook",
+				"emitProofstreamEvent",
+				"diagnostics",
+				"revoke",
+			},
+			"canary": map[string]any{
+				"status": "green",
+				"ref":    *canaryRef,
+			},
+		},
+		InstallRequirements: map[string]any{
+			"tenantLoginRequired": true,
+			"entitlementRequired": true,
+		},
+		Changelog: []map[string]any{
+			{
+				"version": *version,
+				"changes": []string{"Initial production connector manifest."},
+			},
+		},
 	}
 	if len(manifest.Capabilities) == 0 {
 		return errors.New("at least one capability is required")

cmd/attesto/main_test.go

@@ -201,6 +201,12 @@ func TestMarketplaceInitAndValidate(t *testing.T) {
 		"--repository-url", "https://git.example.com/acme/risk-connector",
 		"--docs-url", "https://docs.example.com/acme/risk-connector",
 		"--capabilities", "proofstream,offline-verification",
+		"--provider-url", "https://example.com/acme-risk",
+		"--auth-mode", "signed-webhook",
+		"--auth-scopes", "repository:read",
+		"--sync-modes", "webhook",
+		"--event-types", "risk.decision.created",
+		"--canary-ref", "attesto-owned-test-account-2026-06-09",
 	}, &stdout, &stderr, testEnv(t, nil))
 	if code != 0 {
 		t.Fatalf("exit=%d stderr=%s", code, stderr.String())
@@ -311,7 +317,7 @@ func loadVector(t *testing.T) map[string]any {
 func writeMarketplaceManifest(t *testing.T, path string) {
 	t.Helper()
 	manifest := map[string]any{
-		"schemaVersion": "1.0",
+		"schemaVersion": "attesto.connector.v2",
 		"slug":          "acme-risk-connector",
 		"name":          "ACME Risk Connector",
 		"version":       "1.0.0",
@@ -340,6 +346,62 @@ func writeMarketplaceManifest(t *testing.T, path string) {
 			"secretScan":     true,
 		},
 		"supportedLanguages": []string{"en", "nl", "de", "fr", "es", "pl", "it"},
+		"provider": map[string]any{
+			"id":         "acme-risk-connector",
+			"name":       "ACME Risk Connector",
+			"websiteUrl": "https://example.com/acme-risk",
+		},
+		"auth": map[string]any{
+			"mode":   "signed-webhook",
+			"scopes": []string{"repository:read"},
+		},
+		"sync": map[string]any{
+			"modes":           []string{"webhook"},
+			"supportsReplay":  true,
+			"rateLimitPolicy": "provider-documented",
+		},
+		"eventTypes": []string{"risk.decision.created"},
+		"sourceTime": map[string]any{
+			"required":       true,
+			"timezonePolicy": "source-timestamp-with-offset-required",
+		},
+		"configSchema": map[string]any{"type": "object"},
+		"secretSchema": map[string]any{"type": "object"},
+		"diagnostics": map[string]any{
+			"providerAuthStatus":  true,
+			"replayConflictCheck": true,
+			"revocationCheck":     true,
+			"syncLag":             true,
+			"testConnection":      true,
+		},
+		"runtime": map[string]any{
+			"officialConnectorKit": true,
+			"sdkSurfaces":          []string{"python", "typescript", "go", "cli"},
+			"requiredMethods": []string{
+				"metadata",
+				"validateConfig",
+				"testConnection",
+				"sync",
+				"handleWebhook",
+				"emitProofstreamEvent",
+				"diagnostics",
+				"revoke",
+			},
+			"canary": map[string]any{
+				"status": "green",
+				"ref":    "attesto-owned-test-account-2026-06-09",
+			},
+		},
+		"installRequirements": map[string]any{
+			"tenantLoginRequired": true,
+			"entitlementRequired": true,
+		},
+		"changelog": []map[string]any{
+			{
+				"version": "1.0.0",
+				"changes": []string{"Initial production connector manifest."},
+			},
+		},
 	}
 	raw, err := json.MarshalIndent(manifest, "", "  ")
 	if err != nil {