@finalai/agent-provider 0.1.0

package/dist/modules/conformance/scripted-model/sse.mjs

@@ -0,0 +1,75 @@
+const sseEvent = (event, data) => ({
+  event,
+  data: JSON.stringify(data)
+});
+const encodeEvent = (event) => `${event.event == null ? "" : `event: ${event.event}
+`}data: ${event.data}
+
+`;
+const SSE_HEADERS = {
+  "content-type": "text/event-stream",
+  "cache-control": "no-cache"
+};
+const sseResponse = (events) => new Response(events.map(encodeEvent).join(""), { status: 200, headers: SSE_HEADERS });
+const jsonResponse = (status, body) => new Response(JSON.stringify(body), {
+  status,
+  headers: { "content-type": "application/json" }
+});
+const DEFAULT_HELD_STREAM_TIMING = {
+  holdMs: 10 * 6e4,
+  keepaliveMs: 15e3
+};
+const heldSseResponse = (events, timing) => {
+  const encoder = new TextEncoder();
+  let keepalive = null;
+  let deadline = null;
+  const stop = () => {
+    if (keepalive != null) clearInterval(keepalive);
+    if (deadline != null) clearTimeout(deadline);
+    keepalive = null;
+    deadline = null;
+  };
+  const body = new ReadableStream({
+    start: (controller) => {
+      controller.enqueue(encoder.encode(events.map(encodeEvent).join("")));
+      keepalive = setInterval(() => {
+        controller.enqueue(encoder.encode(": keepalive\n\n"));
+      }, timing.keepaliveMs);
+      deadline = setTimeout(() => {
+        stop();
+        controller.close();
+      }, timing.holdMs);
+    },
+    cancel: stop
+  });
+  return new Response(body, { status: 200, headers: SSE_HEADERS });
+};
+const pausedSseResponse = (head, tail, pauseMs) => {
+  if (pauseMs <= 0) return sseResponse([...head, ...tail]);
+  const encoder = new TextEncoder();
+  let timer = null;
+  const body = new ReadableStream({
+    start: (controller) => {
+      controller.enqueue(encoder.encode(head.map(encodeEvent).join("")));
+      timer = setTimeout(() => {
+        timer = null;
+        controller.enqueue(encoder.encode(tail.map(encodeEvent).join("")));
+        controller.close();
+      }, pauseMs);
+    },
+    cancel: () => {
+      if (timer != null) clearTimeout(timer);
+      timer = null;
+    }
+  });
+  return new Response(body, { status: 200, headers: SSE_HEADERS });
+};
+export {
+  DEFAULT_HELD_STREAM_TIMING,
+  heldSseResponse,
+  jsonResponse,
+  pausedSseResponse,
+  sseEvent,
+  sseResponse
+};
+//# sourceMappingURL=sse.mjs.map

package/dist/modules/conformance/scripted-model/sse.mjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/conformance/scripted-model/sse.ts"],
+  "sourcesContent": ["import type { JsonValue } from \"../../json.mjs\";\n\n// Server-sent events and JSON responses for the scripted model's wires. Web\n// APIs only, so the same code serves from Node and workerd.\n\nexport interface SseEventIface {\n  // The `event:` field; chat completions send data-only events.\n  event: string | null;\n  // Serialized already (`[DONE]` is not JSON).\n  data: string;\n}\n\nexport const sseEvent = (event: string | null, data: JsonValue): SseEventIface => ({\n  event,\n  data: JSON.stringify(data),\n});\n\nconst encodeEvent = (event: SseEventIface): string =>\n  `${event.event == null ? '' : `event: ${event.event}\\n`}data: ${event.data}\\n\\n`;\n\nconst SSE_HEADERS = {\n  'content-type': 'text/event-stream',\n  'cache-control': 'no-cache',\n};\n\nexport const sseResponse = (events: SseEventIface[]): Response =>\n  new Response(events.map(encodeEvent).join(''), { status: 200, headers: SSE_HEADERS });\n\nexport const jsonResponse = (status: number, body: JsonValue): Response =>\n  new Response(JSON.stringify(body), {\n    status,\n    headers: { 'content-type': 'application/json' },\n  });\n\nexport interface HeldStreamTimingIface {\n  // How long a held response stays open before it ends unfinished.\n  holdMs: number;\n  // SSE comments while held, so proxies keep an idle stream open.\n  keepaliveMs: number;\n}\n\nexport const DEFAULT_HELD_STREAM_TIMING: HeldStreamTimingIface = {\n  holdMs: 10 * 60_000,\n  keepaliveMs: 15_000,\n};\n\n// Sends `events`, then keeps the response open (a model still generating)\n// until the caller aborts it, which cancels the body, or the hold ends.\nexport const heldSseResponse = (\n  events: SseEventIface[],\n  timing: HeldStreamTimingIface,\n): Response => {\n  const encoder = new TextEncoder();\n  let keepalive: ReturnType<typeof setInterval> | null = null;\n  let deadline: ReturnType<typeof setTimeout> | null = null;\n  const stop = (): void => {\n    if (keepalive != null) clearInterval(keepalive);\n    if (deadline != null) clearTimeout(deadline);\n    keepalive = null;\n    deadline = null;\n  };\n  const body = new ReadableStream<Uint8Array>({\n    start: (controller) => {\n      controller.enqueue(encoder.encode(events.map(encodeEvent).join('')));\n      keepalive = setInterval(() => {\n        controller.enqueue(encoder.encode(': keepalive\\n\\n'));\n      }, timing.keepaliveMs);\n      deadline = setTimeout(() => {\n        stop();\n        controller.close();\n      }, timing.holdMs);\n    },\n    cancel: stop,\n  });\n  return new Response(body, { status: 200, headers: SSE_HEADERS });\n};\n\n// Sends `head`, pauses `pauseMs` (a model thinking mid-reply), then `tail`;\n// an abort meanwhile cancels the body and the rest is never sent.\nexport const pausedSseResponse = (\n  head: SseEventIface[],\n  tail: SseEventIface[],\n  pauseMs: number,\n): Response => {\n  if (pauseMs <= 0) return sseResponse([...head, ...tail]);\n  const encoder = new TextEncoder();\n  let timer: ReturnType<typeof setTimeout> | null = null;\n  const body = new ReadableStream<Uint8Array>({\n    start: (controller) => {\n      controller.enqueue(encoder.encode(head.map(encodeEvent).join('')));\n      timer = setTimeout(() => {\n        timer = null;\n        controller.enqueue(encoder.encode(tail.map(encodeEvent).join('')));\n        controller.close();\n      }, pauseMs);\n    },\n    cancel: () => {\n      if (timer != null) clearTimeout(timer);\n      timer = null;\n    },\n  });\n  return new Response(body, { status: 200, headers: SSE_HEADERS });\n};\n"],
+  "mappings": "AAYO,MAAM,WAAW,CAAC,OAAsB,UAAoC;AAAA,EACjF;AAAA,EACA,MAAM,KAAK,UAAU,IAAI;AAC3B;AAEA,MAAM,cAAc,CAAC,UACnB,GAAG,MAAM,SAAS,OAAO,KAAK,UAAU,MAAM,KAAK;AAAA,CAAI,SAAS,MAAM,IAAI;AAAA;AAAA;AAE5E,MAAM,cAAc;AAAA,EAClB,gBAAgB;AAAA,EAChB,iBAAiB;AACnB;AAEO,MAAM,cAAc,CAAC,WAC1B,IAAI,SAAS,OAAO,IAAI,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,KAAK,SAAS,YAAY,CAAC;AAE/E,MAAM,eAAe,CAAC,QAAgB,SAC3C,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,EACjC;AAAA,EACA,SAAS,EAAE,gBAAgB,mBAAmB;AAChD,CAAC;AASI,MAAM,6BAAoD;AAAA,EAC/D,QAAQ,KAAK;AAAA,EACb,aAAa;AACf;AAIO,MAAM,kBAAkB,CAC7B,QACA,WACa;AACb,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,YAAmD;AACvD,MAAI,WAAiD;AACrD,QAAM,OAAO,MAAY;AACvB,QAAI,aAAa,KAAM,eAAc,SAAS;AAC9C,QAAI,YAAY,KAAM,cAAa,QAAQ;AAC3C,gBAAY;AACZ,eAAW;AAAA,EACb;AACA,QAAM,OAAO,IAAI,eAA2B;AAAA,IAC1C,OAAO,CAAC,eAAe;AACrB,iBAAW,QAAQ,QAAQ,OAAO,OAAO,IAAI,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;AACnE,kBAAY,YAAY,MAAM;AAC5B,mBAAW,QAAQ,QAAQ,OAAO,iBAAiB,CAAC;AAAA,MACtD,GAAG,OAAO,WAAW;AACrB,iBAAW,WAAW,MAAM;AAC1B,aAAK;AACL,mBAAW,MAAM;AAAA,MACnB,GAAG,OAAO,MAAM;AAAA,IAClB;AAAA,IACA,QAAQ;AAAA,EACV,CAAC;AACD,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,YAAY,CAAC;AACjE;AAIO,MAAM,oBAAoB,CAC/B,MACA,MACA,YACa;AACb,MAAI,WAAW,EAAG,QAAO,YAAY,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;AACvD,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,QAA8C;AAClD,QAAM,OAAO,IAAI,eAA2B;AAAA,IAC1C,OAAO,CAAC,eAAe;AACrB,iBAAW,QAAQ,QAAQ,OAAO,KAAK,IAAI,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;AACjE,cAAQ,WAAW,MAAM;AACvB,gBAAQ;AACR,mBAAW,QAAQ,QAAQ,OAAO,KAAK,IAAI,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;AACjE,mBAAW,MAAM;AAAA,MACnB,GAAG,OAAO;AAAA,IACZ;AAAA,IACA,QAAQ,MAAM;AACZ,UAAI,SAAS,KAAM,cAAa,KAAK;AACrC,cAAQ;AAAA,IACV;AAAA,EACF,CAAC;AACD,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,YAAY,CAAC;AACjE;",
+  "names": []
+}

package/dist/modules/conformance/v1-agent.d.mts

@@ -0,0 +1,24 @@
+import type { Stream } from '@agentclientprotocol/sdk/experimental/v2';
+export declare const V1_INITIALIZE_RESULT: {
+    protocolVersion: number;
+    agentCapabilities: {
+        loadSession: boolean;
+        promptCapabilities: {
+            image: boolean;
+            embeddedContext: boolean;
+        };
+        mcpCapabilities: {
+            http: boolean;
+        };
+    };
+    agentInfo: {
+        name: string;
+        version: string;
+    };
+    authMethods: never[];
+};
+export interface LegacyProtocolAgentIface {
+    stream: Stream;
+    received: string[];
+}
+export declare const createLegacyProtocolAgent: () => LegacyProtocolAgentIface;

package/dist/modules/conformance/v1-agent.mjs

@@ -0,0 +1,40 @@
+import * as z from "zod";
+const V1_INITIALIZE_RESULT = {
+  protocolVersion: 1,
+  agentCapabilities: {
+    loadSession: true,
+    promptCapabilities: { image: true, embeddedContext: true },
+    mcpCapabilities: { http: true }
+  },
+  agentInfo: { name: "acp-v1-fixture", version: "0.9.0" },
+  authMethods: []
+};
+const requestSchema = z.object({ id: z.union([z.string(), z.number()]), method: z.string() });
+const createLegacyProtocolAgent = () => {
+  const received = [];
+  const toClient = new TransformStream();
+  const writer = toClient.writable.getWriter();
+  const writable = new WritableStream({
+    write: async (wire) => {
+      for (const message of Array.isArray(wire) ? wire : [wire]) {
+        const request = requestSchema.safeParse(message);
+        if (!request.success) continue;
+        received.push(request.data.method);
+        await writer.write(
+          request.data.method === "initialize" ? { jsonrpc: "2.0", id: request.data.id, result: V1_INITIALIZE_RESULT } : {
+            jsonrpc: "2.0",
+            id: request.data.id,
+            error: { code: -32601, message: "this agent speaks ACP v1 only" }
+          }
+        );
+      }
+    },
+    close: () => writer.close().catch(() => void 0)
+  });
+  return { stream: { readable: toClient.readable, writable }, received };
+};
+export {
+  V1_INITIALIZE_RESULT,
+  createLegacyProtocolAgent
+};
+//# sourceMappingURL=v1-agent.mjs.map

package/dist/modules/conformance/v1-agent.mjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/conformance/v1-agent.ts"],
+  "sourcesContent": ["import type { AnyWireMessage, Stream } from '@agentclientprotocol/sdk/experimental/v2';\nimport * as z from 'zod';\n\n// An ACP v1 agent as a v2 client meets it: it answers `initialize` with the\n// latest version it speaks (1) in v1's shape (`agentCapabilities`,\n// `agentInfo`, no `info`) and errors every other request. Every party in the\n// plane must refuse it at `initialize` with `unsupported_protocol_version`; nothing negotiates or converts v1.\n\nexport const V1_INITIALIZE_RESULT = {\n  protocolVersion: 1,\n  agentCapabilities: {\n    loadSession: true,\n    promptCapabilities: { image: true, embeddedContext: true },\n    mcpCapabilities: { http: true },\n  },\n  agentInfo: { name: 'acp-v1-fixture', version: '0.9.0' },\n  authMethods: [],\n};\n\nconst requestSchema = z.object({ id: z.union([z.string(), z.number()]), method: z.string() });\n\nexport interface LegacyProtocolAgentIface {\n  // The client side of the connection: what a dialer would get.\n  stream: Stream;\n  // Methods the agent received, in order.\n  received: string[];\n}\n\nexport const createLegacyProtocolAgent = (): LegacyProtocolAgentIface => {\n  const received: string[] = [];\n  const toClient = new TransformStream<AnyWireMessage, AnyWireMessage>();\n  const writer = toClient.writable.getWriter();\n  const writable = new WritableStream<AnyWireMessage>({\n    write: async (wire) => {\n      for (const message of Array.isArray(wire) ? wire : [wire]) {\n        const request = requestSchema.safeParse(message);\n        if (!request.success) continue;\n        received.push(request.data.method);\n        await writer.write(\n          request.data.method === 'initialize'\n            ? { jsonrpc: '2.0', id: request.data.id, result: V1_INITIALIZE_RESULT }\n            : {\n                jsonrpc: '2.0',\n                id: request.data.id,\n                error: { code: -32601, message: 'this agent speaks ACP v1 only' },\n              },\n        );\n      }\n    },\n    close: () => writer.close().catch(() => undefined),\n  });\n  return { stream: { readable: toClient.readable, writable }, received };\n};\n"],
+  "mappings": "AACA,YAAY,OAAO;AAOZ,MAAM,uBAAuB;AAAA,EAClC,iBAAiB;AAAA,EACjB,mBAAmB;AAAA,IACjB,aAAa;AAAA,IACb,oBAAoB,EAAE,OAAO,MAAM,iBAAiB,KAAK;AAAA,IACzD,iBAAiB,EAAE,MAAM,KAAK;AAAA,EAChC;AAAA,EACA,WAAW,EAAE,MAAM,kBAAkB,SAAS,QAAQ;AAAA,EACtD,aAAa,CAAC;AAChB;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;AASrF,MAAM,4BAA4B,MAAgC;AACvE,QAAM,WAAqB,CAAC;AAC5B,QAAM,WAAW,IAAI,gBAAgD;AACrE,QAAM,SAAS,SAAS,SAAS,UAAU;AAC3C,QAAM,WAAW,IAAI,eAA+B;AAAA,IAClD,OAAO,OAAO,SAAS;AACrB,iBAAW,WAAW,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG;AACzD,cAAM,UAAU,cAAc,UAAU,OAAO;AAC/C,YAAI,CAAC,QAAQ,QAAS;AACtB,iBAAS,KAAK,QAAQ,KAAK,MAAM;AACjC,cAAM,OAAO;AAAA,UACX,QAAQ,KAAK,WAAW,eACpB,EAAE,SAAS,OAAO,IAAI,QAAQ,KAAK,IAAI,QAAQ,qBAAqB,IACpE;AAAA,YACE,SAAS;AAAA,YACT,IAAI,QAAQ,KAAK;AAAA,YACjB,OAAO,EAAE,MAAM,QAAQ,SAAS,gCAAgC;AAAA,UAClE;AAAA,QACN;AAAA,MACF;AAAA,IACF;AAAA,IACA,OAAO,MAAM,OAAO,MAAM,EAAE,MAAM,MAAM,MAAS;AAAA,EACnD,CAAC;AACD,SAAO,EAAE,QAAQ,EAAE,UAAU,SAAS,UAAU,SAAS,GAAG,SAAS;AACvE;",
+  "names": []
+}

package/dist/modules/credential-routes.d.mts

@@ -0,0 +1,24 @@
+import * as z from 'zod';
+export declare enum CredentialRoute {
+    Model = "model",
+    Mcp = "mcp",
+    Sandbox = "sandbox",
+    TranscriptStore = "transcript-store",
+    SubscriptionRelay = "subscription-relay",
+    FinalMcp = "final-mcp"
+}
+export interface RouteGrantIface {
+    route: CredentialRoute;
+    token: string;
+    expiresAt: string;
+}
+export declare const routeGrantSchema: z.ZodObject<{
+    route: z.ZodEnum<typeof CredentialRoute>;
+    token: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strip>;
+export declare const credentialRefreshRequestSchema: z.ZodObject<{
+    harnessSessionId: z.ZodString;
+    routes: z.ZodArray<z.ZodEnum<typeof CredentialRoute>>;
+}, z.core.$strip>;
+export type CredentialRefreshRequestIface = z.infer<typeof credentialRefreshRequestSchema>;

package/dist/modules/credential-routes.mjs

@@ -0,0 +1,25 @@
+import * as z from "zod";
+var CredentialRoute = /* @__PURE__ */ ((CredentialRoute2) => {
+  CredentialRoute2["Model"] = "model";
+  CredentialRoute2["Mcp"] = "mcp";
+  CredentialRoute2["Sandbox"] = "sandbox";
+  CredentialRoute2["TranscriptStore"] = "transcript-store";
+  CredentialRoute2["SubscriptionRelay"] = "subscription-relay";
+  CredentialRoute2["FinalMcp"] = "final-mcp";
+  return CredentialRoute2;
+})(CredentialRoute || {});
+const routeGrantSchema = z.object({
+  route: z.nativeEnum(CredentialRoute),
+  token: z.string().min(1),
+  expiresAt: z.string()
+});
+const credentialRefreshRequestSchema = z.object({
+  harnessSessionId: z.string().uuid(),
+  routes: z.array(z.nativeEnum(CredentialRoute)).min(1).max(8)
+});
+export {
+  CredentialRoute,
+  credentialRefreshRequestSchema,
+  routeGrantSchema
+};
+//# sourceMappingURL=credential-routes.mjs.map

package/dist/modules/credential-routes.mjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/credential-routes.ts"],
+  "sourcesContent": ["import * as z from 'zod';\n\n// Route-scoped, short-lived grants. A harness reads its model\n// credential through the broker's `model` route with `token`; it never sees a\n// subscription secret unless it is Final-managed and the grant says so. A leaf\n// module: a harness session's Durable Object evaluates it (with the relay\n// contract) before its started line, without the rest of harness.ts.\n\nexport enum CredentialRoute {\n  Model = 'model',\n  Mcp = 'mcp',\n  Sandbox = 'sandbox',\n  TranscriptStore = 'transcript-store',\n  SubscriptionRelay = 'subscription-relay',\n  // Attached only by the MCP host to the configured Final MCP endpoint.\n  FinalMcp = 'final-mcp',\n}\n\nexport interface RouteGrantIface {\n  route: CredentialRoute;\n  token: string;\n  expiresAt: string;\n}\n\nexport const routeGrantSchema = z.object({\n  route: z.nativeEnum(CredentialRoute),\n  token: z.string().min(1),\n  expiresAt: z.string(),\n}) satisfies z.ZodType<RouteGrantIface>;\n\n// The body of a refresh: the harness session the token belongs to and the\n// routes to renew (at-open harnesses: `model`, whose renewal carries `atOpen`;\n// `mcp` and `sandbox` for the MCP headers and sandbox endpoints they hold).\nexport const credentialRefreshRequestSchema = z.object({\n  harnessSessionId: z.string().uuid(),\n  routes: z.array(z.nativeEnum(CredentialRoute)).min(1).max(8),\n});\n\nexport type CredentialRefreshRequestIface = z.infer<typeof credentialRefreshRequestSchema>;\n"],
+  "mappings": "AAAA,YAAY,OAAO;AAQZ,IAAK,kBAAL,kBAAKA,qBAAL;AACL,EAAAA,iBAAA,WAAQ;AACR,EAAAA,iBAAA,SAAM;AACN,EAAAA,iBAAA,aAAU;AACV,EAAAA,iBAAA,qBAAkB;AAClB,EAAAA,iBAAA,uBAAoB;AAEpB,EAAAA,iBAAA,cAAW;AAPD,SAAAA;AAAA,GAAA;AAgBL,MAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,OAAO,EAAE,WAAW,eAAe;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,WAAW,EAAE,OAAO;AACtB,CAAC;AAKM,MAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,kBAAkB,EAAE,OAAO,EAAE,KAAK;AAAA,EAClC,QAAQ,EAAE,MAAM,EAAE,WAAW,eAAe,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAC7D,CAAC;",
+  "names": ["CredentialRoute"]
+}

package/dist/modules/credentials.d.mts

@@ -0,0 +1,206 @@
+import * as z from 'zod';
+import { DynamicEvent } from "./dynamic.mjs";
+export declare enum CredentialPayer {
+    AgentOwner = "agent-owner",
+    Organization = "organization",
+    PromptingUser = "prompting-user",
+    ConversationOwner = "conversation-owner"
+}
+export declare enum CredentialOwner {
+    Payer = "payer",
+    Organization = "organization"
+}
+export declare enum CredentialNodeKind {
+    Subscription = "subscription",
+    ApiKey = "api-key",
+    Platform = "platform",
+    HarnessOwned = "harness-owned",
+    Custom = "custom"
+}
+export declare enum InferenceCredentialKind {
+    Subscription = "subscription",
+    ApiKey = "api-key",
+    Platform = "platform",
+    HarnessOwned = "harness-owned"
+}
+export declare enum CredentialDelivery {
+    PerRequest = "per-request",
+    AtOpen = "at-open"
+}
+export declare const KNOWN_INFERENCE_VENDORS: readonly ["openai", "anthropic", "openrouter", "google", "bedrock"];
+export declare const subscriptionNodeSchema: z.ZodObject<{
+    kind: z.ZodLiteral<CredentialNodeKind.Subscription>;
+    owner: z.ZodEnum<typeof CredentialOwner>;
+    vendor: z.ZodOptional<z.ZodString>;
+    pin: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const apiKeyOwnerNodeSchema: z.ZodObject<{
+    pin: z.ZodOptional<z.ZodString>;
+    kind: z.ZodLiteral<CredentialNodeKind.ApiKey>;
+    owner: z.ZodEnum<typeof CredentialOwner>;
+    vendor: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const apiKeySecretNodeSchema: z.ZodObject<{
+    kind: z.ZodLiteral<CredentialNodeKind.ApiKey>;
+    secret: z.ZodString;
+    baseUrl: z.ZodOptional<z.ZodString>;
+    vendor: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const platformNodeSchema: z.ZodObject<{
+    kind: z.ZodLiteral<CredentialNodeKind.Platform>;
+    budget: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const harnessNodeSchema: z.ZodObject<{
+    kind: z.ZodLiteral<CredentialNodeKind.HarnessOwned>;
+}, z.core.$strip>;
+export declare const customNodeSchema: z.ZodObject<{
+    kind: z.ZodLiteral<CredentialNodeKind.Custom>;
+    resolver: z.ZodString;
+    events: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof DynamicEvent>>>;
+}, z.core.$strip>;
+export declare const credentialNodeSchema: z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodLiteral<CredentialNodeKind.Subscription>;
+    owner: z.ZodEnum<typeof CredentialOwner>;
+    vendor: z.ZodOptional<z.ZodString>;
+    pin: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<CredentialNodeKind.ApiKey>;
+    secret: z.ZodString;
+    baseUrl: z.ZodOptional<z.ZodString>;
+    vendor: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    pin: z.ZodOptional<z.ZodString>;
+    kind: z.ZodLiteral<CredentialNodeKind.ApiKey>;
+    owner: z.ZodEnum<typeof CredentialOwner>;
+    vendor: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<CredentialNodeKind.Platform>;
+    budget: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<CredentialNodeKind.HarnessOwned>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<CredentialNodeKind.Custom>;
+    resolver: z.ZodString;
+    events: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof DynamicEvent>>>;
+}, z.core.$strip>]>;
+export declare const credentialPolicySchema: z.ZodObject<{
+    payer: z.ZodEnum<typeof CredentialPayer>;
+    tryInOrder: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        kind: z.ZodLiteral<CredentialNodeKind.Subscription>;
+        owner: z.ZodEnum<typeof CredentialOwner>;
+        vendor: z.ZodOptional<z.ZodString>;
+        pin: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<CredentialNodeKind.ApiKey>;
+        secret: z.ZodString;
+        baseUrl: z.ZodOptional<z.ZodString>;
+        vendor: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        pin: z.ZodOptional<z.ZodString>;
+        kind: z.ZodLiteral<CredentialNodeKind.ApiKey>;
+        owner: z.ZodEnum<typeof CredentialOwner>;
+        vendor: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<CredentialNodeKind.Platform>;
+        budget: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<CredentialNodeKind.HarnessOwned>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<CredentialNodeKind.Custom>;
+        resolver: z.ZodString;
+        events: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof DynamicEvent>>>;
+    }, z.core.$strip>]>>;
+}, z.core.$strip>;
+export type SubscriptionNodeIface = z.infer<typeof subscriptionNodeSchema>;
+export type ApiKeyOwnerNodeIface = z.infer<typeof apiKeyOwnerNodeSchema>;
+export type ApiKeySecretNodeIface = z.infer<typeof apiKeySecretNodeSchema>;
+export type PlatformNodeIface = z.infer<typeof platformNodeSchema>;
+export type HarnessOwnedNodeIface = z.infer<typeof harnessNodeSchema>;
+export type CustomNodeIface = z.infer<typeof customNodeSchema>;
+export type CredentialNode = z.infer<typeof credentialNodeSchema>;
+export type CredentialPolicyIface = z.infer<typeof credentialPolicySchema>;
+export declare const customResolverResultSchema: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodLiteral<CredentialNodeKind.Subscription>;
+    owner: z.ZodEnum<typeof CredentialOwner>;
+    vendor: z.ZodOptional<z.ZodString>;
+    pin: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<CredentialNodeKind.ApiKey>;
+    secret: z.ZodString;
+    baseUrl: z.ZodOptional<z.ZodString>;
+    vendor: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    pin: z.ZodOptional<z.ZodString>;
+    kind: z.ZodLiteral<CredentialNodeKind.ApiKey>;
+    owner: z.ZodEnum<typeof CredentialOwner>;
+    vendor: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<CredentialNodeKind.Platform>;
+    budget: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<CredentialNodeKind.HarnessOwned>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<CredentialNodeKind.Custom>;
+    resolver: z.ZodString;
+    events: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof DynamicEvent>>>;
+}, z.core.$strip>]>, z.ZodObject<{
+    kind: z.ZodLiteral<CredentialNodeKind.ApiKey>;
+    value: z.ZodString;
+    vendor: z.ZodOptional<z.ZodString>;
+    baseUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>]>;
+export type CustomResolverResult = z.infer<typeof customResolverResultSchema>;
+interface SubscriptionArgsIface {
+    owner: CredentialOwner | `${CredentialOwner}`;
+    vendor?: string;
+    pin?: string;
+}
+interface ApiKeyOwnerArgsIface {
+    pin?: string;
+    owner: CredentialOwner | `${CredentialOwner}`;
+    vendor?: string;
+}
+interface ApiKeySecretArgsIface {
+    secret: string;
+    baseUrl?: string;
+    vendor?: string;
+}
+interface ChainArgsIface {
+    payer: CredentialPayer | `${CredentialPayer}`;
+    tryInOrder: CredentialNode[];
+}
+interface CustomResolverRefIface {
+    resolverExport: string;
+    events?: DynamicEvent[];
+}
+export declare const credentials: {
+    chain: (args: ChainArgsIface) => CredentialPolicyIface;
+    subscription: (args: SubscriptionArgsIface) => SubscriptionNodeIface;
+    apiKey: (args: ApiKeyOwnerArgsIface | ApiKeySecretArgsIface) => CredentialNode;
+    platform: (args?: {
+        budget?: string;
+    }) => PlatformNodeIface;
+    harness: () => HarnessOwnedNodeIface;
+    custom: (ref: CustomResolverRefIface) => CustomNodeIface;
+};
+export declare const defaultPersonalCredentialPolicy: () => CredentialPolicyIface;
+export declare const defaultOrganizationCredentialPolicy: () => CredentialPolicyIface;
+export declare const inferenceKindOfNode: (node: CredentialNode) => InferenceCredentialKind | null;
+export declare enum CredentialFailureReason {
+    SubscriptionNotConnected = "subscription_not_connected",
+    UsageExhausted = "usage_exhausted",
+    BudgetExceeded = "budget_exceeded",
+    CredentialInvalid = "credential_invalid",
+    HarnessIncompatible = "harness_incompatible"
+}
+export declare enum CredentialFallbackReason {
+    Archived = "archived",
+    Invalid = "invalid",
+    VendorMismatch = "vendor_mismatch",
+    Exhausted = "exhausted",
+    NotGranted = "not_granted",
+    OverBudget = "over_budget",
+    KindUnsupported = "kind_unsupported",
+    Missing = "missing"
+}
+export {};

package/dist/modules/credentials.mjs

@@ -0,0 +1,207 @@
+import * as z from "zod";
+import { DynamicEvent } from "./dynamic.mjs";
+var CredentialPayer = /* @__PURE__ */ ((CredentialPayer2) => {
+  CredentialPayer2["AgentOwner"] = "agent-owner";
+  CredentialPayer2["Organization"] = "organization";
+  CredentialPayer2["PromptingUser"] = "prompting-user";
+  CredentialPayer2["ConversationOwner"] = "conversation-owner";
+  return CredentialPayer2;
+})(CredentialPayer || {});
+var CredentialOwner = /* @__PURE__ */ ((CredentialOwner2) => {
+  CredentialOwner2["Payer"] = "payer";
+  CredentialOwner2["Organization"] = "organization";
+  return CredentialOwner2;
+})(CredentialOwner || {});
+var CredentialNodeKind = /* @__PURE__ */ ((CredentialNodeKind2) => {
+  CredentialNodeKind2["Subscription"] = "subscription";
+  CredentialNodeKind2["ApiKey"] = "api-key";
+  CredentialNodeKind2["Platform"] = "platform";
+  CredentialNodeKind2["HarnessOwned"] = "harness-owned";
+  CredentialNodeKind2["Custom"] = "custom";
+  return CredentialNodeKind2;
+})(CredentialNodeKind || {});
+var InferenceCredentialKind = /* @__PURE__ */ ((InferenceCredentialKind2) => {
+  InferenceCredentialKind2["Subscription"] = "subscription";
+  InferenceCredentialKind2["ApiKey"] = "api-key";
+  InferenceCredentialKind2["Platform"] = "platform";
+  InferenceCredentialKind2["HarnessOwned"] = "harness-owned";
+  return InferenceCredentialKind2;
+})(InferenceCredentialKind || {});
+var CredentialDelivery = /* @__PURE__ */ ((CredentialDelivery2) => {
+  CredentialDelivery2["PerRequest"] = "per-request";
+  CredentialDelivery2["AtOpen"] = "at-open";
+  return CredentialDelivery2;
+})(CredentialDelivery || {});
+const KNOWN_INFERENCE_VENDORS = [
+  "openai",
+  "anthropic",
+  "openrouter",
+  "google",
+  "bedrock"
+];
+const subscriptionNodeSchema = z.object({
+  kind: z.literal("subscription" /* Subscription */),
+  owner: z.nativeEnum(CredentialOwner),
+  vendor: z.string().min(1).optional(),
+  pin: z.string().min(1).optional()
+});
+const apiKeyOwnerNodeSchema = z.object({
+  pin: z.string().min(1).optional(),
+  kind: z.literal("api-key" /* ApiKey */),
+  owner: z.nativeEnum(CredentialOwner),
+  vendor: z.string().min(1).optional()
+});
+const apiKeySecretNodeSchema = z.object({
+  kind: z.literal("api-key" /* ApiKey */),
+  secret: z.string().min(1),
+  baseUrl: z.string().url().optional(),
+  vendor: z.string().min(1).optional()
+});
+const platformNodeSchema = z.object({
+  kind: z.literal("platform" /* Platform */),
+  budget: z.string().min(1).optional()
+});
+const harnessNodeSchema = z.object({
+  kind: z.literal("harness-owned" /* HarnessOwned */)
+});
+const customNodeSchema = z.object({
+  kind: z.literal("custom" /* Custom */),
+  // Bundle export of a defineDynamic resolver returning one of the other nodes,
+  // or `{ kind: 'api-key', value }` held in memory by the broker.
+  resolver: z.string().min(1),
+  events: z.array(z.nativeEnum(DynamicEvent)).default([DynamicEvent.SessionStarted])
+});
+const credentialNodeSchema = z.union([
+  subscriptionNodeSchema,
+  apiKeySecretNodeSchema,
+  apiKeyOwnerNodeSchema,
+  platformNodeSchema,
+  harnessNodeSchema,
+  customNodeSchema
+]);
+const credentialPolicySchema = z.object({
+  payer: z.nativeEnum(CredentialPayer),
+  tryInOrder: z.array(credentialNodeSchema).min(1)
+});
+const customResolverResultSchema = z.union([
+  credentialNodeSchema,
+  z.object({
+    kind: z.literal("api-key" /* ApiKey */),
+    value: z.string().min(1),
+    vendor: z.string().min(1).optional(),
+    baseUrl: z.string().url().optional()
+  })
+]);
+const ownerSchema = z.nativeEnum(CredentialOwner);
+const toOwner = (owner) => ownerSchema.parse(owner);
+const payerSchema = z.nativeEnum(CredentialPayer);
+const toPayer = (payer) => payerSchema.parse(payer);
+const credentials = {
+  chain: (args) => credentialPolicySchema.parse({ payer: toPayer(args.payer), tryInOrder: args.tryInOrder }),
+  subscription: (args) => {
+    const node = {
+      kind: "subscription" /* Subscription */,
+      owner: toOwner(args.owner)
+    };
+    if (args.vendor != null) node.vendor = args.vendor;
+    if (args.pin != null) node.pin = args.pin;
+    return node;
+  },
+  apiKey: (args) => {
+    if ("secret" in args) {
+      const node2 = { kind: "api-key" /* ApiKey */, secret: args.secret };
+      if (args.baseUrl != null) node2.baseUrl = args.baseUrl;
+      if (args.vendor != null) node2.vendor = args.vendor;
+      return node2;
+    }
+    const node = {
+      kind: "api-key" /* ApiKey */,
+      owner: toOwner(args.owner)
+    };
+    if (args.vendor != null) node.vendor = args.vendor;
+    if (args.pin != null) node.pin = args.pin;
+    return node;
+  },
+  platform: (args) => {
+    const node = { kind: "platform" /* Platform */ };
+    if (args?.budget != null) node.budget = args.budget;
+    return node;
+  },
+  harness: () => ({ kind: "harness-owned" /* HarnessOwned */ }),
+  custom: (ref) => ({
+    kind: "custom" /* Custom */,
+    resolver: ref.resolverExport,
+    events: ref.events ?? [DynamicEvent.SessionStarted]
+  })
+};
+const defaultPersonalCredentialPolicy = () => credentials.chain({
+  payer: "agent-owner" /* AgentOwner */,
+  tryInOrder: [
+    credentials.subscription({ owner: "payer" /* Payer */ }),
+    credentials.platform()
+  ]
+});
+const defaultOrganizationCredentialPolicy = () => credentials.chain({
+  payer: "organization" /* Organization */,
+  tryInOrder: [
+    credentials.subscription({ owner: "organization" /* Organization */ }),
+    credentials.platform()
+  ]
+});
+const inferenceKindOfNode = (node) => {
+  switch (node.kind) {
+    case "subscription" /* Subscription */:
+      return "subscription" /* Subscription */;
+    case "api-key" /* ApiKey */:
+      return "api-key" /* ApiKey */;
+    case "platform" /* Platform */:
+      return "platform" /* Platform */;
+    case "harness-owned" /* HarnessOwned */:
+      return "harness-owned" /* HarnessOwned */;
+    case "custom" /* Custom */:
+      return null;
+  }
+};
+var CredentialFailureReason = /* @__PURE__ */ ((CredentialFailureReason2) => {
+  CredentialFailureReason2["SubscriptionNotConnected"] = "subscription_not_connected";
+  CredentialFailureReason2["UsageExhausted"] = "usage_exhausted";
+  CredentialFailureReason2["BudgetExceeded"] = "budget_exceeded";
+  CredentialFailureReason2["CredentialInvalid"] = "credential_invalid";
+  CredentialFailureReason2["HarnessIncompatible"] = "harness_incompatible";
+  return CredentialFailureReason2;
+})(CredentialFailureReason || {});
+var CredentialFallbackReason = /* @__PURE__ */ ((CredentialFallbackReason2) => {
+  CredentialFallbackReason2["Archived"] = "archived";
+  CredentialFallbackReason2["Invalid"] = "invalid";
+  CredentialFallbackReason2["VendorMismatch"] = "vendor_mismatch";
+  CredentialFallbackReason2["Exhausted"] = "exhausted";
+  CredentialFallbackReason2["NotGranted"] = "not_granted";
+  CredentialFallbackReason2["OverBudget"] = "over_budget";
+  CredentialFallbackReason2["KindUnsupported"] = "kind_unsupported";
+  CredentialFallbackReason2["Missing"] = "missing";
+  return CredentialFallbackReason2;
+})(CredentialFallbackReason || {});
+export {
+  CredentialDelivery,
+  CredentialFailureReason,
+  CredentialFallbackReason,
+  CredentialNodeKind,
+  CredentialOwner,
+  CredentialPayer,
+  InferenceCredentialKind,
+  KNOWN_INFERENCE_VENDORS,
+  apiKeyOwnerNodeSchema,
+  apiKeySecretNodeSchema,
+  credentialNodeSchema,
+  credentialPolicySchema,
+  credentials,
+  customNodeSchema,
+  customResolverResultSchema,
+  defaultOrganizationCredentialPolicy,
+  defaultPersonalCredentialPolicy,
+  harnessNodeSchema,
+  inferenceKindOfNode,
+  platformNodeSchema,
+  subscriptionNodeSchema
+};
+//# sourceMappingURL=credentials.mjs.map