@yanlinglabs/winter-agent-runtime 0.0.29 → 0.0.30

package/dist/mcp-client.d.ts

@@ -1,14 +1,17 @@
-import type { McpServerConfigForProcessTransport } from "@yanlinglabs/winter-agent-sdk";
+import { type McpServerConfigForProcessTransport } from "@yanlinglabs/winter-agent-sdk";
 import { type ConnectedMcpClient } from "./mcp/client.js";
 import type { ElicitationAsker } from "./mcp/elicitation.js";
+import type { McpOAuthStore } from "./mcp-auth/store.js";
 export { McpConnectError, resolveVersionNegotiation, type ConnectedMcpClient, type McpConnectErrorCode, type McpToolInfo, type McpToolAnnotationsInfo, type McpResourceInfo, type McpResourceContent, type McpToolCallResult, } from "./mcp/client.js";
+export type { McpOAuthStore } from "./mcp-auth/store.js";
 export { createElicitationAsker, type ElicitationAction, type ElicitationAsker, type ElicitationRequestPayload, type ElicitationResultPayload, type ElicitationSender, } from "./mcp/elicitation.js";
 /**
  * What a HOST connects with -- deliberately narrower than the runtime's own options: no in-process
  * (`type: "sdk"`) server (a host that has the server object in hand does not need a protocol client to
  * reach it), no redirect refusal (the runtime's web search backend's concern) and no list-changed hook
  * (the runtime's lifecycle owns re-registration). Everything it references is exported from here or from
- * `@yanlinglabs/winter-agent-sdk`, so this subpath's declarations reach into nothing private.
+ * `@yanlinglabs/winter-agent-sdk` (WS-25's `McpOAuthStore` is re-exported here for `oauthStore`), so this
+ * subpath's declarations reach into nothing private.
  */
 export interface ConnectMcpServerOptions {
     /** The server's name: prefixes its diagnostics and is `ConnectedMcpClient.serverName`. */
@@ -23,6 +26,13 @@ export interface ConnectMcpServerOptions {
     elicitationAsk: ElicitationAsker;
     /** REQUIRED for a stdio server: the directory it starts in (never the host process's cwd by default). */
     cwd?: string;
+    /**
+     * WS-25 (MCP OAuth), narrow: the HOST's sign-in store. Present, an `http`/`sse` server without a static
+     * `Authorization` header connects with the stored bearer (from `@yanlinglabs/winter-agent-runtime/mcp-auth`'s
+     * records), and a dead sign-in rejects `needs_auth` without a request. A host IS the refresher, so an
+     * expired token with a refresh token is refreshed IN THIS PROCESS (single-flight, generation-checked).
+     */
+    oauthStore?: McpOAuthStore;
 }
 /** Connect ONE MCP server and return its live client. Rejects with a typed `McpConnectError` (see its `code`). */
 export declare function connectMcpServer(opts: ConnectMcpServerOptions): Promise<ConnectedMcpClient>;

package/dist/mcp-client.js

@@ -1,20 +1,33 @@
 import {
   createElicitationAsker2,
+  createSessionAuthProvider,
+  mcpSignInHint,
   McpConnectError2,
   resolveVersionNegotiation2,
   connectMcpServer2
-} from "./index-8jgwp1px.js";
+} from "./index-9s68t0pd.js";
+import"./index-z6s3r4xm.js";
 
 // src/mcp-client.ts
+import { WINTER_BRAND } from "@yanlinglabs/winter-agent-sdk";
 function connectMcpServer(opts) {
   return connectMcpServer2({
     name: opts.name,
     config: opts.config,
     connectTimeoutMs: opts.connectTimeoutMs,
     elicitationAsk: opts.elicitationAsk,
-    ...opts.cwd !== undefined ? { cwd: opts.cwd } : {}
+    ...opts.cwd !== undefined ? { cwd: opts.cwd } : {},
+    ...hostAuth(opts)
   });
 }
+function hostAuth(opts) {
+  const { config, oauthStore } = opts;
+  if (oauthStore === undefined || config.type !== "http" && config.type !== "sse")
+    return {};
+  if (Object.keys(config.headers ?? {}).some((h) => h.toLowerCase() === "authorization"))
+    return {};
+  return { auth: createSessionAuthProvider({ serverName: opts.name, serverUrl: config.url, oauth: { store: oauthStore, signInHint: (name) => mcpSignInHint(WINTER_BRAND, name) } }) };
+}
 export {
   McpConnectError2 as McpConnectError,
   connectMcpServer,

package/dist/production-wiring.d.ts

@@ -11,6 +11,8 @@ import type { CompactionController } from "./compaction/seam.js";
 import type { StructuredOutputSeam } from "./structured/seam.js";
 import type { FileCheckpointSink } from "./checkpoint/seam.js";
 import { type SessionProviderOptions, type SessionProviderWiring } from "./provider/session-provider.js";
+import { type HostCredentialChannel } from "./provider/host-credentials.js";
+import { type McpOAuthStore } from "./mcp-auth/store.js";
 import type { ProviderStateRecordInput } from "./store/provider-state.js";
 import type { ClassifierInterface } from "./permissions/auto/engine.js";
 import { type SlotProviderResolution } from "./provider/slots.js";
@@ -219,6 +221,10 @@ export interface ProductionWiring {
             workflowsPaths?: readonly string[];
         }[];
         extraMcpServerSources: readonly McpServerSource[];
+        /** WS-25: where the session reads its MCP sign-ins (the session's Keychain service; the test seam's file under `verify:mcp-oauth`; the host, §7). */
+        mcpOAuthStore: McpOAuthStore;
+        /** WS-25 §7: present when the host resolves credentials; `runEngine` binds it to its control bridge. */
+        hostCredentialChannel?: HostCredentialChannel;
         initSlashCommands: readonly string[];
         initSkills: readonly string[];
         initPlugins: readonly InitPluginInfo[];

package/dist/provider/host-credentials.d.ts

@@ -0,0 +1,48 @@
+import { type CredentialRef } from "@yanlinglabs/winter-agent-sdk";
+import { type CredentialMaterial, type CredentialStore } from "@yanlinglabs/winter-provider-runtime";
+import { type KeychainSecretReader } from "./keychain-store.js";
+type KeychainRef = Extract<CredentialRef, {
+    kind: "keychain";
+}>;
+/** The narrow bridge shape this needs (the runtime's `RpcBridge` satisfies it). */
+export interface HostRequestSender {
+    request<T = unknown>(subtype: string, payload: unknown, opts?: {
+        timeoutMs?: number;
+    }): Promise<T>;
+}
+/**
+ * The session's line to its host, BOUND LATE: production wiring builds the credential stores before the
+ * engine exists, and the engine's control bridge is created inside `runEngine`, which binds it here
+ * first thing. A request made before the bind waits for it (bounded).
+ */
+export interface HostCredentialChannel extends HostRequestSender {
+    bind(sender: HostRequestSender): void;
+}
+/** How long one `credential_resolve` may take (the host may be refreshing). */
+export declare const HOST_CREDENTIAL_TIMEOUT_MS = 60000;
+/** How long a request waits for the engine to bind the channel before failing typed. */
+export declare const HOST_CREDENTIAL_BIND_TIMEOUT_MS = 30000;
+export declare function createHostCredentialChannel(opts?: {
+    bindTimeoutMs?: number;
+}): HostCredentialChannel;
+export interface HostResolved {
+    material: string;
+    generation: number;
+    expiresAt?: number;
+}
+/**
+ * ONE `credential_resolve` round trip. `null` for `not_found` (the session behaves as with an empty
+ * Keychain); every other failure throws a typed, ref-named error -- never the material, never the host's
+ * own error text.
+ */
+export declare function resolveFromHost(sender: HostRequestSender, ref: KeychainRef, minGeneration?: number): Promise<HostResolved | null>;
+/**
+ * The Keychain MEMBER of a host-brokered session's credential store. Serves `keychain` refs only (every
+ * other kind is `unsupported`, so the composite asks the env/file/inline members as before).
+ */
+export declare function createHostBrokeredCredentialStore(sender: HostRequestSender): CredentialStore & {
+    refresh(ref: KeychainRef): Promise<CredentialMaterial>;
+};
+/** A host-brokered session's RAW tool-secret reader (the Exa key and friends): the item's string, uninterpreted. */
+export declare function createHostBrokeredSecretReader(sender: HostRequestSender): KeychainSecretReader;
+export {};

package/dist/provider/keychain-store.d.ts

@@ -1,4 +1,4 @@
-import type { CredentialStore } from "@yanlinglabs/winter-provider-runtime";
+import type { CredentialMaterial, CredentialStore } from "@yanlinglabs/winter-provider-runtime";
 import { DEFAULT_KEYCHAIN_SERVICE, type CredentialRef } from "@yanlinglabs/winter-agent-sdk";
 export { DEFAULT_KEYCHAIN_SERVICE };
 /**
@@ -55,5 +55,33 @@ export type KeychainSecretReader = (ref: Extract<CredentialRef, {
  * The ref's own `service` wins over the session's, exactly as in `get`.
  */
 export declare function createKeychainSecretReader(service?: string, opts?: KeychainCredentialStoreOptions): KeychainSecretReader;
+/**
+ * WS-25 (MCP OAuth): a RAW string store over ONE Keychain service -- `read`/`write`/`remove` of an
+ * uninterpreted value under an account name. It is the default `McpOAuthStore` (`mcp-auth/store.ts`):
+ * an MCP sign-in record is JSON this SDK writes and validates itself (`mcp-auth/records.ts`), not a
+ * provider's `CredentialMaterial`, so neither `get` above (which insists on material) nor the reader
+ * (read-only) fits. It lives HERE for the same reason the reader does: this is the one file allowed to
+ * name the secrets backend.
+ *
+ * Every failure is the same typed, account-named `io` error the rest of this file raises; the value is
+ * never quoted, and neither is the backend's own message (it can quote the item).
+ *
+ * SIZE (WS-25 spec §4.1, measured -- `mcp-auth/size-gate.test.ts`, opt-in): `Bun.secrets` round-trips a
+ * 4 MiB value intact on macOS 26, so an item's size is not what splits a sign-in into two items (an
+ * access + refresh token record is a few KiB at most). The 4096-byte limit Claude Code hit is the
+ * `security -i` command line's, a tool Winter never drives.
+ */
+export interface KeychainRawStore {
+    read(account: string): Promise<string | null>;
+    write(account: string, value: string): Promise<void>;
+    remove(account: string): Promise<void>;
+}
+export declare function createKeychainRawStore(service?: string, opts?: KeychainCredentialStoreOptions): KeychainRawStore;
 /** `account = "<providerId>:<accountId>"` (R6-10). One helper, so a caller never assembles the key by hand and drifts. */
 export declare function keychainAccountName(providerId: string, accountId: string): string;
+/**
+ * WS-25 §7: the SAME interpretation `get` applies to a Keychain item's string, for a value that arrived
+ * another way (a host-brokered session receives the item's string from its host). Typed errors name the
+ * ref, never the value.
+ */
+export declare function parseStoredCredentialMaterial(raw: string, ref: CredentialRef): CredentialMaterial;

package/dist/provider/session-provider.d.ts

@@ -317,7 +317,7 @@ export declare const DEFAULT_PROVIDER_ACCOUNT_ID = "default";
  * `keychain-store.ts` resolves `Bun.secrets` LAZILY — a session with no keychain ref never touches
  * it, and a runtime without it reports a typed failure at the point of use rather than at import.
  */
-export declare function createProductionCredentialStore(config: RuntimeConfig, env: Record<string, string | undefined>, home: string): CredentialStore;
+export declare function createProductionCredentialStore(config: RuntimeConfig, env: Record<string, string | undefined>, home: string, keychainMember?: CredentialStore): CredentialStore;
 /**
  * The connection profile for one resolved provider.
  *

package/dist/store/dialect.d.ts

@@ -478,7 +478,7 @@ export declare class TranscriptWriter implements SessionPersistence {
     private dialectRecord;
     static readBack(store: SessionStore, key: SessionKey): Promise<SessionStoreEntry[]>;
 }
-export declare const RUNTIME_ENGINE_VERSION = "0.0.29";
+export declare const RUNTIME_ENGINE_VERSION = "0.0.30";
 export interface ResolvedEngineSession {
     config: RuntimeConfig;
     store: SessionPersistence | undefined;

package/dist/testing.js

@@ -3,8 +3,10 @@ import {
   runEngine2,
   echoProvider2,
   resolveEngineSession2
-} from "./index-jz5d90c6.js";
-import"./index-8jgwp1px.js";
+} from "./index-51673qbw.js";
+import"./index-9s68t0pd.js";
+import"./index-z6s3r4xm.js";
+import"./index-bgeqc7ax.js";
 import"./index-bef62z3r.js";
 import {
   registerDefaultChildEngineFactory,
@@ -12,7 +14,7 @@ import {
   buildProductionWiring,
   withAutoSkillPermissions,
   restoreChildRoster
-} from "./index-gmxxtqpe.js";
+} from "./index-9df1q7j4.js";
 import {
   Queue
 } from "./index-97t2rmtf.js";

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.0.29";
+export declare const RUNTIME_VERSION = "0.0.30";

package/dist/version.js

@@ -1,5 +1,5 @@
 // src/version.ts
-var RUNTIME_VERSION = "0.0.29";
+var RUNTIME_VERSION = "0.0.30";
 export {
   RUNTIME_VERSION
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yanlinglabs/winter-agent-runtime",
-  "version": "0.0.29",
+  "version": "0.0.30",
   "license": "MIT",
   "type": "module",
   "engines": {
@@ -49,6 +49,10 @@
     "./mcp-client": {
       "types": "./dist/mcp-client.d.ts",
       "default": "./dist/mcp-client.js"
+    },
+    "./mcp-auth": {
+      "types": "./dist/mcp-auth.d.ts",
+      "default": "./dist/mcp-auth.js"
     }
   },
   "files": [
@@ -69,9 +73,9 @@
     "@modelcontextprotocol/client": "^2.1.0",
     "ajv": "^8.20.0",
     "ignore": "7.0.5",
-    "@yanlinglabs/winter-agent-sdk": "0.0.29",
-    "@yanlinglabs/winter-provider-catalog": "0.0.29",
-    "@yanlinglabs/winter-provider-runtime": "0.0.29"
+    "@yanlinglabs/winter-agent-sdk": "0.0.30",
+    "@yanlinglabs/winter-provider-runtime": "0.0.30",
+    "@yanlinglabs/winter-provider-catalog": "0.0.30"
   },
   "devDependencies": {
     "@modelcontextprotocol/server": "^2.1.0"