agentfootprint 10.4.0 → 10.5.0

package/dist/esm/identity/requestContext.d.ts

@@ -0,0 +1,96 @@
+/**
+ * requestContext — the INCOMING REQUEST's secrets, sealed for one run.
+ *
+ * A host that receives a per-request credential (an encrypted token in a
+ * header, a session-bound key) seals it here and hands the handle to the run:
+ *
+ * ```ts
+ * const request = requestContext({ secrets: { mcpToken: req.headers['x-mcp-token'] } });
+ * await agent.run({ message }, { request });
+ * ```
+ *
+ * ── Why a sealed handle and not a plain object ──────────────────────────────
+ * The run's input, its options and its state all travel: input and state into
+ * the commit log, the recorders and every exporter; options into whatever a
+ * host logs. A plain `{ mcpToken: '…' }` would ride all of them. The handle
+ * holds NOTHING an enumeration, `JSON.stringify`, `structuredClone` or an
+ * inspector can reach — the values live in a module-private `WeakMap` keyed by
+ * the handle, and only {@link requestSecretOf} (internal, never on a door)
+ * reads them. So the handle can sit in an options bag, be logged by accident,
+ * or be copied, and nothing secret moves with it.
+ *
+ * ── Who reads it ─────────────────────────────────────────────────────────────
+ * Only a credential provider, through `CredentialRequest.request`, which the
+ * framework fills from the run the call belongs to (`bindRequest`). The model
+ * never sees it, no stage writes it to scope, and a tool reaches what it
+ * vends only as `ctx.credential`.
+ *
+ * ── One request, one run ─────────────────────────────────────────────────────
+ * The framework decides WHICH handle a call carries — the agent's own run, or
+ * the run a composition opened for its members (`core/memberRun.ts`). A call
+ * with no run that carries a request gets none: a request credential then
+ * fails closed (`requestCredentials`), and is never borrowed from another run.
+ *
+ * Pattern: sealed value object (module-private WeakMap). Role: identity, run input.
+ */
+import type { CredentialProvider } from './types.js';
+/** What {@link requestContext} takes. */
+export interface RequestContextOptions {
+    /**
+     * The request's secrets, by name — `{ mcpToken: '<from the header>' }`.
+     * Each value must be a non-empty string; names are compared exactly.
+     */
+    readonly secrets: Readonly<Record<string, string>>;
+}
+/**
+ * The incoming request's secrets, sealed. Opaque: it has no readable fields,
+ * serializes as a fixed placeholder, and is recognised by the framework only
+ * when {@link requestContext} built it.
+ */
+export interface RequestContext {
+    /** Type-only brand: no value carries it at run time. A value built anywhere
+     *  else is refused at the door (`assertRequestContext`), never read. */
+    readonly [requestContextBrand]: never;
+}
+/** The brand's key — declared, never created; it exists only in the types. */
+declare const requestContextBrand: unique symbol;
+/**
+ * Seal an incoming request's secrets for one run. Pass the result as
+ * `run(input, { request })` (or `resume(…, { request })`); a credential
+ * provider built by `requestCredentials` reads it there.
+ *
+ * @throws TypeError when `secrets` is not a plain object of non-empty strings.
+ */
+export declare function requestContext(options: RequestContextOptions): RequestContext;
+/** Whether `value` is a handle {@link requestContext} built. */
+export declare function isRequestContext(value: unknown): value is RequestContext;
+/**
+ * Refuse a `request` that {@link requestContext} did not build — at the door
+ * the caller used, before anything moves. A plain object would carry its
+ * values wherever the options travel.
+ *
+ * @throws TypeError naming the door.
+ */
+export declare function assertRequestContext(value: unknown, door: string): void;
+/**
+ * The secret a sealed request holds under `name`, or `undefined`.
+ *
+ * @internal Never re-exported on a door. The only reader is a credential
+ * provider in this folder, which turns it into a `Credential` for one call.
+ */
+export declare function requestSecretOf(request: unknown, name: string): string | undefined;
+/**
+ * The provider a call of ONE run is handed: a `getCredential` for `service` —
+ * the service the calling tool DECLARES in its `needs` — carries that run's
+ * request, and only that run's. A request the caller put on the request
+ * itself is always replaced (or removed), so a tool cannot present another
+ * run's handle through `ctx.credentials`; and a call for any OTHER service
+ * carries no request, so a tool cannot pull a request credential it never
+ * declared. `service` undefined → no call carries a request.
+ *
+ * Every other field passes through untouched; the provider's `id` is kept.
+ *
+ * @internal The framework's binding; not on a door.
+ */
+export declare function bindRequest(provider: CredentialProvider, request: RequestContext | undefined, service: string | undefined): CredentialProvider;
+export {};

package/dist/esm/identity/requestContext.js

@@ -0,0 +1,131 @@
+/**
+ * requestContext — the INCOMING REQUEST's secrets, sealed for one run.
+ *
+ * A host that receives a per-request credential (an encrypted token in a
+ * header, a session-bound key) seals it here and hands the handle to the run:
+ *
+ * ```ts
+ * const request = requestContext({ secrets: { mcpToken: req.headers['x-mcp-token'] } });
+ * await agent.run({ message }, { request });
+ * ```
+ *
+ * ── Why a sealed handle and not a plain object ──────────────────────────────
+ * The run's input, its options and its state all travel: input and state into
+ * the commit log, the recorders and every exporter; options into whatever a
+ * host logs. A plain `{ mcpToken: '…' }` would ride all of them. The handle
+ * holds NOTHING an enumeration, `JSON.stringify`, `structuredClone` or an
+ * inspector can reach — the values live in a module-private `WeakMap` keyed by
+ * the handle, and only {@link requestSecretOf} (internal, never on a door)
+ * reads them. So the handle can sit in an options bag, be logged by accident,
+ * or be copied, and nothing secret moves with it.
+ *
+ * ── Who reads it ─────────────────────────────────────────────────────────────
+ * Only a credential provider, through `CredentialRequest.request`, which the
+ * framework fills from the run the call belongs to (`bindRequest`). The model
+ * never sees it, no stage writes it to scope, and a tool reaches what it
+ * vends only as `ctx.credential`.
+ *
+ * ── One request, one run ─────────────────────────────────────────────────────
+ * The framework decides WHICH handle a call carries — the agent's own run, or
+ * the run a composition opened for its members (`core/memberRun.ts`). A call
+ * with no run that carries a request gets none: a request credential then
+ * fails closed (`requestCredentials`), and is never borrowed from another run.
+ *
+ * Pattern: sealed value object (module-private WeakMap). Role: identity, run input.
+ */
+/** The sealed values, keyed by handle. Module-private: nothing else can read them. */
+const sealed = new WeakMap();
+const PLACEHOLDER = '[request context]';
+/**
+ * Seal an incoming request's secrets for one run. Pass the result as
+ * `run(input, { request })` (or `resume(…, { request })`); a credential
+ * provider built by `requestCredentials` reads it there.
+ *
+ * @throws TypeError when `secrets` is not a plain object of non-empty strings.
+ */
+export function requestContext(options) {
+    const secrets = options?.secrets;
+    if (secrets === null || typeof secrets !== 'object' || Array.isArray(secrets)) {
+        throw new TypeError('requestContext: `secrets` must be an object of name → string.');
+    }
+    const values = new Map();
+    for (const name of Object.keys(secrets)) {
+        const value = secrets[name];
+        if (name === '')
+            throw new TypeError('requestContext: a secret name must not be empty.');
+        // The NAME is safe to say; the value never is.
+        if (typeof value !== 'string' || value === '') {
+            throw new TypeError(`requestContext: secret '${name}' must be a non-empty string — an absent value is ` +
+                'left out, never passed empty.');
+        }
+        values.set(name, value);
+    }
+    const handle = Object.create(handleProto);
+    Object.freeze(handle);
+    sealed.set(handle, values);
+    return handle;
+}
+/**
+ * The handle's prototype — every reader that might print or copy it gets the
+ * placeholder. No own properties, so `Object.keys`, a spread or
+ * `structuredClone` yields `{}`.
+ */
+const handleProto = Object.freeze({
+    toJSON: () => PLACEHOLDER,
+    toString: () => PLACEHOLDER,
+    [Symbol.toStringTag]: 'RequestContext',
+    [Symbol.for('nodejs.util.inspect.custom')]: () => PLACEHOLDER,
+});
+/** Whether `value` is a handle {@link requestContext} built. */
+export function isRequestContext(value) {
+    return typeof value === 'object' && value !== null && sealed.has(value);
+}
+/**
+ * Refuse a `request` that {@link requestContext} did not build — at the door
+ * the caller used, before anything moves. A plain object would carry its
+ * values wherever the options travel.
+ *
+ * @throws TypeError naming the door.
+ */
+export function assertRequestContext(value, door) {
+    if (value === undefined || isRequestContext(value))
+        return;
+    throw new TypeError(`${door}: \`request\` must be built by requestContext({ secrets }) — a plain object is ` +
+        'refused, because its values would travel wherever these options are logged or copied.');
+}
+/**
+ * The secret a sealed request holds under `name`, or `undefined`.
+ *
+ * @internal Never re-exported on a door. The only reader is a credential
+ * provider in this folder, which turns it into a `Credential` for one call.
+ */
+export function requestSecretOf(request, name) {
+    if (typeof request !== 'object' || request === null)
+        return undefined;
+    return sealed.get(request)?.get(name);
+}
+/**
+ * The provider a call of ONE run is handed: a `getCredential` for `service` —
+ * the service the calling tool DECLARES in its `needs` — carries that run's
+ * request, and only that run's. A request the caller put on the request
+ * itself is always replaced (or removed), so a tool cannot present another
+ * run's handle through `ctx.credentials`; and a call for any OTHER service
+ * carries no request, so a tool cannot pull a request credential it never
+ * declared. `service` undefined → no call carries a request.
+ *
+ * Every other field passes through untouched; the provider's `id` is kept.
+ *
+ * @internal The framework's binding; not on a door.
+ */
+export function bindRequest(provider, request, service) {
+    return {
+        id: provider.id,
+        getCredential(req) {
+            const { request: _presented, ...rest } = req;
+            void _presented;
+            const carries = request !== undefined && service !== undefined && req.service === service;
+            return provider.getCredential(carries ? { ...rest, request } : rest);
+        },
+    };
+}
+//# sourceMappingURL=requestContext.js.map

package/dist/esm/identity/requestContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestContext.js","sourceRoot":"","sources":["../../../src/identity/requestContext.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAIH,sFAAsF;AACtF,MAAM,MAAM,GAAG,IAAI,OAAO,EAAuC,CAAC;AAyBlE,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,MAAM,OAAO,GAAI,OAAsD,EAAE,OAAO,CAAC;IACjF,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,SAAS,CAAC,+DAA+D,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,IAAI,KAAK,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;QACzF,+CAA+C;QAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,SAAS,CACjB,2BAA2B,IAAI,oDAAoD;gBACjF,+BAA+B,CAClC,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAmB,CAAC;IAC5D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,WAAW,GAAW,MAAM,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW;IACzB,QAAQ,EAAE,GAAG,EAAE,CAAC,WAAW;IAC3B,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,gBAAgB;IACtC,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,WAAW;CAC9D,CAAC,CAAC;AAEH,gEAAgE;AAChE,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc,EAAE,IAAY;IAC/D,IAAI,KAAK,KAAK,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO;IAC3D,MAAM,IAAI,SAAS,CACjB,GAAG,IAAI,iFAAiF;QACtF,uFAAuF,CAC1F,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgB,EAAE,IAAY;IAC5D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtE,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CACzB,QAA4B,EAC5B,OAAmC,EACnC,OAA2B;IAE3B,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,aAAa,CAAC,GAAsB;YAClC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;YAC7C,KAAK,UAAU,CAAC;YAChB,MAAM,OAAO,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC;YAC1F,OAAO,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/identity/requestCredentials.d.ts

@@ -0,0 +1,99 @@
+/**
+ * requestCredentials — a {@link CredentialProvider} fed from the INCOMING
+ * REQUEST: the credential a tool uses is the one this run's caller sent.
+ *
+ * ```ts
+ * import { requestCredentials, requestContext, decodedWith } from 'agentfootprint/security';
+ *
+ * // Once, at boot — no secret in here:
+ * const credentials = requestCredentials({
+ *   services: {
+ *     crm: 'crmToken',                                         // bearer, as sent
+ *     billing: { secret: 'billingKey', as: asApiKey('x-api-key') },
+ *     mcp: { secret: 'mcpToken', as: decodedWith((raw) => decrypt(raw)) },
+ *   },
+ * });
+ * const agent = Agent.create({ provider, credentials }).tool(crmTool).build();
+ *
+ * // Per request:
+ * await agent.run({ message }, { request: requestContext({ secrets: { crmToken, mcpToken } }) });
+ * ```
+ *
+ * A tool declares `needs: { credential: 'crm' }` and reads `ctx.credential`,
+ * exactly as with any other provider. Nothing about the tool changes.
+ *
+ * ── Interface → adapter → strategies ────────────────────────────────────────
+ * The interface is the `CredentialProvider` port. This adapter reads the
+ * secret named for the service from the request the call belongs to
+ * (`CredentialRequest.request`, filled by the framework). A strategy turns the
+ * raw value into a `Credential`: {@link asBearer} (the default),
+ * {@link asApiKey}, or {@link decodedWith} for a value that must be decrypted
+ * or exchanged first.
+ *
+ * ── Fails closed, by name ───────────────────────────────────────────────────
+ * Every refusal is a {@link RequestCredentialError} naming the SERVICE and the
+ * secret's NAME — never a value, and never a strategy's own error text (a
+ * decrypt library may quote its input). A thrown message reaches the model as
+ * the tool result and rides `agentfootprint.credential.failed`.
+ *   - no request on the call (a run started without one, a mount no run
+ *     reaches, a connection-level caller) → `'no-request'`;
+ *   - the request does not carry the secret → `'missing'`;
+ *   - a service this provider was not told about → `'unknown-service'`;
+ *   - the strategy threw or returned no credential → `'undecodable'`.
+ * There is no fallback: a missing per-request credential is never served from
+ * another request, a default, or the process.
+ *
+ * Pattern: Adapter (port) + Strategy (raw value → Credential).
+ */
+import type { Credential, CredentialProvider } from './types.js';
+/** Raw request value → the credential a tool applies. May be async (decrypt, exchange). */
+export type RequestCredentialStrategy = (raw: string) => Credential | Promise<Credential>;
+/** Where a service's credential comes from in the request, and how it is read. */
+export interface RequestCredentialSource {
+    /** The secret's name in `requestContext({ secrets })`. */
+    readonly secret: string;
+    /** How the raw value becomes a credential. Default {@link asBearer}. */
+    readonly as?: RequestCredentialStrategy;
+}
+/** What {@link requestCredentials} takes. */
+export interface RequestCredentialsOptions {
+    /** Optional id (defaults to `'request-credentials'`). */
+    readonly id?: string;
+    /**
+     * Service id (what a tool's `needs.credential` names) → its source. A string
+     * is the secret's name, read as a bearer token.
+     */
+    readonly services: Readonly<Record<string, string | RequestCredentialSource>>;
+}
+/** Why a request credential was refused. */
+export type RequestCredentialRefusal = 'no-request' | 'missing' | 'unknown-service' | 'undecodable';
+/**
+ * A request credential that could not be served. Its message names the
+ * service and the secret's name; it never carries a value or a strategy's
+ * own error.
+ */
+export declare class RequestCredentialError extends Error {
+    readonly reason: RequestCredentialRefusal;
+    readonly service: string;
+    readonly code: "ERR_REQUEST_CREDENTIAL";
+    constructor(reason: RequestCredentialRefusal, service: string, message: string);
+}
+/** The raw value, as a bearer token (`Authorization: Bearer …`). The default. */
+export declare function asBearer(): RequestCredentialStrategy;
+/** The raw value, as an API key in one header (default `x-api-key`). */
+export declare function asApiKey(headerName?: string): RequestCredentialStrategy;
+/**
+ * Decode the raw value first — decrypt an encrypted per-request token,
+ * exchange it — then read the result with `then` (default {@link asBearer}).
+ * `decode` may return the plain value or a finished `Credential`. Whatever it
+ * throws is replaced by an `'undecodable'` refusal that quotes nothing.
+ */
+export declare function decodedWith(decode: (raw: string) => string | Credential | Promise<string | Credential>, then?: RequestCredentialStrategy): RequestCredentialStrategy;
+/**
+ * Build the provider. Configuration is checked here, at boot: an empty
+ * service map, an empty secret name or a strategy that is not a function is
+ * refused by name.
+ *
+ * @throws TypeError on a malformed `services` map.
+ */
+export declare function requestCredentials(options: RequestCredentialsOptions): CredentialProvider;

package/dist/esm/identity/requestCredentials.js

@@ -0,0 +1,157 @@
+/**
+ * requestCredentials — a {@link CredentialProvider} fed from the INCOMING
+ * REQUEST: the credential a tool uses is the one this run's caller sent.
+ *
+ * ```ts
+ * import { requestCredentials, requestContext, decodedWith } from 'agentfootprint/security';
+ *
+ * // Once, at boot — no secret in here:
+ * const credentials = requestCredentials({
+ *   services: {
+ *     crm: 'crmToken',                                         // bearer, as sent
+ *     billing: { secret: 'billingKey', as: asApiKey('x-api-key') },
+ *     mcp: { secret: 'mcpToken', as: decodedWith((raw) => decrypt(raw)) },
+ *   },
+ * });
+ * const agent = Agent.create({ provider, credentials }).tool(crmTool).build();
+ *
+ * // Per request:
+ * await agent.run({ message }, { request: requestContext({ secrets: { crmToken, mcpToken } }) });
+ * ```
+ *
+ * A tool declares `needs: { credential: 'crm' }` and reads `ctx.credential`,
+ * exactly as with any other provider. Nothing about the tool changes.
+ *
+ * ── Interface → adapter → strategies ────────────────────────────────────────
+ * The interface is the `CredentialProvider` port. This adapter reads the
+ * secret named for the service from the request the call belongs to
+ * (`CredentialRequest.request`, filled by the framework). A strategy turns the
+ * raw value into a `Credential`: {@link asBearer} (the default),
+ * {@link asApiKey}, or {@link decodedWith} for a value that must be decrypted
+ * or exchanged first.
+ *
+ * ── Fails closed, by name ───────────────────────────────────────────────────
+ * Every refusal is a {@link RequestCredentialError} naming the SERVICE and the
+ * secret's NAME — never a value, and never a strategy's own error text (a
+ * decrypt library may quote its input). A thrown message reaches the model as
+ * the tool result and rides `agentfootprint.credential.failed`.
+ *   - no request on the call (a run started without one, a mount no run
+ *     reaches, a connection-level caller) → `'no-request'`;
+ *   - the request does not carry the secret → `'missing'`;
+ *   - a service this provider was not told about → `'unknown-service'`;
+ *   - the strategy threw or returned no credential → `'undecodable'`.
+ * There is no fallback: a missing per-request credential is never served from
+ * another request, a default, or the process.
+ *
+ * Pattern: Adapter (port) + Strategy (raw value → Credential).
+ */
+import { apiKey, bearer } from './kinds.js';
+import { requestSecretOf } from './requestContext.js';
+/**
+ * A request credential that could not be served. Its message names the
+ * service and the secret's name; it never carries a value or a strategy's
+ * own error.
+ */
+export class RequestCredentialError extends Error {
+    reason;
+    service;
+    code = 'ERR_REQUEST_CREDENTIAL';
+    constructor(reason, service, message) {
+        super(message);
+        this.reason = reason;
+        this.service = service;
+        this.name = 'RequestCredentialError';
+    }
+}
+/** The raw value, as a bearer token (`Authorization: Bearer …`). The default. */
+export function asBearer() {
+    return (raw) => bearer(raw);
+}
+/** The raw value, as an API key in one header (default `x-api-key`). */
+export function asApiKey(headerName) {
+    return (raw) => apiKey(raw, headerName);
+}
+/**
+ * Decode the raw value first — decrypt an encrypted per-request token,
+ * exchange it — then read the result with `then` (default {@link asBearer}).
+ * `decode` may return the plain value or a finished `Credential`. Whatever it
+ * throws is replaced by an `'undecodable'` refusal that quotes nothing.
+ */
+export function decodedWith(decode, then = asBearer()) {
+    return async (raw) => {
+        const decoded = await decode(raw);
+        return typeof decoded === 'string' ? then(decoded) : decoded;
+    };
+}
+/**
+ * Build the provider. Configuration is checked here, at boot: an empty
+ * service map, an empty secret name or a strategy that is not a function is
+ * refused by name.
+ *
+ * @throws TypeError on a malformed `services` map.
+ */
+export function requestCredentials(options) {
+    const sources = readSources(options?.services);
+    return {
+        id: options.id ?? 'request-credentials',
+        async getCredential(req) {
+            const service = req.service;
+            const source = Object.hasOwn(sources, service) ? sources[service] : undefined;
+            if (source === undefined) {
+                throw new RequestCredentialError('unknown-service', service, `requestCredentials: no request credential is declared for service '${service}'.`);
+            }
+            if (req.request === undefined) {
+                throw new RequestCredentialError('no-request', service, `requestCredentials: service '${service}' takes its credential from the incoming ` +
+                    'request, and the call carries none — pass `request: requestContext({ secrets })` ' +
+                    'to the run. A credential is never borrowed from another request.');
+            }
+            const raw = requestSecretOf(req.request, source.secret);
+            if (raw === undefined) {
+                throw new RequestCredentialError('missing', service, `requestCredentials: the request carries no '${source.secret}' secret for service ` +
+                    `'${service}'.`);
+            }
+            let credential;
+            try {
+                credential = await source.as(raw);
+            }
+            catch {
+                credential = undefined;
+            }
+            if (!isCredential(credential)) {
+                throw new RequestCredentialError('undecodable', service, `requestCredentials: the '${source.secret}' secret for service '${service}' could ` +
+                    'not be read as a credential.');
+            }
+            return { status: 'issued', credential };
+        },
+    };
+}
+function readSources(services) {
+    if (services === null || typeof services !== 'object' || Array.isArray(services)) {
+        throw new TypeError('requestCredentials: `services` must be an object of service → source.');
+    }
+    const out = Object.create(null);
+    const names = Object.keys(services);
+    if (names.length === 0) {
+        throw new TypeError('requestCredentials: `services` names no service.');
+    }
+    for (const service of names) {
+        const entry = services[service];
+        const secret = typeof entry === 'string' ? entry : entry?.secret;
+        const as = typeof entry === 'string' ? undefined : entry?.as;
+        if (typeof secret !== 'string' || secret === '') {
+            throw new TypeError(`requestCredentials: service '${service}' must name its secret (a non-empty string).`);
+        }
+        if (as !== undefined && typeof as !== 'function') {
+            throw new TypeError(`requestCredentials: service '${service}': \`as\` must be a strategy function.`);
+        }
+        out[service] = { secret, as: as ?? asBearer() };
+    }
+    return out;
+}
+function isCredential(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        typeof value.kind === 'string' &&
+        typeof value.toHeaders === 'function');
+}
+//# sourceMappingURL=requestCredentials.js.map

package/dist/esm/identity/requestCredentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestCredentials.js","sourceRoot":"","sources":["../../../src/identity/requestCredentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAQH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AA2BtD;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAIpC;IACA;IAJF,IAAI,GAAG,wBAAiC,CAAC;IAElD,YACW,MAAgC,EAChC,OAAe,EACxB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAA0B;QAChC,YAAO,GAAP,OAAO,CAAQ;QAIxB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,UAAU,QAAQ;IACtB,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,QAAQ,CAAC,UAAmB;IAC1C,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,MAA2E,EAC3E,OAAkC,QAAQ,EAAE;IAE5C,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/D,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAkC;IACnE,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/C,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,qBAAqB;QACvC,KAAK,CAAC,aAAa,CAAC,GAAsB;YACxC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,sBAAsB,CAC9B,iBAAiB,EACjB,OAAO,EACP,sEAAsE,OAAO,IAAI,CAClF,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,sBAAsB,CAC9B,YAAY,EACZ,OAAO,EACP,gCAAgC,OAAO,2CAA2C;oBAChF,mFAAmF;oBACnF,kEAAkE,CACrE,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACxD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,sBAAsB,CAC9B,SAAS,EACT,OAAO,EACP,+CAA+C,MAAM,CAAC,MAAM,uBAAuB;oBACjF,IAAI,OAAO,IAAI,CAClB,CAAC;YACJ,CAAC;YACD,IAAI,UAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,GAAG,SAAS,CAAC;YACzB,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,sBAAsB,CAC9B,aAAa,EACb,OAAO,EACP,4BAA4B,MAAM,CAAC,MAAM,yBAAyB,OAAO,UAAU;oBACjF,8BAA8B,CACjC,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC;AAOD,SAAS,WAAW,CAAC,QAAiB;IACpC,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,SAAS,CAAC,uEAAuE,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,GAAG,GAA+B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAI,QAAoC,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,KAA8B,EAAE,MAAM,CAAC;QAC3F,MAAM,EAAE,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,KAA0B,EAAE,EAAE,CAAC;QACnF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,SAAS,CACjB,gCAAgC,OAAO,8CAA8C,CACtF,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,KAAK,SAAS,IAAI,OAAO,EAAE,KAAK,UAAU,EAAE,CAAC;YACjD,MAAM,IAAI,SAAS,CACjB,gCAAgC,OAAO,wCAAwC,CAChF,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAG,EAA4C,IAAI,QAAQ,EAAE,EAAE,CAAC;IAC7F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAQ,KAAoB,CAAC,IAAI,KAAK,QAAQ;QAC9C,OAAQ,KAAoB,CAAC,SAAS,KAAK,UAAU,CACtD,CAAC;AACJ,CAAC"}

package/dist/esm/identity/types.d.ts

@@ -23,6 +23,7 @@
  * and observability exporters, which would leak the token into the trace. Pair
  * with `RedactionPolicy` for defence in depth.
  */
+import type { RequestContext } from './requestContext.js';
 /** What a tool/agent asks for. `service` ↔ the provider's downstream service id. */
 export interface CredentialRequest {
     /** Downstream service id, e.g. 'github', 'slack', 'google'. */
@@ -66,6 +67,16 @@ export interface CredentialRequest {
      * `staticTokens` does exactly that.
      */
     readonly userToken?: string;
+    /**
+     * The incoming request this call belongs to, sealed — set by the FRAMEWORK
+     * from the run the call is part of, never by a tool or the model.
+     *
+     * Opaque: it carries no readable field. Only `requestCredentials` reads it
+     * (see `./requestContext`); every other provider ignores it. A call made
+     * where no run carries a request has none, and a request-sourced credential
+     * then fails closed.
+     */
+    readonly request?: RequestContext;
     /** Force a fresh authorization, bypassing any cached/refresh token. */
     readonly forceReauth?: boolean;
 }

package/dist/esm/identity/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAoGH,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,CAAmB;IACpD,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;AAC/B,CAAC;AAgBD;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B;IAC5C,OAAO;QACL,EAAE,EAAE,cAAc;QAClB,aAAa,CAAC,GAAsB;YAClC,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,4DAA4D,GAAG,CAAC,OAAO,QAAQ;gBAC7E,wEAAwE;gBACxE,gEAAgE,CACnE,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAgHH,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,CAAmB;IACpD,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;AAC/B,CAAC;AAgBD;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B;IAC5C,OAAO;QACL,EAAE,EAAE,cAAc;QAClB,aAAa,CAAC,GAAsB;YAClC,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,4DAA4D,GAAG,CAAC,OAAO,QAAQ;gBAC7E,wEAAwE;gBACxE,gEAAgE,CACnE,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/identity.d.ts

@@ -31,6 +31,8 @@ export type { Credential, CredentialProvider, CredentialRequest, CredentialResul
 export { isCredentialIssued, unconfiguredCredentialProvider } from './identity/types.js';
 export { bearer, apiKey, basic, headers, type BearerCredential, type ApiKeyCredential, type BasicCredential, type HeadersCredential, } from './identity/kinds.js';
 export { staticTokens, type StaticTokensOptions } from './identity/staticTokens.js';
+export { requestContext, isRequestContext, type RequestContext, type RequestContextOptions, } from './identity/requestContext.js';
+export { requestCredentials, asBearer, asApiKey, decodedWith, RequestCredentialError, type RequestCredentialsOptions, type RequestCredentialSource, type RequestCredentialStrategy, type RequestCredentialRefusal, } from './identity/requestCredentials.js';
 export type { AuthorizationRequiredMode, ConsentRequest } from './identity/consent.js';
 export { CredentialConsentRequiredError, type CredentialConsentRequiredContext, } from './identity/CredentialConsentRequiredError.js';
 export { withCredentialRetry, type WithCredentialRetryOptions, } from './identity/withCredentialRetry.js';

package/dist/esm/identity.js

@@ -30,6 +30,11 @@
 export { isCredentialIssued, unconfiguredCredentialProvider } from './identity/types.js';
 export { bearer, apiKey, basic, headers, } from './identity/kinds.js';
 export { staticTokens } from './identity/staticTokens.js';
+// Credentials from the INCOMING REQUEST: the host seals the request's secrets
+// per run (`requestContext`), and `requestCredentials` vends them to a tool's
+// declared `needs` — only for the run that carries them, failing closed by name.
+export { requestContext, isRequestContext, } from './identity/requestContext.js';
+export { requestCredentials, asBearer, asApiKey, decodedWith, RequestCredentialError, } from './identity/requestCredentials.js';
 export { CredentialConsentRequiredError, } from './identity/CredentialConsentRequiredError.js';
 export { withCredentialRetry, } from './identity/withCredentialRetry.js';
 export { agentCoreIdentity, 

package/dist/esm/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAWH,OAAO,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AACzF,OAAO,EACL,MAAM,EACN,MAAM,EACN,KAAK,EACL,OAAO,GAKR,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAA4B,MAAM,4BAA4B,CAAC;AAKpF,OAAO,EACL,8BAA8B,GAE/B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,mBAAmB,GAEpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,iBAAiB;AACjB,6EAA6E;AAC7E,wEAAwE;AACxE,gDAAgD;AAChD,8BAA8B,GAK/B,MAAM,kCAAkC,CAAC;AAC1C,yEAAyE;AACzE,6EAA6E;AAC7E,uEAAuE;AACvE,OAAO,EAAE,gBAAgB,EAAgC,MAAM,8BAA8B,CAAC;AAE9F,4EAA4E;AAC5E,uEAAuE;AACvE,6EAA6E;AAC7E,6DAA6D;AAC7D,OAAO,EACL,cAAc,EACd,oBAAoB,GAIrB,MAAM,+BAA+B,CAAC;AAEvC,yEAAyE;AACzE,4EAA4E;AAC5E,uEAAuE;AACvE,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,0EAA0E;AAC1E,gEAAgE;AAChE,OAAO,EACL,aAAa,EACb,cAAc,EACd,sBAAsB,EACtB,8BAA8B,GAK/B,MAAM,8BAA8B,CAAC;AAEtC,8EAA8E;AAC9E,iEAAiE;AACjE,4EAA4E;AAC5E,sEAAsE;AACtE,4EAA4E;AAC5E,OAAO,EACL,YAAY,EACZ,uBAAuB,GAKxB,MAAM,6BAA6B,CAAC;AAErC,4EAA4E;AAC5E,+EAA+E;AAC/E,2EAA2E;AAC3E,0EAA0E;AAC1E,+EAA+E;AAC/E,4BAA4B;AAC5B,OAAO,EACL,YAAY,GAKb,MAAM,6BAA6B,CAAC;AAErC,sEAAsE;AACtE,+EAA+E;AAC/E,iFAAiF;AACjF,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,UAAU,GAIX,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,kBAAkB,GAInB,MAAM,0CAA0C,CAAC;AAClD,qEAAqE;AACrE,6EAA6E;AAC7E,OAAO,EACL,kBAAkB,GAEnB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EACL,aAAa,EACb,kBAAkB,GAGnB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,aAAa,EACb,iBAAiB,GAMlB,MAAM,uCAAuC,CAAC;AAC/C,8EAA8E;AAC9E,wEAAwE;AACxE,OAAO,EACL,YAAY,EACZ,cAAc,EACd,wBAAwB,EACxB,cAAc,EACd,YAAY,GAEb,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GAEpB,MAAM,0CAA0C,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAWH,OAAO,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AACzF,OAAO,EACL,MAAM,EACN,MAAM,EACN,KAAK,EACL,OAAO,GAKR,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAA4B,MAAM,4BAA4B,CAAC;AACpF,8EAA8E;AAC9E,8EAA8E;AAC9E,iFAAiF;AACjF,OAAO,EACL,cAAc,EACd,gBAAgB,GAGjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,kBAAkB,EAClB,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,sBAAsB,GAKvB,MAAM,kCAAkC,CAAC;AAK1C,OAAO,EACL,8BAA8B,GAE/B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,mBAAmB,GAEpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,iBAAiB;AACjB,6EAA6E;AAC7E,wEAAwE;AACxE,gDAAgD;AAChD,8BAA8B,GAK/B,MAAM,kCAAkC,CAAC;AAC1C,yEAAyE;AACzE,6EAA6E;AAC7E,uEAAuE;AACvE,OAAO,EAAE,gBAAgB,EAAgC,MAAM,8BAA8B,CAAC;AAE9F,4EAA4E;AAC5E,uEAAuE;AACvE,6EAA6E;AAC7E,6DAA6D;AAC7D,OAAO,EACL,cAAc,EACd,oBAAoB,GAIrB,MAAM,+BAA+B,CAAC;AAEvC,yEAAyE;AACzE,4EAA4E;AAC5E,uEAAuE;AACvE,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,0EAA0E;AAC1E,gEAAgE;AAChE,OAAO,EACL,aAAa,EACb,cAAc,EACd,sBAAsB,EACtB,8BAA8B,GAK/B,MAAM,8BAA8B,CAAC;AAEtC,8EAA8E;AAC9E,iEAAiE;AACjE,4EAA4E;AAC5E,sEAAsE;AACtE,4EAA4E;AAC5E,OAAO,EACL,YAAY,EACZ,uBAAuB,GAKxB,MAAM,6BAA6B,CAAC;AAErC,4EAA4E;AAC5E,+EAA+E;AAC/E,2EAA2E;AAC3E,0EAA0E;AAC1E,+EAA+E;AAC/E,4BAA4B;AAC5B,OAAO,EACL,YAAY,GAKb,MAAM,6BAA6B,CAAC;AAErC,sEAAsE;AACtE,+EAA+E;AAC/E,iFAAiF;AACjF,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,UAAU,GAIX,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,kBAAkB,GAInB,MAAM,0CAA0C,CAAC;AAClD,qEAAqE;AACrE,6EAA6E;AAC7E,OAAO,EACL,kBAAkB,GAEnB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EACL,aAAa,EACb,kBAAkB,GAGnB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,aAAa,EACb,iBAAiB,GAMlB,MAAM,uCAAuC,CAAC;AAC/C,8EAA8E;AAC9E,wEAAwE;AACxE,OAAO,EACL,YAAY,EACZ,cAAc,EACd,wBAAwB,EACxB,cAAc,EACd,YAAY,GAEb,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GAEpB,MAAM,0CAA0C,CAAC"}

package/dist/esm/index.d.ts

@@ -56,12 +56,13 @@ export { canResume, ConversationMismatchError, RunCheckpointError, type AgentRun
 export { browserSessionId, DEFAULT_SESSION_STORAGE_KEY, type BrowserSessionIdOptions, } from './hosting/browserSession.js';
 export { ContextWindowExceededError, ERR_CONTEXT_WINDOW_EXCEEDED, isContextWindowExceeded, } from './provider-contract/contextWindow.js';
 export { NoConversationError, type NoConversationReason, PendingQuestionError, ResumeIdentityConflictError, ResumeRedactionError, type ResumeRedactionReason, RunInFlightError, } from './core/conversation.js';
-export { MemberIdentityError, ParentRunRefusedError } from './core/memberRun.js';
+export { MemberIdentityError, ParentRunRefusedError, ResumeRequestConflictError, } from './core/memberRun.js';
 export { flowchartAsTool, type FlowchartAsToolOptions, type FlowchartResultMapper, type FlowchartToolSnapshot, } from './core/flowchartAsTool.js';
 export { absenceSignalOf, DECLINED_VERDICT, DEFAULT_MAX_ROWS, DEFAULT_RECORDING_MAX_BYTES, DEFAULT_WALK_CAP, PANEL_RENDER_NOTE, probeDispatch, projectWalk, recordingDispatch, renderVerdictTable, runbookAsTool, RunbookAbsenceSignal, VERDICT_RENDER_NOTE, verdictRowsOf, type InnerCallRecord, type ProjectedWalk, type RecordedDispatch, type RunbookAsToolOptions, type RunbookEnvelope, type RunbookPresentation, type RunbookProcedure, type RunbookRecordingOptions, type RunbookRules, type RunbookVerdictsOptions, type RunbookWalkOptions, type VerdictRow, type WalkDescriptor, type WalkRow, } from './core/runbook/index.js';
 export type { Tool, ToolExecutionContext, ToolRegistryEntry, DefineToolOptions, ToolDispatch, ToolDispatchCallOptions, ToolResultCeiling, } from './tools/tools.js';
 export type { AskOrAssume, ToolPeriod } from './tools/declare.js';
 export { defineTool, assertResultCeiling, assertResultClass, assertResultKind, assertComposedOf, assertGates, } from './tools/tools.js';
+export { hostFilled, fromCredential, fromIdentity, HostFilledArgumentError, HostFilledValueMissingError, HOST_FILLED_PLACEHOLDER, type HostFill, type HostFillFromCredential, type HostFillFromIdentity, type HostFilledIdentityField, } from './tools/hostFilled.js';
 export { assertValidToolName, warnIfInvalidToolName } from './lib/toolName.js';
 export { explainStatusOnlyNearMiss, readToolResultEnvelope, TOOL_RESULT_STATUSES, type InstructionDeliveryLease, type ProposedEffect, type ProposeTransitionEffect, type ReadToolResultEnvelope, type RequireInstructionEffect, type ToolResultEnvelope, type ToolResultStatus, } from './semantics/toolEffects.js';
 export type { InstructionLease, PendingToolTransition } from './injection-engine/leases.js';
@@ -99,4 +100,4 @@ export { providerFromEnv, type ProviderKind, type CreateProviderOptions, type Pr
 export * from './patterns/index.js';
 export { defineRAG, DEFAULT_CORPUS_IDENTITY, type DefineRAGOptions, indexDocuments, type IndexDocumentsOptions, type RagDocument, } from './rag/retriever/index.js';
 export { topK, type TopKOptions, type RetrievalStrategy, type RetrievalEvidence, type RetrievedCandidate, type RetrievalRejectReason, } from './memory/retrieval/index.js';
-export { AnswerValidationError, type AnswerValidationOptions, type AnswerValidationReport, type AnswerCheck, type AnswerEvidenceResolver, } from './answer-validation/index.js';
+export { AnswerValidationError, type AnswerValidationOptions, type AnswerValidationReport, type AnswerCheck, type AnswerEvidenceResolver, type AnswerToolCall, type AnswerToolCallsView, type AnswerValidationContext, } from './answer-validation/index.js';

package/dist/esm/index.js

@@ -270,7 +270,7 @@ export { ContextWindowExceededError, ERR_CONTEXT_WINDOW_EXCEEDED, isContextWindo
 export { NoConversationError, PendingQuestionError, ResumeIdentityConflictError, ResumeRedactionError, RunInFlightError, } from './core/conversation.js';
 // A composition member runs for the run that mounted it; one no run reached is
 // refused by name (`core/memberRun.ts`).
-export { MemberIdentityError, ParentRunRefusedError } from './core/memberRun.js';
+export { MemberIdentityError, ParentRunRefusedError, ResumeRequestConflictError, } from './core/memberRun.js';
 export { flowchartAsTool, } from './core/flowchartAsTool.js';
 // runbookAsTool (9.76.0) — the STANDARD bridge from a footprintjs procedure
 // to an Agent tool: every answer is the mandatory honesty spine (coverage
@@ -296,6 +296,10 @@ assertResultKind,
 // procedure can raise an approval gate). Exported beside the others for
 // consumers assembling `Tool` objects by hand.
 assertComposedOf, assertGates, } from './tools/tools.js';
+// Host-filled tool arguments: a field the HOST fills from the call's credential
+// or the caller's identity — removed from the model's schema, a model-sent
+// value refused by name, the credential scrubbed from what comes back.
+export { hostFilled, fromCredential, fromIdentity, HostFilledArgumentError, HostFilledValueMissingError, HOST_FILLED_PLACEHOLDER, } from './tools/hostFilled.js';
 // The tool-name law (`lib/toolName.ts`): the strict check and the dev-mode
 // warning `defineTool` runs, for consumers assembling `Tool` objects by hand.
 export { assertValidToolName, warnIfInvalidToolName } from './lib/toolName.js';