agentfootprint 6.10.0 → 6.11.0

package/dist/esm/core/agent/stages/toolCalls.js

@@ -26,6 +26,7 @@
  */
 import { typedEmit } from '../../../recorders/core/typedEmit.js';
 import { extractSequence } from '../../../security/extractSequence.js';
+import { unconfiguredCredentialProvider } from '../../../identity/types.js';
 import { isPauseRequest } from '../../pause.js';
 import { safeStringify } from '../validators.js';
 /**
@@ -33,6 +34,10 @@ import { safeStringify } from '../validators.js';
  */
 export function buildToolCallsHandler(deps) {
     const { registryByName, externalToolProvider, providerToolCache, permissionChecker } = deps;
+    // Fail-closed: when no provider is attached, `ctx.credentials` is a provider
+    // that THROWS on use (never undefined) — so a tool can't silently no-op.
+    const credentials = deps.credentialProvider ?? unconfiguredCredentialProvider();
+    const hasCredentials = deps.credentialProvider !== undefined;
     return {
         execute: async (scope) => {
             const toolCalls = scope.llmLatestToolCalls;
@@ -176,33 +181,92 @@ export function buildToolCallsHandler(deps) {
                     }
                 }
                 if (!denied) {
-                    try {
-                        if (!tool)
-                            throw new Error(`Unknown tool: ${tc.name}`);
-                        result = await tool.execute(tc.args, {
-                            toolCallId: tc.id,
-                            iteration,
+                    // Declare-and-push: resolve the tool's declared credential BEFORE
+                    // invoking, and inject it as ctx.credential. On consent-required or
+                    // failure, surface the reason to the LLM (tool result) + emit; the
+                    // tool does NOT run (fail-closed — never half-authed; a denial that
+                    // throws is surfaced, not retried).
+                    let resolvedCredential;
+                    let credentialBlocked = false;
+                    const need = tool?.needs;
+                    if (need) {
+                        typedEmit(scope, 'agentfootprint.credential.requested', {
+                            service: need.credential,
+                            ...(need.mode && { mode: need.mode }),
                         });
+                        try {
+                            const cred = await credentials.getCredential({
+                                service: need.credential,
+                                ...(need.scopes && { scopes: need.scopes }),
+                                ...(need.mode && { mode: need.mode }),
+                                ...(runIdentity && {
+                                    identity: {
+                                        ...(runIdentity.principal && { principal: runIdentity.principal }),
+                                        ...(runIdentity.tenant && { tenant: runIdentity.tenant }),
+                                    },
+                                }),
+                            });
+                            if (cred.status === 'issued') {
+                                resolvedCredential = cred.credential;
+                                typedEmit(scope, 'agentfootprint.credential.acquired', {
+                                    service: need.credential,
+                                    kind: cred.credential.kind,
+                                    ...(cred.expiresAt !== undefined && { expiresAt: cred.expiresAt }),
+                                });
+                            }
+                            else {
+                                credentialBlocked = true;
+                                typedEmit(scope, 'agentfootprint.credential.authorization_required', {
+                                    service: need.credential,
+                                    sessionId: cred.sessionId,
+                                });
+                                result = `authorization required for '${need.credential}': ${cred.authorizationUrl}`;
+                            }
+                        }
+                        catch (credErr) {
+                            credentialBlocked = true;
+                            error = true;
+                            const reason = credErr instanceof Error ? credErr.message : String(credErr);
+                            typedEmit(scope, 'agentfootprint.credential.failed', {
+                                service: need.credential,
+                                reason,
+                            });
+                            result = `credential error for '${need.credential}': ${reason}`;
+                        }
                     }
-                    catch (err) {
-                        if (isPauseRequest(err)) {
-                            // Commit partial state so resume() can find history intact.
-                            scope.history = newHistory;
-                            scope.pausedToolCallId = tc.id;
-                            scope.pausedToolName = tc.name;
-                            scope.pausedToolStartMs = startMs;
-                            // Returning a defined value triggers footprintjs pause —
-                            // the returned object becomes the checkpoint's pauseData.
-                            return {
+                    if (!credentialBlocked) {
+                        try {
+                            if (!tool)
+                                throw new Error(`Unknown tool: ${tc.name}`);
+                            result = await tool.execute(tc.args, {
                                 toolCallId: tc.id,
-                                toolName: tc.name,
-                                ...(typeof err.data === 'object' && err.data !== null
-                                    ? err.data
-                                    : { data: err.data }),
-                            };
+                                iteration,
+                                ...(env.signal && { signal: env.signal }),
+                                credentials,
+                                hasCredentials,
+                                ...(resolvedCredential && { credential: resolvedCredential }),
+                            });
+                        }
+                        catch (err) {
+                            if (isPauseRequest(err)) {
+                                // Commit partial state so resume() can find history intact.
+                                scope.history = newHistory;
+                                scope.pausedToolCallId = tc.id;
+                                scope.pausedToolName = tc.name;
+                                scope.pausedToolStartMs = startMs;
+                                // Returning a defined value triggers footprintjs pause —
+                                // the returned object becomes the checkpoint's pauseData.
+                                return {
+                                    toolCallId: tc.id,
+                                    toolName: tc.name,
+                                    ...(typeof err.data === 'object' && err.data !== null
+                                        ? err.data
+                                        : { data: err.data }),
+                                };
+                            }
+                            error = true;
+                            result = err instanceof Error ? err.message : String(err);
                         }
-                        error = true;
-                        result = err instanceof Error ? err.message : String(err);
                     }
                 }
                 const durationMs = Date.now() - startMs;

package/dist/esm/core/agent/stages/toolCalls.js.map

@@ -1 +1 @@
-{"version":3,"file":"toolCalls.js","sourceRoot":"","sources":["../../../../../src/core/agent/stages/toolCalls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAKH,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAyBjD;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAA0B;IAE1B,MAAM,EAAE,cAAc,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAE5F,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACvB,MAAM,SAAS,GAAG,KAAK,CAAC,kBAIrB,CAAC;YACJ,MAAM,SAAS,GAAG,KAAK,CAAC,SAAmB,CAAC;YAC5C,MAAM,UAAU,GAAiB,CAAC,GAAI,KAAK,CAAC,OAAiC,CAAC,CAAC;YAC/E,kEAAkE;YAClE,kEAAkE;YAClE,6DAA6D;YAC7D,iEAAiE;YACjE,6DAA6D;YAC7D,2DAA2D;YAC3D,IAAI,KAAK,CAAC,gBAAgB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnD,wDAAwD;gBACxD,6DAA6D;gBAC7D,8DAA8D;gBAC9D,0DAA0D;gBAC1D,MAAM,cAAc,GAAI,KAAiD,CAAC,cAAc,CAAC;gBACzF,MAAM,WAAW,GAAG,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC9E,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,WAA0B;oBAChC,OAAO,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAE;oBACrC,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;oBAC1C,GAAG,CAAC,WAAW,IAAI,EAAE,cAAc,EAAE,cAAuB,EAAE,CAAC;iBAChE,CAAC,CAAC;YACL,CAAC;YACD,yDAAyD;YACzD,8DAA8D;YAC9D,6DAA6D;YAC7D,+DAA+D;YAC/D,4DAA4D;YAC5D,wCAAwC;YACxC,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAoB,EAAE;gBACxD,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAClD,IAAI,YAAY;oBAAE,OAAO,YAAY,CAAC;gBACtC,IAAI,CAAC,oBAAoB;oBAAE,OAAO,SAAS,CAAC;gBAC5C,MAAM,MAAM,GAAG,iBAAiB,EAAE,OAAO,IAAI,EAAE,CAAC;gBAChD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;YACxD,CAAC,CAAC;YAEF,mEAAmE;YACnE,oEAAoE;YACpE,sDAAsD;YACtD,MAAM,WAAW,GAAG,KAAK,CAAC,WAEb,CAAC;YACd,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;YAE5B,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACjC,SAAS,CAAC,KAAK,EAAE,kCAAkC,EAAE;oBACnD,QAAQ,EAAE,EAAE,CAAC,IAAI;oBACjB,UAAU,EAAE,EAAE,CAAC,EAAE;oBACjB,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;iBACjE,CAAC,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC3B,IAAI,MAAe,CAAC;gBACpB,IAAI,KAA0B,CAAC;gBAC/B,kEAAkE;gBAClE,kEAAkE;gBAClE,EAAE;gBACF,kCAAkC;gBAClC,qDAAqD;gBACrD,yEAAyE;gBACzE,0EAA0E;gBAC1E,kEAAkE;gBAClE,kEAAkE;gBAClE,EAAE;gBACF,gEAAgE;gBAChE,iEAAiE;gBACjE,4DAA4D;gBAC5D,2DAA2D;gBAC3D,EAAE;gBACF,4DAA4D;gBAC5D,gEAAgE;gBAChE,iEAAiE;gBACjE,6DAA6D;gBAC7D,8CAA8C;gBAC9C,IAAI,MAAM,GAAG,KAAK,CAAC;gBACnB,IAAI,WAMS,CAAC;gBACd,IAAI,iBAAiB,EAAE,CAAC;oBACtB,IAAI,CAAC;wBACH,+DAA+D;wBAC/D,2DAA2D;wBAC3D,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;wBACxD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC;4BAC7C,UAAU,EAAE,WAAW;4BACvB,KAAK,EAAE,OAAO;4BACd,MAAM,EAAE,EAAE,CAAC,IAAI;4BACf,OAAO,EAAE,EAAE,CAAC,IAAI;4BAChB,QAAQ;4BACR,OAAO,EAAE,UAAU;4BACnB,SAAS;4BACT,GAAG,CAAC,WAAW,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;4BAC7C,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;yBAC1C,CAAC,CAAC;wBACH,SAAS,CAAC,KAAK,EAAE,iCAAiC,EAAE;4BAClD,UAAU,EAAE,WAAW;4BACvB,KAAK,EAAE,OAAO;4BACd,MAAM,EAAE,EAAE,CAAC,IAAI;4BACf,MAAM,EAAE,QAAQ,CAAC,MAAM;4BACvB,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;4BACnF,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;4BAC1E,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;yBAClE,CAAC,CAAC;wBACH,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;4BAC/B,MAAM,GAAG,IAAI,CAAC;4BACd,sDAAsD;4BACtD,wDAAwD;4BACxD,4DAA4D;4BAC5D,MAAM,OAAO,GACX,QAAQ,CAAC,OAAO,IAAI,uBAAuB,QAAQ,CAAC,SAAS,IAAI,QAAQ,GAAG,CAAC;4BAC/E,MAAM,GAAG,OAAO,CAAC;wBACnB,CAAC;6BAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;4BACtC,MAAM,GAAG,IAAI,CAAC;4BACd,0DAA0D;4BAC1D,gEAAgE;4BAChE,wDAAwD;4BACxD,oEAAoE;4BACpE,MAAM,OAAO,GACX,QAAQ,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC,IAAI,qCAAqC,CAAC;4BAC5E,MAAM,GAAG,OAAO,CAAC;4BACjB,WAAW,GAAG;gCACZ,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,SAAS,IAAI,aAAa;gCAC9D,OAAO;gCACP,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI,EAAE,SAAS,EAAE,iBAAiB,CAAC,IAAI,EAAE,CAAC;6BACrE,CAAC;wBACJ,CAAC;oBACH,CAAC;oBAAC,OAAO,OAAO,EAAE,CAAC;wBACjB,2DAA2D;wBAC3D,2DAA2D;wBAC3D,wDAAwD;wBACxD,MAAM,GAAG,IAAI,CAAC;wBACd,MAAM,GAAG,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;wBACzE,SAAS,CAAC,KAAK,EAAE,iCAAiC,EAAE;4BAClD,UAAU,EAAE,WAAW;4BACvB,KAAK,EAAE,OAAO;4BACd,MAAM,EAAE,EAAE,CAAC,IAAI;4BACf,MAAM,EAAE,MAAM;4BACd,SAAS,EAAE,6BAA6B,GAAG,EAAE;yBAC9C,CAAC,CAAC;wBACH,MAAM,GAAG,sCAAsC,GAAG,GAAG,CAAC;oBACxD,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,IAAI,CAAC;wBACH,IAAI,CAAC,IAAI;4BAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;wBACvD,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE;4BACnC,UAAU,EAAE,EAAE,CAAC,EAAE;4BACjB,SAAS;yBACV,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;4BACxB,4DAA4D;4BAC5D,KAAK,CAAC,OAAO,GAAG,UAAU,CAAC;4BAC3B,KAAK,CAAC,gBAAgB,GAAG,EAAE,CAAC,EAAE,CAAC;4BAC/B,KAAK,CAAC,cAAc,GAAG,EAAE,CAAC,IAAI,CAAC;4BAC/B,KAAK,CAAC,iBAAiB,GAAG,OAAO,CAAC;4BAClC,yDAAyD;4BACzD,0DAA0D;4BAC1D,OAAO;gCACL,UAAU,EAAE,EAAE,CAAC,EAAE;gCACjB,QAAQ,EAAE,EAAE,CAAC,IAAI;gCACjB,GAAG,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;oCACnD,CAAC,CAAE,GAAG,CAAC,IAAgC;oCACvC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;6BACxB,CAAC;wBACJ,CAAC;wBACD,KAAK,GAAG,IAAI,CAAC;wBACb,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC5D,CAAC;gBACH,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;gBACxC,SAAS,CAAC,KAAK,EAAE,gCAAgC,EAAE;oBACjD,UAAU,EAAE,EAAE,CAAC,EAAE;oBACjB,MAAM;oBACN,UAAU;oBACV,GAAG,CAAC,KAAK,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;iBACvC,CAAC,CAAC;gBACH,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBAC9E,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,SAAS;oBAClB,UAAU,EAAE,EAAE,CAAC,EAAE;oBACjB,QAAQ,EAAE,EAAE,CAAC,IAAI;iBAClB,CAAC,CAAC;gBAEH,0DAA0D;gBAC1D,EAAE;gBACF,yDAAyD;gBACzD,0DAA0D;gBAC1D,mDAAmD;gBACnD,KAAK,CAAC,cAAc,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBAEhE,yDAAyD;gBACzD,0DAA0D;gBAC1D,0DAA0D;gBAC1D,6DAA6D;gBAC7D,mCAAmC;gBACnC,IAAI,EAAE,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;oBAClD,MAAM,WAAW,GAAI,EAAE,CAAC,IAAyB,CAAC,EAAE,CAAC;oBACrD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,qBAA0C,CAAC;wBACjE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;4BACnC,KAAK,CAAC,qBAAqB,GAAG,CAAC,GAAG,OAAO,EAAE,WAAW,CAAC,CAAC;wBAC1D,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,4CAA4C;gBAC5C,EAAE;gBACF,6DAA6D;gBAC7D,8DAA8D;gBAC9D,gEAAgE;gBAChE,gEAAgE;gBAChE,8DAA8D;gBAC9D,6DAA6D;gBAC7D,IAAI,WAAW,EAAE,CAAC;oBAChB,SAAS,CAAC,KAAK,EAAE,gCAAgC,EAAE;wBACjD,MAAM,EAAE,EAAE,CAAC,IAAI;wBACf,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,OAAO,EAAE,WAAW,CAAC,OAAO;wBAC5B,SAAS;wBACT,cAAc,EAAE,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,MAAM;wBAC7D,GAAG,CAAC,WAAW,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;qBACjF,CAAC,CAAC;oBACH,KAAK,CAAC,OAAO,GAAG,UAAU,CAAC;oBAC3B,KAAK,CAAC,gBAAgB,GAAG,WAAW,CAAC,MAAM,CAAC;oBAC5C,KAAK,CAAC,iBAAiB,GAAG,WAAW,CAAC,OAAO,CAAC;oBAC9C,KAAK,CAAC,gBAAgB,GAAG,EAAE,CAAC,IAAI,CAAC;oBACjC,KAAK,CAAC,cAAc,GAAG,EAAE,CAAC,IAAI,CAAC;oBAC/B,KAAK,CAAC,mBAAmB,GAAG,SAAS,CAAC;oBACtC,IAAI,WAAW,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;wBACxC,KAAK,CAAC,mBAAmB,GAAG,WAAW,CAAC,SAAS,CAAC;oBACpD,CAAC;oBACD,KAAK,CAAC,MAAM,CAAC,gBAAgB,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;oBACnD,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,KAAK,CAAC,OAAO,GAAG,UAAU,CAAC;YAE3B,SAAS,CAAC,KAAK,EAAE,oCAAoC,EAAE;gBACrD,SAAS,EAAE,CAAC;gBACZ,SAAS,EAAE,SAAS;gBACpB,aAAa,EAAE,SAAS,CAAC,MAAM;gBAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;YACH,KAAK,CAAC,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC;YAChC,OAAO,SAAS,CAAC,CAAC,+CAA+C;QACnE,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACvB,mEAAmE;YACnE,6DAA6D;YAC7D,wDAAwD;YACxD,iEAAiE;YACjE,kDAAkD;YAClD,MAAM,UAAU,GAAG,KAAK,CAAC,gBAA0B,CAAC;YACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAwB,CAAC;YAChD,MAAM,OAAO,GAAG,KAAK,CAAC,iBAA2B,CAAC;YAClD,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC3E,MAAM,UAAU,GAAiB;gBAC/B,GAAI,KAAK,CAAC,OAAiC;gBAC3C;oBACE,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,SAAS;oBAClB,UAAU;oBACV,QAAQ;iBACT;aACF,CAAC;YACF,KAAK,CAAC,OAAO,GAAG,UAAU,CAAC;YAE3B,SAAS,CAAC,KAAK,EAAE,gCAAgC,EAAE;gBACjD,UAAU;gBACV,MAAM,EAAE,KAAK;gBACb,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;aACjC,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,KAAK,CAAC,SAAmB,CAAC;YAC5C,SAAS,CAAC,KAAK,EAAE,oCAAoC,EAAE;gBACrD,SAAS,EAAE,CAAC;gBACZ,SAAS,EAAE,SAAS;gBACpB,aAAa,EAAE,CAAC;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;YACH,KAAK,CAAC,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC;YAChC,iCAAiC;YACjC,KAAK,CAAC,gBAAgB,GAAG,EAAE,CAAC;YAC5B,KAAK,CAAC,cAAc,GAAG,EAAE,CAAC;YAC1B,KAAK,CAAC,iBAAiB,GAAG,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"toolCalls.js","sourceRoot":"","sources":["../../../../../src/core/agent/stages/toolCalls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAKH,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAGvE,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AA6BjD;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAA0B;IAE1B,MAAM,EAAE,cAAc,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAC5F,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,IAAI,8BAA8B,EAAE,CAAC;IAChF,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,KAAK,SAAS,CAAC;IAE7D,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACvB,MAAM,SAAS,GAAG,KAAK,CAAC,kBAIrB,CAAC;YACJ,MAAM,SAAS,GAAG,KAAK,CAAC,SAAmB,CAAC;YAC5C,MAAM,UAAU,GAAiB,CAAC,GAAI,KAAK,CAAC,OAAiC,CAAC,CAAC;YAC/E,kEAAkE;YAClE,kEAAkE;YAClE,6DAA6D;YAC7D,iEAAiE;YACjE,6DAA6D;YAC7D,2DAA2D;YAC3D,IAAI,KAAK,CAAC,gBAAgB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnD,wDAAwD;gBACxD,6DAA6D;gBAC7D,8DAA8D;gBAC9D,0DAA0D;gBAC1D,MAAM,cAAc,GAAI,KAAiD,CAAC,cAAc,CAAC;gBACzF,MAAM,WAAW,GAAG,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC9E,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,WAA0B;oBAChC,OAAO,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAE;oBACrC,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;oBAC1C,GAAG,CAAC,WAAW,IAAI,EAAE,cAAc,EAAE,cAAuB,EAAE,CAAC;iBAChE,CAAC,CAAC;YACL,CAAC;YACD,yDAAyD;YACzD,8DAA8D;YAC9D,6DAA6D;YAC7D,+DAA+D;YAC/D,4DAA4D;YAC5D,wCAAwC;YACxC,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAoB,EAAE;gBACxD,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAClD,IAAI,YAAY;oBAAE,OAAO,YAAY,CAAC;gBACtC,IAAI,CAAC,oBAAoB;oBAAE,OAAO,SAAS,CAAC;gBAC5C,MAAM,MAAM,GAAG,iBAAiB,EAAE,OAAO,IAAI,EAAE,CAAC;gBAChD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;YACxD,CAAC,CAAC;YAEF,mEAAmE;YACnE,oEAAoE;YACpE,sDAAsD;YACtD,MAAM,WAAW,GAAG,KAAK,CAAC,WAEb,CAAC;YACd,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;YAE5B,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACjC,SAAS,CAAC,KAAK,EAAE,kCAAkC,EAAE;oBACnD,QAAQ,EAAE,EAAE,CAAC,IAAI;oBACjB,UAAU,EAAE,EAAE,CAAC,EAAE;oBACjB,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;iBACjE,CAAC,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC3B,IAAI,MAAe,CAAC;gBACpB,IAAI,KAA0B,CAAC;gBAC/B,kEAAkE;gBAClE,kEAAkE;gBAClE,EAAE;gBACF,kCAAkC;gBAClC,qDAAqD;gBACrD,yEAAyE;gBACzE,0EAA0E;gBAC1E,kEAAkE;gBAClE,kEAAkE;gBAClE,EAAE;gBACF,gEAAgE;gBAChE,iEAAiE;gBACjE,4DAA4D;gBAC5D,2DAA2D;gBAC3D,EAAE;gBACF,4DAA4D;gBAC5D,gEAAgE;gBAChE,iEAAiE;gBACjE,6DAA6D;gBAC7D,8CAA8C;gBAC9C,IAAI,MAAM,GAAG,KAAK,CAAC;gBACnB,IAAI,WAMS,CAAC;gBACd,IAAI,iBAAiB,EAAE,CAAC;oBACtB,IAAI,CAAC;wBACH,+DAA+D;wBAC/D,2DAA2D;wBAC3D,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;wBACxD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC;4BAC7C,UAAU,EAAE,WAAW;4BACvB,KAAK,EAAE,OAAO;4BACd,MAAM,EAAE,EAAE,CAAC,IAAI;4BACf,OAAO,EAAE,EAAE,CAAC,IAAI;4BAChB,QAAQ;4BACR,OAAO,EAAE,UAAU;4BACnB,SAAS;4BACT,GAAG,CAAC,WAAW,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;4BAC7C,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;yBAC1C,CAAC,CAAC;wBACH,SAAS,CAAC,KAAK,EAAE,iCAAiC,EAAE;4BAClD,UAAU,EAAE,WAAW;4BACvB,KAAK,EAAE,OAAO;4BACd,MAAM,EAAE,EAAE,CAAC,IAAI;4BACf,MAAM,EAAE,QAAQ,CAAC,MAAM;4BACvB,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;4BACnF,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;4BAC1E,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;yBAClE,CAAC,CAAC;wBACH,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;4BAC/B,MAAM,GAAG,IAAI,CAAC;4BACd,sDAAsD;4BACtD,wDAAwD;4BACxD,4DAA4D;4BAC5D,MAAM,OAAO,GACX,QAAQ,CAAC,OAAO,IAAI,uBAAuB,QAAQ,CAAC,SAAS,IAAI,QAAQ,GAAG,CAAC;4BAC/E,MAAM,GAAG,OAAO,CAAC;wBACnB,CAAC;6BAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;4BACtC,MAAM,GAAG,IAAI,CAAC;4BACd,0DAA0D;4BAC1D,gEAAgE;4BAChE,wDAAwD;4BACxD,oEAAoE;4BACpE,MAAM,OAAO,GACX,QAAQ,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC,IAAI,qCAAqC,CAAC;4BAC5E,MAAM,GAAG,OAAO,CAAC;4BACjB,WAAW,GAAG;gCACZ,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,SAAS,IAAI,aAAa;gCAC9D,OAAO;gCACP,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI,EAAE,SAAS,EAAE,iBAAiB,CAAC,IAAI,EAAE,CAAC;6BACrE,CAAC;wBACJ,CAAC;oBACH,CAAC;oBAAC,OAAO,OAAO,EAAE,CAAC;wBACjB,2DAA2D;wBAC3D,2DAA2D;wBAC3D,wDAAwD;wBACxD,MAAM,GAAG,IAAI,CAAC;wBACd,MAAM,GAAG,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;wBACzE,SAAS,CAAC,KAAK,EAAE,iCAAiC,EAAE;4BAClD,UAAU,EAAE,WAAW;4BACvB,KAAK,EAAE,OAAO;4BACd,MAAM,EAAE,EAAE,CAAC,IAAI;4BACf,MAAM,EAAE,MAAM;4BACd,SAAS,EAAE,6BAA6B,GAAG,EAAE;yBAC9C,CAAC,CAAC;wBACH,MAAM,GAAG,sCAAsC,GAAG,GAAG,CAAC;oBACxD,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,kEAAkE;oBAClE,oEAAoE;oBACpE,mEAAmE;oBACnE,oEAAoE;oBACpE,oCAAoC;oBACpC,IAAI,kBAA0C,CAAC;oBAC/C,IAAI,iBAAiB,GAAG,KAAK,CAAC;oBAC9B,MAAM,IAAI,GAAG,IAAI,EAAE,KAAK,CAAC;oBACzB,IAAI,IAAI,EAAE,CAAC;wBACT,SAAS,CAAC,KAAK,EAAE,qCAAqC,EAAE;4BACtD,OAAO,EAAE,IAAI,CAAC,UAAU;4BACxB,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;yBACtC,CAAC,CAAC;wBACH,IAAI,CAAC;4BACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC;gCAC3C,OAAO,EAAE,IAAI,CAAC,UAAU;gCACxB,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;gCAC3C,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;gCACrC,GAAG,CAAC,WAAW,IAAI;oCACjB,QAAQ,EAAE;wCACR,GAAG,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;wCAClE,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;qCAC1D;iCACF,CAAC;6BACH,CAAC,CAAC;4BACH,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gCAC7B,kBAAkB,GAAG,IAAI,CAAC,UAAU,CAAC;gCACrC,SAAS,CAAC,KAAK,EAAE,oCAAoC,EAAE;oCACrD,OAAO,EAAE,IAAI,CAAC,UAAU;oCACxB,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;oCAC1B,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;iCACnE,CAAC,CAAC;4BACL,CAAC;iCAAM,CAAC;gCACN,iBAAiB,GAAG,IAAI,CAAC;gCACzB,SAAS,CAAC,KAAK,EAAE,kDAAkD,EAAE;oCACnE,OAAO,EAAE,IAAI,CAAC,UAAU;oCACxB,SAAS,EAAE,IAAI,CAAC,SAAS;iCAC1B,CAAC,CAAC;gCACH,MAAM,GAAG,+BAA+B,IAAI,CAAC,UAAU,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;4BACvF,CAAC;wBACH,CAAC;wBAAC,OAAO,OAAO,EAAE,CAAC;4BACjB,iBAAiB,GAAG,IAAI,CAAC;4BACzB,KAAK,GAAG,IAAI,CAAC;4BACb,MAAM,MAAM,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;4BAC5E,SAAS,CAAC,KAAK,EAAE,kCAAkC,EAAE;gCACnD,OAAO,EAAE,IAAI,CAAC,UAAU;gCACxB,MAAM;6BACP,CAAC,CAAC;4BACH,MAAM,GAAG,yBAAyB,IAAI,CAAC,UAAU,MAAM,MAAM,EAAE,CAAC;wBAClE,CAAC;oBACH,CAAC;oBACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,IAAI,CAAC;4BACH,IAAI,CAAC,IAAI;gCAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;4BACvD,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE;gCACnC,UAAU,EAAE,EAAE,CAAC,EAAE;gCACjB,SAAS;gCACT,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;gCACzC,WAAW;gCACX,cAAc;gCACd,GAAG,CAAC,kBAAkB,IAAI,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;6BAC9D,CAAC,CAAC;wBACL,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gCACxB,4DAA4D;gCAC5D,KAAK,CAAC,OAAO,GAAG,UAAU,CAAC;gCAC3B,KAAK,CAAC,gBAAgB,GAAG,EAAE,CAAC,EAAE,CAAC;gCAC/B,KAAK,CAAC,cAAc,GAAG,EAAE,CAAC,IAAI,CAAC;gCAC/B,KAAK,CAAC,iBAAiB,GAAG,OAAO,CAAC;gCAClC,yDAAyD;gCACzD,0DAA0D;gCAC1D,OAAO;oCACL,UAAU,EAAE,EAAE,CAAC,EAAE;oCACjB,QAAQ,EAAE,EAAE,CAAC,IAAI;oCACjB,GAAG,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;wCACnD,CAAC,CAAE,GAAG,CAAC,IAAgC;wCACvC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;iCACxB,CAAC;4BACJ,CAAC;4BACD,KAAK,GAAG,IAAI,CAAC;4BACb,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBAC5D,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;gBACxC,SAAS,CAAC,KAAK,EAAE,gCAAgC,EAAE;oBACjD,UAAU,EAAE,EAAE,CAAC,EAAE;oBACjB,MAAM;oBACN,UAAU;oBACV,GAAG,CAAC,KAAK,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;iBACvC,CAAC,CAAC;gBACH,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBAC9E,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,SAAS;oBAClB,UAAU,EAAE,EAAE,CAAC,EAAE;oBACjB,QAAQ,EAAE,EAAE,CAAC,IAAI;iBAClB,CAAC,CAAC;gBAEH,0DAA0D;gBAC1D,EAAE;gBACF,yDAAyD;gBACzD,0DAA0D;gBAC1D,mDAAmD;gBACnD,KAAK,CAAC,cAAc,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBAEhE,yDAAyD;gBACzD,0DAA0D;gBAC1D,0DAA0D;gBAC1D,6DAA6D;gBAC7D,mCAAmC;gBACnC,IAAI,EAAE,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;oBAClD,MAAM,WAAW,GAAI,EAAE,CAAC,IAAyB,CAAC,EAAE,CAAC;oBACrD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,qBAA0C,CAAC;wBACjE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;4BACnC,KAAK,CAAC,qBAAqB,GAAG,CAAC,GAAG,OAAO,EAAE,WAAW,CAAC,CAAC;wBAC1D,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,4CAA4C;gBAC5C,EAAE;gBACF,6DAA6D;gBAC7D,8DAA8D;gBAC9D,gEAAgE;gBAChE,gEAAgE;gBAChE,8DAA8D;gBAC9D,6DAA6D;gBAC7D,IAAI,WAAW,EAAE,CAAC;oBAChB,SAAS,CAAC,KAAK,EAAE,gCAAgC,EAAE;wBACjD,MAAM,EAAE,EAAE,CAAC,IAAI;wBACf,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,OAAO,EAAE,WAAW,CAAC,OAAO;wBAC5B,SAAS;wBACT,cAAc,EAAE,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,MAAM;wBAC7D,GAAG,CAAC,WAAW,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;qBACjF,CAAC,CAAC;oBACH,KAAK,CAAC,OAAO,GAAG,UAAU,CAAC;oBAC3B,KAAK,CAAC,gBAAgB,GAAG,WAAW,CAAC,MAAM,CAAC;oBAC5C,KAAK,CAAC,iBAAiB,GAAG,WAAW,CAAC,OAAO,CAAC;oBAC9C,KAAK,CAAC,gBAAgB,GAAG,EAAE,CAAC,IAAI,CAAC;oBACjC,KAAK,CAAC,cAAc,GAAG,EAAE,CAAC,IAAI,CAAC;oBAC/B,KAAK,CAAC,mBAAmB,GAAG,SAAS,CAAC;oBACtC,IAAI,WAAW,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;wBACxC,KAAK,CAAC,mBAAmB,GAAG,WAAW,CAAC,SAAS,CAAC;oBACpD,CAAC;oBACD,KAAK,CAAC,MAAM,CAAC,gBAAgB,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;oBACnD,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,KAAK,CAAC,OAAO,GAAG,UAAU,CAAC;YAE3B,SAAS,CAAC,KAAK,EAAE,oCAAoC,EAAE;gBACrD,SAAS,EAAE,CAAC;gBACZ,SAAS,EAAE,SAAS;gBACpB,aAAa,EAAE,SAAS,CAAC,MAAM;gBAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;YACH,KAAK,CAAC,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC;YAChC,OAAO,SAAS,CAAC,CAAC,+CAA+C;QACnE,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACvB,mEAAmE;YACnE,6DAA6D;YAC7D,wDAAwD;YACxD,iEAAiE;YACjE,kDAAkD;YAClD,MAAM,UAAU,GAAG,KAAK,CAAC,gBAA0B,CAAC;YACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAwB,CAAC;YAChD,MAAM,OAAO,GAAG,KAAK,CAAC,iBAA2B,CAAC;YAClD,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC3E,MAAM,UAAU,GAAiB;gBAC/B,GAAI,KAAK,CAAC,OAAiC;gBAC3C;oBACE,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,SAAS;oBAClB,UAAU;oBACV,QAAQ;iBACT;aACF,CAAC;YACF,KAAK,CAAC,OAAO,GAAG,UAAU,CAAC;YAE3B,SAAS,CAAC,KAAK,EAAE,gCAAgC,EAAE;gBACjD,UAAU;gBACV,MAAM,EAAE,KAAK;gBACb,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;aACjC,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,KAAK,CAAC,SAAmB,CAAC;YAC5C,SAAS,CAAC,KAAK,EAAE,oCAAoC,EAAE;gBACrD,SAAS,EAAE,CAAC;gBACZ,SAAS,EAAE,SAAS;gBACpB,aAAa,EAAE,CAAC;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;YACH,KAAK,CAAC,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC;YAChC,iCAAiC;YACjC,KAAK,CAAC,gBAAgB,GAAG,EAAE,CAAC;YAC5B,KAAK,CAAC,cAAc,GAAG,EAAE,CAAC;YAC1B,KAAK,CAAC,iBAAiB,GAAG,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/core/tools.js

@@ -32,6 +32,7 @@ export function defineTool(options) {
             description: options.description,
             inputSchema: options.inputSchema ?? { type: 'object', properties: {} },
         },
+        ...(options.needs && { needs: options.needs }),
         execute: options.execute,
     };
 }

package/dist/esm/core/tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../src/core/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAmDH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,UAAU,CACxB,OAA0C;IAE1C,OAAO;QACL,MAAM,EAAE;YACN,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;SACvE;QACD,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../src/core/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAwEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,UAAU,CACxB,OAA0C;IAE1C,OAAO;QACL,MAAM,EAAE;YACN,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;SACvE;QACD,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;AACJ,CAAC"}

package/dist/esm/events/registry.js

@@ -77,6 +77,12 @@ export const EVENT_NAMES = {
         gateClosed: 'agentfootprint.permission.gate_closed',
         halt: 'agentfootprint.permission.halt',
     },
+    credential: {
+        requested: 'agentfootprint.credential.requested',
+        acquired: 'agentfootprint.credential.acquired',
+        authorizationRequired: 'agentfootprint.credential.authorization_required',
+        failed: 'agentfootprint.credential.failed',
+    },
     risk: {
         flagged: 'agentfootprint.risk.flagged',
     },
@@ -158,6 +164,10 @@ export const ALL_EVENT_TYPES = [
     'agentfootprint.permission.gate_opened',
     'agentfootprint.permission.gate_closed',
     'agentfootprint.permission.halt',
+    'agentfootprint.credential.requested',
+    'agentfootprint.credential.acquired',
+    'agentfootprint.credential.authorization_required',
+    'agentfootprint.credential.failed',
     'agentfootprint.risk.flagged',
     'agentfootprint.fallback.triggered',
     'agentfootprint.cost.tick',

package/dist/esm/events/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/events/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAiEH,yEAAyE;AACzE,sEAAsE;AACtE,wEAAwE;AACxE,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,WAAW,EAAE;QACX,KAAK,EAAE,kCAAkC;QACzC,IAAI,EAAE,iCAAiC;QACvC,SAAS,EAAE,uCAAuC;QAClD,cAAc,EAAE,4CAA4C;QAC5D,QAAQ,EAAE,sCAAsC;QAChD,YAAY,EAAE,0CAA0C;QACxD,cAAc,EAAE,4CAA4C;QAC5D,aAAa,EAAE,2CAA2C;KAC3D;IACD,KAAK,EAAE;QACL,SAAS,EAAE,iCAAiC;QAC5C,OAAO,EAAE,+BAA+B;QACxC,cAAc,EAAE,sCAAsC;QACtD,YAAY,EAAE,oCAAoC;QAClD,YAAY,EAAE,oCAAoC;QAClD,OAAO,EAAE,8BAA8B;QACvC,4BAA4B,EAAE,sDAAsD;QACpF,mBAAmB,EAAE,4CAA4C;KAClE;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,iCAAiC;QAC3C,MAAM,EAAE,+BAA+B;QACvC,KAAK,EAAE,6BAA6B;QACpC,SAAS,EAAE,kCAAkC;QAC7C,OAAO,EAAE,gCAAgC;QACzC,aAAa,EAAE,sCAAsC;QACrD,WAAW,EAAE,oCAAoC;KAClD;IACD,OAAO,EAAE;QACP,QAAQ,EAAE,iCAAiC;QAC3C,OAAO,EAAE,gCAAgC;QACzC,YAAY,EAAE,sCAAsC;QACpD,cAAc,EAAE,wCAAwC;QACxD,SAAS,EAAE,kCAAkC;KAC9C;IACD,MAAM,EAAE;QACN,eAAe,EAAE,wCAAwC;QACzD,QAAQ,EAAE,gCAAgC;QAC1C,QAAQ,EAAE,gCAAgC;QAC1C,OAAO,EAAE,+BAA+B;KACzC;IACD,KAAK,EAAE;QACL,OAAO,EAAE,8BAA8B;QACvC,SAAS,EAAE,gCAAgC;QAC3C,WAAW,EAAE,kCAAkC;QAC/C,gBAAgB,EAAE,wCAAwC;QAC1D,kBAAkB,EAAE,0CAA0C;QAC9D,eAAe,EAAE,uCAAuC;KACzD;IACD,KAAK,EAAE;QACL,SAAS,EAAE,gCAAgC;QAC3C,WAAW,EAAE,kCAAkC;KAChD;IACD,UAAU,EAAE;QACV,KAAK,EAAE,iCAAiC;QACxC,UAAU,EAAE,uCAAuC;QACnD,UAAU,EAAE,uCAAuC;QACnD,IAAI,EAAE,gCAAgC;KACvC;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,6BAA6B;KACvC;IACD,QAAQ,EAAE;QACR,SAAS,EAAE,mCAAmC;KAC/C;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,+BAA+B;KAC1C;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,2BAA2B;QAClC,gBAAgB,EAAE,uCAAuC;KAC1D;IACD,KAAK,EAAE;QACL,OAAO,EAAE,8BAA8B;QACvC,SAAS,EAAE,gCAAgC;QAC3C,KAAK,EAAE,4BAA4B;KACpC;IACD,WAAW,EAAE;QACX,QAAQ,EAAE,sCAAsC;QAChD,OAAO,EAAE,oCAAoC;QAC7C,SAAS,EAAE,sCAAsC;KAClD;IACD,KAAK,EAAE;QACL,OAAO,EAAE,8BAA8B;QACvC,MAAM,EAAE,6BAA6B;KACtC;IACD,SAAS,EAAE;QACT,SAAS,EAAE,oCAAoC;KAChD;CACO,CAAC;AAyQX;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAuC;IACjE,kCAAkC;IAClC,iCAAiC;IACjC,uCAAuC;IACvC,4CAA4C;IAC5C,sCAAsC;IACtC,0CAA0C;IAC1C,4CAA4C;IAC5C,2CAA2C;IAC3C,iCAAiC;IACjC,+BAA+B;IAC/B,sCAAsC;IACtC,oCAAoC;IACpC,oCAAoC;IACpC,8BAA8B;IAC9B,sDAAsD;IACtD,4CAA4C;IAC5C,iCAAiC;IACjC,+BAA+B;IAC/B,6BAA6B;IAC7B,kCAAkC;IAClC,gCAAgC;IAChC,sCAAsC;IACtC,oCAAoC;IACpC,iCAAiC;IACjC,gCAAgC;IAChC,sCAAsC;IACtC,wCAAwC;IACxC,kCAAkC;IAClC,wCAAwC;IACxC,gCAAgC;IAChC,gCAAgC;IAChC,+BAA+B;IAC/B,8BAA8B;IAC9B,gCAAgC;IAChC,kCAAkC;IAClC,wCAAwC;IACxC,0CAA0C;IAC1C,uCAAuC;IACvC,gCAAgC;IAChC,kCAAkC;IAClC,iCAAiC;IACjC,uCAAuC;IACvC,uCAAuC;IACvC,gCAAgC;IAChC,6BAA6B;IAC7B,mCAAmC;IACnC,0BAA0B;IAC1B,+BAA+B;IAC/B,2BAA2B;IAC3B,uCAAuC;IACvC,8BAA8B;IAC9B,gCAAgC;IAChC,4BAA4B;IAC5B,sCAAsC;IACtC,oCAAoC;IACpC,sCAAsC;IACtC,8BAA8B;IAC9B,6BAA6B;IAC7B,oCAAoC;CAC5B,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/events/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAqEH,yEAAyE;AACzE,sEAAsE;AACtE,wEAAwE;AACxE,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,WAAW,EAAE;QACX,KAAK,EAAE,kCAAkC;QACzC,IAAI,EAAE,iCAAiC;QACvC,SAAS,EAAE,uCAAuC;QAClD,cAAc,EAAE,4CAA4C;QAC5D,QAAQ,EAAE,sCAAsC;QAChD,YAAY,EAAE,0CAA0C;QACxD,cAAc,EAAE,4CAA4C;QAC5D,aAAa,EAAE,2CAA2C;KAC3D;IACD,KAAK,EAAE;QACL,SAAS,EAAE,iCAAiC;QAC5C,OAAO,EAAE,+BAA+B;QACxC,cAAc,EAAE,sCAAsC;QACtD,YAAY,EAAE,oCAAoC;QAClD,YAAY,EAAE,oCAAoC;QAClD,OAAO,EAAE,8BAA8B;QACvC,4BAA4B,EAAE,sDAAsD;QACpF,mBAAmB,EAAE,4CAA4C;KAClE;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,iCAAiC;QAC3C,MAAM,EAAE,+BAA+B;QACvC,KAAK,EAAE,6BAA6B;QACpC,SAAS,EAAE,kCAAkC;QAC7C,OAAO,EAAE,gCAAgC;QACzC,aAAa,EAAE,sCAAsC;QACrD,WAAW,EAAE,oCAAoC;KAClD;IACD,OAAO,EAAE;QACP,QAAQ,EAAE,iCAAiC;QAC3C,OAAO,EAAE,gCAAgC;QACzC,YAAY,EAAE,sCAAsC;QACpD,cAAc,EAAE,wCAAwC;QACxD,SAAS,EAAE,kCAAkC;KAC9C;IACD,MAAM,EAAE;QACN,eAAe,EAAE,wCAAwC;QACzD,QAAQ,EAAE,gCAAgC;QAC1C,QAAQ,EAAE,gCAAgC;QAC1C,OAAO,EAAE,+BAA+B;KACzC;IACD,KAAK,EAAE;QACL,OAAO,EAAE,8BAA8B;QACvC,SAAS,EAAE,gCAAgC;QAC3C,WAAW,EAAE,kCAAkC;QAC/C,gBAAgB,EAAE,wCAAwC;QAC1D,kBAAkB,EAAE,0CAA0C;QAC9D,eAAe,EAAE,uCAAuC;KACzD;IACD,KAAK,EAAE;QACL,SAAS,EAAE,gCAAgC;QAC3C,WAAW,EAAE,kCAAkC;KAChD;IACD,UAAU,EAAE;QACV,KAAK,EAAE,iCAAiC;QACxC,UAAU,EAAE,uCAAuC;QACnD,UAAU,EAAE,uCAAuC;QACnD,IAAI,EAAE,gCAAgC;KACvC;IACD,UAAU,EAAE;QACV,SAAS,EAAE,qCAAqC;QAChD,QAAQ,EAAE,oCAAoC;QAC9C,qBAAqB,EAAE,kDAAkD;QACzE,MAAM,EAAE,kCAAkC;KAC3C;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,6BAA6B;KACvC;IACD,QAAQ,EAAE;QACR,SAAS,EAAE,mCAAmC;KAC/C;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,+BAA+B;KAC1C;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,2BAA2B;QAClC,gBAAgB,EAAE,uCAAuC;KAC1D;IACD,KAAK,EAAE;QACL,OAAO,EAAE,8BAA8B;QACvC,SAAS,EAAE,gCAAgC;QAC3C,KAAK,EAAE,4BAA4B;KACpC;IACD,WAAW,EAAE;QACX,QAAQ,EAAE,sCAAsC;QAChD,OAAO,EAAE,oCAAoC;QAC7C,SAAS,EAAE,sCAAsC;KAClD;IACD,KAAK,EAAE;QACL,OAAO,EAAE,8BAA8B;QACvC,MAAM,EAAE,6BAA6B;KACtC;IACD,SAAS,EAAE;QACT,SAAS,EAAE,oCAAoC;KAChD;CACO,CAAC;AA0RX;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAuC;IACjE,kCAAkC;IAClC,iCAAiC;IACjC,uCAAuC;IACvC,4CAA4C;IAC5C,sCAAsC;IACtC,0CAA0C;IAC1C,4CAA4C;IAC5C,2CAA2C;IAC3C,iCAAiC;IACjC,+BAA+B;IAC/B,sCAAsC;IACtC,oCAAoC;IACpC,oCAAoC;IACpC,8BAA8B;IAC9B,sDAAsD;IACtD,4CAA4C;IAC5C,iCAAiC;IACjC,+BAA+B;IAC/B,6BAA6B;IAC7B,kCAAkC;IAClC,gCAAgC;IAChC,sCAAsC;IACtC,oCAAoC;IACpC,iCAAiC;IACjC,gCAAgC;IAChC,sCAAsC;IACtC,wCAAwC;IACxC,kCAAkC;IAClC,wCAAwC;IACxC,gCAAgC;IAChC,gCAAgC;IAChC,+BAA+B;IAC/B,8BAA8B;IAC9B,gCAAgC;IAChC,kCAAkC;IAClC,wCAAwC;IACxC,0CAA0C;IAC1C,uCAAuC;IACvC,gCAAgC;IAChC,kCAAkC;IAClC,iCAAiC;IACjC,uCAAuC;IACvC,uCAAuC;IACvC,gCAAgC;IAChC,qCAAqC;IACrC,oCAAoC;IACpC,kDAAkD;IAClD,kCAAkC;IAClC,6BAA6B;IAC7B,mCAAmC;IACnC,0BAA0B;IAC1B,+BAA+B;IAC/B,2BAA2B;IAC3B,uCAAuC;IACvC,8BAA8B;IAC9B,gCAAgC;IAChC,4BAA4B;IAC5B,sCAAsC;IACtC,oCAAoC;IACpC,sCAAsC;IACtC,8BAA8B;IAC9B,6BAA6B;IAC7B,oCAAoC;CAC5B,CAAC"}

package/dist/esm/identity/kinds.js

@@ -0,0 +1,66 @@
+/**
+ * Built-in credential kinds — small strategies implementing the {@link Credential}
+ * protocol. Each is a factory returning `{ kind, ...rawFields, toHeaders() }`.
+ *
+ * The framework + tools only ever call `cred.toHeaders()` (generic — no `kind`
+ * switching); the raw fields are there for the rare non-HTTP case. A custom kind
+ * is any object implementing `Credential` — no library change needed.
+ */
+/** Cross-env base64 (browser `btoa` / Node `Buffer`). */
+function base64(s) {
+    if (typeof btoa === 'function')
+        return btoa(s);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const B = globalThis.Buffer;
+    if (B)
+        return B.from(s, 'utf8').toString('base64');
+    throw new Error('basic(): no base64 encoder available in this runtime.');
+}
+/**
+ * Redefine secret-bearing fields as NON-ENUMERABLE — defence in depth: if a
+ * consumer accidentally serializes a credential (returns `ctx.credential` from
+ * a tool, logs it, embeds it in a result object), `JSON.stringify` emits only
+ * the non-secret fields (e.g. `{"kind":"bearer"}`), never the raw secret. The
+ * fields still READ normally (`cred.token` works); `toHeaders()` is the
+ * intended applicator either way. (`structuredClone` rejects the credential
+ * outright — `toHeaders` is a function — so it can't enter tracked scope.)
+ */
+function hideSecrets(cred, fields) {
+    for (const f of fields) {
+        Object.defineProperty(cred, f, {
+            value: cred[f],
+            enumerable: false,
+            writable: false,
+            configurable: false,
+        });
+    }
+    return cred;
+}
+/** OAuth / bearer token → `Authorization: Bearer <token>`. */
+export function bearer(token) {
+    return hideSecrets({ kind: 'bearer', token, toHeaders: () => ({ authorization: `Bearer ${token}` }) }, ['token']);
+}
+/** API key → a single header (default `x-api-key`). */
+export function apiKey(key, headerName = 'x-api-key') {
+    return hideSecrets({ kind: 'apiKey', key, headerName, toHeaders: () => ({ [headerName]: key }) }, ['key']);
+}
+/** HTTP Basic auth → `Authorization: Basic base64(user:pass)`. */
+export function basic(username, password) {
+    const encoded = base64(`${username}:${password}`);
+    return hideSecrets({
+        kind: 'basic',
+        username,
+        password,
+        toHeaders: () => ({ authorization: `Basic ${encoded}` }),
+    }, ['password']);
+}
+/** The universal escape: arbitrary auth headers. Any scheme reduces to this, so
+ *  a provider with no matching typed kind can always return `headers(...)`. */
+export function headers(map) {
+    const copy = { ...map };
+    // The header map IS the secret here — hide it like the other kinds' raw fields.
+    return hideSecrets({ kind: 'headers', headers: copy, toHeaders: () => ({ ...copy }) }, [
+        'headers',
+    ]);
+}
+//# sourceMappingURL=kinds.js.map

package/dist/esm/identity/kinds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kinds.js","sourceRoot":"","sources":["../../../src/identity/kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,yDAAyD;AACzD,SAAS,MAAM,CAAC,CAAS;IACvB,IAAI,OAAO,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/C,8DAA8D;IAC9D,MAAM,CAAC,GAAI,UAAkB,CAAC,MAAM,CAAC;IACrC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAmB,IAAO,EAAE,MAA4B;IAC1E,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,EAAE;YAC7B,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;YACd,UAAU,EAAE,KAAK;YACjB,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAMD,8DAA8D;AAC9D,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,WAAW,CAChB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,EAAE,EAClF,CAAC,OAAO,CAAC,CACV,CAAC;AACJ,CAAC;AAOD,uDAAuD;AACvD,MAAM,UAAU,MAAM,CAAC,GAAW,EAAE,UAAU,GAAG,WAAW;IAC1D,OAAO,WAAW,CAChB,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAC7E,CAAC,KAAK,CAAC,CACR,CAAC;AACJ,CAAC;AAOD,kEAAkE;AAClE,MAAM,UAAU,KAAK,CAAC,QAAgB,EAAE,QAAgB;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC;IAClD,OAAO,WAAW,CAChB;QACE,IAAI,EAAE,OAAO;QACb,QAAQ;QACR,QAAQ;QACR,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,OAAO,EAAE,EAAE,CAAC;KACzD,EACD,CAAC,UAAU,CAAC,CACb,CAAC;AACJ,CAAC;AAMD;+EAC+E;AAC/E,MAAM,UAAU,OAAO,CAAC,GAAqC;IAC3D,MAAM,IAAI,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IACxB,gFAAgF;IAChF,OAAO,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE;QACrF,SAAS;KACV,CAAC,CAAC;AACL,CAAC"}

package/dist/esm/identity/staticTokens.js

@@ -1,30 +1,37 @@
 /**
- * staticTokens — a dev/test {@link CredentialProvider} backed by canned tokens.
+ * staticTokens — a dev/test {@link CredentialProvider} backed by canned credentials.
  *
  * No network, no SDK. Use it to develop tools that need credentials without
  * standing up AgentCore Identity (or any IdP). Production swaps it for
  * `agentCoreIdentity()` — the tool code never changes.
  *
- *   const credentials = staticTokens({ github: 'ghp_dev_xxx', slack: 'xoxb-dev' });
+ *   // a plain string is treated as a bearer token (the common case):
+ *   const credentials = staticTokens({ github: 'ghp_dev_xxx' });
+ *   // …or give an explicit kind:
+ *   const credentials = staticTokens({ internal: apiKey('k', 'x-internal-key') });
+ *
  *   const r = await credentials.getCredential({ service: 'github' });
- *   if (r.status === 'token') useHeader(`Bearer ${r.token}`);
+ *   if (isCredentialIssued(r)) callGithub({ headers: r.credential.toHeaders() });
  */
+import { bearer } from './kinds.js';
 /**
- * Build a {@link CredentialProvider} from a `service → token` map. Always 2-legged
- * (returns the token directly); throws if a requested service has no token.
+ * Build a {@link CredentialProvider} from a `service → credential` map. A plain
+ * string value is treated as a bearer token; a {@link Credential} is used as-is.
+ * Always 2-legged (issues directly); throws if a requested service has none.
  */
-export function staticTokens(tokens, options = {}) {
+export function staticTokens(creds, options = {}) {
     return {
         id: options.id ?? 'static-tokens',
         getCredential(req) {
-            const token = tokens[req.service];
-            if (!token) {
-                return Promise.reject(new Error(`staticTokens: no token configured for service '${req.service}'. ` +
-                    `Known services: ${Object.keys(tokens).join(', ') || '(none)'}.`));
+            const entry = creds[req.service];
+            if (entry === undefined) {
+                return Promise.reject(new Error(`staticTokens: no credential configured for service '${req.service}'. ` +
+                    `Known services: ${Object.keys(creds).join(', ') || '(none)'}.`));
             }
+            const credential = typeof entry === 'string' ? bearer(entry) : entry;
             return Promise.resolve({
-                status: 'token',
-                token,
+                status: 'issued',
+                credential,
                 ...(options.expiresAt !== undefined && { expiresAt: options.expiresAt }),
             });
         },

package/dist/esm/identity/staticTokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"staticTokens.js","sourceRoot":"","sources":["../../../src/identity/staticTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAWH;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAwC,EACxC,UAA+B,EAAE;IAEjC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,eAAe;QACjC,aAAa,CAAC,GAAG;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,kDAAkD,GAAG,CAAC,OAAO,KAAK;oBAChE,mBAAmB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,GAAG,CACnE,CACF,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,OAAO;gBACf,KAAK;gBACL,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aACzE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"staticTokens.js","sourceRoot":"","sources":["../../../src/identity/staticTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AASpC;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAoD,EACpD,UAA+B,EAAE;IAEjC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,eAAe;QACjC,aAAa,CAAC,GAAG;YACf,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,uDAAuD,GAAG,CAAC,OAAO,KAAK;oBACrE,mBAAmB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,GAAG,CAClE,CACF,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACrE,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,QAAQ;gBAChB,UAAU;gBACV,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aACzE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/identity/types.js

@@ -23,8 +23,25 @@
  * and observability exporters, which would leak the token into the trace. Pair
  * with `RedactionPolicy` for defence in depth.
  */
-/** Narrow a {@link CredentialResult} to the token branch. */
-export function isCredentialToken(r) {
-    return r.status === 'token';
+/** Narrow a {@link CredentialResult} to the issued-credential branch. */
+export function isCredentialIssued(r) {
+    return r.status === 'issued';
+}
+/**
+ * A fail-closed {@link CredentialProvider} used when none is attached. Every call
+ * throws loudly — so `ctx.credentials` is never `undefined` (no silent
+ * optional-chaining bypass), and a tool that needs a credential without one
+ * configured fails LOUD, not open. Use `ctx.hasCredentials` to branch when a tool
+ * intentionally supports a no-credential (degraded) mode.
+ */
+export function unconfiguredCredentialProvider() {
+    return {
+        id: 'unconfigured',
+        getCredential(req) {
+            return Promise.reject(new Error(`No credential provider configured, but a credential for '${req.service}' was ` +
+                `requested. Pass \`credentials\` to Agent.create({ ..., credentials }) ` +
+                `(e.g. agentCoreIdentity({ region }) or staticTokens({ ... })).`));
+        },
+    };
 }
 //# sourceMappingURL=types.js.map

package/dist/esm/identity/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAyCH,6DAA6D;AAC7D,MAAM,UAAU,iBAAiB,CAAC,CAAmB;IACnD,OAAO,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAsEH,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,CAAmB;IACpD,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;AAC/B,CAAC;AAgBD;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B;IAC5C,OAAO;QACL,EAAE,EAAE,cAAc;QAClB,aAAa,CAAC,GAAsB;YAClC,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,4DAA4D,GAAG,CAAC,OAAO,QAAQ;gBAC7E,wEAAwE;gBACxE,gEAAgE,CACnE,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/identity.js

@@ -19,11 +19,12 @@
  * if (r.status === 'authorization-required') {
  *   // surface r.authorizationUrl to the user (e.g. pause the run), then retry.
  * } else {
- *   callGitHub({ headers: { authorization: `Bearer ${r.token}` } });
+ *   callGitHub({ headers: r.credential.toHeaders() }); // universal applicator
  * }
  * ```
  */
-export { isCredentialToken } from './identity/types.js';
+export { isCredentialIssued, unconfiguredCredentialProvider } from './identity/types.js';
+export { bearer, apiKey, basic, headers, } from './identity/kinds.js';
 export { staticTokens } from './identity/staticTokens.js';
 export { agentCoreIdentity, } from './adapters/identity/agentcore.js';
 //# sourceMappingURL=identity.js.map

package/dist/esm/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AASH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,YAAY,EAA4B,MAAM,4BAA4B,CAAC;AACpF,OAAO,EACL,iBAAiB,GAIlB,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAWH,OAAO,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AACzF,OAAO,EACL,MAAM,EACN,MAAM,EACN,KAAK,EACL,OAAO,GAKR,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAA4B,MAAM,4BAA4B,CAAC;AACpF,OAAO,EACL,iBAAiB,GAIlB,MAAM,kCAAkC,CAAC"}

package/dist/events/registry.js

@@ -80,6 +80,12 @@ exports.EVENT_NAMES = {
         gateClosed: 'agentfootprint.permission.gate_closed',
         halt: 'agentfootprint.permission.halt',
     },
+    credential: {
+        requested: 'agentfootprint.credential.requested',
+        acquired: 'agentfootprint.credential.acquired',
+        authorizationRequired: 'agentfootprint.credential.authorization_required',
+        failed: 'agentfootprint.credential.failed',
+    },
     risk: {
         flagged: 'agentfootprint.risk.flagged',
     },
@@ -161,6 +167,10 @@ exports.ALL_EVENT_TYPES = [
     'agentfootprint.permission.gate_opened',
     'agentfootprint.permission.gate_closed',
     'agentfootprint.permission.halt',
+    'agentfootprint.credential.requested',
+    'agentfootprint.credential.acquired',
+    'agentfootprint.credential.authorization_required',
+    'agentfootprint.credential.failed',
     'agentfootprint.risk.flagged',
     'agentfootprint.fallback.triggered',
     'agentfootprint.cost.tick',

package/dist/events/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/events/registry.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAiEH,yEAAyE;AACzE,sEAAsE;AACtE,wEAAwE;AAC3D,QAAA,WAAW,GAAG;IACzB,WAAW,EAAE;QACX,KAAK,EAAE,kCAAkC;QACzC,IAAI,EAAE,iCAAiC;QACvC,SAAS,EAAE,uCAAuC;QAClD,cAAc,EAAE,4CAA4C;QAC5D,QAAQ,EAAE,sCAAsC;QAChD,YAAY,EAAE,0CAA0C;QACxD,cAAc,EAAE,4CAA4C;QAC5D,aAAa,EAAE,2CAA2C;KAC3D;IACD,KAAK,EAAE;QACL,SAAS,EAAE,iCAAiC;QAC5C,OAAO,EAAE,+BAA+B;QACxC,cAAc,EAAE,sCAAsC;QACtD,YAAY,EAAE,oCAAoC;QAClD,YAAY,EAAE,oCAAoC;QAClD,OAAO,EAAE,8BAA8B;QACvC,4BAA4B,EAAE,sDAAsD;QACpF,mBAAmB,EAAE,4CAA4C;KAClE;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,iCAAiC;QAC3C,MAAM,EAAE,+BAA+B;QACvC,KAAK,EAAE,6BAA6B;QACpC,SAAS,EAAE,kCAAkC;QAC7C,OAAO,EAAE,gCAAgC;QACzC,aAAa,EAAE,sCAAsC;QACrD,WAAW,EAAE,oCAAoC;KAClD;IACD,OAAO,EAAE;QACP,QAAQ,EAAE,iCAAiC;QAC3C,OAAO,EAAE,gCAAgC;QACzC,YAAY,EAAE,sCAAsC;QACpD,cAAc,EAAE,wCAAwC;QACxD,SAAS,EAAE,kCAAkC;KAC9C;IACD,MAAM,EAAE;QACN,eAAe,EAAE,wCAAwC;QACzD,QAAQ,EAAE,gCAAgC;QAC1C,QAAQ,EAAE,gCAAgC;QAC1C,OAAO,EAAE,+BAA+B;KACzC;IACD,KAAK,EAAE;QACL,OAAO,EAAE,8BAA8B;QACvC,SAAS,EAAE,gCAAgC;QAC3C,WAAW,EAAE,kCAAkC;QAC/C,gBAAgB,EAAE,wCAAwC;QAC1D,kBAAkB,EAAE,0CAA0C;QAC9D,eAAe,EAAE,uCAAuC;KACzD;IACD,KAAK,EAAE;QACL,SAAS,EAAE,gCAAgC;QAC3C,WAAW,EAAE,kCAAkC;KAChD;IACD,UAAU,EAAE;QACV,KAAK,EAAE,iCAAiC;QACxC,UAAU,EAAE,uCAAuC;QACnD,UAAU,EAAE,uCAAuC;QACnD,IAAI,EAAE,gCAAgC;KACvC;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,6BAA6B;KACvC;IACD,QAAQ,EAAE;QACR,SAAS,EAAE,mCAAmC;KAC/C;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,+BAA+B;KAC1C;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,2BAA2B;QAClC,gBAAgB,EAAE,uCAAuC;KAC1D;IACD,KAAK,EAAE;QACL,OAAO,EAAE,8BAA8B;QACvC,SAAS,EAAE,gCAAgC;QAC3C,KAAK,EAAE,4BAA4B;KACpC;IACD,WAAW,EAAE;QACX,QAAQ,EAAE,sCAAsC;QAChD,OAAO,EAAE,oCAAoC;QAC7C,SAAS,EAAE,sCAAsC;KAClD;IACD,KAAK,EAAE;QACL,OAAO,EAAE,8BAA8B;QACvC,MAAM,EAAE,6BAA6B;KACtC;IACD,SAAS,EAAE;QACT,SAAS,EAAE,oCAAoC;KAChD;CACO,CAAC;AAyQX;;;GAGG;AACU,QAAA,eAAe,GAAuC;IACjE,kCAAkC;IAClC,iCAAiC;IACjC,uCAAuC;IACvC,4CAA4C;IAC5C,sCAAsC;IACtC,0CAA0C;IAC1C,4CAA4C;IAC5C,2CAA2C;IAC3C,iCAAiC;IACjC,+BAA+B;IAC/B,sCAAsC;IACtC,oCAAoC;IACpC,oCAAoC;IACpC,8BAA8B;IAC9B,sDAAsD;IACtD,4CAA4C;IAC5C,iCAAiC;IACjC,+BAA+B;IAC/B,6BAA6B;IAC7B,kCAAkC;IAClC,gCAAgC;IAChC,sCAAsC;IACtC,oCAAoC;IACpC,iCAAiC;IACjC,gCAAgC;IAChC,sCAAsC;IACtC,wCAAwC;IACxC,kCAAkC;IAClC,wCAAwC;IACxC,gCAAgC;IAChC,gCAAgC;IAChC,+BAA+B;IAC/B,8BAA8B;IAC9B,gCAAgC;IAChC,kCAAkC;IAClC,wCAAwC;IACxC,0CAA0C;IAC1C,uCAAuC;IACvC,gCAAgC;IAChC,kCAAkC;IAClC,iCAAiC;IACjC,uCAAuC;IACvC,uCAAuC;IACvC,gCAAgC;IAChC,6BAA6B;IAC7B,mCAAmC;IACnC,0BAA0B;IAC1B,+BAA+B;IAC/B,2BAA2B;IAC3B,uCAAuC;IACvC,8BAA8B;IAC9B,gCAAgC;IAChC,4BAA4B;IAC5B,sCAAsC;IACtC,oCAAoC;IACpC,sCAAsC;IACtC,8BAA8B;IAC9B,6BAA6B;IAC7B,oCAAoC;CAC5B,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/events/registry.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAqEH,yEAAyE;AACzE,sEAAsE;AACtE,wEAAwE;AAC3D,QAAA,WAAW,GAAG;IACzB,WAAW,EAAE;QACX,KAAK,EAAE,kCAAkC;QACzC,IAAI,EAAE,iCAAiC;QACvC,SAAS,EAAE,uCAAuC;QAClD,cAAc,EAAE,4CAA4C;QAC5D,QAAQ,EAAE,sCAAsC;QAChD,YAAY,EAAE,0CAA0C;QACxD,cAAc,EAAE,4CAA4C;QAC5D,aAAa,EAAE,2CAA2C;KAC3D;IACD,KAAK,EAAE;QACL,SAAS,EAAE,iCAAiC;QAC5C,OAAO,EAAE,+BAA+B;QACxC,cAAc,EAAE,sCAAsC;QACtD,YAAY,EAAE,oCAAoC;QAClD,YAAY,EAAE,oCAAoC;QAClD,OAAO,EAAE,8BAA8B;QACvC,4BAA4B,EAAE,sDAAsD;QACpF,mBAAmB,EAAE,4CAA4C;KAClE;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,iCAAiC;QAC3C,MAAM,EAAE,+BAA+B;QACvC,KAAK,EAAE,6BAA6B;QACpC,SAAS,EAAE,kCAAkC;QAC7C,OAAO,EAAE,gCAAgC;QACzC,aAAa,EAAE,sCAAsC;QACrD,WAAW,EAAE,oCAAoC;KAClD;IACD,OAAO,EAAE;QACP,QAAQ,EAAE,iCAAiC;QAC3C,OAAO,EAAE,gCAAgC;QACzC,YAAY,EAAE,sCAAsC;QACpD,cAAc,EAAE,wCAAwC;QACxD,SAAS,EAAE,kCAAkC;KAC9C;IACD,MAAM,EAAE;QACN,eAAe,EAAE,wCAAwC;QACzD,QAAQ,EAAE,gCAAgC;QAC1C,QAAQ,EAAE,gCAAgC;QAC1C,OAAO,EAAE,+BAA+B;KACzC;IACD,KAAK,EAAE;QACL,OAAO,EAAE,8BAA8B;QACvC,SAAS,EAAE,gCAAgC;QAC3C,WAAW,EAAE,kCAAkC;QAC/C,gBAAgB,EAAE,wCAAwC;QAC1D,kBAAkB,EAAE,0CAA0C;QAC9D,eAAe,EAAE,uCAAuC;KACzD;IACD,KAAK,EAAE;QACL,SAAS,EAAE,gCAAgC;QAC3C,WAAW,EAAE,kCAAkC;KAChD;IACD,UAAU,EAAE;QACV,KAAK,EAAE,iCAAiC;QACxC,UAAU,EAAE,uCAAuC;QACnD,UAAU,EAAE,uCAAuC;QACnD,IAAI,EAAE,gCAAgC;KACvC;IACD,UAAU,EAAE;QACV,SAAS,EAAE,qCAAqC;QAChD,QAAQ,EAAE,oCAAoC;QAC9C,qBAAqB,EAAE,kDAAkD;QACzE,MAAM,EAAE,kCAAkC;KAC3C;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,6BAA6B;KACvC;IACD,QAAQ,EAAE;QACR,SAAS,EAAE,mCAAmC;KAC/C;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,+BAA+B;KAC1C;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,2BAA2B;QAClC,gBAAgB,EAAE,uCAAuC;KAC1D;IACD,KAAK,EAAE;QACL,OAAO,EAAE,8BAA8B;QACvC,SAAS,EAAE,gCAAgC;QAC3C,KAAK,EAAE,4BAA4B;KACpC;IACD,WAAW,EAAE;QACX,QAAQ,EAAE,sCAAsC;QAChD,OAAO,EAAE,oCAAoC;QAC7C,SAAS,EAAE,sCAAsC;KAClD;IACD,KAAK,EAAE;QACL,OAAO,EAAE,8BAA8B;QACvC,MAAM,EAAE,6BAA6B;KACtC;IACD,SAAS,EAAE;QACT,SAAS,EAAE,oCAAoC;KAChD;CACO,CAAC;AA0RX;;;GAGG;AACU,QAAA,eAAe,GAAuC;IACjE,kCAAkC;IAClC,iCAAiC;IACjC,uCAAuC;IACvC,4CAA4C;IAC5C,sCAAsC;IACtC,0CAA0C;IAC1C,4CAA4C;IAC5C,2CAA2C;IAC3C,iCAAiC;IACjC,+BAA+B;IAC/B,sCAAsC;IACtC,oCAAoC;IACpC,oCAAoC;IACpC,8BAA8B;IAC9B,sDAAsD;IACtD,4CAA4C;IAC5C,iCAAiC;IACjC,+BAA+B;IAC/B,6BAA6B;IAC7B,kCAAkC;IAClC,gCAAgC;IAChC,sCAAsC;IACtC,oCAAoC;IACpC,iCAAiC;IACjC,gCAAgC;IAChC,sCAAsC;IACtC,wCAAwC;IACxC,kCAAkC;IAClC,wCAAwC;IACxC,gCAAgC;IAChC,gCAAgC;IAChC,+BAA+B;IAC/B,8BAA8B;IAC9B,gCAAgC;IAChC,kCAAkC;IAClC,wCAAwC;IACxC,0CAA0C;IAC1C,uCAAuC;IACvC,gCAAgC;IAChC,kCAAkC;IAClC,iCAAiC;IACjC,uCAAuC;IACvC,uCAAuC;IACvC,gCAAgC;IAChC,qCAAqC;IACrC,oCAAoC;IACpC,kDAAkD;IAClD,kCAAkC;IAClC,6BAA6B;IAC7B,mCAAmC;IACnC,0BAA0B;IAC1B,+BAA+B;IAC/B,2BAA2B;IAC3B,uCAAuC;IACvC,8BAA8B;IAC9B,gCAAgC;IAChC,4BAA4B;IAC5B,sCAAsC;IACtC,oCAAoC;IACpC,sCAAsC;IACtC,8BAA8B;IAC9B,6BAA6B;IAC7B,oCAAoC;CAC5B,CAAC"}

package/dist/identity/kinds.js

@@ -0,0 +1,73 @@
+"use strict";
+/**
+ * Built-in credential kinds — small strategies implementing the {@link Credential}
+ * protocol. Each is a factory returning `{ kind, ...rawFields, toHeaders() }`.
+ *
+ * The framework + tools only ever call `cred.toHeaders()` (generic — no `kind`
+ * switching); the raw fields are there for the rare non-HTTP case. A custom kind
+ * is any object implementing `Credential` — no library change needed.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.headers = exports.basic = exports.apiKey = exports.bearer = void 0;
+/** Cross-env base64 (browser `btoa` / Node `Buffer`). */
+function base64(s) {
+    if (typeof btoa === 'function')
+        return btoa(s);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const B = globalThis.Buffer;
+    if (B)
+        return B.from(s, 'utf8').toString('base64');
+    throw new Error('basic(): no base64 encoder available in this runtime.');
+}
+/**
+ * Redefine secret-bearing fields as NON-ENUMERABLE — defence in depth: if a
+ * consumer accidentally serializes a credential (returns `ctx.credential` from
+ * a tool, logs it, embeds it in a result object), `JSON.stringify` emits only
+ * the non-secret fields (e.g. `{"kind":"bearer"}`), never the raw secret. The
+ * fields still READ normally (`cred.token` works); `toHeaders()` is the
+ * intended applicator either way. (`structuredClone` rejects the credential
+ * outright — `toHeaders` is a function — so it can't enter tracked scope.)
+ */
+function hideSecrets(cred, fields) {
+    for (const f of fields) {
+        Object.defineProperty(cred, f, {
+            value: cred[f],
+            enumerable: false,
+            writable: false,
+            configurable: false,
+        });
+    }
+    return cred;
+}
+/** OAuth / bearer token → `Authorization: Bearer <token>`. */
+function bearer(token) {
+    return hideSecrets({ kind: 'bearer', token, toHeaders: () => ({ authorization: `Bearer ${token}` }) }, ['token']);
+}
+exports.bearer = bearer;
+/** API key → a single header (default `x-api-key`). */
+function apiKey(key, headerName = 'x-api-key') {
+    return hideSecrets({ kind: 'apiKey', key, headerName, toHeaders: () => ({ [headerName]: key }) }, ['key']);
+}
+exports.apiKey = apiKey;
+/** HTTP Basic auth → `Authorization: Basic base64(user:pass)`. */
+function basic(username, password) {
+    const encoded = base64(`${username}:${password}`);
+    return hideSecrets({
+        kind: 'basic',
+        username,
+        password,
+        toHeaders: () => ({ authorization: `Basic ${encoded}` }),
+    }, ['password']);
+}
+exports.basic = basic;
+/** The universal escape: arbitrary auth headers. Any scheme reduces to this, so
+ *  a provider with no matching typed kind can always return `headers(...)`. */
+function headers(map) {
+    const copy = { ...map };
+    // The header map IS the secret here — hide it like the other kinds' raw fields.
+    return hideSecrets({ kind: 'headers', headers: copy, toHeaders: () => ({ ...copy }) }, [
+        'headers',
+    ]);
+}
+exports.headers = headers;
+//# sourceMappingURL=kinds.js.map

package/dist/identity/kinds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kinds.js","sourceRoot":"","sources":["../../src/identity/kinds.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAIH,yDAAyD;AACzD,SAAS,MAAM,CAAC,CAAS;IACvB,IAAI,OAAO,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/C,8DAA8D;IAC9D,MAAM,CAAC,GAAI,UAAkB,CAAC,MAAM,CAAC;IACrC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAmB,IAAO,EAAE,MAA4B;IAC1E,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,EAAE;YAC7B,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;YACd,UAAU,EAAE,KAAK;YACjB,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAMD,8DAA8D;AAC9D,SAAgB,MAAM,CAAC,KAAa;IAClC,OAAO,WAAW,CAChB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,EAAE,EAClF,CAAC,OAAO,CAAC,CACV,CAAC;AACJ,CAAC;AALD,wBAKC;AAOD,uDAAuD;AACvD,SAAgB,MAAM,CAAC,GAAW,EAAE,UAAU,GAAG,WAAW;IAC1D,OAAO,WAAW,CAChB,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAC7E,CAAC,KAAK,CAAC,CACR,CAAC;AACJ,CAAC;AALD,wBAKC;AAOD,kEAAkE;AAClE,SAAgB,KAAK,CAAC,QAAgB,EAAE,QAAgB;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC;IAClD,OAAO,WAAW,CAChB;QACE,IAAI,EAAE,OAAO;QACb,QAAQ;QACR,QAAQ;QACR,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,OAAO,EAAE,EAAE,CAAC;KACzD,EACD,CAAC,UAAU,CAAC,CACb,CAAC;AACJ,CAAC;AAXD,sBAWC;AAMD;+EAC+E;AAC/E,SAAgB,OAAO,CAAC,GAAqC;IAC3D,MAAM,IAAI,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IACxB,gFAAgF;IAChF,OAAO,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE;QACrF,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAND,0BAMC"}

package/dist/identity/staticTokens.js

@@ -1,33 +1,40 @@
 "use strict";
 /**
- * staticTokens — a dev/test {@link CredentialProvider} backed by canned tokens.
+ * staticTokens — a dev/test {@link CredentialProvider} backed by canned credentials.
  *
  * No network, no SDK. Use it to develop tools that need credentials without
  * standing up AgentCore Identity (or any IdP). Production swaps it for
  * `agentCoreIdentity()` — the tool code never changes.
  *
- *   const credentials = staticTokens({ github: 'ghp_dev_xxx', slack: 'xoxb-dev' });
+ *   // a plain string is treated as a bearer token (the common case):
+ *   const credentials = staticTokens({ github: 'ghp_dev_xxx' });
+ *   // …or give an explicit kind:
+ *   const credentials = staticTokens({ internal: apiKey('k', 'x-internal-key') });
+ *
  *   const r = await credentials.getCredential({ service: 'github' });
- *   if (r.status === 'token') useHeader(`Bearer ${r.token}`);
+ *   if (isCredentialIssued(r)) callGithub({ headers: r.credential.toHeaders() });
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.staticTokens = void 0;
+const kinds_js_1 = require("./kinds.js");
 /**
- * Build a {@link CredentialProvider} from a `service → token` map. Always 2-legged
- * (returns the token directly); throws if a requested service has no token.
+ * Build a {@link CredentialProvider} from a `service → credential` map. A plain
+ * string value is treated as a bearer token; a {@link Credential} is used as-is.
+ * Always 2-legged (issues directly); throws if a requested service has none.
  */
-function staticTokens(tokens, options = {}) {
+function staticTokens(creds, options = {}) {
     return {
         id: options.id ?? 'static-tokens',
         getCredential(req) {
-            const token = tokens[req.service];
-            if (!token) {
-                return Promise.reject(new Error(`staticTokens: no token configured for service '${req.service}'. ` +
-                    `Known services: ${Object.keys(tokens).join(', ') || '(none)'}.`));
+            const entry = creds[req.service];
+            if (entry === undefined) {
+                return Promise.reject(new Error(`staticTokens: no credential configured for service '${req.service}'. ` +
+                    `Known services: ${Object.keys(creds).join(', ') || '(none)'}.`));
             }
+            const credential = typeof entry === 'string' ? (0, kinds_js_1.bearer)(entry) : entry;
             return Promise.resolve({
-                status: 'token',
-                token,
+                status: 'issued',
+                credential,
                 ...(options.expiresAt !== undefined && { expiresAt: options.expiresAt }),
             });
         },

package/dist/identity/staticTokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"staticTokens.js","sourceRoot":"","sources":["../../src/identity/staticTokens.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAWH;;;GAGG;AACH,SAAgB,YAAY,CAC1B,MAAwC,EACxC,UAA+B,EAAE;IAEjC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,eAAe;QACjC,aAAa,CAAC,GAAG;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,kDAAkD,GAAG,CAAC,OAAO,KAAK;oBAChE,mBAAmB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,GAAG,CACnE,CACF,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,OAAO;gBACf,KAAK;gBACL,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aACzE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAvBD,oCAuBC"}
+{"version":3,"file":"staticTokens.js","sourceRoot":"","sources":["../../src/identity/staticTokens.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAGH,yCAAoC;AASpC;;;;GAIG;AACH,SAAgB,YAAY,CAC1B,KAAoD,EACpD,UAA+B,EAAE;IAEjC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,eAAe;QACjC,aAAa,CAAC,GAAG;YACf,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,uDAAuD,GAAG,CAAC,OAAO,KAAK;oBACrE,mBAAmB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,GAAG,CAClE,CACF,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,iBAAM,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACrE,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,QAAQ;gBAChB,UAAU;gBACV,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aACzE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAxBD,oCAwBC"}