eve 0.13.8 → 0.15.0

package/dist/src/public/channels/slack/slackChannel.d.ts

@@ -5,6 +5,7 @@ import type { ChannelSessionOps } from "#public/definitions/defineChannel.js";
 import type { HandleMessageStreamEvent } from "#protocol/message.js";
 import { type SlackBotToken, type SlackHandle, type SlackThread } from "#public/channels/slack/api.js";
 import { type SlackMessage } from "#public/channels/slack/inbound.js";
+import { type LoadThreadContextMessagesOptions } from "#public/channels/slack/thread.js";
 import { type UploadPolicyInput } from "#public/channels/upload-policy.js";
 import { type SlackWebhookVerifier } from "#public/channels/slack/verify.js";
 import { type Channel } from "#public/definitions/defineChannel.js";
@@ -291,6 +292,13 @@ export interface SlackChannelConfig {
      * unrestricted media types.
      */
     readonly uploadPolicy?: UploadPolicyInput;
+    /**
+     * Adds earlier replies from the current Slack thread to each triggering
+     * turn. Messages are rendered with their Slack sender ids attached so a
+     * multi-user transcript retains unambiguous speaker attribution. Omit this
+     * option to avoid fetching thread history.
+     */
+    readonly threadContext?: LoadThreadContextMessagesOptions;
     /**
      * Invoked when a Slack `app_mention` event arrives (only `app_mention`;
      * other event types are ignored). Decides whether to dispatch and with

package/dist/src/public/channels/slack/slackChannel.js

@@ -1 +1 @@
-import{markEventHandled}from"./utils.js";import{createLogger,logError}from"#internal/logging.js";import{POST,defineChannel}from"#public/definitions/defineChannel.js";import{mergeUploadPolicy}from"#public/channels/upload-policy.js";import{buildSlackBinding,slackContinuationToken}from"#public/channels/slack/api.js";import{defaultEvents,defaultInputRequestedHandler,defaultOnAppMention,defaultOnDirectMessage}from"#public/channels/slack/defaults.js";import{buildSlackTurnMessage,collectInboundFileParts,createSlackFetchFile}from"#public/channels/slack/attachments.js";import{formatSlackContextBlock,parseAppMentionEvent,parseDirectMessageEvent}from"#public/channels/slack/inbound.js";import{SLACK_CHANNEL_DEFAULT_ROUTE}from"#public/channels/slack/constants.js";import{handleInteractionPost}from"#public/channels/slack/interactions.js";import{verifySlackRequest}from"#public/channels/slack/verify.js";const log=createLogger(`slack.channel`);function rebuildSlackContext(e,t,n){let{thread:r,slack:i}=buildSlackBinding({botToken:n?.botToken,channelId:e.channelId??``,threadTs:e.threadTs??``,teamId:e.teamId??void 0,onThreadTsChanged(n){e.threadTs=n,e.channelId&&t.setContinuationToken(slackContinuationToken(e.channelId,n))}});return{thread:r,slack:i,state:e}}function slackChannel(e={}){let t=mergeUploadPolicy(e.uploadPolicy),n=createSlackFetchFile({botToken:e.credentials?.botToken}),u=e.onAppMention??defaultOnAppMention,d=e.onDirectMessage??defaultOnDirectMessage,f=e.events?.[`authorization.required`],p={...defaultEvents,...e.events,"input.requested":e.events?.[`input.requested`]??defaultInputRequestedHandler(),"authorization.required":f===void 0?defaultEvents[`authorization.required`]:constrainAuthorizationRequired(f)},m=new Set;return defineChannel({kindHint:`slack`,state:{channelId:null,threadTs:null,teamId:null,triggeringUserId:null,pendingToolCallMessage:null,lastReasoningTypingAtMs:null,lastReasoningTypingStatus:null,pendingAuthMessageTs:{}},fetchFile:n,metadata(e){return{channelId:e.channelId,teamId:e.teamId,threadTs:e.threadTs,triggeringUserId:e.triggeringUserId??null}},context(t,n){return rebuildSlackContext(t,n,e.credentials)},routes:[POST(e.route??SLACK_CHANNEL_DEFAULT_ROUTE,async(n,{send:r,waitUntil:i})=>{let a=await verifyInbound(n,e.credentials);return a===null?new Response(`unauthorized`,{status:401}):shouldDropSlackHttpTimeoutRetry(n.headers)?new Response(`ok`):(n.headers.get(`content-type`)??``).includes(`application/x-www-form-urlencoded`)?handleInteractionPost(a,{send:r,waitUntil:i},{config:e}):handleEventPost({body:a,send:r,waitUntil:i,onAppMention:u,onDirectMessage:d,uploadPolicy:t,handledEvents:m,headers:n.headers,credentials:e.credentials})})],async receive(t,{send:n}){let r=t.target,i=r.channelId;if(!i||typeof i!=`string`)throw Error(`slackChannel().receive requires target.channelId.`);let a=typeof r.threadTs==`string`?r.threadTs:``,s=r.initialMessage;if(s&&a.length>0)throw Error("slackChannel().receive: `threadTs` and `initialMessage` are mutually exclusive.");let c=a;if(s){let{thread:t}=buildSlackBinding({botToken:e.credentials?.botToken,channelId:i,threadTs:``,teamId:void 0}),n={card:s.card};s.fallbackText!==void 0&&(n.fallbackText=s.fallbackText),c=(await t.post(n)).id}let l=c||crypto.randomUUID();return n(t.message,{auth:t.auth,continuationToken:slackContinuationToken(i,l),state:{channelId:i,threadTs:c||null,teamId:null,triggeringUserId:null}})},events:p})}function constrainAuthorizationRequired(e){return(t,n,r)=>e(t,{postEphemeral:(e,t)=>n.thread.postEphemeral(e,t),postDirectMessage:(e,t)=>n.thread.postDirectMessage(e,t),state:n.state},r)}function shouldDropSlackHttpTimeoutRetry(e){return Number(e.get(`x-slack-retry-num`)??`0`)>=1&&e.get(`x-slack-retry-reason`)===`http_timeout`}async function handleEventPost(t){let n;try{n=JSON.parse(t.body)}catch(e){return log.warn(`inbound webhook body is not valid JSON`,{error:e}),new Response(`ok`)}if(typeof n.challenge==`string`)return new Response(n.challenge,{status:200,headers:{"content-type":`text/plain`}});if(n.event_id){if(t.handledEvents.has(n.event_id))return log.warn(`received a duplicate event`,{event_id:n.event_id,event_time:n.event_time,retry_num:t.headers.get(`x-slack-retry-num`)||`(null)`,retry_reason:t.headers.get(`x-slack-retry-reason`)||`(null)`}),new Response(`ok`);markEventHandled(n.event_id,t.handledEvents)}let r=parseAppMentionEvent(n);if(r)return t.waitUntil(dispatchInboundMessage({kind:`app_mention`,message:r,handler:t.onAppMention,send:t.send,uploadPolicy:t.uploadPolicy,credentials:t.credentials})),new Response(`ok`);let i=parseDirectMessageEvent(n);return i&&t.waitUntil(dispatchInboundMessage({kind:`direct_message`,message:i,handler:t.onDirectMessage,send:t.send,uploadPolicy:t.uploadPolicy,credentials:t.credentials})),new Response(`ok`)}async function verifyInbound(e,t){try{return await verifySlackRequest(e,{signingSecret:t?.signingSecret??(t?.webhookVerifier?void 0:process.env.SLACK_SIGNING_SECRET),webhookVerifier:t?.webhookVerifier})}catch(e){return log.warn(`slack inbound verification failed`,{error:e}),null}}async function dispatchInboundMessage(e){let{message:t,kind:r}=e,{thread:i,slack:a}=buildSlackBinding({botToken:e.credentials?.botToken,channelId:t.channelId,threadTs:t.threadTs,teamId:t.teamId}),s={thread:i,slack:a},c;try{c=await e.handler(s,t)}catch(e){logError(log,`${r} handler failed`,e,{channelId:t.channelId});return}if(c!=null)try{let n=await collectInboundFileParts({mention:t,thread:i,policy:e.uploadPolicy}),r=buildSlackTurnMessage(t.markdown,n),a={channelId:t.channelId,fullName:t.author?.fullName,teamId:t.teamId,threadTs:t.threadTs,userId:t.author?.userId??``,userName:t.author?.userName},o=c.context??[];await e.send({message:r,context:[formatSlackContextBlock(a),...o]},{auth:c.auth,continuationToken:slackContinuationToken(t.channelId,t.threadTs),state:{channelId:t.channelId,threadTs:t.threadTs,teamId:t.teamId??null,triggeringUserId:a.userId||null}})}catch(e){logError(log,`${r} delivery failed`,e,{channelId:t.channelId})}}export{constrainAuthorizationRequired,slackChannel};
+import{markEventHandled}from"./utils.js";import{createLogger,logError}from"#internal/logging.js";import{POST,defineChannel}from"#public/definitions/defineChannel.js";import{mergeUploadPolicy}from"#public/channels/upload-policy.js";import{buildSlackBinding,slackContinuationToken}from"#public/channels/slack/api.js";import{slackUserIdFromAuthContext}from"#public/channels/slack/auth.js";import{defaultEvents,defaultInputRequestedHandler,defaultOnAppMention,defaultOnDirectMessage}from"#public/channels/slack/defaults.js";import{loadThreadContextMessages}from"#public/channels/slack/thread.js";import{buildSlackTurnMessage,collectInboundFileParts,createSlackFetchFile}from"#public/channels/slack/attachments.js";import{parseAppMentionEvent,parseDirectMessageEvent}from"#public/channels/slack/inbound.js";import{formatSlackInboundMessage,formatSlackThreadContext}from"#public/channels/slack/model-context.js";import{SLACK_CHANNEL_DEFAULT_ROUTE}from"#public/channels/slack/constants.js";import{handleInteractionPost}from"#public/channels/slack/interactions.js";import{verifySlackRequest}from"#public/channels/slack/verify.js";const log=createLogger(`slack.channel`);function rebuildSlackContext(e,t,n){let{thread:r,slack:i}=buildSlackBinding({botToken:n?.botToken,channelId:e.channelId??``,threadTs:e.threadTs??``,teamId:e.teamId??void 0,onThreadTsChanged(n){e.threadTs=n,e.channelId&&t.setContinuationToken(slackContinuationToken(e.channelId,n))}});return{thread:r,slack:i,state:e}}function slackChannel(e={}){let t=mergeUploadPolicy(e.uploadPolicy),n=createSlackFetchFile({botToken:e.credentials?.botToken}),u=e.onAppMention??defaultOnAppMention,d=e.onDirectMessage??defaultOnDirectMessage,f=e.events?.[`authorization.required`],p=e.events?.[`turn.started`]??defaultEvents[`turn.started`],m={...defaultEvents,...e.events,async"turn.started"(e,t,n){let r=slackUserIdFromAuthContext(n.session.auth.current);r!==void 0&&(t.state.triggeringUserId=r),await p(e,t,n)},"input.requested":e.events?.[`input.requested`]??defaultInputRequestedHandler(),"authorization.required":f===void 0?defaultEvents[`authorization.required`]:constrainAuthorizationRequired(f)},h=new Set;return defineChannel({kindHint:`slack`,state:{channelId:null,threadTs:null,teamId:null,triggeringUserId:null,pendingToolCallMessage:null,lastReasoningTypingAtMs:null,lastReasoningTypingStatus:null,pendingAuthMessageTs:{}},fetchFile:n,metadata(e){return{channelId:e.channelId,teamId:e.teamId,threadTs:e.threadTs,triggeringUserId:e.triggeringUserId??null}},context(t,n){return rebuildSlackContext(t,n,e.credentials)},routes:[POST(e.route??SLACK_CHANNEL_DEFAULT_ROUTE,async(n,{send:r,waitUntil:i})=>{let a=await verifyInbound(n,e.credentials);return a===null?new Response(`unauthorized`,{status:401}):shouldDropSlackHttpTimeoutRetry(n.headers)?new Response(`ok`):(n.headers.get(`content-type`)??``).includes(`application/x-www-form-urlencoded`)?handleInteractionPost(a,{send:r,waitUntil:i},{config:e}):handleEventPost({body:a,send:r,waitUntil:i,onAppMention:u,onDirectMessage:d,uploadPolicy:t,threadContext:e.threadContext,handledEvents:h,headers:n.headers,credentials:e.credentials})})],async receive(t,{send:n}){let r=t.target,i=r.channelId;if(!i||typeof i!=`string`)throw Error(`slackChannel().receive requires target.channelId.`);let a=typeof r.threadTs==`string`?r.threadTs:``,s=r.initialMessage;if(s&&a.length>0)throw Error("slackChannel().receive: `threadTs` and `initialMessage` are mutually exclusive.");let c=a;if(s){let{thread:t}=buildSlackBinding({botToken:e.credentials?.botToken,channelId:i,threadTs:``,teamId:void 0}),n={card:s.card};s.fallbackText!==void 0&&(n.fallbackText=s.fallbackText),c=(await t.post(n)).id}let l=c||crypto.randomUUID();return n(t.message,{auth:t.auth,continuationToken:slackContinuationToken(i,l),state:{channelId:i,threadTs:c||null,teamId:null,triggeringUserId:null}})},events:m})}function constrainAuthorizationRequired(e){return(t,n,r)=>e(t,{postEphemeral:(e,t)=>n.thread.postEphemeral(e,t),postDirectMessage:(e,t)=>n.thread.postDirectMessage(e,t),state:n.state},r)}function shouldDropSlackHttpTimeoutRetry(e){return Number(e.get(`x-slack-retry-num`)??`0`)>=1&&e.get(`x-slack-retry-reason`)===`http_timeout`}async function handleEventPost(t){let n;try{n=JSON.parse(t.body)}catch(e){return log.warn(`inbound webhook body is not valid JSON`,{error:e}),new Response(`ok`)}if(typeof n.challenge==`string`)return new Response(n.challenge,{status:200,headers:{"content-type":`text/plain`}});if(n.event_id){if(t.handledEvents.has(n.event_id))return log.warn(`received a duplicate event`,{event_id:n.event_id,event_time:n.event_time,retry_num:t.headers.get(`x-slack-retry-num`)||`(null)`,retry_reason:t.headers.get(`x-slack-retry-reason`)||`(null)`}),new Response(`ok`);markEventHandled(n.event_id,t.handledEvents)}let r=parseAppMentionEvent(n);if(r)return t.waitUntil(dispatchInboundMessage({kind:`app_mention`,message:r,handler:t.onAppMention,send:t.send,uploadPolicy:t.uploadPolicy,threadContext:t.threadContext,credentials:t.credentials})),new Response(`ok`);let i=parseDirectMessageEvent(n);return i&&t.waitUntil(dispatchInboundMessage({kind:`direct_message`,message:i,handler:t.onDirectMessage,send:t.send,uploadPolicy:t.uploadPolicy,threadContext:t.threadContext,credentials:t.credentials})),new Response(`ok`)}async function verifyInbound(e,t){try{return await verifySlackRequest(e,{signingSecret:t?.signingSecret??(t?.webhookVerifier?void 0:process.env.SLACK_SIGNING_SECRET),webhookVerifier:t?.webhookVerifier})}catch(e){return log.warn(`slack inbound verification failed`,{error:e}),null}}async function dispatchInboundMessage(e){let{message:t,kind:r}=e,{thread:i,slack:a}=buildSlackBinding({botToken:e.credentials?.botToken,channelId:t.channelId,threadTs:t.threadTs,teamId:t.teamId}),s={thread:i,slack:a},c;try{c=await e.handler(s,t)}catch(e){logError(log,`${r} handler failed`,e,{channelId:t.channelId});return}if(c!=null)try{let n=formatSlackThreadContext(e.threadContext===void 0?[]:await loadThreadContextMessages(i,t,e.threadContext)),r=await collectInboundFileParts({mention:t,thread:i,policy:e.uploadPolicy}),a={channelId:t.channelId,fullName:t.author?.fullName,teamId:t.teamId,threadTs:t.threadTs,userId:t.author?.userId??``,userName:t.author?.userName},o=formatSlackInboundMessage(a,t),s=buildSlackTurnMessage(n===void 0?o:`${n}\n\n${o}`,r),l=c.context??[];await e.send(l.length===0?{message:s}:{message:s,context:l},{auth:c.auth,continuationToken:slackContinuationToken(t.channelId,t.threadTs),state:{channelId:t.channelId,threadTs:t.threadTs,teamId:t.teamId??null,triggeringUserId:a.userId||null},title:t.markdown})}catch(e){logError(log,`${r} delivery failed`,e,{channelId:t.channelId})}}export{constrainAuthorizationRequired,slackChannel};

package/dist/src/public/connections/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * Connection authoring helpers for `agent/connections/*.ts` files.
  */
-export type { AuthorizationCallback, AuthorizationDefinition, ConnectionAuthDefinition, ConnectionPrincipal, HeadersDefinition, InteractiveAuthorizationDefinition, NonInteractiveAuthorizationDefinition, TokenResult, ToolFilterDefinition, } from "#runtime/connections/types.js";
+export type { AuthorizationCallback, AuthorizationDefinition, ConnectionAuthDefinition, ConnectionAuthProvider, ConnectionAuthResolver, ConnectionPrincipal, HeadersDefinition, InteractiveAuthorizationDefinition, NonInteractiveAuthorizationDefinition, TokenResult, ToolFilterDefinition, } from "#runtime/connections/types.js";
 export { defineInteractiveAuthorization } from "#runtime/connections/types.js";
 export type { JsonValue } from "#public/types/json.js";
 export { defineMcpClientConnection, type McpClientConnectionDefinition, } from "#public/definitions/connections/mcp.js";

package/dist/src/public/definitions/agent.d.ts

@@ -1,6 +1,6 @@
 import type { PublicAgentDefinition } from "#shared/agent-definition.js";
 import type { ExactDefinition } from "#public/definitions/exact.js";
-export type { AgentModelOptionsDefinition, AgentBuildDefinition, AgentExperimentalDefinition, AgentWorkflowDefinition, AgentWorkflowWorldDefinition, PublicAgentModelDefinition as AgentModelDefinition, PublicAgentCompactionDefinition as AgentCompactionDefinition, } from "#shared/agent-definition.js";
+export type { AgentModelOptionsDefinition, AgentReasoningDefinition, AgentBuildDefinition, AgentExperimentalDefinition, AgentWorkflowDefinition, AgentWorkflowWorldDefinition, PublicAgentModelDefinition as AgentModelDefinition, PublicAgentCompactionDefinition as AgentCompactionDefinition, } from "#shared/agent-definition.js";
 /**
  * Additive public agent configuration authored in `agent.ts`.
  *

package/dist/src/public/definitions/approval.d.ts

@@ -0,0 +1,40 @@
+import type { SessionContext } from "#public/definitions/callback-context.js";
+type ApprovalToolInput<TInput> = TInput extends object ? Readonly<TInput> : TInput;
+/**
+ * Context passed to an {@link Approval} function.
+ *
+ * Extends {@link SessionContext} so approval policies can make decisions from
+ * the active session, current caller, and turn.
+ *
+ * `approvedTools` is the set of tool names (or compound approval keys)
+ * already approved at least once in the current session. `toolName` is the
+ * runtime name of the tool being evaluated. `toolInput` is the raw input the
+ * model passed, available for input-aware decisions.
+ */
+export interface ApprovalContext<TInput = Record<string, unknown>> extends SessionContext {
+    readonly approvedTools: ReadonlySet<string>;
+    readonly toolInput?: ApprovalToolInput<TInput>;
+    readonly toolName: string;
+}
+/**
+ * Approval decision returned by an {@link Approval} function.
+ *
+ * AI SDK 7 statuses are accepted directly. For compatibility, `true` maps to
+ * `"user-approval"` and `false` maps to `"not-applicable"`.
+ */
+export type ApprovalStatus = undefined | boolean | "not-applicable" | "approved" | "denied" | "user-approval" | {
+    readonly type: "not-applicable";
+    readonly reason?: never;
+} | {
+    readonly type: "approved";
+    readonly reason?: string;
+} | {
+    readonly type: "denied";
+    readonly reason?: string;
+} | {
+    readonly type: "user-approval";
+    readonly reason?: never;
+};
+/** Shared approval policy used by authored tools and connections. */
+export type Approval<TInput = Record<string, unknown>> = (ctx: ApprovalContext<TInput>) => ApprovalStatus | Promise<ApprovalStatus>;
+export {};

package/dist/src/public/definitions/approval.js

@@ -0,0 +1 @@
+export{};

package/dist/src/public/definitions/connections/mcp.d.ts

@@ -1,5 +1,5 @@
 import type { ConnectionAuthDefinition, HeadersDefinition, ToolFilterDefinition } from "#runtime/connections/types.js";
-import type { NeedsApprovalContext } from "#public/definitions/tool.js";
+import type { Approval } from "#public/definitions/approval.js";
 /**
  * Public definition for an MCP client connection authored in
  * `connections/*.ts`.
@@ -37,6 +37,8 @@ export interface McpClientConnectionDefinition {
      * - Three-method form: provide `startAuthorization` and
      *   `completeAuthorization` together to opt into
      *   interactive OAuth authorization.
+     * - Resolver form: pass `(ctx) => provider` to select either shape
+     *   from the active caller's session context.
      *
      * Optional when `headers` is provided for non-Bearer auth schemes.
      */
@@ -52,12 +54,14 @@ export interface McpClientConnectionDefinition {
      * When omitted, tool calls execute without approval, consistent
      * with authored tools.
      */
-    approval?: (ctx: NeedsApprovalContext) => boolean;
+    approval?: Approval;
     /**
      * Arbitrary HTTP headers sent with every request to the MCP server.
      *
      * Use for non-Bearer auth (e.g. API key headers) or server-level
-     * configuration headers. Can be combined with `auth`.
+     * configuration headers. Can be combined with `auth`. The whole map
+     * or individual values may be callbacks that receive the active
+     * session context.
      */
     headers?: HeadersDefinition;
     /**
@@ -72,11 +76,9 @@ export interface McpClientConnectionDefinition {
 /**
  * Defines an MCP client connection.
  *
- * Validates the {@link ConnectionAuthDefinition} shape at
- * definition time, in particular the "both-or-neither" constraint
- * for `startAuthorization` and `completeAuthorization`: providing
- * exactly one is a definition error. `getToken` alone is valid and
- * selects the non-interactive flow; providing both opts into
- * interactive OAuth authorization.
+ * Validates static auth providers at definition time, in particular the
+ * "both-or-neither" constraint for `startAuthorization` and
+ * `completeAuthorization`. Context-aware auth resolvers are validated when
+ * eve invokes them inside an active turn.
  */
 export declare function defineMcpClientConnection(definition: McpClientConnectionDefinition): McpClientConnectionDefinition;

package/dist/src/public/definitions/connections/mcp.js

@@ -1 +1 @@
-import{stampConnectionProtocol}from"#public/definitions/connections/protocol.js";import{normalizeAuthorizationSpec}from"#runtime/connections/validate-authorization.js";import{stampDefinitionKey}from"#public/tool-result-narrowing.js";function defineMcpClientConnection(e){return e.auth!==void 0&&(e.auth=normalizeAuthorizationSpec(e.auth,`defineMcpClientConnection:`)),stampDefinitionKey(e,`connection:${e.url}`),stampConnectionProtocol(e,`mcp`),e}export{defineMcpClientConnection};
+import{stampConnectionProtocol}from"#public/definitions/connections/protocol.js";import{normalizeAuthorizationSpec}from"#runtime/connections/validate-authorization.js";import{stampDefinitionKey}from"#public/tool-result-narrowing.js";function defineMcpClientConnection(e){return e.auth!==void 0&&typeof e.auth!=`function`&&(e.auth=normalizeAuthorizationSpec(e.auth,`defineMcpClientConnection:`)),stampDefinitionKey(e,`connection:${e.url}`),stampConnectionProtocol(e,`mcp`),e}export{defineMcpClientConnection};

package/dist/src/public/definitions/connections/openapi.d.ts

@@ -1,5 +1,5 @@
 import type { ConnectionAuthDefinition, HeadersDefinition, ToolFilterDefinition } from "#runtime/connections/types.js";
-import type { NeedsApprovalContext } from "#public/definitions/tool.js";
+import type { Approval } from "#public/definitions/approval.js";
 /**
  * The OpenAPI document backing the connection: either an HTTPS URL the
  * runtime fetches on first use, or an already-parsed OpenAPI 3.x /
@@ -59,6 +59,8 @@ export interface OpenAPIConnectionDefinition {
      *   omitted.
      * - Three-method form: provide `startAuthorization` and
      *   `completeAuthorization` together to opt into interactive OAuth.
+     * - Resolver form: pass `(ctx) => provider` to select either shape
+     *   from the active caller's session context.
      *
      * Optional when `headers` is provided for non-Bearer auth schemes.
      */
@@ -71,12 +73,13 @@ export interface OpenAPIConnectionDefinition {
      * - `once()`: require approval only the first time per session
      * - `always()`: require approval for every tool call
      */
-    approval?: (ctx: NeedsApprovalContext) => boolean;
+    approval?: Approval;
     /**
      * Arbitrary HTTP headers sent with every request to the API.
      *
      * Use for non-Bearer auth (e.g. API key headers) or configuration
-     * headers. Can be combined with `auth`.
+     * headers. Can be combined with `auth`. The whole map or individual
+     * values may be callbacks that receive the active session context.
      */
     headers?: HeadersDefinition;
     /**
@@ -92,10 +95,9 @@ export interface OpenAPIConnectionDefinition {
 /**
  * Defines an OpenAPI connection.
  *
- * Validates the auth shape at definition time, in particular the
+ * Validates static auth providers at definition time, in particular the
  * "both-or-neither" constraint for `startAuthorization` and
- * `completeAuthorization`: providing exactly one is a definition error.
- * `getToken` alone is valid and selects the non-interactive flow;
- * providing both opts into interactive OAuth.
+ * `completeAuthorization`. Context-aware auth resolvers are validated when
+ * eve invokes them inside an active turn.
  */
 export declare function defineOpenAPIConnection(definition: OpenAPIConnectionDefinition): OpenAPIConnectionDefinition;

package/dist/src/public/definitions/connections/openapi.js

@@ -1 +1 @@
-import{stampConnectionProtocol}from"#public/definitions/connections/protocol.js";import{normalizeAuthorizationSpec}from"#runtime/connections/validate-authorization.js";import{stampDefinitionKey}from"#public/tool-result-narrowing.js";function defineOpenAPIConnection(e){return e.auth!==void 0&&(e.auth=normalizeAuthorizationSpec(e.auth,`defineOpenAPIConnection:`)),stampDefinitionKey(e,`connection:${e.baseUrl??(typeof e.spec==`string`?e.spec:e.description)}`),stampConnectionProtocol(e,`openapi`),e}export{defineOpenAPIConnection};
+import{stampConnectionProtocol}from"#public/definitions/connections/protocol.js";import{normalizeAuthorizationSpec}from"#runtime/connections/validate-authorization.js";import{stampDefinitionKey}from"#public/tool-result-narrowing.js";function defineOpenAPIConnection(e){return e.auth!==void 0&&typeof e.auth!=`function`&&(e.auth=normalizeAuthorizationSpec(e.auth,`defineOpenAPIConnection:`)),stampDefinitionKey(e,`connection:${e.baseUrl??(typeof e.spec==`string`?e.spec:e.description)}`),stampConnectionProtocol(e,`openapi`),e}export{defineOpenAPIConnection};

package/dist/src/public/definitions/tool.d.ts

@@ -1,24 +1,11 @@
 import type { StandardJSONSchemaV1 } from "#compiled/@standard-schema/spec/index.js";
 import type { PublicToolDefinition, ToolModelOutput } from "#shared/tool-definition.js";
 import type { SessionContext } from "#public/definitions/callback-context.js";
+import type { Approval } from "#public/definitions/approval.js";
 import type { JsonObject } from "#shared/json.js";
 import type { AuthorizationDefinition, ConnectionAuthorizationContext, NonInteractiveAuthorizationDefinition, TokenResult } from "#runtime/connections/types.js";
 import { type DynamicEvents, type DynamicSentinel } from "#shared/dynamic-tool-definition.js";
-type ApprovalToolInput<TInput> = TInput extends object ? Readonly<TInput> : TInput;
 type ApprovalContextInput<TInput> = unknown extends TInput ? Record<string, unknown> : TInput;
-/**
- * Context passed to a tool's {@link ToolDefinition.needsApproval} function.
- *
- * `approvedTools` is the set of tool names (or compound approval keys)
- * already approved at least once in the current session. `toolName` is the
- * runtime name of the tool being evaluated. `toolInput` is the raw input the
- * model passed, available for input-aware decisions (e.g. per-connection scoping).
- */
-export interface NeedsApprovalContext<TInput = Record<string, unknown>> {
-    readonly approvedTools: ReadonlySet<string>;
-    readonly toolInput?: ApprovalToolInput<TInput>;
-    readonly toolName: string;
-}
 export type { ToolModelOutput } from "#shared/tool-definition.js";
 /**
  * Authorization provider passed to {@link ToolContext.getToken} or
@@ -96,7 +83,7 @@ export type ToolDefinition<TInput = unknown, TOutput = unknown> = PublicToolDefi
      * - {@link never}: never require approval
      * - {@link once}: require approval only the first time per session
      */
-    needsApproval?: (ctx: NeedsApprovalContext<ApprovalContextInput<TInput>>) => boolean;
+    approval?: Approval<ApprovalContextInput<TInput>>;
     /**
      * Optional projection controlling what the model sees as the tool result.
      * Receives the full `TOutput` from {@link execute} and returns the
@@ -121,7 +108,7 @@ export declare function defineTool<TInputSchema extends StandardJSONSchemaV1<unk
     inputSchema: TInputSchema;
     outputSchema: TOutputSchema;
     execute(input: StandardJSONSchemaV1.InferOutput<TInputSchema>, ctx: ToolContext): Promise<StandardJSONSchemaV1.InferOutput<TOutputSchema>> | StandardJSONSchemaV1.InferOutput<TOutputSchema>;
-    needsApproval?: ToolDefinition<StandardJSONSchemaV1.InferOutput<TInputSchema>, unknown>["needsApproval"];
+    approval?: ToolDefinition<StandardJSONSchemaV1.InferOutput<TInputSchema>, unknown>["approval"];
     toModelOutput?: ToolDefinition<unknown, StandardJSONSchemaV1.InferOutput<TOutputSchema>>["toModelOutput"];
 }): ToolDefinition<StandardJSONSchemaV1.InferOutput<TInputSchema>, StandardJSONSchemaV1.InferOutput<TOutputSchema>>;
 export declare function defineTool<TSchema extends StandardJSONSchemaV1<unknown, unknown>, TOutput>(definition: {
@@ -129,7 +116,7 @@ export declare function defineTool<TSchema extends StandardJSONSchemaV1<unknown,
     inputSchema: TSchema;
     outputSchema?: JsonObject;
     execute(input: StandardJSONSchemaV1.InferOutput<TSchema>, ctx: ToolContext): Promise<TOutput> | TOutput;
-    needsApproval?: ToolDefinition<StandardJSONSchemaV1.InferOutput<TSchema>, unknown>["needsApproval"];
+    approval?: ToolDefinition<StandardJSONSchemaV1.InferOutput<TSchema>, unknown>["approval"];
     toModelOutput?: ToolDefinition<unknown, TOutput>["toModelOutput"];
 }): ToolDefinition<StandardJSONSchemaV1.InferOutput<TSchema>, TOutput>;
 export declare function defineTool<TOutputSchema extends StandardJSONSchemaV1<unknown, unknown>>(definition: {
@@ -137,7 +124,7 @@ export declare function defineTool<TOutputSchema extends StandardJSONSchemaV1<un
     inputSchema: JsonObject;
     outputSchema: TOutputSchema;
     execute(input: Record<string, unknown>, ctx: ToolContext): Promise<StandardJSONSchemaV1.InferOutput<TOutputSchema>> | StandardJSONSchemaV1.InferOutput<TOutputSchema>;
-    needsApproval?: ToolDefinition<Record<string, unknown>, unknown>["needsApproval"];
+    approval?: ToolDefinition<Record<string, unknown>, unknown>["approval"];
     toModelOutput?: ToolDefinition<unknown, StandardJSONSchemaV1.InferOutput<TOutputSchema>>["toModelOutput"];
 }): ToolDefinition<Record<string, unknown>, StandardJSONSchemaV1.InferOutput<TOutputSchema>>;
 export declare function defineTool<TOutput>(definition: {
@@ -145,7 +132,7 @@ export declare function defineTool<TOutput>(definition: {
     inputSchema: JsonObject;
     outputSchema?: JsonObject;
     execute(input: Record<string, unknown>, ctx: ToolContext): Promise<TOutput> | TOutput;
-    needsApproval?: ToolDefinition<Record<string, unknown>, unknown>["needsApproval"];
+    approval?: ToolDefinition<Record<string, unknown>, unknown>["approval"];
     toModelOutput?: ToolDefinition<unknown, TOutput>["toModelOutput"];
 }): ToolDefinition<Record<string, unknown>, TOutput>;
 export declare function defineTool<TInput = unknown, TOutput = unknown>(definition: ToolDefinition<TInput, TOutput>): ToolDefinition<TInput, TOutput>;
@@ -237,7 +224,7 @@ export interface EnableWorkflowToolSentinel {
     readonly kind: typeof ENABLE_WORKFLOW_TOOL_SENTINEL_KIND;
 }
 /**
- * Opt-in marker for the framework `Workflow` tool, a code-mode sandbox whose
+ * Opt-in marker for the framework `Workflow` tool, an isolated JavaScript sandbox whose
  * only callable operations are this agent's subagents and remote agents, for
  * orchestrating them from model-authored JavaScript. Re-export it as the
  * default export of `agent/tools/workflow.ts`:

package/dist/src/public/index.d.ts

@@ -1,5 +1,5 @@
 /**
  * Core agent authoring helpers for `agent/agent.ts`.
  */
-export { type AgentCompactionDefinition, type AgentDefinition, type AgentExperimentalDefinition, type AgentModelDefinition, type AgentModelOptionsDefinition, type AgentWorkflowDefinition, type AgentWorkflowWorldDefinition, defineAgent, } from "#public/definitions/agent.js";
+export { type AgentCompactionDefinition, type AgentDefinition, type AgentExperimentalDefinition, type AgentModelDefinition, type AgentModelOptionsDefinition, type AgentReasoningDefinition, type AgentWorkflowDefinition, type AgentWorkflowWorldDefinition, defineAgent, } from "#public/definitions/agent.js";
 export { type RemoteAgentDefinition, type RemoteAgentDefinitionInput, defineRemoteAgent, } from "#public/definitions/remote-agent.js";

package/dist/src/public/tools/approval/approval-helpers.d.ts

@@ -1,19 +1,19 @@
-import type { NeedsApprovalContext } from "#public/definitions/tool.js";
+import type { Approval } from "#public/definitions/approval.js";
 /**
- * Returns a `needsApproval` callback that always requires user approval before
+ * Returns an `approval` callback that always requires user approval before
  * the tool executes.
  */
-export declare function always<TInput = unknown>(): (ctx: NeedsApprovalContext<TInput>) => boolean;
+export declare function always<TInput = unknown>(): Approval<TInput>;
 /**
- * Returns a `needsApproval` callback that never requires user approval before
+ * Returns an `approval` callback that never requires user approval before
  * the tool executes.
  */
-export declare function never<TInput = unknown>(): (ctx: NeedsApprovalContext<TInput>) => boolean;
+export declare function never<TInput = unknown>(): Approval<TInput>;
 /**
- * Returns a `needsApproval` callback that requires approval until the user
+ * Returns an `approval` callback that requires approval until the user
  * approves this tool once in the current session. A tool is recorded as
  * approved only on an explicit approval; a denial (or continuing without
  * responding) leaves it unrecorded, so the next call prompts again. Keys off
  * the bare tool name, so it ignores compound approval keys.
  */
-export declare function once<TInput = unknown>(): (ctx: NeedsApprovalContext<TInput>) => boolean;
+export declare function once<TInput = unknown>(): Approval<TInput>;

package/dist/src/public/tools/approval/approval-helpers.js

@@ -1 +1 @@
-function always(){return()=>!0}function never(){return()=>!1}function once(){return({approvedTools:e,toolName:t})=>!e.has(t)}export{always,never,once};
+function always(){return()=>`user-approval`}function never(){return()=>`not-applicable`}function once(){return({approvedTools:e,toolName:t})=>e.has(t)?`not-applicable`:`user-approval`}export{always,never,once};

package/dist/src/public/tools/approval/index.d.ts

@@ -1,5 +1,5 @@
 /**
  * Per-tool approval helpers used inside `agent/tools/*.ts` files.
  */
-export type { NeedsApprovalContext } from "#public/definitions/tool.js";
+export type { Approval, ApprovalContext, ApprovalStatus } from "#public/definitions/approval.js";
 export { always, never, once } from "#public/tools/approval/approval-helpers.js";

package/dist/src/public/tools/index.d.ts

@@ -1,7 +1,8 @@
 /**
  * Tool authoring helpers for `agent/tools/*.ts` files.
  */
-export { type DisabledToolSentinel, type EnableWorkflowToolSentinel, defineDynamic, defineTool, disableTool, isDisabledToolSentinel, isEnableWorkflowToolSentinel, type NeedsApprovalContext, type ToolAuthOptions, type ToolAuthProvider, type ToolDefinition, type ToolContext, type ToolModelOutput, ExperimentalWorkflow, } from "#public/definitions/tool.js";
+export { type DisabledToolSentinel, type EnableWorkflowToolSentinel, defineDynamic, defineTool, disableTool, isDisabledToolSentinel, isEnableWorkflowToolSentinel, type ToolAuthOptions, type ToolAuthProvider, type ToolDefinition, type ToolContext, type ToolModelOutput, ExperimentalWorkflow, } from "#public/definitions/tool.js";
+export type { Approval, ApprovalContext, ApprovalStatus } from "#public/definitions/approval.js";
 export type { DynamicToolEntry, DynamicEvents, DynamicToolEvents, DynamicResolveContext, DynamicSentinel, DynamicToolSet, DynamicToolResult, } from "#shared/dynamic-tool-definition.js";
 export { type SessionContext } from "#public/definitions/callback-context.js";
 export { toolResultFrom, type MatchedConnectionResult, type MatchedToolResult, type ToolResultFromFn, } from "#public/tool-result-narrowing.js";

package/dist/src/public/tools/internal.js

@@ -1 +1 @@
-function toPublicToolDefinition(e){if(!e.execute)throw Error(`Tool "${e.name}" is client-side and cannot be re-exported publicly.`);let t=e.execute,n=e.inputSchema,r={description:e.description,execute:e=>t(e),inputSchema:n??{},outputSchema:e.outputSchema};return e.needsApproval!==void 0&&(r.needsApproval=e.needsApproval),r}export{toPublicToolDefinition};
+function toPublicToolDefinition(e){if(!e.execute)throw Error(`Tool "${e.name}" is client-side and cannot be re-exported publicly.`);let t=e.execute,n=e.inputSchema,r={description:e.description,execute:e=>t(e),inputSchema:n??{},outputSchema:e.outputSchema};return e.approval!==void 0&&(r.approval=e.approval),r}export{toPublicToolDefinition};

package/dist/src/runtime/actions/types.d.ts

@@ -1,11 +1,13 @@
 import { z } from "#compiled/zod/index.js";
 /**
- * Runtime-owned authored tool-call request surfaced by a harness and executed
- * later by step-backed runtime code.
+ * Eve-owned `tool-call` action requested by the model.
+ *
+ * Depending on the tool definition, it can execute locally, be provider
+ * executed, or be handled later by the runtime.
  */
 export type RuntimeToolCallActionRequest = z.infer<typeof runtimeToolCallActionRequestSchema>;
 /**
- * Zod schema for one runtime-owned authored tool-call action request.
+ * Zod schema for one Eve-owned `tool-call` action request.
  */
 export declare const runtimeToolCallActionRequestSchema: z.ZodObject<{
     callId: z.ZodString;
@@ -48,14 +50,11 @@ export declare const runtimeRemoteAgentCallActionRequestSchema: z.ZodObject<{
     remoteAgentName: z.ZodString;
 }, z.core.$strict>;
 /**
- * Runtime-owned action request surfaced by a harness.
- *
- * Harness-native capabilities such as `bash` do not cross the harness boundary
- * as runtime actions. Only runtime-executed requests use this taxonomy.
+ * Eve-owned `load-skill` action requested by the model.
  */
 type RuntimeLoadSkillActionRequest = z.infer<typeof runtimeLoadSkillActionRequestSchema>;
 /**
- * Zod schema for one runtime-owned load-skill action request.
+ * Zod schema for one Eve-owned `load-skill` action request.
  */
 declare const runtimeLoadSkillActionRequestSchema: z.ZodObject<{
     callId: z.ZodString;
@@ -63,10 +62,10 @@ declare const runtimeLoadSkillActionRequestSchema: z.ZodObject<{
     kind: z.ZodLiteral<"load-skill">;
 }, z.core.$strict>;
 /**
- * Runtime-owned action request surfaced by a harness.
+ * Eve-owned action request surfaced by the harness.
  *
- * Harness-native capabilities such as `bash` do not cross the harness boundary
- * as runtime actions. Only runtime-executed requests use this taxonomy.
+ * A `tool-call` is one action kind, alongside control-plane work such as
+ * `load-skill` and runtime-dispatched subagent calls.
  */
 export type RuntimeActionRequest = RuntimeLoadSkillActionRequest | RuntimeRemoteAgentCallActionRequest | RuntimeSubagentCallActionRequest | RuntimeToolCallActionRequest;
 /**

package/dist/src/runtime/agent/bootstrap.d.ts

@@ -26,6 +26,7 @@ export interface RuntimeTurnAgent {
     readonly model: RuntimeModelReference;
     readonly nodeId?: string;
     readonly outputSchema?: ResolvedAgent["config"]["outputSchema"];
+    readonly reasoning?: ResolvedAgent["config"]["reasoning"];
     readonly tools: readonly PreparedRuntimeTool[];
     readonly workspaceSpec: WorkspaceRuntimeSpec;
 }

package/dist/src/runtime/agent/bootstrap.js

@@ -1 +1 @@
-import{composeRuntimeBasePrompt}from"#runtime/prompt/compose.js";const BOOTSTRAP_RUNTIME_MODEL_ID=`eve-bootstrap-model`,BOOTSTRAP_RUNTIME_SYSTEM_PROMPT=`You are the eve bootstrap agent. Be concise, stay grounded in the current conversation, and do not assume tools are available unless the runtime provides them.`;function createResolvedRuntimeTurnAgent(e){let t=e.agent;return{id:t.config.name,instructions:composeRuntimeBasePrompt({connections:t.connections,instructions:t.instructions,skills:t.skills,toolsAvailable:e.tools.length>0,workspaceSpec:t.workspaceSpec}),compactionModel:t.config.compaction?.model,model:t.config.model,nodeId:e.nodeId,outputSchema:t.config.outputSchema,tools:[...e.tools],workspaceSpec:t.workspaceSpec}}export{BOOTSTRAP_RUNTIME_MODEL_ID,BOOTSTRAP_RUNTIME_SYSTEM_PROMPT,createResolvedRuntimeTurnAgent};
+import{composeRuntimeBasePrompt}from"#runtime/prompt/compose.js";const BOOTSTRAP_RUNTIME_MODEL_ID=`eve-bootstrap-model`,BOOTSTRAP_RUNTIME_SYSTEM_PROMPT=`You are the eve bootstrap agent. Be concise, stay grounded in the current conversation, and do not assume tools are available unless the runtime provides them.`;function createResolvedRuntimeTurnAgent(e){let t=e.agent;return{id:t.config.name,instructions:composeRuntimeBasePrompt({connections:t.connections,instructions:t.instructions,skills:t.skills,toolsAvailable:e.tools.length>0,workspaceSpec:t.workspaceSpec}),compactionModel:t.config.compaction?.model,model:t.config.model,nodeId:e.nodeId,outputSchema:t.config.outputSchema,reasoning:t.config.reasoning,tools:[...e.tools],workspaceSpec:t.workspaceSpec}}export{BOOTSTRAP_RUNTIME_MODEL_ID,BOOTSTRAP_RUNTIME_SYSTEM_PROMPT,createResolvedRuntimeTurnAgent};

package/dist/src/runtime/agent/mock-model-adapter.js

@@ -1,5 +1,4 @@
-import{z}from"#compiled/zod/index.js";import{LOAD_SKILL_TOOL_NAME}from"#runtime/skills/fragment-context.js";import{CODE_MODE_TOOL_NAME}from"#shared/code-mode.js";import{FINAL_OUTPUT_TOOL_NAME}from"#runtime/framework-tools/final-output.js";import{MockLanguageModelV3}from"ai/test";import{BOOTSTRAP_RUNTIME_MODEL_ID,BOOTSTRAP_RUNTIME_SYSTEM_PROMPT}from"#runtime/agent/bootstrap.js";import{createBootstrapGenerateResult,createBootstrapStreamResult,estimateTokenCount,getLastUserPromptText,getPromptContentText,getPromptText}from"#runtime/agent/bootstrap-model-utils.js";import{createMockAuthoredToolInput,formatToolOutput,resolveMockFixtureToken,resolveWeatherCity}from"#runtime/agent/mock-model-fixtures.js";import{findRelevantSkill,getActivatedSkillIds,getAvailableSkills}from"#runtime/agent/mock-model-skill-selection.js";import{createJsonSchemaSample}from"#runtime/agent/mock-structured-output.js";const authoredRuntimeModelMocks=new Map,bootstrapWeatherPayloadSchema=z.object({city:z.string(),condition:z.string(),summary:z.string(),temperatureF:z.number().finite()}).strict();function shouldMockAuthoredRuntimeModels(){return process.env.NODE_ENV===`test`}function createMockAuthoredRuntimeModel(e){let t=authoredRuntimeModelMocks.get(e.id);if(t!==void 0)return t;let n=new MockLanguageModelV3({modelId:e.id,provider:`eve-runtime-mock`,doGenerate:async t=>createMockModelResult(t,e.id),doStream:async t=>createBootstrapStreamResult(createMockModelResult(t,e.id))});return authoredRuntimeModelMocks.set(e.id,n),n}function createMockModelResult(e,t){let n=getLastAuthoredToolResult(e.prompt);if(n!==null){let r=createFollowUpToolCallResult({modelId:t,options:e,result:n});if(r!==null)return r}else{let n=createSkillLoadResult(e.prompt,t)??createAuthoredToolCallResult(e,t);if(n!==null)return n}let r=createFinalOutputResult(e,t);if(r!==null)return r;let i=n===null?createAssistantMessage(e.prompt):formatToolResultReply(n,e.prompt);return createBootstrapGenerateResult({inputTokens:estimateTokenCount(getPromptText(e.prompt)),modelId:t,outputTokens:estimateTokenCount(i),text:i})}function createFinalOutputResult(e,t){let n=getAvailableTools(e).find(e=>e.name===FINAL_OUTPUT_TOOL_NAME);if(n===void 0)return null;let i=createJsonSchemaSample(n.inputSchema);return createToolCallGenerateResult({input:i,inputTokens:estimateTokenCount(getPromptText(e.prompt)),modelId:t,outputTokens:estimateTokenCount(JSON.stringify(i)),toolCallId:createToolCallId(FINAL_OUTPUT_TOOL_NAME),toolName:FINAL_OUTPUT_TOOL_NAME})}function resolveMockAuthoredRuntimeModel(e){return!shouldMockAuthoredRuntimeModels()||e.id===BOOTSTRAP_RUNTIME_MODEL_ID?null:createMockAuthoredRuntimeModel(e)}function createSkillLoadResult(e,n){let r=getLastUserPromptText(e);if(r===null||getActivatedSkillIds(e).length>0)return null;let i=findRelevantSkill(getAvailableSkills(e),r);return i===null?null:createToolCallGenerateResult({input:{skill:i.name},inputTokens:estimateTokenCount(getPromptText(e)),modelId:n,outputTokens:estimateTokenCount(i.name),toolCallId:`call_load_skill`,toolName:LOAD_SKILL_TOOL_NAME})}function createAuthoredToolCallResult(e,t){let r=getLastUserPromptText(e.prompt);if(r===null)return null;let i=findRelevantTool(getAvailableTools(e),r);if(i===null)return null;let a=resolveWeatherCity(r),o=createMockAuthoredToolInput(i,r,a);if(i.name===CODE_MODE_TOOL_NAME){let n=findRelevantCodeModeHostTool(i.description,r);if(n===null)return null;let o=`return await tools${formatCodeModeToolAccess(n)}({ city: ${JSON.stringify(a)} });`;return createToolCallGenerateResult({input:{js:o},inputTokens:estimateTokenCount(getPromptText(e.prompt)),modelId:t,outputTokens:estimateTokenCount(o),toolCallId:createToolCallId(i.name),toolName:i.name})}return createToolCallGenerateResult({input:o,inputTokens:estimateTokenCount(getPromptText(e.prompt)),modelId:t,outputTokens:estimateTokenCount(Object.values(o).join(` `)),toolCallId:createToolCallId(i.name),toolName:i.name})}function createFollowUpToolCallResult(e){let t=findNextExplicitToolAfterResult({previousToolName:e.result.toolName,prompt:e.options.prompt,tools:getAvailableTools(e.options)});if(t===null)return null;let n=createFollowUpToolInput(e.result.output);return n===null?null:createToolCallGenerateResult({input:n,inputTokens:estimateTokenCount(getPromptText(e.options.prompt)),modelId:e.modelId,outputTokens:estimateTokenCount(Object.values(n).join(` `)),toolCallId:createToolCallId(t.name),toolName:t.name})}function createAssistantMessage(e){let t=getLastUserPromptText(e)??`Hello from eve`,n=getSystemPromptLabels(e),r=resolveSystemProbe(e),i=resolveMockFixtureToken(e);return i===null?n.length>0?r===null?`Bootstrap reply [${n.join(`, `)}]: ${t}`:`Bootstrap reply [${n.join(`, `)}; probe=${r}]: ${t}`:r===null?`Bootstrap reply: ${t}`:`Bootstrap reply [probe=${r}]: ${t}`:i}function formatToolResultReply(e,t){if(e.isError)return`Local weather tool failed: ${formatToolOutput(e.output)}`;if(isWeatherPayload(e.output))return`Used local weather tool for ${e.output.city}: ${e.output.condition}, ${e.output.temperatureF}F. ${e.output.summary}`;let n=getLastUserPromptText(t)??`Hello from eve`;return`Used ${e.toolName} for "${n}": ${formatToolOutput(e.output)}`}function createToolCallGenerateResult(e){return{content:[{input:JSON.stringify(e.input),toolCallId:e.toolCallId,toolName:e.toolName,type:`tool-call`}],finishReason:{raw:void 0,unified:`tool-calls`},response:{id:`bootstrap-response`,modelId:e.modelId,timestamp:new Date(`2026-03-16T00:00:00.000Z`)},usage:{inputTokens:{cacheRead:0,cacheWrite:0,noCache:e.inputTokens,total:e.inputTokens},outputTokens:{reasoning:0,text:e.outputTokens,total:e.outputTokens}},warnings:[]}}function getAvailableTools(e){return(e.tools??[]).flatMap(e=>e.type===`function`?[{description:e.description,inputSchema:`inputSchema`in e?e.inputSchema:void 0,name:e.name,outputSchema:`outputSchema`in e?e.outputSchema:void 0}]:[])}function getLastAuthoredToolResult(e){for(let n of[...e].reverse()){if(n.role===`user`)return null;if(!(n.role!==`tool`&&n.role!==`assistant`)){for(let e of[...n.content].reverse())if(!(typeof e==`string`||e.type!==`tool-result`)&&e.toolName!==LOAD_SKILL_TOOL_NAME)return{isError:e.output.type===`error-json`||e.output.type===`error-text`||e.output.type===`execution-denied`,output:e.output.type===`execution-denied`?{reason:e.output.reason??null,type:e.output.type}:e.output.value,toolCallId:e.toolCallId,toolName:e.toolName}}}return null}function findNextExplicitToolAfterResult(e){let t=getLastUserPromptText(e.prompt);if(t===null)return null;let n=normalizeText(t),r=n.indexOf(normalizeText(e.previousToolName));return r<0?null:e.tools.filter(t=>t.name!==e.previousToolName).flatMap(e=>{let t=n.indexOf(normalizeText(e.name),r+1);return t<0?[]:[{index:t,tool:e}]}).sort((e,t)=>e.index-t.index)[0]?.tool??null}function createFollowUpToolInput(e){return isRecord(e)&&typeof e.stepKey==`string`?{stepKey:e.stepKey}:null}function getSystemPromptLabels(e){let t=e.filter(e=>e.role===`system`);if(t.length===0)return[];let n=t.flatMap(e=>{let t=getPromptContentText(e.content);if(t.startsWith(`Available skills
+import{z}from"#compiled/zod/index.js";import{LOAD_SKILL_TOOL_NAME}from"#runtime/skills/fragment-context.js";import{FINAL_OUTPUT_TOOL_NAME}from"#runtime/framework-tools/final-output.js";import{MockLanguageModelV3}from"ai/test";import{BOOTSTRAP_RUNTIME_MODEL_ID,BOOTSTRAP_RUNTIME_SYSTEM_PROMPT}from"#runtime/agent/bootstrap.js";import{createBootstrapGenerateResult,createBootstrapStreamResult,estimateTokenCount,getLastUserPromptText,getPromptContentText,getPromptText}from"#runtime/agent/bootstrap-model-utils.js";import{createMockAuthoredToolInput,formatToolOutput,resolveMockFixtureToken,resolveWeatherCity}from"#runtime/agent/mock-model-fixtures.js";import{findRelevantSkill,getActivatedSkillIds,getAvailableSkills}from"#runtime/agent/mock-model-skill-selection.js";import{createJsonSchemaSample}from"#runtime/agent/mock-structured-output.js";const authoredRuntimeModelMocks=new Map,bootstrapWeatherPayloadSchema=z.object({city:z.string(),condition:z.string(),summary:z.string(),temperatureF:z.number().finite()}).strict();function shouldMockAuthoredRuntimeModels(){return process.env.NODE_ENV===`test`}function createMockAuthoredRuntimeModel(e){let t=authoredRuntimeModelMocks.get(e.id);if(t!==void 0)return t;let n=new MockLanguageModelV3({modelId:e.id,provider:`eve-runtime-mock`,doGenerate:async t=>createMockModelResult(t,e.id),doStream:async t=>createBootstrapStreamResult(createMockModelResult(t,e.id))});return authoredRuntimeModelMocks.set(e.id,n),n}function createMockModelResult(e,t){let n=getLastAuthoredToolResult(e.prompt);if(n!==null){let r=createFollowUpToolCallResult({modelId:t,options:e,result:n});if(r!==null)return r}else{let n=createSkillLoadResult(e.prompt,t)??createAuthoredToolCallResult(e,t);if(n!==null)return n}let r=createFinalOutputResult(e,t);if(r!==null)return r;let i=n===null?createAssistantMessage(e.prompt):formatToolResultReply(n,e.prompt);return createBootstrapGenerateResult({inputTokens:estimateTokenCount(getPromptText(e.prompt)),modelId:t,outputTokens:estimateTokenCount(i),text:i})}function createFinalOutputResult(e,t){let r=getAvailableTools(e).find(e=>e.name===FINAL_OUTPUT_TOOL_NAME);if(r===void 0)return null;let i=createJsonSchemaSample(r.inputSchema);return createToolCallGenerateResult({input:i,inputTokens:estimateTokenCount(getPromptText(e.prompt)),modelId:t,outputTokens:estimateTokenCount(JSON.stringify(i)),toolCallId:createToolCallId(FINAL_OUTPUT_TOOL_NAME),toolName:FINAL_OUTPUT_TOOL_NAME})}function resolveMockAuthoredRuntimeModel(e){return!shouldMockAuthoredRuntimeModels()||e.id===BOOTSTRAP_RUNTIME_MODEL_ID?null:createMockAuthoredRuntimeModel(e)}function createSkillLoadResult(e,n){let r=getLastUserPromptText(e);if(r===null||getActivatedSkillIds(e).length>0)return null;let i=findRelevantSkill(getAvailableSkills(e),r);return i===null?null:createToolCallGenerateResult({input:{skill:i.name},inputTokens:estimateTokenCount(getPromptText(e)),modelId:n,outputTokens:estimateTokenCount(i.name),toolCallId:`call_load_skill`,toolName:LOAD_SKILL_TOOL_NAME})}function createAuthoredToolCallResult(e,t){let n=getLastUserPromptText(e.prompt);if(n===null)return null;let r=findRelevantTool(getAvailableTools(e),n);if(r===null)return null;let i=createMockAuthoredToolInput(r,n,resolveWeatherCity(n));return createToolCallGenerateResult({input:i,inputTokens:estimateTokenCount(getPromptText(e.prompt)),modelId:t,outputTokens:estimateTokenCount(Object.values(i).join(` `)),toolCallId:createToolCallId(r.name),toolName:r.name})}function createFollowUpToolCallResult(e){let t=findNextExplicitToolAfterResult({previousToolName:e.result.toolName,prompt:e.options.prompt,tools:getAvailableTools(e.options)});if(t===null)return null;let n=createFollowUpToolInput(e.result.output);return n===null?null:createToolCallGenerateResult({input:n,inputTokens:estimateTokenCount(getPromptText(e.options.prompt)),modelId:e.modelId,outputTokens:estimateTokenCount(Object.values(n).join(` `)),toolCallId:createToolCallId(t.name),toolName:t.name})}function createAssistantMessage(e){let t=getLastUserPromptText(e)??`Hello from eve`,n=getSystemPromptLabels(e),r=resolveSystemProbe(e),i=resolveMockFixtureToken(e);return i===null?n.length>0?r===null?`Bootstrap reply [${n.join(`, `)}]: ${t}`:`Bootstrap reply [${n.join(`, `)}; probe=${r}]: ${t}`:r===null?`Bootstrap reply: ${t}`:`Bootstrap reply [probe=${r}]: ${t}`:i}function formatToolResultReply(e,t){if(e.isError)return`Local weather tool failed: ${formatToolOutput(e.output)}`;if(isWeatherPayload(e.output))return`Used local weather tool for ${e.output.city}: ${e.output.condition}, ${e.output.temperatureF}F. ${e.output.summary}`;let n=getLastUserPromptText(t)??`Hello from eve`;return`Used ${e.toolName} for "${n}": ${formatToolOutput(e.output)}`}function createToolCallGenerateResult(e){return{content:[{input:JSON.stringify(e.input),toolCallId:e.toolCallId,toolName:e.toolName,type:`tool-call`}],finishReason:{raw:void 0,unified:`tool-calls`},response:{id:`bootstrap-response`,modelId:e.modelId,timestamp:new Date(`2026-03-16T00:00:00.000Z`)},usage:{inputTokens:{cacheRead:0,cacheWrite:0,noCache:e.inputTokens,total:e.inputTokens},outputTokens:{reasoning:0,text:e.outputTokens,total:e.outputTokens}},warnings:[]}}function getAvailableTools(e){return(e.tools??[]).flatMap(e=>e.type===`function`?[{description:e.description,inputSchema:`inputSchema`in e?e.inputSchema:void 0,name:e.name,outputSchema:`outputSchema`in e?e.outputSchema:void 0}]:[])}function getLastAuthoredToolResult(e){for(let n of[...e].reverse()){if(n.role===`user`)return null;if(!(n.role!==`tool`&&n.role!==`assistant`)){for(let e of[...n.content].reverse())if(!(typeof e==`string`||e.type!==`tool-result`)&&e.toolName!==LOAD_SKILL_TOOL_NAME)return{isError:e.output.type===`error-json`||e.output.type===`error-text`||e.output.type===`execution-denied`,output:e.output.type===`execution-denied`?{reason:e.output.reason??null,type:e.output.type}:e.output.value,toolCallId:e.toolCallId,toolName:e.toolName}}}return null}function findNextExplicitToolAfterResult(e){let t=getLastUserPromptText(e.prompt);if(t===null)return null;let n=normalizeText(t),r=n.indexOf(normalizeText(e.previousToolName));return r<0?null:e.tools.filter(t=>t.name!==e.previousToolName).flatMap(e=>{let t=n.indexOf(normalizeText(e.name),r+1);return t<0?[]:[{index:t,tool:e}]}).sort((e,t)=>e.index-t.index)[0]?.tool??null}function createFollowUpToolInput(e){return isRecord(e)&&typeof e.stepKey==`string`?{stepKey:e.stepKey}:null}function getSystemPromptLabels(e){let t=e.filter(e=>e.role===`system`);if(t.length===0)return[];let n=t.flatMap(e=>{let t=getPromptContentText(e.content);if(t.startsWith(`Available skills
 `))return[];let n=t.split(`
-`).map(e=>e.trim()).filter(e=>e.length>0),r=[];for(let e of n){if(e===BOOTSTRAP_RUNTIME_SYSTEM_PROMPT||e===`Available skills`)continue;let t=/^System \((.+)\)$/.exec(e);if(t?.[1]){r.push(t[1]);continue}let n=/^Skill \((.+)\)$/.exec(e);n?.[1]&&r.push(n[1])}if(r.length>0)return r;let i=n.find(e=>e!==BOOTSTRAP_RUNTIME_SYSTEM_PROMPT&&e!==`Available skills`);return i===void 0?[]:[i]});return[...new Set(n)]}function findRelevantTool(e,n){let r=normalizeText(n),i=e.find(e=>e.name!==`agent`&&e.name!==LOAD_SKILL_TOOL_NAME&&r.includes(normalizeText(e.name)));return i===void 0?/\b(forecast|temperature|weather|wind|rain|snow)\b/u.test(r)?e.find(e=>/\b(forecast|temperature|weather|wind|rain|snow)\b/u.test(normalizeText(`${e.name} ${e.description??``}`)))??null:null:i}function findRelevantCodeModeHostTool(e,t){return e===void 0?null:findRelevantTool(parseCodeModeHostTools(e),t)?.name??null}function parseCodeModeHostTools(e){let t=[],n;for(let r of e.split(`
-`)){let e=/^\s*\/\*\*\s*(.*?)\s*\*\/\s*$/u.exec(r);if(e?.[1]!==void 0){n=e[1];continue}let i=/^\s*(?:([$A-Z_a-z][$\w]*)|(["'])(.*?)\2)\s*:\s*\(input:/u.exec(r),a=i?.[1]??i?.[3];a!==void 0&&(t.push({description:n,name:a}),n=void 0)}return t}function formatCodeModeToolAccess(e){return/^[$A-Z_a-z][$\w]*$/u.test(e)?`.${e}`:`[${JSON.stringify(e)}]`}function normalizeText(e){return e.toLowerCase().replace(/[^a-z0-9]+/gu,` `).trim()}function createToolCallId(e){return`call_${e.toLowerCase().replace(/[^a-z0-9]+/gu,`_`).replace(/^_+|_+$/gu,``)||`tool`}`}function resolveSystemProbe(e){let t=e.filter(e=>e.role===`system`).map(e=>getPromptContentText(e.content)).join(`
+`).map(e=>e.trim()).filter(e=>e.length>0),r=[];for(let e of n){if(e===BOOTSTRAP_RUNTIME_SYSTEM_PROMPT||e===`Available skills`)continue;let t=/^System \((.+)\)$/.exec(e);if(t?.[1]){r.push(t[1]);continue}let n=/^Skill \((.+)\)$/.exec(e);n?.[1]&&r.push(n[1])}if(r.length>0)return r;let i=n.find(e=>e!==BOOTSTRAP_RUNTIME_SYSTEM_PROMPT&&e!==`Available skills`);return i===void 0?[]:[i]});return[...new Set(n)]}function findRelevantTool(e,n){let r=normalizeText(n),i=e.find(e=>e.name!==`agent`&&e.name!==LOAD_SKILL_TOOL_NAME&&r.includes(normalizeText(e.name)));return i===void 0?/\b(forecast|temperature|weather|wind|rain|snow)\b/u.test(r)?e.find(e=>/\b(forecast|temperature|weather|wind|rain|snow)\b/u.test(normalizeText(`${e.name} ${e.description??``}`)))??null:null:i}function normalizeText(e){return e.toLowerCase().replace(/[^a-z0-9]+/gu,` `).trim()}function createToolCallId(e){return`call_${e.toLowerCase().replace(/[^a-z0-9]+/gu,`_`).replace(/^_+|_+$/gu,``)||`tool`}`}function resolveSystemProbe(e){let t=e.filter(e=>e.role===`system`).map(e=>getPromptContentText(e.content)).join(`
 `);return/hmr-probe:\s*([^\n]+)/iu.exec(t)?.[1]?.trim()||null}function isWeatherPayload(e){return bootstrapWeatherPayloadSchema.safeParse(e).success}function isRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}export{createMockAuthoredRuntimeModel,resolveMockAuthoredRuntimeModel,shouldMockAuthoredRuntimeModels};

package/dist/src/runtime/connections/mcp-client.d.ts

@@ -64,9 +64,9 @@ export declare function passesToolFilter(toolName: string, filter: Readonly<Tool
  * Merges `authorization` (Bearer token) and `headers` into one
  * flat `Record<string, string>` for the transport layer.
  *
- * Resolves the {@link ConnectionPrincipal} from the active session
- * and invokes
- * `authorization.getToken({ principal })` to produce the bearer.
+ * Resolves dynamic `auth` and `headers` callbacks with the active
+ * {@link SessionContext}, then resolves the {@link ConnectionPrincipal}
+ * and invokes `authorization.getToken({ principal })` to produce the bearer.
  * `getToken` may throw {@link ConnectionAuthorizationRequiredError};
  * callers (`connection_search`, wrapped connection tools) catch it
  * and it propagates as-is from here.

package/dist/src/runtime/connections/mcp-client.js

@@ -1 +1 @@
-import{isObject}from"#shared/guards.js";import{ConnectionAuthorizationRequiredError}from"#public/connections/errors.js";import{evictScopedToken,resolveScopedToken}from"#runtime/connections/scoped-authorization.js";import{createMCPClient}from"#compiled/@ai-sdk/mcp/index.js";var McpConnectionClient=class{#e;#t;#n;#r;#i;constructor(e){this.#i=e}async connect(){if(this.#t!==void 0)return this.#t;if(this.#e!==void 0)return this.#e;this.#e=this.#a();try{return this.#t=await this.#e,this.#t}catch(e){throw this.#e=void 0,e}}async#a(){let e=await resolveHeaders(this.#i),t=this.#i.url;try{return await createMCPClient({transport:{type:`http`,url:t,headers:e}})}catch(n){if(!isMcpHttpFallbackRetryableError(n))throw n;return await createMCPClient({transport:{type:`sse`,url:t,headers:e}})}}async getToolMetadata(){return(await this.#o()).metadata}async getTools(){return(await this.#o()).tools}async executeTool(e,t){try{let{tools:n}=await this.#o(),r=n[e];if(r?.execute===void 0)throw Error(`Tool "${e}" not found in connection "${this.#i.connectionName}".`);return await r.execute(t,{})}catch(e){return await this.#l(e)}}async#o(){if(this.#r!==void 0)return this.#r;if(this.#n!==void 0)return this.#n;this.#n=this.#s();try{return this.#r=await this.#n,this.#r}catch(e){throw this.#n=void 0,e}}async#s(){try{return await this.#c()}catch(e){return await this.#l(e)}}async#c(){let e=await this.connect(),t=await e.listTools(),n=this.#i.tools,r=n===void 0?t.tools:t.tools.filter(e=>passesToolFilter(e.name,n)),i=e.toolsFromDefinitions({tools:r});return{metadata:r.map(e=>({annotations:e.annotations,description:e.description??``,inputSchema:e.inputSchema??{},name:e.name,outputSchema:`outputSchema`in e&&e.outputSchema!==void 0?e.outputSchema:void 0})),tools:i}}async close(){this.#t!==void 0&&(await this.#t.close(),this.#t=void 0),this.#e=void 0,this.#n=void 0,this.#r=void 0}async#l(e){throw isMcpAuthRequiredError(e)?(await this.#u(),await this.close(),new ConnectionAuthorizationRequiredError(this.#i.connectionName,{message:`Connection "${this.#i.connectionName}" requires authorization (the server rejected the token).`})):e}async#u(){let e=this.#i.authorization;e!==void 0&&await evictScopedToken({authorization:e,connection:{url:this.#i.url},scope:this.#i.connectionName})}};function isMcpAuthRequiredError(e){return readHttpStatus(e)===401}function isMcpHttpFallbackRetryableError(e){let t=readHttpStatus(e);return t===400||t===404||t===405}function readHttpStatus(t){for(let n of walkErrorChain(t)){if(!isObject(n))continue;let t=readStatusField(n);if(t!==void 0)return t;let r=n.response;if(isObject(r)){let e=readStatusField(r);if(e!==void 0)return e}if(typeof n.message==`string`){let e=/\bHTTP\s+(\d{3})\b/u.exec(n.message);if(e?.[1]!==void 0)return Number(e[1])}}}function readStatusField(e){if(typeof e.status==`number`)return e.status;if(typeof e.statusCode==`number`)return e.statusCode}function*walkErrorChain(t){let n=t,r=new Set;for(;n!=null&&!r.has(n);){if(r.add(n),yield n,!isObject(n)||!(`cause`in n))return;n=n.cause}}function passesToolFilter(e,t){return t===void 0?!0:`allow`in t?t.allow.includes(e):!t.block.includes(e)}async function resolveHeaders(e){let t={};if(e.authorization!==void 0&&(t.Authorization=`Bearer ${(await resolveToken(e)).token}`),e.headers!==void 0){let n=await resolveHeadersDefinition(e.headers);for(let[r,i]of Object.entries(n)){if(e.authorization!==void 0&&r.toLowerCase()===`authorization`)throw Error(`Connection "${e.connectionName}" headers must not include an "Authorization" key when "authorization" is also provided.`);t[r]=i}}return t}async function resolveToken(e){if(e.authorization===void 0)throw Error(`Connection "${e.connectionName}" does not define authorization.`);return await resolveScopedToken({authorization:e.authorization,connection:{url:e.url},scope:e.connectionName})}async function resolveHeadersDefinition(e){if(typeof e==`function`)return await e();let t={},n=Object.entries(e);for(let[e,r]of n)t[e]=await resolveHeaderValue(r);return t}async function resolveHeaderValue(e){return typeof e==`function`?await e():await e}export{McpConnectionClient,isMcpAuthRequiredError,passesToolFilter,resolveHeaders};
+import{isObject}from"#shared/guards.js";import{buildCallbackContext}from"#context/build-callback-context.js";import{ConnectionAuthorizationRequiredError}from"#public/connections/errors.js";import{evictScopedToken,resolveScopedToken}from"#runtime/connections/scoped-authorization.js";import{createMCPClient}from"#compiled/@ai-sdk/mcp/index.js";import{resolveConnectionAuthorization}from"#runtime/connections/resolve-authorization.js";var McpConnectionClient=class{#e;#t;#n;#r;#i;constructor(e){this.#i=e}async connect(){if(this.#t!==void 0)return this.#t;if(this.#e!==void 0)return this.#e;this.#e=this.#a();try{return this.#t=await this.#e,this.#t}catch(e){throw this.#e=void 0,e}}async#a(){let e=await resolveHeaders(this.#i),t=this.#i.url;try{return await createMCPClient({transport:{type:`http`,url:t,headers:e}})}catch(n){if(!isMcpHttpFallbackRetryableError(n))throw n;return await createMCPClient({transport:{type:`sse`,url:t,headers:e}})}}async getToolMetadata(){return(await this.#o()).metadata}async getTools(){return(await this.#o()).tools}async executeTool(e,t){try{let{tools:n}=await this.#o(),r=n[e];if(r?.execute===void 0)throw Error(`Tool "${e}" not found in connection "${this.#i.connectionName}".`);return await r.execute(t,{})}catch(e){return await this.#l(e)}}async#o(){if(this.#r!==void 0)return this.#r;if(this.#n!==void 0)return this.#n;this.#n=this.#s();try{return this.#r=await this.#n,this.#r}catch(e){throw this.#n=void 0,e}}async#s(){try{return await this.#c()}catch(e){return await this.#l(e)}}async#c(){let e=await this.connect(),t=await e.listTools(),n=this.#i.tools,r=n===void 0?t.tools:t.tools.filter(e=>passesToolFilter(e.name,n)),i=e.toolsFromDefinitions({tools:r});return{metadata:r.map(e=>({annotations:e.annotations,description:e.description??``,inputSchema:e.inputSchema??{},name:e.name,outputSchema:`outputSchema`in e&&e.outputSchema!==void 0?e.outputSchema:void 0})),tools:i}}async close(){this.#t!==void 0&&(await this.#t.close(),this.#t=void 0),this.#e=void 0,this.#n=void 0,this.#r=void 0}async#l(e){throw isMcpAuthRequiredError(e)?(await this.#u(),await this.close(),new ConnectionAuthorizationRequiredError(this.#i.connectionName,{message:`Connection "${this.#i.connectionName}" requires authorization (the server rejected the token).`})):e}async#u(){let e=await resolveConnectionAuthorization(this.#i);e!==void 0&&await evictScopedToken({authorization:e,connection:{url:this.#i.url},scope:this.#i.connectionName})}};function isMcpAuthRequiredError(e){return readHttpStatus(e)===401}function isMcpHttpFallbackRetryableError(e){let t=readHttpStatus(e);return t===400||t===404||t===405}function readHttpStatus(t){for(let n of walkErrorChain(t)){if(!isObject(n))continue;let t=readStatusField(n);if(t!==void 0)return t;let r=n.response;if(isObject(r)){let e=readStatusField(r);if(e!==void 0)return e}if(typeof n.message==`string`){let e=/\bHTTP\s+(\d{3})\b/u.exec(n.message);if(e?.[1]!==void 0)return Number(e[1])}}}function readStatusField(e){if(typeof e.status==`number`)return e.status;if(typeof e.statusCode==`number`)return e.statusCode}function*walkErrorChain(t){let n=t,r=new Set;for(;n!=null&&!r.has(n);){if(r.add(n),yield n,!isObject(n)||!(`cause`in n))return;n=n.cause}}function passesToolFilter(e,t){return t===void 0?!0:`allow`in t?t.allow.includes(e):!t.block.includes(e)}async function resolveHeaders(e){let n={},r,getCallbackContext=()=>r??=buildCallbackContext(),i=await resolveConnectionAuthorization(e,typeof e.authorization==`function`?getCallbackContext():void 0);if(i!==void 0&&(n.Authorization=`Bearer ${(await resolveToken(e,i)).token}`),e.headers!==void 0){let t=await resolveHeadersDefinition(e.headers,getCallbackContext);for(let[r,a]of Object.entries(t)){if(i!==void 0&&r.toLowerCase()===`authorization`)throw Error(`Connection "${e.connectionName}" headers must not include an "Authorization" key when "authorization" is also provided.`);n[r]=a}}return n}async function resolveToken(e,t){return await resolveScopedToken({authorization:t,connection:{url:e.url},scope:e.connectionName})}async function resolveHeadersDefinition(e,t){if(typeof e==`function`)return{...await e(t())};let n={},r=Object.entries(e);for(let[e,i]of r)n[e]=await resolveHeaderValue(i,t);return n}async function resolveHeaderValue(e,t){return typeof e==`function`?await e(t()):await e}export{McpConnectionClient,isMcpAuthRequiredError,passesToolFilter,resolveHeaders};

package/dist/src/runtime/connections/registry.d.ts

@@ -1,4 +1,4 @@
-import type { NeedsApprovalContext } from "#public/definitions/tool.js";
+import type { Approval } from "#public/definitions/approval.js";
 import type { ResolvedConnectionDefinition } from "#runtime/types.js";
 import type { ConnectionClient, ConnectionRegistry } from "#runtime/connections/types.js";
 /**
@@ -20,7 +20,7 @@ export declare class ConnectionRegistryImpl implements ConnectionRegistry {
      * Returns the authored approval function for the named connection,
      * or `undefined` if the connection did not specify one.
      */
-    getConnectionApproval(connectionName: string): ((ctx: NeedsApprovalContext) => boolean) | undefined;
+    getConnectionApproval(connectionName: string): Approval | undefined;
     /**
      * Returns all registered connection names.
      */

package/dist/src/runtime/connections/resolve-authorization.d.ts

@@ -0,0 +1,11 @@
+import type { SessionContext } from "#public/definitions/callback-context.js";
+import type { ResolvedConnectionDefinition } from "#runtime/types.js";
+import type { AuthorizationDefinition } from "#runtime/connections/types.js";
+type ResolvedAuthorization = Readonly<AuthorizationDefinition> | undefined;
+/**
+ * Resolves and validates the auth provider for the active connection call.
+ * Dynamic providers are cached for the execution step so token resolution,
+ * interactive OAuth, and eviction all use the same provider instance.
+ */
+export declare function resolveConnectionAuthorization(connection: ResolvedConnectionDefinition, ctx?: SessionContext): Promise<ResolvedAuthorization>;
+export {};

package/dist/src/runtime/connections/resolve-authorization.js

@@ -0,0 +1 @@
+import{contextStorage}from"#context/container.js";import{buildCallbackContext}from"#context/build-callback-context.js";import{ContextKey}from"#context/key.js";import{normalizeAuthorizationSpec}from"#runtime/connections/validate-authorization.js";const ConnectionAuthorizationResolversKey=new ContextKey(`eve.connectionAuthorizationResolvers`);async function resolveConnectionAuthorization(t,n){let r=t.authorization;if(r===void 0||typeof r!=`function`)return r;let i=contextStorage.getStore();if(i===void 0)return await resolveDynamicAuthorization(t,n);let a=getResolverCache(i),o=a.get(t);return o===void 0&&(o=resolveDynamicAuthorization(t,n),a.set(t,o)),await o}async function resolveDynamicAuthorization(e,n){let i=e.authorization;return typeof i==`function`?normalizeAuthorizationSpec(await i(n??buildCallbackContext()),`Connection "${e.connectionName}" auth resolver:`):i}function getResolverCache(e){let t=e.get(ConnectionAuthorizationResolversKey);if(t!==void 0)return t;let n=new Map;return e.setVirtualContext(ConnectionAuthorizationResolversKey,n),n}export{resolveConnectionAuthorization};