managed-deepagents 0.0.3-dev.25 → 0.0.3-dev.29

package/dist/runtime/validated-token.js

@@ -0,0 +1,260 @@
+import { HTTPException } from "@langchain/langgraph-sdk/auth";
+import { createRemoteJWKSet, decodeJwt, jwtVerify, SignJWT, } from "jose";
+/** Issuer stamped on MDA-minted guest tokens, used to route them at selection. */
+const GUEST_ISSUER = "mda:guest";
+/** Deployment env var carrying the HS256 key MDA signs/verifies guest tokens with. */
+const GUEST_KEY_ENV = "MDA_GUEST_SIGNING_KEY";
+/** Remote JWKS key sets, cached per resolved JWKS URI for the process lifetime. */
+const jwksCache = new Map();
+/** OIDC `discover` results (issuer → jwks_uri), cached for the process lifetime. */
+const discoverCache = new Map();
+/**
+ * Resolve the caller identity for the `validated_token` ingress mode (§6.2): pick
+ * the provider by token issuer, verify the token (JWKS / introspection / guest),
+ * then map its claims into the identity envelope. Fail-closed (401) throughout.
+ */
+export async function resolveValidatedTokenUser(cfg, ingress, request) {
+    const token = bearerToken(request);
+    const provider = selectProvider(ingress.providers, token);
+    const claims = await verifyProviderClaims(provider, token, request.headers);
+    const user = claimsToUser(provider, claims);
+    if (cfg.tenancy === "multi" && !user.mda_tenant_id) {
+        throw new HTTPException(401, {
+            message: "missing tenant for multi-tenant deployment",
+        });
+    }
+    return user;
+}
+/** Extract the bearer token from the `Authorization` header, or 401. */
+export function bearerToken(request) {
+    const header = request.headers.get("authorization") ?? "";
+    const match = /^Bearer\s+(.+)$/i.exec(header);
+    const token = match?.[1];
+    if (!token) {
+        throw new HTTPException(401, { message: "missing bearer token" });
+    }
+    return token.trim();
+}
+/**
+ * Select the provider that should verify `token`. A single-provider deployment
+ * always uses its one entry; otherwise selection is by the token's `iss` claim
+ * (guest tokens carry MDA's own issuer). Fail-closed on no match (401).
+ */
+export function selectProvider(providers, token) {
+    const [only] = providers;
+    if (only && providers.length === 1) {
+        return only;
+    }
+    let issuer;
+    try {
+        issuer = decodeJwt(token).iss;
+    }
+    catch {
+        throw new HTTPException(401, { message: "malformed token" });
+    }
+    const match = providers.find((p) => p.issuer && p.issuer === issuer);
+    if (match) {
+        return match;
+    }
+    if (issuer === GUEST_ISSUER) {
+        const guest = providers.find((p) => p.guest);
+        if (guest) {
+            return guest;
+        }
+    }
+    throw new HTTPException(401, { message: "no provider matches token issuer" });
+}
+/** Map verified token claims into the managed user envelope, per `provider.claims`. */
+export function claimsToUser(provider, claims) {
+    const actor = claims[provider.claims.actor];
+    if (actor == null || actor === "") {
+        throw new HTTPException(401, {
+            message: `token missing actor claim "${provider.claims.actor}"`,
+        });
+    }
+    const user = {
+        identity: String(actor),
+        permissions: [],
+        mda_actor_id: String(actor),
+        mda_claims: { ...claims },
+    };
+    const tenant = provider.claims.tenant
+        ? claims[provider.claims.tenant]
+        : undefined;
+    if (tenant != null && tenant !== "") {
+        user.mda_tenant_id = String(tenant);
+    }
+    const email = provider.claims.email
+        ? claims[provider.claims.email]
+        : undefined;
+    if (email) {
+        user.mda_actor_email = String(email);
+    }
+    return user;
+}
+async function verifyProviderClaims(provider, token, headers) {
+    if (provider.introspect) {
+        return introspectClaims(provider, token, headers);
+    }
+    if (provider.guest) {
+        return verifyGuestToken(token);
+    }
+    return jwksVerifyClaims(provider, token);
+}
+async function jwksVerifyClaims(provider, token) {
+    const keySet = await providerKeySet(provider);
+    try {
+        const { payload } = await jwtVerify(token, keySet, {
+            issuer: provider.issuer,
+            audience: provider.audience,
+            algorithms: provider.algorithms,
+        });
+        return payload;
+    }
+    catch {
+        throw new HTTPException(401, {
+            message: "token signature verification failed",
+        });
+    }
+}
+async function providerKeySet(provider) {
+    const uri = await resolveJwksUri(provider);
+    let keySet = jwksCache.get(uri);
+    if (!keySet) {
+        keySet = createRemoteJWKSet(new URL(uri));
+        jwksCache.set(uri, keySet);
+    }
+    return keySet;
+}
+async function resolveJwksUri(provider) {
+    if (provider.jwks) {
+        return provider.jwks;
+    }
+    if (provider.discover && provider.issuer) {
+        const cached = discoverCache.get(provider.issuer);
+        if (cached) {
+            return cached;
+        }
+        const base = provider.issuer.replace(/\/$/, "");
+        const response = await fetch(`${base}/.well-known/openid-configuration`);
+        if (!response.ok) {
+            throw new HTTPException(401, {
+                message: "failed to resolve OIDC configuration",
+            });
+        }
+        const config = (await response.json());
+        if (!config.jwks_uri) {
+            throw new HTTPException(401, {
+                message: "OIDC configuration has no jwks_uri",
+            });
+        }
+        discoverCache.set(provider.issuer, config.jwks_uri);
+        return config.jwks_uri;
+    }
+    throw new HTTPException(500, {
+        message: "validated_token provider declares neither jwks nor discover",
+    });
+}
+async function introspectClaims(provider, token, headers) {
+    const introspect = provider.introspect;
+    const target = resolveIntrospection(provider, headers);
+    const requestHeaders = {};
+    // Base headers first, then the selected region's headers so a region can
+    // override the shared default (e.g. a per-region Supabase `apikey`).
+    for (const [key, value] of Object.entries(introspect.headers ?? {})) {
+        requestHeaders[key] = expandEnv(value);
+    }
+    for (const [key, value] of Object.entries(target.headers ?? {})) {
+        requestHeaders[key] = expandEnv(value);
+    }
+    if ((introspect.tokenIn ?? "authorization") === "authorization") {
+        requestHeaders.authorization = `Bearer ${token}`;
+    }
+    else {
+        requestHeaders[introspect.header ?? "authorization"] = token;
+    }
+    // Expand `${ENV}` in the endpoint so region URLs can stay deployment-driven
+    // (e.g. `${SUPABASE_EU_URL}/auth/v1/user`) rather than baked in at authoring.
+    const response = await fetch(expandEnv(target.url), {
+        headers: requestHeaders,
+    });
+    if (!response.ok) {
+        throw new HTTPException(401, { message: "token introspection failed" });
+    }
+    return (await response.json());
+}
+/**
+ * Resolve the introspection endpoint (and any region-specific headers) for the
+ * request. A single-endpoint provider uses `introspect.url`; a multi-region
+ * provider selects by the `regionHeader` value, where each region maps either to
+ * a bare URL (shared headers) or a `{ url, headers }` object carrying its own
+ * credential (e.g. a per-region Supabase `apikey`). Fail-closed (401/500).
+ */
+function resolveIntrospection(provider, headers) {
+    const introspect = provider.introspect;
+    if (introspect.url) {
+        return { url: introspect.url };
+    }
+    if (introspect.regionHeader && introspect.regions) {
+        const region = headers.get(introspect.regionHeader);
+        const entry = region ? introspect.regions[region] : undefined;
+        if (!entry) {
+            throw new HTTPException(401, {
+                message: "unknown or missing region for introspection",
+            });
+        }
+        return typeof entry === "string" ? { url: entry } : entry;
+    }
+    throw new HTTPException(500, {
+        message: "introspection provider declares neither url nor regions",
+    });
+}
+/** Verify an MDA-minted guest token (HS256, signed with the deployment key). */
+async function verifyGuestToken(token) {
+    try {
+        const { payload } = await jwtVerify(token, guestSigningKey(), {
+            issuer: GUEST_ISSUER,
+            algorithms: ["HS256"],
+        });
+        return payload;
+    }
+    catch {
+        throw new HTTPException(401, { message: "invalid guest token" });
+    }
+}
+/**
+ * Mint a short-lived guest token for an anonymous caller. Exposed for the guest
+ * issue/reissue route; the same deployment key verifies it on later calls.
+ */
+export async function issueGuestToken(provider, subject) {
+    const guest = provider.guest;
+    if (!guest?.issue) {
+        throw new HTTPException(400, {
+            message: "provider does not allow guest issuance",
+        });
+    }
+    const sub = `${guest.actorPrefix ?? ""}${subject ?? crypto.randomUUID()}`;
+    return new SignJWT({})
+        .setProtectedHeader({ alg: "HS256" })
+        .setIssuer(GUEST_ISSUER)
+        .setSubject(sub)
+        .setIssuedAt()
+        .setExpirationTime(guest.ttl ?? "24h")
+        .sign(guestSigningKey());
+}
+function guestSigningKey() {
+    const key = process.env[GUEST_KEY_ENV];
+    if (!key) {
+        throw new HTTPException(500, {
+            message: `guest tokens require ${GUEST_KEY_ENV}`,
+        });
+    }
+    return new TextEncoder().encode(key);
+}
+/** Expand a single `${ENV_VAR}` reference in a header value (e.g. Supabase apikey). */
+function expandEnv(value) {
+    return value.replace(/\$\{([A-Z0-9_]+)\}/g, (_match, name) => {
+        return process.env[name] ?? "";
+    });
+}
+//# sourceMappingURL=validated-token.js.map

package/dist/runtime/validated-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validated-token.js","sourceRoot":"","sources":["../../src/runtime/validated-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EACL,kBAAkB,EAClB,SAAS,EAET,SAAS,EACT,OAAO,GACR,MAAM,MAAM,CAAC;AASd,kFAAkF;AAClF,MAAM,YAAY,GAAG,WAAW,CAAC;AACjC,sFAAsF;AACtF,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAI9C,mFAAmF;AACnF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;AAClD,oFAAoF;AACpF,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAmB,EACnB,OAA8B,EAC9B,OAAgB;IAEhB,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,4CAA4C;SACtD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAmC,EACnC,KAAa;IAEb,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IACzB,IAAI,IAAI,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACrE,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,YAAY,CAC1B,QAAgC,EAChC,MAAkB;IAElB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,8BAA8B,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG;SAChE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAgB;QACxB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC;QACvB,WAAW,EAAE,EAAE;QACf,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC;QAC3B,UAAU,EAAE,EAAE,GAAG,MAAM,EAAE;KAC1B,CAAC;IACF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM;QACnC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QAChC,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK;QACjC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/B,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,QAAgC,EAChC,KAAa,EACb,OAAgB;IAEhB,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO,gBAAgB,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAgC,EAChC,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;YACjD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;SAChC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,qCAAqC;SAC/C,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,QAAgC;IAEhC,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,QAAgC;IAEhC,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,mCAAmC,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;gBAC3B,OAAO,EAAE,sCAAsC;aAChD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;gBAC3B,OAAO,EAAE,oCAAoC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IACD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;QAC3B,OAAO,EAAE,6DAA6D;KACvE,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAgC,EAChC,KAAa,EACb,OAAgB;IAEhB,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAW,CAAC;IACxC,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,cAAc,GAA2B,EAAE,CAAC;IAClD,yEAAyE;IACzE,qEAAqE;IACrE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,cAAc,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAChE,cAAc,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,eAAe,CAAC,KAAK,eAAe,EAAE,CAAC;QAChE,cAAc,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;IACnD,CAAC;SAAM,CAAC;QACN,cAAc,CAAC,UAAU,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,KAAK,CAAC;IAC/D,CAAC;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;QAClD,OAAO,EAAE,cAAc;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAe,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC3B,QAAgC,EAChC,OAAgB;IAEhB,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAW,CAAC;IACxC,IAAI,UAAU,CAAC,GAAG,EAAE,CAAC;QACnB,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;gBAC3B,OAAO,EAAE,6CAA6C;aACvD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5D,CAAC;IACD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;QAC3B,OAAO,EAAE,yDAAyD;KACnE,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAC3C,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE;YAC5D,MAAM,EAAE,YAAY;YACpB,UAAU,EAAE,CAAC,OAAO,CAAC;SACtB,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgC,EAChC,OAAgB;IAEhB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,wCAAwC;SAClD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,GAAG,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;IAC1E,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;SACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,SAAS,CAAC,YAAY,CAAC;SACvB,UAAU,CAAC,GAAG,CAAC;SACf,WAAW,EAAE;SACb,iBAAiB,CAAC,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC;SACrC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,wBAAwB,aAAa,EAAE;SACjD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,uFAAuF;AACvF,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;QACnE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/sandbox.d.ts

@@ -2,11 +2,11 @@
  * The managed `sandbox/` declaration primitive.
  *
  * A Managed Deep Agent declares its execution environment in `sandbox/index.ts`
- * by importing a real provider class (e.g. `LangSmithSandbox` from `deepagents`)
- * and handing it to {@link defineSandbox}. The options are typed straight from
- * the provider's own `create(...)` signature — MDA invents no schema. MDA owns
- * how the sandbox is *resolved*: construction, run-scoped naming, reuse across
- * turns, the provisioning `setup.sh`, and lifecycle/TTL.
+ * by importing `LangSmithSandbox` from `deepagents` and handing it to
+ * {@link defineSandbox}. The options are typed straight from the provider's own
+ * `create(...)` signature — MDA invents no schema. MDA owns how the sandbox is
+ * *resolved*: construction, scoped reuse across turns, the provisioning
+ * `setup.sh`, and lifecycle/TTL.
  *
  * @example
  * ```ts
@@ -19,25 +19,26 @@
  * });
  * ```
  */
+import { LangSmithSandbox } from "deepagents";
 /**
  * A sandbox provider class MDA knows how to instantiate.
  *
- * Providers expose a static async `create(options)` factory. MDA calls it after
- * merging the developer's typed options with managed fields. This matches the
- * shape of `deepagents`' `LangSmithSandbox.create(...)`.
+ * Providers expose a static async `create(options)` factory. MDA types options
+ * from that factory signature (matching `deepagents`' `LangSmithSandbox.create(...)`)
+ * and constructs the backend with `new Provider({ sandbox, ... })` at runtime.
  */
 export interface SandboxProviderClass<TOptions extends Record<string, any>, TInstance> {
     create(options: TOptions): Promise<TInstance>;
-    /** Optional stable provider id for debugging, validation, and traces. */
+    /** Optional stable provider id for validation and diagnostics. */
     readonly providerId?: string;
 }
 /** Reuse boundary for a managed sandbox. Defaults to `"thread"`. */
-export type SandboxScope = "thread" | "tenant" | "actor";
+export type SandboxScope = "thread" | "agent";
 /**
  * Provider options MDA owns and developers must not set directly.
  *
- * MDA supplies the image/snapshot (built from `sandbox/Dockerfile` or the
- * provider default) and the run-scoped sandbox name when it calls `create(...)`.
+ * MDA owns sandbox identity and managed runtime safety knobs. Use
+ * `templateName` or `snapshotId` when an explicit LangSmith source is needed.
  */
 export type ManagedSandboxOptionKey = "name" | "image" | "snapshot" | "imageName";
 /** Extracts the option type accepted by a provider's static `create(...)`. */
@@ -55,8 +56,7 @@ export type DefineSandboxOptions<TProvider extends SandboxProviderClass<any, any
      * Sandbox reuse scope. Defaults to `"thread"`.
      *
      * - `"thread"`: one sandbox per durable thread/conversation.
-     * - `"tenant"`: one sandbox shared across threads for the current tenant.
-     * - `"actor"`: one sandbox shared across threads for the current actor.
+     * - `"agent"`: one sandbox shared by all threads handled by this agent process.
      */
     scope?: SandboxScope;
     /**
@@ -74,9 +74,9 @@ export interface SandboxDefinition<TProvider extends SandboxProviderClass<any, a
 /**
  * Declare the managed sandbox provider for a Managed Deep Agent.
  *
- * The developer chooses the provider and its typed options; MDA owns naming,
- * scoping, lifecycle, image/snapshot construction, reuse, the provisioning
- * `setup.sh`, and cleanup. The agent file stays clean — it never sets `backend`.
+ * The provider must be `LangSmithSandbox`; MDA owns naming, scoping, lifecycle,
+ * reuse, the provisioning `setup.sh`, and cleanup. The agent file stays clean —
+ * it never sets `backend`.
  */
-export declare function defineSandbox<TProvider extends SandboxProviderClass<any, any>>(provider: TProvider, options?: DefineSandboxOptions<TProvider>): SandboxDefinition<TProvider>;
+export declare function defineSandbox<TProvider extends typeof LangSmithSandbox = typeof LangSmithSandbox>(provider: TProvider, options?: DefineSandboxOptions<TProvider>): SandboxDefinition<TProvider>;
 //# sourceMappingURL=sandbox.d.ts.map

package/dist/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;;;GAMG;AAEH,MAAM,WAAW,oBAAoB,CACnC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACpC,SAAS;IAET,MAAM,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,yEAAyE;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,oEAAoE;AACpE,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAC/B,MAAM,GACN,OAAO,GACP,UAAU,GACV,WAAW,CAAC;AAEhB,8EAA8E;AAC9E,MAAM,MAAM,sBAAsB,CAAC,SAAS,IAAI,SAAS,SAAS;IAChE,MAAM,CAAC,OAAO,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnD,GACG,QAAQ,SAAS,MAAM,GACrB,QAAQ,GACR,KAAK,GACP,KAAK,CAAC;AAEV;;;;;GAKG;AAEH,MAAM,MAAM,oBAAoB,CAC9B,SAAS,SAAS,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,IAC9C,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE,uBAAuB,CAAC,GAAG;IACrE;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,mDAAmD;AAEnD,MAAM,WAAW,iBAAiB,CAChC,SAAS,SAAS,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,oBAAoB,CACrE,GAAG,EACH,GAAG,CACJ;IAED,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;CACpD;AAED;;;;;;GAMG;AAEH,wBAAgB,aAAa,CAAC,SAAS,SAAS,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,EAC5E,QAAQ,EAAE,SAAS,EACnB,OAAO,CAAC,EAAE,oBAAoB,CAAC,SAAS,CAAC,GACxC,iBAAiB,CAAC,SAAS,CAAC,CAE9B"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;GAMG;AAEH,MAAM,WAAW,oBAAoB,CACnC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACpC,SAAS;IAET,MAAM,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,kEAAkE;IAClE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,oEAAoE;AACpE,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAC/B,MAAM,GACN,OAAO,GACP,UAAU,GACV,WAAW,CAAC;AAEhB,8EAA8E;AAC9E,MAAM,MAAM,sBAAsB,CAAC,SAAS,IAAI,SAAS,SAAS;IAChE,MAAM,CAAC,OAAO,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnD,GACG,QAAQ,SAAS,MAAM,GACrB,QAAQ,GACR,KAAK,GACP,KAAK,CAAC;AAEV;;;;;GAKG;AAEH,MAAM,MAAM,oBAAoB,CAC9B,SAAS,SAAS,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,IAC9C,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE,uBAAuB,CAAC,GAAG;IACrE;;;;;OAKG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,mDAAmD;AAEnD,MAAM,WAAW,iBAAiB,CAChC,SAAS,SAAS,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,oBAAoB,CACrE,GAAG,EACH,GAAG,CACJ;IAED,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;CACpD;AAED;;;;;;GAMG;AAEH,wBAAgB,aAAa,CAC3B,SAAS,SAAS,OAAO,gBAAgB,GAAG,OAAO,gBAAgB,EAEnE,QAAQ,EAAE,SAAS,EACnB,OAAO,CAAC,EAAE,oBAAoB,CAAC,SAAS,CAAC,GACxC,iBAAiB,CAAC,SAAS,CAAC,CAuB9B"}

package/dist/sandbox.js

@@ -2,11 +2,11 @@
  * The managed `sandbox/` declaration primitive.
  *
  * A Managed Deep Agent declares its execution environment in `sandbox/index.ts`
- * by importing a real provider class (e.g. `LangSmithSandbox` from `deepagents`)
- * and handing it to {@link defineSandbox}. The options are typed straight from
- * the provider's own `create(...)` signature — MDA invents no schema. MDA owns
- * how the sandbox is *resolved*: construction, run-scoped naming, reuse across
- * turns, the provisioning `setup.sh`, and lifecycle/TTL.
+ * by importing `LangSmithSandbox` from `deepagents` and handing it to
+ * {@link defineSandbox}. The options are typed straight from the provider's own
+ * `create(...)` signature — MDA invents no schema. MDA owns how the sandbox is
+ * *resolved*: construction, scoped reuse across turns, the provisioning
+ * `setup.sh`, and lifecycle/TTL.
  *
  * @example
  * ```ts
@@ -19,15 +19,43 @@
  * });
  * ```
  */
+import { LangSmithSandbox } from "deepagents";
 /**
  * Declare the managed sandbox provider for a Managed Deep Agent.
  *
- * The developer chooses the provider and its typed options; MDA owns naming,
- * scoping, lifecycle, image/snapshot construction, reuse, the provisioning
- * `setup.sh`, and cleanup. The agent file stays clean — it never sets `backend`.
+ * The provider must be `LangSmithSandbox`; MDA owns naming, scoping, lifecycle,
+ * reuse, the provisioning `setup.sh`, and cleanup. The agent file stays clean —
+ * it never sets `backend`.
  */
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export function defineSandbox(provider, options) {
-    return { kind: "sandbox", provider, options };
+    if (providerKey(provider) !== "LangSmithSandbox") {
+        throw new TypeError("defineSandbox(...) only supports deepagents' LangSmithSandbox provider");
+    }
+    const scope = options?.scope ?? "thread";
+    if (scope !== "thread" && scope !== "agent") {
+        throw new TypeError('sandbox scope must be "thread" or "agent"');
+    }
+    const managed = managedOptionKeys(options);
+    if (managed.length > 0) {
+        throw new TypeError(`${managed.join(", ")} ${managed.length === 1 ? "is" : "are"} owned by the managed runtime and cannot be set in defineSandbox(...).`);
+    }
+    return {
+        kind: "sandbox",
+        provider,
+        options: { ...options, scope },
+    };
+}
+function providerKey(provider) {
+    const providerId = provider.providerId;
+    if (typeof providerId === "string" && providerId.trim()) {
+        return providerId.trim();
+    }
+    return typeof provider.name === "string" ? provider.name.trim() : "";
+}
+function managedOptionKeys(options) {
+    if (!options)
+        return [];
+    return ["name", "image", "snapshot", "imageName"].filter((key) => Object.prototype.hasOwnProperty.call(options, key));
 }
 //# sourceMappingURL=sandbox.js.map

package/dist/sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAiFH;;;;;;GAMG;AACH,8DAA8D;AAC9D,MAAM,UAAU,aAAa,CAC3B,QAAmB,EACnB,OAAyC;IAEzC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC"}
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAgF9C;;;;;;GAMG;AACH,8DAA8D;AAC9D,MAAM,UAAU,aAAa,CAG3B,QAAmB,EACnB,OAAyC;IAEzC,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,kBAAkB,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CACjB,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,QAAQ,CAAC;IACzC,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IACnB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAChC,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,QAAQ;QACR,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAqC;KAClE,CAAC;AACJ,CAAC;AAMD,SAAS,WAAW,CAAC,QAAiC;IACpD,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;IACvC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACxD,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,iBAAiB,CACxB,OAA4C;IAE5C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAC/D,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CACnD,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -1,4 +1,5 @@
 import type { CreateDeepAgentParams } from "deepagents";
+import type { RuntimeIdentity } from "./identity.js";
 /**
  * Properties the managed runtime owns. Agent authors never set these — MDA
  * wires the backend, store, checkpointer, memory, skills, and system prompt at
@@ -107,5 +108,13 @@ export interface RuntimeChannel {
  */
 export interface Runtime {
     channel: RuntimeChannel;
+    /**
+     * The frozen identity envelope for the current run, resolved at ingress.
+     *
+     * Optional because identity is opt-in: a project without an `identity.ts`
+     * runs as a service principal with no end-user scoping (§6.5). Present once
+     * the deployment declares identity and the runtime seam populates it.
+     */
+    identity?: RuntimeIdentity;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAExD;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAC3B,SAAS,GACT,OAAO,GACP,cAAc,GACd,cAAc,GACd,QAAQ,GACR,QAAQ,CAAC;AAEb;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CACtC,qBAAqB,EACrB,mBAAmB,CACpB,GAAG;IACF,4EAA4E;IAC5E,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,mDAAmD;IACnD,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,kDAAkD;IAClD,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,qEAAqE;IACrE,MAAM,CAAC,EAAE,KAAK,CAAC;IACf,6DAA6D;IAC7D,MAAM,CAAC,EAAE,KAAK,CAAC;IACf;;;OAGG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;CAC1B,GACD;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,WAAW,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAClC,EAAE,CAAC,EAAE,kBAAkB,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,UAAU,CAAC;IAC1E,KAAK,EAAE,YAAY,CAAC;IACpB,IAAI,CACF,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,cAAc,CAAC;CACzB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAC3B,SAAS,GACT,OAAO,GACP,cAAc,GACd,cAAc,GACd,QAAQ,GACR,QAAQ,CAAC;AAEb;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CACtC,qBAAqB,EACrB,mBAAmB,CACpB,GAAG;IACF,4EAA4E;IAC5E,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,mDAAmD;IACnD,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,kDAAkD;IAClD,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,qEAAqE;IACrE,MAAM,CAAC,EAAE,KAAK,CAAC;IACf,6DAA6D;IAC7D,MAAM,CAAC,EAAE,KAAK,CAAC;IACf;;;OAGG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;CAC1B,GACD;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,WAAW,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAClC,EAAE,CAAC,EAAE,kBAAkB,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,UAAU,CAAC;IAC1E,KAAK,EAAE,YAAY,CAAC;IACpB,IAAI,CACF,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,cAAc,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "managed-deepagents",
-  "version": "0.0.3-dev.25",
+  "version": "0.0.3-dev.29",
   "description": "Managed Deep Agents — the `defineDeepAgent` authoring interface plus the CLI that compiles and deploys a code-first Deep Agent repository to a managed LangGraph runtime.",
   "keywords": [
     "langchain",
@@ -43,23 +43,26 @@
     "lint": "oxlint --config ../../.oxlintrc.jsonc src",
     "lint:fix": "oxlint --config ../../.oxlintrc.jsonc src --fix",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "vitest run",
+    "test": "vitest run --typecheck",
     "test:watch": "vitest"
   },
   "engines": {
     "node": ">=22"
   },
   "dependencies": {
+    "@langchain/langgraph-sdk": "^1.9.25",
     "@langchain/mcp-adapters": "^1.1.3",
-    "deepagents": "^1.10.4"
+    "deepagents": "^1.10.4",
+    "hono": "^4.12.28",
+    "jose": "^6.2.3"
   },
   "optionalDependencies": {
-    "@langchain/managed-deepagents-darwin-arm64": "0.0.3-dev.25",
-    "@langchain/managed-deepagents-darwin-x64": "0.0.3-dev.25",
-    "@langchain/managed-deepagents-linux-arm64": "0.0.3-dev.25",
-    "@langchain/managed-deepagents-linux-x64": "0.0.3-dev.25",
-    "@langchain/managed-deepagents-win32-arm64": "0.0.3-dev.25",
-    "@langchain/managed-deepagents-win32-x64": "0.0.3-dev.25"
+    "@langchain/managed-deepagents-darwin-arm64": "0.0.3-dev.29",
+    "@langchain/managed-deepagents-darwin-x64": "0.0.3-dev.29",
+    "@langchain/managed-deepagents-linux-arm64": "0.0.3-dev.29",
+    "@langchain/managed-deepagents-linux-x64": "0.0.3-dev.29",
+    "@langchain/managed-deepagents-win32-arm64": "0.0.3-dev.29",
+    "@langchain/managed-deepagents-win32-x64": "0.0.3-dev.29"
   },
   "devDependencies": {
     "@types/node": "^26.0.1",

package/dist/runtime/dev-notice.d.ts

@@ -1,7 +0,0 @@
-export declare function logDevSandboxNoticeOnce(message: string): void;
-/**
- * Reset the one-time notice guard. Test-only: the guard is module-level state
- * that otherwise persists across test cases in the same module instance.
- */
-export declare function resetDevSandboxNoticeForTests(): void;
-//# sourceMappingURL=dev-notice.d.ts.map

package/dist/runtime/dev-notice.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dev-notice.d.ts","sourceRoot":"","sources":["../../src/runtime/dev-notice.ts"],"names":[],"mappings":"AAaA,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAK7D;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}

package/dist/runtime/dev-notice.js

@@ -1,27 +0,0 @@
-/**
- * Emit a one-time notice describing which dev sandbox mode is in effect.
- *
- * Deduped for the lifetime of the process because the managed sandbox is
- * created once per sandbox *scope key* (thread/tenant/actor), not once per
- * process. The `mda dev` LangGraph server is long-lived and serves many
- * threads, so each new thread misses the sandbox cache and provisions a fresh
- * sandbox — without this guard the banner would reprint on the first turn of
- * every new thread (and could interleave when threads start concurrently). The
- * message is session-level context, so once is enough.
- */
-let loggedDevSandboxNotice = false;
-export function logDevSandboxNoticeOnce(message) {
-    if (loggedDevSandboxNotice)
-        return;
-    loggedDevSandboxNotice = true;
-    // eslint-disable-next-line no-console
-    console.log(message);
-}
-/**
- * Reset the one-time notice guard. Test-only: the guard is module-level state
- * that otherwise persists across test cases in the same module instance.
- */
-export function resetDevSandboxNoticeForTests() {
-    loggedDevSandboxNotice = false;
-}
-//# sourceMappingURL=dev-notice.js.map

package/dist/runtime/dev-notice.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dev-notice.js","sourceRoot":"","sources":["../../src/runtime/dev-notice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,IAAI,sBAAsB,GAAG,KAAK,CAAC;AAEnC,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,IAAI,sBAAsB;QAAE,OAAO;IACnC,sBAAsB,GAAG,IAAI,CAAC;IAC9B,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B;IAC3C,sBAAsB,GAAG,KAAK,CAAC;AACjC,CAAC"}

package/dist/runtime/local-dev-sandbox.d.ts

@@ -1,13 +0,0 @@
-import type { ManagedSandboxBackend } from "./types.js";
-/**
- * Provision a local, throwaway sandbox rooted at a fresh OS temp directory.
- *
- * Uses `deepagents`' `LocalShellBackend`, which runs commands and file
- * operations against the host within the temp dir — no remote sandbox, no
- * credentials, no network. Intended only for `mda dev`.
- *
- * `reason` explains *why* the local sandbox is being used (missing credentials,
- * provider creation failure, …) and is logged once alongside the temp dir path.
- */
-export declare function createLocalDevSandbox(reason: string): Promise<ManagedSandboxBackend>;
-//# sourceMappingURL=local-dev-sandbox.d.ts.map

package/dist/runtime/local-dev-sandbox.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"local-dev-sandbox.d.ts","sourceRoot":"","sources":["../../src/runtime/local-dev-sandbox.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAexD;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,qBAAqB,CAAC,CAkChC"}

package/dist/runtime/local-dev-sandbox.js

@@ -1,39 +0,0 @@
-import { mkdtemp } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { logDevSandboxNoticeOnce } from "./dev-notice.js";
-/**
- * Provision a local, throwaway sandbox rooted at a fresh OS temp directory.
- *
- * Uses `deepagents`' `LocalShellBackend`, which runs commands and file
- * operations against the host within the temp dir — no remote sandbox, no
- * credentials, no network. Intended only for `mda dev`.
- *
- * `reason` explains *why* the local sandbox is being used (missing credentials,
- * provider creation failure, …) and is logged once alongside the temp dir path.
- */
-export async function createLocalDevSandbox(reason) {
-    const dir = await mkdtemp(join(tmpdir(), "mda-dev-sandbox-"));
-    logDevSandboxNoticeOnce(`[mda dev] ${reason}:\n  ${dir}`);
-    // Loaded dynamically (rather than a static named import) so the build does
-    // not depend on `LocalShellBackend` being present in the resolved
-    // `deepagents` type surface; it is provided by the runtime's `deepagents`.
-    const deepagentsModule = (await import("deepagents"));
-    const LocalShellBackend = deepagentsModule.LocalShellBackend;
-    if (typeof LocalShellBackend !== "function") {
-        throw new Error("the installed `deepagents` does not export `LocalShellBackend`; upgrade " +
-            "`deepagents` to use the local `mda dev` sandbox, or set the provider credentials.");
-    }
-    const backend = new LocalShellBackend({
-        rootDir: dir,
-        virtualMode: true,
-        inheritEnv: true,
-    });
-    // Initialize eagerly when the backend supports it, mirroring how the provider
-    // `create(...)` factory hands back a ready-to-use backend.
-    if (typeof backend.initialize === "function") {
-        await backend.initialize();
-    }
-    return backend;
-}
-//# sourceMappingURL=local-dev-sandbox.js.map

package/dist/runtime/local-dev-sandbox.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"local-dev-sandbox.js","sourceRoot":"","sources":["../../src/runtime/local-dev-sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAgB1D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC9D,uBAAuB,CAAC,aAAa,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC;IAE1D,2EAA2E;IAC3E,kEAAkE;IAClE,2EAA2E;IAC3E,MAAM,gBAAgB,GAAG,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,CAGnD,CAAC;IACF,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,iBAE9B,CAAC;IACd,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,mFAAmF,CACtF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;QACpC,OAAO,EAAE,GAAG;QACZ,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE,IAAI;KACjB,CAAC,CAAC;IAEH,8EAA8E;IAC9E,2DAA2D;IAC3D,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC7C,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;IAED,OAAO,OAA2C,CAAC;AACrD,CAAC"}