managed-deepagents 0.1.0 → 0.3.0

package/dist/connectors/langsmith.js

@@ -0,0 +1,431 @@
+/**
+ * LangSmith connector — authoring surface.
+ *
+ * A capability-delegation layer for *external / untrusted* callers (browsers,
+ * channels, schedules). The deployment declares a small set of constrained
+ * LangSmith capabilities; MDA performs them server-side with the workspace key
+ * and returns allowlisted responses. The browser never receives
+ * `LANGSMITH_API_KEY`.
+ *
+ * This module is authoring-only: typed per-resource builders + presets that
+ * compile to grants, plus eager validation. The runtime enforcement engine lives
+ * in `runtime/langsmith-connector.ts` and is mounted synchronously by the
+ * connector's `http` hook so routes register before LangGraph captures the
+ * custom HTTP app.
+ */
+import { CONNECTOR_BRAND, } from "../runtime/connector.js";
+import { mountLangSmithRoutes } from "../runtime/langsmith-connector.js";
+/** Conservative default `include` allowlists per resource (browser-safe). */
+const DEFAULT_INCLUDE = {
+    runs: ["id", "status", "start_time", "end_time", "url", "metadata"],
+    feedback: ["id", "run_id", "key", "score", "created_at"],
+    examples: ["id", "dataset_id", "created_at"],
+    prompts: ["name", "commit_hash", "updated_at"],
+    threads: ["thread_id", "created_at", "metadata.title"],
+};
+/** Fields that can never reach a browser without an explicit `allowSensitive`. */
+const SENSITIVE_FIELDS = {
+    runs: ["inputs", "outputs", "events"],
+    prompts: ["content", "messages"],
+    threads: ["messages", "values"],
+};
+/** Constraint keys each resource understands. Unknown keys fail validation. */
+const ALLOWED_CONSTRAINT_KEYS = {
+    runs: [],
+    feedback: ["keys", "scores", "maxCommentChars", "onePerActor"],
+    examples: ["dataset", "allowedFields", "maxExamplesPerThread"],
+    annotation_queues: ["queue", "allowedPriorities", "maxNoteChars"],
+    prompts: [],
+    threads: ["metadataKeys", "maxTitleChars"],
+};
+function omitUndefined(value) {
+    return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== undefined));
+}
+/**
+ * Build a `runs` capability grant (`read` / `share`).
+ *
+ * Use for redacted trace summaries and share links. Prefer {@link traceViewer}
+ * when the default browser surface is enough.
+ *
+ * @param options - Grant id, surfaces, actions, scope, and optional response shaping.
+ * @returns A compiled {@link LangSmithCapability} for the `runs` resource.
+ *
+ * @example
+ * ```ts
+ * langsmith.runs({
+ *   id: "app:run-summary",
+ *   exposeTo: ["browser"],
+ *   actions: ["read", "share"],
+ *   scope: "thread",
+ * })
+ * ```
+ */
+export function runs(options) {
+    return {
+        id: options.id,
+        exposeTo: options.exposeTo,
+        resource: "runs",
+        actions: options.actions,
+        scope: options.scope,
+        response: {
+            include: options.include ?? DEFAULT_INCLUDE.runs,
+            redact: options.redact ?? SENSITIVE_FIELDS.runs,
+        },
+        ...(options.allowSensitive
+            ? { allowSensitive: options.allowSensitive }
+            : {}),
+    };
+}
+/**
+ * Build a `feedback` capability grant (`create` / `update` / `delete`).
+ *
+ * Constrains keys, optional categorical scores, comment length, and
+ * per-actor uniqueness. Prefer {@link chatFeedback} for the common browser
+ * thumbs-up/down + dataset capture surface.
+ *
+ * @param options - Grant id, surfaces, actions, key/score constraints, and shaping.
+ * @returns A compiled {@link LangSmithCapability} for the `feedback` resource.
+ *
+ * @example
+ * ```ts
+ * langsmith.feedback({
+ *   id: "app:user-score",
+ *   exposeTo: ["browser"],
+ *   actions: ["create", "update", "delete"],
+ *   scope: "run",
+ *   keys: ["user_score"],
+ *   scores: ["positive", "negative"],
+ *   onePerActor: true,
+ * })
+ * ```
+ */
+export function feedback(options) {
+    return {
+        id: options.id,
+        exposeTo: options.exposeTo,
+        resource: "feedback",
+        actions: options.actions,
+        scope: options.scope ?? "run",
+        constraints: omitUndefined({
+            keys: options.keys,
+            scores: options.scores,
+            maxCommentChars: options.maxCommentChars,
+            onePerActor: options.onePerActor,
+        }),
+        response: { include: options.include ?? DEFAULT_INCLUDE.feedback },
+    };
+}
+/**
+ * Build an `examples` capability grant (`create` into a fixed dataset).
+ *
+ * The dataset name is fixed in the grant so callers cannot write to arbitrary
+ * datasets. Prefer {@link chatFeedback} when pairing with run feedback.
+ *
+ * @param options - Grant id, surfaces, dataset, and optional field/thread caps.
+ * @returns A compiled {@link LangSmithCapability} for the `examples` resource.
+ *
+ * @example
+ * ```ts
+ * langsmith.examples({
+ *   id: "app:capture-thread",
+ *   exposeTo: ["browser"],
+ *   actions: ["create"],
+ *   scope: "thread",
+ *   dataset: "public-feedback",
+ *   allowedFields: ["messages", "answer", "feedback", "source"],
+ * })
+ * ```
+ */
+export function examples(options) {
+    return {
+        id: options.id,
+        exposeTo: options.exposeTo,
+        resource: "examples",
+        actions: options.actions,
+        scope: options.scope ?? "thread",
+        constraints: omitUndefined({
+            dataset: options.dataset,
+            allowedFields: options.allowedFields,
+            maxExamplesPerThread: options.maxExamplesPerThread,
+        }),
+        response: { include: options.include ?? DEFAULT_INCLUDE.examples },
+    };
+}
+/**
+ * Build an `annotation_queues` capability grant (`enqueue_run` into a fixed queue).
+ *
+ * The queue is fixed in the grant so callers cannot enqueue into arbitrary
+ * queues.
+ *
+ * @param options - Grant id, surfaces, queue, and optional priority/note limits.
+ * @returns A compiled {@link LangSmithCapability} for the `annotation_queues` resource.
+ *
+ * @example
+ * ```ts
+ * langsmith.annotationQueues({
+ *   id: "app:enqueue-review",
+ *   exposeTo: ["trusted_backend"],
+ *   actions: ["enqueue_run"],
+ *   scope: "run",
+ *   queue: "human-review",
+ * })
+ * ```
+ */
+export function annotationQueues(options) {
+    return {
+        id: options.id,
+        exposeTo: options.exposeTo,
+        resource: "annotation_queues",
+        actions: options.actions,
+        scope: options.scope ?? "run",
+        constraints: omitUndefined({
+            queue: options.queue,
+            allowedPriorities: options.allowedPriorities,
+            maxNoteChars: options.maxNoteChars,
+        }),
+        // Enqueue is a write with no readable body; include stays minimal.
+        response: { include: ["id"] },
+    };
+}
+/**
+ * Build a `prompts` capability grant (`read_metadata`).
+ *
+ * Returns prompt metadata only by default; prompt body fields stay redacted.
+ *
+ * @param options - Grant id, surfaces, and optional response shaping.
+ * @returns A compiled {@link LangSmithCapability} for the `prompts` resource.
+ *
+ * @example
+ * ```ts
+ * langsmith.prompts({
+ *   id: "app:prompt-meta",
+ *   exposeTo: ["browser"],
+ *   actions: ["read_metadata"],
+ *   scope: "agent",
+ * })
+ * ```
+ */
+export function prompts(options) {
+    return {
+        id: options.id,
+        exposeTo: options.exposeTo,
+        resource: "prompts",
+        actions: options.actions,
+        scope: options.scope ?? "agent",
+        response: {
+            include: options.include ?? DEFAULT_INCLUDE.prompts,
+            redact: options.redact ?? SENSITIVE_FIELDS.prompts,
+        },
+    };
+}
+/**
+ * Build a `threads` capability grant (`read` / `update_metadata`).
+ *
+ * Thread message bodies stay redacted unless `allowSensitive` acknowledges
+ * them for a browser surface.
+ *
+ * @param options - Grant id, surfaces, actions, metadata constraints, and shaping.
+ * @returns A compiled {@link LangSmithCapability} for the `threads` resource.
+ *
+ * @example
+ * ```ts
+ * langsmith.threads({
+ *   id: "app:thread-title",
+ *   exposeTo: ["browser"],
+ *   actions: ["read", "update_metadata"],
+ *   scope: "actor",
+ *   metadataKeys: ["title"],
+ *   maxTitleChars: 120,
+ * })
+ * ```
+ */
+export function threads(options) {
+    return {
+        id: options.id,
+        exposeTo: options.exposeTo,
+        resource: "threads",
+        actions: options.actions,
+        scope: options.scope ?? "actor",
+        constraints: omitUndefined({
+            metadataKeys: options.metadataKeys,
+            maxTitleChars: options.maxTitleChars,
+        }),
+        response: {
+            include: options.include ?? DEFAULT_INCLUDE.threads,
+            redact: SENSITIVE_FIELDS.threads,
+        },
+        ...(options.allowSensitive
+            ? { allowSensitive: options.allowSensitive }
+            : {}),
+    };
+}
+// --- Presets ---------------------------------------------------------------
+/**
+ * Browser chat feedback preset: thumbs up/down on a run, plus optional dataset
+ * capture of the conversation.
+ *
+ * Expands to two grants with stable capability ids (safe to hard-code in
+ * clients):
+ *
+ * - `langsmith:chat-feedback` — run-scoped {@link feedback} for browsers.
+ *   Key `user_score`, scores `positive`/`negative`, comments ≤ 2000 chars,
+ *   `onePerActor: true`.
+ * - `langsmith:chat-feedback-examples` — thread-scoped {@link examples} create
+ *   into `dataset`, allowing fields `messages`, `answer`, `feedback`, `source`.
+ *
+ * Pass the returned array (or spread it) into {@link connector}.
+ *
+ * @param options.dataset - LangSmith dataset name for the examples capability.
+ * @returns Capability grants for feedback + example capture.
+ *
+ * @example
+ * ```ts
+ * export default langsmith.connector(
+ *   langsmith.chatFeedback({ dataset: "public-feedback" }),
+ * );
+ * // POST /connectors/langsmith/capabilities/langsmith:chat-feedback
+ * ```
+ */
+export function chatFeedback(options) {
+    return [
+        feedback({
+            id: "langsmith:chat-feedback",
+            exposeTo: ["browser"],
+            actions: ["create", "update", "delete"],
+            scope: "run",
+            keys: ["user_score"],
+            scores: ["positive", "negative"],
+            maxCommentChars: 2000,
+            onePerActor: true,
+        }),
+        examples({
+            id: "langsmith:chat-feedback-examples",
+            exposeTo: ["browser"],
+            actions: ["create"],
+            scope: "thread",
+            dataset: options.dataset,
+            allowedFields: ["messages", "answer", "feedback", "source"],
+        }),
+    ];
+}
+/**
+ * Browser trace viewer preset: read a redacted run summary and create a share
+ * link for the caller's thread.
+ *
+ * Expands to one grant with a stable capability id:
+ *
+ * - `langsmith:trace-viewer` — thread-scoped {@link runs} with actions
+ *   `read` and `share`, exposed to `browser`. Responses include
+ *   `id` / `status` / `start_time` / `end_time` / `url` / `metadata` and redact
+ *   `inputs` / `outputs` / `events` by default.
+ *
+ * Pass the returned array (or spread it) into {@link connector}.
+ *
+ * @returns Capability grant for redacted run read/share.
+ *
+ * @example
+ * ```ts
+ * export default langsmith.connector(langsmith.traceViewer());
+ * // POST /connectors/langsmith/capabilities/langsmith:trace-viewer
+ * ```
+ */
+export function traceViewer() {
+    return [
+        runs({
+            id: "langsmith:trace-viewer",
+            exposeTo: ["browser"],
+            actions: ["read", "share"],
+            scope: "thread",
+        }),
+    ];
+}
+// --- Validation ------------------------------------------------------------
+/**
+ * Fail-closed authoring checks that do not require the identity config. The
+ * identity-dependent checks (scope/ingress sanity, tenancy) run when the
+ * connector's `http` hook is mounted, where the resolved identity is available.
+ */
+export function validateLangSmithConnector(capabilities) {
+    if (capabilities.length === 0) {
+        throw new Error("langsmith.connector(...) requires at least one capability.");
+    }
+    const seen = new Set();
+    for (const capability of capabilities) {
+        validateCapability(capability, seen);
+    }
+}
+function validateCapability(capability, seen) {
+    if (!capability.id) {
+        throw new Error("Every LangSmith capability requires an `id`.");
+    }
+    if (seen.has(capability.id)) {
+        throw new Error(`Duplicate LangSmith capability id: "${capability.id}".`);
+    }
+    seen.add(capability.id);
+    if (capability.exposeTo.length === 0) {
+        throw new Error(`LangSmith capability "${capability.id}" must declare at least one exposeTo surface.`);
+    }
+    if (capability.actions.length === 0) {
+        throw new Error(`LangSmith capability "${capability.id}" must declare at least one action.`);
+    }
+    // Every external-surface grant needs an explicit include allowlist.
+    const include = capability.response?.include;
+    if (!include || include.length === 0) {
+        throw new Error(`LangSmith capability "${capability.id}" must set response.include ` +
+            `(fail-closed: unknown fields are dropped).`);
+    }
+    assertSensitiveOptIn(capability, include);
+    assertKnownConstraintKeys(capability);
+}
+function assertSensitiveOptIn(capability, include) {
+    const sensitive = SENSITIVE_FIELDS[capability.resource] ?? [];
+    const acknowledged = new Set(capability.allowSensitive ?? []);
+    const browserExposed = capability.exposeTo.includes("browser");
+    if (!browserExposed) {
+        return;
+    }
+    for (const field of include) {
+        const root = field.split(".")[0] ?? field;
+        if (sensitive.includes(root) && !acknowledged.has(root)) {
+            throw new Error(`LangSmith capability "${capability.id}" includes sensitive field ` +
+                `"${root}" for a browser surface. Add allowSensitive: ["${root}"] to ` +
+                `acknowledge exposing it.`);
+        }
+    }
+}
+function assertKnownConstraintKeys(capability) {
+    const allowed = ALLOWED_CONSTRAINT_KEYS[capability.resource];
+    if (!capability.constraints || allowed === undefined) {
+        return;
+    }
+    for (const key of Object.keys(capability.constraints)) {
+        if (!allowed.includes(key)) {
+            throw new Error(`LangSmith capability "${capability.id}" has unknown constraint ` +
+                `"${key}" for resource "${capability.resource}".`);
+        }
+    }
+}
+/**
+ * Build a branded LangSmith connector from capabilities (or preset-produced
+ * capability arrays). Runs {@link validateLangSmithConnector} eagerly, then
+ * returns a connector whose `http` hook mounts the enforcement engine.
+ */
+export function connector(...capabilities) {
+    const flat = capabilities.flat();
+    validateLangSmithConnector(flat);
+    const instance = {
+        [CONNECTOR_BRAND]: true,
+        kind: "langsmith",
+        capabilities: flat,
+        /**
+         * Mount must be synchronous: `buildManagedHttpApp` does not await hooks,
+         * and LangGraph captures custom routes at import time. A dynamic `import()`
+         * here races that capture and leaves connector paths as platform 404s.
+         */
+        http(ctx) {
+            mountLangSmithRoutes(ctx, flat);
+        },
+    };
+    return instance;
+}
+//# sourceMappingURL=langsmith.js.map

package/dist/connectors/langsmith.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"langsmith.js","sourceRoot":"","sources":["../../src/connectors/langsmith.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,eAAe,GAGhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAsDzE,6EAA6E;AAC7E,MAAM,eAAe,GAAiD;IACpE,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC;IACnE,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC;IACxD,QAAQ,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,YAAY,CAAC;IAC5C,OAAO,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC;IAC9C,OAAO,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,gBAAgB,CAAC;CACvD,CAAC;AAEF,kFAAkF;AAClF,MAAM,gBAAgB,GAAiD;IACrE,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;IACrC,OAAO,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;IAChC,OAAO,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;CAChC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,uBAAuB,GAAiD;IAC5E,IAAI,EAAE,EAAE;IACR,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,aAAa,CAAC;IAC9D,QAAQ,EAAE,CAAC,SAAS,EAAE,eAAe,EAAE,sBAAsB,CAAC;IAC9D,iBAAiB,EAAE,CAAC,OAAO,EAAE,mBAAmB,EAAE,cAAc,CAAC;IACjE,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;CAC3C,CAAC;AAEF,SAAS,aAAa,CAAoC,KAAQ;IAChE,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CACpD,CAAC;AACT,CAAC;AA+BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,IAAI,CAAC,OAA8B;IACjD,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE;YACR,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,IAAI;YAChD,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAAC,IAAI;SAChD;QACD,GAAG,CAAC,OAAO,CAAC,cAAc;YACxB,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AA6BD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,QAAQ,CACtB,OAAkC;IAElC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK;QAC7B,WAAW,EAAE,aAAa,CAAC;YACzB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;QACF,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,QAAQ,EAAE;KACnE,CAAC;AACJ,CAAC;AA2BD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,QAAQ,CACtB,OAAkC;IAElC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,QAAQ;QAChC,WAAW,EAAE,aAAa,CAAC;YACzB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;SACnD,CAAC;QACF,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,QAAQ,EAAE;KACnE,CAAC;AACJ,CAAC;AAyBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAA0C;IAE1C,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK;QAC7B,WAAW,EAAE,aAAa,CAAC;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC;QACF,mEAAmE;QACnE,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE;KAC9B,CAAC;AACJ,CAAC;AAuBD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,OAAO,CACrB,OAAiC;IAEjC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO;QAC/B,QAAQ,EAAE;YACR,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,OAAO;YACnD,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAAC,OAAO;SACnD;KACF,CAAC;AACJ,CAAC;AA8BD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,OAAO,CACrB,OAAiC;IAEjC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO;QAC/B,WAAW,EAAE,aAAa,CAAC;YACzB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC;QACF,QAAQ,EAAE;YACR,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,OAAO;YACnD,MAAM,EAAE,gBAAgB,CAAC,OAAO;SACjC;QACD,GAAG,CAAC,OAAO,CAAC,cAAc;YACxB,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,YAAY,CAAC,OAE5B;IACC,OAAO;QACL,QAAQ,CAAC;YACP,EAAE,EAAE,yBAAyB;YAC7B,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;YACvC,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,CAAC,YAAY,CAAC;YACpB,MAAM,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC;YAChC,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,IAAI;SAClB,CAAC;QACF,QAAQ,CAAC;YACP,EAAE,EAAE,kCAAkC;YACtC,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,CAAC,QAAQ,CAAC;YACnB,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC;SAC5D,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,IAAI,CAAC;YACH,EAAE,EAAE,wBAAwB;YAC5B,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;YAC1B,KAAK,EAAE,QAAQ;SAChB,CAAC;KACH,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,YAAmC;IAEnC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;QACtC,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,UAA+B,EAC/B,IAAiB;IAEjB,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAExB,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,yBAAyB,UAAU,CAAC,EAAE,+CAA+C,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,yBAAyB,UAAU,CAAC,EAAE,qCAAqC,CAC5E,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,yBAAyB,UAAU,CAAC,EAAE,8BAA8B;YAClE,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1C,yBAAyB,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,oBAAoB,CAC3B,UAA+B,EAC/B,OAAiB;IAEjB,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC/D,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QAC1C,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,yBAAyB,UAAU,CAAC,EAAE,6BAA6B;gBACjE,IAAI,IAAI,kDAAkD,IAAI,QAAQ;gBACtE,0BAA0B,CAC7B,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,UAA+B;IAChE,MAAM,OAAO,GAAG,uBAAuB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,WAAW,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO;IACT,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,yBAAyB,UAAU,CAAC,EAAE,2BAA2B;gBAC/D,IAAI,GAAG,mBAAmB,UAAU,CAAC,QAAQ,IAAI,CACpD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,GAAG,YAAgE;IAEnE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;IACjC,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAEjC,MAAM,QAAQ,GAAG;QACf,CAAC,eAAe,CAAC,EAAE,IAAa;QAChC,IAAI,EAAE,WAAoB;QAC1B,YAAY,EAAE,IAAI;QAClB;;;;WAIG;QACH,IAAI,CAAC,GAAgB;YACnB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/connectors.d.ts

@@ -35,6 +35,7 @@
  * });
  * ```
  */
+import { type Connector } from "./runtime/connector.js";
 /** Per-server MCP tool selection. Names are raw, unprefixed MCP tool names. */
 export interface McpToolSelectionConfig {
     /**
@@ -110,8 +111,12 @@ export interface McpServersConfig {
      */
     onConnectionError?: "throw";
 }
-/** The object exported from `connectors/mcp.ts`. */
-export interface McpServersDefinition extends McpServersConfig {
+/**
+ * The connector exported from a `connectors/` module for MCP. It is a branded
+ * managed {@link Connector} whose `tools` hook loads the declared MCP tools at
+ * runtime, plus the raw config the loader reads.
+ */
+export interface McpServersDefinition extends McpServersConfig, Connector {
     /** Internal discriminator used by the MDA loader. */
     readonly kind: "mcp_servers";
 }

package/dist/connectors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connectors.d.ts","sourceRoot":"","sources":["../src/connectors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,4DAA4D;AAC5D,MAAM,WAAW,yBAA0B,SAAQ,sBAAsB;IACvE,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,6CAA6C;AAC7C,MAAM,WAAW,mBAAoB,SAAQ,yBAAyB;IACpE,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,wCAAwC;AACxC,MAAM,WAAW,kBAAmB,SAAQ,yBAAyB;IACnE,oDAAoD;IACpD,SAAS,EAAE,KAAK,CAAC;IACjB,iDAAiD;IACjD,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,OAAO,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,gFAAgF;AAChF,MAAM,MAAM,qBAAqB,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAE7E,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAClD;;;;OAIG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,oDAAoD;AACpD,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,gBAAgB,GACvB,oBAAoB,CA2BtB"}
+{"version":3,"file":"connectors.d.ts","sourceRoot":"","sources":["../src/connectors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEzE,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,4DAA4D;AAC5D,MAAM,WAAW,yBAA0B,SAAQ,sBAAsB;IACvE,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,6CAA6C;AAC7C,MAAM,WAAW,mBAAoB,SAAQ,yBAAyB;IACpE,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,wCAAwC;AACxC,MAAM,WAAW,kBAAmB,SAAQ,yBAAyB;IACnE,oDAAoD;IACpD,SAAS,EAAE,KAAK,CAAC;IACjB,iDAAiD;IACjD,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,OAAO,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,gFAAgF;AAChF,MAAM,MAAM,qBAAqB,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAE7E,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAClD;;;;OAIG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB,EAAE,SAAS;IACvE,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,gBAAgB,GACvB,oBAAoB,CA4CtB"}

package/dist/connectors.js

@@ -35,6 +35,7 @@
  * });
  * ```
  */
+import { CONNECTOR_BRAND } from "./runtime/connector.js";
 /**
  * Declare the MCP servers whose tools should be loaded and added to the managed
  * Deep Agent at runtime.
@@ -61,7 +62,23 @@ export function defineMcpServers(config) {
     for (const [name, server] of entries) {
         validateRemoteServer(name, server);
     }
-    return { kind: "mcp_servers", ...config };
+    const definition = { kind: "mcp_servers", ...config };
+    // Brand it as a connector without exposing the symbol as an enumerable field.
+    Object.defineProperty(definition, CONNECTOR_BRAND, {
+        value: true,
+        enumerable: false,
+    });
+    // The tools hook runs at agent-graph construction time (inside the managed
+    // runtime), so the MCP client loader is imported lazily — authoring-only
+    // installs never pull in `@langchain/mcp-adapters`.
+    Object.defineProperty(definition, "tools", {
+        value: async () => {
+            const { loadManagedMcpTools } = await import("./runtime/connectors-manager.js");
+            return loadManagedMcpTools(definition);
+        },
+        enumerable: false,
+    });
+    return definition;
 }
 /** Allowed remote transports. Stdio is intentionally unsupported in v0. */
 const REMOTE_TRANSPORTS = new Set(["http", "sse"]);

package/dist/connectors.js.map

@@ -1 +1 @@
-{"version":3,"file":"connectors.js","sourceRoot":"","sources":["../src/connectors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAyFH;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAwB;IAExB,MAAM,QAAQ,GAAG,MAA4C,CAAC;IAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC;IAEpC,IACE,OAAO,KAAK,IAAI;QAChB,OAAO,OAAO,KAAK,QAAQ;QAC3B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EACtB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,qCAAqC,CACxC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACrC,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAEnD;;;GAGG;AACH,SAAS,oBAAoB,CAAC,IAAY,EAAE,MAAe;IACzD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,mCAAmC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,MAAM,GAAG,MAAiC,CAAC;IAEjD,4EAA4E;IAC5E,2DAA2D;IAC3D,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,oDAAoD;YACrE,qEAAqE;YACrE,sEAAsE,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,oCAAoC;YACrD,0BAA0B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,qCAAqC,CAAC,CAAC;IAC5E,CAAC;IAED,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAY,EACZ,MAA+B;IAE/B,MAAM,YAAY,GAAG,oBAAoB,CACvC,IAAI,EACJ,cAAc,EACd,MAAM,CAAC,YAAY,CACpB,CAAC;IACF,MAAM,YAAY,GAAG,oBAAoB,CACvC,IAAI,EACJ,cAAc,EACd,MAAM,CAAC,YAAY,CACpB,CAAC;IAEF,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5E,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,iDAAiD;YAClE,qBAAqB,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,UAAkB,EAClB,KAAsC,EACtC,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,eAAe,UAAU,OAAO,KAAK,iCAAiC,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,eAAe,UAAU,OAAO,KAAK,YAAY,KAAK,8BAA8B,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,eAAe,UAAU,OAAO,KAAK,oCAAoC,IAAI,IAAI,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"connectors.js","sourceRoot":"","sources":["../src/connectors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,eAAe,EAAkB,MAAM,wBAAwB,CAAC;AA6FzE;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAwB;IAExB,MAAM,QAAQ,GAAG,MAA4C,CAAC;IAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC;IAEpC,IACE,OAAO,KAAK,IAAI;QAChB,OAAO,OAAO,KAAK,QAAQ;QAC3B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EACtB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,qCAAqC,CACxC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACrC,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,MAAM,EAA0B,CAAC;IAC9E,8EAA8E;IAC9E,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,eAAe,EAAE;QACjD,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,2EAA2E;IAC3E,yEAAyE;IACzE,oDAAoD;IACpD,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,OAAO,EAAE;QACzC,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,EAAE,mBAAmB,EAAE,GAC3B,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;YAClD,OAAO,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;QACD,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAEnD;;;GAGG;AACH,SAAS,oBAAoB,CAAC,IAAY,EAAE,MAAe;IACzD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,mCAAmC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,MAAM,GAAG,MAAiC,CAAC;IAEjD,4EAA4E;IAC5E,2DAA2D;IAC3D,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,oDAAoD;YACrE,qEAAqE;YACrE,sEAAsE,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,oCAAoC;YACrD,0BAA0B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,qCAAqC,CAAC,CAAC;IAC5E,CAAC;IAED,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAY,EACZ,MAA+B;IAE/B,MAAM,YAAY,GAAG,oBAAoB,CACvC,IAAI,EACJ,cAAc,EACd,MAAM,CAAC,YAAY,CACpB,CAAC;IACF,MAAM,YAAY,GAAG,oBAAoB,CACvC,IAAI,EACJ,cAAc,EACd,MAAM,CAAC,YAAY,CACpB,CAAC;IAEF,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5E,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,iDAAiD;YAClE,qBAAqB,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,UAAkB,EAClB,KAAsC,EACtC,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,eAAe,UAAU,OAAO,KAAK,iCAAiC,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,eAAe,UAAU,OAAO,KAAK,YAAY,KAAK,8BAA8B,CACrF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,eAAe,UAAU,OAAO,KAAK,oCAAoC,IAAI,IAAI,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/identity/index.d.ts

@@ -0,0 +1,88 @@
+/**
+ * The managed `identity.ts` declaration primitive.
+ *
+ * A project's root `identity.ts` exports a named `identity` created with
+ * `defineIdentity(...)` (or `defineIdentity.preset(...)`). The compiler
+ * discovers it, generates the custom-auth handler, and wires thread/memory
+ * scoping and downstream credentials.
+ *
+ * This module is pure authoring-time config construction plus eager validation —
+ * it has no runtime dependency (the `providers.*` helpers return plain data).
+ */
+import { type SupabaseProviderOptions } from "./supabase.js";
+import type { IdentityConfig, IdentityDefinition, IdentityPresetName, ValidatedTokenProvider } from "./types.js";
+export type { CredentialResolver, CredentialResolverConfig, CredentialScope, CredentialTarget, HttpIngress, IdentityConfig, IdentityDefinition, IdentityPresetName, MemoryScope, ResolvedCredential, RuntimeIdentity, Tenancy, ThreadScope, ValidatedTokenIngress, ValidatedTokenProvider, } from "./types.js";
+export type { SupabaseProviderOptions, SupabaseRegion } from "./supabase.js";
+export { supabaseAuthV1Base } from "./supabase.js";
+/** The signature of {@link defineIdentity}, including its `.preset` helper. */
+export interface DefineIdentity {
+    (config: IdentityConfig): IdentityDefinition;
+    /**
+     * Start from a named archetype and optionally override any subset of it. The
+     * headline API for the common case.
+     */
+    preset(name: IdentityPresetName, overrides?: DeepPartial<IdentityConfig>): IdentityDefinition;
+}
+/**
+ * Declare the identity contract for the deployment.
+ *
+ * Most developers call {@link defineIdentity.preset} instead. The three scoping
+ * axes are the power-user layer underneath.
+ */
+export declare const defineIdentity: DefineIdentity;
+/**
+ * Provider integrations — authoring-time sugar over {@link ValidatedTokenProvider}.
+ * Each returns a plain provider object you can spread-and-override, so
+ * there is no new runtime surface.
+ */
+export declare const providers: {
+    auth0({ domain, audience, }: {
+        domain: string;
+        audience?: string;
+    }): ValidatedTokenProvider;
+    clerk({ domain }: {
+        domain: string;
+    }): ValidatedTokenProvider;
+    okta({ domain, audience, }: {
+        domain: string;
+        audience?: string;
+    }): ValidatedTokenProvider;
+    cognito({ userPoolId, region, }: {
+        userPoolId: string;
+        region: string;
+    }): ValidatedTokenProvider;
+    entra({ tenantId, audience, }: {
+        tenantId: string;
+        audience?: string;
+    }): ValidatedTokenProvider;
+    google({ audience }?: {
+        audience?: string;
+    }): ValidatedTokenProvider;
+    /** @see {@link supabaseProvider} */
+    supabase(options: SupabaseProviderOptions): ValidatedTokenProvider;
+    /** Universal fallback for any OIDC-compliant IdP via discovery. */
+    oidc({ issuer, audience, }: {
+        issuer: string;
+        audience?: string;
+    }): ValidatedTokenProvider;
+    /**
+     * GitHub OAuth access tokens (opaque bearer tokens, not JWTs). MDA verifies
+     * each request by calling `GET https://api.github.com/user` with the token.
+     */
+    github(): ValidatedTokenProvider;
+    /** MDA-issued anonymous/guest tokens. */
+    guest({ ttl, actorPrefix, }?: {
+        ttl?: string;
+        actorPrefix?: string;
+    }): ValidatedTokenProvider;
+};
+/**
+ * Eagerly reject illegal identity configs at authoring time so misconfig never
+ * reaches the compiler or runtime.
+ */
+export declare function validateIdentity(config: IdentityConfig): void;
+/** Recursively merge plain objects; arrays and primitives from `patch` win. */
+type DeepPartial<T> = T extends object ? {
+    [K in keyof T]?: DeepPartial<T[K]>;
+} : T;
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,KAAK,uBAAuB,EAAoB,MAAM,eAAe,CAAC;AAC/E,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAElB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,OAAO,EACP,WAAW,EACX,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AA8BnD,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,CAAC,MAAM,EAAE,cAAc,GAAG,kBAAkB,CAAC;IAC7C;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,SAAS,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,GACtC,kBAAkB,CAAC;CACvB;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,cAoB5B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,SAAS;iCAIjB;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;sBAUR;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,sBAAsB;gCAY1D;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;qCAavB;QACD,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,sBAAsB;mCAavB;QACD,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;0BAUL;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,sBAAsB;IAUxE,oCAAoC;sBAClB,uBAAuB,GAAG,sBAAsB;IAIlE,mEAAmE;gCAIhE;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;IAU1B;;;OAGG;cACO,sBAAsB;IAehC,yCAAyC;kCAItC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,sBAAsB;CAWxE,CAAC;AAIF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CA0E7D;AA2ED,+EAA+E;AAC/E,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,MAAM,GAClC;KAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GACtC,CAAC,CAAC"}