managed-deepagents 0.4.2 → 0.4.3-dev.95

package/dist/runtime/cors.js

@@ -1,6 +1,5 @@
 /**
- * CORS allowlist helpers for managed HTTP routes (`/identity`, `/connectors`,
- * `/channels`).
+ * CORS allowlist helpers for managed HTTP routes (`/identity`, `/connectors`).
  *
  * LangGraph applies `CORS_ALLOW_ORIGINS` to built-in Agent Server routes, but
  * GET responses from the custom `http.app` do not always receive those headers.
@@ -9,15 +8,25 @@
  *
  * `mda deploy` still derives `CORS_ALLOW_ORIGINS` from
  * {@link MDA_PUBLIC_APP_URL_ENV} plus optional {@link MDA_CORS_ORIGINS_ENV}.
+ *
+ * Subdomain policy: an allowlisted origin also permits **one** DNS label
+ * beneath it (e.g. Cloudflare Pages previews under a project apex). Deeper
+ * nesting is rejected. With credentialed CORS, do not put hosts that issue
+ * attacker-reachable subdomains into {@link MDA_CORS_ORIGINS_ENV} / the public
+ * app URL — a malicious page on such a subdomain could read `/identity` and
+ * `/connectors` responses.
  */
-import { MDA_PUBLIC_APP_URL_ENV } from "../identity/slack/oauth.js";
+import { MDA_PUBLIC_APP_URL_ENV } from "../identity/oauth-env.js";
 /** Path prefixes that receive managed-app CORS (not built-in Agent Server routes). */
 export const MDA_CORS_PATH_PREFIXES = [
     "/identity",
     "/connectors",
     "/channels",
 ];
-/** Comma-separated extra browser origins allowed for managed HTTP CORS. */
+/**
+ * Comma-separated extra browser origins allowed for managed HTTP CORS.
+ * Each entry also trusts a single subdomain label; avoid multi-tenant hosts.
+ */
 export const MDA_CORS_ORIGINS_ENV = "MDA_CORS_ORIGINS";
 /** Headers browser clients send on identity / connector fetches. */
 export const MDA_CORS_ALLOW_HEADERS = [
@@ -52,6 +61,15 @@ export function resolveCorsAllowlist(env = process.env) {
     }
     return [...origins];
 }
+/** True when `requestHost` is exactly one DNS label under `allowedHost`. */
+function isSingleSubdomain(requestHost, allowedHost) {
+    const suffix = `.${allowedHost}`;
+    if (!requestHost.endsWith(suffix)) {
+        return false;
+    }
+    const label = requestHost.slice(0, -suffix.length);
+    return label.length > 0 && !label.includes(".");
+}
 /**
  * Return `requestOrigin` when it is allowed, otherwise `undefined`.
  * Allows exact allowlist matches and one-level subdomains of an allowlisted host.
@@ -83,7 +101,7 @@ export function matchCorsOrigin(requestOrigin, allowlist) {
             continue;
         }
         if (requestHost === allowedHost ||
-            requestHost.endsWith(`.${allowedHost}`)) {
+            isSingleSubdomain(requestHost, allowedHost)) {
             return origin;
         }
     }

package/dist/runtime/cors.js.map

@@ -1 +1 @@
-{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/runtime/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,sFAAsF;AACtF,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,WAAW;IACX,aAAa;IACb,WAAW;CACH,CAAC;AAEX,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,oEAAoE;AACpE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,eAAe;IACf,cAAc;IACd,QAAQ;IACR,WAAW;IACX,WAAW;CACH,CAAC;AAEX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,SAAS;CACD,CAAC;AAEX,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,sBAAsB,CAAC,IAAI,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAClC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,SAAS,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,aAAqB,EACrB,SAAmB;IAEnB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,IAAI,WAAmB,CAAC;QACxB,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IACE,WAAW,KAAK,WAAW;YAC3B,WAAW,CAAC,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,EACvC,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/runtime/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,sFAAsF;AACtF,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,WAAW;IACX,aAAa;IACb,WAAW;CACH,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,oEAAoE;AACpE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,eAAe;IACf,cAAc;IACd,QAAQ;IACR,WAAW;IACX,WAAW;CACH,CAAC;AAEX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,SAAS;CACD,CAAC;AAEX,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,sBAAsB,CAAC,IAAI,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAClC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,SAAS,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED,4EAA4E;AAC5E,SAAS,iBAAiB,CAAC,WAAmB,EAAE,WAAmB;IACjE,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;IACjC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,aAAqB,EACrB,SAAmB;IAEnB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,IAAI,WAAmB,CAAC;QACxB,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IACE,WAAW,KAAK,WAAW;YAC3B,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC,EAC3C,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/runtime/credentials.d.ts

@@ -2,15 +2,15 @@ import type { CredentialTarget, IdentityConfig, ResolvedCredential, RuntimeIdent
 /**
  * Component 5 — Credentials, custom mode.
  *
- * The escape hatch Agent Auth can't cover: bespoke per-actor credential minting
+ * The escape hatch Agent Auth can't cover: bespoke per-caller credential minting
  * via an in-process resolver callback or a hosted token-exchange endpoint. It
  * runs in the worker (not the shared ingress auth handler), applies the output
- * to downstream calls, and caches per `(actor, tenant, target)` until the
- * credential's `expiresAt`. Secrets live only in this in-memory cache keyed by
- * identity — never in thread state or traces.
+ * to downstream calls, and caches per `(user, target)` until the credential's
+ * `expiresAt`. Secrets live only in this in-memory cache keyed by identity —
+ * never in thread state or traces.
  *
- * Managed credential modes (`agent`/`actor`) are reserved for platform Agent
- * Auth and are **not** resolved by this package — only `custom` builds a
+ * Managed credential modes (`"user"` / `"agent"`) select toolserver/Connect
+ * ownership on the identity axis; only `custom` builds a
  * {@link CredentialsProvider} here.
  */
 /** Env var holding the HMAC secret MDA signs the endpoint assertion with. */
@@ -43,10 +43,10 @@ export declare const DEFAULT_CREDENTIAL_TTL_MS: number;
 /** Soft cap on cached credentials per process. */
 export declare const MAX_CREDENTIAL_CACHE_ENTRIES = 1024;
 /**
- * TTL cache for resolved credentials, keyed by `(actor, tenant, target)` so
+ * TTL cache for resolved credentials, keyed by `(user, target)` so
  * per-repo/per-install tokens never collide. Kept out of thread state. Entries
  * expire at the credential's `expiresAt`, or after a default TTL when omitted.
- * The cache is soft-capped to bound memory in multi-tenant workers.
+ * The cache is soft-capped to bound memory in long-lived workers.
  */
 export declare class CredentialCache {
     private readonly defaultTtlMs;

package/dist/runtime/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/runtime/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,8BAA8B,CAAC;AAKzE,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,GAAG,CACD,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,4EAA4E;IAC5E,aAAa,EAAE,CACb,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,gBAAgB,KACrB,OAAO,CAAC,MAAM,CAAC,CAAC;CACtB;AAQD,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,QAAiB,CAAC;AACxD,kDAAkD;AAClD,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD;;;;;GAKG;AACH,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAJ7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IAEzD,YACmB,YAAY,GAAE,MAAkC,EAChD,UAAU,GAAE,MAAqC,EAChE;IAEJ,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAU9D;IAED,GAAG,CACD,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,kBAAkB,EACzB,KAAK,GAAE,MAAmB,GACzB,IAAI,CAkBN;IAED,KAAK,IAAI,IAAI,CAEZ;CACF;AAKD,2DAA2D;AAC3D,wBAAgB,4BAA4B,IAAI,IAAI,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,IAAI,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,EAC9B,KAAK,GAAE,eAA8B,GACpC,mBAAmB,GAAG,SAAS,CA8BjC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/runtime/credentials.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAGV,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAG9B;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,8BAA8B,CAAC;AAKzE,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,GAAG,CACD,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,4EAA4E;IAC5E,aAAa,EAAE,CACb,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,gBAAgB,KACrB,OAAO,CAAC,MAAM,CAAC,CAAC;CACtB;AAQD,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,QAAiB,CAAC;AACxD,kDAAkD;AAClD,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD;;;;;GAKG;AACH,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAJ7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IAEzD,YACmB,YAAY,GAAE,MAAkC,EAChD,UAAU,GAAE,MAAqC,EAChE;IAEJ,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAU9D;IAED,GAAG,CACD,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,kBAAkB,EACzB,KAAK,GAAE,MAAmB,GACzB,IAAI,CAkBN;IAED,KAAK,IAAI,IAAI,CAEZ;CACF;AAKD,2DAA2D;AAC3D,wBAAgB,4BAA4B,IAAI,IAAI,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,IAAI,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,EAC9B,KAAK,GAAE,eAA8B,GACpC,mBAAmB,GAAG,SAAS,CA8BjC"}

package/dist/runtime/credentials.js

@@ -1,16 +1,18 @@
 import { SignJWT } from "jose";
+import { credentialTargetNames, isSingleCredentialResolver, } from "../identity/index.js";
+import { fetchWithTimeout, PROVIDER_HTTP_TIMEOUT_MS } from "./http.js";
 /**
  * Component 5 — Credentials, custom mode.
  *
- * The escape hatch Agent Auth can't cover: bespoke per-actor credential minting
+ * The escape hatch Agent Auth can't cover: bespoke per-caller credential minting
  * via an in-process resolver callback or a hosted token-exchange endpoint. It
  * runs in the worker (not the shared ingress auth handler), applies the output
- * to downstream calls, and caches per `(actor, tenant, target)` until the
- * credential's `expiresAt`. Secrets live only in this in-memory cache keyed by
- * identity — never in thread state or traces.
+ * to downstream calls, and caches per `(user, target)` until the credential's
+ * `expiresAt`. Secrets live only in this in-memory cache keyed by identity —
+ * never in thread state or traces.
  *
- * Managed credential modes (`agent`/`actor`) are reserved for platform Agent
- * Auth and are **not** resolved by this package — only `custom` builds a
+ * Managed credential modes (`"user"` / `"agent"`) select toolserver/Connect
+ * ownership on the identity axis; only `custom` builds a
  * {@link CredentialsProvider} here.
  */
 /** Env var holding the HMAC secret MDA signs the endpoint assertion with. */
@@ -22,10 +24,10 @@ export const DEFAULT_CREDENTIAL_TTL_MS = 15 * 60 * 1000;
 /** Soft cap on cached credentials per process. */
 export const MAX_CREDENTIAL_CACHE_ENTRIES = 1024;
 /**
- * TTL cache for resolved credentials, keyed by `(actor, tenant, target)` so
+ * TTL cache for resolved credentials, keyed by `(user, target)` so
  * per-repo/per-install tokens never collide. Kept out of thread state. Entries
  * expire at the credential's `expiresAt`, or after a default TTL when omitted.
- * The cache is soft-capped to bound memory in multi-tenant workers.
+ * The cache is soft-capped to bound memory in long-lived workers.
  */
 export class CredentialCache {
     defaultTtlMs;
@@ -82,7 +84,7 @@ export function clearCredentialCacheForTests() {
  * run's resolved identity; every `for(target)` call is scoped to that actor.
  */
 export function createCredentialsProvider(cfg, identity, deps, cache = defaultCache) {
-    if (cfg.scoping.credentials !== "custom" || !cfg.credentials) {
+    if (cfg.scope.credentials !== "custom" || !cfg.credentials) {
         return undefined;
     }
     const resolved = {
@@ -115,22 +117,45 @@ async function resolveCredential(cfg, identity, target, deps) {
     if (!creds) {
         throw new Error("No credentials resolver is configured for this deployment.");
     }
-    if ("resolve" in creds) {
-        const out = await creds.resolve({ identity, target });
-        return normalizeResolved(out, "resolver");
+    return resolveOne(selectResolver(creds, target), identity, target, deps, creds);
+}
+/**
+ * Pick the resolver for this target: the single one, or the map entry whose key
+ * matches `target.name`.
+ */
+function selectResolver(creds, target) {
+    if (isSingleCredentialResolver(creds)) {
+        return creds;
+    }
+    const entry = Object.hasOwn(creds, target.name)
+        ? creds[target.name]
+        : undefined;
+    if (!entry) {
+        const configured = credentialTargetNames(creds).join(", ");
+        throw new Error(`runtime.credentials.for(...) has no resolver for target "${target.name}". ` +
+            `Configured targets: ${configured}.`);
+    }
+    return entry;
+}
+async function resolveOne(config, identity, target, deps, creds) {
+    const label = isSingleCredentialResolver(creds)
+        ? "resolver"
+        : `resolver for "${target.name}"`;
+    if ("resolve" in config) {
+        return normalizeResolved(await config.resolve({ identity, target }), label);
     }
     const assertion = await deps.signAssertion(identity, target);
-    return callTokenExchange(creds.endpoint.url, assertion, deps);
+    return callTokenExchange(config.endpoint.url, assertion, deps);
 }
 async function callTokenExchange(url, assertion, deps) {
-    const response = await deps.fetch(url, {
+    const response = await fetchWithTimeout(url, {
         method: "POST",
         headers: {
             "content-type": "application/json",
             authorization: `Bearer ${assertion}`,
         },
         body: JSON.stringify({ assertion }),
-    });
+    }, PROVIDER_HTTP_TIMEOUT_MS, deps.fetch);
     if (!response.ok) {
         throw new Error(`Credential token-exchange endpoint ${url} responded ${response.status}.`);
     }
@@ -144,25 +169,23 @@ async function defaultSignAssertion(identity, target) {
     }
     const issuedAt = Math.floor(Date.now() / 1000);
     return new SignJWT({
-        actor_id: identity.actor.id,
-        actor_type: identity.actor.type,
-        tenant_id: identity.tenant?.id,
+        user_id: identity.user.id,
+        user_kind: identity.user.kind,
         target: { kind: target.kind, name: target.name, intent: target.intent },
     })
         .setProtectedHeader({ alg: "HS256" })
-        .setSubject(identity.actor.id)
+        .setSubject(identity.user.id)
         .setIssuedAt(issuedAt)
         .setExpirationTime(issuedAt + ASSERTION_TTL_SECONDS)
         .sign(new TextEncoder().encode(secret));
 }
 /**
- * The cache key that discriminates a minted credential: the actor + tenant it
- * belongs to, plus the target's kind/name/intent/thread and metadata.
+ * The cache key that discriminates a minted credential: the user it belongs to,
+ * plus the target's kind/name/intent/thread and metadata.
  */
 function cacheKey(identity, target) {
     return stableStringify([
-        identity.actor.id,
-        identity.tenant?.id ?? null,
+        identity.user.id,
         target.kind,
         target.name,
         target.intent ?? null,

package/dist/runtime/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/runtime/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAS/B;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GAAG,2BAA2B,CAAC;AAEzE,iEAAiE;AACjE,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAwCjC,kEAAkE;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACxD,kDAAkD;AAClD,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IAIP,YAAY;IACZ,UAAU;IAJZ,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEzD,YACmB,YAAY,GAAW,yBAAyB,EAChD,UAAU,GAAW,4BAA4B;4BADjD,YAAY;0BACZ,UAAU;IAC1B,CAAC;IAEJ,GAAG,CAAC,GAAW,EAAE,KAAa;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,KAAK,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC;IAED,GAAG,CACD,GAAW,EACX,KAAyB,EACzB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;QAE1B,IAAI,WAAmB,CAAC;QACxB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3C,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM;gBACR,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAC;AAE3C,2DAA2D;AAC3D,MAAM,UAAU,4BAA4B;IAC1C,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAmB,EACnB,QAAqC,EACrC,IAA8B,EAC9B,KAAK,GAAoB,YAAY;IAErC,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAmB;QAC/B,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK;QAC3B,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACpC,aAAa,EAAE,IAAI,EAAE,aAAa,IAAI,oBAAoB;KAC3D,CAAC;IACF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO;YACvB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,sEAAsE;oBACpE,6BAA6B,CAChC,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC3C,IAAI,GAAG,EAAE,CAAC;oBACR,OAAO,GAAG,CAAC;gBACb,CAAC;YACH,CAAC;YACD,2EAA2E;YAC3E,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACpB,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAmB,EACnB,QAAyB,EACzB,MAAwB,EACxB,IAAoB;IAEpB,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,OAAO,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7D,OAAO,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAW,EACX,SAAiB,EACjB,IAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,SAAS,EAAE;SACrC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,sCAAsC,GAAG,cAAc,QAAQ,CAAC,MAAM,GAAG,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,YAAY,GAAG,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,QAAyB,EACzB,MAAwB;IAExB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,8DAA8D;YAC5D,GAAG,6BAA6B,iCAAiC,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/C,OAAO,IAAI,OAAO,CAAC;QACjB,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE;QAC3B,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI;QAC/B,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE;QAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;KACxE,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;SAC7B,WAAW,CAAC,QAAQ,CAAC;SACrB,iBAAiB,CAAC,QAAQ,GAAG,qBAAqB,CAAC;SACnD,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,QAAyB,EAAE,MAAwB;IACnE,OAAO,eAAe,CAAC;QACrB,QAAQ,CAAC,KAAK,CAAC,EAAE;QACjB,QAAQ,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI;QAC3B,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,MAAM,IAAI,IAAI;QACrB,MAAM,CAAC,QAAQ,IAAI,IAAI;QACvB,MAAM,CAAC,QAAQ,IAAI,IAAI;KACxB,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;IACzC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACxB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;SACnE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB,CACxB,KAAc,EACd,WAAmB;IAEnB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,cAAc,WAAW,gCAAgC,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,KAG9B,CAAC;IACF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,cAAc,WAAW,sCAAsC,CAChE,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAA2B,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,cAAc,WAAW,YAAY,IAAI,qBAAqB,CAC/D,CAAC;QACJ,CAAC;QACD,iBAAiB,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC;IACxC,CAAC;IACD,MAAM,MAAM,GAAuB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAClE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,cAAc,WAAW,uCAAuC,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/runtime/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE/B,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAS9B,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAEvE;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GAAG,2BAA2B,CAAC;AAEzE,iEAAiE;AACjE,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAwCjC,kEAAkE;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACxD,kDAAkD;AAClD,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IAIP,YAAY;IACZ,UAAU;IAJZ,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEzD,YACmB,YAAY,GAAW,yBAAyB,EAChD,UAAU,GAAW,4BAA4B;4BADjD,YAAY;0BACZ,UAAU;IAC1B,CAAC;IAEJ,GAAG,CAAC,GAAW,EAAE,KAAa;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,KAAK,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC;IAED,GAAG,CACD,GAAW,EACX,KAAyB,EACzB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;QAE1B,IAAI,WAAmB,CAAC;QACxB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3C,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM;gBACR,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAC;AAE3C,2DAA2D;AAC3D,MAAM,UAAU,4BAA4B;IAC1C,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAmB,EACnB,QAAqC,EACrC,IAA8B,EAC9B,KAAK,GAAoB,YAAY;IAErC,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC3D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAmB;QAC/B,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK;QAC3B,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACpC,aAAa,EAAE,IAAI,EAAE,aAAa,IAAI,oBAAoB;KAC3D,CAAC;IACF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO;YACvB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,sEAAsE;oBACpE,6BAA6B,CAChC,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC3C,IAAI,GAAG,EAAE,CAAC;oBACR,OAAO,GAAG,CAAC;gBACb,CAAC;YACH,CAAC;YACD,2EAA2E;YAC3E,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACpB,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAmB,EACnB,QAAyB,EACzB,MAAwB,EACxB,IAAoB;IAEpB,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CACf,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,EAC7B,QAAQ,EACR,MAAM,EACN,IAAI,EACJ,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CACrB,KAAqD,EACrD,MAAwB;IAExB,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC;QAC7C,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;QACpB,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,4DAA4D,MAAM,CAAC,IAAI,KAAK;YAC1E,uBAAuB,UAAU,GAAG,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAAgC,EAChC,QAAyB,EACzB,MAAwB,EACxB,IAAoB,EACpB,KAAqD;IAErD,MAAM,KAAK,GAAG,0BAA0B,CAAC,KAAK,CAAC;QAC7C,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,iBAAiB,MAAM,CAAC,IAAI,GAAG,CAAC;IACpC,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACxB,OAAO,iBAAiB,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7D,OAAO,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAW,EACX,SAAiB,EACjB,IAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,SAAS,EAAE;SACrC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;KACpC,EACD,wBAAwB,EACxB,IAAI,CAAC,KAAK,CACX,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,sCAAsC,GAAG,cAAc,QAAQ,CAAC,MAAM,GAAG,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,YAAY,GAAG,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,QAAyB,EACzB,MAAwB;IAExB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,8DAA8D;YAC5D,GAAG,6BAA6B,iCAAiC,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/C,OAAO,IAAI,OAAO,CAAC;QACjB,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE;QACzB,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI;QAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;KACxE,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;SAC5B,WAAW,CAAC,QAAQ,CAAC;SACrB,iBAAiB,CAAC,QAAQ,GAAG,qBAAqB,CAAC;SACnD,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,QAAyB,EAAE,MAAwB;IACnE,OAAO,eAAe,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE;QAChB,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,MAAM,IAAI,IAAI;QACrB,MAAM,CAAC,QAAQ,IAAI,IAAI;QACvB,MAAM,CAAC,QAAQ,IAAI,IAAI;KACxB,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;IACzC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACxB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;SACnE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB,CACxB,KAAc,EACd,WAAmB;IAEnB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,cAAc,WAAW,gCAAgC,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,KAG9B,CAAC;IACF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,cAAc,WAAW,sCAAsC,CAChE,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAA2B,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,cAAc,WAAW,YAAY,IAAI,qBAAqB,CAC/D,CAAC;QACJ,CAAC;QACD,iBAAiB,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC;IACxC,CAAC;IACD,MAAM,MAAM,GAAuB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAClE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,cAAc,WAAW,uCAAuC,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/runtime/http.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Bounded outbound HTTP for the managed runtime.
+ *
+ * Node's `fetch` has no default timeout, so a peer that accepts the connection
+ * and never responds pins the caller forever. On the auth path that turns one
+ * hung IdP into a fully unavailable deployment: every request parks in token
+ * verification holding a request slot, and the fail-closed 401 never runs.
+ *
+ * Every outbound call in this package goes through {@link fetchWithTimeout}.
+ * Budgets mirror the Python runtime so the two stay behavior-compatible.
+ */
+/**
+ * Auth/authz-path calls: OIDC discovery, token introspection, thread-ownership
+ * proof. Mirrors `_validated_token.py` (`timeout=10`).
+ */
+export declare const AUTH_HTTP_TIMEOUT_MS = 10000;
+/**
+ * Provider egress: Slack/GitHub APIs, OAuth code exchange, credential
+ * token exchange. Mirrors the Python runtime's `timeout=30`.
+ */
+export declare const PROVIDER_HTTP_TIMEOUT_MS = 30000;
+/**
+ * Remote JWKS fetches performed inside `jose`. Passed explicitly to
+ * `createRemoteJWKSet` rather than relying on the library default.
+ */
+export declare const JWKS_HTTP_TIMEOUT_MS = 5000;
+/**
+ * `fetch` with a hard wall-clock budget.
+ *
+ * The request is aborted with a `TimeoutError` once `timeoutMs` elapses; a
+ * caller-supplied `init.signal` still aborts as usual.
+ *
+ * The budget spans the whole exchange, body included: a peer that sends headers
+ * and then stalls rejects at `response.json()`/`.text()`, *after* this call has
+ * already resolved. Callers that map a network failure to a specific status must
+ * put the body read under the same mapping, or a stalled body takes a different
+ * path than a stalled connection.
+ *
+ * @param input - Request URL.
+ * @param init - Request init, or `undefined`.
+ * @param timeoutMs - Abort budget in milliseconds.
+ * @param fetchImpl - Fetch override (tests, or an injected transport).
+ * @returns The response, or a rejection once the budget elapses.
+ */
+export declare function fetchWithTimeout(input: string | URL, init: RequestInit | undefined, timeoutMs: number, fetchImpl?: typeof fetch): Promise<Response>;
+//# sourceMappingURL=http.d.ts.map

package/dist/runtime/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/runtime/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C;;;GAGG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,oBAAoB,OAAQ,CAAC;AAE1C;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,GAAG,GAAG,EACnB,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,QAAQ,CAAC,CAOnB"}

package/dist/runtime/http.js

@@ -0,0 +1,53 @@
+/**
+ * Bounded outbound HTTP for the managed runtime.
+ *
+ * Node's `fetch` has no default timeout, so a peer that accepts the connection
+ * and never responds pins the caller forever. On the auth path that turns one
+ * hung IdP into a fully unavailable deployment: every request parks in token
+ * verification holding a request slot, and the fail-closed 401 never runs.
+ *
+ * Every outbound call in this package goes through {@link fetchWithTimeout}.
+ * Budgets mirror the Python runtime so the two stay behavior-compatible.
+ */
+/**
+ * Auth/authz-path calls: OIDC discovery, token introspection, thread-ownership
+ * proof. Mirrors `_validated_token.py` (`timeout=10`).
+ */
+export const AUTH_HTTP_TIMEOUT_MS = 10_000;
+/**
+ * Provider egress: Slack/GitHub APIs, OAuth code exchange, credential
+ * token exchange. Mirrors the Python runtime's `timeout=30`.
+ */
+export const PROVIDER_HTTP_TIMEOUT_MS = 30_000;
+/**
+ * Remote JWKS fetches performed inside `jose`. Passed explicitly to
+ * `createRemoteJWKSet` rather than relying on the library default.
+ */
+export const JWKS_HTTP_TIMEOUT_MS = 5_000;
+/**
+ * `fetch` with a hard wall-clock budget.
+ *
+ * The request is aborted with a `TimeoutError` once `timeoutMs` elapses; a
+ * caller-supplied `init.signal` still aborts as usual.
+ *
+ * The budget spans the whole exchange, body included: a peer that sends headers
+ * and then stalls rejects at `response.json()`/`.text()`, *after* this call has
+ * already resolved. Callers that map a network failure to a specific status must
+ * put the body read under the same mapping, or a stalled body takes a different
+ * path than a stalled connection.
+ *
+ * @param input - Request URL.
+ * @param init - Request init, or `undefined`.
+ * @param timeoutMs - Abort budget in milliseconds.
+ * @param fetchImpl - Fetch override (tests, or an injected transport).
+ * @returns The response, or a rejection once the budget elapses.
+ */
+export function fetchWithTimeout(input, init, timeoutMs, fetchImpl = fetch) {
+    const timeout = AbortSignal.timeout(timeoutMs);
+    const caller = init?.signal;
+    return fetchImpl(input, {
+        ...init,
+        signal: caller ? AbortSignal.any([caller, timeout]) : timeout,
+    });
+}
+//# sourceMappingURL=http.js.map

package/dist/runtime/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/runtime/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAmB,EACnB,IAA6B,EAC7B,SAAiB,EACjB,SAAS,GAAiB,KAAK;IAE/B,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;IAC5B,OAAO,SAAS,CAAC,KAAK,EAAE;QACtB,GAAG,IAAI;QACP,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO;KAC9D,CAAC,CAAC;AACL,CAAC"}

package/dist/runtime/identity-http.d.ts

@@ -1,39 +1,32 @@
 import { Hono } from "hono";
 import type { IdentityDefinition } from "../identity/index.js";
-import type { ChannelManifest } from "../channels/manifest.js";
-import type { Connector } from "./connector.js";
+import type { Channel } from "./channel.js";
+import type { Connector, ConnectorRequirements } from "./connector.js";
 /** Inputs the managed HTTP app is built from. */
 export interface ManagedHttpAppInputs {
     /** The declared identity, if the project opts into managed identity. */
     identity?: IdentityDefinition;
-    /** Discovered connectors; those implementing `http` mount routes. */
+    /** Discovered connectors; those implementing hooks mount routes / messaging. */
     connectors?: Connector[];
-    /**
-     * Channel manifests (optional when {@link channelDefinitions} is present).
-     * Prefer live definitions — manifests are derived via `toManifest`.
-     */
-    channels?: Record<string, ChannelManifest>;
-    /**
-     * Live channel declarations from `_mda_channels`. Keyed by file-stem name.
-     * When set, adapters are registered and manifests are derived from each
-     * branded definition's `toManifest`.
-     */
-    channelDefinitions?: Record<string, unknown>;
+    /** Discovered channels; Events mount under `/channels/{name}/events`. */
+    channels?: Channel[];
 }
 /**
  * Build the single managed HTTP app mounted via `langgraph.json` `http.app`.
  *
- * It layers two concerns onto the built-in LangGraph routes:
- *  - **identity** — public guest issuance (`POST /identity/guest`) when the
- *    declared identity enables a guest provider;
- *  - **connectors** — each connector implementing `http` gets a sub-router
- *    namespaced under `/connectors/{kind}` and mounts its own routes.
+ * It layers onto the built-in LangGraph routes:
+ *  - **channels** — each channel mounts public Events at `/channels/{name}/events`
+ *    and may register outbound messaging;
+ *  - **connectors** — each connector gets a sub-router namespaced under
+ *    `/connectors/{name}`; `events` mounts connector Events (e.g. GitHub);
+ *    `http` mounts additional secured/public routes.
  *
  * Connector routes are **secure by default**: MDA resolves and enforces the
  * caller's identity before the handler runs, and a route must opt out of
- * authentication explicitly (`router.public.*`). The connector HTTP surface is
+ * authentication explicitly (`router.public.*`). The managed HTTP surface is
  * logged at construction so the (especially unauthenticated) routes are never
  * invisible.
  */
 export declare function buildManagedHttpApp(inputs: ManagedHttpAppInputs): Hono;
+export type { ConnectorRequirements };
 //# sourceMappingURL=identity-http.d.ts.map

package/dist/runtime/identity-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-http.d.ts","sourceRoot":"","sources":["../../src/runtime/identity-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EAAkB,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAK/D,OAAO,KAAK,EACV,SAAS,EAKV,MAAM,gBAAgB,CAAC;AAUxB,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,qEAAqE;IACrE,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC3C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9C;AAuBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAmCtE"}
+{"version":3,"file":"identity-http.d.ts","sourceRoot":"","sources":["../../src/runtime/identity-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAkB,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAsB/E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,KAAK,EACV,SAAS,EACT,qBAAqB,EAKtB,MAAM,gBAAgB,CAAC;AAUxB,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,gFAAgF;IAChF,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;CACtB;AA2BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CA2EtE;AAwRD,YAAY,EAAE,qBAAqB,EAAE,CAAC"}