managed-deepagents 0.4.2 → 0.5.0-dev.77

package/dist/channels/collect.d.ts

@@ -1,11 +1,8 @@
 /**
  * Collect validated channel declarations from discovered `channels/` modules.
  *
- * Mirrors {@link collectConnectors}: each module should export a named branded
- * {@link ChannelDefinition}. Modules without that export (or with a non-branded
- * value) are skipped — the CLI already omits files without `export const
- * channel`, and this keeps helpers / mistaken bindings from crashing startup.
- * Adapters are registered during collect.
+ * Mirrors {@link collectConnectors}: each module must export a named branded
+ * {@link ChannelDefinition}. Adapters are registered during collect.
  */
 import { type ChannelDefinition } from "./plugin.js";
 export interface ChannelModuleEntry {

package/dist/channels/collect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collect.d.ts","sourceRoot":"","sources":["../../src/channels/collect.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAG1E,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,MAAM,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;CACvD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,kBAAkB,EAAE,GACrC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAmBnC"}
+{"version":3,"file":"collect.d.ts","sourceRoot":"","sources":["../../src/channels/collect.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAG1E,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,MAAM,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;CACvD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,kBAAkB,EAAE,GACrC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CA4BnC"}

package/dist/channels/collect.js

@@ -1,11 +1,8 @@
 /**
  * Collect validated channel declarations from discovered `channels/` modules.
  *
- * Mirrors {@link collectConnectors}: each module should export a named branded
- * {@link ChannelDefinition}. Modules without that export (or with a non-branded
- * value) are skipped — the CLI already omits files without `export const
- * channel`, and this keeps helpers / mistaken bindings from crashing startup.
- * Adapters are registered during collect.
+ * Mirrors {@link collectConnectors}: each module must export a named branded
+ * {@link ChannelDefinition}. Adapters are registered during collect.
  */
 import { isChannelDefinition } from "./plugin.js";
 import { registerChannelAdapter } from "./registry-store.js";
@@ -18,10 +15,17 @@ export function collectChannels(entries) {
     const out = {};
     for (const entry of entries) {
         const channel = entry.module.channel;
-        if (channel === undefined ||
-            channel === null ||
-            !isChannelDefinition(channel)) {
-            continue;
+        if (channel === undefined || channel === null) {
+            throw new Error(`${entry.source} defines no \`channel\` export. A file under channels/ ` +
+                "must export exactly one branded channel as `channel` " +
+                "(e.g. `export const channel = defineGitHubChannel(...)` or a " +
+                "third-party `defineXChannel` that returns defineChannel(...)).");
+        }
+        if (!isChannelDefinition(channel)) {
+            throw new Error(`${entry.source} export \`channel\` is not a branded ChannelDefinition. ` +
+                "The define* helper must return an object with CHANNEL_BRAND, " +
+                "provider, adapter, toManifest, and config " +
+                "(use defineChannel(...) from managed-deepagents/channels).");
         }
         const name = channelStemName(entry.source);
         if (out[name] !== undefined) {

package/dist/channels/collect.js.map

@@ -1 +1 @@
-{"version":3,"file":"collect.js","sourceRoot":"","sources":["../../src/channels/collect.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,mBAAmB,EAA0B,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAS7D;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAsC;IAEtC,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;QACrC,IACE,OAAO,KAAK,SAAS;YACrB,OAAO,KAAK,IAAI;YAChB,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAC7B,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,kBAAkB,CAAC,CAAC;QACrE,CAAC;QACD,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,yBAAyB,MAAM,4CAA4C,CAC5E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"collect.js","sourceRoot":"","sources":["../../src/channels/collect.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,mBAAmB,EAA0B,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAS7D;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAsC;IAEtC,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;QACrC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,MAAM,yDAAyD;gBACtE,uDAAuD;gBACvD,+DAA+D;gBAC/D,gEAAgE,CACnE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,MAAM,0DAA0D;gBACvE,+DAA+D;gBAC/D,4CAA4C;gBAC5C,4DAA4D,CAC/D,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,kBAAkB,CAAC,CAAC;QACrE,CAAC;QACD,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,yBAAyB,MAAM,4CAA4C,CAC5E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/connectors/arcade/index.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Arcade managed connector — tools egress via Arcade MCP gateways.
+ *
+ * Parallel to managed Slack channels (ingress). Authors declare which Arcade
+ * gateways the agent should use; MDA binds them at deploy time (Phase B) and
+ * loads tools over MCP. Manual install is an escape hatch that reuses the
+ * existing MCP connector stack with BYO URL/headers.
+ *
+ * Tool filters are per-gateway only (raw MCP tool names, before any managed
+ * `{server}__` prefix). There is no root-level include/exclude and no
+ * catch-all `defineConnections` API.
+ *
+ * @example Managed (default)
+ * ```ts
+ * // connectors/arcade.ts
+ * import { defineArcadeConnector } from "managed-deepagents/connectors/arcade";
+ *
+ * export default defineArcadeConnector({
+ *   install: "managed",
+ *   gateways: {
+ *     notion: {},
+ *     gmail: { includeTools: ["SendEmail", "ListThreads"] },
+ *   },
+ * });
+ * ```
+ *
+ * @example Manual
+ * ```ts
+ * export default defineArcadeConnector({
+ *   install: "manual",
+ *   mcpServers: {
+ *     custom: {
+ *       transport: "http",
+ *       url: "https://api.arcade.dev/mcp/my-gateway",
+ *       includeTools: ["SendEmail"],
+ *       headers: { Authorization: `Bearer ${process.env.ARCADE_API_KEY}` },
+ *     },
+ *   },
+ * });
+ * ```
+ */
+import { type Connector } from "../../runtime/connector.js";
+import { type McpToolSelectionConfig, type RemoteMcpServerConfig } from "../mcp/index.js";
+/** How Arcade tools are installed into the agent. Defaults to `"managed"`. */
+export type ArcadeInstallMode = "managed" | "manual";
+/**
+ * Per-gateway tool selection for managed install. Names are raw, unprefixed
+ * MCP tool names (same semantics as {@link McpToolSelectionConfig}).
+ */
+export type ArcadeGatewayConfig = McpToolSelectionConfig;
+/** Configuration accepted by {@link defineArcadeConnector}. */
+export type ArcadeConnectorConfig = ArcadeManagedConnectorConfig | ArcadeManualConnectorConfig;
+/** Managed install: declare Arcade gateway slugs; MDA binds them at deploy. */
+export interface ArcadeManagedConnectorConfig {
+    /**
+     * Managed install (default). Resolves workspace Arcade gateways via Fleet
+     * during deploy (Phase B). Rejects `mcpServers`.
+     */
+    install?: "managed";
+    /**
+     * Arcade gateway slug → optional tool filters.
+     *
+     * Omit or leave empty to mean “all workspace Arcade gateways” once deploy
+     * binding has injected `MDA_ARCADE_GATEWAYS`.
+     */
+    gateways?: Record<string, ArcadeGatewayConfig>;
+    /**
+     * Allow agent-scoped Arcade OAuth (shared grant for the deployment).
+     *
+     * Default `false`. Required when identity uses `scoping.credentials: "agent"`
+     * (e.g. shared-bot) so channel actors never silently share one Arcade token.
+     * Prefer `credentials: "actor"` for per-user Arcade.
+     */
+    allowAgentScopedCredentials?: boolean;
+    /** Not allowed with `install: "managed"`. */
+    mcpServers?: never;
+}
+/** Manual install: BYO MCP server URLs/headers via the existing MCP stack. */
+export interface ArcadeManualConnectorConfig {
+    install: "manual";
+    /**
+     * Remote MCP servers (same shape as {@link defineMcpServers}). Required for
+     * manual install. Rejects `gateways`.
+     */
+    mcpServers: Record<string, RemoteMcpServerConfig>;
+    /** Not allowed with `install: "manual"`. */
+    gateways?: never;
+    prefixToolNameWithServerName?: boolean;
+    throwOnLoadError?: boolean;
+    useStandardContentBlocks?: boolean;
+    onConnectionError?: "throw";
+}
+/**
+ * The connector exported from a `connectors/arcade` module. Branded managed
+ * {@link Connector} whose `tools` hook loads Arcade (or BYO MCP) tools.
+ */
+export interface ArcadeConnectorDefinition extends Connector {
+    readonly kind: "arcade";
+    readonly install: ArcadeInstallMode;
+    readonly gateways?: Record<string, ArcadeGatewayConfig>;
+    readonly allowAgentScopedCredentials?: boolean;
+    readonly mcpServers?: Record<string, RemoteMcpServerConfig>;
+    readonly prefixToolNameWithServerName?: boolean;
+    readonly throwOnLoadError?: boolean;
+    readonly useStandardContentBlocks?: boolean;
+    readonly onConnectionError?: "throw";
+}
+export { MANAGED_ARCADE_TOOLS_UNAVAILABLE } from "./load.js";
+/**
+ * Declare Arcade gateways (managed) or BYO MCP servers (manual) whose tools
+ * should be loaded into the managed Deep Agent.
+ *
+ * Validates eagerly so misconfiguration surfaces at module load.
+ */
+export declare function defineArcadeConnector(config?: ArcadeConnectorConfig): ArcadeConnectorDefinition;
+//# sourceMappingURL=index.d.ts.map

package/dist/connectors/arcade/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/connectors/arcade/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAEL,KAAK,SAAS,EAEf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AAEzB,8EAA8E;AAC9E,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAEzD,+DAA+D;AAC/D,MAAM,MAAM,qBAAqB,GAC7B,4BAA4B,GAC5B,2BAA2B,CAAC;AAEhC,+EAA+E;AAC/E,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC/C;;;;;;OAMG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,6CAA6C;IAC7C,UAAU,CAAC,EAAE,KAAK,CAAC;CACpB;AAED,8EAA8E;AAC9E,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,QAAQ,CAAC;IAClB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAClD,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,yBAA0B,SAAQ,SAAS;IAC1D,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACxD,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAC;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC5D,QAAQ,CAAC,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAChD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAED,OAAO,EAAE,gCAAgC,EAAE,MAAM,WAAW,CAAC;AAE7D;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,GAAE,qBAA0B,GACjC,yBAAyB,CAsF3B"}

package/dist/connectors/arcade/index.js

@@ -0,0 +1,177 @@
+/**
+ * Arcade managed connector — tools egress via Arcade MCP gateways.
+ *
+ * Parallel to managed Slack channels (ingress). Authors declare which Arcade
+ * gateways the agent should use; MDA binds them at deploy time (Phase B) and
+ * loads tools over MCP. Manual install is an escape hatch that reuses the
+ * existing MCP connector stack with BYO URL/headers.
+ *
+ * Tool filters are per-gateway only (raw MCP tool names, before any managed
+ * `{server}__` prefix). There is no root-level include/exclude and no
+ * catch-all `defineConnections` API.
+ *
+ * @example Managed (default)
+ * ```ts
+ * // connectors/arcade.ts
+ * import { defineArcadeConnector } from "managed-deepagents/connectors/arcade";
+ *
+ * export default defineArcadeConnector({
+ *   install: "managed",
+ *   gateways: {
+ *     notion: {},
+ *     gmail: { includeTools: ["SendEmail", "ListThreads"] },
+ *   },
+ * });
+ * ```
+ *
+ * @example Manual
+ * ```ts
+ * export default defineArcadeConnector({
+ *   install: "manual",
+ *   mcpServers: {
+ *     custom: {
+ *       transport: "http",
+ *       url: "https://api.arcade.dev/mcp/my-gateway",
+ *       includeTools: ["SendEmail"],
+ *       headers: { Authorization: `Bearer ${process.env.ARCADE_API_KEY}` },
+ *     },
+ *   },
+ * });
+ * ```
+ */
+import { CONNECTOR_BRAND, } from "../../runtime/connector.js";
+import { defineMcpServers, } from "../mcp/index.js";
+export { MANAGED_ARCADE_TOOLS_UNAVAILABLE } from "./load.js";
+/**
+ * Declare Arcade gateways (managed) or BYO MCP servers (manual) whose tools
+ * should be loaded into the managed Deep Agent.
+ *
+ * Validates eagerly so misconfiguration surfaces at module load.
+ */
+export function defineArcadeConnector(config = {}) {
+    const provided = config;
+    const install = normalizeInstall(provided.install);
+    if (install === "managed") {
+        if ("mcpServers" in provided && provided.mcpServers !== undefined) {
+            throw new Error('defineArcadeConnector(...) with install: "managed" rejects ' +
+                "`mcpServers`. Use `gateways` for managed Arcade, or set " +
+                'install: "manual" for BYO MCP URLs.');
+        }
+        const gateways = provided.gateways;
+        if (gateways !== undefined) {
+            validateGateways(gateways);
+        }
+    }
+    else {
+        if ("gateways" in provided && provided.gateways !== undefined) {
+            throw new Error('defineArcadeConnector(...) with install: "manual" rejects ' +
+                "`gateways`. Pass `mcpServers` (same shape as defineMcpServers), " +
+                'or use install: "managed".');
+        }
+        if (provided.mcpServers === null ||
+            typeof provided.mcpServers !== "object" ||
+            Array.isArray(provided.mcpServers)) {
+            throw new Error('defineArcadeConnector(...) with install: "manual" requires an ' +
+                "`mcpServers` object mapping server names to remote MCP configs.");
+        }
+        // Reuse MCP validation (non-empty servers, transports, tool selectors).
+        defineMcpServers({
+            mcpServers: provided.mcpServers,
+            prefixToolNameWithServerName: provided.prefixToolNameWithServerName,
+            throwOnLoadError: provided.throwOnLoadError,
+            useStandardContentBlocks: provided.useStandardContentBlocks,
+            onConnectionError: provided.onConnectionError,
+        });
+    }
+    const definition = {
+        kind: "arcade",
+        install,
+        ...(install === "managed"
+            ? {
+                gateways: provided.gateways ?? {},
+                ...(provided.allowAgentScopedCredentials === true
+                    ? { allowAgentScopedCredentials: true }
+                    : {}),
+            }
+            : {
+                mcpServers: provided.mcpServers,
+                prefixToolNameWithServerName: provided.prefixToolNameWithServerName,
+                throwOnLoadError: provided.throwOnLoadError,
+                useStandardContentBlocks: provided.useStandardContentBlocks,
+                onConnectionError: provided.onConnectionError,
+            }),
+    };
+    Object.defineProperty(definition, CONNECTOR_BRAND, {
+        value: true,
+        enumerable: false,
+    });
+    Object.defineProperty(definition, "tools", {
+        value: async (ctx = {}) => {
+            const { loadArcadeTools } = await import("./load.js");
+            return loadArcadeTools(definition, ctx);
+        },
+        enumerable: false,
+    });
+    return definition;
+}
+function normalizeInstall(value) {
+    if (value === undefined) {
+        return "managed";
+    }
+    if (value === "managed" || value === "manual") {
+        return value;
+    }
+    throw new Error(`defineArcadeConnector(...) install must be "managed" or "manual"; got ${JSON.stringify(value)}.`);
+}
+function validateGateways(gateways) {
+    if (gateways === null ||
+        typeof gateways !== "object" ||
+        Array.isArray(gateways)) {
+        throw new Error("defineArcadeConnector(...) `gateways` must be an object mapping " +
+            "gateway slugs to optional tool-selection configs.");
+    }
+    for (const [name, gateway] of Object.entries(gateways)) {
+        if (typeof name !== "string" || name.trim().length === 0) {
+            throw new Error("defineArcadeConnector(...) gateway names must be non-empty strings.");
+        }
+        if (gateway === null ||
+            typeof gateway !== "object" ||
+            Array.isArray(gateway)) {
+            throw new Error(`Arcade gateway "${name}" must be a configuration object (use {} for all tools).`);
+        }
+        validateToolSelection(name, gateway);
+    }
+}
+function validateToolSelection(name, config) {
+    const includeTools = validateToolNameList(name, "includeTools", config.includeTools);
+    const excludeTools = validateToolNameList(name, "excludeTools", config.excludeTools);
+    if (!includeTools || !excludeTools) {
+        return;
+    }
+    const included = new Set(includeTools);
+    const conflicts = excludeTools.filter((toolName) => included.has(toolName));
+    if (conflicts.length > 0) {
+        throw new Error(`Arcade gateway "${name}" selects tool(s) in both \`includeTools\` and ` +
+            `\`excludeTools\`: ${conflicts.sort().join(", ")}.`);
+    }
+}
+function validateToolNameList(gatewayName, field, value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!Array.isArray(value)) {
+        throw new Error(`Arcade gateway "${gatewayName}" \`${field}\` must be an array of strings.`);
+    }
+    const seen = new Set();
+    for (const [index, item] of value.entries()) {
+        if (typeof item !== "string" || item.trim().length === 0) {
+            throw new Error(`Arcade gateway "${gatewayName}" \`${field}\` entry ${index} must be a non-empty string.`);
+        }
+        if (seen.has(item)) {
+            throw new Error(`Arcade gateway "${gatewayName}" \`${field}\` contains duplicate tool name "${item}".`);
+        }
+        seen.add(item);
+    }
+    return value;
+}
+//# sourceMappingURL=index.js.map

package/dist/connectors/arcade/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/connectors/arcade/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EACL,eAAe,GAGhB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,gBAAgB,GAIjB,MAAM,iBAAiB,CAAC;AA0EzB,OAAO,EAAE,gCAAgC,EAAE,MAAM,WAAW,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAM,GAA0B,EAAE;IAElC,MAAM,QAAQ,GAAG,MAAiC,CAAC;IACnD,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEnD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,YAAY,IAAI,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,6DAA6D;gBAC3D,0DAA0D;gBAC1D,qCAAqC,CACxC,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,UAAU,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CACb,4DAA4D;gBAC1D,kEAAkE;gBAClE,4BAA4B,CAC/B,CAAC;QACJ,CAAC;QACD,IACE,QAAQ,CAAC,UAAU,KAAK,IAAI;YAC5B,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ;YACvC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAClC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gEAAgE;gBAC9D,iEAAiE,CACpE,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,gBAAgB,CAAC;YACf,UAAU,EAAE,QAAQ,CAAC,UAA4C;YACjE,4BAA4B,EAAE,QAAQ,CAAC,4BAE1B;YACb,gBAAgB,EAAE,QAAQ,CAAC,gBAAuC;YAClE,wBAAwB,EAAE,QAAQ,CAAC,wBAEtB;YACb,iBAAiB,EAAE,QAAQ,CAAC,iBAAwC;SACrE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG;QACjB,IAAI,EAAE,QAAQ;QACd,OAAO;QACP,GAAG,CAAC,OAAO,KAAK,SAAS;YACvB,CAAC,CAAC;gBACE,QAAQ,EACL,QAAQ,CAAC,QAAgD,IAAI,EAAE;gBAClE,GAAG,CAAC,QAAQ,CAAC,2BAA2B,KAAK,IAAI;oBAC/C,CAAC,CAAC,EAAE,2BAA2B,EAAE,IAAa,EAAE;oBAChD,CAAC,CAAC,EAAE,CAAC;aACR;YACH,CAAC,CAAC;gBACE,UAAU,EAAE,QAAQ,CAAC,UAGpB;gBACD,4BAA4B,EAC1B,QAAQ,CAAC,4BAAmD;gBAC9D,gBAAgB,EAAE,QAAQ,CAAC,gBAAuC;gBAClE,wBAAwB,EAAE,QAAQ,CAAC,wBAEtB;gBACb,iBAAiB,EAAE,QAAQ,CAAC,iBAAwC;aACrE,CAAC;KACsB,CAAC;IAE/B,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,eAAe,EAAE;QACjD,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,OAAO,EAAE;QACzC,KAAK,EAAE,KAAK,EAAE,GAAG,GAAgB,EAAE,EAAE,EAAE;YACrC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YACtD,OAAO,eAAe,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CACb,yEAAyE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAClG,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAiB;IACzC,IACE,QAAQ,KAAK,IAAI;QACjB,OAAO,QAAQ,KAAK,QAAQ;QAC5B,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,mDAAmD,CACtD,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAC1C,QAAmC,CACpC,EAAE,CAAC;QACF,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,IACE,OAAO,KAAK,IAAI;YAChB,OAAO,OAAO,KAAK,QAAQ;YAC3B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EACtB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,0DAA0D,CAClF,CAAC;QACJ,CAAC;QACD,qBAAqB,CAAC,IAAI,EAAE,OAAkC,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAY,EACZ,MAA+B;IAE/B,MAAM,YAAY,GAAG,oBAAoB,CACvC,IAAI,EACJ,cAAc,EACd,MAAM,CAAC,YAAY,CACpB,CAAC;IACF,MAAM,YAAY,GAAG,oBAAoB,CACvC,IAAI,EACJ,cAAc,EACd,MAAM,CAAC,YAAY,CACpB,CAAC;IAEF,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5E,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,iDAAiD;YACtE,qBAAqB,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,WAAmB,EACnB,KAAsC,EACtC,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,mBAAmB,WAAW,OAAO,KAAK,iCAAiC,CAC5E,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,mBAAmB,WAAW,OAAO,KAAK,YAAY,KAAK,8BAA8B,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,mBAAmB,WAAW,OAAO,KAAK,oCAAoC,IAAI,IAAI,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/connectors/arcade/load.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Arcade tool loading — manual MCP delegation + managed Phase C resolve.
+ *
+ * Managed mode uses a dedicated MCP client (not the generic process cache) so
+ * Authorization can be minted per tool call from runtime identity.
+ */
+import type { ToolContext } from "../../runtime/connector.js";
+import type { ArcadeConnectorDefinition } from "./index.js";
+import type { ArcadeManagedResolution } from "./resolve.js";
+/**
+ * Directed error when managed Arcade tools are requested without deploy
+ * binding (`MDA_ARCADE_GATEWAYS`). Do not invent fake tools.
+ */
+export declare const MANAGED_ARCADE_TOOLS_UNAVAILABLE: string;
+/**
+ * Optional resolver for managed Arcade gateways → MCP server configs.
+ *
+ * Default reads deploy-injected bindings. Tests can override via
+ * {@link setArcadeGatewayResolverForTests}.
+ */
+export interface ArcadeGatewayResolver {
+    resolve(definition: ArcadeConnectorDefinition): Promise<ArcadeManagedResolution>;
+}
+/** Override the managed gateway resolver. Test seam. */
+export declare function setArcadeGatewayResolverForTests(resolver: ArcadeGatewayResolver | undefined): void;
+/** Clear the managed Arcade tool cache. Test-only. */
+export declare function clearArcadeToolsCacheForTests(): void;
+/**
+ * Load tools for an Arcade connector.
+ *
+ * - `manual` → existing process-cached MCP loader
+ * - `managed` → deploy-bound resolve + per-call OAuth (Phase C)
+ */
+export declare function loadArcadeTools(definition: ArcadeConnectorDefinition, ctx?: ToolContext): Promise<unknown[]>;
+//# sourceMappingURL=load.d.ts.map

package/dist/connectors/arcade/load.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../../src/connectors/arcade/load.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAM9D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,gCAAgC,QAIkC,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,CACL,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACrC;AAaD,wDAAwD;AACxD,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,qBAAqB,GAAG,SAAS,GAC1C,IAAI,CAEN;AAKD,sDAAsD;AACtD,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD;AA6JD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,yBAAyB,EACrC,GAAG,GAAE,WAAgB,GACpB,OAAO,CAAC,OAAO,EAAE,CAAC,CAepB"}

package/dist/connectors/arcade/load.js

@@ -0,0 +1,160 @@
+/**
+ * Arcade tool loading — manual MCP delegation + managed Phase C resolve.
+ *
+ * Managed mode uses a dedicated MCP client (not the generic process cache) so
+ * Authorization can be minted per tool call from runtime identity.
+ */
+import { interrupt } from "@langchain/langgraph";
+import { buildRuntimeIdentity, resolveAmbientConfigurable, } from "../../runtime/identity-runtime.js";
+import { defineMcpServers } from "../mcp/index.js";
+import { resolveArcadeMintMode } from "./policy.js";
+/**
+ * Directed error when managed Arcade tools are requested without deploy
+ * binding (`MDA_ARCADE_GATEWAYS`). Do not invent fake tools.
+ */
+export const MANAGED_ARCADE_TOOLS_UNAVAILABLE = "Managed Arcade tools are not bound for this deployment. Configure Arcade in " +
+    "LangSmith (Fleet → Integrations → Arcade) and run `mda deploy` so MDA can " +
+    "install workspace gateways as Fleet MCP servers and inject " +
+    "MDA_ARCADE_GATEWAYS. See https://docs.langchain.com/langsmith/fleet/arcade.";
+async function defaultManagedResolver(definition) {
+    const { resolveManagedArcadeGateways } = await import("./resolve.js");
+    return resolveManagedArcadeGateways(definition);
+}
+let managedResolver = {
+    resolve: defaultManagedResolver,
+};
+/** Override the managed gateway resolver. Test seam. */
+export function setArcadeGatewayResolverForTests(resolver) {
+    managedResolver = resolver ?? { resolve: defaultManagedResolver };
+}
+/** Process-lifetime cache for managed Arcade tools (separate from generic MCP). */
+let cachedArcadeTools;
+/** Clear the managed Arcade tool cache. Test-only. */
+export function clearArcadeToolsCacheForTests() {
+    cachedArcadeTools = undefined;
+}
+function manualAsMcpDefinition(definition) {
+    if (definition.install !== "manual" || !definition.mcpServers) {
+        throw new Error('manual Arcade load requires install: "manual" with mcpServers.');
+    }
+    return defineMcpServers({
+        mcpServers: definition.mcpServers,
+        prefixToolNameWithServerName: definition.prefixToolNameWithServerName,
+        throwOnLoadError: definition.throwOnLoadError,
+        useStandardContentBlocks: definition.useStandardContentBlocks,
+        onConnectionError: definition.onConnectionError,
+    });
+}
+function withListingHeaders(mcp, tokenByProvider, providerByServer) {
+    const mcpServers = Object.fromEntries(Object.entries(mcp.mcpServers).map(([slug, server]) => {
+        const provider = providerByServer[slug];
+        const token = provider ? tokenByProvider.get(provider) : undefined;
+        if (!token) {
+            return [slug, server];
+        }
+        return [
+            slug,
+            {
+                ...server,
+                headers: {
+                    ...(server.headers ?? {}),
+                    Authorization: `Bearer ${token}`,
+                },
+            },
+        ];
+    }));
+    return { ...mcp, mcpServers };
+}
+function interruptIfAuthRequired(result) {
+    if (result.status === "completed" && result.token) {
+        return result.token;
+    }
+    if (result.status === "pending" ||
+        result.status === "connection_required" ||
+        result.status === "token_expired") {
+        // Fleet auth-format: pause the run so the user can complete OAuth.
+        interrupt({
+            auth_required: true,
+            ...(result.authUrl ? { auth_url: result.authUrl } : {}),
+            ...(result.authId ? { auth_id: result.authId } : {}),
+        });
+    }
+    throw new Error(`Managed Arcade OAuth is not ready (status=${result.status}). ` +
+        "Complete Arcade authorization and retry.");
+}
+async function mintAuthorizationHeader(options) {
+    const { authenticateArcadeOAuth } = await import("./resolve.js");
+    let userId;
+    if (options.mintMode === "actor") {
+        const identity = buildRuntimeIdentity(resolveAmbientConfigurable());
+        const actorId = identity?.actor?.id?.trim();
+        if (!actorId) {
+            throw new Error("Managed Arcade with actor-scoped credentials requires a resolved " +
+                "runtime identity (langgraph_auth_user). Refusing to fall back to a " +
+                "shared deploy-user Arcade token.");
+        }
+        userId = actorId;
+    }
+    const result = await authenticateArcadeOAuth({
+        provider: options.provider,
+        agentId: options.agentId,
+        userId,
+        checkOnly: false,
+        env: options.env,
+        fetch: options.fetch,
+    });
+    const token = interruptIfAuthRequired(result);
+    return { Authorization: `Bearer ${token}` };
+}
+async function loadManagedArcadeTools(definition, identityConfig) {
+    const mintMode = resolveArcadeMintMode(identityConfig, definition.allowAgentScopedCredentials);
+    const resolution = await managedResolver.resolve(definition);
+    const { mintArcadeOAuthToken } = await import("./resolve.js");
+    // Tool listing needs a bootstrap Authorization header. Use the agent /
+    // deploy-user grant authorized during `mda deploy` — never an actor token
+    // (no actor exists at graph-compile / process-cache time).
+    const listingTokens = new Map();
+    for (const provider of new Set(Object.values(resolution.providerByServer))) {
+        const token = await mintArcadeOAuthToken({
+            provider,
+            agentId: resolution.agentId,
+        });
+        listingTokens.set(provider, token);
+    }
+    const mcpWithListingAuth = withListingHeaders(resolution.mcp, listingTokens, resolution.providerByServer);
+    const { loadMcpToolsUncached } = await import("../mcp/load.js");
+    return loadMcpToolsUncached(mcpWithListingAuth, {
+        beforeToolCall: async ({ serverName }) => {
+            const provider = resolution.providerByServer[serverName];
+            if (!provider) {
+                throw new Error(`Managed Arcade tool call for unknown gateway "${serverName}".`);
+            }
+            const headers = await mintAuthorizationHeader({
+                mintMode,
+                provider,
+                agentId: resolution.agentId,
+            });
+            return { headers };
+        },
+    });
+}
+/**
+ * Load tools for an Arcade connector.
+ *
+ * - `manual` → existing process-cached MCP loader
+ * - `managed` → deploy-bound resolve + per-call OAuth (Phase C)
+ */
+export async function loadArcadeTools(definition, ctx = {}) {
+    if (definition.install === "manual") {
+        const { loadManagedMcpTools } = await import("../mcp/load.js");
+        return loadManagedMcpTools(manualAsMcpDefinition(definition));
+    }
+    if (!cachedArcadeTools) {
+        cachedArcadeTools = loadManagedArcadeTools(definition, ctx.identity).catch((error) => {
+            cachedArcadeTools = undefined;
+            throw error;
+        });
+    }
+    return cachedArcadeTools;
+}
+//# sourceMappingURL=load.js.map

package/dist/connectors/arcade/load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../../src/connectors/arcade/load.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAIjD,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAA6B,MAAM,iBAAiB,CAAC;AAE9E,OAAO,EAAE,qBAAqB,EAAuB,MAAM,aAAa,CAAC;AAGzE;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAC3C,8EAA8E;IAC9E,4EAA4E;IAC5E,6DAA6D;IAC7D,6EAA6E,CAAC;AAchF,KAAK,UAAU,sBAAsB,CACnC,UAAqC;IAErC,MAAM,EAAE,4BAA4B,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IACtE,OAAO,4BAA4B,CAAC,UAAU,CAAC,CAAC;AAClD,CAAC;AAED,IAAI,eAAe,GAA0B;IAC3C,OAAO,EAAE,sBAAsB;CAChC,CAAC;AAEF,wDAAwD;AACxD,MAAM,UAAU,gCAAgC,CAC9C,QAA2C;IAE3C,eAAe,GAAG,QAAQ,IAAI,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;AACpE,CAAC;AAED,mFAAmF;AACnF,IAAI,iBAAiD,CAAC;AAEtD,sDAAsD;AACtD,MAAM,UAAU,6BAA6B;IAC3C,iBAAiB,GAAG,SAAS,CAAC;AAChC,CAAC;AAED,SAAS,qBAAqB,CAC5B,UAAqC;IAErC,IAAI,UAAU,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,gBAAgB,CAAC;QACtB,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,4BAA4B,EAAE,UAAU,CAAC,4BAA4B;QACrE,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,wBAAwB,EAAE,UAAU,CAAC,wBAAwB;QAC7D,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CACzB,GAAyB,EACzB,eAAoC,EACpC,gBAAwC;IAExC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CACnC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;QACpD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxB,CAAC;QACD,OAAO;YACL,IAAI;YACJ;gBACE,GAAG,MAAM;gBACT,OAAO,EAAE;oBACP,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;oBACzB,aAAa,EAAE,UAAU,KAAK,EAAE;iBACjC;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IACF,OAAO,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,uBAAuB,CAAC,MAKhC;IACC,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClD,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IACD,IACE,MAAM,CAAC,MAAM,KAAK,SAAS;QAC3B,MAAM,CAAC,MAAM,KAAK,qBAAqB;QACvC,MAAM,CAAC,MAAM,KAAK,eAAe,EACjC,CAAC;QACD,mEAAmE;QACnE,SAAS,CAAC;YACR,aAAa,EAAE,IAAI;YACnB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,KAAK,CACb,6CAA6C,MAAM,CAAC,MAAM,KAAK;QAC7D,0CAA0C,CAC7C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,OAMtC;IACC,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IAEjE,IAAI,MAA0B,CAAC;IAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,mEAAmE;gBACjE,qEAAqE;gBACrE,kCAAkC,CACrC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,OAAO,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;QAC3C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM;QACN,SAAS,EAAE,KAAK;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC9C,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,UAAqC,EACrC,cAA0C;IAE1C,MAAM,QAAQ,GAAG,qBAAqB,CACpC,cAAc,EACd,UAAU,CAAC,2BAA2B,CACvC,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IAE9D,uEAAuE;IACvE,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,KAAK,MAAM,QAAQ,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC;YACvC,QAAQ;YACR,OAAO,EAAE,UAAU,CAAC,OAAO;SAC5B,CAAC,CAAC;QACH,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,kBAAkB,GAAG,kBAAkB,CAC3C,UAAU,CAAC,GAAG,EACd,aAAa,EACb,UAAU,CAAC,gBAAgB,CAC5B,CAAC;IAEF,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAChE,OAAO,oBAAoB,CAAC,kBAAkB,EAAE;QAC9C,cAAc,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;YACvC,MAAM,QAAQ,GAAG,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,iDAAiD,UAAU,IAAI,CAChE,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC;gBAC5C,QAAQ;gBACR,QAAQ;gBACR,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAqC,EACrC,GAAG,GAAgB,EAAE;IAErB,IAAI,UAAU,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC/D,OAAO,mBAAmB,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,iBAAiB,GAAG,sBAAsB,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CACxE,CAAC,KAAK,EAAE,EAAE;YACR,iBAAiB,GAAG,SAAS,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC"}

package/dist/connectors/arcade/policy.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Fail-closed credential policy for managed Arcade (Phase C).
+ *
+ * Actor-scoped Arcade maps `runtime.identity.actor.id` → host `user_id`.
+ * Agent-scoped Arcade (shared-bot / internal-tool / service presets) requires
+ * an explicit authoring opt-in so channel actors never silently share one grant.
+ */
+import type { IdentityConfig } from "../../identity/index.js";
+/** How managed Arcade mints host-backend OAuth tokens. */
+export type ArcadeMintMode = "actor" | "agent";
+export declare const AGENT_SCOPED_ARCADE_REQUIRES_OPT_IN: string;
+/**
+ * Resolve mint mode from the deployment identity + Arcade opt-in.
+ *
+ * - `credentials: "actor"` → per-actor `user_id` minting
+ * - `credentials: "agent" | "custom"` → agent mint only with explicit opt-in
+ * - `credentials: "none"` → rejected (Arcade needs an OAuth grant)
+ * - no identity / credentials unset → agent mint (single-user Phase B compat)
+ */
+export declare function resolveArcadeMintMode(identity: IdentityConfig | undefined, allowAgentScopedCredentials: boolean | undefined): ArcadeMintMode;
+//# sourceMappingURL=policy.d.ts.map

package/dist/connectors/arcade/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/connectors/arcade/policy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE9D,0DAA0D;AAC1D,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,CAAC;AAE/C,eAAO,MAAM,mCAAmC,QAMa,CAAC;AAE9D;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,cAAc,GAAG,SAAS,EACpC,2BAA2B,EAAE,OAAO,GAAG,SAAS,GAC/C,cAAc,CAuBhB"}

package/dist/connectors/arcade/policy.js

@@ -0,0 +1,40 @@
+/**
+ * Fail-closed credential policy for managed Arcade (Phase C).
+ *
+ * Actor-scoped Arcade maps `runtime.identity.actor.id` → host `user_id`.
+ * Agent-scoped Arcade (shared-bot / internal-tool / service presets) requires
+ * an explicit authoring opt-in so channel actors never silently share one grant.
+ */
+export const AGENT_SCOPED_ARCADE_REQUIRES_OPT_IN = "Managed Arcade with agent-scoped credentials requires " +
+    "`allowAgentScopedCredentials: true` on defineArcadeConnector(...). " +
+    "Without that opt-in, shared-bot / agent-scoped deployments would share one " +
+    "Arcade grant across all channel actors. Prefer an identity preset with " +
+    '`scoping.credentials: "actor"` (e.g. private-assistant), or set the opt-in ' +
+    "only when a single shared Arcade identity is intentional.";
+/**
+ * Resolve mint mode from the deployment identity + Arcade opt-in.
+ *
+ * - `credentials: "actor"` → per-actor `user_id` minting
+ * - `credentials: "agent" | "custom"` → agent mint only with explicit opt-in
+ * - `credentials: "none"` → rejected (Arcade needs an OAuth grant)
+ * - no identity / credentials unset → agent mint (single-user Phase B compat)
+ */
+export function resolveArcadeMintMode(identity, allowAgentScopedCredentials) {
+    const mode = identity?.scoping?.credentials;
+    if (mode === "actor") {
+        return "actor";
+    }
+    if (mode === "none") {
+        throw new Error('Managed Arcade rejects scoping.credentials: "none". Use "actor" ' +
+            '(recommended) or "agent" with allowAgentScopedCredentials: true.');
+    }
+    if (mode === "agent" || mode === "custom") {
+        if (!allowAgentScopedCredentials) {
+            throw new Error(AGENT_SCOPED_ARCADE_REQUIRES_OPT_IN);
+        }
+        return "agent";
+    }
+    // No identity declaration (or credentials unset): deploy-user / agent grant.
+    return "agent";
+}
+//# sourceMappingURL=policy.js.map