managed-deepagents 0.5.0-dev.78 → 0.5.0-dev.80

package/dist/runtime/connector.d.ts

@@ -1,19 +1,15 @@
 /**
  * The managed connector protocol.
  *
- * A connector is any object carrying {@link CONNECTOR_BRAND} that knows how to
- * contribute to a managed Deep Agent. Built-ins (MCP tools, LangSmith HTTP,
- * GitHub sandbox) implement the same interface with their own `kind` — nothing
- * about them is privileged at the protocol level.
- *
- * Discovery is name-agnostic: the CLI globs modules under `connectors/` that
- * `export default`, imports each default export, and hands them to
- * {@link collectConnectors}, which keeps branded connectors and skips the rest.
- * Entrypoints call the hooks they care about — the agent graph calls
- * {@link Connector.tools}, the managed HTTP app calls {@link Connector.http},
- * and sandbox provisioning calls {@link Connector.sandbox}.
+ * A connector is one integration with one external platform. It may contribute
+ * tools, HTTP routes, sandbox provisioning, inbound events, and/or a named
+ * messaging surface. Discovery is file-based: the CLI globs modules under
+ * `connectors/` that export a `connector`, imports each one, and hands them to
+ * {@link collectConnectors}, which stamps each with its file-stem `name`.
  */
 import type { SandboxBackendProtocolV2 } from "deepagents";
+import type { ChannelManifest } from "../channels/manifest.js";
+import type { ChannelTransport } from "../channels/runtime.js";
 import type { IdentityConfig, IdentityDefinition, RuntimeIdentity } from "../identity/index.js";
 import type { ManagedRunConfig } from "./types.js";
 /**
@@ -56,6 +52,30 @@ export interface HttpContext {
      */
     requireIdentity(request: Request): Promise<RuntimeIdentity>;
 }
+/**
+ * Context handed to {@link Connector.events} for the conventional public
+ * inbound route at `/connectors/{name}/events`.
+ */
+export interface EventsContext {
+    /** File-stem connector name (route segment). */
+    readonly name: string;
+    /** The inbound request. */
+    readonly request: Request;
+    /**
+     * Pre-read raw body when the HTTP framework may have consumed `request`
+     * (Hono mount passes `await c.req.text()`).
+     */
+    readonly rawBody?: string | Uint8Array;
+    /** The live connector instance (e.g. GitHub `prompt` callbacks). */
+    readonly connector: Connector;
+}
+/**
+ * Deploy/runtime requirements a connector declares.
+ *
+ * Generalizes the former channel manifest: required env, permissions, opaque
+ * provider config, and optional provider connection provisioning.
+ */
+export type ConnectorRequirements = ChannelManifest;
 /**
  * Context handed to {@link Connector.sandbox} when a managed sandbox is created
  * or reused for a thread. Connectors close over their own config and use
@@ -117,19 +137,37 @@ export type PublicRouteHandler = (request: Request) => Response | Promise<Respon
 export type ConnectorToolList = unknown[];
 /**
  * A managed connector. Implement at least one of {@link Connector.tools},
- * {@link Connector.http}, or {@link Connector.sandbox}; a connector implementing
- * none does nothing and is rejected by {@link collectConnectors}.
+ * {@link Connector.http}, {@link Connector.sandbox}, {@link Connector.events},
+ * {@link Connector.messaging}, or {@link Connector.requirements}; a connector
+ * implementing none does nothing and is rejected by {@link collectConnectors}.
  */
 export interface Connector {
     readonly [CONNECTOR_BRAND]: true;
-    /** Diagnostic label and HTTP mount namespace, e.g. `"mcp_servers"` or `"langsmith"`. */
+    /**
+     * Diagnostic / provider label (e.g. `"mcp_servers"`, `"langsmith"`, `"slack"`).
+     * HTTP mounts use {@link name}, not kind.
+     */
     readonly kind: string;
+    /**
+     * File-stem instance name, stamped by {@link collectConnectors}. Mount
+     * namespace and messaging address (`runtime.channel` / `deliverTo`).
+     */
+    readonly name?: string;
     /** Contribute tools during agent-graph construction. MCP implements this. */
     tools?(ctx: ToolContext): ConnectorToolList | Promise<ConnectorToolList>;
     /** Mount HTTP routes during managed-app construction. LangSmith implements this. */
     http?(ctx: HttpContext): void | Promise<void>;
     /** Provision/refresh sandbox state when a managed sandbox is created or reused. */
     sandbox?(ctx: SandboxContext): void | Promise<void>;
+    /**
+     * Handle `POST /connectors/{name}/events` (verify + normalize + ACK + work).
+     * Public by construction; provider signature verification is the adapter's job.
+     */
+    events?(ctx: EventsContext): Response | Promise<Response>;
+    /** Build outbound messaging transport for `runtime.channel` / schedule delivery. */
+    messaging?(env: NodeJS.ProcessEnv): ChannelTransport | undefined;
+    /** Deploy/runtime requirements (env, permissions, connection, provider config). */
+    requirements?(name: string): ConnectorRequirements;
 }
 /**
  * Run the `tools` hook of every connector that implements it and concatenate the
@@ -144,13 +182,20 @@ export declare function loadConnectorTools(connectors: readonly Connector[], ctx
 export declare function runConnectorSandboxHooks(connectors: readonly Connector[] | undefined, ctx: SandboxContext): Promise<void>;
 /** True when at least one connector implements {@link Connector.sandbox}. */
 export declare function hasSandboxConnectors(connectors: readonly Connector[] | undefined): boolean;
+/** True when any connector can start an ingress run via {@link Connector.events}. */
+export declare function hasIngressConnectors(connectors: readonly Connector[] | undefined): boolean;
+/**
+ * Build the requirements map (file-stem → manifest) from connectors that
+ * implement {@link Connector.requirements}.
+ */
+export declare function requirementsFromConnectors(connectors: readonly Connector[]): Record<string, ConnectorRequirements>;
 /** A discovered `connectors/` module paired with its source path for diagnostics. */
 export interface DiscoveredConnectorModule {
     /** Project-relative path of the module, used in error messages. */
     readonly source: string;
-    /** The imported module namespace; its default export is the connector. */
+    /** The imported module namespace; its `connector` export is the connector. */
     readonly module: {
-        default?: unknown;
+        connector?: unknown;
     } & Record<string, unknown>;
 }
 /** Narrow an arbitrary value to a {@link Connector} by its brand and hooks. */
@@ -158,13 +203,11 @@ export declare function isConnector(value: unknown): value is Connector;
 /**
  * Validate and collect the connectors discovered under `connectors/`.
  *
- * Each module should expose exactly one connector as its default export. Modules
- * with no default export, or whose default is not a branded connector, are
- * skipped — the CLI already omits files without `export default`, and this
- * keeps helpers / mistaken defaults from crashing startup. A branded connector
- * that implements no hooks is still a hard error (clearly intentional but
- * broken). Duplicate connector objects (re-exported from two modules) are
- * de-duplicated by identity.
+ * Each module should expose exactly one connector as `export const connector`.
+ * The file stem becomes the instance {@link Connector.name} (mount namespace and
+ * messaging address). Duplicate stems are a hard error. Modules with no such
+ * export, or whose `connector` is not branded, are skipped. A branded connector
+ * that implements no hooks is still a hard error.
  */
 export declare function collectConnectors(modules: readonly DiscoveredConnectorModule[]): Connector[];
 //# sourceMappingURL=connector.d.ts.map

package/dist/runtime/connector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connector.d.ts","sourceRoot":"","sources":["../../src/runtime/connector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,OAAO,MAAoC,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IACnC;;;;;;OAMG;IACH,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC7D;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,aAAa,CAAC;IAClD,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CACxC;AAED,sEAAsE;AACtE,MAAM,MAAM,uBAAuB,GAAG,IAAI,CACxC,wBAAwB,EACxB,SAAS,CACV,GACC,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,aAAa,CAAC,CAAC,CAAC;AAEzD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACvD,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACzD,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;CAClC;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACrD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACtD,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACrD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,eAAe,KACtB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElC,8EAA8E;AAC9E,MAAM,MAAM,kBAAkB,GAAG,CAC/B,OAAO,EAAE,OAAO,KACb,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElC,iFAAiF;AACjF,MAAM,MAAM,iBAAiB,GAAG,OAAO,EAAE,CAAC;AAE1C;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC;IACjC,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,KAAK,CAAC,CAAC,GAAG,EAAE,WAAW,GAAG,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzE,oFAAoF;IACpF,IAAI,CAAC,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,mFAAmF;IACnF,OAAO,CAAC,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,SAAS,SAAS,EAAE,EAChC,GAAG,GAAE,WAAgB,GACpB,OAAO,CAAC,OAAO,EAAE,CAAC,CAQpB;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAC5C,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,GAC3C,OAAO,CAIT;AAED,qFAAqF;AACrF,MAAM,WAAW,yBAAyB;IACxC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClE;AAED,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAM9D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,SAAS,yBAAyB,EAAE,GAC5C,SAAS,EAAE,CA2Bb"}
+{"version":3,"file":"connector.d.ts","sourceRoot":"","sources":["../../src/runtime/connector.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,OAAO,MAAoC,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IACnC;;;;;;OAMG;IACH,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC7D;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2BAA2B;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IACvC,oEAAoE;IACpE,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAEpD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,aAAa,CAAC;IAClD,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CACxC;AAED,sEAAsE;AACtE,MAAM,MAAM,uBAAuB,GAAG,IAAI,CACxC,wBAAwB,EACxB,SAAS,CACV,GACC,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,aAAa,CAAC,CAAC,CAAC;AAEzD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACvD,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACzD,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;CAClC;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACrD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACtD,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACrD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,eAAe,KACtB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElC,8EAA8E;AAC9E,MAAM,MAAM,kBAAkB,GAAG,CAC/B,OAAO,EAAE,OAAO,KACb,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElC,iFAAiF;AACjF,MAAM,MAAM,iBAAiB,GAAG,OAAO,EAAE,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,KAAK,CAAC,CAAC,GAAG,EAAE,WAAW,GAAG,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzE,oFAAoF;IACpF,IAAI,CAAC,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,mFAAmF;IACnF,OAAO,CAAC,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;OAGG;IACH,MAAM,CAAC,CAAC,GAAG,EAAE,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1D,oFAAoF;IACpF,SAAS,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,gBAAgB,GAAG,SAAS,CAAC;IACjE,mFAAmF;IACnF,YAAY,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,CAAC;CACpD;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,SAAS,SAAS,EAAE,EAChC,GAAG,GAAE,WAAgB,GACpB,OAAO,CAAC,OAAO,EAAE,CAAC,CAQpB;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAC5C,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,GAC3C,OAAO,CAIT;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,GAC3C,OAAO,CAIT;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,SAAS,SAAS,EAAE,GAC/B,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CASvC;AAED,qFAAqF;AACrF,MAAM,WAAW,yBAAyB;IACxC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpE;AAED,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAM9D;AAaD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,SAAS,yBAAyB,EAAE,GAC5C,SAAS,EAAE,CAoCb"}

package/dist/runtime/connector.js

@@ -1,17 +1,11 @@
 /**
  * The managed connector protocol.
  *
- * A connector is any object carrying {@link CONNECTOR_BRAND} that knows how to
- * contribute to a managed Deep Agent. Built-ins (MCP tools, LangSmith HTTP,
- * GitHub sandbox) implement the same interface with their own `kind` — nothing
- * about them is privileged at the protocol level.
- *
- * Discovery is name-agnostic: the CLI globs modules under `connectors/` that
- * `export default`, imports each default export, and hands them to
- * {@link collectConnectors}, which keeps branded connectors and skips the rest.
- * Entrypoints call the hooks they care about — the agent graph calls
- * {@link Connector.tools}, the managed HTTP app calls {@link Connector.http},
- * and sandbox provisioning calls {@link Connector.sandbox}.
+ * A connector is one integration with one external platform. It may contribute
+ * tools, HTTP routes, sandbox provisioning, inbound events, and/or a named
+ * messaging surface. Discovery is file-based: the CLI globs modules under
+ * `connectors/` that export a `connector`, imports each one, and hands them to
+ * {@link collectConnectors}, which stamps each with its file-stem `name`.
  */
 /**
  * Realm-global brand marking a value as a managed connector. `Symbol.for` keeps
@@ -48,6 +42,24 @@ export async function runConnectorSandboxHooks(connectors, ctx) {
 export function hasSandboxConnectors(connectors) {
     return (connectors ?? []).some((connector) => typeof connector.sandbox === "function");
 }
+/** True when any connector can start an ingress run via {@link Connector.events}. */
+export function hasIngressConnectors(connectors) {
+    return (connectors ?? []).some((connector) => typeof connector.events === "function");
+}
+/**
+ * Build the requirements map (file-stem → manifest) from connectors that
+ * implement {@link Connector.requirements}.
+ */
+export function requirementsFromConnectors(connectors) {
+    const out = {};
+    for (const connector of connectors) {
+        if (typeof connector.requirements !== "function" || !connector.name) {
+            continue;
+        }
+        out[connector.name] = connector.requirements(connector.name);
+    }
+    return out;
+}
 /** Narrow an arbitrary value to a {@link Connector} by its brand and hooks. */
 export function isConnector(value) {
     if (typeof value !== "object" || value === null) {
@@ -56,37 +68,61 @@ export function isConnector(value) {
     const branded = value[CONNECTOR_BRAND];
     return branded === true;
 }
+function connectorHasHook(connector) {
+    return (typeof connector.tools === "function" ||
+        typeof connector.http === "function" ||
+        typeof connector.sandbox === "function" ||
+        typeof connector.events === "function" ||
+        typeof connector.messaging === "function" ||
+        typeof connector.requirements === "function");
+}
 /**
  * Validate and collect the connectors discovered under `connectors/`.
  *
- * Each module should expose exactly one connector as its default export. Modules
- * with no default export, or whose default is not a branded connector, are
- * skipped — the CLI already omits files without `export default`, and this
- * keeps helpers / mistaken defaults from crashing startup. A branded connector
- * that implements no hooks is still a hard error (clearly intentional but
- * broken). Duplicate connector objects (re-exported from two modules) are
- * de-duplicated by identity.
+ * Each module should expose exactly one connector as `export const connector`.
+ * The file stem becomes the instance {@link Connector.name} (mount namespace and
+ * messaging address). Duplicate stems are a hard error. Modules with no such
+ * export, or whose `connector` is not branded, are skipped. A branded connector
+ * that implements no hooks is still a hard error.
  */
 export function collectConnectors(modules) {
     const collected = [];
-    const seen = new Set();
+    const seenObjects = new Set();
+    const seenNames = new Set();
     for (const { source, module } of modules) {
-        const candidate = module.default;
+        const candidate = module.connector;
         if (candidate === undefined || !isConnector(candidate)) {
             continue;
         }
-        if (typeof candidate.tools !== "function" &&
-            typeof candidate.http !== "function" &&
-            typeof candidate.sandbox !== "function") {
-            throw new Error(`${source} default export (kind "${candidate.kind}") implements none of ` +
-                `\`tools\`, \`http\`, or \`sandbox\` and would do nothing.`);
+        if (!connectorHasHook(candidate)) {
+            throw new Error(`${source} connector (kind "${candidate.kind}") implements none of ` +
+                `\`tools\`, \`http\`, \`sandbox\`, \`events\`, \`messaging\`, or ` +
+                `\`requirements\` and would do nothing.`);
         }
-        if (seen.has(candidate)) {
+        const name = connectorStemName(source);
+        if (seenNames.has(name)) {
+            throw new Error(`duplicate connector name '${name}' from connectors/`);
+        }
+        seenNames.add(name);
+        if (seenObjects.has(candidate)) {
             continue;
         }
-        seen.add(candidate);
+        seenObjects.add(candidate);
+        Object.defineProperty(candidate, "name", {
+            value: name,
+            enumerable: false,
+            writable: false,
+            configurable: true,
+        });
         collected.push(candidate);
     }
     return collected;
 }
+function connectorStemName(source) {
+    const base = source.replace(/^.*\//, "").replace(/\.(ts|js|mts|mjs|py)$/, "");
+    if (!base || base === "connector") {
+        throw new Error(`invalid connector path "${source}": use connectors/<name>.ts (not connector.ts)`);
+    }
+    return base;
+}
 //# sourceMappingURL=connector.js.map

package/dist/runtime/connector.js.map

@@ -1 +1 @@
-{"version":3,"file":"connector.js","sourceRoot":"","sources":["../../src/runtime/connector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAWH;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAkB,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AAkI1E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAgC,EAChC,GAAG,GAAgB,EAAE;IAErB,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,UAA4C,EAC5C,GAAmB;IAEnB,KAAK,MAAM,SAAS,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YAC5C,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAClC,UAA4C;IAE5C,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAC5B,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,CACvD,CAAC;AACJ,CAAC;AAUD,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAI,KAAsC,CAAC,eAAe,CAAC,CAAC;IACzE,OAAO,OAAO,KAAK,IAAI,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA6C;IAE7C,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAa,CAAC;IAElC,KAAK,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC;QACjC,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IACE,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU;YACrC,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU;YACpC,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,EACvC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,0BAA0B,SAAS,CAAC,IAAI,wBAAwB;gBACvE,2DAA2D,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"connector.js","sourceRoot":"","sources":["../../src/runtime/connector.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAkB,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AA8K1E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAgC,EAChC,GAAG,GAAgB,EAAE;IAErB,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,UAA4C,EAC5C,GAAmB;IAEnB,KAAK,MAAM,SAAS,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YAC5C,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAClC,UAA4C;IAE5C,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAC5B,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,CACvD,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAClC,UAA4C;IAE5C,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAC5B,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU,CACtD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAgC;IAEhC,MAAM,GAAG,GAA0C,EAAE,CAAC;IACtD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,OAAO,SAAS,CAAC,YAAY,KAAK,UAAU,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACpE,SAAS;QACX,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAUD,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAI,KAAsC,CAAC,eAAe,CAAC,CAAC;IACzE,OAAO,OAAO,KAAK,IAAI,CAAC;AAC1B,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAoB;IAC5C,OAAO,CACL,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU;QACrC,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU;QACpC,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU;QACvC,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU;QACtC,OAAO,SAAS,CAAC,SAAS,KAAK,UAAU;QACzC,OAAO,SAAS,CAAC,YAAY,KAAK,UAAU,CAC7C,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA6C;IAE7C,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAa,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,KAAK,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,qBAAqB,SAAS,CAAC,IAAI,wBAAwB;gBAClE,kEAAkE;gBAClE,wCAAwC,CAC3C,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,oBAAoB,CAAC,CAAC;QACzE,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3B,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE;YACvC,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,KAAK;YACjB,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,gDAAgD,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/runtime/cors.d.ts

@@ -1,6 +1,5 @@
 /**
- * CORS allowlist helpers for managed HTTP routes (`/identity`, `/connectors`,
- * `/channels`).
+ * CORS allowlist helpers for managed HTTP routes (`/identity`, `/connectors`).
  *
  * LangGraph applies `CORS_ALLOW_ORIGINS` to built-in Agent Server routes, but
  * GET responses from the custom `http.app` do not always receive those headers.
@@ -11,7 +10,7 @@
  * {@link MDA_PUBLIC_APP_URL_ENV} plus optional {@link MDA_CORS_ORIGINS_ENV}.
  */
 /** Path prefixes that receive managed-app CORS (not built-in Agent Server routes). */
-export declare const MDA_CORS_PATH_PREFIXES: readonly ["/identity", "/connectors", "/channels"];
+export declare const MDA_CORS_PATH_PREFIXES: readonly ["/identity", "/connectors"];
 /** Comma-separated extra browser origins allowed for managed HTTP CORS. */
 export declare const MDA_CORS_ORIGINS_ENV = "MDA_CORS_ORIGINS";
 /** Headers browser clients send on identity / connector fetches. */

package/dist/runtime/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/runtime/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,YACjC,WAAW,EACX,aAAa,EACb,WAAW,CACH,CAAC;AAEX,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YACjC,eAAe,EACf,cAAc,EACd,QAAQ,EACR,WAAW,EACX,WAAW,CACH,CAAC;AAEX,eAAO,MAAM,sBAAsB,YACjC,KAAK,EACL,MAAM,EACN,KAAK,EACL,QAAQ,EACR,SAAS,CACD,CAAC;AAEX,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIvD;AAED,qEAAqE;AACrE,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,EAAE,CAaV;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EAAE,GAClB,MAAM,GAAG,SAAS,CA+BpB"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/runtime/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,YAAI,WAAW,EAAE,aAAa,CAAU,CAAC;AAE5E,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YACjC,eAAe,EACf,cAAc,EACd,QAAQ,EACR,WAAW,EACX,WAAW,CACH,CAAC;AAEX,eAAO,MAAM,sBAAsB,YACjC,KAAK,EACL,MAAM,EACN,KAAK,EACL,QAAQ,EACR,SAAS,CACD,CAAC;AAEX,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIvD;AAED,qEAAqE;AACrE,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,EAAE,CAaV;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EAAE,GAClB,MAAM,GAAG,SAAS,CA+BpB"}

package/dist/runtime/cors.js

@@ -1,6 +1,5 @@
 /**
- * CORS allowlist helpers for managed HTTP routes (`/identity`, `/connectors`,
- * `/channels`).
+ * CORS allowlist helpers for managed HTTP routes (`/identity`, `/connectors`).
  *
  * LangGraph applies `CORS_ALLOW_ORIGINS` to built-in Agent Server routes, but
  * GET responses from the custom `http.app` do not always receive those headers.
@@ -12,11 +11,7 @@
  */
 import { MDA_PUBLIC_APP_URL_ENV } from "../identity/slack/oauth.js";
 /** Path prefixes that receive managed-app CORS (not built-in Agent Server routes). */
-export const MDA_CORS_PATH_PREFIXES = [
-    "/identity",
-    "/connectors",
-    "/channels",
-];
+export const MDA_CORS_PATH_PREFIXES = ["/identity", "/connectors"];
 /** Comma-separated extra browser origins allowed for managed HTTP CORS. */
 export const MDA_CORS_ORIGINS_ENV = "MDA_CORS_ORIGINS";
 /** Headers browser clients send on identity / connector fetches. */

package/dist/runtime/cors.js.map

@@ -1 +1 @@
-{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/runtime/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,sFAAsF;AACtF,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,WAAW;IACX,aAAa;IACb,WAAW;CACH,CAAC;AAEX,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,oEAAoE;AACpE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,eAAe;IACf,cAAc;IACd,QAAQ;IACR,WAAW;IACX,WAAW;CACH,CAAC;AAEX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,SAAS;CACD,CAAC;AAEX,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,sBAAsB,CAAC,IAAI,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAClC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,SAAS,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,aAAqB,EACrB,SAAmB;IAEnB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,IAAI,WAAmB,CAAC;QACxB,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IACE,WAAW,KAAK,WAAW;YAC3B,WAAW,CAAC,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,EACvC,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/runtime/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,sFAAsF;AACtF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,WAAW,EAAE,aAAa,CAAU,CAAC;AAE5E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,oEAAoE;AACpE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,eAAe;IACf,cAAc;IACd,QAAQ;IACR,WAAW;IACX,WAAW;CACH,CAAC;AAEX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,SAAS;CACD,CAAC;AAEX,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,sBAAsB,CAAC,IAAI,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAClC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,SAAS,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,aAAqB,EACrB,SAAmB;IAEnB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,IAAI,WAAmB,CAAC;QACxB,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IACE,WAAW,KAAK,WAAW;YAC3B,WAAW,CAAC,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,EACvC,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/runtime/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/runtime/credentials.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,8BAA8B,CAAC;AAKzE,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,GAAG,CACD,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,4EAA4E;IAC5E,aAAa,EAAE,CACb,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,gBAAgB,KACrB,OAAO,CAAC,MAAM,CAAC,CAAC;CACtB;AAQD,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,QAAiB,CAAC;AACxD,kDAAkD;AAClD,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD;;;;;GAKG;AACH,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAJ7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IAEzD,YACmB,YAAY,GAAE,MAAkC,EAChD,UAAU,GAAE,MAAqC,EAChE;IAEJ,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAU9D;IAED,GAAG,CACD,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,kBAAkB,EACzB,KAAK,GAAE,MAAmB,GACzB,IAAI,CAkBN;IAED,KAAK,IAAI,IAAI,CAEZ;CACF;AAKD,2DAA2D;AAC3D,wBAAgB,4BAA4B,IAAI,IAAI,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,IAAI,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,EAC9B,KAAK,GAAE,eAA8B,GACpC,mBAAmB,GAAG,SAAS,CA8BjC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/runtime/credentials.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAGV,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAG9B;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,8BAA8B,CAAC;AAKzE,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,GAAG,CACD,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,4EAA4E;IAC5E,aAAa,EAAE,CACb,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,gBAAgB,KACrB,OAAO,CAAC,MAAM,CAAC,CAAC;CACtB;AAQD,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,QAAiB,CAAC;AACxD,kDAAkD;AAClD,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD;;;;;GAKG;AACH,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAJ7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IAEzD,YACmB,YAAY,GAAE,MAAkC,EAChD,UAAU,GAAE,MAAqC,EAChE;IAEJ,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAU9D;IAED,GAAG,CACD,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,kBAAkB,EACzB,KAAK,GAAE,MAAmB,GACzB,IAAI,CAkBN;IAED,KAAK,IAAI,IAAI,CAEZ;CACF;AAKD,2DAA2D;AAC3D,wBAAgB,4BAA4B,IAAI,IAAI,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,IAAI,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,EAC9B,KAAK,GAAE,eAA8B,GACpC,mBAAmB,GAAG,SAAS,CA8BjC"}

package/dist/runtime/credentials.js

@@ -1,4 +1,6 @@
 import { SignJWT } from "jose";
+import { credentialTargetNames, isSingleCredentialResolver, } from "../identity/index.js";
+import { fetchWithTimeout, PROVIDER_HTTP_TIMEOUT_MS } from "./http.js";
 /**
  * Component 5 — Credentials, custom mode.
  *
@@ -82,7 +84,7 @@ export function clearCredentialCacheForTests() {
  * run's resolved identity; every `for(target)` call is scoped to that actor.
  */
 export function createCredentialsProvider(cfg, identity, deps, cache = defaultCache) {
-    if (cfg.scoping.credentials !== "custom" || !cfg.credentials) {
+    if (cfg.scope.credentials !== "custom" || !cfg.credentials) {
         return undefined;
     }
     const resolved = {
@@ -115,22 +117,45 @@ async function resolveCredential(cfg, identity, target, deps) {
     if (!creds) {
         throw new Error("No credentials resolver is configured for this deployment.");
     }
-    if ("resolve" in creds) {
-        const out = await creds.resolve({ identity, target });
-        return normalizeResolved(out, "resolver");
+    return resolveOne(selectResolver(creds, target), identity, target, deps, creds);
+}
+/**
+ * Pick the resolver for this target: the single one, or the map entry whose key
+ * matches `target.name`.
+ */
+function selectResolver(creds, target) {
+    if (isSingleCredentialResolver(creds)) {
+        return creds;
+    }
+    const entry = Object.hasOwn(creds, target.name)
+        ? creds[target.name]
+        : undefined;
+    if (!entry) {
+        const configured = credentialTargetNames(creds).join(", ");
+        throw new Error(`runtime.credentials.for(...) has no resolver for target "${target.name}". ` +
+            `Configured targets: ${configured}.`);
+    }
+    return entry;
+}
+async function resolveOne(config, identity, target, deps, creds) {
+    const label = isSingleCredentialResolver(creds)
+        ? "resolver"
+        : `resolver for "${target.name}"`;
+    if ("resolve" in config) {
+        return normalizeResolved(await config.resolve({ identity, target }), label);
     }
     const assertion = await deps.signAssertion(identity, target);
-    return callTokenExchange(creds.endpoint.url, assertion, deps);
+    return callTokenExchange(config.endpoint.url, assertion, deps);
 }
 async function callTokenExchange(url, assertion, deps) {
-    const response = await deps.fetch(url, {
+    const response = await fetchWithTimeout(url, {
         method: "POST",
         headers: {
             "content-type": "application/json",
             authorization: `Bearer ${assertion}`,
         },
         body: JSON.stringify({ assertion }),
-    });
+    }, PROVIDER_HTTP_TIMEOUT_MS, deps.fetch);
     if (!response.ok) {
         throw new Error(`Credential token-exchange endpoint ${url} responded ${response.status}.`);
     }
@@ -144,25 +169,25 @@ async function defaultSignAssertion(identity, target) {
     }
     const issuedAt = Math.floor(Date.now() / 1000);
     return new SignJWT({
-        actor_id: identity.actor.id,
-        actor_type: identity.actor.type,
-        tenant_id: identity.tenant?.id,
+        user_id: identity.user.id,
+        user_kind: identity.user.kind,
+        organization_id: identity.organization?.id,
         target: { kind: target.kind, name: target.name, intent: target.intent },
     })
         .setProtectedHeader({ alg: "HS256" })
-        .setSubject(identity.actor.id)
+        .setSubject(identity.user.id)
         .setIssuedAt(issuedAt)
         .setExpirationTime(issuedAt + ASSERTION_TTL_SECONDS)
         .sign(new TextEncoder().encode(secret));
 }
 /**
- * The cache key that discriminates a minted credential: the actor + tenant it
+ * The cache key that discriminates a minted credential: the user + organization it
  * belongs to, plus the target's kind/name/intent/thread and metadata.
  */
 function cacheKey(identity, target) {
     return stableStringify([
-        identity.actor.id,
-        identity.tenant?.id ?? null,
+        identity.user.id,
+        identity.organization?.id ?? null,
         target.kind,
         target.name,
         target.intent ?? null,

package/dist/runtime/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/runtime/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAS/B;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GAAG,2BAA2B,CAAC;AAEzE,iEAAiE;AACjE,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAwCjC,kEAAkE;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACxD,kDAAkD;AAClD,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IAIP,YAAY;IACZ,UAAU;IAJZ,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEzD,YACmB,YAAY,GAAW,yBAAyB,EAChD,UAAU,GAAW,4BAA4B;4BADjD,YAAY;0BACZ,UAAU;IAC1B,CAAC;IAEJ,GAAG,CAAC,GAAW,EAAE,KAAa;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,KAAK,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC;IAED,GAAG,CACD,GAAW,EACX,KAAyB,EACzB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;QAE1B,IAAI,WAAmB,CAAC;QACxB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3C,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM;gBACR,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAC;AAE3C,2DAA2D;AAC3D,MAAM,UAAU,4BAA4B;IAC1C,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAmB,EACnB,QAAqC,EACrC,IAA8B,EAC9B,KAAK,GAAoB,YAAY;IAErC,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAmB;QAC/B,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK;QAC3B,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACpC,aAAa,EAAE,IAAI,EAAE,aAAa,IAAI,oBAAoB;KAC3D,CAAC;IACF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO;YACvB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,sEAAsE;oBACpE,6BAA6B,CAChC,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC3C,IAAI,GAAG,EAAE,CAAC;oBACR,OAAO,GAAG,CAAC;gBACb,CAAC;YACH,CAAC;YACD,2EAA2E;YAC3E,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACpB,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAmB,EACnB,QAAyB,EACzB,MAAwB,EACxB,IAAoB;IAEpB,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,OAAO,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7D,OAAO,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAW,EACX,SAAiB,EACjB,IAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,SAAS,EAAE;SACrC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,sCAAsC,GAAG,cAAc,QAAQ,CAAC,MAAM,GAAG,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,YAAY,GAAG,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,QAAyB,EACzB,MAAwB;IAExB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,8DAA8D;YAC5D,GAAG,6BAA6B,iCAAiC,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/C,OAAO,IAAI,OAAO,CAAC;QACjB,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE;QAC3B,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI;QAC/B,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE;QAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;KACxE,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;SAC7B,WAAW,CAAC,QAAQ,CAAC;SACrB,iBAAiB,CAAC,QAAQ,GAAG,qBAAqB,CAAC;SACnD,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,QAAyB,EAAE,MAAwB;IACnE,OAAO,eAAe,CAAC;QACrB,QAAQ,CAAC,KAAK,CAAC,EAAE;QACjB,QAAQ,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI;QAC3B,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,MAAM,IAAI,IAAI;QACrB,MAAM,CAAC,QAAQ,IAAI,IAAI;QACvB,MAAM,CAAC,QAAQ,IAAI,IAAI;KACxB,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;IACzC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACxB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;SACnE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB,CACxB,KAAc,EACd,WAAmB;IAEnB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,cAAc,WAAW,gCAAgC,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,KAG9B,CAAC;IACF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,cAAc,WAAW,sCAAsC,CAChE,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAA2B,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,cAAc,WAAW,YAAY,IAAI,qBAAqB,CAC/D,CAAC;QACJ,CAAC;QACD,iBAAiB,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC;IACxC,CAAC;IACD,MAAM,MAAM,GAAuB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAClE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,cAAc,WAAW,uCAAuC,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/runtime/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE/B,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAS9B,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAEvE;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GAAG,2BAA2B,CAAC;AAEzE,iEAAiE;AACjE,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAwCjC,kEAAkE;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACxD,kDAAkD;AAClD,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IAIP,YAAY;IACZ,UAAU;IAJZ,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEzD,YACmB,YAAY,GAAW,yBAAyB,EAChD,UAAU,GAAW,4BAA4B;4BADjD,YAAY;0BACZ,UAAU;IAC1B,CAAC;IAEJ,GAAG,CAAC,GAAW,EAAE,KAAa;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,KAAK,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC;IAED,GAAG,CACD,GAAW,EACX,KAAyB,EACzB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;QAE1B,IAAI,WAAmB,CAAC;QACxB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3C,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM;gBACR,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAC;AAE3C,2DAA2D;AAC3D,MAAM,UAAU,4BAA4B;IAC1C,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAmB,EACnB,QAAqC,EACrC,IAA8B,EAC9B,KAAK,GAAoB,YAAY;IAErC,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC3D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAmB;QAC/B,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK;QAC3B,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACpC,aAAa,EAAE,IAAI,EAAE,aAAa,IAAI,oBAAoB;KAC3D,CAAC;IACF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO;YACvB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,sEAAsE;oBACpE,6BAA6B,CAChC,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC3C,IAAI,GAAG,EAAE,CAAC;oBACR,OAAO,GAAG,CAAC;gBACb,CAAC;YACH,CAAC;YACD,2EAA2E;YAC3E,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACpB,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAmB,EACnB,QAAyB,EACzB,MAAwB,EACxB,IAAoB;IAEpB,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CACf,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,EAC7B,QAAQ,EACR,MAAM,EACN,IAAI,EACJ,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CACrB,KAAqD,EACrD,MAAwB;IAExB,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC;QAC7C,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;QACpB,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,4DAA4D,MAAM,CAAC,IAAI,KAAK;YAC1E,uBAAuB,UAAU,GAAG,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAAgC,EAChC,QAAyB,EACzB,MAAwB,EACxB,IAAoB,EACpB,KAAqD;IAErD,MAAM,KAAK,GAAG,0BAA0B,CAAC,KAAK,CAAC;QAC7C,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,iBAAiB,MAAM,CAAC,IAAI,GAAG,CAAC;IACpC,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACxB,OAAO,iBAAiB,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7D,OAAO,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAW,EACX,SAAiB,EACjB,IAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,SAAS,EAAE;SACrC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;KACpC,EACD,wBAAwB,EACxB,IAAI,CAAC,KAAK,CACX,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,sCAAsC,GAAG,cAAc,QAAQ,CAAC,MAAM,GAAG,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,YAAY,GAAG,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,QAAyB,EACzB,MAAwB;IAExB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,8DAA8D;YAC5D,GAAG,6BAA6B,iCAAiC,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/C,OAAO,IAAI,OAAO,CAAC;QACjB,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE;QACzB,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI;QAC7B,eAAe,EAAE,QAAQ,CAAC,YAAY,EAAE,EAAE;QAC1C,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;KACxE,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;SAC5B,WAAW,CAAC,QAAQ,CAAC;SACrB,iBAAiB,CAAC,QAAQ,GAAG,qBAAqB,CAAC;SACnD,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,QAAyB,EAAE,MAAwB;IACnE,OAAO,eAAe,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE;QAChB,QAAQ,CAAC,YAAY,EAAE,EAAE,IAAI,IAAI;QACjC,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,MAAM,IAAI,IAAI;QACrB,MAAM,CAAC,QAAQ,IAAI,IAAI;QACvB,MAAM,CAAC,QAAQ,IAAI,IAAI;KACxB,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;IACzC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACxB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;SACnE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB,CACxB,KAAc,EACd,WAAmB;IAEnB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,cAAc,WAAW,gCAAgC,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,KAG9B,CAAC;IACF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,cAAc,WAAW,sCAAsC,CAChE,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAA2B,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,cAAc,WAAW,YAAY,IAAI,qBAAqB,CAC/D,CAAC;QACJ,CAAC;QACD,iBAAiB,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC;IACxC,CAAC;IACD,MAAM,MAAM,GAAuB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAClE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,cAAc,WAAW,uCAAuC,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/runtime/http.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Bounded outbound HTTP for the managed runtime.
+ *
+ * Node's `fetch` has no default timeout, so a peer that accepts the connection
+ * and never responds pins the caller forever. On the auth path that turns one
+ * hung IdP into a fully unavailable deployment: every request parks in token
+ * verification holding a request slot, and the fail-closed 401 never runs.
+ *
+ * Every outbound call in this package goes through {@link fetchWithTimeout}.
+ * Budgets mirror the Python runtime so the two stay behavior-compatible.
+ */
+/**
+ * Auth/authz-path calls: OIDC discovery, token introspection, thread-ownership
+ * proof. Mirrors `_validated_token.py` (`timeout=10`) and
+ * `connectors/langsmith/routes.py` (`_THREAD_ACCESS_TIMEOUT_S`).
+ */
+export declare const AUTH_HTTP_TIMEOUT_MS = 10000;
+/**
+ * Provider egress: Slack/GitHub APIs, OAuth code exchange, credential
+ * token exchange. Mirrors the Python runtime's `timeout=30`.
+ */
+export declare const PROVIDER_HTTP_TIMEOUT_MS = 30000;
+/**
+ * Remote JWKS fetches performed inside `jose`. Passed explicitly to
+ * `createRemoteJWKSet` rather than relying on the library default.
+ */
+export declare const JWKS_HTTP_TIMEOUT_MS = 5000;
+/**
+ * `fetch` with a hard wall-clock budget.
+ *
+ * The request is aborted with a `TimeoutError` once `timeoutMs` elapses; a
+ * caller-supplied `init.signal` still aborts as usual.
+ *
+ * The budget spans the whole exchange, body included: a peer that sends headers
+ * and then stalls rejects at `response.json()`/`.text()`, *after* this call has
+ * already resolved. Callers that map a network failure to a specific status must
+ * put the body read under the same mapping, or a stalled body takes a different
+ * path than a stalled connection.
+ *
+ * @param input - Request URL.
+ * @param init - Request init, or `undefined`.
+ * @param timeoutMs - Abort budget in milliseconds.
+ * @param fetchImpl - Fetch override (tests, or an injected transport).
+ * @returns The response, or a rejection once the budget elapses.
+ */
+export declare function fetchWithTimeout(input: string | URL, init: RequestInit | undefined, timeoutMs: number, fetchImpl?: typeof fetch): Promise<Response>;
+//# sourceMappingURL=http.d.ts.map

package/dist/runtime/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/runtime/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C;;;GAGG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,oBAAoB,OAAQ,CAAC;AAE1C;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,GAAG,GAAG,EACnB,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,QAAQ,CAAC,CAOnB"}

package/dist/runtime/http.js

@@ -0,0 +1,54 @@
+/**
+ * Bounded outbound HTTP for the managed runtime.
+ *
+ * Node's `fetch` has no default timeout, so a peer that accepts the connection
+ * and never responds pins the caller forever. On the auth path that turns one
+ * hung IdP into a fully unavailable deployment: every request parks in token
+ * verification holding a request slot, and the fail-closed 401 never runs.
+ *
+ * Every outbound call in this package goes through {@link fetchWithTimeout}.
+ * Budgets mirror the Python runtime so the two stay behavior-compatible.
+ */
+/**
+ * Auth/authz-path calls: OIDC discovery, token introspection, thread-ownership
+ * proof. Mirrors `_validated_token.py` (`timeout=10`) and
+ * `connectors/langsmith/routes.py` (`_THREAD_ACCESS_TIMEOUT_S`).
+ */
+export const AUTH_HTTP_TIMEOUT_MS = 10_000;
+/**
+ * Provider egress: Slack/GitHub APIs, OAuth code exchange, credential
+ * token exchange. Mirrors the Python runtime's `timeout=30`.
+ */
+export const PROVIDER_HTTP_TIMEOUT_MS = 30_000;
+/**
+ * Remote JWKS fetches performed inside `jose`. Passed explicitly to
+ * `createRemoteJWKSet` rather than relying on the library default.
+ */
+export const JWKS_HTTP_TIMEOUT_MS = 5_000;
+/**
+ * `fetch` with a hard wall-clock budget.
+ *
+ * The request is aborted with a `TimeoutError` once `timeoutMs` elapses; a
+ * caller-supplied `init.signal` still aborts as usual.
+ *
+ * The budget spans the whole exchange, body included: a peer that sends headers
+ * and then stalls rejects at `response.json()`/`.text()`, *after* this call has
+ * already resolved. Callers that map a network failure to a specific status must
+ * put the body read under the same mapping, or a stalled body takes a different
+ * path than a stalled connection.
+ *
+ * @param input - Request URL.
+ * @param init - Request init, or `undefined`.
+ * @param timeoutMs - Abort budget in milliseconds.
+ * @param fetchImpl - Fetch override (tests, or an injected transport).
+ * @returns The response, or a rejection once the budget elapses.
+ */
+export function fetchWithTimeout(input, init, timeoutMs, fetchImpl = fetch) {
+    const timeout = AbortSignal.timeout(timeoutMs);
+    const caller = init?.signal;
+    return fetchImpl(input, {
+        ...init,
+        signal: caller ? AbortSignal.any([caller, timeout]) : timeout,
+    });
+}
+//# sourceMappingURL=http.js.map

package/dist/runtime/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/runtime/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAmB,EACnB,IAA6B,EAC7B,SAAiB,EACjB,SAAS,GAAiB,KAAK;IAE/B,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;IAC5B,OAAO,SAAS,CAAC,KAAK,EAAE;QACtB,GAAG,IAAI;QACP,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO;KAC9D,CAAC,CAAC;AACL,CAAC"}