managed-deepagents 0.6.2-dev.11 → 0.6.2-dev.13

package/dist/connectors/tool-selection.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-selection.js","sourceRoot":"","sources":["../../src/connectors/tool-selection.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyBxB,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,OAAO,GAAG,GAAG,KAAK,6BAA6B,CAAC;IACtD,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;AAC/E,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,YAAY,EAAE,CAAC;SACZ,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;SAC5B,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,OAAO,EAAE,iCAAiC,IAAI,GAAG;iBAClD,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;SACD,QAAQ,EAAE;IACb,YAAY,EAAE,CAAC;SACZ,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;SAC5B,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,OAAO,EAAE,iCAAiC,IAAI,GAAG;iBAClD,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;SACD,QAAQ,EAAE;IACb,kBAAkB,EAAE,CAAC;SAClB,MAAM,CAAC,8CAA8C,CAAC;SACtD,QAAQ,CAAC,8CAA8C,CAAC;SACxD,QAAQ,EAAE;CACd,CAAC;AAEF,sEAAsE;AACtE,MAAM,UAAU,yBAAyB,CACvC,GAA+D,EAC/D,KAAoB;IAEpB,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,OAAO,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACnD,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CACpC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO,EAAE,kEAAkE;gBACzE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC;aACpB;iBACE,IAAI,EAAE;iBACN,IAAI,CAAC,IAAI,CAAC,EAAE;SAChB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,KAAK,GAAkB,EAAE;IAEzB,OAAO,CAAC;SACL,YAAY,CAAC,EAAE,GAAG,4BAA4B,EAAE,GAAG,KAAK,EAAE,CAAC;SAC3D,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,KAAsB,CAAC,CAAC;IAC7D,CAAC,CAAC;SACD,QAAQ,CAAC,EAAE,CAAU,CAAC;AAC3B,CAAC;AAKD,qFAAqF;AACrF,MAAM,CAAC,MAAM,QAAQ,GAAmB,CAAC,IAAI,EAAE,EAAE;IAC/C,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,CAAC;IAC/C,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,SAAwB,EACxB,KAAyB,EACzB,QAAQ,GAAmB,QAAQ;IAEnC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;IACjD,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,KAAK;SACF,GAAG,CAAC,QAAQ,CAAC;SACb,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAC9D,CAAC;IACF,wBAAwB,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,QAAQ,KAAK,SAAS,CAAC;QAChC,CAAC;QACD,OAAO,CACL,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CACvE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAAe,EACf,SAAsB,EACtB,YAAuB,EACvB,YAAuB;IAEvB,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IACpE,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,8BAA8B,KAAK,IAAI;QAC/C,oBAAoB,cAAc,GAAG,CACxC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tool-selection.js","sourceRoot":"","sources":["../../src/connectors/tool-selection.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB,4DAA4D;AAC5D,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,KAAK,CACJ,CAAC;KACE,MAAM,CAAC,sCAAsC,CAAC;KAC9C,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAChC,sCAAsC,CACvC,CACJ;KACA,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACb,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,OAAO,EAAE,iCAAiC,IAAI,GAAG;aAClD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;AACH,CAAC,CAAC;KACD,QAAQ,EAAE,CAAC;AAEd,SAAS,2BAA2B,CAClC,SAA+D;IAE/D,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;IACjD,MAAM,OAAO,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACnD,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CACpC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,kEAAkE;QACvE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC;KACpB;SACE,IAAI,EAAE;SACN,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,GAK/C;IACC,MAAM,OAAO,GAAG,2BAA2B,CACzC,GAAG,CAAC,KAA6D,CAClE,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAKD,qFAAqF;AACrF,MAAM,CAAC,MAAM,QAAQ,GAAmB,CAAC,IAAI,EAAE,EAAE;IAC/C,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,CAAC;IAC/C,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,SAAwB,EACxB,KAAyB,EACzB,QAAQ,GAAmB,QAAQ;IAEnC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;IACjD,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,KAAK;SACF,GAAG,CAAC,QAAQ,CAAC;SACb,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAC9D,CAAC;IACF,wBAAwB,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,QAAQ,KAAK,SAAS,CAAC;QAChC,CAAC;QACD,OAAO,CACL,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CACvE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAAe,EACf,SAAsB,EACtB,YAAuB,EACvB,YAAuB;IAEvB,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IACpE,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,8BAA8B,KAAK,IAAI;QAC/C,oBAAoB,cAAc,GAAG,CACxC,CAAC;AACJ,CAAC"}

package/dist/credential-gate.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Pre-run gate for declarations that need a user-owned credential.
+ *
+ * Before the first model turn the gate reads the caller's OAuth grants from
+ * Agent Auth. Missing grants raise one LangGraph interrupt listing connect
+ * URLs; the tools a grant unlocks are loaded on first use and cached per
+ * caller.
+ */
+import { createMiddleware } from "langchain";
+import { type CredentialReference } from "./credentials.js";
+export declare const CREDENTIAL_GATE_MIDDLEWARE_NAME = "mda-credential-gate";
+export interface PendingCredential {
+    slug: string;
+    connect_url: string;
+    auth_id: string;
+}
+/** Interrupt payload when the caller has not granted one or more credentials. */
+export interface CredentialAuthorizationRequiredInterrupt {
+    type: "credential_authorization_required";
+    message: string;
+    credentials: PendingCredential[];
+}
+/** Tools a declaration contributes for one caller, plus their transport. */
+export interface LoadedCredentialTools {
+    tools: unknown[];
+    close: () => Promise<void>;
+}
+/** A declaration whose tools are unlocked by user-owned credentials. */
+export interface CredentialConsumer {
+    /** The declaration itself, used to key the per-caller tool cache. */
+    declaration: object;
+    /** User-owned credential references the declaration needs. */
+    credentials: readonly CredentialReference[];
+    load: (accessTokens: ReadonlyMap<string, string>) => Promise<LoadedCredentialTools>;
+}
+export declare function createCredentialGateMiddleware(consumers: readonly CredentialConsumer[]): ReturnType<typeof createMiddleware> | undefined;
+/** Drop every cached caller entry and close its transports. Test-only. */
+export declare function clearCredentialToolCacheForTests(): Promise<void>;
+//# sourceMappingURL=credential-gate.d.ts.map

package/dist/credential-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-gate.d.ts","sourceRoot":"","sources":["../src/credential-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAQ7C,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,kBAAkB,CAAC;AAY1B,eAAO,MAAM,+BAA+B,wBAAwB,CAAC;AAUrE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iFAAiF;AACjF,MAAM,WAAW,wCAAwC;IACvD,IAAI,EAAE,mCAAmC,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,iBAAiB,EAAE,CAAC;CAClC;AAED,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,WAAW,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC5C,IAAI,EAAE,CACJ,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KACtC,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACrC;AAuCD,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,SAAS,kBAAkB,EAAE,GACvC,UAAU,CAAC,OAAO,gBAAgB,CAAC,GAAG,SAAS,CAuCjD;AA+KD,0EAA0E;AAC1E,wBAAsB,gCAAgC,IAAI,OAAO,CAAC,IAAI,CAAC,CAStE"}

package/dist/credential-gate.js

@@ -0,0 +1,209 @@
+/**
+ * Pre-run gate for declarations that need a user-owned credential.
+ *
+ * Before the first model turn the gate reads the caller's OAuth grants from
+ * Agent Auth. Missing grants raise one LangGraph interrupt listing connect
+ * URLs; the tools a grant unlocks are loaded on first use and cached per
+ * caller.
+ */
+import { createMiddleware } from "langchain";
+import { interrupt } from "@langchain/langgraph";
+import { AgentAuth, CredentialAuthorizationRequiredError, } from "./agent-auth.js";
+import { resolveAgentAuthContext, resolveOwnerId, } from "./credentials.js";
+import { buildRuntimeIdentity, resolveRuntimeConfigurable, } from "./runtime/identity-runtime.js";
+import { wrapToolsWithManagedRuntime, } from "./runtime/managed-tools.js";
+export const CREDENTIAL_GATE_MIDDLEWARE_NAME = "mda-credential-gate";
+/**
+ * How long a caller's loaded tools stay cached.
+ *
+ * The access token is bound into the transport when the tools are built, so the
+ * entry has to lapse well before the token does.
+ */
+const TOOL_CACHE_TTL_MS = 5 * 60_000;
+/**
+ * Loaded tools by declaration and caller.
+ *
+ * Module scope, not middleware scope: a resumed run re-enters through a fresh
+ * graph factory, so a cache owned by the middleware would be empty for every
+ * turn after an interrupt. It is only ever a latency optimization — a resume
+ * can also land on another replica, so every read path rebuilds on a miss.
+ */
+const toolCache = new Map();
+const declarationIds = new WeakMap();
+let nextDeclarationId = 0;
+class UnauthenticatedCallerError extends Error {
+    constructor() {
+        super("credentials with a user owner require an authenticated caller. " +
+            "Anonymous or agent-only runs cannot complete the credential gate.");
+        this.name = "UnauthenticatedCallerError";
+    }
+}
+export function createCredentialGateMiddleware(consumers) {
+    if (consumers.length === 0) {
+        return undefined;
+    }
+    return createMiddleware({
+        name: CREDENTIAL_GATE_MIDDLEWARE_NAME,
+        async beforeAgent(_state, runtime) {
+            const caller = authContext(runtime);
+            if (!caller) {
+                throw new UnauthenticatedCallerError();
+            }
+            await ensureGrants(consumers, caller);
+            await toolsForContext(consumers, caller.context);
+        },
+        async wrapModelCall(request, handler) {
+            const extra = await toolsForRuntime(consumers, request.runtime);
+            if (extra.length === 0) {
+                return handler(request);
+            }
+            const existing = Array.isArray(request.tools) ? request.tools : [];
+            return handler({ ...request, tools: [...existing, ...extra] });
+        },
+        async wrapToolCall(request, handler) {
+            const name = request.toolCall?.name;
+            if (request.tool != null || typeof name !== "string") {
+                return handler(request);
+            }
+            const tools = await toolsForRuntime(consumers, request.runtime);
+            const tool = tools.find((candidate) => candidate.name === name);
+            return tool ? handler({ ...request, tool }) : handler(request);
+        },
+    });
+}
+/**
+ * Interrupt once when the caller is missing a grant.
+ *
+ * Reads never mint, so the probe is safe to repeat on every replay of this
+ * node. Sessions are minted once, immediately before the interrupt that shows
+ * their URLs.
+ */
+async function ensureGrants(consumers, caller) {
+    const agentAuth = new AgentAuth(caller.context);
+    const granted = await Promise.all(consumerCredentials(consumers, caller).map(async ({ slug }) => ({
+        slug,
+        token: await agentAuth.readUserAccessToken(slug),
+    })));
+    const missing = granted.filter((row) => !row.token).map((row) => row.slug);
+    if (missing.length === 0) {
+        return;
+    }
+    const pending = await Promise.all(missing.map((slug) => agentAuth.startAuthorizationSession(slug)));
+    const payload = {
+        type: "credential_authorization_required",
+        message: "Connect the following integrations to continue.",
+        credentials: pending.map((session) => ({
+            slug: session.slug,
+            connect_url: session.connectUrl,
+            auth_id: session.authId,
+        })),
+    };
+    // `interrupt` throws while no resume value is pending and returns once one
+    // is, so reaching the line below means the run resumed with a grant still
+    // missing.
+    interrupt(payload);
+    throw new CredentialAuthorizationRequiredError(missing);
+}
+/**
+ * Declared credentials, one per slug.
+ *
+ * Every reference is resolved through {@link resolveOwnerId}, the same check
+ * `credentials.get` applies when a tool awaits a handle, so a declaration that
+ * names another user is rejected here rather than quietly run as the caller.
+ */
+function consumerCredentials(consumers, caller) {
+    const bySlug = new Map();
+    for (const consumer of consumers) {
+        for (const credential of consumer.credentials) {
+            resolveOwnerId(credential.owner, caller.identity, caller.context.agentId);
+            bySlug.set(credential.slug, credential);
+        }
+    }
+    return [...bySlug.values()];
+}
+async function toolsForRuntime(consumers, runtime) {
+    const caller = authContext(runtime);
+    return caller ? await toolsForContext(consumers, caller.context) : [];
+}
+async function toolsForContext(consumers, context) {
+    const loaded = await Promise.all(consumers.map((consumer) => cachedTools(consumer, context)));
+    return loaded.flat();
+}
+async function cachedTools(consumer, context) {
+    const key = `${declarationId(consumer.declaration)} ${context.principalId}`;
+    for (;;) {
+        const cached = toolCache.get(key);
+        if (!cached) {
+            return refresh(key, consumer, context, undefined);
+        }
+        const entry = await cached.catch(() => undefined);
+        if (entry && entry.expiresAt > Date.now()) {
+            return entry.tools;
+        }
+        // Nothing suspends between this read and the write inside `refresh`, so a
+        // lapsed entry is retired by exactly one caller. The rest see the
+        // replacement on the next pass and join it.
+        if (toolCache.get(key) === cached) {
+            return refresh(key, consumer, context, entry);
+        }
+    }
+}
+/** Publish the load before awaiting it, so concurrent callers share one transport. */
+async function refresh(key, consumer, context, lapsed) {
+    const loading = loadTools(consumer, context);
+    toolCache.set(key, loading);
+    lapsed?.close().catch(() => undefined);
+    try {
+        return (await loading).tools;
+    }
+    catch (error) {
+        if (toolCache.get(key) === loading) {
+            toolCache.delete(key);
+        }
+        throw error;
+    }
+}
+async function loadTools(consumer, context) {
+    const agentAuth = new AgentAuth(context);
+    const resolved = await Promise.all(consumer.credentials.map(async ({ slug }) => ({
+        slug,
+        token: await agentAuth.readUserAccessToken(slug),
+    })));
+    const missing = resolved.filter((row) => !row.token).map((row) => row.slug);
+    if (missing.length > 0) {
+        throw new CredentialAuthorizationRequiredError(missing);
+    }
+    const accessTokens = new Map(resolved.map((row) => [row.slug, row.token]));
+    const loaded = await consumer.load(accessTokens);
+    return {
+        tools: wrapToolsWithManagedRuntime(loaded.tools),
+        close: loaded.close,
+        expiresAt: Date.now() + TOOL_CACHE_TTL_MS,
+    };
+}
+function declarationId(declaration) {
+    const existing = declarationIds.get(declaration);
+    if (existing)
+        return existing;
+    nextDeclarationId += 1;
+    const id = String(nextDeclarationId);
+    declarationIds.set(declaration, id);
+    return id;
+}
+function authContext(runtime) {
+    const identity = buildRuntimeIdentity(resolveRuntimeConfigurable(runtime));
+    if (!identity?.user.id) {
+        return undefined;
+    }
+    return { context: resolveAgentAuthContext(identity), identity };
+}
+/** Drop every cached caller entry and close its transports. Test-only. */
+export async function clearCredentialToolCacheForTests() {
+    const entries = [...toolCache.values()];
+    toolCache.clear();
+    await Promise.all(entries.map(async (entry) => {
+        const resolved = await entry.catch(() => undefined);
+        await resolved?.close().catch(() => undefined);
+    }));
+}
+//# sourceMappingURL=credential-gate.js.map

package/dist/credential-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-gate.js","sourceRoot":"","sources":["../src/credential-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EACL,SAAS,EACT,oCAAoC,GAErC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,uBAAuB,EACvB,cAAc,GAEf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAE3B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,2BAA2B,GAE5B,MAAM,4BAA4B,CAAC;AAEpC,MAAM,CAAC,MAAM,+BAA+B,GAAG,qBAAqB,CAAC;AAErE;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,GAAG,MAAM,CAAC;AA8CrC;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;AAEzD,MAAM,cAAc,GAAG,IAAI,OAAO,EAAkB,CAAC;AACrD,IAAI,iBAAiB,GAAG,CAAC,CAAC;AAE1B,MAAM,0BAA2B,SAAQ,KAAK;IAC5C;QACE,KAAK,CACH,iEAAiE;YAC/D,mEAAmE,CACtE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,UAAU,8BAA8B,CAC5C,SAAwC;IAExC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,gBAAgB,CAAC;QACtB,IAAI,EAAE,+BAA+B;QACrC,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO;YAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAwC,CAAC,CAAC;YACrE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0BAA0B,EAAE,CAAC;YACzC,CAAC;YACD,MAAM,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO;YAClC,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,SAAS,EACT,OAAO,CAAC,OAAwC,CACjD,CAAC;YACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO;YACjC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;YACpC,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,SAAS,EACT,OAAO,CAAC,OAAwC,CACjD,CAAC;YACF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjE,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CACzB,SAAwC,EACxC,MAAqB;IAErB,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI;QACJ,KAAK,EAAE,MAAM,SAAS,CAAC,mBAAmB,CAAC,IAAI,CAAC;KACjD,CAAC,CAAC,CACJ,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CACjE,CAAC;IACF,MAAM,OAAO,GAA6C;QACxD,IAAI,EAAE,mCAAmC;QACzC,OAAO,EAAE,iDAAiD;QAC1D,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,OAAO,CAAC,UAAU;YAC/B,OAAO,EAAE,OAAO,CAAC,MAAM;SACxB,CAAC,CAAC;KACJ,CAAC;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,WAAW;IACX,SAAS,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,IAAI,oCAAoC,CAAC,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAC1B,SAAwC,EACxC,MAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;IACtD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC9C,cAAc,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1E,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAAwC,EACxC,OAAsC;IAEtC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAAwC,EACxC,OAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAC5D,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAA4B,EAC5B,OAAyB;IAEzB,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAE5E,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;QACD,0EAA0E;QAC1E,kEAAkE;QAClE,4CAA4C;QAC5C,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,OAAO,CACpB,GAAW,EACX,QAA4B,EAC5B,OAAyB,EACzB,MAA8B;IAE9B,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7C,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5B,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,OAAO,CAAC,CAAC,KAAK,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;YACnC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,QAA4B,EAC5B,OAAyB;IAEzB,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI;QACJ,KAAK,EAAE,MAAM,SAAS,CAAC,mBAAmB,CAAC,IAAI,CAAC;KACjD,CAAC,CAAC,CACJ,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,oCAAoC,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAe,CAAC,CAAC,CACvD,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACjD,OAAO;QACL,KAAK,EAAE,2BAA2B,CAChC,MAAM,CAAC,KAAwB,CACjB;QAChB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,WAAmB;IACxC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,iBAAiB,IAAI,CAAC,CAAC;IACvB,MAAM,EAAE,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACrC,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACpC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAClB,OAAsC;IAEtC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,uBAAuB,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;AAClE,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,gCAAgC;IACpD,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,SAAS,CAAC,KAAK,EAAE,CAAC;IAClB,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC1B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,QAAQ,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/credentials.d.ts

@@ -0,0 +1,88 @@
+/**
+ * `credentials.get(...)` — read a managed credential from a tool.
+ *
+ * `owner` is the scope the credential resolves under, and names the same axis as
+ * Agent Auth's `owner_type` / `owner_id`. `{ type: "agent" }` is the deployment,
+ * so every caller resolves the same static secret. `{ type: "user" }` is the
+ * current caller, always backed by an OAuth grant. Resolution reads Agent Auth
+ * on every await and never caches.
+ */
+import type { RuntimeIdentity } from "./identity/index.js";
+import { type AgentAuthContext } from "./agent-auth.js";
+export { AGENT_AUTH_TIMEOUT_MS, AgentAuthUnknownProviderError, CredentialAuthorizationRequiredError, CredentialStoreError, } from "./agent-auth.js";
+export type { AgentAuthContext, PendingAuthorization } from "./agent-auth.js";
+export type AgentCredentialOwner = {
+    type: "agent";
+};
+export type UserCredentialOwner = {
+    type: "user";
+    id?: string;
+};
+export type CredentialOwner = AgentCredentialOwner | UserCredentialOwner;
+export interface CredentialRequest {
+    slug: string;
+    owner: CredentialOwner;
+    identity?: RuntimeIdentity;
+}
+declare const CREDENTIAL_REFERENCE: unique symbol;
+export declare class CredentialNotFoundError extends Error {
+    readonly slug: string;
+    readonly ownerType: CredentialOwner["type"];
+    constructor(slug: string, ownerType: CredentialOwner["type"]);
+}
+/**
+ * A declarative credential handle. Connector declarations inspect its owner;
+ * awaiting the same handle inside a tool resolves fresh material every time.
+ */
+export declare class CredentialReference implements PromiseLike<string> {
+    readonly slug: string;
+    readonly owner: CredentialOwner;
+    private readonly accessor;
+    readonly [CREDENTIAL_REFERENCE] = true;
+    constructor(slug: string, owner: CredentialOwner, accessor: Credentials);
+    then<TResult1 = string, TResult2 = never>(onfulfilled?: ((value: string) => TResult1 | PromiseLike<TResult1>) | null, onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null): PromiseLike<TResult1 | TResult2>;
+}
+export declare function isCredentialReference(value: unknown): value is CredentialReference;
+export declare class AgentAuthCredentialStore {
+    private readonly env;
+    private readonly fetchImpl;
+    private readonly timeoutMs;
+    constructor(env?: NodeJS.ProcessEnv, fetchImpl?: typeof fetch, timeoutMs?: number);
+    fetch(request: CredentialRequest): Promise<string | undefined>;
+}
+export declare class Credentials {
+    private readonly store;
+    constructor(store?: AgentAuthCredentialStore);
+    get(slug: string, owner: CredentialOwner): CredentialReference;
+    resolve(slug: string, owner: CredentialOwner): Promise<string>;
+    /**
+     * Read an agent-owned secret outside a run.
+     *
+     * Connector declarations are loaded once per deployment, before any caller
+     * exists. An agent-owned secret is deployment-scoped, so it is the one lookup
+     * that carries no caller and can be resolved there.
+     */
+    resolveDeploymentSecret(slug: string): Promise<string>;
+}
+/**
+ * The `owner_id` a lookup is keyed by: the caller for a user, else the
+ * deployment. Shared with the credential gate so a declared owner is checked
+ * the same way wherever it is resolved.
+ */
+export declare function resolveOwnerId(owner: CredentialOwner, identity: RuntimeIdentity | undefined, deploymentId: string | undefined): string;
+/**
+ * The Agent Auth binding for one caller.
+ *
+ * `credentials.get` and the pre-run credential gate both resolve their owner id
+ * here, so a slug addresses the same Agent Auth row on either path.
+ */
+export declare function resolveAgentAuthContext(identity: RuntimeIdentity | undefined, env?: NodeJS.ProcessEnv): AgentAuthContext;
+/**
+ * Agent Auth is served by the LangSmith API.
+ *
+ * Rejects a URL that carries a path, query, or userinfo, so a misconfigured
+ * endpoint cannot send the API key at a different service.
+ */
+export declare function resolveAgentAuthBaseUrl(env?: NodeJS.ProcessEnv): string;
+export declare const credentials: Credentials;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAKL,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,oCAAoC,EACpC,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE9E,MAAM,MAAM,oBAAoB,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AACrD,MAAM,MAAM,mBAAmB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,mBAAmB,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED,QAAA,MAAM,oBAAoB,eAA0C,CAAC;AAQrE,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAE5C,YAAY,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,EAK3D;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,WAAW,CAAC,MAAM,CAAC;IAI3D,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,KAAK,EAAE,eAAe;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAL3B,QAAQ,CAAC,CAAC,oBAAoB,CAAC,QAAQ;IAEvC,YACW,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,eAAe,EACd,QAAQ,EAAE,WAAW,EACpC;IAEJ,IAAI,CAAC,QAAQ,GAAG,MAAM,EAAE,QAAQ,GAAG,KAAK,EACtC,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,EAC1E,UAAU,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,KAAK,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,GAC1E,WAAW,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAIlC;CACF;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,mBAAmB,CAO9B;AASD,qBAAa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAH5B,YACmB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,SAAS,GAAE,OAAO,KAAa,EAC/B,SAAS,SAAwB,EAChD;IAEE,KAAK,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA6BnE;CACF;AAED,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IADxB,YACmB,KAAK,GAAE,wBAAyD,EAC/E;IAEJ,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,mBAAmB,CAM7D;IAEK,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBnE;IAED;;;;;;OAMG;IACG,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS3D;CACF;AA+CD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,MAAM,CAqBR;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,gBAAgB,CAkBlB;AAiBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAoBR;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}

package/dist/credentials.js

@@ -0,0 +1,246 @@
+/**
+ * `credentials.get(...)` — read a managed credential from a tool.
+ *
+ * `owner` is the scope the credential resolves under, and names the same axis as
+ * Agent Auth's `owner_type` / `owner_id`. `{ type: "agent" }` is the deployment,
+ * so every caller resolves the same static secret. `{ type: "user" }` is the
+ * current caller, always backed by an OAuth grant. Resolution reads Agent Auth
+ * on every await and never caches.
+ */
+import { AGENT_AUTH_TIMEOUT_MS, AgentAuth, CredentialAuthorizationRequiredError, CredentialStoreError, } from "./agent-auth.js";
+import { buildRuntimeIdentity, resolveRuntimeConfigurable, } from "./runtime/identity-runtime.js";
+export { AGENT_AUTH_TIMEOUT_MS, AgentAuthUnknownProviderError, CredentialAuthorizationRequiredError, CredentialStoreError, } from "./agent-auth.js";
+const CREDENTIAL_REFERENCE = Symbol("managed-deepagents.credential");
+const SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const MAX_SLUG_LENGTH = 64;
+const DEFAULT_LANGSMITH_ENDPOINT = "https://api.smith.langchain.com";
+/** Agent Auth credential kinds, one per owner type. */
+const CREDENTIAL_KIND = { agent: "secret", user: "oauth2" };
+export class CredentialNotFoundError extends Error {
+    slug;
+    ownerType;
+    constructor(slug, ownerType) {
+        super(`no ${ownerType} credential is set for slug ${JSON.stringify(slug)}`);
+        this.name = "CredentialNotFoundError";
+        this.slug = slug;
+        this.ownerType = ownerType;
+    }
+}
+/**
+ * A declarative credential handle. Connector declarations inspect its owner;
+ * awaiting the same handle inside a tool resolves fresh material every time.
+ */
+export class CredentialReference {
+    slug;
+    owner;
+    accessor;
+    [CREDENTIAL_REFERENCE] = true;
+    constructor(slug, owner, accessor) {
+        this.slug = slug;
+        this.owner = owner;
+        this.accessor = accessor;
+    }
+    then(onfulfilled, onrejected) {
+        return this.accessor
+            .resolve(this.slug, this.owner)
+            .then(onfulfilled, onrejected);
+    }
+}
+export function isCredentialReference(value) {
+    return (value instanceof CredentialReference ||
+        (typeof value === "object" &&
+            value !== null &&
+            CREDENTIAL_REFERENCE in value));
+}
+export class AgentAuthCredentialStore {
+    env;
+    fetchImpl;
+    timeoutMs;
+    constructor(env = process.env, fetchImpl = fetch, timeoutMs = AGENT_AUTH_TIMEOUT_MS) {
+        this.env = env;
+        this.fetchImpl = fetchImpl;
+        this.timeoutMs = timeoutMs;
+    }
+    async fetch(request) {
+        const config = resolveAgentAuthConfig(this.env);
+        const ownerId = resolveOwnerId(request.owner, request.identity, config.deploymentId);
+        const client = new AgentAuth({
+            baseUrl: config.baseUrl,
+            agentId: config.deploymentId ?? ownerId,
+            principalId: ownerId,
+            apiKey: config.apiKey,
+            workspaceId: config.workspaceId,
+        }, this.fetchImpl, this.timeoutMs);
+        if (request.owner.type === "user") {
+            return await client.readUserAccessToken(request.slug);
+        }
+        const credentialId = await client.findCredentialId({
+            ownerType: "agent",
+            ownerId,
+            kind: CREDENTIAL_KIND.agent,
+            slug: request.slug,
+        });
+        if (!credentialId)
+            return undefined;
+        return await client.readSecret(credentialId);
+    }
+}
+export class Credentials {
+    store;
+    constructor(store = new AgentAuthCredentialStore()) {
+        this.store = store;
+    }
+    get(slug, owner) {
+        return new CredentialReference(normalizeSlug(slug), normalizeOwner(owner), this);
+    }
+    async resolve(slug, owner) {
+        const configurable = resolveRuntimeConfigurable(undefined);
+        if (!configurable) {
+            throw new Error("credentials.get(...) must be awaited inside a run: resolve a credential in a tool or middleware, not at import time");
+        }
+        const value = await this.store.fetch({
+            slug,
+            owner,
+            identity: buildRuntimeIdentity(configurable),
+        });
+        if (value === undefined) {
+            throw owner.type === "user"
+                ? new CredentialAuthorizationRequiredError([slug])
+                : new CredentialNotFoundError(slug, owner.type);
+        }
+        return value;
+    }
+    /**
+     * Read an agent-owned secret outside a run.
+     *
+     * Connector declarations are loaded once per deployment, before any caller
+     * exists. An agent-owned secret is deployment-scoped, so it is the one lookup
+     * that carries no caller and can be resolved there.
+     */
+    async resolveDeploymentSecret(slug) {
+        const value = await this.store.fetch({
+            slug,
+            owner: { type: "agent" },
+        });
+        if (value === undefined) {
+            throw new CredentialNotFoundError(slug, "agent");
+        }
+        return value;
+    }
+}
+function normalizeSlug(slug) {
+    if (typeof slug !== "string") {
+        throw new TypeError("credential slug must be a string");
+    }
+    const canonical = slug.trim();
+    if (!canonical ||
+        canonical.length > MAX_SLUG_LENGTH ||
+        !SLUG_PATTERN.test(canonical)) {
+        throw new TypeError(`credential slug ${JSON.stringify(slug)} is invalid: use lowercase letters, digits, and single hyphens, at most ${MAX_SLUG_LENGTH} characters`);
+    }
+    return canonical;
+}
+function normalizeOwner(owner) {
+    if (!owner || typeof owner !== "object") {
+        throw new TypeError('credential owner is required: pass { type: "agent" } or { type: "user" }');
+    }
+    const keys = Object.keys(owner);
+    if (keys.some((key) => key !== "type" && key !== "id")) {
+        throw new TypeError("credential owner has an unknown key");
+    }
+    if (owner.type === "agent") {
+        if ("id" in owner) {
+            throw new TypeError('credential owner "id" is not accepted for { type: "agent" }');
+        }
+        return { type: "agent" };
+    }
+    if (owner.type === "user") {
+        if (owner.id === undefined)
+            return { type: "user" };
+        if (typeof owner.id !== "string" || !owner.id.trim()) {
+            throw new TypeError('credential owner "id" must be a non-empty string');
+        }
+        return { type: "user", id: owner.id.trim() };
+    }
+    throw new TypeError("credential owner type is not supported");
+}
+/**
+ * The `owner_id` a lookup is keyed by: the caller for a user, else the
+ * deployment. Shared with the credential gate so a declared owner is checked
+ * the same way wherever it is resolved.
+ */
+export function resolveOwnerId(owner, identity, deploymentId) {
+    if (owner.type === "user") {
+        const authenticated = identity?.user.id;
+        if (!authenticated) {
+            throw new CredentialStoreError("user credentials require an authenticated user principal");
+        }
+        if (owner.id !== undefined && owner.id !== authenticated) {
+            throw new CredentialStoreError("user credential owner id must match the authenticated principal");
+        }
+        return authenticated;
+    }
+    if (!deploymentId) {
+        throw new CredentialStoreError("credentials are not configured: LANGSMITH_HOST_PROJECT_ID is not set");
+    }
+    return deploymentId;
+}
+/**
+ * The Agent Auth binding for one caller.
+ *
+ * `credentials.get` and the pre-run credential gate both resolve their owner id
+ * here, so a slug addresses the same Agent Auth row on either path.
+ */
+export function resolveAgentAuthContext(identity, env = process.env) {
+    const config = resolveAgentAuthConfig(env);
+    if (!config.deploymentId) {
+        throw new CredentialStoreError("credentials are not configured: LANGSMITH_HOST_PROJECT_ID is not set");
+    }
+    return {
+        baseUrl: config.baseUrl,
+        agentId: config.deploymentId,
+        principalId: resolveOwnerId({ type: "user" }, identity, config.deploymentId),
+        apiKey: config.apiKey,
+        workspaceId: config.workspaceId,
+    };
+}
+function resolveAgentAuthConfig(env) {
+    const apiKey = env.LANGSMITH_API_KEY?.trim();
+    if (!apiKey) {
+        throw new CredentialStoreError("credentials are not configured: LANGSMITH_API_KEY is not set");
+    }
+    return {
+        baseUrl: resolveAgentAuthBaseUrl(env),
+        apiKey,
+        deploymentId: env.LANGSMITH_HOST_PROJECT_ID?.trim() || undefined,
+        workspaceId: env.LANGSMITH_WORKSPACE_ID?.trim() || undefined,
+    };
+}
+/**
+ * Agent Auth is served by the LangSmith API.
+ *
+ * Rejects a URL that carries a path, query, or userinfo, so a misconfigured
+ * endpoint cannot send the API key at a different service.
+ */
+export function resolveAgentAuthBaseUrl(env = process.env) {
+    const raw = env.LANGSMITH_ENDPOINT?.trim() || DEFAULT_LANGSMITH_ENDPOINT;
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new CredentialStoreError("LANGSMITH_ENDPOINT is not a valid URL");
+    }
+    if (!["http:", "https:"].includes(parsed.protocol) ||
+        !parsed.hostname ||
+        parsed.username ||
+        parsed.password ||
+        (parsed.pathname !== "/" && parsed.pathname !== "") ||
+        parsed.search ||
+        parsed.hash) {
+        throw new CredentialStoreError("LANGSMITH_ENDPOINT is not a valid URL");
+    }
+    return parsed.origin;
+}
+export const credentials = new Credentials();
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EACL,qBAAqB,EACrB,SAAS,EACT,oCAAoC,EACpC,oBAAoB,GAErB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,oCAAoC,EACpC,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AAazB,MAAM,oBAAoB,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;AACrE,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAClD,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,0BAA0B,GAAG,iCAAiC,CAAC;AAErE,uDAAuD;AACvD,MAAM,eAAe,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAW,CAAC;AAErE,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,CAAS;IACb,SAAS,CAA0B;IAE5C,YAAY,IAAY,EAAE,SAAkC;QAC1D,KAAK,CAAC,MAAM,SAAS,+BAA+B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IAInB,IAAI;IACJ,KAAK;IACG,QAAQ;IALlB,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC;IAEvC,YACW,IAAY,EACZ,KAAsB,EACd,QAAqB;oBAF7B,IAAI;qBACJ,KAAK;wBACG,QAAQ;IACxB,CAAC;IAEJ,IAAI,CACF,WAA0E,EAC1E,UAA2E;QAE3E,OAAO,IAAI,CAAC,QAAQ;aACjB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;aAC9B,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACnC,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAc;IAEd,OAAO,CACL,KAAK,YAAY,mBAAmB;QACpC,CAAC,OAAO,KAAK,KAAK,QAAQ;YACxB,KAAK,KAAK,IAAI;YACd,oBAAoB,IAAI,KAAK,CAAC,CACjC,CAAC;AACJ,CAAC;AASD,MAAM,OAAO,wBAAwB;IAEhB,GAAG;IACH,SAAS;IACT,SAAS;IAH5B,YACmB,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,SAAS,GAAiB,KAAK,EAC/B,SAAS,GAAG,qBAAqB;mBAFjC,GAAG;yBACH,SAAS;yBACT,SAAS;IACzB,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,OAA0B;QACpC,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,cAAc,CAC5B,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,QAAQ,EAChB,MAAM,CAAC,YAAY,CACpB,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B;YACE,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,YAAY,IAAI,OAAO;YACvC,WAAW,EAAE,OAAO;YACpB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,EACD,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACf,CAAC;QACF,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,MAAM,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC;YACjD,SAAS,EAAE,OAAO;YAClB,OAAO;YACP,IAAI,EAAE,eAAe,CAAC,KAAK;YAC3B,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QACpC,OAAO,MAAM,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,OAAO,WAAW;IAEH,KAAK;IADxB,YACmB,KAAK,GAA6B,IAAI,wBAAwB,EAAE;qBAAhE,KAAK;IACrB,CAAC;IAEJ,GAAG,CAAC,IAAY,EAAE,KAAsB;QACtC,OAAO,IAAI,mBAAmB,CAC5B,aAAa,CAAC,IAAI,CAAC,EACnB,cAAc,CAAC,KAAK,CAAC,EACrB,IAAI,CACL,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,KAAsB;QAChD,MAAM,YAAY,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,qHAAqH,CACtH,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YACnC,IAAI;YACJ,KAAK;YACL,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC;SAC7C,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,KAAK,CAAC,IAAI,KAAK,MAAM;gBACzB,CAAC,CAAC,IAAI,oCAAoC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAClD,CAAC,CAAC,IAAI,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,uBAAuB,CAAC,IAAY;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YACnC,IAAI;YACJ,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACzB,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9B,IACE,CAAC,SAAS;QACV,SAAS,CAAC,MAAM,GAAG,eAAe;QAClC,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAC7B,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2EAA2E,eAAe,aAAa,CAC/I,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,KAAsB;IAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,SAAS,CACjB,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,SAAS,CACjB,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACpD,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;IAC/C,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAsB,EACtB,QAAqC,EACrC,YAAgC;IAEhC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,oBAAoB,CAC5B,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS,IAAI,KAAK,CAAC,EAAE,KAAK,aAAa,EAAE,CAAC;YACzD,MAAM,IAAI,oBAAoB,CAC5B,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,oBAAoB,CAC5B,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAqC,EACrC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAC5B,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,YAAY;QAC5B,WAAW,EAAE,cAAc,CACzB,EAAE,IAAI,EAAE,MAAM,EAAE,EAChB,QAAQ,EACR,MAAM,CAAC,YAAY,CACpB;QACD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAsB;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,oBAAoB,CAC5B,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,uBAAuB,CAAC,GAAG,CAAC;QACrC,MAAM;QACN,YAAY,EAAE,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,SAAS;QAChE,WAAW,EAAE,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,SAAS;KAC7D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,0BAA0B,CAAC;IACzE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,uCAAuC,CAAC,CAAC;IAC1E,CAAC;IACD,IACE,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC9C,CAAC,MAAM,CAAC,QAAQ;QAChB,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,QAAQ;QACf,CAAC,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,IAAI,EACX,CAAC;QACD,MAAM,IAAI,oBAAoB,CAAC,uCAAuC,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC"}

package/dist/identity/index.d.ts

@@ -14,7 +14,7 @@ import type { IdentityConfig, IdentityDefinition, LangSmithApiKeyIngress, Valida
 export { normalizeGroups, userClaimName } from "./claims.js";
 export { normalizeIdentity } from "./options.js";
 export type { IdentityAuth, IdentityOptions } from "./options.js";
-export type { ClaimMapping, CredentialScope, HttpIngress, IdentityConfig, IdentityDefinition, LangSmithApiKeyIngress, RuntimeIdentity, ValidatedTokenIngress, ValidatedTokenProvider, } from "./types.js";
+export type { ClaimMapping, CredentialScope, HttpIngress, IdentityConfig, IdentityDefinition, IdentitySource, LangSmithApiKeyIngress, Link, LinkStatus, Principal, PrincipalClaims, PrincipalEnvelope, PrincipalKind, RuntimeIdentity, Subject, SubjectAuthority, ValidatedTokenIngress, ValidatedTokenProvider, } from "./types.js";
 /**
  * Declare the identity contract for the deployment.
  *