managed-deepagents 0.6.2-dev.2 → 0.6.2-dev.20

package/dist/credentials.js

@@ -0,0 +1,288 @@
+/**
+ * `credentials.get(...)` — read a managed credential from a tool.
+ *
+ * `owner` is the scope the credential resolves under, and names the same axis as
+ * Agent Auth's `owner_type` / `owner_id`. `{ type: "agent" }` is the deployment,
+ * so every caller resolves the same static secret. `{ type: "user" }` is the
+ * current caller, always backed by an OAuth grant. Resolution reads Agent Auth
+ * on every await and never caches.
+ *
+ * `mda dev` runs without a deployment, so it substitutes local values instead:
+ * `{ type: "agent" }` reads a normalized `MDA_DEV_*` environment variable, and
+ * `{ type: "user" }` has no local stand-in for an OAuth grant, so it fails with
+ * an actionable error. Both scopes work normally against a deployment.
+ */
+import { AGENT_AUTH_TIMEOUT_MS, AgentAuth, CredentialAuthorizationRequiredError, CredentialStoreError, } from "./agent-auth.js";
+import { buildRuntimeIdentity, resolveRuntimeConfigurable, } from "./runtime/identity-runtime.js";
+export { AGENT_AUTH_TIMEOUT_MS, AgentAuthUnknownProviderError, CredentialAuthorizationRequiredError, CredentialStoreError, } from "./agent-auth.js";
+const CREDENTIAL_REFERENCE = Symbol("managed-deepagents.credential");
+const SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const MAX_SLUG_LENGTH = 64;
+const DEFAULT_LANGSMITH_ENDPOINT = "https://api.smith.langchain.com";
+const DEV_CREDENTIAL_PREFIX = "MDA_DEV_";
+/**
+ * A user-owned credential is an OAuth grant held per caller against the
+ * deployment, and `mda dev` has no deployment to hold one.
+ */
+function localUserCredentialUnsupported(slug) {
+    const localHint = slug
+        ? `set ${agentCredentialEnvKey(slug)}`
+        : "set the corresponding MDA_DEV_<slug> variable";
+    return ("user-scoped credentials need a deployment, so they do not resolve in `mda dev`: " +
+        "deploy with `mda deploy` to exercise this credential, or declare it as " +
+        `{ type: "agent" } and ${localHint} for local runs`);
+}
+/** Agent Auth credential kinds, one per owner type. */
+const CREDENTIAL_KIND = { agent: "secret", user: "oauth2" };
+export class CredentialNotFoundError extends Error {
+    slug;
+    ownerType;
+    constructor(slug, ownerType) {
+        super(`no ${ownerType} credential is set for slug ${JSON.stringify(slug)}`);
+        this.name = "CredentialNotFoundError";
+        this.slug = slug;
+        this.ownerType = ownerType;
+    }
+}
+/**
+ * A declarative credential handle. Connector declarations inspect its owner;
+ * awaiting the same handle inside a tool resolves fresh material every time.
+ */
+export class CredentialReference {
+    slug;
+    owner;
+    accessor;
+    [CREDENTIAL_REFERENCE] = true;
+    constructor(slug, owner, accessor) {
+        this.slug = slug;
+        this.owner = owner;
+        this.accessor = accessor;
+    }
+    then(onfulfilled, onrejected) {
+        return this.accessor
+            .resolve(this.slug, this.owner)
+            .then(onfulfilled, onrejected);
+    }
+}
+export function isCredentialReference(value) {
+    return (value instanceof CredentialReference ||
+        (typeof value === "object" &&
+            value !== null &&
+            CREDENTIAL_REFERENCE in value));
+}
+export class AgentAuthCredentialStore {
+    env;
+    fetchImpl;
+    timeoutMs;
+    constructor(env = process.env, fetchImpl = fetch, timeoutMs = AGENT_AUTH_TIMEOUT_MS) {
+        this.env = env;
+        this.fetchImpl = fetchImpl;
+        this.timeoutMs = timeoutMs;
+    }
+    async fetch(request) {
+        // `mda dev` has no deployment to resolve against, so local values stand in
+        // for agent secrets and a user grant has nothing to stand in for.
+        if (this.env.MDA_LOCAL_DEV === "1") {
+            if (request.owner.type === "user") {
+                throw new CredentialStoreError(localUserCredentialUnsupported(request.slug));
+            }
+            const value = this.env[agentCredentialEnvKey(request.slug)];
+            if (value !== undefined && value.trim()) {
+                return value;
+            }
+            throw new CredentialStoreError(`local agent credential ${JSON.stringify(request.slug)} is not configured; ` +
+                `set ${agentCredentialEnvKey(request.slug)}`);
+        }
+        const config = resolveAgentAuthConfig(this.env);
+        const ownerId = resolveOwnerId(request.owner, request.identity, config.deploymentId);
+        const client = new AgentAuth({
+            baseUrl: config.baseUrl,
+            agentId: config.deploymentId ?? ownerId,
+            principalId: ownerId,
+            apiKey: config.apiKey,
+            workspaceId: config.workspaceId,
+        }, this.fetchImpl, this.timeoutMs);
+        if (request.owner.type === "user") {
+            return await client.readUserAccessToken(request.slug);
+        }
+        const credentialId = await client.findCredentialId({
+            ownerType: "agent",
+            ownerId,
+            kind: CREDENTIAL_KIND.agent,
+            slug: request.slug,
+        });
+        if (!credentialId)
+            return undefined;
+        return await client.readSecret(credentialId);
+    }
+}
+export class Credentials {
+    store;
+    constructor(store = new AgentAuthCredentialStore()) {
+        this.store = store;
+    }
+    get(slug, owner) {
+        return new CredentialReference(normalizeSlug(slug), normalizeOwner(owner), this);
+    }
+    async resolve(slug, owner) {
+        const configurable = resolveRuntimeConfigurable(undefined);
+        if (!configurable) {
+            throw new Error("credentials.get(...) must be awaited inside a run: resolve a credential in a tool or middleware, not at import time");
+        }
+        const value = await this.store.fetch({
+            slug,
+            owner,
+            identity: buildRuntimeIdentity(configurable),
+        });
+        if (value === undefined) {
+            throw owner.type === "user"
+                ? new CredentialAuthorizationRequiredError([slug])
+                : new CredentialNotFoundError(slug, owner.type);
+        }
+        return value;
+    }
+    /**
+     * Read an agent-owned secret outside a run.
+     *
+     * Connector declarations are loaded once per deployment, before any caller
+     * exists. An agent-owned secret is deployment-scoped, so it is the one lookup
+     * that carries no caller and can be resolved there.
+     */
+    async resolveDeploymentSecret(slug) {
+        const value = await this.store.fetch({
+            slug,
+            owner: { type: "agent" },
+        });
+        if (value === undefined) {
+            throw new CredentialNotFoundError(slug, "agent");
+        }
+        return value;
+    }
+}
+/** Environment variable used for one agent-owned development credential. */
+export function agentCredentialEnvKey(slug) {
+    return `${DEV_CREDENTIAL_PREFIX}${normalizeSlug(slug)
+        .toUpperCase()
+        .replaceAll("-", "_")}`;
+}
+function normalizeSlug(slug) {
+    if (typeof slug !== "string") {
+        throw new TypeError("credential slug must be a string");
+    }
+    const canonical = slug.trim();
+    if (!canonical ||
+        canonical.length > MAX_SLUG_LENGTH ||
+        !SLUG_PATTERN.test(canonical)) {
+        throw new TypeError(`credential slug ${JSON.stringify(slug)} is invalid: use lowercase letters, digits, and single hyphens, at most ${MAX_SLUG_LENGTH} characters`);
+    }
+    return canonical;
+}
+function normalizeOwner(owner) {
+    if (!owner || typeof owner !== "object") {
+        throw new TypeError('credential owner is required: pass { type: "agent" } or { type: "user" }');
+    }
+    const keys = Object.keys(owner);
+    if (keys.some((key) => key !== "type" && key !== "id")) {
+        throw new TypeError("credential owner has an unknown key");
+    }
+    if (owner.type === "agent") {
+        if ("id" in owner) {
+            throw new TypeError('credential owner "id" is not accepted for { type: "agent" }');
+        }
+        return { type: "agent" };
+    }
+    if (owner.type === "user") {
+        if (owner.id === undefined)
+            return { type: "user" };
+        if (typeof owner.id !== "string" || !owner.id.trim()) {
+            throw new TypeError('credential owner "id" must be a non-empty string');
+        }
+        return { type: "user", id: owner.id.trim() };
+    }
+    throw new TypeError("credential owner type is not supported");
+}
+/**
+ * The `owner_id` a lookup is keyed by: the caller for a user, else the
+ * deployment. Shared with the credential gate so a declared owner is checked
+ * the same way wherever it is resolved.
+ */
+export function resolveOwnerId(owner, identity, deploymentId) {
+    if (owner.type === "user") {
+        const authenticated = identity?.user.id;
+        if (!authenticated) {
+            throw new CredentialStoreError("user credentials require an authenticated user principal");
+        }
+        if (owner.id !== undefined && owner.id !== authenticated) {
+            throw new CredentialStoreError("user credential owner id must match the authenticated principal");
+        }
+        return authenticated;
+    }
+    if (!deploymentId) {
+        throw new CredentialStoreError("credentials are not configured: LANGSMITH_HOST_PROJECT_ID is not set");
+    }
+    return deploymentId;
+}
+/**
+ * The Agent Auth binding for one caller.
+ *
+ * `credentials.get` and the pre-run credential gate both resolve their owner id
+ * here, so a slug addresses the same Agent Auth row on either path.
+ */
+export function resolveAgentAuthContext(identity, env = process.env) {
+    // Only the user-credential gate resolves a context, so a local run can say
+    // why rather than reporting a missing deployment variable.
+    if (env.MDA_LOCAL_DEV === "1") {
+        throw new CredentialStoreError(localUserCredentialUnsupported());
+    }
+    const config = resolveAgentAuthConfig(env);
+    if (!config.deploymentId) {
+        throw new CredentialStoreError("credentials are not configured: LANGSMITH_HOST_PROJECT_ID is not set");
+    }
+    return {
+        baseUrl: config.baseUrl,
+        agentId: config.deploymentId,
+        principalId: resolveOwnerId({ type: "user" }, identity, config.deploymentId),
+        apiKey: config.apiKey,
+        workspaceId: config.workspaceId,
+    };
+}
+function resolveAgentAuthConfig(env) {
+    const apiKey = env.LANGSMITH_API_KEY?.trim();
+    if (!apiKey) {
+        throw new CredentialStoreError("credentials are not configured: LANGSMITH_API_KEY is not set");
+    }
+    return {
+        baseUrl: resolveAgentAuthBaseUrl(env),
+        apiKey,
+        deploymentId: env.LANGSMITH_HOST_PROJECT_ID?.trim() || undefined,
+        workspaceId: env.LANGSMITH_WORKSPACE_ID?.trim() || undefined,
+    };
+}
+/**
+ * Agent Auth is served by the LangSmith API.
+ *
+ * Rejects a URL that carries a path, query, or userinfo, so a misconfigured
+ * endpoint cannot send the API key at a different service.
+ */
+export function resolveAgentAuthBaseUrl(env = process.env) {
+    const raw = env.LANGSMITH_ENDPOINT?.trim() || DEFAULT_LANGSMITH_ENDPOINT;
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new CredentialStoreError("LANGSMITH_ENDPOINT is not a valid URL");
+    }
+    if (!["http:", "https:"].includes(parsed.protocol) ||
+        !parsed.hostname ||
+        parsed.username ||
+        parsed.password ||
+        (parsed.pathname !== "/" && parsed.pathname !== "") ||
+        parsed.search ||
+        parsed.hash) {
+        throw new CredentialStoreError("LANGSMITH_ENDPOINT is not a valid URL");
+    }
+    return parsed.origin;
+}
+export const credentials = new Credentials();
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EACL,qBAAqB,EACrB,SAAS,EACT,oCAAoC,EACpC,oBAAoB,GAErB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,oCAAoC,EACpC,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AAazB,MAAM,oBAAoB,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;AACrE,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAClD,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,0BAA0B,GAAG,iCAAiC,CAAC;AACrE,MAAM,qBAAqB,GAAG,UAAU,CAAC;AACzC;;;GAGG;AACH,SAAS,8BAA8B,CAAC,IAAa;IACnD,MAAM,SAAS,GAAG,IAAI;QACpB,CAAC,CAAC,OAAO,qBAAqB,CAAC,IAAI,CAAC,EAAE;QACtC,CAAC,CAAC,+CAA+C,CAAC;IACpD,OAAO,CACL,kFAAkF;QAClF,yEAAyE;QACzE,yBAAyB,SAAS,iBAAiB,CACpD,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,eAAe,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAW,CAAC;AAErE,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,CAAS;IACb,SAAS,CAA0B;IAE5C,YAAY,IAAY,EAAE,SAAkC;QAC1D,KAAK,CAAC,MAAM,SAAS,+BAA+B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IAInB,IAAI;IACJ,KAAK;IACG,QAAQ;IALlB,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC;IAEvC,YACW,IAAY,EACZ,KAAsB,EACd,QAAqB;oBAF7B,IAAI;qBACJ,KAAK;wBACG,QAAQ;IACxB,CAAC;IAEJ,IAAI,CACF,WAA0E,EAC1E,UAA2E;QAE3E,OAAO,IAAI,CAAC,QAAQ;aACjB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;aAC9B,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACnC,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAc;IAEd,OAAO,CACL,KAAK,YAAY,mBAAmB;QACpC,CAAC,OAAO,KAAK,KAAK,QAAQ;YACxB,KAAK,KAAK,IAAI;YACd,oBAAoB,IAAI,KAAK,CAAC,CACjC,CAAC;AACJ,CAAC;AASD,MAAM,OAAO,wBAAwB;IAEhB,GAAG;IACH,SAAS;IACT,SAAS;IAH5B,YACmB,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,SAAS,GAAiB,KAAK,EAC/B,SAAS,GAAG,qBAAqB;mBAFjC,GAAG;yBACH,SAAS;yBACT,SAAS;IACzB,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,OAA0B;QACpC,2EAA2E;QAC3E,kEAAkE;QAClE,IAAI,IAAI,CAAC,GAAG,CAAC,aAAa,KAAK,GAAG,EAAE,CAAC;YACnC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAClC,MAAM,IAAI,oBAAoB,CAC5B,8BAA8B,CAAC,OAAO,CAAC,IAAI,CAAC,CAC7C,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBACxC,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;gBAC1E,OAAO,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,cAAc,CAC5B,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,QAAQ,EAChB,MAAM,CAAC,YAAY,CACpB,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B;YACE,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,YAAY,IAAI,OAAO;YACvC,WAAW,EAAE,OAAO;YACpB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,EACD,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACf,CAAC;QACF,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,MAAM,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC;YACjD,SAAS,EAAE,OAAO;YAClB,OAAO;YACP,IAAI,EAAE,eAAe,CAAC,KAAK;YAC3B,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QACpC,OAAO,MAAM,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,OAAO,WAAW;IAEH,KAAK;IADxB,YACmB,KAAK,GAA6B,IAAI,wBAAwB,EAAE;qBAAhE,KAAK;IACrB,CAAC;IAEJ,GAAG,CAAC,IAAY,EAAE,KAAsB;QACtC,OAAO,IAAI,mBAAmB,CAC5B,aAAa,CAAC,IAAI,CAAC,EACnB,cAAc,CAAC,KAAK,CAAC,EACrB,IAAI,CACL,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,KAAsB;QAChD,MAAM,YAAY,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,qHAAqH,CACtH,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YACnC,IAAI;YACJ,KAAK;YACL,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC;SAC7C,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,KAAK,CAAC,IAAI,KAAK,MAAM;gBACzB,CAAC,CAAC,IAAI,oCAAoC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAClD,CAAC,CAAC,IAAI,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,uBAAuB,CAAC,IAAY;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YACnC,IAAI;YACJ,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACzB,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,GAAG,qBAAqB,GAAG,aAAa,CAAC,IAAI,CAAC;SAClD,WAAW,EAAE;SACb,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9B,IACE,CAAC,SAAS;QACV,SAAS,CAAC,MAAM,GAAG,eAAe;QAClC,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAC7B,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2EAA2E,eAAe,aAAa,CAC/I,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,KAAsB;IAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,SAAS,CACjB,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,SAAS,CACjB,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACpD,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;IAC/C,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAsB,EACtB,QAAqC,EACrC,YAAgC;IAEhC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,oBAAoB,CAC5B,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS,IAAI,KAAK,CAAC,EAAE,KAAK,aAAa,EAAE,CAAC;YACzD,MAAM,IAAI,oBAAoB,CAC5B,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,oBAAoB,CAC5B,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAqC,EACrC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,2EAA2E;IAC3E,2DAA2D;IAC3D,IAAI,GAAG,CAAC,aAAa,KAAK,GAAG,EAAE,CAAC;QAC9B,MAAM,IAAI,oBAAoB,CAAC,8BAA8B,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAC5B,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,YAAY;QAC5B,WAAW,EAAE,cAAc,CACzB,EAAE,IAAI,EAAE,MAAM,EAAE,EAChB,QAAQ,EACR,MAAM,CAAC,YAAY,CACpB;QACD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAsB;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,oBAAoB,CAC5B,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,uBAAuB,CAAC,GAAG,CAAC;QACrC,MAAM;QACN,YAAY,EAAE,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,SAAS;QAChE,WAAW,EAAE,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,SAAS;KAC7D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,0BAA0B,CAAC;IACzE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,uCAAuC,CAAC,CAAC;IAC1E,CAAC;IACD,IACE,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC9C,CAAC,MAAM,CAAC,QAAQ;QAChB,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,QAAQ;QACf,CAAC,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,IAAI,EACX,CAAC;QACD,MAAM,IAAI,oBAAoB,CAAC,uCAAuC,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC"}

package/dist/identity/index.d.ts

@@ -14,7 +14,7 @@ import type { IdentityConfig, IdentityDefinition, LangSmithApiKeyIngress, Valida
 export { normalizeGroups, userClaimName } from "./claims.js";
 export { normalizeIdentity } from "./options.js";
 export type { IdentityAuth, IdentityOptions } from "./options.js";
-export type { ClaimMapping, CredentialScope, HttpIngress, IdentityConfig, IdentityDefinition, LangSmithApiKeyIngress, RuntimeIdentity, ValidatedTokenIngress, ValidatedTokenProvider, } from "./types.js";
+export type { ClaimMapping, CredentialScope, HttpIngress, IdentityConfig, IdentityDefinition, IdentitySource, LangSmithApiKeyIngress, Link, LinkStatus, Principal, PrincipalClaims, PrincipalEnvelope, PrincipalKind, RuntimeIdentity, Subject, SubjectAuthority, ValidatedTokenIngress, ValidatedTokenProvider, } from "./types.js";
 /**
  * Declare the identity contract for the deployment.
  *

package/dist/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,KAAK,uBAAuB,EAAoB,MAAM,eAAe,CAAC;AAC/E,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EAEtB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAElE,YAAY,EACV,YAAY,EACZ,eAAe,EACf,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,kBAAkB,CAI3E;AAED;;;GAGG;AACH,eAAO,MAAM,IAAI;IACf,2EAA2E;IAC3E,eAAe,IAAI,sBAAsB;IAGzC,oCAAoC;IACpC,QAAQ,UAAU,uBAAuB,GAAG,sBAAsB;CAGnE,CAAC;AAEF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAuC7D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,KAAK,uBAAuB,EAAoB,MAAM,eAAe,CAAC;AAC/E,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EAEtB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAElE,YAAY,EACV,YAAY,EACZ,eAAe,EACf,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,IAAI,EACJ,UAAU,EACV,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,OAAO,EACP,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,kBAAkB,CAI3E;AAED;;;GAGG;AACH,eAAO,MAAM,IAAI;IACf,2EAA2E;IAC3E,eAAe,IAAI,sBAAsB;IAGzC,oCAAoC;IACpC,QAAQ,UAAU,uBAAuB,GAAG,sBAAsB;CAGnE,CAAC;AAEF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAuC7D"}

package/dist/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAwB,MAAM,cAAc,CAAC;AACvE,OAAO,EAAgC,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAS/E,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAejD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAAC,OAAwB;IACrD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,2EAA2E;IAC3E,eAAe;QACb,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IACvC,CAAC;IACD,oCAAoC;IACpC,QAAQ,CAAC,OAAgC;QACvC,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAyC,CAAC;IACjE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAER,CAAC;IACd,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,wDAAwD;YACtD,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,sEAAsE;YACtE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,MAAM,IAAI,GAAI,OAA6B,CAAC,IAAI,CAAC;IACjD,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,4DAA4D;IAC9D,CAAC;SAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,iJAAiJ,CAClJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA2B,CAAC,IAAI,KAAK,mBAAmB,CAC1D,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA2B,CAAC,IAAI,KAAK,iBAAiB,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAA2B;IACzD,MAAM,IAAI,GAAI,IAAgC,CAAC,SAAS,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAA+B,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,EAAE,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,qBAAqB,CAC3E,CAAC;QACJ,CAAC;QACD,IACE,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;YACnC,QAAQ,CAAC,MAAM,KAAK,IAAI;YACxB,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,4BAA4B,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GACf,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;YACjC,QAAQ,CAAC,QAAQ,KAAK,IAAI;YAC1B,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ;YACzC,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC;QACpC,0EAA0E;QAC1E,mDAAmD;QACnD,IACE,WAAW;YACX,QAAQ,CAAC,UAAU,KAAK,SAAS;YACjC,CAAC,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,EACzE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,uDAAuD,CAC7G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,mFAAmF,CACzI,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAwB,MAAM,cAAc,CAAC;AACvE,OAAO,EAAgC,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAS/E,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAwBjD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAAC,OAAwB;IACrD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,2EAA2E;IAC3E,eAAe;QACb,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IACvC,CAAC;IACD,oCAAoC;IACpC,QAAQ,CAAC,OAAgC;QACvC,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAyC,CAAC;IACjE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAER,CAAC;IACd,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,wDAAwD;YACtD,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,sEAAsE;YACtE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,MAAM,IAAI,GAAI,OAA6B,CAAC,IAAI,CAAC;IACjD,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,4DAA4D;IAC9D,CAAC;SAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,iJAAiJ,CAClJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA2B,CAAC,IAAI,KAAK,mBAAmB,CAC1D,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA2B,CAAC,IAAI,KAAK,iBAAiB,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAA2B;IACzD,MAAM,IAAI,GAAI,IAAgC,CAAC,SAAS,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAA+B,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,EAAE,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,qBAAqB,CAC3E,CAAC;QACJ,CAAC;QACD,IACE,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;YACnC,QAAQ,CAAC,MAAM,KAAK,IAAI;YACxB,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,4BAA4B,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GACf,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;YACjC,QAAQ,CAAC,QAAQ,KAAK,IAAI;YAC1B,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ;YACzC,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC;QACpC,0EAA0E;QAC1E,mDAAmD;QACnD,IACE,WAAW;YACX,QAAQ,CAAC,UAAU,KAAK,SAAS;YACjC,CAAC,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,EACzE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,uDAAuD,CAC7G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,mFAAmF,CACzI,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/identity/types.d.ts

@@ -86,22 +86,96 @@ export interface ValidatedTokenProvider {
     claims: ClaimMapping;
 }
 /**
- * Which verified token claim supplies each identity envelope field.
+ * Which verified token claim supplies each principal field.
  *
  * `user` is required; `defineIdentity` rejects a provider that omits it.
  */
 export interface ClaimMapping {
-    /** Claim used as `runtime.identity.user.id` (e.g. "sub", "email"). */
+    /** Claim used as `runtime.serverInfo.principal.id` (e.g. "sub", "email"). */
     user?: string;
     /**
      * Claim carrying every group the caller belongs to. Accepts a JSON array, or a
-     * comma/space-delimited string. Read by tools for authorization.
+     * comma/space-delimited string. Folded into `principal.claims.groups`.
      */
     groups?: string;
-    /** Claim used as `runtime.identity.user.email`. */
+    /** Claim folded into `principal.claims.email`. */
     email?: string;
 }
-/** The frozen identity envelope tools and middleware see. */
+/**
+ * Agent Auth–aligned identity types for the current run.
+ *
+ * Author surface on LangGraph `serverInfo` (flattened, no nested envelope bag):
+ * `runtime.serverInfo.principal` / `.subject` / `.link`. Reassemble into
+ * {@link PrincipalEnvelope} when calling Agent Auth mint.
+ *
+ * Fields MDA cannot yet fill use conservative defaults
+ * (`link.status: "not_required"`, `subject.agent_id: ""`).
+ */
+export type PrincipalKind = "person" | "service" | "channel";
+export type SubjectAuthority = "agent" | "user";
+export type LinkStatus = "not_required" | "linked" | "unlinked" | "pending";
+/**
+ * The caller's claim bag.
+ *
+ * Mostly the verified token payload, passed through as the IdP sent it. The two
+ * claims MDA gives a name to are normalized before they land here, whether or
+ * not the deployment mapped them in `ClaimMapping`: `groups` is always a string
+ * array (IdPs send arrays or delimited strings), and `email` is always a string.
+ * An unmapped claim of either name that cannot be normalized is dropped rather
+ * than passed through, so the declared type always holds.
+ */
+export interface PrincipalClaims {
+    /** Every group the caller's token asserts. Never a raw delimited string. */
+    groups?: readonly string[];
+    email?: string;
+    [claim: string]: unknown;
+}
+export interface Principal {
+    id: string;
+    kind: PrincipalKind;
+    claims: PrincipalClaims;
+}
+export interface Subject {
+    authority: SubjectAuthority;
+    /**
+     * Deployment / agent id. Omitted when the platform supplied neither an
+     * assistant nor a graph id, so an Agent Auth call fails on a missing field
+     * rather than silently addressing the empty agent.
+     */
+    agent_id?: string;
+    /** Present when `authority === "user"`. */
+    user_id?: string;
+}
+/**
+ * Where the run entered from, as stamped by trusted managed ingress.
+ *
+ * This is MDA's own ingress record, not part of the Agent Auth envelope, so it
+ * sits beside `principal` on `serverInfo` instead of inside it.
+ */
+export interface IdentitySource {
+    /**
+     * Ingress source. Built-ins include `http`, `schedule`, `cli`, `studio`,
+     * plus channel providers (`slack`, `github`, or any registered plugin key).
+     */
+    provider: string;
+    threadId?: string;
+}
+export interface Link {
+    status: LinkStatus;
+    from?: string;
+    to?: string;
+}
+/** Wire shape for Agent Auth (`principal_envelope` on resolve/mint). */
+export interface PrincipalEnvelope {
+    principal: Principal;
+    subject: Subject;
+    link: Link;
+}
+/**
+ * Frozen identity bag for HTTP connector route handlers
+ * (`resolveRequestIdentity`). Tools/middleware use `serverInfo.principal`
+ * (plus `subject` / `link`) instead.
+ */
 export interface RuntimeIdentity {
     /** The caller. `kind: "service"` for machine callers (schedules, channels, Studio). */
     user: {

package/dist/identity/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GACnB,SAAS,GACT,sBAAsB,GACtB,qBAAqB,CAAC;AAE1B,qEAAqE;AACrE,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,mBAAmB,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,IAAI,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN;;;WAGG;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF;;;OAGG;IACH,KAAK,EAAE;QACL,2EAA2E;QAC3E,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;CACH;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GACnB,SAAS,GACT,sBAAsB,GACtB,qBAAqB,CAAC;AAE1B,qEAAqE;AACrE,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,mBAAmB,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAC7D,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,MAAM,CAAC;AAChD,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAE5E;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,gBAAgB,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,IAAI;IACnB,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,IAAI,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN;;;WAGG;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF;;;OAGG;IACH,KAAK,EAAE;QACL,2EAA2E;QAC3E,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;CACH;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC"}

package/dist/index.d.ts

@@ -3,6 +3,7 @@ export { defineSchedule } from "./schedules.js";
 export { defineIdentity } from "./identity/index.js";
 export { defineMemory } from "./memory/index.js";
 export { auth, channels } from "./namespaces.js";
+export { credentials, CredentialAuthorizationRequiredError, CredentialNotFoundError, CredentialStoreError, } from "./credentials.js";
 export { defineSandbox } from "./sandbox.js";
 export type { Channels } from "./namespaces.js";
 import { mcpConnector } from "./connectors/mcp/index.js";
@@ -12,8 +13,10 @@ import { mcpConnector } from "./connectors/mcp/index.js";
 export interface Connectors {
     /**
      * Declare remote MCP servers (HTTP/SSE) whose tools load at agent-graph
-     * construction. Stdio servers are not supported. Use static `headers` (or
-     * similar) when the server needs credentials — roll your own auth.
+     * construction. Stdio servers are not supported. A server may name a
+     * credential; in `mda dev`, an agent-owned one resolves from a normalized
+     * `MDA_DEV_*` environment variable instead of the deployment's Agent Auth
+     * secret.
      *
      * @example
      * ```ts
@@ -22,7 +25,7 @@ export interface Connectors {
      *     docs: {
      *       transport: "http",
      *       url: "https://docs.example.com/mcp",
-     *       headers: { Authorization: `Bearer ${process.env.DOCS_TOKEN}` },
+     *       credential: credentials.get("docs-token", { type: "agent" }),
      *     },
      *   },
      * });
@@ -34,13 +37,15 @@ export interface Connectors {
 }
 /** Public connectors namespace — MCP only for this release. */
 export declare const connectors: Connectors;
+export type { AgentCredentialOwner, CredentialOwner, CredentialRequest, UserCredentialOwner, } from "./credentials.js";
 export type { DeepAgentDefinition, DefineDeepAgentConfig, ManagedDeepAgentKey, } from "./types.js";
 export type { ScheduleConfig, ScheduleDefinition, ScheduleDeliveryTarget, ScheduleThreadConfig, } from "./schedules.js";
-export type { ClaimMapping, CredentialScope, HttpIngress, IdentityAuth, IdentityConfig, IdentityDefinition, IdentityOptions, LangSmithApiKeyIngress, RuntimeIdentity, ValidatedTokenIngress, ValidatedTokenProvider, } from "./identity/index.js";
+export type { ClaimMapping, CredentialScope, HttpIngress, IdentityAuth, IdentityConfig, IdentityDefinition, IdentityOptions, IdentitySource, LangSmithApiKeyIngress, Link, LinkStatus, Principal, PrincipalClaims, PrincipalEnvelope, PrincipalKind, RuntimeIdentity, Subject, SubjectAuthority, ValidatedTokenIngress, ValidatedTokenProvider, } from "./identity/index.js";
 export type { MemoryConfig, MemoryDefinition, MemoryOptions, MemoryScope, MemoryScopeInput, MemorySliceInput, MemorySliceKind, ResolvedMemorySlice, } from "./memory/index.js";
-export type { HttpMcpServerConfig, McpServersConfig, McpServersDefinition, McpToolSelectionConfig, RemoteMcpServerBaseConfig, RemoteMcpServerConfig, SseMcpServerConfig, } from "./connectors/mcp/index.js";
+export type { HttpMcpServerConfig, McpServersConfig, McpServersDefinition, McpServerCredential, McpToolSelectionConfig, RemoteMcpServerBaseConfig, RemoteMcpServerConfig, SseMcpServerConfig, } from "./connectors/mcp/index.js";
+export type { CredentialAuthorizationRequiredInterrupt, PendingCredential, } from "./credential-gate.js";
 export type { ChannelManifest } from "./channels/manifest.js";
 export type { RequiredTriggerSlackChannelConfig, SlackChannel, SlackChannelConfig, } from "./channels/slack/index.js";
 export type { SandboxDefinition, SandboxOptions } from "./sandbox.js";
-export type { ManagedDeepAgentRuntime, ManagedRuntimeExtras, } from "./runtime/managed-tools.js";
+export type { ManagedDeepAgentRuntime, ManagedServerInfo, } from "./runtime/managed-tools.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,GAAG,EAAE,OAAO,YAAY,CAAC;CAC1B;AAED,+DAA+D;AAC/D,eAAO,MAAM,UAAU,EAAE,UAExB,CAAC;AAEF,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,YAAY,EACZ,eAAe,EACf,WAAW,EACX,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,iCAAiC,EACjC,YAAY,EACZ,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEtE,YAAY,EACV,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,WAAW,EACX,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,GAAG,EAAE,OAAO,YAAY,CAAC;CAC1B;AAED,+DAA+D;AAC/D,eAAO,MAAM,UAAU,EAAE,UAExB,CAAC;AAEF,YAAY,EACV,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,YAAY,EACZ,eAAe,EACf,WAAW,EACX,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,IAAI,EACJ,UAAU,EACV,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,OAAO,EACP,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,wCAAwC,EACxC,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,iCAAiC,EACjC,YAAY,EACZ,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEtE,YAAY,EACV,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -3,6 +3,7 @@ export { defineSchedule } from "./schedules.js";
 export { defineIdentity } from "./identity/index.js";
 export { defineMemory } from "./memory/index.js";
 export { auth, channels } from "./namespaces.js";
+export { credentials, CredentialAuthorizationRequiredError, CredentialNotFoundError, CredentialStoreError, } from "./credentials.js";
 export { defineSandbox } from "./sandbox.js";
 import { mcpConnector } from "./connectors/mcp/index.js";
 /** Public connectors namespace — MCP only for this release. */

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AA6BzD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,GAAG,EAAE,YAAY;CAClB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,WAAW,EACX,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AA+BzD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,GAAG,EAAE,YAAY;CAClB,CAAC"}

package/dist/runtime/auth.d.ts

@@ -30,16 +30,21 @@ export declare const LANGCHAIN_API_KEY_ENV = "LANGCHAIN_API_KEY";
 /** Internal Trigger-channel principal used to start and observe Agent runs. */
 export declare const CHANNEL_SERVICE_USER = "mda:channel";
 /**
- * The user object `@auth.authenticate` returns. `identity`/`permissions` satisfy
- * the LangGraph base shape; the `mda_*` fields carry the identity envelope into
- * `config.configurable.langgraph_auth_user` for the runtime seam.
+ * LangGraph AuthUser returned by `@auth.authenticate` and stored on
+ * `langgraph_auth_user` / `serverInfo.user`.
+ *
+ * Transport for auth + authorization — not the author identity surface. Tools
+ * and middleware should read `runtime.serverInfo.principal` (Agent Auth–aligned
+ * caller). The `mda_*` stamps stay internal; the managed seam projects them
+ * into `principal` / `subject` / `link` on `serverInfo`.
  */
 export interface ManagedUser {
     identity: string;
     permissions: string[];
+    /** Subject id stamped by managed auth (internal; prefer `serverInfo.principal`). */
     mda_user_id: string;
     mda_user_email?: string;
-    /** Resolved group memberships; read-only, never an isolation key. */
+    /** Resolved group memberships; never an isolation key. */
     mda_groups?: string[];
     mda_claims?: Record<string, unknown>;
     /** Trusted source provider stamped by managed ingress (never client-supplied). */
@@ -55,6 +60,22 @@ export interface ManagedUser {
  * Also registers thread and store scoping with a studio bypass.
  */
 export declare function buildManagedAuth(identity: IdentityDefinition): Auth;
+/**
+ * Reject (403) every resource/action pair except reading or searching
+ * assistants, covering the resources managed auth does not scope per caller.
+ *
+ * `assistants` and `crons` are deployment-owned: assistants come from the
+ * compiled project and crons from `schedules/**`, both provisioned by `mda
+ * deploy` as a workspace/Studio principal. No runtime caller needs to mutate
+ * either, and `crons:create` accepts a `thread_id`, which would let a caller
+ * schedule a run against a thread the thread-ownership filter would otherwise
+ * put out of reach.
+ *
+ * Assistant reads stay open so clients can enumerate the deployment's agents;
+ * that exposes `graph_id` and assistant config, which is deploy-authored rather
+ * than caller data.
+ */
+export declare function denyUnlessAssistantRead(resource: string, action: string): void;
 /**
  * Resolve the caller's frozen {@link RuntimeIdentity} from a raw HTTP request,
  * using the same ingress logic (`trusted_backend` headers / `validated_token`
@@ -93,6 +114,12 @@ export declare const IDENTITY_LINKS_SERVICE_USER = "mda:identity-links";
  *
  * There is no per-caller store partition to enforce beyond that, because no
  * declaration mounts per-caller state in this release.
+ *
+ * Studio and local-dev principals are deliberately **not** exempt here. Studio
+ * identity is reachable by any holder of a workspace LangSmith API key (via the
+ * `x-auth-scheme: langsmith` ingress the Agent Server honours), and nothing
+ * legitimately reads these tables that way: the managed link client stamps
+ * {@link IDENTITY_LINKS_SERVICE_USER} behind the handoff/ingress secret.
  */
 export declare function assertStoreAccess(user: ManagedUser, value: unknown): void;
 /**

package/dist/runtime/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/runtime/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EAGL,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EAEvB,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAC;AAI9B;;;;;GAKG;AACH,oFAAoF;AACpF,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,qBAAqB,yBAAyB,CAAC;AAC5D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,0BAA0B,CAAC;AAC9D,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAE7D,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,qBAAqB,yBAAyB,CAAC;AAE5D,mDAAmD;AACnD,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AACrE,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,eAAO,MAAM,wBAAwB,cAAc,CAAC;AACpD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,gBAAgB,CAAC;AAuClD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,kFAAkF;IAClF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oEAAoE;IACpE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAkDnE;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,eAAe,CAAC,CA4B1B;AAED,uEAAuE;AACvE,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAEhE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,2BAA2B,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAsBzE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,WAAW,CASb;AA+FD,8EAA8E;AAC9E,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,WAAW,CAAC,CA+EtB;AAiBD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAgB7D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,OAAO,GACf,WAAW,GAAG,IAAI,CASpB;AAYD,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAExD;AAkBD,qFAAqF;AACrF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAQhE;AAED,gFAAgF;AAChF,wBAAgB,uBAAuB,IAAI,WAAW,CAMrD"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/runtime/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EAGL,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EAEvB,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAC;AAI9B;;;;;GAKG;AACH,oFAAoF;AACpF,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,qBAAqB,yBAAyB,CAAC;AAC5D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,0BAA0B,CAAC;AAC9D,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAE7D,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,qBAAqB,yBAAyB,CAAC;AAE5D,mDAAmD;AACnD,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AACrE,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,eAAO,MAAM,wBAAwB,cAAc,CAAC;AACpD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,gBAAgB,CAAC;AAuClD;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,kFAAkF;IAClF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oEAAoE;IACpE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAyEnE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,IAAI,CAON;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,eAAe,CAAC,CA4B1B;AAED,uEAAuE;AACvE,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAEhE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,2BAA2B,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAsBzE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,WAAW,CASb;AA+FD,8EAA8E;AAC9E,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,WAAW,CAAC,CA+EtB;AAiBD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAgB7D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,OAAO,GACf,WAAW,GAAG,IAAI,CASpB;AAYD,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAMxD;AAkBD,qFAAqF;AACrF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAQhE;AAED,gFAAgF;AAChF,wBAAgB,uBAAuB,IAAI,WAAW,CAMrD"}