managed-deepagents 0.6.2-dev.20 → 0.6.2-dev.22

package/dist/{credentials.js → connections.js}

@@ -1,58 +1,45 @@
 /**
- * `credentials.get(...)` — read a managed credential from a tool.
+ * `connections.get(...)` — read a managed connection from a tool.
  *
- * `owner` is the scope the credential resolves under, and names the same axis as
- * Agent Auth's `owner_type` / `owner_id`. `{ type: "agent" }` is the deployment,
- * so every caller resolves the same static secret. `{ type: "user" }` is the
- * current caller, always backed by an OAuth grant. Resolution reads Agent Auth
- * on every await and never caches.
+ * `{ type: "agent" }` resolves shared workspace material on the connection row.
+ * `{ type: "user" }` resolves per-caller grants (OAuth or opaque). Resolution
+ * reads Agent Auth on every await and never caches.
  *
- * `mda dev` runs without a deployment, so it substitutes local values instead:
- * `{ type: "agent" }` reads a normalized `MDA_DEV_*` environment variable, and
- * `{ type: "user" }` has no local stand-in for an OAuth grant, so it fails with
- * an actionable error. Both scopes work normally against a deployment.
+ * `mda dev` substitutes local values for agent opaque secrets via `MDA_DEV_*`.
+ * User-owned connections need a deployment; opaque user grants use the same
+ * pre-run gate as OAuth.
  */
 import { AGENT_AUTH_TIMEOUT_MS, AgentAuth, CredentialAuthorizationRequiredError, CredentialStoreError, } from "./agent-auth.js";
 import { buildRuntimeIdentity, resolveRuntimeConfigurable, } from "./runtime/identity-runtime.js";
 export { AGENT_AUTH_TIMEOUT_MS, AgentAuthUnknownProviderError, CredentialAuthorizationRequiredError, CredentialStoreError, } from "./agent-auth.js";
-const CREDENTIAL_REFERENCE = Symbol("managed-deepagents.credential");
+const CONNECTION_REFERENCE = Symbol("managed-deepagents.connection");
 const SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 const MAX_SLUG_LENGTH = 64;
 const DEFAULT_LANGSMITH_ENDPOINT = "https://api.smith.langchain.com";
 const DEV_CREDENTIAL_PREFIX = "MDA_DEV_";
-/**
- * A user-owned credential is an OAuth grant held per caller against the
- * deployment, and `mda dev` has no deployment to hold one.
- */
-function localUserCredentialUnsupported(slug) {
+function localUserConnectionUnsupported(slug) {
     const localHint = slug
-        ? `set ${agentCredentialEnvKey(slug)}`
+        ? `set ${agentConnectionEnvKey(slug)}`
         : "set the corresponding MDA_DEV_<slug> variable";
-    return ("user-scoped credentials need a deployment, so they do not resolve in `mda dev`: " +
-        "deploy with `mda deploy` to exercise this credential, or declare it as " +
+    return ("user-owned connections need a deployment, so they do not resolve in `mda dev`: " +
+        "deploy with `mda deploy` to exercise this connection, or declare it as " +
         `{ type: "agent" } and ${localHint} for local runs`);
 }
-/** Agent Auth credential kinds, one per owner type. */
-const CREDENTIAL_KIND = { agent: "secret", user: "oauth2" };
-export class CredentialNotFoundError extends Error {
+export class ConnectionNotFoundError extends Error {
     slug;
     ownerType;
     constructor(slug, ownerType) {
-        super(`no ${ownerType} credential is set for slug ${JSON.stringify(slug)}`);
-        this.name = "CredentialNotFoundError";
+        super(`no ${ownerType} connection is set for slug ${JSON.stringify(slug)}`);
+        this.name = "ConnectionNotFoundError";
         this.slug = slug;
         this.ownerType = ownerType;
     }
 }
-/**
- * A declarative credential handle. Connector declarations inspect its owner;
- * awaiting the same handle inside a tool resolves fresh material every time.
- */
-export class CredentialReference {
+export class ConnectionReference {
     slug;
     owner;
     accessor;
-    [CREDENTIAL_REFERENCE] = true;
+    [CONNECTION_REFERENCE] = true;
     constructor(slug, owner, accessor) {
         this.slug = slug;
         this.owner = owner;
@@ -64,13 +51,13 @@ export class CredentialReference {
             .then(onfulfilled, onrejected);
     }
 }
-export function isCredentialReference(value) {
-    return (value instanceof CredentialReference ||
+export function isConnectionReference(value) {
+    return (value instanceof ConnectionReference ||
         (typeof value === "object" &&
             value !== null &&
-            CREDENTIAL_REFERENCE in value));
+            CONNECTION_REFERENCE in value));
 }
-export class AgentAuthCredentialStore {
+export class AgentAuthConnectionStore {
     env;
     fetchImpl;
     timeoutMs;
@@ -80,18 +67,16 @@ export class AgentAuthCredentialStore {
         this.timeoutMs = timeoutMs;
     }
     async fetch(request) {
-        // `mda dev` has no deployment to resolve against, so local values stand in
-        // for agent secrets and a user grant has nothing to stand in for.
         if (this.env.MDA_LOCAL_DEV === "1") {
             if (request.owner.type === "user") {
-                throw new CredentialStoreError(localUserCredentialUnsupported(request.slug));
+                throw new CredentialStoreError(localUserConnectionUnsupported(request.slug));
             }
-            const value = this.env[agentCredentialEnvKey(request.slug)];
+            const value = this.env[agentConnectionEnvKey(request.slug)];
             if (value !== undefined && value.trim()) {
                 return value;
             }
-            throw new CredentialStoreError(`local agent credential ${JSON.stringify(request.slug)} is not configured; ` +
-                `set ${agentCredentialEnvKey(request.slug)}`);
+            throw new CredentialStoreError(`local agent connection ${JSON.stringify(request.slug)} is not configured; ` +
+                `set ${agentConnectionEnvKey(request.slug)}`);
         }
         const config = resolveAgentAuthConfig(this.env);
         const ownerId = resolveOwnerId(request.owner, request.identity, config.deploymentId);
@@ -102,32 +87,44 @@ export class AgentAuthCredentialStore {
             apiKey: config.apiKey,
             workspaceId: config.workspaceId,
         }, this.fetchImpl, this.timeoutMs);
-        if (request.owner.type === "user") {
-            return await client.readUserAccessToken(request.slug);
+        const row = await client.findWorkspaceConnection(request.slug);
+        if (!row) {
+            return undefined;
         }
-        const credentialId = await client.findCredentialId({
-            ownerType: "agent",
-            ownerId,
-            kind: CREDENTIAL_KIND.agent,
-            slug: request.slug,
-        });
-        if (!credentialId)
+        if (request.owner.type === "user") {
+            if (row.kind === "secret") {
+                return await client.readUserSecret(request.slug);
+            }
+            if (row.kind === "oauth2") {
+                return await client.readUserAccessToken(request.slug);
+            }
             return undefined;
-        return await client.readSecret(credentialId);
+        }
+        if (row.kind === "secret") {
+            const credentialId = await client.findWorkspaceCredentialId(request.slug);
+            if (!credentialId) {
+                return undefined;
+            }
+            return await client.readSecret(credentialId);
+        }
+        if (row.kind === "oauth2") {
+            return await client.readConnectionAccessToken(row.connectionId);
+        }
+        return undefined;
     }
 }
-export class Credentials {
+export class Connections {
     store;
-    constructor(store = new AgentAuthCredentialStore()) {
+    constructor(store = new AgentAuthConnectionStore()) {
         this.store = store;
     }
     get(slug, owner) {
-        return new CredentialReference(normalizeSlug(slug), normalizeOwner(owner), this);
+        return new ConnectionReference(normalizeSlug(slug), normalizeOwner(owner), this);
     }
     async resolve(slug, owner) {
         const configurable = resolveRuntimeConfigurable(undefined);
         if (!configurable) {
-            throw new Error("credentials.get(...) must be awaited inside a run: resolve a credential in a tool or middleware, not at import time");
+            throw new Error("connections.get(...) must be awaited inside a run: resolve a connection in a tool or middleware, not at import time");
         }
         const value = await this.store.fetch({
             slug,
@@ -137,57 +134,49 @@ export class Credentials {
         if (value === undefined) {
             throw owner.type === "user"
                 ? new CredentialAuthorizationRequiredError([slug])
-                : new CredentialNotFoundError(slug, owner.type);
+                : new ConnectionNotFoundError(slug, owner.type);
         }
         return value;
     }
-    /**
-     * Read an agent-owned secret outside a run.
-     *
-     * Connector declarations are loaded once per deployment, before any caller
-     * exists. An agent-owned secret is deployment-scoped, so it is the one lookup
-     * that carries no caller and can be resolved there.
-     */
     async resolveDeploymentSecret(slug) {
         const value = await this.store.fetch({
             slug,
             owner: { type: "agent" },
         });
         if (value === undefined) {
-            throw new CredentialNotFoundError(slug, "agent");
+            throw new ConnectionNotFoundError(slug, "agent");
         }
         return value;
     }
 }
-/** Environment variable used for one agent-owned development credential. */
-export function agentCredentialEnvKey(slug) {
+export function agentConnectionEnvKey(slug) {
     return `${DEV_CREDENTIAL_PREFIX}${normalizeSlug(slug)
         .toUpperCase()
         .replaceAll("-", "_")}`;
 }
 function normalizeSlug(slug) {
     if (typeof slug !== "string") {
-        throw new TypeError("credential slug must be a string");
+        throw new TypeError("connection slug must be a string");
     }
     const canonical = slug.trim();
     if (!canonical ||
         canonical.length > MAX_SLUG_LENGTH ||
         !SLUG_PATTERN.test(canonical)) {
-        throw new TypeError(`credential slug ${JSON.stringify(slug)} is invalid: use lowercase letters, digits, and single hyphens, at most ${MAX_SLUG_LENGTH} characters`);
+        throw new TypeError(`connection slug ${JSON.stringify(slug)} is invalid: use lowercase letters, digits, and single hyphens, at most ${MAX_SLUG_LENGTH} characters`);
     }
     return canonical;
 }
 function normalizeOwner(owner) {
     if (!owner || typeof owner !== "object") {
-        throw new TypeError('credential owner is required: pass { type: "agent" } or { type: "user" }');
+        throw new TypeError('connection owner is required: pass { type: "agent" } or { type: "user" }');
     }
     const keys = Object.keys(owner);
     if (keys.some((key) => key !== "type" && key !== "id")) {
-        throw new TypeError("credential owner has an unknown key");
+        throw new TypeError("connection owner has an unknown key");
     }
     if (owner.type === "agent") {
         if ("id" in owner) {
-            throw new TypeError('credential owner "id" is not accepted for { type: "agent" }');
+            throw new TypeError('connection owner "id" is not accepted for { type: "agent" }');
         }
         return { type: "agent" };
     }
@@ -195,48 +184,35 @@ function normalizeOwner(owner) {
         if (owner.id === undefined)
             return { type: "user" };
         if (typeof owner.id !== "string" || !owner.id.trim()) {
-            throw new TypeError('credential owner "id" must be a non-empty string');
+            throw new TypeError('connection owner "id" must be a non-empty string');
         }
         return { type: "user", id: owner.id.trim() };
     }
-    throw new TypeError("credential owner type is not supported");
+    throw new TypeError("connection owner type is not supported");
 }
-/**
- * The `owner_id` a lookup is keyed by: the caller for a user, else the
- * deployment. Shared with the credential gate so a declared owner is checked
- * the same way wherever it is resolved.
- */
 export function resolveOwnerId(owner, identity, deploymentId) {
     if (owner.type === "user") {
         const authenticated = identity?.user.id;
         if (!authenticated) {
-            throw new CredentialStoreError("user credentials require an authenticated user principal");
+            throw new CredentialStoreError("user connections require an authenticated user principal");
         }
         if (owner.id !== undefined && owner.id !== authenticated) {
-            throw new CredentialStoreError("user credential owner id must match the authenticated principal");
+            throw new CredentialStoreError("user connection owner id must match the authenticated principal");
         }
         return authenticated;
     }
     if (!deploymentId) {
-        throw new CredentialStoreError("credentials are not configured: LANGSMITH_HOST_PROJECT_ID is not set");
+        throw new CredentialStoreError("connections are not configured: LANGSMITH_HOST_PROJECT_ID is not set");
     }
     return deploymentId;
 }
-/**
- * The Agent Auth binding for one caller.
- *
- * `credentials.get` and the pre-run credential gate both resolve their owner id
- * here, so a slug addresses the same Agent Auth row on either path.
- */
 export function resolveAgentAuthContext(identity, env = process.env) {
-    // Only the user-credential gate resolves a context, so a local run can say
-    // why rather than reporting a missing deployment variable.
     if (env.MDA_LOCAL_DEV === "1") {
-        throw new CredentialStoreError(localUserCredentialUnsupported());
+        throw new CredentialStoreError(localUserConnectionUnsupported());
     }
     const config = resolveAgentAuthConfig(env);
     if (!config.deploymentId) {
-        throw new CredentialStoreError("credentials are not configured: LANGSMITH_HOST_PROJECT_ID is not set");
+        throw new CredentialStoreError("connections are not configured: LANGSMITH_HOST_PROJECT_ID is not set");
     }
     return {
         baseUrl: config.baseUrl,
@@ -249,21 +225,19 @@ export function resolveAgentAuthContext(identity, env = process.env) {
 function resolveAgentAuthConfig(env) {
     const apiKey = env.LANGSMITH_API_KEY?.trim();
     if (!apiKey) {
-        throw new CredentialStoreError("credentials are not configured: LANGSMITH_API_KEY is not set");
+        throw new CredentialStoreError("connections are not configured: LANGSMITH_API_KEY is not set");
+    }
+    const workspaceId = env.LANGSMITH_WORKSPACE_ID?.trim();
+    if (!workspaceId) {
+        throw new CredentialStoreError("connections are not configured: LANGSMITH_WORKSPACE_ID is not set");
     }
     return {
         baseUrl: resolveAgentAuthBaseUrl(env),
         apiKey,
         deploymentId: env.LANGSMITH_HOST_PROJECT_ID?.trim() || undefined,
-        workspaceId: env.LANGSMITH_WORKSPACE_ID?.trim() || undefined,
+        workspaceId,
     };
 }
-/**
- * Agent Auth is served by the LangSmith API.
- *
- * Rejects a URL that carries a path, query, or userinfo, so a misconfigured
- * endpoint cannot send the API key at a different service.
- */
 export function resolveAgentAuthBaseUrl(env = process.env) {
     const raw = env.LANGSMITH_ENDPOINT?.trim() || DEFAULT_LANGSMITH_ENDPOINT;
     let parsed;
@@ -284,5 +258,5 @@ export function resolveAgentAuthBaseUrl(env = process.env) {
     }
     return parsed.origin;
 }
-export const credentials = new Credentials();
-//# sourceMappingURL=credentials.js.map
+export const connections = new Connections();
+//# sourceMappingURL=connections.js.map

package/dist/connections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connections.js","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EACL,qBAAqB,EACrB,SAAS,EACT,oCAAoC,EACpC,oBAAoB,GAErB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,oCAAoC,EACpC,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AAazB,MAAM,oBAAoB,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;AACrE,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAClD,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,0BAA0B,GAAG,iCAAiC,CAAC;AACrE,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAEzC,SAAS,8BAA8B,CAAC,IAAa;IACnD,MAAM,SAAS,GAAG,IAAI;QACpB,CAAC,CAAC,OAAO,qBAAqB,CAAC,IAAI,CAAC,EAAE;QACtC,CAAC,CAAC,+CAA+C,CAAC;IACpD,OAAO,CACL,iFAAiF;QACjF,yEAAyE;QACzE,yBAAyB,SAAS,iBAAiB,CACpD,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,CAAS;IACb,SAAS,CAA0B;IAE5C,YAAY,IAAY,EAAE,SAAkC;QAC1D,KAAK,CAAC,MAAM,SAAS,+BAA+B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,OAAO,mBAAmB;IAInB,IAAI;IACJ,KAAK;IACG,QAAQ;IALlB,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC;IAEvC,YACW,IAAY,EACZ,KAAsB,EACd,QAAqB;oBAF7B,IAAI;qBACJ,KAAK;wBACG,QAAQ;IACxB,CAAC;IAEJ,IAAI,CACF,WAA0E,EAC1E,UAA2E;QAE3E,OAAO,IAAI,CAAC,QAAQ;aACjB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;aAC9B,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACnC,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAc;IAEd,OAAO,CACL,KAAK,YAAY,mBAAmB;QACpC,CAAC,OAAO,KAAK,KAAK,QAAQ;YACxB,KAAK,KAAK,IAAI;YACd,oBAAoB,IAAI,KAAK,CAAC,CACjC,CAAC;AACJ,CAAC;AASD,MAAM,OAAO,wBAAwB;IAEhB,GAAG;IACH,SAAS;IACT,SAAS;IAH5B,YACmB,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,SAAS,GAAiB,KAAK,EAC/B,SAAS,GAAG,qBAAqB;mBAFjC,GAAG;yBACH,SAAS;yBACT,SAAS;IACzB,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,OAA0B;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,aAAa,KAAK,GAAG,EAAE,CAAC;YACnC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAClC,MAAM,IAAI,oBAAoB,CAC5B,8BAA8B,CAAC,OAAO,CAAC,IAAI,CAAC,CAC7C,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBACxC,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;gBAC1E,OAAO,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,cAAc,CAC5B,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,QAAQ,EAChB,MAAM,CAAC,YAAY,CACpB,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B;YACE,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,YAAY,IAAI,OAAO;YACvC,WAAW,EAAE,OAAO;YACpB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,EACD,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACf,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAClC,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,MAAM,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,MAAM,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxD,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1E,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,MAAM,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,MAAM,MAAM,CAAC,yBAAyB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,WAAW;IAEH,KAAK;IADxB,YACmB,KAAK,GAA6B,IAAI,wBAAwB,EAAE;qBAAhE,KAAK;IACrB,CAAC;IAEJ,GAAG,CAAC,IAAY,EAAE,KAAsB;QACtC,OAAO,IAAI,mBAAmB,CAC5B,aAAa,CAAC,IAAI,CAAC,EACnB,cAAc,CAAC,KAAK,CAAC,EACrB,IAAI,CACL,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,KAAsB;QAChD,MAAM,YAAY,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,qHAAqH,CACtH,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YACnC,IAAI;YACJ,KAAK;YACL,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC;SAC7C,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,KAAK,CAAC,IAAI,KAAK,MAAM;gBACzB,CAAC,CAAC,IAAI,oCAAoC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAClD,CAAC,CAAC,IAAI,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,IAAY;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YACnC,IAAI;YACJ,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACzB,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,GAAG,qBAAqB,GAAG,aAAa,CAAC,IAAI,CAAC;SAClD,WAAW,EAAE;SACb,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9B,IACE,CAAC,SAAS;QACV,SAAS,CAAC,MAAM,GAAG,eAAe;QAClC,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAC7B,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2EAA2E,eAAe,aAAa,CAC/I,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,KAAsB;IAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,SAAS,CACjB,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,SAAS,CACjB,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACpD,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;IAC/C,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAsB,EACtB,QAAqC,EACrC,YAAgC;IAEhC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,oBAAoB,CAC5B,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS,IAAI,KAAK,CAAC,EAAE,KAAK,aAAa,EAAE,CAAC;YACzD,MAAM,IAAI,oBAAoB,CAC5B,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,oBAAoB,CAC5B,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAAqC,EACrC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,GAAG,CAAC,aAAa,KAAK,GAAG,EAAE,CAAC;QAC9B,MAAM,IAAI,oBAAoB,CAAC,8BAA8B,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAC5B,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,YAAY;QAC5B,WAAW,EAAE,cAAc,CACzB,EAAE,IAAI,EAAE,MAAM,EAAE,EAChB,QAAQ,EACR,MAAM,CAAC,YAAY,CACpB;QACD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAsB;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,oBAAoB,CAC5B,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,oBAAoB,CAC5B,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,uBAAuB,CAAC,GAAG,CAAC;QACrC,MAAM;QACN,YAAY,EAAE,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,SAAS;QAChE,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,0BAA0B,CAAC;IACzE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,uCAAuC,CAAC,CAAC;IAC1E,CAAC;IACD,IACE,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC9C,CAAC,MAAM,CAAC,QAAQ;QAChB,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,QAAQ;QACf,CAAC,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,IAAI,EACX,CAAC;QACD,MAAM,IAAI,oBAAoB,CAAC,uCAAuC,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC"}

package/dist/connectors/mcp/index.d.ts

@@ -18,7 +18,7 @@
  * @example
  * ```ts
  * // connectors/mcp.ts
- * import { connectors, credentials } from "managed-deepagents";
+ * import { connectors, connections } from "managed-deepagents";
  *
  * export const connector = connectors.mcp({
  *   mcpServers: {
@@ -29,7 +29,7 @@
  *     notion: {
  *       transport: "http",
  *       url: "https://mcp.notion.com/mcp",
- *       credential: credentials.get("notion", { type: "user" }),
+ *       connection: connections.get("notion", { type: "user" }),
  *     },
  *   },
  * });
@@ -51,17 +51,17 @@ export declare function clearManagedMcpToolsCacheForTests(connectors?: McpServer
 /**
  * The credential gate's view of the declared MCP connectors.
  *
- * One consumer per declaration that names a user-owned credential; a
+ * One consumer per declaration that names a user-owned connection; a
  * declaration that needs no grant never reaches the gate.
  */
 export declare function mcpCredentialConsumers(connectors: readonly unknown[] | undefined): CredentialConsumer[];
 /**
- * Load tools for user-credential servers, once the gate has confirmed the
+ * Load tools for user-connection servers, once the gate has confirmed the
  * caller's grants.
  *
  * Not process-cached here: the Authorization header is per caller, so the gate
  * owns both the cache and closing the returned transport.
  */
-export declare function loadUserCredentialMcpTools(connectors: McpServersDefinition, accessTokens: ReadonlyMap<string, string>): Promise<LoadedCredentialTools>;
+export declare function loadUserConnectionMcpTools(connectors: McpServersDefinition, accessTokens: ReadonlyMap<string, string>): Promise<LoadedCredentialTools>;
 export declare const mcpConnector: (config: McpServersConfig) => McpServersDefinition;
 //# sourceMappingURL=index.d.ts.map

package/dist/connectors/mcp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/connectors/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAUH,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACtB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,KAAK,EACV,gBAAgB,EAChB,oBAAoB,EAGrB,MAAM,YAAY,CAAC;AAEpB,mBAAmB,YAAY,CAAC;AAkBhC;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,oBAAoB,GAC/B,OAAO,CAAC,OAAO,EAAE,CAAC,CAWpB;AAED,yDAAyD;AACzD,wBAAgB,iCAAiC,CAC/C,UAAU,CAAC,EAAE,oBAAoB,GAChC,IAAI,CAMN;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,GACzC,kBAAkB,EAAE,CAuBtB;AAqDD;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,oBAAoB,EAChC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACxC,OAAO,CAAC,qBAAqB,CAAC,CAyBhC;AAsKD,eAAO,MAAM,YAAY,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,oBAOrD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/connectors/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAUH,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACtB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,KAAK,EACV,gBAAgB,EAChB,oBAAoB,EAGrB,MAAM,YAAY,CAAC;AAEpB,mBAAmB,YAAY,CAAC;AAkBhC;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,oBAAoB,GAC/B,OAAO,CAAC,OAAO,EAAE,CAAC,CAWpB;AAED,yDAAyD;AACzD,wBAAgB,iCAAiC,CAC/C,UAAU,CAAC,EAAE,oBAAoB,GAChC,IAAI,CAMN;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,GACzC,kBAAkB,EAAE,CAuBtB;AA0ED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,oBAAoB,EAChC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACxC,OAAO,CAAC,qBAAqB,CAAC,CAyBhC;AAsKD,eAAO,MAAM,YAAY,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,oBAOrD,CAAC"}

package/dist/connectors/mcp/index.js

@@ -18,7 +18,7 @@
  * @example
  * ```ts
  * // connectors/mcp.ts
- * import { connectors, credentials } from "managed-deepagents";
+ * import { connectors, connections } from "managed-deepagents";
  *
  * export const connector = connectors.mcp({
  *   mcpServers: {
@@ -29,7 +29,7 @@
  *     notion: {
  *       transport: "http",
  *       url: "https://mcp.notion.com/mcp",
- *       credential: credentials.get("notion", { type: "user" }),
+ *       connection: connections.get("notion", { type: "user" }),
  *     },
  *   },
  * });
@@ -37,7 +37,7 @@
  */
 import { MultiServerMCPClient } from "@langchain/mcp-adapters";
 import { defineExtension } from "../../extension.js";
-import { credentials, isCredentialReference, } from "../../credentials.js";
+import { connections, isConnectionReference, } from "../../connections.js";
 import { mcpServersConfig } from "./schema.js";
 import { selectTools } from "../tool-selection.js";
 /**
@@ -50,8 +50,8 @@ import { selectTools } from "../tool-selection.js";
  * the in-flight promise also dedupes concurrent first runs for the same
  * connector. Multiple `connectors.mcp(...)` modules each get their own entry.
  *
- * An agent-owned credential is read into this cache once, so rotating that
- * secret takes a redeploy. Servers with a user-owned credential are omitted
+ * An agent-owned connection is read into this cache once, so rotating that
+ * secret takes a redeploy. Servers with a user-owned connection are omitted
  * entirely; the credential gate loads those per caller.
  */
 const cachedTools = new Map();
@@ -85,7 +85,7 @@ export function clearManagedMcpToolsCacheForTests(connectors) {
 /**
  * The credential gate's view of the declared MCP connectors.
  *
- * One consumer per declaration that names a user-owned credential; a
+ * One consumer per declaration that names a user-owned connection; a
  * declaration that needs no grant never reaches the gate.
  */
 export function mcpCredentialConsumers(connectors) {
@@ -97,72 +97,88 @@ export function mcpCredentialConsumers(connectors) {
             continue;
         }
         const definition = connector;
-        const credentials = userCredentialReferences(definition);
-        if (credentials.length === 0) {
+        const userConnections = userConnectionReferences(definition);
+        if (userConnections.length === 0) {
             continue;
         }
         out.push({
             declaration: definition,
-            credentials,
-            load: (accessTokens) => loadUserCredentialMcpTools(definition, accessTokens),
+            credentials: userConnections,
+            load: (accessTokens) => loadUserConnectionMcpTools(definition, accessTokens),
         });
     }
     return out;
 }
 /** The declared references themselves: the gate checks their owner. */
-function userCredentialReferences(connectors) {
+function userConnectionReferences(connectors) {
     const bySlug = new Map();
     for (const server of Object.values(connectors.mcpServers)) {
-        if (usesUserCredential(server)) {
-            const credential = server.credential;
-            bySlug.set(credential.slug, credential);
+        if (usesUserConnection(server)) {
+            const connection = server.connection;
+            bySlug.set(connection.slug, connection);
+        }
+    }
+    return [...bySlug.values()];
+}
+function agentConnectionReferences(connectors) {
+    const bySlug = new Map();
+    for (const server of Object.values(connectors.mcpServers)) {
+        const connection = server.connection;
+        if (isConnectionReference(connection) &&
+            connection.owner.type === "agent") {
+            bySlug.set(connection.slug, connection);
         }
     }
     return [...bySlug.values()];
 }
 function mcpRequirements(name, connectors) {
+    const userSlugs = userConnectionReferences(connectors)
+        .map((connection) => connection.slug)
+        .sort();
+    const agentSlugs = agentConnectionReferences(connectors)
+        .map((connection) => connection.slug)
+        .sort();
     return {
         name,
         provider: "mcp",
         autoReply: false,
         requiredPermissions: [],
         requiredEnv: [],
-        userCredentials: userCredentialReferences(connectors)
-            .map((credential) => credential.slug)
-            .sort(),
+        userConnections: userSlugs,
+        agentConnections: agentSlugs,
         providerConfig: {},
     };
 }
 async function createClientAndLoadTools(connectors) {
-    const { eager, userCredential } = partitionMcpServers(connectors.mcpServers);
-    if (userCredential.length > 0) {
-        warnDeferredUserCredentialServers(userCredential);
+    const { eager, userConnection } = partitionMcpServers(connectors.mcpServers);
+    if (userConnection.length > 0) {
+        warnDeferredUserConnectionServers(userConnection);
     }
     if (Object.keys(eager).length === 0) {
         return [];
     }
-    const { tools } = await loadToolsFromServers(connectors, await withAgentCredentials(eager));
+    const { tools } = await loadToolsFromServers(connectors, await withAgentConnections(eager));
     return tools;
 }
 /**
- * Load tools for user-credential servers, once the gate has confirmed the
+ * Load tools for user-connection servers, once the gate has confirmed the
  * caller's grants.
  *
  * Not process-cached here: the Authorization header is per caller, so the gate
  * owns both the cache and closing the returned transport.
  */
-export async function loadUserCredentialMcpTools(connectors, accessTokens) {
-    const { userCredential } = partitionMcpServers(connectors.mcpServers);
+export async function loadUserConnectionMcpTools(connectors, accessTokens) {
+    const { userConnection } = partitionMcpServers(connectors.mcpServers);
     const connectable = {};
-    for (const name of userCredential) {
+    for (const name of userConnection) {
         const server = connectors.mcpServers[name];
-        const credential = server?.credential;
-        if (!server || !isCredentialReference(credential)) {
+        const connection = server?.connection;
+        if (!server || !isConnectionReference(connection)) {
             continue;
         }
-        const accessToken = accessTokens.get(credential.slug);
+        const accessToken = accessTokens.get(connection.slug);
         if (!accessToken) {
-            throw new Error(`MCP user credential "${credential.slug}" has no access token`);
+            throw new Error(`MCP user connection "${connection.slug}" has no access token`);
         }
         connectable[name] = withBearer(server, accessToken);
     }
@@ -172,13 +188,13 @@ export async function loadUserCredentialMcpTools(connectors, accessTokens) {
     const { tools, client } = await loadToolsFromServers(connectors, connectable);
     return { tools, close: () => client.close() };
 }
-/** Resolve each agent-owned credential into a static bearer header. */
-async function withAgentCredentials(servers) {
+/** Resolve each agent-owned connection into a static bearer header. */
+async function withAgentConnections(servers) {
     const out = {};
     for (const [name, server] of Object.entries(servers)) {
-        const credential = server.credential;
-        out[name] = isCredentialReference(credential)
-            ? withBearer(server, await credentials.resolveDeploymentSecret(credential.slug))
+        const connection = server.connection;
+        out[name] = isConnectionReference(connection)
+            ? withBearer(server, await connections.resolveDeploymentSecret(connection.slug))
             : server;
     }
     return out;
@@ -190,31 +206,31 @@ function withBearer(server, token) {
         headers: { ...headers, Authorization: `Bearer ${token}` },
     };
 }
-function usesUserCredential(server) {
-    return (isCredentialReference(server.credential) &&
-        server.credential.owner.type === "user");
+function usesUserConnection(server) {
+    return (isConnectionReference(server.connection) &&
+        server.connection.owner.type === "user");
 }
 function partitionMcpServers(servers) {
     const eager = {};
-    const userCredential = [];
+    const userConnection = [];
     for (const [name, server] of Object.entries(servers)) {
-        if (usesUserCredential(server)) {
-            userCredential.push(name);
+        if (usesUserConnection(server)) {
+            userConnection.push(name);
         }
         else {
             eager[name] = server;
         }
     }
-    return { eager, userCredential };
+    return { eager, userConnection };
 }
-function warnDeferredUserCredentialServers(serverNames) {
+function warnDeferredUserConnectionServers(serverNames) {
     console.warn(`[managed-deepagents] MCP server(s) ${serverNames.join(", ")} declare ` +
-        `a user credential; tools load after the pre-run credential gate ` +
+        `a user connection; tools load after the pre-run credential gate ` +
         `confirms grants for the caller.`);
 }
 function stripManagedToolSelection(servers) {
     return Object.fromEntries(Object.entries(servers).map(([name, server]) => {
-        const { includeTools: _includeTools, excludeTools: _excludeTools, credential: _credential, ...clientConfig } = server;
+        const { includeTools: _includeTools, excludeTools: _excludeTools, connection: _connection, ...clientConfig } = server;
         return [name, clientConfig];
     }));
 }