managed-deepagents 0.6.2-dev.29 → 0.6.2-dev.30
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +9 -12
- package/dist/agent-auth.d.ts +3 -28
- package/dist/agent-auth.d.ts.map +1 -1
- package/dist/agent-auth.js +12 -181
- package/dist/agent-auth.js.map +1 -1
- package/dist/channels/manifest.d.ts +2 -4
- package/dist/channels/manifest.d.ts.map +1 -1
- package/dist/channels/trigger/http.js +1 -1
- package/dist/channels/trigger/http.js.map +1 -1
- package/dist/connectors/mcp/index.d.ts +5 -5
- package/dist/connectors/mcp/index.d.ts.map +1 -1
- package/dist/connectors/mcp/index.js +44 -60
- package/dist/connectors/mcp/index.js.map +1 -1
- package/dist/connectors/mcp/schema.d.ts.map +1 -1
- package/dist/connectors/mcp/schema.js +3 -5
- package/dist/connectors/mcp/schema.js.map +1 -1
- package/dist/connectors/mcp/types.d.ts +8 -8
- package/dist/connectors/mcp/types.d.ts.map +1 -1
- package/dist/credential-gate.d.ts +12 -13
- package/dist/credential-gate.d.ts.map +1 -1
- package/dist/credential-gate.js +31 -49
- package/dist/credential-gate.js.map +1 -1
- package/dist/credentials.d.ts +95 -0
- package/dist/credentials.d.ts.map +1 -0
- package/dist/{connections.js → credentials.js} +100 -92
- package/dist/credentials.js.map +1 -0
- package/dist/index.d.ts +5 -5
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/package.json +7 -7
- package/dist/connections.d.ts +0 -74
- package/dist/connections.d.ts.map +0 -1
- package/dist/connections.js.map +0 -1
|
@@ -18,7 +18,7 @@
|
|
|
18
18
|
* @example
|
|
19
19
|
* ```ts
|
|
20
20
|
* // connectors/mcp.ts
|
|
21
|
-
* import { connectors,
|
|
21
|
+
* import { connectors, credentials } from "managed-deepagents";
|
|
22
22
|
*
|
|
23
23
|
* export const connector = connectors.mcp({
|
|
24
24
|
* mcpServers: {
|
|
@@ -29,7 +29,7 @@
|
|
|
29
29
|
* notion: {
|
|
30
30
|
* transport: "http",
|
|
31
31
|
* url: "https://mcp.notion.com/mcp",
|
|
32
|
-
*
|
|
32
|
+
* credential: credentials.get("notion", { type: "user" }),
|
|
33
33
|
* },
|
|
34
34
|
* },
|
|
35
35
|
* });
|
|
@@ -37,7 +37,7 @@
|
|
|
37
37
|
*/
|
|
38
38
|
import { MultiServerMCPClient } from "@langchain/mcp-adapters";
|
|
39
39
|
import { defineExtension } from "../../extension.js";
|
|
40
|
-
import {
|
|
40
|
+
import { credentials, isCredentialReference, } from "../../credentials.js";
|
|
41
41
|
import { mcpServersConfig } from "./schema.js";
|
|
42
42
|
import { selectTools } from "../tool-selection.js";
|
|
43
43
|
/**
|
|
@@ -50,8 +50,8 @@ import { selectTools } from "../tool-selection.js";
|
|
|
50
50
|
* the in-flight promise also dedupes concurrent first runs for the same
|
|
51
51
|
* connector. Multiple `connectors.mcp(...)` modules each get their own entry.
|
|
52
52
|
*
|
|
53
|
-
* An agent-owned
|
|
54
|
-
* secret takes a redeploy. Servers with a user-owned
|
|
53
|
+
* An agent-owned credential is read into this cache once, so rotating that
|
|
54
|
+
* secret takes a redeploy. Servers with a user-owned credential are omitted
|
|
55
55
|
* entirely; the credential gate loads those per caller.
|
|
56
56
|
*/
|
|
57
57
|
const cachedTools = new Map();
|
|
@@ -85,7 +85,7 @@ export function clearManagedMcpToolsCacheForTests(connectors) {
|
|
|
85
85
|
/**
|
|
86
86
|
* The credential gate's view of the declared MCP connectors.
|
|
87
87
|
*
|
|
88
|
-
* One consumer per declaration that names a user-owned
|
|
88
|
+
* One consumer per declaration that names a user-owned credential; a
|
|
89
89
|
* declaration that needs no grant never reaches the gate.
|
|
90
90
|
*/
|
|
91
91
|
export function mcpCredentialConsumers(connectors) {
|
|
@@ -97,88 +97,72 @@ export function mcpCredentialConsumers(connectors) {
|
|
|
97
97
|
continue;
|
|
98
98
|
}
|
|
99
99
|
const definition = connector;
|
|
100
|
-
const
|
|
101
|
-
if (
|
|
100
|
+
const credentials = userCredentialReferences(definition);
|
|
101
|
+
if (credentials.length === 0) {
|
|
102
102
|
continue;
|
|
103
103
|
}
|
|
104
104
|
out.push({
|
|
105
105
|
declaration: definition,
|
|
106
|
-
credentials
|
|
107
|
-
load: (accessTokens) =>
|
|
106
|
+
credentials,
|
|
107
|
+
load: (accessTokens) => loadUserCredentialMcpTools(definition, accessTokens),
|
|
108
108
|
});
|
|
109
109
|
}
|
|
110
110
|
return out;
|
|
111
111
|
}
|
|
112
112
|
/** The declared references themselves: the gate checks their owner. */
|
|
113
|
-
function
|
|
113
|
+
function userCredentialReferences(connectors) {
|
|
114
114
|
const bySlug = new Map();
|
|
115
115
|
for (const server of Object.values(connectors.mcpServers)) {
|
|
116
|
-
if (
|
|
117
|
-
const
|
|
118
|
-
bySlug.set(
|
|
119
|
-
}
|
|
120
|
-
}
|
|
121
|
-
return [...bySlug.values()];
|
|
122
|
-
}
|
|
123
|
-
function agentConnectionReferences(connectors) {
|
|
124
|
-
const bySlug = new Map();
|
|
125
|
-
for (const server of Object.values(connectors.mcpServers)) {
|
|
126
|
-
const connection = server.connection;
|
|
127
|
-
if (isConnectionReference(connection) &&
|
|
128
|
-
connection.owner.type === "agent") {
|
|
129
|
-
bySlug.set(connection.slug, connection);
|
|
116
|
+
if (usesUserCredential(server)) {
|
|
117
|
+
const credential = server.credential;
|
|
118
|
+
bySlug.set(credential.slug, credential);
|
|
130
119
|
}
|
|
131
120
|
}
|
|
132
121
|
return [...bySlug.values()];
|
|
133
122
|
}
|
|
134
123
|
function mcpRequirements(name, connectors) {
|
|
135
|
-
const userSlugs = userConnectionReferences(connectors)
|
|
136
|
-
.map((connection) => connection.slug)
|
|
137
|
-
.sort();
|
|
138
|
-
const agentSlugs = agentConnectionReferences(connectors)
|
|
139
|
-
.map((connection) => connection.slug)
|
|
140
|
-
.sort();
|
|
141
124
|
return {
|
|
142
125
|
name,
|
|
143
126
|
provider: "mcp",
|
|
144
127
|
autoReply: false,
|
|
145
128
|
requiredPermissions: [],
|
|
146
129
|
requiredEnv: [],
|
|
147
|
-
|
|
148
|
-
|
|
130
|
+
userCredentials: userCredentialReferences(connectors)
|
|
131
|
+
.map((credential) => credential.slug)
|
|
132
|
+
.sort(),
|
|
149
133
|
providerConfig: {},
|
|
150
134
|
};
|
|
151
135
|
}
|
|
152
136
|
async function createClientAndLoadTools(connectors) {
|
|
153
|
-
const { eager,
|
|
154
|
-
if (
|
|
155
|
-
|
|
137
|
+
const { eager, userCredential } = partitionMcpServers(connectors.mcpServers);
|
|
138
|
+
if (userCredential.length > 0) {
|
|
139
|
+
warnDeferredUserCredentialServers(userCredential);
|
|
156
140
|
}
|
|
157
141
|
if (Object.keys(eager).length === 0) {
|
|
158
142
|
return [];
|
|
159
143
|
}
|
|
160
|
-
const { tools } = await loadToolsFromServers(connectors, await
|
|
144
|
+
const { tools } = await loadToolsFromServers(connectors, await withAgentCredentials(eager));
|
|
161
145
|
return tools;
|
|
162
146
|
}
|
|
163
147
|
/**
|
|
164
|
-
* Load tools for user-
|
|
148
|
+
* Load tools for user-credential servers, once the gate has confirmed the
|
|
165
149
|
* caller's grants.
|
|
166
150
|
*
|
|
167
151
|
* Not process-cached here: the Authorization header is per caller, so the gate
|
|
168
152
|
* owns both the cache and closing the returned transport.
|
|
169
153
|
*/
|
|
170
|
-
export async function
|
|
171
|
-
const {
|
|
154
|
+
export async function loadUserCredentialMcpTools(connectors, accessTokens) {
|
|
155
|
+
const { userCredential } = partitionMcpServers(connectors.mcpServers);
|
|
172
156
|
const connectable = {};
|
|
173
|
-
for (const name of
|
|
157
|
+
for (const name of userCredential) {
|
|
174
158
|
const server = connectors.mcpServers[name];
|
|
175
|
-
const
|
|
176
|
-
if (!server || !
|
|
159
|
+
const credential = server?.credential;
|
|
160
|
+
if (!server || !isCredentialReference(credential)) {
|
|
177
161
|
continue;
|
|
178
162
|
}
|
|
179
|
-
const accessToken = accessTokens.get(
|
|
163
|
+
const accessToken = accessTokens.get(credential.slug);
|
|
180
164
|
if (!accessToken) {
|
|
181
|
-
throw new Error(`MCP user
|
|
165
|
+
throw new Error(`MCP user credential "${credential.slug}" has no access token`);
|
|
182
166
|
}
|
|
183
167
|
connectable[name] = withBearer(server, accessToken);
|
|
184
168
|
}
|
|
@@ -188,13 +172,13 @@ export async function loadUserConnectionMcpTools(connectors, accessTokens) {
|
|
|
188
172
|
const { tools, client } = await loadToolsFromServers(connectors, connectable);
|
|
189
173
|
return { tools, close: () => client.close() };
|
|
190
174
|
}
|
|
191
|
-
/** Resolve each agent-owned
|
|
192
|
-
async function
|
|
175
|
+
/** Resolve each agent-owned credential into a static bearer header. */
|
|
176
|
+
async function withAgentCredentials(servers) {
|
|
193
177
|
const out = {};
|
|
194
178
|
for (const [name, server] of Object.entries(servers)) {
|
|
195
|
-
const
|
|
196
|
-
out[name] =
|
|
197
|
-
? withBearer(server, await
|
|
179
|
+
const credential = server.credential;
|
|
180
|
+
out[name] = isCredentialReference(credential)
|
|
181
|
+
? withBearer(server, await credentials.resolveDeploymentSecret(credential.slug))
|
|
198
182
|
: server;
|
|
199
183
|
}
|
|
200
184
|
return out;
|
|
@@ -206,31 +190,31 @@ function withBearer(server, token) {
|
|
|
206
190
|
headers: { ...headers, Authorization: `Bearer ${token}` },
|
|
207
191
|
};
|
|
208
192
|
}
|
|
209
|
-
function
|
|
210
|
-
return (
|
|
211
|
-
server.
|
|
193
|
+
function usesUserCredential(server) {
|
|
194
|
+
return (isCredentialReference(server.credential) &&
|
|
195
|
+
server.credential.owner.type === "user");
|
|
212
196
|
}
|
|
213
197
|
function partitionMcpServers(servers) {
|
|
214
198
|
const eager = {};
|
|
215
|
-
const
|
|
199
|
+
const userCredential = [];
|
|
216
200
|
for (const [name, server] of Object.entries(servers)) {
|
|
217
|
-
if (
|
|
218
|
-
|
|
201
|
+
if (usesUserCredential(server)) {
|
|
202
|
+
userCredential.push(name);
|
|
219
203
|
}
|
|
220
204
|
else {
|
|
221
205
|
eager[name] = server;
|
|
222
206
|
}
|
|
223
207
|
}
|
|
224
|
-
return { eager,
|
|
208
|
+
return { eager, userCredential };
|
|
225
209
|
}
|
|
226
|
-
function
|
|
210
|
+
function warnDeferredUserCredentialServers(serverNames) {
|
|
227
211
|
console.warn(`[managed-deepagents] MCP server(s) ${serverNames.join(", ")} declare ` +
|
|
228
|
-
`a user
|
|
212
|
+
`a user credential; tools load after the pre-run credential gate ` +
|
|
229
213
|
`confirms grants for the caller.`);
|
|
230
214
|
}
|
|
231
215
|
function stripManagedToolSelection(servers) {
|
|
232
216
|
return Object.fromEntries(Object.entries(servers).map(([name, server]) => {
|
|
233
|
-
const { includeTools: _includeTools, excludeTools: _excludeTools,
|
|
217
|
+
const { includeTools: _includeTools, excludeTools: _excludeTools, credential: _credential, ...clientConfig } = server;
|
|
234
218
|
return [name, clientConfig];
|
|
235
219
|
}));
|
|
236
220
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/connectors/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,WAAW,EACX,qBAAqB,GAEtB,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAUnD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4C,CAAC;AAExE;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAgC;IAEhC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACnE,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,iCAAiC,CAC/C,UAAiC;IAEjC,IAAI,UAAU,EAAE,CAAC;QACf,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/B,OAAO;IACT,CAAC;IACD,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAA0C;IAE1C,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,KAAK,MAAM,SAAS,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;QACzC,IACE,CAAC,SAAS;YACV,OAAO,SAAS,KAAK,QAAQ;YAC5B,SAA+B,CAAC,IAAI,KAAK,aAAa,EACvD,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,SAAiC,CAAC;QACrD,MAAM,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/connectors/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,WAAW,EACX,qBAAqB,GAEtB,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAUnD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4C,CAAC;AAExE;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAgC;IAEhC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACnE,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,iCAAiC,CAC/C,UAAiC;IAEjC,IAAI,UAAU,EAAE,CAAC;QACf,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/B,OAAO;IACT,CAAC;IACD,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAA0C;IAE1C,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,KAAK,MAAM,SAAS,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;QACzC,IACE,CAAC,SAAS;YACV,OAAO,SAAS,KAAK,QAAQ;YAC5B,SAA+B,CAAC,IAAI,KAAK,aAAa,EACvD,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,SAAiC,CAAC;QACrD,MAAM,WAAW,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC;YACP,WAAW,EAAE,UAAU;YACvB,WAAW;YACX,IAAI,EAAE,CAAC,YAAY,EAAE,EAAE,CACrB,0BAA0B,CAAC,UAAU,EAAE,YAAY,CAAC;SACvD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uEAAuE;AACvE,SAAS,wBAAwB,CAC/B,UAAgC;IAEhC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;IACtD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1D,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,UAAU,GAAG,MAAM,CAAC,UAAiC,CAAC;YAC5D,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,UAAgC;IAEhC,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,KAAK;QAChB,mBAAmB,EAAE,EAAE;QACvB,WAAW,EAAE,EAAE;QACf,eAAe,EAAE,wBAAwB,CAAC,UAAU,CAAC;aAClD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;aACpC,IAAI,EAAE;QACT,cAAc,EAAE,EAAE;KACnB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,UAAgC;IAEhC,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,mBAAmB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAE7E,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,iCAAiC,CAAC,cAAc,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,oBAAoB,CAC1C,UAAU,EACV,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAClC,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,UAAgC,EAChC,YAAyC;IAEzC,MAAM,EAAE,cAAc,EAAE,GAAG,mBAAmB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAEtE,MAAM,WAAW,GAAuC,EAAE,CAAC;IAC3D,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,CAAC;QACtC,IAAI,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,wBAAwB,UAAU,CAAC,IAAI,uBAAuB,CAC/D,CAAC;QACJ,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC9E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;AAChD,CAAC;AAED,uEAAuE;AACvE,KAAK,UAAU,oBAAoB,CACjC,OAA2C;IAE3C,MAAM,GAAG,GAAuC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,UAAU,CAAC;YAC3C,CAAC,CAAC,UAAU,CACR,MAAM,EACN,MAAM,WAAW,CAAC,uBAAuB,CAAC,UAAU,CAAC,IAAI,CAAC,CAC3D;YACH,CAAC,CAAC,MAAM,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CACjB,MAA6B,EAC7B,KAAa;IAEb,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CACzC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,CACnD,CACF,CAAC;IACF,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;KAC1D,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAA6B;IACvD,OAAO,CACL,qBAAqB,CAAC,MAAM,CAAC,UAAU,CAAC;QACxC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CACxC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA2C;IAItE,MAAM,KAAK,GAAuC,EAAE,CAAC;IACrD,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,iCAAiC,CAAC,WAAqB;IAC9D,OAAO,CAAC,IAAI,CACV,sCAAsC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW;QACrE,kEAAkE;QAClE,iCAAiC,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,OAA2C;IAE3C,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;QAC7C,MAAM,EACJ,YAAY,EAAE,aAAa,EAC3B,YAAY,EAAE,aAAa,EAC3B,UAAU,EAAE,WAAW,EACvB,GAAG,YAAY,EAChB,GAAG,MAAM,CAAC;QACX,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9B,CAAC,CAAC,CACmC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,UAAgC,EAChC,WAA+C;IAE/C,MAAM,4BAA4B,GAChC,UAAU,CAAC,4BAA4B,IAAI,IAAI,CAAC;IAClD,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC;QACtC,UAAU,EAAE,yBAAyB,CAAC,WAAW,CAAC;QAClD,4BAA4B;QAC5B,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,IAAI,IAAI;QACrD,wBAAwB,EAAE,UAAU,CAAC,wBAAwB,IAAI,IAAI;QACrE,iBAAiB,EAAE,UAAU,CAAC,iBAAiB,IAAI,OAAO;KAC3D,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,iBAAiB,CACnC,MAAM,EACN,WAAW,EACX,4BAA4B,CAC7B,CAAC;QACF,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAClC,0BAA0B,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,MAA4B,EAC5B,OAA2C,EAC3C,4BAAqC;IAErC,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACtD,KAAK,CAAC,IAAI,CACR,GAAG,oBAAoB,CACrB,UAAU,EACV,MAAM,EACN,WAAW,EACX,4BAA4B,CAC7B,CACF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAC3B,UAAkB,EAClB,SAAiC,EACjC,KAAgB,EAChB,4BAAqC;IAErC,OAAO,WAAW,CAAC,eAAe,UAAU,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1E,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,UAAU,IAAI,CAAC;QACjC,OAAO,4BAA4B,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAC5D,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;YAC3B,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAgB;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,4BAA4B,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC/D,yEAAyE;YACzE,4DAA4D,CAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GACvB,eAAe,CAAC,WAAW,EAAE;IAC3B,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,gBAAgB;IACvB,IAAI,EAAE,gBAAgB;IACtB,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;IAChD,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC;CAC1D,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/connectors/mcp/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/connectors/mcp/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA6CnD;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,gBAAgB,CAevE,CAAC"}
|
|
@@ -1,11 +1,10 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
2
|
import { appendToolSelectionOverlapIssue, optionalToolNameListSchema, } from "../tool-selection.js";
|
|
3
|
-
import {
|
|
3
|
+
import { isCredentialReference, } from "../../credentials.js";
|
|
4
4
|
/** Stdio servers are out of scope; the message points at the alternatives. */
|
|
5
5
|
const STDIO_REJECTION = "uses a stdio transport, which is not supported. Managed Deep Agents " +
|
|
6
6
|
"support remote MCP servers over HTTP/SSE only; expose the server over HTTP " +
|
|
7
7
|
"or write a normal authored tool instead.";
|
|
8
|
-
const CREDENTIAL_FIELD_REJECTION = 'the "credential" field was removed; use connection: connections.get(slug, owner) instead';
|
|
9
8
|
/** Raw MCP tool names, before the managed `{server}__` prefix is applied. */
|
|
10
9
|
const remoteMcpServer = z
|
|
11
10
|
.looseObject({
|
|
@@ -29,9 +28,8 @@ const remoteMcpServer = z
|
|
|
29
28
|
.optional(),
|
|
30
29
|
includeTools: optionalToolNameListSchema,
|
|
31
30
|
excludeTools: optionalToolNameListSchema,
|
|
32
|
-
credential: z
|
|
33
|
-
|
|
34
|
-
.custom(isConnectionReference, "must be a connections.get(slug, owner) reference")
|
|
31
|
+
credential: z
|
|
32
|
+
.custom(isCredentialReference, "must be a credentials.get(slug, owner) reference")
|
|
35
33
|
.optional(),
|
|
36
34
|
})
|
|
37
35
|
.check(appendToolSelectionOverlapIssue);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/connectors/mcp/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,sBAAsB,CAAC;AAE9B,8EAA8E;AAC9E,MAAM,eAAe,GACnB,sEAAsE;IACtE,6EAA6E;IAC7E,0CAA0C,CAAC;AAE7C,
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/connectors/mcp/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,sBAAsB,CAAC;AAE9B,8EAA8E;AAC9E,MAAM,eAAe,GACnB,sEAAsE;IACtE,6EAA6E;IAC7E,0CAA0C,CAAC;AAE7C,6EAA6E;AAC7E,MAAM,eAAe,GAAG,CAAC;KACtB,WAAW,CAAC;IACX;;;OAGG;IACH,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;QACjC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,CAAC,KAAK,KAAK,OAAO;YACrB,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,mDAAmD;KAC1D,CAAC;IACF,GAAG,EAAE,CAAC;SACH,MAAM,CAAC,yBAAyB,CAAC;SACjC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,yBAAyB,CAAC;IACpE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,kBAAkB,EAAE,CAAC;SAClB,MAAM,CAAC,8CAA8C,CAAC;SACtD,QAAQ,CAAC,8CAA8C,CAAC;SACxD,QAAQ,EAAE;IACb,YAAY,EAAE,0BAA0B;IACxC,YAAY,EAAE,0BAA0B;IACxC,UAAU,EAAE,CAAC;SACV,MAAM,CACL,qBAAqB,EACrB,kDAAkD,CACnD;SACA,QAAQ,EAAE;CACd,CAAC;KACD,KAAK,CAAC,+BAA+B,CAAC,CAAC;AAE1C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,CAAC,CAAC,MAAM,CAAC;IACP,UAAU,EAAE,CAAC;SACV,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,EAAE;QACnC,KAAK,EACH,qEAAqE;KACxE,CAAC;SACD,MAAM,CACL,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAC5C,6BAA6B,CAC9B;IACH,4BAA4B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACpD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChD,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import type { ClientConfig, StreamableHTTPConnection } from "@langchain/mcp-adapters";
|
|
2
2
|
import type { Connector } from "../../runtime/connector.js";
|
|
3
|
-
import type {
|
|
3
|
+
import type { CredentialReference } from "../../credentials.js";
|
|
4
4
|
/** Per-server MCP tool selection. Names are raw, unprefixed MCP tool names. */
|
|
5
5
|
export interface McpToolSelectionConfig {
|
|
6
6
|
/**
|
|
@@ -14,18 +14,18 @@ export interface McpToolSelectionConfig {
|
|
|
14
14
|
*/
|
|
15
15
|
excludeTools?: string[];
|
|
16
16
|
}
|
|
17
|
-
/** A
|
|
18
|
-
export type
|
|
17
|
+
/** A user-owned credential reference resolved through Agent Auth at run time. */
|
|
18
|
+
export type McpServerCredential = CredentialReference;
|
|
19
19
|
/** Adapter connection fields MDA forwards, excluding stdio/auth the runtime owns. */
|
|
20
20
|
type AdapterRemoteConnection = Omit<StreamableHTTPConnection, "transport" | "type" | "authProvider">;
|
|
21
|
-
/** Shared remote server options plus MDA-only tool selection and
|
|
21
|
+
/** Shared remote server options plus MDA-only tool selection and credential mode. */
|
|
22
22
|
export type RemoteMcpServerBaseConfig = AdapterRemoteConnection & McpToolSelectionConfig & {
|
|
23
23
|
/**
|
|
24
|
-
* Bearer
|
|
25
|
-
* An agent owner is a
|
|
26
|
-
* owner is the caller's grant, loaded per caller after the gate.
|
|
24
|
+
* Bearer credential for this server, declared with `credentials.get(...)`.
|
|
25
|
+
* An agent owner is a deployment-wide secret read once at load; a user
|
|
26
|
+
* owner is the caller's OAuth grant, loaded per caller after the gate.
|
|
27
27
|
*/
|
|
28
|
-
|
|
28
|
+
credential?: McpServerCredential;
|
|
29
29
|
};
|
|
30
30
|
/** Streamable HTTP MCP server connection. */
|
|
31
31
|
export type HttpMcpServerConfig = RemoteMcpServerBaseConfig & {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/connectors/mcp/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,wBAAwB,EACzB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/connectors/mcp/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,wBAAwB,EACzB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,iFAAiF;AACjF,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEtD,qFAAqF;AACrF,KAAK,uBAAuB,GAAG,IAAI,CACjC,wBAAwB,EACxB,WAAW,GAAG,MAAM,GAAG,cAAc,CACtC,CAAC;AAEF,qFAAqF;AACrF,MAAM,MAAM,yBAAyB,GAAG,uBAAuB,GAC7D,sBAAsB,GAAG;IACvB;;;;OAIG;IACH,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAClC,CAAC;AAEJ,6CAA6C;AAC7C,MAAM,MAAM,mBAAmB,GAAG,yBAAyB,GAAG;IAC5D,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,wCAAwC;AACxC,MAAM,MAAM,kBAAkB,GAAG,yBAAyB,GAAG;IAC3D,oDAAoD;IACpD,SAAS,EAAE,KAAK,CAAC;CAClB,CAAC;AAEF,gFAAgF;AAChF,MAAM,MAAM,qBAAqB,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAE7E,4EAA4E;AAC5E,KAAK,gBAAgB,GAAG,IAAI,CAC1B,YAAY,EACV,8BAA8B,GAC9B,kBAAkB,GAClB,0BAA0B,GAC1B,mBAAmB,CACtB,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;CACnD;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB,EAAE,SAAS;IACvE,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;CAC9B"}
|
|
@@ -1,21 +1,20 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* Pre-run gate for declarations that need a user-owned
|
|
2
|
+
* Pre-run gate for declarations that need a user-owned credential.
|
|
3
3
|
*
|
|
4
|
-
* Before the first model turn the gate reads the caller's OAuth grants
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
4
|
+
* Before the first model turn the gate reads the caller's OAuth grants from
|
|
5
|
+
* Agent Auth. Missing grants raise one LangGraph interrupt listing connect
|
|
6
|
+
* URLs; the tools a grant unlocks are loaded on first use and cached per
|
|
7
|
+
* caller.
|
|
8
8
|
*/
|
|
9
9
|
import { createMiddleware } from "langchain";
|
|
10
|
-
import { type
|
|
10
|
+
import { type CredentialReference } from "./credentials.js";
|
|
11
11
|
export declare const CREDENTIAL_GATE_MIDDLEWARE_NAME = "mda-credential-gate";
|
|
12
12
|
export interface PendingCredential {
|
|
13
13
|
slug: string;
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
auth_id?: string;
|
|
14
|
+
connect_url: string;
|
|
15
|
+
auth_id: string;
|
|
17
16
|
}
|
|
18
|
-
/** Interrupt payload when the caller has not granted one or more
|
|
17
|
+
/** Interrupt payload when the caller has not granted one or more credentials. */
|
|
19
18
|
export interface CredentialAuthorizationRequiredInterrupt {
|
|
20
19
|
type: "credential_authorization_required";
|
|
21
20
|
message: string;
|
|
@@ -26,12 +25,12 @@ export interface LoadedCredentialTools {
|
|
|
26
25
|
tools: unknown[];
|
|
27
26
|
close: () => Promise<void>;
|
|
28
27
|
}
|
|
29
|
-
/** A declaration whose tools are unlocked by user-owned
|
|
28
|
+
/** A declaration whose tools are unlocked by user-owned credentials. */
|
|
30
29
|
export interface CredentialConsumer {
|
|
31
30
|
/** The declaration itself, used to key the per-caller tool cache. */
|
|
32
31
|
declaration: object;
|
|
33
|
-
/** User-owned
|
|
34
|
-
credentials: readonly
|
|
32
|
+
/** User-owned credential references the declaration needs. */
|
|
33
|
+
credentials: readonly CredentialReference[];
|
|
35
34
|
load: (accessTokens: ReadonlyMap<string, string>) => Promise<LoadedCredentialTools>;
|
|
36
35
|
}
|
|
37
36
|
export declare function createCredentialGateMiddleware(consumers: readonly CredentialConsumer[]): ReturnType<typeof createMiddleware> | undefined;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credential-gate.d.ts","sourceRoot":"","sources":["../src/credential-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"credential-gate.d.ts","sourceRoot":"","sources":["../src/credential-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAQ7C,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,kBAAkB,CAAC;AAY1B,eAAO,MAAM,+BAA+B,wBAAwB,CAAC;AAUrE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iFAAiF;AACjF,MAAM,WAAW,wCAAwC;IACvD,IAAI,EAAE,mCAAmC,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,iBAAiB,EAAE,CAAC;CAClC;AAED,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,WAAW,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC5C,IAAI,EAAE,CACJ,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KACtC,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACrC;AAuCD,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,SAAS,kBAAkB,EAAE,GACvC,UAAU,CAAC,OAAO,gBAAgB,CAAC,GAAG,SAAS,CAuCjD;AA+KD,0EAA0E;AAC1E,wBAAsB,gCAAgC,IAAI,OAAO,CAAC,IAAI,CAAC,CAStE"}
|
package/dist/credential-gate.js
CHANGED
|
@@ -1,15 +1,15 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* Pre-run gate for declarations that need a user-owned
|
|
2
|
+
* Pre-run gate for declarations that need a user-owned credential.
|
|
3
3
|
*
|
|
4
|
-
* Before the first model turn the gate reads the caller's OAuth grants
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
4
|
+
* Before the first model turn the gate reads the caller's OAuth grants from
|
|
5
|
+
* Agent Auth. Missing grants raise one LangGraph interrupt listing connect
|
|
6
|
+
* URLs; the tools a grant unlocks are loaded on first use and cached per
|
|
7
|
+
* caller.
|
|
8
8
|
*/
|
|
9
9
|
import { createMiddleware } from "langchain";
|
|
10
10
|
import { interrupt } from "@langchain/langgraph";
|
|
11
|
-
import { AgentAuth, CredentialAuthorizationRequiredError,
|
|
12
|
-
import { resolveAgentAuthContext, resolveOwnerId, } from "./
|
|
11
|
+
import { AgentAuth, CredentialAuthorizationRequiredError, } from "./agent-auth.js";
|
|
12
|
+
import { resolveAgentAuthContext, resolveOwnerId, } from "./credentials.js";
|
|
13
13
|
import { buildRuntimeIdentity, resolveRuntimeConfigurable, } from "./runtime/identity-runtime.js";
|
|
14
14
|
import { wrapToolsWithManagedRuntime, } from "./runtime/managed-tools.js";
|
|
15
15
|
export const CREDENTIAL_GATE_MIDDLEWARE_NAME = "mda-credential-gate";
|
|
@@ -33,7 +33,7 @@ const declarationIds = new WeakMap();
|
|
|
33
33
|
let nextDeclarationId = 0;
|
|
34
34
|
class UnauthenticatedCallerError extends Error {
|
|
35
35
|
constructor() {
|
|
36
|
-
super("
|
|
36
|
+
super("credentials with a user owner require an authenticated caller. " +
|
|
37
37
|
"Anonymous or agent-only runs cannot complete the credential gate.");
|
|
38
38
|
this.name = "UnauthenticatedCallerError";
|
|
39
39
|
}
|
|
@@ -75,48 +75,40 @@ export function createCredentialGateMiddleware(consumers) {
|
|
|
75
75
|
* Interrupt once when the caller is missing a grant.
|
|
76
76
|
*
|
|
77
77
|
* Reads never mint, so the probe is safe to repeat on every replay of this
|
|
78
|
-
* node.
|
|
79
|
-
*
|
|
78
|
+
* node. Sessions are minted once, immediately before the interrupt that shows
|
|
79
|
+
* their URLs.
|
|
80
80
|
*/
|
|
81
81
|
async function ensureGrants(consumers, caller) {
|
|
82
82
|
const agentAuth = new AgentAuth(caller.context);
|
|
83
|
-
const
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
83
|
+
const granted = await Promise.all(consumerCredentials(consumers, caller).map(async ({ slug }) => ({
|
|
84
|
+
slug,
|
|
85
|
+
token: await agentAuth.readUserAccessToken(slug),
|
|
86
|
+
})));
|
|
87
|
+
const missing = granted.filter((row) => !row.token).map((row) => row.slug);
|
|
88
|
+
if (missing.length === 0) {
|
|
87
89
|
return;
|
|
88
90
|
}
|
|
89
|
-
const
|
|
91
|
+
const pending = await Promise.all(missing.map((slug) => agentAuth.startAuthorizationSession(slug)));
|
|
90
92
|
const payload = {
|
|
91
93
|
type: "credential_authorization_required",
|
|
92
94
|
message: "Connect the following integrations to continue.",
|
|
93
|
-
credentials:
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
auth_id: session.authId,
|
|
99
|
-
})),
|
|
100
|
-
...missingSecret.map((row) => ({
|
|
101
|
-
slug: row.slug,
|
|
102
|
-
kind: "secret",
|
|
103
|
-
})),
|
|
104
|
-
],
|
|
95
|
+
credentials: pending.map((session) => ({
|
|
96
|
+
slug: session.slug,
|
|
97
|
+
connect_url: session.connectUrl,
|
|
98
|
+
auth_id: session.authId,
|
|
99
|
+
})),
|
|
105
100
|
};
|
|
106
101
|
// `interrupt` throws while no resume value is pending and returns once one
|
|
107
102
|
// is, so reaching the line below means the run resumed with a grant still
|
|
108
103
|
// missing.
|
|
109
104
|
interrupt(payload);
|
|
110
|
-
throw new CredentialAuthorizationRequiredError(
|
|
111
|
-
...missingOAuth.map((row) => row.slug),
|
|
112
|
-
...missingSecret.map((row) => row.slug),
|
|
113
|
-
]);
|
|
105
|
+
throw new CredentialAuthorizationRequiredError(missing);
|
|
114
106
|
}
|
|
115
107
|
/**
|
|
116
|
-
* Declared
|
|
108
|
+
* Declared credentials, one per slug.
|
|
117
109
|
*
|
|
118
110
|
* Every reference is resolved through {@link resolveOwnerId}, the same check
|
|
119
|
-
* `
|
|
111
|
+
* `credentials.get` applies when a tool awaits a handle, so a declaration that
|
|
120
112
|
* names another user is rejected here rather than quietly run as the caller.
|
|
121
113
|
*/
|
|
122
114
|
function consumerCredentials(consumers, caller) {
|
|
@@ -129,19 +121,6 @@ function consumerCredentials(consumers, caller) {
|
|
|
129
121
|
}
|
|
130
122
|
return [...bySlug.values()];
|
|
131
123
|
}
|
|
132
|
-
async function readUserConnectionGrants(agentAuth, references) {
|
|
133
|
-
return await Promise.all(references.map(async ({ slug }) => {
|
|
134
|
-
const row = await agentAuth.findWorkspaceConnection(slug);
|
|
135
|
-
if (!row) {
|
|
136
|
-
throw new CredentialStoreError(`workspace connection ${JSON.stringify(slug)} is not configured`);
|
|
137
|
-
}
|
|
138
|
-
const kind = row.kind === "secret" ? "secret" : "oauth2";
|
|
139
|
-
const token = kind === "secret"
|
|
140
|
-
? await agentAuth.readUserSecret(slug)
|
|
141
|
-
: await agentAuth.readUserAccessToken(slug);
|
|
142
|
-
return { slug, kind, token };
|
|
143
|
-
}));
|
|
144
|
-
}
|
|
145
124
|
async function toolsForRuntime(consumers, runtime) {
|
|
146
125
|
const caller = authContext(runtime);
|
|
147
126
|
return caller ? await toolsForContext(consumers, caller.context) : [];
|
|
@@ -186,12 +165,15 @@ async function refresh(key, consumer, context, lapsed) {
|
|
|
186
165
|
}
|
|
187
166
|
async function loadTools(consumer, context) {
|
|
188
167
|
const agentAuth = new AgentAuth(context);
|
|
189
|
-
const
|
|
190
|
-
|
|
168
|
+
const resolved = await Promise.all(consumer.credentials.map(async ({ slug }) => ({
|
|
169
|
+
slug,
|
|
170
|
+
token: await agentAuth.readUserAccessToken(slug),
|
|
171
|
+
})));
|
|
172
|
+
const missing = resolved.filter((row) => !row.token).map((row) => row.slug);
|
|
191
173
|
if (missing.length > 0) {
|
|
192
174
|
throw new CredentialAuthorizationRequiredError(missing);
|
|
193
175
|
}
|
|
194
|
-
const accessTokens = new Map(
|
|
176
|
+
const accessTokens = new Map(resolved.map((row) => [row.slug, row.token]));
|
|
195
177
|
const loaded = await consumer.load(accessTokens);
|
|
196
178
|
return {
|
|
197
179
|
tools: wrapToolsWithManagedRuntime(loaded.tools),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credential-gate.js","sourceRoot":"","sources":["../src/credential-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EACL,SAAS,EACT,oCAAoC,
|
|
1
|
+
{"version":3,"file":"credential-gate.js","sourceRoot":"","sources":["../src/credential-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EACL,SAAS,EACT,oCAAoC,GAErC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,uBAAuB,EACvB,cAAc,GAEf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAE3B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,2BAA2B,GAE5B,MAAM,4BAA4B,CAAC;AAEpC,MAAM,CAAC,MAAM,+BAA+B,GAAG,qBAAqB,CAAC;AAErE;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,GAAG,MAAM,CAAC;AA8CrC;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;AAEzD,MAAM,cAAc,GAAG,IAAI,OAAO,EAAkB,CAAC;AACrD,IAAI,iBAAiB,GAAG,CAAC,CAAC;AAE1B,MAAM,0BAA2B,SAAQ,KAAK;IAC5C;QACE,KAAK,CACH,iEAAiE;YAC/D,mEAAmE,CACtE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,UAAU,8BAA8B,CAC5C,SAAwC;IAExC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,gBAAgB,CAAC;QACtB,IAAI,EAAE,+BAA+B;QACrC,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO;YAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAwC,CAAC,CAAC;YACrE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0BAA0B,EAAE,CAAC;YACzC,CAAC;YACD,MAAM,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO;YAClC,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,SAAS,EACT,OAAO,CAAC,OAAwC,CACjD,CAAC;YACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO;YACjC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;YACpC,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,SAAS,EACT,OAAO,CAAC,OAAwC,CACjD,CAAC;YACF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjE,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CACzB,SAAwC,EACxC,MAAqB;IAErB,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI;QACJ,KAAK,EAAE,MAAM,SAAS,CAAC,mBAAmB,CAAC,IAAI,CAAC;KACjD,CAAC,CAAC,CACJ,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CACjE,CAAC;IACF,MAAM,OAAO,GAA6C;QACxD,IAAI,EAAE,mCAAmC;QACzC,OAAO,EAAE,iDAAiD;QAC1D,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,OAAO,CAAC,UAAU;YAC/B,OAAO,EAAE,OAAO,CAAC,MAAM;SACxB,CAAC,CAAC;KACJ,CAAC;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,WAAW;IACX,SAAS,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,IAAI,oCAAoC,CAAC,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAC1B,SAAwC,EACxC,MAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;IACtD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC9C,cAAc,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1E,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAAwC,EACxC,OAAsC;IAEtC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAAwC,EACxC,OAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAC5D,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAA4B,EAC5B,OAAyB;IAEzB,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAE5E,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;QACD,0EAA0E;QAC1E,kEAAkE;QAClE,4CAA4C;QAC5C,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,OAAO,CACpB,GAAW,EACX,QAA4B,EAC5B,OAAyB,EACzB,MAA8B;IAE9B,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7C,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5B,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,OAAO,CAAC,CAAC,KAAK,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;YACnC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,QAA4B,EAC5B,OAAyB;IAEzB,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI;QACJ,KAAK,EAAE,MAAM,SAAS,CAAC,mBAAmB,CAAC,IAAI,CAAC;KACjD,CAAC,CAAC,CACJ,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,oCAAoC,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAe,CAAC,CAAC,CACvD,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACjD,OAAO;QACL,KAAK,EAAE,2BAA2B,CAChC,MAAM,CAAC,KAAwB,CACjB;QAChB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,WAAmB;IACxC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,iBAAiB,IAAI,CAAC,CAAC;IACvB,MAAM,EAAE,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACrC,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACpC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAClB,OAAsC;IAEtC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,uBAAuB,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;AAClE,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,gCAAgC;IACpD,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,SAAS,CAAC,KAAK,EAAE,CAAC;IAClB,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC1B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,QAAQ,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}
|