managed-deepagents 0.6.2-dev.29 → 0.6.2-dev.30

package/dist/credentials.d.ts

@@ -0,0 +1,95 @@
+/**
+ * `credentials.get(...)` — read a managed credential from a tool.
+ *
+ * `owner` is the scope the credential resolves under, and names the same axis as
+ * Agent Auth's `owner_type` / `owner_id`. `{ type: "agent" }` is the deployment,
+ * so every caller resolves the same static secret. `{ type: "user" }` is the
+ * current caller, always backed by an OAuth grant. Resolution reads Agent Auth
+ * on every await and never caches.
+ *
+ * `mda dev` runs without a deployment, so it substitutes local values instead:
+ * `{ type: "agent" }` reads a normalized `MDA_DEV_*` environment variable, and
+ * `{ type: "user" }` has no local stand-in for an OAuth grant, so it fails with
+ * an actionable error. Both scopes work normally against a deployment.
+ */
+import type { RuntimeIdentity } from "./identity/index.js";
+import { type AgentAuthContext } from "./agent-auth.js";
+export { AGENT_AUTH_TIMEOUT_MS, AgentAuthUnknownProviderError, CredentialAuthorizationRequiredError, CredentialStoreError, } from "./agent-auth.js";
+export type { AgentAuthContext, PendingAuthorization } from "./agent-auth.js";
+export type AgentCredentialOwner = {
+    type: "agent";
+};
+export type UserCredentialOwner = {
+    type: "user";
+    id?: string;
+};
+export type CredentialOwner = AgentCredentialOwner | UserCredentialOwner;
+export interface CredentialRequest {
+    slug: string;
+    owner: CredentialOwner;
+    identity?: RuntimeIdentity;
+}
+declare const CREDENTIAL_REFERENCE: unique symbol;
+export declare class CredentialNotFoundError extends Error {
+    readonly slug: string;
+    readonly ownerType: CredentialOwner["type"];
+    constructor(slug: string, ownerType: CredentialOwner["type"]);
+}
+/**
+ * A declarative credential handle. Connector declarations inspect its owner;
+ * awaiting the same handle inside a tool resolves fresh material every time.
+ */
+export declare class CredentialReference implements PromiseLike<string> {
+    readonly slug: string;
+    readonly owner: CredentialOwner;
+    private readonly accessor;
+    readonly [CREDENTIAL_REFERENCE] = true;
+    constructor(slug: string, owner: CredentialOwner, accessor: Credentials);
+    then<TResult1 = string, TResult2 = never>(onfulfilled?: ((value: string) => TResult1 | PromiseLike<TResult1>) | null, onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null): PromiseLike<TResult1 | TResult2>;
+}
+export declare function isCredentialReference(value: unknown): value is CredentialReference;
+export declare class AgentAuthCredentialStore {
+    private readonly env;
+    private readonly fetchImpl;
+    private readonly timeoutMs;
+    constructor(env?: NodeJS.ProcessEnv, fetchImpl?: typeof fetch, timeoutMs?: number);
+    fetch(request: CredentialRequest): Promise<string | undefined>;
+}
+export declare class Credentials {
+    private readonly store;
+    constructor(store?: AgentAuthCredentialStore);
+    get(slug: string, owner: CredentialOwner): CredentialReference;
+    resolve(slug: string, owner: CredentialOwner): Promise<string>;
+    /**
+     * Read an agent-owned secret outside a run.
+     *
+     * Connector declarations are loaded once per deployment, before any caller
+     * exists. An agent-owned secret is deployment-scoped, so it is the one lookup
+     * that carries no caller and can be resolved there.
+     */
+    resolveDeploymentSecret(slug: string): Promise<string>;
+}
+/** Environment variable used for one agent-owned development credential. */
+export declare function agentCredentialEnvKey(slug: string): string;
+/**
+ * The `owner_id` a lookup is keyed by: the caller for a user, else the
+ * deployment. Shared with the credential gate so a declared owner is checked
+ * the same way wherever it is resolved.
+ */
+export declare function resolveOwnerId(owner: CredentialOwner, identity: RuntimeIdentity | undefined, deploymentId: string | undefined): string;
+/**
+ * The Agent Auth binding for one caller.
+ *
+ * `credentials.get` and the pre-run credential gate both resolve their owner id
+ * here, so a slug addresses the same Agent Auth row on either path.
+ */
+export declare function resolveAgentAuthContext(identity: RuntimeIdentity | undefined, env?: NodeJS.ProcessEnv): AgentAuthContext;
+/**
+ * Agent Auth is served by the LangSmith API.
+ *
+ * Rejects a URL that carries a path, query, or userinfo, so a misconfigured
+ * endpoint cannot send the API key at a different service.
+ */
+export declare function resolveAgentAuthBaseUrl(env?: NodeJS.ProcessEnv): string;
+export declare const credentials: Credentials;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAKL,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,oCAAoC,EACpC,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE9E,MAAM,MAAM,oBAAoB,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AACrD,MAAM,MAAM,mBAAmB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,mBAAmB,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED,QAAA,MAAM,oBAAoB,eAA0C,CAAC;AAuBrE,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAE5C,YAAY,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,EAK3D;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,WAAW,CAAC,MAAM,CAAC;IAI3D,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,KAAK,EAAE,eAAe;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAL3B,QAAQ,CAAC,CAAC,oBAAoB,CAAC,QAAQ;IAEvC,YACW,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,eAAe,EACd,QAAQ,EAAE,WAAW,EACpC;IAEJ,IAAI,CAAC,QAAQ,GAAG,MAAM,EAAE,QAAQ,GAAG,KAAK,EACtC,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,EAC1E,UAAU,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,KAAK,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,GAC1E,WAAW,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAIlC;CACF;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,mBAAmB,CAO9B;AASD,qBAAa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAH5B,YACmB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,SAAS,GAAE,OAAO,KAAa,EAC/B,SAAS,SAAwB,EAChD;IAEE,KAAK,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA8CnE;CACF;AAED,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IADxB,YACmB,KAAK,GAAE,wBAAyD,EAC/E;IAEJ,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,mBAAmB,CAM7D;IAEK,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBnE;IAED;;;;;;OAMG;IACG,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS3D;CACF;AAED,4EAA4E;AAC5E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI1D;AA+CD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,MAAM,CAqBR;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,gBAAgB,CAuBlB;AAiBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAoBR;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}

package/dist/{connections.js → credentials.js}

@@ -1,52 +1,58 @@
 /**
- * `connections.get(...)` — read a managed connection from a tool.
+ * `credentials.get(...)` — read a managed credential from a tool.
  *
- * `{ type: "agent" }` resolves shared workspace material on the connection row.
- * `{ type: "user" }` resolves per-caller grants (OAuth or opaque). Resolution
- * reads Agent Auth on every await and never caches.
+ * `owner` is the scope the credential resolves under, and names the same axis as
+ * Agent Auth's `owner_type` / `owner_id`. `{ type: "agent" }` is the deployment,
+ * so every caller resolves the same static secret. `{ type: "user" }` is the
+ * current caller, always backed by an OAuth grant. Resolution reads Agent Auth
+ * on every await and never caches.
  *
- * `mda dev` substitutes local values for agent opaque secrets via `MDA_DEV_*`.
- * User-owned connections need a deployment; opaque user grants use the same
- * pre-run gate as OAuth.
+ * `mda dev` runs without a deployment, so it substitutes local values instead:
+ * `{ type: "agent" }` reads a normalized `MDA_DEV_*` environment variable, and
+ * `{ type: "user" }` has no local stand-in for an OAuth grant, so it fails with
+ * an actionable error. Both scopes work normally against a deployment.
  */
 import { AGENT_AUTH_TIMEOUT_MS, AgentAuth, CredentialAuthorizationRequiredError, CredentialStoreError, } from "./agent-auth.js";
 import { buildRuntimeIdentity, resolveRuntimeConfigurable, } from "./runtime/identity-runtime.js";
 export { AGENT_AUTH_TIMEOUT_MS, AgentAuthUnknownProviderError, CredentialAuthorizationRequiredError, CredentialStoreError, } from "./agent-auth.js";
-const CONNECTION_REFERENCE = Symbol("managed-deepagents.connection");
+const CREDENTIAL_REFERENCE = Symbol("managed-deepagents.credential");
 const SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 const MAX_SLUG_LENGTH = 64;
 const DEFAULT_LANGSMITH_ENDPOINT = "https://api.smith.langchain.com";
 const DEV_CREDENTIAL_PREFIX = "MDA_DEV_";
-function localUserConnectionUnsupported(slug) {
+/**
+ * A user-owned credential is an OAuth grant held per caller against the
+ * deployment, and `mda dev` has no deployment to hold one.
+ */
+function localUserCredentialUnsupported(slug) {
     const localHint = slug
-        ? `set ${agentConnectionEnvKey(slug)}`
+        ? `set ${agentCredentialEnvKey(slug)}`
         : "set the corresponding MDA_DEV_<slug> variable";
-    return ("user-owned connections need a deployment, so they do not resolve in `mda dev`: " +
-        "deploy with `mda deploy` to exercise this connection, or declare it as " +
+    return ("user-scoped credentials need a deployment, so they do not resolve in `mda dev`: " +
+        "deploy with `mda deploy` to exercise this credential, or declare it as " +
         `{ type: "agent" } and ${localHint} for local runs`);
 }
-export class ConnectionNotFoundError extends Error {
+/** Agent Auth credential kinds, one per owner type. */
+const CREDENTIAL_KIND = { agent: "secret", user: "oauth2" };
+export class CredentialNotFoundError extends Error {
     slug;
     ownerType;
     constructor(slug, ownerType) {
-        super(`no ${ownerType} connection is set for slug ${JSON.stringify(slug)}`);
-        this.name = "ConnectionNotFoundError";
+        super(`no ${ownerType} credential is set for slug ${JSON.stringify(slug)}`);
+        this.name = "CredentialNotFoundError";
         this.slug = slug;
         this.ownerType = ownerType;
     }
 }
-/** `LANGSMITH_ENDPOINT` is missing a usable Agent Auth origin. */
-export class InvalidAgentAuthEndpointError extends CredentialStoreError {
-    name = "InvalidAgentAuthEndpointError";
-    constructor() {
-        super("LangSmith Agent Auth endpoint is not a valid URL (set LANGSMITH_ENDPOINT)");
-    }
-}
-export class ConnectionReference {
+/**
+ * A declarative credential handle. Connector declarations inspect its owner;
+ * awaiting the same handle inside a tool resolves fresh material every time.
+ */
+export class CredentialReference {
     slug;
     owner;
     accessor;
-    [CONNECTION_REFERENCE] = true;
+    [CREDENTIAL_REFERENCE] = true;
     constructor(slug, owner, accessor) {
         this.slug = slug;
         this.owner = owner;
@@ -58,13 +64,13 @@ export class ConnectionReference {
             .then(onfulfilled, onrejected);
     }
 }
-export function isConnectionReference(value) {
-    return (value instanceof ConnectionReference ||
+export function isCredentialReference(value) {
+    return (value instanceof CredentialReference ||
         (typeof value === "object" &&
             value !== null &&
-            CONNECTION_REFERENCE in value));
+            CREDENTIAL_REFERENCE in value));
 }
-export class AgentAuthConnectionStore {
+export class AgentAuthCredentialStore {
     env;
     fetchImpl;
     timeoutMs;
@@ -74,16 +80,18 @@ export class AgentAuthConnectionStore {
         this.timeoutMs = timeoutMs;
     }
     async fetch(request) {
+        // `mda dev` has no deployment to resolve against, so local values stand in
+        // for agent secrets and a user grant has nothing to stand in for.
         if (this.env.MDA_LOCAL_DEV === "1") {
             if (request.owner.type === "user") {
-                throw new CredentialStoreError(localUserConnectionUnsupported(request.slug));
+                throw new CredentialStoreError(localUserCredentialUnsupported(request.slug));
             }
-            const value = this.env[agentConnectionEnvKey(request.slug)];
+            const value = this.env[agentCredentialEnvKey(request.slug)];
             if (value !== undefined && value.trim()) {
                 return value;
             }
-            throw new CredentialStoreError(`local agent connection ${JSON.stringify(request.slug)} is not configured; ` +
-                `set ${agentConnectionEnvKey(request.slug)}`);
+            throw new CredentialStoreError(`local agent credential ${JSON.stringify(request.slug)} is not configured; ` +
+                `set ${agentCredentialEnvKey(request.slug)}`);
         }
         const config = resolveAgentAuthConfig(this.env);
         const ownerId = resolveOwnerId(request.owner, request.identity, config.deploymentId);
@@ -93,46 +101,33 @@ export class AgentAuthConnectionStore {
             principalId: ownerId,
             apiKey: config.apiKey,
             workspaceId: config.workspaceId,
-            serviceKey: config.serviceKey,
         }, this.fetchImpl, this.timeoutMs);
-        const row = await client.findWorkspaceConnection(request.slug);
-        if (!row) {
-            return undefined;
-        }
         if (request.owner.type === "user") {
-            if (row.kind === "secret") {
-                return await client.readUserSecret(request.slug);
-            }
-            if (row.kind === "oauth2") {
-                return await client.readUserAccessToken(request.slug);
-            }
-            return undefined;
+            return await client.readUserAccessToken(request.slug);
         }
-        if (row.kind === "secret") {
-            const credentialId = await client.findSecretCredentialId(row, request.slug);
-            if (!credentialId) {
-                return undefined;
-            }
-            return await client.readSecret(credentialId);
-        }
-        if (row.kind === "oauth2") {
-            return await client.readConnectionAccessToken(row.connectionId);
-        }
-        return undefined;
+        const credentialId = await client.findCredentialId({
+            ownerType: "agent",
+            ownerId,
+            kind: CREDENTIAL_KIND.agent,
+            slug: request.slug,
+        });
+        if (!credentialId)
+            return undefined;
+        return await client.readSecret(credentialId);
     }
 }
-export class Connections {
+export class Credentials {
     store;
-    constructor(store = new AgentAuthConnectionStore()) {
+    constructor(store = new AgentAuthCredentialStore()) {
         this.store = store;
     }
     get(slug, owner) {
-        return new ConnectionReference(normalizeSlug(slug), normalizeOwner(owner), this);
+        return new CredentialReference(normalizeSlug(slug), normalizeOwner(owner), this);
     }
     async resolve(slug, owner) {
         const configurable = resolveRuntimeConfigurable(undefined);
         if (!configurable) {
-            throw new Error("connections.get(...) must be awaited inside a run: resolve a connection in a tool or middleware, not at import time");
+            throw new Error("credentials.get(...) must be awaited inside a run: resolve a credential in a tool or middleware, not at import time");
         }
         const value = await this.store.fetch({
             slug,
@@ -142,49 +137,57 @@ export class Connections {
         if (value === undefined) {
             throw owner.type === "user"
                 ? new CredentialAuthorizationRequiredError([slug])
-                : new ConnectionNotFoundError(slug, owner.type);
+                : new CredentialNotFoundError(slug, owner.type);
         }
         return value;
     }
+    /**
+     * Read an agent-owned secret outside a run.
+     *
+     * Connector declarations are loaded once per deployment, before any caller
+     * exists. An agent-owned secret is deployment-scoped, so it is the one lookup
+     * that carries no caller and can be resolved there.
+     */
     async resolveDeploymentSecret(slug) {
         const value = await this.store.fetch({
             slug,
             owner: { type: "agent" },
         });
         if (value === undefined) {
-            throw new ConnectionNotFoundError(slug, "agent");
+            throw new CredentialNotFoundError(slug, "agent");
         }
         return value;
     }
 }
-export function agentConnectionEnvKey(slug) {
+/** Environment variable used for one agent-owned development credential. */
+export function agentCredentialEnvKey(slug) {
     return `${DEV_CREDENTIAL_PREFIX}${normalizeSlug(slug)
         .toUpperCase()
         .replaceAll("-", "_")}`;
 }
 function normalizeSlug(slug) {
     if (typeof slug !== "string") {
-        throw new TypeError("connection slug must be a string");
+        throw new TypeError("credential slug must be a string");
     }
     const canonical = slug.trim();
     if (!canonical ||
         canonical.length > MAX_SLUG_LENGTH ||
         !SLUG_PATTERN.test(canonical)) {
-        throw new TypeError(`connection slug ${JSON.stringify(slug)} is invalid: use lowercase letters, digits, and single hyphens, at most ${MAX_SLUG_LENGTH} characters`);
+        throw new TypeError(`credential slug ${JSON.stringify(slug)} is invalid: use lowercase letters, digits, and single hyphens, at most ${MAX_SLUG_LENGTH} characters`);
     }
     return canonical;
 }
 function normalizeOwner(owner) {
     if (!owner || typeof owner !== "object") {
-        throw new TypeError('connection owner is required: pass { type: "agent" } or { type: "user" }');
+        throw new TypeError('credential owner is required: pass { type: "agent" } or { type: "user" }');
     }
     const keys = Object.keys(owner);
     if (keys.some((key) => key !== "type" && key !== "id")) {
-        throw new TypeError("connection owner has an unknown key");
+        throw new TypeError("credential owner has an unknown key");
     }
     if (owner.type === "agent") {
         if ("id" in owner) {
-            throw new TypeError('connection owner "id" is not accepted for { type: "agent" }');
+            throw new TypeError('credential owner "id" is not accepted for { type: "agent" }');
         }
         return { type: "agent" };
     }
@@ -192,35 +195,48 @@ function normalizeOwner(owner) {
         if (owner.id === undefined)
             return { type: "user" };
         if (typeof owner.id !== "string" || !owner.id.trim()) {
-            throw new TypeError('connection owner "id" must be a non-empty string');
+            throw new TypeError('credential owner "id" must be a non-empty string');
         }
         return { type: "user", id: owner.id.trim() };
     }
-    throw new TypeError("connection owner type is not supported");
+    throw new TypeError("credential owner type is not supported");
 }
+/**
+ * The `owner_id` a lookup is keyed by: the caller for a user, else the
+ * deployment. Shared with the credential gate so a declared owner is checked
+ * the same way wherever it is resolved.
+ */
 export function resolveOwnerId(owner, identity, deploymentId) {
     if (owner.type === "user") {
         const authenticated = identity?.user.id;
         if (!authenticated) {
-            throw new CredentialStoreError("user connections require an authenticated user principal");
+            throw new CredentialStoreError("user credentials require an authenticated user principal");
         }
         if (owner.id !== undefined && owner.id !== authenticated) {
-            throw new CredentialStoreError("user connection owner id must match the authenticated principal");
+            throw new CredentialStoreError("user credential owner id must match the authenticated principal");
         }
         return authenticated;
     }
     if (!deploymentId) {
-        throw new CredentialStoreError("connections are not configured: LANGSMITH_HOST_PROJECT_ID is not set");
+        throw new CredentialStoreError("credentials are not configured: LANGSMITH_HOST_PROJECT_ID is not set");
     }
     return deploymentId;
 }
+/**
+ * The Agent Auth binding for one caller.
+ *
+ * `credentials.get` and the pre-run credential gate both resolve their owner id
+ * here, so a slug addresses the same Agent Auth row on either path.
+ */
 export function resolveAgentAuthContext(identity, env = process.env) {
+    // Only the user-credential gate resolves a context, so a local run can say
+    // why rather than reporting a missing deployment variable.
     if (env.MDA_LOCAL_DEV === "1") {
-        throw new CredentialStoreError(localUserConnectionUnsupported());
+        throw new CredentialStoreError(localUserCredentialUnsupported());
     }
     const config = resolveAgentAuthConfig(env);
     if (!config.deploymentId) {
-        throw new CredentialStoreError("connections are not configured: LANGSMITH_HOST_PROJECT_ID is not set");
+        throw new CredentialStoreError("credentials are not configured: LANGSMITH_HOST_PROJECT_ID is not set");
     }
     return {
         baseUrl: config.baseUrl,
@@ -228,42 +244,34 @@ export function resolveAgentAuthContext(identity, env = process.env) {
         principalId: resolveOwnerId({ type: "user" }, identity, config.deploymentId),
         apiKey: config.apiKey,
         workspaceId: config.workspaceId,
-        serviceKey: config.serviceKey,
     };
 }
 function resolveAgentAuthConfig(env) {
     const apiKey = env.LANGSMITH_API_KEY?.trim();
     if (!apiKey) {
-        throw new CredentialStoreError("connections are not configured: LANGSMITH_API_KEY is not set");
-    }
-    const workspaceId = env.LANGSMITH_WORKSPACE_ID?.trim();
-    if (!workspaceId) {
-        throw new CredentialStoreError("connections are not configured: LANGSMITH_WORKSPACE_ID is not set");
+        throw new CredentialStoreError("credentials are not configured: LANGSMITH_API_KEY is not set");
     }
     return {
         baseUrl: resolveAgentAuthBaseUrl(env),
         apiKey,
         deploymentId: env.LANGSMITH_HOST_PROJECT_ID?.trim() || undefined,
-        workspaceId,
-        serviceKey: env.MDA_AGENT_AUTH_SERVICE_KEY?.trim() || undefined,
+        workspaceId: env.LANGSMITH_WORKSPACE_ID?.trim() || undefined,
     };
 }
 /**
- * Origin for Agent Auth HTTP calls from `LANGSMITH_ENDPOINT`.
+ * Agent Auth is served by the LangSmith API.
  *
- * Cloud SaaS revisions omit that reserved name and inject `LANGCHAIN_ENDPOINT`
- * instead; read it as the same setting so we do not default to production.
+ * Rejects a URL that carries a path, query, or userinfo, so a misconfigured
+ * endpoint cannot send the API key at a different service.
  */
 export function resolveAgentAuthBaseUrl(env = process.env) {
-    const raw = env.LANGSMITH_ENDPOINT?.trim() ||
-        env.LANGCHAIN_ENDPOINT?.trim() ||
-        DEFAULT_LANGSMITH_ENDPOINT;
+    const raw = env.LANGSMITH_ENDPOINT?.trim() || DEFAULT_LANGSMITH_ENDPOINT;
     let parsed;
     try {
         parsed = new URL(raw);
     }
     catch {
-        throw new InvalidAgentAuthEndpointError();
+        throw new CredentialStoreError("LANGSMITH_ENDPOINT is not a valid URL");
     }
     if (!["http:", "https:"].includes(parsed.protocol) ||
         !parsed.hostname ||
@@ -272,9 +280,9 @@ export function resolveAgentAuthBaseUrl(env = process.env) {
         (parsed.pathname !== "/" && parsed.pathname !== "") ||
         parsed.search ||
         parsed.hash) {
-        throw new InvalidAgentAuthEndpointError();
+        throw new CredentialStoreError("LANGSMITH_ENDPOINT is not a valid URL");
     }
     return parsed.origin;
 }
-export const connections = new Connections();
-//# sourceMappingURL=connections.js.map
+export const credentials = new Credentials();
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EACL,qBAAqB,EACrB,SAAS,EACT,oCAAoC,EACpC,oBAAoB,GAErB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,oCAAoC,EACpC,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AAazB,MAAM,oBAAoB,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;AACrE,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAClD,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,0BAA0B,GAAG,iCAAiC,CAAC;AACrE,MAAM,qBAAqB,GAAG,UAAU,CAAC;AACzC;;;GAGG;AACH,SAAS,8BAA8B,CAAC,IAAa;IACnD,MAAM,SAAS,GAAG,IAAI;QACpB,CAAC,CAAC,OAAO,qBAAqB,CAAC,IAAI,CAAC,EAAE;QACtC,CAAC,CAAC,+CAA+C,CAAC;IACpD,OAAO,CACL,kFAAkF;QAClF,yEAAyE;QACzE,yBAAyB,SAAS,iBAAiB,CACpD,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,eAAe,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAW,CAAC;AAErE,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,CAAS;IACb,SAAS,CAA0B;IAE5C,YAAY,IAAY,EAAE,SAAkC;QAC1D,KAAK,CAAC,MAAM,SAAS,+BAA+B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IAInB,IAAI;IACJ,KAAK;IACG,QAAQ;IALlB,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC;IAEvC,YACW,IAAY,EACZ,KAAsB,EACd,QAAqB;oBAF7B,IAAI;qBACJ,KAAK;wBACG,QAAQ;IACxB,CAAC;IAEJ,IAAI,CACF,WAA0E,EAC1E,UAA2E;QAE3E,OAAO,IAAI,CAAC,QAAQ;aACjB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;aAC9B,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACnC,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAc;IAEd,OAAO,CACL,KAAK,YAAY,mBAAmB;QACpC,CAAC,OAAO,KAAK,KAAK,QAAQ;YACxB,KAAK,KAAK,IAAI;YACd,oBAAoB,IAAI,KAAK,CAAC,CACjC,CAAC;AACJ,CAAC;AASD,MAAM,OAAO,wBAAwB;IAEhB,GAAG;IACH,SAAS;IACT,SAAS;IAH5B,YACmB,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,SAAS,GAAiB,KAAK,EAC/B,SAAS,GAAG,qBAAqB;mBAFjC,GAAG;yBACH,SAAS;yBACT,SAAS;IACzB,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,OAA0B;QACpC,2EAA2E;QAC3E,kEAAkE;QAClE,IAAI,IAAI,CAAC,GAAG,CAAC,aAAa,KAAK,GAAG,EAAE,CAAC;YACnC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAClC,MAAM,IAAI,oBAAoB,CAC5B,8BAA8B,CAAC,OAAO,CAAC,IAAI,CAAC,CAC7C,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBACxC,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;gBAC1E,OAAO,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,cAAc,CAC5B,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,QAAQ,EAChB,MAAM,CAAC,YAAY,CACpB,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B;YACE,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,YAAY,IAAI,OAAO;YACvC,WAAW,EAAE,OAAO;YACpB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,EACD,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACf,CAAC;QACF,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,MAAM,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC;YACjD,SAAS,EAAE,OAAO;YAClB,OAAO;YACP,IAAI,EAAE,eAAe,CAAC,KAAK;YAC3B,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QACpC,OAAO,MAAM,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,OAAO,WAAW;IAEH,KAAK;IADxB,YACmB,KAAK,GAA6B,IAAI,wBAAwB,EAAE;qBAAhE,KAAK;IACrB,CAAC;IAEJ,GAAG,CAAC,IAAY,EAAE,KAAsB;QACtC,OAAO,IAAI,mBAAmB,CAC5B,aAAa,CAAC,IAAI,CAAC,EACnB,cAAc,CAAC,KAAK,CAAC,EACrB,IAAI,CACL,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,KAAsB;QAChD,MAAM,YAAY,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,qHAAqH,CACtH,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YACnC,IAAI;YACJ,KAAK;YACL,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC;SAC7C,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,KAAK,CAAC,IAAI,KAAK,MAAM;gBACzB,CAAC,CAAC,IAAI,oCAAoC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAClD,CAAC,CAAC,IAAI,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,uBAAuB,CAAC,IAAY;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YACnC,IAAI;YACJ,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACzB,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,GAAG,qBAAqB,GAAG,aAAa,CAAC,IAAI,CAAC;SAClD,WAAW,EAAE;SACb,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9B,IACE,CAAC,SAAS;QACV,SAAS,CAAC,MAAM,GAAG,eAAe;QAClC,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAC7B,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2EAA2E,eAAe,aAAa,CAC/I,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,KAAsB;IAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,SAAS,CACjB,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,SAAS,CACjB,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACpD,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;IAC/C,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAsB,EACtB,QAAqC,EACrC,YAAgC;IAEhC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,oBAAoB,CAC5B,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS,IAAI,KAAK,CAAC,EAAE,KAAK,aAAa,EAAE,CAAC;YACzD,MAAM,IAAI,oBAAoB,CAC5B,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,oBAAoB,CAC5B,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAqC,EACrC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,2EAA2E;IAC3E,2DAA2D;IAC3D,IAAI,GAAG,CAAC,aAAa,KAAK,GAAG,EAAE,CAAC;QAC9B,MAAM,IAAI,oBAAoB,CAAC,8BAA8B,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAC5B,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,YAAY;QAC5B,WAAW,EAAE,cAAc,CACzB,EAAE,IAAI,EAAE,MAAM,EAAE,EAChB,QAAQ,EACR,MAAM,CAAC,YAAY,CACpB;QACD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAsB;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,oBAAoB,CAC5B,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,uBAAuB,CAAC,GAAG,CAAC;QACrC,MAAM;QACN,YAAY,EAAE,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,SAAS;QAChE,WAAW,EAAE,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,SAAS;KAC7D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,0BAA0B,CAAC;IACzE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,uCAAuC,CAAC,CAAC;IAC1E,CAAC;IACD,IACE,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC9C,CAAC,MAAM,CAAC,QAAQ;QAChB,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,QAAQ;QACf,CAAC,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,IAAI,EACX,CAAC;QACD,MAAM,IAAI,oBAAoB,CAAC,uCAAuC,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC"}

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export { defineSchedule } from "./schedules.js";
 export { defineIdentity } from "./identity/index.js";
 export { defineMemory } from "./memory/index.js";
 export { auth, channels } from "./namespaces.js";
-export { connections, CredentialAuthorizationRequiredError, ConnectionNotFoundError, CredentialStoreError, InvalidAgentAuthEndpointError, } from "./connections.js";
+export { credentials, CredentialAuthorizationRequiredError, CredentialNotFoundError, CredentialStoreError, } from "./credentials.js";
 export { defineSandbox } from "./sandbox.js";
 export type { Channels } from "./namespaces.js";
 import { mcpConnector } from "./connectors/mcp/index.js";
@@ -14,7 +14,7 @@ export interface Connectors {
     /**
      * Declare remote MCP servers (HTTP/SSE) whose tools load at agent-graph
      * construction. Stdio servers are not supported. A server may name a
-     * connection; in `mda dev`, an agent-owned one resolves from a normalized
+     * credential; in `mda dev`, an agent-owned one resolves from a normalized
      * `MDA_DEV_*` environment variable instead of the deployment's Agent Auth
      * secret.
      *
@@ -25,7 +25,7 @@ export interface Connectors {
      *     docs: {
      *       transport: "http",
      *       url: "https://docs.example.com/mcp",
-     *       connection: connections.get("docs-token", { type: "agent" }),
+     *       credential: credentials.get("docs-token", { type: "agent" }),
      *     },
      *   },
      * });
@@ -37,12 +37,12 @@ export interface Connectors {
 }
 /** Public connectors namespace — MCP only for this release. */
 export declare const connectors: Connectors;
-export type { AgentConnectionOwner, ConnectionOwner, ConnectionRequest, UserConnectionOwner, } from "./connections.js";
+export type { AgentCredentialOwner, CredentialOwner, CredentialRequest, UserCredentialOwner, } from "./credentials.js";
 export type { DeepAgentDefinition, DefineDeepAgentConfig, ManagedDeepAgentKey, } from "./types.js";
 export type { ScheduleConfig, ScheduleDefinition, ScheduleDeliveryTarget, ScheduleThreadConfig, } from "./schedules.js";
 export type { ClaimMapping, CredentialScope, HttpIngress, IdentityAuth, IdentityConfig, IdentityDefinition, IdentityOptions, IdentitySource, LangSmithApiKeyIngress, Link, LinkStatus, Principal, PrincipalClaims, PrincipalEnvelope, PrincipalKind, RuntimeIdentity, Subject, SubjectAuthority, ValidatedTokenIngress, ValidatedTokenProvider, } from "./identity/index.js";
 export type { MemoryConfig, MemoryDefinition, MemoryOptions, MemoryScope, MemoryScopeInput, MemorySliceInput, MemorySliceKind, ResolvedMemorySlice, } from "./memory/index.js";
-export type { HttpMcpServerConfig, McpServerConnection, McpServersConfig, McpServersDefinition, McpToolSelectionConfig, RemoteMcpServerBaseConfig, RemoteMcpServerConfig, SseMcpServerConfig, } from "./connectors/mcp/index.js";
+export type { HttpMcpServerConfig, McpServersConfig, McpServersDefinition, McpServerCredential, McpToolSelectionConfig, RemoteMcpServerBaseConfig, RemoteMcpServerConfig, SseMcpServerConfig, } from "./connectors/mcp/index.js";
 export type { CredentialAuthorizationRequiredInterrupt, PendingCredential, } from "./credential-gate.js";
 export type { ChannelManifest } from "./channels/manifest.js";
 export type { RequiredTriggerSlackChannelConfig, SlackChannel, SlackChannelConfig, } from "./channels/slack/index.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,WAAW,EACX,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,GAAG,EAAE,OAAO,YAAY,CAAC;CAC1B;AAED,+DAA+D;AAC/D,eAAO,MAAM,UAAU,EAAE,UAExB,CAAC;AAEF,YAAY,EACV,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,YAAY,EACZ,eAAe,EACf,WAAW,EACX,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,IAAI,EACJ,UAAU,EACV,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,OAAO,EACP,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,wCAAwC,EACxC,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,iCAAiC,EACjC,YAAY,EACZ,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEtE,YAAY,EACV,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,WAAW,EACX,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,GAAG,EAAE,OAAO,YAAY,CAAC;CAC1B;AAED,+DAA+D;AAC/D,eAAO,MAAM,UAAU,EAAE,UAExB,CAAC;AAEF,YAAY,EACV,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,YAAY,EACZ,eAAe,EACf,WAAW,EACX,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,IAAI,EACJ,UAAU,EACV,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,OAAO,EACP,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,wCAAwC,EACxC,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,iCAAiC,EACjC,YAAY,EACZ,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEtE,YAAY,EACV,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -3,7 +3,7 @@ export { defineSchedule } from "./schedules.js";
 export { defineIdentity } from "./identity/index.js";
 export { defineMemory } from "./memory/index.js";
 export { auth, channels } from "./namespaces.js";
-export { connections, CredentialAuthorizationRequiredError, ConnectionNotFoundError, CredentialStoreError, InvalidAgentAuthEndpointError, } from "./connections.js";
+export { credentials, CredentialAuthorizationRequiredError, CredentialNotFoundError, CredentialStoreError, } from "./credentials.js";
 export { defineSandbox } from "./sandbox.js";
 import { mcpConnector } from "./connectors/mcp/index.js";
 /** Public connectors namespace — MCP only for this release. */

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,WAAW,EACX,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AA+BzD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,GAAG,EAAE,YAAY;CAClB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,WAAW,EACX,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AA+BzD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,GAAG,EAAE,YAAY;CAClB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "managed-deepagents",
-  "version": "0.6.2-dev.29",
+  "version": "0.6.2-dev.30",
   "description": "Managed Deep Agents — the `defineDeepAgent` authoring interface plus the CLI that compiles and deploys a code-first Deep Agent repository to a managed LangGraph runtime.",
   "keywords": [
     "langchain",
@@ -66,12 +66,12 @@
     "zod": "^4.4.3"
   },
   "optionalDependencies": {
-    "@langchain/managed-deepagents-darwin-arm64": "0.6.2-dev.29",
-    "@langchain/managed-deepagents-darwin-x64": "0.6.2-dev.29",
-    "@langchain/managed-deepagents-linux-arm64": "0.6.2-dev.29",
-    "@langchain/managed-deepagents-linux-x64": "0.6.2-dev.29",
-    "@langchain/managed-deepagents-win32-arm64": "0.6.2-dev.29",
-    "@langchain/managed-deepagents-win32-x64": "0.6.2-dev.29"
+    "@langchain/managed-deepagents-darwin-arm64": "0.6.2-dev.30",
+    "@langchain/managed-deepagents-darwin-x64": "0.6.2-dev.30",
+    "@langchain/managed-deepagents-linux-arm64": "0.6.2-dev.30",
+    "@langchain/managed-deepagents-linux-x64": "0.6.2-dev.30",
+    "@langchain/managed-deepagents-win32-arm64": "0.6.2-dev.30",
+    "@langchain/managed-deepagents-win32-x64": "0.6.2-dev.30"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",