managed-deepagents 0.6.2-dev.4 → 0.6.2-dev.41

package/dist/runtime/identity-runtime.js

@@ -1,5 +1,6 @@
 import { getConfig } from "@langchain/langgraph";
 import { trustedChannelSourceProviders } from "../channels/registry-store.js";
+import { normalizeGroups, } from "../identity/index.js";
 /**
  * Identity fields a client must never assert via `config.configurable`; only the
  * custom-auth handler (`langgraph_auth_user`) is trusted.
@@ -88,6 +89,10 @@ export function resolveAmbientConfigurable() {
  * `langgraph_auth_user` the custom-auth handler produced. Returns
  * `undefined` when the deployment has no resolvable user (identity is opt-in).
  *
+ * Used by HTTP connector handlers (`resolveRequestIdentity`). Tools and
+ * middleware should use {@link buildPrincipalEnvelope} /
+ * `runtime.serverInfo.principal` instead.
+ *
  * LangGraph Studio injects a `StudioUser` (no `mda_user_id`) when
  * `x-auth-scheme: langsmith` is present; that maps to a service principal with
  * `source.provider: "studio"` so user-scoped memory/credentials still resolve
@@ -141,6 +146,149 @@ function deepFreeze(value) {
     }
     return value;
 }
+/**
+ * Reassemble the Agent Auth wire envelope from flattened `serverInfo` fields.
+ */
+export function principalEnvelopeFromServerInfo(info) {
+    if (!info?.principal || !info.subject || !info.link) {
+        return undefined;
+    }
+    return deepFreeze({
+        principal: info.principal,
+        subject: info.subject,
+        link: info.link,
+    });
+}
+/**
+ * Resolve the trusted auth user for `runtime.serverInfo.user`. Returns
+ * `undefined` when the deployment has no resolvable caller (identity is opt-in).
+ */
+export function resolveAuthUser(configurable) {
+    const user = configurable?.langgraph_auth_user;
+    const studio = isStudioAuthUser(user);
+    const userId = user?.mda_user_id ?? (studio ? user?.identity : undefined);
+    if (!user || !userId) {
+        return undefined;
+    }
+    return deepFreeze({
+        ...user,
+        identity: typeof user.identity === "string" && user.identity.trim().length > 0
+            ? user.identity
+            : String(userId),
+        permissions: Array.isArray(user.permissions) ? user.permissions : [],
+        mda_user_id: String(user.mda_user_id ?? userId),
+    });
+}
+/**
+ * Project trusted auth stamps into an Agent Auth–aligned
+ * {@link PrincipalEnvelope}. Returns `undefined` when no caller resolved.
+ *
+ * Today this is built from `langgraph_auth_user`; later Agent Auth
+ * `resolve-principal` can supply the same shape directly.
+ */
+export function buildPrincipalEnvelope(configurable, agentId = "") {
+    const user = configurable?.langgraph_auth_user;
+    const studio = isStudioAuthUser(user);
+    const userId = user?.mda_user_id ?? (studio ? user?.identity : undefined);
+    if (!user || !userId) {
+        return undefined;
+    }
+    const isService = studio || user.mda_user_kind === "service";
+    const kind = isService ? "service" : "person";
+    const authority = isService ? "agent" : "user";
+    const envelope = {
+        principal: {
+            id: String(userId),
+            kind,
+            claims: principalClaims(user),
+        },
+        subject: {
+            authority,
+            ...(agentId ? { agent_id: agentId } : {}),
+            ...(authority === "user" ? { user_id: String(userId) } : {}),
+        },
+        link: { status: "not_required" },
+    };
+    return deepFreeze(envelope);
+}
+/**
+ * Build the caller's claim bag, normalizing the two claims MDA names.
+ *
+ * `mda_groups` / `mda_user_email` are already normalized, but they are only
+ * stamped when the deployment mapped those claims — mapping both is optional.
+ * The raw token payload sits in `mda_claims` and can carry a `groups` or
+ * `email` of any shape, so normalize whatever survives and drop it when it
+ * does not normalize. Otherwise {@link PrincipalClaims} would promise a string
+ * array on a deployment that never mapped `groups` and hand back the delimited
+ * string the IdP sent.
+ */
+function principalClaims(user) {
+    const claims = {
+        ...(user.mda_claims && typeof user.mda_claims === "object"
+            ? user.mda_claims
+            : {}),
+    };
+    const groups = normalizeGroups(user.mda_groups ?? claims.groups);
+    if (groups.length > 0) {
+        claims.groups = groups;
+    }
+    else {
+        delete claims.groups;
+    }
+    const email = user.mda_user_email ?? claims.email;
+    if (typeof email === "string" && email.length > 0) {
+        claims.email = email;
+    }
+    else {
+        delete claims.email;
+    }
+    return claims;
+}
+/**
+ * Build LangGraph `serverInfo` with the trusted auth user, principal envelope,
+ * and ingress source. Preserves platform `assistantId` / `graphId` when present
+ * and omits them otherwise, rather than reporting an empty id as a real one.
+ */
+export function buildManagedServerInfo(runtime, configurable) {
+    const user = resolveAuthUser(configurable);
+    if (!user) {
+        return undefined;
+    }
+    const existing = runtime?.serverInfo ?? runtime?.config?.serverInfo;
+    const assistantId = typeof existing?.assistantId === "string" && existing.assistantId
+        ? existing.assistantId
+        : undefined;
+    const graphId = typeof existing?.graphId === "string" && existing.graphId
+        ? existing.graphId
+        : undefined;
+    const agentId = assistantId ?? graphId ?? "";
+    const envelope = buildPrincipalEnvelope(configurable, agentId);
+    return deepFreeze({
+        ...(assistantId ? { assistantId } : {}),
+        ...(graphId ? { graphId } : {}),
+        ...(envelope
+            ? {
+                principal: envelope.principal,
+                subject: envelope.subject,
+                link: envelope.link,
+            }
+            : {}),
+        source: buildIdentitySource(configurable),
+        user,
+    });
+}
+/**
+ * Resolve the ingress source for `serverInfo.source` from the trusted stamps,
+ * so authors do not have to read `serverInfo.user.mda_source_provider`.
+ */
+export function buildIdentitySource(configurable) {
+    const user = configurable?.langgraph_auth_user;
+    const thread = threadId(configurable);
+    return {
+        provider: isStudioAuthUser(user) ? "studio" : sourceProvider(configurable),
+        ...(thread ? { threadId: thread } : {}),
+    };
+}
 /**
  * Strip client-supplied identity keys from an incoming `configurable` so a
  * request body can never spoof the user the handler resolved. The platform-set

package/dist/runtime/identity-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-runtime.js","sourceRoot":"","sources":["../../src/runtime/identity-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAM9E;;;GAGG;AACH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,UAAU;IACV,WAAW;IACX,aAAa;IACb,qBAAqB;IACrB,gBAAgB;IAChB,YAAY;IACZ,eAAe;IACf,qBAAqB;IACrB,sBAAsB;IACtB;;;OAGG;IACH,SAAS;IACT,iBAAiB;IACjB,aAAa;IACb,qBAAqB;IACrB,YAAY;IACZ,eAAe;IACf,gBAAgB;IAChB,6EAA6E;IAC7E,qBAAqB;IACrB,+DAA+D;IAC/D,cAAc;CACf,CAAC,CAAC;AAEH,IAAI,2BAES,CAAC;AAEd,+EAA+E;AAC/E,MAAM,UAAU,8BAA8B,CAC5C,MAAkD;IAElD,2BAA2B,GAAG,MAAM,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAsC;IAEtC,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,WAAW,IAAI,qBAAqB,IAAI,WAAW,EAAE,CAAC;QACxD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;IAC7C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,uBAAuB,CACrC,OAAsC;IAEtC,MAAM,WAAW,GAAG,OAAO,EAAE,YAAY,IAAI,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC;IAC3E,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO,WAAsC,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,0BAA0B;IAGxC,IAAI,2BAA2B,EAAE,CAAC;QAChC,OAAO,2BAA2B,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,SAAS,EAAE,CAAC,YAAY,CAAC;QAC9C,IAAI,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,YAAuC,CAAC;QACjD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAiD;IAEjD,MAAM,IAAI,GAAG,YAAY,EAAE,mBAA8C,CAAC;IAC1E,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,EAAE,WAAW,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1E,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC;IAC7D,MAAM,QAAQ,GAAoB;QAChC,IAAI,EAAE;YACJ,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACtC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC;YAC1D,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE;KACF,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjE,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC3D,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,UAAqC,CAAC;IAC/D,CAAC;IACD,4EAA4E;IAC5E,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,oEAAoE;AACpE,SAAS,gBAAgB,CAAC,IAA6B;IACrD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,KAAK,uBAAuB,CAAC;AACnD,CAAC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,UAAU,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAcD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAiD;IAEjD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,MAAM,CACjC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,CAChD,CACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAEhF,SAAS,+BAA+B,CAAC,QAAgB;IACvD,IAAI,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,8EAA8E;IAC9E,OAAO,CACL,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,QAAQ;QACrB,6BAA6B,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,YAAiD;IAEjD,MAAM,IAAI,GAAG,YAAY,EAAE,mBAA8C,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,EAAE,mBAAmB,CAAC;IAC3C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,+BAA+B,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,YAAY,EAAE,mBAAmB,CAAC;IACnD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,+BAA+B,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CACf,YAAiD;IAEjD,MAAM,IAAI,GAAG,YAAY,EAAE,mBAA8C,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,EAAE,oBAAoB,CAAC;IAC5C,IAAI,QAAQ,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IACD,8CAA8C;IAC9C,MAAM,KAAK,GAAG,YAAY,EAAE,SAAS,CAAC;IACtC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"identity-runtime.js","sourceRoot":"","sources":["../../src/runtime/identity-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAE9E,OAAO,EACL,eAAe,GAUhB,MAAM,sBAAsB,CAAC;AAI9B;;;GAGG;AACH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,UAAU;IACV,WAAW;IACX,aAAa;IACb,qBAAqB;IACrB,gBAAgB;IAChB,YAAY;IACZ,eAAe;IACf,qBAAqB;IACrB,sBAAsB;IACtB;;;OAGG;IACH,SAAS;IACT,iBAAiB;IACjB,aAAa;IACb,qBAAqB;IACrB,YAAY;IACZ,eAAe;IACf,gBAAgB;IAChB,6EAA6E;IAC7E,qBAAqB;IACrB,+DAA+D;IAC/D,cAAc;CACf,CAAC,CAAC;AAEH,IAAI,2BAES,CAAC;AAEd,+EAA+E;AAC/E,MAAM,UAAU,8BAA8B,CAC5C,MAAkD;IAElD,2BAA2B,GAAG,MAAM,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAsC;IAEtC,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,WAAW,IAAI,qBAAqB,IAAI,WAAW,EAAE,CAAC;QACxD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;IAC7C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,uBAAuB,CACrC,OAAsC;IAEtC,MAAM,WAAW,GAAG,OAAO,EAAE,YAAY,IAAI,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC;IAC3E,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO,WAAsC,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,0BAA0B;IAGxC,IAAI,2BAA2B,EAAE,CAAC;QAChC,OAAO,2BAA2B,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,SAAS,EAAE,CAAC,YAAY,CAAC;QAC9C,IAAI,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,YAAuC,CAAC;QACjD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAiD;IAEjD,MAAM,IAAI,GAAG,YAAY,EAAE,mBAA8C,CAAC;IAC1E,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,EAAE,WAAW,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1E,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC;IAC7D,MAAM,QAAQ,GAAoB;QAChC,IAAI,EAAE;YACJ,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACtC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC;YAC1D,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE;KACF,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjE,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC3D,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,UAAqC,CAAC;IAC/D,CAAC;IACD,4EAA4E;IAC5E,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,oEAAoE;AACpE,SAAS,gBAAgB,CAAC,IAA6B;IACrD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,KAAK,uBAAuB,CAAC;AACnD,CAAC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,UAAU,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AA6BD;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAC7C,IAAmC;IAEnC,IAAI,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACpD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC;AACL,CAAC;AAiBD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,YAAiD;IAEjD,MAAM,IAAI,GAAG,YAAY,EAAE,mBAA8C,CAAC;IAC1E,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,EAAE,WAAW,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1E,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC;QAChB,GAAG,IAAI;QACP,QAAQ,EACN,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAClE,CAAC,CAAC,IAAI,CAAC,QAAQ;YACf,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;QACpE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAiD,EACjD,OAAO,GAAG,EAAE;IAEZ,MAAM,IAAI,GAAG,YAAY,EAAE,mBAA8C,CAAC;IAC1E,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,EAAE,WAAW,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1E,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC;IAC7D,MAAM,IAAI,GAAkB,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7D,MAAM,SAAS,GAAqB,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACjE,MAAM,QAAQ,GAAsB;QAClC,SAAS,EAAE;YACT,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;YAClB,IAAI;YACJ,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC;SAC9B;QACD,OAAO,EAAE;YACP,SAAS;YACT,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D;QACD,IAAI,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;KACjC,CAAC;IACF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,IAAiB;IACxC,MAAM,MAAM,GAAoB;QAC9B,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;YACxD,CAAC,CAAE,IAAI,CAAC,UAAsC;YAC9C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IACjE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,KAAK,CAAC;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAsC,EACtC,YAAiD;IAEjD,MAAM,IAAI,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC;IACpE,MAAM,WAAW,GACf,OAAO,QAAQ,EAAE,WAAW,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW;QAC/D,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,OAAO,GACX,OAAO,QAAQ,EAAE,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO;QACvD,CAAC,CAAC,QAAQ,CAAC,OAAO;QAClB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,OAAO,GAAG,WAAW,IAAI,OAAO,IAAI,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC/D,OAAO,UAAU,CAAC;QAChB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,QAAQ;YACV,CAAC,CAAC;gBACE,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;aACpB;YACH,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,EAAE,mBAAmB,CAAC,YAAY,CAAC;QACzC,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAiD;IAEjD,MAAM,IAAI,GAAG,YAAY,EAAE,mBAA8C,CAAC;IAC1E,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACtC,OAAO;QACL,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC;QAC1E,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAiD;IAEjD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,MAAM,CACjC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,CAChD,CACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAEhF,SAAS,+BAA+B,CAAC,QAAgB;IACvD,IAAI,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,8EAA8E;IAC9E,OAAO,CACL,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,QAAQ;QACrB,6BAA6B,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,YAAiD;IAEjD,MAAM,IAAI,GAAG,YAAY,EAAE,mBAA8C,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,EAAE,mBAAmB,CAAC;IAC3C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,+BAA+B,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,YAAY,EAAE,mBAAmB,CAAC;IACnD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,+BAA+B,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CACf,YAAiD;IAEjD,MAAM,IAAI,GAAG,YAAY,EAAE,mBAA8C,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,EAAE,oBAAoB,CAAC;IAC5C,IAAI,QAAQ,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IACD,8CAA8C;IAC9C,MAAM,KAAK,GAAG,YAAY,EAAE,SAAS,CAAC;IACtC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC"}

package/dist/runtime/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AA8BvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAExE,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AAExE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAIzD,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,WAAW,EACX,kBAAkB,EAClB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,SAAS,EACT,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,yBAAyB,EACzB,aAAa,EACb,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,eAAe,EACf,SAAS,EACT,wBAAwB,GACzB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,OAAO,EACP,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,mBAAmB,EAC/B,MAAM,CAAC,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2YAqJ9B;AAED,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAC9C,mBAAmB,EACnB,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CACnD;IACC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,mBAAmB,EAC/B,MAAM,CAAC,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2YAsB7B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAgCvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAExE,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AAExE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAIzD,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,WAAW,EACX,kBAAkB,EAClB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,SAAS,EACT,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,yBAAyB,EACzB,aAAa,EACb,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,eAAe,EACf,SAAS,EACT,wBAAwB,GACzB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,OAAO,EACP,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,mBAAmB,EAC/B,MAAM,CAAC,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2YA0J9B;AAED,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAC9C,mBAAmB,EACnB,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CACnD;IACC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,mBAAmB,EAC/B,MAAM,CAAC,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2YAsB7B"}

package/dist/runtime/index.js

@@ -3,6 +3,8 @@ import { LazyManagedSandboxBackend } from "./backend.js";
 import { loadConnectorTools } from "./connector.js";
 import { createScheduleDeliveryMiddleware } from "../channels/schedule-delivery.js";
 import { createChannelResponseFormatMiddleware } from "../channels/response-format.js";
+import { createCredentialGateMiddleware } from "../credential-gate.js";
+import { mcpCredentialConsumers } from "../connectors/mcp/index.js";
 import { wrapMiddlewareWithManagedRuntime, } from "./managed-middleware.js";
 import { wrapToolsWithManagedRuntime, } from "./managed-tools.js";
 import { createMemoryInstructionsMiddleware, hasAgentMemorySlice, hotMemoryPaths, } from "../memory/index.js";
@@ -32,8 +34,8 @@ export async function compileManagedAgent(definition, config, options) {
     // one object, but mounting is owned by the managed HTTP app — leave it on
     // `options` unused here.
     // Resolution + thread/store scoping run in the generated custom-auth handler
-    // (`buildManagedAuth`). When identity is declared, the seam also surfaces the
-    // frozen `runtime.identity` envelope to authored + connector tools (below).
+    // (`buildManagedAuth`). When identity is declared, the seam also surfaces
+    // `runtime.serverInfo.principal` to authored + connector tools (below).
     identity, 
     // The root `memory.{ts,py}` declaration. Absent → no durable memory: the
     // slices a run mounts come from here and nowhere else.
@@ -108,15 +110,14 @@ export async function compileManagedAgent(definition, config, options) {
         const authoredTools = Array.isArray(params.tools) ? params.tools : [];
         params.tools = [...authoredTools, ...connectorTools];
     }
-    // With identity declared, surface the frozen `runtime.identity` envelope on
-    // the runtime every tool receives, built from the trusted
-    // `langgraph_auth_user`.
+    // With identity declared, surface `runtime.serverInfo.principal` on the runtime
+    // every tool receives, projected from the trusted `langgraph_auth_user`.
     if (identity && Array.isArray(params.tools)) {
         params.tools = wrapToolsWithManagedRuntime(params.tools);
     }
     // Do the same for authored middleware: each hook's `runtime` (and the `wrap*`
-    // hooks' `request.runtime`) gains `runtime.identity`, built from the same
-    // trusted `langgraph_auth_user` on `runtime.configurable`.
+    // hooks' `request.runtime`) gains `runtime.serverInfo.principal`, built from the
+    // same trusted `langgraph_auth_user` on `runtime.configurable`.
     const authoredMiddleware = Array.isArray(params.middleware)
         ? params.middleware
         : [];
@@ -124,14 +125,18 @@ export async function compileManagedAgent(definition, config, options) {
         ? wrapMiddlewareWithManagedRuntime(authoredMiddleware)
         : authoredMiddleware;
     // Always-on schedule deliverTo auto-post (cron runs); prepend before authored.
+    // The credential gate runs early so OAuth interrupts happen before the model
+    // turn; it only installs when a declaration names a user-owned credential.
     // The memory policy goes last on purpose. First in this list is outermost, so a
     // middleware placed earlier can have its prompt replaced by an authored one that
     // rewrites `systemPrompt` wholesale — and this policy is a security control, not a
     // hint. Last means nothing authored runs after it. deepagents still appends its own
     // `<agent_memory>` block after the whole custom stack, so the policy's "block below"
     // wording stays accurate.
+    const credentialGate = createCredentialGateMiddleware(mcpCredentialConsumers(connectors));
     params.middleware = [
         createScheduleDeliveryMiddleware(),
+        ...(credentialGate ? [credentialGate] : []),
         ...wrappedAuthored,
         createChannelResponseFormatMiddleware(),
         ...(mountsMemory ? [createMemoryInstructionsMiddleware()] : []),

package/dist/runtime/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAC;AACvF,OAAO,EAEL,gCAAgC,GACjC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAEL,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kCAAkC,EAClC,mBAAmB,EACnB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,MAAM,EACN,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AAExE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,0EAA0E;AAC1E,gFAAgF;AAChF,wBAAwB;AACxB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,WAAW,EACX,kBAAkB,EAClB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAgBxB,OAAO,EACL,aAAa,EACb,eAAe,EACf,SAAS,EACT,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAStB;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAA+B,EAC/B,MAAyB,EACzB,OAA6B;IAE7B,MAAM,EACJ,WAAW,EACX,WAAW,EACX,YAAY,EACZ,SAAS,GAAG,KAAK,EACjB,OAAO,EACP,UAAU;IACV,4EAA4E;IAC5E,0EAA0E;IAC1E,yBAAyB;IACzB,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,QAAQ;IACR,yEAAyE;IACzE,uDAAuD;IACvD,MAAM,EACN,YAAY,GACb,GAAG,OAAO,IAAI,EAAE,CAAC;IAElB,MAAM,EAAE,QAAQ,EAAE,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC;IACvD,+EAA+E;IAC/E,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,MAAM,GAA4B,EAAE,GAAG,WAAW,EAAE,CAAC;IAE3D;;;;;;;;OAQG;IACH,MAAM,qBAAqB,GACzB,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QACjC,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC;QAChC,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,cAAc,GAAG,OAAO;QAC5B,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC;YAC/B,OAAO;YACP,SAAS,EAAE,MAAM;YACjB,UAAU;YACV,QAAQ;SACT,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC7E,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,YAAY,GAAG,SAAS,CAAC;QAClC,CAAC;QACD,6EAA6E;QAC7E,uEAAuE;QACvE,MAAM,YAAY,GAAgB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9D,MAAM,CAAC,OAAO,GAAG,qBAAqB,CACpC,cAAc,CAAC,OAAO,EACtB,cAAc,EACd,mBAAmB,CAAC,YAAY,CAAC,CAClC,CAAC;QACF,8EAA8E;QAC9E,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,CAAC,WAAW,GAAG,cAAc;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,GAAG,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC;YACpB,6EAA6E;YAC7E,8EAA8E;YAC9E,+DAA+D;YAC/D,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,6EAA6E;QAC7E,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;QACrC,CAAC;QACD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO,GAAG,cAAc,CAAC;QAClC,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACxB,kFAAkF;YAClF,MAAM,CAAC,OAAO,GAAG,gCAAgC,CAAC,YAAY,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC;IACnD,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,KAAK,GAAG,CAAC,GAAG,aAAa,EAAE,GAAG,cAAc,CAAC,CAAC;IACvD,CAAC;IAED,4EAA4E;IAC5E,0DAA0D;IAC1D,yBAAyB;IACzB,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,KAAK,GAAG,2BAA2B,CAAC,MAAM,CAAC,KAAwB,CAAC,CAAC;IAC9E,CAAC;IAED,8EAA8E;IAC9E,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QACzD,CAAC,CAAE,MAAM,CAAC,UAAkC;QAC5C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,eAAe,GAAG,QAAQ;QAC9B,CAAC,CAAC,gCAAgC,CAAC,kBAAkB,CAAC;QACtD,CAAC,CAAC,kBAAkB,CAAC;IACvB,+EAA+E;IAC/E,gFAAgF;IAChF,iFAAiF;IACjF,mFAAmF;IACnF,oFAAoF;IACpF,qFAAqF;IACrF,0BAA0B;IAC1B,MAAM,CAAC,UAAU,GAAG;QAClB,gCAAgC,EAAE;QAClC,GAAG,eAAe;QAClB,qCAAqC,EAAE;QACvC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,kCAAkC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC;IAEF,8EAA8E;IAC9E,gEAAgE;IAChE,EAAE;IACF,6EAA6E;IAC7E,gEAAgE;IAChE,0EAA0E;IAC1E,2EAA2E;IAC3E,sCAAsC;IACtC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,SAAS,GAA4B;QACzC,cAAc,EAAE,uBAAuB;KACxC,CAAC;IACF,IAAI,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAChC,CAAC;IACD,OAAO,0BAA0B,CAC/B,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAC3B,uBAAuB,CACxB,CAAC;AACJ,CAAC;AASD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,UAA+B,EAC/B,MAAyB,EACzB,OAA4B;IAE5B,MAAM,EAAE,aAAa,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IAC3D,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,cAAc,GAAwB;QAC1C,GAAG,UAAU;QACb,MAAM,EAAE;YACN,GAAG,UAAU,CAAC,MAAM;YACpB,GAAG,CAAC,aAAa,IAAI,eAAe;gBAClC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,IAAI,eAAe,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;IACF,OAAO,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE;QACjD,GAAG,cAAc;QACjB,4EAA4E;QAC5E,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,EAAE,SAAS;QACjB,4EAA4E;QAC5E,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC;KACjC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAyB;IAClD,MAAM,KAAK,GAAG,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,MAAyB;IAC3C,MAAM,GAAG,GAAG,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC;IACtC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,OAA0B;IAE1B,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAC1E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,mFAAmF;IACnF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAMD,KAAK,UAAU,qBAAqB,CAClC,WAA+B,EAC/B,WAA+B;IAE/B,8EAA8E;IAC9E,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,IAAI,iBAAiB,CAAC;gBAC7B,OAAO,EAAE,WAAW;gBACpB,WAAW,EAAE,IAAI;aAClB,CAAC;YACF,OAAO,EAAE,WAAW;SACrB,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAC;AACvF,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAEL,gCAAgC,GACjC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAEL,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kCAAkC,EAClC,mBAAmB,EACnB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,MAAM,EACN,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AAExE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,0EAA0E;AAC1E,gFAAgF;AAChF,wBAAwB;AACxB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,WAAW,EACX,kBAAkB,EAClB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAgBxB,OAAO,EACL,aAAa,EACb,eAAe,EACf,SAAS,EACT,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAStB;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAA+B,EAC/B,MAAyB,EACzB,OAA6B;IAE7B,MAAM,EACJ,WAAW,EACX,WAAW,EACX,YAAY,EACZ,SAAS,GAAG,KAAK,EACjB,OAAO,EACP,UAAU;IACV,4EAA4E;IAC5E,0EAA0E;IAC1E,yBAAyB;IACzB,6EAA6E;IAC7E,0EAA0E;IAC1E,wEAAwE;IACxE,QAAQ;IACR,yEAAyE;IACzE,uDAAuD;IACvD,MAAM,EACN,YAAY,GACb,GAAG,OAAO,IAAI,EAAE,CAAC;IAElB,MAAM,EAAE,QAAQ,EAAE,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC;IACvD,+EAA+E;IAC/E,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,MAAM,GAA4B,EAAE,GAAG,WAAW,EAAE,CAAC;IAE3D;;;;;;;;OAQG;IACH,MAAM,qBAAqB,GACzB,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QACjC,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC;QAChC,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,cAAc,GAAG,OAAO;QAC5B,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC;YAC/B,OAAO;YACP,SAAS,EAAE,MAAM;YACjB,UAAU;YACV,QAAQ;SACT,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC7E,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,YAAY,GAAG,SAAS,CAAC;QAClC,CAAC;QACD,6EAA6E;QAC7E,uEAAuE;QACvE,MAAM,YAAY,GAAgB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9D,MAAM,CAAC,OAAO,GAAG,qBAAqB,CACpC,cAAc,CAAC,OAAO,EACtB,cAAc,EACd,mBAAmB,CAAC,YAAY,CAAC,CAClC,CAAC;QACF,8EAA8E;QAC9E,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,CAAC,WAAW,GAAG,cAAc;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,GAAG,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC;YACpB,6EAA6E;YAC7E,8EAA8E;YAC9E,+DAA+D;YAC/D,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,6EAA6E;QAC7E,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;QACrC,CAAC;QACD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO,GAAG,cAAc,CAAC;QAClC,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACxB,kFAAkF;YAClF,MAAM,CAAC,OAAO,GAAG,gCAAgC,CAAC,YAAY,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC;IACnD,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,KAAK,GAAG,CAAC,GAAG,aAAa,EAAE,GAAG,cAAc,CAAC,CAAC;IACvD,CAAC;IAED,gFAAgF;IAChF,yEAAyE;IACzE,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,KAAK,GAAG,2BAA2B,CAAC,MAAM,CAAC,KAAwB,CAAC,CAAC;IAC9E,CAAC;IAED,8EAA8E;IAC9E,iFAAiF;IACjF,gEAAgE;IAChE,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QACzD,CAAC,CAAE,MAAM,CAAC,UAAkC;QAC5C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,eAAe,GAAG,QAAQ;QAC9B,CAAC,CAAC,gCAAgC,CAAC,kBAAkB,CAAC;QACtD,CAAC,CAAC,kBAAkB,CAAC;IACvB,+EAA+E;IAC/E,6EAA6E;IAC7E,2EAA2E;IAC3E,gFAAgF;IAChF,iFAAiF;IACjF,mFAAmF;IACnF,oFAAoF;IACpF,qFAAqF;IACrF,0BAA0B;IAC1B,MAAM,cAAc,GAAG,8BAA8B,CACnD,sBAAsB,CAAC,UAAU,CAAC,CACnC,CAAC;IACF,MAAM,CAAC,UAAU,GAAG;QAClB,gCAAgC,EAAE;QAClC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,eAAe;QAClB,qCAAqC,EAAE;QACvC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,kCAAkC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC;IAEF,8EAA8E;IAC9E,gEAAgE;IAChE,EAAE;IACF,6EAA6E;IAC7E,gEAAgE;IAChE,0EAA0E;IAC1E,2EAA2E;IAC3E,sCAAsC;IACtC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,SAAS,GAA4B;QACzC,cAAc,EAAE,uBAAuB;KACxC,CAAC;IACF,IAAI,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAChC,CAAC;IACD,OAAO,0BAA0B,CAC/B,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAC3B,uBAAuB,CACxB,CAAC;AACJ,CAAC;AASD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,UAA+B,EAC/B,MAAyB,EACzB,OAA4B;IAE5B,MAAM,EAAE,aAAa,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IAC3D,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,cAAc,GAAwB;QAC1C,GAAG,UAAU;QACb,MAAM,EAAE;YACN,GAAG,UAAU,CAAC,MAAM;YACpB,GAAG,CAAC,aAAa,IAAI,eAAe;gBAClC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,IAAI,eAAe,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;IACF,OAAO,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE;QACjD,GAAG,cAAc;QACjB,4EAA4E;QAC5E,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,EAAE,SAAS;QACjB,4EAA4E;QAC5E,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC;KACjC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAyB;IAClD,MAAM,KAAK,GAAG,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,MAAyB;IAC3C,MAAM,GAAG,GAAG,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC;IACtC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,OAA0B;IAE1B,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAC1E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,mFAAmF;IACnF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAMD,KAAK,UAAU,qBAAqB,CAClC,WAA+B,EAC/B,WAA+B;IAE/B,8EAA8E;IAC9E,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,IAAI,iBAAiB,CAAC;gBAC7B,OAAO,EAAE,WAAW;gBACpB,WAAW,EAAE,IAAI;aAClB,CAAC;YACF,OAAO,EAAE,WAAW;SACrB,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/runtime/managed-middleware.d.ts

@@ -7,8 +7,8 @@ export interface ManagedMiddleware {
     [key: string]: unknown;
 }
 /**
- * Wrap a middleware so every hook sees `runtime.identity` (…) without changing
- * its name, schema, registered tools, or class.
+ * Wrap a middleware so every hook sees `runtime.serverInfo.principal` (…) without
+ * changing its name, schema, registered tools, or class.
  *
  * A `Proxy` intercepts only the hook properties: lifecycle hooks
  * (`beforeAgent`/`beforeModel`/`afterModel`/`afterAgent`, in either function or

package/dist/runtime/managed-middleware.js

@@ -10,10 +10,10 @@ const LIFECYCLE_HOOKS = new Set([
 const WRAP_HOOKS = new Set(["wrapModelCall", "wrapToolCall"]);
 /**
  * Return a copy of the middleware runtime with the managed primitives
- * (`runtime.identity`, …) layered on. Identity is built from the trusted
- * `runtime.configurable.langgraph_auth_user` the custom-auth handler produced —
- * the same channel tools use — since the platform, not us, invokes the graph and
- * `runtime.context` is caller-supplied per-run data we do not control.
+ * (`runtime.serverInfo.principal`, …) layered on. The envelope is projected from
+ * the trusted `runtime.configurable.langgraph_auth_user` the custom-auth handler
+ * produced — the same channel tools use — since the platform, not us, invokes the
+ * graph and `runtime.context` is caller-supplied per-run data we do not control.
  */
 function augmentRuntime(runtime) {
     const overrides = managedRuntimeOverrides(runtime);
@@ -41,8 +41,8 @@ function wrapWrapHook(target, value) {
     return (request, handler) => fn.call(target, { ...request, runtime: augmentRuntime(request?.runtime) }, handler);
 }
 /**
- * Wrap a middleware so every hook sees `runtime.identity` (…) without changing
- * its name, schema, registered tools, or class.
+ * Wrap a middleware so every hook sees `runtime.serverInfo.principal` (…) without
+ * changing its name, schema, registered tools, or class.
  *
  * A `Proxy` intercepts only the hook properties: lifecycle hooks
  * (`beforeAgent`/`beforeModel`/`afterModel`/`afterAgent`, in either function or

package/dist/runtime/managed-tools.d.ts

@@ -1,8 +1,7 @@
 import type { ToolRuntime } from "@langchain/core/tools";
-import type { RuntimeIdentity } from "../identity/index.js";
 import type { RuntimeChannel } from "../channels/types.js";
-import type { RuntimeConfigLike } from "./identity-runtime.js";
-export type { RuntimeConfigLike } from "./identity-runtime.js";
+import type { ManagedServerInfo, RuntimeConfigLike } from "./identity-runtime.js";
+export type { ManagedServerInfo, RuntimeConfigLike, } from "./identity-runtime.js";
 /**
  * A LangChain/LangGraph tool from MDA's perspective: the only surface the runtime
  * seam touches is `invoke(input, runtime)`. Kept structural so the wrapper works
@@ -13,7 +12,11 @@ export interface InvokableTool {
 }
 /** The managed primitives MDA layers onto the tool runtime. */
 export interface ManagedRuntimeExtras {
-    identity?: RuntimeIdentity;
+    /**
+     * LangGraph server metadata with the author-facing principal on `principal`
+     * (plus `subject` / `link`) and LangGraph AuthUser on `user`.
+     */
+    serverInfo?: ManagedServerInfo;
     /**
      * Present only for channel-originated runs. Ordinary HTTP and schedule runs
      * leave this undefined.
@@ -22,31 +25,32 @@ export interface ManagedRuntimeExtras {
 }
 /**
  * The runtime surface managed Deep Agent tools receive: LangGraph's
- * {@link ToolRuntime} plus MDA-managed primitives such as `identity`.
+ * {@link ToolRuntime} plus MDA-managed primitives such as `serverInfo`.
  *
  * Annotate the second parameter of a `tool(...)` handler when you need the
- * frozen identity envelope for the current run.
+ * trusted caller for the current run (`runtime.serverInfo?.principal`).
  */
 export interface ManagedDeepAgentRuntime<TState = unknown, TContext = unknown> extends ToolRuntime<TState, TContext>, ManagedRuntimeExtras {
 }
 /**
  * The fields MDA overlays onto the runtime a tool/middleware hook receives:
- * the frozen `identity` (when an actor resolved) and a `configurable` with the
- * reserved identity keys stripped so downstream code can't read a
- * client-spoofed `actor_id`/`tenant_id`. Returns an empty object when there is
- * nothing to change, so the original runtime passes through untouched.
+ * `serverInfo.principal` / `subject` / `link` (when an actor resolved) and a
+ * `configurable` with the reserved identity keys stripped so downstream code
+ * can't read a client-spoofed `actor_id`/`tenant_id`. Returns an empty object
+ * when there is nothing to change, so the original runtime passes through
+ * untouched.
  */
 export declare function managedRuntimeOverrides(runtime: RuntimeConfigLike | undefined): ManagedRuntimeExtras & {
     configurable?: Record<string, unknown>;
 };
 /**
- * Wrap a tool so its runtime carries the managed primitives (`runtime.identity`,
- * …) without changing its name, schema, or class.
+ * Wrap a tool so its runtime carries the managed primitives
+ * (`runtime.serverInfo.principal`, …) without changing its name, schema, or class.
  *
  * Augments `invoke` (for LangGraph's `ToolNode`) and patches a shallow copy's
- * internal `func`/`coroutine` so identity reaches the authored handler even when
- * LangChain rewrites the runtime into a RunnableConfig before calling the tool
- * function. The original tool instance is left untouched.
+ * internal `func`/`coroutine` so the auth user reaches the authored handler even
+ * when LangChain rewrites the runtime into a RunnableConfig before calling the
+ * tool function. The original tool instance is left untouched.
  */
 export declare function withManagedRuntime<T extends InvokableTool>(managedTool: T): T;
 /** Wrap every tool in a list with {@link withManagedRuntime}. */

package/dist/runtime/managed-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managed-tools.d.ts","sourceRoot":"","sources":["../../src/runtime/managed-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAM3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC;CAC9D;AAED,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB,CAAC,MAAM,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO,CAC3E,SAAQ,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,oBAAoB;CAAG;AAEhE;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GACrC,oBAAoB,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAgCnE;AAwBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,aAAa,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,CAqC7E;AAED,iEAAiE;AACjE,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,aAAa,EACjE,KAAK,EAAE,SAAS,CAAC,EAAE,GAClB,CAAC,EAAE,CAEL"}
+{"version":3,"file":"managed-tools.d.ts","sourceRoot":"","sources":["../../src/runtime/managed-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAM3D,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACV,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAE/B;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC;CAC9D;AAED,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB,CAAC,MAAM,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO,CAC3E,SAAQ,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,oBAAoB;CAAG;AAEhE;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GACrC,oBAAoB,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAmCnE;AAwBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,aAAa,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,CAqC7E;AAED,iEAAiE;AACjE,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,aAAa,EACjE,KAAK,EAAE,SAAS,CAAC,EAAE,GAClB,CAAC,EAAE,CAEL"}

package/dist/runtime/managed-tools.js

@@ -1,18 +1,19 @@
 import { resolveRuntimeChannel } from "../channels/binding.js";
-import { buildRuntimeIdentity, resolveRuntimeConfigurable, sanitizeConfigurable, } from "./identity-runtime.js";
+import { buildManagedServerInfo, resolveRuntimeConfigurable, sanitizeConfigurable, } from "./identity-runtime.js";
 /**
  * The fields MDA overlays onto the runtime a tool/middleware hook receives:
- * the frozen `identity` (when an actor resolved) and a `configurable` with the
- * reserved identity keys stripped so downstream code can't read a
- * client-spoofed `actor_id`/`tenant_id`. Returns an empty object when there is
- * nothing to change, so the original runtime passes through untouched.
+ * `serverInfo.principal` / `subject` / `link` (when an actor resolved) and a
+ * `configurable` with the reserved identity keys stripped so downstream code
+ * can't read a client-spoofed `actor_id`/`tenant_id`. Returns an empty object
+ * when there is nothing to change, so the original runtime passes through
+ * untouched.
  */
 export function managedRuntimeOverrides(runtime) {
     const overrides = {};
     const configurable = resolveRuntimeConfigurable(runtime);
-    const identity = buildRuntimeIdentity(configurable);
-    if (identity) {
-        overrides.identity = identity;
+    const serverInfo = buildManagedServerInfo(runtime, configurable);
+    if (serverInfo) {
+        overrides.serverInfo = serverInfo;
     }
     if (runtime?.channel) {
         overrides.channel = runtime.channel;
@@ -49,13 +50,13 @@ function wrapToolCallable(original, receiver) {
     return (input, runManager, config) => original.call(receiver, input, runManager, augmentToolConfig(config));
 }
 /**
- * Wrap a tool so its runtime carries the managed primitives (`runtime.identity`,
- * …) without changing its name, schema, or class.
+ * Wrap a tool so its runtime carries the managed primitives
+ * (`runtime.serverInfo.principal`, …) without changing its name, schema, or class.
  *
  * Augments `invoke` (for LangGraph's `ToolNode`) and patches a shallow copy's
- * internal `func`/`coroutine` so identity reaches the authored handler even when
- * LangChain rewrites the runtime into a RunnableConfig before calling the tool
- * function. The original tool instance is left untouched.
+ * internal `func`/`coroutine` so the auth user reaches the authored handler even
+ * when LangChain rewrites the runtime into a RunnableConfig before calling the
+ * tool function. The original tool instance is left untouched.
  */
 export function withManagedRuntime(managedTool) {
     const patchable = Object.assign(Object.create(Object.getPrototypeOf(managedTool)), managedTool);

package/dist/runtime/managed-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"managed-tools.js","sourceRoot":"","sources":["../../src/runtime/managed-tools.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAkC/B;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAsC;IAEtC,MAAM,SAAS,GAGX,EAAE,CAAC;IACP,MAAM,YAAY,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,OAA0C,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,WAAW,EAAE,CAAC;YAChB,SAAS,CAAC,OAAO,GAAG,WAAW,CAAC;QAClC,CAAC;IACH,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;YACvE,IAAI,OAAO,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;gBACxC,SAAS,CAAC,YAAY,GAAG,SAAS,CAAC;YACrC,CAAC;iBAAM,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBAC3B,SAAS,CAAC,MAAM,GAAG;oBACjB,GAAG,OAAO,CAAC,MAAM;oBACjB,YAAY,EAAE,SAAS;iBACxB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAqC;IAErC,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;QACtC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE;QAC7B,CAAC,CAAC,MAAM,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAyC,EACzC,QAAiB;IAEjB,OAAO,CAAC,KAAc,EAAE,UAAmB,EAAE,MAAe,EAAE,EAAE,CAC9D,QAAQ,CAAC,IAAI,CACX,QAAQ,EACR,KAAK,EACL,UAAU,EACV,iBAAiB,CAAC,MAAuC,CAAC,CAC3D,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAA0B,WAAc;IACxE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,EACjD,WAAW,CAIZ,CAAC;IACF,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACzC,SAAS,CAAC,IAAI,GAAG,gBAAgB,CAC/B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAChC,WAAW,CACZ,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC9C,SAAS,CAAC,SAAS,GAAG,gBAAgB,CACpC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,EACrC,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,KAAK,CAAC,SAAS,EAAE;QAC1B,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ;YAC5B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAc,EAAE,OAA2B,EAAE,EAAE;oBACrD,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;oBACnD,OAAO,MAAM,CAAC,MAAM,CAClB,KAAK,EACL,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;wBAC/B,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,EAAE;wBAC9B,CAAC,CAAC,OAAO,CACZ,CAAC;gBACJ,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,2BAA2B,CACzC,KAAmB;IAEnB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"managed-tools.js","sourceRoot":"","sources":["../../src/runtime/managed-tools.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AA4C/B;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAsC;IAEtC,MAAM,SAAS,GAMX,EAAE,CAAC;IACP,MAAM,YAAY,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACjE,IAAI,UAAU,EAAE,CAAC;QACf,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,OAA0C,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,WAAW,EAAE,CAAC;YAChB,SAAS,CAAC,OAAO,GAAG,WAAW,CAAC;QAClC,CAAC;IACH,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;YACvE,IAAI,OAAO,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;gBACxC,SAAS,CAAC,YAAY,GAAG,SAAS,CAAC;YACrC,CAAC;iBAAM,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBAC3B,SAAS,CAAC,MAAM,GAAG;oBACjB,GAAG,OAAO,CAAC,MAAM;oBACjB,YAAY,EAAE,SAAS;iBACxB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAqC;IAErC,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;QACtC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE;QAC7B,CAAC,CAAC,MAAM,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAyC,EACzC,QAAiB;IAEjB,OAAO,CAAC,KAAc,EAAE,UAAmB,EAAE,MAAe,EAAE,EAAE,CAC9D,QAAQ,CAAC,IAAI,CACX,QAAQ,EACR,KAAK,EACL,UAAU,EACV,iBAAiB,CAAC,MAAuC,CAAC,CAC3D,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAA0B,WAAc;IACxE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,EACjD,WAAW,CAIZ,CAAC;IACF,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACzC,SAAS,CAAC,IAAI,GAAG,gBAAgB,CAC/B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAChC,WAAW,CACZ,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC9C,SAAS,CAAC,SAAS,GAAG,gBAAgB,CACpC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,EACrC,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,KAAK,CAAC,SAAS,EAAE;QAC1B,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ;YAC5B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAc,EAAE,OAA2B,EAAE,EAAE;oBACrD,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;oBACnD,OAAO,MAAM,CAAC,MAAM,CAClB,KAAK,EACL,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;wBAC/B,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,EAAE;wBAC9B,CAAC,CAAC,OAAO,CACZ,CAAC;gBACJ,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,2BAA2B,CACzC,KAAmB;IAEnB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/runtime/types.d.ts

@@ -61,8 +61,8 @@ export interface ManagedAgentOptions {
     /**
      * The root `identity.ts` declaration, if the project opts into managed
      * identity. Resolution + thread scoping run in the generated custom-auth
-     * handler (`buildManagedAuth`); this seam reserves the declaration for the
-     * frozen `runtime.identity` envelope and memory namespacing.
+     * handler (`buildManagedAuth`); this seam reserves the declaration for
+     * `runtime.serverInfo.principal` and memory namespacing.
      */
     identity?: IdentityDefinition;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "managed-deepagents",
-  "version": "0.6.2-dev.4",
+  "version": "0.6.2-dev.41",
   "description": "Managed Deep Agents — the `defineDeepAgent` authoring interface plus the CLI that compiles and deploys a code-first Deep Agent repository to a managed LangGraph runtime.",
   "keywords": [
     "langchain",
@@ -66,16 +66,16 @@
     "zod": "^4.4.3"
   },
   "optionalDependencies": {
-    "@langchain/managed-deepagents-darwin-arm64": "0.6.2-dev.4",
-    "@langchain/managed-deepagents-darwin-x64": "0.6.2-dev.4",
-    "@langchain/managed-deepagents-linux-arm64": "0.6.2-dev.4",
-    "@langchain/managed-deepagents-linux-x64": "0.6.2-dev.4",
-    "@langchain/managed-deepagents-win32-arm64": "0.6.2-dev.4",
-    "@langchain/managed-deepagents-win32-x64": "0.6.2-dev.4"
+    "@langchain/managed-deepagents-darwin-arm64": "0.6.2-dev.41",
+    "@langchain/managed-deepagents-darwin-x64": "0.6.2-dev.41",
+    "@langchain/managed-deepagents-linux-arm64": "0.6.2-dev.41",
+    "@langchain/managed-deepagents-linux-x64": "0.6.2-dev.41",
+    "@langchain/managed-deepagents-win32-arm64": "0.6.2-dev.41",
+    "@langchain/managed-deepagents-win32-x64": "0.6.2-dev.41"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",
-    "oxfmt": "^0.64.0",
+    "oxfmt": "^0.65.0",
     "oxlint": "^1.75.0",
     "typescript": "^7.0.2",
     "vitest": "^4.1.10"

package/dist/connectors/mcp/load.d.ts

@@ -1,12 +0,0 @@
-import type { McpServersDefinition } from "./index.js";
-/**
- * Load (and cache) the MCP tools for one connector declaration.
- *
- * A failed load is never cached, so a transient connection error on the first
- * run can be retried on the next, but a misconfigured deployment surfaces the
- * error rather than silently starting with no tools.
- */
-export declare function loadManagedMcpTools(connectors: McpServersDefinition): Promise<unknown[]>;
-/** Clear the process-level MCP tool cache. @internal Test-only. */
-export declare function clearManagedMcpToolsCacheForTests(connectors?: McpServersDefinition): void;
-//# sourceMappingURL=load.d.ts.map

package/dist/connectors/mcp/load.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../../src/connectors/mcp/load.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAA0B,MAAM,YAAY,CAAC;AAc/E;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,oBAAoB,GAC/B,OAAO,CAAC,OAAO,EAAE,CAAC,CAWpB;AAED,mEAAmE;AACnE,wBAAgB,iCAAiC,CAC/C,UAAU,CAAC,EAAE,oBAAoB,GAChC,IAAI,CAMN"}