managed-deepagents 0.6.2-dev.5 → 0.6.2-dev.50

package/dist/channels/trigger/identity-context.js

@@ -0,0 +1,171 @@
+/**
+ * Verify Trigger Server `identity_context` JWTs into Agent Auth principal ids.
+ *
+ * Agent Auth signs these with the LangSmith EdDSA JWKS published at
+ * `{LANGSMITH_ENDPOINT}/.well-known/jwks.json`. MDA verifies the signature
+ * (and typ/version/aud/iss/exp/principal UUID) before stamping `x-mda-user-id`.
+ * Delivery still requires Trigger's `x-service-key` header; signature verify is
+ * what stops a forged principal when that gate is weak.
+ */
+import { createRemoteJWKSet, decodeProtectedHeader, jwtVerify, } from "jose";
+import { JWKS_HTTP_TIMEOUT_MS } from "../../runtime/http.js";
+import { normalizeUuid } from "./uuid.js";
+export const IDENTITY_CONTEXT_TOKEN_TYP = "identity-context+jwt";
+export const IDENTITY_CONTEXT_AUDIENCE = "mda";
+export const IDENTITY_CONTEXT_VERSION = "1";
+export const IDENTITY_CONTEXT_ALGORITHMS = ["EdDSA"];
+const DEFAULT_LANGSMITH_ENDPOINT = "https://api.smith.langchain.com";
+/** Remote JWKS key sets, cached per URI for the process lifetime. */
+const jwksCache = new Map();
+export class InvalidIdentityContextError extends Error {
+    name = "InvalidIdentityContextError";
+    constructor(message) {
+        super(message);
+    }
+}
+/** JWKS / network failure while verifying identity_context. Callers should 5xx. */
+export class IdentityContextUnavailableError extends Error {
+    name = "IdentityContextUnavailableError";
+    constructor(message) {
+        super(message);
+    }
+}
+/** LangSmith API origin used as identity-context `iss` and JWKS host. */
+export function resolveIdentityContextIssuer(env = process.env) {
+    const raw = env.LANGSMITH_ENDPOINT?.trim() ||
+        env.LANGCHAIN_ENDPOINT?.trim() ||
+        DEFAULT_LANGSMITH_ENDPOINT;
+    return raw.replace(/\/+$/, "");
+}
+/** Public JWKS URL for Agent Auth identity-context signatures. */
+export function resolveIdentityContextJwksUrl(env = process.env) {
+    return `${resolveIdentityContextIssuer(env)}/.well-known/jwks.json`;
+}
+/**
+ * Extract the Agent Auth principal UUID from a Trigger `identity_context` JWT.
+ *
+ * @throws {InvalidIdentityContextError} when the token is missing, malformed,
+ *   or fails signature / claim checks.
+ */
+export async function principalIdFromIdentityContext(token, options = {}) {
+    const value = token.trim();
+    if (!value) {
+        throw new InvalidIdentityContextError("identity_context is blank");
+    }
+    let header;
+    try {
+        header = decodeProtectedHeader(value);
+    }
+    catch {
+        throw new InvalidIdentityContextError("identity_context is not a JWT");
+    }
+    if (header.typ !== IDENTITY_CONTEXT_TOKEN_TYP) {
+        throw new InvalidIdentityContextError(`identity_context typ must be ${IDENTITY_CONTEXT_TOKEN_TYP}`);
+    }
+    if (header.alg !== "EdDSA") {
+        throw new InvalidIdentityContextError("identity_context alg must be EdDSA");
+    }
+    const env = options.env ?? process.env;
+    const issuer = options.issuer ?? resolveIdentityContextIssuer(env);
+    const getKey = options.getKey ?? remoteJwks(env);
+    let claims;
+    try {
+        const verified = await jwtVerify(value, getKey, {
+            issuer,
+            audience: IDENTITY_CONTEXT_AUDIENCE,
+            algorithms: [...IDENTITY_CONTEXT_ALGORITHMS],
+            typ: IDENTITY_CONTEXT_TOKEN_TYP,
+            requiredClaims: ["exp"],
+        });
+        claims = verified.payload;
+    }
+    catch (error) {
+        if (error instanceof InvalidIdentityContextError ||
+            error instanceof IdentityContextUnavailableError) {
+            throw error;
+        }
+        if (isIdentityContextUnavailable(error)) {
+            throw new IdentityContextUnavailableError("identity_context JWKS verification is unavailable");
+        }
+        const detail = error instanceof Error ? error.message : String(error);
+        const code = error && typeof error === "object" && "code" in error
+            ? String(error.code)
+            : "";
+        if (code === "ERR_JWT_EXPIRED" || /expir|"exp"|claim.*exp/i.test(detail)) {
+            throw new InvalidIdentityContextError("identity_context is expired");
+        }
+        if (code === "ERR_JWT_CLAIM_VALIDATION_FAILED" &&
+            /required.*exp|"exp"/i.test(detail)) {
+            throw new InvalidIdentityContextError("identity_context is missing exp");
+        }
+        throw new InvalidIdentityContextError("identity_context signature verification failed");
+    }
+    if (typeof claims.exp !== "number") {
+        throw new InvalidIdentityContextError("identity_context is missing exp");
+    }
+    if (claims.version !== IDENTITY_CONTEXT_VERSION) {
+        throw new InvalidIdentityContextError(`identity_context version must be ${IDENTITY_CONTEXT_VERSION}`);
+    }
+    const fromPrincipal = principalIdClaim(claims.principal);
+    const fromSubject = typeof claims.sub === "string" ? normalizeUuid(claims.sub) : undefined;
+    if (fromPrincipal && fromSubject && fromPrincipal !== fromSubject) {
+        throw new InvalidIdentityContextError("identity_context principal.id and sub disagree");
+    }
+    const principalId = fromPrincipal ?? fromSubject;
+    if (!principalId) {
+        throw new InvalidIdentityContextError("identity_context is missing a principal UUID");
+    }
+    return principalId;
+}
+/** Resolve a principal id from an optional event field; `undefined` when absent. */
+export async function optionalPrincipalIdFromIdentityContext(token, options = {}) {
+    if (token == null) {
+        return undefined;
+    }
+    if (typeof token !== "string") {
+        throw new InvalidIdentityContextError("identity_context must be a string");
+    }
+    if (!token.trim()) {
+        return undefined;
+    }
+    return await principalIdFromIdentityContext(token, options);
+}
+function isIdentityContextUnavailable(error) {
+    if (error instanceof TypeError) {
+        return true;
+    }
+    const code = error && typeof error === "object" && "code" in error
+        ? String(error.code)
+        : "";
+    if (code === "ERR_JWKS_TIMEOUT" || code === "ABORT_ERR") {
+        return true;
+    }
+    const name = error && typeof error === "object" && "name" in error
+        ? String(error.name)
+        : "";
+    if (name === "TimeoutError" || name === "JWKSTimeout") {
+        return true;
+    }
+    if (error instanceof Error) {
+        return /fetch failed|ECONNREFUSED|ENOTFOUND|network|timed out/i.test(error.message);
+    }
+    return false;
+}
+function remoteJwks(env) {
+    const uri = resolveIdentityContextJwksUrl(env);
+    let keySet = jwksCache.get(uri);
+    if (!keySet) {
+        keySet = createRemoteJWKSet(new URL(uri), {
+            timeoutDuration: JWKS_HTTP_TIMEOUT_MS,
+        });
+        jwksCache.set(uri, keySet);
+    }
+    return keySet;
+}
+function principalIdClaim(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return undefined;
+    }
+    return normalizeUuid(value.id);
+}
+//# sourceMappingURL=identity-context.js.map

package/dist/channels/trigger/identity-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-context.js","sourceRoot":"","sources":["../../../src/channels/trigger/identity-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,SAAS,GAEV,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAC/C,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAC5C,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,OAAO,CAAU,CAAC;AAE9D,MAAM,0BAA0B,GAAG,iCAAiC,CAAC;AAIrE,qEAAqE;AACrE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;AAElD,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,IAAI,GAAG,6BAA6B,CAAC;IAE9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAC/C,IAAI,GAAG,iCAAiC,CAAC;IAElD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAaD,yEAAyE;AACzE,MAAM,UAAU,4BAA4B,CAC1C,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GACP,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QAC9B,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QAC9B,0BAA0B,CAAC;IAC7B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,6BAA6B,CAC3C,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,GAAG,4BAA4B,CAAC,GAAG,CAAC,wBAAwB,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAa,EACb,OAAO,GAAiC,EAAE;IAE1C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,2BAA2B,CAAC,2BAA2B,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,MAAgD,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,2BAA2B,CAAC,+BAA+B,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,0BAA0B,EAAE,CAAC;QAC9C,MAAM,IAAI,2BAA2B,CACnC,gCAAgC,0BAA0B,EAAE,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,2BAA2B,CAAC,oCAAoC,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAEjD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;YAC9C,MAAM;YACN,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,CAAC,GAAG,2BAA2B,CAAC;YAC5C,GAAG,EAAE,0BAA0B;YAC/B,cAAc,EAAE,CAAC,KAAK,CAAC;SACxB,CAAC,CAAC;QACH,MAAM,GAAG,QAAQ,CAAC,OAAkC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,2BAA2B;YAC5C,KAAK,YAAY,+BAA+B,EAChD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,+BAA+B,CACvC,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,GACR,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK;YACnD,CAAC,CAAC,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC;YAC5C,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,IAAI,KAAK,iBAAiB,IAAI,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,2BAA2B,CAAC,6BAA6B,CAAC,CAAC;QACvE,CAAC;QACD,IACE,IAAI,KAAK,iCAAiC;YAC1C,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EACnC,CAAC;YACD,MAAM,IAAI,2BAA2B,CAAC,iCAAiC,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,2BAA2B,CACnC,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,2BAA2B,CAAC,iCAAiC,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,wBAAwB,EAAE,CAAC;QAChD,MAAM,IAAI,2BAA2B,CACnC,oCAAoC,wBAAwB,EAAE,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,WAAW,GACf,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,IAAI,aAAa,IAAI,WAAW,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;QAClE,MAAM,IAAI,2BAA2B,CACnC,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,aAAa,IAAI,WAAW,CAAC;IACjD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,2BAA2B,CACnC,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,KAAgC,EAChC,OAAO,GAAiC,EAAE;IAE1C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,2BAA2B,CAAC,mCAAmC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,8BAA8B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAc;IAClD,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GACR,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK;QACnD,CAAC,CAAC,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC;QAC5C,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GACR,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK;QACnD,CAAC,CAAC,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC;QAC5C,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,wDAAwD,CAAC,IAAI,CAClE,KAAK,CAAC,OAAO,CACd,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,GAAsB;IACxC,MAAM,GAAG,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE;YACxC,eAAe,EAAE,oBAAoB;SACtC,CAAC,CAAC;QACH,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,aAAa,CAAE,KAA0B,CAAC,EAAE,CAAC,CAAC;AACvD,CAAC"}

package/dist/channels/trigger/types.d.ts

@@ -10,6 +10,7 @@ declare const messageEventSchema: z.ZodObject<{
     channel_id: z.ZodString;
     source_thread_key: z.ZodString;
     address: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    identity_context: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     type: z.ZodLiteral<"message">;
     input: z.ZodObject<{
         messages: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -23,6 +24,7 @@ declare const interruptResumeEventSchema: z.ZodObject<{
     channel_id: z.ZodString;
     source_thread_key: z.ZodString;
     address: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    identity_context: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     type: z.ZodLiteral<"interrupt_resume">;
     interaction: z.ZodObject<{
         type: z.ZodLiteral<"interrupt_resume">;
@@ -37,6 +39,7 @@ declare const eventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     channel_id: z.ZodString;
     source_thread_key: z.ZodString;
     address: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    identity_context: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     type: z.ZodLiteral<"message">;
     input: z.ZodObject<{
         messages: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -49,6 +52,7 @@ declare const eventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     channel_id: z.ZodString;
     source_thread_key: z.ZodString;
     address: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    identity_context: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     type: z.ZodLiteral<"interrupt_resume">;
     interaction: z.ZodObject<{
         type: z.ZodLiteral<"interrupt_resume">;
@@ -66,7 +70,7 @@ export interface TriggerChannelActionRequest {
     type: "post";
     action_id: string;
     address: TriggerChannelAddress;
-    source_thread_key: string;
+    source_thread_key?: string;
     message: {
         text: string;
     };
@@ -93,6 +97,12 @@ export interface TriggerChannelRuntimeEventRequest {
     address: TriggerChannelAddress;
     run_thread_id: string;
     run_id: string;
+    /**
+     * Safe, user-facing status text. Raw runtime exceptions must never be sent.
+     */
+    message?: {
+        text: string;
+    };
     /**
      * Present on `run.interrupted`. The Trigger Server cannot read the
      * deployment's threads, so pending interrupts travel on the event itself.

package/dist/channels/trigger/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/channels/trigger/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,0BAA0B,kBAAkB,CAAC;AAK1D,uDAAuD;AACvD,QAAA,MAAM,YAAY,wCAAoC,CAAC;AAevD,QAAA,MAAM,kBAAkB;;;;;;;;;;;;iBAKtB,CAAC;AACH,QAAA,MAAM,0BAA0B;;;;;;;;;;;;;iBAM9B,CAAC;AACH,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;2BAGf,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACjE,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,kBAAkB,CAAC,KAAK,CAAC,KAAK,CACtC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC5E,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CACtD,OAAO,0BAA0B,CAClC,CAAC;AACF,6HAA6H;AAC7H,MAAM,MAAM,oBAAoB,GAC9B,kCAAkC,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC9D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAE9D,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3B;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,MAAM,8BAA8B,GACtC,aAAa,GACb,eAAe,GACf,iBAAiB,GACjB,YAAY,CAAC;AAEjB;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,8BAA8B,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,UAAU,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAG5E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/channels/trigger/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,0BAA0B,kBAAkB,CAAC;AAK1D,uDAAuD;AACvD,QAAA,MAAM,YAAY,wCAAoC,CAAC;AAoBvD,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;iBAKtB,CAAC;AACH,QAAA,MAAM,0BAA0B;;;;;;;;;;;;;;iBAM9B,CAAC;AACH,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAGf,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACjE,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,kBAAkB,CAAC,KAAK,CAAC,KAAK,CACtC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC5E,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CACtD,OAAO,0BAA0B,CAClC,CAAC;AACF,6HAA6H;AAC7H,MAAM,MAAM,oBAAoB,GAC9B,kCAAkC,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC9D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAE9D,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3B;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,MAAM,8BAA8B,GACtC,aAAa,GACb,eAAe,GACf,iBAAiB,GACjB,YAAY,CAAC;AAEjB;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,8BAA8B,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3B;;;OAGG;IACH,UAAU,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAG5E"}

package/dist/channels/trigger/types.js

@@ -19,6 +19,11 @@ const channelEventBase = z.object({
     channel_id: channelId,
     source_thread_key: nonblankString,
     address: opaqueObject,
+    /**
+     * Short-lived Agent Auth identity-context JWT. When present, ingress stamps
+     * its principal UUID as `x-mda-user-id` instead of `mda:channel`.
+     */
+    identity_context: z.string().nullish(),
 });
 const messageEventSchema = channelEventBase.extend({
     type: z.literal("message"),

package/dist/channels/trigger/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/channels/trigger/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,MAAM,0BAA0B,GAAG,eAAe,CAAC;AAE1D,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE;IAC3E,OAAO,EAAE,kBAAkB;CAC5B,CAAC,CAAC;AACH,uDAAuD;AACvD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AACvD,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE;IACrD,OAAO,EAAE,cAAc;CACxB,CAAC,CAAC;AACL,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACvB,QAAQ,EAAE,cAAc;IACxB,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,SAAS;IACrB,iBAAiB,EAAE,cAAc;IACjC,OAAO,EAAE,YAAY;CACtB,CAAC,CAAC;AACH,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;KAChC,CAAC;CACH,CAAC,CAAC;AACH,MAAM,0BAA0B,GAAG,gBAAgB,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACnC,MAAM,EAAE,YAAY;KACrB,CAAC;CACH,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC/C,kBAAkB;IAClB,0BAA0B;CAC3B,CAAC,CAAC;AA+DH,mFAAmF;AACnF,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,OAAO,KAA4B,CAAC;AACtC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/channels/trigger/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,MAAM,0BAA0B,GAAG,eAAe,CAAC;AAE1D,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE;IAC3E,OAAO,EAAE,kBAAkB;CAC5B,CAAC,CAAC;AACH,uDAAuD;AACvD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AACvD,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE;IACrD,OAAO,EAAE,cAAc;CACxB,CAAC,CAAC;AACL,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACvB,QAAQ,EAAE,cAAc;IACxB,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,SAAS;IACrB,iBAAiB,EAAE,cAAc;IACjC,OAAO,EAAE,YAAY;IACrB;;;OAGG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CACvC,CAAC,CAAC;AACH,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;KAChC,CAAC;CACH,CAAC,CAAC;AACH,MAAM,0BAA0B,GAAG,gBAAgB,CAAC,MAAM,CAAC;IACzD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACnC,MAAM,EAAE,YAAY;KACrB,CAAC;CACH,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC/C,kBAAkB;IAClB,0BAA0B;CAC3B,CAAC,CAAC;AAmEH,mFAAmF;AACnF,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,OAAO,KAA4B,CAAC;AACtC,CAAC"}

package/dist/connections.d.ts

@@ -0,0 +1,74 @@
+/**
+ * `connections.get(...)` — read a managed connection from a tool.
+ *
+ * `{ type: "agent" }` resolves material owned by the current deployment.
+ * `{ type: "user" }` resolves per-caller grants (OAuth or opaque). Resolution
+ * reads Agent Auth on every await and never caches.
+ *
+ * `mda dev` substitutes local values for agent opaque secrets via `MDA_DEV_*`.
+ * User-owned connections need a deployment; opaque user grants use the same
+ * pre-run gate as OAuth.
+ */
+import type { RuntimeIdentity } from "./identity/index.js";
+import { CredentialStoreError, type AgentAuthContext } from "./agent-auth.js";
+export { AGENT_AUTH_TIMEOUT_MS, AgentAuthUnknownProviderError, CredentialAuthorizationRequiredError, CredentialStoreError, } from "./agent-auth.js";
+export type { AgentAuthContext, PendingAuthorization } from "./agent-auth.js";
+export type AgentConnectionOwner = {
+    type: "agent";
+};
+export type UserConnectionOwner = {
+    type: "user";
+    id?: string;
+};
+export type ConnectionOwner = AgentConnectionOwner | UserConnectionOwner;
+export interface ConnectionRequest {
+    slug: string;
+    owner: ConnectionOwner;
+    identity?: RuntimeIdentity;
+}
+declare const CONNECTION_REFERENCE: unique symbol;
+export declare class ConnectionNotFoundError extends Error {
+    readonly slug: string;
+    readonly ownerType: ConnectionOwner["type"];
+    constructor(slug: string, ownerType: ConnectionOwner["type"]);
+}
+/** `LANGSMITH_ENDPOINT` is missing a usable Agent Auth origin. */
+export declare class InvalidAgentAuthEndpointError extends CredentialStoreError {
+    readonly name = "InvalidAgentAuthEndpointError";
+    constructor();
+}
+export declare class ConnectionReference implements PromiseLike<string> {
+    readonly slug: string;
+    readonly owner: ConnectionOwner;
+    private readonly accessor;
+    readonly [CONNECTION_REFERENCE] = true;
+    constructor(slug: string, owner: ConnectionOwner, accessor: Connections);
+    then<TResult1 = string, TResult2 = never>(onfulfilled?: ((value: string) => TResult1 | PromiseLike<TResult1>) | null, onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null): PromiseLike<TResult1 | TResult2>;
+}
+export declare function isConnectionReference(value: unknown): value is ConnectionReference;
+export declare class AgentAuthConnectionStore {
+    private readonly env;
+    private readonly fetchImpl;
+    private readonly timeoutMs;
+    constructor(env?: NodeJS.ProcessEnv, fetchImpl?: typeof fetch, timeoutMs?: number);
+    fetch(request: ConnectionRequest): Promise<string | undefined>;
+}
+export declare class Connections {
+    private readonly store;
+    constructor(store?: AgentAuthConnectionStore);
+    get(slug: string, owner: ConnectionOwner): ConnectionReference;
+    resolve(slug: string, owner: ConnectionOwner): Promise<string>;
+    resolveDeploymentSecret(slug: string): Promise<string>;
+}
+export declare function agentConnectionEnvKey(slug: string): string;
+export declare function resolveOwnerId(owner: ConnectionOwner, identity: RuntimeIdentity | undefined, deploymentId: string | undefined): string;
+export declare function resolveAgentAuthContext(identity: RuntimeIdentity | undefined, env?: NodeJS.ProcessEnv): AgentAuthContext;
+/**
+ * Origin for Agent Auth HTTP calls from `LANGSMITH_ENDPOINT`.
+ *
+ * Cloud SaaS revisions omit that reserved name and inject `LANGCHAIN_ENDPOINT`
+ * instead; read it as the same setting so we do not default to production.
+ */
+export declare function resolveAgentAuthBaseUrl(env?: NodeJS.ProcessEnv): string;
+export declare const connections: Connections;
+//# sourceMappingURL=connections.d.ts.map

package/dist/connections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAIL,oBAAoB,EACpB,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,oCAAoC,EACpC,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE9E,MAAM,MAAM,oBAAoB,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AACrD,MAAM,MAAM,mBAAmB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,mBAAmB,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED,QAAA,MAAM,oBAAoB,eAA0C,CAAC;AAiBrE,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAE5C,YAAY,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,EAK3D;CACF;AAED,kEAAkE;AAClE,qBAAa,6BAA8B,SAAQ,oBAAoB;IACrE,SAAkB,IAAI,mCAAmC;IAEzD,cAIC;CACF;AAED,qBAAa,mBAAoB,YAAW,WAAW,CAAC,MAAM,CAAC;IAI3D,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,KAAK,EAAE,eAAe;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAL3B,QAAQ,CAAC,CAAC,oBAAoB,CAAC,QAAQ;IAEvC,YACW,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,eAAe,EACd,QAAQ,EAAE,WAAW,EACpC;IAEJ,IAAI,CAAC,QAAQ,GAAG,MAAM,EAAE,QAAQ,GAAG,KAAK,EACtC,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,EAC1E,UAAU,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,KAAK,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,GAC1E,WAAW,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAIlC;CACF;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,mBAAmB,CAO9B;AASD,qBAAa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAH5B,YACmB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,SAAS,GAAE,OAAO,KAAa,EAC/B,SAAS,SAAwB,EAChD;IAEE,KAAK,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA4DnE;CACF;AAED,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IADxB,YACmB,KAAK,GAAE,wBAAyD,EAC/E;IAEJ,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,mBAAmB,CAM7D;IAEK,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBnE;IAEK,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS3D;CACF;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI1D;AA+CD,wBAAgB,cAAc,CAC5B,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,MAAM,CAqBR;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,gBAAgB,CAqBlB;AAuBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAuBR;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}

package/dist/connections.js

@@ -0,0 +1,277 @@
+/**
+ * `connections.get(...)` — read a managed connection from a tool.
+ *
+ * `{ type: "agent" }` resolves material owned by the current deployment.
+ * `{ type: "user" }` resolves per-caller grants (OAuth or opaque). Resolution
+ * reads Agent Auth on every await and never caches.
+ *
+ * `mda dev` substitutes local values for agent opaque secrets via `MDA_DEV_*`.
+ * User-owned connections need a deployment; opaque user grants use the same
+ * pre-run gate as OAuth.
+ */
+import { AGENT_AUTH_TIMEOUT_MS, AgentAuth, CredentialAuthorizationRequiredError, CredentialStoreError, } from "./agent-auth.js";
+import { buildRuntimeIdentity, resolveRuntimeConfigurable, } from "./runtime/identity-runtime.js";
+export { AGENT_AUTH_TIMEOUT_MS, AgentAuthUnknownProviderError, CredentialAuthorizationRequiredError, CredentialStoreError, } from "./agent-auth.js";
+const CONNECTION_REFERENCE = Symbol("managed-deepagents.connection");
+const SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const MAX_SLUG_LENGTH = 64;
+const DEFAULT_LANGSMITH_ENDPOINT = "https://api.smith.langchain.com";
+const DEV_CREDENTIAL_PREFIX = "MDA_DEV_";
+function localUserConnectionUnsupported(slug) {
+    const localHint = slug
+        ? `set ${agentConnectionEnvKey(slug)}`
+        : "set the corresponding MDA_DEV_<slug> variable";
+    return ("user-owned connections need a deployment, so they do not resolve in `mda dev`: " +
+        "deploy with `mda deploy` to exercise this connection, or declare it as " +
+        `{ type: "agent" } and ${localHint} for local runs`);
+}
+export class ConnectionNotFoundError extends Error {
+    slug;
+    ownerType;
+    constructor(slug, ownerType) {
+        super(`no ${ownerType} connection is set for slug ${JSON.stringify(slug)}`);
+        this.name = "ConnectionNotFoundError";
+        this.slug = slug;
+        this.ownerType = ownerType;
+    }
+}
+/** `LANGSMITH_ENDPOINT` is missing a usable Agent Auth origin. */
+export class InvalidAgentAuthEndpointError extends CredentialStoreError {
+    name = "InvalidAgentAuthEndpointError";
+    constructor() {
+        super("LangSmith Agent Auth endpoint is not a valid URL (set LANGSMITH_ENDPOINT)");
+    }
+}
+export class ConnectionReference {
+    slug;
+    owner;
+    accessor;
+    [CONNECTION_REFERENCE] = true;
+    constructor(slug, owner, accessor) {
+        this.slug = slug;
+        this.owner = owner;
+        this.accessor = accessor;
+    }
+    then(onfulfilled, onrejected) {
+        return this.accessor
+            .resolve(this.slug, this.owner)
+            .then(onfulfilled, onrejected);
+    }
+}
+export function isConnectionReference(value) {
+    return (value instanceof ConnectionReference ||
+        (typeof value === "object" &&
+            value !== null &&
+            CONNECTION_REFERENCE in value));
+}
+export class AgentAuthConnectionStore {
+    env;
+    fetchImpl;
+    timeoutMs;
+    constructor(env = process.env, fetchImpl = fetch, timeoutMs = AGENT_AUTH_TIMEOUT_MS) {
+        this.env = env;
+        this.fetchImpl = fetchImpl;
+        this.timeoutMs = timeoutMs;
+    }
+    async fetch(request) {
+        if (this.env.MDA_LOCAL_DEV === "1") {
+            if (request.owner.type === "user") {
+                throw new CredentialStoreError(localUserConnectionUnsupported(request.slug));
+            }
+            const value = this.env[agentConnectionEnvKey(request.slug)];
+            if (value !== undefined && value.trim()) {
+                return value;
+            }
+            throw new CredentialStoreError(`local agent connection ${JSON.stringify(request.slug)} is not configured; ` +
+                `set ${agentConnectionEnvKey(request.slug)}`);
+        }
+        const config = resolveAgentAuthConfig(this.env);
+        const ownerId = resolveOwnerId(request.owner, request.identity, config.deploymentId);
+        const client = new AgentAuth({
+            baseUrl: config.baseUrl,
+            agentId: config.deploymentId ?? ownerId,
+            principalId: ownerId,
+            apiKey: config.apiKey,
+            workspaceId: config.workspaceId,
+        }, this.fetchImpl, this.timeoutMs);
+        const row = await client.findWorkspaceConnection(request.slug);
+        if (!row) {
+            return undefined;
+        }
+        if (request.owner.type === "user") {
+            if (row.kind === "secret") {
+                return await client.readUserSecretForConnection(row);
+            }
+            if (row.kind === "oauth2") {
+                return await client.readUserAccessTokenForConnection(row);
+            }
+            return undefined;
+        }
+        if (row.kind === "secret") {
+            const credentialId = await client.findSecretCredentialId(row, request.slug);
+            if (!credentialId) {
+                return undefined;
+            }
+            return await client.readSecret(credentialId);
+        }
+        if (row.kind === "oauth2") {
+            return await client.readConnectionAccessToken(row.connectionId);
+        }
+        return undefined;
+    }
+}
+export class Connections {
+    store;
+    constructor(store = new AgentAuthConnectionStore()) {
+        this.store = store;
+    }
+    get(slug, owner) {
+        return new ConnectionReference(normalizeSlug(slug), normalizeOwner(owner), this);
+    }
+    async resolve(slug, owner) {
+        const configurable = resolveRuntimeConfigurable(undefined);
+        if (!configurable) {
+            throw new Error("connections.get(...) must be awaited inside a run: resolve a connection in a tool or middleware, not at import time");
+        }
+        const value = await this.store.fetch({
+            slug,
+            owner,
+            identity: buildRuntimeIdentity(configurable),
+        });
+        if (value === undefined) {
+            throw owner.type === "user"
+                ? new CredentialAuthorizationRequiredError([slug])
+                : new ConnectionNotFoundError(slug, owner.type);
+        }
+        return value;
+    }
+    async resolveDeploymentSecret(slug) {
+        const value = await this.store.fetch({
+            slug,
+            owner: { type: "agent" },
+        });
+        if (value === undefined) {
+            throw new ConnectionNotFoundError(slug, "agent");
+        }
+        return value;
+    }
+}
+export function agentConnectionEnvKey(slug) {
+    return `${DEV_CREDENTIAL_PREFIX}${normalizeSlug(slug)
+        .toUpperCase()
+        .replaceAll("-", "_")}`;
+}
+function normalizeSlug(slug) {
+    if (typeof slug !== "string") {
+        throw new TypeError("connection slug must be a string");
+    }
+    const canonical = slug.trim();
+    if (!canonical ||
+        canonical.length > MAX_SLUG_LENGTH ||
+        !SLUG_PATTERN.test(canonical)) {
+        throw new TypeError(`connection slug ${JSON.stringify(slug)} is invalid: use lowercase letters, digits, and single hyphens, at most ${MAX_SLUG_LENGTH} characters`);
+    }
+    return canonical;
+}
+function normalizeOwner(owner) {
+    if (!owner || typeof owner !== "object") {
+        throw new TypeError('connection owner is required: pass { type: "agent" } or { type: "user" }');
+    }
+    const keys = Object.keys(owner);
+    if (keys.some((key) => key !== "type" && key !== "id")) {
+        throw new TypeError("connection owner has an unknown key");
+    }
+    if (owner.type === "agent") {
+        if ("id" in owner) {
+            throw new TypeError('connection owner "id" is not accepted for { type: "agent" }');
+        }
+        return { type: "agent" };
+    }
+    if (owner.type === "user") {
+        if (owner.id === undefined)
+            return { type: "user" };
+        if (typeof owner.id !== "string" || !owner.id.trim()) {
+            throw new TypeError('connection owner "id" must be a non-empty string');
+        }
+        return { type: "user", id: owner.id.trim() };
+    }
+    throw new TypeError("connection owner type is not supported");
+}
+export function resolveOwnerId(owner, identity, deploymentId) {
+    if (owner.type === "user") {
+        const authenticated = identity?.user.id;
+        if (!authenticated) {
+            throw new CredentialStoreError("user connections require an authenticated user principal");
+        }
+        if (owner.id !== undefined && owner.id !== authenticated) {
+            throw new CredentialStoreError("user connection owner id must match the authenticated principal");
+        }
+        return authenticated;
+    }
+    if (!deploymentId) {
+        throw new CredentialStoreError("connections are not configured: LANGSMITH_HOST_PROJECT_ID is not set");
+    }
+    return deploymentId;
+}
+export function resolveAgentAuthContext(identity, env = process.env) {
+    if (env.MDA_LOCAL_DEV === "1") {
+        throw new CredentialStoreError(localUserConnectionUnsupported());
+    }
+    const config = resolveAgentAuthConfig(env);
+    if (!config.deploymentId) {
+        throw new CredentialStoreError("connections are not configured: LANGSMITH_HOST_PROJECT_ID is not set");
+    }
+    return {
+        baseUrl: config.baseUrl,
+        agentId: config.deploymentId,
+        principalId: resolveOwnerId({ type: "user" }, identity, config.deploymentId),
+        apiKey: config.apiKey,
+        workspaceId: config.workspaceId,
+    };
+}
+function resolveAgentAuthConfig(env) {
+    const apiKey = env.LANGSMITH_API_KEY?.trim();
+    if (!apiKey) {
+        throw new CredentialStoreError("connections are not configured: LANGSMITH_API_KEY is not set");
+    }
+    const workspaceId = env.LANGSMITH_WORKSPACE_ID?.trim();
+    if (!workspaceId) {
+        throw new CredentialStoreError("connections are not configured: LANGSMITH_WORKSPACE_ID is not set");
+    }
+    return {
+        baseUrl: resolveAgentAuthBaseUrl(env),
+        apiKey,
+        deploymentId: env.LANGSMITH_HOST_PROJECT_ID?.trim() || undefined,
+        workspaceId,
+    };
+}
+/**
+ * Origin for Agent Auth HTTP calls from `LANGSMITH_ENDPOINT`.
+ *
+ * Cloud SaaS revisions omit that reserved name and inject `LANGCHAIN_ENDPOINT`
+ * instead; read it as the same setting so we do not default to production.
+ */
+export function resolveAgentAuthBaseUrl(env = process.env) {
+    const raw = env.LANGSMITH_ENDPOINT?.trim() ||
+        env.LANGCHAIN_ENDPOINT?.trim() ||
+        DEFAULT_LANGSMITH_ENDPOINT;
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new InvalidAgentAuthEndpointError();
+    }
+    if (!["http:", "https:"].includes(parsed.protocol) ||
+        !parsed.hostname ||
+        parsed.username ||
+        parsed.password ||
+        (parsed.pathname !== "/" && parsed.pathname !== "") ||
+        parsed.search ||
+        parsed.hash) {
+        throw new InvalidAgentAuthEndpointError();
+    }
+    return parsed.origin;
+}
+export const connections = new Connections();
+//# sourceMappingURL=connections.js.map

package/dist/connections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connections.js","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EACL,qBAAqB,EACrB,SAAS,EACT,oCAAoC,EACpC,oBAAoB,GAErB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,oCAAoC,EACpC,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AAazB,MAAM,oBAAoB,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;AACrE,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAClD,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,0BAA0B,GAAG,iCAAiC,CAAC;AACrE,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAEzC,SAAS,8BAA8B,CAAC,IAAa;IACnD,MAAM,SAAS,GAAG,IAAI;QACpB,CAAC,CAAC,OAAO,qBAAqB,CAAC,IAAI,CAAC,EAAE;QACtC,CAAC,CAAC,+CAA+C,CAAC;IACpD,OAAO,CACL,iFAAiF;QACjF,yEAAyE;QACzE,yBAAyB,SAAS,iBAAiB,CACpD,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,CAAS;IACb,SAAS,CAA0B;IAE5C,YAAY,IAAY,EAAE,SAAkC;QAC1D,KAAK,CAAC,MAAM,SAAS,+BAA+B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,kEAAkE;AAClE,MAAM,OAAO,6BAA8B,SAAQ,oBAAoB;IACnD,IAAI,GAAG,+BAA+B,CAAC;IAEzD;QACE,KAAK,CACH,2EAA2E,CAC5E,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,mBAAmB;IAInB,IAAI;IACJ,KAAK;IACG,QAAQ;IALlB,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC;IAEvC,YACW,IAAY,EACZ,KAAsB,EACd,QAAqB;oBAF7B,IAAI;qBACJ,KAAK;wBACG,QAAQ;IACxB,CAAC;IAEJ,IAAI,CACF,WAA0E,EAC1E,UAA2E;QAE3E,OAAO,IAAI,CAAC,QAAQ;aACjB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;aAC9B,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACnC,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAc;IAEd,OAAO,CACL,KAAK,YAAY,mBAAmB;QACpC,CAAC,OAAO,KAAK,KAAK,QAAQ;YACxB,KAAK,KAAK,IAAI;YACd,oBAAoB,IAAI,KAAK,CAAC,CACjC,CAAC;AACJ,CAAC;AASD,MAAM,OAAO,wBAAwB;IAEhB,GAAG;IACH,SAAS;IACT,SAAS;IAH5B,YACmB,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,SAAS,GAAiB,KAAK,EAC/B,SAAS,GAAG,qBAAqB;mBAFjC,GAAG;yBACH,SAAS;yBACT,SAAS;IACzB,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,OAA0B;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,aAAa,KAAK,GAAG,EAAE,CAAC;YACnC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAClC,MAAM,IAAI,oBAAoB,CAC5B,8BAA8B,CAAC,OAAO,CAAC,IAAI,CAAC,CAC7C,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBACxC,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;gBAC1E,OAAO,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,cAAc,CAC5B,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,QAAQ,EAChB,MAAM,CAAC,YAAY,CACpB,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B;YACE,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,YAAY,IAAI,OAAO;YACvC,WAAW,EAAE,OAAO;YACpB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,EACD,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACf,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAClC,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,MAAM,MAAM,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,MAAM,MAAM,CAAC,gCAAgC,CAAC,GAAG,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,sBAAsB,CACtD,GAAG,EACH,OAAO,CAAC,IAAI,CACb,CAAC;YACF,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,MAAM,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,MAAM,MAAM,CAAC,yBAAyB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,WAAW;IAEH,KAAK;IADxB,YACmB,KAAK,GAA6B,IAAI,wBAAwB,EAAE;qBAAhE,KAAK;IACrB,CAAC;IAEJ,GAAG,CAAC,IAAY,EAAE,KAAsB;QACtC,OAAO,IAAI,mBAAmB,CAC5B,aAAa,CAAC,IAAI,CAAC,EACnB,cAAc,CAAC,KAAK,CAAC,EACrB,IAAI,CACL,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,KAAsB;QAChD,MAAM,YAAY,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,qHAAqH,CACtH,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YACnC,IAAI;YACJ,KAAK;YACL,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC;SAC7C,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,KAAK,CAAC,IAAI,KAAK,MAAM;gBACzB,CAAC,CAAC,IAAI,oCAAoC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAClD,CAAC,CAAC,IAAI,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,IAAY;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YACnC,IAAI;YACJ,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACzB,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,GAAG,qBAAqB,GAAG,aAAa,CAAC,IAAI,CAAC;SAClD,WAAW,EAAE;SACb,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9B,IACE,CAAC,SAAS;QACV,SAAS,CAAC,MAAM,GAAG,eAAe;QAClC,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAC7B,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2EAA2E,eAAe,aAAa,CAC/I,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,KAAsB;IAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,SAAS,CACjB,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,SAAS,CACjB,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACpD,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;IAC/C,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAsB,EACtB,QAAqC,EACrC,YAAgC;IAEhC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,oBAAoB,CAC5B,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS,IAAI,KAAK,CAAC,EAAE,KAAK,aAAa,EAAE,CAAC;YACzD,MAAM,IAAI,oBAAoB,CAC5B,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,oBAAoB,CAC5B,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAAqC,EACrC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,GAAG,CAAC,aAAa,KAAK,GAAG,EAAE,CAAC;QAC9B,MAAM,IAAI,oBAAoB,CAAC,8BAA8B,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAC5B,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,YAAY;QAC5B,WAAW,EAAE,cAAc,CACzB,EAAE,IAAI,EAAE,MAAM,EAAE,EAChB,QAAQ,EACR,MAAM,CAAC,YAAY,CACpB;QACD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAsB;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,oBAAoB,CAC5B,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,oBAAoB,CAC5B,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,uBAAuB,CAAC,GAAG,CAAC;QACrC,MAAM;QACN,YAAY,EAAE,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,SAAS;QAChE,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GACP,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QAC9B,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QAC9B,0BAA0B,CAAC;IAC7B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,6BAA6B,EAAE,CAAC;IAC5C,CAAC;IACD,IACE,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC9C,CAAC,MAAM,CAAC,QAAQ;QAChB,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,QAAQ;QACf,CAAC,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,IAAI,EACX,CAAC;QACD,MAAM,IAAI,6BAA6B,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC"}