managed-deepagents 0.6.2-dev.7 → 0.6.2-dev.8

package/dist/agent-auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-auth.js","sourceRoot":"","sources":["../src/agent-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAC5C,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AACjD,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAOhD,qEAAqE;AACrE,MAAM,UAAU,wBAAwB,CAAC,OAKxC;IACC,OAAO,IAAI,eAAe,CAAC;QACzB,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,QAAQ,EAAE,OAAO,CAAC,OAAO;QACzB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,MAA2B;IAE3B,MAAM,OAAO,GAA2B;QACtC,MAAM,EAAE,kBAAkB;QAC1B,cAAc,EAAE,kBAAkB;QAClC,qBAAqB,EAAE,KAAK;KAC7B,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACrC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,WAAW,CAAC,GAAG,MAAM,CAAC;IAChC,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,aAAa,CAAC,GAAG,WAAW,CAAC;IACvC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAM1C;IAKC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,OAAO,CAAC,GAAG,EACX;QACE,GAAG,OAAO,CAAC,IAAI;QACf,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC;KAC1C,EACD,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,SAAS,CAClB,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI,EACF,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YACpC,CAAC,CAAE,OAAmC;YACtC,CAAC,CAAC,EAAE;KACT,CAAC;AACJ,CAAC;AAmBD,MAAM,OAAO,oCAAqC,SAAQ,KAAK;IAGxC,KAAK;IAFjB,IAAI,GAAG,sCAAsC,CAAC;IAEvD,YAAqB,KAAwB;QAC3C,KAAK,CACH,iCAAiC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACnD,2EAA2E,CAC9E,CAAC;qBAJiB,KAAK;IAK1B,CAAC;CACF;AAED,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAGjC,IAAI;IAFhB,IAAI,GAAG,+BAA+B,CAAC;IAEhD,YAAqB,IAAY;QAC/B,KAAK,CACH,yDAAyD,IAAI,KAAK;YAChE,mDAAmD,CACtD,CAAC;oBAJiB,IAAI;IAKzB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAKlC,MAAM;IAJR,IAAI,GAAG,sBAAsB,CAAC;IAEvC,YACE,OAAe,EACN,MAAe;QAExB,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,YAAY,MAAM,GAAG,CAAC,CAAC;sBAF/D,MAAM;IAGjB,CAAC;CACF;AAOD;;;GAGG;AACH,MAAM,OAAO,SAAS;IACX,OAAO,CAAmB;IAC1B,UAAU,CAAe;IACzB,UAAU,CAAS;IAE5B,YACE,OAAyB,EACzB,SAAS,GAAiB,KAAK,EAC/B,SAAS,GAAG,qBAAqB;QAEjC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC9B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,mBAAmB,CAAC,IAAY;QACpC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC;YAC/C,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACjC,IAAI,EAAE,QAAQ;YACd,IAAI;SACL,CAAC,CAAC;QACH,IAAI,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QACpC,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,yBAAyB,CAAC,IAAY;QAC1C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC9C,6CAA6C,EAC7C;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,WAAW,EAAE,UAAU;gBACvB,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;gBACtC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;aAC/B,CAAC;SACH,CACF,CAAC;QACF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,oBAAoB,CAC5B,sDAAsD,EACtD,MAAM,CACP,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,IAAI,oBAAoB,CAC5B,uEAAuE,CACxE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,sBAAsB,CAAC,IAAY;QACvC,IAAI,MAA0B,CAAC;QAC/B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,6BAA6B,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;gBACjC,SAAS,EAAE,MAAM,CAAC,6BAA6B,CAAC;aACjD,CAAC,CAAC;YACH,IAAI,MAAM;gBAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC9C,kCAAkC,MAAM,CAAC,QAAQ,EAAE,EAAE,EACrD,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;YACF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,oBAAoB,CAC5B,wCAAwC,EACxC,MAAM,CACP,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CACtB,CAAC,IAAI,EAAyB,EAAE,CAC9B,CAAC,CAAC,IAAI;gBACN,OAAO,IAAI,KAAK,QAAQ;gBACxB,MAAM,CAAE,IAAsB,CAAC,IAAI,CAAC,KAAK,IAAI,CAChD,CAAC;YACF,IAAI,KAAK,EAAE,EAAE,EAAE,CAAC;gBACd,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1B,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC;YAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzD,MAAM,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,wDAAwD,CACzD,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,gBAAgB,CAAC,OAKtB;QACC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC9C,8BAA8B,wBAAwB,CAAC,OAAO,CAAC,EAAE,EACjE,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;QACF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,oBAAoB,CAC5B,oCAAoC,EACpC,MAAM,CACP,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,EAAE,GAAI,GAA2C,EAAE,aAAa,CAAC;QACvE,OAAO,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjD,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,UAAU,CAAC,YAAoB;QACnC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC9C,8BAA8B,kBAAkB,CAAC,YAAY,CAAC,SAAS,EACvE,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;QACF,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,oBAAoB,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAC1C,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAC9C,8BAA8B,kBAAkB,CAAC,YAAY,CAAC,SAAS,EACvE,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;QACF,IAAI,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,oBAAoB,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,MAAM,GACV,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;YAC5C,CAAC,CAAE,IAAI,CAAC,MAAkC;YAC1C,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC;QAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,IAAY,EACZ,IAAI,GAA4C,EAAE;QAMlD,OAAO,MAAM,oBAAoB,CAAC;YAChC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,IAAI,EAAE;YACrC,IAAI;YACJ,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU;SAC3B,CAAC,CAAC;IACL,CAAC;CACF;AAED,+EAA+E;AAC/E,SAAS,uBAAuB,CAC9B,MAAc,EACd,IAA6B;IAE7B,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CACnB,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAC9C,CAAC,WAAW,EAAE,CAAC;IAChB,OAAO,CACL,IAAI,CAAC,KAAK,KAAK,wBAAwB;QACvC,MAAM,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QAC5C,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CACvC,CAAC;AACJ,CAAC"}

package/dist/connectors/mcp/schema.d.ts

@@ -1,12 +0,0 @@
-import { z } from "zod";
-import type { McpServersConfig } from "./types.js";
-/**
- * The MCP connector's arguments.
- *
- * Shape, types, and tool-name lists are the schema's job; the rules that need
- * more than one field — a stdio server, a tool selected and deselected at once
- * — are checks with hand-written messages. Server configs stay loose because
- * `@langchain/mcp-adapters` accepts more per-transport options than MDA models.
- */
-export declare const mcpServersConfig: z.ZodType<McpServersConfig, McpServersConfig>;
-//# sourceMappingURL=schema.d.ts.map

package/dist/connectors/mcp/schema.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/connectors/mcp/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA6CnD;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,gBAAgB,CAevE,CAAC"}

package/dist/connectors/mcp/schema.js

@@ -1,55 +0,0 @@
-import { z } from "zod";
-import { appendToolSelectionOverlapIssue, optionalToolNameListSchema, } from "../tool-selection.js";
-import { isCredentialReference, } from "../../credentials.js";
-/** Stdio servers are out of scope; the message points at the alternatives. */
-const STDIO_REJECTION = "uses a stdio transport, which is not supported. Managed Deep Agents " +
-    "support remote MCP servers over HTTP/SSE only; expose the server over HTTP " +
-    "or write a normal authored tool instead.";
-/** Raw MCP tool names, before the managed `{server}__` prefix is applied. */
-const remoteMcpServer = z
-    .looseObject({
-    /**
-     * Present only to reject it: a `command` is how a stdio server is defined,
-     * which we don't support.
-     */
-    command: z.never({ error: STDIO_REJECTION }).optional(),
-    transport: z.enum(["http", "sse"], {
-        error: (issue) => issue.input === "stdio"
-            ? STDIO_REJECTION
-            : 'must declare a remote transport ("http" or "sse")',
-    }),
-    url: z
-        .string("must be a non-empty URL")
-        .refine((url) => url.trim().length > 0, "must be a non-empty URL"),
-    headers: z.record(z.string(), z.string()).optional(),
-    defaultToolTimeout: z
-        .number("defaultToolTimeout must be a positive number")
-        .positive("defaultToolTimeout must be a positive number")
-        .optional(),
-    includeTools: optionalToolNameListSchema,
-    excludeTools: optionalToolNameListSchema,
-    credential: z
-        .custom(isCredentialReference, "must be a credentials.get(slug, owner) reference")
-        .optional(),
-})
-    .check(appendToolSelectionOverlapIssue);
-/**
- * The MCP connector's arguments.
- *
- * Shape, types, and tool-name lists are the schema's job; the rules that need
- * more than one field — a stdio server, a tool selected and deselected at once
- * — are checks with hand-written messages. Server configs stay loose because
- * `@langchain/mcp-adapters` accepts more per-transport options than MDA models.
- */
-export const mcpServersConfig = z.object({
-    mcpServers: z
-        .record(z.string(), remoteMcpServer, {
-        error: "must be an object mapping server names to remote MCP server configs",
-    })
-        .refine((servers) => Object.keys(servers).length > 0, "requires at least one entry"),
-    prefixToolNameWithServerName: z.boolean().optional(),
-    throwOnLoadError: z.boolean().optional(),
-    useStandardContentBlocks: z.boolean().optional(),
-    onConnectionError: z.literal("throw").optional(),
-});
-//# sourceMappingURL=schema.js.map

package/dist/connectors/mcp/schema.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/connectors/mcp/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,sBAAsB,CAAC;AAE9B,8EAA8E;AAC9E,MAAM,eAAe,GACnB,sEAAsE;IACtE,6EAA6E;IAC7E,0CAA0C,CAAC;AAE7C,6EAA6E;AAC7E,MAAM,eAAe,GAAG,CAAC;KACtB,WAAW,CAAC;IACX;;;OAGG;IACH,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvD,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;QACjC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,CAAC,KAAK,KAAK,OAAO;YACrB,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,mDAAmD;KAC1D,CAAC;IACF,GAAG,EAAE,CAAC;SACH,MAAM,CAAC,yBAAyB,CAAC;SACjC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,yBAAyB,CAAC;IACpE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,kBAAkB,EAAE,CAAC;SAClB,MAAM,CAAC,8CAA8C,CAAC;SACtD,QAAQ,CAAC,8CAA8C,CAAC;SACxD,QAAQ,EAAE;IACb,YAAY,EAAE,0BAA0B;IACxC,YAAY,EAAE,0BAA0B;IACxC,UAAU,EAAE,CAAC;SACV,MAAM,CACL,qBAAqB,EACrB,kDAAkD,CACnD;SACA,QAAQ,EAAE;CACd,CAAC;KACD,KAAK,CAAC,+BAA+B,CAAC,CAAC;AAE1C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,CAAC,CAAC,MAAM,CAAC;IACP,UAAU,EAAE,CAAC;SACV,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,EAAE;QACnC,KAAK,EACH,qEAAqE;KACxE,CAAC;SACD,MAAM,CACL,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAC5C,6BAA6B,CAC9B;IACH,4BAA4B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACpD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChD,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC"}

package/dist/connectors/mcp/types.d.ts

@@ -1,62 +0,0 @@
-import type { ClientConfig, StreamableHTTPConnection } from "@langchain/mcp-adapters";
-import type { Connector } from "../../runtime/connector.js";
-import type { CredentialReference } from "../../credentials.js";
-/** Per-server MCP tool selection. Names are raw, unprefixed MCP tool names. */
-export interface McpToolSelectionConfig {
-    /**
-     * Raw MCP tool names to expose from this server. Names are matched before any
-     * managed `{server}__` prefix is applied.
-     */
-    includeTools?: string[];
-    /**
-     * Raw MCP tool names to hide from this server. Names are matched before any
-     * managed `{server}__` prefix is applied.
-     */
-    excludeTools?: string[];
-}
-/** A user-owned credential reference resolved through Agent Auth at run time. */
-export type McpServerCredential = CredentialReference;
-/** Adapter connection fields MDA forwards, excluding stdio/auth the runtime owns. */
-type AdapterRemoteConnection = Omit<StreamableHTTPConnection, "transport" | "type" | "authProvider">;
-/** Shared remote server options plus MDA-only tool selection and credential mode. */
-export type RemoteMcpServerBaseConfig = AdapterRemoteConnection & McpToolSelectionConfig & {
-    /**
-     * Bearer credential for this server, declared with `credentials.get(...)`.
-     * An agent owner is a deployment-wide secret read once at load; a user
-     * owner is the caller's OAuth grant, loaded per caller after the gate.
-     */
-    credential?: McpServerCredential;
-};
-/** Streamable HTTP MCP server connection. */
-export type HttpMcpServerConfig = RemoteMcpServerBaseConfig & {
-    /** Remote transport. `"http"` selects Streamable HTTP. */
-    transport: "http";
-};
-/** Legacy SSE MCP server connection. */
-export type SseMcpServerConfig = RemoteMcpServerBaseConfig & {
-    /** Remote transport. `"sse"` selects legacy SSE. */
-    transport: "sse";
-};
-/** A remote MCP server connection. Stdio servers are intentionally excluded. */
-export type RemoteMcpServerConfig = HttpMcpServerConfig | SseMcpServerConfig;
-/** {@link MultiServerMCPClient} options MDA exposes on `connectors.mcp`. */
-type McpClientOptions = Pick<ClientConfig, "prefixToolNameWithServerName" | "throwOnLoadError" | "useStandardContentBlocks" | "onConnectionError">;
-/** Configuration accepted by `connectors.mcp`. */
-export interface McpServersConfig extends McpClientOptions {
-    /**
-     * MCP servers to connect to. Each key is the logical server name MDA uses
-     * for validation, tracing metadata, and tool-name prefixing.
-     */
-    mcpServers: Record<string, RemoteMcpServerConfig>;
-}
-/**
- * The connector exported from a `connectors/` module for MCP. It is a branded
- * managed {@link Connector} whose `tools` hook loads the declared MCP tools at
- * runtime, plus the raw config the loader reads.
- */
-export interface McpServersDefinition extends McpServersConfig, Connector {
-    /** Internal discriminator used by the MDA loader. */
-    readonly kind: "mcp_servers";
-}
-export {};
-//# sourceMappingURL=types.d.ts.map

package/dist/connectors/mcp/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/connectors/mcp/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,wBAAwB,EACzB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,iFAAiF;AACjF,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEtD,qFAAqF;AACrF,KAAK,uBAAuB,GAAG,IAAI,CACjC,wBAAwB,EACxB,WAAW,GAAG,MAAM,GAAG,cAAc,CACtC,CAAC;AAEF,qFAAqF;AACrF,MAAM,MAAM,yBAAyB,GAAG,uBAAuB,GAC7D,sBAAsB,GAAG;IACvB;;;;OAIG;IACH,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAClC,CAAC;AAEJ,6CAA6C;AAC7C,MAAM,MAAM,mBAAmB,GAAG,yBAAyB,GAAG;IAC5D,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,wCAAwC;AACxC,MAAM,MAAM,kBAAkB,GAAG,yBAAyB,GAAG;IAC3D,oDAAoD;IACpD,SAAS,EAAE,KAAK,CAAC;CAClB,CAAC;AAEF,gFAAgF;AAChF,MAAM,MAAM,qBAAqB,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAE7E,4EAA4E;AAC5E,KAAK,gBAAgB,GAAG,IAAI,CAC1B,YAAY,EACV,8BAA8B,GAC9B,kBAAkB,GAClB,0BAA0B,GAC1B,mBAAmB,CACtB,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;CACnD;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB,EAAE,SAAS;IACvE,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;CAC9B"}

package/dist/connectors/mcp/types.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=types.js.map

package/dist/connectors/mcp/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/connectors/mcp/types.ts"],"names":[],"mappings":""}

package/dist/credential-gate.d.ts

@@ -1,39 +0,0 @@
-/**
- * Pre-run gate for declarations that need a user-owned credential.
- *
- * Before the first model turn the gate reads the caller's OAuth grants from
- * Agent Auth. Missing grants raise one LangGraph interrupt listing connect
- * URLs; the tools a grant unlocks are loaded on first use and cached per
- * caller.
- */
-import { createMiddleware } from "langchain";
-import { type CredentialReference } from "./credentials.js";
-export declare const CREDENTIAL_GATE_MIDDLEWARE_NAME = "mda-credential-gate";
-export interface PendingCredential {
-    slug: string;
-    connect_url: string;
-    auth_id: string;
-}
-/** Interrupt payload when the caller has not granted one or more credentials. */
-export interface CredentialAuthorizationRequiredInterrupt {
-    type: "credential_authorization_required";
-    message: string;
-    credentials: PendingCredential[];
-}
-/** Tools a declaration contributes for one caller, plus their transport. */
-export interface LoadedCredentialTools {
-    tools: unknown[];
-    close: () => Promise<void>;
-}
-/** A declaration whose tools are unlocked by user-owned credentials. */
-export interface CredentialConsumer {
-    /** The declaration itself, used to key the per-caller tool cache. */
-    declaration: object;
-    /** User-owned credential references the declaration needs. */
-    credentials: readonly CredentialReference[];
-    load: (accessTokens: ReadonlyMap<string, string>) => Promise<LoadedCredentialTools>;
-}
-export declare function createCredentialGateMiddleware(consumers: readonly CredentialConsumer[]): ReturnType<typeof createMiddleware> | undefined;
-/** Drop every cached caller entry and close its transports. Test-only. */
-export declare function clearCredentialToolCacheForTests(): Promise<void>;
-//# sourceMappingURL=credential-gate.d.ts.map

package/dist/credential-gate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-gate.d.ts","sourceRoot":"","sources":["../src/credential-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAQ7C,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,kBAAkB,CAAC;AAY1B,eAAO,MAAM,+BAA+B,wBAAwB,CAAC;AAUrE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iFAAiF;AACjF,MAAM,WAAW,wCAAwC;IACvD,IAAI,EAAE,mCAAmC,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,iBAAiB,EAAE,CAAC;CAClC;AAED,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,WAAW,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC5C,IAAI,EAAE,CACJ,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KACtC,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACrC;AAuCD,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,SAAS,kBAAkB,EAAE,GACvC,UAAU,CAAC,OAAO,gBAAgB,CAAC,GAAG,SAAS,CAuCjD;AA+KD,0EAA0E;AAC1E,wBAAsB,gCAAgC,IAAI,OAAO,CAAC,IAAI,CAAC,CAStE"}

package/dist/credential-gate.js

@@ -1,209 +0,0 @@
-/**
- * Pre-run gate for declarations that need a user-owned credential.
- *
- * Before the first model turn the gate reads the caller's OAuth grants from
- * Agent Auth. Missing grants raise one LangGraph interrupt listing connect
- * URLs; the tools a grant unlocks are loaded on first use and cached per
- * caller.
- */
-import { createMiddleware } from "langchain";
-import { interrupt } from "@langchain/langgraph";
-import { AgentAuth, CredentialAuthorizationRequiredError, } from "./agent-auth.js";
-import { resolveAgentAuthContext, resolveOwnerId, } from "./credentials.js";
-import { buildRuntimeIdentity, resolveRuntimeConfigurable, } from "./runtime/identity-runtime.js";
-import { wrapToolsWithManagedRuntime, } from "./runtime/managed-tools.js";
-export const CREDENTIAL_GATE_MIDDLEWARE_NAME = "mda-credential-gate";
-/**
- * How long a caller's loaded tools stay cached.
- *
- * The access token is bound into the transport when the tools are built, so the
- * entry has to lapse well before the token does.
- */
-const TOOL_CACHE_TTL_MS = 5 * 60_000;
-/**
- * Loaded tools by declaration and caller.
- *
- * Module scope, not middleware scope: a resumed run re-enters through a fresh
- * graph factory, so a cache owned by the middleware would be empty for every
- * turn after an interrupt. It is only ever a latency optimization — a resume
- * can also land on another replica, so every read path rebuilds on a miss.
- */
-const toolCache = new Map();
-const declarationIds = new WeakMap();
-let nextDeclarationId = 0;
-class UnauthenticatedCallerError extends Error {
-    constructor() {
-        super("credentials with a user owner require an authenticated caller. " +
-            "Anonymous or agent-only runs cannot complete the credential gate.");
-        this.name = "UnauthenticatedCallerError";
-    }
-}
-export function createCredentialGateMiddleware(consumers) {
-    if (consumers.length === 0) {
-        return undefined;
-    }
-    return createMiddleware({
-        name: CREDENTIAL_GATE_MIDDLEWARE_NAME,
-        async beforeAgent(_state, runtime) {
-            const caller = authContext(runtime);
-            if (!caller) {
-                throw new UnauthenticatedCallerError();
-            }
-            await ensureGrants(consumers, caller);
-            await toolsForContext(consumers, caller.context);
-        },
-        async wrapModelCall(request, handler) {
-            const extra = await toolsForRuntime(consumers, request.runtime);
-            if (extra.length === 0) {
-                return handler(request);
-            }
-            const existing = Array.isArray(request.tools) ? request.tools : [];
-            return handler({ ...request, tools: [...existing, ...extra] });
-        },
-        async wrapToolCall(request, handler) {
-            const name = request.toolCall?.name;
-            if (request.tool != null || typeof name !== "string") {
-                return handler(request);
-            }
-            const tools = await toolsForRuntime(consumers, request.runtime);
-            const tool = tools.find((candidate) => candidate.name === name);
-            return tool ? handler({ ...request, tool }) : handler(request);
-        },
-    });
-}
-/**
- * Interrupt once when the caller is missing a grant.
- *
- * Reads never mint, so the probe is safe to repeat on every replay of this
- * node. Sessions are minted once, immediately before the interrupt that shows
- * their URLs.
- */
-async function ensureGrants(consumers, caller) {
-    const agentAuth = new AgentAuth(caller.context);
-    const granted = await Promise.all(consumerCredentials(consumers, caller).map(async ({ slug }) => ({
-        slug,
-        token: await agentAuth.readUserAccessToken(slug),
-    })));
-    const missing = granted.filter((row) => !row.token).map((row) => row.slug);
-    if (missing.length === 0) {
-        return;
-    }
-    const pending = await Promise.all(missing.map((slug) => agentAuth.startAuthorizationSession(slug)));
-    const payload = {
-        type: "credential_authorization_required",
-        message: "Connect the following integrations to continue.",
-        credentials: pending.map((session) => ({
-            slug: session.slug,
-            connect_url: session.connectUrl,
-            auth_id: session.authId,
-        })),
-    };
-    // `interrupt` throws while no resume value is pending and returns once one
-    // is, so reaching the line below means the run resumed with a grant still
-    // missing.
-    interrupt(payload);
-    throw new CredentialAuthorizationRequiredError(missing);
-}
-/**
- * Declared credentials, one per slug.
- *
- * Every reference is resolved through {@link resolveOwnerId}, the same check
- * `credentials.get` applies when a tool awaits a handle, so a declaration that
- * names another user is rejected here rather than quietly run as the caller.
- */
-function consumerCredentials(consumers, caller) {
-    const bySlug = new Map();
-    for (const consumer of consumers) {
-        for (const credential of consumer.credentials) {
-            resolveOwnerId(credential.owner, caller.identity, caller.context.agentId);
-            bySlug.set(credential.slug, credential);
-        }
-    }
-    return [...bySlug.values()];
-}
-async function toolsForRuntime(consumers, runtime) {
-    const caller = authContext(runtime);
-    return caller ? await toolsForContext(consumers, caller.context) : [];
-}
-async function toolsForContext(consumers, context) {
-    const loaded = await Promise.all(consumers.map((consumer) => cachedTools(consumer, context)));
-    return loaded.flat();
-}
-async function cachedTools(consumer, context) {
-    const key = `${declarationId(consumer.declaration)} ${context.principalId}`;
-    for (;;) {
-        const cached = toolCache.get(key);
-        if (!cached) {
-            return refresh(key, consumer, context, undefined);
-        }
-        const entry = await cached.catch(() => undefined);
-        if (entry && entry.expiresAt > Date.now()) {
-            return entry.tools;
-        }
-        // Nothing suspends between this read and the write inside `refresh`, so a
-        // lapsed entry is retired by exactly one caller. The rest see the
-        // replacement on the next pass and join it.
-        if (toolCache.get(key) === cached) {
-            return refresh(key, consumer, context, entry);
-        }
-    }
-}
-/** Publish the load before awaiting it, so concurrent callers share one transport. */
-async function refresh(key, consumer, context, lapsed) {
-    const loading = loadTools(consumer, context);
-    toolCache.set(key, loading);
-    lapsed?.close().catch(() => undefined);
-    try {
-        return (await loading).tools;
-    }
-    catch (error) {
-        if (toolCache.get(key) === loading) {
-            toolCache.delete(key);
-        }
-        throw error;
-    }
-}
-async function loadTools(consumer, context) {
-    const agentAuth = new AgentAuth(context);
-    const resolved = await Promise.all(consumer.credentials.map(async ({ slug }) => ({
-        slug,
-        token: await agentAuth.readUserAccessToken(slug),
-    })));
-    const missing = resolved.filter((row) => !row.token).map((row) => row.slug);
-    if (missing.length > 0) {
-        throw new CredentialAuthorizationRequiredError(missing);
-    }
-    const accessTokens = new Map(resolved.map((row) => [row.slug, row.token]));
-    const loaded = await consumer.load(accessTokens);
-    return {
-        tools: wrapToolsWithManagedRuntime(loaded.tools),
-        close: loaded.close,
-        expiresAt: Date.now() + TOOL_CACHE_TTL_MS,
-    };
-}
-function declarationId(declaration) {
-    const existing = declarationIds.get(declaration);
-    if (existing)
-        return existing;
-    nextDeclarationId += 1;
-    const id = String(nextDeclarationId);
-    declarationIds.set(declaration, id);
-    return id;
-}
-function authContext(runtime) {
-    const identity = buildRuntimeIdentity(resolveRuntimeConfigurable(runtime));
-    if (!identity?.user.id) {
-        return undefined;
-    }
-    return { context: resolveAgentAuthContext(identity), identity };
-}
-/** Drop every cached caller entry and close its transports. Test-only. */
-export async function clearCredentialToolCacheForTests() {
-    const entries = [...toolCache.values()];
-    toolCache.clear();
-    await Promise.all(entries.map(async (entry) => {
-        const resolved = await entry.catch(() => undefined);
-        await resolved?.close().catch(() => undefined);
-    }));
-}
-//# sourceMappingURL=credential-gate.js.map

package/dist/credential-gate.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-gate.js","sourceRoot":"","sources":["../src/credential-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EACL,SAAS,EACT,oCAAoC,GAErC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,uBAAuB,EACvB,cAAc,GAEf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAE3B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,2BAA2B,GAE5B,MAAM,4BAA4B,CAAC;AAEpC,MAAM,CAAC,MAAM,+BAA+B,GAAG,qBAAqB,CAAC;AAErE;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,GAAG,MAAM,CAAC;AA8CrC;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;AAEzD,MAAM,cAAc,GAAG,IAAI,OAAO,EAAkB,CAAC;AACrD,IAAI,iBAAiB,GAAG,CAAC,CAAC;AAE1B,MAAM,0BAA2B,SAAQ,KAAK;IAC5C;QACE,KAAK,CACH,iEAAiE;YAC/D,mEAAmE,CACtE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,UAAU,8BAA8B,CAC5C,SAAwC;IAExC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,gBAAgB,CAAC;QACtB,IAAI,EAAE,+BAA+B;QACrC,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO;YAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAwC,CAAC,CAAC;YACrE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0BAA0B,EAAE,CAAC;YACzC,CAAC;YACD,MAAM,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO;YAClC,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,SAAS,EACT,OAAO,CAAC,OAAwC,CACjD,CAAC;YACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO;YACjC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;YACpC,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,SAAS,EACT,OAAO,CAAC,OAAwC,CACjD,CAAC;YACF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjE,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CACzB,SAAwC,EACxC,MAAqB;IAErB,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI;QACJ,KAAK,EAAE,MAAM,SAAS,CAAC,mBAAmB,CAAC,IAAI,CAAC;KACjD,CAAC,CAAC,CACJ,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CACjE,CAAC;IACF,MAAM,OAAO,GAA6C;QACxD,IAAI,EAAE,mCAAmC;QACzC,OAAO,EAAE,iDAAiD;QAC1D,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,OAAO,CAAC,UAAU;YAC/B,OAAO,EAAE,OAAO,CAAC,MAAM;SACxB,CAAC,CAAC;KACJ,CAAC;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,WAAW;IACX,SAAS,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,IAAI,oCAAoC,CAAC,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAC1B,SAAwC,EACxC,MAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;IACtD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC9C,cAAc,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1E,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAAwC,EACxC,OAAsC;IAEtC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAAwC,EACxC,OAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAC5D,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAA4B,EAC5B,OAAyB;IAEzB,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAE5E,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;QACD,0EAA0E;QAC1E,kEAAkE;QAClE,4CAA4C;QAC5C,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,OAAO,CACpB,GAAW,EACX,QAA4B,EAC5B,OAAyB,EACzB,MAA8B;IAE9B,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7C,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5B,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,OAAO,CAAC,CAAC,KAAK,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;YACnC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,QAA4B,EAC5B,OAAyB;IAEzB,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI;QACJ,KAAK,EAAE,MAAM,SAAS,CAAC,mBAAmB,CAAC,IAAI,CAAC;KACjD,CAAC,CAAC,CACJ,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,oCAAoC,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAe,CAAC,CAAC,CACvD,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACjD,OAAO;QACL,KAAK,EAAE,2BAA2B,CAChC,MAAM,CAAC,KAAwB,CACjB;QAChB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,WAAmB;IACxC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,iBAAiB,IAAI,CAAC,CAAC;IACvB,MAAM,EAAE,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACrC,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACpC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAClB,OAAsC;IAEtC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,uBAAuB,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;AAClE,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,gCAAgC;IACpD,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,SAAS,CAAC,KAAK,EAAE,CAAC;IAClB,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC1B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,QAAQ,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/credentials.d.ts

@@ -1,88 +0,0 @@
-/**
- * `credentials.get(...)` — read a managed credential from a tool.
- *
- * `owner` is the scope the credential resolves under, and names the same axis as
- * Agent Auth's `owner_type` / `owner_id`. `{ type: "agent" }` is the deployment,
- * so every caller resolves the same static secret. `{ type: "user" }` is the
- * current caller, always backed by an OAuth grant. Resolution reads Agent Auth
- * on every await and never caches.
- */
-import type { RuntimeIdentity } from "./identity/index.js";
-import { type AgentAuthContext } from "./agent-auth.js";
-export { AGENT_AUTH_TIMEOUT_MS, AgentAuthUnknownProviderError, CredentialAuthorizationRequiredError, CredentialStoreError, } from "./agent-auth.js";
-export type { AgentAuthContext, PendingAuthorization } from "./agent-auth.js";
-export type AgentCredentialOwner = {
-    type: "agent";
-};
-export type UserCredentialOwner = {
-    type: "user";
-    id?: string;
-};
-export type CredentialOwner = AgentCredentialOwner | UserCredentialOwner;
-export interface CredentialRequest {
-    slug: string;
-    owner: CredentialOwner;
-    identity?: RuntimeIdentity;
-}
-declare const CREDENTIAL_REFERENCE: unique symbol;
-export declare class CredentialNotFoundError extends Error {
-    readonly slug: string;
-    readonly ownerType: CredentialOwner["type"];
-    constructor(slug: string, ownerType: CredentialOwner["type"]);
-}
-/**
- * A declarative credential handle. Connector declarations inspect its owner;
- * awaiting the same handle inside a tool resolves fresh material every time.
- */
-export declare class CredentialReference implements PromiseLike<string> {
-    readonly slug: string;
-    readonly owner: CredentialOwner;
-    private readonly accessor;
-    readonly [CREDENTIAL_REFERENCE] = true;
-    constructor(slug: string, owner: CredentialOwner, accessor: Credentials);
-    then<TResult1 = string, TResult2 = never>(onfulfilled?: ((value: string) => TResult1 | PromiseLike<TResult1>) | null, onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null): PromiseLike<TResult1 | TResult2>;
-}
-export declare function isCredentialReference(value: unknown): value is CredentialReference;
-export declare class AgentAuthCredentialStore {
-    private readonly env;
-    private readonly fetchImpl;
-    private readonly timeoutMs;
-    constructor(env?: NodeJS.ProcessEnv, fetchImpl?: typeof fetch, timeoutMs?: number);
-    fetch(request: CredentialRequest): Promise<string | undefined>;
-}
-export declare class Credentials {
-    private readonly store;
-    constructor(store?: AgentAuthCredentialStore);
-    get(slug: string, owner: CredentialOwner): CredentialReference;
-    resolve(slug: string, owner: CredentialOwner): Promise<string>;
-    /**
-     * Read an agent-owned secret outside a run.
-     *
-     * Connector declarations are loaded once per deployment, before any caller
-     * exists. An agent-owned secret is deployment-scoped, so it is the one lookup
-     * that carries no caller and can be resolved there.
-     */
-    resolveDeploymentSecret(slug: string): Promise<string>;
-}
-/**
- * The `owner_id` a lookup is keyed by: the caller for a user, else the
- * deployment. Shared with the credential gate so a declared owner is checked
- * the same way wherever it is resolved.
- */
-export declare function resolveOwnerId(owner: CredentialOwner, identity: RuntimeIdentity | undefined, deploymentId: string | undefined): string;
-/**
- * The Agent Auth binding for one caller.
- *
- * `credentials.get` and the pre-run credential gate both resolve their owner id
- * here, so a slug addresses the same Agent Auth row on either path.
- */
-export declare function resolveAgentAuthContext(identity: RuntimeIdentity | undefined, env?: NodeJS.ProcessEnv): AgentAuthContext;
-/**
- * Agent Auth is served by the LangSmith API.
- *
- * Rejects a URL that carries a path, query, or userinfo, so a misconfigured
- * endpoint cannot send the API key at a different service.
- */
-export declare function resolveAgentAuthBaseUrl(env?: NodeJS.ProcessEnv): string;
-export declare const credentials: Credentials;
-//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAKL,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,oCAAoC,EACpC,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE9E,MAAM,MAAM,oBAAoB,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AACrD,MAAM,MAAM,mBAAmB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,mBAAmB,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED,QAAA,MAAM,oBAAoB,eAA0C,CAAC;AAQrE,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAE5C,YAAY,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,EAK3D;CACF;AAED;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,WAAW,CAAC,MAAM,CAAC;IAI3D,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,KAAK,EAAE,eAAe;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAL3B,QAAQ,CAAC,CAAC,oBAAoB,CAAC,QAAQ;IAEvC,YACW,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,eAAe,EACd,QAAQ,EAAE,WAAW,EACpC;IAEJ,IAAI,CAAC,QAAQ,GAAG,MAAM,EAAE,QAAQ,GAAG,KAAK,EACtC,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,EAC1E,UAAU,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,KAAK,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,GAC1E,WAAW,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAIlC;CACF;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,mBAAmB,CAO9B;AASD,qBAAa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAH5B,YACmB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,SAAS,GAAE,OAAO,KAAa,EAC/B,SAAS,SAAwB,EAChD;IAEE,KAAK,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA6BnE;CACF;AAED,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IADxB,YACmB,KAAK,GAAE,wBAAyD,EAC/E;IAEJ,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,mBAAmB,CAM7D;IAEK,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBnE;IAED;;;;;;OAMG;IACG,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS3D;CACF;AA+CD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,MAAM,CAqBR;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,gBAAgB,CAkBlB;AAiBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAoBR;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}