managed-deepagents 0.6.2-dev.7 → 0.6.2-dev.9

package/dist/runtime/index.js

@@ -3,8 +3,6 @@ import { LazyManagedSandboxBackend } from "./backend.js";
 import { loadConnectorTools } from "./connector.js";
 import { createScheduleDeliveryMiddleware } from "../channels/schedule-delivery.js";
 import { createChannelResponseFormatMiddleware } from "../channels/response-format.js";
-import { createCredentialGateMiddleware } from "../credential-gate.js";
-import { mcpCredentialConsumers } from "../connectors/mcp/index.js";
 import { wrapMiddlewareWithManagedRuntime, } from "./managed-middleware.js";
 import { wrapToolsWithManagedRuntime, } from "./managed-tools.js";
 import { createMemoryInstructionsMiddleware, hasAgentMemorySlice, hotMemoryPaths, } from "../memory/index.js";
@@ -34,8 +32,8 @@ export async function compileManagedAgent(definition, config, options) {
     // one object, but mounting is owned by the managed HTTP app — leave it on
     // `options` unused here.
     // Resolution + thread/store scoping run in the generated custom-auth handler
-    // (`buildManagedAuth`). When identity is declared, the seam also surfaces
-    // `runtime.serverInfo.principal` to authored + connector tools (below).
+    // (`buildManagedAuth`). When identity is declared, the seam also surfaces the
+    // frozen `runtime.identity` envelope to authored + connector tools (below).
     identity, 
     // The root `memory.{ts,py}` declaration. Absent → no durable memory: the
     // slices a run mounts come from here and nowhere else.
@@ -110,14 +108,15 @@ export async function compileManagedAgent(definition, config, options) {
         const authoredTools = Array.isArray(params.tools) ? params.tools : [];
         params.tools = [...authoredTools, ...connectorTools];
     }
-    // With identity declared, surface `runtime.serverInfo.principal` on the runtime
-    // every tool receives, projected from the trusted `langgraph_auth_user`.
+    // With identity declared, surface the frozen `runtime.identity` envelope on
+    // the runtime every tool receives, built from the trusted
+    // `langgraph_auth_user`.
     if (identity && Array.isArray(params.tools)) {
         params.tools = wrapToolsWithManagedRuntime(params.tools);
     }
     // Do the same for authored middleware: each hook's `runtime` (and the `wrap*`
-    // hooks' `request.runtime`) gains `runtime.serverInfo.principal`, built from the
-    // same trusted `langgraph_auth_user` on `runtime.configurable`.
+    // hooks' `request.runtime`) gains `runtime.identity`, built from the same
+    // trusted `langgraph_auth_user` on `runtime.configurable`.
     const authoredMiddleware = Array.isArray(params.middleware)
         ? params.middleware
         : [];
@@ -125,18 +124,14 @@ export async function compileManagedAgent(definition, config, options) {
         ? wrapMiddlewareWithManagedRuntime(authoredMiddleware)
         : authoredMiddleware;
     // Always-on schedule deliverTo auto-post (cron runs); prepend before authored.
-    // The credential gate runs early so OAuth interrupts happen before the model
-    // turn; it only installs when a declaration names a user-owned credential.
     // The memory policy goes last on purpose. First in this list is outermost, so a
     // middleware placed earlier can have its prompt replaced by an authored one that
     // rewrites `systemPrompt` wholesale — and this policy is a security control, not a
     // hint. Last means nothing authored runs after it. deepagents still appends its own
     // `<agent_memory>` block after the whole custom stack, so the policy's "block below"
     // wording stays accurate.
-    const credentialGate = createCredentialGateMiddleware(mcpCredentialConsumers(connectors));
     params.middleware = [
         createScheduleDeliveryMiddleware(),
-        ...(credentialGate ? [credentialGate] : []),
         ...wrappedAuthored,
         createChannelResponseFormatMiddleware(),
         ...(mountsMemory ? [createMemoryInstructionsMiddleware()] : []),

package/dist/runtime/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAC;AACvF,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAEL,gCAAgC,GACjC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAEL,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kCAAkC,EAClC,mBAAmB,EACnB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,MAAM,EACN,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AAExE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,0EAA0E;AAC1E,gFAAgF;AAChF,wBAAwB;AACxB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,WAAW,EACX,kBAAkB,EAClB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAgBxB,OAAO,EACL,aAAa,EACb,eAAe,EACf,SAAS,EACT,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAStB;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAA+B,EAC/B,MAAyB,EACzB,OAA6B;IAE7B,MAAM,EACJ,WAAW,EACX,WAAW,EACX,YAAY,EACZ,SAAS,GAAG,KAAK,EACjB,OAAO,EACP,UAAU;IACV,4EAA4E;IAC5E,0EAA0E;IAC1E,yBAAyB;IACzB,6EAA6E;IAC7E,0EAA0E;IAC1E,wEAAwE;IACxE,QAAQ;IACR,yEAAyE;IACzE,uDAAuD;IACvD,MAAM,EACN,YAAY,GACb,GAAG,OAAO,IAAI,EAAE,CAAC;IAElB,MAAM,EAAE,QAAQ,EAAE,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC;IACvD,+EAA+E;IAC/E,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,MAAM,GAA4B,EAAE,GAAG,WAAW,EAAE,CAAC;IAE3D;;;;;;;;OAQG;IACH,MAAM,qBAAqB,GACzB,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QACjC,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC;QAChC,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,cAAc,GAAG,OAAO;QAC5B,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC;YAC/B,OAAO;YACP,SAAS,EAAE,MAAM;YACjB,UAAU;YACV,QAAQ;SACT,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC7E,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,YAAY,GAAG,SAAS,CAAC;QAClC,CAAC;QACD,6EAA6E;QAC7E,uEAAuE;QACvE,MAAM,YAAY,GAAgB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9D,MAAM,CAAC,OAAO,GAAG,qBAAqB,CACpC,cAAc,CAAC,OAAO,EACtB,cAAc,EACd,mBAAmB,CAAC,YAAY,CAAC,CAClC,CAAC;QACF,8EAA8E;QAC9E,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,CAAC,WAAW,GAAG,cAAc;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,GAAG,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC;YACpB,6EAA6E;YAC7E,8EAA8E;YAC9E,+DAA+D;YAC/D,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,6EAA6E;QAC7E,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;QACrC,CAAC;QACD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO,GAAG,cAAc,CAAC;QAClC,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACxB,kFAAkF;YAClF,MAAM,CAAC,OAAO,GAAG,gCAAgC,CAAC,YAAY,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC;IACnD,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,KAAK,GAAG,CAAC,GAAG,aAAa,EAAE,GAAG,cAAc,CAAC,CAAC;IACvD,CAAC;IAED,gFAAgF;IAChF,yEAAyE;IACzE,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,KAAK,GAAG,2BAA2B,CAAC,MAAM,CAAC,KAAwB,CAAC,CAAC;IAC9E,CAAC;IAED,8EAA8E;IAC9E,iFAAiF;IACjF,gEAAgE;IAChE,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QACzD,CAAC,CAAE,MAAM,CAAC,UAAkC;QAC5C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,eAAe,GAAG,QAAQ;QAC9B,CAAC,CAAC,gCAAgC,CAAC,kBAAkB,CAAC;QACtD,CAAC,CAAC,kBAAkB,CAAC;IACvB,+EAA+E;IAC/E,6EAA6E;IAC7E,2EAA2E;IAC3E,gFAAgF;IAChF,iFAAiF;IACjF,mFAAmF;IACnF,oFAAoF;IACpF,qFAAqF;IACrF,0BAA0B;IAC1B,MAAM,cAAc,GAAG,8BAA8B,CACnD,sBAAsB,CAAC,UAAU,CAAC,CACnC,CAAC;IACF,MAAM,CAAC,UAAU,GAAG;QAClB,gCAAgC,EAAE;QAClC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,eAAe;QAClB,qCAAqC,EAAE;QACvC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,kCAAkC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC;IAEF,8EAA8E;IAC9E,gEAAgE;IAChE,EAAE;IACF,6EAA6E;IAC7E,gEAAgE;IAChE,0EAA0E;IAC1E,2EAA2E;IAC3E,sCAAsC;IACtC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,SAAS,GAA4B;QACzC,cAAc,EAAE,uBAAuB;KACxC,CAAC;IACF,IAAI,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAChC,CAAC;IACD,OAAO,0BAA0B,CAC/B,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAC3B,uBAAuB,CACxB,CAAC;AACJ,CAAC;AASD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,UAA+B,EAC/B,MAAyB,EACzB,OAA4B;IAE5B,MAAM,EAAE,aAAa,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IAC3D,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,cAAc,GAAwB;QAC1C,GAAG,UAAU;QACb,MAAM,EAAE;YACN,GAAG,UAAU,CAAC,MAAM;YACpB,GAAG,CAAC,aAAa,IAAI,eAAe;gBAClC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,IAAI,eAAe,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;IACF,OAAO,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE;QACjD,GAAG,cAAc;QACjB,4EAA4E;QAC5E,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,EAAE,SAAS;QACjB,4EAA4E;QAC5E,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC;KACjC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAyB;IAClD,MAAM,KAAK,GAAG,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,MAAyB;IAC3C,MAAM,GAAG,GAAG,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC;IACtC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,OAA0B;IAE1B,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAC1E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,mFAAmF;IACnF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAMD,KAAK,UAAU,qBAAqB,CAClC,WAA+B,EAC/B,WAA+B;IAE/B,8EAA8E;IAC9E,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,IAAI,iBAAiB,CAAC;gBAC7B,OAAO,EAAE,WAAW;gBACpB,WAAW,EAAE,IAAI;aAClB,CAAC;YACF,OAAO,EAAE,WAAW;SACrB,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAC;AACvF,OAAO,EAEL,gCAAgC,GACjC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAEL,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kCAAkC,EAClC,mBAAmB,EACnB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,MAAM,EACN,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AAExE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,0EAA0E;AAC1E,gFAAgF;AAChF,wBAAwB;AACxB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,WAAW,EACX,kBAAkB,EAClB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAgBxB,OAAO,EACL,aAAa,EACb,eAAe,EACf,SAAS,EACT,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAStB;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAA+B,EAC/B,MAAyB,EACzB,OAA6B;IAE7B,MAAM,EACJ,WAAW,EACX,WAAW,EACX,YAAY,EACZ,SAAS,GAAG,KAAK,EACjB,OAAO,EACP,UAAU;IACV,4EAA4E;IAC5E,0EAA0E;IAC1E,yBAAyB;IACzB,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,QAAQ;IACR,yEAAyE;IACzE,uDAAuD;IACvD,MAAM,EACN,YAAY,GACb,GAAG,OAAO,IAAI,EAAE,CAAC;IAElB,MAAM,EAAE,QAAQ,EAAE,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC;IACvD,+EAA+E;IAC/E,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,MAAM,GAA4B,EAAE,GAAG,WAAW,EAAE,CAAC;IAE3D;;;;;;;;OAQG;IACH,MAAM,qBAAqB,GACzB,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QACjC,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC;QAChC,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,cAAc,GAAG,OAAO;QAC5B,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC;YAC/B,OAAO;YACP,SAAS,EAAE,MAAM;YACjB,UAAU;YACV,QAAQ;SACT,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC7E,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,YAAY,GAAG,SAAS,CAAC;QAClC,CAAC;QACD,6EAA6E;QAC7E,uEAAuE;QACvE,MAAM,YAAY,GAAgB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9D,MAAM,CAAC,OAAO,GAAG,qBAAqB,CACpC,cAAc,CAAC,OAAO,EACtB,cAAc,EACd,mBAAmB,CAAC,YAAY,CAAC,CAClC,CAAC;QACF,8EAA8E;QAC9E,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,CAAC,WAAW,GAAG,cAAc;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,GAAG,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC;YACpB,6EAA6E;YAC7E,8EAA8E;YAC9E,+DAA+D;YAC/D,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,6EAA6E;QAC7E,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;QACrC,CAAC;QACD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO,GAAG,cAAc,CAAC;QAClC,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACxB,kFAAkF;YAClF,MAAM,CAAC,OAAO,GAAG,gCAAgC,CAAC,YAAY,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC;IACnD,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,KAAK,GAAG,CAAC,GAAG,aAAa,EAAE,GAAG,cAAc,CAAC,CAAC;IACvD,CAAC;IAED,4EAA4E;IAC5E,0DAA0D;IAC1D,yBAAyB;IACzB,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,KAAK,GAAG,2BAA2B,CAAC,MAAM,CAAC,KAAwB,CAAC,CAAC;IAC9E,CAAC;IAED,8EAA8E;IAC9E,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QACzD,CAAC,CAAE,MAAM,CAAC,UAAkC;QAC5C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,eAAe,GAAG,QAAQ;QAC9B,CAAC,CAAC,gCAAgC,CAAC,kBAAkB,CAAC;QACtD,CAAC,CAAC,kBAAkB,CAAC;IACvB,+EAA+E;IAC/E,gFAAgF;IAChF,iFAAiF;IACjF,mFAAmF;IACnF,oFAAoF;IACpF,qFAAqF;IACrF,0BAA0B;IAC1B,MAAM,CAAC,UAAU,GAAG;QAClB,gCAAgC,EAAE;QAClC,GAAG,eAAe;QAClB,qCAAqC,EAAE;QACvC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,kCAAkC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC;IAEF,8EAA8E;IAC9E,gEAAgE;IAChE,EAAE;IACF,6EAA6E;IAC7E,gEAAgE;IAChE,0EAA0E;IAC1E,2EAA2E;IAC3E,sCAAsC;IACtC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,SAAS,GAA4B;QACzC,cAAc,EAAE,uBAAuB;KACxC,CAAC;IACF,IAAI,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAChC,CAAC;IACD,OAAO,0BAA0B,CAC/B,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAC3B,uBAAuB,CACxB,CAAC;AACJ,CAAC;AASD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,UAA+B,EAC/B,MAAyB,EACzB,OAA4B;IAE5B,MAAM,EAAE,aAAa,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IAC3D,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,cAAc,GAAwB;QAC1C,GAAG,UAAU;QACb,MAAM,EAAE;YACN,GAAG,UAAU,CAAC,MAAM;YACpB,GAAG,CAAC,aAAa,IAAI,eAAe;gBAClC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,IAAI,eAAe,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;IACF,OAAO,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE;QACjD,GAAG,cAAc;QACjB,4EAA4E;QAC5E,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,EAAE,SAAS;QACjB,4EAA4E;QAC5E,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC;KACjC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAyB;IAClD,MAAM,KAAK,GAAG,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,MAAyB;IAC3C,MAAM,GAAG,GAAG,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC;IACtC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,OAA0B;IAE1B,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAC1E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,mFAAmF;IACnF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAMD,KAAK,UAAU,qBAAqB,CAClC,WAA+B,EAC/B,WAA+B;IAE/B,8EAA8E;IAC9E,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,IAAI,iBAAiB,CAAC;gBAC7B,OAAO,EAAE,WAAW;gBACpB,WAAW,EAAE,IAAI;aAClB,CAAC;YACF,OAAO,EAAE,WAAW;SACrB,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/runtime/managed-middleware.d.ts

@@ -7,8 +7,8 @@ export interface ManagedMiddleware {
     [key: string]: unknown;
 }
 /**
- * Wrap a middleware so every hook sees `runtime.serverInfo.principal` (…) without
- * changing its name, schema, registered tools, or class.
+ * Wrap a middleware so every hook sees `runtime.identity` (…) without changing
+ * its name, schema, registered tools, or class.
  *
  * A `Proxy` intercepts only the hook properties: lifecycle hooks
  * (`beforeAgent`/`beforeModel`/`afterModel`/`afterAgent`, in either function or

package/dist/runtime/managed-middleware.js

@@ -10,10 +10,10 @@ const LIFECYCLE_HOOKS = new Set([
 const WRAP_HOOKS = new Set(["wrapModelCall", "wrapToolCall"]);
 /**
  * Return a copy of the middleware runtime with the managed primitives
- * (`runtime.serverInfo.principal`, …) layered on. The envelope is projected from
- * the trusted `runtime.configurable.langgraph_auth_user` the custom-auth handler
- * produced — the same channel tools use — since the platform, not us, invokes the
- * graph and `runtime.context` is caller-supplied per-run data we do not control.
+ * (`runtime.identity`, …) layered on. Identity is built from the trusted
+ * `runtime.configurable.langgraph_auth_user` the custom-auth handler produced —
+ * the same channel tools use — since the platform, not us, invokes the graph and
+ * `runtime.context` is caller-supplied per-run data we do not control.
  */
 function augmentRuntime(runtime) {
     const overrides = managedRuntimeOverrides(runtime);
@@ -41,8 +41,8 @@ function wrapWrapHook(target, value) {
     return (request, handler) => fn.call(target, { ...request, runtime: augmentRuntime(request?.runtime) }, handler);
 }
 /**
- * Wrap a middleware so every hook sees `runtime.serverInfo.principal` (…) without
- * changing its name, schema, registered tools, or class.
+ * Wrap a middleware so every hook sees `runtime.identity` (…) without changing
+ * its name, schema, registered tools, or class.
  *
  * A `Proxy` intercepts only the hook properties: lifecycle hooks
  * (`beforeAgent`/`beforeModel`/`afterModel`/`afterAgent`, in either function or

package/dist/runtime/managed-tools.d.ts

@@ -1,7 +1,8 @@
 import type { ToolRuntime } from "@langchain/core/tools";
+import type { RuntimeIdentity } from "../identity/index.js";
 import type { RuntimeChannel } from "../channels/types.js";
-import type { ManagedServerInfo, RuntimeConfigLike } from "./identity-runtime.js";
-export type { ManagedServerInfo, RuntimeConfigLike, } from "./identity-runtime.js";
+import type { RuntimeConfigLike } from "./identity-runtime.js";
+export type { RuntimeConfigLike } from "./identity-runtime.js";
 /**
  * A LangChain/LangGraph tool from MDA's perspective: the only surface the runtime
  * seam touches is `invoke(input, runtime)`. Kept structural so the wrapper works
@@ -12,11 +13,7 @@ export interface InvokableTool {
 }
 /** The managed primitives MDA layers onto the tool runtime. */
 export interface ManagedRuntimeExtras {
-    /**
-     * LangGraph server metadata with the author-facing principal on `principal`
-     * (plus `subject` / `link`) and LangGraph AuthUser on `user`.
-     */
-    serverInfo?: ManagedServerInfo;
+    identity?: RuntimeIdentity;
     /**
      * Present only for channel-originated runs. Ordinary HTTP and schedule runs
      * leave this undefined.
@@ -25,32 +22,31 @@ export interface ManagedRuntimeExtras {
 }
 /**
  * The runtime surface managed Deep Agent tools receive: LangGraph's
- * {@link ToolRuntime} plus MDA-managed primitives such as `serverInfo`.
+ * {@link ToolRuntime} plus MDA-managed primitives such as `identity`.
  *
  * Annotate the second parameter of a `tool(...)` handler when you need the
- * trusted caller for the current run (`runtime.serverInfo?.principal`).
+ * frozen identity envelope for the current run.
  */
 export interface ManagedDeepAgentRuntime<TState = unknown, TContext = unknown> extends ToolRuntime<TState, TContext>, ManagedRuntimeExtras {
 }
 /**
  * The fields MDA overlays onto the runtime a tool/middleware hook receives:
- * `serverInfo.principal` / `subject` / `link` (when an actor resolved) and a
- * `configurable` with the reserved identity keys stripped so downstream code
- * can't read a client-spoofed `actor_id`/`tenant_id`. Returns an empty object
- * when there is nothing to change, so the original runtime passes through
- * untouched.
+ * the frozen `identity` (when an actor resolved) and a `configurable` with the
+ * reserved identity keys stripped so downstream code can't read a
+ * client-spoofed `actor_id`/`tenant_id`. Returns an empty object when there is
+ * nothing to change, so the original runtime passes through untouched.
  */
 export declare function managedRuntimeOverrides(runtime: RuntimeConfigLike | undefined): ManagedRuntimeExtras & {
     configurable?: Record<string, unknown>;
 };
 /**
- * Wrap a tool so its runtime carries the managed primitives
- * (`runtime.serverInfo.principal`, …) without changing its name, schema, or class.
+ * Wrap a tool so its runtime carries the managed primitives (`runtime.identity`,
+ * …) without changing its name, schema, or class.
  *
  * Augments `invoke` (for LangGraph's `ToolNode`) and patches a shallow copy's
- * internal `func`/`coroutine` so the auth user reaches the authored handler even
- * when LangChain rewrites the runtime into a RunnableConfig before calling the
- * tool function. The original tool instance is left untouched.
+ * internal `func`/`coroutine` so identity reaches the authored handler even when
+ * LangChain rewrites the runtime into a RunnableConfig before calling the tool
+ * function. The original tool instance is left untouched.
  */
 export declare function withManagedRuntime<T extends InvokableTool>(managedTool: T): T;
 /** Wrap every tool in a list with {@link withManagedRuntime}. */

package/dist/runtime/managed-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managed-tools.d.ts","sourceRoot":"","sources":["../../src/runtime/managed-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAM3D,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACV,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAE/B;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC;CAC9D;AAED,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB,CAAC,MAAM,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO,CAC3E,SAAQ,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,oBAAoB;CAAG;AAEhE;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GACrC,oBAAoB,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAmCnE;AAwBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,aAAa,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,CAqC7E;AAED,iEAAiE;AACjE,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,aAAa,EACjE,KAAK,EAAE,SAAS,CAAC,EAAE,GAClB,CAAC,EAAE,CAEL"}
+{"version":3,"file":"managed-tools.d.ts","sourceRoot":"","sources":["../../src/runtime/managed-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAM3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC;CAC9D;AAED,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB,CAAC,MAAM,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO,CAC3E,SAAQ,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,oBAAoB;CAAG;AAEhE;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GACrC,oBAAoB,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAgCnE;AAwBD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,aAAa,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,CAqC7E;AAED,iEAAiE;AACjE,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,aAAa,EACjE,KAAK,EAAE,SAAS,CAAC,EAAE,GAClB,CAAC,EAAE,CAEL"}

package/dist/runtime/managed-tools.js

@@ -1,19 +1,18 @@
 import { resolveRuntimeChannel } from "../channels/binding.js";
-import { buildManagedServerInfo, resolveRuntimeConfigurable, sanitizeConfigurable, } from "./identity-runtime.js";
+import { buildRuntimeIdentity, resolveRuntimeConfigurable, sanitizeConfigurable, } from "./identity-runtime.js";
 /**
  * The fields MDA overlays onto the runtime a tool/middleware hook receives:
- * `serverInfo.principal` / `subject` / `link` (when an actor resolved) and a
- * `configurable` with the reserved identity keys stripped so downstream code
- * can't read a client-spoofed `actor_id`/`tenant_id`. Returns an empty object
- * when there is nothing to change, so the original runtime passes through
- * untouched.
+ * the frozen `identity` (when an actor resolved) and a `configurable` with the
+ * reserved identity keys stripped so downstream code can't read a
+ * client-spoofed `actor_id`/`tenant_id`. Returns an empty object when there is
+ * nothing to change, so the original runtime passes through untouched.
  */
 export function managedRuntimeOverrides(runtime) {
     const overrides = {};
     const configurable = resolveRuntimeConfigurable(runtime);
-    const serverInfo = buildManagedServerInfo(runtime, configurable);
-    if (serverInfo) {
-        overrides.serverInfo = serverInfo;
+    const identity = buildRuntimeIdentity(configurable);
+    if (identity) {
+        overrides.identity = identity;
     }
     if (runtime?.channel) {
         overrides.channel = runtime.channel;
@@ -50,13 +49,13 @@ function wrapToolCallable(original, receiver) {
     return (input, runManager, config) => original.call(receiver, input, runManager, augmentToolConfig(config));
 }
 /**
- * Wrap a tool so its runtime carries the managed primitives
- * (`runtime.serverInfo.principal`, …) without changing its name, schema, or class.
+ * Wrap a tool so its runtime carries the managed primitives (`runtime.identity`,
+ * …) without changing its name, schema, or class.
  *
  * Augments `invoke` (for LangGraph's `ToolNode`) and patches a shallow copy's
- * internal `func`/`coroutine` so the auth user reaches the authored handler even
- * when LangChain rewrites the runtime into a RunnableConfig before calling the
- * tool function. The original tool instance is left untouched.
+ * internal `func`/`coroutine` so identity reaches the authored handler even when
+ * LangChain rewrites the runtime into a RunnableConfig before calling the tool
+ * function. The original tool instance is left untouched.
  */
 export function withManagedRuntime(managedTool) {
     const patchable = Object.assign(Object.create(Object.getPrototypeOf(managedTool)), managedTool);

package/dist/runtime/managed-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"managed-tools.js","sourceRoot":"","sources":["../../src/runtime/managed-tools.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AA4C/B;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAsC;IAEtC,MAAM,SAAS,GAMX,EAAE,CAAC;IACP,MAAM,YAAY,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACjE,IAAI,UAAU,EAAE,CAAC;QACf,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,OAA0C,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,WAAW,EAAE,CAAC;YAChB,SAAS,CAAC,OAAO,GAAG,WAAW,CAAC;QAClC,CAAC;IACH,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;YACvE,IAAI,OAAO,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;gBACxC,SAAS,CAAC,YAAY,GAAG,SAAS,CAAC;YACrC,CAAC;iBAAM,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBAC3B,SAAS,CAAC,MAAM,GAAG;oBACjB,GAAG,OAAO,CAAC,MAAM;oBACjB,YAAY,EAAE,SAAS;iBACxB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAqC;IAErC,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;QACtC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE;QAC7B,CAAC,CAAC,MAAM,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAyC,EACzC,QAAiB;IAEjB,OAAO,CAAC,KAAc,EAAE,UAAmB,EAAE,MAAe,EAAE,EAAE,CAC9D,QAAQ,CAAC,IAAI,CACX,QAAQ,EACR,KAAK,EACL,UAAU,EACV,iBAAiB,CAAC,MAAuC,CAAC,CAC3D,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAA0B,WAAc;IACxE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,EACjD,WAAW,CAIZ,CAAC;IACF,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACzC,SAAS,CAAC,IAAI,GAAG,gBAAgB,CAC/B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAChC,WAAW,CACZ,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC9C,SAAS,CAAC,SAAS,GAAG,gBAAgB,CACpC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,EACrC,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,KAAK,CAAC,SAAS,EAAE;QAC1B,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ;YAC5B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAc,EAAE,OAA2B,EAAE,EAAE;oBACrD,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;oBACnD,OAAO,MAAM,CAAC,MAAM,CAClB,KAAK,EACL,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;wBAC/B,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,EAAE;wBAC9B,CAAC,CAAC,OAAO,CACZ,CAAC;gBACJ,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,2BAA2B,CACzC,KAAmB;IAEnB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"managed-tools.js","sourceRoot":"","sources":["../../src/runtime/managed-tools.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAkC/B;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAsC;IAEtC,MAAM,SAAS,GAGX,EAAE,CAAC;IACP,MAAM,YAAY,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,OAA0C,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,WAAW,EAAE,CAAC;YAChB,SAAS,CAAC,OAAO,GAAG,WAAW,CAAC;QAClC,CAAC;IACH,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;YACvE,IAAI,OAAO,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;gBACxC,SAAS,CAAC,YAAY,GAAG,SAAS,CAAC;YACrC,CAAC;iBAAM,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBAC3B,SAAS,CAAC,MAAM,GAAG;oBACjB,GAAG,OAAO,CAAC,MAAM;oBACjB,YAAY,EAAE,SAAS;iBACxB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAqC;IAErC,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;QACtC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE;QAC7B,CAAC,CAAC,MAAM,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAyC,EACzC,QAAiB;IAEjB,OAAO,CAAC,KAAc,EAAE,UAAmB,EAAE,MAAe,EAAE,EAAE,CAC9D,QAAQ,CAAC,IAAI,CACX,QAAQ,EACR,KAAK,EACL,UAAU,EACV,iBAAiB,CAAC,MAAuC,CAAC,CAC3D,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAA0B,WAAc;IACxE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,EACjD,WAAW,CAIZ,CAAC;IACF,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACzC,SAAS,CAAC,IAAI,GAAG,gBAAgB,CAC/B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAChC,WAAW,CACZ,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC9C,SAAS,CAAC,SAAS,GAAG,gBAAgB,CACpC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,EACrC,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,KAAK,CAAC,SAAS,EAAE;QAC1B,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ;YAC5B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAc,EAAE,OAA2B,EAAE,EAAE;oBACrD,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;oBACnD,OAAO,MAAM,CAAC,MAAM,CAClB,KAAK,EACL,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;wBAC/B,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,EAAE;wBAC9B,CAAC,CAAC,OAAO,CACZ,CAAC;gBACJ,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,2BAA2B,CACzC,KAAmB;IAEnB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/runtime/types.d.ts

@@ -61,8 +61,8 @@ export interface ManagedAgentOptions {
     /**
      * The root `identity.ts` declaration, if the project opts into managed
      * identity. Resolution + thread scoping run in the generated custom-auth
-     * handler (`buildManagedAuth`); this seam reserves the declaration for
-     * `runtime.serverInfo.principal` and memory namespacing.
+     * handler (`buildManagedAuth`); this seam reserves the declaration for the
+     * frozen `runtime.identity` envelope and memory namespacing.
      */
     identity?: IdentityDefinition;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "managed-deepagents",
-  "version": "0.6.2-dev.7",
+  "version": "0.6.2-dev.9",
   "description": "Managed Deep Agents — the `defineDeepAgent` authoring interface plus the CLI that compiles and deploys a code-first Deep Agent repository to a managed LangGraph runtime.",
   "keywords": [
     "langchain",
@@ -66,12 +66,12 @@
     "zod": "^4.4.3"
   },
   "optionalDependencies": {
-    "@langchain/managed-deepagents-darwin-arm64": "0.6.2-dev.7",
-    "@langchain/managed-deepagents-darwin-x64": "0.6.2-dev.7",
-    "@langchain/managed-deepagents-linux-arm64": "0.6.2-dev.7",
-    "@langchain/managed-deepagents-linux-x64": "0.6.2-dev.7",
-    "@langchain/managed-deepagents-win32-arm64": "0.6.2-dev.7",
-    "@langchain/managed-deepagents-win32-x64": "0.6.2-dev.7"
+    "@langchain/managed-deepagents-darwin-arm64": "0.6.2-dev.9",
+    "@langchain/managed-deepagents-darwin-x64": "0.6.2-dev.9",
+    "@langchain/managed-deepagents-linux-arm64": "0.6.2-dev.9",
+    "@langchain/managed-deepagents-linux-x64": "0.6.2-dev.9",
+    "@langchain/managed-deepagents-win32-arm64": "0.6.2-dev.9",
+    "@langchain/managed-deepagents-win32-x64": "0.6.2-dev.9"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",

package/dist/agent-auth.d.ts

@@ -1,104 +0,0 @@
-/**
- * Agent Auth client used by `credentials.get` and the pre-run credential gate.
- *
- * Talks to the shipped Agent Auth APIs (credentials + oauth-authorization-sessions),
- * not the aspirational `credentials/mint` endpoint.
- */
-export declare const AGENT_AUTH_TIMEOUT_MS = 10000;
-export declare const AGENT_AUTH_PROVIDER_PAGE_SIZE = 100;
-export declare const AGENT_AUTH_MAX_PROVIDER_PAGES = 20;
-export interface AgentAuthHttpConfig {
-    apiKey?: string;
-    workspaceId?: string;
-}
-/** Query string that addresses one credential by its natural key. */
-export declare function agentAuthCredentialQuery(options: {
-    ownerType: string;
-    ownerId: string;
-    kind: string;
-    slug: string;
-}): string;
-export declare function agentAuthHeaders(config: AgentAuthHttpConfig): Record<string, string>;
-/** One Agent Auth HTTP call: no redirects, bounded timeout, JSON body. */
-export declare function requestAgentAuthJson(options: {
-    url: string;
-    init?: Omit<RequestInit, "headers" | "signal">;
-    config: AgentAuthHttpConfig;
-    timeoutMs: number;
-    fetchImpl: typeof fetch;
-}): Promise<{
-    ok: boolean;
-    status: number;
-    body: Record<string, unknown>;
-}>;
-export interface AgentAuthContext {
-    baseUrl: string;
-    /** Deployment id, passed to oauth-authorization-sessions as `agent_id`. */
-    agentId: string;
-    /** Authenticated caller, used as `owner_id` for user credentials. */
-    principalId: string;
-    apiKey?: string;
-    workspaceId?: string;
-}
-/** One credential slug the caller has not granted, with its connect URL. */
-export interface PendingAuthorization {
-    slug: string;
-    connectUrl: string;
-    authId: string;
-}
-export declare class CredentialAuthorizationRequiredError extends Error {
-    readonly slugs: readonly string[];
-    readonly name = "CredentialAuthorizationRequiredError";
-    constructor(slugs: readonly string[]);
-}
-export declare class AgentAuthUnknownProviderError extends Error {
-    readonly slug: string;
-    readonly name = "AgentAuthUnknownProviderError";
-    constructor(slug: string);
-}
-/**
- * Agent Auth could not answer. Callers pass a fixed message: a response body
- * can quote secret material, so it never reaches this error.
- */
-export declare class CredentialStoreError extends Error {
-    readonly status?: number | undefined;
-    readonly name = "CredentialStoreError";
-    constructor(message: string, status?: number | undefined);
-}
-/**
- * Bound Agent Auth HTTP client. One instance per caller/run; headers, origin,
- * and the request timeout stay on the instance rather than each call site.
- */
-export declare class AgentAuth {
-    #private;
-    readonly context: AgentAuthContext;
-    constructor(context: AgentAuthContext, fetchImpl?: typeof fetch, timeoutMs?: number);
-    /**
-     * Read the caller's OAuth access token for a slug without starting a session.
-     *
-     * Reads never mint, so a caller can be probed repeatedly — on every replay of
-     * an interrupted node, for instance — without leaving authorization sessions
-     * behind.
-     *
-     * @returns The access token, or `undefined` when the caller must connect.
-     */
-    readUserAccessToken(slug: string): Promise<string | undefined>;
-    /**
-     * Start an OAuth authorization session for a slug the caller has not granted.
-     *
-     * @returns The pending session, including the user-facing connect URL.
-     */
-    startAuthorizationSession(slug: string): Promise<PendingAuthorization>;
-    /** oauth-providers has no slug filter, so the match is made across pages. */
-    resolveOAuthProviderId(slug: string): Promise<string>;
-    /** The credential key is `credential_id`, never `id`. */
-    findCredentialId(options: {
-        ownerType: string;
-        ownerId: string;
-        kind: string;
-        slug: string;
-    }): Promise<string | undefined>;
-    /** @returns The secret, or `undefined` when Agent Auth has no value (404). */
-    readSecret(credentialId: string): Promise<string | undefined>;
-}
-//# sourceMappingURL=agent-auth.d.ts.map

package/dist/agent-auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-auth.d.ts","sourceRoot":"","sources":["../src/agent-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAC5C,eAAO,MAAM,6BAA6B,MAAM,CAAC;AACjD,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qEAAqE;AACrE,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,MAAM,CAOT;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,mBAAmB,GAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAexB;AAED,0EAA0E;AAC1E,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,QAAQ,CAAC,CAAC;IAC/C,MAAM,EAAE,mBAAmB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,KAAK,CAAC;CACzB,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC,CAoBD;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,oCAAqC,SAAQ,KAAK;IAGjD,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE;IAF7C,QAAQ,CAAC,IAAI,0CAA0C;IAEvD,YAAqB,KAAK,EAAE,SAAS,MAAM,EAAE,EAK5C;CACF;AAED,qBAAa,6BAA8B,SAAQ,KAAK;IAG1C,QAAQ,CAAC,IAAI,EAAE,MAAM;IAFjC,QAAQ,CAAC,IAAI,mCAAmC;IAEhD,YAAqB,IAAI,EAAE,MAAM,EAKhC;CACF;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAK3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;IAJ1B,QAAQ,CAAC,IAAI,0BAA0B;IAEvC,YACE,OAAO,EAAE,MAAM,EACN,MAAM,CAAC,EAAE,MAAM,YAAA,EAGzB;CACF;AAOD;;;GAGG;AACH,qBAAa,SAAS;;IACpB,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IAInC,YACE,OAAO,EAAE,gBAAgB,EACzB,SAAS,GAAE,OAAO,KAAa,EAC/B,SAAS,SAAwB,EAKlC;IAED;;;;;;;;OAQG;IACG,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CASnE;IAED;;;;OAIG;IACG,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA2B3E;IAED,6EAA6E;IACvE,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAoC1D;IAED,yDAAyD;IACnD,gBAAgB,CAAC,OAAO,EAAE;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAc9B;IAED,8EAA8E;IACxE,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAalE;CAqCF"}

package/dist/agent-auth.js

@@ -1,224 +0,0 @@
-/**
- * Agent Auth client used by `credentials.get` and the pre-run credential gate.
- *
- * Talks to the shipped Agent Auth APIs (credentials + oauth-authorization-sessions),
- * not the aspirational `credentials/mint` endpoint.
- */
-import { fetchWithTimeout } from "./runtime/http.js";
-export const AGENT_AUTH_TIMEOUT_MS = 10_000;
-export const AGENT_AUTH_PROVIDER_PAGE_SIZE = 100;
-export const AGENT_AUTH_MAX_PROVIDER_PAGES = 20;
-/** Query string that addresses one credential by its natural key. */
-export function agentAuthCredentialQuery(options) {
-    return new URLSearchParams({
-        owner_type: options.ownerType,
-        owner_id: options.ownerId,
-        kind: options.kind,
-        slug: options.slug,
-    }).toString();
-}
-export function agentAuthHeaders(config) {
-    const headers = {
-        accept: "application/json",
-        "content-type": "application/json",
-        "x-langsmith-product": "mda",
-    };
-    const apiKey = config.apiKey?.trim();
-    if (apiKey) {
-        headers["x-api-key"] = apiKey;
-    }
-    const workspaceId = config.workspaceId?.trim();
-    if (workspaceId) {
-        headers["x-tenant-id"] = workspaceId;
-    }
-    return headers;
-}
-/** One Agent Auth HTTP call: no redirects, bounded timeout, JSON body. */
-export async function requestAgentAuthJson(options) {
-    const response = await fetchWithTimeout(options.url, {
-        ...options.init,
-        redirect: "error",
-        headers: agentAuthHeaders(options.config),
-    }, options.timeoutMs, options.fetchImpl);
-    const decoded = await response.json().catch(() => ({}));
-    return {
-        ok: response.ok,
-        status: response.status,
-        body: decoded && typeof decoded === "object"
-            ? decoded
-            : {},
-    };
-}
-export class CredentialAuthorizationRequiredError extends Error {
-    slugs;
-    name = "CredentialAuthorizationRequiredError";
-    constructor(slugs) {
-        super(`the caller has not connected: ${slugs.join(", ")}. ` +
-            "Declare the credential on a connector so the pre-run gate can request it.");
-        this.slugs = slugs;
-    }
-}
-export class AgentAuthUnknownProviderError extends Error {
-    slug;
-    name = "AgentAuthUnknownProviderError";
-    constructor(slug) {
-        super(`Agent Auth has no OAuth provider registered for slug "${slug}". ` +
-            "Register the provider or fix the credential slug.");
-        this.slug = slug;
-    }
-}
-/**
- * Agent Auth could not answer. Callers pass a fixed message: a response body
- * can quote secret material, so it never reaches this error.
- */
-export class CredentialStoreError extends Error {
-    status;
-    name = "CredentialStoreError";
-    constructor(message, status) {
-        super(status === undefined ? message : `${message} (status ${status})`);
-        this.status = status;
-    }
-}
-/**
- * Bound Agent Auth HTTP client. One instance per caller/run; headers, origin,
- * and the request timeout stay on the instance rather than each call site.
- */
-export class AgentAuth {
-    context;
-    #fetchImpl;
-    #timeoutMs;
-    constructor(context, fetchImpl = fetch, timeoutMs = AGENT_AUTH_TIMEOUT_MS) {
-        this.context = context;
-        this.#fetchImpl = fetchImpl;
-        this.#timeoutMs = timeoutMs;
-    }
-    /**
-     * Read the caller's OAuth access token for a slug without starting a session.
-     *
-     * Reads never mint, so a caller can be probed repeatedly — on every replay of
-     * an interrupted node, for instance — without leaving authorization sessions
-     * behind.
-     *
-     * @returns The access token, or `undefined` when the caller must connect.
-     */
-    async readUserAccessToken(slug) {
-        const credentialId = await this.findCredentialId({
-            ownerType: "user",
-            ownerId: this.context.principalId,
-            kind: "oauth2",
-            slug,
-        });
-        if (!credentialId)
-            return undefined;
-        return await this.#fetchAccessToken(credentialId);
-    }
-    /**
-     * Start an OAuth authorization session for a slug the caller has not granted.
-     *
-     * @returns The pending session, including the user-facing connect URL.
-     */
-    async startAuthorizationSession(slug) {
-        const providerId = await this.resolveOAuthProviderId(slug);
-        const { ok, status, body } = await this.#request("/v1/agent-auth/oauth-authorization-sessions", {
-            method: "POST",
-            body: JSON.stringify({
-                provider_id: providerId,
-                principal_id: this.context.principalId,
-                agent_id: this.context.agentId,
-            }),
-        });
-        if (!ok) {
-            throw new CredentialStoreError("Agent Auth create oauth-authorization-session failed", status);
-        }
-        const authId = String(body.id ?? "");
-        const connectUrl = String(body.verification_url ?? "");
-        if (!authId || !connectUrl) {
-            throw new CredentialStoreError("Agent Auth oauth-authorization-session missing id or verification_url");
-        }
-        return { slug, connectUrl, authId };
-    }
-    /** oauth-providers has no slug filter, so the match is made across pages. */
-    async resolveOAuthProviderId(slug) {
-        let cursor;
-        for (let page = 0; page < AGENT_AUTH_MAX_PROVIDER_PAGES; page += 1) {
-            const params = new URLSearchParams({
-                page_size: String(AGENT_AUTH_PROVIDER_PAGE_SIZE),
-            });
-            if (cursor)
-                params.set("cursor", cursor);
-            const { ok, status, body } = await this.#request(`/v1/agent-auth/oauth-providers?${params.toString()}`, { method: "GET" });
-            if (!ok) {
-                throw new CredentialStoreError("Agent Auth list oauth-providers failed", status);
-            }
-            const items = Array.isArray(body.items) ? body.items : [];
-            const match = items.find((item) => !!item &&
-                typeof item === "object" &&
-                String(item.slug) === slug);
-            if (match?.id) {
-                return String(match.id);
-            }
-            const next = body.next_cursor;
-            if (typeof next !== "string" || !next || next === cursor) {
-                throw new AgentAuthUnknownProviderError(slug);
-            }
-            cursor = next;
-        }
-        throw new CredentialStoreError("Agent Auth oauth-provider list returned too many pages");
-    }
-    /** The credential key is `credential_id`, never `id`. */
-    async findCredentialId(options) {
-        const { ok, status, body } = await this.#request(`/v1/agent-auth/credentials?${agentAuthCredentialQuery(options)}`, { method: "GET" });
-        if (!ok) {
-            throw new CredentialStoreError("Agent Auth list credentials failed", status);
-        }
-        const [row] = Array.isArray(body.items) ? body.items : [];
-        const id = row?.credential_id;
-        return typeof id === "string" ? id : undefined;
-    }
-    /** @returns The secret, or `undefined` when Agent Auth has no value (404). */
-    async readSecret(credentialId) {
-        const { ok, status, body } = await this.#request(`/v1/agent-auth/credentials/${encodeURIComponent(credentialId)}/secret`, { method: "GET" });
-        if (status === 404) {
-            return undefined;
-        }
-        if (!ok) {
-            throw new CredentialStoreError("Agent Auth get secret failed", status);
-        }
-        const secret = body.secret;
-        return typeof secret === "string" && secret.length > 0 ? secret : undefined;
-    }
-    async #fetchAccessToken(credentialId) {
-        const { ok, status, body } = await this.#request(`/v1/agent-auth/credentials/${encodeURIComponent(credentialId)}/oauth2`, { method: "GET" });
-        if (isAuthorizationRequired(status, body)) {
-            return undefined;
-        }
-        if (!ok) {
-            throw new CredentialStoreError("Agent Auth get oauth2 failed", status);
-        }
-        const oauth2 = body.oauth2 && typeof body.oauth2 === "object"
-            ? body.oauth2
-            : body;
-        const token = oauth2.access_token;
-        return typeof token === "string" && token ? token : undefined;
-    }
-    async #request(path, init = {}) {
-        return await requestAgentAuthJson({
-            url: `${this.context.baseUrl}${path}`,
-            init,
-            config: this.context,
-            timeoutMs: this.#timeoutMs,
-            fetchImpl: this.#fetchImpl,
-        });
-    }
-}
-/** Agent Auth answers 409 when a stored grant has lapsed and needs re-auth. */
-function isAuthorizationRequired(status, body) {
-    if (status !== 409) {
-        return false;
-    }
-    const detail = String(body.detail ?? body.title ?? body.error ?? "").toLowerCase();
-    return (body.error === "authorization_required" ||
-        detail.includes("authorization is required") ||
-        detail.includes("oauth authorization"));
-}
-//# sourceMappingURL=agent-auth.js.map