managed-deepagents 0.6.2-dev.8 → 0.7.0

package/dist/connections.d.ts

@@ -0,0 +1,98 @@
+/**
+ * `connections.get(...)` — read a managed connection from a tool.
+ *
+ * `{ type: "agent" }` resolves material owned by the current deployment.
+ * `{ type: "user" }` resolves per-caller grants (OAuth or opaque). Resolution
+ * reads Agent Auth on every await and never caches material.
+ *
+ * `mda dev` substitutes local values for agent opaque secrets via `MDA_DEV_*`.
+ * User-owned connections talk to Agent Auth in every environment (including
+ * `mda dev`) after resolving the caller's Agent Auth principal. Missing grants
+ * interrupt at the point of access, including calls from custom tools and
+ * middleware.
+ */
+import type { RuntimeIdentity } from "./identity/index.js";
+import { CredentialStoreError, type AgentAuthContext } from "./agent-auth.js";
+export { AGENT_AUTH_TIMEOUT_MS, AgentAuthUnknownProviderError, clearPrincipalResolveCacheForTests, CredentialAuthorizationRequiredError, CredentialStoreError, } from "./agent-auth.js";
+export type { AgentAuthContext, PendingAuthorization, ResolvePrincipalIdentity, } from "./agent-auth.js";
+export type AgentConnectionOwner = {
+    type: "agent";
+};
+export type UserConnectionOwner = {
+    type: "user";
+    id?: string;
+};
+export type ConnectionOwner = AgentConnectionOwner | UserConnectionOwner;
+export interface ConnectionRequest {
+    slug: string;
+    owner: ConnectionOwner;
+    identity?: RuntimeIdentity;
+}
+declare const CONNECTION_REFERENCE: unique symbol;
+export declare class ConnectionNotFoundError extends Error {
+    readonly slug: string;
+    readonly ownerType: ConnectionOwner["type"];
+    constructor(slug: string, ownerType: ConnectionOwner["type"]);
+}
+/** `LANGSMITH_ENDPOINT` is missing a usable Agent Auth origin. */
+export declare class InvalidAgentAuthEndpointError extends CredentialStoreError {
+    readonly name = "InvalidAgentAuthEndpointError";
+    constructor();
+}
+export declare class ConnectionReference implements PromiseLike<string> {
+    readonly slug: string;
+    readonly owner: ConnectionOwner;
+    private readonly accessor;
+    readonly [CONNECTION_REFERENCE] = true;
+    constructor(slug: string, owner: ConnectionOwner, accessor: Connections);
+    then<TResult1 = string, TResult2 = never>(onfulfilled?: ((value: string) => TResult1 | PromiseLike<TResult1>) | null, onrejected?: ((reason: unknown) => TResult2 | PromiseLike<TResult2>) | null): PromiseLike<TResult1 | TResult2>;
+}
+export declare function isConnectionReference(value: unknown): value is ConnectionReference;
+export interface AgentAuthConfig {
+    baseUrl: string;
+    apiKey: string;
+    deploymentId?: string;
+    workspaceId?: string;
+    localDevPrincipalId?: string;
+}
+export declare class AgentAuthConnectionStore {
+    private readonly env;
+    private readonly fetchImpl;
+    private readonly timeoutMs;
+    constructor(env?: NodeJS.ProcessEnv, fetchImpl?: typeof fetch, timeoutMs?: number);
+    fetch(request: ConnectionRequest): Promise<string | undefined>;
+}
+export declare class Connections {
+    private readonly store;
+    constructor(store?: AgentAuthConnectionStore);
+    get(slug: string, owner: ConnectionOwner): ConnectionReference;
+    resolve(slug: string, owner: ConnectionOwner): Promise<string>;
+    resolveDeploymentSecret(slug: string): Promise<string>;
+}
+export declare function agentConnectionEnvKey(slug: string): string;
+export declare function resolveOwnerId(owner: ConnectionOwner, identity: RuntimeIdentity | undefined, deploymentId: string | undefined): string;
+/**
+ * Build Agent Auth context for user-owned credential ops (gate + connections).
+ *
+ * Resolves the Agent Auth principal UUID from channel stamps or
+ * `POST /v1/agent-auth/principals`. Works under `mda dev` when workspace
+ * Agent Auth env is configured; does not require `LANGSMITH_HOST_PROJECT_ID`.
+ */
+export declare function resolveAgentAuthContext(identity: RuntimeIdentity | undefined, env?: NodeJS.ProcessEnv, fetchImpl?: typeof fetch, timeoutMs?: number): Promise<AgentAuthContext>;
+/**
+ * Map a runtime identity to the Agent Auth principal used for user grants.
+ *
+ * 1. Channel `identity_context` → already-resolved UUID
+ * 2. Validated-token → resolve `(provider, iss, subject)`
+ * 3. Trusted backend / other person → resolve `trusted_backend` + workspace
+ */
+export declare function resolveCredentialPrincipalId(identity: RuntimeIdentity | undefined, config: AgentAuthConfig, fetchImpl?: typeof fetch, timeoutMs?: number): Promise<string>;
+/**
+ * Origin for Agent Auth HTTP calls from `LANGSMITH_ENDPOINT`.
+ *
+ * Cloud SaaS revisions omit that reserved name and inject `LANGCHAIN_ENDPOINT`
+ * instead; read it as the same setting so we do not default to production.
+ */
+export declare function resolveAgentAuthBaseUrl(env?: NodeJS.ProcessEnv): string;
+export declare const connections: Connections;
+//# sourceMappingURL=connections.d.ts.map

package/dist/connections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAIL,oBAAoB,EACpB,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AAOzB,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,kCAAkC,EAClC,oCAAoC,EACpC,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,oBAAoB,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AACrD,MAAM,MAAM,mBAAmB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,mBAAmB,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED,QAAA,MAAM,oBAAoB,eAA0C,CAAC;AASrE,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAE5C,YAAY,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,EAK3D;CACF;AAED,kEAAkE;AAClE,qBAAa,6BAA8B,SAAQ,oBAAoB;IACrE,SAAkB,IAAI,mCAAmC;IAEzD,cAIC;CACF;AAED,qBAAa,mBAAoB,YAAW,WAAW,CAAC,MAAM,CAAC;IAI3D,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,KAAK,EAAE,eAAe;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAL3B,QAAQ,CAAC,CAAC,oBAAoB,CAAC,QAAQ;IAEvC,YACW,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,eAAe,EACd,QAAQ,EAAE,WAAW,EACpC;IAEJ,IAAI,CAAC,QAAQ,GAAG,MAAM,EAAE,QAAQ,GAAG,KAAK,EACtC,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,EAC1E,UAAU,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,KAAK,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,GAC1E,WAAW,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAIlC;CACF;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,mBAAmB,CAO9B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,qBAAa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAH5B,YACmB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,SAAS,GAAE,OAAO,KAAa,EAC/B,SAAS,SAAwB,EAChD;IAEE,KAAK,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAgEnE;CACF;AAED,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IADxB,YACmB,KAAK,GAAE,wBAAyD,EAC/E;IAEJ,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,mBAAmB,CAM7D;IAEK,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBnE;IAEK,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS3D;CACF;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI1D;AA+CD,wBAAgB,cAAc,CAC5B,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,MAAM,CAqBR;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,SAAS,GAAE,OAAO,KAAa,EAC/B,SAAS,SAAwB,GAChC,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,MAAM,EAAE,eAAe,EACvB,SAAS,GAAE,OAAO,KAAa,EAC/B,SAAS,SAAwB,GAChC,OAAO,CAAC,MAAM,CAAC,CA2CjB;AAqDD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAuBR;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}

package/dist/connections.js

@@ -0,0 +1,339 @@
+/**
+ * `connections.get(...)` — read a managed connection from a tool.
+ *
+ * `{ type: "agent" }` resolves material owned by the current deployment.
+ * `{ type: "user" }` resolves per-caller grants (OAuth or opaque). Resolution
+ * reads Agent Auth on every await and never caches material.
+ *
+ * `mda dev` substitutes local values for agent opaque secrets via `MDA_DEV_*`.
+ * User-owned connections talk to Agent Auth in every environment (including
+ * `mda dev`) after resolving the caller's Agent Auth principal. Missing grants
+ * interrupt at the point of access, including calls from custom tools and
+ * middleware.
+ */
+import { AGENT_AUTH_TIMEOUT_MS, AgentAuth, CredentialAuthorizationRequiredError, CredentialStoreError, } from "./agent-auth.js";
+import { buildRuntimeIdentity, resolveRuntimeConfigurable, } from "./runtime/identity-runtime.js";
+import { resolveUserConnectionGrants } from "./connection-authorization.js";
+export { AGENT_AUTH_TIMEOUT_MS, AgentAuthUnknownProviderError, clearPrincipalResolveCacheForTests, CredentialAuthorizationRequiredError, CredentialStoreError, } from "./agent-auth.js";
+const CONNECTION_REFERENCE = Symbol("managed-deepagents.connection");
+const SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const MAX_SLUG_LENGTH = 64;
+const DEFAULT_LANGSMITH_ENDPOINT = "https://api.smith.langchain.com";
+const DEV_CREDENTIAL_PREFIX = "MDA_DEV_";
+const TRUSTED_BACKEND_PROVIDER = "trusted_backend";
+const LOCAL_DEV_USER = "mda:local-dev";
+const LOCAL_DEV_PRINCIPAL_ENV = "MDA_AGENT_AUTH_PRINCIPAL_ID";
+export class ConnectionNotFoundError extends Error {
+    slug;
+    ownerType;
+    constructor(slug, ownerType) {
+        super(`no ${ownerType} connection is set for slug ${JSON.stringify(slug)}`);
+        this.name = "ConnectionNotFoundError";
+        this.slug = slug;
+        this.ownerType = ownerType;
+    }
+}
+/** `LANGSMITH_ENDPOINT` is missing a usable Agent Auth origin. */
+export class InvalidAgentAuthEndpointError extends CredentialStoreError {
+    name = "InvalidAgentAuthEndpointError";
+    constructor() {
+        super("LangSmith Agent Auth endpoint is not a valid URL (set LANGSMITH_ENDPOINT)");
+    }
+}
+export class ConnectionReference {
+    slug;
+    owner;
+    accessor;
+    [CONNECTION_REFERENCE] = true;
+    constructor(slug, owner, accessor) {
+        this.slug = slug;
+        this.owner = owner;
+        this.accessor = accessor;
+    }
+    then(onfulfilled, onrejected) {
+        return this.accessor
+            .resolve(this.slug, this.owner)
+            .then(onfulfilled, onrejected);
+    }
+}
+export function isConnectionReference(value) {
+    return (value instanceof ConnectionReference ||
+        (typeof value === "object" &&
+            value !== null &&
+            CONNECTION_REFERENCE in value));
+}
+export class AgentAuthConnectionStore {
+    env;
+    fetchImpl;
+    timeoutMs;
+    constructor(env = process.env, fetchImpl = fetch, timeoutMs = AGENT_AUTH_TIMEOUT_MS) {
+        this.env = env;
+        this.fetchImpl = fetchImpl;
+        this.timeoutMs = timeoutMs;
+    }
+    async fetch(request) {
+        if (this.env.MDA_LOCAL_DEV === "1" && request.owner.type === "agent") {
+            const value = this.env[agentConnectionEnvKey(request.slug)];
+            if (value !== undefined && value.trim()) {
+                return value;
+            }
+            throw new CredentialStoreError(`local agent connection ${JSON.stringify(request.slug)} is not configured; ` +
+                `set ${agentConnectionEnvKey(request.slug)}`);
+        }
+        const config = resolveAgentAuthConfig(this.env);
+        if (request.owner.type === "agent" && !config.deploymentId) {
+            throw new CredentialStoreError("connections are not configured: LANGSMITH_HOST_PROJECT_ID is not set");
+        }
+        const principalId = request.owner.type === "user"
+            ? await resolveCredentialPrincipalId(request.identity, config, this.fetchImpl, this.timeoutMs)
+            : resolveOwnerId(request.owner, request.identity, config.deploymentId);
+        // Owner id match still uses the source identity (JWT sub / channel actor).
+        if (request.owner.type === "user") {
+            resolveOwnerId(request.owner, request.identity, config.deploymentId);
+        }
+        const client = new AgentAuth({
+            baseUrl: config.baseUrl,
+            agentId: config.deploymentId,
+            principalId,
+            apiKey: config.apiKey,
+            workspaceId: config.workspaceId,
+        }, this.fetchImpl, this.timeoutMs);
+        if (request.owner.type === "user") {
+            return (await resolveUserConnectionGrants(client, [request.slug])).get(request.slug);
+        }
+        const row = await client.findWorkspaceConnection(request.slug);
+        if (!row) {
+            return undefined;
+        }
+        if (row.kind === "secret") {
+            const credentialId = await client.findSecretCredentialId(row, request.slug);
+            if (!credentialId) {
+                return undefined;
+            }
+            return await client.readSecret(credentialId);
+        }
+        if (row.kind === "oauth2") {
+            return await client.readAgentAccessTokenForConnection(row);
+        }
+        return undefined;
+    }
+}
+export class Connections {
+    store;
+    constructor(store = new AgentAuthConnectionStore()) {
+        this.store = store;
+    }
+    get(slug, owner) {
+        return new ConnectionReference(normalizeSlug(slug), normalizeOwner(owner), this);
+    }
+    async resolve(slug, owner) {
+        const configurable = resolveRuntimeConfigurable(undefined);
+        if (!configurable) {
+            throw new Error("connections.get(...) must be awaited inside a run: resolve a connection in a tool or middleware, not at import time");
+        }
+        const value = await this.store.fetch({
+            slug,
+            owner,
+            identity: buildRuntimeIdentity(configurable),
+        });
+        if (value === undefined) {
+            throw owner.type === "user"
+                ? new CredentialAuthorizationRequiredError([slug])
+                : new ConnectionNotFoundError(slug, owner.type);
+        }
+        return value;
+    }
+    async resolveDeploymentSecret(slug) {
+        const value = await this.store.fetch({
+            slug,
+            owner: { type: "agent" },
+        });
+        if (value === undefined) {
+            throw new ConnectionNotFoundError(slug, "agent");
+        }
+        return value;
+    }
+}
+export function agentConnectionEnvKey(slug) {
+    return `${DEV_CREDENTIAL_PREFIX}${normalizeSlug(slug)
+        .toUpperCase()
+        .replaceAll("-", "_")}`;
+}
+function normalizeSlug(slug) {
+    if (typeof slug !== "string") {
+        throw new TypeError("connection slug must be a string");
+    }
+    const canonical = slug.trim();
+    if (!canonical ||
+        canonical.length > MAX_SLUG_LENGTH ||
+        !SLUG_PATTERN.test(canonical)) {
+        throw new TypeError(`connection slug ${JSON.stringify(slug)} is invalid: use lowercase letters, digits, and single hyphens, at most ${MAX_SLUG_LENGTH} characters`);
+    }
+    return canonical;
+}
+function normalizeOwner(owner) {
+    if (!owner || typeof owner !== "object") {
+        throw new TypeError('connection owner is required: pass { type: "agent" } or { type: "user" }');
+    }
+    const keys = Object.keys(owner);
+    if (keys.some((key) => key !== "type" && key !== "id")) {
+        throw new TypeError("connection owner has an unknown key");
+    }
+    if (owner.type === "agent") {
+        if ("id" in owner) {
+            throw new TypeError('connection owner "id" is not accepted for { type: "agent" }');
+        }
+        return { type: "agent" };
+    }
+    if (owner.type === "user") {
+        if (owner.id === undefined)
+            return { type: "user" };
+        if (typeof owner.id !== "string" || !owner.id.trim()) {
+            throw new TypeError('connection owner "id" must be a non-empty string');
+        }
+        return { type: "user", id: owner.id.trim() };
+    }
+    throw new TypeError("connection owner type is not supported");
+}
+export function resolveOwnerId(owner, identity, deploymentId) {
+    if (owner.type === "user") {
+        const authenticated = identity?.user.id;
+        if (!authenticated) {
+            throw new CredentialStoreError("user connections require an authenticated user principal");
+        }
+        if (owner.id !== undefined && owner.id !== authenticated) {
+            throw new CredentialStoreError("user connection owner id must match the authenticated principal");
+        }
+        return authenticated;
+    }
+    if (!deploymentId) {
+        throw new CredentialStoreError("connections are not configured: LANGSMITH_HOST_PROJECT_ID is not set");
+    }
+    return deploymentId;
+}
+/**
+ * Build Agent Auth context for user-owned credential ops (gate + connections).
+ *
+ * Resolves the Agent Auth principal UUID from channel stamps or
+ * `POST /v1/agent-auth/principals`. Works under `mda dev` when workspace
+ * Agent Auth env is configured; does not require `LANGSMITH_HOST_PROJECT_ID`.
+ */
+export async function resolveAgentAuthContext(identity, env = process.env, fetchImpl = fetch, timeoutMs = AGENT_AUTH_TIMEOUT_MS) {
+    const config = resolveAgentAuthConfig(env);
+    const principalId = await resolveCredentialPrincipalId(identity, config, fetchImpl, timeoutMs);
+    return {
+        baseUrl: config.baseUrl,
+        agentId: config.deploymentId,
+        principalId,
+        apiKey: config.apiKey,
+        workspaceId: config.workspaceId,
+    };
+}
+/**
+ * Map a runtime identity to the Agent Auth principal used for user grants.
+ *
+ * 1. Channel `identity_context` → already-resolved UUID
+ * 2. Validated-token → resolve `(provider, iss, subject)`
+ * 3. Trusted backend / other person → resolve `trusted_backend` + workspace
+ */
+export async function resolveCredentialPrincipalId(identity, config, fetchImpl = fetch, timeoutMs = AGENT_AUTH_TIMEOUT_MS) {
+    if (!identity?.user.id) {
+        throw new CredentialStoreError("user connections require an authenticated user principal");
+    }
+    if (identity.user.kind === "service") {
+        if (identity.user.id === LOCAL_DEV_USER &&
+            config.localDevPrincipalId?.trim()) {
+            return config.localDevPrincipalId.trim();
+        }
+        throw new CredentialStoreError("user-owned connections require a person principal; " +
+            "Studio and other service callers cannot own OAuth grants");
+    }
+    if (identity.agentAuthPrincipalId?.trim()) {
+        return identity.agentAuthPrincipalId.trim();
+    }
+    const subject = identity.user.id.trim();
+    const external = externalIdentityForResolve(identity, config.workspaceId);
+    if (!external) {
+        throw new CredentialStoreError("user-owned connections need a resolvable identity " +
+            "(validated-token issuer/subject, channel identity_context, or trusted backend)");
+    }
+    const bootstrap = new AgentAuth({
+        baseUrl: config.baseUrl,
+        principalId: subject,
+        apiKey: config.apiKey,
+        workspaceId: config.workspaceId,
+        agentId: config.deploymentId,
+    }, fetchImpl, timeoutMs);
+    return await bootstrap.resolvePrincipal(external);
+}
+function externalIdentityForResolve(identity, workspaceId) {
+    const provider = identity.identityProvider?.trim();
+    const issuer = identity.identityIssuer?.trim();
+    const subject = identity.identitySubject?.trim();
+    if (provider && issuer && subject) {
+        return { provider, issuer, subject };
+    }
+    // Trusted-backend and other person principals without OIDC stamps.
+    const trustedSubject = identity.user.id.trim();
+    if (!trustedSubject) {
+        return undefined;
+    }
+    const workspace = workspaceId?.trim();
+    if (!workspace) {
+        return undefined;
+    }
+    return {
+        provider: TRUSTED_BACKEND_PROVIDER,
+        issuer: workspace,
+        subject: trustedSubject,
+    };
+}
+function resolveAgentAuthConfig(env) {
+    const apiKey = env.LANGSMITH_API_KEY?.trim();
+    if (!apiKey) {
+        throw new CredentialStoreError("connections are not configured: LANGSMITH_API_KEY is not set");
+    }
+    const workspaceId = env.LANGSMITH_WORKSPACE_ID?.trim();
+    if (!workspaceId) {
+        throw new CredentialStoreError("connections are not configured: LANGSMITH_WORKSPACE_ID is not set");
+    }
+    return {
+        baseUrl: resolveAgentAuthBaseUrl(env),
+        apiKey,
+        deploymentId: env.LANGSMITH_HOST_PROJECT_ID?.trim() || undefined,
+        workspaceId,
+        localDevPrincipalId: env.MDA_LOCAL_DEV === "1"
+            ? env[LOCAL_DEV_PRINCIPAL_ENV]?.trim() || undefined
+            : undefined,
+    };
+}
+/**
+ * Origin for Agent Auth HTTP calls from `LANGSMITH_ENDPOINT`.
+ *
+ * Cloud SaaS revisions omit that reserved name and inject `LANGCHAIN_ENDPOINT`
+ * instead; read it as the same setting so we do not default to production.
+ */
+export function resolveAgentAuthBaseUrl(env = process.env) {
+    const raw = env.LANGSMITH_ENDPOINT?.trim() ||
+        env.LANGCHAIN_ENDPOINT?.trim() ||
+        DEFAULT_LANGSMITH_ENDPOINT;
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new InvalidAgentAuthEndpointError();
+    }
+    if (!["http:", "https:"].includes(parsed.protocol) ||
+        !parsed.hostname ||
+        parsed.username ||
+        parsed.password ||
+        (parsed.pathname !== "/" && parsed.pathname !== "") ||
+        parsed.search ||
+        parsed.hash) {
+        throw new InvalidAgentAuthEndpointError();
+    }
+    return parsed.origin;
+}
+export const connections = new Connections();
+//# sourceMappingURL=connections.js.map

package/dist/connections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connections.js","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EACL,qBAAqB,EACrB,SAAS,EACT,oCAAoC,EACpC,oBAAoB,GAErB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAE5E,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,kCAAkC,EAClC,oCAAoC,EACpC,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AAiBzB,MAAM,oBAAoB,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;AACrE,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAClD,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,0BAA0B,GAAG,iCAAiC,CAAC;AACrE,MAAM,qBAAqB,GAAG,UAAU,CAAC;AACzC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;AACnD,MAAM,cAAc,GAAG,eAAe,CAAC;AACvC,MAAM,uBAAuB,GAAG,6BAA6B,CAAC;AAE9D,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,CAAS;IACb,SAAS,CAA0B;IAE5C,YAAY,IAAY,EAAE,SAAkC;QAC1D,KAAK,CAAC,MAAM,SAAS,+BAA+B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,kEAAkE;AAClE,MAAM,OAAO,6BAA8B,SAAQ,oBAAoB;IACnD,IAAI,GAAG,+BAA+B,CAAC;IAEzD;QACE,KAAK,CACH,2EAA2E,CAC5E,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,mBAAmB;IAInB,IAAI;IACJ,KAAK;IACG,QAAQ;IALlB,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC;IAEvC,YACW,IAAY,EACZ,KAAsB,EACd,QAAqB;oBAF7B,IAAI;qBACJ,KAAK;wBACG,QAAQ;IACxB,CAAC;IAEJ,IAAI,CACF,WAA0E,EAC1E,UAA2E;QAE3E,OAAO,IAAI,CAAC,QAAQ;aACjB,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;aAC9B,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACnC,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAc;IAEd,OAAO,CACL,KAAK,YAAY,mBAAmB;QACpC,CAAC,OAAO,KAAK,KAAK,QAAQ;YACxB,KAAK,KAAK,IAAI;YACd,oBAAoB,IAAI,KAAK,CAAC,CACjC,CAAC;AACJ,CAAC;AAUD,MAAM,OAAO,wBAAwB;IAEhB,GAAG;IACH,SAAS;IACT,SAAS;IAH5B,YACmB,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,SAAS,GAAiB,KAAK,EAC/B,SAAS,GAAG,qBAAqB;mBAFjC,GAAG;yBACH,SAAS;yBACT,SAAS;IACzB,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,OAA0B;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,aAAa,KAAK,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACrE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBACxC,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;gBAC1E,OAAO,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC3D,MAAM,IAAI,oBAAoB,CAC5B,sEAAsE,CACvE,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GACf,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;YAC3B,CAAC,CAAC,MAAM,4BAA4B,CAChC,OAAO,CAAC,QAAQ,EAChB,MAAM,EACN,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACf;YACH,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC3E,2EAA2E;QAC3E,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAClC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B;YACE,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,YAAY;YAC5B,WAAW;YACX,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,EACD,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACf,CAAC;QACF,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,CAAC,MAAM,2BAA2B,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CACpE,OAAO,CAAC,IAAI,CACb,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,sBAAsB,CACtD,GAAG,EACH,OAAO,CAAC,IAAI,CACb,CAAC;YACF,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,MAAM,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,MAAM,MAAM,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,WAAW;IAEH,KAAK;IADxB,YACmB,KAAK,GAA6B,IAAI,wBAAwB,EAAE;qBAAhE,KAAK;IACrB,CAAC;IAEJ,GAAG,CAAC,IAAY,EAAE,KAAsB;QACtC,OAAO,IAAI,mBAAmB,CAC5B,aAAa,CAAC,IAAI,CAAC,EACnB,cAAc,CAAC,KAAK,CAAC,EACrB,IAAI,CACL,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,KAAsB;QAChD,MAAM,YAAY,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,qHAAqH,CACtH,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YACnC,IAAI;YACJ,KAAK;YACL,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC;SAC7C,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,KAAK,CAAC,IAAI,KAAK,MAAM;gBACzB,CAAC,CAAC,IAAI,oCAAoC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAClD,CAAC,CAAC,IAAI,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,IAAY;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YACnC,IAAI;YACJ,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SACzB,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,GAAG,qBAAqB,GAAG,aAAa,CAAC,IAAI,CAAC;SAClD,WAAW,EAAE;SACb,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9B,IACE,CAAC,SAAS;QACV,SAAS,CAAC,MAAM,GAAG,eAAe;QAClC,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAC7B,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2EAA2E,eAAe,aAAa,CAC/I,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,KAAsB;IAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,SAAS,CACjB,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,SAAS,CACjB,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACpD,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;IAC/C,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAsB,EACtB,QAAqC,EACrC,YAAgC;IAEhC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,oBAAoB,CAC5B,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS,IAAI,KAAK,CAAC,EAAE,KAAK,aAAa,EAAE,CAAC;YACzD,MAAM,IAAI,oBAAoB,CAC5B,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,oBAAoB,CAC5B,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAqC,EACrC,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,SAAS,GAAiB,KAAK,EAC/B,SAAS,GAAG,qBAAqB;IAEjC,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,MAAM,4BAA4B,CACpD,QAAQ,EACR,MAAM,EACN,SAAS,EACT,SAAS,CACV,CAAC;IACF,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,YAAY;QAC5B,WAAW;QACX,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,QAAqC,EACrC,MAAuB,EACvB,SAAS,GAAiB,KAAK,EAC/B,SAAS,GAAG,qBAAqB;IAEjC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,oBAAoB,CAC5B,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACrC,IACE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,cAAc;YACnC,MAAM,CAAC,mBAAmB,EAAE,IAAI,EAAE,EAClC,CAAC;YACD,OAAO,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,qDAAqD;YACnD,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,oBAAoB,EAAE,IAAI,EAAE,EAAE,CAAC;QAC1C,OAAO,QAAQ,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,oBAAoB,CAC5B,oDAAoD;YAClD,gFAAgF,CACnF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,SAAS,CAC7B;QACE,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,OAAO;QACpB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,YAAY;KAC7B,EACD,SAAS,EACT,SAAS,CACV,CAAC;IACF,OAAO,MAAM,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,0BAA0B,CACjC,QAAyB,EACzB,WAA+B;IAE/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,QAAQ,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;QAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC;IACD,mEAAmE;IACnE,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,wBAAwB;QAClC,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,cAAc;KACxB,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAsB;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,oBAAoB,CAC5B,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,oBAAoB,CAC5B,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,uBAAuB,CAAC,GAAG,CAAC;QACrC,MAAM;QACN,YAAY,EAAE,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,SAAS;QAChE,WAAW;QACX,mBAAmB,EACjB,GAAG,CAAC,aAAa,KAAK,GAAG;YACvB,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;YACnD,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GACP,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QAC9B,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QAC9B,0BAA0B,CAAC;IAC7B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,6BAA6B,EAAE,CAAC;IAC5C,CAAC;IACD,IACE,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC9C,CAAC,MAAM,CAAC,QAAQ;QAChB,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,QAAQ;QACf,CAAC,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,IAAI,EACX,CAAC;QACD,MAAM,IAAI,6BAA6B,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC"}

package/dist/connectors/mcp/index.d.ts

@@ -1,8 +1,8 @@
 /**
- * The managed `connectors/` declaration primitive.
+ * The managed MCP declaration primitive.
  *
  * A Managed Deep Agent declares the remote MCP servers whose tools it wants in
- * `connectors/mcp.ts` with `connectors.mcp(...)`. MDA discovers that
+ * `tools/mcp.ts` with `defineMcp(...)`. MDA discovers that
  * declaration, creates the `@langchain/mcp-adapters` client, loads the tools,
  * and adds them to the Deep Agent at runtime — the author never imports the MCP
  * client or calls `getTools()`.
@@ -17,111 +17,52 @@
  *
  * @example
  * ```ts
- * // connectors/mcp.ts
- * import { connectors } from "managed-deepagents";
+ * // tools/mcp.ts
+ * import { defineMcp, connections } from "managed-deepagents";
  *
- * export const connector = connectors.mcp({
- *   mcpServers: {
+ * export const mcp = defineMcp({
+ *   servers: {
  *     docs: {
  *       transport: "http",
  *       url: "https://docs.example.com/mcp",
  *     },
+ *     notion: {
+ *       transport: "http",
+ *       url: "https://mcp.notion.com/mcp",
+ *       connection: connections.get("notion", { type: "user" }),
+ *     },
  *   },
  * });
  * ```
  */
-import type { Connector } from "../../runtime/connector.js";
-/** Per-server MCP tool selection. Names are raw, unprefixed MCP tool names. */
-export interface McpToolSelectionConfig {
-    /**
-     * Raw MCP tool names to expose from this server. Names are matched before any
-     * managed `{server}__` prefix is applied.
-     */
-    includeTools?: string[];
-    /**
-     * Raw MCP tool names to hide from this server. Names are matched before any
-     * managed `{server}__` prefix is applied.
-     */
-    excludeTools?: string[];
-}
-/** Shared options for all remote MCP server connections. */
-export interface RemoteMcpServerBaseConfig extends McpToolSelectionConfig {
-    /** URL of the remote MCP server endpoint. */
-    url: string;
-    /** Optional static headers sent when connecting to the MCP server. */
-    headers?: Record<string, string>;
-    /** Default timeout, in milliseconds, for tools loaded from this server. */
-    defaultToolTimeout?: number;
-}
-/** Streamable HTTP MCP server connection. */
-export interface HttpMcpServerConfig extends RemoteMcpServerBaseConfig {
-    /** Remote transport. `"http"` selects Streamable HTTP. */
-    transport: "http";
-    /**
-     * Whether the client may fall back to SSE if the server does not support
-     * Streamable HTTP. Defaults to the behavior of `@langchain/mcp-adapters`.
-     */
-    automaticSSEFallback?: boolean;
-}
-/** Legacy SSE MCP server connection. */
-export interface SseMcpServerConfig extends RemoteMcpServerBaseConfig {
-    /** Remote transport. `"sse"` selects legacy SSE. */
-    transport: "sse";
-    /** Reconnection behavior for SSE MCP servers. */
-    reconnect?: {
-        enabled: boolean;
-        maxAttempts?: number;
-        delayMs?: number;
-    };
-}
-/** A remote MCP server connection. Stdio servers are intentionally excluded. */
-export type RemoteMcpServerConfig = HttpMcpServerConfig | SseMcpServerConfig;
-/** Configuration accepted by `connectors.mcp`. */
-export interface McpServersConfig {
-    /**
-     * MCP servers to connect to. Each key is the logical server name MDA uses
-     * for validation, tracing metadata, and tool-name prefixing.
-     */
-    mcpServers: Record<string, RemoteMcpServerConfig>;
-    /**
-     * Whether tool names should be prefixed with the MCP server name (e.g.
-     * `docs__search`). Defaults to `true`, which avoids collisions between
-     * authored tools and common MCP tool names like `search` or `read`.
-     */
-    prefixToolNameWithServerName?: boolean;
-    /**
-     * Whether tool loading should fail if a tool cannot be loaded. Defaults to
-     * `true` — a managed deployment should fail rather than start with a
-     * partially loaded tool surface.
-     */
-    throwOnLoadError?: boolean;
-    /**
-     * Whether MCP tool outputs should be converted to LangChain standard content
-     * blocks. Defaults to `true` for new managed agents.
-     */
-    useStandardContentBlocks?: boolean;
-    /**
-     * Behavior when an MCP server cannot be connected. Only `"throw"` is
-     * supported for the POC — a failed connection fails the deployment.
-     */
-    onConnectionError?: "throw";
-}
+import type { CredentialConsumer, LoadedCredentialTools } from "../../credential-gate.js";
+import type { McpServersConfig, McpServersDefinition } from "./types.js";
+export type * from "./types.js";
+/**
+ * Load (and cache) the MCP tools for one connector declaration.
+ *
+ * A failed load is never cached, so a transient connection error on the first
+ * run can be retried on the next, but a misconfigured deployment surfaces the
+ * error rather than silently starting with no tools.
+ */
+export declare function loadManagedMcpTools(connectors: McpServersDefinition): Promise<unknown[]>;
+/** Clear the process-level MCP tool cache. Test-only. */
+export declare function clearManagedMcpToolsCacheForTests(connectors?: McpServersDefinition): void;
 /**
- * The connector exported from a `connectors/` module for MCP. It is a branded
- * managed {@link Connector} whose `tools` hook loads the declared MCP tools at
- * runtime, plus the raw config the loader reads.
+ * The credential gate's view of the declared MCP connectors.
+ *
+ * One consumer per declaration that names a user-owned connection; a
+ * declaration that needs no grant never reaches the gate.
  */
-export interface McpServersDefinition extends McpServersConfig, Connector {
-    /** Internal discriminator used by the MDA loader. */
-    readonly kind: "mcp_servers";
-}
+export declare function mcpCredentialConsumers(connectors: readonly unknown[] | undefined): CredentialConsumer[];
 /**
- * Declare the MCP servers whose tools should be loaded and added to the managed
- * Deep Agent at runtime.
+ * Load tools for user-connection servers, once the gate has confirmed the
+ * caller's grants.
  *
- * The tools hook runs at agent-graph construction time (inside the managed
- * runtime), so the MCP client loader is imported lazily — authoring-only
- * installs never pull in `@langchain/mcp-adapters`.
+ * Not process-cached here: the Authorization header is per caller, so the gate
+ * owns both the cache and closing the returned transport.
  */
-export declare const mcpConnector: (config: McpServersConfig) => McpServersDefinition;
+export declare function loadUserConnectionMcpTools(connectors: McpServersDefinition, accessTokens: ReadonlyMap<string, string>): Promise<LoadedCredentialTools>;
+/** Declare remote MCP servers whose tools load at agent-graph construction. */
+export declare const defineMcp: (config: McpServersConfig) => McpServersDefinition;
 //# sourceMappingURL=index.d.ts.map

package/dist/connectors/mcp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/connectors/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAUH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAE5D,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,4DAA4D;AAC5D,MAAM,WAAW,yBAA0B,SAAQ,sBAAsB;IACvE,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,6CAA6C;AAC7C,MAAM,WAAW,mBAAoB,SAAQ,yBAAyB;IACpE,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,wCAAwC;AACxC,MAAM,WAAW,kBAAmB,SAAQ,yBAAyB;IACnE,oDAAoD;IACpD,SAAS,EAAE,KAAK,CAAC;IACjB,iDAAiD;IACjD,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,OAAO,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,gFAAgF;AAChF,MAAM,MAAM,qBAAqB,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAE7E,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAClD;;;;OAIG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB,EAAE,SAAS;IACvE,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;CAC9B;AAqDD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,oBASrD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/connectors/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAUH,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACtB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,KAAK,EACV,gBAAgB,EAChB,oBAAoB,EAGrB,MAAM,YAAY,CAAC;AAEpB,mBAAmB,YAAY,CAAC;AAkBhC;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,oBAAoB,GAC/B,OAAO,CAAC,OAAO,EAAE,CAAC,CAWpB;AAED,yDAAyD;AACzD,wBAAgB,iCAAiC,CAC/C,UAAU,CAAC,EAAE,oBAAoB,GAChC,IAAI,CAMN;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,GACzC,kBAAkB,EAAE,CAuBtB;AA0ED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,oBAAoB,EAChC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACxC,OAAO,CAAC,qBAAqB,CAAC,CAyBhC;AAsKD,+EAA+E;AAC/E,eAAO,MAAM,SAAS,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,oBAOlD,CAAC"}