managed-deepagents 0.6.2-dev.8 → 0.7.0

package/dist/connectors/tool-selection.d.ts

@@ -2,7 +2,7 @@
  * Tool-name selection, shared by the connectors that load their tools from a
  * remote MCP server.
  *
- * `connectors.mcp` selects by raw tool name across arbitrary servers. A name in
+ * `defineMcp` selects by raw tool name across arbitrary servers. A name in
  * `includeTools`/`excludeTools` that no loaded tool answers to is an error
  * naming what *was* available, so a typo fails the deployment instead of
  * silently dropping a tool the agent was meant to have.
@@ -20,27 +20,18 @@ export interface ToolSelection<TTool extends string = string> {
     /** Tool names to hide. Applied after {@link ToolSelection.includeTools}. */
     excludeTools?: TTool[];
 }
-/**
- * Shared authoring options for connectors that load remote tools.
- */
-export interface ToolSelectionConnectorConfig<TTool extends string = string> extends ToolSelection<TTool> {
-    /** Timeout for each tool call (milliseconds on the TypeScript runtime). */
-    defaultToolTimeout?: number;
-}
 /** Tool names: non-empty, no duplicates within one list. */
-export declare const toolSelectionConnectorFields: {
-    includeTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    excludeTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    defaultToolTimeout: z.ZodOptional<z.ZodNumber>;
-};
-/** Shared include/exclude overlap check for connector arg schemas. */
-export declare function checkToolSelectionOverlap(ctx: {
+export declare const optionalToolNameListSchema: z.ZodOptional<z.ZodArray<z.ZodString>>;
+export declare function appendToolSelectionOverlapIssue(ctx: {
+    value: unknown;
     issues: {
-        push(issue: unknown): void;
+        push: (issue: {
+            code: "custom";
+            input: unknown;
+            message: string;
+        }) => void;
     };
-    value: unknown;
-}, value: ToolSelection): void;
-export declare function toolSelectionConnectorSchema<TArgs, TInput>(extra?: z.ZodRawShape): z.ZodType<TArgs, TInput>;
+}): void;
 /** Read the name a selection matches a loaded tool by. */
 export type ToolNameReader = (tool: unknown) => string | undefined;
 /** Read a loaded tool's own `name`. The default for connectors that don't rename. */

package/dist/connectors/tool-selection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-selection.d.ts","sourceRoot":"","sources":["../../src/connectors/tool-selection.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AACH,MAAM,WAAW,aAAa,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM;IAC1D,6DAA6D;IAC7D,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC;IACvB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B,CAC3C,KAAK,SAAS,MAAM,GAAG,MAAM,CAC7B,SAAQ,aAAa,CAAC,KAAK,CAAC;IAC5B,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAOD,4DAA4D;AAC5D,eAAO,MAAM,4BAA4B;IACvC,YAAY;IAgBZ,YAAY;IAgBZ,kBAAkB;CAInB,CAAC;AAEF,sEAAsE;AACtE,wBAAgB,yBAAyB,CACvC,GAAG,EAAE;IAAE,MAAM,EAAE;QAAE,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,EAC/D,KAAK,EAAE,aAAa,GACnB,IAAI,CAgBN;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,EACxD,KAAK,GAAE,CAAC,CAAC,WAAgB,GACxB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAO1B;AAED,0DAA0D;AAC1D,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;AAEnE,qFAAqF;AACrF,eAAO,MAAM,QAAQ,EAAE,cAGtB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,aAAa,EACxB,KAAK,EAAE,SAAS,OAAO,EAAE,EACzB,QAAQ,GAAE,cAAyB,GAClC,OAAO,EAAE,CAwBX"}
+{"version":3,"file":"tool-selection.d.ts","sourceRoot":"","sources":["../../src/connectors/tool-selection.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AACH,MAAM,WAAW,aAAa,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM;IAC1D,6DAA6D;IAC7D,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC;IACvB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC;CACxB;AAED,4DAA4D;AAC5D,eAAO,MAAM,0BAA0B,wCAsB1B,CAAC;AAmBd,wBAAgB,+BAA+B,CAAC,GAAG,EAAE;IACnD,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE;QACN,IAAI,EAAE,CAAC,KAAK,EAAE;YAAE,IAAI,EAAE,QAAQ,CAAC;YAAC,KAAK,EAAE,OAAO,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,KAAK,IAAI,CAAC;KAC5E,CAAC;CACH,GAAG,IAAI,CAWP;AAED,0DAA0D;AAC1D,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;AAEnE,qFAAqF;AACrF,eAAO,MAAM,QAAQ,EAAE,cAGtB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,aAAa,EACxB,KAAK,EAAE,SAAS,OAAO,EAAE,EACzB,QAAQ,GAAE,cAAyB,GAClC,OAAO,EAAE,CAwBX"}

package/dist/connectors/tool-selection.js

@@ -2,79 +2,53 @@
  * Tool-name selection, shared by the connectors that load their tools from a
  * remote MCP server.
  *
- * `connectors.mcp` selects by raw tool name across arbitrary servers. A name in
+ * `defineMcp` selects by raw tool name across arbitrary servers. A name in
  * `includeTools`/`excludeTools` that no loaded tool answers to is an error
  * naming what *was* available, so a typo fails the deployment instead of
  * silently dropping a tool the agent was meant to have.
  */
 import { z } from "zod";
-function nonEmpty(field) {
-    const message = `${field} must be a non-empty string`;
-    return z.string(message).refine((value) => value.trim().length > 0, message);
-}
 /** Tool names: non-empty, no duplicates within one list. */
-export const toolSelectionConnectorFields = {
-    includeTools: z
-        .array(nonEmpty("tool name"))
-        .check((ctx) => {
-        const seen = new Set();
-        for (const name of ctx.value) {
-            if (seen.has(name)) {
-                ctx.issues.push({
-                    code: "custom",
-                    input: ctx.value,
-                    message: `contains duplicate tool name "${name}"`,
-                });
-            }
-            seen.add(name);
-        }
-    })
-        .optional(),
-    excludeTools: z
-        .array(nonEmpty("tool name"))
-        .check((ctx) => {
-        const seen = new Set();
-        for (const name of ctx.value) {
-            if (seen.has(name)) {
-                ctx.issues.push({
-                    code: "custom",
-                    input: ctx.value,
-                    message: `contains duplicate tool name "${name}"`,
-                });
-            }
-            seen.add(name);
+export const optionalToolNameListSchema = z
+    .array(z
+    .string("tool name must be a non-empty string")
+    .refine((name) => name.trim().length > 0, "tool name must be a non-empty string"))
+    .check((ctx) => {
+    const seen = new Set();
+    for (const name of ctx.value) {
+        if (seen.has(name)) {
+            ctx.issues.push({
+                code: "custom",
+                input: ctx.value,
+                message: `contains duplicate tool name "${name}"`,
+            });
         }
-    })
-        .optional(),
-    defaultToolTimeout: z
-        .number("defaultToolTimeout must be a positive number")
-        .positive("defaultToolTimeout must be a positive number")
-        .optional(),
-};
-/** Shared include/exclude overlap check for connector arg schemas. */
-export function checkToolSelectionOverlap(ctx, value) {
-    const { includeTools, excludeTools } = value;
+        seen.add(name);
+    }
+})
+    .optional();
+function toolSelectionOverlapMessage(selection) {
+    const { includeTools, excludeTools } = selection;
     const overlap = (includeTools ?? []).filter((name) => (excludeTools ?? []).includes(name));
-    if (overlap.length > 0) {
+    if (overlap.length === 0) {
+        return undefined;
+    }
+    return `selects tool(s) in both \`includeTools\` and \`excludeTools\`: ${[
+        ...new Set(overlap),
+    ]
+        .sort()
+        .join(", ")}`;
+}
+export function appendToolSelectionOverlapIssue(ctx) {
+    const message = toolSelectionOverlapMessage(ctx.value);
+    if (message) {
         ctx.issues.push({
             code: "custom",
             input: ctx.value,
-            message: `selects tool(s) in both \`includeTools\` and \`excludeTools\`: ${[
-                ...new Set(overlap),
-            ]
-                .sort()
-                .join(", ")}`,
+            message,
         });
     }
 }
-export function toolSelectionConnectorSchema(extra = {}) {
-    return z
-        .strictObject({ ...toolSelectionConnectorFields, ...extra })
-        .check((ctx) => {
-        checkToolSelectionOverlap(ctx, ctx.value);
-    })
-        .prefault({});
-}
 /** Read a loaded tool's own `name`. The default for connectors that don't rename. */
 export const toolName = (tool) => {
     const name = tool.name;

package/dist/connectors/tool-selection.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-selection.js","sourceRoot":"","sources":["../../src/connectors/tool-selection.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyBxB,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,OAAO,GAAG,GAAG,KAAK,6BAA6B,CAAC;IACtD,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;AAC/E,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,YAAY,EAAE,CAAC;SACZ,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;SAC5B,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,OAAO,EAAE,iCAAiC,IAAI,GAAG;iBAClD,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;SACD,QAAQ,EAAE;IACb,YAAY,EAAE,CAAC;SACZ,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;SAC5B,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,OAAO,EAAE,iCAAiC,IAAI,GAAG;iBAClD,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;SACD,QAAQ,EAAE;IACb,kBAAkB,EAAE,CAAC;SAClB,MAAM,CAAC,8CAA8C,CAAC;SACtD,QAAQ,CAAC,8CAA8C,CAAC;SACxD,QAAQ,EAAE;CACd,CAAC;AAEF,sEAAsE;AACtE,MAAM,UAAU,yBAAyB,CACvC,GAA+D,EAC/D,KAAoB;IAEpB,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,OAAO,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACnD,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CACpC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO,EAAE,kEAAkE;gBACzE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC;aACpB;iBACE,IAAI,EAAE;iBACN,IAAI,CAAC,IAAI,CAAC,EAAE;SAChB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,KAAK,GAAkB,EAAE;IAEzB,OAAO,CAAC;SACL,YAAY,CAAC,EAAE,GAAG,4BAA4B,EAAE,GAAG,KAAK,EAAE,CAAC;SAC3D,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC,KAAsB,CAAC,CAAC;IAC7D,CAAC,CAAC;SACD,QAAQ,CAAC,EAAE,CAAU,CAAC;AAC3B,CAAC;AAKD,qFAAqF;AACrF,MAAM,CAAC,MAAM,QAAQ,GAAmB,CAAC,IAAI,EAAE,EAAE;IAC/C,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,CAAC;IAC/C,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,SAAwB,EACxB,KAAyB,EACzB,QAAQ,GAAmB,QAAQ;IAEnC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;IACjD,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,KAAK;SACF,GAAG,CAAC,QAAQ,CAAC;SACb,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAC9D,CAAC;IACF,wBAAwB,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,QAAQ,KAAK,SAAS,CAAC;QAChC,CAAC;QACD,OAAO,CACL,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CACvE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAAe,EACf,SAAsB,EACtB,YAAuB,EACvB,YAAuB;IAEvB,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IACpE,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,8BAA8B,KAAK,IAAI;QAC/C,oBAAoB,cAAc,GAAG,CACxC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tool-selection.js","sourceRoot":"","sources":["../../src/connectors/tool-selection.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB,4DAA4D;AAC5D,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,KAAK,CACJ,CAAC;KACE,MAAM,CAAC,sCAAsC,CAAC;KAC9C,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAChC,sCAAsC,CACvC,CACJ;KACA,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACb,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,OAAO,EAAE,iCAAiC,IAAI,GAAG;aAClD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;AACH,CAAC,CAAC;KACD,QAAQ,EAAE,CAAC;AAEd,SAAS,2BAA2B,CAClC,SAA+D;IAE/D,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;IACjD,MAAM,OAAO,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACnD,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CACpC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,kEAAkE;QACvE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC;KACpB;SACE,IAAI,EAAE;SACN,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,GAK/C;IACC,MAAM,OAAO,GAAG,2BAA2B,CACzC,GAAG,CAAC,KAA6D,CAClE,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAKD,qFAAqF;AACrF,MAAM,CAAC,MAAM,QAAQ,GAAmB,CAAC,IAAI,EAAE,EAAE;IAC/C,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,CAAC;IAC/C,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,SAAwB,EACxB,KAAyB,EACzB,QAAQ,GAAmB,QAAQ;IAEnC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;IACjD,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,KAAK;SACF,GAAG,CAAC,QAAQ,CAAC;SACb,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAC9D,CAAC;IACF,wBAAwB,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,QAAQ,KAAK,SAAS,CAAC;QAChC,CAAC;QACD,OAAO,CACL,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CACvE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAAe,EACf,SAAsB,EACtB,YAAuB,EACvB,YAAuB;IAEvB,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IACpE,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,8BAA8B,KAAK,IAAI;QAC/C,oBAAoB,cAAc,GAAG,CACxC,CAAC;AACJ,CAAC"}

package/dist/credential-gate.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Pre-run gate for declarations that need a user-owned connection.
+ *
+ * Before the first model turn the gate reads the caller's OAuth grants and
+ * opaque secrets from Agent Auth. Missing grants raise one LangGraph interrupt;
+ * OAuth slugs include connect URLs, opaque slugs request password-style input.
+ * The tools a grant unlocks are loaded on first use and cached per caller.
+ */
+import { createMiddleware } from "langchain";
+import { type ConnectionReference } from "./connections.js";
+export declare const CREDENTIAL_GATE_MIDDLEWARE_NAME = "mda-credential-gate";
+/** Tools a declaration contributes for one caller, plus their transport. */
+export interface LoadedCredentialTools {
+    tools: unknown[];
+    close: () => Promise<void>;
+}
+/** A declaration whose tools are unlocked by user-owned connections. */
+export interface CredentialConsumer {
+    /** The declaration itself, used to key the per-caller tool cache. */
+    declaration: object;
+    /** User-owned connection references the declaration needs. */
+    credentials: readonly ConnectionReference[];
+    load: (accessTokens: ReadonlyMap<string, string>) => Promise<LoadedCredentialTools>;
+}
+export declare function createCredentialGateMiddleware(consumers: readonly CredentialConsumer[]): ReturnType<typeof createMiddleware> | undefined;
+/** Drop every cached caller entry and close its transports. Test-only. */
+export declare function clearCredentialToolCacheForTests(): Promise<void>;
+//# sourceMappingURL=credential-gate.d.ts.map

package/dist/credential-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-gate.d.ts","sourceRoot":"","sources":["../src/credential-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAG7C,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,kBAAkB,CAAC;AAY1B,eAAO,MAAM,+BAA+B,wBAAwB,CAAC;AAUrE,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,WAAW,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC5C,IAAI,EAAE,CACJ,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KACtC,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACrC;AAuCD,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,SAAS,kBAAkB,EAAE,GACvC,UAAU,CAAC,OAAO,gBAAgB,CAAC,GAAG,SAAS,CAyCjD;AA6ID,0EAA0E;AAC1E,wBAAsB,gCAAgC,IAAI,OAAO,CAAC,IAAI,CAAC,CAStE"}

package/dist/credential-gate.js

@@ -0,0 +1,179 @@
+/**
+ * Pre-run gate for declarations that need a user-owned connection.
+ *
+ * Before the first model turn the gate reads the caller's OAuth grants and
+ * opaque secrets from Agent Auth. Missing grants raise one LangGraph interrupt;
+ * OAuth slugs include connect URLs, opaque slugs request password-style input.
+ * The tools a grant unlocks are loaded on first use and cached per caller.
+ */
+import { createMiddleware } from "langchain";
+import { AgentAuth } from "./agent-auth.js";
+import { resolveUserConnectionGrants } from "./connection-authorization.js";
+import { resolveAgentAuthContext, resolveOwnerId, } from "./connections.js";
+import { buildRuntimeIdentity, resolveRuntimeConfigurable, } from "./runtime/identity-runtime.js";
+import { wrapToolsWithManagedRuntime, } from "./runtime/managed-tools.js";
+export const CREDENTIAL_GATE_MIDDLEWARE_NAME = "mda-credential-gate";
+/**
+ * How long a caller's loaded tools stay cached.
+ *
+ * The access token is bound into the transport when the tools are built, so the
+ * entry has to lapse well before the token does.
+ */
+const TOOL_CACHE_TTL_MS = 5 * 60_000;
+/**
+ * Loaded tools by declaration and caller.
+ *
+ * Module scope, not middleware scope: a resumed run re-enters through a fresh
+ * graph factory, so a cache owned by the middleware would be empty for every
+ * turn after an interrupt. It is only ever a latency optimization — a resume
+ * can also land on another replica, so every read path rebuilds on a miss.
+ */
+const toolCache = new Map();
+const declarationIds = new WeakMap();
+let nextDeclarationId = 0;
+class UnauthenticatedCallerError extends Error {
+    constructor() {
+        super("connections with a user owner require an authenticated caller. " +
+            "Anonymous or agent-only runs cannot complete the credential gate.");
+        this.name = "UnauthenticatedCallerError";
+    }
+}
+export function createCredentialGateMiddleware(consumers) {
+    if (consumers.length === 0) {
+        return undefined;
+    }
+    return createMiddleware({
+        name: CREDENTIAL_GATE_MIDDLEWARE_NAME,
+        async beforeAgent(_state, runtime) {
+            const caller = await authContext(runtime);
+            if (!caller) {
+                throw new UnauthenticatedCallerError();
+            }
+            await ensureGrants(consumers, caller);
+            await toolsForContext(consumers, caller.context);
+        },
+        async wrapModelCall(request, handler) {
+            const extra = await toolsForRuntime(consumers, request.runtime);
+            if (extra.length === 0) {
+                return handler(request);
+            }
+            const existing = Array.isArray(request.tools) ? request.tools : [];
+            return handler({ ...request, tools: [...existing, ...extra] });
+        },
+        async wrapToolCall(request, handler) {
+            const name = request.toolCall?.name;
+            if (request.tool != null || typeof name !== "string") {
+                return handler(request);
+            }
+            const tools = await toolsForRuntime(consumers, request.runtime);
+            const tool = tools.find((candidate) => candidate.name === name);
+            return tool ? handler({ ...request, tool }) : handler(request);
+        },
+    });
+}
+/**
+ * Interrupt once when the caller is missing a grant.
+ *
+ * Reads never mint, so the probe is safe to repeat on every replay of this
+ * node. OAuth sessions are minted once, immediately before the interrupt that
+ * shows their URLs.
+ */
+async function ensureGrants(consumers, caller) {
+    const agentAuth = new AgentAuth(caller.context);
+    await resolveUserConnectionGrants(agentAuth, consumerCredentials(consumers, caller).map((credential) => credential.slug));
+}
+/**
+ * Declared connections, one per slug.
+ *
+ * Every reference is resolved through {@link resolveOwnerId}, the same check
+ * `connections.get` applies when a tool awaits a handle, so a declaration that
+ * names another user is rejected here rather than quietly run as the caller.
+ */
+function consumerCredentials(consumers, caller) {
+    const bySlug = new Map();
+    for (const consumer of consumers) {
+        for (const credential of consumer.credentials) {
+            resolveOwnerId(credential.owner, caller.identity, caller.context.agentId);
+            bySlug.set(credential.slug, credential);
+        }
+    }
+    return [...bySlug.values()];
+}
+async function toolsForRuntime(consumers, runtime) {
+    const caller = await authContext(runtime);
+    return caller ? await toolsForContext(consumers, caller.context) : [];
+}
+async function toolsForContext(consumers, context) {
+    const loaded = await Promise.all(consumers.map((consumer) => cachedTools(consumer, context)));
+    return loaded.flat();
+}
+async function cachedTools(consumer, context) {
+    const key = `${declarationId(consumer.declaration)} ${context.principalId}`;
+    for (;;) {
+        const cached = toolCache.get(key);
+        if (!cached) {
+            return refresh(key, consumer, context, undefined);
+        }
+        const entry = await cached.catch(() => undefined);
+        if (entry && entry.expiresAt > Date.now()) {
+            return entry.tools;
+        }
+        // Nothing suspends between this read and the write inside `refresh`, so a
+        // lapsed entry is retired by exactly one caller. The rest see the
+        // replacement on the next pass and join it.
+        if (toolCache.get(key) === cached) {
+            return refresh(key, consumer, context, entry);
+        }
+    }
+}
+/** Publish the load before awaiting it, so concurrent callers share one transport. */
+async function refresh(key, consumer, context, lapsed) {
+    const loading = loadTools(consumer, context);
+    toolCache.set(key, loading);
+    lapsed?.close().catch(() => undefined);
+    try {
+        return (await loading).tools;
+    }
+    catch (error) {
+        if (toolCache.get(key) === loading) {
+            toolCache.delete(key);
+        }
+        throw error;
+    }
+}
+async function loadTools(consumer, context) {
+    const agentAuth = new AgentAuth(context);
+    const accessTokens = await resolveUserConnectionGrants(agentAuth, consumer.credentials.map((credential) => credential.slug));
+    const loaded = await consumer.load(accessTokens);
+    return {
+        tools: wrapToolsWithManagedRuntime(loaded.tools),
+        close: loaded.close,
+        expiresAt: Date.now() + TOOL_CACHE_TTL_MS,
+    };
+}
+function declarationId(declaration) {
+    const existing = declarationIds.get(declaration);
+    if (existing)
+        return existing;
+    nextDeclarationId += 1;
+    const id = String(nextDeclarationId);
+    declarationIds.set(declaration, id);
+    return id;
+}
+async function authContext(runtime) {
+    const identity = buildRuntimeIdentity(resolveRuntimeConfigurable(runtime));
+    if (!identity?.user.id) {
+        return undefined;
+    }
+    return { context: await resolveAgentAuthContext(identity), identity };
+}
+/** Drop every cached caller entry and close its transports. Test-only. */
+export async function clearCredentialToolCacheForTests() {
+    const entries = [...toolCache.values()];
+    toolCache.clear();
+    await Promise.all(entries.map(async (entry) => {
+        const resolved = await entry.catch(() => undefined);
+        await resolved?.close().catch(() => undefined);
+    }));
+}
+//# sourceMappingURL=credential-gate.js.map

package/dist/credential-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-gate.js","sourceRoot":"","sources":["../src/credential-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EACL,uBAAuB,EACvB,cAAc,GAEf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAE3B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,2BAA2B,GAE5B,MAAM,4BAA4B,CAAC;AAEpC,MAAM,CAAC,MAAM,+BAA+B,GAAG,qBAAqB,CAAC;AAErE;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,GAAG,MAAM,CAAC;AAiCrC;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;AAEzD,MAAM,cAAc,GAAG,IAAI,OAAO,EAAkB,CAAC;AACrD,IAAI,iBAAiB,GAAG,CAAC,CAAC;AAE1B,MAAM,0BAA2B,SAAQ,KAAK;IAC5C;QACE,KAAK,CACH,iEAAiE;YAC/D,mEAAmE,CACtE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,UAAU,8BAA8B,CAC5C,SAAwC;IAExC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,gBAAgB,CAAC;QACtB,IAAI,EAAE,+BAA+B;QACrC,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO;YAC/B,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,OAAwC,CACzC,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0BAA0B,EAAE,CAAC;YACzC,CAAC;YACD,MAAM,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO;YAClC,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,SAAS,EACT,OAAO,CAAC,OAAwC,CACjD,CAAC;YACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO;YACjC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;YACpC,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,SAAS,EACT,OAAO,CAAC,OAAwC,CACjD,CAAC;YACF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjE,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CACzB,SAAwC,EACxC,MAAqB;IAErB,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,2BAA2B,CAC/B,SAAS,EACT,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAC1B,SAAwC,EACxC,MAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;IACtD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC9C,cAAc,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1E,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAAwC,EACxC,OAAsC;IAEtC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAAwC,EACxC,OAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAC5D,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAA4B,EAC5B,OAAyB;IAEzB,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAE5E,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;QACD,0EAA0E;QAC1E,kEAAkE;QAClE,4CAA4C;QAC5C,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,OAAO,CACpB,GAAW,EACX,QAA4B,EAC5B,OAAyB,EACzB,MAA8B;IAE9B,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7C,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5B,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,OAAO,CAAC,CAAC,KAAK,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;YACnC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,QAA4B,EAC5B,OAAyB;IAEzB,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,MAAM,2BAA2B,CACpD,SAAS,EACT,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAC1D,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACjD,OAAO;QACL,KAAK,EAAE,2BAA2B,CAChC,MAAM,CAAC,KAAwB,CACjB;QAChB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,WAAmB;IACxC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,iBAAiB,IAAI,CAAC,CAAC;IACvB,MAAM,EAAE,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACrC,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACpC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAsC;IAEtC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;AACxE,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,gCAAgC;IACpD,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,SAAS,CAAC,KAAK,EAAE,CAAC;IAClB,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC1B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,QAAQ,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/extension.d.ts

@@ -1,8 +1,8 @@
 /**
  * The contribution API behind the extensible MDA primitives.
  *
- * `defineExtension(kind, options)` returns the factory a connector namespace
- * calls, such as `connectors.mcp({ … })`. Argument parsing, branding, and
+ * `defineExtension(kind, options)` returns the factory a first-party primitive
+ * calls, such as `defineMcp({ … })`. Argument parsing, branding, and
  * manifest stamping are shared.
  *
  * Every kind declares its input through `args`, which takes a schema from any
@@ -40,7 +40,7 @@ export type ExtensionArgs<TInput, TArgs> = StandardSchemaV1<TInput, TArgs> | ((i
 interface ExtensionEnvelope<TInput, TArgs> {
     args: ExtensionArgs<TInput, TArgs>;
     /**
-     * How the factory is spelled in an agent project, e.g. `"connectors.mcp"`.
+     * How the factory is spelled in an agent project, e.g. `"defineMcp"`.
      * Prefixes validation errors, which is the only place an author sees it.
      */
     label: string;

package/dist/extension.js

@@ -1,8 +1,8 @@
 /**
  * The contribution API behind the extensible MDA primitives.
  *
- * `defineExtension(kind, options)` returns the factory a connector namespace
- * calls, such as `connectors.mcp({ … })`. Argument parsing, branding, and
+ * `defineExtension(kind, options)` returns the factory a first-party primitive
+ * calls, such as `defineMcp({ … })`. Argument parsing, branding, and
  * manifest stamping are shared.
  *
  * Every kind declares its input through `args`, which takes a schema from any

package/dist/identity/index.d.ts

@@ -14,7 +14,7 @@ import type { IdentityConfig, IdentityDefinition, LangSmithApiKeyIngress, Valida
 export { normalizeGroups, userClaimName } from "./claims.js";
 export { normalizeIdentity } from "./options.js";
 export type { IdentityAuth, IdentityOptions } from "./options.js";
-export type { ClaimMapping, CredentialScope, HttpIngress, IdentityConfig, IdentityDefinition, LangSmithApiKeyIngress, RuntimeIdentity, ValidatedTokenIngress, ValidatedTokenProvider, } from "./types.js";
+export type { ClaimMapping, CredentialScope, HttpIngress, IdentityConfig, IdentityDefinition, IdentitySource, LangSmithApiKeyIngress, Link, LinkStatus, Principal, PrincipalClaims, PrincipalEnvelope, PrincipalKind, RuntimeIdentity, Subject, SubjectAuthority, ValidatedTokenIngress, ValidatedTokenProvider, } from "./types.js";
 /**
  * Declare the identity contract for the deployment.
  *

package/dist/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,KAAK,uBAAuB,EAAoB,MAAM,eAAe,CAAC;AAC/E,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EAEtB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAElE,YAAY,EACV,YAAY,EACZ,eAAe,EACf,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,kBAAkB,CAI3E;AAED;;;GAGG;AACH,eAAO,MAAM,IAAI;IACf,2EAA2E;IAC3E,eAAe,IAAI,sBAAsB;IAGzC,oCAAoC;IACpC,QAAQ,UAAU,uBAAuB,GAAG,sBAAsB;CAGnE,CAAC;AAEF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAuC7D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,KAAK,uBAAuB,EAAoB,MAAM,eAAe,CAAC;AAC/E,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EAEtB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAElE,YAAY,EACV,YAAY,EACZ,eAAe,EACf,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,IAAI,EACJ,UAAU,EACV,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,OAAO,EACP,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,kBAAkB,CAI3E;AAED;;;GAGG;AACH,eAAO,MAAM,IAAI;IACf,2EAA2E;IAC3E,eAAe,IAAI,sBAAsB;IAGzC,oCAAoC;IACpC,QAAQ,UAAU,uBAAuB,GAAG,sBAAsB;CAGnE,CAAC;AAEF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAuC7D"}

package/dist/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAwB,MAAM,cAAc,CAAC;AACvE,OAAO,EAAgC,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAS/E,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAejD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAAC,OAAwB;IACrD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,2EAA2E;IAC3E,eAAe;QACb,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IACvC,CAAC;IACD,oCAAoC;IACpC,QAAQ,CAAC,OAAgC;QACvC,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAyC,CAAC;IACjE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAER,CAAC;IACd,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,wDAAwD;YACtD,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,sEAAsE;YACtE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,MAAM,IAAI,GAAI,OAA6B,CAAC,IAAI,CAAC;IACjD,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,4DAA4D;IAC9D,CAAC;SAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,iJAAiJ,CAClJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA2B,CAAC,IAAI,KAAK,mBAAmB,CAC1D,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA2B,CAAC,IAAI,KAAK,iBAAiB,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAA2B;IACzD,MAAM,IAAI,GAAI,IAAgC,CAAC,SAAS,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAA+B,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,EAAE,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,qBAAqB,CAC3E,CAAC;QACJ,CAAC;QACD,IACE,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;YACnC,QAAQ,CAAC,MAAM,KAAK,IAAI;YACxB,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,4BAA4B,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GACf,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;YACjC,QAAQ,CAAC,QAAQ,KAAK,IAAI;YAC1B,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ;YACzC,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC;QACpC,0EAA0E;QAC1E,mDAAmD;QACnD,IACE,WAAW;YACX,QAAQ,CAAC,UAAU,KAAK,SAAS;YACjC,CAAC,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,EACzE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,uDAAuD,CAC7G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,mFAAmF,CACzI,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAwB,MAAM,cAAc,CAAC;AACvE,OAAO,EAAgC,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAS/E,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAwBjD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAAC,OAAwB;IACrD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,2EAA2E;IAC3E,eAAe;QACb,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IACvC,CAAC;IACD,oCAAoC;IACpC,QAAQ,CAAC,OAAgC;QACvC,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAyC,CAAC;IACjE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAER,CAAC;IACd,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,wDAAwD;YACtD,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,sEAAsE;YACtE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,MAAM,IAAI,GAAI,OAA6B,CAAC,IAAI,CAAC;IACjD,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,4DAA4D;IAC9D,CAAC;SAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,iJAAiJ,CAClJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA2B,CAAC,IAAI,KAAK,mBAAmB,CAC1D,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA2B,CAAC,IAAI,KAAK,iBAAiB,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAA2B;IACzD,MAAM,IAAI,GAAI,IAAgC,CAAC,SAAS,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAA+B,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,EAAE,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,qBAAqB,CAC3E,CAAC;QACJ,CAAC;QACD,IACE,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;YACnC,QAAQ,CAAC,MAAM,KAAK,IAAI;YACxB,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,4BAA4B,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GACf,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;YACjC,QAAQ,CAAC,QAAQ,KAAK,IAAI;YAC1B,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ;YACzC,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC;QACpC,0EAA0E;QAC1E,mDAAmD;QACnD,IACE,WAAW;YACX,QAAQ,CAAC,UAAU,KAAK,SAAS;YACjC,CAAC,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,EACzE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,uDAAuD,CAC7G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,mFAAmF,CACzI,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/identity/types.d.ts

@@ -86,22 +86,96 @@ export interface ValidatedTokenProvider {
     claims: ClaimMapping;
 }
 /**
- * Which verified token claim supplies each identity envelope field.
+ * Which verified token claim supplies each principal field.
  *
  * `user` is required; `defineIdentity` rejects a provider that omits it.
  */
 export interface ClaimMapping {
-    /** Claim used as `runtime.identity.user.id` (e.g. "sub", "email"). */
+    /** Claim used as `runtime.serverInfo.principal.id` (e.g. "sub", "email"). */
     user?: string;
     /**
      * Claim carrying every group the caller belongs to. Accepts a JSON array, or a
-     * comma/space-delimited string. Read by tools for authorization.
+     * comma/space-delimited string. Folded into `principal.claims.groups`.
      */
     groups?: string;
-    /** Claim used as `runtime.identity.user.email`. */
+    /** Claim folded into `principal.claims.email`. */
     email?: string;
 }
-/** The frozen identity envelope tools and middleware see. */
+/**
+ * Agent Auth–aligned identity types for the current run.
+ *
+ * Author surface on LangGraph `serverInfo` (flattened, no nested envelope bag):
+ * `runtime.serverInfo.principal` / `.subject` / `.link`. Reassemble into
+ * {@link PrincipalEnvelope} when calling Agent Auth mint.
+ *
+ * Fields MDA cannot yet fill use conservative defaults
+ * (`link.status: "not_required"`, `subject.agent_id: ""`).
+ */
+export type PrincipalKind = "person" | "service" | "channel";
+export type SubjectAuthority = "agent" | "user";
+export type LinkStatus = "not_required" | "linked" | "unlinked" | "pending";
+/**
+ * The caller's claim bag.
+ *
+ * Mostly the verified token payload, passed through as the IdP sent it. The two
+ * claims MDA gives a name to are normalized before they land here, whether or
+ * not the deployment mapped them in `ClaimMapping`: `groups` is always a string
+ * array (IdPs send arrays or delimited strings), and `email` is always a string.
+ * An unmapped claim of either name that cannot be normalized is dropped rather
+ * than passed through, so the declared type always holds.
+ */
+export interface PrincipalClaims {
+    /** Every group the caller's token asserts. Never a raw delimited string. */
+    groups?: readonly string[];
+    email?: string;
+    [claim: string]: unknown;
+}
+export interface Principal {
+    id: string;
+    kind: PrincipalKind;
+    claims: PrincipalClaims;
+}
+export interface Subject {
+    authority: SubjectAuthority;
+    /**
+     * Deployment / agent id. Omitted when the platform supplied neither an
+     * assistant nor a graph id, so an Agent Auth call fails on a missing field
+     * rather than silently addressing the empty agent.
+     */
+    agent_id?: string;
+    /** Present when `authority === "user"`. */
+    user_id?: string;
+}
+/**
+ * Where the run entered from, as stamped by trusted managed ingress.
+ *
+ * This is MDA's own ingress record, not part of the Agent Auth envelope, so it
+ * sits beside `principal` on `serverInfo` instead of inside it.
+ */
+export interface IdentitySource {
+    /**
+     * Ingress source. Built-ins include `http`, `schedule`, `cli`, `studio`,
+     * plus channel providers (`slack`, `github`, or any registered plugin key).
+     */
+    provider: string;
+    threadId?: string;
+}
+export interface Link {
+    status: LinkStatus;
+    from?: string;
+    to?: string;
+}
+/** Wire shape for Agent Auth (`principal_envelope` on resolve/mint). */
+export interface PrincipalEnvelope {
+    principal: Principal;
+    subject: Subject;
+    link: Link;
+}
+/**
+ * Frozen identity bag for HTTP connector route handlers
+ * (`resolveRequestIdentity`). Tools/middleware use `serverInfo.principal`
+ * (plus `subject` / `link`) instead.
+ */
 export interface RuntimeIdentity {
     /** The caller. `kind: "service"` for machine callers (schedules, channels, Studio). */
     user: {
@@ -123,6 +197,29 @@ export interface RuntimeIdentity {
         threadId?: string;
     };
     claims?: Record<string, unknown>;
+    /**
+     * Validated-token provider id for Agent Auth principal resolve
+     * (`POST /v1/agent-auth/principals`).
+     */
+    identityProvider?: string;
+    /**
+     * Verified IdP issuer (`iss`) for Agent Auth principal resolve.
+     * Stamped by validated-token ingress; not the configured `claims.user` value.
+     */
+    identityIssuer?: string;
+    /**
+     * Verified IdP subject (`sub`) for Agent Auth principal resolve.
+     * Stamped by validated-token ingress so grants match other LangSmith clients
+     * even when `claims.user` maps to email. Thread ownership still uses
+     * {@link RuntimeIdentity.user.id}.
+     */
+    identitySubject?: string;
+    /**
+     * Agent Auth principal UUID when channel ingress already resolved one
+     * (Trigger `identity_context`). Credential ops use this; thread ownership
+     * still uses {@link RuntimeIdentity.user.id}.
+     */
+    agentAuthPrincipalId?: string;
 }
 /**
  * Whose token downstream calls carry.

package/dist/identity/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GACnB,SAAS,GACT,sBAAsB,GACtB,qBAAqB,CAAC;AAE1B,qEAAqE;AACrE,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,mBAAmB,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,IAAI,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN;;;WAGG;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF;;;OAGG;IACH,KAAK,EAAE;QACL,2EAA2E;QAC3E,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;CACH;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GACnB,SAAS,GACT,sBAAsB,GACtB,qBAAqB,CAAC;AAE1B,qEAAqE;AACrE,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,mBAAmB,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAC7D,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,MAAM,CAAC;AAChD,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAE5E;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,gBAAgB,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,IAAI;IACnB,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,IAAI,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN;;;WAGG;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF;;;OAGG;IACH,KAAK,EAAE;QACL,2EAA2E;QAC3E,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;CACH;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC"}