melchizedek-agents 1.3.1 → 1.4.0

package/dist/lib/runtime/syndicateTurn.js

@@ -70,7 +70,7 @@ import { traceAgentRun } from '../observability/tracer.js';
 import { ProjectedSessionService, renderTranscriptDigest } from '../session/transcript.js';
 import { approvalDecisionIn, describeApproval, interruptedTurnStart, pendingApproval } from './approvals.js';
 import { pendingQuestion, questionAnswerPart, questionFrom, turnStartOfCall } from './questions.js';
-import { deepestPause, delegatedPauses, nestedWorkflowPause, routePause } from './native/interrupts.js';
+import { deepestPause, delegatedPauses, nestedWorkflowPause, routePause, walkConsents } from './native/interrupts.js';
 import { consentPinnedTo, entrySession } from './native/delegate.js';
 import { workflowPauseEvent } from '../workflow/pause.js';
 import { INPUT_REQUEST } from '../workflowConfig.js';
@@ -485,6 +485,15 @@ async function runTurnInner(opts, control, _runtime, nestedTurn) {
         ev.log?.(`⏸ Authorization needed: ${(pending.path ?? [pending.agent]).join(' → ')} → ${pending.provider}`);
         return finish();
     };
+    /** Whether the grant a consent request waits for is stored (an expired or unreadable one is not). */
+    const grantStored = async (open) => {
+        try {
+            return !!open.provider && !!(await credentialStore?.get({ appName: credentialApp, userId, provider: open.provider }));
+        }
+        catch {
+            return false;
+        }
+    };
     let granting;
     // A call waiting for a grant inside a delegated subagent (ADR 0118): the grant's answer is stored here, and the open call carries it down.
     let grantingBelow;
@@ -508,14 +517,7 @@ async function runTurnInner(opts, control, _runtime, nestedTurn) {
                 result.error = { code: 'CONSENT_UNAVAILABLE', message: `A call waits for a ${open.provider} authorization, but this turn has no credential store.` };
                 return finish();
             }
-            let granted = false;
-            try {
-                granted = !!open.provider && !!(await credentialStore.get({ appName: credentialApp, userId, provider: open.provider }));
-            }
-            catch {
-                // Expired or unreadable: not granted. The request stands.
-            }
-            if (!granted)
+            if (!(await grantStored(open)))
                 return consentPause(open);
             // The route's own turn carries the grant's answer down to its call; the message goes to it as it came.
             if (routeWaits)
@@ -527,6 +529,28 @@ async function runTurnInner(opts, control, _runtime, nestedTurn) {
             ev.log?.(`✓ Authorization granted: ${(open.path ?? [open.agent]).join(' → ')} → ${open.provider}`);
         }
     }
+    // A walk waiting for grants (ADR 0128): a node's own consent request, or one a node raised again from below it. Once every
+    // grant is stored, the message becomes their answers and the walk resumes those nodes; until then it repeats the first
+    // request still missing and stores nothing, as at the top.
+    if (!decision && isWorkflowSyndicate(config)) {
+        const waiting = await walkConsents(pauseKey, existing?.events ?? []);
+        if (waiting.length > 0) {
+            if (!credentialStore) {
+                result.status = 'failed';
+                result.error = { code: 'CONSENT_UNAVAILABLE', message: `A call waits for a ${waiting[0].provider} authorization, but this turn has no credential store.` };
+                return finish();
+            }
+            for (const open of waiting)
+                if (!(await grantStored(open)))
+                    return consentPause(open);
+            granting = waiting[0];
+            parts = waiting.map((open) => credentialResponsePart(open.id, open.provider));
+            for (const open of waiting)
+                ev.log?.(`✓ Authorization granted: ${(open.path ?? [open.agent]).join(' → ')} → ${open.provider}`);
+        }
+    }
+    /** The parts a paused workflow route's walk resumes on once its grant is stored (ADR 0128): the grant's answer to its credential request. */
+    const routeGrant = consentRoute?.consent ? [credentialResponsePart(consentRoute.consent.id, consentRoute.consent.provider)] : undefined;
     // ── Questions (lib/runtime/questions.ts) ───────────────────────────────────
     // While an agent's `ask_user` call is open, a plain-text message is its
     // answer: it becomes that call's response, and the agent that asked
@@ -651,6 +675,8 @@ async function runTurnInner(opts, control, _runtime, nestedTurn) {
                 memory: nativeMemory(opts.memoryService),
                 ...(selfCorrection ? { selfCorrection } : {}),
                 ...(credentialStore ? { credentials: credentialStore } : {}),
+                // The consent step, its flows bound to the app the grants are read under, wherever the walk's session is filed (ADR 0128).
+                ...(consentStep ? { consent: consentPinnedTo(consentStep, credentialApp) } : {}),
                 ...(compileOpts.log ? { log: compileOpts.log } : {}),
             });
         }
@@ -747,7 +773,7 @@ async function runTurnInner(opts, control, _runtime, nestedTurn) {
             throw new Error(`Session not found: ${sessionId} (appName=${appName}, userId=${userId})`);
         const kept = (state) => Object.fromEntries(Object.entries(state ?? {}).filter(([k]) => !k.startsWith(TEMP_STATE_PREFIX)));
         // Filed under the agent path (ADR 0119), else continued under the route's name alone where ADR 0106 filed it.
-        const resumingWalk = resumingRoute !== undefined || routeAnswer !== undefined;
+        const resumingWalk = resumingRoute !== undefined || routeAnswer !== undefined || consentRoute !== undefined;
         const child = await entrySession(store, { appName, userId, sessionId, events: shared.events }, route, 'route', kept(shared.state), resumingWalk);
         const childKey = { appName: child.appName, userId, sessionId };
         const before = new Map(Object.entries(kept(child.state)).map(([k, v]) => [k, JSON.stringify(v)]));
@@ -760,7 +786,7 @@ async function runTurnInner(opts, control, _runtime, nestedTurn) {
         };
         let walked;
         try {
-            walked = await runAgent({ agent, sid: sessionId, appName: child.appName, userParts: routeAnswer ?? parts, sessions: sessionService, stage: 'dispatch', route: resolution, publishToolStatus: true, errorPolicy: 'collect' });
+            walked = await runAgent({ agent, sid: sessionId, appName: child.appName, userParts: routeAnswer ?? routeGrant ?? parts, sessions: sessionService, stage: 'dispatch', route: resolution, publishToolStatus: true, errorPolicy: 'collect' });
         }
         catch (err) {
             const last = control.stopReason ? undefined : err;
@@ -1087,6 +1113,10 @@ async function runTurnInner(opts, control, _runtime, nestedTurn) {
         const pending = pendingApproval(after?.events ?? []);
         if (pending)
             return pause(await deepen(pending));
+        // A node waiting for a grant (ADR 0128): its own request, or one from below it, with the path from the node down.
+        const [consent] = await walkConsents(pauseKey, after?.events ?? []);
+        if (consent)
+            return consentPause(consent);
         if (answer.inputRequests.length)
             return question(await deepen(answer.inputRequests[answer.inputRequests.length - 1]));
         result.text = answer.text;

package/dist/lib/syndicateSchema.js

@@ -1153,12 +1153,30 @@ function workflowProblems(raw, subs) {
         if (typeof agent.name === 'string' && mapped.has(agent.name) && isObj(agent.skills) && agent.skills.scripts === 'local') {
             out.push({ path: [...path, 'skills', 'scripts'], message: 'skill scripts (an approval pause) are not supported on an agent a map node runs: a map item cannot pause the walk' });
         }
+        // An authorization_code grant pauses for consent (ADR 0128): allowed on a node, not on a map item.
+        if (typeof agent.name === 'string' && mapped.has(agent.name)) {
+            for (const where of authorizationCodeGrants(agent)) {
+                out.push({ path: [...path, ...where], message: 'an authorization_code grant (a consent pause) is not supported on an agent a map node runs: a map item cannot pause the walk' });
+            }
+        }
         if (typeof agent.a2a_agent_url === 'string') {
             out.push({ path: [...path, 'a2a_agent_url'], message: 'a remote agent cannot be a workflow node yet' });
         }
     }
     return out;
 }
+/** Where an agent declares an authorization_code grant (mcp_auth, mcp_servers[].auth, openapi[].auth), by its path below the agent. */
+function authorizationCodeGrants(agent) {
+    const out = [];
+    const isCode = (auth) => isObj(auth) && isObj(auth.oauth2) && auth.oauth2.grant === 'authorization_code';
+    if (isCode(agent.mcp_auth))
+        out.push(['mcp_auth', 'oauth2', 'grant']);
+    if (Array.isArray(agent.mcp_servers))
+        agent.mcp_servers.forEach((e, i) => isObj(e) && isCode(e.auth) && out.push(['mcp_servers', i, 'auth', 'oauth2', 'grant']));
+    if (Array.isArray(agent.openapi))
+        agent.openapi.forEach((e, i) => isObj(e) && isCode(e.auth) && out.push(['openapi', i, 'auth', 'oauth2', 'grant']));
+    return out;
+}
 // ── Public API ───────────────────────────────────────────────────────────────
 /**
  * Thrown by validateSyndicateConfig. `problems` holds one `<file>: <path> —

package/dist/lib/tools/mcpToolFactory.js

@@ -5,8 +5,9 @@
  * An agent's `mcp_server_url:` (or each entry of `mcp_servers:`, ADR 0124)
  * connects here over Streamable HTTP, falling back to the legacy SSE
  * transport when the server answers the initialize POST with the spec's
- * fallback signal (a 4xx other than 401/403), or over the transport the YAML
- * names. Every tool the server lists becomes an own Tool whose declaration is the server's
+ * fallback signal (a 4xx other than 401/403), or with a 401 when no OAuth
+ * grant is configured for the connection, or over the transport the YAML
+ * names; the transport that worked is remembered per URL. Every tool the server lists becomes an own Tool whose declaration is the server's
  * description (bounded) and input schema, and whose execute calls the
  * server and returns its text (bounded). loadMcpTools returns them;
  * createMcpTools is the name the compiler calls.
@@ -134,14 +135,56 @@ export function isSseFallbackSignal(error) {
     const code = error.code;
     return typeof code === 'number' && code >= 400 && code < 500 && code !== 401 && code !== 403;
 }
+/**
+ * True when a Streamable HTTP connect failed with a 401: the server refused
+ * the request's credential (or its absence). Where the connection carries no
+ * OAuth grant, an SSE-only server behind a bearer can answer the initialize
+ * POST to its stream URL that way, so connectMcp tries SSE once (ADR 0124's
+ * note of 2026-10-11).
+ */
+const isUnauthorized = (error) => error instanceof StreamableHTTPError && error.code === 401;
+/** Server URLs whose transport `auto` has learned, at most; the least recently used is forgotten first. */
+const MAX_REMEMBERED_MCP_TRANSPORTS = 256;
+/**
+ * The transport that last connected to each server URL under `auto`, for the
+ * life of the process, so a later connection skips the probe. It holds a URL
+ * and a transport name, never a credential.
+ */
+const rememberedTransports = new Map();
+function rememberTransport(href, kind) {
+    rememberedTransports.delete(href);
+    rememberedTransports.set(href, kind);
+    while (rememberedTransports.size > MAX_REMEMBERED_MCP_TRANSPORTS) {
+        const oldest = rememberedTransports.keys().next().value;
+        rememberedTransports.delete(oldest);
+    }
+}
+const STREAMABLE_PREFIX = 'Streamable HTTP error: ';
+/** `message` with the credential header's value, and its token, cut out. */
+function withoutCredential(message, headers) {
+    const auth = headers.Authorization;
+    if (!auth)
+        return message;
+    const token = auth.startsWith('Bearer ') ? auth.slice('Bearer '.length) : undefined;
+    return redact(redact(message, auth), token);
+}
 /**
  * A client connected to `url` over `kind`, every request through `fetchFn`
  * (the redirect rule, and the credential when there is one). A transport
  * that fails to connect is closed before the error leaves, so nothing keeps
- * reconnecting; with `auto`, a failed Streamable HTTP attempt carrying the
- * fallback signal is closed and the SSE transport tried once.
+ * reconnecting. With `auto`:
+ *   - a transport remembered for this URL is tried first; if it fails, it is
+ *     forgotten and the probe runs;
+ *   - the probe posts over Streamable HTTP. On the spec's fallback signal, or
+ *     on a 401 when the connection has no OAuth grant (`MCP_BEARER_TOKENS`
+ *     or no credential), it closes that attempt and tries SSE once with the
+ *     same fetch and headers. When SSE fails after a 401, the 401 is what is
+ *     thrown, naming both attempts and no credential. A 401 under an OAuth
+ *     grant (its consent and discovery path, ADR 0112 and 0124), a 403, a 5xx
+ *     and a network failure do not fall back;
+ *   - the transport that connected is remembered for this URL.
  */
-async function connectMcp(url, kind, fetchFn, headers = {}) {
+async function connectMcp(url, kind, fetchFn, headers = {}, options = {}) {
     const attempt = async (which) => {
         const requestInit = Object.keys(headers).length ? { requestInit: { headers } } : {};
         const transport = which === 'sse' ? new SSEClientTransport(url, { ...requestInit, fetch: fetchFn }) : new StreamableHTTPClientTransport(url, { ...requestInit, fetch: fetchFn });
@@ -160,14 +203,43 @@ async function connectMcp(url, kind, fetchFn, headers = {}) {
         return attempt('sse');
     if (kind === 'streamable_http')
         return attempt('streamable_http');
+    const href = url.href;
+    const known = rememberedTransports.get(href);
+    if (known) {
+        try {
+            const conn = await attempt(known);
+            rememberTransport(href, known);
+            return conn;
+        }
+        catch {
+            // The server may have changed: forget it and probe as if new.
+            rememberedTransports.delete(href);
+        }
+    }
+    let conn;
     try {
-        return await attempt('streamable_http');
+        conn = await attempt('streamable_http');
     }
     catch (error) {
-        if (!isSseFallbackSignal(error))
+        if (isSseFallbackSignal(error)) {
+            conn = await attempt('sse');
+        }
+        else if (isUnauthorized(error) && !options.oauth) {
+            try {
+                conn = await attempt('sse');
+            }
+            catch (sseError) {
+                const original = error.message.startsWith(STREAMABLE_PREFIX) ? error.message.slice(STREAMABLE_PREFIX.length) : error.message;
+                const sseMessage = sseError instanceof Error ? sseError.message : String(sseError);
+                throw new StreamableHTTPError(401, withoutCredential(`${original} (Streamable HTTP answered 401; the SSE transport was tried once after it and failed too: ${sseMessage})`, headers));
+            }
+        }
+        else {
             throw error;
-        return attempt('sse');
+        }
     }
+    rememberTransport(href, conn.kind);
+    return conn;
 }
 /**
  * Close every open MCP connection. A connection otherwise lives as long as
@@ -180,6 +252,7 @@ export async function closeMcpConnections() {
     openTransports.clear();
     for (const pool of userPools)
         pool.clear();
+    rememberedTransports.clear();
     await Promise.all(all.map((t) => t.close().catch(() => { })));
 }
 /**
@@ -265,7 +338,7 @@ export async function loadMcpTools(mcpServerUrl, options = {}) {
     try {
         const url = await assertSafeMcpUrl(mcpServerUrl);
         conn = tokenSource
-            ? await connectMcp(url, kind, bearerFetch(oauth2, (destination) => tokenSource(undefined, destination)))
+            ? await connectMcp(url, kind, bearerFetch(oauth2, (destination) => tokenSource(undefined, destination)), {}, { oauth: true })
             : await connectMcp(url, kind, mcpFetch, mcpAuthHeaders(url));
         const client = conn.client;
         // Fetch available tools from the MCP server
@@ -335,7 +408,7 @@ function userGrantMcpTools(mcpServerUrl, oauth2, names, kind) {
         conn.holder = holder;
         conn.ready = (async () => {
             const url = await assertSafeMcpUrl(mcpServerUrl);
-            const { client, transport } = await connectMcp(url, kind, bearerFetch(oauth2, async () => holder.token));
+            const { client, transport } = await connectMcp(url, kind, bearerFetch(oauth2, async () => holder.token), {}, { oauth: true });
             conn.transport = transport;
             if (!listed) {
                 const offered = await client.listTools();

package/dist/lib/tools/mcpTransports.d.ts

@@ -5,8 +5,10 @@
  *
  * `auto` (the default) posts the initialize request over Streamable HTTP, the
  * spec's current transport, and falls back to the legacy HTTP+SSE transport
- * on the spec's signal (lib/tools/mcpToolFactory.ts isSseFallbackSignal);
- * `streamable_http` and `sse` use that one transport only.
+ * on the spec's signal (lib/tools/mcpToolFactory.ts isSseFallbackSignal), or
+ * on a 401 when the connection carries no OAuth grant, remembering per URL
+ * the transport that worked; `streamable_http` and `sse` use that one
+ * transport only.
  */
 export declare const MCP_TRANSPORTS: readonly ['auto', 'streamable_http', 'sse'];
 export type McpTransportKind = (typeof MCP_TRANSPORTS)[number];

package/dist/lib/tools/mcpTransports.js

@@ -5,7 +5,9 @@
  *
  * `auto` (the default) posts the initialize request over Streamable HTTP, the
  * spec's current transport, and falls back to the legacy HTTP+SSE transport
- * on the spec's signal (lib/tools/mcpToolFactory.ts isSseFallbackSignal);
- * `streamable_http` and `sse` use that one transport only.
+ * on the spec's signal (lib/tools/mcpToolFactory.ts isSseFallbackSignal), or
+ * on a 401 when the connection carries no OAuth grant, remembering per URL
+ * the transport that worked; `streamable_http` and `sse` use that one
+ * transport only.
  */
 export const MCP_TRANSPORTS = ['auto', 'streamable_http', 'sse'];

package/dist/lib/workflow/agentNode.d.ts

@@ -44,7 +44,8 @@
  *      run's `error`, and the scheduler fails the attempt with
  *      NodeReportedError, ADK's message, retried or stopping the walk as
  *      ADK's does, and reported once (by the node's own event). A run the turn stopped throws. A run that pauses on
- *      an ask_user tool call is refused by name.
+ *      an ask_user tool call, or on an approval or a question inside its
+ *      delegation, is refused by name.
  *   8. APPROVALS (ADR 0098). A run that pauses on approval requests (a tool
  *      in the agent's `require_approval`) resolves with their ids as the
  *      node's interrupts: the node waits and the walk ends paused, as an
@@ -62,6 +63,20 @@
  *      from its input on. ADK's runLlmAgentAsNode stores the input again and
  *      starts the agent afresh, so the pinned call never runs there; ADK
  *      turns refuse gates on workflow nodes instead.
+ *   9. OAUTH CONSENT (ADR 0128). The node's loop gets the turn's consent
+ *      step, its flows bound to the turn's app. A tool whose grant is
+ *      missing stores its `adk_request_credential` call as the node's event
+ *      (stamped, its id in longRunningToolIds) and the run ends paused: that
+ *      id is the node's interrupt, as an approval request's is. A delegated
+ *      call whose child waits for a grant (ADR 0118) leaves the call open;
+ *      the node raises a copy of the child's request on one event of its own
+ *      (`pausedOn`), under the same id. On the resume, a grant's answer
+ *      (`{ credentialKey, granted: true }`, never plain text) lets the run
+ *      continue as rule 8 lets an approval's: the loop's auth preprocessor
+ *      (interrupts.ts grantedCalls) runs the paused call again, or its
+ *      delegation resume carries the answer down the open call. Without one
+ *      the node waits again, its request raised again (`waitAgain`). A map
+ *      item runs without the consent step: it cannot pause the walk.
  *
  * `agentNodeRuntime` puts it together for the scheduler: a `runNode` for
  * agent nodes and map items, and an `onEvent` that stores the event ADK
@@ -69,7 +84,8 @@
  * (lib/workflow/nodeEvents.ts), so a session the native walk writes holds
  * what ADK's holds, in the same order.
  *
- * NOT HERE: an ask_user tool call inside a node, a pause inside a map item,
+ * NOT HERE: an ask_user tool call inside a node, an approval or a question
+ * inside a node's own delegation, a pause inside a map item,
  * tool nodes (lib/workflow/toolNode.ts) and ask_user nodes
  * (lib/workflow/pause.ts). It imports nothing from ADK.
  */
@@ -119,7 +135,7 @@ export interface AgentNodeContext {
  * one with no output. Throws NodeStoppedError when the turn stopped it, and
  * an Error when it paused on a person.
  */
-export declare function runAgentNode(agent: NativeAgent, run: Pick<NodeRun, 'input' | 'path' | 'branch' | 'signal' | 'resumeInputs' | 'resumedInterruptIds'>, ctx: AgentNodeContext): Promise<NodeResult>;
+export declare function runAgentNode(agent: NativeAgent, run: Pick<NodeRun, 'input' | 'path' | 'branch' | 'signal' | 'resumeInputs' | 'resumedInterruptIds'> & Partial<Pick<NodeRun, 'target'>>, ctx: AgentNodeContext): Promise<NodeResult>;
 export interface AgentNodeRuntimeOptions extends Omit<AgentNodeContext, 'appendInput'> {
     /** Every agent of the syndicate, compiled for native, by YAML name. */
     agents: ReadonlyMap<string, NativeAgent>;

package/dist/lib/workflow/agentNode.js

@@ -44,7 +44,8 @@
  *      run's `error`, and the scheduler fails the attempt with
  *      NodeReportedError, ADK's message, retried or stopping the walk as
  *      ADK's does, and reported once (by the node's own event). A run the turn stopped throws. A run that pauses on
- *      an ask_user tool call is refused by name.
+ *      an ask_user tool call, or on an approval or a question inside its
+ *      delegation, is refused by name.
  *   8. APPROVALS (ADR 0098). A run that pauses on approval requests (a tool
  *      in the agent's `require_approval`) resolves with their ids as the
  *      node's interrupts: the node waits and the walk ends paused, as an
@@ -62,6 +63,20 @@
  *      from its input on. ADK's runLlmAgentAsNode stores the input again and
  *      starts the agent afresh, so the pinned call never runs there; ADK
  *      turns refuse gates on workflow nodes instead.
+ *   9. OAUTH CONSENT (ADR 0128). The node's loop gets the turn's consent
+ *      step, its flows bound to the turn's app. A tool whose grant is
+ *      missing stores its `adk_request_credential` call as the node's event
+ *      (stamped, its id in longRunningToolIds) and the run ends paused: that
+ *      id is the node's interrupt, as an approval request's is. A delegated
+ *      call whose child waits for a grant (ADR 0118) leaves the call open;
+ *      the node raises a copy of the child's request on one event of its own
+ *      (`pausedOn`), under the same id. On the resume, a grant's answer
+ *      (`{ credentialKey, granted: true }`, never plain text) lets the run
+ *      continue as rule 8 lets an approval's: the loop's auth preprocessor
+ *      (interrupts.ts grantedCalls) runs the paused call again, or its
+ *      delegation resume carries the answer down the open call. Without one
+ *      the node waits again, its request raised again (`waitAgain`). A map
+ *      item runs without the consent step: it cannot pause the walk.
  *
  * `agentNodeRuntime` puts it together for the scheduler: a `runNode` for
  * agent nodes and map items, and an `onEvent` that stores the event ADK
@@ -69,13 +84,16 @@
  * (lib/workflow/nodeEvents.ts), so a session the native walk writes holds
  * what ADK's holds, in the same order.
  *
- * NOT HERE: an ask_user tool call inside a node, a pause inside a map item,
+ * NOT HERE: an ask_user tool call inside a node, an approval or a question
+ * inside a node's own delegation, a pause inside a map item,
  * tool nodes (lib/workflow/toolNode.ts) and ask_user nodes
  * (lib/workflow/pause.ts). It imports nothing from ADK.
  */
 import { APPROVAL_REQUEST } from '../runtime/approvals.js';
+import { CREDENTIAL_REQUEST, credentialRequestCall, isGrantAnswer } from '../runtime/credentials.js';
 import { createTurnEvent, getFunctionCalls } from '../runtime/events.js';
 import { runAgentLoop } from '../runtime/native/agentLoop.js';
+import { delegatedPauses } from '../runtime/native/interrupts.js';
 import { predecessorOutputs } from '../runtime/native/request.js';
 import { joinNodeEvent, mapNodeEvent } from './nodeEvents.js';
 import { routeStepEvent } from './route.js';
@@ -161,6 +179,28 @@ function nodeStamp(agent, run, invocationId, state) {
 function isApprovalRequest(event, id) {
     return !!event && getFunctionCalls(event).some((call) => call.id === id && call.name === APPROVAL_REQUEST);
 }
+/** The requests a node waits on and raises again: an approval request, or an OAuth consent request (ADR 0128). */
+const NODE_REQUESTS = new Set([APPROVAL_REQUEST, CREDENTIAL_REQUEST]);
+/** The name of the request call `id` the node's agent (`author`) stored, the latest first: an approval or a credential request, else undefined. */
+function requestNamed(events, author, id) {
+    for (let i = events.length - 1; i >= 0; i--) {
+        const event = events[i];
+        if (event.author !== author)
+            continue;
+        const call = getFunctionCalls(event).find((c) => c.id === id && c.name !== undefined && NODE_REQUESTS.has(c.name));
+        if (call)
+            return call.name;
+    }
+    return undefined;
+}
+/**
+ * Whether a resumed walk's answer to the node's request `id` answers it: a
+ * decision for an approval request (isApprovalAnswer), a grant's answer for
+ * a credential request (isGrantAnswer, ADR 0128).
+ */
+function answersRequest(events, author, id, value) {
+    return requestNamed(events, author, id) === CREDENTIAL_REQUEST ? isGrantAnswer(value) : isApprovalAnswer(value);
+}
 /**
  * Whether a resumed walk's answer to an approval request is a decision: a
  * ToolConfirmation (`{ confirmed }`), or ADK's `{ response: <json> }` form.
@@ -183,7 +223,7 @@ function outputAfter(events, path, ids) {
     const open = new Set(ids);
     let start = -1;
     events.forEach((event, i) => {
-        if (getFunctionCalls(event).some((call) => call.name === APPROVAL_REQUEST && call.id !== undefined && open.has(call.id)))
+        if (getFunctionCalls(event).some((call) => call.name !== undefined && NODE_REQUESTS.has(call.name) && call.id !== undefined && open.has(call.id)))
             start = i;
     });
     if (start === -1)
@@ -203,9 +243,20 @@ function outputAfter(events, path, ids) {
  */
 async function waitAgain(agent, run, ctx, waiting) {
     const open = new Set(waiting);
-    const calls = ctx.session.events.flatMap((event) => getFunctionCalls(event).filter((call) => call.name === APPROVAL_REQUEST && call.id !== undefined && open.has(call.id)));
+    const calls = ctx.session.events
+        .filter((event) => event.author === agent.name)
+        .flatMap((event) => getFunctionCalls(event).filter((call) => call.name !== undefined && NODE_REQUESTS.has(call.name) && call.id !== undefined && open.has(call.id)));
     const seen = new Set();
     const parts = calls.filter((call) => !seen.has(call.id) && seen.add(call.id)).map((call) => ({ functionCall: structuredClone(call) }));
+    return raise(agent, run, ctx, parts);
+}
+/**
+ * Stores `parts` (request calls) as one event of the node's run, stamped as
+ * the node's, their ids in `longRunningToolIds` (the walk's interrupts), and
+ * resolves with those ids: the node waits on them.
+ */
+async function raise(agent, run, ctx, parts) {
+    const seen = new Set(parts.map((p) => p.functionCall?.id));
     const event = createTurnEvent({ author: agent.name, invocationId: ctx.invocationId, content: { role: 'model', parts } });
     event.longRunningToolIds = [...seen];
     nodeStamp(agent, run, ctx.invocationId, { output: undefined })(event);
@@ -213,6 +264,50 @@ async function waitAgain(agent, run, ctx, waiting) {
     ctx.onEvent?.(stored);
     return { interruptIds: [...seen] };
 }
+/**
+ * Rules 8 and 9, a run that ended paused: the ids the node waits on. An
+ * approval request and the node's own OAuth consent request (its
+ * `adk_request_credential` call, already stored as the node's event) are
+ * the walk's interrupts as they are. A delegated call the agent left open
+ * whose child waits for a grant (ADR 0118) is raised again on the walk as a
+ * copy of the child's credential request, under its id (ADR 0128), so the
+ * walk pauses on what the turn asks the person for and its resume reruns
+ * the node with the grant's answer, which the loop's delegation resume
+ * carries down the open call. Any other pause (an ask_user call, an
+ * approval or a question inside the node's delegation) is refused by name.
+ */
+async function pausedOn(agent, run, ctx, end) {
+    const pending = end.pending ?? [];
+    const refuse = () => {
+        throw new Error(`Node '${agent.name}' paused on ${pending.join(', ')}: a pause inside an agent node other than an approval or an OAuth consent does not run on the native runtime yet.`);
+    };
+    if (pending.length === 0)
+        refuse();
+    if (pending.every((id) => isApprovalRequest(end.lastEvent, id)))
+        return { interruptIds: [...pending] };
+    // A map item never pauses: it runs without the consent step (agentNodeRuntime), so it has no request to wait on.
+    if (run.target?.kind === 'map_item')
+        refuse();
+    const { session, sessions } = ctx;
+    const ids = [];
+    const raised = [];
+    let below;
+    for (const id of pending) {
+        if (isApprovalRequest(end.lastEvent, id) || requestNamed(session.events, agent.name, id) === CREDENTIAL_REQUEST) {
+            ids.push(id);
+            continue;
+        }
+        below ??= await delegatedPauses({ sessions, userId: session.userId, sessionId: session.id, appName: session.appName }, session.events, agent.name);
+        const consent = below.find((pause) => pause.callIds[0] === id)?.consent;
+        if (!consent)
+            refuse();
+        ids.push(consent.id);
+        raised.push({ functionCall: credentialRequestCall(consent) });
+    }
+    if (raised.length > 0)
+        await raise(agent, run, ctx, raised);
+    return { interruptIds: ids };
+}
 /**
  * Runs `agent` as the node `run` names, on the native loop, and resolves
  * with the node's output, or with the error it reported when it ended on
@@ -226,7 +321,7 @@ export async function runAgentNode(agent, run, ctx) {
     // Rule 8: a node that waited on an approval resumes its own run once every request it raised is answered.
     const resumed = run.resumedInterruptIds ?? [];
     if (resumed.length > 0) {
-        const waiting = resumed.filter((id) => !isApprovalAnswer(run.resumeInputs?.[id]));
+        const waiting = resumed.filter((id) => !answersRequest(ctx.session.events, agent.name, id, run.resumeInputs?.[id]));
         if (waiting.length > 0)
             return waitAgain(agent, run, ctx, waiting);
         const finished = outputAfter(ctx.session.events, run.path, resumed);
@@ -265,13 +360,8 @@ export async function runAgentNode(agent, run, ctx) {
         else
             ctx.onEvent?.(next.value);
     }
-    if (end.reason === 'paused') {
-        // Rule 8: an approval request pauses the node, and the walk with it; any other pause (an ask_user call) is refused.
-        const pending = end.pending ?? [];
-        if (pending.length > 0 && pending.every((id) => isApprovalRequest(end.lastEvent, id)))
-            return { interruptIds: [...pending] };
-        throw new Error(`Node '${agent.name}' paused on ${pending.join(', ')}: a pause inside an agent node other than an approval does not run on the native runtime yet.`);
-    }
+    if (end.reason === 'paused')
+        return pausedOn(agent, run, ctx, end);
     if (end.reason === 'stopped')
         throw new NodeStoppedError(agent.name, end.stop);
     // ADK's failIfNodeReportedError: an error with an output is not the node's failure. Without one the error is
@@ -320,6 +410,8 @@ export function agentNodeRuntime(options) {
             return stored;
         },
     };
+    const { consent: _consent, ...mapLoop } = ctx.loop ?? {};
+    const mapCtx = { ...ctx, loop: mapLoop };
     const agentNamed = (name) => {
         const agent = agents.get(name);
         if (!agent)
@@ -337,8 +429,9 @@ export function agentNodeRuntime(options) {
             return options.workflowNodes.run(target.name, run);
         if (target.kind === 'agent')
             return runAgentNode(agentNamed(target.name), run, ctx);
+        // A map item cannot pause the walk (ADR 0094): it runs without the consent step, so a missing grant is its tool's error (ADR 0128).
         if (target.kind === 'map_item')
-            return runAgentNode(agentNamed(target.agent), run, ctx);
+            return runAgentNode(agentNamed(target.agent), run, mapCtx);
         if (options.next)
             return options.next(run);
         throw new Error(`agentNodeRunner runs agent nodes and map items only; ${target.name} is a ${target.kind} run`);

package/dist/lib/workflow/resume.d.ts

@@ -120,11 +120,11 @@ export declare function workflowNodeInput(content: TurnContent | undefined): unk
 export declare function resumeInputsFromPlainText(content: TurnContent | undefined, events: readonly StoredEvent[], invocationId: string): Record<string, unknown>;
 /**
  * A pause the native walk cannot resume: one raised inside an agent node
- * other than an approval (an `ask_user` tool call, a credential request) or
- * inside a map item. ADK resumes those inside the node (the agent's own
- * history, the ParallelWorker's item); the native agent node pauses only on
- * an approval (lib/workflow/agentNode.ts, ADR 0098), so it cannot pick the
- * others up. Resuming the walk anyway would run the node again from its
+ * other than an approval or an OAuth consent request (an `ask_user` tool
+ * call) or inside a map item. ADK resumes those inside the node (the
+ * agent's own history, the ParallelWorker's item); the native agent node
+ * pauses only on an approval (lib/workflow/agentNode.ts, ADR 0098) or a
+ * consent request (ADR 0128), so it cannot pick the others up. Resuming the walk anyway would run the node again from its
  * input and ask again, so the resume refuses by name instead.
  */
 export declare class UnsupportedWorkflowResumeError extends Error {
@@ -135,8 +135,9 @@ export declare class UnsupportedWorkflowResumeError extends Error {
 /**
  * Throws UnsupportedWorkflowResumeError for the first interrupt in the run's
  * events that is neither an ask_user node's input request nor an agent
- * node's approval request at a direct child of the workflow (the workflow's
- * own record aside).
+ * node's approval or credential request at a direct child of the workflow
+ * (the workflow's own record aside). A credential request it cannot read
+ * (no paused call's id, no auth config) does not resume.
  */
 export declare function assertResumable(runEvents: readonly StoredEvent[], workflowPath: string): void;
 export interface WorkflowResumeRequest {