managed-deepagents 0.6.2.dev29__py3-none-win_amd64.whl → 0.6.2.dev30__py3-none-win_amd64.whl

managed_deepagents/__init__.py

@@ -9,18 +9,18 @@ This package provides two things:
 
 Resources use ``define_*`` factories while provider collections use namespaces:
 ``define_sandbox()``, ``channels.slack(...)``, ``connectors.mcp(...)``,
-``connections.get(...)``, and ``auth.supabase(...)``. Contributing a *new*
+``credentials.get(...)``, and ``auth.supabase(...)``. Contributing a *new*
 primitive is not part of the public surface.
 """
 
 from __future__ import annotations
 
-from managed_deepagents._connections import (
-    ConnectionNotFoundError,
+from managed_deepagents._credentials import (
     CredentialAuthorizationRequiredError,
+    CredentialNotFoundError,
+    CredentialOwner,
     CredentialStoreError,
-    InvalidAgentAuthEndpointError,
-    connections,
+    credentials,
 )
 from managed_deepagents._managed_tools import (
     ManagedDeepAgentRuntime,
@@ -38,19 +38,19 @@ from managed_deepagents.sandbox import SandboxDefinition
 from managed_deepagents.schedules import define_schedule
 
 __all__ = [
-    "ConnectionNotFoundError",
     "CredentialAuthorizationRequiredError",
+    "CredentialNotFoundError",
+    "CredentialOwner",
     "CredentialStoreError",
     "DeepAgentDefinition",
-    "InvalidAgentAuthEndpointError",
     "ManagedDeepAgentRuntime",
     "ManagedServerInfo",
     "MemoryDefinition",
     "SandboxDefinition",
     "auth",
     "channels",
-    "connections",
     "connectors",
+    "credentials",
     "define_deep_agent",
     "define_identity",
     "define_memory",

managed_deepagents/_agent_auth.py

@@ -1,4 +1,4 @@
-"""Agent Auth client used by ``connections.get`` and the pre-run credential gate.
+"""Agent Auth client used by ``credentials.get`` and the pre-run credential gate.
 
 Talks to the shipped Agent Auth APIs (credentials + oauth-authorization-sessions),
 not the aspirational ``credentials/mint`` endpoint.
@@ -33,7 +33,6 @@ __all__ = [
     "AgentAuthUnknownProviderError",
     "CredentialAuthorizationRequiredError",
     "PendingAuthorization",
-    "WorkspaceConnection",
 ]
 
 
@@ -46,29 +45,20 @@ class AgentAuthContext:
     principal_id: str
     api_key: str | None = None
     workspace_id: str | None = None
-    #: Agent Builder service JWT for workspace-owned credential material.
-    service_key: str | None = None
 
 
 class PendingAuthorization(TypedDict):
-    """One connection slug the caller has not granted, with its connect URL."""
+    """One credential slug the caller has not granted, with its connect URL."""
 
     slug: str
     connect_url: str
     auth_id: str
 
 
-@dataclass(frozen=True)
-class WorkspaceConnection:
-    connection_id: str
-    kind: str
-    owner_policy: str
-
-
 class CredentialAuthorizationRequiredError(RuntimeError):
     def __init__(self, slugs: list[str]) -> None:
         super().__init__(
-            f"the caller has not connected: {', '.join(slugs)}. Declare the connection "
+            f"the caller has not connected: {', '.join(slugs)}. Declare the credential "
             "on a connector so the pre-run gate can request it."
         )
         self.slugs = slugs
@@ -116,124 +106,6 @@ class AgentAuth:
         self._timeout = timeout
         self._request: AgentAuthRequest = request if request is not None else self._urlopen_json
 
-    def find_workspace_connection(self, slug: str) -> WorkspaceConnection | None:
-        """List workspace connections and return the row for ``slug``, if any."""
-        if not (self.context.workspace_id or "").strip():
-            raise CredentialStoreError(
-                "connections are not configured: LANGSMITH_WORKSPACE_ID is not set"
-            )
-        cursor: str | None = None
-        for _ in range(AGENT_AUTH_MAX_PROVIDER_PAGES):
-            query: dict[str, str] = {
-                "page_size": str(AGENT_AUTH_PROVIDER_PAGE_SIZE),
-            }
-            if cursor:
-                query["cursor"] = cursor
-            status, body = self._request(
-                "GET",
-                f"/v1/agent-auth/connections?{urllib.parse.urlencode(query)}",
-            )
-            if status >= _HTTP_BAD_REQUEST:
-                raise CredentialStoreError("Agent Auth list connections failed", status)
-            raw_items = body.get("items")
-            items = raw_items if isinstance(raw_items, list) else []
-            for item in items:
-                if not isinstance(item, Mapping) or item.get("slug") != slug:
-                    continue
-                connection_id = (
-                    item.get("id") or item.get("connection_id") or item.get("credential_id")
-                )
-                kind = _connection_credential_kind(item)
-                owner_policy = item.get("owner_policy")
-                if not isinstance(connection_id, str) or not connection_id:
-                    raise CredentialStoreError("Agent Auth connection row missing id or kind")
-                if not isinstance(kind, str) or not kind:
-                    raise CredentialStoreError("Agent Auth connection row missing id or kind")
-                return WorkspaceConnection(
-                    connection_id=connection_id,
-                    kind=kind,
-                    owner_policy=str(owner_policy) if isinstance(owner_policy, str) else "",
-                )
-            next_cursor = body.get("next_cursor")
-            if not isinstance(next_cursor, str) or not next_cursor or next_cursor == cursor:
-                return None
-            cursor = next_cursor
-        raise CredentialStoreError("Agent Auth connection list returned too many pages")
-
-    def find_workspace_credential_id(self, slug: str) -> str | None:
-        """Workspace credential id for an agent-owned opaque secret grant."""
-        connection = self.find_workspace_connection(slug)
-        if connection is None:
-            return None
-        return self.find_secret_credential_id(connection, slug)
-
-    def find_secret_credential_id(self, connection: WorkspaceConnection, slug: str) -> str | None:
-        """Resolve the credential id for a secret connection row.
-
-        With an Agent Builder service key, prefer GET-for-owner / workspace list.
-        Personal API keys may only list agent-owned credentials.
-        """
-        if connection.kind != "secret":
-            return None
-        workspace_id = (self.context.workspace_id or "").strip()
-        if not workspace_id:
-            raise CredentialStoreError(
-                "connections are not configured: LANGSMITH_WORKSPACE_ID is not set"
-            )
-        if (self.context.service_key or "").strip():
-            from_owner = self._credential_id_for_owner(
-                connection.connection_id, "workspace", workspace_id
-            )
-            if from_owner is not None:
-                return from_owner
-            return self.find_credential_id(
-                owner_type="workspace",
-                owner_id=workspace_id,
-                kind="secret",
-                slug=slug,
-            )
-        return self.find_credential_id(
-            owner_type="agent",
-            owner_id=self.context.agent_id,
-            kind="secret",
-            slug=slug,
-        )
-
-    def _credential_id_for_owner(
-        self, connection_id: str, owner_type: str, owner_id: str
-    ) -> str | None:
-        query = urllib.parse.urlencode(
-            {
-                "credential_owner_type": owner_type,
-                "credential_owner_id": owner_id,
-            }
-        )
-        status, body = self._request(
-            "GET",
-            f"/v1/agent-auth/connections/{_path_segment(connection_id)}?{query}",
-        )
-        if status == _HTTP_NOT_FOUND:
-            return None
-        if status >= _HTTP_BAD_REQUEST:
-            raise CredentialStoreError("Agent Auth get connection for owner failed", status)
-        return _connection_credential_id(body)
-
-    def read_user_secret(self, slug: str) -> str | None:
-        """Read a caller-owned opaque secret grant for a workspace connection slug."""
-        credential_id = self.find_credential_id(
-            owner_type="user",
-            owner_id=self.context.principal_id,
-            kind="secret",
-            slug=slug,
-        )
-        if credential_id is None:
-            return None
-        return self.read_secret(credential_id)
-
-    def read_connection_access_token(self, connection_id: str) -> str | None:
-        """Read an OAuth access token stored on a workspace connection row."""
-        return self._fetch_access_token(connection_id)
-
     def read_user_access_token(self, slug: str) -> str | None:
         """Read the caller's OAuth access token without starting a session.
 
@@ -256,16 +128,12 @@ class AgentAuth:
 
     def start_authorization_session(self, slug: str) -> PendingAuthorization:
         """Start an OAuth session for a slug the caller has not granted."""
-        connection = self.find_workspace_connection(slug)
-        if connection is None:
-            raise CredentialStoreError(f"workspace connection {slug!r} is not configured")
-        if connection.kind != "oauth2":
-            raise CredentialStoreError(f"connection {slug!r} is not an OAuth connection")
+        provider_id = self.resolve_oauth_provider_id(slug)
         status, body = self._request(
             "POST",
             "/v1/agent-auth/oauth-authorization-sessions",
             body={
-                "connection_id": connection.connection_id,
+                "provider_id": provider_id,
                 "principal_id": self.context.principal_id,
                 "agent_id": self.context.agent_id,
             },
@@ -314,35 +182,18 @@ class AgentAuth:
     ) -> str | None:
         """Find a credential id by slug.
 
-        The shipped credentials list filters by owner and kind only, so the
-        slug match is made client-side across pages. The credential key is
-        ``credential_id``, never ``id``.
+        The credential key is ``credential_id``, never ``id``.
         """
-        cursor: str | None = None
-        for _ in range(AGENT_AUTH_MAX_PROVIDER_PAGES):
-            query = agent_auth_credential_query(
-                owner_type=owner_type,
-                owner_id=owner_id,
-                kind=kind,
-                page_size=AGENT_AUTH_PROVIDER_PAGE_SIZE,
-                cursor=cursor,
-            )
-            status, body = self._request("GET", f"/v1/agent-auth/credentials?{query}")
-            if status >= _HTTP_BAD_REQUEST:
-                raise CredentialStoreError("Agent Auth list credentials failed", status)
-            raw_items = body.get("items")
-            items = raw_items if isinstance(raw_items, list) else []
-            for item in items:
-                if not isinstance(item, Mapping) or item.get("slug") != slug:
-                    continue
-                credential_id = item.get("credential_id")
-                if isinstance(credential_id, str) and credential_id:
-                    return credential_id
-            next_cursor = body.get("next_cursor")
-            if not isinstance(next_cursor, str) or not next_cursor or next_cursor == cursor:
-                return None
-            cursor = next_cursor
-        raise CredentialStoreError("Agent Auth credential list returned too many pages")
+        query = agent_auth_credential_query(
+            owner_type=owner_type, owner_id=owner_id, kind=kind, slug=slug
+        )
+        status, body = self._request("GET", f"/v1/agent-auth/credentials?{query}")
+        if status >= _HTTP_BAD_REQUEST:
+            raise CredentialStoreError("Agent Auth list credentials failed", status)
+        items = body.get("items")
+        row = items[0] if isinstance(items, list) and items else None
+        credential_id = row.get("credential_id") if isinstance(row, Mapping) else None
+        return credential_id if isinstance(credential_id, str) else None
 
     def read_secret(self, credential_id: str) -> str | None:
         status, body = self._request(
@@ -390,7 +241,6 @@ class AgentAuth:
         return agent_auth_headers(
             api_key=self.context.api_key,
             workspace_id=self.context.workspace_id,
-            service_key=self.context.service_key,
         )
 
 
@@ -398,24 +248,6 @@ def _path_segment(value: str) -> str:
     return urllib.parse.quote(value, safe="")
 
 
-def _connection_credential_kind(item: Mapping[str, object]) -> str:
-    credential = item.get("credential")
-    if isinstance(credential, Mapping):
-        kind = credential.get("kind")
-        if isinstance(kind, str) and kind:
-            return kind
-    kind = item.get("kind")
-    return kind if isinstance(kind, str) else ""
-
-
-def _connection_credential_id(body: Mapping[str, object]) -> str | None:
-    credential = body.get("credential")
-    if not isinstance(credential, Mapping):
-        return None
-    credential_id = credential.get("credential_id")
-    return credential_id if isinstance(credential_id, str) and credential_id else None
-
-
 def _is_authorization_required(status: int, body: dict[str, object]) -> bool:
     """Agent Auth answers 409 when a stored grant has lapsed and needs re-auth."""
     if status != _HTTP_CONFLICT:

managed_deepagents/_agent_auth_http.py

@@ -46,40 +46,24 @@ def agent_auth_credential_query(
     owner_type: str,
     owner_id: str,
     kind: str,
-    page_size: int | None = None,
-    cursor: str | None = None,
+    slug: str,
 ) -> str:
-    """Query string for listing credentials filtered by owner and kind.
-
-    The shipped list endpoint does not filter by slug; callers match ``slug``
-    client-side across pages.
-    """
-    params: dict[str, str] = {
-        "owner_type": owner_type,
-        "owner_id": owner_id,
-        "kind": kind,
-    }
-    if page_size is not None:
-        params["page_size"] = str(page_size)
-    if cursor:
-        params["cursor"] = cursor
-    return urllib.parse.urlencode(params)
+    """Query string that addresses one credential by its natural key."""
+    return urllib.parse.urlencode(
+        {"owner_type": owner_type, "owner_id": owner_id, "kind": kind, "slug": slug}
+    )
 
 
 def agent_auth_headers(
     *,
     api_key: str | None = None,
     workspace_id: str | None = None,
-    service_key: str | None = None,
 ) -> dict[str, str]:
     headers = {
         "accept": "application/json",
         "content-type": "application/json",
         "x-langsmith-product": "mda",
     }
-    resolved_service_key = (service_key or "").strip()
-    if resolved_service_key:
-        headers["x-service-key"] = resolved_service_key
     resolved_api_key = (api_key or "").strip()
     if resolved_api_key:
         headers["x-api-key"] = resolved_api_key

managed_deepagents/_channels/manifest.py

@@ -17,8 +17,6 @@ JsonObject = dict[str, JsonValue]
 class _OptionalChannelManifest(TypedDict, total=False):
     transport: Literal["trigger_server"]
     userCredentials: list[str]
-    userConnections: list[str]
-    agentConnections: list[str]
 
 
 class ChannelManifest(_OptionalChannelManifest):

managed_deepagents/_channels/trigger/http.py

@@ -250,7 +250,7 @@ async def _observe_accepted_run(
                 event["channel_id"],
                 {
                     "type": "post",
-                    "action_id": event["event_id"],
+                    "action_id": str(uuid.uuid4()),
                     "address": event["address"],
                     "source_thread_key": event["source_thread_key"],
                     "message": {"text": text},

managed_deepagents/_connectors/mcp/__init__.py

@@ -9,7 +9,7 @@ name, before any managed ``{server}__`` prefix is applied.
 Example::
 
     # connectors/mcp.py
-    from managed_deepagents import connectors, connections
+    from managed_deepagents import connectors, credentials
 
     connector = connectors.mcp(
         use_standard_content_blocks=True,
@@ -24,7 +24,7 @@ Example::
             "notion": {
                 "transport": "http",
                 "url": "https://mcp.notion.com/mcp",
-                "connection": connections.get("notion", {"type": "user"}),
+                "credential": credentials.get("notion", {"type": "user"}),
             },
         },
     )
@@ -33,7 +33,6 @@ Example::
 from __future__ import annotations
 
 import math
-import warnings
 from collections.abc import Mapping, Sequence
 from typing import TYPE_CHECKING, Annotated, Any, Literal, TypedDict, cast
 
@@ -46,9 +45,9 @@ from pydantic import (
     model_validator,
 )
 
-from managed_deepagents._connections import ConnectionReference, is_connection_reference
 from managed_deepagents._connector import Connector
 from managed_deepagents._connectors.mcp.load import load_managed_mcp_tools
+from managed_deepagents._credentials import CredentialReference
 from managed_deepagents._extension import define_extension
 
 if TYPE_CHECKING:
@@ -63,9 +62,9 @@ class McpToolSelectionConfig(TypedDict, total=False):
 class RemoteMcpServerBaseConfig(McpToolSelectionConfig, total=False):
     url: str
     headers: dict[str, str]
-    #: Bearer connection: an agent owner is a deployment-wide secret read once
-    #: at load, a user owner is the caller's grant loaded after the gate.
-    connection: ConnectionReference
+    #: Bearer credential: an agent owner is a deployment-wide secret read once
+    #: at load, a user owner is the caller's OAuth grant loaded after the gate.
+    credential: CredentialReference
     #: Default timeout in seconds for tools loaded from this server.
     default_tool_timeout: float
 
@@ -124,26 +123,20 @@ class McpServersDefinition(Connector):
         return load_managed_mcp_tools(self)
 
     def requirements(self, name: str) -> ChannelManifest:
-        """Describe user and agent connections that deploy must validate."""
-        user_slugs: set[str] = set()
-        agent_slugs: set[str] = set()
-        for server in self.config["mcp_servers"].values():
-            connection = server.get("connection") if isinstance(server, dict) else None
-            if not is_connection_reference(connection):
-                continue
-            if connection.owner["type"] == "user":
-                user_slugs.add(connection.slug)
-            else:
-                agent_slugs.add(connection.slug)
+        """Describe user credentials that deploy must validate."""
+        slugs = {
+            credential.slug
+            for server in self.config["mcp_servers"].values()
+            if isinstance((credential := server.get("credential")), CredentialReference)
+            and credential.owner["type"] == "user"
+        }
         return {
             "name": name,
             "provider": "mcp",
             "autoReply": False,
             "requiredPermissions": [],
             "requiredEnv": [],
-            "userConnections": sorted(user_slugs),
-            "agentConnections": sorted(agent_slugs),
-            "userCredentials": sorted(user_slugs),
+            "userCredentials": sorted(slugs),
             "providerConfig": {},
         }
 
@@ -159,12 +152,6 @@ _STDIO_REJECTION = (
     "HTTP or write a normal authored tool instead."
 )
 
-_CREDENTIAL_FIELD_DEPRECATION = (
-    'the "credential" MCP server field is deprecated; use "connection" instead'
-)
-
-_CREDENTIAL_FIELD_CONFLICT = 'use either "connection" or "credential", not both'
-
 
 def _non_empty_tool_name(name: str) -> str:
     if not name.strip():
@@ -197,16 +184,7 @@ class _RemoteMcpServer(BaseModel):
     default_tool_timeout: float | None = None
     include_tools: list[_ToolName] | None = None
     exclude_tools: list[_ToolName] | None = None
-    connection: ConnectionReference | None = None
-
-    @field_validator("connection")
-    @classmethod
-    def _valid_connection(
-        cls, connection: ConnectionReference | None
-    ) -> ConnectionReference | None:
-        if connection is not None and not is_connection_reference(connection):
-            raise ValueError("must be a connections.get(slug, owner) reference")
-        return connection
+    credential: CredentialReference | None = None
 
     @field_validator("default_tool_timeout")
     @classmethod
@@ -217,19 +195,12 @@ class _RemoteMcpServer(BaseModel):
 
     @model_validator(mode="before")
     @classmethod
-    def _normalize_legacy_fields(cls, server: Any) -> Any:
-        if not isinstance(server, Mapping):
-            return server
-        if server.get("transport") == "stdio" or "command" in server:
+    def _reject_stdio(cls, server: Any) -> Any:
+        if isinstance(server, Mapping) and (
+            server.get("transport") == "stdio" or "command" in server
+        ):
             raise ValueError(_STDIO_REJECTION)
-        if "credential" not in server:
-            return server
-        if "connection" in server:
-            raise ValueError(_CREDENTIAL_FIELD_CONFLICT)
-        warnings.warn(_CREDENTIAL_FIELD_DEPRECATION, DeprecationWarning, stacklevel=1)
-        normalized = dict(server)
-        normalized["connection"] = normalized.pop("credential")
-        return normalized
+        return server
 
     @field_validator("transport", mode="before")
     @classmethod