managed-deepagents 0.6.2.dev36__py3-none-win_amd64.whl → 0.6.2.dev37__py3-none-win_amd64.whl

managed_deepagents/_agent_auth.py

@@ -23,7 +23,6 @@ AGENT_AUTH_PROVIDER_PAGE_SIZE = 100
 AGENT_AUTH_MAX_PROVIDER_PAGES = 20
 
 _HTTP_BAD_REQUEST = 400
-_HTTP_FORBIDDEN = 403
 _HTTP_NOT_FOUND = 404
 _HTTP_CONFLICT = 409
 
@@ -47,6 +46,8 @@ class AgentAuthContext:
     principal_id: str
     api_key: str | None = None
     workspace_id: str | None = None
+    #: Agent Builder service JWT for workspace-owned credential material.
+    service_key: str | None = None
 
 
 class PendingAuthorization(TypedDict):
@@ -133,7 +134,7 @@ class AgentAuth:
                 f"/v1/agent-auth/connections?{urllib.parse.urlencode(query)}",
             )
             if status >= _HTTP_BAD_REQUEST:
-                raise CredentialStoreError("Agent Auth list connections failed", status, body)
+                raise CredentialStoreError("Agent Auth list connections failed", status)
             raw_items = body.get("items")
             items = raw_items if isinstance(raw_items, list) else []
             for item in items:
@@ -169,17 +170,28 @@ class AgentAuth:
     def find_secret_credential_id(self, connection: WorkspaceConnection, slug: str) -> str | None:
         """Resolve the credential id for a secret connection row.
 
-        Agent-owned connection declarations scope the credential to this
-        deployment. Workspace-owned credentials are deliberately not visible
-        to deployments.
+        With an Agent Builder service key, prefer GET-for-owner / workspace list.
+        Personal API keys may only list agent-owned credentials.
         """
         if connection.kind != "secret":
             return None
-        from_agent = self._credential_id_for_owner(
-            connection.connection_id, "agent", self.context.agent_id
-        )
-        if from_agent is not None:
-            return from_agent
+        workspace_id = (self.context.workspace_id or "").strip()
+        if not workspace_id:
+            raise CredentialStoreError(
+                "connections are not configured: LANGSMITH_WORKSPACE_ID is not set"
+            )
+        if (self.context.service_key or "").strip():
+            from_owner = self._credential_id_for_owner(
+                connection.connection_id, "workspace", workspace_id
+            )
+            if from_owner is not None:
+                return from_owner
+            return self.find_credential_id(
+                owner_type="workspace",
+                owner_id=workspace_id,
+                kind="secret",
+                slug=slug,
+            )
         return self.find_credential_id(
             owner_type="agent",
             owner_id=self.context.agent_id,
@@ -190,12 +202,6 @@ class AgentAuth:
     def _credential_id_for_owner(
         self, connection_id: str, owner_type: str, owner_id: str
     ) -> str | None:
-        """Read credential_id from GET /connections/{id}?credential_owner_*.
-
-        Deployments authenticate with ``LANGSMITH_API_KEY`` (the minted
-        service-account key). User and workspace owners additionally require
-        workspace management permission.
-        """
         query = urllib.parse.urlencode(
             {
                 "credential_owner_type": owner_type,
@@ -209,27 +215,16 @@ class AgentAuth:
         if status == _HTTP_NOT_FOUND:
             return None
         if status >= _HTTP_BAD_REQUEST:
-            raise CredentialStoreError(
-                "Agent Auth get connection for owner failed"
-                + (" (forbidden)" if status == _HTTP_FORBIDDEN else ""),
-                status,
-                body,
-            )
+            raise CredentialStoreError("Agent Auth get connection for owner failed", status)
         return _connection_credential_id(body)
 
     def read_user_secret(self, slug: str) -> str | None:
         """Read a caller-owned opaque secret grant for a workspace connection slug."""
-        connection = self.find_workspace_connection(slug)
-        if connection is None:
-            return None
-        return self.read_user_secret_for_connection(connection)
-
-    def read_user_secret_for_connection(self, connection: WorkspaceConnection) -> str | None:
-        """Read a caller-owned opaque secret when the connection row is already loaded."""
-        if connection.kind != "secret":
-            return None
-        credential_id = self._credential_id_for_owner(
-            connection.connection_id, "user", self.context.principal_id
+        credential_id = self.find_credential_id(
+            owner_type="user",
+            owner_id=self.context.principal_id,
+            kind="secret",
+            slug=slug,
         )
         if credential_id is None:
             return None
@@ -249,17 +244,11 @@ class AgentAuth:
         Returns:
             The access token, or ``None`` when the caller must connect.
         """
-        connection = self.find_workspace_connection(slug)
-        if connection is None:
-            return None
-        return self.read_user_access_token_for_connection(connection)
-
-    def read_user_access_token_for_connection(self, connection: WorkspaceConnection) -> str | None:
-        """Read a caller OAuth token when the connection row is already loaded."""
-        if connection.kind != "oauth2":
-            return None
-        credential_id = self._credential_id_for_owner(
-            connection.connection_id, "user", self.context.principal_id
+        credential_id = self.find_credential_id(
+            owner_type="user",
+            owner_id=self.context.principal_id,
+            kind="oauth2",
+            slug=slug,
         )
         if credential_id is None:
             return None
@@ -283,7 +272,7 @@ class AgentAuth:
         )
         if status >= _HTTP_BAD_REQUEST:
             raise CredentialStoreError(
-                "Agent Auth create oauth-authorization-session failed", status, body
+                "Agent Auth create oauth-authorization-session failed", status
             )
         auth_id = str(body.get("id") or "")
         connect_url = str(body.get("verification_url") or "")
@@ -304,7 +293,7 @@ class AgentAuth:
                 "GET", f"/v1/agent-auth/oauth-providers?{urllib.parse.urlencode(query)}"
             )
             if status >= _HTTP_BAD_REQUEST:
-                raise CredentialStoreError("Agent Auth list oauth-providers failed", status, body)
+                raise CredentialStoreError("Agent Auth list oauth-providers failed", status)
             raw_items = body.get("items")
             for item in raw_items if isinstance(raw_items, list) else []:
                 if isinstance(item, Mapping) and item.get("slug") == slug and item.get("id"):
@@ -340,7 +329,7 @@ class AgentAuth:
             )
             status, body = self._request("GET", f"/v1/agent-auth/credentials?{query}")
             if status >= _HTTP_BAD_REQUEST:
-                raise CredentialStoreError("Agent Auth list credentials failed", status, body)
+                raise CredentialStoreError("Agent Auth list credentials failed", status)
             raw_items = body.get("items")
             items = raw_items if isinstance(raw_items, list) else []
             for item in items:
@@ -363,7 +352,7 @@ class AgentAuth:
         if status == _HTTP_NOT_FOUND:
             return None
         if status >= _HTTP_BAD_REQUEST:
-            raise CredentialStoreError("Agent Auth get secret failed", status, body)
+            raise CredentialStoreError("Agent Auth get secret failed", status)
         secret = body.get("secret")
         return secret if isinstance(secret, str) and secret else None
 
@@ -375,7 +364,7 @@ class AgentAuth:
         if _is_authorization_required(status, body):
             return None
         if status >= _HTTP_BAD_REQUEST:
-            raise CredentialStoreError("Agent Auth get oauth2 failed", status, body)
+            raise CredentialStoreError("Agent Auth get oauth2 failed", status)
         oauth2 = body.get("oauth2") if isinstance(body.get("oauth2"), dict) else body
         token = oauth2.get("access_token") if isinstance(oauth2, dict) else None
         return token if isinstance(token, str) and token else None
@@ -401,6 +390,7 @@ class AgentAuth:
         return agent_auth_headers(
             api_key=self.context.api_key,
             workspace_id=self.context.workspace_id,
+            service_key=self.context.service_key,
         )
 
 

managed_deepagents/_agent_auth_http.py

@@ -11,68 +11,32 @@ import urllib.error
 import urllib.parse
 import urllib.request
 from collections.abc import Mapping
-from typing import TYPE_CHECKING, Final
+from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
     from http.client import HTTPMessage
     from typing import IO
 
 AGENT_AUTH_TIMEOUT_SECONDS = 10.0
-AGENT_AUTH_PROBLEM_HINT_MAX_CHARS = 200
-_PROBLEM_HINT_FIELDS: Final = ("detail", "remedy")
-
-
-def agent_auth_problem_hint(body: Mapping[str, object] | None) -> str | None:
-    """Return the caller-facing part of an Agent Auth problem+json body.
-
-    ``detail`` names the failure and ``remedy`` names the fix. Nothing else
-    from a response body is read, because the rest can quote secret material.
-    Both are collapsed to one line and truncated so a long or multi-line body
-    cannot reshape an error message.
-    """
-    seen: dict[str, None] = {}
-    for field in _PROBLEM_HINT_FIELDS:
-        value = None if body is None else body.get(field)
-        if not isinstance(value, str):
-            continue
-        text = " ".join(value.split())
-        if text:
-            seen[text] = None
-    if not seen:
-        return None
-    hint = " ".join(seen)
-    if len(hint) > AGENT_AUTH_PROBLEM_HINT_MAX_CHARS:
-        return hint[:AGENT_AUTH_PROBLEM_HINT_MAX_CHARS] + "..."
-    return hint
 
 
 class CredentialStoreError(RuntimeError):
     """Agent Auth could not answer.
 
-    Callers pass a fixed message; the only part of a response body that reaches
-    this error, the logs, or the traceback chain is the allow-listed
-    problem+json hint, since an arbitrary body can quote secret material.
+    Callers pass a fixed message: a response body can quote secret material, so
+    it never reaches this error, the logs, or the traceback chain.
     """
 
-    def __init__(
-        self,
-        message: str,
-        status: int | None = None,
-        problem: Mapping[str, object] | None = None,
-    ) -> None:
+    def __init__(self, message: str, status: int | None = None) -> None:
         self.status = status
-        with_status = message if status is None else f"{message} (status {status})"
-        hint = agent_auth_problem_hint(problem)
-        super().__init__(with_status if hint is None else f"{with_status}: {hint}")
+        super().__init__(message if status is None else f"{message} (status {status})")
 
 
 __all__ = [
-    "AGENT_AUTH_PROBLEM_HINT_MAX_CHARS",
     "AGENT_AUTH_TIMEOUT_SECONDS",
     "CredentialStoreError",
     "agent_auth_credential_query",
     "agent_auth_headers",
-    "agent_auth_problem_hint",
     "request_agent_auth_json",
 ]
 
@@ -106,12 +70,16 @@ def agent_auth_headers(
     *,
     api_key: str | None = None,
     workspace_id: str | None = None,
+    service_key: str | None = None,
 ) -> dict[str, str]:
     headers = {
         "accept": "application/json",
         "content-type": "application/json",
         "x-langsmith-product": "mda",
     }
+    resolved_service_key = (service_key or "").strip()
+    if resolved_service_key:
+        headers["x-service-key"] = resolved_service_key
     resolved_api_key = (api_key or "").strip()
     if resolved_api_key:
         headers["x-api-key"] = resolved_api_key

managed_deepagents/_channels/trigger/http.py

@@ -16,12 +16,6 @@ from managed_deepagents._channels.trigger.client import (
     TriggerClientLike,
     create_trigger_client,
 )
-from managed_deepagents._channels.trigger.identity_context import (
-    IdentityContextKey,
-    IdentityContextUnavailableError,
-    InvalidIdentityContextError,
-    principal_id_from_identity_context,
-)
 from managed_deepagents._channels.trigger.types import (
     TRIGGER_SERVICE_KEY_HEADER,
     TriggerChannelEvent,
@@ -58,7 +52,6 @@ class StartAgentFn(Protocol):
         messages: list[dict[str, object]],
         source_provider: str,
         source_thread_key: str,
-        user_id: str,
     ) -> StartedIngressRun: ...
 
 
@@ -71,7 +64,6 @@ class ResumeAgentFn(Protocol):
         resume: TriggerChannelResume,
         source_provider: str,
         source_thread_key: str,
-        user_id: str,
     ) -> StartedIngressRun: ...
 
 
@@ -82,7 +74,6 @@ async def _start_event_run(
     source_provider: str,
     start_agent: StartAgentFn | None,
     resume_agent: ResumeAgentFn | None,
-    user_id: str,
 ) -> StartedIngressRun:
     thread_id = _thread_id(event["source_thread_key"])
     if event["type"] == "message":
@@ -93,7 +84,6 @@ async def _start_event_run(
             messages=event["input"]["messages"],
             source_provider=source_provider,
             source_thread_key=event["source_thread_key"],
-            user_id=user_id,
         )
     resume = resume_agent or resume_ingress_agent
     return await resume(
@@ -102,11 +92,10 @@ async def _start_event_run(
         resume=event["interaction"]["resume"],
         source_provider=source_provider,
         source_thread_key=event["source_thread_key"],
-        user_id=user_id,
     )
 
 
-async def handle_trigger_channel_event_request(  # noqa: C901, PLR0911
+async def handle_trigger_channel_event_request(
     request: object,
     *,
     source_provider: str,
@@ -117,11 +106,9 @@ async def handle_trigger_channel_event_request(  # noqa: C901, PLR0911
     resume_agent: ResumeAgentFn | None = None,
     observe_agent: ObserveAgentFn | None = None,
     trigger_client: TriggerClientLike | None = None,
-    identity_context_key: IdentityContextKey | None = None,
-    identity_context_issuer: str | None = None,
 ) -> object:
     """Validate a Trigger message and enqueue its Agent Server run."""
-    # TODO: Validate Trigger's platform-signed x-service-key JWT (not presence).
+    # TODO: Validate a per-deployment Trigger↔MDA shared secret.
     if not _nonblank_header(request, TRIGGER_SERVICE_KEY_HEADER):
         return _json_response({"error": "unauthorized"}, status_code=401)
 
@@ -130,32 +117,6 @@ async def handle_trigger_channel_event_request(  # noqa: C901, PLR0911
     except (TypeError, ValueError, UnicodeDecodeError):
         logger.warning("invalid channel event")
         return _json_response({"error": "invalid channel event"}, status_code=400)
-
-    try:
-        user_id = _principal_for_event(
-            event,
-            identity_context_key=identity_context_key,
-            identity_context_issuer=identity_context_issuer,
-        )
-    except _MissingIdentityContextError:
-        logger.warning("missing channel identity_context")
-        return _json_response({"error": "missing channel identity_context"}, status_code=400)
-    except IdentityContextUnavailableError as error:
-        logger.error(
-            "channel identity_context unavailable (%s)",
-            logger.safe_error_label(error),
-        )
-        return _json_response(
-            {"error": "identity_context verification unavailable"},
-            status_code=503,
-        )
-    except InvalidIdentityContextError as error:
-        logger.warning(
-            "invalid channel identity_context (%s)",
-            logger.safe_error_label(error),
-        )
-        return _json_response({"error": "invalid channel identity_context"}, status_code=400)
-
     logger.info(
         "Channel incoming event (type=%s, event_id=%s, delivery_id=%s, channel_id=%s)",
         event["type"],
@@ -198,7 +159,6 @@ async def handle_trigger_channel_event_request(  # noqa: C901, PLR0911
             source_provider=source_provider,
             start_agent=start_agent,
             resume_agent=resume_agent,
-            user_id=user_id,
         )
     except Exception as error:  # noqa: BLE001 - never expose Agent Server details in the response
         logger.error(
@@ -213,9 +173,6 @@ async def handle_trigger_channel_event_request(  # noqa: C901, PLR0911
             started=started,
             client=client,
             observe_agent=observe_agent,
-            source_provider=source_provider,
-            source_thread_key=event["source_thread_key"],
-            user_id=user_id,
         )
 
     schedule_ingress_work(
@@ -235,9 +192,6 @@ async def _observe_accepted_run(
     started: StartedIngressRun,
     client: TriggerClientLike,
     observe_agent: ObserveAgentFn | None,
-    source_provider: str | None = None,
-    source_thread_key: str | None = None,
-    user_id: str,
 ) -> None:
     async def lifecycle(
         event_type: TriggerChannelRuntimeEventType,
@@ -258,13 +212,11 @@ async def _observe_accepted_run(
         )
 
     await lifecycle("run.started")
+    observe = observe_agent or observe_ingress_agent
     try:
-        observed = await _observe_run(
-            started=started,
-            observe_agent=observe_agent,
-            source_provider=source_provider,
-            source_thread_key=source_thread_key,
-            user_id=user_id,
+        observed = await observe(
+            thread_id=started["thread_id"],
+            run_id=started["run_id"],
         )
     except Exception:  # noqa: BLE001 - observation details stay internal
         await lifecycle("run.failed")
@@ -311,53 +263,6 @@ async def _observe_accepted_run(
     await lifecycle("run.completed")
 
 
-async def _observe_run(
-    *,
-    started: StartedIngressRun,
-    observe_agent: ObserveAgentFn | None,
-    source_provider: str | None,
-    source_thread_key: str | None,
-    user_id: str,
-) -> ObservedIngressRun:
-    if observe_agent is not None:
-        return await observe_agent(
-            **_observation_kwargs(
-                started=started,
-                source_provider=source_provider,
-                source_thread_key=source_thread_key,
-                user_id=user_id,
-            )
-        )
-    if source_provider is None or source_thread_key is None:
-        raise RuntimeError("channel observation context is not configured")
-    return await observe_ingress_agent(
-        thread_id=started["thread_id"],
-        run_id=started["run_id"],
-        source_provider=source_provider,
-        source_thread_key=source_thread_key,
-        user_id=user_id,
-    )
-
-
-def _observation_kwargs(
-    *,
-    started: StartedIngressRun,
-    source_provider: str | None,
-    source_thread_key: str | None,
-    user_id: str,
-) -> dict[str, object]:
-    kwargs: dict[str, object] = {
-        "thread_id": started["thread_id"],
-        "run_id": started["run_id"],
-        "user_id": user_id,
-    }
-    if source_provider is None or source_thread_key is None:
-        return kwargs
-    kwargs["source_provider"] = source_provider
-    kwargs["source_thread_key"] = source_thread_key
-    return kwargs
-
-
 def _is_interrupted_run(observed: ObservedIngressRun) -> bool:
     # Agent Server can report status "success" after join while values still
     # carry `__interrupt__`. Trust either signal.
@@ -410,27 +315,6 @@ def _thread_id(source_thread_key: str) -> str:
     return str(uuid.uuid5(uuid.NAMESPACE_URL, source_thread_key))
 
 
-class _MissingIdentityContextError(ValueError):
-    """A message event arrived without a Trigger identity_context token."""
-
-
-def _principal_for_event(
-    event: TriggerChannelEvent,
-    *,
-    identity_context_key: IdentityContextKey | None,
-    identity_context_issuer: str | None,
-) -> str:
-    """Resolve the verified principal required on every Trigger delivery."""
-    raw_identity_context = event.get("identity_context")
-    if not isinstance(raw_identity_context, str) or not raw_identity_context.strip():
-        raise _MissingIdentityContextError
-    return principal_id_from_identity_context(
-        raw_identity_context,
-        key=identity_context_key,
-        issuer=identity_context_issuer,
-    )
-
-
 def _resolve_assistant_id(override: str | None) -> str:
     if override is not None and (explicit := override.strip()):
         return explicit

managed_deepagents/_channels/trigger/types.py

@@ -25,7 +25,7 @@ class TriggerChannelMessageInput(TypedDict):
     messages: list[dict[str, object]]
 
 
-class TriggerChannelMessageEventRequired(TypedDict):
+class TriggerChannelMessageEvent(TypedDict):
     version: Literal["1"]
     type: Literal["message"]
     event_id: str
@@ -37,10 +37,6 @@ class TriggerChannelMessageEventRequired(TypedDict):
     input: TriggerChannelMessageInput
 
 
-class TriggerChannelMessageEvent(TriggerChannelMessageEventRequired, total=False):
-    identity_context: str | None
-
-
 # Keyed LangGraph resume: `{interrupt_id: value}`. Values are opaque
 # (`interrupt()` results or HITL `{decisions}`).
 TriggerChannelResume: TypeAlias = dict[str, object]
@@ -51,7 +47,7 @@ class TriggerChannelInterruptResumeInteraction(TypedDict):
     resume: TriggerChannelResume
 
 
-class TriggerChannelInterruptResumeEventRequired(TypedDict):
+class TriggerChannelInterruptResumeEvent(TypedDict):
     version: Literal["1"]
     type: Literal["interrupt_resume"]
     event_id: str
@@ -63,10 +59,6 @@ class TriggerChannelInterruptResumeEventRequired(TypedDict):
     interaction: TriggerChannelInterruptResumeInteraction
 
 
-class TriggerChannelInterruptResumeEvent(TriggerChannelInterruptResumeEventRequired, total=False):
-    identity_context: str | None
-
-
 TriggerChannelEvent = TriggerChannelMessageEvent | TriggerChannelInterruptResumeEvent
 
 
@@ -178,7 +170,6 @@ class _MessageEventModel(_WireModel):
     source_thread_key: _NonBlankString
     address: SkipValidation[dict[str, object]]
     input: _InputModel
-    identity_context: str | None = None
 
     @field_validator("address", mode="before")
     @classmethod
@@ -206,7 +197,6 @@ class _InterruptResumeEventModel(_WireModel):
     source_thread_key: _NonBlankString
     address: SkipValidation[dict[str, object]]
     interaction: _InterruptResumeInteractionModel
-    identity_context: str | None = None
 
     @field_validator("address", mode="before")
     @classmethod

managed_deepagents/_connections.py

@@ -1,6 +1,6 @@
 """``connections.get(...)`` — read a managed connection from a tool.
 
-``{ type: "agent" }`` resolves material owned by the current deployment.
+``{ type: "agent" }`` resolves shared workspace material on the connection row.
 ``{ type: "user" }`` resolves per-caller grants (OAuth or opaque). Resolution
 reads Agent Auth on every await and never caches.
 
@@ -157,10 +157,11 @@ class _AgentAuthConfig:
     api_key: str
     deployment_id: str | None
     workspace_id: str
+    service_key: str | None = None
 
 
 class AgentAuthConnectionStore:
-    """Store backed by connection rows and deployment/user grants in Agent Auth."""
+    """Store backed by workspace connection rows in Agent Auth."""
 
     def __init__(
         self,
@@ -187,6 +188,7 @@ class AgentAuthConnectionStore:
                 principal_id=owner_id,
                 api_key=config.api_key,
                 workspace_id=config.workspace_id,
+                service_key=config.service_key,
             ),
             request=self._bind_request(config),
             timeout=self._timeout,
@@ -213,6 +215,7 @@ class AgentAuthConnectionStore:
             headers = agent_auth_headers(
                 api_key=config.api_key,
                 workspace_id=config.workspace_id,
+                service_key=config.service_key,
             )
             response = http_get(url, headers, timeout)
             status = response.get("status")
@@ -251,18 +254,19 @@ def _lookup_workspace_connection(
     if row is None:
         return None
     if owner["type"] == "user":
-        return _lookup_user_connection_material(client, row)
+        return _lookup_user_connection_material(client, slug, row)
     return _lookup_agent_connection_material(client, slug, row)
 
 
 def _lookup_user_connection_material(
     client: AgentAuth,
+    slug: str,
     row: WorkspaceConnection,
 ) -> str | None:
     if row.kind == "secret":
-        return client.read_user_secret_for_connection(row)
+        return client.read_user_secret(slug)
     if row.kind == "oauth2":
-        return client.read_user_access_token_for_connection(row)
+        return client.read_user_access_token(slug)
     return None
 
 
@@ -425,6 +429,7 @@ def resolve_agent_auth_context(
         principal_id=resolve_owner_id({"type": "user"}, identity, config.deployment_id),
         api_key=config.api_key,
         workspace_id=config.workspace_id,
+        service_key=config.service_key,
     )
 
 
@@ -438,11 +443,13 @@ def _resolve_agent_auth_config(env: Mapping[str, str] | None) -> _AgentAuthConfi
         raise CredentialStoreError(
             f"connections are not configured: {_WORKSPACE_ID_ENV} is not set"
         )
+    service_key = (resolved.get("MDA_AGENT_AUTH_SERVICE_KEY") or "").strip() or None
     return _AgentAuthConfig(
         base_url=resolve_agent_auth_base_url(resolved),
         api_key=api_key,
         deployment_id=(resolved.get(DEPLOYMENT_ID_ENV) or "").strip() or None,
         workspace_id=workspace_id,
+        service_key=service_key,
     )
 
 

managed_deepagents/_credential_gate.py

@@ -190,9 +190,9 @@ def _read_user_connection_grants(
             raise CredentialStoreError(f"workspace connection {slug!r} is not configured")
         kind: Literal["oauth2", "secret"] = "secret" if row.kind == "secret" else "oauth2"
         token = (
-            agent_auth.read_user_secret_for_connection(row)
+            agent_auth.read_user_secret(slug)
             if kind == "secret"
-            else agent_auth.read_user_access_token_for_connection(row)
+            else agent_auth.read_user_access_token(slug)
         )
         grants.append(_UserConnectionGrant(slug=slug, kind=kind, token=token))
     return grants

managed_deepagents/_identity_auth.py

@@ -124,9 +124,6 @@ CONNECTOR_EVENTS_PATH_SUFFIX = "/events"
 CHANNEL_EVENTS_USER = "mda:channel-events"
 CHANNEL_SERVICE_USER = "mda:channel"
 
-#: Owner-key namespace for threads owned by a channel source conversation.
-CHANNEL_THREAD_OWNER_PREFIX = "mda:source-thread:"
-
 _BUILTIN_CHANNEL_SOURCE_PROVIDERS = frozenset({"slack", "github"})
 
 
@@ -206,20 +203,16 @@ def build_managed_auth(identity: IdentityDefinitionLike) -> AuthInstance:
         return await _authenticate(cfg, http, auth_cls, headers, authorization, path, method)
 
     async def scope_threads(ctx: object, value: object) -> Mapping[str, str] | None:
-        # Let Studio inspect every deployment thread so channel-triggered runs
-        # and their interrupts are visible there. Keep mutations owner-scoped:
-        # Studio identity is reachable by any holder of a workspace LangSmith
-        # API key, so exempting all actions would let that key alter caller
-        # threads too.
+        # Studio is deliberately not exempt from thread ownership. Studio
+        # identity is reachable by any holder of a workspace LangSmith API key
+        # (the Agent Server honours ``x-auth-scheme: langsmith``), so unscoping
+        # it would let that key read and write every caller's threads. Under
+        # ``mda dev`` the generated ``langgraph.json`` disables the Studio
+        # scheme, so local Studio arrives as the local-dev service principal and
+        # stays unscoped through the check below.
         user = getattr(ctx, "user", ctx)
         if is_local_dev_unscoped_user(user):
             return None
-        if (
-            is_studio_user is not None
-            and is_studio_user(user)
-            and getattr(ctx, "action", "") in {"read", "search"}
-        ):
-            return None
         key = _thread_owner_key(user)
         if isinstance(value, dict):
             payload = cast("JsonObject", value)
@@ -667,50 +660,15 @@ def _has_valid_ingress_secret(headers: Mapping[str, object]) -> bool:
 def _thread_owner_key(user: object) -> str:
     """Derive the owner value ``@auth.on.threads`` filters on.
 
-    A managed channel thread is owned by its source conversation; every other
-    caller owns its threads by user id. Channel threads are addressed by
-    ``source_thread_key`` and the deliveries that reach one can legitimately
-    carry different principals: the Trigger Server does not attach
-    ``identity_context`` to every envelope, and any participant may reply in a
-    shared thread or answer an interrupt someone else raised. Keying such a
-    thread on the delivering principal denies every later delivery that does
-    not match.
-
-    Only managed ingress sets both source stamps, and only over a trusted
-    loopback credential — a client presenting them is rejected in
-    :func:`_reject_untrusted_handoff_headers`. ``mda_user_id`` still carries the
-    principal, so credential resolution and store scoping stay per caller.
-
     Principals resolved by ``authenticate`` always carry ``mda_user_id``. A
     Studio user does not: the Agent Server builds it for
     ``x-auth-scheme: langsmith`` without consulting managed auth, so it exposes
     only ``identity``. Fall back to that rather than bucketing every such caller
     under an empty owner.
     """
-    conversation = _channel_conversation_owner_key(user)
-    if conversation is not None:
-        return conversation
     return str(_field(user, "mda_user_id") or _field(user, "identity") or "")
 
 
-def _channel_conversation_owner_key(user: object) -> str | None:
-    """Owner key for a channel ingress caller, or ``None`` for anyone else.
-
-    The prefix keeps conversation owners in a namespace no ``mda_user_id`` can
-    reach (those are UUIDs, emails, or ``mda:*`` service ids), so a source
-    thread key can never collide with a caller.
-    """
-    provider = _trimmed_stamp(_field(user, "mda_source_provider"))
-    thread_key = _trimmed_stamp(_field(user, "mda_source_thread_id"))
-    if not provider or not thread_key:
-        return None
-    return f"{CHANNEL_THREAD_OWNER_PREFIX}{provider}:{thread_key}"
-
-
-def _trimmed_stamp(value: object) -> str:
-    return value.strip() if isinstance(value, str) else ""
-
-
 #: LangGraph Store namespace prefix for Slack ↔ actor account links.
 IDENTITY_LINKS_STORE_PREFIX = "mda_identity_links"
 

managed_deepagents/_ingress.py

@@ -19,6 +19,7 @@ from managed_deepagents._channels.assistant_text import extract_assistant_text
 from managed_deepagents._channels.binding import CHANNEL_BINDING_KEY, ChannelBinding
 from managed_deepagents._channels.types import ChannelError
 from managed_deepagents._identity_auth import (
+    CHANNEL_SERVICE_USER,
     HANDOFF_SECRET_ENV,
     HANDOFF_SECRET_HEADER,
     INGRESS_SECRET_ENV,
@@ -72,7 +73,6 @@ class ObservedIngressRun(TypedDict):
 class _IngressSource(TypedDict):
     provider: str
     thread_key: str
-    user_id: str
 
 
 class _ThreadsClient(Protocol):
@@ -165,8 +165,8 @@ async def ingress_source_thread_exists(
 ) -> bool:
     """True when an MDA thread already exists for this source-thread key.
 
-    The thread is owned by the source conversation rather than by the caller, so
-    this answers "is the agent already in this thread" for any participant.
+    Call with the **resolved** actor (post identity remap) so ownership matches
+    the thread created on the first run.
     """
     if not _has_loopback_credential():
         return False
@@ -236,18 +236,10 @@ async def start_ingress_agent(
     messages: list[dict[str, object]],
     source_provider: str,
     source_thread_key: str,
-    user_id: str,
 ) -> StartedIngressRun:
-    """Create a Trigger-addressed thread and enqueue its run.
-
-    ``user_id`` is the Agent Auth principal UUID from Trigger ``identity_context``.
-    """
+    """Create a Trigger-addressed thread and enqueue its run."""
     client = _create_trigger_ingress_loopback_client(
-        {
-            "provider": source_provider,
-            "thread_key": source_thread_key,
-            "user_id": user_id,
-        }
+        {"provider": source_provider, "thread_key": source_thread_key}
     )
     await client.threads.create(
         thread_id=thread_id,
@@ -276,18 +268,10 @@ async def resume_ingress_agent(
     resume: dict[str, object],
     source_provider: str,
     source_thread_key: str,
-    user_id: str,
 ) -> StartedIngressRun:
-    """Resume a Trigger-addressed thread with a keyed interrupt response.
-
-    ``user_id`` is the Agent Auth principal UUID from Trigger ``identity_context``.
-    """
+    """Resume a Trigger-addressed thread with a keyed interrupt response."""
     client = _create_trigger_ingress_loopback_client(
-        {
-            "provider": source_provider,
-            "thread_key": source_thread_key,
-            "user_id": user_id,
-        }
+        {"provider": source_provider, "thread_key": source_thread_key}
     )
     run = await client.runs.create(
         thread_id,
@@ -308,18 +292,9 @@ async def observe_ingress_agent(
     *,
     thread_id: str,
     run_id: str,
-    source_provider: str,
-    source_thread_key: str,
-    user_id: str,
 ) -> ObservedIngressRun:
-    """Join an accepted run as the principal that owns its thread."""
-    client = _create_trigger_ingress_loopback_client(
-        {
-            "provider": source_provider,
-            "thread_key": source_thread_key,
-            "user_id": user_id,
-        }
-    )
+    """Join an accepted run and read its terminal status."""
+    client = _create_trigger_ingress_loopback_client()
     values = await client.runs.join(thread_id, run_id)
     run = await client.runs.get(thread_id, run_id)
     status = run.get("status") if isinstance(run, Mapping) else None
@@ -337,7 +312,7 @@ async def observe_ingress_agent(
 
 
 def _create_trigger_ingress_loopback_client(
-    source: _IngressSource,
+    source: _IngressSource | None = None,
 ) -> _IngressLoopbackClient:
     api_key = os.environ.get(LANGCHAIN_API_KEY_ENV, "").strip()
     if not api_key:
@@ -347,17 +322,10 @@ def _create_trigger_ingress_loopback_client(
         )
     module = import_module("langgraph_sdk")
     get_client = cast("_GetClient", module.get_client)
-    user_id = source["user_id"].strip()
-    if not user_id:
-        raise ChannelError(
-            "channel_run_failed",
-            "channel run requires an identity_context principal",
-        )
-    headers = {
-        USER_HEADER: user_id,
-        SOURCE_PROVIDER_HEADER: source["provider"],
-        SOURCE_THREAD_HEADER: source["thread_key"],
-    }
+    headers = {USER_HEADER: CHANNEL_SERVICE_USER}
+    if source is not None:
+        headers[SOURCE_PROVIDER_HEADER] = source["provider"]
+        headers[SOURCE_THREAD_HEADER] = source["thread_key"]
     return get_client(
         url=resolve_loopback_api_url(),
         api_key=api_key,

{managed_deepagents-0.6.2.dev36.dist-info → managed_deepagents-0.6.2.dev37.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: managed-deepagents
-Version: 0.6.2.dev36
+Version: 0.6.2.dev37
 Summary: Managed Deep Agents — the define_deep_agent authoring interface plus the CLI that compiles and deploys a code-first Deep Agent repository to a managed LangGraph runtime.
 Author: LangChain
 License: MIT
@@ -282,9 +282,7 @@ when a grant is missing. `mda dev` has no deployment to hold user grants, so
 a user-owned connection fails there with an actionable error; deploy the agent
 to exercise one.
 
-Deploy the project first, then provision its connections with
-`mda connections create`. Agent-owned opaque secrets are scoped to that
-deployment, so the command refuses to create one before `mda deploy`.
+Provision workspace connections with `mda connections create` before deploy.
 `mda connections check` verifies manifest slugs exist in the workspace.
 
 Use `include_tools` or `exclude_tools` inside a server config to select a

{managed_deepagents-0.6.2.dev36.dist-info → managed_deepagents-0.6.2.dev37.dist-info}/RECORD

@@ -1,20 +1,20 @@
 managed_deepagents/__init__.py,sha256=RezkpgYxCcywj6_W7Nk3PN9TMBfYyFgIatxGrIeY8V4,1862
 managed_deepagents/__main__.py,sha256=GcjmqN0Ea5v8OHKMxYToasm3eCX_doSLOlpEzAi1tAw,67
-managed_deepagents/_agent_auth.py,sha256=bOxTT1ZX9BZZyvgIaxd9SZycbEaQl-HuCrPieCAv6G0,17258
-managed_deepagents/_agent_auth_http.py,sha256=aCYn7Rrtw3cnK3r4ir4JWxwzFkb7cF7nBgPpNdydxDw,5108
+managed_deepagents/_agent_auth.py,sha256=3rA39j_3PFROrtsIr5OHkAO_FgAHfASM-ee0vGhPGu8,16650
+managed_deepagents/_agent_auth_http.py,sha256=DtspEFmWHTtpp3uqELw1-wuHiLbAx_ers9JW18J3Coc,3924
 managed_deepagents/_channel.py,sha256=-Og7QOM1yvV-yeTDOfv2CxXpR2HLY4xdX1bLrIsPi5k,5272
 managed_deepagents/_cli.py,sha256=jVaw2i1ysdRoWziMdPFmRXtKry_baYGRspyzyIeGWoU,1688
-managed_deepagents/_connections.py,sha256=VwVBwM4T0rp1MgYu9D8QjGj1ireYeEuP3VIAFN5urFY,16246
+managed_deepagents/_connections.py,sha256=N6luj1YMpBPjpH-WnGc6AIGNTE9DnZoBWAlWcFRSo2I,16518
 managed_deepagents/_connector.py,sha256=Syp0SRs1oFCUUltIUmZbSNi1Ys_PxObVdiAi-I9GBzs,8040
 managed_deepagents/_cors.py,sha256=V96RPrqewdRWG5RpEMEBnPuRq9_zF8nf4vf99k5dkuI,7597
-managed_deepagents/_credential_gate.py,sha256=SNxXunqmHgjBsZpiZu8yp49YkRIO0amkl0-7GHLGnIg,12280
+managed_deepagents/_credential_gate.py,sha256=WlryhbWHtg1FN5IdadiOvgT3JX3G78DtWVGW0wLWvz4,12252
 managed_deepagents/_eval_filesystem.py,sha256=1nuD0yn3gh19JrWNocWyPFyeJW42E7Gse3XRWCUSTAA,1399
 managed_deepagents/_extension.py,sha256=x2H1S8inkvTZQ_dr7kq0M8o8rre1FjzCDvMzItw4iyk,5318
-managed_deepagents/_identity_auth.py,sha256=l0t0Xx-J1-z_Zw4K5D-B2yV6lNdeJgOw7UvxODxUxZQ,32798
+managed_deepagents/_identity_auth.py,sha256=BydhEhqxkb9mUg04hBZlGeyxzlKAogrMfu-r4X_bzdU,30983
 managed_deepagents/_identity_http.py,sha256=aVQfZr7UKQoXF1Dry3p9fzXIj1882sEa668rvhn37i0,16029
 managed_deepagents/_identity_links.py,sha256=Z1H2Seo2KaI-vcdU3_PGM-F06wOz0IQqUP-28wqiQsA,9172
 managed_deepagents/_identity_runtime.py,sha256=vsshj0TNWd-rXUhVsPAqXIkANunQT7jI94CWgzq-1cY,24409
-managed_deepagents/_ingress.py,sha256=iqsGm2jZKKn0FqjNn2nJAlR7d-IqCpVKWo6NbMEhjxw,12323
+managed_deepagents/_ingress.py,sha256=mPIb1o60G_pCg4Qotwt-SUloCxY1xXfUTSyN_BPZNts,11581
 managed_deepagents/_log.py,sha256=oYwOO0ZL4-INkge9YJvtLuCxL9zAtgjSPIggVbkcyc8,2932
 managed_deepagents/_loopback.py,sha256=hQ1oNi77XpdUjzZURSBRoMvJ1mGCs-STobfBftGmXuE,2409
 managed_deepagents/_managed_middleware.py,sha256=cfInVHTVjWoy_DBoFlnslfrDf2_n6llGnTGasta4AIo,10295
@@ -28,7 +28,7 @@ managed_deepagents/py.typed,sha256=AbpHGcgLb-kRsJGnwFEktk7uzpZOCcBY74-YBdrKVGs,1
 managed_deepagents/runtime.py,sha256=B4iKTJZD0zXx_MZ09pqQFOkVo07tqJDT3qvOBr-0iOk,65782
 managed_deepagents/sandbox.py,sha256=xlpcWa6CoVX6GKip2nK-0Lw-HBCoFGFYm0r4x9eYwcY,2530
 managed_deepagents/schedules.py,sha256=MtTQN4tlm1NizFDCjZZv_huGfbQx-dj9WP1dIBybCug,5237
-managed_deepagents/_binaries/mda.exe,sha256=beXeCdpeh0KOXNrpeg-iudNWEv54xwLyOp0XVkL6MyA,3855360
+managed_deepagents/_binaries/mda.exe,sha256=riwU4PKA6DzRCX00K8ObfnFNO2lSlx_Zx1Lj9yOCe3c,3871744
 managed_deepagents/_channels/__init__.py,sha256=Z6eXmzaLxG09DSyJoY_CX34axcsBo9gSJ0G7pRm2D6M,1216
 managed_deepagents/_channels/assistant_text.py,sha256=f-Z3J3PlQFXZHztgBxlRoqB2LigU1Hj1YpwoXBMTR18,2171
 managed_deepagents/_channels/binding.py,sha256=6vAKbWpg-eyLErJ0SsozH4mZc50hA1NhquM63mVmWDQ,3423
@@ -50,9 +50,8 @@ managed_deepagents/_channels/slack/transport.py,sha256=_xQmzK2hBpPOoY3zKFhzc3vvl
 managed_deepagents/_channels/trigger/__init__.py,sha256=bWj66XoPbDdrztPUCKBuSJBBS2pBocn4EA8FDE3WeBA,48
 managed_deepagents/_channels/trigger/channel.py,sha256=rKSvOABOZX58ZIvZ3hKcYxvTx9npQ0YXPQWk9JEy6XE,5108
 managed_deepagents/_channels/trigger/client.py,sha256=cM97gzYWUTFC9o3uoveFe9-HxZc6_VqiqC8u4fKqjXc,8572
-managed_deepagents/_channels/trigger/http.py,sha256=O8yMleioXj3s5QXj7jK-HpUpiSFppjfRjHJ2tdfX0Is,16205
-managed_deepagents/_channels/trigger/identity_context.py,sha256=oo6sgtNDLGGkZCzrkrifMHkkAqxj7ui2HgUUdjNA1iU,7701
-managed_deepagents/_channels/trigger/types.py,sha256=42JMOFXP9MfqwQ66SFlAiwC7q_AnNIJXBts3sAujxac,6625
+managed_deepagents/_channels/trigger/http.py,sha256=L5ILylDH0BXO5MAfHpXGF742vfCxnRhGLNbLn5kQUCY,12303
+managed_deepagents/_channels/trigger/types.py,sha256=G4kW1zKV2JlNyV7evGra-lSrZ_ZpVsRQm2iSx0iLEGE,6277
 managed_deepagents/_connectors/__init__.py,sha256=c_SdH3T7T6bgX7-I5jxAqDzHojmqVUCX0AXRI7g5Ovs,575
 managed_deepagents/_connectors/tool_selection.py,sha256=xMvohEvg_rguQvziUXzxKn4V140mmearZHel97F8tVs,2978
 managed_deepagents/_connectors/mcp/__init__.py,sha256=3AL429g5djYEYuiuSqsxj2VESpTkyU2NeBIJsHlWVk4,11162
@@ -69,9 +68,9 @@ managed_deepagents/identity/__init__.py,sha256=Slm-oEqKxbaZEQsMqHfD3LbG5M4vH2lKU
 managed_deepagents/identity/claims.py,sha256=prby7r_8Lww3MmoBm8PX6PsSGE3GwSHkr8mVIz_08nU,1180
 managed_deepagents/identity/options.py,sha256=x_yMbXEFR7zXyehEjDHG2qjAlukXjrRBcQLcM6IndLM,2550
 managed_deepagents/identity/supabase.py,sha256=8uobl3WCrQL_ieSXG8KTLf1th7Qjim9liZT50HeaJE0,6026
-managed_deepagents-0.6.2.dev36.dist-info/licenses/LICENSE,sha256=WnPZQQ608ojZUkXl7BW6VbKloIAibZiGm1K6cjeZOL8,1066
-managed_deepagents-0.6.2.dev36.dist-info/METADATA,sha256=TcDnuQedflv-AcffJe1UoQkL5yvtwtfI4V6gfMrnqag,13709
-managed_deepagents-0.6.2.dev36.dist-info/WHEEL,sha256=3I5VVWZdsFlU417aCS2bMRuerS8wsfvBq99MyatBV3A,97
-managed_deepagents-0.6.2.dev36.dist-info/entry_points.txt,sha256=ziZqkKuaDO3qHCjKmBhrx9cm3ok8bZ9xcEDpUTj4unM,53
-managed_deepagents-0.6.2.dev36.dist-info/top_level.txt,sha256=fdBo4O0Hlol_w022tTLB5ftZpamb4yJoQ3MUvjgTGfA,19
-managed_deepagents-0.6.2.dev36.dist-info/RECORD,,
+managed_deepagents-0.6.2.dev37.dist-info/licenses/LICENSE,sha256=WnPZQQ608ojZUkXl7BW6VbKloIAibZiGm1K6cjeZOL8,1066
+managed_deepagents-0.6.2.dev37.dist-info/METADATA,sha256=iOVDEIhlqrDnlDJbX7MW9LrTY1u0ExCd_4V0dWCHP38,13582
+managed_deepagents-0.6.2.dev37.dist-info/WHEEL,sha256=3I5VVWZdsFlU417aCS2bMRuerS8wsfvBq99MyatBV3A,97
+managed_deepagents-0.6.2.dev37.dist-info/entry_points.txt,sha256=ziZqkKuaDO3qHCjKmBhrx9cm3ok8bZ9xcEDpUTj4unM,53
+managed_deepagents-0.6.2.dev37.dist-info/top_level.txt,sha256=fdBo4O0Hlol_w022tTLB5ftZpamb4yJoQ3MUvjgTGfA,19
+managed_deepagents-0.6.2.dev37.dist-info/RECORD,,

managed_deepagents/_channels/trigger/identity_context.py

@@ -1,214 +0,0 @@
-"""Verify Trigger Server ``identity_context`` JWTs into Agent Auth principal ids.
-
-Agent Auth signs these with the LangSmith EdDSA JWKS published at
-``{LANGSMITH_ENDPOINT}/.well-known/jwks.json``. MDA verifies the signature
-(and typ/version/aud/iss/exp/principal UUID) before stamping ``x-mda-user-id``.
-Delivery still requires Trigger's ``x-service-key`` header; signature verify is
-what stops a forged principal when that gate is weak.
-"""
-
-from __future__ import annotations
-
-import os
-from collections.abc import Mapping
-from uuid import UUID
-
-import jwt
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
-from jwt import PyJWK, PyJWKClient
-
-IdentityContextKey = Ed25519PublicKey | PyJWK
-
-IDENTITY_CONTEXT_TOKEN_TYP = "identity-context+jwt"  # noqa: S105
-IDENTITY_CONTEXT_AUDIENCE = "mda"
-IDENTITY_CONTEXT_VERSION = "1"
-IDENTITY_CONTEXT_ALGORITHMS = ("EdDSA",)
-_DEFAULT_LANGSMITH_ENDPOINT = "https://api.smith.langchain.com"
-_JWKS_HTTP_TIMEOUT_S = 5
-
-_jwks_clients: dict[str, PyJWKClient] = {}
-
-
-class InvalidIdentityContextError(ValueError):
-    """Raised when a Trigger ``identity_context`` token is unusable."""
-
-
-class IdentityContextUnavailableError(RuntimeError):
-    """JWKS / network failure while verifying identity_context. Callers should 5xx."""
-
-
-def resolve_identity_context_issuer(
-    env: Mapping[str, str] | None = None,
-) -> str:
-    """LangSmith API origin used as identity-context ``iss`` and JWKS host."""
-    source = env if env is not None else os.environ
-    raw = (
-        (source.get("LANGSMITH_ENDPOINT") or "").strip()
-        or (source.get("LANGCHAIN_ENDPOINT") or "").strip()
-        or _DEFAULT_LANGSMITH_ENDPOINT
-    )
-    return raw.rstrip("/")
-
-
-def resolve_identity_context_jwks_url(
-    env: Mapping[str, str] | None = None,
-) -> str:
-    """Public JWKS URL for Agent Auth identity-context signatures."""
-    return f"{resolve_identity_context_issuer(env)}/.well-known/jwks.json"
-
-
-def principal_id_from_identity_context(
-    token: str,
-    *,
-    key: IdentityContextKey | None = None,
-    issuer: str | None = None,
-    env: Mapping[str, str] | None = None,
-) -> str:
-    """Extract the Agent Auth principal UUID from a Trigger identity-context JWT.
-
-    Raises:
-        InvalidIdentityContextError: when the token is missing, malformed, or
-            fails signature / claim checks.
-    """
-    value = token.strip()
-    if not value:
-        raise InvalidIdentityContextError("identity_context is blank")
-
-    _require_identity_context_header(value)
-    claims = _verify_identity_context_claims(
-        value,
-        key=key,
-        issuer=issuer or resolve_identity_context_issuer(env),
-        env=env,
-    )
-    if claims.get("version") != IDENTITY_CONTEXT_VERSION:
-        raise InvalidIdentityContextError(
-            f"identity_context version must be {IDENTITY_CONTEXT_VERSION}"
-        )
-    return _principal_id_from_claims(claims)
-
-
-def optional_principal_id_from_identity_context(
-    token: object | None,
-    *,
-    key: IdentityContextKey | None = None,
-    issuer: str | None = None,
-    env: Mapping[str, str] | None = None,
-) -> str | None:
-    """Resolve a principal id from an optional event field; ``None`` when absent."""
-    if token is None:
-        return None
-    if not isinstance(token, str):
-        raise InvalidIdentityContextError("identity_context must be a string")
-    if not token.strip():
-        return None
-    return principal_id_from_identity_context(token, key=key, issuer=issuer, env=env)
-
-
-def _require_identity_context_header(token: str) -> None:
-    try:
-        header = jwt.get_unverified_header(token)
-    except jwt.exceptions.DecodeError as error:
-        raise InvalidIdentityContextError("identity_context is not a JWT") from error
-    if header.get("typ") != IDENTITY_CONTEXT_TOKEN_TYP:
-        raise InvalidIdentityContextError(
-            f"identity_context typ must be {IDENTITY_CONTEXT_TOKEN_TYP}"
-        )
-    if header.get("alg") != "EdDSA":
-        raise InvalidIdentityContextError("identity_context alg must be EdDSA")
-
-
-def _verify_identity_context_claims(
-    token: str,
-    *,
-    key: IdentityContextKey | None,
-    issuer: str,
-    env: Mapping[str, str] | None,
-) -> dict[str, object]:
-    algorithms = list(IDENTITY_CONTEXT_ALGORITHMS)
-    try:
-        verify_key = _jwks_client(env).get_signing_key_from_jwt(token) if key is None else key
-        decoded = jwt.decode(
-            token,
-            key=verify_key,
-            algorithms=algorithms,
-            audience=IDENTITY_CONTEXT_AUDIENCE,
-            issuer=issuer,
-            options={"require": ["exp"], "verify_exp": True},
-        )
-    except jwt.exceptions.ExpiredSignatureError as error:
-        raise InvalidIdentityContextError("identity_context is expired") from error
-    except jwt.exceptions.MissingRequiredClaimError as error:
-        raise InvalidIdentityContextError("identity_context is missing exp") from error
-    except jwt.exceptions.PyJWKClientConnectionError as error:
-        raise IdentityContextUnavailableError(
-            "identity_context JWKS verification is unavailable"
-        ) from error
-    except TimeoutError as error:
-        raise IdentityContextUnavailableError(
-            "identity_context JWKS verification is unavailable"
-        ) from error
-    except OSError as error:
-        raise IdentityContextUnavailableError(
-            "identity_context JWKS verification is unavailable"
-        ) from error
-    except jwt.exceptions.PyJWTError as error:
-        raise InvalidIdentityContextError(
-            "identity_context signature verification failed"
-        ) from error
-    if not isinstance(decoded, dict):
-        raise InvalidIdentityContextError("identity_context claims must be an object")
-    claims = {str(name): value for name, value in decoded.items()}
-    if not isinstance(claims.get("exp"), (int, float)) or isinstance(claims.get("exp"), bool):
-        raise InvalidIdentityContextError("identity_context is missing exp")
-    return claims
-
-
-def _jwks_client(env: Mapping[str, str] | None) -> PyJWKClient:
-    uri = resolve_identity_context_jwks_url(env)
-    client = _jwks_clients.get(uri)
-    if client is None:
-        client = PyJWKClient(uri, timeout=_JWKS_HTTP_TIMEOUT_S)
-        _jwks_clients[uri] = client
-    return client
-
-
-def _principal_id_from_claims(claims: Mapping[str, object]) -> str:
-    from_principal = _principal_id_claim(claims.get("principal"))
-    raw_subject = claims.get("sub")
-    from_subject = _normalize_uuid(raw_subject) if isinstance(raw_subject, str) else None
-    if from_principal and from_subject and from_principal != from_subject:
-        raise InvalidIdentityContextError("identity_context principal.id and sub disagree")
-    principal_id = from_principal or from_subject
-    if not principal_id:
-        raise InvalidIdentityContextError("identity_context is missing a principal UUID")
-    return principal_id
-
-
-def _principal_id_claim(value: object) -> str | None:
-    if not isinstance(value, Mapping):
-        return None
-    raw_id = value.get("id")
-    return _normalize_uuid(raw_id) if isinstance(raw_id, str) else None
-
-
-def _normalize_uuid(value: str) -> str | None:
-    try:
-        return str(UUID(value))
-    except ValueError:
-        return None
-
-
-__all__ = [
-    "IDENTITY_CONTEXT_ALGORITHMS",
-    "IDENTITY_CONTEXT_AUDIENCE",
-    "IDENTITY_CONTEXT_TOKEN_TYP",
-    "IDENTITY_CONTEXT_VERSION",
-    "IdentityContextKey",
-    "IdentityContextUnavailableError",
-    "InvalidIdentityContextError",
-    "optional_principal_id_from_identity_context",
-    "principal_id_from_identity_context",
-    "resolve_identity_context_issuer",
-    "resolve_identity_context_jwks_url",
-]