langsmith 0.8.9 → 0.8.11

package/dist/sandbox/mounts.cjs

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.s3Mount = s3Mount;
 exports.gitMount = gitMount;
 exports.gcsMount = gcsMount;
+exports.contextHubMount = contextHubMount;
 exports.mountConfig = mountConfig;
 exports.validateMountConfigProxyConfig = validateMountConfigProxyConfig;
 function requireNonEmptyString(value, field) {
@@ -132,6 +133,25 @@ function gcsMount({ id, mountPath, bucket, prefix, readOnly, cache, }) {
     }
     return mount;
 }
+/**
+ * Build a read-only Context Hub mount. The sync is one-way: files written
+ * under the mount path inside the sandbox are never pushed back to the repo,
+ * and the next sync overwrites them.
+ */
+function contextHubMount({ id, mountPath, repo, initialPullOnly, }) {
+    const mount = {
+        id: requireNonEmptyString(id, "id"),
+        type: "contexthub",
+        mount_path: requireNonEmptyString(mountPath, "mountPath"),
+        contexthub: {
+            repo: requireNonEmptyString(repo, "repo"),
+        },
+    };
+    if (initialPullOnly !== undefined) {
+        mount.contexthub.initial_pull_only = initialPullOnly;
+    }
+    return mount;
+}
 function normalizeMounts(mounts) {
     if (!Array.isArray(mounts) || mounts.length === 0) {
         throw new Error("mounts must be a non-empty array of mount objects");
@@ -140,8 +160,11 @@ function normalizeMounts(mounts) {
         if (mount === null || typeof mount !== "object" || Array.isArray(mount)) {
             throw new Error("mounts must be a non-empty array of mount objects");
         }
-        if (mount.type !== "s3" && mount.type !== "gcs" && mount.type !== "git") {
-            throw new Error("mountConfig only supports s3, gcs, and git mounts");
+        if (mount.type !== "s3" &&
+            mount.type !== "gcs" &&
+            mount.type !== "git" &&
+            mount.type !== "contexthub") {
+            throw new Error("mountConfig only supports s3, gcs, git, and contexthub mounts");
         }
         rejectProviderCredentialsInMount(mount);
         return mount;

package/dist/sandbox/mounts.d.ts

@@ -1,4 +1,4 @@
-import type { GCSMountSpec, GitMountRefSpec, GitMountSpec, MountCacheConfig, S3MountSpec, SandboxMount, SandboxMountAuth, SandboxMountConfig, SandboxProxyConfig } from "./types.js";
+import type { ContextHubMountSpec, GCSMountSpec, GitMountRefSpec, GitMountSpec, MountCacheConfig, S3MountSpec, SandboxMount, SandboxMountAuth, SandboxMountConfig, SandboxProxyConfig } from "./types.js";
 export declare function s3Mount({ id, mountPath, bucket, region, prefix, endpointUrl, pathStyle, readOnly, cache, }: {
     id: string;
     mountPath: string;
@@ -25,6 +25,17 @@ export declare function gcsMount({ id, mountPath, bucket, prefix, readOnly, cach
     readOnly?: boolean;
     cache?: MountCacheConfig;
 }): GCSMountSpec;
+/**
+ * Build a read-only Context Hub mount. The sync is one-way: files written
+ * under the mount path inside the sandbox are never pushed back to the repo,
+ * and the next sync overwrites them.
+ */
+export declare function contextHubMount({ id, mountPath, repo, initialPullOnly, }: {
+    id: string;
+    mountPath: string;
+    repo: string;
+    initialPullOnly?: boolean;
+}): ContextHubMountSpec;
 export declare function mountConfig({ auth, mounts, }: {
     auth?: SandboxMountAuth[];
     mounts: SandboxMount[];

package/dist/sandbox/mounts.js

@@ -125,6 +125,25 @@ export function gcsMount({ id, mountPath, bucket, prefix, readOnly, cache, }) {
     }
     return mount;
 }
+/**
+ * Build a read-only Context Hub mount. The sync is one-way: files written
+ * under the mount path inside the sandbox are never pushed back to the repo,
+ * and the next sync overwrites them.
+ */
+export function contextHubMount({ id, mountPath, repo, initialPullOnly, }) {
+    const mount = {
+        id: requireNonEmptyString(id, "id"),
+        type: "contexthub",
+        mount_path: requireNonEmptyString(mountPath, "mountPath"),
+        contexthub: {
+            repo: requireNonEmptyString(repo, "repo"),
+        },
+    };
+    if (initialPullOnly !== undefined) {
+        mount.contexthub.initial_pull_only = initialPullOnly;
+    }
+    return mount;
+}
 function normalizeMounts(mounts) {
     if (!Array.isArray(mounts) || mounts.length === 0) {
         throw new Error("mounts must be a non-empty array of mount objects");
@@ -133,8 +152,11 @@ function normalizeMounts(mounts) {
         if (mount === null || typeof mount !== "object" || Array.isArray(mount)) {
             throw new Error("mounts must be a non-empty array of mount objects");
         }
-        if (mount.type !== "s3" && mount.type !== "gcs" && mount.type !== "git") {
-            throw new Error("mountConfig only supports s3, gcs, and git mounts");
+        if (mount.type !== "s3" &&
+            mount.type !== "gcs" &&
+            mount.type !== "git" &&
+            mount.type !== "contexthub") {
+            throw new Error("mountConfig only supports s3, gcs, git, and contexthub mounts");
         }
         rejectProviderCredentialsInMount(mount);
         return mount;

package/dist/sandbox/proxy_config.cjs

@@ -17,6 +17,22 @@ function requireNonEmptyStringArray(values, field) {
     }
     return values.map((value) => requireNonEmptyString(value, field));
 }
+function requireEnvVars(envVars) {
+    if (envVars === null ||
+        typeof envVars !== "object" ||
+        Array.isArray(envVars)) {
+        throw new Error("envVars must be a non-empty object of names to values");
+    }
+    const entries = Object.entries(envVars);
+    if (entries.length === 0) {
+        throw new Error("envVars must be a non-empty object of names to values");
+    }
+    return Object.fromEntries(entries.map(([name, value]) => {
+        // Validated on the trimmed form, stored verbatim: whitespace can be significant.
+        requireNonEmptyString(value, `envVars[${name}]`);
+        return [requireNonEmptyString(name, "envVars name"), value];
+    }));
+}
 function requireProxyRules(rules) {
     if (rules === undefined) {
         return [];
@@ -79,8 +95,8 @@ function proxyConfig({ rules, noProxy, accessControl, } = {}) {
     return config;
 }
 /** Build a sandbox proxy rule that signs AWS HTTPS requests with SigV4. */
-function awsAuth({ accessKeyId, secretAccessKey, name = "aws", enabled = true, }) {
-    return {
+function awsAuth({ accessKeyId, secretAccessKey, name = "aws", enabled = true, envVars, }) {
+    const rule = {
         name: requireNonEmptyString(name, "name"),
         type: "aws",
         enabled,
@@ -89,19 +105,27 @@ function awsAuth({ accessKeyId, secretAccessKey, name = "aws", enabled = true, }
             secret_access_key: secretAccessKey,
         },
     };
+    if (envVars !== undefined) {
+        rule.env_vars = requireEnvVars(envVars);
+    }
+    return rule;
 }
 /** Build a sandbox proxy rule that injects GCP OAuth bearer auth. */
-function gcpAuth({ serviceAccountJson, scopes, name = "gcp", enabled = true, }) {
+function gcpAuth({ serviceAccountJson, scopes, name = "gcp", enabled = true, envVars, }) {
     const gcp = {
         service_account_json: serviceAccountJson,
     };
     if (scopes !== undefined) {
         gcp.scopes = requireNonEmptyStringArray(scopes, "scopes");
     }
-    return {
+    const rule = {
         name: requireNonEmptyString(name, "name"),
         type: "gcp",
         enabled,
         gcp,
     };
+    if (envVars !== undefined) {
+        rule.env_vars = requireEnvVars(envVars);
+    }
+    return rule;
 }

package/dist/sandbox/proxy_config.d.ts

@@ -10,16 +10,18 @@ export declare function proxyConfig({ rules, noProxy, accessControl, }?: {
     accessControl?: SandboxAccessControl;
 }): SandboxProxyConfig;
 /** Build a sandbox proxy rule that signs AWS HTTPS requests with SigV4. */
-export declare function awsAuth({ accessKeyId, secretAccessKey, name, enabled, }: {
+export declare function awsAuth({ accessKeyId, secretAccessKey, name, enabled, envVars, }: {
     accessKeyId: SandboxProxySecret;
     secretAccessKey: SandboxProxySecret;
     name?: string;
     enabled?: boolean;
+    envVars?: Record<string, string>;
 }): SandboxAwsAuthRule;
 /** Build a sandbox proxy rule that injects GCP OAuth bearer auth. */
-export declare function gcpAuth({ serviceAccountJson, scopes, name, enabled, }: {
+export declare function gcpAuth({ serviceAccountJson, scopes, name, enabled, envVars, }: {
     serviceAccountJson: SandboxProxySecret;
     scopes?: string[];
     name?: string;
     enabled?: boolean;
+    envVars?: Record<string, string>;
 }): SandboxGcpAuthRule;

package/dist/sandbox/proxy_config.js

@@ -10,6 +10,22 @@ function requireNonEmptyStringArray(values, field) {
     }
     return values.map((value) => requireNonEmptyString(value, field));
 }
+function requireEnvVars(envVars) {
+    if (envVars === null ||
+        typeof envVars !== "object" ||
+        Array.isArray(envVars)) {
+        throw new Error("envVars must be a non-empty object of names to values");
+    }
+    const entries = Object.entries(envVars);
+    if (entries.length === 0) {
+        throw new Error("envVars must be a non-empty object of names to values");
+    }
+    return Object.fromEntries(entries.map(([name, value]) => {
+        // Validated on the trimmed form, stored verbatim: whitespace can be significant.
+        requireNonEmptyString(value, `envVars[${name}]`);
+        return [requireNonEmptyString(name, "envVars name"), value];
+    }));
+}
 function requireProxyRules(rules) {
     if (rules === undefined) {
         return [];
@@ -72,8 +88,8 @@ export function proxyConfig({ rules, noProxy, accessControl, } = {}) {
     return config;
 }
 /** Build a sandbox proxy rule that signs AWS HTTPS requests with SigV4. */
-export function awsAuth({ accessKeyId, secretAccessKey, name = "aws", enabled = true, }) {
-    return {
+export function awsAuth({ accessKeyId, secretAccessKey, name = "aws", enabled = true, envVars, }) {
+    const rule = {
         name: requireNonEmptyString(name, "name"),
         type: "aws",
         enabled,
@@ -82,19 +98,27 @@ export function awsAuth({ accessKeyId, secretAccessKey, name = "aws", enabled =
             secret_access_key: secretAccessKey,
         },
     };
+    if (envVars !== undefined) {
+        rule.env_vars = requireEnvVars(envVars);
+    }
+    return rule;
 }
 /** Build a sandbox proxy rule that injects GCP OAuth bearer auth. */
-export function gcpAuth({ serviceAccountJson, scopes, name = "gcp", enabled = true, }) {
+export function gcpAuth({ serviceAccountJson, scopes, name = "gcp", enabled = true, envVars, }) {
     const gcp = {
         service_account_json: serviceAccountJson,
     };
     if (scopes !== undefined) {
         gcp.scopes = requireNonEmptyStringArray(scopes, "scopes");
     }
-    return {
+    const rule = {
         name: requireNonEmptyString(name, "name"),
         type: "gcp",
         enabled,
         gcp,
     };
+    if (envVars !== undefined) {
+        rule.env_vars = requireEnvVars(envVars);
+    }
+    return rule;
 }

package/dist/sandbox/types.d.ts

@@ -270,6 +270,13 @@ export interface SandboxAwsAuthRule {
     type: "aws";
     /** Whether the rule is enabled. */
     enabled?: boolean;
+    /**
+     * Plaintext environment variables set for every command in the sandbox while
+     * the rule is enabled, for tools that refuse to run unless a credential
+     * variable is present even though the proxy injects the real credential on
+     * the wire.
+     */
+    env_vars?: Record<string, string>;
     /** AWS credentials used by the proxy signer. */
     aws: {
         access_key_id: SandboxProxySecret;
@@ -284,6 +291,13 @@ export interface SandboxGcpAuthRule {
     type: "gcp";
     /** Whether the rule is enabled. */
     enabled?: boolean;
+    /**
+     * Plaintext environment variables set for every command in the sandbox while
+     * the rule is enabled, for tools that refuse to run unless a credential
+     * variable is present even though the proxy injects the real credential on
+     * the wire.
+     */
+    env_vars?: Record<string, string>;
     /** GCP service-account credential and OAuth scopes. */
     gcp: {
         service_account_json: SandboxProxySecret;
@@ -386,8 +400,29 @@ export interface GitMountSpec {
     /** Git mount configuration. */
     git: GitMountConfig;
 }
+/** Context Hub configuration for a sandbox mount. */
+export interface ContextHubMountConfig {
+    /**
+     * Context Hub repository to sync, as `owner/repo` (e.g. `-/my-agent`, where
+     * `-` is the current workspace).
+     */
+    repo: string;
+    /** Sync once at startup instead of polling for updates. */
+    initial_pull_only?: boolean;
+}
+/** Read-only Context Hub-backed sandbox mount specification. */
+export interface ContextHubMountSpec {
+    /** Stable mount identifier. */
+    id: string;
+    /** Mount type. */
+    type: "contexthub";
+    /** Absolute path inside the sandbox where the repo tree appears. */
+    mount_path: string;
+    /** Context Hub mount configuration. */
+    contexthub: ContextHubMountConfig;
+}
 /** Sandbox mount specification. */
-export type SandboxMount = S3MountSpec | GCSMountSpec | GitMountSpec;
+export type SandboxMount = S3MountSpec | GCSMountSpec | GitMountSpec | ContextHubMountSpec;
 /** AWS credentials used by the backend to authenticate S3 mounts. */
 export interface SandboxAwsMountAuthConfig {
     access_key_id: SandboxProxySecret;

package/dist/utils/_git.cjs

@@ -17,6 +17,33 @@ const execGit = (command, exec) => {
         });
     });
 };
+function sanitizeRemoteUrl(remoteUrl) {
+    if (remoteUrl == null) {
+        return remoteUrl;
+    }
+    const schemeSeparator = remoteUrl.indexOf("://");
+    if (schemeSeparator === -1) {
+        return remoteUrl;
+    }
+    const scheme = remoteUrl.slice(0, schemeSeparator).toLowerCase();
+    if (scheme !== "http" && scheme !== "https") {
+        return remoteUrl;
+    }
+    const authorityStart = schemeSeparator + "://".length;
+    let authorityEnd = remoteUrl.length;
+    for (const delimiter of ["/", "?", "#"]) {
+        const delimiterIndex = remoteUrl.indexOf(delimiter, authorityStart);
+        if (delimiterIndex !== -1) {
+            authorityEnd = Math.min(authorityEnd, delimiterIndex);
+        }
+    }
+    const authority = remoteUrl.slice(authorityStart, authorityEnd);
+    const userinfoEnd = authority.lastIndexOf("@");
+    if (userinfoEnd === -1) {
+        return remoteUrl;
+    }
+    return `${remoteUrl.slice(0, authorityStart)}${authority.slice(userinfoEnd + 1)}${remoteUrl.slice(authorityEnd)}`;
+}
 const getGitInfo = async (remote = "origin") => {
     let exec;
     try {
@@ -42,7 +69,7 @@ const getGitInfo = async (remote = "origin") => {
         execGit(["log", "-1", "--format=%ae"], exec),
     ]);
     return {
-        remoteUrl,
+        remoteUrl: sanitizeRemoteUrl(remoteUrl),
         commit,
         commitTime,
         branch,

package/dist/utils/_git.js

@@ -14,6 +14,33 @@ const execGit = (command, exec) => {
         });
     });
 };
+function sanitizeRemoteUrl(remoteUrl) {
+    if (remoteUrl == null) {
+        return remoteUrl;
+    }
+    const schemeSeparator = remoteUrl.indexOf("://");
+    if (schemeSeparator === -1) {
+        return remoteUrl;
+    }
+    const scheme = remoteUrl.slice(0, schemeSeparator).toLowerCase();
+    if (scheme !== "http" && scheme !== "https") {
+        return remoteUrl;
+    }
+    const authorityStart = schemeSeparator + "://".length;
+    let authorityEnd = remoteUrl.length;
+    for (const delimiter of ["/", "?", "#"]) {
+        const delimiterIndex = remoteUrl.indexOf(delimiter, authorityStart);
+        if (delimiterIndex !== -1) {
+            authorityEnd = Math.min(authorityEnd, delimiterIndex);
+        }
+    }
+    const authority = remoteUrl.slice(authorityStart, authorityEnd);
+    const userinfoEnd = authority.lastIndexOf("@");
+    if (userinfoEnd === -1) {
+        return remoteUrl;
+    }
+    return `${remoteUrl.slice(0, authorityStart)}${authority.slice(userinfoEnd + 1)}${remoteUrl.slice(authorityEnd)}`;
+}
 export const getGitInfo = async (remote = "origin") => {
     let exec;
     try {
@@ -39,7 +66,7 @@ export const getGitInfo = async (remote = "origin") => {
         execGit(["log", "-1", "--format=%ae"], exec),
     ]);
     return {
-        remoteUrl,
+        remoteUrl: sanitizeRemoteUrl(remoteUrl),
         commit,
         commitTime,
         branch,

package/dist/utils/ls_agent_type.cjs

@@ -0,0 +1,31 @@
+"use strict";
+// Shared primitives for the `ls_agent_type` metadata tag.
+// Consumed by wrappers/integrations that stamp or inspect `ls_agent_type` on
+// traced runs (wrap_openai, OpenAI Agents SDK, Vercel, future wrappers).
+// Keep this module SDK-agnostic: the caller passes in the parent run tree.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NON_ROOT_LS_AGENT_TYPES = void 0;
+exports.resolveDefaultLsAgentType = resolveDefaultLsAgentType;
+exports.lsAgentTypeMetadata = lsAgentTypeMetadata;
+exports.defaultLsAgentTypeMetadata = defaultLsAgentTypeMetadata;
+const run_trees_js_1 = require("../run_trees.cjs");
+// Non-root tags: preserved against default/structural stamping.
+exports.NON_ROOT_LS_AGENT_TYPES = new Set([
+    "middleware",
+    "subagent",
+    "compaction",
+]);
+// `"root"` at trace root; `undefined` when nested (rely on propagation).
+function resolveDefaultLsAgentType(parentRunTree) {
+    return (0, run_trees_js_1.isRunTree)(parentRunTree) ? undefined : "root";
+}
+// Spread helper: `{ ls_agent_type: tag }` when tag is set, `{}` when undefined.
+function lsAgentTypeMetadata(tag) {
+    return tag !== undefined ? { ls_agent_type: tag } : {};
+}
+// Preserves user-supplied ls_agent_type; stamps default only when key is absent.
+function defaultLsAgentTypeMetadata(existingMetadata, parentRunTree) {
+    if ("ls_agent_type" in existingMetadata)
+        return {};
+    return lsAgentTypeMetadata(resolveDefaultLsAgentType(parentRunTree));
+}

package/dist/utils/ls_agent_type.d.ts

@@ -0,0 +1,9 @@
+export type LsAgentType = "root" | "middleware" | "subagent" | "compaction";
+export declare const NON_ROOT_LS_AGENT_TYPES: ReadonlySet<string>;
+export declare function resolveDefaultLsAgentType(parentRunTree?: unknown): LsAgentType | undefined;
+export declare function lsAgentTypeMetadata(tag: LsAgentType | undefined): {
+    ls_agent_type?: LsAgentType;
+};
+export declare function defaultLsAgentTypeMetadata(existingMetadata: Record<string, unknown>, parentRunTree?: unknown): {
+    ls_agent_type?: LsAgentType;
+};

package/dist/utils/ls_agent_type.js

@@ -0,0 +1,25 @@
+// Shared primitives for the `ls_agent_type` metadata tag.
+// Consumed by wrappers/integrations that stamp or inspect `ls_agent_type` on
+// traced runs (wrap_openai, OpenAI Agents SDK, Vercel, future wrappers).
+// Keep this module SDK-agnostic: the caller passes in the parent run tree.
+import { isRunTree } from "../run_trees.js";
+// Non-root tags: preserved against default/structural stamping.
+export const NON_ROOT_LS_AGENT_TYPES = new Set([
+    "middleware",
+    "subagent",
+    "compaction",
+]);
+// `"root"` at trace root; `undefined` when nested (rely on propagation).
+export function resolveDefaultLsAgentType(parentRunTree) {
+    return isRunTree(parentRunTree) ? undefined : "root";
+}
+// Spread helper: `{ ls_agent_type: tag }` when tag is set, `{}` when undefined.
+export function lsAgentTypeMetadata(tag) {
+    return tag !== undefined ? { ls_agent_type: tag } : {};
+}
+// Preserves user-supplied ls_agent_type; stamps default only when key is absent.
+export function defaultLsAgentTypeMetadata(existingMetadata, parentRunTree) {
+    if ("ls_agent_type" in existingMetadata)
+        return {};
+    return lsAgentTypeMetadata(resolveDefaultLsAgentType(parentRunTree));
+}

package/dist/utils/profiles.cjs

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ProfileAuth = exports.DEFAULT_API_URL = void 0;
 exports.hasValue = hasValue;
+exports.resolveTokenEndpoint = resolveTokenEndpoint;
 exports.loadProfileClientConfig = loadProfileClientConfig;
 const env_js_1 = require("./env.cjs");
 const fsUtils = __importStar(require("./fs.cjs"));
@@ -43,6 +44,8 @@ exports.DEFAULT_API_URL = "https://api.smith.langchain.com";
 const OAUTH_CLIENT_ID = "langsmith-cli";
 const TOKEN_REFRESH_LEEWAY_MS = 60_000;
 const TOKEN_REFRESH_TIMEOUT_MS = 10_000;
+const OAUTH_DISCOVERY_TIMEOUT_MS = 5_000;
+const WELL_KNOWN_OAUTH_PATH = "/.well-known/oauth-authorization-server";
 function isBrowserLikeRuntime() {
     const env = (0, env_js_1.getEnv)();
     return env === "browser" || env === "webworker";
@@ -125,6 +128,126 @@ function normalizeConfigUrl(apiUrl) {
         ? normalized.slice(0, -apiV1Suffix.length)
         : normalized;
 }
+/**
+ * Metadata base URLs to probe, most specific first: the configured mount point,
+ * then the self-hosted and SaaS locations, so both a bare origin and an
+ * explicit `/api` resolve.
+ */
+function oauthDiscoveryCandidates(apiUrl) {
+    const given = normalizeConfigUrl(apiUrl);
+    const origin = given.endsWith("/api")
+        ? given.slice(0, -"/api".length)
+        : given;
+    const candidates = [];
+    for (const candidate of [given, `${origin}/api`, origin]) {
+        if (candidate && candidate !== "/api" && !candidates.includes(candidate)) {
+            candidates.push(candidate);
+        }
+    }
+    return candidates;
+}
+/**
+ * Check the document describes the deployment we probed. RFC 8414 requires the
+ * issuer to match the URL the well-known path was built from, and every
+ * endpoint must share the issuer's origin. Refresh tokens are posted to these
+ * endpoints, so an unvalidated document could redirect credentials elsewhere.
+ */
+function isTrustedOAuthMetadata(doc, base) {
+    const { issuer } = doc;
+    if (typeof issuer !== "string" ||
+        issuer.replace(/\/+$/, "") !== base.replace(/\/+$/, "")) {
+        return false;
+    }
+    let issuerUrl;
+    try {
+        issuerUrl = new URL(issuer);
+    }
+    catch {
+        return false;
+    }
+    for (const endpoint of [
+        doc.device_authorization_endpoint,
+        doc.token_endpoint,
+    ]) {
+        if (typeof endpoint !== "string" || !endpoint) {
+            return false;
+        }
+        try {
+            const url = new URL(endpoint);
+            if (url.protocol !== issuerUrl.protocol || url.host !== issuerUrl.host) {
+                return false;
+            }
+        }
+        catch {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Metadata URLs for an issuer, RFC 8414 form first. RFC 8414 inserts the
+ * well-known segment between the origin and the issuer path, so
+ * `https://host/api` is described at
+ * `https://host/.well-known/oauth-authorization-server/api`. Deployments
+ * commonly also serve the appended form, and for a path-less issuer the two are
+ * identical.
+ */
+function oauthMetadataUrls(base) {
+    const appended = `${base}${WELL_KNOWN_OAUTH_PATH}`;
+    let inserted;
+    try {
+        const url = new URL(base);
+        inserted = `${url.origin}${WELL_KNOWN_OAUTH_PATH}${url.pathname === "/" ? "" : url.pathname}`;
+    }
+    catch {
+        return [appended];
+    }
+    return inserted === appended ? [inserted] : [inserted, appended];
+}
+async function fetchOAuthMetadata(url, base, fetchImplementation) {
+    let response;
+    try {
+        response = await fetchImplementation(url, {
+            method: "GET",
+            headers: { Accept: "application/json" },
+            signal: AbortSignal.timeout(OAUTH_DISCOVERY_TIMEOUT_MS),
+        });
+    }
+    catch {
+        return undefined;
+    }
+    if (!response.ok) {
+        return undefined;
+    }
+    let doc;
+    try {
+        // Self-hosted answers unknown paths with an HTML 200 from the SPA.
+        doc = (await response.json());
+    }
+    catch {
+        return undefined;
+    }
+    if (!doc || typeof doc !== "object" || !isTrustedOAuthMetadata(doc, base)) {
+        return undefined;
+    }
+    return doc;
+}
+/**
+ * Resolve the token endpoint, preferring the deployment's metadata document.
+ * Falls back to `<mount>/oauth/token`, keeping a trailing `/api` because
+ * self-hosted mounts the authorization server under it.
+ */
+async function resolveTokenEndpoint(apiUrl, fetchImplementation) {
+    for (const base of oauthDiscoveryCandidates(apiUrl)) {
+        for (const url of oauthMetadataUrls(base)) {
+            const doc = await fetchOAuthMetadata(url, base, fetchImplementation);
+            if (doc) {
+                return doc.token_endpoint;
+            }
+        }
+    }
+    return `${normalizeConfigUrl(apiUrl)}/oauth/token`;
+}
 function applyTokenResponse(profile, token) {
     profile.oauth ??= {};
     if (token.access_token) {
@@ -262,7 +385,8 @@ class ProfileAuth {
                 client_id: OAUTH_CLIENT_ID,
                 refresh_token: this.state.profile.oauth?.refresh_token ?? refreshToken,
             });
-            const response = await fetchImplementation(`${normalizeConfigUrl(refreshApiUrl)}/oauth/token`, {
+            const tokenEndpoint = await resolveTokenEndpoint(refreshApiUrl, fetchImplementation);
+            const response = await fetchImplementation(tokenEndpoint, {
                 method: "POST",
                 headers: {
                     "Content-Type": "application/x-www-form-urlencoded",

package/dist/utils/profiles.d.ts

@@ -33,6 +33,12 @@ export type ProfileClientConfig = {
     profileAuth?: ProfileAuth;
 };
 export declare function hasValue(value?: string | null): boolean;
+/**
+ * Resolve the token endpoint, preferring the deployment's metadata document.
+ * Falls back to `<mount>/oauth/token`, keeping a trailing `/api` because
+ * self-hosted mounts the authorization server under it.
+ */
+export declare function resolveTokenEndpoint(apiUrl: string, fetchImplementation: typeof fetch): Promise<string>;
 export declare function loadProfileClientConfig(): ProfileClientConfig;
 export declare class ProfileAuth {
     private state;