managed-deepagents 0.4.2 → 0.4.3-dev.94

package/dist/identity/linkedin/oauth.js

@@ -0,0 +1,47 @@
+/**
+ * LinkedIn BYO OAuth descriptor — optional non-LangSmith Connect-with-LinkedIn.
+ * The default path uses Fleet auth-sessions instead.
+ */
+import { createByoOauthClient, } from "../byo-oauth.js";
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, } from "../byo-oauth.js";
+const DEFAULT_AUTH_URL = "https://www.linkedin.com/oauth/v2/authorization";
+const DEFAULT_TOKEN_URL = "https://www.linkedin.com/oauth/v2/accessToken";
+const DEFAULT_USERINFO_URL = "https://api.linkedin.com/v2/userinfo";
+/** Profile + Share on LinkedIn; connector-derived unions replace this at authorize time. */
+const DEFAULT_SCOPES = ["openid", "profile", "email", "w_member_social"].join(" ");
+/** LinkedIn BYO OAuth client (config, authorize, exchange, Fleet adapter). */
+export const linkedinByoOauth = createByoOauthClient({
+    providerId: "linkedin",
+    displayName: "LinkedIn",
+    envPrefix: "LINKEDIN_OAUTH",
+    defaultEndpoints: () => ({
+        authUrl: DEFAULT_AUTH_URL,
+        tokenUrl: DEFAULT_TOKEN_URL,
+        userInfoUrl: DEFAULT_USERINFO_URL,
+        defaultScopes: DEFAULT_SCOPES,
+    }),
+    parseUserInfo(json) {
+        return {
+            ...(typeof json.email === "string" && json.email
+                ? { email: json.email }
+                : {}),
+            ...(typeof json.sub === "string" && json.sub
+                ? { subject: json.sub }
+                : {}),
+        };
+    },
+    subjectMetadataKey: "linkedin_sub",
+});
+export const LINKEDIN_OAUTH_CLIENT_ID_ENV = linkedinByoOauth.env.clientId;
+export const LINKEDIN_OAUTH_CLIENT_SECRET_ENV = linkedinByoOauth.env.clientSecret;
+export const LINKEDIN_OAUTH_SCOPES_ENV = linkedinByoOauth.env.scopes;
+export const LINKEDIN_OAUTH_AUTH_URL_ENV = linkedinByoOauth.env.authUrl;
+export const LINKEDIN_OAUTH_TOKEN_URL_ENV = linkedinByoOauth.env.tokenUrl;
+export const LINKEDIN_OAUTH_USERINFO_URL_ENV = linkedinByoOauth.env.userInfoUrl;
+/** LinkedIn-bound OAuth state / connect-ticket helpers. */
+export const linkedinOauthTickets = linkedinByoOauth.tickets;
+export const resolveLinkedInOauthRedirectBase = linkedinByoOauth.resolveRedirectBase;
+export const readLinkedInOauthConfig = linkedinByoOauth.readConfig;
+export const buildLinkedInAuthorizeUrl = linkedinByoOauth.buildAuthorizeUrl;
+export const exchangeLinkedInOauthCode = linkedinByoOauth.exchangeCode;
+//# sourceMappingURL=oauth.js.map

package/dist/identity/linkedin/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/identity/linkedin/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,oBAAoB,GAGrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAIzB,MAAM,gBAAgB,GAAG,iDAAiD,CAAC;AAC3E,MAAM,iBAAiB,GAAG,+CAA+C,CAAC;AAC1E,MAAM,oBAAoB,GAAG,sCAAsC,CAAC;AACpE,4FAA4F;AAC5F,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAC3E,GAAG,CACJ,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAmB,oBAAoB,CAAC;IACnE,UAAU,EAAE,UAAU;IACtB,WAAW,EAAE,UAAU;IACvB,SAAS,EAAE,gBAAgB;IAC3B,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;QACvB,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,iBAAiB;QAC3B,WAAW,EAAE,oBAAoB;QACjC,aAAa,EAAE,cAAc;KAC9B,CAAC;IACF,aAAa,CAAC,IAAI;QAChB,OAAO;YACL,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK;gBAC9C,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;gBACvB,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG;gBAC1C,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;gBACvB,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IACD,kBAAkB,EAAE,cAAc;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC1E,MAAM,CAAC,MAAM,gCAAgC,GAC3C,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC;AACpC,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;AACrE,MAAM,CAAC,MAAM,2BAA2B,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC;AACxE,MAAM,CAAC,MAAM,4BAA4B,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC1E,MAAM,CAAC,MAAM,+BAA+B,GAAG,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC;AAEhF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,OAAO,CAAC;AAE7D,MAAM,CAAC,MAAM,gCAAgC,GAC3C,gBAAgB,CAAC,mBAAmB,CAAC;AAEvC,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC,UAAU,CAAC;AACnE,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC,iBAAiB,CAAC;AAC5E,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC,YAAY,CAAC"}

package/dist/identity/loopback.d.ts

@@ -1,8 +1,33 @@
 /**
  * Resolve the local Agent Server URL for trusted loopback clients.
  *
- * Prefers `explicit`, then `MDA_CHANNEL_API_URL` / `LANGGRAPH_API_URL` /
- * `LANGSMITH_ENDPOINT`, else `http://127.0.0.1:{PORT|8000}`.
+ * Prefers `explicit`, then `MDA_CHANNEL_API_URL` / `LANGGRAPH_API_URL`, else
+ * `http://127.0.0.1:{PORT|8000}`. `LANGSMITH_ENDPOINT` is deliberately not
+ * consulted: it is the tracing/API endpoint (LangSmith SaaS by default), not
+ * this server's origin.
  */
 export declare function resolveLoopbackApiUrl(explicit?: string): string;
+/**
+ * API key for trusted loopback LangGraph SDK clients.
+ *
+ * Prefers `explicit`, then `LANGSMITH_API_KEY`, else `"local"` (in-process /
+ * unit-test clients that do not authenticate against Host).
+ */
+export declare function resolveLoopbackApiKey(explicit?: string): string;
+/**
+ * Whether `value` addresses this host.
+ *
+ * Server-local trust (the ingress secret, which lets its holder assert any
+ * actor id) must never travel to an off-host origin, so callers gate it on
+ * this predicate.
+ *
+ * @param value - Absolute URL, or a host with an optional port.
+ */
+export declare function isLoopbackUrl(value: string): boolean;
+/**
+ * Whether a `Host`-style value (optional port, optional brackets) is loopback.
+ *
+ * @param host - Host value such as `localhost:8000`, `127.0.0.1`, or `[::1]:80`.
+ */
+export declare function isLoopbackHost(host: string): boolean;
 //# sourceMappingURL=loopback.d.ts.map

package/dist/identity/loopback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loopback.d.ts","sourceRoot":"","sources":["../../src/identity/loopback.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAW/D"}
+{"version":3,"file":"loopback.d.ts","sourceRoot":"","sources":["../../src/identity/loopback.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAW/D;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAG/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOpD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAepD"}

package/dist/identity/loopback.js

@@ -1,18 +1,71 @@
 /**
  * Resolve the local Agent Server URL for trusted loopback clients.
  *
- * Prefers `explicit`, then `MDA_CHANNEL_API_URL` / `LANGGRAPH_API_URL` /
- * `LANGSMITH_ENDPOINT`, else `http://127.0.0.1:{PORT|8000}`.
+ * Prefers `explicit`, then `MDA_CHANNEL_API_URL` / `LANGGRAPH_API_URL`, else
+ * `http://127.0.0.1:{PORT|8000}`. `LANGSMITH_ENDPOINT` is deliberately not
+ * consulted: it is the tracing/API endpoint (LangSmith SaaS by default), not
+ * this server's origin.
  */
 export function resolveLoopbackApiUrl(explicit) {
-    const fromEnv = explicit ??
-        process.env.MDA_CHANNEL_API_URL ??
-        process.env.LANGGRAPH_API_URL ??
-        process.env.LANGSMITH_ENDPOINT;
-    if (fromEnv && fromEnv.trim().length > 0) {
-        return fromEnv.replace(/\/$/, "");
+    const fromEnv = [
+        explicit,
+        process.env.MDA_CHANNEL_API_URL,
+        process.env.LANGGRAPH_API_URL,
+    ].find((value) => value && value.trim().length > 0);
+    if (fromEnv) {
+        return fromEnv.trim().replace(/\/$/, "");
     }
     const port = process.env.PORT ?? "8000";
     return `http://127.0.0.1:${port}`;
 }
+/**
+ * API key for trusted loopback LangGraph SDK clients.
+ *
+ * Prefers `explicit`, then `LANGSMITH_API_KEY`, else `"local"` (in-process /
+ * unit-test clients that do not authenticate against Host).
+ */
+export function resolveLoopbackApiKey(explicit) {
+    const key = (explicit ?? process.env.LANGSMITH_API_KEY)?.trim();
+    return key && key.length > 0 ? key : "local";
+}
+/**
+ * Whether `value` addresses this host.
+ *
+ * Server-local trust (the ingress secret, which lets its holder assert any
+ * actor id) must never travel to an off-host origin, so callers gate it on
+ * this predicate.
+ *
+ * @param value - Absolute URL, or a host with an optional port.
+ */
+export function isLoopbackUrl(value) {
+    try {
+        const url = new URL(value.includes("://") ? value : `http://${value}`);
+        return isLoopbackHost(url.hostname);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether a `Host`-style value (optional port, optional brackets) is loopback.
+ *
+ * @param host - Host value such as `localhost:8000`, `127.0.0.1`, or `[::1]:80`.
+ */
+export function isLoopbackHost(host) {
+    let hostname = host.trim().toLowerCase();
+    const bracketed = /^\[(?<inner>[^\]]+)\](?::\d+)?$/.exec(hostname);
+    if (bracketed?.groups) {
+        hostname = bracketed.groups.inner;
+    }
+    else if ((hostname.match(/:/g) ?? []).length === 1) {
+        hostname = hostname.split(":")[0];
+    }
+    if (hostname === "localhost") {
+        return true;
+    }
+    if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(hostname)) {
+        return hostname.split(".").every((part) => Number(part) <= 255);
+    }
+    return hostname === "::1" || hostname === "0:0:0:0:0:0:0:1";
+}
 //# sourceMappingURL=loopback.js.map

package/dist/identity/loopback.js.map

@@ -1 +1 @@
-{"version":3,"file":"loopback.js","sourceRoot":"","sources":["../../src/identity/loopback.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAiB;IACrD,MAAM,OAAO,GACX,QAAQ;QACR,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IACjC,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC;IACxC,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC"}
+{"version":3,"file":"loopback.js","sourceRoot":"","sources":["../../src/identity/loopback.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAiB;IACrD,MAAM,OAAO,GAAG;QACd,QAAQ;QACR,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,OAAO,CAAC,GAAG,CAAC,iBAAiB;KAC9B,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC;IACxC,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAiB;IACrD,MAAM,GAAG,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC;IAChE,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QACvE,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC;QACtB,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,KAAM,CAAC;IACrC,CAAC;SAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACrC,CAAC;IACD,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtD,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,iBAAiB,CAAC;AAC9D,CAAC"}

package/dist/identity/marketplace/connect-hint.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Connect-hint middleware for Fleet marketplace MCP bridges.
+ *
+ * Same proactive "not connected yet" system hint as toolserver Fleet OAuth
+ * integrations ({@link createFleetConnectHintMiddleware}), but the vault
+ * `provider_id` is discovered from the workspace `mcp_servers` row.
+ */
+import type { MarketplaceMcpIntegration } from "../../connectors/marketplace/catalog.js";
+import { resolveMarketplaceMcpServer } from "../../connectors/marketplace/fleet-mcp.js";
+import type { FleetOAuthIntegration } from "../../connectors/toolserver/integrations.js";
+import type { ManagedMiddleware } from "../../runtime/managed-middleware.js";
+import { type FleetConnectHintMiddlewareOptions } from "../fleet-connect-hint.js";
+import { listAgentConnections, type FleetClientOptions } from "../fleet.js";
+/** Adapt a marketplace catalog row to the Fleet Connect / hint integration shape. */
+export declare function marketplaceAsFleetHint(integration: MarketplaceMcpIntegration, providerId?: string): FleetOAuthIntegration;
+export type MarketplaceConnectHintMiddlewareOptions = Omit<FleetConnectHintMiddlewareOptions, "integration" | "providerSlug"> & {
+    fleet?: FleetClientOptions & {
+        list?: typeof listAgentConnections;
+        resolveServer?: typeof resolveMarketplaceMcpServer;
+    };
+};
+/**
+ * Absolute Connect start URL for a marketplace bridge (with optional ticket).
+ */
+export declare function marketplaceConnectHintUrl(integration: MarketplaceMcpIntegration, env?: NodeJS.ProcessEnv, userId?: string): Promise<string>;
+/**
+ * Middleware that injects a system hint when the caller has no vault connection
+ * for this marketplace MCP integration.
+ */
+export declare function createMarketplaceConnectHintMiddleware(integration: MarketplaceMcpIntegration, options?: MarketplaceConnectHintMiddlewareOptions): ManagedMiddleware;
+//# sourceMappingURL=connect-hint.d.ts.map

package/dist/identity/marketplace/connect-hint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-hint.d.ts","sourceRoot":"","sources":["../../../src/identity/marketplace/connect-hint.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACzF,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,EAGL,KAAK,iCAAiC,EACvC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,oBAAoB,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE5E,qFAAqF;AACrF,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,yBAAyB,EACtC,UAAU,SAAK,GACd,qBAAqB,CAYvB;AAED,MAAM,MAAM,uCAAuC,GAAG,IAAI,CACxD,iCAAiC,EACjC,aAAa,GAAG,cAAc,CAC/B,GAAG;IACF,KAAK,CAAC,EAAE,kBAAkB,GAAG;QAC3B,IAAI,CAAC,EAAE,OAAO,oBAAoB,CAAC;QACnC,aAAa,CAAC,EAAE,OAAO,2BAA2B,CAAC;KACpD,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,yBAAyB,EACtC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED;;;GAGG;AACH,wBAAgB,sCAAsC,CACpD,WAAW,EAAE,yBAAyB,EACtC,OAAO,GAAE,uCAA4C,GACpD,iBAAiB,CAwBnB"}

package/dist/identity/marketplace/connect-hint.js

@@ -0,0 +1,59 @@
+/**
+ * Connect-hint middleware for Fleet marketplace MCP bridges.
+ *
+ * Same proactive "not connected yet" system hint as toolserver Fleet OAuth
+ * integrations ({@link createFleetConnectHintMiddleware}), but the vault
+ * `provider_id` is discovered from the workspace `mcp_servers` row.
+ */
+import { resolveMarketplaceMcpServer } from "../../connectors/marketplace/fleet-mcp.js";
+import { agentIdFromActor } from "../actor-subject.js";
+import { createFleetConnectHintMiddleware, fleetConnectHintUrl, } from "../fleet-connect-hint.js";
+import { listAgentConnections } from "../fleet.js";
+/** Adapt a marketplace catalog row to the Fleet Connect / hint integration shape. */
+export function marketplaceAsFleetHint(integration, providerId = "") {
+    return {
+        id: integration.id,
+        connectId: integration.connectId,
+        displayName: integration.displayName,
+        defaultProviderSlug: providerId,
+        toolServerSlugs: [],
+        scopesBySlug: {},
+        ...(integration.scopes?.length
+            ? { profileScopes: [...integration.scopes] }
+            : {}),
+    };
+}
+/**
+ * Absolute Connect start URL for a marketplace bridge (with optional ticket).
+ */
+export async function marketplaceConnectHintUrl(integration, env = process.env, userId) {
+    return fleetConnectHintUrl(marketplaceAsFleetHint(integration), env, userId);
+}
+/**
+ * Middleware that injects a system hint when the caller has no vault connection
+ * for this marketplace MCP integration.
+ */
+export function createMarketplaceConnectHintMiddleware(integration, options = {}) {
+    const list = options.fleet?.list ?? listAgentConnections;
+    const resolve = options.fleet?.resolveServer ?? resolveMarketplaceMcpServer;
+    return createFleetConnectHintMiddleware({
+        integration: marketplaceAsFleetHint(integration),
+        resolvePublicAppUrl: options.resolvePublicAppUrl,
+        fleet: options.fleet,
+        isConnected: options.isConnected ??
+            (async (userId) => {
+                const server = await resolve({
+                    mcpUrl: integration.mcpUrl,
+                    ...(options.fleet ?? {}),
+                });
+                const providerId = server.oauth_provider_id?.trim();
+                if (!providerId) {
+                    return false;
+                }
+                const agentId = agentIdFromActor(userId);
+                const connections = await list(agentId, options.fleet ?? {});
+                return connections.some((c) => c.provider_id === providerId);
+            }),
+    });
+}
+//# sourceMappingURL=connect-hint.js.map

package/dist/identity/marketplace/connect-hint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-hint.js","sourceRoot":"","sources":["../../../src/identity/marketplace/connect-hint.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AAGxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACL,gCAAgC,EAChC,mBAAmB,GAEpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,oBAAoB,EAA2B,MAAM,aAAa,CAAC;AAE5E,qFAAqF;AACrF,MAAM,UAAU,sBAAsB,CACpC,WAAsC,EACtC,UAAU,GAAG,EAAE;IAEf,OAAO;QACL,EAAE,EAAE,WAAW,CAAC,EAAE;QAClB,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,mBAAmB,EAAE,UAAU;QAC/B,eAAe,EAAE,EAAE;QACnB,YAAY,EAAE,EAAE;QAChB,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM;YAC5B,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAYD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,WAAsC,EACtC,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,MAAe;IAEf,OAAO,mBAAmB,CAAC,sBAAsB,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sCAAsC,CACpD,WAAsC,EACtC,OAAO,GAA4C,EAAE;IAErD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,IAAI,oBAAoB,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,aAAa,IAAI,2BAA2B,CAAC;IAE5E,OAAO,gCAAgC,CAAC;QACtC,WAAW,EAAE,sBAAsB,CAAC,WAAW,CAAC;QAChD,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW,EACT,OAAO,CAAC,WAAW;YACnB,CAAC,KAAK,EAAE,MAAc,EAAE,EAAE;gBACxB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;oBAC3B,MAAM,EAAE,WAAW,CAAC,MAAM;oBAC1B,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;iBACzB,CAAC,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;gBACpD,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACzC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC7D,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC;YAC/D,CAAC,CAAC;KACL,CAAC,CAAC;AACL,CAAC"}

package/dist/identity/marketplace/connect.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Connect-with-X for Fleet marketplace MCP integrations.
+ *
+ * Thin adapter over {@link createFleetVaultConnectProvider}: same actor →
+ * agent_id vault lifecycle as Google / Microsoft / LinkedIn, but the OAuth
+ * provider slug is discovered at runtime from the workspace `mcp_servers` row.
+ *
+ * `connect.<id>()` factories and identity-http candidates are derived from
+ * {@link MARKETPLACE_MCP_INTEGRATIONS}.
+ */
+import { type MarketplaceMcpIntegration, type MarketplaceMcpIntegrationId } from "../../connectors/marketplace/catalog.js";
+import { resolveMarketplaceMcpServer } from "../../connectors/marketplace/fleet-mcp.js";
+import type { IdentityConnectProvider } from "../connect-provider-types.js";
+import { createFleetAuthSession, deleteAgentConnection, listAgentConnections, type FleetClientOptions } from "../fleet.js";
+export interface MarketplaceConnectProviderOptions {
+    /** Injectable Fleet client (tests). */
+    fleet?: FleetClientOptions & {
+        list?: typeof listAgentConnections;
+        delete?: typeof deleteAgentConnection;
+        resolveServer?: typeof resolveMarketplaceMcpServer;
+        createSession?: typeof createFleetAuthSession;
+    };
+    /** Override OAuth scopes (default: integration.scopes). */
+    scopes?: string[];
+}
+/** `connect.<id>()` factories for every marketplace catalog entry. */
+export type MarketplaceConnect = {
+    [Id in MarketplaceMcpIntegrationId]: (options?: MarketplaceConnectProviderOptions) => IdentityConnectProvider;
+};
+/**
+ * Build a Connect provider for a marketplace MCP integration.
+ *
+ * Mounts when declared on `identity.connect`, or when the matching
+ * `connectors.<id>` is present on a user-scoped deployment.
+ */
+export declare function createMarketplaceVaultConnectProvider(integration: MarketplaceMcpIntegration, options?: MarketplaceConnectProviderOptions): IdentityConnectProvider;
+/**
+ * Default Connect providers for every marketplace catalog entry.
+ *
+ * Shared between `connect.<id>()` (no options) and identity-http candidates so
+ * mount inference and explicit opt-in use the same instances.
+ */
+export declare const marketplaceIdentityConnectProviders: IdentityConnectProvider[];
+/**
+ * `connect.<id>()` factories derived from the marketplace catalog.
+ *
+ * Usually unnecessary: declaring `connectors.<id>` on a user-scoped identity
+ * deployment mounts the matching Connect flow automatically.
+ */
+export declare const marketplaceConnect: MarketplaceConnect;
+//# sourceMappingURL=connect.d.ts.map

package/dist/identity/marketplace/connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../../src/identity/marketplace/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAGL,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EACjC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AAExF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAK5E,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,KAAK,kBAAkB,EACxB,MAAM,aAAa,CAAC;AAQrB,MAAM,WAAW,iCAAiC;IAChD,uCAAuC;IACvC,KAAK,CAAC,EAAE,kBAAkB,GAAG;QAC3B,IAAI,CAAC,EAAE,OAAO,oBAAoB,CAAC;QACnC,MAAM,CAAC,EAAE,OAAO,qBAAqB,CAAC;QACtC,aAAa,CAAC,EAAE,OAAO,2BAA2B,CAAC;QACnD,aAAa,CAAC,EAAE,OAAO,sBAAsB,CAAC;KAC/C,CAAC;IACF,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,sEAAsE;AACtE,MAAM,MAAM,kBAAkB,GAAG;KAC9B,EAAE,IAAI,2BAA2B,GAAG,CACnC,OAAO,CAAC,EAAE,iCAAiC,KACxC,uBAAuB;CAC7B,CAAC;AAuBF;;;;;GAKG;AACH,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,yBAAyB,EACtC,OAAO,GAAE,iCAAsC,GAC9C,uBAAuB,CAqCzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,EAAE,uBAAuB,EAGtE,CAAC;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,kBAUV,CAAC"}

package/dist/identity/marketplace/connect.js

@@ -0,0 +1,88 @@
+/**
+ * Connect-with-X for Fleet marketplace MCP integrations.
+ *
+ * Thin adapter over {@link createFleetVaultConnectProvider}: same actor →
+ * agent_id vault lifecycle as Google / Microsoft / LinkedIn, but the OAuth
+ * provider slug is discovered at runtime from the workspace `mcp_servers` row.
+ *
+ * `connect.<id>()` factories and identity-http candidates are derived from
+ * {@link MARKETPLACE_MCP_INTEGRATIONS}.
+ */
+import { MARKETPLACE_MCP_INTEGRATIONS, hasMarketplaceConnector, } from "../../connectors/marketplace/catalog.js";
+import { resolveMarketplaceMcpServer } from "../../connectors/marketplace/fleet-mcp.js";
+import { enableActorSubjectIntegration } from "../actor-subject.js";
+import { createFleetVaultConnectProvider, } from "../fleet-connect.js";
+import { createFleetAuthSession, deleteAgentConnection, listAgentConnections, } from "../fleet.js";
+import { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, resolveOauthRedirectBase, } from "../oauth-env.js";
+import { marketplaceAsFleetHint } from "./connect-hint.js";
+function fleetClientOptions(fleet) {
+    if (!fleet) {
+        return undefined;
+    }
+    const { list, delete: remove, createSession, resolveServer: _resolveServer, ...rest } = fleet;
+    return {
+        ...rest,
+        ...(list ? { list } : {}),
+        ...(remove ? { delete: remove } : {}),
+        ...(createSession ? { createAuthSession: createSession } : {}),
+    };
+}
+/**
+ * Build a Connect provider for a marketplace MCP integration.
+ *
+ * Mounts when declared on `identity.connect`, or when the matching
+ * `connectors.<id>` is present on a user-scoped deployment.
+ */
+export function createMarketplaceVaultConnectProvider(integration, options = {}) {
+    const resolveServer = options.fleet?.resolveServer ?? resolveMarketplaceMcpServer;
+    const fleet = fleetClientOptions(options.fleet);
+    return createFleetVaultConnectProvider({
+        integration: marketplaceAsFleetHint(integration),
+        ...(options.scopes ? { scopes: [...options.scopes] } : {}),
+        fallbackScopes: [...(integration.scopes ?? [])],
+        resolveRedirectBase: resolveOauthRedirectBase,
+        resolvePublicAppUrl() {
+            return (process.env[MDA_PUBLIC_APP_URL_ENV]?.replace(/\/$/, "") ||
+                process.env[MDA_PUBLIC_API_URL_ENV]?.replace(/\/$/, ""));
+        },
+        ...(fleet ? { fleet } : {}),
+        async resolveProviderSlug() {
+            const server = await resolveServer({
+                mcpUrl: integration.mcpUrl,
+                ...(fleet ?? {}),
+            });
+            const providerId = server.oauth_provider_id?.trim();
+            if (!providerId) {
+                throw new Error(`${integration.displayName} MCP server has no oauth_provider_id`);
+            }
+            return providerId;
+        },
+        hasDeclaredConnector: (kinds) => hasMarketplaceConnector(integration.id, kinds),
+        notConfiguredError: `${integration.displayName} connect needs LANGSMITH_API_KEY ` +
+            `(and a workspace ${integration.displayName} MCP server from Fleet marketplace).`,
+        softAuthorizeFailures: true,
+    });
+}
+/**
+ * Default Connect providers for every marketplace catalog entry.
+ *
+ * Shared between `connect.<id>()` (no options) and identity-http candidates so
+ * mount inference and explicit opt-in use the same instances.
+ */
+export const marketplaceIdentityConnectProviders = MARKETPLACE_MCP_INTEGRATIONS.map((entry) => createMarketplaceVaultConnectProvider(entry));
+/**
+ * `connect.<id>()` factories derived from the marketplace catalog.
+ *
+ * Usually unnecessary: declaring `connectors.<id>` on a user-scoped identity
+ * deployment mounts the matching Connect flow automatically.
+ */
+export const marketplaceConnect = Object.fromEntries(MARKETPLACE_MCP_INTEGRATIONS.map((entry, index) => [
+    entry.id,
+    (options) => {
+        enableActorSubjectIntegration(entry.id);
+        return options
+            ? createMarketplaceVaultConnectProvider(entry, options)
+            : marketplaceIdentityConnectProviders[index];
+    },
+]));
+//# sourceMappingURL=connect.js.map

package/dist/identity/marketplace/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../../src/identity/marketplace/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,GAGxB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAEpE,OAAO,EACL,+BAA+B,GAEhC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,GAErB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAqB3D,SAAS,kBAAkB,CACzB,KAAiD;IAEjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EACJ,IAAI,EACJ,MAAM,EAAE,MAAM,EACd,aAAa,EACb,aAAa,EAAE,cAAc,EAC7B,GAAG,IAAI,EACR,GAAG,KAAK,CAAC;IACV,OAAO;QACL,GAAG,IAAI;QACP,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CACnD,WAAsC,EACtC,OAAO,GAAsC,EAAE;IAE/C,MAAM,aAAa,GACjB,OAAO,CAAC,KAAK,EAAE,aAAa,IAAI,2BAA2B,CAAC;IAC9D,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAEhD,OAAO,+BAA+B,CAAC;QACrC,WAAW,EAAE,sBAAsB,CAAC,WAAW,CAAC;QAChD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,cAAc,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC/C,mBAAmB,EAAE,wBAAwB;QAC7C,mBAAmB;YACjB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBACvD,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,mBAAmB;YACvB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;gBACjC,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;aACjB,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,GAAG,WAAW,CAAC,WAAW,sCAAsC,CACjE,CAAC;YACJ,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC9B,uBAAuB,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC;QAChD,kBAAkB,EAChB,GAAG,WAAW,CAAC,WAAW,mCAAmC;YAC7D,oBAAoB,WAAW,CAAC,WAAW,sCAAsC;QACnF,qBAAqB,EAAE,IAAI;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAC9C,4BAA4B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,qCAAqC,CAAC,KAAK,CAAC,CAC7C,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAuB,MAAM,CAAC,WAAW,CACtE,4BAA4B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;IACjD,KAAK,CAAC,EAAE;IACR,CAAC,OAA2C,EAAE,EAAE;QAC9C,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxC,OAAO,OAAO;YACZ,CAAC,CAAC,qCAAqC,CAAC,KAAK,EAAE,OAAO,CAAC;YACvD,CAAC,CAAC,mCAAmC,CAAC,KAAK,CAAE,CAAC;IAClD,CAAC;CACF,CAAC,CACmB,CAAC"}

package/dist/identity/marketplace/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Marketplace identity helpers — Connect-with-X for Fleet marketplace MCP bridges.
+ *
+ * One surface covers every catalog entry (Notion, Cloudflare, Neon, …): vault
+ * Connect providers, `connect.<id>()` factories, and proactive connect hints.
+ */
+export { createMarketplaceVaultConnectProvider, marketplaceConnect, marketplaceIdentityConnectProviders, type MarketplaceConnect, type MarketplaceConnectProviderOptions, } from "./connect.js";
+export { createMarketplaceConnectHintMiddleware, marketplaceAsFleetHint, marketplaceConnectHintUrl, type MarketplaceConnectHintMiddlewareOptions, } from "./connect-hint.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/marketplace/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/marketplace/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,qCAAqC,EACrC,kBAAkB,EAClB,mCAAmC,EACnC,KAAK,kBAAkB,EACvB,KAAK,iCAAiC,GACvC,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sCAAsC,EACtC,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,uCAAuC,GAC7C,MAAM,mBAAmB,CAAC"}

package/dist/identity/marketplace/index.js

@@ -0,0 +1,9 @@
+/**
+ * Marketplace identity helpers — Connect-with-X for Fleet marketplace MCP bridges.
+ *
+ * One surface covers every catalog entry (Notion, Cloudflare, Neon, …): vault
+ * Connect providers, `connect.<id>()` factories, and proactive connect hints.
+ */
+export { createMarketplaceVaultConnectProvider, marketplaceConnect, marketplaceIdentityConnectProviders, } from "./connect.js";
+export { createMarketplaceConnectHintMiddleware, marketplaceAsFleetHint, marketplaceConnectHintUrl, } from "./connect-hint.js";
+//# sourceMappingURL=index.js.map

package/dist/identity/marketplace/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/marketplace/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,qCAAqC,EACrC,kBAAkB,EAClB,mCAAmC,GAGpC,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sCAAsC,EACtC,sBAAsB,EACtB,yBAAyB,GAE1B,MAAM,mBAAmB,CAAC"}

package/dist/identity/microsoft/connect-http.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Connect-with-Microsoft — thin adapter over {@link defineFleetIntegrationConnect}.
+ *
+ * Mounted under `/identity/microsoft/*` when listed on `identity.connect`, or
+ * inferred from declared Microsoft toolserver connectors on a user-scoped
+ * deployment.
+ */
+import type { FleetIntegrationConnectProviderOptions } from "../fleet-integration-connect.js";
+export declare const MICROSOFT_CONNECT_STATUS_PATH: string;
+export declare const MICROSOFT_CONNECT_START_PATH: string;
+export declare const MICROSOFT_CONNECT_CALLBACK_PATH: string;
+export declare const MICROSOFT_CONNECT_LINK_PATH: string;
+export declare const isMicrosoftActorSubjectEnabled: () => boolean;
+export declare const enableMicrosoftActorSubject: () => void;
+/**
+ * Enable actor-subject mode when Microsoft connectors imply per-user vault subjects.
+ *
+ * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
+ */
+export declare const enableMicrosoftActorSubjectFromConnectors: (connectorKinds: readonly (string | undefined)[] | undefined, scope?: import("../connect-provider-types.js").IdentityConnectMountContext["scope"]) => void;
+export declare const resetMicrosoftActorSubjectEnabledForTests: () => void;
+export declare const isMicrosoftConnectConfigured: (env?: NodeJS.ProcessEnv) => boolean;
+export declare const microsoftConnectUrl: (publicAppUrl: string) => string;
+/** Options for {@link createMicrosoftIdentityConnectProvider}. */
+export type MicrosoftIdentityConnectProviderOptions = FleetIntegrationConnectProviderOptions;
+/** Build a Microsoft connect provider. */
+export declare const createMicrosoftIdentityConnectProvider: (options?: FleetIntegrationConnectProviderOptions) => import("../connect-provider-types.js").IdentityConnectProvider;
+/** Default Microsoft connect provider used as a built-in mount candidate. */
+export declare const microsoftIdentityConnectProvider: import("../connect-provider-types.js").IdentityConnectProvider;
+/**
+ * Opt into Connect-with-Microsoft on `defineIdentity({ connect: […] })`.
+ *
+ * Usually unnecessary: declaring Microsoft toolserver connectors on a
+ * user-scoped identity deployment mounts this provider and derives OAuth
+ * scopes automatically.
+ */
+export declare const connect: (options?: FleetIntegrationConnectProviderOptions) => import("../connect-provider-types.js").IdentityConnectProvider;
+//# sourceMappingURL=connect-http.d.ts.map

package/dist/identity/microsoft/connect-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/microsoft/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAC;AAQ9F,eAAO,MAAM,6BAA6B,QAAyB,CAAC;AACpE,eAAO,MAAM,4BAA4B,QAA0B,CAAC;AACpE,eAAO,MAAM,+BAA+B,QAA2B,CAAC;AACxE,eAAO,MAAM,2BAA2B,QAAuB,CAAC;AAEhE,eAAO,MAAM,8BAA8B,eAAkC,CAAC;AAC9E,eAAO,MAAM,2BAA2B,YAA+B,CAAC;AACxE;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,4JACV,CAAC;AAC7C,eAAO,MAAM,yCAAyC,YACV,CAAC;AAC7C,eAAO,MAAM,4BAA4B,sCAAgC,CAAC;AAC1E,eAAO,MAAM,mBAAmB,kCAAuB,CAAC;AAExD,kEAAkE;AAClE,MAAM,MAAM,uCAAuC,GACjD,sCAAsC,CAAC;AAEzC,0CAA0C;AAC1C,eAAO,MAAM,sCAAsC,sHAA2B,CAAC;AAE/E,6EAA6E;AAC7E,eAAO,MAAM,gCAAgC,gEAAqB,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,sHAAoB,CAAC"}

package/dist/identity/microsoft/connect-http.js

@@ -0,0 +1,42 @@
+/**
+ * Connect-with-Microsoft — thin adapter over {@link defineFleetIntegrationConnect}.
+ *
+ * Mounted under `/identity/microsoft/*` when listed on `identity.connect`, or
+ * inferred from declared Microsoft toolserver connectors on a user-scoped
+ * deployment.
+ */
+import { MICROSOFT_INTEGRATION } from "../../connectors/toolserver/integrations.js";
+import { defineFleetIntegrationConnect } from "../define-fleet-connect.js";
+import { microsoftByoOauth } from "./oauth.js";
+const microsoft = defineFleetIntegrationConnect({
+    integration: MICROSOFT_INTEGRATION,
+    byoClient: microsoftByoOauth,
+});
+export const MICROSOFT_CONNECT_STATUS_PATH = microsoft.paths.status;
+export const MICROSOFT_CONNECT_START_PATH = microsoft.paths.connect;
+export const MICROSOFT_CONNECT_CALLBACK_PATH = microsoft.paths.callback;
+export const MICROSOFT_CONNECT_LINK_PATH = microsoft.paths.link;
+export const isMicrosoftActorSubjectEnabled = microsoft.isActorSubjectEnabled;
+export const enableMicrosoftActorSubject = microsoft.enableActorSubject;
+/**
+ * Enable actor-subject mode when Microsoft connectors imply per-user vault subjects.
+ *
+ * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
+ */
+export const enableMicrosoftActorSubjectFromConnectors = microsoft.enableActorSubjectFromConnectors;
+export const resetMicrosoftActorSubjectEnabledForTests = microsoft.resetActorSubjectEnabledForTests;
+export const isMicrosoftConnectConfigured = microsoft.isConnectConfigured;
+export const microsoftConnectUrl = microsoft.connectUrl;
+/** Build a Microsoft connect provider. */
+export const createMicrosoftIdentityConnectProvider = microsoft.createProvider;
+/** Default Microsoft connect provider used as a built-in mount candidate. */
+export const microsoftIdentityConnectProvider = microsoft.provider;
+/**
+ * Opt into Connect-with-Microsoft on `defineIdentity({ connect: […] })`.
+ *
+ * Usually unnecessary: declaring Microsoft toolserver connectors on a
+ * user-scoped identity deployment mounts this provider and derives OAuth
+ * scopes automatically.
+ */
+export const connect = microsoft.connect;
+//# sourceMappingURL=connect-http.js.map

package/dist/identity/microsoft/connect-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/microsoft/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAE3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,SAAS,GAAG,6BAA6B,CAAC;IAC9C,WAAW,EAAE,qBAAqB;IAClC,SAAS,EAAE,iBAAiB;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;AACpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;AACpE,MAAM,CAAC,MAAM,+BAA+B,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;AACxE,MAAM,CAAC,MAAM,2BAA2B,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;AAEhE,MAAM,CAAC,MAAM,8BAA8B,GAAG,SAAS,CAAC,qBAAqB,CAAC;AAC9E,MAAM,CAAC,MAAM,2BAA2B,GAAG,SAAS,CAAC,kBAAkB,CAAC;AACxE;;;;GAIG;AACH,MAAM,CAAC,MAAM,yCAAyC,GACpD,SAAS,CAAC,gCAAgC,CAAC;AAC7C,MAAM,CAAC,MAAM,yCAAyC,GACpD,SAAS,CAAC,gCAAgC,CAAC;AAC7C,MAAM,CAAC,MAAM,4BAA4B,GAAG,SAAS,CAAC,mBAAmB,CAAC;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC,UAAU,CAAC;AAMxD,0CAA0C;AAC1C,MAAM,CAAC,MAAM,sCAAsC,GAAG,SAAS,CAAC,cAAc,CAAC;AAE/E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CAAC,QAAQ,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC"}

package/dist/identity/microsoft/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Microsoft identity helpers — Connect-with-Microsoft (Fleet vault).
+ */
+export { connect, createMicrosoftIdentityConnectProvider, enableMicrosoftActorSubject, enableMicrosoftActorSubjectFromConnectors, microsoftConnectUrl, microsoftIdentityConnectProvider, isMicrosoftActorSubjectEnabled, isMicrosoftConnectConfigured, resetMicrosoftActorSubjectEnabledForTests, MICROSOFT_CONNECT_CALLBACK_PATH, MICROSOFT_CONNECT_LINK_PATH, MICROSOFT_CONNECT_START_PATH, MICROSOFT_CONNECT_STATUS_PATH, } from "./connect-http.js";
+export type { MicrosoftIdentityConnectProviderOptions } from "./connect-http.js";
+export { microsoftOauthTickets } from "./oauth.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/microsoft/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/microsoft/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,sCAAsC,EACtC,2BAA2B,EAC3B,yCAAyC,EACzC,mBAAmB,EACnB,gCAAgC,EAChC,8BAA8B,EAC9B,4BAA4B,EAC5B,yCAAyC,EACzC,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,uCAAuC,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC"}

package/dist/identity/microsoft/index.js

@@ -0,0 +1,6 @@
+/**
+ * Microsoft identity helpers — Connect-with-Microsoft (Fleet vault).
+ */
+export { connect, createMicrosoftIdentityConnectProvider, enableMicrosoftActorSubject, enableMicrosoftActorSubjectFromConnectors, microsoftConnectUrl, microsoftIdentityConnectProvider, isMicrosoftActorSubjectEnabled, isMicrosoftConnectConfigured, resetMicrosoftActorSubjectEnabledForTests, MICROSOFT_CONNECT_CALLBACK_PATH, MICROSOFT_CONNECT_LINK_PATH, MICROSOFT_CONNECT_START_PATH, MICROSOFT_CONNECT_STATUS_PATH, } from "./connect-http.js";
+export { microsoftOauthTickets } from "./oauth.js";
+//# sourceMappingURL=index.js.map

package/dist/identity/microsoft/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/microsoft/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,sCAAsC,EACtC,2BAA2B,EAC3B,yCAAyC,EACzC,mBAAmB,EACnB,gCAAgC,EAChC,8BAA8B,EAC9B,4BAA4B,EAC5B,yCAAyC,EACzC,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC"}

package/dist/identity/microsoft/oauth.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Microsoft BYO OAuth descriptor — optional non-LangSmith Connect-with-Microsoft.
+ * The default path uses Fleet auth-sessions instead.
+ */
+import { type ByoOauthConfig, type ByoOauthClient } from "../byo-oauth.js";
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, } from "../byo-oauth.js";
+export type MicrosoftOauthConfig = ByoOauthConfig;
+/** Azure AD tenant (`common`, `organizations`, `consumers`, or a tenant id). */
+export declare const MICROSOFT_OAUTH_TENANT_ENV = "MICROSOFT_OAUTH_TENANT";
+/** Microsoft BYO OAuth client (config, authorize, exchange, Fleet adapter). */
+export declare const microsoftByoOauth: ByoOauthClient;
+export declare const MICROSOFT_OAUTH_CLIENT_ID_ENV: string;
+export declare const MICROSOFT_OAUTH_CLIENT_SECRET_ENV: string;
+export declare const MICROSOFT_OAUTH_SCOPES_ENV: string;
+export declare const MICROSOFT_OAUTH_AUTH_URL_ENV: string;
+export declare const MICROSOFT_OAUTH_TOKEN_URL_ENV: string;
+export declare const MICROSOFT_OAUTH_USERINFO_URL_ENV: string;
+/** Microsoft-bound OAuth state / connect-ticket helpers. */
+export declare const microsoftOauthTickets: import("../oauth-tickets.js").OauthTickets;
+export declare const resolveMicrosoftOauthRedirectBase: typeof import("../oauth-env.js").resolveOauthRedirectBase;
+export declare const readMicrosoftOauthConfig: (env?: NodeJS.ProcessEnv) => ByoOauthConfig | null;
+export declare const buildMicrosoftAuthorizeUrl: (config: ByoOauthConfig, state: string, redirectUri: string, scopes?: string) => string;
+export declare const exchangeMicrosoftOauthCode: (config: ByoOauthConfig, code: string, redirectUri: string, fetchImpl?: typeof fetch) => Promise<import("../fleet-connect.js").FleetVaultByoTokenResult>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/identity/microsoft/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/microsoft/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAElD,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AAqBnE,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,EAAE,cA2B9B,CAAC;AAEH,eAAO,MAAM,6BAA6B,QAAiC,CAAC;AAC5E,eAAO,MAAM,iCAAiC,QACV,CAAC;AACrC,eAAO,MAAM,0BAA0B,QAA+B,CAAC;AACvE,eAAO,MAAM,4BAA4B,QAAgC,CAAC;AAC1E,eAAO,MAAM,6BAA6B,QAAiC,CAAC;AAC5E,eAAO,MAAM,gCAAgC,QACV,CAAC;AAEpC,4DAA4D;AAC5D,eAAO,MAAM,qBAAqB,4CAA4B,CAAC;AAE/D,eAAO,MAAM,iCAAiC,2DACP,CAAC;AAExC,eAAO,MAAM,wBAAwB,oDAA+B,CAAC;AACrE,eAAO,MAAM,0BAA0B,yFAAsC,CAAC;AAC9E,eAAO,MAAM,0BAA0B,0JAAiC,CAAC"}