managed-deepagents 0.4.2 → 0.4.3-dev.95

package/dist/identity/byo-oauth.js

@@ -0,0 +1,190 @@
+/**
+ * Factory for optional BYO (bring-your-own) OAuth clients used when Fleet
+ * auth-sessions are unavailable.
+ *
+ * Vendor modules supply endpoints, authorize extras, and userinfo parsing;
+ * this module owns config env reading, authorize URL construction, token
+ * exchange, and the {@link FleetVaultByoOauth} adapter.
+ */
+import { fetchWithTimeout, PROVIDER_HTTP_TIMEOUT_MS } from "../runtime/http.js";
+import { oauthTicketsFor } from "./oauth-tickets.js";
+import { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, resolveOauthRedirectBase, } from "./oauth-env.js";
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, resolveOauthRedirectBase, resolveSlackOauthRedirectBase, } from "./oauth-env.js";
+function stripSlash(value) {
+    return value.replace(/\/$/, "");
+}
+function envKeysFromPrefix(prefix) {
+    return {
+        clientId: `${prefix}_CLIENT_ID`,
+        clientSecret: `${prefix}_CLIENT_SECRET`,
+        scopes: `${prefix}_SCOPES`,
+        authUrl: `${prefix}_AUTH_URL`,
+        tokenUrl: `${prefix}_TOKEN_URL`,
+        userInfoUrl: `${prefix}_USERINFO_URL`,
+    };
+}
+/** Build a BYO OAuth client for one Fleet vault Connect integration. */
+export function createByoOauthClient(options) {
+    const keys = { ...envKeysFromPrefix(options.envPrefix), ...options.envKeys };
+    const tickets = oauthTicketsFor(options.providerId);
+    const authorizeExtras = {
+        ...(options.defaultPrompt === false
+            ? {}
+            : { prompt: options.defaultPrompt ?? "consent" }),
+        ...options.authorizeParams,
+    };
+    const tokenFormat = options.tokenRequest?.format ?? "form";
+    const tokenHeaders = options.tokenRequest?.headers;
+    const userInfoHeaders = options.userInfoRequest?.headers;
+    const requireUserInfo = options.userInfoRequest?.required ?? false;
+    function readConfig(env = process.env) {
+        const clientId = env[keys.clientId]?.trim();
+        const clientSecret = env[keys.clientSecret]?.trim();
+        const publicAppUrl = env[MDA_PUBLIC_APP_URL_ENV]?.trim() ||
+            env[MDA_PUBLIC_API_URL_ENV]?.trim();
+        if (!clientId || !clientSecret || !publicAppUrl) {
+            return null;
+        }
+        const defaults = options.defaultEndpoints(env);
+        return {
+            clientId,
+            clientSecret,
+            publicAppUrl: stripSlash(publicAppUrl),
+            scopes: env[keys.scopes]?.trim() || defaults.defaultScopes,
+            authUrl: stripSlash(env[keys.authUrl]?.trim() || defaults.authUrl),
+            tokenUrl: stripSlash(env[keys.tokenUrl]?.trim() || defaults.tokenUrl),
+            userInfoUrl: stripSlash(env[keys.userInfoUrl]?.trim() || defaults.userInfoUrl),
+        };
+    }
+    function buildAuthorizeUrl(config, state, redirectUri, scopes) {
+        const url = new URL(config.authUrl);
+        url.searchParams.set("client_id", config.clientId);
+        url.searchParams.set("redirect_uri", redirectUri);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("scope", scopes?.trim() || config.scopes);
+        url.searchParams.set("state", state);
+        for (const [key, value] of Object.entries(authorizeExtras)) {
+            url.searchParams.set(key, value);
+        }
+        return url.toString();
+    }
+    async function exchangeCode(config, code, redirectUri, fetchImpl = fetch) {
+        const tokenInit = tokenFormat === "json"
+            ? {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    ...tokenHeaders,
+                },
+                body: JSON.stringify({
+                    client_id: config.clientId,
+                    client_secret: config.clientSecret,
+                    code,
+                    redirect_uri: redirectUri,
+                }),
+            }
+            : {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/x-www-form-urlencoded",
+                    ...tokenHeaders,
+                },
+                body: new URLSearchParams({
+                    code,
+                    client_id: config.clientId,
+                    client_secret: config.clientSecret,
+                    redirect_uri: redirectUri,
+                    grant_type: "authorization_code",
+                }),
+            };
+        const tokenResponse = await fetchWithTimeout(config.tokenUrl, tokenInit, PROVIDER_HTTP_TIMEOUT_MS, fetchImpl);
+        const tokenJson = (await tokenResponse.json());
+        if (!tokenResponse.ok || !tokenJson.access_token) {
+            throw new Error(tokenJson.error_description ??
+                tokenJson.error ??
+                `${options.displayName} OAuth token exchange failed`);
+        }
+        let accountLabel;
+        let subject;
+        let extraMetadata;
+        try {
+            const userResponse = await fetchWithTimeout(config.userInfoUrl, {
+                headers: {
+                    Authorization: `Bearer ${tokenJson.access_token}`,
+                    ...userInfoHeaders,
+                },
+            }, PROVIDER_HTTP_TIMEOUT_MS, fetchImpl);
+            if (!userResponse.ok) {
+                if (requireUserInfo) {
+                    const errJson = (await userResponse.json().catch(() => ({})));
+                    throw new Error(errJson.message ?? `${options.displayName} userinfo lookup failed`);
+                }
+            }
+            else {
+                const userJson = (await userResponse.json());
+                const parsed = options.parseUserInfo(userJson);
+                if (parsed.email) {
+                    accountLabel = parsed.email;
+                }
+                if (parsed.subject) {
+                    subject = parsed.subject;
+                }
+                if (parsed.metadata) {
+                    extraMetadata = parsed.metadata;
+                }
+                if (requireUserInfo && !subject) {
+                    throw new Error(`${options.displayName} userinfo missing subject`);
+                }
+            }
+        }
+        catch (error) {
+            if (requireUserInfo) {
+                throw error;
+            }
+            // Account label is optional for vault import.
+        }
+        const metadata = {
+            ...extraMetadata,
+            ...(subject ? { [options.subjectMetadataKey]: subject } : {}),
+        };
+        return {
+            accessToken: tokenJson.access_token,
+            ...(tokenJson.refresh_token
+                ? { refreshToken: tokenJson.refresh_token }
+                : {}),
+            ...(typeof tokenJson.expires_in === "number"
+                ? { expiresInSeconds: tokenJson.expires_in }
+                : {}),
+            ...(tokenJson.scope ? { scope: tokenJson.scope } : {}),
+            ...(tokenJson.token_type ? { tokenType: tokenJson.token_type } : {}),
+            ...(accountLabel ? { accountLabel } : {}),
+            ...(Object.keys(metadata).length > 0 ? { metadata } : {}),
+        };
+    }
+    const byo = {
+        readConfig,
+        buildAuthorizeUrl(config, state, redirectUri, scopes) {
+            return buildAuthorizeUrl(config, state, redirectUri, scopes);
+        },
+        exchangeCode(config, code, redirectUri) {
+            return exchangeCode(config, code, redirectUri);
+        },
+    };
+    function resolvePublicAppUrl(env = process.env) {
+        return (readConfig(env)?.publicAppUrl ??
+            env[MDA_PUBLIC_APP_URL_ENV]?.trim().replace(/\/$/, ""));
+    }
+    return {
+        providerId: options.providerId,
+        displayName: options.displayName,
+        env: keys,
+        tickets,
+        resolveRedirectBase: resolveOauthRedirectBase,
+        readConfig,
+        buildAuthorizeUrl,
+        exchangeCode,
+        byo,
+        resolvePublicAppUrl,
+    };
+}
+//# sourceMappingURL=byo-oauth.js.map

package/dist/identity/byo-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"byo-oauth.js","sourceRoot":"","sources":["../../src/identity/byo-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAKhF,OAAO,EAAE,eAAe,EAAqB,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC;AA4GxB,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO;QACL,QAAQ,EAAE,GAAG,MAAM,YAAY;QAC/B,YAAY,EAAE,GAAG,MAAM,gBAAgB;QACvC,MAAM,EAAE,GAAG,MAAM,SAAS;QAC1B,OAAO,EAAE,GAAG,MAAM,WAAW;QAC7B,QAAQ,EAAE,GAAG,MAAM,YAAY;QAC/B,WAAW,EAAE,GAAG,MAAM,eAAe;KACtC,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,oBAAoB,CAClC,OAAoC;IAEpC,MAAM,IAAI,GAAG,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7E,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,eAAe,GAA2B;QAC9C,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,KAAK;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,aAAa,IAAI,SAAS,EAAE,CAAC;QACnD,GAAG,OAAO,CAAC,eAAe;KAC3B,CAAC;IACF,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,MAAM,IAAI,MAAM,CAAC;IAC3D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC;IACnD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC;IACzD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,QAAQ,IAAI,KAAK,CAAC;IAEnE,SAAS,UAAU,CACjB,GAAG,GAAsB,OAAO,CAAC,GAAG;QAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;QAC5C,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QACpD,MAAM,YAAY,GAChB,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE;YACnC,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO;YACL,QAAQ;YACR,YAAY;YACZ,YAAY,EAAE,UAAU,CAAC,YAAY,CAAC;YACtC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,aAAa;YAC1D,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC;YAClE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC;YACrE,WAAW,EAAE,UAAU,CACrB,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,WAAW,CACtD;SACF,CAAC;IACJ,CAAC;IAED,SAAS,iBAAiB,CACxB,MAAsB,EACtB,KAAa,EACb,WAAmB,EACnB,MAAe;QAEf,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,UAAU,YAAY,CACzB,MAAsB,EACtB,IAAY,EACZ,WAAmB,EACnB,SAAS,GAAiB,KAAK;QAE/B,MAAM,SAAS,GACb,WAAW,KAAK,MAAM;YACpB,CAAC,CAAC;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,YAAY;iBAChB;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;oBAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;oBAClC,IAAI;oBACJ,YAAY,EAAE,WAAW;iBAC1B,CAAC;aACH;YACH,CAAC,CAAC;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,GAAG,YAAY;iBAChB;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,IAAI;oBACJ,SAAS,EAAE,MAAM,CAAC,QAAQ;oBAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;oBAClC,YAAY,EAAE,WAAW;oBACzB,UAAU,EAAE,oBAAoB;iBACjC,CAAC;aACH,CAAC;QAER,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAC1C,MAAM,CAAC,QAAQ,EACf,SAAS,EACT,wBAAwB,EACxB,SAAS,CACV,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAQ5C,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,SAAS,CAAC,iBAAiB;gBACzB,SAAS,CAAC,KAAK;gBACf,GAAG,OAAO,CAAC,WAAW,8BAA8B,CACvD,CAAC;QACJ,CAAC;QAED,IAAI,YAAgC,CAAC;QACrC,IAAI,OAA2B,CAAC;QAChC,IAAI,aAAkD,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,MAAM,CAAC,WAAW,EAClB;gBACE,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE;oBACjD,GAAG,eAAe;iBACnB;aACF,EACD,wBAAwB,EACxB,SAAS,CACV,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;gBACrB,IAAI,eAAe,EAAE,CAAC;oBACpB,MAAM,OAAO,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAE3D,CAAC;oBACF,MAAM,IAAI,KAAK,CACb,OAAO,CAAC,OAAO,IAAI,GAAG,OAAO,CAAC,WAAW,yBAAyB,CACnE,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAA4B,CAAC;gBACxE,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC/C,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC9B,CAAC;gBACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;gBAC3B,CAAC;gBACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACpB,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;gBAClC,CAAC;gBACD,IAAI,eAAe,IAAI,CAAC,OAAO,EAAE,CAAC;oBAChC,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,WAAW,2BAA2B,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,8CAA8C;QAChD,CAAC;QAED,MAAM,QAAQ,GAAG;YACf,GAAG,aAAa;YAChB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;QAEF,OAAO;YACL,WAAW,EAAE,SAAS,CAAC,YAAY;YACnC,GAAG,CAAC,SAAS,CAAC,aAAa;gBACzB,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,aAAa,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ;gBAC1C,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,UAAU,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAuB;QAC9B,UAAU;QACV,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM;YAClD,OAAO,iBAAiB,CACtB,MAAwB,EACxB,KAAK,EACL,WAAW,EACX,MAAM,CACP,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW;YACpC,OAAO,YAAY,CAAC,MAAwB,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACnE,CAAC;KACF,CAAC;IAEF,SAAS,mBAAmB,CAC1B,GAAG,GAAsB,OAAO,CAAC,GAAG;QAEpC,OAAO,CACL,UAAU,CAAC,GAAG,CAAC,EAAE,YAAY;YAC7B,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACvD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,IAAI;QACT,OAAO;QACP,mBAAmB,EAAE,wBAAwB;QAC7C,UAAU;QACV,iBAAiB;QACjB,YAAY;QACZ,GAAG;QACH,mBAAmB;KACpB,CAAC;AACJ,CAAC"}

package/dist/identity/claims.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Claim-name resolution shared by authoring validation and the runtime token
+ * mapper, so both agree on which claim supplies each envelope field.
+ */
+import type { ClaimMapping } from "./types.js";
+/** The claim supplying the caller id, or `undefined` when none is mapped. */
+export declare function userClaimName(mapping: ClaimMapping): string | undefined;
+/**
+ * Normalize a `groups` claim value into a list.
+ *
+ * IdPs are inconsistent here: Auth0 and Okta send an array, Entra sends an array
+ * of object ids, and some proxies flatten to a delimited string. Accept all
+ * three rather than making authors pre-process the claim.
+ */
+export declare function normalizeGroups(value: unknown): string[];
+//# sourceMappingURL=claims.d.ts.map

package/dist/identity/claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../src/identity/claims.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAEvE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAaxD"}

package/dist/identity/claims.js

@@ -0,0 +1,33 @@
+/**
+ * Claim-name resolution shared by authoring validation and the runtime token
+ * mapper, so both agree on which claim supplies each envelope field.
+ */
+/** The claim supplying the caller id, or `undefined` when none is mapped. */
+export function userClaimName(mapping) {
+    return nonEmpty(mapping.user);
+}
+/**
+ * Normalize a `groups` claim value into a list.
+ *
+ * IdPs are inconsistent here: Auth0 and Okta send an array, Entra sends an array
+ * of object ids, and some proxies flatten to a delimited string. Accept all
+ * three rather than making authors pre-process the claim.
+ */
+export function normalizeGroups(value) {
+    if (Array.isArray(value)) {
+        return value
+            .map((entry) => String(entry).trim())
+            .filter((entry) => entry.length > 0);
+    }
+    if (typeof value === "string") {
+        return value
+            .split(/[,\s]+/)
+            .map((entry) => entry.trim())
+            .filter((entry) => entry.length > 0);
+    }
+    return [];
+}
+function nonEmpty(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+//# sourceMappingURL=claims.js.map

package/dist/identity/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../src/identity/claims.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,OAAqB;IACjD,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK;aACT,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;aACpC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK;aACT,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC"}

package/dist/identity/connect-inference.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Predicates the built-in Connect-with-X providers use to decide whether a
+ * deployment needs their OAuth routes.
+ *
+ * Authors should not have to list a connect provider that the rest of their
+ * identity already implies — a credential chain that reads user GitHub tokens
+ * on a user-scoped deployment needs Connect-with-GitHub, and a Slack channel on
+ * a per-user deployment needs somewhere to link Slack accounts.
+ */
+import type { IdentityConnectMountContext } from "./connect-provider-types.js";
+export { FLEET_OAUTH_INTEGRATIONS, GOOGLE_TOOLSERVER_SLUGS, LINKEDIN_TOOLSERVER_SLUGS, MICROSOFT_TOOLSERVER_SLUGS, integrationConnectorKinds, integrationById, integrationForSlug, googleConnectorKinds, googleScopesForConnectorKinds, hasIntegrationToolServerConnector, hasGoogleToolServerConnector, hasLinkedInToolServerConnector, hasMicrosoftToolServerConnector, isFleetOAuthSlug, isGoogleToolServerSlug, isLinkedInToolServerSlug, isMicrosoftToolServerSlug, linkedinConnectorKinds, linkedinScopesForConnectorKinds, microsoftConnectorKinds, microsoftScopesForConnectorKinds, scopesForIntegrationConnectorKinds, type FleetOAuthIntegration, type GoogleToolServerSlug, type LinkedInToolServerSlug, type MicrosoftToolServerSlug, } from "../connectors/toolserver/integrations.js";
+/**
+ * True when the deployment keys anything durable on the individual caller.
+ *
+ * This is the condition under which a per-user OAuth link is meaningful: an
+ * `agent`-scoped deployment has no per-caller slice to attach a linked account
+ * to, so it never grows connect routes by inference.
+ */
+export declare function isUserScopedDeployment(scope: IdentityConnectMountContext["scope"]): boolean;
+/** True when a channel of `provider` is declared (e.g. a Slack channel). */
+export declare function hasChannelForProvider(channels: IdentityConnectMountContext["channels"], provider: string): boolean;
+/**
+ * True when the deployment declares a connector whose kind is `"github"`.
+ *
+ * Retained for Connect-with-GitHub inference if a future surface reintroduces a
+ * GitHub connector kind; today Connect mounts from `credentials.github` instead.
+ */
+export declare function hasGithubConnector(connectorKinds: IdentityConnectMountContext["connectorKinds"]): boolean;
+/**
+ * Connect provider ids the deployment's credential resolvers depend on.
+ *
+ * Unions across a per-target map, so a multi-platform deployment is treated the
+ * same as a single-platform one.
+ */
+export declare function credentialConnectIds(credentials: IdentityConnectMountContext["credentials"]): Set<string>;
+export declare function isGoogleConnectorKind(kind: string | undefined): boolean;
+//# sourceMappingURL=connect-inference.d.ts.map

package/dist/identity/connect-inference.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-inference.d.ts","sourceRoot":"","sources":["../../src/identity/connect-inference.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAG/E,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,8BAA8B,EAC9B,+BAA+B,EAC/B,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,gCAAgC,EAChC,kCAAkC,EAClC,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,0CAA0C,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC1C,OAAO,CAOT;AAED,4EAA4E;AAC5E,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,2BAA2B,CAAC,UAAU,CAAC,EACjD,QAAQ,EAAE,MAAM,GACf,OAAO,CAIT;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,cAAc,EAAE,2BAA2B,CAAC,gBAAgB,CAAC,GAC5D,OAAO,CAET;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,2BAA2B,CAAC,aAAa,CAAC,GACtD,GAAG,CAAC,MAAM,CAAC,CAIb;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEvE"}

package/dist/identity/connect-inference.js

@@ -0,0 +1,53 @@
+/**
+ * Predicates the built-in Connect-with-X providers use to decide whether a
+ * deployment needs their OAuth routes.
+ *
+ * Authors should not have to list a connect provider that the rest of their
+ * identity already implies — a credential chain that reads user GitHub tokens
+ * on a user-scoped deployment needs Connect-with-GitHub, and a Slack channel on
+ * a per-user deployment needs somewhere to link Slack accounts.
+ */
+import { isGoogleToolServerSlug } from "../connectors/toolserver/integrations.js";
+import { credentialConnectProviders } from "./credential-resolvers.js";
+export { FLEET_OAUTH_INTEGRATIONS, GOOGLE_TOOLSERVER_SLUGS, LINKEDIN_TOOLSERVER_SLUGS, MICROSOFT_TOOLSERVER_SLUGS, integrationConnectorKinds, integrationById, integrationForSlug, googleConnectorKinds, googleScopesForConnectorKinds, hasIntegrationToolServerConnector, hasGoogleToolServerConnector, hasLinkedInToolServerConnector, hasMicrosoftToolServerConnector, isFleetOAuthSlug, isGoogleToolServerSlug, isLinkedInToolServerSlug, isMicrosoftToolServerSlug, linkedinConnectorKinds, linkedinScopesForConnectorKinds, microsoftConnectorKinds, microsoftScopesForConnectorKinds, scopesForIntegrationConnectorKinds, } from "../connectors/toolserver/integrations.js";
+/**
+ * True when the deployment keys anything durable on the individual caller.
+ *
+ * This is the condition under which a per-user OAuth link is meaningful: an
+ * `agent`-scoped deployment has no per-caller slice to attach a linked account
+ * to, so it never grows connect routes by inference.
+ */
+export function isUserScopedDeployment(scope) {
+    if (!scope) {
+        return false;
+    }
+    // Per-caller Connect is meaningful when credentials are owned by the caller
+    // (`"user"`) or a custom resolver. Memory isolation is a separate axis.
+    return scope.credentials === "user" || scope.credentials === "custom";
+}
+/** True when a channel of `provider` is declared (e.g. a Slack channel). */
+export function hasChannelForProvider(channels, provider) {
+    return Object.values(channels ?? {}).some((manifest) => manifest?.provider === provider);
+}
+/**
+ * True when the deployment declares a connector whose kind is `"github"`.
+ *
+ * Retained for Connect-with-GitHub inference if a future surface reintroduces a
+ * GitHub connector kind; today Connect mounts from `credentials.github` instead.
+ */
+export function hasGithubConnector(connectorKinds) {
+    return (connectorKinds ?? []).some((kind) => kind === "github");
+}
+/**
+ * Connect provider ids the deployment's credential resolvers depend on.
+ *
+ * Unions across a per-target map, so a multi-platform deployment is treated the
+ * same as a single-platform one.
+ */
+export function credentialConnectIds(credentials) {
+    return new Set(credentialConnectProviders(credentials).map((provider) => provider.id));
+}
+export function isGoogleConnectorKind(kind) {
+    return isGoogleToolServerSlug(kind);
+}
+//# sourceMappingURL=connect-inference.js.map

package/dist/identity/connect-inference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-inference.js","sourceRoot":"","sources":["../../src/identity/connect-inference.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAElF,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAEvE,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,8BAA8B,EAC9B,+BAA+B,EAC/B,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,gCAAgC,EAChC,kCAAkC,GAKnC,MAAM,0CAA0C,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAA2C;IAE3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IACD,4EAA4E;IAC5E,wEAAwE;IACxE,OAAO,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC;AACxE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CACnC,QAAiD,EACjD,QAAgB;IAEhB,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CACvC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAC9C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,cAA6D;IAE7D,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAuD;IAEvD,OAAO,IAAI,GAAG,CACZ,0BAA0B,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC"}

package/dist/identity/connect-provider-types.d.ts

@@ -1,9 +1,12 @@
 /**
  * Connect-with-X plugin contract.
  *
- * List providers on `identity.connect` (e.g. `github.connect()`) to mount
+ * List providers on `identity.connect` (e.g. `connect.github()`) to mount
  * `/identity/{id}/{status,connect,callback,link}` from the managed HTTP app.
+ * Built-in providers also mount when the deployment implies them (see
+ * {@link IdentityConnectMountContext}).
  */
+import type { IdentityConfig } from "./types.js";
 /** Context for deciding whether a provider's routes should mount. */
 export interface IdentityConnectMountContext {
     /** Compiled channel manifests (file stem → manifest). */
@@ -12,6 +15,27 @@ export interface IdentityConnectMountContext {
     }>;
     /** True when the project declared managed identity. */
     hasIdentity: boolean;
+    /**
+     * True when this provider appears on `identity.connect`. False when it is
+     * offered as a built-in candidate, in which case the provider's own predicate
+     * decides whether the deployment needs it.
+     */
+    declared?: boolean;
+    /** The deployment's resolved isolation axes. */
+    scope?: IdentityConfig["scope"];
+    /**
+     * The deployment's credential config, when one is declared: a single resolver
+     * or a per-target map. Prefer `credentialConnectIds(ctx.credentials)` over
+     * reading it directly, so both forms are handled.
+     */
+    credentials?: IdentityConfig["credentials"];
+    /**
+     * Connector `kind` values discovered for the deployment (toolserver slugs,
+     * `github`, `slack`, …). Used to infer Connect-with-X from matching
+     * connectors (GitHub, Google, Microsoft, LinkedIn) without listing
+     * `connect.<provider>()` on identity.
+     */
+    connectorKinds?: readonly (string | undefined)[];
 }
 /** JSON object returned by status / error payloads. */
 export type IdentityConnectJson = Record<string, unknown>;
@@ -49,20 +73,25 @@ export interface IdentityConnectProvider {
     readonly settingsQueryKey?: string;
     /** Whether to mount this provider's four routes for the current project. */
     shouldMount(ctx: IdentityConnectMountContext): boolean;
-    /** Secured status payload for the authenticated actor. */
-    status(actorId: string): IdentityConnectJson | Promise<IdentityConnectJson>;
+    /** Secured status payload for the authenticated user. */
+    status(userId: string): IdentityConnectJson | Promise<IdentityConnectJson>;
     /** Begin OAuth — return authorize URL or a not-configured error. */
-    startAuthorize(actorId: string, redirectUri: string): IdentityConnectAuthorizeResult | Promise<IdentityConnectAuthorizeResult>;
+    startAuthorize(userId: string, redirectUri: string): IdentityConnectAuthorizeResult | Promise<IdentityConnectAuthorizeResult>;
     /**
      * Finish OAuth callback. Throw on failure; the scaffold redirects to
      * `/settings?{settingsQueryKey}=error`.
      */
     completeCallback(code: string, state: string, redirectUri: string): IdentityConnectCallbackResult | Promise<IdentityConnectCallbackResult>;
-    /** Remove the actor's link / stored credentials. */
-    unlink(actorId: string): void | Promise<void>;
+    /** Remove the user's link / stored credentials. */
+    unlink(userId: string): void | Promise<void>;
     /** Resolve the public Agent Server base for `redirect_uri`. */
     resolveRedirectBase(options: IdentityConnectRedirectBaseOptions): string;
     /** Public app origin for settings fail/success redirects when available. */
     resolvePublicAppUrl?(): string | undefined;
+    /**
+     * Optional: resolve a caller from a signed `?ticket=` on the connect start
+     * route (channel actors without a browser session). Returns the actor user id.
+     */
+    resolveConnectTicket?(ticket: string): string | Promise<string>;
 }
 //# sourceMappingURL=connect-provider-types.d.ts.map

package/dist/identity/connect-provider-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-provider-types.d.ts","sourceRoot":"","sources":["../../src/identity/connect-provider-types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qEAAqE;AACrE,MAAM,WAAW,2BAA2B;IAC1C,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,uDAAuD;IACvD,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,uDAAuD;AACvD,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1D,MAAM,MAAM,8BAA8B,GACtC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,GACxB;IAAE,aAAa,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C,MAAM,MAAM,6BAA6B,GAAG;IAC1C,oEAAoE;IACpE,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,oEAAoE;AACpE,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;KAAE,CAAC;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,4EAA4E;IAC5E,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC;IACvD,0DAA0D;IAC1D,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5E,oEAAoE;IACpE,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,8BAA8B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC5E;;;OAGG;IACH,gBAAgB,CACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,6BAA6B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC1E,oDAAoD;IACpD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,+DAA+D;IAC/D,mBAAmB,CAAC,OAAO,EAAE,kCAAkC,GAAG,MAAM,CAAC;IACzE,4EAA4E;IAC5E,mBAAmB,CAAC,IAAI,MAAM,GAAG,SAAS,CAAC;CAC5C"}
+{"version":3,"file":"connect-provider-types.d.ts","sourceRoot":"","sources":["../../src/identity/connect-provider-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,qEAAqE;AACrE,MAAM,WAAW,2BAA2B;IAC1C,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,uDAAuD;IACvD,WAAW,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IAChC;;;;OAIG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,cAAc,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;CAClD;AAED,uDAAuD;AACvD,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1D,MAAM,MAAM,8BAA8B,GACtC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,GACxB;IAAE,aAAa,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C,MAAM,MAAM,6BAA6B,GAAG;IAC1C,oEAAoE;IACpE,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,oEAAoE;AACpE,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;KAAE,CAAC;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,4EAA4E;IAC5E,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC;IACvD,yDAAyD;IACzD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC3E,oEAAoE;IACpE,cAAc,CACZ,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,8BAA8B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC5E;;;OAGG;IACH,gBAAgB,CACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,6BAA6B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC1E,mDAAmD;IACnD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,+DAA+D;IAC/D,mBAAmB,CAAC,OAAO,EAAE,kCAAkC,GAAG,MAAM,CAAC;IACzE,4EAA4E;IAC5E,mBAAmB,CAAC,IAAI,MAAM,GAAG,SAAS,CAAC;IAC3C;;;OAGG;IACH,oBAAoB,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACjE"}

package/dist/identity/connect-provider-types.js

@@ -1,8 +1,10 @@
 /**
  * Connect-with-X plugin contract.
  *
- * List providers on `identity.connect` (e.g. `github.connect()`) to mount
+ * List providers on `identity.connect` (e.g. `connect.github()`) to mount
  * `/identity/{id}/{status,connect,callback,link}` from the managed HTTP app.
+ * Built-in providers also mount when the deployment implies them (see
+ * {@link IdentityConnectMountContext}).
  */
 export {};
 //# sourceMappingURL=connect-provider-types.js.map

package/dist/identity/connect-provider-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-provider-types.js","sourceRoot":"","sources":["../../src/identity/connect-provider-types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}
+{"version":3,"file":"connect-provider-types.js","sourceRoot":"","sources":["../../src/identity/connect-provider-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/identity/connect-provider.d.ts

@@ -17,14 +17,19 @@ export interface IdentityConnectMountedRoute {
 }
 export declare function identityConnectSettingsQueryKey(provider: IdentityConnectProvider): string;
 /**
- * Mount Connect-with-X routes for the given providers.
+ * Mount Connect-with-X routes.
  *
- * Authors opt in via `defineIdentity({ connect: [github.connect(), …] })`.
- * An empty list mounts nothing — there is no builtin auto-mount.
+ * Declared providers (`defineIdentity({ connect: [connect.github(), …] })`) are
+ * offered first, then any `candidates` the deployment did not list. Every
+ * provider still decides for itself via `shouldMount`, which sees whether it was
+ * declared — so a built-in can mount because the rest of the identity implies it
+ * without ever mounting on a deployment that has no use for it.
  */
 export declare function mountIdentityConnectProviders(app: Hono, cfg: IdentityConfig, ctx: IdentityConnectMountContext, mounted: IdentityConnectMountedRoute[], options?: {
     deploymentBaseUrl?: string;
-    /** Providers from `identity.connect` (required for production mounts). */
+    /** Providers from `identity.connect`. */
     providers?: IdentityConnectProvider[];
+    /** Built-in providers to offer when the deployment did not list them. */
+    candidates?: IdentityConnectProvider[];
 }): void;
 //# sourceMappingURL=connect-provider.d.ts.map

package/dist/identity/connect-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-provider.d.ts","sourceRoot":"","sources":["../../src/identity/connect-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,6BAA6B,CAAC;AAIrC,YAAY,EACV,8BAA8B,EAC9B,6BAA6B,EAC7B,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,kCAAkC,GACnC,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,uBAAuB,GAChC,MAAM,CAER;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,EACT,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,2BAA2B,EAChC,OAAO,EAAE,2BAA2B,EAAE,EACtC,OAAO,GAAE;IACP,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,SAAS,CAAC,EAAE,uBAAuB,EAAE,CAAC;CAClC,GACL,IAAI,CAQN"}
+{"version":3,"file":"connect-provider.d.ts","sourceRoot":"","sources":["../../src/identity/connect-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,6BAA6B,CAAC;AAIrC,YAAY,EACV,8BAA8B,EAC9B,6BAA6B,EAC7B,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,kCAAkC,GACnC,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,uBAAuB,GAChC,MAAM,CAER;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,EACT,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,2BAA2B,EAChC,OAAO,EAAE,2BAA2B,EAAE,EACtC,OAAO,GAAE;IACP,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yCAAyC;IACzC,SAAS,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACtC,yEAAyE;IACzE,UAAU,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACnC,GACL,IAAI,CAeN"}

package/dist/identity/connect-provider.js

@@ -5,21 +5,31 @@
  */
 import { identityConnectPaths } from "./connect-paths.js";
 import { resolveRequestIdentity } from "../runtime/auth.js";
-import { MDA_PUBLIC_APP_URL_ENV } from "./slack/oauth.js";
+import { MDA_PUBLIC_APP_URL_ENV } from "./oauth-env.js";
 export { identityConnectPaths } from "./connect-paths.js";
 export function identityConnectSettingsQueryKey(provider) {
     return provider.settingsQueryKey?.trim() || provider.id;
 }
 /**
- * Mount Connect-with-X routes for the given providers.
+ * Mount Connect-with-X routes.
  *
- * Authors opt in via `defineIdentity({ connect: [github.connect(), …] })`.
- * An empty list mounts nothing — there is no builtin auto-mount.
+ * Declared providers (`defineIdentity({ connect: [connect.github(), …] })`) are
+ * offered first, then any `candidates` the deployment did not list. Every
+ * provider still decides for itself via `shouldMount`, which sees whether it was
+ * declared — so a built-in can mount because the rest of the identity implies it
+ * without ever mounting on a deployment that has no use for it.
  */
 export function mountIdentityConnectProviders(app, cfg, ctx, mounted, options = {}) {
-    const providers = options.providers ?? [];
-    for (const provider of providers) {
-        if (!provider.shouldMount(ctx)) {
+    const declared = options.providers ?? [];
+    const declaredIds = new Set(declared.map((provider) => provider.id));
+    const offered = [
+        ...declared.map((provider) => ({ provider, declared: true })),
+        ...(options.candidates ?? [])
+            .filter((provider) => !declaredIds.has(provider.id))
+            .map((provider) => ({ provider, declared: false })),
+    ];
+    for (const { provider, declared: isDeclared } of offered) {
+        if (!provider.shouldMount({ ...ctx, declared: isDeclared })) {
             continue;
         }
         mountOneIdentityConnectProvider(app, cfg, provider, mounted, options);
@@ -47,15 +57,31 @@ function mountOneIdentityConnectProvider(app, cfg, provider, mounted, options) {
         if (identity instanceof Response) {
             return identity;
         }
-        return c.json(await provider.status(identity.actor.id));
+        return c.json(await provider.status(identity.user.id));
     });
     app.get(paths.connect, async (c) => {
-        const identity = await resolveOrUnauthorized(cfg, c.req.raw);
-        if (identity instanceof Response) {
-            return identity;
+        const ticket = c.req.query("ticket")?.trim();
+        let userId;
+        if (ticket && provider.resolveConnectTicket) {
+            try {
+                userId = await provider.resolveConnectTicket(ticket);
+            }
+            catch (error) {
+                const message = error instanceof Error && error.message
+                    ? error.message
+                    : "invalid connect ticket";
+                return c.json({ error: message }, 401);
+            }
+        }
+        else {
+            const identity = await resolveOrUnauthorized(cfg, c.req.raw);
+            if (identity instanceof Response) {
+                return identity;
+            }
+            userId = identity.user.id;
         }
         const redirectUri = callbackRedirectUri(provider, c.req.raw, options.deploymentBaseUrl);
-        const result = await provider.startAuthorize(identity.actor.id, redirectUri);
+        const result = await provider.startAuthorize(userId, redirectUri);
         if ("notConfigured" in result) {
             return c.json({ error: result.error }, 503);
         }
@@ -92,7 +118,7 @@ function mountOneIdentityConnectProvider(app, cfg, provider, mounted, options) {
         if (identity instanceof Response) {
             return identity;
         }
-        await provider.unlink(identity.actor.id);
+        await provider.unlink(identity.user.id);
         return c.json({ linked: false });
     });
 }

package/dist/identity/connect-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-provider.js","sourceRoot":"","sources":["../../src/identity/connect-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAK1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAW1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAU1D,MAAM,UAAU,+BAA+B,CAC7C,QAAiC;IAEjC,OAAO,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,GAAS,EACT,GAAmB,EACnB,GAAgC,EAChC,OAAsC,EACtC,OAAO,GAIH,EAAE;IAEN,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IAC1C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CACtC,GAAS,EACT,GAAmB,EACnB,QAAiC,EACjC,OAAsC,EACtC,OAAuC;IAEvC,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,YAAY,QAAQ,CAAC,EAAE,UAAU,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI;QAClB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;QACpD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;QACrD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QACvD,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;KAC7C,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC;YACX,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,EACR,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,EACjB,WAAW,CACZ,CAAC;QACF,IAAI,eAAe,IAAI,MAAM,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,SAAS,GACb,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,MAAM;YAChC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAC9D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,SAAS,GACb,QAAQ,CAAC,mBAAmB,EAAE,EAAE;YAChC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAG,SAAS;YAC5B,CAAC,CAAC,GAAG,SAAS,aAAa,WAAW,QAAQ;YAC9C,CAAC,CAAC,GAAG,CAAC;QACR,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,EACR,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,OAAO,CAAC,iBAAiB,CAC1B,CAAC;YACF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CACzD,IAAI,EACJ,KAAK,EACL,WAAW,CACZ,CAAC;YACF,OAAO,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,SAAS,QAAQ,CAAC,EAAE,yBAAyB,EAAE,KAAK,CAAC,CAAC;YACpE,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAiC,EACjC,OAAgB,EAChB,iBAA0B;IAE1B,MAAM,IAAI,GAAG,QAAQ,CAAC,mBAAmB,CAAC;QACxC,UAAU,EAAE,OAAO,CAAC,GAAG;QACvB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB;KAClB,CAAC,CAAC;IACH,OAAO,GAAG,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,GAAmB,EACnB,OAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ;YACxD,CAAC,CAAE,KAA4B,CAAC,MAAM;YACtC,CAAC,CAAC,GAAG,CAAC;QACV,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;QAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE;YACtD,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}
+{"version":3,"file":"connect-provider.js","sourceRoot":"","sources":["../../src/identity/connect-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAK1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAWxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAU1D,MAAM,UAAU,+BAA+B,CAC7C,QAAiC;IAEjC,OAAO,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAC3C,GAAS,EACT,GAAmB,EACnB,GAAgC,EAChC,OAAsC,EACtC,OAAO,GAMH,EAAE;IAEN,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG;QACd,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;KACtD,CAAC;IACF,KAAK,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,OAAO,EAAE,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CACtC,GAAS,EACT,GAAmB,EACnB,QAAiC,EACjC,OAAsC,EACtC,OAAuC;IAEvC,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,YAAY,QAAQ,CAAC,EAAE,UAAU,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI;QAClB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;QACpD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;QACrD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QACvD,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;KAC7C,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC;YACX,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,MAAc,CAAC;QACnB,IAAI,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO;oBACrC,CAAC,CAAC,KAAK,CAAC,OAAO;oBACf,CAAC,CAAC,wBAAwB,CAAC;gBAC/B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;gBACjC,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,EACR,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,eAAe,IAAI,MAAM,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,SAAS,GACb,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,MAAM;YAChC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAC9D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,SAAS,GACb,QAAQ,CAAC,mBAAmB,EAAE,EAAE;YAChC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAG,SAAS;YAC5B,CAAC,CAAC,GAAG,SAAS,aAAa,WAAW,QAAQ;YAC9C,CAAC,CAAC,GAAG,CAAC;QACR,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,EACR,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,OAAO,CAAC,iBAAiB,CAC1B,CAAC;YACF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CACzD,IAAI,EACJ,KAAK,EACL,WAAW,CACZ,CAAC;YACF,OAAO,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,SAAS,QAAQ,CAAC,EAAE,yBAAyB,EAAE,KAAK,CAAC,CAAC;YACpE,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAiC,EACjC,OAAgB,EAChB,iBAA0B;IAE1B,MAAM,IAAI,GAAG,QAAQ,CAAC,mBAAmB,CAAC;QACxC,UAAU,EAAE,OAAO,CAAC,GAAG;QACvB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB;KAClB,CAAC,CAAC;IACH,OAAO,GAAG,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,GAAmB,EACnB,OAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ;YACxD,CAAC,CAAE,KAA4B,CAAC,MAAM;YACtC,CAAC,CAAC,GAAG,CAAC;QACV,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;QAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE;YACtD,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}