managed-deepagents 0.4.2 → 0.4.3-dev.95

package/dist/identity/credential-resolvers.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Shape helpers for the two `credentials` forms, shared by authoring validation,
+ * normalization, and the runtime resolver so all three agree on which form a
+ * config is.
+ *
+ * A single resolver handles every target itself. A per-target map lets one
+ * deployment integrate several platforms without hand-writing the dispatch — and
+ * without losing the Connect-with-X routes each entry declares, which is the
+ * failure mode a hand-written dispatcher has.
+ */
+import type { IdentityConnectProvider } from "./connect-provider-types.js";
+import type { CredentialResolverConfig, CredentialResolvers } from "./types.js";
+/**
+ * True when `value` is a single {@link CredentialResolverConfig} rather than a
+ * per-target map.
+ *
+ * Discriminates on the *type* of `resolve`/`endpoint`, not merely their
+ * presence, so a target legitimately named `"resolve"` or `"endpoint"` in a map
+ * is not mistaken for the single form.
+ */
+export declare function isSingleCredentialResolver(value: CredentialResolverConfig | CredentialResolvers): value is CredentialResolverConfig;
+/** The target names a per-target map resolves, in declaration order. */
+export declare function credentialTargetNames(value: CredentialResolverConfig | CredentialResolvers): string[];
+/**
+ * Every Connect-with-X provider the config depends on, deduplicated by id and in
+ * declaration order.
+ *
+ * Unioning across map entries is what keeps inference working for a
+ * multi-platform deployment: each entry declares its own routes, and the author
+ * repeats none of them.
+ */
+export declare function credentialConnectProviders(value: CredentialResolverConfig | CredentialResolvers | undefined): IdentityConnectProvider[];
+//# sourceMappingURL=credential-resolvers.d.ts.map

package/dist/identity/credential-resolvers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-resolvers.d.ts","sourceRoot":"","sources":["../../src/identity/credential-resolvers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEhF;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,GACpD,KAAK,IAAI,wBAAwB,CAWnC;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,GACpD,MAAM,EAAE,CAEV;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,GAAG,SAAS,GAChE,uBAAuB,EAAE,CAgB3B"}

package/dist/identity/credential-resolvers.js

@@ -0,0 +1,62 @@
+/**
+ * Shape helpers for the two `credentials` forms, shared by authoring validation,
+ * normalization, and the runtime resolver so all three agree on which form a
+ * config is.
+ *
+ * A single resolver handles every target itself. A per-target map lets one
+ * deployment integrate several platforms without hand-writing the dispatch — and
+ * without losing the Connect-with-X routes each entry declares, which is the
+ * failure mode a hand-written dispatcher has.
+ */
+/**
+ * True when `value` is a single {@link CredentialResolverConfig} rather than a
+ * per-target map.
+ *
+ * Discriminates on the *type* of `resolve`/`endpoint`, not merely their
+ * presence, so a target legitimately named `"resolve"` or `"endpoint"` in a map
+ * is not mistaken for the single form.
+ */
+export function isSingleCredentialResolver(value) {
+    const candidate = value;
+    if (typeof candidate.resolve === "function") {
+        return true;
+    }
+    const endpoint = candidate.endpoint;
+    return (typeof endpoint === "object" &&
+        endpoint !== null &&
+        typeof endpoint.url === "string");
+}
+/** The target names a per-target map resolves, in declaration order. */
+export function credentialTargetNames(value) {
+    return isSingleCredentialResolver(value) ? [] : Object.keys(value);
+}
+/**
+ * Every Connect-with-X provider the config depends on, deduplicated by id and in
+ * declaration order.
+ *
+ * Unioning across map entries is what keeps inference working for a
+ * multi-platform deployment: each entry declares its own routes, and the author
+ * repeats none of them.
+ */
+export function credentialConnectProviders(value) {
+    if (value === undefined || value === null || typeof value !== "object") {
+        return [];
+    }
+    const configs = isSingleCredentialResolver(value)
+        ? [value]
+        : Object.values(value);
+    const out = [];
+    for (const config of configs) {
+        for (const provider of declaredConnect(config)) {
+            if (!out.some((existing) => existing.id === provider.id)) {
+                out.push(provider);
+            }
+        }
+    }
+    return out;
+}
+function declaredConnect(config) {
+    const connect = config?.connect;
+    return Array.isArray(connect) ? connect : [];
+}
+//# sourceMappingURL=credential-resolvers.js.map

package/dist/identity/credential-resolvers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-resolvers.js","sourceRoot":"","sources":["../../src/identity/credential-resolvers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAqD;IAErD,MAAM,SAAS,GAAG,KAAkD,CAAC;IACrE,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;IACpC,OAAO,CACL,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,KAAK,IAAI;QACjB,OAAQ,QAA8B,CAAC,GAAG,KAAK,QAAQ,CACxD,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,qBAAqB,CACnC,KAAqD;IAErD,OAAO,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAiE;IAEjE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC;QAC/C,CAAC,CAAC,CAAC,KAAK,CAAC;QACT,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,GAAG,GAA8B,EAAE,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,QAAQ,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,MAAe;IACtC,MAAM,OAAO,GAAI,MAA4C,EAAE,OAAO,CAAC;IACvE,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAAqC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9E,CAAC"}

package/dist/identity/define-fleet-connect.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Factory for thin Connect-with-X adapters over Fleet vault integrations.
+ *
+ * Google / Microsoft / LinkedIn share the same PATH constants, actor-subject
+ * toggles, and `connect()` wiring — only the integration + BYO client differ.
+ * X is the vault-only variant (no local BYO client).
+ */
+import type { FleetOAuthIntegration } from "../connectors/toolserver/integrations.js";
+import type { ByoOauthClient } from "./byo-oauth.js";
+import { identityConnectPaths } from "./connect-paths.js";
+import type { IdentityConnectMountContext, IdentityConnectProvider } from "./connect-provider-types.js";
+import { type FleetVaultConnectProviderOptions } from "./fleet-connect.js";
+import { type FleetIntegrationConnectProviderOptions } from "./fleet-integration-connect.js";
+/** Shared surface returned by {@link defineFleetIntegrationConnect}. */
+export interface FleetIntegrationConnectAdapter {
+    readonly paths: ReturnType<typeof identityConnectPaths>;
+    isActorSubjectEnabled(): boolean;
+    enableActorSubject(): void;
+    enableActorSubjectFromConnectors(connectorKinds: readonly (string | undefined)[] | undefined, scope?: IdentityConnectMountContext["scope"]): void;
+    resetActorSubjectEnabledForTests(): void;
+    isConnectConfigured(env?: NodeJS.ProcessEnv): boolean;
+    connectUrl(publicAppUrl: string): string;
+    createProvider(options?: FleetIntegrationConnectProviderOptions): IdentityConnectProvider;
+    readonly provider: IdentityConnectProvider;
+    connect(options?: FleetIntegrationConnectProviderOptions): IdentityConnectProvider;
+}
+/** Shared surface returned by {@link defineFleetVaultConnect}. */
+export interface FleetVaultConnectAdapter {
+    readonly paths: ReturnType<typeof identityConnectPaths>;
+    isActorSubjectEnabled(): boolean;
+    enableActorSubject(): void;
+    enableActorSubjectFromConnectors(connectorKinds: readonly (string | undefined)[] | undefined, scope?: IdentityConnectMountContext["scope"]): void;
+    resetActorSubjectEnabledForTests(): void;
+    isConnectConfigured(env?: NodeJS.ProcessEnv): boolean;
+    connectUrl(publicAppUrl: string): string;
+    createProvider(options?: Pick<FleetVaultConnectProviderOptions, "providerSlug" | "scopes" | "fleet">): IdentityConnectProvider;
+    readonly provider: IdentityConnectProvider;
+    connect(options?: Pick<FleetVaultConnectProviderOptions, "providerSlug" | "scopes" | "fleet">): IdentityConnectProvider;
+}
+/** Build the Google/Microsoft/LinkedIn-style BYO + Fleet Connect adapter. */
+export declare function defineFleetIntegrationConnect(options: {
+    integration: FleetOAuthIntegration;
+    byoClient: ByoOauthClient;
+    fallbackScopes?: readonly string[];
+}): FleetIntegrationConnectAdapter;
+/**
+ * Build a vault-only Connect adapter (no local BYO client), e.g. Connect-with-X.
+ */
+export declare function defineFleetVaultConnect(options: {
+    integration: FleetOAuthIntegration;
+    resolveProviderSlug: () => string;
+}): FleetVaultConnectAdapter;
+//# sourceMappingURL=define-fleet-connect.d.ts.map

package/dist/identity/define-fleet-connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-fleet-connect.d.ts","sourceRoot":"","sources":["../../src/identity/define-fleet-connect.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAOtF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAIL,KAAK,gCAAgC,EACtC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIL,KAAK,sCAAsC,EAC5C,MAAM,gCAAgC,CAAC;AAMxC,wEAAwE;AACxE,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC;IACxD,qBAAqB,IAAI,OAAO,CAAC;IACjC,kBAAkB,IAAI,IAAI,CAAC;IAC3B,gCAAgC,CAC9B,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC3C,IAAI,CAAC;IACR,gCAAgC,IAAI,IAAI,CAAC;IACzC,mBAAmB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC;IACtD,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IACzC,cAAc,CACZ,OAAO,CAAC,EAAE,sCAAsC,GAC/C,uBAAuB,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,EAAE,sCAAsC,GAC/C,uBAAuB,CAAC;CAC5B;AAED,kEAAkE;AAClE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC;IACxD,qBAAqB,IAAI,OAAO,CAAC;IACjC,kBAAkB,IAAI,IAAI,CAAC;IAC3B,gCAAgC,CAC9B,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC3C,IAAI,CAAC;IACR,gCAAgC,IAAI,IAAI,CAAC;IACzC,mBAAmB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC;IACtD,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IACzC,cAAc,CACZ,OAAO,CAAC,EAAE,IAAI,CACZ,gCAAgC,EAChC,cAAc,GAAG,QAAQ,GAAG,OAAO,CACpC,GACA,uBAAuB,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,EAAE,IAAI,CACZ,gCAAgC,EAChC,cAAc,GAAG,QAAQ,GAAG,OAAO,CACpC,GACA,uBAAuB,CAAC;CAC5B;AAED,6EAA6E;AAC7E,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACrD,WAAW,EAAE,qBAAqB,CAAC;IACnC,SAAS,EAAE,cAAc,CAAC;IAC1B,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GAAG,8BAA8B,CA0CjC;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,qBAAqB,CAAC;IACnC,mBAAmB,EAAE,MAAM,MAAM,CAAC;CACnC,GAAG,wBAAwB,CAmD3B"}

package/dist/identity/define-fleet-connect.js

@@ -0,0 +1,76 @@
+/**
+ * Factory for thin Connect-with-X adapters over Fleet vault integrations.
+ *
+ * Google / Microsoft / LinkedIn share the same PATH constants, actor-subject
+ * toggles, and `connect()` wiring — only the integration + BYO client differ.
+ * X is the vault-only variant (no local BYO client).
+ */
+import { enableActorSubjectIntegration, enableActorSubjectIntegrationFromConnectors, isActorSubjectIntegrationEnabled, resetActorSubjectEnabledForTests, } from "./actor-subject.js";
+import { identityConnectPaths } from "./connect-paths.js";
+import { createFleetVaultConnectProvider, fleetConnectUrl, isFleetVaultConnectConfigured, } from "./fleet-connect.js";
+import { createFleetIntegrationConnectProvider, fleetIntegrationConnectUrl, isFleetIntegrationConnectConfigured, } from "./fleet-integration-connect.js";
+import { MDA_PUBLIC_APP_URL_ENV, resolveOauthRedirectBase, } from "./oauth-env.js";
+/** Build the Google/Microsoft/LinkedIn-style BYO + Fleet Connect adapter. */
+export function defineFleetIntegrationConnect(options) {
+    const { integration, byoClient, fallbackScopes } = options;
+    const paths = identityConnectPaths(integration.connectId);
+    function createProvider(providerOptions = {}) {
+        return createFleetIntegrationConnectProvider(integration, byoClient, providerOptions, fallbackScopes);
+    }
+    const provider = createProvider();
+    return {
+        paths,
+        isActorSubjectEnabled: () => isActorSubjectIntegrationEnabled(integration.connectId),
+        enableActorSubject: () => enableActorSubjectIntegration(integration.connectId),
+        enableActorSubjectFromConnectors(connectorKinds, scope) {
+            enableActorSubjectIntegrationFromConnectors(integration, connectorKinds, scope);
+        },
+        resetActorSubjectEnabledForTests,
+        isConnectConfigured: (env = process.env) => isFleetIntegrationConnectConfigured(byoClient, env),
+        connectUrl: (publicAppUrl) => fleetIntegrationConnectUrl(integration, publicAppUrl),
+        createProvider,
+        provider,
+        connect(providerOptions) {
+            enableActorSubjectIntegration(integration.connectId);
+            return providerOptions ? createProvider(providerOptions) : provider;
+        },
+    };
+}
+/**
+ * Build a vault-only Connect adapter (no local BYO client), e.g. Connect-with-X.
+ */
+export function defineFleetVaultConnect(options) {
+    const { integration, resolveProviderSlug } = options;
+    const paths = identityConnectPaths(integration.connectId);
+    function createProvider(providerOptions = {}) {
+        return createFleetVaultConnectProvider({
+            integration,
+            providerSlug: providerOptions.providerSlug?.trim() || resolveProviderSlug(),
+            ...(providerOptions.scopes ? { scopes: providerOptions.scopes } : {}),
+            ...(providerOptions.fleet ? { fleet: providerOptions.fleet } : {}),
+            resolveRedirectBase: resolveOauthRedirectBase,
+            resolvePublicAppUrl() {
+                return process.env[MDA_PUBLIC_APP_URL_ENV]?.replace(/\/$/, "");
+            },
+        });
+    }
+    const provider = createProvider();
+    return {
+        paths,
+        isActorSubjectEnabled: () => isActorSubjectIntegrationEnabled(integration.connectId),
+        enableActorSubject: () => enableActorSubjectIntegration(integration.connectId),
+        enableActorSubjectFromConnectors(connectorKinds, scope) {
+            enableActorSubjectIntegrationFromConnectors(integration, connectorKinds, scope);
+        },
+        resetActorSubjectEnabledForTests,
+        isConnectConfigured: (env = process.env) => isFleetVaultConnectConfigured(undefined, env),
+        connectUrl: (publicAppUrl) => fleetConnectUrl(integration, publicAppUrl),
+        createProvider,
+        provider,
+        connect(providerOptions) {
+            enableActorSubjectIntegration(integration.connectId);
+            return providerOptions ? createProvider(providerOptions) : provider;
+        },
+    };
+}
+//# sourceMappingURL=define-fleet-connect.js.map

package/dist/identity/define-fleet-connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-fleet-connect.js","sourceRoot":"","sources":["../../src/identity/define-fleet-connect.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EACL,6BAA6B,EAC7B,2CAA2C,EAC3C,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAK1D,OAAO,EACL,+BAA+B,EAC/B,eAAe,EACf,6BAA6B,GAE9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qCAAqC,EACrC,0BAA0B,EAC1B,mCAAmC,GAEpC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAkDxB,6EAA6E;AAC7E,MAAM,UAAU,6BAA6B,CAAC,OAI7C;IACC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAC3D,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAE1D,SAAS,cAAc,CACrB,eAAe,GAA2C,EAAE;QAE5D,OAAO,qCAAqC,CAC1C,WAAW,EACX,SAAS,EACT,eAAe,EACf,cAAc,CACf,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAElC,OAAO;QACL,KAAK;QACL,qBAAqB,EAAE,GAAG,EAAE,CAC1B,gCAAgC,CAAC,WAAW,CAAC,SAAS,CAAC;QACzD,kBAAkB,EAAE,GAAG,EAAE,CACvB,6BAA6B,CAAC,WAAW,CAAC,SAAS,CAAC;QACtD,gCAAgC,CAAC,cAAc,EAAE,KAAK;YACpD,2CAA2C,CACzC,WAAW,EACX,cAAc,EACd,KAAK,CACN,CAAC;QACJ,CAAC;QACD,gCAAgC;QAChC,mBAAmB,EAAE,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,CACzC,mCAAmC,CAAC,SAAS,EAAE,GAAG,CAAC;QACrD,UAAU,EAAE,CAAC,YAAY,EAAE,EAAE,CAC3B,0BAA0B,CAAC,WAAW,EAAE,YAAY,CAAC;QACvD,cAAc;QACd,QAAQ;QACR,OAAO,CAAC,eAAe;YACrB,6BAA6B,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACrD,OAAO,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAGvC;IACC,MAAM,EAAE,WAAW,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC;IACrD,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAO1D,SAAS,cAAc,CACrB,eAAe,GAAY,EAAE;QAE7B,OAAO,+BAA+B,CAAC;YACrC,WAAW;YACX,YAAY,EACV,eAAe,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,mBAAmB,EAAE;YAC/D,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,mBAAmB,EAAE,wBAAwB;YAC7C,mBAAmB;gBACjB,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACjE,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAElC,OAAO;QACL,KAAK;QACL,qBAAqB,EAAE,GAAG,EAAE,CAC1B,gCAAgC,CAAC,WAAW,CAAC,SAAS,CAAC;QACzD,kBAAkB,EAAE,GAAG,EAAE,CACvB,6BAA6B,CAAC,WAAW,CAAC,SAAS,CAAC;QACtD,gCAAgC,CAAC,cAAc,EAAE,KAAK;YACpD,2CAA2C,CACzC,WAAW,EACX,cAAc,EACd,KAAK,CACN,CAAC;QACJ,CAAC;QACD,gCAAgC;QAChC,mBAAmB,EAAE,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,CACzC,6BAA6B,CAAC,SAAS,EAAE,GAAG,CAAC;QAC/C,UAAU,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC;QACxE,cAAc;QACd,QAAQ;QACR,OAAO,CAAC,eAAe;YACrB,6BAA6B,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACrD,OAAO,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/identity/fleet-connect-hint.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Runtime hint when the caller has not completed Connect-with-X for a Fleet
+ * vault integration yet.
+ *
+ * Prefers Connect status over toolserver 428 (agent subjects skip that today).
+ */
+import { type FleetOAuthIntegration } from "../connectors/toolserver/integrations.js";
+import type { ManagedMiddleware } from "../runtime/managed-middleware.js";
+import { listAgentConnections, type FleetClientOptions } from "./fleet.js";
+export interface FleetConnectHintMiddlewareOptions {
+    integration: FleetOAuthIntegration;
+    providerSlug?: string;
+    fleet?: FleetClientOptions & {
+        list?: typeof listAgentConnections;
+    };
+    /** Override status lookup (tests). */
+    isConnected?: (userId: string) => Promise<boolean>;
+    /** Optional public-app resolver (BYO OAuth publicAppUrl). */
+    resolvePublicAppUrl?: (env?: NodeJS.ProcessEnv) => string | undefined;
+}
+/** Drop cached Connect status (tests only). */
+export declare function clearFleetConnectHintCacheForTests(): void;
+/**
+ * Absolute Connect start URL for agent hints.
+ *
+ * Prefers the Agent Server origin (`MDA_PUBLIC_API_URL`) where
+ * `/identity/{id}/*` is mounted. Falls back to `MDA_PUBLIC_APP_URL`.
+ *
+ * When `userId` and a signing key are available, appends a short-lived
+ * `?ticket=` so the browser session binds OAuth to that actor.
+ */
+export declare function fleetConnectHintUrl(integration: FleetOAuthIntegration, env?: NodeJS.ProcessEnv, userId?: string, resolvePublicAppUrl?: (env?: NodeJS.ProcessEnv) => string | undefined): Promise<string>;
+/**
+ * Middleware that injects a system hint when actor-subject mode is on for
+ * `integration` and the current caller has no LangSmith vault connection.
+ */
+export declare function createFleetConnectHintMiddleware(options: FleetConnectHintMiddlewareOptions): ManagedMiddleware;
+/** Rewrite tool errors that look like a missing Fleet vault connection. */
+export declare function rewriteFleetToolError(error: unknown, integration: FleetOAuthIntegration, resolvePublicAppUrl?: (env?: NodeJS.ProcessEnv) => string | undefined): Error;
+export declare function isFleetConnectHint(message: string, integration: FleetOAuthIntegration): boolean;
+//# sourceMappingURL=fleet-connect-hint.d.ts.map

package/dist/identity/fleet-connect-hint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-connect-hint.d.ts","sourceRoot":"","sources":["../../src/identity/fleet-connect-hint.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAS1E,OAAO,EAAE,oBAAoB,EAAE,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAQ3E,MAAM,WAAW,iCAAiC;IAChD,WAAW,EAAE,qBAAqB,CAAC;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,kBAAkB,GAAG;QAC3B,IAAI,CAAC,EAAE,OAAO,oBAAoB,CAAC;KACpC,CAAC;IACF,sCAAsC;IACtC,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,6DAA6D;IAC7D,mBAAmB,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,KAAK,MAAM,GAAG,SAAS,CAAC;CACvE;AA2DD,+CAA+C;AAC/C,wBAAgB,kCAAkC,IAAI,IAAI,CAEzD;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,qBAAqB,EAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,MAAM,CAAC,EAAE,MAAM,EACf,mBAAmB,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,KAAK,MAAM,GAAG,SAAS,GACpE,OAAO,CAAC,MAAM,CAAC,CA+BjB;AAoBD;;;GAGG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,iCAAiC,GACzC,iBAAiB,CAwEnB;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,WAAW,EAAE,qBAAqB,EAClC,mBAAmB,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,KAAK,MAAM,GAAG,SAAS,GACpE,KAAK,CAgCP;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,qBAAqB,GACjC,OAAO,CAET"}

package/dist/identity/fleet-connect-hint.js

@@ -0,0 +1,190 @@
+/**
+ * Runtime hint when the caller has not completed Connect-with-X for a Fleet
+ * vault integration yet.
+ *
+ * Prefers Connect status over toolserver 428 (agent subjects skip that today).
+ */
+import { readIntegrationProviderSlug, } from "../connectors/toolserver/integrations.js";
+import { managedRuntimeOverrides } from "../runtime/managed-tools.js";
+import { agentIdFromActor, isActorSubjectIntegrationEnabled, } from "./actor-subject.js";
+import { identityConnectPaths } from "./connect-paths.js";
+import { fleetConnectUrl } from "./fleet-connect.js";
+import { listAgentConnections } from "./fleet.js";
+import { oauthTicketsFor } from "./oauth-tickets.js";
+import { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, readOauthStateSigningKey, } from "./oauth-env.js";
+function hintPrefix(integration) {
+    return `User has not connected ${integration.displayName}`;
+}
+/** Short TTL so connected callers skip Fleet on every model turn. */
+const CONNECT_STATUS_TTL_MS = 30_000;
+const connectionStatusCache = new Map();
+function cacheKey(userId, providerSlug) {
+    return `${userId}\0${providerSlug}`;
+}
+/** Drop expired entries so one-shot callers do not retain forever. */
+function evictExpiredCacheEntries(now = Date.now()) {
+    for (const [key, entry] of connectionStatusCache) {
+        if (now >= entry.expiresAt) {
+            connectionStatusCache.delete(key);
+        }
+    }
+}
+function cachedConnected(userId, providerSlug) {
+    const entry = connectionStatusCache.get(cacheKey(userId, providerSlug));
+    if (!entry) {
+        return undefined;
+    }
+    if (Date.now() >= entry.expiresAt) {
+        connectionStatusCache.delete(cacheKey(userId, providerSlug));
+        return undefined;
+    }
+    return entry.connected;
+}
+function storeConnected(userId, providerSlug, connected) {
+    const now = Date.now();
+    evictExpiredCacheEntries(now);
+    // Only cache positives: a just-completed Connect must be visible on retry
+    // within the TTL window, not masked by a prior disconnected observation.
+    if (!connected) {
+        return;
+    }
+    connectionStatusCache.set(cacheKey(userId, providerSlug), {
+        expiresAt: now + CONNECT_STATUS_TTL_MS,
+        connected: true,
+    });
+}
+/** Drop cached Connect status (tests only). */
+export function clearFleetConnectHintCacheForTests() {
+    connectionStatusCache.clear();
+}
+/**
+ * Absolute Connect start URL for agent hints.
+ *
+ * Prefers the Agent Server origin (`MDA_PUBLIC_API_URL`) where
+ * `/identity/{id}/*` is mounted. Falls back to `MDA_PUBLIC_APP_URL`.
+ *
+ * When `userId` and a signing key are available, appends a short-lived
+ * `?ticket=` so the browser session binds OAuth to that actor.
+ */
+export async function fleetConnectHintUrl(integration, env = process.env, userId, resolvePublicAppUrl) {
+    const apiBase = env[MDA_PUBLIC_API_URL_ENV]?.trim().replace(/\/$/, "");
+    const appBase = resolvePublicAppUrl?.(env) ??
+        env[MDA_PUBLIC_APP_URL_ENV]?.trim().replace(/\/$/, "");
+    const base = apiBase || appBase;
+    const paths = identityConnectPaths(integration.connectId);
+    const path = base ? fleetConnectUrl(integration, base) : paths.connect;
+    if (!userId) {
+        return path;
+    }
+    const signingKey = readOauthStateSigningKey(env);
+    if (!signingKey) {
+        return path;
+    }
+    try {
+        const ticket = await oauthTicketsFor(integration.connectId).createTicket(userId, signingKey);
+        const url = new URL(path.startsWith("http") ? path : `https://placeholder.local${path}`);
+        url.searchParams.set("ticket", ticket);
+        if (!path.startsWith("http")) {
+            return `${paths.connect}?${url.searchParams.toString()}`;
+        }
+        return url.toString();
+    }
+    catch {
+        return path;
+    }
+}
+async function hintMessage(integration, userId, resolvePublicAppUrl) {
+    const url = await fleetConnectHintUrl(integration, process.env, userId, resolvePublicAppUrl);
+    return (`${hintPrefix(integration)}; ask them to Connect with ${integration.displayName} at ${url}. ` +
+        "Paste that full URL so they can open it. " +
+        `Do not pretend ${integration.displayName} tools will work until they connect.`);
+}
+/**
+ * Middleware that injects a system hint when actor-subject mode is on for
+ * `integration` and the current caller has no LangSmith vault connection.
+ */
+export function createFleetConnectHintMiddleware(options) {
+    const { integration } = options;
+    const list = options.fleet?.list ?? listAgentConnections;
+    const providerSlug = () => options.providerSlug?.trim() || readIntegrationProviderSlug(integration);
+    async function disconnected(userId) {
+        if (options.isConnected) {
+            return !(await options.isConnected(userId));
+        }
+        const slug = providerSlug();
+        const cached = cachedConnected(userId, slug);
+        if (cached !== undefined) {
+            return !cached;
+        }
+        const agentId = agentIdFromActor(userId);
+        const connections = await list(agentId, options.fleet ?? {});
+        const isDisconnected = !connections.some((c) => c.provider_id === slug);
+        storeConnected(userId, slug, !isDisconnected);
+        return isDisconnected;
+    }
+    return {
+        name: `mda-${integration.id}-connect-hint`,
+        async wrapModelCall(request, handler) {
+            if (!isActorSubjectIntegrationEnabled(integration.id)) {
+                return handler(request);
+            }
+            const overrides = managedRuntimeOverrides(request.runtime);
+            const userId = overrides.identity?.user?.id;
+            if (!userId) {
+                return handler(request);
+            }
+            try {
+                if (!(await disconnected(userId))) {
+                    return handler(request);
+                }
+            }
+            catch {
+                const hint = await hintMessage(integration, userId, options.resolvePublicAppUrl);
+                return handler({
+                    ...request,
+                    messages: [
+                        { role: "system", content: hint },
+                        ...(Array.isArray(request.messages) ? request.messages : []),
+                    ],
+                });
+            }
+            const hint = await hintMessage(integration, userId, options.resolvePublicAppUrl);
+            return handler({
+                ...request,
+                messages: [
+                    { role: "system", content: hint },
+                    ...(Array.isArray(request.messages) ? request.messages : []),
+                ],
+            });
+        },
+    };
+}
+/** Rewrite tool errors that look like a missing Fleet vault connection. */
+export function rewriteFleetToolError(error, integration, resolvePublicAppUrl) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (/connection_required|token_expired|no connection|AgentAuthRequired|428|not connected/i.test(message)) {
+        // Per-caller Connect-with-X only exists on user-scoped deployments. Agent /
+        // no-identity projects use the shared vault from `mda connect`.
+        if (!isActorSubjectIntegrationEnabled(integration.id)) {
+            return new Error(`${integration.displayName} is not connected in the shared LangSmith vault. ` +
+                `Run \`mda connect\` for a ${integration.displayName} connector, or connect it ` +
+                `under LangSmith Settings → Integrations. (Original: ${message})`);
+        }
+        const apiBase = process.env[MDA_PUBLIC_API_URL_ENV]
+            ?.trim()
+            .replace(/\/$/, "");
+        const appBase = resolvePublicAppUrl?.() ??
+            process.env[MDA_PUBLIC_APP_URL_ENV]?.trim().replace(/\/$/, "");
+        const base = apiBase || appBase;
+        const paths = identityConnectPaths(integration.connectId);
+        const url = base ? fleetConnectUrl(integration, base) : paths.connect;
+        return new Error(`${hintPrefix(integration)}. Ask the user to Connect with ${integration.displayName} at ${url}. ` +
+            "Paste that full URL so they can open it. " +
+            `(Original: ${message})`);
+    }
+    return error instanceof Error ? error : new Error(message);
+}
+export function isFleetConnectHint(message, integration) {
+    return message.includes(hintPrefix(integration));
+}
+//# sourceMappingURL=fleet-connect-hint.js.map

package/dist/identity/fleet-connect-hint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-connect-hint.js","sourceRoot":"","sources":["../../src/identity/fleet-connect-hint.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,2BAA2B,GAE5B,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EACL,gBAAgB,EAChB,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAA2B,MAAM,YAAY,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAcxB,SAAS,UAAU,CAAC,WAAkC;IACpD,OAAO,0BAA0B,WAAW,CAAC,WAAW,EAAE,CAAC;AAC7D,CAAC;AAED,qEAAqE;AACrE,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAGlC,CAAC;AAEJ,SAAS,QAAQ,CAAC,MAAc,EAAE,YAAoB;IACpD,OAAO,GAAG,MAAM,KAAK,YAAY,EAAE,CAAC;AACtC,CAAC;AAED,sEAAsE;AACtE,SAAS,wBAAwB,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,qBAAqB,EAAE,CAAC;QACjD,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAC3B,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,MAAc,EACd,YAAoB;IAEpB,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAClC,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC,SAAS,CAAC;AACzB,CAAC;AAED,SAAS,cAAc,CACrB,MAAc,EACd,YAAoB,EACpB,SAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC9B,0EAA0E;IAC1E,yEAAyE;IACzE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE;QACxD,SAAS,EAAE,GAAG,GAAG,qBAAqB;QACtC,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;AACL,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,kCAAkC;IAChD,qBAAqB,CAAC,KAAK,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAkC,EAClC,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,MAAe,EACf,mBAAqE;IAErE,MAAM,OAAO,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvE,MAAM,OAAO,GACX,mBAAmB,EAAE,CAAC,GAAG,CAAC;QAC1B,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,CAAC;IAChC,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IACvE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,YAAY,CACtE,MAAM,EACN,UAAU,CACX,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,4BAA4B,IAAI,EAAE,CACpE,CAAC;QACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,WAAkC,EAClC,MAAc,EACd,mBAAqE;IAErE,MAAM,GAAG,GAAG,MAAM,mBAAmB,CACnC,WAAW,EACX,OAAO,CAAC,GAAG,EACX,MAAM,EACN,mBAAmB,CACpB,CAAC;IACF,OAAO,CACL,GAAG,UAAU,CAAC,WAAW,CAAC,8BAA8B,WAAW,CAAC,WAAW,OAAO,GAAG,IAAI;QAC7F,2CAA2C;QAC3C,kBAAkB,WAAW,CAAC,WAAW,sCAAsC,CAChF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAA0C;IAE1C,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,IAAI,oBAAoB,CAAC;IACzD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,2BAA2B,CAAC,WAAW,CAAC,CAAC;IAE3E,KAAK,UAAU,YAAY,CAAC,MAAc;QACxC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,MAAM,CAAC;QACjB,CAAC;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC;QACxE,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,cAAc,CAAC,CAAC;QAC9C,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO,WAAW,CAAC,EAAE,eAAe;QAC1C,KAAK,CAAC,aAAa,CACjB,OAIC,EACD,OAAyC;YAEzC,IAAI,CAAC,gCAAgC,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;gBACtD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;oBAClC,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,GAAG,MAAM,WAAW,CAC5B,WAAW,EACX,MAAM,EACN,OAAO,CAAC,mBAAmB,CAC5B,CAAC;gBACF,OAAO,OAAO,CAAC;oBACb,GAAG,OAAO;oBACV,QAAQ,EAAE;wBACR,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;wBACjC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC7D;iBACF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,WAAW,CAC5B,WAAW,EACX,MAAM,EACN,OAAO,CAAC,mBAAmB,CAC5B,CAAC;YACF,OAAO,OAAO,CAAC;gBACb,GAAG,OAAO;gBACV,QAAQ,EAAE;oBACR,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;oBACjC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC7D;aACF,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,WAAkC,EAClC,mBAAqE;IAErE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IACE,sFAAsF,CAAC,IAAI,CACzF,OAAO,CACR,EACD,CAAC;QACD,4EAA4E;QAC5E,gEAAgE;QAChE,IAAI,CAAC,gCAAgC,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YACtD,OAAO,IAAI,KAAK,CACd,GAAG,WAAW,CAAC,WAAW,mDAAmD;gBAC3E,6BAA6B,WAAW,CAAC,WAAW,4BAA4B;gBAChF,uDAAuD,OAAO,GAAG,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;YACjD,EAAE,IAAI,EAAE;aACP,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtB,MAAM,OAAO,GACX,mBAAmB,EAAE,EAAE;YACvB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,CAAC;QAChC,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;QACtE,OAAO,IAAI,KAAK,CACd,GAAG,UAAU,CAAC,WAAW,CAAC,kCAAkC,WAAW,CAAC,WAAW,OAAO,GAAG,IAAI;YAC/F,2CAA2C;YAC3C,cAAc,OAAO,GAAG,CAC3B,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,WAAkC;IAElC,OAAO,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;AACnD,CAAC"}

package/dist/identity/fleet-connect.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Factory for Connect-with-X providers that persist tokens in the LangSmith
+ * Fleet vault under a derived actor agent_id.
+ *
+ * Google and Microsoft are thin adapters over this module; Google optionally
+ * adds a BYO OAuth client for offline / non-LangSmith setups.
+ */
+import { type FleetOAuthIntegration } from "../connectors/toolserver/integrations.js";
+import type { IdentityConnectProvider, IdentityConnectRedirectBaseOptions } from "./connect-provider-types.js";
+import { createFleetAuthSession, deleteAgentConnection, listAgentConnections, upsertAgentProviderToken, type FleetClientOptions } from "./fleet.js";
+export interface FleetVaultByoTokenResult {
+    accessToken: string;
+    refreshToken?: string;
+    expiresInSeconds?: number;
+    scope?: string;
+    tokenType?: string;
+    /** Shown on status (e.g. email). */
+    accountLabel?: string;
+    /** Merged into vault token metadata (plus `mda_actor_user_id`). */
+    metadata?: Record<string, unknown>;
+}
+/** Config shape returned by {@link FleetVaultByoOauth.readConfig}. */
+export interface FleetVaultByoOauthConfig {
+    publicAppUrl: string;
+    /** Space-separated OAuth scopes from env / BYO defaults. */
+    scopes: string;
+}
+/** Optional BYO OAuth client when Fleet platform OAuth is unavailable. */
+export interface FleetVaultByoOauth {
+    readConfig(env?: NodeJS.ProcessEnv): FleetVaultByoOauthConfig | null;
+    buildAuthorizeUrl(config: FleetVaultByoOauthConfig, state: string, redirectUri: string, scopes: string): string;
+    exchangeCode(config: FleetVaultByoOauthConfig, code: string, redirectUri: string): Promise<FleetVaultByoTokenResult>;
+}
+export interface FleetVaultConnectProviderOptions {
+    integration: FleetOAuthIntegration;
+    /** Override LangSmith OAuth provider slug. */
+    providerSlug?: string;
+    /**
+     * Resolve the LangSmith OAuth provider slug (sync or async).
+     *
+     * Used by marketplace bridges that discover `oauth_provider_id` from the
+     * workspace MCP server row. When omitted, uses {@link providerSlug} or
+     * {@link readIntegrationProviderSlug}.
+     */
+    resolveProviderSlug?: () => string | Promise<string>;
+    /**
+     * Whether declared connectors imply this Connect provider should mount on
+     * user-scoped deployments. Defaults to toolserver slug matching via
+     * {@link hasIntegrationToolServerConnector}.
+     */
+    hasDeclaredConnector?: (connectorKinds: readonly (string | undefined)[] | undefined) => boolean;
+    /**
+     * Override the "configured" check. Defaults to
+     * {@link isFleetVaultConnectConfigured} with {@link byo}.
+     */
+    isConfigured?: (env?: NodeJS.ProcessEnv) => boolean;
+    /** Override the not-configured error returned from startAuthorize. */
+    notConfiguredError?: string;
+    /**
+     * When true, startAuthorize catches discovery/session failures and returns
+     * `{ notConfigured: true, error }` instead of throwing (marketplace MCP
+     * discovery can fail before an auth-session exists).
+     */
+    softAuthorizeFailures?: boolean;
+    /**
+     * OAuth scopes to request. When omitted: connector-derived scopes from the
+     * mount context, then BYO `readConfig().scopes`, then
+     * {@link fallbackScopes} / `integration.profileScopes`.
+     */
+    scopes?: string[];
+    /** Optional BYO OAuth path (Google / Microsoft). */
+    byo?: FleetVaultByoOauth;
+    resolveRedirectBase(options: IdentityConnectRedirectBaseOptions): string;
+    resolvePublicAppUrl?(): string | undefined;
+    /** Injectable Fleet client (tests). */
+    fleet?: FleetClientOptions & {
+        list?: typeof listAgentConnections;
+        upsert?: typeof upsertAgentProviderToken;
+        delete?: typeof deleteAgentConnection;
+        createAuthSession?: typeof createFleetAuthSession;
+    };
+    /**
+     * Last-resort scopes when connectors and BYO config imply none.
+     * Defaults to `integration.profileScopes`.
+     */
+    fallbackScopes?: string[];
+}
+export declare function isFleetVaultConnectConfigured(byo?: FleetVaultByoOauth, env?: NodeJS.ProcessEnv): boolean;
+export declare function fleetVaultConnectNotConfiguredError(integration: FleetOAuthIntegration): string;
+export declare function fleetConnectUrl(integration: FleetOAuthIntegration, publicAppUrl: string): string;
+/** Build a Fleet vault Connect-with-X provider for `integration`. */
+export declare function createFleetVaultConnectProvider(options: FleetVaultConnectProviderOptions): IdentityConnectProvider;
+//# sourceMappingURL=fleet-connect.d.ts.map

package/dist/identity/fleet-connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-connect.d.ts","sourceRoot":"","sources":["../../src/identity/fleet-connect.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,0CAA0C,CAAC;AAGlD,OAAO,KAAK,EAKV,uBAAuB,EACvB,kCAAkC,EACnC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EAErB,oBAAoB,EACpB,wBAAwB,EACxB,KAAK,kBAAkB,EACxB,MAAM,YAAY,CAAC;AAapB,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,sEAAsE;AACtE,MAAM,WAAW,wBAAwB;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0EAA0E;AAC1E,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,wBAAwB,GAAG,IAAI,CAAC;IACrE,iBAAiB,CACf,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,MAAM,CAAC;IACV,YAAY,CACV,MAAM,EAAE,wBAAwB,EAChC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,gCAAgC;IAC/C,WAAW,EAAE,qBAAqB,CAAC;IACnC,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CACrB,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,KACxD,OAAO,CAAC;IACb;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;IACpD,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,oDAAoD;IACpD,GAAG,CAAC,EAAE,kBAAkB,CAAC;IACzB,mBAAmB,CAAC,OAAO,EAAE,kCAAkC,GAAG,MAAM,CAAC;IACzE,mBAAmB,CAAC,IAAI,MAAM,GAAG,SAAS,CAAC;IAC3C,uCAAuC;IACvC,KAAK,CAAC,EAAE,kBAAkB,GAAG;QAC3B,IAAI,CAAC,EAAE,OAAO,oBAAoB,CAAC;QACnC,MAAM,CAAC,EAAE,OAAO,wBAAwB,CAAC;QACzC,MAAM,CAAC,EAAE,OAAO,qBAAqB,CAAC;QACtC,iBAAiB,CAAC,EAAE,OAAO,sBAAsB,CAAC;KACnD,CAAC;IACF;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAQD,wBAAgB,6BAA6B,CAC3C,GAAG,CAAC,EAAE,kBAAkB,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAQT;AAED,wBAAgB,mCAAmC,CACjD,WAAW,EAAE,qBAAqB,GACjC,MAAM,CAMR;AAED,wBAAgB,eAAe,CAC7B,WAAW,EAAE,qBAAqB,EAClC,YAAY,EAAE,MAAM,GACnB,MAAM,CAGR;AAED,qEAAqE;AACrE,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gCAAgC,GACxC,uBAAuB,CA4QzB"}