managed-deepagents 0.4.2 → 0.4.3-dev.95

package/dist/identity/fleet-connect.js

@@ -0,0 +1,256 @@
+/**
+ * Factory for Connect-with-X providers that persist tokens in the LangSmith
+ * Fleet vault under a derived actor agent_id.
+ *
+ * Google and Microsoft are thin adapters over this module; Google optionally
+ * adds a BYO OAuth client for offline / non-LangSmith setups.
+ */
+import { hasIntegrationToolServerConnector, readIntegrationProviderSlug, scopesForIntegrationConnectorKinds, } from "../connectors/toolserver/integrations.js";
+import { identityConnectPaths } from "./connect-paths.js";
+import { isUserScopedDeployment } from "./connect-inference.js";
+import { createFleetAuthSession, deleteAgentConnection, hasFleetAuthCredentials, listAgentConnections, upsertAgentProviderToken, } from "./fleet.js";
+import { agentIdFromActor, enableActorSubjectIntegration, } from "./actor-subject.js";
+import { oauthTicketsFor } from "./oauth-tickets.js";
+import { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, } from "./oauth-env.js";
+function hasPublicConnectBase(env = process.env) {
+    return Boolean(env[MDA_PUBLIC_API_URL_ENV]?.trim() || env[MDA_PUBLIC_APP_URL_ENV]?.trim());
+}
+export function isFleetVaultConnectConfigured(byo, env = process.env) {
+    if (!hasPublicConnectBase(env)) {
+        return false;
+    }
+    if (hasFleetAuthCredentials(env)) {
+        return true;
+    }
+    return Boolean(readOauthStateSigningKey(env) && byo?.readConfig(env));
+}
+export function fleetVaultConnectNotConfiguredError(integration) {
+    return (`${integration.displayName} connect is not configured (set LANGSMITH_API_KEY, ` +
+        "LANGSMITH_WORKSPACE_ID, MDA_PUBLIC_API_URL; " +
+        `or a BYO OAuth client and ${OAUTH_STATE_SIGNING_KEY_ENV})`);
+}
+export function fleetConnectUrl(integration, publicAppUrl) {
+    const paths = identityConnectPaths(integration.connectId);
+    return `${publicAppUrl.replace(/\/$/, "")}${paths.connect}`;
+}
+/** Build a Fleet vault Connect-with-X provider for `integration`. */
+export function createFleetVaultConnectProvider(options) {
+    const { integration, byo } = options;
+    const paths = identityConnectPaths(integration.connectId);
+    const tickets = oauthTicketsFor(integration.connectId);
+    const list = options.fleet?.list ?? listAgentConnections;
+    const upsert = options.fleet?.upsert ?? upsertAgentProviderToken;
+    const del = options.fleet?.delete ?? deleteAgentConnection;
+    const createSession = options.fleet?.createAuthSession ?? createFleetAuthSession;
+    const fleetOpts = () => {
+        const { list: _l, upsert: _u, delete: _d, createAuthSession: _c, ...rest } = options.fleet ?? {};
+        return rest;
+    };
+    const configured = (env) => options.isConfigured?.(env) ?? isFleetVaultConnectConfigured(byo, env);
+    const notConfiguredError = () => options.notConfiguredError ??
+        fleetVaultConnectNotConfiguredError(integration);
+    let mountConnectorKinds;
+    async function resolveProviderSlug() {
+        if (options.resolveProviderSlug) {
+            return options.resolveProviderSlug();
+        }
+        return (options.providerSlug?.trim() || readIntegrationProviderSlug(integration));
+    }
+    function resolveAuthorizeScopes(ctxKinds) {
+        if (options.scopes?.length) {
+            return [...options.scopes];
+        }
+        const fromConnectors = scopesForIntegrationConnectorKinds(integration, ctxKinds ?? mountConnectorKinds);
+        if (fromConnectors.length > 0) {
+            return fromConnectors;
+        }
+        const byoScopes = byo
+            ?.readConfig()
+            ?.scopes?.trim()
+            .split(/\s+/)
+            .filter(Boolean);
+        if (byoScopes?.length) {
+            return byoScopes;
+        }
+        return [...(options.fallbackScopes ?? integration.profileScopes ?? [])];
+    }
+    function hasConnector(connectorKinds) {
+        return (options.hasDeclaredConnector?.(connectorKinds) ??
+            hasIntegrationToolServerConnector(integration, connectorKinds));
+    }
+    return {
+        id: integration.connectId,
+        settingsQueryKey: integration.connectId,
+        shouldMount(ctx) {
+            if (!ctx.hasIdentity) {
+                return false;
+            }
+            if (ctx.declared) {
+                mountConnectorKinds = ctx.connectorKinds;
+                enableActorSubjectIntegration(integration.id);
+                return true;
+            }
+            if (hasConnector(ctx.connectorKinds) &&
+                isUserScopedDeployment(ctx.scope)) {
+                mountConnectorKinds = ctx.connectorKinds;
+                enableActorSubjectIntegration(integration.id);
+                return true;
+            }
+            return false;
+        },
+        async status(userId) {
+            const isConfigured = configured();
+            let connected = false;
+            let accountLabel;
+            let agentId;
+            let providerId;
+            if (isConfigured) {
+                try {
+                    agentId = agentIdFromActor(userId);
+                    providerId = await resolveProviderSlug();
+                    const connections = await list(agentId, fleetOpts());
+                    const match = connections.find((c) => c.provider_id === providerId);
+                    connected = Boolean(match);
+                    accountLabel = match?.provider_account_label;
+                }
+                catch (err) {
+                    return {
+                        configured: isConfigured,
+                        linked: false,
+                        connected: false,
+                        error: err instanceof Error ? err.message : String(err),
+                        connectPath: paths.connect,
+                    };
+                }
+            }
+            return {
+                configured: isConfigured,
+                linked: connected,
+                connected,
+                ...(agentId ? { agentId } : {}),
+                ...(providerId ? { providerId } : {}),
+                ...(accountLabel ? { email: accountLabel, accountLabel } : {}),
+                connectPath: paths.connect,
+                scopes: resolveAuthorizeScopes(),
+            };
+        },
+        async startAuthorize(userId, redirectUri) {
+            if (!configured()) {
+                return {
+                    notConfigured: true,
+                    error: notConfiguredError(),
+                };
+            }
+            const run = async () => {
+                const scopes = resolveAuthorizeScopes();
+                if (hasFleetAuthCredentials()) {
+                    const agentId = agentIdFromActor(userId);
+                    const session = await createSession({
+                        providerSlug: await resolveProviderSlug(),
+                        scopes,
+                        agentId,
+                        strategy: "create",
+                    }, fleetOpts());
+                    const authorizeUrl = session.verification_url?.trim();
+                    if (!authorizeUrl) {
+                        throw new Error(`Fleet auth-session did not return a verification_url for ${integration.displayName} connect`);
+                    }
+                    return { authorizeUrl };
+                }
+                const stateKey = readOauthStateSigningKey();
+                const oauth = byo?.readConfig();
+                if (!stateKey || !byo || !oauth) {
+                    return {
+                        notConfigured: true,
+                        error: notConfiguredError(),
+                    };
+                }
+                const state = await tickets.createState(userId, stateKey);
+                return {
+                    authorizeUrl: byo.buildAuthorizeUrl(oauth, state, redirectUri, scopes.join(" ")),
+                };
+            };
+            if (!options.softAuthorizeFailures) {
+                return run();
+            }
+            try {
+                return await run();
+            }
+            catch (err) {
+                return {
+                    notConfigured: true,
+                    error: err instanceof Error ? err.message : String(err),
+                };
+            }
+        },
+        async completeCallback(code, state, redirectUri) {
+            // Fleet/platform path finalizes on host GET /v2/auth/callback — MDA's
+            // callback is only used for the optional BYO client.
+            const oauth = byo?.readConfig();
+            if (!byo || !oauth) {
+                const publicApp = process.env[MDA_PUBLIC_APP_URL_ENV]?.replace(/\/$/, "") ||
+                    process.env[MDA_PUBLIC_API_URL_ENV]?.replace(/\/$/, "") ||
+                    "";
+                return {
+                    successRedirect: publicApp
+                        ? `${publicApp}/settings?${integration.connectId}=connected`
+                        : "/",
+                };
+            }
+            const stateKey = readOauthStateSigningKey();
+            if (!stateKey) {
+                throw new Error(`${OAUTH_STATE_SIGNING_KEY_ENV} is not configured`);
+            }
+            const { userId } = await tickets.verifyState(state, stateKey);
+            const token = await byo.exchangeCode(oauth, code, redirectUri);
+            const agentId = agentIdFromActor(userId);
+            const scopes = token.scope
+                ? token.scope.split(/\s+/).filter(Boolean)
+                : resolveAuthorizeScopes();
+            await upsert(agentId, await resolveProviderSlug(), {
+                access_token: token.accessToken,
+                ...(token.refreshToken ? { refresh_token: token.refreshToken } : {}),
+                ...(token.expiresInSeconds !== undefined
+                    ? { expires_in_seconds: token.expiresInSeconds }
+                    : {}),
+                scopes,
+                ...(token.accountLabel
+                    ? { provider_account_label: token.accountLabel }
+                    : {}),
+                metadata: {
+                    mda_actor_user_id: userId,
+                    ...(token.metadata ?? {}),
+                },
+            }, fleetOpts());
+            return {
+                successRedirect: `${oauth.publicAppUrl}/settings?${integration.connectId}=connected`,
+            };
+        },
+        async unlink(userId) {
+            const agentId = agentIdFromActor(userId);
+            const providerId = await resolveProviderSlug();
+            const connections = await list(agentId, fleetOpts());
+            const match = connections.find((c) => c.provider_id === providerId);
+            if (match) {
+                await del(agentId, match.id, fleetOpts());
+            }
+        },
+        resolveRedirectBase(redirectOptions) {
+            return options.resolveRedirectBase(redirectOptions);
+        },
+        resolvePublicAppUrl() {
+            return (options.resolvePublicAppUrl?.() ??
+                byo?.readConfig()?.publicAppUrl ??
+                process.env[MDA_PUBLIC_APP_URL_ENV]?.replace(/\/$/, ""));
+        },
+        async resolveConnectTicket(ticket) {
+            const stateKey = readOauthStateSigningKey();
+            if (!stateKey) {
+                throw new Error(`${OAUTH_STATE_SIGNING_KEY_ENV} is not configured`);
+            }
+            const { userId } = await tickets.verifyTicket(ticket, stateKey);
+            return userId;
+        },
+    };
+}
+//# sourceMappingURL=fleet-connect.js.map

package/dist/identity/fleet-connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-connect.js","sourceRoot":"","sources":["../../src/identity/fleet-connect.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,iCAAiC,EACjC,2BAA2B,EAC3B,kCAAkC,GAEnC,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAShE,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,GAEzB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,gBAAgB,EAChB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AA8FxB,SAAS,oBAAoB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAChE,OAAO,OAAO,CACZ,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAC3E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,GAAwB,EACxB,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC,wBAAwB,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,WAAkC;IAElC,OAAO,CACL,GAAG,WAAW,CAAC,WAAW,qDAAqD;QAC/E,8CAA8C;QAC9C,6BAA6B,2BAA2B,GAAG,CAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,WAAkC,EAClC,YAAoB;IAEpB,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1D,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;AAC9D,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,+BAA+B,CAC7C,OAAyC;IAEzC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACrC,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,IAAI,oBAAoB,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,IAAI,wBAAwB,CAAC;IACjE,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,IAAI,qBAAqB,CAAC;IAC3D,MAAM,aAAa,GACjB,OAAO,CAAC,KAAK,EAAE,iBAAiB,IAAI,sBAAsB,CAAC;IAC7D,MAAM,SAAS,GAAG,GAAuB,EAAE;QACzC,MAAM,EACJ,IAAI,EAAE,EAAE,EACR,MAAM,EAAE,EAAE,EACV,MAAM,EAAE,EAAE,EACV,iBAAiB,EAAE,EAAE,EACrB,GAAG,IAAI,EACR,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,GAAuB,EAAW,EAAE,CACtD,OAAO,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,IAAI,6BAA6B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzE,MAAM,kBAAkB,GAAG,GAAW,EAAE,CACtC,OAAO,CAAC,kBAAkB;QAC1B,mCAAmC,CAAC,WAAW,CAAC,CAAC;IAEnD,IAAI,mBAAgE,CAAC;IAErE,KAAK,UAAU,mBAAmB;QAChC,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACvC,CAAC;QACD,OAAO,CACL,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,2BAA2B,CAAC,WAAW,CAAC,CACzE,CAAC;IACJ,CAAC;IAED,SAAS,sBAAsB,CAAC,QAA4B;QAC1D,IAAI,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,cAAc,GAAG,kCAAkC,CACvD,WAAW,EACX,QAAQ,IAAI,mBAAmB,CAChC,CAAC;QACF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,MAAM,SAAS,GAAG,GAAG;YACnB,EAAE,UAAU,EAAE;YACd,EAAE,MAAM,EAAE,IAAI,EAAE;aACf,KAAK,CAAC,KAAK,CAAC;aACZ,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,WAAW,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,SAAS,YAAY,CACnB,cAA2D;QAE3D,OAAO,CACL,OAAO,CAAC,oBAAoB,EAAE,CAAC,cAAc,CAAC;YAC9C,iCAAiC,CAAC,WAAW,EAAE,cAAc,CAAC,CAC/D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,WAAW,CAAC,SAAS;QACzB,gBAAgB,EAAE,WAAW,CAAC,SAAS;QACvC,WAAW,CAAC,GAAgC;YAC1C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjB,mBAAmB,GAAG,GAAG,CAAC,cAAc,CAAC;gBACzC,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBAC9C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IACE,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC;gBAChC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,EACjC,CAAC;gBACD,mBAAmB,GAAG,GAAG,CAAC,cAAc,CAAC;gBACzC,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBAC9C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;YAClC,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,YAAgC,CAAC;YACrC,IAAI,OAA2B,CAAC;YAChC,IAAI,UAA8B,CAAC;YACnC,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;oBACnC,UAAU,GAAG,MAAM,mBAAmB,EAAE,CAAC;oBACzC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;oBACrD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC;oBACpE,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC3B,YAAY,GAAG,KAAK,EAAE,sBAAsB,CAAC;gBAC/C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO;wBACL,UAAU,EAAE,YAAY;wBACxB,MAAM,EAAE,KAAK;wBACb,SAAS,EAAE,KAAK;wBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;wBACvD,WAAW,EAAE,KAAK,CAAC,OAAO;qBAC3B,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,YAAY;gBACxB,MAAM,EAAE,SAAS;gBACjB,SAAS;gBACT,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/B,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,WAAW,EAAE,KAAK,CAAC,OAAO;gBAC1B,MAAM,EAAE,sBAAsB,EAAE;aACjC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,WAAmB;YAEnB,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;gBAClB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,kBAAkB,EAAE;iBAC5B,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,IAA6C,EAAE;gBAC9D,MAAM,MAAM,GAAG,sBAAsB,EAAE,CAAC;gBACxC,IAAI,uBAAuB,EAAE,EAAE,CAAC;oBAC9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;oBACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC;wBACE,YAAY,EAAE,MAAM,mBAAmB,EAAE;wBACzC,MAAM;wBACN,OAAO;wBACP,QAAQ,EAAE,QAAQ;qBACnB,EACD,SAAS,EAAE,CACZ,CAAC;oBACF,MAAM,YAAY,GAAG,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;oBACtD,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,MAAM,IAAI,KAAK,CACb,4DAA4D,WAAW,CAAC,WAAW,UAAU,CAC9F,CAAC;oBACJ,CAAC;oBACD,OAAO,EAAE,YAAY,EAAE,CAAC;gBAC1B,CAAC;gBACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;gBAC5C,MAAM,KAAK,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC;gBAChC,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;oBAChC,OAAO;wBACL,aAAa,EAAE,IAAI;wBACnB,KAAK,EAAE,kBAAkB,EAAE;qBAC5B,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC1D,OAAO;oBACL,YAAY,EAAE,GAAG,CAAC,iBAAiB,CACjC,KAAK,EACL,KAAK,EACL,WAAW,EACX,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CACjB;iBACF,CAAC;YACJ,CAAC,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;gBACnC,OAAO,GAAG,EAAE,CAAC;YACf,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,GAAG,EAAE,CAAC;YACrB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,sEAAsE;YACtE,qDAAqD;YACrD,MAAM,KAAK,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;oBACvD,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;oBACvD,EAAE,CAAC;gBACL,OAAO;oBACL,eAAe,EAAE,SAAS;wBACxB,CAAC,CAAC,GAAG,SAAS,aAAa,WAAW,CAAC,SAAS,YAAY;wBAC5D,CAAC,CAAC,GAAG;iBACR,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC9D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YAC/D,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK;gBACxB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC1C,CAAC,CAAC,sBAAsB,EAAE,CAAC;YAC7B,MAAM,MAAM,CACV,OAAO,EACP,MAAM,mBAAmB,EAAE,EAC3B;gBACE,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS;oBACtC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,EAAE;oBAChD,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM;gBACN,GAAG,CAAC,KAAK,CAAC,YAAY;oBACpB,CAAC,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,YAAY,EAAE;oBAChD,CAAC,CAAC,EAAE,CAAC;gBACP,QAAQ,EAAE;oBACR,iBAAiB,EAAE,MAAM;oBACzB,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;iBAC1B;aACF,EACD,SAAS,EAAE,CACZ,CAAC;YACF,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,aAAa,WAAW,CAAC,SAAS,YAAY;aACrF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM,UAAU,GAAG,MAAM,mBAAmB,EAAE,CAAC;YAC/C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC;YACpE,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,mBAAmB,CACjB,eAAmD;YAEnD,OAAO,OAAO,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACtD,CAAC;QACD,mBAAmB;YACjB,OAAO,CACL,OAAO,CAAC,mBAAmB,EAAE,EAAE;gBAC/B,GAAG,EAAE,UAAU,EAAE,EAAE,YAAY;gBAC/B,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,oBAAoB,CAAC,MAAc;YACvC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAChE,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/identity/fleet-integration-connect.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Thin Connect-with-X wiring for Fleet vault integrations that use
+ * {@link createByoOauthClient}.
+ */
+import { type FleetOAuthIntegration } from "../connectors/toolserver/integrations.js";
+import type { ByoOauthClient } from "./byo-oauth.js";
+import { type FleetVaultConnectProviderOptions } from "./fleet-connect.js";
+import type { FleetClientOptions } from "./fleet.js";
+import { deleteAgentConnection, listAgentConnections, upsertAgentProviderToken } from "./fleet.js";
+import type { IdentityConnectProvider } from "./connect-provider-types.js";
+export interface FleetIntegrationConnectProviderOptions {
+    /** Override LangSmith OAuth provider slug. */
+    providerSlug?: string;
+    /**
+     * OAuth scopes to request. When omitted, uses connector-derived scopes from
+     * the mount context at authorize time, then profile / fallback scopes.
+     */
+    scopes?: string[];
+    /** Injectable Fleet client (tests). */
+    fleet?: FleetClientOptions & {
+        list?: typeof listAgentConnections;
+        upsert?: typeof upsertAgentProviderToken;
+        delete?: typeof deleteAgentConnection;
+    };
+}
+/** Build Fleet vault Connect options for `integration` + its BYO client. */
+export declare function fleetIntegrationConnectOptions(integration: FleetOAuthIntegration, byoClient: ByoOauthClient, options?: FleetIntegrationConnectProviderOptions, fallbackScopes?: readonly string[]): FleetVaultConnectProviderOptions;
+/** Build a Fleet vault Connect provider for `integration` + its BYO client. */
+export declare function createFleetIntegrationConnectProvider(integration: FleetOAuthIntegration, byoClient: ByoOauthClient, options?: FleetIntegrationConnectProviderOptions, fallbackScopes?: readonly string[]): IdentityConnectProvider;
+export declare function isFleetIntegrationConnectConfigured(byoClient: ByoOauthClient, env?: NodeJS.ProcessEnv): boolean;
+export declare function fleetIntegrationConnectUrl(integration: FleetOAuthIntegration, publicAppUrl: string): string;
+//# sourceMappingURL=fleet-integration-connect.d.ts.map

package/dist/identity/fleet-integration-connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-integration-connect.d.ts","sourceRoot":"","sources":["../../src/identity/fleet-integration-connect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAIL,KAAK,gCAAgC,EACtC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,MAAM,WAAW,sCAAsC;IACrD,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,uCAAuC;IACvC,KAAK,CAAC,EAAE,kBAAkB,GAAG;QAC3B,IAAI,CAAC,EAAE,OAAO,oBAAoB,CAAC;QACnC,MAAM,CAAC,EAAE,OAAO,wBAAwB,CAAC;QACzC,MAAM,CAAC,EAAE,OAAO,qBAAqB,CAAC;KACvC,CAAC;CACH;AAED,4EAA4E;AAC5E,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,qBAAqB,EAClC,SAAS,EAAE,cAAc,EACzB,OAAO,GAAE,sCAA2C,EACpD,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GACjC,gCAAgC,CAiBlC;AAED,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,qBAAqB,EAClC,SAAS,EAAE,cAAc,EACzB,OAAO,GAAE,sCAA2C,EACpD,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GACjC,uBAAuB,CASzB;AAED,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,cAAc,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET;AAED,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,qBAAqB,EAClC,YAAY,EAAE,MAAM,GACnB,MAAM,CAER"}

package/dist/identity/fleet-integration-connect.js

@@ -0,0 +1,35 @@
+/**
+ * Thin Connect-with-X wiring for Fleet vault integrations that use
+ * {@link createByoOauthClient}.
+ */
+import { readIntegrationProviderSlug, } from "../connectors/toolserver/integrations.js";
+import { MDA_PUBLIC_APP_URL_ENV } from "./oauth-env.js";
+import { createFleetVaultConnectProvider, fleetConnectUrl, isFleetVaultConnectConfigured, } from "./fleet-connect.js";
+import { deleteAgentConnection, listAgentConnections, upsertAgentProviderToken, } from "./fleet.js";
+/** Build Fleet vault Connect options for `integration` + its BYO client. */
+export function fleetIntegrationConnectOptions(integration, byoClient, options = {}, fallbackScopes) {
+    return {
+        integration,
+        providerSlug: options.providerSlug?.trim() || readIntegrationProviderSlug(integration),
+        ...(options.scopes ? { scopes: options.scopes } : {}),
+        byo: byoClient.byo,
+        resolveRedirectBase: byoClient.resolveRedirectBase,
+        resolvePublicAppUrl() {
+            return (byoClient.resolvePublicAppUrl() ??
+                process.env[MDA_PUBLIC_APP_URL_ENV]?.replace(/\/$/, ""));
+        },
+        ...(options.fleet ? { fleet: options.fleet } : {}),
+        fallbackScopes: [...(fallbackScopes ?? integration.profileScopes ?? [])],
+    };
+}
+/** Build a Fleet vault Connect provider for `integration` + its BYO client. */
+export function createFleetIntegrationConnectProvider(integration, byoClient, options = {}, fallbackScopes) {
+    return createFleetVaultConnectProvider(fleetIntegrationConnectOptions(integration, byoClient, options, fallbackScopes));
+}
+export function isFleetIntegrationConnectConfigured(byoClient, env = process.env) {
+    return isFleetVaultConnectConfigured(byoClient.byo, env);
+}
+export function fleetIntegrationConnectUrl(integration, publicAppUrl) {
+    return fleetConnectUrl(integration, publicAppUrl);
+}
+//# sourceMappingURL=fleet-integration-connect.js.map

package/dist/identity/fleet-integration-connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-integration-connect.js","sourceRoot":"","sources":["../../src/identity/fleet-integration-connect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,2BAA2B,GAE5B,MAAM,0CAA0C,CAAC;AAElD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EACL,+BAA+B,EAC/B,eAAe,EACf,6BAA6B,GAE9B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AAmBpB,4EAA4E;AAC5E,MAAM,UAAU,8BAA8B,CAC5C,WAAkC,EAClC,SAAyB,EACzB,OAAO,GAA2C,EAAE,EACpD,cAAkC;IAElC,OAAO;QACL,WAAW;QACX,YAAY,EACV,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,2BAA2B,CAAC,WAAW,CAAC;QAC1E,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,mBAAmB,EAAE,SAAS,CAAC,mBAAmB;QAClD,mBAAmB;YACjB,OAAO,CACL,SAAS,CAAC,mBAAmB,EAAE;gBAC/B,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,cAAc,EAAE,CAAC,GAAG,CAAC,cAAc,IAAI,WAAW,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,qCAAqC,CACnD,WAAkC,EAClC,SAAyB,EACzB,OAAO,GAA2C,EAAE,EACpD,cAAkC;IAElC,OAAO,+BAA+B,CACpC,8BAA8B,CAC5B,WAAW,EACX,SAAS,EACT,OAAO,EACP,cAAc,CACf,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,SAAyB,EACzB,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,6BAA6B,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,WAAkC,EAClC,YAAoB;IAEpB,OAAO,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AACpD,CAAC"}

package/dist/identity/fleet.d.ts

@@ -0,0 +1,56 @@
+/**
+ * LangSmith Fleet client for agent-subject vault connections.
+ *
+ * Shared by Connect providers (Google today; other toolserver OAuth providers
+ * later). Source of truth for Connect status is Fleet agent connections — not
+ * a local Store cache.
+ */
+export interface FleetConnection {
+    id: string;
+    agent_id: string;
+    auth_token_id?: string;
+    provider_id: string;
+    provider_account_label?: string;
+    scopes?: string[];
+    expires_at?: string | null;
+}
+export interface UpsertAgentProviderTokenBody {
+    access_token: string;
+    refresh_token?: string;
+    expires_in_seconds?: number;
+    scopes?: string[];
+    provider_account_label?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface FleetClientOptions {
+    apiKey?: string;
+    apiUrl?: string;
+    workspaceId?: string;
+    fetchImpl?: typeof fetch;
+}
+export interface CreateFleetAuthSessionBody {
+    providerSlug: string;
+    scopes: string[];
+    agentId: string;
+    strategy?: "create" | "reuse";
+}
+export interface FleetAuthSession {
+    id?: string;
+    status: string;
+    provider_slug?: string;
+    verification_url?: string;
+    token?: string;
+}
+export declare function resolveFleetApiUrl(env?: NodeJS.ProcessEnv): string;
+export declare function resolveFleetHeaders(label: string, env?: NodeJS.ProcessEnv): Record<string, string>;
+export declare function listAgentConnections(agentId: string, options?: FleetClientOptions): Promise<FleetConnection[]>;
+export declare function upsertAgentProviderToken(agentId: string, providerSlug: string, body: UpsertAgentProviderTokenBody, options?: FleetClientOptions): Promise<FleetConnection>;
+/**
+ * Start a Fleet OAuth session for an agent subject (platform OAuth provider).
+ * Returns a verification_url the browser should open.
+ */
+export declare function createFleetAuthSession(body: CreateFleetAuthSessionBody, options?: FleetClientOptions): Promise<FleetAuthSession>;
+/** True when LANGSMITH_API_KEY is set so Fleet APIs can be called. */
+export declare function hasFleetAuthCredentials(env?: NodeJS.ProcessEnv): boolean;
+export declare function deleteAgentConnection(agentId: string, connectionId: string, options?: FleetClientOptions): Promise<void>;
+//# sourceMappingURL=fleet.d.ts.map

package/dist/identity/fleet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.d.ts","sourceRoot":"","sources":["../../src/identity/fleet.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,kBAAkB,CAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAGR;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBxB;AAiBD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,eAAe,EAAE,CAAC,CAsB5B;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,EAClC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,eAAe,CAAC,CAwB1B;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,0BAA0B,EAChC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,gBAAgB,CAAC,CA2B3B;AAED,sEAAsE;AACtE,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAmBf"}

package/dist/identity/fleet.js

@@ -0,0 +1,131 @@
+/**
+ * LangSmith Fleet client for agent-subject vault connections.
+ *
+ * Shared by Connect providers (Google today; other toolserver OAuth providers
+ * later). Source of truth for Connect status is Fleet agent connections — not
+ * a local Store cache.
+ */
+import { fetchWithTimeout, PROVIDER_HTTP_TIMEOUT_MS } from "../runtime/http.js";
+const DEFAULT_API_URL = "https://api.smith.langchain.com";
+export function resolveFleetApiUrl(env = process.env) {
+    const base = trimmed(env.LANGSMITH_ENDPOINT) ?? DEFAULT_API_URL;
+    return stripTrailingSlashes(withScheme(base));
+}
+export function resolveFleetHeaders(label, env = process.env) {
+    const apiKey = trimmed(env.LANGSMITH_API_KEY);
+    if (!apiKey) {
+        throw new Error(`${label} needs LANGSMITH_API_KEY to reach the LangSmith Fleet API.`);
+    }
+    const headers = {
+        "x-api-key": apiKey,
+        "Content-Type": "application/json",
+    };
+    const workspaceId = trimmed(env.LANGSMITH_WORKSPACE_ID);
+    if (workspaceId) {
+        headers["x-tenant-id"] = workspaceId;
+    }
+    return headers;
+}
+function fleetHeaders(label, options, env = process.env) {
+    if (options.apiKey || options.workspaceId) {
+        return {
+            "x-api-key": options.apiKey ?? trimmed(env.LANGSMITH_API_KEY) ?? "",
+            "Content-Type": "application/json",
+            ...(options.workspaceId ? { "x-tenant-id": options.workspaceId } : {}),
+        };
+    }
+    return resolveFleetHeaders(label, env);
+}
+export async function listAgentConnections(agentId, options = {}) {
+    const env = process.env;
+    const base = options.apiUrl ?? resolveFleetApiUrl(env);
+    const headers = fleetHeaders("fleet list connections", options, env);
+    const url = `${base}/v1/fleet/agents/${encodeURIComponent(agentId)}/connections`;
+    const response = await fetchWithTimeout(url, { method: "GET", headers }, PROVIDER_HTTP_TIMEOUT_MS, options.fetchImpl ?? fetch);
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`Fleet list connections failed (${response.status}): ${text || response.statusText}`);
+    }
+    const json = (await response.json());
+    return json.items ?? json.data ?? [];
+}
+export async function upsertAgentProviderToken(agentId, providerSlug, body, options = {}) {
+    const env = process.env;
+    const base = options.apiUrl ?? resolveFleetApiUrl(env);
+    const headers = fleetHeaders("fleet upsert provider token", options, env);
+    const url = `${base}/v1/fleet/agents/${encodeURIComponent(agentId)}` +
+        `/providers/${encodeURIComponent(providerSlug)}/tokens`;
+    const response = await fetchWithTimeout(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body),
+    }, PROVIDER_HTTP_TIMEOUT_MS, options.fetchImpl ?? fetch);
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`Fleet upsert agent provider token failed (${response.status}): ${text || response.statusText}`);
+    }
+    return (await response.json());
+}
+/**
+ * Start a Fleet OAuth session for an agent subject (platform OAuth provider).
+ * Returns a verification_url the browser should open.
+ */
+export async function createFleetAuthSession(body, options = {}) {
+    const env = process.env;
+    const base = options.apiUrl ?? resolveFleetApiUrl(env);
+    const headers = fleetHeaders("fleet auth-session", options, env);
+    const url = `${base}/v1/fleet/auth-sessions`;
+    const response = await fetchWithTimeout(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({
+            provider_slug: body.providerSlug,
+            scopes: body.scopes,
+            agent_id: body.agentId,
+            strategy: body.strategy ?? "create",
+        }),
+    }, PROVIDER_HTTP_TIMEOUT_MS, options.fetchImpl ?? fetch);
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`Fleet auth-session failed (${response.status}): ${text || response.statusText}`);
+    }
+    return (await response.json());
+}
+/** True when LANGSMITH_API_KEY is set so Fleet APIs can be called. */
+export function hasFleetAuthCredentials(env = process.env) {
+    return Boolean(trimmed(env.LANGSMITH_API_KEY));
+}
+export async function deleteAgentConnection(agentId, connectionId, options = {}) {
+    const env = process.env;
+    const base = options.apiUrl ?? resolveFleetApiUrl(env);
+    const headers = fleetHeaders("fleet delete connection", options, env);
+    const url = `${base}/v1/fleet/agents/${encodeURIComponent(agentId)}` +
+        `/connections/${encodeURIComponent(connectionId)}`;
+    const response = await fetchWithTimeout(url, { method: "DELETE", headers }, PROVIDER_HTTP_TIMEOUT_MS, options.fetchImpl ?? fetch);
+    if (!response.ok && response.status !== 404) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`Fleet delete connection failed (${response.status}): ${text || response.statusText}`);
+    }
+}
+function withScheme(base) {
+    const separator = base.indexOf("://");
+    if (separator > 0) {
+        const scheme = base.slice(0, separator);
+        if (/^[a-z][a-z0-9+.-]*$/i.test(scheme)) {
+            return base;
+        }
+    }
+    return `https://${base}`;
+}
+function stripTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value.charCodeAt(end - 1) === 47 /* / */) {
+        end -= 1;
+    }
+    return end === value.length ? value : value.slice(0, end);
+}
+function trimmed(value) {
+    const v = value?.trim();
+    return v ? v : undefined;
+}
+//# sourceMappingURL=fleet.js.map

package/dist/identity/fleet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.js","sourceRoot":"","sources":["../../src/identity/fleet.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,MAAM,eAAe,GAAG,iCAAiC,CAAC;AA2C1D,MAAM,UAAU,kBAAkB,CAChC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,eAAe,CAAC;IAChE,OAAO,oBAAoB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,4DAA4D,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAA2B;QACtC,WAAW,EAAE,MAAM;QACnB,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACxD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,aAAa,CAAC,GAAG,WAAW,CAAC;IACvC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CACnB,KAAa,EACb,OAA2B,EAC3B,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QAC1C,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE;YACnE,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,OAAO,GAAuB,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,wBAAwB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,GAAG,IAAI,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC;IACjF,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAC1B,wBAAwB,EACxB,OAAO,CAAC,SAAS,IAAI,KAAK,CAC3B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,kCAAkC,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAe,EACf,YAAoB,EACpB,IAAkC,EAClC,OAAO,GAAuB,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,6BAA6B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1E,MAAM,GAAG,GACP,GAAG,IAAI,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,EAAE;QACxD,cAAc,kBAAkB,CAAC,YAAY,CAAC,SAAS,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH;QACE,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,EACD,wBAAwB,EACxB,OAAO,CAAC,SAAS,IAAI,KAAK,CAC3B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,6CAA6C,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAoB,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAgC,EAChC,OAAO,GAAuB,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,oBAAoB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,GAAG,IAAI,yBAAyB,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH;QACE,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ;SACpC,CAAC;KACH,EACD,wBAAwB,EACxB,OAAO,CAAC,SAAS,IAAI,KAAK,CAC3B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,8BAA8B,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqB,CAAC;AACrD,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,uBAAuB,CACrC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAe,EACf,YAAoB,EACpB,OAAO,GAAuB,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,yBAAyB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACtE,MAAM,GAAG,GACP,GAAG,IAAI,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,EAAE;QACxD,gBAAgB,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAC7B,wBAAwB,EACxB,OAAO,CAAC,SAAS,IAAI,KAAK,CAC3B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,mCAAmC,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACxC,IAAI,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,WAAW,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;QAC3D,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;IACD,OAAO,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,OAAO,CAAC,KAAyB;IACxC,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACxB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3B,CAAC"}

package/dist/identity/github/connect-http.d.ts

@@ -1,7 +1,8 @@
 /**
  * Connect-with-GitHub — {@link IdentityConnectProvider} for actor OAuth tokens.
  *
- * Mounted under `/identity/github/*` when listed on `identity.connect`.
+ * Mounted under `/identity/github/*` when listed on `identity.connect`, or when
+ * a user-scoped deployment declares a GitHub connector.
  */
 import type { IdentityConnectProvider } from "../connect-provider-types.js";
 import { type GitHubCredentialStore } from "./credentials-store.js";
@@ -20,12 +21,15 @@ export declare const githubIdentityConnectProvider: IdentityConnectProvider;
 /**
  * Opt into Connect-with-GitHub on `defineIdentity({ connect: […] })`.
  *
+ * Usually unnecessary: `credentials.github(...)` on a user-scoped deployment
+ * mounts these routes by inference.
+ *
  * @example
  * ```ts
- * import { defineIdentity, github } from "managed-deepagents";
+ * import { connect, defineIdentity } from "managed-deepagents";
  *
- * export const identity = defineIdentity.preset("internal-tool", {
- *   connect: [github.connect()],
+ * export const identity = defineIdentity({
+ *   connect: [connect.github()],
  * });
  * ```
  */

package/dist/identity/github/connect-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/github/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAKV,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAC;AAehC,eAAO,MAAM,0BAA0B,QAAe,CAAC;AACvD,eAAO,MAAM,yBAAyB,QAAgB,CAAC;AACvD,eAAO,MAAM,4BAA4B,QAAiB,CAAC;AAC3D,eAAO,MAAM,wBAAwB,QAAa,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,WAAW,oCAAoC;IACnD,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED,oEAAoE;AACpE,wBAAgB,mCAAmC,CACjD,OAAO,GAAE,oCAAyC,GACjD,uBAAuB,CAsFzB;AAED,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,EAAE,uBACL,CAAC;AAExC;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,oCAAoC,GAC7C,uBAAuB,CAIzB"}
+{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/github/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAKV,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AAWtC,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAC;AAWhC,eAAO,MAAM,0BAA0B,QAAe,CAAC;AACvD,eAAO,MAAM,yBAAyB,QAAgB,CAAC;AACvD,eAAO,MAAM,4BAA4B,QAAiB,CAAC;AAC3D,eAAO,MAAM,wBAAwB,QAAa,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,WAAW,oCAAoC;IACnD,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED,oEAAoE;AACpE,wBAAgB,mCAAmC,CACjD,OAAO,GAAE,oCAAyC,GACjD,uBAAuB,CAiGzB;AAED,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,EAAE,uBACL,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,oCAAoC,GAC7C,uBAAuB,CAIzB"}