managed-deepagents 0.4.2 → 0.4.3-dev.95

package/dist/identity/microsoft/oauth.js

@@ -0,0 +1,65 @@
+/**
+ * Microsoft BYO OAuth descriptor — optional non-LangSmith Connect-with-Microsoft.
+ * The default path uses Fleet auth-sessions instead.
+ */
+import { createByoOauthClient, } from "../byo-oauth.js";
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, } from "../byo-oauth.js";
+/** Azure AD tenant (`common`, `organizations`, `consumers`, or a tenant id). */
+export const MICROSOFT_OAUTH_TENANT_ENV = "MICROSOFT_OAUTH_TENANT";
+const DEFAULT_TENANT = "common";
+const DEFAULT_USERINFO_URL = "https://graph.microsoft.com/v1.0/me";
+/** Profile + refresh; connector-derived unions replace this at authorize time. */
+const DEFAULT_SCOPES = [
+    "openid",
+    "email",
+    "profile",
+    "offline_access",
+    "https://graph.microsoft.com/User.Read",
+].join(" ");
+function defaultAuthUrl(tenant) {
+    return `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize`;
+}
+function defaultTokenUrl(tenant) {
+    return `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`;
+}
+/** Microsoft BYO OAuth client (config, authorize, exchange, Fleet adapter). */
+export const microsoftByoOauth = createByoOauthClient({
+    providerId: "microsoft",
+    displayName: "Microsoft",
+    envPrefix: "MICROSOFT_OAUTH",
+    defaultEndpoints(env) {
+        const tenant = env[MICROSOFT_OAUTH_TENANT_ENV]?.trim() || DEFAULT_TENANT;
+        return {
+            authUrl: defaultAuthUrl(tenant),
+            tokenUrl: defaultTokenUrl(tenant),
+            userInfoUrl: DEFAULT_USERINFO_URL,
+            defaultScopes: DEFAULT_SCOPES,
+        };
+    },
+    authorizeParams: { response_mode: "query" },
+    parseUserInfo(json) {
+        const mail = typeof json.mail === "string" ? json.mail : undefined;
+        const upn = typeof json.userPrincipalName === "string"
+            ? json.userPrincipalName
+            : undefined;
+        const id = typeof json.id === "string" ? json.id : undefined;
+        return {
+            ...(mail || upn ? { email: mail || upn } : {}),
+            ...(id ? { subject: id } : {}),
+        };
+    },
+    subjectMetadataKey: "microsoft_oid",
+});
+export const MICROSOFT_OAUTH_CLIENT_ID_ENV = microsoftByoOauth.env.clientId;
+export const MICROSOFT_OAUTH_CLIENT_SECRET_ENV = microsoftByoOauth.env.clientSecret;
+export const MICROSOFT_OAUTH_SCOPES_ENV = microsoftByoOauth.env.scopes;
+export const MICROSOFT_OAUTH_AUTH_URL_ENV = microsoftByoOauth.env.authUrl;
+export const MICROSOFT_OAUTH_TOKEN_URL_ENV = microsoftByoOauth.env.tokenUrl;
+export const MICROSOFT_OAUTH_USERINFO_URL_ENV = microsoftByoOauth.env.userInfoUrl;
+/** Microsoft-bound OAuth state / connect-ticket helpers. */
+export const microsoftOauthTickets = microsoftByoOauth.tickets;
+export const resolveMicrosoftOauthRedirectBase = microsoftByoOauth.resolveRedirectBase;
+export const readMicrosoftOauthConfig = microsoftByoOauth.readConfig;
+export const buildMicrosoftAuthorizeUrl = microsoftByoOauth.buildAuthorizeUrl;
+export const exchangeMicrosoftOauthCode = microsoftByoOauth.exchangeCode;
+//# sourceMappingURL=oauth.js.map

package/dist/identity/microsoft/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/identity/microsoft/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,oBAAoB,GAGrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAIzB,gFAAgF;AAChF,MAAM,CAAC,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAEnE,MAAM,cAAc,GAAG,QAAQ,CAAC;AAChC,MAAM,oBAAoB,GAAG,qCAAqC,CAAC;AACnE,kFAAkF;AAClF,MAAM,cAAc,GAAG;IACrB,QAAQ;IACR,OAAO;IACP,SAAS;IACT,gBAAgB;IAChB,uCAAuC;CACxC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,qCAAqC,MAAM,wBAAwB,CAAC;AAC7E,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,qCAAqC,MAAM,oBAAoB,CAAC;AACzE,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,iBAAiB,GAAmB,oBAAoB,CAAC;IACpE,UAAU,EAAE,WAAW;IACvB,WAAW,EAAE,WAAW;IACxB,SAAS,EAAE,iBAAiB;IAC5B,gBAAgB,CAAC,GAAG;QAClB,MAAM,MAAM,GAAG,GAAG,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC;QACzE,OAAO;YACL,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC;YAC/B,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC;YACjC,WAAW,EAAE,oBAAoB;YACjC,aAAa,EAAE,cAAc;SAC9B,CAAC;IACJ,CAAC;IACD,eAAe,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE;IAC3C,aAAa,CAAC,IAAI;QAChB,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,GAAG,GACP,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ;YACxC,CAAC,CAAC,IAAI,CAAC,iBAAiB;YACxB,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,OAAO;YACL,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/B,CAAC;IACJ,CAAC;IACD,kBAAkB,EAAE,eAAe;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC5E,MAAM,CAAC,MAAM,iCAAiC,GAC5C,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC;AACrC,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;AACvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC;AAC1E,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC5E,MAAM,CAAC,MAAM,gCAAgC,GAC3C,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC;AAEpC,4DAA4D;AAC5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC,OAAO,CAAC;AAE/D,MAAM,CAAC,MAAM,iCAAiC,GAC5C,iBAAiB,CAAC,mBAAmB,CAAC;AAExC,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC,UAAU,CAAC;AACrE,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC,iBAAiB,CAAC;AAC9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC,YAAY,CAAC"}

package/dist/identity/oauth-env.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Shared deployment OAuth env keys and redirect-base resolution.
+ *
+ * Used by Slack OIDC, GitHub Connect, Fleet vault Connect, and BYO clients —
+ * not Slack-specific despite historical residence under `slack/oauth.ts`.
+ */
+export declare const MDA_PUBLIC_APP_URL_ENV = "MDA_PUBLIC_APP_URL";
+/**
+ * Public Agent Server base URL used for OAuth `redirect_uri`.
+ * Required on LangGraph Host where the ASGI request origin is an internal
+ * loopback (e.g. `http://localhost:5557`) rather than `*.langgraph.app`.
+ */
+export declare const MDA_PUBLIC_API_URL_ENV = "MDA_PUBLIC_API_URL";
+/**
+ * Signing key for OAuth `state` JWTs (Connect-with-X). The env var name is
+ * historical — it predates guest ingress being removed — and is kept so
+ * existing deployments do not have to rotate a secret. Never a provider client
+ * secret (that value is an OAuth credential, not a signing key).
+ */
+export declare const OAUTH_STATE_SIGNING_KEY_ENV = "MDA_GUEST_SIGNING_KEY";
+/** Server-side key for OAuth state JWTs; null when Connect cannot bind actors. */
+export declare function readOauthStateSigningKey(env?: NodeJS.ProcessEnv): string | null;
+/**
+ * Public base URL for OAuth `redirect_uri` (`…/identity/{provider}/callback`).
+ *
+ * Prefer an explicit public Agent Server URL over the ASGI request origin:
+ * LangGraph Host rewrites requests to an internal loopback that IdPs cannot
+ * use as a redirect.
+ */
+export declare function resolveOauthRedirectBase(options: {
+    requestUrl: string;
+    headers?: Headers | {
+        get(name: string): string | null | undefined;
+    };
+    deploymentBaseUrl?: string;
+    env?: NodeJS.ProcessEnv;
+}): string;
+/**
+ * @deprecated Use {@link resolveOauthRedirectBase}. Kept for callers that still
+ * import the historical Slack-named alias.
+ */
+export declare const resolveSlackOauthRedirectBase: typeof resolveOauthRedirectBase;
+//# sourceMappingURL=oauth-env.d.ts.map

package/dist/identity/oauth-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-env.d.ts","sourceRoot":"","sources":["../../src/identity/oauth-env.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAC3D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAEnE,kFAAkF;AAClF,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAGf;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;KAAE,CAAC;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,CAcT;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,iCAA2B,CAAC"}

package/dist/identity/oauth-env.js

@@ -0,0 +1,66 @@
+/**
+ * Shared deployment OAuth env keys and redirect-base resolution.
+ *
+ * Used by Slack OIDC, GitHub Connect, Fleet vault Connect, and BYO clients —
+ * not Slack-specific despite historical residence under `slack/oauth.ts`.
+ */
+import { isLoopbackHost, isLoopbackUrl } from "./loopback.js";
+export const MDA_PUBLIC_APP_URL_ENV = "MDA_PUBLIC_APP_URL";
+/**
+ * Public Agent Server base URL used for OAuth `redirect_uri`.
+ * Required on LangGraph Host where the ASGI request origin is an internal
+ * loopback (e.g. `http://localhost:5557`) rather than `*.langgraph.app`.
+ */
+export const MDA_PUBLIC_API_URL_ENV = "MDA_PUBLIC_API_URL";
+/**
+ * Signing key for OAuth `state` JWTs (Connect-with-X). The env var name is
+ * historical — it predates guest ingress being removed — and is kept so
+ * existing deployments do not have to rotate a secret. Never a provider client
+ * secret (that value is an OAuth credential, not a signing key).
+ */
+export const OAUTH_STATE_SIGNING_KEY_ENV = "MDA_GUEST_SIGNING_KEY";
+/** Server-side key for OAuth state JWTs; null when Connect cannot bind actors. */
+export function readOauthStateSigningKey(env = process.env) {
+    const key = env[OAUTH_STATE_SIGNING_KEY_ENV]?.trim();
+    return key || null;
+}
+/**
+ * Public base URL for OAuth `redirect_uri` (`…/identity/{provider}/callback`).
+ *
+ * Prefer an explicit public Agent Server URL over the ASGI request origin:
+ * LangGraph Host rewrites requests to an internal loopback that IdPs cannot
+ * use as a redirect.
+ */
+export function resolveOauthRedirectBase(options) {
+    const env = options.env ?? process.env;
+    if (options.deploymentBaseUrl?.trim()) {
+        return options.deploymentBaseUrl.trim().replace(/\/$/, "");
+    }
+    const fromEnv = env[MDA_PUBLIC_API_URL_ENV]?.trim().replace(/\/$/, "");
+    if (fromEnv && !isLoopbackUrl(fromEnv)) {
+        return fromEnv;
+    }
+    const forwarded = publicOriginFromForwardedHeaders(options.headers);
+    if (forwarded) {
+        return forwarded;
+    }
+    return new URL(options.requestUrl).origin;
+}
+/**
+ * @deprecated Use {@link resolveOauthRedirectBase}. Kept for callers that still
+ * import the historical Slack-named alias.
+ */
+export const resolveSlackOauthRedirectBase = resolveOauthRedirectBase;
+function publicOriginFromForwardedHeaders(headers) {
+    if (!headers) {
+        return undefined;
+    }
+    const host = headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+    if (!host || isLoopbackHost(host)) {
+        return undefined;
+    }
+    const proto = headers.get("x-forwarded-proto")?.split(",")[0]?.trim() ||
+        (host.includes("localhost") || host.startsWith("127.") ? "http" : "https");
+    return `${proto}://${host}`;
+}
+//# sourceMappingURL=oauth-env.js.map

package/dist/identity/oauth-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-env.js","sourceRoot":"","sources":["../../src/identity/oauth-env.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9D,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAC3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAC;AAEnE,kFAAkF;AAClF,MAAM,UAAU,wBAAwB,CACtC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC;IACrD,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAKxC;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,IAAI,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,CAAC;QACtC,OAAO,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvE,IAAI,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,SAAS,GAAG,gCAAgC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,wBAAwB,CAAC;AAEtE,SAAS,gCAAgC,CACvC,OAAoE;IAEpE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GACT,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACvD,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7E,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;AAC9B,CAAC"}

package/dist/identity/oauth-tickets.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Shared OAuth state and connect-ticket JWTs for Connect-with-X providers.
+ *
+ * Parameterized by provider id so each integration gets distinct `typ` values
+ * (`mda-{id}-oauth-state`, `mda-{id}-connect-ticket`) without copying JWT code.
+ */
+export declare function createOauthState(providerId: string, userId: string, signingKey: string, nowMs?: number): Promise<string>;
+export declare function verifyOauthState(providerId: string, state: string, signingKey: string, nowMs?: number): Promise<{
+    userId: string;
+}>;
+/**
+ * Mint a short-lived connect ticket for channel actors (Slack, etc.) who have
+ * no browser session. The Connect start route accepts `?ticket=…` and binds
+ * the OAuth vault subject to this user id.
+ */
+export declare function createConnectTicket(providerId: string, userId: string, signingKey: string, nowMs?: number): Promise<string>;
+export declare function verifyConnectTicket(providerId: string, ticket: string, signingKey: string, nowMs?: number): Promise<{
+    userId: string;
+}>;
+/** Bound OAuth state / connect-ticket helpers for one Connect provider id. */
+export interface OauthTickets {
+    readonly providerId: string;
+    createState(userId: string, signingKey: string, nowMs?: number): Promise<string>;
+    verifyState(state: string, signingKey: string, nowMs?: number): Promise<{
+        userId: string;
+    }>;
+    createTicket(userId: string, signingKey: string, nowMs?: number): Promise<string>;
+    verifyTicket(ticket: string, signingKey: string, nowMs?: number): Promise<{
+        userId: string;
+    }>;
+}
+/**
+ * Bind {@link createOauthState} / ticket helpers to a Connect provider id
+ * (`mda-{id}-oauth-state`, `mda-{id}-connect-ticket`).
+ */
+export declare function oauthTicketsFor(providerId: string): OauthTickets;
+//# sourceMappingURL=oauth-tickets.d.ts.map

package/dist/identity/oauth-tickets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-tickets.d.ts","sourceRoot":"","sources":["../../src/identity/oauth-tickets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAsBH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAqB7B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAwB7B;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,WAAW,CACT,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,WAAW,CACT,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/B,YAAY,CACV,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,YAAY,CACV,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAgBhE"}

package/dist/identity/oauth-tickets.js

@@ -0,0 +1,114 @@
+/**
+ * Shared OAuth state and connect-ticket JWTs for Connect-with-X providers.
+ *
+ * Parameterized by provider id so each integration gets distinct `typ` values
+ * (`mda-{id}-oauth-state`, `mda-{id}-connect-ticket`) without copying JWT code.
+ */
+import { randomBytes } from "node:crypto";
+import { jwtVerify, SignJWT } from "jose";
+const STATE_TTL_MS = 10 * 60 * 1000;
+/** Short-lived ticket so Slack/email actors can open Connect without a browser session. */
+const CONNECT_TICKET_TTL_MS = 30 * 60 * 1000;
+function stateTyp(providerId) {
+    return `mda-${providerId}-oauth-state`;
+}
+function ticketTyp(providerId) {
+    return `mda-${providerId}-connect-ticket`;
+}
+function stateSigningKey(signingKey) {
+    return new TextEncoder().encode(signingKey);
+}
+export async function createOauthState(providerId, userId, signingKey, nowMs = Date.now()) {
+    const iat = Math.floor(nowMs / 1000);
+    const exp = Math.floor((nowMs + STATE_TTL_MS) / 1000);
+    return new SignJWT({
+        userId,
+        nonce: randomBytes(16).toString("hex"),
+    })
+        .setProtectedHeader({ alg: "HS256", typ: stateTyp(providerId) })
+        .setIssuedAt(iat)
+        .setExpirationTime(exp)
+        .sign(stateSigningKey(signingKey));
+}
+export async function verifyOauthState(providerId, state, signingKey, nowMs = Date.now()) {
+    try {
+        const { payload } = await jwtVerify(state, stateSigningKey(signingKey), {
+            algorithms: ["HS256"],
+            typ: stateTyp(providerId),
+            currentDate: new Date(nowMs),
+        });
+        if (typeof payload.userId !== "string" || !payload.userId) {
+            throw new Error("invalid OAuth state actor");
+        }
+        return { userId: payload.userId };
+    }
+    catch (err) {
+        if (err instanceof Error && err.message.startsWith("invalid OAuth state")) {
+            throw err;
+        }
+        const message = err instanceof Error ? err.message : String(err);
+        if (/exp|expir/i.test(message)) {
+            throw new Error("OAuth state expired");
+        }
+        throw new Error("invalid OAuth state signature");
+    }
+}
+/**
+ * Mint a short-lived connect ticket for channel actors (Slack, etc.) who have
+ * no browser session. The Connect start route accepts `?ticket=…` and binds
+ * the OAuth vault subject to this user id.
+ */
+export async function createConnectTicket(providerId, userId, signingKey, nowMs = Date.now()) {
+    const iat = Math.floor(nowMs / 1000);
+    const exp = Math.floor((nowMs + CONNECT_TICKET_TTL_MS) / 1000);
+    return new SignJWT({
+        userId,
+        nonce: randomBytes(16).toString("hex"),
+    })
+        .setProtectedHeader({ alg: "HS256", typ: ticketTyp(providerId) })
+        .setIssuedAt(iat)
+        .setExpirationTime(exp)
+        .sign(stateSigningKey(signingKey));
+}
+export async function verifyConnectTicket(providerId, ticket, signingKey, nowMs = Date.now()) {
+    try {
+        const { payload } = await jwtVerify(ticket, stateSigningKey(signingKey), {
+            algorithms: ["HS256"],
+            typ: ticketTyp(providerId),
+            currentDate: new Date(nowMs),
+        });
+        if (typeof payload.userId !== "string" || !payload.userId) {
+            throw new Error("invalid connect ticket actor");
+        }
+        return { userId: payload.userId };
+    }
+    catch (err) {
+        if (err instanceof Error &&
+            err.message.startsWith("invalid connect ticket")) {
+            throw err;
+        }
+        const message = err instanceof Error ? err.message : String(err);
+        if (/exp|expir/i.test(message)) {
+            throw new Error("connect ticket expired");
+        }
+        throw new Error("invalid connect ticket signature");
+    }
+}
+/**
+ * Bind {@link createOauthState} / ticket helpers to a Connect provider id
+ * (`mda-{id}-oauth-state`, `mda-{id}-connect-ticket`).
+ */
+export function oauthTicketsFor(providerId) {
+    const id = providerId.trim();
+    if (!id) {
+        throw new Error("oauthTicketsFor requires a non-empty providerId");
+    }
+    return {
+        providerId: id,
+        createState: (userId, signingKey, nowMs) => createOauthState(id, userId, signingKey, nowMs),
+        verifyState: (state, signingKey, nowMs) => verifyOauthState(id, state, signingKey, nowMs),
+        createTicket: (userId, signingKey, nowMs) => createConnectTicket(id, userId, signingKey, nowMs),
+        verifyTicket: (ticket, signingKey, nowMs) => verifyConnectTicket(id, ticket, signingKey, nowMs),
+    };
+}
+//# sourceMappingURL=oauth-tickets.js.map

package/dist/identity/oauth-tickets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-tickets.js","sourceRoot":"","sources":["../../src/identity/oauth-tickets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE1C,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,2FAA2F;AAC3F,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C,SAAS,QAAQ,CAAC,UAAkB;IAClC,OAAO,OAAO,UAAU,cAAc,CAAC;AACzC,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB;IACnC,OAAO,OAAO,UAAU,iBAAiB,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAkB,EAClB,MAAc,EACd,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;IACtD,OAAO,IAAI,OAAO,CAAC;QACjB,MAAM;QACN,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACvC,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;SAC/D,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,GAAG,CAAC;SACtB,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAkB,EAClB,KAAa,EACb,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE;YACtE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,QAAQ,CAAC,UAAU,CAAC;YACzB,WAAW,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC1E,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,MAAc,EACd,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,qBAAqB,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/D,OAAO,IAAI,OAAO,CAAC;QACjB,MAAM;QACN,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACvC,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;SAChE,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,GAAG,CAAC;SACtB,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,MAAc,EACd,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE;YACvE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,SAAS,CAAC,UAAU,CAAC;YAC1B,WAAW,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IACE,GAAG,YAAY,KAAK;YACpB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAChD,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AA2BD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,UAAU,EAAE,EAAE;QACd,WAAW,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CACzC,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;QACjD,WAAW,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CACxC,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC;QAChD,YAAY,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAC1C,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;QACpD,YAAY,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAC1C,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;KACrD,CAAC;AACJ,CAAC"}

package/dist/identity/options.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The `defineIdentity(...)` input, and its normalization into the resolved
+ * {@link IdentityConfig}.
+ *
+ * Authors describe how callers authenticate. The runtime supplies the managed
+ * user-isolation policy, so credential ownership and Connect routing do not
+ * become authoring knobs. Durable memory is not an identity concern at all —
+ * it has its own root declaration in `memory.ts`.
+ */
+import type { IdentityConfig, LangSmithApiKeyIngress, ValidatedTokenProvider } from "./types.js";
+/**
+ * How MDA learns who is calling.
+ *
+ * - `"backend"` — a backend you operate has already authenticated the caller and
+ *   asserts the user id over the reserved ingress headers.
+ * - `auth.langsmithApiKey()` — MDA verifies a LangSmith workspace API key and
+ *   treats the result as a service identity.
+ * - one or more `providers.*` entries — MDA verifies the caller's own token
+ *   server-side (browser-direct).
+ */
+export type IdentityAuth = "backend" | LangSmithApiKeyIngress | ValidatedTokenProvider | ValidatedTokenProvider[];
+/** The identity declaration. Authentication must be chosen explicitly. */
+export interface IdentityOptions {
+    /** How callers authenticate. */
+    auth: IdentityAuth;
+}
+/**
+ * Derive the resolved {@link IdentityConfig} from the declared options.
+ *
+ * Pure and total: every reachable option combination produces a config that
+ * `validateIdentity` accepts, so the errors that exist only to police two
+ * fields agreeing with each other are unreachable from this path.
+ */
+export declare function normalizeIdentity(options: IdentityOptions): IdentityConfig;
+//# sourceMappingURL=options.d.ts.map

package/dist/identity/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;GASG;AACH,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,sBAAsB,GACtB,sBAAsB,GACtB,sBAAsB,EAAE,CAAC;AAE7B,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,gCAAgC;IAChC,IAAI,EAAE,YAAY,CAAC;CACpB;AAYD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,eAAe,GAAG,cAAc,CAa1E"}

package/dist/identity/options.js

@@ -0,0 +1,80 @@
+/**
+ * The `defineIdentity(...)` input, and its normalization into the resolved
+ * {@link IdentityConfig}.
+ *
+ * Authors describe how callers authenticate. The runtime supplies the managed
+ * user-isolation policy, so credential ownership and Connect routing do not
+ * become authoring knobs. Durable memory is not an identity concern at all —
+ * it has its own root declaration in `memory.ts`.
+ */
+/**
+ * Managed identity keys downstream credentials on the caller.
+ *
+ * Threads are always user-owned, and durable memory is declared by `memory.ts`,
+ * so credentials are the only axis left for identity to resolve.
+ */
+function managedUserScope() {
+    return { credentials: "user" };
+}
+/**
+ * Derive the resolved {@link IdentityConfig} from the declared options.
+ *
+ * Pure and total: every reachable option combination produces a config that
+ * `validateIdentity` accepts, so the errors that exist only to police two
+ * fields agreeing with each other are unreachable from this path.
+ */
+export function normalizeIdentity(options) {
+    assertOptionKeys(options);
+    if (options.auth === undefined) {
+        throw new Error("defineIdentity(...) requires `auth`. Use auth.langsmithApiKey() for LangSmith workspace API keys.");
+    }
+    return {
+        ingress: { http: resolveIngress(options.auth) },
+        scope: managedUserScope(),
+    };
+}
+function resolveIngress(auth) {
+    if (auth === "backend") {
+        return "backend";
+    }
+    if (typeof auth === "string") {
+        throw new Error(`defineIdentity(...) unknown \`auth\` value "${auth}". Use "backend", auth.langsmithApiKey(), or one or more providers.* entries.`);
+    }
+    if (isLangSmithApiKeyAuth(auth)) {
+        return auth;
+    }
+    const providers = Array.isArray(auth) ? auth : [auth];
+    return { mode: "validated_token", providers };
+}
+function isLangSmithApiKeyAuth(auth) {
+    return (!Array.isArray(auth) && "mode" in auth && auth.mode === "langsmith_api_key");
+}
+const KNOWN_OPTION_KEYS = new Set(["auth"]);
+/**
+ * Reject unknown keys so a typo fails loudly instead of being silently ignored.
+ */
+function assertOptionKeys(options) {
+    if (options === null || typeof options !== "object") {
+        throw new Error("defineIdentity(...) requires an options object ({ auth }).");
+    }
+    // `scope` carried three different removals, so a bare "unknown option" would
+    // leave a migrator guessing which one they hit.
+    if ("scope" in options) {
+        throw new Error("defineIdentity(...) `scope` is no longer supported. Threads and " +
+            "downstream credentials are always per-caller, so there is nothing to " +
+            "declare. Durable memory has its own root declaration: export `memory` " +
+            'from `memory.ts` with `defineMemory({ scope: "agent" })`.');
+    }
+    // Connect-with-X is hidden for this release (#235), so say that rather than
+    // reporting `connect` as a typo.
+    if ("connect" in options) {
+        throw new Error("defineIdentity(...) `connect` is not available in this release. " +
+            "Connect-with-X providers cannot be declared yet.");
+    }
+    const unknown = Object.keys(options).filter((key) => !KNOWN_OPTION_KEYS.has(key));
+    if (unknown.length > 0) {
+        throw new Error(`defineIdentity(...) unknown option(s): ${unknown.join(", ")}. ` +
+            `Valid options: ${[...KNOWN_OPTION_KEYS].join(", ")}.`);
+    }
+}
+//# sourceMappingURL=options.js.map

package/dist/identity/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA8BH;;;;;GAKG;AACH,SAAS,gBAAgB;IACvB,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAwB;IACxD,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE1B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QAC/C,KAAK,EAAE,gBAAgB,EAAE;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAkB;IACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,+EAA+E,CACnI,CAAC;IACJ,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAsC;IAEtC,OAAO,CACL,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,CAC5E,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5C;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAwB;IAChD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,gDAAgD;IAChD,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,uEAAuE;YACvE,wEAAwE;YACxE,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,iCAAiC;IACjC,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CACzC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CACrC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC9D,kBAAkB,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/identity/slack/connect-http.d.ts

@@ -1,7 +1,9 @@
 /**
  * Connect-with-Slack — {@link IdentityConnectProvider} for Slack OIDC linking.
  *
- * Mounted under `/identity/slack/*` when listed on `identity.connect`.
+ * Mounted under `/identity/slack/*` when listed on `identity.connect`, or when
+ * a Slack channel routes into a user-scoped / custom-credentials deployment
+ * (so Events can remap actors and tools can use per-caller tokens).
  */
 import type { IdentityConnectProvider } from "../connect-provider-types.js";
 import { type IdentityLinkStore } from "./links.js";
@@ -22,10 +24,10 @@ export declare const slackIdentityConnectProvider: IdentityConnectProvider;
  *
  * @example
  * ```ts
- * import { defineIdentity, slack } from "managed-deepagents";
+ * import { connect, defineIdentity } from "managed-deepagents";
  *
- * export const identity = defineIdentity.preset("internal-tool", {
- *   connect: [slack.connect()],
+ * export const identity = defineIdentity({
+ *   connect: [connect.slack()],
  * });
  * ```
  */

package/dist/identity/slack/connect-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAKV,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAC;AAgBpB,eAAO,MAAM,yBAAyB,QAAe,CAAC;AACtD,eAAO,MAAM,wBAAwB,QAAgB,CAAC;AACtD,eAAO,MAAM,2BAA2B,QAAiB,CAAC;AAC1D,eAAO,MAAM,uBAAuB,QAAa,CAAC;AAElD,8DAA8D;AAC9D,MAAM,WAAW,mCAAmC;IAClD,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAED,mEAAmE;AACnE,wBAAgB,kCAAkC,CAChD,OAAO,GAAE,mCAAwC,GAChD,uBAAuB,CAoFzB;AAED,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,EAAE,uBACL,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,mCAAmC,GAC5C,uBAAuB,CAIzB"}
+{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAKV,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAC;AAmBpB,eAAO,MAAM,yBAAyB,QAAe,CAAC;AACtD,eAAO,MAAM,wBAAwB,QAAgB,CAAC;AACtD,eAAO,MAAM,2BAA2B,QAAiB,CAAC;AAC1D,eAAO,MAAM,uBAAuB,QAAa,CAAC;AAElD,8DAA8D;AAC9D,MAAM,WAAW,mCAAmC;IAClD,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAED,mEAAmE;AACnE,wBAAgB,kCAAkC,CAChD,OAAO,GAAE,mCAAwC,GAChD,uBAAuB,CA6FzB;AAED,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,EAAE,uBACL,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,mCAAmC,GAC5C,uBAAuB,CAIzB"}

package/dist/identity/slack/connect-http.js

@@ -1,11 +1,14 @@
 /**
  * Connect-with-Slack — {@link IdentityConnectProvider} for Slack OIDC linking.
  *
- * Mounted under `/identity/slack/*` when listed on `identity.connect`.
+ * Mounted under `/identity/slack/*` when listed on `identity.connect`, or when
+ * a Slack channel routes into a user-scoped / custom-credentials deployment
+ * (so Events can remap actors and tools can use per-caller tokens).
  */
 import { buildIdentityLinkRecord, getIdentityLinkStore, } from "./links.js";
-import { buildSlackAuthorizeUrl, createSlackOauthState, exchangeSlackOidcCode, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, readSlackOidcConfig, resolveSlackOauthRedirectBase, verifySlackOauthState, } from "./oauth.js";
+import { buildSlackAuthorizeUrl, exchangeSlackOidcCode, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, readSlackOidcConfig, resolveOauthRedirectBase, slackOauthTickets, } from "./oauth.js";
 import { identityConnectPaths } from "../connect-paths.js";
+import { hasChannelForProvider, isUserScopedDeployment, } from "../connect-inference.js";
 const PATHS = identityConnectPaths("slack");
 export const SLACK_CONNECT_STATUS_PATH = PATHS.status;
 export const SLACK_CONNECT_START_PATH = PATHS.connect;
@@ -17,23 +20,30 @@ export function createSlackIdentityConnectProvider(options = {}) {
     return {
         id: "slack",
         shouldMount(ctx) {
-            // Opt-in is via `identity.connect`; this is a secondary gate only.
-            return ctx.hasIdentity;
+            if (!ctx.hasIdentity) {
+                return false;
+            }
+            // Listed on `identity.connect` — the author already opted in. Otherwise
+            // mount only when a Slack channel routes into a per-user deployment,
+            // which is exactly when there is a Slack account worth linking.
+            return (ctx.declared !== false ||
+                (hasChannelForProvider(ctx.channels, "slack") &&
+                    isUserScopedDeployment(ctx.scope)));
         },
-        async status(actorId) {
-            const link = await store().getByActorId(actorId);
+        async status(userId) {
+            const link = await store().getByUserId(userId);
             return {
                 linked: Boolean(link),
                 ...(link
                     ? {
                         slackUserId: link.slackUserId,
-                        slackActorId: link.slackActorId,
+                        slackKey: link.slackKey,
                         linkedAt: link.linkedAt,
                     }
                     : {}),
             };
         },
-        async startAuthorize(actorId, redirectUri) {
+        async startAuthorize(userId, redirectUri) {
             const oauth = readSlackOidcConfig();
             const stateKey = readOauthStateSigningKey();
             if (!oauth || !stateKey) {
@@ -42,7 +52,7 @@ export function createSlackIdentityConnectProvider(options = {}) {
                     error: `Slack connect is not configured (set SLACK_CLIENT_ID, SLACK_CLIENT_SECRET, MDA_PUBLIC_APP_URL, ${OAUTH_STATE_SIGNING_KEY_ENV})`,
                 };
             }
-            const state = await createSlackOauthState(actorId, stateKey);
+            const state = await slackOauthTickets.createState(userId, stateKey);
             return {
                 authorizeUrl: buildSlackAuthorizeUrl(oauth, state, redirectUri),
             };
@@ -56,11 +66,11 @@ export function createSlackIdentityConnectProvider(options = {}) {
             if (!stateKey) {
                 throw new Error(`${OAUTH_STATE_SIGNING_KEY_ENV} is not configured`);
             }
-            const { actorId } = await verifySlackOauthState(state, stateKey);
+            const { userId } = await slackOauthTickets.verifyState(state, stateKey);
             const slackIdentity = await exchangeSlackOidcCode(oauth, code, redirectUri);
             const teamId = slackIdentity.teamId ?? oauth.teamId;
             const record = buildIdentityLinkRecord({
-                actorId,
+                userId,
                 slackUserId: slackIdentity.userId,
                 ...(teamId ? { slackTeamId: teamId } : {}),
                 ...(slackIdentity.email ? { email: slackIdentity.email } : {}),
@@ -70,11 +80,11 @@ export function createSlackIdentityConnectProvider(options = {}) {
                 successRedirect: `${oauth.publicAppUrl}/settings?slack=connected`,
             };
         },
-        async unlink(actorId) {
-            await store().removeByActorId(actorId);
+        async unlink(userId) {
+            await store().removeByUserId(userId);
         },
         resolveRedirectBase(options) {
-            return resolveSlackOauthRedirectBase(options);
+            return resolveOauthRedirectBase(options);
         },
         resolvePublicAppUrl() {
             const oauth = readSlackOidcConfig();
@@ -90,10 +100,10 @@ export const slackIdentityConnectProvider = createSlackIdentityConnectProvider()
  *
  * @example
  * ```ts
- * import { defineIdentity, slack } from "managed-deepagents";
+ * import { connect, defineIdentity } from "managed-deepagents";
  *
- * export const identity = defineIdentity.preset("internal-tool", {
- *   connect: [slack.connect()],
+ * export const identity = defineIdentity({
+ *   connect: [connect.slack()],
  * });
  * ```
  */

package/dist/identity/slack/connect-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,GAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,MAAM,CAAC;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,OAAO,CAAC;AACtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC;AAOlD,mEAAmE;AACnE,MAAM,UAAU,kCAAkC,CAChD,OAAO,GAAwC,EAAE;IAEjD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,oBAAoB,EAAE,CAAC;IAEhE,OAAO;QACL,EAAE,EAAE,OAAO;QACX,WAAW,CAAC,GAAgC;YAC1C,mEAAmE;YACnE,OAAO,GAAG,CAAC,WAAW,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAe;YAC1B,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACjD,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC;gBACrB,GAAG,CAAC,IAAI;oBACN,CAAC,CAAC;wBACE,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;wBAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,OAAe,EACf,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,kGAAkG,2BAA2B,GAAG;iBACxI,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC7D,OAAO;gBACL,YAAY,EAAE,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;aAChE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACjE,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAC/C,KAAK,EACL,IAAI,EACJ,WAAW,CACZ,CAAC;YACF,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;YACpD,MAAM,MAAM,GAAG,uBAAuB,CAAC;gBACrC,OAAO;gBACP,WAAW,EAAE,aAAa,CAAC,MAAM;gBACjC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,2BAA2B;aAClE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAe;YAC1B,MAAM,KAAK,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,mBAAmB,CAAC,OAA2C;YAC7D,OAAO,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QACD,mBAAmB;YACjB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,OAAO,CACL,KAAK,EAAE,YAAY;gBACnB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,4BAA4B,GACvC,kCAAkC,EAAE,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CACrB,OAA6C;IAE7C,OAAO,OAAO;QACZ,CAAC,CAAC,kCAAkC,CAAC,OAAO,CAAC;QAC7C,CAAC,CAAC,4BAA4B,CAAC;AACnC,CAAC"}
+{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,GAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,MAAM,CAAC;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,OAAO,CAAC;AACtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC;AAOlD,mEAAmE;AACnE,MAAM,UAAU,kCAAkC,CAChD,OAAO,GAAwC,EAAE;IAEjD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,oBAAoB,EAAE,CAAC;IAEhE,OAAO;QACL,EAAE,EAAE,OAAO;QACX,WAAW,CAAC,GAAgC;YAC1C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,wEAAwE;YACxE,qEAAqE;YACrE,gEAAgE;YAChE,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,KAAK;gBACtB,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC;oBAC3C,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC;gBACrB,GAAG,CAAC,IAAI;oBACN,CAAC,CAAC;wBACE,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,kGAAkG,2BAA2B,GAAG;iBACxI,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpE,OAAO;gBACL,YAAY,EAAE,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;aAChE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAC/C,KAAK,EACL,IAAI,EACJ,WAAW,CACZ,CAAC;YACF,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;YACpD,MAAM,MAAM,GAAG,uBAAuB,CAAC;gBACrC,MAAM;gBACN,WAAW,EAAE,aAAa,CAAC,MAAM;gBACjC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,2BAA2B;aAClE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,KAAK,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,mBAAmB,CAAC,OAA2C;YAC7D,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,mBAAmB;YACjB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,OAAO,CACL,KAAK,EAAE,YAAY;gBACnB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,4BAA4B,GACvC,kCAAkC,EAAE,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CACrB,OAA6C;IAE7C,OAAO,OAAO;QACZ,CAAC,CAAC,kCAAkC,CAAC,OAAO,CAAC;QAC7C,CAAC,CAAC,4BAA4B,CAAC;AACnC,CAAC"}