managed-deepagents 0.4.2 → 0.4.3-dev.95

package/dist/identity/slack/index.d.ts

@@ -1,8 +1,7 @@
 /**
  * Slack identity helpers — Connect-with-Slack opt-in for `defineIdentity`.
  *
- * Channel authoring lives under `managed-deepagents/channels/slack`
- * (`defineSlackChannel`).
+ * Slack Events / messaging authoring lives on `connectors.slack`.
  */
 export { connect, createSlackIdentityConnectProvider, slackIdentityConnectProvider, SLACK_CONNECT_CALLBACK_PATH, SLACK_CONNECT_LINK_PATH, SLACK_CONNECT_START_PATH, SLACK_CONNECT_STATUS_PATH, } from "./connect-http.js";
 export type { SlackIdentityConnectProviderOptions } from "./connect-http.js";

package/dist/identity/slack/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,OAAO,EACP,kCAAkC,EAClC,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,mCAAmC,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,OAAO,EACP,kCAAkC,EAClC,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,mCAAmC,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/identity/slack/index.js

@@ -1,8 +1,7 @@
 /**
  * Slack identity helpers — Connect-with-Slack opt-in for `defineIdentity`.
  *
- * Channel authoring lives under `managed-deepagents/channels/slack`
- * (`defineSlackChannel`).
+ * Slack Events / messaging authoring lives on `connectors.slack`.
  */
 export { connect, createSlackIdentityConnectProvider, slackIdentityConnectProvider, SLACK_CONNECT_CALLBACK_PATH, SLACK_CONNECT_LINK_PATH, SLACK_CONNECT_START_PATH, SLACK_CONNECT_STATUS_PATH, } from "./connect-http.js";
 //# sourceMappingURL=index.js.map

package/dist/identity/slack/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/slack/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,OAAO,EACP,kCAAkC,EAClC,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/slack/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,OAAO,EACP,kCAAkC,EAClC,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC"}

package/dist/identity/slack/links.d.ts

@@ -3,58 +3,59 @@
  *
  * Stored in the LangGraph Store under `["mda_identity_links"]`, with an
  * in-memory backend for unit tests. Slack Events look up `slack:T:U` before
- * invoke; the web Connect-with-Slack flow upserts after OIDC.
+ * invoke when Connect OIDC is configured; the web Connect-with-Slack flow
+ * upserts after OIDC.
  */
 import { Client } from "@langchain/langgraph-sdk";
 export declare const IDENTITY_LINKS_NAMESPACE: readonly ["mda_identity_links"];
 export interface IdentityLinkRecord {
-    actorId: string;
+    userId: string;
     slackUserId: string;
     slackTeamId?: string;
-    /** Fully-qualified Slack actor key, e.g. `slack:T123:U456`. */
-    slackActorId: string;
+    /** Fully-qualified Slack user key, e.g. `slack:T123:U456`. */
+    slackKey: string;
     email?: string;
     linkedAt: string;
     source: "slack_oauth";
 }
 export interface IdentityLinkStore {
-    getBySlackActorId(slackActorId: string): Promise<IdentityLinkRecord | null>;
-    getByActorId(actorId: string): Promise<IdentityLinkRecord | null>;
+    getBySlackKey(slackKey: string): Promise<IdentityLinkRecord | null>;
+    getByUserId(userId: string): Promise<IdentityLinkRecord | null>;
     upsert(record: IdentityLinkRecord): Promise<void>;
-    removeByActorId(actorId: string): Promise<void>;
+    removeByUserId(userId: string): Promise<void>;
 }
 /** In-memory store for tests (and as a process-local cache layer). */
 export declare class InMemoryIdentityLinkStore implements IdentityLinkStore {
     private readonly bySlack;
-    private readonly byActor;
-    getBySlackActorId(slackActorId: string): Promise<IdentityLinkRecord | null>;
-    getByActorId(actorId: string): Promise<IdentityLinkRecord | null>;
+    private readonly byUser;
+    getBySlackKey(slackKey: string): Promise<IdentityLinkRecord | null>;
+    getByUserId(userId: string): Promise<IdentityLinkRecord | null>;
     upsert(record: IdentityLinkRecord): Promise<void>;
-    removeByActorId(actorId: string): Promise<void>;
+    removeByUserId(userId: string): Promise<void>;
 }
 /** LangGraph Store–backed identity links. */
 export declare class LangGraphIdentityLinkStore implements IdentityLinkStore {
     private readonly client;
     constructor(client: Client);
-    getBySlackActorId(slackActorId: string): Promise<IdentityLinkRecord | null>;
-    getByActorId(actorId: string): Promise<IdentityLinkRecord | null>;
+    getBySlackKey(slackKey: string): Promise<IdentityLinkRecord | null>;
+    getByUserId(userId: string): Promise<IdentityLinkRecord | null>;
     upsert(record: IdentityLinkRecord): Promise<void>;
-    removeByActorId(actorId: string): Promise<void>;
+    removeByUserId(userId: string): Promise<void>;
     private getItem;
 }
 /** Override the process-default link store (tests). */
 export declare function setIdentityLinkStore(store: IdentityLinkStore | null): void;
 /** Resolve the process-default link store (in-memory until a Client is wired). */
 export declare function getIdentityLinkStore(): IdentityLinkStore;
-/** Build a Store-backed client when loopback + ingress secret are available. */
+/** Build a Store-backed client when a trusted loopback credential is available. */
 export declare function createLangGraphIdentityLinkStore(options?: {
     apiUrl?: string;
     apiKey?: string;
     ingressSecret?: string;
 }): LangGraphIdentityLinkStore | null;
-export declare function slackActorIdFromParts(teamId: string, userId: string): string;
+export declare function slackKeyFromParts(teamId: string, userId: string): string;
 export declare function buildIdentityLinkRecord(input: {
-    actorId: string;
+    userId: string;
     slackUserId: string;
     slackTeamId?: string;
     email?: string;

package/dist/identity/slack/links.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"links.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/links.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAWlD,eAAO,MAAM,wBAAwB,iCAAyC,CAAC;AAE/E,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAC5E,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAClE,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,sEAAsE;AACtE,qBAAa,yBAA0B,YAAW,iBAAiB;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;IAE3D,iBAAiB,CACrB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAEpC;IAEK,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAEtE;IAEK,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtD;IAEK,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOpD;CACF;AAED,6CAA6C;AAC7C,qBAAa,0BAA2B,YAAW,iBAAiB;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAEzC,iBAAiB,CACrB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAEpC;IAEK,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAEtE;IAEK,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BtD;IAEK,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAapD;YAEa,OAAO;CAUtB;AAID,uDAAuD;AACvD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAE1E;AAED,kFAAkF;AAClF,wBAAgB,oBAAoB,IAAI,iBAAiB,CAOxD;AAED,gFAAgF;AAChF,wBAAgB,gCAAgC,CAC9C,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACzE,0BAA0B,GAAG,IAAI,CAqBnC;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,kBAAkB,CAWrB"}
+{"version":3,"file":"links.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/links.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAkBlD,eAAO,MAAM,wBAAwB,iCAAyC,CAAC;AAE/E,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACpE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAChE,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,sEAAsE;AACtE,qBAAa,yBAA0B,YAAW,iBAAiB;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;IACjE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAE1D,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAExE;IAEK,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAEpE;IAEK,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtD;IAEK,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOlD;CACF;AAED,6CAA6C;AAC7C,qBAAa,0BAA2B,YAAW,iBAAiB;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAEzC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAExE;IAEK,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAEpE;IAEK,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BtD;IAEK,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAalD;YAEa,OAAO;CAUtB;AAID,uDAAuD;AACvD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAE1E;AAED,kFAAkF;AAClF,wBAAgB,oBAAoB,IAAI,iBAAiB,CAOxD;AAED,mFAAmF;AACnF,wBAAgB,gCAAgC,CAC9C,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACzE,0BAA0B,GAAG,IAAI,CA+BnC;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,kBAAkB,CAWrB"}

package/dist/identity/slack/links.js

@@ -3,41 +3,42 @@
  *
  * Stored in the LangGraph Store under `["mda_identity_links"]`, with an
  * in-memory backend for unit tests. Slack Events look up `slack:T:U` before
- * invoke; the web Connect-with-Slack flow upserts after OIDC.
+ * invoke when Connect OIDC is configured; the web Connect-with-Slack flow
+ * upserts after OIDC.
  */
 import { Client } from "@langchain/langgraph-sdk";
-import { ACTOR_HEADER, IDENTITY_LINKS_SERVICE_ACTOR, IDENTITY_LINKS_STORE_PREFIX, INGRESS_SECRET_ENV, INGRESS_SECRET_HEADER, } from "../../runtime/auth.js";
-import { resolveLoopbackApiUrl } from "../loopback.js";
+import { HANDOFF_SECRET_ENV, HANDOFF_SECRET_HEADER, USER_HEADER, IDENTITY_LINKS_SERVICE_USER, IDENTITY_LINKS_STORE_PREFIX, INGRESS_SECRET_ENV, INGRESS_SECRET_HEADER, LANGSMITH_API_KEY_ENV, } from "../../runtime/auth.js";
+import { isLoopbackUrl, resolveLoopbackApiKey, resolveLoopbackApiUrl, } from "../loopback.js";
 export const IDENTITY_LINKS_NAMESPACE = [IDENTITY_LINKS_STORE_PREFIX];
 /** In-memory store for tests (and as a process-local cache layer). */
 export class InMemoryIdentityLinkStore {
     bySlack = new Map();
-    byActor = new Map();
-    async getBySlackActorId(slackActorId) {
-        return this.bySlack.get(slackActorId) ?? null;
+    byUser = new Map();
+    async getBySlackKey(slackKey) {
+        return this.bySlack.get(slackKey) ?? null;
     }
-    async getByActorId(actorId) {
-        return this.byActor.get(actorId) ?? null;
+    async getByUserId(userId) {
+        return this.byUser.get(userId) ?? null;
     }
     async upsert(record) {
-        const previous = this.byActor.get(record.actorId);
-        if (previous && previous.slackActorId !== record.slackActorId) {
-            this.bySlack.delete(previous.slackActorId);
+        const previous = this.byUser.get(record.userId);
+        if (previous && previous.slackKey !== record.slackKey) {
+            this.bySlack.delete(previous.slackKey);
         }
-        const existingSlack = this.bySlack.get(record.slackActorId);
-        if (existingSlack && existingSlack.actorId !== record.actorId) {
-            this.byActor.delete(existingSlack.actorId);
+        const existingSlack = this.bySlack.get(record.slackKey);
+        if (existingSlack && existingSlack.userId !== record.userId) {
+            this.byUser.delete(existingSlack.userId);
         }
-        this.bySlack.set(record.slackActorId, record);
-        this.byActor.set(record.actorId, record);
+        this.bySlack.set(record.slackKey, record);
+        this.byUser.set(record.userId, record);
     }
-    async removeByActorId(actorId) {
-        const existing = this.byActor.get(actorId);
+    async removeByUserId(userId) {
+        const existing = this.byUser.get(userId);
         if (!existing) {
             return;
         }
-        this.byActor.delete(actorId);
-        this.bySlack.delete(existing.slackActorId);
+        this.byUser.delete(userId);
+        this.bySlack.delete(existing.slackKey);
     }
 }
 /** LangGraph Store–backed identity links. */
@@ -46,32 +47,32 @@ export class LangGraphIdentityLinkStore {
     constructor(client) {
         this.client = client;
     }
-    async getBySlackActorId(slackActorId) {
-        return this.getItem(slackKey(slackActorId));
+    async getBySlackKey(slackKey) {
+        return this.getItem(slackStoreKey(slackKey));
     }
-    async getByActorId(actorId) {
-        return this.getItem(actorKey(actorId));
+    async getByUserId(userId) {
+        return this.getItem(userStoreKey(userId));
     }
     async upsert(record) {
-        const previous = await this.getByActorId(record.actorId);
-        if (previous && previous.slackActorId !== record.slackActorId) {
-            await this.client.store.deleteItem([...IDENTITY_LINKS_NAMESPACE], slackKey(previous.slackActorId));
+        const previous = await this.getByUserId(record.userId);
+        if (previous && previous.slackKey !== record.slackKey) {
+            await this.client.store.deleteItem([...IDENTITY_LINKS_NAMESPACE], slackStoreKey(previous.slackKey));
         }
-        const existingSlack = await this.getBySlackActorId(record.slackActorId);
-        if (existingSlack && existingSlack.actorId !== record.actorId) {
-            await this.client.store.deleteItem([...IDENTITY_LINKS_NAMESPACE], actorKey(existingSlack.actorId));
+        const existingSlack = await this.getBySlackKey(record.slackKey);
+        if (existingSlack && existingSlack.userId !== record.userId) {
+            await this.client.store.deleteItem([...IDENTITY_LINKS_NAMESPACE], userStoreKey(existingSlack.userId));
         }
         const value = recordToValue(record);
-        await this.client.store.putItem([...IDENTITY_LINKS_NAMESPACE], slackKey(record.slackActorId), value);
-        await this.client.store.putItem([...IDENTITY_LINKS_NAMESPACE], actorKey(record.actorId), value);
+        await this.client.store.putItem([...IDENTITY_LINKS_NAMESPACE], slackStoreKey(record.slackKey), value);
+        await this.client.store.putItem([...IDENTITY_LINKS_NAMESPACE], userStoreKey(record.userId), value);
     }
-    async removeByActorId(actorId) {
-        const existing = await this.getByActorId(actorId);
+    async removeByUserId(userId) {
+        const existing = await this.getByUserId(userId);
         if (!existing) {
             return;
         }
-        await this.client.store.deleteItem([...IDENTITY_LINKS_NAMESPACE], actorKey(actorId));
-        await this.client.store.deleteItem([...IDENTITY_LINKS_NAMESPACE], slackKey(existing.slackActorId));
+        await this.client.store.deleteItem([...IDENTITY_LINKS_NAMESPACE], userStoreKey(userId));
+        await this.client.store.deleteItem([...IDENTITY_LINKS_NAMESPACE], slackStoreKey(existing.slackKey));
     }
     async getItem(key) {
         const item = await this.client.store.getItem([...IDENTITY_LINKS_NAMESPACE], key);
@@ -95,64 +96,77 @@ export function getIdentityLinkStore() {
         createLangGraphIdentityLinkStore() ?? new InMemoryIdentityLinkStore();
     return defaultStore;
 }
-/** Build a Store-backed client when loopback + ingress secret are available. */
+/** Build a Store-backed client when a trusted loopback credential is available. */
 export function createLangGraphIdentityLinkStore(options = {}) {
-    const ingressSecret = options.ingressSecret ?? process.env[INGRESS_SECRET_ENV];
-    if (!ingressSecret) {
+    const serverApiKey = process.env[LANGSMITH_API_KEY_ENV]?.trim();
+    const configuredHandoffSecret = process.env[HANDOFF_SECRET_ENV]?.trim();
+    const explicitIngressSecret = options.ingressSecret?.trim();
+    const configuredIngressSecret = explicitIngressSecret || process.env[INGRESS_SECRET_ENV]?.trim();
+    const apiUrl = resolveLoopbackApiUrl(options.apiUrl);
+    const apiKey = resolveLoopbackApiKey(options.apiKey);
+    const isLocal = isLoopbackUrl(apiUrl);
+    const handoffSecret = isLocal ? configuredHandoffSecret : undefined;
+    const ingressSecret = isLocal ? configuredIngressSecret : undefined;
+    const usesServerApiKey = Boolean(serverApiKey && apiKey === serverApiKey);
+    if (!usesServerApiKey && !handoffSecret && !ingressSecret) {
         return null;
     }
-    const apiUrl = resolveLoopbackApiUrl(options.apiUrl);
-    const apiKey = options.apiKey ??
-        process.env.LANGSMITH_API_KEY ??
-        process.env.LANGGRAPH_API_KEY ??
-        "local";
+    const defaultHeaders = {
+        [USER_HEADER]: IDENTITY_LINKS_SERVICE_USER,
+    };
+    if (!usesServerApiKey && explicitIngressSecret && ingressSecret) {
+        defaultHeaders[INGRESS_SECRET_HEADER] = ingressSecret;
+    }
+    else if (handoffSecret) {
+        defaultHeaders[HANDOFF_SECRET_HEADER] = handoffSecret;
+    }
+    else if (!usesServerApiKey && ingressSecret) {
+        defaultHeaders[INGRESS_SECRET_HEADER] = ingressSecret;
+    }
     const client = new Client({
         apiUrl,
         apiKey,
-        defaultHeaders: {
-            [INGRESS_SECRET_HEADER]: ingressSecret,
-            [ACTOR_HEADER]: IDENTITY_LINKS_SERVICE_ACTOR,
-        },
+        defaultHeaders,
     });
     return new LangGraphIdentityLinkStore(client);
 }
-export function slackActorIdFromParts(teamId, userId) {
+export function slackKeyFromParts(teamId, userId) {
     return `slack:${teamId}:${userId}`;
 }
 export function buildIdentityLinkRecord(input) {
     const team = input.slackTeamId?.trim() || "unknown";
     return {
-        actorId: input.actorId,
+        userId: input.userId,
         slackUserId: input.slackUserId,
         ...(input.slackTeamId ? { slackTeamId: input.slackTeamId } : {}),
-        slackActorId: slackActorIdFromParts(team, input.slackUserId),
+        slackKey: slackKeyFromParts(team, input.slackUserId),
         ...(input.email ? { email: input.email } : {}),
         linkedAt: new Date().toISOString(),
         source: "slack_oauth",
     };
 }
-function slackKey(slackActorId) {
-    return `slack:${slackActorId.replace(/^slack:/, "")}`;
+function slackStoreKey(slackKey) {
+    return `slack:${slackKey.replace(/^slack:/, "")}`;
 }
-function actorKey(actorId) {
-    return `actor:${actorId}`;
+function userStoreKey(userId) {
+    return `actor:${userId}`;
 }
 function recordToValue(record) {
     return { ...record };
 }
 function valueToRecord(value) {
-    const actorId = value.actorId;
+    const userId = value.userId;
     const slackUserId = value.slackUserId;
-    const slackActorId = value.slackActorId;
-    if (typeof actorId !== "string" ||
+    const slackKey = value.slackKey;
+    if (typeof userId !== "string" ||
         typeof slackUserId !== "string" ||
-        typeof slackActorId !== "string") {
+        typeof slackKey !== "string") {
         return null;
     }
     return {
-        actorId,
+        userId,
         slackUserId,
-        slackActorId,
+        slackKey,
         ...(typeof value.slackTeamId === "string"
             ? { slackTeamId: value.slackTeamId }
             : {}),

package/dist/identity/slack/links.js.map

@@ -1 +1 @@
-{"version":3,"file":"links.js","sourceRoot":"","sources":["../../../src/identity/slack/links.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAElD,OAAO,EACL,YAAY,EACZ,4BAA4B,EAC5B,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,2BAA2B,CAAU,CAAC;AAoB/E,sEAAsE;AACtE,MAAM,OAAO,yBAAyB;IACnB,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IAChD,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEjE,KAAK,CAAC,iBAAiB,CACrB,YAAoB;QAEpB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA0B;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5D,IAAI,aAAa,IAAI,aAAa,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;CACF;AAED,6CAA6C;AAC7C,MAAM,OAAO,0BAA0B;IACR,MAAM;IAAnC,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,KAAK,CAAC,iBAAiB,CACrB,YAAoB;QAEpB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA0B;QACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9D,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAChC,CAAC,GAAG,wBAAwB,CAAC,EAC7B,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAChC,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,aAAa,IAAI,aAAa,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9D,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAChC,CAAC,GAAG,wBAAwB,CAAC,EAC7B,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAChC,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAC7B,CAAC,GAAG,wBAAwB,CAAC,EAC7B,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,EAC7B,KAAK,CACN,CAAC;QACF,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAC7B,CAAC,GAAG,wBAAwB,CAAC,EAC7B,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EACxB,KAAK,CACN,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAChC,CAAC,GAAG,wBAAwB,CAAC,EAC7B,QAAQ,CAAC,OAAO,CAAC,CAClB,CAAC;QACF,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAChC,CAAC,GAAG,wBAAwB,CAAC,EAC7B,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAChC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,GAAW;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAC1C,CAAC,GAAG,wBAAwB,CAAC,EAC7B,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,aAAa,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC;IAC9D,CAAC;CACF;AAED,IAAI,YAAY,GAA6B,IAAI,CAAC;AAElD,uDAAuD;AACvD,MAAM,UAAU,oBAAoB,CAAC,KAA+B;IAClE,YAAY,GAAG,KAAK,CAAC;AACvB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,oBAAoB;IAClC,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,YAAY;QACV,gCAAgC,EAAE,IAAI,IAAI,yBAAyB,EAAE,CAAC;IACxE,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gCAAgC,CAC9C,OAAO,GAAiE,EAAE;IAE1E,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC3D,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,MAAM,GACV,OAAO,CAAC,MAAM;QACd,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,OAAO,CAAC;IACV,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,MAAM;QACN,MAAM;QACN,cAAc,EAAE;YACd,CAAC,qBAAqB,CAAC,EAAE,aAAa;YACtC,CAAC,YAAY,CAAC,EAAE,4BAA4B;SAC7C;KACF,CAAC,CAAC;IACH,OAAO,IAAI,0BAA0B,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,MAAc;IAClE,OAAO,SAAS,MAAM,IAAI,MAAM,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAKvC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACpD,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,YAAY,EAAE,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,MAAM,EAAE,aAAa;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,YAAoB;IACpC,OAAO,SAAS,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,SAAS,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,MAA0B;IAC/C,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CACpB,KAA8B;IAE9B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,WAAW,KAAK,QAAQ;QAC/B,OAAO,YAAY,KAAK,QAAQ,EAChC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,OAAO;QACP,WAAW;QACX,YAAY;QACZ,GAAG,CAAC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;YACvC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;YACpC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,QAAQ,EACN,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAChC,CAAC,CAAC,KAAK,CAAC,QAAQ;YAChB,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC9B,MAAM,EAAE,aAAa;KACtB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"links.js","sourceRoot":"","sources":["../../../src/identity/slack/links.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAElD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,WAAW,EACX,2BAA2B,EAC3B,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAExB,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,2BAA2B,CAAU,CAAC;AAoB/E,sEAAsE;AACtE,MAAM,OAAO,yBAAyB;IACnB,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IAChD,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEhE,KAAK,CAAC,aAAa,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA0B;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;CACF;AAED,6CAA6C;AAC7C,MAAM,OAAO,0BAA0B;IACR,MAAM;IAAnC,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,KAAK,CAAC,aAAa,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA0B;QACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAChC,CAAC,GAAG,wBAAwB,CAAC,EAC7B,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACjC,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChE,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC5D,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAChC,CAAC,GAAG,wBAAwB,CAAC,EAC7B,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,CACnC,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAC7B,CAAC,GAAG,wBAAwB,CAAC,EAC7B,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC9B,KAAK,CACN,CAAC;QACF,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAC7B,CAAC,GAAG,wBAAwB,CAAC,EAC7B,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAC3B,KAAK,CACN,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAChC,CAAC,GAAG,wBAAwB,CAAC,EAC7B,YAAY,CAAC,MAAM,CAAC,CACrB,CAAC;QACF,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAChC,CAAC,GAAG,wBAAwB,CAAC,EAC7B,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACjC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,GAAW;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAC1C,CAAC,GAAG,wBAAwB,CAAC,EAC7B,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,aAAa,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC;IAC9D,CAAC;CACF;AAED,IAAI,YAAY,GAA6B,IAAI,CAAC;AAElD,uDAAuD;AACvD,MAAM,UAAU,oBAAoB,CAAC,KAA+B;IAClE,YAAY,GAAG,KAAK,CAAC;AACvB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,oBAAoB;IAClC,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,YAAY;QACV,gCAAgC,EAAE,IAAI,IAAI,yBAAyB,EAAE,CAAC;IACxE,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,gCAAgC,CAC9C,OAAO,GAAiE,EAAE;IAE1E,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IAChE,MAAM,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC;IACxE,MAAM,qBAAqB,GAAG,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IAC5D,MAAM,uBAAuB,GAC3B,qBAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY,IAAI,MAAM,KAAK,YAAY,CAAC,CAAC;IAC1E,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,cAAc,GAA2B;QAC7C,CAAC,WAAW,CAAC,EAAE,2BAA2B;KAC3C,CAAC;IACF,IAAI,CAAC,gBAAgB,IAAI,qBAAqB,IAAI,aAAa,EAAE,CAAC;QAChE,cAAc,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACxD,CAAC;SAAM,IAAI,aAAa,EAAE,CAAC;QACzB,cAAc,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACxD,CAAC;SAAM,IAAI,CAAC,gBAAgB,IAAI,aAAa,EAAE,CAAC;QAC9C,cAAc,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,MAAM;QACN,MAAM;QACN,cAAc;KACf,CAAC,CAAC;IACH,OAAO,IAAI,0BAA0B,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IAC9D,OAAO,SAAS,MAAM,IAAI,MAAM,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAKvC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACpD,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,QAAQ,EAAE,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC;QACpD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,MAAM,EAAE,aAAa;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,SAAS,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,MAA0B;IAC/C,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CACpB,KAA8B;IAE9B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,WAAW,KAAK,QAAQ;QAC/B,OAAO,QAAQ,KAAK,QAAQ,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,MAAM;QACN,WAAW;QACX,QAAQ;QACR,GAAG,CAAC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;YACvC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;YACpC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,QAAQ,EACN,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAChC,CAAC,CAAC,KAAK,CAAC,QAAQ;YAChB,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC9B,MAAM,EAAE,aAAa;KACtB,CAAC;AACJ,CAAC"}

package/dist/identity/slack/oauth.d.ts

@@ -1,24 +1,14 @@
 /**
  * Slack OpenID Connect helpers for Connect-with-Slack account linking.
  */
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, resolveOauthRedirectBase, resolveSlackOauthRedirectBase, } from "../oauth-env.js";
 export declare const SLACK_CLIENT_ID_ENV = "SLACK_CLIENT_ID";
 export declare const SLACK_CLIENT_SECRET_ENV = "SLACK_CLIENT_SECRET";
 export declare const SLACK_TEAM_ID_ENV = "SLACK_TEAM_ID";
-export declare const MDA_PUBLIC_APP_URL_ENV = "MDA_PUBLIC_APP_URL";
-/**
- * Public Agent Server base URL used for Slack OAuth `redirect_uri`.
- * Required on LangGraph Host where the ASGI request origin is an internal
- * loopback (e.g. `http://localhost:5557`) rather than `*.langgraph.app`.
- */
-export declare const MDA_PUBLIC_API_URL_ENV = "MDA_PUBLIC_API_URL";
-/**
- * Signing key for OAuth `state` JWTs (Connect-with-Slack). Reuses the guest
- * token key so deployments do not need a third secret; never the Slack
- * client secret (that value is an OAuth credential, not a signing key).
- */
-export declare const OAUTH_STATE_SIGNING_KEY_ENV = "MDA_GUEST_SIGNING_KEY";
 /** Override Slack OIDC base (tests). */
 export declare const SLACK_OIDC_BASE_ENV = "SLACK_OIDC_BASE";
+/** Slack-bound OAuth state / connect-ticket helpers. */
+export declare const slackOauthTickets: import("../oauth-tickets.js").OauthTickets;
 export interface SlackOidcConfig {
     clientId: string;
     clientSecret: string;
@@ -33,28 +23,6 @@ export interface SlackOidcIdentity {
 }
 export declare function readSlackOidcConfig(env?: NodeJS.ProcessEnv): SlackOidcConfig | null;
 export declare function slackConnectUrl(publicAppUrl: string): string;
-/**
- * Public base URL for Slack OAuth `redirect_uri` (`…/identity/slack/callback`).
- *
- * Prefer an explicit public Agent Server URL over the ASGI request origin:
- * LangGraph Host rewrites requests to an internal loopback that Slack cannot
- * use as a redirect.
- */
-export declare function resolveSlackOauthRedirectBase(options: {
-    requestUrl: string;
-    headers?: Headers | {
-        get(name: string): string | null | undefined;
-    };
-    deploymentBaseUrl?: string;
-    env?: NodeJS.ProcessEnv;
-}): string;
-/** Server-side key for OAuth state JWTs; null when Connect cannot bind actors. */
-export declare function readOauthStateSigningKey(env?: NodeJS.ProcessEnv): string | null;
 export declare function buildSlackAuthorizeUrl(config: SlackOidcConfig, state: string, redirectUri: string): string;
-/** Signed state binding the authenticated actor to the OAuth round-trip. */
-export declare function createSlackOauthState(actorId: string, signingKey: string, nowMs?: number): Promise<string>;
-export declare function verifySlackOauthState(state: string, signingKey: string, nowMs?: number): Promise<{
-    actorId: string;
-}>;
 export declare function exchangeSlackOidcCode(config: SlackOidcConfig, code: string, redirectUri: string): Promise<SlackOidcIdentity>;
 //# sourceMappingURL=oauth.d.ts.map

package/dist/identity/slack/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/oauth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AACrD,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AACjD,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAC3D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAEnE,wCAAwC;AACxC,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAMrD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,eAAe,GAAG,IAAI,CAmBxB;AAED,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;KAAE,CAAC;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,CAcT;AAqCD,kFAAkF;AAClF,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAGf;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,MAAM,CAWR;AAED,4EAA4E;AAC5E,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAqB9B;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAsD5B"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/oauth.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AAEzB,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AACrD,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,wCAAwC;AACxC,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAIrD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,4CAA2B,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,eAAe,GAAG,IAAI,CAmBxB;AAED,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,MAAM,CAWR;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,CAAC,CA4D5B"}

package/dist/identity/slack/oauth.js

@@ -1,29 +1,18 @@
 /**
  * Slack OpenID Connect helpers for Connect-with-Slack account linking.
  */
-import { randomBytes } from "node:crypto";
-import { jwtVerify, SignJWT } from "jose";
+import { fetchWithTimeout, PROVIDER_HTTP_TIMEOUT_MS, } from "../../runtime/http.js";
+import { oauthTicketsFor } from "../oauth-tickets.js";
+import { MDA_PUBLIC_APP_URL_ENV } from "../oauth-env.js";
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, resolveOauthRedirectBase, resolveSlackOauthRedirectBase, } from "../oauth-env.js";
 export const SLACK_CLIENT_ID_ENV = "SLACK_CLIENT_ID";
 export const SLACK_CLIENT_SECRET_ENV = "SLACK_CLIENT_SECRET";
 export const SLACK_TEAM_ID_ENV = "SLACK_TEAM_ID";
-export const MDA_PUBLIC_APP_URL_ENV = "MDA_PUBLIC_APP_URL";
-/**
- * Public Agent Server base URL used for Slack OAuth `redirect_uri`.
- * Required on LangGraph Host where the ASGI request origin is an internal
- * loopback (e.g. `http://localhost:5557`) rather than `*.langgraph.app`.
- */
-export const MDA_PUBLIC_API_URL_ENV = "MDA_PUBLIC_API_URL";
-/**
- * Signing key for OAuth `state` JWTs (Connect-with-Slack). Reuses the guest
- * token key so deployments do not need a third secret; never the Slack
- * client secret (that value is an OAuth credential, not a signing key).
- */
-export const OAUTH_STATE_SIGNING_KEY_ENV = "MDA_GUEST_SIGNING_KEY";
 /** Override Slack OIDC base (tests). */
 export const SLACK_OIDC_BASE_ENV = "SLACK_OIDC_BASE";
 const DEFAULT_OIDC_BASE = "https://slack.com";
-const STATE_TTL_MS = 10 * 60 * 1000;
-const STATE_JWT_TYP = "mda-slack-oauth-state";
+/** Slack-bound OAuth state / connect-ticket helpers. */
+export const slackOauthTickets = oauthTicketsFor("slack");
 export function readSlackOidcConfig(env = process.env) {
     const clientId = env[SLACK_CLIENT_ID_ENV]?.trim();
     const clientSecret = env[SLACK_CLIENT_SECRET_ENV]?.trim();
@@ -44,60 +33,6 @@ export function readSlackOidcConfig(env = process.env) {
 export function slackConnectUrl(publicAppUrl) {
     return `${publicAppUrl.replace(/\/$/, "")}/settings`;
 }
-/**
- * Public base URL for Slack OAuth `redirect_uri` (`…/identity/slack/callback`).
- *
- * Prefer an explicit public Agent Server URL over the ASGI request origin:
- * LangGraph Host rewrites requests to an internal loopback that Slack cannot
- * use as a redirect.
- */
-export function resolveSlackOauthRedirectBase(options) {
-    const env = options.env ?? process.env;
-    if (options.deploymentBaseUrl?.trim()) {
-        return options.deploymentBaseUrl.trim().replace(/\/$/, "");
-    }
-    const fromEnv = env[MDA_PUBLIC_API_URL_ENV]?.trim().replace(/\/$/, "");
-    if (fromEnv && !isLoopbackUrl(fromEnv)) {
-        return fromEnv;
-    }
-    const forwarded = publicOriginFromForwardedHeaders(options.headers);
-    if (forwarded) {
-        return forwarded;
-    }
-    return new URL(options.requestUrl).origin;
-}
-function publicOriginFromForwardedHeaders(headers) {
-    if (!headers) {
-        return undefined;
-    }
-    const host = headers.get("x-forwarded-host")?.split(",")[0]?.trim();
-    if (!host || isLoopbackHost(host)) {
-        return undefined;
-    }
-    const proto = headers.get("x-forwarded-proto")?.split(",")[0]?.trim() ||
-        (host.includes("localhost") || host.startsWith("127.") ? "http" : "https");
-    return `${proto}://${host}`;
-}
-function isLoopbackUrl(value) {
-    try {
-        return isLoopbackHost(new URL(value).hostname);
-    }
-    catch {
-        return false;
-    }
-}
-function isLoopbackHost(host) {
-    const hostname = host
-        .replace(/^\[|\]$/g, "")
-        .split(":")[0]
-        ?.toLowerCase() ?? "";
-    return (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1");
-}
-/** Server-side key for OAuth state JWTs; null when Connect cannot bind actors. */
-export function readOauthStateSigningKey(env = process.env) {
-    const key = env[OAUTH_STATE_SIGNING_KEY_ENV]?.trim();
-    return key || null;
-}
 export function buildSlackAuthorizeUrl(config, state, redirectUri) {
     const url = new URL(`${config.oidcBase}/openid/connect/authorize`);
     url.searchParams.set("response_type", "code");
@@ -110,42 +45,6 @@ export function buildSlackAuthorizeUrl(config, state, redirectUri) {
     }
     return url.toString();
 }
-/** Signed state binding the authenticated actor to the OAuth round-trip. */
-export async function createSlackOauthState(actorId, signingKey, nowMs = Date.now()) {
-    const iat = Math.floor(nowMs / 1000);
-    const exp = Math.floor((nowMs + STATE_TTL_MS) / 1000);
-    return new SignJWT({
-        actorId,
-        nonce: randomBytes(16).toString("hex"),
-    })
-        .setProtectedHeader({ alg: "HS256", typ: STATE_JWT_TYP })
-        .setIssuedAt(iat)
-        .setExpirationTime(exp)
-        .sign(stateSigningKey(signingKey));
-}
-export async function verifySlackOauthState(state, signingKey, nowMs = Date.now()) {
-    try {
-        const { payload } = await jwtVerify(state, stateSigningKey(signingKey), {
-            algorithms: ["HS256"],
-            typ: STATE_JWT_TYP,
-            currentDate: new Date(nowMs),
-        });
-        if (typeof payload.actorId !== "string" || !payload.actorId) {
-            throw new Error("invalid OAuth state actor");
-        }
-        return { actorId: payload.actorId };
-    }
-    catch (err) {
-        if (err instanceof Error && err.message.startsWith("invalid OAuth state")) {
-            throw err;
-        }
-        const message = err instanceof Error ? err.message : String(err);
-        if (/exp|expir/i.test(message)) {
-            throw new Error("OAuth state expired");
-        }
-        throw new Error("invalid OAuth state signature");
-    }
-}
 export async function exchangeSlackOidcCode(config, code, redirectUri) {
     const tokenUrl = `${config.oidcBase}/api/openid.connect.token`;
     const body = new URLSearchParams({
@@ -155,19 +54,17 @@ export async function exchangeSlackOidcCode(config, code, redirectUri) {
         redirect_uri: redirectUri,
         grant_type: "authorization_code",
     });
-    const tokenResponse = await fetch(tokenUrl, {
+    const tokenResponse = await fetchWithTimeout(tokenUrl, {
         method: "POST",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
         body,
-    });
+    }, PROVIDER_HTTP_TIMEOUT_MS);
     const tokenJson = (await tokenResponse.json());
     if (!tokenResponse.ok || tokenJson.ok === false || !tokenJson.access_token) {
         throw new Error(tokenJson.error ?? "Slack OIDC token exchange failed");
     }
     const userInfoUrl = `${config.oidcBase}/api/openid.connect.userInfo`;
-    const userResponse = await fetch(userInfoUrl, {
-        headers: { Authorization: `Bearer ${tokenJson.access_token}` },
-    });
+    const userResponse = await fetchWithTimeout(userInfoUrl, { headers: { Authorization: `Bearer ${tokenJson.access_token}` } }, PROVIDER_HTTP_TIMEOUT_MS);
     const userJson = (await userResponse.json());
     if (!userResponse.ok || userJson.ok === false) {
         throw new Error(userJson.error ?? "Slack OIDC userInfo failed");
@@ -187,7 +84,4 @@ export async function exchangeSlackOidcCode(config, code, redirectUri) {
         ...(typeof userJson.email === "string" ? { email: userJson.email } : {}),
     };
 }
-function stateSigningKey(signingKey) {
-    return new TextEncoder().encode(signingKey);
-}
 //# sourceMappingURL=oauth.js.map