managed-deepagents 0.4.2 → 0.4.3-dev.95

package/dist/identity/slack/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/identity/slack/oauth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE1C,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AACrD,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AACjD,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAC3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAC;AAEnE,wCAAwC;AACxC,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAErD,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAC9C,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAgB9C,MAAM,UAAU,mBAAmB,CACjC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,YAAY,GAAG,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,MAAM,YAAY,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,QAAQ;QACR,YAAY;QACZ,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE;YAChC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,iBAAiB,CAAE,CAAC,IAAI,EAAE,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7C,QAAQ,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,iBAAiB,CAAC,CAAC,OAAO,CACvE,KAAK,EACL,EAAE,CACH;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,YAAoB;IAClD,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAK7C;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,IAAI,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,CAAC;QACtC,OAAO,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvE,IAAI,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,SAAS,GAAG,gCAAgC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;AAC5C,CAAC;AAED,SAAS,gCAAgC,CACvC,OAAoE;IAEpE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GACT,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACvD,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7E,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,QAAQ,GACZ,IAAI;SACD,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACd,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC1B,OAAO,CACL,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,CAC3E,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,wBAAwB,CACtC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC;IACrD,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAuB,EACvB,KAAa,EACb,WAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,2BAA2B,CAAC,CAAC;IACnE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAe,EACf,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;IACtD,OAAO,IAAI,OAAO,CAAC;QACjB,OAAO;QACP,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACvC,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;SACxD,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,GAAG,CAAC;SACtB,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAa,EACb,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE;YACtE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,aAAa;YAClB,WAAW,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC1E,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAuB,EACvB,IAAY,EACZ,WAAmB;IAEnB,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,QAAQ,2BAA2B,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,IAAI;QACJ,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,oBAAoB;KACjC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QAC1C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI;KACL,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAK5C,CAAC;IACF,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,SAAS,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI,kCAAkC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,MAAM,CAAC,QAAQ,8BAA8B,CAAC;IACrE,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;QAC5C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE,EAAE;KAC/D,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAO1C,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,4BAA4B,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GACV,QAAQ,CAAC,2BAA2B,CAAC;QACrC,CAAC,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ;YAC/B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE;YAC/B,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO;QACL,MAAM;QACN,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC;YACvC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,2BAA2B,CAAC,EAAE;YACnD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/identity/slack/oauth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AAEzB,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AACrD,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD,wCAAwC;AACxC,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAErD,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAE9C,wDAAwD;AACxD,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;AAgB1D,MAAM,UAAU,mBAAmB,CACjC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,YAAY,GAAG,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,MAAM,YAAY,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,QAAQ;QACR,YAAY;QACZ,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE;YAChC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,iBAAiB,CAAE,CAAC,IAAI,EAAE,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7C,QAAQ,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,iBAAiB,CAAC,CAAC,OAAO,CACvE,KAAK,EACL,EAAE,CACH;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,YAAoB;IAClD,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAuB,EACvB,KAAa,EACb,WAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,2BAA2B,CAAC,CAAC;IACnE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAuB,EACvB,IAAY,EACZ,WAAmB;IAEnB,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,QAAQ,2BAA2B,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,IAAI;QACJ,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,oBAAoB;KACjC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAC1C,QAAQ,EACR;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI;KACL,EACD,wBAAwB,CACzB,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAK5C,CAAC;IACF,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,SAAS,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI,kCAAkC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,MAAM,CAAC,QAAQ,8BAA8B,CAAC;IACrE,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,WAAW,EACX,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,EAClE,wBAAwB,CACzB,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAO1C,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,4BAA4B,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GACV,QAAQ,CAAC,2BAA2B,CAAC;QACrC,CAAC,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ;YAC/B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE;YAC/B,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO;QACL,MAAM;QACN,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC;YACvC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,2BAA2B,CAAC,EAAE;YACnD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC"}

package/dist/identity/supabase.js

@@ -55,7 +55,7 @@ function normalizeSupabaseRegions(regions) {
         const url = entry.url ??
             (entry.projectRef ? `${supabaseBase(entry.projectRef)}/user` : undefined);
         if (!url) {
-            throw new Error(`providers.supabase(...) region "${region}" needs a \`projectRef\` or \`url\`.`);
+            throw new Error(`auth.supabase(...) region "${region}" needs a \`projectRef\` or \`url\`.`);
         }
         const headers = entry.headers ?? (entry.anonKey ? { apikey: entry.anonKey } : undefined);
         out[region] = headers ? { url, headers } : { url };
@@ -71,7 +71,7 @@ function normalizeSupabaseRegions(regions) {
 export function supabaseProvider(options) {
     const { projectRef, url, introspect, regions, regionHeader = "x-supabase-region", } = options;
     if (projectRef && url) {
-        throw new Error("providers.supabase(...) accepts only one of `projectRef` or `url`.");
+        throw new Error("auth.supabase(...) accepts only one of `projectRef` or `url`.");
     }
     if (introspect) {
         if (regions) {
@@ -82,7 +82,7 @@ export function supabaseProvider(options) {
                     regions: normalizeSupabaseRegions(regions),
                     headers: { apikey: "${SUPABASE_ANON_KEY}" },
                 },
-                claims: { actor: "email" },
+                claims: { user: "email" },
             };
             const issuers = supabaseRegionIssuers(regions);
             if (issuers.length > 0) {
@@ -99,11 +99,11 @@ export function supabaseProvider(options) {
                     url: `${authBase}/user`,
                     headers: { apikey: "${SUPABASE_ANON_KEY}" },
                 },
-                claims: { actor: "email" },
+                claims: { user: "email" },
             };
         }
         if (!projectRef) {
-            throw new Error("providers.supabase(...) requires `projectRef`, `url`, or `regions` when introspect is true.");
+            throw new Error("auth.supabase(...) requires `projectRef`, `url`, or `regions` when introspect is true.");
         }
         const base = supabaseBase(projectRef);
         return {
@@ -113,7 +113,7 @@ export function supabaseProvider(options) {
                 url: `${base}/user`,
                 headers: { apikey: "${SUPABASE_ANON_KEY}" },
             },
-            claims: { actor: "email" },
+            claims: { user: "email" },
         };
     }
     if (url) {
@@ -121,11 +121,11 @@ export function supabaseProvider(options) {
             id: "supabase",
             discoveryUrl: supabaseAuthV1Base(url),
             algorithms: ["ES256", "RS256"],
-            claims: { actor: "email" },
+            claims: { user: "email" },
         };
     }
     if (!projectRef) {
-        throw new Error("providers.supabase(...) without `introspect` requires `projectRef` or `url`.");
+        throw new Error("auth.supabase(...) without `introspect` requires `projectRef` or `url`.");
     }
     const base = supabaseBase(projectRef);
     return {
@@ -133,7 +133,7 @@ export function supabaseProvider(options) {
         issuer: base,
         jwks: `${base}/.well-known/jwks.json`,
         algorithms: ["ES256", "RS256"],
-        claims: { actor: "email" },
+        claims: { user: "email" },
     };
 }
 //# sourceMappingURL=supabase.js.map

package/dist/identity/supabase.js.map

@@ -1 +1 @@
-{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../../src/identity/supabase.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAuCH,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO,WAAW,UAAU,sBAAsB,CAAC;AACrD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,OAAO,UAAU,CAAC;AAC9B,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAuC;IAEvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,IAAI,MAA0B,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC;aAAM,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACrB,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,OAAuC;IAEvC,MAAM,GAAG,GAGL,EAAE,CAAC;IACP,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GACP,KAAK,CAAC,GAAG;YACT,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,sCAAsC,CAChF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAgC;IAEhC,MAAM,EACJ,UAAU,EACV,GAAG,EACH,UAAU,EACV,OAAO,EACP,YAAY,GAAG,mBAAmB,GACnC,GAAG,OAAO,CAAC;IAEZ,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,QAAQ,GAA2B;gBACvC,EAAE,EAAE,UAAU;gBACd,UAAU,EAAE;oBACV,YAAY;oBACZ,OAAO,EAAE,wBAAwB,CAAC,OAAO,CAAC;oBAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;iBAC5C;gBACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;aAC3B,CAAC;YACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;YAC7B,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO;gBACL,EAAE,EAAE,UAAU;gBACd,YAAY,EAAE,QAAQ;gBACtB,UAAU,EAAE;oBACV,GAAG,EAAE,GAAG,QAAQ,OAAO;oBACvB,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;iBAC5C;gBACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;aAC3B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,UAAU;YACd,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE;gBACV,GAAG,EAAE,GAAG,IAAI,OAAO;gBACnB,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;aAC5C;YACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3B,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,EAAE,CAAC;QACR,OAAO;YACL,EAAE,EAAE,UAAU;YACd,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC;YACrC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO;QACL,EAAE,EAAE,UAAU;QACd,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,GAAG,IAAI,wBAAwB;QACrC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QAC9B,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;KAC3B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../../src/identity/supabase.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAuCH,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO,WAAW,UAAU,sBAAsB,CAAC;AACrD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,OAAO,UAAU,CAAC;AAC9B,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAuC;IAEvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,IAAI,MAA0B,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC;aAAM,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACrB,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,OAAuC;IAEvC,MAAM,GAAG,GAGL,EAAE,CAAC;IACP,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GACP,KAAK,CAAC,GAAG;YACT,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,8BAA8B,MAAM,sCAAsC,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAgC;IAEhC,MAAM,EACJ,UAAU,EACV,GAAG,EACH,UAAU,EACV,OAAO,EACP,YAAY,GAAG,mBAAmB,GACnC,GAAG,OAAO,CAAC;IAEZ,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,QAAQ,GAA2B;gBACvC,EAAE,EAAE,UAAU;gBACd,UAAU,EAAE;oBACV,YAAY;oBACZ,OAAO,EAAE,wBAAwB,CAAC,OAAO,CAAC;oBAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;iBAC5C;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;aAC1B,CAAC;YACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;YAC7B,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO;gBACL,EAAE,EAAE,UAAU;gBACd,YAAY,EAAE,QAAQ;gBACtB,UAAU,EAAE;oBACV,GAAG,EAAE,GAAG,QAAQ,OAAO;oBACvB,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;iBAC5C;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;aAC1B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,UAAU;YACd,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE;gBACV,GAAG,EAAE,GAAG,IAAI,OAAO;gBACnB,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;aAC5C;YACD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,EAAE,CAAC;QACR,OAAO;YACL,EAAE,EAAE,UAAU;YACd,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC;YACrC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO;QACL,EAAE,EAAE,UAAU;QACd,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,GAAG,IAAI,wBAAwB;QACrC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;KAC1B,CAAC;AACJ,CAAC"}

package/dist/identity/types.d.ts

@@ -7,7 +7,11 @@
 import type { IdentityConnectProvider } from "./connect-provider-types.js";
 export type { IdentityConnectProvider } from "./connect-provider-types.js";
 /** How MDA learns who is calling on the HTTP ingress path. */
-export type HttpIngress = "trusted_backend" | ValidatedTokenIngress;
+export type HttpIngress = "backend" | LangSmithApiKeyIngress | ValidatedTokenIngress;
+/** LangSmith workspace API-key ingress, verified by managed auth. */
+export interface LangSmithApiKeyIngress {
+    mode: "langsmith_api_key";
+}
 /**
  * Browser-direct ingress: MDA verifies the caller's own IdP token server-side
  * and derives identity from its claims.
@@ -77,29 +81,29 @@ export interface ValidatedTokenProvider {
         /** Custom header name when `tokenIn` is "header". */
         header?: string;
     };
-    /** MDA issues + verifies short-lived signed tokens for anonymous/guest users. */
-    guest?: {
-        /** Enable an issue/reissue path for this provider. */
-        issue: boolean;
-        /** Token lifetime, e.g. "24h". */
-        ttl?: string;
-        /** Prefix applied to the generated actor id, e.g. "guest:". */
-        actorPrefix?: string;
-    };
     /** Maps verified token claims → identity envelope fields. */
-    claims: {
-        /** Claim used as `runtime.identity.actor.id` (e.g. "sub", "email"). */
-        actor: string;
-        /** Claim used as `runtime.identity.tenant.id` (e.g. "org_id"). */
-        tenant?: string;
-        /** Claim used as `runtime.identity.actor.email`. */
-        email?: string;
-    };
+    claims: ClaimMapping;
+}
+/**
+ * Which verified token claim supplies each identity envelope field.
+ *
+ * `user` is required; `defineIdentity` rejects a provider that omits it.
+ */
+export interface ClaimMapping {
+    /** Claim used as `runtime.identity.user.id` (e.g. "sub", "email"). */
+    user?: string;
+    /**
+     * Claim carrying every group the caller belongs to. Accepts a JSON array, or a
+     * comma/space-delimited string. Read by tools for authorization.
+     */
+    groups?: string;
+    /** Claim used as `runtime.identity.user.email`. */
+    email?: string;
 }
 /** Which downstream call needs a credential right now. */
 export interface CredentialTarget {
     /** What is being called. */
-    kind: "subagent" | "mcp" | "connection" | "langsmith";
+    kind: "subagent" | "mcp" | "connection";
     /** The configured name, e.g. "code-reviewer" | "docs" | "github". */
     name: string;
     /** Optional read/write hint so the resolver can mint different tokens. */
@@ -113,19 +117,22 @@ export interface CredentialTarget {
 export interface ResolvedCredential {
     /** Headers MDA attaches to the downstream call (usually Authorization). */
     headers: Record<string, string>;
-    /** ISO expiry; MDA caches per (actor, tenant, target) until then. */
+    /** ISO expiry; MDA caches per (user, target) until then. */
     expiresAt?: string;
 }
 /** The frozen identity envelope tools and middleware see. */
 export interface RuntimeIdentity {
-    actor: {
-        type: "user" | "service";
+    /** The caller. `kind: "service"` for machine callers (schedules, channels, Studio). */
+    user: {
+        kind: "person" | "service";
         id: string;
         email?: string;
     };
-    tenant?: {
-        id: string;
-    };
+    /**
+     * Every group the caller's token asserts. For authorization decisions in tools
+     * and middleware.
+     */
+    groups?: readonly string[];
     source: {
         /**
          * Ingress source. Built-ins include `http`, `schedule`, `cli`, `studio`,
@@ -142,46 +149,78 @@ export type CredentialResolver = (args: {
     target: CredentialTarget;
 }) => Promise<ResolvedCredential>;
 /**
- * Provide this (with `scoping.credentials: "custom"`) to mint your own
- * downstream credentials per actor: an in-process callback or a hosted
- * token-exchange endpoint.
+ * Connect-with-X routes a credential resolver depends on.
+ *
+ * A resolver that reads per-user OAuth tokens needs somewhere for the user to
+ * grant them. Declaring the provider here lets `defineIdentity` mount the routes
+ * from the resolver, instead of asking authors to repeat themselves on
+ * `connect`.
+ */
+export interface CredentialConnectRequirements {
+    connect?: IdentityConnectProvider[];
+}
+/**
+ * Provide this to mint your own downstream credentials per caller: an in-process
+ * callback or a hosted token-exchange endpoint. Providing it puts the
+ * credentials axis in custom mode.
  */
-export type CredentialResolverConfig = {
+export type CredentialResolverConfig = ({
     resolve: CredentialResolver;
-} | {
+} & CredentialConnectRequirements) | ({
     endpoint: {
         url: string;
     };
-};
-/** The tenant boundary. */
-export type Tenancy = "single" | "multi";
-/** Who can open/resume the conversation. */
-export type ThreadScope = "actor" | "channel" | "tenant";
-/** The durable Store namespace prefix. */
-export type MemoryScope = "actor" | "tenant" | "agent" | "none";
-/** Whose token downstream calls carry. */
-export type CredentialScope = "agent" | "actor" | "none" | "custom";
-/** The whole identity config surface. */
+} & CredentialConnectRequirements);
+/**
+ * One resolver per downstream platform, keyed by {@link CredentialTarget.name}.
+ *
+ * Use this instead of a single resolver when an agent integrates more than one
+ * platform. MDA dispatches on the target name, so each entry stays a focused
+ * config (and keeps declaring its own Connect-with-X routes) rather than being
+ * folded into a hand-written switch.
+ */
+export type CredentialResolvers = Record<string, CredentialResolverConfig>;
+/**
+ * Whose token downstream calls carry.
+ *
+ * - `"user"` — per-caller Connect / actor-subject vault (toolserver
+ *   `?agent_id=` derived from the caller).
+ * - `"agent"` — shared LangSmith / deployment vault (`MDA_TOOLSERVER_AGENT_ID`
+ *   or the key's user subject).
+ * - `"custom"` — author-supplied resolver/endpoint (`CredentialsProvider`).
+ * - `"none"` — no managed credential owner.
+ */
+export type CredentialScope = "user" | "agent" | "none" | "custom";
+/**
+ * The resolved identity contract the runtime reads.
+ *
+ * `defineIdentity` derives this from {@link IdentityOptions}; it is not an
+ * authoring surface. Scope remains explicit here so runtime policy is inspectable
+ * without exposing it as a declaration knob.
+ */
 export interface IdentityConfig {
     /** How MDA learns who is calling. */
     ingress: {
         http: HttpIngress;
     };
-    /** The tenant boundary. */
-    tenancy: Tenancy;
-    /** The three scoping axes. */
-    scoping: {
-        /** Who can open/resume the conversation. */
-        threads?: ThreadScope;
-        /** Durable Store namespace prefix. */
-        memory: MemoryScope;
-        /** Managed mode, or "custom" when a resolver/endpoint is provided below. */
+    /**
+     * Isolation axes. Threads are always user-owned, and durable memory is not an
+     * identity axis — it is declared in `memory.ts` (see `MemoryConfig`).
+     */
+    scope: {
+        /**
+         * Whose downstream tokens / Connect ownership apply. `"custom"` when a
+         * resolver/endpoint is provided below.
+         */
         credentials?: CredentialScope;
     };
-    /** Present when `scoping.credentials` is "custom" (or a resolver is set). */
-    credentials?: CredentialResolverConfig;
     /**
-     * Opt-in Connect-with-X providers (`github.connect()`, `slack.connect()`, …).
+     * Present when `scope.credentials` is "custom" (or a resolver is set).
+     * Either one resolver for every target, or one per target name.
+     */
+    credentials?: CredentialResolverConfig | CredentialResolvers;
+    /**
+     * Opt-in Connect-with-X providers (`connect.github()`, `connect.slack()`, …).
      * Only listed providers mount `/identity/{id}/…` routes.
      */
     connect?: IdentityConnectProvider[];
@@ -191,6 +230,4 @@ export interface IdentityDefinition {
     readonly kind: "identity";
     readonly config: IdentityConfig;
 }
-/** The archetype presets that expand to a full {@link IdentityConfig}. */
-export type IdentityPresetName = "private-assistant" | "multi-tenant-saas" | "shared-bot" | "internal-tool" | "service";
 //# sourceMappingURL=types.d.ts.map

package/dist/identity/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,YAAY,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GAAG,iBAAiB,GAAG,qBAAqB,CAAC;AAEpE;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,iFAAiF;IACjF,KAAK,CAAC,EAAE;QACN,sDAAsD;QACtD,KAAK,EAAE,OAAO,CAAC;QACf,kCAAkC;QAClC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,+DAA+D;QAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE;QACN,uEAAuE;QACvE,KAAK,EAAE,MAAM,CAAC;QACd,kEAAkE;QAClE,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,oDAAoD;QACpD,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B;IAC5B,IAAI,EAAE,UAAU,GAAG,KAAK,GAAG,YAAY,GAAG,WAAW,CAAC;IACtD,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,MAAM,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,MAAM,EAAE;QACN;;;WAGG;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,uCAAuC;AACvC,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE;IACtC,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAElC;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAC/B;IAAE,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAElC,2BAA2B;AAC3B,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEzC,4CAA4C;AAC5C,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;AACzD,0CAA0C;AAC1C,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAChE,0CAA0C;AAC1C,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEpE,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF,2BAA2B;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,OAAO,EAAE;QACP,4CAA4C;QAC5C,OAAO,CAAC,EAAE,WAAW,CAAC;QACtB,sCAAsC;QACtC,MAAM,EAAE,WAAW,CAAC;QACpB,4EAA4E;QAC5E,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;IACF,6EAA6E;IAC7E,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC;;;OAGG;IACH,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAED,0EAA0E;AAC1E,MAAM,MAAM,kBAAkB,GAC1B,mBAAmB,GACnB,mBAAmB,GACnB,YAAY,GACZ,eAAe,GACf,SAAS,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,YAAY,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GACnB,SAAS,GACT,sBAAsB,GACtB,qBAAqB,CAAC;AAE1B,qEAAqE;AACrE,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,mBAAmB,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B;IAC5B,IAAI,EAAE,UAAU,GAAG,KAAK,GAAG,YAAY,CAAC;IACxC,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,IAAI,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN;;;WAGG;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,uCAAuC;AACvC,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE;IACtC,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC,CAAC;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAAG,6BAA6B,CAAC,GACjE,CAAC;IAAE,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,6BAA6B,CAAC,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AAE3E;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF;;;OAGG;IACH,KAAK,EAAE;QACL;;;WAGG;QACH,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;IACF;;;OAGG;IACH,WAAW,CAAC,EAAE,wBAAwB,GAAG,mBAAmB,CAAC;IAC7D;;;OAGG;IACH,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC"}

package/dist/identity/x/connect-http.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Connect-with-X — thin adapter over {@link defineFleetVaultConnect}.
+ *
+ * Mounted under `/identity/x/*` when listed on `identity.connect`, or inferred
+ * from `connectors.x` on a user-scoped deployment. OAuth uses Fleet
+ * auth-sessions against the reserved `twitter-oauth-provider` slug (PKCE is
+ * handled by Host); there is no local BYO client path.
+ */
+import type { FleetVaultConnectProviderOptions } from "../fleet-connect.js";
+export declare const X_CONNECT_STATUS_PATH: string;
+export declare const X_CONNECT_START_PATH: string;
+export declare const X_CONNECT_CALLBACK_PATH: string;
+export declare const X_CONNECT_LINK_PATH: string;
+export declare const isXActorSubjectEnabled: () => boolean;
+export declare const enableXActorSubject: () => void;
+/**
+ * Enable actor-subject mode when X connectors imply per-user vault subjects.
+ *
+ * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
+ */
+export declare const enableXActorSubjectFromConnectors: (connectorKinds: readonly (string | undefined)[] | undefined, scope?: import("../connect-provider-types.js").IdentityConnectMountContext["scope"]) => void;
+export declare const resetXActorSubjectEnabledForTests: () => void;
+export declare const isXConnectConfigured: (env?: NodeJS.ProcessEnv) => boolean;
+export declare const xConnectUrl: (publicAppUrl: string) => string;
+/** Options for {@link createXIdentityConnectProvider}. */
+export type XIdentityConnectProviderOptions = Pick<FleetVaultConnectProviderOptions, "providerSlug" | "scopes" | "fleet">;
+/** Build an X connect provider (Fleet auth-sessions / twitter-oauth-provider). */
+export declare const createXIdentityConnectProvider: (options?: Pick<FleetVaultConnectProviderOptions, "providerSlug" | "scopes" | "fleet">) => import("../connect-provider-types.js").IdentityConnectProvider;
+/** Default X connect provider used as a built-in mount candidate. */
+export declare const xIdentityConnectProvider: import("../connect-provider-types.js").IdentityConnectProvider;
+/**
+ * Opt into Connect-with-X on `defineIdentity({ connect: […] })`.
+ *
+ * Usually unnecessary: declaring `connectors.x` on a user-scoped identity
+ * deployment mounts this provider and derives OAuth scopes automatically.
+ */
+export declare const connect: (options?: Pick<FleetVaultConnectProviderOptions, "providerSlug" | "scopes" | "fleet">) => import("../connect-provider-types.js").IdentityConnectProvider;
+//# sourceMappingURL=connect-http.d.ts.map

package/dist/identity/x/connect-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/x/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AAO5E,eAAO,MAAM,qBAAqB,QAAiB,CAAC;AACpD,eAAO,MAAM,oBAAoB,QAAkB,CAAC;AACpD,eAAO,MAAM,uBAAuB,QAAmB,CAAC;AACxD,eAAO,MAAM,mBAAmB,QAAe,CAAC;AAEhD,eAAO,MAAM,sBAAsB,eAA0B,CAAC;AAC9D,eAAO,MAAM,mBAAmB,YAAuB,CAAC;AACxD;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,4JACV,CAAC;AACrC,eAAO,MAAM,iCAAiC,YACV,CAAC;AACrC,eAAO,MAAM,oBAAoB,sCAAwB,CAAC;AAC1D,eAAO,MAAM,WAAW,kCAAe,CAAC;AAExC,0DAA0D;AAC1D,MAAM,MAAM,+BAA+B,GAAG,IAAI,CAChD,gCAAgC,EAChC,cAAc,GAAG,QAAQ,GAAG,OAAO,CACpC,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,8BAA8B,2JAAmB,CAAC;AAE/D,qEAAqE;AACrE,eAAO,MAAM,wBAAwB,gEAAa,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,OAAO,2JAAY,CAAC"}

package/dist/identity/x/connect-http.js

@@ -0,0 +1,41 @@
+/**
+ * Connect-with-X — thin adapter over {@link defineFleetVaultConnect}.
+ *
+ * Mounted under `/identity/x/*` when listed on `identity.connect`, or inferred
+ * from `connectors.x` on a user-scoped deployment. OAuth uses Fleet
+ * auth-sessions against the reserved `twitter-oauth-provider` slug (PKCE is
+ * handled by Host); there is no local BYO client path.
+ */
+import { X_INTEGRATION, readXProviderSlug, } from "../../connectors/toolserver/integrations.js";
+import { defineFleetVaultConnect } from "../define-fleet-connect.js";
+const x = defineFleetVaultConnect({
+    integration: X_INTEGRATION,
+    resolveProviderSlug: readXProviderSlug,
+});
+export const X_CONNECT_STATUS_PATH = x.paths.status;
+export const X_CONNECT_START_PATH = x.paths.connect;
+export const X_CONNECT_CALLBACK_PATH = x.paths.callback;
+export const X_CONNECT_LINK_PATH = x.paths.link;
+export const isXActorSubjectEnabled = x.isActorSubjectEnabled;
+export const enableXActorSubject = x.enableActorSubject;
+/**
+ * Enable actor-subject mode when X connectors imply per-user vault subjects.
+ *
+ * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
+ */
+export const enableXActorSubjectFromConnectors = x.enableActorSubjectFromConnectors;
+export const resetXActorSubjectEnabledForTests = x.resetActorSubjectEnabledForTests;
+export const isXConnectConfigured = x.isConnectConfigured;
+export const xConnectUrl = x.connectUrl;
+/** Build an X connect provider (Fleet auth-sessions / twitter-oauth-provider). */
+export const createXIdentityConnectProvider = x.createProvider;
+/** Default X connect provider used as a built-in mount candidate. */
+export const xIdentityConnectProvider = x.provider;
+/**
+ * Opt into Connect-with-X on `defineIdentity({ connect: […] })`.
+ *
+ * Usually unnecessary: declaring `connectors.x` on a user-scoped identity
+ * deployment mounts this provider and derives OAuth scopes automatically.
+ */
+export const connect = x.connect;
+//# sourceMappingURL=connect-http.js.map

package/dist/identity/x/connect-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/x/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,aAAa,EACb,iBAAiB,GAClB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAGrE,MAAM,CAAC,GAAG,uBAAuB,CAAC;IAChC,WAAW,EAAE,aAAa;IAC1B,mBAAmB,EAAE,iBAAiB;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;AACpD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;AACxD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;AAEhD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,qBAAqB,CAAC;AAC9D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,kBAAkB,CAAC;AACxD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAC5C,CAAC,CAAC,gCAAgC,CAAC;AACrC,MAAM,CAAC,MAAM,iCAAiC,GAC5C,CAAC,CAAC,gCAAgC,CAAC;AACrC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,mBAAmB,CAAC;AAC1D,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,UAAU,CAAC;AAQxC,kFAAkF;AAClF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,cAAc,CAAC;AAE/D,qEAAqE;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,QAAQ,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC"}

package/dist/identity/x/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * X identity helpers — Connect-with-X (Fleet vault / twitter-oauth-provider).
+ */
+export { connect, createXIdentityConnectProvider, enableXActorSubject, enableXActorSubjectFromConnectors, xConnectUrl, xIdentityConnectProvider, isXActorSubjectEnabled, isXConnectConfigured, resetXActorSubjectEnabledForTests, X_CONNECT_CALLBACK_PATH, X_CONNECT_LINK_PATH, X_CONNECT_START_PATH, X_CONNECT_STATUS_PATH, } from "./connect-http.js";
+export type { XIdentityConnectProviderOptions } from "./connect-http.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/x/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/x/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,8BAA8B,EAC9B,mBAAmB,EACnB,iCAAiC,EACjC,WAAW,EACX,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,iCAAiC,EACjC,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/identity/x/index.js

@@ -0,0 +1,5 @@
+/**
+ * X identity helpers — Connect-with-X (Fleet vault / twitter-oauth-provider).
+ */
+export { connect, createXIdentityConnectProvider, enableXActorSubject, enableXActorSubjectFromConnectors, xConnectUrl, xIdentityConnectProvider, isXActorSubjectEnabled, isXConnectConfigured, resetXActorSubjectEnabledForTests, X_CONNECT_CALLBACK_PATH, X_CONNECT_LINK_PATH, X_CONNECT_START_PATH, X_CONNECT_STATUS_PATH, } from "./connect-http.js";
+//# sourceMappingURL=index.js.map

package/dist/identity/x/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/x/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,8BAA8B,EAC9B,mBAAmB,EACnB,iCAAiC,EACjC,WAAW,EACX,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,iCAAiC,EACjC,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC"}

package/dist/index.d.ts

@@ -1,26 +1,15 @@
 export { defineDeepAgent } from "./define-deep-agent.js";
-export { defineMcpServers } from "./connectors/mcp/index.js";
-export * as github from "./connectors/github/index.js";
-export * as slack from "./identity/slack/index.js";
-export * as langsmith from "./connectors/langsmith/index.js";
-export type { GitHubCheckoutReuse, GitHubConnector, GitHubConnectorConfig, GitHubRepositoryCheckout, } from "./connectors/github/index.js";
-export type { LangSmithCapability, LangSmithCallerSurface, LangSmithCapabilityScope, LangSmithConnector, LangSmithConnectorConfig, LangSmithResource, LangSmithResponseShape, } from "./connectors/langsmith/index.js";
 export { defineSchedule } from "./schedules.js";
+export { defineIdentity } from "./identity/index.js";
+export { defineMemory } from "./memory/index.js";
+export { auth, channels, credentials } from "./namespaces.js";
 export { defineSandbox } from "./sandbox.js";
-export { defineIdentity, providers, validateIdentity, } from "./identity/index.js";
-export { defineSlackChannel } from "./channels/slack/index.js";
-export { defineGitHubChannel } from "./channels/github/index.js";
-export { CHANNEL_ERROR_CODES, ChannelError, createRuntimeChannel, normalizeChannelDestination, } from "./channels/index.js";
-export { decodeSlackSourceThreadKey, encodeSlackSourceThreadKey, normalizeSlackEvent, requiredSlackScopes, toChannelManifest, verifySlackRequest, } from "./channels/slack/index.js";
-export { toGitHubChannelManifest, verifyGitHubWebhookSignature, normalizeGitHubEvent, } from "./channels/github/index.js";
-export type { CredentialResolver, CredentialResolverConfig, CredentialScope, CredentialTarget, DefineIdentity, GitHubActorTokenArgs, GitHubAppJwtArgs, GitHubCredentialsOptions, GitHubTokenSource, HttpIngress, IdentityConfig, IdentityConnectProvider, IdentityDefinition, IdentityPresetName, MemoryScope, ResolvedCredential, RuntimeIdentity, Tenancy, ThreadScope, ValidatedTokenIngress, ValidatedTokenProvider, } from "./identity/index.js";
-export type { HttpMcpServerConfig, McpServersConfig, McpServersDefinition, McpToolSelectionConfig, RemoteMcpServerBaseConfig, RemoteMcpServerConfig, SseMcpServerConfig, } from "./connectors/mcp/index.js";
-export { CONNECTOR_BRAND, isConnector } from "./runtime/connector.js";
-export type { Connector, ConnectorSandboxBackend, ConnectorToolList, HttpContext, SandboxContext, ToolContext, } from "./runtime/connector.js";
-export type { ScheduleConfig, ScheduleDefinition, ScheduleDeliveryTarget, ScheduleThreadConfig, } from "./schedules.js";
-export type { ChannelAddress, ChannelCapabilities, ChannelDestination, ChannelErrorCode, ChannelEvent, ChannelMessage, ChannelMessageUpdate, PostedChannelMessage, RuntimeChannel, } from "./channels/index.js";
-export type { ChannelManifest, SlackChannelConfig, SlackChannelDefinition, SlackChannelTrigger, } from "./channels/slack/index.js";
+export type { Channels } from "./namespaces.js";
 export type { DeepAgentDefinition, DefineDeepAgentConfig, ManagedDeepAgentKey, } from "./types.js";
+export type { ScheduleConfig, ScheduleDefinition, ScheduleDeliveryTarget, ScheduleThreadConfig, } from "./schedules.js";
+export type { ClaimMapping, CredentialConnectRequirements, CredentialResolver, CredentialResolverConfig, CredentialResolvers, CredentialScope, CredentialTarget, GitHubAppJwtArgs, GitHubCredentialsOptions, GitHubTokenSource, GitHubUserTokenArgs, HttpIngress, IdentityAuth, IdentityConfig, IdentityDefinition, IdentityOptions, LangSmithApiKeyIngress, ResolvedCredential, RuntimeIdentity, ValidatedTokenIngress, ValidatedTokenProvider, } from "./identity/index.js";
+export type { MemoryConfig, MemoryDefinition, MemoryOptions, MemoryScope, MemoryScopeInput, MemorySliceInput, MemorySliceKind, ResolvedMemorySlice, } from "./memory/index.js";
+export type { ChannelManifest, RequiredSlackChannelConfig, SlackChannel, SlackChannelConfig, SlackChannelFilters, SlackChannelTrigger, SlackConversationPolicy, SlackMentionBehavior, } from "./channels/slack/index.js";
+export type { SandboxDefinition, SandboxOptions, SandboxScope, } from "./sandbox.js";
 export type { ManagedDeepAgentRuntime, ManagedRuntimeExtras, } from "./runtime/managed-tools.js";
-export type { DefineSandboxOptions, ManagedSandboxOptionKey, SandboxDefinition, SandboxProviderClass, SandboxProviderOptions, SandboxScope, } from "./sandbox.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,8BAA8B,CAAC;AACvD,OAAO,KAAK,KAAK,MAAM,2BAA2B,CAAC;AACnD,OAAO,KAAK,SAAS,MAAM,iCAAiC,CAAC;AAC7D,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,SAAS,EACT,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,OAAO,EACP,WAAW,EACX,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACtE,YAAY,EACV,SAAS,EACT,uBAAuB,EACvB,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,WAAW,GACZ,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,GACb,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,YAAY,EACZ,6BAA6B,EAC7B,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,eAAe,EACf,0BAA0B,EAC1B,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,YAAY,GACb,MAAM,cAAc,CAAC;AAEtB,YAAY,EACV,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -1,15 +1,7 @@
 export { defineDeepAgent } from "./define-deep-agent.js";
-export { defineMcpServers } from "./connectors/mcp/index.js";
-export * as github from "./connectors/github/index.js";
-export * as slack from "./identity/slack/index.js";
-export * as langsmith from "./connectors/langsmith/index.js";
 export { defineSchedule } from "./schedules.js";
+export { defineIdentity } from "./identity/index.js";
+export { defineMemory } from "./memory/index.js";
+export { auth, channels, credentials } from "./namespaces.js";
 export { defineSandbox } from "./sandbox.js";
-export { defineIdentity, providers, validateIdentity, } from "./identity/index.js";
-export { defineSlackChannel } from "./channels/slack/index.js";
-export { defineGitHubChannel } from "./channels/github/index.js";
-export { CHANNEL_ERROR_CODES, ChannelError, createRuntimeChannel, normalizeChannelDestination, } from "./channels/index.js";
-export { decodeSlackSourceThreadKey, encodeSlackSourceThreadKey, normalizeSlackEvent, requiredSlackScopes, toChannelManifest, verifySlackRequest, } from "./channels/slack/index.js";
-export { toGitHubChannelManifest, verifyGitHubWebhookSignature, normalizeGitHubEvent, } from "./channels/github/index.js";
-export { CONNECTOR_BRAND, isConnector } from "./runtime/connector.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,8BAA8B,CAAC;AACvD,OAAO,KAAK,KAAK,MAAM,2BAA2B,CAAC;AACnD,OAAO,KAAK,SAAS,MAAM,iCAAiC,CAAC;AAgB7D,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,SAAS,EACT,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAoCpC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}

package/dist/ingress/index.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Managed ingress pipeline: verified inbound event → agent run.
+ *
+ * Providers keep signature verification, event normalization, and reply
+ * transport. This module owns the shared pieces: deterministic thread ids,
+ * trusted loopback invoke with source-provider stamps, and source-thread
+ * existence probes.
+ */
+import { type ChannelBinding } from "../channels/binding.js";
+/** Inputs for the source-thread involvement probe (after identity remap). */
+export interface SourceThreadExistsInput {
+    sourceThreadKey: string;
+    userId: string;
+}
+export interface InvokeIngressAgentInput {
+    userId: string;
+    sourceThreadKey: string;
+    binding: ChannelBinding;
+    text: string;
+    assistantId: string;
+    /** Trusted source provider stamped on loopback invoke. */
+    sourceProvider?: ChannelBinding["provider"];
+}
+export interface InvokeIngressAgentResult {
+    replyText: string;
+    runId?: string;
+    threadId: string;
+}
+/**
+ * Schedule background work after the provider ACK. Defaults to fire-and-forget
+ * with error logging; tests pass an inline runner.
+ */
+export declare function scheduleIngressWork(work: () => Promise<void>, options: {
+    label: string;
+    schedule?: (work: () => Promise<void>) => void;
+}): void;
+/**
+ * True when an MDA thread already exists for this source-thread key.
+ *
+ * Call with the **resolved** actor (post identity remap) so ownership matches
+ * the thread created on the first run.
+ */
+export declare function ingressSourceThreadExists(input: SourceThreadExistsInput): Promise<boolean>;
+/**
+ * Invoke the managed graph over a trusted loopback with ingress identity stamped.
+ *
+ * Only this path may set `x-mda-source-provider` / `x-mda-source-thread-id`.
+ */
+export declare function invokeIngressAgent(input: InvokeIngressAgentInput): Promise<InvokeIngressAgentResult>;
+/** Deterministic LangGraph thread id from a provider source-thread key. */
+export declare function stableThreadId(sourceThreadKey: string): string;
+//# sourceMappingURL=index.d.ts.map

package/dist/ingress/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ingress/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAkBhC,6EAA6E;AAC7E,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,cAAc,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EACzB,OAAO,EAAE;IACP,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;CAChD,GACA,IAAI,CASN;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAelB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CA6CnC;AA4CD,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAS9D"}