managed-deepagents 0.5.0-dev.78 → 0.5.0-dev.80

package/dist/identity/loopback.d.ts

@@ -1,8 +1,33 @@
 /**
  * Resolve the local Agent Server URL for trusted loopback clients.
  *
- * Prefers `explicit`, then `MDA_CHANNEL_API_URL` / `LANGGRAPH_API_URL` /
- * `LANGSMITH_ENDPOINT`, else `http://127.0.0.1:{PORT|8000}`.
+ * Prefers `explicit`, then `MDA_CHANNEL_API_URL` / `LANGGRAPH_API_URL`, else
+ * `http://127.0.0.1:{PORT|8000}`. `LANGSMITH_ENDPOINT` is deliberately not
+ * consulted: it is the tracing/API endpoint (LangSmith SaaS by default), not
+ * this server's origin.
  */
 export declare function resolveLoopbackApiUrl(explicit?: string): string;
+/**
+ * API key for trusted loopback LangGraph SDK clients.
+ *
+ * Prefers `explicit`, then `LANGSMITH_API_KEY`, else `"local"` (in-process /
+ * unit-test clients that do not authenticate against Host).
+ */
+export declare function resolveLoopbackApiKey(explicit?: string): string;
+/**
+ * Whether `value` addresses this host.
+ *
+ * Server-local trust (the ingress secret, which lets its holder assert any
+ * actor id) must never travel to an off-host origin, so callers gate it on
+ * this predicate.
+ *
+ * @param value - Absolute URL, or a host with an optional port.
+ */
+export declare function isLoopbackUrl(value: string): boolean;
+/**
+ * Whether a `Host`-style value (optional port, optional brackets) is loopback.
+ *
+ * @param host - Host value such as `localhost:8000`, `127.0.0.1`, or `[::1]:80`.
+ */
+export declare function isLoopbackHost(host: string): boolean;
 //# sourceMappingURL=loopback.d.ts.map

package/dist/identity/loopback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loopback.d.ts","sourceRoot":"","sources":["../../src/identity/loopback.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAW/D"}
+{"version":3,"file":"loopback.d.ts","sourceRoot":"","sources":["../../src/identity/loopback.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAW/D;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAG/D;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOpD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAepD"}

package/dist/identity/loopback.js

@@ -1,18 +1,71 @@
 /**
  * Resolve the local Agent Server URL for trusted loopback clients.
  *
- * Prefers `explicit`, then `MDA_CHANNEL_API_URL` / `LANGGRAPH_API_URL` /
- * `LANGSMITH_ENDPOINT`, else `http://127.0.0.1:{PORT|8000}`.
+ * Prefers `explicit`, then `MDA_CHANNEL_API_URL` / `LANGGRAPH_API_URL`, else
+ * `http://127.0.0.1:{PORT|8000}`. `LANGSMITH_ENDPOINT` is deliberately not
+ * consulted: it is the tracing/API endpoint (LangSmith SaaS by default), not
+ * this server's origin.
  */
 export function resolveLoopbackApiUrl(explicit) {
-    const fromEnv = explicit ??
-        process.env.MDA_CHANNEL_API_URL ??
-        process.env.LANGGRAPH_API_URL ??
-        process.env.LANGSMITH_ENDPOINT;
-    if (fromEnv && fromEnv.trim().length > 0) {
-        return fromEnv.replace(/\/$/, "");
+    const fromEnv = [
+        explicit,
+        process.env.MDA_CHANNEL_API_URL,
+        process.env.LANGGRAPH_API_URL,
+    ].find((value) => value && value.trim().length > 0);
+    if (fromEnv) {
+        return fromEnv.trim().replace(/\/$/, "");
     }
     const port = process.env.PORT ?? "8000";
     return `http://127.0.0.1:${port}`;
 }
+/**
+ * API key for trusted loopback LangGraph SDK clients.
+ *
+ * Prefers `explicit`, then `LANGSMITH_API_KEY`, else `"local"` (in-process /
+ * unit-test clients that do not authenticate against Host).
+ */
+export function resolveLoopbackApiKey(explicit) {
+    const key = (explicit ?? process.env.LANGSMITH_API_KEY)?.trim();
+    return key && key.length > 0 ? key : "local";
+}
+/**
+ * Whether `value` addresses this host.
+ *
+ * Server-local trust (the ingress secret, which lets its holder assert any
+ * actor id) must never travel to an off-host origin, so callers gate it on
+ * this predicate.
+ *
+ * @param value - Absolute URL, or a host with an optional port.
+ */
+export function isLoopbackUrl(value) {
+    try {
+        const url = new URL(value.includes("://") ? value : `http://${value}`);
+        return isLoopbackHost(url.hostname);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether a `Host`-style value (optional port, optional brackets) is loopback.
+ *
+ * @param host - Host value such as `localhost:8000`, `127.0.0.1`, or `[::1]:80`.
+ */
+export function isLoopbackHost(host) {
+    let hostname = host.trim().toLowerCase();
+    const bracketed = /^\[(?<inner>[^\]]+)\](?::\d+)?$/.exec(hostname);
+    if (bracketed?.groups) {
+        hostname = bracketed.groups.inner;
+    }
+    else if ((hostname.match(/:/g) ?? []).length === 1) {
+        hostname = hostname.split(":")[0];
+    }
+    if (hostname === "localhost") {
+        return true;
+    }
+    if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(hostname)) {
+        return hostname.split(".").every((part) => Number(part) <= 255);
+    }
+    return hostname === "::1" || hostname === "0:0:0:0:0:0:0:1";
+}
 //# sourceMappingURL=loopback.js.map

package/dist/identity/loopback.js.map

@@ -1 +1 @@
-{"version":3,"file":"loopback.js","sourceRoot":"","sources":["../../src/identity/loopback.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAiB;IACrD,MAAM,OAAO,GACX,QAAQ;QACR,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IACjC,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC;IACxC,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC"}
+{"version":3,"file":"loopback.js","sourceRoot":"","sources":["../../src/identity/loopback.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAiB;IACrD,MAAM,OAAO,GAAG;QACd,QAAQ;QACR,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,OAAO,CAAC,GAAG,CAAC,iBAAiB;KAC9B,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC;IACxC,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAiB;IACrD,MAAM,GAAG,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC;IAChE,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QACvE,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC;QACtB,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,KAAM,CAAC;IACrC,CAAC;SAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACrC,CAAC;IACD,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtD,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,iBAAiB,CAAC;AAC9D,CAAC"}

package/dist/identity/options.d.ts

@@ -0,0 +1,90 @@
+/**
+ * The `defineIdentity(...)` input, and its normalization into the resolved
+ * {@link IdentityConfig}.
+ *
+ * Authors describe *what they want* — how callers authenticate, and what the
+ * isolation boundary is — in two keys. Everything else the runtime needs is
+ * derived here, so the resolved contract stays free to grow axes without the
+ * authoring surface growing a knob per axis.
+ *
+ * See `docs/design/identity-model-review.md` for the rationale.
+ */
+import type { IdentityConnectProvider } from "./connect-provider-types.js";
+import type { CredentialResolverConfig, CredentialResolvers, CredentialScope, IdentityConfig, MemoryScope, OrganizationRequirement, ThreadScope, ValidatedTokenProvider } from "./types.js";
+/**
+ * How MDA learns who is calling.
+ *
+ * - `"backend"` — a backend you operate has already authenticated the caller and
+ *   asserts the user id over the reserved ingress headers.
+ * - one or more `providers.*` entries — MDA verifies the caller's own token
+ *   server-side (browser-direct).
+ */
+export type IdentityAuth = "backend" | ValidatedTokenProvider | ValidatedTokenProvider[];
+/**
+ * The isolation boundary for the deployment — the one decision most projects
+ * make about identity.
+ *
+ * - `"user"` (default) — every caller gets private threads, private memory, and
+ *   acts as themselves downstream.
+ * - `"organization"` — callers belong to customer organizations; memory is
+ *   shared within an organization and callers must present one.
+ * - `"agent"` — no per-caller isolation; one shared memory slice, the agent acts
+ *   as itself. Machine-to-machine deployments.
+ * - `"none"` — no durable memory and no downstream credentials.
+ */
+export type IdentityScope = "user" | "organization" | "agent" | "none";
+/**
+ * Per-axis overrides for authors whose deployment does not fit a single
+ * {@link IdentityScope}. Anything left unset follows `default`.
+ */
+export interface IdentityScopeOverrides {
+    /** Base scope the unset axes follow. Defaults to `"user"`. */
+    default?: IdentityScope;
+    /** Who can open or resume a conversation. */
+    threads?: ThreadScope;
+    /** Which memory slice a run may use. */
+    memory?: MemoryScope;
+    /** Whose credentials downstream calls carry. `"custom"` is implied by `credentials`. */
+    credentials?: CredentialScope;
+}
+/** The identity declaration. Every key is optional. */
+export interface IdentityOptions {
+    /** How callers authenticate. Defaults to `"backend"`. */
+    auth?: IdentityAuth;
+    /** The isolation boundary, or per-axis overrides. Defaults to `"user"`. */
+    scope?: IdentityScope | IdentityScopeOverrides;
+    /** Whether callers must present an organization. Inferred from `scope`. */
+    organizations?: OrganizationRequirement;
+    /**
+     * Mint your own downstream credentials per caller. Providing this puts the
+     * credentials axis in custom mode — there is no separate flag to set.
+     *
+     * Pass one resolver, or a map keyed by target name when the agent integrates
+     * several platforms:
+     *
+     * ```ts
+     * credentials: {
+     *   github: credentials.github({ read: ["user", "pat"] }),
+     *   jira: { resolve: mintJiraToken },
+     * }
+     * ```
+     */
+    credentials?: CredentialResolverConfig | CredentialResolvers;
+    /**
+     * Extra Connect-with-X providers to mount under `/identity/{id}/…`.
+     *
+     * Providers the deployment already implies are added automatically (a
+     * `credentials.github(...)` chain that reads user tokens brings
+     * Connect-with-GitHub with it), so this is only needed for custom providers.
+     */
+    connect?: IdentityConnectProvider[];
+}
+/**
+ * Derive the resolved {@link IdentityConfig} from the declared options.
+ *
+ * Pure and total: every reachable option combination produces a config that
+ * `validateIdentity` accepts, so the errors that exist only to police two
+ * fields agreeing with each other are unreachable from this path.
+ */
+export declare function normalizeIdentity(options?: IdentityOptions): IdentityConfig;
+//# sourceMappingURL=options.d.ts.map

package/dist/identity/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,OAAO,KAAK,EACV,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,WAAW,EACX,uBAAuB,EACvB,WAAW,EACX,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,sBAAsB,GACtB,sBAAsB,EAAE,CAAC;AAE7B;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,cAAc,GAAG,OAAO,GAAG,MAAM,CAAC;AAEvE;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,8DAA8D;IAC9D,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,wCAAwC;IACxC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,wFAAwF;IACxF,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED,uDAAuD;AACvD,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,aAAa,GAAG,sBAAsB,CAAC;IAC/C,2EAA2E;IAC3E,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,wBAAwB,GAAG,mBAAmB,CAAC;IAC7D;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAgCD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,GAAE,eAAoB,GAC5B,cAAc,CAsBhB"}

package/dist/identity/options.js

@@ -0,0 +1,171 @@
+/**
+ * The `defineIdentity(...)` input, and its normalization into the resolved
+ * {@link IdentityConfig}.
+ *
+ * Authors describe *what they want* — how callers authenticate, and what the
+ * isolation boundary is — in two keys. Everything else the runtime needs is
+ * derived here, so the resolved contract stays free to grow axes without the
+ * authoring surface growing a knob per axis.
+ *
+ * See `docs/design/identity-model-review.md` for the rationale.
+ */
+import { credentialConnectProviders } from "./credential-resolvers.js";
+/** Axis defaults per {@link IdentityScope}. */
+const SCOPE_AXES = {
+    user: { threads: "user", memory: "user", credentials: "user" },
+    organization: {
+        threads: "user",
+        memory: "organization",
+        credentials: "agent",
+    },
+    agent: { threads: "user", memory: "agent", credentials: "agent" },
+    none: { threads: "user", memory: "none", credentials: "none" },
+};
+const THREAD_SCOPES = [
+    "user",
+    "conversation",
+    "organization",
+];
+const MEMORY_SCOPES = [
+    "user",
+    "organization",
+    "agent",
+    "none",
+];
+const CREDENTIAL_SCOPES = [
+    "user",
+    "agent",
+    "none",
+    "custom",
+];
+/**
+ * Derive the resolved {@link IdentityConfig} from the declared options.
+ *
+ * Pure and total: every reachable option combination produces a config that
+ * `validateIdentity` accepts, so the errors that exist only to police two
+ * fields agreeing with each other are unreachable from this path.
+ */
+export function normalizeIdentity(options = {}) {
+    assertOptionKeys(options);
+    const scope = resolveScope(options);
+    const organizations = options.organizations ?? inferOrganizationRequirement(scope);
+    assertOrganizationRequirement(options.organizations, scope, organizations);
+    const config = {
+        ingress: { http: resolveIngress(options.auth) },
+        organizations,
+        scope,
+    };
+    if (options.credentials !== undefined) {
+        config.credentials = options.credentials;
+    }
+    const connect = resolveConnect(options);
+    if (connect.length > 0) {
+        config.connect = connect;
+    }
+    return config;
+}
+function resolveIngress(auth) {
+    if (auth === undefined || auth === "backend") {
+        return "backend";
+    }
+    if (typeof auth === "string") {
+        throw new Error(`defineIdentity(...) unknown \`auth\` value "${auth}". Use "backend" or one or more providers.* entries.`);
+    }
+    const providers = Array.isArray(auth) ? auth : [auth];
+    return { mode: "validated_token", providers };
+}
+function resolveScope(options) {
+    const scope = options.scope ?? "user";
+    const overrides = typeof scope === "string" ? { default: scope } : scope;
+    const base = SCOPE_AXES[overrides.default ?? "user"];
+    if (base === undefined) {
+        throw new Error(`defineIdentity(...) unknown \`scope\` "${String(overrides.default)}". ` +
+            `Valid scopes: ${Object.keys(SCOPE_AXES).join(", ")}.`);
+    }
+    const threads = assertAxis("threads", overrides.threads, THREAD_SCOPES) ?? base.threads;
+    const memory = assertAxis("memory", overrides.memory, MEMORY_SCOPES) ?? base.memory;
+    // A resolver is the declaration of custom mode; the axis follows from it.
+    const credentials = options.credentials !== undefined
+        ? requireCustomCompatible(overrides.credentials)
+        : (assertAxis("credentials", overrides.credentials, CREDENTIAL_SCOPES) ??
+            base.credentials);
+    return { threads, memory, credentials };
+}
+function assertAxis(axis, value, allowed) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!allowed.includes(value)) {
+        throw new Error(`defineIdentity(...) unknown \`scope.${axis}\` value "${String(value)}". ` +
+            `Valid values: ${allowed.join(", ")}.`);
+    }
+    return value;
+}
+/**
+ * A resolver plus an explicitly managed credentials owner is a genuine conflict
+ * of intent (unlike a redundant `"custom"` sentinel), so it fails.
+ */
+function requireCustomCompatible(declared) {
+    if (declared !== undefined && declared !== "custom") {
+        throw new Error(`defineIdentity(...) provides a \`credentials\` resolver but \`scope.credentials\` is "${declared}". ` +
+            "Drop `scope.credentials` (the resolver implies custom mode) or remove the resolver.");
+    }
+    return "custom";
+}
+/** Organization-scoped axes are what make an organization mandatory. */
+function inferOrganizationRequirement(scope) {
+    const axes = [scope.threads, scope.memory, scope.credentials];
+    return axes.includes("organization") ? "required" : "optional";
+}
+function assertOrganizationRequirement(declared, scope, resolved) {
+    if (declared !== undefined &&
+        declared !== "optional" &&
+        declared !== "required") {
+        throw new Error(`defineIdentity(...) \`organizations\` must be "optional" or "required" (received "${String(declared)}").`);
+    }
+    if (resolved === "optional" &&
+        inferOrganizationRequirement(scope) === "required") {
+        throw new Error('defineIdentity(...) organization-scoped isolation requires `organizations: "required"`.');
+    }
+}
+/**
+ * Connect providers the deployment declared, plus the ones its credential
+ * resolvers depend on. A resolver that reads per-user OAuth tokens needs a place
+ * for the user to grant them, so the routes follow from the resolver rather than
+ * from a second opt-in that has to agree with it.
+ *
+ * For a per-target map this unions across every entry, so a multi-platform
+ * deployment gets each platform's routes without repeating any of them.
+ */
+function resolveConnect(options) {
+    const declared = options.connect ?? [];
+    const required = credentialConnectProviders(options.credentials);
+    const out = [...declared];
+    for (const provider of required) {
+        if (!out.some((existing) => existing.id === provider.id)) {
+            out.push(provider);
+        }
+    }
+    return out;
+}
+const KNOWN_OPTION_KEYS = new Set([
+    "auth",
+    "scope",
+    "organizations",
+    "credentials",
+    "connect",
+]);
+/**
+ * Reject unknown keys so a typo fails loudly instead of being silently ignored.
+ */
+function assertOptionKeys(options) {
+    if (options === null || typeof options !== "object") {
+        throw new Error("defineIdentity(...) accepts an options object ({ auth, scope, … }) or no arguments.");
+    }
+    const unknown = Object.keys(options).filter((key) => !KNOWN_OPTION_KEYS.has(key));
+    if (unknown.length > 0) {
+        throw new Error(`defineIdentity(...) unknown option(s): ${unknown.join(", ")}. ` +
+            `Valid options: ${[...KNOWN_OPTION_KEYS].join(", ")}.`);
+    }
+}
+//# sourceMappingURL=options.js.map

package/dist/identity/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAuFvE,+CAA+C;AAC/C,MAAM,UAAU,GAAmD;IACjE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE;IAC9D,YAAY,EAAE;QACZ,OAAO,EAAE,MAAM;QACf,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,OAAO;KACrB;IACD,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;IACjE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE;CAC/D,CAAC;AAEF,MAAM,aAAa,GAA2B;IAC5C,MAAM;IACN,cAAc;IACd,cAAc;CACf,CAAC;AACF,MAAM,aAAa,GAA2B;IAC5C,MAAM;IACN,cAAc;IACd,OAAO;IACP,MAAM;CACP,CAAC;AACF,MAAM,iBAAiB,GAA+B;IACpD,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;CACT,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAO,GAAoB,EAAE;IAE7B,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE1B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa,IAAI,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC/D,6BAA6B,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAmB;QAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QAC/C,aAAa;QACb,KAAK;KACN,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAC3C,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CACrB,IAA8B;IAE9B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,sDAAsD,CAC1G,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,OAAwB;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC;IACtC,MAAM,SAAS,GACb,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK;YACtE,iBAAiB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC;IAC1E,MAAM,MAAM,GACV,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;IACvE,0EAA0E;IAC1E,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,KAAK,SAAS;QAC/B,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,WAAW,CAAC;QAChD,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,WAAW,EAAE,iBAAiB,CAAC;YACpE,IAAI,CAAC,WAAW,CAAC,CAAC;IAExB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,UAAU,CACjB,IAAY,EACZ,KAAwB,EACxB,OAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,aAAa,MAAM,CAAC,KAAK,CAAC,KAAK;YACxE,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAC9B,QAAqC;IAErC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,yFAAyF,QAAQ,KAAK;YACpG,qFAAqF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wEAAwE;AACxE,SAAS,4BAA4B,CACnC,KAA8B;IAE9B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;AACjE,CAAC;AAED,SAAS,6BAA6B,CACpC,QAA6C,EAC7C,KAA8B,EAC9B,QAAiC;IAEjC,IACE,QAAQ,KAAK,SAAS;QACtB,QAAQ,KAAK,UAAU;QACvB,QAAQ,KAAK,UAAU,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qFAAqF,MAAM,CAAC,QAAQ,CAAC,KAAK,CAC3G,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,KAAK,UAAU;QACvB,4BAA4B,CAAC,KAAK,CAAC,KAAK,UAAU,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,OAAwB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC1B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM;IACN,OAAO;IACP,eAAe;IACf,aAAa;IACb,SAAS;CACV,CAAC,CAAC;AAEH;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAwB;IAChD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CACzC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CACrC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC9D,kBAAkB,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/identity/slack/connect-http.d.ts

@@ -22,10 +22,10 @@ export declare const slackIdentityConnectProvider: IdentityConnectProvider;
  *
  * @example
  * ```ts
- * import { defineIdentity, slack } from "managed-deepagents";
+ * import { connect, defineIdentity } from "managed-deepagents";
  *
- * export const identity = defineIdentity.preset("internal-tool", {
- *   connect: [slack.connect()],
+ * export const identity = defineIdentity({
+ *   connect: [connect.slack()],
  * });
  * ```
  */

package/dist/identity/slack/connect-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAKV,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAC;AAgBpB,eAAO,MAAM,yBAAyB,QAAe,CAAC;AACtD,eAAO,MAAM,wBAAwB,QAAgB,CAAC;AACtD,eAAO,MAAM,2BAA2B,QAAiB,CAAC;AAC1D,eAAO,MAAM,uBAAuB,QAAa,CAAC;AAElD,8DAA8D;AAC9D,MAAM,WAAW,mCAAmC;IAClD,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAED,mEAAmE;AACnE,wBAAgB,kCAAkC,CAChD,OAAO,GAAE,mCAAwC,GAChD,uBAAuB,CAoFzB;AAED,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,EAAE,uBACL,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,mCAAmC,GAC5C,uBAAuB,CAIzB"}
+{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAKV,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAC;AAoBpB,eAAO,MAAM,yBAAyB,QAAe,CAAC;AACtD,eAAO,MAAM,wBAAwB,QAAgB,CAAC;AACtD,eAAO,MAAM,2BAA2B,QAAiB,CAAC;AAC1D,eAAO,MAAM,uBAAuB,QAAa,CAAC;AAElD,8DAA8D;AAC9D,MAAM,WAAW,mCAAmC;IAClD,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAED,mEAAmE;AACnE,wBAAgB,kCAAkC,CAChD,OAAO,GAAE,mCAAwC,GAChD,uBAAuB,CA6FzB;AAED,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,EAAE,uBACL,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,mCAAmC,GAC5C,uBAAuB,CAIzB"}

package/dist/identity/slack/connect-http.js

@@ -6,6 +6,7 @@
 import { buildIdentityLinkRecord, getIdentityLinkStore, } from "./links.js";
 import { buildSlackAuthorizeUrl, createSlackOauthState, exchangeSlackOidcCode, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, readSlackOidcConfig, resolveSlackOauthRedirectBase, verifySlackOauthState, } from "./oauth.js";
 import { identityConnectPaths } from "../connect-paths.js";
+import { hasChannelForProvider, isUserScopedDeployment, } from "../connect-inference.js";
 const PATHS = identityConnectPaths("slack");
 export const SLACK_CONNECT_STATUS_PATH = PATHS.status;
 export const SLACK_CONNECT_START_PATH = PATHS.connect;
@@ -17,23 +18,30 @@ export function createSlackIdentityConnectProvider(options = {}) {
     return {
         id: "slack",
         shouldMount(ctx) {
-            // Opt-in is via `identity.connect`; this is a secondary gate only.
-            return ctx.hasIdentity;
+            if (!ctx.hasIdentity) {
+                return false;
+            }
+            // Listed on `identity.connect` — the author already opted in. Otherwise
+            // mount only when a Slack channel routes into a per-user deployment,
+            // which is exactly when there is a Slack account worth linking.
+            return (ctx.declared !== false ||
+                (hasChannelForProvider(ctx.channels, "slack") &&
+                    isUserScopedDeployment(ctx.scope)));
         },
-        async status(actorId) {
-            const link = await store().getByActorId(actorId);
+        async status(userId) {
+            const link = await store().getByUserId(userId);
             return {
                 linked: Boolean(link),
                 ...(link
                     ? {
                         slackUserId: link.slackUserId,
-                        slackActorId: link.slackActorId,
+                        slackKey: link.slackKey,
                         linkedAt: link.linkedAt,
                     }
                     : {}),
             };
         },
-        async startAuthorize(actorId, redirectUri) {
+        async startAuthorize(userId, redirectUri) {
             const oauth = readSlackOidcConfig();
             const stateKey = readOauthStateSigningKey();
             if (!oauth || !stateKey) {
@@ -42,7 +50,7 @@ export function createSlackIdentityConnectProvider(options = {}) {
                     error: `Slack connect is not configured (set SLACK_CLIENT_ID, SLACK_CLIENT_SECRET, MDA_PUBLIC_APP_URL, ${OAUTH_STATE_SIGNING_KEY_ENV})`,
                 };
             }
-            const state = await createSlackOauthState(actorId, stateKey);
+            const state = await createSlackOauthState(userId, stateKey);
             return {
                 authorizeUrl: buildSlackAuthorizeUrl(oauth, state, redirectUri),
             };
@@ -56,11 +64,11 @@ export function createSlackIdentityConnectProvider(options = {}) {
             if (!stateKey) {
                 throw new Error(`${OAUTH_STATE_SIGNING_KEY_ENV} is not configured`);
             }
-            const { actorId } = await verifySlackOauthState(state, stateKey);
+            const { userId } = await verifySlackOauthState(state, stateKey);
             const slackIdentity = await exchangeSlackOidcCode(oauth, code, redirectUri);
             const teamId = slackIdentity.teamId ?? oauth.teamId;
             const record = buildIdentityLinkRecord({
-                actorId,
+                userId,
                 slackUserId: slackIdentity.userId,
                 ...(teamId ? { slackTeamId: teamId } : {}),
                 ...(slackIdentity.email ? { email: slackIdentity.email } : {}),
@@ -70,8 +78,8 @@ export function createSlackIdentityConnectProvider(options = {}) {
                 successRedirect: `${oauth.publicAppUrl}/settings?slack=connected`,
             };
         },
-        async unlink(actorId) {
-            await store().removeByActorId(actorId);
+        async unlink(userId) {
+            await store().removeByUserId(userId);
         },
         resolveRedirectBase(options) {
             return resolveSlackOauthRedirectBase(options);
@@ -90,10 +98,10 @@ export const slackIdentityConnectProvider = createSlackIdentityConnectProvider()
  *
  * @example
  * ```ts
- * import { defineIdentity, slack } from "managed-deepagents";
+ * import { connect, defineIdentity } from "managed-deepagents";
  *
- * export const identity = defineIdentity.preset("internal-tool", {
- *   connect: [slack.connect()],
+ * export const identity = defineIdentity({
+ *   connect: [connect.slack()],
  * });
  * ```
  */

package/dist/identity/slack/connect-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,GAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,MAAM,CAAC;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,OAAO,CAAC;AACtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC;AAOlD,mEAAmE;AACnE,MAAM,UAAU,kCAAkC,CAChD,OAAO,GAAwC,EAAE;IAEjD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,oBAAoB,EAAE,CAAC;IAEhE,OAAO;QACL,EAAE,EAAE,OAAO;QACX,WAAW,CAAC,GAAgC;YAC1C,mEAAmE;YACnE,OAAO,GAAG,CAAC,WAAW,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAe;YAC1B,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACjD,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC;gBACrB,GAAG,CAAC,IAAI;oBACN,CAAC,CAAC;wBACE,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;wBAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,OAAe,EACf,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,kGAAkG,2BAA2B,GAAG;iBACxI,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC7D,OAAO;gBACL,YAAY,EAAE,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;aAChE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACjE,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAC/C,KAAK,EACL,IAAI,EACJ,WAAW,CACZ,CAAC;YACF,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;YACpD,MAAM,MAAM,GAAG,uBAAuB,CAAC;gBACrC,OAAO;gBACP,WAAW,EAAE,aAAa,CAAC,MAAM;gBACjC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,2BAA2B;aAClE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAe;YAC1B,MAAM,KAAK,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,mBAAmB,CAAC,OAA2C;YAC7D,OAAO,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QACD,mBAAmB;YACjB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,OAAO,CACL,KAAK,EAAE,YAAY;gBACnB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,4BAA4B,GACvC,kCAAkC,EAAE,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CACrB,OAA6C;IAE7C,OAAO,OAAO;QACZ,CAAC,CAAC,kCAAkC,CAAC,OAAO,CAAC;QAC7C,CAAC,CAAC,4BAA4B,CAAC;AACnC,CAAC"}
+{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,GAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,MAAM,CAAC;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,OAAO,CAAC;AACtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC;AAOlD,mEAAmE;AACnE,MAAM,UAAU,kCAAkC,CAChD,OAAO,GAAwC,EAAE;IAEjD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,oBAAoB,EAAE,CAAC;IAEhE,OAAO;QACL,EAAE,EAAE,OAAO;QACX,WAAW,CAAC,GAAgC;YAC1C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,wEAAwE;YACxE,qEAAqE;YACrE,gEAAgE;YAChE,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,KAAK;gBACtB,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC;oBAC3C,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC;gBACrB,GAAG,CAAC,IAAI;oBACN,CAAC,CAAC;wBACE,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,kGAAkG,2BAA2B,GAAG;iBACxI,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC5D,OAAO;gBACL,YAAY,EAAE,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;aAChE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAChE,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAC/C,KAAK,EACL,IAAI,EACJ,WAAW,CACZ,CAAC;YACF,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;YACpD,MAAM,MAAM,GAAG,uBAAuB,CAAC;gBACrC,MAAM;gBACN,WAAW,EAAE,aAAa,CAAC,MAAM;gBACjC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,2BAA2B;aAClE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,KAAK,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,mBAAmB,CAAC,OAA2C;YAC7D,OAAO,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QACD,mBAAmB;YACjB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,OAAO,CACL,KAAK,EAAE,YAAY;gBACnB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,4BAA4B,GACvC,kCAAkC,EAAE,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CACrB,OAA6C;IAE7C,OAAO,OAAO;QACZ,CAAC,CAAC,kCAAkC,CAAC,OAAO,CAAC;QAC7C,CAAC,CAAC,4BAA4B,CAAC;AACnC,CAAC"}

package/dist/identity/slack/index.d.ts

@@ -1,8 +1,7 @@
 /**
  * Slack identity helpers — Connect-with-Slack opt-in for `defineIdentity`.
  *
- * Channel authoring lives under `managed-deepagents/channels/slack`
- * (`defineSlackChannel`).
+ * Slack Events / messaging authoring lives on `connectors.slack`.
  */
 export { connect, createSlackIdentityConnectProvider, slackIdentityConnectProvider, SLACK_CONNECT_CALLBACK_PATH, SLACK_CONNECT_LINK_PATH, SLACK_CONNECT_START_PATH, SLACK_CONNECT_STATUS_PATH, } from "./connect-http.js";
 export type { SlackIdentityConnectProviderOptions } from "./connect-http.js";

package/dist/identity/slack/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,OAAO,EACP,kCAAkC,EAClC,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,mCAAmC,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,OAAO,EACP,kCAAkC,EAClC,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,mCAAmC,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/identity/slack/index.js

@@ -1,8 +1,7 @@
 /**
  * Slack identity helpers — Connect-with-Slack opt-in for `defineIdentity`.
  *
- * Channel authoring lives under `managed-deepagents/channels/slack`
- * (`defineSlackChannel`).
+ * Slack Events / messaging authoring lives on `connectors.slack`.
  */
 export { connect, createSlackIdentityConnectProvider, slackIdentityConnectProvider, SLACK_CONNECT_CALLBACK_PATH, SLACK_CONNECT_LINK_PATH, SLACK_CONNECT_START_PATH, SLACK_CONNECT_STATUS_PATH, } from "./connect-http.js";
 //# sourceMappingURL=index.js.map

package/dist/identity/slack/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/slack/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,OAAO,EACP,kCAAkC,EAClC,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/slack/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,OAAO,EACP,kCAAkC,EAClC,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC"}

package/dist/identity/slack/links.d.ts

@@ -8,38 +8,38 @@
 import { Client } from "@langchain/langgraph-sdk";
 export declare const IDENTITY_LINKS_NAMESPACE: readonly ["mda_identity_links"];
 export interface IdentityLinkRecord {
-    actorId: string;
+    userId: string;
     slackUserId: string;
     slackTeamId?: string;
-    /** Fully-qualified Slack actor key, e.g. `slack:T123:U456`. */
-    slackActorId: string;
+    /** Fully-qualified Slack user key, e.g. `slack:T123:U456`. */
+    slackKey: string;
     email?: string;
     linkedAt: string;
     source: "slack_oauth";
 }
 export interface IdentityLinkStore {
-    getBySlackActorId(slackActorId: string): Promise<IdentityLinkRecord | null>;
-    getByActorId(actorId: string): Promise<IdentityLinkRecord | null>;
+    getBySlackKey(slackKey: string): Promise<IdentityLinkRecord | null>;
+    getByUserId(userId: string): Promise<IdentityLinkRecord | null>;
     upsert(record: IdentityLinkRecord): Promise<void>;
-    removeByActorId(actorId: string): Promise<void>;
+    removeByUserId(userId: string): Promise<void>;
 }
 /** In-memory store for tests (and as a process-local cache layer). */
 export declare class InMemoryIdentityLinkStore implements IdentityLinkStore {
     private readonly bySlack;
-    private readonly byActor;
-    getBySlackActorId(slackActorId: string): Promise<IdentityLinkRecord | null>;
-    getByActorId(actorId: string): Promise<IdentityLinkRecord | null>;
+    private readonly byUser;
+    getBySlackKey(slackKey: string): Promise<IdentityLinkRecord | null>;
+    getByUserId(userId: string): Promise<IdentityLinkRecord | null>;
     upsert(record: IdentityLinkRecord): Promise<void>;
-    removeByActorId(actorId: string): Promise<void>;
+    removeByUserId(userId: string): Promise<void>;
 }
 /** LangGraph Store–backed identity links. */
 export declare class LangGraphIdentityLinkStore implements IdentityLinkStore {
     private readonly client;
     constructor(client: Client);
-    getBySlackActorId(slackActorId: string): Promise<IdentityLinkRecord | null>;
-    getByActorId(actorId: string): Promise<IdentityLinkRecord | null>;
+    getBySlackKey(slackKey: string): Promise<IdentityLinkRecord | null>;
+    getByUserId(userId: string): Promise<IdentityLinkRecord | null>;
     upsert(record: IdentityLinkRecord): Promise<void>;
-    removeByActorId(actorId: string): Promise<void>;
+    removeByUserId(userId: string): Promise<void>;
     private getItem;
 }
 /** Override the process-default link store (tests). */
@@ -52,9 +52,9 @@ export declare function createLangGraphIdentityLinkStore(options?: {
     apiKey?: string;
     ingressSecret?: string;
 }): LangGraphIdentityLinkStore | null;
-export declare function slackActorIdFromParts(teamId: string, userId: string): string;
+export declare function slackKeyFromParts(teamId: string, userId: string): string;
 export declare function buildIdentityLinkRecord(input: {
-    actorId: string;
+    userId: string;
     slackUserId: string;
     slackTeamId?: string;
     email?: string;