managed-deepagents 0.5.0-dev.79 → 0.5.0-dev.81

package/dist/extension.d.ts

@@ -0,0 +1,77 @@
+/**
+ * The contribution API behind the extensible MDA primitives.
+ *
+ * `defineExtension(kind, options)` returns the factory an agent project calls —
+ * `connectors.slack({ … })`, `connectors.github({ … })`, `sandboxes.langsmith()`.
+ * The `kind` narrows which hooks the primitive may implement; argument parsing,
+ * branding, and manifest stamping are shared.
+ *
+ * Every kind declares its input through `args`, which takes a schema from any
+ * [Standard Schema](https://standardschema.dev) library — Zod, Valibot,
+ * ArkType — or a plain function where a schema does not fit. Validating through
+ * that interface keeps the vendor out of this package's dependencies, so a
+ * contributor picks whichever library they already use.
+ *
+ * This module is deliberately absent from the package barrel. Only the
+ * first-party namespaces in `namespaces.ts` contribute primitives, so an agent
+ * project cannot mount its own adapter, HTTP route, or sandbox backend into the
+ * managed runtime. Opening it up to third-party packages is a later step.
+ *
+ * The `auth`, `credentials`, and `connect` primitives are extended by plain
+ * factories rather than through here: they return inert configuration objects
+ * with no brand, hooks, or normalization to share. They gain an envelope when
+ * this API is exported and their inputs need validating at the boundary.
+ */
+import type { StandardSchemaV1 } from "@standard-schema/spec";
+import type { ChannelTransport } from "./channels/runtime.js";
+import { type Connector, type ConnectorRequirements, type ConnectorToolList, type EventsContext, type HttpContext, type SandboxContext, type ToolContext } from "./runtime/connector.js";
+import { type SandboxOptions, type SandboxDefinition, type SandboxProviderClass } from "./sandbox.js";
+/** The primitives that carry a shared construction envelope. */
+export type ExtensionKind = "connector" | "sandbox";
+/**
+ * How author input becomes the arguments a primitive is built from.
+ *
+ * Either a schema from any [Standard Schema](https://standardschema.dev)
+ * library — Zod, Valibot, ArkType, … — or a plain function for the cases a
+ * schema cannot express. Both run at module load, so misconfiguration surfaces
+ * at build or dev startup rather than mid-run. Defaults and coercions belong
+ * here too: whatever this produces is what the primitive carries.
+ */
+export type ExtensionArgs<TInput, TArgs> = StandardSchemaV1<TInput, TArgs> | ((input: TInput) => TArgs);
+/** Shared by every kind: how the factory's input is validated, and its name. */
+interface ExtensionEnvelope<TInput, TArgs> {
+    args: ExtensionArgs<TInput, TArgs>;
+    /**
+     * How the factory is spelled in an agent project, e.g. `"connectors.mcp"`.
+     * Prefixes validation errors, which is the only place an author sees it.
+     */
+    label: string;
+}
+/**
+ * A connector contributes tools, HTTP routes, sandbox provisioning, inbound
+ * events, and/or a named messaging surface. Hooks receive the built connector,
+ * so they can read the parsed arguments spread onto it.
+ */
+export interface ConnectorExtensionOptions<TInput, TArgs extends object, TKind extends string> extends ExtensionEnvelope<TInput, TArgs> {
+    /** Diagnostic label (e.g. `"mcp_servers"`). Mounts use the file-stem name. */
+    kind: TKind;
+    tools?(ctx: ToolContext, self: ConnectorInstance<TArgs, TKind>): ConnectorToolList | Promise<ConnectorToolList>;
+    http?(ctx: HttpContext, self: ConnectorInstance<TArgs, TKind>): void | Promise<void>;
+    sandbox?(ctx: SandboxContext, self: ConnectorInstance<TArgs, TKind>): void | Promise<void>;
+    events?(ctx: EventsContext, self: ConnectorInstance<TArgs, TKind>): Response | Promise<Response>;
+    messaging?(env: NodeJS.ProcessEnv, self: ConnectorInstance<TArgs, TKind>): ChannelTransport | undefined;
+    requirements?(name: string, self: ConnectorInstance<TArgs, TKind>): ConnectorRequirements;
+}
+/** The connector a `"connector"` extension builds: its brand, kind, and args. */
+export type ConnectorInstance<TArgs extends object, TKind extends string> = Connector & TArgs & {
+    readonly kind: TKind;
+};
+/** A sandbox contributes the execution environment the agent's shell runs in. */
+export interface SandboxExtensionOptions<TInput, TProvider extends SandboxProviderClass<any, any>> extends ExtensionEnvelope<TInput, SandboxOptions<TProvider>> {
+    /** Backend class MDA constructs with `new Provider({ sandbox, … })`. */
+    provider: TProvider;
+}
+export declare function defineExtension<TInput, TArgs extends object, TKind extends string>(kind: "connector", options: ConnectorExtensionOptions<TInput, TArgs, TKind>): (input: TInput) => ConnectorInstance<TArgs, TKind>;
+export declare function defineExtension<TInput, TProvider extends SandboxProviderClass<any, any>>(kind: "sandbox", options: SandboxExtensionOptions<TInput, TProvider>): (input: TInput) => SandboxDefinition<TProvider>;
+export {};
+//# sourceMappingURL=extension.d.ts.map

package/dist/extension.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension.d.ts","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAC1B,MAAM,cAAc,CAAC;AAEtB,gEAAgE;AAChE,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,SAAS,CAAC;AAEpD;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,IACnC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,GAC/B,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,KAAK,CAAC,CAAC;AAE/B,gFAAgF;AAChF,UAAU,iBAAiB,CAAC,MAAM,EAAE,KAAK;IACvC,IAAI,EAAE,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnC;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB,CACxC,MAAM,EACN,KAAK,SAAS,MAAM,EACpB,KAAK,SAAS,MAAM,CACpB,SAAQ,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC;IACxC,8EAA8E;IAC9E,IAAI,EAAE,KAAK,CAAC;IACZ,KAAK,CAAC,CACJ,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,GACpC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClD,IAAI,CAAC,CACH,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,GACpC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,CAAC,CACN,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,GACpC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,CACL,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,GACpC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,SAAS,CAAC,CACR,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,EAAE,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,GACpC,gBAAgB,GAAG,SAAS,CAAC;IAChC,YAAY,CAAC,CACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,GACpC,qBAAqB,CAAC;CAC1B;AAED,iFAAiF;AACjF,MAAM,MAAM,iBAAiB,CAC3B,KAAK,SAAS,MAAM,EACpB,KAAK,SAAS,MAAM,IAClB,SAAS,GAAG,KAAK,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC;AAEjD,iFAAiF;AACjF,MAAM,WAAW,uBAAuB,CACtC,MAAM,EACN,SAAS,SAAS,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAChD,SAAQ,iBAAiB,CAAC,MAAM,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,wBAAgB,eAAe,CAC7B,MAAM,EACN,KAAK,SAAS,MAAM,EACpB,KAAK,SAAS,MAAM,EAEpB,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,yBAAyB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,GACvD,CAAC,KAAK,EAAE,MAAM,KAAK,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACtD,wBAAgB,eAAe,CAC7B,MAAM,EACN,SAAS,SAAS,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,EAEhD,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,GAClD,CAAC,KAAK,EAAE,MAAM,KAAK,iBAAiB,CAAC,SAAS,CAAC,CAAC"}

package/dist/extension.js

@@ -0,0 +1,127 @@
+/**
+ * The contribution API behind the extensible MDA primitives.
+ *
+ * `defineExtension(kind, options)` returns the factory an agent project calls —
+ * `connectors.slack({ … })`, `connectors.github({ … })`, `sandboxes.langsmith()`.
+ * The `kind` narrows which hooks the primitive may implement; argument parsing,
+ * branding, and manifest stamping are shared.
+ *
+ * Every kind declares its input through `args`, which takes a schema from any
+ * [Standard Schema](https://standardschema.dev) library — Zod, Valibot,
+ * ArkType — or a plain function where a schema does not fit. Validating through
+ * that interface keeps the vendor out of this package's dependencies, so a
+ * contributor picks whichever library they already use.
+ *
+ * This module is deliberately absent from the package barrel. Only the
+ * first-party namespaces in `namespaces.ts` contribute primitives, so an agent
+ * project cannot mount its own adapter, HTTP route, or sandbox backend into the
+ * managed runtime. Opening it up to third-party packages is a later step.
+ *
+ * The `auth`, `credentials`, and `connect` primitives are extended by plain
+ * factories rather than through here: they return inert configuration objects
+ * with no brand, hooks, or normalization to share. They gain an envelope when
+ * this API is exported and their inputs need validating at the boundary.
+ */
+import { CONNECTOR_BRAND, } from "./runtime/connector.js";
+import { normalizeSandboxOptions, sandboxProviderKey, } from "./sandbox.js";
+export function defineExtension(kind, options) {
+    switch (kind) {
+        case "connector":
+            return connectorExtension(options);
+        case "sandbox":
+            return sandboxExtension(options);
+        default:
+            throw new TypeError(`Unknown extension kind: ${String(kind)}`);
+    }
+}
+function connectorExtension(options) {
+    const parse = parser(options);
+    return (input) => {
+        const args = parse(input);
+        const self = { kind: options.kind, ...args };
+        // Hooks and the brand stay non-enumerable so a connector still spreads and
+        // serializes as its plain configuration.
+        hide(self, CONNECTOR_BRAND, true);
+        if (options.tools) {
+            const tools = options.tools;
+            hide(self, "tools", (ctx) => tools(ctx, self));
+        }
+        if (options.http) {
+            const http = options.http;
+            hide(self, "http", (ctx) => http(ctx, self));
+        }
+        if (options.sandbox) {
+            const sandbox = options.sandbox;
+            hide(self, "sandbox", (ctx) => sandbox(ctx, self));
+        }
+        if (options.events) {
+            const events = options.events;
+            hide(self, "events", (ctx) => events(ctx, self));
+        }
+        if (options.messaging) {
+            const messaging = options.messaging;
+            hide(self, "messaging", (env) => messaging(env, self));
+        }
+        if (options.requirements) {
+            const requirements = options.requirements;
+            hide(self, "requirements", (name) => requirements(name, self));
+        }
+        return self;
+    };
+}
+function sandboxExtension(options) {
+    const parse = parser(options);
+    return (input) => {
+        if (sandboxProviderKey(options.provider) !== "LangSmithSandbox") {
+            throw new TypeError("MDA only supports deepagents' LangSmithSandbox provider");
+        }
+        return {
+            kind: "sandbox",
+            provider: options.provider,
+            // The managed-key rule is MDA policy, not the provider's, so it runs
+            // here rather than in each provider's `args`.
+            options: normalizeSandboxOptions(parse(input)),
+        };
+    };
+}
+/**
+ * Resolve `args` into the function the factory runs on its input.
+ *
+ * A schema is validated through the Standard Schema interface, so the vendor
+ * (Zod, Valibot, …) never has to be a dependency of this package.
+ */
+function parser(options) {
+    const { args, label } = options;
+    if (typeof args === "function") {
+        return args;
+    }
+    const { validate } = args["~standard"];
+    return (input) => {
+        const result = validate(input);
+        if (result instanceof Promise) {
+            throw new TypeError(`${label}(...) needs a schema that validates synchronously, because ` +
+                "primitives are declared at module load. Drop the async refinement " +
+                "or validate inside a hook instead.");
+        }
+        if (result.issues) {
+            throw new Error(`${label}(...) ${describeIssues(result.issues)}`);
+        }
+        return result.value;
+    };
+}
+/** Render schema issues as `path: message`, in the order the vendor reported. */
+function describeIssues(issues) {
+    const lines = issues.map((issue) => {
+        const path = (issue.path ?? [])
+            .map((segment) => String(typeof segment === "object" ? segment.key : segment))
+            .join(".");
+        return path.length > 0 ? `${path}: ${issue.message}` : issue.message;
+    });
+    return lines.length === 1
+        ? `received invalid configuration — ${lines[0]}.`
+        : `received invalid configuration:\n  - ${lines.join("\n  - ")}`;
+}
+function hide(target, key, value) {
+    Object.defineProperty(target, key, { value, enumerable: false });
+}
+//# sourceMappingURL=extension.js.map

package/dist/extension.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension.js","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,OAAO,EACL,eAAe,GAQhB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,GAInB,MAAM,cAAc,CAAC;AAgGtB,MAAM,UAAU,eAAe,CAC7B,IAAmB,EACnB,OAAY;IAEZ,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW;YACd,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACrC,KAAK,SAAS;YACZ,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACnC;YACE,MAAM,IAAI,SAAS,CAAC,2BAA2B,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAwD;IAExD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,EAGzC,CAAC;QACF,2EAA2E;QAC3E,yCAAyC;QACzC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC5B,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,GAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,GAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YAChC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,GAAmB,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAkB,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;YACpC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,GAAsB,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;YAC1C,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAIvB,OAAmD;IAEnD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,IAAI,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,kBAAkB,EAAE,CAAC;YAChE,MAAM,IAAI,SAAS,CACjB,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,qEAAqE;YACrE,8CAA8C;YAC9C,OAAO,EAAE,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;SAC/C,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CACb,OAAyC;IAEzC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAChC,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACvC,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,SAAS,CACjB,GAAG,KAAK,6DAA6D;gBACnE,oEAAoE;gBACpE,oCAAoC,CACvC,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,cAAc,CAAC,MAAyC;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;aAC5B,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACf,MAAM,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAC5D;aACA,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IACvE,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,oCAAoC,KAAK,CAAC,CAAC,CAAC,GAAG;QACjD,CAAC,CAAC,wCAAwC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,GAAoB,EAAE,KAAc;IAChE,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AACnE,CAAC"}

package/dist/identity/actor-subject.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Deterministic LangSmith agent_id for an MDA actor's Fleet vault subject.
+ *
+ * Tokens imported via Connect-with-X and toolserver `?agent_id=` must use the
+ * same derivation so each caller reaches their own vault connections. One
+ * actor has one agent_id; multiple Fleet OAuth integrations attach as distinct
+ * `provider_id`s on that subject.
+ */
+import { type FleetOAuthIntegration } from "../connectors/toolserver/integrations.js";
+import type { IdentityConnectMountContext } from "./connect-provider-types.js";
+/**
+ * Fixed namespace for MDA actor vault subjects (UUID form).
+ * Stable across releases so reconnects hit the same vault row.
+ */
+export declare const NAMESPACE_MDA_ACTOR = "c0ffee00-0da0-4111-8111-000000000001";
+export interface AgentIdFromActorOptions {
+    /**
+     * Workspace discriminator so ids do not collide across workspaces.
+     * Defaults to {@link resolveActorDeploymentId} (`LANGCHAIN_WORKSPACE_ID`).
+     */
+    deploymentId?: string;
+    /** Override process env (tests). */
+    env?: NodeJS.ProcessEnv;
+    /** Override the UUID namespace (tests). */
+    namespace?: string;
+}
+/**
+ * Resolve the workspace slice for {@link agentIdFromActor}.
+ *
+ * Uses `LANGCHAIN_WORKSPACE_ID`, else `"local"`.
+ */
+export declare function resolveActorDeploymentId(env?: NodeJS.ProcessEnv): string;
+/**
+ * Derive the vault `agent_id` for an authenticated MDA actor.
+ *
+ * `uuidv5(`${workspaceId}:${userId}`, NAMESPACE_MDA_ACTOR)`.
+ */
+export declare function agentIdFromActor(userId: string, options?: AgentIdFromActorOptions): string;
+/** Enable actor-subject routing for a Fleet OAuth integration. */
+export declare function enableActorSubjectIntegration(integrationId: string): void;
+/** True when actor-subject routing is on for `integrationId`. */
+export declare function isActorSubjectIntegrationEnabled(integrationId: string): boolean;
+/**
+ * True when `slug` belongs to an enabled Fleet OAuth integration (per-actor
+ * `?agent_id=` routing).
+ */
+export declare function isActorSubjectSlugEnabled(slug: string | undefined): boolean;
+/** Enabled integration ids (for connect-hint middleware, etc.). */
+export declare function enabledActorSubjectIntegrations(): readonly string[];
+/**
+ * Enable actor-subject mode for every Fleet integration implied by connectors on a
+ * user-scoped deployment. Agent-scoped deployments keep the shared
+ * `MDA_TOOLSERVER_AGENT_ID` subject.
+ */
+export declare function enableActorSubjectIntegrationsFromConnectors(connectorKinds: readonly (string | undefined)[] | undefined, scope?: IdentityConnectMountContext["scope"]): void;
+/** Enable a specific integration when connectors imply it (user-scoped only). */
+export declare function enableActorSubjectIntegrationFromConnectors(integration: FleetOAuthIntegration, connectorKinds: readonly (string | undefined)[] | undefined, scope?: IdentityConnectMountContext["scope"]): void;
+/** Test-only reset. */
+export declare function resetActorSubjectEnabledForTests(): void;
+//# sourceMappingURL=actor-subject.d.ts.map

package/dist/identity/actor-subject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor-subject.d.ts","sourceRoot":"","sources":["../../src/identity/actor-subject.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAY/E;;;GAGG;AACH,eAAO,MAAM,mBAAmB,yCAAyC,CAAC;AAE1E,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,uBAA4B,GACpC,MAAM,CAUR;AAKD,kEAAkE;AAClE,wBAAgB,6BAA6B,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAKzE;AAED,iEAAiE;AACjE,wBAAgB,gCAAgC,CAC9C,aAAa,EAAE,MAAM,GACpB,OAAO,CAET;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAG3E;AAED,mEAAmE;AACnE,wBAAgB,+BAA+B,IAAI,SAAS,MAAM,EAAE,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,4CAA4C,CAC1D,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC3C,IAAI,CAcN;AAED,iFAAiF;AACjF,wBAAgB,2CAA2C,CACzD,WAAW,EAAE,qBAAqB,EAClC,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC3C,IAAI,CAON;AAED,uBAAuB;AACvB,wBAAgB,gCAAgC,IAAI,IAAI,CAEvD"}

package/dist/identity/actor-subject.js

@@ -0,0 +1,107 @@
+/**
+ * Deterministic LangSmith agent_id for an MDA actor's Fleet vault subject.
+ *
+ * Tokens imported via Connect-with-X and toolserver `?agent_id=` must use the
+ * same derivation so each caller reaches their own vault connections. One
+ * actor has one agent_id; multiple Fleet OAuth integrations attach as distinct
+ * `provider_id`s on that subject.
+ */
+import { v5 as uuidv5 } from "uuid";
+import { MARKETPLACE_MCP_INTEGRATIONS, hasMarketplaceConnector, } from "../connectors/marketplace/catalog.js";
+import { FLEET_OAUTH_INTEGRATIONS, integrationForSlug, hasIntegrationToolServerConnector, } from "../connectors/toolserver/integrations.js";
+function isUserScoped(scope) {
+    if (!scope) {
+        return false;
+    }
+    // Per-caller Connect / actor-subject vault ownership. Memory is unrelated.
+    return scope.credentials === "user" || scope.credentials === "custom";
+}
+/**
+ * Fixed namespace for MDA actor vault subjects (UUID form).
+ * Stable across releases so reconnects hit the same vault row.
+ */
+export const NAMESPACE_MDA_ACTOR = "c0ffee00-0da0-4111-8111-000000000001";
+/**
+ * Resolve the workspace slice for {@link agentIdFromActor}.
+ *
+ * Uses `LANGCHAIN_WORKSPACE_ID`, else `"local"`.
+ */
+export function resolveActorDeploymentId(env = process.env) {
+    return trimmed(env.LANGCHAIN_WORKSPACE_ID) ?? "local";
+}
+/**
+ * Derive the vault `agent_id` for an authenticated MDA actor.
+ *
+ * `uuidv5(`${workspaceId}:${userId}`, NAMESPACE_MDA_ACTOR)`.
+ */
+export function agentIdFromActor(userId, options = {}) {
+    const id = userId.trim();
+    if (!id) {
+        throw new Error("agentIdFromActor requires a non-empty userId");
+    }
+    const deploymentId = options.deploymentId?.trim() ||
+        resolveActorDeploymentId(options.env ?? process.env);
+    const namespace = options.namespace ?? NAMESPACE_MDA_ACTOR;
+    return uuidv5(`${deploymentId}:${id}`, namespace);
+}
+/** Integrations with per-actor toolserver subject routing enabled in this process. */
+const enabledIntegrations = new Set();
+/** Enable actor-subject routing for a Fleet OAuth integration. */
+export function enableActorSubjectIntegration(integrationId) {
+    const id = integrationId.trim();
+    if (id) {
+        enabledIntegrations.add(id);
+    }
+}
+/** True when actor-subject routing is on for `integrationId`. */
+export function isActorSubjectIntegrationEnabled(integrationId) {
+    return enabledIntegrations.has(integrationId);
+}
+/**
+ * True when `slug` belongs to an enabled Fleet OAuth integration (per-actor
+ * `?agent_id=` routing).
+ */
+export function isActorSubjectSlugEnabled(slug) {
+    const integration = integrationForSlug(slug);
+    return integration != null && enabledIntegrations.has(integration.id);
+}
+/** Enabled integration ids (for connect-hint middleware, etc.). */
+export function enabledActorSubjectIntegrations() {
+    return [...enabledIntegrations];
+}
+/**
+ * Enable actor-subject mode for every Fleet integration implied by connectors on a
+ * user-scoped deployment. Agent-scoped deployments keep the shared
+ * `MDA_TOOLSERVER_AGENT_ID` subject.
+ */
+export function enableActorSubjectIntegrationsFromConnectors(connectorKinds, scope) {
+    if (!isUserScoped(scope)) {
+        return;
+    }
+    for (const integration of FLEET_OAUTH_INTEGRATIONS) {
+        if (hasIntegrationToolServerConnector(integration, connectorKinds)) {
+            enableActorSubjectIntegration(integration.id);
+        }
+    }
+    for (const integration of MARKETPLACE_MCP_INTEGRATIONS) {
+        if (hasMarketplaceConnector(integration.id, connectorKinds)) {
+            enableActorSubjectIntegration(integration.id);
+        }
+    }
+}
+/** Enable a specific integration when connectors imply it (user-scoped only). */
+export function enableActorSubjectIntegrationFromConnectors(integration, connectorKinds, scope) {
+    if (hasIntegrationToolServerConnector(integration, connectorKinds) &&
+        isUserScoped(scope)) {
+        enableActorSubjectIntegration(integration.id);
+    }
+}
+/** Test-only reset. */
+export function resetActorSubjectEnabledForTests() {
+    enabledIntegrations.clear();
+}
+function trimmed(value) {
+    const v = value?.trim();
+    return v ? v : undefined;
+}
+//# sourceMappingURL=actor-subject.js.map

package/dist/identity/actor-subject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor-subject.js","sourceRoot":"","sources":["../../src/identity/actor-subject.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,iCAAiC,GAElC,MAAM,0CAA0C,CAAC;AAGlD,SAAS,YAAY,CACnB,KAAuD;IAEvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IACD,2EAA2E;IAC3E,OAAO,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,sCAAsC,CAAC;AAc1E;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,OAAO,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,OAAO,GAA4B,EAAE;IAErC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE;QAC5B,wBAAwB,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,mBAAmB,CAAC;IAC3D,OAAO,MAAM,CAAC,GAAG,YAAY,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;AACpD,CAAC;AAED,sFAAsF;AACtF,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE9C,kEAAkE;AAClE,MAAM,UAAU,6BAA6B,CAAC,aAAqB;IACjE,MAAM,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,EAAE,EAAE,CAAC;QACP,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,gCAAgC,CAC9C,aAAqB;IAErB,OAAO,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAwB;IAChE,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,WAAW,IAAI,IAAI,IAAI,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,+BAA+B;IAC7C,OAAO,CAAC,GAAG,mBAAmB,CAAC,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4CAA4C,CAC1D,cAA2D,EAC3D,KAA4C;IAE5C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,wBAAwB,EAAE,CAAC;QACnD,IAAI,iCAAiC,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;YACnE,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,4BAA4B,EAAE,CAAC;QACvD,IAAI,uBAAuB,CAAC,WAAW,CAAC,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;YAC5D,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,2CAA2C,CACzD,WAAkC,EAClC,cAA2D,EAC3D,KAA4C;IAE5C,IACE,iCAAiC,CAAC,WAAW,EAAE,cAAc,CAAC;QAC9D,YAAY,CAAC,KAAK,CAAC,EACnB,CAAC;QACD,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,uBAAuB;AACvB,MAAM,UAAU,gCAAgC;IAC9C,mBAAmB,CAAC,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,OAAO,CAAC,KAAyB;IACxC,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACxB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3B,CAAC"}

package/dist/identity/byo-oauth.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Factory for optional BYO (bring-your-own) OAuth clients used when Fleet
+ * auth-sessions are unavailable.
+ *
+ * Vendor modules supply endpoints, authorize extras, and userinfo parsing;
+ * this module owns config env reading, authorize URL construction, token
+ * exchange, and the {@link FleetVaultByoOauth} adapter.
+ */
+import type { FleetVaultByoOauth, FleetVaultByoTokenResult } from "./fleet-connect.js";
+import { type OauthTickets } from "./oauth-tickets.js";
+import { resolveSlackOauthRedirectBase } from "./slack/oauth.js";
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, resolveSlackOauthRedirectBase, } from "./slack/oauth.js";
+/** Shared BYO OAuth client configuration. */
+export interface ByoOauthConfig {
+    clientId: string;
+    clientSecret: string;
+    publicAppUrl: string;
+    scopes: string;
+    authUrl: string;
+    tokenUrl: string;
+    userInfoUrl: string;
+}
+export interface ByoOauthEndpoints {
+    authUrl: string;
+    tokenUrl: string;
+    userInfoUrl: string;
+    /** Space-separated default scopes when env override is absent. */
+    defaultScopes: string;
+}
+export interface ByoOauthUserInfo {
+    email?: string;
+    subject?: string;
+}
+export interface CreateByoOauthClientOptions {
+    /** Connect / ticket provider id, e.g. `"google"`. */
+    providerId: string;
+    /** Human label for error messages ("Google", "Microsoft"). */
+    displayName: string;
+    /**
+     * Env prefix without trailing underscore, e.g. `"GOOGLE_OAUTH"`.
+     * Reads `${prefix}_CLIENT_ID`, `_CLIENT_SECRET`, `_SCOPES`, `_AUTH_URL`,
+     * `_TOKEN_URL`, `_USERINFO_URL`.
+     */
+    envPrefix: string;
+    /** Default endpoints + scopes (may read extra env, e.g. tenant). */
+    defaultEndpoints: (env: NodeJS.ProcessEnv) => ByoOauthEndpoints;
+    /**
+     * Extra authorize query params merged after the shared OAuth code-grant
+     * fields. Defaults include `prompt=consent` when omitted here.
+     */
+    authorizeParams?: Record<string, string>;
+    /** Map a userinfo /me JSON body to email + subject. */
+    parseUserInfo: (json: Record<string, unknown>) => ByoOauthUserInfo;
+    /** Vault metadata key for the IdP subject (e.g. `google_sub`). */
+    subjectMetadataKey: string;
+}
+export interface ByoOauthEnvKeys {
+    clientId: string;
+    clientSecret: string;
+    scopes: string;
+    authUrl: string;
+    tokenUrl: string;
+    userInfoUrl: string;
+}
+/** BYO OAuth client produced by {@link createByoOauthClient}. */
+export interface ByoOauthClient {
+    providerId: string;
+    displayName: string;
+    env: ByoOauthEnvKeys;
+    tickets: OauthTickets;
+    resolveRedirectBase: typeof resolveSlackOauthRedirectBase;
+    readConfig(env?: NodeJS.ProcessEnv): ByoOauthConfig | null;
+    buildAuthorizeUrl(config: ByoOauthConfig, state: string, redirectUri: string, scopes?: string): string;
+    exchangeCode(config: ByoOauthConfig, code: string, redirectUri: string, fetchImpl?: typeof fetch): Promise<FleetVaultByoTokenResult>;
+    /** Ready for `createFleetVaultConnectProvider({ byo })`. */
+    byo: FleetVaultByoOauth;
+    resolvePublicAppUrl(env?: NodeJS.ProcessEnv): string | undefined;
+}
+/** Build a BYO OAuth client for one Fleet vault Connect integration. */
+export declare function createByoOauthClient(options: CreateByoOauthClientOptions): ByoOauthClient;
+//# sourceMappingURL=byo-oauth.d.ts.map

package/dist/identity/byo-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"byo-oauth.d.ts","sourceRoot":"","sources":["../../src/identity/byo-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAGL,6BAA6B,EAC9B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAE1B,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,iBAAiB,CAAC;IAChE;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,uDAAuD;IACvD,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,gBAAgB,CAAC;IACnE,kEAAkE;IAClE,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,eAAe,CAAC;IACrB,OAAO,EAAE,YAAY,CAAC;IACtB,mBAAmB,EAAE,OAAO,6BAA6B,CAAC;IAC1D,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,cAAc,GAAG,IAAI,CAAC;IAC3D,iBAAiB,CACf,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC;IACV,YAAY,CACV,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,OAAO,KAAK,GACvB,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrC,4DAA4D;IAC5D,GAAG,EAAE,kBAAkB,CAAC;IACxB,mBAAmB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;CAClE;AAiBD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,2BAA2B,GACnC,cAAc,CAwKhB"}

package/dist/identity/byo-oauth.js

@@ -0,0 +1,145 @@
+/**
+ * Factory for optional BYO (bring-your-own) OAuth clients used when Fleet
+ * auth-sessions are unavailable.
+ *
+ * Vendor modules supply endpoints, authorize extras, and userinfo parsing;
+ * this module owns config env reading, authorize URL construction, token
+ * exchange, and the {@link FleetVaultByoOauth} adapter.
+ */
+import { fetchWithTimeout, PROVIDER_HTTP_TIMEOUT_MS } from "../runtime/http.js";
+import { oauthTicketsFor } from "./oauth-tickets.js";
+import { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, resolveSlackOauthRedirectBase, } from "./slack/oauth.js";
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, resolveSlackOauthRedirectBase, } from "./slack/oauth.js";
+function stripSlash(value) {
+    return value.replace(/\/$/, "");
+}
+function envKeys(prefix) {
+    return {
+        clientId: `${prefix}_CLIENT_ID`,
+        clientSecret: `${prefix}_CLIENT_SECRET`,
+        scopes: `${prefix}_SCOPES`,
+        authUrl: `${prefix}_AUTH_URL`,
+        tokenUrl: `${prefix}_TOKEN_URL`,
+        userInfoUrl: `${prefix}_USERINFO_URL`,
+    };
+}
+/** Build a BYO OAuth client for one Fleet vault Connect integration. */
+export function createByoOauthClient(options) {
+    const keys = envKeys(options.envPrefix);
+    const tickets = oauthTicketsFor(options.providerId);
+    const authorizeExtras = {
+        prompt: "consent",
+        ...options.authorizeParams,
+    };
+    function readConfig(env = process.env) {
+        const clientId = env[keys.clientId]?.trim();
+        const clientSecret = env[keys.clientSecret]?.trim();
+        const publicAppUrl = env[MDA_PUBLIC_APP_URL_ENV]?.trim() ||
+            env[MDA_PUBLIC_API_URL_ENV]?.trim();
+        if (!clientId || !clientSecret || !publicAppUrl) {
+            return null;
+        }
+        const defaults = options.defaultEndpoints(env);
+        return {
+            clientId,
+            clientSecret,
+            publicAppUrl: stripSlash(publicAppUrl),
+            scopes: env[keys.scopes]?.trim() || defaults.defaultScopes,
+            authUrl: stripSlash(env[keys.authUrl]?.trim() || defaults.authUrl),
+            tokenUrl: stripSlash(env[keys.tokenUrl]?.trim() || defaults.tokenUrl),
+            userInfoUrl: stripSlash(env[keys.userInfoUrl]?.trim() || defaults.userInfoUrl),
+        };
+    }
+    function buildAuthorizeUrl(config, state, redirectUri, scopes) {
+        const url = new URL(config.authUrl);
+        url.searchParams.set("client_id", config.clientId);
+        url.searchParams.set("redirect_uri", redirectUri);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("scope", scopes?.trim() || config.scopes);
+        url.searchParams.set("state", state);
+        for (const [key, value] of Object.entries(authorizeExtras)) {
+            url.searchParams.set(key, value);
+        }
+        return url.toString();
+    }
+    async function exchangeCode(config, code, redirectUri, fetchImpl = fetch) {
+        const body = new URLSearchParams({
+            code,
+            client_id: config.clientId,
+            client_secret: config.clientSecret,
+            redirect_uri: redirectUri,
+            grant_type: "authorization_code",
+        });
+        const tokenResponse = await fetchWithTimeout(config.tokenUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body,
+        }, PROVIDER_HTTP_TIMEOUT_MS, fetchImpl);
+        const tokenJson = (await tokenResponse.json());
+        if (!tokenResponse.ok || !tokenJson.access_token) {
+            throw new Error(tokenJson.error_description ??
+                tokenJson.error ??
+                `${options.displayName} OAuth token exchange failed`);
+        }
+        let accountLabel;
+        let subject;
+        try {
+            const userResponse = await fetchWithTimeout(config.userInfoUrl, {
+                headers: { Authorization: `Bearer ${tokenJson.access_token}` },
+            }, PROVIDER_HTTP_TIMEOUT_MS, fetchImpl);
+            if (userResponse.ok) {
+                const userJson = (await userResponse.json());
+                const parsed = options.parseUserInfo(userJson);
+                if (parsed.email) {
+                    accountLabel = parsed.email;
+                }
+                if (parsed.subject) {
+                    subject = parsed.subject;
+                }
+            }
+        }
+        catch {
+            // Account label is optional for vault import.
+        }
+        return {
+            accessToken: tokenJson.access_token,
+            ...(tokenJson.refresh_token
+                ? { refreshToken: tokenJson.refresh_token }
+                : {}),
+            ...(typeof tokenJson.expires_in === "number"
+                ? { expiresInSeconds: tokenJson.expires_in }
+                : {}),
+            ...(tokenJson.scope ? { scope: tokenJson.scope } : {}),
+            ...(accountLabel ? { accountLabel } : {}),
+            ...(subject
+                ? { metadata: { [options.subjectMetadataKey]: subject } }
+                : {}),
+        };
+    }
+    const byo = {
+        readConfig,
+        buildAuthorizeUrl(config, state, redirectUri, scopes) {
+            return buildAuthorizeUrl(config, state, redirectUri, scopes);
+        },
+        exchangeCode(config, code, redirectUri) {
+            return exchangeCode(config, code, redirectUri);
+        },
+    };
+    function resolvePublicAppUrl(env = process.env) {
+        return (readConfig(env)?.publicAppUrl ??
+            env[MDA_PUBLIC_APP_URL_ENV]?.trim().replace(/\/$/, ""));
+    }
+    return {
+        providerId: options.providerId,
+        displayName: options.displayName,
+        env: keys,
+        tickets,
+        resolveRedirectBase: resolveSlackOauthRedirectBase,
+        readConfig,
+        buildAuthorizeUrl,
+        exchangeCode,
+        byo,
+        resolvePublicAppUrl,
+    };
+}
+//# sourceMappingURL=byo-oauth.js.map

package/dist/identity/byo-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"byo-oauth.js","sourceRoot":"","sources":["../../src/identity/byo-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAKhF,OAAO,EAAE,eAAe,EAAqB,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAoF1B,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO;QACL,QAAQ,EAAE,GAAG,MAAM,YAAY;QAC/B,YAAY,EAAE,GAAG,MAAM,gBAAgB;QACvC,MAAM,EAAE,GAAG,MAAM,SAAS;QAC1B,OAAO,EAAE,GAAG,MAAM,WAAW;QAC7B,QAAQ,EAAE,GAAG,MAAM,YAAY;QAC/B,WAAW,EAAE,GAAG,MAAM,eAAe;KACtC,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,oBAAoB,CAClC,OAAoC;IAEpC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG;QACtB,MAAM,EAAE,SAAS;QACjB,GAAG,OAAO,CAAC,eAAe;KAC3B,CAAC;IAEF,SAAS,UAAU,CACjB,GAAG,GAAsB,OAAO,CAAC,GAAG;QAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;QAC5C,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QACpD,MAAM,YAAY,GAChB,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE;YACnC,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO;YACL,QAAQ;YACR,YAAY;YACZ,YAAY,EAAE,UAAU,CAAC,YAAY,CAAC;YACtC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,aAAa;YAC1D,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC;YAClE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC;YACrE,WAAW,EAAE,UAAU,CACrB,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,WAAW,CACtD;SACF,CAAC;IACJ,CAAC;IAED,SAAS,iBAAiB,CACxB,MAAsB,EACtB,KAAa,EACb,WAAmB,EACnB,MAAe;QAEf,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,UAAU,YAAY,CACzB,MAAsB,EACtB,IAAY,EACZ,WAAmB,EACnB,SAAS,GAAiB,KAAK;QAE/B,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,IAAI;YACJ,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAC1C,MAAM,CAAC,QAAQ,EACf;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI;SACL,EACD,wBAAwB,EACxB,SAAS,CACV,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAQ5C,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,SAAS,CAAC,iBAAiB;gBACzB,SAAS,CAAC,KAAK;gBACf,GAAG,OAAO,CAAC,WAAW,8BAA8B,CACvD,CAAC;QACJ,CAAC;QAED,IAAI,YAAgC,CAAC;QACrC,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,MAAM,CAAC,WAAW,EAClB;gBACE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE,EAAE;aAC/D,EACD,wBAAwB,EACxB,SAAS,CACV,CAAC;YACF,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAA4B,CAAC;gBACxE,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC/C,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC9B,CAAC;gBACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;QAED,OAAO;YACL,WAAW,EAAE,SAAS,CAAC,YAAY;YACnC,GAAG,CAAC,SAAS,CAAC,aAAa;gBACzB,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,aAAa,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ;gBAC1C,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,UAAU,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,OAAO;gBACT,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAuB;QAC9B,UAAU;QACV,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM;YAClD,OAAO,iBAAiB,CACtB,MAAwB,EACxB,KAAK,EACL,WAAW,EACX,MAAM,CACP,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW;YACpC,OAAO,YAAY,CAAC,MAAwB,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACnE,CAAC;KACF,CAAC;IAEF,SAAS,mBAAmB,CAC1B,GAAG,GAAsB,OAAO,CAAC,GAAG;QAEpC,OAAO,CACL,UAAU,CAAC,GAAG,CAAC,EAAE,YAAY;YAC7B,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACvD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,IAAI;QACT,OAAO;QACP,mBAAmB,EAAE,6BAA6B;QAClD,UAAU;QACV,iBAAiB;QACjB,YAAY;QACZ,GAAG;QACH,mBAAmB;KACpB,CAAC;AACJ,CAAC"}