managed-deepagents 0.5.0-dev.79 → 0.5.0-dev.81

package/dist/identity/claims.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Claim-name resolution shared by authoring validation and the runtime token
+ * mapper, so both agree on which claim supplies each envelope field.
+ */
+import type { ClaimMapping } from "./types.js";
+/** The claim supplying the caller id, or `undefined` when none is mapped. */
+export declare function userClaimName(mapping: ClaimMapping): string | undefined;
+/** The claim supplying the active organization id, if any. */
+export declare function organizationClaimName(mapping: ClaimMapping): string | undefined;
+/**
+ * Normalize a `groups` claim value into a list.
+ *
+ * IdPs are inconsistent here: Auth0 and Okta send an array, Entra sends an array
+ * of object ids, and some proxies flatten to a delimited string. Accept all
+ * three rather than making authors pre-process the claim.
+ */
+export declare function normalizeGroups(value: unknown): string[];
+//# sourceMappingURL=claims.d.ts.map

package/dist/identity/claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../src/identity/claims.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAEvE;AAED,8DAA8D;AAC9D,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,YAAY,GACpB,MAAM,GAAG,SAAS,CAEpB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAaxD"}

package/dist/identity/claims.js

@@ -0,0 +1,37 @@
+/**
+ * Claim-name resolution shared by authoring validation and the runtime token
+ * mapper, so both agree on which claim supplies each envelope field.
+ */
+/** The claim supplying the caller id, or `undefined` when none is mapped. */
+export function userClaimName(mapping) {
+    return nonEmpty(mapping.user);
+}
+/** The claim supplying the active organization id, if any. */
+export function organizationClaimName(mapping) {
+    return nonEmpty(mapping.organization);
+}
+/**
+ * Normalize a `groups` claim value into a list.
+ *
+ * IdPs are inconsistent here: Auth0 and Okta send an array, Entra sends an array
+ * of object ids, and some proxies flatten to a delimited string. Accept all
+ * three rather than making authors pre-process the claim.
+ */
+export function normalizeGroups(value) {
+    if (Array.isArray(value)) {
+        return value
+            .map((entry) => String(entry).trim())
+            .filter((entry) => entry.length > 0);
+    }
+    if (typeof value === "string") {
+        return value
+            .split(/[,\s]+/)
+            .map((entry) => entry.trim())
+            .filter((entry) => entry.length > 0);
+    }
+    return [];
+}
+function nonEmpty(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+//# sourceMappingURL=claims.js.map

package/dist/identity/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../src/identity/claims.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,OAAqB;IACjD,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,qBAAqB,CACnC,OAAqB;IAErB,OAAO,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK;aACT,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;aACpC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK;aACT,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC"}

package/dist/identity/connect-inference.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Predicates the built-in Connect-with-X providers use to decide whether a
+ * deployment needs their OAuth routes.
+ *
+ * Authors should not have to list a connect provider that the rest of their
+ * identity already implies — a `connectors.github` (or credential chain that
+ * reads user tokens) on a user-scoped deployment needs Connect-with-GitHub, and
+ * a Slack channel on a per-user deployment needs somewhere to link Slack
+ * accounts.
+ */
+import type { IdentityConnectMountContext } from "./connect-provider-types.js";
+export { FLEET_OAUTH_INTEGRATIONS, GOOGLE_TOOLSERVER_SLUGS, LINKEDIN_TOOLSERVER_SLUGS, MICROSOFT_TOOLSERVER_SLUGS, integrationConnectorKinds, integrationById, integrationForSlug, googleConnectorKinds, googleScopesForConnectorKinds, hasIntegrationToolServerConnector, hasGoogleToolServerConnector, hasLinkedInToolServerConnector, hasMicrosoftToolServerConnector, isFleetOAuthSlug, isGoogleToolServerSlug, isLinkedInToolServerSlug, isMicrosoftToolServerSlug, linkedinConnectorKinds, linkedinScopesForConnectorKinds, microsoftConnectorKinds, microsoftScopesForConnectorKinds, scopesForIntegrationConnectorKinds, type FleetOAuthIntegration, type GoogleToolServerSlug, type LinkedInToolServerSlug, type MicrosoftToolServerSlug, } from "../connectors/toolserver/integrations.js";
+/**
+ * True when the deployment keys anything durable on the individual caller.
+ *
+ * This is the condition under which a per-user OAuth link is meaningful: an
+ * `agent`-scoped deployment has no per-caller slice to attach a linked account
+ * to, so it never grows connect routes by inference.
+ */
+export declare function isUserScopedDeployment(scope: IdentityConnectMountContext["scope"]): boolean;
+/** True when a channel of `provider` is declared (e.g. a Slack channel). */
+export declare function hasChannelForProvider(channels: IdentityConnectMountContext["channels"], provider: string): boolean;
+/**
+ * True when the deployment declares `connectors.github`.
+ *
+ * Same inference trigger Google/Microsoft use for their toolserver connectors:
+ * a GitHub connector on a user-scoped deployment implies Connect-with-GitHub.
+ */
+export declare function hasGithubConnector(connectorKinds: IdentityConnectMountContext["connectorKinds"]): boolean;
+/**
+ * Connect provider ids the deployment's credential resolvers depend on.
+ *
+ * Unions across a per-target map, so a multi-platform deployment is treated the
+ * same as a single-platform one.
+ */
+export declare function credentialConnectIds(credentials: IdentityConnectMountContext["credentials"]): Set<string>;
+export declare function isGoogleConnectorKind(kind: string | undefined): boolean;
+//# sourceMappingURL=connect-inference.d.ts.map

package/dist/identity/connect-inference.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-inference.d.ts","sourceRoot":"","sources":["../../src/identity/connect-inference.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAG/E,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,8BAA8B,EAC9B,+BAA+B,EAC/B,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,gCAAgC,EAChC,kCAAkC,EAClC,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,0CAA0C,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC1C,OAAO,CAOT;AAED,4EAA4E;AAC5E,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,2BAA2B,CAAC,UAAU,CAAC,EACjD,QAAQ,EAAE,MAAM,GACf,OAAO,CAIT;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,cAAc,EAAE,2BAA2B,CAAC,gBAAgB,CAAC,GAC5D,OAAO,CAET;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,2BAA2B,CAAC,aAAa,CAAC,GACtD,GAAG,CAAC,MAAM,CAAC,CAIb;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEvE"}

package/dist/identity/connect-inference.js

@@ -0,0 +1,55 @@
+/**
+ * Predicates the built-in Connect-with-X providers use to decide whether a
+ * deployment needs their OAuth routes.
+ *
+ * Authors should not have to list a connect provider that the rest of their
+ * identity already implies — a `connectors.github` (or credential chain that
+ * reads user tokens) on a user-scoped deployment needs Connect-with-GitHub, and
+ * a Slack channel on a per-user deployment needs somewhere to link Slack
+ * accounts.
+ */
+import { GITHUB_SLUG } from "../connectors/toolserver/catalog.js";
+import { isGoogleToolServerSlug } from "../connectors/toolserver/integrations.js";
+import { credentialConnectProviders } from "./credential-resolvers.js";
+export { FLEET_OAUTH_INTEGRATIONS, GOOGLE_TOOLSERVER_SLUGS, LINKEDIN_TOOLSERVER_SLUGS, MICROSOFT_TOOLSERVER_SLUGS, integrationConnectorKinds, integrationById, integrationForSlug, googleConnectorKinds, googleScopesForConnectorKinds, hasIntegrationToolServerConnector, hasGoogleToolServerConnector, hasLinkedInToolServerConnector, hasMicrosoftToolServerConnector, isFleetOAuthSlug, isGoogleToolServerSlug, isLinkedInToolServerSlug, isMicrosoftToolServerSlug, linkedinConnectorKinds, linkedinScopesForConnectorKinds, microsoftConnectorKinds, microsoftScopesForConnectorKinds, scopesForIntegrationConnectorKinds, } from "../connectors/toolserver/integrations.js";
+/**
+ * True when the deployment keys anything durable on the individual caller.
+ *
+ * This is the condition under which a per-user OAuth link is meaningful: an
+ * `agent`-scoped deployment has no per-caller slice to attach a linked account
+ * to, so it never grows connect routes by inference.
+ */
+export function isUserScopedDeployment(scope) {
+    if (!scope) {
+        return false;
+    }
+    // Per-caller Connect is meaningful when credentials are owned by the caller
+    // (`"user"`) or a custom resolver. Memory isolation is a separate axis.
+    return scope.credentials === "user" || scope.credentials === "custom";
+}
+/** True when a channel of `provider` is declared (e.g. a Slack channel). */
+export function hasChannelForProvider(channels, provider) {
+    return Object.values(channels ?? {}).some((manifest) => manifest?.provider === provider);
+}
+/**
+ * True when the deployment declares `connectors.github`.
+ *
+ * Same inference trigger Google/Microsoft use for their toolserver connectors:
+ * a GitHub connector on a user-scoped deployment implies Connect-with-GitHub.
+ */
+export function hasGithubConnector(connectorKinds) {
+    return (connectorKinds ?? []).some((kind) => kind === GITHUB_SLUG);
+}
+/**
+ * Connect provider ids the deployment's credential resolvers depend on.
+ *
+ * Unions across a per-target map, so a multi-platform deployment is treated the
+ * same as a single-platform one.
+ */
+export function credentialConnectIds(credentials) {
+    return new Set(credentialConnectProviders(credentials).map((provider) => provider.id));
+}
+export function isGoogleConnectorKind(kind) {
+    return isGoogleToolServerSlug(kind);
+}
+//# sourceMappingURL=connect-inference.js.map

package/dist/identity/connect-inference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-inference.js","sourceRoot":"","sources":["../../src/identity/connect-inference.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAElF,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAEvE,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,8BAA8B,EAC9B,+BAA+B,EAC/B,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,gCAAgC,EAChC,kCAAkC,GAKnC,MAAM,0CAA0C,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAA2C;IAE3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IACD,4EAA4E;IAC5E,wEAAwE;IACxE,OAAO,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC;AACxE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CACnC,QAAiD,EACjD,QAAgB;IAEhB,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CACvC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAC9C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,cAA6D;IAE7D,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAuD;IAEvD,OAAO,IAAI,GAAG,CACZ,0BAA0B,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC"}

package/dist/identity/connect-provider-types.d.ts

@@ -1,9 +1,12 @@
 /**
  * Connect-with-X plugin contract.
  *
- * List providers on `identity.connect` (e.g. `github.connect()`) to mount
+ * List providers on `identity.connect` (e.g. `connect.github()`) to mount
  * `/identity/{id}/{status,connect,callback,link}` from the managed HTTP app.
+ * Built-in providers also mount when the deployment implies them (see
+ * {@link IdentityConnectMountContext}).
  */
+import type { IdentityConfig } from "./types.js";
 /** Context for deciding whether a provider's routes should mount. */
 export interface IdentityConnectMountContext {
     /** Compiled channel manifests (file stem → manifest). */
@@ -12,6 +15,27 @@ export interface IdentityConnectMountContext {
     }>;
     /** True when the project declared managed identity. */
     hasIdentity: boolean;
+    /**
+     * True when this provider appears on `identity.connect`. False when it is
+     * offered as a built-in candidate, in which case the provider's own predicate
+     * decides whether the deployment needs it.
+     */
+    declared?: boolean;
+    /** The deployment's resolved isolation axes. */
+    scope?: IdentityConfig["scope"];
+    /**
+     * The deployment's credential config, when one is declared: a single resolver
+     * or a per-target map. Prefer `credentialConnectIds(ctx.credentials)` over
+     * reading it directly, so both forms are handled.
+     */
+    credentials?: IdentityConfig["credentials"];
+    /**
+     * Connector `kind` values discovered for the deployment (toolserver slugs,
+     * `github`, `slack`, …). Used to infer Connect-with-X from matching
+     * connectors (GitHub, Google, Microsoft, LinkedIn) without listing
+     * `connect.<provider>()` on identity.
+     */
+    connectorKinds?: readonly (string | undefined)[];
 }
 /** JSON object returned by status / error payloads. */
 export type IdentityConnectJson = Record<string, unknown>;
@@ -49,20 +73,25 @@ export interface IdentityConnectProvider {
     readonly settingsQueryKey?: string;
     /** Whether to mount this provider's four routes for the current project. */
     shouldMount(ctx: IdentityConnectMountContext): boolean;
-    /** Secured status payload for the authenticated actor. */
-    status(actorId: string): IdentityConnectJson | Promise<IdentityConnectJson>;
+    /** Secured status payload for the authenticated user. */
+    status(userId: string): IdentityConnectJson | Promise<IdentityConnectJson>;
     /** Begin OAuth — return authorize URL or a not-configured error. */
-    startAuthorize(actorId: string, redirectUri: string): IdentityConnectAuthorizeResult | Promise<IdentityConnectAuthorizeResult>;
+    startAuthorize(userId: string, redirectUri: string): IdentityConnectAuthorizeResult | Promise<IdentityConnectAuthorizeResult>;
     /**
      * Finish OAuth callback. Throw on failure; the scaffold redirects to
      * `/settings?{settingsQueryKey}=error`.
      */
     completeCallback(code: string, state: string, redirectUri: string): IdentityConnectCallbackResult | Promise<IdentityConnectCallbackResult>;
-    /** Remove the actor's link / stored credentials. */
-    unlink(actorId: string): void | Promise<void>;
+    /** Remove the user's link / stored credentials. */
+    unlink(userId: string): void | Promise<void>;
     /** Resolve the public Agent Server base for `redirect_uri`. */
     resolveRedirectBase(options: IdentityConnectRedirectBaseOptions): string;
     /** Public app origin for settings fail/success redirects when available. */
     resolvePublicAppUrl?(): string | undefined;
+    /**
+     * Optional: resolve a caller from a signed `?ticket=` on the connect start
+     * route (channel actors without a browser session). Returns the actor user id.
+     */
+    resolveConnectTicket?(ticket: string): string | Promise<string>;
 }
 //# sourceMappingURL=connect-provider-types.d.ts.map

package/dist/identity/connect-provider-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-provider-types.d.ts","sourceRoot":"","sources":["../../src/identity/connect-provider-types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qEAAqE;AACrE,MAAM,WAAW,2BAA2B;IAC1C,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,uDAAuD;IACvD,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,uDAAuD;AACvD,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1D,MAAM,MAAM,8BAA8B,GACtC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,GACxB;IAAE,aAAa,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C,MAAM,MAAM,6BAA6B,GAAG;IAC1C,oEAAoE;IACpE,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,oEAAoE;AACpE,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;KAAE,CAAC;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,4EAA4E;IAC5E,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC;IACvD,0DAA0D;IAC1D,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5E,oEAAoE;IACpE,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,8BAA8B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC5E;;;OAGG;IACH,gBAAgB,CACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,6BAA6B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC1E,oDAAoD;IACpD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,+DAA+D;IAC/D,mBAAmB,CAAC,OAAO,EAAE,kCAAkC,GAAG,MAAM,CAAC;IACzE,4EAA4E;IAC5E,mBAAmB,CAAC,IAAI,MAAM,GAAG,SAAS,CAAC;CAC5C"}
+{"version":3,"file":"connect-provider-types.d.ts","sourceRoot":"","sources":["../../src/identity/connect-provider-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,qEAAqE;AACrE,MAAM,WAAW,2BAA2B;IAC1C,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,uDAAuD;IACvD,WAAW,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IAChC;;;;OAIG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,cAAc,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;CAClD;AAED,uDAAuD;AACvD,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1D,MAAM,MAAM,8BAA8B,GACtC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,GACxB;IAAE,aAAa,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C,MAAM,MAAM,6BAA6B,GAAG;IAC1C,oEAAoE;IACpE,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,oEAAoE;AACpE,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;KAAE,CAAC;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,4EAA4E;IAC5E,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC;IACvD,yDAAyD;IACzD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC3E,oEAAoE;IACpE,cAAc,CACZ,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,8BAA8B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC5E;;;OAGG;IACH,gBAAgB,CACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,6BAA6B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC1E,mDAAmD;IACnD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,+DAA+D;IAC/D,mBAAmB,CAAC,OAAO,EAAE,kCAAkC,GAAG,MAAM,CAAC;IACzE,4EAA4E;IAC5E,mBAAmB,CAAC,IAAI,MAAM,GAAG,SAAS,CAAC;IAC3C;;;OAGG;IACH,oBAAoB,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACjE"}

package/dist/identity/connect-provider-types.js

@@ -1,8 +1,10 @@
 /**
  * Connect-with-X plugin contract.
  *
- * List providers on `identity.connect` (e.g. `github.connect()`) to mount
+ * List providers on `identity.connect` (e.g. `connect.github()`) to mount
  * `/identity/{id}/{status,connect,callback,link}` from the managed HTTP app.
+ * Built-in providers also mount when the deployment implies them (see
+ * {@link IdentityConnectMountContext}).
  */
 export {};
 //# sourceMappingURL=connect-provider-types.js.map

package/dist/identity/connect-provider-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-provider-types.js","sourceRoot":"","sources":["../../src/identity/connect-provider-types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}
+{"version":3,"file":"connect-provider-types.js","sourceRoot":"","sources":["../../src/identity/connect-provider-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/identity/connect-provider.d.ts

@@ -17,14 +17,19 @@ export interface IdentityConnectMountedRoute {
 }
 export declare function identityConnectSettingsQueryKey(provider: IdentityConnectProvider): string;
 /**
- * Mount Connect-with-X routes for the given providers.
+ * Mount Connect-with-X routes.
  *
- * Authors opt in via `defineIdentity({ connect: [github.connect(), …] })`.
- * An empty list mounts nothing — there is no builtin auto-mount.
+ * Declared providers (`defineIdentity({ connect: [connect.github(), …] })`) are
+ * offered first, then any `candidates` the deployment did not list. Every
+ * provider still decides for itself via `shouldMount`, which sees whether it was
+ * declared — so a built-in can mount because the rest of the identity implies it
+ * without ever mounting on a deployment that has no use for it.
  */
 export declare function mountIdentityConnectProviders(app: Hono, cfg: IdentityConfig, ctx: IdentityConnectMountContext, mounted: IdentityConnectMountedRoute[], options?: {
     deploymentBaseUrl?: string;
-    /** Providers from `identity.connect` (required for production mounts). */
+    /** Providers from `identity.connect`. */
     providers?: IdentityConnectProvider[];
+    /** Built-in providers to offer when the deployment did not list them. */
+    candidates?: IdentityConnectProvider[];
 }): void;
 //# sourceMappingURL=connect-provider.d.ts.map

package/dist/identity/connect-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-provider.d.ts","sourceRoot":"","sources":["../../src/identity/connect-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,6BAA6B,CAAC;AAIrC,YAAY,EACV,8BAA8B,EAC9B,6BAA6B,EAC7B,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,kCAAkC,GACnC,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,uBAAuB,GAChC,MAAM,CAER;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,EACT,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,2BAA2B,EAChC,OAAO,EAAE,2BAA2B,EAAE,EACtC,OAAO,GAAE;IACP,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,SAAS,CAAC,EAAE,uBAAuB,EAAE,CAAC;CAClC,GACL,IAAI,CAQN"}
+{"version":3,"file":"connect-provider.d.ts","sourceRoot":"","sources":["../../src/identity/connect-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,6BAA6B,CAAC;AAIrC,YAAY,EACV,8BAA8B,EAC9B,6BAA6B,EAC7B,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,kCAAkC,GACnC,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,uBAAuB,GAChC,MAAM,CAER;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,EACT,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,2BAA2B,EAChC,OAAO,EAAE,2BAA2B,EAAE,EACtC,OAAO,GAAE;IACP,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yCAAyC;IACzC,SAAS,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACtC,yEAAyE;IACzE,UAAU,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACnC,GACL,IAAI,CAeN"}

package/dist/identity/connect-provider.js

@@ -11,15 +11,25 @@ export function identityConnectSettingsQueryKey(provider) {
     return provider.settingsQueryKey?.trim() || provider.id;
 }
 /**
- * Mount Connect-with-X routes for the given providers.
+ * Mount Connect-with-X routes.
  *
- * Authors opt in via `defineIdentity({ connect: [github.connect(), …] })`.
- * An empty list mounts nothing — there is no builtin auto-mount.
+ * Declared providers (`defineIdentity({ connect: [connect.github(), …] })`) are
+ * offered first, then any `candidates` the deployment did not list. Every
+ * provider still decides for itself via `shouldMount`, which sees whether it was
+ * declared — so a built-in can mount because the rest of the identity implies it
+ * without ever mounting on a deployment that has no use for it.
  */
 export function mountIdentityConnectProviders(app, cfg, ctx, mounted, options = {}) {
-    const providers = options.providers ?? [];
-    for (const provider of providers) {
-        if (!provider.shouldMount(ctx)) {
+    const declared = options.providers ?? [];
+    const declaredIds = new Set(declared.map((provider) => provider.id));
+    const offered = [
+        ...declared.map((provider) => ({ provider, declared: true })),
+        ...(options.candidates ?? [])
+            .filter((provider) => !declaredIds.has(provider.id))
+            .map((provider) => ({ provider, declared: false })),
+    ];
+    for (const { provider, declared: isDeclared } of offered) {
+        if (!provider.shouldMount({ ...ctx, declared: isDeclared })) {
             continue;
         }
         mountOneIdentityConnectProvider(app, cfg, provider, mounted, options);
@@ -47,15 +57,31 @@ function mountOneIdentityConnectProvider(app, cfg, provider, mounted, options) {
         if (identity instanceof Response) {
             return identity;
         }
-        return c.json(await provider.status(identity.actor.id));
+        return c.json(await provider.status(identity.user.id));
     });
     app.get(paths.connect, async (c) => {
-        const identity = await resolveOrUnauthorized(cfg, c.req.raw);
-        if (identity instanceof Response) {
-            return identity;
+        const ticket = c.req.query("ticket")?.trim();
+        let userId;
+        if (ticket && provider.resolveConnectTicket) {
+            try {
+                userId = await provider.resolveConnectTicket(ticket);
+            }
+            catch (error) {
+                const message = error instanceof Error && error.message
+                    ? error.message
+                    : "invalid connect ticket";
+                return c.json({ error: message }, 401);
+            }
+        }
+        else {
+            const identity = await resolveOrUnauthorized(cfg, c.req.raw);
+            if (identity instanceof Response) {
+                return identity;
+            }
+            userId = identity.user.id;
         }
         const redirectUri = callbackRedirectUri(provider, c.req.raw, options.deploymentBaseUrl);
-        const result = await provider.startAuthorize(identity.actor.id, redirectUri);
+        const result = await provider.startAuthorize(userId, redirectUri);
         if ("notConfigured" in result) {
             return c.json({ error: result.error }, 503);
         }
@@ -92,7 +118,7 @@ function mountOneIdentityConnectProvider(app, cfg, provider, mounted, options) {
         if (identity instanceof Response) {
             return identity;
         }
-        await provider.unlink(identity.actor.id);
+        await provider.unlink(identity.user.id);
         return c.json({ linked: false });
     });
 }

package/dist/identity/connect-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-provider.js","sourceRoot":"","sources":["../../src/identity/connect-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAK1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAW1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAU1D,MAAM,UAAU,+BAA+B,CAC7C,QAAiC;IAEjC,OAAO,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,GAAS,EACT,GAAmB,EACnB,GAAgC,EAChC,OAAsC,EACtC,OAAO,GAIH,EAAE;IAEN,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IAC1C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CACtC,GAAS,EACT,GAAmB,EACnB,QAAiC,EACjC,OAAsC,EACtC,OAAuC;IAEvC,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,YAAY,QAAQ,CAAC,EAAE,UAAU,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI;QAClB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;QACpD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;QACrD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QACvD,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;KAC7C,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC;YACX,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,EACR,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,EACjB,WAAW,CACZ,CAAC;QACF,IAAI,eAAe,IAAI,MAAM,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,SAAS,GACb,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,MAAM;YAChC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAC9D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,SAAS,GACb,QAAQ,CAAC,mBAAmB,EAAE,EAAE;YAChC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAG,SAAS;YAC5B,CAAC,CAAC,GAAG,SAAS,aAAa,WAAW,QAAQ;YAC9C,CAAC,CAAC,GAAG,CAAC;QACR,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,EACR,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,OAAO,CAAC,iBAAiB,CAC1B,CAAC;YACF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CACzD,IAAI,EACJ,KAAK,EACL,WAAW,CACZ,CAAC;YACF,OAAO,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,SAAS,QAAQ,CAAC,EAAE,yBAAyB,EAAE,KAAK,CAAC,CAAC;YACpE,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAiC,EACjC,OAAgB,EAChB,iBAA0B;IAE1B,MAAM,IAAI,GAAG,QAAQ,CAAC,mBAAmB,CAAC;QACxC,UAAU,EAAE,OAAO,CAAC,GAAG;QACvB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB;KAClB,CAAC,CAAC;IACH,OAAO,GAAG,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,GAAmB,EACnB,OAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ;YACxD,CAAC,CAAE,KAA4B,CAAC,MAAM;YACtC,CAAC,CAAC,GAAG,CAAC;QACV,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;QAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE;YACtD,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}
+{"version":3,"file":"connect-provider.js","sourceRoot":"","sources":["../../src/identity/connect-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAK1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAW1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAU1D,MAAM,UAAU,+BAA+B,CAC7C,QAAiC;IAEjC,OAAO,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAC3C,GAAS,EACT,GAAmB,EACnB,GAAgC,EAChC,OAAsC,EACtC,OAAO,GAMH,EAAE;IAEN,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG;QACd,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;KACtD,CAAC;IACF,KAAK,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,OAAO,EAAE,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CACtC,GAAS,EACT,GAAmB,EACnB,QAAiC,EACjC,OAAsC,EACtC,OAAuC;IAEvC,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,YAAY,QAAQ,CAAC,EAAE,UAAU,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI;QAClB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;QACpD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;QACrD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QACvD,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;KAC7C,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC;YACX,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,MAAc,CAAC;QACnB,IAAI,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO;oBACrC,CAAC,CAAC,KAAK,CAAC,OAAO;oBACf,CAAC,CAAC,wBAAwB,CAAC;gBAC/B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;gBACjC,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,EACR,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,eAAe,IAAI,MAAM,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,SAAS,GACb,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,MAAM;YAChC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAC9D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,SAAS,GACb,QAAQ,CAAC,mBAAmB,EAAE,EAAE;YAChC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAG,SAAS;YAC5B,CAAC,CAAC,GAAG,SAAS,aAAa,WAAW,QAAQ;YAC9C,CAAC,CAAC,GAAG,CAAC;QACR,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,EACR,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,OAAO,CAAC,iBAAiB,CAC1B,CAAC;YACF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CACzD,IAAI,EACJ,KAAK,EACL,WAAW,CACZ,CAAC;YACF,OAAO,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,SAAS,QAAQ,CAAC,EAAE,yBAAyB,EAAE,KAAK,CAAC,CAAC;YACpE,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAiC,EACjC,OAAgB,EAChB,iBAA0B;IAE1B,MAAM,IAAI,GAAG,QAAQ,CAAC,mBAAmB,CAAC;QACxC,UAAU,EAAE,OAAO,CAAC,GAAG;QACvB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB;KAClB,CAAC,CAAC;IACH,OAAO,GAAG,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,GAAmB,EACnB,OAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ;YACxD,CAAC,CAAE,KAA4B,CAAC,MAAM;YACtC,CAAC,CAAC,GAAG,CAAC;QACV,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;QAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE;YACtD,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/identity/credential-resolvers.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Shape helpers for the two `credentials` forms, shared by authoring validation,
+ * normalization, and the runtime resolver so all three agree on which form a
+ * config is.
+ *
+ * A single resolver handles every target itself. A per-target map lets one
+ * deployment integrate several platforms without hand-writing the dispatch — and
+ * without losing the Connect-with-X routes each entry declares, which is the
+ * failure mode a hand-written dispatcher has.
+ */
+import type { IdentityConnectProvider } from "./connect-provider-types.js";
+import type { CredentialResolverConfig, CredentialResolvers } from "./types.js";
+/**
+ * True when `value` is a single {@link CredentialResolverConfig} rather than a
+ * per-target map.
+ *
+ * Discriminates on the *type* of `resolve`/`endpoint`, not merely their
+ * presence, so a target legitimately named `"resolve"` or `"endpoint"` in a map
+ * is not mistaken for the single form.
+ */
+export declare function isSingleCredentialResolver(value: CredentialResolverConfig | CredentialResolvers): value is CredentialResolverConfig;
+/** The target names a per-target map resolves, in declaration order. */
+export declare function credentialTargetNames(value: CredentialResolverConfig | CredentialResolvers): string[];
+/**
+ * Every Connect-with-X provider the config depends on, deduplicated by id and in
+ * declaration order.
+ *
+ * Unioning across map entries is what keeps inference working for a
+ * multi-platform deployment: each entry declares its own routes, and the author
+ * repeats none of them.
+ */
+export declare function credentialConnectProviders(value: CredentialResolverConfig | CredentialResolvers | undefined): IdentityConnectProvider[];
+//# sourceMappingURL=credential-resolvers.d.ts.map

package/dist/identity/credential-resolvers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-resolvers.d.ts","sourceRoot":"","sources":["../../src/identity/credential-resolvers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEhF;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,GACpD,KAAK,IAAI,wBAAwB,CAWnC;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,GACpD,MAAM,EAAE,CAEV;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,GAAG,SAAS,GAChE,uBAAuB,EAAE,CAgB3B"}

package/dist/identity/credential-resolvers.js

@@ -0,0 +1,62 @@
+/**
+ * Shape helpers for the two `credentials` forms, shared by authoring validation,
+ * normalization, and the runtime resolver so all three agree on which form a
+ * config is.
+ *
+ * A single resolver handles every target itself. A per-target map lets one
+ * deployment integrate several platforms without hand-writing the dispatch — and
+ * without losing the Connect-with-X routes each entry declares, which is the
+ * failure mode a hand-written dispatcher has.
+ */
+/**
+ * True when `value` is a single {@link CredentialResolverConfig} rather than a
+ * per-target map.
+ *
+ * Discriminates on the *type* of `resolve`/`endpoint`, not merely their
+ * presence, so a target legitimately named `"resolve"` or `"endpoint"` in a map
+ * is not mistaken for the single form.
+ */
+export function isSingleCredentialResolver(value) {
+    const candidate = value;
+    if (typeof candidate.resolve === "function") {
+        return true;
+    }
+    const endpoint = candidate.endpoint;
+    return (typeof endpoint === "object" &&
+        endpoint !== null &&
+        typeof endpoint.url === "string");
+}
+/** The target names a per-target map resolves, in declaration order. */
+export function credentialTargetNames(value) {
+    return isSingleCredentialResolver(value) ? [] : Object.keys(value);
+}
+/**
+ * Every Connect-with-X provider the config depends on, deduplicated by id and in
+ * declaration order.
+ *
+ * Unioning across map entries is what keeps inference working for a
+ * multi-platform deployment: each entry declares its own routes, and the author
+ * repeats none of them.
+ */
+export function credentialConnectProviders(value) {
+    if (value === undefined || value === null || typeof value !== "object") {
+        return [];
+    }
+    const configs = isSingleCredentialResolver(value)
+        ? [value]
+        : Object.values(value);
+    const out = [];
+    for (const config of configs) {
+        for (const provider of declaredConnect(config)) {
+            if (!out.some((existing) => existing.id === provider.id)) {
+                out.push(provider);
+            }
+        }
+    }
+    return out;
+}
+function declaredConnect(config) {
+    const connect = config?.connect;
+    return Array.isArray(connect) ? connect : [];
+}
+//# sourceMappingURL=credential-resolvers.js.map

package/dist/identity/credential-resolvers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-resolvers.js","sourceRoot":"","sources":["../../src/identity/credential-resolvers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAqD;IAErD,MAAM,SAAS,GAAG,KAAkD,CAAC;IACrE,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;IACpC,OAAO,CACL,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,KAAK,IAAI;QACjB,OAAQ,QAA8B,CAAC,GAAG,KAAK,QAAQ,CACxD,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,qBAAqB,CACnC,KAAqD;IAErD,OAAO,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAiE;IAEjE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC;QAC/C,CAAC,CAAC,CAAC,KAAK,CAAC;QACT,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,GAAG,GAA8B,EAAE,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,QAAQ,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,MAAe;IACtC,MAAM,OAAO,GAAI,MAA4C,EAAE,OAAO,CAAC;IACvE,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAAqC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9E,CAAC"}

package/dist/identity/fleet-connect-hint.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Runtime hint when the caller has not completed Connect-with-X for a Fleet
+ * vault integration yet.
+ *
+ * Prefers Connect status over toolserver 428 (agent subjects skip that today).
+ */
+import { type FleetOAuthIntegration } from "../connectors/toolserver/integrations.js";
+import type { ManagedMiddleware } from "../runtime/managed-middleware.js";
+import { listAgentConnections, type FleetClientOptions } from "./fleet.js";
+export interface FleetConnectHintMiddlewareOptions {
+    integration: FleetOAuthIntegration;
+    providerSlug?: string;
+    fleet?: FleetClientOptions & {
+        list?: typeof listAgentConnections;
+    };
+    /** Override status lookup (tests). */
+    isConnected?: (userId: string) => Promise<boolean>;
+    /** Optional public-app resolver (BYO OAuth publicAppUrl). */
+    resolvePublicAppUrl?: (env?: NodeJS.ProcessEnv) => string | undefined;
+}
+/**
+ * Absolute Connect start URL for agent hints.
+ *
+ * Prefers the Agent Server origin (`MDA_PUBLIC_API_URL`) where
+ * `/identity/{id}/*` is mounted. Falls back to `MDA_PUBLIC_APP_URL`.
+ *
+ * When `userId` and a signing key are available, appends a short-lived
+ * `?ticket=` so the browser session binds OAuth to that actor.
+ */
+export declare function fleetConnectHintUrl(integration: FleetOAuthIntegration, env?: NodeJS.ProcessEnv, userId?: string, resolvePublicAppUrl?: (env?: NodeJS.ProcessEnv) => string | undefined): Promise<string>;
+/**
+ * Middleware that injects a system hint when actor-subject mode is on for
+ * `integration` and the current caller has no LangSmith vault connection.
+ */
+export declare function createFleetConnectHintMiddleware(options: FleetConnectHintMiddlewareOptions): ManagedMiddleware;
+/** Rewrite tool errors that look like a missing Fleet vault connection. */
+export declare function rewriteFleetToolError(error: unknown, integration: FleetOAuthIntegration, resolvePublicAppUrl?: (env?: NodeJS.ProcessEnv) => string | undefined): Error;
+export declare function isFleetConnectHint(message: string, integration: FleetOAuthIntegration): boolean;
+//# sourceMappingURL=fleet-connect-hint.d.ts.map

package/dist/identity/fleet-connect-hint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-connect-hint.d.ts","sourceRoot":"","sources":["../../src/identity/fleet-connect-hint.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAS1E,OAAO,EAAE,oBAAoB,EAAE,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAQ3E,MAAM,WAAW,iCAAiC;IAChD,WAAW,EAAE,qBAAqB,CAAC;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,kBAAkB,GAAG;QAC3B,IAAI,CAAC,EAAE,OAAO,oBAAoB,CAAC;KACpC,CAAC;IACF,sCAAsC;IACtC,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,6DAA6D;IAC7D,mBAAmB,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,KAAK,MAAM,GAAG,SAAS,CAAC;CACvE;AAMD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,qBAAqB,EAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,MAAM,CAAC,EAAE,MAAM,EACf,mBAAmB,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,KAAK,MAAM,GAAG,SAAS,GACpE,OAAO,CAAC,MAAM,CAAC,CA+BjB;AAoBD;;;GAGG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,iCAAiC,GACzC,iBAAiB,CAiEnB;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,WAAW,EAAE,qBAAqB,EAClC,mBAAmB,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,KAAK,MAAM,GAAG,SAAS,GACpE,KAAK,CAuBP;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,qBAAqB,GACjC,OAAO,CAET"}