managed-deepagents 0.5.0-dev.79 → 0.5.0-dev.81

package/dist/identity/google/connect-http.js

@@ -0,0 +1,59 @@
+/**
+ * Connect-with-Google — thin adapter over {@link createFleetIntegrationConnectProvider}.
+ *
+ * Mounted under `/identity/google/*` when listed on `identity.connect`, or
+ * inferred from declared Google toolserver connectors on a user-scoped
+ * deployment.
+ */
+import { GOOGLE_INTEGRATION } from "../../connectors/toolserver/integrations.js";
+import { enableActorSubjectIntegration, enableActorSubjectIntegrationFromConnectors, isActorSubjectIntegrationEnabled, resetActorSubjectEnabledForTests, } from "../actor-subject.js";
+import { identityConnectPaths } from "../connect-paths.js";
+import { createFleetIntegrationConnectProvider, fleetIntegrationConnectUrl, isFleetIntegrationConnectConfigured, } from "../fleet-integration-connect.js";
+import { googleByoOauth } from "./oauth.js";
+const PATHS = identityConnectPaths("google");
+export const GOOGLE_CONNECT_STATUS_PATH = PATHS.status;
+export const GOOGLE_CONNECT_START_PATH = PATHS.connect;
+export const GOOGLE_CONNECT_CALLBACK_PATH = PATHS.callback;
+export const GOOGLE_CONNECT_LINK_PATH = PATHS.link;
+export function isGoogleActorSubjectEnabled() {
+    return isActorSubjectIntegrationEnabled("google");
+}
+export function enableGoogleActorSubject() {
+    enableActorSubjectIntegration("google");
+}
+/**
+ * Enable actor-subject mode when Google connectors imply per-user vault subjects.
+ *
+ * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
+ */
+export function enableGoogleActorSubjectFromConnectors(connectorKinds, scope) {
+    enableActorSubjectIntegrationFromConnectors(GOOGLE_INTEGRATION, connectorKinds, scope);
+}
+export function resetGoogleActorSubjectEnabledForTests() {
+    resetActorSubjectEnabledForTests();
+}
+export function isGoogleConnectConfigured(env = process.env) {
+    return isFleetIntegrationConnectConfigured(googleByoOauth, env);
+}
+export function googleConnectUrl(publicAppUrl) {
+    return fleetIntegrationConnectUrl(GOOGLE_INTEGRATION, publicAppUrl);
+}
+/** Build a Google connect provider. */
+export function createGoogleIdentityConnectProvider(options = {}) {
+    return createFleetIntegrationConnectProvider(GOOGLE_INTEGRATION, googleByoOauth, options, ["openid", "email", "profile"]);
+}
+/** Default Google connect provider used as a built-in mount candidate. */
+export const googleIdentityConnectProvider = createGoogleIdentityConnectProvider();
+/**
+ * Opt into Connect-with-Google on `defineIdentity({ connect: […] })`.
+ *
+ * Usually unnecessary: declaring Google toolserver connectors on a user-scoped
+ * identity deployment mounts this provider and derives OAuth scopes automatically.
+ */
+export function connect(options) {
+    enableGoogleActorSubject();
+    return options
+        ? createGoogleIdentityConnectProvider(options)
+        : googleIdentityConnectProvider;
+}
+//# sourceMappingURL=connect-http.js.map

package/dist/identity/google/connect-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/google/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACjF,OAAO,EACL,6BAA6B,EAC7B,2CAA2C,EAC3C,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAK3D,OAAO,EACL,qCAAqC,EACrC,0BAA0B,EAC1B,mCAAmC,GAEpC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC,MAAM,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,OAAO,CAAC;AACvD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,IAAI,CAAC;AAEnD,MAAM,UAAU,2BAA2B;IACzC,OAAO,gCAAgC,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,6BAA6B,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sCAAsC,CACpD,cAA2D,EAC3D,KAA4C;IAE5C,2CAA2C,CACzC,kBAAkB,EAClB,cAAc,EACd,KAAK,CACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC;IACpD,gCAAgC,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,mCAAmC,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,OAAO,0BAA0B,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;AACtE,CAAC;AAMD,uCAAuC;AACvC,MAAM,UAAU,mCAAmC,CACjD,OAAO,GAAyC,EAAE;IAElD,OAAO,qCAAqC,CAC1C,kBAAkB,EAClB,cAAc,EACd,OAAO,EACP,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,MAAM,6BAA6B,GACxC,mCAAmC,EAAE,CAAC;AAExC;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CACrB,OAA8C;IAE9C,wBAAwB,EAAE,CAAC;IAC3B,OAAO,OAAO;QACZ,CAAC,CAAC,mCAAmC,CAAC,OAAO,CAAC;QAC9C,CAAC,CAAC,6BAA6B,CAAC;AACpC,CAAC"}

package/dist/identity/google/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Google identity helpers — Connect-with-Google.
+ */
+export { connect, createGoogleIdentityConnectProvider, enableGoogleActorSubject, enableGoogleActorSubjectFromConnectors, googleConnectUrl, googleIdentityConnectProvider, isGoogleActorSubjectEnabled, isGoogleConnectConfigured, resetGoogleActorSubjectEnabledForTests, GOOGLE_CONNECT_CALLBACK_PATH, GOOGLE_CONNECT_LINK_PATH, GOOGLE_CONNECT_START_PATH, GOOGLE_CONNECT_STATUS_PATH, } from "./connect-http.js";
+export type { GoogleIdentityConnectProviderOptions } from "./connect-http.js";
+export { googleOauthTickets } from "./oauth.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/google/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/google/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,mCAAmC,EACnC,wBAAwB,EACxB,sCAAsC,EACtC,gBAAgB,EAChB,6BAA6B,EAC7B,2BAA2B,EAC3B,yBAAyB,EACzB,sCAAsC,EACtC,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,oCAAoC,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}

package/dist/identity/google/index.js

@@ -0,0 +1,6 @@
+/**
+ * Google identity helpers — Connect-with-Google.
+ */
+export { connect, createGoogleIdentityConnectProvider, enableGoogleActorSubject, enableGoogleActorSubjectFromConnectors, googleConnectUrl, googleIdentityConnectProvider, isGoogleActorSubjectEnabled, isGoogleConnectConfigured, resetGoogleActorSubjectEnabledForTests, GOOGLE_CONNECT_CALLBACK_PATH, GOOGLE_CONNECT_LINK_PATH, GOOGLE_CONNECT_START_PATH, GOOGLE_CONNECT_STATUS_PATH, } from "./connect-http.js";
+export { googleOauthTickets } from "./oauth.js";
+//# sourceMappingURL=index.js.map

package/dist/identity/google/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/google/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,mCAAmC,EACnC,wBAAwB,EACxB,sCAAsC,EACtC,gBAAgB,EAChB,6BAA6B,EAC7B,2BAA2B,EAC3B,yBAAyB,EACzB,sCAAsC,EACtC,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}

package/dist/identity/google/oauth.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Google BYO OAuth descriptor — optional non-LangSmith Connect-with-Google.
+ * The default path uses Fleet auth-sessions instead.
+ */
+import { type ByoOauthConfig, type ByoOauthClient } from "../byo-oauth.js";
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, } from "../byo-oauth.js";
+export type GoogleOauthConfig = ByoOauthConfig;
+/** Google BYO OAuth client (config, authorize, exchange, Fleet adapter). */
+export declare const googleByoOauth: ByoOauthClient;
+export declare const GOOGLE_OAUTH_CLIENT_ID_ENV: string;
+export declare const GOOGLE_OAUTH_CLIENT_SECRET_ENV: string;
+export declare const GOOGLE_OAUTH_SCOPES_ENV: string;
+export declare const GOOGLE_OAUTH_AUTH_URL_ENV: string;
+export declare const GOOGLE_OAUTH_TOKEN_URL_ENV: string;
+export declare const GOOGLE_OAUTH_USERINFO_URL_ENV: string;
+/** Google-bound OAuth state / connect-ticket helpers. */
+export declare const googleOauthTickets: import("../oauth-tickets.js").OauthTickets;
+export declare const resolveGoogleOauthRedirectBase: typeof import("../byo-oauth.js").resolveSlackOauthRedirectBase;
+export declare const readGoogleOauthConfig: (env?: NodeJS.ProcessEnv) => ByoOauthConfig | null;
+export declare const buildGoogleAuthorizeUrl: (config: ByoOauthConfig, state: string, redirectUri: string, scopes?: string) => string;
+export declare const exchangeGoogleOauthCode: (config: ByoOauthConfig, code: string, redirectUri: string, fetchImpl?: typeof fetch) => Promise<import("../fleet-connect.js").FleetVaultByoTokenResult>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/identity/google/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/google/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAQ/C,4EAA4E;AAC5E,eAAO,MAAM,cAAc,EAAE,cAsB3B,CAAC;AAEH,eAAO,MAAM,0BAA0B,QAA8B,CAAC;AACtE,eAAO,MAAM,8BAA8B,QAAkC,CAAC;AAC9E,eAAO,MAAM,uBAAuB,QAA4B,CAAC;AACjE,eAAO,MAAM,yBAAyB,QAA6B,CAAC;AACpE,eAAO,MAAM,0BAA0B,QAA8B,CAAC;AACtE,eAAO,MAAM,6BAA6B,QAAiC,CAAC;AAE5E,yDAAyD;AACzD,eAAO,MAAM,kBAAkB,4CAAyB,CAAC;AAEzD,eAAO,MAAM,8BAA8B,gEACP,CAAC;AAErC,eAAO,MAAM,qBAAqB,oDAA4B,CAAC;AAC/D,eAAO,MAAM,uBAAuB,yFAAmC,CAAC;AACxE,eAAO,MAAM,uBAAuB,0JAA8B,CAAC"}

package/dist/identity/google/oauth.js

@@ -0,0 +1,48 @@
+/**
+ * Google BYO OAuth descriptor — optional non-LangSmith Connect-with-Google.
+ * The default path uses Fleet auth-sessions instead.
+ */
+import { createByoOauthClient, } from "../byo-oauth.js";
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, } from "../byo-oauth.js";
+const DEFAULT_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
+const DEFAULT_TOKEN_URL = "https://oauth2.googleapis.com/token";
+const DEFAULT_USERINFO_URL = "https://www.googleapis.com/oauth2/v3/userinfo";
+/** Profile-only default; connector-derived unions replace this at authorize time. */
+const DEFAULT_SCOPES = ["openid", "email", "profile"].join(" ");
+/** Google BYO OAuth client (config, authorize, exchange, Fleet adapter). */
+export const googleByoOauth = createByoOauthClient({
+    providerId: "google",
+    displayName: "Google",
+    envPrefix: "GOOGLE_OAUTH",
+    defaultEndpoints: () => ({
+        authUrl: DEFAULT_AUTH_URL,
+        tokenUrl: DEFAULT_TOKEN_URL,
+        userInfoUrl: DEFAULT_USERINFO_URL,
+        defaultScopes: DEFAULT_SCOPES,
+    }),
+    authorizeParams: { access_type: "offline" },
+    parseUserInfo(json) {
+        return {
+            ...(typeof json.email === "string" && json.email
+                ? { email: json.email }
+                : {}),
+            ...(typeof json.sub === "string" && json.sub
+                ? { subject: json.sub }
+                : {}),
+        };
+    },
+    subjectMetadataKey: "google_sub",
+});
+export const GOOGLE_OAUTH_CLIENT_ID_ENV = googleByoOauth.env.clientId;
+export const GOOGLE_OAUTH_CLIENT_SECRET_ENV = googleByoOauth.env.clientSecret;
+export const GOOGLE_OAUTH_SCOPES_ENV = googleByoOauth.env.scopes;
+export const GOOGLE_OAUTH_AUTH_URL_ENV = googleByoOauth.env.authUrl;
+export const GOOGLE_OAUTH_TOKEN_URL_ENV = googleByoOauth.env.tokenUrl;
+export const GOOGLE_OAUTH_USERINFO_URL_ENV = googleByoOauth.env.userInfoUrl;
+/** Google-bound OAuth state / connect-ticket helpers. */
+export const googleOauthTickets = googleByoOauth.tickets;
+export const resolveGoogleOauthRedirectBase = googleByoOauth.resolveRedirectBase;
+export const readGoogleOauthConfig = googleByoOauth.readConfig;
+export const buildGoogleAuthorizeUrl = googleByoOauth.buildAuthorizeUrl;
+export const exchangeGoogleOauthCode = googleByoOauth.exchangeCode;
+//# sourceMappingURL=oauth.js.map

package/dist/identity/google/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/identity/google/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,oBAAoB,GAGrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAIzB,MAAM,gBAAgB,GAAG,8CAA8C,CAAC;AACxE,MAAM,iBAAiB,GAAG,qCAAqC,CAAC;AAChE,MAAM,oBAAoB,GAAG,+CAA+C,CAAC;AAC7E,qFAAqF;AACrF,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEhE,4EAA4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAmB,oBAAoB,CAAC;IACjE,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,QAAQ;IACrB,SAAS,EAAE,cAAc;IACzB,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;QACvB,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,iBAAiB;QAC3B,WAAW,EAAE,oBAAoB;QACjC,aAAa,EAAE,cAAc;KAC9B,CAAC;IACF,eAAe,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE;IAC3C,aAAa,CAAC,IAAI;QAChB,OAAO;YACL,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK;gBAC9C,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;gBACvB,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG;gBAC1C,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;gBACvB,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IACD,kBAAkB,EAAE,YAAY;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;AACtE,MAAM,CAAC,MAAM,8BAA8B,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC;AACpE,MAAM,CAAC,MAAM,0BAA0B,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;AACtE,MAAM,CAAC,MAAM,6BAA6B,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC;AAE5E,yDAAyD;AACzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC,OAAO,CAAC;AAEzD,MAAM,CAAC,MAAM,8BAA8B,GACzC,cAAc,CAAC,mBAAmB,CAAC;AAErC,MAAM,CAAC,MAAM,qBAAqB,GAAG,cAAc,CAAC,UAAU,CAAC;AAC/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC,iBAAiB,CAAC;AACxE,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC,YAAY,CAAC"}

package/dist/identity/index.d.ts

@@ -2,39 +2,55 @@
  * The managed `identity.ts` declaration primitive.
  *
  * A project's root `identity.ts` exports a named `identity` created with
- * `defineIdentity(...)` (or `defineIdentity.preset(...)`). The compiler
- * discovers it, generates the custom-auth handler, and wires thread/memory
- * scoping and downstream credentials.
+ * `defineIdentity(...)`. The compiler discovers it, generates the custom-auth
+ * handler, and wires thread/memory scoping and downstream credentials.
  *
  * This module is pure authoring-time config construction plus eager validation —
- * it has no runtime dependency (the `providers.*` helpers return plain data).
+ * it has no runtime dependency (the `auth.*` helpers return plain data).
  */
+import { type IdentityOptions } from "./options.js";
 import { type SupabaseProviderOptions } from "./supabase.js";
-import type { IdentityConfig, IdentityDefinition, IdentityPresetName, ValidatedTokenProvider } from "./types.js";
-export type { CredentialResolver, CredentialResolverConfig, CredentialScope, CredentialTarget, HttpIngress, IdentityConfig, IdentityConnectProvider, IdentityDefinition, IdentityPresetName, MemoryScope, ResolvedCredential, RuntimeIdentity, Tenancy, ThreadScope, ValidatedTokenIngress, ValidatedTokenProvider, } from "./types.js";
-export type { GitHubActorTokenArgs, GitHubAppJwtArgs, GitHubCredentialsOptions, GitHubTokenSource, } from "./github/credentials.js";
-/** The signature of {@link defineIdentity}, including its `.preset` helper. */
-export interface DefineIdentity {
-    (config: IdentityConfig): IdentityDefinition;
-    /**
-     * Start from a named archetype and optionally override any subset of it. The
-     * headline API for the common case.
-     */
-    preset(name: IdentityPresetName, overrides?: DeepPartial<IdentityConfig>): IdentityDefinition;
-}
+import type { IdentityConfig, IdentityDefinition, ValidatedTokenProvider } from "./types.js";
+export { normalizeGroups, organizationClaimName, userClaimName, } from "./claims.js";
+export { normalizeIdentity } from "./options.js";
+export type { IdentityAuth, IdentityOptions, IdentityScope, IdentityScopeOverrides, } from "./options.js";
+export { credentialTargetNames, isSingleCredentialResolver, } from "./credential-resolvers.js";
+export type { ClaimMapping, CredentialConnectRequirements, CredentialResolver, CredentialResolverConfig, CredentialResolvers, CredentialScope, CredentialTarget, HttpIngress, IdentityConfig, IdentityConnectProvider, IdentityDefinition, MemoryScope, OrganizationRequirement, ResolvedCredential, RuntimeIdentity, ThreadScope, ValidatedTokenIngress, ValidatedTokenProvider, } from "./types.js";
+export type { GitHubAppJwtArgs, GitHubCredentialsOptions, GitHubTokenSource, GitHubUserTokenArgs, } from "./github/credentials.js";
+export { createFleetAuthSession, deleteAgentConnection, hasFleetAuthCredentials, listAgentConnections, resolveFleetApiUrl, resolveFleetHeaders, upsertAgentProviderToken, type CreateFleetAuthSessionBody, type FleetAuthSession, type FleetClientOptions, type FleetConnection, type UpsertAgentProviderTokenBody, } from "./fleet.js";
+export { agentIdFromActor, enableActorSubjectIntegrationsFromConnectors, enableActorSubjectIntegration, isActorSubjectIntegrationEnabled, isActorSubjectSlugEnabled, NAMESPACE_MDA_ACTOR, resetActorSubjectEnabledForTests, resolveActorDeploymentId, type AgentIdFromActorOptions, } from "./actor-subject.js";
+export { createFleetVaultConnectProvider, fleetConnectUrl, isFleetVaultConnectConfigured, type FleetVaultByoOauth, type FleetVaultByoOauthConfig, type FleetVaultConnectProviderOptions, type FleetVaultByoTokenResult, } from "./fleet-connect.js";
+export { createByoOauthClient, type ByoOauthClient, type ByoOauthConfig, type CreateByoOauthClientOptions, } from "./byo-oauth.js";
+export { createFleetIntegrationConnectProvider, fleetIntegrationConnectUrl, isFleetIntegrationConnectConfigured, type FleetIntegrationConnectProviderOptions, } from "./fleet-integration-connect.js";
+export { createFleetConnectHintMiddleware, fleetConnectHintUrl, rewriteFleetToolError, } from "./fleet-connect-hint.js";
+export { createConnectTicket, createOauthState, oauthTicketsFor, verifyConnectTicket, verifyOauthState, type OauthTickets, } from "./oauth-tickets.js";
 /**
  * Declare the identity contract for the deployment.
  *
- * Most developers call {@link defineIdentity.preset} instead. The three scoping
- * axes are the power-user layer underneath.
+ * The common case takes no arguments — a backend you operate asserts the caller,
+ * and each caller gets private threads and memory:
+ *
+ * ```ts
+ * export const identity = defineIdentity();
+ * ```
+ *
+ * Otherwise describe how callers authenticate and what the isolation boundary
+ * is; `scope` accepts per-axis overrides when a single boundary does not fit:
+ *
+ * ```ts
+ * export const identity = defineIdentity({
+ *   auth: auth.auth0({ domain: "acme.us.auth0.com" }),
+ *   scope: "organization",
+ * });
+ * ```
  */
-export declare const defineIdentity: DefineIdentity;
+export declare function defineIdentity(options?: IdentityOptions): IdentityDefinition;
 /**
- * Provider integrations — authoring-time sugar over {@link ValidatedTokenProvider}.
- * Each returns a plain provider object you can spread-and-override, so
- * there is no new runtime surface.
+ * Validated-token auth providers — authoring-time sugar over
+ * {@link ValidatedTokenProvider}. Each returns a plain provider object you can
+ * spread-and-override, so there is no new runtime surface.
  */
-export declare const providers: {
+export declare const auth: {
     auth0({ domain, audience, }: {
         domain: string;
         audience?: string;
@@ -64,15 +80,25 @@ export declare const providers: {
         issuer: string;
         audience?: string;
     }): ValidatedTokenProvider;
+    /**
+     * LangSmith OAuth access tokens (Ed25519 JWTs). Verifies against LangSmith's
+     * public JWKS. `apiUrl` defaults to the US SaaS endpoint; override for another
+     * region or self-hosted LangSmith. Audience is the same URL — LangSmith only
+     * mints tokens for its own API (and MCP), so it cannot be narrowed further.
+     */
+    langsmith({ apiUrl, }?: {
+        apiUrl?: string;
+    }): ValidatedTokenProvider;
     /**
      * GitHub OAuth access tokens (opaque bearer tokens, not JWTs). MDA verifies
      * each request by calling `GET https://api.github.com/user` with the token.
      */
     github(): ValidatedTokenProvider;
     /** MDA-issued anonymous/guest tokens. */
-    guest({ ttl, actorPrefix, }?: {
+    guest({ ttl, userPrefix, }?: {
         ttl?: string;
-        actorPrefix?: string;
+        /** Prefix applied to the generated user id, e.g. `"guest:"`. */
+        userPrefix?: string;
     }): ValidatedTokenProvider;
 };
 /**
@@ -80,8 +106,4 @@ export declare const providers: {
  * reaches the compiler or runtime.
  */
 export declare function validateIdentity(config: IdentityConfig): void;
-/** Recursively merge plain objects; arrays and primitives from `patch` win. */
-type DeepPartial<T> = T extends object ? {
-    [K in keyof T]?: DeepPartial<T[K]>;
-} : T;
 //# sourceMappingURL=index.d.ts.map

package/dist/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,KAAK,uBAAuB,EAAoB,MAAM,eAAe,CAAC;AAC/E,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAElB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,cAAc,EACd,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,OAAO,EACP,WAAW,EACX,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AA8BjC,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,CAAC,MAAM,EAAE,cAAc,GAAG,kBAAkB,CAAC;IAC7C;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,SAAS,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,GACtC,kBAAkB,CAAC;CACvB;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,cAoB5B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,SAAS;IACpB,KAAK,wBAGF;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;IAU1B,KAAK,aAAa;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,sBAAsB;IAS7D,IAAI,wBAGD;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;IAU1B,OAAO,0BAGJ;QACD,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,sBAAsB;IAU1B,KAAK,0BAGF;QACD,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;IAU1B,MAAM,gBAAe;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,sBAAsB;IAUxE,oCAAoC;IACpC,QAAQ,UAAU,uBAAuB,GAAG,sBAAsB;IAIlE,mEAAmE;IACnE,IAAI,wBAGD;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;IAU1B;;;OAGG;IACH,MAAM,IAAI,sBAAsB;IAehC,yCAAyC;IACzC,KAAK,yBAGF;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,sBAAsB;CAWxE,CAAC;AAIF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CA8E7D;AAuHD,+EAA+E;AAC/E,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,MAAM,GAClC;KAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GACtC,CAAC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,KAAK,uBAAuB,EAAoB,MAAM,eAAe,CAAC;AAC/E,OAAO,KAAK,EAGV,cAAc,EACd,kBAAkB,EAElB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EACV,YAAY,EACZ,eAAe,EACf,aAAa,EACb,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,YAAY,EACZ,6BAA6B,EAC7B,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,cAAc,EACd,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,uBAAuB,EACvB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,4BAA4B,GAClC,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,gBAAgB,EAChB,4CAA4C,EAC5C,6BAA6B,EAC7B,gCAAgC,EAChC,yBAAyB,EACzB,mBAAmB,EACnB,gCAAgC,EAChC,wBAAwB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,+BAA+B,EAC/B,eAAe,EACf,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,gCAAgC,EACrC,KAAK,wBAAwB,GAC9B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,2BAA2B,GACjC,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,qCAAqC,EACrC,0BAA0B,EAC1B,mCAAmC,EACnC,KAAK,sCAAsC,GAC5C,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,gCAAgC,EAChC,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,GAAE,eAAoB,GAC5B,kBAAkB,CAIpB;AAED;;;;GAIG;AACH,eAAO,MAAM,IAAI;IACf,KAAK,wBAGF;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;IAU1B,KAAK,aAAa;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,sBAAsB;IAS7D,IAAI,wBAGD;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;IAU1B,OAAO,0BAGJ;QACD,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,sBAAsB;IAU1B,KAAK,0BAGF;QACD,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;IAU1B,MAAM,gBAAe;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,sBAAsB;IAUxE,oCAAoC;IACpC,QAAQ,UAAU,uBAAuB,GAAG,sBAAsB;IAIlE,mEAAmE;IACnE,IAAI,wBAGD;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;IAU1B;;;;;OAKG;IACH,SAAS,eAEN;QACD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAQ,sBAAsB;IAW/B;;;OAGG;IACH,MAAM,IAAI,sBAAsB;IAehC,yCAAyC;IACzC,KAAK,wBAGF;QACD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,gEAAgE;QAChE,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GAAQ,sBAAsB;CAWhC,CAAC;AAKF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CA4E7D"}