managed-deepagents 0.5.0-dev.79 → 0.5.0-dev.81

package/dist/identity/supabase.js

@@ -55,7 +55,7 @@ function normalizeSupabaseRegions(regions) {
         const url = entry.url ??
             (entry.projectRef ? `${supabaseBase(entry.projectRef)}/user` : undefined);
         if (!url) {
-            throw new Error(`providers.supabase(...) region "${region}" needs a \`projectRef\` or \`url\`.`);
+            throw new Error(`auth.supabase(...) region "${region}" needs a \`projectRef\` or \`url\`.`);
         }
         const headers = entry.headers ?? (entry.anonKey ? { apikey: entry.anonKey } : undefined);
         out[region] = headers ? { url, headers } : { url };
@@ -71,7 +71,7 @@ function normalizeSupabaseRegions(regions) {
 export function supabaseProvider(options) {
     const { projectRef, url, introspect, regions, regionHeader = "x-supabase-region", } = options;
     if (projectRef && url) {
-        throw new Error("providers.supabase(...) accepts only one of `projectRef` or `url`.");
+        throw new Error("auth.supabase(...) accepts only one of `projectRef` or `url`.");
     }
     if (introspect) {
         if (regions) {
@@ -82,7 +82,7 @@ export function supabaseProvider(options) {
                     regions: normalizeSupabaseRegions(regions),
                     headers: { apikey: "${SUPABASE_ANON_KEY}" },
                 },
-                claims: { actor: "email" },
+                claims: { user: "email" },
             };
             const issuers = supabaseRegionIssuers(regions);
             if (issuers.length > 0) {
@@ -99,11 +99,11 @@ export function supabaseProvider(options) {
                     url: `${authBase}/user`,
                     headers: { apikey: "${SUPABASE_ANON_KEY}" },
                 },
-                claims: { actor: "email" },
+                claims: { user: "email" },
             };
         }
         if (!projectRef) {
-            throw new Error("providers.supabase(...) requires `projectRef`, `url`, or `regions` when introspect is true.");
+            throw new Error("auth.supabase(...) requires `projectRef`, `url`, or `regions` when introspect is true.");
         }
         const base = supabaseBase(projectRef);
         return {
@@ -113,7 +113,7 @@ export function supabaseProvider(options) {
                 url: `${base}/user`,
                 headers: { apikey: "${SUPABASE_ANON_KEY}" },
             },
-            claims: { actor: "email" },
+            claims: { user: "email" },
         };
     }
     if (url) {
@@ -121,11 +121,11 @@ export function supabaseProvider(options) {
             id: "supabase",
             discoveryUrl: supabaseAuthV1Base(url),
             algorithms: ["ES256", "RS256"],
-            claims: { actor: "email" },
+            claims: { user: "email" },
         };
     }
     if (!projectRef) {
-        throw new Error("providers.supabase(...) without `introspect` requires `projectRef` or `url`.");
+        throw new Error("auth.supabase(...) without `introspect` requires `projectRef` or `url`.");
     }
     const base = supabaseBase(projectRef);
     return {
@@ -133,7 +133,7 @@ export function supabaseProvider(options) {
         issuer: base,
         jwks: `${base}/.well-known/jwks.json`,
         algorithms: ["ES256", "RS256"],
-        claims: { actor: "email" },
+        claims: { user: "email" },
     };
 }
 //# sourceMappingURL=supabase.js.map

package/dist/identity/supabase.js.map

@@ -1 +1 @@
-{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../../src/identity/supabase.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAuCH,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO,WAAW,UAAU,sBAAsB,CAAC;AACrD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,OAAO,UAAU,CAAC;AAC9B,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAuC;IAEvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,IAAI,MAA0B,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC;aAAM,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACrB,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,OAAuC;IAEvC,MAAM,GAAG,GAGL,EAAE,CAAC;IACP,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GACP,KAAK,CAAC,GAAG;YACT,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,sCAAsC,CAChF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAgC;IAEhC,MAAM,EACJ,UAAU,EACV,GAAG,EACH,UAAU,EACV,OAAO,EACP,YAAY,GAAG,mBAAmB,GACnC,GAAG,OAAO,CAAC;IAEZ,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,QAAQ,GAA2B;gBACvC,EAAE,EAAE,UAAU;gBACd,UAAU,EAAE;oBACV,YAAY;oBACZ,OAAO,EAAE,wBAAwB,CAAC,OAAO,CAAC;oBAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;iBAC5C;gBACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;aAC3B,CAAC;YACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;YAC7B,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO;gBACL,EAAE,EAAE,UAAU;gBACd,YAAY,EAAE,QAAQ;gBACtB,UAAU,EAAE;oBACV,GAAG,EAAE,GAAG,QAAQ,OAAO;oBACvB,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;iBAC5C;gBACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;aAC3B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,UAAU;YACd,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE;gBACV,GAAG,EAAE,GAAG,IAAI,OAAO;gBACnB,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;aAC5C;YACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3B,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,EAAE,CAAC;QACR,OAAO;YACL,EAAE,EAAE,UAAU;YACd,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC;YACrC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO;QACL,EAAE,EAAE,UAAU;QACd,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,GAAG,IAAI,wBAAwB;QACrC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QAC9B,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;KAC3B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../../src/identity/supabase.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAuCH,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO,WAAW,UAAU,sBAAsB,CAAC;AACrD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,OAAO,UAAU,CAAC;AAC9B,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAuC;IAEvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,IAAI,MAA0B,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC;aAAM,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACrB,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,OAAuC;IAEvC,MAAM,GAAG,GAGL,EAAE,CAAC;IACP,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GACP,KAAK,CAAC,GAAG;YACT,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,8BAA8B,MAAM,sCAAsC,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAgC;IAEhC,MAAM,EACJ,UAAU,EACV,GAAG,EACH,UAAU,EACV,OAAO,EACP,YAAY,GAAG,mBAAmB,GACnC,GAAG,OAAO,CAAC;IAEZ,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,QAAQ,GAA2B;gBACvC,EAAE,EAAE,UAAU;gBACd,UAAU,EAAE;oBACV,YAAY;oBACZ,OAAO,EAAE,wBAAwB,CAAC,OAAO,CAAC;oBAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;iBAC5C;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;aAC1B,CAAC;YACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;YAC7B,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO;gBACL,EAAE,EAAE,UAAU;gBACd,YAAY,EAAE,QAAQ;gBACtB,UAAU,EAAE;oBACV,GAAG,EAAE,GAAG,QAAQ,OAAO;oBACvB,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;iBAC5C;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;aAC1B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,UAAU;YACd,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE;gBACV,GAAG,EAAE,GAAG,IAAI,OAAO;gBACnB,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;aAC5C;YACD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,EAAE,CAAC;QACR,OAAO;YACL,EAAE,EAAE,UAAU;YACd,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC;YACrC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO;QACL,EAAE,EAAE,UAAU;QACd,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,GAAG,IAAI,wBAAwB;QACrC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;KAC1B,CAAC;AACJ,CAAC"}

package/dist/identity/types.d.ts

@@ -7,7 +7,7 @@
 import type { IdentityConnectProvider } from "./connect-provider-types.js";
 export type { IdentityConnectProvider } from "./connect-provider-types.js";
 /** How MDA learns who is calling on the HTTP ingress path. */
-export type HttpIngress = "trusted_backend" | ValidatedTokenIngress;
+export type HttpIngress = "backend" | ValidatedTokenIngress;
 /**
  * Browser-direct ingress: MDA verifies the caller's own IdP token server-side
  * and derives identity from its claims.
@@ -83,18 +83,30 @@ export interface ValidatedTokenProvider {
         issue: boolean;
         /** Token lifetime, e.g. "24h". */
         ttl?: string;
-        /** Prefix applied to the generated actor id, e.g. "guest:". */
-        actorPrefix?: string;
+        /** Prefix applied to the generated user id, e.g. "guest:". */
+        userPrefix?: string;
     };
     /** Maps verified token claims → identity envelope fields. */
-    claims: {
-        /** Claim used as `runtime.identity.actor.id` (e.g. "sub", "email"). */
-        actor: string;
-        /** Claim used as `runtime.identity.tenant.id` (e.g. "org_id"). */
-        tenant?: string;
-        /** Claim used as `runtime.identity.actor.email`. */
-        email?: string;
-    };
+    claims: ClaimMapping;
+}
+/**
+ * Which verified token claim supplies each identity envelope field.
+ *
+ * `user` is required; `defineIdentity` rejects a provider that omits it.
+ */
+export interface ClaimMapping {
+    /** Claim used as `runtime.identity.user.id` (e.g. "sub", "email"). */
+    user?: string;
+    /** Claim used as `runtime.identity.organization.id` (e.g. "org_id"). */
+    organization?: string;
+    /**
+     * Claim carrying every group the caller belongs to. Accepts a JSON array, or a
+     * comma/space-delimited string. Read by tools for authorization; never an
+     * isolation key (see `organization` for that).
+     */
+    groups?: string;
+    /** Claim used as `runtime.identity.user.email`. */
+    email?: string;
 }
 /** Which downstream call needs a credential right now. */
 export interface CredentialTarget {
@@ -113,19 +125,26 @@ export interface CredentialTarget {
 export interface ResolvedCredential {
     /** Headers MDA attaches to the downstream call (usually Authorization). */
     headers: Record<string, string>;
-    /** ISO expiry; MDA caches per (actor, tenant, target) until then. */
+    /** ISO expiry; MDA caches per (user, organization, target) until then. */
     expiresAt?: string;
 }
 /** The frozen identity envelope tools and middleware see. */
 export interface RuntimeIdentity {
-    actor: {
-        type: "user" | "service";
+    /** The caller. `kind: "service"` for machine callers (schedules, channels, Studio). */
+    user: {
+        kind: "person" | "service";
         id: string;
         email?: string;
     };
-    tenant?: {
+    /** The organization this run is scoped to, when the caller presents one. */
+    organization?: {
         id: string;
     };
+    /**
+     * Every group the caller's token asserts. For authorization decisions in tools
+     * and middleware — isolation is keyed on {@link RuntimeIdentity.organization}.
+     */
+    groups?: readonly string[];
     source: {
         /**
          * Ingress source. Built-ins include `http`, `schedule`, `cli`, `studio`,
@@ -142,46 +161,87 @@ export type CredentialResolver = (args: {
     target: CredentialTarget;
 }) => Promise<ResolvedCredential>;
 /**
- * Provide this (with `scoping.credentials: "custom"`) to mint your own
- * downstream credentials per actor: an in-process callback or a hosted
- * token-exchange endpoint.
+ * Connect-with-X routes a credential resolver depends on.
+ *
+ * A resolver that reads per-user OAuth tokens needs somewhere for the user to
+ * grant them. Declaring the provider here lets `defineIdentity` mount the routes
+ * from the resolver, instead of asking authors to repeat themselves on
+ * `connect`.
+ */
+export interface CredentialConnectRequirements {
+    connect?: IdentityConnectProvider[];
+}
+/**
+ * Provide this to mint your own downstream credentials per caller: an in-process
+ * callback or a hosted token-exchange endpoint. Providing it puts the
+ * credentials axis in custom mode.
  */
-export type CredentialResolverConfig = {
+export type CredentialResolverConfig = ({
     resolve: CredentialResolver;
-} | {
+} & CredentialConnectRequirements) | ({
     endpoint: {
         url: string;
     };
-};
-/** The tenant boundary. */
-export type Tenancy = "single" | "multi";
+} & CredentialConnectRequirements);
+/**
+ * One resolver per downstream platform, keyed by {@link CredentialTarget.name}.
+ *
+ * Use this instead of a single resolver when an agent integrates more than one
+ * platform. MDA dispatches on the target name, so each entry stays a focused
+ * config (and keeps declaring its own Connect-with-X routes) rather than being
+ * folded into a hand-written switch.
+ */
+export type CredentialResolvers = Record<string, CredentialResolverConfig>;
+/** Whether every caller must present an organization. */
+export type OrganizationRequirement = "optional" | "required";
 /** Who can open/resume the conversation. */
-export type ThreadScope = "actor" | "channel" | "tenant";
+export type ThreadScope = "user" | "conversation" | "organization";
 /** The durable Store namespace prefix. */
-export type MemoryScope = "actor" | "tenant" | "agent" | "none";
-/** Whose token downstream calls carry. */
-export type CredentialScope = "agent" | "actor" | "none" | "custom";
-/** The whole identity config surface. */
+export type MemoryScope = "user" | "organization" | "agent" | "none";
+/**
+ * Whose token downstream calls carry.
+ *
+ * - `"user"` — per-caller Connect / actor-subject vault (toolserver
+ *   `?agent_id=` derived from the caller).
+ * - `"agent"` — shared LangSmith / deployment vault (`MDA_TOOLSERVER_AGENT_ID`
+ *   or the key's user subject).
+ * - `"custom"` — author-supplied resolver/endpoint (`CredentialsProvider`).
+ * - `"none"` — no managed credential owner.
+ */
+export type CredentialScope = "user" | "agent" | "none" | "custom";
+/**
+ * The resolved identity contract the runtime reads.
+ *
+ * `defineIdentity` derives this from {@link IdentityOptions}; it is not an
+ * authoring surface. Its vocabulary matches the authoring vocabulary exactly, so
+ * a value you read while debugging is the value you wrote.
+ */
 export interface IdentityConfig {
     /** How MDA learns who is calling. */
     ingress: {
         http: HttpIngress;
     };
-    /** The tenant boundary. */
-    tenancy: Tenancy;
-    /** The three scoping axes. */
-    scoping: {
+    /** Whether every caller must present an organization. */
+    organizations: OrganizationRequirement;
+    /** The three isolation axes. */
+    scope: {
         /** Who can open/resume the conversation. */
         threads?: ThreadScope;
         /** Durable Store namespace prefix. */
         memory: MemoryScope;
-        /** Managed mode, or "custom" when a resolver/endpoint is provided below. */
+        /**
+         * Whose downstream tokens / Connect ownership apply. `"custom"` when a
+         * resolver/endpoint is provided below.
+         */
         credentials?: CredentialScope;
     };
-    /** Present when `scoping.credentials` is "custom" (or a resolver is set). */
-    credentials?: CredentialResolverConfig;
     /**
-     * Opt-in Connect-with-X providers (`github.connect()`, `slack.connect()`, …).
+     * Present when `scope.credentials` is "custom" (or a resolver is set).
+     * Either one resolver for every target, or one per target name.
+     */
+    credentials?: CredentialResolverConfig | CredentialResolvers;
+    /**
+     * Opt-in Connect-with-X providers (`connect.github()`, `connect.slack()`, …).
      * Only listed providers mount `/identity/{id}/…` routes.
      */
     connect?: IdentityConnectProvider[];
@@ -191,6 +251,4 @@ export interface IdentityDefinition {
     readonly kind: "identity";
     readonly config: IdentityConfig;
 }
-/** The archetype presets that expand to a full {@link IdentityConfig}. */
-export type IdentityPresetName = "private-assistant" | "multi-tenant-saas" | "shared-bot" | "internal-tool" | "service";
 //# sourceMappingURL=types.d.ts.map

package/dist/identity/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,YAAY,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GAAG,iBAAiB,GAAG,qBAAqB,CAAC;AAEpE;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,iFAAiF;IACjF,KAAK,CAAC,EAAE;QACN,sDAAsD;QACtD,KAAK,EAAE,OAAO,CAAC;QACf,kCAAkC;QAClC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,+DAA+D;QAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE;QACN,uEAAuE;QACvE,KAAK,EAAE,MAAM,CAAC;QACd,kEAAkE;QAClE,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,oDAAoD;QACpD,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B;IAC5B,IAAI,EAAE,UAAU,GAAG,KAAK,GAAG,YAAY,GAAG,WAAW,CAAC;IACtD,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,MAAM,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,MAAM,EAAE;QACN;;;WAGG;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,uCAAuC;AACvC,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE;IACtC,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAElC;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAC/B;IAAE,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAElC,2BAA2B;AAC3B,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEzC,4CAA4C;AAC5C,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;AACzD,0CAA0C;AAC1C,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAChE,0CAA0C;AAC1C,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEpE,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF,2BAA2B;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,OAAO,EAAE;QACP,4CAA4C;QAC5C,OAAO,CAAC,EAAE,WAAW,CAAC;QACtB,sCAAsC;QACtC,MAAM,EAAE,WAAW,CAAC;QACpB,4EAA4E;QAC5E,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;IACF,6EAA6E;IAC7E,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC;;;OAGG;IACH,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAED,0EAA0E;AAC1E,MAAM,MAAM,kBAAkB,GAC1B,mBAAmB,GACnB,mBAAmB,GACnB,YAAY,GACZ,eAAe,GACf,SAAS,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,YAAY,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,qBAAqB,CAAC;AAE5D;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,iFAAiF;IACjF,KAAK,CAAC,EAAE;QACN,sDAAsD;QACtD,KAAK,EAAE,OAAO,CAAC;QACf,kCAAkC;QAClC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,8DAA8D;QAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B;IAC5B,IAAI,EAAE,UAAU,GAAG,KAAK,GAAG,YAAY,GAAG,WAAW,CAAC;IACtD,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,IAAI,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,4EAA4E;IAC5E,YAAY,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN;;;WAGG;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,uCAAuC;AACvC,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE;IACtC,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC,CAAC;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAAG,6BAA6B,CAAC,GACjE,CAAC;IAAE,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,6BAA6B,CAAC,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AAE3E,yDAAyD;AACzD,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,UAAU,CAAC;AAE9D,4CAA4C;AAC5C,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,cAAc,GAAG,cAAc,CAAC;AACnE,0CAA0C;AAC1C,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,cAAc,GAAG,OAAO,GAAG,MAAM,CAAC;AACrE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF,yDAAyD;IACzD,aAAa,EAAE,uBAAuB,CAAC;IACvC,gCAAgC;IAChC,KAAK,EAAE;QACL,4CAA4C;QAC5C,OAAO,CAAC,EAAE,WAAW,CAAC;QACtB,sCAAsC;QACtC,MAAM,EAAE,WAAW,CAAC;QACpB;;;WAGG;QACH,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;IACF;;;OAGG;IACH,WAAW,CAAC,EAAE,wBAAwB,GAAG,mBAAmB,CAAC;IAC7D;;;OAGG;IACH,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC"}

package/dist/identity/x/connect-http.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Connect-with-X — thin adapter over {@link createFleetVaultConnectProvider}.
+ *
+ * Mounted under `/identity/x/*` when listed on `identity.connect`, or inferred
+ * from `connectors.x` on a user-scoped deployment. OAuth uses Fleet
+ * auth-sessions against the reserved `twitter-oauth-provider` slug (PKCE is
+ * handled by Host); there is no local BYO client path.
+ */
+import type { IdentityConnectMountContext, IdentityConnectProvider } from "../connect-provider-types.js";
+import { type FleetVaultConnectProviderOptions } from "../fleet-connect.js";
+export declare const X_CONNECT_STATUS_PATH: string;
+export declare const X_CONNECT_START_PATH: string;
+export declare const X_CONNECT_CALLBACK_PATH: string;
+export declare const X_CONNECT_LINK_PATH: string;
+export declare function isXActorSubjectEnabled(): boolean;
+export declare function enableXActorSubject(): void;
+/**
+ * Enable actor-subject mode when X connectors imply per-user vault subjects.
+ *
+ * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
+ */
+export declare function enableXActorSubjectFromConnectors(connectorKinds: readonly (string | undefined)[] | undefined, scope?: IdentityConnectMountContext["scope"]): void;
+export declare function resetXActorSubjectEnabledForTests(): void;
+export declare function isXConnectConfigured(env?: NodeJS.ProcessEnv): boolean;
+export declare function xConnectUrl(publicAppUrl: string): string;
+/** Options for {@link createXIdentityConnectProvider}. */
+export type XIdentityConnectProviderOptions = Pick<FleetVaultConnectProviderOptions, "providerSlug" | "scopes" | "fleet">;
+/** Build an X connect provider (Fleet auth-sessions / twitter-oauth-provider). */
+export declare function createXIdentityConnectProvider(options?: XIdentityConnectProviderOptions): IdentityConnectProvider;
+/** Default X connect provider used as a built-in mount candidate. */
+export declare const xIdentityConnectProvider: IdentityConnectProvider;
+/**
+ * Opt into Connect-with-X on `defineIdentity({ connect: […] })`.
+ *
+ * Usually unnecessary: declaring `connectors.x` on a user-scoped identity
+ * deployment mounts this provider and derives OAuth scopes automatically.
+ */
+export declare function connect(options?: XIdentityConnectProviderOptions): IdentityConnectProvider;
+//# sourceMappingURL=connect-http.d.ts.map

package/dist/identity/x/connect-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/x/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAIL,KAAK,gCAAgC,EACtC,MAAM,qBAAqB,CAAC;AAQ7B,eAAO,MAAM,qBAAqB,QAAe,CAAC;AAClD,eAAO,MAAM,oBAAoB,QAAgB,CAAC;AAClD,eAAO,MAAM,uBAAuB,QAAiB,CAAC;AACtD,eAAO,MAAM,mBAAmB,QAAa,CAAC;AAE9C,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC/C,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC3C,IAAI,CAMN;AAED,wBAAgB,iCAAiC,IAAI,IAAI,CAExD;AAED,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET;AAED,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,0DAA0D;AAC1D,MAAM,MAAM,+BAA+B,GAAG,IAAI,CAChD,gCAAgC,EAChC,cAAc,GAAG,QAAQ,GAAG,OAAO,CACpC,CAAC;AAEF,kFAAkF;AAClF,wBAAgB,8BAA8B,CAC5C,OAAO,GAAE,+BAAoC,GAC5C,uBAAuB,CAWzB;AAED,qEAAqE;AACrE,eAAO,MAAM,wBAAwB,EAAE,uBACL,CAAC;AAEnC;;;;;GAKG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,+BAA+B,GACxC,uBAAuB,CAKzB"}

package/dist/identity/x/connect-http.js

@@ -0,0 +1,69 @@
+/**
+ * Connect-with-X — thin adapter over {@link createFleetVaultConnectProvider}.
+ *
+ * Mounted under `/identity/x/*` when listed on `identity.connect`, or inferred
+ * from `connectors.x` on a user-scoped deployment. OAuth uses Fleet
+ * auth-sessions against the reserved `twitter-oauth-provider` slug (PKCE is
+ * handled by Host); there is no local BYO client path.
+ */
+import { X_INTEGRATION, readXProviderSlug, } from "../../connectors/toolserver/integrations.js";
+import { enableActorSubjectIntegration, enableActorSubjectIntegrationFromConnectors, isActorSubjectIntegrationEnabled, resetActorSubjectEnabledForTests, } from "../actor-subject.js";
+import { identityConnectPaths } from "../connect-paths.js";
+import { createFleetVaultConnectProvider, fleetConnectUrl, isFleetVaultConnectConfigured, } from "../fleet-connect.js";
+import { MDA_PUBLIC_APP_URL_ENV, resolveSlackOauthRedirectBase, } from "../slack/oauth.js";
+const PATHS = identityConnectPaths("x");
+export const X_CONNECT_STATUS_PATH = PATHS.status;
+export const X_CONNECT_START_PATH = PATHS.connect;
+export const X_CONNECT_CALLBACK_PATH = PATHS.callback;
+export const X_CONNECT_LINK_PATH = PATHS.link;
+export function isXActorSubjectEnabled() {
+    return isActorSubjectIntegrationEnabled("x");
+}
+export function enableXActorSubject() {
+    enableActorSubjectIntegration("x");
+}
+/**
+ * Enable actor-subject mode when X connectors imply per-user vault subjects.
+ *
+ * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
+ */
+export function enableXActorSubjectFromConnectors(connectorKinds, scope) {
+    enableActorSubjectIntegrationFromConnectors(X_INTEGRATION, connectorKinds, scope);
+}
+export function resetXActorSubjectEnabledForTests() {
+    resetActorSubjectEnabledForTests();
+}
+export function isXConnectConfigured(env = process.env) {
+    return isFleetVaultConnectConfigured(undefined, env);
+}
+export function xConnectUrl(publicAppUrl) {
+    return fleetConnectUrl(X_INTEGRATION, publicAppUrl);
+}
+/** Build an X connect provider (Fleet auth-sessions / twitter-oauth-provider). */
+export function createXIdentityConnectProvider(options = {}) {
+    return createFleetVaultConnectProvider({
+        integration: X_INTEGRATION,
+        providerSlug: options.providerSlug?.trim() || readXProviderSlug(),
+        ...(options.scopes ? { scopes: options.scopes } : {}),
+        ...(options.fleet ? { fleet: options.fleet } : {}),
+        resolveRedirectBase: resolveSlackOauthRedirectBase,
+        resolvePublicAppUrl() {
+            return process.env[MDA_PUBLIC_APP_URL_ENV]?.replace(/\/$/, "");
+        },
+    });
+}
+/** Default X connect provider used as a built-in mount candidate. */
+export const xIdentityConnectProvider = createXIdentityConnectProvider();
+/**
+ * Opt into Connect-with-X on `defineIdentity({ connect: […] })`.
+ *
+ * Usually unnecessary: declaring `connectors.x` on a user-scoped identity
+ * deployment mounts this provider and derives OAuth scopes automatically.
+ */
+export function connect(options) {
+    enableXActorSubject();
+    return options
+        ? createXIdentityConnectProvider(options)
+        : xIdentityConnectProvider;
+}
+//# sourceMappingURL=connect-http.js.map

package/dist/identity/x/connect-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/x/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,aAAa,EACb,iBAAiB,GAClB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,6BAA6B,EAC7B,2CAA2C,EAC3C,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAK3D,OAAO,EACL,+BAA+B,EAC/B,eAAe,EACf,6BAA6B,GAE9B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;AAExC,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC,MAAM,CAAC;AAClD,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC,OAAO,CAAC;AAClD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,QAAQ,CAAC;AACtD,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC,IAAI,CAAC;AAE9C,MAAM,UAAU,sBAAsB;IACpC,OAAO,gCAAgC,CAAC,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,6BAA6B,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iCAAiC,CAC/C,cAA2D,EAC3D,KAA4C;IAE5C,2CAA2C,CACzC,aAAa,EACb,cAAc,EACd,KAAK,CACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC;IAC/C,gCAAgC,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,6BAA6B,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,YAAoB;IAC9C,OAAO,eAAe,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;AACtD,CAAC;AAQD,kFAAkF;AAClF,MAAM,UAAU,8BAA8B,CAC5C,OAAO,GAAoC,EAAE;IAE7C,OAAO,+BAA+B,CAAC;QACrC,WAAW,EAAE,aAAa;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,iBAAiB,EAAE;QACjE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,mBAAmB,EAAE,6BAA6B;QAClD,mBAAmB;YACjB,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjE,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,wBAAwB,GACnC,8BAA8B,EAAE,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CACrB,OAAyC;IAEzC,mBAAmB,EAAE,CAAC;IACtB,OAAO,OAAO;QACZ,CAAC,CAAC,8BAA8B,CAAC,OAAO,CAAC;QACzC,CAAC,CAAC,wBAAwB,CAAC;AAC/B,CAAC"}

package/dist/identity/x/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * X identity helpers — Connect-with-X (Fleet vault / twitter-oauth-provider).
+ */
+export { connect, createXIdentityConnectProvider, enableXActorSubject, enableXActorSubjectFromConnectors, xConnectUrl, xIdentityConnectProvider, isXActorSubjectEnabled, isXConnectConfigured, resetXActorSubjectEnabledForTests, X_CONNECT_CALLBACK_PATH, X_CONNECT_LINK_PATH, X_CONNECT_START_PATH, X_CONNECT_STATUS_PATH, } from "./connect-http.js";
+export type { XIdentityConnectProviderOptions } from "./connect-http.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/x/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/x/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,8BAA8B,EAC9B,mBAAmB,EACnB,iCAAiC,EACjC,WAAW,EACX,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,iCAAiC,EACjC,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/identity/x/index.js

@@ -0,0 +1,5 @@
+/**
+ * X identity helpers — Connect-with-X (Fleet vault / twitter-oauth-provider).
+ */
+export { connect, createXIdentityConnectProvider, enableXActorSubject, enableXActorSubjectFromConnectors, xConnectUrl, xIdentityConnectProvider, isXActorSubjectEnabled, isXConnectConfigured, resetXActorSubjectEnabledForTests, X_CONNECT_CALLBACK_PATH, X_CONNECT_LINK_PATH, X_CONNECT_START_PATH, X_CONNECT_STATUS_PATH, } from "./connect-http.js";
+//# sourceMappingURL=index.js.map

package/dist/identity/x/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/x/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,8BAA8B,EAC9B,mBAAmB,EACnB,iCAAiC,EACjC,WAAW,EACX,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,iCAAiC,EACjC,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC"}

package/dist/index.d.ts

@@ -1,26 +1,19 @@
 export { defineDeepAgent } from "./define-deep-agent.js";
-export { defineMcpServers } from "./connectors/mcp/index.js";
-export * as github from "./connectors/github/index.js";
-export * as slack from "./identity/slack/index.js";
-export * as langsmith from "./connectors/langsmith/index.js";
-export type { GitHubCheckoutReuse, GitHubConnector, GitHubConnectorConfig, GitHubRepositoryCheckout, } from "./connectors/github/index.js";
-export type { LangSmithCapability, LangSmithCallerSurface, LangSmithCapabilityScope, LangSmithConnector, LangSmithConnectorConfig, LangSmithResource, LangSmithResponseShape, } from "./connectors/langsmith/index.js";
 export { defineSchedule } from "./schedules.js";
-export { defineSandbox } from "./sandbox.js";
-export { defineIdentity, providers, validateIdentity, } from "./identity/index.js";
-export { defineSlackChannel } from "./channels/slack/index.js";
-export { defineGitHubChannel } from "./channels/github/index.js";
-export { CHANNEL_ERROR_CODES, ChannelError, createRuntimeChannel, normalizeChannelDestination, } from "./channels/index.js";
-export { decodeSlackSourceThreadKey, encodeSlackSourceThreadKey, normalizeSlackEvent, requiredSlackScopes, toChannelManifest, verifySlackRequest, } from "./channels/slack/index.js";
-export { toGitHubChannelManifest, verifyGitHubWebhookSignature, normalizeGitHubEvent, } from "./channels/github/index.js";
-export type { CredentialResolver, CredentialResolverConfig, CredentialScope, CredentialTarget, DefineIdentity, GitHubActorTokenArgs, GitHubAppJwtArgs, GitHubCredentialsOptions, GitHubTokenSource, HttpIngress, IdentityConfig, IdentityConnectProvider, IdentityDefinition, IdentityPresetName, MemoryScope, ResolvedCredential, RuntimeIdentity, Tenancy, ThreadScope, ValidatedTokenIngress, ValidatedTokenProvider, } from "./identity/index.js";
-export type { HttpMcpServerConfig, McpServersConfig, McpServersDefinition, McpToolSelectionConfig, RemoteMcpServerBaseConfig, RemoteMcpServerConfig, SseMcpServerConfig, } from "./connectors/mcp/index.js";
-export { CONNECTOR_BRAND, isConnector } from "./runtime/connector.js";
-export type { Connector, ConnectorSandboxBackend, ConnectorToolList, HttpContext, SandboxContext, ToolContext, } from "./runtime/connector.js";
-export type { ScheduleConfig, ScheduleDefinition, ScheduleDeliveryTarget, ScheduleThreadConfig, } from "./schedules.js";
-export type { ChannelAddress, ChannelCapabilities, ChannelDestination, ChannelErrorCode, ChannelEvent, ChannelMessage, ChannelMessageUpdate, PostedChannelMessage, RuntimeChannel, } from "./channels/index.js";
-export type { ChannelManifest, SlackChannelConfig, SlackChannelDefinition, SlackChannelTrigger, } from "./channels/slack/index.js";
+export { defineIdentity } from "./identity/index.js";
+export { auth, connect, connectors, credentials, sandboxes, } from "./namespaces.js";
+export type { Connect, Connectors, LangSmithConnectorsNamespace, } from "./namespaces.js";
 export type { DeepAgentDefinition, DefineDeepAgentConfig, ManagedDeepAgentKey, } from "./types.js";
+export type { ScheduleConfig, ScheduleDefinition, ScheduleDeliveryTarget, ScheduleThreadConfig, } from "./schedules.js";
+export type { ClaimMapping, CredentialConnectRequirements, CredentialResolver, CredentialResolverConfig, CredentialResolvers, CredentialScope, CredentialTarget, GitHubAppJwtArgs, GitHubCredentialsOptions, GitHubTokenSource, GitHubUserTokenArgs, HttpIngress, IdentityAuth, IdentityConfig, IdentityConnectProvider, IdentityDefinition, IdentityOptions, IdentityScope, IdentityScopeOverrides, MemoryScope, OrganizationRequirement, ResolvedCredential, RuntimeIdentity, ThreadScope, ValidatedTokenIngress, ValidatedTokenProvider, } from "./identity/index.js";
+export type { GitHubCheckoutReuse, GitHubConnector, GitHubConnectorConfig, GitHubRepositoryCheckout, } from "./connectors/github/index.js";
+export type { LangSmithCallerSurface, LangSmithCapability, LangSmithCapabilityScope, LangSmithConnector, LangSmithConnectorConfig, LangSmithResource, LangSmithResponseShape, } from "./connectors/langsmith/index.js";
+export type { HttpMcpServerConfig, McpServersConfig, McpServersDefinition, McpToolSelectionConfig, RemoteMcpServerBaseConfig, RemoteMcpServerConfig, SseMcpServerConfig, } from "./connectors/mcp/index.js";
+export type { ToolSelection, ToolSelectionConnectorConfig, } from "./connectors/tool-selection.js";
+export type { ToolServerConnector, ToolServerConnectorConfig, ToolServerConnectorFactory, ToolServerConnectorFactoryFor, ToolServerConnectors, ToolServerFactoryName, ToolServerIntegration, ToolServerIntegrationEntry, ToolServerSlug, ToolServerToolSelection, ToolsForFactory, } from "./connectors/toolserver/index.js";
+export { integrationForFactory } from "./connectors/toolserver/index.js";
+export type { ChannelManifest, RequiredSlackConnectorConfig, SlackAppConfig, SlackChannelFilters, SlackChannelTrigger, SlackConnector, SlackConnectorConfig, SlackConversationPolicy, SlackMentionBehavior, } from "./connectors/slack/index.js";
+export type { GitHubChannelConfig, GitHubChannelDefinition, GitHubChannelHandler, GitHubChannelTrigger, GitHubWebhookPromptEvent, } from "./connectors/github/define.js";
+export type { LangSmithSandboxOptions, SandboxDefinition, SandboxScope, } from "./sandbox.js";
 export type { ManagedDeepAgentRuntime, ManagedRuntimeExtras, } from "./runtime/managed-tools.js";
-export type { DefineSandboxOptions, ManagedSandboxOptionKey, SandboxDefinition, SandboxProviderClass, SandboxProviderOptions, SandboxScope, } from "./sandbox.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,8BAA8B,CAAC;AACvD,OAAO,KAAK,KAAK,MAAM,2BAA2B,CAAC;AACnD,OAAO,KAAK,SAAS,MAAM,iCAAiC,CAAC;AAC7D,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,SAAS,EACT,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,OAAO,EACP,WAAW,EACX,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACtE,YAAY,EACV,SAAS,EACT,uBAAuB,EACvB,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,WAAW,GACZ,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,GACb,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EACL,IAAI,EACJ,OAAO,EACP,UAAU,EACV,WAAW,EACX,SAAS,GACV,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,OAAO,EACP,UAAU,EACV,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,YAAY,EACZ,6BAA6B,EAC7B,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,YAAY,EACZ,cAAc,EACd,uBAAuB,EACvB,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,WAAW,EACX,uBAAuB,EACvB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,aAAa,EACb,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC1B,6BAA6B,EAC7B,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,cAAc,EACd,uBAAuB,EACvB,eAAe,GAChB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAEzE,YAAY,EACV,eAAe,EACf,4BAA4B,EAC5B,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AAEvC,YAAY,EACV,uBAAuB,EACvB,iBAAiB,EACjB,YAAY,GACb,MAAM,cAAc,CAAC;AAEtB,YAAY,EACV,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -1,15 +1,6 @@
 export { defineDeepAgent } from "./define-deep-agent.js";
-export { defineMcpServers } from "./connectors/mcp/index.js";
-export * as github from "./connectors/github/index.js";
-export * as slack from "./identity/slack/index.js";
-export * as langsmith from "./connectors/langsmith/index.js";
 export { defineSchedule } from "./schedules.js";
-export { defineSandbox } from "./sandbox.js";
-export { defineIdentity, providers, validateIdentity, } from "./identity/index.js";
-export { defineSlackChannel } from "./channels/slack/index.js";
-export { defineGitHubChannel } from "./channels/github/index.js";
-export { CHANNEL_ERROR_CODES, ChannelError, createRuntimeChannel, normalizeChannelDestination, } from "./channels/index.js";
-export { decodeSlackSourceThreadKey, encodeSlackSourceThreadKey, normalizeSlackEvent, requiredSlackScopes, toChannelManifest, verifySlackRequest, } from "./channels/slack/index.js";
-export { toGitHubChannelManifest, verifyGitHubWebhookSignature, normalizeGitHubEvent, } from "./channels/github/index.js";
-export { CONNECTOR_BRAND, isConnector } from "./runtime/connector.js";
+export { defineIdentity } from "./identity/index.js";
+export { auth, connect, connectors, credentials, sandboxes, } from "./namespaces.js";
+export { integrationForFactory } from "./connectors/toolserver/index.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,8BAA8B,CAAC;AACvD,OAAO,KAAK,KAAK,MAAM,2BAA2B,CAAC;AACnD,OAAO,KAAK,SAAS,MAAM,iCAAiC,CAAC;AAgB7D,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,SAAS,EACT,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAoCpC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EACL,IAAI,EACJ,OAAO,EACP,UAAU,EACV,WAAW,EACX,SAAS,GACV,MAAM,iBAAiB,CAAC;AA0FzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/ingress/index.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Managed ingress pipeline: verified inbound event → agent run.
+ *
+ * Providers keep signature verification, event normalization, and reply
+ * transport. This module owns the shared pieces: deterministic thread ids,
+ * trusted loopback invoke with source-provider stamps, and source-thread
+ * existence probes.
+ */
+import { type ChannelBinding } from "../channels/binding.js";
+/** Inputs for the source-thread involvement probe (after identity remap). */
+export interface SourceThreadExistsInput {
+    sourceThreadKey: string;
+    userId: string;
+    organizationId?: string;
+}
+export interface InvokeIngressAgentInput {
+    userId: string;
+    organizationId?: string;
+    sourceThreadKey: string;
+    binding: ChannelBinding;
+    text: string;
+    assistantId: string;
+    /** Trusted source provider stamped on loopback invoke. */
+    sourceProvider?: ChannelBinding["provider"];
+}
+export interface InvokeIngressAgentResult {
+    replyText: string;
+    runId?: string;
+    threadId: string;
+}
+/**
+ * Schedule background work after the provider ACK. Defaults to fire-and-forget
+ * with error logging; tests pass an inline runner.
+ */
+export declare function scheduleIngressWork(work: () => Promise<void>, options: {
+    label: string;
+    schedule?: (work: () => Promise<void>) => void;
+}): void;
+/**
+ * True when an MDA thread already exists for this source-thread key.
+ *
+ * Call with the **resolved** actor (post identity remap) so ownership matches
+ * the thread created on the first run.
+ */
+export declare function ingressSourceThreadExists(input: SourceThreadExistsInput): Promise<boolean>;
+/**
+ * Invoke the managed graph over a trusted loopback with ingress identity stamped.
+ *
+ * Only this path may set `x-mda-source-provider` / `x-mda-source-thread-id`.
+ */
+export declare function invokeIngressAgent(input: InvokeIngressAgentInput): Promise<InvokeIngressAgentResult>;
+/** Deterministic LangGraph thread id from a provider source-thread key. */
+export declare function stableThreadId(sourceThreadKey: string): string;
+//# sourceMappingURL=index.d.ts.map

package/dist/ingress/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ingress/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAehC,6EAA6E;AAC7E,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,cAAc,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EACzB,OAAO,EAAE;IACP,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;CAChD,GACA,IAAI,CASN;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CAgDnC;AA2BD,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAS9D"}