managed-deepagents 0.5.0-dev.80 → 0.5.0-dev.82

package/dist/identity/marketplace/connect.js

@@ -0,0 +1,88 @@
+/**
+ * Connect-with-X for Fleet marketplace MCP integrations.
+ *
+ * Thin adapter over {@link createFleetVaultConnectProvider}: same actor →
+ * agent_id vault lifecycle as Google / Microsoft / LinkedIn, but the OAuth
+ * provider slug is discovered at runtime from the workspace `mcp_servers` row.
+ *
+ * `connect.<id>()` factories and identity-http candidates are derived from
+ * {@link MARKETPLACE_MCP_INTEGRATIONS}.
+ */
+import { MARKETPLACE_MCP_INTEGRATIONS, hasMarketplaceConnector, } from "../../connectors/marketplace/catalog.js";
+import { resolveMarketplaceMcpServer } from "../../connectors/marketplace/fleet-mcp.js";
+import { enableActorSubjectIntegration } from "../actor-subject.js";
+import { createFleetVaultConnectProvider, } from "../fleet-connect.js";
+import { createFleetAuthSession, deleteAgentConnection, listAgentConnections, } from "../fleet.js";
+import { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, resolveSlackOauthRedirectBase, } from "../slack/oauth.js";
+import { marketplaceAsFleetHint } from "./connect-hint.js";
+function fleetClientOptions(fleet) {
+    if (!fleet) {
+        return undefined;
+    }
+    const { list, delete: remove, createSession, resolveServer: _resolveServer, ...rest } = fleet;
+    return {
+        ...rest,
+        ...(list ? { list } : {}),
+        ...(remove ? { delete: remove } : {}),
+        ...(createSession ? { createAuthSession: createSession } : {}),
+    };
+}
+/**
+ * Build a Connect provider for a marketplace MCP integration.
+ *
+ * Mounts when declared on `identity.connect`, or when the matching
+ * `connectors.<id>` is present on a user-scoped deployment.
+ */
+export function createMarketplaceVaultConnectProvider(integration, options = {}) {
+    const resolveServer = options.fleet?.resolveServer ?? resolveMarketplaceMcpServer;
+    const fleet = fleetClientOptions(options.fleet);
+    return createFleetVaultConnectProvider({
+        integration: marketplaceAsFleetHint(integration),
+        ...(options.scopes ? { scopes: [...options.scopes] } : {}),
+        fallbackScopes: [...(integration.scopes ?? [])],
+        resolveRedirectBase: resolveSlackOauthRedirectBase,
+        resolvePublicAppUrl() {
+            return (process.env[MDA_PUBLIC_APP_URL_ENV]?.replace(/\/$/, "") ||
+                process.env[MDA_PUBLIC_API_URL_ENV]?.replace(/\/$/, ""));
+        },
+        ...(fleet ? { fleet } : {}),
+        async resolveProviderSlug() {
+            const server = await resolveServer({
+                mcpUrl: integration.mcpUrl,
+                ...(fleet ?? {}),
+            });
+            const providerId = server.oauth_provider_id?.trim();
+            if (!providerId) {
+                throw new Error(`${integration.displayName} MCP server has no oauth_provider_id`);
+            }
+            return providerId;
+        },
+        hasDeclaredConnector: (kinds) => hasMarketplaceConnector(integration.id, kinds),
+        notConfiguredError: `${integration.displayName} connect needs LANGSMITH_API_KEY ` +
+            `(and a workspace ${integration.displayName} MCP server from Fleet marketplace).`,
+        softAuthorizeFailures: true,
+    });
+}
+/**
+ * Default Connect providers for every marketplace catalog entry.
+ *
+ * Shared between `connect.<id>()` (no options) and identity-http candidates so
+ * mount inference and explicit opt-in use the same instances.
+ */
+export const marketplaceIdentityConnectProviders = MARKETPLACE_MCP_INTEGRATIONS.map((entry) => createMarketplaceVaultConnectProvider(entry));
+/**
+ * `connect.<id>()` factories derived from the marketplace catalog.
+ *
+ * Usually unnecessary: declaring `connectors.<id>` on a user-scoped identity
+ * deployment mounts the matching Connect flow automatically.
+ */
+export const marketplaceConnect = Object.fromEntries(MARKETPLACE_MCP_INTEGRATIONS.map((entry, index) => [
+    entry.id,
+    (options) => {
+        enableActorSubjectIntegration(entry.id);
+        return options
+            ? createMarketplaceVaultConnectProvider(entry, options)
+            : marketplaceIdentityConnectProviders[index];
+    },
+]));
+//# sourceMappingURL=connect.js.map

package/dist/identity/marketplace/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../../src/identity/marketplace/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,GAGxB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAEpE,OAAO,EACL,+BAA+B,GAEhC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,GAErB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAqB3D,SAAS,kBAAkB,CACzB,KAAiD;IAEjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EACJ,IAAI,EACJ,MAAM,EAAE,MAAM,EACd,aAAa,EACb,aAAa,EAAE,cAAc,EAC7B,GAAG,IAAI,EACR,GAAG,KAAK,CAAC;IACV,OAAO;QACL,GAAG,IAAI;QACP,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CACnD,WAAsC,EACtC,OAAO,GAAsC,EAAE;IAE/C,MAAM,aAAa,GACjB,OAAO,CAAC,KAAK,EAAE,aAAa,IAAI,2BAA2B,CAAC;IAC9D,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAEhD,OAAO,+BAA+B,CAAC;QACrC,WAAW,EAAE,sBAAsB,CAAC,WAAW,CAAC;QAChD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,cAAc,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC/C,mBAAmB,EAAE,6BAA6B;QAClD,mBAAmB;YACjB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBACvD,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,mBAAmB;YACvB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;gBACjC,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;aACjB,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,GAAG,WAAW,CAAC,WAAW,sCAAsC,CACjE,CAAC;YACJ,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC9B,uBAAuB,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC;QAChD,kBAAkB,EAChB,GAAG,WAAW,CAAC,WAAW,mCAAmC;YAC7D,oBAAoB,WAAW,CAAC,WAAW,sCAAsC;QACnF,qBAAqB,EAAE,IAAI;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAC9C,4BAA4B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,qCAAqC,CAAC,KAAK,CAAC,CAC7C,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAuB,MAAM,CAAC,WAAW,CACtE,4BAA4B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;IACjD,KAAK,CAAC,EAAE;IACR,CAAC,OAA2C,EAAE,EAAE;QAC9C,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxC,OAAO,OAAO;YACZ,CAAC,CAAC,qCAAqC,CAAC,KAAK,EAAE,OAAO,CAAC;YACvD,CAAC,CAAC,mCAAmC,CAAC,KAAK,CAAE,CAAC;IAClD,CAAC;CACF,CAAC,CACmB,CAAC"}

package/dist/identity/marketplace/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Marketplace identity helpers — Connect-with-X for Fleet marketplace MCP bridges.
+ *
+ * One surface covers every catalog entry (Notion, Cloudflare, Neon, …): vault
+ * Connect providers, `connect.<id>()` factories, and proactive connect hints.
+ */
+export { createMarketplaceVaultConnectProvider, marketplaceConnect, marketplaceIdentityConnectProviders, type MarketplaceConnect, type MarketplaceConnectProviderOptions, } from "./connect.js";
+export { createMarketplaceConnectHintMiddleware, marketplaceAsFleetHint, marketplaceConnectHintUrl, type MarketplaceConnectHintMiddlewareOptions, } from "./connect-hint.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/marketplace/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/marketplace/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,qCAAqC,EACrC,kBAAkB,EAClB,mCAAmC,EACnC,KAAK,kBAAkB,EACvB,KAAK,iCAAiC,GACvC,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sCAAsC,EACtC,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,uCAAuC,GAC7C,MAAM,mBAAmB,CAAC"}

package/dist/identity/marketplace/index.js

@@ -0,0 +1,9 @@
+/**
+ * Marketplace identity helpers — Connect-with-X for Fleet marketplace MCP bridges.
+ *
+ * One surface covers every catalog entry (Notion, Cloudflare, Neon, …): vault
+ * Connect providers, `connect.<id>()` factories, and proactive connect hints.
+ */
+export { createMarketplaceVaultConnectProvider, marketplaceConnect, marketplaceIdentityConnectProviders, } from "./connect.js";
+export { createMarketplaceConnectHintMiddleware, marketplaceAsFleetHint, marketplaceConnectHintUrl, } from "./connect-hint.js";
+//# sourceMappingURL=index.js.map

package/dist/identity/marketplace/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/marketplace/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,qCAAqC,EACrC,kBAAkB,EAClB,mCAAmC,GAGpC,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sCAAsC,EACtC,sBAAsB,EACtB,yBAAyB,GAE1B,MAAM,mBAAmB,CAAC"}

package/dist/identity/microsoft/connect-http.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Connect-with-Microsoft — thin adapter over {@link createFleetIntegrationConnectProvider}.
+ *
+ * Mounted under `/identity/microsoft/*` when listed on `identity.connect`, or
+ * inferred from declared Microsoft toolserver connectors on a user-scoped
+ * deployment.
+ */
+import type { IdentityConnectMountContext, IdentityConnectProvider } from "../connect-provider-types.js";
+import { type FleetIntegrationConnectProviderOptions } from "../fleet-integration-connect.js";
+export declare const MICROSOFT_CONNECT_STATUS_PATH: string;
+export declare const MICROSOFT_CONNECT_START_PATH: string;
+export declare const MICROSOFT_CONNECT_CALLBACK_PATH: string;
+export declare const MICROSOFT_CONNECT_LINK_PATH: string;
+export declare function isMicrosoftActorSubjectEnabled(): boolean;
+export declare function enableMicrosoftActorSubject(): void;
+/**
+ * Enable actor-subject mode when Microsoft connectors imply per-user vault subjects.
+ *
+ * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
+ */
+export declare function enableMicrosoftActorSubjectFromConnectors(connectorKinds: readonly (string | undefined)[] | undefined, scope?: IdentityConnectMountContext["scope"]): void;
+export declare function resetMicrosoftActorSubjectEnabledForTests(): void;
+export declare function isMicrosoftConnectConfigured(env?: NodeJS.ProcessEnv): boolean;
+export declare function microsoftConnectUrl(publicAppUrl: string): string;
+/** Options for {@link createMicrosoftIdentityConnectProvider}. */
+export type MicrosoftIdentityConnectProviderOptions = FleetIntegrationConnectProviderOptions;
+/** Build a Microsoft connect provider. */
+export declare function createMicrosoftIdentityConnectProvider(options?: MicrosoftIdentityConnectProviderOptions): IdentityConnectProvider;
+/** Default Microsoft connect provider used as a built-in mount candidate. */
+export declare const microsoftIdentityConnectProvider: IdentityConnectProvider;
+/**
+ * Opt into Connect-with-Microsoft on `defineIdentity({ connect: […] })`.
+ *
+ * Usually unnecessary: declaring Microsoft toolserver connectors on a
+ * user-scoped identity deployment mounts this provider and derives OAuth
+ * scopes automatically.
+ */
+export declare function connect(options?: MicrosoftIdentityConnectProviderOptions): IdentityConnectProvider;
+//# sourceMappingURL=connect-http.d.ts.map

package/dist/identity/microsoft/connect-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/microsoft/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAIL,KAAK,sCAAsC,EAC5C,MAAM,iCAAiC,CAAC;AAKzC,eAAO,MAAM,6BAA6B,QAAe,CAAC;AAC1D,eAAO,MAAM,4BAA4B,QAAgB,CAAC;AAC1D,eAAO,MAAM,+BAA+B,QAAiB,CAAC;AAC9D,eAAO,MAAM,2BAA2B,QAAa,CAAC;AAEtD,wBAAgB,8BAA8B,IAAI,OAAO,CAExD;AAED,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED;;;;GAIG;AACH,wBAAgB,yCAAyC,CACvD,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC3C,IAAI,CAMN;AAED,wBAAgB,yCAAyC,IAAI,IAAI,CAEhE;AAED,wBAAgB,4BAA4B,CAC1C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET;AAED,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,kEAAkE;AAClE,MAAM,MAAM,uCAAuC,GACjD,sCAAsC,CAAC;AAEzC,0CAA0C;AAC1C,wBAAgB,sCAAsC,CACpD,OAAO,GAAE,uCAA4C,GACpD,uBAAuB,CAMzB;AAED,6EAA6E;AAC7E,eAAO,MAAM,gCAAgC,EAAE,uBACL,CAAC;AAE3C;;;;;;GAMG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,uCAAuC,GAChD,uBAAuB,CAKzB"}

package/dist/identity/microsoft/connect-http.js

@@ -0,0 +1,60 @@
+/**
+ * Connect-with-Microsoft — thin adapter over {@link createFleetIntegrationConnectProvider}.
+ *
+ * Mounted under `/identity/microsoft/*` when listed on `identity.connect`, or
+ * inferred from declared Microsoft toolserver connectors on a user-scoped
+ * deployment.
+ */
+import { MICROSOFT_INTEGRATION } from "../../connectors/toolserver/integrations.js";
+import { enableActorSubjectIntegration, enableActorSubjectIntegrationFromConnectors, isActorSubjectIntegrationEnabled, resetActorSubjectEnabledForTests, } from "../actor-subject.js";
+import { identityConnectPaths } from "../connect-paths.js";
+import { createFleetIntegrationConnectProvider, fleetIntegrationConnectUrl, isFleetIntegrationConnectConfigured, } from "../fleet-integration-connect.js";
+import { microsoftByoOauth } from "./oauth.js";
+const PATHS = identityConnectPaths("microsoft");
+export const MICROSOFT_CONNECT_STATUS_PATH = PATHS.status;
+export const MICROSOFT_CONNECT_START_PATH = PATHS.connect;
+export const MICROSOFT_CONNECT_CALLBACK_PATH = PATHS.callback;
+export const MICROSOFT_CONNECT_LINK_PATH = PATHS.link;
+export function isMicrosoftActorSubjectEnabled() {
+    return isActorSubjectIntegrationEnabled("microsoft");
+}
+export function enableMicrosoftActorSubject() {
+    enableActorSubjectIntegration("microsoft");
+}
+/**
+ * Enable actor-subject mode when Microsoft connectors imply per-user vault subjects.
+ *
+ * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
+ */
+export function enableMicrosoftActorSubjectFromConnectors(connectorKinds, scope) {
+    enableActorSubjectIntegrationFromConnectors(MICROSOFT_INTEGRATION, connectorKinds, scope);
+}
+export function resetMicrosoftActorSubjectEnabledForTests() {
+    resetActorSubjectEnabledForTests();
+}
+export function isMicrosoftConnectConfigured(env = process.env) {
+    return isFleetIntegrationConnectConfigured(microsoftByoOauth, env);
+}
+export function microsoftConnectUrl(publicAppUrl) {
+    return fleetIntegrationConnectUrl(MICROSOFT_INTEGRATION, publicAppUrl);
+}
+/** Build a Microsoft connect provider. */
+export function createMicrosoftIdentityConnectProvider(options = {}) {
+    return createFleetIntegrationConnectProvider(MICROSOFT_INTEGRATION, microsoftByoOauth, options);
+}
+/** Default Microsoft connect provider used as a built-in mount candidate. */
+export const microsoftIdentityConnectProvider = createMicrosoftIdentityConnectProvider();
+/**
+ * Opt into Connect-with-Microsoft on `defineIdentity({ connect: […] })`.
+ *
+ * Usually unnecessary: declaring Microsoft toolserver connectors on a
+ * user-scoped identity deployment mounts this provider and derives OAuth
+ * scopes automatically.
+ */
+export function connect(options) {
+    enableMicrosoftActorSubject();
+    return options
+        ? createMicrosoftIdentityConnectProvider(options)
+        : microsoftIdentityConnectProvider;
+}
+//# sourceMappingURL=connect-http.js.map

package/dist/identity/microsoft/connect-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/microsoft/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EACL,6BAA6B,EAC7B,2CAA2C,EAC3C,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAK3D,OAAO,EACL,qCAAqC,EACrC,0BAA0B,EAC1B,mCAAmC,GAEpC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;AAEhD,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAK,CAAC,MAAM,CAAC;AAC1D,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC,OAAO,CAAC;AAC1D,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC9D,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC,IAAI,CAAC;AAEtD,MAAM,UAAU,8BAA8B;IAC5C,OAAO,gCAAgC,CAAC,WAAW,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,6BAA6B,CAAC,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yCAAyC,CACvD,cAA2D,EAC3D,KAA4C;IAE5C,2CAA2C,CACzC,qBAAqB,EACrB,cAAc,EACd,KAAK,CACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yCAAyC;IACvD,gCAAgC,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,mCAAmC,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,OAAO,0BAA0B,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC;AACzE,CAAC;AAMD,0CAA0C;AAC1C,MAAM,UAAU,sCAAsC,CACpD,OAAO,GAA4C,EAAE;IAErD,OAAO,qCAAqC,CAC1C,qBAAqB,EACrB,iBAAiB,EACjB,OAAO,CACR,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gCAAgC,GAC3C,sCAAsC,EAAE,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CACrB,OAAiD;IAEjD,2BAA2B,EAAE,CAAC;IAC9B,OAAO,OAAO;QACZ,CAAC,CAAC,sCAAsC,CAAC,OAAO,CAAC;QACjD,CAAC,CAAC,gCAAgC,CAAC;AACvC,CAAC"}

package/dist/identity/microsoft/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Microsoft identity helpers — Connect-with-Microsoft (Fleet vault).
+ */
+export { connect, createMicrosoftIdentityConnectProvider, enableMicrosoftActorSubject, enableMicrosoftActorSubjectFromConnectors, microsoftConnectUrl, microsoftIdentityConnectProvider, isMicrosoftActorSubjectEnabled, isMicrosoftConnectConfigured, resetMicrosoftActorSubjectEnabledForTests, MICROSOFT_CONNECT_CALLBACK_PATH, MICROSOFT_CONNECT_LINK_PATH, MICROSOFT_CONNECT_START_PATH, MICROSOFT_CONNECT_STATUS_PATH, } from "./connect-http.js";
+export type { MicrosoftIdentityConnectProviderOptions } from "./connect-http.js";
+export { microsoftOauthTickets } from "./oauth.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/microsoft/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/microsoft/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,sCAAsC,EACtC,2BAA2B,EAC3B,yCAAyC,EACzC,mBAAmB,EACnB,gCAAgC,EAChC,8BAA8B,EAC9B,4BAA4B,EAC5B,yCAAyC,EACzC,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,uCAAuC,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC"}

package/dist/identity/microsoft/index.js

@@ -0,0 +1,6 @@
+/**
+ * Microsoft identity helpers — Connect-with-Microsoft (Fleet vault).
+ */
+export { connect, createMicrosoftIdentityConnectProvider, enableMicrosoftActorSubject, enableMicrosoftActorSubjectFromConnectors, microsoftConnectUrl, microsoftIdentityConnectProvider, isMicrosoftActorSubjectEnabled, isMicrosoftConnectConfigured, resetMicrosoftActorSubjectEnabledForTests, MICROSOFT_CONNECT_CALLBACK_PATH, MICROSOFT_CONNECT_LINK_PATH, MICROSOFT_CONNECT_START_PATH, MICROSOFT_CONNECT_STATUS_PATH, } from "./connect-http.js";
+export { microsoftOauthTickets } from "./oauth.js";
+//# sourceMappingURL=index.js.map

package/dist/identity/microsoft/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/microsoft/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,sCAAsC,EACtC,2BAA2B,EAC3B,yCAAyC,EACzC,mBAAmB,EACnB,gCAAgC,EAChC,8BAA8B,EAC9B,4BAA4B,EAC5B,yCAAyC,EACzC,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC"}

package/dist/identity/microsoft/oauth.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Microsoft BYO OAuth descriptor — optional non-LangSmith Connect-with-Microsoft.
+ * The default path uses Fleet auth-sessions instead.
+ */
+import { type ByoOauthConfig, type ByoOauthClient } from "../byo-oauth.js";
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, } from "../byo-oauth.js";
+export type MicrosoftOauthConfig = ByoOauthConfig;
+/** Azure AD tenant (`common`, `organizations`, `consumers`, or a tenant id). */
+export declare const MICROSOFT_OAUTH_TENANT_ENV = "MICROSOFT_OAUTH_TENANT";
+/** Microsoft BYO OAuth client (config, authorize, exchange, Fleet adapter). */
+export declare const microsoftByoOauth: ByoOauthClient;
+export declare const MICROSOFT_OAUTH_CLIENT_ID_ENV: string;
+export declare const MICROSOFT_OAUTH_CLIENT_SECRET_ENV: string;
+export declare const MICROSOFT_OAUTH_SCOPES_ENV: string;
+export declare const MICROSOFT_OAUTH_AUTH_URL_ENV: string;
+export declare const MICROSOFT_OAUTH_TOKEN_URL_ENV: string;
+export declare const MICROSOFT_OAUTH_USERINFO_URL_ENV: string;
+/** Microsoft-bound OAuth state / connect-ticket helpers. */
+export declare const microsoftOauthTickets: import("../oauth-tickets.js").OauthTickets;
+export declare const resolveMicrosoftOauthRedirectBase: typeof import("../byo-oauth.js").resolveSlackOauthRedirectBase;
+export declare const readMicrosoftOauthConfig: (env?: NodeJS.ProcessEnv) => ByoOauthConfig | null;
+export declare const buildMicrosoftAuthorizeUrl: (config: ByoOauthConfig, state: string, redirectUri: string, scopes?: string) => string;
+export declare const exchangeMicrosoftOauthCode: (config: ByoOauthConfig, code: string, redirectUri: string, fetchImpl?: typeof fetch) => Promise<import("../fleet-connect.js").FleetVaultByoTokenResult>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/identity/microsoft/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/microsoft/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAElD,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AAqBnE,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,EAAE,cA2B9B,CAAC;AAEH,eAAO,MAAM,6BAA6B,QAAiC,CAAC;AAC5E,eAAO,MAAM,iCAAiC,QACV,CAAC;AACrC,eAAO,MAAM,0BAA0B,QAA+B,CAAC;AACvE,eAAO,MAAM,4BAA4B,QAAgC,CAAC;AAC1E,eAAO,MAAM,6BAA6B,QAAiC,CAAC;AAC5E,eAAO,MAAM,gCAAgC,QACV,CAAC;AAEpC,4DAA4D;AAC5D,eAAO,MAAM,qBAAqB,4CAA4B,CAAC;AAE/D,eAAO,MAAM,iCAAiC,gEACP,CAAC;AAExC,eAAO,MAAM,wBAAwB,oDAA+B,CAAC;AACrE,eAAO,MAAM,0BAA0B,yFAAsC,CAAC;AAC9E,eAAO,MAAM,0BAA0B,0JAAiC,CAAC"}

package/dist/identity/microsoft/oauth.js

@@ -0,0 +1,65 @@
+/**
+ * Microsoft BYO OAuth descriptor — optional non-LangSmith Connect-with-Microsoft.
+ * The default path uses Fleet auth-sessions instead.
+ */
+import { createByoOauthClient, } from "../byo-oauth.js";
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, } from "../byo-oauth.js";
+/** Azure AD tenant (`common`, `organizations`, `consumers`, or a tenant id). */
+export const MICROSOFT_OAUTH_TENANT_ENV = "MICROSOFT_OAUTH_TENANT";
+const DEFAULT_TENANT = "common";
+const DEFAULT_USERINFO_URL = "https://graph.microsoft.com/v1.0/me";
+/** Profile + refresh; connector-derived unions replace this at authorize time. */
+const DEFAULT_SCOPES = [
+    "openid",
+    "email",
+    "profile",
+    "offline_access",
+    "https://graph.microsoft.com/User.Read",
+].join(" ");
+function defaultAuthUrl(tenant) {
+    return `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize`;
+}
+function defaultTokenUrl(tenant) {
+    return `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`;
+}
+/** Microsoft BYO OAuth client (config, authorize, exchange, Fleet adapter). */
+export const microsoftByoOauth = createByoOauthClient({
+    providerId: "microsoft",
+    displayName: "Microsoft",
+    envPrefix: "MICROSOFT_OAUTH",
+    defaultEndpoints(env) {
+        const tenant = env[MICROSOFT_OAUTH_TENANT_ENV]?.trim() || DEFAULT_TENANT;
+        return {
+            authUrl: defaultAuthUrl(tenant),
+            tokenUrl: defaultTokenUrl(tenant),
+            userInfoUrl: DEFAULT_USERINFO_URL,
+            defaultScopes: DEFAULT_SCOPES,
+        };
+    },
+    authorizeParams: { response_mode: "query" },
+    parseUserInfo(json) {
+        const mail = typeof json.mail === "string" ? json.mail : undefined;
+        const upn = typeof json.userPrincipalName === "string"
+            ? json.userPrincipalName
+            : undefined;
+        const id = typeof json.id === "string" ? json.id : undefined;
+        return {
+            ...(mail || upn ? { email: mail || upn } : {}),
+            ...(id ? { subject: id } : {}),
+        };
+    },
+    subjectMetadataKey: "microsoft_oid",
+});
+export const MICROSOFT_OAUTH_CLIENT_ID_ENV = microsoftByoOauth.env.clientId;
+export const MICROSOFT_OAUTH_CLIENT_SECRET_ENV = microsoftByoOauth.env.clientSecret;
+export const MICROSOFT_OAUTH_SCOPES_ENV = microsoftByoOauth.env.scopes;
+export const MICROSOFT_OAUTH_AUTH_URL_ENV = microsoftByoOauth.env.authUrl;
+export const MICROSOFT_OAUTH_TOKEN_URL_ENV = microsoftByoOauth.env.tokenUrl;
+export const MICROSOFT_OAUTH_USERINFO_URL_ENV = microsoftByoOauth.env.userInfoUrl;
+/** Microsoft-bound OAuth state / connect-ticket helpers. */
+export const microsoftOauthTickets = microsoftByoOauth.tickets;
+export const resolveMicrosoftOauthRedirectBase = microsoftByoOauth.resolveRedirectBase;
+export const readMicrosoftOauthConfig = microsoftByoOauth.readConfig;
+export const buildMicrosoftAuthorizeUrl = microsoftByoOauth.buildAuthorizeUrl;
+export const exchangeMicrosoftOauthCode = microsoftByoOauth.exchangeCode;
+//# sourceMappingURL=oauth.js.map

package/dist/identity/microsoft/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/identity/microsoft/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,oBAAoB,GAGrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAIzB,gFAAgF;AAChF,MAAM,CAAC,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAEnE,MAAM,cAAc,GAAG,QAAQ,CAAC;AAChC,MAAM,oBAAoB,GAAG,qCAAqC,CAAC;AACnE,kFAAkF;AAClF,MAAM,cAAc,GAAG;IACrB,QAAQ;IACR,OAAO;IACP,SAAS;IACT,gBAAgB;IAChB,uCAAuC;CACxC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,qCAAqC,MAAM,wBAAwB,CAAC;AAC7E,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,qCAAqC,MAAM,oBAAoB,CAAC;AACzE,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,iBAAiB,GAAmB,oBAAoB,CAAC;IACpE,UAAU,EAAE,WAAW;IACvB,WAAW,EAAE,WAAW;IACxB,SAAS,EAAE,iBAAiB;IAC5B,gBAAgB,CAAC,GAAG;QAClB,MAAM,MAAM,GAAG,GAAG,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC;QACzE,OAAO;YACL,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC;YAC/B,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC;YACjC,WAAW,EAAE,oBAAoB;YACjC,aAAa,EAAE,cAAc;SAC9B,CAAC;IACJ,CAAC;IACD,eAAe,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE;IAC3C,aAAa,CAAC,IAAI;QAChB,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,GAAG,GACP,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ;YACxC,CAAC,CAAC,IAAI,CAAC,iBAAiB;YACxB,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,OAAO;YACL,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/B,CAAC;IACJ,CAAC;IACD,kBAAkB,EAAE,eAAe;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC5E,MAAM,CAAC,MAAM,iCAAiC,GAC5C,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC;AACrC,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;AACvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC;AAC1E,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC5E,MAAM,CAAC,MAAM,gCAAgC,GAC3C,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC;AAEpC,4DAA4D;AAC5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC,OAAO,CAAC;AAE/D,MAAM,CAAC,MAAM,iCAAiC,GAC5C,iBAAiB,CAAC,mBAAmB,CAAC;AAExC,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC,UAAU,CAAC;AACrE,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC,iBAAiB,CAAC;AAC9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC,YAAY,CAAC"}

package/dist/identity/oauth-tickets.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Shared OAuth state and connect-ticket JWTs for Connect-with-X providers.
+ *
+ * Parameterized by provider id so each integration gets distinct `typ` values
+ * (`mda-{id}-oauth-state`, `mda-{id}-connect-ticket`) without copying JWT code.
+ */
+export declare function createOauthState(providerId: string, userId: string, signingKey: string, nowMs?: number): Promise<string>;
+export declare function verifyOauthState(providerId: string, state: string, signingKey: string, nowMs?: number): Promise<{
+    userId: string;
+}>;
+/**
+ * Mint a short-lived connect ticket for channel actors (Slack, etc.) who have
+ * no browser session. The Connect start route accepts `?ticket=…` and binds
+ * the OAuth vault subject to this user id.
+ */
+export declare function createConnectTicket(providerId: string, userId: string, signingKey: string, nowMs?: number): Promise<string>;
+export declare function verifyConnectTicket(providerId: string, ticket: string, signingKey: string, nowMs?: number): Promise<{
+    userId: string;
+}>;
+/** Bound OAuth state / connect-ticket helpers for one Connect provider id. */
+export interface OauthTickets {
+    readonly providerId: string;
+    createState(userId: string, signingKey: string, nowMs?: number): Promise<string>;
+    verifyState(state: string, signingKey: string, nowMs?: number): Promise<{
+        userId: string;
+    }>;
+    createTicket(userId: string, signingKey: string, nowMs?: number): Promise<string>;
+    verifyTicket(ticket: string, signingKey: string, nowMs?: number): Promise<{
+        userId: string;
+    }>;
+}
+/**
+ * Bind {@link createOauthState} / ticket helpers to a Connect provider id
+ * (`mda-{id}-oauth-state`, `mda-{id}-connect-ticket`).
+ */
+export declare function oauthTicketsFor(providerId: string): OauthTickets;
+//# sourceMappingURL=oauth-tickets.d.ts.map

package/dist/identity/oauth-tickets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-tickets.d.ts","sourceRoot":"","sources":["../../src/identity/oauth-tickets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAsBH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAqB7B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAwB7B;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,WAAW,CACT,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,WAAW,CACT,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/B,YAAY,CACV,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,YAAY,CACV,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAgBhE"}

package/dist/identity/oauth-tickets.js

@@ -0,0 +1,114 @@
+/**
+ * Shared OAuth state and connect-ticket JWTs for Connect-with-X providers.
+ *
+ * Parameterized by provider id so each integration gets distinct `typ` values
+ * (`mda-{id}-oauth-state`, `mda-{id}-connect-ticket`) without copying JWT code.
+ */
+import { randomBytes } from "node:crypto";
+import { jwtVerify, SignJWT } from "jose";
+const STATE_TTL_MS = 10 * 60 * 1000;
+/** Short-lived ticket so Slack/email actors can open Connect without a browser session. */
+const CONNECT_TICKET_TTL_MS = 30 * 60 * 1000;
+function stateTyp(providerId) {
+    return `mda-${providerId}-oauth-state`;
+}
+function ticketTyp(providerId) {
+    return `mda-${providerId}-connect-ticket`;
+}
+function stateSigningKey(signingKey) {
+    return new TextEncoder().encode(signingKey);
+}
+export async function createOauthState(providerId, userId, signingKey, nowMs = Date.now()) {
+    const iat = Math.floor(nowMs / 1000);
+    const exp = Math.floor((nowMs + STATE_TTL_MS) / 1000);
+    return new SignJWT({
+        userId,
+        nonce: randomBytes(16).toString("hex"),
+    })
+        .setProtectedHeader({ alg: "HS256", typ: stateTyp(providerId) })
+        .setIssuedAt(iat)
+        .setExpirationTime(exp)
+        .sign(stateSigningKey(signingKey));
+}
+export async function verifyOauthState(providerId, state, signingKey, nowMs = Date.now()) {
+    try {
+        const { payload } = await jwtVerify(state, stateSigningKey(signingKey), {
+            algorithms: ["HS256"],
+            typ: stateTyp(providerId),
+            currentDate: new Date(nowMs),
+        });
+        if (typeof payload.userId !== "string" || !payload.userId) {
+            throw new Error("invalid OAuth state actor");
+        }
+        return { userId: payload.userId };
+    }
+    catch (err) {
+        if (err instanceof Error && err.message.startsWith("invalid OAuth state")) {
+            throw err;
+        }
+        const message = err instanceof Error ? err.message : String(err);
+        if (/exp|expir/i.test(message)) {
+            throw new Error("OAuth state expired");
+        }
+        throw new Error("invalid OAuth state signature");
+    }
+}
+/**
+ * Mint a short-lived connect ticket for channel actors (Slack, etc.) who have
+ * no browser session. The Connect start route accepts `?ticket=…` and binds
+ * the OAuth vault subject to this user id.
+ */
+export async function createConnectTicket(providerId, userId, signingKey, nowMs = Date.now()) {
+    const iat = Math.floor(nowMs / 1000);
+    const exp = Math.floor((nowMs + CONNECT_TICKET_TTL_MS) / 1000);
+    return new SignJWT({
+        userId,
+        nonce: randomBytes(16).toString("hex"),
+    })
+        .setProtectedHeader({ alg: "HS256", typ: ticketTyp(providerId) })
+        .setIssuedAt(iat)
+        .setExpirationTime(exp)
+        .sign(stateSigningKey(signingKey));
+}
+export async function verifyConnectTicket(providerId, ticket, signingKey, nowMs = Date.now()) {
+    try {
+        const { payload } = await jwtVerify(ticket, stateSigningKey(signingKey), {
+            algorithms: ["HS256"],
+            typ: ticketTyp(providerId),
+            currentDate: new Date(nowMs),
+        });
+        if (typeof payload.userId !== "string" || !payload.userId) {
+            throw new Error("invalid connect ticket actor");
+        }
+        return { userId: payload.userId };
+    }
+    catch (err) {
+        if (err instanceof Error &&
+            err.message.startsWith("invalid connect ticket")) {
+            throw err;
+        }
+        const message = err instanceof Error ? err.message : String(err);
+        if (/exp|expir/i.test(message)) {
+            throw new Error("connect ticket expired");
+        }
+        throw new Error("invalid connect ticket signature");
+    }
+}
+/**
+ * Bind {@link createOauthState} / ticket helpers to a Connect provider id
+ * (`mda-{id}-oauth-state`, `mda-{id}-connect-ticket`).
+ */
+export function oauthTicketsFor(providerId) {
+    const id = providerId.trim();
+    if (!id) {
+        throw new Error("oauthTicketsFor requires a non-empty providerId");
+    }
+    return {
+        providerId: id,
+        createState: (userId, signingKey, nowMs) => createOauthState(id, userId, signingKey, nowMs),
+        verifyState: (state, signingKey, nowMs) => verifyOauthState(id, state, signingKey, nowMs),
+        createTicket: (userId, signingKey, nowMs) => createConnectTicket(id, userId, signingKey, nowMs),
+        verifyTicket: (ticket, signingKey, nowMs) => verifyConnectTicket(id, ticket, signingKey, nowMs),
+    };
+}
+//# sourceMappingURL=oauth-tickets.js.map

package/dist/identity/oauth-tickets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-tickets.js","sourceRoot":"","sources":["../../src/identity/oauth-tickets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE1C,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,2FAA2F;AAC3F,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C,SAAS,QAAQ,CAAC,UAAkB;IAClC,OAAO,OAAO,UAAU,cAAc,CAAC;AACzC,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB;IACnC,OAAO,OAAO,UAAU,iBAAiB,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAkB,EAClB,MAAc,EACd,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;IACtD,OAAO,IAAI,OAAO,CAAC;QACjB,MAAM;QACN,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACvC,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;SAC/D,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,GAAG,CAAC;SACtB,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAkB,EAClB,KAAa,EACb,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE;YACtE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,QAAQ,CAAC,UAAU,CAAC;YACzB,WAAW,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC1E,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,MAAc,EACd,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,qBAAqB,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/D,OAAO,IAAI,OAAO,CAAC;QACjB,MAAM;QACN,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACvC,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;SAChE,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,GAAG,CAAC;SACtB,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,MAAc,EACd,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE;YACvE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,SAAS,CAAC,UAAU,CAAC;YAC1B,WAAW,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IACE,GAAG,YAAY,KAAK;YACpB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAChD,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AA2BD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,UAAU,EAAE,EAAE;QACd,WAAW,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CACzC,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;QACjD,WAAW,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CACxC,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC;QAChD,YAAY,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAC1C,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;QACpD,YAAY,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAC1C,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;KACrD,CAAC;AACJ,CAAC"}

package/dist/identity/options.d.ts

@@ -44,7 +44,11 @@ export interface IdentityScopeOverrides {
     threads?: ThreadScope;
     /** Which memory slice a run may use. */
     memory?: MemoryScope;
-    /** Whose credentials downstream calls carry. `"custom"` is implied by `credentials`. */
+    /**
+     * Whose credentials downstream calls carry. `"custom"` is implied by
+     * `credentials`. `"user"` enables per-caller Connect; `"agent"` uses the
+     * shared LangSmith vault.
+     */
     credentials?: CredentialScope;
 }
 /** The identity declaration. Every key is optional. */
@@ -74,8 +78,9 @@ export interface IdentityOptions {
      * Extra Connect-with-X providers to mount under `/identity/{id}/…`.
      *
      * Providers the deployment already implies are added automatically (a
-     * `credentials.github(...)` chain that reads user tokens brings
-     * Connect-with-GitHub with it), so this is only needed for custom providers.
+     * `connectors.github` declaration or `credentials.github(...)` chain that
+     * reads user tokens brings Connect-with-GitHub with it), so this is only
+     * needed for custom providers.
      */
     connect?: IdentityConnectProvider[];
 }

package/dist/identity/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,OAAO,KAAK,EACV,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,WAAW,EACX,uBAAuB,EACvB,WAAW,EACX,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,sBAAsB,GACtB,sBAAsB,EAAE,CAAC;AAE7B;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,cAAc,GAAG,OAAO,GAAG,MAAM,CAAC;AAEvE;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,8DAA8D;IAC9D,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,wCAAwC;IACxC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,wFAAwF;IACxF,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED,uDAAuD;AACvD,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,aAAa,GAAG,sBAAsB,CAAC;IAC/C,2EAA2E;IAC3E,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,wBAAwB,GAAG,mBAAmB,CAAC;IAC7D;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAgCD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,GAAE,eAAoB,GAC5B,cAAc,CAsBhB"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,OAAO,KAAK,EACV,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,WAAW,EACX,uBAAuB,EACvB,WAAW,EACX,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,sBAAsB,GACtB,sBAAsB,EAAE,CAAC;AAE7B;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,cAAc,GAAG,OAAO,GAAG,MAAM,CAAC;AAEvE;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,8DAA8D;IAC9D,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,wCAAwC;IACxC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED,uDAAuD;AACvD,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,aAAa,GAAG,sBAAsB,CAAC;IAC/C,2EAA2E;IAC3E,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,wBAAwB,GAAG,mBAAmB,CAAC;IAC7D;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAoCD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,GAAE,eAAoB,GAC5B,cAAc,CAsBhB"}

package/dist/identity/options.js

@@ -10,13 +10,17 @@
  * See `docs/design/identity-model-review.md` for the rationale.
  */
 import { credentialConnectProviders } from "./credential-resolvers.js";
-/** Axis defaults per {@link IdentityScope}. */
+/**
+ * Axis defaults per {@link IdentityScope}.
+ *
+ * Pass a `credentials` resolver to opt into `"custom"`.
+ */
 const SCOPE_AXES = {
     user: { threads: "user", memory: "user", credentials: "user" },
     organization: {
         threads: "user",
         memory: "organization",
-        credentials: "agent",
+        credentials: "none",
     },
     agent: { threads: "user", memory: "agent", credentials: "agent" },
     none: { threads: "user", memory: "none", credentials: "none" },

package/dist/identity/options.js.map

@@ -1 +1 @@
-{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAuFvE,+CAA+C;AAC/C,MAAM,UAAU,GAAmD;IACjE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE;IAC9D,YAAY,EAAE;QACZ,OAAO,EAAE,MAAM;QACf,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,OAAO;KACrB;IACD,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;IACjE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE;CAC/D,CAAC;AAEF,MAAM,aAAa,GAA2B;IAC5C,MAAM;IACN,cAAc;IACd,cAAc;CACf,CAAC;AACF,MAAM,aAAa,GAA2B;IAC5C,MAAM;IACN,cAAc;IACd,OAAO;IACP,MAAM;CACP,CAAC;AACF,MAAM,iBAAiB,GAA+B;IACpD,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;CACT,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAO,GAAoB,EAAE;IAE7B,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE1B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa,IAAI,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC/D,6BAA6B,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAmB;QAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QAC/C,aAAa;QACb,KAAK;KACN,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAC3C,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CACrB,IAA8B;IAE9B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,sDAAsD,CAC1G,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,OAAwB;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC;IACtC,MAAM,SAAS,GACb,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK;YACtE,iBAAiB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC;IAC1E,MAAM,MAAM,GACV,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;IACvE,0EAA0E;IAC1E,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,KAAK,SAAS;QAC/B,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,WAAW,CAAC;QAChD,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,WAAW,EAAE,iBAAiB,CAAC;YACpE,IAAI,CAAC,WAAW,CAAC,CAAC;IAExB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,UAAU,CACjB,IAAY,EACZ,KAAwB,EACxB,OAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,aAAa,MAAM,CAAC,KAAK,CAAC,KAAK;YACxE,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAC9B,QAAqC;IAErC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,yFAAyF,QAAQ,KAAK;YACpG,qFAAqF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wEAAwE;AACxE,SAAS,4BAA4B,CACnC,KAA8B;IAE9B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;AACjE,CAAC;AAED,SAAS,6BAA6B,CACpC,QAA6C,EAC7C,KAA8B,EAC9B,QAAiC;IAEjC,IACE,QAAQ,KAAK,SAAS;QACtB,QAAQ,KAAK,UAAU;QACvB,QAAQ,KAAK,UAAU,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qFAAqF,MAAM,CAAC,QAAQ,CAAC,KAAK,CAC3G,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,KAAK,UAAU;QACvB,4BAA4B,CAAC,KAAK,CAAC,KAAK,UAAU,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,OAAwB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC1B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM;IACN,OAAO;IACP,eAAe;IACf,aAAa;IACb,SAAS;CACV,CAAC,CAAC;AAEH;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAwB;IAChD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CACzC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CACrC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC9D,kBAAkB,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AA4FvE;;;;GAIG;AACH,MAAM,UAAU,GAAmD;IACjE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE;IAC9D,YAAY,EAAE;QACZ,OAAO,EAAE,MAAM;QACf,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,MAAM;KACpB;IACD,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;IACjE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE;CAC/D,CAAC;AAEF,MAAM,aAAa,GAA2B;IAC5C,MAAM;IACN,cAAc;IACd,cAAc;CACf,CAAC;AACF,MAAM,aAAa,GAA2B;IAC5C,MAAM;IACN,cAAc;IACd,OAAO;IACP,MAAM;CACP,CAAC;AACF,MAAM,iBAAiB,GAA+B;IACpD,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;CACT,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAO,GAAoB,EAAE;IAE7B,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE1B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa,IAAI,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC/D,6BAA6B,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAmB;QAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QAC/C,aAAa;QACb,KAAK;KACN,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAC3C,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CACrB,IAA8B;IAE9B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,sDAAsD,CAC1G,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,OAAwB;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC;IACtC,MAAM,SAAS,GACb,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK;YACtE,iBAAiB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC;IAC1E,MAAM,MAAM,GACV,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;IACvE,0EAA0E;IAC1E,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,KAAK,SAAS;QAC/B,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,WAAW,CAAC;QAChD,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,WAAW,EAAE,iBAAiB,CAAC;YACpE,IAAI,CAAC,WAAW,CAAC,CAAC;IAExB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,UAAU,CACjB,IAAY,EACZ,KAAwB,EACxB,OAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,aAAa,MAAM,CAAC,KAAK,CAAC,KAAK;YACxE,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAC9B,QAAqC;IAErC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,yFAAyF,QAAQ,KAAK;YACpG,qFAAqF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wEAAwE;AACxE,SAAS,4BAA4B,CACnC,KAA8B;IAE9B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;AACjE,CAAC;AAED,SAAS,6BAA6B,CACpC,QAA6C,EAC7C,KAA8B,EAC9B,QAAiC;IAEjC,IACE,QAAQ,KAAK,SAAS;QACtB,QAAQ,KAAK,UAAU;QACvB,QAAQ,KAAK,UAAU,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qFAAqF,MAAM,CAAC,QAAQ,CAAC,KAAK,CAC3G,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,KAAK,UAAU;QACvB,4BAA4B,CAAC,KAAK,CAAC,KAAK,UAAU,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,OAAwB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC1B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM;IACN,OAAO;IACP,eAAe;IACf,aAAa;IACb,SAAS;CACV,CAAC,CAAC;AAEH;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAwB;IAChD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CACzC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CACrC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC9D,kBAAkB,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/identity/slack/connect-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAKV,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAC;AAoBpB,eAAO,MAAM,yBAAyB,QAAe,CAAC;AACtD,eAAO,MAAM,wBAAwB,QAAgB,CAAC;AACtD,eAAO,MAAM,2BAA2B,QAAiB,CAAC;AAC1D,eAAO,MAAM,uBAAuB,QAAa,CAAC;AAElD,8DAA8D;AAC9D,MAAM,WAAW,mCAAmC;IAClD,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAED,mEAAmE;AACnE,wBAAgB,kCAAkC,CAChD,OAAO,GAAE,mCAAwC,GAChD,uBAAuB,CA6FzB;AAED,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,EAAE,uBACL,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,mCAAmC,GAC5C,uBAAuB,CAIzB"}
+{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAKV,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAC;AAmBpB,eAAO,MAAM,yBAAyB,QAAe,CAAC;AACtD,eAAO,MAAM,wBAAwB,QAAgB,CAAC;AACtD,eAAO,MAAM,2BAA2B,QAAiB,CAAC;AAC1D,eAAO,MAAM,uBAAuB,QAAa,CAAC;AAElD,8DAA8D;AAC9D,MAAM,WAAW,mCAAmC;IAClD,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAED,mEAAmE;AACnE,wBAAgB,kCAAkC,CAChD,OAAO,GAAE,mCAAwC,GAChD,uBAAuB,CA6FzB;AAED,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,EAAE,uBACL,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,mCAAmC,GAC5C,uBAAuB,CAIzB"}