managed-deepagents 0.5.0-dev.80 → 0.5.0-dev.82

package/dist/identity/actor-subject.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Deterministic LangSmith agent_id for an MDA actor's Fleet vault subject.
+ *
+ * Tokens imported via Connect-with-X and toolserver `?agent_id=` must use the
+ * same derivation so each caller reaches their own vault connections. One
+ * actor has one agent_id; multiple Fleet OAuth integrations attach as distinct
+ * `provider_id`s on that subject.
+ */
+import { type FleetOAuthIntegration } from "../connectors/toolserver/integrations.js";
+import type { IdentityConnectMountContext } from "./connect-provider-types.js";
+/**
+ * Fixed namespace for MDA actor vault subjects (UUID form).
+ * Stable across releases so reconnects hit the same vault row.
+ */
+export declare const NAMESPACE_MDA_ACTOR = "c0ffee00-0da0-4111-8111-000000000001";
+export interface AgentIdFromActorOptions {
+    /**
+     * Workspace discriminator so ids do not collide across workspaces.
+     * Defaults to {@link resolveActorDeploymentId} (`LANGCHAIN_WORKSPACE_ID`).
+     */
+    deploymentId?: string;
+    /** Override process env (tests). */
+    env?: NodeJS.ProcessEnv;
+    /** Override the UUID namespace (tests). */
+    namespace?: string;
+}
+/**
+ * Resolve the workspace slice for {@link agentIdFromActor}.
+ *
+ * Uses `LANGCHAIN_WORKSPACE_ID`, else `"local"`.
+ */
+export declare function resolveActorDeploymentId(env?: NodeJS.ProcessEnv): string;
+/**
+ * Derive the vault `agent_id` for an authenticated MDA actor.
+ *
+ * `uuidv5(`${workspaceId}:${userId}`, NAMESPACE_MDA_ACTOR)`.
+ */
+export declare function agentIdFromActor(userId: string, options?: AgentIdFromActorOptions): string;
+/** Enable actor-subject routing for a Fleet OAuth integration. */
+export declare function enableActorSubjectIntegration(integrationId: string): void;
+/** True when actor-subject routing is on for `integrationId`. */
+export declare function isActorSubjectIntegrationEnabled(integrationId: string): boolean;
+/**
+ * True when `slug` belongs to an enabled Fleet OAuth integration (per-actor
+ * `?agent_id=` routing).
+ */
+export declare function isActorSubjectSlugEnabled(slug: string | undefined): boolean;
+/** Enabled integration ids (for connect-hint middleware, etc.). */
+export declare function enabledActorSubjectIntegrations(): readonly string[];
+/**
+ * Enable actor-subject mode for every Fleet integration implied by connectors on a
+ * user-scoped deployment. Agent-scoped deployments keep the shared
+ * `MDA_TOOLSERVER_AGENT_ID` subject.
+ */
+export declare function enableActorSubjectIntegrationsFromConnectors(connectorKinds: readonly (string | undefined)[] | undefined, scope?: IdentityConnectMountContext["scope"]): void;
+/** Enable a specific integration when connectors imply it (user-scoped only). */
+export declare function enableActorSubjectIntegrationFromConnectors(integration: FleetOAuthIntegration, connectorKinds: readonly (string | undefined)[] | undefined, scope?: IdentityConnectMountContext["scope"]): void;
+/** Test-only reset. */
+export declare function resetActorSubjectEnabledForTests(): void;
+//# sourceMappingURL=actor-subject.d.ts.map

package/dist/identity/actor-subject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor-subject.d.ts","sourceRoot":"","sources":["../../src/identity/actor-subject.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAY/E;;;GAGG;AACH,eAAO,MAAM,mBAAmB,yCAAyC,CAAC;AAE1E,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,uBAA4B,GACpC,MAAM,CAUR;AAKD,kEAAkE;AAClE,wBAAgB,6BAA6B,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAKzE;AAED,iEAAiE;AACjE,wBAAgB,gCAAgC,CAC9C,aAAa,EAAE,MAAM,GACpB,OAAO,CAET;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAG3E;AAED,mEAAmE;AACnE,wBAAgB,+BAA+B,IAAI,SAAS,MAAM,EAAE,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,4CAA4C,CAC1D,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC3C,IAAI,CAcN;AAED,iFAAiF;AACjF,wBAAgB,2CAA2C,CACzD,WAAW,EAAE,qBAAqB,EAClC,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC3C,IAAI,CAON;AAED,uBAAuB;AACvB,wBAAgB,gCAAgC,IAAI,IAAI,CAEvD"}

package/dist/identity/actor-subject.js

@@ -0,0 +1,107 @@
+/**
+ * Deterministic LangSmith agent_id for an MDA actor's Fleet vault subject.
+ *
+ * Tokens imported via Connect-with-X and toolserver `?agent_id=` must use the
+ * same derivation so each caller reaches their own vault connections. One
+ * actor has one agent_id; multiple Fleet OAuth integrations attach as distinct
+ * `provider_id`s on that subject.
+ */
+import { v5 as uuidv5 } from "uuid";
+import { MARKETPLACE_MCP_INTEGRATIONS, hasMarketplaceConnector, } from "../connectors/marketplace/catalog.js";
+import { FLEET_OAUTH_INTEGRATIONS, integrationForSlug, hasIntegrationToolServerConnector, } from "../connectors/toolserver/integrations.js";
+function isUserScoped(scope) {
+    if (!scope) {
+        return false;
+    }
+    // Per-caller Connect / actor-subject vault ownership. Memory is unrelated.
+    return scope.credentials === "user" || scope.credentials === "custom";
+}
+/**
+ * Fixed namespace for MDA actor vault subjects (UUID form).
+ * Stable across releases so reconnects hit the same vault row.
+ */
+export const NAMESPACE_MDA_ACTOR = "c0ffee00-0da0-4111-8111-000000000001";
+/**
+ * Resolve the workspace slice for {@link agentIdFromActor}.
+ *
+ * Uses `LANGCHAIN_WORKSPACE_ID`, else `"local"`.
+ */
+export function resolveActorDeploymentId(env = process.env) {
+    return trimmed(env.LANGCHAIN_WORKSPACE_ID) ?? "local";
+}
+/**
+ * Derive the vault `agent_id` for an authenticated MDA actor.
+ *
+ * `uuidv5(`${workspaceId}:${userId}`, NAMESPACE_MDA_ACTOR)`.
+ */
+export function agentIdFromActor(userId, options = {}) {
+    const id = userId.trim();
+    if (!id) {
+        throw new Error("agentIdFromActor requires a non-empty userId");
+    }
+    const deploymentId = options.deploymentId?.trim() ||
+        resolveActorDeploymentId(options.env ?? process.env);
+    const namespace = options.namespace ?? NAMESPACE_MDA_ACTOR;
+    return uuidv5(`${deploymentId}:${id}`, namespace);
+}
+/** Integrations with per-actor toolserver subject routing enabled in this process. */
+const enabledIntegrations = new Set();
+/** Enable actor-subject routing for a Fleet OAuth integration. */
+export function enableActorSubjectIntegration(integrationId) {
+    const id = integrationId.trim();
+    if (id) {
+        enabledIntegrations.add(id);
+    }
+}
+/** True when actor-subject routing is on for `integrationId`. */
+export function isActorSubjectIntegrationEnabled(integrationId) {
+    return enabledIntegrations.has(integrationId);
+}
+/**
+ * True when `slug` belongs to an enabled Fleet OAuth integration (per-actor
+ * `?agent_id=` routing).
+ */
+export function isActorSubjectSlugEnabled(slug) {
+    const integration = integrationForSlug(slug);
+    return integration != null && enabledIntegrations.has(integration.id);
+}
+/** Enabled integration ids (for connect-hint middleware, etc.). */
+export function enabledActorSubjectIntegrations() {
+    return [...enabledIntegrations];
+}
+/**
+ * Enable actor-subject mode for every Fleet integration implied by connectors on a
+ * user-scoped deployment. Agent-scoped deployments keep the shared
+ * `MDA_TOOLSERVER_AGENT_ID` subject.
+ */
+export function enableActorSubjectIntegrationsFromConnectors(connectorKinds, scope) {
+    if (!isUserScoped(scope)) {
+        return;
+    }
+    for (const integration of FLEET_OAUTH_INTEGRATIONS) {
+        if (hasIntegrationToolServerConnector(integration, connectorKinds)) {
+            enableActorSubjectIntegration(integration.id);
+        }
+    }
+    for (const integration of MARKETPLACE_MCP_INTEGRATIONS) {
+        if (hasMarketplaceConnector(integration.id, connectorKinds)) {
+            enableActorSubjectIntegration(integration.id);
+        }
+    }
+}
+/** Enable a specific integration when connectors imply it (user-scoped only). */
+export function enableActorSubjectIntegrationFromConnectors(integration, connectorKinds, scope) {
+    if (hasIntegrationToolServerConnector(integration, connectorKinds) &&
+        isUserScoped(scope)) {
+        enableActorSubjectIntegration(integration.id);
+    }
+}
+/** Test-only reset. */
+export function resetActorSubjectEnabledForTests() {
+    enabledIntegrations.clear();
+}
+function trimmed(value) {
+    const v = value?.trim();
+    return v ? v : undefined;
+}
+//# sourceMappingURL=actor-subject.js.map

package/dist/identity/actor-subject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor-subject.js","sourceRoot":"","sources":["../../src/identity/actor-subject.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,iCAAiC,GAElC,MAAM,0CAA0C,CAAC;AAGlD,SAAS,YAAY,CACnB,KAAuD;IAEvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IACD,2EAA2E;IAC3E,OAAO,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,sCAAsC,CAAC;AAc1E;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,OAAO,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,OAAO,GAA4B,EAAE;IAErC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE;QAC5B,wBAAwB,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,mBAAmB,CAAC;IAC3D,OAAO,MAAM,CAAC,GAAG,YAAY,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;AACpD,CAAC;AAED,sFAAsF;AACtF,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE9C,kEAAkE;AAClE,MAAM,UAAU,6BAA6B,CAAC,aAAqB;IACjE,MAAM,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,EAAE,EAAE,CAAC;QACP,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,gCAAgC,CAC9C,aAAqB;IAErB,OAAO,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAwB;IAChE,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,WAAW,IAAI,IAAI,IAAI,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,+BAA+B;IAC7C,OAAO,CAAC,GAAG,mBAAmB,CAAC,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4CAA4C,CAC1D,cAA2D,EAC3D,KAA4C;IAE5C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,wBAAwB,EAAE,CAAC;QACnD,IAAI,iCAAiC,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;YACnE,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,4BAA4B,EAAE,CAAC;QACvD,IAAI,uBAAuB,CAAC,WAAW,CAAC,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;YAC5D,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,2CAA2C,CACzD,WAAkC,EAClC,cAA2D,EAC3D,KAA4C;IAE5C,IACE,iCAAiC,CAAC,WAAW,EAAE,cAAc,CAAC;QAC9D,YAAY,CAAC,KAAK,CAAC,EACnB,CAAC;QACD,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,uBAAuB;AACvB,MAAM,UAAU,gCAAgC;IAC9C,mBAAmB,CAAC,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,OAAO,CAAC,KAAyB;IACxC,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACxB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3B,CAAC"}

package/dist/identity/byo-oauth.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Factory for optional BYO (bring-your-own) OAuth clients used when Fleet
+ * auth-sessions are unavailable.
+ *
+ * Vendor modules supply endpoints, authorize extras, and userinfo parsing;
+ * this module owns config env reading, authorize URL construction, token
+ * exchange, and the {@link FleetVaultByoOauth} adapter.
+ */
+import type { FleetVaultByoOauth, FleetVaultByoTokenResult } from "./fleet-connect.js";
+import { type OauthTickets } from "./oauth-tickets.js";
+import { resolveSlackOauthRedirectBase } from "./slack/oauth.js";
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, resolveSlackOauthRedirectBase, } from "./slack/oauth.js";
+/** Shared BYO OAuth client configuration. */
+export interface ByoOauthConfig {
+    clientId: string;
+    clientSecret: string;
+    publicAppUrl: string;
+    scopes: string;
+    authUrl: string;
+    tokenUrl: string;
+    userInfoUrl: string;
+}
+export interface ByoOauthEndpoints {
+    authUrl: string;
+    tokenUrl: string;
+    userInfoUrl: string;
+    /** Space-separated default scopes when env override is absent. */
+    defaultScopes: string;
+}
+export interface ByoOauthUserInfo {
+    email?: string;
+    subject?: string;
+}
+export interface CreateByoOauthClientOptions {
+    /** Connect / ticket provider id, e.g. `"google"`. */
+    providerId: string;
+    /** Human label for error messages ("Google", "Microsoft"). */
+    displayName: string;
+    /**
+     * Env prefix without trailing underscore, e.g. `"GOOGLE_OAUTH"`.
+     * Reads `${prefix}_CLIENT_ID`, `_CLIENT_SECRET`, `_SCOPES`, `_AUTH_URL`,
+     * `_TOKEN_URL`, `_USERINFO_URL`.
+     */
+    envPrefix: string;
+    /** Default endpoints + scopes (may read extra env, e.g. tenant). */
+    defaultEndpoints: (env: NodeJS.ProcessEnv) => ByoOauthEndpoints;
+    /**
+     * Extra authorize query params merged after the shared OAuth code-grant
+     * fields. Defaults include `prompt=consent` when omitted here.
+     */
+    authorizeParams?: Record<string, string>;
+    /** Map a userinfo /me JSON body to email + subject. */
+    parseUserInfo: (json: Record<string, unknown>) => ByoOauthUserInfo;
+    /** Vault metadata key for the IdP subject (e.g. `google_sub`). */
+    subjectMetadataKey: string;
+}
+export interface ByoOauthEnvKeys {
+    clientId: string;
+    clientSecret: string;
+    scopes: string;
+    authUrl: string;
+    tokenUrl: string;
+    userInfoUrl: string;
+}
+/** BYO OAuth client produced by {@link createByoOauthClient}. */
+export interface ByoOauthClient {
+    providerId: string;
+    displayName: string;
+    env: ByoOauthEnvKeys;
+    tickets: OauthTickets;
+    resolveRedirectBase: typeof resolveSlackOauthRedirectBase;
+    readConfig(env?: NodeJS.ProcessEnv): ByoOauthConfig | null;
+    buildAuthorizeUrl(config: ByoOauthConfig, state: string, redirectUri: string, scopes?: string): string;
+    exchangeCode(config: ByoOauthConfig, code: string, redirectUri: string, fetchImpl?: typeof fetch): Promise<FleetVaultByoTokenResult>;
+    /** Ready for `createFleetVaultConnectProvider({ byo })`. */
+    byo: FleetVaultByoOauth;
+    resolvePublicAppUrl(env?: NodeJS.ProcessEnv): string | undefined;
+}
+/** Build a BYO OAuth client for one Fleet vault Connect integration. */
+export declare function createByoOauthClient(options: CreateByoOauthClientOptions): ByoOauthClient;
+//# sourceMappingURL=byo-oauth.d.ts.map

package/dist/identity/byo-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"byo-oauth.d.ts","sourceRoot":"","sources":["../../src/identity/byo-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAGL,6BAA6B,EAC9B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAE1B,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,iBAAiB,CAAC;IAChE;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,uDAAuD;IACvD,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,gBAAgB,CAAC;IACnE,kEAAkE;IAClE,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,eAAe,CAAC;IACrB,OAAO,EAAE,YAAY,CAAC;IACtB,mBAAmB,EAAE,OAAO,6BAA6B,CAAC;IAC1D,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,cAAc,GAAG,IAAI,CAAC;IAC3D,iBAAiB,CACf,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC;IACV,YAAY,CACV,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,OAAO,KAAK,GACvB,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrC,4DAA4D;IAC5D,GAAG,EAAE,kBAAkB,CAAC;IACxB,mBAAmB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;CAClE;AAiBD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,2BAA2B,GACnC,cAAc,CAwKhB"}

package/dist/identity/byo-oauth.js

@@ -0,0 +1,145 @@
+/**
+ * Factory for optional BYO (bring-your-own) OAuth clients used when Fleet
+ * auth-sessions are unavailable.
+ *
+ * Vendor modules supply endpoints, authorize extras, and userinfo parsing;
+ * this module owns config env reading, authorize URL construction, token
+ * exchange, and the {@link FleetVaultByoOauth} adapter.
+ */
+import { fetchWithTimeout, PROVIDER_HTTP_TIMEOUT_MS } from "../runtime/http.js";
+import { oauthTicketsFor } from "./oauth-tickets.js";
+import { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, resolveSlackOauthRedirectBase, } from "./slack/oauth.js";
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, resolveSlackOauthRedirectBase, } from "./slack/oauth.js";
+function stripSlash(value) {
+    return value.replace(/\/$/, "");
+}
+function envKeys(prefix) {
+    return {
+        clientId: `${prefix}_CLIENT_ID`,
+        clientSecret: `${prefix}_CLIENT_SECRET`,
+        scopes: `${prefix}_SCOPES`,
+        authUrl: `${prefix}_AUTH_URL`,
+        tokenUrl: `${prefix}_TOKEN_URL`,
+        userInfoUrl: `${prefix}_USERINFO_URL`,
+    };
+}
+/** Build a BYO OAuth client for one Fleet vault Connect integration. */
+export function createByoOauthClient(options) {
+    const keys = envKeys(options.envPrefix);
+    const tickets = oauthTicketsFor(options.providerId);
+    const authorizeExtras = {
+        prompt: "consent",
+        ...options.authorizeParams,
+    };
+    function readConfig(env = process.env) {
+        const clientId = env[keys.clientId]?.trim();
+        const clientSecret = env[keys.clientSecret]?.trim();
+        const publicAppUrl = env[MDA_PUBLIC_APP_URL_ENV]?.trim() ||
+            env[MDA_PUBLIC_API_URL_ENV]?.trim();
+        if (!clientId || !clientSecret || !publicAppUrl) {
+            return null;
+        }
+        const defaults = options.defaultEndpoints(env);
+        return {
+            clientId,
+            clientSecret,
+            publicAppUrl: stripSlash(publicAppUrl),
+            scopes: env[keys.scopes]?.trim() || defaults.defaultScopes,
+            authUrl: stripSlash(env[keys.authUrl]?.trim() || defaults.authUrl),
+            tokenUrl: stripSlash(env[keys.tokenUrl]?.trim() || defaults.tokenUrl),
+            userInfoUrl: stripSlash(env[keys.userInfoUrl]?.trim() || defaults.userInfoUrl),
+        };
+    }
+    function buildAuthorizeUrl(config, state, redirectUri, scopes) {
+        const url = new URL(config.authUrl);
+        url.searchParams.set("client_id", config.clientId);
+        url.searchParams.set("redirect_uri", redirectUri);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("scope", scopes?.trim() || config.scopes);
+        url.searchParams.set("state", state);
+        for (const [key, value] of Object.entries(authorizeExtras)) {
+            url.searchParams.set(key, value);
+        }
+        return url.toString();
+    }
+    async function exchangeCode(config, code, redirectUri, fetchImpl = fetch) {
+        const body = new URLSearchParams({
+            code,
+            client_id: config.clientId,
+            client_secret: config.clientSecret,
+            redirect_uri: redirectUri,
+            grant_type: "authorization_code",
+        });
+        const tokenResponse = await fetchWithTimeout(config.tokenUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body,
+        }, PROVIDER_HTTP_TIMEOUT_MS, fetchImpl);
+        const tokenJson = (await tokenResponse.json());
+        if (!tokenResponse.ok || !tokenJson.access_token) {
+            throw new Error(tokenJson.error_description ??
+                tokenJson.error ??
+                `${options.displayName} OAuth token exchange failed`);
+        }
+        let accountLabel;
+        let subject;
+        try {
+            const userResponse = await fetchWithTimeout(config.userInfoUrl, {
+                headers: { Authorization: `Bearer ${tokenJson.access_token}` },
+            }, PROVIDER_HTTP_TIMEOUT_MS, fetchImpl);
+            if (userResponse.ok) {
+                const userJson = (await userResponse.json());
+                const parsed = options.parseUserInfo(userJson);
+                if (parsed.email) {
+                    accountLabel = parsed.email;
+                }
+                if (parsed.subject) {
+                    subject = parsed.subject;
+                }
+            }
+        }
+        catch {
+            // Account label is optional for vault import.
+        }
+        return {
+            accessToken: tokenJson.access_token,
+            ...(tokenJson.refresh_token
+                ? { refreshToken: tokenJson.refresh_token }
+                : {}),
+            ...(typeof tokenJson.expires_in === "number"
+                ? { expiresInSeconds: tokenJson.expires_in }
+                : {}),
+            ...(tokenJson.scope ? { scope: tokenJson.scope } : {}),
+            ...(accountLabel ? { accountLabel } : {}),
+            ...(subject
+                ? { metadata: { [options.subjectMetadataKey]: subject } }
+                : {}),
+        };
+    }
+    const byo = {
+        readConfig,
+        buildAuthorizeUrl(config, state, redirectUri, scopes) {
+            return buildAuthorizeUrl(config, state, redirectUri, scopes);
+        },
+        exchangeCode(config, code, redirectUri) {
+            return exchangeCode(config, code, redirectUri);
+        },
+    };
+    function resolvePublicAppUrl(env = process.env) {
+        return (readConfig(env)?.publicAppUrl ??
+            env[MDA_PUBLIC_APP_URL_ENV]?.trim().replace(/\/$/, ""));
+    }
+    return {
+        providerId: options.providerId,
+        displayName: options.displayName,
+        env: keys,
+        tickets,
+        resolveRedirectBase: resolveSlackOauthRedirectBase,
+        readConfig,
+        buildAuthorizeUrl,
+        exchangeCode,
+        byo,
+        resolvePublicAppUrl,
+    };
+}
+//# sourceMappingURL=byo-oauth.js.map

package/dist/identity/byo-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"byo-oauth.js","sourceRoot":"","sources":["../../src/identity/byo-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAKhF,OAAO,EAAE,eAAe,EAAqB,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAoF1B,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO;QACL,QAAQ,EAAE,GAAG,MAAM,YAAY;QAC/B,YAAY,EAAE,GAAG,MAAM,gBAAgB;QACvC,MAAM,EAAE,GAAG,MAAM,SAAS;QAC1B,OAAO,EAAE,GAAG,MAAM,WAAW;QAC7B,QAAQ,EAAE,GAAG,MAAM,YAAY;QAC/B,WAAW,EAAE,GAAG,MAAM,eAAe;KACtC,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,oBAAoB,CAClC,OAAoC;IAEpC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG;QACtB,MAAM,EAAE,SAAS;QACjB,GAAG,OAAO,CAAC,eAAe;KAC3B,CAAC;IAEF,SAAS,UAAU,CACjB,GAAG,GAAsB,OAAO,CAAC,GAAG;QAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;QAC5C,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QACpD,MAAM,YAAY,GAChB,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE;YACnC,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO;YACL,QAAQ;YACR,YAAY;YACZ,YAAY,EAAE,UAAU,CAAC,YAAY,CAAC;YACtC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,aAAa;YAC1D,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC;YAClE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC;YACrE,WAAW,EAAE,UAAU,CACrB,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,WAAW,CACtD;SACF,CAAC;IACJ,CAAC;IAED,SAAS,iBAAiB,CACxB,MAAsB,EACtB,KAAa,EACb,WAAmB,EACnB,MAAe;QAEf,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,UAAU,YAAY,CACzB,MAAsB,EACtB,IAAY,EACZ,WAAmB,EACnB,SAAS,GAAiB,KAAK;QAE/B,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,IAAI;YACJ,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAC1C,MAAM,CAAC,QAAQ,EACf;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI;SACL,EACD,wBAAwB,EACxB,SAAS,CACV,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAQ5C,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,SAAS,CAAC,iBAAiB;gBACzB,SAAS,CAAC,KAAK;gBACf,GAAG,OAAO,CAAC,WAAW,8BAA8B,CACvD,CAAC;QACJ,CAAC;QAED,IAAI,YAAgC,CAAC;QACrC,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,MAAM,CAAC,WAAW,EAClB;gBACE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE,EAAE;aAC/D,EACD,wBAAwB,EACxB,SAAS,CACV,CAAC;YACF,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAA4B,CAAC;gBACxE,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC/C,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC9B,CAAC;gBACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;QAChD,CAAC;QAED,OAAO;YACL,WAAW,EAAE,SAAS,CAAC,YAAY;YACnC,GAAG,CAAC,SAAS,CAAC,aAAa;gBACzB,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,aAAa,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ;gBAC1C,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,UAAU,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,OAAO;gBACT,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAuB;QAC9B,UAAU;QACV,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM;YAClD,OAAO,iBAAiB,CACtB,MAAwB,EACxB,KAAK,EACL,WAAW,EACX,MAAM,CACP,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW;YACpC,OAAO,YAAY,CAAC,MAAwB,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACnE,CAAC;KACF,CAAC;IAEF,SAAS,mBAAmB,CAC1B,GAAG,GAAsB,OAAO,CAAC,GAAG;QAEpC,OAAO,CACL,UAAU,CAAC,GAAG,CAAC,EAAE,YAAY;YAC7B,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACvD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,IAAI;QACT,OAAO;QACP,mBAAmB,EAAE,6BAA6B;QAClD,UAAU;QACV,iBAAiB;QACjB,YAAY;QACZ,GAAG;QACH,mBAAmB;KACpB,CAAC;AACJ,CAAC"}

package/dist/identity/connect-inference.d.ts

@@ -3,11 +3,13 @@
  * deployment needs their OAuth routes.
  *
  * Authors should not have to list a connect provider that the rest of their
- * identity already implies — a GitHub credential chain that reads user tokens
- * needs somewhere for the user to grant them, and a Slack channel on a
- * per-user deployment needs somewhere to link Slack accounts.
+ * identity already implies — a `connectors.github` (or credential chain that
+ * reads user tokens) on a user-scoped deployment needs Connect-with-GitHub, and
+ * a Slack channel on a per-user deployment needs somewhere to link Slack
+ * accounts.
  */
 import type { IdentityConnectMountContext } from "./connect-provider-types.js";
+export { FLEET_OAUTH_INTEGRATIONS, GOOGLE_TOOLSERVER_SLUGS, LINKEDIN_TOOLSERVER_SLUGS, MICROSOFT_TOOLSERVER_SLUGS, integrationConnectorKinds, integrationById, integrationForSlug, googleConnectorKinds, googleScopesForConnectorKinds, hasIntegrationToolServerConnector, hasGoogleToolServerConnector, hasLinkedInToolServerConnector, hasMicrosoftToolServerConnector, isFleetOAuthSlug, isGoogleToolServerSlug, isLinkedInToolServerSlug, isMicrosoftToolServerSlug, linkedinConnectorKinds, linkedinScopesForConnectorKinds, microsoftConnectorKinds, microsoftScopesForConnectorKinds, scopesForIntegrationConnectorKinds, type FleetOAuthIntegration, type GoogleToolServerSlug, type LinkedInToolServerSlug, type MicrosoftToolServerSlug, } from "../connectors/toolserver/integrations.js";
 /**
  * True when the deployment keys anything durable on the individual caller.
  *
@@ -18,6 +20,13 @@ import type { IdentityConnectMountContext } from "./connect-provider-types.js";
 export declare function isUserScopedDeployment(scope: IdentityConnectMountContext["scope"]): boolean;
 /** True when a channel of `provider` is declared (e.g. a Slack channel). */
 export declare function hasChannelForProvider(channels: IdentityConnectMountContext["channels"], provider: string): boolean;
+/**
+ * True when the deployment declares `connectors.github`.
+ *
+ * Same inference trigger Google/Microsoft use for their toolserver connectors:
+ * a GitHub connector on a user-scoped deployment implies Connect-with-GitHub.
+ */
+export declare function hasGithubConnector(connectorKinds: IdentityConnectMountContext["connectorKinds"]): boolean;
 /**
  * Connect provider ids the deployment's credential resolvers depend on.
  *
@@ -25,4 +34,5 @@ export declare function hasChannelForProvider(channels: IdentityConnectMountCont
  * same as a single-platform one.
  */
 export declare function credentialConnectIds(credentials: IdentityConnectMountContext["credentials"]): Set<string>;
+export declare function isGoogleConnectorKind(kind: string | undefined): boolean;
 //# sourceMappingURL=connect-inference.d.ts.map

package/dist/identity/connect-inference.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-inference.d.ts","sourceRoot":"","sources":["../../src/identity/connect-inference.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAG/E;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC1C,OAAO,CAST;AAED,4EAA4E;AAC5E,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,2BAA2B,CAAC,UAAU,CAAC,EACjD,QAAQ,EAAE,MAAM,GACf,OAAO,CAIT;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,2BAA2B,CAAC,aAAa,CAAC,GACtD,GAAG,CAAC,MAAM,CAAC,CAIb"}
+{"version":3,"file":"connect-inference.d.ts","sourceRoot":"","sources":["../../src/identity/connect-inference.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAG/E,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,8BAA8B,EAC9B,+BAA+B,EAC/B,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,gCAAgC,EAChC,kCAAkC,EAClC,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,0CAA0C,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC1C,OAAO,CAOT;AAED,4EAA4E;AAC5E,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,2BAA2B,CAAC,UAAU,CAAC,EACjD,QAAQ,EAAE,MAAM,GACf,OAAO,CAIT;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,cAAc,EAAE,2BAA2B,CAAC,gBAAgB,CAAC,GAC5D,OAAO,CAET;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,2BAA2B,CAAC,aAAa,CAAC,GACtD,GAAG,CAAC,MAAM,CAAC,CAIb;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEvE"}

package/dist/identity/connect-inference.js

@@ -3,11 +3,15 @@
  * deployment needs their OAuth routes.
  *
  * Authors should not have to list a connect provider that the rest of their
- * identity already implies — a GitHub credential chain that reads user tokens
- * needs somewhere for the user to grant them, and a Slack channel on a
- * per-user deployment needs somewhere to link Slack accounts.
+ * identity already implies — a `connectors.github` (or credential chain that
+ * reads user tokens) on a user-scoped deployment needs Connect-with-GitHub, and
+ * a Slack channel on a per-user deployment needs somewhere to link Slack
+ * accounts.
  */
+import { GITHUB_SLUG } from "../connectors/toolserver/catalog.js";
+import { isGoogleToolServerSlug } from "../connectors/toolserver/integrations.js";
 import { credentialConnectProviders } from "./credential-resolvers.js";
+export { FLEET_OAUTH_INTEGRATIONS, GOOGLE_TOOLSERVER_SLUGS, LINKEDIN_TOOLSERVER_SLUGS, MICROSOFT_TOOLSERVER_SLUGS, integrationConnectorKinds, integrationById, integrationForSlug, googleConnectorKinds, googleScopesForConnectorKinds, hasIntegrationToolServerConnector, hasGoogleToolServerConnector, hasLinkedInToolServerConnector, hasMicrosoftToolServerConnector, isFleetOAuthSlug, isGoogleToolServerSlug, isLinkedInToolServerSlug, isMicrosoftToolServerSlug, linkedinConnectorKinds, linkedinScopesForConnectorKinds, microsoftConnectorKinds, microsoftScopesForConnectorKinds, scopesForIntegrationConnectorKinds, } from "../connectors/toolserver/integrations.js";
 /**
  * True when the deployment keys anything durable on the individual caller.
  *
@@ -19,14 +23,23 @@ export function isUserScopedDeployment(scope) {
     if (!scope) {
         return false;
     }
-    return (scope.memory === "user" ||
-        scope.credentials === "user" ||
-        scope.credentials === "custom");
+    // Per-caller Connect is meaningful when credentials are owned by the caller
+    // (`"user"`) or a custom resolver. Memory isolation is a separate axis.
+    return scope.credentials === "user" || scope.credentials === "custom";
 }
 /** True when a channel of `provider` is declared (e.g. a Slack channel). */
 export function hasChannelForProvider(channels, provider) {
     return Object.values(channels ?? {}).some((manifest) => manifest?.provider === provider);
 }
+/**
+ * True when the deployment declares `connectors.github`.
+ *
+ * Same inference trigger Google/Microsoft use for their toolserver connectors:
+ * a GitHub connector on a user-scoped deployment implies Connect-with-GitHub.
+ */
+export function hasGithubConnector(connectorKinds) {
+    return (connectorKinds ?? []).some((kind) => kind === GITHUB_SLUG);
+}
 /**
  * Connect provider ids the deployment's credential resolvers depend on.
  *
@@ -36,4 +49,7 @@ export function hasChannelForProvider(channels, provider) {
 export function credentialConnectIds(credentials) {
     return new Set(credentialConnectProviders(credentials).map((provider) => provider.id));
 }
+export function isGoogleConnectorKind(kind) {
+    return isGoogleToolServerSlug(kind);
+}
 //# sourceMappingURL=connect-inference.js.map

package/dist/identity/connect-inference.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-inference.js","sourceRoot":"","sources":["../../src/identity/connect-inference.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAA2C;IAE3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,MAAM;QACvB,KAAK,CAAC,WAAW,KAAK,MAAM;QAC5B,KAAK,CAAC,WAAW,KAAK,QAAQ,CAC/B,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CACnC,QAAiD,EACjD,QAAgB;IAEhB,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CACvC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAC9C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAuD;IAEvD,OAAO,IAAI,GAAG,CACZ,0BAA0B,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CACvE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"connect-inference.js","sourceRoot":"","sources":["../../src/identity/connect-inference.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAElF,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAEvE,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,8BAA8B,EAC9B,+BAA+B,EAC/B,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,gCAAgC,EAChC,kCAAkC,GAKnC,MAAM,0CAA0C,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAA2C;IAE3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IACD,4EAA4E;IAC5E,wEAAwE;IACxE,OAAO,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC;AACxE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CACnC,QAAiD,EACjD,QAAgB;IAEhB,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CACvC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAC9C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,cAA6D;IAE7D,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAuD;IAEvD,OAAO,IAAI,GAAG,CACZ,0BAA0B,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC"}

package/dist/identity/connect-provider-types.d.ts

@@ -29,6 +29,13 @@ export interface IdentityConnectMountContext {
      * reading it directly, so both forms are handled.
      */
     credentials?: IdentityConfig["credentials"];
+    /**
+     * Connector `kind` values discovered for the deployment (toolserver slugs,
+     * `github`, `slack`, …). Used to infer Connect-with-X from matching
+     * connectors (GitHub, Google, Microsoft, LinkedIn) without listing
+     * `connect.<provider>()` on identity.
+     */
+    connectorKinds?: readonly (string | undefined)[];
 }
 /** JSON object returned by status / error payloads. */
 export type IdentityConnectJson = Record<string, unknown>;
@@ -81,5 +88,10 @@ export interface IdentityConnectProvider {
     resolveRedirectBase(options: IdentityConnectRedirectBaseOptions): string;
     /** Public app origin for settings fail/success redirects when available. */
     resolvePublicAppUrl?(): string | undefined;
+    /**
+     * Optional: resolve a caller from a signed `?ticket=` on the connect start
+     * route (channel actors without a browser session). Returns the actor user id.
+     */
+    resolveConnectTicket?(ticket: string): string | Promise<string>;
 }
 //# sourceMappingURL=connect-provider-types.d.ts.map

package/dist/identity/connect-provider-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-provider-types.d.ts","sourceRoot":"","sources":["../../src/identity/connect-provider-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,qEAAqE;AACrE,MAAM,WAAW,2BAA2B;IAC1C,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,uDAAuD;IACvD,WAAW,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IAChC;;;;OAIG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;CAC7C;AAED,uDAAuD;AACvD,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1D,MAAM,MAAM,8BAA8B,GACtC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,GACxB;IAAE,aAAa,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C,MAAM,MAAM,6BAA6B,GAAG;IAC1C,oEAAoE;IACpE,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,oEAAoE;AACpE,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;KAAE,CAAC;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,4EAA4E;IAC5E,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC;IACvD,yDAAyD;IACzD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC3E,oEAAoE;IACpE,cAAc,CACZ,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,8BAA8B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC5E;;;OAGG;IACH,gBAAgB,CACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,6BAA6B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC1E,mDAAmD;IACnD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,+DAA+D;IAC/D,mBAAmB,CAAC,OAAO,EAAE,kCAAkC,GAAG,MAAM,CAAC;IACzE,4EAA4E;IAC5E,mBAAmB,CAAC,IAAI,MAAM,GAAG,SAAS,CAAC;CAC5C"}
+{"version":3,"file":"connect-provider-types.d.ts","sourceRoot":"","sources":["../../src/identity/connect-provider-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,qEAAqE;AACrE,MAAM,WAAW,2BAA2B;IAC1C,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,uDAAuD;IACvD,WAAW,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IAChC;;;;OAIG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,cAAc,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;CAClD;AAED,uDAAuD;AACvD,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1D,MAAM,MAAM,8BAA8B,GACtC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,GACxB;IAAE,aAAa,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C,MAAM,MAAM,6BAA6B,GAAG;IAC1C,oEAAoE;IACpE,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,oEAAoE;AACpE,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;KAAE,CAAC;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,4EAA4E;IAC5E,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC;IACvD,yDAAyD;IACzD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC3E,oEAAoE;IACpE,cAAc,CACZ,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,8BAA8B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC5E;;;OAGG;IACH,gBAAgB,CACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,6BAA6B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC1E,mDAAmD;IACnD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,+DAA+D;IAC/D,mBAAmB,CAAC,OAAO,EAAE,kCAAkC,GAAG,MAAM,CAAC;IACzE,4EAA4E;IAC5E,mBAAmB,CAAC,IAAI,MAAM,GAAG,SAAS,CAAC;IAC3C;;;OAGG;IACH,oBAAoB,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACjE"}

package/dist/identity/connect-provider.js

@@ -60,12 +60,28 @@ function mountOneIdentityConnectProvider(app, cfg, provider, mounted, options) {
         return c.json(await provider.status(identity.user.id));
     });
     app.get(paths.connect, async (c) => {
-        const identity = await resolveOrUnauthorized(cfg, c.req.raw);
-        if (identity instanceof Response) {
-            return identity;
+        const ticket = c.req.query("ticket")?.trim();
+        let userId;
+        if (ticket && provider.resolveConnectTicket) {
+            try {
+                userId = await provider.resolveConnectTicket(ticket);
+            }
+            catch (error) {
+                const message = error instanceof Error && error.message
+                    ? error.message
+                    : "invalid connect ticket";
+                return c.json({ error: message }, 401);
+            }
+        }
+        else {
+            const identity = await resolveOrUnauthorized(cfg, c.req.raw);
+            if (identity instanceof Response) {
+                return identity;
+            }
+            userId = identity.user.id;
         }
         const redirectUri = callbackRedirectUri(provider, c.req.raw, options.deploymentBaseUrl);
-        const result = await provider.startAuthorize(identity.user.id, redirectUri);
+        const result = await provider.startAuthorize(userId, redirectUri);
         if ("notConfigured" in result) {
             return c.json({ error: result.error }, 503);
         }

package/dist/identity/connect-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-provider.js","sourceRoot":"","sources":["../../src/identity/connect-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAK1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAW1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAU1D,MAAM,UAAU,+BAA+B,CAC7C,QAAiC;IAEjC,OAAO,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAC3C,GAAS,EACT,GAAmB,EACnB,GAAgC,EAChC,OAAsC,EACtC,OAAO,GAMH,EAAE;IAEN,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG;QACd,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;KACtD,CAAC;IACF,KAAK,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,OAAO,EAAE,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CACtC,GAAS,EACT,GAAmB,EACnB,QAAiC,EACjC,OAAsC,EACtC,OAAuC;IAEvC,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,YAAY,QAAQ,CAAC,EAAE,UAAU,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI;QAClB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;QACpD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;QACrD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QACvD,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;KAC7C,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC;YACX,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,EACR,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QAC5E,IAAI,eAAe,IAAI,MAAM,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,SAAS,GACb,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,MAAM;YAChC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAC9D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,SAAS,GACb,QAAQ,CAAC,mBAAmB,EAAE,EAAE;YAChC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAG,SAAS;YAC5B,CAAC,CAAC,GAAG,SAAS,aAAa,WAAW,QAAQ;YAC9C,CAAC,CAAC,GAAG,CAAC;QACR,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,EACR,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,OAAO,CAAC,iBAAiB,CAC1B,CAAC;YACF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CACzD,IAAI,EACJ,KAAK,EACL,WAAW,CACZ,CAAC;YACF,OAAO,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,SAAS,QAAQ,CAAC,EAAE,yBAAyB,EAAE,KAAK,CAAC,CAAC;YACpE,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAiC,EACjC,OAAgB,EAChB,iBAA0B;IAE1B,MAAM,IAAI,GAAG,QAAQ,CAAC,mBAAmB,CAAC;QACxC,UAAU,EAAE,OAAO,CAAC,GAAG;QACvB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB;KAClB,CAAC,CAAC;IACH,OAAO,GAAG,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,GAAmB,EACnB,OAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ;YACxD,CAAC,CAAE,KAA4B,CAAC,MAAM;YACtC,CAAC,CAAC,GAAG,CAAC;QACV,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;QAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE;YACtD,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}
+{"version":3,"file":"connect-provider.js","sourceRoot":"","sources":["../../src/identity/connect-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAK1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAW1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAU1D,MAAM,UAAU,+BAA+B,CAC7C,QAAiC;IAEjC,OAAO,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAC3C,GAAS,EACT,GAAmB,EACnB,GAAgC,EAChC,OAAsC,EACtC,OAAO,GAMH,EAAE;IAEN,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG;QACd,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;KACtD,CAAC;IACF,KAAK,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,OAAO,EAAE,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CACtC,GAAS,EACT,GAAmB,EACnB,QAAiC,EACjC,OAAsC,EACtC,OAAuC;IAEvC,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,YAAY,QAAQ,CAAC,EAAE,UAAU,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI;QAClB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;QACpD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;QACrD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QACvD,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;KAC7C,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC;YACX,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,MAAc,CAAC;QACnB,IAAI,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO;oBACrC,CAAC,CAAC,KAAK,CAAC,OAAO;oBACf,CAAC,CAAC,wBAAwB,CAAC;gBAC/B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;gBACjC,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,EACR,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,eAAe,IAAI,MAAM,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,SAAS,GACb,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,MAAM;YAChC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAC9D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,SAAS,GACb,QAAQ,CAAC,mBAAmB,EAAE,EAAE;YAChC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAG,SAAS;YAC5B,CAAC,CAAC,GAAG,SAAS,aAAa,WAAW,QAAQ;YAC9C,CAAC,CAAC,GAAG,CAAC;QACR,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,EACR,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,OAAO,CAAC,iBAAiB,CAC1B,CAAC;YACF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CACzD,IAAI,EACJ,KAAK,EACL,WAAW,CACZ,CAAC;YACF,OAAO,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,SAAS,QAAQ,CAAC,EAAE,yBAAyB,EAAE,KAAK,CAAC,CAAC;YACpE,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAiC,EACjC,OAAgB,EAChB,iBAA0B;IAE1B,MAAM,IAAI,GAAG,QAAQ,CAAC,mBAAmB,CAAC;QACxC,UAAU,EAAE,OAAO,CAAC,GAAG;QACvB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB;KAClB,CAAC,CAAC;IACH,OAAO,GAAG,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,GAAmB,EACnB,OAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ;YACxD,CAAC,CAAE,KAA4B,CAAC,MAAM;YACtC,CAAC,CAAC,GAAG,CAAC;QACV,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;QAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE;YACtD,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}