managed-deepagents 0.5.0-dev.84 → 0.5.0-dev.85

package/dist/identity/microsoft/connect-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/microsoft/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EACL,6BAA6B,EAC7B,2CAA2C,EAC3C,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAK3D,OAAO,EACL,qCAAqC,EACrC,0BAA0B,EAC1B,mCAAmC,GAEpC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;AAEhD,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAK,CAAC,MAAM,CAAC;AAC1D,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC,OAAO,CAAC;AAC1D,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC9D,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC,IAAI,CAAC;AAEtD,MAAM,UAAU,8BAA8B;IAC5C,OAAO,gCAAgC,CAAC,WAAW,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,6BAA6B,CAAC,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yCAAyC,CACvD,cAA2D,EAC3D,KAA4C;IAE5C,2CAA2C,CACzC,qBAAqB,EACrB,cAAc,EACd,KAAK,CACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yCAAyC;IACvD,gCAAgC,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,mCAAmC,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,OAAO,0BAA0B,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC;AACzE,CAAC;AAMD,0CAA0C;AAC1C,MAAM,UAAU,sCAAsC,CACpD,OAAO,GAA4C,EAAE;IAErD,OAAO,qCAAqC,CAC1C,qBAAqB,EACrB,iBAAiB,EACjB,OAAO,CACR,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gCAAgC,GAC3C,sCAAsC,EAAE,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CACrB,OAAiD;IAEjD,2BAA2B,EAAE,CAAC;IAC9B,OAAO,OAAO;QACZ,CAAC,CAAC,sCAAsC,CAAC,OAAO,CAAC;QACjD,CAAC,CAAC,gCAAgC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/microsoft/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAE3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,SAAS,GAAG,6BAA6B,CAAC;IAC9C,WAAW,EAAE,qBAAqB;IAClC,SAAS,EAAE,iBAAiB;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;AACpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;AACpE,MAAM,CAAC,MAAM,+BAA+B,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;AACxE,MAAM,CAAC,MAAM,2BAA2B,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;AAEhE,MAAM,CAAC,MAAM,8BAA8B,GAAG,SAAS,CAAC,qBAAqB,CAAC;AAC9E,MAAM,CAAC,MAAM,2BAA2B,GAAG,SAAS,CAAC,kBAAkB,CAAC;AACxE;;;;GAIG;AACH,MAAM,CAAC,MAAM,yCAAyC,GACpD,SAAS,CAAC,gCAAgC,CAAC;AAC7C,MAAM,CAAC,MAAM,yCAAyC,GACpD,SAAS,CAAC,gCAAgC,CAAC;AAC7C,MAAM,CAAC,MAAM,4BAA4B,GAAG,SAAS,CAAC,mBAAmB,CAAC;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC,UAAU,CAAC;AAMxD,0CAA0C;AAC1C,MAAM,CAAC,MAAM,sCAAsC,GAAG,SAAS,CAAC,cAAc,CAAC;AAE/E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CAAC,QAAQ,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC"}

package/dist/identity/microsoft/oauth.d.ts

@@ -17,7 +17,7 @@ export declare const MICROSOFT_OAUTH_TOKEN_URL_ENV: string;
 export declare const MICROSOFT_OAUTH_USERINFO_URL_ENV: string;
 /** Microsoft-bound OAuth state / connect-ticket helpers. */
 export declare const microsoftOauthTickets: import("../oauth-tickets.js").OauthTickets;
-export declare const resolveMicrosoftOauthRedirectBase: typeof import("../byo-oauth.js").resolveSlackOauthRedirectBase;
+export declare const resolveMicrosoftOauthRedirectBase: typeof import("../oauth-env.js").resolveOauthRedirectBase;
 export declare const readMicrosoftOauthConfig: (env?: NodeJS.ProcessEnv) => ByoOauthConfig | null;
 export declare const buildMicrosoftAuthorizeUrl: (config: ByoOauthConfig, state: string, redirectUri: string, scopes?: string) => string;
 export declare const exchangeMicrosoftOauthCode: (config: ByoOauthConfig, code: string, redirectUri: string, fetchImpl?: typeof fetch) => Promise<import("../fleet-connect.js").FleetVaultByoTokenResult>;

package/dist/identity/microsoft/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/microsoft/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAElD,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AAqBnE,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,EAAE,cA2B9B,CAAC;AAEH,eAAO,MAAM,6BAA6B,QAAiC,CAAC;AAC5E,eAAO,MAAM,iCAAiC,QACV,CAAC;AACrC,eAAO,MAAM,0BAA0B,QAA+B,CAAC;AACvE,eAAO,MAAM,4BAA4B,QAAgC,CAAC;AAC1E,eAAO,MAAM,6BAA6B,QAAiC,CAAC;AAC5E,eAAO,MAAM,gCAAgC,QACV,CAAC;AAEpC,4DAA4D;AAC5D,eAAO,MAAM,qBAAqB,4CAA4B,CAAC;AAE/D,eAAO,MAAM,iCAAiC,gEACP,CAAC;AAExC,eAAO,MAAM,wBAAwB,oDAA+B,CAAC;AACrE,eAAO,MAAM,0BAA0B,yFAAsC,CAAC;AAC9E,eAAO,MAAM,0BAA0B,0JAAiC,CAAC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/microsoft/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAElD,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AAqBnE,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,EAAE,cA2B9B,CAAC;AAEH,eAAO,MAAM,6BAA6B,QAAiC,CAAC;AAC5E,eAAO,MAAM,iCAAiC,QACV,CAAC;AACrC,eAAO,MAAM,0BAA0B,QAA+B,CAAC;AACvE,eAAO,MAAM,4BAA4B,QAAgC,CAAC;AAC1E,eAAO,MAAM,6BAA6B,QAAiC,CAAC;AAC5E,eAAO,MAAM,gCAAgC,QACV,CAAC;AAEpC,4DAA4D;AAC5D,eAAO,MAAM,qBAAqB,4CAA4B,CAAC;AAE/D,eAAO,MAAM,iCAAiC,2DACP,CAAC;AAExC,eAAO,MAAM,wBAAwB,oDAA+B,CAAC;AACrE,eAAO,MAAM,0BAA0B,yFAAsC,CAAC;AAC9E,eAAO,MAAM,0BAA0B,0JAAiC,CAAC"}

package/dist/identity/oauth-env.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Shared deployment OAuth env keys and redirect-base resolution.
+ *
+ * Used by Slack OIDC, GitHub Connect, Fleet vault Connect, and BYO clients —
+ * not Slack-specific despite historical residence under `slack/oauth.ts`.
+ */
+export declare const MDA_PUBLIC_APP_URL_ENV = "MDA_PUBLIC_APP_URL";
+/**
+ * Public Agent Server base URL used for OAuth `redirect_uri`.
+ * Required on LangGraph Host where the ASGI request origin is an internal
+ * loopback (e.g. `http://localhost:5557`) rather than `*.langgraph.app`.
+ */
+export declare const MDA_PUBLIC_API_URL_ENV = "MDA_PUBLIC_API_URL";
+/**
+ * Signing key for OAuth `state` JWTs (Connect-with-X). Reuses the guest
+ * token key so deployments do not need a third secret; never a provider
+ * client secret (that value is an OAuth credential, not a signing key).
+ */
+export declare const OAUTH_STATE_SIGNING_KEY_ENV = "MDA_GUEST_SIGNING_KEY";
+/** Server-side key for OAuth state JWTs; null when Connect cannot bind actors. */
+export declare function readOauthStateSigningKey(env?: NodeJS.ProcessEnv): string | null;
+/**
+ * Public base URL for OAuth `redirect_uri` (`…/identity/{provider}/callback`).
+ *
+ * Prefer an explicit public Agent Server URL over the ASGI request origin:
+ * LangGraph Host rewrites requests to an internal loopback that IdPs cannot
+ * use as a redirect.
+ */
+export declare function resolveOauthRedirectBase(options: {
+    requestUrl: string;
+    headers?: Headers | {
+        get(name: string): string | null | undefined;
+    };
+    deploymentBaseUrl?: string;
+    env?: NodeJS.ProcessEnv;
+}): string;
+/**
+ * @deprecated Use {@link resolveOauthRedirectBase}. Kept for callers that still
+ * import the historical Slack-named alias.
+ */
+export declare const resolveSlackOauthRedirectBase: typeof resolveOauthRedirectBase;
+//# sourceMappingURL=oauth-env.d.ts.map

package/dist/identity/oauth-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-env.d.ts","sourceRoot":"","sources":["../../src/identity/oauth-env.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAC3D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAEnE,kFAAkF;AAClF,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAGf;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;KAAE,CAAC;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,CAcT;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,iCAA2B,CAAC"}

package/dist/identity/oauth-env.js

@@ -0,0 +1,65 @@
+/**
+ * Shared deployment OAuth env keys and redirect-base resolution.
+ *
+ * Used by Slack OIDC, GitHub Connect, Fleet vault Connect, and BYO clients —
+ * not Slack-specific despite historical residence under `slack/oauth.ts`.
+ */
+import { isLoopbackHost, isLoopbackUrl } from "./loopback.js";
+export const MDA_PUBLIC_APP_URL_ENV = "MDA_PUBLIC_APP_URL";
+/**
+ * Public Agent Server base URL used for OAuth `redirect_uri`.
+ * Required on LangGraph Host where the ASGI request origin is an internal
+ * loopback (e.g. `http://localhost:5557`) rather than `*.langgraph.app`.
+ */
+export const MDA_PUBLIC_API_URL_ENV = "MDA_PUBLIC_API_URL";
+/**
+ * Signing key for OAuth `state` JWTs (Connect-with-X). Reuses the guest
+ * token key so deployments do not need a third secret; never a provider
+ * client secret (that value is an OAuth credential, not a signing key).
+ */
+export const OAUTH_STATE_SIGNING_KEY_ENV = "MDA_GUEST_SIGNING_KEY";
+/** Server-side key for OAuth state JWTs; null when Connect cannot bind actors. */
+export function readOauthStateSigningKey(env = process.env) {
+    const key = env[OAUTH_STATE_SIGNING_KEY_ENV]?.trim();
+    return key || null;
+}
+/**
+ * Public base URL for OAuth `redirect_uri` (`…/identity/{provider}/callback`).
+ *
+ * Prefer an explicit public Agent Server URL over the ASGI request origin:
+ * LangGraph Host rewrites requests to an internal loopback that IdPs cannot
+ * use as a redirect.
+ */
+export function resolveOauthRedirectBase(options) {
+    const env = options.env ?? process.env;
+    if (options.deploymentBaseUrl?.trim()) {
+        return options.deploymentBaseUrl.trim().replace(/\/$/, "");
+    }
+    const fromEnv = env[MDA_PUBLIC_API_URL_ENV]?.trim().replace(/\/$/, "");
+    if (fromEnv && !isLoopbackUrl(fromEnv)) {
+        return fromEnv;
+    }
+    const forwarded = publicOriginFromForwardedHeaders(options.headers);
+    if (forwarded) {
+        return forwarded;
+    }
+    return new URL(options.requestUrl).origin;
+}
+/**
+ * @deprecated Use {@link resolveOauthRedirectBase}. Kept for callers that still
+ * import the historical Slack-named alias.
+ */
+export const resolveSlackOauthRedirectBase = resolveOauthRedirectBase;
+function publicOriginFromForwardedHeaders(headers) {
+    if (!headers) {
+        return undefined;
+    }
+    const host = headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+    if (!host || isLoopbackHost(host)) {
+        return undefined;
+    }
+    const proto = headers.get("x-forwarded-proto")?.split(",")[0]?.trim() ||
+        (host.includes("localhost") || host.startsWith("127.") ? "http" : "https");
+    return `${proto}://${host}`;
+}
+//# sourceMappingURL=oauth-env.js.map

package/dist/identity/oauth-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-env.js","sourceRoot":"","sources":["../../src/identity/oauth-env.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9D,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAC3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAC;AAEnE,kFAAkF;AAClF,MAAM,UAAU,wBAAwB,CACtC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC;IACrD,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAKxC;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,IAAI,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,CAAC;QACtC,OAAO,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvE,IAAI,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,SAAS,GAAG,gCAAgC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,wBAAwB,CAAC;AAEtE,SAAS,gCAAgC,CACvC,OAAoE;IAEpE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GACT,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACvD,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7E,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;AAC9B,CAAC"}

package/dist/identity/options.d.ts

@@ -24,12 +24,12 @@ export type IdentityAuth = "backend" | ValidatedTokenProvider | ValidatedTokenPr
  * The isolation boundary for the deployment — the one decision most projects
  * make about identity.
  *
- * - `"user"` (default) — every caller gets private threads, private memory, and
- *   acts as themselves downstream.
+ * - `"agent"` (default) — one shared memory slice; the agent acts as itself
+ *   with the shared LangSmith vault (`mda connect` / Settings → Integrations).
+ * - `"user"` — every caller gets private threads, private memory, and acts as
+ *   themselves downstream (per-caller Connect-with-X).
  * - `"organization"` — callers belong to customer organizations; memory is
  *   shared within an organization and callers must present one.
- * - `"agent"` — no per-caller isolation; one shared memory slice, the agent acts
- *   as itself. Machine-to-machine deployments.
  * - `"none"` — no durable memory and no downstream credentials.
  */
 export type IdentityScope = "user" | "organization" | "agent" | "none";
@@ -38,7 +38,7 @@ export type IdentityScope = "user" | "organization" | "agent" | "none";
  * {@link IdentityScope}. Anything left unset follows `default`.
  */
 export interface IdentityScopeOverrides {
-    /** Base scope the unset axes follow. Defaults to `"user"`. */
+    /** Base scope the unset axes follow. Defaults to `"agent"`. */
     default?: IdentityScope;
     /** Who can open or resume a conversation. */
     threads?: ThreadScope;
@@ -55,10 +55,23 @@ export interface IdentityScopeOverrides {
 export interface IdentityOptions {
     /** How callers authenticate. Defaults to `"backend"`. */
     auth?: IdentityAuth;
-    /** The isolation boundary, or per-axis overrides. Defaults to `"user"`. */
+    /** The isolation boundary, or per-axis overrides. Defaults to `"agent"`. */
     scope?: IdentityScope | IdentityScopeOverrides;
-    /** Whether callers must present an organization. Inferred from `scope`. */
-    organizations?: OrganizationRequirement;
+    /**
+     * Whether every caller must present an organization id.
+     *
+     * Inferred from `scope`: any axis set to `"organization"` → `"required"`,
+     * otherwise `"optional"`. Set this explicitly only when you need org
+     * partitioning without org-scoped memory — for example private per-user
+     * memory namespaced by customer org:
+     *
+     * ```ts
+     * defineIdentity({ scope: "user", organization: "required" })
+     * ```
+     *
+     * Cannot be `"optional"` when an axis is organization-scoped.
+     */
+    organization?: OrganizationRequirement;
     /**
      * Mint your own downstream credentials per caller. Providing this puts the
      * credentials axis in custom mode — there is no separate flag to set.

package/dist/identity/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,OAAO,KAAK,EACV,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,WAAW,EACX,uBAAuB,EACvB,WAAW,EACX,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,sBAAsB,GACtB,sBAAsB,EAAE,CAAC;AAE7B;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,cAAc,GAAG,OAAO,GAAG,MAAM,CAAC;AAEvE;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,8DAA8D;IAC9D,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,wCAAwC;IACxC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED,uDAAuD;AACvD,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,aAAa,GAAG,sBAAsB,CAAC;IAC/C,2EAA2E;IAC3E,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,wBAAwB,GAAG,mBAAmB,CAAC;IAC7D;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAoCD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,GAAE,eAAoB,GAC5B,cAAc,CAsBhB"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,OAAO,KAAK,EACV,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,WAAW,EACX,uBAAuB,EACvB,WAAW,EACX,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,sBAAsB,GACtB,sBAAsB,EAAE,CAAC;AAE7B;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,cAAc,GAAG,OAAO,GAAG,MAAM,CAAC;AAEvE;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,+DAA+D;IAC/D,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,wCAAwC;IACxC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED,uDAAuD;AACvD,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,aAAa,GAAG,sBAAsB,CAAC;IAC/C;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,uBAAuB,CAAC;IACvC;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,wBAAwB,GAAG,mBAAmB,CAAC;IAC7D;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAoCD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,GAAE,eAAoB,GAC5B,cAAc,CAsBhB"}

package/dist/identity/options.js

@@ -52,11 +52,11 @@ const CREDENTIAL_SCOPES = [
 export function normalizeIdentity(options = {}) {
     assertOptionKeys(options);
     const scope = resolveScope(options);
-    const organizations = options.organizations ?? inferOrganizationRequirement(scope);
-    assertOrganizationRequirement(options.organizations, scope, organizations);
+    const organization = options.organization ?? inferOrganizationRequirement(scope);
+    assertOrganizationRequirement(options.organization, scope, organization);
     const config = {
         ingress: { http: resolveIngress(options.auth) },
-        organizations,
+        organization,
         scope,
     };
     if (options.credentials !== undefined) {
@@ -79,9 +79,9 @@ function resolveIngress(auth) {
     return { mode: "validated_token", providers };
 }
 function resolveScope(options) {
-    const scope = options.scope ?? "user";
+    const scope = options.scope ?? "agent";
     const overrides = typeof scope === "string" ? { default: scope } : scope;
-    const base = SCOPE_AXES[overrides.default ?? "user"];
+    const base = SCOPE_AXES[overrides.default ?? "agent"];
     if (base === undefined) {
         throw new Error(`defineIdentity(...) unknown \`scope\` "${String(overrides.default)}". ` +
             `Valid scopes: ${Object.keys(SCOPE_AXES).join(", ")}.`);
@@ -125,11 +125,11 @@ function assertOrganizationRequirement(declared, scope, resolved) {
     if (declared !== undefined &&
         declared !== "optional" &&
         declared !== "required") {
-        throw new Error(`defineIdentity(...) \`organizations\` must be "optional" or "required" (received "${String(declared)}").`);
+        throw new Error(`defineIdentity(...) \`organization\` must be "optional" or "required" (received "${String(declared)}").`);
     }
     if (resolved === "optional" &&
         inferOrganizationRequirement(scope) === "required") {
-        throw new Error('defineIdentity(...) organization-scoped isolation requires `organizations: "required"`.');
+        throw new Error('defineIdentity(...) organization-scoped isolation requires `organization: "required"`.');
     }
 }
 /**
@@ -155,7 +155,7 @@ function resolveConnect(options) {
 const KNOWN_OPTION_KEYS = new Set([
     "auth",
     "scope",
-    "organizations",
+    "organization",
     "credentials",
     "connect",
 ]);

package/dist/identity/options.js.map

@@ -1 +1 @@
-{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AA4FvE;;;;GAIG;AACH,MAAM,UAAU,GAAmD;IACjE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE;IAC9D,YAAY,EAAE;QACZ,OAAO,EAAE,MAAM;QACf,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,MAAM;KACpB;IACD,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;IACjE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE;CAC/D,CAAC;AAEF,MAAM,aAAa,GAA2B;IAC5C,MAAM;IACN,cAAc;IACd,cAAc;CACf,CAAC;AACF,MAAM,aAAa,GAA2B;IAC5C,MAAM;IACN,cAAc;IACd,OAAO;IACP,MAAM;CACP,CAAC;AACF,MAAM,iBAAiB,GAA+B;IACpD,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;CACT,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAO,GAAoB,EAAE;IAE7B,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE1B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa,IAAI,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC/D,6BAA6B,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAmB;QAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QAC/C,aAAa;QACb,KAAK;KACN,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAC3C,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CACrB,IAA8B;IAE9B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,sDAAsD,CAC1G,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,OAAwB;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC;IACtC,MAAM,SAAS,GACb,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK;YACtE,iBAAiB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC;IAC1E,MAAM,MAAM,GACV,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;IACvE,0EAA0E;IAC1E,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,KAAK,SAAS;QAC/B,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,WAAW,CAAC;QAChD,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,WAAW,EAAE,iBAAiB,CAAC;YACpE,IAAI,CAAC,WAAW,CAAC,CAAC;IAExB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,UAAU,CACjB,IAAY,EACZ,KAAwB,EACxB,OAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,aAAa,MAAM,CAAC,KAAK,CAAC,KAAK;YACxE,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAC9B,QAAqC;IAErC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,yFAAyF,QAAQ,KAAK;YACpG,qFAAqF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wEAAwE;AACxE,SAAS,4BAA4B,CACnC,KAA8B;IAE9B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;AACjE,CAAC;AAED,SAAS,6BAA6B,CACpC,QAA6C,EAC7C,KAA8B,EAC9B,QAAiC;IAEjC,IACE,QAAQ,KAAK,SAAS;QACtB,QAAQ,KAAK,UAAU;QACvB,QAAQ,KAAK,UAAU,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qFAAqF,MAAM,CAAC,QAAQ,CAAC,KAAK,CAC3G,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,KAAK,UAAU;QACvB,4BAA4B,CAAC,KAAK,CAAC,KAAK,UAAU,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,OAAwB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC1B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM;IACN,OAAO;IACP,eAAe;IACf,aAAa;IACb,SAAS;CACV,CAAC,CAAC;AAEH;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAwB;IAChD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CACzC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CACrC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC9D,kBAAkB,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAyGvE;;;;GAIG;AACH,MAAM,UAAU,GAAmD;IACjE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE;IAC9D,YAAY,EAAE;QACZ,OAAO,EAAE,MAAM;QACf,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,MAAM;KACpB;IACD,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;IACjE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE;CAC/D,CAAC;AAEF,MAAM,aAAa,GAA2B;IAC5C,MAAM;IACN,cAAc;IACd,cAAc;CACf,CAAC;AACF,MAAM,aAAa,GAA2B;IAC5C,MAAM;IACN,cAAc;IACd,OAAO;IACP,MAAM;CACP,CAAC;AACF,MAAM,iBAAiB,GAA+B;IACpD,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;CACT,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAO,GAAoB,EAAE;IAE7B,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE1B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,IAAI,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC9D,6BAA6B,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAmB;QAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QAC/C,YAAY;QACZ,KAAK;KACN,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAC3C,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CACrB,IAA8B;IAE9B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,sDAAsD,CAC1G,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,OAAwB;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC;IACvC,MAAM,SAAS,GACb,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK;YACtE,iBAAiB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC;IAC1E,MAAM,MAAM,GACV,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;IACvE,0EAA0E;IAC1E,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,KAAK,SAAS;QAC/B,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,WAAW,CAAC;QAChD,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,WAAW,EAAE,iBAAiB,CAAC;YACpE,IAAI,CAAC,WAAW,CAAC,CAAC;IAExB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,UAAU,CACjB,IAAY,EACZ,KAAwB,EACxB,OAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,aAAa,MAAM,CAAC,KAAK,CAAC,KAAK;YACxE,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAC9B,QAAqC;IAErC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,yFAAyF,QAAQ,KAAK;YACpG,qFAAqF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wEAAwE;AACxE,SAAS,4BAA4B,CACnC,KAA8B;IAE9B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;AACjE,CAAC;AAED,SAAS,6BAA6B,CACpC,QAA6C,EAC7C,KAA8B,EAC9B,QAAiC;IAEjC,IACE,QAAQ,KAAK,SAAS;QACtB,QAAQ,KAAK,UAAU;QACvB,QAAQ,KAAK,UAAU,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oFAAoF,MAAM,CAAC,QAAQ,CAAC,KAAK,CAC1G,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,KAAK,UAAU;QACvB,4BAA4B,CAAC,KAAK,CAAC,KAAK,UAAU,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,OAAwB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC1B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM;IACN,OAAO;IACP,cAAc;IACd,aAAa;IACb,SAAS;CACV,CAAC,CAAC;AAEH;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAwB;IAChD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CACzC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CACrC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC9D,kBAAkB,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/identity/slack/connect-http.js

@@ -4,7 +4,7 @@
  * Mounted under `/identity/slack/*` when listed on `identity.connect`.
  */
 import { buildIdentityLinkRecord, getIdentityLinkStore, } from "./links.js";
-import { buildSlackAuthorizeUrl, exchangeSlackOidcCode, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, readSlackOidcConfig, resolveSlackOauthRedirectBase, slackOauthTickets, } from "./oauth.js";
+import { buildSlackAuthorizeUrl, exchangeSlackOidcCode, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, readSlackOidcConfig, resolveOauthRedirectBase, slackOauthTickets, } from "./oauth.js";
 import { identityConnectPaths } from "../connect-paths.js";
 import { hasChannelForProvider, isUserScopedDeployment, } from "../connect-inference.js";
 const PATHS = identityConnectPaths("slack");
@@ -82,7 +82,7 @@ export function createSlackIdentityConnectProvider(options = {}) {
             await store().removeByUserId(userId);
         },
         resolveRedirectBase(options) {
-            return resolveSlackOauthRedirectBase(options);
+            return resolveOauthRedirectBase(options);
         },
         resolvePublicAppUrl() {
             const oauth = readSlackOidcConfig();

package/dist/identity/slack/connect-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,GAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,MAAM,CAAC;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,OAAO,CAAC;AACtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC;AAOlD,mEAAmE;AACnE,MAAM,UAAU,kCAAkC,CAChD,OAAO,GAAwC,EAAE;IAEjD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,oBAAoB,EAAE,CAAC;IAEhE,OAAO;QACL,EAAE,EAAE,OAAO;QACX,WAAW,CAAC,GAAgC;YAC1C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,wEAAwE;YACxE,qEAAqE;YACrE,gEAAgE;YAChE,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,KAAK;gBACtB,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC;oBAC3C,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC;gBACrB,GAAG,CAAC,IAAI;oBACN,CAAC,CAAC;wBACE,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,kGAAkG,2BAA2B,GAAG;iBACxI,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpE,OAAO;gBACL,YAAY,EAAE,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;aAChE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAC/C,KAAK,EACL,IAAI,EACJ,WAAW,CACZ,CAAC;YACF,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;YACpD,MAAM,MAAM,GAAG,uBAAuB,CAAC;gBACrC,MAAM;gBACN,WAAW,EAAE,aAAa,CAAC,MAAM;gBACjC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,2BAA2B;aAClE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,KAAK,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,mBAAmB,CAAC,OAA2C;YAC7D,OAAO,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QACD,mBAAmB;YACjB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,OAAO,CACL,KAAK,EAAE,YAAY;gBACnB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,4BAA4B,GACvC,kCAAkC,EAAE,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CACrB,OAA6C;IAE7C,OAAO,OAAO;QACZ,CAAC,CAAC,kCAAkC,CAAC,OAAO,CAAC;QAC7C,CAAC,CAAC,4BAA4B,CAAC;AACnC,CAAC"}
+{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,GAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,MAAM,CAAC;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,OAAO,CAAC;AACtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC;AAOlD,mEAAmE;AACnE,MAAM,UAAU,kCAAkC,CAChD,OAAO,GAAwC,EAAE;IAEjD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,oBAAoB,EAAE,CAAC;IAEhE,OAAO;QACL,EAAE,EAAE,OAAO;QACX,WAAW,CAAC,GAAgC;YAC1C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,wEAAwE;YACxE,qEAAqE;YACrE,gEAAgE;YAChE,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,KAAK;gBACtB,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC;oBAC3C,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC;gBACrB,GAAG,CAAC,IAAI;oBACN,CAAC,CAAC;wBACE,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,kGAAkG,2BAA2B,GAAG;iBACxI,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpE,OAAO;gBACL,YAAY,EAAE,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;aAChE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAC/C,KAAK,EACL,IAAI,EACJ,WAAW,CACZ,CAAC;YACF,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;YACpD,MAAM,MAAM,GAAG,uBAAuB,CAAC;gBACrC,MAAM;gBACN,WAAW,EAAE,aAAa,CAAC,MAAM;gBACjC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,2BAA2B;aAClE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,KAAK,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,mBAAmB,CAAC,OAA2C;YAC7D,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,mBAAmB;YACjB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,OAAO,CACL,KAAK,EAAE,YAAY;gBACnB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,4BAA4B,GACvC,kCAAkC,EAAE,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CACrB,OAA6C;IAE7C,OAAO,OAAO;QACZ,CAAC,CAAC,kCAAkC,CAAC,OAAO,CAAC;QAC7C,CAAC,CAAC,4BAA4B,CAAC;AACnC,CAAC"}

package/dist/identity/slack/oauth.d.ts

@@ -1,22 +1,10 @@
 /**
  * Slack OpenID Connect helpers for Connect-with-Slack account linking.
  */
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, resolveOauthRedirectBase, resolveSlackOauthRedirectBase, } from "../oauth-env.js";
 export declare const SLACK_CLIENT_ID_ENV = "SLACK_CLIENT_ID";
 export declare const SLACK_CLIENT_SECRET_ENV = "SLACK_CLIENT_SECRET";
 export declare const SLACK_TEAM_ID_ENV = "SLACK_TEAM_ID";
-export declare const MDA_PUBLIC_APP_URL_ENV = "MDA_PUBLIC_APP_URL";
-/**
- * Public Agent Server base URL used for Slack OAuth `redirect_uri`.
- * Required on LangGraph Host where the ASGI request origin is an internal
- * loopback (e.g. `http://localhost:5557`) rather than `*.langgraph.app`.
- */
-export declare const MDA_PUBLIC_API_URL_ENV = "MDA_PUBLIC_API_URL";
-/**
- * Signing key for OAuth `state` JWTs (Connect-with-Slack). Reuses the guest
- * token key so deployments do not need a third secret; never the Slack
- * client secret (that value is an OAuth credential, not a signing key).
- */
-export declare const OAUTH_STATE_SIGNING_KEY_ENV = "MDA_GUEST_SIGNING_KEY";
 /** Override Slack OIDC base (tests). */
 export declare const SLACK_OIDC_BASE_ENV = "SLACK_OIDC_BASE";
 /** Slack-bound OAuth state / connect-ticket helpers. */
@@ -35,23 +23,6 @@ export interface SlackOidcIdentity {
 }
 export declare function readSlackOidcConfig(env?: NodeJS.ProcessEnv): SlackOidcConfig | null;
 export declare function slackConnectUrl(publicAppUrl: string): string;
-/**
- * Public base URL for Slack OAuth `redirect_uri` (`…/identity/slack/callback`).
- *
- * Prefer an explicit public Agent Server URL over the ASGI request origin:
- * LangGraph Host rewrites requests to an internal loopback that Slack cannot
- * use as a redirect.
- */
-export declare function resolveSlackOauthRedirectBase(options: {
-    requestUrl: string;
-    headers?: Headers | {
-        get(name: string): string | null | undefined;
-    };
-    deploymentBaseUrl?: string;
-    env?: NodeJS.ProcessEnv;
-}): string;
-/** Server-side key for OAuth state JWTs; null when Connect cannot bind actors. */
-export declare function readOauthStateSigningKey(env?: NodeJS.ProcessEnv): string | null;
 export declare function buildSlackAuthorizeUrl(config: SlackOidcConfig, state: string, redirectUri: string): string;
 export declare function exchangeSlackOidcCode(config: SlackOidcConfig, code: string, redirectUri: string): Promise<SlackOidcIdentity>;
 //# sourceMappingURL=oauth.d.ts.map

package/dist/identity/slack/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/oauth.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AACrD,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AACjD,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAC3D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAEnE,wCAAwC;AACxC,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAIrD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,4CAA2B,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,eAAe,GAAG,IAAI,CAmBxB;AAED,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;KAAE,CAAC;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,CAcT;AAkBD,kFAAkF;AAClF,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAGf;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,MAAM,CAWR;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,CAAC,CA4D5B"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/oauth.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AAEzB,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AACrD,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,wCAAwC;AACxC,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAIrD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,4CAA2B,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,eAAe,GAAG,IAAI,CAmBxB;AAED,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,MAAM,CAWR;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,CAAC,CA4D5B"}

package/dist/identity/slack/oauth.js

@@ -2,24 +2,12 @@
  * Slack OpenID Connect helpers for Connect-with-Slack account linking.
  */
 import { fetchWithTimeout, PROVIDER_HTTP_TIMEOUT_MS, } from "../../runtime/http.js";
-import { isLoopbackHost, isLoopbackUrl } from "../loopback.js";
 import { oauthTicketsFor } from "../oauth-tickets.js";
+import { MDA_PUBLIC_APP_URL_ENV } from "../oauth-env.js";
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, resolveOauthRedirectBase, resolveSlackOauthRedirectBase, } from "../oauth-env.js";
 export const SLACK_CLIENT_ID_ENV = "SLACK_CLIENT_ID";
 export const SLACK_CLIENT_SECRET_ENV = "SLACK_CLIENT_SECRET";
 export const SLACK_TEAM_ID_ENV = "SLACK_TEAM_ID";
-export const MDA_PUBLIC_APP_URL_ENV = "MDA_PUBLIC_APP_URL";
-/**
- * Public Agent Server base URL used for Slack OAuth `redirect_uri`.
- * Required on LangGraph Host where the ASGI request origin is an internal
- * loopback (e.g. `http://localhost:5557`) rather than `*.langgraph.app`.
- */
-export const MDA_PUBLIC_API_URL_ENV = "MDA_PUBLIC_API_URL";
-/**
- * Signing key for OAuth `state` JWTs (Connect-with-Slack). Reuses the guest
- * token key so deployments do not need a third secret; never the Slack
- * client secret (that value is an OAuth credential, not a signing key).
- */
-export const OAUTH_STATE_SIGNING_KEY_ENV = "MDA_GUEST_SIGNING_KEY";
 /** Override Slack OIDC base (tests). */
 export const SLACK_OIDC_BASE_ENV = "SLACK_OIDC_BASE";
 const DEFAULT_OIDC_BASE = "https://slack.com";
@@ -45,45 +33,6 @@ export function readSlackOidcConfig(env = process.env) {
 export function slackConnectUrl(publicAppUrl) {
     return `${publicAppUrl.replace(/\/$/, "")}/settings`;
 }
-/**
- * Public base URL for Slack OAuth `redirect_uri` (`…/identity/slack/callback`).
- *
- * Prefer an explicit public Agent Server URL over the ASGI request origin:
- * LangGraph Host rewrites requests to an internal loopback that Slack cannot
- * use as a redirect.
- */
-export function resolveSlackOauthRedirectBase(options) {
-    const env = options.env ?? process.env;
-    if (options.deploymentBaseUrl?.trim()) {
-        return options.deploymentBaseUrl.trim().replace(/\/$/, "");
-    }
-    const fromEnv = env[MDA_PUBLIC_API_URL_ENV]?.trim().replace(/\/$/, "");
-    if (fromEnv && !isLoopbackUrl(fromEnv)) {
-        return fromEnv;
-    }
-    const forwarded = publicOriginFromForwardedHeaders(options.headers);
-    if (forwarded) {
-        return forwarded;
-    }
-    return new URL(options.requestUrl).origin;
-}
-function publicOriginFromForwardedHeaders(headers) {
-    if (!headers) {
-        return undefined;
-    }
-    const host = headers.get("x-forwarded-host")?.split(",")[0]?.trim();
-    if (!host || isLoopbackHost(host)) {
-        return undefined;
-    }
-    const proto = headers.get("x-forwarded-proto")?.split(",")[0]?.trim() ||
-        (host.includes("localhost") || host.startsWith("127.") ? "http" : "https");
-    return `${proto}://${host}`;
-}
-/** Server-side key for OAuth state JWTs; null when Connect cannot bind actors. */
-export function readOauthStateSigningKey(env = process.env) {
-    const key = env[OAUTH_STATE_SIGNING_KEY_ENV]?.trim();
-    return key || null;
-}
 export function buildSlackAuthorizeUrl(config, state, redirectUri) {
     const url = new URL(`${config.oidcBase}/openid/connect/authorize`);
     url.searchParams.set("response_type", "code");

package/dist/identity/slack/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/identity/slack/oauth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AACrD,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AACjD,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAC3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAC;AAEnE,wCAAwC;AACxC,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAErD,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAE9C,wDAAwD;AACxD,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;AAgB1D,MAAM,UAAU,mBAAmB,CACjC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,YAAY,GAAG,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,MAAM,YAAY,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,QAAQ;QACR,YAAY;QACZ,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE;YAChC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,iBAAiB,CAAE,CAAC,IAAI,EAAE,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7C,QAAQ,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,iBAAiB,CAAC,CAAC,OAAO,CACvE,KAAK,EACL,EAAE,CACH;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,YAAoB;IAClD,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAK7C;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,IAAI,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,CAAC;QACtC,OAAO,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvE,IAAI,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,SAAS,GAAG,gCAAgC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;AAC5C,CAAC;AAED,SAAS,gCAAgC,CACvC,OAAoE;IAEpE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GACT,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACvD,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7E,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,wBAAwB,CACtC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC;IACrD,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAuB,EACvB,KAAa,EACb,WAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,2BAA2B,CAAC,CAAC;IACnE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAuB,EACvB,IAAY,EACZ,WAAmB;IAEnB,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,QAAQ,2BAA2B,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,IAAI;QACJ,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,oBAAoB;KACjC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAC1C,QAAQ,EACR;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI;KACL,EACD,wBAAwB,CACzB,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAK5C,CAAC;IACF,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,SAAS,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI,kCAAkC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,MAAM,CAAC,QAAQ,8BAA8B,CAAC;IACrE,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,WAAW,EACX,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,EAClE,wBAAwB,CACzB,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAO1C,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,4BAA4B,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GACV,QAAQ,CAAC,2BAA2B,CAAC;QACrC,CAAC,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ;YAC/B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE;YAC/B,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO;QACL,MAAM;QACN,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC;YACvC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,2BAA2B,CAAC,EAAE;YACnD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/identity/slack/oauth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AAEzB,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AACrD,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD,wCAAwC;AACxC,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAErD,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAE9C,wDAAwD;AACxD,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;AAgB1D,MAAM,UAAU,mBAAmB,CACjC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,YAAY,GAAG,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,MAAM,YAAY,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,QAAQ;QACR,YAAY;QACZ,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE;YAChC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,iBAAiB,CAAE,CAAC,IAAI,EAAE,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7C,QAAQ,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,iBAAiB,CAAC,CAAC,OAAO,CACvE,KAAK,EACL,EAAE,CACH;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,YAAoB;IAClD,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAuB,EACvB,KAAa,EACb,WAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,2BAA2B,CAAC,CAAC;IACnE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAuB,EACvB,IAAY,EACZ,WAAmB;IAEnB,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,QAAQ,2BAA2B,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,IAAI;QACJ,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,oBAAoB;KACjC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAC1C,QAAQ,EACR;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI;KACL,EACD,wBAAwB,CACzB,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAK5C,CAAC;IACF,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,SAAS,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI,kCAAkC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,MAAM,CAAC,QAAQ,8BAA8B,CAAC;IACrE,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,WAAW,EACX,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,EAClE,wBAAwB,CACzB,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAO1C,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,4BAA4B,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GACV,QAAQ,CAAC,2BAA2B,CAAC;QACrC,CAAC,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ;YAC/B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE;YAC/B,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO;QACL,MAAM;QACN,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC;YACvC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,2BAA2B,CAAC,EAAE;YACnD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC"}

package/dist/identity/types.d.ts

@@ -192,7 +192,21 @@ export type CredentialResolverConfig = ({
  * folded into a hand-written switch.
  */
 export type CredentialResolvers = Record<string, CredentialResolverConfig>;
-/** Whether every caller must present an organization. */
+/**
+ * Whether every caller must present an organization id.
+ *
+ * - `"optional"` — callers may omit an organization; memory / thread keys do
+ *   not partition by org.
+ * - `"required"` — requests without an organization are rejected. When memory
+ *   is `"user"`, per-user slices are also namespaced by org
+ *   (`{deploy}--t--{org}--u--{user}`), so the same user in two orgs cannot
+ *   share memory.
+ *
+ * Usually inferred from {@link IdentityConfig.scope}: any axis set to
+ * `"organization"` forces `"required"`. Set it explicitly only for the
+ * combination inference cannot reach — e.g. `scope: "user"` with
+ * `organization: "required"` (private per-user memory, partitioned by org).
+ */
 export type OrganizationRequirement = "optional" | "required";
 /** Who can open/resume the conversation. */
 export type ThreadScope = "user" | "conversation" | "organization";
@@ -221,8 +235,13 @@ export interface IdentityConfig {
     ingress: {
         http: HttpIngress;
     };
-    /** Whether every caller must present an organization. */
-    organizations: OrganizationRequirement;
+    /**
+     * Whether every caller must present an organization id on the request.
+     * See {@link OrganizationRequirement}. Distinct from
+     * {@link RuntimeIdentity.organization}, which is the caller's org for a
+     * single run.
+     */
+    organization: OrganizationRequirement;
     /** The three isolation axes. */
     scope: {
         /** Who can open/resume the conversation. */

package/dist/identity/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,YAAY,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,qBAAqB,CAAC;AAE5D;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,iFAAiF;IACjF,KAAK,CAAC,EAAE;QACN,sDAAsD;QACtD,KAAK,EAAE,OAAO,CAAC;QACf,kCAAkC;QAClC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,8DAA8D;QAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B;IAC5B,IAAI,EAAE,UAAU,GAAG,KAAK,GAAG,YAAY,GAAG,WAAW,CAAC;IACtD,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,IAAI,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,4EAA4E;IAC5E,YAAY,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN;;;WAGG;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,uCAAuC;AACvC,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE;IACtC,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC,CAAC;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAAG,6BAA6B,CAAC,GACjE,CAAC;IAAE,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,6BAA6B,CAAC,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AAE3E,yDAAyD;AACzD,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,UAAU,CAAC;AAE9D,4CAA4C;AAC5C,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,cAAc,GAAG,cAAc,CAAC;AACnE,0CAA0C;AAC1C,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,cAAc,GAAG,OAAO,GAAG,MAAM,CAAC;AACrE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF,yDAAyD;IACzD,aAAa,EAAE,uBAAuB,CAAC;IACvC,gCAAgC;IAChC,KAAK,EAAE;QACL,4CAA4C;QAC5C,OAAO,CAAC,EAAE,WAAW,CAAC;QACtB,sCAAsC;QACtC,MAAM,EAAE,WAAW,CAAC;QACpB;;;WAGG;QACH,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;IACF;;;OAGG;IACH,WAAW,CAAC,EAAE,wBAAwB,GAAG,mBAAmB,CAAC;IAC7D;;;OAGG;IACH,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,YAAY,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,qBAAqB,CAAC;AAE5D;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,iFAAiF;IACjF,KAAK,CAAC,EAAE;QACN,sDAAsD;QACtD,KAAK,EAAE,OAAO,CAAC;QACf,kCAAkC;QAClC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,8DAA8D;QAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B;IAC5B,IAAI,EAAE,UAAU,GAAG,KAAK,GAAG,YAAY,GAAG,WAAW,CAAC;IACtD,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,IAAI,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,4EAA4E;IAC5E,YAAY,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN;;;WAGG;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,uCAAuC;AACvC,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE;IACtC,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC,CAAC;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAAG,6BAA6B,CAAC,GACjE,CAAC;IAAE,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,6BAA6B,CAAC,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AAE3E;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,UAAU,CAAC;AAE9D,4CAA4C;AAC5C,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,cAAc,GAAG,cAAc,CAAC;AACnE,0CAA0C;AAC1C,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,cAAc,GAAG,OAAO,GAAG,MAAM,CAAC;AACrE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF;;;;;OAKG;IACH,YAAY,EAAE,uBAAuB,CAAC;IACtC,gCAAgC;IAChC,KAAK,EAAE;QACL,4CAA4C;QAC5C,OAAO,CAAC,EAAE,WAAW,CAAC;QACtB,sCAAsC;QACtC,MAAM,EAAE,WAAW,CAAC;QACpB;;;WAGG;QACH,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;IACF;;;OAGG;IACH,WAAW,CAAC,EAAE,wBAAwB,GAAG,mBAAmB,CAAC;IAC7D;;;OAGG;IACH,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC"}

package/dist/identity/x/connect-http.d.ts

@@ -1,39 +1,38 @@
 /**
- * Connect-with-X — thin adapter over {@link createFleetVaultConnectProvider}.
+ * Connect-with-X — thin adapter over {@link defineFleetVaultConnect}.
  *
  * Mounted under `/identity/x/*` when listed on `identity.connect`, or inferred
  * from `connectors.x` on a user-scoped deployment. OAuth uses Fleet
  * auth-sessions against the reserved `twitter-oauth-provider` slug (PKCE is
  * handled by Host); there is no local BYO client path.
  */
-import type { IdentityConnectMountContext, IdentityConnectProvider } from "../connect-provider-types.js";
-import { type FleetVaultConnectProviderOptions } from "../fleet-connect.js";
+import type { FleetVaultConnectProviderOptions } from "../fleet-connect.js";
 export declare const X_CONNECT_STATUS_PATH: string;
 export declare const X_CONNECT_START_PATH: string;
 export declare const X_CONNECT_CALLBACK_PATH: string;
 export declare const X_CONNECT_LINK_PATH: string;
-export declare function isXActorSubjectEnabled(): boolean;
-export declare function enableXActorSubject(): void;
+export declare const isXActorSubjectEnabled: () => boolean;
+export declare const enableXActorSubject: () => void;
 /**
  * Enable actor-subject mode when X connectors imply per-user vault subjects.
  *
  * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
  */
-export declare function enableXActorSubjectFromConnectors(connectorKinds: readonly (string | undefined)[] | undefined, scope?: IdentityConnectMountContext["scope"]): void;
-export declare function resetXActorSubjectEnabledForTests(): void;
-export declare function isXConnectConfigured(env?: NodeJS.ProcessEnv): boolean;
-export declare function xConnectUrl(publicAppUrl: string): string;
+export declare const enableXActorSubjectFromConnectors: (connectorKinds: readonly (string | undefined)[] | undefined, scope?: import("../connect-provider-types.js").IdentityConnectMountContext["scope"]) => void;
+export declare const resetXActorSubjectEnabledForTests: () => void;
+export declare const isXConnectConfigured: (env?: NodeJS.ProcessEnv) => boolean;
+export declare const xConnectUrl: (publicAppUrl: string) => string;
 /** Options for {@link createXIdentityConnectProvider}. */
 export type XIdentityConnectProviderOptions = Pick<FleetVaultConnectProviderOptions, "providerSlug" | "scopes" | "fleet">;
 /** Build an X connect provider (Fleet auth-sessions / twitter-oauth-provider). */
-export declare function createXIdentityConnectProvider(options?: XIdentityConnectProviderOptions): IdentityConnectProvider;
+export declare const createXIdentityConnectProvider: (options?: Pick<FleetVaultConnectProviderOptions, "providerSlug" | "scopes" | "fleet">) => import("../connect-provider-types.js").IdentityConnectProvider;
 /** Default X connect provider used as a built-in mount candidate. */
-export declare const xIdentityConnectProvider: IdentityConnectProvider;
+export declare const xIdentityConnectProvider: import("../connect-provider-types.js").IdentityConnectProvider;
 /**
  * Opt into Connect-with-X on `defineIdentity({ connect: […] })`.
  *
  * Usually unnecessary: declaring `connectors.x` on a user-scoped identity
  * deployment mounts this provider and derives OAuth scopes automatically.
  */
-export declare function connect(options?: XIdentityConnectProviderOptions): IdentityConnectProvider;
+export declare const connect: (options?: Pick<FleetVaultConnectProviderOptions, "providerSlug" | "scopes" | "fleet">) => import("../connect-provider-types.js").IdentityConnectProvider;
 //# sourceMappingURL=connect-http.d.ts.map

package/dist/identity/x/connect-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/x/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAIL,KAAK,gCAAgC,EACtC,MAAM,qBAAqB,CAAC;AAQ7B,eAAO,MAAM,qBAAqB,QAAe,CAAC;AAClD,eAAO,MAAM,oBAAoB,QAAgB,CAAC;AAClD,eAAO,MAAM,uBAAuB,QAAiB,CAAC;AACtD,eAAO,MAAM,mBAAmB,QAAa,CAAC;AAE9C,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC/C,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC3C,IAAI,CAMN;AAED,wBAAgB,iCAAiC,IAAI,IAAI,CAExD;AAED,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET;AAED,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,0DAA0D;AAC1D,MAAM,MAAM,+BAA+B,GAAG,IAAI,CAChD,gCAAgC,EAChC,cAAc,GAAG,QAAQ,GAAG,OAAO,CACpC,CAAC;AAEF,kFAAkF;AAClF,wBAAgB,8BAA8B,CAC5C,OAAO,GAAE,+BAAoC,GAC5C,uBAAuB,CAWzB;AAED,qEAAqE;AACrE,eAAO,MAAM,wBAAwB,EAAE,uBACL,CAAC;AAEnC;;;;;GAKG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,+BAA+B,GACxC,uBAAuB,CAKzB"}
+{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/x/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AAO5E,eAAO,MAAM,qBAAqB,QAAiB,CAAC;AACpD,eAAO,MAAM,oBAAoB,QAAkB,CAAC;AACpD,eAAO,MAAM,uBAAuB,QAAmB,CAAC;AACxD,eAAO,MAAM,mBAAmB,QAAe,CAAC;AAEhD,eAAO,MAAM,sBAAsB,eAA0B,CAAC;AAC9D,eAAO,MAAM,mBAAmB,YAAuB,CAAC;AACxD;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,4JACV,CAAC;AACrC,eAAO,MAAM,iCAAiC,YACV,CAAC;AACrC,eAAO,MAAM,oBAAoB,sCAAwB,CAAC;AAC1D,eAAO,MAAM,WAAW,kCAAe,CAAC;AAExC,0DAA0D;AAC1D,MAAM,MAAM,+BAA+B,GAAG,IAAI,CAChD,gCAAgC,EAChC,cAAc,GAAG,QAAQ,GAAG,OAAO,CACpC,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,8BAA8B,2JAAmB,CAAC;AAE/D,qEAAqE;AACrE,eAAO,MAAM,wBAAwB,gEAAa,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,OAAO,2JAAY,CAAC"}