managed-deepagents 0.5.0-dev.84 → 0.5.0-dev.86

package/dist/identity/marketplace/connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../../src/identity/marketplace/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,GAGxB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAEpE,OAAO,EACL,+BAA+B,GAEhC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,GAErB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAqB3D,SAAS,kBAAkB,CACzB,KAAiD;IAEjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EACJ,IAAI,EACJ,MAAM,EAAE,MAAM,EACd,aAAa,EACb,aAAa,EAAE,cAAc,EAC7B,GAAG,IAAI,EACR,GAAG,KAAK,CAAC;IACV,OAAO;QACL,GAAG,IAAI;QACP,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CACnD,WAAsC,EACtC,OAAO,GAAsC,EAAE;IAE/C,MAAM,aAAa,GACjB,OAAO,CAAC,KAAK,EAAE,aAAa,IAAI,2BAA2B,CAAC;IAC9D,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAEhD,OAAO,+BAA+B,CAAC;QACrC,WAAW,EAAE,sBAAsB,CAAC,WAAW,CAAC;QAChD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,cAAc,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC/C,mBAAmB,EAAE,6BAA6B;QAClD,mBAAmB;YACjB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBACvD,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,mBAAmB;YACvB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;gBACjC,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;aACjB,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,GAAG,WAAW,CAAC,WAAW,sCAAsC,CACjE,CAAC;YACJ,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC9B,uBAAuB,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC;QAChD,kBAAkB,EAChB,GAAG,WAAW,CAAC,WAAW,mCAAmC;YAC7D,oBAAoB,WAAW,CAAC,WAAW,sCAAsC;QACnF,qBAAqB,EAAE,IAAI;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAC9C,4BAA4B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,qCAAqC,CAAC,KAAK,CAAC,CAC7C,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAuB,MAAM,CAAC,WAAW,CACtE,4BAA4B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;IACjD,KAAK,CAAC,EAAE;IACR,CAAC,OAA2C,EAAE,EAAE;QAC9C,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxC,OAAO,OAAO;YACZ,CAAC,CAAC,qCAAqC,CAAC,KAAK,EAAE,OAAO,CAAC;YACvD,CAAC,CAAC,mCAAmC,CAAC,KAAK,CAAE,CAAC;IAClD,CAAC;CACF,CAAC,CACmB,CAAC"}
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../../src/identity/marketplace/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,GAGxB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAEpE,OAAO,EACL,+BAA+B,GAEhC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,GAErB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAqB3D,SAAS,kBAAkB,CACzB,KAAiD;IAEjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EACJ,IAAI,EACJ,MAAM,EAAE,MAAM,EACd,aAAa,EACb,aAAa,EAAE,cAAc,EAC7B,GAAG,IAAI,EACR,GAAG,KAAK,CAAC;IACV,OAAO;QACL,GAAG,IAAI;QACP,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CACnD,WAAsC,EACtC,OAAO,GAAsC,EAAE;IAE/C,MAAM,aAAa,GACjB,OAAO,CAAC,KAAK,EAAE,aAAa,IAAI,2BAA2B,CAAC;IAC9D,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAEhD,OAAO,+BAA+B,CAAC;QACrC,WAAW,EAAE,sBAAsB,CAAC,WAAW,CAAC;QAChD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,cAAc,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC/C,mBAAmB,EAAE,wBAAwB;QAC7C,mBAAmB;YACjB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBACvD,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,mBAAmB;YACvB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;gBACjC,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;aACjB,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,GAAG,WAAW,CAAC,WAAW,sCAAsC,CACjE,CAAC;YACJ,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC9B,uBAAuB,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC;QAChD,kBAAkB,EAChB,GAAG,WAAW,CAAC,WAAW,mCAAmC;YAC7D,oBAAoB,WAAW,CAAC,WAAW,sCAAsC;QACnF,qBAAqB,EAAE,IAAI;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAC9C,4BAA4B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,qCAAqC,CAAC,KAAK,CAAC,CAC7C,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAuB,MAAM,CAAC,WAAW,CACtE,4BAA4B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;IACjD,KAAK,CAAC,EAAE;IACR,CAAC,OAA2C,EAAE,EAAE;QAC9C,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxC,OAAO,OAAO;YACZ,CAAC,CAAC,qCAAqC,CAAC,KAAK,EAAE,OAAO,CAAC;YACvD,CAAC,CAAC,mCAAmC,CAAC,KAAK,CAAE,CAAC;IAClD,CAAC;CACF,CAAC,CACmB,CAAC"}

package/dist/identity/microsoft/connect-http.d.ts

@@ -1,33 +1,32 @@
 /**
- * Connect-with-Microsoft — thin adapter over {@link createFleetIntegrationConnectProvider}.
+ * Connect-with-Microsoft — thin adapter over {@link defineFleetIntegrationConnect}.
  *
  * Mounted under `/identity/microsoft/*` when listed on `identity.connect`, or
  * inferred from declared Microsoft toolserver connectors on a user-scoped
  * deployment.
  */
-import type { IdentityConnectMountContext, IdentityConnectProvider } from "../connect-provider-types.js";
-import { type FleetIntegrationConnectProviderOptions } from "../fleet-integration-connect.js";
+import type { FleetIntegrationConnectProviderOptions } from "../fleet-integration-connect.js";
 export declare const MICROSOFT_CONNECT_STATUS_PATH: string;
 export declare const MICROSOFT_CONNECT_START_PATH: string;
 export declare const MICROSOFT_CONNECT_CALLBACK_PATH: string;
 export declare const MICROSOFT_CONNECT_LINK_PATH: string;
-export declare function isMicrosoftActorSubjectEnabled(): boolean;
-export declare function enableMicrosoftActorSubject(): void;
+export declare const isMicrosoftActorSubjectEnabled: () => boolean;
+export declare const enableMicrosoftActorSubject: () => void;
 /**
  * Enable actor-subject mode when Microsoft connectors imply per-user vault subjects.
  *
  * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
  */
-export declare function enableMicrosoftActorSubjectFromConnectors(connectorKinds: readonly (string | undefined)[] | undefined, scope?: IdentityConnectMountContext["scope"]): void;
-export declare function resetMicrosoftActorSubjectEnabledForTests(): void;
-export declare function isMicrosoftConnectConfigured(env?: NodeJS.ProcessEnv): boolean;
-export declare function microsoftConnectUrl(publicAppUrl: string): string;
+export declare const enableMicrosoftActorSubjectFromConnectors: (connectorKinds: readonly (string | undefined)[] | undefined, scope?: import("../connect-provider-types.js").IdentityConnectMountContext["scope"]) => void;
+export declare const resetMicrosoftActorSubjectEnabledForTests: () => void;
+export declare const isMicrosoftConnectConfigured: (env?: NodeJS.ProcessEnv) => boolean;
+export declare const microsoftConnectUrl: (publicAppUrl: string) => string;
 /** Options for {@link createMicrosoftIdentityConnectProvider}. */
 export type MicrosoftIdentityConnectProviderOptions = FleetIntegrationConnectProviderOptions;
 /** Build a Microsoft connect provider. */
-export declare function createMicrosoftIdentityConnectProvider(options?: MicrosoftIdentityConnectProviderOptions): IdentityConnectProvider;
+export declare const createMicrosoftIdentityConnectProvider: (options?: FleetIntegrationConnectProviderOptions) => import("../connect-provider-types.js").IdentityConnectProvider;
 /** Default Microsoft connect provider used as a built-in mount candidate. */
-export declare const microsoftIdentityConnectProvider: IdentityConnectProvider;
+export declare const microsoftIdentityConnectProvider: import("../connect-provider-types.js").IdentityConnectProvider;
 /**
  * Opt into Connect-with-Microsoft on `defineIdentity({ connect: […] })`.
  *
@@ -35,5 +34,5 @@ export declare const microsoftIdentityConnectProvider: IdentityConnectProvider;
  * user-scoped identity deployment mounts this provider and derives OAuth
  * scopes automatically.
  */
-export declare function connect(options?: MicrosoftIdentityConnectProviderOptions): IdentityConnectProvider;
+export declare const connect: (options?: FleetIntegrationConnectProviderOptions) => import("../connect-provider-types.js").IdentityConnectProvider;
 //# sourceMappingURL=connect-http.d.ts.map

package/dist/identity/microsoft/connect-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/microsoft/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAIL,KAAK,sCAAsC,EAC5C,MAAM,iCAAiC,CAAC;AAKzC,eAAO,MAAM,6BAA6B,QAAe,CAAC;AAC1D,eAAO,MAAM,4BAA4B,QAAgB,CAAC;AAC1D,eAAO,MAAM,+BAA+B,QAAiB,CAAC;AAC9D,eAAO,MAAM,2BAA2B,QAAa,CAAC;AAEtD,wBAAgB,8BAA8B,IAAI,OAAO,CAExD;AAED,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED;;;;GAIG;AACH,wBAAgB,yCAAyC,CACvD,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC3C,IAAI,CAMN;AAED,wBAAgB,yCAAyC,IAAI,IAAI,CAEhE;AAED,wBAAgB,4BAA4B,CAC1C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET;AAED,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,kEAAkE;AAClE,MAAM,MAAM,uCAAuC,GACjD,sCAAsC,CAAC;AAEzC,0CAA0C;AAC1C,wBAAgB,sCAAsC,CACpD,OAAO,GAAE,uCAA4C,GACpD,uBAAuB,CAMzB;AAED,6EAA6E;AAC7E,eAAO,MAAM,gCAAgC,EAAE,uBACL,CAAC;AAE3C;;;;;;GAMG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,uCAAuC,GAChD,uBAAuB,CAKzB"}
+{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/microsoft/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAC;AAQ9F,eAAO,MAAM,6BAA6B,QAAyB,CAAC;AACpE,eAAO,MAAM,4BAA4B,QAA0B,CAAC;AACpE,eAAO,MAAM,+BAA+B,QAA2B,CAAC;AACxE,eAAO,MAAM,2BAA2B,QAAuB,CAAC;AAEhE,eAAO,MAAM,8BAA8B,eAAkC,CAAC;AAC9E,eAAO,MAAM,2BAA2B,YAA+B,CAAC;AACxE;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,4JACV,CAAC;AAC7C,eAAO,MAAM,yCAAyC,YACV,CAAC;AAC7C,eAAO,MAAM,4BAA4B,sCAAgC,CAAC;AAC1E,eAAO,MAAM,mBAAmB,kCAAuB,CAAC;AAExD,kEAAkE;AAClE,MAAM,MAAM,uCAAuC,GACjD,sCAAsC,CAAC;AAEzC,0CAA0C;AAC1C,eAAO,MAAM,sCAAsC,sHAA2B,CAAC;AAE/E,6EAA6E;AAC7E,eAAO,MAAM,gCAAgC,gEAAqB,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,sHAAoB,CAAC"}

package/dist/identity/microsoft/connect-http.js

@@ -1,49 +1,36 @@
 /**
- * Connect-with-Microsoft — thin adapter over {@link createFleetIntegrationConnectProvider}.
+ * Connect-with-Microsoft — thin adapter over {@link defineFleetIntegrationConnect}.
  *
  * Mounted under `/identity/microsoft/*` when listed on `identity.connect`, or
  * inferred from declared Microsoft toolserver connectors on a user-scoped
  * deployment.
  */
 import { MICROSOFT_INTEGRATION } from "../../connectors/toolserver/integrations.js";
-import { enableActorSubjectIntegration, enableActorSubjectIntegrationFromConnectors, isActorSubjectIntegrationEnabled, resetActorSubjectEnabledForTests, } from "../actor-subject.js";
-import { identityConnectPaths } from "../connect-paths.js";
-import { createFleetIntegrationConnectProvider, fleetIntegrationConnectUrl, isFleetIntegrationConnectConfigured, } from "../fleet-integration-connect.js";
+import { defineFleetIntegrationConnect } from "../define-fleet-connect.js";
 import { microsoftByoOauth } from "./oauth.js";
-const PATHS = identityConnectPaths("microsoft");
-export const MICROSOFT_CONNECT_STATUS_PATH = PATHS.status;
-export const MICROSOFT_CONNECT_START_PATH = PATHS.connect;
-export const MICROSOFT_CONNECT_CALLBACK_PATH = PATHS.callback;
-export const MICROSOFT_CONNECT_LINK_PATH = PATHS.link;
-export function isMicrosoftActorSubjectEnabled() {
-    return isActorSubjectIntegrationEnabled("microsoft");
-}
-export function enableMicrosoftActorSubject() {
-    enableActorSubjectIntegration("microsoft");
-}
+const microsoft = defineFleetIntegrationConnect({
+    integration: MICROSOFT_INTEGRATION,
+    byoClient: microsoftByoOauth,
+});
+export const MICROSOFT_CONNECT_STATUS_PATH = microsoft.paths.status;
+export const MICROSOFT_CONNECT_START_PATH = microsoft.paths.connect;
+export const MICROSOFT_CONNECT_CALLBACK_PATH = microsoft.paths.callback;
+export const MICROSOFT_CONNECT_LINK_PATH = microsoft.paths.link;
+export const isMicrosoftActorSubjectEnabled = microsoft.isActorSubjectEnabled;
+export const enableMicrosoftActorSubject = microsoft.enableActorSubject;
 /**
  * Enable actor-subject mode when Microsoft connectors imply per-user vault subjects.
  *
  * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
  */
-export function enableMicrosoftActorSubjectFromConnectors(connectorKinds, scope) {
-    enableActorSubjectIntegrationFromConnectors(MICROSOFT_INTEGRATION, connectorKinds, scope);
-}
-export function resetMicrosoftActorSubjectEnabledForTests() {
-    resetActorSubjectEnabledForTests();
-}
-export function isMicrosoftConnectConfigured(env = process.env) {
-    return isFleetIntegrationConnectConfigured(microsoftByoOauth, env);
-}
-export function microsoftConnectUrl(publicAppUrl) {
-    return fleetIntegrationConnectUrl(MICROSOFT_INTEGRATION, publicAppUrl);
-}
+export const enableMicrosoftActorSubjectFromConnectors = microsoft.enableActorSubjectFromConnectors;
+export const resetMicrosoftActorSubjectEnabledForTests = microsoft.resetActorSubjectEnabledForTests;
+export const isMicrosoftConnectConfigured = microsoft.isConnectConfigured;
+export const microsoftConnectUrl = microsoft.connectUrl;
 /** Build a Microsoft connect provider. */
-export function createMicrosoftIdentityConnectProvider(options = {}) {
-    return createFleetIntegrationConnectProvider(MICROSOFT_INTEGRATION, microsoftByoOauth, options);
-}
+export const createMicrosoftIdentityConnectProvider = microsoft.createProvider;
 /** Default Microsoft connect provider used as a built-in mount candidate. */
-export const microsoftIdentityConnectProvider = createMicrosoftIdentityConnectProvider();
+export const microsoftIdentityConnectProvider = microsoft.provider;
 /**
  * Opt into Connect-with-Microsoft on `defineIdentity({ connect: […] })`.
  *
@@ -51,10 +38,5 @@ export const microsoftIdentityConnectProvider = createMicrosoftIdentityConnectPr
  * user-scoped identity deployment mounts this provider and derives OAuth
  * scopes automatically.
  */
-export function connect(options) {
-    enableMicrosoftActorSubject();
-    return options
-        ? createMicrosoftIdentityConnectProvider(options)
-        : microsoftIdentityConnectProvider;
-}
+export const connect = microsoft.connect;
 //# sourceMappingURL=connect-http.js.map

package/dist/identity/microsoft/connect-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/microsoft/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EACL,6BAA6B,EAC7B,2CAA2C,EAC3C,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAK3D,OAAO,EACL,qCAAqC,EACrC,0BAA0B,EAC1B,mCAAmC,GAEpC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;AAEhD,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAK,CAAC,MAAM,CAAC;AAC1D,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC,OAAO,CAAC;AAC1D,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC9D,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC,IAAI,CAAC;AAEtD,MAAM,UAAU,8BAA8B;IAC5C,OAAO,gCAAgC,CAAC,WAAW,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,6BAA6B,CAAC,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yCAAyC,CACvD,cAA2D,EAC3D,KAA4C;IAE5C,2CAA2C,CACzC,qBAAqB,EACrB,cAAc,EACd,KAAK,CACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yCAAyC;IACvD,gCAAgC,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,mCAAmC,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,OAAO,0BAA0B,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC;AACzE,CAAC;AAMD,0CAA0C;AAC1C,MAAM,UAAU,sCAAsC,CACpD,OAAO,GAA4C,EAAE;IAErD,OAAO,qCAAqC,CAC1C,qBAAqB,EACrB,iBAAiB,EACjB,OAAO,CACR,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gCAAgC,GAC3C,sCAAsC,EAAE,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CACrB,OAAiD;IAEjD,2BAA2B,EAAE,CAAC;IAC9B,OAAO,OAAO;QACZ,CAAC,CAAC,sCAAsC,CAAC,OAAO,CAAC;QACjD,CAAC,CAAC,gCAAgC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/microsoft/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAE3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,SAAS,GAAG,6BAA6B,CAAC;IAC9C,WAAW,EAAE,qBAAqB;IAClC,SAAS,EAAE,iBAAiB;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;AACpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;AACpE,MAAM,CAAC,MAAM,+BAA+B,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;AACxE,MAAM,CAAC,MAAM,2BAA2B,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;AAEhE,MAAM,CAAC,MAAM,8BAA8B,GAAG,SAAS,CAAC,qBAAqB,CAAC;AAC9E,MAAM,CAAC,MAAM,2BAA2B,GAAG,SAAS,CAAC,kBAAkB,CAAC;AACxE;;;;GAIG;AACH,MAAM,CAAC,MAAM,yCAAyC,GACpD,SAAS,CAAC,gCAAgC,CAAC;AAC7C,MAAM,CAAC,MAAM,yCAAyC,GACpD,SAAS,CAAC,gCAAgC,CAAC;AAC7C,MAAM,CAAC,MAAM,4BAA4B,GAAG,SAAS,CAAC,mBAAmB,CAAC;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC,UAAU,CAAC;AAMxD,0CAA0C;AAC1C,MAAM,CAAC,MAAM,sCAAsC,GAAG,SAAS,CAAC,cAAc,CAAC;AAE/E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CAAC,QAAQ,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC"}

package/dist/identity/microsoft/oauth.d.ts

@@ -17,7 +17,7 @@ export declare const MICROSOFT_OAUTH_TOKEN_URL_ENV: string;
 export declare const MICROSOFT_OAUTH_USERINFO_URL_ENV: string;
 /** Microsoft-bound OAuth state / connect-ticket helpers. */
 export declare const microsoftOauthTickets: import("../oauth-tickets.js").OauthTickets;
-export declare const resolveMicrosoftOauthRedirectBase: typeof import("../byo-oauth.js").resolveSlackOauthRedirectBase;
+export declare const resolveMicrosoftOauthRedirectBase: typeof import("../oauth-env.js").resolveOauthRedirectBase;
 export declare const readMicrosoftOauthConfig: (env?: NodeJS.ProcessEnv) => ByoOauthConfig | null;
 export declare const buildMicrosoftAuthorizeUrl: (config: ByoOauthConfig, state: string, redirectUri: string, scopes?: string) => string;
 export declare const exchangeMicrosoftOauthCode: (config: ByoOauthConfig, code: string, redirectUri: string, fetchImpl?: typeof fetch) => Promise<import("../fleet-connect.js").FleetVaultByoTokenResult>;

package/dist/identity/microsoft/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/microsoft/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAElD,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AAqBnE,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,EAAE,cA2B9B,CAAC;AAEH,eAAO,MAAM,6BAA6B,QAAiC,CAAC;AAC5E,eAAO,MAAM,iCAAiC,QACV,CAAC;AACrC,eAAO,MAAM,0BAA0B,QAA+B,CAAC;AACvE,eAAO,MAAM,4BAA4B,QAAgC,CAAC;AAC1E,eAAO,MAAM,6BAA6B,QAAiC,CAAC;AAC5E,eAAO,MAAM,gCAAgC,QACV,CAAC;AAEpC,4DAA4D;AAC5D,eAAO,MAAM,qBAAqB,4CAA4B,CAAC;AAE/D,eAAO,MAAM,iCAAiC,gEACP,CAAC;AAExC,eAAO,MAAM,wBAAwB,oDAA+B,CAAC;AACrE,eAAO,MAAM,0BAA0B,yFAAsC,CAAC;AAC9E,eAAO,MAAM,0BAA0B,0JAAiC,CAAC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/microsoft/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAElD,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AAqBnE,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,EAAE,cA2B9B,CAAC;AAEH,eAAO,MAAM,6BAA6B,QAAiC,CAAC;AAC5E,eAAO,MAAM,iCAAiC,QACV,CAAC;AACrC,eAAO,MAAM,0BAA0B,QAA+B,CAAC;AACvE,eAAO,MAAM,4BAA4B,QAAgC,CAAC;AAC1E,eAAO,MAAM,6BAA6B,QAAiC,CAAC;AAC5E,eAAO,MAAM,gCAAgC,QACV,CAAC;AAEpC,4DAA4D;AAC5D,eAAO,MAAM,qBAAqB,4CAA4B,CAAC;AAE/D,eAAO,MAAM,iCAAiC,2DACP,CAAC;AAExC,eAAO,MAAM,wBAAwB,oDAA+B,CAAC;AACrE,eAAO,MAAM,0BAA0B,yFAAsC,CAAC;AAC9E,eAAO,MAAM,0BAA0B,0JAAiC,CAAC"}

package/dist/identity/oauth-env.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Shared deployment OAuth env keys and redirect-base resolution.
+ *
+ * Used by Slack OIDC, GitHub Connect, Fleet vault Connect, and BYO clients —
+ * not Slack-specific despite historical residence under `slack/oauth.ts`.
+ */
+export declare const MDA_PUBLIC_APP_URL_ENV = "MDA_PUBLIC_APP_URL";
+/**
+ * Public Agent Server base URL used for OAuth `redirect_uri`.
+ * Required on LangGraph Host where the ASGI request origin is an internal
+ * loopback (e.g. `http://localhost:5557`) rather than `*.langgraph.app`.
+ */
+export declare const MDA_PUBLIC_API_URL_ENV = "MDA_PUBLIC_API_URL";
+/**
+ * Signing key for OAuth `state` JWTs (Connect-with-X). Reuses the guest
+ * token key so deployments do not need a third secret; never a provider
+ * client secret (that value is an OAuth credential, not a signing key).
+ */
+export declare const OAUTH_STATE_SIGNING_KEY_ENV = "MDA_GUEST_SIGNING_KEY";
+/** Server-side key for OAuth state JWTs; null when Connect cannot bind actors. */
+export declare function readOauthStateSigningKey(env?: NodeJS.ProcessEnv): string | null;
+/**
+ * Public base URL for OAuth `redirect_uri` (`…/identity/{provider}/callback`).
+ *
+ * Prefer an explicit public Agent Server URL over the ASGI request origin:
+ * LangGraph Host rewrites requests to an internal loopback that IdPs cannot
+ * use as a redirect.
+ */
+export declare function resolveOauthRedirectBase(options: {
+    requestUrl: string;
+    headers?: Headers | {
+        get(name: string): string | null | undefined;
+    };
+    deploymentBaseUrl?: string;
+    env?: NodeJS.ProcessEnv;
+}): string;
+/**
+ * @deprecated Use {@link resolveOauthRedirectBase}. Kept for callers that still
+ * import the historical Slack-named alias.
+ */
+export declare const resolveSlackOauthRedirectBase: typeof resolveOauthRedirectBase;
+//# sourceMappingURL=oauth-env.d.ts.map

package/dist/identity/oauth-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-env.d.ts","sourceRoot":"","sources":["../../src/identity/oauth-env.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAC3D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAEnE,kFAAkF;AAClF,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAGf;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;KAAE,CAAC;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,CAcT;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,iCAA2B,CAAC"}

package/dist/identity/oauth-env.js

@@ -0,0 +1,65 @@
+/**
+ * Shared deployment OAuth env keys and redirect-base resolution.
+ *
+ * Used by Slack OIDC, GitHub Connect, Fleet vault Connect, and BYO clients —
+ * not Slack-specific despite historical residence under `slack/oauth.ts`.
+ */
+import { isLoopbackHost, isLoopbackUrl } from "./loopback.js";
+export const MDA_PUBLIC_APP_URL_ENV = "MDA_PUBLIC_APP_URL";
+/**
+ * Public Agent Server base URL used for OAuth `redirect_uri`.
+ * Required on LangGraph Host where the ASGI request origin is an internal
+ * loopback (e.g. `http://localhost:5557`) rather than `*.langgraph.app`.
+ */
+export const MDA_PUBLIC_API_URL_ENV = "MDA_PUBLIC_API_URL";
+/**
+ * Signing key for OAuth `state` JWTs (Connect-with-X). Reuses the guest
+ * token key so deployments do not need a third secret; never a provider
+ * client secret (that value is an OAuth credential, not a signing key).
+ */
+export const OAUTH_STATE_SIGNING_KEY_ENV = "MDA_GUEST_SIGNING_KEY";
+/** Server-side key for OAuth state JWTs; null when Connect cannot bind actors. */
+export function readOauthStateSigningKey(env = process.env) {
+    const key = env[OAUTH_STATE_SIGNING_KEY_ENV]?.trim();
+    return key || null;
+}
+/**
+ * Public base URL for OAuth `redirect_uri` (`…/identity/{provider}/callback`).
+ *
+ * Prefer an explicit public Agent Server URL over the ASGI request origin:
+ * LangGraph Host rewrites requests to an internal loopback that IdPs cannot
+ * use as a redirect.
+ */
+export function resolveOauthRedirectBase(options) {
+    const env = options.env ?? process.env;
+    if (options.deploymentBaseUrl?.trim()) {
+        return options.deploymentBaseUrl.trim().replace(/\/$/, "");
+    }
+    const fromEnv = env[MDA_PUBLIC_API_URL_ENV]?.trim().replace(/\/$/, "");
+    if (fromEnv && !isLoopbackUrl(fromEnv)) {
+        return fromEnv;
+    }
+    const forwarded = publicOriginFromForwardedHeaders(options.headers);
+    if (forwarded) {
+        return forwarded;
+    }
+    return new URL(options.requestUrl).origin;
+}
+/**
+ * @deprecated Use {@link resolveOauthRedirectBase}. Kept for callers that still
+ * import the historical Slack-named alias.
+ */
+export const resolveSlackOauthRedirectBase = resolveOauthRedirectBase;
+function publicOriginFromForwardedHeaders(headers) {
+    if (!headers) {
+        return undefined;
+    }
+    const host = headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+    if (!host || isLoopbackHost(host)) {
+        return undefined;
+    }
+    const proto = headers.get("x-forwarded-proto")?.split(",")[0]?.trim() ||
+        (host.includes("localhost") || host.startsWith("127.") ? "http" : "https");
+    return `${proto}://${host}`;
+}
+//# sourceMappingURL=oauth-env.js.map

package/dist/identity/oauth-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-env.js","sourceRoot":"","sources":["../../src/identity/oauth-env.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9D,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAC3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAC;AAEnE,kFAAkF;AAClF,MAAM,UAAU,wBAAwB,CACtC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC;IACrD,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAKxC;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,IAAI,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,CAAC;QACtC,OAAO,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvE,IAAI,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,SAAS,GAAG,gCAAgC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,wBAAwB,CAAC;AAEtE,SAAS,gCAAgC,CACvC,OAAoE;IAEpE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GACT,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACvD,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7E,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;AAC9B,CAAC"}

package/dist/identity/options.d.ts

@@ -24,12 +24,12 @@ export type IdentityAuth = "backend" | ValidatedTokenProvider | ValidatedTokenPr
  * The isolation boundary for the deployment — the one decision most projects
  * make about identity.
  *
- * - `"user"` (default) — every caller gets private threads, private memory, and
- *   acts as themselves downstream.
+ * - `"agent"` (default) — one shared memory slice; the agent acts as itself
+ *   with the shared LangSmith vault (`mda connect` / Settings → Integrations).
+ * - `"user"` — every caller gets private threads, private memory, and acts as
+ *   themselves downstream (per-caller Connect-with-X).
  * - `"organization"` — callers belong to customer organizations; memory is
  *   shared within an organization and callers must present one.
- * - `"agent"` — no per-caller isolation; one shared memory slice, the agent acts
- *   as itself. Machine-to-machine deployments.
  * - `"none"` — no durable memory and no downstream credentials.
  */
 export type IdentityScope = "user" | "organization" | "agent" | "none";
@@ -38,7 +38,7 @@ export type IdentityScope = "user" | "organization" | "agent" | "none";
  * {@link IdentityScope}. Anything left unset follows `default`.
  */
 export interface IdentityScopeOverrides {
-    /** Base scope the unset axes follow. Defaults to `"user"`. */
+    /** Base scope the unset axes follow. Defaults to `"agent"`. */
     default?: IdentityScope;
     /** Who can open or resume a conversation. */
     threads?: ThreadScope;
@@ -55,10 +55,23 @@ export interface IdentityScopeOverrides {
 export interface IdentityOptions {
     /** How callers authenticate. Defaults to `"backend"`. */
     auth?: IdentityAuth;
-    /** The isolation boundary, or per-axis overrides. Defaults to `"user"`. */
+    /** The isolation boundary, or per-axis overrides. Defaults to `"agent"`. */
     scope?: IdentityScope | IdentityScopeOverrides;
-    /** Whether callers must present an organization. Inferred from `scope`. */
-    organizations?: OrganizationRequirement;
+    /**
+     * Whether every caller must present an organization id.
+     *
+     * Inferred from `scope`: any axis set to `"organization"` → `"required"`,
+     * otherwise `"optional"`. Set this explicitly only when you need org
+     * partitioning without org-scoped memory — for example private per-user
+     * memory namespaced by customer org:
+     *
+     * ```ts
+     * defineIdentity({ scope: "user", organization: "required" })
+     * ```
+     *
+     * Cannot be `"optional"` when an axis is organization-scoped.
+     */
+    organization?: OrganizationRequirement;
     /**
      * Mint your own downstream credentials per caller. Providing this puts the
      * credentials axis in custom mode — there is no separate flag to set.

package/dist/identity/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,OAAO,KAAK,EACV,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,WAAW,EACX,uBAAuB,EACvB,WAAW,EACX,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,sBAAsB,GACtB,sBAAsB,EAAE,CAAC;AAE7B;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,cAAc,GAAG,OAAO,GAAG,MAAM,CAAC;AAEvE;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,8DAA8D;IAC9D,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,wCAAwC;IACxC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED,uDAAuD;AACvD,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,aAAa,GAAG,sBAAsB,CAAC;IAC/C,2EAA2E;IAC3E,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,wBAAwB,GAAG,mBAAmB,CAAC;IAC7D;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAoCD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,GAAE,eAAoB,GAC5B,cAAc,CAsBhB"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,OAAO,KAAK,EACV,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,WAAW,EACX,uBAAuB,EACvB,WAAW,EACX,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,sBAAsB,GACtB,sBAAsB,EAAE,CAAC;AAE7B;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,cAAc,GAAG,OAAO,GAAG,MAAM,CAAC;AAEvE;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,+DAA+D;IAC/D,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,wCAAwC;IACxC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED,uDAAuD;AACvD,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,aAAa,GAAG,sBAAsB,CAAC;IAC/C;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,uBAAuB,CAAC;IACvC;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,wBAAwB,GAAG,mBAAmB,CAAC;IAC7D;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAoCD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,GAAE,eAAoB,GAC5B,cAAc,CAsBhB"}

package/dist/identity/options.js

@@ -52,11 +52,11 @@ const CREDENTIAL_SCOPES = [
 export function normalizeIdentity(options = {}) {
     assertOptionKeys(options);
     const scope = resolveScope(options);
-    const organizations = options.organizations ?? inferOrganizationRequirement(scope);
-    assertOrganizationRequirement(options.organizations, scope, organizations);
+    const organization = options.organization ?? inferOrganizationRequirement(scope);
+    assertOrganizationRequirement(options.organization, scope, organization);
     const config = {
         ingress: { http: resolveIngress(options.auth) },
-        organizations,
+        organization,
         scope,
     };
     if (options.credentials !== undefined) {
@@ -79,9 +79,9 @@ function resolveIngress(auth) {
     return { mode: "validated_token", providers };
 }
 function resolveScope(options) {
-    const scope = options.scope ?? "user";
+    const scope = options.scope ?? "agent";
     const overrides = typeof scope === "string" ? { default: scope } : scope;
-    const base = SCOPE_AXES[overrides.default ?? "user"];
+    const base = SCOPE_AXES[overrides.default ?? "agent"];
     if (base === undefined) {
         throw new Error(`defineIdentity(...) unknown \`scope\` "${String(overrides.default)}". ` +
             `Valid scopes: ${Object.keys(SCOPE_AXES).join(", ")}.`);
@@ -125,11 +125,11 @@ function assertOrganizationRequirement(declared, scope, resolved) {
     if (declared !== undefined &&
         declared !== "optional" &&
         declared !== "required") {
-        throw new Error(`defineIdentity(...) \`organizations\` must be "optional" or "required" (received "${String(declared)}").`);
+        throw new Error(`defineIdentity(...) \`organization\` must be "optional" or "required" (received "${String(declared)}").`);
     }
     if (resolved === "optional" &&
         inferOrganizationRequirement(scope) === "required") {
-        throw new Error('defineIdentity(...) organization-scoped isolation requires `organizations: "required"`.');
+        throw new Error('defineIdentity(...) organization-scoped isolation requires `organization: "required"`.');
     }
 }
 /**
@@ -155,7 +155,7 @@ function resolveConnect(options) {
 const KNOWN_OPTION_KEYS = new Set([
     "auth",
     "scope",
-    "organizations",
+    "organization",
     "credentials",
     "connect",
 ]);

package/dist/identity/options.js.map

@@ -1 +1 @@
-{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AA4FvE;;;;GAIG;AACH,MAAM,UAAU,GAAmD;IACjE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE;IAC9D,YAAY,EAAE;QACZ,OAAO,EAAE,MAAM;QACf,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,MAAM;KACpB;IACD,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;IACjE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE;CAC/D,CAAC;AAEF,MAAM,aAAa,GAA2B;IAC5C,MAAM;IACN,cAAc;IACd,cAAc;CACf,CAAC;AACF,MAAM,aAAa,GAA2B;IAC5C,MAAM;IACN,cAAc;IACd,OAAO;IACP,MAAM;CACP,CAAC;AACF,MAAM,iBAAiB,GAA+B;IACpD,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;CACT,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAO,GAAoB,EAAE;IAE7B,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE1B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa,IAAI,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC/D,6BAA6B,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAmB;QAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QAC/C,aAAa;QACb,KAAK;KACN,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAC3C,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CACrB,IAA8B;IAE9B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,sDAAsD,CAC1G,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,OAAwB;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC;IACtC,MAAM,SAAS,GACb,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK;YACtE,iBAAiB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC;IAC1E,MAAM,MAAM,GACV,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;IACvE,0EAA0E;IAC1E,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,KAAK,SAAS;QAC/B,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,WAAW,CAAC;QAChD,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,WAAW,EAAE,iBAAiB,CAAC;YACpE,IAAI,CAAC,WAAW,CAAC,CAAC;IAExB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,UAAU,CACjB,IAAY,EACZ,KAAwB,EACxB,OAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,aAAa,MAAM,CAAC,KAAK,CAAC,KAAK;YACxE,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAC9B,QAAqC;IAErC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,yFAAyF,QAAQ,KAAK;YACpG,qFAAqF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wEAAwE;AACxE,SAAS,4BAA4B,CACnC,KAA8B;IAE9B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;AACjE,CAAC;AAED,SAAS,6BAA6B,CACpC,QAA6C,EAC7C,KAA8B,EAC9B,QAAiC;IAEjC,IACE,QAAQ,KAAK,SAAS;QACtB,QAAQ,KAAK,UAAU;QACvB,QAAQ,KAAK,UAAU,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qFAAqF,MAAM,CAAC,QAAQ,CAAC,KAAK,CAC3G,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,KAAK,UAAU;QACvB,4BAA4B,CAAC,KAAK,CAAC,KAAK,UAAU,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,OAAwB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC1B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM;IACN,OAAO;IACP,eAAe;IACf,aAAa;IACb,SAAS;CACV,CAAC,CAAC;AAEH;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAwB;IAChD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CACzC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CACrC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC9D,kBAAkB,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAyGvE;;;;GAIG;AACH,MAAM,UAAU,GAAmD;IACjE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE;IAC9D,YAAY,EAAE;QACZ,OAAO,EAAE,MAAM;QACf,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,MAAM;KACpB;IACD,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;IACjE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE;CAC/D,CAAC;AAEF,MAAM,aAAa,GAA2B;IAC5C,MAAM;IACN,cAAc;IACd,cAAc;CACf,CAAC;AACF,MAAM,aAAa,GAA2B;IAC5C,MAAM;IACN,cAAc;IACd,OAAO;IACP,MAAM;CACP,CAAC;AACF,MAAM,iBAAiB,GAA+B;IACpD,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;CACT,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAO,GAAoB,EAAE;IAE7B,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE1B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,IAAI,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC9D,6BAA6B,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAEzE,MAAM,MAAM,GAAmB;QAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QAC/C,YAAY;QACZ,KAAK;KACN,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAC3C,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CACrB,IAA8B;IAE9B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,sDAAsD,CAC1G,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,OAAwB;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC;IACvC,MAAM,SAAS,GACb,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK;YACtE,iBAAiB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC;IAC1E,MAAM,MAAM,GACV,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;IACvE,0EAA0E;IAC1E,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,KAAK,SAAS;QAC/B,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,WAAW,CAAC;QAChD,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,WAAW,EAAE,iBAAiB,CAAC;YACpE,IAAI,CAAC,WAAW,CAAC,CAAC;IAExB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,UAAU,CACjB,IAAY,EACZ,KAAwB,EACxB,OAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,aAAa,MAAM,CAAC,KAAK,CAAC,KAAK;YACxE,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAC9B,QAAqC;IAErC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,yFAAyF,QAAQ,KAAK;YACpG,qFAAqF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wEAAwE;AACxE,SAAS,4BAA4B,CACnC,KAA8B;IAE9B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;AACjE,CAAC;AAED,SAAS,6BAA6B,CACpC,QAA6C,EAC7C,KAA8B,EAC9B,QAAiC;IAEjC,IACE,QAAQ,KAAK,SAAS;QACtB,QAAQ,KAAK,UAAU;QACvB,QAAQ,KAAK,UAAU,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oFAAoF,MAAM,CAAC,QAAQ,CAAC,KAAK,CAC1G,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,KAAK,UAAU;QACvB,4BAA4B,CAAC,KAAK,CAAC,KAAK,UAAU,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,OAAwB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC1B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM;IACN,OAAO;IACP,cAAc;IACd,aAAa;IACb,SAAS;CACV,CAAC,CAAC;AAEH;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAwB;IAChD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CACzC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CACrC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC9D,kBAAkB,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/identity/slack/connect-http.js

@@ -4,7 +4,7 @@
  * Mounted under `/identity/slack/*` when listed on `identity.connect`.
  */
 import { buildIdentityLinkRecord, getIdentityLinkStore, } from "./links.js";
-import { buildSlackAuthorizeUrl, exchangeSlackOidcCode, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, readSlackOidcConfig, resolveSlackOauthRedirectBase, slackOauthTickets, } from "./oauth.js";
+import { buildSlackAuthorizeUrl, exchangeSlackOidcCode, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, readSlackOidcConfig, resolveOauthRedirectBase, slackOauthTickets, } from "./oauth.js";
 import { identityConnectPaths } from "../connect-paths.js";
 import { hasChannelForProvider, isUserScopedDeployment, } from "../connect-inference.js";
 const PATHS = identityConnectPaths("slack");
@@ -82,7 +82,7 @@ export function createSlackIdentityConnectProvider(options = {}) {
             await store().removeByUserId(userId);
         },
         resolveRedirectBase(options) {
-            return resolveSlackOauthRedirectBase(options);
+            return resolveOauthRedirectBase(options);
         },
         resolvePublicAppUrl() {
             const oauth = readSlackOidcConfig();

package/dist/identity/slack/connect-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,GAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,MAAM,CAAC;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,OAAO,CAAC;AACtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC;AAOlD,mEAAmE;AACnE,MAAM,UAAU,kCAAkC,CAChD,OAAO,GAAwC,EAAE;IAEjD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,oBAAoB,EAAE,CAAC;IAEhE,OAAO;QACL,EAAE,EAAE,OAAO;QACX,WAAW,CAAC,GAAgC;YAC1C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,wEAAwE;YACxE,qEAAqE;YACrE,gEAAgE;YAChE,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,KAAK;gBACtB,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC;oBAC3C,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC;gBACrB,GAAG,CAAC,IAAI;oBACN,CAAC,CAAC;wBACE,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,kGAAkG,2BAA2B,GAAG;iBACxI,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpE,OAAO;gBACL,YAAY,EAAE,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;aAChE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAC/C,KAAK,EACL,IAAI,EACJ,WAAW,CACZ,CAAC;YACF,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;YACpD,MAAM,MAAM,GAAG,uBAAuB,CAAC;gBACrC,MAAM;gBACN,WAAW,EAAE,aAAa,CAAC,MAAM;gBACjC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,2BAA2B;aAClE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,KAAK,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,mBAAmB,CAAC,OAA2C;YAC7D,OAAO,6BAA6B,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QACD,mBAAmB;YACjB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,OAAO,CACL,KAAK,EAAE,YAAY;gBACnB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,4BAA4B,GACvC,kCAAkC,EAAE,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CACrB,OAA6C;IAE7C,OAAO,OAAO;QACZ,CAAC,CAAC,kCAAkC,CAAC,OAAO,CAAC;QAC7C,CAAC,CAAC,4BAA4B,CAAC;AACnC,CAAC"}
+{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,GAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,MAAM,CAAC;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,OAAO,CAAC;AACtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC;AAOlD,mEAAmE;AACnE,MAAM,UAAU,kCAAkC,CAChD,OAAO,GAAwC,EAAE;IAEjD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,oBAAoB,EAAE,CAAC;IAEhE,OAAO;QACL,EAAE,EAAE,OAAO;QACX,WAAW,CAAC,GAAgC;YAC1C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,wEAAwE;YACxE,qEAAqE;YACrE,gEAAgE;YAChE,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,KAAK;gBACtB,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC;oBAC3C,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC;gBACrB,GAAG,CAAC,IAAI;oBACN,CAAC,CAAC;wBACE,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,kGAAkG,2BAA2B,GAAG;iBACxI,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpE,OAAO;gBACL,YAAY,EAAE,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;aAChE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAC/C,KAAK,EACL,IAAI,EACJ,WAAW,CACZ,CAAC;YACF,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;YACpD,MAAM,MAAM,GAAG,uBAAuB,CAAC;gBACrC,MAAM;gBACN,WAAW,EAAE,aAAa,CAAC,MAAM;gBACjC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,2BAA2B;aAClE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,KAAK,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,mBAAmB,CAAC,OAA2C;YAC7D,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,mBAAmB;YACjB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,OAAO,CACL,KAAK,EAAE,YAAY;gBACnB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,4BAA4B,GACvC,kCAAkC,EAAE,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CACrB,OAA6C;IAE7C,OAAO,OAAO;QACZ,CAAC,CAAC,kCAAkC,CAAC,OAAO,CAAC;QAC7C,CAAC,CAAC,4BAA4B,CAAC;AACnC,CAAC"}

package/dist/identity/slack/oauth.d.ts

@@ -1,22 +1,10 @@
 /**
  * Slack OpenID Connect helpers for Connect-with-Slack account linking.
  */
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, resolveOauthRedirectBase, resolveSlackOauthRedirectBase, } from "../oauth-env.js";
 export declare const SLACK_CLIENT_ID_ENV = "SLACK_CLIENT_ID";
 export declare const SLACK_CLIENT_SECRET_ENV = "SLACK_CLIENT_SECRET";
 export declare const SLACK_TEAM_ID_ENV = "SLACK_TEAM_ID";
-export declare const MDA_PUBLIC_APP_URL_ENV = "MDA_PUBLIC_APP_URL";
-/**
- * Public Agent Server base URL used for Slack OAuth `redirect_uri`.
- * Required on LangGraph Host where the ASGI request origin is an internal
- * loopback (e.g. `http://localhost:5557`) rather than `*.langgraph.app`.
- */
-export declare const MDA_PUBLIC_API_URL_ENV = "MDA_PUBLIC_API_URL";
-/**
- * Signing key for OAuth `state` JWTs (Connect-with-Slack). Reuses the guest
- * token key so deployments do not need a third secret; never the Slack
- * client secret (that value is an OAuth credential, not a signing key).
- */
-export declare const OAUTH_STATE_SIGNING_KEY_ENV = "MDA_GUEST_SIGNING_KEY";
 /** Override Slack OIDC base (tests). */
 export declare const SLACK_OIDC_BASE_ENV = "SLACK_OIDC_BASE";
 /** Slack-bound OAuth state / connect-ticket helpers. */
@@ -35,23 +23,6 @@ export interface SlackOidcIdentity {
 }
 export declare function readSlackOidcConfig(env?: NodeJS.ProcessEnv): SlackOidcConfig | null;
 export declare function slackConnectUrl(publicAppUrl: string): string;
-/**
- * Public base URL for Slack OAuth `redirect_uri` (`…/identity/slack/callback`).
- *
- * Prefer an explicit public Agent Server URL over the ASGI request origin:
- * LangGraph Host rewrites requests to an internal loopback that Slack cannot
- * use as a redirect.
- */
-export declare function resolveSlackOauthRedirectBase(options: {
-    requestUrl: string;
-    headers?: Headers | {
-        get(name: string): string | null | undefined;
-    };
-    deploymentBaseUrl?: string;
-    env?: NodeJS.ProcessEnv;
-}): string;
-/** Server-side key for OAuth state JWTs; null when Connect cannot bind actors. */
-export declare function readOauthStateSigningKey(env?: NodeJS.ProcessEnv): string | null;
 export declare function buildSlackAuthorizeUrl(config: SlackOidcConfig, state: string, redirectUri: string): string;
 export declare function exchangeSlackOidcCode(config: SlackOidcConfig, code: string, redirectUri: string): Promise<SlackOidcIdentity>;
 //# sourceMappingURL=oauth.d.ts.map

package/dist/identity/slack/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/oauth.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AACrD,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AACjD,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAC3D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAEnE,wCAAwC;AACxC,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAIrD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,4CAA2B,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,eAAe,GAAG,IAAI,CAmBxB;AAED,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;KAAE,CAAC;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,CAcT;AAkBD,kFAAkF;AAClF,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAGf;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,MAAM,CAWR;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,CAAC,CA4D5B"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/oauth.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AAEzB,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AACrD,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,wCAAwC;AACxC,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAIrD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,4CAA2B,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,mBAAmB,CACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,eAAe,GAAG,IAAI,CAmBxB;AAED,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,MAAM,CAWR;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,CAAC,CA4D5B"}

package/dist/identity/slack/oauth.js

@@ -2,24 +2,12 @@
  * Slack OpenID Connect helpers for Connect-with-Slack account linking.
  */
 import { fetchWithTimeout, PROVIDER_HTTP_TIMEOUT_MS, } from "../../runtime/http.js";
-import { isLoopbackHost, isLoopbackUrl } from "../loopback.js";
 import { oauthTicketsFor } from "../oauth-tickets.js";
+import { MDA_PUBLIC_APP_URL_ENV } from "../oauth-env.js";
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, resolveOauthRedirectBase, resolveSlackOauthRedirectBase, } from "../oauth-env.js";
 export const SLACK_CLIENT_ID_ENV = "SLACK_CLIENT_ID";
 export const SLACK_CLIENT_SECRET_ENV = "SLACK_CLIENT_SECRET";
 export const SLACK_TEAM_ID_ENV = "SLACK_TEAM_ID";
-export const MDA_PUBLIC_APP_URL_ENV = "MDA_PUBLIC_APP_URL";
-/**
- * Public Agent Server base URL used for Slack OAuth `redirect_uri`.
- * Required on LangGraph Host where the ASGI request origin is an internal
- * loopback (e.g. `http://localhost:5557`) rather than `*.langgraph.app`.
- */
-export const MDA_PUBLIC_API_URL_ENV = "MDA_PUBLIC_API_URL";
-/**
- * Signing key for OAuth `state` JWTs (Connect-with-Slack). Reuses the guest
- * token key so deployments do not need a third secret; never the Slack
- * client secret (that value is an OAuth credential, not a signing key).
- */
-export const OAUTH_STATE_SIGNING_KEY_ENV = "MDA_GUEST_SIGNING_KEY";
 /** Override Slack OIDC base (tests). */
 export const SLACK_OIDC_BASE_ENV = "SLACK_OIDC_BASE";
 const DEFAULT_OIDC_BASE = "https://slack.com";
@@ -45,45 +33,6 @@ export function readSlackOidcConfig(env = process.env) {
 export function slackConnectUrl(publicAppUrl) {
     return `${publicAppUrl.replace(/\/$/, "")}/settings`;
 }
-/**
- * Public base URL for Slack OAuth `redirect_uri` (`…/identity/slack/callback`).
- *
- * Prefer an explicit public Agent Server URL over the ASGI request origin:
- * LangGraph Host rewrites requests to an internal loopback that Slack cannot
- * use as a redirect.
- */
-export function resolveSlackOauthRedirectBase(options) {
-    const env = options.env ?? process.env;
-    if (options.deploymentBaseUrl?.trim()) {
-        return options.deploymentBaseUrl.trim().replace(/\/$/, "");
-    }
-    const fromEnv = env[MDA_PUBLIC_API_URL_ENV]?.trim().replace(/\/$/, "");
-    if (fromEnv && !isLoopbackUrl(fromEnv)) {
-        return fromEnv;
-    }
-    const forwarded = publicOriginFromForwardedHeaders(options.headers);
-    if (forwarded) {
-        return forwarded;
-    }
-    return new URL(options.requestUrl).origin;
-}
-function publicOriginFromForwardedHeaders(headers) {
-    if (!headers) {
-        return undefined;
-    }
-    const host = headers.get("x-forwarded-host")?.split(",")[0]?.trim();
-    if (!host || isLoopbackHost(host)) {
-        return undefined;
-    }
-    const proto = headers.get("x-forwarded-proto")?.split(",")[0]?.trim() ||
-        (host.includes("localhost") || host.startsWith("127.") ? "http" : "https");
-    return `${proto}://${host}`;
-}
-/** Server-side key for OAuth state JWTs; null when Connect cannot bind actors. */
-export function readOauthStateSigningKey(env = process.env) {
-    const key = env[OAUTH_STATE_SIGNING_KEY_ENV]?.trim();
-    return key || null;
-}
 export function buildSlackAuthorizeUrl(config, state, redirectUri) {
     const url = new URL(`${config.oidcBase}/openid/connect/authorize`);
     url.searchParams.set("response_type", "code");