managed-deepagents 0.5.0-dev.89 → 0.5.0-dev.96

package/dist/identity/options.d.ts

@@ -2,86 +2,27 @@
  * The `defineIdentity(...)` input, and its normalization into the resolved
  * {@link IdentityConfig}.
  *
- * Authors describe *what they want* — how callers authenticate, and what the
- * isolation boundary is — in two keys. Everything else the runtime needs is
- * derived here, so the resolved contract stays free to grow axes without the
- * authoring surface growing a knob per axis.
+ * Authors describe how callers authenticate. The runtime supplies the managed
+ * user-isolation policy, so credential ownership and Connect routing do not
+ * become authoring knobs. Durable memory is not an identity concern at all —
+ * it has its own root declaration in `memory.ts`.
  */
-import type { IdentityConnectProvider } from "./connect-provider-types.js";
-import type { CredentialResolverConfig, CredentialResolvers, CredentialScope, IdentityConfig, MemoryScope, MemoryScopeInput, ValidatedTokenProvider } from "./types.js";
+import type { IdentityConfig, LangSmithApiKeyIngress, ValidatedTokenProvider } from "./types.js";
 /**
  * How MDA learns who is calling.
  *
  * - `"backend"` — a backend you operate has already authenticated the caller and
  *   asserts the user id over the reserved ingress headers.
+ * - `auth.langsmithApiKey()` — MDA verifies a LangSmith workspace API key and
+ *   treats the result as a service identity.
  * - one or more `providers.*` entries — MDA verifies the caller's own token
  *   server-side (browser-direct).
  */
-export type IdentityAuth = "backend" | ValidatedTokenProvider | ValidatedTokenProvider[];
-/**
- * The isolation boundary for the deployment — the one decision most projects
- * make about identity.
- *
- * - `"agent"` (default) — shared agent memory only; the agent acts as itself
- *   with the shared LangSmith vault (`mda connect` / Settings → Integrations).
- * - `"user"` — private threads, per-caller credentials, and both agent
- *   (procedural) + user (personal) memory slices.
- * - `"none"` — no durable memory and no downstream credentials.
- */
-export type IdentityScope = "user" | "agent" | "none";
-/**
- * Per-axis overrides for authors whose deployment does not fit a single
- * {@link IdentityScope}. Anything left unset follows `default`.
- *
- * Threads are always user-owned; there is no `threads` override.
- */
-export interface IdentityScopeOverrides {
-    /** Base scope the unset axes follow. Defaults to `"agent"`. */
-    default?: IdentityScope;
-    /**
-     * Which memory slices a run may use.
-     *
-     * See {@link MemoryScopeInput}. Shorthand `"user"` means user-only; the
-     * identity shorthand `scope: "user"` expands to agent+user.
-     */
-    memory?: MemoryScopeInput;
-    /**
-     * Whose credentials downstream calls carry. `"custom"` is implied by
-     * `credentials`. `"user"` enables per-caller Connect; `"agent"` uses the
-     * shared LangSmith vault.
-     */
-    credentials?: CredentialScope;
-}
-/** The identity declaration. Every key is optional. */
+export type IdentityAuth = "backend" | LangSmithApiKeyIngress | ValidatedTokenProvider | ValidatedTokenProvider[];
+/** The identity declaration. Authentication must be chosen explicitly. */
 export interface IdentityOptions {
-    /** How callers authenticate. Defaults to `"backend"`. */
-    auth?: IdentityAuth;
-    /** The isolation boundary, or per-axis overrides. Defaults to `"agent"`. */
-    scope?: IdentityScope | IdentityScopeOverrides;
-    /**
-     * Mint your own downstream credentials per caller. Providing this puts the
-     * credentials axis in custom mode — there is no separate flag to set.
-     *
-     * Pass one resolver, or a map keyed by target name when the agent integrates
-     * several platforms:
-     *
-     * ```ts
-     * credentials: {
-     *   github: credentials.github({ read: ["user", "pat"] }),
-     *   jira: { resolve: mintJiraToken },
-     * }
-     * ```
-     */
-    credentials?: CredentialResolverConfig | CredentialResolvers;
-    /**
-     * Extra Connect-with-X providers to mount under `/identity/{id}/…`.
-     *
-     * Providers the deployment already implies are added automatically (a
-     * `connectors.github` declaration or `credentials.github(...)` chain that
-     * reads user tokens brings Connect-with-GitHub with it), so this is only
-     * needed for custom providers.
-     */
-    connect?: IdentityConnectProvider[];
+    /** How callers authenticate. */
+    auth: IdentityAuth;
 }
 /**
  * Derive the resolved {@link IdentityConfig} from the declared options.
@@ -90,6 +31,5 @@ export interface IdentityOptions {
  * `validateIdentity` accepts, so the errors that exist only to police two
  * fields agreeing with each other are unreachable from this path.
  */
-export declare function normalizeIdentity(options?: IdentityOptions): IdentityConfig;
-export type { MemoryScope, MemoryScopeInput };
+export declare function normalizeIdentity(options: IdentityOptions): IdentityConfig;
 //# sourceMappingURL=options.d.ts.map

package/dist/identity/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAG3E,OAAO,KAAK,EACV,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,sBAAsB,GACtB,sBAAsB,EAAE,CAAC;AAE7B;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,+DAA+D;IAC/D,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B;;;;OAIG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED,uDAAuD;AACvD,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,aAAa,GAAG,sBAAsB,CAAC;IAC/C;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,wBAAwB,GAAG,mBAAmB,CAAC;IAC7D;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AA0BD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,GAAE,eAAoB,GAC5B,cAAc,CAkBhB;AA6ID,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;GASG;AACH,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,sBAAsB,GACtB,sBAAsB,GACtB,sBAAsB,EAAE,CAAC;AAE7B,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,gCAAgC;IAChC,IAAI,EAAE,YAAY,CAAC;CACpB;AAYD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,eAAe,GAAG,cAAc,CAa1E"}

package/dist/identity/options.js

@@ -2,34 +2,20 @@
  * The `defineIdentity(...)` input, and its normalization into the resolved
  * {@link IdentityConfig}.
  *
- * Authors describe *what they want* — how callers authenticate, and what the
- * isolation boundary is — in two keys. Everything else the runtime needs is
- * derived here, so the resolved contract stays free to grow axes without the
- * authoring surface growing a knob per axis.
+ * Authors describe how callers authenticate. The runtime supplies the managed
+ * user-isolation policy, so credential ownership and Connect routing do not
+ * become authoring knobs. Durable memory is not an identity concern at all —
+ * it has its own root declaration in `memory.ts`.
  */
-import { credentialConnectProviders } from "./credential-resolvers.js";
-import { normalizeMemoryScope } from "./memory-slices.js";
-const AGENT_SLICE = { kind: "agent" };
-const USER_SLICE = { kind: "user" };
 /**
- * Axis defaults per {@link IdentityScope}.
+ * Managed identity keys downstream credentials on the caller.
  *
- * Pass a `credentials` resolver to opt into `"custom"`.
+ * Threads are always user-owned, and durable memory is declared by `memory.ts`,
+ * so credentials are the only axis left for identity to resolve.
  */
-const SCOPE_AXES = {
-    user: {
-        memory: [AGENT_SLICE, USER_SLICE],
-        credentials: "user",
-    },
-    agent: { memory: [AGENT_SLICE], credentials: "agent" },
-    none: { memory: [], credentials: "none" },
-};
-const CREDENTIAL_SCOPES = [
-    "user",
-    "agent",
-    "none",
-    "custom",
-];
+function managedUserScope() {
+    return { credentials: "user" };
+}
 /**
  * Derive the resolved {@link IdentityConfig} from the declared options.
  *
@@ -37,113 +23,53 @@ const CREDENTIAL_SCOPES = [
  * `validateIdentity` accepts, so the errors that exist only to police two
  * fields agreeing with each other are unreachable from this path.
  */
-export function normalizeIdentity(options = {}) {
+export function normalizeIdentity(options) {
     assertOptionKeys(options);
-    const scope = resolveScope(options);
-    const config = {
+    if (options.auth === undefined) {
+        throw new Error("defineIdentity(...) requires `auth`. Use auth.langsmithApiKey() for LangSmith workspace API keys.");
+    }
+    return {
         ingress: { http: resolveIngress(options.auth) },
-        scope,
+        scope: managedUserScope(),
     };
-    if (options.credentials !== undefined) {
-        config.credentials = options.credentials;
-    }
-    const connect = resolveConnect(options);
-    if (connect.length > 0) {
-        config.connect = connect;
-    }
-    return config;
 }
 function resolveIngress(auth) {
-    if (auth === undefined || auth === "backend") {
+    if (auth === "backend") {
         return "backend";
     }
     if (typeof auth === "string") {
-        throw new Error(`defineIdentity(...) unknown \`auth\` value "${auth}". Use "backend" or one or more providers.* entries.`);
+        throw new Error(`defineIdentity(...) unknown \`auth\` value "${auth}". Use "backend", auth.langsmithApiKey(), or one or more providers.* entries.`);
+    }
+    if (isLangSmithApiKeyAuth(auth)) {
+        return auth;
     }
     const providers = Array.isArray(auth) ? auth : [auth];
     return { mode: "validated_token", providers };
 }
-function resolveScope(options) {
-    const scope = options.scope ?? "agent";
-    const overrides = typeof scope === "string" ? { default: scope } : scope;
-    if (typeof scope !== "string" &&
-        scope !== null &&
-        typeof scope === "object") {
-        assertNoThreads(scope);
-    }
-    const base = SCOPE_AXES[overrides.default ?? "agent"];
-    if (base === undefined) {
-        throw new Error(`defineIdentity(...) unknown \`scope\` "${String(overrides.default)}". ` +
-            `Valid scopes: ${Object.keys(SCOPE_AXES).join(", ")}.`);
-    }
-    const memory = overrides.memory !== undefined
-        ? normalizeMemoryScope(overrides.memory)
-        : base.memory;
-    // A resolver is the declaration of custom mode; the axis follows from it.
-    const credentials = options.credentials !== undefined
-        ? requireCustomCompatible(overrides.credentials)
-        : (assertAxis("credentials", overrides.credentials, CREDENTIAL_SCOPES) ??
-            base.credentials);
-    return { memory, credentials };
-}
-function assertNoThreads(scope) {
-    if (!("threads" in scope)) {
-        return;
-    }
-    throw new Error("defineIdentity(...) `scope.threads` is not supported. " +
-        "Threads are always user-owned — omit `threads`.");
-}
-function assertAxis(axis, value, allowed) {
-    if (value === undefined) {
-        return undefined;
-    }
-    if (!allowed.includes(value)) {
-        throw new Error(`defineIdentity(...) unknown \`scope.${axis}\` value "${String(value)}". ` +
-            `Valid values: ${allowed.join(", ")}.`);
-    }
-    return value;
-}
-/**
- * A resolver plus an explicitly managed credentials owner is a genuine conflict
- * of intent (unlike a redundant `"custom"` sentinel), so it fails.
- */
-function requireCustomCompatible(declared) {
-    if (declared !== undefined && declared !== "custom") {
-        throw new Error(`defineIdentity(...) provides a \`credentials\` resolver but \`scope.credentials\` is "${declared}". ` +
-            "Drop `scope.credentials` (the resolver implies custom mode) or remove the resolver.");
-    }
-    return "custom";
+function isLangSmithApiKeyAuth(auth) {
+    return (!Array.isArray(auth) && "mode" in auth && auth.mode === "langsmith_api_key");
 }
-/**
- * Connect providers the deployment declared, plus the ones its credential
- * resolvers depend on. A resolver that reads per-user OAuth tokens needs a place
- * for the user to grant them, so the routes follow from the resolver rather than
- * from a second opt-in that has to agree with it.
- *
- * For a per-target map this unions across every entry, so a multi-platform
- * deployment gets each platform's routes without repeating any of them.
- */
-function resolveConnect(options) {
-    const declared = options.connect ?? [];
-    const required = credentialConnectProviders(options.credentials);
-    const out = [...declared];
-    for (const provider of required) {
-        if (!out.some((existing) => existing.id === provider.id)) {
-            out.push(provider);
-        }
-    }
-    return out;
-}
-const KNOWN_OPTION_KEYS = new Set(["auth", "scope", "credentials", "connect"]);
+const KNOWN_OPTION_KEYS = new Set(["auth"]);
 /**
  * Reject unknown keys so a typo fails loudly instead of being silently ignored.
  */
 function assertOptionKeys(options) {
     if (options === null || typeof options !== "object") {
-        throw new Error("defineIdentity(...) accepts an options object ({ auth, scope, … }) or no arguments.");
+        throw new Error("defineIdentity(...) requires an options object ({ auth }).");
+    }
+    // `scope` carried three different removals, so a bare "unknown option" would
+    // leave a migrator guessing which one they hit.
+    if ("scope" in options) {
+        throw new Error("defineIdentity(...) `scope` is no longer supported. Threads and " +
+            "downstream credentials are always per-caller, so there is nothing to " +
+            "declare. Durable memory has its own root declaration: export `memory` " +
+            'from `memory.ts` with `defineMemory({ scope: "agent" })`.');
     }
-    if ("organization" in options) {
-        throw new Error("defineIdentity(...) `organization` is not supported. Organization identity has been removed.");
+    // Connect-with-X is hidden for this release (#235), so say that rather than
+    // reporting `connect` as a typo.
+    if ("connect" in options) {
+        throw new Error("defineIdentity(...) `connect` is not available in this release. " +
+            "Connect-with-X providers cannot be declared yet.");
     }
     const unknown = Object.keys(options).filter((key) => !KNOWN_OPTION_KEYS.has(key));
     if (unknown.length > 0) {

package/dist/identity/options.js.map

@@ -1 +1 @@
-{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AA4F1D,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,OAAO,EAAW,CAAC;AAC/C,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,MAAM,EAAW,CAAC;AAE7C;;;;GAIG;AACH,MAAM,UAAU,GAAmD;IACjE,IAAI,EAAE;QACJ,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;QACjC,WAAW,EAAE,MAAM;KACpB;IACD,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE;IACtD,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE;CAC1C,CAAC;AAEF,MAAM,iBAAiB,GAA+B;IACpD,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;CACT,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAO,GAAoB,EAAE;IAE7B,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE1B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAEpC,MAAM,MAAM,GAAmB;QAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QAC/C,KAAK;KACN,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAC3C,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CACrB,IAA8B;IAE9B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,sDAAsD,CAC1G,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,OAAwB;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC;IACvC,MAAM,SAAS,GACb,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ,EACzB,CAAC;QACD,eAAe,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK;YACtE,iBAAiB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,SAAS,CAAC,MAAM,KAAK,SAAS;QAC5B,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC,MAAM,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAClB,0EAA0E;IAC1E,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,KAAK,SAAS;QAC/B,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,WAAW,CAAC;QAChD,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,WAAW,EAAE,iBAAiB,CAAC;YACpE,IAAI,CAAC,WAAW,CAAC,CAAC;IAExB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CACb,wDAAwD;QACtD,iDAAiD,CACpD,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,IAAY,EACZ,KAAwB,EACxB,OAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,aAAa,MAAM,CAAC,KAAK,CAAC,KAAK;YACxE,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAC9B,QAAqC;IAErC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,yFAAyF,QAAQ,KAAK;YACpG,qFAAqF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,OAAwB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC1B,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AAE/E;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAwB;IAChD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CACzC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CACrC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC9D,kBAAkB,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA8BH;;;;;GAKG;AACH,SAAS,gBAAgB;IACvB,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAwB;IACxD,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE1B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QAC/C,KAAK,EAAE,gBAAgB,EAAE;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAkB;IACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,+EAA+E,CACnI,CAAC;IACJ,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAsC;IAEtC,OAAO,CACL,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,CAC5E,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5C;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAwB;IAChD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,gDAAgD;IAChD,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,uEAAuE;YACvE,wEAAwE;YACxE,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,iCAAiC;IACjC,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,kDAAkD,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CACzC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CACrC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC9D,kBAAkB,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/identity/slack/connect-http.d.ts

@@ -1,7 +1,9 @@
 /**
  * Connect-with-Slack — {@link IdentityConnectProvider} for Slack OIDC linking.
  *
- * Mounted under `/identity/slack/*` when listed on `identity.connect`.
+ * Mounted under `/identity/slack/*` when listed on `identity.connect`, or when
+ * a Slack channel routes into a user-scoped / custom-credentials deployment
+ * (so Events can remap actors and tools can use per-caller tokens).
  */
 import type { IdentityConnectProvider } from "../connect-provider-types.js";
 import { type IdentityLinkStore } from "./links.js";

package/dist/identity/slack/connect-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAKV,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAC;AAmBpB,eAAO,MAAM,yBAAyB,QAAe,CAAC;AACtD,eAAO,MAAM,wBAAwB,QAAgB,CAAC;AACtD,eAAO,MAAM,2BAA2B,QAAiB,CAAC;AAC1D,eAAO,MAAM,uBAAuB,QAAa,CAAC;AAElD,8DAA8D;AAC9D,MAAM,WAAW,mCAAmC;IAClD,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAED,mEAAmE;AACnE,wBAAgB,kCAAkC,CAChD,OAAO,GAAE,mCAAwC,GAChD,uBAAuB,CA6FzB;AAED,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,EAAE,uBACL,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,mCAAmC,GAC5C,uBAAuB,CAIzB"}
+{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAKV,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAC;AAmBpB,eAAO,MAAM,yBAAyB,QAAe,CAAC;AACtD,eAAO,MAAM,wBAAwB,QAAgB,CAAC;AACtD,eAAO,MAAM,2BAA2B,QAAiB,CAAC;AAC1D,eAAO,MAAM,uBAAuB,QAAa,CAAC;AAElD,8DAA8D;AAC9D,MAAM,WAAW,mCAAmC;IAClD,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAED,mEAAmE;AACnE,wBAAgB,kCAAkC,CAChD,OAAO,GAAE,mCAAwC,GAChD,uBAAuB,CA6FzB;AAED,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,EAAE,uBACL,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,mCAAmC,GAC5C,uBAAuB,CAIzB"}

package/dist/identity/slack/connect-http.js

@@ -1,7 +1,9 @@
 /**
  * Connect-with-Slack — {@link IdentityConnectProvider} for Slack OIDC linking.
  *
- * Mounted under `/identity/slack/*` when listed on `identity.connect`.
+ * Mounted under `/identity/slack/*` when listed on `identity.connect`, or when
+ * a Slack channel routes into a user-scoped / custom-credentials deployment
+ * (so Events can remap actors and tools can use per-caller tokens).
  */
 import { buildIdentityLinkRecord, getIdentityLinkStore, } from "./links.js";
 import { buildSlackAuthorizeUrl, exchangeSlackOidcCode, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, readSlackOidcConfig, resolveOauthRedirectBase, slackOauthTickets, } from "./oauth.js";

package/dist/identity/slack/connect-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,GAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,MAAM,CAAC;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,OAAO,CAAC;AACtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC;AAOlD,mEAAmE;AACnE,MAAM,UAAU,kCAAkC,CAChD,OAAO,GAAwC,EAAE;IAEjD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,oBAAoB,EAAE,CAAC;IAEhE,OAAO;QACL,EAAE,EAAE,OAAO;QACX,WAAW,CAAC,GAAgC;YAC1C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,wEAAwE;YACxE,qEAAqE;YACrE,gEAAgE;YAChE,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,KAAK;gBACtB,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC;oBAC3C,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC;gBACrB,GAAG,CAAC,IAAI;oBACN,CAAC,CAAC;wBACE,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,kGAAkG,2BAA2B,GAAG;iBACxI,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpE,OAAO;gBACL,YAAY,EAAE,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;aAChE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAC/C,KAAK,EACL,IAAI,EACJ,WAAW,CACZ,CAAC;YACF,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;YACpD,MAAM,MAAM,GAAG,uBAAuB,CAAC;gBACrC,MAAM;gBACN,WAAW,EAAE,aAAa,CAAC,MAAM;gBACjC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,2BAA2B;aAClE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,KAAK,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,mBAAmB,CAAC,OAA2C;YAC7D,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,mBAAmB;YACjB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,OAAO,CACL,KAAK,EAAE,YAAY;gBACnB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,4BAA4B,GACvC,kCAAkC,EAAE,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CACrB,OAA6C;IAE7C,OAAO,OAAO;QACZ,CAAC,CAAC,kCAAkC,CAAC,OAAO,CAAC;QAC7C,CAAC,CAAC,4BAA4B,CAAC;AACnC,CAAC"}
+{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,GAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,MAAM,CAAC;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,OAAO,CAAC;AACtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC;AAOlD,mEAAmE;AACnE,MAAM,UAAU,kCAAkC,CAChD,OAAO,GAAwC,EAAE;IAEjD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,oBAAoB,EAAE,CAAC;IAEhE,OAAO;QACL,EAAE,EAAE,OAAO;QACX,WAAW,CAAC,GAAgC;YAC1C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,wEAAwE;YACxE,qEAAqE;YACrE,gEAAgE;YAChE,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,KAAK;gBACtB,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC;oBAC3C,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC;gBACrB,GAAG,CAAC,IAAI;oBACN,CAAC,CAAC;wBACE,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,kGAAkG,2BAA2B,GAAG;iBACxI,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpE,OAAO;gBACL,YAAY,EAAE,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;aAChE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAC/C,KAAK,EACL,IAAI,EACJ,WAAW,CACZ,CAAC;YACF,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;YACpD,MAAM,MAAM,GAAG,uBAAuB,CAAC;gBACrC,MAAM;gBACN,WAAW,EAAE,aAAa,CAAC,MAAM;gBACjC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,2BAA2B;aAClE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,KAAK,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,mBAAmB,CAAC,OAA2C;YAC7D,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,mBAAmB;YACjB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;YACpC,OAAO,CACL,KAAK,EAAE,YAAY;gBACnB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,4BAA4B,GACvC,kCAAkC,EAAE,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CACrB,OAA6C;IAE7C,OAAO,OAAO;QACZ,CAAC,CAAC,kCAAkC,CAAC,OAAO,CAAC;QAC7C,CAAC,CAAC,4BAA4B,CAAC;AACnC,CAAC"}

package/dist/identity/slack/links.d.ts

@@ -3,7 +3,8 @@
  *
  * Stored in the LangGraph Store under `["mda_identity_links"]`, with an
  * in-memory backend for unit tests. Slack Events look up `slack:T:U` before
- * invoke; the web Connect-with-Slack flow upserts after OIDC.
+ * invoke when Connect OIDC is configured; the web Connect-with-Slack flow
+ * upserts after OIDC.
  */
 import { Client } from "@langchain/langgraph-sdk";
 export declare const IDENTITY_LINKS_NAMESPACE: readonly ["mda_identity_links"];
@@ -46,7 +47,7 @@ export declare class LangGraphIdentityLinkStore implements IdentityLinkStore {
 export declare function setIdentityLinkStore(store: IdentityLinkStore | null): void;
 /** Resolve the process-default link store (in-memory until a Client is wired). */
 export declare function getIdentityLinkStore(): IdentityLinkStore;
-/** Build a Store-backed client when loopback + ingress secret are available. */
+/** Build a Store-backed client when a trusted loopback credential is available. */
 export declare function createLangGraphIdentityLinkStore(options?: {
     apiUrl?: string;
     apiKey?: string;

package/dist/identity/slack/links.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"links.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/links.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAWlD,eAAO,MAAM,wBAAwB,iCAAyC,CAAC;AAE/E,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACpE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAChE,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,sEAAsE;AACtE,qBAAa,yBAA0B,YAAW,iBAAiB;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;IACjE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAE1D,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAExE;IAEK,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAEpE;IAEK,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtD;IAEK,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOlD;CACF;AAED,6CAA6C;AAC7C,qBAAa,0BAA2B,YAAW,iBAAiB;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAEzC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAExE;IAEK,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAEpE;IAEK,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BtD;IAEK,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAalD;YAEa,OAAO;CAUtB;AAID,uDAAuD;AACvD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAE1E;AAED,kFAAkF;AAClF,wBAAgB,oBAAoB,IAAI,iBAAiB,CAOxD;AAED,gFAAgF;AAChF,wBAAgB,gCAAgC,CAC9C,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACzE,0BAA0B,GAAG,IAAI,CAiBnC;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,kBAAkB,CAWrB"}
+{"version":3,"file":"links.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/links.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAkBlD,eAAO,MAAM,wBAAwB,iCAAyC,CAAC;AAE/E,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACpE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAChE,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,sEAAsE;AACtE,qBAAa,yBAA0B,YAAW,iBAAiB;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;IACjE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAE1D,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAExE;IAEK,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAEpE;IAEK,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtD;IAEK,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOlD;CACF;AAED,6CAA6C;AAC7C,qBAAa,0BAA2B,YAAW,iBAAiB;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAEzC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAExE;IAEK,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAEpE;IAEK,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BtD;IAEK,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAalD;YAEa,OAAO;CAUtB;AAID,uDAAuD;AACvD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAE1E;AAED,kFAAkF;AAClF,wBAAgB,oBAAoB,IAAI,iBAAiB,CAOxD;AAED,mFAAmF;AACnF,wBAAgB,gCAAgC,CAC9C,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACzE,0BAA0B,GAAG,IAAI,CA+BnC;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,kBAAkB,CAWrB"}

package/dist/identity/slack/links.js

@@ -3,11 +3,12 @@
  *
  * Stored in the LangGraph Store under `["mda_identity_links"]`, with an
  * in-memory backend for unit tests. Slack Events look up `slack:T:U` before
- * invoke; the web Connect-with-Slack flow upserts after OIDC.
+ * invoke when Connect OIDC is configured; the web Connect-with-Slack flow
+ * upserts after OIDC.
  */
 import { Client } from "@langchain/langgraph-sdk";
-import { USER_HEADER, IDENTITY_LINKS_SERVICE_USER, IDENTITY_LINKS_STORE_PREFIX, INGRESS_SECRET_ENV, INGRESS_SECRET_HEADER, } from "../../runtime/auth.js";
-import { resolveLoopbackApiKey, resolveLoopbackApiUrl } from "../loopback.js";
+import { HANDOFF_SECRET_ENV, HANDOFF_SECRET_HEADER, USER_HEADER, IDENTITY_LINKS_SERVICE_USER, IDENTITY_LINKS_STORE_PREFIX, INGRESS_SECRET_ENV, INGRESS_SECRET_HEADER, LANGSMITH_API_KEY_ENV, } from "../../runtime/auth.js";
+import { isLoopbackUrl, resolveLoopbackApiKey, resolveLoopbackApiUrl, } from "../loopback.js";
 export const IDENTITY_LINKS_NAMESPACE = [IDENTITY_LINKS_STORE_PREFIX];
 /** In-memory store for tests (and as a process-local cache layer). */
 export class InMemoryIdentityLinkStore {
@@ -95,21 +96,37 @@ export function getIdentityLinkStore() {
         createLangGraphIdentityLinkStore() ?? new InMemoryIdentityLinkStore();
     return defaultStore;
 }
-/** Build a Store-backed client when loopback + ingress secret are available. */
+/** Build a Store-backed client when a trusted loopback credential is available. */
 export function createLangGraphIdentityLinkStore(options = {}) {
-    const ingressSecret = options.ingressSecret ?? process.env[INGRESS_SECRET_ENV];
-    if (!ingressSecret) {
-        return null;
-    }
+    const serverApiKey = process.env[LANGSMITH_API_KEY_ENV]?.trim();
+    const configuredHandoffSecret = process.env[HANDOFF_SECRET_ENV]?.trim();
+    const explicitIngressSecret = options.ingressSecret?.trim();
+    const configuredIngressSecret = explicitIngressSecret || process.env[INGRESS_SECRET_ENV]?.trim();
     const apiUrl = resolveLoopbackApiUrl(options.apiUrl);
     const apiKey = resolveLoopbackApiKey(options.apiKey);
+    const isLocal = isLoopbackUrl(apiUrl);
+    const handoffSecret = isLocal ? configuredHandoffSecret : undefined;
+    const ingressSecret = isLocal ? configuredIngressSecret : undefined;
+    const usesServerApiKey = Boolean(serverApiKey && apiKey === serverApiKey);
+    if (!usesServerApiKey && !handoffSecret && !ingressSecret) {
+        return null;
+    }
+    const defaultHeaders = {
+        [USER_HEADER]: IDENTITY_LINKS_SERVICE_USER,
+    };
+    if (!usesServerApiKey && explicitIngressSecret && ingressSecret) {
+        defaultHeaders[INGRESS_SECRET_HEADER] = ingressSecret;
+    }
+    else if (handoffSecret) {
+        defaultHeaders[HANDOFF_SECRET_HEADER] = handoffSecret;
+    }
+    else if (!usesServerApiKey && ingressSecret) {
+        defaultHeaders[INGRESS_SECRET_HEADER] = ingressSecret;
+    }
     const client = new Client({
         apiUrl,
         apiKey,
-        defaultHeaders: {
-            [INGRESS_SECRET_HEADER]: ingressSecret,
-            [USER_HEADER]: IDENTITY_LINKS_SERVICE_USER,
-        },
+        defaultHeaders,
     });
     return new LangGraphIdentityLinkStore(client);
 }

package/dist/identity/slack/links.js.map

@@ -1 +1 @@
-{"version":3,"file":"links.js","sourceRoot":"","sources":["../../../src/identity/slack/links.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAElD,OAAO,EACL,WAAW,EACX,2BAA2B,EAC3B,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAE9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,2BAA2B,CAAU,CAAC;AAoB/E,sEAAsE;AACtE,MAAM,OAAO,yBAAyB;IACnB,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IAChD,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEhE,KAAK,CAAC,aAAa,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA0B;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;CACF;AAED,6CAA6C;AAC7C,MAAM,OAAO,0BAA0B;IACR,MAAM;IAAnC,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,KAAK,CAAC,aAAa,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA0B;QACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAChC,CAAC,GAAG,wBAAwB,CAAC,EAC7B,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACjC,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChE,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC5D,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAChC,CAAC,GAAG,wBAAwB,CAAC,EAC7B,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,CACnC,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAC7B,CAAC,GAAG,wBAAwB,CAAC,EAC7B,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC9B,KAAK,CACN,CAAC;QACF,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAC7B,CAAC,GAAG,wBAAwB,CAAC,EAC7B,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAC3B,KAAK,CACN,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAChC,CAAC,GAAG,wBAAwB,CAAC,EAC7B,YAAY,CAAC,MAAM,CAAC,CACrB,CAAC;QACF,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAChC,CAAC,GAAG,wBAAwB,CAAC,EAC7B,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACjC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,GAAW;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAC1C,CAAC,GAAG,wBAAwB,CAAC,EAC7B,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,aAAa,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC;IAC9D,CAAC;CACF;AAED,IAAI,YAAY,GAA6B,IAAI,CAAC;AAElD,uDAAuD;AACvD,MAAM,UAAU,oBAAoB,CAAC,KAA+B;IAClE,YAAY,GAAG,KAAK,CAAC;AACvB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,oBAAoB;IAClC,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,YAAY;QACV,gCAAgC,EAAE,IAAI,IAAI,yBAAyB,EAAE,CAAC;IACxE,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gCAAgC,CAC9C,OAAO,GAAiE,EAAE;IAE1E,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC3D,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,MAAM;QACN,MAAM;QACN,cAAc,EAAE;YACd,CAAC,qBAAqB,CAAC,EAAE,aAAa;YACtC,CAAC,WAAW,CAAC,EAAE,2BAA2B;SAC3C;KACF,CAAC,CAAC;IACH,OAAO,IAAI,0BAA0B,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IAC9D,OAAO,SAAS,MAAM,IAAI,MAAM,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAKvC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACpD,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,QAAQ,EAAE,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC;QACpD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,MAAM,EAAE,aAAa;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,SAAS,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,MAA0B;IAC/C,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CACpB,KAA8B;IAE9B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,WAAW,KAAK,QAAQ;QAC/B,OAAO,QAAQ,KAAK,QAAQ,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,MAAM;QACN,WAAW;QACX,QAAQ;QACR,GAAG,CAAC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;YACvC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;YACpC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,QAAQ,EACN,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAChC,CAAC,CAAC,KAAK,CAAC,QAAQ;YAChB,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC9B,MAAM,EAAE,aAAa;KACtB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"links.js","sourceRoot":"","sources":["../../../src/identity/slack/links.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAElD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,WAAW,EACX,2BAA2B,EAC3B,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAExB,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,2BAA2B,CAAU,CAAC;AAoB/E,sEAAsE;AACtE,MAAM,OAAO,yBAAyB;IACnB,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IAChD,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEhE,KAAK,CAAC,aAAa,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA0B;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;CACF;AAED,6CAA6C;AAC7C,MAAM,OAAO,0BAA0B;IACR,MAAM;IAAnC,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,KAAK,CAAC,aAAa,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA0B;QACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAChC,CAAC,GAAG,wBAAwB,CAAC,EAC7B,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACjC,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChE,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC5D,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAChC,CAAC,GAAG,wBAAwB,CAAC,EAC7B,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,CACnC,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAC7B,CAAC,GAAG,wBAAwB,CAAC,EAC7B,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,EAC9B,KAAK,CACN,CAAC;QACF,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAC7B,CAAC,GAAG,wBAAwB,CAAC,EAC7B,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAC3B,KAAK,CACN,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAChC,CAAC,GAAG,wBAAwB,CAAC,EAC7B,YAAY,CAAC,MAAM,CAAC,CACrB,CAAC;QACF,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAChC,CAAC,GAAG,wBAAwB,CAAC,EAC7B,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACjC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,GAAW;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAC1C,CAAC,GAAG,wBAAwB,CAAC,EAC7B,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,aAAa,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC;IAC9D,CAAC;CACF;AAED,IAAI,YAAY,GAA6B,IAAI,CAAC;AAElD,uDAAuD;AACvD,MAAM,UAAU,oBAAoB,CAAC,KAA+B;IAClE,YAAY,GAAG,KAAK,CAAC;AACvB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,oBAAoB;IAClC,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,YAAY;QACV,gCAAgC,EAAE,IAAI,IAAI,yBAAyB,EAAE,CAAC;IACxE,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,gCAAgC,CAC9C,OAAO,GAAiE,EAAE;IAE1E,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IAChE,MAAM,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC;IACxE,MAAM,qBAAqB,GAAG,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IAC5D,MAAM,uBAAuB,GAC3B,qBAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY,IAAI,MAAM,KAAK,YAAY,CAAC,CAAC;IAC1E,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,cAAc,GAA2B;QAC7C,CAAC,WAAW,CAAC,EAAE,2BAA2B;KAC3C,CAAC;IACF,IAAI,CAAC,gBAAgB,IAAI,qBAAqB,IAAI,aAAa,EAAE,CAAC;QAChE,cAAc,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACxD,CAAC;SAAM,IAAI,aAAa,EAAE,CAAC;QACzB,cAAc,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACxD,CAAC;SAAM,IAAI,CAAC,gBAAgB,IAAI,aAAa,EAAE,CAAC;QAC9C,cAAc,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,MAAM;QACN,MAAM;QACN,cAAc;KACf,CAAC,CAAC;IACH,OAAO,IAAI,0BAA0B,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IAC9D,OAAO,SAAS,MAAM,IAAI,MAAM,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAKvC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACpD,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,QAAQ,EAAE,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC;QACpD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,MAAM,EAAE,aAAa;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,SAAS,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,MAA0B;IAC/C,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CACpB,KAA8B;IAE9B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,WAAW,KAAK,QAAQ;QAC/B,OAAO,QAAQ,KAAK,QAAQ,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,MAAM;QACN,WAAW;QACX,QAAQ;QACR,GAAG,CAAC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;YACvC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;YACpC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,QAAQ,EACN,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAChC,CAAC,CAAC,KAAK,CAAC,QAAQ;YAChB,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC9B,MAAM,EAAE,aAAa;KACtB,CAAC;AACJ,CAAC"}

package/dist/identity/types.d.ts

@@ -7,7 +7,11 @@
 import type { IdentityConnectProvider } from "./connect-provider-types.js";
 export type { IdentityConnectProvider } from "./connect-provider-types.js";
 /** How MDA learns who is calling on the HTTP ingress path. */
-export type HttpIngress = "backend" | ValidatedTokenIngress;
+export type HttpIngress = "backend" | LangSmithApiKeyIngress | ValidatedTokenIngress;
+/** LangSmith workspace API-key ingress, verified by managed auth. */
+export interface LangSmithApiKeyIngress {
+    mode: "langsmith_api_key";
+}
 /**
  * Browser-direct ingress: MDA verifies the caller's own IdP token server-side
  * and derives identity from its claims.
@@ -77,15 +81,6 @@ export interface ValidatedTokenProvider {
         /** Custom header name when `tokenIn` is "header". */
         header?: string;
     };
-    /** MDA issues + verifies short-lived signed tokens for anonymous/guest users. */
-    guest?: {
-        /** Enable an issue/reissue path for this provider. */
-        issue: boolean;
-        /** Token lifetime, e.g. "24h". */
-        ttl?: string;
-        /** Prefix applied to the generated user id, e.g. "guest:". */
-        userPrefix?: string;
-    };
     /** Maps verified token claims → identity envelope fields. */
     claims: ClaimMapping;
 }
@@ -108,7 +103,7 @@ export interface ClaimMapping {
 /** Which downstream call needs a credential right now. */
 export interface CredentialTarget {
     /** What is being called. */
-    kind: "subagent" | "mcp" | "connection" | "langsmith";
+    kind: "subagent" | "mcp" | "connection";
     /** The configured name, e.g. "code-reviewer" | "docs" | "github". */
     name: string;
     /** Optional read/write hint so the resolver can mint different tokens. */
@@ -185,33 +180,6 @@ export type CredentialResolverConfig = ({
  * folded into a hand-written switch.
  */
 export type CredentialResolvers = Record<string, CredentialResolverConfig>;
-/** One enabled memory mount after normalize. Mounts are always read/write. */
-export type ResolvedMemorySlice = {
-    kind: "user";
-} | {
-    kind: "agent";
-};
-/**
- * Resolved durable memory config: which slices are mounted.
- *
- * Empty array means no durable memory. Order is agent then user when both are
- * present. User memory is always per-caller keyed (`{deploy}--u--{user}`).
- */
-export type MemoryScope = ResolvedMemorySlice[];
-/** Authoring form of a single memory slice. */
-export type MemorySliceInput = "user" | "agent";
-/**
- * Authoring form of `scope.memory`.
- *
- * - `"none"` / `[]` — no durable memory
- * - `"user"` / `"agent"` — that slice only
- * - `["agent", "user"]` — both (procedural + personal)
- *
- * Object slice syntax (`{ kind }`) is not part of the authoring surface yet.
- * Legacy flat `"organization"`, any `partition` field, and any `access` field
- * are rejected (mounts are always R/W).
- */
-export type MemoryScopeInput = "none" | MemorySliceInput | MemorySliceInput[];
 /**
  * Whose token downstream calls carry.
  *
@@ -227,18 +195,19 @@ export type CredentialScope = "user" | "agent" | "none" | "custom";
  * The resolved identity contract the runtime reads.
  *
  * `defineIdentity` derives this from {@link IdentityOptions}; it is not an
- * authoring surface. Its vocabulary matches the authoring vocabulary exactly, so
- * a value you read while debugging is the value you wrote.
+ * authoring surface. Scope remains explicit here so runtime policy is inspectable
+ * without exposing it as a declaration knob.
  */
 export interface IdentityConfig {
     /** How MDA learns who is calling. */
     ingress: {
         http: HttpIngress;
     };
-    /** Isolation axes. Threads are always user-owned. */
+    /**
+     * Isolation axes. Threads are always user-owned, and durable memory is not an
+     * identity axis — it is declared in `memory.ts` (see `MemoryConfig`).
+     */
     scope: {
-        /** Enabled memory slices (empty = none). */
-        memory: MemoryScope;
         /**
          * Whose downstream tokens / Connect ownership apply. `"custom"` when a
          * resolver/endpoint is provided below.

package/dist/identity/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,YAAY,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,qBAAqB,CAAC;AAE5D;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,iFAAiF;IACjF,KAAK,CAAC,EAAE;QACN,sDAAsD;QACtD,KAAK,EAAE,OAAO,CAAC;QACf,kCAAkC;QAClC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,8DAA8D;QAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B;IAC5B,IAAI,EAAE,UAAU,GAAG,KAAK,GAAG,YAAY,GAAG,WAAW,CAAC;IACtD,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,IAAI,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN;;;WAGG;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,uCAAuC;AACvC,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE;IACtC,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC,CAAC;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAAG,6BAA6B,CAAC,GACjE,CAAC;IAAE,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,6BAA6B,CAAC,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AAE3E,8EAA8E;AAC9E,MAAM,MAAM,mBAAmB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,gBAAgB,GAAG,gBAAgB,EAAE,CAAC;AAE9E;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF,qDAAqD;IACrD,KAAK,EAAE;QACL,4CAA4C;QAC5C,MAAM,EAAE,WAAW,CAAC;QACpB;;;WAGG;QACH,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;IACF;;;OAGG;IACH,WAAW,CAAC,EAAE,wBAAwB,GAAG,mBAAmB,CAAC;IAC7D;;;OAGG;IACH,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,YAAY,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GACnB,SAAS,GACT,sBAAsB,GACtB,qBAAqB,CAAC;AAE1B,qEAAqE;AACrE,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,mBAAmB,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B;IAC5B,IAAI,EAAE,UAAU,GAAG,KAAK,GAAG,YAAY,CAAC;IACxC,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,IAAI,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN;;;WAGG;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,uCAAuC;AACvC,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE;IACtC,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC,CAAC;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAAG,6BAA6B,CAAC,GACjE,CAAC;IAAE,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,6BAA6B,CAAC,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AAE3E;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF;;;OAGG;IACH,KAAK,EAAE;QACL;;;WAGG;QACH,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;IACF;;;OAGG;IACH,WAAW,CAAC,EAAE,wBAAwB,GAAG,mBAAmB,CAAC;IAC7D;;;OAGG;IACH,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC"}