managed-deepagents 0.5.3-dev.111 → 0.5.3-dev.112

package/dist/identity/marketplace/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/marketplace/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,qCAAqC,EACrC,kBAAkB,EAClB,mCAAmC,EACnC,KAAK,kBAAkB,EACvB,KAAK,iCAAiC,GACvC,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sCAAsC,EACtC,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,uCAAuC,GAC7C,MAAM,mBAAmB,CAAC"}

package/dist/identity/marketplace/index.js

@@ -1,9 +0,0 @@
-/**
- * Marketplace identity helpers — Connect-with-X for Fleet marketplace MCP bridges.
- *
- * One surface covers every catalog entry (Notion, Cloudflare, Neon, …): vault
- * Connect providers, `connect.<id>()` factories, and proactive connect hints.
- */
-export { createMarketplaceVaultConnectProvider, marketplaceConnect, marketplaceIdentityConnectProviders, } from "./connect.js";
-export { createMarketplaceConnectHintMiddleware, marketplaceAsFleetHint, marketplaceConnectHintUrl, } from "./connect-hint.js";
-//# sourceMappingURL=index.js.map

package/dist/identity/marketplace/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/marketplace/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,qCAAqC,EACrC,kBAAkB,EAClB,mCAAmC,GAGpC,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sCAAsC,EACtC,sBAAsB,EACtB,yBAAyB,GAE1B,MAAM,mBAAmB,CAAC"}

package/dist/identity/microsoft/connect-http.d.ts

@@ -1,38 +0,0 @@
-/**
- * Connect-with-Microsoft — thin adapter over {@link defineFleetIntegrationConnect}.
- *
- * Mounted under `/identity/microsoft/*` when listed on `identity.connect`, or
- * inferred from declared Microsoft toolserver connectors on a user-scoped
- * deployment.
- */
-import type { FleetIntegrationConnectProviderOptions } from "../fleet-integration-connect.js";
-export declare const MICROSOFT_CONNECT_STATUS_PATH: string;
-export declare const MICROSOFT_CONNECT_START_PATH: string;
-export declare const MICROSOFT_CONNECT_CALLBACK_PATH: string;
-export declare const MICROSOFT_CONNECT_LINK_PATH: string;
-export declare const isMicrosoftActorSubjectEnabled: () => boolean;
-export declare const enableMicrosoftActorSubject: () => void;
-/**
- * Enable actor-subject mode when Microsoft connectors imply per-user vault subjects.
- *
- * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
- */
-export declare const enableMicrosoftActorSubjectFromConnectors: (connectorKinds: readonly (string | undefined)[] | undefined, scope?: import("../connect-provider-types.js").IdentityConnectMountContext["scope"]) => void;
-export declare const resetMicrosoftActorSubjectEnabledForTests: () => void;
-export declare const isMicrosoftConnectConfigured: (env?: NodeJS.ProcessEnv) => boolean;
-export declare const microsoftConnectUrl: (publicAppUrl: string) => string;
-/** Options for {@link createMicrosoftIdentityConnectProvider}. */
-export type MicrosoftIdentityConnectProviderOptions = FleetIntegrationConnectProviderOptions;
-/** Build a Microsoft connect provider. */
-export declare const createMicrosoftIdentityConnectProvider: (options?: FleetIntegrationConnectProviderOptions) => import("../connect-provider-types.js").IdentityConnectProvider;
-/** Default Microsoft connect provider used as a built-in mount candidate. */
-export declare const microsoftIdentityConnectProvider: import("../connect-provider-types.js").IdentityConnectProvider;
-/**
- * Opt into Connect-with-Microsoft on `defineIdentity({ connect: […] })`.
- *
- * Usually unnecessary: declaring Microsoft toolserver connectors on a
- * user-scoped identity deployment mounts this provider and derives OAuth
- * scopes automatically.
- */
-export declare const connect: (options?: FleetIntegrationConnectProviderOptions) => import("../connect-provider-types.js").IdentityConnectProvider;
-//# sourceMappingURL=connect-http.d.ts.map

package/dist/identity/microsoft/connect-http.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/microsoft/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAC;AAQ9F,eAAO,MAAM,6BAA6B,QAAyB,CAAC;AACpE,eAAO,MAAM,4BAA4B,QAA0B,CAAC;AACpE,eAAO,MAAM,+BAA+B,QAA2B,CAAC;AACxE,eAAO,MAAM,2BAA2B,QAAuB,CAAC;AAEhE,eAAO,MAAM,8BAA8B,eAAkC,CAAC;AAC9E,eAAO,MAAM,2BAA2B,YAA+B,CAAC;AACxE;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,4JACV,CAAC;AAC7C,eAAO,MAAM,yCAAyC,YACV,CAAC;AAC7C,eAAO,MAAM,4BAA4B,sCAAgC,CAAC;AAC1E,eAAO,MAAM,mBAAmB,kCAAuB,CAAC;AAExD,kEAAkE;AAClE,MAAM,MAAM,uCAAuC,GACjD,sCAAsC,CAAC;AAEzC,0CAA0C;AAC1C,eAAO,MAAM,sCAAsC,sHAA2B,CAAC;AAE/E,6EAA6E;AAC7E,eAAO,MAAM,gCAAgC,gEAAqB,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,sHAAoB,CAAC"}

package/dist/identity/microsoft/connect-http.js

@@ -1,42 +0,0 @@
-/**
- * Connect-with-Microsoft — thin adapter over {@link defineFleetIntegrationConnect}.
- *
- * Mounted under `/identity/microsoft/*` when listed on `identity.connect`, or
- * inferred from declared Microsoft toolserver connectors on a user-scoped
- * deployment.
- */
-import { MICROSOFT_INTEGRATION } from "../../connectors/toolserver/integrations.js";
-import { defineFleetIntegrationConnect } from "../define-fleet-connect.js";
-import { microsoftByoOauth } from "./oauth.js";
-const microsoft = defineFleetIntegrationConnect({
-    integration: MICROSOFT_INTEGRATION,
-    byoClient: microsoftByoOauth,
-});
-export const MICROSOFT_CONNECT_STATUS_PATH = microsoft.paths.status;
-export const MICROSOFT_CONNECT_START_PATH = microsoft.paths.connect;
-export const MICROSOFT_CONNECT_CALLBACK_PATH = microsoft.paths.callback;
-export const MICROSOFT_CONNECT_LINK_PATH = microsoft.paths.link;
-export const isMicrosoftActorSubjectEnabled = microsoft.isActorSubjectEnabled;
-export const enableMicrosoftActorSubject = microsoft.enableActorSubject;
-/**
- * Enable actor-subject mode when Microsoft connectors imply per-user vault subjects.
- *
- * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
- */
-export const enableMicrosoftActorSubjectFromConnectors = microsoft.enableActorSubjectFromConnectors;
-export const resetMicrosoftActorSubjectEnabledForTests = microsoft.resetActorSubjectEnabledForTests;
-export const isMicrosoftConnectConfigured = microsoft.isConnectConfigured;
-export const microsoftConnectUrl = microsoft.connectUrl;
-/** Build a Microsoft connect provider. */
-export const createMicrosoftIdentityConnectProvider = microsoft.createProvider;
-/** Default Microsoft connect provider used as a built-in mount candidate. */
-export const microsoftIdentityConnectProvider = microsoft.provider;
-/**
- * Opt into Connect-with-Microsoft on `defineIdentity({ connect: […] })`.
- *
- * Usually unnecessary: declaring Microsoft toolserver connectors on a
- * user-scoped identity deployment mounts this provider and derives OAuth
- * scopes automatically.
- */
-export const connect = microsoft.connect;
-//# sourceMappingURL=connect-http.js.map

package/dist/identity/microsoft/connect-http.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/microsoft/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAE3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,SAAS,GAAG,6BAA6B,CAAC;IAC9C,WAAW,EAAE,qBAAqB;IAClC,SAAS,EAAE,iBAAiB;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;AACpE,MAAM,CAAC,MAAM,4BAA4B,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;AACpE,MAAM,CAAC,MAAM,+BAA+B,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;AACxE,MAAM,CAAC,MAAM,2BAA2B,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;AAEhE,MAAM,CAAC,MAAM,8BAA8B,GAAG,SAAS,CAAC,qBAAqB,CAAC;AAC9E,MAAM,CAAC,MAAM,2BAA2B,GAAG,SAAS,CAAC,kBAAkB,CAAC;AACxE;;;;GAIG;AACH,MAAM,CAAC,MAAM,yCAAyC,GACpD,SAAS,CAAC,gCAAgC,CAAC;AAC7C,MAAM,CAAC,MAAM,yCAAyC,GACpD,SAAS,CAAC,gCAAgC,CAAC;AAC7C,MAAM,CAAC,MAAM,4BAA4B,GAAG,SAAS,CAAC,mBAAmB,CAAC;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC,UAAU,CAAC;AAMxD,0CAA0C;AAC1C,MAAM,CAAC,MAAM,sCAAsC,GAAG,SAAS,CAAC,cAAc,CAAC;AAE/E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CAAC,QAAQ,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC"}

package/dist/identity/microsoft/index.d.ts

@@ -1,7 +0,0 @@
-/**
- * Microsoft identity helpers — Connect-with-Microsoft (Fleet vault).
- */
-export { connect, createMicrosoftIdentityConnectProvider, enableMicrosoftActorSubject, enableMicrosoftActorSubjectFromConnectors, microsoftConnectUrl, microsoftIdentityConnectProvider, isMicrosoftActorSubjectEnabled, isMicrosoftConnectConfigured, resetMicrosoftActorSubjectEnabledForTests, MICROSOFT_CONNECT_CALLBACK_PATH, MICROSOFT_CONNECT_LINK_PATH, MICROSOFT_CONNECT_START_PATH, MICROSOFT_CONNECT_STATUS_PATH, } from "./connect-http.js";
-export type { MicrosoftIdentityConnectProviderOptions } from "./connect-http.js";
-export { microsoftOauthTickets } from "./oauth.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/identity/microsoft/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/microsoft/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,sCAAsC,EACtC,2BAA2B,EAC3B,yCAAyC,EACzC,mBAAmB,EACnB,gCAAgC,EAChC,8BAA8B,EAC9B,4BAA4B,EAC5B,yCAAyC,EACzC,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,uCAAuC,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC"}

package/dist/identity/microsoft/index.js

@@ -1,6 +0,0 @@
-/**
- * Microsoft identity helpers — Connect-with-Microsoft (Fleet vault).
- */
-export { connect, createMicrosoftIdentityConnectProvider, enableMicrosoftActorSubject, enableMicrosoftActorSubjectFromConnectors, microsoftConnectUrl, microsoftIdentityConnectProvider, isMicrosoftActorSubjectEnabled, isMicrosoftConnectConfigured, resetMicrosoftActorSubjectEnabledForTests, MICROSOFT_CONNECT_CALLBACK_PATH, MICROSOFT_CONNECT_LINK_PATH, MICROSOFT_CONNECT_START_PATH, MICROSOFT_CONNECT_STATUS_PATH, } from "./connect-http.js";
-export { microsoftOauthTickets } from "./oauth.js";
-//# sourceMappingURL=index.js.map

package/dist/identity/microsoft/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/microsoft/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,sCAAsC,EACtC,2BAA2B,EAC3B,yCAAyC,EACzC,mBAAmB,EACnB,gCAAgC,EAChC,8BAA8B,EAC9B,4BAA4B,EAC5B,yCAAyC,EACzC,+BAA+B,EAC/B,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC"}

package/dist/identity/microsoft/oauth.d.ts

@@ -1,24 +0,0 @@
-/**
- * Microsoft BYO OAuth descriptor — optional non-LangSmith Connect-with-Microsoft.
- * The default path uses Fleet auth-sessions instead.
- */
-import { type ByoOauthConfig, type ByoOauthClient } from "../byo-oauth.js";
-export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, } from "../byo-oauth.js";
-export type MicrosoftOauthConfig = ByoOauthConfig;
-/** Azure AD tenant (`common`, `organizations`, `consumers`, or a tenant id). */
-export declare const MICROSOFT_OAUTH_TENANT_ENV = "MICROSOFT_OAUTH_TENANT";
-/** Microsoft BYO OAuth client (config, authorize, exchange, Fleet adapter). */
-export declare const microsoftByoOauth: ByoOauthClient;
-export declare const MICROSOFT_OAUTH_CLIENT_ID_ENV: string;
-export declare const MICROSOFT_OAUTH_CLIENT_SECRET_ENV: string;
-export declare const MICROSOFT_OAUTH_SCOPES_ENV: string;
-export declare const MICROSOFT_OAUTH_AUTH_URL_ENV: string;
-export declare const MICROSOFT_OAUTH_TOKEN_URL_ENV: string;
-export declare const MICROSOFT_OAUTH_USERINFO_URL_ENV: string;
-/** Microsoft-bound OAuth state / connect-ticket helpers. */
-export declare const microsoftOauthTickets: import("../oauth-tickets.js").OauthTickets;
-export declare const resolveMicrosoftOauthRedirectBase: typeof import("../oauth-env.js").resolveOauthRedirectBase;
-export declare const readMicrosoftOauthConfig: (env?: NodeJS.ProcessEnv) => ByoOauthConfig | null;
-export declare const buildMicrosoftAuthorizeUrl: (config: ByoOauthConfig, state: string, redirectUri: string, scopes?: string) => string;
-export declare const exchangeMicrosoftOauthCode: (config: ByoOauthConfig, code: string, redirectUri: string, fetchImpl?: typeof fetch) => Promise<import("../fleet-connect.js").FleetVaultByoTokenResult>;
-//# sourceMappingURL=oauth.d.ts.map

package/dist/identity/microsoft/oauth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/microsoft/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAElD,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AAqBnE,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,EAAE,cA2B9B,CAAC;AAEH,eAAO,MAAM,6BAA6B,QAAiC,CAAC;AAC5E,eAAO,MAAM,iCAAiC,QACV,CAAC;AACrC,eAAO,MAAM,0BAA0B,QAA+B,CAAC;AACvE,eAAO,MAAM,4BAA4B,QAAgC,CAAC;AAC1E,eAAO,MAAM,6BAA6B,QAAiC,CAAC;AAC5E,eAAO,MAAM,gCAAgC,QACV,CAAC;AAEpC,4DAA4D;AAC5D,eAAO,MAAM,qBAAqB,4CAA4B,CAAC;AAE/D,eAAO,MAAM,iCAAiC,2DACP,CAAC;AAExC,eAAO,MAAM,wBAAwB,oDAA+B,CAAC;AACrE,eAAO,MAAM,0BAA0B,yFAAsC,CAAC;AAC9E,eAAO,MAAM,0BAA0B,0JAAiC,CAAC"}

package/dist/identity/microsoft/oauth.js

@@ -1,65 +0,0 @@
-/**
- * Microsoft BYO OAuth descriptor — optional non-LangSmith Connect-with-Microsoft.
- * The default path uses Fleet auth-sessions instead.
- */
-import { createByoOauthClient, } from "../byo-oauth.js";
-export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, } from "../byo-oauth.js";
-/** Azure AD tenant (`common`, `organizations`, `consumers`, or a tenant id). */
-export const MICROSOFT_OAUTH_TENANT_ENV = "MICROSOFT_OAUTH_TENANT";
-const DEFAULT_TENANT = "common";
-const DEFAULT_USERINFO_URL = "https://graph.microsoft.com/v1.0/me";
-/** Profile + refresh; connector-derived unions replace this at authorize time. */
-const DEFAULT_SCOPES = [
-    "openid",
-    "email",
-    "profile",
-    "offline_access",
-    "https://graph.microsoft.com/User.Read",
-].join(" ");
-function defaultAuthUrl(tenant) {
-    return `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize`;
-}
-function defaultTokenUrl(tenant) {
-    return `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`;
-}
-/** Microsoft BYO OAuth client (config, authorize, exchange, Fleet adapter). */
-export const microsoftByoOauth = createByoOauthClient({
-    providerId: "microsoft",
-    displayName: "Microsoft",
-    envPrefix: "MICROSOFT_OAUTH",
-    defaultEndpoints(env) {
-        const tenant = env[MICROSOFT_OAUTH_TENANT_ENV]?.trim() || DEFAULT_TENANT;
-        return {
-            authUrl: defaultAuthUrl(tenant),
-            tokenUrl: defaultTokenUrl(tenant),
-            userInfoUrl: DEFAULT_USERINFO_URL,
-            defaultScopes: DEFAULT_SCOPES,
-        };
-    },
-    authorizeParams: { response_mode: "query" },
-    parseUserInfo(json) {
-        const mail = typeof json.mail === "string" ? json.mail : undefined;
-        const upn = typeof json.userPrincipalName === "string"
-            ? json.userPrincipalName
-            : undefined;
-        const id = typeof json.id === "string" ? json.id : undefined;
-        return {
-            ...(mail || upn ? { email: mail || upn } : {}),
-            ...(id ? { subject: id } : {}),
-        };
-    },
-    subjectMetadataKey: "microsoft_oid",
-});
-export const MICROSOFT_OAUTH_CLIENT_ID_ENV = microsoftByoOauth.env.clientId;
-export const MICROSOFT_OAUTH_CLIENT_SECRET_ENV = microsoftByoOauth.env.clientSecret;
-export const MICROSOFT_OAUTH_SCOPES_ENV = microsoftByoOauth.env.scopes;
-export const MICROSOFT_OAUTH_AUTH_URL_ENV = microsoftByoOauth.env.authUrl;
-export const MICROSOFT_OAUTH_TOKEN_URL_ENV = microsoftByoOauth.env.tokenUrl;
-export const MICROSOFT_OAUTH_USERINFO_URL_ENV = microsoftByoOauth.env.userInfoUrl;
-/** Microsoft-bound OAuth state / connect-ticket helpers. */
-export const microsoftOauthTickets = microsoftByoOauth.tickets;
-export const resolveMicrosoftOauthRedirectBase = microsoftByoOauth.resolveRedirectBase;
-export const readMicrosoftOauthConfig = microsoftByoOauth.readConfig;
-export const buildMicrosoftAuthorizeUrl = microsoftByoOauth.buildAuthorizeUrl;
-export const exchangeMicrosoftOauthCode = microsoftByoOauth.exchangeCode;
-//# sourceMappingURL=oauth.js.map

package/dist/identity/microsoft/oauth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/identity/microsoft/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,oBAAoB,GAGrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAIzB,gFAAgF;AAChF,MAAM,CAAC,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAEnE,MAAM,cAAc,GAAG,QAAQ,CAAC;AAChC,MAAM,oBAAoB,GAAG,qCAAqC,CAAC;AACnE,kFAAkF;AAClF,MAAM,cAAc,GAAG;IACrB,QAAQ;IACR,OAAO;IACP,SAAS;IACT,gBAAgB;IAChB,uCAAuC;CACxC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,qCAAqC,MAAM,wBAAwB,CAAC;AAC7E,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,qCAAqC,MAAM,oBAAoB,CAAC;AACzE,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,iBAAiB,GAAmB,oBAAoB,CAAC;IACpE,UAAU,EAAE,WAAW;IACvB,WAAW,EAAE,WAAW;IACxB,SAAS,EAAE,iBAAiB;IAC5B,gBAAgB,CAAC,GAAG;QAClB,MAAM,MAAM,GAAG,GAAG,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC;QACzE,OAAO;YACL,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC;YAC/B,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC;YACjC,WAAW,EAAE,oBAAoB;YACjC,aAAa,EAAE,cAAc;SAC9B,CAAC;IACJ,CAAC;IACD,eAAe,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE;IAC3C,aAAa,CAAC,IAAI;QAChB,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,GAAG,GACP,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ;YACxC,CAAC,CAAC,IAAI,CAAC,iBAAiB;YACxB,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,OAAO;YACL,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/B,CAAC;IACJ,CAAC;IACD,kBAAkB,EAAE,eAAe;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC5E,MAAM,CAAC,MAAM,iCAAiC,GAC5C,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC;AACrC,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;AACvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC;AAC1E,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC5E,MAAM,CAAC,MAAM,gCAAgC,GAC3C,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC;AAEpC,4DAA4D;AAC5D,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC,OAAO,CAAC;AAE/D,MAAM,CAAC,MAAM,iCAAiC,GAC5C,iBAAiB,CAAC,mBAAmB,CAAC;AAExC,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC,UAAU,CAAC;AACrE,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC,iBAAiB,CAAC;AAC9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAC,YAAY,CAAC"}

package/dist/identity/oauth-env.d.ts

@@ -1,43 +0,0 @@
-/**
- * Shared deployment OAuth env keys and redirect-base resolution.
- *
- * Used by Slack OIDC, GitHub Connect, Fleet vault Connect, and BYO clients —
- * not Slack-specific despite historical residence under `slack/oauth.ts`.
- */
-export declare const MDA_PUBLIC_APP_URL_ENV = "MDA_PUBLIC_APP_URL";
-/**
- * Public Agent Server base URL used for OAuth `redirect_uri`.
- * Required on LangGraph Host where the ASGI request origin is an internal
- * loopback (e.g. `http://localhost:5557`) rather than `*.langgraph.app`.
- */
-export declare const MDA_PUBLIC_API_URL_ENV = "MDA_PUBLIC_API_URL";
-/**
- * Signing key for OAuth `state` JWTs (Connect-with-X). The env var name is
- * historical — it predates guest ingress being removed — and is kept so
- * existing deployments do not have to rotate a secret. Never a provider client
- * secret (that value is an OAuth credential, not a signing key).
- */
-export declare const OAUTH_STATE_SIGNING_KEY_ENV = "MDA_GUEST_SIGNING_KEY";
-/** Server-side key for OAuth state JWTs; null when Connect cannot bind actors. */
-export declare function readOauthStateSigningKey(env?: NodeJS.ProcessEnv): string | null;
-/**
- * Public base URL for OAuth `redirect_uri` (`…/identity/{provider}/callback`).
- *
- * Prefer an explicit public Agent Server URL over the ASGI request origin:
- * LangGraph Host rewrites requests to an internal loopback that IdPs cannot
- * use as a redirect.
- */
-export declare function resolveOauthRedirectBase(options: {
-    requestUrl: string;
-    headers?: Headers | {
-        get(name: string): string | null | undefined;
-    };
-    deploymentBaseUrl?: string;
-    env?: NodeJS.ProcessEnv;
-}): string;
-/**
- * @deprecated Use {@link resolveOauthRedirectBase}. Kept for callers that still
- * import the historical Slack-named alias.
- */
-export declare const resolveSlackOauthRedirectBase: typeof resolveOauthRedirectBase;
-//# sourceMappingURL=oauth-env.d.ts.map

package/dist/identity/oauth-env.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-env.d.ts","sourceRoot":"","sources":["../../src/identity/oauth-env.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAC3D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAEnE,kFAAkF;AAClF,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAGf;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;KAAE,CAAC;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,CAcT;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,iCAA2B,CAAC"}

package/dist/identity/oauth-env.js

@@ -1,66 +0,0 @@
-/**
- * Shared deployment OAuth env keys and redirect-base resolution.
- *
- * Used by Slack OIDC, GitHub Connect, Fleet vault Connect, and BYO clients —
- * not Slack-specific despite historical residence under `slack/oauth.ts`.
- */
-import { isLoopbackHost, isLoopbackUrl } from "./loopback.js";
-export const MDA_PUBLIC_APP_URL_ENV = "MDA_PUBLIC_APP_URL";
-/**
- * Public Agent Server base URL used for OAuth `redirect_uri`.
- * Required on LangGraph Host where the ASGI request origin is an internal
- * loopback (e.g. `http://localhost:5557`) rather than `*.langgraph.app`.
- */
-export const MDA_PUBLIC_API_URL_ENV = "MDA_PUBLIC_API_URL";
-/**
- * Signing key for OAuth `state` JWTs (Connect-with-X). The env var name is
- * historical — it predates guest ingress being removed — and is kept so
- * existing deployments do not have to rotate a secret. Never a provider client
- * secret (that value is an OAuth credential, not a signing key).
- */
-export const OAUTH_STATE_SIGNING_KEY_ENV = "MDA_GUEST_SIGNING_KEY";
-/** Server-side key for OAuth state JWTs; null when Connect cannot bind actors. */
-export function readOauthStateSigningKey(env = process.env) {
-    const key = env[OAUTH_STATE_SIGNING_KEY_ENV]?.trim();
-    return key || null;
-}
-/**
- * Public base URL for OAuth `redirect_uri` (`…/identity/{provider}/callback`).
- *
- * Prefer an explicit public Agent Server URL over the ASGI request origin:
- * LangGraph Host rewrites requests to an internal loopback that IdPs cannot
- * use as a redirect.
- */
-export function resolveOauthRedirectBase(options) {
-    const env = options.env ?? process.env;
-    if (options.deploymentBaseUrl?.trim()) {
-        return options.deploymentBaseUrl.trim().replace(/\/$/, "");
-    }
-    const fromEnv = env[MDA_PUBLIC_API_URL_ENV]?.trim().replace(/\/$/, "");
-    if (fromEnv && !isLoopbackUrl(fromEnv)) {
-        return fromEnv;
-    }
-    const forwarded = publicOriginFromForwardedHeaders(options.headers);
-    if (forwarded) {
-        return forwarded;
-    }
-    return new URL(options.requestUrl).origin;
-}
-/**
- * @deprecated Use {@link resolveOauthRedirectBase}. Kept for callers that still
- * import the historical Slack-named alias.
- */
-export const resolveSlackOauthRedirectBase = resolveOauthRedirectBase;
-function publicOriginFromForwardedHeaders(headers) {
-    if (!headers) {
-        return undefined;
-    }
-    const host = headers.get("x-forwarded-host")?.split(",")[0]?.trim();
-    if (!host || isLoopbackHost(host)) {
-        return undefined;
-    }
-    const proto = headers.get("x-forwarded-proto")?.split(",")[0]?.trim() ||
-        (host.includes("localhost") || host.startsWith("127.") ? "http" : "https");
-    return `${proto}://${host}`;
-}
-//# sourceMappingURL=oauth-env.js.map

package/dist/identity/oauth-env.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-env.js","sourceRoot":"","sources":["../../src/identity/oauth-env.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9D,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAC3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAC;AAEnE,kFAAkF;AAClF,MAAM,UAAU,wBAAwB,CACtC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC;IACrD,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAKxC;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,IAAI,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,CAAC;QACtC,OAAO,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvE,IAAI,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,SAAS,GAAG,gCAAgC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,wBAAwB,CAAC;AAEtE,SAAS,gCAAgC,CACvC,OAAoE;IAEpE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GACT,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACvD,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7E,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;AAC9B,CAAC"}

package/dist/identity/oauth-tickets.d.ts

@@ -1,37 +0,0 @@
-/**
- * Shared OAuth state and connect-ticket JWTs for Connect-with-X providers.
- *
- * Parameterized by provider id so each integration gets distinct `typ` values
- * (`mda-{id}-oauth-state`, `mda-{id}-connect-ticket`) without copying JWT code.
- */
-export declare function createOauthState(providerId: string, userId: string, signingKey: string, nowMs?: number): Promise<string>;
-export declare function verifyOauthState(providerId: string, state: string, signingKey: string, nowMs?: number): Promise<{
-    userId: string;
-}>;
-/**
- * Mint a short-lived connect ticket for channel actors (Slack, etc.) who have
- * no browser session. The Connect start route accepts `?ticket=…` and binds
- * the OAuth vault subject to this user id.
- */
-export declare function createConnectTicket(providerId: string, userId: string, signingKey: string, nowMs?: number): Promise<string>;
-export declare function verifyConnectTicket(providerId: string, ticket: string, signingKey: string, nowMs?: number): Promise<{
-    userId: string;
-}>;
-/** Bound OAuth state / connect-ticket helpers for one Connect provider id. */
-export interface OauthTickets {
-    readonly providerId: string;
-    createState(userId: string, signingKey: string, nowMs?: number): Promise<string>;
-    verifyState(state: string, signingKey: string, nowMs?: number): Promise<{
-        userId: string;
-    }>;
-    createTicket(userId: string, signingKey: string, nowMs?: number): Promise<string>;
-    verifyTicket(ticket: string, signingKey: string, nowMs?: number): Promise<{
-        userId: string;
-    }>;
-}
-/**
- * Bind {@link createOauthState} / ticket helpers to a Connect provider id
- * (`mda-{id}-oauth-state`, `mda-{id}-connect-ticket`).
- */
-export declare function oauthTicketsFor(providerId: string): OauthTickets;
-//# sourceMappingURL=oauth-tickets.d.ts.map

package/dist/identity/oauth-tickets.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-tickets.d.ts","sourceRoot":"","sources":["../../src/identity/oauth-tickets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAsBH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAqB7B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAwB7B;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,WAAW,CACT,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,WAAW,CACT,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/B,YAAY,CACV,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,YAAY,CACV,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAgBhE"}

package/dist/identity/oauth-tickets.js

@@ -1,114 +0,0 @@
-/**
- * Shared OAuth state and connect-ticket JWTs for Connect-with-X providers.
- *
- * Parameterized by provider id so each integration gets distinct `typ` values
- * (`mda-{id}-oauth-state`, `mda-{id}-connect-ticket`) without copying JWT code.
- */
-import { randomBytes } from "node:crypto";
-import { jwtVerify, SignJWT } from "jose";
-const STATE_TTL_MS = 10 * 60 * 1000;
-/** Short-lived ticket so Slack/email actors can open Connect without a browser session. */
-const CONNECT_TICKET_TTL_MS = 30 * 60 * 1000;
-function stateTyp(providerId) {
-    return `mda-${providerId}-oauth-state`;
-}
-function ticketTyp(providerId) {
-    return `mda-${providerId}-connect-ticket`;
-}
-function stateSigningKey(signingKey) {
-    return new TextEncoder().encode(signingKey);
-}
-export async function createOauthState(providerId, userId, signingKey, nowMs = Date.now()) {
-    const iat = Math.floor(nowMs / 1000);
-    const exp = Math.floor((nowMs + STATE_TTL_MS) / 1000);
-    return new SignJWT({
-        userId,
-        nonce: randomBytes(16).toString("hex"),
-    })
-        .setProtectedHeader({ alg: "HS256", typ: stateTyp(providerId) })
-        .setIssuedAt(iat)
-        .setExpirationTime(exp)
-        .sign(stateSigningKey(signingKey));
-}
-export async function verifyOauthState(providerId, state, signingKey, nowMs = Date.now()) {
-    try {
-        const { payload } = await jwtVerify(state, stateSigningKey(signingKey), {
-            algorithms: ["HS256"],
-            typ: stateTyp(providerId),
-            currentDate: new Date(nowMs),
-        });
-        if (typeof payload.userId !== "string" || !payload.userId) {
-            throw new Error("invalid OAuth state actor");
-        }
-        return { userId: payload.userId };
-    }
-    catch (err) {
-        if (err instanceof Error && err.message.startsWith("invalid OAuth state")) {
-            throw err;
-        }
-        const message = err instanceof Error ? err.message : String(err);
-        if (/exp|expir/i.test(message)) {
-            throw new Error("OAuth state expired");
-        }
-        throw new Error("invalid OAuth state signature");
-    }
-}
-/**
- * Mint a short-lived connect ticket for channel actors (Slack, etc.) who have
- * no browser session. The Connect start route accepts `?ticket=…` and binds
- * the OAuth vault subject to this user id.
- */
-export async function createConnectTicket(providerId, userId, signingKey, nowMs = Date.now()) {
-    const iat = Math.floor(nowMs / 1000);
-    const exp = Math.floor((nowMs + CONNECT_TICKET_TTL_MS) / 1000);
-    return new SignJWT({
-        userId,
-        nonce: randomBytes(16).toString("hex"),
-    })
-        .setProtectedHeader({ alg: "HS256", typ: ticketTyp(providerId) })
-        .setIssuedAt(iat)
-        .setExpirationTime(exp)
-        .sign(stateSigningKey(signingKey));
-}
-export async function verifyConnectTicket(providerId, ticket, signingKey, nowMs = Date.now()) {
-    try {
-        const { payload } = await jwtVerify(ticket, stateSigningKey(signingKey), {
-            algorithms: ["HS256"],
-            typ: ticketTyp(providerId),
-            currentDate: new Date(nowMs),
-        });
-        if (typeof payload.userId !== "string" || !payload.userId) {
-            throw new Error("invalid connect ticket actor");
-        }
-        return { userId: payload.userId };
-    }
-    catch (err) {
-        if (err instanceof Error &&
-            err.message.startsWith("invalid connect ticket")) {
-            throw err;
-        }
-        const message = err instanceof Error ? err.message : String(err);
-        if (/exp|expir/i.test(message)) {
-            throw new Error("connect ticket expired");
-        }
-        throw new Error("invalid connect ticket signature");
-    }
-}
-/**
- * Bind {@link createOauthState} / ticket helpers to a Connect provider id
- * (`mda-{id}-oauth-state`, `mda-{id}-connect-ticket`).
- */
-export function oauthTicketsFor(providerId) {
-    const id = providerId.trim();
-    if (!id) {
-        throw new Error("oauthTicketsFor requires a non-empty providerId");
-    }
-    return {
-        providerId: id,
-        createState: (userId, signingKey, nowMs) => createOauthState(id, userId, signingKey, nowMs),
-        verifyState: (state, signingKey, nowMs) => verifyOauthState(id, state, signingKey, nowMs),
-        createTicket: (userId, signingKey, nowMs) => createConnectTicket(id, userId, signingKey, nowMs),
-        verifyTicket: (ticket, signingKey, nowMs) => verifyConnectTicket(id, ticket, signingKey, nowMs),
-    };
-}
-//# sourceMappingURL=oauth-tickets.js.map

package/dist/identity/oauth-tickets.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-tickets.js","sourceRoot":"","sources":["../../src/identity/oauth-tickets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE1C,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,2FAA2F;AAC3F,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C,SAAS,QAAQ,CAAC,UAAkB;IAClC,OAAO,OAAO,UAAU,cAAc,CAAC;AACzC,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB;IACnC,OAAO,OAAO,UAAU,iBAAiB,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAkB,EAClB,MAAc,EACd,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;IACtD,OAAO,IAAI,OAAO,CAAC;QACjB,MAAM;QACN,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACvC,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;SAC/D,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,GAAG,CAAC;SACtB,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAkB,EAClB,KAAa,EACb,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE;YACtE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,QAAQ,CAAC,UAAU,CAAC;YACzB,WAAW,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC1E,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,MAAc,EACd,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,qBAAqB,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/D,OAAO,IAAI,OAAO,CAAC;QACjB,MAAM;QACN,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACvC,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;SAChE,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,GAAG,CAAC;SACtB,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,MAAc,EACd,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE;YACvE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,SAAS,CAAC,UAAU,CAAC;YAC1B,WAAW,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IACE,GAAG,YAAY,KAAK;YACpB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAChD,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AA2BD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,UAAU,EAAE,EAAE;QACd,WAAW,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CACzC,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;QACjD,WAAW,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CACxC,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC;QAChD,YAAY,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAC1C,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;QACpD,YAAY,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAC1C,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;KACrD,CAAC;AACJ,CAAC"}

package/dist/identity/slack/connect-http.d.ts

@@ -1,35 +0,0 @@
-/**
- * Connect-with-Slack — {@link IdentityConnectProvider} for Slack OIDC linking.
- *
- * Mounted under `/identity/slack/*` when listed on `identity.connect`, or when
- * a Slack channel routes into a user-scoped / custom-credentials deployment
- * (so Events can remap actors and tools can use per-caller tokens).
- */
-import type { IdentityConnectProvider } from "../connect-provider-types.js";
-import { type IdentityLinkStore } from "./links.js";
-export declare const SLACK_CONNECT_STATUS_PATH: string;
-export declare const SLACK_CONNECT_START_PATH: string;
-export declare const SLACK_CONNECT_CALLBACK_PATH: string;
-export declare const SLACK_CONNECT_LINK_PATH: string;
-/** Options for {@link createSlackIdentityConnectProvider}. */
-export interface SlackIdentityConnectProviderOptions {
-    linkStore?: IdentityLinkStore;
-}
-/** Build a Slack connect provider (injectable store for tests). */
-export declare function createSlackIdentityConnectProvider(options?: SlackIdentityConnectProviderOptions): IdentityConnectProvider;
-/** Default Slack connect provider used by the identity-connect registry. */
-export declare const slackIdentityConnectProvider: IdentityConnectProvider;
-/**
- * Opt into Connect-with-Slack on `defineIdentity({ connect: […] })`.
- *
- * @example
- * ```ts
- * import { connect, defineIdentity } from "managed-deepagents";
- *
- * export const identity = defineIdentity({
- *   connect: [connect.slack()],
- * });
- * ```
- */
-export declare function connect(options?: SlackIdentityConnectProviderOptions): IdentityConnectProvider;
-//# sourceMappingURL=connect-http.d.ts.map

package/dist/identity/slack/connect-http.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/slack/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAKV,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAC;AAmBpB,eAAO,MAAM,yBAAyB,QAAe,CAAC;AACtD,eAAO,MAAM,wBAAwB,QAAgB,CAAC;AACtD,eAAO,MAAM,2BAA2B,QAAiB,CAAC;AAC1D,eAAO,MAAM,uBAAuB,QAAa,CAAC;AAElD,8DAA8D;AAC9D,MAAM,WAAW,mCAAmC;IAClD,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAED,mEAAmE;AACnE,wBAAgB,kCAAkC,CAChD,OAAO,GAAE,mCAAwC,GAChD,uBAAuB,CA6FzB;AAED,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,EAAE,uBACL,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,mCAAmC,GAC5C,uBAAuB,CAIzB"}