managed-deepagents 0.5.3-dev.111 → 0.5.3-dev.113

package/dist/identity/actor-subject.d.ts

@@ -1,60 +0,0 @@
-/**
- * Deterministic LangSmith agent_id for an MDA actor's Fleet vault subject.
- *
- * Tokens imported via Connect-with-X and toolserver `?agent_id=` must use the
- * same derivation so each caller reaches their own vault connections. One
- * actor has one agent_id; multiple Fleet OAuth integrations attach as distinct
- * `provider_id`s on that subject.
- */
-import { type FleetOAuthIntegration } from "../connectors/toolserver/integrations.js";
-import type { IdentityConnectMountContext } from "./connect-provider-types.js";
-/**
- * Fixed namespace for MDA actor vault subjects (UUID form).
- * Stable across releases so reconnects hit the same vault row.
- */
-export declare const NAMESPACE_MDA_ACTOR = "c0ffee00-0da0-4111-8111-000000000001";
-export interface AgentIdFromActorOptions {
-    /**
-     * Workspace discriminator so ids do not collide across workspaces.
-     * Defaults to {@link resolveActorDeploymentId} (`LANGSMITH_WORKSPACE_ID`).
-     */
-    deploymentId?: string;
-    /** Override process env (tests). */
-    env?: NodeJS.ProcessEnv;
-    /** Override the UUID namespace (tests). */
-    namespace?: string;
-}
-/**
- * Resolve the workspace slice for {@link agentIdFromActor}.
- *
- * Uses `LANGSMITH_WORKSPACE_ID`, else `"local"`.
- */
-export declare function resolveActorDeploymentId(env?: NodeJS.ProcessEnv): string;
-/**
- * Derive the vault `agent_id` for an authenticated MDA actor.
- *
- * `uuidv5(`${workspaceId}:${userId}`, NAMESPACE_MDA_ACTOR)`.
- */
-export declare function agentIdFromActor(userId: string, options?: AgentIdFromActorOptions): string;
-/** Enable actor-subject routing for a Fleet OAuth integration. */
-export declare function enableActorSubjectIntegration(integrationId: string): void;
-/** True when actor-subject routing is on for `integrationId`. */
-export declare function isActorSubjectIntegrationEnabled(integrationId: string): boolean;
-/**
- * True when `slug` belongs to an enabled Fleet OAuth integration (per-actor
- * `?agent_id=` routing).
- */
-export declare function isActorSubjectSlugEnabled(slug: string | undefined): boolean;
-/** Enabled integration ids (for connect-hint middleware, etc.). */
-export declare function enabledActorSubjectIntegrations(): readonly string[];
-/**
- * Enable actor-subject mode for every Fleet integration implied by connectors on a
- * user-scoped deployment. Agent-scoped deployments keep the shared
- * `MDA_TOOLSERVER_AGENT_ID` subject.
- */
-export declare function enableActorSubjectIntegrationsFromConnectors(connectorKinds: readonly (string | undefined)[] | undefined, scope?: IdentityConnectMountContext["scope"]): void;
-/** Enable a specific integration when connectors imply it (user-scoped only). */
-export declare function enableActorSubjectIntegrationFromConnectors(integration: FleetOAuthIntegration, connectorKinds: readonly (string | undefined)[] | undefined, scope?: IdentityConnectMountContext["scope"]): void;
-/** Test-only reset. */
-export declare function resetActorSubjectEnabledForTests(): void;
-//# sourceMappingURL=actor-subject.d.ts.map

package/dist/identity/actor-subject.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"actor-subject.d.ts","sourceRoot":"","sources":["../../src/identity/actor-subject.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAY/E;;;GAGG;AACH,eAAO,MAAM,mBAAmB,yCAAyC,CAAC;AAE1E,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,uBAA4B,GACpC,MAAM,CAUR;AAKD,kEAAkE;AAClE,wBAAgB,6BAA6B,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAKzE;AAED,iEAAiE;AACjE,wBAAgB,gCAAgC,CAC9C,aAAa,EAAE,MAAM,GACpB,OAAO,CAET;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAG3E;AAED,mEAAmE;AACnE,wBAAgB,+BAA+B,IAAI,SAAS,MAAM,EAAE,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,4CAA4C,CAC1D,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC3C,IAAI,CAcN;AAED,iFAAiF;AACjF,wBAAgB,2CAA2C,CACzD,WAAW,EAAE,qBAAqB,EAClC,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC3C,IAAI,CAON;AAED,uBAAuB;AACvB,wBAAgB,gCAAgC,IAAI,IAAI,CAEvD"}

package/dist/identity/actor-subject.js

@@ -1,107 +0,0 @@
-/**
- * Deterministic LangSmith agent_id for an MDA actor's Fleet vault subject.
- *
- * Tokens imported via Connect-with-X and toolserver `?agent_id=` must use the
- * same derivation so each caller reaches their own vault connections. One
- * actor has one agent_id; multiple Fleet OAuth integrations attach as distinct
- * `provider_id`s on that subject.
- */
-import { v5 as uuidv5 } from "uuid";
-import { MARKETPLACE_MCP_INTEGRATIONS, hasMarketplaceConnector, } from "../connectors/marketplace/catalog.js";
-import { FLEET_OAUTH_INTEGRATIONS, integrationForSlug, hasIntegrationToolServerConnector, } from "../connectors/toolserver/integrations.js";
-function isUserScoped(scope) {
-    if (!scope) {
-        return false;
-    }
-    // Per-caller Connect / actor-subject vault ownership. Memory is unrelated.
-    return scope.credentials === "user" || scope.credentials === "custom";
-}
-/**
- * Fixed namespace for MDA actor vault subjects (UUID form).
- * Stable across releases so reconnects hit the same vault row.
- */
-export const NAMESPACE_MDA_ACTOR = "c0ffee00-0da0-4111-8111-000000000001";
-/**
- * Resolve the workspace slice for {@link agentIdFromActor}.
- *
- * Uses `LANGSMITH_WORKSPACE_ID`, else `"local"`.
- */
-export function resolveActorDeploymentId(env = process.env) {
-    return trimmed(env.LANGSMITH_WORKSPACE_ID) ?? "local";
-}
-/**
- * Derive the vault `agent_id` for an authenticated MDA actor.
- *
- * `uuidv5(`${workspaceId}:${userId}`, NAMESPACE_MDA_ACTOR)`.
- */
-export function agentIdFromActor(userId, options = {}) {
-    const id = userId.trim();
-    if (!id) {
-        throw new Error("agentIdFromActor requires a non-empty userId");
-    }
-    const deploymentId = options.deploymentId?.trim() ||
-        resolveActorDeploymentId(options.env ?? process.env);
-    const namespace = options.namespace ?? NAMESPACE_MDA_ACTOR;
-    return uuidv5(`${deploymentId}:${id}`, namespace);
-}
-/** Integrations with per-actor toolserver subject routing enabled in this process. */
-const enabledIntegrations = new Set();
-/** Enable actor-subject routing for a Fleet OAuth integration. */
-export function enableActorSubjectIntegration(integrationId) {
-    const id = integrationId.trim();
-    if (id) {
-        enabledIntegrations.add(id);
-    }
-}
-/** True when actor-subject routing is on for `integrationId`. */
-export function isActorSubjectIntegrationEnabled(integrationId) {
-    return enabledIntegrations.has(integrationId);
-}
-/**
- * True when `slug` belongs to an enabled Fleet OAuth integration (per-actor
- * `?agent_id=` routing).
- */
-export function isActorSubjectSlugEnabled(slug) {
-    const integration = integrationForSlug(slug);
-    return integration != null && enabledIntegrations.has(integration.id);
-}
-/** Enabled integration ids (for connect-hint middleware, etc.). */
-export function enabledActorSubjectIntegrations() {
-    return [...enabledIntegrations];
-}
-/**
- * Enable actor-subject mode for every Fleet integration implied by connectors on a
- * user-scoped deployment. Agent-scoped deployments keep the shared
- * `MDA_TOOLSERVER_AGENT_ID` subject.
- */
-export function enableActorSubjectIntegrationsFromConnectors(connectorKinds, scope) {
-    if (!isUserScoped(scope)) {
-        return;
-    }
-    for (const integration of FLEET_OAUTH_INTEGRATIONS) {
-        if (hasIntegrationToolServerConnector(integration, connectorKinds)) {
-            enableActorSubjectIntegration(integration.id);
-        }
-    }
-    for (const integration of MARKETPLACE_MCP_INTEGRATIONS) {
-        if (hasMarketplaceConnector(integration.id, connectorKinds)) {
-            enableActorSubjectIntegration(integration.id);
-        }
-    }
-}
-/** Enable a specific integration when connectors imply it (user-scoped only). */
-export function enableActorSubjectIntegrationFromConnectors(integration, connectorKinds, scope) {
-    if (hasIntegrationToolServerConnector(integration, connectorKinds) &&
-        isUserScoped(scope)) {
-        enableActorSubjectIntegration(integration.id);
-    }
-}
-/** Test-only reset. */
-export function resetActorSubjectEnabledForTests() {
-    enabledIntegrations.clear();
-}
-function trimmed(value) {
-    const v = value?.trim();
-    return v ? v : undefined;
-}
-//# sourceMappingURL=actor-subject.js.map

package/dist/identity/actor-subject.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"actor-subject.js","sourceRoot":"","sources":["../../src/identity/actor-subject.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,iCAAiC,GAElC,MAAM,0CAA0C,CAAC;AAGlD,SAAS,YAAY,CACnB,KAAuD;IAEvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IACD,2EAA2E;IAC3E,OAAO,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,sCAAsC,CAAC;AAc1E;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,OAAO,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,OAAO,GAA4B,EAAE;IAErC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE;QAC5B,wBAAwB,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,mBAAmB,CAAC;IAC3D,OAAO,MAAM,CAAC,GAAG,YAAY,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;AACpD,CAAC;AAED,sFAAsF;AACtF,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE9C,kEAAkE;AAClE,MAAM,UAAU,6BAA6B,CAAC,aAAqB;IACjE,MAAM,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,EAAE,EAAE,CAAC;QACP,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,gCAAgC,CAC9C,aAAqB;IAErB,OAAO,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAwB;IAChE,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,WAAW,IAAI,IAAI,IAAI,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,+BAA+B;IAC7C,OAAO,CAAC,GAAG,mBAAmB,CAAC,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4CAA4C,CAC1D,cAA2D,EAC3D,KAA4C;IAE5C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,wBAAwB,EAAE,CAAC;QACnD,IAAI,iCAAiC,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;YACnE,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,4BAA4B,EAAE,CAAC;QACvD,IAAI,uBAAuB,CAAC,WAAW,CAAC,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;YAC5D,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,2CAA2C,CACzD,WAAkC,EAClC,cAA2D,EAC3D,KAA4C;IAE5C,IACE,iCAAiC,CAAC,WAAW,EAAE,cAAc,CAAC;QAC9D,YAAY,CAAC,KAAK,CAAC,EACnB,CAAC;QACD,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,uBAAuB;AACvB,MAAM,UAAU,gCAAgC;IAC9C,mBAAmB,CAAC,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,OAAO,CAAC,KAAyB;IACxC,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACxB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3B,CAAC"}

package/dist/identity/byo-oauth.d.ts

@@ -1,105 +0,0 @@
-/**
- * Factory for optional BYO (bring-your-own) OAuth clients used when Fleet
- * auth-sessions are unavailable.
- *
- * Vendor modules supply endpoints, authorize extras, and userinfo parsing;
- * this module owns config env reading, authorize URL construction, token
- * exchange, and the {@link FleetVaultByoOauth} adapter.
- */
-import type { FleetVaultByoOauth, FleetVaultByoTokenResult } from "./fleet-connect.js";
-import { type OauthTickets } from "./oauth-tickets.js";
-import { resolveOauthRedirectBase } from "./oauth-env.js";
-export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, resolveOauthRedirectBase, resolveSlackOauthRedirectBase, } from "./oauth-env.js";
-/** Shared BYO OAuth client configuration. */
-export interface ByoOauthConfig {
-    clientId: string;
-    clientSecret: string;
-    publicAppUrl: string;
-    scopes: string;
-    authUrl: string;
-    tokenUrl: string;
-    userInfoUrl: string;
-}
-export interface ByoOauthEndpoints {
-    authUrl: string;
-    tokenUrl: string;
-    userInfoUrl: string;
-    /** Space-separated default scopes when env override is absent. */
-    defaultScopes: string;
-}
-export interface ByoOauthUserInfo {
-    email?: string;
-    subject?: string;
-    /** Extra vault / provider metadata merged with {@link CreateByoOauthClientOptions.subjectMetadataKey}. */
-    metadata?: Record<string, unknown>;
-}
-export interface CreateByoOauthClientOptions {
-    /** Connect / ticket provider id, e.g. `"google"`. */
-    providerId: string;
-    /** Human label for error messages ("Google", "Microsoft"). */
-    displayName: string;
-    /**
-     * Env prefix without trailing underscore, e.g. `"GOOGLE_OAUTH"`.
-     * Reads `${prefix}_CLIENT_ID`, `_CLIENT_SECRET`, `_SCOPES`, `_AUTH_URL`,
-     * `_TOKEN_URL`, `_USERINFO_URL` unless overridden by {@link envKeys}.
-     */
-    envPrefix: string;
-    /** Override individual env key names after prefix derivation (e.g. GitHub). */
-    envKeys?: Partial<ByoOauthEnvKeys>;
-    /** Default endpoints + scopes (may read extra env, e.g. tenant). */
-    defaultEndpoints: (env: NodeJS.ProcessEnv) => ByoOauthEndpoints;
-    /**
-     * Extra authorize query params merged after the shared OAuth code-grant
-     * fields. Defaults include `prompt=consent` unless {@link defaultPrompt} is
-     * `false`.
-     */
-    authorizeParams?: Record<string, string>;
-    /**
-     * Default authorize `prompt` value. Set `false` to omit (GitHub).
-     * @default "consent"
-     */
-    defaultPrompt?: string | false;
-    /**
-     * Token exchange request shape. GitHub needs JSON + `Accept: application/json`;
-     * most IdPs use form-urlencoded.
-     */
-    tokenRequest?: {
-        format?: "form" | "json";
-        headers?: Record<string, string>;
-    };
-    /** UserInfo /profile request options. */
-    userInfoRequest?: {
-        headers?: Record<string, string>;
-        /** When true, a failed or incomplete userinfo response throws. */
-        required?: boolean;
-    };
-    /** Map a userinfo /me JSON body to email + subject (+ optional metadata). */
-    parseUserInfo: (json: Record<string, unknown>) => ByoOauthUserInfo;
-    /** Vault metadata key for the IdP subject (e.g. `google_sub`). */
-    subjectMetadataKey: string;
-}
-export interface ByoOauthEnvKeys {
-    clientId: string;
-    clientSecret: string;
-    scopes: string;
-    authUrl: string;
-    tokenUrl: string;
-    userInfoUrl: string;
-}
-/** BYO OAuth client produced by {@link createByoOauthClient}. */
-export interface ByoOauthClient {
-    providerId: string;
-    displayName: string;
-    env: ByoOauthEnvKeys;
-    tickets: OauthTickets;
-    resolveRedirectBase: typeof resolveOauthRedirectBase;
-    readConfig(env?: NodeJS.ProcessEnv): ByoOauthConfig | null;
-    buildAuthorizeUrl(config: ByoOauthConfig, state: string, redirectUri: string, scopes?: string): string;
-    exchangeCode(config: ByoOauthConfig, code: string, redirectUri: string, fetchImpl?: typeof fetch): Promise<FleetVaultByoTokenResult>;
-    /** Ready for `createFleetVaultConnectProvider({ byo })`. */
-    byo: FleetVaultByoOauth;
-    resolvePublicAppUrl(env?: NodeJS.ProcessEnv): string | undefined;
-}
-/** Build a BYO OAuth client for one Fleet vault Connect integration. */
-export declare function createByoOauthClient(options: CreateByoOauthClientOptions): ByoOauthClient;
-//# sourceMappingURL=byo-oauth.d.ts.map

package/dist/identity/byo-oauth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"byo-oauth.d.ts","sourceRoot":"","sources":["../../src/identity/byo-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAGL,wBAAwB,EACzB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC;AAExB,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0GAA0G;IAC1G,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,2BAA2B;IAC1C,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACnC,oEAAoE;IACpE,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,iBAAiB,CAAC;IAChE;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC/B;;;OAGG;IACH,YAAY,CAAC,EAAE;QACb,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,CAAC;IACF,yCAAyC;IACzC,eAAe,CAAC,EAAE;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,kEAAkE;QAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;IACF,6EAA6E;IAC7E,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,gBAAgB,CAAC;IACnE,kEAAkE;IAClE,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,eAAe,CAAC;IACrB,OAAO,EAAE,YAAY,CAAC;IACtB,mBAAmB,EAAE,OAAO,wBAAwB,CAAC;IACrD,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,cAAc,GAAG,IAAI,CAAC;IAC3D,iBAAiB,CACf,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC;IACV,YAAY,CACV,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,OAAO,KAAK,GACvB,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrC,4DAA4D;IAC5D,GAAG,EAAE,kBAAkB,CAAC;IACxB,mBAAmB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;CAClE;AAiBD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,2BAA2B,GACnC,cAAc,CA2NhB"}

package/dist/identity/byo-oauth.js

@@ -1,190 +0,0 @@
-/**
- * Factory for optional BYO (bring-your-own) OAuth clients used when Fleet
- * auth-sessions are unavailable.
- *
- * Vendor modules supply endpoints, authorize extras, and userinfo parsing;
- * this module owns config env reading, authorize URL construction, token
- * exchange, and the {@link FleetVaultByoOauth} adapter.
- */
-import { fetchWithTimeout, PROVIDER_HTTP_TIMEOUT_MS } from "../runtime/http.js";
-import { oauthTicketsFor } from "./oauth-tickets.js";
-import { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, resolveOauthRedirectBase, } from "./oauth-env.js";
-export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, resolveOauthRedirectBase, resolveSlackOauthRedirectBase, } from "./oauth-env.js";
-function stripSlash(value) {
-    return value.replace(/\/$/, "");
-}
-function envKeysFromPrefix(prefix) {
-    return {
-        clientId: `${prefix}_CLIENT_ID`,
-        clientSecret: `${prefix}_CLIENT_SECRET`,
-        scopes: `${prefix}_SCOPES`,
-        authUrl: `${prefix}_AUTH_URL`,
-        tokenUrl: `${prefix}_TOKEN_URL`,
-        userInfoUrl: `${prefix}_USERINFO_URL`,
-    };
-}
-/** Build a BYO OAuth client for one Fleet vault Connect integration. */
-export function createByoOauthClient(options) {
-    const keys = { ...envKeysFromPrefix(options.envPrefix), ...options.envKeys };
-    const tickets = oauthTicketsFor(options.providerId);
-    const authorizeExtras = {
-        ...(options.defaultPrompt === false
-            ? {}
-            : { prompt: options.defaultPrompt ?? "consent" }),
-        ...options.authorizeParams,
-    };
-    const tokenFormat = options.tokenRequest?.format ?? "form";
-    const tokenHeaders = options.tokenRequest?.headers;
-    const userInfoHeaders = options.userInfoRequest?.headers;
-    const requireUserInfo = options.userInfoRequest?.required ?? false;
-    function readConfig(env = process.env) {
-        const clientId = env[keys.clientId]?.trim();
-        const clientSecret = env[keys.clientSecret]?.trim();
-        const publicAppUrl = env[MDA_PUBLIC_APP_URL_ENV]?.trim() ||
-            env[MDA_PUBLIC_API_URL_ENV]?.trim();
-        if (!clientId || !clientSecret || !publicAppUrl) {
-            return null;
-        }
-        const defaults = options.defaultEndpoints(env);
-        return {
-            clientId,
-            clientSecret,
-            publicAppUrl: stripSlash(publicAppUrl),
-            scopes: env[keys.scopes]?.trim() || defaults.defaultScopes,
-            authUrl: stripSlash(env[keys.authUrl]?.trim() || defaults.authUrl),
-            tokenUrl: stripSlash(env[keys.tokenUrl]?.trim() || defaults.tokenUrl),
-            userInfoUrl: stripSlash(env[keys.userInfoUrl]?.trim() || defaults.userInfoUrl),
-        };
-    }
-    function buildAuthorizeUrl(config, state, redirectUri, scopes) {
-        const url = new URL(config.authUrl);
-        url.searchParams.set("client_id", config.clientId);
-        url.searchParams.set("redirect_uri", redirectUri);
-        url.searchParams.set("response_type", "code");
-        url.searchParams.set("scope", scopes?.trim() || config.scopes);
-        url.searchParams.set("state", state);
-        for (const [key, value] of Object.entries(authorizeExtras)) {
-            url.searchParams.set(key, value);
-        }
-        return url.toString();
-    }
-    async function exchangeCode(config, code, redirectUri, fetchImpl = fetch) {
-        const tokenInit = tokenFormat === "json"
-            ? {
-                method: "POST",
-                headers: {
-                    "Content-Type": "application/json",
-                    ...tokenHeaders,
-                },
-                body: JSON.stringify({
-                    client_id: config.clientId,
-                    client_secret: config.clientSecret,
-                    code,
-                    redirect_uri: redirectUri,
-                }),
-            }
-            : {
-                method: "POST",
-                headers: {
-                    "Content-Type": "application/x-www-form-urlencoded",
-                    ...tokenHeaders,
-                },
-                body: new URLSearchParams({
-                    code,
-                    client_id: config.clientId,
-                    client_secret: config.clientSecret,
-                    redirect_uri: redirectUri,
-                    grant_type: "authorization_code",
-                }),
-            };
-        const tokenResponse = await fetchWithTimeout(config.tokenUrl, tokenInit, PROVIDER_HTTP_TIMEOUT_MS, fetchImpl);
-        const tokenJson = (await tokenResponse.json());
-        if (!tokenResponse.ok || !tokenJson.access_token) {
-            throw new Error(tokenJson.error_description ??
-                tokenJson.error ??
-                `${options.displayName} OAuth token exchange failed`);
-        }
-        let accountLabel;
-        let subject;
-        let extraMetadata;
-        try {
-            const userResponse = await fetchWithTimeout(config.userInfoUrl, {
-                headers: {
-                    Authorization: `Bearer ${tokenJson.access_token}`,
-                    ...userInfoHeaders,
-                },
-            }, PROVIDER_HTTP_TIMEOUT_MS, fetchImpl);
-            if (!userResponse.ok) {
-                if (requireUserInfo) {
-                    const errJson = (await userResponse.json().catch(() => ({})));
-                    throw new Error(errJson.message ?? `${options.displayName} userinfo lookup failed`);
-                }
-            }
-            else {
-                const userJson = (await userResponse.json());
-                const parsed = options.parseUserInfo(userJson);
-                if (parsed.email) {
-                    accountLabel = parsed.email;
-                }
-                if (parsed.subject) {
-                    subject = parsed.subject;
-                }
-                if (parsed.metadata) {
-                    extraMetadata = parsed.metadata;
-                }
-                if (requireUserInfo && !subject) {
-                    throw new Error(`${options.displayName} userinfo missing subject`);
-                }
-            }
-        }
-        catch (error) {
-            if (requireUserInfo) {
-                throw error;
-            }
-            // Account label is optional for vault import.
-        }
-        const metadata = {
-            ...extraMetadata,
-            ...(subject ? { [options.subjectMetadataKey]: subject } : {}),
-        };
-        return {
-            accessToken: tokenJson.access_token,
-            ...(tokenJson.refresh_token
-                ? { refreshToken: tokenJson.refresh_token }
-                : {}),
-            ...(typeof tokenJson.expires_in === "number"
-                ? { expiresInSeconds: tokenJson.expires_in }
-                : {}),
-            ...(tokenJson.scope ? { scope: tokenJson.scope } : {}),
-            ...(tokenJson.token_type ? { tokenType: tokenJson.token_type } : {}),
-            ...(accountLabel ? { accountLabel } : {}),
-            ...(Object.keys(metadata).length > 0 ? { metadata } : {}),
-        };
-    }
-    const byo = {
-        readConfig,
-        buildAuthorizeUrl(config, state, redirectUri, scopes) {
-            return buildAuthorizeUrl(config, state, redirectUri, scopes);
-        },
-        exchangeCode(config, code, redirectUri) {
-            return exchangeCode(config, code, redirectUri);
-        },
-    };
-    function resolvePublicAppUrl(env = process.env) {
-        return (readConfig(env)?.publicAppUrl ??
-            env[MDA_PUBLIC_APP_URL_ENV]?.trim().replace(/\/$/, ""));
-    }
-    return {
-        providerId: options.providerId,
-        displayName: options.displayName,
-        env: keys,
-        tickets,
-        resolveRedirectBase: resolveOauthRedirectBase,
-        readConfig,
-        buildAuthorizeUrl,
-        exchangeCode,
-        byo,
-        resolvePublicAppUrl,
-    };
-}
-//# sourceMappingURL=byo-oauth.js.map

package/dist/identity/byo-oauth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"byo-oauth.js","sourceRoot":"","sources":["../../src/identity/byo-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAKhF,OAAO,EAAE,eAAe,EAAqB,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC;AA4GxB,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO;QACL,QAAQ,EAAE,GAAG,MAAM,YAAY;QAC/B,YAAY,EAAE,GAAG,MAAM,gBAAgB;QACvC,MAAM,EAAE,GAAG,MAAM,SAAS;QAC1B,OAAO,EAAE,GAAG,MAAM,WAAW;QAC7B,QAAQ,EAAE,GAAG,MAAM,YAAY;QAC/B,WAAW,EAAE,GAAG,MAAM,eAAe;KACtC,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,oBAAoB,CAClC,OAAoC;IAEpC,MAAM,IAAI,GAAG,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7E,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,eAAe,GAA2B;QAC9C,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,KAAK;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,aAAa,IAAI,SAAS,EAAE,CAAC;QACnD,GAAG,OAAO,CAAC,eAAe;KAC3B,CAAC;IACF,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,MAAM,IAAI,MAAM,CAAC;IAC3D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC;IACnD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC;IACzD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,QAAQ,IAAI,KAAK,CAAC;IAEnE,SAAS,UAAU,CACjB,GAAG,GAAsB,OAAO,CAAC,GAAG;QAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;QAC5C,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QACpD,MAAM,YAAY,GAChB,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE;YACnC,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO;YACL,QAAQ;YACR,YAAY;YACZ,YAAY,EAAE,UAAU,CAAC,YAAY,CAAC;YACtC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,aAAa;YAC1D,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC;YAClE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC;YACrE,WAAW,EAAE,UAAU,CACrB,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,WAAW,CACtD;SACF,CAAC;IACJ,CAAC;IAED,SAAS,iBAAiB,CACxB,MAAsB,EACtB,KAAa,EACb,WAAmB,EACnB,MAAe;QAEf,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,UAAU,YAAY,CACzB,MAAsB,EACtB,IAAY,EACZ,WAAmB,EACnB,SAAS,GAAiB,KAAK;QAE/B,MAAM,SAAS,GACb,WAAW,KAAK,MAAM;YACpB,CAAC,CAAC;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,YAAY;iBAChB;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;oBAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;oBAClC,IAAI;oBACJ,YAAY,EAAE,WAAW;iBAC1B,CAAC;aACH;YACH,CAAC,CAAC;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,GAAG,YAAY;iBAChB;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,IAAI;oBACJ,SAAS,EAAE,MAAM,CAAC,QAAQ;oBAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;oBAClC,YAAY,EAAE,WAAW;oBACzB,UAAU,EAAE,oBAAoB;iBACjC,CAAC;aACH,CAAC;QAER,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAC1C,MAAM,CAAC,QAAQ,EACf,SAAS,EACT,wBAAwB,EACxB,SAAS,CACV,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAQ5C,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,SAAS,CAAC,iBAAiB;gBACzB,SAAS,CAAC,KAAK;gBACf,GAAG,OAAO,CAAC,WAAW,8BAA8B,CACvD,CAAC;QACJ,CAAC;QAED,IAAI,YAAgC,CAAC;QACrC,IAAI,OAA2B,CAAC;QAChC,IAAI,aAAkD,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,MAAM,CAAC,WAAW,EAClB;gBACE,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE;oBACjD,GAAG,eAAe;iBACnB;aACF,EACD,wBAAwB,EACxB,SAAS,CACV,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;gBACrB,IAAI,eAAe,EAAE,CAAC;oBACpB,MAAM,OAAO,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAE3D,CAAC;oBACF,MAAM,IAAI,KAAK,CACb,OAAO,CAAC,OAAO,IAAI,GAAG,OAAO,CAAC,WAAW,yBAAyB,CACnE,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAA4B,CAAC;gBACxE,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC/C,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC9B,CAAC;gBACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;gBAC3B,CAAC;gBACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACpB,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;gBAClC,CAAC;gBACD,IAAI,eAAe,IAAI,CAAC,OAAO,EAAE,CAAC;oBAChC,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,WAAW,2BAA2B,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,8CAA8C;QAChD,CAAC;QAED,MAAM,QAAQ,GAAG;YACf,GAAG,aAAa;YAChB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;QAEF,OAAO;YACL,WAAW,EAAE,SAAS,CAAC,YAAY;YACnC,GAAG,CAAC,SAAS,CAAC,aAAa;gBACzB,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,aAAa,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ;gBAC1C,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,UAAU,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAuB;QAC9B,UAAU;QACV,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM;YAClD,OAAO,iBAAiB,CACtB,MAAwB,EACxB,KAAK,EACL,WAAW,EACX,MAAM,CACP,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW;YACpC,OAAO,YAAY,CAAC,MAAwB,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACnE,CAAC;KACF,CAAC;IAEF,SAAS,mBAAmB,CAC1B,GAAG,GAAsB,OAAO,CAAC,GAAG;QAEpC,OAAO,CACL,UAAU,CAAC,GAAG,CAAC,EAAE,YAAY;YAC7B,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACvD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,IAAI;QACT,OAAO;QACP,mBAAmB,EAAE,wBAAwB;QAC7C,UAAU;QACV,iBAAiB;QACjB,YAAY;QACZ,GAAG;QACH,mBAAmB;KACpB,CAAC;AACJ,CAAC"}

package/dist/identity/connect-inference.d.ts

@@ -1,37 +0,0 @@
-/**
- * Predicates the built-in Connect-with-X providers use to decide whether a
- * deployment needs their OAuth routes.
- *
- * Authors should not have to list a connect provider that the rest of their
- * identity already implies — a credential chain that reads user GitHub tokens
- * on a user-scoped deployment needs Connect-with-GitHub, and a Slack channel on
- * a per-user deployment needs somewhere to link Slack accounts.
- */
-import type { IdentityConnectMountContext } from "./connect-provider-types.js";
-export { FLEET_OAUTH_INTEGRATIONS, GOOGLE_TOOLSERVER_SLUGS, LINKEDIN_TOOLSERVER_SLUGS, MICROSOFT_TOOLSERVER_SLUGS, integrationConnectorKinds, integrationById, integrationForSlug, googleConnectorKinds, googleScopesForConnectorKinds, hasIntegrationToolServerConnector, hasGoogleToolServerConnector, hasLinkedInToolServerConnector, hasMicrosoftToolServerConnector, isFleetOAuthSlug, isGoogleToolServerSlug, isLinkedInToolServerSlug, isMicrosoftToolServerSlug, linkedinConnectorKinds, linkedinScopesForConnectorKinds, microsoftConnectorKinds, microsoftScopesForConnectorKinds, scopesForIntegrationConnectorKinds, type FleetOAuthIntegration, type GoogleToolServerSlug, type LinkedInToolServerSlug, type MicrosoftToolServerSlug, } from "../connectors/toolserver/integrations.js";
-/**
- * True when the deployment keys anything durable on the individual caller.
- *
- * This is the condition under which a per-user OAuth link is meaningful: an
- * `agent`-scoped deployment has no per-caller slice to attach a linked account
- * to, so it never grows connect routes by inference.
- */
-export declare function isUserScopedDeployment(scope: IdentityConnectMountContext["scope"]): boolean;
-/** True when a channel of `provider` is declared (e.g. a Slack channel). */
-export declare function hasChannelForProvider(channels: IdentityConnectMountContext["channels"], provider: string): boolean;
-/**
- * True when the deployment declares a connector whose kind is `"github"`.
- *
- * Retained for Connect-with-GitHub inference if a future surface reintroduces a
- * GitHub connector kind; today Connect mounts from `credentials.github` instead.
- */
-export declare function hasGithubConnector(connectorKinds: IdentityConnectMountContext["connectorKinds"]): boolean;
-/**
- * Connect provider ids the deployment's credential resolvers depend on.
- *
- * Unions across a per-target map, so a multi-platform deployment is treated the
- * same as a single-platform one.
- */
-export declare function credentialConnectIds(credentials: IdentityConnectMountContext["credentials"]): Set<string>;
-export declare function isGoogleConnectorKind(kind: string | undefined): boolean;
-//# sourceMappingURL=connect-inference.d.ts.map

package/dist/identity/connect-inference.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-inference.d.ts","sourceRoot":"","sources":["../../src/identity/connect-inference.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAG/E,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,8BAA8B,EAC9B,+BAA+B,EAC/B,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,gCAAgC,EAChC,kCAAkC,EAClC,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,0CAA0C,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC1C,OAAO,CAOT;AAED,4EAA4E;AAC5E,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,2BAA2B,CAAC,UAAU,CAAC,EACjD,QAAQ,EAAE,MAAM,GACf,OAAO,CAIT;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,cAAc,EAAE,2BAA2B,CAAC,gBAAgB,CAAC,GAC5D,OAAO,CAET;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,2BAA2B,CAAC,aAAa,CAAC,GACtD,GAAG,CAAC,MAAM,CAAC,CAIb;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEvE"}

package/dist/identity/connect-inference.js

@@ -1,53 +0,0 @@
-/**
- * Predicates the built-in Connect-with-X providers use to decide whether a
- * deployment needs their OAuth routes.
- *
- * Authors should not have to list a connect provider that the rest of their
- * identity already implies — a credential chain that reads user GitHub tokens
- * on a user-scoped deployment needs Connect-with-GitHub, and a Slack channel on
- * a per-user deployment needs somewhere to link Slack accounts.
- */
-import { isGoogleToolServerSlug } from "../connectors/toolserver/integrations.js";
-import { credentialConnectProviders } from "./credential-resolvers.js";
-export { FLEET_OAUTH_INTEGRATIONS, GOOGLE_TOOLSERVER_SLUGS, LINKEDIN_TOOLSERVER_SLUGS, MICROSOFT_TOOLSERVER_SLUGS, integrationConnectorKinds, integrationById, integrationForSlug, googleConnectorKinds, googleScopesForConnectorKinds, hasIntegrationToolServerConnector, hasGoogleToolServerConnector, hasLinkedInToolServerConnector, hasMicrosoftToolServerConnector, isFleetOAuthSlug, isGoogleToolServerSlug, isLinkedInToolServerSlug, isMicrosoftToolServerSlug, linkedinConnectorKinds, linkedinScopesForConnectorKinds, microsoftConnectorKinds, microsoftScopesForConnectorKinds, scopesForIntegrationConnectorKinds, } from "../connectors/toolserver/integrations.js";
-/**
- * True when the deployment keys anything durable on the individual caller.
- *
- * This is the condition under which a per-user OAuth link is meaningful: an
- * `agent`-scoped deployment has no per-caller slice to attach a linked account
- * to, so it never grows connect routes by inference.
- */
-export function isUserScopedDeployment(scope) {
-    if (!scope) {
-        return false;
-    }
-    // Per-caller Connect is meaningful when credentials are owned by the caller
-    // (`"user"`) or a custom resolver. Memory isolation is a separate axis.
-    return scope.credentials === "user" || scope.credentials === "custom";
-}
-/** True when a channel of `provider` is declared (e.g. a Slack channel). */
-export function hasChannelForProvider(channels, provider) {
-    return Object.values(channels ?? {}).some((manifest) => manifest?.provider === provider);
-}
-/**
- * True when the deployment declares a connector whose kind is `"github"`.
- *
- * Retained for Connect-with-GitHub inference if a future surface reintroduces a
- * GitHub connector kind; today Connect mounts from `credentials.github` instead.
- */
-export function hasGithubConnector(connectorKinds) {
-    return (connectorKinds ?? []).some((kind) => kind === "github");
-}
-/**
- * Connect provider ids the deployment's credential resolvers depend on.
- *
- * Unions across a per-target map, so a multi-platform deployment is treated the
- * same as a single-platform one.
- */
-export function credentialConnectIds(credentials) {
-    return new Set(credentialConnectProviders(credentials).map((provider) => provider.id));
-}
-export function isGoogleConnectorKind(kind) {
-    return isGoogleToolServerSlug(kind);
-}
-//# sourceMappingURL=connect-inference.js.map

package/dist/identity/connect-inference.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-inference.js","sourceRoot":"","sources":["../../src/identity/connect-inference.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAElF,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAEvE,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,EAC5B,8BAA8B,EAC9B,+BAA+B,EAC/B,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,+BAA+B,EAC/B,uBAAuB,EACvB,gCAAgC,EAChC,kCAAkC,GAKnC,MAAM,0CAA0C,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAA2C;IAE3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IACD,4EAA4E;IAC5E,wEAAwE;IACxE,OAAO,KAAK,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC;AACxE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CACnC,QAAiD,EACjD,QAAgB;IAEhB,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CACvC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAC9C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,cAA6D;IAE7D,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAuD;IAEvD,OAAO,IAAI,GAAG,CACZ,0BAA0B,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC"}

package/dist/identity/connect-paths.d.ts

@@ -1,8 +0,0 @@
-/** Path helpers for Connect-with-X providers under `/identity/{id}/…`. */
-export declare function identityConnectPaths(id: string): {
-    status: string;
-    connect: string;
-    callback: string;
-    link: string;
-};
-//# sourceMappingURL=connect-paths.d.ts.map

package/dist/identity/connect-paths.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-paths.d.ts","sourceRoot":"","sources":["../../src/identity/connect-paths.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAE1E,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd,CAQA"}

package/dist/identity/connect-paths.js

@@ -1,11 +0,0 @@
-/** Path helpers for Connect-with-X providers under `/identity/{id}/…`. */
-export function identityConnectPaths(id) {
-    const base = `/identity/${id}`;
-    return {
-        status: `${base}/status`,
-        connect: `${base}/connect`,
-        callback: `${base}/callback`,
-        link: `${base}/link`,
-    };
-}
-//# sourceMappingURL=connect-paths.js.map

package/dist/identity/connect-paths.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-paths.js","sourceRoot":"","sources":["../../src/identity/connect-paths.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAE1E,MAAM,UAAU,oBAAoB,CAAC,EAAU;IAM7C,MAAM,IAAI,GAAG,aAAa,EAAE,EAAE,CAAC;IAC/B,OAAO;QACL,MAAM,EAAE,GAAG,IAAI,SAAS;QACxB,OAAO,EAAE,GAAG,IAAI,UAAU;QAC1B,QAAQ,EAAE,GAAG,IAAI,WAAW;QAC5B,IAAI,EAAE,GAAG,IAAI,OAAO;KACrB,CAAC;AACJ,CAAC"}