managed-deepagents 0.5.3-dev.111 → 0.5.3-dev.113

package/dist/identity/connect-provider-types.d.ts

@@ -1,97 +0,0 @@
-/**
- * Connect-with-X plugin contract.
- *
- * List providers on `identity.connect` (e.g. `connect.github()`) to mount
- * `/identity/{id}/{status,connect,callback,link}` from the managed HTTP app.
- * Built-in providers also mount when the deployment implies them (see
- * {@link IdentityConnectMountContext}).
- */
-import type { IdentityConfig } from "./types.js";
-/** Context for deciding whether a provider's routes should mount. */
-export interface IdentityConnectMountContext {
-    /** Compiled channel manifests (file stem → manifest). */
-    channels?: Record<string, {
-        provider?: string;
-    }>;
-    /** True when the project declared managed identity. */
-    hasIdentity: boolean;
-    /**
-     * True when this provider appears on `identity.connect`. False when it is
-     * offered as a built-in candidate, in which case the provider's own predicate
-     * decides whether the deployment needs it.
-     */
-    declared?: boolean;
-    /** The deployment's resolved isolation axes. */
-    scope?: IdentityConfig["scope"];
-    /**
-     * The deployment's credential config, when one is declared: a single resolver
-     * or a per-target map. Prefer `credentialConnectIds(ctx.credentials)` over
-     * reading it directly, so both forms are handled.
-     */
-    credentials?: IdentityConfig["credentials"];
-    /**
-     * Connector `kind` values discovered for the deployment (toolserver slugs,
-     * `github`, `slack`, …). Used to infer Connect-with-X from matching
-     * connectors (GitHub, Google, Microsoft, LinkedIn) without listing
-     * `connect.<provider>()` on identity.
-     */
-    connectorKinds?: readonly (string | undefined)[];
-}
-/** JSON object returned by status / error payloads. */
-export type IdentityConnectJson = Record<string, unknown>;
-export type IdentityConnectAuthorizeResult = {
-    authorizeUrl: string;
-} | {
-    notConfigured: true;
-    error: string;
-};
-export type IdentityConnectCallbackResult = {
-    /** Absolute URL to redirect the browser after a successful link. */
-    successRedirect: string;
-};
-/** Inputs for resolving the OAuth `redirect_uri` base (no path). */
-export interface IdentityConnectRedirectBaseOptions {
-    requestUrl: string;
-    headers?: Headers | {
-        get(name: string): string | null | undefined;
-    };
-    deploymentBaseUrl?: string;
-}
-/**
- * Pluggable Connect-with-X provider.
- *
- * OAuth/OIDC exchange and persistence stay in the provider module; the shared
- * scaffold only owns HTTP choreography.
- */
-export interface IdentityConnectProvider {
-    /** Path segment under `/identity/{id}/…` (e.g. `"slack"`, `"stripe"`). */
-    readonly id: string;
-    /**
-     * Query key for post-OAuth settings redirects (`/settings?{key}=connected`).
-     * Defaults to {@link id}.
-     */
-    readonly settingsQueryKey?: string;
-    /** Whether to mount this provider's four routes for the current project. */
-    shouldMount(ctx: IdentityConnectMountContext): boolean;
-    /** Secured status payload for the authenticated user. */
-    status(userId: string): IdentityConnectJson | Promise<IdentityConnectJson>;
-    /** Begin OAuth — return authorize URL or a not-configured error. */
-    startAuthorize(userId: string, redirectUri: string): IdentityConnectAuthorizeResult | Promise<IdentityConnectAuthorizeResult>;
-    /**
-     * Finish OAuth callback. Throw on failure; the scaffold redirects to
-     * `/settings?{settingsQueryKey}=error`.
-     */
-    completeCallback(code: string, state: string, redirectUri: string): IdentityConnectCallbackResult | Promise<IdentityConnectCallbackResult>;
-    /** Remove the user's link / stored credentials. */
-    unlink(userId: string): void | Promise<void>;
-    /** Resolve the public Agent Server base for `redirect_uri`. */
-    resolveRedirectBase(options: IdentityConnectRedirectBaseOptions): string;
-    /** Public app origin for settings fail/success redirects when available. */
-    resolvePublicAppUrl?(): string | undefined;
-    /**
-     * Optional: resolve a caller from a signed `?ticket=` on the connect start
-     * route (channel actors without a browser session). Returns the actor user id.
-     */
-    resolveConnectTicket?(ticket: string): string | Promise<string>;
-}
-//# sourceMappingURL=connect-provider-types.d.ts.map

package/dist/identity/connect-provider-types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-provider-types.d.ts","sourceRoot":"","sources":["../../src/identity/connect-provider-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,qEAAqE;AACrE,MAAM,WAAW,2BAA2B;IAC1C,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,uDAAuD;IACvD,WAAW,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IAChC;;;;OAIG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,cAAc,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;CAClD;AAED,uDAAuD;AACvD,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1D,MAAM,MAAM,8BAA8B,GACtC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,GACxB;IAAE,aAAa,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C,MAAM,MAAM,6BAA6B,GAAG;IAC1C,oEAAoE;IACpE,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,oEAAoE;AACpE,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;KAAE,CAAC;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,4EAA4E;IAC5E,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC;IACvD,yDAAyD;IACzD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC3E,oEAAoE;IACpE,cAAc,CACZ,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,8BAA8B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC5E;;;OAGG;IACH,gBAAgB,CACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,6BAA6B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC1E,mDAAmD;IACnD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,+DAA+D;IAC/D,mBAAmB,CAAC,OAAO,EAAE,kCAAkC,GAAG,MAAM,CAAC;IACzE,4EAA4E;IAC5E,mBAAmB,CAAC,IAAI,MAAM,GAAG,SAAS,CAAC;IAC3C;;;OAGG;IACH,oBAAoB,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACjE"}

package/dist/identity/connect-provider-types.js

@@ -1,10 +0,0 @@
-/**
- * Connect-with-X plugin contract.
- *
- * List providers on `identity.connect` (e.g. `connect.github()`) to mount
- * `/identity/{id}/{status,connect,callback,link}` from the managed HTTP app.
- * Built-in providers also mount when the deployment implies them (see
- * {@link IdentityConnectMountContext}).
- */
-export {};
-//# sourceMappingURL=connect-provider-types.js.map

package/dist/identity/connect-provider-types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-provider-types.js","sourceRoot":"","sources":["../../src/identity/connect-provider-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/identity/connect-provider.d.ts

@@ -1,35 +0,0 @@
-/**
- * Shared Connect-with-X HTTP scaffold.
- *
- * Authors opt in via `identity.connect` (see {@link mountIdentityConnectProviders}).
- */
-import type { Hono } from "hono";
-import type { IdentityConfig } from "./index.js";
-import type { IdentityConnectMountContext, IdentityConnectProvider } from "./connect-provider-types.js";
-export type { IdentityConnectAuthorizeResult, IdentityConnectCallbackResult, IdentityConnectJson, IdentityConnectMountContext, IdentityConnectProvider, IdentityConnectRedirectBaseOptions, } from "./connect-provider-types.js";
-export { identityConnectPaths } from "./connect-paths.js";
-/** A route recorded for build/startup visibility. */
-export interface IdentityConnectMountedRoute {
-    connector: string;
-    method: string;
-    path: string;
-    secured: boolean;
-}
-export declare function identityConnectSettingsQueryKey(provider: IdentityConnectProvider): string;
-/**
- * Mount Connect-with-X routes.
- *
- * Declared providers (`defineIdentity({ connect: [connect.github(), …] })`) are
- * offered first, then any `candidates` the deployment did not list. Every
- * provider still decides for itself via `shouldMount`, which sees whether it was
- * declared — so a built-in can mount because the rest of the identity implies it
- * without ever mounting on a deployment that has no use for it.
- */
-export declare function mountIdentityConnectProviders(app: Hono, cfg: IdentityConfig, ctx: IdentityConnectMountContext, mounted: IdentityConnectMountedRoute[], options?: {
-    deploymentBaseUrl?: string;
-    /** Providers from `identity.connect`. */
-    providers?: IdentityConnectProvider[];
-    /** Built-in providers to offer when the deployment did not list them. */
-    candidates?: IdentityConnectProvider[];
-}): void;
-//# sourceMappingURL=connect-provider.d.ts.map

package/dist/identity/connect-provider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-provider.d.ts","sourceRoot":"","sources":["../../src/identity/connect-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,6BAA6B,CAAC;AAIrC,YAAY,EACV,8BAA8B,EAC9B,6BAA6B,EAC7B,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,kCAAkC,GACnC,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,uBAAuB,GAChC,MAAM,CAER;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,EACT,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,2BAA2B,EAChC,OAAO,EAAE,2BAA2B,EAAE,EACtC,OAAO,GAAE;IACP,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yCAAyC;IACzC,SAAS,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACtC,yEAAyE;IACzE,UAAU,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACnC,GACL,IAAI,CAeN"}

package/dist/identity/connect-provider.js

@@ -1,148 +0,0 @@
-/**
- * Shared Connect-with-X HTTP scaffold.
- *
- * Authors opt in via `identity.connect` (see {@link mountIdentityConnectProviders}).
- */
-import { identityConnectPaths } from "./connect-paths.js";
-import { resolveRequestIdentity } from "../runtime/auth.js";
-import { MDA_PUBLIC_APP_URL_ENV } from "./oauth-env.js";
-export { identityConnectPaths } from "./connect-paths.js";
-export function identityConnectSettingsQueryKey(provider) {
-    return provider.settingsQueryKey?.trim() || provider.id;
-}
-/**
- * Mount Connect-with-X routes.
- *
- * Declared providers (`defineIdentity({ connect: [connect.github(), …] })`) are
- * offered first, then any `candidates` the deployment did not list. Every
- * provider still decides for itself via `shouldMount`, which sees whether it was
- * declared — so a built-in can mount because the rest of the identity implies it
- * without ever mounting on a deployment that has no use for it.
- */
-export function mountIdentityConnectProviders(app, cfg, ctx, mounted, options = {}) {
-    const declared = options.providers ?? [];
-    const declaredIds = new Set(declared.map((provider) => provider.id));
-    const offered = [
-        ...declared.map((provider) => ({ provider, declared: true })),
-        ...(options.candidates ?? [])
-            .filter((provider) => !declaredIds.has(provider.id))
-            .map((provider) => ({ provider, declared: false })),
-    ];
-    for (const { provider, declared: isDeclared } of offered) {
-        if (!provider.shouldMount({ ...ctx, declared: isDeclared })) {
-            continue;
-        }
-        mountOneIdentityConnectProvider(app, cfg, provider, mounted, options);
-    }
-}
-function mountOneIdentityConnectProvider(app, cfg, provider, mounted, options) {
-    const paths = identityConnectPaths(provider.id);
-    const settingsKey = identityConnectSettingsQueryKey(provider);
-    const label = `identity:${provider.id}-connect`;
-    for (const route of [
-        { method: "get", path: paths.status, secured: true },
-        { method: "get", path: paths.connect, secured: true },
-        { method: "get", path: paths.callback, secured: false },
-        { method: "delete", path: paths.link, secured: true },
-    ]) {
-        mounted.push({
-            connector: label,
-            method: route.method,
-            path: route.path,
-            secured: route.secured,
-        });
-    }
-    app.get(paths.status, async (c) => {
-        const identity = await resolveOrUnauthorized(cfg, c.req.raw);
-        if (identity instanceof Response) {
-            return identity;
-        }
-        return c.json(await provider.status(identity.user.id));
-    });
-    app.get(paths.connect, async (c) => {
-        const ticket = c.req.query("ticket")?.trim();
-        let userId;
-        if (ticket && provider.resolveConnectTicket) {
-            try {
-                userId = await provider.resolveConnectTicket(ticket);
-            }
-            catch (error) {
-                const message = error instanceof Error && error.message
-                    ? error.message
-                    : "invalid connect ticket";
-                return c.json({ error: message }, 401);
-            }
-        }
-        else {
-            const identity = await resolveOrUnauthorized(cfg, c.req.raw);
-            if (identity instanceof Response) {
-                return identity;
-            }
-            userId = identity.user.id;
-        }
-        const redirectUri = callbackRedirectUri(provider, c.req.raw, options.deploymentBaseUrl);
-        const result = await provider.startAuthorize(userId, redirectUri);
-        if ("notConfigured" in result) {
-            return c.json({ error: result.error }, 503);
-        }
-        const wantsJson = c.req.query("format") === "json" ||
-            (c.req.header("accept") ?? "").includes("application/json");
-        if (wantsJson) {
-            return c.json({ authorizeUrl: result.authorizeUrl });
-        }
-        return c.redirect(result.authorizeUrl, 302);
-    });
-    app.get(paths.callback, async (c) => {
-        const publicApp = provider.resolvePublicAppUrl?.() ??
-            process.env[MDA_PUBLIC_APP_URL_ENV]?.replace(/\/$/, "");
-        const failRedirect = publicApp
-            ? `${publicApp}/settings?${settingsKey}=error`
-            : "/";
-        try {
-            const code = c.req.query("code");
-            const state = c.req.query("state");
-            if (!code || !state) {
-                throw new Error("missing code or state");
-            }
-            const redirectUri = callbackRedirectUri(provider, c.req.raw, options.deploymentBaseUrl);
-            const { successRedirect } = await provider.completeCallback(code, state, redirectUri);
-            return c.redirect(successRedirect, 302);
-        }
-        catch (error) {
-            console.error(`[mda] ${provider.id} OAuth callback failed:`, error);
-            return c.redirect(failRedirect, 302);
-        }
-    });
-    app.delete(paths.link, async (c) => {
-        const identity = await resolveOrUnauthorized(cfg, c.req.raw);
-        if (identity instanceof Response) {
-            return identity;
-        }
-        await provider.unlink(identity.user.id);
-        return c.json({ linked: false });
-    });
-}
-function callbackRedirectUri(provider, request, deploymentBaseUrl) {
-    const base = provider.resolveRedirectBase({
-        requestUrl: request.url,
-        headers: request.headers,
-        deploymentBaseUrl,
-    });
-    return `${base}${identityConnectPaths(provider.id).callback}`;
-}
-async function resolveOrUnauthorized(cfg, request) {
-    try {
-        return await resolveRequestIdentity(cfg, request);
-    }
-    catch (error) {
-        const status = typeof error.status === "number"
-            ? error.status
-            : 401;
-        const message = error instanceof Error && error.message ? error.message : "unauthorized";
-        return new Response(JSON.stringify({ error: message }), {
-            status,
-            headers: { "content-type": "application/json" },
-        });
-    }
-}
-//# sourceMappingURL=connect-provider.js.map

package/dist/identity/connect-provider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-provider.js","sourceRoot":"","sources":["../../src/identity/connect-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAK1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAWxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAU1D,MAAM,UAAU,+BAA+B,CAC7C,QAAiC;IAEjC,OAAO,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAC3C,GAAS,EACT,GAAmB,EACnB,GAAgC,EAChC,OAAsC,EACtC,OAAO,GAMH,EAAE;IAEN,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG;QACd,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;KACtD,CAAC;IACF,KAAK,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,OAAO,EAAE,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CACtC,GAAS,EACT,GAAmB,EACnB,QAAiC,EACjC,OAAsC,EACtC,OAAuC;IAEvC,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,YAAY,QAAQ,CAAC,EAAE,UAAU,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI;QAClB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;QACpD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;QACrD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QACvD,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;KAC7C,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC;YACX,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,MAAc,CAAC;QACnB,IAAI,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO;oBACrC,CAAC,CAAC,KAAK,CAAC,OAAO;oBACf,CAAC,CAAC,wBAAwB,CAAC;gBAC/B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;gBACjC,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,EACR,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,eAAe,IAAI,MAAM,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,SAAS,GACb,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,MAAM;YAChC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAC9D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,SAAS,GACb,QAAQ,CAAC,mBAAmB,EAAE,EAAE;YAChC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAG,SAAS;YAC5B,CAAC,CAAC,GAAG,SAAS,aAAa,WAAW,QAAQ;YAC9C,CAAC,CAAC,GAAG,CAAC;QACR,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,EACR,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,OAAO,CAAC,iBAAiB,CAC1B,CAAC;YACF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CACzD,IAAI,EACJ,KAAK,EACL,WAAW,CACZ,CAAC;YACF,OAAO,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,SAAS,QAAQ,CAAC,EAAE,yBAAyB,EAAE,KAAK,CAAC,CAAC;YACpE,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAiC,EACjC,OAAgB,EAChB,iBAA0B;IAE1B,MAAM,IAAI,GAAG,QAAQ,CAAC,mBAAmB,CAAC;QACxC,UAAU,EAAE,OAAO,CAAC,GAAG;QACvB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB;KAClB,CAAC,CAAC;IACH,OAAO,GAAG,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,GAAmB,EACnB,OAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ;YACxD,CAAC,CAAE,KAA4B,CAAC,MAAM;YACtC,CAAC,CAAC,GAAG,CAAC;QACV,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;QAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE;YACtD,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/identity/credential-resolvers.d.ts

@@ -1,33 +0,0 @@
-/**
- * Shape helpers for the two `credentials` forms, shared by authoring validation,
- * normalization, and the runtime resolver so all three agree on which form a
- * config is.
- *
- * A single resolver handles every target itself. A per-target map lets one
- * deployment integrate several platforms without hand-writing the dispatch — and
- * without losing the Connect-with-X routes each entry declares, which is the
- * failure mode a hand-written dispatcher has.
- */
-import type { IdentityConnectProvider } from "./connect-provider-types.js";
-import type { CredentialResolverConfig, CredentialResolvers } from "./types.js";
-/**
- * True when `value` is a single {@link CredentialResolverConfig} rather than a
- * per-target map.
- *
- * Discriminates on the *type* of `resolve`/`endpoint`, not merely their
- * presence, so a target legitimately named `"resolve"` or `"endpoint"` in a map
- * is not mistaken for the single form.
- */
-export declare function isSingleCredentialResolver(value: CredentialResolverConfig | CredentialResolvers): value is CredentialResolverConfig;
-/** The target names a per-target map resolves, in declaration order. */
-export declare function credentialTargetNames(value: CredentialResolverConfig | CredentialResolvers): string[];
-/**
- * Every Connect-with-X provider the config depends on, deduplicated by id and in
- * declaration order.
- *
- * Unioning across map entries is what keeps inference working for a
- * multi-platform deployment: each entry declares its own routes, and the author
- * repeats none of them.
- */
-export declare function credentialConnectProviders(value: CredentialResolverConfig | CredentialResolvers | undefined): IdentityConnectProvider[];
-//# sourceMappingURL=credential-resolvers.d.ts.map

package/dist/identity/credential-resolvers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-resolvers.d.ts","sourceRoot":"","sources":["../../src/identity/credential-resolvers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEhF;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,GACpD,KAAK,IAAI,wBAAwB,CAWnC;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,GACpD,MAAM,EAAE,CAEV;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,GAAG,SAAS,GAChE,uBAAuB,EAAE,CAgB3B"}

package/dist/identity/credential-resolvers.js

@@ -1,62 +0,0 @@
-/**
- * Shape helpers for the two `credentials` forms, shared by authoring validation,
- * normalization, and the runtime resolver so all three agree on which form a
- * config is.
- *
- * A single resolver handles every target itself. A per-target map lets one
- * deployment integrate several platforms without hand-writing the dispatch — and
- * without losing the Connect-with-X routes each entry declares, which is the
- * failure mode a hand-written dispatcher has.
- */
-/**
- * True when `value` is a single {@link CredentialResolverConfig} rather than a
- * per-target map.
- *
- * Discriminates on the *type* of `resolve`/`endpoint`, not merely their
- * presence, so a target legitimately named `"resolve"` or `"endpoint"` in a map
- * is not mistaken for the single form.
- */
-export function isSingleCredentialResolver(value) {
-    const candidate = value;
-    if (typeof candidate.resolve === "function") {
-        return true;
-    }
-    const endpoint = candidate.endpoint;
-    return (typeof endpoint === "object" &&
-        endpoint !== null &&
-        typeof endpoint.url === "string");
-}
-/** The target names a per-target map resolves, in declaration order. */
-export function credentialTargetNames(value) {
-    return isSingleCredentialResolver(value) ? [] : Object.keys(value);
-}
-/**
- * Every Connect-with-X provider the config depends on, deduplicated by id and in
- * declaration order.
- *
- * Unioning across map entries is what keeps inference working for a
- * multi-platform deployment: each entry declares its own routes, and the author
- * repeats none of them.
- */
-export function credentialConnectProviders(value) {
-    if (value === undefined || value === null || typeof value !== "object") {
-        return [];
-    }
-    const configs = isSingleCredentialResolver(value)
-        ? [value]
-        : Object.values(value);
-    const out = [];
-    for (const config of configs) {
-        for (const provider of declaredConnect(config)) {
-            if (!out.some((existing) => existing.id === provider.id)) {
-                out.push(provider);
-            }
-        }
-    }
-    return out;
-}
-function declaredConnect(config) {
-    const connect = config?.connect;
-    return Array.isArray(connect) ? connect : [];
-}
-//# sourceMappingURL=credential-resolvers.js.map

package/dist/identity/credential-resolvers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-resolvers.js","sourceRoot":"","sources":["../../src/identity/credential-resolvers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAqD;IAErD,MAAM,SAAS,GAAG,KAAkD,CAAC;IACrE,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;IACpC,OAAO,CACL,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,KAAK,IAAI;QACjB,OAAQ,QAA8B,CAAC,GAAG,KAAK,QAAQ,CACxD,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,qBAAqB,CACnC,KAAqD;IAErD,OAAO,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAiE;IAEjE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC;QAC/C,CAAC,CAAC,CAAC,KAAK,CAAC;QACT,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,GAAG,GAA8B,EAAE,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,QAAQ,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,MAAe;IACtC,MAAM,OAAO,GAAI,MAA4C,EAAE,OAAO,CAAC;IACvE,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAAqC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9E,CAAC"}

package/dist/identity/define-fleet-connect.d.ts

@@ -1,53 +0,0 @@
-/**
- * Factory for thin Connect-with-X adapters over Fleet vault integrations.
- *
- * Google / Microsoft / LinkedIn share the same PATH constants, actor-subject
- * toggles, and `connect()` wiring — only the integration + BYO client differ.
- * X is the vault-only variant (no local BYO client).
- */
-import type { FleetOAuthIntegration } from "../connectors/toolserver/integrations.js";
-import type { ByoOauthClient } from "./byo-oauth.js";
-import { identityConnectPaths } from "./connect-paths.js";
-import type { IdentityConnectMountContext, IdentityConnectProvider } from "./connect-provider-types.js";
-import { type FleetVaultConnectProviderOptions } from "./fleet-connect.js";
-import { type FleetIntegrationConnectProviderOptions } from "./fleet-integration-connect.js";
-/** Shared surface returned by {@link defineFleetIntegrationConnect}. */
-export interface FleetIntegrationConnectAdapter {
-    readonly paths: ReturnType<typeof identityConnectPaths>;
-    isActorSubjectEnabled(): boolean;
-    enableActorSubject(): void;
-    enableActorSubjectFromConnectors(connectorKinds: readonly (string | undefined)[] | undefined, scope?: IdentityConnectMountContext["scope"]): void;
-    resetActorSubjectEnabledForTests(): void;
-    isConnectConfigured(env?: NodeJS.ProcessEnv): boolean;
-    connectUrl(publicAppUrl: string): string;
-    createProvider(options?: FleetIntegrationConnectProviderOptions): IdentityConnectProvider;
-    readonly provider: IdentityConnectProvider;
-    connect(options?: FleetIntegrationConnectProviderOptions): IdentityConnectProvider;
-}
-/** Shared surface returned by {@link defineFleetVaultConnect}. */
-export interface FleetVaultConnectAdapter {
-    readonly paths: ReturnType<typeof identityConnectPaths>;
-    isActorSubjectEnabled(): boolean;
-    enableActorSubject(): void;
-    enableActorSubjectFromConnectors(connectorKinds: readonly (string | undefined)[] | undefined, scope?: IdentityConnectMountContext["scope"]): void;
-    resetActorSubjectEnabledForTests(): void;
-    isConnectConfigured(env?: NodeJS.ProcessEnv): boolean;
-    connectUrl(publicAppUrl: string): string;
-    createProvider(options?: Pick<FleetVaultConnectProviderOptions, "providerSlug" | "scopes" | "fleet">): IdentityConnectProvider;
-    readonly provider: IdentityConnectProvider;
-    connect(options?: Pick<FleetVaultConnectProviderOptions, "providerSlug" | "scopes" | "fleet">): IdentityConnectProvider;
-}
-/** Build the Google/Microsoft/LinkedIn-style BYO + Fleet Connect adapter. */
-export declare function defineFleetIntegrationConnect(options: {
-    integration: FleetOAuthIntegration;
-    byoClient: ByoOauthClient;
-    fallbackScopes?: readonly string[];
-}): FleetIntegrationConnectAdapter;
-/**
- * Build a vault-only Connect adapter (no local BYO client), e.g. Connect-with-X.
- */
-export declare function defineFleetVaultConnect(options: {
-    integration: FleetOAuthIntegration;
-    resolveProviderSlug: () => string;
-}): FleetVaultConnectAdapter;
-//# sourceMappingURL=define-fleet-connect.d.ts.map

package/dist/identity/define-fleet-connect.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"define-fleet-connect.d.ts","sourceRoot":"","sources":["../../src/identity/define-fleet-connect.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAOtF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAIL,KAAK,gCAAgC,EACtC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIL,KAAK,sCAAsC,EAC5C,MAAM,gCAAgC,CAAC;AAMxC,wEAAwE;AACxE,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC;IACxD,qBAAqB,IAAI,OAAO,CAAC;IACjC,kBAAkB,IAAI,IAAI,CAAC;IAC3B,gCAAgC,CAC9B,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC3C,IAAI,CAAC;IACR,gCAAgC,IAAI,IAAI,CAAC;IACzC,mBAAmB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC;IACtD,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IACzC,cAAc,CACZ,OAAO,CAAC,EAAE,sCAAsC,GAC/C,uBAAuB,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,EAAE,sCAAsC,GAC/C,uBAAuB,CAAC;CAC5B;AAED,kEAAkE;AAClE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC;IACxD,qBAAqB,IAAI,OAAO,CAAC;IACjC,kBAAkB,IAAI,IAAI,CAAC;IAC3B,gCAAgC,CAC9B,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC3C,IAAI,CAAC;IACR,gCAAgC,IAAI,IAAI,CAAC;IACzC,mBAAmB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC;IACtD,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IACzC,cAAc,CACZ,OAAO,CAAC,EAAE,IAAI,CACZ,gCAAgC,EAChC,cAAc,GAAG,QAAQ,GAAG,OAAO,CACpC,GACA,uBAAuB,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,EAAE,IAAI,CACZ,gCAAgC,EAChC,cAAc,GAAG,QAAQ,GAAG,OAAO,CACpC,GACA,uBAAuB,CAAC;CAC5B;AAED,6EAA6E;AAC7E,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACrD,WAAW,EAAE,qBAAqB,CAAC;IACnC,SAAS,EAAE,cAAc,CAAC;IAC1B,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GAAG,8BAA8B,CA0CjC;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,qBAAqB,CAAC;IACnC,mBAAmB,EAAE,MAAM,MAAM,CAAC;CACnC,GAAG,wBAAwB,CAmD3B"}

package/dist/identity/define-fleet-connect.js

@@ -1,76 +0,0 @@
-/**
- * Factory for thin Connect-with-X adapters over Fleet vault integrations.
- *
- * Google / Microsoft / LinkedIn share the same PATH constants, actor-subject
- * toggles, and `connect()` wiring — only the integration + BYO client differ.
- * X is the vault-only variant (no local BYO client).
- */
-import { enableActorSubjectIntegration, enableActorSubjectIntegrationFromConnectors, isActorSubjectIntegrationEnabled, resetActorSubjectEnabledForTests, } from "./actor-subject.js";
-import { identityConnectPaths } from "./connect-paths.js";
-import { createFleetVaultConnectProvider, fleetConnectUrl, isFleetVaultConnectConfigured, } from "./fleet-connect.js";
-import { createFleetIntegrationConnectProvider, fleetIntegrationConnectUrl, isFleetIntegrationConnectConfigured, } from "./fleet-integration-connect.js";
-import { MDA_PUBLIC_APP_URL_ENV, resolveOauthRedirectBase, } from "./oauth-env.js";
-/** Build the Google/Microsoft/LinkedIn-style BYO + Fleet Connect adapter. */
-export function defineFleetIntegrationConnect(options) {
-    const { integration, byoClient, fallbackScopes } = options;
-    const paths = identityConnectPaths(integration.connectId);
-    function createProvider(providerOptions = {}) {
-        return createFleetIntegrationConnectProvider(integration, byoClient, providerOptions, fallbackScopes);
-    }
-    const provider = createProvider();
-    return {
-        paths,
-        isActorSubjectEnabled: () => isActorSubjectIntegrationEnabled(integration.connectId),
-        enableActorSubject: () => enableActorSubjectIntegration(integration.connectId),
-        enableActorSubjectFromConnectors(connectorKinds, scope) {
-            enableActorSubjectIntegrationFromConnectors(integration, connectorKinds, scope);
-        },
-        resetActorSubjectEnabledForTests,
-        isConnectConfigured: (env = process.env) => isFleetIntegrationConnectConfigured(byoClient, env),
-        connectUrl: (publicAppUrl) => fleetIntegrationConnectUrl(integration, publicAppUrl),
-        createProvider,
-        provider,
-        connect(providerOptions) {
-            enableActorSubjectIntegration(integration.connectId);
-            return providerOptions ? createProvider(providerOptions) : provider;
-        },
-    };
-}
-/**
- * Build a vault-only Connect adapter (no local BYO client), e.g. Connect-with-X.
- */
-export function defineFleetVaultConnect(options) {
-    const { integration, resolveProviderSlug } = options;
-    const paths = identityConnectPaths(integration.connectId);
-    function createProvider(providerOptions = {}) {
-        return createFleetVaultConnectProvider({
-            integration,
-            providerSlug: providerOptions.providerSlug?.trim() || resolveProviderSlug(),
-            ...(providerOptions.scopes ? { scopes: providerOptions.scopes } : {}),
-            ...(providerOptions.fleet ? { fleet: providerOptions.fleet } : {}),
-            resolveRedirectBase: resolveOauthRedirectBase,
-            resolvePublicAppUrl() {
-                return process.env[MDA_PUBLIC_APP_URL_ENV]?.replace(/\/$/, "");
-            },
-        });
-    }
-    const provider = createProvider();
-    return {
-        paths,
-        isActorSubjectEnabled: () => isActorSubjectIntegrationEnabled(integration.connectId),
-        enableActorSubject: () => enableActorSubjectIntegration(integration.connectId),
-        enableActorSubjectFromConnectors(connectorKinds, scope) {
-            enableActorSubjectIntegrationFromConnectors(integration, connectorKinds, scope);
-        },
-        resetActorSubjectEnabledForTests,
-        isConnectConfigured: (env = process.env) => isFleetVaultConnectConfigured(undefined, env),
-        connectUrl: (publicAppUrl) => fleetConnectUrl(integration, publicAppUrl),
-        createProvider,
-        provider,
-        connect(providerOptions) {
-            enableActorSubjectIntegration(integration.connectId);
-            return providerOptions ? createProvider(providerOptions) : provider;
-        },
-    };
-}
-//# sourceMappingURL=define-fleet-connect.js.map

package/dist/identity/define-fleet-connect.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"define-fleet-connect.js","sourceRoot":"","sources":["../../src/identity/define-fleet-connect.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EACL,6BAA6B,EAC7B,2CAA2C,EAC3C,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAK1D,OAAO,EACL,+BAA+B,EAC/B,eAAe,EACf,6BAA6B,GAE9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qCAAqC,EACrC,0BAA0B,EAC1B,mCAAmC,GAEpC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAkDxB,6EAA6E;AAC7E,MAAM,UAAU,6BAA6B,CAAC,OAI7C;IACC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAC3D,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAE1D,SAAS,cAAc,CACrB,eAAe,GAA2C,EAAE;QAE5D,OAAO,qCAAqC,CAC1C,WAAW,EACX,SAAS,EACT,eAAe,EACf,cAAc,CACf,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAElC,OAAO;QACL,KAAK;QACL,qBAAqB,EAAE,GAAG,EAAE,CAC1B,gCAAgC,CAAC,WAAW,CAAC,SAAS,CAAC;QACzD,kBAAkB,EAAE,GAAG,EAAE,CACvB,6BAA6B,CAAC,WAAW,CAAC,SAAS,CAAC;QACtD,gCAAgC,CAAC,cAAc,EAAE,KAAK;YACpD,2CAA2C,CACzC,WAAW,EACX,cAAc,EACd,KAAK,CACN,CAAC;QACJ,CAAC;QACD,gCAAgC;QAChC,mBAAmB,EAAE,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,CACzC,mCAAmC,CAAC,SAAS,EAAE,GAAG,CAAC;QACrD,UAAU,EAAE,CAAC,YAAY,EAAE,EAAE,CAC3B,0BAA0B,CAAC,WAAW,EAAE,YAAY,CAAC;QACvD,cAAc;QACd,QAAQ;QACR,OAAO,CAAC,eAAe;YACrB,6BAA6B,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACrD,OAAO,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAGvC;IACC,MAAM,EAAE,WAAW,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC;IACrD,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAO1D,SAAS,cAAc,CACrB,eAAe,GAAY,EAAE;QAE7B,OAAO,+BAA+B,CAAC;YACrC,WAAW;YACX,YAAY,EACV,eAAe,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,mBAAmB,EAAE;YAC/D,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,mBAAmB,EAAE,wBAAwB;YAC7C,mBAAmB;gBACjB,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACjE,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAElC,OAAO;QACL,KAAK;QACL,qBAAqB,EAAE,GAAG,EAAE,CAC1B,gCAAgC,CAAC,WAAW,CAAC,SAAS,CAAC;QACzD,kBAAkB,EAAE,GAAG,EAAE,CACvB,6BAA6B,CAAC,WAAW,CAAC,SAAS,CAAC;QACtD,gCAAgC,CAAC,cAAc,EAAE,KAAK;YACpD,2CAA2C,CACzC,WAAW,EACX,cAAc,EACd,KAAK,CACN,CAAC;QACJ,CAAC;QACD,gCAAgC;QAChC,mBAAmB,EAAE,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,CACzC,6BAA6B,CAAC,SAAS,EAAE,GAAG,CAAC;QAC/C,UAAU,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC;QACxE,cAAc;QACd,QAAQ;QACR,OAAO,CAAC,eAAe;YACrB,6BAA6B,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACrD,OAAO,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/identity/fleet-connect-hint.d.ts

@@ -1,41 +0,0 @@
-/**
- * Runtime hint when the caller has not completed Connect-with-X for a Fleet
- * vault integration yet.
- *
- * Prefers Connect status over toolserver 428 (agent subjects skip that today).
- */
-import { type FleetOAuthIntegration } from "../connectors/toolserver/integrations.js";
-import type { ManagedMiddleware } from "../runtime/managed-middleware.js";
-import { listAgentConnections, type FleetClientOptions } from "./fleet.js";
-export interface FleetConnectHintMiddlewareOptions {
-    integration: FleetOAuthIntegration;
-    providerSlug?: string;
-    fleet?: FleetClientOptions & {
-        list?: typeof listAgentConnections;
-    };
-    /** Override status lookup (tests). */
-    isConnected?: (userId: string) => Promise<boolean>;
-    /** Optional public-app resolver (BYO OAuth publicAppUrl). */
-    resolvePublicAppUrl?: (env?: NodeJS.ProcessEnv) => string | undefined;
-}
-/** Drop cached Connect status (tests only). */
-export declare function clearFleetConnectHintCacheForTests(): void;
-/**
- * Absolute Connect start URL for agent hints.
- *
- * Prefers the Agent Server origin (`MDA_PUBLIC_API_URL`) where
- * `/identity/{id}/*` is mounted. Falls back to `MDA_PUBLIC_APP_URL`.
- *
- * When `userId` and a signing key are available, appends a short-lived
- * `?ticket=` so the browser session binds OAuth to that actor.
- */
-export declare function fleetConnectHintUrl(integration: FleetOAuthIntegration, env?: NodeJS.ProcessEnv, userId?: string, resolvePublicAppUrl?: (env?: NodeJS.ProcessEnv) => string | undefined): Promise<string>;
-/**
- * Middleware that injects a system hint when actor-subject mode is on for
- * `integration` and the current caller has no LangSmith vault connection.
- */
-export declare function createFleetConnectHintMiddleware(options: FleetConnectHintMiddlewareOptions): ManagedMiddleware;
-/** Rewrite tool errors that look like a missing Fleet vault connection. */
-export declare function rewriteFleetToolError(error: unknown, integration: FleetOAuthIntegration, resolvePublicAppUrl?: (env?: NodeJS.ProcessEnv) => string | undefined): Error;
-export declare function isFleetConnectHint(message: string, integration: FleetOAuthIntegration): boolean;
-//# sourceMappingURL=fleet-connect-hint.d.ts.map

package/dist/identity/fleet-connect-hint.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fleet-connect-hint.d.ts","sourceRoot":"","sources":["../../src/identity/fleet-connect-hint.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAS1E,OAAO,EAAE,oBAAoB,EAAE,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAQ3E,MAAM,WAAW,iCAAiC;IAChD,WAAW,EAAE,qBAAqB,CAAC;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,kBAAkB,GAAG;QAC3B,IAAI,CAAC,EAAE,OAAO,oBAAoB,CAAC;KACpC,CAAC;IACF,sCAAsC;IACtC,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,6DAA6D;IAC7D,mBAAmB,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,KAAK,MAAM,GAAG,SAAS,CAAC;CACvE;AA2DD,+CAA+C;AAC/C,wBAAgB,kCAAkC,IAAI,IAAI,CAEzD;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,qBAAqB,EAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,MAAM,CAAC,EAAE,MAAM,EACf,mBAAmB,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,KAAK,MAAM,GAAG,SAAS,GACpE,OAAO,CAAC,MAAM,CAAC,CA+BjB;AAoBD;;;GAGG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,iCAAiC,GACzC,iBAAiB,CAwEnB;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,WAAW,EAAE,qBAAqB,EAClC,mBAAmB,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,KAAK,MAAM,GAAG,SAAS,GACpE,KAAK,CAgCP;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,qBAAqB,GACjC,OAAO,CAET"}