managed-deepagents 0.5.3-dev.111 → 0.5.3-dev.113

package/dist/identity/fleet-connect-hint.js

@@ -1,190 +0,0 @@
-/**
- * Runtime hint when the caller has not completed Connect-with-X for a Fleet
- * vault integration yet.
- *
- * Prefers Connect status over toolserver 428 (agent subjects skip that today).
- */
-import { readIntegrationProviderSlug, } from "../connectors/toolserver/integrations.js";
-import { managedRuntimeOverrides } from "../runtime/managed-tools.js";
-import { agentIdFromActor, isActorSubjectIntegrationEnabled, } from "./actor-subject.js";
-import { identityConnectPaths } from "./connect-paths.js";
-import { fleetConnectUrl } from "./fleet-connect.js";
-import { listAgentConnections } from "./fleet.js";
-import { oauthTicketsFor } from "./oauth-tickets.js";
-import { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, readOauthStateSigningKey, } from "./oauth-env.js";
-function hintPrefix(integration) {
-    return `User has not connected ${integration.displayName}`;
-}
-/** Short TTL so connected callers skip Fleet on every model turn. */
-const CONNECT_STATUS_TTL_MS = 30_000;
-const connectionStatusCache = new Map();
-function cacheKey(userId, providerSlug) {
-    return `${userId}\0${providerSlug}`;
-}
-/** Drop expired entries so one-shot callers do not retain forever. */
-function evictExpiredCacheEntries(now = Date.now()) {
-    for (const [key, entry] of connectionStatusCache) {
-        if (now >= entry.expiresAt) {
-            connectionStatusCache.delete(key);
-        }
-    }
-}
-function cachedConnected(userId, providerSlug) {
-    const entry = connectionStatusCache.get(cacheKey(userId, providerSlug));
-    if (!entry) {
-        return undefined;
-    }
-    if (Date.now() >= entry.expiresAt) {
-        connectionStatusCache.delete(cacheKey(userId, providerSlug));
-        return undefined;
-    }
-    return entry.connected;
-}
-function storeConnected(userId, providerSlug, connected) {
-    const now = Date.now();
-    evictExpiredCacheEntries(now);
-    // Only cache positives: a just-completed Connect must be visible on retry
-    // within the TTL window, not masked by a prior disconnected observation.
-    if (!connected) {
-        return;
-    }
-    connectionStatusCache.set(cacheKey(userId, providerSlug), {
-        expiresAt: now + CONNECT_STATUS_TTL_MS,
-        connected: true,
-    });
-}
-/** Drop cached Connect status (tests only). */
-export function clearFleetConnectHintCacheForTests() {
-    connectionStatusCache.clear();
-}
-/**
- * Absolute Connect start URL for agent hints.
- *
- * Prefers the Agent Server origin (`MDA_PUBLIC_API_URL`) where
- * `/identity/{id}/*` is mounted. Falls back to `MDA_PUBLIC_APP_URL`.
- *
- * When `userId` and a signing key are available, appends a short-lived
- * `?ticket=` so the browser session binds OAuth to that actor.
- */
-export async function fleetConnectHintUrl(integration, env = process.env, userId, resolvePublicAppUrl) {
-    const apiBase = env[MDA_PUBLIC_API_URL_ENV]?.trim().replace(/\/$/, "");
-    const appBase = resolvePublicAppUrl?.(env) ??
-        env[MDA_PUBLIC_APP_URL_ENV]?.trim().replace(/\/$/, "");
-    const base = apiBase || appBase;
-    const paths = identityConnectPaths(integration.connectId);
-    const path = base ? fleetConnectUrl(integration, base) : paths.connect;
-    if (!userId) {
-        return path;
-    }
-    const signingKey = readOauthStateSigningKey(env);
-    if (!signingKey) {
-        return path;
-    }
-    try {
-        const ticket = await oauthTicketsFor(integration.connectId).createTicket(userId, signingKey);
-        const url = new URL(path.startsWith("http") ? path : `https://placeholder.local${path}`);
-        url.searchParams.set("ticket", ticket);
-        if (!path.startsWith("http")) {
-            return `${paths.connect}?${url.searchParams.toString()}`;
-        }
-        return url.toString();
-    }
-    catch {
-        return path;
-    }
-}
-async function hintMessage(integration, userId, resolvePublicAppUrl) {
-    const url = await fleetConnectHintUrl(integration, process.env, userId, resolvePublicAppUrl);
-    return (`${hintPrefix(integration)}; ask them to Connect with ${integration.displayName} at ${url}. ` +
-        "Paste that full URL so they can open it. " +
-        `Do not pretend ${integration.displayName} tools will work until they connect.`);
-}
-/**
- * Middleware that injects a system hint when actor-subject mode is on for
- * `integration` and the current caller has no LangSmith vault connection.
- */
-export function createFleetConnectHintMiddleware(options) {
-    const { integration } = options;
-    const list = options.fleet?.list ?? listAgentConnections;
-    const providerSlug = () => options.providerSlug?.trim() || readIntegrationProviderSlug(integration);
-    async function disconnected(userId) {
-        if (options.isConnected) {
-            return !(await options.isConnected(userId));
-        }
-        const slug = providerSlug();
-        const cached = cachedConnected(userId, slug);
-        if (cached !== undefined) {
-            return !cached;
-        }
-        const agentId = agentIdFromActor(userId);
-        const connections = await list(agentId, options.fleet ?? {});
-        const isDisconnected = !connections.some((c) => c.provider_id === slug);
-        storeConnected(userId, slug, !isDisconnected);
-        return isDisconnected;
-    }
-    return {
-        name: `mda-${integration.id}-connect-hint`,
-        async wrapModelCall(request, handler) {
-            if (!isActorSubjectIntegrationEnabled(integration.id)) {
-                return handler(request);
-            }
-            const overrides = managedRuntimeOverrides(request.runtime);
-            const userId = overrides.identity?.user?.id;
-            if (!userId) {
-                return handler(request);
-            }
-            try {
-                if (!(await disconnected(userId))) {
-                    return handler(request);
-                }
-            }
-            catch {
-                const hint = await hintMessage(integration, userId, options.resolvePublicAppUrl);
-                return handler({
-                    ...request,
-                    messages: [
-                        { role: "system", content: hint },
-                        ...(Array.isArray(request.messages) ? request.messages : []),
-                    ],
-                });
-            }
-            const hint = await hintMessage(integration, userId, options.resolvePublicAppUrl);
-            return handler({
-                ...request,
-                messages: [
-                    { role: "system", content: hint },
-                    ...(Array.isArray(request.messages) ? request.messages : []),
-                ],
-            });
-        },
-    };
-}
-/** Rewrite tool errors that look like a missing Fleet vault connection. */
-export function rewriteFleetToolError(error, integration, resolvePublicAppUrl) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (/connection_required|token_expired|no connection|AgentAuthRequired|428|not connected/i.test(message)) {
-        // Per-caller Connect-with-X only exists on user-scoped deployments. Agent /
-        // no-identity projects use the shared vault from `mda connect`.
-        if (!isActorSubjectIntegrationEnabled(integration.id)) {
-            return new Error(`${integration.displayName} is not connected in the shared LangSmith vault. ` +
-                `Run \`mda connect\` for a ${integration.displayName} connector, or connect it ` +
-                `under LangSmith Settings → Integrations. (Original: ${message})`);
-        }
-        const apiBase = process.env[MDA_PUBLIC_API_URL_ENV]
-            ?.trim()
-            .replace(/\/$/, "");
-        const appBase = resolvePublicAppUrl?.() ??
-            process.env[MDA_PUBLIC_APP_URL_ENV]?.trim().replace(/\/$/, "");
-        const base = apiBase || appBase;
-        const paths = identityConnectPaths(integration.connectId);
-        const url = base ? fleetConnectUrl(integration, base) : paths.connect;
-        return new Error(`${hintPrefix(integration)}. Ask the user to Connect with ${integration.displayName} at ${url}. ` +
-            "Paste that full URL so they can open it. " +
-            `(Original: ${message})`);
-    }
-    return error instanceof Error ? error : new Error(message);
-}
-export function isFleetConnectHint(message, integration) {
-    return message.includes(hintPrefix(integration));
-}
-//# sourceMappingURL=fleet-connect-hint.js.map

package/dist/identity/fleet-connect-hint.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"fleet-connect-hint.js","sourceRoot":"","sources":["../../src/identity/fleet-connect-hint.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,2BAA2B,GAE5B,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EACL,gBAAgB,EAChB,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAA2B,MAAM,YAAY,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAcxB,SAAS,UAAU,CAAC,WAAkC;IACpD,OAAO,0BAA0B,WAAW,CAAC,WAAW,EAAE,CAAC;AAC7D,CAAC;AAED,qEAAqE;AACrE,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAGlC,CAAC;AAEJ,SAAS,QAAQ,CAAC,MAAc,EAAE,YAAoB;IACpD,OAAO,GAAG,MAAM,KAAK,YAAY,EAAE,CAAC;AACtC,CAAC;AAED,sEAAsE;AACtE,SAAS,wBAAwB,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,qBAAqB,EAAE,CAAC;QACjD,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAC3B,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,MAAc,EACd,YAAoB;IAEpB,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAClC,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC,SAAS,CAAC;AACzB,CAAC;AAED,SAAS,cAAc,CACrB,MAAc,EACd,YAAoB,EACpB,SAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC9B,0EAA0E;IAC1E,yEAAyE;IACzE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE;QACxD,SAAS,EAAE,GAAG,GAAG,qBAAqB;QACtC,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;AACL,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,kCAAkC;IAChD,qBAAqB,CAAC,KAAK,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAkC,EAClC,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,MAAe,EACf,mBAAqE;IAErE,MAAM,OAAO,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvE,MAAM,OAAO,GACX,mBAAmB,EAAE,CAAC,GAAG,CAAC;QAC1B,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,CAAC;IAChC,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IACvE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,YAAY,CACtE,MAAM,EACN,UAAU,CACX,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,4BAA4B,IAAI,EAAE,CACpE,CAAC;QACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,WAAkC,EAClC,MAAc,EACd,mBAAqE;IAErE,MAAM,GAAG,GAAG,MAAM,mBAAmB,CACnC,WAAW,EACX,OAAO,CAAC,GAAG,EACX,MAAM,EACN,mBAAmB,CACpB,CAAC;IACF,OAAO,CACL,GAAG,UAAU,CAAC,WAAW,CAAC,8BAA8B,WAAW,CAAC,WAAW,OAAO,GAAG,IAAI;QAC7F,2CAA2C;QAC3C,kBAAkB,WAAW,CAAC,WAAW,sCAAsC,CAChF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAA0C;IAE1C,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,IAAI,oBAAoB,CAAC;IACzD,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,2BAA2B,CAAC,WAAW,CAAC,CAAC;IAE3E,KAAK,UAAU,YAAY,CAAC,MAAc;QACxC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,MAAM,CAAC;QACjB,CAAC;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC;QACxE,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,cAAc,CAAC,CAAC;QAC9C,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO,WAAW,CAAC,EAAE,eAAe;QAC1C,KAAK,CAAC,aAAa,CACjB,OAIC,EACD,OAAyC;YAEzC,IAAI,CAAC,gCAAgC,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;gBACtD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;oBAClC,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,GAAG,MAAM,WAAW,CAC5B,WAAW,EACX,MAAM,EACN,OAAO,CAAC,mBAAmB,CAC5B,CAAC;gBACF,OAAO,OAAO,CAAC;oBACb,GAAG,OAAO;oBACV,QAAQ,EAAE;wBACR,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;wBACjC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC7D;iBACF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,WAAW,CAC5B,WAAW,EACX,MAAM,EACN,OAAO,CAAC,mBAAmB,CAC5B,CAAC;YACF,OAAO,OAAO,CAAC;gBACb,GAAG,OAAO;gBACV,QAAQ,EAAE;oBACR,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;oBACjC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC7D;aACF,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,WAAkC,EAClC,mBAAqE;IAErE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IACE,sFAAsF,CAAC,IAAI,CACzF,OAAO,CACR,EACD,CAAC;QACD,4EAA4E;QAC5E,gEAAgE;QAChE,IAAI,CAAC,gCAAgC,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YACtD,OAAO,IAAI,KAAK,CACd,GAAG,WAAW,CAAC,WAAW,mDAAmD;gBAC3E,6BAA6B,WAAW,CAAC,WAAW,4BAA4B;gBAChF,uDAAuD,OAAO,GAAG,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;YACjD,EAAE,IAAI,EAAE;aACP,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtB,MAAM,OAAO,GACX,mBAAmB,EAAE,EAAE;YACvB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,CAAC;QAChC,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;QACtE,OAAO,IAAI,KAAK,CACd,GAAG,UAAU,CAAC,WAAW,CAAC,kCAAkC,WAAW,CAAC,WAAW,OAAO,GAAG,IAAI;YAC/F,2CAA2C;YAC3C,cAAc,OAAO,GAAG,CAC3B,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,WAAkC;IAElC,OAAO,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;AACnD,CAAC"}

package/dist/identity/fleet-connect.d.ts

@@ -1,93 +0,0 @@
-/**
- * Factory for Connect-with-X providers that persist tokens in the LangSmith
- * Fleet vault under a derived actor agent_id.
- *
- * Google and Microsoft are thin adapters over this module; Google optionally
- * adds a BYO OAuth client for offline / non-LangSmith setups.
- */
-import { type FleetOAuthIntegration } from "../connectors/toolserver/integrations.js";
-import type { IdentityConnectProvider, IdentityConnectRedirectBaseOptions } from "./connect-provider-types.js";
-import { createFleetAuthSession, deleteAgentConnection, listAgentConnections, upsertAgentProviderToken, type FleetClientOptions } from "./fleet.js";
-export interface FleetVaultByoTokenResult {
-    accessToken: string;
-    refreshToken?: string;
-    expiresInSeconds?: number;
-    scope?: string;
-    tokenType?: string;
-    /** Shown on status (e.g. email). */
-    accountLabel?: string;
-    /** Merged into vault token metadata (plus `mda_actor_user_id`). */
-    metadata?: Record<string, unknown>;
-}
-/** Config shape returned by {@link FleetVaultByoOauth.readConfig}. */
-export interface FleetVaultByoOauthConfig {
-    publicAppUrl: string;
-    /** Space-separated OAuth scopes from env / BYO defaults. */
-    scopes: string;
-}
-/** Optional BYO OAuth client when Fleet platform OAuth is unavailable. */
-export interface FleetVaultByoOauth {
-    readConfig(env?: NodeJS.ProcessEnv): FleetVaultByoOauthConfig | null;
-    buildAuthorizeUrl(config: FleetVaultByoOauthConfig, state: string, redirectUri: string, scopes: string): string;
-    exchangeCode(config: FleetVaultByoOauthConfig, code: string, redirectUri: string): Promise<FleetVaultByoTokenResult>;
-}
-export interface FleetVaultConnectProviderOptions {
-    integration: FleetOAuthIntegration;
-    /** Override LangSmith OAuth provider slug. */
-    providerSlug?: string;
-    /**
-     * Resolve the LangSmith OAuth provider slug (sync or async).
-     *
-     * Used by marketplace bridges that discover `oauth_provider_id` from the
-     * workspace MCP server row. When omitted, uses {@link providerSlug} or
-     * {@link readIntegrationProviderSlug}.
-     */
-    resolveProviderSlug?: () => string | Promise<string>;
-    /**
-     * Whether declared connectors imply this Connect provider should mount on
-     * user-scoped deployments. Defaults to toolserver slug matching via
-     * {@link hasIntegrationToolServerConnector}.
-     */
-    hasDeclaredConnector?: (connectorKinds: readonly (string | undefined)[] | undefined) => boolean;
-    /**
-     * Override the "configured" check. Defaults to
-     * {@link isFleetVaultConnectConfigured} with {@link byo}.
-     */
-    isConfigured?: (env?: NodeJS.ProcessEnv) => boolean;
-    /** Override the not-configured error returned from startAuthorize. */
-    notConfiguredError?: string;
-    /**
-     * When true, startAuthorize catches discovery/session failures and returns
-     * `{ notConfigured: true, error }` instead of throwing (marketplace MCP
-     * discovery can fail before an auth-session exists).
-     */
-    softAuthorizeFailures?: boolean;
-    /**
-     * OAuth scopes to request. When omitted: connector-derived scopes from the
-     * mount context, then BYO `readConfig().scopes`, then
-     * {@link fallbackScopes} / `integration.profileScopes`.
-     */
-    scopes?: string[];
-    /** Optional BYO OAuth path (Google / Microsoft). */
-    byo?: FleetVaultByoOauth;
-    resolveRedirectBase(options: IdentityConnectRedirectBaseOptions): string;
-    resolvePublicAppUrl?(): string | undefined;
-    /** Injectable Fleet client (tests). */
-    fleet?: FleetClientOptions & {
-        list?: typeof listAgentConnections;
-        upsert?: typeof upsertAgentProviderToken;
-        delete?: typeof deleteAgentConnection;
-        createAuthSession?: typeof createFleetAuthSession;
-    };
-    /**
-     * Last-resort scopes when connectors and BYO config imply none.
-     * Defaults to `integration.profileScopes`.
-     */
-    fallbackScopes?: string[];
-}
-export declare function isFleetVaultConnectConfigured(byo?: FleetVaultByoOauth, env?: NodeJS.ProcessEnv): boolean;
-export declare function fleetVaultConnectNotConfiguredError(integration: FleetOAuthIntegration): string;
-export declare function fleetConnectUrl(integration: FleetOAuthIntegration, publicAppUrl: string): string;
-/** Build a Fleet vault Connect-with-X provider for `integration`. */
-export declare function createFleetVaultConnectProvider(options: FleetVaultConnectProviderOptions): IdentityConnectProvider;
-//# sourceMappingURL=fleet-connect.d.ts.map

package/dist/identity/fleet-connect.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fleet-connect.d.ts","sourceRoot":"","sources":["../../src/identity/fleet-connect.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,0CAA0C,CAAC;AAGlD,OAAO,KAAK,EAKV,uBAAuB,EACvB,kCAAkC,EACnC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EAErB,oBAAoB,EACpB,wBAAwB,EACxB,KAAK,kBAAkB,EACxB,MAAM,YAAY,CAAC;AAapB,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,sEAAsE;AACtE,MAAM,WAAW,wBAAwB;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0EAA0E;AAC1E,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,wBAAwB,GAAG,IAAI,CAAC;IACrE,iBAAiB,CACf,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,MAAM,CAAC;IACV,YAAY,CACV,MAAM,EAAE,wBAAwB,EAChC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,gCAAgC;IAC/C,WAAW,EAAE,qBAAqB,CAAC;IACnC,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CACrB,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,KACxD,OAAO,CAAC;IACb;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;IACpD,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,oDAAoD;IACpD,GAAG,CAAC,EAAE,kBAAkB,CAAC;IACzB,mBAAmB,CAAC,OAAO,EAAE,kCAAkC,GAAG,MAAM,CAAC;IACzE,mBAAmB,CAAC,IAAI,MAAM,GAAG,SAAS,CAAC;IAC3C,uCAAuC;IACvC,KAAK,CAAC,EAAE,kBAAkB,GAAG;QAC3B,IAAI,CAAC,EAAE,OAAO,oBAAoB,CAAC;QACnC,MAAM,CAAC,EAAE,OAAO,wBAAwB,CAAC;QACzC,MAAM,CAAC,EAAE,OAAO,qBAAqB,CAAC;QACtC,iBAAiB,CAAC,EAAE,OAAO,sBAAsB,CAAC;KACnD,CAAC;IACF;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAQD,wBAAgB,6BAA6B,CAC3C,GAAG,CAAC,EAAE,kBAAkB,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAQT;AAED,wBAAgB,mCAAmC,CACjD,WAAW,EAAE,qBAAqB,GACjC,MAAM,CAMR;AAED,wBAAgB,eAAe,CAC7B,WAAW,EAAE,qBAAqB,EAClC,YAAY,EAAE,MAAM,GACnB,MAAM,CAGR;AAED,qEAAqE;AACrE,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gCAAgC,GACxC,uBAAuB,CA4QzB"}

package/dist/identity/fleet-connect.js

@@ -1,256 +0,0 @@
-/**
- * Factory for Connect-with-X providers that persist tokens in the LangSmith
- * Fleet vault under a derived actor agent_id.
- *
- * Google and Microsoft are thin adapters over this module; Google optionally
- * adds a BYO OAuth client for offline / non-LangSmith setups.
- */
-import { hasIntegrationToolServerConnector, readIntegrationProviderSlug, scopesForIntegrationConnectorKinds, } from "../connectors/toolserver/integrations.js";
-import { identityConnectPaths } from "./connect-paths.js";
-import { isUserScopedDeployment } from "./connect-inference.js";
-import { createFleetAuthSession, deleteAgentConnection, hasFleetAuthCredentials, listAgentConnections, upsertAgentProviderToken, } from "./fleet.js";
-import { agentIdFromActor, enableActorSubjectIntegration, } from "./actor-subject.js";
-import { oauthTicketsFor } from "./oauth-tickets.js";
-import { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, } from "./oauth-env.js";
-function hasPublicConnectBase(env = process.env) {
-    return Boolean(env[MDA_PUBLIC_API_URL_ENV]?.trim() || env[MDA_PUBLIC_APP_URL_ENV]?.trim());
-}
-export function isFleetVaultConnectConfigured(byo, env = process.env) {
-    if (!hasPublicConnectBase(env)) {
-        return false;
-    }
-    if (hasFleetAuthCredentials(env)) {
-        return true;
-    }
-    return Boolean(readOauthStateSigningKey(env) && byo?.readConfig(env));
-}
-export function fleetVaultConnectNotConfiguredError(integration) {
-    return (`${integration.displayName} connect is not configured (set LANGSMITH_API_KEY, ` +
-        "LANGSMITH_WORKSPACE_ID, MDA_PUBLIC_API_URL; " +
-        `or a BYO OAuth client and ${OAUTH_STATE_SIGNING_KEY_ENV})`);
-}
-export function fleetConnectUrl(integration, publicAppUrl) {
-    const paths = identityConnectPaths(integration.connectId);
-    return `${publicAppUrl.replace(/\/$/, "")}${paths.connect}`;
-}
-/** Build a Fleet vault Connect-with-X provider for `integration`. */
-export function createFleetVaultConnectProvider(options) {
-    const { integration, byo } = options;
-    const paths = identityConnectPaths(integration.connectId);
-    const tickets = oauthTicketsFor(integration.connectId);
-    const list = options.fleet?.list ?? listAgentConnections;
-    const upsert = options.fleet?.upsert ?? upsertAgentProviderToken;
-    const del = options.fleet?.delete ?? deleteAgentConnection;
-    const createSession = options.fleet?.createAuthSession ?? createFleetAuthSession;
-    const fleetOpts = () => {
-        const { list: _l, upsert: _u, delete: _d, createAuthSession: _c, ...rest } = options.fleet ?? {};
-        return rest;
-    };
-    const configured = (env) => options.isConfigured?.(env) ?? isFleetVaultConnectConfigured(byo, env);
-    const notConfiguredError = () => options.notConfiguredError ??
-        fleetVaultConnectNotConfiguredError(integration);
-    let mountConnectorKinds;
-    async function resolveProviderSlug() {
-        if (options.resolveProviderSlug) {
-            return options.resolveProviderSlug();
-        }
-        return (options.providerSlug?.trim() || readIntegrationProviderSlug(integration));
-    }
-    function resolveAuthorizeScopes(ctxKinds) {
-        if (options.scopes?.length) {
-            return [...options.scopes];
-        }
-        const fromConnectors = scopesForIntegrationConnectorKinds(integration, ctxKinds ?? mountConnectorKinds);
-        if (fromConnectors.length > 0) {
-            return fromConnectors;
-        }
-        const byoScopes = byo
-            ?.readConfig()
-            ?.scopes?.trim()
-            .split(/\s+/)
-            .filter(Boolean);
-        if (byoScopes?.length) {
-            return byoScopes;
-        }
-        return [...(options.fallbackScopes ?? integration.profileScopes ?? [])];
-    }
-    function hasConnector(connectorKinds) {
-        return (options.hasDeclaredConnector?.(connectorKinds) ??
-            hasIntegrationToolServerConnector(integration, connectorKinds));
-    }
-    return {
-        id: integration.connectId,
-        settingsQueryKey: integration.connectId,
-        shouldMount(ctx) {
-            if (!ctx.hasIdentity) {
-                return false;
-            }
-            if (ctx.declared) {
-                mountConnectorKinds = ctx.connectorKinds;
-                enableActorSubjectIntegration(integration.id);
-                return true;
-            }
-            if (hasConnector(ctx.connectorKinds) &&
-                isUserScopedDeployment(ctx.scope)) {
-                mountConnectorKinds = ctx.connectorKinds;
-                enableActorSubjectIntegration(integration.id);
-                return true;
-            }
-            return false;
-        },
-        async status(userId) {
-            const isConfigured = configured();
-            let connected = false;
-            let accountLabel;
-            let agentId;
-            let providerId;
-            if (isConfigured) {
-                try {
-                    agentId = agentIdFromActor(userId);
-                    providerId = await resolveProviderSlug();
-                    const connections = await list(agentId, fleetOpts());
-                    const match = connections.find((c) => c.provider_id === providerId);
-                    connected = Boolean(match);
-                    accountLabel = match?.provider_account_label;
-                }
-                catch (err) {
-                    return {
-                        configured: isConfigured,
-                        linked: false,
-                        connected: false,
-                        error: err instanceof Error ? err.message : String(err),
-                        connectPath: paths.connect,
-                    };
-                }
-            }
-            return {
-                configured: isConfigured,
-                linked: connected,
-                connected,
-                ...(agentId ? { agentId } : {}),
-                ...(providerId ? { providerId } : {}),
-                ...(accountLabel ? { email: accountLabel, accountLabel } : {}),
-                connectPath: paths.connect,
-                scopes: resolveAuthorizeScopes(),
-            };
-        },
-        async startAuthorize(userId, redirectUri) {
-            if (!configured()) {
-                return {
-                    notConfigured: true,
-                    error: notConfiguredError(),
-                };
-            }
-            const run = async () => {
-                const scopes = resolveAuthorizeScopes();
-                if (hasFleetAuthCredentials()) {
-                    const agentId = agentIdFromActor(userId);
-                    const session = await createSession({
-                        providerSlug: await resolveProviderSlug(),
-                        scopes,
-                        agentId,
-                        strategy: "create",
-                    }, fleetOpts());
-                    const authorizeUrl = session.verification_url?.trim();
-                    if (!authorizeUrl) {
-                        throw new Error(`Fleet auth-session did not return a verification_url for ${integration.displayName} connect`);
-                    }
-                    return { authorizeUrl };
-                }
-                const stateKey = readOauthStateSigningKey();
-                const oauth = byo?.readConfig();
-                if (!stateKey || !byo || !oauth) {
-                    return {
-                        notConfigured: true,
-                        error: notConfiguredError(),
-                    };
-                }
-                const state = await tickets.createState(userId, stateKey);
-                return {
-                    authorizeUrl: byo.buildAuthorizeUrl(oauth, state, redirectUri, scopes.join(" ")),
-                };
-            };
-            if (!options.softAuthorizeFailures) {
-                return run();
-            }
-            try {
-                return await run();
-            }
-            catch (err) {
-                return {
-                    notConfigured: true,
-                    error: err instanceof Error ? err.message : String(err),
-                };
-            }
-        },
-        async completeCallback(code, state, redirectUri) {
-            // Fleet/platform path finalizes on host GET /v2/auth/callback — MDA's
-            // callback is only used for the optional BYO client.
-            const oauth = byo?.readConfig();
-            if (!byo || !oauth) {
-                const publicApp = process.env[MDA_PUBLIC_APP_URL_ENV]?.replace(/\/$/, "") ||
-                    process.env[MDA_PUBLIC_API_URL_ENV]?.replace(/\/$/, "") ||
-                    "";
-                return {
-                    successRedirect: publicApp
-                        ? `${publicApp}/settings?${integration.connectId}=connected`
-                        : "/",
-                };
-            }
-            const stateKey = readOauthStateSigningKey();
-            if (!stateKey) {
-                throw new Error(`${OAUTH_STATE_SIGNING_KEY_ENV} is not configured`);
-            }
-            const { userId } = await tickets.verifyState(state, stateKey);
-            const token = await byo.exchangeCode(oauth, code, redirectUri);
-            const agentId = agentIdFromActor(userId);
-            const scopes = token.scope
-                ? token.scope.split(/\s+/).filter(Boolean)
-                : resolveAuthorizeScopes();
-            await upsert(agentId, await resolveProviderSlug(), {
-                access_token: token.accessToken,
-                ...(token.refreshToken ? { refresh_token: token.refreshToken } : {}),
-                ...(token.expiresInSeconds !== undefined
-                    ? { expires_in_seconds: token.expiresInSeconds }
-                    : {}),
-                scopes,
-                ...(token.accountLabel
-                    ? { provider_account_label: token.accountLabel }
-                    : {}),
-                metadata: {
-                    mda_actor_user_id: userId,
-                    ...(token.metadata ?? {}),
-                },
-            }, fleetOpts());
-            return {
-                successRedirect: `${oauth.publicAppUrl}/settings?${integration.connectId}=connected`,
-            };
-        },
-        async unlink(userId) {
-            const agentId = agentIdFromActor(userId);
-            const providerId = await resolveProviderSlug();
-            const connections = await list(agentId, fleetOpts());
-            const match = connections.find((c) => c.provider_id === providerId);
-            if (match) {
-                await del(agentId, match.id, fleetOpts());
-            }
-        },
-        resolveRedirectBase(redirectOptions) {
-            return options.resolveRedirectBase(redirectOptions);
-        },
-        resolvePublicAppUrl() {
-            return (options.resolvePublicAppUrl?.() ??
-                byo?.readConfig()?.publicAppUrl ??
-                process.env[MDA_PUBLIC_APP_URL_ENV]?.replace(/\/$/, ""));
-        },
-        async resolveConnectTicket(ticket) {
-            const stateKey = readOauthStateSigningKey();
-            if (!stateKey) {
-                throw new Error(`${OAUTH_STATE_SIGNING_KEY_ENV} is not configured`);
-            }
-            const { userId } = await tickets.verifyTicket(ticket, stateKey);
-            return userId;
-        },
-    };
-}
-//# sourceMappingURL=fleet-connect.js.map

package/dist/identity/fleet-connect.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"fleet-connect.js","sourceRoot":"","sources":["../../src/identity/fleet-connect.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,iCAAiC,EACjC,2BAA2B,EAC3B,kCAAkC,GAEnC,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAShE,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,GAEzB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,gBAAgB,EAChB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AA8FxB,SAAS,oBAAoB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAChE,OAAO,OAAO,CACZ,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAC3E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,GAAwB,EACxB,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC,wBAAwB,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,WAAkC;IAElC,OAAO,CACL,GAAG,WAAW,CAAC,WAAW,qDAAqD;QAC/E,8CAA8C;QAC9C,6BAA6B,2BAA2B,GAAG,CAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,WAAkC,EAClC,YAAoB;IAEpB,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1D,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;AAC9D,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,+BAA+B,CAC7C,OAAyC;IAEzC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACrC,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,IAAI,oBAAoB,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,IAAI,wBAAwB,CAAC;IACjE,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,IAAI,qBAAqB,CAAC;IAC3D,MAAM,aAAa,GACjB,OAAO,CAAC,KAAK,EAAE,iBAAiB,IAAI,sBAAsB,CAAC;IAC7D,MAAM,SAAS,GAAG,GAAuB,EAAE;QACzC,MAAM,EACJ,IAAI,EAAE,EAAE,EACR,MAAM,EAAE,EAAE,EACV,MAAM,EAAE,EAAE,EACV,iBAAiB,EAAE,EAAE,EACrB,GAAG,IAAI,EACR,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,GAAuB,EAAW,EAAE,CACtD,OAAO,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,IAAI,6BAA6B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzE,MAAM,kBAAkB,GAAG,GAAW,EAAE,CACtC,OAAO,CAAC,kBAAkB;QAC1B,mCAAmC,CAAC,WAAW,CAAC,CAAC;IAEnD,IAAI,mBAAgE,CAAC;IAErE,KAAK,UAAU,mBAAmB;QAChC,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACvC,CAAC;QACD,OAAO,CACL,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,2BAA2B,CAAC,WAAW,CAAC,CACzE,CAAC;IACJ,CAAC;IAED,SAAS,sBAAsB,CAAC,QAA4B;QAC1D,IAAI,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,cAAc,GAAG,kCAAkC,CACvD,WAAW,EACX,QAAQ,IAAI,mBAAmB,CAChC,CAAC;QACF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,MAAM,SAAS,GAAG,GAAG;YACnB,EAAE,UAAU,EAAE;YACd,EAAE,MAAM,EAAE,IAAI,EAAE;aACf,KAAK,CAAC,KAAK,CAAC;aACZ,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,WAAW,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,SAAS,YAAY,CACnB,cAA2D;QAE3D,OAAO,CACL,OAAO,CAAC,oBAAoB,EAAE,CAAC,cAAc,CAAC;YAC9C,iCAAiC,CAAC,WAAW,EAAE,cAAc,CAAC,CAC/D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,WAAW,CAAC,SAAS;QACzB,gBAAgB,EAAE,WAAW,CAAC,SAAS;QACvC,WAAW,CAAC,GAAgC;YAC1C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjB,mBAAmB,GAAG,GAAG,CAAC,cAAc,CAAC;gBACzC,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBAC9C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IACE,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC;gBAChC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,EACjC,CAAC;gBACD,mBAAmB,GAAG,GAAG,CAAC,cAAc,CAAC;gBACzC,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBAC9C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;YAClC,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,YAAgC,CAAC;YACrC,IAAI,OAA2B,CAAC;YAChC,IAAI,UAA8B,CAAC;YACnC,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;oBACnC,UAAU,GAAG,MAAM,mBAAmB,EAAE,CAAC;oBACzC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;oBACrD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC;oBACpE,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC3B,YAAY,GAAG,KAAK,EAAE,sBAAsB,CAAC;gBAC/C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO;wBACL,UAAU,EAAE,YAAY;wBACxB,MAAM,EAAE,KAAK;wBACb,SAAS,EAAE,KAAK;wBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;wBACvD,WAAW,EAAE,KAAK,CAAC,OAAO;qBAC3B,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,YAAY;gBACxB,MAAM,EAAE,SAAS;gBACjB,SAAS;gBACT,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/B,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,WAAW,EAAE,KAAK,CAAC,OAAO;gBAC1B,MAAM,EAAE,sBAAsB,EAAE;aACjC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,WAAmB;YAEnB,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;gBAClB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,kBAAkB,EAAE;iBAC5B,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,IAA6C,EAAE;gBAC9D,MAAM,MAAM,GAAG,sBAAsB,EAAE,CAAC;gBACxC,IAAI,uBAAuB,EAAE,EAAE,CAAC;oBAC9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;oBACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC;wBACE,YAAY,EAAE,MAAM,mBAAmB,EAAE;wBACzC,MAAM;wBACN,OAAO;wBACP,QAAQ,EAAE,QAAQ;qBACnB,EACD,SAAS,EAAE,CACZ,CAAC;oBACF,MAAM,YAAY,GAAG,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;oBACtD,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,MAAM,IAAI,KAAK,CACb,4DAA4D,WAAW,CAAC,WAAW,UAAU,CAC9F,CAAC;oBACJ,CAAC;oBACD,OAAO,EAAE,YAAY,EAAE,CAAC;gBAC1B,CAAC;gBACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;gBAC5C,MAAM,KAAK,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC;gBAChC,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;oBAChC,OAAO;wBACL,aAAa,EAAE,IAAI;wBACnB,KAAK,EAAE,kBAAkB,EAAE;qBAC5B,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC1D,OAAO;oBACL,YAAY,EAAE,GAAG,CAAC,iBAAiB,CACjC,KAAK,EACL,KAAK,EACL,WAAW,EACX,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CACjB;iBACF,CAAC;YACJ,CAAC,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;gBACnC,OAAO,GAAG,EAAE,CAAC;YACf,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,GAAG,EAAE,CAAC;YACrB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,sEAAsE;YACtE,qDAAqD;YACrD,MAAM,KAAK,GAAG,GAAG,EAAE,UAAU,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;oBACvD,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;oBACvD,EAAE,CAAC;gBACL,OAAO;oBACL,eAAe,EAAE,SAAS;wBACxB,CAAC,CAAC,GAAG,SAAS,aAAa,WAAW,CAAC,SAAS,YAAY;wBAC5D,CAAC,CAAC,GAAG;iBACR,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC9D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YAC/D,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK;gBACxB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC1C,CAAC,CAAC,sBAAsB,EAAE,CAAC;YAC7B,MAAM,MAAM,CACV,OAAO,EACP,MAAM,mBAAmB,EAAE,EAC3B;gBACE,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS;oBACtC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,EAAE;oBAChD,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM;gBACN,GAAG,CAAC,KAAK,CAAC,YAAY;oBACpB,CAAC,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,YAAY,EAAE;oBAChD,CAAC,CAAC,EAAE,CAAC;gBACP,QAAQ,EAAE;oBACR,iBAAiB,EAAE,MAAM;oBACzB,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;iBAC1B;aACF,EACD,SAAS,EAAE,CACZ,CAAC;YACF,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,aAAa,WAAW,CAAC,SAAS,YAAY;aACrF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM,UAAU,GAAG,MAAM,mBAAmB,EAAE,CAAC;YAC/C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC;YACpE,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,mBAAmB,CACjB,eAAmD;YAEnD,OAAO,OAAO,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACtD,CAAC;QACD,mBAAmB;YACjB,OAAO,CACL,OAAO,CAAC,mBAAmB,EAAE,EAAE;gBAC/B,GAAG,EAAE,UAAU,EAAE,EAAE,YAAY;gBAC/B,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,oBAAoB,CAAC,MAAc;YACvC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAChE,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/identity/fleet-integration-connect.d.ts

@@ -1,32 +0,0 @@
-/**
- * Thin Connect-with-X wiring for Fleet vault integrations that use
- * {@link createByoOauthClient}.
- */
-import { type FleetOAuthIntegration } from "../connectors/toolserver/integrations.js";
-import type { ByoOauthClient } from "./byo-oauth.js";
-import { type FleetVaultConnectProviderOptions } from "./fleet-connect.js";
-import type { FleetClientOptions } from "./fleet.js";
-import { deleteAgentConnection, listAgentConnections, upsertAgentProviderToken } from "./fleet.js";
-import type { IdentityConnectProvider } from "./connect-provider-types.js";
-export interface FleetIntegrationConnectProviderOptions {
-    /** Override LangSmith OAuth provider slug. */
-    providerSlug?: string;
-    /**
-     * OAuth scopes to request. When omitted, uses connector-derived scopes from
-     * the mount context at authorize time, then profile / fallback scopes.
-     */
-    scopes?: string[];
-    /** Injectable Fleet client (tests). */
-    fleet?: FleetClientOptions & {
-        list?: typeof listAgentConnections;
-        upsert?: typeof upsertAgentProviderToken;
-        delete?: typeof deleteAgentConnection;
-    };
-}
-/** Build Fleet vault Connect options for `integration` + its BYO client. */
-export declare function fleetIntegrationConnectOptions(integration: FleetOAuthIntegration, byoClient: ByoOauthClient, options?: FleetIntegrationConnectProviderOptions, fallbackScopes?: readonly string[]): FleetVaultConnectProviderOptions;
-/** Build a Fleet vault Connect provider for `integration` + its BYO client. */
-export declare function createFleetIntegrationConnectProvider(integration: FleetOAuthIntegration, byoClient: ByoOauthClient, options?: FleetIntegrationConnectProviderOptions, fallbackScopes?: readonly string[]): IdentityConnectProvider;
-export declare function isFleetIntegrationConnectConfigured(byoClient: ByoOauthClient, env?: NodeJS.ProcessEnv): boolean;
-export declare function fleetIntegrationConnectUrl(integration: FleetOAuthIntegration, publicAppUrl: string): string;
-//# sourceMappingURL=fleet-integration-connect.d.ts.map

package/dist/identity/fleet-integration-connect.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fleet-integration-connect.d.ts","sourceRoot":"","sources":["../../src/identity/fleet-integration-connect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAIL,KAAK,gCAAgC,EACtC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,MAAM,WAAW,sCAAsC;IACrD,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,uCAAuC;IACvC,KAAK,CAAC,EAAE,kBAAkB,GAAG;QAC3B,IAAI,CAAC,EAAE,OAAO,oBAAoB,CAAC;QACnC,MAAM,CAAC,EAAE,OAAO,wBAAwB,CAAC;QACzC,MAAM,CAAC,EAAE,OAAO,qBAAqB,CAAC;KACvC,CAAC;CACH;AAED,4EAA4E;AAC5E,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,qBAAqB,EAClC,SAAS,EAAE,cAAc,EACzB,OAAO,GAAE,sCAA2C,EACpD,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GACjC,gCAAgC,CAiBlC;AAED,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,qBAAqB,EAClC,SAAS,EAAE,cAAc,EACzB,OAAO,GAAE,sCAA2C,EACpD,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,GACjC,uBAAuB,CASzB;AAED,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,cAAc,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET;AAED,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,qBAAqB,EAClC,YAAY,EAAE,MAAM,GACnB,MAAM,CAER"}

package/dist/identity/fleet-integration-connect.js

@@ -1,35 +0,0 @@
-/**
- * Thin Connect-with-X wiring for Fleet vault integrations that use
- * {@link createByoOauthClient}.
- */
-import { readIntegrationProviderSlug, } from "../connectors/toolserver/integrations.js";
-import { MDA_PUBLIC_APP_URL_ENV } from "./oauth-env.js";
-import { createFleetVaultConnectProvider, fleetConnectUrl, isFleetVaultConnectConfigured, } from "./fleet-connect.js";
-import { deleteAgentConnection, listAgentConnections, upsertAgentProviderToken, } from "./fleet.js";
-/** Build Fleet vault Connect options for `integration` + its BYO client. */
-export function fleetIntegrationConnectOptions(integration, byoClient, options = {}, fallbackScopes) {
-    return {
-        integration,
-        providerSlug: options.providerSlug?.trim() || readIntegrationProviderSlug(integration),
-        ...(options.scopes ? { scopes: options.scopes } : {}),
-        byo: byoClient.byo,
-        resolveRedirectBase: byoClient.resolveRedirectBase,
-        resolvePublicAppUrl() {
-            return (byoClient.resolvePublicAppUrl() ??
-                process.env[MDA_PUBLIC_APP_URL_ENV]?.replace(/\/$/, ""));
-        },
-        ...(options.fleet ? { fleet: options.fleet } : {}),
-        fallbackScopes: [...(fallbackScopes ?? integration.profileScopes ?? [])],
-    };
-}
-/** Build a Fleet vault Connect provider for `integration` + its BYO client. */
-export function createFleetIntegrationConnectProvider(integration, byoClient, options = {}, fallbackScopes) {
-    return createFleetVaultConnectProvider(fleetIntegrationConnectOptions(integration, byoClient, options, fallbackScopes));
-}
-export function isFleetIntegrationConnectConfigured(byoClient, env = process.env) {
-    return isFleetVaultConnectConfigured(byoClient.byo, env);
-}
-export function fleetIntegrationConnectUrl(integration, publicAppUrl) {
-    return fleetConnectUrl(integration, publicAppUrl);
-}
-//# sourceMappingURL=fleet-integration-connect.js.map