@agentconnect.md/setup 1.61.0-rc.204 → 1.61.0-rc.206

package/dist/index.js

@@ -45151,8 +45151,8 @@ function createRemoteJWKSet(url, options) {
 /** Google Chat credential validation shared by the Setup Server and the Control Plane (google-chat-integration.md §3). */
 /** Google's fixed OAuth token endpoint; the key's own `token_uri` is never followed. */
 const GOOGLE_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
-/** The one bounded read that proves the credential; nothing is ever posted. */
-const GOOGLE_CHAT_PROBE_URL = `https://chat.googleapis.com/v1/spaces?pageSize=1`;
+/** The one bounded read that proves the credential, and shows which Workspace customers own the named Spaces the app is in (§10.3); nothing is ever posted. */
+const GOOGLE_CHAT_PROBE_URL = `https://chat.googleapis.com/v1/spaces?pageSize=100&filter=${encodeURIComponent("spaceType = \"SPACE\"")}`;
 /** App authentication only: no user impersonation and no domain-wide delegation (§3). */
 const GOOGLE_CHAT_BOT_SCOPE = "https://www.googleapis.com/auth/chat.bot";
 /** Read-only scope for resolving the key's own project number; a `chat.bot` token cannot read it. */
@@ -45268,10 +45268,14 @@ async function probeGoogleChatCredential(key, fetchImpl, now = () => /* @__PURE_
 	} catch {
 		return unreachable("the Google Chat API");
 	}
-	if (chatResponse.ok) return {
-		status: "ok",
-		message: `${key.clientEmail} authenticated to the Google Chat API as the project's Chat app`
-	};
+	if (chatResponse.ok) {
+		const customerId = soleCustomerOf(await readJson(chatResponse));
+		return {
+			status: "ok",
+			message: `${key.clientEmail} authenticated to the Google Chat API as the project's Chat app`,
+			...customerId ? { customerId } : {}
+		};
+	}
 	if (chatResponse.status >= 500 || chatResponse.status === 429) return unavailable("the Google Chat API", chatResponse.status);
 	const reason = detail((await readJson(chatResponse))?.error?.message) ?? "no details";
 	if (chatResponse.status === 401) return {
@@ -45354,8 +45358,23 @@ async function checkGoogleChatApp(input, fetchImpl, now = () => /* @__PURE__ */
 		status: "ok",
 		key: checked.key,
 		projectNumber: resolved.projectNumber,
-		message: probe.message
-	};
+		message: probe.message,
+		...probe.customerId ? { customerId: probe.customerId } : {}
+	};
+}
+/** The bare id of the one `customers/…` every listed named Space carries; undefined for none, several, or a list with more pages. */
+function soleCustomerOf(body) {
+	if (!body || body.nextPageToken) return void 0;
+	const spaces = Array.isArray(body.spaces) ? body.spaces : [];
+	const customers = /* @__PURE__ */ new Set();
+	for (const space of spaces) {
+		const entry = typeof space === "object" && space !== null ? space : void 0;
+		if (entry?.spaceType !== "SPACE") continue;
+		const customer = typeof entry.customer === "string" ? /^customers\/([A-Za-z0-9_-]{1,128})$/.exec(entry.customer)?.[1] : void 0;
+		if (!customer) return void 0;
+		customers.add(customer);
+	}
+	return customers.size === 1 ? [...customers][0] : void 0;
 }
 /** One app-authenticated access token for `scope`, from Google's fixed token endpoint. */
 async function mintAccessToken(key, scope, fetchImpl, now) {