managed-deepagents 0.4.0-dev.72 → 0.4.0

package/dist/identity/github/connect-http.js

@@ -0,0 +1,111 @@
+/**
+ * Connect-with-GitHub — {@link IdentityConnectProvider} for actor OAuth tokens.
+ *
+ * Mounted under `/identity/github/*` when listed on `identity.connect`.
+ */
+import { identityConnectPaths } from "../connect-paths.js";
+import { buildGitHubCredentialRecord, getGitHubCredentialStore, } from "./credentials-store.js";
+import { buildGitHubAuthorizeUrl, createGitHubOauthState, exchangeGitHubOauthCode, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readGitHubOauthConfig, readOauthStateSigningKey, resolveGitHubOauthRedirectBase, verifyGitHubOauthState, } from "./oauth.js";
+const PATHS = identityConnectPaths("github");
+export const GITHUB_CONNECT_STATUS_PATH = PATHS.status;
+export const GITHUB_CONNECT_START_PATH = PATHS.connect;
+export const GITHUB_CONNECT_CALLBACK_PATH = PATHS.callback;
+export const GITHUB_CONNECT_LINK_PATH = PATHS.link;
+/** Build a GitHub connect provider (injectable store for tests). */
+export function createGitHubIdentityConnectProvider(options = {}) {
+    const store = () => options.credentialStore ?? getGitHubCredentialStore();
+    return {
+        id: "github",
+        shouldMount(ctx) {
+            // Opt-in is via `identity.connect`; this is a secondary gate only.
+            return ctx.hasIdentity;
+        },
+        async status(actorId) {
+            const configured = Boolean(readGitHubOauthConfig());
+            const record = await store().getByActorId(actorId);
+            return {
+                configured,
+                linked: Boolean(record),
+                ...(record
+                    ? {
+                        githubLogin: record.githubLogin,
+                        githubUserId: record.githubUserId,
+                        linkedAt: record.linkedAt,
+                        scope: record.scope,
+                    }
+                    : {}),
+            };
+        },
+        async startAuthorize(actorId, redirectUri) {
+            const oauth = readGitHubOauthConfig();
+            const stateKey = readOauthStateSigningKey();
+            if (!oauth || !stateKey) {
+                return {
+                    notConfigured: true,
+                    error: `GitHub connect is not configured (set GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, MDA_PUBLIC_APP_URL, ${OAUTH_STATE_SIGNING_KEY_ENV})`,
+                };
+            }
+            const state = await createGitHubOauthState(actorId, stateKey);
+            return {
+                authorizeUrl: buildGitHubAuthorizeUrl(oauth, state, redirectUri),
+            };
+        },
+        async completeCallback(code, state, redirectUri) {
+            const oauth = readGitHubOauthConfig();
+            if (!oauth) {
+                throw new Error("GitHub OAuth is not configured");
+            }
+            const stateKey = readOauthStateSigningKey();
+            if (!stateKey) {
+                throw new Error(`${OAUTH_STATE_SIGNING_KEY_ENV} is not configured`);
+            }
+            const { actorId } = await verifyGitHubOauthState(state, stateKey);
+            const token = await exchangeGitHubOauthCode(oauth, code, redirectUri);
+            const record = buildGitHubCredentialRecord({
+                actorId,
+                githubUserId: token.userId,
+                githubLogin: token.login,
+                accessToken: token.accessToken,
+                ...(token.refreshToken ? { refreshToken: token.refreshToken } : {}),
+                ...(token.tokenType ? { tokenType: token.tokenType } : {}),
+                ...(token.scope ? { scope: token.scope } : {}),
+                ...(token.email ? { email: token.email } : {}),
+            });
+            await store().upsert(record);
+            return {
+                successRedirect: `${oauth.publicAppUrl}/settings?github=connected`,
+            };
+        },
+        async unlink(actorId) {
+            await store().removeByActorId(actorId);
+        },
+        resolveRedirectBase(options) {
+            return resolveGitHubOauthRedirectBase(options);
+        },
+        resolvePublicAppUrl() {
+            const oauth = readGitHubOauthConfig();
+            return (oauth?.publicAppUrl ??
+                process.env[MDA_PUBLIC_APP_URL_ENV]?.replace(/\/$/, ""));
+        },
+    };
+}
+/** Default GitHub connect provider used by the identity-connect registry. */
+export const githubIdentityConnectProvider = createGitHubIdentityConnectProvider();
+/**
+ * Opt into Connect-with-GitHub on `defineIdentity({ connect: […] })`.
+ *
+ * @example
+ * ```ts
+ * import { defineIdentity, github } from "managed-deepagents";
+ *
+ * export const identity = defineIdentity.preset("internal-tool", {
+ *   connect: [github.connect()],
+ * });
+ * ```
+ */
+export function connect(options) {
+    return options
+        ? createGitHubIdentityConnectProvider(options)
+        : githubIdentityConnectProvider;
+}
+//# sourceMappingURL=connect-http.js.map

package/dist/identity/github/connect-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/github/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,GAEzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,EAC3B,qBAAqB,EACrB,wBAAwB,EACxB,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC,MAAM,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,OAAO,CAAC;AACvD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,IAAI,CAAC;AAOnD,oEAAoE;AACpE,MAAM,UAAU,mCAAmC,CACjD,OAAO,GAAyC,EAAE;IAElD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,IAAI,wBAAwB,EAAE,CAAC;IAE1E,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,WAAW,CAAC,GAAgC;YAC1C,mEAAmE;YACnE,OAAO,GAAG,CAAC,WAAW,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAe;YAC1B,MAAM,UAAU,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACnD,OAAO;gBACL,UAAU;gBACV,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;gBACvB,GAAG,CAAC,MAAM;oBACR,CAAC,CAAC;wBACE,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;wBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;qBACpB;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,OAAe,EACf,WAAmB;YAEnB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,qGAAqG,2BAA2B,GAAG;iBAC3I,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC9D,OAAO;gBACL,YAAY,EAAE,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;aACjE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,2BAA2B,CAAC;gBACzC,OAAO;gBACP,YAAY,EAAE,KAAK,CAAC,MAAM;gBAC1B,WAAW,EAAE,KAAK,CAAC,KAAK;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/C,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,4BAA4B;aACnE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAe;YAC1B,MAAM,KAAK,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,mBAAmB,CAAC,OAA2C;YAC7D,OAAO,8BAA8B,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QACD,mBAAmB;YACjB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,OAAO,CACL,KAAK,EAAE,YAAY;gBACnB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GACxC,mCAAmC,EAAE,CAAC;AAExC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CACrB,OAA8C;IAE9C,OAAO,OAAO;QACZ,CAAC,CAAC,mCAAmC,CAAC,OAAO,CAAC;QAC9C,CAAC,CAAC,6BAA6B,CAAC;AACpC,CAAC"}

package/dist/identity/github/credentials-store.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Per-actor GitHub OAuth credential vault.
+ *
+ * Stored in the LangGraph Store under `["mda_github_credentials"]`. Connect-
+ * with-GitHub upserts after OAuth; `github.credentials` resolves `actor` tokens
+ * from here until managed Agent Auth lands.
+ *
+ * Tokens are deployment-scoped Store values — treat the Store namespace as
+ * sensitive and prefer short-lived OAuth tokens / refresh where available.
+ *
+ * Reads always consult the shared Store first (in-graph {@link getStore}, then
+ * the service-principal HTTP client). A small process cache is only a
+ * write-through fallback for the Host quirk where loopback `get` can miss
+ * right after a successful `put` on the same worker — never an authority that
+ * can outlive an unlink/rotate on another worker.
+ */
+import { Client } from "@langchain/langgraph-sdk";
+import { GITHUB_CREDENTIALS_STORE_PREFIX } from "../../runtime/auth.js";
+export { GITHUB_CREDENTIALS_STORE_PREFIX };
+export declare const GITHUB_CREDENTIALS_NAMESPACE: readonly ["mda_github_credentials"];
+/** How long a same-worker write-through entry may survive a Store miss. */
+export declare const GITHUB_CREDENTIAL_CACHE_TTL_MS = 30000;
+/** Soft cap on cached GitHub credential records per process. */
+export declare const GITHUB_CREDENTIAL_CACHE_MAX_ENTRIES = 256;
+export interface GitHubCredentialRecord {
+    actorId: string;
+    githubUserId: string;
+    githubLogin: string;
+    accessToken: string;
+    refreshToken?: string;
+    tokenType?: string;
+    scope?: string;
+    email?: string;
+    linkedAt: string;
+    source: "github_oauth";
+}
+export interface GitHubCredentialStore {
+    getByActorId(actorId: string): Promise<GitHubCredentialRecord | null>;
+    upsert(record: GitHubCredentialRecord): Promise<void>;
+    removeByActorId(actorId: string): Promise<void>;
+}
+/** In-memory store for tests. */
+export declare class InMemoryGitHubCredentialStore implements GitHubCredentialStore {
+    private readonly byActor;
+    getByActorId(actorId: string): Promise<GitHubCredentialRecord | null>;
+    upsert(record: GitHubCredentialRecord): Promise<void>;
+    removeByActorId(actorId: string): Promise<void>;
+}
+/** LangGraph Store–backed GitHub credential vault. */
+export declare class LangGraphGitHubCredentialStore implements GitHubCredentialStore {
+    private readonly client;
+    constructor(client: Client);
+    getByActorId(actorId: string): Promise<GitHubCredentialRecord | null>;
+    upsert(record: GitHubCredentialRecord): Promise<void>;
+    removeByActorId(actorId: string): Promise<void>;
+}
+/** Override the process-default credential store (tests). */
+export declare function setGitHubCredentialStore(store: GitHubCredentialStore | null): void;
+/** Resolve the process-default credential store. */
+export declare function getGitHubCredentialStore(): GitHubCredentialStore;
+export declare function createLangGraphGitHubCredentialStore(options?: {
+    apiUrl?: string;
+    apiKey?: string;
+    ingressSecret?: string;
+}): LangGraphGitHubCredentialStore | null;
+export declare function buildGitHubCredentialRecord(input: {
+    actorId: string;
+    githubUserId: string;
+    githubLogin: string;
+    accessToken: string;
+    refreshToken?: string;
+    tokenType?: string;
+    scope?: string;
+    email?: string;
+}): GitHubCredentialRecord;
+//# sourceMappingURL=credentials-store.d.ts.map

package/dist/identity/github/credentials-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-store.d.ts","sourceRoot":"","sources":["../../../src/identity/github/credentials-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAElD,OAAO,EAEL,+BAA+B,EAIhC,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,+BAA+B,EAAE,CAAC;AAC3C,eAAO,MAAM,4BAA4B,qCAE/B,CAAC;AAEX,2EAA2E;AAC3E,eAAO,MAAM,8BAA8B,QAAS,CAAC;AACrD,gEAAgE;AAChE,eAAO,MAAM,mCAAmC,MAAM,CAAC;AAEvD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACtE,MAAM,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAgBD,iCAAiC;AACjC,qBAAa,6BAA8B,YAAW,qBAAqB;IACzE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6C;IAE/D,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAE1E;IAEK,MAAM,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAEK,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpD;CACF;AAED,sDAAsD;AACtD,qBAAa,8BAA+B,YAAW,qBAAqB;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAEzC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CA0C1E;IAEK,MAAM,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ1D;IAEK,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOpD;CACF;AAID,6DAA6D;AAC7D,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,qBAAqB,GAAG,IAAI,GAClC,IAAI,CAGN;AAED,oDAAoD;AACpD,wBAAgB,wBAAwB,IAAI,qBAAqB,CAQhE;AAED,wBAAgB,oCAAoC,CAClD,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACzE,8BAA8B,GAAG,IAAI,CAqBvC;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,sBAAsB,CAazB"}

package/dist/identity/github/credentials-store.js

@@ -0,0 +1,257 @@
+/**
+ * Per-actor GitHub OAuth credential vault.
+ *
+ * Stored in the LangGraph Store under `["mda_github_credentials"]`. Connect-
+ * with-GitHub upserts after OAuth; `github.credentials` resolves `actor` tokens
+ * from here until managed Agent Auth lands.
+ *
+ * Tokens are deployment-scoped Store values — treat the Store namespace as
+ * sensitive and prefer short-lived OAuth tokens / refresh where available.
+ *
+ * Reads always consult the shared Store first (in-graph {@link getStore}, then
+ * the service-principal HTTP client). A small process cache is only a
+ * write-through fallback for the Host quirk where loopback `get` can miss
+ * right after a successful `put` on the same worker — never an authority that
+ * can outlive an unlink/rotate on another worker.
+ */
+import { getStore } from "@langchain/langgraph";
+import { Client } from "@langchain/langgraph-sdk";
+import { ACTOR_HEADER, GITHUB_CREDENTIALS_STORE_PREFIX, IDENTITY_LINKS_SERVICE_ACTOR, INGRESS_SECRET_ENV, INGRESS_SECRET_HEADER, } from "../../runtime/auth.js";
+import { resolveLoopbackApiUrl } from "../loopback.js";
+export { GITHUB_CREDENTIALS_STORE_PREFIX };
+export const GITHUB_CREDENTIALS_NAMESPACE = [
+    GITHUB_CREDENTIALS_STORE_PREFIX,
+];
+/** How long a same-worker write-through entry may survive a Store miss. */
+export const GITHUB_CREDENTIAL_CACHE_TTL_MS = 30_000;
+/** Soft cap on cached GitHub credential records per process. */
+export const GITHUB_CREDENTIAL_CACHE_MAX_ENTRIES = 256;
+/** Bounded write-through cache shared by LangGraph-backed stores. */
+const processCache = new Map();
+/** In-memory store for tests. */
+export class InMemoryGitHubCredentialStore {
+    byActor = new Map();
+    async getByActorId(actorId) {
+        return this.byActor.get(actorId) ?? null;
+    }
+    async upsert(record) {
+        this.byActor.set(record.actorId, record);
+    }
+    async removeByActorId(actorId) {
+        this.byActor.delete(actorId);
+    }
+}
+/** LangGraph Store–backed GitHub credential vault. */
+export class LangGraphGitHubCredentialStore {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    async getByActorId(actorId) {
+        const fromGraph = await readFromAmbientStore(actorId);
+        if (fromGraph) {
+            rememberCache(actorId, fromGraph, { localWrite: false });
+            return fromGraph;
+        }
+        let storeMiss = false;
+        let storeUnavailable = false;
+        try {
+            const item = await this.client.store.getItem([...GITHUB_CREDENTIALS_NAMESPACE], actorKey(actorId));
+            if (item?.value && typeof item.value === "object") {
+                const record = valueToRecord(item.value);
+                if (record) {
+                    rememberCache(actorId, record, { localWrite: false });
+                    return record;
+                }
+            }
+            storeMiss = true;
+        }
+        catch {
+            storeUnavailable = true;
+        }
+        const cached = liveCacheEntry(actorId);
+        if (cached) {
+            if (storeUnavailable) {
+                return cached.record;
+            }
+            if (storeMiss && cached.localWrite) {
+                // Same-worker Host quirk: put succeeded, loopback get returned empty.
+                return cached.record;
+            }
+        }
+        if (storeMiss) {
+            // Authoritative miss — honor unlink/rotate from another worker.
+            processCache.delete(actorId);
+        }
+        return null;
+    }
+    async upsert(record) {
+        await this.client.store.putItem([...GITHUB_CREDENTIALS_NAMESPACE], actorKey(record.actorId), recordToValue(record));
+        rememberCache(record.actorId, record, { localWrite: true });
+        await writeToAmbientStore(record);
+    }
+    async removeByActorId(actorId) {
+        processCache.delete(actorId);
+        await this.client.store.deleteItem([...GITHUB_CREDENTIALS_NAMESPACE], actorKey(actorId));
+        await deleteFromAmbientStore(actorId);
+    }
+}
+let defaultStore = null;
+/** Override the process-default credential store (tests). */
+export function setGitHubCredentialStore(store) {
+    defaultStore = store;
+    processCache.clear();
+}
+/** Resolve the process-default credential store. */
+export function getGitHubCredentialStore() {
+    if (defaultStore) {
+        return defaultStore;
+    }
+    defaultStore =
+        createLangGraphGitHubCredentialStore() ??
+            new InMemoryGitHubCredentialStore();
+    return defaultStore;
+}
+export function createLangGraphGitHubCredentialStore(options = {}) {
+    const ingressSecret = options.ingressSecret ?? process.env[INGRESS_SECRET_ENV];
+    if (!ingressSecret) {
+        return null;
+    }
+    const apiUrl = resolveLoopbackApiUrl(options.apiUrl);
+    const apiKey = options.apiKey ??
+        process.env.LANGSMITH_API_KEY ??
+        process.env.LANGGRAPH_API_KEY ??
+        "local";
+    const client = new Client({
+        apiUrl,
+        apiKey,
+        defaultHeaders: {
+            [INGRESS_SECRET_HEADER]: ingressSecret,
+            [ACTOR_HEADER]: IDENTITY_LINKS_SERVICE_ACTOR,
+        },
+    });
+    return new LangGraphGitHubCredentialStore(client);
+}
+export function buildGitHubCredentialRecord(input) {
+    return {
+        actorId: input.actorId,
+        githubUserId: input.githubUserId,
+        githubLogin: input.githubLogin,
+        accessToken: input.accessToken,
+        ...(input.refreshToken ? { refreshToken: input.refreshToken } : {}),
+        ...(input.tokenType ? { tokenType: input.tokenType } : {}),
+        ...(input.scope ? { scope: input.scope } : {}),
+        ...(input.email ? { email: input.email } : {}),
+        linkedAt: new Date().toISOString(),
+        source: "github_oauth",
+    };
+}
+function actorKey(actorId) {
+    return `actor:${actorId}`;
+}
+function recordToValue(record) {
+    return { ...record };
+}
+function valueToRecord(value) {
+    const actorId = value.actorId;
+    const githubUserId = value.githubUserId;
+    const githubLogin = value.githubLogin;
+    const accessToken = value.accessToken;
+    if (typeof actorId !== "string" ||
+        typeof githubUserId !== "string" ||
+        typeof githubLogin !== "string" ||
+        typeof accessToken !== "string") {
+        return null;
+    }
+    return {
+        actorId,
+        githubUserId,
+        githubLogin,
+        accessToken,
+        ...(typeof value.refreshToken === "string"
+            ? { refreshToken: value.refreshToken }
+            : {}),
+        ...(typeof value.tokenType === "string"
+            ? { tokenType: value.tokenType }
+            : {}),
+        ...(typeof value.scope === "string" ? { scope: value.scope } : {}),
+        ...(typeof value.email === "string" ? { email: value.email } : {}),
+        linkedAt: typeof value.linkedAt === "string"
+            ? value.linkedAt
+            : new Date().toISOString(),
+        source: "github_oauth",
+    };
+}
+function rememberCache(actorId, record, options) {
+    processCache.set(actorId, {
+        record,
+        cachedAtMs: Date.now(),
+        localWrite: options.localWrite,
+    });
+    evictExpiredAndOverflow();
+}
+function liveCacheEntry(actorId) {
+    const entry = processCache.get(actorId);
+    if (!entry) {
+        return undefined;
+    }
+    if (Date.now() - entry.cachedAtMs > GITHUB_CREDENTIAL_CACHE_TTL_MS) {
+        processCache.delete(actorId);
+        return undefined;
+    }
+    return entry;
+}
+function evictExpiredAndOverflow() {
+    const now = Date.now();
+    for (const [key, entry] of processCache) {
+        if (now - entry.cachedAtMs > GITHUB_CREDENTIAL_CACHE_TTL_MS) {
+            processCache.delete(key);
+        }
+    }
+    while (processCache.size > GITHUB_CREDENTIAL_CACHE_MAX_ENTRIES) {
+        const oldest = processCache.keys().next().value;
+        if (oldest === undefined) {
+            break;
+        }
+        processCache.delete(oldest);
+    }
+}
+async function readFromAmbientStore(actorId) {
+    try {
+        const store = getStore();
+        if (!store)
+            return null;
+        const item = await store.get([...GITHUB_CREDENTIALS_NAMESPACE], actorKey(actorId));
+        if (!item?.value || typeof item.value !== "object") {
+            return null;
+        }
+        return valueToRecord(item.value);
+    }
+    catch {
+        // Outside a runnable context (Connect HTTP handlers, unit tests).
+        return null;
+    }
+}
+async function writeToAmbientStore(record) {
+    try {
+        const store = getStore();
+        if (!store)
+            return;
+        await store.put([...GITHUB_CREDENTIALS_NAMESPACE], actorKey(record.actorId), recordToValue(record));
+    }
+    catch {
+        // Best-effort; HTTP put already persisted.
+    }
+}
+async function deleteFromAmbientStore(actorId) {
+    try {
+        const store = getStore();
+        if (!store)
+            return;
+        await store.delete([...GITHUB_CREDENTIALS_NAMESPACE], actorKey(actorId));
+    }
+    catch {
+        // Best-effort.
+    }
+}
+//# sourceMappingURL=credentials-store.js.map

package/dist/identity/github/credentials-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-store.js","sourceRoot":"","sources":["../../../src/identity/github/credentials-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAElD,OAAO,EACL,YAAY,EACZ,+BAA+B,EAC/B,4BAA4B,EAC5B,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,+BAA+B,EAAE,CAAC;AAC3C,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,+BAA+B;CACvB,CAAC;AAEX,2EAA2E;AAC3E,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC;AACrD,gEAAgE;AAChE,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AAgCvD,qEAAqE;AACrE,MAAM,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;AAE1D,iCAAiC;AACjC,MAAM,OAAO,6BAA6B;IACvB,OAAO,GAAG,IAAI,GAAG,EAAkC,CAAC;IAErE,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA8B;QACzC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;CACF;AAED,sDAAsD;AACtD,MAAM,OAAO,8BAA8B;IACZ,MAAM;IAAnC,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,SAAS,EAAE,CAAC;YACd,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,gBAAgB,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAC1C,CAAC,GAAG,4BAA4B,CAAC,EACjC,QAAQ,CAAC,OAAO,CAAC,CAClB,CAAC;YACF,IAAI,IAAI,EAAE,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAClD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC;gBACpE,IAAI,MAAM,EAAE,CAAC;oBACX,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;oBACtD,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC;YACD,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,gBAAgB,EAAE,CAAC;gBACrB,OAAO,MAAM,CAAC,MAAM,CAAC;YACvB,CAAC;YACD,IAAI,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACnC,sEAAsE;gBACtE,OAAO,MAAM,CAAC,MAAM,CAAC;YACvB,CAAC;QACH,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,gEAAgE;YAChE,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA8B;QACzC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAC7B,CAAC,GAAG,4BAA4B,CAAC,EACjC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EACxB,aAAa,CAAC,MAAM,CAAC,CACtB,CAAC;QACF,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAChC,CAAC,GAAG,4BAA4B,CAAC,EACjC,QAAQ,CAAC,OAAO,CAAC,CAClB,CAAC;QACF,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;CACF;AAED,IAAI,YAAY,GAAiC,IAAI,CAAC;AAEtD,6DAA6D;AAC7D,MAAM,UAAU,wBAAwB,CACtC,KAAmC;IAEnC,YAAY,GAAG,KAAK,CAAC;IACrB,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,wBAAwB;IACtC,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,YAAY;QACV,oCAAoC,EAAE;YACtC,IAAI,6BAA6B,EAAE,CAAC;IACtC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,OAAO,GAAiE,EAAE;IAE1E,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC3D,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,MAAM,GACV,OAAO,CAAC,MAAM;QACd,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,OAAO,CAAC;IACV,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,MAAM;QACN,MAAM;QACN,cAAc,EAAE;YACd,CAAC,qBAAqB,CAAC,EAAE,aAAa;YACtC,CAAC,YAAY,CAAC,EAAE,4BAA4B;SAC7C;KACF,CAAC,CAAC;IACH,OAAO,IAAI,8BAA8B,CAAC,MAAM,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAS3C;IACC,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,MAAM,EAAE,cAAc;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,SAAS,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CACpB,MAA8B;IAE9B,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CACpB,KAA8B;IAE9B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,YAAY,KAAK,QAAQ;QAChC,OAAO,WAAW,KAAK,QAAQ;QAC/B,OAAO,WAAW,KAAK,QAAQ,EAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,OAAO;QACP,YAAY;QACZ,WAAW;QACX,WAAW;QACX,GAAG,CAAC,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;YACxC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE;YACtC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACrC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,QAAQ,EACN,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAChC,CAAC,CAAC,KAAK,CAAC,QAAQ;YAChB,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC9B,MAAM,EAAE,cAAc;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,OAAe,EACf,MAA8B,EAC9B,OAAgC;IAEhC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE;QACxB,MAAM;QACN,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,uBAAuB,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,8BAA8B,EAAE,CAAC;QACnE,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;QACxC,IAAI,GAAG,GAAG,KAAK,CAAC,UAAU,GAAG,8BAA8B,EAAE,CAAC;YAC5D,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC,IAAI,GAAG,mCAAmC,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM;QACR,CAAC;QACD,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAC1B,CAAC,GAAG,4BAA4B,CAAC,EACjC,QAAQ,CAAC,OAAO,CAAC,CAClB,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,aAAa,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,MAA8B;IAE9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,KAAK,CAAC,GAAG,CACb,CAAC,GAAG,4BAA4B,CAAC,EACjC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EACxB,aAAa,CAAC,MAAM,CAAC,CACtB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,OAAe;IACnD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,4BAA4B,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;AACH,CAAC"}

package/dist/identity/github/credentials.d.ts

@@ -0,0 +1,82 @@
+import type { CredentialResolverConfig, RuntimeIdentity } from "../types.js";
+/**
+ * Credential source a GitHub resolver may try for a downstream API call.
+ *
+ * - `"actor"` calls the user-supplied `resolveActorToken` hook.
+ * - `"installation"` mints a GitHub App installation token.
+ * - `"pat"` uses a deployment-scoped personal access token.
+ */
+export type GitHubTokenSource = "actor" | "installation" | "pat";
+/** Arguments passed when GitHub credentials need an actor-scoped OAuth token. */
+export interface GitHubActorTokenArgs {
+    /** The frozen identity envelope for the current run. */
+    identity: RuntimeIdentity;
+    /** OAuth scopes the helper needs for this GitHub operation. */
+    scopes: string[];
+}
+/** Arguments passed to a custom GitHub App JWT factory. */
+export interface GitHubAppJwtArgs {
+    /** GitHub App id used as the JWT issuer. */
+    appId: string;
+    /** PEM-encoded GitHub App private key. Keep this in deployment secrets. */
+    privateKey: string;
+}
+/** Options for {@link credentials}. */
+export interface GitHubCredentialsOptions {
+    /**
+     * Token sources to try for read intents. Defaults to
+     * `["installation", "pat"]`.
+     */
+    read?: GitHubTokenSource[];
+    /** Token sources to try for write intents. Defaults to `["actor"]`. */
+    write?: GitHubTokenSource[];
+    /** GitHub App id. Falls back to `GITHUB_APP_ID`. */
+    appId?: string;
+    /** GitHub App private key. Falls back to `GITHUB_APP_PRIVATE_KEY`. */
+    privateKey?: string;
+    /**
+     * Default installation id when the target metadata does not provide
+     * `installationId`.
+     */
+    installationId?: string;
+    /** Deployment-scoped token. Falls back to `GITHUB_TOKEN` or `GITHUB_PAT`. */
+    pat?: string;
+    /**
+     * Allowed repositories for this resolver, as `owner/repo` or `owner/*`.
+     * When set, targets must include `metadata.repo` (or `owner` + `repository`).
+     */
+    repositories?: string[];
+    /**
+     * Hook that mints or retrieves the actor's GitHub OAuth token. Defaults to
+     * the Connect-with-GitHub credential vault (populated by
+     * `/identity/github/connect`). Supply a custom hook to override until
+     * managed Agent Auth lands.
+     */
+    resolveActorToken?: (args: GitHubActorTokenArgs) => Promise<string | undefined>;
+    /** Fetch implementation for GitHub App installation token exchange. */
+    fetch?: typeof fetch;
+    /** Test/custom hook for producing the GitHub App JWT. */
+    createAppJwt?: (args: GitHubAppJwtArgs) => Promise<string>;
+}
+/**
+ * Build a custom credential resolver for GitHub connection targets.
+ *
+ * Use this through the GitHub namespace:
+ *
+ * ```ts
+ * import { defineIdentity, github } from "managed-deepagents";
+ *
+ * export const identity = defineIdentity({
+ *   // ...
+ *   scoping: { memory: "actor", credentials: "custom" },
+ *   credentials: github.credentials({ repositories: ["acme/*"] }),
+ * });
+ * ```
+ */
+export declare function credentials(options?: GitHubCredentialsOptions): CredentialResolverConfig;
+/**
+ * Default actor-token lookup: Connect-with-GitHub vault keyed by actor id.
+ * Returns undefined when the actor has not connected GitHub yet.
+ */
+export declare function defaultResolveActorToken(args: GitHubActorTokenArgs): Promise<string | undefined>;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/identity/github/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/identity/github/credentials.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,wBAAwB,EAGxB,eAAe,EAChB,MAAM,aAAa,CAAC;AAErB;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,cAAc,GAAG,KAAK,CAAC;AAEjE,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC,wDAAwD;IACxD,QAAQ,EAAE,eAAe,CAAC;IAC1B,+DAA+D;IAC/D,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,uCAAuC;AACvC,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,IAAI,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC3B,uEAAuE;IACvE,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC5B,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,CAClB,IAAI,EAAE,oBAAoB,KACvB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjC,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,yDAAyD;IACzD,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,gBAAgB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D;AAYD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CACzB,OAAO,GAAE,wBAA6B,GACrC,wBAAwB,CA8B1B;AA6HD;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAK7B"}