managed-deepagents 0.4.2 → 0.4.3-dev.95

package/dist/identity/github/credentials.js

@@ -1,7 +1,10 @@
 import { importPKCS8, SignJWT } from "jose";
+import { fetchWithTimeout, PROVIDER_HTTP_TIMEOUT_MS, } from "../../runtime/http.js";
+import { connect as githubConnect } from "./connect-http.js";
 import { getGitHubCredentialStore } from "./credentials-store.js";
 const DEFAULT_READ_CHAIN = ["installation", "pat"];
-const DEFAULT_WRITE_CHAIN = ["actor"];
+const DEFAULT_WRITE_CHAIN = ["user"];
+const USER_TOKEN_SOURCES = ["user"];
 const GITHUB_API_VERSION = "2022-11-28";
 const USER_AGENT = "managed-deepagents";
 /**
@@ -13,18 +16,21 @@ const USER_AGENT = "managed-deepagents";
  * import { defineIdentity, github } from "managed-deepagents";
  *
  * export const identity = defineIdentity({
- *   // ...
- *   scoping: { memory: "actor", credentials: "custom" },
- *   credentials: github.credentials({ repositories: ["acme/*"] }),
+ *   credentials: credentials.github({ repositories: ["acme/*"] }),
  * });
  * ```
+ *
+ * When a chain reads user tokens from the managed vault, the returned config
+ * declares Connect-with-GitHub so `defineIdentity` mounts `/identity/github/…`
+ * without a separate `connect` entry.
  */
 export function credentials(options = {}) {
     validateGithubCredentialsOptions(options);
     return {
+        ...(usesUserTokens(options) ? { connect: [githubConnect()] } : {}),
         async resolve({ identity, target }) {
             if (target.name !== "github") {
-                throw new Error(`github.credentials(...) can only resolve target name "github" (received "${target.name}").`);
+                throw new Error(`credentials.github(...) can only resolve target name "github" (received "${target.name}").`);
             }
             const repo = repoFromTarget(target) ?? defaultRepoFromPatterns(options.repositories);
             assertRepoAllowed(repo, options.repositories);
@@ -37,17 +43,31 @@ export function credentials(options = {}) {
                     return credential;
                 }
             }
-            throw new Error(`github.credentials(...) could not resolve a GitHub credential for target "${target.name}".`);
+            throw new Error(`credentials.github(...) could not resolve a GitHub credential for target "${target.name}".`);
         },
     };
 }
+/**
+ * True when either chain can reach the per-user OAuth vault.
+ *
+ * A custom `resolveUserToken` hook replaces the vault, so a deployment that
+ * supplies one owns its token source and needs no Connect-with-GitHub routes.
+ */
+function usesUserTokens(options) {
+    if (options.resolveUserToken) {
+        return false;
+    }
+    const read = options.read ?? DEFAULT_READ_CHAIN;
+    const write = options.write ?? DEFAULT_WRITE_CHAIN;
+    return [...read, ...write].some((source) => USER_TOKEN_SOURCES.includes(source));
+}
 function validateGithubCredentialsOptions(options) {
     validateChain("read", options.read);
     validateChain("write", options.write);
     if (options.repositories) {
         for (const pattern of options.repositories) {
             if (!isAllowedRepoPattern(pattern)) {
-                throw new Error(`github.credentials(...) repository allowlist entry "${pattern}" must look like "owner/repo" or "owner/*".`);
+                throw new Error(`credentials.github(...) repository allowlist entry "${pattern}" must look like "owner/repo" or "owner/*".`);
             }
         }
     }
@@ -56,11 +76,11 @@ function validateChain(name, chain) {
     if (chain === undefined)
         return;
     if (!Array.isArray(chain) || chain.length === 0) {
-        throw new Error(`github.credentials(...) \`${name}\` must be a non-empty token source list.`);
+        throw new Error(`credentials.github(...) \`${name}\` must be a non-empty token source list.`);
     }
     for (const source of chain) {
-        if (source !== "actor" && source !== "installation" && source !== "pat") {
-            throw new Error(`github.credentials(...) unknown token source "${String(source)}".`);
+        if (source !== "user" && source !== "installation" && source !== "pat") {
+            throw new Error(`credentials.github(...) unknown token source "${String(source)}".`);
         }
     }
 }
@@ -69,8 +89,8 @@ async function resolveSource(source, ctx, options) {
         const token = options.pat ?? process.env.GITHUB_TOKEN ?? process.env.GITHUB_PAT;
         return token ? bearer(token) : undefined;
     }
-    if (source === "actor") {
-        const resolve = options.resolveActorToken ?? defaultResolveActorToken;
+    if (source === "user") {
+        const resolve = options.resolveUserToken ?? defaultResolveUserToken;
         const token = await resolve({
             identity: ctx.identity,
             scopes: ["repo"],
@@ -87,13 +107,13 @@ async function installationCredential(target, options) {
         return undefined;
     }
     if (!appId || !privateKey) {
-        throw new Error('github.credentials(...) token source "installation" requires `appId` and `privateKey` (or GITHUB_APP_ID / GITHUB_APP_PRIVATE_KEY).');
+        throw new Error('credentials.github(...) token source "installation" requires `appId` and `privateKey` (or GITHUB_APP_ID / GITHUB_APP_PRIVATE_KEY).');
     }
     const appJwt = options.createAppJwt
         ? await options.createAppJwt({ appId, privateKey })
         : await createGitHubAppJwt({ appId, privateKey });
     const fetchImpl = options.fetch ?? fetch;
-    const response = await fetchImpl(`https://api.github.com/app/installations/${encodeURIComponent(installationId)}/access_tokens`, {
+    const response = await fetchWithTimeout(`https://api.github.com/app/installations/${encodeURIComponent(installationId)}/access_tokens`, {
         method: "POST",
         headers: {
             Accept: "application/vnd.github+json",
@@ -101,13 +121,13 @@ async function installationCredential(target, options) {
             "User-Agent": USER_AGENT,
             "X-GitHub-Api-Version": GITHUB_API_VERSION,
         },
-    });
+    }, PROVIDER_HTTP_TIMEOUT_MS, fetchImpl);
     if (!response.ok) {
-        throw new Error(`github.credentials(...) GitHub installation token request failed with ${response.status}.`);
+        throw new Error(`credentials.github(...) GitHub installation token request failed with ${response.status}.`);
     }
     const body = (await response.json());
     if (typeof body.token !== "string" || body.token.length === 0) {
-        throw new Error("github.credentials(...) GitHub installation token response did not include `token`.");
+        throw new Error("credentials.github(...) GitHub installation token response did not include `token`.");
     }
     return {
         ...bearer(body.token),
@@ -127,11 +147,11 @@ async function createGitHubAppJwt({ appId, privateKey, }) {
         .sign(key);
 }
 /**
- * Default actor-token lookup: Connect-with-GitHub vault keyed by actor id.
- * Returns undefined when the actor has not connected GitHub yet.
+ * Default user-token lookup: Connect-with-GitHub vault keyed by user id.
+ * Returns undefined when the user has not connected GitHub yet.
  */
-export async function defaultResolveActorToken(args) {
-    const record = await getGitHubCredentialStore().getByActorId(args.identity.actor.id);
+export async function defaultResolveUserToken(args) {
+    const record = await getGitHubCredentialStore().getByUserId(args.identity.user.id);
     return record?.accessToken;
 }
 function bearer(token) {
@@ -153,10 +173,10 @@ function assertRepoAllowed(repo, patterns) {
     if (!patterns || patterns.length === 0)
         return;
     if (!repo) {
-        throw new Error("github.credentials(...) target metadata must include `repo` when repositories allowlist is configured (or include an exact owner/repo entry to default).");
+        throw new Error("credentials.github(...) target metadata must include `repo` when repositories allowlist is configured (or include an exact owner/repo entry to default).");
     }
     if (!patterns.some((pattern) => repoMatches(repo, pattern))) {
-        throw new Error(`github.credentials(...) repository "${repo}" is not allowed by the configured repositories allowlist.`);
+        throw new Error(`credentials.github(...) repository "${repo}" is not allowed by the configured repositories allowlist.`);
     }
 }
 /** First exact `owner/repo` pattern, used when callers omit `metadata.repo`. */

package/dist/identity/github/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/identity/github/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAgFlE,MAAM,kBAAkB,GAAwB,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;AACxE,MAAM,mBAAmB,GAAwB,CAAC,OAAO,CAAC,CAAC;AAC3D,MAAM,kBAAkB,GAAG,YAAY,CAAC;AACxC,MAAM,UAAU,GAAG,oBAAoB,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW,CACzB,OAAO,GAA6B,EAAE;IAEtC,gCAAgC,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE;YAChC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,4EAA4E,MAAM,CAAC,IAAI,KAAK,CAC7F,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GACR,cAAc,CAAC,MAAM,CAAC,IAAI,uBAAuB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC1E,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;YAC9C,MAAM,KAAK,GACT,MAAM,CAAC,MAAM,KAAK,OAAO;gBACvB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,mBAAmB,CAAC;gBACxC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAC,CAAC;YAC3C,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;gBAC3B,MAAM,UAAU,GAAG,MAAM,aAAa,CACpC,MAAM,EACN,EAAE,QAAQ,EAAE,MAAM,EAAE,EACpB,OAAO,CACR,CAAC;gBACF,IAAI,UAAU,EAAE,CAAC;oBACf,OAAO,UAAU,CAAC;gBACpB,CAAC;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CACb,6EAA6E,MAAM,CAAC,IAAI,IAAI,CAC7F,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,OAAiC;IAEjC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YAC3C,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,uDAAuD,OAAO,6CAA6C,CAC5G,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAsB,EAAE,KAAc;IAC3D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,2CAA2C,CAC7E,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3B,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,cAAc,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CACb,iDAAiD,MAAM,CAAC,MAAM,CAAC,IAAI,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,MAAyB,EACzB,GAA4B,EAC5B,OAAiC;IAEjC,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,KAAK,GACT,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACpE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3C,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,IAAI,wBAAwB,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;YAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,CAAC,MAAM,CAAC;SACjB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3C,CAAC;IACD,OAAO,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAAwB,EACxB,OAAiC;IAEjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACzD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC5E,MAAM,cAAc,GAClB,cAAc,CAAC,MAAM,EAAE,gBAAgB,CAAC,IAAI,OAAO,CAAC,cAAc,CAAC;IACrE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,oIAAoI,CACrI,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY;QACjC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACnD,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,4CAA4C,kBAAkB,CAC5D,cAAc,CACf,gBAAgB,EACjB;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,6BAA6B;YACrC,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,YAAY,EAAE,UAAU;YACxB,sBAAsB,EAAE,kBAAkB;SAC3C;KACF,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,yEAAyE,QAAQ,CAAC,MAAM,GAAG,CAC5F,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAC;IACF,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QACrB,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;YACrC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE;YAChC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,EAChC,KAAK,EACL,UAAU,GACO;IACjB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACnD,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;SACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,CAAC,UAAU,GAAG,EAAE,CAAC;SAC5B,iBAAiB,CAAC,UAAU,GAAG,CAAC,GAAG,EAAE,CAAC;SACtC,SAAS,CAAC,KAAK,CAAC;SAChB,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAA0B;IAE1B,MAAM,MAAM,GAAG,MAAM,wBAAwB,EAAE,CAAC,YAAY,CAC1D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CACvB,CAAC;IACF,OAAO,MAAM,EAAE,WAAW,CAAC;AAC7B,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,cAAc,CAAC,MAAwB;IAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAClD,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CACrB,MAAwB,EACxB,GAAW;IAEX,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAwB,EACxB,QAA8B;IAE9B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,0JAA0J,CAC3J,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,4DAA4D,CACxG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,uBAAuB,CAC9B,QAA8B;IAE9B,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,OAAe;IAChD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,KAAK,OAAO,CAAC;AAC1B,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe;IAC3C,OAAO,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACnE,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/identity/github/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE5C,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AA+ElE,MAAM,kBAAkB,GAAwB,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;AACxE,MAAM,mBAAmB,GAAwB,CAAC,MAAM,CAAC,CAAC;AAC1D,MAAM,kBAAkB,GAAiC,CAAC,MAAM,CAAC,CAAC;AAClE,MAAM,kBAAkB,GAAG,YAAY,CAAC;AACxC,MAAM,UAAU,GAAG,oBAAoB,CAAC;AAExC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CACzB,OAAO,GAA6B,EAAE;IAEtC,gCAAgC,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE;YAChC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,4EAA4E,MAAM,CAAC,IAAI,KAAK,CAC7F,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GACR,cAAc,CAAC,MAAM,CAAC,IAAI,uBAAuB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC1E,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;YAC9C,MAAM,KAAK,GACT,MAAM,CAAC,MAAM,KAAK,OAAO;gBACvB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,mBAAmB,CAAC;gBACxC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAC,CAAC;YAC3C,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;gBAC3B,MAAM,UAAU,GAAG,MAAM,aAAa,CACpC,MAAM,EACN,EAAE,QAAQ,EAAE,MAAM,EAAE,EACpB,OAAO,CACR,CAAC;gBACF,IAAI,UAAU,EAAE,CAAC;oBACf,OAAO,UAAU,CAAC;gBACpB,CAAC;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CACb,6EAA6E,MAAM,CAAC,IAAI,IAAI,CAC7F,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAiC;IACvD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAC;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,mBAAmB,CAAC;IACnD,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACzC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,OAAiC;IAEjC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YAC3C,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,uDAAuD,OAAO,6CAA6C,CAC5G,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAsB,EAAE,KAAc;IAC3D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,2CAA2C,CAC7E,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3B,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,cAAc,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CACb,iDAAiD,MAAM,CAAC,MAAM,CAAC,IAAI,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,MAAyB,EACzB,GAA4B,EAC5B,OAAiC;IAEjC,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,KAAK,GACT,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACpE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3C,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,IAAI,uBAAuB,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;YAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,CAAC,MAAM,CAAC;SACjB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3C,CAAC;IACD,OAAO,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAAwB,EACxB,OAAiC;IAEjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACzD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC5E,MAAM,cAAc,GAClB,cAAc,CAAC,MAAM,EAAE,gBAAgB,CAAC,IAAI,OAAO,CAAC,cAAc,CAAC;IACrE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,oIAAoI,CACrI,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY;QACjC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACnD,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,4CAA4C,kBAAkB,CAC5D,cAAc,CACf,gBAAgB,EACjB;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,6BAA6B;YACrC,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,YAAY,EAAE,UAAU;YACxB,sBAAsB,EAAE,kBAAkB;SAC3C;KACF,EACD,wBAAwB,EACxB,SAAS,CACV,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,yEAAyE,QAAQ,CAAC,MAAM,GAAG,CAC5F,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAC;IACF,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QACrB,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;YACrC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE;YAChC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,EAChC,KAAK,EACL,UAAU,GACO;IACjB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACnD,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;SACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,CAAC,UAAU,GAAG,EAAE,CAAC;SAC5B,iBAAiB,CAAC,UAAU,GAAG,CAAC,GAAG,EAAE,CAAC;SACtC,SAAS,CAAC,KAAK,CAAC;SAChB,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,wBAAwB,EAAE,CAAC,WAAW,CACzD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CACtB,CAAC;IACF,OAAO,MAAM,EAAE,WAAW,CAAC;AAC7B,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,cAAc,CAAC,MAAwB;IAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAClD,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CACrB,MAAwB,EACxB,GAAW;IAEX,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAwB,EACxB,QAA8B;IAE9B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,0JAA0J,CAC3J,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,4DAA4D,CACxG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,uBAAuB,CAC9B,QAA8B;IAE9B,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,OAAe;IAChD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,KAAK,OAAO,CAAC;AAC1B,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe;IAC3C,OAAO,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACnE,CAAC"}

package/dist/identity/github/index.d.ts

@@ -1,10 +1,7 @@
 /**
  * GitHub identity helpers — credentials resolver + Connect-with-GitHub opt-in.
- *
- * Channel authoring lives under `managed-deepagents/channels/github`
- * (`defineGitHubChannel`). Sandbox connector: `github.connector(...)`.
  */
-export { credentials, type GitHubActorTokenArgs, type GitHubAppJwtArgs, type GitHubCredentialsOptions, type GitHubTokenSource, } from "./credentials.js";
+export { credentials, type GitHubUserTokenArgs, type GitHubAppJwtArgs, type GitHubCredentialsOptions, type GitHubTokenSource, } from "./credentials.js";
 export { connect, createGitHubIdentityConnectProvider, githubIdentityConnectProvider, GITHUB_CONNECT_CALLBACK_PATH, GITHUB_CONNECT_LINK_PATH, GITHUB_CONNECT_START_PATH, GITHUB_CONNECT_STATUS_PATH, } from "./connect-http.js";
 export type { GitHubIdentityConnectProviderOptions } from "./connect-http.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/identity/github/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/github/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,WAAW,EACX,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,OAAO,EACP,mCAAmC,EACnC,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,oCAAoC,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/github/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,OAAO,EACP,mCAAmC,EACnC,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,oCAAoC,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/identity/github/index.js

@@ -1,8 +1,5 @@
 /**
  * GitHub identity helpers — credentials resolver + Connect-with-GitHub opt-in.
- *
- * Channel authoring lives under `managed-deepagents/channels/github`
- * (`defineGitHubChannel`). Sandbox connector: `github.connector(...)`.
  */
 export { credentials, } from "./credentials.js";
 export { connect, createGitHubIdentityConnectProvider, githubIdentityConnectProvider, GITHUB_CONNECT_CALLBACK_PATH, GITHUB_CONNECT_LINK_PATH, GITHUB_CONNECT_START_PATH, GITHUB_CONNECT_STATUS_PATH, } from "./connect-http.js";

package/dist/identity/github/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/github/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,WAAW,GAKZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,OAAO,EACP,mCAAmC,EACnC,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/github/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,GAKZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,OAAO,EACP,mCAAmC,EACnC,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC"}

package/dist/identity/github/oauth.d.ts

@@ -2,25 +2,20 @@
  * GitHub OAuth helpers for Connect-with-GitHub credential binding.
  *
  * Unlike Slack Connect (channel identity remap only), GitHub Connect stores a
- * per-actor OAuth access token so `github.credentials({ write: ["actor"] })`
+ * per-actor OAuth access token so `credentials.github({ write: ["actor"] })`
  * can act as the signed-in user (e.g. open pull requests).
+ *
+ * Implemented as a {@link createByoOauthClient} descriptor with GitHub-specific
+ * token (JSON body) and userinfo (API headers) quirks.
  */
-import { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, resolveSlackOauthRedirectBase } from "../slack/oauth.js";
-export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, };
+import { type ByoOauthClient, type ByoOauthConfig } from "../byo-oauth.js";
 export declare const GITHUB_CLIENT_ID_ENV = "GITHUB_CLIENT_ID";
 export declare const GITHUB_CLIENT_SECRET_ENV = "GITHUB_CLIENT_SECRET";
 /** Space-separated OAuth scopes. Defaults to `repo read:user`. */
 export declare const GITHUB_OAUTH_SCOPES_ENV = "GITHUB_OAUTH_SCOPES";
 /** Override GitHub OAuth/API base (tests). */
 export declare const GITHUB_OAUTH_BASE_ENV = "GITHUB_OAUTH_BASE";
-export interface GitHubOauthConfig {
-    clientId: string;
-    clientSecret: string;
-    publicAppUrl: string;
-    scopes: string;
-    oauthBase: string;
-    apiBase: string;
-}
+export type GitHubOauthConfig = ByoOauthConfig;
 export interface GitHubOauthTokenResult {
     accessToken: string;
     tokenType?: string;
@@ -30,20 +25,23 @@ export interface GitHubOauthTokenResult {
     login: string;
     email?: string;
 }
+/** GitHub BYO OAuth client (config, authorize, exchange). */
+export declare const githubByoOauth: ByoOauthClient;
+/** GitHub-bound OAuth state / connect-ticket helpers. */
+export declare const githubOauthTickets: import("../oauth-tickets.js").OauthTickets;
+export declare const resolveGitHubOauthRedirectBase: typeof import("../oauth-env.js").resolveOauthRedirectBase;
+/**
+ * Requires `MDA_PUBLIC_APP_URL` — unlike Fleet BYO readers, do not fall back
+ * to `MDA_PUBLIC_API_URL`; post-OAuth redirect targets the managed app
+ * (`/settings?github=connected`).
+ */
 export declare function readGitHubOauthConfig(env?: NodeJS.ProcessEnv): GitHubOauthConfig | null;
-/** Reuse the Slack redirect-base resolver (same Host/loopback constraints). */
-export declare const resolveGitHubOauthRedirectBase: typeof resolveSlackOauthRedirectBase;
-export declare function buildGitHubAuthorizeUrl(config: GitHubOauthConfig, state: string, redirectUri: string): string;
-/** Signed state binding the authenticated actor to the OAuth round-trip. */
-export declare function createGitHubOauthState(actorId: string, signingKey: string, nowMs?: number): Promise<string>;
-export declare function verifyGitHubOauthState(state: string, signingKey: string, nowMs?: number): Promise<{
-    actorId: string;
-}>;
+export declare const buildGitHubAuthorizeUrl: (config: ByoOauthConfig, state: string, redirectUri: string, scopes?: string) => string;
 /**
  * Exchange an authorization code for a user access token and profile.
  *
  * GitHub returns `application/x-www-form-urlencoded` unless `Accept:
- * application/json` is set.
+ * application/json` is set — handled by the BYO tokenRequest config.
  */
 export declare function exchangeGitHubOauthCode(config: GitHubOauthConfig, code: string, redirectUri: string, fetchImpl?: typeof fetch): Promise<GitHubOauthTokenResult>;
 //# sourceMappingURL=oauth.d.ts.map

package/dist/identity/github/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/github/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,EAC9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,CAAC;AAEF,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAC/D,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,8CAA8C;AAC9C,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAQzD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CACnC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,iBAAiB,GAAG,IAAI,CAqB1B;AAED,+EAA+E;AAC/E,eAAO,MAAM,8BAA8B,sCAAgC,CAAC;AAE5E,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,MAAM,CAOR;AAED,4EAA4E;AAC5E,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAqB9B;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAgEjC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/github/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AAGzB,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAC/D,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,8CAA8C;AAC9C,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAQzD,MAAM,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAE/C,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAyBD,6DAA6D;AAC7D,eAAO,MAAM,cAAc,EAAE,cAkD3B,CAAC;AAEH,yDAAyD;AACzD,eAAO,MAAM,kBAAkB,4CAAyB,CAAC;AAEzD,eAAO,MAAM,8BAA8B,2DACP,CAAC;AAErC;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,iBAAiB,GAAG,IAAI,CAK1B;AAED,eAAO,MAAM,uBAAuB,yFAAmC,CAAC;AAExE;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAqBjC"}

package/dist/identity/github/oauth.js

@@ -2,13 +2,14 @@
  * GitHub OAuth helpers for Connect-with-GitHub credential binding.
  *
  * Unlike Slack Connect (channel identity remap only), GitHub Connect stores a
- * per-actor OAuth access token so `github.credentials({ write: ["actor"] })`
+ * per-actor OAuth access token so `credentials.github({ write: ["actor"] })`
  * can act as the signed-in user (e.g. open pull requests).
+ *
+ * Implemented as a {@link createByoOauthClient} descriptor with GitHub-specific
+ * token (JSON body) and userinfo (API headers) quirks.
  */
-import { randomBytes } from "node:crypto";
-import { jwtVerify, SignJWT } from "jose";
-import { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, resolveSlackOauthRedirectBase, } from "../slack/oauth.js";
-export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, };
+import { createByoOauthClient, } from "../byo-oauth.js";
+import { MDA_PUBLIC_APP_URL_ENV } from "../oauth-env.js";
 export const GITHUB_CLIENT_ID_ENV = "GITHUB_CLIENT_ID";
 export const GITHUB_CLIENT_SECRET_ENV = "GITHUB_CLIENT_SECRET";
 /** Space-separated OAuth scopes. Defaults to `repo read:user`. */
@@ -18,126 +19,106 @@ export const GITHUB_OAUTH_BASE_ENV = "GITHUB_OAUTH_BASE";
 const DEFAULT_OAUTH_BASE = "https://github.com";
 const DEFAULT_API_BASE = "https://api.github.com";
 const DEFAULT_SCOPES = "repo read:user";
-const STATE_TTL_MS = 10 * 60 * 1000;
-const STATE_JWT_TYP = "mda-github-oauth-state";
-export function readGitHubOauthConfig(env = process.env) {
-    const clientId = env[GITHUB_CLIENT_ID_ENV]?.trim();
-    const clientSecret = env[GITHUB_CLIENT_SECRET_ENV]?.trim();
-    const publicAppUrl = env[MDA_PUBLIC_APP_URL_ENV]?.trim();
-    if (!clientId || !clientSecret || !publicAppUrl) {
-        return null;
-    }
+const SUBJECT_METADATA_KEY = "github_user_id";
+const LOGIN_METADATA_KEY = "github_login";
+function githubEndpoints(env) {
     const oauthBase = (env[GITHUB_OAUTH_BASE_ENV]?.trim() || DEFAULT_OAUTH_BASE).replace(/\/$/, "");
+    const apiBase = oauthBase === DEFAULT_OAUTH_BASE ? DEFAULT_API_BASE : `${oauthBase}/api/v3`;
     return {
-        clientId,
-        clientSecret,
-        publicAppUrl: publicAppUrl.replace(/\/$/, ""),
-        scopes: env[GITHUB_OAUTH_SCOPES_ENV]?.trim() || DEFAULT_SCOPES,
         oauthBase,
-        apiBase: oauthBase === DEFAULT_OAUTH_BASE
-            ? DEFAULT_API_BASE
-            : `${oauthBase}/api/v3`,
+        apiBase,
+        authUrl: `${oauthBase}/login/oauth/authorize`,
+        tokenUrl: `${oauthBase}/login/oauth/access_token`,
+        userInfoUrl: `${apiBase}/user`,
+        defaultScopes: DEFAULT_SCOPES,
     };
 }
-/** Reuse the Slack redirect-base resolver (same Host/loopback constraints). */
-export const resolveGitHubOauthRedirectBase = resolveSlackOauthRedirectBase;
-export function buildGitHubAuthorizeUrl(config, state, redirectUri) {
-    const url = new URL(`${config.oauthBase}/login/oauth/authorize`);
-    url.searchParams.set("client_id", config.clientId);
-    url.searchParams.set("redirect_uri", redirectUri);
-    url.searchParams.set("scope", config.scopes);
-    url.searchParams.set("state", state);
-    return url.toString();
-}
-/** Signed state binding the authenticated actor to the OAuth round-trip. */
-export async function createGitHubOauthState(actorId, signingKey, nowMs = Date.now()) {
-    const iat = Math.floor(nowMs / 1000);
-    const exp = Math.floor((nowMs + STATE_TTL_MS) / 1000);
-    return new SignJWT({
-        actorId,
-        nonce: randomBytes(16).toString("hex"),
-    })
-        .setProtectedHeader({ alg: "HS256", typ: STATE_JWT_TYP })
-        .setIssuedAt(iat)
-        .setExpirationTime(exp)
-        .sign(stateSigningKey(signingKey));
-}
-export async function verifyGitHubOauthState(state, signingKey, nowMs = Date.now()) {
-    try {
-        const { payload } = await jwtVerify(state, stateSigningKey(signingKey), {
-            algorithms: ["HS256"],
-            typ: STATE_JWT_TYP,
-            currentDate: new Date(nowMs),
-        });
-        if (typeof payload.actorId !== "string" || !payload.actorId) {
-            throw new Error("invalid OAuth state actor");
-        }
-        return { actorId: payload.actorId };
-    }
-    catch (err) {
-        if (err instanceof Error && err.message.startsWith("invalid OAuth state")) {
-            throw err;
-        }
-        const message = err instanceof Error ? err.message : String(err);
-        if (/exp|expir/i.test(message)) {
-            throw new Error("OAuth state expired");
+/** GitHub BYO OAuth client (config, authorize, exchange). */
+export const githubByoOauth = createByoOauthClient({
+    providerId: "github",
+    displayName: "GitHub",
+    envPrefix: "GITHUB",
+    envKeys: {
+        scopes: GITHUB_OAUTH_SCOPES_ENV,
+    },
+    defaultPrompt: false,
+    tokenRequest: {
+        format: "json",
+        headers: { Accept: "application/json" },
+    },
+    userInfoRequest: {
+        required: true,
+        headers: {
+            Accept: "application/vnd.github+json",
+            "User-Agent": "managed-deepagents",
+            "X-GitHub-Api-Version": "2022-11-28",
+        },
+    },
+    defaultEndpoints(env) {
+        const endpoints = githubEndpoints(env);
+        return {
+            authUrl: endpoints.authUrl,
+            tokenUrl: endpoints.tokenUrl,
+            userInfoUrl: endpoints.userInfoUrl,
+            defaultScopes: endpoints.defaultScopes,
+        };
+    },
+    parseUserInfo(json) {
+        const id = json.id;
+        const login = typeof json.login === "string" ? json.login : undefined;
+        if (id === undefined || !login) {
+            throw new Error(typeof json.message === "string"
+                ? json.message
+                : "GitHub /user lookup failed");
         }
-        throw new Error("invalid OAuth state signature");
+        return {
+            ...(typeof json.email === "string" && json.email
+                ? { email: json.email }
+                : {}),
+            subject: String(id),
+            metadata: {
+                [LOGIN_METADATA_KEY]: login,
+            },
+        };
+    },
+    subjectMetadataKey: SUBJECT_METADATA_KEY,
+});
+/** GitHub-bound OAuth state / connect-ticket helpers. */
+export const githubOauthTickets = githubByoOauth.tickets;
+export const resolveGitHubOauthRedirectBase = githubByoOauth.resolveRedirectBase;
+/**
+ * Requires `MDA_PUBLIC_APP_URL` — unlike Fleet BYO readers, do not fall back
+ * to `MDA_PUBLIC_API_URL`; post-OAuth redirect targets the managed app
+ * (`/settings?github=connected`).
+ */
+export function readGitHubOauthConfig(env = process.env) {
+    if (!env[MDA_PUBLIC_APP_URL_ENV]?.trim()) {
+        return null;
     }
+    return githubByoOauth.readConfig(env);
 }
+export const buildGitHubAuthorizeUrl = githubByoOauth.buildAuthorizeUrl;
 /**
  * Exchange an authorization code for a user access token and profile.
  *
  * GitHub returns `application/x-www-form-urlencoded` unless `Accept:
- * application/json` is set.
+ * application/json` is set — handled by the BYO tokenRequest config.
  */
 export async function exchangeGitHubOauthCode(config, code, redirectUri, fetchImpl = fetch) {
-    const tokenResponse = await fetchImpl(`${config.oauthBase}/login/oauth/access_token`, {
-        method: "POST",
-        headers: {
-            Accept: "application/json",
-            "Content-Type": "application/json",
-        },
-        body: JSON.stringify({
-            client_id: config.clientId,
-            client_secret: config.clientSecret,
-            code,
-            redirect_uri: redirectUri,
-        }),
-    });
-    const tokenJson = (await tokenResponse.json());
-    if (!tokenResponse.ok || !tokenJson.access_token) {
-        throw new Error(tokenJson.error_description ??
-            tokenJson.error ??
-            "GitHub OAuth token exchange failed");
-    }
-    const userResponse = await fetchImpl(`${config.apiBase}/user`, {
-        headers: {
-            Accept: "application/vnd.github+json",
-            Authorization: `Bearer ${tokenJson.access_token}`,
-            "User-Agent": "managed-deepagents",
-            "X-GitHub-Api-Version": "2022-11-28",
-        },
-    });
-    const userJson = (await userResponse.json());
-    if (!userResponse.ok || userJson.id === undefined || !userJson.login) {
-        throw new Error(userJson.message ?? "GitHub /user lookup failed");
+    const result = await githubByoOauth.exchangeCode(config, code, redirectUri, fetchImpl);
+    const userId = result.metadata?.[SUBJECT_METADATA_KEY];
+    const login = result.metadata?.[LOGIN_METADATA_KEY];
+    if (typeof userId !== "string" || typeof login !== "string" || !login) {
+        throw new Error("GitHub /user lookup failed");
     }
     return {
-        accessToken: tokenJson.access_token,
-        ...(tokenJson.token_type ? { tokenType: tokenJson.token_type } : {}),
-        ...(tokenJson.scope ? { scope: tokenJson.scope } : {}),
-        ...(tokenJson.refresh_token
-            ? { refreshToken: tokenJson.refresh_token }
-            : {}),
-        userId: String(userJson.id),
-        login: userJson.login,
-        ...(typeof userJson.email === "string" && userJson.email
-            ? { email: userJson.email }
-            : {}),
+        accessToken: result.accessToken,
+        ...(result.tokenType ? { tokenType: result.tokenType } : {}),
+        ...(result.scope ? { scope: result.scope } : {}),
+        ...(result.refreshToken ? { refreshToken: result.refreshToken } : {}),
+        userId,
+        login,
+        ...(result.accountLabel ? { email: result.accountLabel } : {}),
     };
 }
-function stateSigningKey(signingKey) {
-    return new TextEncoder().encode(signingKey);
-}
 //# sourceMappingURL=oauth.js.map

package/dist/identity/github/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/identity/github/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AACvD,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAC/D,kEAAkE;AAClE,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAC7D,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAEzD,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAChD,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAClD,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAqB/C,MAAM,UAAU,qBAAqB,CACnC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,YAAY,GAAG,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3D,MAAM,YAAY,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,CAChB,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,IAAI,kBAAkB,CACzD,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrB,OAAO;QACL,QAAQ;QACR,YAAY;QACZ,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7C,MAAM,EAAE,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,cAAc;QAC9D,SAAS;QACT,OAAO,EACL,SAAS,KAAK,kBAAkB;YAC9B,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,GAAG,SAAS,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,6BAA6B,CAAC;AAE5E,MAAM,UAAU,uBAAuB,CACrC,MAAyB,EACzB,KAAa,EACb,WAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,SAAS,wBAAwB,CAAC,CAAC;IACjE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;IACtD,OAAO,IAAI,OAAO,CAAC;QACjB,OAAO;QACP,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACvC,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;SACxD,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,GAAG,CAAC;SACtB,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAa,EACb,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE;YACtE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,aAAa;YAClB,WAAW,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC1E,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAyB,EACzB,IAAY,EACZ,WAAmB,EACnB,SAAS,GAAiB,KAAK;IAE/B,MAAM,aAAa,GAAG,MAAM,SAAS,CACnC,GAAG,MAAM,CAAC,SAAS,2BAA2B,EAC9C;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,CAAC;KACH,CACF,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAO5C,CAAC;IACF,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,SAAS,CAAC,iBAAiB;YACzB,SAAS,CAAC,KAAK;YACf,oCAAoC,CACvC,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,CAAC,OAAO,OAAO,EAAE;QAC7D,OAAO,EAAE;YACP,MAAM,EAAE,6BAA6B;YACrC,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE;YACjD,YAAY,EAAE,oBAAoB;YAClC,sBAAsB,EAAE,YAAY;SACrC;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAK1C,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,IAAI,4BAA4B,CAAC,CAAC;IACpE,CAAC;IAED,OAAO;QACL,WAAW,EAAE,SAAS,CAAC,YAAY;QACnC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,SAAS,CAAC,aAAa;YACzB,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,aAAa,EAAE;YAC3C,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,GAAG,CAAC,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK;YACtD,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;YAC3B,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/identity/github/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,oBAAoB,GAGrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AACvD,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAC/D,kEAAkE;AAClE,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAC7D,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAEzD,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAChD,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAClD,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAC9C,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAc1C,SAAS,eAAe,CAAC,GAAsB;IAQ7C,MAAM,SAAS,GAAG,CAChB,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,IAAI,kBAAkB,CACzD,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrB,MAAM,OAAO,GACX,SAAS,KAAK,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,SAAS,SAAS,CAAC;IAC9E,OAAO;QACL,SAAS;QACT,OAAO;QACP,OAAO,EAAE,GAAG,SAAS,wBAAwB;QAC7C,QAAQ,EAAE,GAAG,SAAS,2BAA2B;QACjD,WAAW,EAAE,GAAG,OAAO,OAAO;QAC9B,aAAa,EAAE,cAAc;KAC9B,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,MAAM,cAAc,GAAmB,oBAAoB,CAAC;IACjE,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,QAAQ;IACrB,SAAS,EAAE,QAAQ;IACnB,OAAO,EAAE;QACP,MAAM,EAAE,uBAAuB;KAChC;IACD,aAAa,EAAE,KAAK;IACpB,YAAY,EAAE;QACZ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC;IACD,eAAe,EAAE;QACf,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE;YACP,MAAM,EAAE,6BAA6B;YACrC,YAAY,EAAE,oBAAoB;YAClC,sBAAsB,EAAE,YAAY;SACrC;KACF;IACD,gBAAgB,CAAC,GAAG;QAClB,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO;YACL,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,aAAa,EAAE,SAAS,CAAC,aAAa;SACvC,CAAC;IACJ,CAAC;IACD,aAAa,CAAC,IAAI;QAChB,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;gBAC9B,CAAC,CAAC,IAAI,CAAC,OAAO;gBACd,CAAC,CAAC,4BAA4B,CACjC,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK;gBAC9C,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;gBACvB,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YACnB,QAAQ,EAAE;gBACR,CAAC,kBAAkB,CAAC,EAAE,KAAK;aAC5B;SACF,CAAC;IACJ,CAAC;IACD,kBAAkB,EAAE,oBAAoB;CACzC,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC,OAAO,CAAC;AAEzD,MAAM,CAAC,MAAM,8BAA8B,GACzC,cAAc,CAAC,mBAAmB,CAAC;AAErC;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC,iBAAiB,CAAC;AAExE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAyB,EACzB,IAAY,EACZ,WAAmB,EACnB,SAAS,GAAiB,KAAK;IAE/B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,YAAY,CAC9C,MAAM,EACN,IAAI,EACJ,WAAW,EACX,SAAS,CACV,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,oBAAoB,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,kBAAkB,CAAC,CAAC;IACpD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM;QACN,KAAK;QACL,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC"}

package/dist/identity/google/connect-http.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Connect-with-Google — thin adapter over {@link defineFleetIntegrationConnect}.
+ *
+ * Mounted under `/identity/google/*` when listed on `identity.connect`, or
+ * inferred from declared Google toolserver connectors on a user-scoped
+ * deployment.
+ */
+import type { FleetIntegrationConnectProviderOptions } from "../fleet-integration-connect.js";
+export declare const GOOGLE_CONNECT_STATUS_PATH: string;
+export declare const GOOGLE_CONNECT_START_PATH: string;
+export declare const GOOGLE_CONNECT_CALLBACK_PATH: string;
+export declare const GOOGLE_CONNECT_LINK_PATH: string;
+export declare const isGoogleActorSubjectEnabled: () => boolean;
+export declare const enableGoogleActorSubject: () => void;
+/**
+ * Enable actor-subject mode when Google connectors imply per-user vault subjects.
+ *
+ * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
+ */
+export declare const enableGoogleActorSubjectFromConnectors: (connectorKinds: readonly (string | undefined)[] | undefined, scope?: import("../connect-provider-types.js").IdentityConnectMountContext["scope"]) => void;
+export declare const resetGoogleActorSubjectEnabledForTests: () => void;
+export declare const isGoogleConnectConfigured: (env?: NodeJS.ProcessEnv) => boolean;
+export declare const googleConnectUrl: (publicAppUrl: string) => string;
+/** Options for {@link createGoogleIdentityConnectProvider}. */
+export type GoogleIdentityConnectProviderOptions = FleetIntegrationConnectProviderOptions;
+/** Build a Google connect provider. */
+export declare const createGoogleIdentityConnectProvider: (options?: FleetIntegrationConnectProviderOptions) => import("../connect-provider-types.js").IdentityConnectProvider;
+/** Default Google connect provider used as a built-in mount candidate. */
+export declare const googleIdentityConnectProvider: import("../connect-provider-types.js").IdentityConnectProvider;
+/**
+ * Opt into Connect-with-Google on `defineIdentity({ connect: […] })`.
+ *
+ * Usually unnecessary: declaring Google toolserver connectors on a user-scoped
+ * identity deployment mounts this provider and derives OAuth scopes automatically.
+ */
+export declare const connect: (options?: FleetIntegrationConnectProviderOptions) => import("../connect-provider-types.js").IdentityConnectProvider;
+//# sourceMappingURL=connect-http.d.ts.map

package/dist/identity/google/connect-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/google/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAC;AAS9F,eAAO,MAAM,0BAA0B,QAAsB,CAAC;AAC9D,eAAO,MAAM,yBAAyB,QAAuB,CAAC;AAC9D,eAAO,MAAM,4BAA4B,QAAwB,CAAC;AAClE,eAAO,MAAM,wBAAwB,QAAoB,CAAC;AAE1D,eAAO,MAAM,2BAA2B,eAA+B,CAAC;AACxE,eAAO,MAAM,wBAAwB,YAA4B,CAAC;AAClE;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,4JACV,CAAC;AAC1C,eAAO,MAAM,sCAAsC,YACV,CAAC;AAC1C,eAAO,MAAM,yBAAyB,sCAA6B,CAAC;AACpE,eAAO,MAAM,gBAAgB,kCAAoB,CAAC;AAElD,+DAA+D;AAC/D,MAAM,MAAM,oCAAoC,GAC9C,sCAAsC,CAAC;AAEzC,uCAAuC;AACvC,eAAO,MAAM,mCAAmC,sHAAwB,CAAC;AAEzE,0EAA0E;AAC1E,eAAO,MAAM,6BAA6B,gEAAkB,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,OAAO,sHAAiB,CAAC"}