managed-deepagents 0.5.0-dev.78 → 0.5.0-dev.80

package/dist/identity/claims.js

@@ -0,0 +1,37 @@
+/**
+ * Claim-name resolution shared by authoring validation and the runtime token
+ * mapper, so both agree on which claim supplies each envelope field.
+ */
+/** The claim supplying the caller id, or `undefined` when none is mapped. */
+export function userClaimName(mapping) {
+    return nonEmpty(mapping.user);
+}
+/** The claim supplying the active organization id, if any. */
+export function organizationClaimName(mapping) {
+    return nonEmpty(mapping.organization);
+}
+/**
+ * Normalize a `groups` claim value into a list.
+ *
+ * IdPs are inconsistent here: Auth0 and Okta send an array, Entra sends an array
+ * of object ids, and some proxies flatten to a delimited string. Accept all
+ * three rather than making authors pre-process the claim.
+ */
+export function normalizeGroups(value) {
+    if (Array.isArray(value)) {
+        return value
+            .map((entry) => String(entry).trim())
+            .filter((entry) => entry.length > 0);
+    }
+    if (typeof value === "string") {
+        return value
+            .split(/[,\s]+/)
+            .map((entry) => entry.trim())
+            .filter((entry) => entry.length > 0);
+    }
+    return [];
+}
+function nonEmpty(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+//# sourceMappingURL=claims.js.map

package/dist/identity/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../src/identity/claims.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,OAAqB;IACjD,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,qBAAqB,CACnC,OAAqB;IAErB,OAAO,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK;aACT,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;aACpC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK;aACT,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC"}

package/dist/identity/connect-inference.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Predicates the built-in Connect-with-X providers use to decide whether a
+ * deployment needs their OAuth routes.
+ *
+ * Authors should not have to list a connect provider that the rest of their
+ * identity already implies — a GitHub credential chain that reads user tokens
+ * needs somewhere for the user to grant them, and a Slack channel on a
+ * per-user deployment needs somewhere to link Slack accounts.
+ */
+import type { IdentityConnectMountContext } from "./connect-provider-types.js";
+/**
+ * True when the deployment keys anything durable on the individual caller.
+ *
+ * This is the condition under which a per-user OAuth link is meaningful: an
+ * `agent`-scoped deployment has no per-caller slice to attach a linked account
+ * to, so it never grows connect routes by inference.
+ */
+export declare function isUserScopedDeployment(scope: IdentityConnectMountContext["scope"]): boolean;
+/** True when a channel of `provider` is declared (e.g. a Slack channel). */
+export declare function hasChannelForProvider(channels: IdentityConnectMountContext["channels"], provider: string): boolean;
+/**
+ * Connect provider ids the deployment's credential resolvers depend on.
+ *
+ * Unions across a per-target map, so a multi-platform deployment is treated the
+ * same as a single-platform one.
+ */
+export declare function credentialConnectIds(credentials: IdentityConnectMountContext["credentials"]): Set<string>;
+//# sourceMappingURL=connect-inference.d.ts.map

package/dist/identity/connect-inference.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-inference.d.ts","sourceRoot":"","sources":["../../src/identity/connect-inference.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAG/E;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC1C,OAAO,CAST;AAED,4EAA4E;AAC5E,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,2BAA2B,CAAC,UAAU,CAAC,EACjD,QAAQ,EAAE,MAAM,GACf,OAAO,CAIT;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,2BAA2B,CAAC,aAAa,CAAC,GACtD,GAAG,CAAC,MAAM,CAAC,CAIb"}

package/dist/identity/connect-inference.js

@@ -0,0 +1,39 @@
+/**
+ * Predicates the built-in Connect-with-X providers use to decide whether a
+ * deployment needs their OAuth routes.
+ *
+ * Authors should not have to list a connect provider that the rest of their
+ * identity already implies — a GitHub credential chain that reads user tokens
+ * needs somewhere for the user to grant them, and a Slack channel on a
+ * per-user deployment needs somewhere to link Slack accounts.
+ */
+import { credentialConnectProviders } from "./credential-resolvers.js";
+/**
+ * True when the deployment keys anything durable on the individual caller.
+ *
+ * This is the condition under which a per-user OAuth link is meaningful: an
+ * `agent`-scoped deployment has no per-caller slice to attach a linked account
+ * to, so it never grows connect routes by inference.
+ */
+export function isUserScopedDeployment(scope) {
+    if (!scope) {
+        return false;
+    }
+    return (scope.memory === "user" ||
+        scope.credentials === "user" ||
+        scope.credentials === "custom");
+}
+/** True when a channel of `provider` is declared (e.g. a Slack channel). */
+export function hasChannelForProvider(channels, provider) {
+    return Object.values(channels ?? {}).some((manifest) => manifest?.provider === provider);
+}
+/**
+ * Connect provider ids the deployment's credential resolvers depend on.
+ *
+ * Unions across a per-target map, so a multi-platform deployment is treated the
+ * same as a single-platform one.
+ */
+export function credentialConnectIds(credentials) {
+    return new Set(credentialConnectProviders(credentials).map((provider) => provider.id));
+}
+//# sourceMappingURL=connect-inference.js.map

package/dist/identity/connect-inference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-inference.js","sourceRoot":"","sources":["../../src/identity/connect-inference.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAA2C;IAE3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,MAAM;QACvB,KAAK,CAAC,WAAW,KAAK,MAAM;QAC5B,KAAK,CAAC,WAAW,KAAK,QAAQ,CAC/B,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CACnC,QAAiD,EACjD,QAAgB;IAEhB,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CACvC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAC9C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAuD;IAEvD,OAAO,IAAI,GAAG,CACZ,0BAA0B,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CACvE,CAAC;AACJ,CAAC"}

package/dist/identity/connect-provider-types.d.ts

@@ -1,9 +1,12 @@
 /**
  * Connect-with-X plugin contract.
  *
- * List providers on `identity.connect` (e.g. `github.connect()`) to mount
+ * List providers on `identity.connect` (e.g. `connect.github()`) to mount
  * `/identity/{id}/{status,connect,callback,link}` from the managed HTTP app.
+ * Built-in providers also mount when the deployment implies them (see
+ * {@link IdentityConnectMountContext}).
  */
+import type { IdentityConfig } from "./types.js";
 /** Context for deciding whether a provider's routes should mount. */
 export interface IdentityConnectMountContext {
     /** Compiled channel manifests (file stem → manifest). */
@@ -12,6 +15,20 @@ export interface IdentityConnectMountContext {
     }>;
     /** True when the project declared managed identity. */
     hasIdentity: boolean;
+    /**
+     * True when this provider appears on `identity.connect`. False when it is
+     * offered as a built-in candidate, in which case the provider's own predicate
+     * decides whether the deployment needs it.
+     */
+    declared?: boolean;
+    /** The deployment's resolved isolation axes. */
+    scope?: IdentityConfig["scope"];
+    /**
+     * The deployment's credential config, when one is declared: a single resolver
+     * or a per-target map. Prefer `credentialConnectIds(ctx.credentials)` over
+     * reading it directly, so both forms are handled.
+     */
+    credentials?: IdentityConfig["credentials"];
 }
 /** JSON object returned by status / error payloads. */
 export type IdentityConnectJson = Record<string, unknown>;
@@ -49,17 +66,17 @@ export interface IdentityConnectProvider {
     readonly settingsQueryKey?: string;
     /** Whether to mount this provider's four routes for the current project. */
     shouldMount(ctx: IdentityConnectMountContext): boolean;
-    /** Secured status payload for the authenticated actor. */
-    status(actorId: string): IdentityConnectJson | Promise<IdentityConnectJson>;
+    /** Secured status payload for the authenticated user. */
+    status(userId: string): IdentityConnectJson | Promise<IdentityConnectJson>;
     /** Begin OAuth — return authorize URL or a not-configured error. */
-    startAuthorize(actorId: string, redirectUri: string): IdentityConnectAuthorizeResult | Promise<IdentityConnectAuthorizeResult>;
+    startAuthorize(userId: string, redirectUri: string): IdentityConnectAuthorizeResult | Promise<IdentityConnectAuthorizeResult>;
     /**
      * Finish OAuth callback. Throw on failure; the scaffold redirects to
      * `/settings?{settingsQueryKey}=error`.
      */
     completeCallback(code: string, state: string, redirectUri: string): IdentityConnectCallbackResult | Promise<IdentityConnectCallbackResult>;
-    /** Remove the actor's link / stored credentials. */
-    unlink(actorId: string): void | Promise<void>;
+    /** Remove the user's link / stored credentials. */
+    unlink(userId: string): void | Promise<void>;
     /** Resolve the public Agent Server base for `redirect_uri`. */
     resolveRedirectBase(options: IdentityConnectRedirectBaseOptions): string;
     /** Public app origin for settings fail/success redirects when available. */

package/dist/identity/connect-provider-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-provider-types.d.ts","sourceRoot":"","sources":["../../src/identity/connect-provider-types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qEAAqE;AACrE,MAAM,WAAW,2BAA2B;IAC1C,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,uDAAuD;IACvD,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,uDAAuD;AACvD,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1D,MAAM,MAAM,8BAA8B,GACtC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,GACxB;IAAE,aAAa,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C,MAAM,MAAM,6BAA6B,GAAG;IAC1C,oEAAoE;IACpE,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,oEAAoE;AACpE,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;KAAE,CAAC;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,4EAA4E;IAC5E,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC;IACvD,0DAA0D;IAC1D,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5E,oEAAoE;IACpE,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,8BAA8B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC5E;;;OAGG;IACH,gBAAgB,CACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,6BAA6B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC1E,oDAAoD;IACpD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,+DAA+D;IAC/D,mBAAmB,CAAC,OAAO,EAAE,kCAAkC,GAAG,MAAM,CAAC;IACzE,4EAA4E;IAC5E,mBAAmB,CAAC,IAAI,MAAM,GAAG,SAAS,CAAC;CAC5C"}
+{"version":3,"file":"connect-provider-types.d.ts","sourceRoot":"","sources":["../../src/identity/connect-provider-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,qEAAqE;AACrE,MAAM,WAAW,2BAA2B;IAC1C,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,uDAAuD;IACvD,WAAW,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IAChC;;;;OAIG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC;CAC7C;AAED,uDAAuD;AACvD,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1D,MAAM,MAAM,8BAA8B,GACtC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,GACxB;IAAE,aAAa,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C,MAAM,MAAM,6BAA6B,GAAG;IAC1C,oEAAoE;IACpE,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,oEAAoE;AACpE,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;KAAE,CAAC;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,4EAA4E;IAC5E,WAAW,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC;IACvD,yDAAyD;IACzD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC3E,oEAAoE;IACpE,cAAc,CACZ,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,8BAA8B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC5E;;;OAGG;IACH,gBAAgB,CACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,6BAA6B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC1E,mDAAmD;IACnD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,+DAA+D;IAC/D,mBAAmB,CAAC,OAAO,EAAE,kCAAkC,GAAG,MAAM,CAAC;IACzE,4EAA4E;IAC5E,mBAAmB,CAAC,IAAI,MAAM,GAAG,SAAS,CAAC;CAC5C"}

package/dist/identity/connect-provider-types.js

@@ -1,8 +1,10 @@
 /**
  * Connect-with-X plugin contract.
  *
- * List providers on `identity.connect` (e.g. `github.connect()`) to mount
+ * List providers on `identity.connect` (e.g. `connect.github()`) to mount
  * `/identity/{id}/{status,connect,callback,link}` from the managed HTTP app.
+ * Built-in providers also mount when the deployment implies them (see
+ * {@link IdentityConnectMountContext}).
  */
 export {};
 //# sourceMappingURL=connect-provider-types.js.map

package/dist/identity/connect-provider-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-provider-types.js","sourceRoot":"","sources":["../../src/identity/connect-provider-types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}
+{"version":3,"file":"connect-provider-types.js","sourceRoot":"","sources":["../../src/identity/connect-provider-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/identity/connect-provider.d.ts

@@ -17,14 +17,19 @@ export interface IdentityConnectMountedRoute {
 }
 export declare function identityConnectSettingsQueryKey(provider: IdentityConnectProvider): string;
 /**
- * Mount Connect-with-X routes for the given providers.
+ * Mount Connect-with-X routes.
  *
- * Authors opt in via `defineIdentity({ connect: [github.connect(), …] })`.
- * An empty list mounts nothing — there is no builtin auto-mount.
+ * Declared providers (`defineIdentity({ connect: [connect.github(), …] })`) are
+ * offered first, then any `candidates` the deployment did not list. Every
+ * provider still decides for itself via `shouldMount`, which sees whether it was
+ * declared — so a built-in can mount because the rest of the identity implies it
+ * without ever mounting on a deployment that has no use for it.
  */
 export declare function mountIdentityConnectProviders(app: Hono, cfg: IdentityConfig, ctx: IdentityConnectMountContext, mounted: IdentityConnectMountedRoute[], options?: {
     deploymentBaseUrl?: string;
-    /** Providers from `identity.connect` (required for production mounts). */
+    /** Providers from `identity.connect`. */
     providers?: IdentityConnectProvider[];
+    /** Built-in providers to offer when the deployment did not list them. */
+    candidates?: IdentityConnectProvider[];
 }): void;
 //# sourceMappingURL=connect-provider.d.ts.map

package/dist/identity/connect-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-provider.d.ts","sourceRoot":"","sources":["../../src/identity/connect-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,6BAA6B,CAAC;AAIrC,YAAY,EACV,8BAA8B,EAC9B,6BAA6B,EAC7B,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,kCAAkC,GACnC,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,uBAAuB,GAChC,MAAM,CAER;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,EACT,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,2BAA2B,EAChC,OAAO,EAAE,2BAA2B,EAAE,EACtC,OAAO,GAAE;IACP,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,SAAS,CAAC,EAAE,uBAAuB,EAAE,CAAC;CAClC,GACL,IAAI,CAQN"}
+{"version":3,"file":"connect-provider.d.ts","sourceRoot":"","sources":["../../src/identity/connect-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,6BAA6B,CAAC;AAIrC,YAAY,EACV,8BAA8B,EAC9B,6BAA6B,EAC7B,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,kCAAkC,GACnC,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,uBAAuB,GAChC,MAAM,CAER;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,EACT,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,2BAA2B,EAChC,OAAO,EAAE,2BAA2B,EAAE,EACtC,OAAO,GAAE;IACP,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yCAAyC;IACzC,SAAS,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACtC,yEAAyE;IACzE,UAAU,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACnC,GACL,IAAI,CAeN"}

package/dist/identity/connect-provider.js

@@ -11,15 +11,25 @@ export function identityConnectSettingsQueryKey(provider) {
     return provider.settingsQueryKey?.trim() || provider.id;
 }
 /**
- * Mount Connect-with-X routes for the given providers.
+ * Mount Connect-with-X routes.
  *
- * Authors opt in via `defineIdentity({ connect: [github.connect(), …] })`.
- * An empty list mounts nothing — there is no builtin auto-mount.
+ * Declared providers (`defineIdentity({ connect: [connect.github(), …] })`) are
+ * offered first, then any `candidates` the deployment did not list. Every
+ * provider still decides for itself via `shouldMount`, which sees whether it was
+ * declared — so a built-in can mount because the rest of the identity implies it
+ * without ever mounting on a deployment that has no use for it.
  */
 export function mountIdentityConnectProviders(app, cfg, ctx, mounted, options = {}) {
-    const providers = options.providers ?? [];
-    for (const provider of providers) {
-        if (!provider.shouldMount(ctx)) {
+    const declared = options.providers ?? [];
+    const declaredIds = new Set(declared.map((provider) => provider.id));
+    const offered = [
+        ...declared.map((provider) => ({ provider, declared: true })),
+        ...(options.candidates ?? [])
+            .filter((provider) => !declaredIds.has(provider.id))
+            .map((provider) => ({ provider, declared: false })),
+    ];
+    for (const { provider, declared: isDeclared } of offered) {
+        if (!provider.shouldMount({ ...ctx, declared: isDeclared })) {
             continue;
         }
         mountOneIdentityConnectProvider(app, cfg, provider, mounted, options);
@@ -47,7 +57,7 @@ function mountOneIdentityConnectProvider(app, cfg, provider, mounted, options) {
         if (identity instanceof Response) {
             return identity;
         }
-        return c.json(await provider.status(identity.actor.id));
+        return c.json(await provider.status(identity.user.id));
     });
     app.get(paths.connect, async (c) => {
         const identity = await resolveOrUnauthorized(cfg, c.req.raw);
@@ -55,7 +65,7 @@ function mountOneIdentityConnectProvider(app, cfg, provider, mounted, options) {
             return identity;
         }
         const redirectUri = callbackRedirectUri(provider, c.req.raw, options.deploymentBaseUrl);
-        const result = await provider.startAuthorize(identity.actor.id, redirectUri);
+        const result = await provider.startAuthorize(identity.user.id, redirectUri);
         if ("notConfigured" in result) {
             return c.json({ error: result.error }, 503);
         }
@@ -92,7 +102,7 @@ function mountOneIdentityConnectProvider(app, cfg, provider, mounted, options) {
         if (identity instanceof Response) {
             return identity;
         }
-        await provider.unlink(identity.actor.id);
+        await provider.unlink(identity.user.id);
         return c.json({ linked: false });
     });
 }

package/dist/identity/connect-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-provider.js","sourceRoot":"","sources":["../../src/identity/connect-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAK1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAW1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAU1D,MAAM,UAAU,+BAA+B,CAC7C,QAAiC;IAEjC,OAAO,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,GAAS,EACT,GAAmB,EACnB,GAAgC,EAChC,OAAsC,EACtC,OAAO,GAIH,EAAE;IAEN,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IAC1C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CACtC,GAAS,EACT,GAAmB,EACnB,QAAiC,EACjC,OAAsC,EACtC,OAAuC;IAEvC,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,YAAY,QAAQ,CAAC,EAAE,UAAU,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI;QAClB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;QACpD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;QACrD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QACvD,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;KAC7C,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC;YACX,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,EACR,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,EACjB,WAAW,CACZ,CAAC;QACF,IAAI,eAAe,IAAI,MAAM,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,SAAS,GACb,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,MAAM;YAChC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAC9D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,SAAS,GACb,QAAQ,CAAC,mBAAmB,EAAE,EAAE;YAChC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAG,SAAS;YAC5B,CAAC,CAAC,GAAG,SAAS,aAAa,WAAW,QAAQ;YAC9C,CAAC,CAAC,GAAG,CAAC;QACR,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,EACR,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,OAAO,CAAC,iBAAiB,CAC1B,CAAC;YACF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CACzD,IAAI,EACJ,KAAK,EACL,WAAW,CACZ,CAAC;YACF,OAAO,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,SAAS,QAAQ,CAAC,EAAE,yBAAyB,EAAE,KAAK,CAAC,CAAC;YACpE,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAiC,EACjC,OAAgB,EAChB,iBAA0B;IAE1B,MAAM,IAAI,GAAG,QAAQ,CAAC,mBAAmB,CAAC;QACxC,UAAU,EAAE,OAAO,CAAC,GAAG;QACvB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB;KAClB,CAAC,CAAC;IACH,OAAO,GAAG,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,GAAmB,EACnB,OAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ;YACxD,CAAC,CAAE,KAA4B,CAAC,MAAM;YACtC,CAAC,CAAC,GAAG,CAAC;QACV,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;QAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE;YACtD,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}
+{"version":3,"file":"connect-provider.js","sourceRoot":"","sources":["../../src/identity/connect-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAK1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAW1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAU1D,MAAM,UAAU,+BAA+B,CAC7C,QAAiC;IAEjC,OAAO,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAC3C,GAAS,EACT,GAAmB,EACnB,GAAgC,EAChC,OAAsC,EACtC,OAAO,GAMH,EAAE;IAEN,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG;QACd,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;KACtD,CAAC;IACF,KAAK,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,OAAO,EAAE,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,+BAA+B,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B,CACtC,GAAS,EACT,GAAmB,EACnB,QAAiC,EACjC,OAAsC,EACtC,OAAuC;IAEvC,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,YAAY,QAAQ,CAAC,EAAE,UAAU,CAAC;IAEhD,KAAK,MAAM,KAAK,IAAI;QAClB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;QACpD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;QACrD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QACvD,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;KAC7C,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC;YACX,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,EACR,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QAC5E,IAAI,eAAe,IAAI,MAAM,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,SAAS,GACb,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,MAAM;YAChC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAC9D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,SAAS,GACb,QAAQ,CAAC,mBAAmB,EAAE,EAAE;YAChC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,YAAY,GAAG,SAAS;YAC5B,CAAC,CAAC,GAAG,SAAS,aAAa,WAAW,QAAQ;YAC9C,CAAC,CAAC,GAAG,CAAC;QACR,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,EACR,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,OAAO,CAAC,iBAAiB,CAC1B,CAAC;YACF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CACzD,IAAI,EACJ,KAAK,EACL,WAAW,CACZ,CAAC;YACF,OAAO,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,SAAS,QAAQ,CAAC,EAAE,yBAAyB,EAAE,KAAK,CAAC,CAAC;YACpE,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,QAAQ,YAAY,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAiC,EACjC,OAAgB,EAChB,iBAA0B;IAE1B,MAAM,IAAI,GAAG,QAAQ,CAAC,mBAAmB,CAAC;QACxC,UAAU,EAAE,OAAO,CAAC,GAAG;QACvB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB;KAClB,CAAC,CAAC;IACH,OAAO,GAAG,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,GAAmB,EACnB,OAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ;YACxD,CAAC,CAAE,KAA4B,CAAC,MAAM;YACtC,CAAC,CAAC,GAAG,CAAC;QACV,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;QAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE;YACtD,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/identity/credential-resolvers.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Shape helpers for the two `credentials` forms, shared by authoring validation,
+ * normalization, and the runtime resolver so all three agree on which form a
+ * config is.
+ *
+ * A single resolver handles every target itself. A per-target map lets one
+ * deployment integrate several platforms without hand-writing the dispatch — and
+ * without losing the Connect-with-X routes each entry declares, which is the
+ * failure mode a hand-written dispatcher has.
+ */
+import type { IdentityConnectProvider } from "./connect-provider-types.js";
+import type { CredentialResolverConfig, CredentialResolvers } from "./types.js";
+/**
+ * True when `value` is a single {@link CredentialResolverConfig} rather than a
+ * per-target map.
+ *
+ * Discriminates on the *type* of `resolve`/`endpoint`, not merely their
+ * presence, so a target legitimately named `"resolve"` or `"endpoint"` in a map
+ * is not mistaken for the single form.
+ */
+export declare function isSingleCredentialResolver(value: CredentialResolverConfig | CredentialResolvers): value is CredentialResolverConfig;
+/** The target names a per-target map resolves, in declaration order. */
+export declare function credentialTargetNames(value: CredentialResolverConfig | CredentialResolvers): string[];
+/**
+ * Every Connect-with-X provider the config depends on, deduplicated by id and in
+ * declaration order.
+ *
+ * Unioning across map entries is what keeps inference working for a
+ * multi-platform deployment: each entry declares its own routes, and the author
+ * repeats none of them.
+ */
+export declare function credentialConnectProviders(value: CredentialResolverConfig | CredentialResolvers | undefined): IdentityConnectProvider[];
+//# sourceMappingURL=credential-resolvers.d.ts.map

package/dist/identity/credential-resolvers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-resolvers.d.ts","sourceRoot":"","sources":["../../src/identity/credential-resolvers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEhF;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,GACpD,KAAK,IAAI,wBAAwB,CAWnC;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,GACpD,MAAM,EAAE,CAEV;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,GAAG,SAAS,GAChE,uBAAuB,EAAE,CAgB3B"}

package/dist/identity/credential-resolvers.js

@@ -0,0 +1,62 @@
+/**
+ * Shape helpers for the two `credentials` forms, shared by authoring validation,
+ * normalization, and the runtime resolver so all three agree on which form a
+ * config is.
+ *
+ * A single resolver handles every target itself. A per-target map lets one
+ * deployment integrate several platforms without hand-writing the dispatch — and
+ * without losing the Connect-with-X routes each entry declares, which is the
+ * failure mode a hand-written dispatcher has.
+ */
+/**
+ * True when `value` is a single {@link CredentialResolverConfig} rather than a
+ * per-target map.
+ *
+ * Discriminates on the *type* of `resolve`/`endpoint`, not merely their
+ * presence, so a target legitimately named `"resolve"` or `"endpoint"` in a map
+ * is not mistaken for the single form.
+ */
+export function isSingleCredentialResolver(value) {
+    const candidate = value;
+    if (typeof candidate.resolve === "function") {
+        return true;
+    }
+    const endpoint = candidate.endpoint;
+    return (typeof endpoint === "object" &&
+        endpoint !== null &&
+        typeof endpoint.url === "string");
+}
+/** The target names a per-target map resolves, in declaration order. */
+export function credentialTargetNames(value) {
+    return isSingleCredentialResolver(value) ? [] : Object.keys(value);
+}
+/**
+ * Every Connect-with-X provider the config depends on, deduplicated by id and in
+ * declaration order.
+ *
+ * Unioning across map entries is what keeps inference working for a
+ * multi-platform deployment: each entry declares its own routes, and the author
+ * repeats none of them.
+ */
+export function credentialConnectProviders(value) {
+    if (value === undefined || value === null || typeof value !== "object") {
+        return [];
+    }
+    const configs = isSingleCredentialResolver(value)
+        ? [value]
+        : Object.values(value);
+    const out = [];
+    for (const config of configs) {
+        for (const provider of declaredConnect(config)) {
+            if (!out.some((existing) => existing.id === provider.id)) {
+                out.push(provider);
+            }
+        }
+    }
+    return out;
+}
+function declaredConnect(config) {
+    const connect = config?.connect;
+    return Array.isArray(connect) ? connect : [];
+}
+//# sourceMappingURL=credential-resolvers.js.map

package/dist/identity/credential-resolvers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-resolvers.js","sourceRoot":"","sources":["../../src/identity/credential-resolvers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAqD;IAErD,MAAM,SAAS,GAAG,KAAkD,CAAC;IACrE,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;IACpC,OAAO,CACL,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,KAAK,IAAI;QACjB,OAAQ,QAA8B,CAAC,GAAG,KAAK,QAAQ,CACxD,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,qBAAqB,CACnC,KAAqD;IAErD,OAAO,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAiE;IAEjE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC;QAC/C,CAAC,CAAC,CAAC,KAAK,CAAC;QACT,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,GAAG,GAA8B,EAAE,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,QAAQ,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,MAAe;IACtC,MAAM,OAAO,GAAI,MAA4C,EAAE,OAAO,CAAC;IACvE,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAAqC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9E,CAAC"}

package/dist/identity/github/connect-http.d.ts

@@ -22,10 +22,10 @@ export declare const githubIdentityConnectProvider: IdentityConnectProvider;
  *
  * @example
  * ```ts
- * import { defineIdentity, github } from "managed-deepagents";
+ * import { connect, defineIdentity } from "managed-deepagents";
  *
- * export const identity = defineIdentity.preset("internal-tool", {
- *   connect: [github.connect()],
+ * export const identity = defineIdentity({
+ *   connect: [connect.github()],
  * });
  * ```
  */

package/dist/identity/github/connect-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/github/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAKV,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAC;AAehC,eAAO,MAAM,0BAA0B,QAAe,CAAC;AACvD,eAAO,MAAM,yBAAyB,QAAgB,CAAC;AACvD,eAAO,MAAM,4BAA4B,QAAiB,CAAC;AAC3D,eAAO,MAAM,wBAAwB,QAAa,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,WAAW,oCAAoC;IACnD,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED,oEAAoE;AACpE,wBAAgB,mCAAmC,CACjD,OAAO,GAAE,oCAAyC,GACjD,uBAAuB,CAsFzB;AAED,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,EAAE,uBACL,CAAC;AAExC;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,oCAAoC,GAC7C,uBAAuB,CAIzB"}
+{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/github/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAKV,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AAMtC,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAC;AAehC,eAAO,MAAM,0BAA0B,QAAe,CAAC;AACvD,eAAO,MAAM,yBAAyB,QAAgB,CAAC;AACvD,eAAO,MAAM,4BAA4B,QAAiB,CAAC;AAC3D,eAAO,MAAM,wBAAwB,QAAa,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,WAAW,oCAAoC;IACnD,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED,oEAAoE;AACpE,wBAAgB,mCAAmC,CACjD,OAAO,GAAE,oCAAyC,GACjD,uBAAuB,CA+FzB;AAED,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,EAAE,uBACL,CAAC;AAExC;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,oCAAoC,GAC7C,uBAAuB,CAIzB"}

package/dist/identity/github/connect-http.js

@@ -4,6 +4,7 @@
  * Mounted under `/identity/github/*` when listed on `identity.connect`.
  */
 import { identityConnectPaths } from "../connect-paths.js";
+import { credentialConnectIds, isUserScopedDeployment, } from "../connect-inference.js";
 import { buildGitHubCredentialRecord, getGitHubCredentialStore, } from "./credentials-store.js";
 import { buildGitHubAuthorizeUrl, createGitHubOauthState, exchangeGitHubOauthCode, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readGitHubOauthConfig, readOauthStateSigningKey, resolveGitHubOauthRedirectBase, verifyGitHubOauthState, } from "./oauth.js";
 const PATHS = identityConnectPaths("github");
@@ -17,12 +18,19 @@ export function createGitHubIdentityConnectProvider(options = {}) {
     return {
         id: "github",
         shouldMount(ctx) {
-            // Opt-in is via `identity.connect`; this is a secondary gate only.
-            return ctx.hasIdentity;
+            if (!ctx.hasIdentity) {
+                return false;
+            }
+            // Listed on `identity.connect` — the author already opted in. Otherwise
+            // mount only when a credential chain reads per-user GitHub tokens, since
+            // those tokens have no other way to be granted.
+            return (ctx.declared !== false ||
+                (credentialConnectIds(ctx.credentials).has("github") &&
+                    isUserScopedDeployment(ctx.scope)));
         },
-        async status(actorId) {
+        async status(userId) {
             const configured = Boolean(readGitHubOauthConfig());
-            const record = await store().getByActorId(actorId);
+            const record = await store().getByUserId(userId);
             return {
                 configured,
                 linked: Boolean(record),
@@ -36,7 +44,7 @@ export function createGitHubIdentityConnectProvider(options = {}) {
                     : {}),
             };
         },
-        async startAuthorize(actorId, redirectUri) {
+        async startAuthorize(userId, redirectUri) {
             const oauth = readGitHubOauthConfig();
             const stateKey = readOauthStateSigningKey();
             if (!oauth || !stateKey) {
@@ -45,7 +53,7 @@ export function createGitHubIdentityConnectProvider(options = {}) {
                     error: `GitHub connect is not configured (set GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, MDA_PUBLIC_APP_URL, ${OAUTH_STATE_SIGNING_KEY_ENV})`,
                 };
             }
-            const state = await createGitHubOauthState(actorId, stateKey);
+            const state = await createGitHubOauthState(userId, stateKey);
             return {
                 authorizeUrl: buildGitHubAuthorizeUrl(oauth, state, redirectUri),
             };
@@ -59,10 +67,10 @@ export function createGitHubIdentityConnectProvider(options = {}) {
             if (!stateKey) {
                 throw new Error(`${OAUTH_STATE_SIGNING_KEY_ENV} is not configured`);
             }
-            const { actorId } = await verifyGitHubOauthState(state, stateKey);
+            const { userId } = await verifyGitHubOauthState(state, stateKey);
             const token = await exchangeGitHubOauthCode(oauth, code, redirectUri);
             const record = buildGitHubCredentialRecord({
-                actorId,
+                userId,
                 githubUserId: token.userId,
                 githubLogin: token.login,
                 accessToken: token.accessToken,
@@ -76,8 +84,8 @@ export function createGitHubIdentityConnectProvider(options = {}) {
                 successRedirect: `${oauth.publicAppUrl}/settings?github=connected`,
             };
         },
-        async unlink(actorId) {
-            await store().removeByActorId(actorId);
+        async unlink(userId) {
+            await store().removeByUserId(userId);
         },
         resolveRedirectBase(options) {
             return resolveGitHubOauthRedirectBase(options);
@@ -96,10 +104,10 @@ export const githubIdentityConnectProvider = createGitHubIdentityConnectProvider
  *
  * @example
  * ```ts
- * import { defineIdentity, github } from "managed-deepagents";
+ * import { connect, defineIdentity } from "managed-deepagents";
  *
- * export const identity = defineIdentity.preset("internal-tool", {
- *   connect: [github.connect()],
+ * export const identity = defineIdentity({
+ *   connect: [connect.github()],
  * });
  * ```
  */

package/dist/identity/github/connect-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/github/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,GAEzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,EAC3B,qBAAqB,EACrB,wBAAwB,EACxB,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC,MAAM,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,OAAO,CAAC;AACvD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,IAAI,CAAC;AAOnD,oEAAoE;AACpE,MAAM,UAAU,mCAAmC,CACjD,OAAO,GAAyC,EAAE;IAElD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,IAAI,wBAAwB,EAAE,CAAC;IAE1E,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,WAAW,CAAC,GAAgC;YAC1C,mEAAmE;YACnE,OAAO,GAAG,CAAC,WAAW,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAe;YAC1B,MAAM,UAAU,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACnD,OAAO;gBACL,UAAU;gBACV,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;gBACvB,GAAG,CAAC,MAAM;oBACR,CAAC,CAAC;wBACE,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;wBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;qBACpB;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,OAAe,EACf,WAAmB;YAEnB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,qGAAqG,2BAA2B,GAAG;iBAC3I,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC9D,OAAO;gBACL,YAAY,EAAE,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;aACjE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,2BAA2B,CAAC;gBACzC,OAAO;gBACP,YAAY,EAAE,KAAK,CAAC,MAAM;gBAC1B,WAAW,EAAE,KAAK,CAAC,KAAK;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/C,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,4BAA4B;aACnE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAe;YAC1B,MAAM,KAAK,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,mBAAmB,CAAC,OAA2C;YAC7D,OAAO,8BAA8B,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QACD,mBAAmB;YACjB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,OAAO,CACL,KAAK,EAAE,YAAY;gBACnB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GACxC,mCAAmC,EAAE,CAAC;AAExC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CACrB,OAA8C;IAE9C,OAAO,OAAO;QACZ,CAAC,CAAC,mCAAmC,CAAC,OAAO,CAAC;QAC9C,CAAC,CAAC,6BAA6B,CAAC;AACpC,CAAC"}
+{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/github/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,GAEzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,EAC3B,qBAAqB,EACrB,wBAAwB,EACxB,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC,MAAM,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,OAAO,CAAC;AACvD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,IAAI,CAAC;AAOnD,oEAAoE;AACpE,MAAM,UAAU,mCAAmC,CACjD,OAAO,GAAyC,EAAE;IAElD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,IAAI,wBAAwB,EAAE,CAAC;IAE1E,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,WAAW,CAAC,GAAgC;YAC1C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,wEAAwE;YACxE,yEAAyE;YACzE,gDAAgD;YAChD,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,KAAK;gBACtB,CAAC,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAClD,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,UAAU,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACjD,OAAO;gBACL,UAAU;gBACV,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;gBACvB,GAAG,CAAC,MAAM;oBACR,CAAC,CAAC;wBACE,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;wBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;qBACpB;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,WAAmB;YAEnB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,qGAAqG,2BAA2B,GAAG;iBAC3I,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC7D,OAAO;gBACL,YAAY,EAAE,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;aACjE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACjE,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,2BAA2B,CAAC;gBACzC,MAAM;gBACN,YAAY,EAAE,KAAK,CAAC,MAAM;gBAC1B,WAAW,EAAE,KAAK,CAAC,KAAK;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/C,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,4BAA4B;aACnE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,KAAK,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,mBAAmB,CAAC,OAA2C;YAC7D,OAAO,8BAA8B,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QACD,mBAAmB;YACjB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,OAAO,CACL,KAAK,EAAE,YAAY;gBACnB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GACxC,mCAAmC,EAAE,CAAC;AAExC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CACrB,OAA8C;IAE9C,OAAO,OAAO;QACZ,CAAC,CAAC,mCAAmC,CAAC,OAAO,CAAC;QAC9C,CAAC,CAAC,6BAA6B,CAAC;AACpC,CAAC"}

package/dist/identity/github/credentials-store.d.ts

@@ -2,7 +2,7 @@
  * Per-actor GitHub OAuth credential vault.
  *
  * Stored in the LangGraph Store under `["mda_github_credentials"]`. Connect-
- * with-GitHub upserts after OAuth; `github.credentials` resolves `actor` tokens
+ * with-GitHub upserts after OAuth; `credentials.github` resolves `actor` tokens
  * from here until managed Agent Auth lands.
  *
  * Tokens are deployment-scoped Store values — treat the Store namespace as
@@ -23,7 +23,7 @@ export declare const GITHUB_CREDENTIAL_CACHE_TTL_MS = 30000;
 /** Soft cap on cached GitHub credential records per process. */
 export declare const GITHUB_CREDENTIAL_CACHE_MAX_ENTRIES = 256;
 export interface GitHubCredentialRecord {
-    actorId: string;
+    userId: string;
     githubUserId: string;
     githubLogin: string;
     accessToken: string;
@@ -35,24 +35,24 @@ export interface GitHubCredentialRecord {
     source: "github_oauth";
 }
 export interface GitHubCredentialStore {
-    getByActorId(actorId: string): Promise<GitHubCredentialRecord | null>;
+    getByUserId(userId: string): Promise<GitHubCredentialRecord | null>;
     upsert(record: GitHubCredentialRecord): Promise<void>;
-    removeByActorId(actorId: string): Promise<void>;
+    removeByUserId(userId: string): Promise<void>;
 }
 /** In-memory store for tests. */
 export declare class InMemoryGitHubCredentialStore implements GitHubCredentialStore {
-    private readonly byActor;
-    getByActorId(actorId: string): Promise<GitHubCredentialRecord | null>;
+    private readonly byUser;
+    getByUserId(userId: string): Promise<GitHubCredentialRecord | null>;
     upsert(record: GitHubCredentialRecord): Promise<void>;
-    removeByActorId(actorId: string): Promise<void>;
+    removeByUserId(userId: string): Promise<void>;
 }
 /** LangGraph Store–backed GitHub credential vault. */
 export declare class LangGraphGitHubCredentialStore implements GitHubCredentialStore {
     private readonly client;
     constructor(client: Client);
-    getByActorId(actorId: string): Promise<GitHubCredentialRecord | null>;
+    getByUserId(userId: string): Promise<GitHubCredentialRecord | null>;
     upsert(record: GitHubCredentialRecord): Promise<void>;
-    removeByActorId(actorId: string): Promise<void>;
+    removeByUserId(userId: string): Promise<void>;
 }
 /** Override the process-default credential store (tests). */
 export declare function setGitHubCredentialStore(store: GitHubCredentialStore | null): void;
@@ -64,7 +64,7 @@ export declare function createLangGraphGitHubCredentialStore(options?: {
     ingressSecret?: string;
 }): LangGraphGitHubCredentialStore | null;
 export declare function buildGitHubCredentialRecord(input: {
-    actorId: string;
+    userId: string;
     githubUserId: string;
     githubLogin: string;
     accessToken: string;