managed-deepagents 0.5.0-dev.79 → 0.5.0-dev.81

package/dist/identity/fleet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.d.ts","sourceRoot":"","sources":["../../src/identity/fleet.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,kBAAkB,CAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAMR;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBxB;AAiBD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,eAAe,EAAE,CAAC,CAsB5B;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,EAClC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,eAAe,CAAC,CAwB1B;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,0BAA0B,EAChC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,gBAAgB,CAAC,CA2B3B;AAED,sEAAsE;AACtE,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAmBf"}

package/dist/identity/fleet.js

@@ -0,0 +1,133 @@
+/**
+ * LangSmith Fleet client for agent-subject vault connections.
+ *
+ * Shared by Connect providers (Google today; other toolserver OAuth providers
+ * later). Source of truth for Connect status is Fleet agent connections — not
+ * a local Store cache.
+ */
+import { fetchWithTimeout, PROVIDER_HTTP_TIMEOUT_MS } from "../runtime/http.js";
+const DEFAULT_API_URL = "https://api.smith.langchain.com";
+export function resolveFleetApiUrl(env = process.env) {
+    const base = trimmed(env.LANGSMITH_ENDPOINT) ??
+        trimmed(env.LANGCHAIN_ENDPOINT) ??
+        DEFAULT_API_URL;
+    return stripTrailingSlashes(withScheme(base));
+}
+export function resolveFleetHeaders(label, env = process.env) {
+    const apiKey = trimmed(env.LANGSMITH_API_KEY);
+    if (!apiKey) {
+        throw new Error(`${label} needs LANGSMITH_API_KEY to reach the LangSmith Fleet API.`);
+    }
+    const headers = {
+        "x-api-key": apiKey,
+        "Content-Type": "application/json",
+    };
+    const workspaceId = trimmed(env.LANGCHAIN_WORKSPACE_ID);
+    if (workspaceId) {
+        headers["x-tenant-id"] = workspaceId;
+    }
+    return headers;
+}
+function fleetHeaders(label, options, env = process.env) {
+    if (options.apiKey || options.workspaceId) {
+        return {
+            "x-api-key": options.apiKey ?? trimmed(env.LANGSMITH_API_KEY) ?? "",
+            "Content-Type": "application/json",
+            ...(options.workspaceId ? { "x-tenant-id": options.workspaceId } : {}),
+        };
+    }
+    return resolveFleetHeaders(label, env);
+}
+export async function listAgentConnections(agentId, options = {}) {
+    const env = process.env;
+    const base = options.apiUrl ?? resolveFleetApiUrl(env);
+    const headers = fleetHeaders("fleet list connections", options, env);
+    const url = `${base}/v1/fleet/agents/${encodeURIComponent(agentId)}/connections`;
+    const response = await fetchWithTimeout(url, { method: "GET", headers }, PROVIDER_HTTP_TIMEOUT_MS, options.fetchImpl ?? fetch);
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`Fleet list connections failed (${response.status}): ${text || response.statusText}`);
+    }
+    const json = (await response.json());
+    return json.items ?? json.data ?? [];
+}
+export async function upsertAgentProviderToken(agentId, providerSlug, body, options = {}) {
+    const env = process.env;
+    const base = options.apiUrl ?? resolveFleetApiUrl(env);
+    const headers = fleetHeaders("fleet upsert provider token", options, env);
+    const url = `${base}/v1/fleet/agents/${encodeURIComponent(agentId)}` +
+        `/providers/${encodeURIComponent(providerSlug)}/tokens`;
+    const response = await fetchWithTimeout(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body),
+    }, PROVIDER_HTTP_TIMEOUT_MS, options.fetchImpl ?? fetch);
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`Fleet upsert agent provider token failed (${response.status}): ${text || response.statusText}`);
+    }
+    return (await response.json());
+}
+/**
+ * Start a Fleet OAuth session for an agent subject (platform OAuth provider).
+ * Returns a verification_url the browser should open.
+ */
+export async function createFleetAuthSession(body, options = {}) {
+    const env = process.env;
+    const base = options.apiUrl ?? resolveFleetApiUrl(env);
+    const headers = fleetHeaders("fleet auth-session", options, env);
+    const url = `${base}/v1/fleet/auth-sessions`;
+    const response = await fetchWithTimeout(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({
+            provider_slug: body.providerSlug,
+            scopes: body.scopes,
+            agent_id: body.agentId,
+            strategy: body.strategy ?? "create",
+        }),
+    }, PROVIDER_HTTP_TIMEOUT_MS, options.fetchImpl ?? fetch);
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`Fleet auth-session failed (${response.status}): ${text || response.statusText}`);
+    }
+    return (await response.json());
+}
+/** True when LANGSMITH_API_KEY is set so Fleet APIs can be called. */
+export function hasFleetAuthCredentials(env = process.env) {
+    return Boolean(trimmed(env.LANGSMITH_API_KEY));
+}
+export async function deleteAgentConnection(agentId, connectionId, options = {}) {
+    const env = process.env;
+    const base = options.apiUrl ?? resolveFleetApiUrl(env);
+    const headers = fleetHeaders("fleet delete connection", options, env);
+    const url = `${base}/v1/fleet/agents/${encodeURIComponent(agentId)}` +
+        `/connections/${encodeURIComponent(connectionId)}`;
+    const response = await fetchWithTimeout(url, { method: "DELETE", headers }, PROVIDER_HTTP_TIMEOUT_MS, options.fetchImpl ?? fetch);
+    if (!response.ok && response.status !== 404) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`Fleet delete connection failed (${response.status}): ${text || response.statusText}`);
+    }
+}
+function withScheme(base) {
+    const separator = base.indexOf("://");
+    if (separator > 0) {
+        const scheme = base.slice(0, separator);
+        if (/^[a-z][a-z0-9+.-]*$/i.test(scheme)) {
+            return base;
+        }
+    }
+    return `https://${base}`;
+}
+function stripTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value.charCodeAt(end - 1) === 47 /* / */) {
+        end -= 1;
+    }
+    return end === value.length ? value : value.slice(0, end);
+}
+function trimmed(value) {
+    const v = value?.trim();
+    return v ? v : undefined;
+}
+//# sourceMappingURL=fleet.js.map

package/dist/identity/fleet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.js","sourceRoot":"","sources":["../../src/identity/fleet.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,MAAM,eAAe,GAAG,iCAAiC,CAAC;AA2C1D,MAAM,UAAU,kBAAkB,CAChC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,IAAI,GACR,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC/B,eAAe,CAAC;IAClB,OAAO,oBAAoB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,4DAA4D,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAA2B;QACtC,WAAW,EAAE,MAAM;QACnB,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACxD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,aAAa,CAAC,GAAG,WAAW,CAAC;IACvC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CACnB,KAAa,EACb,OAA2B,EAC3B,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QAC1C,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE;YACnE,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,OAAO,GAAuB,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,wBAAwB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,GAAG,IAAI,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC;IACjF,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAC1B,wBAAwB,EACxB,OAAO,CAAC,SAAS,IAAI,KAAK,CAC3B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,kCAAkC,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAe,EACf,YAAoB,EACpB,IAAkC,EAClC,OAAO,GAAuB,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,6BAA6B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1E,MAAM,GAAG,GACP,GAAG,IAAI,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,EAAE;QACxD,cAAc,kBAAkB,CAAC,YAAY,CAAC,SAAS,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH;QACE,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,EACD,wBAAwB,EACxB,OAAO,CAAC,SAAS,IAAI,KAAK,CAC3B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,6CAA6C,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAoB,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAgC,EAChC,OAAO,GAAuB,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,oBAAoB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,GAAG,IAAI,yBAAyB,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH;QACE,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ;SACpC,CAAC;KACH,EACD,wBAAwB,EACxB,OAAO,CAAC,SAAS,IAAI,KAAK,CAC3B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,8BAA8B,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqB,CAAC;AACrD,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,uBAAuB,CACrC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAe,EACf,YAAoB,EACpB,OAAO,GAAuB,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,yBAAyB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACtE,MAAM,GAAG,GACP,GAAG,IAAI,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,EAAE;QACxD,gBAAgB,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAC7B,wBAAwB,EACxB,OAAO,CAAC,SAAS,IAAI,KAAK,CAC3B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,mCAAmC,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACxC,IAAI,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,WAAW,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;QAC3D,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;IACD,OAAO,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,OAAO,CAAC,KAAyB;IACxC,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACxB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3B,CAAC"}

package/dist/identity/github/connect-http.d.ts

@@ -1,7 +1,9 @@
 /**
  * Connect-with-GitHub — {@link IdentityConnectProvider} for actor OAuth tokens.
  *
- * Mounted under `/identity/github/*` when listed on `identity.connect`.
+ * Mounted under `/identity/github/*` when listed on `identity.connect`, or when
+ * a user-scoped deployment declares `connectors.github` / a credential chain
+ * that reads per-user GitHub tokens.
  */
 import type { IdentityConnectProvider } from "../connect-provider-types.js";
 import { type GitHubCredentialStore } from "./credentials-store.js";
@@ -20,12 +22,15 @@ export declare const githubIdentityConnectProvider: IdentityConnectProvider;
 /**
  * Opt into Connect-with-GitHub on `defineIdentity({ connect: […] })`.
  *
+ * Usually unnecessary: `connectors.github` on a user-scoped deployment mounts
+ * these routes by inference.
+ *
  * @example
  * ```ts
- * import { defineIdentity, github } from "managed-deepagents";
+ * import { connect, defineIdentity } from "managed-deepagents";
  *
- * export const identity = defineIdentity.preset("internal-tool", {
- *   connect: [github.connect()],
+ * export const identity = defineIdentity({
+ *   connect: [connect.github()],
  * });
  * ```
  */

package/dist/identity/github/connect-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/github/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAKV,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAC;AAehC,eAAO,MAAM,0BAA0B,QAAe,CAAC;AACvD,eAAO,MAAM,yBAAyB,QAAgB,CAAC;AACvD,eAAO,MAAM,4BAA4B,QAAiB,CAAC;AAC3D,eAAO,MAAM,wBAAwB,QAAa,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,WAAW,oCAAoC;IACnD,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED,oEAAoE;AACpE,wBAAgB,mCAAmC,CACjD,OAAO,GAAE,oCAAyC,GACjD,uBAAuB,CAsFzB;AAED,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,EAAE,uBACL,CAAC;AAExC;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,oCAAoC,GAC7C,uBAAuB,CAIzB"}
+{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/github/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAKV,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AAOtC,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAC;AAchC,eAAO,MAAM,0BAA0B,QAAe,CAAC;AACvD,eAAO,MAAM,yBAAyB,QAAgB,CAAC;AACvD,eAAO,MAAM,4BAA4B,QAAiB,CAAC;AAC3D,eAAO,MAAM,wBAAwB,QAAa,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,WAAW,oCAAoC;IACnD,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED,oEAAoE;AACpE,wBAAgB,mCAAmC,CACjD,OAAO,GAAE,oCAAyC,GACjD,uBAAuB,CAqGzB;AAED,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,EAAE,uBACL,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,oCAAoC,GAC7C,uBAAuB,CAIzB"}

package/dist/identity/github/connect-http.js

@@ -1,11 +1,14 @@
 /**
  * Connect-with-GitHub — {@link IdentityConnectProvider} for actor OAuth tokens.
  *
- * Mounted under `/identity/github/*` when listed on `identity.connect`.
+ * Mounted under `/identity/github/*` when listed on `identity.connect`, or when
+ * a user-scoped deployment declares `connectors.github` / a credential chain
+ * that reads per-user GitHub tokens.
  */
 import { identityConnectPaths } from "../connect-paths.js";
+import { credentialConnectIds, hasGithubConnector, isUserScopedDeployment, } from "../connect-inference.js";
 import { buildGitHubCredentialRecord, getGitHubCredentialStore, } from "./credentials-store.js";
-import { buildGitHubAuthorizeUrl, createGitHubOauthState, exchangeGitHubOauthCode, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readGitHubOauthConfig, readOauthStateSigningKey, resolveGitHubOauthRedirectBase, verifyGitHubOauthState, } from "./oauth.js";
+import { buildGitHubAuthorizeUrl, exchangeGitHubOauthCode, githubOauthTickets, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readGitHubOauthConfig, readOauthStateSigningKey, resolveGitHubOauthRedirectBase, } from "./oauth.js";
 const PATHS = identityConnectPaths("github");
 export const GITHUB_CONNECT_STATUS_PATH = PATHS.status;
 export const GITHUB_CONNECT_START_PATH = PATHS.connect;
@@ -17,12 +20,25 @@ export function createGitHubIdentityConnectProvider(options = {}) {
     return {
         id: "github",
         shouldMount(ctx) {
-            // Opt-in is via `identity.connect`; this is a secondary gate only.
-            return ctx.hasIdentity;
+            if (!ctx.hasIdentity) {
+                return false;
+            }
+            // Listed on `identity.connect` — the author already opted in.
+            if (ctx.declared) {
+                return true;
+            }
+            // Otherwise mirror Google/Microsoft: a GitHub connector (or a credential
+            // chain that reads user tokens) on a user-scoped deployment needs
+            // somewhere for the caller to grant an actor OAuth token.
+            if (!isUserScopedDeployment(ctx.scope)) {
+                return false;
+            }
+            return (hasGithubConnector(ctx.connectorKinds) ||
+                credentialConnectIds(ctx.credentials).has("github"));
         },
-        async status(actorId) {
+        async status(userId) {
             const configured = Boolean(readGitHubOauthConfig());
-            const record = await store().getByActorId(actorId);
+            const record = await store().getByUserId(userId);
             return {
                 configured,
                 linked: Boolean(record),
@@ -36,7 +52,7 @@ export function createGitHubIdentityConnectProvider(options = {}) {
                     : {}),
             };
         },
-        async startAuthorize(actorId, redirectUri) {
+        async startAuthorize(userId, redirectUri) {
             const oauth = readGitHubOauthConfig();
             const stateKey = readOauthStateSigningKey();
             if (!oauth || !stateKey) {
@@ -45,7 +61,7 @@ export function createGitHubIdentityConnectProvider(options = {}) {
                     error: `GitHub connect is not configured (set GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, MDA_PUBLIC_APP_URL, ${OAUTH_STATE_SIGNING_KEY_ENV})`,
                 };
             }
-            const state = await createGitHubOauthState(actorId, stateKey);
+            const state = await githubOauthTickets.createState(userId, stateKey);
             return {
                 authorizeUrl: buildGitHubAuthorizeUrl(oauth, state, redirectUri),
             };
@@ -59,10 +75,10 @@ export function createGitHubIdentityConnectProvider(options = {}) {
             if (!stateKey) {
                 throw new Error(`${OAUTH_STATE_SIGNING_KEY_ENV} is not configured`);
             }
-            const { actorId } = await verifyGitHubOauthState(state, stateKey);
+            const { userId } = await githubOauthTickets.verifyState(state, stateKey);
             const token = await exchangeGitHubOauthCode(oauth, code, redirectUri);
             const record = buildGitHubCredentialRecord({
-                actorId,
+                userId,
                 githubUserId: token.userId,
                 githubLogin: token.login,
                 accessToken: token.accessToken,
@@ -76,8 +92,8 @@ export function createGitHubIdentityConnectProvider(options = {}) {
                 successRedirect: `${oauth.publicAppUrl}/settings?github=connected`,
             };
         },
-        async unlink(actorId) {
-            await store().removeByActorId(actorId);
+        async unlink(userId) {
+            await store().removeByUserId(userId);
         },
         resolveRedirectBase(options) {
             return resolveGitHubOauthRedirectBase(options);
@@ -94,12 +110,15 @@ export const githubIdentityConnectProvider = createGitHubIdentityConnectProvider
 /**
  * Opt into Connect-with-GitHub on `defineIdentity({ connect: […] })`.
  *
+ * Usually unnecessary: `connectors.github` on a user-scoped deployment mounts
+ * these routes by inference.
+ *
  * @example
  * ```ts
- * import { defineIdentity, github } from "managed-deepagents";
+ * import { connect, defineIdentity } from "managed-deepagents";
  *
- * export const identity = defineIdentity.preset("internal-tool", {
- *   connect: [github.connect()],
+ * export const identity = defineIdentity({
+ *   connect: [connect.github()],
  * });
  * ```
  */

package/dist/identity/github/connect-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/github/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,GAEzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,EAC3B,qBAAqB,EACrB,wBAAwB,EACxB,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC,MAAM,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,OAAO,CAAC;AACvD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,IAAI,CAAC;AAOnD,oEAAoE;AACpE,MAAM,UAAU,mCAAmC,CACjD,OAAO,GAAyC,EAAE;IAElD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,IAAI,wBAAwB,EAAE,CAAC;IAE1E,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,WAAW,CAAC,GAAgC;YAC1C,mEAAmE;YACnE,OAAO,GAAG,CAAC,WAAW,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAe;YAC1B,MAAM,UAAU,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACnD,OAAO;gBACL,UAAU;gBACV,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;gBACvB,GAAG,CAAC,MAAM;oBACR,CAAC,CAAC;wBACE,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;wBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;qBACpB;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,OAAe,EACf,WAAmB;YAEnB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,qGAAqG,2BAA2B,GAAG;iBAC3I,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC9D,OAAO;gBACL,YAAY,EAAE,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;aACjE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,2BAA2B,CAAC;gBACzC,OAAO;gBACP,YAAY,EAAE,KAAK,CAAC,MAAM;gBAC1B,WAAW,EAAE,KAAK,CAAC,KAAK;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/C,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,4BAA4B;aACnE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAe;YAC1B,MAAM,KAAK,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,mBAAmB,CAAC,OAA2C;YAC7D,OAAO,8BAA8B,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QACD,mBAAmB;YACjB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,OAAO,CACL,KAAK,EAAE,YAAY;gBACnB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GACxC,mCAAmC,EAAE,CAAC;AAExC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CACrB,OAA8C;IAE9C,OAAO,OAAO;QACZ,CAAC,CAAC,mCAAmC,CAAC,OAAO,CAAC;QAC9C,CAAC,CAAC,6BAA6B,CAAC;AACpC,CAAC"}
+{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/github/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,GAEzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,EACtB,2BAA2B,EAC3B,qBAAqB,EACrB,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,YAAY,CAAC;AAEpB,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC,MAAM,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,OAAO,CAAC;AACvD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,IAAI,CAAC;AAOnD,oEAAoE;AACpE,MAAM,UAAU,mCAAmC,CACjD,OAAO,GAAyC,EAAE;IAElD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,IAAI,wBAAwB,EAAE,CAAC;IAE1E,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,WAAW,CAAC,GAAgC;YAC1C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,8DAA8D;YAC9D,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,yEAAyE;YACzE,kEAAkE;YAClE,0DAA0D;YAC1D,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvC,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,CACL,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC;gBACtC,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CACpD,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,UAAU,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACjD,OAAO;gBACL,UAAU;gBACV,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;gBACvB,GAAG,CAAC,MAAM;oBACR,CAAC,CAAC;wBACE,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;wBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;qBACpB;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,WAAmB;YAEnB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,qGAAqG,2BAA2B,GAAG;iBAC3I,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrE,OAAO;gBACL,YAAY,EAAE,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;aACjE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACzE,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,2BAA2B,CAAC;gBACzC,MAAM;gBACN,YAAY,EAAE,KAAK,CAAC,MAAM;gBAC1B,WAAW,EAAE,KAAK,CAAC,KAAK;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/C,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,4BAA4B;aACnE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,KAAK,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,mBAAmB,CAAC,OAA2C;YAC7D,OAAO,8BAA8B,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QACD,mBAAmB;YACjB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,OAAO,CACL,KAAK,EAAE,YAAY;gBACnB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GACxC,mCAAmC,EAAE,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,OAAO,CACrB,OAA8C;IAE9C,OAAO,OAAO;QACZ,CAAC,CAAC,mCAAmC,CAAC,OAAO,CAAC;QAC9C,CAAC,CAAC,6BAA6B,CAAC;AACpC,CAAC"}

package/dist/identity/github/credentials-store.d.ts

@@ -2,7 +2,7 @@
  * Per-actor GitHub OAuth credential vault.
  *
  * Stored in the LangGraph Store under `["mda_github_credentials"]`. Connect-
- * with-GitHub upserts after OAuth; `github.credentials` resolves `actor` tokens
+ * with-GitHub upserts after OAuth; `credentials.github` resolves `actor` tokens
  * from here until managed Agent Auth lands.
  *
  * Tokens are deployment-scoped Store values — treat the Store namespace as
@@ -23,7 +23,7 @@ export declare const GITHUB_CREDENTIAL_CACHE_TTL_MS = 30000;
 /** Soft cap on cached GitHub credential records per process. */
 export declare const GITHUB_CREDENTIAL_CACHE_MAX_ENTRIES = 256;
 export interface GitHubCredentialRecord {
-    actorId: string;
+    userId: string;
     githubUserId: string;
     githubLogin: string;
     accessToken: string;
@@ -35,24 +35,24 @@ export interface GitHubCredentialRecord {
     source: "github_oauth";
 }
 export interface GitHubCredentialStore {
-    getByActorId(actorId: string): Promise<GitHubCredentialRecord | null>;
+    getByUserId(userId: string): Promise<GitHubCredentialRecord | null>;
     upsert(record: GitHubCredentialRecord): Promise<void>;
-    removeByActorId(actorId: string): Promise<void>;
+    removeByUserId(userId: string): Promise<void>;
 }
 /** In-memory store for tests. */
 export declare class InMemoryGitHubCredentialStore implements GitHubCredentialStore {
-    private readonly byActor;
-    getByActorId(actorId: string): Promise<GitHubCredentialRecord | null>;
+    private readonly byUser;
+    getByUserId(userId: string): Promise<GitHubCredentialRecord | null>;
     upsert(record: GitHubCredentialRecord): Promise<void>;
-    removeByActorId(actorId: string): Promise<void>;
+    removeByUserId(userId: string): Promise<void>;
 }
 /** LangGraph Store–backed GitHub credential vault. */
 export declare class LangGraphGitHubCredentialStore implements GitHubCredentialStore {
     private readonly client;
     constructor(client: Client);
-    getByActorId(actorId: string): Promise<GitHubCredentialRecord | null>;
+    getByUserId(userId: string): Promise<GitHubCredentialRecord | null>;
     upsert(record: GitHubCredentialRecord): Promise<void>;
-    removeByActorId(actorId: string): Promise<void>;
+    removeByUserId(userId: string): Promise<void>;
 }
 /** Override the process-default credential store (tests). */
 export declare function setGitHubCredentialStore(store: GitHubCredentialStore | null): void;
@@ -64,7 +64,7 @@ export declare function createLangGraphGitHubCredentialStore(options?: {
     ingressSecret?: string;
 }): LangGraphGitHubCredentialStore | null;
 export declare function buildGitHubCredentialRecord(input: {
-    actorId: string;
+    userId: string;
     githubUserId: string;
     githubLogin: string;
     accessToken: string;

package/dist/identity/github/credentials-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials-store.d.ts","sourceRoot":"","sources":["../../../src/identity/github/credentials-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAElD,OAAO,EAEL,+BAA+B,EAIhC,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,+BAA+B,EAAE,CAAC;AAC3C,eAAO,MAAM,4BAA4B,qCAE/B,CAAC;AAEX,2EAA2E;AAC3E,eAAO,MAAM,8BAA8B,QAAS,CAAC;AACrD,gEAAgE;AAChE,eAAO,MAAM,mCAAmC,MAAM,CAAC;AAEvD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACtE,MAAM,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAgBD,iCAAiC;AACjC,qBAAa,6BAA8B,YAAW,qBAAqB;IACzE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6C;IAE/D,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAE1E;IAEK,MAAM,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAEK,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpD;CACF;AAED,sDAAsD;AACtD,qBAAa,8BAA+B,YAAW,qBAAqB;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAEzC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CA0C1E;IAEK,MAAM,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ1D;IAEK,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOpD;CACF;AAID,6DAA6D;AAC7D,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,qBAAqB,GAAG,IAAI,GAClC,IAAI,CAGN;AAED,oDAAoD;AACpD,wBAAgB,wBAAwB,IAAI,qBAAqB,CAQhE;AAED,wBAAgB,oCAAoC,CAClD,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACzE,8BAA8B,GAAG,IAAI,CAqBvC;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,sBAAsB,CAazB"}
+{"version":3,"file":"credentials-store.d.ts","sourceRoot":"","sources":["../../../src/identity/github/credentials-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAElD,OAAO,EAEL,+BAA+B,EAIhC,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,+BAA+B,EAAE,CAAC;AAC3C,eAAO,MAAM,4BAA4B,qCAE/B,CAAC;AAEX,2EAA2E;AAC3E,eAAO,MAAM,8BAA8B,QAAS,CAAC;AACrD,gEAAgE;AAChE,eAAO,MAAM,mCAAmC,MAAM,CAAC;AAEvD,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACpE,MAAM,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAgBD,iCAAiC;AACjC,qBAAa,6BAA8B,YAAW,qBAAqB;IACzE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;IAE9D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAExE;IAEK,MAAM,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAEK,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElD;CACF;AAED,sDAAsD;AACtD,qBAAa,8BAA+B,YAAW,qBAAqB;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAEzC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CA0CxE;IAEK,MAAM,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ1D;IAEK,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOlD;CACF;AAID,6DAA6D;AAC7D,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,qBAAqB,GAAG,IAAI,GAClC,IAAI,CAGN;AAED,oDAAoD;AACpD,wBAAgB,wBAAwB,IAAI,qBAAqB,CAQhE;AAED,wBAAgB,oCAAoC,CAClD,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACzE,8BAA8B,GAAG,IAAI,CAiBvC;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,sBAAsB,CAazB"}

package/dist/identity/github/credentials-store.js

@@ -2,7 +2,7 @@
  * Per-actor GitHub OAuth credential vault.
  *
  * Stored in the LangGraph Store under `["mda_github_credentials"]`. Connect-
- * with-GitHub upserts after OAuth; `github.credentials` resolves `actor` tokens
+ * with-GitHub upserts after OAuth; `credentials.github` resolves `actor` tokens
  * from here until managed Agent Auth lands.
  *
  * Tokens are deployment-scoped Store values — treat the Store namespace as
@@ -16,8 +16,8 @@
  */
 import { getStore } from "@langchain/langgraph";
 import { Client } from "@langchain/langgraph-sdk";
-import { ACTOR_HEADER, GITHUB_CREDENTIALS_STORE_PREFIX, IDENTITY_LINKS_SERVICE_ACTOR, INGRESS_SECRET_ENV, INGRESS_SECRET_HEADER, } from "../../runtime/auth.js";
-import { resolveLoopbackApiUrl } from "../loopback.js";
+import { USER_HEADER, GITHUB_CREDENTIALS_STORE_PREFIX, IDENTITY_LINKS_SERVICE_USER, INGRESS_SECRET_ENV, INGRESS_SECRET_HEADER, } from "../../runtime/auth.js";
+import { resolveLoopbackApiKey, resolveLoopbackApiUrl } from "../loopback.js";
 export { GITHUB_CREDENTIALS_STORE_PREFIX };
 export const GITHUB_CREDENTIALS_NAMESPACE = [
     GITHUB_CREDENTIALS_STORE_PREFIX,
@@ -30,15 +30,15 @@ export const GITHUB_CREDENTIAL_CACHE_MAX_ENTRIES = 256;
 const processCache = new Map();
 /** In-memory store for tests. */
 export class InMemoryGitHubCredentialStore {
-    byActor = new Map();
-    async getByActorId(actorId) {
-        return this.byActor.get(actorId) ?? null;
+    byUser = new Map();
+    async getByUserId(userId) {
+        return this.byUser.get(userId) ?? null;
     }
     async upsert(record) {
-        this.byActor.set(record.actorId, record);
+        this.byUser.set(record.userId, record);
     }
-    async removeByActorId(actorId) {
-        this.byActor.delete(actorId);
+    async removeByUserId(userId) {
+        this.byUser.delete(userId);
     }
 }
 /** LangGraph Store–backed GitHub credential vault. */
@@ -47,20 +47,20 @@ export class LangGraphGitHubCredentialStore {
     constructor(client) {
         this.client = client;
     }
-    async getByActorId(actorId) {
-        const fromGraph = await readFromAmbientStore(actorId);
+    async getByUserId(userId) {
+        const fromGraph = await readFromAmbientStore(userId);
         if (fromGraph) {
-            rememberCache(actorId, fromGraph, { localWrite: false });
+            rememberCache(userId, fromGraph, { localWrite: false });
             return fromGraph;
         }
         let storeMiss = false;
         let storeUnavailable = false;
         try {
-            const item = await this.client.store.getItem([...GITHUB_CREDENTIALS_NAMESPACE], actorKey(actorId));
+            const item = await this.client.store.getItem([...GITHUB_CREDENTIALS_NAMESPACE], userKey(userId));
             if (item?.value && typeof item.value === "object") {
                 const record = valueToRecord(item.value);
                 if (record) {
-                    rememberCache(actorId, record, { localWrite: false });
+                    rememberCache(userId, record, { localWrite: false });
                     return record;
                 }
             }
@@ -69,7 +69,7 @@ export class LangGraphGitHubCredentialStore {
         catch {
             storeUnavailable = true;
         }
-        const cached = liveCacheEntry(actorId);
+        const cached = liveCacheEntry(userId);
         if (cached) {
             if (storeUnavailable) {
                 return cached.record;
@@ -81,19 +81,19 @@ export class LangGraphGitHubCredentialStore {
         }
         if (storeMiss) {
             // Authoritative miss — honor unlink/rotate from another worker.
-            processCache.delete(actorId);
+            processCache.delete(userId);
         }
         return null;
     }
     async upsert(record) {
-        await this.client.store.putItem([...GITHUB_CREDENTIALS_NAMESPACE], actorKey(record.actorId), recordToValue(record));
-        rememberCache(record.actorId, record, { localWrite: true });
+        await this.client.store.putItem([...GITHUB_CREDENTIALS_NAMESPACE], userKey(record.userId), recordToValue(record));
+        rememberCache(record.userId, record, { localWrite: true });
         await writeToAmbientStore(record);
     }
-    async removeByActorId(actorId) {
-        processCache.delete(actorId);
-        await this.client.store.deleteItem([...GITHUB_CREDENTIALS_NAMESPACE], actorKey(actorId));
-        await deleteFromAmbientStore(actorId);
+    async removeByUserId(userId) {
+        processCache.delete(userId);
+        await this.client.store.deleteItem([...GITHUB_CREDENTIALS_NAMESPACE], userKey(userId));
+        await deleteFromAmbientStore(userId);
     }
 }
 let defaultStore = null;
@@ -118,23 +118,20 @@ export function createLangGraphGitHubCredentialStore(options = {}) {
         return null;
     }
     const apiUrl = resolveLoopbackApiUrl(options.apiUrl);
-    const apiKey = options.apiKey ??
-        process.env.LANGSMITH_API_KEY ??
-        process.env.LANGGRAPH_API_KEY ??
-        "local";
+    const apiKey = resolveLoopbackApiKey(options.apiKey);
     const client = new Client({
         apiUrl,
         apiKey,
         defaultHeaders: {
             [INGRESS_SECRET_HEADER]: ingressSecret,
-            [ACTOR_HEADER]: IDENTITY_LINKS_SERVICE_ACTOR,
+            [USER_HEADER]: IDENTITY_LINKS_SERVICE_USER,
         },
     });
     return new LangGraphGitHubCredentialStore(client);
 }
 export function buildGitHubCredentialRecord(input) {
     return {
-        actorId: input.actorId,
+        userId: input.userId,
         githubUserId: input.githubUserId,
         githubLogin: input.githubLogin,
         accessToken: input.accessToken,
@@ -146,25 +143,25 @@ export function buildGitHubCredentialRecord(input) {
         source: "github_oauth",
     };
 }
-function actorKey(actorId) {
-    return `actor:${actorId}`;
+function userKey(userId) {
+    return `actor:${userId}`;
 }
 function recordToValue(record) {
     return { ...record };
 }
 function valueToRecord(value) {
-    const actorId = value.actorId;
+    const userId = value.userId;
     const githubUserId = value.githubUserId;
     const githubLogin = value.githubLogin;
     const accessToken = value.accessToken;
-    if (typeof actorId !== "string" ||
+    if (typeof userId !== "string" ||
         typeof githubUserId !== "string" ||
         typeof githubLogin !== "string" ||
         typeof accessToken !== "string") {
         return null;
     }
     return {
-        actorId,
+        userId,
         githubUserId,
         githubLogin,
         accessToken,
@@ -182,21 +179,21 @@ function valueToRecord(value) {
         source: "github_oauth",
     };
 }
-function rememberCache(actorId, record, options) {
-    processCache.set(actorId, {
+function rememberCache(userId, record, options) {
+    processCache.set(userId, {
         record,
         cachedAtMs: Date.now(),
         localWrite: options.localWrite,
     });
     evictExpiredAndOverflow();
 }
-function liveCacheEntry(actorId) {
-    const entry = processCache.get(actorId);
+function liveCacheEntry(userId) {
+    const entry = processCache.get(userId);
     if (!entry) {
         return undefined;
     }
     if (Date.now() - entry.cachedAtMs > GITHUB_CREDENTIAL_CACHE_TTL_MS) {
-        processCache.delete(actorId);
+        processCache.delete(userId);
         return undefined;
     }
     return entry;
@@ -216,12 +213,12 @@ function evictExpiredAndOverflow() {
         processCache.delete(oldest);
     }
 }
-async function readFromAmbientStore(actorId) {
+async function readFromAmbientStore(userId) {
     try {
         const store = getStore();
         if (!store)
             return null;
-        const item = await store.get([...GITHUB_CREDENTIALS_NAMESPACE], actorKey(actorId));
+        const item = await store.get([...GITHUB_CREDENTIALS_NAMESPACE], userKey(userId));
         if (!item?.value || typeof item.value !== "object") {
             return null;
         }
@@ -237,18 +234,18 @@ async function writeToAmbientStore(record) {
         const store = getStore();
         if (!store)
             return;
-        await store.put([...GITHUB_CREDENTIALS_NAMESPACE], actorKey(record.actorId), recordToValue(record));
+        await store.put([...GITHUB_CREDENTIALS_NAMESPACE], userKey(record.userId), recordToValue(record));
     }
     catch {
         // Best-effort; HTTP put already persisted.
     }
 }
-async function deleteFromAmbientStore(actorId) {
+async function deleteFromAmbientStore(userId) {
     try {
         const store = getStore();
         if (!store)
             return;
-        await store.delete([...GITHUB_CREDENTIALS_NAMESPACE], actorKey(actorId));
+        await store.delete([...GITHUB_CREDENTIALS_NAMESPACE], userKey(userId));
     }
     catch {
         // Best-effort.