managed-deepagents 0.5.0-dev.80 → 0.5.0-dev.82

package/dist/identity/fleet.d.ts

@@ -0,0 +1,56 @@
+/**
+ * LangSmith Fleet client for agent-subject vault connections.
+ *
+ * Shared by Connect providers (Google today; other toolserver OAuth providers
+ * later). Source of truth for Connect status is Fleet agent connections — not
+ * a local Store cache.
+ */
+export interface FleetConnection {
+    id: string;
+    agent_id: string;
+    auth_token_id?: string;
+    provider_id: string;
+    provider_account_label?: string;
+    scopes?: string[];
+    expires_at?: string | null;
+}
+export interface UpsertAgentProviderTokenBody {
+    access_token: string;
+    refresh_token?: string;
+    expires_in_seconds?: number;
+    scopes?: string[];
+    provider_account_label?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface FleetClientOptions {
+    apiKey?: string;
+    apiUrl?: string;
+    workspaceId?: string;
+    fetchImpl?: typeof fetch;
+}
+export interface CreateFleetAuthSessionBody {
+    providerSlug: string;
+    scopes: string[];
+    agentId: string;
+    strategy?: "create" | "reuse";
+}
+export interface FleetAuthSession {
+    id?: string;
+    status: string;
+    provider_slug?: string;
+    verification_url?: string;
+    token?: string;
+}
+export declare function resolveFleetApiUrl(env?: NodeJS.ProcessEnv): string;
+export declare function resolveFleetHeaders(label: string, env?: NodeJS.ProcessEnv): Record<string, string>;
+export declare function listAgentConnections(agentId: string, options?: FleetClientOptions): Promise<FleetConnection[]>;
+export declare function upsertAgentProviderToken(agentId: string, providerSlug: string, body: UpsertAgentProviderTokenBody, options?: FleetClientOptions): Promise<FleetConnection>;
+/**
+ * Start a Fleet OAuth session for an agent subject (platform OAuth provider).
+ * Returns a verification_url the browser should open.
+ */
+export declare function createFleetAuthSession(body: CreateFleetAuthSessionBody, options?: FleetClientOptions): Promise<FleetAuthSession>;
+/** True when LANGSMITH_API_KEY is set so Fleet APIs can be called. */
+export declare function hasFleetAuthCredentials(env?: NodeJS.ProcessEnv): boolean;
+export declare function deleteAgentConnection(agentId: string, connectionId: string, options?: FleetClientOptions): Promise<void>;
+//# sourceMappingURL=fleet.d.ts.map

package/dist/identity/fleet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.d.ts","sourceRoot":"","sources":["../../src/identity/fleet.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,kBAAkB,CAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAMR;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBxB;AAiBD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,eAAe,EAAE,CAAC,CAsB5B;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,EAClC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,eAAe,CAAC,CAwB1B;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,0BAA0B,EAChC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,gBAAgB,CAAC,CA2B3B;AAED,sEAAsE;AACtE,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAmBf"}

package/dist/identity/fleet.js

@@ -0,0 +1,133 @@
+/**
+ * LangSmith Fleet client for agent-subject vault connections.
+ *
+ * Shared by Connect providers (Google today; other toolserver OAuth providers
+ * later). Source of truth for Connect status is Fleet agent connections — not
+ * a local Store cache.
+ */
+import { fetchWithTimeout, PROVIDER_HTTP_TIMEOUT_MS } from "../runtime/http.js";
+const DEFAULT_API_URL = "https://api.smith.langchain.com";
+export function resolveFleetApiUrl(env = process.env) {
+    const base = trimmed(env.LANGSMITH_ENDPOINT) ??
+        trimmed(env.LANGCHAIN_ENDPOINT) ??
+        DEFAULT_API_URL;
+    return stripTrailingSlashes(withScheme(base));
+}
+export function resolveFleetHeaders(label, env = process.env) {
+    const apiKey = trimmed(env.LANGSMITH_API_KEY);
+    if (!apiKey) {
+        throw new Error(`${label} needs LANGSMITH_API_KEY to reach the LangSmith Fleet API.`);
+    }
+    const headers = {
+        "x-api-key": apiKey,
+        "Content-Type": "application/json",
+    };
+    const workspaceId = trimmed(env.LANGCHAIN_WORKSPACE_ID);
+    if (workspaceId) {
+        headers["x-tenant-id"] = workspaceId;
+    }
+    return headers;
+}
+function fleetHeaders(label, options, env = process.env) {
+    if (options.apiKey || options.workspaceId) {
+        return {
+            "x-api-key": options.apiKey ?? trimmed(env.LANGSMITH_API_KEY) ?? "",
+            "Content-Type": "application/json",
+            ...(options.workspaceId ? { "x-tenant-id": options.workspaceId } : {}),
+        };
+    }
+    return resolveFleetHeaders(label, env);
+}
+export async function listAgentConnections(agentId, options = {}) {
+    const env = process.env;
+    const base = options.apiUrl ?? resolveFleetApiUrl(env);
+    const headers = fleetHeaders("fleet list connections", options, env);
+    const url = `${base}/v1/fleet/agents/${encodeURIComponent(agentId)}/connections`;
+    const response = await fetchWithTimeout(url, { method: "GET", headers }, PROVIDER_HTTP_TIMEOUT_MS, options.fetchImpl ?? fetch);
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`Fleet list connections failed (${response.status}): ${text || response.statusText}`);
+    }
+    const json = (await response.json());
+    return json.items ?? json.data ?? [];
+}
+export async function upsertAgentProviderToken(agentId, providerSlug, body, options = {}) {
+    const env = process.env;
+    const base = options.apiUrl ?? resolveFleetApiUrl(env);
+    const headers = fleetHeaders("fleet upsert provider token", options, env);
+    const url = `${base}/v1/fleet/agents/${encodeURIComponent(agentId)}` +
+        `/providers/${encodeURIComponent(providerSlug)}/tokens`;
+    const response = await fetchWithTimeout(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body),
+    }, PROVIDER_HTTP_TIMEOUT_MS, options.fetchImpl ?? fetch);
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`Fleet upsert agent provider token failed (${response.status}): ${text || response.statusText}`);
+    }
+    return (await response.json());
+}
+/**
+ * Start a Fleet OAuth session for an agent subject (platform OAuth provider).
+ * Returns a verification_url the browser should open.
+ */
+export async function createFleetAuthSession(body, options = {}) {
+    const env = process.env;
+    const base = options.apiUrl ?? resolveFleetApiUrl(env);
+    const headers = fleetHeaders("fleet auth-session", options, env);
+    const url = `${base}/v1/fleet/auth-sessions`;
+    const response = await fetchWithTimeout(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({
+            provider_slug: body.providerSlug,
+            scopes: body.scopes,
+            agent_id: body.agentId,
+            strategy: body.strategy ?? "create",
+        }),
+    }, PROVIDER_HTTP_TIMEOUT_MS, options.fetchImpl ?? fetch);
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`Fleet auth-session failed (${response.status}): ${text || response.statusText}`);
+    }
+    return (await response.json());
+}
+/** True when LANGSMITH_API_KEY is set so Fleet APIs can be called. */
+export function hasFleetAuthCredentials(env = process.env) {
+    return Boolean(trimmed(env.LANGSMITH_API_KEY));
+}
+export async function deleteAgentConnection(agentId, connectionId, options = {}) {
+    const env = process.env;
+    const base = options.apiUrl ?? resolveFleetApiUrl(env);
+    const headers = fleetHeaders("fleet delete connection", options, env);
+    const url = `${base}/v1/fleet/agents/${encodeURIComponent(agentId)}` +
+        `/connections/${encodeURIComponent(connectionId)}`;
+    const response = await fetchWithTimeout(url, { method: "DELETE", headers }, PROVIDER_HTTP_TIMEOUT_MS, options.fetchImpl ?? fetch);
+    if (!response.ok && response.status !== 404) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`Fleet delete connection failed (${response.status}): ${text || response.statusText}`);
+    }
+}
+function withScheme(base) {
+    const separator = base.indexOf("://");
+    if (separator > 0) {
+        const scheme = base.slice(0, separator);
+        if (/^[a-z][a-z0-9+.-]*$/i.test(scheme)) {
+            return base;
+        }
+    }
+    return `https://${base}`;
+}
+function stripTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value.charCodeAt(end - 1) === 47 /* / */) {
+        end -= 1;
+    }
+    return end === value.length ? value : value.slice(0, end);
+}
+function trimmed(value) {
+    const v = value?.trim();
+    return v ? v : undefined;
+}
+//# sourceMappingURL=fleet.js.map

package/dist/identity/fleet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.js","sourceRoot":"","sources":["../../src/identity/fleet.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,MAAM,eAAe,GAAG,iCAAiC,CAAC;AA2C1D,MAAM,UAAU,kBAAkB,CAChC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,IAAI,GACR,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC/B,eAAe,CAAC;IAClB,OAAO,oBAAoB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,4DAA4D,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAA2B;QACtC,WAAW,EAAE,MAAM;QACnB,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACxD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,aAAa,CAAC,GAAG,WAAW,CAAC;IACvC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CACnB,KAAa,EACb,OAA2B,EAC3B,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QAC1C,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE;YACnE,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,OAAO,GAAuB,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,wBAAwB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,GAAG,IAAI,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC;IACjF,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAC1B,wBAAwB,EACxB,OAAO,CAAC,SAAS,IAAI,KAAK,CAC3B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,kCAAkC,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAe,EACf,YAAoB,EACpB,IAAkC,EAClC,OAAO,GAAuB,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,6BAA6B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1E,MAAM,GAAG,GACP,GAAG,IAAI,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,EAAE;QACxD,cAAc,kBAAkB,CAAC,YAAY,CAAC,SAAS,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH;QACE,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,EACD,wBAAwB,EACxB,OAAO,CAAC,SAAS,IAAI,KAAK,CAC3B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,6CAA6C,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAoB,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAgC,EAChC,OAAO,GAAuB,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,oBAAoB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,GAAG,IAAI,yBAAyB,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH;QACE,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ;SACpC,CAAC;KACH,EACD,wBAAwB,EACxB,OAAO,CAAC,SAAS,IAAI,KAAK,CAC3B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,8BAA8B,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqB,CAAC;AACrD,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,uBAAuB,CACrC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAe,EACf,YAAoB,EACpB,OAAO,GAAuB,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,yBAAyB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACtE,MAAM,GAAG,GACP,GAAG,IAAI,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,EAAE;QACxD,gBAAgB,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAC7B,wBAAwB,EACxB,OAAO,CAAC,SAAS,IAAI,KAAK,CAC3B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,mCAAmC,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACxC,IAAI,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,WAAW,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;QAC3D,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;IACD,OAAO,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,OAAO,CAAC,KAAyB;IACxC,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACxB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3B,CAAC"}

package/dist/identity/github/connect-http.d.ts

@@ -1,7 +1,9 @@
 /**
  * Connect-with-GitHub — {@link IdentityConnectProvider} for actor OAuth tokens.
  *
- * Mounted under `/identity/github/*` when listed on `identity.connect`.
+ * Mounted under `/identity/github/*` when listed on `identity.connect`, or when
+ * a user-scoped deployment declares `connectors.github` / a credential chain
+ * that reads per-user GitHub tokens.
  */
 import type { IdentityConnectProvider } from "../connect-provider-types.js";
 import { type GitHubCredentialStore } from "./credentials-store.js";
@@ -20,6 +22,9 @@ export declare const githubIdentityConnectProvider: IdentityConnectProvider;
 /**
  * Opt into Connect-with-GitHub on `defineIdentity({ connect: […] })`.
  *
+ * Usually unnecessary: `connectors.github` on a user-scoped deployment mounts
+ * these routes by inference.
+ *
  * @example
  * ```ts
  * import { connect, defineIdentity } from "managed-deepagents";

package/dist/identity/github/connect-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/github/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAKV,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AAMtC,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAC;AAehC,eAAO,MAAM,0BAA0B,QAAe,CAAC;AACvD,eAAO,MAAM,yBAAyB,QAAgB,CAAC;AACvD,eAAO,MAAM,4BAA4B,QAAiB,CAAC;AAC3D,eAAO,MAAM,wBAAwB,QAAa,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,WAAW,oCAAoC;IACnD,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED,oEAAoE;AACpE,wBAAgB,mCAAmC,CACjD,OAAO,GAAE,oCAAyC,GACjD,uBAAuB,CA+FzB;AAED,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,EAAE,uBACL,CAAC;AAExC;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,oCAAoC,GAC7C,uBAAuB,CAIzB"}
+{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/github/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAKV,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AAOtC,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAC;AAchC,eAAO,MAAM,0BAA0B,QAAe,CAAC;AACvD,eAAO,MAAM,yBAAyB,QAAgB,CAAC;AACvD,eAAO,MAAM,4BAA4B,QAAiB,CAAC;AAC3D,eAAO,MAAM,wBAAwB,QAAa,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,WAAW,oCAAoC;IACnD,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED,oEAAoE;AACpE,wBAAgB,mCAAmC,CACjD,OAAO,GAAE,oCAAyC,GACjD,uBAAuB,CAqGzB;AAED,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,EAAE,uBACL,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,oCAAoC,GAC7C,uBAAuB,CAIzB"}

package/dist/identity/github/connect-http.js

@@ -1,12 +1,14 @@
 /**
  * Connect-with-GitHub — {@link IdentityConnectProvider} for actor OAuth tokens.
  *
- * Mounted under `/identity/github/*` when listed on `identity.connect`.
+ * Mounted under `/identity/github/*` when listed on `identity.connect`, or when
+ * a user-scoped deployment declares `connectors.github` / a credential chain
+ * that reads per-user GitHub tokens.
  */
 import { identityConnectPaths } from "../connect-paths.js";
-import { credentialConnectIds, isUserScopedDeployment, } from "../connect-inference.js";
+import { credentialConnectIds, hasGithubConnector, isUserScopedDeployment, } from "../connect-inference.js";
 import { buildGitHubCredentialRecord, getGitHubCredentialStore, } from "./credentials-store.js";
-import { buildGitHubAuthorizeUrl, createGitHubOauthState, exchangeGitHubOauthCode, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readGitHubOauthConfig, readOauthStateSigningKey, resolveGitHubOauthRedirectBase, verifyGitHubOauthState, } from "./oauth.js";
+import { buildGitHubAuthorizeUrl, exchangeGitHubOauthCode, githubOauthTickets, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readGitHubOauthConfig, readOauthStateSigningKey, resolveGitHubOauthRedirectBase, } from "./oauth.js";
 const PATHS = identityConnectPaths("github");
 export const GITHUB_CONNECT_STATUS_PATH = PATHS.status;
 export const GITHUB_CONNECT_START_PATH = PATHS.connect;
@@ -21,12 +23,18 @@ export function createGitHubIdentityConnectProvider(options = {}) {
             if (!ctx.hasIdentity) {
                 return false;
             }
-            // Listed on `identity.connect` — the author already opted in. Otherwise
-            // mount only when a credential chain reads per-user GitHub tokens, since
-            // those tokens have no other way to be granted.
-            return (ctx.declared !== false ||
-                (credentialConnectIds(ctx.credentials).has("github") &&
-                    isUserScopedDeployment(ctx.scope)));
+            // Listed on `identity.connect` — the author already opted in.
+            if (ctx.declared) {
+                return true;
+            }
+            // Otherwise mirror Google/Microsoft: a GitHub connector (or a credential
+            // chain that reads user tokens) on a user-scoped deployment needs
+            // somewhere for the caller to grant an actor OAuth token.
+            if (!isUserScopedDeployment(ctx.scope)) {
+                return false;
+            }
+            return (hasGithubConnector(ctx.connectorKinds) ||
+                credentialConnectIds(ctx.credentials).has("github"));
         },
         async status(userId) {
             const configured = Boolean(readGitHubOauthConfig());
@@ -53,7 +61,7 @@ export function createGitHubIdentityConnectProvider(options = {}) {
                     error: `GitHub connect is not configured (set GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, MDA_PUBLIC_APP_URL, ${OAUTH_STATE_SIGNING_KEY_ENV})`,
                 };
             }
-            const state = await createGitHubOauthState(userId, stateKey);
+            const state = await githubOauthTickets.createState(userId, stateKey);
             return {
                 authorizeUrl: buildGitHubAuthorizeUrl(oauth, state, redirectUri),
             };
@@ -67,7 +75,7 @@ export function createGitHubIdentityConnectProvider(options = {}) {
             if (!stateKey) {
                 throw new Error(`${OAUTH_STATE_SIGNING_KEY_ENV} is not configured`);
             }
-            const { userId } = await verifyGitHubOauthState(state, stateKey);
+            const { userId } = await githubOauthTickets.verifyState(state, stateKey);
             const token = await exchangeGitHubOauthCode(oauth, code, redirectUri);
             const record = buildGitHubCredentialRecord({
                 userId,
@@ -102,6 +110,9 @@ export const githubIdentityConnectProvider = createGitHubIdentityConnectProvider
 /**
  * Opt into Connect-with-GitHub on `defineIdentity({ connect: […] })`.
  *
+ * Usually unnecessary: `connectors.github` on a user-scoped deployment mounts
+ * these routes by inference.
+ *
  * @example
  * ```ts
  * import { connect, defineIdentity } from "managed-deepagents";

package/dist/identity/github/connect-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/github/connect-http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,GAEzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,EAC3B,qBAAqB,EACrB,wBAAwB,EACxB,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC,MAAM,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,OAAO,CAAC;AACvD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,IAAI,CAAC;AAOnD,oEAAoE;AACpE,MAAM,UAAU,mCAAmC,CACjD,OAAO,GAAyC,EAAE;IAElD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,IAAI,wBAAwB,EAAE,CAAC;IAE1E,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,WAAW,CAAC,GAAgC;YAC1C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,wEAAwE;YACxE,yEAAyE;YACzE,gDAAgD;YAChD,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,KAAK;gBACtB,CAAC,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAClD,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,UAAU,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACjD,OAAO;gBACL,UAAU;gBACV,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;gBACvB,GAAG,CAAC,MAAM;oBACR,CAAC,CAAC;wBACE,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;wBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;qBACpB;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,WAAmB;YAEnB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,qGAAqG,2BAA2B,GAAG;iBAC3I,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC7D,OAAO;gBACL,YAAY,EAAE,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;aACjE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACjE,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,2BAA2B,CAAC;gBACzC,MAAM;gBACN,YAAY,EAAE,KAAK,CAAC,MAAM;gBAC1B,WAAW,EAAE,KAAK,CAAC,KAAK;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/C,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,4BAA4B;aACnE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,KAAK,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,mBAAmB,CAAC,OAA2C;YAC7D,OAAO,8BAA8B,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QACD,mBAAmB;YACjB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,OAAO,CACL,KAAK,EAAE,YAAY;gBACnB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GACxC,mCAAmC,EAAE,CAAC;AAExC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CACrB,OAA8C;IAE9C,OAAO,OAAO;QACZ,CAAC,CAAC,mCAAmC,CAAC,OAAO,CAAC;QAC9C,CAAC,CAAC,6BAA6B,CAAC;AACpC,CAAC"}
+{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/github/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,GAEzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,EACtB,2BAA2B,EAC3B,qBAAqB,EACrB,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,YAAY,CAAC;AAEpB,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC,MAAM,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,OAAO,CAAC;AACvD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,IAAI,CAAC;AAOnD,oEAAoE;AACpE,MAAM,UAAU,mCAAmC,CACjD,OAAO,GAAyC,EAAE;IAElD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,IAAI,wBAAwB,EAAE,CAAC;IAE1E,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,WAAW,CAAC,GAAgC;YAC1C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,8DAA8D;YAC9D,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,yEAAyE;YACzE,kEAAkE;YAClE,0DAA0D;YAC1D,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvC,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,CACL,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC;gBACtC,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CACpD,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,UAAU,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACjD,OAAO;gBACL,UAAU;gBACV,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;gBACvB,GAAG,CAAC,MAAM;oBACR,CAAC,CAAC;wBACE,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;wBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;qBACpB;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,WAAmB;YAEnB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,qGAAqG,2BAA2B,GAAG;iBAC3I,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrE,OAAO;gBACL,YAAY,EAAE,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;aACjE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACzE,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,2BAA2B,CAAC;gBACzC,MAAM;gBACN,YAAY,EAAE,KAAK,CAAC,MAAM;gBAC1B,WAAW,EAAE,KAAK,CAAC,KAAK;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/C,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,4BAA4B;aACnE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,KAAK,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,mBAAmB,CAAC,OAA2C;YAC7D,OAAO,8BAA8B,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QACD,mBAAmB;YACjB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,OAAO,CACL,KAAK,EAAE,YAAY;gBACnB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GACxC,mCAAmC,EAAE,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,OAAO,CACrB,OAA8C;IAE9C,OAAO,OAAO;QACZ,CAAC,CAAC,mCAAmC,CAAC,OAAO,CAAC;QAC9C,CAAC,CAAC,6BAA6B,CAAC;AACpC,CAAC"}

package/dist/identity/github/oauth.d.ts

@@ -13,6 +13,8 @@ export declare const GITHUB_CLIENT_SECRET_ENV = "GITHUB_CLIENT_SECRET";
 export declare const GITHUB_OAUTH_SCOPES_ENV = "GITHUB_OAUTH_SCOPES";
 /** Override GitHub OAuth/API base (tests). */
 export declare const GITHUB_OAUTH_BASE_ENV = "GITHUB_OAUTH_BASE";
+/** GitHub-bound OAuth state / connect-ticket helpers. */
+export declare const githubOauthTickets: import("../oauth-tickets.js").OauthTickets;
 export interface GitHubOauthConfig {
     clientId: string;
     clientSecret: string;
@@ -34,11 +36,6 @@ export declare function readGitHubOauthConfig(env?: NodeJS.ProcessEnv): GitHubOa
 /** Reuse the Slack redirect-base resolver (same Host/loopback constraints). */
 export declare const resolveGitHubOauthRedirectBase: typeof resolveSlackOauthRedirectBase;
 export declare function buildGitHubAuthorizeUrl(config: GitHubOauthConfig, state: string, redirectUri: string): string;
-/** Signed state binding the authenticated actor to the OAuth round-trip. */
-export declare function createGitHubOauthState(userId: string, signingKey: string, nowMs?: number): Promise<string>;
-export declare function verifyGitHubOauthState(state: string, signingKey: string, nowMs?: number): Promise<{
-    userId: string;
-}>;
 /**
  * Exchange an authorization code for a user access token and profile.
  *

package/dist/identity/github/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/github/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,EAC9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,CAAC;AAEF,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAC/D,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,8CAA8C;AAC9C,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAQzD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CACnC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,iBAAiB,GAAG,IAAI,CAqB1B;AAED,+EAA+E;AAC/E,eAAO,MAAM,8BAA8B,sCAAgC,CAAC;AAE5E,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,MAAM,CAOR;AAED,4EAA4E;AAC5E,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAqB7B;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAuEjC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/github/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,EAC9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,CAAC;AAEF,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAC/D,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,8CAA8C;AAC9C,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAMzD,yDAAyD;AACzD,eAAO,MAAM,kBAAkB,4CAA4B,CAAC;AAE5D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CACnC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,iBAAiB,GAAG,IAAI,CAqB1B;AAED,+EAA+E;AAC/E,eAAO,MAAM,8BAA8B,sCAAgC,CAAC;AAE5E,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,MAAM,CAOR;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAuEjC"}

package/dist/identity/github/oauth.js

@@ -5,9 +5,8 @@
  * per-actor OAuth access token so `credentials.github({ write: ["actor"] })`
  * can act as the signed-in user (e.g. open pull requests).
  */
-import { randomBytes } from "node:crypto";
-import { jwtVerify, SignJWT } from "jose";
 import { fetchWithTimeout, PROVIDER_HTTP_TIMEOUT_MS, } from "../../runtime/http.js";
+import { oauthTicketsFor } from "../oauth-tickets.js";
 import { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, resolveSlackOauthRedirectBase, } from "../slack/oauth.js";
 export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, };
 export const GITHUB_CLIENT_ID_ENV = "GITHUB_CLIENT_ID";
@@ -19,8 +18,8 @@ export const GITHUB_OAUTH_BASE_ENV = "GITHUB_OAUTH_BASE";
 const DEFAULT_OAUTH_BASE = "https://github.com";
 const DEFAULT_API_BASE = "https://api.github.com";
 const DEFAULT_SCOPES = "repo read:user";
-const STATE_TTL_MS = 10 * 60 * 1000;
-const STATE_JWT_TYP = "mda-github-oauth-state";
+/** GitHub-bound OAuth state / connect-ticket helpers. */
+export const githubOauthTickets = oauthTicketsFor("github");
 export function readGitHubOauthConfig(env = process.env) {
     const clientId = env[GITHUB_CLIENT_ID_ENV]?.trim();
     const clientSecret = env[GITHUB_CLIENT_SECRET_ENV]?.trim();
@@ -50,42 +49,6 @@ export function buildGitHubAuthorizeUrl(config, state, redirectUri) {
     url.searchParams.set("state", state);
     return url.toString();
 }
-/** Signed state binding the authenticated actor to the OAuth round-trip. */
-export async function createGitHubOauthState(userId, signingKey, nowMs = Date.now()) {
-    const iat = Math.floor(nowMs / 1000);
-    const exp = Math.floor((nowMs + STATE_TTL_MS) / 1000);
-    return new SignJWT({
-        userId,
-        nonce: randomBytes(16).toString("hex"),
-    })
-        .setProtectedHeader({ alg: "HS256", typ: STATE_JWT_TYP })
-        .setIssuedAt(iat)
-        .setExpirationTime(exp)
-        .sign(stateSigningKey(signingKey));
-}
-export async function verifyGitHubOauthState(state, signingKey, nowMs = Date.now()) {
-    try {
-        const { payload } = await jwtVerify(state, stateSigningKey(signingKey), {
-            algorithms: ["HS256"],
-            typ: STATE_JWT_TYP,
-            currentDate: new Date(nowMs),
-        });
-        if (typeof payload.userId !== "string" || !payload.userId) {
-            throw new Error("invalid OAuth state actor");
-        }
-        return { userId: payload.userId };
-    }
-    catch (err) {
-        if (err instanceof Error && err.message.startsWith("invalid OAuth state")) {
-            throw err;
-        }
-        const message = err instanceof Error ? err.message : String(err);
-        if (/exp|expir/i.test(message)) {
-            throw new Error("OAuth state expired");
-        }
-        throw new Error("invalid OAuth state signature");
-    }
-}
 /**
  * Exchange an authorization code for a user access token and profile.
  *
@@ -138,7 +101,4 @@ export async function exchangeGitHubOauthCode(config, code, redirectUri, fetchIm
             : {}),
     };
 }
-function stateSigningKey(signingKey) {
-    return new TextEncoder().encode(signingKey);
-}
 //# sourceMappingURL=oauth.js.map

package/dist/identity/github/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/identity/github/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AACvD,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAC/D,kEAAkE;AAClE,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAC7D,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAEzD,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAChD,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAClD,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAqB/C,MAAM,UAAU,qBAAqB,CACnC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,YAAY,GAAG,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3D,MAAM,YAAY,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,CAChB,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,IAAI,kBAAkB,CACzD,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrB,OAAO;QACL,QAAQ;QACR,YAAY;QACZ,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7C,MAAM,EAAE,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,cAAc;QAC9D,SAAS;QACT,OAAO,EACL,SAAS,KAAK,kBAAkB;YAC9B,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,GAAG,SAAS,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,6BAA6B,CAAC;AAE5E,MAAM,UAAU,uBAAuB,CACrC,MAAyB,EACzB,KAAa,EACb,WAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,SAAS,wBAAwB,CAAC,CAAC;IACjE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAc,EACd,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;IACtD,OAAO,IAAI,OAAO,CAAC;QACjB,MAAM;QACN,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACvC,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;SACxD,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,GAAG,CAAC;SACtB,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAa,EACb,UAAkB,EAClB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE;IAE1B,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE;YACtE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,aAAa;YAClB,WAAW,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC1E,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAyB,EACzB,IAAY,EACZ,WAAmB,EACnB,SAAS,GAAiB,KAAK;IAE/B,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAC1C,GAAG,MAAM,CAAC,SAAS,2BAA2B,EAC9C;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,CAAC;KACH,EACD,wBAAwB,EACxB,SAAS,CACV,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAO5C,CAAC;IACF,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,SAAS,CAAC,iBAAiB;YACzB,SAAS,CAAC,KAAK;YACf,oCAAoC,CACvC,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,GAAG,MAAM,CAAC,OAAO,OAAO,EACxB;QACE,OAAO,EAAE;YACP,MAAM,EAAE,6BAA6B;YACrC,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE;YACjD,YAAY,EAAE,oBAAoB;YAClC,sBAAsB,EAAE,YAAY;SACrC;KACF,EACD,wBAAwB,EACxB,SAAS,CACV,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAK1C,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,IAAI,4BAA4B,CAAC,CAAC;IACpE,CAAC;IAED,OAAO;QACL,WAAW,EAAE,SAAS,CAAC,YAAY;QACnC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,SAAS,CAAC,aAAa;YACzB,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,aAAa,EAAE;YAC3C,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,GAAG,CAAC,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK;YACtD,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;YAC3B,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/identity/github/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AACvD,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAC/D,kEAAkE;AAClE,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAC7D,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAEzD,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAChD,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAClD,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,yDAAyD;AACzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;AAqB5D,MAAM,UAAU,qBAAqB,CACnC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,YAAY,GAAG,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3D,MAAM,YAAY,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,CAChB,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,IAAI,kBAAkB,CACzD,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrB,OAAO;QACL,QAAQ;QACR,YAAY;QACZ,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7C,MAAM,EAAE,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,cAAc;QAC9D,SAAS;QACT,OAAO,EACL,SAAS,KAAK,kBAAkB;YAC9B,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,GAAG,SAAS,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,6BAA6B,CAAC;AAE5E,MAAM,UAAU,uBAAuB,CACrC,MAAyB,EACzB,KAAa,EACb,WAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,SAAS,wBAAwB,CAAC,CAAC;IACjE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAyB,EACzB,IAAY,EACZ,WAAmB,EACnB,SAAS,GAAiB,KAAK;IAE/B,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAC1C,GAAG,MAAM,CAAC,SAAS,2BAA2B,EAC9C;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,CAAC;KACH,EACD,wBAAwB,EACxB,SAAS,CACV,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAO5C,CAAC;IACF,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,SAAS,CAAC,iBAAiB;YACzB,SAAS,CAAC,KAAK;YACf,oCAAoC,CACvC,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,GAAG,MAAM,CAAC,OAAO,OAAO,EACxB;QACE,OAAO,EAAE;YACP,MAAM,EAAE,6BAA6B;YACrC,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE;YACjD,YAAY,EAAE,oBAAoB;YAClC,sBAAsB,EAAE,YAAY;SACrC;KACF,EACD,wBAAwB,EACxB,SAAS,CACV,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAK1C,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,IAAI,4BAA4B,CAAC,CAAC;IACpE,CAAC;IAED,OAAO;QACL,WAAW,EAAE,SAAS,CAAC,YAAY;QACnC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,SAAS,CAAC,aAAa;YACzB,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,aAAa,EAAE;YAC3C,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,GAAG,CAAC,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK;YACtD,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;YAC3B,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}

package/dist/identity/google/connect-http.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Connect-with-Google — thin adapter over {@link createFleetIntegrationConnectProvider}.
+ *
+ * Mounted under `/identity/google/*` when listed on `identity.connect`, or
+ * inferred from declared Google toolserver connectors on a user-scoped
+ * deployment.
+ */
+import type { IdentityConnectMountContext, IdentityConnectProvider } from "../connect-provider-types.js";
+import { type FleetIntegrationConnectProviderOptions } from "../fleet-integration-connect.js";
+export declare const GOOGLE_CONNECT_STATUS_PATH: string;
+export declare const GOOGLE_CONNECT_START_PATH: string;
+export declare const GOOGLE_CONNECT_CALLBACK_PATH: string;
+export declare const GOOGLE_CONNECT_LINK_PATH: string;
+export declare function isGoogleActorSubjectEnabled(): boolean;
+export declare function enableGoogleActorSubject(): void;
+/**
+ * Enable actor-subject mode when Google connectors imply per-user vault subjects.
+ *
+ * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
+ */
+export declare function enableGoogleActorSubjectFromConnectors(connectorKinds: readonly (string | undefined)[] | undefined, scope?: IdentityConnectMountContext["scope"]): void;
+export declare function resetGoogleActorSubjectEnabledForTests(): void;
+export declare function isGoogleConnectConfigured(env?: NodeJS.ProcessEnv): boolean;
+export declare function googleConnectUrl(publicAppUrl: string): string;
+/** Options for {@link createGoogleIdentityConnectProvider}. */
+export type GoogleIdentityConnectProviderOptions = FleetIntegrationConnectProviderOptions;
+/** Build a Google connect provider. */
+export declare function createGoogleIdentityConnectProvider(options?: GoogleIdentityConnectProviderOptions): IdentityConnectProvider;
+/** Default Google connect provider used as a built-in mount candidate. */
+export declare const googleIdentityConnectProvider: IdentityConnectProvider;
+/**
+ * Opt into Connect-with-Google on `defineIdentity({ connect: […] })`.
+ *
+ * Usually unnecessary: declaring Google toolserver connectors on a user-scoped
+ * identity deployment mounts this provider and derives OAuth scopes automatically.
+ */
+export declare function connect(options?: GoogleIdentityConnectProviderOptions): IdentityConnectProvider;
+//# sourceMappingURL=connect-http.d.ts.map

package/dist/identity/google/connect-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/google/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAIL,KAAK,sCAAsC,EAC5C,MAAM,iCAAiC,CAAC;AAKzC,eAAO,MAAM,0BAA0B,QAAe,CAAC;AACvD,eAAO,MAAM,yBAAyB,QAAgB,CAAC;AACvD,eAAO,MAAM,4BAA4B,QAAiB,CAAC;AAC3D,eAAO,MAAM,wBAAwB,QAAa,CAAC;AAEnD,wBAAgB,2BAA2B,IAAI,OAAO,CAErD;AAED,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAED;;;;GAIG;AACH,wBAAgB,sCAAsC,CACpD,cAAc,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,GAC3C,IAAI,CAMN;AAED,wBAAgB,sCAAsC,IAAI,IAAI,CAE7D;AAED,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET;AAED,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,+DAA+D;AAC/D,MAAM,MAAM,oCAAoC,GAC9C,sCAAsC,CAAC;AAEzC,uCAAuC;AACvC,wBAAgB,mCAAmC,CACjD,OAAO,GAAE,oCAAyC,GACjD,uBAAuB,CAOzB;AAED,0EAA0E;AAC1E,eAAO,MAAM,6BAA6B,EAAE,uBACL,CAAC;AAExC;;;;;GAKG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,oCAAoC,GAC7C,uBAAuB,CAKzB"}

package/dist/identity/google/connect-http.js

@@ -0,0 +1,59 @@
+/**
+ * Connect-with-Google — thin adapter over {@link createFleetIntegrationConnectProvider}.
+ *
+ * Mounted under `/identity/google/*` when listed on `identity.connect`, or
+ * inferred from declared Google toolserver connectors on a user-scoped
+ * deployment.
+ */
+import { GOOGLE_INTEGRATION } from "../../connectors/toolserver/integrations.js";
+import { enableActorSubjectIntegration, enableActorSubjectIntegrationFromConnectors, isActorSubjectIntegrationEnabled, resetActorSubjectEnabledForTests, } from "../actor-subject.js";
+import { identityConnectPaths } from "../connect-paths.js";
+import { createFleetIntegrationConnectProvider, fleetIntegrationConnectUrl, isFleetIntegrationConnectConfigured, } from "../fleet-integration-connect.js";
+import { googleByoOauth } from "./oauth.js";
+const PATHS = identityConnectPaths("google");
+export const GOOGLE_CONNECT_STATUS_PATH = PATHS.status;
+export const GOOGLE_CONNECT_START_PATH = PATHS.connect;
+export const GOOGLE_CONNECT_CALLBACK_PATH = PATHS.callback;
+export const GOOGLE_CONNECT_LINK_PATH = PATHS.link;
+export function isGoogleActorSubjectEnabled() {
+    return isActorSubjectIntegrationEnabled("google");
+}
+export function enableGoogleActorSubject() {
+    enableActorSubjectIntegration("google");
+}
+/**
+ * Enable actor-subject mode when Google connectors imply per-user vault subjects.
+ *
+ * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
+ */
+export function enableGoogleActorSubjectFromConnectors(connectorKinds, scope) {
+    enableActorSubjectIntegrationFromConnectors(GOOGLE_INTEGRATION, connectorKinds, scope);
+}
+export function resetGoogleActorSubjectEnabledForTests() {
+    resetActorSubjectEnabledForTests();
+}
+export function isGoogleConnectConfigured(env = process.env) {
+    return isFleetIntegrationConnectConfigured(googleByoOauth, env);
+}
+export function googleConnectUrl(publicAppUrl) {
+    return fleetIntegrationConnectUrl(GOOGLE_INTEGRATION, publicAppUrl);
+}
+/** Build a Google connect provider. */
+export function createGoogleIdentityConnectProvider(options = {}) {
+    return createFleetIntegrationConnectProvider(GOOGLE_INTEGRATION, googleByoOauth, options, ["openid", "email", "profile"]);
+}
+/** Default Google connect provider used as a built-in mount candidate. */
+export const googleIdentityConnectProvider = createGoogleIdentityConnectProvider();
+/**
+ * Opt into Connect-with-Google on `defineIdentity({ connect: […] })`.
+ *
+ * Usually unnecessary: declaring Google toolserver connectors on a user-scoped
+ * identity deployment mounts this provider and derives OAuth scopes automatically.
+ */
+export function connect(options) {
+    enableGoogleActorSubject();
+    return options
+        ? createGoogleIdentityConnectProvider(options)
+        : googleIdentityConnectProvider;
+}
+//# sourceMappingURL=connect-http.js.map

package/dist/identity/google/connect-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/google/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACjF,OAAO,EACL,6BAA6B,EAC7B,2CAA2C,EAC3C,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAK3D,OAAO,EACL,qCAAqC,EACrC,0BAA0B,EAC1B,mCAAmC,GAEpC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC,MAAM,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,OAAO,CAAC;AACvD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,IAAI,CAAC;AAEnD,MAAM,UAAU,2BAA2B;IACzC,OAAO,gCAAgC,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,6BAA6B,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sCAAsC,CACpD,cAA2D,EAC3D,KAA4C;IAE5C,2CAA2C,CACzC,kBAAkB,EAClB,cAAc,EACd,KAAK,CACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC;IACpD,gCAAgC,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,mCAAmC,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,OAAO,0BAA0B,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;AACtE,CAAC;AAMD,uCAAuC;AACvC,MAAM,UAAU,mCAAmC,CACjD,OAAO,GAAyC,EAAE;IAElD,OAAO,qCAAqC,CAC1C,kBAAkB,EAClB,cAAc,EACd,OAAO,EACP,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,MAAM,6BAA6B,GACxC,mCAAmC,EAAE,CAAC;AAExC;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CACrB,OAA8C;IAE9C,wBAAwB,EAAE,CAAC;IAC3B,OAAO,OAAO;QACZ,CAAC,CAAC,mCAAmC,CAAC,OAAO,CAAC;QAC9C,CAAC,CAAC,6BAA6B,CAAC;AACpC,CAAC"}

package/dist/identity/google/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Google identity helpers — Connect-with-Google.
+ */
+export { connect, createGoogleIdentityConnectProvider, enableGoogleActorSubject, enableGoogleActorSubjectFromConnectors, googleConnectUrl, googleIdentityConnectProvider, isGoogleActorSubjectEnabled, isGoogleConnectConfigured, resetGoogleActorSubjectEnabledForTests, GOOGLE_CONNECT_CALLBACK_PATH, GOOGLE_CONNECT_LINK_PATH, GOOGLE_CONNECT_START_PATH, GOOGLE_CONNECT_STATUS_PATH, } from "./connect-http.js";
+export type { GoogleIdentityConnectProviderOptions } from "./connect-http.js";
+export { googleOauthTickets } from "./oauth.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/google/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/google/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,mCAAmC,EACnC,wBAAwB,EACxB,sCAAsC,EACtC,gBAAgB,EAChB,6BAA6B,EAC7B,2BAA2B,EAC3B,yBAAyB,EACzB,sCAAsC,EACtC,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,oCAAoC,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}

package/dist/identity/google/index.js

@@ -0,0 +1,6 @@
+/**
+ * Google identity helpers — Connect-with-Google.
+ */
+export { connect, createGoogleIdentityConnectProvider, enableGoogleActorSubject, enableGoogleActorSubjectFromConnectors, googleConnectUrl, googleIdentityConnectProvider, isGoogleActorSubjectEnabled, isGoogleConnectConfigured, resetGoogleActorSubjectEnabledForTests, GOOGLE_CONNECT_CALLBACK_PATH, GOOGLE_CONNECT_LINK_PATH, GOOGLE_CONNECT_START_PATH, GOOGLE_CONNECT_STATUS_PATH, } from "./connect-http.js";
+export { googleOauthTickets } from "./oauth.js";
+//# sourceMappingURL=index.js.map

package/dist/identity/google/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/google/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,mCAAmC,EACnC,wBAAwB,EACxB,sCAAsC,EACtC,gBAAgB,EAChB,6BAA6B,EAC7B,2BAA2B,EAC3B,yBAAyB,EACzB,sCAAsC,EACtC,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}

package/dist/identity/google/oauth.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Google BYO OAuth descriptor — optional non-LangSmith Connect-with-Google.
+ * The default path uses Fleet auth-sessions instead.
+ */
+import { type ByoOauthConfig, type ByoOauthClient } from "../byo-oauth.js";
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, } from "../byo-oauth.js";
+export type GoogleOauthConfig = ByoOauthConfig;
+/** Google BYO OAuth client (config, authorize, exchange, Fleet adapter). */
+export declare const googleByoOauth: ByoOauthClient;
+export declare const GOOGLE_OAUTH_CLIENT_ID_ENV: string;
+export declare const GOOGLE_OAUTH_CLIENT_SECRET_ENV: string;
+export declare const GOOGLE_OAUTH_SCOPES_ENV: string;
+export declare const GOOGLE_OAUTH_AUTH_URL_ENV: string;
+export declare const GOOGLE_OAUTH_TOKEN_URL_ENV: string;
+export declare const GOOGLE_OAUTH_USERINFO_URL_ENV: string;
+/** Google-bound OAuth state / connect-ticket helpers. */
+export declare const googleOauthTickets: import("../oauth-tickets.js").OauthTickets;
+export declare const resolveGoogleOauthRedirectBase: typeof import("../byo-oauth.js").resolveSlackOauthRedirectBase;
+export declare const readGoogleOauthConfig: (env?: NodeJS.ProcessEnv) => ByoOauthConfig | null;
+export declare const buildGoogleAuthorizeUrl: (config: ByoOauthConfig, state: string, redirectUri: string, scopes?: string) => string;
+export declare const exchangeGoogleOauthCode: (config: ByoOauthConfig, code: string, redirectUri: string, fetchImpl?: typeof fetch) => Promise<import("../fleet-connect.js").FleetVaultByoTokenResult>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/identity/google/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/google/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAQ/C,4EAA4E;AAC5E,eAAO,MAAM,cAAc,EAAE,cAsB3B,CAAC;AAEH,eAAO,MAAM,0BAA0B,QAA8B,CAAC;AACtE,eAAO,MAAM,8BAA8B,QAAkC,CAAC;AAC9E,eAAO,MAAM,uBAAuB,QAA4B,CAAC;AACjE,eAAO,MAAM,yBAAyB,QAA6B,CAAC;AACpE,eAAO,MAAM,0BAA0B,QAA8B,CAAC;AACtE,eAAO,MAAM,6BAA6B,QAAiC,CAAC;AAE5E,yDAAyD;AACzD,eAAO,MAAM,kBAAkB,4CAAyB,CAAC;AAEzD,eAAO,MAAM,8BAA8B,gEACP,CAAC;AAErC,eAAO,MAAM,qBAAqB,oDAA4B,CAAC;AAC/D,eAAO,MAAM,uBAAuB,yFAAmC,CAAC;AACxE,eAAO,MAAM,uBAAuB,0JAA8B,CAAC"}