managed-deepagents 0.5.3-dev.111 → 0.5.3-dev.112

package/dist/identity/fleet-integration-connect.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"fleet-integration-connect.js","sourceRoot":"","sources":["../../src/identity/fleet-integration-connect.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,2BAA2B,GAE5B,MAAM,0CAA0C,CAAC;AAElD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EACL,+BAA+B,EAC/B,eAAe,EACf,6BAA6B,GAE9B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AAmBpB,4EAA4E;AAC5E,MAAM,UAAU,8BAA8B,CAC5C,WAAkC,EAClC,SAAyB,EACzB,OAAO,GAA2C,EAAE,EACpD,cAAkC;IAElC,OAAO;QACL,WAAW;QACX,YAAY,EACV,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,2BAA2B,CAAC,WAAW,CAAC;QAC1E,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,mBAAmB,EAAE,SAAS,CAAC,mBAAmB;QAClD,mBAAmB;YACjB,OAAO,CACL,SAAS,CAAC,mBAAmB,EAAE;gBAC/B,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,cAAc,EAAE,CAAC,GAAG,CAAC,cAAc,IAAI,WAAW,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,qCAAqC,CACnD,WAAkC,EAClC,SAAyB,EACzB,OAAO,GAA2C,EAAE,EACpD,cAAkC;IAElC,OAAO,+BAA+B,CACpC,8BAA8B,CAC5B,WAAW,EACX,SAAS,EACT,OAAO,EACP,cAAc,CACf,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,SAAyB,EACzB,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,6BAA6B,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,WAAkC,EAClC,YAAoB;IAEpB,OAAO,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AACpD,CAAC"}

package/dist/identity/fleet.d.ts

@@ -1,56 +0,0 @@
-/**
- * LangSmith Fleet client for agent-subject vault connections.
- *
- * Shared by Connect providers (Google today; other toolserver OAuth providers
- * later). Source of truth for Connect status is Fleet agent connections — not
- * a local Store cache.
- */
-export interface FleetConnection {
-    id: string;
-    agent_id: string;
-    auth_token_id?: string;
-    provider_id: string;
-    provider_account_label?: string;
-    scopes?: string[];
-    expires_at?: string | null;
-}
-export interface UpsertAgentProviderTokenBody {
-    access_token: string;
-    refresh_token?: string;
-    expires_in_seconds?: number;
-    scopes?: string[];
-    provider_account_label?: string;
-    metadata?: Record<string, unknown>;
-}
-export interface FleetClientOptions {
-    apiKey?: string;
-    apiUrl?: string;
-    workspaceId?: string;
-    fetchImpl?: typeof fetch;
-}
-export interface CreateFleetAuthSessionBody {
-    providerSlug: string;
-    scopes: string[];
-    agentId: string;
-    strategy?: "create" | "reuse";
-}
-export interface FleetAuthSession {
-    id?: string;
-    status: string;
-    provider_slug?: string;
-    verification_url?: string;
-    token?: string;
-}
-export declare function resolveFleetApiUrl(env?: NodeJS.ProcessEnv): string;
-export declare function resolveFleetHeaders(label: string, env?: NodeJS.ProcessEnv): Record<string, string>;
-export declare function listAgentConnections(agentId: string, options?: FleetClientOptions): Promise<FleetConnection[]>;
-export declare function upsertAgentProviderToken(agentId: string, providerSlug: string, body: UpsertAgentProviderTokenBody, options?: FleetClientOptions): Promise<FleetConnection>;
-/**
- * Start a Fleet OAuth session for an agent subject (platform OAuth provider).
- * Returns a verification_url the browser should open.
- */
-export declare function createFleetAuthSession(body: CreateFleetAuthSessionBody, options?: FleetClientOptions): Promise<FleetAuthSession>;
-/** True when LANGSMITH_API_KEY is set so Fleet APIs can be called. */
-export declare function hasFleetAuthCredentials(env?: NodeJS.ProcessEnv): boolean;
-export declare function deleteAgentConnection(agentId: string, connectionId: string, options?: FleetClientOptions): Promise<void>;
-//# sourceMappingURL=fleet.d.ts.map

package/dist/identity/fleet.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fleet.d.ts","sourceRoot":"","sources":["../../src/identity/fleet.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,kBAAkB,CAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAGR;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBxB;AAiBD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,eAAe,EAAE,CAAC,CAsB5B;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,EAClC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,eAAe,CAAC,CAwB1B;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,0BAA0B,EAChC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,gBAAgB,CAAC,CA2B3B;AAED,sEAAsE;AACtE,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAmBf"}

package/dist/identity/fleet.js

@@ -1,131 +0,0 @@
-/**
- * LangSmith Fleet client for agent-subject vault connections.
- *
- * Shared by Connect providers (Google today; other toolserver OAuth providers
- * later). Source of truth for Connect status is Fleet agent connections — not
- * a local Store cache.
- */
-import { fetchWithTimeout, PROVIDER_HTTP_TIMEOUT_MS } from "../runtime/http.js";
-const DEFAULT_API_URL = "https://api.smith.langchain.com";
-export function resolveFleetApiUrl(env = process.env) {
-    const base = trimmed(env.LANGSMITH_ENDPOINT) ?? DEFAULT_API_URL;
-    return stripTrailingSlashes(withScheme(base));
-}
-export function resolveFleetHeaders(label, env = process.env) {
-    const apiKey = trimmed(env.LANGSMITH_API_KEY);
-    if (!apiKey) {
-        throw new Error(`${label} needs LANGSMITH_API_KEY to reach the LangSmith Fleet API.`);
-    }
-    const headers = {
-        "x-api-key": apiKey,
-        "Content-Type": "application/json",
-    };
-    const workspaceId = trimmed(env.LANGSMITH_WORKSPACE_ID);
-    if (workspaceId) {
-        headers["x-tenant-id"] = workspaceId;
-    }
-    return headers;
-}
-function fleetHeaders(label, options, env = process.env) {
-    if (options.apiKey || options.workspaceId) {
-        return {
-            "x-api-key": options.apiKey ?? trimmed(env.LANGSMITH_API_KEY) ?? "",
-            "Content-Type": "application/json",
-            ...(options.workspaceId ? { "x-tenant-id": options.workspaceId } : {}),
-        };
-    }
-    return resolveFleetHeaders(label, env);
-}
-export async function listAgentConnections(agentId, options = {}) {
-    const env = process.env;
-    const base = options.apiUrl ?? resolveFleetApiUrl(env);
-    const headers = fleetHeaders("fleet list connections", options, env);
-    const url = `${base}/v1/fleet/agents/${encodeURIComponent(agentId)}/connections`;
-    const response = await fetchWithTimeout(url, { method: "GET", headers }, PROVIDER_HTTP_TIMEOUT_MS, options.fetchImpl ?? fetch);
-    if (!response.ok) {
-        const text = await response.text().catch(() => "");
-        throw new Error(`Fleet list connections failed (${response.status}): ${text || response.statusText}`);
-    }
-    const json = (await response.json());
-    return json.items ?? json.data ?? [];
-}
-export async function upsertAgentProviderToken(agentId, providerSlug, body, options = {}) {
-    const env = process.env;
-    const base = options.apiUrl ?? resolveFleetApiUrl(env);
-    const headers = fleetHeaders("fleet upsert provider token", options, env);
-    const url = `${base}/v1/fleet/agents/${encodeURIComponent(agentId)}` +
-        `/providers/${encodeURIComponent(providerSlug)}/tokens`;
-    const response = await fetchWithTimeout(url, {
-        method: "POST",
-        headers,
-        body: JSON.stringify(body),
-    }, PROVIDER_HTTP_TIMEOUT_MS, options.fetchImpl ?? fetch);
-    if (!response.ok) {
-        const text = await response.text().catch(() => "");
-        throw new Error(`Fleet upsert agent provider token failed (${response.status}): ${text || response.statusText}`);
-    }
-    return (await response.json());
-}
-/**
- * Start a Fleet OAuth session for an agent subject (platform OAuth provider).
- * Returns a verification_url the browser should open.
- */
-export async function createFleetAuthSession(body, options = {}) {
-    const env = process.env;
-    const base = options.apiUrl ?? resolveFleetApiUrl(env);
-    const headers = fleetHeaders("fleet auth-session", options, env);
-    const url = `${base}/v1/fleet/auth-sessions`;
-    const response = await fetchWithTimeout(url, {
-        method: "POST",
-        headers,
-        body: JSON.stringify({
-            provider_slug: body.providerSlug,
-            scopes: body.scopes,
-            agent_id: body.agentId,
-            strategy: body.strategy ?? "create",
-        }),
-    }, PROVIDER_HTTP_TIMEOUT_MS, options.fetchImpl ?? fetch);
-    if (!response.ok) {
-        const text = await response.text().catch(() => "");
-        throw new Error(`Fleet auth-session failed (${response.status}): ${text || response.statusText}`);
-    }
-    return (await response.json());
-}
-/** True when LANGSMITH_API_KEY is set so Fleet APIs can be called. */
-export function hasFleetAuthCredentials(env = process.env) {
-    return Boolean(trimmed(env.LANGSMITH_API_KEY));
-}
-export async function deleteAgentConnection(agentId, connectionId, options = {}) {
-    const env = process.env;
-    const base = options.apiUrl ?? resolveFleetApiUrl(env);
-    const headers = fleetHeaders("fleet delete connection", options, env);
-    const url = `${base}/v1/fleet/agents/${encodeURIComponent(agentId)}` +
-        `/connections/${encodeURIComponent(connectionId)}`;
-    const response = await fetchWithTimeout(url, { method: "DELETE", headers }, PROVIDER_HTTP_TIMEOUT_MS, options.fetchImpl ?? fetch);
-    if (!response.ok && response.status !== 404) {
-        const text = await response.text().catch(() => "");
-        throw new Error(`Fleet delete connection failed (${response.status}): ${text || response.statusText}`);
-    }
-}
-function withScheme(base) {
-    const separator = base.indexOf("://");
-    if (separator > 0) {
-        const scheme = base.slice(0, separator);
-        if (/^[a-z][a-z0-9+.-]*$/i.test(scheme)) {
-            return base;
-        }
-    }
-    return `https://${base}`;
-}
-function stripTrailingSlashes(value) {
-    let end = value.length;
-    while (end > 0 && value.charCodeAt(end - 1) === 47 /* / */) {
-        end -= 1;
-    }
-    return end === value.length ? value : value.slice(0, end);
-}
-function trimmed(value) {
-    const v = value?.trim();
-    return v ? v : undefined;
-}
-//# sourceMappingURL=fleet.js.map

package/dist/identity/fleet.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"fleet.js","sourceRoot":"","sources":["../../src/identity/fleet.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,MAAM,eAAe,GAAG,iCAAiC,CAAC;AA2C1D,MAAM,UAAU,kBAAkB,CAChC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,eAAe,CAAC;IAChE,OAAO,oBAAoB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,4DAA4D,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAA2B;QACtC,WAAW,EAAE,MAAM;QACnB,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACxD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,aAAa,CAAC,GAAG,WAAW,CAAC;IACvC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CACnB,KAAa,EACb,OAA2B,EAC3B,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QAC1C,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE;YACnE,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,OAAO,GAAuB,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,wBAAwB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,GAAG,IAAI,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC;IACjF,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAC1B,wBAAwB,EACxB,OAAO,CAAC,SAAS,IAAI,KAAK,CAC3B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,kCAAkC,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAe,EACf,YAAoB,EACpB,IAAkC,EAClC,OAAO,GAAuB,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,6BAA6B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1E,MAAM,GAAG,GACP,GAAG,IAAI,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,EAAE;QACxD,cAAc,kBAAkB,CAAC,YAAY,CAAC,SAAS,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH;QACE,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,EACD,wBAAwB,EACxB,OAAO,CAAC,SAAS,IAAI,KAAK,CAC3B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,6CAA6C,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAoB,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAgC,EAChC,OAAO,GAAuB,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,oBAAoB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,GAAG,IAAI,yBAAyB,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH;QACE,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ;SACpC,CAAC;KACH,EACD,wBAAwB,EACxB,OAAO,CAAC,SAAS,IAAI,KAAK,CAC3B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,8BAA8B,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqB,CAAC;AACrD,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,uBAAuB,CACrC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAe,EACf,YAAoB,EACpB,OAAO,GAAuB,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,YAAY,CAAC,yBAAyB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACtE,MAAM,GAAG,GACP,GAAG,IAAI,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,EAAE;QACxD,gBAAgB,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAC7B,wBAAwB,EACxB,OAAO,CAAC,SAAS,IAAI,KAAK,CAC3B,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,mCAAmC,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACxC,IAAI,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,WAAW,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;QAC3D,GAAG,IAAI,CAAC,CAAC;IACX,CAAC;IACD,OAAO,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,OAAO,CAAC,KAAyB;IACxC,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACxB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3B,CAAC"}

package/dist/identity/github/connect-http.d.ts

@@ -1,37 +0,0 @@
-/**
- * Connect-with-GitHub — {@link IdentityConnectProvider} for actor OAuth tokens.
- *
- * Mounted under `/identity/github/*` when listed on `identity.connect`, or when
- * a user-scoped deployment declares a GitHub connector.
- */
-import type { IdentityConnectProvider } from "../connect-provider-types.js";
-import { type GitHubCredentialStore } from "./credentials-store.js";
-export declare const GITHUB_CONNECT_STATUS_PATH: string;
-export declare const GITHUB_CONNECT_START_PATH: string;
-export declare const GITHUB_CONNECT_CALLBACK_PATH: string;
-export declare const GITHUB_CONNECT_LINK_PATH: string;
-/** Options for {@link createGitHubIdentityConnectProvider}. */
-export interface GitHubIdentityConnectProviderOptions {
-    credentialStore?: GitHubCredentialStore;
-}
-/** Build a GitHub connect provider (injectable store for tests). */
-export declare function createGitHubIdentityConnectProvider(options?: GitHubIdentityConnectProviderOptions): IdentityConnectProvider;
-/** Default GitHub connect provider used by the identity-connect registry. */
-export declare const githubIdentityConnectProvider: IdentityConnectProvider;
-/**
- * Opt into Connect-with-GitHub on `defineIdentity({ connect: […] })`.
- *
- * Usually unnecessary: `credentials.github(...)` on a user-scoped deployment
- * mounts these routes by inference.
- *
- * @example
- * ```ts
- * import { connect, defineIdentity } from "managed-deepagents";
- *
- * export const identity = defineIdentity({
- *   connect: [connect.github()],
- * });
- * ```
- */
-export declare function connect(options?: GitHubIdentityConnectProviderOptions): IdentityConnectProvider;
-//# sourceMappingURL=connect-http.d.ts.map

package/dist/identity/github/connect-http.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/github/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAKV,uBAAuB,EAExB,MAAM,8BAA8B,CAAC;AAWtC,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAC;AAWhC,eAAO,MAAM,0BAA0B,QAAe,CAAC;AACvD,eAAO,MAAM,yBAAyB,QAAgB,CAAC;AACvD,eAAO,MAAM,4BAA4B,QAAiB,CAAC;AAC3D,eAAO,MAAM,wBAAwB,QAAa,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,WAAW,oCAAoC;IACnD,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED,oEAAoE;AACpE,wBAAgB,mCAAmC,CACjD,OAAO,GAAE,oCAAyC,GACjD,uBAAuB,CAiGzB;AAED,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,EAAE,uBACL,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,OAAO,CACrB,OAAO,CAAC,EAAE,oCAAoC,GAC7C,uBAAuB,CAIzB"}

package/dist/identity/github/connect-http.js

@@ -1,128 +0,0 @@
-/**
- * Connect-with-GitHub — {@link IdentityConnectProvider} for actor OAuth tokens.
- *
- * Mounted under `/identity/github/*` when listed on `identity.connect`, or when
- * a user-scoped deployment declares a GitHub connector.
- */
-import { identityConnectPaths } from "../connect-paths.js";
-import { hasGithubConnector, isUserScopedDeployment, } from "../connect-inference.js";
-import { MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, } from "../oauth-env.js";
-import { buildGitHubCredentialRecord, getGitHubCredentialStore, } from "./credentials-store.js";
-import { buildGitHubAuthorizeUrl, exchangeGitHubOauthCode, githubOauthTickets, readGitHubOauthConfig, resolveGitHubOauthRedirectBase, } from "./oauth.js";
-const PATHS = identityConnectPaths("github");
-export const GITHUB_CONNECT_STATUS_PATH = PATHS.status;
-export const GITHUB_CONNECT_START_PATH = PATHS.connect;
-export const GITHUB_CONNECT_CALLBACK_PATH = PATHS.callback;
-export const GITHUB_CONNECT_LINK_PATH = PATHS.link;
-/** Build a GitHub connect provider (injectable store for tests). */
-export function createGitHubIdentityConnectProvider(options = {}) {
-    const store = () => options.credentialStore ?? getGitHubCredentialStore();
-    return {
-        id: "github",
-        shouldMount(ctx) {
-            if (!ctx.hasIdentity) {
-                return false;
-            }
-            // Listed on `identity.connect` — the author already opted in.
-            if (ctx.declared) {
-                return true;
-            }
-            // Otherwise mirror Google/Microsoft: a GitHub connector on a user-scoped
-            // deployment needs somewhere for the caller to grant an actor OAuth token.
-            if (!isUserScopedDeployment(ctx.scope)) {
-                return false;
-            }
-            return hasGithubConnector(ctx.connectorKinds);
-        },
-        async status(userId) {
-            const configured = Boolean(readGitHubOauthConfig());
-            const record = await store().getByUserId(userId);
-            return {
-                configured,
-                linked: Boolean(record),
-                ...(record
-                    ? {
-                        githubLogin: record.githubLogin,
-                        githubUserId: record.githubUserId,
-                        linkedAt: record.linkedAt,
-                        scope: record.scope,
-                    }
-                    : {}),
-            };
-        },
-        async startAuthorize(userId, redirectUri) {
-            const oauth = readGitHubOauthConfig();
-            const stateKey = readOauthStateSigningKey();
-            if (!oauth || !stateKey) {
-                return {
-                    notConfigured: true,
-                    error: `GitHub connect is not configured (set GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, MDA_PUBLIC_APP_URL, ${OAUTH_STATE_SIGNING_KEY_ENV})`,
-                };
-            }
-            const state = await githubOauthTickets.createState(userId, stateKey);
-            return {
-                authorizeUrl: buildGitHubAuthorizeUrl(oauth, state, redirectUri),
-            };
-        },
-        async completeCallback(code, state, redirectUri) {
-            const oauth = readGitHubOauthConfig();
-            if (!oauth) {
-                throw new Error("GitHub OAuth is not configured");
-            }
-            const stateKey = readOauthStateSigningKey();
-            if (!stateKey) {
-                throw new Error(`${OAUTH_STATE_SIGNING_KEY_ENV} is not configured`);
-            }
-            const { userId } = await githubOauthTickets.verifyState(state, stateKey);
-            const token = await exchangeGitHubOauthCode(oauth, code, redirectUri);
-            const record = buildGitHubCredentialRecord({
-                userId,
-                githubUserId: token.userId,
-                githubLogin: token.login,
-                accessToken: token.accessToken,
-                ...(token.refreshToken ? { refreshToken: token.refreshToken } : {}),
-                ...(token.tokenType ? { tokenType: token.tokenType } : {}),
-                ...(token.scope ? { scope: token.scope } : {}),
-                ...(token.email ? { email: token.email } : {}),
-            });
-            await store().upsert(record);
-            return {
-                successRedirect: `${oauth.publicAppUrl}/settings?github=connected`,
-            };
-        },
-        async unlink(userId) {
-            await store().removeByUserId(userId);
-        },
-        resolveRedirectBase(options) {
-            return resolveGitHubOauthRedirectBase(options);
-        },
-        resolvePublicAppUrl() {
-            const oauth = readGitHubOauthConfig();
-            return (oauth?.publicAppUrl ??
-                process.env[MDA_PUBLIC_APP_URL_ENV]?.replace(/\/$/, ""));
-        },
-    };
-}
-/** Default GitHub connect provider used by the identity-connect registry. */
-export const githubIdentityConnectProvider = createGitHubIdentityConnectProvider();
-/**
- * Opt into Connect-with-GitHub on `defineIdentity({ connect: […] })`.
- *
- * Usually unnecessary: `credentials.github(...)` on a user-scoped deployment
- * mounts these routes by inference.
- *
- * @example
- * ```ts
- * import { connect, defineIdentity } from "managed-deepagents";
- *
- * export const identity = defineIdentity({
- *   connect: [connect.github()],
- * });
- * ```
- */
-export function connect(options) {
-    return options
-        ? createGitHubIdentityConnectProvider(options)
-        : githubIdentityConnectProvider;
-}
-//# sourceMappingURL=connect-http.js.map

package/dist/identity/github/connect-http.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/github/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,GAEzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,YAAY,CAAC;AAEpB,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC,MAAM,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC,OAAO,CAAC;AACvD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC,QAAQ,CAAC;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC,IAAI,CAAC;AAOnD,oEAAoE;AACpE,MAAM,UAAU,mCAAmC,CACjD,OAAO,GAAyC,EAAE;IAElD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,IAAI,wBAAwB,EAAE,CAAC;IAE1E,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,WAAW,CAAC,GAAgC;YAC1C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,8DAA8D;YAC9D,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,yEAAyE;YACzE,2EAA2E;YAC3E,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvC,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAChD,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,UAAU,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACjD,OAAO;gBACL,UAAU;gBACV,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;gBACvB,GAAG,CAAC,MAAM;oBACR,CAAC,CAAC;wBACE,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;wBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;qBACpB;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,WAAmB;YAEnB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,KAAK,EAAE,qGAAqG,2BAA2B,GAAG;iBAC3I,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrE,OAAO;gBACL,YAAY,EAAE,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;aACjE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CACpB,IAAY,EACZ,KAAa,EACb,WAAmB;YAEnB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,GAAG,2BAA2B,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACzE,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,2BAA2B,CAAC;gBACzC,MAAM;gBACN,YAAY,EAAE,KAAK,CAAC,MAAM;gBAC1B,WAAW,EAAE,KAAK,CAAC,KAAK;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/C,CAAC,CAAC;YACH,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO;gBACL,eAAe,EAAE,GAAG,KAAK,CAAC,YAAY,4BAA4B;aACnE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc;YACzB,MAAM,KAAK,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,mBAAmB,CAAC,OAA2C;YAC7D,OAAO,8BAA8B,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QACD,mBAAmB;YACjB,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACtC,OAAO,CACL,KAAK,EAAE,YAAY;gBACnB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACxD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GACxC,mCAAmC,EAAE,CAAC;AAExC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,OAAO,CACrB,OAA8C;IAE9C,OAAO,OAAO;QACZ,CAAC,CAAC,mCAAmC,CAAC,OAAO,CAAC;QAC9C,CAAC,CAAC,6BAA6B,CAAC;AACpC,CAAC"}

package/dist/identity/github/oauth.d.ts

@@ -1,47 +0,0 @@
-/**
- * GitHub OAuth helpers for Connect-with-GitHub credential binding.
- *
- * Unlike Slack Connect (channel identity remap only), GitHub Connect stores a
- * per-actor OAuth access token so `credentials.github({ write: ["actor"] })`
- * can act as the signed-in user (e.g. open pull requests).
- *
- * Implemented as a {@link createByoOauthClient} descriptor with GitHub-specific
- * token (JSON body) and userinfo (API headers) quirks.
- */
-import { type ByoOauthClient, type ByoOauthConfig } from "../byo-oauth.js";
-export declare const GITHUB_CLIENT_ID_ENV = "GITHUB_CLIENT_ID";
-export declare const GITHUB_CLIENT_SECRET_ENV = "GITHUB_CLIENT_SECRET";
-/** Space-separated OAuth scopes. Defaults to `repo read:user`. */
-export declare const GITHUB_OAUTH_SCOPES_ENV = "GITHUB_OAUTH_SCOPES";
-/** Override GitHub OAuth/API base (tests). */
-export declare const GITHUB_OAUTH_BASE_ENV = "GITHUB_OAUTH_BASE";
-export type GitHubOauthConfig = ByoOauthConfig;
-export interface GitHubOauthTokenResult {
-    accessToken: string;
-    tokenType?: string;
-    scope?: string;
-    refreshToken?: string;
-    userId: string;
-    login: string;
-    email?: string;
-}
-/** GitHub BYO OAuth client (config, authorize, exchange). */
-export declare const githubByoOauth: ByoOauthClient;
-/** GitHub-bound OAuth state / connect-ticket helpers. */
-export declare const githubOauthTickets: import("../oauth-tickets.js").OauthTickets;
-export declare const resolveGitHubOauthRedirectBase: typeof import("../oauth-env.js").resolveOauthRedirectBase;
-/**
- * Requires `MDA_PUBLIC_APP_URL` — unlike Fleet BYO readers, do not fall back
- * to `MDA_PUBLIC_API_URL`; post-OAuth redirect targets the managed app
- * (`/settings?github=connected`).
- */
-export declare function readGitHubOauthConfig(env?: NodeJS.ProcessEnv): GitHubOauthConfig | null;
-export declare const buildGitHubAuthorizeUrl: (config: ByoOauthConfig, state: string, redirectUri: string, scopes?: string) => string;
-/**
- * Exchange an authorization code for a user access token and profile.
- *
- * GitHub returns `application/x-www-form-urlencoded` unless `Accept:
- * application/json` is set — handled by the BYO tokenRequest config.
- */
-export declare function exchangeGitHubOauthCode(config: GitHubOauthConfig, code: string, redirectUri: string, fetchImpl?: typeof fetch): Promise<GitHubOauthTokenResult>;
-//# sourceMappingURL=oauth.d.ts.map

package/dist/identity/github/oauth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/github/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AAGzB,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAC/D,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,8CAA8C;AAC9C,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAQzD,MAAM,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAE/C,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAyBD,6DAA6D;AAC7D,eAAO,MAAM,cAAc,EAAE,cAkD3B,CAAC;AAEH,yDAAyD;AACzD,eAAO,MAAM,kBAAkB,4CAAyB,CAAC;AAEzD,eAAO,MAAM,8BAA8B,2DACP,CAAC;AAErC;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,iBAAiB,GAAG,IAAI,CAK1B;AAED,eAAO,MAAM,uBAAuB,yFAAmC,CAAC;AAExE;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAqBjC"}

package/dist/identity/github/oauth.js

@@ -1,124 +0,0 @@
-/**
- * GitHub OAuth helpers for Connect-with-GitHub credential binding.
- *
- * Unlike Slack Connect (channel identity remap only), GitHub Connect stores a
- * per-actor OAuth access token so `credentials.github({ write: ["actor"] })`
- * can act as the signed-in user (e.g. open pull requests).
- *
- * Implemented as a {@link createByoOauthClient} descriptor with GitHub-specific
- * token (JSON body) and userinfo (API headers) quirks.
- */
-import { createByoOauthClient, } from "../byo-oauth.js";
-import { MDA_PUBLIC_APP_URL_ENV } from "../oauth-env.js";
-export const GITHUB_CLIENT_ID_ENV = "GITHUB_CLIENT_ID";
-export const GITHUB_CLIENT_SECRET_ENV = "GITHUB_CLIENT_SECRET";
-/** Space-separated OAuth scopes. Defaults to `repo read:user`. */
-export const GITHUB_OAUTH_SCOPES_ENV = "GITHUB_OAUTH_SCOPES";
-/** Override GitHub OAuth/API base (tests). */
-export const GITHUB_OAUTH_BASE_ENV = "GITHUB_OAUTH_BASE";
-const DEFAULT_OAUTH_BASE = "https://github.com";
-const DEFAULT_API_BASE = "https://api.github.com";
-const DEFAULT_SCOPES = "repo read:user";
-const SUBJECT_METADATA_KEY = "github_user_id";
-const LOGIN_METADATA_KEY = "github_login";
-function githubEndpoints(env) {
-    const oauthBase = (env[GITHUB_OAUTH_BASE_ENV]?.trim() || DEFAULT_OAUTH_BASE).replace(/\/$/, "");
-    const apiBase = oauthBase === DEFAULT_OAUTH_BASE ? DEFAULT_API_BASE : `${oauthBase}/api/v3`;
-    return {
-        oauthBase,
-        apiBase,
-        authUrl: `${oauthBase}/login/oauth/authorize`,
-        tokenUrl: `${oauthBase}/login/oauth/access_token`,
-        userInfoUrl: `${apiBase}/user`,
-        defaultScopes: DEFAULT_SCOPES,
-    };
-}
-/** GitHub BYO OAuth client (config, authorize, exchange). */
-export const githubByoOauth = createByoOauthClient({
-    providerId: "github",
-    displayName: "GitHub",
-    envPrefix: "GITHUB",
-    envKeys: {
-        scopes: GITHUB_OAUTH_SCOPES_ENV,
-    },
-    defaultPrompt: false,
-    tokenRequest: {
-        format: "json",
-        headers: { Accept: "application/json" },
-    },
-    userInfoRequest: {
-        required: true,
-        headers: {
-            Accept: "application/vnd.github+json",
-            "User-Agent": "managed-deepagents",
-            "X-GitHub-Api-Version": "2022-11-28",
-        },
-    },
-    defaultEndpoints(env) {
-        const endpoints = githubEndpoints(env);
-        return {
-            authUrl: endpoints.authUrl,
-            tokenUrl: endpoints.tokenUrl,
-            userInfoUrl: endpoints.userInfoUrl,
-            defaultScopes: endpoints.defaultScopes,
-        };
-    },
-    parseUserInfo(json) {
-        const id = json.id;
-        const login = typeof json.login === "string" ? json.login : undefined;
-        if (id === undefined || !login) {
-            throw new Error(typeof json.message === "string"
-                ? json.message
-                : "GitHub /user lookup failed");
-        }
-        return {
-            ...(typeof json.email === "string" && json.email
-                ? { email: json.email }
-                : {}),
-            subject: String(id),
-            metadata: {
-                [LOGIN_METADATA_KEY]: login,
-            },
-        };
-    },
-    subjectMetadataKey: SUBJECT_METADATA_KEY,
-});
-/** GitHub-bound OAuth state / connect-ticket helpers. */
-export const githubOauthTickets = githubByoOauth.tickets;
-export const resolveGitHubOauthRedirectBase = githubByoOauth.resolveRedirectBase;
-/**
- * Requires `MDA_PUBLIC_APP_URL` — unlike Fleet BYO readers, do not fall back
- * to `MDA_PUBLIC_API_URL`; post-OAuth redirect targets the managed app
- * (`/settings?github=connected`).
- */
-export function readGitHubOauthConfig(env = process.env) {
-    if (!env[MDA_PUBLIC_APP_URL_ENV]?.trim()) {
-        return null;
-    }
-    return githubByoOauth.readConfig(env);
-}
-export const buildGitHubAuthorizeUrl = githubByoOauth.buildAuthorizeUrl;
-/**
- * Exchange an authorization code for a user access token and profile.
- *
- * GitHub returns `application/x-www-form-urlencoded` unless `Accept:
- * application/json` is set — handled by the BYO tokenRequest config.
- */
-export async function exchangeGitHubOauthCode(config, code, redirectUri, fetchImpl = fetch) {
-    const result = await githubByoOauth.exchangeCode(config, code, redirectUri, fetchImpl);
-    const userId = result.metadata?.[SUBJECT_METADATA_KEY];
-    const login = result.metadata?.[LOGIN_METADATA_KEY];
-    if (typeof userId !== "string" || typeof login !== "string" || !login) {
-        throw new Error("GitHub /user lookup failed");
-    }
-    return {
-        accessToken: result.accessToken,
-        ...(result.tokenType ? { tokenType: result.tokenType } : {}),
-        ...(result.scope ? { scope: result.scope } : {}),
-        ...(result.refreshToken ? { refreshToken: result.refreshToken } : {}),
-        userId,
-        login,
-        ...(result.accountLabel ? { email: result.accountLabel } : {}),
-    };
-}
-//# sourceMappingURL=oauth.js.map

package/dist/identity/github/oauth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/identity/github/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,oBAAoB,GAGrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AACvD,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAC/D,kEAAkE;AAClE,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAC7D,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAEzD,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAChD,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAClD,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAC9C,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAc1C,SAAS,eAAe,CAAC,GAAsB;IAQ7C,MAAM,SAAS,GAAG,CAChB,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,IAAI,kBAAkB,CACzD,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrB,MAAM,OAAO,GACX,SAAS,KAAK,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,SAAS,SAAS,CAAC;IAC9E,OAAO;QACL,SAAS;QACT,OAAO;QACP,OAAO,EAAE,GAAG,SAAS,wBAAwB;QAC7C,QAAQ,EAAE,GAAG,SAAS,2BAA2B;QACjD,WAAW,EAAE,GAAG,OAAO,OAAO;QAC9B,aAAa,EAAE,cAAc;KAC9B,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,MAAM,cAAc,GAAmB,oBAAoB,CAAC;IACjE,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,QAAQ;IACrB,SAAS,EAAE,QAAQ;IACnB,OAAO,EAAE;QACP,MAAM,EAAE,uBAAuB;KAChC;IACD,aAAa,EAAE,KAAK;IACpB,YAAY,EAAE;QACZ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC;IACD,eAAe,EAAE;QACf,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE;YACP,MAAM,EAAE,6BAA6B;YACrC,YAAY,EAAE,oBAAoB;YAClC,sBAAsB,EAAE,YAAY;SACrC;KACF;IACD,gBAAgB,CAAC,GAAG;QAClB,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO;YACL,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,aAAa,EAAE,SAAS,CAAC,aAAa;SACvC,CAAC;IACJ,CAAC;IACD,aAAa,CAAC,IAAI;QAChB,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;gBAC9B,CAAC,CAAC,IAAI,CAAC,OAAO;gBACd,CAAC,CAAC,4BAA4B,CACjC,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK;gBAC9C,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;gBACvB,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YACnB,QAAQ,EAAE;gBACR,CAAC,kBAAkB,CAAC,EAAE,KAAK;aAC5B;SACF,CAAC;IACJ,CAAC;IACD,kBAAkB,EAAE,oBAAoB;CACzC,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC,OAAO,CAAC;AAEzD,MAAM,CAAC,MAAM,8BAA8B,GACzC,cAAc,CAAC,mBAAmB,CAAC;AAErC;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC,iBAAiB,CAAC;AAExE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAyB,EACzB,IAAY,EACZ,WAAmB,EACnB,SAAS,GAAiB,KAAK;IAE/B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,YAAY,CAC9C,MAAM,EACN,IAAI,EACJ,WAAW,EACX,SAAS,CACV,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,oBAAoB,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,kBAAkB,CAAC,CAAC;IACpD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM;QACN,KAAK;QACL,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC"}

package/dist/identity/google/connect-http.d.ts

@@ -1,37 +0,0 @@
-/**
- * Connect-with-Google — thin adapter over {@link defineFleetIntegrationConnect}.
- *
- * Mounted under `/identity/google/*` when listed on `identity.connect`, or
- * inferred from declared Google toolserver connectors on a user-scoped
- * deployment.
- */
-import type { FleetIntegrationConnectProviderOptions } from "../fleet-integration-connect.js";
-export declare const GOOGLE_CONNECT_STATUS_PATH: string;
-export declare const GOOGLE_CONNECT_START_PATH: string;
-export declare const GOOGLE_CONNECT_CALLBACK_PATH: string;
-export declare const GOOGLE_CONNECT_LINK_PATH: string;
-export declare const isGoogleActorSubjectEnabled: () => boolean;
-export declare const enableGoogleActorSubject: () => void;
-/**
- * Enable actor-subject mode when Google connectors imply per-user vault subjects.
- *
- * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
- */
-export declare const enableGoogleActorSubjectFromConnectors: (connectorKinds: readonly (string | undefined)[] | undefined, scope?: import("../connect-provider-types.js").IdentityConnectMountContext["scope"]) => void;
-export declare const resetGoogleActorSubjectEnabledForTests: () => void;
-export declare const isGoogleConnectConfigured: (env?: NodeJS.ProcessEnv) => boolean;
-export declare const googleConnectUrl: (publicAppUrl: string) => string;
-/** Options for {@link createGoogleIdentityConnectProvider}. */
-export type GoogleIdentityConnectProviderOptions = FleetIntegrationConnectProviderOptions;
-/** Build a Google connect provider. */
-export declare const createGoogleIdentityConnectProvider: (options?: FleetIntegrationConnectProviderOptions) => import("../connect-provider-types.js").IdentityConnectProvider;
-/** Default Google connect provider used as a built-in mount candidate. */
-export declare const googleIdentityConnectProvider: import("../connect-provider-types.js").IdentityConnectProvider;
-/**
- * Opt into Connect-with-Google on `defineIdentity({ connect: […] })`.
- *
- * Usually unnecessary: declaring Google toolserver connectors on a user-scoped
- * identity deployment mounts this provider and derives OAuth scopes automatically.
- */
-export declare const connect: (options?: FleetIntegrationConnectProviderOptions) => import("../connect-provider-types.js").IdentityConnectProvider;
-//# sourceMappingURL=connect-http.d.ts.map

package/dist/identity/google/connect-http.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/google/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAC;AAS9F,eAAO,MAAM,0BAA0B,QAAsB,CAAC;AAC9D,eAAO,MAAM,yBAAyB,QAAuB,CAAC;AAC9D,eAAO,MAAM,4BAA4B,QAAwB,CAAC;AAClE,eAAO,MAAM,wBAAwB,QAAoB,CAAC;AAE1D,eAAO,MAAM,2BAA2B,eAA+B,CAAC;AACxE,eAAO,MAAM,wBAAwB,YAA4B,CAAC;AAClE;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,4JACV,CAAC;AAC1C,eAAO,MAAM,sCAAsC,YACV,CAAC;AAC1C,eAAO,MAAM,yBAAyB,sCAA6B,CAAC;AACpE,eAAO,MAAM,gBAAgB,kCAAoB,CAAC;AAElD,+DAA+D;AAC/D,MAAM,MAAM,oCAAoC,GAC9C,sCAAsC,CAAC;AAEzC,uCAAuC;AACvC,eAAO,MAAM,mCAAmC,sHAAwB,CAAC;AAEzE,0EAA0E;AAC1E,eAAO,MAAM,6BAA6B,gEAAkB,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,OAAO,sHAAiB,CAAC"}