managed-deepagents 0.5.3-dev.111 → 0.5.3-dev.113

package/dist/identity/github/credentials-store.js

@@ -1,270 +0,0 @@
-/**
- * Per-actor GitHub OAuth credential vault.
- *
- * Stored in the LangGraph Store under `["mda_github_credentials"]`. Connect-
- * with-GitHub upserts after OAuth; `credentials.github` resolves `actor` tokens
- * from here until managed Agent Auth lands.
- *
- * Tokens are deployment-scoped Store values — treat the Store namespace as
- * sensitive and prefer short-lived OAuth tokens / refresh where available.
- *
- * Reads always consult the shared Store first (in-graph {@link getStore}, then
- * the service-principal HTTP client). A small process cache is only a
- * write-through fallback for the Host quirk where loopback `get` can miss
- * right after a successful `put` on the same worker — never an authority that
- * can outlive an unlink/rotate on another worker.
- */
-import { getStore } from "@langchain/langgraph";
-import { Client } from "@langchain/langgraph-sdk";
-import { HANDOFF_SECRET_ENV, HANDOFF_SECRET_HEADER, USER_HEADER, GITHUB_CREDENTIALS_STORE_PREFIX, IDENTITY_LINKS_SERVICE_USER, INGRESS_SECRET_ENV, INGRESS_SECRET_HEADER, LANGSMITH_API_KEY_ENV, } from "../../runtime/auth.js";
-import { isLoopbackUrl, resolveLoopbackApiKey, resolveLoopbackApiUrl, } from "../loopback.js";
-export { GITHUB_CREDENTIALS_STORE_PREFIX };
-export const GITHUB_CREDENTIALS_NAMESPACE = [
-    GITHUB_CREDENTIALS_STORE_PREFIX,
-];
-/** How long a same-worker write-through entry may survive a Store miss. */
-export const GITHUB_CREDENTIAL_CACHE_TTL_MS = 30_000;
-/** Soft cap on cached GitHub credential records per process. */
-export const GITHUB_CREDENTIAL_CACHE_MAX_ENTRIES = 256;
-/** Bounded write-through cache shared by LangGraph-backed stores. */
-const processCache = new Map();
-/** In-memory store for tests. */
-export class InMemoryGitHubCredentialStore {
-    byUser = new Map();
-    async getByUserId(userId) {
-        return this.byUser.get(userId) ?? null;
-    }
-    async upsert(record) {
-        this.byUser.set(record.userId, record);
-    }
-    async removeByUserId(userId) {
-        this.byUser.delete(userId);
-    }
-}
-/** LangGraph Store–backed GitHub credential vault. */
-export class LangGraphGitHubCredentialStore {
-    client;
-    constructor(client) {
-        this.client = client;
-    }
-    async getByUserId(userId) {
-        const fromGraph = await readFromAmbientStore(userId);
-        if (fromGraph) {
-            rememberCache(userId, fromGraph, { localWrite: false });
-            return fromGraph;
-        }
-        let storeMiss = false;
-        let storeUnavailable = false;
-        try {
-            const item = await this.client.store.getItem([...GITHUB_CREDENTIALS_NAMESPACE], userKey(userId));
-            if (item?.value && typeof item.value === "object") {
-                const record = valueToRecord(item.value);
-                if (record) {
-                    rememberCache(userId, record, { localWrite: false });
-                    return record;
-                }
-            }
-            storeMiss = true;
-        }
-        catch {
-            storeUnavailable = true;
-        }
-        const cached = liveCacheEntry(userId);
-        if (cached) {
-            if (storeUnavailable) {
-                return cached.record;
-            }
-            if (storeMiss && cached.localWrite) {
-                // Same-worker Host quirk: put succeeded, loopback get returned empty.
-                return cached.record;
-            }
-        }
-        if (storeMiss) {
-            // Authoritative miss — honor unlink/rotate from another worker.
-            processCache.delete(userId);
-        }
-        return null;
-    }
-    async upsert(record) {
-        await this.client.store.putItem([...GITHUB_CREDENTIALS_NAMESPACE], userKey(record.userId), recordToValue(record));
-        rememberCache(record.userId, record, { localWrite: true });
-        await writeToAmbientStore(record);
-    }
-    async removeByUserId(userId) {
-        processCache.delete(userId);
-        await this.client.store.deleteItem([...GITHUB_CREDENTIALS_NAMESPACE], userKey(userId));
-        await deleteFromAmbientStore(userId);
-    }
-}
-let defaultStore = null;
-/** Override the process-default credential store (tests). */
-export function setGitHubCredentialStore(store) {
-    defaultStore = store;
-    processCache.clear();
-}
-/** Resolve the process-default credential store. */
-export function getGitHubCredentialStore() {
-    if (defaultStore) {
-        return defaultStore;
-    }
-    defaultStore =
-        createLangGraphGitHubCredentialStore() ??
-            new InMemoryGitHubCredentialStore();
-    return defaultStore;
-}
-export function createLangGraphGitHubCredentialStore(options = {}) {
-    const serverApiKey = process.env[LANGSMITH_API_KEY_ENV]?.trim();
-    const configuredHandoffSecret = process.env[HANDOFF_SECRET_ENV]?.trim();
-    const explicitIngressSecret = options.ingressSecret?.trim();
-    const configuredIngressSecret = explicitIngressSecret || process.env[INGRESS_SECRET_ENV]?.trim();
-    const apiUrl = resolveLoopbackApiUrl(options.apiUrl);
-    const apiKey = resolveLoopbackApiKey(options.apiKey);
-    const isLocal = isLoopbackUrl(apiUrl);
-    const handoffSecret = isLocal ? configuredHandoffSecret : undefined;
-    const ingressSecret = isLocal ? configuredIngressSecret : undefined;
-    const usesServerApiKey = Boolean(serverApiKey && apiKey === serverApiKey);
-    if (!usesServerApiKey && !handoffSecret && !ingressSecret) {
-        return null;
-    }
-    const defaultHeaders = {
-        [USER_HEADER]: IDENTITY_LINKS_SERVICE_USER,
-    };
-    if (!usesServerApiKey && explicitIngressSecret && ingressSecret) {
-        defaultHeaders[INGRESS_SECRET_HEADER] = ingressSecret;
-    }
-    else if (handoffSecret) {
-        defaultHeaders[HANDOFF_SECRET_HEADER] = handoffSecret;
-    }
-    else if (!usesServerApiKey && ingressSecret) {
-        defaultHeaders[INGRESS_SECRET_HEADER] = ingressSecret;
-    }
-    const client = new Client({
-        apiUrl,
-        apiKey,
-        defaultHeaders,
-    });
-    return new LangGraphGitHubCredentialStore(client);
-}
-export function buildGitHubCredentialRecord(input) {
-    return {
-        userId: input.userId,
-        githubUserId: input.githubUserId,
-        githubLogin: input.githubLogin,
-        accessToken: input.accessToken,
-        ...(input.refreshToken ? { refreshToken: input.refreshToken } : {}),
-        ...(input.tokenType ? { tokenType: input.tokenType } : {}),
-        ...(input.scope ? { scope: input.scope } : {}),
-        ...(input.email ? { email: input.email } : {}),
-        linkedAt: new Date().toISOString(),
-        source: "github_oauth",
-    };
-}
-function userKey(userId) {
-    return `actor:${userId}`;
-}
-function recordToValue(record) {
-    return { ...record };
-}
-function valueToRecord(value) {
-    const userId = value.userId;
-    const githubUserId = value.githubUserId;
-    const githubLogin = value.githubLogin;
-    const accessToken = value.accessToken;
-    if (typeof userId !== "string" ||
-        typeof githubUserId !== "string" ||
-        typeof githubLogin !== "string" ||
-        typeof accessToken !== "string") {
-        return null;
-    }
-    return {
-        userId,
-        githubUserId,
-        githubLogin,
-        accessToken,
-        ...(typeof value.refreshToken === "string"
-            ? { refreshToken: value.refreshToken }
-            : {}),
-        ...(typeof value.tokenType === "string"
-            ? { tokenType: value.tokenType }
-            : {}),
-        ...(typeof value.scope === "string" ? { scope: value.scope } : {}),
-        ...(typeof value.email === "string" ? { email: value.email } : {}),
-        linkedAt: typeof value.linkedAt === "string"
-            ? value.linkedAt
-            : new Date().toISOString(),
-        source: "github_oauth",
-    };
-}
-function rememberCache(userId, record, options) {
-    processCache.set(userId, {
-        record,
-        cachedAtMs: Date.now(),
-        localWrite: options.localWrite,
-    });
-    evictExpiredAndOverflow();
-}
-function liveCacheEntry(userId) {
-    const entry = processCache.get(userId);
-    if (!entry) {
-        return undefined;
-    }
-    if (Date.now() - entry.cachedAtMs > GITHUB_CREDENTIAL_CACHE_TTL_MS) {
-        processCache.delete(userId);
-        return undefined;
-    }
-    return entry;
-}
-function evictExpiredAndOverflow() {
-    const now = Date.now();
-    for (const [key, entry] of processCache) {
-        if (now - entry.cachedAtMs > GITHUB_CREDENTIAL_CACHE_TTL_MS) {
-            processCache.delete(key);
-        }
-    }
-    while (processCache.size > GITHUB_CREDENTIAL_CACHE_MAX_ENTRIES) {
-        const oldest = processCache.keys().next().value;
-        if (oldest === undefined) {
-            break;
-        }
-        processCache.delete(oldest);
-    }
-}
-async function readFromAmbientStore(userId) {
-    try {
-        const store = getStore();
-        if (!store)
-            return null;
-        const item = await store.get([...GITHUB_CREDENTIALS_NAMESPACE], userKey(userId));
-        if (!item?.value || typeof item.value !== "object") {
-            return null;
-        }
-        return valueToRecord(item.value);
-    }
-    catch {
-        // Outside a runnable context (Connect HTTP handlers, unit tests).
-        return null;
-    }
-}
-async function writeToAmbientStore(record) {
-    try {
-        const store = getStore();
-        if (!store)
-            return;
-        await store.put([...GITHUB_CREDENTIALS_NAMESPACE], userKey(record.userId), recordToValue(record));
-    }
-    catch {
-        // Best-effort; HTTP put already persisted.
-    }
-}
-async function deleteFromAmbientStore(userId) {
-    try {
-        const store = getStore();
-        if (!store)
-            return;
-        await store.delete([...GITHUB_CREDENTIALS_NAMESPACE], userKey(userId));
-    }
-    catch {
-        // Best-effort.
-    }
-}
-//# sourceMappingURL=credentials-store.js.map

package/dist/identity/github/credentials-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials-store.js","sourceRoot":"","sources":["../../../src/identity/github/credentials-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAElD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,WAAW,EACX,+BAA+B,EAC/B,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,+BAA+B,EAAE,CAAC;AAC3C,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,+BAA+B;CACvB,CAAC;AAEX,2EAA2E;AAC3E,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC;AACrD,gEAAgE;AAChE,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AAgCvD,qEAAqE;AACrE,MAAM,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;AAE1D,iCAAiC;AACjC,MAAM,OAAO,6BAA6B;IACvB,MAAM,GAAG,IAAI,GAAG,EAAkC,CAAC;IAEpE,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA8B;QACzC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;CACF;AAED,sDAAsD;AACtD,MAAM,OAAO,8BAA8B;IACZ,MAAM;IAAnC,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,SAAS,EAAE,CAAC;YACd,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;YACxD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,gBAAgB,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAC1C,CAAC,GAAG,4BAA4B,CAAC,EACjC,OAAO,CAAC,MAAM,CAAC,CAChB,CAAC;YACF,IAAI,IAAI,EAAE,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAClD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC;gBACpE,IAAI,MAAM,EAAE,CAAC;oBACX,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;oBACrD,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC;YACD,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,gBAAgB,EAAE,CAAC;gBACrB,OAAO,MAAM,CAAC,MAAM,CAAC;YACvB,CAAC;YACD,IAAI,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACnC,sEAAsE;gBACtE,OAAO,MAAM,CAAC,MAAM,CAAC;YACvB,CAAC;QACH,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,gEAAgE;YAChE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA8B;QACzC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAC7B,CAAC,GAAG,4BAA4B,CAAC,EACjC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,aAAa,CAAC,MAAM,CAAC,CACtB,CAAC;QACF,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAChC,CAAC,GAAG,4BAA4B,CAAC,EACjC,OAAO,CAAC,MAAM,CAAC,CAChB,CAAC;QACF,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;CACF;AAED,IAAI,YAAY,GAAiC,IAAI,CAAC;AAEtD,6DAA6D;AAC7D,MAAM,UAAU,wBAAwB,CACtC,KAAmC;IAEnC,YAAY,GAAG,KAAK,CAAC;IACrB,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,wBAAwB;IACtC,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,YAAY;QACV,oCAAoC,EAAE;YACtC,IAAI,6BAA6B,EAAE,CAAC;IACtC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,OAAO,GAAiE,EAAE;IAE1E,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IAChE,MAAM,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC;IACxE,MAAM,qBAAqB,GAAG,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IAC5D,MAAM,uBAAuB,GAC3B,qBAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY,IAAI,MAAM,KAAK,YAAY,CAAC,CAAC;IAC1E,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,cAAc,GAA2B;QAC7C,CAAC,WAAW,CAAC,EAAE,2BAA2B;KAC3C,CAAC;IACF,IAAI,CAAC,gBAAgB,IAAI,qBAAqB,IAAI,aAAa,EAAE,CAAC;QAChE,cAAc,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACxD,CAAC;SAAM,IAAI,aAAa,EAAE,CAAC;QACzB,cAAc,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACxD,CAAC;SAAM,IAAI,CAAC,gBAAgB,IAAI,aAAa,EAAE,CAAC;QAC9C,cAAc,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,MAAM;QACN,MAAM;QACN,cAAc;KACf,CAAC,CAAC;IACH,OAAO,IAAI,8BAA8B,CAAC,MAAM,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAS3C;IACC,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,MAAM,EAAE,cAAc;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CACpB,MAA8B;IAE9B,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CACpB,KAA8B;IAE9B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,YAAY,KAAK,QAAQ;QAChC,OAAO,WAAW,KAAK,QAAQ;QAC/B,OAAO,WAAW,KAAK,QAAQ,EAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,MAAM;QACN,YAAY;QACZ,WAAW;QACX,WAAW;QACX,GAAG,CAAC,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;YACxC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE;YACtC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACrC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,QAAQ,EACN,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAChC,CAAC,CAAC,KAAK,CAAC,QAAQ;YAChB,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC9B,MAAM,EAAE,cAAc;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,MAAc,EACd,MAA8B,EAC9B,OAAgC;IAEhC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE;QACvB,MAAM;QACN,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,uBAAuB,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,8BAA8B,EAAE,CAAC;QACnE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;QACxC,IAAI,GAAG,GAAG,KAAK,CAAC,UAAU,GAAG,8BAA8B,EAAE,CAAC;YAC5D,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC,IAAI,GAAG,mCAAmC,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM;QACR,CAAC;QACD,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAC1B,CAAC,GAAG,4BAA4B,CAAC,EACjC,OAAO,CAAC,MAAM,CAAC,CAChB,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,aAAa,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,MAA8B;IAE9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,KAAK,CAAC,GAAG,CACb,CAAC,GAAG,4BAA4B,CAAC,EACjC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,aAAa,CAAC,MAAM,CAAC,CACtB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,MAAc;IAClD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,4BAA4B,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;AACH,CAAC"}

package/dist/identity/github/credentials.d.ts

@@ -1,87 +0,0 @@
-import type { CredentialResolverConfig, RuntimeIdentity } from "../types.js";
-/**
- * Credential source a GitHub resolver may try for a downstream API call.
- *
- * - `"user"` calls the user-supplied `resolveUserToken` hook, which defaults to
- *   the Connect-with-GitHub vault.
- * - `"installation"` mints a GitHub App installation token.
- * - `"pat"` uses a deployment-scoped personal access token.
- */
-export type GitHubTokenSource = "user" | "installation" | "pat";
-/** Arguments passed when GitHub credentials need a user-scoped OAuth token. */
-export interface GitHubUserTokenArgs {
-    /** The frozen identity envelope for the current run. */
-    identity: RuntimeIdentity;
-    /** OAuth scopes the helper needs for this GitHub operation. */
-    scopes: string[];
-}
-/** Arguments passed to a custom GitHub App JWT factory. */
-export interface GitHubAppJwtArgs {
-    /** GitHub App id used as the JWT issuer. */
-    appId: string;
-    /** PEM-encoded GitHub App private key. Keep this in deployment secrets. */
-    privateKey: string;
-}
-/** Options for {@link credentials}. */
-export interface GitHubCredentialsOptions {
-    /**
-     * Token sources to try for read intents. Defaults to
-     * `["installation", "pat"]`.
-     */
-    read?: GitHubTokenSource[];
-    /** Token sources to try for write intents. Defaults to `["user"]`. */
-    write?: GitHubTokenSource[];
-    /** GitHub App id. Falls back to `GITHUB_APP_ID`. */
-    appId?: string;
-    /** GitHub App private key. Falls back to `GITHUB_APP_PRIVATE_KEY`. */
-    privateKey?: string;
-    /**
-     * Default installation id when the target metadata does not provide
-     * `installationId`.
-     */
-    installationId?: string;
-    /** Deployment-scoped token. Falls back to `GITHUB_TOKEN` or `GITHUB_PAT`. */
-    pat?: string;
-    /**
-     * Allowed repositories for this resolver, as `owner/repo` or `owner/*`.
-     * When set, targets should include `metadata.repo` (or `owner` +
-     * `repository`). If omitted, the first exact `owner/repo` pattern is used as
-     * the default target (wildcard-only lists still require metadata).
-     */
-    repositories?: string[];
-    /**
-     * Hook that mints or retrieves the caller's GitHub OAuth token. Defaults to
-     * the Connect-with-GitHub credential vault (populated by
-     * `/identity/github/connect`). Supply a custom hook to override until
-     * managed Agent Auth lands.
-     */
-    resolveUserToken?: (args: GitHubUserTokenArgs) => Promise<string | undefined>;
-    /** Fetch implementation for GitHub App installation token exchange. */
-    fetch?: typeof fetch;
-    /** Test/custom hook for producing the GitHub App JWT. */
-    createAppJwt?: (args: GitHubAppJwtArgs) => Promise<string>;
-}
-/**
- * Build a custom credential resolver for GitHub connection targets.
- *
- * Use this through the GitHub namespace:
- *
- * ```ts
- * import { defineIdentity, github } from "managed-deepagents";
- *
- * export const identity = defineIdentity({
- *   credentials: credentials.github({ repositories: ["acme/*"] }),
- * });
- * ```
- *
- * When a chain reads user tokens from the managed vault, the returned config
- * declares Connect-with-GitHub so `defineIdentity` mounts `/identity/github/…`
- * without a separate `connect` entry.
- */
-export declare function credentials(options?: GitHubCredentialsOptions): CredentialResolverConfig;
-/**
- * Default user-token lookup: Connect-with-GitHub vault keyed by user id.
- * Returns undefined when the user has not connected GitHub yet.
- */
-export declare function defaultResolveUserToken(args: GitHubUserTokenArgs): Promise<string | undefined>;
-//# sourceMappingURL=credentials.d.ts.map

package/dist/identity/github/credentials.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/identity/github/credentials.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,wBAAwB,EAGxB,eAAe,EAChB,MAAM,aAAa,CAAC;AAErB;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,cAAc,GAAG,KAAK,CAAC;AAEhE,+EAA+E;AAC/E,MAAM,WAAW,mBAAmB;IAClC,wDAAwD;IACxD,QAAQ,EAAE,eAAe,CAAC;IAC1B,+DAA+D;IAC/D,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,uCAAuC;AACvC,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,IAAI,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC3B,sEAAsE;IACtE,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC5B,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC9E,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,yDAAyD;IACzD,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,gBAAgB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D;AAaD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CACzB,OAAO,GAAE,wBAA6B,GACrC,wBAAwB,CAgC1B;AAgJD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAK7B"}

package/dist/identity/github/credentials.js

@@ -1,201 +0,0 @@
-import { importPKCS8, SignJWT } from "jose";
-import { fetchWithTimeout, PROVIDER_HTTP_TIMEOUT_MS, } from "../../runtime/http.js";
-import { connect as githubConnect } from "./connect-http.js";
-import { getGitHubCredentialStore } from "./credentials-store.js";
-const DEFAULT_READ_CHAIN = ["installation", "pat"];
-const DEFAULT_WRITE_CHAIN = ["user"];
-const USER_TOKEN_SOURCES = ["user"];
-const GITHUB_API_VERSION = "2022-11-28";
-const USER_AGENT = "managed-deepagents";
-/**
- * Build a custom credential resolver for GitHub connection targets.
- *
- * Use this through the GitHub namespace:
- *
- * ```ts
- * import { defineIdentity, github } from "managed-deepagents";
- *
- * export const identity = defineIdentity({
- *   credentials: credentials.github({ repositories: ["acme/*"] }),
- * });
- * ```
- *
- * When a chain reads user tokens from the managed vault, the returned config
- * declares Connect-with-GitHub so `defineIdentity` mounts `/identity/github/…`
- * without a separate `connect` entry.
- */
-export function credentials(options = {}) {
-    validateGithubCredentialsOptions(options);
-    return {
-        ...(usesUserTokens(options) ? { connect: [githubConnect()] } : {}),
-        async resolve({ identity, target }) {
-            if (target.name !== "github") {
-                throw new Error(`credentials.github(...) can only resolve target name "github" (received "${target.name}").`);
-            }
-            const repo = repoFromTarget(target) ?? defaultRepoFromPatterns(options.repositories);
-            assertRepoAllowed(repo, options.repositories);
-            const chain = target.intent === "write"
-                ? (options.write ?? DEFAULT_WRITE_CHAIN)
-                : (options.read ?? DEFAULT_READ_CHAIN);
-            for (const source of chain) {
-                const credential = await resolveSource(source, { identity, target }, options);
-                if (credential) {
-                    return credential;
-                }
-            }
-            throw new Error(`credentials.github(...) could not resolve a GitHub credential for target "${target.name}".`);
-        },
-    };
-}
-/**
- * True when either chain can reach the per-user OAuth vault.
- *
- * A custom `resolveUserToken` hook replaces the vault, so a deployment that
- * supplies one owns its token source and needs no Connect-with-GitHub routes.
- */
-function usesUserTokens(options) {
-    if (options.resolveUserToken) {
-        return false;
-    }
-    const read = options.read ?? DEFAULT_READ_CHAIN;
-    const write = options.write ?? DEFAULT_WRITE_CHAIN;
-    return [...read, ...write].some((source) => USER_TOKEN_SOURCES.includes(source));
-}
-function validateGithubCredentialsOptions(options) {
-    validateChain("read", options.read);
-    validateChain("write", options.write);
-    if (options.repositories) {
-        for (const pattern of options.repositories) {
-            if (!isAllowedRepoPattern(pattern)) {
-                throw new Error(`credentials.github(...) repository allowlist entry "${pattern}" must look like "owner/repo" or "owner/*".`);
-            }
-        }
-    }
-}
-function validateChain(name, chain) {
-    if (chain === undefined)
-        return;
-    if (!Array.isArray(chain) || chain.length === 0) {
-        throw new Error(`credentials.github(...) \`${name}\` must be a non-empty token source list.`);
-    }
-    for (const source of chain) {
-        if (source !== "user" && source !== "installation" && source !== "pat") {
-            throw new Error(`credentials.github(...) unknown token source "${String(source)}".`);
-        }
-    }
-}
-async function resolveSource(source, ctx, options) {
-    if (source === "pat") {
-        const token = options.pat ?? process.env.GITHUB_TOKEN ?? process.env.GITHUB_PAT;
-        return token ? bearer(token) : undefined;
-    }
-    if (source === "user") {
-        const resolve = options.resolveUserToken ?? defaultResolveUserToken;
-        const token = await resolve({
-            identity: ctx.identity,
-            scopes: ["repo"],
-        });
-        return token ? bearer(token) : undefined;
-    }
-    return installationCredential(ctx.target, options);
-}
-async function installationCredential(target, options) {
-    const appId = options.appId ?? process.env.GITHUB_APP_ID;
-    const privateKey = options.privateKey ?? process.env.GITHUB_APP_PRIVATE_KEY;
-    const installationId = stringMetadata(target, "installationId") ?? options.installationId;
-    if (!installationId) {
-        return undefined;
-    }
-    if (!appId || !privateKey) {
-        throw new Error('credentials.github(...) token source "installation" requires `appId` and `privateKey` (or GITHUB_APP_ID / GITHUB_APP_PRIVATE_KEY).');
-    }
-    const appJwt = options.createAppJwt
-        ? await options.createAppJwt({ appId, privateKey })
-        : await createGitHubAppJwt({ appId, privateKey });
-    const fetchImpl = options.fetch ?? fetch;
-    const response = await fetchWithTimeout(`https://api.github.com/app/installations/${encodeURIComponent(installationId)}/access_tokens`, {
-        method: "POST",
-        headers: {
-            Accept: "application/vnd.github+json",
-            Authorization: `Bearer ${appJwt}`,
-            "User-Agent": USER_AGENT,
-            "X-GitHub-Api-Version": GITHUB_API_VERSION,
-        },
-    }, PROVIDER_HTTP_TIMEOUT_MS, fetchImpl);
-    if (!response.ok) {
-        throw new Error(`credentials.github(...) GitHub installation token request failed with ${response.status}.`);
-    }
-    const body = (await response.json());
-    if (typeof body.token !== "string" || body.token.length === 0) {
-        throw new Error("credentials.github(...) GitHub installation token response did not include `token`.");
-    }
-    return {
-        ...bearer(body.token),
-        ...(typeof body.expires_at === "string"
-            ? { expiresAt: body.expires_at }
-            : {}),
-    };
-}
-async function createGitHubAppJwt({ appId, privateKey, }) {
-    const nowSeconds = Math.floor(Date.now() / 1000);
-    const key = await importPKCS8(privateKey, "RS256");
-    return new SignJWT({})
-        .setProtectedHeader({ alg: "RS256" })
-        .setIssuedAt(nowSeconds - 60)
-        .setExpirationTime(nowSeconds + 9 * 60)
-        .setIssuer(appId)
-        .sign(key);
-}
-/**
- * Default user-token lookup: Connect-with-GitHub vault keyed by user id.
- * Returns undefined when the user has not connected GitHub yet.
- */
-export async function defaultResolveUserToken(args) {
-    const record = await getGitHubCredentialStore().getByUserId(args.identity.user.id);
-    return record?.accessToken;
-}
-function bearer(token) {
-    return { headers: { Authorization: `Bearer ${token}` } };
-}
-function repoFromTarget(target) {
-    const repo = stringMetadata(target, "repo");
-    if (repo)
-        return repo;
-    const owner = stringMetadata(target, "owner");
-    const name = stringMetadata(target, "repository");
-    return owner && name ? `${owner}/${name}` : undefined;
-}
-function stringMetadata(target, key) {
-    const value = target.metadata?.[key];
-    return typeof value === "string" && value.length > 0 ? value : undefined;
-}
-function assertRepoAllowed(repo, patterns) {
-    if (!patterns || patterns.length === 0)
-        return;
-    if (!repo) {
-        throw new Error("credentials.github(...) target metadata must include `repo` when repositories allowlist is configured (or include an exact owner/repo entry to default).");
-    }
-    if (!patterns.some((pattern) => repoMatches(repo, pattern))) {
-        throw new Error(`credentials.github(...) repository "${repo}" is not allowed by the configured repositories allowlist.`);
-    }
-}
-/** First exact `owner/repo` pattern, used when callers omit `metadata.repo`. */
-function defaultRepoFromPatterns(patterns) {
-    if (!patterns)
-        return undefined;
-    for (const pattern of patterns) {
-        if (!pattern.endsWith("/*"))
-            return pattern;
-    }
-    return undefined;
-}
-function repoMatches(repo, pattern) {
-    if (pattern.endsWith("/*")) {
-        return repo.startsWith(`${pattern.slice(0, -2)}/`);
-    }
-    return repo === pattern;
-}
-function isAllowedRepoPattern(pattern) {
-    return /^[A-Za-z0-9_.-]+\/(?:[A-Za-z0-9_.-]+|\*)$/.test(pattern);
-}
-//# sourceMappingURL=credentials.js.map

package/dist/identity/github/credentials.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/identity/github/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE5C,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AA+ElE,MAAM,kBAAkB,GAAwB,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;AACxE,MAAM,mBAAmB,GAAwB,CAAC,MAAM,CAAC,CAAC;AAC1D,MAAM,kBAAkB,GAAiC,CAAC,MAAM,CAAC,CAAC;AAClE,MAAM,kBAAkB,GAAG,YAAY,CAAC;AACxC,MAAM,UAAU,GAAG,oBAAoB,CAAC;AAExC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CACzB,OAAO,GAA6B,EAAE;IAEtC,gCAAgC,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE;YAChC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,4EAA4E,MAAM,CAAC,IAAI,KAAK,CAC7F,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GACR,cAAc,CAAC,MAAM,CAAC,IAAI,uBAAuB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC1E,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;YAC9C,MAAM,KAAK,GACT,MAAM,CAAC,MAAM,KAAK,OAAO;gBACvB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,mBAAmB,CAAC;gBACxC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAC,CAAC;YAC3C,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;gBAC3B,MAAM,UAAU,GAAG,MAAM,aAAa,CACpC,MAAM,EACN,EAAE,QAAQ,EAAE,MAAM,EAAE,EACpB,OAAO,CACR,CAAC;gBACF,IAAI,UAAU,EAAE,CAAC;oBACf,OAAO,UAAU,CAAC;gBACpB,CAAC;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CACb,6EAA6E,MAAM,CAAC,IAAI,IAAI,CAC7F,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAiC;IACvD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAC;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,mBAAmB,CAAC;IACnD,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACzC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,OAAiC;IAEjC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YAC3C,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,uDAAuD,OAAO,6CAA6C,CAC5G,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAsB,EAAE,KAAc;IAC3D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,2CAA2C,CAC7E,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3B,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,cAAc,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CACb,iDAAiD,MAAM,CAAC,MAAM,CAAC,IAAI,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,MAAyB,EACzB,GAA4B,EAC5B,OAAiC;IAEjC,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,KAAK,GACT,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACpE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3C,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,IAAI,uBAAuB,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;YAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,CAAC,MAAM,CAAC;SACjB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3C,CAAC;IACD,OAAO,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAAwB,EACxB,OAAiC;IAEjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACzD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC5E,MAAM,cAAc,GAClB,cAAc,CAAC,MAAM,EAAE,gBAAgB,CAAC,IAAI,OAAO,CAAC,cAAc,CAAC;IACrE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,oIAAoI,CACrI,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY;QACjC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACnD,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,4CAA4C,kBAAkB,CAC5D,cAAc,CACf,gBAAgB,EACjB;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,6BAA6B;YACrC,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,YAAY,EAAE,UAAU;YACxB,sBAAsB,EAAE,kBAAkB;SAC3C;KACF,EACD,wBAAwB,EACxB,SAAS,CACV,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,yEAAyE,QAAQ,CAAC,MAAM,GAAG,CAC5F,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAC;IACF,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QACrB,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;YACrC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE;YAChC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,EAChC,KAAK,EACL,UAAU,GACO;IACjB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACnD,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;SACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,CAAC,UAAU,GAAG,EAAE,CAAC;SAC5B,iBAAiB,CAAC,UAAU,GAAG,CAAC,GAAG,EAAE,CAAC;SACtC,SAAS,CAAC,KAAK,CAAC;SAChB,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,wBAAwB,EAAE,CAAC,WAAW,CACzD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CACtB,CAAC;IACF,OAAO,MAAM,EAAE,WAAW,CAAC;AAC7B,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,cAAc,CAAC,MAAwB;IAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAClD,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CACrB,MAAwB,EACxB,GAAW;IAEX,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAwB,EACxB,QAA8B;IAE9B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,0JAA0J,CAC3J,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,4DAA4D,CACxG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,uBAAuB,CAC9B,QAA8B;IAE9B,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,OAAe;IAChD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,KAAK,OAAO,CAAC;AAC1B,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe;IAC3C,OAAO,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACnE,CAAC"}

package/dist/identity/github/index.d.ts

@@ -1,7 +0,0 @@
-/**
- * GitHub identity helpers — credentials resolver + Connect-with-GitHub opt-in.
- */
-export { credentials, type GitHubUserTokenArgs, type GitHubAppJwtArgs, type GitHubCredentialsOptions, type GitHubTokenSource, } from "./credentials.js";
-export { connect, createGitHubIdentityConnectProvider, githubIdentityConnectProvider, GITHUB_CONNECT_CALLBACK_PATH, GITHUB_CONNECT_LINK_PATH, GITHUB_CONNECT_START_PATH, GITHUB_CONNECT_STATUS_PATH, } from "./connect-http.js";
-export type { GitHubIdentityConnectProviderOptions } from "./connect-http.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/identity/github/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/github/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,OAAO,EACP,mCAAmC,EACnC,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,oCAAoC,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/identity/github/index.js

@@ -1,6 +0,0 @@
-/**
- * GitHub identity helpers — credentials resolver + Connect-with-GitHub opt-in.
- */
-export { credentials, } from "./credentials.js";
-export { connect, createGitHubIdentityConnectProvider, githubIdentityConnectProvider, GITHUB_CONNECT_CALLBACK_PATH, GITHUB_CONNECT_LINK_PATH, GITHUB_CONNECT_START_PATH, GITHUB_CONNECT_STATUS_PATH, } from "./connect-http.js";
-//# sourceMappingURL=index.js.map

package/dist/identity/github/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/github/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,GAKZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,OAAO,EACP,mCAAmC,EACnC,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC"}

package/dist/identity/github/oauth.d.ts

@@ -1,47 +0,0 @@
-/**
- * GitHub OAuth helpers for Connect-with-GitHub credential binding.
- *
- * Unlike Slack Connect (channel identity remap only), GitHub Connect stores a
- * per-actor OAuth access token so `credentials.github({ write: ["actor"] })`
- * can act as the signed-in user (e.g. open pull requests).
- *
- * Implemented as a {@link createByoOauthClient} descriptor with GitHub-specific
- * token (JSON body) and userinfo (API headers) quirks.
- */
-import { type ByoOauthClient, type ByoOauthConfig } from "../byo-oauth.js";
-export declare const GITHUB_CLIENT_ID_ENV = "GITHUB_CLIENT_ID";
-export declare const GITHUB_CLIENT_SECRET_ENV = "GITHUB_CLIENT_SECRET";
-/** Space-separated OAuth scopes. Defaults to `repo read:user`. */
-export declare const GITHUB_OAUTH_SCOPES_ENV = "GITHUB_OAUTH_SCOPES";
-/** Override GitHub OAuth/API base (tests). */
-export declare const GITHUB_OAUTH_BASE_ENV = "GITHUB_OAUTH_BASE";
-export type GitHubOauthConfig = ByoOauthConfig;
-export interface GitHubOauthTokenResult {
-    accessToken: string;
-    tokenType?: string;
-    scope?: string;
-    refreshToken?: string;
-    userId: string;
-    login: string;
-    email?: string;
-}
-/** GitHub BYO OAuth client (config, authorize, exchange). */
-export declare const githubByoOauth: ByoOauthClient;
-/** GitHub-bound OAuth state / connect-ticket helpers. */
-export declare const githubOauthTickets: import("../oauth-tickets.js").OauthTickets;
-export declare const resolveGitHubOauthRedirectBase: typeof import("../oauth-env.js").resolveOauthRedirectBase;
-/**
- * Requires `MDA_PUBLIC_APP_URL` — unlike Fleet BYO readers, do not fall back
- * to `MDA_PUBLIC_API_URL`; post-OAuth redirect targets the managed app
- * (`/settings?github=connected`).
- */
-export declare function readGitHubOauthConfig(env?: NodeJS.ProcessEnv): GitHubOauthConfig | null;
-export declare const buildGitHubAuthorizeUrl: (config: ByoOauthConfig, state: string, redirectUri: string, scopes?: string) => string;
-/**
- * Exchange an authorization code for a user access token and profile.
- *
- * GitHub returns `application/x-www-form-urlencoded` unless `Accept:
- * application/json` is set — handled by the BYO tokenRequest config.
- */
-export declare function exchangeGitHubOauthCode(config: GitHubOauthConfig, code: string, redirectUri: string, fetchImpl?: typeof fetch): Promise<GitHubOauthTokenResult>;
-//# sourceMappingURL=oauth.d.ts.map