managed-deepagents 0.5.3-dev.112 → 0.5.3-dev.113

package/dist/identity/credential-resolvers.js

@@ -1,31 +0,0 @@
-/**
- * Shape helpers for the two `credentials` forms, shared by authoring validation,
- * normalization, and the runtime resolver so all three agree on which form a
- * config is.
- *
- * A single resolver handles every target itself. A per-target map lets one
- * deployment integrate several platforms without hand-writing the dispatch.
- */
-/**
- * True when `value` is a single {@link CredentialResolverConfig} rather than a
- * per-target map.
- *
- * Discriminates on the *type* of `resolve`/`endpoint`, not merely their
- * presence, so a target legitimately named `"resolve"` or `"endpoint"` in a map
- * is not mistaken for the single form.
- */
-export function isSingleCredentialResolver(value) {
-    const candidate = value;
-    if (typeof candidate.resolve === "function") {
-        return true;
-    }
-    const endpoint = candidate.endpoint;
-    return (typeof endpoint === "object" &&
-        endpoint !== null &&
-        typeof endpoint.url === "string");
-}
-/** The target names a per-target map resolves, in declaration order. */
-export function credentialTargetNames(value) {
-    return isSingleCredentialResolver(value) ? [] : Object.keys(value);
-}
-//# sourceMappingURL=credential-resolvers.js.map

package/dist/identity/credential-resolvers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-resolvers.js","sourceRoot":"","sources":["../../src/identity/credential-resolvers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAqD;IAErD,MAAM,SAAS,GAAG,KAAkD,CAAC;IACrE,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;IACpC,OAAO,CACL,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,KAAK,IAAI;QACjB,OAAQ,QAA8B,CAAC,GAAG,KAAK,QAAQ,CACxD,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,qBAAqB,CACnC,KAAqD;IAErD,OAAO,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC"}

package/dist/identity/github/credentials-store.d.ts

@@ -1,76 +0,0 @@
-/**
- * Per-actor GitHub OAuth credential vault.
- *
- * Stored in the LangGraph Store under `["mda_github_credentials"]`.
- * `credentials.github` resolves `actor` tokens from here until managed Agent
- * Auth lands.
- *
- * Tokens are deployment-scoped Store values — treat the Store namespace as
- * sensitive and prefer short-lived OAuth tokens / refresh where available.
- *
- * Reads always consult the shared Store first (in-graph {@link getStore}, then
- * the service-principal HTTP client). A small process cache is only a
- * write-through fallback for the Host quirk where loopback `get` can miss
- * right after a successful `put` on the same worker — never an authority that
- * can outlive an unlink/rotate on another worker.
- */
-import { Client } from "@langchain/langgraph-sdk";
-import { GITHUB_CREDENTIALS_STORE_PREFIX } from "../../runtime/auth.js";
-export { GITHUB_CREDENTIALS_STORE_PREFIX };
-export declare const GITHUB_CREDENTIALS_NAMESPACE: readonly ["mda_github_credentials"];
-/** How long a same-worker write-through entry may survive a Store miss. */
-export declare const GITHUB_CREDENTIAL_CACHE_TTL_MS = 30000;
-/** Soft cap on cached GitHub credential records per process. */
-export declare const GITHUB_CREDENTIAL_CACHE_MAX_ENTRIES = 256;
-export interface GitHubCredentialRecord {
-    userId: string;
-    githubUserId: string;
-    githubLogin: string;
-    accessToken: string;
-    refreshToken?: string;
-    tokenType?: string;
-    scope?: string;
-    email?: string;
-    linkedAt: string;
-    source: "github_oauth";
-}
-export interface GitHubCredentialStore {
-    getByUserId(userId: string): Promise<GitHubCredentialRecord | null>;
-    upsert(record: GitHubCredentialRecord): Promise<void>;
-    removeByUserId(userId: string): Promise<void>;
-}
-/** In-memory store for tests. */
-export declare class InMemoryGitHubCredentialStore implements GitHubCredentialStore {
-    private readonly byUser;
-    getByUserId(userId: string): Promise<GitHubCredentialRecord | null>;
-    upsert(record: GitHubCredentialRecord): Promise<void>;
-    removeByUserId(userId: string): Promise<void>;
-}
-/** LangGraph Store–backed GitHub credential vault. */
-export declare class LangGraphGitHubCredentialStore implements GitHubCredentialStore {
-    private readonly client;
-    constructor(client: Client);
-    getByUserId(userId: string): Promise<GitHubCredentialRecord | null>;
-    upsert(record: GitHubCredentialRecord): Promise<void>;
-    removeByUserId(userId: string): Promise<void>;
-}
-/** Override the process-default credential store (tests). */
-export declare function setGitHubCredentialStore(store: GitHubCredentialStore | null): void;
-/** Resolve the process-default credential store. */
-export declare function getGitHubCredentialStore(): GitHubCredentialStore;
-export declare function createLangGraphGitHubCredentialStore(options?: {
-    apiUrl?: string;
-    apiKey?: string;
-    ingressSecret?: string;
-}): LangGraphGitHubCredentialStore | null;
-export declare function buildGitHubCredentialRecord(input: {
-    userId: string;
-    githubUserId: string;
-    githubLogin: string;
-    accessToken: string;
-    refreshToken?: string;
-    tokenType?: string;
-    scope?: string;
-    email?: string;
-}): GitHubCredentialRecord;
-//# sourceMappingURL=credentials-store.d.ts.map

package/dist/identity/github/credentials-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials-store.d.ts","sourceRoot":"","sources":["../../../src/identity/github/credentials-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAElD,OAAO,EAIL,+BAA+B,EAKhC,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EAAE,+BAA+B,EAAE,CAAC;AAC3C,eAAO,MAAM,4BAA4B,qCAE/B,CAAC;AAEX,2EAA2E;AAC3E,eAAO,MAAM,8BAA8B,QAAS,CAAC;AACrD,gEAAgE;AAChE,eAAO,MAAM,mCAAmC,MAAM,CAAC;AAEvD,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACpE,MAAM,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAgBD,iCAAiC;AACjC,qBAAa,6BAA8B,YAAW,qBAAqB;IACzE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;IAE9D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAExE;IAEK,MAAM,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAEK,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElD;CACF;AAED,sDAAsD;AACtD,qBAAa,8BAA+B,YAAW,qBAAqB;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAEzC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CA0CxE;IAEK,MAAM,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ1D;IAEK,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOlD;CACF;AAID,6DAA6D;AAC7D,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,qBAAqB,GAAG,IAAI,GAClC,IAAI,CAGN;AAED,oDAAoD;AACpD,wBAAgB,wBAAwB,IAAI,qBAAqB,CAQhE;AAED,wBAAgB,oCAAoC,CAClD,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACzE,8BAA8B,GAAG,IAAI,CA+BvC;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,sBAAsB,CAazB"}

package/dist/identity/github/credentials-store.js

@@ -1,270 +0,0 @@
-/**
- * Per-actor GitHub OAuth credential vault.
- *
- * Stored in the LangGraph Store under `["mda_github_credentials"]`.
- * `credentials.github` resolves `actor` tokens from here until managed Agent
- * Auth lands.
- *
- * Tokens are deployment-scoped Store values — treat the Store namespace as
- * sensitive and prefer short-lived OAuth tokens / refresh where available.
- *
- * Reads always consult the shared Store first (in-graph {@link getStore}, then
- * the service-principal HTTP client). A small process cache is only a
- * write-through fallback for the Host quirk where loopback `get` can miss
- * right after a successful `put` on the same worker — never an authority that
- * can outlive an unlink/rotate on another worker.
- */
-import { getStore } from "@langchain/langgraph";
-import { Client } from "@langchain/langgraph-sdk";
-import { HANDOFF_SECRET_ENV, HANDOFF_SECRET_HEADER, USER_HEADER, GITHUB_CREDENTIALS_STORE_PREFIX, IDENTITY_LINKS_SERVICE_USER, INGRESS_SECRET_ENV, INGRESS_SECRET_HEADER, LANGSMITH_API_KEY_ENV, } from "../../runtime/auth.js";
-import { isLoopbackUrl, resolveLoopbackApiKey, resolveLoopbackApiUrl, } from "../loopback.js";
-export { GITHUB_CREDENTIALS_STORE_PREFIX };
-export const GITHUB_CREDENTIALS_NAMESPACE = [
-    GITHUB_CREDENTIALS_STORE_PREFIX,
-];
-/** How long a same-worker write-through entry may survive a Store miss. */
-export const GITHUB_CREDENTIAL_CACHE_TTL_MS = 30_000;
-/** Soft cap on cached GitHub credential records per process. */
-export const GITHUB_CREDENTIAL_CACHE_MAX_ENTRIES = 256;
-/** Bounded write-through cache shared by LangGraph-backed stores. */
-const processCache = new Map();
-/** In-memory store for tests. */
-export class InMemoryGitHubCredentialStore {
-    byUser = new Map();
-    async getByUserId(userId) {
-        return this.byUser.get(userId) ?? null;
-    }
-    async upsert(record) {
-        this.byUser.set(record.userId, record);
-    }
-    async removeByUserId(userId) {
-        this.byUser.delete(userId);
-    }
-}
-/** LangGraph Store–backed GitHub credential vault. */
-export class LangGraphGitHubCredentialStore {
-    client;
-    constructor(client) {
-        this.client = client;
-    }
-    async getByUserId(userId) {
-        const fromGraph = await readFromAmbientStore(userId);
-        if (fromGraph) {
-            rememberCache(userId, fromGraph, { localWrite: false });
-            return fromGraph;
-        }
-        let storeMiss = false;
-        let storeUnavailable = false;
-        try {
-            const item = await this.client.store.getItem([...GITHUB_CREDENTIALS_NAMESPACE], userKey(userId));
-            if (item?.value && typeof item.value === "object") {
-                const record = valueToRecord(item.value);
-                if (record) {
-                    rememberCache(userId, record, { localWrite: false });
-                    return record;
-                }
-            }
-            storeMiss = true;
-        }
-        catch {
-            storeUnavailable = true;
-        }
-        const cached = liveCacheEntry(userId);
-        if (cached) {
-            if (storeUnavailable) {
-                return cached.record;
-            }
-            if (storeMiss && cached.localWrite) {
-                // Same-worker Host quirk: put succeeded, loopback get returned empty.
-                return cached.record;
-            }
-        }
-        if (storeMiss) {
-            // Authoritative miss — honor unlink/rotate from another worker.
-            processCache.delete(userId);
-        }
-        return null;
-    }
-    async upsert(record) {
-        await this.client.store.putItem([...GITHUB_CREDENTIALS_NAMESPACE], userKey(record.userId), recordToValue(record));
-        rememberCache(record.userId, record, { localWrite: true });
-        await writeToAmbientStore(record);
-    }
-    async removeByUserId(userId) {
-        processCache.delete(userId);
-        await this.client.store.deleteItem([...GITHUB_CREDENTIALS_NAMESPACE], userKey(userId));
-        await deleteFromAmbientStore(userId);
-    }
-}
-let defaultStore = null;
-/** Override the process-default credential store (tests). */
-export function setGitHubCredentialStore(store) {
-    defaultStore = store;
-    processCache.clear();
-}
-/** Resolve the process-default credential store. */
-export function getGitHubCredentialStore() {
-    if (defaultStore) {
-        return defaultStore;
-    }
-    defaultStore =
-        createLangGraphGitHubCredentialStore() ??
-            new InMemoryGitHubCredentialStore();
-    return defaultStore;
-}
-export function createLangGraphGitHubCredentialStore(options = {}) {
-    const serverApiKey = process.env[LANGSMITH_API_KEY_ENV]?.trim();
-    const configuredHandoffSecret = process.env[HANDOFF_SECRET_ENV]?.trim();
-    const explicitIngressSecret = options.ingressSecret?.trim();
-    const configuredIngressSecret = explicitIngressSecret || process.env[INGRESS_SECRET_ENV]?.trim();
-    const apiUrl = resolveLoopbackApiUrl(options.apiUrl);
-    const apiKey = resolveLoopbackApiKey(options.apiKey);
-    const isLocal = isLoopbackUrl(apiUrl);
-    const handoffSecret = isLocal ? configuredHandoffSecret : undefined;
-    const ingressSecret = isLocal ? configuredIngressSecret : undefined;
-    const usesServerApiKey = Boolean(serverApiKey && apiKey === serverApiKey);
-    if (!usesServerApiKey && !handoffSecret && !ingressSecret) {
-        return null;
-    }
-    const defaultHeaders = {
-        [USER_HEADER]: IDENTITY_LINKS_SERVICE_USER,
-    };
-    if (!usesServerApiKey && explicitIngressSecret && ingressSecret) {
-        defaultHeaders[INGRESS_SECRET_HEADER] = ingressSecret;
-    }
-    else if (handoffSecret) {
-        defaultHeaders[HANDOFF_SECRET_HEADER] = handoffSecret;
-    }
-    else if (!usesServerApiKey && ingressSecret) {
-        defaultHeaders[INGRESS_SECRET_HEADER] = ingressSecret;
-    }
-    const client = new Client({
-        apiUrl,
-        apiKey,
-        defaultHeaders,
-    });
-    return new LangGraphGitHubCredentialStore(client);
-}
-export function buildGitHubCredentialRecord(input) {
-    return {
-        userId: input.userId,
-        githubUserId: input.githubUserId,
-        githubLogin: input.githubLogin,
-        accessToken: input.accessToken,
-        ...(input.refreshToken ? { refreshToken: input.refreshToken } : {}),
-        ...(input.tokenType ? { tokenType: input.tokenType } : {}),
-        ...(input.scope ? { scope: input.scope } : {}),
-        ...(input.email ? { email: input.email } : {}),
-        linkedAt: new Date().toISOString(),
-        source: "github_oauth",
-    };
-}
-function userKey(userId) {
-    return `actor:${userId}`;
-}
-function recordToValue(record) {
-    return { ...record };
-}
-function valueToRecord(value) {
-    const userId = value.userId;
-    const githubUserId = value.githubUserId;
-    const githubLogin = value.githubLogin;
-    const accessToken = value.accessToken;
-    if (typeof userId !== "string" ||
-        typeof githubUserId !== "string" ||
-        typeof githubLogin !== "string" ||
-        typeof accessToken !== "string") {
-        return null;
-    }
-    return {
-        userId,
-        githubUserId,
-        githubLogin,
-        accessToken,
-        ...(typeof value.refreshToken === "string"
-            ? { refreshToken: value.refreshToken }
-            : {}),
-        ...(typeof value.tokenType === "string"
-            ? { tokenType: value.tokenType }
-            : {}),
-        ...(typeof value.scope === "string" ? { scope: value.scope } : {}),
-        ...(typeof value.email === "string" ? { email: value.email } : {}),
-        linkedAt: typeof value.linkedAt === "string"
-            ? value.linkedAt
-            : new Date().toISOString(),
-        source: "github_oauth",
-    };
-}
-function rememberCache(userId, record, options) {
-    processCache.set(userId, {
-        record,
-        cachedAtMs: Date.now(),
-        localWrite: options.localWrite,
-    });
-    evictExpiredAndOverflow();
-}
-function liveCacheEntry(userId) {
-    const entry = processCache.get(userId);
-    if (!entry) {
-        return undefined;
-    }
-    if (Date.now() - entry.cachedAtMs > GITHUB_CREDENTIAL_CACHE_TTL_MS) {
-        processCache.delete(userId);
-        return undefined;
-    }
-    return entry;
-}
-function evictExpiredAndOverflow() {
-    const now = Date.now();
-    for (const [key, entry] of processCache) {
-        if (now - entry.cachedAtMs > GITHUB_CREDENTIAL_CACHE_TTL_MS) {
-            processCache.delete(key);
-        }
-    }
-    while (processCache.size > GITHUB_CREDENTIAL_CACHE_MAX_ENTRIES) {
-        const oldest = processCache.keys().next().value;
-        if (oldest === undefined) {
-            break;
-        }
-        processCache.delete(oldest);
-    }
-}
-async function readFromAmbientStore(userId) {
-    try {
-        const store = getStore();
-        if (!store)
-            return null;
-        const item = await store.get([...GITHUB_CREDENTIALS_NAMESPACE], userKey(userId));
-        if (!item?.value || typeof item.value !== "object") {
-            return null;
-        }
-        return valueToRecord(item.value);
-    }
-    catch {
-        // Outside a runnable context (for example, unit tests).
-        return null;
-    }
-}
-async function writeToAmbientStore(record) {
-    try {
-        const store = getStore();
-        if (!store)
-            return;
-        await store.put([...GITHUB_CREDENTIALS_NAMESPACE], userKey(record.userId), recordToValue(record));
-    }
-    catch {
-        // Best-effort; HTTP put already persisted.
-    }
-}
-async function deleteFromAmbientStore(userId) {
-    try {
-        const store = getStore();
-        if (!store)
-            return;
-        await store.delete([...GITHUB_CREDENTIALS_NAMESPACE], userKey(userId));
-    }
-    catch {
-        // Best-effort.
-    }
-}
-//# sourceMappingURL=credentials-store.js.map

package/dist/identity/github/credentials-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials-store.js","sourceRoot":"","sources":["../../../src/identity/github/credentials-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAElD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,WAAW,EACX,+BAA+B,EAC/B,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,+BAA+B,EAAE,CAAC;AAC3C,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,+BAA+B;CACvB,CAAC;AAEX,2EAA2E;AAC3E,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC;AACrD,gEAAgE;AAChE,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AAgCvD,qEAAqE;AACrE,MAAM,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;AAE1D,iCAAiC;AACjC,MAAM,OAAO,6BAA6B;IACvB,MAAM,GAAG,IAAI,GAAG,EAAkC,CAAC;IAEpE,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA8B;QACzC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;CACF;AAED,sDAAsD;AACtD,MAAM,OAAO,8BAA8B;IACZ,MAAM;IAAnC,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,SAAS,EAAE,CAAC;YACd,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;YACxD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,gBAAgB,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAC1C,CAAC,GAAG,4BAA4B,CAAC,EACjC,OAAO,CAAC,MAAM,CAAC,CAChB,CAAC;YACF,IAAI,IAAI,EAAE,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAClD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC;gBACpE,IAAI,MAAM,EAAE,CAAC;oBACX,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;oBACrD,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC;YACD,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,gBAAgB,EAAE,CAAC;gBACrB,OAAO,MAAM,CAAC,MAAM,CAAC;YACvB,CAAC;YACD,IAAI,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACnC,sEAAsE;gBACtE,OAAO,MAAM,CAAC,MAAM,CAAC;YACvB,CAAC;QACH,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,gEAAgE;YAChE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA8B;QACzC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAC7B,CAAC,GAAG,4BAA4B,CAAC,EACjC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,aAAa,CAAC,MAAM,CAAC,CACtB,CAAC;QACF,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAChC,CAAC,GAAG,4BAA4B,CAAC,EACjC,OAAO,CAAC,MAAM,CAAC,CAChB,CAAC;QACF,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;CACF;AAED,IAAI,YAAY,GAAiC,IAAI,CAAC;AAEtD,6DAA6D;AAC7D,MAAM,UAAU,wBAAwB,CACtC,KAAmC;IAEnC,YAAY,GAAG,KAAK,CAAC;IACrB,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,wBAAwB;IACtC,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,YAAY;QACV,oCAAoC,EAAE;YACtC,IAAI,6BAA6B,EAAE,CAAC;IACtC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,OAAO,GAAiE,EAAE;IAE1E,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IAChE,MAAM,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC;IACxE,MAAM,qBAAqB,GAAG,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IAC5D,MAAM,uBAAuB,GAC3B,qBAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY,IAAI,MAAM,KAAK,YAAY,CAAC,CAAC;IAC1E,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,cAAc,GAA2B;QAC7C,CAAC,WAAW,CAAC,EAAE,2BAA2B;KAC3C,CAAC;IACF,IAAI,CAAC,gBAAgB,IAAI,qBAAqB,IAAI,aAAa,EAAE,CAAC;QAChE,cAAc,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACxD,CAAC;SAAM,IAAI,aAAa,EAAE,CAAC;QACzB,cAAc,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACxD,CAAC;SAAM,IAAI,CAAC,gBAAgB,IAAI,aAAa,EAAE,CAAC;QAC9C,cAAc,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,MAAM;QACN,MAAM;QACN,cAAc;KACf,CAAC,CAAC;IACH,OAAO,IAAI,8BAA8B,CAAC,MAAM,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAS3C;IACC,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,MAAM,EAAE,cAAc;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CACpB,MAA8B;IAE9B,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CACpB,KAA8B;IAE9B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,YAAY,KAAK,QAAQ;QAChC,OAAO,WAAW,KAAK,QAAQ;QAC/B,OAAO,WAAW,KAAK,QAAQ,EAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,MAAM;QACN,YAAY;QACZ,WAAW;QACX,WAAW;QACX,GAAG,CAAC,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;YACxC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE;YACtC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACrC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;YAChC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,QAAQ,EACN,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAChC,CAAC,CAAC,KAAK,CAAC,QAAQ;YAChB,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC9B,MAAM,EAAE,cAAc;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,MAAc,EACd,MAA8B,EAC9B,OAAgC;IAEhC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE;QACvB,MAAM;QACN,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,uBAAuB,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,8BAA8B,EAAE,CAAC;QACnE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;QACxC,IAAI,GAAG,GAAG,KAAK,CAAC,UAAU,GAAG,8BAA8B,EAAE,CAAC;YAC5D,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC,IAAI,GAAG,mCAAmC,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM;QACR,CAAC;QACD,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAC1B,CAAC,GAAG,4BAA4B,CAAC,EACjC,OAAO,CAAC,MAAM,CAAC,CAChB,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,aAAa,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,MAA8B;IAE9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,KAAK,CAAC,GAAG,CACb,CAAC,GAAG,4BAA4B,CAAC,EACjC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,aAAa,CAAC,MAAM,CAAC,CACtB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,MAAc;IAClD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,4BAA4B,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;AACH,CAAC"}

package/dist/identity/github/credentials.d.ts

@@ -1,85 +0,0 @@
-import type { CredentialResolverConfig, RuntimeIdentity } from "../types.js";
-/**
- * Credential source a GitHub resolver may try for a downstream API call.
- *
- * - `"user"` calls the user-supplied `resolveUserToken` hook, which defaults to
- *   the GitHub credential store.
- * - `"installation"` mints a GitHub App installation token.
- * - `"pat"` uses a deployment-scoped personal access token.
- */
-export type GitHubTokenSource = "user" | "installation" | "pat";
-/** Arguments passed when GitHub credentials need a user-scoped OAuth token. */
-export interface GitHubUserTokenArgs {
-    /** The frozen identity envelope for the current run. */
-    identity: RuntimeIdentity;
-    /** OAuth scopes the helper needs for this GitHub operation. */
-    scopes: string[];
-}
-/** Arguments passed to a custom GitHub App JWT factory. */
-export interface GitHubAppJwtArgs {
-    /** GitHub App id used as the JWT issuer. */
-    appId: string;
-    /** PEM-encoded GitHub App private key. Keep this in deployment secrets. */
-    privateKey: string;
-}
-/** Options for {@link credentials}. */
-export interface GitHubCredentialsOptions {
-    /**
-     * Token sources to try for read intents. Defaults to
-     * `["installation", "pat"]`.
-     */
-    read?: GitHubTokenSource[];
-    /** Token sources to try for write intents. Defaults to `["user"]`. */
-    write?: GitHubTokenSource[];
-    /** GitHub App id. Falls back to `GITHUB_APP_ID`. */
-    appId?: string;
-    /** GitHub App private key. Falls back to `GITHUB_APP_PRIVATE_KEY`. */
-    privateKey?: string;
-    /**
-     * Default installation id when the target metadata does not provide
-     * `installationId`.
-     */
-    installationId?: string;
-    /** Deployment-scoped token. Falls back to `GITHUB_TOKEN` or `GITHUB_PAT`. */
-    pat?: string;
-    /**
-     * Allowed repositories for this resolver, as `owner/repo` or `owner/*`.
-     * When set, targets should include `metadata.repo` (or `owner` +
-     * `repository`). If omitted, the first exact `owner/repo` pattern is used as
-     * the default target (wildcard-only lists still require metadata).
-     */
-    repositories?: string[];
-    /**
-     * Hook that mints or retrieves the caller's GitHub OAuth token. Defaults to
-     * the GitHub credential store. Supply a custom hook to override until managed
-     * Agent Auth lands.
-     */
-    resolveUserToken?: (args: GitHubUserTokenArgs) => Promise<string | undefined>;
-    /** Fetch implementation for GitHub App installation token exchange. */
-    fetch?: typeof fetch;
-    /** Test/custom hook for producing the GitHub App JWT. */
-    createAppJwt?: (args: GitHubAppJwtArgs) => Promise<string>;
-}
-/**
- * Build a custom credential resolver for GitHub connection targets.
- *
- * Use this through the GitHub namespace:
- *
- * ```ts
- * import { defineIdentity, github } from "managed-deepagents";
- *
- * export const identity = defineIdentity({
- *   credentials: credentials.github({ repositories: ["acme/*"] }),
- * });
- * ```
- *
- * User-token chains read from `resolveUserToken`, which defaults to the GitHub
- * credential store.
- */
-export declare function credentials(options?: GitHubCredentialsOptions): CredentialResolverConfig;
-/**
- * Default user-token lookup: GitHub credential store keyed by user id.
- * Returns undefined when no stored GitHub token exists for the user.
- */
-export declare function defaultResolveUserToken(args: GitHubUserTokenArgs): Promise<string | undefined>;
-//# sourceMappingURL=credentials.d.ts.map

package/dist/identity/github/credentials.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/identity/github/credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,wBAAwB,EAGxB,eAAe,EAChB,MAAM,aAAa,CAAC;AAErB;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,cAAc,GAAG,KAAK,CAAC;AAEhE,+EAA+E;AAC/E,MAAM,WAAW,mBAAmB;IAClC,wDAAwD;IACxD,QAAQ,EAAE,eAAe,CAAC;IAC1B,+DAA+D;IAC/D,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,uCAAuC;AACvC,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,IAAI,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC3B,sEAAsE;IACtE,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC5B,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC9E,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,yDAAyD;IACzD,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,gBAAgB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D;AAYD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CACzB,OAAO,GAAE,wBAA6B,GACrC,wBAAwB,CA+B1B;AA+HD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAK7B"}