Consume @corbits/oauth-core from a pinned git tag

apps/hub/src/credential-material-refresh.ts

@@ -5,7 +5,7 @@
 // point: ahead of every send, `createTenantServingRefresh` refreshes each
 // due `oauth_token` credential in the tenant — via the connections token
 // session (`@corbits/connections`'s `createCredentialTokenSession`, over
-// the vendored `@corbits/oauth-core`), coalesced and skew-aware — and the
+// `@corbits/oauth-core`), coalesced and skew-aware — and the
 // refreshed material reaches running deployments through the existing
 // `credentials-updated` push (`pushSourceUpdates` → `sendCredentialsUpdate`).
 // The existing MCP expiry sweep keeps running as the background backstop
@@ -235,7 +235,7 @@ export function createServingRefresh(deps: ServingRefreshDeps): ServingRefresh {
             ? {}
             : { refreshSecret: refreshed.refreshToken }),
           // No `expires_in` stated: persist a NULL expiry — non-due, per
-          // the vendored oauth-core stance. Never a short artificial
+          // the oauth-core stance. Never a short artificial
           // timer that would re-refresh on every dial.
           expiresAt:
             refreshed.expiresIn === undefined

packages/connections/package.json

@@ -31,19 +31,19 @@
   },
   "dependencies": {
     "@corbits/code-review": "workspace:*",
-    "@corbits/oauth-core": "workspace:*",
     "@corbits/credential-providers": "workspace:*",
     "@corbits/error-sink": "workspace:*",
     "@corbits/github-tools": "workspace:*",
+    "@corbits/hub-api-client": "workspace:*",
     "@corbits/inference-settings": "workspace:*",
     "@corbits/mcp-tools": "workspace:*",
+    "@corbits/oauth-core": "github:corbitsdev/corbits-oauth-core#v0.1.1",
+    "@corbits/seeding": "workspace:*",
     "@intx/crypto": "0.3.0",
     "@intx/db": "workspace:*",
     "@intx/hub-api": "workspace:*",
     "@intx/types": "workspace:*",
     "@modelcontextprotocol/sdk": "catalog:",
-    "@corbits/hub-api-client": "workspace:*",
-    "@corbits/seeding": "workspace:*",
     "arktype": "catalog:",
     "drizzle-orm": "catalog:",
     "hono": "catalog:",

packages/connections/src/token-session.ts

@@ -3,7 +3,7 @@
 // Inference `oauth_token` credentials go stale mid-use: the only refresh
 // the hub ran before CL-7505 was the background MCP expiry sweep, and a
 // still-valid-at-connect access token expires while a run is serving.
-// This module adapts the vendored `@corbits/oauth-core` token session
+// This module adapts the `@corbits/oauth-core` token session
 // (`createTokenSession` — skew-aware expiry, in-process coalescing of
 // concurrent refreshes) onto the shape the hub actually stores: the
 // `credential` row's `secret` / `refreshSecret` / `expiresAt` columns.
@@ -39,7 +39,7 @@ export type RefreshedTokens = {
   /** Omitted when the grant carried the prior refresh token forward. */
   readonly refreshSecret?: string;
   /** `null` when the grant stated no lifetime: the row is stored
-   * non-due (the vendored oauth-core stance — missing expiry
+   * non-due (the oauth-core stance — missing expiry
    * information is never treated as a short timer). */
   readonly expiresAt: Date | null;
 };
@@ -82,7 +82,7 @@ export function createCredentialTokenSession(
   const now = deps.now ?? Date.now;
   const skewLeadMs = deps.skewLeadMs ?? DEFAULT_SKEW_LEAD_MS;
 
-  // The vendored session keys its in-flight refresh map by profile name —
+  // The oauth-core session keys its in-flight refresh map by profile name —
   // the credential id, so concurrent calls for one credential coalesce
   // into exactly one grant while different credentials refresh in
   // parallel.

scripts/checks/kill-dates.txt

@@ -24,7 +24,6 @@ vendor/intx/hub-sessions | sawyer | 2026-11-03 | 40f873fb8059a4e9488411f2eac4428
 vendor/intx/inference | sawyer | 2026-11-03 | 81e1b31947cd8e6cac4e336d21d8a87ba063b638e0ac4ada1b0f375ec6861bf5
 vendor/intx/mail-memory | sawyer | 2026-11-03 | e281498352adbc2face631744ce9a02cb838c60a6c318961022904f0fd05d192
 vendor/intx/mailbox | sawyer | 2026-11-03 | 926bfef1b60a4ba7e600252e9ad6e37c17d387a200f79c2cbc0b3ceb612000ea
-vendor/intx/oauth-core | sawyer | 2026-10-07 | 030e27dadc9551563f74de93254eb0bdbd0558d9801b909b6c98cda88513b768
 vendor/intx/mime | sawyer | 2026-11-03 | ddf7e626172350c6a447890affc6c746b7938e04ee53af8f1d9c8cffd97d1954
 vendor/intx/types | sawyer | 2026-11-03 | 71bd6493ae6df31abd9be8ff3d2feb79260d2aae3a29a5e275945dc92ea16a12
 vendor/intx/workflow | sawyer | 2026-11-03 | c8f3a7a40d4ef429b58ba913c2faa27a5e7e98baf433dc57f864e12c907eb47a

tsconfig.build.json

@@ -211,9 +211,6 @@
     {
       "path": "./vendor/intx/mime/tsconfig.src.json"
     },
-    {
-      "path": "./vendor/intx/oauth-core/tsconfig.src.json"
-    },
     {
       "path": "./vendor/intx/types/tsconfig.src.json"
     },