@inkbox/sdk 0.1.4 → 0.2.1

package/dist/agent_identity.js

@@ -8,19 +8,20 @@
  * identity's assigned channels so callers never need to pass an email
  * address or phone number ID explicitly.
  */
-import { InkboxAPIError } from "./_http.js";
+import { InkboxError } from "./_http.js";
+import { Credentials } from "./credentials.js";
 export class AgentIdentity {
     _data;
     _inkbox;
     _mailbox;
     _phoneNumber;
-    _authenticatorApp;
+    _credentials = null;
+    _credentialsVaultRef = null; // tracks which _unlocked built the cache
     constructor(data, inkbox) {
         this._data = data;
         this._inkbox = inkbox;
         this._mailbox = data.mailbox;
         this._phoneNumber = data.phoneNumber;
-        this._authenticatorApp = data.authenticatorApp;
     }
     // ------------------------------------------------------------------
     // Identity properties
@@ -32,8 +33,134 @@ export class AgentIdentity {
     get mailbox() { return this._mailbox; }
     /** The phone number currently assigned to this identity, or `null` if none. */
     get phoneNumber() { return this._phoneNumber; }
-    /** The authenticator app currently assigned to this identity, or `null` if none. */
-    get authenticatorApp() { return this._authenticatorApp; }
+    /**
+     * Identity-scoped credential access.
+     *
+     * Returns a {@link Credentials} object filtered to the secrets this
+     * identity has been granted access to. The vault must be unlocked
+     * first via `inkbox.vault.unlock(vaultKey)`.
+     *
+     * The result is cached and automatically invalidated when the
+     * vault is re-unlocked.  Call {@link refresh} to manually clear
+     * the cache (e.g. after access-rule changes).
+     *
+     * @throws Error if the vault has not been unlocked.
+     */
+    async getCredentials() {
+        // If the vault was unlocked via constructor vaultKey, wait for it.
+        if (this._inkbox._vaultUnlockPromise !== null) {
+            await this._inkbox._vaultUnlockPromise;
+        }
+        const vault = this._inkbox._vaultResource;
+        // Invalidate cache if the vault was re-unlocked since we last built it.
+        if (this._credentials !== null && vault._unlocked === this._credentialsVaultRef) {
+            return this._credentials;
+        }
+        this._requireVaultUnlocked();
+        const unlocked = vault._unlocked;
+        // Filter secrets by identity access rules (same logic as
+        // VaultResource.unlock with identityId).
+        const idStr = this.id;
+        const filtered = [];
+        for (const secret of unlocked.secrets) {
+            const rules = await vault.http.get(`/secrets/${secret.id}/access`);
+            if (rules.some((r) => r.identity_id === idStr)) {
+                filtered.push(secret);
+            }
+        }
+        this._credentials = new Credentials(filtered);
+        this._credentialsVaultRef = unlocked;
+        return this._credentials;
+    }
+    /**
+     * Revoke this identity's access to a vault secret.
+     *
+     * Also clears the credentials cache so the next call to
+     * {@link getCredentials} reflects the change.
+     *
+     * @param secretId - UUID of the secret to revoke access from.
+     */
+    async revokeCredentialAccess(secretId) {
+        await this._inkbox._vaultResource.revokeAccess(secretId, this.id);
+        this._credentials = null;
+    }
+    // ------------------------------------------------------------------
+    // Vault secret management
+    // ------------------------------------------------------------------
+    /**
+     * Create a vault secret and grant this identity access to it.
+     *
+     * The vault must be unlocked first.
+     *
+     * @param options.name - Display name (max 255 characters).
+     * @param options.payload - The secret payload.
+     * @param options.description - Optional description.
+     * @returns {@link VaultSecret} metadata.
+     */
+    async createSecret(options) {
+        this._requireVaultUnlocked();
+        const unlocked = this._inkbox._vaultResource._unlocked;
+        const secret = await unlocked.createSecret(options);
+        await this._inkbox._vaultResource.grantAccess(secret.id, this.id);
+        this._credentials = null;
+        return secret;
+    }
+    /**
+     * Fetch and decrypt a vault secret this identity has access to.
+     *
+     * @param secretId - UUID of the secret.
+     */
+    async getSecret(secretId) {
+        this._requireVaultUnlocked();
+        return this._inkbox._vaultResource._unlocked.getSecret(secretId);
+    }
+    /**
+     * Add or replace TOTP on a login secret this identity has access to.
+     *
+     * @param secretId - UUID of the login secret.
+     * @param totp - A {@link TOTPConfig} or an `otpauth://totp/...` URI string.
+     * @returns Updated {@link VaultSecret} metadata.
+     */
+    async setTotp(secretId, totp) {
+        this._requireVaultUnlocked();
+        const result = await this._inkbox._vaultResource._unlocked.setTotp(secretId, totp);
+        this._credentials = null;
+        return result;
+    }
+    /**
+     * Remove TOTP from a login secret this identity has access to.
+     *
+     * @param secretId - UUID of the login secret.
+     * @returns Updated {@link VaultSecret} metadata.
+     */
+    async removeTotp(secretId) {
+        this._requireVaultUnlocked();
+        const result = await this._inkbox._vaultResource._unlocked.removeTotp(secretId);
+        this._credentials = null;
+        return result;
+    }
+    /**
+     * Generate the current TOTP code for a login secret.
+     *
+     * Uses cached credentials if available, otherwise fetches fresh.
+     *
+     * @param secretId - UUID of the login secret.
+     * @returns A {@link TOTPCode}.
+     */
+    async getTotpCode(secretId) {
+        this._requireVaultUnlocked();
+        return this._inkbox._vaultResource._unlocked.getTotpCode(secretId);
+    }
+    /**
+     * Delete a vault secret.
+     *
+     * @param secretId - UUID of the secret to delete.
+     */
+    async deleteSecret(secretId) {
+        this._requireVaultUnlocked();
+        await this._inkbox._vaultResource._unlocked.deleteSecret(secretId);
+        this._credentials = null;
+    }
     // ------------------------------------------------------------------
     // Channel management
     // ------------------------------------------------------------------
@@ -119,46 +246,6 @@ export class AgentIdentity {
         await this._inkbox._idsResource.unlinkPhoneNumber(this.agentHandle);
         this._phoneNumber = null;
     }
-    /**
-     * Create a new authenticator app and link it to this identity.
-     *
-     * @returns The newly created {@link AuthenticatorApp}.
-     */
-    async createAuthenticatorApp() {
-        const app = await this._inkbox._authApps.create({ agentHandle: this.agentHandle });
-        this._authenticatorApp = {
-            id: app.id,
-            organizationId: app.organizationId,
-            identityId: app.identityId,
-            status: app.status,
-            createdAt: app.createdAt,
-            updatedAt: app.updatedAt,
-        };
-        return app;
-    }
-    /**
-     * Link an existing authenticator app to this identity.
-     *
-     * @param authenticatorAppId - UUID of the authenticator app to link. Obtain via
-     *   `inkbox.authenticatorApps.list()` or `inkbox.authenticatorApps.get()`.
-     * @returns The linked {@link IdentityAuthenticatorApp}.
-     */
-    async assignAuthenticatorApp(authenticatorAppId) {
-        const data = await this._inkbox._idsResource.assignAuthenticatorApp(this.agentHandle, {
-            authenticatorAppId,
-        });
-        this._authenticatorApp = data.authenticatorApp;
-        this._data = data;
-        return this._authenticatorApp;
-    }
-    /**
-     * Unlink this identity's authenticator app (does not delete the app).
-     */
-    async unlinkAuthenticatorApp() {
-        this._requireAuthenticatorApp();
-        await this._inkbox._idsResource.unlinkAuthenticatorApp(this.agentHandle);
-        this._authenticatorApp = null;
-    }
     // ------------------------------------------------------------------
     // Mail helpers
     // ------------------------------------------------------------------
@@ -272,64 +359,6 @@ export class AgentIdentity {
         return this._inkbox._transcripts.list(this._phoneNumber.id, callId);
     }
     // ------------------------------------------------------------------
-    // Authenticator helpers
-    // ------------------------------------------------------------------
-    /**
-     * Create a new authenticator account from an `otpauth://` URI.
-     *
-     * @param options.otpauthUri - `otpauth://totp/...` or `otpauth://hotp/...` URI.
-     * @param options.displayName - Optional user-managed label (max 255 characters).
-     * @param options.description - Optional free-form notes.
-     */
-    async createAuthenticatorAccount(options) {
-        this._requireAuthenticatorApp();
-        return this._inkbox._authAccounts.create(this._authenticatorApp.id, options);
-    }
-    /** List all authenticator accounts in this identity's app. */
-    async listAuthenticatorAccounts() {
-        this._requireAuthenticatorApp();
-        return this._inkbox._authAccounts.list(this._authenticatorApp.id);
-    }
-    /**
-     * Get a single authenticator account by ID.
-     *
-     * @param accountId - UUID of the authenticator account.
-     */
-    async getAuthenticatorAccount(accountId) {
-        this._requireAuthenticatorApp();
-        return this._inkbox._authAccounts.get(this._authenticatorApp.id, accountId);
-    }
-    /**
-     * Update user-managed metadata on an authenticator account.
-     *
-     * @param accountId - UUID of the authenticator account to update.
-     * @param options.displayName - New label (max 255 characters).
-     * @param options.description - New notes.
-     */
-    async updateAuthenticatorAccount(accountId, options) {
-        this._requireAuthenticatorApp();
-        return this._inkbox._authAccounts.update(this._authenticatorApp.id, accountId, options);
-    }
-    /**
-     * Soft-delete an authenticator account.
-     *
-     * @param accountId - UUID of the authenticator account to delete.
-     */
-    async deleteAuthenticatorAccount(accountId) {
-        this._requireAuthenticatorApp();
-        await this._inkbox._authAccounts.delete(this._authenticatorApp.id, accountId);
-    }
-    /**
-     * Generate the current OTP code for an authenticator account.
-     *
-     * @param accountId - UUID of the authenticator account.
-     * @returns The generated OTP code with metadata.
-     */
-    async generateOtp(accountId) {
-        this._requireAuthenticatorApp();
-        return this._inkbox._authAccounts.generateOtp(this._authenticatorApp.id, accountId);
-    }
-    // ------------------------------------------------------------------
     // Identity management
     // ------------------------------------------------------------------
     /**
@@ -344,12 +373,15 @@ export class AgentIdentity {
             ...result,
             mailbox: this._mailbox,
             phoneNumber: this._phoneNumber,
-            authenticatorApp: this._authenticatorApp,
         };
     }
     /**
      * Re-fetch this identity from the API and update cached channels.
      *
+     * Also clears the credentials filter cache so the next call to
+     * {@link getCredentials} re-evaluates access rules.  (The cache is
+     * also automatically invalidated when the vault is re-unlocked.)
+     *
      * @returns `this` for chaining.
      */
     async refresh() {
@@ -357,29 +389,29 @@ export class AgentIdentity {
         this._data = data;
         this._mailbox = data.mailbox;
         this._phoneNumber = data.phoneNumber;
-        this._authenticatorApp = data.authenticatorApp;
+        this._credentials = null;
         return this;
     }
-    /** Soft-delete this identity (unlinks channels without deleting them). */
+    /** Delete this identity (unlinks channels without deleting them). */
     async delete() {
         await this._inkbox._idsResource.delete(this.agentHandle);
     }
     // ------------------------------------------------------------------
     // Internal guards
     // ------------------------------------------------------------------
+    _requireVaultUnlocked() {
+        if (this._inkbox._vaultResource._unlocked === null) {
+            throw new InkboxError("Vault must be unlocked before accessing credentials. Call inkbox.vault.unlock(vaultKey) first.");
+        }
+    }
     _requireMailbox() {
         if (!this._mailbox) {
-            throw new InkboxAPIError(0, `Identity '${this.agentHandle}' has no mailbox assigned. Call identity.createMailbox() or identity.assignMailbox() first.`);
+            throw new InkboxError(`Identity '${this.agentHandle}' has no mailbox assigned. Call identity.createMailbox() or identity.assignMailbox() first.`);
         }
     }
     _requirePhone() {
         if (!this._phoneNumber) {
-            throw new InkboxAPIError(0, `Identity '${this.agentHandle}' has no phone number assigned. Call identity.provisionPhoneNumber() or identity.assignPhoneNumber() first.`);
-        }
-    }
-    _requireAuthenticatorApp() {
-        if (!this._authenticatorApp) {
-            throw new InkboxAPIError(0, `Identity '${this.agentHandle}' has no authenticator app assigned. Call identity.createAuthenticatorApp() or identity.assignAuthenticatorApp() first.`);
+            throw new InkboxError(`Identity '${this.agentHandle}' has no phone number assigned. Call identity.provisionPhoneNumber() or identity.assignPhoneNumber() first.`);
         }
     }
 }

package/dist/agent_identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent_identity.js","sourceRoot":"","sources":["../src/agent_identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAa5C,MAAM,OAAO,aAAa;IAChB,KAAK,CAAqB;IACjB,OAAO,CAAS;IACzB,QAAQ,CAAyB;IACjC,YAAY,CAA6B;IACzC,iBAAiB,CAAkC;IAE3D,YAAY,IAAwB,EAAE,MAAc;QAClD,IAAI,CAAC,KAAK,GAAgB,IAAI,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAc,MAAM,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAa,IAAI,CAAC,OAAO,CAAC;QACvC,IAAI,CAAC,YAAY,GAAS,IAAI,CAAC,WAAW,CAAC;QAC3C,IAAI,CAAC,iBAAiB,GAAI,IAAI,CAAC,gBAAgB,CAAC;IAClD,CAAC;IAED,qEAAqE;IACrE,sBAAsB;IACtB,qEAAqE;IAErE,IAAI,WAAW,KAAa,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5D,IAAI,EAAE,KAAuB,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,IAAI,MAAM,KAAmB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAExD,0EAA0E;IAC1E,IAAI,OAAO,KAA6B,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/D,+EAA+E;IAC/E,IAAI,WAAW,KAAiC,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAE3E,oFAAoF;IACpF,IAAI,gBAAgB,KAAsC,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAE1F,qEAAqE;IACrE,qBAAqB;IACrB,qEAAqE;IAErE;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,UAAoC,EAAE;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;YACnD,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,OAAO;SACX,CAAC,CAAC;QACH,MAAM,MAAM,GAAoB;YAC9B,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,MAAM,IAAI,GAAM,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE;YAC9E,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAI,IAAI,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAO,IAAI,CAAC;QACtB,OAAO,IAAI,CAAC,QAAS,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB,CACxB,UAA6C,EAAE;QAE/C,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACnE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,KAAK,GAAU,IAAI,CAAC;QACzB,OAAO,IAAI,CAAC,YAAa,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,aAAqB;QAC3C,MAAM,IAAI,GAAK,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE;YACjF,aAAa;SACd,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,KAAK,GAAU,IAAI,CAAC;QACzB,OAAO,IAAI,CAAC,YAAa,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB;QACrB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,sBAAsB;QAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,iBAAiB,GAAG;YACvB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;QACF,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,sBAAsB,CAAC,kBAA0B;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,sBAAsB,CAAC,IAAI,CAAC,WAAW,EAAE;YACpF,kBAAkB;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC/C,IAAI,CAAC,KAAK,GAAe,IAAI,CAAC;QAC9B,OAAO,IAAI,CAAC,iBAAkB,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB;QAC1B,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAChC,CAAC;IAED,qEAAqE;IACrE,eAAe;IACf,qEAAqE;IAErE;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,SAAS,CAAC,OASf;QACC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,UAAqE,EAAE;QAChF,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,CAAC,gBAAgB,CAAC,UAAqE,EAAE;QAC7F,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,MAAM,GAAG,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,UAAoB;QACvC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAS,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAED,qEAAqE;IACrE,gBAAgB;IAChB,qEAAqE;IAErE;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,OAGf;QACC,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/B,UAAU,EAAW,IAAI,CAAC,YAAa,CAAC,MAAM;YAC9C,QAAQ,EAAa,OAAO,CAAC,QAAQ;YACrC,kBAAkB,EAAG,OAAO,CAAC,kBAAkB;SAChD,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,UAA+C,EAAE;QAC/D,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,YAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAED,qEAAqE;IACrE,wBAAwB;IACxB,qEAAqE;IAErE;;;;;;OAMG;IACH,KAAK,CAAC,0BAA0B,CAAC,OAIhC;QACC,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAkB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAChF,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,yBAAyB;QAC7B,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAkB,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,uBAAuB,CAAC,SAAiB;QAC7C,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAkB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC/E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,0BAA0B,CAC9B,SAAiB,EACjB,OAAqE;QAErE,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3F,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,0BAA0B,CAAC,SAAiB;QAChD,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAkB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACjF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,SAAiB;QACjC,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAkB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACvF,CAAC;IAED,qEAAqE;IACrE,sBAAsB;IACtB,qEAAqE;IAErE;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,OAAgD;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjF,IAAI,CAAC,KAAK,GAAG;YACX,GAAG,MAAM;YACT,OAAO,EAAW,IAAI,CAAC,QAAQ;YAC/B,WAAW,EAAO,IAAI,CAAC,YAAY;YACnC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB;SACzC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,GAAe,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,GAAe,IAAI,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAY,IAAI,CAAC,OAAO,CAAC;QACtC,IAAI,CAAC,YAAY,GAAQ,IAAI,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3D,CAAC;IAED,qEAAqE;IACrE,kBAAkB;IAClB,qEAAqE;IAE7D,eAAe;QACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,cAAc,CACtB,CAAC,EACD,aAAa,IAAI,CAAC,WAAW,6FAA6F,CAC3H,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,cAAc,CACtB,CAAC,EACD,aAAa,IAAI,CAAC,WAAW,6GAA6G,CAC3I,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,wBAAwB;QAC9B,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,cAAc,CACtB,CAAC,EACD,aAAa,IAAI,CAAC,WAAW,yHAAyH,CACvJ,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"agent_identity.js","sourceRoot":"","sources":["../src/agent_identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAkB,WAAW,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAc/C,MAAM,OAAO,aAAa;IAChB,KAAK,CAAqB;IACjB,OAAO,CAAS;IACzB,QAAQ,CAAyB;IACjC,YAAY,CAA6B;IACzC,YAAY,GAAuB,IAAI,CAAC;IACxC,oBAAoB,GAAkB,IAAI,CAAC,CAAC,yCAAyC;IAE7F,YAAY,IAAwB,EAAE,MAAc;QAClD,IAAI,CAAC,KAAK,GAAgB,IAAI,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAc,MAAM,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAa,IAAI,CAAC,OAAO,CAAC;QACvC,IAAI,CAAC,YAAY,GAAS,IAAI,CAAC,WAAW,CAAC;IAC7C,CAAC;IAED,qEAAqE;IACrE,sBAAsB;IACtB,qEAAqE;IAErE,IAAI,WAAW,KAAa,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5D,IAAI,EAAE,KAAuB,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,IAAI,MAAM,KAAmB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAExD,0EAA0E;IAC1E,IAAI,OAAO,KAA6B,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/D,+EAA+E;IAC/E,IAAI,WAAW,KAAiC,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAE3E;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,cAAc;QAClB,mEAAmE;QACnE,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;QACzC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;QAC1C,wEAAwE;QACxE,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAChF,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAU,CAAC;QAClC,yDAAyD;QACzD,yCAAyC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAEhC,YAAY,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,EAAE,CAAC;gBAC/C,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,oBAAoB,GAAG,QAAQ,CAAC;QACrC,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,sBAAsB,CAAC,QAAgB;QAC3C,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED,qEAAqE;IACrE,0BAA0B;IAC1B,qEAAqE;IAErE;;;;;;;;;OASG;IACH,KAAK,CAAC,YAAY,CAAC,OAIlB;QACC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,SAAU,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,SAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,IAAyB;QACvD,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,SAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpF,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,SAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACjF,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,SAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,SAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED,qEAAqE;IACrE,qBAAqB;IACrB,qEAAqE;IAErE;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,UAAoC,EAAE;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;YACnD,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,OAAO;SACX,CAAC,CAAC;QACH,MAAM,MAAM,GAAoB;YAC9B,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,MAAM,IAAI,GAAM,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE;YAC9E,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAI,IAAI,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAO,IAAI,CAAC;QACtB,OAAO,IAAI,CAAC,QAAS,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB,CACxB,UAA6C,EAAE;QAE/C,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACnE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,KAAK,GAAU,IAAI,CAAC;QACzB,OAAO,IAAI,CAAC,YAAa,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,aAAqB;QAC3C,MAAM,IAAI,GAAK,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE;YACjF,aAAa;SACd,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,KAAK,GAAU,IAAI,CAAC;QACzB,OAAO,IAAI,CAAC,YAAa,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB;QACrB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED,qEAAqE;IACrE,eAAe;IACf,qEAAqE;IAErE;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,SAAS,CAAC,OASf;QACC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,UAA+D,EAAE;QAC1E,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,CAAC,gBAAgB,CAAC,UAA+D,EAAE;QACvF,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,MAAM,GAAG,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,UAAoB;QACvC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAS,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAED,qEAAqE;IACrE,gBAAgB;IAChB,qEAAqE;IAErE;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,OAGf;QACC,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/B,UAAU,EAAW,IAAI,CAAC,YAAa,CAAC,MAAM;YAC9C,QAAQ,EAAa,OAAO,CAAC,QAAQ;YACrC,kBAAkB,EAAG,OAAO,CAAC,kBAAkB;SAChD,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,UAA+C,EAAE;QAC/D,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,YAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAED,qEAAqE;IACrE,sBAAsB;IACtB,qEAAqE;IAErE;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,OAAgD;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjF,IAAI,CAAC,KAAK,GAAG;YACX,GAAG,MAAM;YACT,OAAO,EAAW,IAAI,CAAC,QAAQ;YAC/B,WAAW,EAAO,IAAI,CAAC,YAAY;SACpC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,GAAe,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,GAAe,IAAI,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAY,IAAI,CAAC,OAAO,CAAC;QACtC,IAAI,CAAC,YAAY,GAAQ,IAAI,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAQ,IAAI,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3D,CAAC;IAED,qEAAqE;IACrE,kBAAkB;IAClB,qEAAqE;IAE7D,qBAAqB;QAC3B,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACnD,MAAM,IAAI,WAAW,CACnB,gGAAgG,CACjG,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,eAAe;QACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,WAAW,CACnB,aAAa,IAAI,CAAC,WAAW,6FAA6F,CAC3H,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,WAAW,CACnB,aAAa,IAAI,CAAC,WAAW,6GAA6G,CAC3I,CAAC;QACJ,CAAC;IACH,CAAC;CAEF"}

package/dist/credentials.d.ts

@@ -0,0 +1,97 @@
+/**
+ * inkbox/src/credentials.ts
+ *
+ * Credentials — agent-facing credential access, typed and identity-scoped.
+ *
+ * This is the *runtime* surface for agents that need their credentials.
+ * The vault remains the *admin* surface for creating secrets, managing
+ * keys, and configuring access rules.
+ */
+import type { TOTPCode } from "./vault/totp.js";
+import type { APIKeyPayload, DecryptedVaultSecret, KeyPairPayload, LoginPayload, SSHKeyPayload } from "./vault/types.js";
+/**
+ * Agent-facing credential access — typed, identity-scoped.
+ *
+ * Wraps a pre-filtered list of {@link DecryptedVaultSecret} objects and
+ * provides typed accessors so agents can retrieve credentials without
+ * dealing with vault internals.
+ *
+ * Obtain via {@link AgentIdentity.getCredentials} after unlocking the vault:
+ *
+ * ```ts
+ * await inkbox.vault.unlock("my-Vault-key-01!");
+ * const identity = await inkbox.getIdentity("support-bot");
+ *
+ * const creds = await identity.getCredentials();
+ * const logins = creds.listLogins();
+ * const apiKey = creds.getApiKey("cccc3333-...");
+ * ```
+ */
+export declare class Credentials {
+    private readonly _secrets;
+    private readonly _byId;
+    constructor(secrets: DecryptedVaultSecret[]);
+    /** List all credentials this identity has access to. */
+    list(): DecryptedVaultSecret[];
+    /** List login credentials (username/password). */
+    listLogins(): DecryptedVaultSecret[];
+    /** List API key credentials. */
+    listApiKeys(): DecryptedVaultSecret[];
+    /** List key pair credentials (access key + secret key). */
+    listKeyPairs(): DecryptedVaultSecret[];
+    /** List SSH key credentials. */
+    listSshKeys(): DecryptedVaultSecret[];
+    /**
+     * Get any credential by UUID.
+     *
+     * @param secretId - UUID of the secret.
+     * @throws Error if no credential with this UUID is accessible.
+     */
+    get(secretId: string): DecryptedVaultSecret;
+    /**
+     * Get a login credential's payload by UUID.
+     *
+     * @param secretId - UUID of the secret.
+     * @throws Error if not found.
+     * @throws TypeError if the credential is not a login type.
+     */
+    getLogin(secretId: string): LoginPayload;
+    /**
+     * Get an API key credential's payload by UUID.
+     *
+     * @param secretId - UUID of the secret.
+     * @throws Error if not found.
+     * @throws TypeError if the credential is not an api_key type.
+     */
+    getApiKey(secretId: string): APIKeyPayload;
+    /**
+     * Get a key pair credential's payload by UUID.
+     *
+     * @param secretId - UUID of the secret.
+     * @throws Error if not found.
+     * @throws TypeError if the credential is not a key_pair type.
+     */
+    getKeyPair(secretId: string): KeyPairPayload;
+    /**
+     * Get an SSH key credential's payload by UUID.
+     *
+     * @param secretId - UUID of the secret.
+     * @throws Error if not found.
+     * @throws TypeError if the credential is not an ssh_key type.
+     */
+    getSshKey(secretId: string): SSHKeyPayload;
+    private _getTyped;
+    /**
+     * Generate the current TOTP code for a login credential.
+     *
+     * @param secretId - UUID of the login secret.
+     * @returns A {@link TOTPCode}.
+     * @throws Error if not found.
+     * @throws TypeError if the credential is not a login type.
+     * @throws Error if the login has no TOTP configured.
+     */
+    getTotpCode(secretId: string): TOTPCode;
+    /** Number of credentials accessible to this identity. */
+    get length(): number;
+}
+//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,KAAK,EACV,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,YAAY,EACZ,aAAa,EACd,MAAM,kBAAkB,CAAC;AAG1B;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoC;gBAE9C,OAAO,EAAE,oBAAoB,EAAE;IAS3C,wDAAwD;IACxD,IAAI,IAAI,oBAAoB,EAAE;IAI9B,kDAAkD;IAClD,UAAU,IAAI,oBAAoB,EAAE;IAIpC,gCAAgC;IAChC,WAAW,IAAI,oBAAoB,EAAE;IAIrC,2DAA2D;IAC3D,YAAY,IAAI,oBAAoB,EAAE;IAItC,gCAAgC;IAChC,WAAW,IAAI,oBAAoB,EAAE;IAQrC;;;;;OAKG;IACH,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,oBAAoB;IAU3C;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY;IAIxC;;;;;;OAMG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa;IAI1C;;;;;;OAMG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc;IAI5C;;;;;;OAMG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa;IAQ1C,OAAO,CAAC,SAAS;IAUjB;;;;;;;;OAQG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ;IAQvC,yDAAyD;IACzD,IAAI,MAAM,IAAI,MAAM,CAEnB;CACF"}

package/dist/credentials.js

@@ -0,0 +1,147 @@
+/**
+ * inkbox/src/credentials.ts
+ *
+ * Credentials — agent-facing credential access, typed and identity-scoped.
+ *
+ * This is the *runtime* surface for agents that need their credentials.
+ * The vault remains the *admin* surface for creating secrets, managing
+ * keys, and configuring access rules.
+ */
+import { generateTotp } from "./vault/totp.js";
+import { VaultSecretType } from "./vault/types.js";
+/**
+ * Agent-facing credential access — typed, identity-scoped.
+ *
+ * Wraps a pre-filtered list of {@link DecryptedVaultSecret} objects and
+ * provides typed accessors so agents can retrieve credentials without
+ * dealing with vault internals.
+ *
+ * Obtain via {@link AgentIdentity.getCredentials} after unlocking the vault:
+ *
+ * ```ts
+ * await inkbox.vault.unlock("my-Vault-key-01!");
+ * const identity = await inkbox.getIdentity("support-bot");
+ *
+ * const creds = await identity.getCredentials();
+ * const logins = creds.listLogins();
+ * const apiKey = creds.getApiKey("cccc3333-...");
+ * ```
+ */
+export class Credentials {
+    _secrets;
+    _byId;
+    constructor(secrets) {
+        this._secrets = secrets;
+        this._byId = new Map(secrets.map((s) => [s.id, s]));
+    }
+    // ------------------------------------------------------------------
+    // Discovery — return full DecryptedVaultSecret for name/metadata
+    // ------------------------------------------------------------------
+    /** List all credentials this identity has access to. */
+    list() {
+        return [...this._secrets];
+    }
+    /** List login credentials (username/password). */
+    listLogins() {
+        return this._secrets.filter((s) => s.secretType === VaultSecretType.LOGIN);
+    }
+    /** List API key credentials. */
+    listApiKeys() {
+        return this._secrets.filter((s) => s.secretType === VaultSecretType.API_KEY);
+    }
+    /** List key pair credentials (access key + secret key). */
+    listKeyPairs() {
+        return this._secrets.filter((s) => s.secretType === VaultSecretType.KEY_PAIR);
+    }
+    /** List SSH key credentials. */
+    listSshKeys() {
+        return this._secrets.filter((s) => s.secretType === VaultSecretType.SSH_KEY);
+    }
+    // ------------------------------------------------------------------
+    // Access by UUID — return typed payload directly
+    // ------------------------------------------------------------------
+    /**
+     * Get any credential by UUID.
+     *
+     * @param secretId - UUID of the secret.
+     * @throws Error if no credential with this UUID is accessible.
+     */
+    get(secretId) {
+        const secret = this._byId.get(secretId);
+        if (!secret) {
+            throw new Error(`No credential with id '${secretId}' is accessible to this identity`);
+        }
+        return secret;
+    }
+    /**
+     * Get a login credential's payload by UUID.
+     *
+     * @param secretId - UUID of the secret.
+     * @throws Error if not found.
+     * @throws TypeError if the credential is not a login type.
+     */
+    getLogin(secretId) {
+        return this._getTyped(secretId, VaultSecretType.LOGIN);
+    }
+    /**
+     * Get an API key credential's payload by UUID.
+     *
+     * @param secretId - UUID of the secret.
+     * @throws Error if not found.
+     * @throws TypeError if the credential is not an api_key type.
+     */
+    getApiKey(secretId) {
+        return this._getTyped(secretId, VaultSecretType.API_KEY);
+    }
+    /**
+     * Get a key pair credential's payload by UUID.
+     *
+     * @param secretId - UUID of the secret.
+     * @throws Error if not found.
+     * @throws TypeError if the credential is not a key_pair type.
+     */
+    getKeyPair(secretId) {
+        return this._getTyped(secretId, VaultSecretType.KEY_PAIR);
+    }
+    /**
+     * Get an SSH key credential's payload by UUID.
+     *
+     * @param secretId - UUID of the secret.
+     * @throws Error if not found.
+     * @throws TypeError if the credential is not an ssh_key type.
+     */
+    getSshKey(secretId) {
+        return this._getTyped(secretId, VaultSecretType.SSH_KEY);
+    }
+    // ------------------------------------------------------------------
+    // Internal
+    // ------------------------------------------------------------------
+    _getTyped(secretId, expectedType) {
+        const secret = this.get(secretId);
+        if (secret.secretType !== expectedType) {
+            throw new TypeError(`Credential '${secretId}' is a '${secret.secretType}' secret, not '${expectedType}'`);
+        }
+        return secret.payload;
+    }
+    /**
+     * Generate the current TOTP code for a login credential.
+     *
+     * @param secretId - UUID of the login secret.
+     * @returns A {@link TOTPCode}.
+     * @throws Error if not found.
+     * @throws TypeError if the credential is not a login type.
+     * @throws Error if the login has no TOTP configured.
+     */
+    getTotpCode(secretId) {
+        const payload = this.getLogin(secretId);
+        if (!payload.totp) {
+            throw new Error(`Login '${secretId}' has no TOTP configured`);
+        }
+        return generateTotp(payload.totp);
+    }
+    /** Number of credentials accessible to this identity. */
+    get length() {
+        return this._secrets.length;
+    }
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAQ/C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,WAAW;IACL,QAAQ,CAAyB;IACjC,KAAK,CAAoC;IAE1D,YAAY,OAA+B;QACzC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,qEAAqE;IACrE,iEAAiE;IACjE,qEAAqE;IAErE,wDAAwD;IACxD,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,kDAAkD;IAClD,UAAU;QACR,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,eAAe,CAAC,KAAK,CAAC,CAAC;IAC7E,CAAC;IAED,gCAAgC;IAChC,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,eAAe,CAAC,OAAO,CAAC,CAAC;IAC/E,CAAC;IAED,2DAA2D;IAC3D,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,eAAe,CAAC,QAAQ,CAAC,CAAC;IAChF,CAAC;IAED,gCAAgC;IAChC,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,eAAe,CAAC,OAAO,CAAC,CAAC;IAC/E,CAAC;IAED,qEAAqE;IACrE,iDAAiD;IACjD,qEAAqE;IAErE;;;;;OAKG;IACH,GAAG,CAAC,QAAgB;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,0BAA0B,QAAQ,kCAAkC,CACrE,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAiB,CAAC;IACzE,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,QAAgB;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,eAAe,CAAC,OAAO,CAAkB,CAAC;IAC5E,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAmB,CAAC;IAC9E,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,QAAgB;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,eAAe,CAAC,OAAO,CAAkB,CAAC;IAC5E,CAAC;IAED,qEAAqE;IACrE,WAAW;IACX,qEAAqE;IAE7D,SAAS,CAAC,QAAgB,EAAE,YAA6B;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;YACvC,MAAM,IAAI,SAAS,CACjB,eAAe,QAAQ,WAAW,MAAM,CAAC,UAAU,kBAAkB,YAAY,GAAG,CACrF,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED;;;;;;;;OAQG;IACH,WAAW,CAAC,QAAgB;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,0BAA0B,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,yDAAyD;IACzD,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC9B,CAAC;CACF"}

package/dist/identities/resources/identities.d.ts

@@ -39,7 +39,7 @@ export declare class IdentitiesResource {
         status?: string;
     }): Promise<AgentIdentitySummary>;
     /**
-     * Soft-delete an identity.
+     * Delete an identity.
      *
      * Unlinks any assigned channels without deleting them.
      *
@@ -76,20 +76,5 @@ export declare class IdentitiesResource {
      * @param agentHandle - Handle of the identity.
      */
     unlinkPhoneNumber(agentHandle: string): Promise<void>;
-    /**
-     * Assign an authenticator app to an identity.
-     *
-     * @param agentHandle - Handle of the identity.
-     * @param options.authenticatorAppId - UUID of the authenticator app to assign.
-     */
-    assignAuthenticatorApp(agentHandle: string, options: {
-        authenticatorAppId: string;
-    }): Promise<_AgentIdentityData>;
-    /**
-     * Unlink the authenticator app from an identity (does not delete the app).
-     *
-     * @param agentHandle - Handle of the identity.
-     */
-    unlinkAuthenticatorApp(agentHandle: string): Promise<void>;
 }
 //# sourceMappingURL=identities.d.ts.map