managed-deepagents 0.0.3-dev.26 → 0.0.3-dev.29

package/dist/identity.d.ts

@@ -0,0 +1,273 @@
+/**
+ * The managed `identity.ts` declaration primitive.
+ *
+ * A project's root `identity.ts` exports a named `identity` created with
+ * `defineIdentity(...)` (or `defineIdentity.preset(...)`). The compiler
+ * discovers it, generates the custom-auth handler, and wires thread/memory
+ * scoping and downstream credentials. See `specification/identity-final.md`.
+ *
+ * This module is pure authoring-time config construction plus eager validation —
+ * it has no runtime dependency (the `providers.*` helpers return plain data).
+ */
+/** How MDA learns who is calling on the HTTP ingress path (§6). */
+export type HttpIngress = "trusted_backend" | ValidatedTokenIngress;
+/**
+ * Browser-direct ingress: MDA verifies the caller's own IdP token server-side
+ * and derives identity from its claims (§6.2).
+ */
+export interface ValidatedTokenIngress {
+    mode: "validated_token";
+    /**
+     * The token families this deployment accepts (non-empty). MDA selects a
+     * provider per request by the token issuer (`iss`). Use one entry for a single
+     * IdP; `id` is required once there is more than one entry.
+     */
+    providers: ValidatedTokenProvider[];
+}
+/** A single token family MDA knows how to verify (§6.2). */
+export interface ValidatedTokenProvider {
+    /** Label used for routing; required only when there is more than one provider. */
+    id?: string;
+    /** Expected token issuer (`iss`) — the routing/verification key for real IdP tokens. */
+    issuer?: string;
+    /** Expected audience (`aud`), so tokens minted for other apps are rejected. */
+    audience?: string;
+    /** Accepted signing algorithms, e.g. `["RS256"]`. */
+    algorithms?: string[];
+    /**
+     * URL of the IdP's public keys (JWKS). MDA verifies the signature locally —
+     * the recommended path for most OAuth/OIDC providers.
+     */
+    jwks?: string;
+    /**
+     * Resolve `jwks`/endpoints from `issuer/.well-known/openid-configuration`
+     * instead of a literal `jwks` URL (what `providers.oidc` sets).
+     */
+    discover?: boolean;
+    /**
+     * Only for opaque tokens: verify by calling the IdP once per request
+     * (e.g. Supabase `/auth/v1/user`).
+     */
+    introspect?: {
+        /** Single introspection endpoint (the common case). */
+        url?: string;
+        /** Provider-specific endpoint selection by a client header (e.g. Supabase region). */
+        regionHeader?: string;
+        /**
+         * Region value → introspection endpoint. A bare string is the URL (using the
+         * shared `headers` below); an object also carries region-specific headers
+         * (e.g. a per-region Supabase `apikey`), which override the shared ones.
+         */
+        regions?: Record<string, string | {
+            url: string;
+            headers?: Record<string, string>;
+        }>;
+        /** Static headers sent with the introspection call (e.g. Supabase `apikey`). */
+        headers?: Record<string, string>;
+        /** Where MDA puts the user's token when calling the endpoint. Default: "authorization". */
+        tokenIn?: "authorization" | "header";
+        /** Custom header name when `tokenIn` is "header". */
+        header?: string;
+    };
+    /** MDA issues + verifies short-lived signed tokens for anonymous/guest users. */
+    guest?: {
+        /** Enable an issue/reissue path for this provider. */
+        issue: boolean;
+        /** Token lifetime, e.g. "24h". */
+        ttl?: string;
+        /** Prefix applied to the generated actor id, e.g. "guest:". */
+        actorPrefix?: string;
+    };
+    /** Maps verified token claims → identity envelope fields. */
+    claims: {
+        /** Claim used as `runtime.identity.actor.id` (e.g. "sub", "email"). */
+        actor: string;
+        /** Claim used as `runtime.identity.tenant.id` (e.g. "org_id"). */
+        tenant?: string;
+        /** Claim used as `runtime.identity.actor.email`. */
+        email?: string;
+    };
+}
+/** Which downstream call needs a credential right now (§7). */
+export interface CredentialTarget {
+    /** What is being called. */
+    kind: "subagent" | "mcp" | "connection";
+    /** The configured name, e.g. "code-reviewer" | "docs" | "github". */
+    name: string;
+    /** Optional read/write hint so the resolver can mint different tokens (§7.6). */
+    intent?: "read" | "write";
+    /** Current thread, when the credential is thread-specific. */
+    threadId?: string;
+    /** Free-form context (e.g. `{ repo, installationId }`); part of the cache key. */
+    metadata?: Record<string, unknown>;
+}
+/** What a credential resolver returns (§7.2). */
+export interface ResolvedCredential {
+    /** Headers MDA attaches to the downstream call (usually Authorization). */
+    headers: Record<string, string>;
+    /** ISO expiry; MDA caches per (actor, tenant, target) until then. */
+    expiresAt?: string;
+}
+/** The frozen identity envelope tools and middleware see (§8). */
+export interface RuntimeIdentity {
+    actor: {
+        type: "user" | "service";
+        id: string;
+        email?: string;
+    };
+    tenant?: {
+        id: string;
+    };
+    source: {
+        provider: "http" | "slack" | "schedule" | "cli" | "studio";
+        threadId?: string;
+    };
+    claims?: Record<string, unknown>;
+}
+/** An in-process resolver callback (§7.2). */
+export type CredentialResolver = (args: {
+    identity: RuntimeIdentity;
+    target: CredentialTarget;
+}) => Promise<ResolvedCredential>;
+/**
+ * Provide this (with `scoping.credentials: "custom"`) to mint your own
+ * downstream credentials per actor: an in-process callback or a hosted
+ * token-exchange endpoint.
+ */
+export type CredentialResolverConfig = {
+    resolve: CredentialResolver;
+} | {
+    endpoint: {
+        url: string;
+    };
+};
+/** The tenant boundary (§5). */
+export type Tenancy = "single" | "multi";
+/** Who can open/resume the conversation (§4). */
+export type ThreadScope = "actor" | "channel" | "tenant";
+/** The durable Store namespace prefix (§4). */
+export type MemoryScope = "actor" | "tenant" | "agent" | "none";
+/** Whose token downstream calls carry (§4, §7). */
+export type CredentialScope = "agent" | "actor" | "none" | "custom";
+/** The whole identity config surface (§13.1). */
+export interface IdentityConfig {
+    /** How MDA learns who is calling (§6). */
+    ingress: {
+        http: HttpIngress;
+    };
+    /** The tenant boundary (§5). */
+    tenancy: Tenancy;
+    /** The three scoping axes (§4). */
+    scoping: {
+        /** Who can open/resume the conversation. */
+        threads?: ThreadScope;
+        /** Durable Store namespace prefix. */
+        memory: MemoryScope;
+        /** Managed mode, or "custom" when a resolver/endpoint is provided below. */
+        credentials?: CredentialScope;
+    };
+    /** Present when `scoping.credentials` is "custom" (or a resolver is set). */
+    credentials?: CredentialResolverConfig;
+}
+/** The object exported from the project's root `identity.ts`. */
+export interface IdentityDefinition {
+    readonly kind: "identity";
+    readonly config: IdentityConfig;
+}
+/** The archetype presets that expand to a full {@link IdentityConfig} (§3). */
+export type IdentityPresetName = "private-assistant" | "multi-tenant-saas" | "shared-bot" | "internal-tool" | "service";
+/** The signature of {@link defineIdentity}, including its `.preset` helper. */
+export interface DefineIdentity {
+    (config: IdentityConfig): IdentityDefinition;
+    /**
+     * Start from a named archetype and optionally override any subset of it. The
+     * headline API for the common case (§3).
+     */
+    preset(name: IdentityPresetName, overrides?: DeepPartial<IdentityConfig>): IdentityDefinition;
+}
+/**
+ * Declare the identity contract for the deployment.
+ *
+ * Most developers call {@link defineIdentity.preset} instead. The three scoping
+ * axes are the power-user layer underneath.
+ */
+export declare const defineIdentity: DefineIdentity;
+/**
+ * A single Supabase region for multi-region introspection. A bare string is the
+ * introspection URL (using the shared `${SUPABASE_ANON_KEY}`); an object pins a
+ * `projectRef` or explicit `url`, plus an optional region-specific `anonKey`
+ * (or raw `headers`) so each region uses its own project and anon key.
+ */
+export type SupabaseRegion = string | {
+    projectRef?: string;
+    url?: string;
+    anonKey?: string;
+    headers?: Record<string, string>;
+};
+/**
+ * Provider integrations — authoring-time sugar over {@link ValidatedTokenProvider}
+ * (§6.2). Each returns a plain provider object you can spread-and-override, so
+ * there is no new runtime surface.
+ */
+export declare const providers: {
+    auth0({ domain, audience, }: {
+        domain: string;
+        audience?: string;
+    }): ValidatedTokenProvider;
+    clerk({ domain }: {
+        domain: string;
+    }): ValidatedTokenProvider;
+    okta({ domain, audience, }: {
+        domain: string;
+        audience?: string;
+    }): ValidatedTokenProvider;
+    cognito({ userPoolId, region, }: {
+        userPoolId: string;
+        region: string;
+    }): ValidatedTokenProvider;
+    entra({ tenantId, audience, }: {
+        tenantId: string;
+        audience?: string;
+    }): ValidatedTokenProvider;
+    google({ audience }?: {
+        audience?: string;
+    }): ValidatedTokenProvider;
+    supabase({ projectRef, introspect, regions, regionHeader, }: {
+        projectRef?: string;
+        introspect?: boolean;
+        /**
+         * Multi-region introspection: map each region to its Supabase project. A
+         * string is a `projectRef`; an object can pin an explicit `url`/`anonKey` (so
+         * each region uses its own project + anon key). Only valid with `introspect`.
+         */
+        regions?: Record<string, SupabaseRegion>;
+        /** Client header carrying the region (default `x-supabase-region`). */
+        regionHeader?: string;
+    }): ValidatedTokenProvider;
+    /** Universal fallback for any OIDC-compliant IdP via discovery. */
+    oidc({ issuer, audience, }: {
+        issuer: string;
+        audience?: string;
+    }): ValidatedTokenProvider;
+    /**
+     * GitHub OAuth access tokens (opaque bearer tokens, not JWTs). MDA verifies
+     * each request by calling `GET https://api.github.com/user` with the token.
+     */
+    github(): ValidatedTokenProvider;
+    /** MDA-issued anonymous/guest tokens. */
+    guest({ ttl, actorPrefix, }?: {
+        ttl?: string;
+        actorPrefix?: string;
+    }): ValidatedTokenProvider;
+};
+/**
+ * Eagerly reject illegal identity configs at authoring time so misconfig never
+ * reaches the compiler or runtime (§4.4).
+ */
+export declare function validateIdentity(config: IdentityConfig): void;
+/** Recursively merge plain objects; arrays and primitives from `patch` win. */
+type DeepPartial<T> = T extends object ? {
+    [K in keyof T]?: DeepPartial<T[K]>;
+} : T;
+export {};
+//# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,mEAAmE;AACnE,MAAM,MAAM,WAAW,GAAG,iBAAiB,GAAG,qBAAqB,CAAC;AAEpE;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,4DAA4D;AAC5D,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,iFAAiF;IACjF,KAAK,CAAC,EAAE;QACN,sDAAsD;QACtD,KAAK,EAAE,OAAO,CAAC;QACf,kCAAkC;QAClC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,+DAA+D;QAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE;QACN,uEAAuE;QACvE,KAAK,EAAE,MAAM,CAAC;QACd,kEAAkE;QAClE,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,oDAAoD;QACpD,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,+DAA+D;AAC/D,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B;IAC5B,IAAI,EAAE,UAAU,GAAG,KAAK,GAAG,YAAY,CAAC;IACxC,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,iDAAiD;AACjD,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,MAAM,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,KAAK,GAAG,QAAQ,CAAC;QAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,8CAA8C;AAC9C,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE;IACtC,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAElC;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAC/B;IAAE,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAElC,gCAAgC;AAChC,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEzC,iDAAiD;AACjD,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;AACzD,+CAA+C;AAC/C,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAChE,mDAAmD;AACnD,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEpE,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF,gCAAgC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,mCAAmC;IACnC,OAAO,EAAE;QACP,4CAA4C;QAC5C,OAAO,CAAC,EAAE,WAAW,CAAC;QACtB,sCAAsC;QACtC,MAAM,EAAE,WAAW,CAAC;QACpB,4EAA4E;QAC5E,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;IACF,6EAA6E;IAC7E,WAAW,CAAC,EAAE,wBAAwB,CAAC;CACxC;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAED,+EAA+E;AAC/E,MAAM,MAAM,kBAAkB,GAC1B,mBAAmB,GACnB,mBAAmB,GACnB,YAAY,GACZ,eAAe,GACf,SAAS,CAAC;AA8Bd,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,CAAC,MAAM,EAAE,cAAc,GAAG,kBAAkB,CAAC;IAC7C;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,SAAS,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,GACtC,kBAAkB,CAAC;CACvB;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,cAoB5B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACtB,MAAM,GACN;IACE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAuCN;;;;GAIG;AACH,eAAO,MAAM,SAAS;iCAIjB;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;sBAUR;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,sBAAsB;gCAY1D;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;qCAavB;QACD,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,sBAAsB;mCAavB;QACD,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;0BAUL;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,sBAAsB;iEAerE;QACD,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QACzC,uEAAuE;QACvE,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,sBAAsB;IA0C1B,mEAAmE;gCAIhE;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;IAS1B;;;OAGG;cACO,sBAAsB;IAehC,yCAAyC;kCAItC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,sBAAsB;CAWxE,CAAC;AAIF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CA0E7D;AA0ED,+EAA+E;AAC/E,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,MAAM,GAClC;KAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GACtC,CAAC,CAAC"}

package/dist/identity.js

@@ -0,0 +1,358 @@
+/**
+ * The managed `identity.ts` declaration primitive.
+ *
+ * A project's root `identity.ts` exports a named `identity` created with
+ * `defineIdentity(...)` (or `defineIdentity.preset(...)`). The compiler
+ * discovers it, generates the custom-auth handler, and wires thread/memory
+ * scoping and downstream credentials. See `specification/identity-final.md`.
+ *
+ * This module is pure authoring-time config construction plus eager validation —
+ * it has no runtime dependency (the `providers.*` helpers return plain data).
+ */
+const PRESETS = {
+    "private-assistant": {
+        ingress: { http: "trusted_backend" },
+        tenancy: "single",
+        scoping: { threads: "actor", memory: "actor", credentials: "actor" },
+    },
+    "multi-tenant-saas": {
+        ingress: { http: "trusted_backend" },
+        tenancy: "multi",
+        scoping: { threads: "actor", memory: "tenant", credentials: "agent" },
+    },
+    "shared-bot": {
+        ingress: { http: "trusted_backend" },
+        tenancy: "single",
+        scoping: { threads: "channel", memory: "actor", credentials: "agent" },
+    },
+    "internal-tool": {
+        ingress: { http: "trusted_backend" },
+        tenancy: "single",
+        scoping: { threads: "actor", memory: "actor", credentials: "agent" },
+    },
+    service: {
+        ingress: { http: "trusted_backend" },
+        tenancy: "single",
+        scoping: { memory: "agent", credentials: "agent" },
+    },
+};
+/**
+ * Declare the identity contract for the deployment.
+ *
+ * Most developers call {@link defineIdentity.preset} instead. The three scoping
+ * axes are the power-user layer underneath.
+ */
+export const defineIdentity = Object.assign(function defineIdentity(config) {
+    validateIdentity(config);
+    return { kind: "identity", config };
+}, {
+    preset(name, overrides) {
+        const base = PRESETS[name];
+        if (base === undefined) {
+            throw new Error(`defineIdentity.preset(...) unknown preset "${String(name)}". ` +
+                `Valid presets: ${Object.keys(PRESETS).join(", ")}.`);
+        }
+        return defineIdentity(deepMerge(base, overrides));
+    },
+});
+function supabaseBase(projectRef) {
+    return `https://${projectRef}.supabase.co/auth/v1`;
+}
+/**
+ * Normalize authoring-time Supabase regions into the runtime `regions` shape. A
+ * bare string stays a URL (using the shared base `apikey`); an object resolves
+ * its `url` from `url`/`projectRef` and, when given, carries region-specific
+ * `headers`/`anonKey` that override the shared `apikey` at introspection time.
+ */
+function normalizeSupabaseRegions(regions) {
+    const out = {};
+    for (const [region, entry] of Object.entries(regions)) {
+        if (typeof entry === "string") {
+            out[region] = entry;
+            continue;
+        }
+        const url = entry.url ??
+            (entry.projectRef ? `${supabaseBase(entry.projectRef)}/user` : undefined);
+        if (!url) {
+            throw new Error(`providers.supabase(...) region "${region}" needs a \`projectRef\` or \`url\`.`);
+        }
+        const headers = entry.headers ?? (entry.anonKey ? { apikey: entry.anonKey } : undefined);
+        out[region] = headers ? { url, headers } : { url };
+    }
+    return out;
+}
+/**
+ * Provider integrations — authoring-time sugar over {@link ValidatedTokenProvider}
+ * (§6.2). Each returns a plain provider object you can spread-and-override, so
+ * there is no new runtime surface.
+ */
+export const providers = {
+    auth0({ domain, audience, }) {
+        return {
+            issuer: `https://${domain}/`,
+            jwks: `https://${domain}/.well-known/jwks.json`,
+            ...(audience ? { audience } : {}),
+            algorithms: ["RS256"],
+            claims: { actor: "sub", tenant: "org_id" },
+        };
+    },
+    clerk({ domain }) {
+        return {
+            issuer: `https://${domain}`,
+            jwks: `https://${domain}/.well-known/jwks.json`,
+            algorithms: ["RS256"],
+            claims: { actor: "sub" },
+        };
+    },
+    okta({ domain, audience, }) {
+        return {
+            issuer: `https://${domain}`,
+            jwks: `https://${domain}/oauth2/v1/keys`,
+            ...(audience ? { audience } : {}),
+            algorithms: ["RS256"],
+            claims: { actor: "sub" },
+        };
+    },
+    cognito({ userPoolId, region, }) {
+        const issuer = `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`;
+        return {
+            issuer,
+            jwks: `${issuer}/.well-known/jwks.json`,
+            algorithms: ["RS256"],
+            claims: { actor: "sub" },
+        };
+    },
+    entra({ tenantId, audience, }) {
+        return {
+            issuer: `https://login.microsoftonline.com/${tenantId}/v2.0`,
+            jwks: `https://login.microsoftonline.com/${tenantId}/discovery/v2.0/keys`,
+            ...(audience ? { audience } : {}),
+            algorithms: ["RS256"],
+            claims: { actor: "oid" },
+        };
+    },
+    google({ audience } = {}) {
+        return {
+            issuer: "https://accounts.google.com",
+            jwks: "https://www.googleapis.com/oauth2/v3/certs",
+            ...(audience ? { audience } : {}),
+            algorithms: ["RS256"],
+            claims: { actor: "sub", email: "email" },
+        };
+    },
+    supabase({ projectRef, introspect, regions, regionHeader = "x-supabase-region", }) {
+        if (introspect) {
+            if (regions) {
+                return {
+                    id: "supabase",
+                    introspect: {
+                        regionHeader,
+                        regions: normalizeSupabaseRegions(regions),
+                        headers: { apikey: "${SUPABASE_ANON_KEY}" },
+                    },
+                    claims: { actor: "email" },
+                };
+            }
+            if (!projectRef) {
+                throw new Error("providers.supabase(...) requires `projectRef` (single region) or `regions`.");
+            }
+            return {
+                id: "supabase",
+                introspect: {
+                    url: `${supabaseBase(projectRef)}/user`,
+                    headers: { apikey: "${SUPABASE_ANON_KEY}" },
+                },
+                claims: { actor: "email" },
+            };
+        }
+        if (!projectRef) {
+            throw new Error("providers.supabase(...) without `introspect` requires `projectRef`.");
+        }
+        const base = supabaseBase(projectRef);
+        return {
+            id: "supabase",
+            issuer: base,
+            jwks: `${base}/.well-known/jwks.json`,
+            algorithms: ["ES256", "RS256"],
+            claims: { actor: "email" },
+        };
+    },
+    /** Universal fallback for any OIDC-compliant IdP via discovery. */
+    oidc({ issuer, audience, }) {
+        return {
+            issuer,
+            discover: true,
+            ...(audience ? { audience } : {}),
+            claims: { actor: "sub" },
+        };
+    },
+    /**
+     * GitHub OAuth access tokens (opaque bearer tokens, not JWTs). MDA verifies
+     * each request by calling `GET https://api.github.com/user` with the token.
+     */
+    github() {
+        return {
+            id: "github",
+            introspect: {
+                url: "https://api.github.com/user",
+                headers: {
+                    Accept: "application/vnd.github+json",
+                    "X-GitHub-Api-Version": "2022-11-28",
+                    "User-Agent": "managed-deepagents-github-example",
+                },
+            },
+            claims: { actor: "login", email: "email" },
+        };
+    },
+    /** MDA-issued anonymous/guest tokens. */
+    guest({ ttl, actorPrefix, } = {}) {
+        return {
+            id: "guest",
+            guest: {
+                issue: true,
+                ...(ttl ? { ttl } : {}),
+                ...(actorPrefix ? { actorPrefix } : {}),
+            },
+            claims: { actor: "sub" },
+        };
+    },
+};
+const MANAGED_CREDENTIAL_MODES = ["agent", "actor", "none"];
+/**
+ * Eagerly reject illegal identity configs at authoring time so misconfig never
+ * reaches the compiler or runtime (§4.4).
+ */
+export function validateIdentity(config) {
+    const provided = config;
+    const ingress = provided.ingress;
+    if (ingress === null || typeof ingress !== "object" || !("http" in ingress)) {
+        throw new Error("defineIdentity(...) requires an `ingress.http` value ('trusted_backend' or a validated_token config).");
+    }
+    const tenancy = provided.tenancy;
+    if (tenancy !== "single" && tenancy !== "multi") {
+        throw new Error('defineIdentity(...) requires `tenancy` to be "single" or "multi".');
+    }
+    const scoping = provided.scoping;
+    if (scoping === null || typeof scoping !== "object") {
+        throw new Error("defineIdentity(...) requires a `scoping` object.");
+    }
+    if (typeof scoping.memory !== "string") {
+        throw new Error('defineIdentity(...) requires `scoping.memory` (one of "actor" | "tenant" | "agent" | "none").');
+    }
+    // tenancy: "single" cannot use any tenant-scoped axis.
+    if (tenancy === "single") {
+        const tenantAxes = ["threads", "memory", "credentials"].filter((axis) => scoping[axis] === "tenant");
+        if (tenantAxes.length > 0) {
+            throw new Error(`defineIdentity(...) cannot use "tenant" scope (${tenantAxes.join(", ")}) with tenancy: "single". Set tenancy: "multi".`);
+        }
+    }
+    // Credentials axis must agree with the presence of a resolver/endpoint.
+    const hasResolver = provided.credentials !== undefined;
+    const credentialsMode = scoping.credentials;
+    if (credentialsMode === "custom" && !hasResolver) {
+        throw new Error('defineIdentity(...) with scoping.credentials: "custom" requires a `credentials` resolver or endpoint.');
+    }
+    if (hasResolver &&
+        typeof credentialsMode === "string" &&
+        MANAGED_CREDENTIAL_MODES.includes(credentialsMode)) {
+        throw new Error(`defineIdentity(...) provides a \`credentials\` resolver but scoping.credentials is "${credentialsMode}". ` +
+            'Set scoping.credentials: "custom" (or remove the resolver).');
+    }
+    if (hasResolver) {
+        validateCredentialResolver(provided.credentials);
+    }
+    // validated_token ingress needs at least one provider, each with claims.actor.
+    const http = ingress.http;
+    if (isValidatedToken(http)) {
+        validateValidatedToken(http);
+    }
+    else if (http !== "trusted_backend") {
+        throw new Error('defineIdentity(...) `ingress.http` must be "trusted_backend" or a { mode: "validated_token", providers: [...] } config.');
+    }
+}
+function isValidatedToken(http) {
+    return (typeof http === "object" &&
+        http !== null &&
+        http.mode === "validated_token");
+}
+function validateValidatedToken(http) {
+    const list = http.providers;
+    if (!Array.isArray(list) || list.length === 0) {
+        throw new Error("defineIdentity(...) validated_token ingress requires a non-empty `providers` list.");
+    }
+    const multiple = list.length > 1;
+    for (const [index, entry] of list.entries()) {
+        const provider = entry;
+        const label = provider?.id ?? `#${index}`;
+        if (provider === null || typeof provider !== "object") {
+            throw new Error(`defineIdentity(...) validated_token provider ${label} must be an object.`);
+        }
+        if (typeof provider.claims !== "object" ||
+            provider.claims === null ||
+            typeof provider.claims.actor !== "string" ||
+            provider.claims.actor.length === 0) {
+            throw new Error(`defineIdentity(...) validated_token provider ${label} requires \`claims.actor\`.`);
+        }
+        if (multiple && typeof provider.id !== "string") {
+            throw new Error("defineIdentity(...) each validated_token provider requires an `id` when more than one is configured.");
+        }
+        const hasVerifier = typeof provider.jwks === "string" ||
+            provider.discover === true ||
+            provider.introspect !== undefined ||
+            provider.guest !== undefined;
+        if (!hasVerifier) {
+            throw new Error(`defineIdentity(...) validated_token provider ${label} must declare one of \`jwks\`, \`discover\`, \`introspect\`, or \`guest\`.`);
+        }
+    }
+}
+function validateCredentialResolver(credentials) {
+    if (credentials === null || typeof credentials !== "object") {
+        throw new Error("defineIdentity(...) `credentials` must be a resolver ({ resolve }) or endpoint ({ endpoint }) config.");
+    }
+    const cfg = credentials;
+    const hasResolveFn = typeof cfg.resolve === "function";
+    const hasEndpoint = typeof cfg.endpoint === "object" &&
+        cfg.endpoint !== null &&
+        typeof cfg.endpoint.url === "string";
+    if (hasResolveFn === hasEndpoint) {
+        throw new Error("defineIdentity(...) `credentials` requires exactly one of `resolve` (function) or `endpoint` ({ url }).");
+    }
+}
+function isPlainObject(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        !Array.isArray(value) &&
+        typeof value !== "function");
+}
+function deepMerge(base, patch) {
+    if (patch === undefined)
+        return structuredCloneConfig(base);
+    if (!isPlainObject(base) || !isPlainObject(patch)) {
+        return patch;
+    }
+    const out = { ...base };
+    for (const [key, value] of Object.entries(patch)) {
+        if (value === undefined)
+            continue;
+        const current = out[key];
+        out[key] =
+            isPlainObject(current) && isPlainObject(value)
+                ? deepMerge(current, value)
+                : value;
+    }
+    return out;
+}
+function structuredCloneConfig(value) {
+    if (Array.isArray(value)) {
+        return value.map((item) => structuredCloneConfig(item));
+    }
+    if (isPlainObject(value)) {
+        const out = {};
+        for (const [key, inner] of Object.entries(value)) {
+            out[key] = structuredCloneConfig(inner);
+        }
+        return out;
+    }
+    return value;
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiLH,MAAM,OAAO,GAA+C;IAC1D,mBAAmB,EAAE;QACnB,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;KACrE;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE;KACtE;IACD,YAAY,EAAE;QACZ,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;KACvE;IACD,eAAe,EAAE;QACf,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;KACrE;IACD,OAAO,EAAE;QACP,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;KACnD;CACF,CAAC;AAeF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAmB,MAAM,CAAC,MAAM,CACzD,SAAS,cAAc,CAAC,MAAsB;IAC5C,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC,EACD;IACE,MAAM,CACJ,IAAwB,EACxB,SAAuC;QAEvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,8CAA8C,MAAM,CAAC,IAAI,CAAC,KAAK;gBAC7D,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvD,CAAC;QACJ,CAAC;QACD,OAAO,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACpD,CAAC;CACF,CACF,CAAC;AAiBF,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO,WAAW,UAAU,sBAAsB,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,OAAuC;IAEvC,MAAM,GAAG,GAGL,EAAE,CAAC;IACP,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GACP,KAAK,CAAC,GAAG;YACT,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,sCAAsC,CAChF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,KAAK,CAAC,EACJ,MAAM,EACN,QAAQ,GAIT;QACC,OAAO;YACL,MAAM,EAAE,WAAW,MAAM,GAAG;YAC5B,IAAI,EAAE,WAAW,MAAM,wBAAwB;YAC/C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,EAAE,MAAM,EAAsB;QAClC,OAAO;YACL,MAAM,EAAE,WAAW,MAAM,EAAE;YAC3B,IAAI,EAAE,WAAW,MAAM,wBAAwB;YAC/C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,EACH,MAAM,EACN,QAAQ,GAIT;QACC,OAAO;YACL,MAAM,EAAE,WAAW,MAAM,EAAE;YAC3B,IAAI,EAAE,WAAW,MAAM,iBAAiB;YACxC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,EACN,UAAU,EACV,MAAM,GAIP;QACC,MAAM,MAAM,GAAG,uBAAuB,MAAM,kBAAkB,UAAU,EAAE,CAAC;QAC3E,OAAO;YACL,MAAM;YACN,IAAI,EAAE,GAAG,MAAM,wBAAwB;YACvC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,EACJ,QAAQ,EACR,QAAQ,GAIT;QACC,OAAO;YACL,MAAM,EAAE,qCAAqC,QAAQ,OAAO;YAC5D,IAAI,EAAE,qCAAqC,QAAQ,sBAAsB;YACzE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,EAAE,QAAQ,KAA4B,EAAE;QAC7C,OAAO;YACL,MAAM,EAAE,6BAA6B;YACrC,IAAI,EAAE,4CAA4C;YAClD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,EACP,UAAU,EACV,UAAU,EACV,OAAO,EACP,YAAY,GAAG,mBAAmB,GAYnC;QACC,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;oBACL,EAAE,EAAE,UAAU;oBACd,UAAU,EAAE;wBACV,YAAY;wBACZ,OAAO,EAAE,wBAAwB,CAAC,OAAO,CAAC;wBAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;qBAC5C;oBACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;iBAC3B,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,UAAU;gBACd,UAAU,EAAE;oBACV,GAAG,EAAE,GAAG,YAAY,CAAC,UAAU,CAAC,OAAO;oBACvC,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;iBAC5C;gBACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;aAC3B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,UAAU;YACd,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,IAAI,wBAAwB;YACrC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3B,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,IAAI,CAAC,EACH,MAAM,EACN,QAAQ,GAIT;QACC,OAAO;YACL,MAAM;YACN,QAAQ,EAAE,IAAI;YACd,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,OAAO;YACL,EAAE,EAAE,QAAQ;YACZ,UAAU,EAAE;gBACV,GAAG,EAAE,6BAA6B;gBAClC,OAAO,EAAE;oBACP,MAAM,EAAE,6BAA6B;oBACrC,sBAAsB,EAAE,YAAY;oBACpC,YAAY,EAAE,mCAAmC;iBAClD;aACF;YACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,yCAAyC;IACzC,KAAK,CAAC,EACJ,GAAG,EACH,WAAW,MAC+B,EAAE;QAC5C,OAAO;YACL,EAAE,EAAE,OAAO;YACX,KAAK,EAAE;gBACL,KAAK,EAAE,IAAI;gBACX,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC;YACD,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,wBAAwB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAErE;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,MAAM,QAAQ,GAAG,MAA4C,CAAC;IAE9D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAyC,CAAC;IACnE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAEZ,CAAC;IACd,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,uDAAuD;IACvD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,UAAU,GAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAW,CAAC,MAAM,CACvE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ,CACrC,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,kDAAkD,UAAU,CAAC,IAAI,CAC/D,IAAI,CACL,iDAAiD,CACnD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC;IACvD,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC;IAC5C,IAAI,eAAe,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,IACE,WAAW;QACX,OAAO,eAAe,KAAK,QAAQ;QAClC,wBAA8C,CAAC,QAAQ,CAAC,eAAe,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uFAAuF,eAAe,KAAK;YACzG,6DAA6D,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,0BAA0B,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnD,CAAC;IAED,+EAA+E;IAC/E,MAAM,IAAI,GAAI,OAA6B,CAAC,IAAI,CAAC;IACjD,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;SAAM,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,yHAAyH,CAC1H,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA2B,CAAC,IAAI,KAAK,iBAAiB,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAA2B;IACzD,MAAM,IAAI,GAAI,IAAgC,CAAC,SAAS,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAA+B,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,EAAE,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,qBAAqB,CAC3E,CAAC;QACJ,CAAC;QACD,IACE,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;YACnC,QAAQ,CAAC,MAAM,KAAK,IAAI;YACxB,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ;YACzC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAClC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,6BAA6B,CACnF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GACf,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;YACjC,QAAQ,CAAC,QAAQ,KAAK,IAAI;YAC1B,QAAQ,CAAC,UAAU,KAAK,SAAS;YACjC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC;QAC/B,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,4EAA4E,CAClI,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,WAAoB;IACtD,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,WAAwD,CAAC;IACrE,MAAM,YAAY,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,CAAC;IACvD,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAChC,GAAG,CAAC,QAAQ,KAAK,IAAI;QACrB,OAAQ,GAAG,CAAC,QAA8B,CAAC,GAAG,KAAK,QAAQ,CAAC;IAC9D,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,yGAAyG,CAC1G,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,OAAO,KAAK,KAAK,UAAU,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAI,IAAO,EAAE,KAAiC;IAC9D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,KAAU,CAAC;IACpB,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC;YACN,aAAa,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC;gBAC5C,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,KAAoC,CAAC;gBAC1D,CAAC,CAAC,KAAK,CAAC;IACd,CAAC;IACD,OAAO,GAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAI,KAAQ;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAiB,CAAC;IAC1E,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,GAAG,CAAC,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,GAAQ,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/index.d.ts

@@ -2,8 +2,11 @@ export { defineDeepAgent } from "./define-deep-agent.js";
 export { defineMcpServers } from "./connectors.js";
 export { defineSchedule } from "./schedules.js";
 export { defineSandbox } from "./sandbox.js";
+export { defineIdentity, providers, validateIdentity } from "./identity.js";
+export type { CredentialResolver, CredentialResolverConfig, CredentialScope, CredentialTarget, DefineIdentity, HttpIngress, IdentityConfig, IdentityDefinition, IdentityPresetName, MemoryScope, ResolvedCredential, RuntimeIdentity, Tenancy, ThreadScope, ValidatedTokenIngress, ValidatedTokenProvider, } from "./identity.js";
 export type { HttpMcpServerConfig, McpServersConfig, McpServersDefinition, McpToolSelectionConfig, RemoteMcpServerBaseConfig, RemoteMcpServerConfig, SseMcpServerConfig, } from "./connectors.js";
 export type { ScheduleConfig, ScheduleDefinition, ScheduleDeliveryTarget, ScheduleThreadConfig, } from "./schedules.js";
 export type { ChannelAttachment, ChannelDestination, ChannelEvent, ChannelMessage, ChannelPostOptions, DeepAgentDefinition, DefineDeepAgentConfig, ManagedDeepAgentKey, PostedChannelMessage, Runtime, RuntimeChannel, } from "./types.js";
+export type { ManagedDeepAgentRuntime, ManagedRuntimeExtras, } from "./runtime/managed-tools.js";
 export type { DefineSandboxOptions, ManagedSandboxOptionKey, SandboxDefinition, SandboxProviderClass, SandboxProviderOptions, SandboxScope, } from "./sandbox.js";
 //# sourceMappingURL=index.d.ts.map