managed-deepagents 0.0.3-dev.38 → 0.1.0

package/dist/connectors/langsmith.js

@@ -1,262 +0,0 @@
-/**
- * LangSmith connector — authoring surface.
- *
- * A capability-delegation layer for *external / untrusted* callers (browsers,
- * channels, schedules). The deployment declares a small set of constrained
- * LangSmith capabilities; MDA performs them server-side with the workspace key
- * and returns allowlisted responses. The browser never receives
- * `LANGSMITH_API_KEY`.
- *
- * This module is authoring-only: typed per-resource builders + presets that
- * compile to grants, plus eager validation. The runtime enforcement engine lives
- * in `runtime/langsmith-connector.ts` and is imported lazily by the connector's
- * `http` hook so authoring installs stay light.
- */
-import { CONNECTOR_BRAND, } from "../runtime/connector.js";
-/** Conservative default `include` allowlists per resource (browser-safe). */
-const DEFAULT_INCLUDE = {
-    runs: ["id", "status", "start_time", "end_time", "url", "metadata"],
-    feedback: ["id", "run_id", "key", "score", "created_at"],
-    examples: ["id", "dataset_id", "created_at"],
-    prompts: ["name", "commit_hash", "updated_at"],
-    threads: ["thread_id", "created_at", "metadata.title"],
-};
-/** Fields that can never reach a browser without an explicit `allowSensitive`. */
-const SENSITIVE_FIELDS = {
-    runs: ["inputs", "outputs", "events"],
-    prompts: ["content", "messages"],
-    threads: ["messages", "values"],
-};
-/** Constraint keys each resource understands. Unknown keys fail validation. */
-const ALLOWED_CONSTRAINT_KEYS = {
-    runs: [],
-    feedback: ["keys", "scores", "maxCommentChars", "onePerActor"],
-    examples: ["dataset", "allowedFields", "maxExamplesPerThread"],
-    annotation_queues: ["queue", "allowedPriorities", "maxNoteChars"],
-    prompts: [],
-    threads: ["metadataKeys", "maxTitleChars"],
-};
-function omitUndefined(value) {
-    return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== undefined));
-}
-export function runs(options) {
-    return {
-        id: options.id,
-        exposeTo: options.exposeTo,
-        resource: "runs",
-        actions: options.actions,
-        scope: options.scope,
-        response: {
-            include: options.include ?? DEFAULT_INCLUDE.runs,
-            redact: options.redact ?? SENSITIVE_FIELDS.runs,
-        },
-        ...(options.allowSensitive
-            ? { allowSensitive: options.allowSensitive }
-            : {}),
-    };
-}
-export function feedback(options) {
-    return {
-        id: options.id,
-        exposeTo: options.exposeTo,
-        resource: "feedback",
-        actions: options.actions,
-        scope: options.scope ?? "run",
-        constraints: omitUndefined({
-            keys: options.keys,
-            scores: options.scores,
-            maxCommentChars: options.maxCommentChars,
-            onePerActor: options.onePerActor,
-        }),
-        response: { include: options.include ?? DEFAULT_INCLUDE.feedback },
-    };
-}
-export function examples(options) {
-    return {
-        id: options.id,
-        exposeTo: options.exposeTo,
-        resource: "examples",
-        actions: options.actions,
-        scope: options.scope ?? "thread",
-        constraints: omitUndefined({
-            dataset: options.dataset,
-            allowedFields: options.allowedFields,
-            maxExamplesPerThread: options.maxExamplesPerThread,
-        }),
-        response: { include: options.include ?? DEFAULT_INCLUDE.examples },
-    };
-}
-export function annotationQueues(options) {
-    return {
-        id: options.id,
-        exposeTo: options.exposeTo,
-        resource: "annotation_queues",
-        actions: options.actions,
-        scope: options.scope ?? "run",
-        constraints: omitUndefined({
-            queue: options.queue,
-            allowedPriorities: options.allowedPriorities,
-            maxNoteChars: options.maxNoteChars,
-        }),
-        // Enqueue is a write with no readable body; include stays minimal.
-        response: { include: ["id"] },
-    };
-}
-export function prompts(options) {
-    return {
-        id: options.id,
-        exposeTo: options.exposeTo,
-        resource: "prompts",
-        actions: options.actions,
-        scope: options.scope ?? "agent",
-        response: {
-            include: options.include ?? DEFAULT_INCLUDE.prompts,
-            redact: options.redact ?? SENSITIVE_FIELDS.prompts,
-        },
-    };
-}
-export function threads(options) {
-    return {
-        id: options.id,
-        exposeTo: options.exposeTo,
-        resource: "threads",
-        actions: options.actions,
-        scope: options.scope ?? "actor",
-        constraints: omitUndefined({
-            metadataKeys: options.metadataKeys,
-            maxTitleChars: options.maxTitleChars,
-        }),
-        response: {
-            include: options.include ?? DEFAULT_INCLUDE.threads,
-            redact: SENSITIVE_FIELDS.threads,
-        },
-        ...(options.allowSensitive
-            ? { allowSensitive: options.allowSensitive }
-            : {}),
-    };
-}
-// --- Presets ---------------------------------------------------------------
-/**
- * The whole browser feedback surface: create/update/delete one bounded feedback
- * per actor on a run, plus capturing the conversation into a fixed dataset.
- * Emits deterministic namespaced ids so the public route contract is stable.
- */
-export function chatFeedback(options) {
-    return [
-        feedback({
-            id: "langsmith:chat-feedback",
-            exposeTo: ["browser"],
-            actions: ["create", "update", "delete"],
-            scope: "run",
-            keys: ["user_score"],
-            scores: ["positive", "negative"],
-            maxCommentChars: 2000,
-            onePerActor: true,
-        }),
-        examples({
-            id: "langsmith:chat-feedback-examples",
-            exposeTo: ["browser"],
-            actions: ["create"],
-            scope: "thread",
-            dataset: options.dataset,
-            allowedFields: ["messages", "answer", "feedback", "source"],
-        }),
-    ];
-}
-/** A read-only, redacted trace viewer: run summary + share link. */
-export function traceViewer() {
-    return [
-        runs({
-            id: "langsmith:trace-viewer",
-            exposeTo: ["browser"],
-            actions: ["read", "share"],
-            scope: "thread",
-        }),
-    ];
-}
-// --- Validation ------------------------------------------------------------
-/**
- * Fail-closed authoring checks that do not require the identity config. The
- * identity-dependent checks (scope/ingress sanity, tenancy) run when the
- * connector's `http` hook is mounted, where the resolved identity is available.
- */
-export function validateLangSmithConnector(capabilities) {
-    if (capabilities.length === 0) {
-        throw new Error("langsmith.connector(...) requires at least one capability.");
-    }
-    const seen = new Set();
-    for (const capability of capabilities) {
-        validateCapability(capability, seen);
-    }
-}
-function validateCapability(capability, seen) {
-    if (!capability.id) {
-        throw new Error("Every LangSmith capability requires an `id`.");
-    }
-    if (seen.has(capability.id)) {
-        throw new Error(`Duplicate LangSmith capability id: "${capability.id}".`);
-    }
-    seen.add(capability.id);
-    if (capability.exposeTo.length === 0) {
-        throw new Error(`LangSmith capability "${capability.id}" must declare at least one exposeTo surface.`);
-    }
-    if (capability.actions.length === 0) {
-        throw new Error(`LangSmith capability "${capability.id}" must declare at least one action.`);
-    }
-    // Every external-surface grant needs an explicit include allowlist.
-    const include = capability.response?.include;
-    if (!include || include.length === 0) {
-        throw new Error(`LangSmith capability "${capability.id}" must set response.include ` +
-            `(fail-closed: unknown fields are dropped).`);
-    }
-    assertSensitiveOptIn(capability, include);
-    assertKnownConstraintKeys(capability);
-}
-function assertSensitiveOptIn(capability, include) {
-    const sensitive = SENSITIVE_FIELDS[capability.resource] ?? [];
-    const acknowledged = new Set(capability.allowSensitive ?? []);
-    const browserExposed = capability.exposeTo.includes("browser");
-    if (!browserExposed) {
-        return;
-    }
-    for (const field of include) {
-        const root = field.split(".")[0] ?? field;
-        if (sensitive.includes(root) && !acknowledged.has(root)) {
-            throw new Error(`LangSmith capability "${capability.id}" includes sensitive field ` +
-                `"${root}" for a browser surface. Add allowSensitive: ["${root}"] to ` +
-                `acknowledge exposing it.`);
-        }
-    }
-}
-function assertKnownConstraintKeys(capability) {
-    const allowed = ALLOWED_CONSTRAINT_KEYS[capability.resource];
-    if (!capability.constraints || allowed === undefined) {
-        return;
-    }
-    for (const key of Object.keys(capability.constraints)) {
-        if (!allowed.includes(key)) {
-            throw new Error(`LangSmith capability "${capability.id}" has unknown constraint ` +
-                `"${key}" for resource "${capability.resource}".`);
-        }
-    }
-}
-/**
- * Build a branded LangSmith connector from capabilities (or preset-produced
- * capability arrays). Runs {@link validateLangSmithConnector} eagerly, then
- * returns a connector whose `http` hook mounts the enforcement engine.
- */
-export function connector(...capabilities) {
-    const flat = capabilities.flat();
-    validateLangSmithConnector(flat);
-    const instance = {
-        [CONNECTOR_BRAND]: true,
-        kind: "langsmith",
-        capabilities: flat,
-        async http(ctx) {
-            const { mountLangSmithRoutes } = await import("../runtime/langsmith-connector.js");
-            mountLangSmithRoutes(ctx, flat);
-        },
-    };
-    return instance;
-}
-//# sourceMappingURL=langsmith.js.map

package/dist/connectors/langsmith.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"langsmith.js","sourceRoot":"","sources":["../../src/connectors/langsmith.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,eAAe,GAGhB,MAAM,yBAAyB,CAAC;AAsDjC,6EAA6E;AAC7E,MAAM,eAAe,GAAiD;IACpE,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC;IACnE,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC;IACxD,QAAQ,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,YAAY,CAAC;IAC5C,OAAO,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC;IAC9C,OAAO,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,gBAAgB,CAAC;CACvD,CAAC;AAEF,kFAAkF;AAClF,MAAM,gBAAgB,GAAiD;IACrE,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;IACrC,OAAO,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;IAChC,OAAO,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;CAChC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,uBAAuB,GAAiD;IAC5E,IAAI,EAAE,EAAE;IACR,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,aAAa,CAAC;IAC9D,QAAQ,EAAE,CAAC,SAAS,EAAE,eAAe,EAAE,sBAAsB,CAAC;IAC9D,iBAAiB,EAAE,CAAC,OAAO,EAAE,mBAAmB,EAAE,cAAc,CAAC;IACjE,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;CAC3C,CAAC;AAEF,SAAS,aAAa,CAAoC,KAAQ;IAChE,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CACpD,CAAC;AACT,CAAC;AAcD,MAAM,UAAU,IAAI,CAAC,OAA8B;IACjD,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE;YACR,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,IAAI;YAChD,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAAC,IAAI;SAChD;QACD,GAAG,CAAC,OAAO,CAAC,cAAc;YACxB,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAcD,MAAM,UAAU,QAAQ,CACtB,OAAkC;IAElC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK;QAC7B,WAAW,EAAE,aAAa,CAAC;YACzB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;QACF,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,QAAQ,EAAE;KACnE,CAAC;AACJ,CAAC;AAaD,MAAM,UAAU,QAAQ,CACtB,OAAkC;IAElC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,QAAQ;QAChC,WAAW,EAAE,aAAa,CAAC;YACzB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;SACnD,CAAC;QACF,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,QAAQ,EAAE;KACnE,CAAC;AACJ,CAAC;AAYD,MAAM,UAAU,gBAAgB,CAC9B,OAA0C;IAE1C,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK;QAC7B,WAAW,EAAE,aAAa,CAAC;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC;QACF,mEAAmE;QACnE,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE;KAC9B,CAAC;AACJ,CAAC;AAWD,MAAM,UAAU,OAAO,CACrB,OAAiC;IAEjC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO;QAC/B,QAAQ,EAAE;YACR,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,OAAO;YACnD,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAAC,OAAO;SACnD;KACF,CAAC;AACJ,CAAC;AAaD,MAAM,UAAU,OAAO,CACrB,OAAiC;IAEjC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO;QAC/B,WAAW,EAAE,aAAa,CAAC;YACzB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC;QACF,QAAQ,EAAE;YACR,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,OAAO;YACnD,MAAM,EAAE,gBAAgB,CAAC,OAAO;SACjC;QACD,GAAG,CAAC,OAAO,CAAC,cAAc;YACxB,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAE5B;IACC,OAAO;QACL,QAAQ,CAAC;YACP,EAAE,EAAE,yBAAyB;YAC7B,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;YACvC,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,CAAC,YAAY,CAAC;YACpB,MAAM,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC;YAChC,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,IAAI;SAClB,CAAC;QACF,QAAQ,CAAC;YACP,EAAE,EAAE,kCAAkC;YACtC,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,CAAC,QAAQ,CAAC;YACnB,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC;SAC5D,CAAC;KACH,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,IAAI,CAAC;YACH,EAAE,EAAE,wBAAwB;YAC5B,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;YAC1B,KAAK,EAAE,QAAQ;SAChB,CAAC;KACH,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,YAAmC;IAEnC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;QACtC,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,UAA+B,EAC/B,IAAiB;IAEjB,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAExB,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,yBAAyB,UAAU,CAAC,EAAE,+CAA+C,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,yBAAyB,UAAU,CAAC,EAAE,qCAAqC,CAC5E,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,yBAAyB,UAAU,CAAC,EAAE,8BAA8B;YAClE,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1C,yBAAyB,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,oBAAoB,CAC3B,UAA+B,EAC/B,OAAiB;IAEjB,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC/D,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QAC1C,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,yBAAyB,UAAU,CAAC,EAAE,6BAA6B;gBACjE,IAAI,IAAI,kDAAkD,IAAI,QAAQ;gBACtE,0BAA0B,CAC7B,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,UAA+B;IAChE,MAAM,OAAO,GAAG,uBAAuB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,WAAW,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO;IACT,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,yBAAyB,UAAU,CAAC,EAAE,2BAA2B;gBAC/D,IAAI,GAAG,mBAAmB,UAAU,CAAC,QAAQ,IAAI,CACpD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,GAAG,YAAgE;IAEnE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;IACjC,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAEjC,MAAM,QAAQ,GAAG;QACf,CAAC,eAAe,CAAC,EAAE,IAAa;QAChC,IAAI,EAAE,WAAoB;QAC1B,YAAY,EAAE,IAAI;QAClB,KAAK,CAAC,IAAI,CAAC,GAAgB;YACzB,MAAM,EAAE,oBAAoB,EAAE,GAC5B,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAC;YACpD,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/identity.d.ts

@@ -1,273 +0,0 @@
-/**
- * The managed `identity.ts` declaration primitive.
- *
- * A project's root `identity.ts` exports a named `identity` created with
- * `defineIdentity(...)` (or `defineIdentity.preset(...)`). The compiler
- * discovers it, generates the custom-auth handler, and wires thread/memory
- * scoping and downstream credentials. See `specification/identity-final.md`.
- *
- * This module is pure authoring-time config construction plus eager validation —
- * it has no runtime dependency (the `providers.*` helpers return plain data).
- */
-/** How MDA learns who is calling on the HTTP ingress path (§6). */
-export type HttpIngress = "trusted_backend" | ValidatedTokenIngress;
-/**
- * Browser-direct ingress: MDA verifies the caller's own IdP token server-side
- * and derives identity from its claims (§6.2).
- */
-export interface ValidatedTokenIngress {
-    mode: "validated_token";
-    /**
-     * The token families this deployment accepts (non-empty). MDA selects a
-     * provider per request by the token issuer (`iss`). Use one entry for a single
-     * IdP; `id` is required once there is more than one entry.
-     */
-    providers: ValidatedTokenProvider[];
-}
-/** A single token family MDA knows how to verify (§6.2). */
-export interface ValidatedTokenProvider {
-    /** Label used for routing; required only when there is more than one provider. */
-    id?: string;
-    /** Expected token issuer (`iss`) — the routing/verification key for real IdP tokens. */
-    issuer?: string;
-    /** Expected audience (`aud`), so tokens minted for other apps are rejected. */
-    audience?: string;
-    /** Accepted signing algorithms, e.g. `["RS256"]`. */
-    algorithms?: string[];
-    /**
-     * URL of the IdP's public keys (JWKS). MDA verifies the signature locally —
-     * the recommended path for most OAuth/OIDC providers.
-     */
-    jwks?: string;
-    /**
-     * Resolve `jwks`/endpoints from `issuer/.well-known/openid-configuration`
-     * instead of a literal `jwks` URL (what `providers.oidc` sets).
-     */
-    discover?: boolean;
-    /**
-     * Only for opaque tokens: verify by calling the IdP once per request
-     * (e.g. Supabase `/auth/v1/user`).
-     */
-    introspect?: {
-        /** Single introspection endpoint (the common case). */
-        url?: string;
-        /** Provider-specific endpoint selection by a client header (e.g. Supabase region). */
-        regionHeader?: string;
-        /**
-         * Region value → introspection endpoint. A bare string is the URL (using the
-         * shared `headers` below); an object also carries region-specific headers
-         * (e.g. a per-region Supabase `apikey`), which override the shared ones.
-         */
-        regions?: Record<string, string | {
-            url: string;
-            headers?: Record<string, string>;
-        }>;
-        /** Static headers sent with the introspection call (e.g. Supabase `apikey`). */
-        headers?: Record<string, string>;
-        /** Where MDA puts the user's token when calling the endpoint. Default: "authorization". */
-        tokenIn?: "authorization" | "header";
-        /** Custom header name when `tokenIn` is "header". */
-        header?: string;
-    };
-    /** MDA issues + verifies short-lived signed tokens for anonymous/guest users. */
-    guest?: {
-        /** Enable an issue/reissue path for this provider. */
-        issue: boolean;
-        /** Token lifetime, e.g. "24h". */
-        ttl?: string;
-        /** Prefix applied to the generated actor id, e.g. "guest:". */
-        actorPrefix?: string;
-    };
-    /** Maps verified token claims → identity envelope fields. */
-    claims: {
-        /** Claim used as `runtime.identity.actor.id` (e.g. "sub", "email"). */
-        actor: string;
-        /** Claim used as `runtime.identity.tenant.id` (e.g. "org_id"). */
-        tenant?: string;
-        /** Claim used as `runtime.identity.actor.email`. */
-        email?: string;
-    };
-}
-/** Which downstream call needs a credential right now (§7). */
-export interface CredentialTarget {
-    /** What is being called. */
-    kind: "subagent" | "mcp" | "connection" | "langsmith";
-    /** The configured name, e.g. "code-reviewer" | "docs" | "github". */
-    name: string;
-    /** Optional read/write hint so the resolver can mint different tokens (§7.6). */
-    intent?: "read" | "write";
-    /** Current thread, when the credential is thread-specific. */
-    threadId?: string;
-    /** Free-form context (e.g. `{ repo, installationId }`); part of the cache key. */
-    metadata?: Record<string, unknown>;
-}
-/** What a credential resolver returns (§7.2). */
-export interface ResolvedCredential {
-    /** Headers MDA attaches to the downstream call (usually Authorization). */
-    headers: Record<string, string>;
-    /** ISO expiry; MDA caches per (actor, tenant, target) until then. */
-    expiresAt?: string;
-}
-/** The frozen identity envelope tools and middleware see (§8). */
-export interface RuntimeIdentity {
-    actor: {
-        type: "user" | "service";
-        id: string;
-        email?: string;
-    };
-    tenant?: {
-        id: string;
-    };
-    source: {
-        provider: "http" | "slack" | "schedule" | "cli" | "studio";
-        threadId?: string;
-    };
-    claims?: Record<string, unknown>;
-}
-/** An in-process resolver callback (§7.2). */
-export type CredentialResolver = (args: {
-    identity: RuntimeIdentity;
-    target: CredentialTarget;
-}) => Promise<ResolvedCredential>;
-/**
- * Provide this (with `scoping.credentials: "custom"`) to mint your own
- * downstream credentials per actor: an in-process callback or a hosted
- * token-exchange endpoint.
- */
-export type CredentialResolverConfig = {
-    resolve: CredentialResolver;
-} | {
-    endpoint: {
-        url: string;
-    };
-};
-/** The tenant boundary (§5). */
-export type Tenancy = "single" | "multi";
-/** Who can open/resume the conversation (§4). */
-export type ThreadScope = "actor" | "channel" | "tenant";
-/** The durable Store namespace prefix (§4). */
-export type MemoryScope = "actor" | "tenant" | "agent" | "none";
-/** Whose token downstream calls carry (§4, §7). */
-export type CredentialScope = "agent" | "actor" | "none" | "custom";
-/** The whole identity config surface (§13.1). */
-export interface IdentityConfig {
-    /** How MDA learns who is calling (§6). */
-    ingress: {
-        http: HttpIngress;
-    };
-    /** The tenant boundary (§5). */
-    tenancy: Tenancy;
-    /** The three scoping axes (§4). */
-    scoping: {
-        /** Who can open/resume the conversation. */
-        threads?: ThreadScope;
-        /** Durable Store namespace prefix. */
-        memory: MemoryScope;
-        /** Managed mode, or "custom" when a resolver/endpoint is provided below. */
-        credentials?: CredentialScope;
-    };
-    /** Present when `scoping.credentials` is "custom" (or a resolver is set). */
-    credentials?: CredentialResolverConfig;
-}
-/** The object exported from the project's root `identity.ts`. */
-export interface IdentityDefinition {
-    readonly kind: "identity";
-    readonly config: IdentityConfig;
-}
-/** The archetype presets that expand to a full {@link IdentityConfig} (§3). */
-export type IdentityPresetName = "private-assistant" | "multi-tenant-saas" | "shared-bot" | "internal-tool" | "service";
-/** The signature of {@link defineIdentity}, including its `.preset` helper. */
-export interface DefineIdentity {
-    (config: IdentityConfig): IdentityDefinition;
-    /**
-     * Start from a named archetype and optionally override any subset of it. The
-     * headline API for the common case (§3).
-     */
-    preset(name: IdentityPresetName, overrides?: DeepPartial<IdentityConfig>): IdentityDefinition;
-}
-/**
- * Declare the identity contract for the deployment.
- *
- * Most developers call {@link defineIdentity.preset} instead. The three scoping
- * axes are the power-user layer underneath.
- */
-export declare const defineIdentity: DefineIdentity;
-/**
- * A single Supabase region for multi-region introspection. A bare string is the
- * introspection URL (using the shared `${SUPABASE_ANON_KEY}`); an object pins a
- * `projectRef` or explicit `url`, plus an optional region-specific `anonKey`
- * (or raw `headers`) so each region uses its own project and anon key.
- */
-export type SupabaseRegion = string | {
-    projectRef?: string;
-    url?: string;
-    anonKey?: string;
-    headers?: Record<string, string>;
-};
-/**
- * Provider integrations — authoring-time sugar over {@link ValidatedTokenProvider}
- * (§6.2). Each returns a plain provider object you can spread-and-override, so
- * there is no new runtime surface.
- */
-export declare const providers: {
-    auth0({ domain, audience, }: {
-        domain: string;
-        audience?: string;
-    }): ValidatedTokenProvider;
-    clerk({ domain }: {
-        domain: string;
-    }): ValidatedTokenProvider;
-    okta({ domain, audience, }: {
-        domain: string;
-        audience?: string;
-    }): ValidatedTokenProvider;
-    cognito({ userPoolId, region, }: {
-        userPoolId: string;
-        region: string;
-    }): ValidatedTokenProvider;
-    entra({ tenantId, audience, }: {
-        tenantId: string;
-        audience?: string;
-    }): ValidatedTokenProvider;
-    google({ audience }?: {
-        audience?: string;
-    }): ValidatedTokenProvider;
-    supabase({ projectRef, introspect, regions, regionHeader, }: {
-        projectRef?: string;
-        introspect?: boolean;
-        /**
-         * Multi-region introspection: map each region to its Supabase project. A
-         * string is a `projectRef`; an object can pin an explicit `url`/`anonKey` (so
-         * each region uses its own project + anon key). Only valid with `introspect`.
-         */
-        regions?: Record<string, SupabaseRegion>;
-        /** Client header carrying the region (default `x-supabase-region`). */
-        regionHeader?: string;
-    }): ValidatedTokenProvider;
-    /** Universal fallback for any OIDC-compliant IdP via discovery. */
-    oidc({ issuer, audience, }: {
-        issuer: string;
-        audience?: string;
-    }): ValidatedTokenProvider;
-    /**
-     * GitHub OAuth access tokens (opaque bearer tokens, not JWTs). MDA verifies
-     * each request by calling `GET https://api.github.com/user` with the token.
-     */
-    github(): ValidatedTokenProvider;
-    /** MDA-issued anonymous/guest tokens. */
-    guest({ ttl, actorPrefix, }?: {
-        ttl?: string;
-        actorPrefix?: string;
-    }): ValidatedTokenProvider;
-};
-/**
- * Eagerly reject illegal identity configs at authoring time so misconfig never
- * reaches the compiler or runtime (§4.4).
- */
-export declare function validateIdentity(config: IdentityConfig): void;
-/** Recursively merge plain objects; arrays and primitives from `patch` win. */
-type DeepPartial<T> = T extends object ? {
-    [K in keyof T]?: DeepPartial<T[K]>;
-} : T;
-export {};
-//# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,mEAAmE;AACnE,MAAM,MAAM,WAAW,GAAG,iBAAiB,GAAG,qBAAqB,CAAC;AAEpE;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,4DAA4D;AAC5D,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,iFAAiF;IACjF,KAAK,CAAC,EAAE;QACN,sDAAsD;QACtD,KAAK,EAAE,OAAO,CAAC;QACf,kCAAkC;QAClC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,+DAA+D;QAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE;QACN,uEAAuE;QACvE,KAAK,EAAE,MAAM,CAAC;QACd,kEAAkE;QAClE,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,oDAAoD;QACpD,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,+DAA+D;AAC/D,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B;IAC5B,IAAI,EAAE,UAAU,GAAG,KAAK,GAAG,YAAY,GAAG,WAAW,CAAC;IACtD,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,iDAAiD;AACjD,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,MAAM,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,KAAK,GAAG,QAAQ,CAAC;QAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,8CAA8C;AAC9C,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE;IACtC,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAElC;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAC/B;IAAE,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAElC,gCAAgC;AAChC,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEzC,iDAAiD;AACjD,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;AACzD,+CAA+C;AAC/C,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAChE,mDAAmD;AACnD,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEpE,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF,gCAAgC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,mCAAmC;IACnC,OAAO,EAAE;QACP,4CAA4C;QAC5C,OAAO,CAAC,EAAE,WAAW,CAAC;QACtB,sCAAsC;QACtC,MAAM,EAAE,WAAW,CAAC;QACpB,4EAA4E;QAC5E,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;IACF,6EAA6E;IAC7E,WAAW,CAAC,EAAE,wBAAwB,CAAC;CACxC;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAED,+EAA+E;AAC/E,MAAM,MAAM,kBAAkB,GAC1B,mBAAmB,GACnB,mBAAmB,GACnB,YAAY,GACZ,eAAe,GACf,SAAS,CAAC;AA8Bd,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,CAAC,MAAM,EAAE,cAAc,GAAG,kBAAkB,CAAC;IAC7C;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,SAAS,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,GACtC,kBAAkB,CAAC;CACvB;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,cAoB5B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACtB,MAAM,GACN;IACE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAuCN;;;;GAIG;AACH,eAAO,MAAM,SAAS;iCAIjB;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;sBAUR;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,sBAAsB;gCAY1D;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;qCAavB;QACD,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,sBAAsB;mCAavB;QACD,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;0BAUL;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,sBAAsB;iEAerE;QACD,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QACzC,uEAAuE;QACvE,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,sBAAsB;IA0C1B,mEAAmE;gCAIhE;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;IAS1B;;;OAGG;cACO,sBAAsB;IAehC,yCAAyC;kCAItC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,sBAAsB;CAWxE,CAAC;AAIF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CA0E7D;AA0ED,+EAA+E;AAC/E,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,MAAM,GAClC;KAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GACtC,CAAC,CAAC"}