managed-deepagents 0.0.3-dev.45 → 0.0.3-dev.47

package/dist/identity/index.d.ts

@@ -0,0 +1,88 @@
+/**
+ * The managed `identity.ts` declaration primitive.
+ *
+ * A project's root `identity.ts` exports a named `identity` created with
+ * `defineIdentity(...)` (or `defineIdentity.preset(...)`). The compiler
+ * discovers it, generates the custom-auth handler, and wires thread/memory
+ * scoping and downstream credentials.
+ *
+ * This module is pure authoring-time config construction plus eager validation —
+ * it has no runtime dependency (the `providers.*` helpers return plain data).
+ */
+import { type SupabaseProviderOptions } from "./supabase.js";
+import type { IdentityConfig, IdentityDefinition, IdentityPresetName, ValidatedTokenProvider } from "./types.js";
+export type { CredentialResolver, CredentialResolverConfig, CredentialScope, CredentialTarget, HttpIngress, IdentityConfig, IdentityDefinition, IdentityPresetName, MemoryScope, ResolvedCredential, RuntimeIdentity, Tenancy, ThreadScope, ValidatedTokenIngress, ValidatedTokenProvider, } from "./types.js";
+export type { SupabaseProviderOptions, SupabaseRegion } from "./supabase.js";
+export { supabaseAuthV1Base } from "./supabase.js";
+/** The signature of {@link defineIdentity}, including its `.preset` helper. */
+export interface DefineIdentity {
+    (config: IdentityConfig): IdentityDefinition;
+    /**
+     * Start from a named archetype and optionally override any subset of it. The
+     * headline API for the common case.
+     */
+    preset(name: IdentityPresetName, overrides?: DeepPartial<IdentityConfig>): IdentityDefinition;
+}
+/**
+ * Declare the identity contract for the deployment.
+ *
+ * Most developers call {@link defineIdentity.preset} instead. The three scoping
+ * axes are the power-user layer underneath.
+ */
+export declare const defineIdentity: DefineIdentity;
+/**
+ * Provider integrations — authoring-time sugar over {@link ValidatedTokenProvider}.
+ * Each returns a plain provider object you can spread-and-override, so
+ * there is no new runtime surface.
+ */
+export declare const providers: {
+    auth0({ domain, audience, }: {
+        domain: string;
+        audience?: string;
+    }): ValidatedTokenProvider;
+    clerk({ domain }: {
+        domain: string;
+    }): ValidatedTokenProvider;
+    okta({ domain, audience, }: {
+        domain: string;
+        audience?: string;
+    }): ValidatedTokenProvider;
+    cognito({ userPoolId, region, }: {
+        userPoolId: string;
+        region: string;
+    }): ValidatedTokenProvider;
+    entra({ tenantId, audience, }: {
+        tenantId: string;
+        audience?: string;
+    }): ValidatedTokenProvider;
+    google({ audience }?: {
+        audience?: string;
+    }): ValidatedTokenProvider;
+    /** @see {@link supabaseProvider} */
+    supabase(options: SupabaseProviderOptions): ValidatedTokenProvider;
+    /** Universal fallback for any OIDC-compliant IdP via discovery. */
+    oidc({ issuer, audience, }: {
+        issuer: string;
+        audience?: string;
+    }): ValidatedTokenProvider;
+    /**
+     * GitHub OAuth access tokens (opaque bearer tokens, not JWTs). MDA verifies
+     * each request by calling `GET https://api.github.com/user` with the token.
+     */
+    github(): ValidatedTokenProvider;
+    /** MDA-issued anonymous/guest tokens. */
+    guest({ ttl, actorPrefix, }?: {
+        ttl?: string;
+        actorPrefix?: string;
+    }): ValidatedTokenProvider;
+};
+/**
+ * Eagerly reject illegal identity configs at authoring time so misconfig never
+ * reaches the compiler or runtime.
+ */
+export declare function validateIdentity(config: IdentityConfig): void;
+/** Recursively merge plain objects; arrays and primitives from `patch` win. */
+type DeepPartial<T> = T extends object ? {
+    [K in keyof T]?: DeepPartial<T[K]>;
+} : T;
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,KAAK,uBAAuB,EAAoB,MAAM,eAAe,CAAC;AAC/E,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAElB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,OAAO,EACP,WAAW,EACX,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AA8BnD,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,CAAC,MAAM,EAAE,cAAc,GAAG,kBAAkB,CAAC;IAC7C;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,SAAS,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,GACtC,kBAAkB,CAAC;CACvB;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,cAoB5B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,SAAS;iCAIjB;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;sBAUR;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,sBAAsB;gCAY1D;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;qCAavB;QACD,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,sBAAsB;mCAavB;QACD,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;0BAUL;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,sBAAsB;IAUxE,oCAAoC;sBAClB,uBAAuB,GAAG,sBAAsB;IAIlE,mEAAmE;gCAIhE;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;IAU1B;;;OAGG;cACO,sBAAsB;IAehC,yCAAyC;kCAItC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,sBAAsB;CAWxE,CAAC;AAIF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CA0E7D;AA2ED,+EAA+E;AAC/E,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,MAAM,GAClC;KAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GACtC,CAAC,CAAC"}

package/dist/{identity.js → identity/index.js}

@@ -9,6 +9,8 @@
  * This module is pure authoring-time config construction plus eager validation —
  * it has no runtime dependency (the `providers.*` helpers return plain data).
  */
+import { supabaseProvider } from "./supabase.js";
+export { supabaseAuthV1Base } from "./supabase.js";
 const PRESETS = {
     "private-assistant": {
         ingress: { http: "trusted_backend" },
@@ -55,64 +57,6 @@ export const defineIdentity = Object.assign(function defineIdentity(config) {
         return defineIdentity(deepMerge(base, overrides));
     },
 });
-function supabaseBase(projectRef) {
-    return `https://${projectRef}.supabase.co/auth/v1`;
-}
-/** Normalize a Supabase project or custom-domain URL to the `…/auth/v1` root. */
-export function supabaseAuthV1Base(url) {
-    let trimmed = url.replace(/\/$/, "");
-    if (trimmed.endsWith("/user")) {
-        trimmed = trimmed.slice(0, -"/user".length);
-    }
-    if (trimmed.endsWith("/auth/v1")) {
-        return trimmed;
-    }
-    return `${trimmed}/auth/v1`;
-}
-function supabaseRegionIssuers(regions) {
-    const issuers = [];
-    const seen = new Set();
-    for (const entry of Object.values(regions)) {
-        let issuer;
-        if (typeof entry === "string") {
-            issuer = supabaseAuthV1Base(entry);
-        }
-        else if (entry.projectRef) {
-            issuer = supabaseBase(entry.projectRef);
-        }
-        else if (entry.url) {
-            issuer = supabaseAuthV1Base(entry.url);
-        }
-        if (issuer && !seen.has(issuer)) {
-            seen.add(issuer);
-            issuers.push(issuer);
-        }
-    }
-    return issuers;
-}
-/**
- * Normalize authoring-time Supabase regions into the runtime `regions` shape. A
- * bare string stays a URL (using the shared base `apikey`); an object resolves
- * its `url` from `url`/`projectRef` and, when given, carries region-specific
- * `headers`/`anonKey` that override the shared `apikey` at introspection time.
- */
-function normalizeSupabaseRegions(regions) {
-    const out = {};
-    for (const [region, entry] of Object.entries(regions)) {
-        if (typeof entry === "string") {
-            out[region] = entry;
-            continue;
-        }
-        const url = entry.url ??
-            (entry.projectRef ? `${supabaseBase(entry.projectRef)}/user` : undefined);
-        if (!url) {
-            throw new Error(`providers.supabase(...) region "${region}" needs a \`projectRef\` or \`url\`.`);
-        }
-        const headers = entry.headers ?? (entry.anonKey ? { apikey: entry.anonKey } : undefined);
-        out[region] = headers ? { url, headers } : { url };
-    }
-    return out;
-}
 /**
  * Provider integrations — authoring-time sugar over {@link ValidatedTokenProvider}.
  * Each returns a plain provider object you can spread-and-override, so
@@ -172,72 +116,9 @@ export const providers = {
             claims: { actor: "sub", email: "email" },
         };
     },
-    supabase({ projectRef, url, introspect, regions, regionHeader = "x-supabase-region", }) {
-        if (projectRef && url) {
-            throw new Error("providers.supabase(...) accepts only one of `projectRef` or `url`.");
-        }
-        if (introspect) {
-            if (regions) {
-                const provider = {
-                    id: "supabase",
-                    introspect: {
-                        regionHeader,
-                        regions: normalizeSupabaseRegions(regions),
-                        headers: { apikey: "${SUPABASE_ANON_KEY}" },
-                    },
-                    claims: { actor: "email" },
-                };
-                const issuers = supabaseRegionIssuers(regions);
-                if (issuers.length > 0) {
-                    provider.issuers = issuers;
-                }
-                return provider;
-            }
-            if (url) {
-                const authBase = supabaseAuthV1Base(url);
-                return {
-                    id: "supabase",
-                    discoveryUrl: authBase,
-                    introspect: {
-                        url: `${authBase}/user`,
-                        headers: { apikey: "${SUPABASE_ANON_KEY}" },
-                    },
-                    claims: { actor: "email" },
-                };
-            }
-            if (!projectRef) {
-                throw new Error("providers.supabase(...) requires `projectRef`, `url`, or `regions` when introspect is true.");
-            }
-            const base = supabaseBase(projectRef);
-            return {
-                id: "supabase",
-                issuer: base,
-                introspect: {
-                    url: `${base}/user`,
-                    headers: { apikey: "${SUPABASE_ANON_KEY}" },
-                },
-                claims: { actor: "email" },
-            };
-        }
-        if (url) {
-            return {
-                id: "supabase",
-                discoveryUrl: supabaseAuthV1Base(url),
-                algorithms: ["ES256", "RS256"],
-                claims: { actor: "email" },
-            };
-        }
-        if (!projectRef) {
-            throw new Error("providers.supabase(...) without `introspect` requires `projectRef` or `url`.");
-        }
-        const base = supabaseBase(projectRef);
-        return {
-            id: "supabase",
-            issuer: base,
-            jwks: `${base}/.well-known/jwks.json`,
-            algorithms: ["ES256", "RS256"],
-            claims: { actor: "email" },
-        };
+    /** @see {@link supabaseProvider} */
+    supabase(options) {
+        return supabaseProvider(options);
     },
     /** Universal fallback for any OIDC-compliant IdP via discovery. */
     oidc({ issuer, audience, }) {
@@ -419,4 +300,4 @@ function structuredCloneConfig(value) {
     }
     return value;
 }
-//# sourceMappingURL=identity.js.map
+//# sourceMappingURL=index.js.map

package/dist/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAgC,gBAAgB,EAAE,MAAM,eAAe,CAAC;AA4B/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,OAAO,GAA+C;IAC1D,mBAAmB,EAAE;QACnB,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;KACrE;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE;KACtE;IACD,YAAY,EAAE;QACZ,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;KACvE;IACD,eAAe,EAAE;QACf,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;KACrE;IACD,OAAO,EAAE;QACP,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;KACnD;CACF,CAAC;AAeF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAmB,MAAM,CAAC,MAAM,CACzD,SAAS,cAAc,CAAC,MAAsB;IAC5C,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC,EACD;IACE,MAAM,CACJ,IAAwB,EACxB,SAAuC;QAEvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,8CAA8C,MAAM,CAAC,IAAI,CAAC,KAAK;gBAC7D,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvD,CAAC;QACJ,CAAC;QACD,OAAO,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACpD,CAAC;CACF,CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,KAAK,CAAC,EACJ,MAAM,EACN,QAAQ,GAIT;QACC,OAAO;YACL,MAAM,EAAE,WAAW,MAAM,GAAG;YAC5B,IAAI,EAAE,WAAW,MAAM,wBAAwB;YAC/C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,EAAE,MAAM,EAAsB;QAClC,OAAO;YACL,MAAM,EAAE,WAAW,MAAM,EAAE;YAC3B,IAAI,EAAE,WAAW,MAAM,wBAAwB;YAC/C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,EACH,MAAM,EACN,QAAQ,GAIT;QACC,OAAO;YACL,MAAM,EAAE,WAAW,MAAM,EAAE;YAC3B,IAAI,EAAE,WAAW,MAAM,iBAAiB;YACxC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,EACN,UAAU,EACV,MAAM,GAIP;QACC,MAAM,MAAM,GAAG,uBAAuB,MAAM,kBAAkB,UAAU,EAAE,CAAC;QAC3E,OAAO;YACL,MAAM;YACN,IAAI,EAAE,GAAG,MAAM,wBAAwB;YACvC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,EACJ,QAAQ,EACR,QAAQ,GAIT;QACC,OAAO;YACL,MAAM,EAAE,qCAAqC,QAAQ,OAAO;YAC5D,IAAI,EAAE,qCAAqC,QAAQ,sBAAsB;YACzE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,EAAE,QAAQ,KAA4B,EAAE;QAC7C,OAAO;YACL,MAAM,EAAE,6BAA6B;YACrC,IAAI,EAAE,4CAA4C;YAClD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,QAAQ,CAAC,OAAgC;QACvC,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,mEAAmE;IACnE,IAAI,CAAC,EACH,MAAM,EACN,QAAQ,GAIT;QACC,OAAO;YACL,MAAM;YACN,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,OAAO;YACL,EAAE,EAAE,QAAQ;YACZ,UAAU,EAAE;gBACV,GAAG,EAAE,6BAA6B;gBAClC,OAAO,EAAE;oBACP,MAAM,EAAE,6BAA6B;oBACrC,sBAAsB,EAAE,YAAY;oBACpC,YAAY,EAAE,mCAAmC;iBAClD;aACF;YACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,yCAAyC;IACzC,KAAK,CAAC,EACJ,GAAG,EACH,WAAW,MAC+B,EAAE;QAC5C,OAAO;YACL,EAAE,EAAE,OAAO;YACX,KAAK,EAAE;gBACL,KAAK,EAAE,IAAI;gBACX,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC;YACD,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,wBAAwB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAErE;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,MAAM,QAAQ,GAAG,MAA4C,CAAC;IAE9D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAyC,CAAC;IACnE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAEZ,CAAC;IACd,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,uDAAuD;IACvD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,UAAU,GAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAW,CAAC,MAAM,CACvE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ,CACrC,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,kDAAkD,UAAU,CAAC,IAAI,CAC/D,IAAI,CACL,iDAAiD,CACnD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC;IACvD,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC;IAC5C,IAAI,eAAe,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,IACE,WAAW;QACX,OAAO,eAAe,KAAK,QAAQ;QAClC,wBAA8C,CAAC,QAAQ,CAAC,eAAe,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uFAAuF,eAAe,KAAK;YACzG,6DAA6D,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,0BAA0B,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnD,CAAC;IAED,+EAA+E;IAC/E,MAAM,IAAI,GAAI,OAA6B,CAAC,IAAI,CAAC;IACjD,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;SAAM,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,yHAAyH,CAC1H,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA2B,CAAC,IAAI,KAAK,iBAAiB,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAA2B;IACzD,MAAM,IAAI,GAAI,IAAgC,CAAC,SAAS,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAA+B,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,EAAE,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,qBAAqB,CAC3E,CAAC;QACJ,CAAC;QACD,IACE,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;YACnC,QAAQ,CAAC,MAAM,KAAK,IAAI;YACxB,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ;YACzC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAClC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,6BAA6B,CACnF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GACf,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;YACjC,QAAQ,CAAC,QAAQ,KAAK,IAAI;YAC1B,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ;YACzC,QAAQ,CAAC,UAAU,KAAK,SAAS;YACjC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC;QAC/B,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,8FAA8F,CACpJ,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,WAAoB;IACtD,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,WAAwD,CAAC;IACrE,MAAM,YAAY,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,CAAC;IACvD,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAChC,GAAG,CAAC,QAAQ,KAAK,IAAI;QACrB,OAAQ,GAAG,CAAC,QAA8B,CAAC,GAAG,KAAK,QAAQ,CAAC;IAC9D,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,yGAAyG,CAC1G,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,OAAO,KAAK,KAAK,UAAU,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAI,IAAO,EAAE,KAAiC;IAC9D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,KAAU,CAAC;IACpB,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC;YACN,aAAa,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC;gBAC5C,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,KAAoC,CAAC;gBAC1D,CAAC,CAAC,KAAK,CAAC;IACd,CAAC;IACD,OAAO,GAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAI,KAAQ;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAiB,CAAC;IAC1E,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,GAAG,CAAC,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,GAAQ,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/identity/supabase.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Supabase validated-token provider helpers.
+ *
+ * Authoring-time sugar for {@link ValidatedTokenProvider} configs that talk to
+ * Supabase Auth (project refs, custom domains, multi-region introspection).
+ */
+import type { ValidatedTokenProvider } from "./types.js";
+/**
+ * A single Supabase region for multi-region introspection. A bare string is the
+ * introspection URL (using the shared `${SUPABASE_ANON_KEY}`); an object pins a
+ * `projectRef` or explicit `url`, plus an optional region-specific `anonKey`
+ * (or raw `headers`) so each region uses its own project and anon key.
+ */
+export type SupabaseRegion = string | {
+    projectRef?: string;
+    url?: string;
+    anonKey?: string;
+    headers?: Record<string, string>;
+};
+/** Options for {@link supabaseProvider}. */
+export interface SupabaseProviderOptions {
+    projectRef?: string;
+    /**
+     * Project URL or custom auth domain (e.g. `https://auth.example.com`).
+     * Sets `discoveryUrl` so the runtime resolves the real JWT `iss` + JWKS
+     * via OIDC — vanity hosts are not the token issuer.
+     */
+    url?: string;
+    introspect?: boolean;
+    /**
+     * Multi-region introspection: map each region to its Supabase project. A
+     * string is a `projectRef`; an object can pin an explicit `url`/`anonKey` (so
+     * each region uses its own project + anon key). Only valid with `introspect`.
+     */
+    regions?: Record<string, SupabaseRegion>;
+    /** Client header carrying the region (default `x-supabase-region`). */
+    regionHeader?: string;
+}
+/** Normalize a Supabase project or custom-domain URL to the `…/auth/v1` root. */
+export declare function supabaseAuthV1Base(url: string): string;
+/**
+ * Build a Supabase {@link ValidatedTokenProvider}.
+ *
+ * @param options - Project ref, custom domain URL, and/or multi-region introspect.
+ * @returns A plain provider object for `defineIdentity` / `validated_token`.
+ */
+export declare function supabaseProvider(options: SupabaseProviderOptions): ValidatedTokenProvider;
+//# sourceMappingURL=supabase.d.ts.map

package/dist/identity/supabase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.d.ts","sourceRoot":"","sources":["../../src/identity/supabase.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACtB,MAAM,GACN;IACE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEN,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACzC,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAMD,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAStD;AAyDD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAC/B,sBAAsB,CAgFxB"}

package/dist/identity/supabase.js

@@ -0,0 +1,139 @@
+/**
+ * Supabase validated-token provider helpers.
+ *
+ * Authoring-time sugar for {@link ValidatedTokenProvider} configs that talk to
+ * Supabase Auth (project refs, custom domains, multi-region introspection).
+ */
+function supabaseBase(projectRef) {
+    return `https://${projectRef}.supabase.co/auth/v1`;
+}
+/** Normalize a Supabase project or custom-domain URL to the `…/auth/v1` root. */
+export function supabaseAuthV1Base(url) {
+    let trimmed = url.replace(/\/$/, "");
+    if (trimmed.endsWith("/user")) {
+        trimmed = trimmed.slice(0, -"/user".length);
+    }
+    if (trimmed.endsWith("/auth/v1")) {
+        return trimmed;
+    }
+    return `${trimmed}/auth/v1`;
+}
+function supabaseRegionIssuers(regions) {
+    const issuers = [];
+    const seen = new Set();
+    for (const entry of Object.values(regions)) {
+        let issuer;
+        if (typeof entry === "string") {
+            issuer = supabaseAuthV1Base(entry);
+        }
+        else if (entry.projectRef) {
+            issuer = supabaseBase(entry.projectRef);
+        }
+        else if (entry.url) {
+            issuer = supabaseAuthV1Base(entry.url);
+        }
+        if (issuer && !seen.has(issuer)) {
+            seen.add(issuer);
+            issuers.push(issuer);
+        }
+    }
+    return issuers;
+}
+/**
+ * Normalize authoring-time Supabase regions into the runtime `regions` shape. A
+ * bare string stays a URL (using the shared base `apikey`); an object resolves
+ * its `url` from `url`/`projectRef` and, when given, carries region-specific
+ * `headers`/`anonKey` that override the shared `apikey` at introspection time.
+ */
+function normalizeSupabaseRegions(regions) {
+    const out = {};
+    for (const [region, entry] of Object.entries(regions)) {
+        if (typeof entry === "string") {
+            out[region] = entry;
+            continue;
+        }
+        const url = entry.url ??
+            (entry.projectRef ? `${supabaseBase(entry.projectRef)}/user` : undefined);
+        if (!url) {
+            throw new Error(`providers.supabase(...) region "${region}" needs a \`projectRef\` or \`url\`.`);
+        }
+        const headers = entry.headers ?? (entry.anonKey ? { apikey: entry.anonKey } : undefined);
+        out[region] = headers ? { url, headers } : { url };
+    }
+    return out;
+}
+/**
+ * Build a Supabase {@link ValidatedTokenProvider}.
+ *
+ * @param options - Project ref, custom domain URL, and/or multi-region introspect.
+ * @returns A plain provider object for `defineIdentity` / `validated_token`.
+ */
+export function supabaseProvider(options) {
+    const { projectRef, url, introspect, regions, regionHeader = "x-supabase-region", } = options;
+    if (projectRef && url) {
+        throw new Error("providers.supabase(...) accepts only one of `projectRef` or `url`.");
+    }
+    if (introspect) {
+        if (regions) {
+            const provider = {
+                id: "supabase",
+                introspect: {
+                    regionHeader,
+                    regions: normalizeSupabaseRegions(regions),
+                    headers: { apikey: "${SUPABASE_ANON_KEY}" },
+                },
+                claims: { actor: "email" },
+            };
+            const issuers = supabaseRegionIssuers(regions);
+            if (issuers.length > 0) {
+                provider.issuers = issuers;
+            }
+            return provider;
+        }
+        if (url) {
+            const authBase = supabaseAuthV1Base(url);
+            return {
+                id: "supabase",
+                discoveryUrl: authBase,
+                introspect: {
+                    url: `${authBase}/user`,
+                    headers: { apikey: "${SUPABASE_ANON_KEY}" },
+                },
+                claims: { actor: "email" },
+            };
+        }
+        if (!projectRef) {
+            throw new Error("providers.supabase(...) requires `projectRef`, `url`, or `regions` when introspect is true.");
+        }
+        const base = supabaseBase(projectRef);
+        return {
+            id: "supabase",
+            issuer: base,
+            introspect: {
+                url: `${base}/user`,
+                headers: { apikey: "${SUPABASE_ANON_KEY}" },
+            },
+            claims: { actor: "email" },
+        };
+    }
+    if (url) {
+        return {
+            id: "supabase",
+            discoveryUrl: supabaseAuthV1Base(url),
+            algorithms: ["ES256", "RS256"],
+            claims: { actor: "email" },
+        };
+    }
+    if (!projectRef) {
+        throw new Error("providers.supabase(...) without `introspect` requires `projectRef` or `url`.");
+    }
+    const base = supabaseBase(projectRef);
+    return {
+        id: "supabase",
+        issuer: base,
+        jwks: `${base}/.well-known/jwks.json`,
+        algorithms: ["ES256", "RS256"],
+        claims: { actor: "email" },
+    };
+}
+//# sourceMappingURL=supabase.js.map

package/dist/identity/supabase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../../src/identity/supabase.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAuCH,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO,WAAW,UAAU,sBAAsB,CAAC;AACrD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,OAAO,UAAU,CAAC;AAC9B,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAuC;IAEvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,IAAI,MAA0B,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC;aAAM,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACrB,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,OAAuC;IAEvC,MAAM,GAAG,GAGL,EAAE,CAAC;IACP,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GACP,KAAK,CAAC,GAAG;YACT,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,sCAAsC,CAChF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAgC;IAEhC,MAAM,EACJ,UAAU,EACV,GAAG,EACH,UAAU,EACV,OAAO,EACP,YAAY,GAAG,mBAAmB,GACnC,GAAG,OAAO,CAAC;IAEZ,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,QAAQ,GAA2B;gBACvC,EAAE,EAAE,UAAU;gBACd,UAAU,EAAE;oBACV,YAAY;oBACZ,OAAO,EAAE,wBAAwB,CAAC,OAAO,CAAC;oBAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;iBAC5C;gBACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;aAC3B,CAAC;YACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;YAC7B,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO;gBACL,EAAE,EAAE,UAAU;gBACd,YAAY,EAAE,QAAQ;gBACtB,UAAU,EAAE;oBACV,GAAG,EAAE,GAAG,QAAQ,OAAO;oBACvB,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;iBAC5C;gBACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;aAC3B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,UAAU;YACd,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE;gBACV,GAAG,EAAE,GAAG,IAAI,OAAO;gBACnB,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;aAC5C;YACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3B,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,EAAE,CAAC;QACR,OAAO;YACL,EAAE,EAAE,UAAU;YACd,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC;YACrC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO;QACL,EAAE,EAAE,UAAU;QACd,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,GAAG,IAAI,wBAAwB;QACrC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QAC9B,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;KAC3B,CAAC;AACJ,CAAC"}

package/dist/{identity.d.ts → identity/types.d.ts}

@@ -1,13 +1,8 @@
 /**
- * The managed `identity.ts` declaration primitive.
+ * Shared identity authoring types.
  *
- * A project's root `identity.ts` exports a named `identity` created with
- * `defineIdentity(...)` (or `defineIdentity.preset(...)`). The compiler
- * discovers it, generates the custom-auth handler, and wires thread/memory
- * scoping and downstream credentials.
- *
- * This module is pure authoring-time config construction plus eager validation —
- * it has no runtime dependency (the `providers.*` helpers return plain data).
+ * Kept separate from provider helpers so modules like `supabase.ts` can import
+ * types without circular dependencies on the public barrel.
  */
 /** How MDA learns who is calling on the HTTP ingress path. */
 export type HttpIngress = "trusted_backend" | ValidatedTokenIngress;
@@ -187,106 +182,4 @@ export interface IdentityDefinition {
 }
 /** The archetype presets that expand to a full {@link IdentityConfig}. */
 export type IdentityPresetName = "private-assistant" | "multi-tenant-saas" | "shared-bot" | "internal-tool" | "service";
-/** The signature of {@link defineIdentity}, including its `.preset` helper. */
-export interface DefineIdentity {
-    (config: IdentityConfig): IdentityDefinition;
-    /**
-     * Start from a named archetype and optionally override any subset of it. The
-     * headline API for the common case.
-     */
-    preset(name: IdentityPresetName, overrides?: DeepPartial<IdentityConfig>): IdentityDefinition;
-}
-/**
- * Declare the identity contract for the deployment.
- *
- * Most developers call {@link defineIdentity.preset} instead. The three scoping
- * axes are the power-user layer underneath.
- */
-export declare const defineIdentity: DefineIdentity;
-/**
- * A single Supabase region for multi-region introspection. A bare string is the
- * introspection URL (using the shared `${SUPABASE_ANON_KEY}`); an object pins a
- * `projectRef` or explicit `url`, plus an optional region-specific `anonKey`
- * (or raw `headers`) so each region uses its own project and anon key.
- */
-export type SupabaseRegion = string | {
-    projectRef?: string;
-    url?: string;
-    anonKey?: string;
-    headers?: Record<string, string>;
-};
-/** Normalize a Supabase project or custom-domain URL to the `…/auth/v1` root. */
-export declare function supabaseAuthV1Base(url: string): string;
-/**
- * Provider integrations — authoring-time sugar over {@link ValidatedTokenProvider}.
- * Each returns a plain provider object you can spread-and-override, so
- * there is no new runtime surface.
- */
-export declare const providers: {
-    auth0({ domain, audience, }: {
-        domain: string;
-        audience?: string;
-    }): ValidatedTokenProvider;
-    clerk({ domain }: {
-        domain: string;
-    }): ValidatedTokenProvider;
-    okta({ domain, audience, }: {
-        domain: string;
-        audience?: string;
-    }): ValidatedTokenProvider;
-    cognito({ userPoolId, region, }: {
-        userPoolId: string;
-        region: string;
-    }): ValidatedTokenProvider;
-    entra({ tenantId, audience, }: {
-        tenantId: string;
-        audience?: string;
-    }): ValidatedTokenProvider;
-    google({ audience }?: {
-        audience?: string;
-    }): ValidatedTokenProvider;
-    supabase({ projectRef, url, introspect, regions, regionHeader, }: {
-        projectRef?: string;
-        /**
-         * Project URL or custom auth domain (e.g. `https://auth.example.com`).
-         * Sets `discoveryUrl` so the runtime resolves the real JWT `iss` + JWKS
-         * via OIDC — vanity hosts are not the token issuer.
-         */
-        url?: string;
-        introspect?: boolean;
-        /**
-         * Multi-region introspection: map each region to its Supabase project. A
-         * string is a `projectRef`; an object can pin an explicit `url`/`anonKey` (so
-         * each region uses its own project + anon key). Only valid with `introspect`.
-         */
-        regions?: Record<string, SupabaseRegion>;
-        /** Client header carrying the region (default `x-supabase-region`). */
-        regionHeader?: string;
-    }): ValidatedTokenProvider;
-    /** Universal fallback for any OIDC-compliant IdP via discovery. */
-    oidc({ issuer, audience, }: {
-        issuer: string;
-        audience?: string;
-    }): ValidatedTokenProvider;
-    /**
-     * GitHub OAuth access tokens (opaque bearer tokens, not JWTs). MDA verifies
-     * each request by calling `GET https://api.github.com/user` with the token.
-     */
-    github(): ValidatedTokenProvider;
-    /** MDA-issued anonymous/guest tokens. */
-    guest({ ttl, actorPrefix, }?: {
-        ttl?: string;
-        actorPrefix?: string;
-    }): ValidatedTokenProvider;
-};
-/**
- * Eagerly reject illegal identity configs at authoring time so misconfig never
- * reaches the compiler or runtime.
- */
-export declare function validateIdentity(config: IdentityConfig): void;
-/** Recursively merge plain objects; arrays and primitives from `patch` win. */
-type DeepPartial<T> = T extends object ? {
-    [K in keyof T]?: DeepPartial<T[K]>;
-} : T;
-export {};
-//# sourceMappingURL=identity.d.ts.map
+//# sourceMappingURL=types.d.ts.map

package/dist/identity/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GAAG,iBAAiB,GAAG,qBAAqB,CAAC;AAEpE;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,iFAAiF;IACjF,KAAK,CAAC,EAAE;QACN,sDAAsD;QACtD,KAAK,EAAE,OAAO,CAAC;QACf,kCAAkC;QAClC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,+DAA+D;QAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE;QACN,uEAAuE;QACvE,KAAK,EAAE,MAAM,CAAC;QACd,kEAAkE;QAClE,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,oDAAoD;QACpD,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B;IAC5B,IAAI,EAAE,UAAU,GAAG,KAAK,GAAG,YAAY,GAAG,WAAW,CAAC;IACtD,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,MAAM,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,KAAK,GAAG,QAAQ,CAAC;QAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,uCAAuC;AACvC,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE;IACtC,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAElC;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAC/B;IAAE,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAElC,2BAA2B;AAC3B,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEzC,4CAA4C;AAC5C,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;AACzD,0CAA0C;AAC1C,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAChE,0CAA0C;AAC1C,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEpE,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF,2BAA2B;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,OAAO,EAAE;QACP,4CAA4C;QAC5C,OAAO,CAAC,EAAE,WAAW,CAAC;QACtB,sCAAsC;QACtC,MAAM,EAAE,WAAW,CAAC;QACpB,4EAA4E;QAC5E,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;IACF,6EAA6E;IAC7E,WAAW,CAAC,EAAE,wBAAwB,CAAC;CACxC;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAED,0EAA0E;AAC1E,MAAM,MAAM,kBAAkB,GAC1B,mBAAmB,GACnB,mBAAmB,GACnB,YAAY,GACZ,eAAe,GACf,SAAS,CAAC"}

package/dist/identity/types.js

@@ -0,0 +1,8 @@
+/**
+ * Shared identity authoring types.
+ *
+ * Kept separate from provider helpers so modules like `supabase.ts` can import
+ * types without circular dependencies on the public barrel.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/identity/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/index.d.ts

@@ -4,8 +4,8 @@ export * as langsmith from "./connectors/langsmith.js";
 export type { LangSmithCapability, LangSmithCallerSurface, LangSmithCapabilityScope, LangSmithConnector, LangSmithConnectorConfig, LangSmithResource, LangSmithResponseShape, } from "./connectors/langsmith.js";
 export { defineSchedule } from "./schedules.js";
 export { defineSandbox } from "./sandbox.js";
-export { defineIdentity, providers, validateIdentity } from "./identity.js";
-export type { CredentialResolver, CredentialResolverConfig, CredentialScope, CredentialTarget, DefineIdentity, HttpIngress, IdentityConfig, IdentityDefinition, IdentityPresetName, MemoryScope, ResolvedCredential, RuntimeIdentity, Tenancy, ThreadScope, ValidatedTokenIngress, ValidatedTokenProvider, } from "./identity.js";
+export { defineIdentity, providers, validateIdentity, } from "./identity/index.js";
+export type { CredentialResolver, CredentialResolverConfig, CredentialScope, CredentialTarget, DefineIdentity, HttpIngress, IdentityConfig, IdentityDefinition, IdentityPresetName, MemoryScope, ResolvedCredential, RuntimeIdentity, Tenancy, ThreadScope, ValidatedTokenIngress, ValidatedTokenProvider, } from "./identity/index.js";
 export type { HttpMcpServerConfig, McpServersConfig, McpServersDefinition, McpToolSelectionConfig, RemoteMcpServerBaseConfig, RemoteMcpServerConfig, SseMcpServerConfig, } from "./connectors.js";
 export type { ScheduleConfig, ScheduleDefinition, ScheduleDeliveryTarget, ScheduleThreadConfig, } from "./schedules.js";
 export type { ChannelAttachment, ChannelDestination, ChannelEvent, ChannelMessage, ChannelPostOptions, DeepAgentDefinition, DefineDeepAgentConfig, ManagedDeepAgentKey, PostedChannelMessage, Runtime, RuntimeChannel, } from "./types.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,SAAS,MAAM,2BAA2B,CAAC;AACvD,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE5E,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,OAAO,EACP,WAAW,EACX,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,OAAO,EACP,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,GACb,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,SAAS,MAAM,2BAA2B,CAAC;AACvD,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,SAAS,EACT,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,OAAO,EACP,WAAW,EACX,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,OAAO,EACP,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,GACb,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -3,5 +3,5 @@ export { defineMcpServers } from "./connectors.js";
 export * as langsmith from "./connectors/langsmith.js";
 export { defineSchedule } from "./schedules.js";
 export { defineSandbox } from "./sandbox.js";
-export { defineIdentity, providers, validateIdentity } from "./identity.js";
+export { defineIdentity, providers, validateIdentity, } from "./identity/index.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,SAAS,MAAM,2BAA2B,CAAC;AAUvD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,SAAS,MAAM,2BAA2B,CAAC;AAUvD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,SAAS,EACT,gBAAgB,GACjB,MAAM,qBAAqB,CAAC"}