managed-deepagents 0.1.0 → 0.3.0

package/dist/identity/index.js

@@ -0,0 +1,303 @@
+/**
+ * The managed `identity.ts` declaration primitive.
+ *
+ * A project's root `identity.ts` exports a named `identity` created with
+ * `defineIdentity(...)` (or `defineIdentity.preset(...)`). The compiler
+ * discovers it, generates the custom-auth handler, and wires thread/memory
+ * scoping and downstream credentials.
+ *
+ * This module is pure authoring-time config construction plus eager validation —
+ * it has no runtime dependency (the `providers.*` helpers return plain data).
+ */
+import { supabaseProvider } from "./supabase.js";
+export { supabaseAuthV1Base } from "./supabase.js";
+const PRESETS = {
+    "private-assistant": {
+        ingress: { http: "trusted_backend" },
+        tenancy: "single",
+        scoping: { threads: "actor", memory: "actor", credentials: "actor" },
+    },
+    "multi-tenant-saas": {
+        ingress: { http: "trusted_backend" },
+        tenancy: "multi",
+        scoping: { threads: "actor", memory: "tenant", credentials: "agent" },
+    },
+    "shared-bot": {
+        ingress: { http: "trusted_backend" },
+        tenancy: "single",
+        scoping: { threads: "channel", memory: "actor", credentials: "agent" },
+    },
+    "internal-tool": {
+        ingress: { http: "trusted_backend" },
+        tenancy: "single",
+        scoping: { threads: "actor", memory: "actor", credentials: "agent" },
+    },
+    service: {
+        ingress: { http: "trusted_backend" },
+        tenancy: "single",
+        scoping: { memory: "agent", credentials: "agent" },
+    },
+};
+/**
+ * Declare the identity contract for the deployment.
+ *
+ * Most developers call {@link defineIdentity.preset} instead. The three scoping
+ * axes are the power-user layer underneath.
+ */
+export const defineIdentity = Object.assign(function defineIdentity(config) {
+    validateIdentity(config);
+    return { kind: "identity", config };
+}, {
+    preset(name, overrides) {
+        const base = PRESETS[name];
+        if (base === undefined) {
+            throw new Error(`defineIdentity.preset(...) unknown preset "${String(name)}". ` +
+                `Valid presets: ${Object.keys(PRESETS).join(", ")}.`);
+        }
+        return defineIdentity(deepMerge(base, overrides));
+    },
+});
+/**
+ * Provider integrations — authoring-time sugar over {@link ValidatedTokenProvider}.
+ * Each returns a plain provider object you can spread-and-override, so
+ * there is no new runtime surface.
+ */
+export const providers = {
+    auth0({ domain, audience, }) {
+        return {
+            issuer: `https://${domain}/`,
+            jwks: `https://${domain}/.well-known/jwks.json`,
+            ...(audience ? { audience } : {}),
+            algorithms: ["RS256"],
+            claims: { actor: "sub", tenant: "org_id" },
+        };
+    },
+    clerk({ domain }) {
+        return {
+            issuer: `https://${domain}`,
+            jwks: `https://${domain}/.well-known/jwks.json`,
+            algorithms: ["RS256"],
+            claims: { actor: "sub" },
+        };
+    },
+    okta({ domain, audience, }) {
+        return {
+            issuer: `https://${domain}`,
+            jwks: `https://${domain}/oauth2/v1/keys`,
+            ...(audience ? { audience } : {}),
+            algorithms: ["RS256"],
+            claims: { actor: "sub" },
+        };
+    },
+    cognito({ userPoolId, region, }) {
+        const issuer = `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`;
+        return {
+            issuer,
+            jwks: `${issuer}/.well-known/jwks.json`,
+            algorithms: ["RS256"],
+            claims: { actor: "sub" },
+        };
+    },
+    entra({ tenantId, audience, }) {
+        return {
+            issuer: `https://login.microsoftonline.com/${tenantId}/v2.0`,
+            jwks: `https://login.microsoftonline.com/${tenantId}/discovery/v2.0/keys`,
+            ...(audience ? { audience } : {}),
+            algorithms: ["RS256"],
+            claims: { actor: "oid" },
+        };
+    },
+    google({ audience } = {}) {
+        return {
+            issuer: "https://accounts.google.com",
+            jwks: "https://www.googleapis.com/oauth2/v3/certs",
+            ...(audience ? { audience } : {}),
+            algorithms: ["RS256"],
+            claims: { actor: "sub", email: "email" },
+        };
+    },
+    /** @see {@link supabaseProvider} */
+    supabase(options) {
+        return supabaseProvider(options);
+    },
+    /** Universal fallback for any OIDC-compliant IdP via discovery. */
+    oidc({ issuer, audience, }) {
+        return {
+            issuer,
+            discover: true,
+            algorithms: ["RS256"],
+            ...(audience ? { audience } : {}),
+            claims: { actor: "sub" },
+        };
+    },
+    /**
+     * GitHub OAuth access tokens (opaque bearer tokens, not JWTs). MDA verifies
+     * each request by calling `GET https://api.github.com/user` with the token.
+     */
+    github() {
+        return {
+            id: "github",
+            introspect: {
+                url: "https://api.github.com/user",
+                headers: {
+                    Accept: "application/vnd.github+json",
+                    "X-GitHub-Api-Version": "2022-11-28",
+                    "User-Agent": "managed-deepagents-github-example",
+                },
+            },
+            claims: { actor: "login", email: "email" },
+        };
+    },
+    /** MDA-issued anonymous/guest tokens. */
+    guest({ ttl, actorPrefix, } = {}) {
+        return {
+            id: "guest",
+            guest: {
+                issue: true,
+                ...(ttl ? { ttl } : {}),
+                ...(actorPrefix ? { actorPrefix } : {}),
+            },
+            claims: { actor: "sub" },
+        };
+    },
+};
+const MANAGED_CREDENTIAL_MODES = ["agent", "actor", "none"];
+/**
+ * Eagerly reject illegal identity configs at authoring time so misconfig never
+ * reaches the compiler or runtime.
+ */
+export function validateIdentity(config) {
+    const provided = config;
+    const ingress = provided.ingress;
+    if (ingress === null || typeof ingress !== "object" || !("http" in ingress)) {
+        throw new Error("defineIdentity(...) requires an `ingress.http` value ('trusted_backend' or a validated_token config).");
+    }
+    const tenancy = provided.tenancy;
+    if (tenancy !== "single" && tenancy !== "multi") {
+        throw new Error('defineIdentity(...) requires `tenancy` to be "single" or "multi".');
+    }
+    const scoping = provided.scoping;
+    if (scoping === null || typeof scoping !== "object") {
+        throw new Error("defineIdentity(...) requires a `scoping` object.");
+    }
+    if (typeof scoping.memory !== "string") {
+        throw new Error('defineIdentity(...) requires `scoping.memory` (one of "actor" | "tenant" | "agent" | "none").');
+    }
+    // tenancy: "single" cannot use any tenant-scoped axis.
+    if (tenancy === "single") {
+        const tenantAxes = ["threads", "memory", "credentials"].filter((axis) => scoping[axis] === "tenant");
+        if (tenantAxes.length > 0) {
+            throw new Error(`defineIdentity(...) cannot use "tenant" scope (${tenantAxes.join(", ")}) with tenancy: "single". Set tenancy: "multi".`);
+        }
+    }
+    // Credentials axis must agree with the presence of a resolver/endpoint.
+    const hasResolver = provided.credentials !== undefined;
+    const credentialsMode = scoping.credentials;
+    if (credentialsMode === "custom" && !hasResolver) {
+        throw new Error('defineIdentity(...) with scoping.credentials: "custom" requires a `credentials` resolver or endpoint.');
+    }
+    if (hasResolver &&
+        typeof credentialsMode === "string" &&
+        MANAGED_CREDENTIAL_MODES.includes(credentialsMode)) {
+        throw new Error(`defineIdentity(...) provides a \`credentials\` resolver but scoping.credentials is "${credentialsMode}". ` +
+            'Set scoping.credentials: "custom" (or remove the resolver).');
+    }
+    if (hasResolver) {
+        validateCredentialResolver(provided.credentials);
+    }
+    // validated_token ingress needs at least one provider, each with claims.actor.
+    const http = ingress.http;
+    if (isValidatedToken(http)) {
+        validateValidatedToken(http);
+    }
+    else if (http !== "trusted_backend") {
+        throw new Error('defineIdentity(...) `ingress.http` must be "trusted_backend" or a { mode: "validated_token", providers: [...] } config.');
+    }
+}
+function isValidatedToken(http) {
+    return (typeof http === "object" &&
+        http !== null &&
+        http.mode === "validated_token");
+}
+function validateValidatedToken(http) {
+    const list = http.providers;
+    if (!Array.isArray(list) || list.length === 0) {
+        throw new Error("defineIdentity(...) validated_token ingress requires a non-empty `providers` list.");
+    }
+    const multiple = list.length > 1;
+    for (const [index, entry] of list.entries()) {
+        const provider = entry;
+        const label = provider?.id ?? `#${index}`;
+        if (provider === null || typeof provider !== "object") {
+            throw new Error(`defineIdentity(...) validated_token provider ${label} must be an object.`);
+        }
+        if (typeof provider.claims !== "object" ||
+            provider.claims === null ||
+            typeof provider.claims.actor !== "string" ||
+            provider.claims.actor.length === 0) {
+            throw new Error(`defineIdentity(...) validated_token provider ${label} requires \`claims.actor\`.`);
+        }
+        if (multiple && typeof provider.id !== "string") {
+            throw new Error("defineIdentity(...) each validated_token provider requires an `id` when more than one is configured.");
+        }
+        const hasVerifier = typeof provider.jwks === "string" ||
+            provider.discover === true ||
+            typeof provider.discoveryUrl === "string" ||
+            provider.introspect !== undefined ||
+            provider.guest !== undefined;
+        if (!hasVerifier) {
+            throw new Error(`defineIdentity(...) validated_token provider ${label} must declare one of \`jwks\`, \`discover\`, \`discoveryUrl\`, \`introspect\`, or \`guest\`.`);
+        }
+    }
+}
+function validateCredentialResolver(credentials) {
+    if (credentials === null || typeof credentials !== "object") {
+        throw new Error("defineIdentity(...) `credentials` must be a resolver ({ resolve }) or endpoint ({ endpoint }) config.");
+    }
+    const cfg = credentials;
+    const hasResolveFn = typeof cfg.resolve === "function";
+    const hasEndpoint = typeof cfg.endpoint === "object" &&
+        cfg.endpoint !== null &&
+        typeof cfg.endpoint.url === "string";
+    if (hasResolveFn === hasEndpoint) {
+        throw new Error("defineIdentity(...) `credentials` requires exactly one of `resolve` (function) or `endpoint` ({ url }).");
+    }
+}
+function isPlainObject(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        !Array.isArray(value) &&
+        typeof value !== "function");
+}
+function deepMerge(base, patch) {
+    if (patch === undefined)
+        return structuredCloneConfig(base);
+    if (!isPlainObject(base) || !isPlainObject(patch)) {
+        return patch;
+    }
+    const out = { ...base };
+    for (const [key, value] of Object.entries(patch)) {
+        if (value === undefined)
+            continue;
+        const current = out[key];
+        out[key] =
+            isPlainObject(current) && isPlainObject(value)
+                ? deepMerge(current, value)
+                : value;
+    }
+    return out;
+}
+function structuredCloneConfig(value) {
+    if (Array.isArray(value)) {
+        return value.map((item) => structuredCloneConfig(item));
+    }
+    if (isPlainObject(value)) {
+        const out = {};
+        for (const [key, inner] of Object.entries(value)) {
+            out[key] = structuredCloneConfig(inner);
+        }
+        return out;
+    }
+    return value;
+}
+//# sourceMappingURL=index.js.map

package/dist/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAgC,gBAAgB,EAAE,MAAM,eAAe,CAAC;AA4B/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,OAAO,GAA+C;IAC1D,mBAAmB,EAAE;QACnB,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;KACrE;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE;KACtE;IACD,YAAY,EAAE;QACZ,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;KACvE;IACD,eAAe,EAAE;QACf,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;KACrE;IACD,OAAO,EAAE;QACP,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;KACnD;CACF,CAAC;AAeF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAmB,MAAM,CAAC,MAAM,CACzD,SAAS,cAAc,CAAC,MAAsB;IAC5C,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC,EACD;IACE,MAAM,CACJ,IAAwB,EACxB,SAAuC;QAEvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,8CAA8C,MAAM,CAAC,IAAI,CAAC,KAAK;gBAC7D,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvD,CAAC;QACJ,CAAC;QACD,OAAO,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACpD,CAAC;CACF,CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,KAAK,CAAC,EACJ,MAAM,EACN,QAAQ,GAIT;QACC,OAAO;YACL,MAAM,EAAE,WAAW,MAAM,GAAG;YAC5B,IAAI,EAAE,WAAW,MAAM,wBAAwB;YAC/C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,EAAE,MAAM,EAAsB;QAClC,OAAO;YACL,MAAM,EAAE,WAAW,MAAM,EAAE;YAC3B,IAAI,EAAE,WAAW,MAAM,wBAAwB;YAC/C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,EACH,MAAM,EACN,QAAQ,GAIT;QACC,OAAO;YACL,MAAM,EAAE,WAAW,MAAM,EAAE;YAC3B,IAAI,EAAE,WAAW,MAAM,iBAAiB;YACxC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,EACN,UAAU,EACV,MAAM,GAIP;QACC,MAAM,MAAM,GAAG,uBAAuB,MAAM,kBAAkB,UAAU,EAAE,CAAC;QAC3E,OAAO;YACL,MAAM;YACN,IAAI,EAAE,GAAG,MAAM,wBAAwB;YACvC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,EACJ,QAAQ,EACR,QAAQ,GAIT;QACC,OAAO;YACL,MAAM,EAAE,qCAAqC,QAAQ,OAAO;YAC5D,IAAI,EAAE,qCAAqC,QAAQ,sBAAsB;YACzE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,EAAE,QAAQ,KAA4B,EAAE;QAC7C,OAAO;YACL,MAAM,EAAE,6BAA6B;YACrC,IAAI,EAAE,4CAA4C;YAClD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,QAAQ,CAAC,OAAgC;QACvC,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,mEAAmE;IACnE,IAAI,CAAC,EACH,MAAM,EACN,QAAQ,GAIT;QACC,OAAO;YACL,MAAM;YACN,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,OAAO;YACL,EAAE,EAAE,QAAQ;YACZ,UAAU,EAAE;gBACV,GAAG,EAAE,6BAA6B;gBAClC,OAAO,EAAE;oBACP,MAAM,EAAE,6BAA6B;oBACrC,sBAAsB,EAAE,YAAY;oBACpC,YAAY,EAAE,mCAAmC;iBAClD;aACF;YACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,yCAAyC;IACzC,KAAK,CAAC,EACJ,GAAG,EACH,WAAW,MAC+B,EAAE;QAC5C,OAAO;YACL,EAAE,EAAE,OAAO;YACX,KAAK,EAAE;gBACL,KAAK,EAAE,IAAI;gBACX,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC;YACD,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,wBAAwB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAErE;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,MAAM,QAAQ,GAAG,MAA4C,CAAC;IAE9D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAyC,CAAC;IACnE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAEZ,CAAC;IACd,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,uDAAuD;IACvD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,UAAU,GAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAW,CAAC,MAAM,CACvE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ,CACrC,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,kDAAkD,UAAU,CAAC,IAAI,CAC/D,IAAI,CACL,iDAAiD,CACnD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC;IACvD,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC;IAC5C,IAAI,eAAe,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,IACE,WAAW;QACX,OAAO,eAAe,KAAK,QAAQ;QAClC,wBAA8C,CAAC,QAAQ,CAAC,eAAe,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uFAAuF,eAAe,KAAK;YACzG,6DAA6D,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,0BAA0B,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnD,CAAC;IAED,+EAA+E;IAC/E,MAAM,IAAI,GAAI,OAA6B,CAAC,IAAI,CAAC;IACjD,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;SAAM,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,yHAAyH,CAC1H,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA2B,CAAC,IAAI,KAAK,iBAAiB,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAA2B;IACzD,MAAM,IAAI,GAAI,IAAgC,CAAC,SAAS,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAA+B,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,EAAE,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,qBAAqB,CAC3E,CAAC;QACJ,CAAC;QACD,IACE,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;YACnC,QAAQ,CAAC,MAAM,KAAK,IAAI;YACxB,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ;YACzC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAClC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,6BAA6B,CACnF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GACf,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;YACjC,QAAQ,CAAC,QAAQ,KAAK,IAAI;YAC1B,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ;YACzC,QAAQ,CAAC,UAAU,KAAK,SAAS;YACjC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC;QAC/B,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,8FAA8F,CACpJ,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,WAAoB;IACtD,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,WAAwD,CAAC;IACrE,MAAM,YAAY,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,CAAC;IACvD,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAChC,GAAG,CAAC,QAAQ,KAAK,IAAI;QACrB,OAAQ,GAAG,CAAC,QAA8B,CAAC,GAAG,KAAK,QAAQ,CAAC;IAC9D,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,yGAAyG,CAC1G,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,OAAO,KAAK,KAAK,UAAU,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAI,IAAO,EAAE,KAAiC;IAC9D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,KAAU,CAAC;IACpB,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC;YACN,aAAa,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC;gBAC5C,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,KAAoC,CAAC;gBAC1D,CAAC,CAAC,KAAK,CAAC;IACd,CAAC;IACD,OAAO,GAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAI,KAAQ;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAiB,CAAC;IAC1E,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,GAAG,CAAC,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,GAAQ,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/identity/supabase.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Supabase validated-token provider helpers.
+ *
+ * Authoring-time sugar for {@link ValidatedTokenProvider} configs that talk to
+ * Supabase Auth (project refs, custom domains, multi-region introspection).
+ */
+import type { ValidatedTokenProvider } from "./types.js";
+/**
+ * A single Supabase region for multi-region introspection. A bare string is the
+ * introspection URL (using the shared `${SUPABASE_ANON_KEY}`); an object pins a
+ * `projectRef` or explicit `url`, plus an optional region-specific `anonKey`
+ * (or raw `headers`) so each region uses its own project and anon key.
+ */
+export type SupabaseRegion = string | {
+    projectRef?: string;
+    url?: string;
+    anonKey?: string;
+    headers?: Record<string, string>;
+};
+/** Options for {@link supabaseProvider}. */
+export interface SupabaseProviderOptions {
+    projectRef?: string;
+    /**
+     * Project URL or custom auth domain (e.g. `https://auth.example.com`).
+     * Sets `discoveryUrl` so the runtime resolves the real JWT `iss` + JWKS
+     * via OIDC — vanity hosts are not the token issuer.
+     */
+    url?: string;
+    introspect?: boolean;
+    /**
+     * Multi-region introspection: map each region to its Supabase project. A
+     * string is a `projectRef`; an object can pin an explicit `url`/`anonKey` (so
+     * each region uses its own project + anon key). Only valid with `introspect`.
+     */
+    regions?: Record<string, SupabaseRegion>;
+    /** Client header carrying the region (default `x-supabase-region`). */
+    regionHeader?: string;
+}
+/** Normalize a Supabase project or custom-domain URL to the `…/auth/v1` root. */
+export declare function supabaseAuthV1Base(url: string): string;
+/**
+ * Build a Supabase {@link ValidatedTokenProvider}.
+ *
+ * @param options - Project ref, custom domain URL, and/or multi-region introspect.
+ * @returns A plain provider object for `defineIdentity` / `validated_token`.
+ */
+export declare function supabaseProvider(options: SupabaseProviderOptions): ValidatedTokenProvider;
+//# sourceMappingURL=supabase.d.ts.map

package/dist/identity/supabase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.d.ts","sourceRoot":"","sources":["../../src/identity/supabase.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACtB,MAAM,GACN;IACE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEN,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACzC,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAMD,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAStD;AAyDD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAC/B,sBAAsB,CAgFxB"}

package/dist/identity/supabase.js

@@ -0,0 +1,139 @@
+/**
+ * Supabase validated-token provider helpers.
+ *
+ * Authoring-time sugar for {@link ValidatedTokenProvider} configs that talk to
+ * Supabase Auth (project refs, custom domains, multi-region introspection).
+ */
+function supabaseBase(projectRef) {
+    return `https://${projectRef}.supabase.co/auth/v1`;
+}
+/** Normalize a Supabase project or custom-domain URL to the `…/auth/v1` root. */
+export function supabaseAuthV1Base(url) {
+    let trimmed = url.replace(/\/$/, "");
+    if (trimmed.endsWith("/user")) {
+        trimmed = trimmed.slice(0, -"/user".length);
+    }
+    if (trimmed.endsWith("/auth/v1")) {
+        return trimmed;
+    }
+    return `${trimmed}/auth/v1`;
+}
+function supabaseRegionIssuers(regions) {
+    const issuers = [];
+    const seen = new Set();
+    for (const entry of Object.values(regions)) {
+        let issuer;
+        if (typeof entry === "string") {
+            issuer = supabaseAuthV1Base(entry);
+        }
+        else if (entry.projectRef) {
+            issuer = supabaseBase(entry.projectRef);
+        }
+        else if (entry.url) {
+            issuer = supabaseAuthV1Base(entry.url);
+        }
+        if (issuer && !seen.has(issuer)) {
+            seen.add(issuer);
+            issuers.push(issuer);
+        }
+    }
+    return issuers;
+}
+/**
+ * Normalize authoring-time Supabase regions into the runtime `regions` shape. A
+ * bare string stays a URL (using the shared base `apikey`); an object resolves
+ * its `url` from `url`/`projectRef` and, when given, carries region-specific
+ * `headers`/`anonKey` that override the shared `apikey` at introspection time.
+ */
+function normalizeSupabaseRegions(regions) {
+    const out = {};
+    for (const [region, entry] of Object.entries(regions)) {
+        if (typeof entry === "string") {
+            out[region] = entry;
+            continue;
+        }
+        const url = entry.url ??
+            (entry.projectRef ? `${supabaseBase(entry.projectRef)}/user` : undefined);
+        if (!url) {
+            throw new Error(`providers.supabase(...) region "${region}" needs a \`projectRef\` or \`url\`.`);
+        }
+        const headers = entry.headers ?? (entry.anonKey ? { apikey: entry.anonKey } : undefined);
+        out[region] = headers ? { url, headers } : { url };
+    }
+    return out;
+}
+/**
+ * Build a Supabase {@link ValidatedTokenProvider}.
+ *
+ * @param options - Project ref, custom domain URL, and/or multi-region introspect.
+ * @returns A plain provider object for `defineIdentity` / `validated_token`.
+ */
+export function supabaseProvider(options) {
+    const { projectRef, url, introspect, regions, regionHeader = "x-supabase-region", } = options;
+    if (projectRef && url) {
+        throw new Error("providers.supabase(...) accepts only one of `projectRef` or `url`.");
+    }
+    if (introspect) {
+        if (regions) {
+            const provider = {
+                id: "supabase",
+                introspect: {
+                    regionHeader,
+                    regions: normalizeSupabaseRegions(regions),
+                    headers: { apikey: "${SUPABASE_ANON_KEY}" },
+                },
+                claims: { actor: "email" },
+            };
+            const issuers = supabaseRegionIssuers(regions);
+            if (issuers.length > 0) {
+                provider.issuers = issuers;
+            }
+            return provider;
+        }
+        if (url) {
+            const authBase = supabaseAuthV1Base(url);
+            return {
+                id: "supabase",
+                discoveryUrl: authBase,
+                introspect: {
+                    url: `${authBase}/user`,
+                    headers: { apikey: "${SUPABASE_ANON_KEY}" },
+                },
+                claims: { actor: "email" },
+            };
+        }
+        if (!projectRef) {
+            throw new Error("providers.supabase(...) requires `projectRef`, `url`, or `regions` when introspect is true.");
+        }
+        const base = supabaseBase(projectRef);
+        return {
+            id: "supabase",
+            issuer: base,
+            introspect: {
+                url: `${base}/user`,
+                headers: { apikey: "${SUPABASE_ANON_KEY}" },
+            },
+            claims: { actor: "email" },
+        };
+    }
+    if (url) {
+        return {
+            id: "supabase",
+            discoveryUrl: supabaseAuthV1Base(url),
+            algorithms: ["ES256", "RS256"],
+            claims: { actor: "email" },
+        };
+    }
+    if (!projectRef) {
+        throw new Error("providers.supabase(...) without `introspect` requires `projectRef` or `url`.");
+    }
+    const base = supabaseBase(projectRef);
+    return {
+        id: "supabase",
+        issuer: base,
+        jwks: `${base}/.well-known/jwks.json`,
+        algorithms: ["ES256", "RS256"],
+        claims: { actor: "email" },
+    };
+}
+//# sourceMappingURL=supabase.js.map

package/dist/identity/supabase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../../src/identity/supabase.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAuCH,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO,WAAW,UAAU,sBAAsB,CAAC;AACrD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,OAAO,UAAU,CAAC;AAC9B,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAuC;IAEvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,IAAI,MAA0B,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC;aAAM,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACrB,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,OAAuC;IAEvC,MAAM,GAAG,GAGL,EAAE,CAAC;IACP,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GACP,KAAK,CAAC,GAAG;YACT,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,sCAAsC,CAChF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAgC;IAEhC,MAAM,EACJ,UAAU,EACV,GAAG,EACH,UAAU,EACV,OAAO,EACP,YAAY,GAAG,mBAAmB,GACnC,GAAG,OAAO,CAAC;IAEZ,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,QAAQ,GAA2B;gBACvC,EAAE,EAAE,UAAU;gBACd,UAAU,EAAE;oBACV,YAAY;oBACZ,OAAO,EAAE,wBAAwB,CAAC,OAAO,CAAC;oBAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;iBAC5C;gBACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;aAC3B,CAAC;YACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;YAC7B,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO;gBACL,EAAE,EAAE,UAAU;gBACd,YAAY,EAAE,QAAQ;gBACtB,UAAU,EAAE;oBACV,GAAG,EAAE,GAAG,QAAQ,OAAO;oBACvB,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;iBAC5C;gBACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;aAC3B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,UAAU;YACd,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE;gBACV,GAAG,EAAE,GAAG,IAAI,OAAO;gBACnB,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;aAC5C;YACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3B,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,EAAE,CAAC;QACR,OAAO;YACL,EAAE,EAAE,UAAU;YACd,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC;YACrC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO;QACL,EAAE,EAAE,UAAU;QACd,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,GAAG,IAAI,wBAAwB;QACrC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QAC9B,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;KAC3B,CAAC;AACJ,CAAC"}