managed-deepagents 0.1.0 → 0.3.0

package/dist/identity/types.d.ts

@@ -0,0 +1,185 @@
+/**
+ * Shared identity authoring types.
+ *
+ * Kept separate from provider helpers so modules like `supabase.ts` can import
+ * types without circular dependencies on the public barrel.
+ */
+/** How MDA learns who is calling on the HTTP ingress path. */
+export type HttpIngress = "trusted_backend" | ValidatedTokenIngress;
+/**
+ * Browser-direct ingress: MDA verifies the caller's own IdP token server-side
+ * and derives identity from its claims.
+ */
+export interface ValidatedTokenIngress {
+    mode: "validated_token";
+    /**
+     * The token families this deployment accepts (non-empty). MDA selects a
+     * provider per request by the token issuer (`iss`). Use one entry for a single
+     * IdP; `id` is required once there is more than one entry.
+     */
+    providers: ValidatedTokenProvider[];
+}
+/** A single token family MDA knows how to verify. */
+export interface ValidatedTokenProvider {
+    /** Label used for routing; required only when there is more than one provider. */
+    id?: string;
+    /** Expected token issuer (`iss`) — the routing/verification key for real IdP tokens. */
+    issuer?: string;
+    /**
+     * Additional accepted `iss` values (e.g. multi-region Supabase projects on one
+     * introspect provider).
+     */
+    issuers?: string[];
+    /** Expected audience (`aud`), so tokens minted for other apps are rejected. */
+    audience?: string;
+    /** Accepted signing algorithms, e.g. `["RS256"]`. */
+    algorithms?: string[];
+    /**
+     * URL of the IdP's public keys (JWKS). MDA verifies the signature locally —
+     * the recommended path for most OAuth/OIDC providers.
+     */
+    jwks?: string;
+    /**
+     * Resolve `jwks`/endpoints from `issuer/.well-known/openid-configuration`
+     * instead of a literal `jwks` URL (what `providers.oidc` sets).
+     */
+    discover?: boolean;
+    /**
+     * Auth API root used to resolve the real JWT `issuer` + `jwks` via OIDC
+     * discovery (custom Supabase domains). Materialized at request time before
+     * provider selection so vanity hosts are not mistaken for token `iss`.
+     */
+    discoveryUrl?: string;
+    /**
+     * Only for opaque tokens: verify by calling the IdP once per request
+     * (e.g. Supabase `/auth/v1/user`).
+     */
+    introspect?: {
+        /** Single introspection endpoint (the common case). */
+        url?: string;
+        /** Provider-specific endpoint selection by a client header (e.g. Supabase region). */
+        regionHeader?: string;
+        /**
+         * Region value → introspection endpoint. A bare string is the URL (using the
+         * shared `headers` below); an object also carries region-specific headers
+         * (e.g. a per-region Supabase `apikey`), which override the shared ones.
+         */
+        regions?: Record<string, string | {
+            url: string;
+            headers?: Record<string, string>;
+        }>;
+        /** Static headers sent with the introspection call (e.g. Supabase `apikey`). */
+        headers?: Record<string, string>;
+        /** Where MDA puts the user's token when calling the endpoint. Default: "authorization". */
+        tokenIn?: "authorization" | "header";
+        /** Custom header name when `tokenIn` is "header". */
+        header?: string;
+    };
+    /** MDA issues + verifies short-lived signed tokens for anonymous/guest users. */
+    guest?: {
+        /** Enable an issue/reissue path for this provider. */
+        issue: boolean;
+        /** Token lifetime, e.g. "24h". */
+        ttl?: string;
+        /** Prefix applied to the generated actor id, e.g. "guest:". */
+        actorPrefix?: string;
+    };
+    /** Maps verified token claims → identity envelope fields. */
+    claims: {
+        /** Claim used as `runtime.identity.actor.id` (e.g. "sub", "email"). */
+        actor: string;
+        /** Claim used as `runtime.identity.tenant.id` (e.g. "org_id"). */
+        tenant?: string;
+        /** Claim used as `runtime.identity.actor.email`. */
+        email?: string;
+    };
+}
+/** Which downstream call needs a credential right now. */
+export interface CredentialTarget {
+    /** What is being called. */
+    kind: "subagent" | "mcp" | "connection" | "langsmith";
+    /** The configured name, e.g. "code-reviewer" | "docs" | "github". */
+    name: string;
+    /** Optional read/write hint so the resolver can mint different tokens. */
+    intent?: "read" | "write";
+    /** Current thread, when the credential is thread-specific. */
+    threadId?: string;
+    /** Free-form context (e.g. `{ repo, installationId }`); part of the cache key. */
+    metadata?: Record<string, unknown>;
+}
+/** What a credential resolver returns. */
+export interface ResolvedCredential {
+    /** Headers MDA attaches to the downstream call (usually Authorization). */
+    headers: Record<string, string>;
+    /** ISO expiry; MDA caches per (actor, tenant, target) until then. */
+    expiresAt?: string;
+}
+/** The frozen identity envelope tools and middleware see. */
+export interface RuntimeIdentity {
+    actor: {
+        type: "user" | "service";
+        id: string;
+        email?: string;
+    };
+    tenant?: {
+        id: string;
+    };
+    source: {
+        provider: "http" | "slack" | "schedule" | "cli" | "studio";
+        threadId?: string;
+    };
+    claims?: Record<string, unknown>;
+}
+/** An in-process resolver callback. */
+export type CredentialResolver = (args: {
+    identity: RuntimeIdentity;
+    target: CredentialTarget;
+}) => Promise<ResolvedCredential>;
+/**
+ * Provide this (with `scoping.credentials: "custom"`) to mint your own
+ * downstream credentials per actor: an in-process callback or a hosted
+ * token-exchange endpoint.
+ */
+export type CredentialResolverConfig = {
+    resolve: CredentialResolver;
+} | {
+    endpoint: {
+        url: string;
+    };
+};
+/** The tenant boundary. */
+export type Tenancy = "single" | "multi";
+/** Who can open/resume the conversation. */
+export type ThreadScope = "actor" | "channel" | "tenant";
+/** The durable Store namespace prefix. */
+export type MemoryScope = "actor" | "tenant" | "agent" | "none";
+/** Whose token downstream calls carry. */
+export type CredentialScope = "agent" | "actor" | "none" | "custom";
+/** The whole identity config surface. */
+export interface IdentityConfig {
+    /** How MDA learns who is calling. */
+    ingress: {
+        http: HttpIngress;
+    };
+    /** The tenant boundary. */
+    tenancy: Tenancy;
+    /** The three scoping axes. */
+    scoping: {
+        /** Who can open/resume the conversation. */
+        threads?: ThreadScope;
+        /** Durable Store namespace prefix. */
+        memory: MemoryScope;
+        /** Managed mode, or "custom" when a resolver/endpoint is provided below. */
+        credentials?: CredentialScope;
+    };
+    /** Present when `scoping.credentials` is "custom" (or a resolver is set). */
+    credentials?: CredentialResolverConfig;
+}
+/** The object exported from the project's root `identity.ts`. */
+export interface IdentityDefinition {
+    readonly kind: "identity";
+    readonly config: IdentityConfig;
+}
+/** The archetype presets that expand to a full {@link IdentityConfig}. */
+export type IdentityPresetName = "private-assistant" | "multi-tenant-saas" | "shared-bot" | "internal-tool" | "service";
+//# sourceMappingURL=types.d.ts.map

package/dist/identity/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GAAG,iBAAiB,GAAG,qBAAqB,CAAC;AAEpE;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,iFAAiF;IACjF,KAAK,CAAC,EAAE;QACN,sDAAsD;QACtD,KAAK,EAAE,OAAO,CAAC;QACf,kCAAkC;QAClC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,+DAA+D;QAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE;QACN,uEAAuE;QACvE,KAAK,EAAE,MAAM,CAAC;QACd,kEAAkE;QAClE,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,oDAAoD;QACpD,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B;IAC5B,IAAI,EAAE,UAAU,GAAG,KAAK,GAAG,YAAY,GAAG,WAAW,CAAC;IACtD,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,MAAM,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,KAAK,GAAG,QAAQ,CAAC;QAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,uCAAuC;AACvC,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE;IACtC,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAElC;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAC/B;IAAE,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAElC,2BAA2B;AAC3B,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEzC,4CAA4C;AAC5C,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;AACzD,0CAA0C;AAC1C,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAChE,0CAA0C;AAC1C,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEpE,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF,2BAA2B;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,OAAO,EAAE;QACP,4CAA4C;QAC5C,OAAO,CAAC,EAAE,WAAW,CAAC;QACtB,sCAAsC;QACtC,MAAM,EAAE,WAAW,CAAC;QACpB,4EAA4E;QAC5E,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;IACF,6EAA6E;IAC7E,WAAW,CAAC,EAAE,wBAAwB,CAAC;CACxC;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAED,0EAA0E;AAC1E,MAAM,MAAM,kBAAkB,GAC1B,mBAAmB,GACnB,mBAAmB,GACnB,YAAY,GACZ,eAAe,GACf,SAAS,CAAC"}

package/dist/identity/types.js

@@ -0,0 +1,8 @@
+/**
+ * Shared identity authoring types.
+ *
+ * Kept separate from provider helpers so modules like `supabase.ts` can import
+ * types without circular dependencies on the public barrel.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/identity/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/index.d.ts

@@ -1,9 +1,14 @@
 export { defineDeepAgent } from "./define-deep-agent.js";
 export { defineMcpServers } from "./connectors.js";
+export * as langsmith from "./connectors/langsmith.js";
+export type { LangSmithCapability, LangSmithCallerSurface, LangSmithCapabilityScope, LangSmithConnector, LangSmithConnectorConfig, LangSmithResource, LangSmithResponseShape, } from "./connectors/langsmith.js";
 export { defineSchedule } from "./schedules.js";
 export { defineSandbox } from "./sandbox.js";
+export { defineIdentity, providers, validateIdentity, } from "./identity/index.js";
+export type { CredentialResolver, CredentialResolverConfig, CredentialScope, CredentialTarget, DefineIdentity, HttpIngress, IdentityConfig, IdentityDefinition, IdentityPresetName, MemoryScope, ResolvedCredential, RuntimeIdentity, Tenancy, ThreadScope, ValidatedTokenIngress, ValidatedTokenProvider, } from "./identity/index.js";
 export type { HttpMcpServerConfig, McpServersConfig, McpServersDefinition, McpToolSelectionConfig, RemoteMcpServerBaseConfig, RemoteMcpServerConfig, SseMcpServerConfig, } from "./connectors.js";
 export type { ScheduleConfig, ScheduleDefinition, ScheduleDeliveryTarget, ScheduleThreadConfig, } from "./schedules.js";
 export type { ChannelAttachment, ChannelDestination, ChannelEvent, ChannelMessage, ChannelPostOptions, DeepAgentDefinition, DefineDeepAgentConfig, ManagedDeepAgentKey, PostedChannelMessage, Runtime, RuntimeChannel, } from "./types.js";
+export type { ManagedDeepAgentRuntime, ManagedRuntimeExtras, } from "./runtime/managed-tools.js";
 export type { DefineSandboxOptions, ManagedSandboxOptionKey, SandboxDefinition, SandboxProviderClass, SandboxProviderOptions, SandboxScope, } from "./sandbox.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,OAAO,EACP,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,GACb,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,SAAS,MAAM,2BAA2B,CAAC;AACvD,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,SAAS,EACT,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,OAAO,EACP,WAAW,EACX,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,OAAO,EACP,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,GACb,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -1,5 +1,7 @@
 export { defineDeepAgent } from "./define-deep-agent.js";
 export { defineMcpServers } from "./connectors.js";
+export * as langsmith from "./connectors/langsmith.js";
 export { defineSchedule } from "./schedules.js";
 export { defineSandbox } from "./sandbox.js";
+export { defineIdentity, providers, validateIdentity, } from "./identity/index.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,SAAS,MAAM,2BAA2B,CAAC;AAUvD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,SAAS,EACT,gBAAgB,GACjB,MAAM,qBAAqB,CAAC"}

package/dist/runtime/auth.d.ts

@@ -0,0 +1,56 @@
+import { Auth } from "@langchain/langgraph-sdk/auth";
+import type { IdentityConfig, IdentityDefinition, RuntimeIdentity } from "../identity/index.js";
+/**
+ * The user object `@auth.authenticate` returns. `identity`/`permissions` satisfy
+ * the LangGraph base shape; the `mda_*` fields carry the identity envelope into
+ * `config.configurable.langgraph_auth_user` for the runtime seam.
+ */
+export interface ManagedUser {
+    identity: string;
+    permissions: string[];
+    mda_actor_id: string;
+    mda_tenant_id?: string;
+    mda_actor_email?: string;
+    mda_claims?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+/**
+ * Build the managed LangGraph custom-auth handler from a declared identity.
+ *
+ * Handles both ingress modes: `trusted_backend` (reserved headers behind a
+ * shared ingress secret) and `validated_token` (browser-direct IdP tokens
+ * verified via JWKS / introspection / MDA-signed guest). Also registers thread
+ * and store scoping with a studio bypass.
+ */
+export declare function buildManagedAuth(identity: IdentityDefinition): Auth;
+/**
+ * Resolve the caller's frozen {@link RuntimeIdentity} from a raw HTTP request,
+ * using the same ingress logic (`trusted_backend` headers / `validated_token`
+ * verification) as the managed auth handler. Throws an {@link HTTPException}
+ * (401) when the caller is unauthenticated or unresolvable.
+ *
+ * This is the resolver that backs default-secure connector HTTP routes: a
+ * connector route runs behind identity by default, and this is what enforces it.
+ */
+export declare function resolveRequestIdentity(cfg: IdentityConfig, request: Request): Promise<RuntimeIdentity>;
+/**
+ * Fail-closed (403) unless the store `namespace` contains the identity segments
+ * the memory scope requires as a contiguous ordered prefix (typically after the
+ * deployment id). `agent`/`none` scopes carry no per-identity restriction.
+ */
+export declare function assertStoreAccess(cfg: IdentityConfig, user: ManagedUser, value: unknown): void;
+/** True when `required` appears as a contiguous ordered subsequence of `namespace`. */
+export declare function namespaceHasOrderedSegments(namespace: string[], required: string[]): boolean;
+/**
+ * Resolve the caller identity for `trusted_backend`: validate the shared ingress
+ * secret, then trust the reserved actor/tenant headers. Fail-closed (401) on a
+ * missing/invalid secret, a missing actor, or a missing tenant under multi.
+ */
+export declare function resolveTrustedBackendUser(cfg: IdentityConfig, request: Request): ManagedUser;
+/** Derive the owner value `@auth.on.threads` filters on, per the `threads` axis. */
+export declare function threadOwnerKey(cfg: IdentityConfig, user: ManagedUser): string;
+/** True when this deployment exposes guest issuance and the request targets it. */
+export declare function isGuestIssuanceRequest(request: Request, cfg: IdentityConfig): boolean;
+/** Placeholder identity so LangGraph auth middleware allows tokenless issuance. */
+export declare function guestIssuanceBypassUser(): ManagedUser;
+//# sourceMappingURL=auth.d.ts.map

package/dist/runtime/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/runtime/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EAGL,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,eAAe,EAChB,MAAM,sBAAsB,CAAC;AA0B9B;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAsCnE;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,eAAe,CAAC,CAc1B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,OAAO,GACb,IAAI,CAqBN;AAED,uFAAuF;AACvF,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EAAE,EACnB,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAeT;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,WAAW,CAgBb;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,CAY7E;AAuBD,mFAAmF;AACnF,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,cAAc,GAClB,OAAO,CAaT;AAED,mFAAmF;AACnF,wBAAgB,uBAAuB,IAAI,WAAW,CAMrD"}

package/dist/runtime/auth.js

@@ -0,0 +1,204 @@
+import { Auth, HTTPException, isStudioUser, } from "@langchain/langgraph-sdk/auth";
+import { buildRuntimeIdentity, memoryIdentitySegments, } from "./identity-runtime.js";
+import { resolveValidatedTokenUser } from "./validated-token.js";
+/**
+ * Reserved transport for the trusted-backend ingress mode. Actor/tenant travel
+ * as reserved headers (mapped into `config.configurable` by the generated
+ * `langgraph.json` allowlist); the ingress secret is validated here and is
+ * deliberately **not** allowlisted, so it never reaches `config.configurable`.
+ */
+const ACTOR_HEADER = "x-mda-actor-id";
+const TENANT_HEADER = "x-mda-tenant-id";
+const INGRESS_SECRET_HEADER = "x-mda-ingress-secret";
+/** Deployment env var carrying the shared secret the trusted backend presents. */
+const INGRESS_SECRET_ENV = "MDA_INGRESS_SECRET";
+/** Path MDA exposes for anonymous guest token issuance (must stay public). */
+const GUEST_ISSUANCE_PATH = "/identity/guest";
+/** Synthetic actor used only to satisfy auth middleware on the issuance route. */
+const GUEST_ISSUER_ACTOR = "mda:guest-issuer";
+/**
+ * Build the managed LangGraph custom-auth handler from a declared identity.
+ *
+ * Handles both ingress modes: `trusted_backend` (reserved headers behind a
+ * shared ingress secret) and `validated_token` (browser-direct IdP tokens
+ * verified via JWKS / introspection / MDA-signed guest). Also registers thread
+ * and store scoping with a studio bypass.
+ */
+export function buildManagedAuth(identity) {
+    const cfg = identity.config;
+    const http = cfg.ingress.http;
+    const auth = new Auth();
+    auth.authenticate(async (request) => {
+        if (isGuestIssuanceRequest(request, cfg)) {
+            return guestIssuanceBypassUser();
+        }
+        if (http === "trusted_backend") {
+            return resolveTrustedBackendUser(cfg, request);
+        }
+        return resolveValidatedTokenUser(cfg, http, request);
+    });
+    auth.on("threads", ({ user, value }) => {
+        if (isStudioUser(user)) {
+            return true;
+        }
+        const key = threadOwnerKey(cfg, user);
+        if (value && typeof value === "object") {
+            const container = value;
+            container.metadata = { ...(container.metadata ?? {}), owner: key };
+        }
+        return { owner: key };
+    });
+    // Mirror the memory namespace so raw store ops can't cross the identity
+    // boundary a run is scoped to.
+    auth.on("store", ({ user, value }) => {
+        if (isStudioUser(user)) {
+            return true;
+        }
+        assertStoreAccess(cfg, user, value);
+        return true;
+    });
+    return auth;
+}
+/**
+ * Resolve the caller's frozen {@link RuntimeIdentity} from a raw HTTP request,
+ * using the same ingress logic (`trusted_backend` headers / `validated_token`
+ * verification) as the managed auth handler. Throws an {@link HTTPException}
+ * (401) when the caller is unauthenticated or unresolvable.
+ *
+ * This is the resolver that backs default-secure connector HTTP routes: a
+ * connector route runs behind identity by default, and this is what enforces it.
+ */
+export async function resolveRequestIdentity(cfg, request) {
+    const http = cfg.ingress.http;
+    const user = http === "trusted_backend"
+        ? resolveTrustedBackendUser(cfg, request)
+        : await resolveValidatedTokenUser(cfg, http, request);
+    const identity = buildRuntimeIdentity({
+        langgraph_auth_user: user,
+        mda_source_provider: "http",
+    });
+    if (!identity) {
+        throw new HTTPException(401, { message: "unauthenticated" });
+    }
+    return identity;
+}
+/**
+ * Fail-closed (403) unless the store `namespace` contains the identity segments
+ * the memory scope requires as a contiguous ordered prefix (typically after the
+ * deployment id). `agent`/`none` scopes carry no per-identity restriction.
+ */
+export function assertStoreAccess(cfg, user, value) {
+    const required = memoryIdentitySegments(cfg.scoping.memory, cfg.tenancy, user.mda_actor_id ? String(user.mda_actor_id) : undefined, user.mda_tenant_id ? String(user.mda_tenant_id) : undefined);
+    if (required.length === 0) {
+        return;
+    }
+    const namespace = value &&
+        typeof value === "object" &&
+        Array.isArray(value.namespace)
+        ? value.namespace.map(String)
+        : [];
+    if (!namespaceHasOrderedSegments(namespace, required)) {
+        throw new HTTPException(403, {
+            message: "store namespace is outside the caller's identity boundary",
+        });
+    }
+}
+/** True when `required` appears as a contiguous ordered subsequence of `namespace`. */
+export function namespaceHasOrderedSegments(namespace, required) {
+    if (required.length === 0) {
+        return true;
+    }
+    if (namespace.length < required.length) {
+        return false;
+    }
+    for (let start = 0; start <= namespace.length - required.length; start += 1) {
+        if (required.every((segment, index) => namespace[start + index] === segment)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Resolve the caller identity for `trusted_backend`: validate the shared ingress
+ * secret, then trust the reserved actor/tenant headers. Fail-closed (401) on a
+ * missing/invalid secret, a missing actor, or a missing tenant under multi.
+ */
+export function resolveTrustedBackendUser(cfg, request) {
+    requireIngressSecret(request);
+    const actor = request.headers.get(ACTOR_HEADER);
+    if (!actor) {
+        throw new HTTPException(401, { message: `missing ${ACTOR_HEADER}` });
+    }
+    const tenant = request.headers.get(TENANT_HEADER) ?? undefined;
+    assertTenantPresentIfMulti(cfg, tenant);
+    return {
+        identity: actor,
+        permissions: [],
+        mda_actor_id: actor,
+        ...(tenant ? { mda_tenant_id: tenant } : {}),
+    };
+}
+/** Derive the owner value `@auth.on.threads` filters on, per the `threads` axis. */
+export function threadOwnerKey(cfg, user) {
+    const scope = cfg.scoping.threads ?? "actor";
+    const actor = String(user.mda_actor_id ?? "");
+    const tenant = user.mda_tenant_id ? String(user.mda_tenant_id) : undefined;
+    if (scope === "tenant") {
+        return tenant ?? actor;
+    }
+    if (scope === "channel") {
+        const channel = user.mda_source_thread_id;
+        return channel ? String(channel) : actor;
+    }
+    return actor;
+}
+function requireIngressSecret(request) {
+    const expected = process.env[INGRESS_SECRET_ENV];
+    const provided = request.headers.get(INGRESS_SECRET_HEADER);
+    if (!expected || !provided || !constantTimeEquals(expected, provided)) {
+        throw new HTTPException(401, {
+            message: "invalid or missing ingress secret",
+        });
+    }
+}
+function assertTenantPresentIfMulti(cfg, tenant) {
+    if (cfg.tenancy === "multi" && !tenant) {
+        throw new HTTPException(401, {
+            message: "missing tenant for multi-tenant deployment",
+        });
+    }
+}
+/** True when this deployment exposes guest issuance and the request targets it. */
+export function isGuestIssuanceRequest(request, cfg) {
+    if (request.method !== "POST") {
+        return false;
+    }
+    const { pathname } = new URL(request.url);
+    if (pathname !== GUEST_ISSUANCE_PATH) {
+        return false;
+    }
+    const http = cfg.ingress.http;
+    if (http === "trusted_backend") {
+        return false;
+    }
+    return http.providers.some((provider) => provider.guest?.issue);
+}
+/** Placeholder identity so LangGraph auth middleware allows tokenless issuance. */
+export function guestIssuanceBypassUser() {
+    return {
+        identity: GUEST_ISSUER_ACTOR,
+        permissions: [],
+        mda_actor_id: GUEST_ISSUER_ACTOR,
+    };
+}
+function constantTimeEquals(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    let mismatch = 0;
+    for (let i = 0; i < a.length; i += 1) {
+        mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return mismatch === 0;
+}
+//# sourceMappingURL=auth.js.map

package/dist/runtime/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/runtime/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EACJ,aAAa,EACb,YAAY,GACb,MAAM,+BAA+B,CAAC;AAOvC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,YAAY,GAAG,gBAAgB,CAAC;AACtC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AACxC,MAAM,qBAAqB,GAAG,sBAAsB,CAAC;AAErD,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEhD,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAiB9C;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA4B;IAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;IAExB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,OAAgB,EAAwB,EAAE;QACjE,IAAI,sBAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO,uBAAuB,EAAE,CAAC;QACnC,CAAC;QACD,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC/B,OAAO,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,yBAAyB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACrC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,EAAE,IAA8B,CAAC,CAAC;QAChE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,KAA+C,CAAC;YAClE,SAAS,CAAC,QAAQ,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,+BAA+B;IAC/B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACnC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,iBAAiB,CAAC,GAAG,EAAE,IAA8B,EAAE,KAAK,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAmB,EACnB,OAAgB;IAEhB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,MAAM,IAAI,GACR,IAAI,KAAK,iBAAiB;QACxB,CAAC,CAAC,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC;QACzC,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,mBAAmB,EAAE,IAAI;QACzB,mBAAmB,EAAE,MAAM;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAmB,EACnB,IAAiB,EACjB,KAAc;IAEd,MAAM,QAAQ,GAAG,sBAAsB,CACrC,GAAG,CAAC,OAAO,CAAC,MAAM,EAClB,GAAG,CAAC,OAAO,EACX,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,EACzD,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAC5D,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GACb,KAAK;QACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,OAAO,CAAE,KAAiC,CAAC,SAAS,CAAC;QACzD,CAAC,CAAE,KAAkC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;QAC3D,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,CAAC,2BAA2B,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,2DAA2D;SACrE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,2BAA2B,CACzC,SAAmB,EACnB,QAAkB;IAElB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,SAAS,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,IACE,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,OAAO,CAAC,EACxE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAmB,EACnB,OAAgB;IAEhB,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAE9B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,WAAW,YAAY,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC;IAC/D,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAExC,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,EAAE;QACf,YAAY,EAAE,KAAK;QACnB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,GAAmB,EAAE,IAAiB;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,MAAM,IAAI,KAAK,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC1C,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAgB;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,mCAAmC;SAC7C,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,GAAmB,EACnB,MAA0B;IAE1B,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,4CAA4C;SACtD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,sBAAsB,CACpC,OAAgB,EAChB,GAAmB;IAEnB,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,mBAAmB,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,QAAQ,EAAE,kBAAkB;QAC5B,WAAW,EAAE,EAAE;QACf,YAAY,EAAE,kBAAkB;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC"}