managed-deepagents 0.4.2 → 0.4.3-dev.94

package/dist/identity/index.js

@@ -2,246 +2,124 @@
  * The managed `identity.ts` declaration primitive.
  *
  * A project's root `identity.ts` exports a named `identity` created with
- * `defineIdentity(...)` (or `defineIdentity.preset(...)`). The compiler
- * discovers it, generates the custom-auth handler, and wires thread/memory
- * scoping and downstream credentials.
+ * `defineIdentity(...)`. The compiler discovers it, generates the custom-auth
+ * handler, and wires thread/memory scoping and downstream credentials.
  *
  * This module is pure authoring-time config construction plus eager validation —
- * it has no runtime dependency (the `providers.*` helpers return plain data).
+ * it has no runtime dependency (the `auth.*` helpers return plain data).
  */
+import { userClaimName } from "./claims.js";
+import { isSingleCredentialResolver } from "./credential-resolvers.js";
+import { normalizeIdentity } from "./options.js";
 import { supabaseProvider } from "./supabase.js";
-const PRESETS = {
-    "private-assistant": {
-        ingress: { http: "trusted_backend" },
-        tenancy: "single",
-        scoping: { threads: "actor", memory: "actor", credentials: "actor" },
-    },
-    "multi-tenant-saas": {
-        ingress: { http: "trusted_backend" },
-        tenancy: "multi",
-        scoping: { threads: "actor", memory: "tenant", credentials: "agent" },
-    },
-    "shared-bot": {
-        ingress: { http: "trusted_backend" },
-        tenancy: "single",
-        scoping: { threads: "channel", memory: "actor", credentials: "agent" },
-    },
-    "internal-tool": {
-        ingress: { http: "trusted_backend" },
-        tenancy: "single",
-        scoping: { threads: "actor", memory: "actor", credentials: "agent" },
-    },
-    service: {
-        ingress: { http: "trusted_backend" },
-        tenancy: "single",
-        scoping: { memory: "agent", credentials: "agent" },
-    },
-};
+export { normalizeGroups, userClaimName } from "./claims.js";
+export { normalizeIdentity } from "./options.js";
+export { credentialTargetNames, isSingleCredentialResolver, } from "./credential-resolvers.js";
+export { createFleetAuthSession, deleteAgentConnection, hasFleetAuthCredentials, listAgentConnections, resolveFleetApiUrl, resolveFleetHeaders, upsertAgentProviderToken, } from "./fleet.js";
+export { agentIdFromActor, enableActorSubjectIntegrationsFromConnectors, enableActorSubjectIntegration, isActorSubjectIntegrationEnabled, isActorSubjectSlugEnabled, NAMESPACE_MDA_ACTOR, resetActorSubjectEnabledForTests, resolveActorDeploymentId, } from "./actor-subject.js";
+export { createFleetVaultConnectProvider, fleetConnectUrl, isFleetVaultConnectConfigured, } from "./fleet-connect.js";
+export { createByoOauthClient, } from "./byo-oauth.js";
+export { createFleetIntegrationConnectProvider, fleetIntegrationConnectUrl, isFleetIntegrationConnectConfigured, } from "./fleet-integration-connect.js";
+export { clearFleetConnectHintCacheForTests, createFleetConnectHintMiddleware, fleetConnectHintUrl, rewriteFleetToolError, } from "./fleet-connect-hint.js";
+export { createConnectTicket, createOauthState, oauthTicketsFor, verifyConnectTicket, verifyOauthState, } from "./oauth-tickets.js";
 /**
  * Declare the identity contract for the deployment.
  *
- * Most developers call {@link defineIdentity.preset} instead. The three scoping
- * axes are the power-user layer underneath.
+ * Managed identity always gives each caller private threads and downstream
+ * credentials. Authentication must be declared explicitly:
+ *
+ * ```ts
+ * export const identity = defineIdentity({
+ *   auth: auth.langsmithApiKey(),
+ * });
+ * ```
+ *
+ * Otherwise describe how callers authenticate:
+ *
+ * ```ts
+ * export const identity = defineIdentity({
+ *   auth: auth.supabase({ projectRef: "abcdefgh" }),
+ * });
+ * ```
  */
-export const defineIdentity = Object.assign(function defineIdentity(config) {
+export function defineIdentity(options) {
+    const config = normalizeIdentity(options);
     validateIdentity(config);
     return { kind: "identity", config };
-}, {
-    preset(name, overrides) {
-        const base = PRESETS[name];
-        if (base === undefined) {
-            throw new Error(`defineIdentity.preset(...) unknown preset "${String(name)}". ` +
-                `Valid presets: ${Object.keys(PRESETS).join(", ")}.`);
-        }
-        return defineIdentity(deepMerge(base, overrides));
-    },
-});
+}
 /**
- * Provider integrations — authoring-time sugar over {@link ValidatedTokenProvider}.
- * Each returns a plain provider object you can spread-and-override, so
- * there is no new runtime surface.
+ * Authentication modes and validated-token providers. Every helper returns
+ * plain authoring-time configuration; the managed runtime performs validation.
  */
-export const providers = {
-    auth0({ domain, audience, }) {
-        return {
-            issuer: `https://${domain}/`,
-            jwks: `https://${domain}/.well-known/jwks.json`,
-            ...(audience ? { audience } : {}),
-            algorithms: ["RS256"],
-            claims: { actor: "sub", tenant: "org_id" },
-        };
-    },
-    clerk({ domain }) {
-        return {
-            issuer: `https://${domain}`,
-            jwks: `https://${domain}/.well-known/jwks.json`,
-            algorithms: ["RS256"],
-            claims: { actor: "sub" },
-        };
-    },
-    okta({ domain, audience, }) {
-        return {
-            issuer: `https://${domain}`,
-            jwks: `https://${domain}/oauth2/v1/keys`,
-            ...(audience ? { audience } : {}),
-            algorithms: ["RS256"],
-            claims: { actor: "sub" },
-        };
-    },
-    cognito({ userPoolId, region, }) {
-        const issuer = `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`;
-        return {
-            issuer,
-            jwks: `${issuer}/.well-known/jwks.json`,
-            algorithms: ["RS256"],
-            claims: { actor: "sub" },
-        };
-    },
-    entra({ tenantId, audience, }) {
-        return {
-            issuer: `https://login.microsoftonline.com/${tenantId}/v2.0`,
-            jwks: `https://login.microsoftonline.com/${tenantId}/discovery/v2.0/keys`,
-            ...(audience ? { audience } : {}),
-            algorithms: ["RS256"],
-            claims: { actor: "oid" },
-        };
-    },
-    google({ audience } = {}) {
-        return {
-            issuer: "https://accounts.google.com",
-            jwks: "https://www.googleapis.com/oauth2/v3/certs",
-            ...(audience ? { audience } : {}),
-            algorithms: ["RS256"],
-            claims: { actor: "sub", email: "email" },
-        };
+export const auth = {
+    /** Authenticate workspace/service callers with a LangSmith `x-api-key`. */
+    langsmithApiKey() {
+        return { mode: "langsmith_api_key" };
     },
     /** @see {@link supabaseProvider} */
     supabase(options) {
         return supabaseProvider(options);
     },
-    /** Universal fallback for any OIDC-compliant IdP via discovery. */
-    oidc({ issuer, audience, }) {
-        return {
-            issuer,
-            discover: true,
-            algorithms: ["RS256"],
-            ...(audience ? { audience } : {}),
-            claims: { actor: "sub" },
-        };
-    },
-    /**
-     * GitHub OAuth access tokens (opaque bearer tokens, not JWTs). MDA verifies
-     * each request by calling `GET https://api.github.com/user` with the token.
-     */
-    github() {
-        return {
-            id: "github",
-            introspect: {
-                url: "https://api.github.com/user",
-                headers: {
-                    Accept: "application/vnd.github+json",
-                    "X-GitHub-Api-Version": "2022-11-28",
-                    "User-Agent": "managed-deepagents-github-example",
-                },
-            },
-            claims: { actor: "login", email: "email" },
-        };
-    },
-    /** MDA-issued anonymous/guest tokens. */
-    guest({ ttl, actorPrefix, } = {}) {
-        return {
-            id: "guest",
-            guest: {
-                issue: true,
-                ...(ttl ? { ttl } : {}),
-                ...(actorPrefix ? { actorPrefix } : {}),
-            },
-            claims: { actor: "sub" },
-        };
-    },
 };
-const MANAGED_CREDENTIAL_MODES = ["agent", "actor", "none"];
+/** Non-custom credentials modes currently selectable on `CredentialScope`. */
+const MANAGED_CREDENTIAL_MODES = ["user", "agent", "none"];
 /**
  * Eagerly reject illegal identity configs at authoring time so misconfig never
  * reaches the compiler or runtime.
  */
 export function validateIdentity(config) {
-    const provided = config;
-    const ingress = provided.ingress;
+    const ingress = config.ingress;
     if (ingress === null || typeof ingress !== "object" || !("http" in ingress)) {
-        throw new Error("defineIdentity(...) requires an `ingress.http` value ('trusted_backend' or a validated_token config).");
-    }
-    const tenancy = provided.tenancy;
-    if (tenancy !== "single" && tenancy !== "multi") {
-        throw new Error('defineIdentity(...) requires `tenancy` to be "single" or "multi".');
+        throw new Error("defineIdentity(...) requires an `ingress.http` value ('backend' or a validated_token config).");
     }
-    const scoping = provided.scoping;
-    if (scoping === null || typeof scoping !== "object") {
-        throw new Error("defineIdentity(...) requires a `scoping` object.");
+    const scope = config.scope;
+    if (scope === null || typeof scope !== "object") {
+        throw new Error("defineIdentity(...) requires a `scope` object.");
     }
-    if (typeof scoping.memory !== "string") {
-        throw new Error('defineIdentity(...) requires `scoping.memory` (one of "actor" | "tenant" | "agent" | "none").');
+    if ("threads" in scope) {
+        throw new Error("defineIdentity(...) `scope.threads` is not supported. " +
+            "Threads are always user-owned — omit `threads`.");
     }
-    // tenancy: "single" cannot use any tenant-scoped axis.
-    if (tenancy === "single") {
-        const tenantAxes = ["threads", "memory", "credentials"].filter((axis) => scoping[axis] === "tenant");
-        if (tenantAxes.length > 0) {
-            throw new Error(`defineIdentity(...) cannot use "tenant" scope (${tenantAxes.join(", ")}) with tenancy: "single". Set tenancy: "multi".`);
-        }
+    if ("memory" in scope) {
+        throw new Error("defineIdentity(...) `scope.memory` is no longer supported. Durable memory " +
+            "has its own root declaration: export `memory` from `memory.ts` with " +
+            '`defineMemory({ scope: "agent" })`, and drop `scope.memory` here.');
     }
     // Credentials axis must agree with the presence of a resolver/endpoint.
-    const hasResolver = provided.credentials !== undefined;
-    const credentialsMode = scoping.credentials;
+    const hasResolver = config.credentials !== undefined;
+    const credentialsMode = scope.credentials;
     if (credentialsMode === "custom" && !hasResolver) {
-        throw new Error('defineIdentity(...) with scoping.credentials: "custom" requires a `credentials` resolver or endpoint.');
+        throw new Error('defineIdentity(...) with scope.credentials: "custom" requires a `credentials` resolver or endpoint.');
     }
     if (hasResolver &&
         typeof credentialsMode === "string" &&
         MANAGED_CREDENTIAL_MODES.includes(credentialsMode)) {
-        throw new Error(`defineIdentity(...) provides a \`credentials\` resolver but scoping.credentials is "${credentialsMode}". ` +
-            'Set scoping.credentials: "custom" (or remove the resolver).');
+        throw new Error(`defineIdentity(...) provides a \`credentials\` resolver but scope.credentials is "${credentialsMode}". ` +
+            'Set scope.credentials: "custom" (or remove the resolver).');
     }
     if (hasResolver) {
-        validateCredentialResolver(provided.credentials);
+        validateCredentialResolver(config.credentials);
     }
-    // validated_token ingress needs at least one provider, each with claims.actor.
+    // validated_token ingress needs at least one provider, each with claims.user.
     const http = ingress.http;
-    if (isValidatedToken(http)) {
+    if (isLangSmithApiKey(http)) {
+        // The platform supplies the endpoint and tenant at runtime.
+    }
+    else if (isValidatedToken(http)) {
         validateValidatedToken(http);
     }
-    else if (http !== "trusted_backend") {
-        throw new Error('defineIdentity(...) `ingress.http` must be "trusted_backend" or a { mode: "validated_token", providers: [...] } config.');
+    else if (http !== "backend") {
+        throw new Error('defineIdentity(...) `ingress.http` must be "backend", { mode: "langsmith_api_key" }, or a { mode: "validated_token", providers: [...] } config.');
     }
-    if (provided.connect !== undefined) {
-        validateConnectProviders(provided.connect);
+    if (config.connect !== undefined) {
+        throw new Error("defineIdentity(...) `connect` is not available in this release. " +
+            "Connect-with-X providers cannot be declared yet.");
     }
 }
-function validateConnectProviders(connect) {
-    if (!Array.isArray(connect)) {
-        throw new Error("defineIdentity(...) `connect` must be an array of identity connect providers " +
-            "(e.g. `[github.connect(), slack.connect()]`).");
-    }
-    for (const [index, entry] of connect.entries()) {
-        if (entry === null || typeof entry !== "object") {
-            throw new Error(`defineIdentity(...) connect[${index}] must be an IdentityConnectProvider object.`);
-        }
-        const provider = entry;
-        if (typeof provider.id !== "string" || !provider.id.trim()) {
-            throw new Error(`defineIdentity(...) connect[${index}] requires a non-empty \`id\` string.`);
-        }
-        for (const method of [
-            "shouldMount",
-            "status",
-            "startAuthorize",
-            "completeCallback",
-            "unlink",
-            "resolveRedirectBase",
-        ]) {
-            if (typeof provider[method] !== "function") {
-                throw new Error(`defineIdentity(...) connect[${index}] ("${provider.id}") requires \`${method}\`.`);
-            }
-        }
-    }
+function isLangSmithApiKey(http) {
+    return (typeof http === "object" &&
+        http !== null &&
+        http.mode === "langsmith_api_key");
 }
 function isValidatedToken(http) {
     return (typeof http === "object" &&
@@ -262,9 +140,8 @@ function validateValidatedToken(http) {
         }
         if (typeof provider.claims !== "object" ||
             provider.claims === null ||
-            typeof provider.claims.actor !== "string" ||
-            provider.claims.actor.length === 0) {
-            throw new Error(`defineIdentity(...) validated_token provider ${label} requires \`claims.actor\`.`);
+            !userClaimName(provider.claims)) {
+            throw new Error(`defineIdentity(...) validated_token provider ${label} requires \`claims.user\`.`);
         }
         if (multiple && typeof provider.id !== "string") {
             throw new Error("defineIdentity(...) each validated_token provider requires an `id` when more than one is configured.");
@@ -272,61 +149,45 @@ function validateValidatedToken(http) {
         const hasVerifier = typeof provider.jwks === "string" ||
             provider.discover === true ||
             typeof provider.discoveryUrl === "string" ||
-            provider.introspect !== undefined ||
-            provider.guest !== undefined;
+            provider.introspect !== undefined;
         if (!hasVerifier) {
-            throw new Error(`defineIdentity(...) validated_token provider ${label} must declare one of \`jwks\`, \`discover\`, \`discoveryUrl\`, \`introspect\`, or \`guest\`.`);
+            throw new Error(`defineIdentity(...) validated_token provider ${label} must declare one of \`jwks\`, \`discover\`, \`discoveryUrl\`, or \`introspect\`.`);
         }
     }
 }
 function validateCredentialResolver(credentials) {
     if (credentials === null || typeof credentials !== "object") {
-        throw new Error("defineIdentity(...) `credentials` must be a resolver ({ resolve }) or endpoint ({ endpoint }) config.");
+        throw new Error("defineIdentity(...) `credentials` must be a resolver ({ resolve }), an endpoint " +
+            "({ endpoint }), or a map of target name to either.");
+    }
+    if (isSingleCredentialResolver(credentials)) {
+        validateOneCredentialResolver(credentials, "`credentials`");
+        return;
+    }
+    // Per-target map. An empty one resolves nothing, which is always a mistake.
+    const entries = Object.entries(credentials);
+    if (entries.length === 0) {
+        throw new Error("defineIdentity(...) `credentials` map must declare at least one target, " +
+            "e.g. `{ github: credentials.github({ … }) }`.");
+    }
+    for (const [name, entry] of entries) {
+        if (!name.trim()) {
+            throw new Error("defineIdentity(...) `credentials` map keys must be non-empty target names.");
+        }
+        validateOneCredentialResolver(entry, `\`credentials.${name}\``);
     }
-    const cfg = credentials;
+}
+function validateOneCredentialResolver(entry, label) {
+    if (entry === null || typeof entry !== "object") {
+        throw new Error(`defineIdentity(...) ${label} must be a resolver ({ resolve }) or endpoint ({ endpoint }) config.`);
+    }
+    const cfg = entry;
     const hasResolveFn = typeof cfg.resolve === "function";
     const hasEndpoint = typeof cfg.endpoint === "object" &&
         cfg.endpoint !== null &&
         typeof cfg.endpoint.url === "string";
     if (hasResolveFn === hasEndpoint) {
-        throw new Error("defineIdentity(...) `credentials` requires exactly one of `resolve` (function) or `endpoint` ({ url }).");
-    }
-}
-function isPlainObject(value) {
-    return (typeof value === "object" &&
-        value !== null &&
-        !Array.isArray(value) &&
-        typeof value !== "function");
-}
-function deepMerge(base, patch) {
-    if (patch === undefined)
-        return structuredCloneConfig(base);
-    if (!isPlainObject(base) || !isPlainObject(patch)) {
-        return patch;
-    }
-    const out = { ...base };
-    for (const [key, value] of Object.entries(patch)) {
-        if (value === undefined)
-            continue;
-        const current = out[key];
-        out[key] =
-            isPlainObject(current) && isPlainObject(value)
-                ? deepMerge(current, value)
-                : value;
-    }
-    return out;
-}
-function structuredCloneConfig(value) {
-    if (Array.isArray(value)) {
-        return value.map((item) => structuredCloneConfig(item));
-    }
-    if (isPlainObject(value)) {
-        const out = {};
-        for (const [key, inner] of Object.entries(value)) {
-            out[key] = structuredCloneConfig(inner);
-        }
-        return out;
+        throw new Error(`defineIdentity(...) ${label} requires exactly one of \`resolve\` (function) or \`endpoint\` ({ url }).`);
     }
-    return value;
 }
 //# sourceMappingURL=index.js.map

package/dist/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAgC,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAmC/E,MAAM,OAAO,GAA+C;IAC1D,mBAAmB,EAAE;QACnB,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;KACrE;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE;KACtE;IACD,YAAY,EAAE;QACZ,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;KACvE;IACD,eAAe,EAAE;QACf,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;KACrE;IACD,OAAO,EAAE;QACP,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;KACnD;CACF,CAAC;AAeF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAmB,MAAM,CAAC,MAAM,CACzD,SAAS,cAAc,CAAC,MAAsB;IAC5C,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC,EACD;IACE,MAAM,CACJ,IAAwB,EACxB,SAAuC;QAEvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,8CAA8C,MAAM,CAAC,IAAI,CAAC,KAAK;gBAC7D,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvD,CAAC;QACJ,CAAC;QACD,OAAO,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACpD,CAAC;CACF,CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,KAAK,CAAC,EACJ,MAAM,EACN,QAAQ,GAIT;QACC,OAAO;YACL,MAAM,EAAE,WAAW,MAAM,GAAG;YAC5B,IAAI,EAAE,WAAW,MAAM,wBAAwB;YAC/C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,EAAE,MAAM,EAAsB;QAClC,OAAO;YACL,MAAM,EAAE,WAAW,MAAM,EAAE;YAC3B,IAAI,EAAE,WAAW,MAAM,wBAAwB;YAC/C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,EACH,MAAM,EACN,QAAQ,GAIT;QACC,OAAO;YACL,MAAM,EAAE,WAAW,MAAM,EAAE;YAC3B,IAAI,EAAE,WAAW,MAAM,iBAAiB;YACxC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,EACN,UAAU,EACV,MAAM,GAIP;QACC,MAAM,MAAM,GAAG,uBAAuB,MAAM,kBAAkB,UAAU,EAAE,CAAC;QAC3E,OAAO;YACL,MAAM;YACN,IAAI,EAAE,GAAG,MAAM,wBAAwB;YACvC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,EACJ,QAAQ,EACR,QAAQ,GAIT;QACC,OAAO;YACL,MAAM,EAAE,qCAAqC,QAAQ,OAAO;YAC5D,IAAI,EAAE,qCAAqC,QAAQ,sBAAsB;YACzE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,EAAE,QAAQ,EAAE,GAA0B,EAAE;QAC7C,OAAO;YACL,MAAM,EAAE,6BAA6B;YACrC,IAAI,EAAE,4CAA4C;YAClD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,QAAQ,CAAC,OAAgC;QACvC,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,mEAAmE;IACnE,IAAI,CAAC,EACH,MAAM,EACN,QAAQ,GAIT;QACC,OAAO;YACL,MAAM;YACN,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,OAAO;YACL,EAAE,EAAE,QAAQ;YACZ,UAAU,EAAE;gBACV,GAAG,EAAE,6BAA6B;gBAClC,OAAO,EAAE;oBACP,MAAM,EAAE,6BAA6B;oBACrC,sBAAsB,EAAE,YAAY;oBACpC,YAAY,EAAE,mCAAmC;iBAClD;aACF;YACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,yCAAyC;IACzC,KAAK,CAAC,EACJ,GAAG,EACH,WAAW,GACZ,GAA2C,EAAE;QAC5C,OAAO;YACL,EAAE,EAAE,OAAO;YACX,KAAK,EAAE;gBACL,KAAK,EAAE,IAAI;gBACX,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC;YACD,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,wBAAwB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAErE;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,MAAM,QAAQ,GAAG,MAA4C,CAAC;IAE9D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAyC,CAAC;IACnE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAEZ,CAAC;IACd,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,uDAAuD;IACvD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,UAAU,GAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAW,CAAC,MAAM,CACvE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ,CACrC,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,kDAAkD,UAAU,CAAC,IAAI,CAC/D,IAAI,CACL,iDAAiD,CACnD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC;IACvD,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC;IAC5C,IAAI,eAAe,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,IACE,WAAW;QACX,OAAO,eAAe,KAAK,QAAQ;QAClC,wBAA8C,CAAC,QAAQ,CAAC,eAAe,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uFAAuF,eAAe,KAAK;YACzG,6DAA6D,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,0BAA0B,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnD,CAAC;IAED,+EAA+E;IAC/E,MAAM,IAAI,GAAI,OAA6B,CAAC,IAAI,CAAC;IACjD,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;SAAM,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,yHAAyH,CAC1H,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAgB;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,+EAA+E;YAC7E,+CAA+C,CAClD,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,8CAA8C,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,KAQhB,CAAC;QACF,IAAI,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,uCAAuC,CAC5E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,MAAM,IAAI;YACnB,aAAa;YACb,QAAQ;YACR,gBAAgB;YAChB,kBAAkB;YAClB,QAAQ;YACR,qBAAqB;SACb,EAAE,CAAC;YACX,IAAI,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,OAAO,QAAQ,CAAC,EAAE,iBAAiB,MAAM,KAAK,CACnF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA2B,CAAC,IAAI,KAAK,iBAAiB,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAA2B;IACzD,MAAM,IAAI,GAAI,IAAgC,CAAC,SAAS,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAA+B,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,EAAE,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,qBAAqB,CAC3E,CAAC;QACJ,CAAC;QACD,IACE,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;YACnC,QAAQ,CAAC,MAAM,KAAK,IAAI;YACxB,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ;YACzC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAClC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,6BAA6B,CACnF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GACf,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;YACjC,QAAQ,CAAC,QAAQ,KAAK,IAAI;YAC1B,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ;YACzC,QAAQ,CAAC,UAAU,KAAK,SAAS;YACjC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC;QAC/B,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,8FAA8F,CACpJ,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,WAAoB;IACtD,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,WAAwD,CAAC;IACrE,MAAM,YAAY,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,CAAC;IACvD,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAChC,GAAG,CAAC,QAAQ,KAAK,IAAI;QACrB,OAAQ,GAAG,CAAC,QAA8B,CAAC,GAAG,KAAK,QAAQ,CAAC;IAC9D,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,yGAAyG,CAC1G,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,OAAO,KAAK,KAAK,UAAU,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAI,IAAO,EAAE,KAAiC;IAC9D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,KAAU,CAAC;IACpB,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC;YACN,aAAa,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC;gBAC5C,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,KAAoC,CAAC;gBAC1D,CAAC,CAAC,KAAK,CAAC;IACd,CAAC;IACD,OAAO,GAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAI,KAAQ;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAiB,CAAC;IAC1E,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,GAAG,CAAC,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,GAAQ,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAwB,MAAM,cAAc,CAAC;AACvE,OAAO,EAAgC,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAW/E,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGjD,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AA2BnC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,GAMzB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,gBAAgB,EAChB,4CAA4C,EAC5C,6BAA6B,EAC7B,gCAAgC,EAChC,yBAAyB,EACzB,mBAAmB,EACnB,gCAAgC,EAChC,wBAAwB,GAEzB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,+BAA+B,EAC/B,eAAe,EACf,6BAA6B,GAK9B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,oBAAoB,GAIrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,qCAAqC,EACrC,0BAA0B,EAC1B,mCAAmC,GAEpC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,kCAAkC,EAClC,gCAAgC,EAChC,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,GAEjB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAAC,OAAwB;IACrD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,2EAA2E;IAC3E,eAAe;QACb,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IACvC,CAAC;IACD,oCAAoC;IACpC,QAAQ,CAAC,OAAgC;QACvC,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;CACF,CAAC;AAEF,8EAA8E;AAC9E,MAAM,wBAAwB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAEpE;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAyC,CAAC;IACjE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAER,CAAC;IACd,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,wDAAwD;YACtD,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,sEAAsE;YACtE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC;IACrD,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,CAAC;IAC1C,IAAI,eAAe,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;IACJ,CAAC;IACD,IACE,WAAW;QACX,OAAO,eAAe,KAAK,QAAQ;QAClC,wBAA8C,CAAC,QAAQ,CAAC,eAAe,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qFAAqF,eAAe,KAAK;YACvG,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,0BAA0B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC;IAED,8EAA8E;IAC9E,MAAM,IAAI,GAAI,OAA6B,CAAC,IAAI,CAAC;IACjD,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,4DAA4D;IAC9D,CAAC;SAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,iJAAiJ,CAClJ,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,kDAAkD,CACrD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA2B,CAAC,IAAI,KAAK,mBAAmB,CAC1D,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA2B,CAAC,IAAI,KAAK,iBAAiB,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAA2B;IACzD,MAAM,IAAI,GAAI,IAAgC,CAAC,SAAS,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAA+B,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,EAAE,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,qBAAqB,CAC3E,CAAC;QACJ,CAAC;QACD,IACE,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;YACnC,QAAQ,CAAC,MAAM,KAAK,IAAI;YACxB,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,4BAA4B,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GACf,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;YACjC,QAAQ,CAAC,QAAQ,KAAK,IAAI;YAC1B,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ;YACzC,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC;QACpC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,mFAAmF,CACzI,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,WAAoB;IACtD,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,kFAAkF;YAChF,oDAAoD,CACvD,CAAC;IACJ,CAAC;IACD,IACE,0BAA0B,CACxB,WAA6D,CAC9D,EACD,CAAC;QACD,6BAA6B,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IACD,4EAA4E;IAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,WAAsC,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,+CAA+C,CAClD,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,6BAA6B,CAAC,KAAK,EAAE,iBAAiB,IAAI,IAAI,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CAAC,KAAc,EAAE,KAAa;IAClE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,uBAAuB,KAAK,sEAAsE,CACnG,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,KAAkD,CAAC;IAC/D,MAAM,YAAY,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,CAAC;IACvD,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAChC,GAAG,CAAC,QAAQ,KAAK,IAAI;QACrB,OAAQ,GAAG,CAAC,QAA8B,CAAC,GAAG,KAAK,QAAQ,CAAC;IAC9D,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,uBAAuB,KAAK,4EAA4E,CACzG,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/identity/linkedin/connect-http.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Connect-with-LinkedIn — thin adapter over {@link defineFleetIntegrationConnect}.
+ *
+ * Mounted under `/identity/linkedin/*` when listed on `identity.connect`, or
+ * inferred from declared LinkedIn toolserver connectors on a user-scoped
+ * deployment.
+ */
+import type { FleetIntegrationConnectProviderOptions } from "../fleet-integration-connect.js";
+export declare const LINKEDIN_CONNECT_STATUS_PATH: string;
+export declare const LINKEDIN_CONNECT_START_PATH: string;
+export declare const LINKEDIN_CONNECT_CALLBACK_PATH: string;
+export declare const LINKEDIN_CONNECT_LINK_PATH: string;
+export declare const isLinkedInActorSubjectEnabled: () => boolean;
+export declare const enableLinkedInActorSubject: () => void;
+/**
+ * Enable actor-subject mode when LinkedIn connectors imply per-user vault subjects.
+ *
+ * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
+ */
+export declare const enableLinkedInActorSubjectFromConnectors: (connectorKinds: readonly (string | undefined)[] | undefined, scope?: import("../connect-provider-types.js").IdentityConnectMountContext["scope"]) => void;
+export declare const resetLinkedInActorSubjectEnabledForTests: () => void;
+export declare const isLinkedInConnectConfigured: (env?: NodeJS.ProcessEnv) => boolean;
+export declare const linkedinConnectUrl: (publicAppUrl: string) => string;
+/** Options for {@link createLinkedInIdentityConnectProvider}. */
+export type LinkedInIdentityConnectProviderOptions = FleetIntegrationConnectProviderOptions;
+/** Build a LinkedIn connect provider. */
+export declare const createLinkedInIdentityConnectProvider: (options?: FleetIntegrationConnectProviderOptions) => import("../connect-provider-types.js").IdentityConnectProvider;
+/** Default LinkedIn connect provider used as a built-in mount candidate. */
+export declare const linkedinIdentityConnectProvider: import("../connect-provider-types.js").IdentityConnectProvider;
+/**
+ * Opt into Connect-with-LinkedIn on `defineIdentity({ connect: […] })`.
+ *
+ * Usually unnecessary: declaring `connectors.linkedin` on a user-scoped
+ * identity deployment mounts this provider and derives OAuth scopes automatically.
+ */
+export declare const connect: (options?: FleetIntegrationConnectProviderOptions) => import("../connect-provider-types.js").IdentityConnectProvider;
+//# sourceMappingURL=connect-http.d.ts.map

package/dist/identity/linkedin/connect-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-http.d.ts","sourceRoot":"","sources":["../../../src/identity/linkedin/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAC;AAQ9F,eAAO,MAAM,4BAA4B,QAAwB,CAAC;AAClE,eAAO,MAAM,2BAA2B,QAAyB,CAAC;AAClE,eAAO,MAAM,8BAA8B,QAA0B,CAAC;AACtE,eAAO,MAAM,0BAA0B,QAAsB,CAAC;AAE9D,eAAO,MAAM,6BAA6B,eAAiC,CAAC;AAC5E,eAAO,MAAM,0BAA0B,YAA8B,CAAC;AACtE;;;;GAIG;AACH,eAAO,MAAM,wCAAwC,4JACV,CAAC;AAC5C,eAAO,MAAM,wCAAwC,YACV,CAAC;AAC5C,eAAO,MAAM,2BAA2B,sCAA+B,CAAC;AACxE,eAAO,MAAM,kBAAkB,kCAAsB,CAAC;AAEtD,iEAAiE;AACjE,MAAM,MAAM,sCAAsC,GAChD,sCAAsC,CAAC;AAEzC,yCAAyC;AACzC,eAAO,MAAM,qCAAqC,sHAA0B,CAAC;AAE7E,4EAA4E;AAC5E,eAAO,MAAM,+BAA+B,gEAAoB,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,OAAO,sHAAmB,CAAC"}

package/dist/identity/linkedin/connect-http.js

@@ -0,0 +1,41 @@
+/**
+ * Connect-with-LinkedIn — thin adapter over {@link defineFleetIntegrationConnect}.
+ *
+ * Mounted under `/identity/linkedin/*` when listed on `identity.connect`, or
+ * inferred from declared LinkedIn toolserver connectors on a user-scoped
+ * deployment.
+ */
+import { LINKEDIN_INTEGRATION } from "../../connectors/toolserver/integrations.js";
+import { defineFleetIntegrationConnect } from "../define-fleet-connect.js";
+import { linkedinByoOauth } from "./oauth.js";
+const linkedin = defineFleetIntegrationConnect({
+    integration: LINKEDIN_INTEGRATION,
+    byoClient: linkedinByoOauth,
+});
+export const LINKEDIN_CONNECT_STATUS_PATH = linkedin.paths.status;
+export const LINKEDIN_CONNECT_START_PATH = linkedin.paths.connect;
+export const LINKEDIN_CONNECT_CALLBACK_PATH = linkedin.paths.callback;
+export const LINKEDIN_CONNECT_LINK_PATH = linkedin.paths.link;
+export const isLinkedInActorSubjectEnabled = linkedin.isActorSubjectEnabled;
+export const enableLinkedInActorSubject = linkedin.enableActorSubject;
+/**
+ * Enable actor-subject mode when LinkedIn connectors imply per-user vault subjects.
+ *
+ * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
+ */
+export const enableLinkedInActorSubjectFromConnectors = linkedin.enableActorSubjectFromConnectors;
+export const resetLinkedInActorSubjectEnabledForTests = linkedin.resetActorSubjectEnabledForTests;
+export const isLinkedInConnectConfigured = linkedin.isConnectConfigured;
+export const linkedinConnectUrl = linkedin.connectUrl;
+/** Build a LinkedIn connect provider. */
+export const createLinkedInIdentityConnectProvider = linkedin.createProvider;
+/** Default LinkedIn connect provider used as a built-in mount candidate. */
+export const linkedinIdentityConnectProvider = linkedin.provider;
+/**
+ * Opt into Connect-with-LinkedIn on `defineIdentity({ connect: […] })`.
+ *
+ * Usually unnecessary: declaring `connectors.linkedin` on a user-scoped
+ * identity deployment mounts this provider and derives OAuth scopes automatically.
+ */
+export const connect = linkedin.connect;
+//# sourceMappingURL=connect-http.js.map

package/dist/identity/linkedin/connect-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/linkedin/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAE3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,QAAQ,GAAG,6BAA6B,CAAC;IAC7C,WAAW,EAAE,oBAAoB;IACjC,SAAS,EAAE,gBAAgB;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;AAClE,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;AAClE,MAAM,CAAC,MAAM,8BAA8B,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;AACtE,MAAM,CAAC,MAAM,0BAA0B,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;AAE9D,MAAM,CAAC,MAAM,6BAA6B,GAAG,QAAQ,CAAC,qBAAqB,CAAC;AAC5E,MAAM,CAAC,MAAM,0BAA0B,GAAG,QAAQ,CAAC,kBAAkB,CAAC;AACtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,wCAAwC,GACnD,QAAQ,CAAC,gCAAgC,CAAC;AAC5C,MAAM,CAAC,MAAM,wCAAwC,GACnD,QAAQ,CAAC,gCAAgC,CAAC;AAC5C,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,CAAC,mBAAmB,CAAC;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC,UAAU,CAAC;AAMtD,yCAAyC;AACzC,MAAM,CAAC,MAAM,qCAAqC,GAAG,QAAQ,CAAC,cAAc,CAAC;AAE7E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,+BAA+B,GAAG,QAAQ,CAAC,QAAQ,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC"}

package/dist/identity/linkedin/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * LinkedIn identity helpers — Connect-with-LinkedIn (Fleet vault).
+ */
+export { connect, createLinkedInIdentityConnectProvider, enableLinkedInActorSubject, enableLinkedInActorSubjectFromConnectors, linkedinConnectUrl, linkedinIdentityConnectProvider, isLinkedInActorSubjectEnabled, isLinkedInConnectConfigured, resetLinkedInActorSubjectEnabledForTests, LINKEDIN_CONNECT_CALLBACK_PATH, LINKEDIN_CONNECT_LINK_PATH, LINKEDIN_CONNECT_START_PATH, LINKEDIN_CONNECT_STATUS_PATH, } from "./connect-http.js";
+export type { LinkedInIdentityConnectProviderOptions } from "./connect-http.js";
+export { linkedinOauthTickets } from "./oauth.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/linkedin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/linkedin/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,qCAAqC,EACrC,0BAA0B,EAC1B,wCAAwC,EACxC,kBAAkB,EAClB,+BAA+B,EAC/B,6BAA6B,EAC7B,2BAA2B,EAC3B,wCAAwC,EACxC,8BAA8B,EAC9B,0BAA0B,EAC1B,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,sCAAsC,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC"}

package/dist/identity/linkedin/index.js

@@ -0,0 +1,6 @@
+/**
+ * LinkedIn identity helpers — Connect-with-LinkedIn (Fleet vault).
+ */
+export { connect, createLinkedInIdentityConnectProvider, enableLinkedInActorSubject, enableLinkedInActorSubjectFromConnectors, linkedinConnectUrl, linkedinIdentityConnectProvider, isLinkedInActorSubjectEnabled, isLinkedInConnectConfigured, resetLinkedInActorSubjectEnabledForTests, LINKEDIN_CONNECT_CALLBACK_PATH, LINKEDIN_CONNECT_LINK_PATH, LINKEDIN_CONNECT_START_PATH, LINKEDIN_CONNECT_STATUS_PATH, } from "./connect-http.js";
+export { linkedinOauthTickets } from "./oauth.js";
+//# sourceMappingURL=index.js.map

package/dist/identity/linkedin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/linkedin/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,qCAAqC,EACrC,0BAA0B,EAC1B,wCAAwC,EACxC,kBAAkB,EAClB,+BAA+B,EAC/B,6BAA6B,EAC7B,2BAA2B,EAC3B,wCAAwC,EACxC,8BAA8B,EAC9B,0BAA0B,EAC1B,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC"}

package/dist/identity/linkedin/oauth.d.ts

@@ -0,0 +1,22 @@
+/**
+ * LinkedIn BYO OAuth descriptor — optional non-LangSmith Connect-with-LinkedIn.
+ * The default path uses Fleet auth-sessions instead.
+ */
+import { type ByoOauthConfig, type ByoOauthClient } from "../byo-oauth.js";
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, } from "../byo-oauth.js";
+export type LinkedInOauthConfig = ByoOauthConfig;
+/** LinkedIn BYO OAuth client (config, authorize, exchange, Fleet adapter). */
+export declare const linkedinByoOauth: ByoOauthClient;
+export declare const LINKEDIN_OAUTH_CLIENT_ID_ENV: string;
+export declare const LINKEDIN_OAUTH_CLIENT_SECRET_ENV: string;
+export declare const LINKEDIN_OAUTH_SCOPES_ENV: string;
+export declare const LINKEDIN_OAUTH_AUTH_URL_ENV: string;
+export declare const LINKEDIN_OAUTH_TOKEN_URL_ENV: string;
+export declare const LINKEDIN_OAUTH_USERINFO_URL_ENV: string;
+/** LinkedIn-bound OAuth state / connect-ticket helpers. */
+export declare const linkedinOauthTickets: import("../oauth-tickets.js").OauthTickets;
+export declare const resolveLinkedInOauthRedirectBase: typeof import("../oauth-env.js").resolveOauthRedirectBase;
+export declare const readLinkedInOauthConfig: (env?: NodeJS.ProcessEnv) => ByoOauthConfig | null;
+export declare const buildLinkedInAuthorizeUrl: (config: ByoOauthConfig, state: string, redirectUri: string, scopes?: string) => string;
+export declare const exchangeLinkedInOauthCode: (config: ByoOauthConfig, code: string, redirectUri: string, fetchImpl?: typeof fetch) => Promise<import("../fleet-connect.js").FleetVaultByoTokenResult>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/identity/linkedin/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/linkedin/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAUjD,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,EAAE,cAqB7B,CAAC;AAEH,eAAO,MAAM,4BAA4B,QAAgC,CAAC;AAC1E,eAAO,MAAM,gCAAgC,QACV,CAAC;AACpC,eAAO,MAAM,yBAAyB,QAA8B,CAAC;AACrE,eAAO,MAAM,2BAA2B,QAA+B,CAAC;AACxE,eAAO,MAAM,4BAA4B,QAAgC,CAAC;AAC1E,eAAO,MAAM,+BAA+B,QAAmC,CAAC;AAEhF,2DAA2D;AAC3D,eAAO,MAAM,oBAAoB,4CAA2B,CAAC;AAE7D,eAAO,MAAM,gCAAgC,2DACP,CAAC;AAEvC,eAAO,MAAM,uBAAuB,oDAA8B,CAAC;AACnE,eAAO,MAAM,yBAAyB,yFAAqC,CAAC;AAC5E,eAAO,MAAM,yBAAyB,0JAAgC,CAAC"}