managed-deepagents 0.4.2 → 0.4.3-dev.95

package/dist/identity/google/connect-http.js

@@ -0,0 +1,42 @@
+/**
+ * Connect-with-Google — thin adapter over {@link defineFleetIntegrationConnect}.
+ *
+ * Mounted under `/identity/google/*` when listed on `identity.connect`, or
+ * inferred from declared Google toolserver connectors on a user-scoped
+ * deployment.
+ */
+import { GOOGLE_INTEGRATION } from "../../connectors/toolserver/integrations.js";
+import { defineFleetIntegrationConnect } from "../define-fleet-connect.js";
+import { googleByoOauth } from "./oauth.js";
+const google = defineFleetIntegrationConnect({
+    integration: GOOGLE_INTEGRATION,
+    byoClient: googleByoOauth,
+    fallbackScopes: ["openid", "email", "profile"],
+});
+export const GOOGLE_CONNECT_STATUS_PATH = google.paths.status;
+export const GOOGLE_CONNECT_START_PATH = google.paths.connect;
+export const GOOGLE_CONNECT_CALLBACK_PATH = google.paths.callback;
+export const GOOGLE_CONNECT_LINK_PATH = google.paths.link;
+export const isGoogleActorSubjectEnabled = google.isActorSubjectEnabled;
+export const enableGoogleActorSubject = google.enableActorSubject;
+/**
+ * Enable actor-subject mode when Google connectors imply per-user vault subjects.
+ *
+ * Prefer {@link enableActorSubjectIntegrationsFromConnectors} at compile seams.
+ */
+export const enableGoogleActorSubjectFromConnectors = google.enableActorSubjectFromConnectors;
+export const resetGoogleActorSubjectEnabledForTests = google.resetActorSubjectEnabledForTests;
+export const isGoogleConnectConfigured = google.isConnectConfigured;
+export const googleConnectUrl = google.connectUrl;
+/** Build a Google connect provider. */
+export const createGoogleIdentityConnectProvider = google.createProvider;
+/** Default Google connect provider used as a built-in mount candidate. */
+export const googleIdentityConnectProvider = google.provider;
+/**
+ * Opt into Connect-with-Google on `defineIdentity({ connect: […] })`.
+ *
+ * Usually unnecessary: declaring Google toolserver connectors on a user-scoped
+ * identity deployment mounts this provider and derives OAuth scopes automatically.
+ */
+export const connect = google.connect;
+//# sourceMappingURL=connect-http.js.map

package/dist/identity/google/connect-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-http.js","sourceRoot":"","sources":["../../../src/identity/google/connect-http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAE3E,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,MAAM,GAAG,6BAA6B,CAAC;IAC3C,WAAW,EAAE,kBAAkB;IAC/B,SAAS,EAAE,cAAc;IACzB,cAAc,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;CAC/C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;AAC9D,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;AAC9D,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;AAClE,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;AAE1D,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,qBAAqB,CAAC;AACxE,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,kBAAkB,CAAC;AAClE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GACjD,MAAM,CAAC,gCAAgC,CAAC;AAC1C,MAAM,CAAC,MAAM,sCAAsC,GACjD,MAAM,CAAC,gCAAgC,CAAC;AAC1C,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,mBAAmB,CAAC;AACpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC;AAMlD,uCAAuC;AACvC,MAAM,CAAC,MAAM,mCAAmC,GAAG,MAAM,CAAC,cAAc,CAAC;AAEzE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,QAAQ,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC"}

package/dist/identity/google/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Google identity helpers — Connect-with-Google.
+ */
+export { connect, createGoogleIdentityConnectProvider, enableGoogleActorSubject, enableGoogleActorSubjectFromConnectors, googleConnectUrl, googleIdentityConnectProvider, isGoogleActorSubjectEnabled, isGoogleConnectConfigured, resetGoogleActorSubjectEnabledForTests, GOOGLE_CONNECT_CALLBACK_PATH, GOOGLE_CONNECT_LINK_PATH, GOOGLE_CONNECT_START_PATH, GOOGLE_CONNECT_STATUS_PATH, } from "./connect-http.js";
+export type { GoogleIdentityConnectProviderOptions } from "./connect-http.js";
+export { googleOauthTickets } from "./oauth.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/google/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/google/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,mCAAmC,EACnC,wBAAwB,EACxB,sCAAsC,EACtC,gBAAgB,EAChB,6BAA6B,EAC7B,2BAA2B,EAC3B,yBAAyB,EACzB,sCAAsC,EACtC,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,oCAAoC,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}

package/dist/identity/google/index.js

@@ -0,0 +1,6 @@
+/**
+ * Google identity helpers — Connect-with-Google.
+ */
+export { connect, createGoogleIdentityConnectProvider, enableGoogleActorSubject, enableGoogleActorSubjectFromConnectors, googleConnectUrl, googleIdentityConnectProvider, isGoogleActorSubjectEnabled, isGoogleConnectConfigured, resetGoogleActorSubjectEnabledForTests, GOOGLE_CONNECT_CALLBACK_PATH, GOOGLE_CONNECT_LINK_PATH, GOOGLE_CONNECT_START_PATH, GOOGLE_CONNECT_STATUS_PATH, } from "./connect-http.js";
+export { googleOauthTickets } from "./oauth.js";
+//# sourceMappingURL=index.js.map

package/dist/identity/google/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/google/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,OAAO,EACP,mCAAmC,EACnC,wBAAwB,EACxB,sCAAsC,EACtC,gBAAgB,EAChB,6BAA6B,EAC7B,2BAA2B,EAC3B,yBAAyB,EACzB,sCAAsC,EACtC,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}

package/dist/identity/google/oauth.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Google BYO OAuth descriptor — optional non-LangSmith Connect-with-Google.
+ * The default path uses Fleet auth-sessions instead.
+ */
+import { type ByoOauthConfig, type ByoOauthClient } from "../byo-oauth.js";
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, } from "../byo-oauth.js";
+export type GoogleOauthConfig = ByoOauthConfig;
+/** Google BYO OAuth client (config, authorize, exchange, Fleet adapter). */
+export declare const googleByoOauth: ByoOauthClient;
+export declare const GOOGLE_OAUTH_CLIENT_ID_ENV: string;
+export declare const GOOGLE_OAUTH_CLIENT_SECRET_ENV: string;
+export declare const GOOGLE_OAUTH_SCOPES_ENV: string;
+export declare const GOOGLE_OAUTH_AUTH_URL_ENV: string;
+export declare const GOOGLE_OAUTH_TOKEN_URL_ENV: string;
+export declare const GOOGLE_OAUTH_USERINFO_URL_ENV: string;
+/** Google-bound OAuth state / connect-ticket helpers. */
+export declare const googleOauthTickets: import("../oauth-tickets.js").OauthTickets;
+export declare const resolveGoogleOauthRedirectBase: typeof import("../oauth-env.js").resolveOauthRedirectBase;
+export declare const readGoogleOauthConfig: (env?: NodeJS.ProcessEnv) => ByoOauthConfig | null;
+export declare const buildGoogleAuthorizeUrl: (config: ByoOauthConfig, state: string, redirectUri: string, scopes?: string) => string;
+export declare const exchangeGoogleOauthCode: (config: ByoOauthConfig, code: string, redirectUri: string, fetchImpl?: typeof fetch) => Promise<import("../fleet-connect.js").FleetVaultByoTokenResult>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/identity/google/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/identity/google/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAQ/C,4EAA4E;AAC5E,eAAO,MAAM,cAAc,EAAE,cAsB3B,CAAC;AAEH,eAAO,MAAM,0BAA0B,QAA8B,CAAC;AACtE,eAAO,MAAM,8BAA8B,QAAkC,CAAC;AAC9E,eAAO,MAAM,uBAAuB,QAA4B,CAAC;AACjE,eAAO,MAAM,yBAAyB,QAA6B,CAAC;AACpE,eAAO,MAAM,0BAA0B,QAA8B,CAAC;AACtE,eAAO,MAAM,6BAA6B,QAAiC,CAAC;AAE5E,yDAAyD;AACzD,eAAO,MAAM,kBAAkB,4CAAyB,CAAC;AAEzD,eAAO,MAAM,8BAA8B,2DACP,CAAC;AAErC,eAAO,MAAM,qBAAqB,oDAA4B,CAAC;AAC/D,eAAO,MAAM,uBAAuB,yFAAmC,CAAC;AACxE,eAAO,MAAM,uBAAuB,0JAA8B,CAAC"}

package/dist/identity/google/oauth.js

@@ -0,0 +1,48 @@
+/**
+ * Google BYO OAuth descriptor — optional non-LangSmith Connect-with-Google.
+ * The default path uses Fleet auth-sessions instead.
+ */
+import { createByoOauthClient, } from "../byo-oauth.js";
+export { MDA_PUBLIC_API_URL_ENV, MDA_PUBLIC_APP_URL_ENV, OAUTH_STATE_SIGNING_KEY_ENV, readOauthStateSigningKey, } from "../byo-oauth.js";
+const DEFAULT_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
+const DEFAULT_TOKEN_URL = "https://oauth2.googleapis.com/token";
+const DEFAULT_USERINFO_URL = "https://www.googleapis.com/oauth2/v3/userinfo";
+/** Profile-only default; connector-derived unions replace this at authorize time. */
+const DEFAULT_SCOPES = ["openid", "email", "profile"].join(" ");
+/** Google BYO OAuth client (config, authorize, exchange, Fleet adapter). */
+export const googleByoOauth = createByoOauthClient({
+    providerId: "google",
+    displayName: "Google",
+    envPrefix: "GOOGLE_OAUTH",
+    defaultEndpoints: () => ({
+        authUrl: DEFAULT_AUTH_URL,
+        tokenUrl: DEFAULT_TOKEN_URL,
+        userInfoUrl: DEFAULT_USERINFO_URL,
+        defaultScopes: DEFAULT_SCOPES,
+    }),
+    authorizeParams: { access_type: "offline" },
+    parseUserInfo(json) {
+        return {
+            ...(typeof json.email === "string" && json.email
+                ? { email: json.email }
+                : {}),
+            ...(typeof json.sub === "string" && json.sub
+                ? { subject: json.sub }
+                : {}),
+        };
+    },
+    subjectMetadataKey: "google_sub",
+});
+export const GOOGLE_OAUTH_CLIENT_ID_ENV = googleByoOauth.env.clientId;
+export const GOOGLE_OAUTH_CLIENT_SECRET_ENV = googleByoOauth.env.clientSecret;
+export const GOOGLE_OAUTH_SCOPES_ENV = googleByoOauth.env.scopes;
+export const GOOGLE_OAUTH_AUTH_URL_ENV = googleByoOauth.env.authUrl;
+export const GOOGLE_OAUTH_TOKEN_URL_ENV = googleByoOauth.env.tokenUrl;
+export const GOOGLE_OAUTH_USERINFO_URL_ENV = googleByoOauth.env.userInfoUrl;
+/** Google-bound OAuth state / connect-ticket helpers. */
+export const googleOauthTickets = googleByoOauth.tickets;
+export const resolveGoogleOauthRedirectBase = googleByoOauth.resolveRedirectBase;
+export const readGoogleOauthConfig = googleByoOauth.readConfig;
+export const buildGoogleAuthorizeUrl = googleByoOauth.buildAuthorizeUrl;
+export const exchangeGoogleOauthCode = googleByoOauth.exchangeCode;
+//# sourceMappingURL=oauth.js.map

package/dist/identity/google/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/identity/google/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,oBAAoB,GAGrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAIzB,MAAM,gBAAgB,GAAG,8CAA8C,CAAC;AACxE,MAAM,iBAAiB,GAAG,qCAAqC,CAAC;AAChE,MAAM,oBAAoB,GAAG,+CAA+C,CAAC;AAC7E,qFAAqF;AACrF,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEhE,4EAA4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAmB,oBAAoB,CAAC;IACjE,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,QAAQ;IACrB,SAAS,EAAE,cAAc;IACzB,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;QACvB,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,iBAAiB;QAC3B,WAAW,EAAE,oBAAoB;QACjC,aAAa,EAAE,cAAc;KAC9B,CAAC;IACF,eAAe,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE;IAC3C,aAAa,CAAC,IAAI;QAChB,OAAO;YACL,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK;gBAC9C,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;gBACvB,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG;gBAC1C,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;gBACvB,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IACD,kBAAkB,EAAE,YAAY;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;AACtE,MAAM,CAAC,MAAM,8BAA8B,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC;AACpE,MAAM,CAAC,MAAM,0BAA0B,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;AACtE,MAAM,CAAC,MAAM,6BAA6B,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC;AAE5E,yDAAyD;AACzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC,OAAO,CAAC;AAEzD,MAAM,CAAC,MAAM,8BAA8B,GACzC,cAAc,CAAC,mBAAmB,CAAC;AAErC,MAAM,CAAC,MAAM,qBAAqB,GAAG,cAAc,CAAC,UAAU,CAAC;AAC/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC,iBAAiB,CAAC;AACxE,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC,YAAY,CAAC"}

package/dist/identity/index.d.ts

@@ -2,86 +2,62 @@
  * The managed `identity.ts` declaration primitive.
  *
  * A project's root `identity.ts` exports a named `identity` created with
- * `defineIdentity(...)` (or `defineIdentity.preset(...)`). The compiler
- * discovers it, generates the custom-auth handler, and wires thread/memory
- * scoping and downstream credentials.
+ * `defineIdentity(...)`. The compiler discovers it, generates the custom-auth
+ * handler, and wires thread/memory scoping and downstream credentials.
  *
  * This module is pure authoring-time config construction plus eager validation —
- * it has no runtime dependency (the `providers.*` helpers return plain data).
+ * it has no runtime dependency (the `auth.*` helpers return plain data).
  */
+import { type IdentityOptions } from "./options.js";
 import { type SupabaseProviderOptions } from "./supabase.js";
-import type { IdentityConfig, IdentityDefinition, IdentityPresetName, ValidatedTokenProvider } from "./types.js";
-export type { CredentialResolver, CredentialResolverConfig, CredentialScope, CredentialTarget, HttpIngress, IdentityConfig, IdentityConnectProvider, IdentityDefinition, IdentityPresetName, MemoryScope, ResolvedCredential, RuntimeIdentity, Tenancy, ThreadScope, ValidatedTokenIngress, ValidatedTokenProvider, } from "./types.js";
-export type { GitHubActorTokenArgs, GitHubAppJwtArgs, GitHubCredentialsOptions, GitHubTokenSource, } from "./github/credentials.js";
-/** The signature of {@link defineIdentity}, including its `.preset` helper. */
-export interface DefineIdentity {
-    (config: IdentityConfig): IdentityDefinition;
-    /**
-     * Start from a named archetype and optionally override any subset of it. The
-     * headline API for the common case.
-     */
-    preset(name: IdentityPresetName, overrides?: DeepPartial<IdentityConfig>): IdentityDefinition;
-}
+import type { IdentityConfig, IdentityDefinition, LangSmithApiKeyIngress, ValidatedTokenProvider } from "./types.js";
+export { normalizeGroups, userClaimName } from "./claims.js";
+export { normalizeIdentity } from "./options.js";
+export type { IdentityAuth, IdentityOptions } from "./options.js";
+export { credentialTargetNames, isSingleCredentialResolver, } from "./credential-resolvers.js";
+export type { ClaimMapping, CredentialConnectRequirements, CredentialResolver, CredentialResolverConfig, CredentialResolvers, CredentialScope, CredentialTarget, HttpIngress, IdentityConfig, IdentityConnectProvider, IdentityDefinition, LangSmithApiKeyIngress, ResolvedCredential, RuntimeIdentity, ValidatedTokenIngress, ValidatedTokenProvider, } from "./types.js";
+export type { GitHubAppJwtArgs, GitHubCredentialsOptions, GitHubTokenSource, GitHubUserTokenArgs, } from "./github/credentials.js";
+export { createFleetAuthSession, deleteAgentConnection, hasFleetAuthCredentials, listAgentConnections, resolveFleetApiUrl, resolveFleetHeaders, upsertAgentProviderToken, type CreateFleetAuthSessionBody, type FleetAuthSession, type FleetClientOptions, type FleetConnection, type UpsertAgentProviderTokenBody, } from "./fleet.js";
+export { agentIdFromActor, enableActorSubjectIntegrationsFromConnectors, enableActorSubjectIntegration, isActorSubjectIntegrationEnabled, isActorSubjectSlugEnabled, NAMESPACE_MDA_ACTOR, resetActorSubjectEnabledForTests, resolveActorDeploymentId, type AgentIdFromActorOptions, } from "./actor-subject.js";
+export { createFleetVaultConnectProvider, fleetConnectUrl, isFleetVaultConnectConfigured, type FleetVaultByoOauth, type FleetVaultByoOauthConfig, type FleetVaultConnectProviderOptions, type FleetVaultByoTokenResult, } from "./fleet-connect.js";
+export { createByoOauthClient, type ByoOauthClient, type ByoOauthConfig, type CreateByoOauthClientOptions, } from "./byo-oauth.js";
+export { createFleetIntegrationConnectProvider, fleetIntegrationConnectUrl, isFleetIntegrationConnectConfigured, type FleetIntegrationConnectProviderOptions, } from "./fleet-integration-connect.js";
+export { clearFleetConnectHintCacheForTests, createFleetConnectHintMiddleware, fleetConnectHintUrl, rewriteFleetToolError, } from "./fleet-connect-hint.js";
+export { createConnectTicket, createOauthState, oauthTicketsFor, verifyConnectTicket, verifyOauthState, type OauthTickets, } from "./oauth-tickets.js";
 /**
  * Declare the identity contract for the deployment.
  *
- * Most developers call {@link defineIdentity.preset} instead. The three scoping
- * axes are the power-user layer underneath.
+ * Managed identity always gives each caller private threads and downstream
+ * credentials. Authentication must be declared explicitly:
+ *
+ * ```ts
+ * export const identity = defineIdentity({
+ *   auth: auth.langsmithApiKey(),
+ * });
+ * ```
+ *
+ * Otherwise describe how callers authenticate:
+ *
+ * ```ts
+ * export const identity = defineIdentity({
+ *   auth: auth.supabase({ projectRef: "abcdefgh" }),
+ * });
+ * ```
  */
-export declare const defineIdentity: DefineIdentity;
+export declare function defineIdentity(options: IdentityOptions): IdentityDefinition;
 /**
- * Provider integrations — authoring-time sugar over {@link ValidatedTokenProvider}.
- * Each returns a plain provider object you can spread-and-override, so
- * there is no new runtime surface.
+ * Authentication modes and validated-token providers. Every helper returns
+ * plain authoring-time configuration; the managed runtime performs validation.
  */
-export declare const providers: {
-    auth0({ domain, audience, }: {
-        domain: string;
-        audience?: string;
-    }): ValidatedTokenProvider;
-    clerk({ domain }: {
-        domain: string;
-    }): ValidatedTokenProvider;
-    okta({ domain, audience, }: {
-        domain: string;
-        audience?: string;
-    }): ValidatedTokenProvider;
-    cognito({ userPoolId, region, }: {
-        userPoolId: string;
-        region: string;
-    }): ValidatedTokenProvider;
-    entra({ tenantId, audience, }: {
-        tenantId: string;
-        audience?: string;
-    }): ValidatedTokenProvider;
-    google({ audience }?: {
-        audience?: string;
-    }): ValidatedTokenProvider;
+export declare const auth: {
+    /** Authenticate workspace/service callers with a LangSmith `x-api-key`. */
+    langsmithApiKey(): LangSmithApiKeyIngress;
     /** @see {@link supabaseProvider} */
     supabase(options: SupabaseProviderOptions): ValidatedTokenProvider;
-    /** Universal fallback for any OIDC-compliant IdP via discovery. */
-    oidc({ issuer, audience, }: {
-        issuer: string;
-        audience?: string;
-    }): ValidatedTokenProvider;
-    /**
-     * GitHub OAuth access tokens (opaque bearer tokens, not JWTs). MDA verifies
-     * each request by calling `GET https://api.github.com/user` with the token.
-     */
-    github(): ValidatedTokenProvider;
-    /** MDA-issued anonymous/guest tokens. */
-    guest({ ttl, actorPrefix, }?: {
-        ttl?: string;
-        actorPrefix?: string;
-    }): ValidatedTokenProvider;
 };
 /**
  * Eagerly reject illegal identity configs at authoring time so misconfig never
  * reaches the compiler or runtime.
  */
 export declare function validateIdentity(config: IdentityConfig): void;
-/** Recursively merge plain objects; arrays and primitives from `patch` win. */
-type DeepPartial<T> = T extends object ? {
-    [K in keyof T]?: DeepPartial<T[K]>;
-} : T;
 //# sourceMappingURL=index.d.ts.map

package/dist/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,KAAK,uBAAuB,EAAoB,MAAM,eAAe,CAAC;AAC/E,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAElB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,cAAc,EACd,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,OAAO,EACP,WAAW,EACX,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AA8BjC,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,CAAC,MAAM,EAAE,cAAc,GAAG,kBAAkB,CAAC;IAC7C;;;OAGG;IACH,MAAM,CACJ,IAAI,EAAE,kBAAkB,EACxB,SAAS,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,GACtC,kBAAkB,CAAC;CACvB;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,cAoB5B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,SAAS;IACpB,KAAK,wBAGF;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;IAU1B,KAAK,aAAa;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,sBAAsB;IAS7D,IAAI,wBAGD;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;IAU1B,OAAO,0BAGJ;QACD,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,sBAAsB;IAU1B,KAAK,0BAGF;QACD,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;IAU1B,MAAM,gBAAe;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,sBAAsB;IAUxE,oCAAoC;IACpC,QAAQ,UAAU,uBAAuB,GAAG,sBAAsB;IAIlE,mEAAmE;IACnE,IAAI,wBAGD;QACD,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,sBAAsB;IAU1B;;;OAGG;IACH,MAAM,IAAI,sBAAsB;IAehC,yCAAyC;IACzC,KAAK,yBAGF;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,sBAAsB;CAWxE,CAAC;AAIF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CA8E7D;AAuHD,+EAA+E;AAC/E,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,MAAM,GAClC;KAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GACtC,CAAC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,KAAK,uBAAuB,EAAoB,MAAM,eAAe,CAAC;AAC/E,OAAO,KAAK,EAGV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EAEtB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAElE,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,YAAY,EACZ,6BAA6B,EAC7B,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,cAAc,EACd,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,4BAA4B,GAClC,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,gBAAgB,EAChB,4CAA4C,EAC5C,6BAA6B,EAC7B,gCAAgC,EAChC,yBAAyB,EACzB,mBAAmB,EACnB,gCAAgC,EAChC,wBAAwB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,+BAA+B,EAC/B,eAAe,EACf,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,gCAAgC,EACrC,KAAK,wBAAwB,GAC9B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,2BAA2B,GACjC,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,qCAAqC,EACrC,0BAA0B,EAC1B,mCAAmC,EACnC,KAAK,sCAAsC,GAC5C,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,kCAAkC,EAClC,gCAAgC,EAChC,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,kBAAkB,CAI3E;AAED;;;GAGG;AACH,eAAO,MAAM,IAAI;IACf,2EAA2E;IAC3E,eAAe,IAAI,sBAAsB;IAGzC,oCAAoC;IACpC,QAAQ,UAAU,uBAAuB,GAAG,sBAAsB;CAGnE,CAAC;AAKF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAoE7D"}