managed-deepagents 0.5.3-dev.112 → 0.5.3-dev.113

package/README.md

@@ -45,14 +45,18 @@ per-platform optional dependencies, so install only downloads the binary for you
 OS and CPU architecture. This npm-installed CLI scaffolds and compiles TypeScript
 projects only and vendors the TypeScript runtime bundled with this package.
 
-To start a new project:
+To start a new project, run `mda init` and follow the guided setup:
 
 ```bash
-mda init my-agent
-cd my-agent
-npm install
+mda init
 ```
 
+After scaffolding, choose a coding agent to continue building or choose
+**View raw prompt** to copy the setup instructions. The CLI supports Deep Agents
+Code, Claude Code, Codex, Cursor, Droid, Gemini CLI, opencode, and Pi. If Deep
+Agents Code is not installed, selecting it offers the official install command;
+on native Windows, use WSL. Coding agents open in the new project directory.
+
 `mda init` can shape the project up front — `--instructions "..."` (or
 `--instructions-file <path>`) writes the system prompt, `--model <spec>` picks
 the model, `--memory agent` opts into deployment-shared durable memory, and
@@ -60,8 +64,7 @@ the model, `--memory agent` opts into deployment-shared durable memory, and
 `identity.ts` that explicitly selects `auth.langsmithApiKey()` authentication.
 Managed Deep Agent evals are Harbor tasks under `evals/tasks/`. Optionally create
 a minimal source task under `evals/scaffold/` with `mda evals init <name>`, then
-package the managed agent and scaffolded tasks with `mda evals compile .`.
-Nothing prompts, so these commands also work in coding agents and CI scripts.
+package the managed agent and scaffolded tasks with `mda evals compile`.
 
 `mda init my-agent --gateway` runs the agent on
 [LangSmith Gateway](https://docs.langchain.com/langsmith/gateway) — a model
@@ -136,14 +139,25 @@ Create one file per schedule under `schedules/` and export a named `schedule`:
 ```ts
 // schedules/daily-digest.ts
 import { defineSchedule } from "managed-deepagents";
+import prompt from "./daily-digest.md" with { type: "text" };
 
 export const schedule = defineSchedule({
   cron: "0 8 * * 1-5",
   timezone: "America/Los_Angeles",
-  prompt: "Write the daily digest.",
+  prompt,
 });
 ```
 
+```md
+<!-- schedules/daily-digest.md -->
+Write the daily digest.
+```
+
+`mda` inlines `import … with { type: "text" }` into a string constant at compile
+time. The package also ships ambient `*.md` typings, so TypeScript accepts the
+import once you depend on `managed-deepagents` — no project-local
+`declare module "*.md"` needed.
+
 `mda deploy` reconciles schedules as LangSmith cron jobs after the deployment is
 live. Declarations must be statically serializable literals or top-level
 constants; prompt schedules become user-message input, and stateless runs clean
@@ -249,11 +263,11 @@ mda delete ./my-agent
 ```
 
 `mda delete` (alias `mda destroy`) removes the LangSmith deployment, the tracing
-project created alongside it, the deployment's Context Hub repo including the
-per-user memory repos beneath it, and the managed sandboxes the
-deployment created. It asks for confirmation first; pass `--yes` to skip the
-prompt in scripts. Agent memory and thread history are not recoverable
-afterwards.
+project created alongside it, the deployment's Context Hub repo (plus any legacy
+per-user or org child memory repos left from older runtimes), and the managed
+sandboxes the deployment created. It asks for confirmation first; pass `--yes`
+to skip the prompt in scripts. Agent memory and thread history are not
+recoverable afterwards.
 
 Sandboxes are matched by name: the runtime names each one
 `{deployment}--{digest}`, which also lets a restarted deployment re-adopt its
@@ -264,9 +278,9 @@ Sandboxes created before this behavior existed are unnamed and are left to
 LangSmith's idle-stop and retention window.
 
 Before deploying, make sure your model provider key such as `OPENAI_API_KEY`
-or `ANTHROPIC_API_KEY` is available in the project `.env`, the process
-environment, or LangSmith workspace secrets. For LangSmith itself, set
-`LANGSMITH_API_KEY` the same way, or run interactively and press Enter at the
-prompt to sign in with your browser (the CLI creates a key and writes it to
-`.env`). TypeScript deploys also require `npm` on `PATH` because the CLI
-generates a lockfile for the remote build.
+or `ANTHROPIC_API_KEY` is available in the project `.env` or LangSmith
+workspace secrets; a value exported in your shell is not deployed. For
+LangSmith itself, set `LANGSMITH_API_KEY` in `.env` or your shell, or run
+interactively and press Enter at the prompt to sign in with your browser (the
+CLI creates a key and writes it to `.env`). TypeScript deploys also require
+`npm` on `PATH` because the CLI generates a lockfile for the remote build.

package/dist/channels/manifest.d.ts

@@ -32,6 +32,4 @@ export interface ChannelManifest {
     /** Opaque-to-core provider config (Slack filters/conversation, …). */
     providerConfig: JsonObject;
 }
-/** Author-supplied requirements fields; `name` / `provider` are stamped by the factory. */
-export type ChannelManifestBody = Omit<ChannelManifest, "name" | "provider">;
 //# sourceMappingURL=manifest.d.ts.map

package/dist/channels/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/channels/manifest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,2EAA2E;AAC3E,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,gEAAgE;IAChE,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,sEAAsE;IACtE,cAAc,EAAE,UAAU,CAAC;CAC5B;AAED,2FAA2F;AAC3F,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,UAAU,CAAC,CAAC"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/channels/manifest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,2EAA2E;AAC3E,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,SAAS,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,gEAAgE;IAChE,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,sEAAsE;IACtE,cAAc,EAAE,UAAU,CAAC;CAC5B"}

package/dist/extension.d.ts

@@ -16,8 +16,8 @@
  * project cannot mount its own adapter or HTTP route into the managed runtime.
  * Opening it up to third-party packages is a later step.
  *
- * The `auth` and `credentials` primitives are extended by plain factories rather
- * than through here: they return inert configuration objects with no brand,
+ * The `auth` primitive is extended by a plain factory rather
+ * than through here: it returns inert configuration objects with no brand,
  * hooks, or normalization to share. They gain an envelope when this API is
  * exported and their inputs need validating at the boundary.
  */

package/dist/extension.js

@@ -16,8 +16,8 @@
  * project cannot mount its own adapter or HTTP route into the managed runtime.
  * Opening it up to third-party packages is a later step.
  *
- * The `auth` and `credentials` primitives are extended by plain factories rather
- * than through here: they return inert configuration objects with no brand,
+ * The `auth` primitive is extended by a plain factory rather
+ * than through here: it returns inert configuration objects with no brand,
  * hooks, or normalization to share. They gain an envelope when this API is
  * exported and their inputs need validating at the boundary.
  */

package/dist/identity/index.d.ts

@@ -3,7 +3,7 @@
  *
  * A project's root `identity.ts` exports a named `identity` created with
  * `defineIdentity(...)`. The compiler discovers it, generates the custom-auth
- * handler, and wires thread/memory scoping and downstream credentials.
+ * handler, and wires thread ownership for authenticated callers.
  *
  * This module is pure authoring-time config construction plus eager validation —
  * it has no runtime dependency (the `auth.*` helpers return plain data).
@@ -14,9 +14,7 @@ import type { IdentityConfig, IdentityDefinition, LangSmithApiKeyIngress, Valida
 export { normalizeGroups, userClaimName } from "./claims.js";
 export { normalizeIdentity } from "./options.js";
 export type { IdentityAuth, IdentityOptions } from "./options.js";
-export { credentialTargetNames, isSingleCredentialResolver, } from "./credential-resolvers.js";
-export type { ClaimMapping, CredentialResolver, CredentialResolverConfig, CredentialResolvers, CredentialScope, CredentialTarget, HttpIngress, IdentityConfig, IdentityDefinition, LangSmithApiKeyIngress, ResolvedCredential, RuntimeIdentity, ValidatedTokenIngress, ValidatedTokenProvider, } from "./types.js";
-export type { GitHubAppJwtArgs, GitHubCredentialsOptions, GitHubTokenSource, GitHubUserTokenArgs, } from "./github/credentials.js";
+export type { ClaimMapping, CredentialScope, HttpIngress, IdentityConfig, IdentityDefinition, LangSmithApiKeyIngress, RuntimeIdentity, ValidatedTokenIngress, ValidatedTokenProvider, } from "./types.js";
 /**
  * Declare the identity contract for the deployment.
  *

package/dist/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,KAAK,uBAAuB,EAAoB,MAAM,eAAe,CAAC;AAC/E,OAAO,KAAK,EAGV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EAEtB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAElE,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,kBAAkB,CAI3E;AAED;;;GAGG;AACH,eAAO,MAAM,IAAI;IACf,2EAA2E;IAC3E,eAAe,IAAI,sBAAsB;IAGzC,oCAAoC;IACpC,QAAQ,UAAU,uBAAuB,GAAG,sBAAsB;CAGnE,CAAC;AAKF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CA6D7D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,KAAK,uBAAuB,EAAoB,MAAM,eAAe,CAAC;AAC/E,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EAEtB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAElE,YAAY,EACV,YAAY,EACZ,eAAe,EACf,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,kBAAkB,CAI3E;AAED;;;GAGG;AACH,eAAO,MAAM,IAAI;IACf,2EAA2E;IAC3E,eAAe,IAAI,sBAAsB;IAGzC,oCAAoC;IACpC,QAAQ,UAAU,uBAAuB,GAAG,sBAAsB;CAGnE,CAAC;AAEF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAuC7D"}

package/dist/identity/index.js

@@ -3,18 +3,16 @@
  *
  * A project's root `identity.ts` exports a named `identity` created with
  * `defineIdentity(...)`. The compiler discovers it, generates the custom-auth
- * handler, and wires thread/memory scoping and downstream credentials.
+ * handler, and wires thread ownership for authenticated callers.
  *
  * This module is pure authoring-time config construction plus eager validation —
  * it has no runtime dependency (the `auth.*` helpers return plain data).
  */
 import { userClaimName } from "./claims.js";
-import { isSingleCredentialResolver } from "./credential-resolvers.js";
 import { normalizeIdentity } from "./options.js";
 import { supabaseProvider } from "./supabase.js";
 export { normalizeGroups, userClaimName } from "./claims.js";
 export { normalizeIdentity } from "./options.js";
-export { credentialTargetNames, isSingleCredentialResolver, } from "./credential-resolvers.js";
 /**
  * Declare the identity contract for the deployment.
  *
@@ -54,8 +52,6 @@ export const auth = {
         return supabaseProvider(options);
     },
 };
-/** Non-custom credentials modes currently selectable on `CredentialScope`. */
-const MANAGED_CREDENTIAL_MODES = ["user", "agent", "none"];
 /**
  * Eagerly reject illegal identity configs at authoring time so misconfig never
  * reaches the compiler or runtime.
@@ -78,21 +74,6 @@ export function validateIdentity(config) {
             "has its own root declaration: export `memory` from `memory.ts` with " +
             '`defineMemory({ scope: "agent" })`, and drop `scope.memory` here.');
     }
-    // Credentials axis must agree with the presence of a resolver/endpoint.
-    const hasResolver = config.credentials !== undefined;
-    const credentialsMode = scope.credentials;
-    if (credentialsMode === "custom" && !hasResolver) {
-        throw new Error('defineIdentity(...) with scope.credentials: "custom" requires a `credentials` resolver or endpoint.');
-    }
-    if (hasResolver &&
-        typeof credentialsMode === "string" &&
-        MANAGED_CREDENTIAL_MODES.includes(credentialsMode)) {
-        throw new Error(`defineIdentity(...) provides a \`credentials\` resolver but scope.credentials is "${credentialsMode}". ` +
-            'Set scope.credentials: "custom" (or remove the resolver).');
-    }
-    if (hasResolver) {
-        validateCredentialResolver(config.credentials);
-    }
     // validated_token ingress needs at least one provider, each with claims.user.
     const http = ingress.http;
     if (isLangSmithApiKey(http)) {
@@ -139,44 +120,16 @@ function validateValidatedToken(http) {
             provider.discover === true ||
             typeof provider.discoveryUrl === "string" ||
             provider.introspect !== undefined;
+        // Local JWKS/OIDC verification must reject tokens minted for another app.
+        // Introspection leaves audience checks to the IdP.
+        if (hasVerifier &&
+            provider.introspect === undefined &&
+            (typeof provider.audience !== "string" || provider.audience.length === 0)) {
+            throw new Error(`defineIdentity(...) validated_token provider ${label} requires a non-empty audience for JWKS verification.`);
+        }
         if (!hasVerifier) {
             throw new Error(`defineIdentity(...) validated_token provider ${label} must declare one of \`jwks\`, \`discover\`, \`discoveryUrl\`, or \`introspect\`.`);
         }
     }
 }
-function validateCredentialResolver(credentials) {
-    if (credentials === null || typeof credentials !== "object") {
-        throw new Error("defineIdentity(...) `credentials` must be a resolver ({ resolve }), an endpoint " +
-            "({ endpoint }), or a map of target name to either.");
-    }
-    if (isSingleCredentialResolver(credentials)) {
-        validateOneCredentialResolver(credentials, "`credentials`");
-        return;
-    }
-    // Per-target map. An empty one resolves nothing, which is always a mistake.
-    const entries = Object.entries(credentials);
-    if (entries.length === 0) {
-        throw new Error("defineIdentity(...) `credentials` map must declare at least one target, " +
-            "e.g. `{ github: credentials.github({ … }) }`.");
-    }
-    for (const [name, entry] of entries) {
-        if (!name.trim()) {
-            throw new Error("defineIdentity(...) `credentials` map keys must be non-empty target names.");
-        }
-        validateOneCredentialResolver(entry, `\`credentials.${name}\``);
-    }
-}
-function validateOneCredentialResolver(entry, label) {
-    if (entry === null || typeof entry !== "object") {
-        throw new Error(`defineIdentity(...) ${label} must be a resolver ({ resolve }) or endpoint ({ endpoint }) config.`);
-    }
-    const cfg = entry;
-    const hasResolveFn = typeof cfg.resolve === "function";
-    const hasEndpoint = typeof cfg.endpoint === "object" &&
-        cfg.endpoint !== null &&
-        typeof cfg.endpoint.url === "string";
-    if (hasResolveFn === hasEndpoint) {
-        throw new Error(`defineIdentity(...) ${label} requires exactly one of \`resolve\` (function) or \`endpoint\` ({ url }).`);
-    }
-}
 //# sourceMappingURL=index.js.map

package/dist/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAwB,MAAM,cAAc,CAAC;AACvE,OAAO,EAAgC,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAW/E,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGjD,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AAyBnC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAAC,OAAwB;IACrD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,2EAA2E;IAC3E,eAAe;QACb,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IACvC,CAAC;IACD,oCAAoC;IACpC,QAAQ,CAAC,OAAgC;QACvC,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;CACF,CAAC;AAEF,8EAA8E;AAC9E,MAAM,wBAAwB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAEpE;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAyC,CAAC;IACjE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAER,CAAC;IACd,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,wDAAwD;YACtD,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,sEAAsE;YACtE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC;IACrD,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,CAAC;IAC1C,IAAI,eAAe,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;IACJ,CAAC;IACD,IACE,WAAW;QACX,OAAO,eAAe,KAAK,QAAQ;QAClC,wBAA8C,CAAC,QAAQ,CAAC,eAAe,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qFAAqF,eAAe,KAAK;YACvG,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,0BAA0B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC;IAED,8EAA8E;IAC9E,MAAM,IAAI,GAAI,OAA6B,CAAC,IAAI,CAAC;IACjD,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,4DAA4D;IAC9D,CAAC;SAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,iJAAiJ,CAClJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA2B,CAAC,IAAI,KAAK,mBAAmB,CAC1D,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA2B,CAAC,IAAI,KAAK,iBAAiB,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAA2B;IACzD,MAAM,IAAI,GAAI,IAAgC,CAAC,SAAS,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAA+B,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,EAAE,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,qBAAqB,CAC3E,CAAC;QACJ,CAAC;QACD,IACE,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;YACnC,QAAQ,CAAC,MAAM,KAAK,IAAI;YACxB,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,4BAA4B,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GACf,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;YACjC,QAAQ,CAAC,QAAQ,KAAK,IAAI;YAC1B,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ;YACzC,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC;QACpC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,mFAAmF,CACzI,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,WAAoB;IACtD,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,kFAAkF;YAChF,oDAAoD,CACvD,CAAC;IACJ,CAAC;IACD,IACE,0BAA0B,CACxB,WAA6D,CAC9D,EACD,CAAC;QACD,6BAA6B,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IACD,4EAA4E;IAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,WAAsC,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,+CAA+C,CAClD,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,6BAA6B,CAAC,KAAK,EAAE,iBAAiB,IAAI,IAAI,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CAAC,KAAc,EAAE,KAAa;IAClE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,uBAAuB,KAAK,sEAAsE,CACnG,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,KAAkD,CAAC;IAC/D,MAAM,YAAY,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,CAAC;IACvD,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAChC,GAAG,CAAC,QAAQ,KAAK,IAAI;QACrB,OAAQ,GAAG,CAAC,QAA8B,CAAC,GAAG,KAAK,QAAQ,CAAC;IAC9D,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,uBAAuB,KAAK,4EAA4E,CACzG,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAwB,MAAM,cAAc,CAAC;AACvE,OAAO,EAAgC,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAS/E,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAejD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAAC,OAAwB;IACrD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,2EAA2E;IAC3E,eAAe;QACb,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IACvC,CAAC;IACD,oCAAoC;IACpC,QAAQ,CAAC,OAAgC;QACvC,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAyC,CAAC;IACjE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAER,CAAC;IACd,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,wDAAwD;YACtD,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,sEAAsE;YACtE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,MAAM,IAAI,GAAI,OAA6B,CAAC,IAAI,CAAC;IACjD,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,4DAA4D;IAC9D,CAAC;SAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,iJAAiJ,CAClJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA2B,CAAC,IAAI,KAAK,mBAAmB,CAC1D,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA2B,CAAC,IAAI,KAAK,iBAAiB,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAA2B;IACzD,MAAM,IAAI,GAAI,IAAgC,CAAC,SAAS,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAA+B,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,EAAE,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,qBAAqB,CAC3E,CAAC;QACJ,CAAC;QACD,IACE,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;YACnC,QAAQ,CAAC,MAAM,KAAK,IAAI;YACxB,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,4BAA4B,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GACf,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;YACjC,QAAQ,CAAC,QAAQ,KAAK,IAAI;YAC1B,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ;YACzC,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC;QACpC,0EAA0E;QAC1E,mDAAmD;QACnD,IACE,WAAW;YACX,QAAQ,CAAC,UAAU,KAAK,SAAS;YACjC,CAAC,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,EACzE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,uDAAuD,CAC7G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,mFAAmF,CACzI,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/identity/options.js

@@ -65,6 +65,11 @@ function assertOptionKeys(options) {
             "declare. Durable memory has its own root declaration: export `memory` " +
             'from `memory.ts` with `defineMemory({ scope: "agent" })`.');
     }
+    if ("credentials" in options) {
+        throw new Error("defineIdentity(...) `credentials` is no longer supported. Downstream " +
+            "credentials are always per-caller. Mint tokens in your own tools " +
+            "(for example from `GITHUB_TOKEN`) rather than declaring a resolver.");
+    }
     const unknown = Object.keys(options).filter((key) => !KNOWN_OPTION_KEYS.has(key));
     if (unknown.length > 0) {
         throw new Error(`defineIdentity(...) unknown option(s): ${unknown.join(", ")}. ` +

package/dist/identity/options.js.map

@@ -1 +1 @@
-{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA8BH;;;;;GAKG;AACH,SAAS,gBAAgB;IACvB,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAwB;IACxD,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE1B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QAC/C,KAAK,EAAE,gBAAgB,EAAE;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAkB;IACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,+EAA+E,CACnI,CAAC;IACJ,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAsC;IAEtC,OAAO,CACL,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,CAC5E,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5C;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAwB;IAChD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,gDAAgD;IAChD,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,uEAAuE;YACvE,wEAAwE;YACxE,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CACzC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CACrC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC9D,kBAAkB,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/identity/options.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA8BH;;;;;GAKG;AACH,SAAS,gBAAgB;IACvB,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAwB;IACxD,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE1B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QAC/C,KAAK,EAAE,gBAAgB,EAAE;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAkB;IACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,+EAA+E,CACnI,CAAC;IACJ,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAsC;IAEtC,OAAO,CACL,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,CAC5E,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5C;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAwB;IAChD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,gDAAgD;IAChD,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,uEAAuE;YACvE,wEAAwE;YACxE,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,mEAAmE;YACnE,qEAAqE,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CACzC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CACrC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC9D,kBAAkB,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/identity/supabase.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supabase.d.ts","sourceRoot":"","sources":["../../src/identity/supabase.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACtB,MAAM,GACN;IACE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEN,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACzC,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAMD,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAStD;AAyDD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAC/B,sBAAsB,CAgFxB"}
+{"version":3,"file":"supabase.d.ts","sourceRoot":"","sources":["../../src/identity/supabase.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACtB,MAAM,GACN;IACE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEN,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACzC,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAMD,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAStD;AAyDD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAC/B,sBAAsB,CAkFxB"}

package/dist/identity/supabase.js

@@ -120,6 +120,7 @@ export function supabaseProvider(options) {
         return {
             id: "supabase",
             discoveryUrl: supabaseAuthV1Base(url),
+            audience: "authenticated",
             algorithms: ["ES256", "RS256"],
             claims: { user: "email" },
         };
@@ -132,6 +133,7 @@ export function supabaseProvider(options) {
         id: "supabase",
         issuer: base,
         jwks: `${base}/.well-known/jwks.json`,
+        audience: "authenticated",
         algorithms: ["ES256", "RS256"],
         claims: { user: "email" },
     };

package/dist/identity/supabase.js.map

@@ -1 +1 @@
-{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../../src/identity/supabase.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAuCH,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO,WAAW,UAAU,sBAAsB,CAAC;AACrD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,OAAO,UAAU,CAAC;AAC9B,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAuC;IAEvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,IAAI,MAA0B,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC;aAAM,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACrB,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,OAAuC;IAEvC,MAAM,GAAG,GAGL,EAAE,CAAC;IACP,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GACP,KAAK,CAAC,GAAG;YACT,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,8BAA8B,MAAM,sCAAsC,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAgC;IAEhC,MAAM,EACJ,UAAU,EACV,GAAG,EACH,UAAU,EACV,OAAO,EACP,YAAY,GAAG,mBAAmB,GACnC,GAAG,OAAO,CAAC;IAEZ,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,QAAQ,GAA2B;gBACvC,EAAE,EAAE,UAAU;gBACd,UAAU,EAAE;oBACV,YAAY;oBACZ,OAAO,EAAE,wBAAwB,CAAC,OAAO,CAAC;oBAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;iBAC5C;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;aAC1B,CAAC;YACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;YAC7B,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO;gBACL,EAAE,EAAE,UAAU;gBACd,YAAY,EAAE,QAAQ;gBACtB,UAAU,EAAE;oBACV,GAAG,EAAE,GAAG,QAAQ,OAAO;oBACvB,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;iBAC5C;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;aAC1B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,UAAU;YACd,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE;gBACV,GAAG,EAAE,GAAG,IAAI,OAAO;gBACnB,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;aAC5C;YACD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,EAAE,CAAC;QACR,OAAO;YACL,EAAE,EAAE,UAAU;YACd,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC;YACrC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO;QACL,EAAE,EAAE,UAAU;QACd,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,GAAG,IAAI,wBAAwB;QACrC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;KAC1B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../../src/identity/supabase.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAuCH,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO,WAAW,UAAU,sBAAsB,CAAC;AACrD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,OAAO,UAAU,CAAC;AAC9B,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAuC;IAEvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,IAAI,MAA0B,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC;aAAM,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACrB,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,OAAuC;IAEvC,MAAM,GAAG,GAGL,EAAE,CAAC;IACP,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GACP,KAAK,CAAC,GAAG;YACT,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,8BAA8B,MAAM,sCAAsC,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAgC;IAEhC,MAAM,EACJ,UAAU,EACV,GAAG,EACH,UAAU,EACV,OAAO,EACP,YAAY,GAAG,mBAAmB,GACnC,GAAG,OAAO,CAAC;IAEZ,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,QAAQ,GAA2B;gBACvC,EAAE,EAAE,UAAU;gBACd,UAAU,EAAE;oBACV,YAAY;oBACZ,OAAO,EAAE,wBAAwB,CAAC,OAAO,CAAC;oBAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;iBAC5C;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;aAC1B,CAAC;YACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAC;YAC7B,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO;gBACL,EAAE,EAAE,UAAU;gBACd,YAAY,EAAE,QAAQ;gBACtB,UAAU,EAAE;oBACV,GAAG,EAAE,GAAG,QAAQ,OAAO;oBACvB,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;iBAC5C;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;aAC1B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,UAAU;YACd,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE;gBACV,GAAG,EAAE,GAAG,IAAI,OAAO;gBACnB,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;aAC5C;YACD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,EAAE,CAAC;QACR,OAAO;YACL,EAAE,EAAE,UAAU;YACd,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC;YACrC,QAAQ,EAAE,eAAe;YACzB,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO;QACL,EAAE,EAAE,UAAU;QACd,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,GAAG,IAAI,wBAAwB;QACrC,QAAQ,EAAE,eAAe;QACzB,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;KAC1B,CAAC;AACJ,CAAC"}

package/dist/identity/types.d.ts

@@ -34,7 +34,10 @@ export interface ValidatedTokenProvider {
      * introspect provider).
      */
     issuers?: string[];
-    /** Expected audience (`aud`), so tokens minted for other apps are rejected. */
+    /**
+     * Expected audience (`aud`). Required for local JWKS/OIDC verification;
+     * optional for introspection, where the IdP validates the token.
+     */
     audience?: string;
     /** Accepted signing algorithms, e.g. `["RS256"]`. */
     algorithms?: string[];
@@ -98,26 +101,6 @@ export interface ClaimMapping {
     /** Claim used as `runtime.identity.user.email`. */
     email?: string;
 }
-/** Which downstream call needs a credential right now. */
-export interface CredentialTarget {
-    /** What is being called. */
-    kind: "subagent" | "mcp" | "connection";
-    /** The configured name, e.g. "code-reviewer" | "docs" | "github". */
-    name: string;
-    /** Optional read/write hint so the resolver can mint different tokens. */
-    intent?: "read" | "write";
-    /** Current thread, when the credential is thread-specific. */
-    threadId?: string;
-    /** Free-form context (e.g. `{ repo, installationId }`); part of the cache key. */
-    metadata?: Record<string, unknown>;
-}
-/** What a credential resolver returns. */
-export interface ResolvedCredential {
-    /** Headers MDA attaches to the downstream call (usually Authorization). */
-    headers: Record<string, string>;
-    /** ISO expiry; MDA caches per (user, target) until then. */
-    expiresAt?: string;
-}
 /** The frozen identity envelope tools and middleware see. */
 export interface RuntimeIdentity {
     /** The caller. `kind: "service"` for machine callers (schedules, channels, Studio). */
@@ -141,40 +124,13 @@ export interface RuntimeIdentity {
     };
     claims?: Record<string, unknown>;
 }
-/** An in-process resolver callback. */
-export type CredentialResolver = (args: {
-    identity: RuntimeIdentity;
-    target: CredentialTarget;
-}) => Promise<ResolvedCredential>;
-/**
- * Provide this to mint your own downstream credentials per caller: an in-process
- * callback or a hosted token-exchange endpoint. Providing it puts the
- * credentials axis in custom mode.
- */
-export type CredentialResolverConfig = {
-    resolve: CredentialResolver;
-} | {
-    endpoint: {
-        url: string;
-    };
-};
-/**
- * One resolver per downstream platform, keyed by {@link CredentialTarget.name}.
- *
- * Use this instead of a single resolver when an agent integrates more than one
- * platform. MDA dispatches on the target name, so each entry stays a focused
- * config rather than being folded into a hand-written switch.
- */
-export type CredentialResolvers = Record<string, CredentialResolverConfig>;
 /**
  * Whose token downstream calls carry.
  *
- * - `"user"` — per-caller downstream credential vault.
- * - `"agent"` — shared LangSmith / deployment credential vault.
- * - `"custom"` — author-supplied resolver/endpoint (`CredentialsProvider`).
- * - `"none"` — no managed credential owner.
+ * Managed identity always keys credentials on the caller. This axis is not an
+ * authoring knob — `defineIdentity` always resolves it to `"user"`.
  */
-export type CredentialScope = "user" | "agent" | "none" | "custom";
+export type CredentialScope = "user";
 /**
  * The resolved identity contract the runtime reads.
  *
@@ -192,17 +148,9 @@ export interface IdentityConfig {
      * identity axis — it is declared in `memory.ts` (see `MemoryConfig`).
      */
     scope: {
-        /**
-         * Whose downstream tokens apply. `"custom"` when a resolver/endpoint is
-         * provided below.
-         */
+        /** Whose downstream tokens apply. Always `"user"` for managed identity. */
         credentials?: CredentialScope;
     };
-    /**
-     * Present when `scope.credentials` is "custom" (or a resolver is set).
-     * Either one resolver for every target, or one per target name.
-     */
-    credentials?: CredentialResolverConfig | CredentialResolvers;
 }
 /** The object exported from the project's root `identity.ts`. */
 export interface IdentityDefinition {

package/dist/identity/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GACnB,SAAS,GACT,sBAAsB,GACtB,qBAAqB,CAAC;AAE1B,qEAAqE;AACrE,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,mBAAmB,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B;IAC5B,IAAI,EAAE,UAAU,GAAG,KAAK,GAAG,YAAY,CAAC;IACxC,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,IAAI,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN;;;WAGG;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,uCAAuC;AACvC,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE;IACtC,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAElC;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAC/B;IAAE,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AAE3E;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF;;;OAGG;IACH,KAAK,EAAE;QACL;;;WAGG;QACH,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;IACF;;;OAGG;IACH,WAAW,CAAC,EAAE,wBAAwB,GAAG,mBAAmB,CAAC;CAC9D;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GACnB,SAAS,GACT,sBAAsB,GACtB,qBAAqB,CAAC;AAE1B,qEAAqE;AACrE,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,mBAAmB,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,IAAI,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN;;;WAGG;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF;;;OAGG;IACH,KAAK,EAAE;QACL,2EAA2E;QAC3E,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;CACH;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC"}

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export { defineDeepAgent } from "./define-deep-agent.js";
 export { defineSchedule } from "./schedules.js";
 export { defineIdentity } from "./identity/index.js";
 export { defineMemory } from "./memory/index.js";
-export { auth, channels, credentials } from "./namespaces.js";
+export { auth, channels } from "./namespaces.js";
 export { defineSandbox } from "./sandbox.js";
 export type { Channels } from "./namespaces.js";
 import { mcpConnector } from "./connectors/mcp/index.js";
@@ -36,7 +36,7 @@ export interface Connectors {
 export declare const connectors: Connectors;
 export type { DeepAgentDefinition, DefineDeepAgentConfig, ManagedDeepAgentKey, } from "./types.js";
 export type { ScheduleConfig, ScheduleDefinition, ScheduleDeliveryTarget, ScheduleThreadConfig, } from "./schedules.js";
-export type { ClaimMapping, CredentialResolver, CredentialResolverConfig, CredentialResolvers, CredentialScope, CredentialTarget, GitHubAppJwtArgs, GitHubCredentialsOptions, GitHubTokenSource, GitHubUserTokenArgs, HttpIngress, IdentityAuth, IdentityConfig, IdentityDefinition, IdentityOptions, LangSmithApiKeyIngress, ResolvedCredential, RuntimeIdentity, ValidatedTokenIngress, ValidatedTokenProvider, } from "./identity/index.js";
+export type { ClaimMapping, CredentialScope, HttpIngress, IdentityAuth, IdentityConfig, IdentityDefinition, IdentityOptions, LangSmithApiKeyIngress, RuntimeIdentity, ValidatedTokenIngress, ValidatedTokenProvider, } from "./identity/index.js";
 export type { MemoryConfig, MemoryDefinition, MemoryOptions, MemoryScope, MemoryScopeInput, MemorySliceInput, MemorySliceKind, ResolvedMemorySlice, } from "./memory/index.js";
 export type { HttpMcpServerConfig, McpServersConfig, McpServersDefinition, McpToolSelectionConfig, RemoteMcpServerBaseConfig, RemoteMcpServerConfig, SseMcpServerConfig, } from "./connectors/mcp/index.js";
 export type { ChannelManifest, RequiredSlackChannelConfig, SlackChannel, SlackChannelConfig, SlackChannelFilters, SlackChannelTrigger, SlackConversationPolicy, SlackMentionBehavior, } from "./channels/slack/index.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,GAAG,EAAE,OAAO,YAAY,CAAC;CAC1B;AAED,+DAA+D;AAC/D,eAAO,MAAM,UAAU,EAAE,UAExB,CAAC;AAEF,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,eAAe,EACf,0BAA0B,EAC1B,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,YAAY,GACb,MAAM,cAAc,CAAC;AAEtB,YAAY,EACV,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,GAAG,EAAE,OAAO,YAAY,CAAC;CAC1B;AAED,+DAA+D;AAC/D,eAAO,MAAM,UAAU,EAAE,UAExB,CAAC;AAEF,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,YAAY,EACZ,eAAe,EACf,WAAW,EACX,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,eAAe,EACf,0BAA0B,EAC1B,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,YAAY,GACb,MAAM,cAAc,CAAC;AAEtB,YAAY,EACV,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -2,7 +2,7 @@ export { defineDeepAgent } from "./define-deep-agent.js";
 export { defineSchedule } from "./schedules.js";
 export { defineIdentity } from "./identity/index.js";
 export { defineMemory } from "./memory/index.js";
-export { auth, channels, credentials } from "./namespaces.js";
+export { auth, channels } from "./namespaces.js";
 export { defineSandbox } from "./sandbox.js";
 import { mcpConnector } from "./connectors/mcp/index.js";
 /** Public connectors namespace — MCP only for this release. */

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AA6BzD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,GAAG,EAAE,YAAY;CAClB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AA6BzD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,GAAG,EAAE,YAAY;CAClB,CAAC"}

package/dist/namespaces.d.ts

@@ -10,7 +10,6 @@
  * connectors.mcp({ mcpServers: { docs: { transport: "http", url: "https://docs.example.com/mcp" } } });
  * defineSandbox({ defaultTimeout: 600 });
  * auth.supabase({ projectRef: "abc" });
- * credentials.github({ read: ["user"] });
  * ```
  *
  * These are the only primitives the managed runtime will mount. A project
@@ -18,7 +17,6 @@
  */
 import { mcpConnector } from "./connectors/mcp/index.js";
 import { slackChannel } from "./channels/slack/index.js";
-import { credentials as githubCredentials } from "./identity/github/credentials.js";
 export { auth } from "./identity/index.js";
 /**
  * Integrations: tools, HTTP routes, sandbox provisioning, inbound events, and
@@ -83,8 +81,4 @@ export interface Channels {
  * stay in step with the channel modules. Hover docs come from {@link Channels}.
  */
 export declare const channels: Channels;
-/** Third-party token resolvers. Composed into `defineIdentity({ credentials })`. */
-export declare const credentials: {
-    github: typeof githubCredentials;
-};
 //# sourceMappingURL=namespaces.d.ts.map

package/dist/namespaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"namespaces.d.ts","sourceRoot":"","sources":["../src/namespaces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,WAAW,IAAI,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAEpF,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAE3C;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;;;;;OAcG;IACH,GAAG,EAAE,OAAO,YAAY,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,EAAE,UAExB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB;;;;;;;;;;;OAWG;IACH,KAAK,EAAE,OAAO,YAAY,CAAC;CAC5B;AAED;;;GAGG;AACH,eAAO,MAAM,QAAQ,EAAE,QAEtB,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,WAAW;IACtB,MAAM;CACP,CAAC"}
+{"version":3,"file":"namespaces.d.ts","sourceRoot":"","sources":["../src/namespaces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAE3C;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;;;;;OAcG;IACH,GAAG,EAAE,OAAO,YAAY,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,EAAE,UAExB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB;;;;;;;;;;;OAWG;IACH,KAAK,EAAE,OAAO,YAAY,CAAC;CAC5B;AAED;;;GAGG;AACH,eAAO,MAAM,QAAQ,EAAE,QAEtB,CAAC"}

package/dist/namespaces.js

@@ -10,7 +10,6 @@
  * connectors.mcp({ mcpServers: { docs: { transport: "http", url: "https://docs.example.com/mcp" } } });
  * defineSandbox({ defaultTimeout: 600 });
  * auth.supabase({ projectRef: "abc" });
- * credentials.github({ read: ["user"] });
  * ```
  *
  * These are the only primitives the managed runtime will mount. A project
@@ -18,7 +17,6 @@
  */
 import { mcpConnector } from "./connectors/mcp/index.js";
 import { slackChannel } from "./channels/slack/index.js";
-import { credentials as githubCredentials } from "./identity/github/credentials.js";
 export { auth } from "./identity/index.js";
 /**
  * Integrations: tools, HTTP routes, sandbox provisioning, inbound events, and
@@ -38,8 +36,4 @@ export const connectors = {
 export const channels = {
     slack: slackChannel,
 };
-/** Third-party token resolvers. Composed into `defineIdentity({ credentials })`. */
-export const credentials = {
-    github: githubCredentials,
-};
 //# sourceMappingURL=namespaces.js.map

package/dist/namespaces.js.map

@@ -1 +1 @@
-{"version":3,"file":"namespaces.js","sourceRoot":"","sources":["../src/namespaces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,WAAW,IAAI,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAEpF,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AA+B3C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,GAAG,EAAE,YAAY;CAClB,CAAC;AAwBF;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAa;IAChC,KAAK,EAAE,YAAY;CACpB,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM,EAAE,iBAAiB;CAC1B,CAAC"}
+{"version":3,"file":"namespaces.js","sourceRoot":"","sources":["../src/namespaces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AA+B3C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,GAAG,EAAE,YAAY;CAClB,CAAC;AAwBF;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAa;IAChC,KAAK,EAAE,YAAY;CACpB,CAAC"}