/**
 * Shared identity authoring types.
 *
 * Kept separate from provider helpers so modules like `supabase.ts` can import
 * types without circular dependencies on the public barrel.
 */
/** How MDA learns who is calling on the HTTP ingress path. */
export type HttpIngress = "backend" | LangSmithApiKeyIngress | ValidatedTokenIngress;
/** LangSmith workspace API-key ingress, verified by managed auth. */
export interface LangSmithApiKeyIngress {
    mode: "langsmith_api_key";
}
/**
 * Browser-direct ingress: MDA verifies the caller's own IdP token server-side
 * and derives identity from its claims.
 */
export interface ValidatedTokenIngress {
    mode: "validated_token";
    /**
     * The token families this deployment accepts (non-empty). MDA selects a
     * provider per request by the token issuer (`iss`). Use one entry for a single
     * IdP; `id` is required once there is more than one entry.
     */
    providers: ValidatedTokenProvider[];
}
/** A single token family MDA knows how to verify. */
export interface ValidatedTokenProvider {
    /** Label used for routing; required only when there is more than one provider. */
    id?: string;
    /** Expected token issuer (`iss`) — the routing/verification key for real IdP tokens. */
    issuer?: string;
    /**
     * Additional accepted `iss` values (e.g. multi-region Supabase projects on one
     * introspect provider).
     */
    issuers?: string[];
    /**
     * Expected audience (`aud`). Required for local JWKS/OIDC verification;
     * optional for introspection, where the IdP validates the token.
     */
    audience?: string;
    /** Accepted signing algorithms, e.g. `["RS256"]`. */
    algorithms?: string[];
    /**
     * URL of the IdP's public keys (JWKS). MDA verifies the signature locally —
     * the recommended path for most OAuth/OIDC providers.
     */
    jwks?: string;
    /**
     * Resolve `jwks`/endpoints from `issuer/.well-known/openid-configuration`
     * instead of a literal `jwks` URL (what `providers.oidc` sets).
     */
    discover?: boolean;
    /**
     * Auth API root used to resolve the real JWT `issuer` + `jwks` via OIDC
     * discovery (custom Supabase domains). Materialized at request time before
     * provider selection so vanity hosts are not mistaken for token `iss`.
     */
    discoveryUrl?: string;
    /**
     * Only for opaque tokens: verify by calling the IdP once per request
     * (e.g. Supabase `/auth/v1/user`).
     */
    introspect?: {
        /** Single introspection endpoint (the common case). */
        url?: string;
        /** Provider-specific endpoint selection by a client header (e.g. Supabase region). */
        regionHeader?: string;
        /**
         * Region value → introspection endpoint. A bare string is the URL (using the
         * shared `headers` below); an object also carries region-specific headers
         * (e.g. a per-region Supabase `apikey`), which override the shared ones.
         */
        regions?: Record<string, string | {
            url: string;
            headers?: Record<string, string>;
        }>;
        /** Static headers sent with the introspection call (e.g. Supabase `apikey`). */
        headers?: Record<string, string>;
        /** Where MDA puts the user's token when calling the endpoint. Default: "authorization". */
        tokenIn?: "authorization" | "header";
        /** Custom header name when `tokenIn` is "header". */
        header?: string;
    };
    /** Maps verified token claims → identity envelope fields. */
    claims: ClaimMapping;
}
/**
 * Which verified token claim supplies each identity envelope field.
 *
 * `user` is required; `defineIdentity` rejects a provider that omits it.
 */
export interface ClaimMapping {
    /** Claim used as `runtime.identity.user.id` (e.g. "sub", "email"). */
    user?: string;
    /**
     * Claim carrying every group the caller belongs to. Accepts a JSON array, or a
     * comma/space-delimited string. Read by tools for authorization.
     */
    groups?: string;
    /** Claim used as `runtime.identity.user.email`. */
    email?: string;
}
/** The frozen identity envelope tools and middleware see. */
export interface RuntimeIdentity {
    /** The caller. `kind: "service"` for machine callers (schedules, channels, Studio). */
    user: {
        kind: "person" | "service";
        id: string;
        email?: string;
    };
    /**
     * Every group the caller's token asserts. For authorization decisions in tools
     * and middleware.
     */
    groups?: readonly string[];
    source: {
        /**
         * Ingress source. Built-ins include `http`, `schedule`, `cli`, `studio`,
         * plus channel providers (`slack`, `github`, or any registered plugin key).
         */
        provider: string;
        threadId?: string;
    };
    claims?: Record<string, unknown>;
}
/**
 * Whose token downstream calls carry.
 *
 * Managed identity always keys credentials on the caller. This axis is not an
 * authoring knob — `defineIdentity` always resolves it to `"user"`.
 */
export type CredentialScope = "user";
/**
 * The resolved identity contract the runtime reads.
 *
 * `defineIdentity` derives this from {@link IdentityOptions}; it is not an
 * authoring surface. Scope remains explicit here so runtime policy is inspectable
 * without exposing it as a declaration knob.
 */
export interface IdentityConfig {
    /** How MDA learns who is calling. */
    ingress: {
        http: HttpIngress;
    };
    /**
     * Isolation axes. Threads are always user-owned, and durable memory is not an
     * identity axis — it is declared in `memory.ts` (see `MemoryConfig`).
     */
    scope: {
        /** Whose downstream tokens apply. Always `"user"` for managed identity. */
        credentials?: CredentialScope;
    };
}
/** The object exported from the project's root `identity.ts`. */
export interface IdentityDefinition {
    readonly kind: "identity";
    readonly config: IdentityConfig;
}
//# sourceMappingURL=types.d.ts.map