managed-deepagents 0.0.3-dev.32 → 0.0.3-dev.34

package/dist/identity.js

@@ -1,358 +0,0 @@
-/**
- * The managed `identity.ts` declaration primitive.
- *
- * A project's root `identity.ts` exports a named `identity` created with
- * `defineIdentity(...)` (or `defineIdentity.preset(...)`). The compiler
- * discovers it, generates the custom-auth handler, and wires thread/memory
- * scoping and downstream credentials. See `specification/identity-final.md`.
- *
- * This module is pure authoring-time config construction plus eager validation —
- * it has no runtime dependency (the `providers.*` helpers return plain data).
- */
-const PRESETS = {
-    "private-assistant": {
-        ingress: { http: "trusted_backend" },
-        tenancy: "single",
-        scoping: { threads: "actor", memory: "actor", credentials: "actor" },
-    },
-    "multi-tenant-saas": {
-        ingress: { http: "trusted_backend" },
-        tenancy: "multi",
-        scoping: { threads: "actor", memory: "tenant", credentials: "agent" },
-    },
-    "shared-bot": {
-        ingress: { http: "trusted_backend" },
-        tenancy: "single",
-        scoping: { threads: "channel", memory: "actor", credentials: "agent" },
-    },
-    "internal-tool": {
-        ingress: { http: "trusted_backend" },
-        tenancy: "single",
-        scoping: { threads: "actor", memory: "actor", credentials: "agent" },
-    },
-    service: {
-        ingress: { http: "trusted_backend" },
-        tenancy: "single",
-        scoping: { memory: "agent", credentials: "agent" },
-    },
-};
-/**
- * Declare the identity contract for the deployment.
- *
- * Most developers call {@link defineIdentity.preset} instead. The three scoping
- * axes are the power-user layer underneath.
- */
-export const defineIdentity = Object.assign(function defineIdentity(config) {
-    validateIdentity(config);
-    return { kind: "identity", config };
-}, {
-    preset(name, overrides) {
-        const base = PRESETS[name];
-        if (base === undefined) {
-            throw new Error(`defineIdentity.preset(...) unknown preset "${String(name)}". ` +
-                `Valid presets: ${Object.keys(PRESETS).join(", ")}.`);
-        }
-        return defineIdentity(deepMerge(base, overrides));
-    },
-});
-function supabaseBase(projectRef) {
-    return `https://${projectRef}.supabase.co/auth/v1`;
-}
-/**
- * Normalize authoring-time Supabase regions into the runtime `regions` shape. A
- * bare string stays a URL (using the shared base `apikey`); an object resolves
- * its `url` from `url`/`projectRef` and, when given, carries region-specific
- * `headers`/`anonKey` that override the shared `apikey` at introspection time.
- */
-function normalizeSupabaseRegions(regions) {
-    const out = {};
-    for (const [region, entry] of Object.entries(regions)) {
-        if (typeof entry === "string") {
-            out[region] = entry;
-            continue;
-        }
-        const url = entry.url ??
-            (entry.projectRef ? `${supabaseBase(entry.projectRef)}/user` : undefined);
-        if (!url) {
-            throw new Error(`providers.supabase(...) region "${region}" needs a \`projectRef\` or \`url\`.`);
-        }
-        const headers = entry.headers ?? (entry.anonKey ? { apikey: entry.anonKey } : undefined);
-        out[region] = headers ? { url, headers } : { url };
-    }
-    return out;
-}
-/**
- * Provider integrations — authoring-time sugar over {@link ValidatedTokenProvider}
- * (§6.2). Each returns a plain provider object you can spread-and-override, so
- * there is no new runtime surface.
- */
-export const providers = {
-    auth0({ domain, audience, }) {
-        return {
-            issuer: `https://${domain}/`,
-            jwks: `https://${domain}/.well-known/jwks.json`,
-            ...(audience ? { audience } : {}),
-            algorithms: ["RS256"],
-            claims: { actor: "sub", tenant: "org_id" },
-        };
-    },
-    clerk({ domain }) {
-        return {
-            issuer: `https://${domain}`,
-            jwks: `https://${domain}/.well-known/jwks.json`,
-            algorithms: ["RS256"],
-            claims: { actor: "sub" },
-        };
-    },
-    okta({ domain, audience, }) {
-        return {
-            issuer: `https://${domain}`,
-            jwks: `https://${domain}/oauth2/v1/keys`,
-            ...(audience ? { audience } : {}),
-            algorithms: ["RS256"],
-            claims: { actor: "sub" },
-        };
-    },
-    cognito({ userPoolId, region, }) {
-        const issuer = `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`;
-        return {
-            issuer,
-            jwks: `${issuer}/.well-known/jwks.json`,
-            algorithms: ["RS256"],
-            claims: { actor: "sub" },
-        };
-    },
-    entra({ tenantId, audience, }) {
-        return {
-            issuer: `https://login.microsoftonline.com/${tenantId}/v2.0`,
-            jwks: `https://login.microsoftonline.com/${tenantId}/discovery/v2.0/keys`,
-            ...(audience ? { audience } : {}),
-            algorithms: ["RS256"],
-            claims: { actor: "oid" },
-        };
-    },
-    google({ audience } = {}) {
-        return {
-            issuer: "https://accounts.google.com",
-            jwks: "https://www.googleapis.com/oauth2/v3/certs",
-            ...(audience ? { audience } : {}),
-            algorithms: ["RS256"],
-            claims: { actor: "sub", email: "email" },
-        };
-    },
-    supabase({ projectRef, introspect, regions, regionHeader = "x-supabase-region", }) {
-        if (introspect) {
-            if (regions) {
-                return {
-                    id: "supabase",
-                    introspect: {
-                        regionHeader,
-                        regions: normalizeSupabaseRegions(regions),
-                        headers: { apikey: "${SUPABASE_ANON_KEY}" },
-                    },
-                    claims: { actor: "email" },
-                };
-            }
-            if (!projectRef) {
-                throw new Error("providers.supabase(...) requires `projectRef` (single region) or `regions`.");
-            }
-            return {
-                id: "supabase",
-                introspect: {
-                    url: `${supabaseBase(projectRef)}/user`,
-                    headers: { apikey: "${SUPABASE_ANON_KEY}" },
-                },
-                claims: { actor: "email" },
-            };
-        }
-        if (!projectRef) {
-            throw new Error("providers.supabase(...) without `introspect` requires `projectRef`.");
-        }
-        const base = supabaseBase(projectRef);
-        return {
-            id: "supabase",
-            issuer: base,
-            jwks: `${base}/.well-known/jwks.json`,
-            algorithms: ["ES256", "RS256"],
-            claims: { actor: "email" },
-        };
-    },
-    /** Universal fallback for any OIDC-compliant IdP via discovery. */
-    oidc({ issuer, audience, }) {
-        return {
-            issuer,
-            discover: true,
-            ...(audience ? { audience } : {}),
-            claims: { actor: "sub" },
-        };
-    },
-    /**
-     * GitHub OAuth access tokens (opaque bearer tokens, not JWTs). MDA verifies
-     * each request by calling `GET https://api.github.com/user` with the token.
-     */
-    github() {
-        return {
-            id: "github",
-            introspect: {
-                url: "https://api.github.com/user",
-                headers: {
-                    Accept: "application/vnd.github+json",
-                    "X-GitHub-Api-Version": "2022-11-28",
-                    "User-Agent": "managed-deepagents-github-example",
-                },
-            },
-            claims: { actor: "login", email: "email" },
-        };
-    },
-    /** MDA-issued anonymous/guest tokens. */
-    guest({ ttl, actorPrefix, } = {}) {
-        return {
-            id: "guest",
-            guest: {
-                issue: true,
-                ...(ttl ? { ttl } : {}),
-                ...(actorPrefix ? { actorPrefix } : {}),
-            },
-            claims: { actor: "sub" },
-        };
-    },
-};
-const MANAGED_CREDENTIAL_MODES = ["agent", "actor", "none"];
-/**
- * Eagerly reject illegal identity configs at authoring time so misconfig never
- * reaches the compiler or runtime (§4.4).
- */
-export function validateIdentity(config) {
-    const provided = config;
-    const ingress = provided.ingress;
-    if (ingress === null || typeof ingress !== "object" || !("http" in ingress)) {
-        throw new Error("defineIdentity(...) requires an `ingress.http` value ('trusted_backend' or a validated_token config).");
-    }
-    const tenancy = provided.tenancy;
-    if (tenancy !== "single" && tenancy !== "multi") {
-        throw new Error('defineIdentity(...) requires `tenancy` to be "single" or "multi".');
-    }
-    const scoping = provided.scoping;
-    if (scoping === null || typeof scoping !== "object") {
-        throw new Error("defineIdentity(...) requires a `scoping` object.");
-    }
-    if (typeof scoping.memory !== "string") {
-        throw new Error('defineIdentity(...) requires `scoping.memory` (one of "actor" | "tenant" | "agent" | "none").');
-    }
-    // tenancy: "single" cannot use any tenant-scoped axis.
-    if (tenancy === "single") {
-        const tenantAxes = ["threads", "memory", "credentials"].filter((axis) => scoping[axis] === "tenant");
-        if (tenantAxes.length > 0) {
-            throw new Error(`defineIdentity(...) cannot use "tenant" scope (${tenantAxes.join(", ")}) with tenancy: "single". Set tenancy: "multi".`);
-        }
-    }
-    // Credentials axis must agree with the presence of a resolver/endpoint.
-    const hasResolver = provided.credentials !== undefined;
-    const credentialsMode = scoping.credentials;
-    if (credentialsMode === "custom" && !hasResolver) {
-        throw new Error('defineIdentity(...) with scoping.credentials: "custom" requires a `credentials` resolver or endpoint.');
-    }
-    if (hasResolver &&
-        typeof credentialsMode === "string" &&
-        MANAGED_CREDENTIAL_MODES.includes(credentialsMode)) {
-        throw new Error(`defineIdentity(...) provides a \`credentials\` resolver but scoping.credentials is "${credentialsMode}". ` +
-            'Set scoping.credentials: "custom" (or remove the resolver).');
-    }
-    if (hasResolver) {
-        validateCredentialResolver(provided.credentials);
-    }
-    // validated_token ingress needs at least one provider, each with claims.actor.
-    const http = ingress.http;
-    if (isValidatedToken(http)) {
-        validateValidatedToken(http);
-    }
-    else if (http !== "trusted_backend") {
-        throw new Error('defineIdentity(...) `ingress.http` must be "trusted_backend" or a { mode: "validated_token", providers: [...] } config.');
-    }
-}
-function isValidatedToken(http) {
-    return (typeof http === "object" &&
-        http !== null &&
-        http.mode === "validated_token");
-}
-function validateValidatedToken(http) {
-    const list = http.providers;
-    if (!Array.isArray(list) || list.length === 0) {
-        throw new Error("defineIdentity(...) validated_token ingress requires a non-empty `providers` list.");
-    }
-    const multiple = list.length > 1;
-    for (const [index, entry] of list.entries()) {
-        const provider = entry;
-        const label = provider?.id ?? `#${index}`;
-        if (provider === null || typeof provider !== "object") {
-            throw new Error(`defineIdentity(...) validated_token provider ${label} must be an object.`);
-        }
-        if (typeof provider.claims !== "object" ||
-            provider.claims === null ||
-            typeof provider.claims.actor !== "string" ||
-            provider.claims.actor.length === 0) {
-            throw new Error(`defineIdentity(...) validated_token provider ${label} requires \`claims.actor\`.`);
-        }
-        if (multiple && typeof provider.id !== "string") {
-            throw new Error("defineIdentity(...) each validated_token provider requires an `id` when more than one is configured.");
-        }
-        const hasVerifier = typeof provider.jwks === "string" ||
-            provider.discover === true ||
-            provider.introspect !== undefined ||
-            provider.guest !== undefined;
-        if (!hasVerifier) {
-            throw new Error(`defineIdentity(...) validated_token provider ${label} must declare one of \`jwks\`, \`discover\`, \`introspect\`, or \`guest\`.`);
-        }
-    }
-}
-function validateCredentialResolver(credentials) {
-    if (credentials === null || typeof credentials !== "object") {
-        throw new Error("defineIdentity(...) `credentials` must be a resolver ({ resolve }) or endpoint ({ endpoint }) config.");
-    }
-    const cfg = credentials;
-    const hasResolveFn = typeof cfg.resolve === "function";
-    const hasEndpoint = typeof cfg.endpoint === "object" &&
-        cfg.endpoint !== null &&
-        typeof cfg.endpoint.url === "string";
-    if (hasResolveFn === hasEndpoint) {
-        throw new Error("defineIdentity(...) `credentials` requires exactly one of `resolve` (function) or `endpoint` ({ url }).");
-    }
-}
-function isPlainObject(value) {
-    return (typeof value === "object" &&
-        value !== null &&
-        !Array.isArray(value) &&
-        typeof value !== "function");
-}
-function deepMerge(base, patch) {
-    if (patch === undefined)
-        return structuredCloneConfig(base);
-    if (!isPlainObject(base) || !isPlainObject(patch)) {
-        return patch;
-    }
-    const out = { ...base };
-    for (const [key, value] of Object.entries(patch)) {
-        if (value === undefined)
-            continue;
-        const current = out[key];
-        out[key] =
-            isPlainObject(current) && isPlainObject(value)
-                ? deepMerge(current, value)
-                : value;
-    }
-    return out;
-}
-function structuredCloneConfig(value) {
-    if (Array.isArray(value)) {
-        return value.map((item) => structuredCloneConfig(item));
-    }
-    if (isPlainObject(value)) {
-        const out = {};
-        for (const [key, inner] of Object.entries(value)) {
-            out[key] = structuredCloneConfig(inner);
-        }
-        return out;
-    }
-    return value;
-}
-//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiLH,MAAM,OAAO,GAA+C;IAC1D,mBAAmB,EAAE;QACnB,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;KACrE;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE;KACtE;IACD,YAAY,EAAE;QACZ,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;KACvE;IACD,eAAe,EAAE;QACf,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;KACrE;IACD,OAAO,EAAE;QACP,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACpC,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE;KACnD;CACF,CAAC;AAeF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAmB,MAAM,CAAC,MAAM,CACzD,SAAS,cAAc,CAAC,MAAsB;IAC5C,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC,EACD;IACE,MAAM,CACJ,IAAwB,EACxB,SAAuC;QAEvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,8CAA8C,MAAM,CAAC,IAAI,CAAC,KAAK;gBAC7D,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvD,CAAC;QACJ,CAAC;QACD,OAAO,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACpD,CAAC;CACF,CACF,CAAC;AAiBF,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO,WAAW,UAAU,sBAAsB,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAC/B,OAAuC;IAEvC,MAAM,GAAG,GAGL,EAAE,CAAC;IACP,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GACP,KAAK,CAAC,GAAG;YACT,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,sCAAsC,CAChF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,KAAK,CAAC,EACJ,MAAM,EACN,QAAQ,GAIT;QACC,OAAO;YACL,MAAM,EAAE,WAAW,MAAM,GAAG;YAC5B,IAAI,EAAE,WAAW,MAAM,wBAAwB;YAC/C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,EAAE,MAAM,EAAsB;QAClC,OAAO;YACL,MAAM,EAAE,WAAW,MAAM,EAAE;YAC3B,IAAI,EAAE,WAAW,MAAM,wBAAwB;YAC/C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,EACH,MAAM,EACN,QAAQ,GAIT;QACC,OAAO;YACL,MAAM,EAAE,WAAW,MAAM,EAAE;YAC3B,IAAI,EAAE,WAAW,MAAM,iBAAiB;YACxC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,EACN,UAAU,EACV,MAAM,GAIP;QACC,MAAM,MAAM,GAAG,uBAAuB,MAAM,kBAAkB,UAAU,EAAE,CAAC;QAC3E,OAAO;YACL,MAAM;YACN,IAAI,EAAE,GAAG,MAAM,wBAAwB;YACvC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,EACJ,QAAQ,EACR,QAAQ,GAIT;QACC,OAAO;YACL,MAAM,EAAE,qCAAqC,QAAQ,OAAO;YAC5D,IAAI,EAAE,qCAAqC,QAAQ,sBAAsB;YACzE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,EAAE,QAAQ,KAA4B,EAAE;QAC7C,OAAO;YACL,MAAM,EAAE,6BAA6B;YACrC,IAAI,EAAE,4CAA4C;YAClD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,EACP,UAAU,EACV,UAAU,EACV,OAAO,EACP,YAAY,GAAG,mBAAmB,GAYnC;QACC,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;oBACL,EAAE,EAAE,UAAU;oBACd,UAAU,EAAE;wBACV,YAAY;wBACZ,OAAO,EAAE,wBAAwB,CAAC,OAAO,CAAC;wBAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;qBAC5C;oBACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;iBAC3B,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,UAAU;gBACd,UAAU,EAAE;oBACV,GAAG,EAAE,GAAG,YAAY,CAAC,UAAU,CAAC,OAAO;oBACvC,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE;iBAC5C;gBACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;aAC3B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,UAAU;YACd,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,IAAI,wBAAwB;YACrC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9B,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3B,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,IAAI,CAAC,EACH,MAAM,EACN,QAAQ,GAIT;QACC,OAAO;YACL,MAAM;YACN,QAAQ,EAAE,IAAI;YACd,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,OAAO;YACL,EAAE,EAAE,QAAQ;YACZ,UAAU,EAAE;gBACV,GAAG,EAAE,6BAA6B;gBAClC,OAAO,EAAE;oBACP,MAAM,EAAE,6BAA6B;oBACrC,sBAAsB,EAAE,YAAY;oBACpC,YAAY,EAAE,mCAAmC;iBAClD;aACF;YACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,yCAAyC;IACzC,KAAK,CAAC,EACJ,GAAG,EACH,WAAW,MAC+B,EAAE;QAC5C,OAAO;YACL,EAAE,EAAE,OAAO;YACX,KAAK,EAAE;gBACL,KAAK,EAAE,IAAI;gBACX,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC;YACD,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;SACzB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,wBAAwB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAErE;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,MAAM,QAAQ,GAAG,MAA4C,CAAC;IAE9D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAyC,CAAC;IACnE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAEZ,CAAC;IACd,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,uDAAuD;IACvD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,UAAU,GAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAW,CAAC,MAAM,CACvE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ,CACrC,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,kDAAkD,UAAU,CAAC,IAAI,CAC/D,IAAI,CACL,iDAAiD,CACnD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC;IACvD,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC;IAC5C,IAAI,eAAe,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,IACE,WAAW;QACX,OAAO,eAAe,KAAK,QAAQ;QAClC,wBAA8C,CAAC,QAAQ,CAAC,eAAe,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uFAAuF,eAAe,KAAK;YACzG,6DAA6D,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,0BAA0B,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnD,CAAC;IAED,+EAA+E;IAC/E,MAAM,IAAI,GAAI,OAA6B,CAAC,IAAI,CAAC;IACjD,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;SAAM,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,yHAAyH,CAC1H,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAA2B,CAAC,IAAI,KAAK,iBAAiB,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAA2B;IACzD,MAAM,IAAI,GAAI,IAAgC,CAAC,SAAS,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAA+B,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,EAAE,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,qBAAqB,CAC3E,CAAC;QACJ,CAAC;QACD,IACE,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;YACnC,QAAQ,CAAC,MAAM,KAAK,IAAI;YACxB,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ;YACzC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAClC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,6BAA6B,CACnF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GACf,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;YACjC,QAAQ,CAAC,QAAQ,KAAK,IAAI;YAC1B,QAAQ,CAAC,UAAU,KAAK,SAAS;YACjC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC;QAC/B,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,gDAAgD,KAAK,4EAA4E,CAClI,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,WAAoB;IACtD,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,WAAwD,CAAC;IACrE,MAAM,YAAY,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,CAAC;IACvD,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAChC,GAAG,CAAC,QAAQ,KAAK,IAAI;QACrB,OAAQ,GAAG,CAAC,QAA8B,CAAC,GAAG,KAAK,QAAQ,CAAC;IAC9D,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,yGAAyG,CAC1G,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,OAAO,KAAK,KAAK,UAAU,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAI,IAAO,EAAE,KAAiC;IAC9D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,KAAU,CAAC;IACpB,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC;YACN,aAAa,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC;gBAC5C,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,KAAoC,CAAC;gBAC1D,CAAC,CAAC,KAAK,CAAC;IACd,CAAC;IACD,OAAO,GAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAI,KAAQ;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAiB,CAAC;IAC1E,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,GAAG,CAAC,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,GAAQ,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/runtime/auth.d.ts

@@ -1,54 +0,0 @@
-import { Auth } from "@langchain/langgraph-sdk/auth";
-import type { IdentityConfig, IdentityDefinition, RuntimeIdentity } from "../identity.js";
-/**
- * The user object `@auth.authenticate` returns. `identity`/`permissions` satisfy
- * the LangGraph base shape; the `mda_*` fields carry the identity envelope into
- * `config.configurable.langgraph_auth_user` for the runtime seam.
- */
-export interface ManagedUser {
-    identity: string;
-    permissions: string[];
-    mda_actor_id: string;
-    mda_tenant_id?: string;
-    mda_actor_email?: string;
-    mda_claims?: Record<string, unknown>;
-    [key: string]: unknown;
-}
-/**
- * Build the managed LangGraph custom-auth handler from a declared identity.
- *
- * Handles both ingress modes: `trusted_backend` (reserved headers behind a
- * shared ingress secret) and `validated_token` (browser-direct IdP tokens
- * verified via JWKS / introspection / MDA-signed guest). Also registers thread
- * and store scoping with a studio bypass.
- */
-export declare function buildManagedAuth(identity: IdentityDefinition): Auth;
-/**
- * Resolve the caller's frozen {@link RuntimeIdentity} from a raw HTTP request,
- * using the same ingress logic (`trusted_backend` headers / `validated_token`
- * verification) as the managed auth handler. Throws an {@link HTTPException}
- * (401) when the caller is unauthenticated or unresolvable.
- *
- * This is the resolver that backs default-secure connector HTTP routes: a
- * connector route runs behind identity by default, and this is what enforces it.
- */
-export declare function resolveRequestIdentity(cfg: IdentityConfig, request: Request): Promise<RuntimeIdentity>;
-/**
- * Fail-closed (403) unless every identity segment the memory scope requires is
- * present in the store `namespace`. `agent`/`none` scopes carry no per-identity
- * restriction (shared or absent memory), so any namespace is allowed.
- */
-export declare function assertStoreAccess(cfg: IdentityConfig, user: ManagedUser, value: unknown): void;
-/**
- * Resolve the caller identity for `trusted_backend`: validate the shared ingress
- * secret, then trust the reserved actor/tenant headers. Fail-closed (401) on a
- * missing/invalid secret, a missing actor, or a missing tenant under multi.
- */
-export declare function resolveTrustedBackendUser(cfg: IdentityConfig, request: Request): ManagedUser;
-/** Derive the owner value `@auth.on.threads` filters on, per the `threads` axis. */
-export declare function threadOwnerKey(cfg: IdentityConfig, user: ManagedUser): string;
-/** True when this deployment exposes guest issuance and the request targets it. */
-export declare function isGuestIssuanceRequest(request: Request, cfg: IdentityConfig): boolean;
-/** Placeholder identity so LangGraph auth middleware allows tokenless issuance. */
-export declare function guestIssuanceBypassUser(): ManagedUser;
-//# sourceMappingURL=auth.d.ts.map

package/dist/runtime/auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/runtime/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EAGL,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,eAAe,EAChB,MAAM,gBAAgB,CAAC;AA0BxB;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAsCnE;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,eAAe,CAAC,CAc1B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,OAAO,GACb,IAAI,CAuBN;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,WAAW,CAgBb;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,CAY7E;AAuBD,mFAAmF;AACnF,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,cAAc,GAClB,OAAO,CAaT;AAED,mFAAmF;AACnF,wBAAgB,uBAAuB,IAAI,WAAW,CAMrD"}

package/dist/runtime/auth.js

@@ -1,191 +0,0 @@
-import { Auth, HTTPException, isStudioUser, } from "@langchain/langgraph-sdk/auth";
-import { buildRuntimeIdentity, memoryIdentitySegments, } from "./identity-runtime.js";
-import { resolveValidatedTokenUser } from "./validated-token.js";
-/**
- * Reserved transport for the trusted-backend ingress mode. Actor/tenant travel
- * as reserved headers (mapped into `config.configurable` by the generated
- * `langgraph.json` allowlist); the ingress secret is validated here and is
- * deliberately **not** allowlisted, so it never reaches `config.configurable`.
- */
-const ACTOR_HEADER = "x-mda-actor-id";
-const TENANT_HEADER = "x-mda-tenant-id";
-const INGRESS_SECRET_HEADER = "x-mda-ingress-secret";
-/** Deployment env var carrying the shared secret the trusted backend presents. */
-const INGRESS_SECRET_ENV = "MDA_INGRESS_SECRET";
-/** Path MDA exposes for anonymous guest token issuance (must stay public). */
-const GUEST_ISSUANCE_PATH = "/identity/guest";
-/** Synthetic actor used only to satisfy auth middleware on the issuance route. */
-const GUEST_ISSUER_ACTOR = "mda:guest-issuer";
-/**
- * Build the managed LangGraph custom-auth handler from a declared identity.
- *
- * Handles both ingress modes: `trusted_backend` (reserved headers behind a
- * shared ingress secret) and `validated_token` (browser-direct IdP tokens
- * verified via JWKS / introspection / MDA-signed guest). Also registers thread
- * and store scoping with a studio bypass.
- */
-export function buildManagedAuth(identity) {
-    const cfg = identity.config;
-    const http = cfg.ingress.http;
-    const auth = new Auth();
-    auth.authenticate(async (request) => {
-        if (isGuestIssuanceRequest(request, cfg)) {
-            return guestIssuanceBypassUser();
-        }
-        if (http === "trusted_backend") {
-            return resolveTrustedBackendUser(cfg, request);
-        }
-        return resolveValidatedTokenUser(cfg, http, request);
-    });
-    auth.on("threads", ({ user, value }) => {
-        if (isStudioUser(user)) {
-            return true;
-        }
-        const key = threadOwnerKey(cfg, user);
-        if (value && typeof value === "object") {
-            const container = value;
-            container.metadata = { ...(container.metadata ?? {}), owner: key };
-        }
-        return { owner: key };
-    });
-    // Mirror the memory namespace so raw store ops can't cross the identity
-    // boundary a run is scoped to (§5, §6.2).
-    auth.on("store", ({ user, value }) => {
-        if (isStudioUser(user)) {
-            return true;
-        }
-        assertStoreAccess(cfg, user, value);
-        return true;
-    });
-    return auth;
-}
-/**
- * Resolve the caller's frozen {@link RuntimeIdentity} from a raw HTTP request,
- * using the same ingress logic (`trusted_backend` headers / `validated_token`
- * verification) as the managed auth handler. Throws an {@link HTTPException}
- * (401) when the caller is unauthenticated or unresolvable.
- *
- * This is the resolver that backs default-secure connector HTTP routes: a
- * connector route runs behind identity by default, and this is what enforces it.
- */
-export async function resolveRequestIdentity(cfg, request) {
-    const http = cfg.ingress.http;
-    const user = http === "trusted_backend"
-        ? resolveTrustedBackendUser(cfg, request)
-        : await resolveValidatedTokenUser(cfg, http, request);
-    const identity = buildRuntimeIdentity({
-        langgraph_auth_user: user,
-        mda_source_provider: "http",
-    });
-    if (!identity) {
-        throw new HTTPException(401, { message: "unauthenticated" });
-    }
-    return identity;
-}
-/**
- * Fail-closed (403) unless every identity segment the memory scope requires is
- * present in the store `namespace`. `agent`/`none` scopes carry no per-identity
- * restriction (shared or absent memory), so any namespace is allowed.
- */
-export function assertStoreAccess(cfg, user, value) {
-    const required = memoryIdentitySegments(cfg.scoping.memory, cfg.tenancy, user.mda_actor_id ? String(user.mda_actor_id) : undefined, user.mda_tenant_id ? String(user.mda_tenant_id) : undefined);
-    if (required.length === 0) {
-        return;
-    }
-    const namespace = value &&
-        typeof value === "object" &&
-        Array.isArray(value.namespace)
-        ? value.namespace.map(String)
-        : [];
-    for (const segment of required) {
-        if (!namespace.includes(segment)) {
-            throw new HTTPException(403, {
-                message: "store namespace is outside the caller's identity boundary",
-            });
-        }
-    }
-}
-/**
- * Resolve the caller identity for `trusted_backend`: validate the shared ingress
- * secret, then trust the reserved actor/tenant headers. Fail-closed (401) on a
- * missing/invalid secret, a missing actor, or a missing tenant under multi.
- */
-export function resolveTrustedBackendUser(cfg, request) {
-    requireIngressSecret(request);
-    const actor = request.headers.get(ACTOR_HEADER);
-    if (!actor) {
-        throw new HTTPException(401, { message: `missing ${ACTOR_HEADER}` });
-    }
-    const tenant = request.headers.get(TENANT_HEADER) ?? undefined;
-    assertTenantPresentIfMulti(cfg, tenant);
-    return {
-        identity: actor,
-        permissions: [],
-        mda_actor_id: actor,
-        ...(tenant ? { mda_tenant_id: tenant } : {}),
-    };
-}
-/** Derive the owner value `@auth.on.threads` filters on, per the `threads` axis. */
-export function threadOwnerKey(cfg, user) {
-    const scope = cfg.scoping.threads ?? "actor";
-    const actor = String(user.mda_actor_id ?? "");
-    const tenant = user.mda_tenant_id ? String(user.mda_tenant_id) : undefined;
-    if (scope === "tenant") {
-        return tenant ?? actor;
-    }
-    if (scope === "channel") {
-        const channel = user.mda_source_thread_id;
-        return channel ? String(channel) : actor;
-    }
-    return actor;
-}
-function requireIngressSecret(request) {
-    const expected = process.env[INGRESS_SECRET_ENV];
-    const provided = request.headers.get(INGRESS_SECRET_HEADER);
-    if (!expected || !provided || !constantTimeEquals(expected, provided)) {
-        throw new HTTPException(401, {
-            message: "invalid or missing ingress secret",
-        });
-    }
-}
-function assertTenantPresentIfMulti(cfg, tenant) {
-    if (cfg.tenancy === "multi" && !tenant) {
-        throw new HTTPException(401, {
-            message: "missing tenant for multi-tenant deployment",
-        });
-    }
-}
-/** True when this deployment exposes guest issuance and the request targets it. */
-export function isGuestIssuanceRequest(request, cfg) {
-    if (request.method !== "POST") {
-        return false;
-    }
-    const { pathname } = new URL(request.url);
-    if (pathname !== GUEST_ISSUANCE_PATH) {
-        return false;
-    }
-    const http = cfg.ingress.http;
-    if (http === "trusted_backend") {
-        return false;
-    }
-    return http.providers.some((provider) => provider.guest?.issue);
-}
-/** Placeholder identity so LangGraph auth middleware allows tokenless issuance. */
-export function guestIssuanceBypassUser() {
-    return {
-        identity: GUEST_ISSUER_ACTOR,
-        permissions: [],
-        mda_actor_id: GUEST_ISSUER_ACTOR,
-    };
-}
-function constantTimeEquals(a, b) {
-    if (a.length !== b.length) {
-        return false;
-    }
-    let mismatch = 0;
-    for (let i = 0; i < a.length; i += 1) {
-        mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
-    }
-    return mismatch === 0;
-}
-//# sourceMappingURL=auth.js.map

package/dist/runtime/auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/runtime/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EACJ,aAAa,EACb,YAAY,GACb,MAAM,+BAA+B,CAAC;AAOvC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,YAAY,GAAG,gBAAgB,CAAC;AACtC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AACxC,MAAM,qBAAqB,GAAG,sBAAsB,CAAC;AAErD,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEhD,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAiB9C;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA4B;IAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;IAExB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,OAAgB,EAAwB,EAAE;QACjE,IAAI,sBAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO,uBAAuB,EAAE,CAAC;QACnC,CAAC;QACD,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC/B,OAAO,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,yBAAyB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACrC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,EAAE,IAA8B,CAAC,CAAC;QAChE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,KAA+C,CAAC;YAClE,SAAS,CAAC,QAAQ,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,0CAA0C;IAC1C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACnC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,iBAAiB,CAAC,GAAG,EAAE,IAA8B,EAAE,KAAK,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAmB,EACnB,OAAgB;IAEhB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,MAAM,IAAI,GACR,IAAI,KAAK,iBAAiB;QACxB,CAAC,CAAC,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC;QACzC,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,mBAAmB,EAAE,IAAI;QACzB,mBAAmB,EAAE,MAAM;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAmB,EACnB,IAAiB,EACjB,KAAc;IAEd,MAAM,QAAQ,GAAG,sBAAsB,CACrC,GAAG,CAAC,OAAO,CAAC,MAAM,EAClB,GAAG,CAAC,OAAO,EACX,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,EACzD,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAC5D,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GACb,KAAK;QACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,OAAO,CAAE,KAAiC,CAAC,SAAS,CAAC;QACzD,CAAC,CAAE,KAAkC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;QAC3D,CAAC,CAAC,EAAE,CAAC;IACT,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;gBAC3B,OAAO,EAAE,2DAA2D;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAmB,EACnB,OAAgB;IAEhB,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAE9B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,WAAW,YAAY,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC;IAC/D,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAExC,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,EAAE;QACf,YAAY,EAAE,KAAK;QACnB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,GAAmB,EAAE,IAAiB;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,MAAM,IAAI,KAAK,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC1C,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAgB;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,mCAAmC;SAC7C,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,GAAmB,EACnB,MAA0B;IAE1B,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,4CAA4C;SACtD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,sBAAsB,CACpC,OAAgB,EAChB,GAAmB;IAEnB,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,mBAAmB,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,QAAQ,EAAE,kBAAkB;QAC5B,WAAW,EAAE,EAAE;QACf,YAAY,EAAE,kBAAkB;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC"}