managed-deepagents 0.4.0-dev.68 → 0.4.0-dev.69

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,SAAS,MAAM,2BAA2B,CAAC;AACvD,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,SAAS,EACT,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,OAAO,EACP,WAAW,EACX,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,GACb,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,SAAS,MAAM,2BAA2B,CAAC;AACvD,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,SAAS,EACT,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,oBAAoB,EACpB,2BAA2B,EAC3B,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,OAAO,EACP,WAAW,EACX,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,GACb,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -4,4 +4,7 @@ export * as langsmith from "./connectors/langsmith.js";
 export { defineSchedule } from "./schedules.js";
 export { defineSandbox } from "./sandbox.js";
 export { defineIdentity, providers, validateIdentity, } from "./identity/index.js";
+export { defineSlackChannel } from "./channels/slack/index.js";
+export { CHANNEL_ERROR_CODES, ChannelError, createRuntimeChannel, normalizeChannelDestination, wasFinalPosted, } from "./channels/index.js";
+export { decodeSlackSourceThreadKey, encodeSlackSourceThreadKey, normalizeSlackEvent, requiredSlackScopes, toChannelManifest, verifySlackRequest, } from "./channels/slack/index.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,SAAS,MAAM,2BAA2B,CAAC;AAUvD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,SAAS,EACT,gBAAgB,GACjB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,SAAS,MAAM,2BAA2B,CAAC;AAUvD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,SAAS,EACT,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,oBAAoB,EACpB,2BAA2B,EAC3B,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC"}

package/dist/runtime/auth.d.ts

@@ -1,5 +1,24 @@
 import { Auth } from "@langchain/langgraph-sdk/auth";
 import type { IdentityConfig, IdentityDefinition, RuntimeIdentity } from "../identity/index.js";
+/**
+ * Reserved transport for the trusted-backend ingress mode. Actor/tenant travel
+ * as reserved headers (mapped into `config.configurable` by the generated
+ * `langgraph.json` allowlist); the ingress secret is validated here and is
+ * deliberately **not** allowlisted, so it never reaches `config.configurable`.
+ */
+/** Trusted-backend / channel-loopback identity headers (single source of truth). */
+export declare const ACTOR_HEADER = "x-mda-actor-id";
+export declare const TENANT_HEADER = "x-mda-tenant-id";
+export declare const INGRESS_SECRET_HEADER = "x-mda-ingress-secret";
+/**
+ * Internal channel handoff headers. Accepted only after the ingress secret
+ * validates — never part of the public HTTP identity surface, and deliberately
+ * not allowlisted into `config.configurable`.
+ */
+export declare const SOURCE_PROVIDER_HEADER = "x-mda-source-provider";
+export declare const SOURCE_THREAD_HEADER = "x-mda-source-thread-id";
+/** Deployment env var carrying the shared secret the trusted backend presents. */
+export declare const INGRESS_SECRET_ENV = "MDA_INGRESS_SECRET";
 /**
  * The user object `@auth.authenticate` returns. `identity`/`permissions` satisfy
  * the LangGraph base shape; the `mda_*` fields carry the identity envelope into
@@ -12,6 +31,10 @@ export interface ManagedUser {
     mda_tenant_id?: string;
     mda_actor_email?: string;
     mda_claims?: Record<string, unknown>;
+    /** Trusted source provider stamped by managed ingress (never client-supplied). */
+    mda_source_provider?: string;
+    /** Trusted source thread key stamped by managed channel ingress. */
+    mda_source_thread_id?: string;
     [key: string]: unknown;
 }
 /**
@@ -33,6 +56,13 @@ export declare function buildManagedAuth(identity: IdentityDefinition): Auth;
  * connector route runs behind identity by default, and this is what enforces it.
  */
 export declare function resolveRequestIdentity(cfg: IdentityConfig, request: Request): Promise<RuntimeIdentity>;
+/** LangGraph Store namespace prefix for Slack ↔ actor account links. */
+export declare const IDENTITY_LINKS_STORE_PREFIX = "mda_identity_links";
+/**
+ * Trusted service principal for {@link IDENTITY_LINKS_STORE_PREFIX} Store ops.
+ * Stamped by the managed link client together with the ingress secret.
+ */
+export declare const IDENTITY_LINKS_SERVICE_ACTOR = "mda:identity-links";
 /**
  * Fail-closed (403) unless the store `namespace` contains the identity segments
  * the memory scope requires as a contiguous ordered prefix (typically after the
@@ -49,6 +79,10 @@ export declare function namespaceHasOrderedSegments(namespace: string[], require
  * Under `mda dev` (`MDA_LOCAL_DEV=1`), requests without a valid ingress secret
  * resolve to a synthetic local service principal so LangGraph Studio can talk
  * to the agent without custom headers. Deploy never sets that env var.
+ *
+ * Optional source-provider / source-thread headers are accepted only after the
+ * ingress secret validates. They exist for the managed channel runner's
+ * loopback handoff — ordinary clients without the secret cannot stamp them.
  */
 export declare function resolveTrustedBackendUser(cfg: IdentityConfig, request: Request): ManagedUser;
 /**
@@ -68,6 +102,12 @@ export declare function tryLocalDevTrustedUser(cfg: IdentityConfig, request: Req
 export declare function threadOwnerKey(cfg: IdentityConfig, user: ManagedUser): string;
 /** True when this deployment exposes guest issuance and the request targets it. */
 export declare function isGuestIssuanceRequest(request: Request, cfg: IdentityConfig): boolean;
+/** True when the request targets a public channel Events ingress route. */
+export declare function isChannelEventsRequest(request: Request): boolean;
+/** True when the request is a public identity-provider OAuth/OIDC callback. */
+export declare function isIdentityProviderCallbackRequest(request: Request): boolean;
 /** Placeholder identity so LangGraph auth middleware allows tokenless issuance. */
 export declare function guestIssuanceBypassUser(): ManagedUser;
+/** Placeholder identity so middleware allows provider-signed channel Events. */
+export declare function channelEventsBypassUser(): ManagedUser;
 //# sourceMappingURL=auth.d.ts.map

package/dist/runtime/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/runtime/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EAGL,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAoC9B;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAsCnE;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,eAAe,CAAC,CAc1B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,OAAO,GACb,IAAI,CAqBN;AAED,uFAAuF;AACvF,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EAAE,EACnB,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAeT;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,WAAW,CAqBb;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAgB7D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,WAAW,GAAG,IAAI,CAoBpB;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,CAY7E;AA6BD,mFAAmF;AACnF,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,cAAc,GAClB,OAAO,CAaT;AAED,mFAAmF;AACnF,wBAAgB,uBAAuB,IAAI,WAAW,CAMrD"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/runtime/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EAGL,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAO9B;;;;;GAKG;AACH,oFAAoF;AACpF,eAAO,MAAM,YAAY,mBAAmB,CAAC;AAC7C,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAC/C,eAAO,MAAM,qBAAqB,yBAAyB,CAAC;AAC5D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,0BAA0B,CAAC;AAC9D,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAE7D,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAoCvD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,kFAAkF;IAClF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oEAAoE;IACpE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAgDnE;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,eAAe,CAAC,CAoB1B;AAED,wEAAwE;AACxE,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,4BAA4B,uBAAuB,CAAC;AAEjE;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,OAAO,GACb,IAAI,CAiCN;AAED,uFAAuF;AACvF,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EAAE,EACnB,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAeT;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,WAAW,CA+Cb;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAgB7D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,WAAW,GAAG,IAAI,CAoBpB;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,CAiB7E;AA6BD,mFAAmF;AACnF,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,cAAc,GAClB,OAAO,CAaT;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAMhE;AAED,+EAA+E;AAC/E,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAM3E;AAED,mFAAmF;AACnF,wBAAgB,uBAAuB,IAAI,WAAW,CAMrD;AAED,gFAAgF;AAChF,wBAAgB,uBAAuB,IAAI,WAAW,CAMrD"}

package/dist/runtime/auth.js

@@ -7,11 +7,21 @@ import { resolveValidatedTokenUser } from "./validated-token.js";
  * `langgraph.json` allowlist); the ingress secret is validated here and is
  * deliberately **not** allowlisted, so it never reaches `config.configurable`.
  */
-const ACTOR_HEADER = "x-mda-actor-id";
-const TENANT_HEADER = "x-mda-tenant-id";
-const INGRESS_SECRET_HEADER = "x-mda-ingress-secret";
+/** Trusted-backend / channel-loopback identity headers (single source of truth). */
+export const ACTOR_HEADER = "x-mda-actor-id";
+export const TENANT_HEADER = "x-mda-tenant-id";
+export const INGRESS_SECRET_HEADER = "x-mda-ingress-secret";
+/**
+ * Internal channel handoff headers. Accepted only after the ingress secret
+ * validates — never part of the public HTTP identity surface, and deliberately
+ * not allowlisted into `config.configurable`.
+ */
+export const SOURCE_PROVIDER_HEADER = "x-mda-source-provider";
+export const SOURCE_THREAD_HEADER = "x-mda-source-thread-id";
 /** Deployment env var carrying the shared secret the trusted backend presents. */
-const INGRESS_SECRET_ENV = "MDA_INGRESS_SECRET";
+export const INGRESS_SECRET_ENV = "MDA_INGRESS_SECRET";
+/** Source providers the trusted-backend handoff may stamp. */
+const TRUSTED_SOURCE_PROVIDERS = new Set(["slack"]);
 /**
  * Set to `"1"` by `mda dev` so local Studio / API clients can exercise
  * `trusted_backend` identity without injecting ingress headers. Never set in
@@ -22,8 +32,20 @@ const LOCAL_DEV_ENV = "MDA_LOCAL_DEV";
 const LOCAL_DEV_ACTOR = "mda:local-dev";
 /** Path MDA exposes for anonymous guest token issuance (must stay public). */
 const GUEST_ISSUANCE_PATH = "/identity/guest";
+/**
+ * Provider OAuth/OIDC callbacks must stay public (IdP redirects the browser
+ * here). Path shape: `/identity/{provider}/callback`.
+ */
+const IDENTITY_PROVIDER_CALLBACK_PATH = /^\/identity\/[^/]+\/callback\/?$/;
+/**
+ * Channel Events routes authenticate via provider signatures (Slack HMAC), not
+ * MDA ingress. Path shape: `/channels/{name}/events`.
+ */
+const CHANNEL_EVENTS_PATH = /^\/channels\/[^/]+\/events\/?$/;
 /** Synthetic actor used only to satisfy auth middleware on the issuance route. */
 const GUEST_ISSUER_ACTOR = "mda:guest-issuer";
+/** Synthetic actor so middleware_first allows unsigned Slack Events ingress. */
+const CHANNEL_EVENTS_ACTOR = "mda:channel-events";
 /**
  * Build the managed LangGraph custom-auth handler from a declared identity.
  *
@@ -37,10 +59,20 @@ export function buildManagedAuth(identity) {
     const http = cfg.ingress.http;
     const auth = new Auth();
     auth.authenticate(async (request) => {
+        // Provider-signed channel Events must reach the public HTTP handler before
+        // MDA ingress can succeed (Slack cannot present x-mda-ingress-secret).
+        if (isChannelEventsRequest(request)) {
+            return channelEventsBypassUser();
+        }
+        if (isIdentityProviderCallbackRequest(request)) {
+            return guestIssuanceBypassUser();
+        }
         if (isGuestIssuanceRequest(request, cfg)) {
             return guestIssuanceBypassUser();
         }
-        if (http === "trusted_backend") {
+        // Channel loopback (and other trusted handoffs) stamp the ingress secret
+        // even when public HTTP ingress is validated_token (e.g. Supabase web).
+        if (http === "trusted_backend" || hasValidIngressSecret(request)) {
             return resolveTrustedBackendUser(cfg, request);
         }
         return resolveValidatedTokenUser(cfg, http, request);
@@ -78,18 +110,30 @@ export function buildManagedAuth(identity) {
  */
 export async function resolveRequestIdentity(cfg, request) {
     const http = cfg.ingress.http;
-    const user = http === "trusted_backend"
+    const user = http === "trusted_backend" || hasValidIngressSecret(request)
         ? resolveTrustedBackendUser(cfg, request)
         : await resolveValidatedTokenUser(cfg, http, request);
+    // Preserve trusted channel source stamps; default public HTTP to "http".
+    const sourceProvider = user.mda_source_provider ??
+        (hasValidIngressSecret(request) ? undefined : "http");
     const identity = buildRuntimeIdentity({
-        langgraph_auth_user: user,
-        mda_source_provider: "http",
+        langgraph_auth_user: {
+            ...user,
+            ...(sourceProvider ? { mda_source_provider: sourceProvider } : {}),
+        },
     });
     if (!identity) {
         throw new HTTPException(401, { message: "unauthenticated" });
     }
     return identity;
 }
+/** LangGraph Store namespace prefix for Slack ↔ actor account links. */
+export const IDENTITY_LINKS_STORE_PREFIX = "mda_identity_links";
+/**
+ * Trusted service principal for {@link IDENTITY_LINKS_STORE_PREFIX} Store ops.
+ * Stamped by the managed link client together with the ingress secret.
+ */
+export const IDENTITY_LINKS_SERVICE_ACTOR = "mda:identity-links";
 /**
  * Fail-closed (403) unless the store `namespace` contains the identity segments
  * the memory scope requires as a contiguous ordered prefix (typically after the
@@ -105,6 +149,18 @@ export function assertStoreAccess(cfg, user, value) {
         Array.isArray(value.namespace)
         ? value.namespace.map(String)
         : [];
+    // Managed account-link table is deployment-wide (looked up before the actor
+    // is known on Slack Events). Only the trusted identity-links service
+    // principal (ingress secret + SERVICE_ACTOR) may read/write it — not
+    // ordinary authenticated users via the Store API.
+    if (namespace[0] === IDENTITY_LINKS_STORE_PREFIX) {
+        if (user.mda_actor_id === IDENTITY_LINKS_SERVICE_ACTOR) {
+            return;
+        }
+        throw new HTTPException(403, {
+            message: "store namespace is outside the caller's identity boundary",
+        });
+    }
     if (!namespaceHasOrderedSegments(namespace, required)) {
         throw new HTTPException(403, {
             message: "store namespace is outside the caller's identity boundary",
@@ -134,6 +190,10 @@ export function namespaceHasOrderedSegments(namespace, required) {
  * Under `mda dev` (`MDA_LOCAL_DEV=1`), requests without a valid ingress secret
  * resolve to a synthetic local service principal so LangGraph Studio can talk
  * to the agent without custom headers. Deploy never sets that env var.
+ *
+ * Optional source-provider / source-thread headers are accepted only after the
+ * ingress secret validates. They exist for the managed channel runner's
+ * loopback handoff — ordinary clients without the secret cannot stamp them.
  */
 export function resolveTrustedBackendUser(cfg, request) {
     const local = tryLocalDevTrustedUser(cfg, request);
@@ -147,11 +207,36 @@ export function resolveTrustedBackendUser(cfg, request) {
     }
     const tenant = request.headers.get(TENANT_HEADER) ?? undefined;
     assertTenantPresentIfMulti(cfg, tenant);
+    const sourceProvider = request.headers.get(SOURCE_PROVIDER_HEADER) ?? undefined;
+    const sourceThread = request.headers.get(SOURCE_THREAD_HEADER) ?? undefined;
+    if (sourceProvider !== undefined) {
+        if (!TRUSTED_SOURCE_PROVIDERS.has(sourceProvider)) {
+            throw new HTTPException(401, {
+                message: `unsupported ${SOURCE_PROVIDER_HEADER}`,
+            });
+        }
+        if (!sourceThread) {
+            throw new HTTPException(401, {
+                message: `missing ${SOURCE_THREAD_HEADER}`,
+            });
+        }
+    }
+    else if (sourceThread !== undefined) {
+        throw new HTTPException(401, {
+            message: `missing ${SOURCE_PROVIDER_HEADER}`,
+        });
+    }
     return {
         identity: actor,
         permissions: [],
         mda_actor_id: actor,
         ...(tenant ? { mda_tenant_id: tenant } : {}),
+        ...(sourceProvider
+            ? {
+                mda_source_provider: sourceProvider,
+                mda_source_thread_id: sourceThread,
+            }
+            : {}),
     };
 }
 /**
@@ -208,7 +293,12 @@ export function threadOwnerKey(cfg, user) {
     }
     if (scope === "channel") {
         const channel = user.mda_source_thread_id;
-        return channel ? String(channel) : actor;
+        // Slack (and other channel sources) own by source thread; web callers
+        // without a source stamp fall back to actor-owned threads.
+        if (channel && String(channel).length > 0) {
+            return String(channel);
+        }
+        return actor;
     }
     return actor;
 }
@@ -246,6 +336,22 @@ export function isGuestIssuanceRequest(request, cfg) {
     }
     return http.providers.some((provider) => provider.guest?.issue);
 }
+/** True when the request targets a public channel Events ingress route. */
+export function isChannelEventsRequest(request) {
+    if (request.method !== "POST") {
+        return false;
+    }
+    const { pathname } = new URL(request.url);
+    return CHANNEL_EVENTS_PATH.test(pathname);
+}
+/** True when the request is a public identity-provider OAuth/OIDC callback. */
+export function isIdentityProviderCallbackRequest(request) {
+    if (request.method !== "GET") {
+        return false;
+    }
+    const { pathname } = new URL(request.url);
+    return IDENTITY_PROVIDER_CALLBACK_PATH.test(pathname);
+}
 /** Placeholder identity so LangGraph auth middleware allows tokenless issuance. */
 export function guestIssuanceBypassUser() {
     return {
@@ -254,6 +360,14 @@ export function guestIssuanceBypassUser() {
         mda_actor_id: GUEST_ISSUER_ACTOR,
     };
 }
+/** Placeholder identity so middleware allows provider-signed channel Events. */
+export function channelEventsBypassUser() {
+    return {
+        identity: CHANNEL_EVENTS_ACTOR,
+        permissions: [],
+        mda_actor_id: CHANNEL_EVENTS_ACTOR,
+    };
+}
 function constantTimeEquals(a, b) {
     if (a.length !== b.length) {
         return false;

package/dist/runtime/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/runtime/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EACJ,aAAa,EACb,YAAY,GACb,MAAM,+BAA+B,CAAC;AAOvC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,YAAY,GAAG,gBAAgB,CAAC;AACtC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AACxC,MAAM,qBAAqB,GAAG,sBAAsB,CAAC;AAErD,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,aAAa,GAAG,eAAe,CAAC;AAEtC,2EAA2E;AAC3E,MAAM,eAAe,GAAG,eAAe,CAAC;AAExC,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAiB9C;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA4B;IAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;IAExB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,OAAgB,EAAwB,EAAE;QACjE,IAAI,sBAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO,uBAAuB,EAAE,CAAC;QACnC,CAAC;QACD,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC/B,OAAO,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,yBAAyB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACrC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,EAAE,IAA8B,CAAC,CAAC;QAChE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,KAA+C,CAAC;YAClE,SAAS,CAAC,QAAQ,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,+BAA+B;IAC/B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACnC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,iBAAiB,CAAC,GAAG,EAAE,IAA8B,EAAE,KAAK,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAmB,EACnB,OAAgB;IAEhB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,MAAM,IAAI,GACR,IAAI,KAAK,iBAAiB;QACxB,CAAC,CAAC,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC;QACzC,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,mBAAmB,EAAE,IAAI;QACzB,mBAAmB,EAAE,MAAM;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAmB,EACnB,IAAiB,EACjB,KAAc;IAEd,MAAM,QAAQ,GAAG,sBAAsB,CACrC,GAAG,CAAC,OAAO,CAAC,MAAM,EAClB,GAAG,CAAC,OAAO,EACX,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,EACzD,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAC5D,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GACb,KAAK;QACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,OAAO,CAAE,KAAiC,CAAC,SAAS,CAAC;QACzD,CAAC,CAAE,KAAkC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;QAC3D,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,CAAC,2BAA2B,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,2DAA2D;SACrE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,2BAA2B,CACzC,SAAmB,EACnB,QAAkB;IAElB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,SAAS,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,IACE,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,OAAO,CAAC,EACxE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAmB,EACnB,OAAgB;IAEhB,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IAED,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAE9B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,WAAW,YAAY,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC;IAC/D,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAExC,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,EAAE;QACf,YAAY,EAAE,KAAK;QACnB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAa;IAClD,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,GAAG,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAI,IAAoB,CAAC,YAAY,CAAC;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,KAAK,KAAK,eAAe;QACzB,KAAK,KAAK,eAAe;QACxB,IAAoB,CAAC,cAAc,KAAK,SAAS,CACnD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAmB,EACnB,OAAgB;IAEhB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,GAAG,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,eAAe,CAAC;IACnE,MAAM,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAClC,CAAC,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjE,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,EAAE;QACf,YAAY,EAAE,KAAK;QACnB,cAAc,EAAE,SAAS;QACzB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,GAAmB,EAAE,IAAiB;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,MAAM,IAAI,KAAK,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC1C,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAgB;IAC5C,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,mCAAmC;SAC7C,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAgB;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC5D,OAAO,OAAO,CACZ,QAAQ,IAAI,QAAQ,IAAI,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,GAAmB,EACnB,MAA0B;IAE1B,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,4CAA4C;SACtD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,sBAAsB,CACpC,OAAgB,EAChB,GAAmB;IAEnB,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,mBAAmB,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,QAAQ,EAAE,kBAAkB;QAC5B,WAAW,EAAE,EAAE;QACf,YAAY,EAAE,kBAAkB;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/runtime/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EACJ,aAAa,EACb,YAAY,GACb,MAAM,+BAA+B,CAAC;AAOvC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEjE;;;;;GAKG;AACH,oFAAoF;AACpF,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAC7C,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAC/C,MAAM,CAAC,MAAM,qBAAqB,GAAG,sBAAsB,CAAC;AAC5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,uBAAuB,CAAC;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAE7D,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD,8DAA8D;AAC9D,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAEpD;;;;GAIG;AACH,MAAM,aAAa,GAAG,eAAe,CAAC;AAEtC,2EAA2E;AAC3E,MAAM,eAAe,GAAG,eAAe,CAAC;AAExC,8EAA8E;AAC9E,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C;;;GAGG;AACH,MAAM,+BAA+B,GAAG,kCAAkC,CAAC;AAE3E;;;GAGG;AACH,MAAM,mBAAmB,GAAG,gCAAgC,CAAC;AAE7D,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAE9C,gFAAgF;AAChF,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAqBlD;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA4B;IAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;IAExB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,OAAgB,EAAwB,EAAE;QACjE,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,OAAO,uBAAuB,EAAE,CAAC;QACnC,CAAC;QACD,IAAI,iCAAiC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/C,OAAO,uBAAuB,EAAE,CAAC;QACnC,CAAC;QACD,IAAI,sBAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO,uBAAuB,EAAE,CAAC;QACnC,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,IAAI,KAAK,iBAAiB,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YACjE,OAAO,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,yBAAyB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACrC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,EAAE,IAA8B,CAAC,CAAC;QAChE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,KAA+C,CAAC;YAClE,SAAS,CAAC,QAAQ,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,+BAA+B;IAC/B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACnC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,iBAAiB,CAAC,GAAG,EAAE,IAA8B,EAAE,KAAK,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAmB,EACnB,OAAgB;IAEhB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,MAAM,IAAI,GACR,IAAI,KAAK,iBAAiB,IAAI,qBAAqB,CAAC,OAAO,CAAC;QAC1D,CAAC,CAAC,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC;QACzC,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1D,yEAAyE;IACzE,MAAM,cAAc,GAClB,IAAI,CAAC,mBAAmB;QACxB,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,mBAAmB,EAAE;YACnB,GAAG,IAAI;YACP,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;KACF,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,2BAA2B,GAAG,oBAAoB,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,oBAAoB,CAAC;AAEjE;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAmB,EACnB,IAAiB,EACjB,KAAc;IAEd,MAAM,QAAQ,GAAG,sBAAsB,CACrC,GAAG,CAAC,OAAO,CAAC,MAAM,EAClB,GAAG,CAAC,OAAO,EACX,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,EACzD,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAC5D,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GACb,KAAK;QACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,OAAO,CAAE,KAAiC,CAAC,SAAS,CAAC;QACzD,CAAC,CAAE,KAAkC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;QAC3D,CAAC,CAAC,EAAE,CAAC;IACT,4EAA4E;IAC5E,qEAAqE;IACrE,qEAAqE;IACrE,kDAAkD;IAClD,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,2BAA2B,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,YAAY,KAAK,4BAA4B,EAAE,CAAC;YACvD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,2DAA2D;SACrE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,2DAA2D;SACrE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,2BAA2B,CACzC,SAAmB,EACnB,QAAkB;IAElB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,SAAS,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,IACE,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,OAAO,CAAC,EACxE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAmB,EACnB,OAAgB;IAEhB,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IAED,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAE9B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,WAAW,YAAY,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC;IAC/D,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAExC,MAAM,cAAc,GAClB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,SAAS,CAAC;IAC3D,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,SAAS,CAAC;IAC5E,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;gBAC3B,OAAO,EAAE,eAAe,sBAAsB,EAAE;aACjD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;gBAC3B,OAAO,EAAE,WAAW,oBAAoB,EAAE;aAC3C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,WAAW,sBAAsB,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,EAAE;QACf,YAAY,EAAE,KAAK;QACnB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,cAAc;YAChB,CAAC,CAAC;gBACE,mBAAmB,EAAE,cAAc;gBACnC,oBAAoB,EAAE,YAAY;aACnC;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAa;IAClD,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,GAAG,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAI,IAAoB,CAAC,YAAY,CAAC;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,KAAK,KAAK,eAAe;QACzB,KAAK,KAAK,eAAe;QACxB,IAAoB,CAAC,cAAc,KAAK,SAAS,CACnD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAmB,EACnB,OAAgB;IAEhB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,GAAG,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,eAAe,CAAC;IACnE,MAAM,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAClC,CAAC,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjE,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,EAAE;QACf,YAAY,EAAE,KAAK;QACnB,cAAc,EAAE,SAAS;QACzB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,GAAmB,EAAE,IAAiB;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,MAAM,IAAI,KAAK,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC1C,sEAAsE;QACtE,2DAA2D;QAC3D,IAAI,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAgB;IAC5C,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,mCAAmC;SAC7C,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAgB;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC5D,OAAO,OAAO,CACZ,QAAQ,IAAI,QAAQ,IAAI,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,GAAmB,EACnB,MAA0B;IAE1B,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,4CAA4C;SACtD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,sBAAsB,CACpC,OAAgB,EAChB,GAAmB;IAEnB,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,mBAAmB,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iCAAiC,CAAC,OAAgB;IAChE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO,+BAA+B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,QAAQ,EAAE,kBAAkB;QAC5B,WAAW,EAAE,EAAE;QACf,YAAY,EAAE,kBAAkB;KACjC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,QAAQ,EAAE,oBAAoB;QAC9B,WAAW,EAAE,EAAE;QACf,YAAY,EAAE,oBAAoB;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC"}

package/dist/runtime/cors.d.ts

@@ -0,0 +1,28 @@
+/**
+ * CORS allowlist helpers for managed HTTP routes (`/identity`, `/connectors`,
+ * `/channels`).
+ *
+ * LangGraph applies `CORS_ALLOW_ORIGINS` to built-in Agent Server routes, but
+ * GET responses from the custom `http.app` do not always receive those headers.
+ * The managed app therefore adds CORS only on its own path prefixes so `/ok`
+ * and other built-ins are not double-headed.
+ *
+ * `mda deploy` still derives `CORS_ALLOW_ORIGINS` from
+ * {@link MDA_PUBLIC_APP_URL_ENV} plus optional {@link MDA_CORS_ORIGINS_ENV}.
+ */
+/** Path prefixes that receive managed-app CORS (not built-in Agent Server routes). */
+export declare const MDA_CORS_PATH_PREFIXES: readonly ["/identity", "/connectors", "/channels"];
+/** Comma-separated extra browser origins allowed for managed HTTP CORS. */
+export declare const MDA_CORS_ORIGINS_ENV = "MDA_CORS_ORIGINS";
+/** Headers browser clients send on identity / connector fetches. */
+export declare const MDA_CORS_ALLOW_HEADERS: readonly ["Authorization", "Content-Type", "Accept", "X-Api-Key", "x-api-key"];
+export declare const MDA_CORS_ALLOW_METHODS: readonly ["GET", "POST", "PUT", "DELETE", "OPTIONS"];
+export declare function isManagedCorsPath(path: string): boolean;
+/** Exact origins configured for CORS (trailing slashes stripped). */
+export declare function resolveCorsAllowlist(env?: NodeJS.ProcessEnv): string[];
+/**
+ * Return `requestOrigin` when it is allowed, otherwise `undefined`.
+ * Allows exact allowlist matches and one-level subdomains of an allowlisted host.
+ */
+export declare function matchCorsOrigin(requestOrigin: string, allowlist: string[]): string | undefined;
+//# sourceMappingURL=cors.d.ts.map

package/dist/runtime/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/runtime/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,oDAIzB,CAAC;AAEX,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,gFAMzB,CAAC;AAEX,eAAO,MAAM,sBAAsB,sDAMzB,CAAC;AAEX,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIvD;AAED,qEAAqE;AACrE,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,EAAE,CAaV;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EAAE,GAClB,MAAM,GAAG,SAAS,CA+BpB"}

package/dist/runtime/cors.js

@@ -0,0 +1,92 @@
+/**
+ * CORS allowlist helpers for managed HTTP routes (`/identity`, `/connectors`,
+ * `/channels`).
+ *
+ * LangGraph applies `CORS_ALLOW_ORIGINS` to built-in Agent Server routes, but
+ * GET responses from the custom `http.app` do not always receive those headers.
+ * The managed app therefore adds CORS only on its own path prefixes so `/ok`
+ * and other built-ins are not double-headed.
+ *
+ * `mda deploy` still derives `CORS_ALLOW_ORIGINS` from
+ * {@link MDA_PUBLIC_APP_URL_ENV} plus optional {@link MDA_CORS_ORIGINS_ENV}.
+ */
+import { MDA_PUBLIC_APP_URL_ENV } from "../identity/slack-oauth.js";
+/** Path prefixes that receive managed-app CORS (not built-in Agent Server routes). */
+export const MDA_CORS_PATH_PREFIXES = [
+    "/identity",
+    "/connectors",
+    "/channels",
+];
+/** Comma-separated extra browser origins allowed for managed HTTP CORS. */
+export const MDA_CORS_ORIGINS_ENV = "MDA_CORS_ORIGINS";
+/** Headers browser clients send on identity / connector fetches. */
+export const MDA_CORS_ALLOW_HEADERS = [
+    "Authorization",
+    "Content-Type",
+    "Accept",
+    "X-Api-Key",
+    "x-api-key",
+];
+export const MDA_CORS_ALLOW_METHODS = [
+    "GET",
+    "POST",
+    "PUT",
+    "DELETE",
+    "OPTIONS",
+];
+export function isManagedCorsPath(path) {
+    return MDA_CORS_PATH_PREFIXES.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
+}
+/** Exact origins configured for CORS (trailing slashes stripped). */
+export function resolveCorsAllowlist(env = process.env) {
+    const origins = new Set();
+    const publicApp = env[MDA_PUBLIC_APP_URL_ENV]?.trim().replace(/\/$/, "");
+    if (publicApp) {
+        origins.add(publicApp);
+    }
+    for (const part of (env[MDA_CORS_ORIGINS_ENV] ?? "").split(",")) {
+        const origin = part.trim().replace(/\/$/, "");
+        if (origin) {
+            origins.add(origin);
+        }
+    }
+    return [...origins];
+}
+/**
+ * Return `requestOrigin` when it is allowed, otherwise `undefined`.
+ * Allows exact allowlist matches and one-level subdomains of an allowlisted host.
+ */
+export function matchCorsOrigin(requestOrigin, allowlist) {
+    let origin;
+    try {
+        origin = new URL(requestOrigin).origin;
+    }
+    catch {
+        return undefined;
+    }
+    if (allowlist.includes(origin)) {
+        return origin;
+    }
+    let requestHost;
+    try {
+        requestHost = new URL(origin).host;
+    }
+    catch {
+        return undefined;
+    }
+    for (const allowed of allowlist) {
+        let allowedHost;
+        try {
+            allowedHost = new URL(allowed).host;
+        }
+        catch {
+            continue;
+        }
+        if (requestHost === allowedHost ||
+            requestHost.endsWith(`.${allowedHost}`)) {
+            return origin;
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=cors.js.map

package/dist/runtime/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/runtime/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,sFAAsF;AACtF,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,WAAW;IACX,aAAa;IACb,WAAW;CACH,CAAC;AAEX,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,oEAAoE;AACpE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,eAAe;IACf,cAAc;IACd,QAAQ;IACR,WAAW;IACX,WAAW;CACH,CAAC;AAEX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,SAAS;CACD,CAAC;AAEX,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,sBAAsB,CAAC,IAAI,CAChC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,SAAS,GAAG,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,aAAqB,EACrB,SAAmB;IAEnB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,IAAI,WAAmB,CAAC;QACxB,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IACE,WAAW,KAAK,WAAW;YAC3B,WAAW,CAAC,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,EACvC,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/runtime/identity-http.d.ts

@@ -1,5 +1,6 @@
 import { Hono } from "hono";
 import type { IdentityDefinition } from "../identity/index.js";
+import type { ChannelManifest } from "../channels/slack/define.js";
 import type { Connector } from "./connector.js";
 /** Inputs the managed HTTP app is built from. */
 export interface ManagedHttpAppInputs {
@@ -7,6 +8,11 @@ export interface ManagedHttpAppInputs {
     identity?: IdentityDefinition;
     /** Discovered connectors; those implementing `http` mount routes. */
     connectors?: Connector[];
+    /**
+     * Channel manifests emitted at compile time (`channels.json`). Each Slack
+     * entry mounts a public Events API route under `/channels/{name}/events`.
+     */
+    channels?: Record<string, ChannelManifest>;
 }
 /**
  * Build the single managed HTTP app mounted via `langgraph.json` `http.app`.

package/dist/runtime/identity-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-http.d.ts","sourceRoot":"","sources":["../../src/runtime/identity-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAkB,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/E,OAAO,KAAK,EACV,SAAS,EAKV,MAAM,gBAAgB,CAAC;AAGxB,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,qEAAqE;IACrE,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CAC1B;AAuBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAgBtE"}
+{"version":3,"file":"identity-http.d.ts","sourceRoot":"","sources":["../../src/runtime/identity-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EAAkB,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAOnE,OAAO,KAAK,EACV,SAAS,EAKV,MAAM,gBAAgB,CAAC;AAUxB,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,qEAAqE;IACrE,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC5C;AAuBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAqCtE"}