managed-deepagents 0.4.0-dev.68 → 0.4.0-dev.70

package/dist/runtime/identity-http.js

@@ -1,5 +1,9 @@
 import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { handleSlackEventsRequest } from "../channels/slack/http.js";
+import { mountSlackConnectRoutes, projectHasSlackChannel, } from "../identity/slack-connect-http.js";
 import { resolveRequestIdentity } from "./auth.js";
+import { isManagedCorsPath, matchCorsOrigin, MDA_CORS_ALLOW_HEADERS, MDA_CORS_ALLOW_METHODS, resolveCorsAllowlist, } from "./cors.js";
 import { issueGuestToken } from "./validated-token.js";
 /** Signals a secured route was reached but no identity is declared to resolve it. */
 class IdentityNotConfiguredError extends Error {
@@ -26,6 +30,7 @@ class IdentityNotConfiguredError extends Error {
  */
 export function buildManagedHttpApp(inputs) {
     const app = new Hono();
+    mountManagedCors(app);
     if (inputs.identity) {
         mountIdentityRoutes(app, inputs.identity);
     }
@@ -35,9 +40,52 @@ export function buildManagedHttpApp(inputs) {
             mountConnectorRoutes(app, connector, inputs.identity?.config, mounted);
         }
     }
+    mountChannelRoutes(app, inputs.channels, mounted);
+    // Connect-with-Slack only when the project declares a Slack channel.
+    if (inputs.identity && projectHasSlackChannel(inputs.channels)) {
+        mountSlackConnectRoutes(app, inputs.identity.config);
+        for (const route of [
+            { method: "get", path: "/identity/slack/status", secured: true },
+            { method: "get", path: "/identity/slack/connect", secured: true },
+            { method: "get", path: "/identity/slack/callback", secured: false },
+            { method: "delete", path: "/identity/slack/link", secured: true },
+        ]) {
+            mounted.push({
+                connector: "identity:slack-connect",
+                method: route.method,
+                path: route.path,
+                secured: route.secured,
+            });
+        }
+    }
     logConnectorSurface(mounted);
     return app;
 }
+/**
+ * CORS for managed routes only.
+ *
+ * LangGraph's `CORS_ALLOW_ORIGINS` covers built-ins (`/ok`, `/threads`, …) but
+ * GET responses from `http.app` often omit ACAO. Scoping to managed prefixes
+ * avoids stacking a second ACAO on those built-ins.
+ */
+function mountManagedCors(app) {
+    const allowlist = resolveCorsAllowlist();
+    if (allowlist.length === 0) {
+        return;
+    }
+    const middleware = cors({
+        origin: (origin) => matchCorsOrigin(origin, allowlist) ?? null,
+        allowMethods: [...MDA_CORS_ALLOW_METHODS],
+        allowHeaders: [...MDA_CORS_ALLOW_HEADERS],
+        credentials: true,
+    });
+    app.use("*", async (c, next) => {
+        if (!isManagedCorsPath(c.req.path)) {
+            return next();
+        }
+        return middleware(c, next);
+    });
+}
 /** Mount the public identity routes (guest issuance) onto `app`. */
 function mountIdentityRoutes(app, identity) {
     const http = identity.config.ingress.http;
@@ -53,6 +101,43 @@ function mountIdentityRoutes(app, identity) {
         return c.json({ token });
     });
 }
+/**
+ * Mount public Slack Events routes for each channel manifest.
+ *
+ * Channel ingress authenticates via Slack request signatures — these routes
+ * stay public at the LangGraph auth layer (middleware_first).
+ */
+function mountChannelRoutes(app, channels, mounted) {
+    if (!channels)
+        return;
+    for (const [name, manifest] of Object.entries(channels)) {
+        if (manifest.provider !== "slack")
+            continue;
+        const path = `/channels/${name}/events`;
+        mounted.push({
+            connector: `channel:${name}`,
+            method: "post",
+            path,
+            secured: false,
+        });
+        app.post(path, async (c) => {
+            // Read the body through Hono so signature verification sees the same
+            // bytes Slack signed (platform middleware may otherwise consume `raw`).
+            const rawBody = await c.req.text();
+            return handleSlackEventsRequest(c.req.raw, {
+                name,
+                config: {
+                    on: manifest.triggers,
+                    autoReply: manifest.autoReply,
+                    mentionBehavior: manifest.mentionBehavior,
+                    filters: manifest.filters,
+                    conversation: manifest.conversation,
+                },
+                rawBody,
+            });
+        });
+    }
+}
 /**
  * Mount a connector's `http` routes on a sub-router namespaced under
  * `/connectors/{kind}`, so connector routes cannot collide with identity/API
@@ -144,9 +229,12 @@ function logConnectorSurface(mounted) {
     if (mounted.length === 0) {
         return;
     }
-    console.info(`[mda] connector HTTP surface (${mounted.length} route(s)):`);
+    console.info(`[mda] managed HTTP surface (${mounted.length} route(s)):`);
     for (const route of mounted) {
-        const full = `/connectors/${route.connector}${route.path}`;
+        const full = route.connector.startsWith("channel:") ||
+            route.connector.startsWith("identity:")
+            ? route.path
+            : `/connectors/${route.connector}${route.path}`;
         const line = `[mda]   ${route.method.toUpperCase().padEnd(6)} ${full}`;
         if (route.secured) {
             console.info(`${line}  (identity enforced)`);

package/dist/runtime/identity-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-http.js","sourceRoot":"","sources":["../../src/runtime/identity-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAQnD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAoBvD,qFAAqF;AACrF,MAAM,0BAA2B,SAAQ,KAAK;IACnC,MAAM,GAAG,GAAG,CAAC;IACtB;QACE,KAAK,CACH,qEAAqE;YACnE,qBAAqB,CACxB,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA4B;IAC9D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QAChD,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACzC,oBAAoB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAE7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,SAAS,mBAAmB,CAAC,GAAS,EAAE,QAA4B;IAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CACpC,CAAC;IACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAC3B,GAAS,EACT,SAAoB,EACpB,GAA+B,EAC/B,OAAuB;IAEvB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,GAAG,GAAgB;QACvB,MAAM;QACN,QAAQ,EAAE,GAAG;QACb,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE;YAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,6DAA6D;oBAC3D,0DAA0D,CAC7D,CACF,CAAC;YACJ,CAAC;YACD,OAAO,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;KACF,CAAC;IACF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,CAAyB,CAAC;IAC7D,IACE,MAAM,IAAI,IAAI;QACd,OAAQ,MAA4B,CAAC,IAAI,KAAK,UAAU,EACxD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,CAAC,IAAI,+CAA+C;YACzE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,eAAe,SAAS,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,GAAS,EACT,IAAY,EACZ,GAA+B,EAC/B,OAAuB;IAEvB,MAAM,OAAO,GACX,CAAC,MAAkB,EAAE,EAAE,CAAC,CAAC,IAAY,EAAE,OAA4B,EAAE,EAAE;QACrE,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC5B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;YAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,oBAAoB,CAAC,IAAI,0BAA0B,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEJ,MAAM,WAAW,GACf,CAAC,MAAkB,EAAE,EAAE,CAAC,CAAC,IAAY,EAAE,OAA2B,EAAE,EAAE;QACpE,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC;IAEJ,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC;QACnB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;QACrB,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC;QACnB,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC;QACzB,MAAM,EAAE;YACN,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC;YACvB,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC;YACzB,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC;YACvB,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,MAAM,GACV,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ;QACxD,CAAC,CAAE,KAA4B,CAAC,MAAM;QACtC,CAAC,CAAC,GAAG,CAAC;IACV,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;IAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE;QACtD,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,OAAuB;IAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,iCAAiC,OAAO,CAAC,MAAM,aAAa,CAAC,CAAC;IAC3E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,eAAe,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,WAAW,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QACvE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,sCAAsC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"identity-http.js","sourceRoot":"","sources":["../../src/runtime/identity-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAQnD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAyBvD,qFAAqF;AACrF,MAAM,0BAA2B,SAAQ,KAAK;IACnC,MAAM,GAAG,GAAG,CAAC;IACtB;QACE,KAAK,CACH,qEAAqE;YACnE,qBAAqB,CACxB,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA4B;IAC9D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAEtB,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QAChD,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACzC,oBAAoB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAElD,qEAAqE;IACrE,IAAI,MAAM,CAAC,QAAQ,IAAI,sBAAsB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrD,KAAK,MAAM,KAAK,IAAI;YAClB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE;YAChE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,IAAI,EAAE;YACjE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,KAAK,EAAE;YACnE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE;SACzD,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC;gBACX,SAAS,EAAE,wBAAwB;gBACnC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAE7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,GAAS;IACjC,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAC;IACzC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC;QACtB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,IAAI;QAC9D,YAAY,EAAE,CAAC,GAAG,sBAAsB,CAAC;QACzC,YAAY,EAAE,CAAC,GAAG,sBAAsB,CAAC;QACzC,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,OAAO,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,oEAAoE;AACpE,SAAS,mBAAmB,CAAC,GAAS,EAAE,QAA4B;IAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CACvC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CACpC,CAAC;IACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CACzB,GAAS,EACT,QAAqD,EACrD,OAAuB;IAEvB,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO;YAAE,SAAS;QAC5C,MAAM,IAAI,GAAG,aAAa,IAAI,SAAS,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC;YACX,SAAS,EAAE,WAAW,IAAI,EAAE;YAC5B,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACzB,qEAAqE;YACrE,wEAAwE;YACxE,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACnC,OAAO,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE;gBACzC,IAAI;gBACJ,MAAM,EAAE;oBACN,EAAE,EAAE,QAAQ,CAAC,QAAQ;oBACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,eAAe,EAAE,QAAQ,CAAC,eAAe;oBACzC,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,YAAY,EAAE,QAAQ,CAAC,YAAY;iBACpC;gBACD,OAAO;aACR,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAC3B,GAAS,EACT,SAAoB,EACpB,GAA+B,EAC/B,OAAuB;IAEvB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,GAAG,GAAgB;QACvB,MAAM;QACN,QAAQ,EAAE,GAAG;QACb,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE;YAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,6DAA6D;oBAC3D,0DAA0D,CAC7D,CACF,CAAC;YACJ,CAAC;YACD,OAAO,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;KACF,CAAC;IACF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,CAAyB,CAAC;IAC7D,IACE,MAAM,IAAI,IAAI;QACd,OAAQ,MAA4B,CAAC,IAAI,KAAK,UAAU,EACxD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,CAAC,IAAI,+CAA+C;YACzE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,eAAe,SAAS,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,GAAS,EACT,IAAY,EACZ,GAA+B,EAC/B,OAAuB;IAEvB,MAAM,OAAO,GACX,CAAC,MAAkB,EAAE,EAAE,CAAC,CAAC,IAAY,EAAE,OAA4B,EAAE,EAAE;QACrE,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC5B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;YAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,oBAAoB,CAAC,IAAI,0BAA0B,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEJ,MAAM,WAAW,GACf,CAAC,MAAkB,EAAE,EAAE,CAAC,CAAC,IAAY,EAAE,OAA2B,EAAE,EAAE;QACpE,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC;IAEJ,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC;QACnB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;QACrB,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC;QACnB,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC;QACzB,MAAM,EAAE;YACN,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC;YACvB,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC;YACzB,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC;YACvB,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,MAAM,GACV,OAAQ,KAA8B,CAAC,MAAM,KAAK,QAAQ;QACxD,CAAC,CAAE,KAA4B,CAAC,MAAM;QACtC,CAAC,CAAC,GAAG,CAAC;IACV,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;IAC3E,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE;QACtD,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,OAAuB;IAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,+BAA+B,OAAO,CAAC,MAAM,aAAa,CAAC,CAAC;IACzE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GACR,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC;YACtC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC;YACrC,CAAC,CAAC,KAAK,CAAC,IAAI;YACZ,CAAC,CAAC,eAAe,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,WAAW,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QACvE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,sCAAsC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/runtime/identity-runtime.d.ts

@@ -1,8 +1,21 @@
 import type { IdentityConfig, MemoryScope, RuntimeIdentity, Tenancy } from "../identity/index.js";
+import type { RuntimeChannel } from "../channels/types.js";
 import type { ConfigurableCarrier } from "./types.js";
+/** Override ambient LangGraph configurable resolution. Test-only. */
+export declare function setAmbientConfigurableForTests(loader?: () => Record<string, unknown> | undefined): void;
 /**
  * Resolve the LangGraph `configurable` bag from either a flat runtime or the
- * nested `ToolRuntime` shape LangChain passes to tools (`runtime.config.configurable`).
+ * nested `ToolRuntime` shape LangChain passes to tools
+ * (`runtime.config.configurable`).
+ *
+ * When the caller only passes `{ state }` (deepagents memory/skills middleware
+ * does this when resolving a {@link BackendFactory}), fall back to the ambient
+ * LangGraph runnable config so `langgraph_auth_user` still reaches actor/tenant
+ * memory remounts.
+ *
+ * Also fall back when a runtime `config` is present but its `configurable` bag
+ * lacks `langgraph_auth_user` (empty or partial). Returning that bag would skip
+ * ambient and break first-turn actor memory remounts.
  */
 export declare function resolveRuntimeConfigurable(runtime: RuntimeConfigLike | undefined): Record<string, unknown> | undefined;
 /**
@@ -31,6 +44,7 @@ export declare function memoryNamespace(cfg: IdentityConfig, ident: RuntimeIdent
  */
 export interface RuntimeConfigLike extends ConfigurableCarrier {
     identity?: RuntimeIdentity;
+    channel?: RuntimeChannel;
     config?: {
         configurable?: Record<string, unknown>;
     };
@@ -50,6 +64,32 @@ export declare function memoryNamespaceFor(runtime: RuntimeConfigLike | undefine
  * on exactly which segments identify a namespace.
  */
 export declare function memoryIdentitySegments(scope: MemoryScope, tenancy: Tenancy, actorId: string | undefined, tenantId: string | undefined): string[];
+/**
+ * Dedicated Context Hub repo handle for actor/tenant memory.
+ *
+ * LangSmith requires `^[a-z][a-z0-9-_]*$`. Naming:
+ * - single · actor → `{deploy}--u--{actor}`
+ * - multi · actor → `{deploy}--t--{tenant}--u--{actor}`
+ * - tenant → `{deploy}--t--{tenant}`
+ *
+ * Returns `null` for `agent` / `none` (those stay on the deployment repo).
+ */
+export declare function memoryHubRepoHandle(deployRepo: string, scope: MemoryScope, tenancy: Tenancy, actorId: string | undefined, tenantId: string | undefined): string | null;
+/**
+ * Make identity ids safe as Hub / local-FS *path* segments (`guest:uuid` → `guest_uuid`).
+ *
+ * ASCII-only so npm and PyPI agree. Empty / `.` / `..` collapse to `_` so a
+ * local `path.join` cannot escape the Context Hub root.
+ */
+export declare function sanitizeMemoryPathSegment(segment: string): string;
+/**
+ * Make identity ids safe as Context Hub *repo handles*
+ * (`^[a-z][a-z0-9-_]*$` — LangSmith `pushAgent` requirement).
+ *
+ * Implemented as a linear scan (no `/-+/` regex) so long dash runs cannot
+ * trigger CodeQL polynomial-ReDoS alerts on uncontrolled identity input.
+ */
+export declare function sanitizeHubRepoSegment(segment: string): string;
 /**
  * Strip client-supplied identity keys from an incoming `configurable` so a
  * request body can never spoof the actor/tenant the handler resolved. The

package/dist/runtime/identity-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-runtime.d.ts","sourceRoot":"","sources":["../../src/runtime/identity-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EACX,eAAe,EACf,OAAO,EACR,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AA0BtD;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GACrC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAErC;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAChD,eAAe,GAAG,SAAS,CA0B7B;AAwBD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,GACnB,MAAM,EAAE,GAAG,SAAS,CAiBtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,MAAM,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CACrD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,iBAAiB,GAAG,SAAS,EACtC,GAAG,EAAE,cAAc,EACnB,YAAY,EAAE,MAAM,GACnB,MAAM,EAAE,GAAG,SAAS,CAQtB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,EAAE,CAgBV;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAChD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB"}
+{"version":3,"file":"identity-runtime.d.ts","sourceRoot":"","sources":["../../src/runtime/identity-runtime.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EACX,eAAe,EACf,OAAO,EACR,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAmCtD,qEAAqE;AACrE,wBAAgB,8BAA8B,CAC5C,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GACjD,IAAI,CAEN;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GACrC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAWrC;AA4BD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAChD,eAAe,GAAG,SAAS,CA0B7B;AAwBD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,GACnB,MAAM,EAAE,GAAG,SAAS,CAiBtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,MAAM,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CACrD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,iBAAiB,GAAG,SAAS,EACtC,GAAG,EAAE,cAAc,EACnB,YAAY,EAAE,MAAM,GACnB,MAAM,EAAE,GAAG,SAAS,CAQtB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,EAAE,CAgBV;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,GAAG,IAAI,CAsBf;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMjE;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA0B9D;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAChD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB"}

package/dist/runtime/identity-runtime.js

@@ -1,3 +1,4 @@
+import { getConfig } from "@langchain/langgraph";
 /**
  * Identity fields a client must never assert via `config.configurable`; only the
  * custom-auth handler (`langgraph_auth_user`) is trusted.
@@ -10,7 +11,12 @@ const RESERVED_CONFIGURABLE_KEYS = new Set([
     "mda_actor_email",
     "mda_claims",
     "mda_actor_type",
+    "mda_source_provider",
     "mda_source_thread_id",
+    /** Stamped by the managed channel runner; rebuilt into `runtime.channel`. */
+    "mda_channel_binding",
+    /** Stamped by compiled cron entries; never client-asserted. */
+    "mda_schedule",
 ]);
 /** Source channels a run can originate from (`runtime.identity.source.provider`). */
 const SOURCE_PROVIDERS = new Set([
@@ -20,12 +26,57 @@ const SOURCE_PROVIDERS = new Set([
     "cli",
     "studio",
 ]);
+let ambientConfigurableForTests;
+/** Override ambient LangGraph configurable resolution. Test-only. */
+export function setAmbientConfigurableForTests(loader) {
+    ambientConfigurableForTests = loader;
+}
 /**
  * Resolve the LangGraph `configurable` bag from either a flat runtime or the
- * nested `ToolRuntime` shape LangChain passes to tools (`runtime.config.configurable`).
+ * nested `ToolRuntime` shape LangChain passes to tools
+ * (`runtime.config.configurable`).
+ *
+ * When the caller only passes `{ state }` (deepagents memory/skills middleware
+ * does this when resolving a {@link BackendFactory}), fall back to the ambient
+ * LangGraph runnable config so `langgraph_auth_user` still reaches actor/tenant
+ * memory remounts.
+ *
+ * Also fall back when a runtime `config` is present but its `configurable` bag
+ * lacks `langgraph_auth_user` (empty or partial). Returning that bag would skip
+ * ambient and break first-turn actor memory remounts.
  */
 export function resolveRuntimeConfigurable(runtime) {
-    return runtime?.configurable ?? runtime?.config?.configurable;
+    const fromRuntime = configurableFromRuntime(runtime);
+    if (fromRuntime && "langgraph_auth_user" in fromRuntime) {
+        return fromRuntime;
+    }
+    const ambient = resolveAmbientConfigurable();
+    if (ambient) {
+        return ambient;
+    }
+    return fromRuntime;
+}
+function configurableFromRuntime(runtime) {
+    const fromRuntime = runtime?.configurable ?? runtime?.config?.configurable;
+    if (fromRuntime && typeof fromRuntime === "object") {
+        return fromRuntime;
+    }
+    return undefined;
+}
+function resolveAmbientConfigurable() {
+    if (ambientConfigurableForTests) {
+        return ambientConfigurableForTests();
+    }
+    try {
+        const configurable = getConfig().configurable;
+        if (configurable && typeof configurable === "object") {
+            return configurable;
+        }
+    }
+    catch {
+        // Outside a runnable context (e.g. authoring-time unit tests).
+    }
+    return undefined;
 }
 /**
  * Build the frozen identity envelope for the current run from the trusted
@@ -142,6 +193,83 @@ export function memoryIdentitySegments(scope, tenancy, actorId, tenantId) {
     // "agent" (shared) | "none" (no memory) → no per-identity restriction.
     return [];
 }
+/**
+ * Dedicated Context Hub repo handle for actor/tenant memory.
+ *
+ * LangSmith requires `^[a-z][a-z0-9-_]*$`. Naming:
+ * - single · actor → `{deploy}--u--{actor}`
+ * - multi · actor → `{deploy}--t--{tenant}--u--{actor}`
+ * - tenant → `{deploy}--t--{tenant}`
+ *
+ * Returns `null` for `agent` / `none` (those stay on the deployment repo).
+ */
+export function memoryHubRepoHandle(deployRepo, scope, tenancy, actorId, tenantId) {
+    if (scope === "none" || scope === "agent") {
+        return null;
+    }
+    const segments = memoryIdentitySegments(scope, tenancy, actorId, tenantId).map(sanitizeHubRepoSegment);
+    if (segments.length === 0) {
+        return null;
+    }
+    const base = sanitizeHubRepoSegment(deployRepo);
+    if (scope === "tenant") {
+        return `${base}--t--${segments[0]}`;
+    }
+    // actor
+    if (tenancy === "multi" && segments.length >= 2) {
+        return `${base}--t--${segments[0]}--u--${segments[1]}`;
+    }
+    return `${base}--u--${segments[0]}`;
+}
+/**
+ * Make identity ids safe as Hub / local-FS *path* segments (`guest:uuid` → `guest_uuid`).
+ *
+ * ASCII-only so npm and PyPI agree. Empty / `.` / `..` collapse to `_` so a
+ * local `path.join` cannot escape the Context Hub root.
+ */
+export function sanitizeMemoryPathSegment(segment) {
+    const cleaned = segment.replace(/[^A-Za-z0-9._@-]+/g, "_");
+    if (cleaned === "" || cleaned === "." || cleaned === "..") {
+        return "_";
+    }
+    return cleaned;
+}
+/**
+ * Make identity ids safe as Context Hub *repo handles*
+ * (`^[a-z][a-z0-9-_]*$` — LangSmith `pushAgent` requirement).
+ *
+ * Implemented as a linear scan (no `/-+/` regex) so long dash runs cannot
+ * trigger CodeQL polynomial-ReDoS alerts on uncontrolled identity input.
+ */
+export function sanitizeHubRepoSegment(segment) {
+    let cleaned = "";
+    let pendingDash = false;
+    for (let i = 0; i < segment.length; i++) {
+        const code = segment.charCodeAt(i);
+        // Fold ASCII A-Z to a-z; leave everything else for the separator branch.
+        const lower = code >= 65 && code <= 90 ? code + 32 : code;
+        const isLower = lower >= 97 && lower <= 122;
+        const isDigit = lower >= 48 && lower <= 57;
+        if (isLower || isDigit) {
+            if (pendingDash && cleaned.length > 0) {
+                cleaned += "-";
+            }
+            cleaned += String.fromCharCode(lower);
+            pendingDash = false;
+        }
+        else {
+            // `-`, `_`, `:`, unicode, etc. all collapse to a single separator dash.
+            pendingDash = true;
+        }
+    }
+    if (cleaned.length === 0) {
+        cleaned = "x";
+    }
+    else if (cleaned.charCodeAt(0) < 97 || cleaned.charCodeAt(0) > 122) {
+        cleaned = `u-${cleaned}`;
+    }
+    return cleaned;
+}
 /**
  * Strip client-supplied identity keys from an incoming `configurable` so a
  * request body can never spoof the actor/tenant the handler resolved. The
@@ -154,6 +282,12 @@ export function sanitizeConfigurable(configurable) {
     return Object.fromEntries(Object.entries(configurable).filter(([key]) => !RESERVED_CONFIGURABLE_KEYS.has(key)));
 }
 function sourceProvider(configurable) {
+    const user = configurable?.langgraph_auth_user;
+    const fromUser = user?.mda_source_provider;
+    if (typeof fromUser === "string" && SOURCE_PROVIDERS.has(fromUser)) {
+        return fromUser;
+    }
+    // Legacy top-level stamp (pre-channel); reserved and stripped from clients.
     const declared = configurable?.mda_source_provider;
     if (typeof declared === "string" && SOURCE_PROVIDERS.has(declared)) {
         return declared;
@@ -161,6 +295,12 @@ function sourceProvider(configurable) {
     return "http";
 }
 function threadId(configurable) {
+    const user = configurable?.langgraph_auth_user;
+    const fromUser = user?.mda_source_thread_id;
+    if (fromUser != null && String(fromUser).length > 0) {
+        return String(fromUser);
+    }
+    // Non-channel / backward-compatible fallback.
     const value = configurable?.thread_id;
     return value == null ? undefined : String(value);
 }

package/dist/runtime/identity-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-runtime.js","sourceRoot":"","sources":["../../src/runtime/identity-runtime.ts"],"names":[],"mappings":"AASA;;;GAGG;AACH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,UAAU;IACV,WAAW;IACX,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,YAAY;IACZ,gBAAgB;IAChB,sBAAsB;CACvB,CAAC,CAAC;AAEH,qFAAqF;AACrF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,OAAO;IACP,UAAU;IACV,KAAK;IACL,QAAQ;CACT,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAsC;IAEtC,OAAO,OAAO,EAAE,YAAY,IAAI,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC;AAChE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAiD;IAEjD,MAAM,IAAI,GAAG,YAAY,EAAE,mBAA8C,CAAC;IAC1E,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,EAAE,YAAY,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC5E,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAoB;QAChC,KAAK,EAAE;YACL,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;YACtE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC;YAC1D,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE;KACF,CAAC;IACF,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC3D,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,UAAqC,CAAC;IAC/D,CAAC;IACD,4EAA4E;IAC5E,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,oEAAoE;AACpE,SAAS,gBAAgB,CAAC,IAA6B;IACrD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,KAAK,uBAAuB,CAAC;AACnD,CAAC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,UAAU,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAmB,EACnB,KAAsB,EACtB,YAAoB;IAEpB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IACjC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO;QACL,YAAY;QACZ,GAAG,sBAAsB,CACvB,KAAK,EACL,GAAG,CAAC,OAAO,EACX,KAAK,CAAC,KAAK,CAAC,EAAE,EACd,KAAK,CAAC,MAAM,EAAE,EAAE,CACjB;KACF,CAAC;AACJ,CAAC;AAaD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAsC,EACtC,GAAmB,EACnB,YAAoB;IAEpB,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC;IAC5E,MAAM,QAAQ,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACtD,CAAC;IACD,+EAA+E;IAC/E,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAkB,EAClB,OAAgB,EAChB,OAA2B,EAC3B,QAA4B;IAE5B,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,OAAO,KAAK,OAAO,IAAI,QAAQ,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpC,CAAC;IACD,uEAAuE;IACvE,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAiD;IAEjD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,MAAM,CACjC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,CAChD,CACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,YAAiD;IAEjD,MAAM,QAAQ,GAAG,YAAY,EAAE,mBAAmB,CAAC;IACnD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,OAAO,QAAiD,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CACf,YAAiD;IAEjD,MAAM,KAAK,GAAG,YAAY,EAAE,SAAS,CAAC;IACtC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"identity-runtime.js","sourceRoot":"","sources":["../../src/runtime/identity-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAYjD;;;GAGG;AACH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,UAAU;IACV,WAAW;IACX,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;IACrB,sBAAsB;IACtB,6EAA6E;IAC7E,qBAAqB;IACrB,+DAA+D;IAC/D,cAAc;CACf,CAAC,CAAC;AAEH,qFAAqF;AACrF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,OAAO;IACP,UAAU;IACV,KAAK;IACL,QAAQ;CACT,CAAC,CAAC;AAEH,IAAI,2BAES,CAAC;AAEd,qEAAqE;AACrE,MAAM,UAAU,8BAA8B,CAC5C,MAAkD;IAElD,2BAA2B,GAAG,MAAM,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAsC;IAEtC,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,WAAW,IAAI,qBAAqB,IAAI,WAAW,EAAE,CAAC;QACxD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;IAC7C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAsC;IAEtC,MAAM,WAAW,GAAG,OAAO,EAAE,YAAY,IAAI,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC;IAC3E,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO,WAAsC,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,0BAA0B;IACjC,IAAI,2BAA2B,EAAE,CAAC;QAChC,OAAO,2BAA2B,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,SAAS,EAAE,CAAC,YAAY,CAAC;QAC9C,IAAI,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,YAAuC,CAAC;QACjD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAiD;IAEjD,MAAM,IAAI,GAAG,YAAY,EAAE,mBAA8C,CAAC;IAC1E,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,EAAE,YAAY,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC5E,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAoB;QAChC,KAAK,EAAE;YACL,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;YACtE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC;YAC1D,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE;KACF,CAAC;IACF,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC3D,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,UAAqC,CAAC;IAC/D,CAAC;IACD,4EAA4E;IAC5E,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,oEAAoE;AACpE,SAAS,gBAAgB,CAAC,IAA6B;IACrD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,KAAK,uBAAuB,CAAC;AACnD,CAAC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,UAAU,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAmB,EACnB,KAAsB,EACtB,YAAoB;IAEpB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IACjC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO;QACL,YAAY;QACZ,GAAG,sBAAsB,CACvB,KAAK,EACL,GAAG,CAAC,OAAO,EACX,KAAK,CAAC,KAAK,CAAC,EAAE,EACd,KAAK,CAAC,MAAM,EAAE,EAAE,CACjB;KACF,CAAC;AACJ,CAAC;AAcD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAsC,EACtC,GAAmB,EACnB,YAAoB;IAEpB,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC;IAC5E,MAAM,QAAQ,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACtD,CAAC;IACD,+EAA+E;IAC/E,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAkB,EAClB,OAAgB,EAChB,OAA2B,EAC3B,QAA4B;IAE5B,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,OAAO,KAAK,OAAO,IAAI,QAAQ,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpC,CAAC;IACD,uEAAuE;IACvE,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAkB,EAClB,KAAkB,EAClB,OAAgB,EAChB,OAA2B,EAC3B,QAA4B;IAE5B,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,sBAAsB,CACrC,KAAK,EACL,OAAO,EACP,OAAO,EACP,QAAQ,CACT,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC9B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,GAAG,IAAI,QAAQ,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACtC,CAAC;IACD,QAAQ;IACR,IAAI,OAAO,KAAK,OAAO,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAChD,OAAO,GAAG,IAAI,QAAQ,QAAQ,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,IAAI,QAAQ,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC1D,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACnC,yEAAyE;QACzE,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,IAAI,KAAK,IAAI,GAAG,CAAC;QAC5C,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3C,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;YACvB,IAAI,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtC,OAAO,IAAI,GAAG,CAAC;YACjB,CAAC;YACD,OAAO,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YACtC,WAAW,GAAG,KAAK,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,GAAG,CAAC;IAChB,CAAC;SAAM,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC;QACrE,OAAO,GAAG,KAAK,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAAiD;IAEjD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,MAAM,CACjC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,CAChD,CACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,YAAiD;IAEjD,MAAM,IAAI,GAAG,YAAY,EAAE,mBAA8C,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,EAAE,mBAAmB,CAAC;IAC3C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,OAAO,QAAiD,CAAC;IAC3D,CAAC;IACD,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,YAAY,EAAE,mBAAmB,CAAC;IACnD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,OAAO,QAAiD,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CACf,YAAiD;IAEjD,MAAM,IAAI,GAAG,YAAY,EAAE,mBAA8C,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,EAAE,oBAAoB,CAAC;IAC5C,IAAI,QAAQ,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IACD,8CAA8C;IAC9C,MAAM,KAAK,GAAG,YAAY,EAAE,SAAS,CAAC;IACtC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC"}

package/dist/runtime/index.d.ts

@@ -8,11 +8,12 @@ export type { Connector, ConnectorToolList, DiscoveredConnectorModule, HttpConte
 export type { ManagedUser } from "./auth.js";
 export { CredentialCache, CREDENTIAL_SIGNING_SECRET_ENV, clearCredentialCacheForTests, createCredentialsProvider, } from "./credentials.js";
 export type { CredentialDeps, CredentialForOptions, CredentialsProvider, } from "./credentials.js";
-export { buildRuntimeIdentity, memoryIdentitySegments, memoryNamespace, memoryNamespaceFor, sanitizeConfigurable, } from "./identity-runtime.js";
+export { buildRuntimeIdentity, memoryHubRepoHandle, memoryIdentitySegments, memoryNamespace, memoryNamespaceFor, resolveRuntimeConfigurable, sanitizeConfigurable, sanitizeHubRepoSegment, sanitizeMemoryPathSegment, setAmbientConfigurableForTests, } from "./identity-runtime.js";
 export { managedRuntimeOverrides, withManagedRuntime, wrapToolsWithManagedRuntime, } from "./managed-tools.js";
 export type { InvokableTool, ManagedDeepAgentRuntime, ManagedRuntimeExtras, } from "./managed-tools.js";
 export { withManagedMiddleware, wrapMiddlewareWithManagedRuntime, } from "./managed-middleware.js";
 export type { ManagedMiddleware } from "./managed-middleware.js";
+export { ensureIdentityMemorySlice, ensureLocalMemorySlice, } from "./memory/index.js";
 export { issueGuestToken } from "./validated-token.js";
 /**
  * Compile a {@link DeepAgentDefinition} into a runnable Deep Agent.

package/dist/runtime/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAWvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAExE,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,yBAAyB,EACzB,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EACL,eAAe,EACf,6BAA6B,EAC7B,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,aAAa,EACb,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,gCAAgC,GACjC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAgGvD;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,mBAAmB,EAC/B,MAAM,CAAC,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2YA4F9B;AAED,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAC9C,mBAAmB,EACnB,aAAa,GAAG,eAAe,GAAG,WAAW,GAAG,SAAS,CAC1D;IACC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,mBAAmB,EAC/B,MAAM,CAAC,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2YAe7B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAuBvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAExE,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,yBAAyB,EACzB,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EACL,eAAe,EACf,6BAA6B,EAC7B,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,0BAA0B,EAC1B,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,aAAa,EACb,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,gCAAgC,GACjC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EACL,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAgGvD;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,mBAAmB,EAC/B,MAAM,CAAC,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2YAoK9B;AAED,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAC9C,mBAAmB,EACnB,aAAa,GAAG,eAAe,GAAG,WAAW,GAAG,SAAS,CAC1D;IACC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,mBAAmB,EAC/B,MAAM,CAAC,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2YAe7B"}