managed-deepagents 0.5.0-dev.78 → 0.5.0-dev.80

package/dist/identity/types.d.ts

@@ -7,7 +7,7 @@
 import type { IdentityConnectProvider } from "./connect-provider-types.js";
 export type { IdentityConnectProvider } from "./connect-provider-types.js";
 /** How MDA learns who is calling on the HTTP ingress path. */
-export type HttpIngress = "trusted_backend" | ValidatedTokenIngress;
+export type HttpIngress = "backend" | ValidatedTokenIngress;
 /**
  * Browser-direct ingress: MDA verifies the caller's own IdP token server-side
  * and derives identity from its claims.
@@ -83,18 +83,30 @@ export interface ValidatedTokenProvider {
         issue: boolean;
         /** Token lifetime, e.g. "24h". */
         ttl?: string;
-        /** Prefix applied to the generated actor id, e.g. "guest:". */
-        actorPrefix?: string;
+        /** Prefix applied to the generated user id, e.g. "guest:". */
+        userPrefix?: string;
     };
     /** Maps verified token claims → identity envelope fields. */
-    claims: {
-        /** Claim used as `runtime.identity.actor.id` (e.g. "sub", "email"). */
-        actor: string;
-        /** Claim used as `runtime.identity.tenant.id` (e.g. "org_id"). */
-        tenant?: string;
-        /** Claim used as `runtime.identity.actor.email`. */
-        email?: string;
-    };
+    claims: ClaimMapping;
+}
+/**
+ * Which verified token claim supplies each identity envelope field.
+ *
+ * `user` is required; `defineIdentity` rejects a provider that omits it.
+ */
+export interface ClaimMapping {
+    /** Claim used as `runtime.identity.user.id` (e.g. "sub", "email"). */
+    user?: string;
+    /** Claim used as `runtime.identity.organization.id` (e.g. "org_id"). */
+    organization?: string;
+    /**
+     * Claim carrying every group the caller belongs to. Accepts a JSON array, or a
+     * comma/space-delimited string. Read by tools for authorization; never an
+     * isolation key (see `organization` for that).
+     */
+    groups?: string;
+    /** Claim used as `runtime.identity.user.email`. */
+    email?: string;
 }
 /** Which downstream call needs a credential right now. */
 export interface CredentialTarget {
@@ -113,19 +125,26 @@ export interface CredentialTarget {
 export interface ResolvedCredential {
     /** Headers MDA attaches to the downstream call (usually Authorization). */
     headers: Record<string, string>;
-    /** ISO expiry; MDA caches per (actor, tenant, target) until then. */
+    /** ISO expiry; MDA caches per (user, organization, target) until then. */
     expiresAt?: string;
 }
 /** The frozen identity envelope tools and middleware see. */
 export interface RuntimeIdentity {
-    actor: {
-        type: "user" | "service";
+    /** The caller. `kind: "service"` for machine callers (schedules, channels, Studio). */
+    user: {
+        kind: "person" | "service";
         id: string;
         email?: string;
     };
-    tenant?: {
+    /** The organization this run is scoped to, when the caller presents one. */
+    organization?: {
         id: string;
     };
+    /**
+     * Every group the caller's token asserts. For authorization decisions in tools
+     * and middleware — isolation is keyed on {@link RuntimeIdentity.organization}.
+     */
+    groups?: readonly string[];
     source: {
         /**
          * Ingress source. Built-ins include `http`, `schedule`, `cli`, `studio`,
@@ -142,35 +161,61 @@ export type CredentialResolver = (args: {
     target: CredentialTarget;
 }) => Promise<ResolvedCredential>;
 /**
- * Provide this (with `scoping.credentials: "custom"`) to mint your own
- * downstream credentials per actor: an in-process callback or a hosted
- * token-exchange endpoint.
+ * Connect-with-X routes a credential resolver depends on.
+ *
+ * A resolver that reads per-user OAuth tokens needs somewhere for the user to
+ * grant them. Declaring the provider here lets `defineIdentity` mount the routes
+ * from the resolver, instead of asking authors to repeat themselves on
+ * `connect`.
  */
-export type CredentialResolverConfig = {
+export interface CredentialConnectRequirements {
+    connect?: IdentityConnectProvider[];
+}
+/**
+ * Provide this to mint your own downstream credentials per caller: an in-process
+ * callback or a hosted token-exchange endpoint. Providing it puts the
+ * credentials axis in custom mode.
+ */
+export type CredentialResolverConfig = ({
     resolve: CredentialResolver;
-} | {
+} & CredentialConnectRequirements) | ({
     endpoint: {
         url: string;
     };
-};
-/** The tenant boundary. */
-export type Tenancy = "single" | "multi";
+} & CredentialConnectRequirements);
+/**
+ * One resolver per downstream platform, keyed by {@link CredentialTarget.name}.
+ *
+ * Use this instead of a single resolver when an agent integrates more than one
+ * platform. MDA dispatches on the target name, so each entry stays a focused
+ * config (and keeps declaring its own Connect-with-X routes) rather than being
+ * folded into a hand-written switch.
+ */
+export type CredentialResolvers = Record<string, CredentialResolverConfig>;
+/** Whether every caller must present an organization. */
+export type OrganizationRequirement = "optional" | "required";
 /** Who can open/resume the conversation. */
-export type ThreadScope = "actor" | "channel" | "tenant";
+export type ThreadScope = "user" | "conversation" | "organization";
 /** The durable Store namespace prefix. */
-export type MemoryScope = "actor" | "tenant" | "agent" | "none";
+export type MemoryScope = "user" | "organization" | "agent" | "none";
 /** Whose token downstream calls carry. */
-export type CredentialScope = "agent" | "actor" | "none" | "custom";
-/** The whole identity config surface. */
+export type CredentialScope = "user" | "agent" | "none" | "custom";
+/**
+ * The resolved identity contract the runtime reads.
+ *
+ * `defineIdentity` derives this from {@link IdentityOptions}; it is not an
+ * authoring surface. Its vocabulary matches the authoring vocabulary exactly, so
+ * a value you read while debugging is the value you wrote.
+ */
 export interface IdentityConfig {
     /** How MDA learns who is calling. */
     ingress: {
         http: HttpIngress;
     };
-    /** The tenant boundary. */
-    tenancy: Tenancy;
-    /** The three scoping axes. */
-    scoping: {
+    /** Whether every caller must present an organization. */
+    organizations: OrganizationRequirement;
+    /** The three isolation axes. */
+    scope: {
         /** Who can open/resume the conversation. */
         threads?: ThreadScope;
         /** Durable Store namespace prefix. */
@@ -178,10 +223,13 @@ export interface IdentityConfig {
         /** Managed mode, or "custom" when a resolver/endpoint is provided below. */
         credentials?: CredentialScope;
     };
-    /** Present when `scoping.credentials` is "custom" (or a resolver is set). */
-    credentials?: CredentialResolverConfig;
     /**
-     * Opt-in Connect-with-X providers (`github.connect()`, `slack.connect()`, …).
+     * Present when `scope.credentials` is "custom" (or a resolver is set).
+     * Either one resolver for every target, or one per target name.
+     */
+    credentials?: CredentialResolverConfig | CredentialResolvers;
+    /**
+     * Opt-in Connect-with-X providers (`connect.github()`, `connect.slack()`, …).
      * Only listed providers mount `/identity/{id}/…` routes.
      */
     connect?: IdentityConnectProvider[];
@@ -191,6 +239,4 @@ export interface IdentityDefinition {
     readonly kind: "identity";
     readonly config: IdentityConfig;
 }
-/** The archetype presets that expand to a full {@link IdentityConfig}. */
-export type IdentityPresetName = "private-assistant" | "multi-tenant-saas" | "shared-bot" | "internal-tool" | "service";
 //# sourceMappingURL=types.d.ts.map

package/dist/identity/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,YAAY,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GAAG,iBAAiB,GAAG,qBAAqB,CAAC;AAEpE;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,iFAAiF;IACjF,KAAK,CAAC,EAAE;QACN,sDAAsD;QACtD,KAAK,EAAE,OAAO,CAAC;QACf,kCAAkC;QAClC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,+DAA+D;QAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE;QACN,uEAAuE;QACvE,KAAK,EAAE,MAAM,CAAC;QACd,kEAAkE;QAClE,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,oDAAoD;QACpD,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B;IAC5B,IAAI,EAAE,UAAU,GAAG,KAAK,GAAG,YAAY,GAAG,WAAW,CAAC;IACtD,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,MAAM,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,MAAM,EAAE;QACN;;;WAGG;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,uCAAuC;AACvC,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE;IACtC,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAElC;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAC/B;IAAE,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAElC,2BAA2B;AAC3B,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEzC,4CAA4C;AAC5C,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;AACzD,0CAA0C;AAC1C,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAChE,0CAA0C;AAC1C,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEpE,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF,2BAA2B;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,OAAO,EAAE;QACP,4CAA4C;QAC5C,OAAO,CAAC,EAAE,WAAW,CAAC;QACtB,sCAAsC;QACtC,MAAM,EAAE,WAAW,CAAC;QACpB,4EAA4E;QAC5E,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;IACF,6EAA6E;IAC7E,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC;;;OAGG;IACH,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAED,0EAA0E;AAC1E,MAAM,MAAM,kBAAkB,GAC1B,mBAAmB,GACnB,mBAAmB,GACnB,YAAY,GACZ,eAAe,GACf,SAAS,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,YAAY,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAE3E,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,qBAAqB,CAAC;AAE5D;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,iFAAiF;IACjF,KAAK,CAAC,EAAE;QACN,sDAAsD;QACtD,KAAK,EAAE,OAAO,CAAC;QACf,kCAAkC;QAClC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,8DAA8D;QAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B;IAC5B,IAAI,EAAE,UAAU,GAAG,KAAK,GAAG,YAAY,GAAG,WAAW,CAAC;IACtD,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,IAAI,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,4EAA4E;IAC5E,YAAY,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN;;;WAGG;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,uCAAuC;AACvC,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE;IACtC,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAChC,CAAC;IAAE,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAAG,6BAA6B,CAAC,GACjE,CAAC;IAAE,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,6BAA6B,CAAC,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AAE3E,yDAAyD;AACzD,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,UAAU,CAAC;AAE9D,4CAA4C;AAC5C,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,cAAc,GAAG,cAAc,CAAC;AACnE,0CAA0C;AAC1C,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,cAAc,GAAG,OAAO,GAAG,MAAM,CAAC;AACrE,0CAA0C;AAC1C,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF,yDAAyD;IACzD,aAAa,EAAE,uBAAuB,CAAC;IACvC,gCAAgC;IAChC,KAAK,EAAE;QACL,4CAA4C;QAC5C,OAAO,CAAC,EAAE,WAAW,CAAC;QACtB,sCAAsC;QACtC,MAAM,EAAE,WAAW,CAAC;QACpB,4EAA4E;QAC5E,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;IACF;;;OAGG;IACH,WAAW,CAAC,EAAE,wBAAwB,GAAG,mBAAmB,CAAC;IAC7D;;;OAGG;IACH,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC"}

package/dist/index.d.ts

@@ -1,26 +1,16 @@
 export { defineDeepAgent } from "./define-deep-agent.js";
-export { defineMcpServers } from "./connectors/mcp/index.js";
-export * as github from "./connectors/github/index.js";
-export * as slack from "./identity/slack/index.js";
-export * as langsmith from "./connectors/langsmith/index.js";
-export type { GitHubCheckoutReuse, GitHubConnector, GitHubConnectorConfig, GitHubRepositoryCheckout, } from "./connectors/github/index.js";
-export type { LangSmithCapability, LangSmithCallerSurface, LangSmithCapabilityScope, LangSmithConnector, LangSmithConnectorConfig, LangSmithResource, LangSmithResponseShape, } from "./connectors/langsmith/index.js";
 export { defineSchedule } from "./schedules.js";
-export { defineSandbox } from "./sandbox.js";
-export { defineIdentity, providers, validateIdentity, } from "./identity/index.js";
-export { defineSlackChannel } from "./channels/slack/index.js";
-export { defineGitHubChannel } from "./channels/github/index.js";
-export { CHANNEL_ERROR_CODES, ChannelError, createRuntimeChannel, normalizeChannelDestination, } from "./channels/index.js";
-export { decodeSlackSourceThreadKey, encodeSlackSourceThreadKey, normalizeSlackEvent, requiredSlackScopes, toChannelManifest, verifySlackRequest, } from "./channels/slack/index.js";
-export { toGitHubChannelManifest, verifyGitHubWebhookSignature, normalizeGitHubEvent, } from "./channels/github/index.js";
-export type { CredentialResolver, CredentialResolverConfig, CredentialScope, CredentialTarget, DefineIdentity, GitHubActorTokenArgs, GitHubAppJwtArgs, GitHubCredentialsOptions, GitHubTokenSource, HttpIngress, IdentityConfig, IdentityConnectProvider, IdentityDefinition, IdentityPresetName, MemoryScope, ResolvedCredential, RuntimeIdentity, Tenancy, ThreadScope, ValidatedTokenIngress, ValidatedTokenProvider, } from "./identity/index.js";
-export type { HttpMcpServerConfig, McpServersConfig, McpServersDefinition, McpToolSelectionConfig, RemoteMcpServerBaseConfig, RemoteMcpServerConfig, SseMcpServerConfig, } from "./connectors/mcp/index.js";
-export { CONNECTOR_BRAND, isConnector } from "./runtime/connector.js";
-export type { Connector, ConnectorSandboxBackend, ConnectorToolList, HttpContext, SandboxContext, ToolContext, } from "./runtime/connector.js";
-export type { ScheduleConfig, ScheduleDefinition, ScheduleDeliveryTarget, ScheduleThreadConfig, } from "./schedules.js";
-export type { ChannelAddress, ChannelCapabilities, ChannelDestination, ChannelErrorCode, ChannelEvent, ChannelMessage, ChannelMessageUpdate, PostedChannelMessage, RuntimeChannel, } from "./channels/index.js";
-export type { ChannelManifest, SlackChannelConfig, SlackChannelDefinition, SlackChannelTrigger, } from "./channels/slack/index.js";
+export { defineIdentity } from "./identity/index.js";
+export { auth, connect, connectors, credentials, sandboxes, } from "./namespaces.js";
 export type { DeepAgentDefinition, DefineDeepAgentConfig, ManagedDeepAgentKey, } from "./types.js";
+export type { ScheduleConfig, ScheduleDefinition, ScheduleDeliveryTarget, ScheduleThreadConfig, } from "./schedules.js";
+export type { ClaimMapping, CredentialConnectRequirements, CredentialResolver, CredentialResolverConfig, CredentialResolvers, CredentialScope, CredentialTarget, GitHubAppJwtArgs, GitHubCredentialsOptions, GitHubTokenSource, GitHubUserTokenArgs, HttpIngress, IdentityAuth, IdentityConfig, IdentityConnectProvider, IdentityDefinition, IdentityOptions, IdentityScope, IdentityScopeOverrides, MemoryScope, OrganizationRequirement, ResolvedCredential, RuntimeIdentity, ThreadScope, ValidatedTokenIngress, ValidatedTokenProvider, } from "./identity/index.js";
+export type { GitHubCheckoutReuse, GitHubConnector, GitHubConnectorConfig, GitHubRepositoryCheckout, } from "./connectors/github/index.js";
+export type { LangSmithCallerSurface, LangSmithCapability, LangSmithCapabilityScope, LangSmithConnector, LangSmithConnectorConfig, LangSmithResource, LangSmithResponseShape, } from "./connectors/langsmith/index.js";
+export type { HttpMcpServerConfig, McpServersConfig, McpServersDefinition, McpToolSelectionConfig, RemoteMcpServerBaseConfig, RemoteMcpServerConfig, SseMcpServerConfig, } from "./connectors/mcp/index.js";
+export type { ToolServerConnector, ToolServerConnectorConfig, ToolServerConnectorFactory, ToolServerFactoryName, ToolServerIntegrationEntry, ToolServerSlug, ToolServerToolSelection, } from "./connectors/toolserver/index.js";
+export type { ChannelManifest, RequiredSlackConnectorConfig, SlackAppConfig, SlackChannelFilters, SlackChannelTrigger, SlackConnector, SlackConnectorConfig, SlackConversationPolicy, SlackMentionBehavior, } from "./connectors/slack/index.js";
+export type { GitHubChannelConfig, GitHubChannelDefinition, GitHubChannelHandler, GitHubChannelTrigger, GitHubWebhookPromptEvent, } from "./connectors/github/define.js";
+export type { LangSmithSandboxOptions, SandboxDefinition, SandboxScope, } from "./sandbox.js";
 export type { ManagedDeepAgentRuntime, ManagedRuntimeExtras, } from "./runtime/managed-tools.js";
-export type { DefineSandboxOptions, ManagedSandboxOptionKey, SandboxDefinition, SandboxProviderClass, SandboxProviderOptions, SandboxScope, } from "./sandbox.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,8BAA8B,CAAC;AACvD,OAAO,KAAK,KAAK,MAAM,2BAA2B,CAAC;AACnD,OAAO,KAAK,SAAS,MAAM,iCAAiC,CAAC;AAC7D,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,SAAS,EACT,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,OAAO,EACP,WAAW,EACX,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACtE,YAAY,EACV,SAAS,EACT,uBAAuB,EACvB,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,WAAW,GACZ,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,GACb,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EACL,IAAI,EACJ,OAAO,EACP,UAAU,EACV,WAAW,EACX,SAAS,GACV,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,YAAY,EACZ,6BAA6B,EAC7B,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,YAAY,EACZ,cAAc,EACd,uBAAuB,EACvB,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,WAAW,EACX,uBAAuB,EACvB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,EAC1B,cAAc,EACd,uBAAuB,GACxB,MAAM,kCAAkC,CAAC;AAE1C,YAAY,EACV,eAAe,EACf,4BAA4B,EAC5B,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AAEvC,YAAY,EACV,uBAAuB,EACvB,iBAAiB,EACjB,YAAY,GACb,MAAM,cAAc,CAAC;AAEtB,YAAY,EACV,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -1,15 +1,5 @@
 export { defineDeepAgent } from "./define-deep-agent.js";
-export { defineMcpServers } from "./connectors/mcp/index.js";
-export * as github from "./connectors/github/index.js";
-export * as slack from "./identity/slack/index.js";
-export * as langsmith from "./connectors/langsmith/index.js";
 export { defineSchedule } from "./schedules.js";
-export { defineSandbox } from "./sandbox.js";
-export { defineIdentity, providers, validateIdentity, } from "./identity/index.js";
-export { defineSlackChannel } from "./channels/slack/index.js";
-export { defineGitHubChannel } from "./channels/github/index.js";
-export { CHANNEL_ERROR_CODES, ChannelError, createRuntimeChannel, normalizeChannelDestination, } from "./channels/index.js";
-export { decodeSlackSourceThreadKey, encodeSlackSourceThreadKey, normalizeSlackEvent, requiredSlackScopes, toChannelManifest, verifySlackRequest, } from "./channels/slack/index.js";
-export { toGitHubChannelManifest, verifyGitHubWebhookSignature, normalizeGitHubEvent, } from "./channels/github/index.js";
-export { CONNECTOR_BRAND, isConnector } from "./runtime/connector.js";
+export { defineIdentity } from "./identity/index.js";
+export { auth, connect, connectors, credentials, sandboxes, } from "./namespaces.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,8BAA8B,CAAC;AACvD,OAAO,KAAK,KAAK,MAAM,2BAA2B,CAAC;AACnD,OAAO,KAAK,SAAS,MAAM,iCAAiC,CAAC;AAgB7D,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,SAAS,EACT,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAoCpC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EACL,IAAI,EACJ,OAAO,EACP,UAAU,EACV,WAAW,EACX,SAAS,GACV,MAAM,iBAAiB,CAAC"}

package/dist/ingress/index.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Managed ingress pipeline: verified inbound event → agent run.
+ *
+ * Providers keep signature verification, event normalization, and reply
+ * transport. This module owns the shared pieces: deterministic thread ids,
+ * trusted loopback invoke with source-provider stamps, and source-thread
+ * existence probes.
+ */
+import { type ChannelBinding } from "../channels/binding.js";
+/** Inputs for the source-thread involvement probe (after identity remap). */
+export interface SourceThreadExistsInput {
+    sourceThreadKey: string;
+    userId: string;
+    organizationId?: string;
+}
+export interface InvokeIngressAgentInput {
+    userId: string;
+    organizationId?: string;
+    sourceThreadKey: string;
+    binding: ChannelBinding;
+    text: string;
+    assistantId: string;
+    /** Trusted source provider stamped on loopback invoke. */
+    sourceProvider?: ChannelBinding["provider"];
+}
+export interface InvokeIngressAgentResult {
+    replyText: string;
+    runId?: string;
+    threadId: string;
+}
+/**
+ * Schedule background work after the provider ACK. Defaults to fire-and-forget
+ * with error logging; tests pass an inline runner.
+ */
+export declare function scheduleIngressWork(work: () => Promise<void>, options: {
+    label: string;
+    schedule?: (work: () => Promise<void>) => void;
+}): void;
+/**
+ * True when an MDA thread already exists for this source-thread key.
+ *
+ * Call with the **resolved** actor (post identity remap) so ownership matches
+ * the thread created on the first run.
+ */
+export declare function ingressSourceThreadExists(input: SourceThreadExistsInput): Promise<boolean>;
+/**
+ * Invoke the managed graph over a trusted loopback with ingress identity stamped.
+ *
+ * Only this path may set `x-mda-source-provider` / `x-mda-source-thread-id`.
+ */
+export declare function invokeIngressAgent(input: InvokeIngressAgentInput): Promise<InvokeIngressAgentResult>;
+/** Deterministic LangGraph thread id from a provider source-thread key. */
+export declare function stableThreadId(sourceThreadKey: string): string;
+//# sourceMappingURL=index.d.ts.map

package/dist/ingress/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ingress/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAehC,6EAA6E;AAC7E,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,cAAc,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EACzB,OAAO,EAAE;IACP,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;CAChD,GACA,IAAI,CASN;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CAgDnC;AA2BD,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAS9D"}

package/dist/ingress/index.js

@@ -0,0 +1,128 @@
+/**
+ * Managed ingress pipeline: verified inbound event → agent run.
+ *
+ * Providers keep signature verification, event normalization, and reply
+ * transport. This module owns the shared pieces: deterministic thread ids,
+ * trusted loopback invoke with source-provider stamps, and source-thread
+ * existence probes.
+ */
+import { createHash } from "node:crypto";
+import { Client } from "@langchain/langgraph-sdk";
+import { extractAssistantText } from "../channels/assistant-text.js";
+import { CHANNEL_BINDING_KEY, } from "../channels/binding.js";
+import { ChannelError } from "../channels/errors.js";
+import { resolveLoopbackApiKey, resolveLoopbackApiUrl, } from "../identity/loopback.js";
+import { USER_HEADER, INGRESS_SECRET_ENV, INGRESS_SECRET_HEADER, SOURCE_PROVIDER_HEADER, SOURCE_THREAD_HEADER, ORGANIZATION_HEADER, } from "../runtime/auth.js";
+/**
+ * Schedule background work after the provider ACK. Defaults to fire-and-forget
+ * with error logging; tests pass an inline runner.
+ */
+export function scheduleIngressWork(work, options) {
+    const schedule = options.schedule ??
+        ((fn) => {
+            fn().catch((error) => {
+                console.error(`[mda] ${options.label} failed:`, error);
+            });
+        });
+    schedule(work);
+}
+/**
+ * True when an MDA thread already exists for this source-thread key.
+ *
+ * Call with the **resolved** actor (post identity remap) so ownership matches
+ * the thread created on the first run.
+ */
+export async function ingressSourceThreadExists(input) {
+    const ingressSecret = process.env[INGRESS_SECRET_ENV];
+    if (!ingressSecret) {
+        return false;
+    }
+    const client = createIngressLoopbackClient({
+        userId: input.userId,
+        organizationId: input.organizationId,
+        sourceThreadKey: input.sourceThreadKey,
+        ingressSecret,
+    });
+    const threadId = stableThreadId(input.sourceThreadKey);
+    try {
+        await client.threads.get(threadId);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Invoke the managed graph over a trusted loopback with ingress identity stamped.
+ *
+ * Only this path may set `x-mda-source-provider` / `x-mda-source-thread-id`.
+ */
+export async function invokeIngressAgent(input) {
+    const ingressSecret = process.env[INGRESS_SECRET_ENV];
+    if (!ingressSecret) {
+        throw new ChannelError("channel_run_failed", "MDA_INGRESS_SECRET is required for channel agent invocation");
+    }
+    const client = createIngressLoopbackClient({
+        userId: input.userId,
+        organizationId: input.organizationId,
+        sourceThreadKey: input.sourceThreadKey,
+        ingressSecret,
+        sourceProvider: input.sourceProvider ?? input.binding.provider,
+    });
+    const threadId = stableThreadId(input.sourceThreadKey);
+    try {
+        await client.threads.create({
+            threadId,
+            metadata: { owner: input.sourceThreadKey },
+            ifExists: "do_nothing",
+        });
+    }
+    catch {
+        // Some SDK versions use different ifExists semantics; continue and let run fail loudly.
+    }
+    const run = (await client.runs.wait(threadId, input.assistantId, {
+        input: {
+            messages: [{ role: "human", content: input.text }],
+        },
+        config: {
+            configurable: {
+                [CHANNEL_BINDING_KEY]: input.binding,
+            },
+        },
+    }));
+    return {
+        replyText: extractAssistantText(run),
+        runId: run.runId ?? run.run_id,
+        threadId,
+    };
+}
+function createIngressLoopbackClient(input) {
+    const apiUrl = resolveLoopbackApiUrl();
+    const apiKey = resolveLoopbackApiKey();
+    const headers = {
+        [INGRESS_SECRET_HEADER]: input.ingressSecret,
+        [USER_HEADER]: input.userId,
+        [SOURCE_PROVIDER_HEADER]: input.sourceProvider ?? "slack",
+        [SOURCE_THREAD_HEADER]: input.sourceThreadKey,
+    };
+    if (input.organizationId) {
+        headers[ORGANIZATION_HEADER] = input.organizationId;
+    }
+    return new Client({
+        apiUrl,
+        apiKey,
+        defaultHeaders: headers,
+    });
+}
+/** Deterministic LangGraph thread id from a provider source-thread key. */
+export function stableThreadId(sourceThreadKey) {
+    const hex = createHash("sha256").update(sourceThreadKey).digest("hex");
+    return [
+        hex.slice(0, 8),
+        hex.slice(8, 12),
+        `5${hex.slice(13, 16)}`,
+        `a${hex.slice(17, 20)}`,
+        hex.slice(20, 32),
+    ].join("-");
+}
+//# sourceMappingURL=index.js.map

package/dist/ingress/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ingress/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAElD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EACL,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EACL,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AA0B5B;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAyB,EACzB,OAGC;IAED,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ;QAChB,CAAC,CAAC,EAAE,EAAE,EAAE;YACN,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC5B,OAAO,CAAC,KAAK,CAAC,SAAS,OAAO,CAAC,KAAK,UAAU,EAAE,KAAK,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,QAAQ,CAAC,IAAI,CAAC,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAA8B;IAE9B,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACtD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,aAAa;KACd,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA8B;IAE9B,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACtD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,aAAa;QACb,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ;KAC/D,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1B,QAAQ;YACR,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,eAAe,EAAE;YAC1C,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;IAC1F,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE;QAC/D,KAAK,EAAE;YACL,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SACnD;QACD,MAAM,EAAE;YACN,YAAY,EAAE;gBACZ,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,OAAO;aACrC;SACF;KACF,CAAC,CAID,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC;QACpC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM;QAC9B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,KAMpC;IACC,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,MAAM,OAAO,GAA2B;QACtC,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,aAAa;QAC5C,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM;QAC3B,CAAC,sBAAsB,CAAC,EAAE,KAAK,CAAC,cAAc,IAAI,OAAO;QACzD,CAAC,oBAAoB,CAAC,EAAE,KAAK,CAAC,eAAe;KAC9C,CAAC;IACF,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,OAAO,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,MAAM,CAAC;QAChB,MAAM;QACN,MAAM;QACN,cAAc,EAAE,OAAO;KACxB,CAAC,CAAC;AACL,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAAC,eAAuB;IACpD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE;QACvB,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE;QACvB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;KAClB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC"}

package/dist/namespaces.d.ts

@@ -0,0 +1,76 @@
+/**
+ * The first-party primitive namespaces.
+ *
+ * Every provider an agent project can select is reached the same way —
+ * `<primitive>.<provider>(...)` — so the primitive is obvious at the call site
+ * and providers can be added without growing the barrel:
+ *
+ * ```ts
+ * connectors.slack({ on: ["app_mention"] });
+ * connectors.github({
+ *   repositories: [{ repo: "acme/api", path: "api" }],
+ *   events: [{ on: "pull_request.opened", prompt: () => "review" }],
+ * });
+ * sandboxes.langsmith({ defaultTimeout: 600 });
+ * auth.supabase({ projectRef: "abc" });
+ * credentials.github({ read: ["user"] });
+ * connect.github();
+ * ```
+ *
+ * These are the only primitives the managed runtime will mount. A project
+ * cannot contribute its own — `defineExtension` stays internal.
+ */
+import { LangSmithSandbox } from "deepagents";
+import { type GitHubConnector, type GitHubConnectorConfig } from "./connectors/github/index.js";
+import { annotationQueues, chatFeedback, examples, feedback, prompts, runs, threads, traceViewer, type LangSmithConnector, type LangSmithConnectorConfig } from "./connectors/langsmith/index.js";
+import { type McpServersConfig, type McpServersDefinition } from "./connectors/mcp/index.js";
+import { type SlackConnector, type SlackConnectorConfig } from "./connectors/slack/index.js";
+import { type ToolServerConnectorFactory, type ToolServerFactoryName } from "./connectors/toolserver/index.js";
+import { connect as githubConnect } from "./identity/github/connect-http.js";
+import { credentials as githubCredentials } from "./identity/github/credentials.js";
+import { connect as slackConnect } from "./identity/slack/connect-http.js";
+import { type LangSmithSandboxOptions, type SandboxDefinition } from "./sandbox.js";
+export { auth } from "./identity/index.js";
+/** Execution environments the agent's shell runs in. Exported from `sandbox/`. */
+export declare const sandboxes: {
+    langsmith(options?: LangSmithSandboxOptions): SandboxDefinition<typeof LangSmithSandbox>;
+};
+/**
+ * Integrations: tools, HTTP routes, sandbox provisioning, inbound events, and
+ * named messaging. Exported from `connectors/*`.
+ *
+ * Most entries are the LangSmith tool server's built-in integrations —
+ * `connectors.gmail`, `connectors.linear`, `connectors.googleSheets`, … — whose
+ * tools resolve against the connection the workspace already manages in
+ * LangSmith. They are spread from the catalog so adding an integration is one
+ * entry there rather than a line here as well. GitHub and Slack are first-class
+ * connectors that may also contribute sandbox / Events / messaging.
+ *
+ * `langsmith` doubles as the namespace for its capability builders, so a
+ * project selects grants without a second import.
+ */
+export declare const connectors: Record<ToolServerFactoryName, ToolServerConnectorFactory> & {
+    mcp(config: McpServersConfig): McpServersDefinition;
+    github(config?: GitHubConnectorConfig): GitHubConnector;
+    slack(config?: SlackConnectorConfig): SlackConnector;
+    langsmith: ((config: LangSmithConnectorConfig) => LangSmithConnector) & {
+        runs: typeof runs;
+        feedback: typeof feedback;
+        examples: typeof examples;
+        annotationQueues: typeof annotationQueues;
+        prompts: typeof prompts;
+        threads: typeof threads;
+        chatFeedback: typeof chatFeedback;
+        traceViewer: typeof traceViewer;
+    };
+};
+/** Third-party token resolvers. Composed into `defineIdentity({ credentials })`. */
+export declare const credentials: {
+    github: typeof githubCredentials;
+};
+/** Caller-initiated OAuth links. Composed into `defineIdentity({ connect })`. */
+export declare const connect: {
+    github: typeof githubConnect;
+    slack: typeof slackConnect;
+};
+//# sourceMappingURL=namespaces.d.ts.map

package/dist/namespaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespaces.d.ts","sourceRoot":"","sources":["../src/namespaces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACR,QAAQ,EAER,OAAO,EACP,IAAI,EACJ,OAAO,EACP,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC3B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,WAAW,IAAI,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAW3C,kFAAkF;AAClF,eAAO,MAAM,SAAS;IACpB,SAAS,WACG,uBAAuB,GAChC,iBAAiB,CAAC,OAAO,gBAAgB,CAAC;CAG9C,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,UAAU,EAAE,MAAM,CAC7B,qBAAqB,EACrB,0BAA0B,CAC3B,GAAG;IACF,GAAG,CAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,CAAC;IACpD,MAAM,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAAC;IACxD,KAAK,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,cAAc,CAAC;IACrD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,wBAAwB,KAAK,kBAAkB,CAAC,GAAG;QACtE,IAAI,EAAE,OAAO,IAAI,CAAC;QAClB,QAAQ,EAAE,OAAO,QAAQ,CAAC;QAC1B,QAAQ,EAAE,OAAO,QAAQ,CAAC;QAC1B,gBAAgB,EAAE,OAAO,gBAAgB,CAAC;QAC1C,OAAO,EAAE,OAAO,OAAO,CAAC;QACxB,OAAO,EAAE,OAAO,OAAO,CAAC;QACxB,YAAY,EAAE,OAAO,YAAY,CAAC;QAClC,WAAW,EAAE,OAAO,WAAW,CAAC;KACjC,CAAC;CA0BH,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,WAAW;IACtB,MAAM;CACP,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,OAAO;IAClB,MAAM;IACN,KAAK;CACN,CAAC"}