managed-deepagents 0.6.2-dev.5 → 0.6.2-dev.50

package/dist/identity/types.d.ts

@@ -86,22 +86,96 @@ export interface ValidatedTokenProvider {
     claims: ClaimMapping;
 }
 /**
- * Which verified token claim supplies each identity envelope field.
+ * Which verified token claim supplies each principal field.
  *
  * `user` is required; `defineIdentity` rejects a provider that omits it.
  */
 export interface ClaimMapping {
-    /** Claim used as `runtime.identity.user.id` (e.g. "sub", "email"). */
+    /** Claim used as `runtime.serverInfo.principal.id` (e.g. "sub", "email"). */
     user?: string;
     /**
      * Claim carrying every group the caller belongs to. Accepts a JSON array, or a
-     * comma/space-delimited string. Read by tools for authorization.
+     * comma/space-delimited string. Folded into `principal.claims.groups`.
      */
     groups?: string;
-    /** Claim used as `runtime.identity.user.email`. */
+    /** Claim folded into `principal.claims.email`. */
     email?: string;
 }
-/** The frozen identity envelope tools and middleware see. */
+/**
+ * Agent Auth–aligned identity types for the current run.
+ *
+ * Author surface on LangGraph `serverInfo` (flattened, no nested envelope bag):
+ * `runtime.serverInfo.principal` / `.subject` / `.link`. Reassemble into
+ * {@link PrincipalEnvelope} when calling Agent Auth mint.
+ *
+ * Fields MDA cannot yet fill use conservative defaults
+ * (`link.status: "not_required"`, `subject.agent_id: ""`).
+ */
+export type PrincipalKind = "person" | "service" | "channel";
+export type SubjectAuthority = "agent" | "user";
+export type LinkStatus = "not_required" | "linked" | "unlinked" | "pending";
+/**
+ * The caller's claim bag.
+ *
+ * Mostly the verified token payload, passed through as the IdP sent it. The two
+ * claims MDA gives a name to are normalized before they land here, whether or
+ * not the deployment mapped them in `ClaimMapping`: `groups` is always a string
+ * array (IdPs send arrays or delimited strings), and `email` is always a string.
+ * An unmapped claim of either name that cannot be normalized is dropped rather
+ * than passed through, so the declared type always holds.
+ */
+export interface PrincipalClaims {
+    /** Every group the caller's token asserts. Never a raw delimited string. */
+    groups?: readonly string[];
+    email?: string;
+    [claim: string]: unknown;
+}
+export interface Principal {
+    id: string;
+    kind: PrincipalKind;
+    claims: PrincipalClaims;
+}
+export interface Subject {
+    authority: SubjectAuthority;
+    /**
+     * Deployment / agent id. Omitted when the platform supplied neither an
+     * assistant nor a graph id, so an Agent Auth call fails on a missing field
+     * rather than silently addressing the empty agent.
+     */
+    agent_id?: string;
+    /** Present when `authority === "user"`. */
+    user_id?: string;
+}
+/**
+ * Where the run entered from, as stamped by trusted managed ingress.
+ *
+ * This is MDA's own ingress record, not part of the Agent Auth envelope, so it
+ * sits beside `principal` on `serverInfo` instead of inside it.
+ */
+export interface IdentitySource {
+    /**
+     * Ingress source. Built-ins include `http`, `schedule`, `cli`, `studio`,
+     * plus channel providers (`slack`, `github`, or any registered plugin key).
+     */
+    provider: string;
+    threadId?: string;
+}
+export interface Link {
+    status: LinkStatus;
+    from?: string;
+    to?: string;
+}
+/** Wire shape for Agent Auth (`principal_envelope` on resolve/mint). */
+export interface PrincipalEnvelope {
+    principal: Principal;
+    subject: Subject;
+    link: Link;
+}
+/**
+ * Frozen identity bag for HTTP connector route handlers
+ * (`resolveRequestIdentity`). Tools/middleware use `serverInfo.principal`
+ * (plus `subject` / `link`) instead.
+ */
 export interface RuntimeIdentity {
     /** The caller. `kind: "service"` for machine callers (schedules, channels, Studio). */
     user: {

package/dist/identity/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GACnB,SAAS,GACT,sBAAsB,GACtB,qBAAqB,CAAC;AAE1B,qEAAqE;AACrE,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,mBAAmB,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,IAAI,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN;;;WAGG;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF;;;OAGG;IACH,KAAK,EAAE;QACL,2EAA2E;QAC3E,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;CACH;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GACnB,SAAS,GACT,sBAAsB,GACtB,qBAAqB,CAAC;AAE1B,qEAAqE;AACrE,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,mBAAmB,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,uDAAuD;QACvD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CACd,MAAM,EACN,MAAM,GAAG;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAC3D,CAAC;QACF,gFAAgF;QAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,2FAA2F;QAC3F,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,6DAA6D;IAC7D,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAC7D,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,MAAM,CAAC;AAChD,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAE5E;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,gBAAgB,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,IAAI;IACnB,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,IAAI,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN;;;WAGG;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;KACnB,CAAC;IACF;;;OAGG;IACH,KAAK,EAAE;QACL,2EAA2E;QAC3E,WAAW,CAAC,EAAE,eAAe,CAAC;KAC/B,CAAC;CACH;AAED,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC"}

package/dist/index.d.ts

@@ -3,6 +3,7 @@ export { defineSchedule } from "./schedules.js";
 export { defineIdentity } from "./identity/index.js";
 export { defineMemory } from "./memory/index.js";
 export { auth, channels } from "./namespaces.js";
+export { connections, CredentialAuthorizationRequiredError, ConnectionNotFoundError, CredentialStoreError, InvalidAgentAuthEndpointError, } from "./connections.js";
 export { defineSandbox } from "./sandbox.js";
 export type { Channels } from "./namespaces.js";
 import { mcpConnector } from "./connectors/mcp/index.js";
@@ -12,8 +13,10 @@ import { mcpConnector } from "./connectors/mcp/index.js";
 export interface Connectors {
     /**
      * Declare remote MCP servers (HTTP/SSE) whose tools load at agent-graph
-     * construction. Stdio servers are not supported. Use static `headers` (or
-     * similar) when the server needs credentials — roll your own auth.
+     * construction. Stdio servers are not supported. A server may name a
+     * connection; in `mda dev`, an agent-owned one resolves from a normalized
+     * `MDA_DEV_*` environment variable instead of the deployment's Agent Auth
+     * secret.
      *
      * @example
      * ```ts
@@ -22,7 +25,7 @@ export interface Connectors {
      *     docs: {
      *       transport: "http",
      *       url: "https://docs.example.com/mcp",
-     *       headers: { Authorization: `Bearer ${process.env.DOCS_TOKEN}` },
+     *       connection: connections.get("docs-token", { type: "agent" }),
      *     },
      *   },
      * });
@@ -34,13 +37,15 @@ export interface Connectors {
 }
 /** Public connectors namespace — MCP only for this release. */
 export declare const connectors: Connectors;
+export type { AgentConnectionOwner, ConnectionOwner, ConnectionRequest, UserConnectionOwner, } from "./connections.js";
 export type { DeepAgentDefinition, DefineDeepAgentConfig, ManagedDeepAgentKey, } from "./types.js";
 export type { ScheduleConfig, ScheduleDefinition, ScheduleDeliveryTarget, ScheduleThreadConfig, } from "./schedules.js";
-export type { ClaimMapping, CredentialScope, HttpIngress, IdentityAuth, IdentityConfig, IdentityDefinition, IdentityOptions, LangSmithApiKeyIngress, RuntimeIdentity, ValidatedTokenIngress, ValidatedTokenProvider, } from "./identity/index.js";
+export type { ClaimMapping, CredentialScope, HttpIngress, IdentityAuth, IdentityConfig, IdentityDefinition, IdentityOptions, IdentitySource, LangSmithApiKeyIngress, Link, LinkStatus, Principal, PrincipalClaims, PrincipalEnvelope, PrincipalKind, RuntimeIdentity, Subject, SubjectAuthority, ValidatedTokenIngress, ValidatedTokenProvider, } from "./identity/index.js";
 export type { MemoryConfig, MemoryDefinition, MemoryOptions, MemoryScope, MemoryScopeInput, MemorySliceInput, MemorySliceKind, ResolvedMemorySlice, } from "./memory/index.js";
-export type { HttpMcpServerConfig, McpServersConfig, McpServersDefinition, McpToolSelectionConfig, RemoteMcpServerBaseConfig, RemoteMcpServerConfig, SseMcpServerConfig, } from "./connectors/mcp/index.js";
+export type { HttpMcpServerConfig, McpServerConnection, McpServersConfig, McpServersDefinition, McpToolSelectionConfig, RemoteMcpServerBaseConfig, RemoteMcpServerConfig, SseMcpServerConfig, } from "./connectors/mcp/index.js";
+export type { CredentialAuthorizationRequiredInterrupt, PendingCredential, } from "./credential-gate.js";
 export type { ChannelManifest } from "./channels/manifest.js";
 export type { RequiredTriggerSlackChannelConfig, SlackChannel, SlackChannelConfig, } from "./channels/slack/index.js";
 export type { SandboxDefinition, SandboxOptions } from "./sandbox.js";
-export type { ManagedDeepAgentRuntime } from "./runtime/managed-tools.js";
+export type { ManagedDeepAgentRuntime, ManagedServerInfo, } from "./runtime/managed-tools.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,GAAG,EAAE,OAAO,YAAY,CAAC;CAC1B;AAED,+DAA+D;AAC/D,eAAO,MAAM,UAAU,EAAE,UAExB,CAAC;AAEF,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,YAAY,EACZ,eAAe,EACf,WAAW,EACX,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,iCAAiC,EACjC,YAAY,EACZ,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEtE,YAAY,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,WAAW,EACX,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,GAAG,EAAE,OAAO,YAAY,CAAC;CAC1B;AAED,+DAA+D;AAC/D,eAAO,MAAM,UAAU,EAAE,UAExB,CAAC;AAEF,YAAY,EACV,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,YAAY,EACZ,eAAe,EACf,WAAW,EACX,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,IAAI,EACJ,UAAU,EACV,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,OAAO,EACP,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,wCAAwC,EACxC,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,iCAAiC,EACjC,YAAY,EACZ,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEtE,YAAY,EACV,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -3,6 +3,7 @@ export { defineSchedule } from "./schedules.js";
 export { defineIdentity } from "./identity/index.js";
 export { defineMemory } from "./memory/index.js";
 export { auth, channels } from "./namespaces.js";
+export { connections, CredentialAuthorizationRequiredError, ConnectionNotFoundError, CredentialStoreError, InvalidAgentAuthEndpointError, } from "./connections.js";
 export { defineSandbox } from "./sandbox.js";
 import { mcpConnector } from "./connectors/mcp/index.js";
 /** Public connectors namespace — MCP only for this release. */

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AA6BzD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,GAAG,EAAE,YAAY;CAClB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,WAAW,EACX,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AA+BzD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,GAAG,EAAE,YAAY;CAClB,CAAC"}

package/dist/ingress/index.d.ts

@@ -47,8 +47,8 @@ export declare function scheduleIngressWork(work: () => Promise<void>, options:
 /**
  * True when an MDA thread already exists for this source-thread key.
  *
- * Call with the **resolved** actor (post identity remap) so ownership matches
- * the thread created on the first run.
+ * The thread is owned by the source conversation rather than by the caller, so
+ * this answers "is the agent already in this thread" for any participant.
  */
 export declare function ingressSourceThreadExists(input: SourceThreadExistsInput): Promise<boolean>;
 /**
@@ -64,6 +64,8 @@ export declare function startIngressAgent(input: {
     messages: Record<string, unknown>[];
     sourceProvider: string;
     sourceThreadKey: string;
+    /** Agent Auth principal UUID from Trigger `identity_context`. */
+    userId: string;
 }): Promise<StartedIngressRun>;
 /** Resume a Trigger-addressed thread with a keyed interrupt response. */
 export declare function resumeIngressAgent(input: {
@@ -72,11 +74,17 @@ export declare function resumeIngressAgent(input: {
     resume: TriggerChannelResume;
     sourceProvider: string;
     sourceThreadKey: string;
+    /** Agent Auth principal UUID from Trigger `identity_context`. */
+    userId: string;
 }): Promise<StartedIngressRun>;
 /** Join an accepted Trigger run and read its terminal status. */
 export declare function observeIngressAgent(input: {
     threadId: string;
     runId: string;
+    sourceProvider: string;
+    sourceThreadKey: string;
+    /** Agent Auth principal UUID used to create the run's thread. */
+    userId: string;
 }): Promise<ObservedIngressRun>;
 /** Deterministic LangGraph thread id from a provider source-thread key. */
 export declare function stableThreadId(sourceThreadKey: string): string;

package/dist/ingress/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ingress/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAoBhC,6EAA6E;AAC7E,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,cAAc,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAE/E,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EACzB,OAAO,EAAE;IACP,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;CAChD,GACA,IAAI,CASN;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAelB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CA6CnC;AAED,6DAA6D;AAC7D,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoB7B;AAED,yEAAyE;AACzE,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAgB7B;AAED,iEAAiE;AACjE,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAW9B;AA8ED,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAS9D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ingress/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAmBhC,6EAA6E;AAC7E,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,cAAc,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAE/E,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EACzB,OAAO,EAAE;IACP,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;CAChD,GACA,IAAI,CASN;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAelB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CA6CnC;AAED,6DAA6D;AAC7D,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAqB7B;AAED,yEAAyE;AACzE,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAiB7B;AAED,iEAAiE;AACjE,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAe9B;AAoFD,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAS9D"}

package/dist/ingress/index.js

@@ -12,7 +12,7 @@ import { extractAssistantText } from "../channels/assistant-text.js";
 import { CHANNEL_BINDING_KEY, } from "../channels/binding.js";
 import { ChannelError } from "../channels/errors.js";
 import { isLoopbackUrl, resolveLoopbackApiKey, resolveLoopbackApiUrl, } from "../identity/loopback.js";
-import { CHANNEL_SERVICE_USER, HANDOFF_SECRET_ENV, HANDOFF_SECRET_HEADER, USER_HEADER, INGRESS_SECRET_ENV, INGRESS_SECRET_HEADER, LANGCHAIN_API_KEY_ENV, LANGSMITH_API_KEY_ENV, SOURCE_PROVIDER_HEADER, SOURCE_THREAD_HEADER, } from "../runtime/auth.js";
+import { HANDOFF_SECRET_ENV, HANDOFF_SECRET_HEADER, USER_HEADER, INGRESS_SECRET_ENV, INGRESS_SECRET_HEADER, LANGCHAIN_API_KEY_ENV, LANGSMITH_API_KEY_ENV, SOURCE_PROVIDER_HEADER, SOURCE_THREAD_HEADER, } from "../runtime/auth.js";
 /**
  * Schedule background work after the provider ACK. Defaults to fire-and-forget
  * with error logging; tests pass an inline runner.
@@ -29,8 +29,8 @@ export function scheduleIngressWork(work, options) {
 /**
  * True when an MDA thread already exists for this source-thread key.
  *
- * Call with the **resolved** actor (post identity remap) so ownership matches
- * the thread created on the first run.
+ * The thread is owned by the source conversation rather than by the caller, so
+ * this answers "is the agent already in this thread" for any participant.
  */
 export async function ingressSourceThreadExists(input) {
     if (!hasLoopbackCredential()) {
@@ -95,6 +95,7 @@ export async function startIngressAgent(input) {
     const client = createTriggerIngressLoopbackClient({
         provider: input.sourceProvider,
         threadKey: input.sourceThreadKey,
+        userId: input.userId,
     });
     await client.threads.create({
         threadId: input.threadId,
@@ -114,6 +115,7 @@ export async function resumeIngressAgent(input) {
     const client = createTriggerIngressLoopbackClient({
         provider: input.sourceProvider,
         threadKey: input.sourceThreadKey,
+        userId: input.userId,
     });
     const run = await client.runs.create(input.threadId, input.assistantId, {
         command: { resume: input.resume },
@@ -126,7 +128,11 @@ export async function resumeIngressAgent(input) {
 }
 /** Join an accepted Trigger run and read its terminal status. */
 export async function observeIngressAgent(input) {
-    const client = createTriggerIngressLoopbackClient();
+    const client = createTriggerIngressLoopbackClient({
+        provider: input.sourceProvider,
+        threadKey: input.sourceThreadKey,
+        userId: input.userId,
+    });
     const values = await client.runs.join(input.threadId, input.runId);
     const run = await client.runs.get(input.threadId, input.runId);
     if (!isIngressRunStatus(run.status)) {
@@ -139,13 +145,15 @@ function createTriggerIngressLoopbackClient(source) {
     if (!apiKey) {
         throw new ChannelError("channel_run_failed", "managed loopback authentication is not configured");
     }
+    const userId = source.userId.trim();
+    if (!userId) {
+        throw new ChannelError("channel_run_failed", "channel run requires an identity_context principal");
+    }
     const headers = {
-        [USER_HEADER]: CHANNEL_SERVICE_USER,
+        [USER_HEADER]: userId,
+        [SOURCE_PROVIDER_HEADER]: source.provider,
+        [SOURCE_THREAD_HEADER]: source.threadKey,
     };
-    if (source) {
-        headers[SOURCE_PROVIDER_HEADER] = source.provider;
-        headers[SOURCE_THREAD_HEADER] = source.threadKey;
-    }
     return new Client({
         apiUrl: resolveLoopbackApiUrl(),
         apiKey,

package/dist/ingress/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ingress/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAElD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,EACL,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,WAAW,EACX,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAoC5B;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAyB,EACzB,OAGC;IAED,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ;QAChB,CAAC,CAAC,EAAE,EAAE,EAAE;YACN,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC5B,OAAO,CAAC,KAAK,CAAC,SAAS,OAAO,CAAC,KAAK,UAAU,EAAE,KAAK,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,QAAQ,CAAC,IAAI,CAAC,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAA8B;IAE9B,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA8B;IAE9B,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ;KAC/D,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1B,QAAQ;YACR,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,eAAe,EAAE;YAC1C,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;IAC1F,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE;QAC/D,KAAK,EAAE;YACL,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SACnD;QACD,MAAM,EAAE;YACN,YAAY,EAAE;gBACZ,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,OAAO;aACrC;SACF;KACF,CAAC,CAID,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC;QACpC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM;QAC9B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAMvC;IACC,MAAM,MAAM,GAAG,kCAAkC,CAAC;QAChD,QAAQ,EAAE,KAAK,CAAC,cAAc;QAC9B,SAAS,EAAE,KAAK,CAAC,eAAe;KACjC,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE;QACtE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;QACnC,iBAAiB,EAAE,SAAS;KAC7B,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACzD,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAMxC;IACC,MAAM,MAAM,GAAG,kCAAkC,CAAC;QAChD,QAAQ,EAAE,KAAK,CAAC,cAAc;QAC9B,SAAS,EAAE,KAAK,CAAC,eAAe;KACjC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE;QACtE,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;QACjC,iBAAiB,EAAE,SAAS;KAC7B,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACzD,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAGzC;IACC,MAAM,MAAM,GAAG,kCAAkC,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,kCAAkC,CAAC,MAG3C;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAA2B;QACtC,CAAC,WAAW,CAAC,EAAE,oBAAoB;KACpC,CAAC;IACF,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;QAClD,OAAO,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,MAAM,CAAC;QAChB,MAAM,EAAE,qBAAqB,EAAE;QAC/B,MAAM;QACN,cAAc,EAAE,OAAO;KACxB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,CACL,KAAK,KAAK,OAAO;QACjB,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,aAAa,CACxB,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,KAIpC;IACC,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO;QAC3B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE;QACzC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IAChE,MAAM,aAAa,GAAG,OAAO;QAC3B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE;QACzC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAA2B;QACtC,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM;QAC3B,CAAC,sBAAsB,CAAC,EAAE,KAAK,CAAC,cAAc,IAAI,OAAO;QACzD,CAAC,oBAAoB,CAAC,EAAE,KAAK,CAAC,eAAe;KAC9C,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACjD,CAAC;SAAM,IAAI,CAAC,YAAY,IAAI,aAAa,EAAE,CAAC;QAC1C,OAAO,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,MAAM,CAAC;QAChB,MAAM;QACN,MAAM;QACN,cAAc,EAAE,OAAO;KACxB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,OAAO,GAAG,aAAa,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACvD,OAAO,OAAO,CACZ,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE;QAC1C,CAAC,OAAO;YACN,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE;gBACtC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAAC,eAAuB;IACpD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE;QACvB,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE;QACvB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;KAClB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ingress/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAElD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,EACL,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,WAAW,EACX,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAoC5B;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAyB,EACzB,OAGC;IAED,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ;QAChB,CAAC,CAAC,EAAE,EAAE,EAAE;YACN,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC5B,OAAO,CAAC,KAAK,CAAC,SAAS,OAAO,CAAC,KAAK,UAAU,EAAE,KAAK,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,QAAQ,CAAC,IAAI,CAAC,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAA8B;IAE9B,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA8B;IAE9B,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ;KAC/D,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1B,QAAQ;YACR,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,eAAe,EAAE;YAC1C,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;IAC1F,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE;QAC/D,KAAK,EAAE;YACL,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SACnD;QACD,MAAM,EAAE;YACN,YAAY,EAAE;gBACZ,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,OAAO;aACrC;SACF;KACF,CAAC,CAID,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC;QACpC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM;QAC9B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAQvC;IACC,MAAM,MAAM,GAAG,kCAAkC,CAAC;QAChD,QAAQ,EAAE,KAAK,CAAC,cAAc;QAC9B,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE;QACtE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;QACnC,iBAAiB,EAAE,SAAS;KAC7B,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACzD,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAQxC;IACC,MAAM,MAAM,GAAG,kCAAkC,CAAC;QAChD,QAAQ,EAAE,KAAK,CAAC,cAAc;QAC9B,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE;QACtE,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;QACjC,iBAAiB,EAAE,SAAS;KAC7B,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACzD,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAOzC;IACC,MAAM,MAAM,GAAG,kCAAkC,CAAC;QAChD,QAAQ,EAAE,KAAK,CAAC,cAAc;QAC9B,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,kCAAkC,CAAC,MAI3C;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAA2B;QACtC,CAAC,WAAW,CAAC,EAAE,MAAM;QACrB,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC,QAAQ;QACzC,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC,SAAS;KACzC,CAAC;IACF,OAAO,IAAI,MAAM,CAAC;QAChB,MAAM,EAAE,qBAAqB,EAAE;QAC/B,MAAM;QACN,cAAc,EAAE,OAAO;KACxB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,CACL,KAAK,KAAK,OAAO;QACjB,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,aAAa,CACxB,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,KAIpC;IACC,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO;QAC3B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE;QACzC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IAChE,MAAM,aAAa,GAAG,OAAO;QAC3B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE;QACzC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAA2B;QACtC,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM;QAC3B,CAAC,sBAAsB,CAAC,EAAE,KAAK,CAAC,cAAc,IAAI,OAAO;QACzD,CAAC,oBAAoB,CAAC,EAAE,KAAK,CAAC,eAAe;KAC9C,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACjD,CAAC;SAAM,IAAI,CAAC,YAAY,IAAI,aAAa,EAAE,CAAC;QAC1C,OAAO,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,MAAM,CAAC;QAChB,MAAM;QACN,MAAM;QACN,cAAc,EAAE,OAAO;KACxB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,OAAO,GAAG,aAAa,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACvD,OAAO,OAAO,CACZ,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE;QAC1C,CAAC,OAAO;YACN,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE;gBACtC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAAC,eAAuB;IACpD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE;QACvB,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE;QACvB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;KAClB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC"}

package/dist/runtime/auth.d.ts

@@ -29,17 +29,24 @@ export declare const LANGSMITH_API_KEY_ENV = "LANGSMITH_API_KEY";
 export declare const LANGCHAIN_API_KEY_ENV = "LANGCHAIN_API_KEY";
 /** Internal Trigger-channel principal used to start and observe Agent runs. */
 export declare const CHANNEL_SERVICE_USER = "mda:channel";
+/** Owner-key namespace for threads owned by a channel source conversation. */
+export declare const CHANNEL_THREAD_OWNER_PREFIX = "mda:source-thread:";
 /**
- * The user object `@auth.authenticate` returns. `identity`/`permissions` satisfy
- * the LangGraph base shape; the `mda_*` fields carry the identity envelope into
- * `config.configurable.langgraph_auth_user` for the runtime seam.
+ * LangGraph AuthUser returned by `@auth.authenticate` and stored on
+ * `langgraph_auth_user` / `serverInfo.user`.
+ *
+ * Transport for auth + authorization — not the author identity surface. Tools
+ * and middleware should read `runtime.serverInfo.principal` (Agent Auth–aligned
+ * caller). The `mda_*` stamps stay internal; the managed seam projects them
+ * into `principal` / `subject` / `link` on `serverInfo`.
  */
 export interface ManagedUser {
     identity: string;
     permissions: string[];
+    /** Subject id stamped by managed auth (internal; prefer `serverInfo.principal`). */
     mda_user_id: string;
     mda_user_email?: string;
-    /** Resolved group memberships; read-only, never an isolation key. */
+    /** Resolved group memberships; never an isolation key. */
     mda_groups?: string[];
     mda_claims?: Record<string, unknown>;
     /** Trusted source provider stamped by managed ingress (never client-supplied). */
@@ -55,6 +62,22 @@ export interface ManagedUser {
  * Also registers thread and store scoping with a studio bypass.
  */
 export declare function buildManagedAuth(identity: IdentityDefinition): Auth;
+/**
+ * Reject (403) every resource/action pair except reading or searching
+ * assistants, covering the resources managed auth does not scope per caller.
+ *
+ * `assistants` and `crons` are deployment-owned: assistants come from the
+ * compiled project and crons from `schedules/**`, both provisioned by `mda
+ * deploy` as a workspace/Studio principal. No runtime caller needs to mutate
+ * either, and `crons:create` accepts a `thread_id`, which would let a caller
+ * schedule a run against a thread the thread-ownership filter would otherwise
+ * put out of reach.
+ *
+ * Assistant reads stay open so clients can enumerate the deployment's agents;
+ * that exposes `graph_id` and assistant config, which is deploy-authored rather
+ * than caller data.
+ */
+export declare function denyUnlessAssistantRead(resource: string, action: string): void;
 /**
  * Resolve the caller's frozen {@link RuntimeIdentity} from a raw HTTP request,
  * using the same ingress logic (`trusted_backend` headers / `validated_token`
@@ -93,6 +116,12 @@ export declare const IDENTITY_LINKS_SERVICE_USER = "mda:identity-links";
  *
  * There is no per-caller store partition to enforce beyond that, because no
  * declaration mounts per-caller state in this release.
+ *
+ * Studio and local-dev principals are deliberately **not** exempt here. Studio
+ * identity is reachable by any holder of a workspace LangSmith API key (via the
+ * `x-auth-scheme: langsmith` ingress the Agent Server honours), and nothing
+ * legitimately reads these tables that way: the managed link client stamps
+ * {@link IDENTITY_LINKS_SERVICE_USER} behind the handoff/ingress secret.
  */
 export declare function assertStoreAccess(user: ManagedUser, value: unknown): void;
 /**
@@ -124,7 +153,22 @@ export declare function isLocalDevUnscopedUser(user: unknown): boolean;
  * present (so the normal trusted-backend path runs).
  */
 export declare function tryLocalDevTrustedUser(_cfg: IdentityConfig, request: Request): ManagedUser | null;
-/** Derive the owner value `@auth.on.threads` filters on (the caller user id). */
+/**
+ * Derive the owner value `@auth.on.threads` filters on.
+ *
+ * A managed channel thread is owned by its source conversation; every other
+ * caller owns its threads by user id. Channel threads are addressed by
+ * `source_thread_key` and the deliveries that reach one can legitimately carry
+ * different principals: the Trigger Server does not attach `identity_context`
+ * to every envelope, and any participant may reply in a shared thread or answer
+ * an interrupt someone else raised. Keying such a thread on the delivering
+ * principal denies every later delivery that does not match.
+ *
+ * Only managed ingress sets both source stamps, and only over a trusted
+ * loopback credential — a client presenting them is rejected in
+ * {@link rejectUntrustedHandoffHeaders}. `mda_user_id` still carries the
+ * principal, so credential resolution and store scoping stay per caller.
+ */
 export declare function threadOwnerKey(user: ManagedUser): string;
 /** True when the request targets a public channel/connector Events ingress route. */
 export declare function isChannelEventsRequest(request: Request): boolean;

package/dist/runtime/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/runtime/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EAGL,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EAEvB,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAC;AAI9B;;;;;GAKG;AACH,oFAAoF;AACpF,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,qBAAqB,yBAAyB,CAAC;AAC5D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,0BAA0B,CAAC;AAC9D,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAE7D,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,qBAAqB,yBAAyB,CAAC;AAE5D,mDAAmD;AACnD,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AACrE,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,eAAO,MAAM,wBAAwB,cAAc,CAAC;AACpD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,gBAAgB,CAAC;AAuClD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,kFAAkF;IAClF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oEAAoE;IACpE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAkDnE;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,eAAe,CAAC,CA4B1B;AAED,uEAAuE;AACvE,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAEhE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,2BAA2B,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAsBzE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,WAAW,CASb;AA+FD,8EAA8E;AAC9E,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,WAAW,CAAC,CA+EtB;AAiBD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAgB7D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,OAAO,GACf,WAAW,GAAG,IAAI,CASpB;AAYD,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAExD;AAkBD,qFAAqF;AACrF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAQhE;AAED,gFAAgF;AAChF,wBAAgB,uBAAuB,IAAI,WAAW,CAMrD"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/runtime/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EAGL,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EAEvB,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAC;AAI9B;;;;;GAKG;AACH,oFAAoF;AACpF,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,qBAAqB,yBAAyB,CAAC;AAC5D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,0BAA0B,CAAC;AAC9D,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAE7D,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,qBAAqB,yBAAyB,CAAC;AAE5D,mDAAmD;AACnD,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AACrE,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,eAAO,MAAM,wBAAwB,cAAc,CAAC;AACpD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,gBAAgB,CAAC;AAuClD,8EAA8E;AAC9E,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAEhE;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,kFAAkF;IAClF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oEAAoE;IACpE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CA0EnE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,IAAI,CAON;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,eAAe,CAAC,CA4B1B;AAED,uEAAuE;AACvE,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAEhE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,2BAA2B,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAsBzE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,WAAW,CASb;AA+FD,8EAA8E;AAC9E,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,WAAW,CAAC,CA+EtB;AAiBD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAgB7D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,OAAO,GACf,WAAW,GAAG,IAAI,CASpB;AAYD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAUxD;AAsCD,qFAAqF;AACrF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAQhE;AAED,gFAAgF;AAChF,wBAAgB,uBAAuB,IAAI,WAAW,CAMrD"}

package/dist/runtime/auth.js

@@ -61,6 +61,8 @@ function isTrustedSourceProvider(provider) {
 }
 /** Synthetic user so middleware_first allows adapter-authenticated Events ingress. */
 const CHANNEL_EVENTS_USER = "mda:channel-events";
+/** Owner-key namespace for threads owned by a channel source conversation. */
+export const CHANNEL_THREAD_OWNER_PREFIX = "mda:source-thread:";
 /**
  * Build the managed LangGraph custom-auth handler from a declared identity.
  *
@@ -92,8 +94,15 @@ export function buildManagedAuth(identity) {
         }
         return resolveValidatedTokenUser(cfg, http, request);
     });
-    auth.on("threads", ({ user, value }) => {
-        if (isStudioUser(user) || isLocalDevUnscopedUser(user)) {
+    // Let Studio inspect every deployment thread so channel-triggered runs and
+    // their interrupts are visible there. Keep mutations owner-scoped: Studio
+    // identity is reachable by any holder of a workspace LangSmith API key, so
+    // exempting all thread actions would also let that key alter caller threads.
+    auth.on("threads", ({ user, action, value }) => {
+        if (isLocalDevUnscopedUser(user)) {
+            return true;
+        }
+        if (isStudioUser(user) && (action === "read" || action === "search")) {
             return true;
         }
         const key = threadOwnerKey(user);
@@ -105,15 +114,54 @@ export function buildManagedAuth(identity) {
     });
     // Mirror the memory namespace so raw store ops can't cross the identity
     // boundary a run is scoped to.
+    //
+    // The reserved-table check runs before the Studio / local-dev exemption on
+    // purpose. A caller holding a workspace LangSmith key can present
+    // `x-auth-scheme: langsmith` and be authenticated as a Studio user by the
+    // Agent Server, so exempting Studio first would hand out the deployment-wide
+    // account-link and legacy-credential tables to anyone with that key.
     auth.on("store", ({ user, value }) => {
+        assertStoreAccess(user, value);
+        return true;
+    });
+    // Default-deny everything the handlers above do not claim. LangGraph
+    // authorization is fail-open: an unhandled resource is permitted, so the
+    // resources MDA does not scope (`assistants`, `crons`) would otherwise be
+    // reachable unfiltered by any authenticated caller. The specific handlers
+    // registered above take precedence over this one, so threads and store keep
+    // their own scoping.
+    auth.on("*", ({ user, resource, action }) => {
         if (isStudioUser(user) || isLocalDevUnscopedUser(user)) {
             return true;
         }
-        assertStoreAccess(user, value);
+        denyUnlessAssistantRead(resource, action);
         return true;
     });
     return auth;
 }
+/**
+ * Reject (403) every resource/action pair except reading or searching
+ * assistants, covering the resources managed auth does not scope per caller.
+ *
+ * `assistants` and `crons` are deployment-owned: assistants come from the
+ * compiled project and crons from `schedules/**`, both provisioned by `mda
+ * deploy` as a workspace/Studio principal. No runtime caller needs to mutate
+ * either, and `crons:create` accepts a `thread_id`, which would let a caller
+ * schedule a run against a thread the thread-ownership filter would otherwise
+ * put out of reach.
+ *
+ * Assistant reads stay open so clients can enumerate the deployment's agents;
+ * that exposes `graph_id` and assistant config, which is deploy-authored rather
+ * than caller data.
+ */
+export function denyUnlessAssistantRead(resource, action) {
+    if (resource === "assistants" && (action === "read" || action === "search")) {
+        return;
+    }
+    throw new HTTPException(403, {
+        message: `${resource}:${action} is not permitted for this caller`,
+    });
+}
 /**
  * Resolve the caller's frozen {@link RuntimeIdentity} from a raw HTTP request,
  * using the same ingress logic (`trusted_backend` headers / `validated_token`
@@ -178,6 +226,12 @@ export const IDENTITY_LINKS_SERVICE_USER = "mda:identity-links";
  *
  * There is no per-caller store partition to enforce beyond that, because no
  * declaration mounts per-caller state in this release.
+ *
+ * Studio and local-dev principals are deliberately **not** exempt here. Studio
+ * identity is reachable by any holder of a workspace LangSmith API key (via the
+ * `x-auth-scheme: langsmith` ingress the Agent Server honours), and nothing
+ * legitimately reads these tables that way: the managed link client stamps
+ * {@link IDENTITY_LINKS_SERVICE_USER} behind the handoff/ingress secret.
  */
 export function assertStoreAccess(user, value) {
     const namespace = value &&
@@ -427,9 +481,50 @@ function localDevServiceUser(request) {
         mda_user_kind: "service",
     };
 }
-/** Derive the owner value `@auth.on.threads` filters on (the caller user id). */
+/**
+ * Derive the owner value `@auth.on.threads` filters on.
+ *
+ * A managed channel thread is owned by its source conversation; every other
+ * caller owns its threads by user id. Channel threads are addressed by
+ * `source_thread_key` and the deliveries that reach one can legitimately carry
+ * different principals: the Trigger Server does not attach `identity_context`
+ * to every envelope, and any participant may reply in a shared thread or answer
+ * an interrupt someone else raised. Keying such a thread on the delivering
+ * principal denies every later delivery that does not match.
+ *
+ * Only managed ingress sets both source stamps, and only over a trusted
+ * loopback credential — a client presenting them is rejected in
+ * {@link rejectUntrustedHandoffHeaders}. `mda_user_id` still carries the
+ * principal, so credential resolution and store scoping stay per caller.
+ */
 export function threadOwnerKey(user) {
-    return String(user.mda_user_id ?? "");
+    const conversation = channelConversationOwnerKey(user);
+    if (conversation) {
+        return conversation;
+    }
+    // Principals resolved by `authenticate` always carry `mda_user_id`. A Studio
+    // user does not: the Agent Server builds it for `x-auth-scheme: langsmith`
+    // without consulting managed auth, so it exposes only `identity`. Fall back to
+    // that rather than bucketing every such caller under an empty owner.
+    return String(user.mda_user_id ?? user.identity ?? "");
+}
+/**
+ * Owner key for a channel ingress caller, or `undefined` for anyone else.
+ *
+ * The prefix keeps conversation owners in a namespace no `mda_user_id` can
+ * reach (those are UUIDs, emails, or `mda:*` service ids), so a source thread
+ * key can never collide with a caller.
+ */
+function channelConversationOwnerKey(user) {
+    const provider = trimmedStamp(user.mda_source_provider);
+    const threadKey = trimmedStamp(user.mda_source_thread_id);
+    if (!provider || !threadKey) {
+        return undefined;
+    }
+    return `${CHANNEL_THREAD_OWNER_PREFIX}${provider}:${threadKey}`;
+}
+function trimmedStamp(value) {
+    return typeof value === "string" ? value.trim() : "";
 }
 function requireIngressSecret(request) {
     if (!hasValidIngressSecret(request)) {