managed-deepagents 0.6.2-dev.9 → 0.7.0

package/dist/index.d.ts

@@ -2,45 +2,20 @@ export { defineDeepAgent } from "./define-deep-agent.js";
 export { defineSchedule } from "./schedules.js";
 export { defineIdentity } from "./identity/index.js";
 export { defineMemory } from "./memory/index.js";
-export { auth, channels } from "./namespaces.js";
+export { auth, channels, connectors } from "./namespaces.js";
+export { connections, CredentialAuthorizationRequiredError, ConnectionNotFoundError, CredentialStoreError, InvalidAgentAuthEndpointError, } from "./connections.js";
 export { defineSandbox } from "./sandbox.js";
-export type { Channels } from "./namespaces.js";
-import { mcpConnector } from "./connectors/mcp/index.js";
-/**
- * Public connectors surface for this release: remote MCP only.
- */
-export interface Connectors {
-    /**
-     * Declare remote MCP servers (HTTP/SSE) whose tools load at agent-graph
-     * construction. Stdio servers are not supported. Use static `headers` (or
-     * similar) when the server needs credentials — roll your own auth.
-     *
-     * @example
-     * ```ts
-     * export const connector = connectors.mcp({
-     *   mcpServers: {
-     *     docs: {
-     *       transport: "http",
-     *       url: "https://docs.example.com/mcp",
-     *       headers: { Authorization: `Bearer ${process.env.DOCS_TOKEN}` },
-     *     },
-     *   },
-     * });
-     * ```
-     *
-     * @see {@link mcpConnector}
-     */
-    mcp: typeof mcpConnector;
-}
-/** Public connectors namespace — MCP only for this release. */
-export declare const connectors: Connectors;
+export { defineMcp } from "./connectors/mcp/index.js";
+export type { Channels, Connectors } from "./namespaces.js";
+export type { AgentConnectionOwner, ConnectionOwner, ConnectionRequest, UserConnectionOwner, } from "./connections.js";
 export type { DeepAgentDefinition, DefineDeepAgentConfig, ManagedDeepAgentKey, } from "./types.js";
 export type { ScheduleConfig, ScheduleDefinition, ScheduleDeliveryTarget, ScheduleThreadConfig, } from "./schedules.js";
-export type { ClaimMapping, CredentialScope, HttpIngress, IdentityAuth, IdentityConfig, IdentityDefinition, IdentityOptions, LangSmithApiKeyIngress, RuntimeIdentity, ValidatedTokenIngress, ValidatedTokenProvider, } from "./identity/index.js";
+export type { ClaimMapping, CredentialScope, HttpIngress, IdentityAuth, IdentityConfig, IdentityDefinition, IdentityOptions, IdentitySource, LangSmithApiKeyIngress, Link, LinkStatus, Principal, PrincipalClaims, PrincipalEnvelope, PrincipalKind, RuntimeIdentity, Subject, SubjectAuthority, ValidatedTokenIngress, ValidatedTokenProvider, } from "./identity/index.js";
 export type { MemoryConfig, MemoryDefinition, MemoryOptions, MemoryScope, MemoryScopeInput, MemorySliceInput, MemorySliceKind, ResolvedMemorySlice, } from "./memory/index.js";
-export type { HttpMcpServerConfig, McpServersConfig, McpServersDefinition, McpToolSelectionConfig, RemoteMcpServerBaseConfig, RemoteMcpServerConfig, SseMcpServerConfig, } from "./connectors/mcp/index.js";
+export type { HttpMcpServerConfig, McpServerConnection, McpServersConfig, McpServersDefinition, McpToolSelectionConfig, RemoteMcpServerBaseConfig, RemoteMcpServerConfig, SseMcpServerConfig, } from "./connectors/mcp/index.js";
+export type { CredentialAuthorizationRequiredInterrupt, PendingCredential, } from "./connection-authorization.js";
 export type { ChannelManifest } from "./channels/manifest.js";
 export type { RequiredTriggerSlackChannelConfig, SlackChannel, SlackChannelConfig, } from "./channels/slack/index.js";
 export type { SandboxDefinition, SandboxOptions } from "./sandbox.js";
-export type { ManagedDeepAgentRuntime } from "./runtime/managed-tools.js";
+export type { ManagedDeepAgentRuntime, ManagedServerInfo, } from "./runtime/managed-tools.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,GAAG,EAAE,OAAO,YAAY,CAAC;CAC1B;AAED,+DAA+D;AAC/D,eAAO,MAAM,UAAU,EAAE,UAExB,CAAC;AAEF,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,YAAY,EACZ,eAAe,EACf,WAAW,EACX,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,iCAAiC,EACjC,YAAY,EACZ,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEtE,YAAY,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EACL,WAAW,EACX,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE5D,YAAY,EACV,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,YAAY,EACZ,eAAe,EACf,WAAW,EACX,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,IAAI,EACJ,UAAU,EACV,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,OAAO,EACP,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,wCAAwC,EACxC,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AAEvC,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,iCAAiC,EACjC,YAAY,EACZ,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEtE,YAAY,EACV,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -2,11 +2,8 @@ export { defineDeepAgent } from "./define-deep-agent.js";
 export { defineSchedule } from "./schedules.js";
 export { defineIdentity } from "./identity/index.js";
 export { defineMemory } from "./memory/index.js";
-export { auth, channels } from "./namespaces.js";
+export { auth, channels, connectors } from "./namespaces.js";
+export { connections, CredentialAuthorizationRequiredError, ConnectionNotFoundError, CredentialStoreError, InvalidAgentAuthEndpointError, } from "./connections.js";
 export { defineSandbox } from "./sandbox.js";
-import { mcpConnector } from "./connectors/mcp/index.js";
-/** Public connectors namespace — MCP only for this release. */
-export const connectors = {
-    mcp: mcpConnector,
-};
+export { defineMcp } from "./connectors/mcp/index.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AA6BzD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,GAAG,EAAE,YAAY;CAClB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EACL,WAAW,EACX,oCAAoC,EACpC,uBAAuB,EACvB,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/ingress/index.d.ts

@@ -47,8 +47,8 @@ export declare function scheduleIngressWork(work: () => Promise<void>, options:
 /**
  * True when an MDA thread already exists for this source-thread key.
  *
- * Call with the **resolved** actor (post identity remap) so ownership matches
- * the thread created on the first run.
+ * The thread is owned by the source conversation rather than by the caller, so
+ * this answers "is the agent already in this thread" for any participant.
  */
 export declare function ingressSourceThreadExists(input: SourceThreadExistsInput): Promise<boolean>;
 /**
@@ -64,6 +64,8 @@ export declare function startIngressAgent(input: {
     messages: Record<string, unknown>[];
     sourceProvider: string;
     sourceThreadKey: string;
+    /** Agent Auth principal UUID from Trigger `identity_context`. */
+    userId: string;
 }): Promise<StartedIngressRun>;
 /** Resume a Trigger-addressed thread with a keyed interrupt response. */
 export declare function resumeIngressAgent(input: {
@@ -72,11 +74,17 @@ export declare function resumeIngressAgent(input: {
     resume: TriggerChannelResume;
     sourceProvider: string;
     sourceThreadKey: string;
+    /** Agent Auth principal UUID from Trigger `identity_context`. */
+    userId: string;
 }): Promise<StartedIngressRun>;
 /** Join an accepted Trigger run and read its terminal status. */
 export declare function observeIngressAgent(input: {
     threadId: string;
     runId: string;
+    sourceProvider: string;
+    sourceThreadKey: string;
+    /** Agent Auth principal UUID used to create the run's thread. */
+    userId: string;
 }): Promise<ObservedIngressRun>;
 /** Deterministic LangGraph thread id from a provider source-thread key. */
 export declare function stableThreadId(sourceThreadKey: string): string;

package/dist/ingress/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ingress/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAoBhC,6EAA6E;AAC7E,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,cAAc,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAE/E,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EACzB,OAAO,EAAE;IACP,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;CAChD,GACA,IAAI,CASN;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAelB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CA6CnC;AAED,6DAA6D;AAC7D,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoB7B;AAED,yEAAyE;AACzE,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAgB7B;AAED,iEAAiE;AACjE,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAW9B;AA8ED,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAS9D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ingress/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAoBhC,6EAA6E;AAC7E,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,cAAc,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAE/E,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EACzB,OAAO,EAAE;IACP,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;CAChD,GACA,IAAI,CASN;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAelB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CA6CnC;AAED,6DAA6D;AAC7D,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAqB7B;AAED,yEAAyE;AACzE,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAiB7B;AAED,iEAAiE;AACjE,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAe9B;AAqFD,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAS9D"}

package/dist/ingress/index.js

@@ -12,7 +12,7 @@ import { extractAssistantText } from "../channels/assistant-text.js";
 import { CHANNEL_BINDING_KEY, } from "../channels/binding.js";
 import { ChannelError } from "../channels/errors.js";
 import { isLoopbackUrl, resolveLoopbackApiKey, resolveLoopbackApiUrl, } from "../identity/loopback.js";
-import { CHANNEL_SERVICE_USER, HANDOFF_SECRET_ENV, HANDOFF_SECRET_HEADER, USER_HEADER, INGRESS_SECRET_ENV, INGRESS_SECRET_HEADER, LANGCHAIN_API_KEY_ENV, LANGSMITH_API_KEY_ENV, SOURCE_PROVIDER_HEADER, SOURCE_THREAD_HEADER, } from "../runtime/auth.js";
+import { HANDOFF_SECRET_ENV, HANDOFF_SECRET_HEADER, USER_HEADER, INGRESS_SECRET_ENV, INGRESS_SECRET_HEADER, LANGCHAIN_API_KEY_ENV, LANGSMITH_API_KEY_ENV, AGENT_AUTH_PRINCIPAL_HEADER, SOURCE_PROVIDER_HEADER, SOURCE_THREAD_HEADER, } from "../runtime/auth.js";
 /**
  * Schedule background work after the provider ACK. Defaults to fire-and-forget
  * with error logging; tests pass an inline runner.
@@ -29,8 +29,8 @@ export function scheduleIngressWork(work, options) {
 /**
  * True when an MDA thread already exists for this source-thread key.
  *
- * Call with the **resolved** actor (post identity remap) so ownership matches
- * the thread created on the first run.
+ * The thread is owned by the source conversation rather than by the caller, so
+ * this answers "is the agent already in this thread" for any participant.
  */
 export async function ingressSourceThreadExists(input) {
     if (!hasLoopbackCredential()) {
@@ -95,6 +95,7 @@ export async function startIngressAgent(input) {
     const client = createTriggerIngressLoopbackClient({
         provider: input.sourceProvider,
         threadKey: input.sourceThreadKey,
+        userId: input.userId,
     });
     await client.threads.create({
         threadId: input.threadId,
@@ -114,6 +115,7 @@ export async function resumeIngressAgent(input) {
     const client = createTriggerIngressLoopbackClient({
         provider: input.sourceProvider,
         threadKey: input.sourceThreadKey,
+        userId: input.userId,
     });
     const run = await client.runs.create(input.threadId, input.assistantId, {
         command: { resume: input.resume },
@@ -126,7 +128,11 @@ export async function resumeIngressAgent(input) {
 }
 /** Join an accepted Trigger run and read its terminal status. */
 export async function observeIngressAgent(input) {
-    const client = createTriggerIngressLoopbackClient();
+    const client = createTriggerIngressLoopbackClient({
+        provider: input.sourceProvider,
+        threadKey: input.sourceThreadKey,
+        userId: input.userId,
+    });
     const values = await client.runs.join(input.threadId, input.runId);
     const run = await client.runs.get(input.threadId, input.runId);
     if (!isIngressRunStatus(run.status)) {
@@ -139,13 +145,16 @@ function createTriggerIngressLoopbackClient(source) {
     if (!apiKey) {
         throw new ChannelError("channel_run_failed", "managed loopback authentication is not configured");
     }
+    const userId = source.userId.trim();
+    if (!userId) {
+        throw new ChannelError("channel_run_failed", "channel run requires an identity_context principal");
+    }
     const headers = {
-        [USER_HEADER]: CHANNEL_SERVICE_USER,
+        [USER_HEADER]: userId,
+        [AGENT_AUTH_PRINCIPAL_HEADER]: userId,
+        [SOURCE_PROVIDER_HEADER]: source.provider,
+        [SOURCE_THREAD_HEADER]: source.threadKey,
     };
-    if (source) {
-        headers[SOURCE_PROVIDER_HEADER] = source.provider;
-        headers[SOURCE_THREAD_HEADER] = source.threadKey;
-    }
     return new Client({
         apiUrl: resolveLoopbackApiUrl(),
         apiKey,

package/dist/ingress/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ingress/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAElD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,EACL,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,WAAW,EACX,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAoC5B;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAyB,EACzB,OAGC;IAED,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ;QAChB,CAAC,CAAC,EAAE,EAAE,EAAE;YACN,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC5B,OAAO,CAAC,KAAK,CAAC,SAAS,OAAO,CAAC,KAAK,UAAU,EAAE,KAAK,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,QAAQ,CAAC,IAAI,CAAC,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAA8B;IAE9B,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA8B;IAE9B,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ;KAC/D,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1B,QAAQ;YACR,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,eAAe,EAAE;YAC1C,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;IAC1F,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE;QAC/D,KAAK,EAAE;YACL,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SACnD;QACD,MAAM,EAAE;YACN,YAAY,EAAE;gBACZ,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,OAAO;aACrC;SACF;KACF,CAAC,CAID,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC;QACpC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM;QAC9B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAMvC;IACC,MAAM,MAAM,GAAG,kCAAkC,CAAC;QAChD,QAAQ,EAAE,KAAK,CAAC,cAAc;QAC9B,SAAS,EAAE,KAAK,CAAC,eAAe;KACjC,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE;QACtE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;QACnC,iBAAiB,EAAE,SAAS;KAC7B,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACzD,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAMxC;IACC,MAAM,MAAM,GAAG,kCAAkC,CAAC;QAChD,QAAQ,EAAE,KAAK,CAAC,cAAc;QAC9B,SAAS,EAAE,KAAK,CAAC,eAAe;KACjC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE;QACtE,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;QACjC,iBAAiB,EAAE,SAAS;KAC7B,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACzD,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAGzC;IACC,MAAM,MAAM,GAAG,kCAAkC,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,kCAAkC,CAAC,MAG3C;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAA2B;QACtC,CAAC,WAAW,CAAC,EAAE,oBAAoB;KACpC,CAAC;IACF,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;QAClD,OAAO,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,MAAM,CAAC;QAChB,MAAM,EAAE,qBAAqB,EAAE;QAC/B,MAAM;QACN,cAAc,EAAE,OAAO;KACxB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,CACL,KAAK,KAAK,OAAO;QACjB,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,aAAa,CACxB,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,KAIpC;IACC,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO;QAC3B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE;QACzC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IAChE,MAAM,aAAa,GAAG,OAAO;QAC3B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE;QACzC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAA2B;QACtC,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM;QAC3B,CAAC,sBAAsB,CAAC,EAAE,KAAK,CAAC,cAAc,IAAI,OAAO;QACzD,CAAC,oBAAoB,CAAC,EAAE,KAAK,CAAC,eAAe;KAC9C,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACjD,CAAC;SAAM,IAAI,CAAC,YAAY,IAAI,aAAa,EAAE,CAAC;QAC1C,OAAO,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,MAAM,CAAC;QAChB,MAAM;QACN,MAAM;QACN,cAAc,EAAE,OAAO;KACxB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,OAAO,GAAG,aAAa,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACvD,OAAO,OAAO,CACZ,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE;QAC1C,CAAC,OAAO;YACN,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE;gBACtC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAAC,eAAuB;IACpD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE;QACvB,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE;QACvB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;KAClB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ingress/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAElD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,EACL,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,WAAW,EACX,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAoC5B;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAyB,EACzB,OAGC;IAED,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ;QAChB,CAAC,CAAC,EAAE,EAAE,EAAE;YACN,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC5B,OAAO,CAAC,KAAK,CAAC,SAAS,OAAO,CAAC,KAAK,UAAU,EAAE,KAAK,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,QAAQ,CAAC,IAAI,CAAC,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAA8B;IAE9B,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA8B;IAE9B,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ;KAC/D,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1B,QAAQ;YACR,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,eAAe,EAAE;YAC1C,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;IAC1F,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE;QAC/D,KAAK,EAAE;YACL,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SACnD;QACD,MAAM,EAAE;YACN,YAAY,EAAE;gBACZ,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,OAAO;aACrC;SACF;KACF,CAAC,CAID,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC;QACpC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM;QAC9B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAQvC;IACC,MAAM,MAAM,GAAG,kCAAkC,CAAC;QAChD,QAAQ,EAAE,KAAK,CAAC,cAAc;QAC9B,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE;QACtE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;QACnC,iBAAiB,EAAE,SAAS;KAC7B,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACzD,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAQxC;IACC,MAAM,MAAM,GAAG,kCAAkC,CAAC;QAChD,QAAQ,EAAE,KAAK,CAAC,cAAc;QAC9B,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE;QACtE,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;QACjC,iBAAiB,EAAE,SAAS;KAC7B,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACzD,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAOzC;IACC,MAAM,MAAM,GAAG,kCAAkC,CAAC;QAChD,QAAQ,EAAE,KAAK,CAAC,cAAc;QAC9B,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,kCAAkC,CAAC,MAI3C;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAA2B;QACtC,CAAC,WAAW,CAAC,EAAE,MAAM;QACrB,CAAC,2BAA2B,CAAC,EAAE,MAAM;QACrC,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC,QAAQ;QACzC,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC,SAAS;KACzC,CAAC;IACF,OAAO,IAAI,MAAM,CAAC;QAChB,MAAM,EAAE,qBAAqB,EAAE;QAC/B,MAAM;QACN,cAAc,EAAE,OAAO;KACxB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,CACL,KAAK,KAAK,OAAO;QACjB,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,aAAa,CACxB,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,KAIpC;IACC,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO;QAC3B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE;QACzC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IAChE,MAAM,aAAa,GAAG,OAAO;QAC3B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE;QACzC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAA2B;QACtC,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM;QAC3B,CAAC,sBAAsB,CAAC,EAAE,KAAK,CAAC,cAAc,IAAI,OAAO;QACzD,CAAC,oBAAoB,CAAC,EAAE,KAAK,CAAC,eAAe;KAC9C,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACjD,CAAC;SAAM,IAAI,CAAC,YAAY,IAAI,aAAa,EAAE,CAAC;QAC1C,OAAO,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,MAAM,CAAC;QAChB,MAAM;QACN,MAAM;QACN,cAAc,EAAE,OAAO;KACxB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,OAAO,GAAG,aAAa,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACvD,OAAO,OAAO,CACZ,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE;QAC1C,CAAC,OAAO;YACN,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE;gBACtC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAAC,eAAuB;IACpD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE;QACvB,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE;QACvB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;KAClB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC"}

package/dist/namespaces.d.ts

@@ -7,7 +7,7 @@
  *
  * ```ts
  * channels.slack({ name: "Support Bot" });
- * connectors.mcp({ mcpServers: { docs: { transport: "http", url: "https://docs.example.com/mcp" } } });
+ * defineMcp({ servers: { docs: { transport: "http", url: "https://docs.example.com/mcp" } } });
  * defineSandbox({ defaultTimeout: 600 });
  * auth.supabase({ projectRef: "abc" });
  * ```
@@ -15,44 +15,27 @@
  * These are the only primitives the managed runtime will mount. A project
  * cannot contribute its own — `defineExtension` stays internal.
  */
-import { mcpConnector } from "./connectors/mcp/index.js";
 import { slackChannel } from "./channels/slack/index.js";
+import { defineMcp } from "./connectors/mcp/index.js";
 export { auth } from "./identity/index.js";
+/** @internal */
+export declare const CONNECTORS_MCP_DEPRECATION = "connectors.mcp(...) is deprecated; use defineMcp(...) instead. It will be removed in 0.8.0.";
 /**
- * Integrations: tools, HTTP routes, sandbox provisioning, inbound events, and
- * named messaging. Exported from `connectors/*`.
+ * @deprecated Use {@link defineMcp} instead. The `connectors` namespace will
+ * be removed in 0.8.0.
  *
- * Connector catalogs are MCP-only. Slack Events ingress lives on
- * {@link channels}.
- *
- * Docs live on this interface (not the value) so IDE hover on `connectors.<name>`
- * stays useful — TypeScript surfaces property docs from the annotation.
+ * Docs live on this interface so IDE hover on `connectors.mcp` stays useful.
  */
 export interface Connectors {
     /**
-     * Declare remote MCP servers (HTTP/SSE) whose tools load at agent-graph
-     * construction. Stdio servers are not supported.
-     *
-     * @example
-     * ```ts
-     * export const connector = connectors.mcp({
-     *   mcpServers: {
-     *     docs: { transport: "http", url: "https://docs.example.com/mcp" },
-     *   },
-     * });
-     * ```
-     *
-     * @see {@link mcpConnector}
+     * @deprecated Use {@link defineMcp} instead. `connectors.mcp` will be removed
+     * in 0.8.0.
      */
-    mcp: typeof mcpConnector;
+    mcp: typeof defineMcp;
 }
 /**
- * Integrations: tools, HTTP routes, sandbox provisioning, inbound events, and
- * named messaging. Exported from `connectors/*`.
- *
- * Factories are assigned by reference (same pattern as the Python namespace) so
- * signatures stay in step with the connector modules. Hover docs come from
- * {@link Connectors}.
+ * @deprecated Use {@link defineMcp} instead. The `connectors` namespace will
+ * be removed in 0.8.0.
  */
 export declare const connectors: Connectors;
 /**

package/dist/namespaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"namespaces.d.ts","sourceRoot":"","sources":["../src/namespaces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAE3C;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;;;;;OAcG;IACH,GAAG,EAAE,OAAO,YAAY,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,EAAE,UAExB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB;;;;;;;;;;;;;;OAcG;IACH,KAAK,EAAE,OAAO,YAAY,CAAC;CAC5B;AAED;;;GAGG;AACH,eAAO,MAAM,QAAQ,EAAE,QAEtB,CAAC"}
+{"version":3,"file":"namespaces.d.ts","sourceRoot":"","sources":["../src/namespaces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAMtD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAE3C,gBAAgB;AAChB,eAAO,MAAM,0BAA0B,gGACwD,CAAC;AAyBhG;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,GAAG,EAAE,OAAO,SAAS,CAAC;CACvB;AAED;;;GAGG;AACH,eAAO,MAAM,UAAU,EAAE,UAExB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB;;;;;;;;;;;;;;OAcG;IACH,KAAK,EAAE,OAAO,YAAY,CAAC;CAC5B;AAED;;;GAGG;AACH,eAAO,MAAM,QAAQ,EAAE,QAEtB,CAAC"}

package/dist/namespaces.js

@@ -7,7 +7,7 @@
  *
  * ```ts
  * channels.slack({ name: "Support Bot" });
- * connectors.mcp({ mcpServers: { docs: { transport: "http", url: "https://docs.example.com/mcp" } } });
+ * defineMcp({ servers: { docs: { transport: "http", url: "https://docs.example.com/mcp" } } });
  * defineSandbox({ defaultTimeout: 600 });
  * auth.supabase({ projectRef: "abc" });
  * ```
@@ -15,19 +15,36 @@
  * These are the only primitives the managed runtime will mount. A project
  * cannot contribute its own — `defineExtension` stays internal.
  */
-import { mcpConnector } from "./connectors/mcp/index.js";
 import { slackChannel } from "./channels/slack/index.js";
+import { defineMcp } from "./connectors/mcp/index.js";
 export { auth } from "./identity/index.js";
+/** @internal */
+export const CONNECTORS_MCP_DEPRECATION = "connectors.mcp(...) is deprecated; use defineMcp(...) instead. It will be removed in 0.8.0.";
+function emitConnectorsMcpDeprecation() {
+    if (typeof process !== "undefined" &&
+        typeof process.emitWarning === "function") {
+        process.emitWarning(CONNECTORS_MCP_DEPRECATION, {
+            type: "DeprecationWarning",
+            code: "MDA_CONNECTORS_MCP",
+        });
+        return;
+    }
+    console.warn(CONNECTORS_MCP_DEPRECATION);
+}
 /**
- * Integrations: tools, HTTP routes, sandbox provisioning, inbound events, and
- * named messaging. Exported from `connectors/*`.
- *
- * Factories are assigned by reference (same pattern as the Python namespace) so
- * signatures stay in step with the connector modules. Hover docs come from
- * {@link Connectors}.
+ * @deprecated Use {@link defineMcp} instead. `connectors.mcp` will be removed
+ * in 0.8.0.
+ */
+function deprecatedMcp(config) {
+    emitConnectorsMcpDeprecation();
+    return defineMcp(config);
+}
+/**
+ * @deprecated Use {@link defineMcp} instead. The `connectors` namespace will
+ * be removed in 0.8.0.
  */
 export const connectors = {
-    mcp: mcpConnector,
+    mcp: deprecatedMcp,
 };
 /**
  * Inbound messaging surfaces. Factories are assigned by reference so signatures

package/dist/namespaces.js.map

@@ -1 +1 @@
-{"version":3,"file":"namespaces.js","sourceRoot":"","sources":["../src/namespaces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AA+B3C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,GAAG,EAAE,YAAY;CAClB,CAAC;AA0BF;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAa;IAChC,KAAK,EAAE,YAAY;CACpB,CAAC"}
+{"version":3,"file":"namespaces.js","sourceRoot":"","sources":["../src/namespaces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAMtD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAE3C,gBAAgB;AAChB,MAAM,CAAC,MAAM,0BAA0B,GACrC,6FAA6F,CAAC;AAEhG,SAAS,4BAA4B;IACnC,IACE,OAAO,OAAO,KAAK,WAAW;QAC9B,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EACzC,CAAC;QACD,OAAO,CAAC,WAAW,CAAC,0BAA0B,EAAE;YAC9C,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,oBAAoB;SAC3B,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,MAAwB;IAC7C,4BAA4B,EAAE,CAAC;IAC/B,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAgBD;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,GAAG,EAAE,aAAa;CACnB,CAAC;AA0BF;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAa;IAChC,KAAK,EAAE,YAAY;CACpB,CAAC"}

package/dist/runtime/auth.d.ts

@@ -16,6 +16,12 @@ export declare const INGRESS_SECRET_HEADER = "x-mda-ingress-secret";
  */
 export declare const SOURCE_PROVIDER_HEADER = "x-mda-source-provider";
 export declare const SOURCE_THREAD_HEADER = "x-mda-source-thread-id";
+/**
+ * Trigger loopback stamp: the Agent Auth principal UUID from a verified
+ * `identity_context`. Accepted only after a trusted server credential, same as
+ * the other internal handoff headers. Not inferred from `x-mda-user-id` shape.
+ */
+export declare const AGENT_AUTH_PRINCIPAL_HEADER = "x-mda-agent-auth-principal-id";
 /** Deployment env var carrying the shared secret the trusted backend presents. */
 export declare const INGRESS_SECRET_ENV = "MDA_INGRESS_SECRET";
 /** Deploy/dev-owned credential used only for internal identity handoffs. */
@@ -29,23 +35,51 @@ export declare const LANGSMITH_API_KEY_ENV = "LANGSMITH_API_KEY";
 export declare const LANGCHAIN_API_KEY_ENV = "LANGCHAIN_API_KEY";
 /** Internal Trigger-channel principal used to start and observe Agent runs. */
 export declare const CHANNEL_SERVICE_USER = "mda:channel";
+/** Owner-key namespace for threads owned by a channel source conversation. */
+export declare const CHANNEL_THREAD_OWNER_PREFIX = "mda:source-thread:";
 /**
- * The user object `@auth.authenticate` returns. `identity`/`permissions` satisfy
- * the LangGraph base shape; the `mda_*` fields carry the identity envelope into
- * `config.configurable.langgraph_auth_user` for the runtime seam.
+ * LangGraph AuthUser returned by `@auth.authenticate` and stored on
+ * `langgraph_auth_user` / `serverInfo.user`.
+ *
+ * Transport for auth + authorization — not the author identity surface. Tools
+ * and middleware should read `runtime.serverInfo.principal` (Agent Auth–aligned
+ * caller). The `mda_*` stamps stay internal; the managed seam projects them
+ * into `principal` / `subject` / `link` on `serverInfo`.
  */
 export interface ManagedUser {
     identity: string;
     permissions: string[];
+    /** Subject id stamped by managed auth (internal; prefer `serverInfo.principal`). */
     mda_user_id: string;
     mda_user_email?: string;
-    /** Resolved group memberships; read-only, never an isolation key. */
+    /** Resolved group memberships; never an isolation key. */
     mda_groups?: string[];
     mda_claims?: Record<string, unknown>;
     /** Trusted source provider stamped by managed ingress (never client-supplied). */
     mda_source_provider?: string;
     /** Trusted source thread key stamped by managed channel ingress. */
     mda_source_thread_id?: string;
+    /**
+     * Validated-token provider id (`supabase`, …) for Agent Auth principal resolve.
+     * Never client-supplied.
+     */
+    mda_identity_provider?: string;
+    /**
+     * Verified IdP issuer (`iss`) for Agent Auth principal resolve.
+     * Never client-supplied.
+     */
+    mda_identity_issuer?: string;
+    /**
+     * Verified IdP subject (`sub`) for Agent Auth principal resolve.
+     * Never client-supplied; distinct from `mda_user_id` when `claims.user` is email.
+     */
+    mda_identity_subject?: string;
+    /**
+     * Agent Auth principal UUID when ingress already resolved one (Trigger
+     * `identity_context`). Credential ops use this; thread ownership still uses
+     * `mda_user_id`.
+     */
+    mda_agent_auth_principal_id?: string;
     [key: string]: unknown;
 }
 /**
@@ -55,6 +89,22 @@ export interface ManagedUser {
  * Also registers thread and store scoping with a studio bypass.
  */
 export declare function buildManagedAuth(identity: IdentityDefinition): Auth;
+/**
+ * Reject (403) every resource/action pair except reading or searching
+ * assistants, covering the resources managed auth does not scope per caller.
+ *
+ * `assistants` and `crons` are deployment-owned: assistants come from the
+ * compiled project and crons from `schedules/**`, both provisioned by `mda
+ * deploy` as a workspace/Studio principal. No runtime caller needs to mutate
+ * either, and `crons:create` accepts a `thread_id`, which would let a caller
+ * schedule a run against a thread the thread-ownership filter would otherwise
+ * put out of reach.
+ *
+ * Assistant reads stay open so clients can enumerate the deployment's agents;
+ * that exposes `graph_id` and assistant config, which is deploy-authored rather
+ * than caller data.
+ */
+export declare function denyUnlessAssistantRead(resource: string, action: string): void;
 /**
  * Resolve the caller's frozen {@link RuntimeIdentity} from a raw HTTP request,
  * using the same ingress logic (`trusted_backend` headers / `validated_token`
@@ -93,6 +143,12 @@ export declare const IDENTITY_LINKS_SERVICE_USER = "mda:identity-links";
  *
  * There is no per-caller store partition to enforce beyond that, because no
  * declaration mounts per-caller state in this release.
+ *
+ * Studio and local-dev principals are deliberately **not** exempt here. Studio
+ * identity is reachable by any holder of a workspace LangSmith API key (via the
+ * `x-auth-scheme: langsmith` ingress the Agent Server honours), and nothing
+ * legitimately reads these tables that way: the managed link client stamps
+ * {@link IDENTITY_LINKS_SERVICE_USER} behind the handoff/ingress secret.
  */
 export declare function assertStoreAccess(user: ManagedUser, value: unknown): void;
 /**
@@ -124,7 +180,22 @@ export declare function isLocalDevUnscopedUser(user: unknown): boolean;
  * present (so the normal trusted-backend path runs).
  */
 export declare function tryLocalDevTrustedUser(_cfg: IdentityConfig, request: Request): ManagedUser | null;
-/** Derive the owner value `@auth.on.threads` filters on (the caller user id). */
+/**
+ * Derive the owner value `@auth.on.threads` filters on.
+ *
+ * A managed channel thread is owned by its source conversation; every other
+ * caller owns its threads by user id. Channel threads are addressed by
+ * `source_thread_key` and the deliveries that reach one can legitimately carry
+ * different principals: the Trigger Server does not attach `identity_context`
+ * to every envelope, and any participant may reply in a shared thread or answer
+ * an interrupt someone else raised. Keying such a thread on the delivering
+ * principal denies every later delivery that does not match.
+ *
+ * Only managed ingress sets both source stamps, and only over a trusted
+ * loopback credential — a client presenting them is rejected in
+ * {@link rejectUntrustedHandoffHeaders}. `mda_user_id` still carries the
+ * principal, so credential resolution and store scoping stay per caller.
+ */
 export declare function threadOwnerKey(user: ManagedUser): string;
 /** True when the request targets a public channel/connector Events ingress route. */
 export declare function isChannelEventsRequest(request: Request): boolean;

package/dist/runtime/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/runtime/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EAGL,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EAEvB,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAC;AAI9B;;;;;GAKG;AACH,oFAAoF;AACpF,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,qBAAqB,yBAAyB,CAAC;AAC5D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,0BAA0B,CAAC;AAC9D,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAE7D,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,qBAAqB,yBAAyB,CAAC;AAE5D,mDAAmD;AACnD,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AACrE,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,eAAO,MAAM,wBAAwB,cAAc,CAAC;AACpD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,gBAAgB,CAAC;AAuClD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,kFAAkF;IAClF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oEAAoE;IACpE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAkDnE;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,eAAe,CAAC,CA4B1B;AAED,uEAAuE;AACvE,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAEhE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,2BAA2B,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAsBzE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,WAAW,CASb;AA+FD,8EAA8E;AAC9E,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,WAAW,CAAC,CA+EtB;AAiBD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAgB7D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,OAAO,GACf,WAAW,GAAG,IAAI,CASpB;AAYD,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAExD;AAkBD,qFAAqF;AACrF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAQhE;AAED,gFAAgF;AAChF,wBAAgB,uBAAuB,IAAI,WAAW,CAMrD"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/runtime/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EAGL,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EAEvB,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAC;AAI9B;;;;;GAKG;AACH,oFAAoF;AACpF,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,qBAAqB,yBAAyB,CAAC;AAC5D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,0BAA0B,CAAC;AAC9D,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,kCAAkC,CAAC;AAE3E,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,qBAAqB,yBAAyB,CAAC;AAE5D,mDAAmD;AACnD,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AACrE,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,eAAO,MAAM,wBAAwB,cAAc,CAAC;AACpD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,gBAAgB,CAAC;AAuClD,8EAA8E;AAC9E,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAEhE;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,kFAAkF;IAClF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oEAAoE;IACpE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CA0EnE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,IAAI,CAON;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,eAAe,CAAC,CA4B1B;AAED,uEAAuE;AACvE,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAEhE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,2BAA2B,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAsBzE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,GACf,WAAW,CASb;AAuGD,8EAA8E;AAC9E,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,WAAW,CAAC,CA+EtB;AAiBD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAgB7D;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,OAAO,GACf,WAAW,GAAG,IAAI,CASpB;AAYD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAUxD;AAsCD,qFAAqF;AACrF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAQhE;AAED,gFAAgF;AAChF,wBAAgB,uBAAuB,IAAI,WAAW,CAMrD"}