/**
 * http.ts — multi-tenant streamable-HTTP entry for mcp-slack (Abel, 2026-07-16).
 *
 * ONE process serves every legate: the bearer key ("badge") on each request picks
 * the identity. URLs keep the per-legate shape (/claudia/mcp, /florence/mcp, ...)
 * so nothing wired against the process-per-legate deployment changes.
 *
 * Boot:
 *   1. Fetch the badge map from ASM (AUTH_KEYS_SECRET_ID, default
 *      mcp-remote-legate-keys): { legate: badgeKey, ... }. Non-legate entries
 *      (e.g. "render") are ignored via SLACK_SECRET_SUFFIX probing — a legate is
 *      any key whose `<name>-slack-app` secret exists.
 *   2. Pre-fetch each legate's token bundle once and cache it — sessions are then
 *      cheap (no per-session ASM round-trip).
 *
 * Per session: a fresh SlackerV3Server instance bound to that legate's tokens via
 * constructor injection, connected to its own StreamableHTTPServerTransport.
 * Auth is validated on EVERY request (initialize and after), not just at session
 * start, so a stolen session id without the badge is useless.
 */
export {};
//# sourceMappingURL=http.d.ts.map