@alpacakit/agents-conventions 0.1.0-beta.36 → 0.1.0-beta.39

package/README.md

@@ -1,12 +1,132 @@
 # @alpacakit/agents-conventions
 
-AlpacaLoop-family conventions for [`@alpacakit/agents`](../agents) machine-local
-config: the `ALPACA_AGENTS_HOME` / `~/.alpaca/agents` config root, the
-`alpacaloop.agents-home` keyring service, and the managed-home layout shared
-by AlpacaLoop-family products (the CLI, promptopt, codehint).
-
-This package is published with the other `@alpacakit/*` libraries. It is a
-plain consumer of the neutral `@alpacakit/agents` public API — the same shape
-any third party would write for their own convention. The general library
-ships a convention-neutral `@alpacakit/agents/config/xdg` preset; this package
-provides the AlpacaLoop-specific instance.
+The AlpacaKit family's **shared agents home**: where it lives, how an agent is
+registered into it, and the `agent` command every family product mounts.
+
+This lives outside the neutral [`@alpacakit/agents`](../agents) package on
+purpose. It encodes the family's `ALPACA_AGENTS_HOME` / `~/.alpaca/agents`
+config root, the `alpaca.agents` keychain service, the managed-home layout, and
+— the part that matters most — the **order and failure policy** of registering
+a credential. It is a plain consumer of the agents package's public API: the
+same shape any third party would write for their own convention. The general
+library ships a convention-neutral `@alpacakit/agents/config/xdg` preset; this
+package is the AlpacaKit-specific instance.
+
+## Procedures
+
+Every procedure takes `{ homeDir, env }` and opens the same shared home.
+`ports` and `keyring` are injectable so tests drive the real path without a
+subprocess or a real keychain. Expected outcomes come back as a result type
+with a `kind`; only faults throw.
+
+| Procedure | Result kinds |
+|---|---|
+| `listAgentsHome` | `{ agentsHome, entries }` — every candidate with its readiness |
+| `loginManagedHome` | `registered` / `profile_exists` / `unknown_agent` / `unsupported` / `login_failed` |
+| `addApiKeyProfile` | `registered` / `profile_exists` / `empty_key` |
+| `addAgentConfig` | `added` / `exists` |
+| `removeAgentsHomeEntry` | `removed_profile` / `removed_agent_config` / `not_found` |
+
+Every procedure that takes a record name can also answer `invalid_name`
+(carrying the `rule` in words, so a product need not restate the grammar).
+
+The policies these procedures own, so no product re-decides them:
+
+- **`listAgentsHome`** probes a profile-backed candidate with that profile's
+  environment applied — the same `auth.toEnv` patch a run gets — so it can
+  never report the ambient login for a profile that has its own credential. An
+  agent that declares no availability probe reports `null`, not a guess.
+- **`loginManagedHome`** writes no profile when the sign-in fails, but keeps
+  the managed home so a retry resumes from it. A sign-in that succeeds and then
+  cannot be recorded is a **fault**, not a result: discarding a completed
+  browser flow would leave a live credential nobody knows about. An id this
+  home does not have (`unknown_agent`) is kept apart from a method the agent
+  does not offer (`unsupported`) — the two have different fixes.
+- **`addApiKeyProfile`** rejects a blank key (`empty_key`) before touching the
+  keychain, stores the key trimmed so a piped newline never reaches the
+  provider, then references it — and removes the stored key again if the
+  reference cannot be written.
+- **`addAgentConfig`** dispatches on `input.kind`, the same discriminator
+  `agent add --kind` carries, so the CLI projection is the input verbatim.
+- **Record names** (profile ids, agent config ids) match
+  `^[a-z0-9][a-z0-9._-]{0,63}$`. A name is not free text: it becomes a path
+  segment under `managed-homes/` and a segment of a keychain account, so an
+  unconstrained one would decide where this package writes and what it deletes.
+  `/cli` rejects it at the codec and the procedures repeat the check for
+  callers that skip the CLI; `resolveManagedHomePath` throws rather than build
+  a path outside the shared home.
+- **`removeAgentsHomeEntry`** removes the record first, then only the artifacts
+  this package created. A home the operator pointed at themselves, and a secret
+  behind someone else's resolver, are left alone.
+
+```ts
+import { loginManagedHome } from "@alpacakit/agents-conventions";
+
+const result = await loginManagedHome({
+  homeDir: os.homedir(),
+  env: process.env,
+  profileId: "judge-codex",
+  agentId: "codex",
+  method: "oauth",
+  onEvent: (event) => render(event),
+});
+```
+
+## `@alpacakit/agents-conventions/cli`
+
+The shared `agent` Endpoint tree — no `bin`, parser, output writer, or startup
+I/O. It owns the command paths, flags, procedure-input projection, and five
+thin procedure handlers, so `alpacaloop agent login` and
+`promptopt agent login` execute the same operation. Collecting the tree and
+rendering help do not open the agents home, keyring, login process, or stdin.
+
+```
+agent list
+agent login <PROFILE> --agent <claude|codex> [--method oauth|device]
+agent credential add <PROFILE> --agent <ID> --stdin   (--stdin is required)
+agent add <ID> --kind openai-compatible --base-url <URL> --model <M>
+                [--api-key-env <VAR>] [--engine fetch|pi]
+agent remove <NAME>
+```
+
+Mount the node in the product's tree. The host parser passes only explicitly
+supplied canonical parameter names to `parseOptions`; after it succeeds, the
+host supplies an invocation-scoped `AgentEntryContext` and calls the collected
+handler directly:
+
+```ts
+import {
+  AGENT_CLI_SURFACE,
+  type AgentEntryContext,
+} from "@alpacakit/agents-conventions/cli";
+import { collectCliCommands } from "@alpacakit/channels/cli";
+
+const view = collectCliCommands(AGENT_CLI_SURFACE.node);
+// During host action registration, for each collected command:
+const input = command.input.parseOptions(explicitCanonicalValues);
+const outcome = await command.handler(input, context satisfies AgentEntryContext);
+render(outcome); // text, JSON envelope, redaction, and exit status are host-owned
+```
+
+`AgentEntryContext` contains `{ homeDir, env, ports?, keyring?,
+readCredentialSecret, onLoginEvent, signal? }`. `onLoginEvent` receives the
+typed `LoginEvent`; the host decides how to display it. `--stdin` identifies
+the input source: only the credential-add handler calls
+`readCredentialSecret()`, once, after input validation succeeds.
+
+Each handler returns `AgentEntryOutcome`, discriminated by the corresponding
+`AGENT_ENTRY_NAME` in `operation`, with the unchanged procedure result in
+`result`. This is not a CLI text/JSON envelope and carries no exit or
+presentation policy. Optional flags stay absent when unset — `--engine` is
+defaulted once by the persisted agent-config payload. The addable kinds
+(`AGENT_ADD_KIND`) remain on the root export beside the procedure that acts on
+them; `/cli` only spells them as a flag.
+
+`AGENT_CLI_SURFACE.outputs.<operation>.schema` remains the explicit validator
+for the inner procedure result used by existing projectors. It intentionally
+does not validate the tagged `AgentEntryOutcome` wrapper; presentation code
+selects the operation and validates `outcome.result` when required.
+
+`@alpacakit/channels` and `zod` are **peer** dependencies of this package: they
+are needed only by `/cli`, so importing the procedures never drags a CLI
+framework in.

package/dist/cli-output.d.ts

@@ -0,0 +1,209 @@
+/**
+ * The JSON shape of every `agent` command result. These are the CONTRACT, not
+ * a convenience: an app may render the result any way it likes, but what it
+ * emits as data is fixed here so `alpacaloop agent list --json` and
+ * `promptopt agent list --json` are the same document.
+ */
+import { z } from "zod";
+export declare const profileSchema: z.ZodObject<{
+    id: z.ZodString;
+    agentId: z.ZodString;
+    material: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"home-dir">;
+        path: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"api-key">;
+        secret: z.ZodObject<{
+            resolver: z.ZodString;
+            id: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>;
+export declare const agentConfigSchema: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodString;
+    enabled: z.ZodBoolean;
+    payload: z.ZodRecord<z.ZodString, z.ZodType<import("@alpacakit/agents").JsonValue, unknown, z.core.$ZodTypeInternals<import("@alpacakit/agents").JsonValue, unknown>>>;
+}, z.core.$strict>;
+/** `null` when the agent declares no availability probe at all. */
+export declare const availabilitySchema: z.ZodNullable<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    status: z.ZodLiteral<"runnable">;
+}, z.core.$strict>, z.ZodObject<{
+    status: z.ZodLiteral<"unavailable">;
+    reason: z.ZodEnum<{
+        command_missing: "command_missing";
+        authentication_required: "authentication_required";
+    }>;
+    remediation: z.ZodNullable<z.ZodObject<{
+        detail: z.ZodString;
+        command: z.ZodNullable<z.ZodObject<{
+            executable: z.ZodString;
+            args: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+    status: z.ZodLiteral<"indeterminate">;
+    reason: z.ZodEnum<{
+        probe_timeout: "probe_timeout";
+        probe_fault: "probe_fault";
+    }>;
+    detail: z.ZodString;
+}, z.core.$strict>], "status">>;
+export declare const agentListOutputSchema: z.ZodObject<{
+    agentsHome: z.ZodString;
+    entries: z.ZodArray<z.ZodObject<{
+        agentId: z.ZodString;
+        agentConfigId: z.ZodString;
+        kind: z.ZodString;
+        source: z.ZodEnum<{
+            profile: "profile";
+            ambient: "ambient";
+            configured: "configured";
+        }>;
+        profileId: z.ZodNullable<z.ZodString>;
+        availability: z.ZodNullable<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            status: z.ZodLiteral<"runnable">;
+        }, z.core.$strict>, z.ZodObject<{
+            status: z.ZodLiteral<"unavailable">;
+            reason: z.ZodEnum<{
+                command_missing: "command_missing";
+                authentication_required: "authentication_required";
+            }>;
+            remediation: z.ZodNullable<z.ZodObject<{
+                detail: z.ZodString;
+                command: z.ZodNullable<z.ZodObject<{
+                    executable: z.ZodString;
+                    args: z.ZodArray<z.ZodString>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            status: z.ZodLiteral<"indeterminate">;
+            reason: z.ZodEnum<{
+                probe_timeout: "probe_timeout";
+                probe_fault: "probe_fault";
+            }>;
+            detail: z.ZodString;
+        }, z.core.$strict>], "status">>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const agentLoginOutputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"registered">;
+    profile: z.ZodObject<{
+        id: z.ZodString;
+        agentId: z.ZodString;
+        material: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"home-dir">;
+            path: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"api-key">;
+            secret: z.ZodObject<{
+                resolver: z.ZodString;
+                id: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>;
+    managedHome: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"profile_exists">;
+    profileId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"unknown_agent">;
+    agentId: z.ZodString;
+    known: z.ZodArray<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"unsupported">;
+    agentId: z.ZodString;
+    method: z.ZodString;
+    supported: z.ZodArray<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"login_failed">;
+    detail: z.ZodString;
+    managedHome: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"invalid_name">;
+    name: z.ZodString;
+    rule: z.ZodString;
+}, z.core.$strict>], "kind">;
+export declare const agentCredentialAddOutputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"registered">;
+    profile: z.ZodObject<{
+        id: z.ZodString;
+        agentId: z.ZodString;
+        material: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"home-dir">;
+            path: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"api-key">;
+            secret: z.ZodObject<{
+                resolver: z.ZodString;
+                id: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"profile_exists">;
+    profileId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"empty_key">;
+    profileId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"invalid_name">;
+    name: z.ZodString;
+    rule: z.ZodString;
+}, z.core.$strict>], "kind">;
+export declare const agentAddOutputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"added">;
+    agentConfig: z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodString;
+        enabled: z.ZodBoolean;
+        payload: z.ZodRecord<z.ZodString, z.ZodType<import("@alpacakit/agents").JsonValue, unknown, z.core.$ZodTypeInternals<import("@alpacakit/agents").JsonValue, unknown>>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"exists">;
+    id: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"invalid_name">;
+    name: z.ZodString;
+    rule: z.ZodString;
+}, z.core.$strict>], "kind">;
+export declare const agentRemoveOutputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"removed_profile">;
+    profile: z.ZodObject<{
+        id: z.ZodString;
+        agentId: z.ZodString;
+        material: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"home-dir">;
+            path: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"api-key">;
+            secret: z.ZodObject<{
+                resolver: z.ZodString;
+                id: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>;
+    removedManagedHome: z.ZodNullable<z.ZodString>;
+    removedSecret: z.ZodBoolean;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"removed_agent_config">;
+    agentConfig: z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodString;
+        enabled: z.ZodBoolean;
+        payload: z.ZodRecord<z.ZodString, z.ZodType<import("@alpacakit/agents").JsonValue, unknown, z.core.$ZodTypeInternals<import("@alpacakit/agents").JsonValue, unknown>>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"not_found">;
+    name: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"invalid_name">;
+    name: z.ZodString;
+    rule: z.ZodString;
+}, z.core.$strict>], "kind">;
+export type AgentListOutput = z.infer<typeof agentListOutputSchema>;
+export type AgentLoginOutput = z.infer<typeof agentLoginOutputSchema>;
+export type AgentCredentialAddOutput = z.infer<typeof agentCredentialAddOutputSchema>;
+export type AgentAddOutput = z.infer<typeof agentAddOutputSchema>;
+export type AgentRemoveOutput = z.infer<typeof agentRemoveOutputSchema>;
+//# sourceMappingURL=cli-output.d.ts.map

package/dist/cli-output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-output.d.ts","sourceRoot":"","sources":["../src/cli-output.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA+BxB,eAAO,MAAM,aAAa;;;;;;;;;;;;;kBAMf,CAAC;AAEZ,eAAO,MAAM,iBAAiB;;;;;kBAOnB,CAAC;AAYZ,mEAAmE;AACnE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;+BA0BlB,CAAC;AAWd,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAoBvB,CAAC;AAEZ,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAwClC,CAAC;AAEF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;4BAuB1C,CAAC;AAEF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;4BAc/B,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAyBnC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/cli-output.js

@@ -0,0 +1,208 @@
+/**
+ * The JSON shape of every `agent` command result. These are the CONTRACT, not
+ * a convenience: an app may render the result any way it likes, but what it
+ * emits as data is fixed here so `alpacaloop agent list --json` and
+ * `promptopt agent list --json` are the same document.
+ */
+import { AGENT_AVAILABILITY_STATUS, AGENT_INDETERMINATE_REASON, AGENT_UNAVAILABLE_REASON, AUTH_MATERIAL_KIND, } from "@alpacakit/agents";
+import { CANDIDATE_SOURCE_KIND } from "@alpacakit/agents/config";
+import { jsonValueSchema } from "@alpacakit/core";
+import { z } from "zod";
+import { INVALID_NAME_RESULT_KIND } from "./names.js";
+import { ADD_AGENT_CONFIG_RESULT, ADD_API_KEY_PROFILE_RESULT, LOGIN_MANAGED_HOME_RESULT, } from "./register.js";
+import { REMOVE_AGENTS_HOME_ENTRY_RESULT } from "./remove.js";
+const RESULT_DISCRIMINATOR = "kind";
+const AVAILABILITY_DISCRIMINATOR = "status";
+const secretRefSchema = z
+    .object({ resolver: z.string(), id: z.string() })
+    .strict();
+const authMaterialSchema = z.discriminatedUnion(RESULT_DISCRIMINATOR, [
+    z
+        .object({
+        kind: z.literal(AUTH_MATERIAL_KIND.homeDir),
+        path: z.string(),
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal(AUTH_MATERIAL_KIND.apiKey),
+        secret: secretRefSchema,
+    })
+        .strict(),
+]);
+export const profileSchema = z
+    .object({
+    id: z.string(),
+    agentId: z.string(),
+    material: authMaterialSchema,
+})
+    .strict();
+export const agentConfigSchema = z
+    .object({
+    id: z.string(),
+    kind: z.string(),
+    enabled: z.boolean(),
+    payload: z.record(z.string(), jsonValueSchema),
+})
+    .strict();
+const remediationSchema = z
+    .object({
+    detail: z.string(),
+    command: z
+        .object({ executable: z.string(), args: z.array(z.string()) })
+        .strict()
+        .nullable(),
+})
+    .strict();
+/** `null` when the agent declares no availability probe at all. */
+export const availabilitySchema = z
+    .discriminatedUnion(AVAILABILITY_DISCRIMINATOR, [
+    z
+        .object({ status: z.literal(AGENT_AVAILABILITY_STATUS.runnable) })
+        .strict(),
+    z
+        .object({
+        status: z.literal(AGENT_AVAILABILITY_STATUS.unavailable),
+        reason: z.enum([
+            AGENT_UNAVAILABLE_REASON.commandMissing,
+            AGENT_UNAVAILABLE_REASON.authenticationRequired,
+        ]),
+        remediation: remediationSchema.nullable(),
+    })
+        .strict(),
+    z
+        .object({
+        status: z.literal(AGENT_AVAILABILITY_STATUS.indeterminate),
+        reason: z.enum([
+            AGENT_INDETERMINATE_REASON.probeTimeout,
+            AGENT_INDETERMINATE_REASON.probeFault,
+        ]),
+        detail: z.string(),
+    })
+        .strict(),
+])
+    .nullable();
+/** The rejection every name-taking command shares (`InvalidNameResult`). */
+const invalidNameSchema = z
+    .object({
+    kind: z.literal(INVALID_NAME_RESULT_KIND),
+    name: z.string(),
+    rule: z.string(),
+})
+    .strict();
+export const agentListOutputSchema = z
+    .object({
+    agentsHome: z.string(),
+    entries: z.array(z
+        .object({
+        agentId: z.string(),
+        agentConfigId: z.string(),
+        kind: z.string(),
+        source: z.enum([
+            CANDIDATE_SOURCE_KIND.profile,
+            CANDIDATE_SOURCE_KIND.ambient,
+            CANDIDATE_SOURCE_KIND.configured,
+        ]),
+        profileId: z.string().nullable(),
+        availability: availabilitySchema,
+    })
+        .strict()),
+})
+    .strict();
+export const agentLoginOutputSchema = z.discriminatedUnion(RESULT_DISCRIMINATOR, [
+    z
+        .object({
+        kind: z.literal(LOGIN_MANAGED_HOME_RESULT.registered),
+        profile: profileSchema,
+        managedHome: z.string(),
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal(LOGIN_MANAGED_HOME_RESULT.profileExists),
+        profileId: z.string(),
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal(LOGIN_MANAGED_HOME_RESULT.unknownAgent),
+        agentId: z.string(),
+        known: z.array(z.string()),
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal(LOGIN_MANAGED_HOME_RESULT.unsupported),
+        agentId: z.string(),
+        method: z.string(),
+        supported: z.array(z.string()),
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal(LOGIN_MANAGED_HOME_RESULT.loginFailed),
+        detail: z.string(),
+        managedHome: z.string(),
+    })
+        .strict(),
+    invalidNameSchema,
+]);
+export const agentCredentialAddOutputSchema = z.discriminatedUnion(RESULT_DISCRIMINATOR, [
+    z
+        .object({
+        kind: z.literal(ADD_API_KEY_PROFILE_RESULT.registered),
+        profile: profileSchema,
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal(ADD_API_KEY_PROFILE_RESULT.profileExists),
+        profileId: z.string(),
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal(ADD_API_KEY_PROFILE_RESULT.emptyKey),
+        profileId: z.string(),
+    })
+        .strict(),
+    invalidNameSchema,
+]);
+export const agentAddOutputSchema = z.discriminatedUnion(RESULT_DISCRIMINATOR, [
+    z
+        .object({
+        kind: z.literal(ADD_AGENT_CONFIG_RESULT.added),
+        agentConfig: agentConfigSchema,
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal(ADD_AGENT_CONFIG_RESULT.exists),
+        id: z.string(),
+    })
+        .strict(),
+    invalidNameSchema,
+]);
+export const agentRemoveOutputSchema = z.discriminatedUnion(RESULT_DISCRIMINATOR, [
+    z
+        .object({
+        kind: z.literal(REMOVE_AGENTS_HOME_ENTRY_RESULT.removedProfile),
+        profile: profileSchema,
+        removedManagedHome: z.string().nullable(),
+        removedSecret: z.boolean(),
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal(REMOVE_AGENTS_HOME_ENTRY_RESULT.removedAgentConfig),
+        agentConfig: agentConfigSchema,
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal(REMOVE_AGENTS_HOME_ENTRY_RESULT.notFound),
+        name: z.string(),
+    })
+        .strict(),
+    invalidNameSchema,
+]);