@gajae-code/coding-agent 0.13.2 → 0.14.0

package/dist/types/sdk/prompt-status.d.ts

@@ -1,5 +1,6 @@
 /**
- * Public DTO contract for Q26 `turn.prompt_status` and the `clientRef`
+ * Public prompt-result DTO contract for canonical Q26 `turn.result` with
+ * `kind: "prompt"`, plus the legacy `turn.prompt_status` alias and the `clientRef`
  * correlation field on `turn.prompt`.
  *
  * Semantics:
@@ -13,14 +14,14 @@
  * - The clientRef index is scoped to one live session runtime: identical refs
  *   may coexist in different sessions, lookups never cross sessions, a ref
  *   conflicts only while its record is retained (`client_ref_conflict`), and
- *   after terminal TTL/capacity eviction a ref may be admitted again with the
+ *   after terminal capacity eviction a ref may be admitted again with the
  *   prior outcome unknown — callers MUST NOT reuse a clientRef as a retry
  *   mechanism and MUST treat `unknown` as uncertainty, not proof of
  *   non-execution.
  * - Prompt records survive process restart: an active prompt is finalized from its
  *   durable pending outcome, or as `prompt_failed` when it has none. Only skill
  *   records settle as `process_restart`, and a lookup reports `unknown` only after
- *   retained-record TTL/capacity eviction.
+ *   retained-record capacity eviction.
  * - Q26 tracks prompts accepted through the SDK control surface (which always
  *   carries a requesting connection); submissions without a delivery owner are
  *   outside the reconciliation contract and hold no reservation.
@@ -47,6 +48,7 @@ export interface TurnPromptInput {
  * prompt that is active at process restart is finalized from its durable pending
  * outcome (or `prompt_failed` when it has none), so it never reports as unknown.
  */
+import type { ReceiptState } from "./receipt-state";
 export type PromptReconciliationStatus = "accepted" | "in_flight" | "terminal_ok" | "failed";
 export type SdkPromptStopReason = "end_turn" | "max_tokens" | "max_turn_requests" | "refusal" | "cancelled";
 export type SdkPromptFailureCode = "prompt_failed" | "prompt_deadline_exceeded";
@@ -76,14 +78,17 @@ interface TurnPromptReconciliationIdentity {
 }
 export interface TurnPromptReconciliationAccepted extends TurnPromptReconciliationIdentity {
     status: "accepted";
+    receiptState: Extract<ReceiptState, "absent">;
 }
 export interface TurnPromptReconciliationInFlight extends TurnPromptReconciliationIdentity {
     status: "in_flight";
+    receiptState: Extract<ReceiptState, "absent">;
     /** Epoch milliseconds of the agent_start transition. */
     startedAt: number;
 }
 export interface TurnPromptReconciliationTerminalOk extends TurnPromptReconciliationIdentity {
     status: "terminal_ok";
+    receiptState: Exclude<ReceiptState, "absent">;
     startedAt?: number;
     /** Epoch milliseconds of the terminal transition. */
     terminalAt: number;
@@ -96,6 +101,7 @@ export interface TurnPromptReconciliationTerminalOk extends TurnPromptReconcilia
 }
 export interface TurnPromptReconciliationFailed extends TurnPromptReconciliationIdentity {
     status: "failed";
+    receiptState: Exclude<ReceiptState, "absent">;
     startedAt?: number;
     terminalAt: number;
     /** Bounded, sanitized failure detail (code safe-token ≤64, message ≤512). */
@@ -107,6 +113,7 @@ export interface TurnPromptReconciliationFailed extends TurnPromptReconciliation
 }
 export interface TurnPromptReconciliationUnknown {
     status: "unknown";
+    receiptState: Extract<ReceiptState, "unknown">;
 }
 export type TurnPromptReconciliation = TurnPromptReconciliationAccepted | TurnPromptReconciliationInFlight | TurnPromptReconciliationTerminalOk | TurnPromptReconciliationFailed | TurnPromptReconciliationUnknown;
 /** Result of a successful `turn.prompt` preflight acknowledgement. */

package/dist/types/sdk/protocol/operation-registry.d.ts

@@ -4,6 +4,9 @@ export type AdapterDisposition = "native_alias" | "generic_safe" | "machine_only
 export type OperationKind = "control" | "global" | "query" | "reverse";
 export type Idempotency = "idempotent" | "ordered" | "fast_lane";
 export type QueryContinuityClass = "stable_prefix" | "retained_revision" | "scalar_snapshot" | "content_addressed";
+/** Legacy kind-specific selectors for canonical Q26 `turn.result`. */
+export declare const TURN_RESULT_PROMPT_ALIAS = "turn.prompt_status";
+export declare const TURN_RESULT_SKILL_ALIAS = "skill.invoke_status";
 export interface Operation {
     id: string;
     sdkId: string;
@@ -13,6 +16,8 @@ export interface Operation {
     errorCodes: string[];
     revisionResource?: string;
     continuityClass?: QueryContinuityClass;
+    /** Non-canonical request IDs that resolve to this operation's contract. */
+    aliases?: readonly string[];
     adapterDispositions: Record<Adapter, AdapterDisposition>;
     testIds: string[];
 }

package/dist/types/sdk/receipt-state.d.ts

@@ -0,0 +1,17 @@
+export type ReceiptState = "absent" | "present" | "missing" | "unknown";
+export type ExecutionState = "accepted" | "in_flight" | "terminal_ok" | "failed" | "cancelled" | "unknown";
+export interface ReceiptSource {
+    text?: string | null;
+    artifactPath?: string | null;
+}
+export interface TerminalReceiptInput {
+    execution: "accepted" | "in_flight" | "completed" | "failed" | "cancelled" | "unknown";
+    reportable: boolean;
+}
+export interface TerminalReceiptState {
+    execution: ExecutionState;
+    receipt: ReceiptState;
+}
+export declare function reportableReceipt({ text, artifactPath }: ReceiptSource): boolean;
+export declare function receiptStateForTerminal(source: ReceiptSource): Extract<ReceiptState, "present" | "missing">;
+export declare function reduceTerminalReceiptState(input: TerminalReceiptInput): TerminalReceiptState;

package/dist/types/sdk/reconciliation-extensions.d.ts

@@ -0,0 +1,2 @@
+export { createKindAwareReconciliation, type KindAwareReconciliation, type ReconciliationKind, type SteerReconciliationResult, } from "./bus/kind-aware-reconciliation";
+export { createReconciliationStore, type DurableExecutionReconciliationRecord, type DurableReconciliationRecord, type DurableSteerReconciliationRecord, type ReconciliationStore, resolveReconciliationSessionFile, } from "./bus/reconciliation-store";

package/dist/types/sdk/router/index.d.ts

@@ -0,0 +1 @@
+export * from "./session-router";

package/dist/types/sdk/router/session-router.d.ts

@@ -0,0 +1,152 @@
+import { type SessionIndex } from "../broker/session-index";
+import { type ActivatedPreparedSession } from "../session-activation";
+/**
+ * Exact identity of one attached SDK session endpoint. Providers persist it next to
+ * their conversation state and re-prove it before every resume, so it must be derived
+ * in exactly one place: a caller that recomputes the digest by hand silently stops
+ * matching the moment the bound fields change.
+ */
+export declare function sessionAttachmentAuthorityId(input: {
+    sessionId: string;
+    generation: number;
+    pid: number;
+    endpointMtimeMs: number | undefined;
+    url: string;
+    token: string;
+}): string;
+/** The only capability a provider may retain for an attached SDK session. */
+export interface SessionAttachment {
+    readonly sessionId: string;
+    readonly authorityId?: string;
+    /** Current Router-owned transport identity for this exact attachment's reverse leases. */
+    readonly connectionId?: string;
+    readonly generation: number;
+    isCurrent(): boolean;
+    send(frame: Record<string, unknown>): unknown;
+    /** Revoke this exact capability after provider admission or replay fails closed. */
+    retire?(): Promise<void>;
+}
+/**
+ * Provider-local notification capability. This is deliberately not an
+ * attachment lease: it carries no endpoint, connection, generation, or
+ * authority identity and its cancellation can only stop this subscription.
+ */
+export interface NotificationSubscription {
+    readonly sessionId: string;
+    readonly subscriptionId: string;
+    readonly cursor: {
+        readonly generation: number;
+        readonly seq: number;
+    };
+    readonly isActive: () => boolean;
+    readonly send: (frame: Record<string, unknown>) => unknown;
+    readonly advanceCursor: (generation: number, seq: number) => void;
+    readonly cancel: (reason?: string) => void;
+}
+export type NotificationCleanupState = "pending" | "failed" | "completed";
+export interface NotificationCleanupReceipt {
+    readonly subscriptionId: string;
+    readonly sessionId: string;
+    readonly state: NotificationCleanupState;
+    readonly reason?: string;
+}
+/** The transport surface Router keeps private behind its attachment capabilities. */
+export interface SessionRouterClient {
+    onFrame(handler: (frame: Record<string, unknown>) => void): () => void;
+    onReconnect?(handler: () => void): () => void;
+    connect?(): Promise<void>;
+    request(frame: Record<string, unknown>, options?: {
+        timeoutMs?: number;
+    }): Promise<Record<string, unknown>>;
+    /** Current private transport connection identity, surfaced only through its exact attachment. */
+    readonly connectionId?: string;
+    close(): Promise<void>;
+    send(frame: Record<string, unknown>): void;
+}
+/** One frame after the caller's envelope/payload identity correlation. */
+export interface SessionRouterFrame {
+    readonly body: Record<string, unknown>;
+    readonly name: string | undefined;
+    readonly sessionId: string | undefined;
+    readonly generation: number | undefined;
+    readonly commandId?: string;
+    readonly turnId?: string;
+    readonly publicationId?: string;
+    readonly seq?: number;
+}
+export type SessionRouterFrameCorrelator = (frame: Record<string, unknown>) => SessionRouterFrame | undefined;
+export interface SessionRouterDeps {
+    createClient?: (authority: {
+        readonly sessionId: string;
+        readonly generation: number;
+        readonly pid: number;
+        readonly endpointMtimeMs: number;
+    }) => Promise<SessionRouterClient>;
+    createIndex?: (agentDir: string) => SessionIndex;
+    createBrokerClient?: () => Promise<SessionRouterClient>;
+    /** Receives only an opaque capability and correlated provider-neutral frames. */
+    onFrame?: (attachment: SessionAttachment, frame: SessionRouterFrame) => Promise<void> | void;
+    onAttachment?: (attachment: SessionAttachment) => Promise<void> | void;
+    /** Called only after the opaque capability becomes externally current. */
+    onAttachmentReady?: (attachment: SessionAttachment) => Promise<void> | void;
+    /** Called when the Broker index no longer reports an attached session as live. */
+    onSessionRemoved?: (attachment: SessionAttachment, reason?: "removed" | "replaced" | "replaced_same_generation") => Promise<void> | void;
+    /** Narrow provider surface for notification consumers such as Telegram. */
+    onNotificationSubscription?: (subscription: NotificationSubscription) => Promise<void> | void;
+    onNotificationSubscriptionReady?: (subscription: NotificationSubscription) => Promise<void> | void;
+    onNotificationFrame?: (subscription: NotificationSubscription, frame: SessionRouterFrame) => Promise<void> | void;
+    onNotificationSubscriptionRemoved?: (subscription: NotificationSubscription, reason?: "removed" | "replaced" | "replaced_same_generation" | "cancelled") => Promise<void> | void;
+    onReconciled?: () => void;
+    setInterval?: typeof setInterval;
+    clearInterval?: typeof clearInterval;
+    setTimeout?: typeof setTimeout;
+    clearTimeout?: typeof clearTimeout;
+}
+export type SessionRouterProviderDeps = Pick<SessionRouterDeps, "createClient" | "createIndex" | "createBrokerClient" | "setInterval" | "clearInterval" | "setTimeout" | "clearTimeout" | "onReconciled">;
+export interface SessionRouterOptions {
+    agentDir: string;
+    deps?: SessionRouterDeps;
+    /** Runtime-specific identity validation; Router supplies a conservative fallback. */
+    correlateFrame?: SessionRouterFrameCorrelator;
+}
+export type SessionRouterErrorPhase = "pre_send" | "ambiguous";
+export declare class SessionRouterError extends Error {
+    readonly phase: SessionRouterErrorPhase;
+    constructor(phase: SessionRouterErrorPhase, message?: string);
+}
+/**
+ * Broker-index-backed SDK attachment authority. Providers receive only opaque
+ * attachment capabilities; endpoint records and SDK clients remain here.
+ */
+export declare class SessionRouter {
+    #private;
+    constructor(options: SessionRouterOptions);
+    /** Provider-local cleanup outcomes; core authority never depends on these. */
+    notificationCleanupReceipts(): NotificationCleanupReceipt[];
+    isReady(): boolean;
+    /** Starts reconciliation and the index watcher. */
+    start(): Promise<void>;
+    /** Exposed for deterministic callers and reconciliation tests. */
+    reconcile(): Promise<void>;
+    /** Ingests a credential-bearing Broker lifecycle result directly into Router custody. */
+    adoptLifecycleResult(value: unknown, fallback: {
+        sessionId: string;
+        cwd: string;
+    }): Promise<SessionAttachment>;
+    stop(): Promise<void>;
+    /** Returns an opaque lease only while the exact attachment generation is live. */
+    attachment(sessionId: string, expectedGeneration?: number): SessionAttachment | null;
+    /** Sends an SDK command through the current attachment without exposing its client. */
+    request(sessionId: string, frame: Record<string, unknown>, expectedGeneration?: number, expectedAttachment?: SessionAttachment, options?: {
+        timeoutMs?: number;
+    }): Promise<Record<string, unknown>>;
+    /** Resolves the exact provider-neutral binding authority for operator adoption. */
+    bindingAuthority(sessionId: string): Promise<{
+        sessionId: string;
+        endpointGeneration: number;
+    } | undefined>;
+    /** Activates a prepared session through one Router-owned, one-shot SDK client. */
+    activatePreparedSession(sessionId: string): Promise<ActivatedPreparedSession>;
+    /** Lists saved sessions through Router-owned Broker discovery without exposing credentials or mutation authority. */
+    listBrokerSessions(input: Record<string, unknown>, idempotencyKey: string): Promise<Record<string, unknown>>;
+}

package/dist/types/sdk/session-list.d.ts

@@ -0,0 +1,22 @@
+export type SessionListPageRecord = Record<string, unknown>;
+export type SessionListTraversalErrorKind = "malformed_page" | "repeated_cursor" | "page_budget_exceeded";
+export declare class SessionListTraversalError extends Error {
+    #private;
+    constructor(kind: SessionListTraversalErrorKind);
+    get kind(): SessionListTraversalErrorKind;
+}
+export interface SessionListTraversalInputPage {
+    readonly sessions: readonly unknown[];
+    readonly continuationCursor?: unknown;
+}
+export interface SessionListTraversalPage<TResponse, TPage extends SessionListTraversalInputPage> {
+    readonly response: TResponse;
+    readonly page: TPage;
+    readonly sessions: readonly unknown[];
+    readonly continuationCursor?: string;
+}
+export type SessionListPage = SessionListPageRecord & SessionListTraversalInputPage;
+/** Returns a strict session.list page from either a Broker envelope or a direct result record. */
+export declare function sessionListPageFromResponse(value: unknown): SessionListPage | undefined;
+/** Drains bounded Broker session.list pages while rejecting malformed or cyclic continuations. */
+export declare function traverseSessionList<TInput extends Record<string, unknown>, TResponse, TPage extends SessionListTraversalInputPage>(input: TInput, request: (input: TInput) => Promise<TResponse>, pageFromResponse: (response: TResponse) => TPage | undefined): Promise<readonly SessionListTraversalPage<TResponse, TPage>[]>;

package/dist/types/sdk/session-reconnect.d.ts

@@ -1,4 +1,4 @@
-import type { SdkClientOptions } from "./client";
+import { type SdkClientOptions } from "./client";
 type SessionReconnectOptions = Required<Pick<SdkClientOptions, "reconnectAttempts" | "reconnectBackoffMs" | "reconnectMaxBackoffMs">>;
 /**
  * Reconnect budget for every long-lived SDK session client: ACP sessions and the
@@ -17,4 +17,46 @@ type SessionReconnectOptions = Required<Pick<SdkClientOptions, "reconnectAttempt
  * sleeps stay short and recovery is prompt once the host answers again.
  */
 export declare const ACP_SESSION_RECONNECT: SessionReconnectOptions;
+/**
+ * Post-connect response budget for session-scoped SDK commands dispatched
+ * through the Router. It bounds the wait for a reply on an already-connected
+ * transport; connecting, reconnecting, and lifecycle work keep their own
+ * separate deadlines.
+ *
+ * The transport default (10s) is sized for one-shot broker requests and is too
+ * short for the first query a cold session host answers: Q10
+ * (`models.list/current`) collects credentials for every configured profile
+ * provider, which on a multi-OAuth setup takes longer than 10s once and
+ * milliseconds afterwards. Abandoning that request loses far more than the
+ * query — the reply lands after the deadline, so the outcome can only be
+ * reported as uncertain after the frame was sent, and ACP discards the session
+ * it just created (#4258).
+ *
+ * The size is the SDK's existing model of what one healthy round trip may cost
+ * while the producer is still working: an owner heartbeat window plus a second
+ * window for recovery ({@link ACP_SESSION_RECONNECT}, and `SDK_RECONNECT_BUDGET_MS`
+ * in `./prompt-watchdog`, both `2 * HEARTBEAT_TTL_MS`). A response budget shorter
+ * than the recovery budget would abandon replies the rest of the stack is still
+ * waiting to deliver.
+ *
+ * Session commands are acknowledgement-shaped (`turn.prompt` returns an accepted
+ * receipt, not the turn's result), so no legitimate session request needs longer.
+ * The tradeoff is that a connected but wedged host is reported after this budget
+ * rather than after 10s, including `turn.abort`: ACP awaits that acknowledgement
+ * before arming its own settlement grace (`CANCEL_SETTLEMENT_GRACE_MS`), which
+ * bounds only the terminal that follows an acknowledged abort.
+ */
+export declare const SESSION_REQUEST_TIMEOUT_MS: number;
+/**
+ * Reply budget for `turn.abort`, which cannot use {@link SESSION_REQUEST_TIMEOUT_MS}.
+ *
+ * A cancel is the user asking for the turn to stop now, and the caller waits for
+ * its acknowledgement before anything else can bound the turn: ACP arms its own
+ * settlement grace only after `aborted: true` comes back, so an abort that waits
+ * the full session budget delays cancellation by that budget and, if it finally
+ * rejects, leaves the prompt for the inactivity watchdog instead of the cancel
+ * path. Aborting therefore keeps the ordinary one-shot request deadline: the
+ * abort is not the query whose cold first answer needed a wider budget (#4258).
+ */
+export declare const SESSION_ABORT_TIMEOUT_MS = 10000;
 export {};

package/dist/types/sdk/session.d.ts

@@ -1,6 +1,7 @@
 import { type AgentMessage, type AgentTelemetryConfig, ThinkingLevel } from "@gajae-code/agent-core";
 import { type AuthCredentialSelector, type Model, type ProviderSessionState } from "@gajae-code/ai/core";
 import { createAppendOnlyContextManager, providerSupportsAppendOnlyAuto, resolveAppendOnlyMode } from "../append-only-mode";
+import { AsyncJobManager } from "../async";
 import { type Rule } from "../capability/rule";
 import { ModelRegistry } from "../config/model-registry";
 import { type ScopedModelSelection } from "../config/model-resolver";
@@ -24,6 +25,7 @@ import { MCPManager } from "../runtime-mcp";
 import { AgentSession, type ForkContextSeed } from "../session/agent-session";
 import { AuthStorage } from "../session/auth-storage";
 import { SessionManager } from "../session/session-manager";
+import { type StartupAuthConfigSnapshot } from "../session/startup-auth-config";
 import { type BuildSystemPromptResult } from "../system-prompt";
 import { BUILTIN_TOOLS, createTools, HIDDEN_TOOLS, type Tool, type ToolSession } from "../tools";
 import { EventBus } from "../utils/event-bus";
@@ -40,6 +42,16 @@ import type { WorkspaceTree } from "../workspace-tree";
  * result for any such trailing unpaired tool call so a resumed session always
  * starts from a valid, paired history. No-op for well-formed transcripts.
  */
+/** Whether the cached SDK-only reconciliation store still matches the current
+ *  session identity. session_switch/session_branch can move to a DIFFERENT
+ *  transcript that retains the same copied session id, so the cache is keyed
+ *  by BOTH the session id and the session-file path (including a null-to-file
+ *  transition); a mismatch means the store must be recreated or the successor
+ *  reads/writes the predecessor's reconciliation file (review thread P2). */
+export declare function sdkOnlyStoreMatches(cached: {
+    sessionId: string;
+    sessionFile: string | undefined;
+} | undefined, sessionId: string, sessionFile: string | undefined): boolean;
 export declare function reconcileTrailingToolCalls(messages: AgentMessage[]): AgentMessage[];
 export interface CreateAgentSessionOptions {
     /** Working directory for project-local discovery. Default: getProjectDir() */
@@ -81,6 +93,14 @@ export interface CreateAgentSessionOptions {
         selector: AuthCredentialSelector;
         raw: string;
     };
+    /** Soft runtime credential preference; quota/rate-limit failures may rotate away from it. */
+    preferredCredentialSelector?: {
+        provider?: string;
+        selector: AuthCredentialSelector;
+        raw: string;
+    };
+    /** Durable global pin intent loaded from startup-auth config; session bootstrap resolves it without mutating shared storage. */
+    startupAuthConfig?: StartupAuthConfigSnapshot;
     /** Custom tools to register (in addition to built-in tools). Accepts both CustomTool and ToolDefinition. */
     customTools?: (CustomTool | ToolDefinition)[];
     /** Explicit parent/phase used to load active GJC sub-skill tools for this session. */
@@ -94,6 +114,8 @@ export interface CreateAgentSessionOptions {
     extensions?: ExtensionFactory[];
     /** Additional extension paths to load (merged with discovery). */
     additionalExtensionPaths?: string[];
+    /** Explicit hook module paths to load in addition to native discovery. */
+    hookPaths?: string[];
     /** Disable extension discovery (explicit paths still load). */
     disableExtensionDiscovery?: boolean;
     /**
@@ -126,6 +148,14 @@ export interface CreateAgentSessionOptions {
     /** Load MCP tools for a top-level session only from this caller-owned absolute config file path.
      * Mutually exclusive with mcpManager. */
     mcpConfigPath?: string;
+    /**
+     * Whether conventional MCP autoload is enabled for a top-level standalone
+     * session (default: true). When false, native user `~/.gjc/agent/mcp.json`
+     * and project `.gjc/mcp.json` registrations are not discovered or connected
+     * at startup. Plugin-bundle MCPs and `mcpConfigPath` exact-file sessions
+     * are unaffected. CLI: `--no-mcp`.
+     */
+    enableMcpAutoload?: boolean;
     /**
      * Defer connecting an exact MCP config until the interactive UI is ready.
      * @internal CLI-only startup optimization; SDK callers retain synchronous loading by default.
@@ -177,6 +207,8 @@ export interface CreateAgentSessionOptions {
     agentRegistry?: AgentRegistry;
     /** Parent task ID prefix for nested artifact naming (e.g., "6-Extensions") */
     parentTaskPrefix?: string;
+    /** Parent manager borrowed by a child session; never disposed by the child. */
+    inheritedAsyncJobManager?: AsyncJobManager;
     /**
      * W6b: the parent's scope-held MCP facade, handed to a canonical sub-session so
      * it can inherit always-on MCP tools without owning the manager. Replaces the
@@ -269,7 +301,8 @@ export declare function loadSshTool(session: ToolSession): Promise<import("../to
  * back into the broker through the {@link AuthStorageOptions.refreshOAuthCredential}
  * override to re-mint access tokens when needed.
  */
-export declare function discoverAuthStorage(agentDir?: string): Promise<AuthStorage>;
+export declare function discoverAuthStorage(agentDir?: string, startupAuth?: StartupAuthConfigSnapshot): Promise<AuthStorage>;
+/** Ranking is resolved as part of the typed startup-auth snapshot. */
 /**
  * Discover extensions from cwd.
  */

package/dist/types/sdk/transport/serve-cli.d.ts

@@ -6,10 +6,7 @@ type BrokerSessionRow = {
     live: boolean;
     ambiguous: boolean;
 };
-/**
- * Exhausts broker `session.list` cursor pagination (default page limit 100) to
- * one full snapshot; exported for tests.
- */
+/** Exhausts strict broker `session.list` pages into one full session snapshot. */
 export declare function listBrokerSessions(broker: SdkClient): Promise<BrokerSessionRow[]>;
 /** Selects the session to serve through broker `session.list` truth (C10); exported for tests. */
 export declare function selectBrokerSession(sessions: BrokerSessionRow[], explicitSessionId: string | undefined): string;

package/dist/types/session/account-inventory.d.ts

@@ -0,0 +1,86 @@
+import { type AuthStorage, type CachedCredentialHealth, type CachedUsageReport, type CredentialInventoryRecord } from "@gajae-code/ai/core";
+import type { Settings } from "../config/settings";
+/** A redacted usage observation attached to an account row. */
+export interface AccountUsageCache extends CachedUsageReport {
+}
+/** Safe account health state used by presentation surfaces. */
+export interface AccountHealthCache extends CachedCredentialHealth {
+}
+export type AccountInventorySource = "stored" | "env" | "config" | "runtime";
+/** Fixed presentation classification for a persisted disabled credential. */
+export type AccountInventoryDisabledCause = "auth_failure" | "user_removed" | "duplicate" | "replaced" | "unknown";
+export interface AccountInventoryCapabilities {
+    canCheck: boolean;
+    canPin: boolean;
+    canRemove: boolean;
+    hasCachedUsage: boolean;
+}
+export interface AccountInventoryRouting {
+    /** True when this row is the session's last recorded stored credential. */
+    active: boolean;
+    /** True when this source is the effective source for the provider/session. */
+    selected: boolean;
+    marker: "active" | "selected" | "available";
+}
+/**
+ * Payload-free account row for renderers. This type deliberately has no
+ * AuthCredential, API-key bytes, access token, refresh token, or raw usage.
+ */
+export interface AccountInventoryRow {
+    /** Stable, non-secret presentation id. */
+    id: string;
+    /** Numeric storage id when this is a persisted row. */
+    credentialId?: number;
+    provider: string;
+    credentialKind: "oauth" | "api_key";
+    source: AccountInventorySource;
+    sourceLabel: string;
+    identityLabel: string | null;
+    /** OAuth identity is intentionally limited to safe labels from inventory. */
+    oauthIdentity?: {
+        label: string;
+    };
+    disabled: boolean;
+    disabledCause: AccountInventoryDisabledCause | null;
+    health: AccountHealthCache;
+    usage?: AccountUsageCache;
+    capabilities: AccountInventoryCapabilities;
+    routing: AccountInventoryRouting;
+}
+export interface AccountInventorySnapshot {
+    generatedAt: number;
+    generation: number;
+    rows: AccountInventoryRow[];
+}
+export interface AccountInventoryInput {
+    authStorage: AuthStorage;
+    modelRegistry?: {
+        getAvailable?: () => Array<{
+            provider: string;
+        }>;
+        getProviderBaseUrl?: (provider: string) => string | undefined;
+    };
+    sessionId?: string;
+    provider?: string;
+    nowMs?: number;
+}
+export interface AccountInventoryCheckResult {
+    rowId: string;
+    provider: string;
+    credentialId?: number;
+    ok: boolean | null;
+    reason?: string;
+}
+/** Build a redacted, cache-only account snapshot. This function never probes. */
+export declare function buildAccountInventorySnapshot(input: AccountInventoryInput): AccountInventorySnapshot;
+/** Short alias used by command/report callers. */
+export declare const buildAccountInventory: typeof buildAccountInventorySnapshot;
+/**
+ * Run the explicit sequential checker and return a fresh redacted snapshot.
+ * AuthStorage.checkCredentials performs stored-row probes sequentially; the
+ * synthetic API-key probes below are also intentionally sequential.
+ */
+export declare function checkAccountInventory(input: AccountInventoryInput): Promise<AccountInventorySnapshot>;
+export declare const checkAccountInventorySnapshot: typeof checkAccountInventory;
+/** Clear a global persistent pin only after its selected credential was removed. */
+export declare function clearPersistentPinForRemovedRows(settings: Pick<Settings, "commitAtomicBatchWithCurrent">, provider: string, inventory: readonly CredentialInventoryRecord[], removedIds: readonly number[]): Promise<boolean>;