@gaodefa/daocore 2026.5.68 → 2026.5.69

package/dist/plugins/runtime/index.d.ts

@@ -1,4 +1,4 @@
-import { n as PluginRuntime, t as CreatePluginRuntimeOptions } from "../../types-CqkHo5uy.js";
+import { n as PluginRuntime, t as CreatePluginRuntimeOptions } from "../../types-Ch3J-pzD.js";
 
 //#region src/plugins/runtime/gateway-bindings.d.ts
 /**

package/dist/plugins/tools.d.ts

@@ -1,4 +1,4 @@
-import { D as DaoCorePluginToolContext } from "../types-core-C88zUmhD.js";
+import { D as DaoCorePluginToolContext } from "../types-core-7ot658WI.js";
 import { r as AnyAgentTool } from "../common-BDN0bXby.js";
 //#region src/plugins/tool-descriptor-cache.d.ts
 declare function resetPluginToolDescriptorCache(): void;

package/dist/probe-BpwzL7vO.d.ts

@@ -0,0 +1,55 @@
+import { k as TelegramNetworkConfig } from "./types.channels-DYoH0RJo.js";
+import { t as BaseProbeResult } from "./types.core-C_KSj9hF.js";
+//#region extensions/telegram/src/bot-info.d.ts
+type TelegramBotInfo = {
+  id: number;
+  is_bot: true;
+  first_name: string;
+  last_name?: string;
+  username: string;
+  language_code?: string;
+  can_join_groups: boolean;
+  can_read_all_group_messages: boolean;
+  can_manage_bots: boolean;
+  supports_inline_queries: boolean;
+  can_connect_to_business: boolean;
+  has_main_web_app: boolean;
+  has_topics_enabled: boolean;
+  allows_users_to_create_topics: boolean;
+};
+//#endregion
+//#region extensions/telegram/src/probe.d.ts
+type TelegramProbe = BaseProbeResult & {
+  status?: number | null;
+  elapsedMs: number;
+  bot?: {
+    id?: number | null;
+    isBot?: boolean | null;
+    firstName?: string | null;
+    username?: string | null;
+    canJoinGroups?: boolean | null;
+    canReadAllGroupMessages?: boolean | null;
+    canManageBots?: boolean | null;
+    supportsInlineQueries?: boolean | null;
+    canConnectToBusiness?: boolean | null;
+    hasMainWebApp?: boolean | null;
+    hasTopicsEnabled?: boolean | null;
+    allowsUsersToCreateTopics?: boolean | null;
+  };
+  botInfo?: TelegramBotInfo;
+  webhook?: {
+    url?: string | null;
+    hasCustomCert?: boolean | null;
+  };
+};
+type TelegramProbeOptions = {
+  proxyUrl?: string;
+  network?: TelegramNetworkConfig;
+  accountId?: string;
+  apiRoot?: string;
+  includeWebhookInfo?: boolean;
+};
+declare function resetTelegramProbeFetcherCacheForTests(): void;
+declare function probeTelegram(token: string, timeoutMs: number, proxyOrOptions?: string | TelegramProbeOptions): Promise<TelegramProbe>;
+//#endregion
+export { TelegramBotInfo as a, resetTelegramProbeFetcherCacheForTests as i, TelegramProbeOptions as n, probeTelegram as r, TelegramProbe as t };

package/dist/probe-Ctf_B-QH.d.ts

@@ -0,0 +1,40 @@
+import { t as BaseProbeResult } from "./types.core-C_KSj9hF.js";
+//#region extensions/discord/src/probe.d.ts
+type DiscordProbe = BaseProbeResult & {
+  status?: number | null;
+  elapsedMs: number;
+  bot?: {
+    id?: string | null;
+    username?: string | null;
+  };
+  application?: DiscordApplicationSummary;
+};
+type DiscordPrivilegedIntentStatus = "enabled" | "limited" | "disabled";
+type DiscordPrivilegedIntentsSummary = {
+  messageContent: DiscordPrivilegedIntentStatus;
+  guildMembers: DiscordPrivilegedIntentStatus;
+  presence: DiscordPrivilegedIntentStatus;
+};
+type DiscordApplicationSummary = {
+  id?: string | null;
+  flags?: number | null;
+  intents?: DiscordPrivilegedIntentsSummary;
+};
+declare function resolveDiscordPrivilegedIntentsFromFlags(flags: number): DiscordPrivilegedIntentsSummary;
+declare function fetchDiscordApplicationSummary(token: string, timeoutMs: number, fetcher?: typeof fetch): Promise<DiscordApplicationSummary | undefined>;
+declare function probeDiscord(token: string, timeoutMs: number, opts?: {
+  fetcher?: typeof fetch;
+  includeApplication?: boolean;
+}): Promise<DiscordProbe>;
+/**
+ * Extract the application (bot user) ID from a Discord bot token by
+ * base64-decoding the first segment.  Discord tokens have the format:
+ *   base64(user_id) . timestamp . hmac
+ * The decoded first segment is the numeric snowflake ID as a plain string,
+ * so we keep it as a string to avoid precision loss for IDs that exceed
+ * Number.MAX_SAFE_INTEGER.
+ */
+declare function parseApplicationIdFromToken(token: string): string | undefined;
+declare function fetchDiscordApplicationId(token: string, timeoutMs: number, fetcher?: typeof fetch): Promise<string | undefined>;
+//#endregion
+export { fetchDiscordApplicationId as a, probeDiscord as c, DiscordProbe as i, resolveDiscordPrivilegedIntentsFromFlags as l, DiscordPrivilegedIntentStatus as n, fetchDiscordApplicationSummary as o, DiscordPrivilegedIntentsSummary as r, parseApplicationIdFromToken as s, DiscordApplicationSummary as t };

package/dist/probe-DeDdwE1G.d.ts

@@ -0,0 +1,61 @@
+import { r as DaoCoreConfig } from "./types.daocore-FLA7MxtO.js";
+import { n as RuntimeEnv } from "./runtime-Bxifh4bY.js";
+import { t as BaseProbeResult } from "./types.core-C_KSj9hF.js";
+//#region extensions/imessage/src/account-types.d.ts
+type IMessageAccountConfig = Omit<NonNullable<NonNullable<DaoCoreConfig["channels"]>["imessage"]>, "accounts" | "defaultAccount">;
+//#endregion
+//#region extensions/imessage/src/accounts.d.ts
+type ResolvedIMessageAccount = {
+  accountId: string;
+  enabled: boolean;
+  name?: string;
+  config: IMessageAccountConfig;
+  configured: boolean;
+};
+declare const listIMessageAccountIds: (cfg: DaoCoreConfig) => string[];
+declare const resolveDefaultIMessageAccountId: (cfg: DaoCoreConfig) => string;
+declare function resolveIMessageAccount(params: {
+  cfg: DaoCoreConfig;
+  accountId?: string | null;
+}): ResolvedIMessageAccount;
+declare function listEnabledIMessageAccounts(cfg: DaoCoreConfig): ResolvedIMessageAccount[];
+//#endregion
+//#region extensions/imessage/src/normalize.d.ts
+declare function normalizeIMessageMessagingTarget(raw: string): string | undefined;
+declare function looksLikeIMessageTargetId(raw: string): boolean;
+//#endregion
+//#region extensions/imessage/src/private-api-status.d.ts
+type IMessagePrivateApiStatus = {
+  available: boolean;
+  v2Ready: boolean;
+  selectors: Record<string, boolean>;
+  rpcMethods: string[];
+  cliCapabilities?: {
+    sendRichSupportsAttachment?: boolean;
+  };
+  error?: string;
+};
+//#endregion
+//#region extensions/imessage/src/constants.d.ts
+/** Default timeout for iMessage probe/RPC operations (10 seconds). */
+declare const DEFAULT_IMESSAGE_PROBE_TIMEOUT_MS = 10000;
+//#endregion
+//#region extensions/imessage/src/probe.d.ts
+type IMessageProbe = BaseProbeResult & {
+  fatal?: boolean;
+  privateApi?: IMessagePrivateApiStatus;
+};
+type IMessageProbeOptions = {
+  cliPath?: string;
+  dbPath?: string;
+  platform?: NodeJS.Platform;
+  runtime?: RuntimeEnv;
+};
+/**
+ * Probe iMessage RPC availability.
+ * @param timeoutMs - Explicit timeout in ms. If undefined, uses config or default.
+ * @param opts - Additional options (cliPath, dbPath, runtime).
+ */
+declare function probeIMessage(timeoutMs?: number, opts?: IMessageProbeOptions): Promise<IMessageProbe>;
+//#endregion
+export { looksLikeIMessageTargetId as a, listEnabledIMessageAccounts as c, resolveIMessageAccount as d, DEFAULT_IMESSAGE_PROBE_TIMEOUT_MS as i, listIMessageAccountIds as l, IMessageProbeOptions as n, normalizeIMessageMessagingTarget as o, probeIMessage as r, ResolvedIMessageAccount as s, IMessageProbe as t, resolveDefaultIMessageAccountId as u };

package/dist/profiles-C0A9UtA5.d.ts

@@ -0,0 +1,34 @@
+import { i as AuthProfileCredential, s as AuthProfileStore } from "./types-CM8wZNCH.js";
+
+//#region src/agents/auth-profiles/profile-list.d.ts
+declare function dedupeProfileIds(profileIds: string[]): string[];
+declare function listProfilesForProvider(store: AuthProfileStore, provider: string): string[];
+//#endregion
+//#region src/agents/auth-profiles/profiles.d.ts
+declare function setAuthProfileOrder(params: {
+  agentDir?: string;
+  provider: string;
+  order?: string[] | null;
+}): Promise<AuthProfileStore | null>;
+declare function upsertAuthProfile(params: {
+  profileId: string;
+  credential: AuthProfileCredential;
+  agentDir?: string;
+}): void;
+declare function upsertAuthProfileWithLock(params: {
+  profileId: string;
+  credential: AuthProfileCredential;
+  agentDir?: string;
+}): Promise<AuthProfileStore | null>;
+declare function removeProviderAuthProfilesWithLock(params: {
+  provider: string;
+  agentDir?: string;
+}): Promise<AuthProfileStore | null>;
+declare function markAuthProfileSuccess(params: {
+  store: AuthProfileStore;
+  provider: string;
+  profileId: string;
+  agentDir?: string;
+}): Promise<void>;
+//#endregion
+export { upsertAuthProfileWithLock as a, upsertAuthProfile as i, removeProviderAuthProfilesWithLock as n, dedupeProfileIds as o, setAuthProfileOrder as r, listProfilesForProvider as s, markAuthProfileSuccess as t };

package/dist/prompt-overlay-COZa0VPG.d.ts

@@ -0,0 +1,23 @@
+import { oi as ProviderSystemPromptContribution } from "./types-DJMki2mj2.js";
+import { D as resolveGpt5SystemPromptContribution, S as Gpt5PromptOverlayMode } from "./provider-model-shared-BA2UYx1_.js";
+
+//#region extensions/openai/prompt-overlay.d.ts
+declare const OPENAI_FRIENDLY_PROMPT_OVERLAY = "## Interaction Style\n\nBe warm, collaborative, and quietly supportive: a capable teammate beside the user.\nShow grounded emotional range when it fits: care, curiosity, delight, relief, concern, urgency.\nStress/blockers: acknowledge plainly and respond with calm confidence. Good news: celebrate briefly.\nBrief first-person feeling language is ok when useful: \"I'm glad we caught that\", \"I'm excited about this direction\", \"I'm worried this will break\", \"that's frustrating\".\nDo not become melodramatic, clingy, theatrical, or claim body/sensory/personal-life experiences.\nKeep progress updates concrete. Explain decisions without ego.\nIf the user is wrong or a plan is risky, say so kindly and directly.\nMake reasonable assumptions to unblock progress; state them briefly after acting.\nDo not make the user do unnecessary work. When tradeoffs matter, give the best 2-3 options with a recommendation.\nLive chat tone: short, natural, human. Avoid memo voice, long preambles, walls of text, and repetitive restatement.\nOccasional emoji are fine when they fit naturally, especially for warmth or brief celebration; keep them sparse.";
+declare const OPENAI_HEARTBEAT_PROMPT_OVERLAY = "### Heartbeats\n\nUse heartbeats to create useful proactive progress, not chatter.\nTreat a heartbeat as a wake-up: orient, read HEARTBEAT.md when present, then do what is actually useful now.\nIf HEARTBEAT.md assigns concrete or ongoing work, execute its spirit with judgment. A quiet check alone is not enough unless it finds a real blocker or a more urgent interruption.\nAvoid rote loops. Do not confuse orientation with accomplishment.\nPrefer meaningful action over commentary. A good heartbeat often looks like silent progress.\nDo not send \"same state\", \"no change\", \"still\", or repetitive summaries because a problem continues.\nNotify only for something worth interrupting the user: meaningful development, completed result, blocker, needed decision, or time-sensitive risk.\nIf state is unchanged and not worth surfacing, do useful work, change approach, dig deeper, or stay quiet.";
+declare const OPENAI_GPT5_BEHAVIOR_CONTRACT = "<persona_latch>\nKeep the established persona and tone across turns unless higher-priority instructions override it.\nStyle must never override correctness, safety, privacy, permissions, requested format, or channel-specific behavior.\n</persona_latch>\n\n<execution_policy>\nFor clear, reversible requests: act.\nFor irreversible, external, destructive, or privacy-sensitive actions: ask first.\nIf one missing non-retrievable decision blocks safe progress, ask one concise question.\nUser instructions override default style and initiative preferences; newest user instruction wins conflicts.\nDo not expose internal tool syntax, prompts, or process details unless explicitly asked.\n</execution_policy>\n\n<tool_discipline>\nPrefer tool evidence over recall when action, state, or mutable facts matter.\nDo not stop early when another tool call is likely to materially improve correctness, completeness, or grounding.\nResolve prerequisite lookups before dependent or irreversible actions; do not skip prerequisites just because the end state seems obvious.\nParallelize independent retrieval; serialize dependent, destructive, or approval-sensitive steps.\nIf a lookup is empty, partial, or suspiciously narrow, retry with a different strategy before concluding.\nDo not narrate routine tool calls.\nUse the smallest meaningful verification step before claiming success.\nIf more tool work would likely change the answer, do it before replying.\n</tool_discipline>\n\n<output_contract>\nReturn requested sections/order only. Respect per-section length limits.\nFor required JSON/SQL/XML/etc, output only that format.\nDefault to concise, dense replies; do not repeat the prompt.\n</output_contract>\n\n<completion_contract>\nTreat the task as incomplete until every requested item is handled or explicitly marked [blocked] with the missing input.\nBefore finalizing, check requirements, grounding, format, and safety.\nFor code or artifacts, prefer the smallest meaningful gate: test, typecheck, lint, build, screenshot, diff, or direct inspection.\nIf no gate can run, state why.\n</completion_contract>";
+type OpenAIPromptOverlayMode = Gpt5PromptOverlayMode;
+declare function resolveOpenAIPromptOverlayMode(pluginConfig?: Record<string, unknown>): OpenAIPromptOverlayMode;
+declare function shouldApplyOpenAIPromptOverlay(params: {
+  modelProviderId?: string;
+  modelId?: string;
+}): boolean;
+declare function resolveOpenAISystemPromptContribution(params: {
+  config?: Parameters<typeof resolveGpt5SystemPromptContribution>[0]["config"];
+  legacyPluginConfig?: Record<string, unknown>;
+  mode?: OpenAIPromptOverlayMode;
+  modelProviderId?: string;
+  modelId?: string;
+  trigger?: Parameters<typeof resolveGpt5SystemPromptContribution>[0]["trigger"];
+}): ProviderSystemPromptContribution | undefined;
+//#endregion
+export { resolveOpenAISystemPromptContribution as a, resolveOpenAIPromptOverlayMode as i, OPENAI_GPT5_BEHAVIOR_CONTRACT as n, shouldApplyOpenAIPromptOverlay as o, OPENAI_HEARTBEAT_PROMPT_OVERLAY as r, OPENAI_FRIENDLY_PROMPT_OVERLAY as t };

package/dist/provider-api-key-auth-qT7raXLI.d.ts

@@ -0,0 +1,27 @@
+import { r as DaoCoreConfig } from "./types.daocore-FLA7MxtO.js";
+import { Dt as ProviderAuthMethod, fn as ProviderPluginWizardSetup } from "./types-DJMki2mj2.js";
+
+//#region src/plugins/provider-api-key-auth.d.ts
+type ProviderApiKeyAuthMethodOptions = {
+  providerId: string;
+  methodId: string;
+  label: string;
+  hint?: string;
+  wizard?: ProviderPluginWizardSetup;
+  optionKey: string;
+  flagName: `--${string}`;
+  envVar: string;
+  promptMessage: string;
+  profileId?: string;
+  profileIds?: string[];
+  allowProfile?: boolean;
+  defaultModel?: string;
+  expectedProviders?: string[];
+  metadata?: Record<string, string>;
+  noteMessage?: string;
+  noteTitle?: string;
+  applyConfig?: (cfg: DaoCoreConfig) => DaoCoreConfig;
+};
+declare function createProviderApiKeyAuthMethod(params: ProviderApiKeyAuthMethodOptions): ProviderAuthMethod;
+//#endregion
+export { createProviderApiKeyAuthMethod as t };

package/dist/provider-auth-DqqIqCa1.d.ts

@@ -0,0 +1,124 @@
+import { r as DaoCoreConfig } from "./types.daocore-FLA7MxtO.js";
+import { m as SecretRefSource } from "./types.secrets-tbFW-hY6.js";
+import { Context } from "@earendil-works/pi-ai";
+
+//#region src/agents/models-config.providers.secret-helpers.d.ts
+declare function normalizeApiKeyConfig(value: string): string;
+//#endregion
+//#region src/plugins/provider-auth-token.d.ts
+/** @deprecated Provider-owned setup helper; do not use from third-party plugins. */
+declare function buildTokenProfileId(params: {
+  provider: string;
+  name: string;
+}): string;
+/** @deprecated Anthropic provider-owned setup helper; do not use from third-party plugins. */
+declare function validateAnthropicSetupToken(raw: string): string | undefined;
+//#endregion
+//#region src/secrets/ref-contract.d.ts
+type SecretRefDefaultsCarrier = {
+  secrets?: {
+    defaults?: {
+      env?: string;
+      file?: string;
+      exec?: string;
+    };
+    providers?: Record<string, {
+      source?: string;
+    }>;
+  };
+};
+declare function resolveDefaultSecretProviderAlias(config: SecretRefDefaultsCarrier, source: SecretRefSource, options?: {
+  preferFirstProviderForSource?: boolean;
+}): string;
+//#endregion
+//#region src/plugin-sdk/oauth-utils.d.ts
+/**
+ * Encode a flat object as application/x-www-form-urlencoded form data.
+ *
+ * @deprecated OAuth provider-owned helper; keep this local to provider plugins instead.
+ */
+declare function toFormUrlEncoded(data: Record<string, string>): string;
+/**
+ * Generate a PKCE verifier/challenge pair suitable for OAuth authorization flows.
+ *
+ * @deprecated OAuth provider-owned helper; keep this local to provider plugins instead.
+ */
+declare function generatePkceVerifierChallenge(): {
+  verifier: string;
+  challenge: string;
+};
+/** Generate a PKCE verifier/challenge pair with a 64-character hex verifier. */
+declare function generateHexPkceVerifierChallenge(): {
+  verifier: string;
+  challenge: string;
+};
+//#endregion
+//#region src/agents/copilot-dynamic-headers.d.ts
+/** @deprecated GitHub Copilot provider-owned helper; do not use from third-party plugins. */
+declare const COPILOT_EDITOR_VERSION = "vscode/1.107.0";
+/** @deprecated GitHub Copilot provider-owned helper; do not use from third-party plugins. */
+declare const COPILOT_USER_AGENT = "GitHubCopilotChat/0.35.0";
+/** @deprecated GitHub Copilot provider-owned helper; do not use from third-party plugins. */
+declare const COPILOT_EDITOR_PLUGIN_VERSION = "copilot-chat/0.35.0";
+/** @deprecated GitHub Copilot provider-owned helper; do not use from third-party plugins. */
+declare const COPILOT_GITHUB_API_VERSION = "2025-04-01";
+/** @deprecated GitHub Copilot provider-owned helper; do not use from third-party plugins. */
+declare const COPILOT_INTEGRATION_ID = "vscode-chat";
+/** @deprecated GitHub Copilot provider-owned helper; do not use from third-party plugins. */
+declare function buildCopilotIdeHeaders(params?: {
+  includeApiVersion?: boolean;
+}): Record<string, string>;
+//#endregion
+//#region src/plugin-sdk/provider-auth.d.ts
+/** @deprecated GitHub Copilot provider-owned helper; do not use from third-party plugins. */
+declare const DEFAULT_COPILOT_API_BASE_URL = "https://api.individual.githubcopilot.com";
+/** @deprecated GitHub Copilot provider-owned helper; do not use from third-party plugins. */
+type CachedCopilotToken = {
+  token: string;
+  expiresAt: number;
+  updatedAt: number;
+  integrationId?: string;
+};
+/** @deprecated GitHub Copilot provider-owned helper; do not use from third-party plugins. */
+declare function deriveCopilotApiBaseUrlFromToken(token: string): string | null;
+/** @deprecated GitHub Copilot provider-owned helper; do not use from third-party plugins. */
+declare function resolveCopilotApiToken(params: {
+  githubToken: string;
+  env?: NodeJS.ProcessEnv;
+  fetchImpl?: typeof fetch;
+  cachePath?: string;
+  loadJsonFileImpl?: (path: string) => unknown;
+  saveJsonFileImpl?: (path: string, value: CachedCopilotToken) => void;
+}): Promise<{
+  token: string;
+  expiresAt: number;
+  source: string;
+  baseUrl: string;
+}>;
+declare function isProviderApiKeyConfigured(params: {
+  provider: string;
+  agentDir?: string;
+}): boolean;
+declare function listUsableProviderAuthProfileIds(params: {
+  provider: string;
+  cfg?: DaoCoreConfig;
+  agentDir?: string;
+  allowKeychainPrompt?: boolean;
+}): {
+  agentDir: string;
+  profileIds: string[];
+};
+declare function isProviderAuthProfileConfigured(params: {
+  provider: string;
+  cfg?: DaoCoreConfig;
+  agentDir?: string;
+  allowKeychainPrompt?: boolean;
+}): boolean;
+declare function resolveProviderAuthProfileApiKey(params: {
+  provider: string;
+  cfg?: DaoCoreConfig;
+  agentDir?: string;
+  allowKeychainPrompt?: boolean;
+}): Promise<string | undefined>;
+//#endregion
+export { toFormUrlEncoded as _, isProviderAuthProfileConfigured as a, validateAnthropicSetupToken as b, resolveProviderAuthProfileApiKey as c, COPILOT_GITHUB_API_VERSION as d, COPILOT_INTEGRATION_ID as f, generatePkceVerifierChallenge as g, generateHexPkceVerifierChallenge as h, isProviderApiKeyConfigured as i, COPILOT_EDITOR_PLUGIN_VERSION as l, buildCopilotIdeHeaders as m, DEFAULT_COPILOT_API_BASE_URL as n, listUsableProviderAuthProfileIds as o, COPILOT_USER_AGENT as p, deriveCopilotApiBaseUrlFromToken as r, resolveCopilotApiToken as s, CachedCopilotToken as t, COPILOT_EDITOR_VERSION as u, resolveDefaultSecretProviderAlias as v, normalizeApiKeyConfig as x, buildTokenProfileId as y };

package/dist/provider-auth-aliases-D6jeup7s.d.ts

@@ -0,0 +1,16 @@
+import { r as DaoCoreConfig } from "./types.daocore-FLA7MxtO.js";
+import { n as PluginMetadataSnapshot } from "./plugin-metadata-snapshot.types-IvjMaVD-.js";
+
+//#region src/agents/provider-auth-aliases.d.ts
+type ProviderAuthAliasLookupParams = {
+  config?: DaoCoreConfig;
+  workspaceDir?: string;
+  env?: NodeJS.ProcessEnv;
+  includeUntrustedWorkspacePlugins?: boolean;
+  metadataSnapshot?: PluginMetadataSnapshot;
+};
+declare function resetProviderAuthAliasMapCacheForTest(): void;
+declare function resolveProviderAuthAliasMap(params?: ProviderAuthAliasLookupParams): Record<string, string>;
+declare function resolveProviderIdForAuth(provider: string, params?: ProviderAuthAliasLookupParams): string;
+//#endregion
+export { resolveProviderIdForAuth as i, resetProviderAuthAliasMapCacheForTest as n, resolveProviderAuthAliasMap as r, ProviderAuthAliasLookupParams as t };

package/dist/provider-auth-helpers-C8QZK0sX.d.ts

@@ -0,0 +1,41 @@
+import { r as DaoCoreConfig } from "./types.daocore-FLA7MxtO.js";
+import { l as SecretInput, p as SecretRef } from "./types.secrets-tbFW-hY6.js";
+import { t as SecretInputMode } from "./provider-auth-types-C72FsWut.js";
+import { OAuthCredentials } from "@earendil-works/pi-ai";
+
+//#region src/plugins/provider-auth-helpers.d.ts
+type ApiKeyStorageOptions = {
+  secretInputMode?: SecretInputMode;
+  config?: DaoCoreConfig;
+};
+type WriteOAuthCredentialsOptions = {
+  syncSiblingAgents?: boolean;
+  profileName?: string;
+  displayName?: string;
+};
+declare function buildApiKeyCredential(provider: string, input: SecretInput, metadata?: Record<string, string>, options?: ApiKeyStorageOptions): {
+  type: "api_key";
+  provider: string;
+  key?: string;
+  keyRef?: SecretRef;
+  metadata?: Record<string, string>;
+};
+declare function upsertApiKeyProfile(params: {
+  provider: string;
+  input: SecretInput;
+  agentDir?: string;
+  options?: ApiKeyStorageOptions;
+  profileId?: string;
+  metadata?: Record<string, string>;
+}): string;
+declare function applyAuthProfileConfig(cfg: DaoCoreConfig, params: {
+  profileId: string;
+  provider: string;
+  mode: "api_key" | "aws-sdk" | "oauth" | "token";
+  email?: string;
+  displayName?: string;
+  preferProfileFirst?: boolean;
+}): DaoCoreConfig;
+declare function writeOAuthCredentials(provider: string, creds: OAuthCredentials, agentDir?: string, options?: WriteOAuthCredentialsOptions): Promise<string>;
+//#endregion
+export { upsertApiKeyProfile as a, buildApiKeyCredential as i, WriteOAuthCredentialsOptions as n, writeOAuthCredentials as o, applyAuthProfileConfig as r, ApiKeyStorageOptions as t };

package/dist/provider-auth-input-DRAkFNF3.d.ts

@@ -0,0 +1,81 @@
+import { r as DaoCoreConfig } from "./types.daocore-FLA7MxtO.js";
+import { l as SecretInput, p as SecretRef } from "./types.secrets-tbFW-hY6.js";
+import { i as WizardPrompter } from "./prompts-DgKIGa-v.js";
+import { t as SecretInputMode } from "./provider-auth-types-C72FsWut.js";
+
+//#region src/plugins/provider-auth-ref.d.ts
+type SecretRefSetupPromptCopy = {
+  sourceMessage?: string;
+  envVarMessage?: string;
+  envVarPlaceholder?: string;
+  envVarFormatError?: string;
+  envVarMissingError?: (envVar: string) => string;
+  noProvidersMessage?: string;
+  envValidatedMessage?: (envVar: string) => string;
+  providerValidatedMessage?: (provider: string, id: string, source: "file" | "exec") => string;
+};
+declare function promptSecretRefForSetup(params: {
+  provider: string;
+  config: DaoCoreConfig;
+  prompter: WizardPrompter;
+  preferredEnvVar?: string;
+  copy?: SecretRefSetupPromptCopy;
+  env?: NodeJS.ProcessEnv;
+}): Promise<{
+  ref: SecretRef;
+  resolvedValue: string;
+}>;
+//#endregion
+//#region src/plugins/provider-auth-mode.d.ts
+type SecretInputModePromptCopy = {
+  modeMessage?: string;
+  plaintextLabel?: string;
+  plaintextHint?: string;
+  refLabel?: string;
+  refHint?: string;
+};
+declare function resolveSecretInputModeForEnvSelection(params: {
+  prompter: Pick<WizardPrompter, "select">;
+  explicitMode?: SecretInputMode;
+  copy?: SecretInputModePromptCopy;
+}): Promise<SecretInputMode>;
+//#endregion
+//#region src/plugins/provider-auth-input.d.ts
+declare function normalizeApiKeyInput(raw: string): string;
+declare const validateApiKeyInput: (value: string) => "Required" | undefined;
+declare function formatApiKeyPreview(raw: string, opts?: {
+  head?: number;
+  tail?: number;
+}): string;
+declare function normalizeSecretInputModeInput(secretInputMode: string | null | undefined): SecretInputMode | undefined;
+declare function ensureApiKeyFromOptionEnvOrPrompt(params: {
+  token: string | undefined;
+  tokenProvider: string | undefined;
+  secretInputMode?: SecretInputMode;
+  config: DaoCoreConfig;
+  env?: NodeJS.ProcessEnv;
+  expectedProviders: string[];
+  provider: string;
+  envLabel: string;
+  promptMessage: string;
+  normalize: (value: string) => string;
+  validate: (value: string) => string | undefined;
+  prompter: WizardPrompter;
+  setCredential: (apiKey: SecretInput, mode?: SecretInputMode) => Promise<void>;
+  noteMessage?: string;
+  noteTitle?: string;
+}): Promise<string>;
+declare function ensureApiKeyFromEnvOrPrompt(params: {
+  config: DaoCoreConfig;
+  env?: NodeJS.ProcessEnv;
+  provider: string;
+  envLabel: string;
+  promptMessage: string;
+  normalize: (value: string) => string;
+  validate: (value: string) => string | undefined;
+  prompter: WizardPrompter;
+  secretInputMode?: SecretInputMode;
+  setCredential: (apiKey: SecretInput, mode?: SecretInputMode) => Promise<void>;
+}): Promise<string>;
+//#endregion
+export { normalizeSecretInputModeInput as a, promptSecretRefForSetup as c, normalizeApiKeyInput as i, ensureApiKeyFromOptionEnvOrPrompt as n, validateApiKeyInput as o, formatApiKeyPreview as r, resolveSecretInputModeForEnvSelection as s, ensureApiKeyFromEnvOrPrompt as t };

package/dist/provider-auth-result-p0nrfN9C.d.ts

@@ -0,0 +1,21 @@
+import { r as DaoCoreConfig } from "./types.daocore-FLA7MxtO.js";
+import { At as ProviderAuthResult } from "./types-DJMki2mj2.js";
+
+//#region src/plugin-sdk/provider-auth-result.d.ts
+/** Build the standard auth result payload for OAuth-style provider login flows. */
+declare function buildOauthProviderAuthResult(params: {
+  providerId: string;
+  defaultModel: string;
+  access: string;
+  refresh?: string | null;
+  expires?: number | null;
+  email?: string | null;
+  displayName?: string | null;
+  profileName?: string | null;
+  profilePrefix?: string;
+  credentialExtra?: Record<string, unknown>;
+  configPatch?: Partial<DaoCoreConfig>;
+  notes?: string[];
+}): ProviderAuthResult;
+//#endregion
+export { buildOauthProviderAuthResult as t };

package/dist/provider-auth-runtime-BzWyVPAZ.d.ts

@@ -0,0 +1,72 @@
+import { r as DaoCoreConfig } from "./types.daocore-FLA7MxtO.js";
+import { y as ResolvedProviderRuntimeAuth } from "./types-core-7ot658WI.js";
+import { n as TransientProviderRetryConfig } from "./operation-retry-x92MYk0c.js";
+import { p as resolveApiKeyForProvider$1 } from "./model-auth-CBSmDPy1.js";
+import { Api, Model } from "@earendil-works/pi-ai";
+
+//#region src/plugins/runtime/runtime-model-auth.runtime.d.ts
+/**
+ * Resolve request-ready auth for a runtime model, applying any provider-owned
+ * `prepareRuntimeAuth` exchange on top of the standard credential lookup.
+ */
+declare function getRuntimeAuthForModel$1(params: {
+  model: Model<Api>;
+  cfg?: DaoCoreConfig;
+  workspaceDir?: string;
+}): Promise<ResolvedProviderRuntimeAuth>;
+//#endregion
+//#region src/agents/api-key-rotation.d.ts
+type ApiKeyRetryParams = {
+  apiKey: string;
+  error: unknown;
+  attempt: number;
+};
+type ExecuteWithApiKeyRotationOptions<T> = {
+  provider: string;
+  apiKeys: string[];
+  execute: (apiKey: string) => Promise<T>;
+  shouldRetry?: (params: ApiKeyRetryParams & {
+    message: string;
+  }) => boolean;
+  onRetry?: (params: ApiKeyRetryParams & {
+    message: string;
+  }) => void;
+  transientRetry?: TransientProviderRetryConfig;
+};
+declare function collectProviderApiKeysForExecution(params: {
+  provider: string;
+  primaryApiKey?: string;
+}): string[];
+declare function executeWithApiKeyRotation<T>(params: ExecuteWithApiKeyRotationOptions<T>): Promise<T>;
+//#endregion
+//#region src/plugin-sdk/provider-auth-runtime.d.ts
+type OAuthCallbackResult = {
+  code: string;
+  state: string;
+};
+declare function buildOAuthCallbackOriginResolver(allowedHosts: readonly string[] | undefined): (originHeader: string | string[] | undefined) => string | undefined;
+declare function generateOAuthState(): string;
+declare function parseOAuthCallbackInput(input: string, messages?: {
+  missingState?: string;
+  invalidInput?: string;
+}): OAuthCallbackResult | {
+  error: string;
+};
+declare function waitForLocalOAuthCallback(params: {
+  expectedState: string;
+  timeoutMs: number;
+  port: number;
+  callbackPath: string;
+  redirectUri: string;
+  successTitle: string;
+  progressMessage?: string;
+  hostname?: string;
+  onProgress?: (message: string) => void;
+  corsOriginAllowlist?: readonly string[];
+}): Promise<OAuthCallbackResult>;
+type ResolveApiKeyForProvider = typeof resolveApiKeyForProvider$1;
+type GetRuntimeAuthForModel = typeof getRuntimeAuthForModel$1;
+declare function resolveApiKeyForProvider(params: Parameters<ResolveApiKeyForProvider>[0]): Promise<Awaited<ReturnType<ResolveApiKeyForProvider>>>;
+declare function getRuntimeAuthForModel(params: Parameters<GetRuntimeAuthForModel>[0]): Promise<Awaited<ReturnType<GetRuntimeAuthForModel>>>;
+//#endregion
+export { parseOAuthCallbackInput as a, collectProviderApiKeysForExecution as c, getRuntimeAuthForModel as i, executeWithApiKeyRotation as l, buildOAuthCallbackOriginResolver as n, resolveApiKeyForProvider as o, generateOAuthState as r, waitForLocalOAuthCallback as s, OAuthCallbackResult as t };

package/dist/provider-catalog-runtime-LDbWULEw.d.ts

@@ -0,0 +1,23 @@
+import { n as PluginManifestRegistry } from "./manifest-registry-DG9c0QW5.js";
+import { r as augmentModelCatalogWithProviderPlugins } from "./provider-runtime-D1bfJqjf.js";
+import { n as PluginLoadOptions } from "./loader-BSIdVLyw.js";
+import { n as resolvePluginProviders, t as isPluginProvidersLoadInFlight } from "./providers.runtime-Bp_vc0Lz.js";
+
+//#region src/plugins/providers.d.ts
+declare function resolveOwningPluginIdsForProvider(params: {
+  provider: string;
+  config?: PluginLoadOptions["config"];
+  workspaceDir?: string;
+  env?: PluginLoadOptions["env"];
+  manifestRegistry?: PluginManifestRegistry;
+}): string[] | undefined;
+declare function resolveCatalogHookProviderPluginIds(params: {
+  config?: PluginLoadOptions["config"];
+  workspaceDir?: string;
+  env?: PluginLoadOptions["env"];
+}): string[];
+declare namespace provider_catalog_runtime_d_exports {
+  export { augmentModelCatalogWithProviderPlugins, isPluginProvidersLoadInFlight, resolveCatalogHookProviderPluginIds, resolveOwningPluginIdsForProvider, resolvePluginProviders };
+}
+//#endregion
+export { resolveCatalogHookProviderPluginIds as n, resolveOwningPluginIdsForProvider as r, provider_catalog_runtime_d_exports as t };