@hachej/boring-agent 0.1.109 → 0.1.110

package/dist/server/index.js

@@ -3,6 +3,19 @@ import {
   AgentFleetCompilationError,
   AgentFleetCompilationErrorCode,
   AuthoredAgentMaterializationError,
+  CHANNELS_ENV_FLAG,
+  CHANNEL_DURABLE_STREAM_REQUIRED,
+  CHANNEL_INBOUND_PARKED,
+  CHANNEL_OUTBOUND_PARKED,
+  CHANNEL_RUNTIME_FILE_NAME,
+  CHANNEL_TURN_STALLED,
+  CHANNEL_UNKNOWN_BINDING,
+  ChannelBindingStore,
+  ChannelInboundService,
+  ChannelIntentionService,
+  ChannelMessageRouter,
+  ChannelOutboundService,
+  ChannelSessionCreateTimeoutError,
   DEFAULT_AGENT_FLEET,
   DEFAULT_AGENT_TYPE_ID,
   DEFAULT_PI_RESOURCE_DIGEST_LIMITS,
@@ -12,8 +25,10 @@ import {
   InMemoryAgentRequestLedger,
   MANAGED_AGENT_MCP_DELIVERY_RULE,
   MANAGED_AGENT_MCP_ORIGIN_SURFACE,
+  MIN_REQUEST_RETENTION_MS,
   ManagedAgentMcpDelegateController,
   ManagedAgentMcpError,
+  PI_OAUTH_CREDENTIAL_FIELD_ID_V1,
   REMOTE_WORKER_EXCLUSIVE_BINARY_CREATE_CAPABILITY,
   REMOTE_WORKER_PROVIDER,
   REMOTE_WORKER_RUNTIME_CWD,
@@ -30,28 +45,40 @@ import {
   WORKER_REQUEST_ID_HEADER,
   WORKER_WORKSPACE_ID_HEADER,
   applyCspHeaders,
+  areChannelsEnabled,
+  assembleNextTurn,
+  assertChannelDurability,
   autoDetectMode,
   buildDeploymentSnapshotRecipe,
   compileAgentDirectory,
   compilePersonaPackageDirectory,
   constantTimeTokenEqual,
   createAgentHost,
+  createAgentHostChannelRuntime,
+  createAgentHostChannelStorage,
   createAuthMiddleware,
   createBlaxelSandboxModeAdapter,
   createBoundWorkspaceAgentDispatcher,
+  createChannelIntentionRuntime,
   createConfiguredAgentHostAgentSpec,
   createDirectModeAdapter,
   createEnvironmentProvisioningFingerprint,
-  createFakeAuthorityVerifierV1,
   createHostSideCredentialResolverV1,
   createInMemoryCredentialBackendV1,
+  createInMemoryCredentialVaultPersistenceV1,
+  createInMemoryCredentialVersionAnchorV1,
+  createLocalCredentialVersionAnchorFromEnvV1,
+  createLocalFileCredentialVersionAnchorV1,
+  createLocalKekWorkspaceKekProviderFromEnvV1,
   createLocalModeAdapter,
   createManagedAgentMcpDelegateController,
   createManagedAgentMcpHttpHandler,
   createManagedAgentMcpServer,
+  createOpenAiCodexOAuthBrokerV1,
   createPiResourceDigestFence,
   createPiResourceDigestInput,
   createPluginDiagnosticsTool,
+  createPostgresCredentialVaultPersistenceV1,
   createProviderRuntimeModeAdapter,
   createRemoteWorkerModeAdapter,
   createRemoteWorkerSandbox,
@@ -62,12 +89,15 @@ import {
   createStandaloneAgentHostApp,
   createUserFilesystemBinding,
   createValidatingAgentFleetCompiler,
+  createVaultCredentialStoreBackendV1,
+  createVaultCredentialStoreV1,
   createVercelSandboxModeAdapter,
   decodeBytesFromWorker,
   deepLinkRoutes,
   digestPiResourceInputs,
   encodeBytesForWorker,
   hasBwrap,
+  initializeLocalFileCredentialVersionAnchorV1,
   loadConfiguredAgentFleet,
   materializeAgentDirectory,
   mergeRuntimeFilesystemBindings,
@@ -75,6 +105,7 @@ import {
   normalizeRuntimeReadonlyFilesystemPolicy,
   parseSkillMetadataFrontmatter,
   prepareDeploymentSnapshot,
+  projectAgentRequestRunId,
   projectAuthorizedSessionRunDetails,
   provisionRuntimeWorkspace,
   provisionWorkspaceRuntime,
@@ -88,29 +119,44 @@ import {
   resolveRequestLedgerPath,
   resolveRuntimeReadonlyFilesystemAccess,
   resolveWorkspaceRoot,
+  runCredentialVaultPostgresMigrationsV1,
   sandboxRuntimeHostOperations,
+  shapeChannelText,
   shareResourceUri,
   withResolvedCredential,
   withRuntimeEnvContributions
-} from "../chunk-KDXIXVF6.js";
+} from "../chunk-V3H5A3BR.js";
 import {
   PI_PACKAGE_RESOURCE_FILTERS,
   compactPiPackages,
   createResourceSettingsManager,
   mergePiPackageSources,
   piPackageSourceKey
-} from "../chunk-GS4ADE34.js";
-import "../chunk-6OANSUEI.js";
+} from "../chunk-42D6KAQV.js";
+import "../chunk-72KT6VWV.js";
 import "../chunk-7XAOVFSN.js";
 import "../chunk-YTUZFKB3.js";
-import "../chunk-MVKXLMH3.js";
+import "../chunk-KN72XWP7.js";
 import "../chunk-YGRQ4Q5P.js";
-import "../chunk-3JFPS2O6.js";
+import "../chunk-KJIEMSQP.js";
 export {
   AgentDirectoryCompilerError,
   AgentFleetCompilationError,
   AgentFleetCompilationErrorCode,
   AuthoredAgentMaterializationError,
+  CHANNELS_ENV_FLAG,
+  CHANNEL_DURABLE_STREAM_REQUIRED,
+  CHANNEL_INBOUND_PARKED,
+  CHANNEL_OUTBOUND_PARKED,
+  CHANNEL_RUNTIME_FILE_NAME,
+  CHANNEL_TURN_STALLED,
+  CHANNEL_UNKNOWN_BINDING,
+  ChannelBindingStore,
+  ChannelInboundService,
+  ChannelIntentionService,
+  ChannelMessageRouter,
+  ChannelOutboundService,
+  ChannelSessionCreateTimeoutError,
   DEFAULT_AGENT_FLEET,
   DEFAULT_AGENT_TYPE_ID,
   DEFAULT_PI_RESOURCE_DIGEST_LIMITS,
@@ -120,8 +166,10 @@ export {
   InMemoryAgentRequestLedger,
   MANAGED_AGENT_MCP_DELIVERY_RULE,
   MANAGED_AGENT_MCP_ORIGIN_SURFACE,
+  MIN_REQUEST_RETENTION_MS,
   ManagedAgentMcpDelegateController,
   ManagedAgentMcpError,
+  PI_OAUTH_CREDENTIAL_FIELD_ID_V1,
   PI_PACKAGE_RESOURCE_FILTERS,
   REMOTE_WORKER_EXCLUSIVE_BINARY_CREATE_CAPABILITY,
   REMOTE_WORKER_PROVIDER,
@@ -139,6 +187,9 @@ export {
   WORKER_REQUEST_ID_HEADER,
   WORKER_WORKSPACE_ID_HEADER,
   applyCspHeaders,
+  areChannelsEnabled,
+  assembleNextTurn,
+  assertChannelDurability,
   autoDetectMode,
   buildDeploymentSnapshotRecipe,
   compactPiPackages,
@@ -147,21 +198,30 @@ export {
   constantTimeTokenEqual,
   createAuthMiddleware as createAgentAuthMiddleware,
   createAgentHost,
+  createAgentHostChannelRuntime,
+  createAgentHostChannelStorage,
   createBlaxelSandboxModeAdapter,
   createBoundWorkspaceAgentDispatcher,
+  createChannelIntentionRuntime,
   createConfiguredAgentHostAgentSpec,
   createDirectModeAdapter,
   createEnvironmentProvisioningFingerprint,
-  createFakeAuthorityVerifierV1,
   createHostSideCredentialResolverV1,
   createInMemoryCredentialBackendV1,
+  createInMemoryCredentialVaultPersistenceV1,
+  createInMemoryCredentialVersionAnchorV1,
+  createLocalCredentialVersionAnchorFromEnvV1,
+  createLocalFileCredentialVersionAnchorV1,
+  createLocalKekWorkspaceKekProviderFromEnvV1,
   createLocalModeAdapter,
   createManagedAgentMcpDelegateController,
   createManagedAgentMcpHttpHandler,
   createManagedAgentMcpServer,
+  createOpenAiCodexOAuthBrokerV1,
   createPiResourceDigestFence,
   createPiResourceDigestInput,
   createPluginDiagnosticsTool,
+  createPostgresCredentialVaultPersistenceV1,
   createProviderRuntimeModeAdapter,
   createRemoteWorkerModeAdapter,
   createRemoteWorkerSandbox,
@@ -173,12 +233,15 @@ export {
   createStandaloneAgentHostApp,
   createUserFilesystemBinding,
   createValidatingAgentFleetCompiler,
+  createVaultCredentialStoreBackendV1,
+  createVaultCredentialStoreV1,
   createVercelSandboxModeAdapter,
   decodeBytesFromWorker,
   deepLinkRoutes,
   digestPiResourceInputs,
   encodeBytesForWorker,
   hasBwrap,
+  initializeLocalFileCredentialVersionAnchorV1,
   loadConfiguredAgentFleet,
   materializeAgentDirectory,
   mergePiPackageSources,
@@ -188,6 +251,7 @@ export {
   parseSkillMetadataFrontmatter,
   piPackageSourceKey,
   prepareDeploymentSnapshot,
+  projectAgentRequestRunId,
   projectAuthorizedSessionRunDetails,
   provisionRuntimeWorkspace,
   provisionWorkspaceRuntime,
@@ -201,7 +265,9 @@ export {
   resolveRequestLedgerPath,
   resolveRuntimeReadonlyFilesystemAccess,
   resolveWorkspaceRoot,
+  runCredentialVaultPostgresMigrationsV1,
   sandboxRuntimeHostOperations,
+  shapeChannelText,
   shareResourceUri,
   withResolvedCredential,
   withRuntimeEnvContributions

package/dist/server/worker/index.js

@@ -2,14 +2,14 @@ import {
   REMOTE_WORKER_EXCLUSIVE_BINARY_CREATE_CAPABILITY,
   WORKER_INTERNAL_TOKEN_HEADER,
   constantTimeTokenEqual
-} from "../../chunk-KDXIXVF6.js";
-import "../../chunk-GS4ADE34.js";
-import "../../chunk-6OANSUEI.js";
+} from "../../chunk-V3H5A3BR.js";
+import "../../chunk-42D6KAQV.js";
+import "../../chunk-72KT6VWV.js";
 import "../../chunk-7XAOVFSN.js";
 import "../../chunk-YTUZFKB3.js";
-import "../../chunk-MVKXLMH3.js";
+import "../../chunk-KN72XWP7.js";
 import "../../chunk-YGRQ4Q5P.js";
-import "../../chunk-3JFPS2O6.js";
+import "../../chunk-KJIEMSQP.js";
 
 // src/server/worker/index.ts
 import Fastify from "fastify";

package/dist/{lease-nASWv2tU.d.ts → share-entry-CxS6UJ_L.d.ts}

@@ -1,7 +1,80 @@
+import { C as CredentialConsumerBindingId, P as ProviderId, a as CredentialFieldId, b as ProviderRegistryV1, c as ProviderDefinitionV1, d as CredentialFieldDefinitionV1, A as AuthorizedWorkspaceCredentialScopeV1 } from './file-search-BUgMSKZE.js';
 import { z } from 'zod';
-import { A as AgentDefinitionErrorCode, p as AgentDeploymentErrorCode } from './piChatEvent-BUWIzw5l.js';
+import { A as AgentDefinitionErrorCode, p as AgentDeploymentErrorCode } from './piChatEvent-DpE0lIb9.js';
 import { b as Workspace } from './sandbox-BMhut3kh.js';
 
+type CredentialConsumerKindV1 = "model-provider" | "first-party-tool" | "plugin-server" | "mcp-server" | "tenant-custom-tool";
+type CredentialDeliveryV1 = "host-only" | "sandbox-pipe" | "sandbox-tmpfs";
+/** Immutable authority registered by the host beside the tool/provider catalog. */
+interface CredentialConsumerBindingV1 {
+    readonly contractVersion: "boring.credential-consumer-binding.v1";
+    readonly id: CredentialConsumerBindingId;
+    readonly providerId: ProviderId;
+    readonly consumer: Readonly<{
+        id: string;
+        kind: CredentialConsumerKindV1;
+        trust: "trusted" | "untrusted";
+    }>;
+    readonly purpose: string;
+    readonly allowedFieldIds: readonly CredentialFieldId[];
+    readonly delivery: CredentialDeliveryV1;
+    readonly sandbox?: Readonly<{
+        credentialChannel: "fd-3" | "tmpfs-v1";
+        egressOrigins: readonly `https://${string}`[];
+    }>;
+}
+interface CredentialConsumerBindingRegistryV1 {
+    readonly contractVersion: "boring.credential-consumer-bindings.v1";
+    require(bindingId: CredentialConsumerBindingId): CredentialConsumerBindingV1;
+}
+declare function providerCredentialFieldsV1(provider: ProviderDefinitionV1): readonly CredentialFieldDefinitionV1[];
+declare function createCredentialConsumerBindingRegistryV1(bindings: readonly CredentialConsumerBindingV1[], providerRegistry: ProviderRegistryV1): CredentialConsumerBindingRegistryV1;
+
+declare const PROVIDER_CREDENTIAL_REF_VERSION: "boring.provider-credential-ref.v1";
+/** Constructed by a trusted factory from a registered binding. */
+interface ProviderCredentialRefV1 {
+    readonly contractVersion: typeof PROVIDER_CREDENTIAL_REF_VERSION;
+    readonly providerId: ProviderId;
+    readonly executionId: string;
+    readonly bindingId: CredentialConsumerBindingId;
+}
+interface ProviderCredentialRefFactoryV1 {
+    readonly contractVersion: "boring.provider-credential-ref-factory.v1";
+    create(input: Readonly<{
+        providerId: ProviderId;
+        executionId: string;
+        bindingId: CredentialConsumerBindingId;
+    }>): ProviderCredentialRefV1;
+}
+declare function createProviderCredentialRefFactoryV1(bindingRegistry: CredentialConsumerBindingRegistryV1): ProviderCredentialRefFactoryV1;
+
+type ResolvedCredentialMaterialV1 = Readonly<{
+    kind: "field-set";
+    fields: ReadonlyMap<CredentialFieldId, Uint8Array>;
+}> | Readonly<{
+    kind: "external-managed-account";
+    custodianAdapterId: string;
+    opaqueAccountReference: Uint8Array;
+}> | Readonly<{
+    kind: "none";
+}>;
+interface ResolvedCredentialLeaseV1 {
+    readonly contractVersion: "boring.resolved-credential.v1";
+    readonly workspaceId: string;
+    readonly providerId: ProviderId;
+    readonly credentialVersion: number;
+    readonly executionId: string;
+    /** Server implementation may use a Node byte array; shared stays Uint8Array. */
+    readonly material: ResolvedCredentialMaterialV1;
+    readonly expiresAt: string;
+    /** Idempotent best-effort overwrite and reference release. */
+    dispose(): void;
+}
+interface WorkspaceCredentialResolverV1 {
+    readonly contractVersion: "boring.workspace-credential-resolver.v1";
+    resolve(workspace: AuthorizedWorkspaceCredentialScopeV1, ref: ProviderCredentialRefV1): Promise<ResolvedCredentialLeaseV1>;
+}
+
 interface SandboxHandleRecord {
     workspaceId: string;
     sandboxId: string;
@@ -137,8 +210,8 @@ declare const ShareEntryV1Schema: z.ZodObject<{
         producerPrincipalRef: string;
     }>;
 }, "strict", z.ZodTypeAny, {
-    path: string;
     id: string;
+    path: string;
     workspaceId: string;
     schemaVersion: 1;
     provenance: {
@@ -146,8 +219,8 @@ declare const ShareEntryV1Schema: z.ZodObject<{
         producerPrincipalRef: string;
     };
 }, {
-    path: string;
     id: string;
+    path: string;
     workspaceId: string;
     schemaVersion: 1;
     provenance: {
@@ -254,179 +327,4 @@ type ShareEntryResolution = {
  */
 declare function resolveShareEntry(store: ShareEntryStore, id: string, workspace: Workspace): Promise<ShareEntryResolution>;
 
-/**
- * Opaque, in-process Core capability. The brand symbol and constructor are not
- * exported; Core records issued object identity in a private WeakMap.
- */
-declare const authorizedWorkspaceCredentialScopeBrand: unique symbol;
-interface AuthorizedWorkspaceCredentialScopeV1 {
-    readonly contractVersion: "boring.authorized-workspace-credential-scope.v1";
-    readonly [authorizedWorkspaceCredentialScopeBrand]: true;
-}
-type VerifiedWorkspaceCredentialPrincipalV1 = Readonly<{
-    kind: "user";
-    userId: string;
-    membershipRole: "owner" | "editor" | "viewer";
-}> | Readonly<{
-    kind: "system";
-    principalId: string;
-    workspaceGrantId: string;
-}>;
-interface VerifiedWorkspaceCredentialAuthorityV1 {
-    readonly workspaceId: string;
-    readonly appId: string;
-    readonly principal: VerifiedWorkspaceCredentialPrincipalV1;
-    readonly authorizationReceiptId: string;
-    readonly expiresAt: string;
-}
-/** Core-owned verifier; a TypeScript cast or copied object is never authority. */
-interface WorkspaceCredentialAuthorityVerifierV1 {
-    readonly contractVersion: "boring.workspace-credential-authority-verifier.v1";
-    verifyCurrent(scope: AuthorizedWorkspaceCredentialScopeV1): Promise<VerifiedWorkspaceCredentialAuthorityV1>;
-}
-
-type ProviderId = string & {
-    readonly __providerId: unique symbol;
-};
-type CredentialFieldId = string & {
-    readonly __credentialFieldId: unique symbol;
-};
-type CredentialConsumerBindingId = string & {
-    readonly __credentialConsumerBindingId: unique symbol;
-};
-type ProviderCategoryV1 = "llm" | "search" | "transcription" | "mcp" | "other";
-interface CredentialFieldDefinitionV1 {
-    readonly id: CredentialFieldId;
-    readonly label: string;
-    readonly required: boolean;
-    readonly sensitivity: "secret" | "public";
-    readonly minBytes?: number;
-    readonly maxBytes: number;
-}
-interface ExternalManagedAccountReferenceDefinitionV1 {
-    readonly label: string;
-    readonly maxBytes: number;
-    readonly persistence: "server-only-metadata";
-}
-type ProviderCredentialDefinitionV1 = Readonly<{
-    type: "api-key";
-    fields: readonly CredentialFieldDefinitionV1[];
-}> | Readonly<{
-    type: "oauth2-authorization-code";
-    tokenCustody: "local-vault";
-    clientRegistrationRef: string;
-    authorizationEndpoint: `https://${string}`;
-    tokenEndpoint: `https://${string}`;
-    revocationEndpoint?: `https://${string}`;
-    scopes: readonly string[];
-    usePkce: true;
-    refreshTokenField: CredentialFieldDefinitionV1;
-    resolvedAccessTokenField: CredentialFieldDefinitionV1;
-    accessTokenPersistence: "memory-only";
-}> | Readonly<{
-    type: "oauth2-authorization-code";
-    tokenCustody: "external-managed";
-    custodianAdapterId: string;
-    connectUrlOrigins: readonly `https://${string}`[];
-    scopes: readonly string[];
-    accountReference: ExternalManagedAccountReferenceDefinitionV1;
-    delivery: "host-session-adapter-only";
-}> | Readonly<{
-    type: "none";
-}>;
-interface ProviderDefinitionV1 {
-    readonly contractVersion: "boring.provider.v1";
-    readonly id: ProviderId;
-    readonly displayName: string;
-    readonly category: ProviderCategoryV1;
-    readonly credential: ProviderCredentialDefinitionV1;
-    readonly consumerBindingIds: readonly CredentialConsumerBindingId[];
-    readonly sandboxEgressOrigins: readonly `https://${string}`[];
-    readonly mcp?: Readonly<{
-        transport: "streamable-http";
-        endpoint?: `https://${string}`;
-        toolkitId?: string;
-        allowedTools: readonly string[];
-        deniedTools: readonly string[];
-    }>;
-}
-interface ProviderRegistryV1 {
-    readonly contractVersion: "boring.provider-registry.v1";
-    list(): readonly ProviderDefinitionV1[];
-    require(providerId: ProviderId): ProviderDefinitionV1;
-}
-declare function createProviderRegistryV1(defs: readonly ProviderDefinitionV1[]): ProviderRegistryV1;
-
-type CredentialConsumerKindV1 = "model-provider" | "first-party-tool" | "plugin-server" | "mcp-server" | "tenant-custom-tool";
-type CredentialDeliveryV1 = "host-only" | "sandbox-pipe" | "sandbox-tmpfs";
-/** Immutable authority registered by the host beside the tool/provider catalog. */
-interface CredentialConsumerBindingV1 {
-    readonly contractVersion: "boring.credential-consumer-binding.v1";
-    readonly id: CredentialConsumerBindingId;
-    readonly providerId: ProviderId;
-    readonly consumer: Readonly<{
-        id: string;
-        kind: CredentialConsumerKindV1;
-        trust: "trusted" | "untrusted";
-    }>;
-    readonly purpose: string;
-    readonly allowedFieldIds: readonly CredentialFieldId[];
-    readonly delivery: CredentialDeliveryV1;
-    readonly sandbox?: Readonly<{
-        credentialChannel: "fd-3" | "tmpfs-v1";
-        egressOrigins: readonly `https://${string}`[];
-    }>;
-}
-interface CredentialConsumerBindingRegistryV1 {
-    readonly contractVersion: "boring.credential-consumer-bindings.v1";
-    require(bindingId: CredentialConsumerBindingId): CredentialConsumerBindingV1;
-}
-declare function providerCredentialFieldsV1(provider: ProviderDefinitionV1): readonly CredentialFieldDefinitionV1[];
-declare function createCredentialConsumerBindingRegistryV1(bindings: readonly CredentialConsumerBindingV1[], providerRegistry: ProviderRegistryV1): CredentialConsumerBindingRegistryV1;
-
-declare const PROVIDER_CREDENTIAL_REF_VERSION: "boring.provider-credential-ref.v1";
-/** Constructed by a trusted factory from a registered binding. */
-interface ProviderCredentialRefV1 {
-    readonly contractVersion: typeof PROVIDER_CREDENTIAL_REF_VERSION;
-    readonly providerId: ProviderId;
-    readonly executionId: string;
-    readonly bindingId: CredentialConsumerBindingId;
-}
-interface ProviderCredentialRefFactoryV1 {
-    readonly contractVersion: "boring.provider-credential-ref-factory.v1";
-    create(input: Readonly<{
-        providerId: ProviderId;
-        executionId: string;
-        bindingId: CredentialConsumerBindingId;
-    }>): ProviderCredentialRefV1;
-}
-declare function createProviderCredentialRefFactoryV1(bindingRegistry: CredentialConsumerBindingRegistryV1): ProviderCredentialRefFactoryV1;
-
-type ResolvedCredentialMaterialV1 = Readonly<{
-    kind: "field-set";
-    fields: ReadonlyMap<CredentialFieldId, Uint8Array>;
-}> | Readonly<{
-    kind: "external-managed-account";
-    custodianAdapterId: string;
-    opaqueAccountReference: Uint8Array;
-}> | Readonly<{
-    kind: "none";
-}>;
-interface ResolvedCredentialLeaseV1 {
-    readonly contractVersion: "boring.resolved-credential.v1";
-    readonly workspaceId: string;
-    readonly providerId: ProviderId;
-    readonly credentialVersion: number;
-    readonly executionId: string;
-    /** Server implementation may use a Node byte array; shared stays Uint8Array. */
-    readonly material: ResolvedCredentialMaterialV1;
-    readonly expiresAt: string;
-    /** Idempotent best-effort overwrite and reference release. */
-    dispose(): void;
-}
-interface WorkspaceCredentialResolverV1 {
-    readonly contractVersion: "boring.workspace-credential-resolver.v1";
-    resolve(workspace: AuthorizedWorkspaceCredentialScopeV1, ref: ProviderCredentialRefV1): Promise<ResolvedCredentialLeaseV1>;
-}
-
-export { createAgentDeploymentDigest as $, type AgentSchemaIssue as A, type ResolvedCredentialMaterialV1 as B, type CredentialConsumerBindingId as C, type SandboxHandleRecord as D, type ExternalManagedAccountReferenceDefinitionV1 as E, type SandboxHandleStore as F, Sha256DigestSchema as G, ShareEntryErrorCode as H, InMemoryShareEntryStore as I, type ShareEntryProvenance as J, ShareEntryProvenanceSchema as K, type ShareEntryResolution as L, type ShareEntryStore as M, type ShareEntryTombstone as N, OpaqueRefSchema as O, type ProviderCredentialRefV1 as P, type ShareEntryV1 as Q, type ResolvedCredentialLeaseV1 as R, SchemaValidationError as S, ShareEntryV1Schema as T, ShareEntryValidationError as U, type VerifiedWorkspaceCredentialAuthorityV1 as V, type VerifiedWorkspaceCredentialPrincipalV1 as W, type WorkspaceCredentialAuthorityVerifierV1 as X, type WorkspaceCredentialResolverV1 as Y, createAgentAssetDigest as Z, createAgentDefinitionDigest as _, type Sha256Digest as a, createCredentialConsumerBindingRegistryV1 as a0, createProviderCredentialRefFactoryV1 as a1, createProviderRegistryV1 as a2, providerCredentialFieldsV1 as a3, resolveShareEntry as a4, validateAgentDefinition as a5, validateAgentDeployment as a6, type AgentSchemaValidationResult as b, type CredentialFieldId as c, type AuthorizedWorkspaceCredentialScopeV1 as d, type AgentDefinition as e, type AgentDefinitionDigestAsset as f, type AgentDefinitionReference as g, AgentDefinitionValidationError as h, type AgentDeployment as i, AgentDeploymentValidationError as j, type CompiledAgentBundle as k, type CompiledAgentDefinition as l, type CreateShareEntryInput as m, type CredentialConsumerBindingRegistryV1 as n, type CredentialConsumerBindingV1 as o, type CredentialConsumerKindV1 as p, type CredentialDeliveryV1 as q, type CredentialFieldDefinitionV1 as r, OpaqueShareLocatorIdSchema as s, PROVIDER_CREDENTIAL_REF_VERSION as t, type ProviderCategoryV1 as u, type ProviderCredentialDefinitionV1 as v, type ProviderCredentialRefFactoryV1 as w, type ProviderDefinitionV1 as x, type ProviderId as y, type ProviderRegistryV1 as z };
+export { type AgentSchemaIssue as A, type ShareEntryTombstone as B, type CompiledAgentBundle as C, type ShareEntryV1 as D, ShareEntryV1Schema as E, ShareEntryValidationError as F, createAgentAssetDigest as G, createAgentDefinitionDigest as H, InMemoryShareEntryStore as I, createAgentDeploymentDigest as J, createCredentialConsumerBindingRegistryV1 as K, createProviderCredentialRefFactoryV1 as L, providerCredentialFieldsV1 as M, resolveShareEntry as N, OpaqueRefSchema as O, type ProviderCredentialRefV1 as P, validateAgentDefinition as Q, type ResolvedCredentialLeaseV1 as R, SchemaValidationError as S, validateAgentDeployment as T, type WorkspaceCredentialResolverV1 as W, type Sha256Digest as a, type AgentSchemaValidationResult as b, type AgentDefinition as c, type AgentDefinitionDigestAsset as d, type AgentDefinitionReference as e, AgentDefinitionValidationError as f, type AgentDeployment as g, AgentDeploymentValidationError as h, type CompiledAgentDefinition as i, type CreateShareEntryInput as j, type CredentialConsumerBindingRegistryV1 as k, type CredentialConsumerBindingV1 as l, type CredentialConsumerKindV1 as m, type CredentialDeliveryV1 as n, OpaqueShareLocatorIdSchema as o, PROVIDER_CREDENTIAL_REF_VERSION as p, type ProviderCredentialRefFactoryV1 as q, type ResolvedCredentialMaterialV1 as r, type SandboxHandleRecord as s, type SandboxHandleStore as t, Sha256DigestSchema as u, ShareEntryErrorCode as v, type ShareEntryProvenance as w, ShareEntryProvenanceSchema as x, type ShareEntryResolution as y, type ShareEntryStore as z };