@makaio/contracts 1.0.0-dev-1779051654000

package/dist/config/provider-defaults.d.ts

@@ -0,0 +1,207 @@
+import { z } from 'zod';
+import { AIModelSchema } from '../model/index.js';
+export { AIModelSchema };
+/**
+ * Stored protocol endpoint overrides persisted in provider config files.
+ *
+ * The stored file format allows sparse endpoint overrides because a provider
+ * may only override one of the supported wire protocols.
+ */
+export declare const StoredProtocolEndpointsSchema: z.ZodObject<{
+    anthropic: z.ZodOptional<z.ZodString>;
+    openai: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/**
+ * Inferred type for stored protocol endpoint overrides.
+ */
+export type StoredProtocolEndpoints = z.infer<typeof StoredProtocolEndpointsSchema>;
+/**
+ * Provider defaults configuration without display/enabled fields.
+ *
+ * This lower-layer contract is shared by adapter config parsing and settings
+ * RPC schemas, so it must remain outside adapter-core to avoid package cycles.
+ */
+export declare const ProviderDefaultsSchema: z.ZodObject<{
+    model: z.ZodOptional<z.ZodString>;
+    timeouts: z.ZodOptional<z.ZodType<Partial<import("@makaio/framework/contracts").RequiredTimeoutConfig>, unknown, z.core.$ZodTypeInternals<Partial<import("@makaio/framework/contracts").RequiredTimeoutConfig>, unknown>>>;
+    cwd: z.ZodOptional<z.ZodString>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    credentials: z.ZodOptional<z.ZodRecord<z.ZodString, z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">>>;
+    providerSettings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+/**
+ * Configuration for a single adapter provider.
+ *
+ * Providers allow running multiple configurations of the same adapter
+ * (e.g., different API keys, models, or runtime settings).
+ */
+export declare const ProviderConfigSchema: z.ZodObject<{
+    model: z.ZodOptional<z.ZodString>;
+    timeouts: z.ZodOptional<z.ZodType<Partial<import("@makaio/framework/contracts").RequiredTimeoutConfig>, unknown, z.core.$ZodTypeInternals<Partial<import("@makaio/framework/contracts").RequiredTimeoutConfig>, unknown>>>;
+    cwd: z.ZodOptional<z.ZodString>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    credentials: z.ZodOptional<z.ZodRecord<z.ZodString, z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">>>;
+    providerSettings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    providerId: z.ZodOptional<z.ZodString>;
+    definitionId: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+    baseUrl: z.ZodOptional<z.ZodString>;
+    availableModels: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        friendlyName: z.ZodOptional<z.ZodString>;
+        family: z.ZodOptional<z.ZodString>;
+        contextWindowSize: z.ZodNumber;
+        labId: z.ZodString;
+        supportedReasoningLevels: z.ZodOptional<z.ZodObject<{
+            none: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+            low: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+            medium: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+            high: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+            'extra-high': z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+        }, z.core.$strip>>;
+        metadata: z.ZodOptional<z.ZodObject<{
+            maxOutputTokens: z.ZodOptional<z.ZodNumber>;
+            capabilities: z.ZodOptional<z.ZodObject<{
+                vision: z.ZodOptional<z.ZodBoolean>;
+                toolCalling: z.ZodOptional<z.ZodBoolean>;
+                parallelToolCalls: z.ZodOptional<z.ZodBoolean>;
+                structuredOutput: z.ZodOptional<z.ZodBoolean>;
+                pdfUpload: z.ZodOptional<z.ZodBoolean>;
+                speechToText: z.ZodOptional<z.ZodObject<{
+                    modes: z.ZodArray<z.ZodEnum<{
+                        batch: "batch";
+                        streaming: "streaming";
+                    }>>;
+                    vocabularyBiasing: z.ZodOptional<z.ZodBoolean>;
+                }, z.core.$strip>>;
+                textToSpeech: z.ZodOptional<z.ZodObject<{
+                    modes: z.ZodArray<z.ZodEnum<{
+                        buffered: "buffered";
+                        streaming: "streaming";
+                    }>>;
+                    voiceSelection: z.ZodOptional<z.ZodBoolean>;
+                    voiceInstructions: z.ZodOptional<z.ZodBoolean>;
+                    outputFormats: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+            pricing: z.ZodOptional<z.ZodObject<{
+                token: z.ZodOptional<z.ZodObject<{
+                    inputPerMillion: z.ZodNumber;
+                    inputCachedPerMillion: z.ZodOptional<z.ZodNumber>;
+                    cacheWritePerMillion: z.ZodOptional<z.ZodNumber>;
+                    outputPerMillion: z.ZodNumber;
+                }, z.core.$strip>>;
+                request: z.ZodOptional<z.ZodObject<{
+                    multiplier: z.ZodNumber;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+            includedInSubscription: z.ZodOptional<z.ZodBoolean>;
+            description: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>>;
+    modelFilterMode: z.ZodOptional<z.ZodEnum<{
+        allowlist: "allowlist";
+        "show-all": "show-all";
+    }>>;
+    modelVisibility: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<{
+        disabled: "disabled";
+        enabled: "enabled";
+        visible: "visible";
+    }>>>;
+    isDefault: z.ZodDefault<z.ZodBoolean>;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+/**
+ * Adapter configuration file schema.
+ *
+ * This schema defines the structure of user config files stored at:
+ * `~/.makaio/adapters/<adapterName>/config.json`
+ */
+export declare const BaseAdapterConfigSchema: z.ZodObject<{
+    $schema: z.ZodLiteral<"makaio/adapter-config/v2">;
+    defaults: z.ZodOptional<z.ZodObject<{
+        model: z.ZodOptional<z.ZodString>;
+        timeouts: z.ZodOptional<z.ZodType<Partial<import("@makaio/framework/contracts").RequiredTimeoutConfig>, unknown, z.core.$ZodTypeInternals<Partial<import("@makaio/framework/contracts").RequiredTimeoutConfig>, unknown>>>;
+        cwd: z.ZodOptional<z.ZodString>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        credentials: z.ZodOptional<z.ZodRecord<z.ZodString, z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">>>;
+        providerSettings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>>;
+    providers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        model: z.ZodOptional<z.ZodString>;
+        timeouts: z.ZodOptional<z.ZodType<Partial<import("@makaio/framework/contracts").RequiredTimeoutConfig>, unknown, z.core.$ZodTypeInternals<Partial<import("@makaio/framework/contracts").RequiredTimeoutConfig>, unknown>>>;
+        cwd: z.ZodOptional<z.ZodString>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        credentials: z.ZodOptional<z.ZodRecord<z.ZodString, z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">>>;
+        providerSettings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        providerId: z.ZodOptional<z.ZodString>;
+        definitionId: z.ZodOptional<z.ZodString>;
+        name: z.ZodString;
+        baseUrl: z.ZodOptional<z.ZodString>;
+        availableModels: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            friendlyName: z.ZodOptional<z.ZodString>;
+            family: z.ZodOptional<z.ZodString>;
+            contextWindowSize: z.ZodNumber;
+            labId: z.ZodString;
+            supportedReasoningLevels: z.ZodOptional<z.ZodObject<{
+                none: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+                low: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+                medium: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+                high: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+                'extra-high': z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+            }, z.core.$strip>>;
+            metadata: z.ZodOptional<z.ZodObject<{
+                maxOutputTokens: z.ZodOptional<z.ZodNumber>;
+                capabilities: z.ZodOptional<z.ZodObject<{
+                    vision: z.ZodOptional<z.ZodBoolean>;
+                    toolCalling: z.ZodOptional<z.ZodBoolean>;
+                    parallelToolCalls: z.ZodOptional<z.ZodBoolean>;
+                    structuredOutput: z.ZodOptional<z.ZodBoolean>;
+                    pdfUpload: z.ZodOptional<z.ZodBoolean>;
+                    speechToText: z.ZodOptional<z.ZodObject<{
+                        modes: z.ZodArray<z.ZodEnum<{
+                            batch: "batch";
+                            streaming: "streaming";
+                        }>>;
+                        vocabularyBiasing: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strip>>;
+                    textToSpeech: z.ZodOptional<z.ZodObject<{
+                        modes: z.ZodArray<z.ZodEnum<{
+                            buffered: "buffered";
+                            streaming: "streaming";
+                        }>>;
+                        voiceSelection: z.ZodOptional<z.ZodBoolean>;
+                        voiceInstructions: z.ZodOptional<z.ZodBoolean>;
+                        outputFormats: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    }, z.core.$strip>>;
+                }, z.core.$strip>>;
+                pricing: z.ZodOptional<z.ZodObject<{
+                    token: z.ZodOptional<z.ZodObject<{
+                        inputPerMillion: z.ZodNumber;
+                        inputCachedPerMillion: z.ZodOptional<z.ZodNumber>;
+                        cacheWritePerMillion: z.ZodOptional<z.ZodNumber>;
+                        outputPerMillion: z.ZodNumber;
+                    }, z.core.$strip>>;
+                    request: z.ZodOptional<z.ZodObject<{
+                        multiplier: z.ZodNumber;
+                    }, z.core.$strip>>;
+                }, z.core.$strip>>;
+                includedInSubscription: z.ZodOptional<z.ZodBoolean>;
+                description: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>>;
+        modelFilterMode: z.ZodOptional<z.ZodEnum<{
+            allowlist: "allowlist";
+            "show-all": "show-all";
+        }>>;
+        modelVisibility: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<{
+            disabled: "disabled";
+            enabled: "enabled";
+            visible: "visible";
+        }>>>;
+        isDefault: z.ZodDefault<z.ZodBoolean>;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+//# sourceMappingURL=provider-defaults.d.ts.map

package/dist/config/provider-defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-defaults.d.ts","sourceRoot":"","sources":["../../src/config/provider-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKlD,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B;;;kBAM/B,CAAC;AAEZ;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;;;;;iBAkBjC,CAAC;AAEH;;;;;GAKG;AAIH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuB/B,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkBlC,CAAC"}

package/dist/config-namespace-B-nWOYn1.mjs

@@ -0,0 +1 @@
+import{createBusNamespace as e}from"@makaio/framework/core";import{z as t}from"zod";const n=t.object({$schema:t.literal(`makaio/config/v1`).default(`makaio/config/v1`),mode:t.enum([`local`,`remote`,`hybrid`]).default(`local`),role:t.enum([`main-dev-machine`,`server`]).default(`main-dev-machine`),bus:t.object({remote:t.object({url:t.string().url().optional(),secret:t.string().optional()}).optional()}).optional(),relay:t.object({url:t.string().url().optional(),token:t.string().optional(),autoReconnect:t.boolean().optional().default(!0),maxReconnectAttempts:t.number().int().min(0).optional().default(5),heartbeatInterval:t.number().int().positive().optional().default(3e4)}).optional(),features:t.object({voiceBridge:t.boolean().default(!1)}).optional(),fileWatcher:t.object({backend:t.enum([`auto`,`watchman`,`parcel`,`chokidar`]).default(`auto`)}).optional()}),r=t.object({initialization:t.number().optional().describe(`Time allowed for adapter/session initialization (cold starts, auth). Defaults to 30000ms.`),acknowledgement:t.number().optional().describe(`Time allowed for acknowledgement that a message was received. Defaults to 30000ms.`),completion:t.number().optional().describe(`Time allowed for completion of complex reasoning operations. Defaults to 60000ms.`),toolApproval:t.number().optional().describe(`Time allowed for tool approval responses (user is waiting). Defaults to 5000ms.`),eventWait:t.number().optional().describe(`Default time for once() calls waiting for events. Defaults to 10000ms.`)}),i={get:{request:t.object({}),response:t.object({config:n})},update:{request:t.object({config:n}),response:t.object({success:t.boolean()})}},a=e(`config`,i),o=a.subjects;export{n as a,r as i,o as n,i as r,a as t};

package/dist/credential/change-sequence.d.ts

@@ -0,0 +1,13 @@
+import { z } from 'zod';
+/**
+ * Shared credential-change sequence contract.
+ *
+ * Safe-integer bounds keep the bus contract aligned with the runtime
+ * sequencer, which only accepts exact JavaScript integers.
+ */
+export declare const CredentialChangeSequenceSchema: z.ZodNumber;
+/**
+ * Credential-change sequence inferred from the shared schema.
+ */
+export type CredentialChangeSequence = z.infer<typeof CredentialChangeSequenceSchema>;
+//# sourceMappingURL=change-sequence.d.ts.map

package/dist/credential/change-sequence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-sequence.d.ts","sourceRoot":"","sources":["../../src/credential/change-sequence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,aAAuD,CAAC;AAEnG;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}

package/dist/credential/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Public API for the credential contracts.
+ * @packageDocumentation
+ */
+export { CredentialNamespace, CredentialSubjects } from './namespace.js';
+export { CredentialChangeSequenceSchema } from './change-sequence.js';
+export type { CredentialChangeSequence } from './change-sequence.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/credential/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AACtE,YAAY,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/credential/namespace.d.ts

@@ -0,0 +1,242 @@
+/**
+ * Credential namespace for the Makaio bus.
+ *
+ * Provides top-level bus subjects for credential CRUD and resolution,
+ * keyed by `configId`. Provider-config entities use their UUID as the configId;
+ * other callers (e.g., GitHub OAuth) use a well-known synthetic key such as
+ * `'github:oauth-default'`.
+ *
+ * Channel-only subjects (`store`, `get`, `resolve`) carry sensitive credential
+ * data and are rejected by the public bus. Callers must open a DirectChannel
+ * via the `getChannelToken` subject before using them. `getChannelToken` itself
+ * is local-only — it is never routed to remote transports — so only in-process
+ * bus participants can request the capability token.
+ *
+ * Prefix: `credential.`
+ * @example
+ * ```typescript
+ * // Obtain a channel token, then open a channel for sensitive operations
+ * const { token } = await bus.request(CredentialSubjects.getChannelToken, {});
+ * const channel = await openChannel(bus.getContext(), 'credentials', { token, transports: [] });
+ *
+ * // Store credentials over the encrypted channel
+ * await channel.request(CredentialSubjects.store, {
+ *   configId: 'uuid-here',
+ *   credentials: { apiKey: 'sk-...' },
+ * });
+ *
+ * // Resolve a credential reference over the encrypted channel
+ * const { value } = await channel.request(CredentialSubjects.resolve, { ref });
+ * ```
+ * @packageDocumentation
+ */
+import { z } from 'zod';
+/** Credential service namespace registered under the `credential` prefix. */
+export declare const CredentialNamespace: import("@makaio/framework/core").BusNamespaceDefinition<"credential", {
+    /**
+     * Store credentials for a provider config.
+     * Channel-only — carries sensitive credential data.
+     */
+    store: import("@makaio/framework/core").ChannelSubjectSchema<{
+        request: z.ZodObject<{
+            configId: z.ZodString;
+            credentials: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strip>;
+        response: z.ZodObject<{}, z.core.$strip>;
+    }>;
+    /**
+     * Retrieve stored credentials for a provider config.
+     * Channel-only — carries sensitive credential data.
+     */
+    get: import("@makaio/framework/core").ChannelSubjectSchema<{
+        request: z.ZodObject<{
+            configId: z.ZodString;
+        }, z.core.$strip>;
+        response: z.ZodObject<{
+            credentials: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strip>;
+    }>;
+    /** Check whether credentials exist for a provider config. */
+    exists: {
+        request: z.ZodObject<{
+            configId: z.ZodString;
+        }, z.core.$strip>;
+        response: z.ZodObject<{
+            exists: z.ZodBoolean;
+        }, z.core.$strip>;
+    };
+    /** Delete stored credentials for a provider config. */
+    delete: {
+        request: z.ZodObject<{
+            configId: z.ZodString;
+        }, z.core.$strip>;
+        response: z.ZodObject<{
+            deleted: z.ZodBoolean;
+        }, z.core.$strip>;
+    };
+    /**
+     * Pre-resolution activation hook for credential extensions.
+     *
+     * Emitted before `resolveConnectorCredentials()` runs so extensions
+     * (e.g., account-manager) can prepare native credential stores.
+     * Awaited before credential resolution — handler failures are suppressed
+     * (errors cannot block agent start), but completion is guaranteed before
+     * `resolveConnectorCredentials()` runs.
+     */
+    activate: {
+        request: z.ZodObject<{
+            providerConfigId: z.ZodString;
+            definitionId: z.ZodString;
+            credentialRefs: z.ZodRecord<z.ZodString, z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">>;
+        }, z.core.$strip>;
+        response: z.ZodObject<{}, z.core.$strip>;
+    };
+    /**
+     * Mid-session credential rotation signal.
+     *
+     * Emitted when credential state changes during active sessions.
+     * The orchestrator fans this out to affected agents.
+     */
+    changed: {
+        request: z.ZodObject<{
+            sessionId: z.ZodString;
+            providerConfigId: z.ZodString;
+            definitionId: z.ZodString;
+            changeSequence: z.ZodNumber;
+            credentialRefs: z.ZodRecord<z.ZodString, z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">>;
+        }, z.core.$strip>;
+        response: z.ZodObject<{}, z.core.$strip>;
+    };
+    /**
+     * Resolve a credential reference to its plaintext value.
+     * Channel-only — the resolved value is sensitive.
+     */
+    resolve: import("@makaio/framework/core").ChannelSubjectSchema<{
+        request: z.ZodObject<{
+            ref: z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">;
+        }, z.core.$strip>;
+        response: z.ZodObject<{
+            value: z.ZodNullable<z.ZodString>;
+            error: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }>;
+    /**
+     * Request the credential channel capability token (local-only).
+     *
+     * The token grants access to encrypted credential operations. This subject
+     * is local-only to prevent the token from leaking to remote transports.
+     * The runtime distributes this token only to authorized services during
+     * initialization.
+     */
+    getChannelToken: import("@makaio/framework/core").LocalSubjectSchema<{
+        request: z.ZodObject<{}, z.core.$strip>;
+        response: z.ZodObject<{
+            token: z.ZodString;
+        }, z.core.$strip>;
+    }>;
+}>;
+/** Pre-extracted credential bus subjects for direct import. */
+export declare const CredentialSubjects: import("@makaio/framework/core").BusSubjects<import("@makaio/framework/core").FlatSubjectDefinitions<"credential", {
+    /**
+     * Store credentials for a provider config.
+     * Channel-only — carries sensitive credential data.
+     */
+    store: import("@makaio/framework/core").ChannelSubjectSchema<{
+        request: z.ZodObject<{
+            configId: z.ZodString;
+            credentials: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strip>;
+        response: z.ZodObject<{}, z.core.$strip>;
+    }>;
+    /**
+     * Retrieve stored credentials for a provider config.
+     * Channel-only — carries sensitive credential data.
+     */
+    get: import("@makaio/framework/core").ChannelSubjectSchema<{
+        request: z.ZodObject<{
+            configId: z.ZodString;
+        }, z.core.$strip>;
+        response: z.ZodObject<{
+            credentials: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strip>;
+    }>;
+    /** Check whether credentials exist for a provider config. */
+    exists: {
+        request: z.ZodObject<{
+            configId: z.ZodString;
+        }, z.core.$strip>;
+        response: z.ZodObject<{
+            exists: z.ZodBoolean;
+        }, z.core.$strip>;
+    };
+    /** Delete stored credentials for a provider config. */
+    delete: {
+        request: z.ZodObject<{
+            configId: z.ZodString;
+        }, z.core.$strip>;
+        response: z.ZodObject<{
+            deleted: z.ZodBoolean;
+        }, z.core.$strip>;
+    };
+    /**
+     * Pre-resolution activation hook for credential extensions.
+     *
+     * Emitted before `resolveConnectorCredentials()` runs so extensions
+     * (e.g., account-manager) can prepare native credential stores.
+     * Awaited before credential resolution — handler failures are suppressed
+     * (errors cannot block agent start), but completion is guaranteed before
+     * `resolveConnectorCredentials()` runs.
+     */
+    activate: {
+        request: z.ZodObject<{
+            providerConfigId: z.ZodString;
+            definitionId: z.ZodString;
+            credentialRefs: z.ZodRecord<z.ZodString, z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">>;
+        }, z.core.$strip>;
+        response: z.ZodObject<{}, z.core.$strip>;
+    };
+    /**
+     * Mid-session credential rotation signal.
+     *
+     * Emitted when credential state changes during active sessions.
+     * The orchestrator fans this out to affected agents.
+     */
+    changed: {
+        request: z.ZodObject<{
+            sessionId: z.ZodString;
+            providerConfigId: z.ZodString;
+            definitionId: z.ZodString;
+            changeSequence: z.ZodNumber;
+            credentialRefs: z.ZodRecord<z.ZodString, z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">>;
+        }, z.core.$strip>;
+        response: z.ZodObject<{}, z.core.$strip>;
+    };
+    /**
+     * Resolve a credential reference to its plaintext value.
+     * Channel-only — the resolved value is sensitive.
+     */
+    resolve: import("@makaio/framework/core").ChannelSubjectSchema<{
+        request: z.ZodObject<{
+            ref: z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">;
+        }, z.core.$strip>;
+        response: z.ZodObject<{
+            value: z.ZodNullable<z.ZodString>;
+            error: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }>;
+    /**
+     * Request the credential channel capability token (local-only).
+     *
+     * The token grants access to encrypted credential operations. This subject
+     * is local-only to prevent the token from leaking to remote transports.
+     * The runtime distributes this token only to authorized services during
+     * initialization.
+     */
+    getChannelToken: import("@makaio/framework/core").LocalSubjectSchema<{
+        request: z.ZodObject<{}, z.core.$strip>;
+        response: z.ZodObject<{
+            token: z.ZodString;
+        }, z.core.$strip>;
+    }>;
+}>, "credential">;
+//# sourceMappingURL=namespace.d.ts.map

package/dist/credential/namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../src/credential/namespace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyIxB,6EAA6E;AAC7E,eAAO,MAAM,mBAAmB;IA5H9B;;;OAGG;;;;;;;;IAUH;;;OAGG;;;;;;;;;IAWH,6DAA6D;;;;;;;;;IAW7D,uDAAuD;;;;;;;;;IAWvD;;;;;;;;OAQG;;;;;;;;;IAYH;;;;;OAKG;;;;;;;;;;;IAgBH;;;OAGG;;;;;;;;;;IAaH;;;;;;;OAOG;;;;;;;EAWiF,CAAC;AAEvF,+DAA+D;AAC/D,eAAO,MAAM,kBAAkB;IA/H7B;;;OAGG;;;;;;;;IAUH;;;OAGG;;;;;;;;;IAWH,6DAA6D;;;;;;;;;IAW7D,uDAAuD;;;;;;;;;IAWvD;;;;;;;;OAQG;;;;;;;;;IAYH;;;;;OAKG;;;;;;;;;;;IAgBH;;;OAGG;;;;;;;;;;IAaH;;;;;;;OAOG;;;;;;;iBAcyD,CAAC"}

package/dist/credential-ref-DAVeyQ2h.mjs

@@ -0,0 +1 @@
+import"./visibility-D4i0fywT.mjs";import{z as e}from"zod";const t=`stored:providerConfig:`,n=`account-manager:`;function r(e){if(!e.startsWith(t))return null;let n=e.slice(22),r=n.lastIndexOf(`:`);if(r===-1)return null;let i=n.slice(0,r),a=n.slice(r+1);return!i||!a||a.includes(`:`)?null:{configId:i,key:a}}function i(e,t){if(!e.startsWith(t))return!1;let n=e.slice(t.length),r=n.indexOf(`:`);return!(r<=0||r>=n.length-1)}function a(e){if(!e.startsWith(n))return null;try{let t=JSON.parse(e.slice(16));return!Array.isArray(t)||t.length!==2||typeof t[0]!=`string`||typeof t[1]!=`string`||t[0].length===0||t[1].length===0?null:{clientId:t[0],accountId:t[1]}}catch{return null}}function o(e){if(r(e))return!0;if(e.startsWith(`env:`)){let t=e.slice(4);return/^[A-Za-z_][A-Za-z0-9_]*$/.test(t)}return e.startsWith(`file:`)?e.length>5:!!(i(e,`keychain:`)||a(e))}function s(e){return a(e)!==null}const c=e.string().refine(o,{message:`Invalid credential reference format.`}).brand();function l(e,n){if(n.includes(`:`))throw Error(`Credential key must not contain colons: "${n}"`);return c.parse(`${t}${e}:${n}`)}function u(e,t){return c.parse(`${n}${JSON.stringify([e,t])}`)}function d(e){return r(e)}function f(e){if(!e)return;let t={};for(let[n,r]of Object.entries(e))t[n]=c.parse(r);return t}function p(e){if(e)return Object.fromEntries(Object.entries(e).map(([e,t])=>[e,t]))}export{s as a,l as i,f as n,d as o,u as r,p as s,c as t};

package/dist/definition-7C4TvfXk.mjs

@@ -0,0 +1 @@
+import{i as e,t}from"./visibility-D4i0fywT.mjs";import{z as n}from"zod";const r=n.enum([`anthropic`,`openai`]),i=n.object({anthropic:n.string().url(),openai:n.string().url()}).partial().refine(e=>Object.keys(e).length>0,{message:`At least one protocol endpoint must be specified`}),a=n.object({id:n.string().min(1),name:n.string().min(1),description:n.string().optional(),endpoints:i.optional(),defaultModel:n.string().optional(),fastModel:n.string().optional(),primaryTestModel:n.string().optional(),secondaryTestModel:n.string().optional(),availableModels:n.array(e).default([]),defaultModelFilterMode:t.optional(),credentialEnvVars:n.record(n.string(),n.string()).optional()});export{r as n,a as r,i as t};