@makaio/framework 1.0.0-dev-1783705652236 → 1.0.0-dev-1783940945655

package/dist/.makaio-build.json

@@ -1,5 +1,5 @@
 {
   "version": 1,
-  "fingerprint": "8ffadc741e4269410d04cacdf8ffc8987d1276b9861fb2562c15b58e5a881d96",
-  "builtAt": "2026-07-10T17:48:41.489Z"
+  "fingerprint": "03a8031c3db961e4fe3677c3acddf243e48c6e1217d62f3fbc8d712f47fa660a",
+  "builtAt": "2026-07-13T11:10:14.890Z"
 }

package/dist/account-identity-BYfeWLe-.mjs

@@ -0,0 +1 @@
+import{t as e}from"./json-value-DmU8ibo_.mjs";import"./shared-RP_KARKF.mjs";import{g as t,h as n,m as r}from"./profile-D2m94ZYD.mjs";import{n as i}from"./version-C1-VD-XL.mjs";import{z as a}from"zod";const o=a.enum([`strong`,`alias`]),s=a.object({scheme:t,value:t,strength:o}),c=a.object({key:t,label:a.string(),usedPercentage:a.number().finite().min(0).max(100),resetsAt:n.optional()}),l=a.object({windows:a.array(c)}),u=a.record(a.string(),a.unknown()).optional(),d=a.object({clientId:t,found:a.boolean(),binaryPath:r.optional(),version:a.string().optional(),warningMessage:a.string().optional()}),f=a.object({clientId:t,binaryName:t,supportedVersions:i.optional()}),p=a.object({clientAccountId:t,clientId:t,observedAt:n,source:t,displayLabel:a.string().optional(),usage:l,metadata:u}),m=a.discriminatedUnion(`kind`,[a.object({kind:a.literal(`session`),sessionId:t}),a.object({kind:a.literal(`adapter-session`),adapterSessionId:t}),a.object({kind:a.literal(`both`),sessionId:t,adapterSessionId:t})]),h=a.object({clientId:a.string(),source:a.string(),kind:a.string(),observedAt:n,payload:e}),g={request:a.object({clientId:t,observedAt:n.optional(),displayLabel:a.string().optional(),identifiers:a.array(s).min(1),metadata:u}),response:a.object({clientAccountId:t,displayLabel:a.string().optional()})},_={request:h.extend({locator:m}),response:a.object({handled:a.boolean(),sessionId:t.nullable(),clientAccountId:t.nullable(),changed:a.boolean()})},v={request:a.object({clientId:t,observedAt:n,source:t,account:a.object({displayLabel:a.string().optional(),identifiers:a.array(s).min(1)}),usage:l,metadata:u}),response:a.object({clientAccountId:t,snapshot:p})};export{u as a,_ as c,p as d,c as f,h as i,m as l,g as n,d as o,l as p,o as r,f as s,s as t,v as u};

package/dist/adapter-auth-runtime-a4O7cSNP.mjs

@@ -0,0 +1 @@
+import{AuthenticationError as e}from"@makaio/framework/core";import{createBusInstance as t,openChannel as n}from"@makaio/framework/bus";import{AdapterProviderAuthSchema as r,CredentialSubjects as i,ResolvedProviderAuthSchema as a,assertAdapterAuthBindingMatchesMethod as o}from"@makaio/framework/contracts";import{ClientSubjects as s}from"@makaio/framework/contracts/client";import{resolveClientBinary as c}from"@makaio/framework/clients";function l(e,t={}){let n={};if(e)for(let[t,r]of Object.entries(e))r!==void 0&&(n[t]=r);delete n.NODE_OPTIONS,delete n.CLAUDECODE;for(let e of t.omitEnvVars??[])delete n[e];return n}var u=class extends e{reason;constructor(e,t){super(t),this.reason=e,this.name=`AdapterAuthError`}};function d(e){return e.auth.mode===`explicit`?e.auth.definition.fields.filter(e=>!e.required).map(e=>e.id):[]}function f(e){if(Array.isArray(e)){for(let t of e)f(t);return Object.freeze(e)}if(e&&typeof e==`object`){for(let t of Object.values(e))f(t);return Object.freeze(e)}return e}function p(e,t){return e.owner!==t.owner||e.methodId!==t.methodId?!1:e.owner===`provider`?t.owner===`provider`&&e.providerDefinitionId===t.providerDefinitionId:t.owner===`client`&&e.clientId===t.clientId}function m(e,t){return e.bindings.filter(e=>p(e.method,t))}function h(e,t){let n=m(e,t);if(n.length===0)throw new u(`binding-missing`,`No adapter authentication binding matches the selected method.`);if(n.length>1)throw new u(`binding-ambiguous`,`Multiple adapter authentication bindings match the selected method.`);return n[0]}function g(e,t){let n=new Set;for(let e of t){for(let t of e.scrubEnvVars)n.add(t);for(let t of e.bindings)for(let e of t.deliveries)if(e.kind===`process-env`)for(let t of Object.values(e.fields))n.add(t)}if(e.mode===`explicit`)for(let t of Object.values(e.credentialRefs))t.startsWith(`env:`)&&n.add(t.slice(4));return[...n]}function _(e){let t=a.safeParse(e.auth);if(!t.success)throw Error(`Resolved provider authentication is invalid.`);if(m(e.adapterProviderAuth,t.data.method).length>1)throw new u(`binding-ambiguous`,`Multiple adapter authentication bindings match the selected method.`);let n=r.safeParse(e.adapterProviderAuth);if(!n.success)throw Error(`Selected adapter authentication declaration is invalid.`);let i=[n.data];for(let t of e.compatibleProviderAuths??[]){let e=r.safeParse(t);if(!e.success)throw Error(`Compatible adapter authentication declaration is invalid.`);i.push(e.data)}let s=h(n.data,t.data.method);return o(s,t.data.definition),f({auth:t.data,binding:s,scrubEnvVars:g(t.data,i)})}async function v(e,t){let n=await y(e.auth,t),r=[],i=[];for(let t of e.binding.deliveries){if(t.kind===`process-env`){r.push(...b(n,t.fields));continue}if(t.kind!==`connector`)continue;let e=Object.fromEntries(b(n,t.fields)),a={...t.constants,...e};i.push({target:t.target,values:a})}return f({processEnv:Object.fromEntries(r),connectorDeliveries:i,configInheritance:e.auth.mode===`inferred`?`auth-only`:`empty`})}async function y(e,t){if(e.mode!==`explicit`)return Object.freeze({});let n;try{n=await t(e.credentialRefs)}catch(e){throw e instanceof u?e:new u(`credential-resolution-failed`,`Failed to resolve adapter authentication credentials.`)}if(typeof n!=`object`||!n)throw Error(`Credential resolver returned invalid authentication values.`);let r;try{r=Object.entries(n)}catch{throw Error(`Credential resolver returned invalid authentication values.`)}let i=new Set(Object.keys(e.credentialRefs)),a=new Map;for(let[e,t]of r){if(!i.has(e)||typeof t!=`string`)throw Error(`Credential resolver returned values outside the selected authentication fields.`);a.set(e,t)}let o=[];for(let t of e.definition.fields){let e=a.get(t.id);if(typeof e==`string`&&e.length>0)o.push([t.id,e]);else if(t.required)throw new u(`credential-missing`,`Required authentication field "${t.id}" could not be resolved.`)}return Object.freeze(Object.fromEntries(o))}function b(e,t){let n=[];for(let[r,i]of Object.entries(t)){if(!Object.hasOwn(e,r))continue;let t=e[r];typeof t==`string`&&n.push([i,t])}return n}var x=class extends Error{code;constructor(e){super(e===`credential-unavailable`?`A selected credential is unavailable.`:`Credential resolution failed.`),this.code=e,this.name=`ConnectorCredentialResolutionError`}};async function S(e,r,a={}){let o=Object.entries(r);if(o.length===0)return{};let s={},c=new Set(a.optionalFields),l=e.getContext(),{token:u}=await t({context:l}).request(i.getChannelToken,{}),d=await n(l,`credentials`,{token:u,transports:[]});try{let e=await Promise.all(o.map(async([e,t])=>{try{let n=await d.request(i.resolve,{ref:t});if(n.value===null){if(c.has(e))return;throw new x(`credential-unavailable`)}return[e,n.value]}catch(e){throw e instanceof x?e:new x(`credential-request-failed`)}}));for(let[t,n]of e.filter(e=>e!==void 0))s[t]=n}finally{d.close()}return s}async function C(e){let{globalBus:t,clientId:n,baseEnv:r={},sessionEnv:i={},binaryEnv:a={},scrubEnvVars:o=[],leaseEnv:s={},selectedAuthEnv:u={}}=e,d;if(n!==void 0){if(t===void 0)throw Error(`Client binary resolution requires the adapter runtime global bus.`);d=await c(t,n)}let f={...r,...i,...d?.env??{},...a},p={...f,...s},m=Object.keys(s),h=l(f,{omitEnvVars:[...new Set([...o,...m])]}),g={...l(p,{omitEnvVars:o}),...u};return Object.freeze(h),Object.freeze(g),{resolvedBinary:d,connectorEnv:g,contextEnv:h}}var w=class{bus;clientId;leaseId;releasePromise;constructor(e,t,n){this.bus=e,this.clientId=t,this.leaseId=n}release(){return this.releasePromise??=this.destroy(),this.releasePromise}async destroy(){if(!(await this.bus.request(s.sessionConfig.destroy,{clientId:this.clientId,leaseId:this.leaseId})).success)throw Error(`Client config lease release was unsuccessful.`)}};async function T(e){let t=e.boundProviderAuth;if(t===void 0){let t=Object.freeze({...e.env??{}});return{config:{...e,env:Object.freeze({...t}),contextEnv:t}}}let n=D(e.globalBus);O(t,e.clientId);let r=await v(t,async e=>{try{return await S(n,e,{optionalFields:d(t)})}catch(e){throw e instanceof x&&e.code===`credential-unavailable`?new u(`credential-missing`,`A required authentication credential is unavailable.`):e}}),i=await k(n,e,r);try{A(t,i);let a=await C({globalBus:n,clientId:e.clientId,baseEnv:e.env,scrubEnvVars:t.scrubEnvVars,leaseEnv:i?.env,selectedAuthEnv:r.processEnv}),{boundProviderAuth:o,...s}=e;return{config:{...s,env:a.connectorEnv,contextEnv:a.contextEnv,adapterAuth:r,...a.resolvedBinary!==void 0&&{clientExecution:a.resolvedBinary}},...i!==void 0&&{lease:i.handle}}}catch(e){throw await j(i?.handle,e,`Adapter auth preparation and lease rollback both failed.`),e}}async function E(e,t){let n=M(t.selectorValidatedAuth),r=await C({baseEnv:e.env,sessionEnv:t.sessionEnv,binaryEnv:t.binaryEnv,leaseEnv:t.leaseEnv,scrubEnvVars:t.scrubEnvVars,selectedAuthEnv:n.processEnv}),{boundProviderAuth:i,...a}=e;return{...a,env:r.connectorEnv,contextEnv:r.contextEnv,adapterAuth:n}}function D(e){if(e===void 0)throw new u(`runtime-bus-missing`,`Normalized adapter authentication requires a global bus.`);return e}function O(e,t){let n=e.auth.method;if(n.owner===`client`&&n.clientId!==t)throw new u(`client-mismatch`,`Selected authentication client does not match the adapter runtime client.`)}async function k(e,t,n){if(t.clientId===void 0)return;let r=crypto.randomUUID(),i=await e.request(s.sessionConfig.create,{clientId:t.clientId,leaseId:r,...t.sessionId!==void 0&&{ownerSessionId:t.sessionId},...t.clientProfileName!==void 0&&{profileName:t.clientProfileName},projectDir:t.cwd,configInheritance:n.configInheritance});return{handle:new w(e,t.clientId,r),env:Object.freeze({...i.env}),authMaterialized:i.authMaterialized}}function A(e,t){if(e.auth.mode===`inferred`&&t?.authMaterialized!==!0)throw new u(`native-auth-unavailable`,`Selected native client authentication could not be materialized.`)}async function j(e,t,n){if(e!==void 0)try{await e.release()}catch(e){throw AggregateError([t,e],n,{cause:t})}}function M(e){let t=e.connectorDeliveries.map(e=>Object.freeze({target:e.target,values:Object.freeze({...e.values})}));return Object.freeze({processEnv:Object.freeze({...e.processEnv}),connectorDeliveries:Object.freeze(t),configInheritance:e.configInheritance})}export{S as a,d as c,x as i,v as l,T as n,u as o,C as r,_ as s,E as t,l as u};

package/dist/adapter-binding-DDUyv1JK.d.mts

@@ -0,0 +1,254 @@
+import { z } from "zod";
+
+//#region core/contracts/src/auth/selection.d.ts
+/**
+ * Credential reference accepted by normalized authentication selections.
+ *
+ * Account identity is carried separately through
+ * {@link NativeAccountSelectionSchema}; credential refs identify only
+ * resolvable secret sources.
+ */
+declare const AuthCredentialRefSchema: z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">;
+/** Reference to an authentication method owned by a provider definition. */
+declare const ProviderAuthMethodRefSchema: z.ZodObject<{
+  owner: z.ZodLiteral<"provider">;
+  providerDefinitionId: z.ZodString;
+  methodId: z.ZodString;
+}, z.core.$strict>;
+/** Reference to an authentication method owned by a native client definition. */
+declare const ClientAuthMethodRefSchema: z.ZodObject<{
+  owner: z.ZodLiteral<"client">;
+  clientId: z.ZodString;
+  methodId: z.ZodString;
+}, z.core.$strict>;
+/** Reference to either provider-owned or client-owned authentication. */
+declare const AuthMethodRefSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  owner: z.ZodLiteral<"provider">;
+  providerDefinitionId: z.ZodString;
+  methodId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+  owner: z.ZodLiteral<"client">;
+  clientId: z.ZodString;
+  methodId: z.ZodString;
+}, z.core.$strict>], "owner">;
+/** Optional native account selected for an inferred authentication method. */
+declare const NativeAccountSelectionSchema: z.ZodObject<{
+  managerId: z.ZodString;
+  accountId: z.ZodString;
+}, z.core.$strict>;
+/** Lifecycle manager for a persisted provider configuration. */
+declare const ProviderConfigManagerSchema: z.ZodObject<{
+  kind: z.ZodLiteral<"client">;
+  clientId: z.ZodString;
+}, z.core.$strict>;
+/** Persisted selection of exactly one authentication mode and method. */
+declare const ProviderConfigAuthSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  mode: z.ZodLiteral<"explicit">;
+  method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    owner: z.ZodLiteral<"provider">;
+    providerDefinitionId: z.ZodString;
+    methodId: z.ZodString;
+  }, z.core.$strict>, z.ZodObject<{
+    owner: z.ZodLiteral<"client">;
+    clientId: z.ZodString;
+    methodId: z.ZodString;
+  }, z.core.$strict>], "owner">;
+  credentialRefs: z.ZodRecord<z.ZodString, z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">>;
+}, z.core.$strict>, z.ZodObject<{
+  mode: z.ZodLiteral<"inferred">;
+  method: z.ZodObject<{
+    owner: z.ZodLiteral<"client">;
+    clientId: z.ZodString;
+    methodId: z.ZodString;
+  }, z.core.$strict>;
+  account: z.ZodOptional<z.ZodObject<{
+    managerId: z.ZodString;
+    accountId: z.ZodString;
+  }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+  mode: z.ZodLiteral<"none">;
+  method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    owner: z.ZodLiteral<"provider">;
+    providerDefinitionId: z.ZodString;
+    methodId: z.ZodString;
+  }, z.core.$strict>, z.ZodObject<{
+    owner: z.ZodLiteral<"client">;
+    clientId: z.ZodString;
+    methodId: z.ZodString;
+  }, z.core.$strict>], "owner">;
+}, z.core.$strict>], "mode">;
+type ProviderAuthMethodRef = z.infer<typeof ProviderAuthMethodRefSchema>;
+type ClientAuthMethodRef = z.infer<typeof ClientAuthMethodRefSchema>;
+type AuthMethodRef = z.infer<typeof AuthMethodRefSchema>;
+type AuthCredentialRef = z.infer<typeof AuthCredentialRefSchema>;
+type NativeAccountSelection = z.infer<typeof NativeAccountSelectionSchema>;
+type ProviderConfigManager = z.infer<typeof ProviderConfigManagerSchema>;
+type ProviderConfigAuth = z.infer<typeof ProviderConfigAuthSchema>;
+//#endregion
+//#region core/contracts/src/auth/adapter-binding.d.ts
+/** JSON-safe literal supported by connector auth delivery constants. */
+declare const AdapterAuthConstantSchema: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>;
+/** Map resolved credential fields into a spawned process environment. */
+declare const ProcessEnvAdapterAuthDeliverySchema: z.ZodObject<{
+  kind: z.ZodLiteral<"process-env">;
+  fields: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strict>;
+/** Map resolved fields and JSON constants into an adapter-owned operation. */
+declare const ConnectorAdapterAuthDeliverySchema: z.ZodObject<{
+  kind: z.ZodLiteral<"connector">;
+  target: z.ZodString;
+  fields: z.ZodRecord<z.ZodString, z.ZodString>;
+  constants: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>;
+}, z.core.$strict>;
+/** Delegate authentication materialization to a native client. */
+declare const NativeClientAdapterAuthDeliverySchema: z.ZodObject<{
+  kind: z.ZodLiteral<"native-client">;
+  clientId: z.ZodString;
+}, z.core.$strict>;
+/** Declare that the selected path performs no authentication delivery. */
+declare const NoAdapterAuthDeliverySchema: z.ZodObject<{
+  kind: z.ZodLiteral<"none">;
+}, z.core.$strict>;
+/** One runtime-only adapter delivery strategy for a selected auth method. */
+declare const AdapterAuthDeliverySchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  kind: z.ZodLiteral<"process-env">;
+  fields: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+  kind: z.ZodLiteral<"connector">;
+  target: z.ZodString;
+  fields: z.ZodRecord<z.ZodString, z.ZodString>;
+  constants: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>;
+}, z.core.$strict>, z.ZodObject<{
+  kind: z.ZodLiteral<"native-client">;
+  clientId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+  kind: z.ZodLiteral<"none">;
+}, z.core.$strict>], "kind">;
+/** Runtime-only compatibility and delivery declaration for one auth method. */
+declare const AdapterAuthBindingSchema: z.ZodObject<{
+  method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    owner: z.ZodLiteral<"provider">;
+    providerDefinitionId: z.ZodString;
+    methodId: z.ZodString;
+  }, z.core.$strict>, z.ZodObject<{
+    owner: z.ZodLiteral<"client">;
+    clientId: z.ZodString;
+    methodId: z.ZodString;
+  }, z.core.$strict>], "owner">;
+  deliveries: z.ZodTuple<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"process-env">;
+    fields: z.ZodRecord<z.ZodString, z.ZodString>;
+  }, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"connector">;
+    target: z.ZodString;
+    fields: z.ZodRecord<z.ZodString, z.ZodString>;
+    constants: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>;
+  }, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"native-client">;
+    clientId: z.ZodString;
+  }, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"none">;
+  }, z.core.$strict>], "kind">], z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"process-env">;
+    fields: z.ZodRecord<z.ZodString, z.ZodString>;
+  }, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"connector">;
+    target: z.ZodString;
+    fields: z.ZodRecord<z.ZodString, z.ZodString>;
+    constants: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>;
+  }, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"native-client">;
+    clientId: z.ZodString;
+  }, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"none">;
+  }, z.core.$strict>], "kind">>;
+}, z.core.$strict>;
+/** Complete runtime-only authentication metadata for one adapter/provider ref. */
+declare const AdapterProviderAuthSchema: z.core.$ZodBranded<z.ZodObject<{
+  bindings: z.ZodArray<z.ZodObject<{
+    method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+      owner: z.ZodLiteral<"provider">;
+      providerDefinitionId: z.ZodString;
+      methodId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+      owner: z.ZodLiteral<"client">;
+      clientId: z.ZodString;
+      methodId: z.ZodString;
+    }, z.core.$strict>], "owner">;
+    deliveries: z.ZodTuple<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+      kind: z.ZodLiteral<"process-env">;
+      fields: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+      kind: z.ZodLiteral<"connector">;
+      target: z.ZodString;
+      fields: z.ZodRecord<z.ZodString, z.ZodString>;
+      constants: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>;
+    }, z.core.$strict>, z.ZodObject<{
+      kind: z.ZodLiteral<"native-client">;
+      clientId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+      kind: z.ZodLiteral<"none">;
+    }, z.core.$strict>], "kind">], z.ZodDiscriminatedUnion<[z.ZodObject<{
+      kind: z.ZodLiteral<"process-env">;
+      fields: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+      kind: z.ZodLiteral<"connector">;
+      target: z.ZodString;
+      fields: z.ZodRecord<z.ZodString, z.ZodString>;
+      constants: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>;
+    }, z.core.$strict>, z.ZodObject<{
+      kind: z.ZodLiteral<"native-client">;
+      clientId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+      kind: z.ZodLiteral<"none">;
+    }, z.core.$strict>], "kind">>;
+  }, z.core.$strict>>;
+  scrubEnvVars: z.ZodArray<z.ZodString>;
+}, z.core.$strict>, "AdapterProviderAuth", "out">;
+type AdapterAuthConstant = z.infer<typeof AdapterAuthConstantSchema>;
+/** Readonly declaration shape for process-environment auth delivery. */
+interface ProcessEnvAdapterAuthDelivery {
+  readonly kind: 'process-env';
+  readonly fields: Readonly<Record<string, string>>;
+}
+/** Readonly declaration shape for connector auth delivery. */
+interface ConnectorAdapterAuthDelivery {
+  readonly kind: 'connector';
+  readonly target: string;
+  readonly fields: Readonly<Record<string, string>>;
+  readonly constants?: Readonly<Record<string, AdapterAuthConstant>>;
+}
+/** Readonly declaration shape for native-client auth delivery. */
+interface NativeClientAdapterAuthDelivery {
+  readonly kind: 'native-client';
+  readonly clientId: string;
+}
+/** Readonly declaration shape for an explicit no-delivery binding. */
+interface NoAdapterAuthDelivery {
+  readonly kind: 'none';
+}
+type AdapterAuthDelivery = ProcessEnvAdapterAuthDelivery | ConnectorAdapterAuthDelivery | NativeClientAdapterAuthDelivery | NoAdapterAuthDelivery;
+/** Readonly runtime declaration for one method binding. */
+interface AdapterAuthBinding {
+  readonly method: AuthMethodRef;
+  readonly deliveries: readonly [AdapterAuthDelivery, ...AdapterAuthDelivery[]];
+}
+/** Unvalidated readonly declaration accepted by {@link defineAdapterProviderAuth}. */
+interface AdapterProviderAuthInput {
+  readonly bindings: readonly AdapterAuthBinding[];
+  readonly scrubEnvVars: readonly string[];
+}
+/** Validated runtime declaration attached to an adapter/provider ref. */
+type AdapterProviderAuth = z.infer<typeof AdapterProviderAuthSchema>;
+/**
+ * Validate and clone one runtime-only adapter/provider auth declaration.
+ *
+ * Adapter definitions call this at declaration time so invalid target names,
+ * duplicate bindings, and inconsistent native-client ownership fail before
+ * the adapter enters the runtime registry.
+ * @param auth - Authentication declaration to validate.
+ * @returns Parsed authentication declaration.
+ */
+declare function defineAdapterProviderAuth(auth: AdapterProviderAuthInput): AdapterProviderAuth;
+//#endregion
+export { ProviderConfigAuthSchema as A, ClientAuthMethodRef as C, ProviderAuthMethodRef as D, NativeAccountSelectionSchema as E, ProviderConfigManagerSchema as M, ProviderAuthMethodRefSchema as O, AuthMethodRefSchema as S, NativeAccountSelection as T, ProcessEnvAdapterAuthDeliverySchema as _, AdapterAuthDelivery as a, AuthCredentialRefSchema as b, AdapterProviderAuthInput as c, ConnectorAdapterAuthDeliverySchema as d, NativeClientAdapterAuthDelivery as f, ProcessEnvAdapterAuthDelivery as g, NoAdapterAuthDeliverySchema as h, AdapterAuthConstantSchema as i, ProviderConfigManager as j, ProviderConfigAuth as k, AdapterProviderAuthSchema as l, NoAdapterAuthDelivery as m, AdapterAuthBindingSchema as n, AdapterAuthDeliverySchema as o, NativeClientAdapterAuthDeliverySchema as p, AdapterAuthConstant as r, AdapterProviderAuth as s, AdapterAuthBinding as t, ConnectorAdapterAuthDelivery as u, defineAdapterProviderAuth as v, ClientAuthMethodRefSchema as w, AuthMethodRef as x, AuthCredentialRef as y };

package/dist/{adapter-CA8rPIUz.mjs → adapter-nl_xz9dz.mjs}

@@ -1 +1 @@
-import{_ as e,b as t,c as n,d as r,f as i,g as a,h as o,ht as s,l as c,m as l,o as u,p as d,s as f,t as p,u as m,v as h,y as g}from"./schemas-CVo8qAK-.mjs";import"./compression-C5JAWdgZ.mjs";import"./provider-context-CqMgPOWF.mjs";import"./contracts/adapter/schemas/session-lineage.mjs";import{createBusNamespace as _}from"@makaio/framework/core";const v={getCapabilities:s,startAgent:t,infer:g,listAgents:h,getAgent:e,stopAgent:a,rehydrateAgent:o,getConfigSchema:l,"agent.created":d,"session.created":i,"session.discovered":p,"session.usage":r,"session.closed":m,log:c,error:n,initialized:f,quota:u},y=_(`adapter`,v),b=y.subjects;export{b as n,v as r,y as t};
+import{_ as e,b as t,c as n,d as r,f as i,g as a,h as o,ht as s,l as c,m as l,o as u,p as d,s as f,t as p,u as m,v as h,y as g}from"./schemas-n9Ff6_RX.mjs";import"./compression-CZ_6fYq8.mjs";import"./provider-context-DOsjOjiR.mjs";import"./contracts/adapter/schemas/session-lineage.mjs";import{createBusNamespace as _}from"@makaio/framework/core";const v={getCapabilities:s,startAgent:t,infer:g,listAgents:h,getAgent:e,stopAgent:a,rehydrateAgent:o,getConfigSchema:l,"agent.created":d,"session.created":i,"session.discovered":p,"session.usage":r,"session.closed":m,log:c,error:n,initialized:f,quota:u},y=_(`adapter`,v),b=y.subjects;export{b as n,v as r,y as t};

package/dist/adapter-subsystem/index.d.mts

@@ -1,9 +1,12 @@
 import { z } from "zod";
 import { IMakaioBus } from "@makaio/framework/bus";
 import * as _$_makaio_contracts0 from "@makaio/framework/contracts";
-import { AdapterClientRef, AdapterProviderDefinitionContract, AdapterProviderRef, MakaioNodeExtension, ProtocolId } from "@makaio/framework/contracts";
+import { AdapterClientRef, AdapterProviderDefinitionContract, AdapterProviderRef, MakaioNodeExtension, ProtocolId, ResolvedProviderContext } from "@makaio/framework/contracts";
 import { BaseService } from "@makaio/framework/service-base";
+import { ClientAuthMethodDefinition, ProviderAuthMethodDefinition, ProviderConfigAuth } from "@makaio/framework/contracts/auth";
 import { AdapterFile, ProviderConfigFile } from "@makaio/framework/contracts/config";
+import { ClientDefinition as ClientDefinition$1 } from "@makaio/framework/contracts/client";
+import { ClientRecord, ProviderRecord } from "@makaio/framework/services/settings/storage";
 import { ContributionProcessor, ExtensionCoordinator } from "@makaio/framework/kernel";
 import { AdapterFileConfigSet, IAdapterConfigRepository, IAdapterConfigRepository as IAdapterConfigRepository$1, ProviderConfigFileSet } from "@makaio/framework/services/adapter-subsystem";
 import { AvailableAdapter, HelpLink } from "@makaio/framework/services/settings";
@@ -65,6 +68,13 @@ interface AdapterInitOptions {
    * downstream consumers where the runtime bus differs from the default singleton.
    */
   globalBus?: IMakaioBus;
+  /**
+   * Trusted host-layer auth preparer forwarded opaquely to the adapter factory.
+   *
+   * The core subsystem never invokes or serializes this value, avoiding a
+   * dependency on the host adapter runtime types.
+   */
+  prepareAuthRuntime?: unknown;
 }
 /**
  * Minimal adapter instance surface returned by the adapter factory.
@@ -133,8 +143,6 @@ interface LoadedAdapter {
   providers: LoadedAdapterProvider[];
   /** Adapter-level provider config schema applied during delayed provider resolution. */
   providerConfigSchema?: z.ZodObject<z.ZodRawShape>;
-  /** Adapter-level provider credential schema applied during delayed provider resolution. */
-  providerCredentialSchema?: z.ZodObject<z.ZodRawShape>;
   /** Help links for documentation. */
   helpLinks?: readonly HelpLink[];
   /** Setup instructions in Markdown format. */
@@ -143,6 +151,8 @@ interface LoadedAdapter {
   defaultPresetId?: string;
   /** Client extensions this adapter can delegate to, with compatible version ranges. */
   clients?: readonly AdapterClientRef[];
+  /** Authoritative definitions for every client this adapter may execute. */
+  clientDefinitions?: readonly ClientDefinition$1[];
   /** Wire protocol this adapter speaks (e.g., `'anthropic'`, `'openai'`). */
   protocol?: ProtocolId;
 }
@@ -230,6 +240,8 @@ interface AdapterSubsystemServiceOptions {
    * Platform-provided defaults forwarded to adapter factories.
    */
   readonly platformDefaults: PlatformDefaults;
+  /** Trusted host-layer auth preparer forwarded opaquely to adapter factories. */
+  readonly prepareAuthRuntime?: unknown;
 }
 /**
  * File-backed adapter subsystem service.
@@ -273,6 +285,8 @@ declare class AdapterSubsystemService extends BaseService {
   protected onInit(): Promise<void>;
   private registerBusHandlers;
   private registerReadHandlers;
+  private registerConfigReadHandlers;
+  private registerRuntimeReadHandlers;
   private registerMutationHandlers;
   /**
    * Shut down adapter instances and clear in-memory state on destroy.
@@ -357,7 +371,9 @@ declare class FileAdapterConfigRepository implements IAdapterConfigRepository$1
   loadAdapterConfigs(): Promise<AdapterFileConfigSet>;
   /**
    * Load all validated provider config files from disk.
-   * Invalid JSON or schema mismatches are skipped.
+   *
+   * Structurally invalid provider configs fail the load with a typed diagnostic
+   * so legacy authentication semantics are never silently ignored.
    * @returns Validated provider config file set.
    */
   loadProviderConfigs(): Promise<ProviderConfigFileSet>;
@@ -389,6 +405,7 @@ declare class FileAdapterConfigRepository implements IAdapterConfigRepository$1
    * Read raw JSON files from a directory, returning an empty array when missing.
    * @param directoryPath - Directory to scan.
    * @param label - Human-readable file label for warnings.
+   * @param invalidJsonPolicy - Whether malformed JSON is skipped or rejected.
    * @returns JSON file entries sorted by file name.
    */
   private readJsonFiles;
@@ -398,6 +415,13 @@ declare class FileAdapterConfigRepository implements IAdapterConfigRepository$1
    * @param filePath - Absolute path to the skipped file.
    */
   private warnInvalidFile;
+  /**
+   * Parse one canonical provider config without reinterpreting legacy fields.
+   * @param value - Raw JSON or repository write input.
+   * @param source - Safe provider-config ID used in diagnostics.
+   * @returns Validated canonical provider config.
+   */
+  private parseProviderConfig;
   /**
    * Check a loaded JSON file stem before accepting it as a canonical ID.
    * @param stem - File stem derived from the directory entry.
@@ -445,6 +469,85 @@ declare class FileAdapterConfigRepository implements IAdapterConfigRepository$1
   private assertCanonicalFileStem;
 }
 //#endregion
+//#region subsystems/adapter/src/provider-config-diagnostic-error.d.ts
+/** Stable diagnostic categories for rejected provider-config files. */
+type ProviderConfigDiagnosticCode = 'legacy-provider-config' | 'unsupported-provider-config-version' | 'invalid-provider-config';
+/**
+ * Typed startup/write diagnostic for a provider-config file that cannot be
+ * interpreted under the canonical normalized-auth contract.
+ */
+declare class ProviderConfigDiagnosticError extends Error {
+  /** Stable machine-readable diagnostic code. */
+  readonly code: ProviderConfigDiagnosticCode;
+  /** Safe file name or provider-config identifier rejected by the repository. */
+  readonly source: string;
+  /**
+   * Create a provider-config diagnostic.
+   * @param code - Stable diagnostic category.
+   * @param source - Safe file name or config identifier being parsed.
+   * @param detail - Safe structural detail that contains no credential values.
+   */
+  constructor(code: ProviderConfigDiagnosticCode, source: string, detail: string);
+}
+//#endregion
+//#region subsystems/adapter/src/provider-config-auth-validation.d.ts
+/** Definition records captured while validating one auth selection. */
+interface ValidatedProviderConfigAuth {
+  /** Exact declared method selected by the config. */
+  readonly method: ProviderAuthMethodDefinition | ClientAuthMethodDefinition;
+  /** Provider definition that owns the containing config. */
+  readonly provider: ProviderRecord;
+  /** Client definition when the selected method is client-owned. */
+  readonly client?: ClientRecord;
+}
+/**
+ * Require definition records selected by a structurally valid auth choice to
+ * be enabled before the provider config can become executable.
+ *
+ * Disabled configs may retain structurally valid selections that reference a
+ * disabled catalog record. The gate belongs at enable/runtime transitions so
+ * drafts and managed desired state remain persistable without becoming usable.
+ * @param validated - Definition records returned by structural auth validation.
+ */
+declare function assertProviderConfigAuthDefinitionsEnabled(validated: ValidatedProviderConfigAuth): void;
+/** Stable categories for definition-backed auth-selection validation. */
+type ProviderConfigAuthValidationCode = 'provider-definition-not-found' | 'provider-definition-disabled' | 'client-definition-not-found' | 'client-definition-disabled' | 'auth-method-not-found' | 'auth-mode-mismatch' | 'auth-credential-fields-mismatch';
+/** Typed validation failure for a provider-config auth selection. */
+declare class ProviderConfigAuthValidationError extends Error {
+  readonly code: ProviderConfigAuthValidationCode;
+  /**
+   * Create a definition-backed validation error.
+   * @param code - Stable validation category.
+   * @param message - Human-readable diagnostic that contains no credential values.
+   */
+  constructor(code: ProviderConfigAuthValidationCode, message: string);
+}
+/**
+ * Validate a normalized auth selection against provider/client definition
+ * storage. No compatibility is inferred from provider IDs: client-owned
+ * methods are resolved only from the referenced client definition.
+ * @param bus - Bus used to read provider and client definitions.
+ * @param definitionId - Provider definition selected by the containing config.
+ * @param auth - Complete normalized auth selection.
+ * @param knownProvider - Optional provider record already fetched by the caller.
+ * @returns The validated method and definition records from one lookup snapshot.
+ */
+declare function validateProviderConfigAuth(bus: IMakaioBus, definitionId: string, auth: ProviderConfigAuth, knownProvider?: ProviderRecord): Promise<ValidatedProviderConfigAuth>;
+//#endregion
+//#region subsystems/adapter/src/provider-runtime-view.d.ts
+/** Stable runtime-context assembly failure categories. */
+type ProviderRuntimeContextErrorCode = 'provider-config-disabled';
+/** Typed failure raised before a config can reach adapter startup. */
+declare class ProviderRuntimeContextError extends Error {
+  readonly code: ProviderRuntimeContextErrorCode;
+  /**
+   * Create a runtime provider-context failure.
+   * @param code - Stable failure category.
+   * @param message - Credential-free diagnostic.
+   */
+  constructor(code: ProviderRuntimeContextErrorCode, message: string);
+}
+//#endregion
 //#region subsystems/adapter/src/adapter-subsystem-contribution-factory.d.ts
 /**
  * Dependencies for the adapter subsystem contribution processor factory.
@@ -495,6 +598,8 @@ interface CreateAdapterSubsystemPackageOptions {
    * Platform-provided defaults forwarded to adapter factories.
    */
   readonly platformDefaults: PlatformDefaults;
+  /** Trusted host-layer auth preparer forwarded opaquely to adapter factories. */
+  readonly prepareAuthRuntime?: unknown;
 }
 /**
  * Create the adapter subsystem extension package.
@@ -509,4 +614,4 @@ interface CreateAdapterSubsystemPackageOptions {
  */
 declare function createAdapterSubsystemPackage(options: CreateAdapterSubsystemPackageOptions): MakaioNodeExtension<IMakaioBus>;
 //#endregion
-export { type AdapterInitOptions, type AdapterInstance, type AdapterLogImportConfig, AdapterSubsystemService, AdapterSubsystemToken, CreateAdapterSubsystemPackageOptions, FileAdapterConfigRepository, type IAdapterConfigRepository, type LoadedAdapter, type PlatformDefaults, createAdapterSubsystemContributionProcessor, createAdapterSubsystemPackage, ensureAdapterConfigs, extractAdapterIdFromPackageName, initializeEnabledAdapters, shutdownAdapterInstances, toAvailableAdapter };
+export { type AdapterInitOptions, type AdapterInstance, type AdapterLogImportConfig, AdapterSubsystemService, AdapterSubsystemToken, CreateAdapterSubsystemPackageOptions, FileAdapterConfigRepository, type IAdapterConfigRepository, type LoadedAdapter, type PlatformDefaults, type ProviderConfigAuthValidationCode, ProviderConfigAuthValidationError, type ProviderConfigDiagnosticCode, ProviderConfigDiagnosticError, ProviderRuntimeContextError, type ProviderRuntimeContextErrorCode, type ValidatedProviderConfigAuth, assertProviderConfigAuthDefinitionsEnabled, createAdapterSubsystemContributionProcessor, createAdapterSubsystemPackage, ensureAdapterConfigs, extractAdapterIdFromPackageName, initializeEnabledAdapters, shutdownAdapterInstances, toAvailableAdapter, validateProviderConfigAuth };