@makaio/framework 1.0.0-dev-1783705652236 → 1.0.0-dev-1783940945655

package/dist/adapters/config/index.d.mts

@@ -1,12 +1,12 @@
-import { _ as BaseAgentConnectorConfig } from "../../types-BrUOVfwe.mjs";
+import { A as PreparedAdapterAuthRuntime, B as ResolvedAdapterAuth, D as AdapterAuthLeaseHandle, F as AdapterAuthError, G as resolveBoundProviderAuth, H as ResolvedConnectorAuthDelivery, I as AdapterAuthErrorReason, L as BindProviderAuthOptions, M as SuppliedAdapterAuthRuntime, N as applySuppliedAdapterAuthRuntime, O as AdapterAuthRuntimePreparer, P as prepareAdapterAuthRuntime, R as BoundProviderAuthContext, U as bindProviderAuth, V as ResolvedAuthCredentialValues, W as getOptionalAuthCredentialFields, _ as BaseAgentConnectorConfig, j as ResolvedAdapterRuntimeConfig, k as BoundAdapterRuntimeConfig, z as ResolveAuthCredentialRefs } from "../../types-DvKaEOOn.mjs";
 import { z } from "zod";
 import { IMakaioBus, MakaioBusContext } from "@makaio/framework/bus";
-import { AIModelSchema, ProtocolId, ProviderContext } from "@makaio/framework/contracts";
+import { AIModelSchema, AdapterProviderAuth, ProtocolId, ProviderContext, ResolvedProviderAuth } from "@makaio/framework/contracts";
 import { BaseAdapterConfigSchema, CredentialRef, ProviderConfigSchema, ProviderDefaultsSchema } from "@makaio/framework/contracts/config";
 import { ClientExecutionContext } from "@makaio/framework/contracts/client";
 import { ProviderRecord } from "@makaio/framework/services/settings/storage";
 import { TimeoutConfig, TrackedTimeoutConfig } from "@makaio/framework/utils";
-import { ProviderConfigFileRecord } from "@makaio/framework/services/adapter-subsystem";
+import { AdapterRuntimeSnapshot, AdapterRuntimeSnapshotErrorCode, AdapterRuntimeSnapshotErrorCode as AdapterRuntimeSnapshotErrorCode$1, ProviderConfigFileRecord } from "@makaio/framework/services/adapter-subsystem";
 import { Simplify } from "type-fest";
 
 //#region adapters/core/src/config/resolve-credential-ref.d.ts
@@ -121,8 +121,6 @@ interface CreateAdapterConfigFactoryOptions<TConfig extends BaseAgentConnectorCo
   adapterDefinition: {
     defaultTimeouts?: TimeoutConfig;
   };
-  /** Wire protocol used to select the correct provider endpoint URL from endpointOverrides. */
-  protocol: ProtocolId;
 }
 /**
  * Minimal input shape required by the factory.
@@ -133,11 +131,18 @@ interface AdapterConfigFactoryInput<TConfig extends BaseAgentConnectorConfig> {
   agentId: string;
   adapterName: string;
   adapterId: string;
-  /**
-   * Unresolved provider context (credential refs, not plaintext).
-   * Connectors resolve credentials locally via `resolveConnectorCredentials()`.
-   */
+  /** Resolved refs-only provider context or the closed provider-less state. */
   providerContext: ProviderContext;
+  /** Exact protocol declared by the selected adapter/provider reference. */
+  providerProtocol?: ProtocolId;
+  /** Adapter/provider auth metadata selected by `providerContext.definitionId`. */
+  adapterProviderAuth?: AdapterProviderAuth;
+  /** Other adapter/provider auth declarations contributing to the scrub union. */
+  compatibleProviderAuths?: readonly AdapterProviderAuth[];
+  /** Whether this adapter rejects the unresolved provider state. */
+  providerContextRequired?: boolean;
+  /** Runtime client identity used to validate client-owned auth methods. */
+  clientId?: string;
   model?: string;
   cwd?: string;
   env?: Record<string, string>;
@@ -153,12 +158,14 @@ interface FactoryGuaranteedFields<TProviderConfig> {
   cwd: string;
   timeouts: TrackedTimeoutConfig;
   providerConfig: TProviderConfig;
+  /** Exact refs-only auth binding consumed once by the central runtime. */
+  boundProviderAuth?: BoundProviderAuthContext;
 }
 /**
  * Result type: input + adapter defaults + guaranteed fields.
  * Simplify flattens the intersection for better type display.
  */
-type ConfigFactoryResult<TInput extends AdapterConfigFactoryInput<TConfig>, TConfig extends BaseAgentConnectorConfig, TProviderConfig = TConfig['providerConfig']> = Simplify<AdapterDefaults<TConfig> & Omit<TInput, 'providerConfig'> & FactoryGuaranteedFields<TProviderConfig>>;
+type ConfigFactoryResult<TInput extends AdapterConfigFactoryInput<TConfig>, TConfig extends BaseAgentConnectorConfig, TProviderConfig = TConfig['providerConfig']> = Simplify<AdapterDefaults<TConfig> & Omit<TInput, 'providerConfig' | 'adapterProviderAuth' | 'compatibleProviderAuths' | 'providerContextRequired'> & FactoryGuaranteedFields<TProviderConfig>>;
 type AdapterConfigFactory<TConfig extends BaseAgentConnectorConfig, TProviderConfig> = {
   getConfig: <TInput extends AdapterConfigFactoryInput<TConfig>>(input: TInput) => Promise<ConfigFactoryResult<TInput, TConfig, TProviderConfig>>; /** Lazily evaluate the thunk and return adapter defaults (model, fastModel, etc.) */
   getDefaults: () => AdapterDefaults<TConfig>;
@@ -167,12 +174,12 @@ type AdapterConfigFactory<TConfig extends BaseAgentConnectorConfig, TProviderCon
  * Create a standardized adapter config factory.
  *
  * Eliminates ceremony by encapsulating the common pattern:
- * 1. Read unresolved providerContext (credential refs only — no plaintext on the bus)
+ * 1. Bind the refs-only provider auth selection to one exact adapter declaration
  * 2. resolveTimeouts with adapter + runtime layers
- * 3. Merge providerConfigDefaults with runtime providerConfig (credentials resolved by connector)
+ * 3. Merge providerConfigDefaults with runtime providerConfig
  *
- * The factory is pure: it does not dispatch any bus requests and does not
- * resolve credentials. Connectors call `resolveConnectorCredentials()` locally.
+ * The factory is pure: it does not dispatch any bus requests or resolve
+ * credential refs. The central connector runtime consumes the bound result.
  *
  * Options are provided via thunk to enable lazy evaluation, avoiding circular
  * dependency issues when config.ts imports from index.ts (for adapterDefinition)
@@ -186,13 +193,23 @@ type AdapterConfigFactory<TConfig extends BaseAgentConnectorConfig, TProviderCon
  *   adapterDefaults: { model: 'gemini-2.5-pro' },
  *   schema: null,
  *   adapterDefinition: { defaultTimeouts: DEFAULT_TIMEOUTS },
- *   protocol: 'openai',
  * }));
  * ```
  */
 declare function createAdapterConfigFactory<TConfig extends BaseAgentConnectorConfig, TProviderConfig = TConfig['providerConfig']>(optionsThunk: () => CreateAdapterConfigFactoryOptions<TConfig>): AdapterConfigFactory<TConfig, TProviderConfig>;
 //#endregion
 //#region adapters/core/src/config/resolve-provider-endpoint.d.ts
+/** Stable authenticated endpoint-resolution failure categories. */
+type ProviderEndpointAuthErrorCode = 'fetch-auth-unsupported' | 'fetch-auth-missing' | 'fetch-auth-resolution-failed';
+/** Typed, credential-free failure for authenticated direct provider fetches. */
+declare class ProviderEndpointAuthError extends Error {
+  readonly code: ProviderEndpointAuthErrorCode;
+  /**
+   * Create an authenticated endpoint-resolution failure.
+   * @param code - Stable failure category
+   */
+  constructor(code: ProviderEndpointAuthErrorCode);
+}
 /**
  * Resolved HTTP endpoint credentials for a provider.
  * Returned by {@link resolveProviderEndpoint} for use by infrastructure-layer
@@ -208,6 +225,13 @@ interface ProviderEndpoint {
    */
   apiKey: string;
 }
+/** Explicit credential-field requirement for the API-key endpoint consumer. */
+interface ProviderEndpointAuthRequirement {
+  /** This endpoint helper currently supports API-key authorization only. */
+  readonly kind: 'api-key';
+  /** Selected auth-method field whose value the HTTP client accepts as its API key. */
+  readonly credentialFieldId: string;
+}
 /**
  * Resolve `{ baseUrl, apiKey }` for a given provider config and wire protocol
  * without requiring an agent context.
@@ -216,69 +240,66 @@ interface ProviderEndpoint {
  * STT/TTS providers) that need to make HTTP calls to cloud providers but are not
  * part of an agent turn.
  *
- * Delegates the common lookup chain (config → definition → endpoint → credentials)
- * to {@link resolveProviderResolution} and applies strict validation on the result:
- * both `baseUrl` and `apiKey` must be present or an error is thrown.
+ * Delegates the atomic config/definition/auth read to
+ * {@link resolveProviderResolution}, then resolves only the explicitly selected
+ * `apiKey` ref through the trusted local credential channel. Inferred and
+ * unauthenticated selections remain valid for refs-only endpoint resolution,
+ * but cannot authorize this API-key-specific fetch seam.
  *
  * Resolution order for the endpoint URL:
  * 1. `ProviderConfig.endpointOverrides[protocol]` (user-customised URL)
  * 2. `ProviderDefinition.endpoints[protocol]` (default from provider package)
  *
- * Credentials are resolved from the config's stored credential refs via the bus.
+ * Credentials are resolved from the normalized explicit auth selection. No
+ * environment or SDK ambient fallback is consulted.
  * @param bus - Makaio bus instance used to query storage and resolve credential refs
  * @param providerConfigId - UUID of the ProviderConfig entity to resolve
  * @param protocol - Wire protocol to select the correct endpoint URL
+ * @param authRequirement - Explicit API-key field required by the direct HTTP consumer
  * @returns Resolved `{ baseUrl, apiKey }` for the provider
  * @throws Error when the ProviderConfig or its ProviderDefinition is not found, or
  *   when `baseUrl` or `apiKey` cannot be resolved from any source
  */
-declare function resolveProviderEndpoint(bus: IMakaioBus, providerConfigId: string, protocol: ProtocolId): Promise<ProviderEndpoint>;
+declare function resolveProviderEndpoint(bus: IMakaioBus, providerConfigId: string, protocol: ProtocolId, authRequirement: ProviderEndpointAuthRequirement): Promise<ProviderEndpoint>;
 //#endregion
 //#region adapters/core/src/config/resolve-provider-resolution.d.ts
+/** Stable provider-resolution failure categories. */
+type ProviderResolutionErrorCode = 'provider-config-not-found';
+/** Typed refs-only provider-resolution failure. */
+declare class ProviderResolutionError extends Error {
+  readonly code: ProviderResolutionErrorCode;
+  /**
+   * Create a provider-resolution failure.
+   * @param code - Stable failure category.
+   * @param message - Credential-free diagnostic.
+   */
+  constructor(code: ProviderResolutionErrorCode, message: string);
+}
 /**
- * Fully resolved provider data returned by {@link resolveProviderResolution}.
- *
- * Callers use this to build protocol-specific outputs (e.g. adapter config,
- * HTTP endpoint) without duplicating the lookup chain.
+ * Definition-backed provider data plus the selected normalized auth snapshot.
+ * Credential values remain refs and are resolved only by a trusted auth
+ * consumer after adapter delivery has been selected.
  */
 interface ProviderResolution {
-  /** Bus-safe provider config read model from the adapter subsystem. */
-  config: ProviderConfigFileRecord;
-  /** The ProviderDefinition record referenced by the config. */
-  definition: ProviderRecord;
-  /**
-   * Resolved base URL for the requested protocol.
-   * `null` when neither the config override nor the definition declares an
-   * endpoint for the requested protocol.
-   */
-  baseUrl: string | null;
-  /**
-   * Plaintext credentials resolved from the config's credential refs.
-   * Empty object when no credentials are configured or none resolve.
-   */
-  credentials: Record<string, string>;
+  /** Bus-safe provider config read model. */
+  readonly config: ProviderConfigFileRecord;
+  /** Provider definition referenced by the config. */
+  readonly definition: ProviderRecord;
+  /** Effective endpoint for the requested protocol, or null when undeclared. */
+  readonly baseUrl: string | null;
+  /** Validated normalized auth selection with credential refs, never plaintext. */
+  readonly auth: ResolvedProviderAuth;
 }
 /**
- * Resolve a ProviderConfig to its full runtime data: config record,
- * definition record, endpoint URL, and plaintext credentials.
- *
- * Encapsulates the common lookup chain shared by the adapter config factory
- * and the provider endpoint resolver:
- * 1. `AdapterSubsystemSubjects.getProviderConfig` for the canonical read model
- * 2. `AdapterSubsystemSubjects.buildProviderContext` for runtime credential refs and endpoint overrides
- * 3. `ProviderStorageSubjects.get` for provider-definition metadata
- * 4. `context.endpointOverrides?.[protocol] ?? definition.endpoints?.[protocol]`
- * 5. Opens a DirectChannel via `CredentialSubjects.getChannelToken` and
- *    resolves each credential ref; the channel is closed after use.
+ * Resolve one provider config to definition metadata, endpoint, and refs-only auth.
  *
- * Callers keep only their differing post-resolution logic (e.g., strict
- * `baseUrl` / `apiKey` validation for HTTP bridges vs. nullable `baseUrl`
- * for adapter factories that allow env-var fallbacks).
- * @param bus - Bus instance for storage and credential requests
- * @param providerConfigId - UUID of the ProviderConfig to resolve
- * @param protocol - Wire protocol used to select the correct endpoint URL
- * @returns Fully resolved provider data
- * @throws Error when the ProviderConfig or its ProviderDefinition is not found
+ * The adapter subsystem is the sole owner of auth-method validation and returns
+ * the safe config, refs-only context, and provider definition from one captured
+ * snapshot. This helper never opens the credential DirectChannel.
+ * @param bus - Bus instance for the atomic adapter-subsystem snapshot request.
+ * @param providerConfigId - Explicit provider config ID.
+ * @param protocol - Wire protocol used to select the endpoint URL.
+ * @returns Definition-backed provider resolution without plaintext credentials.
  */
 declare function resolveProviderResolution(bus: IMakaioBus, providerConfigId: string, protocol: ProtocolId): Promise<ProviderResolution>;
 //#endregion
@@ -287,6 +308,24 @@ declare function resolveProviderResolution(bus: IMakaioBus, providerConfigId: st
 interface CredentialBusContextProvider {
   getContext(): MakaioBusContext;
 }
+/** Stable credential-resolution failure categories. */
+type ConnectorCredentialResolutionErrorCode = 'credential-unavailable' | 'credential-request-failed';
+/** Trusted resolution policy for refs selected by a normalized auth method. */
+interface ConnectorCredentialResolutionOptions {
+  /** Selected field names whose unavailable refs are intentionally omitted. */
+  readonly optionalFields?: readonly string[];
+}
+/**
+ * Typed credential-resolution failure that never retains a ref, secret, or provider error.
+ */
+declare class ConnectorCredentialResolutionError extends Error {
+  readonly code: ConnectorCredentialResolutionErrorCode;
+  /**
+   * Create a sanitized connector credential failure.
+   * @param code - Stable failure category
+   */
+  constructor(code: ConnectorCredentialResolutionErrorCode);
+}
 /**
  * Resolve credential references to plaintext values at the connector layer.
  *
@@ -295,135 +334,119 @@ interface CredentialBusContextProvider {
  * or credential rotation — plaintext never leaves the connector.
  *
  * Returns an empty object immediately when `credentialRefs` is empty,
- * avoiding an unnecessary channel round-trip. Partial failures are
- * tolerated: refs that fail to resolve are omitted and logged. Callers
- * must still validate any required credential fields before using the
- * returned record to build env or client config.
+ * avoiding an unnecessary channel round-trip. Resolution is atomic for
+ * required refs: every required ref must produce a value or the whole
+ * operation fails with a sanitized typed error. Trusted normalized-auth
+ * callers may declare optional selected fields; unavailable optional refs are
+ * omitted rather than turning an explicit selection into an ambient fallback.
  * @param bus - Bus instance with context access for channel token retrieval
  * @param credentialRefs - Credential refs keyed by field name
+ * @param options - Trusted required/optional policy for selected fields
  * @returns Plaintext credential values keyed by field name
  */
-declare function resolveConnectorCredentials(bus: CredentialBusContextProvider, credentialRefs: Record<string, CredentialRef>): Promise<Record<string, string>>;
-//#endregion
-//#region adapters/core/src/config/build-credential-env.d.ts
-/**
- * Build environment variables from resolved credentials.
- *
- * Maps plaintext credential values to their environment variable names
- * using the provider definition's `credentialEnvVars` mapping. Subprocess
- * adapters use this to set the correct env vars before spawning.
- * @example
- * ```typescript
- * // { apiKey: 'sk-...' } + { apiKey: 'ANTHROPIC_API_KEY' }
- * // → { ANTHROPIC_API_KEY: 'sk-...' }
- * ```
- * @param credentials - Resolved plaintext credentials keyed by field name
- * @param credentialEnvVars - Mapping from credential field names to env var names
- * @returns Environment variables ready for process.env / subprocess spawn
- */
-declare function buildCredentialEnv(credentials: Record<string, string>, credentialEnvVars: Record<string, string> | undefined): Record<string, string>;
+declare function resolveConnectorCredentials(bus: CredentialBusContextProvider, credentialRefs: Record<string, CredentialRef>, options?: ConnectorCredentialResolutionOptions): Promise<Record<string, string>>;
 //#endregion
 //#region adapters/core/src/config/resolve-session-environment.d.ts
-/** Minimal bus surface needed for session environment resolution. */
-interface SessionEnvironmentBus {
-  getContext(): MakaioBusContext;
-}
-/**
- * Unresolved provider context fields needed for session environment resolution.
- *
- * Mirrors the relevant subset of {@link ProviderContext} from `@makaio/contracts`
- * so callers can pass the full provider context object without importing it here.
- */
-interface ProviderContextShape {
-  /** Provider config UUID carried by full provider contexts. */
-  providerConfigId?: string;
-  /** Provider definition ID carried by full provider contexts. */
-  definitionId?: string;
-  /** Credential references keyed by field name. */
-  credentialRefs: Record<string, CredentialRef>;
-  /** Maps credential field names to env var names for subprocess adapters. */
-  credentialEnvVars?: Record<string, string>;
-  /** Ambient provider credential env vars to strip before explicit credential injection. */
-  ambientCredentialEnvVars?: readonly string[];
-}
 /**
  * Input options for {@link resolveSessionEnvironment}.
  */
 interface SessionEnvironmentOptions {
-  /** Bus instance used to resolve credential references. */
-  bus: SessionEnvironmentBus;
-  /**
-   * Unresolved provider context carrying credential refs and env-var mapping.
-   * When `undefined`, the credential steps are skipped and `credentials` / `credEnv`
-   * are returned as empty objects.
-   */
-  providerContext: ProviderContextShape | undefined;
+  /** Runtime bus that owns client binary resolution. */
+  globalBus?: IMakaioBus;
   /**
    * Stable client identifier passed to `resolveClientBinary`
-   * (e.g. `'claude-code'`, `'qwen'`, `'github-copilot'`).
+   * (e.g. `'claude-code'`, `'qwen'`, `'github-copilot'`). Omit for
+   * connector-only SDK adapters with no managed binary.
    */
-  clientId: string;
+  clientId?: string;
   /**
-   * Base environment variables that are merged into `spawnEnv` before credential
-   * env and binary env are applied.  Typically the connector's own `this.env`.
+   * Base environment variables explicitly supplied by the host. This function
+   * never falls back to ambient `process.env`.
    */
   baseEnv?: Record<string, string>;
+  /** Non-auth session environment composed over the base environment. */
+  sessionEnv?: Readonly<Record<string, string>>;
+  /** Pre-resolved non-auth binary environment supplied by an external host. */
+  binaryEnv?: Readonly<Record<string, string>>;
+  /** Complete normalized auth source/sink set removed before selected delivery. */
+  scrubEnvVars?: readonly string[];
+  /** Environment returned by the connector-owned client config lease. */
+  leaseEnv?: Readonly<Record<string, string>>;
+  /** Selected normalized process-environment delivery, applied last. */
+  selectedAuthEnv?: Readonly<Record<string, string>>;
 }
 /**
  * Fully resolved session environment returned by {@link resolveSessionEnvironment}.
  *
- * All three resolution steps are returned individually so callers that need
- * non-standard composition (e.g. optional binary env) can do so without
- * repeating the resolution calls.
+ * Binary resolution is returned alongside process-private and shared-context
+ * environment views derived from one authoritative merge.
  */
 interface SessionEnvironmentResult {
-  /**
-   * Plaintext credentials keyed by field name.
-   * Empty when `providerContext` is `undefined` or carries no credential refs.
-   */
-  credentials: Record<string, string>;
-  /**
-   * Environment variables derived from `credentials` via the provider's
-   * `credentialEnvVars` mapping.
-   * Empty when `providerContext` is `undefined` or carries no `credentialEnvVars`.
-   */
-  credEnv: Record<string, string>;
   /**
    * Execution context for the resolved client binary, or `undefined` when
    * no `client.resolveBinary` handler is registered (framework-only boot).
    */
   resolvedBinary: ClientExecutionContext | undefined;
   /**
-   * Merged spawn environment for the common case:
-   * `{ ...cleanBaseEnv, ...credEnv, ...(resolvedBinary?.env ?? {}) }`.
+   * Process-private connector environment:
+   * `{ ...scrub({ ...baseEnv, ...sessionEnv, ...resolvedBinaryEnv, ...binaryEnv, ...leaseEnv }), ...selectedAuthEnv }`.
+   *
+   * This view may contain the selected plaintext process delivery and must not
+   * be copied into bus payloads, logs, or other shared execution contexts.
+   */
+  connectorEnv: Record<string, string>;
+  /**
+   * Shared execution-context environment produced from host/session/binary
+   * inputs after the full auth scrub. Connector-private lease variables are
+   * excluded even when another source supplied the same variable name.
    *
-   * Ambient provider credential env vars are stripped from base env first.
-   * Credential env then takes precedence so that explicitly resolved secrets are
-   * restored. Binary env finally wins over credential env to enforce config
-   * isolation.
+   * Connector-owned bus and tool payloads use this view so explicitly shareable
+   * variables remain available without exporting process authentication or
+   * config-directory capabilities.
    */
-  spawnEnv: Record<string, string>;
+  contextEnv: Readonly<Record<string, string>>;
 }
 /**
- * Resolve credentials, build credential environment variables, and locate the
- * client binary — the three-step pattern shared by subprocess connectors.
+ * Resolve the selected client binary and compose the two environment views.
  *
- * Encapsulates:
- * 1. `resolveConnectorCredentials(bus, credentialRefs)` — opens an encrypted
- *    DirectChannel, resolves each ref, and closes the channel.
- * 2. `buildCredentialEnv(credentials, credentialEnvVars)` — maps credential
- *    values to subprocess env var names.
- * 3. `resolveClientBinary(clientId)` — dispatches `client.resolveBinary` on the
- *    static bus; returns `undefined` in framework-only boot.
- *
- * The returned {@link SessionEnvironmentResult} includes every intermediate
- * value so callers with non-standard composition strategies (e.g. connectors
- * that treat binary env as optional or pass credentials through a different
- * channel) can compose the final env themselves.
+ * Credential refs are deliberately absent from this contract. The normalized
+ * adapter-auth runtime resolves them once and passes only the selected process
+ * delivery. Lease keys are connector-private capabilities: the same names are
+ * removed from the shared view regardless of which environment source supplied
+ * them, while the connector view still receives the scrubbed lease values.
  * @param options - Session environment resolution options
- * @returns Resolved credentials, credential env, binary execution context, and
- *   merged spawn environment
+ * @returns Binary execution context and merged connector/context environments
  */
 declare function resolveSessionEnvironment(options: SessionEnvironmentOptions): Promise<SessionEnvironmentResult>;
 //#endregion
-export { type AIModel, AIModelSchema, type AdapterConfigFactoryInput, type AdapterDefaults, type BaseAdapterConfig, BaseAdapterConfigSchema, type BaseProviderConfig, BaseProviderConfigSchema, type ConfigFactoryResult, type CreateAdapterConfigFactoryOptions, type FactoryGuaranteedFields, type ProviderConfig, ProviderConfigSchema, type ProviderDefaults, ProviderDefaultsSchema, type ProviderEndpoint, type ProviderResolution, type ResolveCredentialRefDeps, type SessionEnvironmentOptions, type SessionEnvironmentResult, buildCredentialEnv, createAdapterConfigFactory, getDefinitionOrThrow, resolveConnectorCredentials, resolveCredentialRef, resolveProviderEndpoint, resolveProviderResolution, resolveSessionEnvironment };
+//#region adapters/core/src/config/resolve-adapter-runtime-snapshot.d.ts
+/** Atomic adapter runtime snapshot with its exact refs-only auth binding. */
+interface BoundAdapterRuntimeSnapshot extends AdapterRuntimeSnapshot {
+  /** Exact selected adapter delivery compiled without resolving plaintext. */
+  readonly boundProviderAuth: BoundProviderAuthContext;
+}
+/** Typed credential-free atomic adapter runtime resolution failure. */
+declare class AdapterRuntimeSnapshotError extends Error {
+  readonly code: AdapterRuntimeSnapshotErrorCode$1;
+  /**
+   * Create an atomic runtime resolution failure.
+   * @param code - Stable failure category returned by the subsystem
+   */
+  constructor(code: AdapterRuntimeSnapshotErrorCode$1);
+}
+/**
+ * Resolve and bind one adapter/provider runtime snapshot in a single subsystem read.
+ *
+ * The response carries refs and runtime-only delivery declarations but never
+ * plaintext. Binding remains in Adapter Core so the lower subsystem does not
+ * depend on this host-layer package.
+ * @param bus - Runtime bus serving the adapter subsystem
+ * @param input - Exact adapter name and provider config selection
+ * @returns Atomic runtime metadata plus immutable refs-only auth binding
+ */
+declare function resolveAdapterRuntimeSnapshot(bus: IMakaioBus, input: {
+  readonly adapterName: string;
+  readonly providerConfigId: string;
+}): Promise<BoundAdapterRuntimeSnapshot>;
+//#endregion
+export { type AIModel, AIModelSchema, AdapterAuthError, type AdapterAuthErrorReason, type AdapterAuthLeaseHandle, type AdapterAuthRuntimePreparer, type AdapterConfigFactoryInput, type AdapterDefaults, AdapterRuntimeSnapshotError, type AdapterRuntimeSnapshotErrorCode, type BaseAdapterConfig, BaseAdapterConfigSchema, type BaseProviderConfig, BaseProviderConfigSchema, type BindProviderAuthOptions, type BoundAdapterRuntimeConfig, type BoundAdapterRuntimeSnapshot, type BoundProviderAuthContext, type ConfigFactoryResult, ConnectorCredentialResolutionError, type ConnectorCredentialResolutionErrorCode, type CreateAdapterConfigFactoryOptions, type FactoryGuaranteedFields, type PreparedAdapterAuthRuntime, type ProviderConfig, ProviderConfigSchema, type ProviderDefaults, ProviderDefaultsSchema, type ProviderEndpoint, ProviderEndpointAuthError, type ProviderEndpointAuthErrorCode, type ProviderEndpointAuthRequirement, type ProviderResolution, ProviderResolutionError, type ProviderResolutionErrorCode, type ResolveAuthCredentialRefs, type ResolveCredentialRefDeps, type ResolvedAdapterAuth, type ResolvedAdapterRuntimeConfig, type ResolvedAuthCredentialValues, type ResolvedConnectorAuthDelivery, type SessionEnvironmentOptions, type SessionEnvironmentResult, type SuppliedAdapterAuthRuntime, applySuppliedAdapterAuthRuntime, bindProviderAuth, createAdapterConfigFactory, getDefinitionOrThrow, getOptionalAuthCredentialFields, prepareAdapterAuthRuntime, resolveAdapterRuntimeSnapshot, resolveBoundProviderAuth, resolveConnectorCredentials, resolveCredentialRef, resolveProviderEndpoint, resolveProviderResolution, resolveSessionEnvironment };

package/dist/adapters/config/index.mjs

@@ -1 +1 @@
-import{t as e}from"../../cleanEnvForAdapter-BooAgM2R.mjs";import{z as t}from"zod";import n from"node:fs/promises";import{createBusInstance as r,openChannel as i}from"@makaio/framework/bus";import{AIModelSchema as a,CredentialSubjects as o}from"@makaio/framework/contracts";import{BaseAdapterConfigSchema as s,ProviderConfigSchema as c,ProviderDefaultsSchema as l}from"@makaio/framework/contracts/config";import{ProviderStorageSubjects as u}from"@makaio/framework/services/settings/storage";import{resolveTimeouts as d}from"@makaio/framework/utils";import{AdapterSubsystemSubjects as f}from"@makaio/framework/services/adapter-subsystem";import{resolveClientBinary as p}from"@makaio/framework/clients";async function m(e,t={}){if(e.startsWith(`env:`)){let n=e.slice(4);if(!n)throw Error(`Credential reference is missing environment variable name`);return(t.readEnv??(e=>process.env[e]))(n)||null}if(e.startsWith(`file:`)){let r=e.slice(5);if(!r)throw Error(`Credential reference is missing file path`);return(await(t.readFile??(async e=>await n.readFile(e,`utf-8`)))(r)).trim()||null}if(e.startsWith(`keychain:`)){let[n,...r]=e.slice(9).split(`:`);if(!n||r.length===0)throw Error(`Credential reference is missing keychain service or account`);if(!t.resolveKeychain)throw Error(`Keychain credential resolution is not configured`);return t.resolveKeychain(n,r.join(`:`))}return e||null}function h(e,t){let n=e.find(e=>e.id===t);if(!n)throw Error(`Provider definition not found: '${t}'`);if(!g(n))throw Error(`Provider definition '${t}' is missing a defaultModel`);return n}function g(e){return typeof e.defaultModel==`string`&&e.defaultModel.length>0}const _=t.record(t.string(),t.unknown());function v(e){return{getDefaults:()=>e().adapterDefaults,getConfig:async t=>{let{adapterName:n,adapterDefaults:r,adapterDefinition:i,protocol:a}=e(),{providerContext:o}=t,s=o.endpointOverrides?.[a]??null,c=d([{layer:`adapter`,source:n,config:i.defaultTimeouts},{layer:`runtime`,source:`config.ts`,config:t.runtimeTimeouts}]),l={...r.providerConfig,...t.providerConfig,baseUrl:s??t.providerConfig?.baseUrl??r.providerConfig?.baseUrl},u=t.model??r.model;if(!u)throw Error(`No model resolved for adapter "${n}" (agentId: ${t.agentId}). Provide a model explicitly or configure adapterDefaults.model.`);return{...r,...t,adapterName:t.adapterName,model:u,cwd:t.cwd??r.cwd??process.cwd(),timeouts:c,providerConfig:l}}}}async function y(e,t){let n=Object.entries(t);if(n.length===0)return{};let a={},s=e.getContext(),{token:c}=await r({context:s}).request(o.getChannelToken,{}),l=await i(s,`credentials`,{token:c,transports:[]});try{let e=await Promise.allSettled(n.map(([,e])=>l.request(o.resolve,{ref:e})));for(let t=0;t<n.length;t++){let[r,i]=n[t],o=e[t];if(o.status===`fulfilled`)if(o.value.value!==null)a[r]=o.value.value;else if(o.value.error){let e=JSON.stringify(i);console.warn(`[resolveConnectorCredentials] Failed to resolve field '${r}' (ref ${e}):`,o.value.error)}else{let e=JSON.stringify(i);console.info(`[resolveConnectorCredentials] Credential unavailable for field '${r}' (ref ${e}); omitting it from the resolved connector credentials.`)}else{let e=JSON.stringify(i);console.warn(`[resolveConnectorCredentials] Failed to resolve field '${r}' (ref ${e}):`,o.reason)}}}finally{l.close()}return a}async function b(e,t,n){let{config:r}=await e.request(f.getProviderConfig,{id:t});if(!r)throw Error(`ProviderConfig '${t}' not found`);let{context:i}=await e.request(f.buildProviderContext,{providerConfigId:t});if(!i)throw Error(`ProviderConfig '${t}' not found`);if(i.definitionId!==r.definitionId)throw Error(`ProviderConfig '${t}' changed during resolution; retry`);let{provider:a}=await e.request(u.get,{id:i.definitionId});if(!a)throw Error(`ProviderDefinition '${r.definitionId}' not found for config '${t}'`);return{config:r,definition:a,baseUrl:i.endpointOverrides?.[n]??a.endpoints?.[n]??null,credentials:await y(e,i.credentialRefs)}}async function x(e,t,n){let{baseUrl:r,credentials:i}=await b(e,t,n);if(!r)throw Error(`Could not resolve baseUrl for ProviderConfig '${t}' with protocol '${n}'. Ensure the provider definition or config override declares an endpoint for this protocol.`);let a=i.apiKey;if(!a)throw Error(`Could not resolve apiKey for ProviderConfig '${t}'. Store credentials via settings before using this provider.`);return{baseUrl:r,apiKey:a}}function S(e,t){if(!t)return{};let n={};for(let[r,i]of Object.entries(t)){let t=e[r];t!==void 0&&(n[i]=t)}return n}async function C(t){let{bus:n,providerContext:r,clientId:i,baseEnv:a={}}=t,o=await y(n,r?.credentialRefs??{}),s=S(o,r?.credentialEnvVars),c=await p(i);return{credentials:o,credEnv:s,resolvedBinary:c,spawnEnv:{...e(a,{omitEnvVars:r?.ambientCredentialEnvVars}),...s,...c?.env??{}}}}export{a as AIModelSchema,s as BaseAdapterConfigSchema,_ as BaseProviderConfigSchema,c as ProviderConfigSchema,l as ProviderDefaultsSchema,S as buildCredentialEnv,v as createAdapterConfigFactory,h as getDefinitionOrThrow,y as resolveConnectorCredentials,m as resolveCredentialRef,x as resolveProviderEndpoint,b as resolveProviderResolution,C as resolveSessionEnvironment};
+import{a as e,c as t,i as n,l as r,n as i,o as a,r as o,s,t as c}from"../../adapter-auth-runtime-a4O7cSNP.mjs";import{z as l}from"zod";import u from"node:fs/promises";import{AIModelSchema as d,AuthFieldIdSchema as f}from"@makaio/framework/contracts";import{BaseAdapterConfigSchema as p,ProviderConfigSchema as m,ProviderDefaultsSchema as h}from"@makaio/framework/contracts/config";import{resolveTimeouts as g}from"@makaio/framework/utils";import{AdapterSubsystemSubjects as _}from"@makaio/framework/services/adapter-subsystem";async function v(e,t={}){if(e.startsWith(`env:`)){let n=e.slice(4);if(!n)throw Error(`Credential reference is missing environment variable name`);return(t.readEnv??(e=>process.env[e]))(n)||null}if(e.startsWith(`file:`)){let n=e.slice(5);if(!n)throw Error(`Credential reference is missing file path`);return(await(t.readFile??(async e=>await u.readFile(e,`utf-8`)))(n)).trim()||null}if(e.startsWith(`keychain:`)){let[n,...r]=e.slice(9).split(`:`);if(!n||r.length===0)throw Error(`Credential reference is missing keychain service or account`);if(!t.resolveKeychain)throw Error(`Keychain credential resolution is not configured`);return t.resolveKeychain(n,r.join(`:`))}return e||null}function y(e,t){let n=e.find(e=>e.id===t);if(!n)throw Error(`Provider definition not found: '${t}'`);if(!b(n))throw Error(`Provider definition '${t}' is missing a defaultModel`);return n}function b(e){return typeof e.defaultModel==`string`&&e.defaultModel.length>0}const x=l.record(l.string(),l.unknown());function S(e){return{getDefaults:()=>e().adapterDefaults,getConfig:t=>C(e,t)}}async function C(e,t){let{adapterName:n,adapterDefaults:r,adapterDefinition:i}=e(),a=T(t),o=t.providerContext.state===`resolved`&&t.providerProtocol!==void 0?t.providerContext.endpointOverrides?.[t.providerProtocol]??null:null,s=g([{layer:`adapter`,source:n,config:i.defaultTimeouts},{layer:`runtime`,source:`config.ts`,config:t.runtimeTimeouts}]),c={...r.providerConfig,...t.providerConfig,baseUrl:o??t.providerConfig?.baseUrl??r.providerConfig?.baseUrl},l=w(t.model??r.model,n,t.agentId),{providerConfig:u,adapterProviderAuth:d,compatibleProviderAuths:f,providerContextRequired:p,...m}=t;return{...r,...m,adapterName:t.adapterName,model:l,cwd:t.cwd??r.cwd??process.cwd(),timeouts:s,providerConfig:c,...a!==void 0&&{boundProviderAuth:a}}}function w(e,t,n){if(e!==void 0&&e.length>0)return e;throw Error(`No model resolved for adapter "${t}" (agentId: ${n}). Provide a model explicitly or configure adapterDefaults.model.`)}function T(e){if(e.providerContext.state===`unresolved`){if(e.providerContextRequired===!0)throw new a(`provider-context-unresolved`,`This adapter requires a resolved provider authentication context.`);return}if(e.adapterProviderAuth===void 0)throw new a(`binding-missing`,`The selected provider has no adapter authentication declaration.`);let t=s({auth:e.providerContext.auth,adapterProviderAuth:e.adapterProviderAuth,compatibleProviderAuths:e.compatibleProviderAuths});if(t.auth.method.owner===`client`&&t.auth.method.clientId!==e.clientId)throw new a(`client-mismatch`,`Selected authentication client does not match the adapter runtime client.`);return t}var E=class extends Error{code;constructor(e,t){super(t),this.code=e,this.name=`ProviderResolutionError`}};async function D(e,t,n){let{snapshot:r}=await e.request(_.resolveProviderRuntimeSnapshot,{providerConfigId:t});if(!r)throw new E(`provider-config-not-found`,`ProviderConfig '${t}' not found`);let i=r.context.endpointOverrides?.[n]??r.definition.endpoints?.[n]??null;return{config:r.config,definition:r.definition,baseUrl:i,auth:r.context.auth}}var O=class extends Error{code;constructor(e){super(`Authenticated provider endpoint resolution failed (${e}).`),this.code=e,this.name=`ProviderEndpointAuthError`}};async function k(t,r,i,a){let{baseUrl:o,auth:s}=await D(t,r,i);if(!o)throw Error(`Could not resolve baseUrl for ProviderConfig '${r}' with protocol '${i}'. Ensure the provider definition or config override declares an endpoint for this protocol.`);if(s.mode!==`explicit`)throw new O(`fetch-auth-unsupported`);let c=f.safeParse(a.credentialFieldId);if(a.kind!==`api-key`||!c.success)throw new O(`fetch-auth-unsupported`);let l=s.definition.fields.find(({id:e})=>e===c.data);if(l===void 0)throw new O(`fetch-auth-unsupported`);let u=s.credentialRefs[l.id];if(u===void 0)throw new O(`fetch-auth-missing`);let d;try{d=(await e(t,{apiKey:u})).apiKey}catch(e){throw e instanceof n&&e.code===`credential-unavailable`?new O(`fetch-auth-missing`):new O(`fetch-auth-resolution-failed`)}if(d===void 0||d.trim()===``)throw new O(`fetch-auth-missing`);return{baseUrl:o,apiKey:d}}var A=class extends Error{code;constructor(e){super(`Adapter runtime snapshot resolution failed (${e}).`),this.code=e,this.name=`AdapterRuntimeSnapshotError`}};async function j(e,t){let n=await e.request(_.resolveAdapterRuntimeSnapshot,t);if(n.status===`error`)throw new A(n.code);let r=n.runtime;if(r.adapterName!==t.adapterName||r.snapshot.context.providerConfigId!==t.providerConfigId)throw new A(`snapshot-identity-mismatch`);let i=s({auth:r.snapshot.context.auth,adapterProviderAuth:r.adapterProviderAuth,compatibleProviderAuths:r.compatibleProviderAuths});if(i.auth.method.owner===`client`&&i.auth.method.clientId!==r.adapterClientId)throw new A(`client-incompatible`);return{...r,boundProviderAuth:i}}export{d as AIModelSchema,a as AdapterAuthError,A as AdapterRuntimeSnapshotError,p as BaseAdapterConfigSchema,x as BaseProviderConfigSchema,n as ConnectorCredentialResolutionError,m as ProviderConfigSchema,h as ProviderDefaultsSchema,O as ProviderEndpointAuthError,E as ProviderResolutionError,c as applySuppliedAdapterAuthRuntime,s as bindProviderAuth,S as createAdapterConfigFactory,y as getDefinitionOrThrow,t as getOptionalAuthCredentialFields,i as prepareAdapterAuthRuntime,j as resolveAdapterRuntimeSnapshot,r as resolveBoundProviderAuth,e as resolveConnectorCredentials,v as resolveCredentialRef,k as resolveProviderEndpoint,D as resolveProviderResolution,o as resolveSessionEnvironment};