@makaio/framework 1.0.0-dev-1783705652236 → 1.0.0-dev-1783940945655

package/dist/tools-C8vqn1KY.mjs

@@ -0,0 +1 @@
+import{B as e,b as t}from"./handlers-RGs3eC9X.mjs";import{SessionStorageSubjects as n}from"./services/session/storage/namespace.mjs";import{$ as r,D as i,L as a,W as o,a as s,b as c,c as l,f as u,i as d,j as f,n as ee,q as te,r as ne,tt as re}from"./session-CAjudDuJ.mjs";import{n as p}from"./namespace-D7pE2QWv.mjs";import{t as ie}from"./capability-service-Dg2bU8qc.mjs";import"./services/adapter-subsystem/index.mjs";import{i as ae,s as oe}from"./model-registry-C8MInDtX.mjs";import{t as se}from"./tool-approval-service-Dh0XI21f.mjs";import{t as ce}from"./tray-menu-service-Bonl2KXf.mjs";import{r as m,t as h}from"./handler-4pKQi3eo.mjs";import{n as le}from"./package-BwvGaKwn.mjs";import{t as ue}from"./filesystem-service-maY_P3yA.mjs";import{z as g}from"zod";import{createHash as de}from"node:crypto";import{MakaioError as fe,createMakaioContext as pe}from"@makaio/framework/core";import{MakaioBus as _}from"@makaio/framework/bus";import{AdapterSubjects as me,ArtifactSubjects as v,CanonicalModelSubjects as he,DEFAULT_HARNESSES as ge,HarnessDefinitionCreateSchema as _e,HarnessSubjects as y,JsonValueSchema as ve,ToolSubjects as b,TransitionRuleDefinitionSchema as ye,WorkflowBlocksSubjects as be,WorkflowSubjects as xe,dep as x,extensionToken as S,validateToolAdapterIdentity as Se,zodSchemaToJsonRecord as C}from"@makaio/framework/contracts";import{BaseService as w}from"@makaio/framework/service-base";import{registerDrizzleHandlers as T}from"@makaio/framework/storage/drizzle";import{slugifyProviderConfigName as E}from"@makaio/framework/contracts/config";import{ClientAccountIdentifierSchema as Ce,ClientSessionAccountObserveSchema as we,ClientSubjects as D}from"@makaio/framework/contracts/client";import{FacetSubjects as O}from"@makaio/framework/contracts/facet";import{MaterializationSubjects as k}from"@makaio/framework/contracts/materialization";import{FILE_ACCESS_RULES_KEY as Te,FILE_ACCESS_RULES_KEY as Ee,ToolErrorCodes as A,errorToToolResult as De,extractToolFilePath as Oe,toolError as j,toolSuccess as ke}from"@makaio/framework/tools";import{ConditionSchema as Ae,evaluate as je}from"@makaio/framework/rules";import{evaluateSync as Me}from"@makaio/framework/expression";import{GitService as Ne}from"@makaio/framework/git";const Pe=[{type:`supersedes`,symmetry:`asymmetric`},{type:`contradicts`,symmetry:`symmetric`},{type:`derives_from`,symmetry:`asymmetric`},{type:`responds_to`,symmetry:`asymmetric`},{type:`contains`,symmetry:`asymmetric`},{type:`refines`,symmetry:`asymmetric`},{type:`scopes`,symmetry:`asymmetric`},{type:`references`,symmetry:`asymmetric`},{type:`evidenced_by`,symmetry:`asymmetric`}],M={extension:0,"factory-repo":1,"target-repo":2},N={source:`extension`,ownerKey:`extension:bus`};function P(e){return`${e.source}:${e.ownerKey}`}function Fe(e,t){return e.source===t.source&&e.ownerKey===t.ownerKey}function F(e){return structuredClone(e)}function I(e,t){return`${e}@${t}`}var L=class extends w{kinds=new Map;kindContributions=new Map;nextKindContributionOrder=0;relationTypes=new Map;constructor(e){super(e)}async onInit(){for(let e of Pe)this.relationTypes.set(e.type,e);this.registerHandler(v.kind.register,e=>{this.registerKind(e.payload),e.setResult({registered:!0})}),this.registerHandler(v.kind.list,e=>{let{kind:t}=e.payload,n=[...this.kinds.values()].filter(e=>!t||e.kind===t).map(F);e.setResult({kinds:n})}),this.registerHandler(v[`relation-type`].register,e=>{this.storeRelationType(e.payload),e.setResult({registered:!0})}),this.registerHandler(v[`relation-type`].list,e=>{let{type:t}=e.payload,n=[...this.relationTypes.values()].filter(e=>!t||e.type===t).map(F);e.setResult({relationTypes:n})})}compareKindContributions(e,t){let n=M[e.owner.source]-M[t.owner.source];return n===0?e.owner.source===`extension`?t.order-e.order:e.order-t.order:n}findSameTierRepoConflict(e,t,n){return[...e.values()].find(e=>!Fe(e.owner,t)&&e.owner.source===t.source&&t.source!==`extension`&&e.order<=n)}recomputeKindWinner(e){let t=this.kindContributions.get(e),n=this.kinds.get(e);if(t===void 0||t.size===0){this.kindContributions.delete(e),this.kinds.delete(e),this.emitKindChangedFromKey(e,n);return}let r;for(let e of t.values())(r===void 0||this.compareKindContributions(e,r)<0)&&(r=e);let i=r;this.kinds.set(e,F(i.registration)),JSON.stringify(n)!==JSON.stringify(i.registration)&&this.bus.emit(v.kind.changed,{kind:i.registration.kind,schemaVersion:i.registration.schemaVersion})}emitKindChangedFromKey(e,t){t!==void 0&&this.bus.emit(v.kind.changed,{kind:t.kind,schemaVersion:t.schemaVersion})}registerKind(e,t=N){let n=I(e.kind,e.schemaVersion),r=this.kindContributions.get(n)??new Map,i=P(t),a=r.get(i),o=t.source===`extension`?this.nextKindContributionOrder:a?.order??this.nextKindContributionOrder,s=this.findSameTierRepoConflict(r,t,o);if(s!==void 0){console.warn(`[ArtifactSchemaRegistry] Artifact kind '${n}' is already registered by '${s.owner.ownerKey}' at the same priority; keeping the existing owner.`);return}r.set(i,{owner:t,registration:F(e),order:t.source===`extension`||a===void 0?this.nextKindContributionOrder++:a.order}),this.kindContributions.set(n,r),this.recomputeKindWinner(n)}deregisterKind(e,t,n=N){let r=I(e,t),i=this.kindContributions.get(r);i!==void 0&&(i.delete(P(n)),this.recomputeKindWinner(r))}replaceKindRegistrationsForOwner(e,t){let n=new Set,r=P(e),i=new Map;for(let[e,t]of this.kindContributions.entries()){let a=t.get(r);a!==void 0&&(i.set(e,a.order),t.delete(r),n.add(e))}for(let a of t){let t=I(a.kind,a.schemaVersion),o=this.kindContributions.get(t)??new Map,s=e.source===`extension`?void 0:i.get(t),c=s??this.nextKindContributionOrder,l=this.findSameTierRepoConflict(o,e,c);if(l!==void 0){console.warn(`[ArtifactSchemaRegistry] Artifact kind '${t}' is already registered by '${l.owner.ownerKey}' at the same priority; keeping the existing owner.`);continue}o.set(r,{owner:e,registration:F(a),order:s??this.nextKindContributionOrder++}),this.kindContributions.set(t,o),n.add(t)}for(let e of n)this.recomputeKindWinner(e)}storeRelationType(e){let t=this.relationTypes.get(e.type);if(t){if(t.symmetry!==e.symmetry)throw Error(`Relation type '${e.type}' is already registered with different symmetry (existing: '${t.symmetry}', new: '${e.symmetry}')`);return}this.relationTypes.set(e.type,F(e))}getKind(e,t){let n=this.kinds.get(I(e,t));return n?F(n):void 0}getRelationType(e){let t=this.relationTypes.get(e);return t?F(t):void 0}onDestroy(){this.kinds.clear(),this.kindContributions.clear(),this.relationTypes.clear(),this.nextKindContributionOrder=0}},R=class extends Error{reason;hookId;constructor(e,t){super(`Artifact write rejected by hook '${t}': ${e}`),this.reason=e,this.hookId=t,this.name=`ArtifactLifecycleHookRejectedError`}};function z(e,t){return e?!(e.kind!==void 0&&e.kind!==`*`&&e.kind!==t.kind||e.schemaVersion!==void 0&&e.schemaVersion!==t.schemaVersion):!0}function B(e){return e.priority??0}function Ie(e,t,n){return e.filter(e=>e.event===t&&z(e.filter,n)).sort((e,t)=>B(t)-B(e))}function Le(e,t,n){return e.filter(e=>e.event===t&&z(e.filter,n)).sort((e,t)=>B(t)-B(e))}function Re(e,t){return{...e,...`data`in t?{data:t.data}:{},...`relations`in t?{relations:t.relations}:{},...`confidence`in t?{confidence:t.confidence}:{},...`representations`in t?{representations:t.representations}:{},...`actor`in t?{actor:t.actor}:{}}}function ze(e,t){let{confidence:n,representations:r,...i}=e;return{...i,data:t.data,relations:[...t.relations],...t.confidence===void 0?{}:{confidence:t.confidence},...t.representations===void 0?{}:{representations:t.representations},actor:t.actor}}var V=class extends w{registrations=new Map;constructor(e){super(e)}async onInit(){}onDestroy(){this.registrations.clear()}registerHooks(e,t){let n=[...t];this.registrations.set(e,n);let r=!1;return()=>{r||(r=!0,this.registrations.get(e)===n&&this.registrations.delete(e))}}allHooks(){let e=[];for(let t of this.registrations.values())e.push(...t);return e}async runBeforeCreate(e){return this.runBeforeHooks(`beforeCreate`,e)}async runBeforeRevise(e){return this.runBeforeHooks(`beforeRevise`,e)}async runBeforeHooks(e,t){let{draft:n,previous:r,kindRegistration:i}=t,a=Ie(this.allHooks(),e,n),o=new Map,s={kind:n.kind,schemaVersion:n.schemaVersion,scope:n.scope,data:n.data,relations:n.relations,...n.confidence===void 0?{}:{confidence:n.confidence},...n.representations===void 0?{}:{representations:n.representations},actor:n.actor},c=!1;for(let t of a){let n,a={event:e,get draft(){return s},previous:r,kindRegistration:i,bus:this.bus,meta:o,rejectCreation(e){n={reason:e}},skipMaterialization(){c=!0},updateDraft(e){s=Re(s,e)}};if(await t.handler(a),n)throw new R(n.reason,t.id)}return{draft:ze(n,s),skipMaterialization:c,meta:o}}async runAfterCreate(e){await this.runAfterHooks(`afterCreate`,`created`,e)}async runAfterRevise(e){await this.runAfterHooks(`afterRevise`,`revised`,e)}async runAfterStatusChanged(e){await this.runAfterHooks(`afterStatusChanged`,`status-changed`,e)}async runAfterObservationAdded(e){await this.runAfterHooks(`afterObservationAdded`,`observation-added`,e)}async runAfterHooks(e,t,n){let{artifact:r,previous:i,observation:a,kindRegistration:o,projectionPolicy:s,skipDefaultProjection:c,meta:l}=n,u=Le(this.allHooks(),e,r),d=this.bus,f=!1;for(let n of u){if(c&&(n.priority??0)<0||f&&(n.priority??0)<0)continue;let u={event:e,semanticEvent:t,artifact:r,previous:i?{refClass:`artifact`,id:i.id,revision:i.revision,kind:i.kind}:void 0,observation:a,kindRegistration:o,projectionPolicy:s,bus:d,meta:l,preventDefault(){f=!0},async resolveRelations(e){let t=r.relations.filter(t=>t.type===e).map(e=>e.target),n=[];for(let e of t){let t=e;if(t.refClass===`artifact`){let e=t,{artifact:r}=await d.request(v.resolve,{ref:e});r&&n.push(r)}}return n}};try{await n.handler(u)}catch(t){console.error(`[ArtifactLifecycleHookRegistry] Hook '${n.id}' threw during '${e}':`,t)}}}};function H(e){return structuredClone(e)}var Be=class extends w{namespaces=new Map;constructor(e){super(e)}async onInit(){this.registerHandler(O.namespace.register,e=>{this.registerNamespace(e.payload),e.setResult({registered:!0})}),this.registerHandler(O.namespace.list,e=>{let{namespace:t}=e.payload,n=[...this.namespaces.values()].filter(e=>!t||e.namespace===t).map(H);e.setResult({namespaces:n})})}registerNamespace(e){let t=this.namespaces.get(e.namespace);if(t){if(JSON.stringify(t)!==JSON.stringify(e))throw Error(`Facet namespace '${e.namespace}' is already registered with a different definition`);return}this.namespaces.set(e.namespace,H(e)),this.bus.emit(O.namespace.changed,{namespace:e.namespace})}deregisterNamespace(e){this.namespaces.delete(e)&&this.bus.emit(O.namespace.changed,{namespace:e})}getNamespace(e){let t=this.namespaces.get(e);return t?H(t):void 0}onDestroy(){this.namespaces.clear()}};function U(e){return structuredClone(e)}var Ve=class extends w{bindings=new Map;constructor(e){super(e)}async onInit(){this.registerHandler(k.surfaceBinding.register,e=>{this.registerBinding(e.payload),e.setResult({registered:!0})}),this.registerHandler(k.surfaceBinding.list,e=>{let{provider:t,namespace:n}=e.payload,r=[...this.bindings.values()].filter(e=>(!t||e.provider===t)&&(!n||e.namespace===n)).map(U);e.setResult({bindings:r})})}registerBinding(e){let t=this.bindings.get(e.id);if(t){if(JSON.stringify(t)!==JSON.stringify(e))throw Error(`Surface binding '${e.id}' is already registered with a different definition`);return}this.bindings.set(e.id,U(e)),this.bus.emit(k.surfaceBinding.changed,{id:e.id,provider:e.provider})}deregisterBinding(e){let t=this.bindings.get(e);t&&(this.bindings.delete(e),this.bus.emit(k.surfaceBinding.changed,{id:e,provider:t.provider}))}getBinding(e){let t=this.bindings.get(e);return t?U(t):void 0}onDestroy(){this.bindings.clear()}},W=class extends fe{code;suggestions;constructor(e,t,n){super(e),this.code=t,this.suggestions=n}},He=class{deps;constructor(e){this.deps=e}async resolve(e,t){switch(e.kind){case`bare`:return this.resolveBare(e.model);case`qualified`:return this.resolveQualified(e.segment1,e.segment2,e.model)}}async resolveBare(e){let t=await this.deps.resolveDefaultModelTarget(e);switch(t.kind){case`resolved`:return{kind:`adapter`,adapterName:t.target.adapterName,providerConfigId:t.target.providerConfigId,model:t.target.model};case`ambiguous`:throw new W(`Model "${e}" is available via multiple providers. Use a qualified reference to select one.`,`ambiguous-model`,t.matches.map(e=>e.qualifiedName));case`not-found`:throw new W(`Model "${e}" was not found in any enabled adapter's registry.`,`model-not-found`)}}async resolveQualified(e,t,n){return t===void 0?this.resolveQualifiedOneSegment(e,n):this.resolveQualifiedTwoSegments(e,t,n)}async resolveQualifiedTwoSegments(e,t,n){let r=await this.deps.listEnabledAdapterNames();if(!r.includes(e))throw new W(`Adapter "${e}" is not enabled or does not exist.`,`adapter-not-found`);return{kind:`adapter`,adapterName:e,providerConfigId:await this.resolveProviderSegment(t,e,r),model:n}}async resolveQualifiedOneSegment(e,t){let n=await this.deps.listEnabledAdapterNames();if(n.includes(e)){let n=await this.deps.getDefaultBinding(e);if(!n)throw new W(`Adapter "${e}" has no enabled provider binding. Configure or enable a provider binding first.`,`no-binding`);return{kind:`adapter`,adapterName:e,providerConfigId:n.providerConfigId,model:t}}let r=await this.deps.findProviderConfigByName(e);if(r)return{kind:`adapter`,adapterName:(await this.pickBindingForConfig(r.id,n)).adapterName,providerConfigId:r.id,model:t};let i=await this.deps.findProviderDefinition(e,n);if(i){let r=await this.deps.findDefaultConfigForDefinition(i.id);if(!r)throw new W(`Provider definition "${e}" exists but has no configured provider config. Create a provider config first.`,`provider-not-found`);return{kind:`adapter`,adapterName:(await this.pickBindingForConfig(r.id,n)).adapterName,providerConfigId:r.id,model:t}}throw new W(`"${e}" does not match any enabled adapter name, provider config name, or provider definition ID.`,`adapter-not-found`)}async resolveProviderSegment(e,t,n){let r=await this.deps.findProviderConfigByName(e);if(r)return await this.requireBindingForAdapterAndConfig(t,r.id,e),r.id;let i=await this.deps.findProviderDefinition(e,n);if(i){let n=await this.deps.findConfigForDefinitionAndAdapter(i.id,t);if(!n)throw new W(`Provider definition "${e}" has no enabled config bound to adapter "${t}". Create a provider config and binding first.`,`no-binding`);return n.id}throw new W(`"${e}" does not match any provider config name or provider definition ID.`,`provider-not-found`)}async requireBindingForAdapterAndConfig(e,t,n){if(!(await this.deps.listBindingsForConfig(t)).some(t=>t.adapterName===e))throw new W(`No binding exists between adapter "${e}" and provider "${n}". Create a binding first.`,`no-binding`)}async pickBindingForConfig(e,t){let n=(await this.deps.listBindingsForConfig(e)).filter(e=>t.includes(e.adapterName));if(n.length===0)throw new W(`Provider config "${e}" has no bindings to enabled adapters. Bind it to an enabled adapter first.`,`no-binding`);return n.find(e=>e.isDefault)??n[0]}},Ue=class e extends w{constructor(e=_){super(e)}async onInit(){await this.bus.request(p.ensureReady,{});let e=new He(this.createDeps());this.registerHandler(he.resolve,async t=>{let n=await e.resolve(t.payload.parsed,t.payload.context);t.setResult(n)})}createDeps(){let e=this.bus,t=async()=>{let{adapters:t}=await e.request(p.listAdapters,{});return t.filter(e=>e.enabled).map(e=>e.name)},n=async t=>{let[n,r]=await Promise.all([e.request(p.getDefaultBinding,{adapterName:t}),this.listEnabledProviderConfigIds()]);if(n.binding&&r.has(n.binding.providerConfigId))return n.binding;let{bindings:i}=await e.request(p.listBindings,{adapterName:t}),a=i.filter(e=>r.has(e.providerConfigId));return a.find(e=>e.isDefault)??a[0]},r=async t=>{let{definitions:n}=await e.request(p.getProviderDefinitionsByAdapter,{adapterName:t});return n},i=async t=>{let{bindings:n}=await e.request(p.listBindingsByConfig,{providerConfigId:t});return n},a=async t=>{let{configs:n}=await e.request(p.listProviderConfigs,{enabled:!0}),r=E(t);return n.find(e=>E(e.name)===r)},o=this.buildFindProviderDefinition(t,r),s=async t=>{let{configs:n}=await e.request(p.listProviderConfigsByDefinition,{definitionId:t}),r=n.filter(e=>e.enabled);return r.find(e=>e.isDefault)??r[0]},c=async(t,n)=>{let{config:r}=await e.request(p.findConfigForDefinitionAndAdapter,{definitionId:t,adapterName:n});return r?{id:r.id}:void 0};return{listEnabledAdapterNames:t,getDefaultBinding:n,findProviderConfigByName:a,findProviderDefinition:o,listBindingsForConfig:i,findDefaultConfigForDefinition:s,findConfigForDefinitionAndAdapter:c,resolveDefaultModelTarget:this.buildResolveDefaultModelTarget(t,r,c)}}buildFindProviderDefinition(e,t){return async(n,r)=>{let i=r??await e();for(let e of i){let r=(await t(e)).find(e=>e.id===n);if(r)return r}}}buildResolveDefaultModelTarget(t,n,r){let i=this.bus;return async a=>{let o=await t(),s=await Promise.all(o.map(async e=>({adapterName:e,definitions:await n(e)}))),c=Array.from(new Set(s.flatMap(({definitions:e})=>e.map(e=>e.id))));if(c.length===0)return{kind:`not-found`};let{matches:l}=await i.request(oe.checkModelInProviders,{providerIds:c,model:a}),u=(await Promise.all(s.map(({adapterName:e,definitions:t})=>this.collectAdapterCandidates(e,t,a,l,r)))).flat();return e.buildResolution(u)}}async collectAdapterCandidates(e,t,n,r,i){let a=t.filter(e=>e.id in r),o=await Promise.all(a.map(t=>i(t.id,e)));return a.flatMap((t,r)=>{let i=o[r];return i?[{adapterName:e,definitionId:t.id,providerConfigId:i.id,qualifiedName:`${e}/${t.id}::${n}`,model:n}]:[]})}static buildResolution(e){let t=Array.from(new Map(e.map(e=>[this.routeKey(e),e])).values());if(t.length===0)return{kind:`not-found`};if(t.length>1)return{kind:`ambiguous`,matches:t.map(({adapterName:e,definitionId:t,qualifiedName:n})=>({adapterName:e,definitionId:t,qualifiedName:n}))};let[n]=t;return{kind:`resolved`,target:{adapterName:n.adapterName,providerConfigId:n.providerConfigId,definitionId:n.definitionId,model:n.model}}}static routeKey(e){return`${e.adapterName}\0${e.definitionId}\0${e.providerConfigId}`}async listEnabledProviderConfigIds(){let{configs:e}=await this.bus.request(p.listProviderConfigs,{enabled:!0});return new Set(e.map(e=>e.id))}};const G={name:`makaio.canonical-model`,displayName:`Canonical Model`,version:`0.1.0`,critical:!1,create:e=>new Ue(e.bus)};function We(e){let t=Se({adapterId:e?.adapterId,adapterName:e?.adapterName,contextOverrides:{adapterId:e?.contextOverrides?.adapterId,adapterName:e?.contextOverrides?.adapterName}}),n=t.issues[0];return n?j(A.VALIDATION_FAILED,n.message):ke(t.effectiveIdentity)}function Ge(e){let t=e?.allowedDirectories;if(Array.isArray(t))return t.filter(e=>typeof e==`string`)}async function Ke(e,t,n,r){let i=new Map;for(let e of t)i.set(e.name,await r(e.name));let a=t.filter(e=>{let t=i.get(e.name);return!t?.allowedAdapters||t.allowedAdapters.length===0?!0:t.allowedAdapters.includes(n)}),o=new Set(a.map(e=>e.name));return{filteredTools:e.filter(e=>!(!o.has(e.toolsetName)||i.get(e.toolsetName)?.disabledTools?.includes(e.name))),filteredToolsets:a}}function qe(){return`exec_${Date.now()}_${Math.random().toString(36).substring(2,9)}`}var Je=class{bus;toolsets=new Map;tools=new Map;cleanupHandlers=[];handlerPriority;policyProvider;fileAccessRuleProvider;revision=0;constructor(e){this.bus=e?.bus??_,this.handlerPriority=e?.handlerPriority??0,this.policyProvider=e?.policyProvider,this.fileAccessRuleProvider=e?.fileAccessRuleProvider,this.registerHandlers()}registerHandlers(){let e=this.bus.on(b.list,async e=>{let{toolsetName:t,adapterId:n,adapterName:r}=e.payload,{tools:i,toolsets:a}=await this.listToolsWithToolsets({toolsetName:t,adapterId:n,adapterName:r});e.setResult({tools:i,toolsets:a})},{priority:this.handlerPriority});this.cleanupHandlers.push(e);let t=this.bus.on(b.execute,async e=>{let{toolName:t,input:n,adapterId:r,adapterName:i,contextOverrides:a}=e.payload,o=await this.execute(t,n,{contextOverrides:a,adapterId:r,adapterName:i});e.setResult(o)},{priority:this.handlerPriority});this.cleanupHandlers.push(t)}async register(e){if(this.toolsets.has(e.metadata.name))throw Error(`Toolset '${e.metadata.name}' is already registered`);let t=[],n=[];for(let[,r]of Object.entries(e.tools)){let i=r.metadata.name;if(this.tools.has(i))throw Error(`Tool '${i}' is already registered (from toolset '${this.tools.get(i).toolsetName}')`);n.push({tool:r,toolsetName:e.metadata.name}),t.push(i)}this.toolsets.set(e.metadata.name,e);for(let e=0;e<n.length;e+=1)this.tools.set(t[e],n[e]);await this.emitRegistryChanged(`toolset-registered`,e.metadata.name).catch(t=>console.warn(`[ToolRegistry] Failed to emit ${b.registryChanged.subject} for '${e.metadata.name}':`,t)),await this.bus.emit(b.registered,{toolsetName:e.metadata.name,toolsetVersion:e.metadata.version,toolNames:t}).catch(t=>console.warn(`[ToolRegistry] Failed to emit ${b.registered.subject} for '${e.metadata.name}':`,t))}async deregister(e){let t=this.toolsets.get(e);if(!t)throw Error(`Toolset '${e}' is not registered`);for(let e of Object.values(t.tools))this.tools.delete(e.metadata.name);this.toolsets.delete(e),await this.emitRegistryChanged(`toolset-unregistered`,e).catch(t=>console.warn(`[ToolRegistry] Failed to emit ${b.registryChanged.subject} for '${e}':`,t))}async emitRegistryChanged(e,t){this.revision+=1,await this.bus.emit(b.registryChanged,{revision:this.revision,reason:e,toolsetName:t})}async execute(e,t,n){let r=this.tools.get(e);if(!r)return j(A.TOOL_NOT_FOUND,`Tool '${e}' not found`);let i=We(n);if(!i.success)return i;let{tool:a,toolsetName:o}=r,s=await this.checkPolicy(o,e,i.data.adapterId,i.data.adapterName);if(s)return s;let c=qe(),l=Date.now();await this.bus.emit(b.started,{toolName:e,toolsetName:o,executionId:c,timestamp:l});try{let r=a.inputSchema.safeParse(t);if(!r.success){let t=j(A.VALIDATION_FAILED,`Input validation failed`,{issues:r.error.issues});return await this.bus.emit(b.error,{toolName:e,toolsetName:o,executionId:c,timestamp:Date.now(),error:t.error}),t}let s=await this.buildExecutionContext(n,i.data),u=await a.execute(r.data,s);return u.success?await this.bus.emit(b.completed,{toolName:e,toolsetName:o,executionId:c,timestamp:Date.now(),durationMs:Date.now()-l}):await this.bus.emit(b.error,{toolName:e,toolsetName:o,executionId:c,timestamp:Date.now(),error:u.error}),u}catch(t){let n=De(t);return await this.bus.emit(b.error,{toolName:e,toolsetName:o,executionId:c,timestamp:Date.now(),error:n.error}),n}}async buildExecutionContext(e,t){let n=e?.contextOverrides?.constraints;if(this.fileAccessRuleProvider){let t=e?.contextOverrides?.cwd??process.cwd(),r=Ge(n),i=await this.fileAccessRuleProvider(t,r);n={...n,[Te]:i}}let r=pe({...e?.contextOverrides,constraints:n}),i=e?.contextOverrides;return{...r,bus:this.bus,sessionId:i?.sessionId,agentId:i?.agentId,adapterId:t.adapterId,adapterName:t.adapterName,adapterSessionId:i?.adapterSessionId,turnId:i?.turnId,turnContext:i?.turnContext,toolCallId:i?.toolCallId}}async checkPolicy(e,t,n,r){if(!this.policyProvider)return null;let i=await this.policyProvider(e);if(!i)return null;if(i.disabledTools?.includes(t))return j(A.PERMISSION_DENIED,`Tool '${t}' is disabled`,{toolsetName:e,toolName:t});if(i.allowedAdapters&&i.allowedAdapters.length>0){let t=r??n;if(!t||!i.allowedAdapters.includes(t))return j(A.PERMISSION_DENIED,`Adapter not allowed for toolset '${e}'`,{toolsetName:e,adapterId:n,adapterName:r,allowedAdapters:i.allowedAdapters})}return null}listTools(e){let t=[];for(let[,n]of this.tools){if(e?.toolsetName&&n.toolsetName!==e.toolsetName)continue;let{$schema:r,...i}=g.toJSONSchema(n.tool.inputSchema);t.push({name:n.tool.metadata.name,description:n.tool.metadata.description,toolsetName:n.toolsetName,annotations:n.tool.metadata.annotations,inputSchema:i})}return t}listToolsets(){let e=[];for(let[,t]of this.toolsets){let n={name:t.metadata.name,description:t.metadata.description,version:t.metadata.version,toolCount:Object.keys(t.tools).length};if(t.configSchema){let{$schema:e,...r}=g.toJSONSchema(t.configSchema);n.configSchema=r}e.push(n)}return e}async listToolsWithToolsets(e){let t=this.listTools(e),n=this.listToolsets(),r=e?.toolsetName?n.filter(t=>t.name===e.toolsetName):n,i=e?.adapterName??e?.adapterId;if(this.policyProvider&&i){let{filteredTools:e,filteredToolsets:n}=await Ke(t,r,i,this.policyProvider);return{tools:e,toolsets:n}}return{tools:t,toolsets:r}}getTool(e){return this.tools.get(e)?.tool}getToolset(e){return this.toolsets.get(e)}dispose(){for(let e of this.cleanupHandlers)e();this.cleanupHandlers.length=0}destroy(){this.dispose()}},Ye=class extends w{triggersByExtension=new Map;stepsByExtension=new Map;revision=0;cache=null;constructor(e){super(e)}onInit(){this.registerHandler(be.list,e=>{e.setResult({triggers:this.listTriggers(),steps:this.listSteps()})})}async register(e,t){let n=[],r=[],i=this.snapshotExtensionState(e),a=new Set;for(let e of this.triggersByExtension.values())for(let t of e)a.add(t.metadata.name);for(let e of this.stepsByExtension.values())for(let t of e)a.add(t.metadata.name);if(t.triggers)for(let r of t.triggers)this.assertExtensionNamespace(e,r.metadata),this.assertNoCollision(r.metadata,a),a.add(r.metadata.name),n.push({metadata:{...r.metadata,extensionName:e},configSchema:C(r.configSchema),outputSchema:C(r.outputSchema)});if(t.steps)for(let n of t.steps)this.assertExtensionNamespace(e,n.metadata),this.assertNoCollision(n.metadata,a),a.add(n.metadata.name),r.push({metadata:{...n.metadata,extensionName:e},configSchema:C(n.configSchema),inputSchema:C(n.inputSchema),outputSchema:C(n.outputSchema),runs:structuredClone(n.runs)});if(n.length>0&&this.triggersByExtension.set(e,n),r.length>0&&this.stepsByExtension.set(e,r),n.length>0||r.length>0){this.revision+=1;try{await this.emitChanged(e,`registered`)}catch(t){throw this.restoreExtensionState(e,i),t}}}async deregister(e){let t=this.snapshotExtensionState(e),n=this.triggersByExtension.delete(e),r=this.stepsByExtension.delete(e);if(n||r){this.revision+=1;try{await this.emitChanged(e,`deregistered`)}catch(n){throw this.restoreExtensionState(e,t),n}}}listTriggers(){return this.getCache().triggers.map(Xe)}listSteps(){return this.getCache().steps.map(Ze)}async emitChanged(e,t){await this.bus.emit(be.changed,{extensionName:e,revision:this.revision,reason:t})}getCache(){return(!this.cache||this.cache.revision!==this.revision)&&(this.cache={revision:this.revision,triggers:[...this.triggersByExtension.values()].flat(),steps:[...this.stepsByExtension.values()].flat()}),this.cache}snapshotExtensionState(e){return{triggers:this.triggersByExtension.get(e),steps:this.stepsByExtension.get(e),revision:this.revision,cache:this.cache}}restoreExtensionState(e,t){t.triggers?this.triggersByExtension.set(e,t.triggers):this.triggersByExtension.delete(e),t.steps?this.stepsByExtension.set(e,t.steps):this.stepsByExtension.delete(e),this.revision=t.revision,this.cache=t.cache}assertNoCollision(e,t){if(t.has(e.name))throw Error(`Workflow block name collision: '${e.name}' is already registered`)}assertExtensionNamespace(e,t){let n=`${e}.`;if(!t.name.startsWith(n))throw Error(`Workflow block '${t.name}' must be namespaced by extension '${n}'`)}};function Xe(e){return{metadata:Qe(e.metadata),configSchema:structuredClone(e.configSchema),outputSchema:structuredClone(e.outputSchema)}}function Ze(e){return{metadata:Qe(e.metadata),configSchema:structuredClone(e.configSchema),inputSchema:structuredClone(e.inputSchema),outputSchema:structuredClone(e.outputSchema),runs:structuredClone(e.runs)}}function Qe(e){return e.categories?{...e,categories:[...e.categories]}:{...e}}const K=`workflow.start`;function $e(e){return()=>({async execute(t,n){let{input:r={},executionHints:i}=t,{workflowId:a}=r;if(typeof a!=`string`||a.length===0)throw Error(`[TransitionActionRegistry] 'workflow.start' action requires a non-empty 'input.workflowId' string`);await e.request(xe.start,{workflowId:a,input:et(r,n),config:r.config,artifactRef:r.artifactRef,scope:r.scope,triggerPayload:{_transitionRuleId:n._transition.ruleId,_transitionDepth:n._transition.depth,_transitionEventType:n._transition.eventType},executionHints:i})}})}function et(e,t){let n=e.inputExpression;if(typeof n!=`string`)return e.input;let r=Me(n,tt(t)),i=ve.safeParse(r);if(!i.success)throw Error(`[TransitionActionRegistry] 'workflow.start' inputExpression for rule '${t._transition.ruleId}' must resolve to a JSON value`);return i.data}function tt(e){let t={...e};return{...t,ctx:t}}var nt=class{factories=new Map;factoriesBySource=new Map;constructor(e){this.factories.set(K,$e(e)),this.factoriesBySource.set(`__builtin__`,[K])}register(e,t){let n=Object.keys(t);if(n.length!==0){if(this.factoriesBySource.has(e))throw Error(`TransitionActionRegistry: duplicate source '${e}'`);for(let t of n)if(this.factories.has(t))throw Error(`TransitionActionRegistry: duplicate action type '${t}' from source '${e}'`);for(let e of n)this.factories.set(e,t[e]);this.factoriesBySource.set(e,n)}}deregister(e){if(e===`__builtin__`)return;let t=this.factoriesBySource.get(e);if(t){for(let e of t)this.factories.delete(e);this.factoriesBySource.delete(e)}}async dispatch(e,t){let n=this.factories.get(e.type);if(!n)throw Error(`TransitionActionRegistry: unknown action type '${e.type}'. Registered types: ${[...this.factories.keys()].join(`, `)}`);await n().execute(e,t)}has(e){return this.factories.has(e)}listTypes(){return[...this.factories.keys()]}},rt=class{rulesBySource=new Map;rulesByEventType=new Map;ruleIdSet=new Set;register(e,t){if(t.length===0)return;if(this.rulesBySource.has(e))throw Error(`TransitionRuleRegistry: duplicate source '${e}'`);let n=new Set,r=[];for(let i of t){let t=ye.parse(i);if(n.has(t.id))throw Error(`TransitionRuleRegistry: duplicate rule ID '${t.id}' within source '${e}'`);if(this.ruleIdSet.has(t.id))throw Error(`TransitionRuleRegistry: duplicate rule ID '${t.id}' from source '${e}'`);n.add(t.id),r.push({rule:t,condition:t.when===void 0?void 0:Ae.parse(t.when)})}for(let e of r){let{rule:t}=e;this.ruleIdSet.add(t.id);let n=this.rulesByEventType.get(t.on)??[];n.push(e),this.rulesByEventType.set(t.on,n)}this.rulesBySource.set(e,r)}deregister(e){let t=this.rulesBySource.get(e);if(t){for(let{rule:e}of t){this.ruleIdSet.delete(e.id);let t=this.rulesByEventType.get(e.on);if(t){let n=t.filter(t=>t.rule.id!==e.id);n.length>0?this.rulesByEventType.set(e.on,n):this.rulesByEventType.delete(e.on)}}this.rulesBySource.delete(e)}}getRulesForEvent(e){let t=this.rulesByEventType.get(e);return t?t.filter(e=>e.rule.enabled):[]}snapshotSource(e){let t=this.rulesBySource.get(e);if(t)return{ruleIds:t.map(e=>e.rule.id)}}},it=class extends w{ruleRegistry;actionRegistry;depthMap=new Map;constructor(e){super(e),this.ruleRegistry=new rt,this.actionRegistry=new nt(e)}onInit(){this.registerHandler(v.created,async e=>{await this.handleArtifactEvent(`artifact.created`,{artifact:e.payload.artifact})}),this.registerHandler(v.revised,async e=>{let t=await this.resolvePreviousRevisedArtifact(e.payload.previous);await this.handleArtifactEvent(`artifact.revised`,{artifact:e.payload.artifact,previous:e.payload.previous,...t===void 0?{}:{previousArtifact:t}})}),this.registerHandler(v.status.changed,async e=>{let t=await this.resolveStatusChangedArtifact(e.payload.artifact);t!==void 0&&await this.handleArtifactEvent(`artifact.status.changed`,{artifact:t,path:e.payload.path,previous:e.payload.previous,current:e.payload.current})})}async handleArtifactEvent(e,t){let n=this.artifactKey(t.artifact),r=this.readDepth(n);if(r>=10){console.warn(`[TransitionPipelineService] Transition depth limit (10) reached for event '${e}' on artifact '${n}'. Loop protection active — skipping rule evaluation.`);return}let i=this.ruleRegistry.getRulesForEvent(e);if(i.length!==0)for(let a of i)await this.evaluateAndDispatch(a,e,t,n,r)}async resolveStatusChangedArtifact(e){let t=await this.bus.requestOptional(v.resolve,{ref:e});if(!t.handled){console.warn(`[TransitionPipelineService] No artifact resolver is registered for status transition on artifact '${this.artifactKey(e)}'. Skipping rule evaluation.`);return}if(t.data.artifact===null){console.warn(`[TransitionPipelineService] Could not resolve status transition artifact '${this.artifactKey(e)}'. Skipping rule evaluation.`);return}return t.data.artifact}async resolvePreviousRevisedArtifact(e){let t=await this.bus.requestOptional(v.resolve,{ref:e});if(!(!t.handled||t.data.artifact===null))return t.data.artifact}async evaluateAndDispatch(e,t,n,r,i){let{rule:a,condition:o}=e,s={...n,_transition:{ruleId:a.id,eventType:t,depth:i+1}};if(o!==void 0){let e={...s},t;try{t=je(o,e)}catch(e){console.error(`[TransitionPipelineService] Condition evaluation error for rule '${a.id}':`,e);return}if(!t)return}try{await this.actionRegistry.dispatch(a.action,s),a.action.type===`workflow.start`&&this.incrementDepth(r)}catch(e){console.error(`[TransitionPipelineService] Action dispatch error for rule '${a.id}' (action type '${a.action.type}'):`,e)}}artifactKey(e){return`${typeof e.kind==`string`?e.kind:`unknown`}:${typeof e.id==`string`?e.id:`unknown`}`}readDepth(e){let t=this.depthMap.get(e);return t===void 0?0:Date.now()>t.expiresAt?(this.depthMap.delete(e),0):t.count}incrementDepth(e){let t=this.depthMap.get(e);this.depthMap.set(e,{count:t===void 0?1:t.count+1,expiresAt:Date.now()+6e4})}};function at(e){return async t=>{let n=await ot(e,t);if(!n)return{handled:!1,sessionId:null,clientAccountId:null,changed:!1};let{sessionId:r}=n,{observation:i,accountObserveRequest:a}=st(t),o=await e.requestOptional(D.account.observe,a);if(!o.handled)return{handled:!1,sessionId:r,clientAccountId:null,changed:!1};let{clientAccountId:s}=o.data;return{handled:!0,sessionId:r,clientAccountId:s,changed:await mt(e,r,i,s)}}}async function ot(e,t){switch(t.locator.kind){case`session`:{let{session:r}=await e.request(n.get,{sessionId:t.locator.sessionId});return r?{sessionId:r.sessionId,session:r}:null}case`adapter-session`:{let{session:r}=await e.request(n.getByAdapterSessionId,{adapterSessionId:t.locator.adapterSessionId});return r?{sessionId:r.sessionId,session:r}:null}case`both`:{let[{session:r},{session:i}]=await Promise.all([e.request(n.get,{sessionId:t.locator.sessionId}),e.request(n.getByAdapterSessionId,{adapterSessionId:t.locator.adapterSessionId})]);if(!r&&!i)return null;if(!r||!i)throw Error(`Session locator mismatch: sessionId "${t.locator.sessionId}" and adapterSessionId "${t.locator.adapterSessionId}" must both resolve the same session`);if(r.sessionId!==i.sessionId)throw Error(`Session locator mismatch: sessionId "${t.locator.sessionId}" and adapterSessionId "${t.locator.adapterSessionId}" resolve to different sessions`);return{sessionId:r.sessionId,session:r}}}}function st(e){let t={clientId:e.clientId,source:e.source,kind:e.kind,observedAt:e.observedAt,payload:ft(e.payload)};return{observation:t,accountObserveRequest:ct(t)}}function ct(e){let t=e.payload,n=lt(t),r=ut(t);if(r.length>0)return{clientId:e.clientId,observedAt:e.observedAt,displayLabel:dt(t,n),identifiers:r};throw Error(`client.session.account.observe for "${e.clientId}" requires canonical client account identifiers`)}function lt(e){return pt(e.accountInfo)??e}function ut(e){let t=e.identifiers;if(!Array.isArray(t))return[];try{return g.array(Ce).min(1).parse(t)}catch(e){throw Error(`client.session.account.observe received malformed canonical client account identifiers`,{cause:e})}}function dt(e,t){return q(e.displayLabel)??q(t.displayLabel)??q(t.email)??q(t.label)}function ft(e){return structuredClone(e)}function pt(e){return typeof e==`object`&&e&&!Array.isArray(e)?e:void 0}function q(e){return typeof e==`string`&&e.trim().length>0?e.trim():void 0}async function mt(e,t,r,i){let a=await e.request(n.update,{sessionId:t,clientId:r.clientId,clientAccountId:i,lastClientIdentityObservation:r});if(!a.success)throw Error(`Failed to update session "${t}" with client account linkage`);return a.clientAccountChanged??!1}const ht=S(`session-storage`).name;var gt=class extends w{constructor(e=_){super(e)}onInit(){let e=at(this.bus);this.registerHandler(D.session.account.observe,async t=>{t.setResult(await e(we.request.parse(t.payload)))})}};const _t={name:`makaio.session-client-account-linking`,displayName:`Session Client Account Linking`,version:`0.1.0`,dependencies:[x(ht),x(`makaio.clients-core`)],critical:!1,create:e=>new gt(e.bus)},vt={name:`framework-shell`,displayName:`Shell`,version:`0.1.0`,surface:`interactive`,windows:[{id:`main`,style:`utility`,width:1e3,height:700,singleton:!0}]};async function yt(e){let{harnesses:t}=await e.request(m.list,{}),n=new Set(t.map(e=>e.id));for(let t of ge){if(n.has(t.id))continue;let r={...t};await e.request(m.set,{harness:r})}}function J(e,t,n){return e??t??n}var bt=class extends w{static storage={drizzle:h};constructor(e=_){super(e)}async onInit(){await yt(this.bus),this.registerHandlers()}registerHandlers(){this.registerHandler(y.get,async e=>{let t=await this.loadHarness(e.payload);if(!t)throw Error(`Harness not found`);e.setResult(t)}),this.registerHandler(y.list,async e=>{let{harnesses:t}=await this.bus.request(m.list,e.payload);e.setResult({harnesses:t})}),this.registerHandler(y.set,async e=>{let t=await this.upsertHarness(e.payload);e.setResult({id:t})}),this.registerHandler(y.delete,async e=>{let{deleted:t}=await this.bus.request(m.delete,{id:e.payload.id});e.setResult({success:t})}),this.registerHandler(y.getDefault,async e=>{let t=await this.getDefaultHarness(e.payload.adapterName,e.payload.clientId);e.setResult(t)}),this.registerHandler(y.resolve,async e=>{let{adapterName:t,clientId:n,personaHarnessId:r,profileHarnessId:i}=e.payload;if(r){let i=await this.resolveAndValidateHarness(r,t,`persona`,n);e.setResult(i);return}if(i){let r=await this.resolveAndValidateHarness(i,t,`profile`,n);e.setResult(r);return}let a=await this.getDefaultHarness(t,n);e.setResult(a)}),this.registerHandler(y.getSchema,({setResult:e})=>{let{$schema:t,...n}=g.toJSONSchema(_e);e({schema:n,uiConfig:{editMode:`fullPage`,hiddenFields:[`isDefault`]}})})}async upsertHarness(e){let t=await this.resolveHarnessId(e.name,e.adapterName,e.clientId),n=await this.loadHarness({id:t,adapterName:e.adapterName,clientId:e.clientId}),r=this.mergeHarnessPayload(t,e,n);return r.adapterName&&await this.validateNativeTools(r.adapterName,r.nativeTools),await this.bus.request(m.set,{harness:r}),t}mergeHarnessPayload(e,t,n){let r={enabled:[],disabled:[]};return{id:e,name:t.name,description:J(t.description,n?.description,void 0),adapterName:t.adapterName,clientId:J(t.clientId,n?.clientId,void 0),env:J(t.env,n?.env,void 0),credentials:J(t.credentials,n?.credentials,void 0),cwd:J(t.cwd,n?.cwd,void 0),approvalPolicy:J(t.approvalPolicy,n?.approvalPolicy,`always-ask`),nativeTools:J(t.nativeTools,n?.nativeTools,r),registryTools:J(t.registryTools,n?.registryTools,r),skills:J(t.skills,n?.skills,void 0),toolCapabilityMap:t.toolCapabilityMap??n?.toolCapabilityMap,capabilityOverrides:t.capabilityOverrides??n?.capabilityOverrides,toolApprovalOverrides:t.toolApprovalOverrides??n?.toolApprovalOverrides,isDefault:J(t.isDefault,n?.isDefault,!1),enabled:J(t.enabled,n?.enabled,!0)}}async resolveHarnessId(e,t,n){let r=n??t,{harnesses:i}=await this.bus.request(m.list,{name:e}),a=i.find(t=>t.name===e&&(t.clientId??t.adapterName)===r);if(a)return a.id;let o=i.find(t=>t.name===e&&(t.clientId??t.adapterName)!==r);if(o){let t=o.clientId?`client '${o.clientId}'`:`adapter '${o.adapterName}'`;throw Error(`Harness "${e}" already exists with scope ${t}; cannot change scope to ${r??`(none)`}`)}return this.createStableHarnessId(e,r)}async loadHarness(e){if(e.id){let{harness:t}=await this.bus.request(m.get,{id:e.id});return t&&(!e.adapterName||t.adapterName===e.adapterName)&&(!e.clientId||t.clientId===e.clientId)?t:null}if(!e.name)return null;let{harnesses:t}=await this.bus.request(m.list,{name:e.name,adapterName:e.adapterName,clientId:e.clientId});return e.clientId?t.find(t=>t.clientId===e.clientId)??null:e.adapterName?t.find(t=>t.adapterName===e.adapterName)??null:t[0]??null}async getDefaultHarness(e,t){if(t){let{harnesses:e}=await this.bus.request(m.list,{clientId:t}),n=e.find(e=>e.isDefault&&e.enabled);if(n)return n;let r=e.find(e=>e.enabled);if(r)return r}if(e){let{harnesses:t}=await this.bus.request(m.list,{adapterName:e}),n=t.find(e=>e.isDefault&&e.enabled);if(n)return n;let r=t.find(e=>e.enabled);if(r)return r}let n=t?e?`client '${t}' or adapter '${e}'`:`client '${t}'`:`adapter '${e}'`;throw Error(`No harness available for ${n}`)}assertHarnessAdapterMatch(e,t,n,r){if(e.adapterName&&t&&e.adapterName!==t)throw Error(`Resolved ${n} harness adapter mismatch: expected "${t}", got "${e.adapterName}"`);if(e.clientId&&r&&e.clientId!==r)throw Error(`Resolved ${n} harness client mismatch: expected "${r}", got "${e.clientId}"`)}assertHarnessEnabled(e,t){if(!e.enabled)throw Error(`Resolved ${t} harness is disabled: ${e.id}`)}async validateNativeTools(e,t){let n=await this.bus.requestOptional(me.getCapabilities,{adapterName:e});if(!n.handled)return;let r=new Set(n.data.nativeTools),i=[...t.enabled,...t.disabled].filter(e=>!r.has(e));if(i.length>0)throw Error(`Tool '${i[0]}' not found in adapter '${e}' native tools. Declared tools: ${[...r].join(`, `)}`)}createStableHarnessId(e,t){return`harness-${de(`sha256`).update(`${t??``}\0${e}`).digest(`hex`).slice(0,24)}`}async resolveAndValidateHarness(e,t,n,r){let i=await this.loadHarness({id:e});if(!i)throw Error(`${n===`persona`?`Persona`:`Profile`} harness not found: ${e}`);return this.assertHarnessAdapterMatch(i,t,n,r),this.assertHarnessEnabled(i,n),i}};const xt={name:`makaio.harness`,displayName:`Harness`,version:`0.1.0`,critical:!0,storage:{registerHandlers:T(h)},create:e=>new bt(e.bus)},Y=S(`session-storage`),X=S(`session-bridge`),Z=S(`session`),St=S(`session-orchestrator`),Ct=S(`observed-session-ingestion`),Q=S(`tool-registry`),wt=S(`tool-approval`),Tt=S(`tray-menu`),Et=S(`capability`),Dt=S(`model-registry`),Ot=S(`workflow-block-registry`),kt=S(`transition-pipeline`),At=S(`filesystem`),jt=S(`git`),Mt=S(`artifact-schema-registry`),Nt=S(`artifact-lifecycle-hook-registry`),Pt=S(`facet-namespace-registry`),Ft=S(`surface-binding-registry`),It={name:Mt.name,displayName:`Artifact Schema Registry`,version:`0.1.0`,critical:!0,create:e=>new L(e.bus)},Lt={name:Nt.name,displayName:`Artifact Lifecycle Hook Registry`,version:`0.1.0`,critical:!0,create:e=>new V(e.bus)},Rt={name:Pt.name,displayName:`Facet Namespace Registry`,version:`0.1.0`,critical:!0,create:e=>new Be(e.bus)},zt={name:Ft.name,displayName:`Surface Binding Registry`,version:`0.1.0`,critical:!0,create:e=>new Ve(e.bus)},Bt={name:Y.name,displayName:`Session Storage`,version:`0.1.0`,critical:!0,storage:{registerHandlers:T((n,a)=>{let o=[],u=e=>{for(let t=o.length-1;t>=0;--t)try{o[t]?.()}catch(t){console.warn(`[sessionStoragePackage] cleanup failed during ${e}:`,t)}o.length=0};try{o.push(i(n,a)),o.push(e(n,a)),o.push(r(n,a)),o.push(te(n,a)),o.push(t(n,a)),o.push(f(n,a)),o.push(l(n,a)),o.push(c(n,a)),o.push(s(n,a)),o.push(d(n)),o.push(ne(n)),o.push(ee(n))}catch(e){throw u(`rollback`),e}return()=>{u(`shutdown`)}})}},$={name:X.name,displayName:`Session Bridge`,version:`0.1.0`,dependencies:[x(Y.name)],critical:!0,create:e=>new a(e.bus)},Vt={name:Z.name,displayName:`Session`,version:`0.1.0`,dependencies:[x(X.name)],critical:!0,create:e=>new re(e.bus)},Ht={name:St.name,displayName:`Session Orchestrator`,version:`0.1.0`,dependencies:[x(Z.name),x(G.name)],critical:!0,runtimeOwnership:{sessionOrchestrator:!0},create:e=>new o(e.bus,e.machineId)},Ut={name:Ct.name,displayName:`Observed-Session Ingestion`,version:`0.1.0`,dependencies:[x(X.name)],critical:!1,create:e=>new u(e.bus)},Wt={name:Q.name,displayName:`Tool Registry`,version:`0.1.0`,critical:!0,create:e=>new Je({bus:e.bus})},Gt={name:wt.name,displayName:`Tool Approval`,version:`0.1.0`,dependencies:[x(Q.name)],critical:!0,create:e=>new se(e.bus)},Kt={name:Tt.name,displayName:`Tray Menu`,version:`0.1.0`,critical:!0,create:e=>new ce(e.bus)},qt={name:Et.name,displayName:`Capability`,version:`0.1.0`,critical:!0,create:e=>new ie(e.bus)},Jt={name:Ot.name,displayName:`Workflow Block Registry`,version:`0.1.0`,critical:!0,create:e=>new Ye(e.bus)},Yt={name:kt.name,displayName:`Transition Pipeline`,version:`0.1.0`,critical:!0,create:e=>new it(e.bus)},Xt={name:At.name,displayName:`Filesystem`,version:`0.1.0`,critical:!0,create:e=>new ue(e.bus,e.machineId)},Zt={name:jt.name,displayName:`Git`,version:`0.1.0`,dependencies:[x(At.name)],critical:!0,create:e=>new Ne(e.bus)};function Qt(e){return{name:Dt.name,displayName:`Model Registry`,version:`0.1.0`,critical:!0,create:t=>new ae({bus:t.bus,fetcher:e})}}const $t=[It,Lt,Rt,zt,Bt,$,_t,Vt,Ht,Ut,le,Wt,Gt,Kt,qt,xt,G,vt,Jt,Yt,Zt,Xt];function en(){let e=new Map;return{filter:e=>!!e.tools?.createToolsets,async processActivated(t,n,r){let i=r.getService(Q);if(!i)throw Error(`ToolRegistry is not available. Ensure toolRegistryPackage is included in the composition root.`);let a=n.tools.createToolsets(r),o=[];try{for(let e of a)await i.register(e),o.push(()=>i.deregister(e.metadata.name))}catch(e){for(let e=o.length-1;e>=0;--e)try{await o[e]()}catch(e){console.error(`[ToolContributionProcessor] Rollback error for "${t}":`,e)}throw e}e.set(t,o)},async processStopped(t){let n=e.get(t);if(n){for(let e=n.length-1;e>=0;--e)try{await n[e]()}catch(e){console.error(`[ToolContributionProcessor] Deregister error for "${t}":`,e)}e.delete(t)}}}}export{Gt as A,Je as B,Rt as C,Vt as D,Ht as E,it as F,Ve as G,Ue as H,rt as I,R as J,Be as K,nt as L,Yt as M,Kt as N,Bt as O,Jt as P,K as R,Qt as S,$ as T,He as U,G as V,W,L as Y,Tt as _,Mt as a,It as b,Dt as c,Y as d,Z as f,kt as g,Q as h,Nt as i,Wt as j,zt as k,X as l,wt as m,Oe as n,Et as o,Ft as p,V as q,en as r,Pt as s,Ee as t,St as u,Ot as v,$t as w,qt as x,Lt as y,Ye as z};

package/dist/{transition-OzGXyy3p.d.mts → transition-Bfe8VVc1.d.mts}

@@ -1,5 +1,5 @@
-import { It as ArtifactRevision$1 } from "./index-B9d_8_V2.mjs";
-import { i as JsonValue$1 } from "./json-value-DtIkQN7g.mjs";
+import { It as ArtifactRevision$1 } from "./index-9g0agW_p.mjs";
+import { i as JsonValue$1 } from "./json-value-C8duSh9X.mjs";
 import { z } from "zod";
 import * as _$_makaio_contracts0 from "@makaio/framework/contracts";
 

package/dist/{types-BWduCvRU.d.mts → types-B-xY9WW2.d.mts}

@@ -1,4 +1,4 @@
-import { r as LogImportMode, t as LogImporterInfo } from "./index-D7rWAEY0.mjs";
+import { r as LogImportMode, t as LogImporterInfo } from "./index-Bd52mmj9.mjs";
 import * as _$_makaio_bus_core0 from "@makaio/framework/bus";
 import { IMakaioBus } from "@makaio/framework/bus";
 import { LogImportOrchestrator, LogImporter } from "@makaio/framework/adapters";

package/dist/{types-BrUOVfwe.d.mts → types-DvKaEOOn.d.mts}

@@ -1,7 +1,8 @@
 import { z } from "zod";
-import { ExtractSubjectPayload, ExtractSubjectResponse, HandlerForSubjectDefinition, ScopedSubjectDefinition, SubjectRecord } from "@makaio/framework/core";
+import { AuthenticationError, ExtractSubjectPayload, ExtractSubjectResponse, HandlerForSubjectDefinition, ScopedSubjectDefinition, SubjectRecord } from "@makaio/framework/core";
 import { IFilteredBus, IMakaioBus, OnOptions, ScopedBus } from "@makaio/framework/bus";
-import { AIModel, AIReasoningLevel, AIReasoningLevel as AIReasoningLevel$1, AgentSchemas, AgentSubjects, CacheStrategy, JsonValue, McpRuntimeSessionContext, McpSessionContext, McpToolState, Message, MessageBlock, MessageDeliveryMode, MessageDeliveryMode as MessageDeliveryMode$1, MessageInput, MessageOutcome, NativeForkDirective, ProviderContext, ReasoningLevelMap as ReasoningLevelMap$1, RequestCorrelationContext, ResponseSchemaDescriptor, SendMessageResultInnerResult, SessionContext, StructuredOutputValidation, SystemPrompt, ToolListItem } from "@makaio/framework/contracts";
+import { AIModel, AIReasoningLevel, AIReasoningLevel as AIReasoningLevel$1, AdapterAuthBinding, AdapterAuthConstant, AdapterProviderAuth, AdapterProviderDefinitionContract, AgentSchemas, AgentSubjects, AuthCredentialRef, CacheStrategy, JsonValue, McpRuntimeSessionContext, McpSessionContext, McpToolState, Message, MessageBlock, MessageDeliveryMode, MessageDeliveryMode as MessageDeliveryMode$1, MessageInput, MessageOutcome, NativeForkDirective, ProtocolId, ProviderContext, ReasoningLevelMap as ReasoningLevelMap$1, RequestCorrelationContext, ResolvedProviderAuth, ResponseSchemaDescriptor, SendMessageResultInnerResult, SessionContext, StructuredOutputValidation, SystemPrompt, ToolListItem } from "@makaio/framework/contracts";
+import { ClientExecutionContext } from "@makaio/framework/contracts/client";
 import { DeferredPromise, TimeoutConfig, TrackedTimeoutConfig } from "@makaio/framework/utils";
 import { SetRequired } from "type-fest";
 
@@ -240,6 +241,13 @@ interface MessageHandleOptions {
    * `user_message.sent` event is emitted for the synthetic retry message.
    */
   internalRetry?: boolean;
+  /**
+   * Lifecycle turnId from the session orchestrator. Distinct from
+   * `requestCorrelation.turnId` (transport correlation, which may be present
+   * when no lifecycle turn exists): all user_message lifecycle events for the
+   * handle pair by this value.
+   */
+  turnId?: string;
 }
 /**
  * Processing state for agent orchestration.
@@ -279,6 +287,14 @@ declare class MessageHandle {
   readonly internalRetry: boolean;
   /** Content-free transport correlation for provider requests. */
   readonly requestCorrelation?: RequestCorrelationContext | undefined;
+  /**
+   * Lifecycle turnId from the session orchestrator (`agent.sendMessage.turnId`).
+   * Distinct from `requestCorrelation.turnId`, which is transport correlation
+   * and may be present when no lifecycle turn exists. All user_message
+   * lifecycle events for this handle (sent/acknowledged/completed) pair by
+   * this value.
+   */
+  readonly turnId?: string | undefined;
   protected readonly deferredCompletion: DeferredPromise<MessageResult>;
   protected readonly deferredAcknowledgement: DeferredPromise<boolean>;
   state: MessageState;
@@ -323,7 +339,16 @@ declare class MessageHandle {
 
   cacheStrategy?: CacheStrategy, /** Content-free transport correlation for provider requests. */
 
-  requestCorrelation?: RequestCorrelationContext | undefined);
+  requestCorrelation?: RequestCorrelationContext | undefined,
+  /**
+   * Lifecycle turnId from the session orchestrator (`agent.sendMessage.turnId`).
+   * Distinct from `requestCorrelation.turnId`, which is transport correlation
+   * and may be present when no lifecycle turn exists. All user_message
+   * lifecycle events for this handle (sent/acknowledged/completed) pair by
+   * this value.
+   */
+
+  turnId?: string | undefined);
   /**
    * Curated message history from sessionContext
    * @returns The message history array or undefined if not set
@@ -760,11 +785,16 @@ interface ConfigFactoryInput<TBus extends ScopedBus<string> = ScopedBus<string>>
   adapterId: string;
   /** Adapter type name (required - provided by AIAgent from adapter) */
   adapterName: string;
-  /**
-   * Unresolved provider context (credential refs, not plaintext).
-   * Connectors resolve credentials locally via `resolveConnectorCredentials()`.
-   */
+  /** Refs-only normalized provider selection consumed by the common auth runtime. */
   providerContext: ProviderContext;
+  /** Exact HTTP protocol declared by the selected adapter/provider reference. */
+  providerProtocol?: ProtocolId;
+  /** Adapter/provider auth metadata selected by `providerContext.definitionId`. */
+  adapterProviderAuth?: AdapterProviderAuth;
+  /** Other adapter/provider auth declarations contributing to the scrub union. */
+  compatibleProviderAuths?: readonly AdapterProviderAuth[];
+  /** Whether this adapter rejects the unresolved provider state. */
+  providerContextRequired?: boolean;
   /** Provider's session ID for resuming existing conversations */
   adapterSessionId?: string;
   /** Makaio session ID for tool execution context and multi-session correlation */
@@ -843,6 +873,175 @@ interface IAdapterConfigFactory<TConfig extends BaseAgentConnectorConfig, TBus e
   getConfig(input: ConfigFactoryInput<TBus>): Promise<TConfig>;
 }
 //#endregion
+//#region adapters/core/src/types/provider-definition.d.ts
+/**
+ * Runtime adapter provider definition pairing a serializable provider definition
+ * with optional runtime-only provider configuration metadata.
+ *
+ * Aliases {@link AdapterProviderDefinitionContract} from `@makaio/contracts`,
+ * the single source of truth for the `definition` and `configSchema` fields.
+ * The domain-specific name keeps adapter implementation signatures readable
+ * without creating a second provider-definition contract.
+ *
+ * Each adapter exports an array of these from its `definition.ts` (via `providers`).
+ * The `definition` field contains serializable data (models, endpoints, etc.).
+ * Config schemas are runtime-only — used for UI form generation, never serialized.
+ */
+type AdapterProviderDefinition = AdapterProviderDefinitionContract;
+//#endregion
+//#region adapters/core/src/config/resolve-adapter-auth.d.ts
+/** Stable normalized adapter-auth failure categories. */
+type AdapterAuthErrorReason = 'provider-context-unresolved' | 'binding-missing' | 'binding-ambiguous' | 'client-mismatch' | 'credential-resolution-failed' | 'credential-missing' | 'runtime-bus-missing' | 'native-auth-unavailable';
+/** Typed, credential-free failure at the normalized adapter-auth boundary. */
+declare class AdapterAuthError extends AuthenticationError {
+  readonly reason: AdapterAuthErrorReason;
+  /**
+   * Create a normalized adapter-auth failure.
+   * @param reason - Stable failure category
+   * @param message - Credential-free diagnostic
+   */
+  constructor(reason: AdapterAuthErrorReason, message: string);
+}
+/** Plaintext values produced by the trusted credential resolver. */
+type ResolvedAuthCredentialValues = Readonly<Record<string, string>>;
+/** Resolve normalized credential refs without exposing them outside the trusted consumer. */
+type ResolveAuthCredentialRefs = (credentialRefs: Readonly<Record<string, AuthCredentialRef>>) => Promise<ResolvedAuthCredentialValues>;
+/** Input for binding one normalized provider selection to an adapter declaration. */
+interface BindProviderAuthOptions {
+  /** Resolved provider authentication selection containing refs but no plaintext. */
+  readonly auth: ResolvedProviderAuth;
+  /** Authentication declaration for the selected adapter/provider junction. */
+  readonly adapterProviderAuth: AdapterProviderAuth;
+  /** Other compatible declarations whose environment sinks must also be scrubbed. */
+  readonly compatibleProviderAuths?: readonly AdapterProviderAuth[];
+}
+/** Immutable refs-only adapter binding emitted before connector-local resolution. */
+interface BoundProviderAuthContext {
+  /** Selected normalized provider authentication. */
+  readonly auth: ResolvedProviderAuth;
+  /** The single adapter delivery binding matching the selected method exactly. */
+  readonly binding: AdapterAuthBinding;
+  /** Complete adapter-wide environment variables removed before selected delivery. */
+  readonly scrubEnvVars: readonly string[];
+}
+/**
+ * Select optional field IDs from an explicit normalized auth selection.
+ *
+ * Trusted credential resolvers use this policy to omit only selected optional
+ * refs whose backing secret is unavailable. Keeping it next to the binding
+ * contract guarantees host and container materialization share one rule.
+ * @param bound - Exact provider/auth binding selected for one adapter runtime.
+ * @returns Field IDs whose unavailable refs may be omitted during resolution.
+ */
+declare function getOptionalAuthCredentialFields(bound: BoundProviderAuthContext): readonly string[];
+/** One immutable connector-owned authentication operation. */
+interface ResolvedConnectorAuthDelivery {
+  /** Adapter-specific operation identifier. */
+  readonly target: string;
+  /** Plaintext fields and constant/null suppressions consumed by the operation. */
+  readonly values: Readonly<Record<string, AdapterAuthConstant>>;
+}
+/** Immutable connector-local authentication snapshot. */
+interface ResolvedAdapterAuth {
+  /** Selected plaintext values delivered to a spawned process. */
+  readonly processEnv: Readonly<Record<string, string>>;
+  /** Selected adapter-specific connector operations. */
+  readonly connectorDeliveries: readonly ResolvedConnectorAuthDelivery[];
+  /** Native auth is inherited only for inferred methods. */
+  readonly configInheritance: 'auth-only' | 'empty';
+}
+/**
+ * Bind normalized provider authentication to one exact adapter delivery declaration.
+ *
+ * The result remains refs-only and can therefore travel through adapter configuration
+ * plumbing without exposing plaintext. Every object is cloned by schema parsing and
+ * deeply frozen so connector startup observes one stable selection.
+ * @param options - Selected auth plus selected and compatible adapter declarations.
+ * @returns Immutable refs-only provider auth binding.
+ */
+declare function bindProviderAuth(options: BindProviderAuthOptions): BoundProviderAuthContext;
+/**
+ * Resolve a bound provider auth context into one immutable connector-local snapshot.
+ *
+ * Explicit refs are resolved exactly once. Only required fields must materialize;
+ * unavailable optional fields are omitted from every delivery. Inferred and no-auth
+ * methods never invoke the credential resolver.
+ * @param bound - Immutable refs-only adapter binding.
+ * @param resolveCredentialRefs - Trusted local credential resolver.
+ * @returns Immutable plaintext delivery snapshot.
+ */
+declare function resolveBoundProviderAuth(bound: BoundProviderAuthContext, resolveCredentialRefs: ResolveAuthCredentialRefs): Promise<ResolvedAdapterAuth>;
+//#endregion
+//#region adapters/core/src/config/adapter-auth-runtime.d.ts
+/** Refs-only config emitted by the common adapter factory. */
+type BoundAdapterRuntimeConfig<TBus extends ScopedBus<string> = ScopedBus<string>, TConfig extends BaseAgentConnectorConfig<TBus> = BaseAgentConnectorConfig<TBus>> = TConfig & {
+  /** Adapter instance identifier required by connector factories. */adapterId: string; /** Exact normalized auth selection and adapter delivery binding. */
+  boundProviderAuth?: BoundProviderAuthContext;
+};
+/** Connector-facing config after auth refs and client state have been materialized. */
+type ResolvedAdapterRuntimeConfig<TBus extends ScopedBus<string> = ScopedBus<string>, TConfig extends BaseAgentConnectorConfig<TBus> = BaseAgentConnectorConfig<TBus>> = Omit<TConfig, 'boundProviderAuth'> & {
+  /** Adapter instance identifier required by connector factories. */adapterId: string; /** Selected connector-local auth delivery, including plaintext. */
+  adapterAuth?: ResolvedAdapterAuth; /** Selected managed client binary, when this adapter has a client. */
+  clientExecution?: ClientExecutionContext; /** Auth-free environment safe for routable/shared execution contexts. */
+  contextEnv: Readonly<Record<string, string>>;
+};
+/** Explicit connector-owned client config lease. */
+interface AdapterAuthLeaseHandle {
+  /** Client whose isolated config directory is leased. */
+  readonly clientId: string;
+  /** Connector-unique lease identifier. */
+  readonly leaseId: string;
+  /** Release the lease exactly once. Repeated calls share the same result. */
+  release(): Promise<void>;
+}
+/** Runtime config plus the lease whose lifetime must match its connector. */
+interface PreparedAdapterAuthRuntime<TBus extends ScopedBus<string> = ScopedBus<string>, TConfig extends BaseAgentConnectorConfig<TBus> = BaseAgentConnectorConfig<TBus>> {
+  /** Connector-facing config with one immutable auth snapshot. */
+  readonly config: ResolvedAdapterRuntimeConfig<TBus, TConfig>;
+  /** Explicit lease handle, present only for client-backed adapters. */
+  readonly lease?: AdapterAuthLeaseHandle;
+}
+/** Trusted non-serializable strategy for preparing auth in the current host. */
+type AdapterAuthRuntimePreparer<TBus extends ScopedBus<string> = ScopedBus<string>, TConfig extends BaseAgentConnectorConfig<TBus> = BaseAgentConnectorConfig<TBus>> = (config: BoundAdapterRuntimeConfig<TBus, TConfig>) => Promise<PreparedAdapterAuthRuntime<TBus, TConfig>>;
+/** Host-resolved auth material supplied to a runtime without local secret services. */
+interface SuppliedAdapterAuthRuntime {
+  /** Auth snapshot already compiled against the selected adapter binding by the host. */
+  readonly selectorValidatedAuth: ResolvedAdapterAuth;
+  /** Complete host-compiled adapter auth source/sink scrub union. */
+  readonly scrubEnvVars: readonly string[];
+  /** Non-auth session environment supplied by the host. */
+  readonly sessionEnv?: Readonly<Record<string, string>>;
+  /** Pre-resolved non-auth binary environment supplied by the host. */
+  readonly binaryEnv?: Readonly<Record<string, string>>;
+  /** Environment for an externally-owned config lease or mounted native state. */
+  readonly leaseEnv?: Readonly<Record<string, string>>;
+}
+/**
+ * Prepare the single connector-local auth snapshot and client config lease.
+ *
+ * Explicit credential refs are resolved exactly once through the encrypted
+ * credential channel. The existing session-environment helper remains the
+ * sole merge authority: it scrubs the full adapter set before selected auth
+ * values are applied last. The caller owns the returned lease and must release
+ * it in every connector close or rollback path.
+ * @param config - Refs-only config emitted by the adapter config factory
+ * @returns Connector-facing config and its explicit lease handle
+ */
+declare function prepareAdapterAuthRuntime<TBus extends ScopedBus<string>, TConfig extends BaseAgentConnectorConfig<TBus>>(config: BoundAdapterRuntimeConfig<TBus, TConfig>): Promise<PreparedAdapterAuthRuntime<TBus, TConfig>>;
+/**
+ * Apply host-resolved auth without opening credential channels or owning leases.
+ *
+ * This is the container/bootstrap seam. Its input must already have been
+ * selector-validated with {@link resolveBoundProviderAuth} by the trusted host.
+ * Every supplied non-auth source is merged before the full scrub union, then
+ * only the selected process delivery is injected. Connector deliveries remain
+ * structured values and are never serialized or logged here.
+ * @param config - Connector config containing only non-auth runtime inputs
+ * @param supplied - Host-compiled auth and non-auth environment sources
+ * @returns Connector-facing config with one immutable auth snapshot
+ */
+declare function applySuppliedAdapterAuthRuntime<TBus extends ScopedBus<string>, TConfig extends BaseAgentConnectorConfig<TBus>>(config: BoundAdapterRuntimeConfig<TBus, TConfig>, supplied: SuppliedAdapterAuthRuntime): Promise<ResolvedAdapterRuntimeConfig<TBus, TConfig>>;
+//#endregion
 //#region adapters/core/src/agent/types.d.ts
 /**
  * Core agent identity fields.
@@ -911,14 +1110,12 @@ interface BaseAgentConnectorConfig<TBus extends ScopedBus<string> = ScopedBus<st
    */
   providerConfigId?: string;
   /**
-   * Unresolved provider context (credential refs, not plaintext).
-   *
-   * Passed through from the factory input so connectors can call
-   * `resolveConnectorCredentials()` locally during initialization.
-   * Connectors must NOT read plaintext credentials from this field —
-   * they must resolve refs via `resolveConnectorCredentials()`.
+   * Refs-only normalized provider selection retained for runtime introspection.
+   * Plaintext authentication is available only through {@link adapterAuth}.
    */
   providerContext?: ProviderContext;
+  /** Exact HTTP protocol selected by the active adapter/provider reference. */
+  providerProtocol?: ProtocolId;
   providerConfig?: TProviderConfig;
   /**
    * Maps supported reasoning levels to provider-native values for the active model.
@@ -941,6 +1138,22 @@ interface BaseAgentConnectorConfig<TBus extends ScopedBus<string> = ScopedBus<st
   clientId?: string;
   /** Client profile name for session-scoped config isolation. */
   clientProfileName?: string;
+  /**
+   * Auth-free environment safe for bus-routable tool and MCP contexts.
+   *
+   * The central adapter runtime derives this from the same merged inputs as
+   * `env`, but omits the selected process authentication delivery.
+   */
+  contextEnv?: Readonly<Record<string, string>>;
+  /**
+   * Single connector-local normalized auth snapshot.
+   *
+   * Plaintext exists only on this trusted connector config and must never be
+   * emitted, persisted, stringified, or copied back into provider context.
+   */
+  adapterAuth?: ResolvedAdapterAuth;
+  /** Managed client binary selected by the central runtime, when applicable. */
+  clientExecution?: ClientExecutionContext;
   /** Callback when a user message is enqueued */
   onMessageSent?: (messageHandle: MessageHandle) => void;
   /**
@@ -987,11 +1200,7 @@ interface AIAgentConfig<TBus extends ScopedBus<string> = ScopedBus<string>, TCon
   adapterSessionId?: string;
   /** Makaio session identifier */
   sessionId?: string;
-  /**
-   * Unresolved provider context (credential refs, not plaintext).
-   * Set by the orchestrator before forwarding the startAgent request.
-   * Connectors resolve credentials locally via `resolveConnectorCredentials()`.
-   */
+  /** Refs-only normalized provider selection set by session orchestration. */
   providerContext?: ProviderContext;
   /** Previous adapter session ID for resume attempts (from recovery). */
   resumeAdapterSessionId?: string;
@@ -1001,6 +1210,8 @@ interface AIAgentConfig<TBus extends ScopedBus<string> = ScopedBus<string>, TCon
   clientId?: string;
   /** Client profile name for session-scoped config isolation. */
   clientProfileName?: string;
+  /** Trusted non-serializable auth preparation strategy injected by the host. */
+  prepareAuthRuntime?: AdapterAuthRuntimePreparer<TBus>;
   /** Global bus instance (defaults to MakaioBus singleton) */
   globalBus?: IMakaioBus;
   /** Scoped bus for adapter-specific events */
@@ -1011,6 +1222,8 @@ interface AIAgentConfig<TBus extends ScopedBus<string> = ScopedBus<string>, TCon
   nativeTools: string[];
   /** Available models for this adapter (used for context window lookup) */
   availableModels?: AIModel[];
+  /** Resolved provider definitions, including adapter-provider auth metadata. */
+  definitionProviders?: readonly AdapterProviderDefinition[];
   /** Allowed tool names (adapter-specific). Empty array = disable all tools. */
   allowedTools?: string[];
   /** Disallowed tool names (adapter-specific). Takes precedence over allowedTools. */
@@ -1120,6 +1333,13 @@ interface ConnectorSendMessageOptions extends AgentSendMessageOptions {
    * message handle and never materialized into the LLM-facing message.
    */
   requestCorrelation?: RequestCorrelationContext;
+  /**
+   * Lifecycle turnId from the session orchestrator (`agent.sendMessage.turnId`).
+   * Carried on the message handle so user_message lifecycle events pair by it.
+   * Distinct from `requestCorrelation.turnId`, which is transport correlation
+   * and may be present when no lifecycle turn exists.
+   */
+  turnId?: string;
   /**
    * Turn-scoped context assembled by PreUserMessage hooks and the orchestrator.
    * Extracted from sessionContext.turnContext by AIAgent.
@@ -1178,6 +1398,11 @@ type EmitteryEvents = {
 /**
  * Normalized usage metrics for a single agent call.
  * Adapter implementations normalize provider-specific usage data to this format.
+ *
+ * Derived from the `agent.usage` schema, so the mandatory `granularity` field
+ * is part of this type: adapters MUST declare the truthful measurement
+ * granularity of every usage signal they normalize (see
+ * `docs/architecture/adapters/usage-and-provenance.md`).
  */
 type NormalizedCallUsage = Omit<z.infer<typeof AgentSchemas.usage>, keyof AgentContext | 'model'>;
 /**
@@ -1205,6 +1430,14 @@ type AgentConnectorConfigOverrides = Partial<{
   adapterSessionId: string;
   resumeAdapterSessionId: string;
   mcpSessionContext: McpRuntimeSessionContext | McpSessionContext | LedgerSessionContext;
+  /**
+   * Target reasoning effort for the replacement generation. Key presence (not
+   * value) selects this over the live connector's current effort, so an
+   * explicit `undefined` builds a reasoning-less connector. Adapters may
+   * consume reasoning only at construction/start, so the replacement must be
+   * built with its target effort rather than mutated afterwards.
+   */
+  reasoningEffort: AIReasoningLevel$1 | undefined;
 }>;
 //#endregion
-export { MessageDeliveryMode$1 as A, AIReasoningLevel$1 as B, NormalizedCallUsage as C, ConfigFactoryInput as D, StartAgentOptions as E, MessageResult as F, ToolLedgerEntry as G, ISessionToolLedger as H, MessageState as I, ProcessingState as L, markCompletedWithFinalResult as M, NormalizedMessageInput as N, IAdapterConfigFactory as O, normalizeMessageInput as P, SendMessageOptions as R, GetCapabilitiesResponsePayload as S, SendMessageResponsePayload as T, LedgerSessionContext as U, ReasoningLevelMap$1 as V, SessionToolLedger as W, BaseAgentConnectorConfig as _, AgentCredentialChangeResponsePayload as a, ContextWindowInput as b, AgentIdentity as c, AgentMcpServersSetRequestPayload as d, AgentMcpServersSetResponsePayload as f, AgentStartResult as g, AgentSendMessageOptions as h, AgentCredentialChangeRequestPayload as i, MessageHandle as j, AIAgentConnector as k, AgentInterruptRequestPayload as l, AgentModelChangeResponsePayload as m, AgentConnectorConfigOverrides as n, AgentCwdChangeRequestPayload as o, AgentModelChangeRequestPayload as p, AgentContext as r, AgentCwdChangeResponsePayload as s, AIAgentConfig as t, AgentInterruptResponsePayload as u, ConnectorSendMessageOptions as v, SendMessageRequestPayload as w, ExecutionContext as x, ConnectorStartOptions as y, AIModel as z };
+export { NormalizedMessageInput as $, PreparedAdapterAuthRuntime as A, ResolvedAdapterAuth as B, NormalizedCallUsage as C, AdapterAuthLeaseHandle as D, StartAgentOptions as E, AdapterAuthError as F, resolveBoundProviderAuth as G, ResolvedConnectorAuthDelivery as H, AdapterAuthErrorReason as I, IAdapterConfigFactory as J, AdapterProviderDefinition as K, BindProviderAuthOptions as L, SuppliedAdapterAuthRuntime as M, applySuppliedAdapterAuthRuntime as N, AdapterAuthRuntimePreparer as O, prepareAdapterAuthRuntime as P, markCompletedWithFinalResult as Q, BoundProviderAuthContext as R, GetCapabilitiesResponsePayload as S, SendMessageResponsePayload as T, bindProviderAuth as U, ResolvedAuthCredentialValues as V, getOptionalAuthCredentialFields as W, MessageDeliveryMode$1 as X, AIAgentConnector as Y, MessageHandle as Z, BaseAgentConnectorConfig as _, AgentCredentialChangeResponsePayload as a, AIModel as at, ContextWindowInput as b, AgentIdentity as c, ISessionToolLedger as ct, AgentMcpServersSetRequestPayload as d, ToolLedgerEntry as dt, normalizeMessageInput as et, AgentMcpServersSetResponsePayload as f, AgentStartResult as g, AgentSendMessageOptions as h, AgentCredentialChangeRequestPayload as i, SendMessageOptions as it, ResolvedAdapterRuntimeConfig as j, BoundAdapterRuntimeConfig as k, AgentInterruptRequestPayload as l, LedgerSessionContext as lt, AgentModelChangeResponsePayload as m, AgentConnectorConfigOverrides as n, MessageState as nt, AgentCwdChangeRequestPayload as o, AIReasoningLevel$1 as ot, AgentModelChangeRequestPayload as p, ConfigFactoryInput as q, AgentContext as r, ProcessingState as rt, AgentCwdChangeResponsePayload as s, ReasoningLevelMap$1 as st, AIAgentConfig as t, MessageResult as tt, AgentInterruptResponsePayload as u, SessionToolLedger as ut, ConnectorSendMessageOptions as v, SendMessageRequestPayload as w, ExecutionContext as x, ConnectorStartOptions as y, ResolveAuthCredentialRefs as z };