@makaio/framework 1.0.0-dev-1783705652236 → 1.0.0-dev-1783940945655

package/dist/{canonical-model-DV-Z8gsb.mjs → canonical-model-CVRCW9h7.mjs}

@@ -1 +1 @@
-import{a as e}from"./visibility-Cb62p9bv.mjs";import{i as t,l as n,r,t as i}from"./compression-C5JAWdgZ.mjs";import{t as a}from"./schemas-XeIBqwvE.mjs";import{o}from"./schemas-CuG17U3L.mjs";import{z as s}from"zod";import{createBusNamespace as c}from"@makaio/framework/core";const l=[`empty`,`empty-model`,`empty-routing`,`empty-segment`,`too-many-segments`,`invalid-segment`,`invalid-virtual-name`,`empty-virtual-name`],u=s.enum(l),d=s.object({kind:s.literal(`parse-error`),code:u,message:s.string(),input:s.string()}),f=s.object({kind:s.literal(`bare`),model:s.string()}),p=s.object({kind:s.literal(`qualified`),segment1:s.string(),segment2:s.string().optional(),model:s.string()}),m=s.object({kind:s.literal(`virtual`),name:s.string()}),h=s.discriminatedUnion(`kind`,[f,p,m]),g=s.discriminatedUnion(`kind`,[f,p]),_=s.discriminatedUnion(`kind`,[f,p,m,d]),v=/^[a-z0-9][a-z0-9._-]*$/,y=/^[a-z0-9][a-z0-9_-]*$/;function b(e,t,n){return{kind:`parse-error`,code:e,message:t,input:n}}function x(e){let t=e.trim();if(t.length===0)return b(`empty`,`Canonical model string must not be empty.`,e);if(t.startsWith(`~`)){let n=t.slice(1);return n.length===0?b(`empty-virtual-name`,`Virtual model reference '~' must be followed by a name.`,e):y.test(n)?{kind:`virtual`,name:n}:b(`invalid-virtual-name`,`Invalid virtual model name '${n}': must match [a-z0-9][a-z0-9_-]*.`,e)}let n=t.indexOf(`::`);if(n===-1)return{kind:`bare`,model:t};let r=t.slice(0,n),i=t.slice(n+2);if(r.length===0)return b(`empty-routing`,`Canonical model string must have a routing segment before '::'.`,e);if(i.length===0)return b(`empty-model`,`Canonical model string must have a model name after '::'.`,e);let a=r.toLowerCase().split(`/`);for(let t of a)if(t.length===0)return b(`empty-segment`,`Routing segment must not be empty - check for consecutive '/' characters.`,e);if(a.length>2)return b(`too-many-segments`,`Routing part '${r}' has ${a.length} segments; at most 2 are allowed.`,e);for(let t of a)if(!v.test(t))return b(`invalid-segment`,`Routing segment '${t}' is invalid: must match [a-z0-9][a-z0-9._-]*.`,e);return{kind:`qualified`,segment1:a[0],segment2:a.length>1?a[1]:void 0,model:i}}function S(e){return e.kind===`parse-error`}const C=s.object({adapterName:s.string(),providerConfigId:s.string().optional(),model:s.string().optional(),systemPrompt:s.string().optional(),contextMode:o,compressionMode:i,allowedTools:s.array(s.string()).optional(),disallowedTools:s.array(s.string()).optional(),allowedDirectories:s.array(s.string()).optional(),reasoningEffort:e.optional(),approvalPolicy:a.optional(),harnessId:s.string().optional(),profileId:s.string().optional(),mcpConfig:n.optional()}),w=s.object({sessionId:s.string().optional(),projectId:s.string().optional(),promptText:s.string().optional(),sessionContext:s.unknown().optional()}),T=c(`agentResolution`,{resolve:{request:s.object({selection:t,context:w.optional()}),response:C}}),E=T.subjects,D=r.safeExtend({kind:s.literal(`adapter`),adapterName:s.string(),providerConfigId:s.string(),model:s.string()}),O={resolve:{request:s.object({parsed:g,context:w.optional()}),response:D}},k=c(`canonicalModel`,O),A=k.subjects;export{h as _,T as a,m as b,v as c,x as d,f,_ as g,d as h,O as i,y as l,u as m,A as n,E as o,l as p,D as r,C as s,k as t,S as u,p as v,g as y};
+import{a as e}from"./visibility-Cb62p9bv.mjs";import{i as t,l as n,r,t as i}from"./compression-CZ_6fYq8.mjs";import{t as a}from"./schemas-CMyv7l7-.mjs";import{o}from"./schemas-D6lj9NMg.mjs";import{z as s}from"zod";import{createBusNamespace as c}from"@makaio/framework/core";const l=[`empty`,`empty-model`,`empty-routing`,`empty-segment`,`too-many-segments`,`invalid-segment`,`invalid-virtual-name`,`empty-virtual-name`],u=s.enum(l),d=s.object({kind:s.literal(`parse-error`),code:u,message:s.string(),input:s.string()}),f=s.object({kind:s.literal(`bare`),model:s.string()}),p=s.object({kind:s.literal(`qualified`),segment1:s.string(),segment2:s.string().optional(),model:s.string()}),m=s.object({kind:s.literal(`virtual`),name:s.string()}),h=s.discriminatedUnion(`kind`,[f,p,m]),g=s.discriminatedUnion(`kind`,[f,p]),_=s.discriminatedUnion(`kind`,[f,p,m,d]),v=/^[a-z0-9][a-z0-9._-]*$/,y=/^[a-z0-9][a-z0-9_-]*$/;function b(e,t,n){return{kind:`parse-error`,code:e,message:t,input:n}}function x(e){let t=e.trim();if(t.length===0)return b(`empty`,`Canonical model string must not be empty.`,e);if(t.startsWith(`~`)){let n=t.slice(1);return n.length===0?b(`empty-virtual-name`,`Virtual model reference '~' must be followed by a name.`,e):y.test(n)?{kind:`virtual`,name:n}:b(`invalid-virtual-name`,`Invalid virtual model name '${n}': must match [a-z0-9][a-z0-9_-]*.`,e)}let n=t.indexOf(`::`);if(n===-1)return{kind:`bare`,model:t};let r=t.slice(0,n),i=t.slice(n+2);if(r.length===0)return b(`empty-routing`,`Canonical model string must have a routing segment before '::'.`,e);if(i.length===0)return b(`empty-model`,`Canonical model string must have a model name after '::'.`,e);let a=r.toLowerCase().split(`/`);for(let t of a)if(t.length===0)return b(`empty-segment`,`Routing segment must not be empty - check for consecutive '/' characters.`,e);if(a.length>2)return b(`too-many-segments`,`Routing part '${r}' has ${a.length} segments; at most 2 are allowed.`,e);for(let t of a)if(!v.test(t))return b(`invalid-segment`,`Routing segment '${t}' is invalid: must match [a-z0-9][a-z0-9._-]*.`,e);return{kind:`qualified`,segment1:a[0],segment2:a.length>1?a[1]:void 0,model:i}}function S(e){return e.kind===`parse-error`}const C=s.object({adapterName:s.string(),providerConfigId:s.string().optional(),model:s.string().optional(),systemPrompt:s.string().optional(),contextMode:o,compressionMode:i,allowedTools:s.array(s.string()).optional(),disallowedTools:s.array(s.string()).optional(),allowedDirectories:s.array(s.string()).optional(),reasoningEffort:e.optional(),approvalPolicy:a.optional(),harnessId:s.string().optional(),profileId:s.string().optional(),mcpConfig:n.optional()}),w=s.object({sessionId:s.string().optional(),projectId:s.string().optional(),promptText:s.string().optional(),sessionContext:s.unknown().optional()}),T=c(`agentResolution`,{resolve:{request:s.object({selection:t,context:w.optional()}),response:C}}),E=T.subjects,D=r.safeExtend({kind:s.literal(`adapter`),adapterName:s.string(),providerConfigId:s.string(),model:s.string()}),O={resolve:{request:s.object({parsed:g,context:w.optional()}),response:D}},k=c(`canonicalModel`,O),A=k.subjects;export{h as _,T as a,m as b,v as c,x as d,f,_ as g,d as h,O as i,y as l,u as m,A as n,E as o,l as p,D as r,C as s,k as t,S as u,p as v,g as y};

package/dist/client-BkpLM8Fx.mjs

@@ -0,0 +1 @@
+import{o as e,s as t}from"./definitions-C1pgx0Nq.mjs";import{t as n}from"./schemas-CMyv7l7-.mjs";import{_ as r,a as i,g as a,h as o,m as s,n as ee,o as te}from"./profile-D2m94ZYD.mjs";import{n as ne,t as c}from"./version-C1-VD-XL.mjs";import{c as re,d as ie,n as ae,o as oe,s as se,t as l,u as ce}from"./account-identity-BYfeWLe-.mjs";import{z as u}from"zod";import{createBusNamespace as le,observability as d}from"@makaio/framework/core";const f=u.object({tag:u.string(),description:u.string().optional()}),p=u.object({name:u.string(),friendlyName:u.string(),description:u.string().optional(),category:u.string().optional(),capabilities:u.array(f).default([])}),m=u.object({id:u.string(),name:u.string(),description:u.string().optional(),glob:u.string().optional()}),h=u.object({name:u.string().min(1),frameworkSubject:u.string().min(1).optional(),mode:u.enum([`event`,`request`]).default(`event`)}),g=u.object({envVar:a.regex(/^[A-Za-z_][A-Za-z0-9_]*$/,{message:`envVar must be a valid environment variable name (letters, digits, underscores)`}),defaultPath:a.refine(e=>e===`~`||e.startsWith(`~/`)||r(e),{message:`defaultPath must be absolute, '~', or start with '~/'`}),pathKind:u.enum([`directory`,`file`]).default(`directory`)});function ue(e){if(!e.startsWith(`@`))return!e.includes(`@`);let t=e.indexOf(`/`);return t>1&&!e.slice(t+1).includes(`@`)}const _=u.object({type:u.literal(`npm`),package:u.string().min(1).refine(ue,{message:"package must not include an inline `@version` suffix; use the version field instead"}),version:c}),v=u.object({type:u.literal(`signed-binary-bucket`),version:c,config:u.object({baseUrl:u.string().url(),manifestPathTemplate:u.string().min(1),manifestSignaturePathTemplate:u.string().min(1),publicKeyUrl:u.string().url(),publicKeyFingerprint:u.string().min(1),binaryPathTemplate:u.string().min(1),platforms:u.record(u.string().min(1),u.string().min(1))})}),y=u.discriminatedUnion(`type`,[_,v]),b=u.object({executable:u.union([u.string().min(1),u.object({default:u.string().min(1),darwin:u.string().min(1).optional(),linux:u.string().min(1).optional(),win32:u.string().min(1).optional()}).strict()]),args:u.array(u.string()).default([])}).strict(),x=u.object({kind:u.string().min(1),payload:u.record(u.string(),u.unknown()).optional()}),S=u.object({supportsHooks:u.boolean().default(!1),supportsStatusline:u.boolean().default(!1),supportsSupervisorLaunch:u.boolean().default(!1),supportsManagedBinary:u.boolean().default(!1),hookEvents:u.array(h).default([])}).refine(e=>e.supportsHooks||e.hookEvents.length===0,{message:`hookEvents must be empty when supportsHooks is false`,path:[`hookEvents`]}),C=u.object({name:u.string().min(1),supportedVersions:ne}).strict(),w=u.object({id:u.string(),name:u.string(),version:c,description:u.string().optional(),binary:C.optional(),nativeTools:u.array(p).default([]),defaultApprovalPolicy:n,logSources:u.array(m).optional(),authMethods:e,defaultAuth:t.optional(),runtimeCapabilities:S.optional().transform(e=>S.parse(e??{})),managedInstall:y.optional(),versionCommand:b.optional(),postInstall:x.optional(),configIsolation:g.optional()}).strict().refine(e=>!e.runtimeCapabilities.supportsManagedBinary||e.managedInstall!==void 0,{message:`managedInstall is required when runtimeCapabilities.supportsManagedBinary is true`,path:[`managedInstall`]}).refine(e=>e.managedInstall===void 0||e.runtimeCapabilities.supportsManagedBinary,{message:`runtimeCapabilities.supportsManagedBinary must be true when managedInstall is provided`,path:[`runtimeCapabilities`,`supportsManagedBinary`]}).refine(e=>e.managedInstall===void 0||e.versionCommand!==void 0,{message:`versionCommand is required when managedInstall is provided`,path:[`versionCommand`]}).superRefine((e,t)=>{e.defaultAuth!==void 0&&e.authMethods.find(({id:t})=>t===e.defaultAuth?.methodId)?.mode!==`inferred`&&t.addIssue({code:u.ZodIssueCode.custom,message:`defaultAuth.methodId must reference an inferred method declared by this client.`,path:[`defaultAuth`,`methodId`]})}).superRefine((e,t)=>{if(e.managedInstall===void 0||e.versionCommand===void 0)return;let{executable:n}=e.versionCommand,r=typeof n==`string`?[{path:n,issuePath:[`versionCommand`,`executable`]}]:[{path:n.default,issuePath:[`versionCommand`,`executable`,`default`]},...n.darwin===void 0?[]:[{path:n.darwin,issuePath:[`versionCommand`,`executable`,`darwin`]}],...n.linux===void 0?[]:[{path:n.linux,issuePath:[`versionCommand`,`executable`,`linux`]}],...n.win32===void 0?[]:[{path:n.win32,issuePath:[`versionCommand`,`executable`,`win32`]}]];for(let{path:e,issuePath:n}of r){let r=e.startsWith(`/`),i=/^[A-Za-z]:/.test(e),a=e.startsWith(`\\`);if(r||i||a){t.addIssue({code:u.ZodIssueCode.custom,path:n,message:`${n.join(`.`)} must be a relative path within the install directory`});continue}e.split(/[/\\]/).some(e=>e===`..`)&&t.addIssue({code:u.ZodIssueCode.custom,path:n,message:`${n.join(`.`)} must be a relative path within the install directory`})}}),T=u.object({binaryPath:s.nullable(),env:u.record(u.string(),u.string()),configDir:s.nullable(),source:u.enum([`managed`,`global`]),version:a.nullable()}),E={request:u.object({clientId:a,sessionId:a.optional(),projectDir:s.optional(),preferSource:u.enum([`managed`,`global`]).optional(),harnessId:a.optional()}),response:T},D=u.enum([`npm`,`signed-binary-bucket`]),O=u.object({version:a,installPath:s,installedAt:o,isActive:u.boolean()}),k=u.object({clientId:a,installedVersions:u.array(O),activeVersion:a.nullable(),pinnedVersion:c,updateAvailable:u.boolean()}).strict(),A={request:u.object({forceRefresh:u.boolean().optional()}),response:u.object({clients:u.array(k)})},j={request:u.object({clientId:a,version:c.optional()}),response:u.object({jobId:a,requestedVersion:c.nullable(),resolvedVersion:c.nullable()})},de={request:u.object({clientId:a,version:a}),response:u.object({clientId:a,removedVersion:a,activeVersion:a.nullable()})},M={request:u.object({clientId:a}),response:u.object({jobId:a,resolvedVersion:c.nullable()})},N={request:u.object({clientId:a,version:a}),response:u.object({clientId:a,activeVersion:a})},P=u.enum([`resolving`,`downloading`,`verifying`,`extracting`,`installing`,`post-install`,`activating`]),F=u.object({jobId:a,clientId:a,version:a.optional(),strategy:D,stage:P,progress:u.number().min(0).max(100).nullable(),installPath:s.optional(),activeAfterCompletion:u.boolean().optional(),metadata:u.record(u.string(),u.unknown()).optional()}),I=u.object({message:u.string(),code:u.string().optional()}),L=u.object({jobId:a,clientId:a,version:a.optional(),strategy:D,status:u.enum([`success`,`error`]),installPath:s.optional(),activeVersion:a.nullable(),error:I.optional(),metadata:u.record(u.string(),u.unknown()).optional()}),R=u.object({clientId:a,previousActiveVersion:a.nullable(),activeVersion:a.nullable(),reason:u.enum([`install`,`update`,`set-active`,`uninstall`])}),z=u.enum([`supervisor`,`adapter`,`client-hook`,`statusline`,`cli-wrapper`]),B=u.object({layer:z,producer:a}),V=u.object({supervisorSessionId:a.optional(),pid:u.number().int().positive().optional(),parentPid:u.number().int().positive().optional(),adapterSessionId:a.optional(),sessionId:a.optional(),cwd:u.string().optional(),argv:u.array(u.string()).optional(),metadata:u.record(u.string(),u.unknown()).optional()}),H={request:u.object({clientId:a,source:B,observedAt:o}).merge(V).refine(e=>e.supervisorSessionId!==void 0||e.pid!==void 0||e.adapterSessionId!==void 0,{message:`At least one hard-evidence field is required (supervisorSessionId, pid, or adapterSessionId)`}),response:u.object({clientRuntimeId:a,created:u.boolean(),promoted:u.boolean()})},U=V.extend({clientRuntimeId:a,clientId:a,status:u.enum([`observed`,`started`]),source:B,observedAt:o}),W={request:u.object({adapterSessionId:a,clientId:a}),response:u.object({managed:u.boolean()})},G=u.object({clientId:d.attribute(a,`makaio.client.id`),source:d.attribute(a,`makaio.client.lifecycle.source`),observedAt:d.attribute(o,`event.observed_at`),sessionId:d.attribute(u.string(),`makaio.session.id`).optional(),adapterSessionId:d.attribute(u.string(),`makaio.adapter.session_id`).optional(),metadata:u.record(u.string(),u.unknown()).optional()}),K=[`fresh`,`fork`,`resume`,`clear`,`compact`],q=u.enum(K),J=G.extend({transcriptPath:u.string().optional(),cwd:u.string().optional(),machineId:d.attribute(u.string(),`makaio.machine.id`).optional(),startMode:d.attribute(q,`makaio.session.start_mode`).optional(),parentAdapterSessionId:d.attribute(u.string(),`makaio.session.parent_adapter_session_id`).optional()}),Y=G.extend({prompt:a.optional()}),X=G.extend({}),fe=G.extend({transcriptPath:u.string().optional()}),pe=G.extend({toolName:d.attribute(a,`tool.name`).optional(),toolCallId:d.attribute(a,`tool.call_id`).optional()}),me=G.extend({toolName:d.attribute(a,`tool.name`).optional(),toolCallId:d.attribute(a,`tool.call_id`).optional(),success:d.attribute(u.boolean(),`tool.success`).optional()}),he=u.object({group:a,name:a,installed:u.boolean(),command:a}),Z=u.enum([`provider-reported`,`client-reported`,`estimated`]),Q=u.number().finite().nonnegative(),ge=u.number().finite().min(0).max(100),_e=u.object({clientId:d.attribute(a,`makaio.client.id`),clientAccountId:d.attribute(a,`makaio.client.account_id`).optional(),sessionId:d.attribute(a,`makaio.session.id`).optional(),adapterSessionId:d.attribute(a,`makaio.adapter.session_id`).optional(),source:d.attribute(a,`makaio.client.usage.source`),observedAt:d.attribute(o,`event.observed_at`),clientVersion:d.attribute(a,`makaio.client.version`).optional(),modelId:d.attribute(a,`llm.model`).optional(),modelDisplayName:d.attribute(a,`llm.model.display_name`).optional(),modelFamily:d.attribute(a,`llm.model.family`).optional(),latestRequestInputTokens:d.attribute(Q,`llm.tokens.latest_request.input`).optional(),latestRequestOutputTokens:d.attribute(Q,`llm.tokens.latest_request.output`).optional(),latestRequestCacheReadTokens:d.attribute(Q,`llm.tokens.latest_request.cache_read`).optional(),latestRequestCacheWriteTokens:d.attribute(Q,`llm.tokens.latest_request.cache_write`).optional(),currentContextInputTokens:d.attribute(Q,`llm.context.tokens.input`).optional(),currentContextOutputTokens:d.attribute(Q,`llm.context.tokens.output`).optional(),contextWindowSizeTokens:d.attribute(Q,`llm.context.window_size`).optional(),contextUsedPercentage:d.attribute(ge,`llm.context.used_percentage`).optional(),contextRemainingPercentage:d.attribute(ge,`llm.context.remaining_percentage`).optional(),contextThresholdExceeded:d.attribute(u.boolean(),`llm.context.threshold_exceeded`).optional(),totalCost:d.attribute(Q,`llm.cost.total`).optional(),costCurrency:d.attribute(a,`llm.cost.currency`).optional(),costProvenance:d.attribute(Z,`llm.cost.provenance`).optional(),totalDurationMs:d.attribute(Q,`makaio.session.duration_ms`).optional(),totalApiDurationMs:d.attribute(Q,`llm.duration.total_api_ms`).optional(),totalLinesAdded:d.attribute(Q,`code.lines_added`).optional(),totalLinesRemoved:d.attribute(Q,`code.lines_removed`).optional(),totalEdits:d.attribute(Q,`code.edits`).optional()}).strict().superRefine((e,t)=>{let n=[`totalCost`,`costCurrency`,`costProvenance`],r=n.filter(t=>e[t]!==void 0).length;if(!(r===0||r===n.length))for(let r of n)e[r]===void 0&&t.addIssue({code:u.ZodIssueCode.custom,path:[r],message:`totalCost, costCurrency, and costProvenance must be supplied together`})}),ve={"runtime.observe":H,"runtime.started":U,"runtime.isAdapterManaged":W,scan:{request:u.object({targets:u.array(se).optional()}),response:u.object({results:u.array(oe)})},"session.account.observe":re,"account.observe":ae,"account.activate":{request:u.object({clientId:a,clientAccountId:a,identifiers:u.array(l).min(1),displayLabel:u.string().optional()}),response:u.object({accepted:u.boolean()})},"account.getActive":{request:u.object({clientId:a}),response:u.object({identity:u.object({clientAccountId:a,identifiers:u.array(l).min(1),displayLabel:u.string().optional()}).nullable()})},"usage.ingest":ce,"usage.snapshot":ie,"session.usage.snapshot":_e,"session.started":J,"session.userPrompt.submitted":Y,"session.turn.started":X,"session.turn.completed":fe,"session.tool.pre":pe,"session.tool.post":me,"wiring.list":{request:u.object({clientId:a.optional(),projectDir:s.optional(),makaioCommand:a}),response:u.object({results:u.array(u.object({clientId:a,entries:u.array(he)}))})},list:A,install:j,uninstall:de,update:M,setActive:N,"installJob.progress":F,"installJob.completed":L,"version.changed":R,resolveBinary:E,...i,...te,"config.prime":ee},ye=le(`client`,ve),be=ye.subjects;function $(e){if(Array.isArray(e)){for(let t of e)$(t);return Object.freeze(e)}if(e&&typeof e==`object`){for(let t of Object.values(e))$(t);return Object.freeze(e)}return e}function xe(e){return $(w.parse(e))}export{M as A,h as B,k as C,A as D,j as E,D as F,m as G,f as H,T as I,x as J,y as K,E as L,I as M,P as N,N as O,O as P,C as R,U as S,F as T,p as U,S as V,g as W,b as X,v as Y,V as _,Z as a,z as b,G as c,me as d,pe as f,he as g,Y as h,ve as i,R as j,de as k,q as l,X as m,ye as n,_e as o,fe as p,_ as q,be as r,K as s,xe as t,J as u,W as v,L as w,B as x,H as y,w as z};

package/dist/client-binary-version-verifier-BK_vIjIo.mjs

@@ -0,0 +1,2 @@
+import*as e from"node:fs/promises";import*as t from"node:path";import{ManagedInstallDescriptorSchema as n}from"@makaio/framework/contracts/client";function r(e){if(e!==void 0)return(t,n)=>{n!==null&&n>0?e(`downloading`,t/n*100):e(`downloading`,null)}}var i=class{#e;#t;constructor(e,t){this.#e=e,this.#t=t}async execute(e,t,n){if(e!==this.#e.version)throw Error(`npm managed install requested version ${e} but descriptor pins ${this.#e.version}`);n?.(`installing`,null);let r=`${this.#e.package}@${this.#e.version}`;return await this.#t.exec(`npm`,[`install`,r,`--prefix`,t,`--no-save`,`--ignore-scripts`]),n?.(`installing`,100),{installPath:t,version:this.#e.version,strategy:`npm`}}};function a(){if(process.platform!==`linux`)return!1;try{let e=process.report?.getReport?.();if(typeof e!=`object`||!e||!(`header`in e))return!0;let{header:t}=e;return typeof t!=`object`||!t?!0:!(`glibcVersionRuntime`in t)}catch{return!1}}function o(e){return e.replace(/[^0-9a-fA-F]/g,``).toUpperCase()}function s(e,t,n,r){let i=e.replaceAll(`{version}`,t);return n!==void 0&&(i=i.replaceAll(`{platform}`,n)),r!==void 0&&(i=i.replaceAll(`{binary}`,r)),i}function c(e){let t=`${e.platform}-${e.arch}`;return e.platform===`linux`&&e.isMusl?`${t}-musl`:t}function l(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`Signed manifest must be a JSON object`);let n=e,r=n.version;if(r!==t)throw Error(`Signed manifest version ${String(r)} does not match descriptor pin ${t}`);let i=n.platforms;if(typeof i!=`object`||!i||Array.isArray(i))throw Error(`Signed manifest must contain a platforms object`);return{version:r,platforms:i}}function u(e,t){let n=e.platforms[t];if(typeof n!=`object`||!n||Array.isArray(n))throw Error(`Signed manifest does not contain a platform entry for '${t}'`);let{binary:r,checksum:i}=n;if(typeof r!=`string`||!d(r))throw Error(`Manifest entry for '${t}' has unsafe binary filename`);if(typeof i!=`string`||i.length===0)throw Error(`Manifest entry for '${t}' is missing a valid 'checksum' field`);return{binary:r,checksum:i}}function d(e){return e.length>0&&e!==`.`&&e!==`..`&&!e.includes(`/`)&&!e.includes(`\\`)}var f=class{#e;#t;#n;constructor(e,t,n){this.#e=e,this.#t=t,this.#n={platform:n?.platform??process.platform,arch:n?.arch??process.arch,isMusl:n?.isMusl??a()}}async execute(n,i,a){if(n!==this.#e.version)throw Error(`signed-binary-bucket managed install requested version ${n} but descriptor pins ${this.#e.version}`);let{config:o}=this.#e,l=c(this.#n),u=o.platforms[l];if(u===void 0)throw Error(`signed-binary-bucket descriptor has no platform entry for '${l}'. Supported platforms: ${Object.keys(o.platforms).join(`, `)}`);await e.mkdir(i,{recursive:!0});let d=t.join(i,`.gnupg`),f=t.join(i,`signing-key.asc`),p=t.join(i,`manifest.json`),m=t.join(i,`manifest.json.sig`);a?.(`resolving`,null),await this.#r(o,n,f,p,m),a?.(`verifying`,null);let h=await this.#i(o,d,f,p,m,l);a?.(`downloading`,null);let g=s(o.binaryPathTemplate,n,u,h.binary),_=t.resolve(i,h.binary);await this.#t.downloadFile(`${o.baseUrl}/${g}`,_,r(a)),a?.(`verifying`,null);let v=await this.#t.computeChecksum(_);if(v!==h.checksum)throw Error(`Binary checksum mismatch: expected ${h.checksum} but computed ${v}`);return a?.(`installing`,null),this.#n.platform!==`win32`&&await e.chmod(_,493),await this.#t.removeDirectory(d),await this.#t.deleteFile(f),await this.#t.deleteFile(m),a?.(`installing`,100),{installPath:i,version:this.#e.version,strategy:`signed-binary-bucket`}}async#r(t,n,r,i,a){let o=`${t.baseUrl}/${s(t.manifestPathTemplate,n)}`,c=`${t.baseUrl}/${s(t.manifestSignaturePathTemplate,n)}`,l=await this.#t.fetchText(t.publicKeyUrl);await e.writeFile(r,l,`utf-8`),await this.#t.downloadFile(o,i),await this.#t.downloadFile(c,a)}async#i(t,n,r,i,a,s){await e.mkdir(n,{recursive:!0,mode:448}),await this.#t.exec(`gpg`,[`--homedir`,n,`--import`,r]);let c=await this.#t.exec(`gpg`,[`--homedir`,n,`--with-colons`,`--fingerprint`,`--list-keys`]),d=this.#a(c);if(o(d)!==o(t.publicKeyFingerprint))throw Error(`GPG key fingerprint mismatch: expected ${t.publicKeyFingerprint} but got ${d}`);await this.#t.exec(`gpg`,[`--homedir`,n,`--verify`,a,i]).catch(e=>{throw Error(`Manifest GPG signature verification failed: ${e.message}`)});let f=await e.readFile(i,`utf-8`);return u(l(JSON.parse(f),this.#e.version),s)}#a(e){for(let t of e.split(`
+`)){let e=t.split(`:`);if(e[0]===`fpr`&&e[9]!==void 0&&e[9].length>0)return e[9]}throw Error(`Could not extract GPG key fingerprint from output`)}};function p(e,t){let r=n.safeParse(e);if(r.success)switch(r.data.type){case`npm`:return new i(r.data,t);case`signed-binary-bucket`:return new f(r.data,t)}}function m(e,n){let r=t.relative(e,n);return r!==``&&!r.startsWith(`..${t.sep}`)&&r!==`..`&&!t.isAbsolute(r)}async function h(n,r,i,a){let[o,...s]=i;if(_(o))throw Error(`versionCommand[0] must be a relative path; received absolute path "${o}"`);if(o.split(/[/\\]/).includes(`..`))throw Error(`versionCommand[0] must not contain path traversal segments; received "${o}"`);let c=t.normalize(o),l=t.join(r,c),u=await e.realpath(r),d=await e.realpath(l);if(!m(u,d))throw Error(`versionCommand[0] must not escape the install directory; "${o}" resolves outside installPath`);let f;try{f=await n(d,s,{cwd:u})}catch(e){let t=e instanceof Error?e.message:String(e);throw Error(`Version verification failed: command "${l}" exited with an error: ${t}`,{cause:e})}let p=g(a);if(!v(f,p))throw Error(`Version mismatch: expected "${a}" but command output was "${f.trim()}"`)}function g(e){return e[0]===`v`||e[0]===`V`?e.slice(1):e}function _(e){return e.startsWith(`/`)||/^[A-Za-z]:[/\\]/.test(e)||e.startsWith(`\\`)}function v(e,t){return(e.match(/[A-Za-z0-9][A-Za-z0-9._+-]*/g)??[]).some(e=>g(e)===t)}export{m as n,p as r,h as t};

package/dist/client-binary-version-verifier-BwrMTAh2.d.mts

@@ -0,0 +1,179 @@
+import { InstallStage, ManagedInstallDescriptor, ManagedInstallStrategy } from "@makaio/framework/contracts/client";
+
+//#region subsystems/client/src/binary-strategies/types.d.ts
+/**
+ * Progress callback invoked by a strategy as it moves through pipeline stages.
+ * @param stage - The current install pipeline stage.
+ * @param progress - Fractional progress in `[0, 100]`, or `null` when the
+ *   stage does not have deterministic progress (e.g. resolving, verifying).
+ */
+type StrategyProgressCallback = (stage: InstallStage, progress: number | null) => void;
+/**
+ * Normalized result of a successful strategy execution.
+ *
+ * Every strategy returns this shape so the `ClientBinaryManager` can handle
+ * all strategies without branching on type.
+ */
+interface InstallArtifact {
+  /**
+   * Absolute path to the installed binary's directory.
+   *
+   * For `npm`, this is the `node_modules/.bin`-accessible root.
+   * For archive strategies this is the extraction target directory.
+   */
+  installPath: string;
+  /**
+   * The exact version that was installed, as passed to {@link InstallStrategy.execute}.
+   *
+   * For `npm` this mirrors the registry semver tag. For `signed-binary-bucket`
+   * this is the version string from the descriptor.
+   */
+  version: string;
+  /** The strategy that performed the install. */
+  strategy: ManagedInstallStrategy;
+}
+/**
+ * Injected I/O dependencies for install strategy implementations.
+ *
+ * Abstracting these operations behind an interface makes every strategy
+ * testable without touching the network or file system.
+ */
+interface StrategyDependencies {
+  /**
+   * Fetch `url` and return the full response body as a string.
+   * @param url - The URL to fetch.
+   * @returns The raw response body text.
+   */
+  fetchText(url: string): Promise<string>;
+  /**
+   * Fetch `url`, parse the response body as JSON, and return it.
+   * @param url - The URL to fetch.
+   * @returns The parsed JSON value.
+   */
+  fetchJson(url: string): Promise<unknown>;
+  /**
+   * Download `url` to `destPath` on disk, optionally reporting byte progress.
+   * @param url - The URL to download.
+   * @param destPath - Absolute destination file path.
+   * @param onProgress - Optional callback; `total` is `null` when the server
+   *   does not advertise a `Content-Length`.
+   * @returns The resolved absolute destination path.
+   */
+  downloadFile(url: string, destPath: string, onProgress?: (downloaded: number, total: number | null) => void): Promise<string>;
+  /**
+   * Execute a shell command and return its stdout.
+   * @param command - The executable to run (no shell expansion).
+   * @param args - Positional arguments passed to the executable.
+   * @param options - Optional execution options. `cwd` sets the working
+   *   directory; `env` is merged on top of the parent environment when present
+   *   (when absent the parent environment is inherited unchanged).
+   * @returns Trimmed stdout string.
+   */
+  exec(command: string, args: string[], options?: {
+    cwd?: string;
+    env?: Record<string, string>;
+  }): Promise<string>;
+  /**
+   * Extract an archive file into `destDir`.
+   * @param archivePath - Absolute path to the archive file.
+   * @param destDir - Absolute directory to extract into.
+   * @param format - Archive type (`'tar.gz'` or `'zip'`).
+   */
+  extractArchive(archivePath: string, destDir: string, format: 'tar.gz' | 'zip'): Promise<void>;
+  /**
+   * Delete a single file from disk.
+   *
+   * Implementations must be idempotent — if `filePath` does not exist the call
+   * should resolve without error.
+   * @param filePath - Absolute path to the file to remove.
+   */
+  deleteFile(filePath: string): Promise<void>;
+  /**
+   * Compute the checksum of a file at `filePath`.
+   * @param filePath - Absolute path to the file to hash.
+   * @param algorithm - Hash algorithm name (defaults to `'sha256'`).
+   * @returns Lowercase hex-encoded digest string.
+   */
+  computeChecksum(filePath: string, algorithm?: string): Promise<string>;
+  /**
+   * Recursively remove a directory and all of its contents.
+   *
+   * Implementations must be idempotent — if `dirPath` does not exist the
+   * call should resolve without error. This mirrors the `force` flag of
+   * `fs.rm` from `node:fs/promises`.
+   * @param dirPath - Absolute path to the directory to remove.
+   */
+  removeDirectory(dirPath: string): Promise<void>;
+}
+/**
+ * Common interface implemented by all install strategy classes.
+ *
+ * A strategy is a pure computation unit — it has no bus, no BaseService, and
+ * no side effects beyond what is provided through {@link StrategyDependencies}.
+ * Strategies operate only on pinned versions; upstream version resolution is not
+ * part of this contract.
+ */
+interface InstallStrategy {
+  /**
+   * Execute the install pipeline for `version` into `targetDir`.
+   *
+   * The strategy is responsible for downloading, verifying (when applicable),
+   * extracting, and writing the binary into `targetDir`. The returned
+   * {@link InstallArtifact} tells the manager where the binary landed and
+   * which version was installed.
+   * @param version - The exact version to install.
+   * @param targetDir - Absolute path to the directory to install into.
+   * @param onProgress - Optional progress callback invoked at each stage.
+   * @returns A normalized install artifact describing the installed binary.
+   */
+  execute(version: string, targetDir: string, onProgress?: StrategyProgressCallback): Promise<InstallArtifact>;
+}
+//#endregion
+//#region subsystems/client/src/binary-strategies/index.d.ts
+/**
+ * Instantiate the appropriate {@link InstallStrategy} for the given descriptor.
+ *
+ * The factory validates the descriptor and then performs narrowing over the
+ * `type` discriminant so callers do not need to repeat the switch logic.
+ *
+ * Supported descriptor types:
+ * - `'npm'` → {@link NpmStrategy}
+ * - `'signed-binary-bucket'` → {@link SignedBinaryBucketStrategy}
+ * @param descriptor - The managed install descriptor from a
+ *   {@link ClientDefinition}, or an unvalidated runtime value with a `type`
+ *   field.
+ * @param deps - Injected I/O dependencies forwarded to the chosen strategy.
+ * @returns A ready-to-use {@link InstallStrategy} instance, or `undefined`
+ *   when the descriptor fails validation.
+ */
+declare function createStrategy(descriptor: ManagedInstallDescriptor, deps: StrategyDependencies): InstallStrategy | undefined;
+declare function createStrategy(descriptor: {
+  readonly type: string;
+}, deps: StrategyDependencies): InstallStrategy | undefined;
+//#endregion
+//#region subsystems/client/src/client-binary-version-verifier.d.ts
+/**
+ * Verifies that the binary installed at `installPath` reports the expected
+ * version when executed with the declared `versionCommand`.
+ *
+ * The first element of `versionCommand` is resolved relative to `installPath`.
+ * Absolute paths and any `..` segments are rejected to prevent path traversal.
+ * The binary is executed with `{ cwd: installPath }` so relative paths within
+ * the binary work as expected. Before execution, both the install directory
+ * and resolved executable are canonicalized with `realpath()` so symlinked
+ * executables cannot escape the install directory.
+ *
+ * Version strings are compared as output tokens after stripping a single
+ * leading `v`, so `v1.2.3` and `1.2.3` are equivalent but `1.2.30` does not
+ * satisfy `1.2.3`.
+ * @param exec - Exec dependency from {@link StrategyDependencies}
+ * @param installPath - Absolute directory where the binary was installed
+ * @param versionCommand - Command and arguments declared on the client definition
+ * @param expectedVersion - The version string that the binary must report
+ * @throws When the command path is absolute or contains `..`
+ * @throws When the command fails to execute
+ * @throws When the command output does not contain the expected version token
+ */
+declare function verifyInstalledVersion(exec: StrategyDependencies['exec'], installPath: string, versionCommand: readonly [string, ...string[]], expectedVersion: string): Promise<void>;
+//#endregion
+export { StrategyDependencies as a, InstallStrategy as i, createStrategy as n, InstallArtifact as r, verifyInstalledVersion as t };

package/dist/clients/index.d.mts

@@ -1,3 +1,4 @@
+import { a as StrategyDependencies, i as InstallStrategy, n as createStrategy, r as InstallArtifact, t as verifyInstalledVersion } from "../client-binary-version-verifier-BwrMTAh2.mjs";
 import * as _$zod from "zod";
 import { z } from "zod";
 import * as _$_makaio_core0 from "@makaio/framework/core";
@@ -157,82 +158,17 @@ declare class ClientAccountRegistry {
   private mergeInto;
 }
 //#endregion
-//#region subsystems/client/src/binary-strategies/types.d.ts
+//#region subsystems/client/src/client-binary-manager-types.d.ts
 /**
- * Injected I/O dependencies for install strategy implementations.
+ * Policy controlling which filesystem owns binary resolution.
  *
- * Abstracting these operations behind an interface makes every strategy
- * testable without touching the network or file system.
+ * `managed-first` is the normal host behavior: resolve the active managed
+ * install from persisted state, then fall back to the current process PATH.
+ * `global-only` is for isolated runtimes whose filesystem cannot access the
+ * host's persisted managed-install paths; those runtimes resolve only binaries
+ * available on their own PATH.
  */
-interface StrategyDependencies {
-  /**
-   * Fetch `url` and return the full response body as a string.
-   * @param url - The URL to fetch.
-   * @returns The raw response body text.
-   */
-  fetchText(url: string): Promise<string>;
-  /**
-   * Fetch `url`, parse the response body as JSON, and return it.
-   * @param url - The URL to fetch.
-   * @returns The parsed JSON value.
-   */
-  fetchJson(url: string): Promise<unknown>;
-  /**
-   * Download `url` to `destPath` on disk, optionally reporting byte progress.
-   * @param url - The URL to download.
-   * @param destPath - Absolute destination file path.
-   * @param onProgress - Optional callback; `total` is `null` when the server
-   *   does not advertise a `Content-Length`.
-   * @returns The resolved absolute destination path.
-   */
-  downloadFile(url: string, destPath: string, onProgress?: (downloaded: number, total: number | null) => void): Promise<string>;
-  /**
-   * Execute a shell command and return its stdout.
-   * @param command - The executable to run (no shell expansion).
-   * @param args - Positional arguments passed to the executable.
-   * @param options - Optional execution options. `cwd` sets the working
-   *   directory; `env` is merged on top of the parent environment when present
-   *   (when absent the parent environment is inherited unchanged).
-   * @returns Trimmed stdout string.
-   */
-  exec(command: string, args: string[], options?: {
-    cwd?: string;
-    env?: Record<string, string>;
-  }): Promise<string>;
-  /**
-   * Extract an archive file into `destDir`.
-   * @param archivePath - Absolute path to the archive file.
-   * @param destDir - Absolute directory to extract into.
-   * @param format - Archive type (`'tar.gz'` or `'zip'`).
-   */
-  extractArchive(archivePath: string, destDir: string, format: 'tar.gz' | 'zip'): Promise<void>;
-  /**
-   * Delete a single file from disk.
-   *
-   * Implementations must be idempotent — if `filePath` does not exist the call
-   * should resolve without error.
-   * @param filePath - Absolute path to the file to remove.
-   */
-  deleteFile(filePath: string): Promise<void>;
-  /**
-   * Compute the checksum of a file at `filePath`.
-   * @param filePath - Absolute path to the file to hash.
-   * @param algorithm - Hash algorithm name (defaults to `'sha256'`).
-   * @returns Lowercase hex-encoded digest string.
-   */
-  computeChecksum(filePath: string, algorithm?: string): Promise<string>;
-  /**
-   * Recursively remove a directory and all of its contents.
-   *
-   * Implementations must be idempotent — if `dirPath` does not exist the
-   * call should resolve without error. This mirrors the `force` flag of
-   * `fs.rm` from `node:fs/promises`.
-   * @param dirPath - Absolute path to the directory to remove.
-   */
-  removeDirectory(dirPath: string): Promise<void>;
-}
-//#endregion
-//#region subsystems/client/src/client-binary-manager-types.d.ts
+type ClientBinaryResolutionPolicy = 'managed-first' | 'global-only';
 /**
  * Configuration for the managed binary base directory.
  *
@@ -268,6 +204,11 @@ interface ClientBinaryManagerConfig extends ClientBinaryJobRunnerConfig {
    * the definition declares `configIsolation`.
    */
   configBasePath: string;
+  /**
+   * Filesystem ownership policy for `client.resolveBinary`.
+   * @defaultValue 'managed-first'
+   */
+  resolutionPolicy?: ClientBinaryResolutionPolicy;
 }
 /**
  * Context passed to a framework-owned post-install handler.
@@ -1219,12 +1160,14 @@ declare class ClientProfileService extends BaseService {
 //#endregion
 //#region subsystems/client/src/client-session-config-service.d.ts
 /**
- * Handles `client.sessionConfig.*` bus subjects, providing per-session config
+ * Handles `client.sessionConfig.*` bus subjects, providing leased config
  * directory isolation for client processes.
  */
 declare class ClientSessionConfigService extends BaseService {
   private readonly clientsBasePath;
   private readonly getNow;
+  private readonly liveLeasesByClient;
+  private readonly liveLeasesByOwner;
   /**
    * @param bus - Bus instance used for handler registration and storage requests
    * @param clientsBasePath - Absolute path to the top-level clients directory
@@ -1237,8 +1180,10 @@ declare class ClientSessionConfigService extends BaseService {
    * Register all `client.sessionConfig.*` handlers and run boot-time cleanup.
    */
   protected onInit(): Promise<void>;
+  /** Register the config-lease creation handler and its rollback lifecycle. */
+  private registerCreateHandler;
   /**
-   * Resolve the base configuration directory for a session.
+   * Resolve the base configuration directory for a config lease.
    *
    * Resolution order:
    * 1. Explicit `baseConfigDir` from the request payload.
@@ -1263,10 +1208,10 @@ declare class ClientSessionConfigService extends BaseService {
    */
   private cleanupOrphanedDirs;
   /**
-   * Remove every per-client config directory for a closed framework session.
-   * @param sessionId - Framework session ID from `session.closed`.
+   * Release every live config lease owned by a closed framework session.
+   * @param ownerSessionId - Framework session ID from `session.closed`.
    */
-  private destroySessionDirsForSessionId;
+  private destroyOwnedLeases;
   /**
    * Run client-owned session config teardown before removing the directory.
    * @param clientId - Canonical client identifier.
@@ -1274,19 +1219,49 @@ declare class ClientSessionConfigService extends BaseService {
    */
   private destroyClientSessionDir;
   /**
-   * Check whether a stale-looking directory belongs to a still-active session.
-   * @param sessionId - Session directory name.
-   * @returns `true` when the session registry still marks the session active.
+   * Check whether a stale-looking directory belongs to a live config lease.
+   * @param clientId - Canonical client identifier.
+   * @param leaseId - Lease directory name.
+   * @returns `true` when the service still tracks the connector lease.
+   */
+  private isLiveLease;
+  /**
+   * Get the currently registered generation for a lease coordinate.
+   * @param clientId - Canonical client identifier.
+   * @param leaseId - Connector-unique config lease ID.
+   * @returns Current lease generation, or `undefined` when none is reserved.
    */
-  private isActiveSession;
+  private getLiveLease;
   /**
    * Resolve a session directory for a canonical client ID.
    * @param clientId - Canonical client identifier.
-   * @param sessionId - Framework session ID.
+   * @param leaseId - Connector-unique config lease ID.
    * @param operation - Operation name used in error messages.
    * @returns Absolute session directory path.
    */
   private resolveClientSessionDir;
+  /**
+   * Atomically reserve a lease in both the client-primary and optional owner indexes.
+   * @param identity - Lease identity to reserve before materialization starts.
+   * @returns Newly reserved lease generation.
+   */
+  private reserveLiveLease;
+  /**
+   * Release one lease generation, waiting for in-flight creation when needed.
+   * @param lease - Exact reservation generation to release.
+   */
+  private releaseLiveLease;
+  /**
+   * Start or join the single cleanup operation for a lease generation.
+   * @param lease - Exact reservation generation whose resources must be removed.
+   * @returns Shared cleanup promise for this generation.
+   */
+  private beginLeaseCleanup;
+  /**
+   * Remove an exact lease generation from both indexes. Stale generations are a no-op.
+   * @param lease - Exact reservation generation to remove.
+   */
+  private untrackLiveLease;
   /**
    * List all client IDs that currently have a directory under `clientsBasePath`.
    * @returns Array of directory names (one per client)
@@ -1762,6 +1737,14 @@ interface ClientsCorePackageOptions {
    * When omitted no post-install handlers are registered.
    */
   readonly postInstallHandlers?: ReadonlyMap<string, PostInstallHandler>;
+  /**
+   * Filesystem ownership policy used by `client.resolveBinary`.
+   *
+   * Isolated runtimes use `global-only` so persisted host install paths are
+   * never interpreted inside a different filesystem namespace.
+   * @defaultValue 'managed-first'
+   */
+  readonly binaryResolutionPolicy?: ClientBinaryResolutionPolicy;
 }
 /**
  * Run storage handler registrations and return one cleanup that unwinds every
@@ -2190,8 +2173,8 @@ declare const RuntimeRecordSchema: z.ZodObject<{
   clientRuntimeId: z.ZodString;
   clientId: z.ZodString;
   status: z.ZodEnum<{
-    started: "started";
     observed: "observed";
+    started: "started";
   }>;
   supervisorSessionId: z.ZodOptional<z.ZodString>;
   pid: z.ZodOptional<z.ZodNumber>;
@@ -2217,8 +2200,8 @@ declare const ClientRuntimeStorageNamespace: _$_makaio_core0.BusNamespaceDefinit
       clientRuntimeId: z.ZodString;
       clientId: z.ZodString;
       status: z.ZodEnum<{
-        started: "started";
         observed: "observed";
+        started: "started";
       }>;
       supervisorSessionId: z.ZodOptional<z.ZodString>;
       pid: z.ZodOptional<z.ZodNumber>;
@@ -2243,8 +2226,8 @@ declare const ClientRuntimeStorageNamespace: _$_makaio_core0.BusNamespaceDefinit
         clientRuntimeId: z.ZodString;
         clientId: z.ZodString;
         status: z.ZodEnum<{
-          started: "started";
           observed: "observed";
+          started: "started";
         }>;
         supervisorSessionId: z.ZodOptional<z.ZodString>;
         pid: z.ZodOptional<z.ZodNumber>;
@@ -2268,8 +2251,8 @@ declare const ClientRuntimeStorageSubjects: _$_makaio_core0.BusSubjects<_$_makai
       clientRuntimeId: z.ZodString;
       clientId: z.ZodString;
       status: z.ZodEnum<{
-        started: "started";
         observed: "observed";
+        started: "started";
       }>;
       supervisorSessionId: z.ZodOptional<z.ZodString>;
       pid: z.ZodOptional<z.ZodNumber>;
@@ -2294,8 +2277,8 @@ declare const ClientRuntimeStorageSubjects: _$_makaio_core0.BusSubjects<_$_makai
         clientRuntimeId: z.ZodString;
         clientId: z.ZodString;
         status: z.ZodEnum<{
-          started: "started";
           observed: "observed";
+          started: "started";
         }>;
         supervisorSessionId: z.ZodOptional<z.ZodString>;
         pid: z.ZodOptional<z.ZodNumber>;
@@ -2694,12 +2677,13 @@ declare const clientRuntimesDual: _$_makaio_storage_drizzle0.DualTable<"client_r
  * Uses `requestOptional` so the adapter continues to function in
  * framework-only boot where no `client.resolveBinary` handler is registered.
  * In that case `undefined` is returned and callers fall back to PATH lookup.
+ * @param bus - Runtime bus that owns the client-resolution handlers.
  * @param clientId - Stable client identifier to resolve (e.g. `'claude-code'`)
  * @returns Resolved execution context (source `'managed'` or `'global'`), or
  *   `undefined` when no `client.resolveBinary` handler is registered
  *   (framework-only boot)
  */
-declare function resolveClientBinary(clientId: string): Promise<ClientExecutionContext | undefined>;
+declare function resolveClientBinary(bus: IMakaioBus, clientId: string): Promise<ClientExecutionContext | undefined>;
 //#endregion
 //#region subsystems/client/src/wiring-helpers.d.ts
 /**
@@ -2766,4 +2750,4 @@ declare function buildHookCommand(makaioCommand: string, sentinel: string, event
  */
 declare function deriveSessionEventDescriptors(clientDefinition: ClientDefinition$1): ReadonlyArray<SessionEventDescriptor>;
 //#endregion
-export { AbsolutePathSchema, type AtomicContentParser, type AtomicModifier, type AtomicModifyOutcome, BinaryNotFoundError, type BuildClientSessionBaseOpts, CLIENT_RUNTIME_STATUSES, ClientAccountRegistry, type ClientAccountUpsertResult, ClientBinaryJobRunner, ClientBinaryManager, type ClientBinaryManagerConfig, type ClientBinaryStateRecord, ClientBinaryStateRecordSchema, ClientBinaryStorageNamespace, ClientBinaryStorageSubjects, type ClientBinaryVersionRecord, ClientBinaryVersionRecordSchema, ClientBinaryVersionResolver, ClientConfigPrimeService, type ClientDefinitionLookup, ClientDefinitionRegistry, type ClientHookHandleResponse, ClientHookHandleResponseSchema, type ClientNamespaceResult, type ClientProfileRecord, ClientProfileRecordSchema, ClientProfileService, ClientProfileStorageNamespace, ClientProfileStorageSubjects, type ClientRuntimeRecord, ClientRuntimeRegistry, ClientRuntimeService, type ClientRuntimeStatus, ClientRuntimeStorageNamespace, ClientRuntimeStorageSubjects, ClientSessionConfigService, ClientSubjects, type ClientWiringAggregatedResult, ClientWiringAggregatedResultSchema, type ClientWiringApplyResponse, ClientWiringApplyResponseSchema, type ClientWiringEntry, ClientWiringEntrySchema, type ClientWiringListResponse, ClientWiringListResponseSchema, type ClientWiringListSubjectDef, type ClientWiringRemoveResponse, ClientWiringRemoveResponseSchema, type ClientWiringSubjectDefBase, type ClientsCorePackageOptions, ClientsCoreService, ClientsCoreToken, DEFAULT_HOOK_HANDLE_TIMEOUT_MS, type InstallJob, type JobCompletedCallback, type JobCompletionCallback, type JobCompletionResult, type JobProgressCallback, type PostInstallContext, type PostInstallHandler, type RawClientHookHandleSubject, type RawClientHookPayload, RawClientHookPayloadSchema, type RawClientHookReceivedSubject, type ResolvedInstallVersion, RuntimeRecordSchema, type RuntimeUpsertResult, type SessionEventDescriptor, type StrategyDependencies, assertAbsoluteProjectDir, atomicModifyFile, buildClientCommand, buildClientSessionBase, buildHookCommand, canonicalizeClientId, clientRuntimesDual, createClientNamespace, createClientWiringListSubjectDef, createClientWiringSubjectDef, createClientsCorePackage, createRawClientHookHandleSubject, createRawClientHookReceivedSubject, deriveSessionEventDescriptors, emitBestEffort, isPathWithinBase, pickNonEmptyString, pickNonEmptyStringValue, registerDrizzleClientBinaryStorage, registerDrizzleProfileStorage, registerDrizzleRuntimeStorage, registerStorageHandlersWithRollback, resolveAndValidateBasePath, resolveClientBinary };
+export { AbsolutePathSchema, type AtomicContentParser, type AtomicModifier, type AtomicModifyOutcome, BinaryNotFoundError, type BuildClientSessionBaseOpts, CLIENT_RUNTIME_STATUSES, ClientAccountRegistry, type ClientAccountUpsertResult, ClientBinaryJobRunner, ClientBinaryManager, type ClientBinaryManagerConfig, type ClientBinaryResolutionPolicy, type ClientBinaryStateRecord, ClientBinaryStateRecordSchema, ClientBinaryStorageNamespace, ClientBinaryStorageSubjects, type ClientBinaryVersionRecord, ClientBinaryVersionRecordSchema, ClientBinaryVersionResolver, ClientConfigPrimeService, type ClientDefinitionLookup, ClientDefinitionRegistry, type ClientHookHandleResponse, ClientHookHandleResponseSchema, type ClientNamespaceResult, type ClientProfileRecord, ClientProfileRecordSchema, ClientProfileService, ClientProfileStorageNamespace, ClientProfileStorageSubjects, type ClientRuntimeRecord, ClientRuntimeRegistry, ClientRuntimeService, type ClientRuntimeStatus, ClientRuntimeStorageNamespace, ClientRuntimeStorageSubjects, ClientSessionConfigService, ClientSubjects, type ClientWiringAggregatedResult, ClientWiringAggregatedResultSchema, type ClientWiringApplyResponse, ClientWiringApplyResponseSchema, type ClientWiringEntry, ClientWiringEntrySchema, type ClientWiringListResponse, ClientWiringListResponseSchema, type ClientWiringListSubjectDef, type ClientWiringRemoveResponse, ClientWiringRemoveResponseSchema, type ClientWiringSubjectDefBase, type ClientsCorePackageOptions, ClientsCoreService, ClientsCoreToken, DEFAULT_HOOK_HANDLE_TIMEOUT_MS, type InstallArtifact, type InstallJob, type InstallStrategy, type JobCompletedCallback, type JobCompletionCallback, type JobCompletionResult, type JobProgressCallback, type PostInstallContext, type PostInstallHandler, type RawClientHookHandleSubject, type RawClientHookPayload, RawClientHookPayloadSchema, type RawClientHookReceivedSubject, type ResolvedInstallVersion, RuntimeRecordSchema, type RuntimeUpsertResult, type SessionEventDescriptor, type StrategyDependencies, assertAbsoluteProjectDir, atomicModifyFile, buildClientCommand, buildClientSessionBase, buildHookCommand, canonicalizeClientId, clientRuntimesDual, createClientNamespace, createClientWiringListSubjectDef, createClientWiringSubjectDef, createClientsCorePackage, createRawClientHookHandleSubject, createRawClientHookReceivedSubject, createStrategy, deriveSessionEventDescriptors, emitBestEffort, isPathWithinBase, pickNonEmptyString, pickNonEmptyStringValue, registerDrizzleClientBinaryStorage, registerDrizzleProfileStorage, registerDrizzleRuntimeStorage, registerStorageHandlersWithRollback, resolveAndValidateBasePath, resolveClientBinary, verifyInstalledVersion };