@makaio/framework 1.0.0-dev-1783705652236 → 1.0.0-dev-1783973359164

package/dist/index-ButbwvVY.d.mts

@@ -0,0 +1,1175 @@
+import * as _$zod from "zod";
+import { z } from "zod";
+import * as _$_makaio_core0 from "@makaio/framework/core";
+import * as _$zod_v4_core0 from "zod/v4/core";
+
+//#region services/core/src/execution-target/container-schemas.d.ts
+/** Dedicated bootstrap fields that must never fall back to ambient process env. */
+declare const CONTAINER_BOOTSTRAP_PRIVATE_ENV_VARS: readonly ["MAKAIO_GIT_TOKEN", "MAKAIO_BUS_AUTH_SECRET"];
+/** JSON-safe value delivered to an adapter-owned connector auth target. */
+declare const ContainerConnectorAuthValueSchema: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>;
+type ContainerConnectorAuthValue = z.infer<typeof ContainerConnectorAuthValueSchema>;
+/** Host-minted identity and exact package graph for one session container. */
+declare const ContainerSessionRuntimeBindingSchema: z.ZodReadonly<z.ZodObject<{
+  machineId: z.ZodString;
+  packageNames: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>>;
+type ContainerSessionRuntimeBinding = z.infer<typeof ContainerSessionRuntimeBindingSchema>;
+/**
+ * Coordinates that bind one plaintext auth envelope to its intended container
+ * config-factory invocation.
+ *
+ * Inferred/native auth is deliberately absent: native client state is not
+ * portable into containers and must be rejected before the container is
+ * spawned.
+ */
+declare const ContainerAdapterAuthSelectorSchema: z.ZodReadonly<z.ZodObject<{
+  sessionId: z.ZodString;
+  adapterName: z.ZodString;
+  providerConfigId: z.ZodString;
+  definitionId: z.ZodString;
+  runtime: z.ZodReadonly<z.ZodObject<{
+    machineId: z.ZodString;
+    packageNames: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+  }, z.core.$strict>>;
+  auth: z.ZodReadonly<z.ZodObject<{
+    mode: z.ZodEnum<{
+      explicit: "explicit";
+      none: "none";
+    }>;
+    method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+      owner: z.ZodLiteral<"provider">;
+      providerDefinitionId: z.ZodString;
+      methodId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+      owner: z.ZodLiteral<"client">;
+      clientId: z.ZodString;
+      methodId: z.ZodString;
+    }, z.core.$strict>], "owner">;
+  }, z.core.$strict>>;
+}, z.core.$strict>>;
+type ContainerAdapterAuthSelector = z.infer<typeof ContainerAdapterAuthSelectorSchema>;
+/** One adapter-owned connector delivery already compiled by the trusted host. */
+declare const ContainerConnectorAuthDeliverySchema: z.ZodReadonly<z.ZodObject<{
+  target: z.ZodString;
+  values: z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>;
+}, z.core.$strict>>;
+type ContainerConnectorAuthDelivery = z.infer<typeof ContainerConnectorAuthDeliverySchema>;
+/**
+ * Host-compiled adapter authentication material for one container invocation.
+ *
+ * The trusted host compiles one selected portable method into this envelope;
+ * the container consumes it once through the adapter runtime preparer.
+ */
+declare const ContainerAdapterAuthEnvelopeSchema: z.ZodReadonly<z.ZodObject<{
+  selector: z.ZodReadonly<z.ZodObject<{
+    sessionId: z.ZodString;
+    adapterName: z.ZodString;
+    providerConfigId: z.ZodString;
+    definitionId: z.ZodString;
+    runtime: z.ZodReadonly<z.ZodObject<{
+      machineId: z.ZodString;
+      packageNames: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    auth: z.ZodReadonly<z.ZodObject<{
+      mode: z.ZodEnum<{
+        explicit: "explicit";
+        none: "none";
+      }>;
+      method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        owner: z.ZodLiteral<"provider">;
+        providerDefinitionId: z.ZodString;
+        methodId: z.ZodString;
+      }, z.core.$strict>, z.ZodObject<{
+        owner: z.ZodLiteral<"client">;
+        clientId: z.ZodString;
+        methodId: z.ZodString;
+      }, z.core.$strict>], "owner">;
+    }, z.core.$strict>>;
+  }, z.core.$strict>>;
+  scrubEnvVars: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+  processEnv: z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodString>>;
+  connectorDeliveries: z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodObject<{
+    target: z.ZodString;
+    values: z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>;
+  }, z.core.$strict>>>>;
+}, z.core.$strict>>;
+type ContainerAdapterAuthEnvelope = z.infer<typeof ContainerAdapterAuthEnvelopeSchema>;
+/**
+ * One-shot stdin bootstrap payload written by the host before the container
+ * entrypoint reads from stdin.
+ *
+ * Fields are optional because some runtime roles require only a subset of the
+ * private material. Bootstrap secrets never fall back to process environment.
+ * Adapter authentication uses only the selector-bound `adapterAuth` envelope;
+ * legacy free-form credential/provider environment maps are rejected.
+ */
+declare const ContainerBootstrapConfigSchema: z.ZodObject<{
+  busAuthSecret: z.ZodOptional<z.ZodString>;
+  relayPeer: z.ZodOptional<z.ZodObject<{
+    id: z.ZodString;
+    signingPublicKey: z.ZodString;
+  }, z.core.$strict>>;
+  relayIdentity: z.ZodOptional<z.ZodObject<{
+    id: z.ZodString;
+    signingPublicKey: z.ZodString;
+    signingPrivateKeyPem: z.ZodString;
+  }, z.core.$strict>>;
+  gitToken: z.ZodOptional<z.ZodString>;
+  runtimeEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+  sessionRuntime: z.ZodOptional<z.ZodReadonly<z.ZodObject<{
+    machineId: z.ZodString;
+    packageNames: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+  }, z.core.$strict>>>;
+  adapterAuth: z.ZodOptional<z.ZodReadonly<z.ZodObject<{
+    selector: z.ZodReadonly<z.ZodObject<{
+      sessionId: z.ZodString;
+      adapterName: z.ZodString;
+      providerConfigId: z.ZodString;
+      definitionId: z.ZodString;
+      runtime: z.ZodReadonly<z.ZodObject<{
+        machineId: z.ZodString;
+        packageNames: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+      }, z.core.$strict>>;
+      auth: z.ZodReadonly<z.ZodObject<{
+        mode: z.ZodEnum<{
+          explicit: "explicit";
+          none: "none";
+        }>;
+        method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+          owner: z.ZodLiteral<"provider">;
+          providerDefinitionId: z.ZodString;
+          methodId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+          owner: z.ZodLiteral<"client">;
+          clientId: z.ZodString;
+          methodId: z.ZodString;
+        }, z.core.$strict>], "owner">;
+      }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    scrubEnvVars: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    processEnv: z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodString>>;
+    connectorDeliveries: z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodObject<{
+      target: z.ZodString;
+      values: z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>;
+    }, z.core.$strict>>>>;
+  }, z.core.$strict>>>;
+}, z.core.$strict>;
+type ContainerBootstrapConfig = z.infer<typeof ContainerBootstrapConfigSchema>;
+/**
+ * Container runtime type.
+ */
+declare const ContainerRuntimeSchema: z.ZodEnum<{
+  full: "full";
+  simple: "simple";
+}>;
+type ContainerRuntime = z.infer<typeof ContainerRuntimeSchema>;
+/**
+ * Container state.
+ */
+declare const ContainerStateSchema: z.ZodEnum<{
+  running: "running";
+  created: "created";
+  stopped: "stopped";
+  destroyed: "destroyed";
+}>;
+type ContainerState = z.infer<typeof ContainerStateSchema>;
+/** Public Git remote that cannot carry URL credentials, query parameters, or fragments. */
+declare const CredentialFreeGitRemoteSchema: z.ZodString;
+/** Public relay endpoint limited to credential-free WebSocket transports. */
+declare const CredentialFreeRelayUrlSchema: z.ZodString;
+/**
+ * Spawn request for container-local mode.
+ */
+declare const ContainerLocalSpawnRequestSchema: z.ZodObject<{
+  sessionId: z.ZodString;
+  executionId: z.ZodOptional<z.ZodString>;
+  adapter: z.ZodString;
+  runtime: z.ZodDefault<z.ZodEnum<{
+    full: "full";
+    simple: "simple";
+  }>>;
+  image: z.ZodOptional<z.ZodString>;
+  mode: z.ZodLiteral<"container-local">;
+  repoPath: z.ZodString;
+  baseBranch: z.ZodString;
+  worktreeBranch: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+type ContainerLocalSpawnRequest = z.infer<typeof ContainerLocalSpawnRequestSchema>;
+/**
+ * Spawn request for container-isolated mode.
+ */
+declare const ContainerIsolatedSpawnRequestSchema: z.ZodObject<{
+  sessionId: z.ZodString;
+  executionId: z.ZodOptional<z.ZodString>;
+  adapter: z.ZodString;
+  runtime: z.ZodDefault<z.ZodEnum<{
+    full: "full";
+    simple: "simple";
+  }>>;
+  image: z.ZodOptional<z.ZodString>;
+  mode: z.ZodLiteral<"container-isolated">;
+  repoUrl: z.ZodString;
+  branch: z.ZodOptional<z.ZodString>;
+  busMode: z.ZodEnum<{
+    relay: "relay";
+    host: "host";
+  }>;
+  relayUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+type ContainerIsolatedSpawnRequest = z.infer<typeof ContainerIsolatedSpawnRequestSchema>;
+/**
+ * Discriminated spawn request union.
+ */
+declare const SpawnRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  sessionId: z.ZodString;
+  executionId: z.ZodOptional<z.ZodString>;
+  adapter: z.ZodString;
+  runtime: z.ZodDefault<z.ZodEnum<{
+    full: "full";
+    simple: "simple";
+  }>>;
+  image: z.ZodOptional<z.ZodString>;
+  mode: z.ZodLiteral<"container-local">;
+  repoPath: z.ZodString;
+  baseBranch: z.ZodString;
+  worktreeBranch: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+  sessionId: z.ZodString;
+  executionId: z.ZodOptional<z.ZodString>;
+  adapter: z.ZodString;
+  runtime: z.ZodDefault<z.ZodEnum<{
+    full: "full";
+    simple: "simple";
+  }>>;
+  image: z.ZodOptional<z.ZodString>;
+  mode: z.ZodLiteral<"container-isolated">;
+  repoUrl: z.ZodString;
+  branch: z.ZodOptional<z.ZodString>;
+  busMode: z.ZodEnum<{
+    relay: "relay";
+    host: "host";
+  }>;
+  relayUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>], "mode">;
+type SpawnRequest = z.infer<typeof SpawnRequestSchema>;
+/**
+ * Atomic encrypted-channel request for a descriptor plus plaintext bootstrap.
+ *
+ * This shape is channel-only at the namespace layer. Keeping it separate from
+ * {@link SpawnRequestSchema} prevents bootstrap material from entering the
+ * remotely routable Docker descriptor.
+ */
+declare const ContainerBootstrapSpawnRequestSchema: z.ZodReadonly<z.ZodObject<{
+  descriptor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    sessionId: z.ZodString;
+    executionId: z.ZodOptional<z.ZodString>;
+    adapter: z.ZodString;
+    runtime: z.ZodDefault<z.ZodEnum<{
+      full: "full";
+      simple: "simple";
+    }>>;
+    image: z.ZodOptional<z.ZodString>;
+    mode: z.ZodLiteral<"container-local">;
+    repoPath: z.ZodString;
+    baseBranch: z.ZodString;
+    worktreeBranch: z.ZodOptional<z.ZodString>;
+  }, z.core.$strict>, z.ZodObject<{
+    sessionId: z.ZodString;
+    executionId: z.ZodOptional<z.ZodString>;
+    adapter: z.ZodString;
+    runtime: z.ZodDefault<z.ZodEnum<{
+      full: "full";
+      simple: "simple";
+    }>>;
+    image: z.ZodOptional<z.ZodString>;
+    mode: z.ZodLiteral<"container-isolated">;
+    repoUrl: z.ZodString;
+    branch: z.ZodOptional<z.ZodString>;
+    busMode: z.ZodEnum<{
+      relay: "relay";
+      host: "host";
+    }>;
+    relayUrl: z.ZodOptional<z.ZodString>;
+  }, z.core.$strict>], "mode">;
+  bootstrapConfig: z.ZodObject<{
+    busAuthSecret: z.ZodOptional<z.ZodString>;
+    relayPeer: z.ZodOptional<z.ZodObject<{
+      id: z.ZodString;
+      signingPublicKey: z.ZodString;
+    }, z.core.$strict>>;
+    relayIdentity: z.ZodOptional<z.ZodObject<{
+      id: z.ZodString;
+      signingPublicKey: z.ZodString;
+      signingPrivateKeyPem: z.ZodString;
+    }, z.core.$strict>>;
+    gitToken: z.ZodOptional<z.ZodString>;
+    runtimeEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    sessionRuntime: z.ZodOptional<z.ZodReadonly<z.ZodObject<{
+      machineId: z.ZodString;
+      packageNames: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>>;
+    adapterAuth: z.ZodOptional<z.ZodReadonly<z.ZodObject<{
+      selector: z.ZodReadonly<z.ZodObject<{
+        sessionId: z.ZodString;
+        adapterName: z.ZodString;
+        providerConfigId: z.ZodString;
+        definitionId: z.ZodString;
+        runtime: z.ZodReadonly<z.ZodObject<{
+          machineId: z.ZodString;
+          packageNames: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        auth: z.ZodReadonly<z.ZodObject<{
+          mode: z.ZodEnum<{
+            explicit: "explicit";
+            none: "none";
+          }>;
+          method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            owner: z.ZodLiteral<"provider">;
+            providerDefinitionId: z.ZodString;
+            methodId: z.ZodString;
+          }, z.core.$strict>, z.ZodObject<{
+            owner: z.ZodLiteral<"client">;
+            clientId: z.ZodString;
+            methodId: z.ZodString;
+          }, z.core.$strict>], "owner">;
+        }, z.core.$strict>>;
+      }, z.core.$strict>>;
+      scrubEnvVars: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+      processEnv: z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodString>>;
+      connectorDeliveries: z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodObject<{
+        target: z.ZodString;
+        values: z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>;
+      }, z.core.$strict>>>>;
+    }, z.core.$strict>>>;
+  }, z.core.$strict>;
+}, z.core.$strict>>;
+type ContainerBootstrapSpawnRequest = z.infer<typeof ContainerBootstrapSpawnRequestSchema>;
+/**
+ * Spawn container response.
+ */
+declare const SpawnResponseSchema: z.ZodObject<{
+  containerId: z.ZodString;
+  worktreePath: z.ZodOptional<z.ZodString>;
+  worktreeBranch: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type SpawnResponse = z.infer<typeof SpawnResponseSchema>;
+/**
+ * Stop container request.
+ */
+declare const StopRequestSchema: z.ZodObject<{
+  containerId: z.ZodString;
+  deleteBranch: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+type StopRequest = z.infer<typeof StopRequestSchema>;
+/**
+ * Stop container response.
+ */
+declare const StopResponseSchema: z.ZodObject<{
+  success: z.ZodBoolean;
+}, z.core.$strip>;
+type StopResponse = z.infer<typeof StopResponseSchema>;
+/**
+ * Container status request.
+ */
+declare const StatusRequestSchema: z.ZodObject<{
+  containerId: z.ZodString;
+}, z.core.$strip>;
+type StatusRequest = z.infer<typeof StatusRequestSchema>;
+/**
+ * Container status response.
+ */
+declare const StatusResponseSchema: z.ZodObject<{
+  state: z.ZodEnum<{
+    running: "running";
+    created: "created";
+    stopped: "stopped";
+    destroyed: "destroyed";
+  }>;
+  sessionId: z.ZodString;
+  worktreePath: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type StatusResponse = z.infer<typeof StatusResponseSchema>;
+/**
+ * Container created event.
+ */
+declare const ContainerCreatedSchema: z.ZodObject<{
+  containerId: z.ZodString;
+  sessionId: z.ZodString;
+  worktreePath: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type ContainerCreated = z.infer<typeof ContainerCreatedSchema>;
+/**
+ * Container started event.
+ */
+declare const ContainerStartedSchema: z.ZodObject<{
+  containerId: z.ZodString;
+  sessionId: z.ZodString;
+  worktreePath: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type ContainerStarted = z.infer<typeof ContainerStartedSchema>;
+/**
+ * Container stopped event.
+ */
+declare const ContainerStoppedSchema: z.ZodObject<{
+  containerId: z.ZodString;
+  sessionId: z.ZodString;
+  exitCode: z.ZodNumber;
+}, z.core.$strip>;
+type ContainerStopped = z.infer<typeof ContainerStoppedSchema>;
+/**
+ * Container destroyed event.
+ */
+declare const ContainerDestroyedSchema: z.ZodObject<{
+  containerId: z.ZodString;
+  sessionId: z.ZodString;
+}, z.core.$strip>;
+type ContainerDestroyed = z.infer<typeof ContainerDestroyedSchema>;
+//#endregion
+//#region services/core/src/execution-target/container-namespace.d.ts
+/** Process-local DirectChannel endpoint used for plaintext Docker bootstrap. */
+declare const CONTAINER_BOOTSTRAP_CHANNEL_ENDPOINT = "docker-bootstrap";
+/**
+ * Canonical Docker namespace.
+ */
+declare const DockerNamespace: _$_makaio_core0.BusNamespaceDefinition<"docker", {
+  'container.spawn': {
+    request: z.ZodDiscriminatedUnion<[z.ZodObject<{
+      sessionId: z.ZodString;
+      executionId: z.ZodOptional<z.ZodString>;
+      adapter: z.ZodString;
+      runtime: z.ZodDefault<z.ZodEnum<{
+        full: "full";
+        simple: "simple";
+      }>>;
+      image: z.ZodOptional<z.ZodString>;
+      mode: z.ZodLiteral<"container-local">;
+      repoPath: z.ZodString;
+      baseBranch: z.ZodString;
+      worktreeBranch: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+      sessionId: z.ZodString;
+      executionId: z.ZodOptional<z.ZodString>;
+      adapter: z.ZodString;
+      runtime: z.ZodDefault<z.ZodEnum<{
+        full: "full";
+        simple: "simple";
+      }>>;
+      image: z.ZodOptional<z.ZodString>;
+      mode: z.ZodLiteral<"container-isolated">;
+      repoUrl: z.ZodString;
+      branch: z.ZodOptional<z.ZodString>;
+      busMode: z.ZodEnum<{
+        relay: "relay";
+        host: "host";
+      }>;
+      relayUrl: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>], "mode">;
+    response: z.ZodObject<{
+      containerId: z.ZodString;
+      worktreePath: z.ZodOptional<z.ZodString>;
+      worktreeBranch: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+  };
+  /**
+   * Atomically spawn from a public descriptor plus encrypted bootstrap data.
+   * Channel-only because the request contains resolved plaintext secrets.
+   */
+  'bootstrap.spawn': _$_makaio_core0.ChannelSubjectSchema<{
+    request: z.ZodReadonly<z.ZodObject<{
+      descriptor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        sessionId: z.ZodString;
+        executionId: z.ZodOptional<z.ZodString>;
+        adapter: z.ZodString;
+        runtime: z.ZodDefault<z.ZodEnum<{
+          full: "full";
+          simple: "simple";
+        }>>;
+        image: z.ZodOptional<z.ZodString>;
+        mode: z.ZodLiteral<"container-local">;
+        repoPath: z.ZodString;
+        baseBranch: z.ZodString;
+        worktreeBranch: z.ZodOptional<z.ZodString>;
+      }, z.core.$strict>, z.ZodObject<{
+        sessionId: z.ZodString;
+        executionId: z.ZodOptional<z.ZodString>;
+        adapter: z.ZodString;
+        runtime: z.ZodDefault<z.ZodEnum<{
+          full: "full";
+          simple: "simple";
+        }>>;
+        image: z.ZodOptional<z.ZodString>;
+        mode: z.ZodLiteral<"container-isolated">;
+        repoUrl: z.ZodString;
+        branch: z.ZodOptional<z.ZodString>;
+        busMode: z.ZodEnum<{
+          relay: "relay";
+          host: "host";
+        }>;
+        relayUrl: z.ZodOptional<z.ZodString>;
+      }, z.core.$strict>], "mode">;
+      bootstrapConfig: z.ZodObject<{
+        busAuthSecret: z.ZodOptional<z.ZodString>;
+        relayPeer: z.ZodOptional<z.ZodObject<{
+          id: z.ZodString;
+          signingPublicKey: z.ZodString;
+        }, z.core.$strict>>;
+        relayIdentity: z.ZodOptional<z.ZodObject<{
+          id: z.ZodString;
+          signingPublicKey: z.ZodString;
+          signingPrivateKeyPem: z.ZodString;
+        }, z.core.$strict>>;
+        gitToken: z.ZodOptional<z.ZodString>;
+        runtimeEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        sessionRuntime: z.ZodOptional<z.ZodReadonly<z.ZodObject<{
+          machineId: z.ZodString;
+          packageNames: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>>;
+        adapterAuth: z.ZodOptional<z.ZodReadonly<z.ZodObject<{
+          selector: z.ZodReadonly<z.ZodObject<{
+            sessionId: z.ZodString;
+            adapterName: z.ZodString;
+            providerConfigId: z.ZodString;
+            definitionId: z.ZodString;
+            runtime: z.ZodReadonly<z.ZodObject<{
+              machineId: z.ZodString;
+              packageNames: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+            auth: z.ZodReadonly<z.ZodObject<{
+              mode: z.ZodEnum<{
+                explicit: "explicit";
+                none: "none";
+              }>;
+              method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                owner: z.ZodLiteral<"provider">;
+                providerDefinitionId: z.ZodString;
+                methodId: z.ZodString;
+              }, z.core.$strict>, z.ZodObject<{
+                owner: z.ZodLiteral<"client">;
+                clientId: z.ZodString;
+                methodId: z.ZodString;
+              }, z.core.$strict>], "owner">;
+            }, z.core.$strict>>;
+          }, z.core.$strict>>;
+          scrubEnvVars: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+          processEnv: z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodString>>;
+          connectorDeliveries: z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodObject<{
+            target: z.ZodString;
+            values: z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>;
+          }, z.core.$strict>>>>;
+        }, z.core.$strict>>>;
+      }, z.core.$strict>;
+    }, z.core.$strict>>;
+    response: z.ZodObject<{
+      containerId: z.ZodString;
+      worktreePath: z.ZodOptional<z.ZodString>;
+      worktreeBranch: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+  }>; /** Return the process-local bootstrap channel bearer capability. */
+  'bootstrap.getChannelToken': _$_makaio_core0.LocalSubjectSchema<{
+    request: z.ZodObject<{}, z.core.$strip>;
+    response: z.ZodObject<{
+      token: z.ZodString;
+    }, z.core.$strip>;
+  }>;
+  'container.stop': {
+    request: z.ZodObject<{
+      containerId: z.ZodString;
+      deleteBranch: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>;
+    response: z.ZodObject<{
+      success: z.ZodBoolean;
+    }, z.core.$strip>;
+  };
+  'container.status': {
+    request: z.ZodObject<{
+      containerId: z.ZodString;
+    }, z.core.$strip>;
+    response: z.ZodObject<{
+      state: z.ZodEnum<{
+        running: "running";
+        created: "created";
+        stopped: "stopped";
+        destroyed: "destroyed";
+      }>;
+      sessionId: z.ZodString;
+      worktreePath: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+  };
+  'container.created': z.ZodObject<{
+    containerId: z.ZodString;
+    sessionId: z.ZodString;
+    worktreePath: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  'container.started': z.ZodObject<{
+    containerId: z.ZodString;
+    sessionId: z.ZodString;
+    worktreePath: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  'container.stopped': z.ZodObject<{
+    containerId: z.ZodString;
+    sessionId: z.ZodString;
+    exitCode: z.ZodNumber;
+  }, z.core.$strip>;
+  'container.destroyed': z.ZodObject<{
+    containerId: z.ZodString;
+    sessionId: z.ZodString;
+  }, z.core.$strip>;
+}>;
+/**
+ * Typed Docker subjects.
+ */
+declare const DockerSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.FlatSubjectDefinitions<"docker", {
+  'container.spawn': {
+    request: z.ZodDiscriminatedUnion<[z.ZodObject<{
+      sessionId: z.ZodString;
+      executionId: z.ZodOptional<z.ZodString>;
+      adapter: z.ZodString;
+      runtime: z.ZodDefault<z.ZodEnum<{
+        full: "full";
+        simple: "simple";
+      }>>;
+      image: z.ZodOptional<z.ZodString>;
+      mode: z.ZodLiteral<"container-local">;
+      repoPath: z.ZodString;
+      baseBranch: z.ZodString;
+      worktreeBranch: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+      sessionId: z.ZodString;
+      executionId: z.ZodOptional<z.ZodString>;
+      adapter: z.ZodString;
+      runtime: z.ZodDefault<z.ZodEnum<{
+        full: "full";
+        simple: "simple";
+      }>>;
+      image: z.ZodOptional<z.ZodString>;
+      mode: z.ZodLiteral<"container-isolated">;
+      repoUrl: z.ZodString;
+      branch: z.ZodOptional<z.ZodString>;
+      busMode: z.ZodEnum<{
+        relay: "relay";
+        host: "host";
+      }>;
+      relayUrl: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>], "mode">;
+    response: z.ZodObject<{
+      containerId: z.ZodString;
+      worktreePath: z.ZodOptional<z.ZodString>;
+      worktreeBranch: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+  };
+  /**
+   * Atomically spawn from a public descriptor plus encrypted bootstrap data.
+   * Channel-only because the request contains resolved plaintext secrets.
+   */
+  'bootstrap.spawn': _$_makaio_core0.ChannelSubjectSchema<{
+    request: z.ZodReadonly<z.ZodObject<{
+      descriptor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        sessionId: z.ZodString;
+        executionId: z.ZodOptional<z.ZodString>;
+        adapter: z.ZodString;
+        runtime: z.ZodDefault<z.ZodEnum<{
+          full: "full";
+          simple: "simple";
+        }>>;
+        image: z.ZodOptional<z.ZodString>;
+        mode: z.ZodLiteral<"container-local">;
+        repoPath: z.ZodString;
+        baseBranch: z.ZodString;
+        worktreeBranch: z.ZodOptional<z.ZodString>;
+      }, z.core.$strict>, z.ZodObject<{
+        sessionId: z.ZodString;
+        executionId: z.ZodOptional<z.ZodString>;
+        adapter: z.ZodString;
+        runtime: z.ZodDefault<z.ZodEnum<{
+          full: "full";
+          simple: "simple";
+        }>>;
+        image: z.ZodOptional<z.ZodString>;
+        mode: z.ZodLiteral<"container-isolated">;
+        repoUrl: z.ZodString;
+        branch: z.ZodOptional<z.ZodString>;
+        busMode: z.ZodEnum<{
+          relay: "relay";
+          host: "host";
+        }>;
+        relayUrl: z.ZodOptional<z.ZodString>;
+      }, z.core.$strict>], "mode">;
+      bootstrapConfig: z.ZodObject<{
+        busAuthSecret: z.ZodOptional<z.ZodString>;
+        relayPeer: z.ZodOptional<z.ZodObject<{
+          id: z.ZodString;
+          signingPublicKey: z.ZodString;
+        }, z.core.$strict>>;
+        relayIdentity: z.ZodOptional<z.ZodObject<{
+          id: z.ZodString;
+          signingPublicKey: z.ZodString;
+          signingPrivateKeyPem: z.ZodString;
+        }, z.core.$strict>>;
+        gitToken: z.ZodOptional<z.ZodString>;
+        runtimeEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        sessionRuntime: z.ZodOptional<z.ZodReadonly<z.ZodObject<{
+          machineId: z.ZodString;
+          packageNames: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>>;
+        adapterAuth: z.ZodOptional<z.ZodReadonly<z.ZodObject<{
+          selector: z.ZodReadonly<z.ZodObject<{
+            sessionId: z.ZodString;
+            adapterName: z.ZodString;
+            providerConfigId: z.ZodString;
+            definitionId: z.ZodString;
+            runtime: z.ZodReadonly<z.ZodObject<{
+              machineId: z.ZodString;
+              packageNames: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+            auth: z.ZodReadonly<z.ZodObject<{
+              mode: z.ZodEnum<{
+                explicit: "explicit";
+                none: "none";
+              }>;
+              method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                owner: z.ZodLiteral<"provider">;
+                providerDefinitionId: z.ZodString;
+                methodId: z.ZodString;
+              }, z.core.$strict>, z.ZodObject<{
+                owner: z.ZodLiteral<"client">;
+                clientId: z.ZodString;
+                methodId: z.ZodString;
+              }, z.core.$strict>], "owner">;
+            }, z.core.$strict>>;
+          }, z.core.$strict>>;
+          scrubEnvVars: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+          processEnv: z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodString>>;
+          connectorDeliveries: z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodObject<{
+            target: z.ZodString;
+            values: z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>;
+          }, z.core.$strict>>>>;
+        }, z.core.$strict>>>;
+      }, z.core.$strict>;
+    }, z.core.$strict>>;
+    response: z.ZodObject<{
+      containerId: z.ZodString;
+      worktreePath: z.ZodOptional<z.ZodString>;
+      worktreeBranch: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+  }>; /** Return the process-local bootstrap channel bearer capability. */
+  'bootstrap.getChannelToken': _$_makaio_core0.LocalSubjectSchema<{
+    request: z.ZodObject<{}, z.core.$strip>;
+    response: z.ZodObject<{
+      token: z.ZodString;
+    }, z.core.$strip>;
+  }>;
+  'container.stop': {
+    request: z.ZodObject<{
+      containerId: z.ZodString;
+      deleteBranch: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>;
+    response: z.ZodObject<{
+      success: z.ZodBoolean;
+    }, z.core.$strip>;
+  };
+  'container.status': {
+    request: z.ZodObject<{
+      containerId: z.ZodString;
+    }, z.core.$strip>;
+    response: z.ZodObject<{
+      state: z.ZodEnum<{
+        running: "running";
+        created: "created";
+        stopped: "stopped";
+        destroyed: "destroyed";
+      }>;
+      sessionId: z.ZodString;
+      worktreePath: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+  };
+  'container.created': z.ZodObject<{
+    containerId: z.ZodString;
+    sessionId: z.ZodString;
+    worktreePath: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  'container.started': z.ZodObject<{
+    containerId: z.ZodString;
+    sessionId: z.ZodString;
+    worktreePath: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  'container.stopped': z.ZodObject<{
+    containerId: z.ZodString;
+    sessionId: z.ZodString;
+    exitCode: z.ZodNumber;
+  }, z.core.$strip>;
+  'container.destroyed': z.ZodObject<{
+    containerId: z.ZodString;
+    sessionId: z.ZodString;
+  }, z.core.$strip>;
+}>, "docker">;
+//#endregion
+//#region services/core/src/execution-target/container-spawn-namespace.d.ts
+/**
+ * Backward-compatible alias for the canonical Docker namespace.
+ */
+declare const ContainerSpawnNamespace: _$_makaio_core0.BusNamespaceDefinition<"docker", {
+  'container.spawn': {
+    request: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+      sessionId: _$zod.ZodString;
+      executionId: _$zod.ZodOptional<_$zod.ZodString>;
+      adapter: _$zod.ZodString;
+      runtime: _$zod.ZodDefault<_$zod.ZodEnum<{
+        full: "full";
+        simple: "simple";
+      }>>;
+      image: _$zod.ZodOptional<_$zod.ZodString>;
+      mode: _$zod.ZodLiteral<"container-local">;
+      repoPath: _$zod.ZodString;
+      baseBranch: _$zod.ZodString;
+      worktreeBranch: _$zod.ZodOptional<_$zod.ZodString>;
+    }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+      sessionId: _$zod.ZodString;
+      executionId: _$zod.ZodOptional<_$zod.ZodString>;
+      adapter: _$zod.ZodString;
+      runtime: _$zod.ZodDefault<_$zod.ZodEnum<{
+        full: "full";
+        simple: "simple";
+      }>>;
+      image: _$zod.ZodOptional<_$zod.ZodString>;
+      mode: _$zod.ZodLiteral<"container-isolated">;
+      repoUrl: _$zod.ZodString;
+      branch: _$zod.ZodOptional<_$zod.ZodString>;
+      busMode: _$zod.ZodEnum<{
+        relay: "relay";
+        host: "host";
+      }>;
+      relayUrl: _$zod.ZodOptional<_$zod.ZodString>;
+    }, _$zod_v4_core0.$strict>], "mode">;
+    response: _$zod.ZodObject<{
+      containerId: _$zod.ZodString;
+      worktreePath: _$zod.ZodOptional<_$zod.ZodString>;
+      worktreeBranch: _$zod.ZodOptional<_$zod.ZodString>;
+    }, _$zod_v4_core0.$strip>;
+  };
+  'bootstrap.spawn': _$_makaio_core0.ChannelSubjectSchema<{
+    request: _$zod.ZodReadonly<_$zod.ZodObject<{
+      descriptor: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+        sessionId: _$zod.ZodString;
+        executionId: _$zod.ZodOptional<_$zod.ZodString>;
+        adapter: _$zod.ZodString;
+        runtime: _$zod.ZodDefault<_$zod.ZodEnum<{
+          full: "full";
+          simple: "simple";
+        }>>;
+        image: _$zod.ZodOptional<_$zod.ZodString>;
+        mode: _$zod.ZodLiteral<"container-local">;
+        repoPath: _$zod.ZodString;
+        baseBranch: _$zod.ZodString;
+        worktreeBranch: _$zod.ZodOptional<_$zod.ZodString>;
+      }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+        sessionId: _$zod.ZodString;
+        executionId: _$zod.ZodOptional<_$zod.ZodString>;
+        adapter: _$zod.ZodString;
+        runtime: _$zod.ZodDefault<_$zod.ZodEnum<{
+          full: "full";
+          simple: "simple";
+        }>>;
+        image: _$zod.ZodOptional<_$zod.ZodString>;
+        mode: _$zod.ZodLiteral<"container-isolated">;
+        repoUrl: _$zod.ZodString;
+        branch: _$zod.ZodOptional<_$zod.ZodString>;
+        busMode: _$zod.ZodEnum<{
+          relay: "relay";
+          host: "host";
+        }>;
+        relayUrl: _$zod.ZodOptional<_$zod.ZodString>;
+      }, _$zod_v4_core0.$strict>], "mode">;
+      bootstrapConfig: _$zod.ZodObject<{
+        busAuthSecret: _$zod.ZodOptional<_$zod.ZodString>;
+        relayPeer: _$zod.ZodOptional<_$zod.ZodObject<{
+          id: _$zod.ZodString;
+          signingPublicKey: _$zod.ZodString;
+        }, _$zod_v4_core0.$strict>>;
+        relayIdentity: _$zod.ZodOptional<_$zod.ZodObject<{
+          id: _$zod.ZodString;
+          signingPublicKey: _$zod.ZodString;
+          signingPrivateKeyPem: _$zod.ZodString;
+        }, _$zod_v4_core0.$strict>>;
+        gitToken: _$zod.ZodOptional<_$zod.ZodString>;
+        runtimeEnv: _$zod.ZodOptional<_$zod.ZodRecord<_$zod.ZodString, _$zod.ZodString>>;
+        sessionRuntime: _$zod.ZodOptional<_$zod.ZodReadonly<_$zod.ZodObject<{
+          machineId: _$zod.ZodString;
+          packageNames: _$zod.ZodReadonly<_$zod.ZodArray<_$zod.ZodString>>;
+        }, _$zod_v4_core0.$strict>>>;
+        adapterAuth: _$zod.ZodOptional<_$zod.ZodReadonly<_$zod.ZodObject<{
+          selector: _$zod.ZodReadonly<_$zod.ZodObject<{
+            sessionId: _$zod.ZodString;
+            adapterName: _$zod.ZodString;
+            providerConfigId: _$zod.ZodString;
+            definitionId: _$zod.ZodString;
+            runtime: _$zod.ZodReadonly<_$zod.ZodObject<{
+              machineId: _$zod.ZodString;
+              packageNames: _$zod.ZodReadonly<_$zod.ZodArray<_$zod.ZodString>>;
+            }, _$zod_v4_core0.$strict>>;
+            auth: _$zod.ZodReadonly<_$zod.ZodObject<{
+              mode: _$zod.ZodEnum<{
+                explicit: "explicit";
+                none: "none";
+              }>;
+              method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+                owner: _$zod.ZodLiteral<"provider">;
+                providerDefinitionId: _$zod.ZodString;
+                methodId: _$zod.ZodString;
+              }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+                owner: _$zod.ZodLiteral<"client">;
+                clientId: _$zod.ZodString;
+                methodId: _$zod.ZodString;
+              }, _$zod_v4_core0.$strict>], "owner">;
+            }, _$zod_v4_core0.$strict>>;
+          }, _$zod_v4_core0.$strict>>;
+          scrubEnvVars: _$zod.ZodReadonly<_$zod.ZodArray<_$zod.ZodString>>;
+          processEnv: _$zod.ZodReadonly<_$zod.ZodRecord<_$zod.ZodString, _$zod.ZodString>>;
+          connectorDeliveries: _$zod.ZodReadonly<_$zod.ZodArray<_$zod.ZodReadonly<_$zod.ZodObject<{
+            target: _$zod.ZodString;
+            values: _$zod.ZodReadonly<_$zod.ZodRecord<_$zod.ZodString, _$zod.ZodUnion<readonly [_$zod.ZodString, _$zod.ZodNumber, _$zod.ZodBoolean, _$zod.ZodNull]>>>;
+          }, _$zod_v4_core0.$strict>>>>;
+        }, _$zod_v4_core0.$strict>>>;
+      }, _$zod_v4_core0.$strict>;
+    }, _$zod_v4_core0.$strict>>;
+    response: _$zod.ZodObject<{
+      containerId: _$zod.ZodString;
+      worktreePath: _$zod.ZodOptional<_$zod.ZodString>;
+      worktreeBranch: _$zod.ZodOptional<_$zod.ZodString>;
+    }, _$zod_v4_core0.$strip>;
+  }>;
+  'bootstrap.getChannelToken': _$_makaio_core0.LocalSubjectSchema<{
+    request: _$zod.ZodObject<{}, _$zod_v4_core0.$strip>;
+    response: _$zod.ZodObject<{
+      token: _$zod.ZodString;
+    }, _$zod_v4_core0.$strip>;
+  }>;
+  'container.stop': {
+    request: _$zod.ZodObject<{
+      containerId: _$zod.ZodString;
+      deleteBranch: _$zod.ZodDefault<_$zod.ZodBoolean>;
+    }, _$zod_v4_core0.$strip>;
+    response: _$zod.ZodObject<{
+      success: _$zod.ZodBoolean;
+    }, _$zod_v4_core0.$strip>;
+  };
+  'container.status': {
+    request: _$zod.ZodObject<{
+      containerId: _$zod.ZodString;
+    }, _$zod_v4_core0.$strip>;
+    response: _$zod.ZodObject<{
+      state: _$zod.ZodEnum<{
+        running: "running";
+        created: "created";
+        stopped: "stopped";
+        destroyed: "destroyed";
+      }>;
+      sessionId: _$zod.ZodString;
+      worktreePath: _$zod.ZodOptional<_$zod.ZodString>;
+    }, _$zod_v4_core0.$strip>;
+  };
+  'container.created': _$zod.ZodObject<{
+    containerId: _$zod.ZodString;
+    sessionId: _$zod.ZodString;
+    worktreePath: _$zod.ZodOptional<_$zod.ZodString>;
+  }, _$zod_v4_core0.$strip>;
+  'container.started': _$zod.ZodObject<{
+    containerId: _$zod.ZodString;
+    sessionId: _$zod.ZodString;
+    worktreePath: _$zod.ZodOptional<_$zod.ZodString>;
+  }, _$zod_v4_core0.$strip>;
+  'container.stopped': _$zod.ZodObject<{
+    containerId: _$zod.ZodString;
+    sessionId: _$zod.ZodString;
+    exitCode: _$zod.ZodNumber;
+  }, _$zod_v4_core0.$strip>;
+  'container.destroyed': _$zod.ZodObject<{
+    containerId: _$zod.ZodString;
+    sessionId: _$zod.ZodString;
+  }, _$zod_v4_core0.$strip>;
+}>;
+/**
+ * Backward-compatible alias for the canonical Docker subjects.
+ */
+declare const ContainerSpawnSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.FlatSubjectDefinitions<"docker", {
+  'container.spawn': {
+    request: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+      sessionId: _$zod.ZodString;
+      executionId: _$zod.ZodOptional<_$zod.ZodString>;
+      adapter: _$zod.ZodString;
+      runtime: _$zod.ZodDefault<_$zod.ZodEnum<{
+        full: "full";
+        simple: "simple";
+      }>>;
+      image: _$zod.ZodOptional<_$zod.ZodString>;
+      mode: _$zod.ZodLiteral<"container-local">;
+      repoPath: _$zod.ZodString;
+      baseBranch: _$zod.ZodString;
+      worktreeBranch: _$zod.ZodOptional<_$zod.ZodString>;
+    }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+      sessionId: _$zod.ZodString;
+      executionId: _$zod.ZodOptional<_$zod.ZodString>;
+      adapter: _$zod.ZodString;
+      runtime: _$zod.ZodDefault<_$zod.ZodEnum<{
+        full: "full";
+        simple: "simple";
+      }>>;
+      image: _$zod.ZodOptional<_$zod.ZodString>;
+      mode: _$zod.ZodLiteral<"container-isolated">;
+      repoUrl: _$zod.ZodString;
+      branch: _$zod.ZodOptional<_$zod.ZodString>;
+      busMode: _$zod.ZodEnum<{
+        relay: "relay";
+        host: "host";
+      }>;
+      relayUrl: _$zod.ZodOptional<_$zod.ZodString>;
+    }, _$zod_v4_core0.$strict>], "mode">;
+    response: _$zod.ZodObject<{
+      containerId: _$zod.ZodString;
+      worktreePath: _$zod.ZodOptional<_$zod.ZodString>;
+      worktreeBranch: _$zod.ZodOptional<_$zod.ZodString>;
+    }, _$zod_v4_core0.$strip>;
+  };
+  'bootstrap.spawn': _$_makaio_core0.ChannelSubjectSchema<{
+    request: _$zod.ZodReadonly<_$zod.ZodObject<{
+      descriptor: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+        sessionId: _$zod.ZodString;
+        executionId: _$zod.ZodOptional<_$zod.ZodString>;
+        adapter: _$zod.ZodString;
+        runtime: _$zod.ZodDefault<_$zod.ZodEnum<{
+          full: "full";
+          simple: "simple";
+        }>>;
+        image: _$zod.ZodOptional<_$zod.ZodString>;
+        mode: _$zod.ZodLiteral<"container-local">;
+        repoPath: _$zod.ZodString;
+        baseBranch: _$zod.ZodString;
+        worktreeBranch: _$zod.ZodOptional<_$zod.ZodString>;
+      }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+        sessionId: _$zod.ZodString;
+        executionId: _$zod.ZodOptional<_$zod.ZodString>;
+        adapter: _$zod.ZodString;
+        runtime: _$zod.ZodDefault<_$zod.ZodEnum<{
+          full: "full";
+          simple: "simple";
+        }>>;
+        image: _$zod.ZodOptional<_$zod.ZodString>;
+        mode: _$zod.ZodLiteral<"container-isolated">;
+        repoUrl: _$zod.ZodString;
+        branch: _$zod.ZodOptional<_$zod.ZodString>;
+        busMode: _$zod.ZodEnum<{
+          relay: "relay";
+          host: "host";
+        }>;
+        relayUrl: _$zod.ZodOptional<_$zod.ZodString>;
+      }, _$zod_v4_core0.$strict>], "mode">;
+      bootstrapConfig: _$zod.ZodObject<{
+        busAuthSecret: _$zod.ZodOptional<_$zod.ZodString>;
+        relayPeer: _$zod.ZodOptional<_$zod.ZodObject<{
+          id: _$zod.ZodString;
+          signingPublicKey: _$zod.ZodString;
+        }, _$zod_v4_core0.$strict>>;
+        relayIdentity: _$zod.ZodOptional<_$zod.ZodObject<{
+          id: _$zod.ZodString;
+          signingPublicKey: _$zod.ZodString;
+          signingPrivateKeyPem: _$zod.ZodString;
+        }, _$zod_v4_core0.$strict>>;
+        gitToken: _$zod.ZodOptional<_$zod.ZodString>;
+        runtimeEnv: _$zod.ZodOptional<_$zod.ZodRecord<_$zod.ZodString, _$zod.ZodString>>;
+        sessionRuntime: _$zod.ZodOptional<_$zod.ZodReadonly<_$zod.ZodObject<{
+          machineId: _$zod.ZodString;
+          packageNames: _$zod.ZodReadonly<_$zod.ZodArray<_$zod.ZodString>>;
+        }, _$zod_v4_core0.$strict>>>;
+        adapterAuth: _$zod.ZodOptional<_$zod.ZodReadonly<_$zod.ZodObject<{
+          selector: _$zod.ZodReadonly<_$zod.ZodObject<{
+            sessionId: _$zod.ZodString;
+            adapterName: _$zod.ZodString;
+            providerConfigId: _$zod.ZodString;
+            definitionId: _$zod.ZodString;
+            runtime: _$zod.ZodReadonly<_$zod.ZodObject<{
+              machineId: _$zod.ZodString;
+              packageNames: _$zod.ZodReadonly<_$zod.ZodArray<_$zod.ZodString>>;
+            }, _$zod_v4_core0.$strict>>;
+            auth: _$zod.ZodReadonly<_$zod.ZodObject<{
+              mode: _$zod.ZodEnum<{
+                explicit: "explicit";
+                none: "none";
+              }>;
+              method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+                owner: _$zod.ZodLiteral<"provider">;
+                providerDefinitionId: _$zod.ZodString;
+                methodId: _$zod.ZodString;
+              }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+                owner: _$zod.ZodLiteral<"client">;
+                clientId: _$zod.ZodString;
+                methodId: _$zod.ZodString;
+              }, _$zod_v4_core0.$strict>], "owner">;
+            }, _$zod_v4_core0.$strict>>;
+          }, _$zod_v4_core0.$strict>>;
+          scrubEnvVars: _$zod.ZodReadonly<_$zod.ZodArray<_$zod.ZodString>>;
+          processEnv: _$zod.ZodReadonly<_$zod.ZodRecord<_$zod.ZodString, _$zod.ZodString>>;
+          connectorDeliveries: _$zod.ZodReadonly<_$zod.ZodArray<_$zod.ZodReadonly<_$zod.ZodObject<{
+            target: _$zod.ZodString;
+            values: _$zod.ZodReadonly<_$zod.ZodRecord<_$zod.ZodString, _$zod.ZodUnion<readonly [_$zod.ZodString, _$zod.ZodNumber, _$zod.ZodBoolean, _$zod.ZodNull]>>>;
+          }, _$zod_v4_core0.$strict>>>>;
+        }, _$zod_v4_core0.$strict>>>;
+      }, _$zod_v4_core0.$strict>;
+    }, _$zod_v4_core0.$strict>>;
+    response: _$zod.ZodObject<{
+      containerId: _$zod.ZodString;
+      worktreePath: _$zod.ZodOptional<_$zod.ZodString>;
+      worktreeBranch: _$zod.ZodOptional<_$zod.ZodString>;
+    }, _$zod_v4_core0.$strip>;
+  }>;
+  'bootstrap.getChannelToken': _$_makaio_core0.LocalSubjectSchema<{
+    request: _$zod.ZodObject<{}, _$zod_v4_core0.$strip>;
+    response: _$zod.ZodObject<{
+      token: _$zod.ZodString;
+    }, _$zod_v4_core0.$strip>;
+  }>;
+  'container.stop': {
+    request: _$zod.ZodObject<{
+      containerId: _$zod.ZodString;
+      deleteBranch: _$zod.ZodDefault<_$zod.ZodBoolean>;
+    }, _$zod_v4_core0.$strip>;
+    response: _$zod.ZodObject<{
+      success: _$zod.ZodBoolean;
+    }, _$zod_v4_core0.$strip>;
+  };
+  'container.status': {
+    request: _$zod.ZodObject<{
+      containerId: _$zod.ZodString;
+    }, _$zod_v4_core0.$strip>;
+    response: _$zod.ZodObject<{
+      state: _$zod.ZodEnum<{
+        running: "running";
+        created: "created";
+        stopped: "stopped";
+        destroyed: "destroyed";
+      }>;
+      sessionId: _$zod.ZodString;
+      worktreePath: _$zod.ZodOptional<_$zod.ZodString>;
+    }, _$zod_v4_core0.$strip>;
+  };
+  'container.created': _$zod.ZodObject<{
+    containerId: _$zod.ZodString;
+    sessionId: _$zod.ZodString;
+    worktreePath: _$zod.ZodOptional<_$zod.ZodString>;
+  }, _$zod_v4_core0.$strip>;
+  'container.started': _$zod.ZodObject<{
+    containerId: _$zod.ZodString;
+    sessionId: _$zod.ZodString;
+    worktreePath: _$zod.ZodOptional<_$zod.ZodString>;
+  }, _$zod_v4_core0.$strip>;
+  'container.stopped': _$zod.ZodObject<{
+    containerId: _$zod.ZodString;
+    sessionId: _$zod.ZodString;
+    exitCode: _$zod.ZodNumber;
+  }, _$zod_v4_core0.$strip>;
+  'container.destroyed': _$zod.ZodObject<{
+    containerId: _$zod.ZodString;
+    sessionId: _$zod.ZodString;
+  }, _$zod_v4_core0.$strip>;
+}>, "docker">;
+//#endregion
+export { ContainerSessionRuntimeBindingSchema as A, SpawnRequestSchema as B, ContainerIsolatedSpawnRequest as C, ContainerRuntime as D, ContainerLocalSpawnRequestSchema as E, ContainerStopped as F, StatusResponse as G, SpawnResponseSchema as H, ContainerStoppedSchema as I, StopRequestSchema as J, StatusResponseSchema as K, CredentialFreeGitRemoteSchema as L, ContainerStartedSchema as M, ContainerState as N, ContainerRuntimeSchema as O, ContainerStateSchema as P, CredentialFreeRelayUrlSchema as R, ContainerDestroyedSchema as S, ContainerLocalSpawnRequest as T, StatusRequest as U, SpawnResponse as V, StatusRequestSchema as W, StopResponseSchema as X, StopResponse as Y, ContainerConnectorAuthValue as _, DockerSubjects as a, ContainerCreatedSchema as b, ContainerAdapterAuthEnvelopeSchema as c, ContainerBootstrapConfig as d, ContainerBootstrapConfigSchema as f, ContainerConnectorAuthDeliverySchema as g, ContainerConnectorAuthDelivery as h, DockerNamespace as i, ContainerStarted as j, ContainerSessionRuntimeBinding as k, ContainerAdapterAuthSelector as l, ContainerBootstrapSpawnRequestSchema as m, ContainerSpawnSubjects as n, CONTAINER_BOOTSTRAP_PRIVATE_ENV_VARS as o, ContainerBootstrapSpawnRequest as p, StopRequest as q, CONTAINER_BOOTSTRAP_CHANNEL_ENDPOINT as r, ContainerAdapterAuthEnvelope as s, ContainerSpawnNamespace as t, ContainerAdapterAuthSelectorSchema as u, ContainerConnectorAuthValueSchema as v, ContainerIsolatedSpawnRequestSchema as w, ContainerDestroyed as x, ContainerCreated as y, SpawnRequest as z };