@makaio/framework 1.0.0-dev-1783705652236 → 1.0.0-dev-1783973359164

package/dist/index-BxuiHVFi.d.mts

@@ -0,0 +1,284 @@
+import { t as AdapterAuthBinding } from "./adapter-binding-DDUyv1JK.mjs";
+import { z } from "zod";
+
+//#region core/contracts/src/auth/definitions.d.ts
+/**
+ * Portable identifier used as an own-property key in authentication field maps.
+ *
+ * Prototype-mutating property names are rejected even when a specific consumer
+ * currently constructs null-prototype records. Keeping the restriction in the
+ * contract prevents a later plain-object consumer from changing field meaning.
+ */
+declare const AuthFieldIdSchema: z.ZodString;
+/**
+ * Environment variable name accepted by authentication declarations.
+ *
+ * The contract intentionally models portable process-environment identifiers,
+ * not shell expressions or assignments.
+ */
+declare const AuthEnvironmentVariableNameSchema: z.ZodString;
+/** Environment-variable source hint for an explicit credential field. */
+declare const AuthCredentialSourceHintSchema: z.ZodObject<{
+  kind: z.ZodLiteral<"environment">;
+  variable: z.ZodString;
+}, z.core.$strict>;
+/** Static declaration of one credential field required by an auth method. */
+declare const AuthCredentialFieldDefinitionSchema: z.ZodObject<{
+  id: z.ZodString;
+  label: z.ZodString;
+  description: z.ZodOptional<z.ZodString>;
+  required: z.ZodBoolean;
+  secret: z.ZodBoolean;
+  sourceHints: z.ZodArray<z.ZodObject<{
+    kind: z.ZodLiteral<"environment">;
+    variable: z.ZodString;
+  }, z.core.$strict>>;
+}, z.core.$strict>;
+/** Authentication method whose credential values must be resolved explicitly. */
+declare const ExplicitAuthMethodDefinitionSchema: z.ZodObject<{
+  id: z.ZodString;
+  mode: z.ZodLiteral<"explicit">;
+  label: z.ZodString;
+  description: z.ZodOptional<z.ZodString>;
+  fields: z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    required: z.ZodBoolean;
+    secret: z.ZodBoolean;
+    sourceHints: z.ZodArray<z.ZodObject<{
+      kind: z.ZodLiteral<"environment">;
+      variable: z.ZodString;
+    }, z.core.$strict>>;
+  }, z.core.$strict>>;
+}, z.core.$strict>;
+/** Authentication method backed by a native client's persisted auth state. */
+declare const InferredAuthMethodDefinitionSchema: z.ZodObject<{
+  id: z.ZodString;
+  mode: z.ZodLiteral<"inferred">;
+  label: z.ZodString;
+  description: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** Explicit declaration that a provider/client path requires no authentication. */
+declare const NoAuthMethodDefinitionSchema: z.ZodObject<{
+  id: z.ZodString;
+  mode: z.ZodLiteral<"none">;
+  label: z.ZodString;
+  description: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** Provider-owned auth methods are explicit or deliberately unauthenticated. */
+declare const ProviderAuthMethodDefinitionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  id: z.ZodString;
+  mode: z.ZodLiteral<"explicit">;
+  label: z.ZodString;
+  description: z.ZodOptional<z.ZodString>;
+  fields: z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    required: z.ZodBoolean;
+    secret: z.ZodBoolean;
+    sourceHints: z.ZodArray<z.ZodObject<{
+      kind: z.ZodLiteral<"environment">;
+      variable: z.ZodString;
+    }, z.core.$strict>>;
+  }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+  id: z.ZodString;
+  mode: z.ZodLiteral<"none">;
+  label: z.ZodString;
+  description: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>], "mode">;
+/** Client-owned auth methods may additionally use native inferred auth. */
+declare const ClientAuthMethodDefinitionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  id: z.ZodString;
+  mode: z.ZodLiteral<"explicit">;
+  label: z.ZodString;
+  description: z.ZodOptional<z.ZodString>;
+  fields: z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    required: z.ZodBoolean;
+    secret: z.ZodBoolean;
+    sourceHints: z.ZodArray<z.ZodObject<{
+      kind: z.ZodLiteral<"environment">;
+      variable: z.ZodString;
+    }, z.core.$strict>>;
+  }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+  id: z.ZodString;
+  mode: z.ZodLiteral<"inferred">;
+  label: z.ZodString;
+  description: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+  id: z.ZodString;
+  mode: z.ZodLiteral<"none">;
+  label: z.ZodString;
+  description: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>], "mode">;
+/** Unique provider-owned auth method declarations. */
+declare const ProviderAuthMethodsSchema: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+  id: z.ZodString;
+  mode: z.ZodLiteral<"explicit">;
+  label: z.ZodString;
+  description: z.ZodOptional<z.ZodString>;
+  fields: z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    required: z.ZodBoolean;
+    secret: z.ZodBoolean;
+    sourceHints: z.ZodArray<z.ZodObject<{
+      kind: z.ZodLiteral<"environment">;
+      variable: z.ZodString;
+    }, z.core.$strict>>;
+  }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+  id: z.ZodString;
+  mode: z.ZodLiteral<"none">;
+  label: z.ZodString;
+  description: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>], "mode">>;
+/** Unique client-owned auth method declarations. */
+declare const ClientAuthMethodsSchema: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+  id: z.ZodString;
+  mode: z.ZodLiteral<"explicit">;
+  label: z.ZodString;
+  description: z.ZodOptional<z.ZodString>;
+  fields: z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    required: z.ZodBoolean;
+    secret: z.ZodBoolean;
+    sourceHints: z.ZodArray<z.ZodObject<{
+      kind: z.ZodLiteral<"environment">;
+      variable: z.ZodString;
+    }, z.core.$strict>>;
+  }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+  id: z.ZodString;
+  mode: z.ZodLiteral<"inferred">;
+  label: z.ZodString;
+  description: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+  id: z.ZodString;
+  mode: z.ZodLiteral<"none">;
+  label: z.ZodString;
+  description: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>], "mode">>;
+/** Default native-auth selection declared by a client definition. */
+declare const ClientDefaultAuthSchema: z.ZodObject<{
+  providerDefinitionId: z.ZodString;
+  methodId: z.ZodString;
+}, z.core.$strict>;
+type AuthEnvironmentVariableName = z.infer<typeof AuthEnvironmentVariableNameSchema>;
+type AuthFieldId = z.infer<typeof AuthFieldIdSchema>;
+type AuthCredentialSourceHint = z.infer<typeof AuthCredentialSourceHintSchema>;
+type AuthCredentialFieldDefinition = z.infer<typeof AuthCredentialFieldDefinitionSchema>;
+type ExplicitAuthMethodDefinition = z.infer<typeof ExplicitAuthMethodDefinitionSchema>;
+type InferredAuthMethodDefinition = z.infer<typeof InferredAuthMethodDefinitionSchema>;
+type NoAuthMethodDefinition = z.infer<typeof NoAuthMethodDefinitionSchema>;
+type ProviderAuthMethodDefinition = z.infer<typeof ProviderAuthMethodDefinitionSchema>;
+type ClientAuthMethodDefinition = z.infer<typeof ClientAuthMethodDefinitionSchema>;
+type ClientDefaultAuth = z.infer<typeof ClientDefaultAuthSchema>;
+//#endregion
+//#region core/contracts/src/auth/resolved.d.ts
+/**
+ * Provider authentication after the selected static method has been resolved.
+ * Plaintext values are deliberately absent; explicit credentials remain refs.
+ */
+declare const ResolvedProviderAuthSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  mode: z.ZodLiteral<"explicit">;
+  method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    owner: z.ZodLiteral<"provider">;
+    providerDefinitionId: z.ZodString;
+    methodId: z.ZodString;
+  }, z.core.$strict>, z.ZodObject<{
+    owner: z.ZodLiteral<"client">;
+    clientId: z.ZodString;
+    methodId: z.ZodString;
+  }, z.core.$strict>], "owner">;
+  definition: z.ZodObject<{
+    id: z.ZodString;
+    mode: z.ZodLiteral<"explicit">;
+    label: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    fields: z.ZodArray<z.ZodObject<{
+      id: z.ZodString;
+      label: z.ZodString;
+      description: z.ZodOptional<z.ZodString>;
+      required: z.ZodBoolean;
+      secret: z.ZodBoolean;
+      sourceHints: z.ZodArray<z.ZodObject<{
+        kind: z.ZodLiteral<"environment">;
+        variable: z.ZodString;
+      }, z.core.$strict>>;
+    }, z.core.$strict>>;
+  }, z.core.$strict>;
+  credentialRefs: z.ZodRecord<z.ZodString, z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">>;
+}, z.core.$strict>, z.ZodObject<{
+  mode: z.ZodLiteral<"inferred">;
+  method: z.ZodObject<{
+    owner: z.ZodLiteral<"client">;
+    clientId: z.ZodString;
+    methodId: z.ZodString;
+  }, z.core.$strict>;
+  definition: z.ZodObject<{
+    id: z.ZodString;
+    mode: z.ZodLiteral<"inferred">;
+    label: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+  }, z.core.$strict>;
+  account: z.ZodOptional<z.ZodObject<{
+    managerId: z.ZodString;
+    accountId: z.ZodString;
+  }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+  mode: z.ZodLiteral<"none">;
+  method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    owner: z.ZodLiteral<"provider">;
+    providerDefinitionId: z.ZodString;
+    methodId: z.ZodString;
+  }, z.core.$strict>, z.ZodObject<{
+    owner: z.ZodLiteral<"client">;
+    clientId: z.ZodString;
+    methodId: z.ZodString;
+  }, z.core.$strict>], "owner">;
+  definition: z.ZodObject<{
+    id: z.ZodString;
+    mode: z.ZodLiteral<"none">;
+    label: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+  }, z.core.$strict>;
+}, z.core.$strict>], "mode">;
+type ResolvedProviderAuth = z.infer<typeof ResolvedProviderAuthSchema>;
+//#endregion
+//#region core/contracts/src/auth/binding-validation.d.ts
+/** Credential-field subset required for delivery-semantic validation. */
+interface AdapterAuthBindingCredentialFieldDefinition {
+  readonly id: string;
+  readonly required: boolean;
+}
+/** Static auth method accepted by adapter binding validation. */
+type AdapterAuthBindingMethodDefinition = {
+  readonly id: string;
+  readonly mode: 'explicit';
+  readonly fields: readonly AdapterAuthBindingCredentialFieldDefinition[];
+} | {
+  readonly id: string;
+  readonly mode: 'inferred' | 'none';
+};
+/**
+ * Assert that one adapter binding can faithfully deliver one static auth method.
+ *
+ * This is the single semantic validator shared by contribution discovery, UI
+ * compatibility reads, and Adapter Core. Structural Zod parsing remains the
+ * responsibility of the surrounding declaration contract.
+ * @param binding - Structurally valid adapter delivery binding.
+ * @param method - Authoritative provider/client auth method definition.
+ */
+declare function assertAdapterAuthBindingMatchesMethod(binding: AdapterAuthBinding, method: AdapterAuthBindingMethodDefinition): void;
+//#endregion
+export { NoAuthMethodDefinitionSchema as C, ProviderAuthMethodsSchema as E, NoAuthMethodDefinition as S, ProviderAuthMethodDefinitionSchema as T, ClientDefaultAuthSchema as _, AuthCredentialFieldDefinition as a, InferredAuthMethodDefinition as b, AuthCredentialSourceHintSchema as c, AuthFieldId as d, AuthFieldIdSchema as f, ClientDefaultAuth as g, ClientAuthMethodsSchema as h, ResolvedProviderAuthSchema as i, AuthEnvironmentVariableName as l, ClientAuthMethodDefinitionSchema as m, assertAdapterAuthBindingMatchesMethod as n, AuthCredentialFieldDefinitionSchema as o, ClientAuthMethodDefinition as p, ResolvedProviderAuth as r, AuthCredentialSourceHint as s, AdapterAuthBindingMethodDefinition as t, AuthEnvironmentVariableNameSchema as u, ExplicitAuthMethodDefinition as v, ProviderAuthMethodDefinition as w, InferredAuthMethodDefinitionSchema as x, ExplicitAuthMethodDefinitionSchema as y };

package/dist/{index-DnnKUwHm.d.mts → index-C2C1qH1Y.d.mts}

@@ -1,12 +1,13 @@
-import { J as ArtifactLifecycleHookEvent, Y as ArtifactLifecycleHookRegistration$1, z as AnyArtifactKindDefinition } from "./index-B9d_8_V2.mjs";
-import { A as VersionRange, O as VersionLiteral$1, r as ClientDefinition$1 } from "./definition-CuJvtYeG.mjs";
-import { c as ProviderDefinitionInput$1, r as ProtocolId$1 } from "./definition-Cllhr9mi.mjs";
-import { t as RequiredTimeoutConfig } from "./index-CuHqL95P.mjs";
-import { V as SessionMessage$1, b as SESSION_EVENT_TYPES, i as MakaioSessionEvent$1 } from "./types-CBLPaQXe.mjs";
-import { D as EntityUIConfig, I as FormFieldProps } from "./index-CaerrEDH.mjs";
-import { n as ExtensionTransitionRulesContribution, t as ExtensionTransitionActionsContribution, y as WorkflowBlockCollection$1 } from "./transition-OzGXyy3p.mjs";
-import { l as FacetNamespaceDefinition } from "./index-O08Q2ikz.mjs";
-import { t as SurfaceBindingDefinition } from "./definition-s9PIua2B.mjs";
+import { J as ArtifactLifecycleHookEvent, Y as ArtifactLifecycleHookRegistration$1, z as AnyArtifactKindDefinition } from "./index-9g0agW_p.mjs";
+import { s as AdapterProviderAuth$1 } from "./adapter-binding-DDUyv1JK.mjs";
+import { A as VersionRange, O as VersionLiteral$1, r as ClientDefinition$1 } from "./definition-Cbl0k6Fc.mjs";
+import { c as ProviderDefinitionInput$1, r as ProtocolId$1 } from "./definition-BsTlOz99.mjs";
+import { t as RequiredTimeoutConfig } from "./index-Bv9lm0Kf.mjs";
+import { H as SessionMessage$1, b as SESSION_EVENT_TYPES, i as MakaioSessionEvent$1 } from "./types-BaDYigzD.mjs";
+import { D as EntityUIConfig$1, I as FormFieldProps } from "./index-Bbr5LEUc.mjs";
+import { n as ExtensionTransitionRulesContribution, t as ExtensionTransitionActionsContribution, y as WorkflowBlockCollection$1 } from "./transition-CwUIm1hJ.mjs";
+import { l as FacetNamespaceDefinition } from "./index-DHGW7dFf.mjs";
+import { t as SurfaceBindingDefinition } from "./definition-Bj9Vr16H.mjs";
 import { z } from "zod";
 import { MakaioBusLike, PayloadFilter, RegistrableBusNamespaceDefinition, SubjectSchema } from "@makaio/framework/core";
 import * as _$_makaio_contracts0 from "@makaio/framework/contracts";
@@ -140,9 +141,10 @@ interface AdapterManifest {
   /**
    * Wire protocol(s) this adapter implements.
    *
-   * At least one entry is required. Each entry is either a plain
-   * {@link ProtocolId} string or a {@link ProtocolRef} config object with
-   * per-protocol overrides.
+   * Each entry is either a plain {@link ProtocolId} string or a
+   * {@link ProtocolRef} config object with per-protocol overrides. An empty
+   * array explicitly identifies an SDK-native adapter that does not implement
+   * a framework wire protocol.
    */
   readonly protocols: readonly ProtocolRef[];
   /**
@@ -1408,12 +1410,19 @@ declare function extensionToken$1<T>(name: string): ExtensionToken$1<T>;
  *
  * The adapter declares which providers it can serve by stable definition ID.
  * The adapter subsystem resolves each ID to a full {@link ProviderDefinitionInput}
- * from the provider registry at boot. Optional schemas override the adapter-level
- * defaults for this specific provider.
+ * from the provider registry at boot. An optional config schema overrides the
+ * adapter-level default for this specific provider.
  */
 interface AdapterProviderRef$1 {
   /** Stable provider definition ID (e.g., `'anthropic'`, `'openai'`). */
   readonly definitionId: string;
+  /**
+   * Exact HTTP inference protocol used through this adapter/provider path.
+   *
+   * Omit for SDK-native or subprocess-native transports that do not consume a
+   * Makaio protocol endpoint.
+   */
+  readonly protocol?: ProtocolId$1;
   /**
    * Provider-specific config schema override.
    *
@@ -1421,11 +1430,10 @@ interface AdapterProviderRef$1 {
    */
   readonly configSchema?: z.ZodObject<z.ZodRawShape>;
   /**
-   * Provider-specific credential schema override.
-   *
-   * When present, overrides any adapter-level credential schema for this provider.
+   * Runtime-only compatibility, delivery, and environment-scrubbing metadata
+   * for authentication methods supported through this provider path.
    */
-  readonly credentialSchema?: z.ZodObject<z.ZodRawShape>;
+  readonly auth?: AdapterProviderAuth$1;
 }
 /**
  * Runtime contract for a single provider supported by an adapter.
@@ -1444,6 +1452,8 @@ interface AdapterProviderDefinitionContract$1 {
    * narrows after the adapter subsystem merges the registry data.
    */
   readonly definition: ProviderDefinitionInput$1;
+  /** Exact protocol copied from the selected adapter/provider declaration. */
+  readonly protocol?: ProtocolId$1;
   /**
    * Zod schema for provider-specific configuration fields.
    *
@@ -1453,13 +1463,12 @@ interface AdapterProviderDefinitionContract$1 {
    */
   readonly configSchema?: z.ZodObject<z.ZodRawShape>;
   /**
-   * Zod schema for provider credential fields (e.g., API key, token).
+   * Validated adapter-specific authentication compatibility and delivery metadata.
    *
-   * When present, the adapter subsystem uses this schema to validate
-   * credentials before forwarding them to the adapter factory.
-   * Not serializable — kept in the definition, not the manifest.
+   * Runtime-only: the adapter subsystem resolves this from the matching
+   * {@link AdapterProviderRef} and carries it alongside the provider definition.
    */
-  readonly credentialSchema?: z.ZodObject<z.ZodRawShape>;
+  readonly auth?: AdapterProviderAuth$1;
 }
 /**
  * Runtime contract for an adapter contributed by an extension.
@@ -1519,11 +1528,6 @@ interface AdapterDefinitionContract$1<TAdapter = unknown, TOptions = never> {
    * per-provider via {@link AdapterProviderRef.configSchema}.
    */
   readonly providerConfigSchema?: z.ZodObject<z.ZodRawShape>;
-  /**
-   * Default credential schema applied to all providers unless overridden
-   * per-provider via {@link AdapterProviderRef.credentialSchema}.
-   */
-  readonly providerCredentialSchema?: z.ZodObject<z.ZodRawShape>;
   /**
    * Required timeout defaults for all adapter operations.
    *
@@ -1615,8 +1619,8 @@ declare const ExtensionWarningActionSchema: z.ZodDiscriminatedUnion<[z.ZodObject
  * - `'degraded'`    — the extension is operating in a degraded fallback mode.
  */
 declare const ExtensionWarningSeveritySchema: z.ZodEnum<{
-  info: "info";
   degraded: "degraded";
+  info: "info";
   recommended: "recommended";
 }>;
 /**
@@ -1627,8 +1631,8 @@ declare const ExtensionWarningSeveritySchema: z.ZodEnum<{
  */
 declare const ExtensionWarningSchema: z.ZodObject<{
   severity: z.ZodEnum<{
-    info: "info";
     degraded: "degraded";
+    info: "info";
     recommended: "recommended";
   }>;
   title: z.ZodString;
@@ -1674,8 +1678,8 @@ declare const ExtensionWarningEntrySchema: z.ZodObject<{
   extensionName: z.ZodString;
   warnings: z.ZodArray<z.ZodObject<{
     severity: z.ZodEnum<{
-      info: "info";
       degraded: "degraded";
+      info: "info";
       recommended: "recommended";
     }>;
     title: z.ZodString;
@@ -1825,6 +1829,8 @@ interface ExtensionContext$1<TBus extends MakaioBusLike = MakaioBusLike> {
  * host-agnostic extensions can type themselves against {@link ExtensionContext}.
  */
 interface NodeExtensionContext$1<TBus extends MakaioBusLike = MakaioBusLike> extends ExtensionContext$1<TBus> {
+  /** Working directory selected by the Node host for relative filesystem operations. */
+  readonly cwd?: string;
   /** Current platform identifier (e.g., `'darwin'`, `'linux'`, `'win32'`). */
   readonly platform: NodeJS.Platform;
   /** User's home directory path. */
@@ -3620,7 +3626,7 @@ interface MakaioExtension$1<THostContext extends ExtensionContext$1 = NodeExtens
    * which fields to hide, and per-field widget overrides (e.g. slider, color
    * picker). Only meaningful when {@link configSchema} is also declared.
    */
-  readonly uiConfig?: EntityUIConfig;
+  readonly uiConfig?: EntityUIConfig$1;
   /**
    * Client runtime definitions contributed by this extension.
    *

package/dist/{index-ntS1EXlf.d.mts → index-C6LZOiDv.d.mts}

@@ -1,18 +1,109 @@
-import { r as ExtensionDiscovery } from "./extension-discovery-CIZn5bkq.mjs";
+import { r as ExtensionDiscovery } from "./extension-discovery-APMf1Tes.mjs";
 import { RegistrableBusNamespaceDefinition } from "@makaio/framework/core";
 import { BusTransport, IMakaioBus, SubjectTelemetryProjectorRegistry } from "@makaio/framework/bus";
 import { ExtensionConfigProvider, IWorkerNodeProvider, IWorkflowRunner, IWorkflowRunner as IWorkflowRunner$1, LoopGateHandler, NormalizedWorkerNodeCapabilities, StationHandler, StepRunnerBusAuth, StepRunnerPlatformDefaults, TrayManifest, WorkerContributionManifest, WorkerNodeCapabilities, WorkerNodeDispatch, WorkerNodeHandle, WorkerNodeProvisionRequest, WorkerNodeRequirements, WorkflowDefinition, WorkflowRunResult, WorkflowRunResult as WorkflowRunResult$1, WorkflowRunnerRunOptions, WorkflowWorkerConfig, WorkflowWorkerSource, WorkflowZodSchemas } from "@makaio/framework/contracts";
 import { DispatchingAuth, TransportAuth } from "@makaio/framework/node/transports";
 import { StorageEngine } from "@makaio/framework/storage/drizzle";
+import { Toolset } from "@makaio/framework/tools";
 import { ContributionProcessor, ExtensionCoordinator, ExtensionRuntimeSurface, KernelExtensionContext, KernelMakaioExtension, RuntimeCapability, TransportProvider, WindowRegistry } from "@makaio/framework/kernel";
 import { IAdapterConfigRepository } from "@makaio/framework/services/adapter-subsystem";
 import { PostInstallHandler, StrategyDependencies } from "@makaio/framework/clients";
 import { DatabaseClient } from "@makaio/framework/storage/drizzle/client";
+import { IAdapterConfigRepository as IAdapterConfigRepository$1, PlatformDefaults, createAdapterSubsystemPackage } from "@makaio/framework/adapter-subsystem";
 import { PersistedMachineIdentity } from "@makaio/framework/node/machine-identity";
 import { Hono } from "hono";
 import { ConfigProvider } from "@makaio/framework/providers";
 import { Server } from "node:http";
 
+//#region runtimes/node/src/compose-adapter-runtime.d.ts
+/**
+ * Composition seam for booting a local adapter runtime.
+ *
+ * Encapsulates the proven host sequence for making `adapter.*` execution
+ * subjects locally owned, so every adapter-capable runtime composes it the
+ * same way instead of reinventing it. There are two phases because the kernel
+ * lifecycle requires it:
+ *
+ * 1. {@link prepareAdapterRuntime} — call **before** `coordinator.startAll()`:
+ *    builds the adapter-subsystem package (add it to the coordinator load set)
+ *    and registers the adapter contribution processor so adapter contributions
+ *    are awaited during activation.
+ * 2. {@link activateAdapterRuntimeIdentity} — call **after** `coordinator.startAll()`:
+ *    registers the adapter-runtime identity handlers and the adapter-name
+ *    resolver, which resolve `adapterName` to the deterministic adapter id that
+ *    live `AIAdapter` instances filter `AdapterSubjects.startAgent` on.
+ *
+ * The locality invariant this seam upholds: the `currentMachineId` passed to
+ * {@link activateAdapterRuntimeIdentity} MUST be the same machine id the
+ * coordinator injects as `extensionContextBase.machineId` (and therefore the
+ * id `AdapterSubsystemService` and `SubagentService` derive adapter ids from).
+ * If they diverge, `AdapterRuntimeSubjects.resolveId` yields an id no local
+ * adapter listens on and `startAgent` silently falls through to the transport.
+ */
+/** Input for {@link prepareAdapterRuntime} (the pre-`startAll` phase). */
+interface PrepareAdapterRuntimeInput {
+  /** Coordinator that loads the adapter-subsystem package and owns activation. */
+  readonly coordinator: ExtensionCoordinator;
+  /** Persistence seam for adapter/provider configuration. */
+  readonly configRepository: IAdapterConfigRepository$1;
+  /** Platform defaults (cwd/env) supplied to adapter instances. */
+  readonly platformDefaults: PlatformDefaults;
+  /** Trusted non-serializable auth preparer forwarded to every loaded adapter. */
+  readonly prepareAuthRuntime?: unknown;
+  /** Priority for runtime snapshot handlers relative to connected control-plane peers. */
+  readonly runtimeSnapshotHandlerPriority?: number;
+  /** Priority for provider/client definition reads backing local runtime snapshots. */
+  readonly runtimeDefinitionHandlerPriority?: number;
+}
+/** Result of {@link prepareAdapterRuntime}. */
+interface PreparedAdapterRuntime {
+  /**
+   * The adapter-subsystem package. The caller MUST add this to the array passed
+   * to `coordinator.load(...)`; its `create` reads `ctx.machineId`, so adapter
+   * ids derive from the coordinator's machine id.
+   */
+  readonly adapterSubsystemPackage: ReturnType<typeof createAdapterSubsystemPackage>;
+}
+/** Input for {@link activateAdapterRuntimeIdentity} (the post-`startAll` phase). */
+interface ActivateAdapterRuntimeIdentityInput {
+  /** Bus the identity handlers and name resolver are registered on. */
+  readonly bus: IMakaioBus;
+  /**
+   * The runtime's machine id. MUST equal the coordinator's
+   * `extensionContextBase.machineId` (see the locality invariant above).
+   */
+  readonly currentMachineId: string;
+  /**
+   * Optional override for enumerating known adapter names. Defaults to querying
+   * `AdapterSubsystemSubjects.listAdapterConfigs` on the bus, matching the host.
+   */
+  readonly listKnownAdapterNames?: () => Promise<Iterable<string>>;
+}
+/** Result of {@link activateAdapterRuntimeIdentity}. */
+interface ActivatedAdapterRuntimeIdentity {
+  /** Tear down the identity handlers and the adapter-name resolver. */
+  readonly cleanup: () => void;
+}
+/**
+ * Build the adapter-subsystem package and register its contribution processor.
+ *
+ * Call before `coordinator.startAll()`. Registering the contribution processor
+ * only stores it for use during activation, so it is order-independent relative
+ * to `coordinator.load(...)` as long as it happens before `startAll()`.
+ * @param input - Coordinator, config repository, and platform defaults.
+ * @returns The adapter-subsystem package to add to the coordinator load set.
+ */
+declare function prepareAdapterRuntime(input: PrepareAdapterRuntimeInput): PreparedAdapterRuntime;
+/**
+ * Register the adapter-runtime identity handlers and adapter-name resolver.
+ *
+ * Call after `coordinator.startAll()` so that `CapabilityService` and the
+ * adapter subsystem have registered their handlers.
+ * @param input - Bus, the runtime machine id, and an optional name enumerator.
+ * @returns A cleanup that tears both registrations down.
+ */
+declare function activateAdapterRuntimeIdentity(input: ActivateAdapterRuntimeIdentityInput): ActivatedAdapterRuntimeIdentity;
+//#endregion
 //#region runtimes/node/src/hono-route-graph.d.ts
 /**
  * Options for {@link createHonoRouteGraph}.
@@ -1262,6 +1353,63 @@ declare class InProcessWorkflowRunner implements IWorkflowRunner {
   run(config: WorkflowWorkerConfig, signal: AbortSignal, _manifest?: WorkerContributionManifest): Promise<WorkflowRunResult>;
 }
 //#endregion
+//#region runtimes/node/src/workflow-worker/isolated-workflow-runtime.d.ts
+/** Connect an isolated runtime bus to its authenticated authority. */
+type WorkflowRuntimeAuthorityConnector = (bus: IMakaioBus) => Promise<void>;
+/** Discover runtime contributions after the authority connection is authenticated. */
+type WorkflowRuntimeContributionLoader = (bus: IMakaioBus) => Promise<readonly KernelMakaioExtension[]>;
+/** Node host context supplied by the runtime composition root. */
+interface IsolatedWorkflowRuntimeContext {
+  /** Working directory exposed to adapters and contributed packages. */
+  readonly cwd: string;
+  /** Current platform identifier. */
+  readonly platform: NodeJS.Platform;
+  /** User's home directory path. */
+  readonly homedir: string;
+  /** Resolved `.makaio` home directory. */
+  readonly makaioHome: string;
+  /** Current OS username. */
+  readonly username: string;
+  /** Stable runtime machine identity. */
+  readonly machineId: string;
+}
+/** Inputs for composing an authority-backed isolated workflow runtime. */
+interface CreateIsolatedWorkflowRuntimeOptions {
+  /** Connect the new bus to an already authenticated authority transport. */
+  readonly connectAuthority: WorkflowRuntimeAuthorityConnector;
+  /** Load authority-dependent contribution packages after authentication. */
+  readonly loadContributedPackages?: WorkflowRuntimeContributionLoader;
+  /** Exact extension packages contributed to this runtime. */
+  readonly contributedPackages: readonly KernelMakaioExtension[];
+  /** Adapter configuration persistence supplied by the authority host. */
+  readonly configRepository: PrepareAdapterRuntimeInput['configRepository'];
+  /** Trusted non-serializable adapter authentication preparer. */
+  readonly prepareAuthRuntime?: PrepareAdapterRuntimeInput['prepareAuthRuntime'];
+  /** Explicit Node host context for adapters and contributed packages. */
+  readonly context: IsolatedWorkflowRuntimeContext;
+  /** Toolsets explicitly authorized for this runtime. */
+  readonly toolsets: readonly Toolset[];
+}
+/** Active isolated workflow runtime and its owned lifecycle. */
+interface IsolatedWorkflowRuntime {
+  readonly bus: IMakaioBus;
+  readonly coordinator: ExtensionCoordinator;
+  readonly machineId: string;
+  /** Release all runtime-owned resources in reverse startup order. */
+  readonly shutdown: () => Promise<void>;
+}
+/**
+ * Compose an isolated, authority-backed runtime for workflow agent steps.
+ *
+ * The runtime deliberately owns no database and installs no local storage
+ * handlers. Session lifecycle and usage requests therefore cross the supplied
+ * authenticated authority connection. Product bootstrap, package discovery,
+ * relay policy, and worker-pool concerns remain with the caller.
+ * @param options - Authority connection, packages, adapter preparation, host context, and tools.
+ * @returns A started runtime with an idempotent shutdown handle.
+ */
+declare function createIsolatedWorkflowRuntime(options: CreateIsolatedWorkflowRuntimeOptions): Promise<IsolatedWorkflowRuntime>;
+//#endregion
 //#region runtimes/node/src/workflow-worker/workflow-loader.d.ts
 /**
  * Resolve a {@link RuntimeLoadedWorkflow} from the parsed worker config.
@@ -1324,4 +1472,4 @@ declare function loadWorkflowModules(source: Exclude<WorkflowWorkerSource, {
  */
 declare function loadWorkflowModule(source: WorkflowWorkerSource): Promise<RuntimeLoadedWorkflow>;
 //#endregion
-export { DatabaseBootOptions as A, NodeFrameworkModuleResolver as B, ServerTransportProvider as C, WorkflowWorkerEntryMode as D, WorkflowRunnerBootOptions as E, normalizeNodeHostCapabilities as F, HttpContributionPhase as G, resolveFrameworkSpecifier as H, selectFrameworkCorePackages as I, HonoRouteGraphOptions as J, HttpRouteContribution as K, ShutdownStep as L, InitializeNodeDatabaseResult as M, initializeNodeDatabase as N, WorkflowWorkerEntryResolverOptions as O, HostCapabilityDeclaration as P, BridgeBrowserOptions as R, MakaioRuntime as S, UpstreamTelemetryBootOptions as T, HttpRouteGraphBuilder as U, NoopFrameworkModuleResolver as V, createHttpRouteGraphBuilder as W, createHonoRouteGraph as Y, ThinWorkflowPiscinaRunnerOptions as _, InProcessWorkflowRunnerOptions as a, BootMakaioRuntimeOptions as b, WorkerNodeRunner as c, NodeWorkflowRunnerPackageOptions as d, createNodeWorkflowRunner as f, RuntimeLoadedWorkflow as g, IWorkflowRunner$1 as h, InProcessWorkflowRunner as i, InitializeNodeDatabaseOptions as j, resolveWorkflowWorkerEntry as k, WorkerNodeRunnerOptions as l, ThinWorkflowPiscinaRunner as m, loadWorkflowModules as n, PiscinaThinWorkflowProvider as o, createNodeWorkflowRunnerPackageOptions as p, HonoRouteGraph as q, loadWorkflowFromConfig as r, PiscinaThinWorkflowProviderOptions as s, loadWorkflowModule as t, CreateNodeWorkflowRunnerPackageOptionsParams as u, WorkflowRunResult$1 as v, TransportReadyInfo as w, CoreBootOptions as x, BootCoordinatorSetupContext as y, FrameworkModuleResolver as z };
+export { HonoRouteGraph as $, TransportReadyInfo as A, HostCapabilityDeclaration as B, ThinWorkflowPiscinaRunnerOptions as C, CoreBootOptions as D, BootMakaioRuntimeOptions as E, resolveWorkflowWorkerEntry as F, FrameworkModuleResolver as G, selectFrameworkCorePackages as H, DatabaseBootOptions as I, resolveFrameworkSpecifier as J, NodeFrameworkModuleResolver as K, InitializeNodeDatabaseOptions as L, WorkflowRunnerBootOptions as M, WorkflowWorkerEntryMode as N, MakaioRuntime as O, WorkflowWorkerEntryResolverOptions as P, HttpRouteContribution as Q, InitializeNodeDatabaseResult as R, RuntimeLoadedWorkflow as S, BootCoordinatorSetupContext as T, ShutdownStep as U, normalizeNodeHostCapabilities as V, BridgeBrowserOptions as W, createHttpRouteGraphBuilder as X, HttpRouteGraphBuilder as Y, HttpContributionPhase as Z, NodeWorkflowRunnerPackageOptions as _, IsolatedWorkflowRuntime as a, PreparedAdapterRuntime as at, ThinWorkflowPiscinaRunner as b, WorkflowRuntimeContributionLoader as c, InProcessWorkflowRunnerOptions as d, HonoRouteGraphOptions as et, PiscinaThinWorkflowProvider as f, CreateNodeWorkflowRunnerPackageOptionsParams as g, WorkerNodeRunnerOptions as h, CreateIsolatedWorkflowRuntimeOptions as i, PrepareAdapterRuntimeInput as it, UpstreamTelemetryBootOptions as j, ServerTransportProvider as k, createIsolatedWorkflowRuntime as l, WorkerNodeRunner as m, loadWorkflowModules as n, ActivateAdapterRuntimeIdentityInput as nt, IsolatedWorkflowRuntimeContext as o, activateAdapterRuntimeIdentity as ot, PiscinaThinWorkflowProviderOptions as p, NoopFrameworkModuleResolver as q, loadWorkflowFromConfig as r, ActivatedAdapterRuntimeIdentity as rt, WorkflowRuntimeAuthorityConnector as s, prepareAdapterRuntime as st, loadWorkflowModule as t, createHonoRouteGraph as tt, InProcessWorkflowRunner as u, createNodeWorkflowRunner as v, WorkflowRunResult$1 as w, IWorkflowRunner$1 as x, createNodeWorkflowRunnerPackageOptions as y, initializeNodeDatabase as z };