@makaio/framework 1.0.0-dev-1783705652236 → 1.0.0-dev-1783973359164

package/dist/{index-B2DjrVb8.d.mts → index-DpZbaS7y.d.mts}

@@ -498,18 +498,82 @@ declare const AdapterNamespace: _$_makaio_core0.BusNamespaceDefinition<"adapter"
           exposed: _$zod.ZodBoolean;
         }, _$zod_v4_core0.$strip>>;
       }, _$zod_v4_core0.$strip>]>>;
-      providerContext: _$zod.ZodOptional<_$zod.ZodObject<{
+      providerContext: _$zod.ZodOptional<_$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"resolved">;
         providerConfigId: _$zod.ZodString;
         definitionId: _$zod.ZodString;
         endpointOverrides: _$zod.ZodOptional<_$zod.ZodObject<{
           anthropic: _$zod.ZodOptional<_$zod.ZodString>;
           openai: _$zod.ZodOptional<_$zod.ZodString>;
         }, _$zod_v4_core0.$strip>>;
-        credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
-        credentialEnvVars: _$zod.ZodOptional<_$zod.ZodRecord<_$zod.ZodString, _$zod.ZodString>>;
-        ambientCredentialEnvVars: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
+        auth: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"explicit">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"explicit">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+            fields: _$zod.ZodArray<_$zod.ZodObject<{
+              id: _$zod.ZodString;
+              label: _$zod.ZodString;
+              description: _$zod.ZodOptional<_$zod.ZodString>;
+              required: _$zod.ZodBoolean;
+              secret: _$zod.ZodBoolean;
+              sourceHints: _$zod.ZodArray<_$zod.ZodObject<{
+                kind: _$zod.ZodLiteral<"environment">;
+                variable: _$zod.ZodString;
+              }, _$zod_v4_core0.$strict>>;
+            }, _$zod_v4_core0.$strict>>;
+          }, _$zod_v4_core0.$strict>;
+          credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"inferred">;
+          method: _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"inferred">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+          account: _$zod.ZodOptional<_$zod.ZodObject<{
+            managerId: _$zod.ZodString;
+            accountId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"none">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"none">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+        }, _$zod_v4_core0.$strict>], "mode">;
         capabilities: _$zod.ZodOptional<_$zod.ZodType<Record<string, unknown>, Record<string, unknown>, _$zod_v4_core0.$ZodTypeInternals<Record<string, unknown>, Record<string, unknown>>>>;
-      }, _$zod_v4_core0.$strip>>;
+      }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"unresolved">;
+      }, _$zod_v4_core0.$strict>], "state">>;
       ephemeral: _$zod.ZodOptional<_$zod.ZodBoolean>;
       cwd: _$zod.ZodOptional<_$zod.ZodString>;
       allowedTools: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
@@ -1006,18 +1070,82 @@ declare const AdapterNamespace: _$_makaio_core0.BusNamespaceDefinition<"adapter"
           exposed: _$zod.ZodBoolean;
         }, _$zod_v4_core0.$strip>>;
       }, _$zod_v4_core0.$strip>]>>;
-      providerContext: _$zod.ZodOptional<_$zod.ZodObject<{
+      providerContext: _$zod.ZodOptional<_$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"resolved">;
         providerConfigId: _$zod.ZodString;
         definitionId: _$zod.ZodString;
         endpointOverrides: _$zod.ZodOptional<_$zod.ZodObject<{
           anthropic: _$zod.ZodOptional<_$zod.ZodString>;
           openai: _$zod.ZodOptional<_$zod.ZodString>;
         }, _$zod_v4_core0.$strip>>;
-        credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
-        credentialEnvVars: _$zod.ZodOptional<_$zod.ZodRecord<_$zod.ZodString, _$zod.ZodString>>;
-        ambientCredentialEnvVars: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
+        auth: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"explicit">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"explicit">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+            fields: _$zod.ZodArray<_$zod.ZodObject<{
+              id: _$zod.ZodString;
+              label: _$zod.ZodString;
+              description: _$zod.ZodOptional<_$zod.ZodString>;
+              required: _$zod.ZodBoolean;
+              secret: _$zod.ZodBoolean;
+              sourceHints: _$zod.ZodArray<_$zod.ZodObject<{
+                kind: _$zod.ZodLiteral<"environment">;
+                variable: _$zod.ZodString;
+              }, _$zod_v4_core0.$strict>>;
+            }, _$zod_v4_core0.$strict>>;
+          }, _$zod_v4_core0.$strict>;
+          credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"inferred">;
+          method: _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"inferred">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+          account: _$zod.ZodOptional<_$zod.ZodObject<{
+            managerId: _$zod.ZodString;
+            accountId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"none">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"none">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+        }, _$zod_v4_core0.$strict>], "mode">;
         capabilities: _$zod.ZodOptional<_$zod.ZodType<Record<string, unknown>, Record<string, unknown>, _$zod_v4_core0.$ZodTypeInternals<Record<string, unknown>, Record<string, unknown>>>>;
-      }, _$zod_v4_core0.$strip>>;
+      }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"unresolved">;
+      }, _$zod_v4_core0.$strict>], "state">>;
       ephemeral: _$zod.ZodOptional<_$zod.ZodBoolean>;
       cwd: _$zod.ZodOptional<_$zod.ZodString>;
       allowedTools: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
@@ -1511,18 +1639,82 @@ declare const AdapterNamespace: _$_makaio_core0.BusNamespaceDefinition<"adapter"
           exposed: _$zod.ZodBoolean;
         }, _$zod_v4_core0.$strip>>;
       }, _$zod_v4_core0.$strip>]>>;
-      providerContext: _$zod.ZodOptional<_$zod.ZodObject<{
+      providerContext: _$zod.ZodOptional<_$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"resolved">;
         providerConfigId: _$zod.ZodString;
         definitionId: _$zod.ZodString;
         endpointOverrides: _$zod.ZodOptional<_$zod.ZodObject<{
           anthropic: _$zod.ZodOptional<_$zod.ZodString>;
           openai: _$zod.ZodOptional<_$zod.ZodString>;
         }, _$zod_v4_core0.$strip>>;
-        credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
-        credentialEnvVars: _$zod.ZodOptional<_$zod.ZodRecord<_$zod.ZodString, _$zod.ZodString>>;
-        ambientCredentialEnvVars: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
+        auth: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"explicit">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"explicit">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+            fields: _$zod.ZodArray<_$zod.ZodObject<{
+              id: _$zod.ZodString;
+              label: _$zod.ZodString;
+              description: _$zod.ZodOptional<_$zod.ZodString>;
+              required: _$zod.ZodBoolean;
+              secret: _$zod.ZodBoolean;
+              sourceHints: _$zod.ZodArray<_$zod.ZodObject<{
+                kind: _$zod.ZodLiteral<"environment">;
+                variable: _$zod.ZodString;
+              }, _$zod_v4_core0.$strict>>;
+            }, _$zod_v4_core0.$strict>>;
+          }, _$zod_v4_core0.$strict>;
+          credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"inferred">;
+          method: _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"inferred">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+          account: _$zod.ZodOptional<_$zod.ZodObject<{
+            managerId: _$zod.ZodString;
+            accountId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"none">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"none">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+        }, _$zod_v4_core0.$strict>], "mode">;
         capabilities: _$zod.ZodOptional<_$zod.ZodType<Record<string, unknown>, Record<string, unknown>, _$zod_v4_core0.$ZodTypeInternals<Record<string, unknown>, Record<string, unknown>>>>;
-      }, _$zod_v4_core0.$strip>>;
+      }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"unresolved">;
+      }, _$zod_v4_core0.$strict>], "state">>;
       ephemeral: _$zod.ZodOptional<_$zod.ZodBoolean>;
       cwd: _$zod.ZodOptional<_$zod.ZodString>;
       allowedTools: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
@@ -1558,18 +1750,82 @@ declare const AdapterNamespace: _$_makaio_core0.BusNamespaceDefinition<"adapter"
         name: _$zod.ZodOptional<_$zod.ZodString>;
         strict: _$zod.ZodOptional<_$zod.ZodBoolean>;
       }, _$zod_v4_core0.$strict>>;
-      providerContext: _$zod.ZodOptional<_$zod.ZodObject<{
+      providerContext: _$zod.ZodOptional<_$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"resolved">;
         providerConfigId: _$zod.ZodString;
         definitionId: _$zod.ZodString;
         endpointOverrides: _$zod.ZodOptional<_$zod.ZodObject<{
           anthropic: _$zod.ZodOptional<_$zod.ZodString>;
           openai: _$zod.ZodOptional<_$zod.ZodString>;
         }, _$zod_v4_core0.$strip>>;
-        credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
-        credentialEnvVars: _$zod.ZodOptional<_$zod.ZodRecord<_$zod.ZodString, _$zod.ZodString>>;
-        ambientCredentialEnvVars: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
+        auth: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"explicit">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"explicit">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+            fields: _$zod.ZodArray<_$zod.ZodObject<{
+              id: _$zod.ZodString;
+              label: _$zod.ZodString;
+              description: _$zod.ZodOptional<_$zod.ZodString>;
+              required: _$zod.ZodBoolean;
+              secret: _$zod.ZodBoolean;
+              sourceHints: _$zod.ZodArray<_$zod.ZodObject<{
+                kind: _$zod.ZodLiteral<"environment">;
+                variable: _$zod.ZodString;
+              }, _$zod_v4_core0.$strict>>;
+            }, _$zod_v4_core0.$strict>>;
+          }, _$zod_v4_core0.$strict>;
+          credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"inferred">;
+          method: _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"inferred">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+          account: _$zod.ZodOptional<_$zod.ZodObject<{
+            managerId: _$zod.ZodString;
+            accountId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"none">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"none">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+        }, _$zod_v4_core0.$strict>], "mode">;
         capabilities: _$zod.ZodOptional<_$zod.ZodType<Record<string, unknown>, Record<string, unknown>, _$zod_v4_core0.$ZodTypeInternals<Record<string, unknown>, Record<string, unknown>>>>;
-      }, _$zod_v4_core0.$strip>>;
+      }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"unresolved">;
+      }, _$zod_v4_core0.$strict>], "state">>;
     }, _$zod_v4_core0.$strip>;
     response: _$zod.ZodObject<{
       text: _$zod.ZodString;
@@ -2226,18 +2482,82 @@ declare const AdapterSubjects$1: _$_makaio_core0.BusSubjects<_$_makaio_core0.Fla
           exposed: _$zod.ZodBoolean;
         }, _$zod_v4_core0.$strip>>;
       }, _$zod_v4_core0.$strip>]>>;
-      providerContext: _$zod.ZodOptional<_$zod.ZodObject<{
+      providerContext: _$zod.ZodOptional<_$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"resolved">;
         providerConfigId: _$zod.ZodString;
         definitionId: _$zod.ZodString;
         endpointOverrides: _$zod.ZodOptional<_$zod.ZodObject<{
           anthropic: _$zod.ZodOptional<_$zod.ZodString>;
           openai: _$zod.ZodOptional<_$zod.ZodString>;
         }, _$zod_v4_core0.$strip>>;
-        credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
-        credentialEnvVars: _$zod.ZodOptional<_$zod.ZodRecord<_$zod.ZodString, _$zod.ZodString>>;
-        ambientCredentialEnvVars: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
+        auth: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"explicit">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"explicit">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+            fields: _$zod.ZodArray<_$zod.ZodObject<{
+              id: _$zod.ZodString;
+              label: _$zod.ZodString;
+              description: _$zod.ZodOptional<_$zod.ZodString>;
+              required: _$zod.ZodBoolean;
+              secret: _$zod.ZodBoolean;
+              sourceHints: _$zod.ZodArray<_$zod.ZodObject<{
+                kind: _$zod.ZodLiteral<"environment">;
+                variable: _$zod.ZodString;
+              }, _$zod_v4_core0.$strict>>;
+            }, _$zod_v4_core0.$strict>>;
+          }, _$zod_v4_core0.$strict>;
+          credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"inferred">;
+          method: _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"inferred">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+          account: _$zod.ZodOptional<_$zod.ZodObject<{
+            managerId: _$zod.ZodString;
+            accountId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"none">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"none">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+        }, _$zod_v4_core0.$strict>], "mode">;
         capabilities: _$zod.ZodOptional<_$zod.ZodType<Record<string, unknown>, Record<string, unknown>, _$zod_v4_core0.$ZodTypeInternals<Record<string, unknown>, Record<string, unknown>>>>;
-      }, _$zod_v4_core0.$strip>>;
+      }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"unresolved">;
+      }, _$zod_v4_core0.$strict>], "state">>;
       ephemeral: _$zod.ZodOptional<_$zod.ZodBoolean>;
       cwd: _$zod.ZodOptional<_$zod.ZodString>;
       allowedTools: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
@@ -2734,18 +3054,82 @@ declare const AdapterSubjects$1: _$_makaio_core0.BusSubjects<_$_makaio_core0.Fla
           exposed: _$zod.ZodBoolean;
         }, _$zod_v4_core0.$strip>>;
       }, _$zod_v4_core0.$strip>]>>;
-      providerContext: _$zod.ZodOptional<_$zod.ZodObject<{
+      providerContext: _$zod.ZodOptional<_$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"resolved">;
         providerConfigId: _$zod.ZodString;
         definitionId: _$zod.ZodString;
         endpointOverrides: _$zod.ZodOptional<_$zod.ZodObject<{
           anthropic: _$zod.ZodOptional<_$zod.ZodString>;
           openai: _$zod.ZodOptional<_$zod.ZodString>;
         }, _$zod_v4_core0.$strip>>;
-        credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
-        credentialEnvVars: _$zod.ZodOptional<_$zod.ZodRecord<_$zod.ZodString, _$zod.ZodString>>;
-        ambientCredentialEnvVars: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
+        auth: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"explicit">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"explicit">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+            fields: _$zod.ZodArray<_$zod.ZodObject<{
+              id: _$zod.ZodString;
+              label: _$zod.ZodString;
+              description: _$zod.ZodOptional<_$zod.ZodString>;
+              required: _$zod.ZodBoolean;
+              secret: _$zod.ZodBoolean;
+              sourceHints: _$zod.ZodArray<_$zod.ZodObject<{
+                kind: _$zod.ZodLiteral<"environment">;
+                variable: _$zod.ZodString;
+              }, _$zod_v4_core0.$strict>>;
+            }, _$zod_v4_core0.$strict>>;
+          }, _$zod_v4_core0.$strict>;
+          credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"inferred">;
+          method: _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"inferred">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+          account: _$zod.ZodOptional<_$zod.ZodObject<{
+            managerId: _$zod.ZodString;
+            accountId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"none">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"none">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+        }, _$zod_v4_core0.$strict>], "mode">;
         capabilities: _$zod.ZodOptional<_$zod.ZodType<Record<string, unknown>, Record<string, unknown>, _$zod_v4_core0.$ZodTypeInternals<Record<string, unknown>, Record<string, unknown>>>>;
-      }, _$zod_v4_core0.$strip>>;
+      }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"unresolved">;
+      }, _$zod_v4_core0.$strict>], "state">>;
       ephemeral: _$zod.ZodOptional<_$zod.ZodBoolean>;
       cwd: _$zod.ZodOptional<_$zod.ZodString>;
       allowedTools: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
@@ -3239,18 +3623,82 @@ declare const AdapterSubjects$1: _$_makaio_core0.BusSubjects<_$_makaio_core0.Fla
           exposed: _$zod.ZodBoolean;
         }, _$zod_v4_core0.$strip>>;
       }, _$zod_v4_core0.$strip>]>>;
-      providerContext: _$zod.ZodOptional<_$zod.ZodObject<{
+      providerContext: _$zod.ZodOptional<_$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"resolved">;
         providerConfigId: _$zod.ZodString;
         definitionId: _$zod.ZodString;
         endpointOverrides: _$zod.ZodOptional<_$zod.ZodObject<{
           anthropic: _$zod.ZodOptional<_$zod.ZodString>;
           openai: _$zod.ZodOptional<_$zod.ZodString>;
         }, _$zod_v4_core0.$strip>>;
-        credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
-        credentialEnvVars: _$zod.ZodOptional<_$zod.ZodRecord<_$zod.ZodString, _$zod.ZodString>>;
-        ambientCredentialEnvVars: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
+        auth: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"explicit">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"explicit">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+            fields: _$zod.ZodArray<_$zod.ZodObject<{
+              id: _$zod.ZodString;
+              label: _$zod.ZodString;
+              description: _$zod.ZodOptional<_$zod.ZodString>;
+              required: _$zod.ZodBoolean;
+              secret: _$zod.ZodBoolean;
+              sourceHints: _$zod.ZodArray<_$zod.ZodObject<{
+                kind: _$zod.ZodLiteral<"environment">;
+                variable: _$zod.ZodString;
+              }, _$zod_v4_core0.$strict>>;
+            }, _$zod_v4_core0.$strict>>;
+          }, _$zod_v4_core0.$strict>;
+          credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"inferred">;
+          method: _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"inferred">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+          account: _$zod.ZodOptional<_$zod.ZodObject<{
+            managerId: _$zod.ZodString;
+            accountId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"none">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"none">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+        }, _$zod_v4_core0.$strict>], "mode">;
         capabilities: _$zod.ZodOptional<_$zod.ZodType<Record<string, unknown>, Record<string, unknown>, _$zod_v4_core0.$ZodTypeInternals<Record<string, unknown>, Record<string, unknown>>>>;
-      }, _$zod_v4_core0.$strip>>;
+      }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"unresolved">;
+      }, _$zod_v4_core0.$strict>], "state">>;
       ephemeral: _$zod.ZodOptional<_$zod.ZodBoolean>;
       cwd: _$zod.ZodOptional<_$zod.ZodString>;
       allowedTools: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
@@ -3286,18 +3734,82 @@ declare const AdapterSubjects$1: _$_makaio_core0.BusSubjects<_$_makaio_core0.Fla
         name: _$zod.ZodOptional<_$zod.ZodString>;
         strict: _$zod.ZodOptional<_$zod.ZodBoolean>;
       }, _$zod_v4_core0.$strict>>;
-      providerContext: _$zod.ZodOptional<_$zod.ZodObject<{
+      providerContext: _$zod.ZodOptional<_$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"resolved">;
         providerConfigId: _$zod.ZodString;
         definitionId: _$zod.ZodString;
         endpointOverrides: _$zod.ZodOptional<_$zod.ZodObject<{
           anthropic: _$zod.ZodOptional<_$zod.ZodString>;
           openai: _$zod.ZodOptional<_$zod.ZodString>;
         }, _$zod_v4_core0.$strip>>;
-        credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
-        credentialEnvVars: _$zod.ZodOptional<_$zod.ZodRecord<_$zod.ZodString, _$zod.ZodString>>;
-        ambientCredentialEnvVars: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
+        auth: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"explicit">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"explicit">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+            fields: _$zod.ZodArray<_$zod.ZodObject<{
+              id: _$zod.ZodString;
+              label: _$zod.ZodString;
+              description: _$zod.ZodOptional<_$zod.ZodString>;
+              required: _$zod.ZodBoolean;
+              secret: _$zod.ZodBoolean;
+              sourceHints: _$zod.ZodArray<_$zod.ZodObject<{
+                kind: _$zod.ZodLiteral<"environment">;
+                variable: _$zod.ZodString;
+              }, _$zod_v4_core0.$strict>>;
+            }, _$zod_v4_core0.$strict>>;
+          }, _$zod_v4_core0.$strict>;
+          credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"inferred">;
+          method: _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"inferred">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+          account: _$zod.ZodOptional<_$zod.ZodObject<{
+            managerId: _$zod.ZodString;
+            accountId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"none">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"none">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+        }, _$zod_v4_core0.$strict>], "mode">;
         capabilities: _$zod.ZodOptional<_$zod.ZodType<Record<string, unknown>, Record<string, unknown>, _$zod_v4_core0.$ZodTypeInternals<Record<string, unknown>, Record<string, unknown>>>>;
-      }, _$zod_v4_core0.$strip>>;
+      }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"unresolved">;
+      }, _$zod_v4_core0.$strict>], "state">>;
     }, _$zod_v4_core0.$strip>;
     response: _$zod.ZodObject<{
       text: _$zod.ZodString;
@@ -3978,18 +4490,82 @@ declare const AdapterSchemas: {
           exposed: _$zod.ZodBoolean;
         }, _$zod_v4_core0.$strip>>;
       }, _$zod_v4_core0.$strip>]>>;
-      providerContext: _$zod.ZodOptional<_$zod.ZodObject<{
+      providerContext: _$zod.ZodOptional<_$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"resolved">;
         providerConfigId: _$zod.ZodString;
         definitionId: _$zod.ZodString;
         endpointOverrides: _$zod.ZodOptional<_$zod.ZodObject<{
           anthropic: _$zod.ZodOptional<_$zod.ZodString>;
           openai: _$zod.ZodOptional<_$zod.ZodString>;
         }, _$zod_v4_core0.$strip>>;
-        credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
-        credentialEnvVars: _$zod.ZodOptional<_$zod.ZodRecord<_$zod.ZodString, _$zod.ZodString>>;
-        ambientCredentialEnvVars: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
+        auth: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"explicit">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"explicit">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+            fields: _$zod.ZodArray<_$zod.ZodObject<{
+              id: _$zod.ZodString;
+              label: _$zod.ZodString;
+              description: _$zod.ZodOptional<_$zod.ZodString>;
+              required: _$zod.ZodBoolean;
+              secret: _$zod.ZodBoolean;
+              sourceHints: _$zod.ZodArray<_$zod.ZodObject<{
+                kind: _$zod.ZodLiteral<"environment">;
+                variable: _$zod.ZodString;
+              }, _$zod_v4_core0.$strict>>;
+            }, _$zod_v4_core0.$strict>>;
+          }, _$zod_v4_core0.$strict>;
+          credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"inferred">;
+          method: _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"inferred">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+          account: _$zod.ZodOptional<_$zod.ZodObject<{
+            managerId: _$zod.ZodString;
+            accountId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"none">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"none">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+        }, _$zod_v4_core0.$strict>], "mode">;
         capabilities: _$zod.ZodOptional<_$zod.ZodType<Record<string, unknown>, Record<string, unknown>, _$zod_v4_core0.$ZodTypeInternals<Record<string, unknown>, Record<string, unknown>>>>;
-      }, _$zod_v4_core0.$strip>>;
+      }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"unresolved">;
+      }, _$zod_v4_core0.$strict>], "state">>;
       ephemeral: _$zod.ZodOptional<_$zod.ZodBoolean>;
       cwd: _$zod.ZodOptional<_$zod.ZodString>;
       allowedTools: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
@@ -4486,18 +5062,82 @@ declare const AdapterSchemas: {
           exposed: _$zod.ZodBoolean;
         }, _$zod_v4_core0.$strip>>;
       }, _$zod_v4_core0.$strip>]>>;
-      providerContext: _$zod.ZodOptional<_$zod.ZodObject<{
+      providerContext: _$zod.ZodOptional<_$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"resolved">;
         providerConfigId: _$zod.ZodString;
         definitionId: _$zod.ZodString;
         endpointOverrides: _$zod.ZodOptional<_$zod.ZodObject<{
           anthropic: _$zod.ZodOptional<_$zod.ZodString>;
           openai: _$zod.ZodOptional<_$zod.ZodString>;
         }, _$zod_v4_core0.$strip>>;
-        credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
-        credentialEnvVars: _$zod.ZodOptional<_$zod.ZodRecord<_$zod.ZodString, _$zod.ZodString>>;
-        ambientCredentialEnvVars: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
+        auth: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"explicit">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"explicit">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+            fields: _$zod.ZodArray<_$zod.ZodObject<{
+              id: _$zod.ZodString;
+              label: _$zod.ZodString;
+              description: _$zod.ZodOptional<_$zod.ZodString>;
+              required: _$zod.ZodBoolean;
+              secret: _$zod.ZodBoolean;
+              sourceHints: _$zod.ZodArray<_$zod.ZodObject<{
+                kind: _$zod.ZodLiteral<"environment">;
+                variable: _$zod.ZodString;
+              }, _$zod_v4_core0.$strict>>;
+            }, _$zod_v4_core0.$strict>>;
+          }, _$zod_v4_core0.$strict>;
+          credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"inferred">;
+          method: _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"inferred">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+          account: _$zod.ZodOptional<_$zod.ZodObject<{
+            managerId: _$zod.ZodString;
+            accountId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"none">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"none">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+        }, _$zod_v4_core0.$strict>], "mode">;
         capabilities: _$zod.ZodOptional<_$zod.ZodType<Record<string, unknown>, Record<string, unknown>, _$zod_v4_core0.$ZodTypeInternals<Record<string, unknown>, Record<string, unknown>>>>;
-      }, _$zod_v4_core0.$strip>>;
+      }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"unresolved">;
+      }, _$zod_v4_core0.$strict>], "state">>;
       ephemeral: _$zod.ZodOptional<_$zod.ZodBoolean>;
       cwd: _$zod.ZodOptional<_$zod.ZodString>;
       allowedTools: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
@@ -4991,18 +5631,82 @@ declare const AdapterSchemas: {
           exposed: _$zod.ZodBoolean;
         }, _$zod_v4_core0.$strip>>;
       }, _$zod_v4_core0.$strip>]>>;
-      providerContext: _$zod.ZodOptional<_$zod.ZodObject<{
+      providerContext: _$zod.ZodOptional<_$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"resolved">;
         providerConfigId: _$zod.ZodString;
         definitionId: _$zod.ZodString;
         endpointOverrides: _$zod.ZodOptional<_$zod.ZodObject<{
           anthropic: _$zod.ZodOptional<_$zod.ZodString>;
           openai: _$zod.ZodOptional<_$zod.ZodString>;
         }, _$zod_v4_core0.$strip>>;
-        credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
-        credentialEnvVars: _$zod.ZodOptional<_$zod.ZodRecord<_$zod.ZodString, _$zod.ZodString>>;
-        ambientCredentialEnvVars: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
+        auth: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"explicit">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"explicit">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+            fields: _$zod.ZodArray<_$zod.ZodObject<{
+              id: _$zod.ZodString;
+              label: _$zod.ZodString;
+              description: _$zod.ZodOptional<_$zod.ZodString>;
+              required: _$zod.ZodBoolean;
+              secret: _$zod.ZodBoolean;
+              sourceHints: _$zod.ZodArray<_$zod.ZodObject<{
+                kind: _$zod.ZodLiteral<"environment">;
+                variable: _$zod.ZodString;
+              }, _$zod_v4_core0.$strict>>;
+            }, _$zod_v4_core0.$strict>>;
+          }, _$zod_v4_core0.$strict>;
+          credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"inferred">;
+          method: _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"inferred">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+          account: _$zod.ZodOptional<_$zod.ZodObject<{
+            managerId: _$zod.ZodString;
+            accountId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"none">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"none">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+        }, _$zod_v4_core0.$strict>], "mode">;
         capabilities: _$zod.ZodOptional<_$zod.ZodType<Record<string, unknown>, Record<string, unknown>, _$zod_v4_core0.$ZodTypeInternals<Record<string, unknown>, Record<string, unknown>>>>;
-      }, _$zod_v4_core0.$strip>>;
+      }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"unresolved">;
+      }, _$zod_v4_core0.$strict>], "state">>;
       ephemeral: _$zod.ZodOptional<_$zod.ZodBoolean>;
       cwd: _$zod.ZodOptional<_$zod.ZodString>;
       allowedTools: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
@@ -5038,18 +5742,82 @@ declare const AdapterSchemas: {
         name: _$zod.ZodOptional<_$zod.ZodString>;
         strict: _$zod.ZodOptional<_$zod.ZodBoolean>;
       }, _$zod_v4_core0.$strict>>;
-      providerContext: _$zod.ZodOptional<_$zod.ZodObject<{
+      providerContext: _$zod.ZodOptional<_$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"resolved">;
         providerConfigId: _$zod.ZodString;
         definitionId: _$zod.ZodString;
         endpointOverrides: _$zod.ZodOptional<_$zod.ZodObject<{
           anthropic: _$zod.ZodOptional<_$zod.ZodString>;
           openai: _$zod.ZodOptional<_$zod.ZodString>;
         }, _$zod_v4_core0.$strip>>;
-        credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
-        credentialEnvVars: _$zod.ZodOptional<_$zod.ZodRecord<_$zod.ZodString, _$zod.ZodString>>;
-        ambientCredentialEnvVars: _$zod.ZodOptional<_$zod.ZodArray<_$zod.ZodString>>;
+        auth: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"explicit">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"explicit">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+            fields: _$zod.ZodArray<_$zod.ZodObject<{
+              id: _$zod.ZodString;
+              label: _$zod.ZodString;
+              description: _$zod.ZodOptional<_$zod.ZodString>;
+              required: _$zod.ZodBoolean;
+              secret: _$zod.ZodBoolean;
+              sourceHints: _$zod.ZodArray<_$zod.ZodObject<{
+                kind: _$zod.ZodLiteral<"environment">;
+                variable: _$zod.ZodString;
+              }, _$zod_v4_core0.$strict>>;
+            }, _$zod_v4_core0.$strict>>;
+          }, _$zod_v4_core0.$strict>;
+          credentialRefs: _$zod.ZodRecord<_$zod.ZodString, _$zod_v4_core0.$ZodBranded<_$zod.ZodString, "CredentialRef", "out">>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"inferred">;
+          method: _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"inferred">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+          account: _$zod.ZodOptional<_$zod.ZodObject<{
+            managerId: _$zod.ZodString;
+            accountId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>>;
+        }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+          mode: _$zod.ZodLiteral<"none">;
+          method: _$zod.ZodDiscriminatedUnion<[_$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"provider">;
+            providerDefinitionId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+            owner: _$zod.ZodLiteral<"client">;
+            clientId: _$zod.ZodString;
+            methodId: _$zod.ZodString;
+          }, _$zod_v4_core0.$strict>], "owner">;
+          definition: _$zod.ZodObject<{
+            id: _$zod.ZodString;
+            mode: _$zod.ZodLiteral<"none">;
+            label: _$zod.ZodString;
+            description: _$zod.ZodOptional<_$zod.ZodString>;
+          }, _$zod_v4_core0.$strict>;
+        }, _$zod_v4_core0.$strict>], "mode">;
         capabilities: _$zod.ZodOptional<_$zod.ZodType<Record<string, unknown>, Record<string, unknown>, _$zod_v4_core0.$ZodTypeInternals<Record<string, unknown>, Record<string, unknown>>>>;
-      }, _$zod_v4_core0.$strip>>;
+      }, _$zod_v4_core0.$strict>, _$zod.ZodObject<{
+        state: _$zod.ZodLiteral<"unresolved">;
+      }, _$zod_v4_core0.$strict>], "state">>;
     }, _$zod_v4_core0.$strip>;
     response: _$zod.ZodObject<{
       text: _$zod.ZodString;
@@ -5745,18 +6513,82 @@ declare const StartAgentSchema: {
         exposed: z.ZodBoolean;
       }, z.core.$strip>>;
     }, z.core.$strip>]>>;
-    providerContext: z.ZodOptional<z.ZodObject<{
+    providerContext: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+      state: z.ZodLiteral<"resolved">;
       providerConfigId: z.ZodString;
       definitionId: z.ZodString;
       endpointOverrides: z.ZodOptional<z.ZodObject<{
         anthropic: z.ZodOptional<z.ZodString>;
         openai: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>>;
-      credentialRefs: z.ZodRecord<z.ZodString, z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">>;
-      credentialEnvVars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-      ambientCredentialEnvVars: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      auth: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"explicit">;
+        method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+          owner: z.ZodLiteral<"provider">;
+          providerDefinitionId: z.ZodString;
+          methodId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+          owner: z.ZodLiteral<"client">;
+          clientId: z.ZodString;
+          methodId: z.ZodString;
+        }, z.core.$strict>], "owner">;
+        definition: z.ZodObject<{
+          id: z.ZodString;
+          mode: z.ZodLiteral<"explicit">;
+          label: z.ZodString;
+          description: z.ZodOptional<z.ZodString>;
+          fields: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            label: z.ZodString;
+            description: z.ZodOptional<z.ZodString>;
+            required: z.ZodBoolean;
+            secret: z.ZodBoolean;
+            sourceHints: z.ZodArray<z.ZodObject<{
+              kind: z.ZodLiteral<"environment">;
+              variable: z.ZodString;
+            }, z.core.$strict>>;
+          }, z.core.$strict>>;
+        }, z.core.$strict>;
+        credentialRefs: z.ZodRecord<z.ZodString, z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">>;
+      }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"inferred">;
+        method: z.ZodObject<{
+          owner: z.ZodLiteral<"client">;
+          clientId: z.ZodString;
+          methodId: z.ZodString;
+        }, z.core.$strict>;
+        definition: z.ZodObject<{
+          id: z.ZodString;
+          mode: z.ZodLiteral<"inferred">;
+          label: z.ZodString;
+          description: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        account: z.ZodOptional<z.ZodObject<{
+          managerId: z.ZodString;
+          accountId: z.ZodString;
+        }, z.core.$strict>>;
+      }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"none">;
+        method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+          owner: z.ZodLiteral<"provider">;
+          providerDefinitionId: z.ZodString;
+          methodId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+          owner: z.ZodLiteral<"client">;
+          clientId: z.ZodString;
+          methodId: z.ZodString;
+        }, z.core.$strict>], "owner">;
+        definition: z.ZodObject<{
+          id: z.ZodString;
+          mode: z.ZodLiteral<"none">;
+          label: z.ZodString;
+          description: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+      }, z.core.$strict>], "mode">;
       capabilities: z.ZodOptional<z.ZodType<Record<string, unknown>, Record<string, unknown>, z.core.$ZodTypeInternals<Record<string, unknown>, Record<string, unknown>>>>;
-    }, z.core.$strip>>;
+    }, z.core.$strict>, z.ZodObject<{
+      state: z.ZodLiteral<"unresolved">;
+    }, z.core.$strict>], "state">>;
     ephemeral: z.ZodOptional<z.ZodBoolean>;
     cwd: z.ZodOptional<z.ZodString>;
     allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -6253,18 +7085,82 @@ declare const StartAgentSchema: {
         exposed: z.ZodBoolean;
       }, z.core.$strip>>;
     }, z.core.$strip>]>>;
-    providerContext: z.ZodOptional<z.ZodObject<{
+    providerContext: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+      state: z.ZodLiteral<"resolved">;
       providerConfigId: z.ZodString;
       definitionId: z.ZodString;
       endpointOverrides: z.ZodOptional<z.ZodObject<{
         anthropic: z.ZodOptional<z.ZodString>;
         openai: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>>;
-      credentialRefs: z.ZodRecord<z.ZodString, z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">>;
-      credentialEnvVars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-      ambientCredentialEnvVars: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      auth: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"explicit">;
+        method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+          owner: z.ZodLiteral<"provider">;
+          providerDefinitionId: z.ZodString;
+          methodId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+          owner: z.ZodLiteral<"client">;
+          clientId: z.ZodString;
+          methodId: z.ZodString;
+        }, z.core.$strict>], "owner">;
+        definition: z.ZodObject<{
+          id: z.ZodString;
+          mode: z.ZodLiteral<"explicit">;
+          label: z.ZodString;
+          description: z.ZodOptional<z.ZodString>;
+          fields: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            label: z.ZodString;
+            description: z.ZodOptional<z.ZodString>;
+            required: z.ZodBoolean;
+            secret: z.ZodBoolean;
+            sourceHints: z.ZodArray<z.ZodObject<{
+              kind: z.ZodLiteral<"environment">;
+              variable: z.ZodString;
+            }, z.core.$strict>>;
+          }, z.core.$strict>>;
+        }, z.core.$strict>;
+        credentialRefs: z.ZodRecord<z.ZodString, z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">>;
+      }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"inferred">;
+        method: z.ZodObject<{
+          owner: z.ZodLiteral<"client">;
+          clientId: z.ZodString;
+          methodId: z.ZodString;
+        }, z.core.$strict>;
+        definition: z.ZodObject<{
+          id: z.ZodString;
+          mode: z.ZodLiteral<"inferred">;
+          label: z.ZodString;
+          description: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        account: z.ZodOptional<z.ZodObject<{
+          managerId: z.ZodString;
+          accountId: z.ZodString;
+        }, z.core.$strict>>;
+      }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"none">;
+        method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+          owner: z.ZodLiteral<"provider">;
+          providerDefinitionId: z.ZodString;
+          methodId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+          owner: z.ZodLiteral<"client">;
+          clientId: z.ZodString;
+          methodId: z.ZodString;
+        }, z.core.$strict>], "owner">;
+        definition: z.ZodObject<{
+          id: z.ZodString;
+          mode: z.ZodLiteral<"none">;
+          label: z.ZodString;
+          description: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+      }, z.core.$strict>], "mode">;
       capabilities: z.ZodOptional<z.ZodType<Record<string, unknown>, Record<string, unknown>, z.core.$ZodTypeInternals<Record<string, unknown>, Record<string, unknown>>>>;
-    }, z.core.$strip>>;
+    }, z.core.$strict>, z.ZodObject<{
+      state: z.ZodLiteral<"unresolved">;
+    }, z.core.$strict>], "state">>;
     ephemeral: z.ZodOptional<z.ZodBoolean>;
     cwd: z.ZodOptional<z.ZodString>;
     allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -6758,18 +7654,82 @@ declare const StartAgentSchema: {
         exposed: z.ZodBoolean;
       }, z.core.$strip>>;
     }, z.core.$strip>]>>;
-    providerContext: z.ZodOptional<z.ZodObject<{
+    providerContext: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+      state: z.ZodLiteral<"resolved">;
       providerConfigId: z.ZodString;
       definitionId: z.ZodString;
       endpointOverrides: z.ZodOptional<z.ZodObject<{
         anthropic: z.ZodOptional<z.ZodString>;
         openai: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>>;
-      credentialRefs: z.ZodRecord<z.ZodString, z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">>;
-      credentialEnvVars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-      ambientCredentialEnvVars: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      auth: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"explicit">;
+        method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+          owner: z.ZodLiteral<"provider">;
+          providerDefinitionId: z.ZodString;
+          methodId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+          owner: z.ZodLiteral<"client">;
+          clientId: z.ZodString;
+          methodId: z.ZodString;
+        }, z.core.$strict>], "owner">;
+        definition: z.ZodObject<{
+          id: z.ZodString;
+          mode: z.ZodLiteral<"explicit">;
+          label: z.ZodString;
+          description: z.ZodOptional<z.ZodString>;
+          fields: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            label: z.ZodString;
+            description: z.ZodOptional<z.ZodString>;
+            required: z.ZodBoolean;
+            secret: z.ZodBoolean;
+            sourceHints: z.ZodArray<z.ZodObject<{
+              kind: z.ZodLiteral<"environment">;
+              variable: z.ZodString;
+            }, z.core.$strict>>;
+          }, z.core.$strict>>;
+        }, z.core.$strict>;
+        credentialRefs: z.ZodRecord<z.ZodString, z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">>;
+      }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"inferred">;
+        method: z.ZodObject<{
+          owner: z.ZodLiteral<"client">;
+          clientId: z.ZodString;
+          methodId: z.ZodString;
+        }, z.core.$strict>;
+        definition: z.ZodObject<{
+          id: z.ZodString;
+          mode: z.ZodLiteral<"inferred">;
+          label: z.ZodString;
+          description: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        account: z.ZodOptional<z.ZodObject<{
+          managerId: z.ZodString;
+          accountId: z.ZodString;
+        }, z.core.$strict>>;
+      }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"none">;
+        method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+          owner: z.ZodLiteral<"provider">;
+          providerDefinitionId: z.ZodString;
+          methodId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+          owner: z.ZodLiteral<"client">;
+          clientId: z.ZodString;
+          methodId: z.ZodString;
+        }, z.core.$strict>], "owner">;
+        definition: z.ZodObject<{
+          id: z.ZodString;
+          mode: z.ZodLiteral<"none">;
+          label: z.ZodString;
+          description: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+      }, z.core.$strict>], "mode">;
       capabilities: z.ZodOptional<z.ZodType<Record<string, unknown>, Record<string, unknown>, z.core.$ZodTypeInternals<Record<string, unknown>, Record<string, unknown>>>>;
-    }, z.core.$strip>>;
+    }, z.core.$strict>, z.ZodObject<{
+      state: z.ZodLiteral<"unresolved">;
+    }, z.core.$strict>], "state">>;
     ephemeral: z.ZodOptional<z.ZodBoolean>;
     cwd: z.ZodOptional<z.ZodString>;
     allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -7280,27 +8240,174 @@ declare const AgentSelectionSchema: z.ZodObject<{
 //#endregion
 //#region core/contracts/src/adapter/schemas/provider-context.d.ts
 /**
- * Unresolved provider context passed on the public bus.
- *
- * Carries credential references (not plaintext) so credentials never
- * travel on the public bus. Connectors call `resolveConnectorCredentials()`
- * to obtain plaintext locally.
+ * Provider context whose persisted config and authentication method were
+ * resolved against the current provider/client definitions.
  */
-declare const ProviderContextSchema$1: z.ZodObject<{
+declare const ResolvedProviderContextSchema$1: z.ZodObject<{
+  state: z.ZodLiteral<"resolved">;
   providerConfigId: z.ZodString;
   definitionId: z.ZodString;
   endpointOverrides: z.ZodOptional<z.ZodObject<{
     anthropic: z.ZodOptional<z.ZodString>;
     openai: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>>;
-  credentialRefs: z.ZodRecord<z.ZodString, z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">>;
-  credentialEnvVars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-  ambientCredentialEnvVars: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  auth: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    mode: z.ZodLiteral<"explicit">;
+    method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+      owner: z.ZodLiteral<"provider">;
+      providerDefinitionId: z.ZodString;
+      methodId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+      owner: z.ZodLiteral<"client">;
+      clientId: z.ZodString;
+      methodId: z.ZodString;
+    }, z.core.$strict>], "owner">;
+    definition: z.ZodObject<{
+      id: z.ZodString;
+      mode: z.ZodLiteral<"explicit">;
+      label: z.ZodString;
+      description: z.ZodOptional<z.ZodString>;
+      fields: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        required: z.ZodBoolean;
+        secret: z.ZodBoolean;
+        sourceHints: z.ZodArray<z.ZodObject<{
+          kind: z.ZodLiteral<"environment">;
+          variable: z.ZodString;
+        }, z.core.$strict>>;
+      }, z.core.$strict>>;
+    }, z.core.$strict>;
+    credentialRefs: z.ZodRecord<z.ZodString, z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">>;
+  }, z.core.$strict>, z.ZodObject<{
+    mode: z.ZodLiteral<"inferred">;
+    method: z.ZodObject<{
+      owner: z.ZodLiteral<"client">;
+      clientId: z.ZodString;
+      methodId: z.ZodString;
+    }, z.core.$strict>;
+    definition: z.ZodObject<{
+      id: z.ZodString;
+      mode: z.ZodLiteral<"inferred">;
+      label: z.ZodString;
+      description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    account: z.ZodOptional<z.ZodObject<{
+      managerId: z.ZodString;
+      accountId: z.ZodString;
+    }, z.core.$strict>>;
+  }, z.core.$strict>, z.ZodObject<{
+    mode: z.ZodLiteral<"none">;
+    method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+      owner: z.ZodLiteral<"provider">;
+      providerDefinitionId: z.ZodString;
+      methodId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+      owner: z.ZodLiteral<"client">;
+      clientId: z.ZodString;
+      methodId: z.ZodString;
+    }, z.core.$strict>], "owner">;
+    definition: z.ZodObject<{
+      id: z.ZodString;
+      mode: z.ZodLiteral<"none">;
+      label: z.ZodString;
+      description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+  }, z.core.$strict>], "mode">;
   capabilities: z.ZodOptional<z.ZodType<Record<string, unknown>, Record<string, unknown>, z.core.$ZodTypeInternals<Record<string, unknown>, Record<string, unknown>>>>;
-}, z.core.$strip>;
+}, z.core.$strict>;
 /**
- * Inferred type for an unresolved provider context.
+ * Deliberately configless provider state.
+ *
+ * This state carries no partial provider or auth fields, so it cannot be
+ * misread as native authentication or an ambient-credential fallback.
  */
+declare const UnresolvedProviderContextSchema: z.ZodObject<{
+  state: z.ZodLiteral<"unresolved">;
+}, z.core.$strict>;
+/** Public refs-only provider execution context. */
+declare const ProviderContextSchema$1: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  state: z.ZodLiteral<"resolved">;
+  providerConfigId: z.ZodString;
+  definitionId: z.ZodString;
+  endpointOverrides: z.ZodOptional<z.ZodObject<{
+    anthropic: z.ZodOptional<z.ZodString>;
+    openai: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  auth: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    mode: z.ZodLiteral<"explicit">;
+    method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+      owner: z.ZodLiteral<"provider">;
+      providerDefinitionId: z.ZodString;
+      methodId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+      owner: z.ZodLiteral<"client">;
+      clientId: z.ZodString;
+      methodId: z.ZodString;
+    }, z.core.$strict>], "owner">;
+    definition: z.ZodObject<{
+      id: z.ZodString;
+      mode: z.ZodLiteral<"explicit">;
+      label: z.ZodString;
+      description: z.ZodOptional<z.ZodString>;
+      fields: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        required: z.ZodBoolean;
+        secret: z.ZodBoolean;
+        sourceHints: z.ZodArray<z.ZodObject<{
+          kind: z.ZodLiteral<"environment">;
+          variable: z.ZodString;
+        }, z.core.$strict>>;
+      }, z.core.$strict>>;
+    }, z.core.$strict>;
+    credentialRefs: z.ZodRecord<z.ZodString, z.core.$ZodBranded<z.ZodString, "CredentialRef", "out">>;
+  }, z.core.$strict>, z.ZodObject<{
+    mode: z.ZodLiteral<"inferred">;
+    method: z.ZodObject<{
+      owner: z.ZodLiteral<"client">;
+      clientId: z.ZodString;
+      methodId: z.ZodString;
+    }, z.core.$strict>;
+    definition: z.ZodObject<{
+      id: z.ZodString;
+      mode: z.ZodLiteral<"inferred">;
+      label: z.ZodString;
+      description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    account: z.ZodOptional<z.ZodObject<{
+      managerId: z.ZodString;
+      accountId: z.ZodString;
+    }, z.core.$strict>>;
+  }, z.core.$strict>, z.ZodObject<{
+    mode: z.ZodLiteral<"none">;
+    method: z.ZodDiscriminatedUnion<[z.ZodObject<{
+      owner: z.ZodLiteral<"provider">;
+      providerDefinitionId: z.ZodString;
+      methodId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+      owner: z.ZodLiteral<"client">;
+      clientId: z.ZodString;
+      methodId: z.ZodString;
+    }, z.core.$strict>], "owner">;
+    definition: z.ZodObject<{
+      id: z.ZodString;
+      mode: z.ZodLiteral<"none">;
+      label: z.ZodString;
+      description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+  }, z.core.$strict>], "mode">;
+  capabilities: z.ZodOptional<z.ZodType<Record<string, unknown>, Record<string, unknown>, z.core.$ZodTypeInternals<Record<string, unknown>, Record<string, unknown>>>>;
+}, z.core.$strict>, z.ZodObject<{
+  state: z.ZodLiteral<"unresolved">;
+}, z.core.$strict>], "state">;
+/** Provider context with a validated provider config and auth method. */
+type ResolvedProviderContext$1 = z.infer<typeof ResolvedProviderContextSchema$1>;
+/** Deliberately configless provider context. */
+type UnresolvedProviderContext = z.infer<typeof UnresolvedProviderContextSchema>;
+/** Runtime provider context union. */
 type ProviderContext$1 = z.infer<typeof ProviderContextSchema$1>;
 //#endregion
-export { AdapterNamespace as C, AdapterSchemas as S, StartAgentRequest as _, AgentSelection as a, AdapterRuntimeOptions$1 as b, AgentSelectionKindMap as c, SessionDiscoveredSchema$1 as d, SessionUsage as f, RehydrateAgentSchema as g, RehydrateAgentResponse as h, AdapterSelectionSchema as i, AgentSelectionSchema as l, RehydrateAgentRequest as m, ProviderContextSchema$1 as n, AgentSelectionBase as o, SessionUsageSchema as p, AdapterSelection as r, AgentSelectionBaseSchema as s, ProviderContext$1 as t, SessionDiscovered as u, StartAgentResponse as v, AdapterSubjects$1 as w, AdapterRuntimeOptionsSchema as x, StartAgentSchema as y };
+export { StartAgentSchema as C, AdapterNamespace as D, AdapterSchemas as E, AdapterSubjects$1 as O, StartAgentResponse as S, AdapterRuntimeOptionsSchema as T, SessionUsageSchema as _, UnresolvedProviderContext as a, RehydrateAgentSchema as b, AdapterSelectionSchema as c, AgentSelectionBaseSchema as d, AgentSelectionKindMap as f, SessionUsage as g, SessionDiscoveredSchema$1 as h, ResolvedProviderContextSchema$1 as i, AgentSelection as l, SessionDiscovered as m, ProviderContextSchema$1 as n, UnresolvedProviderContextSchema as o, AgentSelectionSchema as p, ResolvedProviderContext$1 as r, AdapterSelection as s, ProviderContext$1 as t, AgentSelectionBase as u, RehydrateAgentRequest as v, AdapterRuntimeOptions$1 as w, StartAgentRequest as x, RehydrateAgentResponse as y };