@makaio/framework 1.0.0-dev-1783705652236 → 1.0.0-dev-1783973359164

package/dist/{types-BrUOVfwe.d.mts → types-DvKaEOOn.d.mts}

@@ -1,7 +1,8 @@
 import { z } from "zod";
-import { ExtractSubjectPayload, ExtractSubjectResponse, HandlerForSubjectDefinition, ScopedSubjectDefinition, SubjectRecord } from "@makaio/framework/core";
+import { AuthenticationError, ExtractSubjectPayload, ExtractSubjectResponse, HandlerForSubjectDefinition, ScopedSubjectDefinition, SubjectRecord } from "@makaio/framework/core";
 import { IFilteredBus, IMakaioBus, OnOptions, ScopedBus } from "@makaio/framework/bus";
-import { AIModel, AIReasoningLevel, AIReasoningLevel as AIReasoningLevel$1, AgentSchemas, AgentSubjects, CacheStrategy, JsonValue, McpRuntimeSessionContext, McpSessionContext, McpToolState, Message, MessageBlock, MessageDeliveryMode, MessageDeliveryMode as MessageDeliveryMode$1, MessageInput, MessageOutcome, NativeForkDirective, ProviderContext, ReasoningLevelMap as ReasoningLevelMap$1, RequestCorrelationContext, ResponseSchemaDescriptor, SendMessageResultInnerResult, SessionContext, StructuredOutputValidation, SystemPrompt, ToolListItem } from "@makaio/framework/contracts";
+import { AIModel, AIReasoningLevel, AIReasoningLevel as AIReasoningLevel$1, AdapterAuthBinding, AdapterAuthConstant, AdapterProviderAuth, AdapterProviderDefinitionContract, AgentSchemas, AgentSubjects, AuthCredentialRef, CacheStrategy, JsonValue, McpRuntimeSessionContext, McpSessionContext, McpToolState, Message, MessageBlock, MessageDeliveryMode, MessageDeliveryMode as MessageDeliveryMode$1, MessageInput, MessageOutcome, NativeForkDirective, ProtocolId, ProviderContext, ReasoningLevelMap as ReasoningLevelMap$1, RequestCorrelationContext, ResolvedProviderAuth, ResponseSchemaDescriptor, SendMessageResultInnerResult, SessionContext, StructuredOutputValidation, SystemPrompt, ToolListItem } from "@makaio/framework/contracts";
+import { ClientExecutionContext } from "@makaio/framework/contracts/client";
 import { DeferredPromise, TimeoutConfig, TrackedTimeoutConfig } from "@makaio/framework/utils";
 import { SetRequired } from "type-fest";
 
@@ -240,6 +241,13 @@ interface MessageHandleOptions {
    * `user_message.sent` event is emitted for the synthetic retry message.
    */
   internalRetry?: boolean;
+  /**
+   * Lifecycle turnId from the session orchestrator. Distinct from
+   * `requestCorrelation.turnId` (transport correlation, which may be present
+   * when no lifecycle turn exists): all user_message lifecycle events for the
+   * handle pair by this value.
+   */
+  turnId?: string;
 }
 /**
  * Processing state for agent orchestration.
@@ -279,6 +287,14 @@ declare class MessageHandle {
   readonly internalRetry: boolean;
   /** Content-free transport correlation for provider requests. */
   readonly requestCorrelation?: RequestCorrelationContext | undefined;
+  /**
+   * Lifecycle turnId from the session orchestrator (`agent.sendMessage.turnId`).
+   * Distinct from `requestCorrelation.turnId`, which is transport correlation
+   * and may be present when no lifecycle turn exists. All user_message
+   * lifecycle events for this handle (sent/acknowledged/completed) pair by
+   * this value.
+   */
+  readonly turnId?: string | undefined;
   protected readonly deferredCompletion: DeferredPromise<MessageResult>;
   protected readonly deferredAcknowledgement: DeferredPromise<boolean>;
   state: MessageState;
@@ -323,7 +339,16 @@ declare class MessageHandle {
 
   cacheStrategy?: CacheStrategy, /** Content-free transport correlation for provider requests. */
 
-  requestCorrelation?: RequestCorrelationContext | undefined);
+  requestCorrelation?: RequestCorrelationContext | undefined,
+  /**
+   * Lifecycle turnId from the session orchestrator (`agent.sendMessage.turnId`).
+   * Distinct from `requestCorrelation.turnId`, which is transport correlation
+   * and may be present when no lifecycle turn exists. All user_message
+   * lifecycle events for this handle (sent/acknowledged/completed) pair by
+   * this value.
+   */
+
+  turnId?: string | undefined);
   /**
    * Curated message history from sessionContext
    * @returns The message history array or undefined if not set
@@ -760,11 +785,16 @@ interface ConfigFactoryInput<TBus extends ScopedBus<string> = ScopedBus<string>>
   adapterId: string;
   /** Adapter type name (required - provided by AIAgent from adapter) */
   adapterName: string;
-  /**
-   * Unresolved provider context (credential refs, not plaintext).
-   * Connectors resolve credentials locally via `resolveConnectorCredentials()`.
-   */
+  /** Refs-only normalized provider selection consumed by the common auth runtime. */
   providerContext: ProviderContext;
+  /** Exact HTTP protocol declared by the selected adapter/provider reference. */
+  providerProtocol?: ProtocolId;
+  /** Adapter/provider auth metadata selected by `providerContext.definitionId`. */
+  adapterProviderAuth?: AdapterProviderAuth;
+  /** Other adapter/provider auth declarations contributing to the scrub union. */
+  compatibleProviderAuths?: readonly AdapterProviderAuth[];
+  /** Whether this adapter rejects the unresolved provider state. */
+  providerContextRequired?: boolean;
   /** Provider's session ID for resuming existing conversations */
   adapterSessionId?: string;
   /** Makaio session ID for tool execution context and multi-session correlation */
@@ -843,6 +873,175 @@ interface IAdapterConfigFactory<TConfig extends BaseAgentConnectorConfig, TBus e
   getConfig(input: ConfigFactoryInput<TBus>): Promise<TConfig>;
 }
 //#endregion
+//#region adapters/core/src/types/provider-definition.d.ts
+/**
+ * Runtime adapter provider definition pairing a serializable provider definition
+ * with optional runtime-only provider configuration metadata.
+ *
+ * Aliases {@link AdapterProviderDefinitionContract} from `@makaio/contracts`,
+ * the single source of truth for the `definition` and `configSchema` fields.
+ * The domain-specific name keeps adapter implementation signatures readable
+ * without creating a second provider-definition contract.
+ *
+ * Each adapter exports an array of these from its `definition.ts` (via `providers`).
+ * The `definition` field contains serializable data (models, endpoints, etc.).
+ * Config schemas are runtime-only — used for UI form generation, never serialized.
+ */
+type AdapterProviderDefinition = AdapterProviderDefinitionContract;
+//#endregion
+//#region adapters/core/src/config/resolve-adapter-auth.d.ts
+/** Stable normalized adapter-auth failure categories. */
+type AdapterAuthErrorReason = 'provider-context-unresolved' | 'binding-missing' | 'binding-ambiguous' | 'client-mismatch' | 'credential-resolution-failed' | 'credential-missing' | 'runtime-bus-missing' | 'native-auth-unavailable';
+/** Typed, credential-free failure at the normalized adapter-auth boundary. */
+declare class AdapterAuthError extends AuthenticationError {
+  readonly reason: AdapterAuthErrorReason;
+  /**
+   * Create a normalized adapter-auth failure.
+   * @param reason - Stable failure category
+   * @param message - Credential-free diagnostic
+   */
+  constructor(reason: AdapterAuthErrorReason, message: string);
+}
+/** Plaintext values produced by the trusted credential resolver. */
+type ResolvedAuthCredentialValues = Readonly<Record<string, string>>;
+/** Resolve normalized credential refs without exposing them outside the trusted consumer. */
+type ResolveAuthCredentialRefs = (credentialRefs: Readonly<Record<string, AuthCredentialRef>>) => Promise<ResolvedAuthCredentialValues>;
+/** Input for binding one normalized provider selection to an adapter declaration. */
+interface BindProviderAuthOptions {
+  /** Resolved provider authentication selection containing refs but no plaintext. */
+  readonly auth: ResolvedProviderAuth;
+  /** Authentication declaration for the selected adapter/provider junction. */
+  readonly adapterProviderAuth: AdapterProviderAuth;
+  /** Other compatible declarations whose environment sinks must also be scrubbed. */
+  readonly compatibleProviderAuths?: readonly AdapterProviderAuth[];
+}
+/** Immutable refs-only adapter binding emitted before connector-local resolution. */
+interface BoundProviderAuthContext {
+  /** Selected normalized provider authentication. */
+  readonly auth: ResolvedProviderAuth;
+  /** The single adapter delivery binding matching the selected method exactly. */
+  readonly binding: AdapterAuthBinding;
+  /** Complete adapter-wide environment variables removed before selected delivery. */
+  readonly scrubEnvVars: readonly string[];
+}
+/**
+ * Select optional field IDs from an explicit normalized auth selection.
+ *
+ * Trusted credential resolvers use this policy to omit only selected optional
+ * refs whose backing secret is unavailable. Keeping it next to the binding
+ * contract guarantees host and container materialization share one rule.
+ * @param bound - Exact provider/auth binding selected for one adapter runtime.
+ * @returns Field IDs whose unavailable refs may be omitted during resolution.
+ */
+declare function getOptionalAuthCredentialFields(bound: BoundProviderAuthContext): readonly string[];
+/** One immutable connector-owned authentication operation. */
+interface ResolvedConnectorAuthDelivery {
+  /** Adapter-specific operation identifier. */
+  readonly target: string;
+  /** Plaintext fields and constant/null suppressions consumed by the operation. */
+  readonly values: Readonly<Record<string, AdapterAuthConstant>>;
+}
+/** Immutable connector-local authentication snapshot. */
+interface ResolvedAdapterAuth {
+  /** Selected plaintext values delivered to a spawned process. */
+  readonly processEnv: Readonly<Record<string, string>>;
+  /** Selected adapter-specific connector operations. */
+  readonly connectorDeliveries: readonly ResolvedConnectorAuthDelivery[];
+  /** Native auth is inherited only for inferred methods. */
+  readonly configInheritance: 'auth-only' | 'empty';
+}
+/**
+ * Bind normalized provider authentication to one exact adapter delivery declaration.
+ *
+ * The result remains refs-only and can therefore travel through adapter configuration
+ * plumbing without exposing plaintext. Every object is cloned by schema parsing and
+ * deeply frozen so connector startup observes one stable selection.
+ * @param options - Selected auth plus selected and compatible adapter declarations.
+ * @returns Immutable refs-only provider auth binding.
+ */
+declare function bindProviderAuth(options: BindProviderAuthOptions): BoundProviderAuthContext;
+/**
+ * Resolve a bound provider auth context into one immutable connector-local snapshot.
+ *
+ * Explicit refs are resolved exactly once. Only required fields must materialize;
+ * unavailable optional fields are omitted from every delivery. Inferred and no-auth
+ * methods never invoke the credential resolver.
+ * @param bound - Immutable refs-only adapter binding.
+ * @param resolveCredentialRefs - Trusted local credential resolver.
+ * @returns Immutable plaintext delivery snapshot.
+ */
+declare function resolveBoundProviderAuth(bound: BoundProviderAuthContext, resolveCredentialRefs: ResolveAuthCredentialRefs): Promise<ResolvedAdapterAuth>;
+//#endregion
+//#region adapters/core/src/config/adapter-auth-runtime.d.ts
+/** Refs-only config emitted by the common adapter factory. */
+type BoundAdapterRuntimeConfig<TBus extends ScopedBus<string> = ScopedBus<string>, TConfig extends BaseAgentConnectorConfig<TBus> = BaseAgentConnectorConfig<TBus>> = TConfig & {
+  /** Adapter instance identifier required by connector factories. */adapterId: string; /** Exact normalized auth selection and adapter delivery binding. */
+  boundProviderAuth?: BoundProviderAuthContext;
+};
+/** Connector-facing config after auth refs and client state have been materialized. */
+type ResolvedAdapterRuntimeConfig<TBus extends ScopedBus<string> = ScopedBus<string>, TConfig extends BaseAgentConnectorConfig<TBus> = BaseAgentConnectorConfig<TBus>> = Omit<TConfig, 'boundProviderAuth'> & {
+  /** Adapter instance identifier required by connector factories. */adapterId: string; /** Selected connector-local auth delivery, including plaintext. */
+  adapterAuth?: ResolvedAdapterAuth; /** Selected managed client binary, when this adapter has a client. */
+  clientExecution?: ClientExecutionContext; /** Auth-free environment safe for routable/shared execution contexts. */
+  contextEnv: Readonly<Record<string, string>>;
+};
+/** Explicit connector-owned client config lease. */
+interface AdapterAuthLeaseHandle {
+  /** Client whose isolated config directory is leased. */
+  readonly clientId: string;
+  /** Connector-unique lease identifier. */
+  readonly leaseId: string;
+  /** Release the lease exactly once. Repeated calls share the same result. */
+  release(): Promise<void>;
+}
+/** Runtime config plus the lease whose lifetime must match its connector. */
+interface PreparedAdapterAuthRuntime<TBus extends ScopedBus<string> = ScopedBus<string>, TConfig extends BaseAgentConnectorConfig<TBus> = BaseAgentConnectorConfig<TBus>> {
+  /** Connector-facing config with one immutable auth snapshot. */
+  readonly config: ResolvedAdapterRuntimeConfig<TBus, TConfig>;
+  /** Explicit lease handle, present only for client-backed adapters. */
+  readonly lease?: AdapterAuthLeaseHandle;
+}
+/** Trusted non-serializable strategy for preparing auth in the current host. */
+type AdapterAuthRuntimePreparer<TBus extends ScopedBus<string> = ScopedBus<string>, TConfig extends BaseAgentConnectorConfig<TBus> = BaseAgentConnectorConfig<TBus>> = (config: BoundAdapterRuntimeConfig<TBus, TConfig>) => Promise<PreparedAdapterAuthRuntime<TBus, TConfig>>;
+/** Host-resolved auth material supplied to a runtime without local secret services. */
+interface SuppliedAdapterAuthRuntime {
+  /** Auth snapshot already compiled against the selected adapter binding by the host. */
+  readonly selectorValidatedAuth: ResolvedAdapterAuth;
+  /** Complete host-compiled adapter auth source/sink scrub union. */
+  readonly scrubEnvVars: readonly string[];
+  /** Non-auth session environment supplied by the host. */
+  readonly sessionEnv?: Readonly<Record<string, string>>;
+  /** Pre-resolved non-auth binary environment supplied by the host. */
+  readonly binaryEnv?: Readonly<Record<string, string>>;
+  /** Environment for an externally-owned config lease or mounted native state. */
+  readonly leaseEnv?: Readonly<Record<string, string>>;
+}
+/**
+ * Prepare the single connector-local auth snapshot and client config lease.
+ *
+ * Explicit credential refs are resolved exactly once through the encrypted
+ * credential channel. The existing session-environment helper remains the
+ * sole merge authority: it scrubs the full adapter set before selected auth
+ * values are applied last. The caller owns the returned lease and must release
+ * it in every connector close or rollback path.
+ * @param config - Refs-only config emitted by the adapter config factory
+ * @returns Connector-facing config and its explicit lease handle
+ */
+declare function prepareAdapterAuthRuntime<TBus extends ScopedBus<string>, TConfig extends BaseAgentConnectorConfig<TBus>>(config: BoundAdapterRuntimeConfig<TBus, TConfig>): Promise<PreparedAdapterAuthRuntime<TBus, TConfig>>;
+/**
+ * Apply host-resolved auth without opening credential channels or owning leases.
+ *
+ * This is the container/bootstrap seam. Its input must already have been
+ * selector-validated with {@link resolveBoundProviderAuth} by the trusted host.
+ * Every supplied non-auth source is merged before the full scrub union, then
+ * only the selected process delivery is injected. Connector deliveries remain
+ * structured values and are never serialized or logged here.
+ * @param config - Connector config containing only non-auth runtime inputs
+ * @param supplied - Host-compiled auth and non-auth environment sources
+ * @returns Connector-facing config with one immutable auth snapshot
+ */
+declare function applySuppliedAdapterAuthRuntime<TBus extends ScopedBus<string>, TConfig extends BaseAgentConnectorConfig<TBus>>(config: BoundAdapterRuntimeConfig<TBus, TConfig>, supplied: SuppliedAdapterAuthRuntime): Promise<ResolvedAdapterRuntimeConfig<TBus, TConfig>>;
+//#endregion
 //#region adapters/core/src/agent/types.d.ts
 /**
  * Core agent identity fields.
@@ -911,14 +1110,12 @@ interface BaseAgentConnectorConfig<TBus extends ScopedBus<string> = ScopedBus<st
    */
   providerConfigId?: string;
   /**
-   * Unresolved provider context (credential refs, not plaintext).
-   *
-   * Passed through from the factory input so connectors can call
-   * `resolveConnectorCredentials()` locally during initialization.
-   * Connectors must NOT read plaintext credentials from this field —
-   * they must resolve refs via `resolveConnectorCredentials()`.
+   * Refs-only normalized provider selection retained for runtime introspection.
+   * Plaintext authentication is available only through {@link adapterAuth}.
    */
   providerContext?: ProviderContext;
+  /** Exact HTTP protocol selected by the active adapter/provider reference. */
+  providerProtocol?: ProtocolId;
   providerConfig?: TProviderConfig;
   /**
    * Maps supported reasoning levels to provider-native values for the active model.
@@ -941,6 +1138,22 @@ interface BaseAgentConnectorConfig<TBus extends ScopedBus<string> = ScopedBus<st
   clientId?: string;
   /** Client profile name for session-scoped config isolation. */
   clientProfileName?: string;
+  /**
+   * Auth-free environment safe for bus-routable tool and MCP contexts.
+   *
+   * The central adapter runtime derives this from the same merged inputs as
+   * `env`, but omits the selected process authentication delivery.
+   */
+  contextEnv?: Readonly<Record<string, string>>;
+  /**
+   * Single connector-local normalized auth snapshot.
+   *
+   * Plaintext exists only on this trusted connector config and must never be
+   * emitted, persisted, stringified, or copied back into provider context.
+   */
+  adapterAuth?: ResolvedAdapterAuth;
+  /** Managed client binary selected by the central runtime, when applicable. */
+  clientExecution?: ClientExecutionContext;
   /** Callback when a user message is enqueued */
   onMessageSent?: (messageHandle: MessageHandle) => void;
   /**
@@ -987,11 +1200,7 @@ interface AIAgentConfig<TBus extends ScopedBus<string> = ScopedBus<string>, TCon
   adapterSessionId?: string;
   /** Makaio session identifier */
   sessionId?: string;
-  /**
-   * Unresolved provider context (credential refs, not plaintext).
-   * Set by the orchestrator before forwarding the startAgent request.
-   * Connectors resolve credentials locally via `resolveConnectorCredentials()`.
-   */
+  /** Refs-only normalized provider selection set by session orchestration. */
   providerContext?: ProviderContext;
   /** Previous adapter session ID for resume attempts (from recovery). */
   resumeAdapterSessionId?: string;
@@ -1001,6 +1210,8 @@ interface AIAgentConfig<TBus extends ScopedBus<string> = ScopedBus<string>, TCon
   clientId?: string;
   /** Client profile name for session-scoped config isolation. */
   clientProfileName?: string;
+  /** Trusted non-serializable auth preparation strategy injected by the host. */
+  prepareAuthRuntime?: AdapterAuthRuntimePreparer<TBus>;
   /** Global bus instance (defaults to MakaioBus singleton) */
   globalBus?: IMakaioBus;
   /** Scoped bus for adapter-specific events */
@@ -1011,6 +1222,8 @@ interface AIAgentConfig<TBus extends ScopedBus<string> = ScopedBus<string>, TCon
   nativeTools: string[];
   /** Available models for this adapter (used for context window lookup) */
   availableModels?: AIModel[];
+  /** Resolved provider definitions, including adapter-provider auth metadata. */
+  definitionProviders?: readonly AdapterProviderDefinition[];
   /** Allowed tool names (adapter-specific). Empty array = disable all tools. */
   allowedTools?: string[];
   /** Disallowed tool names (adapter-specific). Takes precedence over allowedTools. */
@@ -1120,6 +1333,13 @@ interface ConnectorSendMessageOptions extends AgentSendMessageOptions {
    * message handle and never materialized into the LLM-facing message.
    */
   requestCorrelation?: RequestCorrelationContext;
+  /**
+   * Lifecycle turnId from the session orchestrator (`agent.sendMessage.turnId`).
+   * Carried on the message handle so user_message lifecycle events pair by it.
+   * Distinct from `requestCorrelation.turnId`, which is transport correlation
+   * and may be present when no lifecycle turn exists.
+   */
+  turnId?: string;
   /**
    * Turn-scoped context assembled by PreUserMessage hooks and the orchestrator.
    * Extracted from sessionContext.turnContext by AIAgent.
@@ -1178,6 +1398,11 @@ type EmitteryEvents = {
 /**
  * Normalized usage metrics for a single agent call.
  * Adapter implementations normalize provider-specific usage data to this format.
+ *
+ * Derived from the `agent.usage` schema, so the mandatory `granularity` field
+ * is part of this type: adapters MUST declare the truthful measurement
+ * granularity of every usage signal they normalize (see
+ * `docs/architecture/adapters/usage-and-provenance.md`).
  */
 type NormalizedCallUsage = Omit<z.infer<typeof AgentSchemas.usage>, keyof AgentContext | 'model'>;
 /**
@@ -1205,6 +1430,14 @@ type AgentConnectorConfigOverrides = Partial<{
   adapterSessionId: string;
   resumeAdapterSessionId: string;
   mcpSessionContext: McpRuntimeSessionContext | McpSessionContext | LedgerSessionContext;
+  /**
+   * Target reasoning effort for the replacement generation. Key presence (not
+   * value) selects this over the live connector's current effort, so an
+   * explicit `undefined` builds a reasoning-less connector. Adapters may
+   * consume reasoning only at construction/start, so the replacement must be
+   * built with its target effort rather than mutated afterwards.
+   */
+  reasoningEffort: AIReasoningLevel$1 | undefined;
 }>;
 //#endregion
-export { MessageDeliveryMode$1 as A, AIReasoningLevel$1 as B, NormalizedCallUsage as C, ConfigFactoryInput as D, StartAgentOptions as E, MessageResult as F, ToolLedgerEntry as G, ISessionToolLedger as H, MessageState as I, ProcessingState as L, markCompletedWithFinalResult as M, NormalizedMessageInput as N, IAdapterConfigFactory as O, normalizeMessageInput as P, SendMessageOptions as R, GetCapabilitiesResponsePayload as S, SendMessageResponsePayload as T, LedgerSessionContext as U, ReasoningLevelMap$1 as V, SessionToolLedger as W, BaseAgentConnectorConfig as _, AgentCredentialChangeResponsePayload as a, ContextWindowInput as b, AgentIdentity as c, AgentMcpServersSetRequestPayload as d, AgentMcpServersSetResponsePayload as f, AgentStartResult as g, AgentSendMessageOptions as h, AgentCredentialChangeRequestPayload as i, MessageHandle as j, AIAgentConnector as k, AgentInterruptRequestPayload as l, AgentModelChangeResponsePayload as m, AgentConnectorConfigOverrides as n, AgentCwdChangeRequestPayload as o, AgentModelChangeRequestPayload as p, AgentContext as r, AgentCwdChangeResponsePayload as s, AIAgentConfig as t, AgentInterruptResponsePayload as u, ConnectorSendMessageOptions as v, SendMessageRequestPayload as w, ExecutionContext as x, ConnectorStartOptions as y, AIModel as z };
+export { NormalizedMessageInput as $, PreparedAdapterAuthRuntime as A, ResolvedAdapterAuth as B, NormalizedCallUsage as C, AdapterAuthLeaseHandle as D, StartAgentOptions as E, AdapterAuthError as F, resolveBoundProviderAuth as G, ResolvedConnectorAuthDelivery as H, AdapterAuthErrorReason as I, IAdapterConfigFactory as J, AdapterProviderDefinition as K, BindProviderAuthOptions as L, SuppliedAdapterAuthRuntime as M, applySuppliedAdapterAuthRuntime as N, AdapterAuthRuntimePreparer as O, prepareAdapterAuthRuntime as P, markCompletedWithFinalResult as Q, BoundProviderAuthContext as R, GetCapabilitiesResponsePayload as S, SendMessageResponsePayload as T, bindProviderAuth as U, ResolvedAuthCredentialValues as V, getOptionalAuthCredentialFields as W, MessageDeliveryMode$1 as X, AIAgentConnector as Y, MessageHandle as Z, BaseAgentConnectorConfig as _, AgentCredentialChangeResponsePayload as a, AIModel as at, ContextWindowInput as b, AgentIdentity as c, ISessionToolLedger as ct, AgentMcpServersSetRequestPayload as d, ToolLedgerEntry as dt, normalizeMessageInput as et, AgentMcpServersSetResponsePayload as f, AgentStartResult as g, AgentSendMessageOptions as h, AgentCredentialChangeRequestPayload as i, SendMessageOptions as it, ResolvedAdapterRuntimeConfig as j, BoundAdapterRuntimeConfig as k, AgentInterruptRequestPayload as l, LedgerSessionContext as lt, AgentModelChangeResponsePayload as m, AgentConnectorConfigOverrides as n, MessageState as nt, AgentCwdChangeRequestPayload as o, AIReasoningLevel$1 as ot, AgentModelChangeRequestPayload as p, ConfigFactoryInput as q, AgentContext as r, ProcessingState as rt, AgentCwdChangeResponsePayload as s, ReasoningLevelMap$1 as st, AIAgentConfig as t, MessageResult as tt, AgentInterruptResponsePayload as u, SessionToolLedger as ut, ConnectorSendMessageOptions as v, SendMessageRequestPayload as w, ExecutionContext as x, ConnectorStartOptions as y, ResolveAuthCredentialRefs as z };

package/dist/ui-hooks/index.d.mts

@@ -5,10 +5,10 @@ import { AdapterInfo, ComponentLike, NavigationGroupConfig, OnboardingContext, O
 import { ExtensionInfo } from "@makaio/framework/kernel";
 import { IMakaioBus } from "@makaio/framework/bus";
 import { AIModel, AgentSelection, ModelFilterMode, ModelVisibility, UiContextSnapshot, UiRuntimeNavigationLevel, UiScope } from "@makaio/framework/contracts";
-import { BindingRecord, ProviderConfigFileRecord } from "@makaio/framework/services/adapter-subsystem";
+import { BindingRecord, CompatibleAuthOption, ProviderConfigFileRecord } from "@makaio/framework/services/adapter-subsystem";
 import { LogImportMode } from "@makaio/framework/services/log-import/log-import";
+import { AuthMethodRef, ClientAuthMethodRef, NativeAccountSelection, ProviderConfigAuth } from "@makaio/framework/contracts/auth";
 import { EventHandler, EventMessagePayload, ExtractSubjectPayload, SubjectDefinition } from "@makaio/framework/core";
-import { CredentialRef } from "@makaio/framework/contracts/config";
 import { ModelFilterMode as ModelFilterMode$1, ModelVisibility as ModelVisibility$1, ProtocolEndpoints, ProtocolId } from "@makaio/framework/contracts/provider";
 
 //#region ui/hooks/src/bus/bus-provider.d.ts
@@ -1226,10 +1226,7 @@ interface ProviderConfigSummaryView extends ProviderConfigFileRecord {
 /**
  * UI-facing provider-config detail enriched with provider definition metadata.
  */
-interface ProviderConfigDetailView extends ProviderConfigSummaryView {
-  /** Credential refs resolved through the runtime context seam. */
-  credentialRefs?: Record<string, CredentialRef>;
-}
+type ProviderConfigDetailView = ProviderConfigSummaryView;
 /**
  * List provider-config summaries enriched for UI consumption.
  * @param bus - Bus used to load subsystem configs and provider definitions.
@@ -1241,11 +1238,93 @@ declare function listProviderConfigSummaryViews(bus: IMakaioBus, options?: {
 }): Promise<ProviderConfigSummaryView[]>;
 /**
  * Load one provider-config detail view enriched for UI consumption.
- * @param bus - Bus used to load subsystem config, provider metadata, and runtime context.
+ * @param bus - Bus used to load the safe config summary and provider metadata.
  * @param id - Provider-config identifier.
  * @returns Enriched detail view or `null` when missing.
  */
 declare function getProviderConfigDetailView(bus: IMakaioBus, id: string): Promise<ProviderConfigDetailView | null>;
+/**
+ * List adapter-deliverable authentication methods for one provider definition.
+ * @param bus - Bus used to query the adapter subsystem.
+ * @param definitionId - Provider definition whose auth methods are requested.
+ * @returns Safe method declarations with fields/source hints but no credential refs.
+ */
+declare function listCompatibleAuthOptions(bus: IMakaioBus, definitionId: string): Promise<CompatibleAuthOption[]>;
+//#endregion
+//#region ui/hooks/src/provider-config/auth-draft.d.ts
+/** One explicit credential field sourced from encrypted product storage. */
+interface StoredAuthFieldDraft {
+  readonly source: 'stored';
+  readonly value: string;
+}
+/** One explicit credential field sourced from a declared environment variable. */
+interface EnvironmentAuthFieldDraft {
+  readonly source: 'environment';
+  readonly variable: string;
+}
+/** UI selection for one explicit authentication field. */
+type AuthFieldDraft = StoredAuthFieldDraft | EnvironmentAuthFieldDraft;
+/** UI authentication selection before plaintext fields are persisted. */
+type ProviderConfigAuthDraft = {
+  readonly mode: 'explicit';
+  readonly method: AuthMethodRef;
+  readonly fields: Readonly<Record<string, AuthFieldDraft>>;
+} | {
+  readonly mode: 'inferred';
+  readonly method: ClientAuthMethodRef;
+  readonly account?: NativeAccountSelection;
+} | {
+  readonly mode: 'none';
+  readonly method: AuthMethodRef;
+};
+/** Normalized refs-only auth plus plaintext values that still need storage. */
+interface CompiledProviderConfigAuthDraft {
+  /** Canonical refs-only selection persisted in the provider config. */
+  readonly auth: ProviderConfigAuth;
+  /** Plaintext values destined for the encrypted credential service. */
+  readonly storedCredentials: Readonly<Record<string, string>>;
+}
+/**
+ * Create editable field drafts for one compatible authentication option.
+ * @param option - Exact adapter-compatible method selected by the UI.
+ * @returns Stored-source drafts for every explicit field, or an empty map for non-explicit methods.
+ */
+declare function createInitialAuthFieldDrafts(option: CompatibleAuthOption): Record<string, AuthFieldDraft>;
+/**
+ * Build one strict provider-config auth draft from an adapter-compatible option.
+ *
+ * This is the shared form boundary for onboarding and settings. It preserves
+ * optional omissions, rejects undeclared field/source selections, and keeps
+ * inferred account selection separate from explicit credential fields.
+ * @param option - Exact adapter-compatible method selected by the UI.
+ * @param fieldDrafts - Current explicit field-source/value drafts.
+ * @param account - Optional native account selected for an inferred method.
+ * @returns Complete mode-specific provider-config auth draft.
+ */
+declare function buildProviderConfigAuthDraft(option: CompatibleAuthOption, fieldDrafts?: Readonly<Record<string, AuthFieldDraft>>, account?: NativeAccountSelection): ProviderConfigAuthDraft;
+/**
+ * Build a collision-free owner-qualified key for UI method controls.
+ * @param method - Normalized provider- or client-owned auth method.
+ * @returns Stable key suitable for form control values.
+ */
+declare function authMethodRefKey(method: AuthMethodRef): string;
+/**
+ * Compile one UI auth draft into the canonical refs-only selection.
+ *
+ * Stored refs are deterministic from the final provider-config ID, allowing a
+ * disabled reservation to contain its final auth snapshot before plaintext is
+ * written. Environment-only, inferred, and no-auth drafts do not need an ID.
+ * @param draft - Complete UI authentication selection.
+ * @param providerConfigId - Final canonical ID when any field uses stored plaintext.
+ * @returns Canonical auth plus the plaintext subset that still needs storage.
+ */
+declare function compileProviderConfigAuthDraft(draft: ProviderConfigAuthDraft, providerConfigId?: string): CompiledProviderConfigAuthDraft;
+/**
+ * Return whether an auth draft contains at least one stored plaintext field.
+ * @param draft - UI authentication selection to inspect.
+ * @returns Whether the host-owned encrypted storage bridge is required.
+ */
+declare function authDraftRequiresStorage(draft: ProviderConfigAuthDraft): boolean;
 //#endregion
 //#region ui/hooks/src/onboarding/scan-onboarding-adapters.d.ts
 /**
@@ -1432,10 +1511,8 @@ interface OnboardingProviderConfigDraft {
   definitionId: string;
   /** Optional display name. */
   name?: string;
-  /** Plaintext credentials captured by a host step. */
-  credentials?: Record<string, string>;
-  /** Pre-resolved credential refs for externally managed credentials. */
-  credentialRefs?: Record<string, CredentialRef>;
+  /** Exactly one normalized authentication method and its UI field sources. */
+  auth: ProviderConfigAuthDraft;
   /** Optional endpoint overrides. */
   endpointOverrides?: ProtocolEndpoints;
   /** Optional per-model visibility overrides. */
@@ -1833,8 +1910,6 @@ interface ProviderInfo {
   enabled: boolean;
   /** Controls default visibility for models without explicit overrides. */
   modelFilterMode: ModelFilterMode;
-  /** True when at least one credential key exists in storage. */
-  hasCredentials: boolean;
   /** Sparse per-model visibility overrides. */
   modelVisibility?: Record<string, ModelVisibility>;
   /**
@@ -1885,6 +1960,20 @@ interface ProviderState {
 }
 declare const useProviderStore: UseBoundStore<StoreApi<ProviderState>>;
 //#endregion
+//#region ui/hooks/src/provider-config/use-compatible-auth-options.d.ts
+/** Reactive result for one definition's adapter-compatible auth methods. */
+interface UseCompatibleAuthOptionsResult {
+  readonly options: CompatibleAuthOption[];
+  readonly isLoading: boolean;
+  readonly error: Error | null;
+}
+/**
+ * Load the safe adapter-compatible authentication methods for one definition.
+ * @param definitionId - Provider definition ID, or empty while no definition is selected.
+ * @returns Current options plus loading and error state.
+ */
+declare function useCompatibleAuthOptions(definitionId: string): UseCompatibleAuthOptionsResult;
+//#endregion
 //#region ui/hooks/src/utils/persisted-agent-selection.d.ts
 type PersistableAdapterSelection = Extract<AgentSelection, {
   kind: 'adapter';
@@ -1912,4 +2001,4 @@ declare function parsePersistedAgentSelection(value: unknown): AgentSelection |
  */
 declare function isPersistableProjectSelection(selection: AgentSelection): selection is PersistableProjectSelection;
 //#endregion
-export { type AppContextState, type BoundAdapter, BusContext, BusProvider, type BusProviderProps, type CoreOnboardingStepComponents, type ExecutablePage, type ExtensionBrowserLoadOptions, type ExtensionBrowserLoadResult, type FocusContextId, type FocusContextLayout, type FocusContextObject, type FocusContextWidgetSize, type FocusState, type GroupedPages, type HealthCheckResult, type OnboardingAdapter, type OnboardingClient, type OnboardingFlowActions, type OnboardingFlowState, type OnboardingStepDefinition, type OnboardingStepProps, type PageOverlayState, type PersistableAdapterSelection, type PersistableProjectSelection, type PersistedExtensionConfigEntry, type PersistedStoreConfig, type PlacedFocusWidget, type ProviderConfigDetailView, type ProviderConfigSummaryView, type ProviderInfo, type RuntimeNavigationLevel, type ScanContext, type SharedLoaderState, type SidebarState, type StorageType, type UseBusQueryOptions, type UseBusQueryResult, type UseOnboardingFlowOptions, type UseOnboardingFlowResult, type UseWidgetConfigOptions, type UseWidgetConfigResult, type UseWidgetRegistryOptions, type UseWidgetsOptions, type UseWidgetsResult, type WindowContextState, addWidgetToFocusLayout, buildScanContext, clearOnboardingCompleted, clearOnboardingSkipped, createEmptyFocusContextLayout, createPersistedStore, getOnboardingCompleted, getOnboardingSkipped, getProviderConfigDetailView, groupPagesByNavigationGroup, isPersistableProjectSelection, listProviderConfigSummaryViews, loadExtensionBrowserContributions, noopStorage, parsePersistedAgentSelection, persistPluginEnabled, registerCoreOnboardingSteps, registerNavigationHandler, removeWidgetFromFocusLayout, scanOnboarding, scanOnboardingAdapters, scanOnboardingClients, setOnboardingCompleted, setOnboardingSkipped, updateFocusContextWidgetPosition, updateFocusContextWidgetSize, useAppContext, useBus, useBusEvent, useBusQuery, useFocusStore, useNavigationLevel, useOnboardingFlow, useOptionalBus, usePageComponent, usePageDefinitions, usePageOverlayStore, usePages, useProviderStore, useSidebarStore, useTrayLayout, useWidgetConfig, useWidgetLayout, useWidgetLayoutActions, useWidgetRegistry, useWidgets, useWindowContext, useWindowIdPages };
+export { type AppContextState, type AuthFieldDraft, type BoundAdapter, BusContext, BusProvider, type BusProviderProps, type CompiledProviderConfigAuthDraft, type CoreOnboardingStepComponents, type EnvironmentAuthFieldDraft, type ExecutablePage, type ExtensionBrowserLoadOptions, type ExtensionBrowserLoadResult, type FocusContextId, type FocusContextLayout, type FocusContextObject, type FocusContextWidgetSize, type FocusState, type GroupedPages, type HealthCheckResult, type OnboardingAdapter, type OnboardingClient, type OnboardingFlowActions, type OnboardingFlowState, type OnboardingProviderConfigCreator, type OnboardingProviderConfigDraft, type OnboardingStepDefinition, type OnboardingStepProps, type PageOverlayState, type PersistableAdapterSelection, type PersistableProjectSelection, type PersistedExtensionConfigEntry, type PersistedStoreConfig, type PlacedFocusWidget, type ProviderConfigAuthDraft, type ProviderConfigDetailView, type ProviderConfigSummaryView, type ProviderInfo, type RuntimeNavigationLevel, type ScanContext, type SharedLoaderState, type SidebarState, type StorageType, type StoredAuthFieldDraft, type UseBusQueryOptions, type UseBusQueryResult, type UseCompatibleAuthOptionsResult, type UseOnboardingFlowOptions, type UseOnboardingFlowResult, type UseWidgetConfigOptions, type UseWidgetConfigResult, type UseWidgetRegistryOptions, type UseWidgetsOptions, type UseWidgetsResult, type WindowContextState, addWidgetToFocusLayout, authDraftRequiresStorage, authMethodRefKey, buildProviderConfigAuthDraft, buildScanContext, clearOnboardingCompleted, clearOnboardingSkipped, compileProviderConfigAuthDraft, createEmptyFocusContextLayout, createInitialAuthFieldDrafts, createPersistedStore, getOnboardingCompleted, getOnboardingSkipped, getProviderConfigDetailView, groupPagesByNavigationGroup, isPersistableProjectSelection, listCompatibleAuthOptions, listProviderConfigSummaryViews, loadExtensionBrowserContributions, noopStorage, parsePersistedAgentSelection, persistPluginEnabled, registerCoreOnboardingSteps, registerNavigationHandler, removeWidgetFromFocusLayout, scanOnboarding, scanOnboardingAdapters, scanOnboardingClients, setOnboardingCompleted, setOnboardingSkipped, updateFocusContextWidgetPosition, updateFocusContextWidgetSize, useAppContext, useBus, useBusEvent, useBusQuery, useCompatibleAuthOptions, useFocusStore, useNavigationLevel, useOnboardingFlow, useOptionalBus, usePageComponent, usePageDefinitions, usePageOverlayStore, usePages, useProviderStore, useSidebarStore, useTrayLayout, useWidgetConfig, useWidgetLayout, useWidgetLayoutActions, useWidgetRegistry, useWidgets, useWindowContext, useWindowIdPages };