@makaio/framework 1.0.0-dev-1785407933303 → 1.0.0-dev-1786014320559

package/dist/{index-GHASUiem.d.mts → index-DBadVauL.d.mts}

@@ -1,4 +1,4 @@
-import { t as ContractStorageNamespaceDefinition } from "./storage-namespace-definition-BvlX0QV_.mjs";
+import { t as ContractStorageNamespaceDefinition } from "./storage-namespace-definition-BsnYAPot.mjs";
 import * as _$zod from "zod";
 import { z } from "zod";
 import * as _$_makaio_core0 from "@makaio/framework/core";

package/dist/{index-gUhidukN.d.mts → index-DI7-tIL3.d.mts}

@@ -1,5 +1,6 @@
+import { r as ExecutionTarget } from "./schemas-CeUI2i5j.mjs";
 import { IMakaioBus } from "@makaio/framework/bus";
-import { IMakaioSession, MakaioSessionAgent, Message, MessageInput, MessageOutcome, ResponseSchemaDescriptor, SessionContext, TurnInitiator } from "@makaio/framework/contracts";
+import { IMakaioSession, MakaioSessionAgent, Message, MessageInput, MessageOutcome, ReasoningLevelMap, ResponseSchemaDescriptor, SessionContext, TurnInitiator } from "@makaio/framework/contracts";
 
 //#region services/core/src/session/entities/turn.d.ts
 /**
@@ -541,6 +542,198 @@ declare class SessionTurnManager {
   private findTurnForCompletion;
 }
 //#endregion
+//#region services/core/src/session/utils/resolution.d.ts
+/**
+ * Resolve adapterName → adapterId for bus routing.
+ * Queries the adapters table for a local enabled instance.
+ * @param bus - Bus instance
+ * @param adapterName - Adapter type name
+ * @param machineId - Optional machine ID for deterministic local resolution
+ * @returns Canonical adapter ID for bus routing
+ * @throws if no enabled instance found for this adapterName
+ */
+declare function resolveAdapterId(bus: IMakaioBus, adapterName: string, machineId?: string): Promise<string>;
+/**
+ * The adapter instance an ownership act runs against, together with the machine
+ * whose namespace it acts in.
+ *
+ * **One value, because it is one key.** The ownership key is
+ * `(machine, adapter instance, provider session)` and an instance ID is derived
+ * from `(machineId, adapterName)`, so an act that took its instance from one
+ * source and its machine from another files itself under a pair nobody else
+ * computes. Carrying both halves in one object is what makes "instance and
+ * namespace come from one identity" structural rather than a rule every call
+ * site has to remember.
+ *
+ * `machineId` is absent for exactly one caller shape — one that named no machine
+ * and is therefore not acting for any: it gets the unscoped answer, the
+ * authority acts under its own composed identity, and there are no two
+ * identities to mix.
+ */
+interface OwnedAdapterInstance {
+  /** Live adapter instance every act of the attempt addresses. */
+  readonly adapterId: string;
+  /** Machine whose namespace those acts are filed under, or `undefined` when the caller named none. */
+  readonly machineId?: string;
+}
+/**
+ * An owned instance whose machine is named.
+ *
+ * The shape a path that performs a **keyed** ownership act needs, stated as a
+ * type so the requirement is checked rather than remembered: a keyed act files
+ * itself under `(machine, instance, provider session)`, so a path that can reach
+ * one may not hold an instance whose machine is unnamed. Wave 3 left exactly
+ * that hole — a fresh lead start reserves keyless, which hides the machine's
+ * absence, and then settles on the provider session the connector confirms,
+ * which does not.
+ */
+type MachineScopedAdapterInstance = OwnedAdapterInstance & {
+  readonly machineId: string;
+};
+/** What a caller knows about the instance it wants, before it is resolved. */
+interface OwnedAdapterInstanceTarget {
+  /** Adapter type name the instance belongs to. */
+  readonly adapterName: string;
+  /**
+   * Instance the caller named itself, when it named one.
+   *
+   * Only usable together with {@link OwnedAdapterInstanceTarget.machineId}: the
+   * derivation is one-way, so a named instance whose machine is unnamed is half
+   * an identity, and half an identity is worse than none.
+   */
+  readonly adapterId?: string;
+  /**
+   * Machine every act of this attempt names, or `undefined` when the caller
+   * names none.
+   */
+  readonly machineId?: string;
+  /**
+   * Instance this agent was last known to live on, offered as a fallback for the
+   * unscoped form only.
+   *
+   * A persisted instance goes stale across a runtime restart or a failover, so
+   * it is never preferred — but for a caller that names no machine it beats
+   * failing a whole recovery because a registry lookup was momentarily
+   * unavailable, and it cannot mix two identities because there is only one.
+   */
+  readonly storedAdapterId?: string;
+}
+/**
+ * Resolve the instance an attempt addresses **and** the machine it acts for, or
+ * answer that this runtime may not act at all.
+ *
+ * One seam for a rule that was split in three: a fresh resolution for every act
+ * (a persisted instance goes stale across a restart or a failover), the machine
+ * carried alongside it, and the refusal when the two cannot be produced
+ * together. Reserving against one instance and dispatching to another reserves
+ * in a namespace the dispatch never uses, and reserving under machine X while
+ * dispatching to machine R's instance builds a key no other actor computes — it
+ * collides with nothing, so it protects nothing, and the runtime that really
+ * owns that instance claims the same provider session beside it.
+ *
+ * **The three answers, and why each is the honest one:**
+ *
+ * - **A named instance with its machine** is returned unresolved. The caller
+ *   already holds both halves from one source — the selection schema refuses the
+ *   pair any other way — so there is nothing to look up and nothing to second-guess.
+ * - **A named instance without a machine** is `undefined`. This is the handler-side
+ *   half of the schema's refinement, and it is needed as well as the schema:
+ *   the test bus does not validate, and defaulting to this runtime's own identity
+ *   here is precisely the silent mis-key the refinement exists to prevent.
+ * - **No named instance** derives one. With a machine named, a derivation that
+ *   cannot answer is `undefined` — the stored instance may not stand in, because
+ *   the machine it belongs to cannot be recovered from it. With no machine named,
+ *   the attempt is unscoped in every act, so the stored instance is an honest
+ *   fallback.
+ *
+ * `undefined` means *this runtime may not act for that machine*, never *this
+ * failed*. Translating it is the caller's job, because only the caller knows
+ * what its own refusal looks like: a send defers the agent, a restart reports a
+ * non-native recovery, a start refuses to dispatch.
+ * @param bus - Bus the lookup is issued on.
+ * @param target - What the caller knows about the instance and the machine it acts for.
+ * @returns Both halves of the key, or `undefined` when this runtime may not act for that machine.
+ */
+declare function resolveOwnedAdapterInstance(bus: IMakaioBus, target: OwnedAdapterInstanceTarget): Promise<OwnedAdapterInstance | undefined>;
+/**
+ * Resolve supported reasoning levels for a model from provider definitions.
+ *
+ * Looks up the provider config by ID, finds the provider definition it belongs to,
+ * then finds the model's `supportedReasoningLevels` in the provider's `availableModels`
+ * catalog.
+ * @param bus - Bus instance for RPC calls
+ * @param providerConfigId - Canonical provider config ID (ProviderConfigRecord.id)
+ * @param model - Model identifier to look up in the provider's catalog
+ * @returns Object with `supportedReasoningLevels` when found, or `undefined` when not resolvable
+ */
+declare function resolveModelCapabilities(bus: IMakaioBus, providerConfigId: string | undefined, model: string | undefined): Promise<{
+  supportedReasoningLevels?: ReasoningLevelMap;
+} | undefined>;
+/**
+ * Resolves the effective execution target for a session.
+ * Priority: explicit executionTargetId → system default (local).
+ * @param bus - Makaio bus instance
+ * @param params - Resolution parameters from session context
+ * @returns Resolved execution target
+ */
+declare function resolveExecutionTarget(bus: IMakaioBus, params: {
+  executionTargetId?: string;
+}): Promise<ExecutionTarget>;
+//#endregion
+//#region services/core/src/session/handlers/session-start-error.d.ts
+/**
+ * Why a reserved start could not be completed, as a value the caller can branch
+ * on.
+ *
+ * Every member names a *modeled* outcome of the ownership seam, not a bug: a
+ * start that reaches a live connector can still be refused ownership of what
+ * that connector is talking to, and the caller has to be told which of those
+ * happened rather than being handed a message to match on.
+ */
+type SessionStartFailureCode = /** The adapter refused or threw; the reservation was rolled back or retired. */'start-failed'
+/**
+ * The connector is live but another generation owns the provider session it
+ * speaks to. The connector was stopped and the claims retired.
+ */
+| 'ownership-refused' /** The agent row is `disposed` or gone; the connector was stopped. */ | 'agent-unavailable'
+/**
+ * The settlement neither landed nor was refused on ownership grounds — a raw
+ * throw from one of its guarded acts, not a modeled answer. The attempt is
+ * torn down on the caller-owned paths: the connector is stopped best-effort,
+ * the attempt's tokens are retired as `abandoned`, and the row is committed
+ * `dead` — the durable state must not advertise a start whose settlement
+ * this process can no longer vouch for.
+ */
+| 'settlement-unresolved' /** A joined start left the row `starting` more often than the bounded re-read allows. */ | 'start-unresolved' /** Another start won the lead designation and the session still has no agents. */ | 'lead-conflict';
+/** A reserved start that did not end with a usable agent. */
+declare class SessionStartError extends Error {
+  readonly code: SessionStartFailureCode;
+  /**
+   * The named targets this call could not act for — exactly the set the
+   * `agent-unavailable` code refuses. Two producers fill it: a total deferral
+   * (every named agent's provider session is held by a generation this runtime
+   * does not own) and a stated-target send against a session with no agents
+   * (the named agents do not exist). The field deliberately does not separate
+   * the two, because the code does not either: which one it was is a statement
+   * about the session, carried by the message, not a distinct caller branch —
+   * in particular, no entry is guaranteed to be foreign-held-and-retryable.
+   *
+   * A response field is unreachable on a path that throws, and a send that
+   * silently reaches fewer agents than it was asked to is exactly the failure
+   * this contract refuses everywhere else. The field carries the set for
+   * in-process callers; the message names the agents as well, for anything
+   * crossing a transport that may not preserve custom error properties.
+   */
+  readonly deferredAgentIds?: readonly string[];
+  /**
+   * @param code - Which modeled outcome this is; the value callers branch on.
+   * @param message - Human-readable detail, including the identifiers involved.
+   * @param cause - Underlying failure, when one exists.
+   * @param deferredAgentIds - The named targets this call could not act for, when the send named any.
+   */
+  constructor(code: SessionStartFailureCode, message: string, cause?: unknown, deferredAgentIds?: readonly string[]);
+}
+//#endregion
 //#region services/core/src/session/handlers/abandon-handler.d.ts
 /**
  * Registers the session.abandon RPC handler.
@@ -602,6 +795,110 @@ declare function registerForkHandler(bus: IMakaioBus, machineId?: string): () =>
  */
 declare function registerMergeHandler(bus: IMakaioBus): () => void;
 //#endregion
+//#region services/core/src/session/handlers/in-flight-start-join.d.ts
+/** What a consumer does with an agent whose start it joined or arbitrated. */
+type StartResolution = /** The agent is usable as it stands. */'use' /** The agent is not part of this send: the row is gone, or terminal. */ | 'drop' /** The agent needs the ordinary fresh-with-history recovery. */ | 'recover';
+/** How a send's target set changed once every in-flight start was resolved. */
+interface InFlightStartResolution {
+  /** Agents that left the session's target set — deleted or `disposed` rows. */
+  readonly droppedAgentIds: ReadonlySet<string>;
+  /** Agents this send must recover before using. */
+  readonly recoveringAgentIds: ReadonlySet<string>;
+  /**
+   * The subset whose recovery this send claimed by **compare-and-swap**, not by
+   * consuming a local attempt.
+   *
+   * The two provenances carry different evidence and must not be treated alike.
+   * A locally joined attempt reported its own verdict: this process ran it, and
+   * it said whether a connector exists. A won compare-and-swap says only that
+   * this caller wrote a status first — the attempt it outran belongs to a
+   * process this runtime cannot see, and Wave 3 has no way to ask whether that
+   * process is alive (OQ-B, deferred to Wave 4). Writing `dead` does not make
+   * the agent dead, so a consumer must still find out for itself before opening
+   * a second lifecycle.
+   */
+  readonly arbitratedAgentIds: ReadonlySet<string>;
+}
+/**
+ * Apply the in-flight-start consumer rule to a session's agents.
+ *
+ * Runs *before* the liveness probe and before the fresh-start branch, and only
+ * for agents whose stored status is `starting` — every other row costs nothing.
+ * The ordering matters at both ends: probing a `starting` agent would find no
+ * registered connector and walk into a second lifecycle for an identity that
+ * already has one in flight, and an agent dropped here may be the session's last,
+ * which must then start fresh rather than fail for having no targets.
+ *
+ * Dropped agents are removed from `session.agents` in place, and every agent that
+ * survives is **replaced by the row this resolution read**, so every later step
+ * of the send sees both the target set and the identities this resolution
+ * produced. The second half matters as much as the first: a joined attempt can
+ * bind its agent to a different adapter instance, and a send that kept the
+ * pre-join snapshot would probe liveness and route at the instance that attempt
+ * moved off.
+ * @param bus - Bus the joins, reads and compare-and-swaps are issued on.
+ * @param session - Session whose agents are resolved; its `agents` are filtered and refreshed in place.
+ * @returns Which agents left the set, and which the send must recover.
+ */
+declare function resolveInFlightStarts(bus: IMakaioBus, session: IMakaioSession): Promise<InFlightStartResolution>;
+//#endregion
+//#region services/core/src/session/handlers/deferred-agents.d.ts
+/**
+ * Admit a send to the fresh-start branch, or refuse the targets it stated.
+ *
+ * **Decided before that branch runs, and the ordering is the whole point.**
+ * `lead-default` is the only form that asks for *an* agent rather than asserting
+ * something about the ones the session has; every other form states a target,
+ * and a session with no agents answers every such statement the same way. So
+ * only `lead-default` may bring a session its first agent:
+ *
+ * - **`explicit`** — the session cannot contain the ids the caller named, and
+ *   substituting a freshly started agent would answer a question nobody asked.
+ * - **`'all'`** — "all of them" of nothing is not a delivery, exactly as it is
+ *   not one when every target defers ({@link refuseTotalDeferral}).
+ *
+ * Either send was already decided at this moment, so starting a lead first only
+ * changes *what the failure leaves behind* — an agent row, a lead designation
+ * and a reserved provider session created by a send that never delivered.
+ *
+ * This admits, it does not clear: a named agent the session *has* may still turn
+ * out to be undrivable, which is what the post-recovery validation decides.
+ *
+ * `agent-unavailable` is reused rather than invented, exactly as
+ * {@link refuseTotalDeferral} reuses it: the code means "this runtime may not act
+ * for these agents", and an agent that does not exist is the strongest form of
+ * that, not a different fact. Only the named form carries `deferredAgentIds` — a
+ * throw makes the response field unreachable, so the ids travel on the error
+ * where there are ids to travel; a broadcast named none, and inventing a payload
+ * for it would say the session held agents it never held.
+ * @param caller - Log prefix of the send path raising this, e.g. `[session.sendMessage]`.
+ * @param sessionId - Session the send was for.
+ * @param session - Session as this send resolved it, after any in-flight start.
+ * @param targetSpec - The request's `agentIds`, as the schema models it.
+ * @throws A {@link SessionStartError} naming the agents, when the send named any.
+ */
+declare function admitFreshStartTargets(caller: string, sessionId: string, session: IMakaioSession, targetSpec: readonly string[] | 'all' | undefined): void;
+/**
+ * Refuse a send whose every target is held elsewhere.
+ *
+ * `agent-unavailable` is reused rather than invented: it already means "this
+ * runtime may not act for this agent". A broadcast with no recipient is not a
+ * delivery, and a caller that named its agents is owed the failure rather than
+ * a substitute.
+ *
+ * **Exported for the send pipelines a product composes itself.** *Whether* a
+ * total deferral is a refusal is a product decision — this framework's
+ * orchestrator and a product's may guard it differently — but the refusal it
+ * raises is one fact with one wording and one code, and a second copy of it is a
+ * second answer to "what did the caller just fail with". The caller names itself
+ * so the message still says where the send stopped.
+ * @param caller - Log prefix of the send path raising this, e.g. `[session.sendMessage]`.
+ * @param sessionId - Session the send was for.
+ * @param deferredAgentIds - Agents held by a generation this runtime does not own.
+ * @throws A {@link SessionStartError} naming the agents in both the field and the message.
+ */
+declare function refuseTotalDeferral(caller: string, sessionId: string, deferredAgentIds: ReadonlySet<string>): never;
+//#endregion
 //#region services/core/src/session/handlers/routing-lifecycle.d.ts
 /** Narrow ledger transition owned by SessionTurnManager and injected into routing. */
 interface TurnCompletionRecorder {
@@ -722,4 +1019,4 @@ declare function routeToAgentsCore(bus: IMakaioBus, session: IMakaioSession, age
   adapterId: string;
 }>, message: MessageInput, messageId: string, turn: Turn$1, deliveryMode: 'enqueue' | 'immediate' | undefined, onTurnComplete: TurnCompleteCallback, turnManager: TurnCompletionRecorder, sessionContext?: SessionContext, responseSchema?: ResponseSchemaDescriptor, assertDispatch?: () => void): Promise<readonly AgentDispatchOutcome[]>;
 //#endregion
-export { registerCompressHandler as a, SessionTurnManager as c, TurnContext as d, TurnPairStateChange as f, registerForkHandler as i, Turn$1 as l, TurnResult as m, routeToAgents as n, registerAttachHandler as o, TurnPairTerminalOutcome as p, registerMergeHandler as r, registerAbandonHandler as s, routeToAgentsCore as t, TurnConfig as u };
+export { Turn$1 as C, TurnPairTerminalOutcome as D, TurnPairStateChange as E, TurnResult as O, SessionTurnManager as S, TurnContext as T, OwnedAdapterInstanceTarget as _, InFlightStartResolution as a, resolveModelCapabilities as b, registerMergeHandler as c, registerAttachHandler as d, registerAbandonHandler as f, OwnedAdapterInstance as g, MachineScopedAdapterInstance as h, refuseTotalDeferral as i, registerForkHandler as l, SessionStartFailureCode as m, routeToAgents as n, StartResolution as o, SessionStartError as p, admitFreshStartTargets as r, resolveInFlightStarts as s, routeToAgentsCore as t, registerCompressHandler as u, resolveAdapterId as v, TurnConfig as w, resolveOwnedAdapterInstance as x, resolveExecutionTarget as y };

package/dist/index-DP3o_13U.d.mts

@@ -0,0 +1,165 @@
+import { z } from "zod";
+import * as _$_makaio_core0 from "@makaio/framework/core";
+import * as _$_makaio_contracts0 from "@makaio/framework/contracts";
+
+//#region core/contracts/src/automation-trigger/namespace.d.ts
+/**
+ * Framework-level automation trigger discovery bus schemas.
+ *
+ * Defines the RPC and event subjects for the automation trigger registry.
+ * The schema set covers:
+ *
+ * - `list` — query all currently registered trigger descriptors (RPC)
+ * - `changed` — emitted when the trigger registry changes (event)
+ *
+ * Callers use `list` to populate the Builder UI's trigger catalog.
+ * The `changed` event enables reactive updates without polling.
+ *
+ * Hosts that extend the trigger surface should register an additional
+ * host-owned namespace rather than merging subjects into this one.
+ */
+declare const AutomationTriggerSchemas: {
+  /**
+   * List all currently registered automation trigger descriptors (RPC).
+   *
+   * Returns the complete set of serializable descriptors contributed by all
+   * active extensions. Callers should re-query on {@link changed} events to
+   * keep their catalog current.
+   */
+  list: {
+    request: z.ZodObject<{}, z.core.$strip>;
+    response: z.ZodObject<{
+      triggers: z.ZodArray<z.ZodObject<{
+        kind: z.ZodString;
+        label: z.ZodString;
+        description: z.ZodString;
+        categories: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+        parameterSchema: z.ZodType<Record<string, _$_makaio_contracts0.JsonValue>, Record<string, _$_makaio_contracts0.JsonValue>, z.core.$ZodTypeInternals<Record<string, _$_makaio_contracts0.JsonValue>, Record<string, _$_makaio_contracts0.JsonValue>>>;
+        eventSchema: z.ZodType<Record<string, _$_makaio_contracts0.JsonValue>, Record<string, _$_makaio_contracts0.JsonValue>, z.core.$ZodTypeInternals<Record<string, _$_makaio_contracts0.JsonValue>, Record<string, _$_makaio_contracts0.JsonValue>>>;
+        workflowCompatible: z.ZodBoolean;
+      }, z.core.$strip>>;
+    }, z.core.$strip>;
+  };
+  /**
+   * Emitted when the automation trigger registry changes.
+   *
+   * Fired whenever an extension registers or deregisters its trigger batch.
+   * The `revision` counter monotonically increases so that subscribers can
+   * detect missed events. `kinds` is the exact union of the owner's previous
+   * and replacement batches, so consumers can refresh only identities whose
+   * registration may have changed without inferring ownership from a prefix.
+   */
+  changed: z.ZodObject<{
+    owner: z.ZodString;
+    revision: z.ZodNumber;
+    kinds: z.ZodArray<z.ZodString>;
+    reason: z.ZodEnum<{
+      registered: "registered";
+      deregistered: "deregistered";
+    }>;
+  }, z.core.$strip>;
+};
+/**
+ * Automation trigger discovery bus namespace.
+ *
+ * Registers the `automation-triggers` namespace with framework-level RPC and
+ * event subjects for the trigger registry. Use {@link AutomationTriggerSubjects}
+ * to access typed bus subject descriptors.
+ */
+declare const AutomationTriggerNamespace: _$_makaio_core0.BusNamespaceDefinition<"automation-triggers", {
+  /**
+   * List all currently registered automation trigger descriptors (RPC).
+   *
+   * Returns the complete set of serializable descriptors contributed by all
+   * active extensions. Callers should re-query on {@link changed} events to
+   * keep their catalog current.
+   */
+  list: {
+    request: z.ZodObject<{}, z.core.$strip>;
+    response: z.ZodObject<{
+      triggers: z.ZodArray<z.ZodObject<{
+        kind: z.ZodString;
+        label: z.ZodString;
+        description: z.ZodString;
+        categories: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+        parameterSchema: z.ZodType<Record<string, _$_makaio_contracts0.JsonValue>, Record<string, _$_makaio_contracts0.JsonValue>, z.core.$ZodTypeInternals<Record<string, _$_makaio_contracts0.JsonValue>, Record<string, _$_makaio_contracts0.JsonValue>>>;
+        eventSchema: z.ZodType<Record<string, _$_makaio_contracts0.JsonValue>, Record<string, _$_makaio_contracts0.JsonValue>, z.core.$ZodTypeInternals<Record<string, _$_makaio_contracts0.JsonValue>, Record<string, _$_makaio_contracts0.JsonValue>>>;
+        workflowCompatible: z.ZodBoolean;
+      }, z.core.$strip>>;
+    }, z.core.$strip>;
+  };
+  /**
+   * Emitted when the automation trigger registry changes.
+   *
+   * Fired whenever an extension registers or deregisters its trigger batch.
+   * The `revision` counter monotonically increases so that subscribers can
+   * detect missed events. `kinds` is the exact union of the owner's previous
+   * and replacement batches, so consumers can refresh only identities whose
+   * registration may have changed without inferring ownership from a prefix.
+   */
+  changed: z.ZodObject<{
+    owner: z.ZodString;
+    revision: z.ZodNumber;
+    kinds: z.ZodArray<z.ZodString>;
+    reason: z.ZodEnum<{
+      registered: "registered";
+      deregistered: "deregistered";
+    }>;
+  }, z.core.$strip>;
+}>;
+/**
+ * Typed subjects for automation trigger bus communication.
+ *
+ * Available subjects:
+ * - `AutomationTriggerSubjects['list']` — list registered triggers (RPC)
+ * - `AutomationTriggerSubjects['changed']` — trigger registry changed event
+ */
+declare const AutomationTriggerSubjects$1: _$_makaio_core0.BusSubjects<_$_makaio_core0.FlatSubjectDefinitions<"automation-triggers", {
+  /**
+   * List all currently registered automation trigger descriptors (RPC).
+   *
+   * Returns the complete set of serializable descriptors contributed by all
+   * active extensions. Callers should re-query on {@link changed} events to
+   * keep their catalog current.
+   */
+  list: {
+    request: z.ZodObject<{}, z.core.$strip>;
+    response: z.ZodObject<{
+      triggers: z.ZodArray<z.ZodObject<{
+        kind: z.ZodString;
+        label: z.ZodString;
+        description: z.ZodString;
+        categories: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+        parameterSchema: z.ZodType<Record<string, _$_makaio_contracts0.JsonValue>, Record<string, _$_makaio_contracts0.JsonValue>, z.core.$ZodTypeInternals<Record<string, _$_makaio_contracts0.JsonValue>, Record<string, _$_makaio_contracts0.JsonValue>>>;
+        eventSchema: z.ZodType<Record<string, _$_makaio_contracts0.JsonValue>, Record<string, _$_makaio_contracts0.JsonValue>, z.core.$ZodTypeInternals<Record<string, _$_makaio_contracts0.JsonValue>, Record<string, _$_makaio_contracts0.JsonValue>>>;
+        workflowCompatible: z.ZodBoolean;
+      }, z.core.$strip>>;
+    }, z.core.$strip>;
+  };
+  /**
+   * Emitted when the automation trigger registry changes.
+   *
+   * Fired whenever an extension registers or deregisters its trigger batch.
+   * The `revision` counter monotonically increases so that subscribers can
+   * detect missed events. `kinds` is the exact union of the owner's previous
+   * and replacement batches, so consumers can refresh only identities whose
+   * registration may have changed without inferring ownership from a prefix.
+   */
+  changed: z.ZodObject<{
+    owner: z.ZodString;
+    revision: z.ZodNumber;
+    kinds: z.ZodArray<z.ZodString>;
+    reason: z.ZodEnum<{
+      registered: "registered";
+      deregistered: "deregistered";
+    }>;
+  }, z.core.$strip>;
+}>, "automation-triggers">;
+/** Request payload for listing registered automation triggers. */
+type AutomationTriggerListRequest = z.infer<(typeof AutomationTriggerSchemas)['list']['request']>;
+/** Response payload for listing registered automation triggers. */
+type AutomationTriggerListResponse = z.infer<(typeof AutomationTriggerSchemas)['list']['response']>;
+/** Payload for the automation trigger registry changed event. */
+type AutomationTriggerChangedPayload = z.infer<(typeof AutomationTriggerSchemas)['changed']>;
+//#endregion
+export { AutomationTriggerSchemas as a, AutomationTriggerNamespace as i, AutomationTriggerListRequest as n, AutomationTriggerSubjects$1 as o, AutomationTriggerListResponse as r, AutomationTriggerChangedPayload as t };

package/dist/{index-DSBT83c0.d.mts → index-DcYAAJ0V.d.mts}

@@ -1,6 +1,6 @@
-import { i as CliContribution } from "./types-b54n1o57.mjs";
-import { c as ExtensionInfo } from "./index-CMgLxw14.mjs";
-import { r as WindowRegistry } from "./window-registry-BDnZLPVx.mjs";
+import { i as CliContribution } from "./types-Ce6LL25v.mjs";
+import { c as ExtensionInfo } from "./index-B6GOuxVy2.mjs";
+import { r as WindowRegistry } from "./window-registry-BLtVx3Iw.mjs";
 import { IMakaioBus } from "@makaio/framework/bus";
 import { ExtensionContributionProcessor, ExtensionService, ExtensionToken, MakaioExtension, NodeExtensionContext, StorageDialect, TrayManifest, VersionLiteral } from "@makaio/framework/contracts";
 
@@ -167,6 +167,9 @@ interface ExtensionCoordinatorOptions {
  * Non-critical failures are isolated so remaining extensions continue to start.
  * Critical extension failures abort boot because the host declared them mandatory.
  *
+ * Lifecycle transitions are serialized. Extension lifecycle callbacks must not
+ * await another coordinator lifecycle call, because it waits in the same lane.
+ *
  * During {@link load}, window manifests are registered into
  * {@link windowRegistry}, tray entries are collected into {@link trayEntries},
  * and CLI contributions are collected into {@link cliContributions}. Static
@@ -197,6 +200,10 @@ declare class ExtensionCoordinator {
   private loadOrder;
   private loaded;
   private started;
+  private shutdownRequested;
+  private shutdownPromise;
+  /** FIFO lane for lifecycle transitions that mutate extension entries. */
+  private lifecycleTail;
   private rpcCleanups;
   private readonly contributionProcessors;
   /**
@@ -286,6 +293,8 @@ declare class ExtensionCoordinator {
    *   critical package fails.
    */
   startAll(): Promise<void>;
+  /** Run the admitted startup transition in the coordinator lifecycle lane. */
+  private startAllInLifecycleLane;
   /**
    * Shut down all active packages in reverse dependency order.
    *
@@ -295,9 +304,12 @@ declare class ExtensionCoordinator {
    * together so the caller can treat termination as unclean.
    *
    * Safe to call even if {@link startAll} was never called.
+   * @returns A promise that settles after every admitted transition and teardown complete.
    * @throws An AggregateError when any package failed to shut down cleanly.
    */
   shutdown(): Promise<void>;
+  /** Run shutdown after every lifecycle transition admitted before shutdown. */
+  private shutdownInLifecycleLane;
   /**
    * Return the current state snapshot for all registered packages.
    * @returns Array of {@link ExtensionInfo} objects reflecting current observable states.
@@ -377,6 +389,15 @@ declare class ExtensionCoordinator {
    * @returns `true` on success, `false` when the state machine rejects.
    */
   handleSetEnabled(name: string, enabled: boolean): Promise<boolean>;
+  /**
+   * Schedule a lifecycle transition after every previously admitted transition.
+   *
+   * The tail recovers from failures so one rejected operation cannot strand
+   * later shutdown or toggle work behind a rejected promise.
+   * @param operation - Lifecycle transition to run exclusively.
+   * @returns The operation's result.
+   */
+  private enqueueLifecycle;
   /**
    * Create the shared extension-context helper host without exposing coordinator internals.
    * @returns Helper host for config resolution and ExtensionContext construction.