import { h as Simplify, r as CredentialSetProxyConfig, s as AnyZodObject, t as CredentialSetManifest } from "./schemas-DXcT2SRm.mjs";
import { z } from "zod";

//#region src/shared/primitive.d.ts
type PrimitiveKind = 'agent' | 'credential-set' | 'mcp-server' | 'messaging-gateway' | 'operation' | 'sandbox' | 'task' | 'trigger' | 'workflow';
/**
 * Base class for all Keystroke primitives. The `kind` discriminator lets
 * downstream code narrow primitive unions (e.g. `AnyAgentToolEntry =
 * AnyOperation | AnyWorkflow`) without resorting to structural `'x' in tool`
 * checks. Each subclass declares a literal `kind` matching its identity.
 */
declare abstract class Primitive<TManifest extends Record<string, unknown>> {
  abstract readonly kind: PrimitiveKind;
  abstract toManifest(): TManifest;
}
//#endregion
//#region src/credential-set/constants.d.ts
/**
 * Shared constants for the credential/connection system.
 * Defined in core (bottom of dependency chain) so all packages can import them.
 */
declare const CREDENTIAL_EXPOSURES: {
  readonly 'user-runtime': "user-runtime";
  readonly 'platform-only': "platform-only";
};
type CredentialExposure$1 = keyof typeof CREDENTIAL_EXPOSURES;
//#endregion
//#region src/credential-set/credential-type.d.ts
/** How the platform acquires and resolves credentials for this credential set. */
type CredentialType = 'oauth' | 'manual';
//#endregion
//#region src/credential-set/types.d.ts
type CredentialExposure = 'user-runtime' | 'platform-only';
interface CredentialSetConfig<TId extends string, TAuthSchema extends AnyZodObject> {
  readonly id: TId;
  /**
   * Human-readable label used in the web UI, CLI output, and vault-row display.
   * Defaults to the credential set's raw `id` when omitted.
   */
  readonly name?: string;
  readonly description?: string;
  readonly auth: TAuthSchema;
  /**
   * Declares how the platform resolves credentials for this id.
   *
   * - `'oauth'` — Keystroke-managed OAuth connect and refresh; vault holds auth keys.
   * - `'manual'` — user upload; vault decrypt and inject auth keys.
   */
  readonly credentialType: CredentialType;
  /**
   * Trust-boundary policy for runtime delivery. Defaults to `user-runtime`;
   */
  readonly exposure?: CredentialExposure;
  readonly proxy?: CredentialSetProxyConfig;
  /**
   * When true, the sandbox transport must pass resolved credential values as
   * literal strings instead of the usual `KS_CRED_*` placeholders the TLS
   * proxy replaces on outbound requests.
   */
  readonly needsRawSecret?: boolean;
}
/**
 * Extracts the `id` string literal from a `CredentialSet`.
 */
type CredentialSetId<TCredentialSet> = TCredentialSet extends {
  readonly id: infer TId extends string;
} ? TId : never;
/**
 * Infers the resolved auth value type (schema output) for a `CredentialSet`.
 */
type InferCredentialSetAuth<TCredentialSet> = TCredentialSet extends {
  readonly auth: infer TAuthSchema extends z.ZodTypeAny;
} ? z.output<TAuthSchema> : never;
/**
 * Infers the auth input value type (schema input, pre-transform) for a `CredentialSet`.
 */
type InferCredentialSetAuthInput<TCredentialSet> = TCredentialSet extends {
  readonly auth: infer TAuthSchema extends z.ZodTypeAny;
} ? z.input<TAuthSchema> : never;
type CredentialNamespace<TCredentialSets extends readonly AnyCredentialSet[], TCredentialId extends CredentialSetId<TCredentialSets[number]>> = InferCredentialSetAuth<Extract<TCredentialSets[number], {
  id: TCredentialId;
}>>;
type CredentialInputNamespace<TCredentialSets extends readonly AnyCredentialSet[], TCredentialId extends CredentialSetId<TCredentialSets[number]>> = InferCredentialSetAuthInput<Extract<TCredentialSets[number], {
  id: TCredentialId;
}>>;
type ResolvedCredentials<TCredentialSets extends readonly AnyCredentialSet[] | undefined> = TCredentialSets extends readonly AnyCredentialSet[] ? Simplify<{ readonly [TCredentialId in CredentialSetId<TCredentialSets[number]>]: CredentialNamespace<TCredentialSets, TCredentialId> }> : Record<string, never>;
type CredentialInputs<TCredentialSets extends readonly AnyCredentialSet[] | undefined> = TCredentialSets extends readonly AnyCredentialSet[] ? Simplify<{ readonly [TCredentialId in CredentialSetId<TCredentialSets[number]>]: CredentialInputNamespace<TCredentialSets, TCredentialId> }> : Record<string, never>;
type CredentialSetIdCollisionError<TDuplicateKey extends string> = {
  readonly __credentialSetError: 'DuplicateRuntimeKey';
  readonly duplicateKey: TDuplicateKey;
  readonly hint: 'Two credential sets share the same runtime key. Either rename one (id: "foo") or import the shared instance from a single module.';
};
/** Compile-time check that all credential set `id` values in a tuple are unique. */
type AssertUniqueCredentialSetIds<TCredentialSets extends readonly AnyCredentialSet[], TSeen extends string = never> = TCredentialSets extends readonly [infer TFirst extends AnyCredentialSet, ...infer TRest extends readonly AnyCredentialSet[]] ? CredentialSetId<TFirst> extends TSeen ? CredentialSetIdCollisionError<CredentialSetId<TFirst>> : AssertUniqueCredentialSetIds<TRest, TSeen | CredentialSetId<TFirst>> extends infer TRestResult ? TRestResult extends readonly AnyCredentialSet[] ? readonly [TFirst, ...TRestResult] : TRestResult : never : TCredentialSets;
//#endregion
//#region src/credential-set/CredentialSet.d.ts
declare class CredentialSet<TId extends string, TAuthSchema extends AnyZodObject> extends Primitive<CredentialSetManifest> {
  #private;
  readonly kind: "credential-set";
  readonly id: TId;
  readonly name: string;
  readonly description?: string;
  readonly auth: TAuthSchema;
  readonly credentialType: CredentialType;
  readonly exposure: CredentialExposure$1;
  readonly proxy?: CredentialSetProxyConfig;
  readonly needsRawSecret?: boolean;
  readonly credentialKeys: readonly string[];
  readonly optionalCredentialKeys: readonly string[];
  readonly storedCredentialKeys: readonly string[];
  readonly optionalStoredCredentialKeys: readonly string[];
  constructor(config: CredentialSetConfig<TId, TAuthSchema>);
  toManifest(): CredentialSetManifest;
}
interface AnyCredentialSet {
  readonly id: string;
  readonly name: string;
  readonly description?: string;
  readonly auth: z.ZodObject<any>;
  readonly credentialType: CredentialType;
  readonly exposure: CredentialExposure$1;
  readonly proxy?: CredentialSetProxyConfig;
  readonly needsRawSecret?: boolean;
  readonly credentialKeys: readonly string[];
  readonly optionalCredentialKeys: readonly string[];
  readonly storedCredentialKeys: readonly string[];
  readonly optionalStoredCredentialKeys: readonly string[];
  toManifest(): CredentialSetManifest;
}
interface CredentialSetManifestSource {
  readonly id: string;
  readonly name: string;
  readonly description?: string;
  readonly credentialType: CredentialType;
  readonly credentialKeys: readonly string[];
  readonly optionalCredentialKeys: readonly string[];
  readonly storedCredentialKeys: readonly string[];
  readonly optionalStoredCredentialKeys: readonly string[];
  toManifest(): CredentialSetManifest;
}
//#endregion
export { CredentialInputs as a, InferCredentialSetAuth as c, CredentialType as d, CredentialExposure$1 as f, AssertUniqueCredentialSetIds as i, InferCredentialSetAuthInput as l, CredentialSet as n, CredentialSetConfig as o, Primitive as p, CredentialSetManifestSource as r, CredentialSetId as s, AnyCredentialSet as t, ResolvedCredentials as u };