@theokit/agents 13.0.0-next.7 → 13.0.0-next.9

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # @theokit/agents
 
+## 13.0.0-next.9
+
+### Minor Changes
+
+- c59abf6: A foreign configuration root can be imported in part
+
+  `resolveCompatSources` returned the bare literal `'claude-code'`, which the SDK reads as "import
+  every surface" — hooks, plugins, skills, subagents. `settingSources.claudeCode.import` now names the
+  surfaces, and the resolved value carries them.
+
+  The distinction is the reason the grant exists: `.claude/` usually arrives with the clone and its
+  `hooks.json` executes shell, so "take the skills, refuse the hooks" is the ordinary thing to want,
+  and the only choices were all of it or none of it.
+
+  Absent `import` still means the whole root, so nothing existing changes. An EMPTY list is refused
+  rather than guessed: "no surfaces" and "unset, so all of them" are both defensible readings of `[]`,
+  they differ by whether shell executes, and picking one would settle a security question by
+  convention.
+
+  `CompatSurface` and `ResolvedCompatSource` are declared here rather than imported from the SDK, for
+  the reason already recorded beside the literal: they do not exist in `@theokit/sdk@4.52.1`, this
+  package's declared floor.
+
+  Closes usetheokit/theokit#686.
+
+## 13.0.0-next.8
+
+### Minor Changes
+
+- feb5781: `AgentBuilder.create().hookApproval()` — the fluent twin of `defineAgent({ hookApproval })`
+
+  `13.0.0-next.7` shipped the hook approval gate reachable through `defineAgent` and capabilities, and
+  not through the fluent builder. A consumer that authors with `AgentBuilder.create()` had no way to
+  reach it: `.use()` composes presets rather than sinking capabilities, and the definition reaches
+  `streamAgentTurnInProcess` with `local` already assembled, so there was no downstream place to inject
+  `local.hooks` by hand either.
+
+  Fifth instance of one family and a NEW variant. The first four were "the symbol exists and the barrel
+  omits it", which the emitted-export guard now catches. This one is the opposite: the symbol is
+  exported, on the compiled waist, and reachable through one authoring door — the other door simply
+  does not offer it, and an export check is green on that.
+
+  So the guard for this variant builds the SAME agent through BOTH doors and asserts they arrive at the
+  same compiled waist. It catches the worst case too: an interface that declares the method while the
+  factory never wires it compiles, does nothing, and fails this test.
+
 ## 13.0.0-next.7
 
 ### Patch Changes

package/dist/{agent-compiler-C2jIZ4CZ.d.ts → agent-compiler-DZorqtK2.d.ts}

@@ -1,4 +1,4 @@
-import { InlineSkill, SystemPromptResolver, SettingSource, MemorySettings, SkillsSettings, ContextSettings } from '@theokit/sdk';
+import { InlineSkill, TrustPosture, SettingSource, SystemPromptResolver, MemorySettings, SkillsSettings, ContextSettings } from '@theokit/sdk';
 import { TheokitAgentError } from '@theokit/sdk/errors';
 import { R as ReasoningEffort, a as MemoryOptions, P as ProjectContextOptions, M as McpServersMap, H as HumanInTheLoopOptions, C as CheckpointOptions, T as ToolOptions, A as ApprovalOptions, B as BudgetOptions } from './types-C16Wuh9E.js';
 
@@ -97,6 +97,183 @@ type SkillsSelection = readonly (string | InlineSkill)[] | ((ctx: SkillsRequestC
  */
 declare function resolveEnabledSkills(selection: SkillsSelection | undefined, ctx: SkillsRequestContext): Promise<string[] | undefined>;
 
+/**
+ * M68 — the trust gate for `settingSources`.
+ *
+ * ## The defect this module closes
+ *
+ * `settingSources` enables on-disk config discovery. `'user'` reads `~/.theokit/` — the operator's
+ * own machine, which no third party controls. `'project'` reads `<cwd>/.theokit/`, **including
+ * `hooks.json`, which executes shell**.
+ *
+ * The previous API took `readonly SettingSource[]`, and its JSDoc justified the risk this way:
+ * *"it is opt-in because `.theokit/` is the app's own repo (informed consent)"*. That premise holds
+ * for a web app whose `cwd` is its own deploy. It does **not** hold for the class of product this
+ * framework addresses — an agent whose `cwd` is a repository the user just cloned. There `.theokit/`
+ * is attacker-controlled content, and enabling `'project'` is remote code execution on the first
+ * `build()`.
+ *
+ * Documenting it did not prevent it. The measured consumer (TheoCode) did not trust the API: it
+ * gated from the outside, with a `posture.allows` of its own (`chat.ts:386`, comment B-008). It
+ * already **had** the right decision and could not pass it through, because the API only accepted
+ * strings. The gate existed on its side and evaporated at the boundary.
+ *
+ * ## The evidence is the SDK's, not one invented here
+ *
+ * `TrustPosture` is `@theokit/sdk`'s own trust primitive, and `recordWiring`'s doc says *"a posture
+ * is the only thing in this package that retains a capability"*. A bespoke type would make two trust
+ * grammars coexist and drift apart (ADR 0063).
+ */
+/**
+ * The framework's capability vocabulary — deliberately a single name (ADR 0065).
+ *
+ * `allows` is all-or-nothing in the SDK: every declared `K` gets the same boolean. A finer
+ * vocabulary (`hooks`, `skills`, `subagents`, `mcp`) would promise the consumer it can gate one
+ * without gating the other, and the primitive does not deliver that. An API that suggests a
+ * distinction the runtime does not make teaches the wrong thing, and the error only surfaces when
+ * somebody depends on the distinction.
+ */
+type SettingSourceCapability = 'projectSettings';
+/** Authorization to read config from the working directory. Requires the posture, never a claim. */
+interface ProjectSettingsGrant {
+    /**
+     * Typically the output of `resolveTrustPosture` — which is what gives it `source` (`'env' |
+     * 'store' | 'default'`) and therefore a refusal that says WHERE the decision came from instead of
+     * merely denying.
+     */
+    readonly trustedBy: TrustPosture<SettingSourceCapability>;
+}
+/**
+ * Which on-disk config roots the agent may read.
+ *
+ * The asymmetry is the design: `user` is a boolean because `~/.theokit/` belongs to the operator;
+ * `project` requires evidence because `<cwd>/.theokit/` may not. Omitting a root is not enabling it
+ * — never "enabling without a gate". The asymmetry is inherited from the SDK itself, whose
+ * `TrustPostureInput.envOverride` documents that `false` and `undefined` both mean "the operator did
+ * not turn it on", not "turned it off".
+ */
+interface SettingSourcesSelection {
+    /** `~/.theokit/` — the operator's machine. No gate: no third party controls it. */
+    readonly user?: boolean;
+    /** `<cwd>/.theokit/` — controlled by whoever wrote the open repository. Requires evidence. */
+    readonly project?: ProjectSettingsGrant;
+    /**
+     * `<cwd>/.claude/` — a FOREIGN configuration dialect, read only once declared
+     * (`usetheokit/theokit-sdk#524`).
+     *
+     * ## Two questions, and which half of this field answers each
+     *
+     * The SDK's docblock separates them, and the separation is the whole point of `compatSources`:
+     * a trust gate answers *"do I trust the code in this directory?"*; importing another product's
+     * configuration answers *"do I want it imported into this one?"*. They come apart in the ordinary
+     * case, because `.claude/` is populated in exactly the repository one trusts most — for a
+     * different tool, by a teammate who never heard of this runtime.
+     *
+     * So the two are answered by two different things here, and it matters which:
+     *
+     * | Question | Answered by |
+     * |---|---|
+     * | do I want the foreign dialect imported? | **declaring this field at all** — omitting is not enabling |
+     * | do I trust this directory's code to run? | the `TrustPosture` inside the grant |
+     *
+     * ## Why the grant is `ProjectSettingsGrant` and not a vocabulary of its own
+     *
+     * Not because the two questions are the same — they are not. Because a separate grant could not
+     * carry the distinction even if it existed: `TrustPosture.allows` is `Record<K, boolean>` and the
+     * SDK documents every value as moving together with the level, so a `'foreignDialects'` capability
+     * beside `'projectSettings'` would promise an operator they can grant one and withhold the other,
+     * and `resolveTrustPosture` would hand back the same boolean for both. That is precisely the
+     * failure ADR 0065 exists to prevent, and inventing the second name would commit it while looking
+     * like rigour.
+     *
+     * The consent half is therefore carried by the declaration, which is a real and sufficient
+     * boundary: an operator who trusts a repository completely still reads no `.claude/` until they
+     * write this field. What the grant adds on top is stricter than the SDK — there, listing a dialect
+     * is enough — and the extra strictness is deliberate: this reads a `hooks.json` that executes
+     * shell out of a directory that usually arrived with the clone.
+     */
+    readonly claudeCode?: ProjectSettingsGrant & {
+        /**
+         * #686 — WHICH surfaces of the foreign root to import. Absent means all of them, which is what
+         * every caller before this meant and still means.
+         *
+         * The distinction is the reason the grant exists. `.claude/` usually arrives with the clone and
+         * its `hooks.json` executes shell, so "take the skills, refuse the hooks" is the ordinary thing
+         * to want — and before this the only choices were all of it or none of it.
+         *
+         * Requires `@theokit/sdk >= 5.4.0`, which is where the narrowed form landed. On an older SDK the
+         * runtime drops an unrecognised shape in SILENCE, so declaring it there would import nothing at
+         * all rather than importing less — refused at resolve time instead.
+         */
+        readonly import?: readonly CompatSurface[];
+    };
+}
+/**
+ * The surfaces a foreign configuration root can contribute.
+ *
+ * Written out rather than imported, for the same reason as the `claude-code` literal below:
+ * `CompatSurface` does not exist in `@theokit/sdk@4.52.1`, this package's declared floor, and a gate
+ * that cannot build against its own minimum dependency is worse than a constant that has been
+ * checked. Verified against the published 5.4.0 `.d.ts`, where the union is
+ * `"hooks" | "plugins" | "skills" | "subagents"` — note `subagents`, not `agents`.
+ */
+type CompatSurface = 'hooks' | 'plugins' | 'skills' | 'subagents';
+/** What `resolveCompatSources` returns: the whole root, or the root narrowed to some surfaces. */
+type ResolvedCompatSource = 'claude-code' | {
+    readonly kind: 'claude-code';
+    readonly import: readonly CompatSurface[];
+};
+/**
+ * Refusal to read the working directory for lack of trust.
+ *
+ * Descends from `TheokitAgentError` because typed errors are an unbreakable rule here — and because
+ * `isTransientError` only sees this hierarchy. A class extending plain `Error` would be invisible to
+ * the predicate that separates recoverable from unrecoverable (the defect M67 fixed in five
+ * classes).
+ */
+declare class UntrustedSettingSourceError extends TheokitAgentError {
+    /** Where the trust decision came from: `'env' | 'store' | 'default'`. */
+    readonly trustSource: string;
+    /** The refused capability. */
+    readonly capability: SettingSourceCapability;
+    readonly name = "UntrustedSettingSourceError";
+    constructor(message: string, 
+    /** Where the trust decision came from: `'env' | 'store' | 'default'`. */
+    trustSource: string, 
+    /** The refused capability. */
+    capability: SettingSourceCapability);
+}
+/**
+ * Translate the declared selection into the `SettingSource`s the SDK accepts, refusing what the
+ * posture does not authorize.
+ *
+ * Refuses rather than ignores (ADR 0064). Ignoring would leave the product running in the belief
+ * that the repository's hooks are active — a silent failure mode, on the wrong side. The SDK already
+ * picked that side for the same problem: `recordWiring` throws `UngatedCapabilityError` when
+ * somebody registers a capability the posture does not gate.
+ *
+ * @throws {UntrustedSettingSourceError} when `project` is requested and the posture does not grant it.
+ */
+declare function resolveSettingSources(selection: SettingSourcesSelection | undefined): readonly SettingSource[];
+/**
+ * The foreign configuration dialects this layer forwards, once the posture authorises them.
+ *
+ * ## Why it is a separate function and the same vocabulary
+ *
+ * Separate because the SDK takes them on a separate option (`local.compatSources`); the same
+ * `ProjectSettingsGrant` because the thing being authorised is identical — reading a `hooks.json`
+ * that executes shell out of a directory the operator does not necessarily control.
+ *
+ * ## What it deliberately does NOT do
+ *
+ * Validate the source NAME. The SDK DROPS an unrecognised name rather than turning it into
+ * `<cwd>/<name>`, so a typo fails closed there; turning that into a throw here would convert a safe
+ * default into a crash. This gate decides authorisation, never vocabulary.
+ *
+ * @throws {UntrustedSettingSourceError} when a source is requested and the posture does not grant it.
+ */
+declare function resolveCompatSources(selection: SettingSourcesSelection | undefined): readonly ResolvedCompatSource[];
+
 /**
  * Project the M8 fields from `CompiledAgentOptions` into `Agent.create()` arguments. Only the async
  * `@ProjectContext` resolver is built here (it does I/O, so the compiler keeps it raw). `applied`
@@ -245,7 +422,7 @@ interface CompiledAgentOptions {
      * Resolved at compile time by `resolveCompatSources`, exactly like `settingSources`: a value here
      * can only hold a source some posture granted, so the adapter projects rather than decides.
      */
-    compatSources?: readonly string[];
+    compatSources?: readonly ResolvedCompatSource[];
     /**
      * #686 — the consumer's pre-spawn approval gate, forwarded to `Agent.create({ local: { hooks } })`.
      *
@@ -298,4 +475,4 @@ interface CompiledAgentOptions {
     skillsResolver?: SkillsSelection;
 }
 
-export { type CompiledAgentOptions as C, type Guardrail as G, type HookApprovalGate as H, type SkillsSelection as S, type ToolWalkResult as T, type CompiledTool as a, CostBudgetExceededError as b, type GuardrailAction as c, type GuardrailPhase as d, type GuardrailResult as e, GuardrailViolationError as f, type HookApprovalRequest as g, HookGateUnsupportedError as h, type SkillsRequestContext as i, type ToolboxWalkResult as j, compileTools as k, resolveEnabledSkills as r };
+export { type CompiledAgentOptions as C, type Guardrail as G, type HookApprovalGate as H, type ProjectSettingsGrant as P, type ResolvedCompatSource as R, type SkillsSelection as S, type ToolWalkResult as T, UntrustedSettingSourceError as U, type SettingSourcesSelection as a, type CompiledTool as b, type CompatSurface as c, CostBudgetExceededError as d, type GuardrailAction as e, type GuardrailPhase as f, type GuardrailResult as g, GuardrailViolationError as h, type HookApprovalRequest as i, HookGateUnsupportedError as j, type SettingSourceCapability as k, type SkillsRequestContext as l, type ToolboxWalkResult as m, compileTools as n, resolveEnabledSkills as o, resolveSettingSources as p, resolveCompatSources as r };

package/dist/{bridge-entry-Db0SZbYj.d.ts → bridge-entry-B0FqqPlt.d.ts}

@@ -1,11 +1,11 @@
 import { ExecutionContext } from '@theokit/http';
 import { c as AgentOptions, T as ToolOptions, P as ProjectContextOptions, H as HumanInTheLoopOptions, R as ReasoningEffort, M as McpServersMap } from './types-C16Wuh9E.js';
-import { C as CompiledAgentOptions, a as CompiledTool, G as Guardrail, S as SkillsSelection } from './agent-compiler-C2jIZ4CZ.js';
+import { C as CompiledAgentOptions, b as CompiledTool, G as Guardrail, S as SkillsSelection, a as SettingSourcesSelection, H as HookApprovalGate } from './agent-compiler-DZorqtK2.js';
 import { SkillsSettings, ContextSettings, SystemPromptResolver, ModelSelection, PluginsSettings, Plugin, ProviderRoutingSettings, AgentDefinition as AgentDefinition$1, BudgetTracker, CustomTool, RunEventSink, MemorySettings } from '@theokit/sdk';
-import { S as StreamEvent, f as ApprovalRequiredEvent, a4 as MaskError } from './delegation-scoring-BrBQXvIp.js';
+import { S as StreamEvent, f as ApprovalRequiredEvent, a4 as MaskError } from './delegation-scoring-MbnqL68u.js';
 import { RetryOptions } from '@theokit/sdk/retry';
 import { SandboxPosture } from '@theokit/sdk/sandbox';
-import { A as AgentDefinition, S as SettingSourcesSelection } from './define-agent-WYnUlWaH.js';
+import { A as AgentDefinition } from './define-agent-D9b3h3VU.js';
 import { z } from 'zod';
 import { H as HookHandlers } from './hook-handlers-Cw2FsnE5.js';
 import { WireChunk } from '@theokit/presenter/wire';
@@ -912,6 +912,22 @@ interface AgentBuilder<TInput extends z.ZodType | UnsetMarker = UnsetMarker, TMo
      * whose `cwd` is its own deploy, false for an agent pointed at a repository someone else wrote.
      */
     settingSources(selection: SettingSourcesSelection): AgentBuilder<TInput, TModel, TContext, TTools>;
+    /**
+     * #686 — decide whether a hook declared in a config root is spawned AT ALL, before it runs.
+     *
+     * The fluent twin of `defineAgent({ hookApproval })`. It exists because a consumer that builds
+     * through this chain had no way to reach the gate: `.use()` composes presets rather than sinking
+     * capabilities, and the definition reaches `streamAgentTurnInProcess` with `local` already
+     * assembled, so there was no downstream place to inject it either.
+     *
+     * Distinct from {@link AgentBuilder.hooks} below, which ATTACHES lifecycle hooks. This one decides
+     * whether hooks somebody ELSE declared — in `.theokit/`, or in a foreign dialect imported through
+     * `settingSources` — are allowed to run.
+     *
+     * Requires `@theokit/sdk >= 5.4.0`. Declaring it against an older SDK is refused at assembly
+     * rather than forwarded: a gate that silently does not gate is worse than none.
+     */
+    hookApproval(gate: HookApprovalGate): AgentBuilder<TInput, TModel, TContext, TTools>;
     /**
      * M49 — enable the SDK's durable memory for this agent (`.theokit/memory/` in the run cwd:
      * `Remember:` capture with secret redaction, auto-injected recall, memory tools). Takes the SDK's

package/dist/bridge.d.ts

@@ -1,7 +1,7 @@
-export { c as APPROVAL_MODES, d as AfterToolCallContext, e as AgentBuilder, f as AgentDefinitionError, g as AgentExecutionContext, h as AgentManifest, A as AgentManifestEntry, i as AgentManifestSource, j as AgentManifestTool, b as AgentModule, k as AgentRoute, l as AgentRouteContext, m as AgentRunInfo, n as AgentsPluginOptions, o as ApiErrorContext, p as ApiErrorDecision, q as ApiErrorPolicy, r as ApprovalMode, a as ApprovalPosture, B as BeforeToolCallContext, u as CompiledContextWindow, v as ContextualTool, D as DefinitionOrThunk, w as DelegationTimeoutError, E as EphemeralAgent, L as LLMCallContext, M as McpApprovalSpec, x as McpFileError, y as McpRegistryConfig, z as McpRequestContext, F as McpSelection, P as ProcessInputContext, G as SdkAgentHandle, I as SdkMessage, J as SdkSendOptions, K as SdkTurnHandle, N as Segment, O as ShouldAutoApproveOptions, T as ToolCallVeto, Q as ToolHooks, R as ToolHooksPlugin, W as WRITE_SCOPED_TOOLS, U as agentsPlugin, V as applyPosture, X as buildModelSelection, Y as compileAgentModule, Z as compileContextWindow, _ as compileLoadedAgentModule, $ as compileProjectContext, a0 as compileSkills, a1 as createAgentExecutionContext, a2 as createApiErrorHandler, a3 as createSdkAgentStream, a4 as createThinkTagExtractor, a5 as createToolHooksPlugin, a6 as extractThinkTagStream, a7 as generateAgentManifest, a8 as generateAgentRoutes, a9 as isAgentContext, aa as loadMcpJson, ab as mcpRegistry, ac as mcpToolApprovals, ad as projectContextMetadataOnlyKnobs, ae as reasoningEffortOf, af as resolveMcpServers, ag as runWithApiErrorHandling, ah as shouldAutoApprove, s as streamAgentUIMessages, ai as toAgentFactory, aj as translateSdkEvent, ak as withClockCap, al as withEphemeralAgent } from './bridge-entry-Db0SZbYj.js';
-export { C as CompiledAgentOptions, a as CompiledTool, H as HookApprovalGate, g as HookApprovalRequest, h as HookGateUnsupportedError, T as ToolWalkResult, j as ToolboxWalkResult, k as compileTools } from './agent-compiler-C2jIZ4CZ.js';
-export { A as AgentStopReason, d as AgentStreamEvent, e as AgentTurnMetadata, f as ApprovalRequiredEvent, g as ArtifactChunkEvent, h as ArtifactStartEvent, B as BackgroundDelegation, i as BudgetExceededError, C as CheckpointSavedEvent, k as DelegateFn, a as DelegateOptions, l as DelegationBudgetExceededError, m as DelegationError, n as DelegationPort, c as DelegationResult, D as DelegationTarget, o as DoneEvent, E as ErrorEvent, F as FileEditEvent, I as IterationEvent, P as PartialToolCallEvent, v as RunStartedEvent, w as ScoreVerdict, x as ScoredDelegation, y as Scorer, z as StateUpdateEvent, S as StreamEvent, T as TextDeltaEvent, G as ThinkingEvent, H as ToolCallEvent, J as ToolResultEvent, K as delegate, M as delegateBackground, N as delegateWithScoring, O as isApprovalRequired, Q as isDone, U as isError, V as isPartialToolCall, W as isTextDelta, X as isToolCall, Y as isToolResult, a0 as presentUIMessageStream, a3 as streamAgentResponse } from './delegation-scoring-BrBQXvIp.js';
-export { a as AGENT_BRAND, A as AgentDefinition, D as DefineAgentConfig, I as InferAgentInput, b as InferAgentToolNames, P as ProjectSettingsGrant, c as SettingSourceCapability, S as SettingSourcesSelection, U as UntrustedSettingSourceError, d as compileAgentDefinition, i as isAgentDefinition, r as resolveCompatSources, e as resolveSettingSources } from './define-agent-WYnUlWaH.js';
+export { c as APPROVAL_MODES, d as AfterToolCallContext, e as AgentBuilder, f as AgentDefinitionError, g as AgentExecutionContext, h as AgentManifest, A as AgentManifestEntry, i as AgentManifestSource, j as AgentManifestTool, b as AgentModule, k as AgentRoute, l as AgentRouteContext, m as AgentRunInfo, n as AgentsPluginOptions, o as ApiErrorContext, p as ApiErrorDecision, q as ApiErrorPolicy, r as ApprovalMode, a as ApprovalPosture, B as BeforeToolCallContext, u as CompiledContextWindow, v as ContextualTool, D as DefinitionOrThunk, w as DelegationTimeoutError, E as EphemeralAgent, L as LLMCallContext, M as McpApprovalSpec, x as McpFileError, y as McpRegistryConfig, z as McpRequestContext, F as McpSelection, P as ProcessInputContext, G as SdkAgentHandle, I as SdkMessage, J as SdkSendOptions, K as SdkTurnHandle, N as Segment, O as ShouldAutoApproveOptions, T as ToolCallVeto, Q as ToolHooks, R as ToolHooksPlugin, W as WRITE_SCOPED_TOOLS, U as agentsPlugin, V as applyPosture, X as buildModelSelection, Y as compileAgentModule, Z as compileContextWindow, _ as compileLoadedAgentModule, $ as compileProjectContext, a0 as compileSkills, a1 as createAgentExecutionContext, a2 as createApiErrorHandler, a3 as createSdkAgentStream, a4 as createThinkTagExtractor, a5 as createToolHooksPlugin, a6 as extractThinkTagStream, a7 as generateAgentManifest, a8 as generateAgentRoutes, a9 as isAgentContext, aa as loadMcpJson, ab as mcpRegistry, ac as mcpToolApprovals, ad as projectContextMetadataOnlyKnobs, ae as reasoningEffortOf, af as resolveMcpServers, ag as runWithApiErrorHandling, ah as shouldAutoApprove, s as streamAgentUIMessages, ai as toAgentFactory, aj as translateSdkEvent, ak as withClockCap, al as withEphemeralAgent } from './bridge-entry-B0FqqPlt.js';
+export { c as CompatSurface, C as CompiledAgentOptions, b as CompiledTool, H as HookApprovalGate, i as HookApprovalRequest, j as HookGateUnsupportedError, P as ProjectSettingsGrant, R as ResolvedCompatSource, k as SettingSourceCapability, a as SettingSourcesSelection, T as ToolWalkResult, m as ToolboxWalkResult, U as UntrustedSettingSourceError, n as compileTools, r as resolveCompatSources, p as resolveSettingSources } from './agent-compiler-DZorqtK2.js';
+export { A as AgentStopReason, d as AgentStreamEvent, e as AgentTurnMetadata, f as ApprovalRequiredEvent, g as ArtifactChunkEvent, h as ArtifactStartEvent, B as BackgroundDelegation, i as BudgetExceededError, C as CheckpointSavedEvent, k as DelegateFn, a as DelegateOptions, l as DelegationBudgetExceededError, m as DelegationError, n as DelegationPort, c as DelegationResult, D as DelegationTarget, o as DoneEvent, E as ErrorEvent, F as FileEditEvent, I as IterationEvent, P as PartialToolCallEvent, v as RunStartedEvent, w as ScoreVerdict, x as ScoredDelegation, y as Scorer, z as StateUpdateEvent, S as StreamEvent, T as TextDeltaEvent, G as ThinkingEvent, H as ToolCallEvent, J as ToolResultEvent, K as delegate, M as delegateBackground, N as delegateWithScoring, O as isApprovalRequired, Q as isDone, U as isError, V as isPartialToolCall, W as isTextDelta, X as isToolCall, Y as isToolResult, a0 as presentUIMessageStream, a3 as streamAgentResponse } from './delegation-scoring-MbnqL68u.js';
+export { a as AGENT_BRAND, A as AgentDefinition, D as DefineAgentConfig, I as InferAgentInput, b as InferAgentToolNames, c as compileAgentDefinition, i as isAgentDefinition } from './define-agent-D9b3h3VU.js';
 import '@theokit/http';
 import './types-C16Wuh9E.js';
 import '@theokit/sdk';

package/dist/bridge.js

@@ -29,7 +29,7 @@ import {
   runWithApiErrorHandling,
   streamAgentResponse,
   streamAgentUIMessages
-} from "./chunk-YVPQ3KSA.js";
+} from "./chunk-TZCHACY7.js";
 import {
   APPROVAL_MODES,
   BudgetExceededError,
@@ -55,7 +55,7 @@ import {
   translateSdkEvent,
   withClockCap,
   withEphemeralAgent
-} from "./chunk-NZTLBLHB.js";
+} from "./chunk-6WFRR24F.js";
 import "./chunk-RKWCXVYG.js";
 import {
   AGENT_BRAND,
@@ -64,7 +64,7 @@ import {
   isAgentDefinition,
   resolveCompatSources,
   resolveSettingSources
-} from "./chunk-X4IGZHOV.js";
+} from "./chunk-LPS65NGG.js";
 import "./chunk-OXNDJSAJ.js";
 import "./chunk-Z4QWC7IK.js";
 export {

package/dist/{chunk-NZTLBLHB.js → chunk-6WFRR24F.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-RKWCXVYG.js";
 import {
   compileAgentDefinition
-} from "./chunk-X4IGZHOV.js";
+} from "./chunk-LPS65NGG.js";
 import {
   createRunUsageMeter
 } from "./chunk-OXNDJSAJ.js";
@@ -2553,4 +2553,4 @@ export {
   delegateBackground,
   delegateWithScoring
 };
-//# sourceMappingURL=chunk-NZTLBLHB.js.map
+//# sourceMappingURL=chunk-6WFRR24F.js.map