@theokit/agents 7.4.2 → 7.6.0

package/dist/index.js

@@ -16,6 +16,7 @@ import {
   GuardrailViolationError,
   JudgeCredentialError,
   McpFileError,
+  UntrustedSettingSourceError,
   agentsPlugin,
   buildModelSelection,
   compactionStrategyConfigSchema,
@@ -66,6 +67,7 @@ import {
   resolveCompactionStrategy,
   resolveLoopStrategy,
   resolveMcpServers,
+  resolveSettingSources,
   runInputGuards,
   runOutputGuards,
   runWithApiErrorHandling,
@@ -76,7 +78,10 @@ import {
   toolRuntimeName,
   translateSdkEvent,
   unicodeNormalizer
-} from "./chunk-PHUNONZT.js";
+} from "./chunk-22IPZFVT.js";
+import {
+  __name
+} from "./chunk-Z4QWC7IK.js";
 
 // src/index.ts
 import { Agent as AgentDoSdk } from "@theokit/sdk";
@@ -84,6 +89,9 @@ import { Agent as AgentDoSdk } from "@theokit/sdk";
 // src/capability/capability.ts
 import { isDeepStrictEqual } from "util";
 var CapabilityConflictError = class extends Error {
+  static {
+    __name(this, "CapabilityConflictError");
+  }
   name = "CapabilityConflictError";
   constructor(field, previous, next, capability) {
     super(
@@ -102,14 +110,21 @@ function shapeOf(value) {
   }
   return typeof value;
 }
+__name(shapeOf, "shapeOf");
 function createDraft() {
-  return { tools: [], agents: {}, provenance: [] };
+  return {
+    tools: [],
+    agents: {},
+    provenance: []
+  };
 }
+__name(createDraft, "createDraft");
 function applyCapabilities(capabilities, draft = createDraft()) {
   for (const c of capabilities) c.apply(draft);
   draft.stream ??= true;
   return draft;
 }
+__name(applyCapabilities, "applyCapabilities");
 function setOnce(draft, field, value, capability) {
   if (value === void 0) return;
   const previous = draft[field];
@@ -117,15 +132,28 @@ function setOnce(draft, field, value, capability) {
     throw new CapabilityConflictError(field, previous, value, capability);
   }
   draft[field] = value;
-  draft.provenance.push({ capability, contributed: [field] });
+  draft.provenance.push({
+    capability,
+    contributed: [
+      field
+    ]
+  });
 }
+__name(setOnce, "setOnce");
 
 // src/capability/capabilities.ts
 function describe(value) {
   if (value === null) return "null";
   return Array.isArray(value) ? "array" : typeof value;
 }
+__name(describe, "describe");
 var ModelCapability = class {
+  static {
+    __name(this, "ModelCapability");
+  }
+  id;
+  reasoningEffort;
+  name = "model";
   constructor(id, reasoningEffort) {
     this.id = id;
     this.reasoningEffort = reasoningEffort;
@@ -134,9 +162,6 @@ var ModelCapability = class {
     }
     if (id.trim().length === 0) throw new ConfigurationError("model: id cannot be empty");
   }
-  id;
-  reasoningEffort;
-  name = "model";
   apply(draft) {
     setOnce(draft, "model", this.id, this.name);
     if (this.reasoningEffort !== void 0) {
@@ -145,6 +170,9 @@ var ModelCapability = class {
   }
 };
 var ToolsCapability = class {
+  static {
+    __name(this, "ToolsCapability");
+  }
   name = "tools";
   #tools;
   constructor(tools) {
@@ -152,10 +180,18 @@ var ToolsCapability = class {
   }
   apply(draft) {
     draft.tools.push(...this.#tools);
-    draft.provenance.push({ capability: this.name, contributed: ["tools"] });
+    draft.provenance.push({
+      capability: this.name,
+      contributed: [
+        "tools"
+      ]
+    });
   }
 };
 var SkillsCapability = class {
+  static {
+    __name(this, "SkillsCapability");
+  }
   name = "skills";
   #entries;
   constructor(entries) {
@@ -170,16 +206,16 @@ var SkillsCapability = class {
         continue;
       }
       if (typeof e !== "object" || e === null || Array.isArray(e)) {
-        throw new ConfigurationError(
-          `skills: invalid entry (${describe(e)}) \u2014 use a name or an inline skill`
-        );
+        throw new ConfigurationError(`skills: invalid entry (${describe(e)}) \u2014 use a name or an inline skill`);
       }
-      for (const field of ["name", "description", "instructions"]) {
+      for (const field of [
+        "name",
+        "description",
+        "instructions"
+      ]) {
         const value = e[field];
         if (typeof value !== "string" || value.trim().length === 0) {
-          throw new ConfigurationError(
-            `skills: inline skill without a valid \`${field}\` (${describe(value)}) \u2014 name, description and instructions are all required`
-          );
+          throw new ConfigurationError(`skills: inline skill without a valid \`${field}\` (${describe(value)}) \u2014 name, description and instructions are all required`);
         }
       }
     }
@@ -198,21 +234,40 @@ var SkillsCapability = class {
       // and no reference array form can express it) — revisit when one can.
       ...previous,
       ...compiled.skills,
-      enabled: [...previous.enabled ?? [], ...compiled.skills.enabled ?? []],
-      ...previous.inline !== void 0 || compiled.skills.inline !== void 0 ? { inline: [...previous.inline ?? [], ...compiled.skills.inline ?? []] } : {}
+      enabled: [
+        ...previous.enabled ?? [],
+        ...compiled.skills.enabled ?? []
+      ],
+      ...previous.inline !== void 0 || compiled.skills.inline !== void 0 ? {
+        inline: [
+          ...previous.inline ?? [],
+          ...compiled.skills.inline ?? []
+        ]
+      } : {}
     };
-    draft.provenance.push({ capability: this.name, contributed: ["skills"] });
+    draft.provenance.push({
+      capability: this.name,
+      contributed: [
+        "skills"
+      ]
+    });
   }
 };
 
 // src/capability/registry.ts
 var UnknownCapabilityError = class extends Error {
+  static {
+    __name(this, "UnknownCapabilityError");
+  }
   name = "UnknownCapabilityError";
   constructor(requested, known) {
     super(`capability "${requested}" is not registered. Known: ${known.join(", ") || "(none)"}.`);
   }
 };
 var CapabilityRegistry = class {
+  static {
+    __name(this, "CapabilityRegistry");
+  }
   #factories = /* @__PURE__ */ new Map();
   register(name, factory) {
     this.#factories.set(name, factory);
@@ -222,7 +277,9 @@ var CapabilityRegistry = class {
     return this.#factories.has(name);
   }
   names() {
-    return [...this.#factories.keys()];
+    return [
+      ...this.#factories.keys()
+    ];
   }
   resolve(name, arg) {
     const factory = this.#factories.get(name);
@@ -231,12 +288,15 @@ var CapabilityRegistry = class {
   }
 };
 var CapabilityPreset = class {
+  static {
+    __name(this, "CapabilityPreset");
+  }
+  name;
+  #members;
   constructor(name, members) {
     this.name = name;
     this.#members = members;
   }
-  name;
-  #members;
   apply(draft) {
     for (const member of this.#members) member.apply(draft);
   }
@@ -244,120 +304,169 @@ var CapabilityPreset = class {
 
 // src/capability/agent-capabilities.ts
 var FieldCapability = class {
+  static {
+    __name(this, "FieldCapability");
+  }
+  value;
   constructor(value) {
     this.value = value;
   }
-  value;
   apply(draft) {
     setOnce(draft, this.field, this.value, this.name);
   }
 };
 var MemoryCapability = class extends FieldCapability {
+  static {
+    __name(this, "MemoryCapability");
+  }
   name = "memory";
   field = "memory";
 };
 var ContextWindowCapability = class {
-  constructor(options) {
-    this.options = options;
+  static {
+    __name(this, "ContextWindowCapability");
   }
   options;
   name = "context-window";
+  constructor(options) {
+    this.options = options;
+  }
   apply(draft) {
     setOnce(draft, "context", compileContextWindow(this.options).context, this.name);
   }
 };
 var ProjectContextCapability = class extends FieldCapability {
+  static {
+    __name(this, "ProjectContextCapability");
+  }
   name = "project-context";
   field = "projectContext";
 };
 var McpServersCapability = class extends FieldCapability {
+  static {
+    __name(this, "McpServersCapability");
+  }
   name = "mcp";
   field = "mcpServers";
 };
 var GuardrailsCapability = class extends FieldCapability {
+  static {
+    __name(this, "GuardrailsCapability");
+  }
   name = "guardrails";
   field = "guardrails";
 };
 var CheckpointCapability = class {
-  constructor(options) {
-    this.options = options;
+  static {
+    __name(this, "CheckpointCapability");
   }
   options;
   name = "checkpoint";
+  constructor(options) {
+    this.options = options;
+  }
   apply(draft) {
     if (this.options !== void 0 && this.options.storage !== "filesystem") {
-      console.warn(
-        `[THEO_AGENT_CHECKPOINT_STORAGE_METADATA_ONLY] checkpoint({ storage: '${this.options.storage ?? "memory"}' }) does NOT resume across requests \u2014 only 'filesystem' selects the SDK's durable conversation store. Use checkpoint({ storage: 'filesystem' }) for cross-request resume.`
-      );
+      console.warn(`[THEO_AGENT_CHECKPOINT_STORAGE_METADATA_ONLY] checkpoint({ storage: '${this.options.storage ?? "memory"}' }) does NOT resume across requests \u2014 only 'filesystem' selects the SDK's durable conversation store. Use checkpoint({ storage: 'filesystem' }) for cross-request resume.`);
     }
     setOnce(draft, "checkpoint", this.options, this.name);
   }
 };
 var HumanInTheLoopCapability = class extends FieldCapability {
+  static {
+    __name(this, "HumanInTheLoopCapability");
+  }
   name = "human-in-the-loop";
   field = "hitl";
 };
 var SubAgentsCapability = class {
-  constructor(children) {
-    this.children = children;
+  static {
+    __name(this, "SubAgentsCapability");
   }
   children;
   name = "sub-agents";
+  constructor(children) {
+    this.children = children;
+  }
   apply(draft) {
     for (const [name, child] of Object.entries(this.children)) {
       if (name in draft.agents && draft.agents[name] !== child) {
-        throw new ConfigurationError(
-          `sub-agents: child "${name}" declared twice with different definitions`
-        );
+        throw new ConfigurationError(`sub-agents: child "${name}" declared twice with different definitions`);
       }
       draft.agents[name] = child;
     }
-    draft.provenance.push({ capability: this.name, contributed: ["agents"] });
+    draft.provenance.push({
+      capability: this.name,
+      contributed: [
+        "agents"
+      ]
+    });
   }
 };
 var SkillsOptionsCapability = class {
-  constructor(options) {
-    this.options = options;
+  static {
+    __name(this, "SkillsOptionsCapability");
   }
   options;
   name = "skills";
+  constructor(options) {
+    this.options = options;
+  }
   apply(draft) {
     setOnce(draft, "skills", compileSkills(this.options), this.name);
   }
 };
 var SettingSourcesCapability = class extends FieldCapability {
+  static {
+    __name(this, "SettingSourcesCapability");
+  }
   name = "setting-sources";
   field = "settingSources";
 };
 var PluginsCapability = class extends FieldCapability {
+  static {
+    __name(this, "PluginsCapability");
+  }
   name = "plugins";
   field = "plugins";
 };
 var RunContextCapability = class extends FieldCapability {
+  static {
+    __name(this, "RunContextCapability");
+  }
   name = "run-context";
   field = "runContext";
 };
 var SkillsResolverCapability = class extends FieldCapability {
+  static {
+    __name(this, "SkillsResolverCapability");
+  }
   name = "skills-resolver";
   field = "skillsResolver";
 };
 var AgentConfigCapability = class {
+  static {
+    __name(this, "AgentConfigCapability");
+  }
+  config;
+  name = "agent-config";
   constructor(config) {
     this.config = config;
     if (typeof config !== "object" || config === null) {
       throw new ConfigurationError("agent-config: expected a configuration object");
     }
-    for (const field of ["maxIterations", "timeoutMs"]) {
+    for (const field of [
+      "maxIterations",
+      "timeoutMs"
+    ]) {
       const value = config[field];
       if (value !== void 0 && (!Number.isFinite(value) || value <= 0)) {
         throw new ConfigurationError(`agent-config: \`${field}\` must be a positive number`);
       }
     }
   }
-  config;
-  name = "agent-config";
   apply(draft) {
-    const claimedByMainLoop = (field) => draft.provenance.some((p) => p.capability === "main-loop" && p.contributed.includes(field));
+    const claimedByMainLoop = /* @__PURE__ */ __name((field) => draft.provenance.some((p) => p.capability === "main-loop" && p.contributed.includes(field)), "claimedByMainLoop");
     if (!claimedByMainLoop("maxIterations")) {
       setOnce(draft, "maxIterations", this.config.maxIterations, this.name);
     }
@@ -372,11 +481,14 @@ var AgentConfigCapability = class {
   }
 };
 var MainLoopCapability = class {
-  constructor(config) {
-    this.config = config;
+  static {
+    __name(this, "MainLoopCapability");
   }
   config;
   name = "main-loop";
+  constructor(config) {
+    this.config = config;
+  }
   apply(draft) {
     const contributed = [];
     if (this.config.maxIterations !== void 0) {
@@ -387,12 +499,18 @@ var MainLoopCapability = class {
       draft.timeoutMs = this.config.timeoutMs;
       contributed.push("timeoutMs");
     }
-    if (contributed.length > 0) draft.provenance.push({ capability: this.name, contributed });
+    if (contributed.length > 0) draft.provenance.push({
+      capability: this.name,
+      contributed
+    });
   }
 };
 
 // src/capability/toolbox.ts
 var ToolboxCapability = class {
+  static {
+    __name(this, "ToolboxCapability");
+  }
   name = "toolbox";
   #instance;
   #declarations;
@@ -403,15 +521,11 @@ var ToolboxCapability = class {
     }
     const declared = options.tools ?? instance.constructor.tools;
     if (declared === void 0 || declared.length === 0) {
-      throw new ConfigurationError(
-        `toolbox: ${instance.constructor.name} declares no tools \u2014 use \`static tools = [...]\` or the \`tools\` option`
-      );
+      throw new ConfigurationError(`toolbox: ${instance.constructor.name} declares no tools \u2014 use \`static tools = [...]\` or the \`tools\` option`);
     }
     for (const tool of declared) {
       if (typeof instance[tool.method] !== "function") {
-        throw new ConfigurationError(
-          `toolbox: ${instance.constructor.name}.${tool.method} is not a method (tool "${tool.name}")`
-        );
+        throw new ConfigurationError(`toolbox: ${instance.constructor.name}.${tool.method} is not a method (tool "${tool.name}")`);
       }
     }
     this.#instance = instance;
@@ -420,15 +534,15 @@ var ToolboxCapability = class {
     for (const tool of declared) toolRuntimeName(this.#namespace, tool.name);
   }
   /**
-   * The single derivation of this toolbox (M55). Both compilers below consume THIS object, so the
-   * tool registry and the HITL gate map cannot disagree on a name — the property is structural, not
-   * a convention repeated in two loops. That repetition is precisely how the two drifted apart in
-   * #145: the tool became `ns_tool` while its gate stayed `ns.tool`, silently ungating it.
-   *
-   * Same technique the `opencode` harness uses for the analogous tool↔permission coupling, where
-   * `Permission.visibleTools` filters the tool record itself rather than keeping a parallel map
-   * ("so the two cannot drift" — `permission/index.ts`).
-   */
+  * The single derivation of this toolbox (M55). Both compilers below consume THIS object, so the
+  * tool registry and the HITL gate map cannot disagree on a name — the property is structural, not
+  * a convention repeated in two loops. That repetition is precisely how the two drifted apart in
+  * #145: the tool became `ns_tool` while its gate stayed `ns.tool`, silently ungating it.
+  *
+  * Same technique the `opencode` harness uses for the analogous tool↔permission coupling, where
+  * `Permission.visibleTools` filters the tool record itself rather than keeping a parallel map
+  * ("so the two cannot drift" — `permission/index.ts`).
+  */
   #walk() {
     return {
       // `constructor` is typed `Function` by lib.d.ts; here it is used purely as an IDENTITY key
@@ -443,48 +557,74 @@ var ToolboxCapability = class {
         approval: tool.approval,
         trace: tool.trace ?? false,
         audit: tool.audit ?? false,
-        ...tool.hitl !== void 0 ? { hitl: tool.hitl } : {}
+        ...tool.hitl !== void 0 ? {
+          hitl: tool.hitl
+        } : {}
       }))
     };
   }
   /**
-   * M56 — the public `compile()` is GONE. It had zero callers anywhere in the monorepo and was kept
-   * only because deleting a public method is breaking; that concession is exactly the dead surface
-   * M55 set out to remove, preserved inside the milestone that removed it. `apply()` is the one path.
-   */
+  * M56 — the public `compile()` is GONE. It had zero callers anywhere in the monorepo and was kept
+  * only because deleting a public method is breaking; that concession is exactly the dead surface
+  * M55 set out to remove, preserved inside the milestone that removed it. `apply()` is the one path.
+  */
   apply(draft) {
     const walk = this.#walk();
-    draft.tools.push(...compileTools([walk], /* @__PURE__ */ new Map([[walk.class, this.#instance]])));
-    draft.provenance.push({ capability: this.name, contributed: ["tools"] });
-    const gates = compileHitlGates([walk]);
+    draft.tools.push(...compileTools([
+      walk
+    ], /* @__PURE__ */ new Map([
+      [
+        walk.class,
+        this.#instance
+      ]
+    ])));
+    draft.provenance.push({
+      capability: this.name,
+      contributed: [
+        "tools"
+      ]
+    });
+    const gates = compileHitlGates([
+      walk
+    ]);
     if (gates.size === 0) return;
     draft.hitl ??= /* @__PURE__ */ new Map();
     for (const [key, options] of gates) draft.hitl.set(key, options);
-    draft.provenance.push({ capability: this.name, contributed: ["hitl"] });
+    draft.provenance.push({
+      capability: this.name,
+      contributed: [
+        "hitl"
+      ]
+    });
   }
 };
 
 // src/capability/toolset.ts
 import { TheokitAgentError } from "@theokit/sdk/errors";
 var ToolsetError = class extends TheokitAgentError {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
+  static {
+    __name(this, "ToolsetError");
   }
   code;
   name = "ToolsetError";
+  constructor(message, code) {
+    super(message), this.code = code;
+  }
 };
 var Toolset = class _Toolset {
+  static {
+    __name(this, "Toolset");
+  }
   #byName;
   constructor(byName) {
     this.#byName = byName;
     Object.freeze(this);
   }
   /**
-   * Builds from tools that are already instantiated. Fails loud on a duplicate name **at construction**
-   * — not at resolution: a descriptor with two tools of the same name is wrong the moment it is
-   * written, and deferring the error to the first `resolve` hides half the cases.
-   */
+  * Builds from tools that are already instantiated. Fails loud on a duplicate name **at construction**
+  * — not at resolution: a descriptor with two tools of the same name is wrong the moment it is
+  * written, and deferring the error to the first `resolve` hides half the cases.
+  */
   static from(tools) {
     const byName = /* @__PURE__ */ new Map();
     for (const tool of tools) {
@@ -504,9 +644,9 @@ var Toolset = class _Toolset {
     return tool;
   }
   /**
-   * Resolves a whitelist. Fails loud on an unknown name **and** on a duplicate within the list itself:
-   * a team never silently grants a tool the role did not declare, nor silently drops one it did.
-   */
+  * Resolves a whitelist. Fails loud on an unknown name **and** on a duplicate within the list itself:
+  * a team never silently grants a tool the role did not declare, nor silently drops one it did.
+  */
   resolve(names) {
     const seen = /* @__PURE__ */ new Set();
     return names.map((name) => {
@@ -519,11 +659,15 @@ var Toolset = class _Toolset {
   }
   /** The known names, in registration order. */
   names() {
-    return [...this.#byName.keys()];
+    return [
+      ...this.#byName.keys()
+    ];
   }
   /** All the tools, in registration order. */
   all() {
-    return [...this.#byName.values()];
+    return [
+      ...this.#byName.values()
+    ];
   }
 };
 
@@ -531,6 +675,7 @@ var Toolset = class _Toolset {
 function trimTrailingSlash(url) {
   return url.endsWith("/") ? url.slice(0, -1) : url;
 }
+__name(trimTrailingSlash, "trimTrailingSlash");
 function buildAgentCard(entry, options) {
   const base = trimTrailingSlash(options.baseUrl);
   return {
@@ -543,14 +688,24 @@ function buildAgentCard(entry, options) {
       pushNotifications: false,
       stateTransitionHistory: false
     },
-    defaultInputModes: ["text"],
-    defaultOutputModes: ["text"],
-    skills: entry.tools.map((t) => ({ id: t.name, name: t.name, description: t.description }))
+    defaultInputModes: [
+      "text"
+    ],
+    defaultOutputModes: [
+      "text"
+    ],
+    skills: entry.tools.map((t) => ({
+      id: t.name,
+      name: t.name,
+      description: t.description
+    }))
   };
 }
+__name(buildAgentCard, "buildAgentCard");
 function wellKnownCardPath(agentName) {
   return `/.well-known/${agentName}/agent-card.json`;
 }
+__name(wellKnownCardPath, "wellKnownCardPath");
 
 // src/a2a/mcp-server-manifest.ts
 var MCP_PROTOCOL_VERSION = "2024-11-05";
@@ -558,20 +713,33 @@ function buildMcpToolDescriptors(entry) {
   return entry.tools.map((t) => ({
     name: t.name,
     description: t.description,
-    inputSchema: { type: "object", properties: {} }
+    inputSchema: {
+      type: "object",
+      properties: {}
+    }
   }));
 }
+__name(buildMcpToolDescriptors, "buildMcpToolDescriptors");
 function mcpServerInfo(entry) {
-  return { name: entry.name, version: "1.0", protocolVersion: MCP_PROTOCOL_VERSION };
+  return {
+    name: entry.name,
+    version: "1.0",
+    protocolVersion: MCP_PROTOCOL_VERSION
+  };
 }
+__name(mcpServerInfo, "mcpServerInfo");
 
 // src/a2a/a2a-client.ts
 function buildHeaders(config) {
-  const headers = { "content-type": "application/json", ...config.headers };
+  const headers = {
+    "content-type": "application/json",
+    ...config.headers
+  };
   if (config.auth?.bearer) headers.authorization = `Bearer ${config.auth.bearer}`;
   if (config.auth?.apiKey) headers[config.auth.apiKey.header] = config.auth.apiKey.value;
   return headers;
 }
+__name(buildHeaders, "buildHeaders");
 function createA2ATool(config) {
   const doFetch = config.fetchImpl ?? fetch;
   return {
@@ -579,24 +747,34 @@ function createA2ATool(config) {
     description: config.description,
     inputSchema: {
       type: "object",
-      properties: { message: { type: "string", description: "The message to send to the remote agent." } },
-      required: ["message"]
+      properties: {
+        message: {
+          type: "string",
+          description: "The message to send to the remote agent."
+        }
+      },
+      required: [
+        "message"
+      ]
     },
-    handler: async (input) => {
+    handler: /* @__PURE__ */ __name(async (input) => {
       const message = typeof input.message === "string" ? input.message : "";
       const res = await doFetch(config.url, {
         method: "POST",
         headers: buildHeaders(config),
-        body: JSON.stringify({ message })
+        body: JSON.stringify({
+          message
+        })
       });
       if (!res.ok) {
         throw new Error(`A2A call to "${config.name}" failed: ${res.status} ${res.statusText}`);
       }
       const data = await res.json();
       return data.response ?? data.text ?? "";
-    }
+    }, "handler")
   };
 }
+__name(createA2ATool, "createA2ATool");
 
 // src/conversation-scope.ts
 var SEPARATOR = "/";
@@ -605,14 +783,19 @@ function deriveConversationId(resource, thread) {
   if (!thread) throw new Error("[@theokit/agents] deriveConversationId: thread must be non-empty");
   return `${encodeURIComponent(resource)}${SEPARATOR}${encodeURIComponent(thread)}`;
 }
+__name(deriveConversationId, "deriveConversationId");
 function parseConversationId(id) {
   const idx = id.indexOf(SEPARATOR);
   if (idx <= 0 || idx >= id.length - 1) return null;
   const resource = decodeURIComponent(id.slice(0, idx));
   const thread = decodeURIComponent(id.slice(idx + 1));
   if (!resource || !thread) return null;
-  return { resource, thread };
+  return {
+    resource,
+    thread
+  };
 }
+__name(parseConversationId, "parseConversationId");
 
 // src/skills-resolver.ts
 async function resolveEnabledSkills(selection, ctx) {
@@ -628,15 +811,22 @@ async function resolveEnabledSkills(selection, ctx) {
   if (!names.every((n) => typeof n === "string" && n.trim().length > 0)) {
     throw new Error("[@theokit/agents] skills resolver must return non-empty skill NAME strings");
   }
-  return [...names];
+  return [
+    ...names
+  ];
 }
+__name(resolveEnabledSkills, "resolveEnabledSkills");
 
 // src/acp/protocol.ts
 function encodeAcpMessage(message) {
   return `${JSON.stringify(message)}
 `;
 }
+__name(encodeAcpMessage, "encodeAcpMessage");
 var AcpMessageDecoder = class {
+  static {
+    __name(this, "AcpMessageDecoder");
+  }
   buffer = "";
   /** Feed a chunk; returns the messages completed by this chunk (possibly empty). */
   push(chunk) {
@@ -650,7 +840,9 @@ var AcpMessageDecoder = class {
         try {
           messages.push(JSON.parse(line));
         } catch (cause) {
-          throw new Error(`[@theokit/agents] ACP decode failed on line: ${line}`, { cause });
+          throw new Error(`[@theokit/agents] ACP decode failed on line: ${line}`, {
+            cause
+          });
         }
       }
       newlineIndex = this.buffer.indexOf("\n");
@@ -663,10 +855,20 @@ var AcpMessageDecoder = class {
 function isResponse(m) {
   return typeof m.id === "number" && ("result" in m || "error" in m) && !("method" in m);
 }
+__name(isResponse, "isResponse");
 function isServerRequest(m) {
   return typeof m.method === "string" && typeof m.id === "number";
 }
+__name(isServerRequest, "isServerRequest");
 var AcpClient = class {
+  static {
+    __name(this, "AcpClient");
+  }
+  transport;
+  nextId = 1;
+  pending = /* @__PURE__ */ new Map();
+  handlers = /* @__PURE__ */ new Map();
+  decoder = new AcpMessageDecoder();
   constructor(transport) {
     this.transport = transport;
     transport.subscribe((chunk) => {
@@ -675,17 +877,20 @@ var AcpClient = class {
       }
     });
   }
-  transport;
-  nextId = 1;
-  pending = /* @__PURE__ */ new Map();
-  handlers = /* @__PURE__ */ new Map();
-  decoder = new AcpMessageDecoder();
   /** Send a JSON-RPC request and resolve with its `result` (or reject on `error`). */
   request(method, params) {
     const id = this.nextId++;
     return new Promise((resolve, reject) => {
-      this.pending.set(id, { resolve, reject });
-      this.transport.send(encodeAcpMessage({ jsonrpc: "2.0", id, method, params }));
+      this.pending.set(id, {
+        resolve,
+        reject
+      });
+      this.transport.send(encodeAcpMessage({
+        jsonrpc: "2.0",
+        id,
+        method,
+        params
+      }));
     });
   }
   /** Register a handler for a server→client request method (e.g. `session/request_permission`). */
@@ -708,22 +913,32 @@ var AcpClient = class {
   async handleServerRequest(req) {
     const handler = this.handlers.get(req.method);
     if (!handler) {
-      this.transport.send(
-        encodeAcpMessage({ jsonrpc: "2.0", id: req.id, error: { code: -32601, message: `No handler: ${req.method}` } })
-      );
+      this.transport.send(encodeAcpMessage({
+        jsonrpc: "2.0",
+        id: req.id,
+        error: {
+          code: -32601,
+          message: `No handler: ${req.method}`
+        }
+      }));
       return;
     }
     try {
       const result = await handler(req.params);
-      this.transport.send(encodeAcpMessage({ jsonrpc: "2.0", id: req.id, result }));
+      this.transport.send(encodeAcpMessage({
+        jsonrpc: "2.0",
+        id: req.id,
+        result
+      }));
     } catch (err) {
-      this.transport.send(
-        encodeAcpMessage({
-          jsonrpc: "2.0",
-          id: req.id,
-          error: { code: -32603, message: err instanceof Error ? err.message : "handler failed" }
-        })
-      );
+      this.transport.send(encodeAcpMessage({
+        jsonrpc: "2.0",
+        id: req.id,
+        error: {
+          code: -32603,
+          message: err instanceof Error ? err.message : "handler failed"
+        }
+      }));
     }
   }
 };
@@ -733,12 +948,7 @@ import { Squad, Tool, Provider } from "@theokit/sdk";
 import { setDiagnosticsSink } from "@theokit/sdk";
 import { SubAgent } from "@theokit/sdk/a2a";
 import { assertNoSymlinkEscape, isForbiddenPath, safePathJoin } from "@theokit/sdk/path-safety";
-import {
-  CONTEXT_WINDOW_FLOOR,
-  CONTEXT_WINDOW_MARGIN,
-  ContextWindowMarginError,
-  resolveEffectiveContextWindow
-} from "@theokit/sdk/compaction";
+import { CONTEXT_WINDOW_FLOOR, CONTEXT_WINDOW_MARGIN, ContextWindowMarginError, resolveEffectiveContextWindow } from "@theokit/sdk/compaction";
 export * from "@theokit/sdk/errors";
 export * from "@theokit/sdk/retry";
 export * from "@theokit/sdk/concurrency";
@@ -749,10 +959,11 @@ import { BudgetExceededError as BudgetExceededError2 } from "@theokit/sdk/errors
 
 // src/in-process-turn.ts
 var InProcessApprovalRequiredError = class extends Error {
+  static {
+    __name(this, "InProcessApprovalRequiredError");
+  }
   constructor(toolNames) {
-    super(
-      `Agent has HITL-gated tool(s) [${toolNames.join(", ")}] but no \`awaitApproval\` resolver was supplied to streamAgentTurnInProcess. In-process runs must resolve approvals inline \u2014 pass awaitApproval, or remove the gate. Refused (fail-closed).`
-    );
+    super(`Agent has HITL-gated tool(s) [${toolNames.join(", ")}] but no \`awaitApproval\` resolver was supplied to streamAgentTurnInProcess. In-process runs must resolve approvals inline \u2014 pass awaitApproval, or remove the gate. Refused (fail-closed).`);
     this.name = "InProcessApprovalRequiredError";
   }
 };
@@ -762,40 +973,69 @@ function postureResolver(posturePolicy) {
     case "interactive":
       return posturePolicy.awaitApproval;
     case "auto-approve":
-      return () => Promise.resolve({ approved: true, reason: posturePolicy.reason });
+      return () => Promise.resolve({
+        approved: true,
+        reason: posturePolicy.reason
+      });
     case "auto-reject":
-      return () => Promise.resolve({ approved: false, reason: posturePolicy.reason });
+      return () => Promise.resolve({
+        approved: false,
+        reason: posturePolicy.reason
+      });
     case "owned-by-surface":
       return void 0;
   }
 }
-function streamAgentTurnInProcess(mod, apiKey, input, deps = { stream: streamAgentUIMessages }) {
+__name(postureResolver, "postureResolver");
+function streamAgentTurnInProcess(mod, apiKey, input, deps = {
+  stream: streamAgentUIMessages
+}) {
   const compiled = compileAgentModule(mod, input.source);
   const gated = compiled.hitl;
   if (gated && gated.size > 0 && !input.awaitApproval && input.approvals === void 0) {
-    throw new InProcessApprovalRequiredError([...gated.keys()]);
+    throw new InProcessApprovalRequiredError([
+      ...gated.keys()
+    ]);
   }
   const resolve = input.awaitApproval;
-  const approvalResolver = resolve ? (approvalId, opts, toolName) => resolve({ approvalId, toolName, opts }) : postureResolver(input.approvals);
-  const hitl = gated && gated.size > 0 && approvalResolver ? { gated, awaitApproval: approvalResolver } : void 0;
+  const approvalResolver = resolve ? (approvalId, opts, toolName) => resolve({
+    approvalId,
+    toolName,
+    opts
+  }) : postureResolver(input.approvals);
+  const hitl = gated && gated.size > 0 && approvalResolver ? {
+    gated,
+    awaitApproval: approvalResolver
+  } : void 0;
   const sessionId = input.sessionId ?? crypto.randomUUID();
   return (async function* () {
     if (compiled.skillsResolver) {
       const enabled = await resolveEnabledSkills(compiled.skillsResolver, compiled.runContext ?? {});
-      if (enabled !== void 0) compiled.skills = { enabled, autoInject: true };
+      if (enabled !== void 0) compiled.skills = {
+        enabled,
+        autoInject: true
+      };
     }
     yield* deps.stream(compiled, apiKey, {
       message: input.message,
       // M35 — pass images through so the SDK send uses the structured `{ text, images }` form.
-      ...input.images !== void 0 ? { images: input.images } : {},
+      ...input.images !== void 0 ? {
+        images: input.images
+      } : {},
       sessionId,
       hitl,
-      signal: input.signal
+      signal: input.signal,
+      ...input.onRunEvent !== void 0 ? {
+        onRunEvent: input.onRunEvent
+      } : {}
     });
   })();
 }
+__name(streamAgentTurnInProcess, "streamAgentTurnInProcess");
 
 // src/index.ts
+import { applySecurityFloor, auditEnvReachability, foldLayers, recordWiring, resolveTrustPosture, verifyLayerOrdering } from "@theokit/sdk";
+import { GenerateObjectError, LayerOrderError, StreamObjectError, ToolError, UngatedCapabilityError } from "@theokit/sdk";
 var Agent = AgentDoSdk;
 export {
   AGENT_BRAND,
@@ -824,12 +1064,14 @@ export {
   DelegationBudgetExceededError,
   DelegationError,
   FieldCapability,
+  GenerateObjectError,
   GoalRunner,
   GuardrailViolationError,
   GuardrailsCapability,
   HumanInTheLoopCapability,
   InProcessApprovalRequiredError,
   JudgeCredentialError,
+  LayerOrderError,
   MCP_PROTOCOL_VERSION,
   MainLoopCapability,
   McpFileError,
@@ -845,18 +1087,24 @@ export {
   SkillsOptionsCapability,
   SkillsResolverCapability,
   Squad,
+  StreamObjectError,
   SubAgent,
   SubAgentsCapability,
   Tool,
+  ToolError,
   ToolboxCapability,
   ToolsCapability,
   Toolset,
   ToolsetError,
+  UngatedCapabilityError,
   UnknownCapabilityError,
+  UntrustedSettingSourceError,
   BudgetExceededError2 as WindowBudgetExceededError,
   agentsPlugin,
   applyCapabilities,
+  applySecurityFloor,
   assertNoSymlinkEscape,
+  auditEnvReachability,
   buildAgentCard,
   buildMcpToolDescriptors,
   buildModelSelection,
@@ -883,6 +1131,7 @@ export {
   encodeAcpMessage,
   estimateTokens,
   extractThinkTagStream,
+  foldLayers,
   generateAgentManifest,
   generateAgentRoutes,
   isAgentContext,
@@ -911,12 +1160,15 @@ export {
   projectContextMetadataOnlyKnobs,
   promptInjectionDetector,
   reasoningEffortOf,
+  recordWiring,
   reflectionStrategyConfigSchema,
   resolveCompactionStrategy,
   resolveEffectiveContextWindow,
   resolveEnabledSkills,
   resolveLoopStrategy,
   resolveMcpServers,
+  resolveSettingSources,
+  resolveTrustPosture,
   runInputGuards,
   runOutputGuards,
   runWithApiErrorHandling,
@@ -930,6 +1182,7 @@ export {
   tokenBudgetCompactionStrategy,
   translateSdkEvent,
   unicodeNormalizer,
+  verifyLayerOrdering,
   wellKnownCardPath
 };
 //# sourceMappingURL=index.js.map