@theokit/agents 7.6.0 → 8.0.0

package/dist/hooks.js

@@ -0,0 +1,286 @@
+import {
+  __name
+} from "./chunk-Z4QWC7IK.js";
+
+// src/hooks/hook-spec.ts
+import { randomBytes } from "crypto";
+import { TheokitAgentError } from "@theokit/sdk/errors";
+import { z } from "zod";
+
+// src/hooks/hook-fingerprint.ts
+import { createHash } from "crypto";
+var FIELD_SEPARATOR = "";
+function hookFingerprint(identity) {
+  const canonical = [
+    identity.command,
+    identity.event,
+    identity.matcher ?? "",
+    String(identity.timeoutMs)
+  ].join(FIELD_SEPARATOR);
+  return createHash("sha256").update(canonical, "utf8").digest("hex");
+}
+__name(hookFingerprint, "hookFingerprint");
+
+// src/hooks/hook-runner.ts
+import { spawn } from "child_process";
+var MAX_OUTPUT_BYTES = 1048576;
+var DRAIN_BUDGET_MS = 2e3;
+var CHAIN_BUDGET_MULTIPLIER = 4;
+async function runHookCommand(input) {
+  return new Promise((resolve) => {
+    const child = spawn(input.command, {
+      cwd: input.cwd,
+      shell: true,
+      // Trap 3: its own process group, so the timeout can kill the whole tree.
+      detached: true,
+      env: input.env,
+      stdio: [
+        "pipe",
+        "pipe",
+        "pipe"
+      ]
+    });
+    let stdout = "";
+    let stderr = "";
+    let truncated = false;
+    let timedOut = false;
+    let settled = false;
+    const capture = /* @__PURE__ */ __name((current, chunk) => {
+      if (current.length >= MAX_OUTPUT_BYTES) {
+        truncated = true;
+        return current;
+      }
+      const next = current + chunk.toString("utf8");
+      if (next.length <= MAX_OUTPUT_BYTES) return next;
+      truncated = true;
+      return next.slice(0, MAX_OUTPUT_BYTES);
+    }, "capture");
+    child.stdout.on("data", (chunk) => {
+      stdout = capture(stdout, chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr = capture(stderr, chunk);
+    });
+    const settle = /* @__PURE__ */ __name((exitCode) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      clearTimeout(drainTimer);
+      resolve({
+        exitCode,
+        stdout,
+        stderr,
+        truncated,
+        timedOut
+      });
+    }, "settle");
+    const timer = setTimeout(() => {
+      timedOut = true;
+      killGroup(child.pid);
+    }, input.timeoutMs);
+    let drainTimer = setTimeout(() => void 0, 0);
+    child.on("exit", (code) => {
+      drainTimer = setTimeout(() => {
+        settle(code);
+      }, DRAIN_BUDGET_MS);
+    });
+    child.on("close", (code) => {
+      settle(code);
+    });
+    child.on("error", () => {
+      settle(null);
+    });
+    child.stdin.on("error", () => void 0);
+    if (input.stdin !== void 0) child.stdin.end(input.stdin);
+    else child.stdin.end();
+  });
+}
+__name(runHookCommand, "runHookCommand");
+function killGroup(pid) {
+  if (pid === void 0) return;
+  try {
+    process.kill(-pid, "SIGKILL");
+  } catch {
+  }
+}
+__name(killGroup, "killGroup");
+
+// src/hooks/hook-spec.ts
+var HOOK_EVENTS = [
+  "pre_tool_call",
+  "post_tool_call",
+  "transform_tool_result",
+  "transform_llm_output",
+  "on_session_start",
+  "on_session_end",
+  "pre_user_send",
+  "post_assistant_reply"
+];
+var DEFAULT_HOOK_TIMEOUT_MS = 3e4;
+var DEFAULT_CONTINUATION_BUDGET = 3;
+var hookSpecSchema = z.object({
+  event: z.enum(HOOK_EVENTS),
+  command: z.string().min(1).refine((value) => !/[\u0000-\u001f\u007f]/.test(value), {
+    message: "command contains control characters that would be hidden in the approval dialog"
+  }),
+  /** Selector for which tools/messages this fires on. Absent means all. */
+  matcher: z.string().optional(),
+  timeout_ms: z.number().int().positive().default(DEFAULT_HOOK_TIMEOUT_MS)
+}).strict();
+var HookSpecError = class extends TheokitAgentError {
+  static {
+    __name(this, "HookSpecError");
+  }
+  name = "HookSpecError";
+  constructor(message) {
+    super(message, {
+      code: "HOOK_SPEC_INVALID",
+      // A typo in a config file is not a transient condition.
+      isRetryable: false
+    });
+  }
+};
+function parseHookSpecs(input) {
+  const parsed = z.array(hookSpecSchema).safeParse(input);
+  if (!parsed.success) {
+    throw new HookSpecError(`invalid hook configuration: ${parsed.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")}`);
+  }
+  return parsed.data;
+}
+__name(parseHookSpecs, "parseHookSpecs");
+var IGNORE_WARNING = /* @__PURE__ */ __name(() => void 0, "IGNORE_WARNING");
+function buildHookHandlers(specs, options) {
+  const warn = options.onWarn ?? IGNORE_WARNING;
+  if (!options.trusted) {
+    if (specs.length > 0) {
+      warn(`${String(specs.length)} hook(s) declared but the directory is not trusted \u2014 none will run.`);
+    }
+    return {};
+  }
+  const runnable = specs.filter((spec) => {
+    const approved = options.approved.has(hookFingerprint(identityOf(spec)));
+    if (!approved) {
+      warn(`hook not approved and will not run: "${spec.command}" on ${spec.event}. Approve it by fingerprint \u2014 editing the command invalidates any previous approval, by design.`);
+    }
+    return approved;
+  });
+  if (runnable.length === 0) return {};
+  const handlers = {};
+  const chainBudgetMs = Math.max(...runnable.map((spec) => spec.timeout_ms)) * CHAIN_BUDGET_MULTIPLIER;
+  const preHooks = runnable.filter((spec) => spec.event === "pre_tool_call");
+  if (preHooks.length > 0) {
+    handlers.pre_tool_call = async (ctx) => {
+      const started = Date.now();
+      for (const spec of preHooks) {
+        if (Date.now() - started > chainBudgetMs) {
+          return {
+            block: true,
+            message: "hook chain exceeded its time budget"
+          };
+        }
+        if (!matches(spec, ctx.name)) continue;
+        const result = await runHookCommand({
+          command: spec.command,
+          cwd: options.cwd,
+          timeoutMs: spec.timeout_ms,
+          stdin: JSON.stringify({
+            tool: ctx.name,
+            args: ctx.args
+          }),
+          ...options.env !== void 0 && {
+            env: options.env
+          }
+        });
+        if (result.exitCode !== 0) {
+          return {
+            block: true,
+            message: fenceHookOutput(result.stdout || result.stderr || `hook exited ${String(result.exitCode)}`)
+          };
+        }
+      }
+      return void 0;
+    };
+  }
+  const postHooks = runnable.filter((spec) => spec.event === "post_tool_call");
+  if (postHooks.length > 0) {
+    handlers.post_tool_call = async (ctx) => {
+      const started = Date.now();
+      for (const spec of postHooks) {
+        if (Date.now() - started > chainBudgetMs) {
+          warn("hook chain exceeded its time budget; remaining post hooks were skipped");
+          return;
+        }
+        if (!matches(spec, ctx.name)) continue;
+        try {
+          const result = await runHookCommand({
+            command: spec.command,
+            cwd: options.cwd,
+            timeoutMs: spec.timeout_ms,
+            stdin: JSON.stringify({
+              tool: ctx.name,
+              args: ctx.args,
+              result: ctx.result
+            }),
+            ...options.env !== void 0 && {
+              env: options.env
+            }
+          });
+          if (result.exitCode !== 0) {
+            warn(`post hook "${spec.command}" exited ${String(result.exitCode)}`);
+          }
+          if (result.truncated) warn(`post hook "${spec.command}" output was truncated`);
+        } catch (error) {
+          warn(`post hook "${spec.command}" failed: ${error.message}`);
+        }
+      }
+    };
+  }
+  return handlers;
+}
+__name(buildHookHandlers, "buildHookHandlers");
+function identityOf(spec) {
+  return {
+    command: spec.command,
+    event: spec.event,
+    ...spec.matcher !== void 0 && {
+      matcher: spec.matcher
+    },
+    timeoutMs: spec.timeout_ms
+  };
+}
+__name(identityOf, "identityOf");
+function matches(spec, toolName) {
+  if (spec.matcher === void 0) return true;
+  try {
+    return new RegExp(spec.matcher).test(toolName);
+  } catch {
+    return false;
+  }
+}
+__name(matches, "matches");
+function fenceHookOutput(output) {
+  const nonce = randomBytes(8).toString("hex");
+  const open = `<hook-output nonce="${nonce}">`;
+  const close = `</hook-output nonce="${nonce}">`;
+  const escaped = output.replaceAll(close, close.replace("<", "&lt;"));
+  return `${open}
+${escaped}
+${close}`;
+}
+__name(fenceHookOutput, "fenceHookOutput");
+export {
+  CHAIN_BUDGET_MULTIPLIER,
+  DEFAULT_CONTINUATION_BUDGET,
+  DEFAULT_HOOK_TIMEOUT_MS,
+  DRAIN_BUDGET_MS,
+  HOOK_EVENTS,
+  HookSpecError,
+  MAX_OUTPUT_BYTES,
+  buildHookHandlers,
+  fenceHookOutput,
+  hookFingerprint,
+  hookSpecSchema,
+  parseHookSpecs,
+  runHookCommand
+};
+//# sourceMappingURL=hooks.js.map

package/dist/hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/hooks/hook-spec.ts","../src/hooks/hook-fingerprint.ts","../src/hooks/hook-runner.ts"],"mappings":";;;;;AAAA,SAASA,mBAAmB;AAE5B,SAASC,yBAAyB;AAClC,SAASC,SAAS;;;ACHlB,SAASC,kBAAkB;AAsC3B,IAAMC,kBAAkB;AASjB,SAASC,gBAAgBC,UAAsB;AACpD,QAAMC,YAAY;IAChBD,SAASE;IACTF,SAASG;IACTH,SAASI,WAAW;IACpBC,OAAOL,SAASM,SAAS;IACzBC,KAAKT,eAAAA;AACP,SAAOU,WAAW,QAAA,EAAUC,OAAOR,WAAW,MAAA,EAAQS,OAAO,KAAA;AAC/D;AARgBX;;;AC/ChB,SAASY,aAAa;AA+Bf,IAAMC,mBAAmB;AAQzB,IAAMC,kBAAkB;AAGxB,IAAMC,0BAA0B;AAgCvC,eAAsBC,eAAeC,OAAmB;AACtD,SAAO,IAAIC,QAAuB,CAACC,YAAAA;AAcjC,UAAMC,QAAQC,MAAMJ,MAAMK,SAAS;MACjCC,KAAKN,MAAMM;MACXC,OAAO;;MAEPC,UAAU;MACVC,KAAKT,MAAMS;MACXC,OAAO;QAAC;QAAQ;QAAQ;;IAC1B,CAAA;AAEA,QAAIC,SAAS;AACb,QAAIC,SAAS;AACb,QAAIC,YAAY;AAChB,QAAIC,WAAW;AACf,QAAIC,UAAU;AAEd,UAAMC,UAAU,wBAACC,SAAiBC,UAAAA;AAChC,UAAID,QAAQE,UAAUvB,kBAAkB;AACtCiB,oBAAY;AACZ,eAAOI;MACT;AACA,YAAMG,OAAOH,UAAUC,MAAMG,SAAS,MAAA;AACtC,UAAID,KAAKD,UAAUvB,iBAAkB,QAAOwB;AAC5CP,kBAAY;AACZ,aAAOO,KAAKE,MAAM,GAAG1B,gBAAAA;IACvB,GATgB;AAWhBO,UAAMQ,OAAOY,GAAG,QAAQ,CAACL,UAAAA;AACvBP,eAASK,QAAQL,QAAQO,KAAAA;IAC3B,CAAA;AACAf,UAAMS,OAAOW,GAAG,QAAQ,CAACL,UAAAA;AACvBN,eAASI,QAAQJ,QAAQM,KAAAA;IAC3B,CAAA;AAEA,UAAMM,SAAS,wBAACC,aAAAA;AACd,UAAIV,QAAS;AACbA,gBAAU;AACVW,mBAAaC,KAAAA;AACbD,mBAAaE,UAAAA;AACb1B,cAAQ;QAAEuB;QAAUd;QAAQC;QAAQC;QAAWC;MAAS,CAAA;IAC1D,GANe;AAQf,UAAMa,QAAQE,WAAW,MAAA;AACvBf,iBAAW;AACXgB,gBAAU3B,MAAM4B,GAAG;IACrB,GAAG/B,MAAMgC,SAAS;AAIlB,QAAIJ,aAA4CC,WAAW,MAAMI,QAAW,CAAA;AAC5E9B,UAAMoB,GAAG,QAAQ,CAACW,SAAAA;AAEhBN,mBAAaC,WAAW,MAAA;AACtBL,eAAOU,IAAAA;MACT,GAAGrC,eAAAA;IACL,CAAA;AACAM,UAAMoB,GAAG,SAAS,CAACW,SAAAA;AACjBV,aAAOU,IAAAA;IACT,CAAA;AACA/B,UAAMoB,GAAG,SAAS,MAAA;AAChBC,aAAO,IAAA;IACT,CAAA;AAYArB,UAAMgC,MAAMZ,GAAG,SAAS,MAAMU,MAAAA;AAC9B,QAAIjC,MAAMmC,UAAUF,OAAW9B,OAAMgC,MAAMC,IAAIpC,MAAMmC,KAAK;QACrDhC,OAAMgC,MAAMC,IAAG;EACtB,CAAA;AACF;AA3FsBrC;AAoGtB,SAAS+B,UAAUC,KAAuB;AACxC,MAAIA,QAAQE,OAAW;AACvB,MAAI;AACFI,YAAQC,KAAK,CAACP,KAAK,SAAA;EACrB,QAAQ;EAER;AACF;AAPSD;;;AF3IF,IAAMS,cAAc;EACzB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;AAMK,IAAMC,0BAA0B;AAQhC,IAAMC,8BAA8B;AAQpC,IAAMC,iBAAiBC,EAC3BC,OAAO;EACNC,OAAOF,EAAEG,KAAKP,WAAAA;EACdQ,SAASJ,EACNK,OAAM,EACNC,IAAI,CAAA,EAQJC,OAAO,CAACC,UAAU,CAAC,wBAAwBC,KAAKD,KAAAA,GAAQ;IACvDE,SAAS;EACX,CAAA;;EAEFC,SAASX,EAAEK,OAAM,EAAGO,SAAQ;EAC5BC,YAAYb,EAAEc,OAAM,EAAGC,IAAG,EAAGC,SAAQ,EAAGC,QAAQpB,uBAAAA;AAClD,CAAA,EACCqB,OAAM;AAWF,IAAMC,gBAAN,cAA4BC,kBAAAA;EAhGnC,OAgGmCA;;;EACfC,OAAO;EACzB,YAAYX,SAAiB;AAC3B,UAAMA,SAAS;MACbY,MAAM;;MAENC,aAAa;IACf,CAAA;EACF;AACF;AASO,SAASC,eAAeC,OAAc;AAC3C,QAAMC,SAAS1B,EAAE2B,MAAM5B,cAAAA,EAAgB6B,UAAUH,KAAAA;AACjD,MAAI,CAACC,OAAOG,SAAS;AACnB,UAAM,IAAIV,cACR,+BAA+BO,OAAOI,MAAMC,OACzCC,IAAI,CAACC,UAAU,GAAGA,MAAMC,KAAKC,KAAK,GAAA,CAAA,KAASF,MAAMvB,OAAO,EAAE,EAC1DyB,KAAK,IAAA,CAAA,EAAO;EAEnB;AACA,SAAOT,OAAOU;AAChB;AAVgBZ;AAgChB,IAAMa,iBAAiB,6BAAYC,QAAZ;AAQhB,SAASC,kBACdC,OACAC,SAAiC;AAEjC,QAAMC,OAAOD,QAAQE,UAAUN;AAC/B,MAAI,CAACI,QAAQG,SAAS;AACpB,QAAIJ,MAAMK,SAAS,GAAG;AACpBH,WACE,GAAGI,OAAON,MAAMK,MAAM,CAAA,0EAAsE;IAEhG;AACA,WAAO,CAAC;EACV;AAEA,QAAME,WAAWP,MAAMQ,OAAO,CAACC,SAAAA;AAC7B,UAAMC,WAAWT,QAAQS,SAASC,IAAIC,gBAAgBC,WAAWJ,IAAAA,CAAAA,CAAAA;AACjE,QAAI,CAACC,UAAU;AACbR,WACE,wCAAwCO,KAAK7C,OAAO,QAAQ6C,KAAK/C,KAAK,sGACa;IAEvF;AACA,WAAOgD;EACT,CAAA;AACA,MAAIH,SAASF,WAAW,EAAG,QAAO,CAAC;AAEnC,QAAMS,WAAyB,CAAC;AAChC,QAAMC,gBACJC,KAAKC,IAAG,GAAIV,SAASf,IAAI,CAACiB,SAASA,KAAKpC,UAAU,CAAA,IAAK6C;AAMzD,QAAMC,WAAWZ,SAASC,OAAO,CAACC,SAASA,KAAK/C,UAAU,eAAA;AAC1D,MAAIyD,SAASd,SAAS,GAAG;AACvBS,aAASM,gBAAgB,OAAOC,QAAAA;AAC9B,YAAMC,UAAUC,KAAKC,IAAG;AACxB,iBAAWf,QAAQU,UAAU;AAC3B,YAAII,KAAKC,IAAG,IAAKF,UAAUP,eAAe;AACxC,iBAAO;YAAEU,OAAO;YAAMvD,SAAS;UAAsC;QACvE;AACA,YAAI,CAACwD,QAAQjB,MAAMY,IAAIxC,IAAI,EAAG;AAC9B,cAAM8C,SAAS,MAAMC,eAAe;UAClChE,SAAS6C,KAAK7C;UACdiE,KAAK5B,QAAQ4B;UACbC,WAAWrB,KAAKpC;UAChB0D,OAAOC,KAAKC,UAAU;YAAEC,MAAMb,IAAIxC;YAAMsD,MAAMd,IAAIc;UAAK,CAAA;UACvD,GAAIlC,QAAQmC,QAAQtC,UAAa;YAAEsC,KAAKnC,QAAQmC;UAAI;QACtD,CAAA;AACA,YAAIT,OAAOU,aAAa,GAAG;AACzB,iBAAO;YACLZ,OAAO;YACPvD,SAASoE,gBACPX,OAAOY,UAAUZ,OAAOa,UAAU,eAAelC,OAAOqB,OAAOU,QAAQ,CAAA,EAAG;UAE9E;QACF;MACF;AACA,aAAOvC;IACT;EACF;AAEA,QAAM2C,YAAYlC,SAASC,OAAO,CAACC,SAASA,KAAK/C,UAAU,gBAAA;AAC3D,MAAI+E,UAAUpC,SAAS,GAAG;AACxBS,aAAS4B,iBAAiB,OAAOrB,QAAAA;AAC/B,YAAMC,UAAUC,KAAKC,IAAG;AACxB,iBAAWf,QAAQgC,WAAW;AAC5B,YAAIlB,KAAKC,IAAG,IAAKF,UAAUP,eAAe;AACxCb,eAAK,wEAAA;AACL;QACF;AACA,YAAI,CAACwB,QAAQjB,MAAMY,IAAIxC,IAAI,EAAG;AAC9B,YAAI;AACF,gBAAM8C,SAAS,MAAMC,eAAe;YAClChE,SAAS6C,KAAK7C;YACdiE,KAAK5B,QAAQ4B;YACbC,WAAWrB,KAAKpC;YAChB0D,OAAOC,KAAKC,UAAU;cAAEC,MAAMb,IAAIxC;cAAMsD,MAAMd,IAAIc;cAAMR,QAAQN,IAAIM;YAAO,CAAA;YAC3E,GAAI1B,QAAQmC,QAAQtC,UAAa;cAAEsC,KAAKnC,QAAQmC;YAAI;UACtD,CAAA;AACA,cAAIT,OAAOU,aAAa,GAAG;AAEzBnC,iBAAK,cAAcO,KAAK7C,OAAO,YAAY0C,OAAOqB,OAAOU,QAAQ,CAAA,EAAG;UACtE;AACA,cAAIV,OAAOgB,UAAWzC,MAAK,cAAcO,KAAK7C,OAAO,wBAAwB;QAC/E,SAAS0B,OAAO;AACdY,eAAK,cAAcO,KAAK7C,OAAO,aAAc0B,MAAgBpB,OAAO,EAAE;QACxE;MACF;IACF;EACF;AAEA,SAAO4C;AACT;AA9FgBf;AAiGhB,SAASc,WAAWJ,MAAc;AAChC,SAAO;IACL7C,SAAS6C,KAAK7C;IACdF,OAAO+C,KAAK/C;IACZ,GAAI+C,KAAKtC,YAAY2B,UAAa;MAAE3B,SAASsC,KAAKtC;IAAQ;IAC1D2D,WAAWrB,KAAKpC;EAClB;AACF;AAPSwC;AAoBT,SAASa,QAAQjB,MAAgBmC,UAAgB;AAC/C,MAAInC,KAAKtC,YAAY2B,OAAW,QAAO;AACvC,MAAI;AAEF,WAAO,IAAI+C,OAAOpC,KAAKtC,OAAO,EAAEF,KAAK2E,QAAAA;EACvC,QAAQ;AACN,WAAO;EACT;AACF;AARSlB;AAsBF,SAASY,gBAAgBQ,QAAc;AAC5C,QAAMC,QAAQC,YAAY,CAAA,EAAGC,SAAS,KAAA;AACtC,QAAMC,OAAO,uBAAuBH,KAAAA;AACpC,QAAMI,QAAQ,wBAAwBJ,KAAAA;AAGtC,QAAMK,UAAUN,OAAOO,WAAWF,OAAOA,MAAMG,QAAQ,KAAK,MAAA,CAAA;AAC5D,SAAO,GAAGJ,IAAAA;EAASE,OAAAA;EAAYD,KAAAA;AACjC;AARgBb;","names":["randomBytes","TheokitAgentError","z","createHash","FIELD_SEPARATOR","hookFingerprint","identity","canonical","command","event","matcher","String","timeoutMs","join","createHash","update","digest","spawn","MAX_OUTPUT_BYTES","DRAIN_BUDGET_MS","CHAIN_BUDGET_MULTIPLIER","runHookCommand","input","Promise","resolve","child","spawn","command","cwd","shell","detached","env","stdio","stdout","stderr","truncated","timedOut","settled","capture","current","chunk","length","next","toString","slice","on","settle","exitCode","clearTimeout","timer","drainTimer","setTimeout","killGroup","pid","timeoutMs","undefined","code","stdin","end","process","kill","HOOK_EVENTS","DEFAULT_HOOK_TIMEOUT_MS","DEFAULT_CONTINUATION_BUDGET","hookSpecSchema","z","object","event","enum","command","string","min","refine","value","test","message","matcher","optional","timeout_ms","number","int","positive","default","strict","HookSpecError","TheokitAgentError","name","code","isRetryable","parseHookSpecs","input","parsed","array","safeParse","success","error","issues","map","issue","path","join","data","IGNORE_WARNING","undefined","buildHookHandlers","specs","options","warn","onWarn","trusted","length","String","runnable","filter","spec","approved","has","hookFingerprint","identityOf","handlers","chainBudgetMs","Math","max","CHAIN_BUDGET_MULTIPLIER","preHooks","pre_tool_call","ctx","started","Date","now","block","matches","result","runHookCommand","cwd","timeoutMs","stdin","JSON","stringify","tool","args","env","exitCode","fenceHookOutput","stdout","stderr","postHooks","post_tool_call","truncated","toolName","RegExp","output","nonce","randomBytes","toString","open","close","escaped","replaceAll","replace"]}

package/dist/index.d.ts

@@ -1,7 +1,9 @@
 import { PluginsSettings, Plugin, ProviderRoutingSettings, AgentDefinition, BudgetTracker, CustomTool, GoalLoopAgent, GoalOptions, runGoalLoop, GoalEvent, GoalResult, InlineSkill, Agent as Agent$1, ListAgentsOptions, ListResult, SDKAgentInfo } from '@theokit/sdk';
-export { CustomTool, DiagnosticsSink, GenerateObjectError, GoalEvent, GoalLoopAgent, GoalOptions, GoalResult, JudgeCredentialError, JudgeResult, LayerOrderError, McpAuthConfig, McpHttpServerConfig, McpOAuthConfig, McpServerConfig, McpStdioServerConfig, Provider, SDKAgent, SessionRecord, Squad, StreamObjectError, Tool, ToolError, ToolResultContentBlock, TrustLevel, TrustPosture, TrustPostureInput, TrustSource, UngatedCapabilityError, Verdict, WiredEntity, applySecurityFloor, auditEnvReachability, foldLayers, recordWiring, resolveTrustPosture, setDiagnosticsSink, verifyLayerOrdering } from '@theokit/sdk';
-import { G as Guardrail, L as LoopStrategy, R as ReflectionStrategy, C as CompiledAgentOptions, M as MainLoopMeta, a as CompiledTool, b as ReasoningEffort, c as RoundStreamFactory, S as StreamEvent, D as DelegationResult, d as ContextWindowOptions, e as SkillsOptions, T as ToolOptions, A as ApprovalOptions, H as HumanInTheLoopOptions, f as AgentManifestEntry, g as HitlDecision, s as streamAgentUIMessages, h as ApprovalPosture } from './bridge-entry-CvmBrmc9.js';
-export { i as AGENT_BRAND, j as AfterToolCallContext, k as AgentBuilder, l as AgentDefinition, m as AgentDefinitionError, n as AgentExecutionContext, o as AgentManifest, p as AgentManifestSource, q as AgentManifestTool, r as AgentOptions, t as AgentRoute, u as AgentRouteContext, v as AgentRunInfo, w as AgentStreamEvent, x as AgentTurnMetadata, y as AgentsPluginOptions, z as ApiErrorContext, B as ApiErrorDecision, E as ApiErrorPolicy, F as ApprovalRequiredEvent, I as ArtifactChunkEvent, J as ArtifactStartEvent, K as BackgroundDelegation, N as BeforeToolCallContext, O as BudgetExceededError, P as BudgetOptions, Q as CheckpointSavedEvent, U as CompiledContextWindow, V as ContextualTool, W as CostBudgetExceededError, X as DEFAULT_MAX_ITERATIONS, Y as DefineAgentConfig, Z as DefinitionOrThunk, _ as DelegateFn, $ as DelegateOptions, a0 as DelegationBudgetExceededError, a1 as DelegationError, a2 as DoneEvent, a3 as ErrorEvent, a4 as FileEditEvent, a5 as GuardrailAction, a6 as GuardrailPhase, a7 as GuardrailResult, a8 as GuardrailViolationError, a9 as HookHandlers, aa as InferAgentInput, ab as InferAgentToolNames, ac as IterationEvent, ad as LLMCallContext, ae as LoopFinishReason, af as LoopOutcome, ag as LoopStrategyConfig, ah as MainLoopOptions, ai as McpApprovalSpec, aj as McpFileError, ak as McpRegistryConfig, al as McpRequestContext, am as McpSelection, an as McpServersMap, ao as PartialToolCallEvent, ap as PolicyHandler, aq as ProcessInputContext, ar as ProjectSettingsGrant, as as ReflectionContext, at as ReflectionResult, au as ReflectionStrategyConfig, av as RunStartedEvent, aw as ScoreVerdict, ax as ScoredDelegation, ay as Scorer, az as SdkAgentHandle, aA as SdkMessage, aB as SdkSendOptions, aC as SdkTurnHandle, aD as Segment, aE as SettingSourceCapability, aF as SettingSourcesSelection, aG as SkillsRequestContext, aH as SkillsSelection, aI as StateUpdateEvent, aJ as TextDeltaEvent, aK as ThinkingEvent, aL as TimeoutAction, aM as ToolCallEvent, aN as ToolCallVeto, aO as ToolHooks, aP as ToolHooksPlugin, aQ as ToolResultEvent, aR as ToolWalkResult, aS as ToolboxOptions, aT as ToolboxWalkResult, aU as UntrustedSettingSourceError, aV as agentsPlugin, aW as buildModelSelection, aX as compileAgentDefinition, aY as compileAgentModule, aZ as compileContextWindow, a_ as compileProjectContext, a$ as compileSkills, b0 as compileTools, b1 as createAgentExecutionContext, b2 as createApiErrorHandler, b3 as createSdkAgentStream, b4 as createThinkTagExtractor, b5 as createToolHooksPlugin, b6 as delegate, b7 as delegateBackground, b8 as delegateWithScoring, b9 as extractThinkTagStream, ba as generateAgentManifest, bb as generateAgentRoutes, bc as isAgentContext, bd as isAgentDefinition, be as isApprovalRequired, bf as isDone, bg as isError, bh as isPartialToolCall, bi as isTextDelta, bj as isToolCall, bk as isToolResult, bl as ladderReflectionStrategy, bm as loadMcpJson, bn as loopStrategyConfigSchema, bo as mcpRegistry, bp as mcpToolApprovals, bq as noopReflectionStrategy, br as presentUIMessageStream, bs as projectContextMetadataOnlyKnobs, bt as reasoningEffortOf, bu as reflectionStrategyConfigSchema, bv as resolveEnabledSkills, bw as resolveLoopStrategy, bx as resolveMcpServers, by as resolveSettingSources, bz as runWithApiErrorHandling, bA as streamAgentResponse, bB as toAgentFactory, bC as translateSdkEvent } from './bridge-entry-CvmBrmc9.js';
+export { CustomTool, DiagnosticsSink, GenerateObjectError, GoalEvent, GoalLoopAgent, GoalOptions, GoalResult, JudgeCredentialError, JudgeResult, LayerOrderError, McpAuthConfig, McpHttpServerConfig, McpOAuthConfig, McpServerConfig, McpStdioServerConfig, Provider, RunEvent, SDKAgent, SessionRecord, Squad, StreamObjectError, Tool, ToolError, ToolResultContentBlock, TrustLevel, TrustPosture, TrustPostureInput, TrustSource, UngatedCapabilityError, Verdict, WiredEntity, applySecurityFloor, auditEnvReachability, foldLayers, recordWiring, resolveTrustPosture, setDiagnosticsSink, verifyLayerOrdering } from '@theokit/sdk';
+import { G as Guardrail, C as CompiledAgentOptions, M as MainLoopMeta, a as CompiledTool, R as ReasoningEffort, S as SettingSourcesSelection, T as ToolOptions, b as ApprovalOptions, H as HumanInTheLoopOptions } from './define-agent-3Kuf6iKM.js';
+export { c as AGENT_BRAND, A as AgentDefinition, d as AgentOptions, B as BudgetOptions, e as CostBudgetExceededError, D as DefineAgentConfig, f as GuardrailAction, g as GuardrailPhase, h as GuardrailResult, i as GuardrailViolationError, I as InferAgentInput, j as InferAgentToolNames, k as MainLoopOptions, l as McpServersMap, P as PolicyHandler, m as ProjectSettingsGrant, n as SettingSourceCapability, o as SkillsRequestContext, p as SkillsSelection, q as TimeoutAction, r as ToolWalkResult, s as ToolboxOptions, t as ToolboxWalkResult, U as UntrustedSettingSourceError, u as compileAgentDefinition, v as compileTools, w as isAgentDefinition, x as resolveEnabledSkills, y as resolveSettingSources } from './define-agent-3Kuf6iKM.js';
+import { L as LoopStrategy, R as ReflectionStrategy, a as RoundStreamFactory, S as StreamEvent, D as DelegationResult, C as ContextWindowOptions, b as SkillsOptions, A as AgentManifestEntry, H as HitlDecision, s as streamAgentUIMessages, c as ApprovalPosture } from './bridge-entry-BEniSXWE.js';
+export { d as AfterToolCallContext, e as AgentBuilder, f as AgentDefinitionError, g as AgentExecutionContext, h as AgentManifest, i as AgentManifestSource, j as AgentManifestTool, k as AgentRoute, l as AgentRouteContext, m as AgentRunInfo, n as AgentStreamEvent, o as AgentTurnMetadata, p as AgentsPluginOptions, q as ApiErrorContext, r as ApiErrorDecision, t as ApiErrorPolicy, u as ApprovalRequiredEvent, v as ArtifactChunkEvent, w as ArtifactStartEvent, B as BackgroundDelegation, x as BeforeToolCallContext, y as BudgetExceededError, z as CheckpointSavedEvent, E as CompiledContextWindow, F as ContextualTool, G as DEFAULT_MAX_ITERATIONS, I as DefinitionOrThunk, J as DelegateFn, K as DelegateOptions, M as DelegationBudgetExceededError, N as DelegationError, O as DelegationPort, P as DelegationTarget, Q as DelegationTimeoutError, T as DoneEvent, U as EphemeralAgent, V as ErrorEvent, W as FileEditEvent, X as IterationEvent, Y as LLMCallContext, Z as LoopFinishReason, _ as LoopOutcome, $ as LoopStrategyConfig, a0 as McpApprovalSpec, a1 as McpFileError, a2 as McpRegistryConfig, a3 as McpRequestContext, a4 as McpSelection, a5 as PartialToolCallEvent, a6 as ProcessInputContext, a7 as ReflectionContext, a8 as ReflectionResult, a9 as ReflectionStrategyConfig, aa as RunStartedEvent, ab as ScoreVerdict, ac as ScoredDelegation, ad as Scorer, ae as SdkAgentHandle, af as SdkMessage, ag as SdkSendOptions, ah as SdkTurnHandle, ai as Segment, aj as StateUpdateEvent, ak as TextDeltaEvent, al as ThinkingEvent, am as ToolCallEvent, an as ToolCallVeto, ao as ToolHooks, ap as ToolHooksPlugin, aq as ToolResultEvent, ar as agentsPlugin, as as buildModelSelection, at as compileAgentModule, au as compileContextWindow, av as compileProjectContext, aw as compileSkills, ax as createAgentExecutionContext, ay as createApiErrorHandler, az as createSdkAgentStream, aA as createThinkTagExtractor, aB as createToolHooksPlugin, aC as delegate, aD as delegateBackground, aE as delegateWithScoring, aF as extractThinkTagStream, aG as generateAgentManifest, aH as generateAgentRoutes, aI as isAgentContext, aJ as isApprovalRequired, aK as isDone, aL as isError, aM as isPartialToolCall, aN as isTextDelta, aO as isToolCall, aP as isToolResult, aQ as ladderReflectionStrategy, aR as loadMcpJson, aS as loopStrategyConfigSchema, aT as mcpRegistry, aU as mcpToolApprovals, aV as noopReflectionStrategy, aW as presentUIMessageStream, aX as projectContextMetadataOnlyKnobs, aY as reasoningEffortOf, aZ as reflectionStrategyConfigSchema, a_ as resolveLoopStrategy, a$ as resolveMcpServers, b0 as runWithApiErrorHandling, b1 as streamAgentResponse, b2 as toAgentFactory, b3 as translateSdkEvent, b4 as withClockCap, b5 as withEphemeralAgent } from './bridge-entry-BEniSXWE.js';
 import { TheokitAgentError } from '@theokit/sdk/errors';
 export * from '@theokit/sdk/errors';
 export { ConfigurationError, BudgetExceededError as WindowBudgetExceededError } from '@theokit/sdk/errors';
@@ -15,9 +17,14 @@ export { assertNoSymlinkEscape, isForbiddenPath, safePathJoin } from '@theokit/s
 export * from '@theokit/sdk/concurrency';
 export * from '@theokit/sdk/messages';
 export * from '@theokit/sdk/models';
+import { DiscoverSubagentsOptions } from '@theokit/sdk/subagents-loader';
 export { AgentDefinition as SubagentDefinition, discoverSubagents, loadSubagentDefinition } from '@theokit/sdk/subagents-loader';
+export { H as HookHandlers } from './hook-handlers-Cw2FsnE5.js';
 import { WireChunk } from '@theokit/presenter/wire';
+export { WireChunk, WireDataPart } from '@theokit/presenter/wire';
+export { ContentChunk, LifecycleItem, LifecycleVocabulary, TurnLifecycle, TurnOutcome, foldTurnLifecycle } from '@theokit/presenter';
 import '@theokit/http';
+import '@theokit/sdk/sandbox';
 
 /**
  * M9 (theokit-ai-first) — built-in guardrail detectors.
@@ -470,6 +477,36 @@ declare class GoalRunner {
     run(goal: string, options?: GoalOptions, deps?: GoalRunnerDeps): AsyncGenerator<GoalEvent, GoalResult, void>;
 }
 
+/**
+ * M69 — render one {@link GoalEvent} as a line, exhaustively and safely.
+ *
+ * ## Why this exists
+ *
+ * `GoalEvent` is a closed discriminated union of five variants. Every consumer that renders a goal
+ * run switched on it, and TypeScript made that switch exhaustive against the types they had
+ * installed — which is precisely the problem: the day the SDK adds a sixth variant in a minor, each
+ * of those switches is silently non-exhaustive at runtime while still compiling.
+ *
+ * So every consumer wrote the same default branch for an event it could not name. This function is
+ * that branch, written once, where the knowledge belongs.
+ *
+ * ## Exhaustive-safe means both halves
+ *
+ * **Compile time:** the `never` assignment at the end of the switch fails the build if a variant is
+ * added to the union — here, in the one file that claims to know them all, rather than in every
+ * consumer.
+ *
+ * **Run time:** an event whose `type` this build does not recognise is still formatted, and the line
+ * says so. A render path that throws on a forward-compatible event turns an SDK minor into a
+ * crashed UI; a line that pretends to understand it is worse, because nobody notices. The honest
+ * output names the type and marks it unrecognised.
+ *
+ * The milestone allowed marking the published union OPEN instead. That was rejected: an open union
+ * makes the default branch *required*, which is the opposite of the stated goal — the consumer
+ * stops writing it.
+ */
+declare function formatGoalEvent(event: GoalEvent): string;
+
 /**
  * M52 — the capability layer: object-oriented, composable authoring that produces the EXISTING narrow
  * waist (`CompiledAgentOptions`), which `assembleM8CreateOptions` already turns into `Agent.create`
@@ -497,7 +534,15 @@ interface Capability {
     apply(draft: CompiledAgentOptionsDraft): void;
 }
 /** Two capabilities set the same scalar field to different values — a composition bug, never last-wins. */
-declare class CapabilityConflictError extends Error {
+/**
+ * M80 — extends {@link TheokitAgentError}, not plain `Error`.
+ *
+ * `isTransientError` is defined over `TheokitAgentError`, so a class outside that hierarchy is
+ * INVISIBLE to it and the only recourse left to a consumer is matching on message text. `code` is
+ * stable across a rename; `isRetryable` is DECLARED, because a default would be a retry policy
+ * nobody chose.
+ */
+declare class CapabilityConflictError extends TheokitAgentError {
     readonly name = "CapabilityConflictError";
     constructor(field: string, previous: unknown, next: unknown, capability: string);
 }
@@ -548,7 +593,15 @@ declare class SkillsCapability implements Capability {
  * capability names): resolving name → capability without a switch that grows per feature (OCP).
  */
 /** Fail-fast with the known set — never `undefined` leaking into the pipeline. */
-declare class UnknownCapabilityError extends Error {
+/**
+ * M80 — extends {@link TheokitAgentError}, not plain `Error`.
+ *
+ * `isTransientError` is defined over `TheokitAgentError`, so a class outside that hierarchy is
+ * INVISIBLE to it and the only recourse left to a consumer is matching on message text. `code` is
+ * stable across a rename; `isRetryable` is DECLARED, because a default would be a retry policy
+ * nobody chose.
+ */
+declare class UnknownCapabilityError extends TheokitAgentError {
     readonly name = "UnknownCapabilityError";
     constructor(requested: string, known: readonly string[]);
 }
@@ -670,10 +723,22 @@ declare class SkillsOptionsCapability implements Capability {
     constructor(options: SkillsOptions);
     apply(draft: CompiledAgentOptionsDraft): void;
 }
-/** Functional-path fields that had no decorator source — closing the gap list, not adding surface. */
-declare class SettingSourcesCapability extends FieldCapability<'settingSources'> {
+/**
+ * `.settingSources({ user, project })` → the resolved SDK roots.
+ *
+ * NOT a `FieldCapability` (M68). A raw pass-through here would let a bare `'project'` string reach
+ * `CompiledAgentOptions` — and `project` reads `<cwd>/.theokit/`, **including `hooks.json`, which
+ * executes shell**. Resolving through the gate is what makes the compiled value unable to express a
+ * root that no posture authorized.
+ *
+ * The refusal happens at `apply()` — build time — rather than at run assembly, per
+ * `error-handling.md` § 3: validate at the entry, fail before the value travels.
+ */
+declare class SettingSourcesCapability implements Capability {
+    private readonly selection;
     readonly name = "setting-sources";
-    protected readonly field: "settingSources";
+    constructor(selection: SettingSourcesSelection);
+    apply(draft: CompiledAgentOptionsDraft): void;
 }
 declare class PluginsCapability extends FieldCapability<'plugins'> {
     readonly name = "plugins";
@@ -727,6 +792,64 @@ declare class MainLoopCapability implements Capability {
     apply(draft: CompiledAgentOptionsDraft): void;
 }
 
+/**
+ * M69 — the composed shape of an agent, as a value the construction sites can consume.
+ *
+ * ## What this replaces
+ *
+ * `applyCapabilities` returns a `FinalizedDraft`: `Partial<CompiledAgentOptions>` plus a MUTABLE
+ * `provenance` array. That is the compiler's working surface — exactly right for capabilities,
+ * which enrich it in place — and it was also the only thing the capability layer handed back.
+ *
+ * So a caller that wanted the small answer ("which tools does this agent have, on which model, and
+ * who declared them?") had to depend on the entire compiled-options shape and receive an array it
+ * could push into. The three construction sites — the `AgentBuilder`, `Agent.create`, and roles
+ * loaded from disk — all need that same answer, and none of them should be handed the draft to get
+ * it.
+ *
+ * ## Why four fields
+ *
+ * `{ tools, model, reasoningEffort, provenance }` is what a caller composes and reasons about: what
+ * the agent can do, on which model, at what effort, and where each of those came from. Everything
+ * else in the compiled options is downstream projection. Publishing the narrow value is what keeps
+ * the wide internal one free to change — the reason it was internal in the first place.
+ *
+ * `provenance` is what makes the shape auditable rather than merely descriptive: two capabilities
+ * may both touch `tools`, and without it a reader cannot tell which one to go edit.
+ */
+interface AgentShape {
+    /** Identity of the agent this shape describes. */
+    readonly name: string;
+    /**
+     * Tools the composed capabilities contributed, in declaration order.
+     *
+     * `readonly CompiledTool[]`, not the draft's own `CompiledTool[]`: inheriting the draft's type
+     * would publish a MUTABLE array, which is the half of the problem this value exists to fix. The
+     * draft is mutable because capabilities enrich it in place; what the construction sites receive
+     * must not be.
+     */
+    readonly tools: readonly CompiledTool[];
+    /** Model id, when some capability declared one. */
+    readonly model?: string;
+    /** Extended-thinking effort, when declared. */
+    readonly reasoningEffort?: ReasoningEffort;
+    /** Which capability contributed which field. */
+    readonly provenance: readonly ProvenanceEntry[];
+}
+/**
+ * Compose `members` into a published {@link AgentShape}.
+ *
+ * A projection of `applyCapabilities`, never a second implementation — so it inherits the set-once
+ * discipline: a conflicting redeclaration still throws `CapabilityConflictError` rather than
+ * resolving silently. A narrower return type that swallowed the conflict would be a downgrade
+ * disguised as ergonomics.
+ *
+ * The result is frozen, including its arrays. The draft is mutable by design; the published value
+ * must not be, or the shape becomes a shared mutable and the next reader cannot tell whether what
+ * they hold is what was declared.
+ */
+declare function declareAgentShape(name: string, members: readonly Capability[]): AgentShape;
+
 /**
  * M53 — tools without `@Toolbox`/`@Tool`.
  *
@@ -1062,26 +1185,22 @@ declare class AcpClient {
 }
 
 /**
- * M35 (multi-surface) — the in-process agent-turn seam (Model A).
+ * M81 — the names of the subagents defined under `<cwd>/.theokit/agents/*.md`.
  *
- * The FRAMEWORK-owned sibling of the HTTP `mountAgent` and the stdout `runAgentInTerminal`: it runs a
- * compiled agent with the SAME `compileAgentModule` + SAME `streamAgentUIMessages` (G2 — reuses the
- * SDK runtime, reimplements nothing), but returns the raw `UIMessageChunk` generator so ANY consumer
- * drives it directly — the Ink TUI (M35), a Tauri window (M36), or a test — in a SINGLE process with
- * NO HTTP loopback, NO port, and NO CSRF (there is no network boundary to defend).
+ * ## Why one line deserves to exist
  *
- * The ONLY difference from the HTTP mount is HITL resolution: the mount pauses the run and resolves
- * the approval via a SECOND HTTP request to `/approve/:id` (the approval registry). In-process there
- * is no second request — the caller resolves the approval INLINE via `awaitApproval` (e.g. the Ink
- * TUI's y/n prompt). The gated-tool map is `compiled.hitl` verbatim, so the pause semantics are
- * byte-identical to the HTTP path; only the resolver differs. Parity with the mount is by
- * construction: both compile the module, resolve function-form skills, and call `streamAgentUIMessages`
- * with the same `{ message, sessionId, hitl }`.
+ * It is a SELECTOR over `discoverSubagents`, exactly as `loadSubagentDefinition` already is — and
+ * that module says why in its own words: *"one parser is the whole point"*.
  *
- * Consumers WILL still receive `tool-approval-request` chunks from the returned generator — they are
- * INFORMATIONAL (render them or ignore them). The authoritative human gate is `awaitApproval`, which
- * the SDK awaits BEFORE the gated tool runs; the chunk is not the gate.
+ * What was missing is not the logic; it is the REACH. A product that wants an inventory of
+ * subagents for a `/agents` command had no name-shaped answer to reach for, so it wrote a second
+ * reader over the same directory. Two readers of one convention disagree eventually — about
+ * frontmatter, about which files count, about what an absent directory means — and the disagreement
+ * shows up as a command that lists an agent the runtime cannot find.
+ *
+ * Sorted, because an inventory whose order changes per filesystem is an inventory nobody can diff.
  */
+declare function listSubagentNames(cwd: string, options?: DiscoverSubagentsOptions): Promise<readonly string[]>;
 
 /** An inline approval request handed to the caller's `awaitApproval` (the Ink/Tauri prompt). */
 interface InProcessApprovalRequest {
@@ -1144,7 +1263,16 @@ interface StreamAgentTurnDeps {
  * the correct posture: silently running a `@HumanInTheLoop`-gated tool with no human gate is exactly
  * the #99 class of bug. Typed so callers can catch it distinctly.
  */
-declare class InProcessApprovalRequiredError extends Error {
+/**
+ * M80 — extends {@link TheokitAgentError}, not plain `Error`.
+ *
+ * `isTransientError` is defined over `TheokitAgentError`, so a class outside that hierarchy is
+ * INVISIBLE to it and the only recourse left to a consumer is matching on message text. `code` is
+ * stable across a rename; `isRetryable` is DECLARED, because a default would be a retry policy
+ * nobody chose.
+ */
+declare class InProcessApprovalRequiredError extends TheokitAgentError {
+    readonly name = "InProcessApprovalRequiredError";
     constructor(toolNames: readonly string[]);
 }
 /**
@@ -1164,6 +1292,22 @@ type ListOptionsWithoutPagination = ListAgentsOptions & {
  * the previous minor keeps compiling; it will be removed in the next major.
  */
 type ListOptionsWithoutPaginationAlias = ListOptionsWithoutPagination;
+/**
+ * M71 — `Agent.delete` clears the REGISTRY ENTRY and never touches the transcript on disk.
+ *
+ * That asymmetry is not visible from the name, and the consumer that hit it had to discover it by
+ * measuring: it called `delete`, believed the session was gone, and found the `.jsonl` still there.
+ * A method whose name promises removal and delivers half of it is the kind of thing this layer is
+ * supposed to say out loud — the same reason the `list` narrowing above carries its own note.
+ *
+ * The whole answer is `deleteSession` in `@theokit/agents/session`, which returns
+ * `{ registryRemoved, transcriptRemoved }` precisely so the two stores are impossible to confuse,
+ * and refuses by default when the session is protected. Reach for that unless you specifically want
+ * the registry alone.
+ *
+ * Kept reachable rather than removed: narrowing it away would break a consumer that legitimately
+ * wants only the registry entry gone, and this layer's rule is that enriching never reduces.
+ */
 type AgentWithNarrowedList = Omit<typeof Agent$1, 'list'> & {
     list(options?: ListOptionsWithoutPagination): Promise<Omit<ListResult<SDKAgentInfo>, 'nextCursor'>>;
 };
@@ -1174,4 +1318,4 @@ type AgentWithNarrowedList = Omit<typeof Agent$1, 'list'> & {
 type AgentWithNarrowedListAlias = AgentWithNarrowedList;
 declare const Agent: AgentWithNarrowedList;
 
-export { type A2AAuth, type A2ACapabilities, type A2ASkill, type A2AToolConfig, AcpClient, AcpMessageDecoder, type AcpTransport, Agent, type AgentCard, type AgentConfig, AgentConfigCapability, AgentManifestEntry, AgentRunner, AgentRunnerBuilder, type AgentRunnerRunOptions, type AgentWithNarrowedListAlias, ApprovalOptions, ApprovalPosture, type BuildAgentCardOptions, type Capability, CapabilityConflictError, CapabilityPreset, CapabilityRegistry, CheckpointCapability, type CompactionCallOptions, type CompactionStrategyConfig, CompiledAgentOptions, type CompiledAgentOptionsDraft, CompiledTool, ContextWindowCapability, type CostGuardOptions, DEFAULT_KEEP_TOKENS, DelegationResult, FieldCapability, type FinalizedDraft, GoalRunner, type GoalRunnerDeps, Guardrail, GuardrailsCapability, HitlDecision, HumanInTheLoopCapability, HumanInTheLoopOptions, type InProcessApprovalRequest, InProcessApprovalRequiredError, type InProcessAwaitApproval, type ListOptionsWithoutPaginationAlias, LoopStrategy, MCP_PROTOCOL_VERSION, MainLoopCapability, MainLoopMeta, type McpJsonSchema, type McpServerInfo, McpServersCapability, type McpToolDescriptor, MemoryCapability, ModelCapability, type NamedTool, type OutputModerationOptions, type PiiOptions, PluginsCapability, ProjectContextCapability, type PromptInjectionOptions, type ProvenanceEntry, ReasoningEffort, ReflectionStrategy, RoundStreamFactory, RunContextCapability, SettingSourcesCapability, SkillsCapability, SkillsOptionsCapability, SkillsResolverCapability, type StreamAgentTurnDeps, type StreamAgentTurnInProcessInput, StreamEvent, SubAgentsCapability, type Summarize, type ToolComNome, type ToolDeclaration, ToolOptions, ToolboxCapability, type ToolboxSource, ToolsCapability, Toolset, ToolsetError, type TranscriptCompactionStrategy, UnknownCapabilityError, applyCapabilities, buildAgentCard, buildMcpToolDescriptors, compactionStrategyConfigSchema, costGuard, createA2ATool, createDraft, deriveConversationId, encodeAcpMessage, estimateTokens, mcpServerInfo, moderateOutputStream, outputModeration, parseConversationId, piiDetector, promptInjectionDetector, resolveCompactionStrategy, runInputGuards, runOutputGuards, setOnce, streamAgentTurnInProcess, streamAgentUIMessages, tokenBudgetCompactionStrategy, unicodeNormalizer, wellKnownCardPath };
+export { type A2AAuth, type A2ACapabilities, type A2ASkill, type A2AToolConfig, AcpClient, AcpMessageDecoder, type AcpTransport, Agent, type AgentCard, type AgentConfig, AgentConfigCapability, AgentManifestEntry, AgentRunner, AgentRunnerBuilder, type AgentRunnerRunOptions, type AgentShape, type AgentWithNarrowedListAlias, ApprovalOptions, ApprovalPosture, type BuildAgentCardOptions, type Capability, CapabilityConflictError, CapabilityPreset, CapabilityRegistry, CheckpointCapability, type CompactionCallOptions, type CompactionStrategyConfig, CompiledAgentOptions, type CompiledAgentOptionsDraft, CompiledTool, ContextWindowCapability, type CostGuardOptions, DEFAULT_KEEP_TOKENS, DelegationResult, FieldCapability, type FinalizedDraft, GoalRunner, type GoalRunnerDeps, Guardrail, GuardrailsCapability, HitlDecision, HumanInTheLoopCapability, HumanInTheLoopOptions, type InProcessApprovalRequest, InProcessApprovalRequiredError, type InProcessAwaitApproval, type ListOptionsWithoutPaginationAlias, LoopStrategy, MCP_PROTOCOL_VERSION, MainLoopCapability, MainLoopMeta, type McpJsonSchema, type McpServerInfo, McpServersCapability, type McpToolDescriptor, MemoryCapability, ModelCapability, type NamedTool, type OutputModerationOptions, type PiiOptions, PluginsCapability, ProjectContextCapability, type PromptInjectionOptions, type ProvenanceEntry, ReasoningEffort, ReflectionStrategy, RoundStreamFactory, RunContextCapability, SettingSourcesCapability, SettingSourcesSelection, SkillsCapability, SkillsOptionsCapability, SkillsResolverCapability, type StreamAgentTurnDeps, type StreamAgentTurnInProcessInput, StreamEvent, SubAgentsCapability, type Summarize, type ToolComNome, type ToolDeclaration, ToolOptions, ToolboxCapability, type ToolboxSource, ToolsCapability, Toolset, ToolsetError, type TranscriptCompactionStrategy, UnknownCapabilityError, applyCapabilities, buildAgentCard, buildMcpToolDescriptors, compactionStrategyConfigSchema, costGuard, createA2ATool, createDraft, declareAgentShape, deriveConversationId, encodeAcpMessage, estimateTokens, formatGoalEvent, listSubagentNames, mcpServerInfo, moderateOutputStream, outputModeration, parseConversationId, piiDetector, promptInjectionDetector, resolveCompactionStrategy, runInputGuards, runOutputGuards, setOnce, streamAgentTurnInProcess, streamAgentUIMessages, tokenBudgetCompactionStrategy, unicodeNormalizer, wellKnownCardPath };