@theokit/sdk 0.0.0-compat-580-20260905204608

package/dist/index.cjs

@@ -0,0 +1,2487 @@
+'use strict';
+
+var chunkTFG5IBZS_cjs = require('./chunk-TFG5IBZS.cjs');
+var chunkOBA6YK2R_cjs = require('./chunk-OBA6YK2R.cjs');
+var chunkQDM3OHUT_cjs = require('./chunk-QDM3OHUT.cjs');
+var chunkVPK6PHIE_cjs = require('./chunk-VPK6PHIE.cjs');
+var chunkQWD4RDZ3_cjs = require('./chunk-QWD4RDZ3.cjs');
+require('./chunk-7JJ3A6AT.cjs');
+var chunk4HS6FFGL_cjs = require('./chunk-4HS6FFGL.cjs');
+require('./chunk-4A3SKJ53.cjs');
+require('./chunk-VTYY7XL5.cjs');
+var chunk67SBTGMA_cjs = require('./chunk-67SBTGMA.cjs');
+var chunkD3CCY3A2_cjs = require('./chunk-D3CCY3A2.cjs');
+var chunkKVSAY6NZ_cjs = require('./chunk-KVSAY6NZ.cjs');
+require('./chunk-Y2KYR2ED.cjs');
+require('./chunk-BUUUWQMB.cjs');
+require('./chunk-Z2JFX372.cjs');
+require('./chunk-KGANQYP7.cjs');
+require('./chunk-BV2MWEMV.cjs');
+require('./chunk-D6POWE7E.cjs');
+require('./chunk-GHX4P3V2.cjs');
+require('./chunk-TMKTSYDS.cjs');
+var chunkNQTNSHSB_cjs = require('./chunk-NQTNSHSB.cjs');
+var chunk7FDKWDA2_cjs = require('./chunk-7FDKWDA2.cjs');
+var chunk2HPNT6HH_cjs = require('./chunk-2HPNT6HH.cjs');
+require('./chunk-FUSDYC2B.cjs');
+require('./chunk-YJNYDJ2T.cjs');
+require('./chunk-24SYBZPL.cjs');
+require('./chunk-QOGNZMHD.cjs');
+var chunkYIFFF23U_cjs = require('./chunk-YIFFF23U.cjs');
+require('./chunk-2ZPEDVLM.cjs');
+require('./chunk-IU5N5224.cjs');
+require('./chunk-KRD3GQAA.cjs');
+require('./chunk-RQMCOFAI.cjs');
+require('./chunk-MUUQ2WFJ.cjs');
+var chunkAA27GEYS_cjs = require('./chunk-AA27GEYS.cjs');
+require('./chunk-YSTXFWQE.cjs');
+require('./chunk-FRITRLZQ.cjs');
+require('./chunk-NQTD6QOW.cjs');
+require('./chunk-NINIJCHU.cjs');
+require('./chunk-QATRS7JD.cjs');
+require('./chunk-LOHMT36V.cjs');
+require('./chunk-IJ7M6GOG.cjs');
+require('./chunk-7A6535RA.cjs');
+require('./chunk-SA6K24NB.cjs');
+require('./chunk-I2PWY7VM.cjs');
+require('./chunk-KTTHHYEW.cjs');
+require('./chunk-Z3NTRKIC.cjs');
+require('./chunk-GZV6AVRL.cjs');
+require('./chunk-A4RAL2ER.cjs');
+require('./chunk-DQZU7JK6.cjs');
+require('./chunk-BJUJT5ED.cjs');
+var chunkZF2LDKQQ_cjs = require('./chunk-ZF2LDKQQ.cjs');
+var chunkHCT4HPCL_cjs = require('./chunk-HCT4HPCL.cjs');
+var chunkJLRLCBJ4_cjs = require('./chunk-JLRLCBJ4.cjs');
+require('./chunk-QYLZQ43D.cjs');
+require('./chunk-NYQ3IS7K.cjs');
+require('./chunk-HW7SEELD.cjs');
+var chunkATT276RD_cjs = require('./chunk-ATT276RD.cjs');
+var chunk3EE6LVWT_cjs = require('./chunk-3EE6LVWT.cjs');
+require('./chunk-ANMJJD6D.cjs');
+var chunkQC55H6RJ_cjs = require('./chunk-QC55H6RJ.cjs');
+require('./chunk-NVXXWAU7.cjs');
+require('./chunk-4NLCWGH7.cjs');
+require('./chunk-EXTRW7GW.cjs');
+require('./chunk-HUFSABUZ.cjs');
+var chunkJ7J7J2GN_cjs = require('./chunk-J7J7J2GN.cjs');
+var chunk6LHQPOMI_cjs = require('./chunk-6LHQPOMI.cjs');
+var crypto = require('crypto');
+var zod = require('zod');
+var promises = require('fs/promises');
+var path = require('path');
+
+// src/agent-factory.ts
+function createAgentFactory(common) {
+  return {
+    forSession: (agentId, overrides) => chunkD3CCY3A2_cjs.Agent.create(mergeAgentOptions(common, overrides, agentId)),
+    getOrCreate: (agentId, overrides) => chunkD3CCY3A2_cjs.Agent.getOrCreate(agentId, mergeAgentOptions(common, overrides, agentId))
+  };
+}
+function mergeAgentOptions(common, overrides, agentId) {
+  const o = overrides ?? {};
+  const merged = { ...common, ...o };
+  const local = deepMergeLocal(common.local, o.local);
+  if (local !== void 0) merged.local = local;
+  const memory = deepMergeMemory(common.memory, o.memory);
+  if (memory !== void 0) merged.memory = memory;
+  const cloud = deepMergeCloud(common.cloud, o.cloud);
+  if (cloud !== void 0) merged.cloud = cloud;
+  merged.agentId = agentId;
+  return merged;
+}
+function deepMergeLocal(base, top) {
+  if (base === void 0 && top === void 0) return void 0;
+  return { ...base ?? {}, ...top ?? {} };
+}
+function deepMergeMemory(base, top) {
+  if (base === void 0 && top === void 0) return void 0;
+  return {
+    ...base ?? {},
+    ...top ?? {},
+    enabled: top?.enabled ?? base?.enabled ?? false
+  };
+}
+function deepMergeCloud(base, top) {
+  if (base === void 0 && top === void 0) return void 0;
+  return { ...base ?? {}, ...top ?? {} };
+}
+var AgentFactory = class {
+  constructor() {
+  }
+  static create(common) {
+    return createAgentFactory(common);
+  }
+};
+
+// src/approval-policy.ts
+var BY_MODE = {
+  ask: { outcome: "ask", reason: "mode-ask" },
+  "never-ask": { outcome: "allow", reason: "mode-never-ask" },
+  "refuse-all": { outcome: "deny", reason: "mode-refuse-all" }
+};
+function decideApproval(input) {
+  const { tool } = input;
+  if ((input.denied ?? []).includes(tool)) {
+    return { outcome: "deny", reason: "explicitly-denied", tool };
+  }
+  if ((input.allowed ?? []).includes(tool)) {
+    return { outcome: "allow", reason: "explicitly-allowed", tool };
+  }
+  const fromMode = BY_MODE[input.mode];
+  return { outcome: fromMode.outcome, reason: fromMode.reason, tool };
+}
+
+// src/blast-radius.ts
+function evaluateBlastRadius(input) {
+  const { scope, reversible } = input.action;
+  if (scope.length === 0) {
+    return { outcome: "refuse", reason: "scope-undeclared", scope };
+  }
+  if (!input.granted.includes(scope)) {
+    return { outcome: "refuse", reason: "scope-not-granted", scope };
+  }
+  if (!reversible && !(input.irreversibleAllowed ?? []).includes(scope)) {
+    return { outcome: "require-approval", reason: "irreversible", scope };
+  }
+  return { outcome: "allow", reason: "within-granted-scope", scope };
+}
+
+// src/internal/budget/calendar-window.ts
+function startOfDayUtc(now = /* @__PURE__ */ new Date()) {
+  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()));
+}
+function startOfWeekUtc(now = /* @__PURE__ */ new Date()) {
+  const dayOfWeek = now.getUTCDay();
+  const daysSinceMonday = (dayOfWeek + 6) % 7;
+  const start = startOfDayUtc(now);
+  start.setUTCDate(start.getUTCDate() - daysSinceMonday);
+  return start;
+}
+var MS_PER_HOUR = 60 * 60 * 1e3;
+var MS_PER_DAY = 24 * MS_PER_HOUR;
+function windowStartMs(window, now = /* @__PURE__ */ new Date()) {
+  switch (window) {
+    case "1h":
+      return now.getTime() - MS_PER_HOUR;
+    case "1d":
+      return startOfDayUtc(now).getTime();
+    case "1w":
+      return startOfWeekUtc(now).getTime();
+    case "30d":
+      return now.getTime() - 30 * MS_PER_DAY;
+    case "365d":
+      return now.getTime() - 365 * MS_PER_DAY;
+    default: {
+      const _exhaustive = window;
+      throw new Error(`unreachable window: ${_exhaustive}`);
+    }
+  }
+}
+
+// src/internal/budget/ledger.ts
+var MS_PER_YEAR = 365 * 24 * 60 * 60 * 1e3;
+var GC_INTERVAL_MS = 5 * 60 * 1e3;
+var GC_LOGS_THRESHOLD = 1e4;
+var state = {
+  logs: /* @__PURE__ */ new Map(),
+  lastGcAt: Date.now()
+};
+var MUTEX_KEY = "budget-ledger";
+function shouldGc(now) {
+  if (now - state.lastGcAt < GC_INTERVAL_MS) return false;
+  let totalLogs = 0;
+  for (const arr of state.logs.values()) totalLogs += arr.length;
+  return totalLogs > GC_LOGS_THRESHOLD;
+}
+function gcOlderThanOneYear(now) {
+  const cutoff = now - MS_PER_YEAR;
+  for (const [name, arr] of state.logs.entries()) {
+    const kept = arr.filter((l) => l.timestamp >= cutoff);
+    if (kept.length === 0) state.logs.delete(name);
+    else state.logs.set(name, kept);
+  }
+  state.lastGcAt = now;
+}
+async function charge(name, amountUsd) {
+  if (amountUsd <= 0) return;
+  await chunkZF2LDKQQ_cjs.withCwdMutex(MUTEX_KEY, async () => {
+    const now = Date.now();
+    const list2 = state.logs.get(name) ?? [];
+    list2.push({ timestamp: now, amountUsd });
+    state.logs.set(name, list2);
+    if (shouldGc(now)) gcOlderThanOneYear(now);
+  });
+}
+function spentIn(name, window, now = /* @__PURE__ */ new Date()) {
+  const arr = state.logs.get(name);
+  if (arr === void 0) return 0;
+  const sinceMs = windowStartMs(window, now);
+  let total = 0;
+  for (const log of arr) {
+    if (log.timestamp >= sinceMs) total += log.amountUsd;
+  }
+  return total;
+}
+
+// src/internal/budget/registry.ts
+var NAME_GRAMMAR = /^[a-z0-9][a-z0-9_-]*$/;
+var registry = /* @__PURE__ */ new Map();
+function validateBudgetName(name) {
+  if (typeof name !== "string" || name.length === 0) {
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError("Budget name must be a non-empty string", {
+      code: "invalid_budget_name"
+    });
+  }
+  if (!NAME_GRAMMAR.test(name)) {
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError(
+      `Budget name "${name}" must match ^[a-z0-9][a-z0-9_-]*$ (lowercase + dash/underscore, start alphanumeric)`,
+      { code: "invalid_budget_name" }
+    );
+  }
+}
+function assertImplementedScope(scope) {
+  if (scope === "process") return;
+  throw new chunkJ7J7J2GN_cjs.ConfigurationError(
+    `Budget scope "${scope}" is declared but not implemented \u2014 only "process" is honoured. A budget created with it would have been accounted process-wide with no warning.`,
+    { code: "unimplemented_budget_scope" }
+  );
+}
+function createBudget(opts) {
+  validateBudgetName(opts.name);
+  assertImplementedScope(opts.scope);
+  if (registry.has(opts.name)) {
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError(`Budget "${opts.name}" already exists`, {
+      code: "invalid_budget_name"
+    });
+  }
+  registry.set(opts.name, opts);
+  return buildHandle(opts);
+}
+function getBudget(name) {
+  const opts = registry.get(name);
+  if (opts === void 0) return void 0;
+  return buildHandle(opts);
+}
+function listBudgets() {
+  return [...registry.values()].map(buildHandle);
+}
+function deleteBudget(name) {
+  return registry.delete(name);
+}
+function snapshotAll() {
+  const result = [];
+  for (const opts of registry.values()) {
+    for (const lim of opts.limits) {
+      const spent = spentIn(opts.name, lim.window);
+      result.push({
+        name: opts.name,
+        window: lim.window,
+        spentUsd: spent,
+        limitUsd: lim.limitUsd,
+        ratio: lim.limitUsd > 0 ? spent / lim.limitUsd : 0
+      });
+    }
+  }
+  return result;
+}
+function getBudgetOptionsRaw(name) {
+  return registry.get(name);
+}
+function defaultMode(opts) {
+  return opts.mode ?? "warn";
+}
+function buildHandle(opts) {
+  return {
+    name: opts.name,
+    mode: defaultMode(opts),
+    scope: opts.scope,
+    limits: opts.limits,
+    spentIn: (window) => spentIn(opts.name, window),
+    remainingIn: (window) => {
+      const lim = opts.limits.find((l) => l.window === window);
+      if (lim === void 0) return Number.POSITIVE_INFINITY;
+      return Math.max(0, lim.limitUsd - spentIn(opts.name, window));
+    }
+  };
+}
+
+// src/internal/budget/enforcement.ts
+var THRESHOLDS = [0.8, 0.95];
+function preflightCheck(name, estimatedUsd) {
+  const opts = getBudgetOptionsRaw(name);
+  if (opts === void 0) return;
+  if (defaultMode(opts) !== "block") return;
+  for (const lim of opts.limits) {
+    const currentSpent = spentIn(opts.name, lim.window);
+    if (currentSpent + estimatedUsd > lim.limitUsd) {
+      throw new chunkJ7J7J2GN_cjs.BudgetExceededError({
+        budgetName: opts.name,
+        window: lim.window,
+        spentUsd: currentSpent + estimatedUsd,
+        limitUsd: lim.limitUsd,
+        mode: "block"
+      });
+    }
+  }
+}
+async function chargeAndCheckThresholds(name, actualUsd) {
+  const opts = getBudgetOptionsRaw(name);
+  if (opts === void 0) {
+    chunk6LHQPOMI_cjs.diag(
+      `[budget] charge for deleted budget "${name}" is a no-op (was the budget removed during in-flight send?)
+`
+    );
+    return;
+  }
+  const mode = defaultMode(opts);
+  await charge(opts.name, actualUsd);
+  if (mode === "audit") return;
+  await dispatchCallbacksFor(opts, mode);
+}
+async function dispatchCallbacksFor(opts, mode) {
+  for (const lim of opts.limits) {
+    const spent = spentIn(opts.name, lim.window);
+    if (lim.limitUsd <= 0) {
+      if (spent > 0) await dispatchExceed(opts, lim.window, spent, lim.limitUsd, mode);
+      continue;
+    }
+    const ratio = spent / lim.limitUsd;
+    if (ratio >= 1) {
+      await dispatchExceed(opts, lim.window, spent, lim.limitUsd, mode);
+    } else {
+      for (const t of [...THRESHOLDS].reverse()) {
+        if (ratio >= t) {
+          await dispatchThreshold(opts, lim.window, spent, lim.limitUsd, t);
+          break;
+        }
+      }
+    }
+  }
+}
+async function dispatchThreshold(opts, window, spentUsd, limitUsd, threshold) {
+  if (opts.onThreshold === void 0) return;
+  try {
+    await opts.onThreshold({
+      budgetName: opts.name,
+      window,
+      threshold,
+      spentUsd,
+      limitUsd
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    chunk6LHQPOMI_cjs.diag(`[budget] onThreshold callback threw: ${msg}
+`);
+  }
+}
+async function dispatchExceed(opts, window, spentUsd, limitUsd, mode) {
+  if (opts.onExceed === void 0) {
+    if (mode === "warn") {
+      chunk6LHQPOMI_cjs.diag(
+        `[budget] "${opts.name}" exceeded ${window} limit: $${spentUsd.toFixed(4)} > $${limitUsd.toFixed(4)}
+`
+      );
+    }
+    return;
+  }
+  try {
+    await opts.onExceed({
+      budgetName: opts.name,
+      window,
+      spentUsd,
+      limitUsd,
+      mode
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    chunk6LHQPOMI_cjs.diag(`[budget] onExceed callback threw: ${msg}
+`);
+  }
+}
+
+// src/internal/budget/normalize-usage.ts
+function int(v) {
+  if (typeof v === "number") return Number.isFinite(v) ? Math.max(0, Math.trunc(v)) : 0;
+  if (typeof v === "string") {
+    const n = Number.parseInt(v, 10);
+    return Number.isFinite(n) ? Math.max(0, n) : 0;
+  }
+  return 0;
+}
+function buildTotal(buckets) {
+  return buckets.inputTokens + buckets.outputTokens + buckets.cacheReadTokens + buckets.cacheWriteTokens;
+}
+function omitUndefined(usage) {
+  return {
+    inputTokens: usage.inputTokens,
+    outputTokens: usage.outputTokens,
+    ...usage.cacheReadTokens > 0 ? { cacheReadTokens: usage.cacheReadTokens } : {},
+    ...usage.cacheWriteTokens > 0 ? { cacheWriteTokens: usage.cacheWriteTokens } : {},
+    ...usage.reasoningTokens > 0 ? { reasoningTokens: usage.reasoningTokens } : {},
+    totalTokens: usage.totalTokens
+  };
+}
+function inferApiMode(provider) {
+  const p = provider.toLowerCase();
+  if (p === "anthropic" || p === "claude" || p === "bedrock_anthropic") {
+    return "anthropic_messages";
+  }
+  if (p === "openai-codex" || p === "codex") return "openai_responses";
+  return "openai_chat_completions";
+}
+function normalizeUsage(rawUsage, opts) {
+  if (rawUsage === null || rawUsage === void 0) {
+    return { inputTokens: 0, outputTokens: 0, totalTokens: 0 };
+  }
+  if (typeof rawUsage !== "object") {
+    return { inputTokens: 0, outputTokens: 0, totalTokens: 0 };
+  }
+  const raw = rawUsage;
+  const mode = opts.apiMode ?? inferApiMode(opts.provider);
+  if (mode === "anthropic_messages") return normalizeAnthropic(raw);
+  if (mode === "openai_responses") return normalizeOpenAIResponses(raw);
+  return normalizeOpenAIChat(raw);
+}
+function normalizeAnthropic(raw) {
+  const inputTokens = int(raw.input_tokens);
+  const outputTokens = int(raw.output_tokens);
+  const cacheReadTokens = int(raw.cache_read_input_tokens);
+  const cacheWriteTokens = int(raw.cache_creation_input_tokens);
+  const usage = {
+    inputTokens,
+    outputTokens,
+    cacheReadTokens,
+    cacheWriteTokens,
+    reasoningTokens: 0,
+    totalTokens: buildTotal({ inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens })
+  };
+  return omitUndefined(usage);
+}
+function normalizeOpenAIResponses(raw) {
+  const inputTotal = int(raw.input_tokens);
+  const outputTokens = int(raw.output_tokens);
+  const inputDetails = raw.input_tokens_details ?? {};
+  const outputDetails = raw.output_tokens_details ?? {};
+  const cacheReadTokens = int(inputDetails.cached_tokens);
+  const cacheWriteTokens = int(inputDetails.cache_creation_tokens);
+  const reasoningTokens = int(outputDetails.reasoning_tokens);
+  const inputTokens = Math.max(0, inputTotal - cacheReadTokens - cacheWriteTokens);
+  const usage = {
+    inputTokens,
+    outputTokens,
+    cacheReadTokens,
+    cacheWriteTokens,
+    reasoningTokens,
+    totalTokens: buildTotal({ inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens })
+  };
+  return omitUndefined(usage);
+}
+function normalizeOpenAIChat(raw) {
+  const promptTotal = int(raw.prompt_tokens);
+  const outputTokens = int(raw.completion_tokens);
+  const promptDetails = raw.prompt_tokens_details ?? {};
+  const completionDetails = raw.completion_tokens_details ?? {};
+  const cacheReadTokens = int(promptDetails.cached_tokens) || int(raw.cache_read_input_tokens);
+  const cacheWriteTokens = int(promptDetails.cache_write_tokens) || int(raw.cache_creation_input_tokens);
+  const reasoningTokens = int(completionDetails.reasoning_tokens);
+  const inputTokens = Math.max(0, promptTotal - cacheReadTokens - cacheWriteTokens);
+  const usage = {
+    inputTokens,
+    outputTokens,
+    cacheReadTokens,
+    cacheWriteTokens,
+    reasoningTokens,
+    totalTokens: buildTotal({ inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens })
+  };
+  return omitUndefined(usage);
+}
+
+// src/budget.ts
+var Budget = class {
+  // D375 — static class with private constructor.
+  constructor() {
+    throw new Error("Budget is static; do not instantiate");
+  }
+  /**
+   * Create a budget. `name` must match `^[a-z0-9][a-z0-9_-]*$` (EC-7).
+   * Throws `ConfigurationError` if name is invalid OR already exists
+   * (EC-16: duplicate surface caller bug).
+   *
+   * `limits` is stacked (D384) — ANY exceeded triggers enforcement.
+   * Empty `limits[]` is valid: pure tracking, no thresholds/exceed
+   * callbacks fire (EC-19).
+   *
+   * Default `mode` is `"warn"` (D383). For emergency stop, use
+   * `mode: "block", limits: [{ window: "1d", limitUsd: 0 }]` (EC-18).
+   */
+  static create(options) {
+    return createBudget(options);
+  }
+  /** Returns the handle for an active budget, or `undefined`. */
+  static get(name) {
+    return getBudget(name);
+  }
+  /** Returns all active budgets. */
+  static list() {
+    return listBudgets();
+  }
+  /**
+   * Deletes a budget from the registry. Returns `true` if it existed.
+   * In-flight `agent.send` calls referencing the name treat the
+   * subsequent charge as a silent no-op + stderr warn (EC-20).
+   */
+  static delete(name) {
+    return deleteBudget(name);
+  }
+  /**
+   * Returns per-window spend snapshot for all active budgets. Each
+   * entry has `{ name, window, spentUsd, limitUsd, ratio }`.
+   */
+  static snapshot() {
+    return snapshotAll();
+  }
+};
+
+// src/built-in-processors.ts
+var CONTROL_CHARS = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g;
+function createUnicodeNormalizer(opts = {}) {
+  const stripControlChars = opts.stripControlChars ?? false;
+  const collapseWhitespace = opts.collapseWhitespace ?? false;
+  return {
+    id: "unicode-normalizer",
+    processInput(ctx) {
+      let s = ctx.message.normalize("NFC");
+      if (stripControlChars) s = s.replace(CONTROL_CHARS, "");
+      if (collapseWhitespace) {
+        s = s.replace(/[^\S\n]+/g, " ").replace(/ *\n */g, "\n").replace(/\n{3,}/g, "\n\n").trim();
+      }
+      return s;
+    }
+  };
+}
+function createTokenLimiter(opts) {
+  if (!Number.isInteger(opts.limit) || opts.limit <= 0) {
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError("createTokenLimiter: `limit` must be a positive integer.", {
+      code: "invalid_processor_options"
+    });
+  }
+  const limit = opts.limit;
+  const strategy = opts.strategy ?? "truncate";
+  const cap = (text, controls) => {
+    const estimated = chunkATT276RD_cjs.estimateTokens(text);
+    if (estimated <= limit) return text;
+    if (strategy === "block") {
+      controls.abort(`exceeds token limit ${limit} (~${estimated} estimated)`);
+    }
+    return [...text].slice(0, limit * chunkATT276RD_cjs.CHARS_PER_TOKEN).join("");
+  };
+  return {
+    id: "token-limiter",
+    processInput: (ctx) => cap(ctx.message, ctx),
+    processOutput: (ctx) => cap(ctx.text, ctx)
+  };
+}
+var TokenLimiter = class {
+  constructor() {
+  }
+  static create(opts) {
+    return createTokenLimiter(opts);
+  }
+};
+var UnicodeNormalizer = class {
+  constructor() {
+  }
+  static create(opts = {}) {
+    return createUnicodeNormalizer(opts);
+  }
+};
+
+// src/create-skill.ts
+function createSkill(spec) {
+  if (!spec.name) {
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError("createSkill: `name` is required.", {
+      code: "invalid_skill_spec"
+    });
+  }
+  if (!spec.description) {
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError("createSkill: `description` is required.", {
+      code: "invalid_skill_spec"
+    });
+  }
+  return {
+    name: spec.name,
+    description: spec.description,
+    source: `inline://${spec.name}`,
+    instructions: spec.instructions,
+    ...spec.category !== void 0 ? { category: spec.category } : {},
+    ...spec.dependencies !== void 0 ? { dependencies: spec.dependencies } : {},
+    ...spec.references !== void 0 ? { references: spec.references } : {}
+  };
+}
+var Skill = class {
+  constructor() {
+  }
+  static create(spec) {
+    return createSkill(spec);
+  }
+};
+function describeCredential(input) {
+  const secret = (input.value ?? "").trim();
+  if (secret.length === 0) {
+    return { provider: input.provider, present: false, source: input.source };
+  }
+  return {
+    provider: input.provider,
+    present: true,
+    source: input.source,
+    fingerprint: crypto.createHash("sha256").update(secret).digest("hex").slice(0, 8)
+  };
+}
+
+// src/define-provider.ts
+function defineProvider(profile, opts) {
+  return {
+    name: profile.name,
+    version: opts?.version ?? "1.0.0",
+    kind: "model-provider",
+    profile
+  };
+}
+var Provider = class _Provider {
+  constructor() {
+  }
+  static create(profile, opts) {
+    return defineProvider(profile, opts);
+  }
+  /**
+   * Every first-party builtin provider (anthropic, openai, openrouter, gemini, ollama, the ChatGPT/Codex
+   * `openai-chatgpt`, …) as model-provider plugins, ready to hand to `Agent.create({ plugins })` or any
+   * runtime that consumes model-provider plugins (e.g. the `theokit` agent server / `@theokit/agents`, whose
+   * own model resolution does NOT share this registry). Enables a consumer to route to ANY SDK builtin —
+   * including one added later in a single SDK file — with ZERO provider-specific code: just
+   * `.plugins(Provider.builtins())` once, then pick a `provider/model` id. @public
+   */
+  static builtins() {
+    chunkQC55H6RJ_cjs.registerBuiltins();
+    return chunkQC55H6RJ_cjs.listProviders().map((profile) => defineProvider(profile));
+  }
+  /**
+   * The builtin serving `modelId`, or `undefined` when none does.
+   *
+   * The grammar of a model id — `provider/model` — now has **one** owner. M94: the consumer
+   * redid it by hand with `modelId.slice(0, modelId.indexOf('/'))`, which on an id **without a slash** returns the
+   * id minus its last character (`claude-opus-5` -> `claude-opus-`): it matches no provider and the
+   * caller fell through to the default, without distinguishing that from a hit. A non-routable model was
+   * indistinguishable from the happy path.
+   *
+   * Returns `undefined` instead of throwing: the caller decides whether absence is an error, and only they
+   * know whether the model came from an explicit `--model` (an error) or from the default (normal).
+   *
+   * @public
+   */
+  static forModel(modelId) {
+    const { provider } = chunk3EE6LVWT_cjs.parseModelId(modelId);
+    if (provider === void 0) return void 0;
+    return _Provider.builtins().find((p) => p.name === provider);
+  }
+};
+var SkillReadInputSchema = zod.z.object({
+  name: zod.z.string().min(1, "skill_read: `name` is required.")
+});
+function renderSkill(skill) {
+  const parts = [`# Skill: ${skill.name}`, "", skill.instructions];
+  const refs = skill.references;
+  if (refs !== void 0 && Object.keys(refs).length > 0) {
+    parts.push("", "## References");
+    for (const [file, content] of Object.entries(refs)) {
+      parts.push("", `### ${file}`, content);
+    }
+  }
+  return parts.join("\n");
+}
+function defineSkillReadTool(skills) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const skill of skills) {
+    if (seen.has(skill.name)) {
+      throw new chunkJ7J7J2GN_cjs.ConfigurationError(`defineSkillReadTool: duplicate skill name "${skill.name}".`, {
+        code: "duplicate_skill_name"
+      });
+    }
+    seen.add(skill.name);
+  }
+  return {
+    name: "skill_read",
+    description: "Read a skill's full instructions (and any bundled reference documents) by its name. Use this to load the body of a skill listed in the <skills> block before acting on it.",
+    inputSchema: chunkAA27GEYS_cjs.toJsonSchema(SkillReadInputSchema),
+    handler: (input) => {
+      const { name } = SkillReadInputSchema.parse(input);
+      const skill = skills.find((s) => s.name === name);
+      if (skill === void 0) {
+        const available = skills.map((s) => s.name).join(", ");
+        return `Skill "${name}" not found. Available skills: ${available.length > 0 ? available : "(none)"}.`;
+      }
+      return renderSkill(skill);
+    }
+  };
+}
+var SkillReadTool = class {
+  constructor() {
+  }
+  static create(skills) {
+    return defineSkillReadTool(skills);
+  }
+};
+
+// src/env-reachability.ts
+function auditEnvReachability(input) {
+  const reachable = new Set(input.reachable);
+  const exempt = new Set(input.optOuts.map((o) => o.key));
+  const declared = new Set(input.keys);
+  return {
+    unreachable: input.keys.filter((k) => !reachable.has(k) && !exempt.has(k)),
+    staleOptOuts: input.optOuts.filter((o) => !declared.has(o.key) || reachable.has(o.key)).map((o) => o.key)
+  };
+}
+
+// src/event-bus.ts
+var EventBus = class {
+  handlers = /* @__PURE__ */ new Map();
+  // M3 #64 — a swallowed handler error used to vanish without a trace (fail-loud
+  // violation). We now log it AND expose an observable count so ops/tests can see
+  // that a subscriber is silently failing, without breaking the EC-2 contract.
+  #handlerErrorCount = 0;
+  /** M3 #64 — number of handler invocations that threw (and were logged). */
+  get handlerErrorCount() {
+    return this.#handlerErrorCount;
+  }
+  /**
+   * Subscribe to an event. Returns an unsubscribe function.
+   */
+  subscribe(event, handler) {
+    if (!this.handlers.has(event)) {
+      this.handlers.set(event, /* @__PURE__ */ new Set());
+    }
+    const set = this.handlers.get(event);
+    set.add(handler);
+    return () => {
+      set.delete(handler);
+    };
+  }
+  /**
+   * Publish an event to all subscribers. EC-2: try-catch per handler.
+   */
+  publish(event, payload) {
+    const set = this.handlers.get(event);
+    if (!set) return;
+    for (const handler of set) {
+      try {
+        handler(payload);
+      } catch (cause) {
+        this.#handlerErrorCount += 1;
+        const message = cause instanceof Error ? cause.message : String(cause);
+        chunk6LHQPOMI_cjs.diag(`[theokit-sdk] event-bus: handler for "${String(event)}" threw: ${message}
+`);
+      }
+    }
+  }
+  /**
+   * Subscribe to an event for a single firing. Returns an unsubscribe function.
+   */
+  once(event, handler) {
+    const wrapped = (payload) => {
+      unsub();
+      handler(payload);
+    };
+    const unsub = this.subscribe(event, wrapped);
+    return unsub;
+  }
+};
+
+// src/goal-loop.ts
+function runGoalLoop(agent, goal, options, depsOverride) {
+  async function* wrap() {
+    const { runUntilImpl } = await import('./run-until-DG2KXWB2.cjs');
+    const deps = depsOverride ?? await (async () => {
+      const { judgeCallImpl } = await import('./judge-call-46M2E5FA.cjs');
+      const { getAgentFacade } = await import('./agent-factory-registry-UU46BUMU.cjs');
+      const create = getAgentFacade().create;
+      return {
+        judge: (ctx, opts) => judgeCallImpl(ctx, opts, { create })
+      };
+    })();
+    return yield* runUntilImpl(agent, goal, options, deps);
+  }
+  return wrap();
+}
+
+// src/internal/budget/tracker/budget-tracker-counter.ts
+function createCounterBudgetTracker(options = {}) {
+  let totalTokens = 0;
+  let iterations = 0;
+  const maxTokens = options.maxTokens;
+  const maxIterations = options.maxIterations;
+  return {
+    track(event) {
+      const t = Number.isFinite(event.tokens) && event.tokens > 0 ? event.tokens : 0;
+      totalTokens += t;
+    },
+    check() {
+      if (maxTokens !== void 0 && totalTokens >= maxTokens) {
+        return {
+          allowed: false,
+          reason: "token_limit",
+          detail: `${totalTokens} >= maxTokens ${maxTokens}`
+        };
+      }
+      if (maxIterations !== void 0 && iterations >= maxIterations) {
+        return {
+          allowed: false,
+          reason: "iteration_limit",
+          detail: `${iterations} >= maxIterations ${maxIterations}`
+        };
+      }
+      return { allowed: true };
+    },
+    getTotal() {
+      return { tokens: totalTokens, iterations };
+    },
+    nextIteration() {
+      iterations += 1;
+    }
+  };
+}
+
+// src/internal/plugins/types.ts
+function definePlugin(p) {
+  return p;
+}
+var Plugin = { create: definePlugin };
+
+// src/internal/runtime/memory-glue/memory-provider-noop.ts
+var NOOP_ADAPTER_ID = "noop";
+var NOOP_CAPABILITIES = {
+  history: false,
+  sessions: false,
+  tenancy: false,
+  reasoning: false,
+  toolSchemas: false,
+  prefetch: false
+};
+function createNoopMemoryAdapter() {
+  return {
+    id: NOOP_ADAPTER_ID,
+    capabilities: NOOP_CAPABILITIES,
+    isAvailable() {
+      return true;
+    },
+    async write(_content, _ctx) {
+      return `${NOOP_ADAPTER_ID}:noop`;
+    },
+    async recall(_query, _ctx, _k) {
+      return [];
+    },
+    async delete(_id) {
+      return;
+    }
+  };
+}
+function createNoopMemoryProvider() {
+  return {
+    async init(_opts) {
+      return {
+        adapter: createNoopMemoryAdapter()
+      };
+    },
+    buildTools(_handle) {
+      return [];
+    },
+    async runActivePass(_handle, _args) {
+      return { facts: [] };
+    },
+    recordSessionSummary() {
+      return;
+    },
+    dispose(_handle) {
+      return;
+    }
+  };
+}
+var NoopMemoryProvider = class {
+  constructor() {
+  }
+  static create() {
+    return createNoopMemoryProvider();
+  }
+};
+var JobQueue = class {
+  jobs = /* @__PURE__ */ new Map();
+  controllers = /* @__PURE__ */ new Map();
+  maxConcurrency;
+  running = 0;
+  waiting = [];
+  constructor(options = {}) {
+    this.maxConcurrency = options.maxConcurrency === void 0 ? Number.POSITIVE_INFINITY : Math.max(1, options.maxConcurrency);
+  }
+  /**
+   * Enqueue a background function. Returns the job ID immediately. The function
+   * receives an `AbortSignal` that fires when the job is cancelled (#58) — a
+   * cooperative job should observe it to stop early. Existing `() => Promise<T>`
+   * callers are unaffected (the signal argument is simply ignored).
+   */
+  enqueue(fn2) {
+    const id = crypto.randomUUID();
+    const job = { id, status: "pending" };
+    this.jobs.set(id, job);
+    const controller = new AbortController();
+    this.controllers.set(id, controller);
+    void this.#acquire().then(() => {
+      if (job.status === "cancelled") {
+        this.#release(id);
+        return;
+      }
+      job.status = "running";
+      Promise.resolve().then(() => fn2(controller.signal)).then((result) => {
+        if (job.status === "cancelled") return;
+        job.result = result;
+        job.status = "completed";
+      }).catch((err) => {
+        if (job.status === "cancelled") return;
+        job.error = err instanceof Error ? err.message : String(err);
+        job.status = "failed";
+      }).finally(() => this.#release(id));
+    });
+    return id;
+  }
+  getJob(id) {
+    return this.jobs.get(id);
+  }
+  list() {
+    return [...this.jobs.values()];
+  }
+  /**
+   * Cancel a pending or running job. Returns true if cancelled. #58 — aborts the
+   * job's `AbortSignal` so a cooperative running job is actually interrupted.
+   */
+  cancel(id) {
+    const job = this.jobs.get(id);
+    if (!job) return false;
+    if (job.status === "pending" || job.status === "running") {
+      const wasRunning = job.status === "running";
+      job.status = "cancelled";
+      this.controllers.get(id)?.abort();
+      if (wasRunning) this.#release(id);
+      return true;
+    }
+    return false;
+  }
+  /** Acquire a concurrency slot (resolves immediately when unbounded/free). */
+  #acquire() {
+    if (this.running < this.maxConcurrency) {
+      this.running += 1;
+      return Promise.resolve();
+    }
+    return new Promise((resolve) => {
+      this.waiting.push(() => {
+        this.running += 1;
+        resolve();
+      });
+    });
+  }
+  /**
+   * Release a slot + clean up the controller; start the next waiting job.
+   * Idempotent — keyed on the controller's presence, so a running job that was
+   * cancelled (released early) does not double-decrement when its `.finally`
+   * eventually fires.
+   */
+  #release(id) {
+    if (!this.controllers.has(id)) return;
+    this.controllers.delete(id);
+    this.running -= 1;
+    const next = this.waiting.shift();
+    if (next !== void 0) next();
+  }
+};
+
+// src/layer-fold.ts
+var LayerOrderError = class extends chunkJ7J7J2GN_cjs.TheokitAgentError {
+  name = "LayerOrderError";
+};
+function verifyLayerOrdering(layers) {
+  let previous;
+  for (const current of layers) {
+    if (current.precedence === void 0) continue;
+    const declared = { layer: current.layer, precedence: current.precedence };
+    if (previous !== void 0 && declared.precedence <= previous.precedence) {
+      throw new LayerOrderError(
+        `layers out of order: \`${declared.layer}\` (precedence ${String(declared.precedence)}) comes after \`${previous.layer}\` (precedence ${String(previous.precedence)}) but does not outrank it`
+      );
+    }
+    previous = declared;
+  }
+}
+function foldLayers(entries, accumulatingKeys = []) {
+  verifyLayerOrdering(entries);
+  const accumulated = new Map(accumulatingKeys.map((k) => [k, []]));
+  const combined = {};
+  for (const { values } of entries) {
+    for (const [key, value] of Object.entries(values)) {
+      if (value === void 0) continue;
+      const stack = accumulated.get(key);
+      if (stack !== void 0 && Array.isArray(value)) {
+        stack.push(...value);
+        combined[key] = [...stack];
+        continue;
+      }
+      combined[key] = value;
+    }
+  }
+  return combined;
+}
+
+// src/internal/memory/dreaming/phases.ts
+var DEFAULT_DEDUP_THRESHOLD = 0.95;
+var DEFAULT_CLUSTER_THRESHOLD = 0.75;
+var CONSOLIDATABLE_KINDS = /* @__PURE__ */ new Set(["project"]);
+var ATOMIC_KINDS = /* @__PURE__ */ new Set(["user", "feedback", "reference"]);
+function dedupPolicy(fact) {
+  if (fact.kind === void 0) return "exact";
+  if (ATOMIC_KINDS.has(fact.kind)) return "never";
+  return CONSOLIDATABLE_KINDS.has(fact.kind) ? "similar" : "never";
+}
+function normalizeForExactMatch(text) {
+  return text.trim().toLowerCase().replace(/\s+/g, " ").replace(/[.!?]+$/, "");
+}
+async function lightPhase(facts, embedding, threshold = DEFAULT_DEDUP_THRESHOLD) {
+  if (facts.length <= 1) return { kept: [...facts], duplicatesRemoved: 0 };
+  const never = facts.filter((f) => dedupPolicy(f) === "never");
+  const exact = facts.filter((f) => dedupPolicy(f) === "exact");
+  const similar = facts.filter((f) => dedupPolicy(f) === "similar");
+  const seen = /* @__PURE__ */ new Set();
+  const exactKept = [];
+  let removed = 0;
+  for (const f of exact) {
+    const key = normalizeForExactMatch(f.text);
+    if (seen.has(key)) {
+      removed += 1;
+      continue;
+    }
+    seen.add(key);
+    exactKept.push(f);
+  }
+  const sim = similar.length > 1 ? await dedupCandidates(similar, embedding, threshold) : { kept: [...similar], duplicatesRemoved: 0 };
+  return {
+    kept: [...never, ...exactKept, ...sim.kept],
+    duplicatesRemoved: removed + sim.duplicatesRemoved
+  };
+}
+async function dedupCandidates(facts, embedding, threshold) {
+  if (facts.length <= 1) return { kept: [...facts], duplicatesRemoved: 0 };
+  const vectors = await embedding.embed(facts.map((f) => f.text));
+  const keptIdx = [];
+  const keptVecs = [];
+  for (let i = 0; i < facts.length; i++) {
+    const vec = vectors[i] ?? [];
+    const isDup = keptVecs.some((kept2) => cosineSimilarity(vec, kept2) >= threshold);
+    if (isDup) continue;
+    keptIdx.push(i);
+    keptVecs.push(vec);
+  }
+  const kept = keptIdx.map((i) => facts[i]);
+  return { kept, duplicatesRemoved: facts.length - kept.length };
+}
+var DEFAULT_MAX_FACTS_PER_SWEEP = 500;
+async function remPhase(facts, embedding, threshold = DEFAULT_CLUSTER_THRESHOLD, maxFactsPerSweep = DEFAULT_MAX_FACTS_PER_SWEEP) {
+  if (facts.length === 0) return { clusters: [] };
+  const capped = facts.length > maxFactsPerSweep ? facts.slice(0, maxFactsPerSweep) : facts;
+  const vectors = await embedding.embed(capped.map((f) => f.text));
+  const clusterOfIdx = unionFindByPairs(vectors, threshold);
+  const groups = bucketFactsByClusterRoot(capped, clusterOfIdx);
+  return { clusters: [...groups.values()].map(buildClusterFromMembers) };
+}
+function unionFindByPairs(vectors, threshold) {
+  const clusterOfIdx = vectors.map((_, i) => i);
+  for (let i = 0; i < vectors.length; i++) {
+    for (let j = i + 1; j < vectors.length; j++) {
+      if (cosineSimilarity(vectors[i] ?? [], vectors[j] ?? []) >= threshold) {
+        unifyClusters(clusterOfIdx, i, j);
+      }
+    }
+  }
+  return clusterOfIdx;
+}
+function bucketFactsByClusterRoot(facts, clusterOfIdx) {
+  const groups = /* @__PURE__ */ new Map();
+  for (let i = 0; i < facts.length; i++) {
+    const root = findRoot(clusterOfIdx, i);
+    const list2 = groups.get(root) ?? [];
+    list2.push(facts[i]);
+    groups.set(root, list2);
+  }
+  return groups;
+}
+function buildClusterFromMembers(members) {
+  const sorted = [...members].sort((a, b) => b.text.length - a.text.length);
+  return { representativeText: sorted[0]?.text ?? "", members };
+}
+function deepPhase(clusters, timestampMs) {
+  if (clusters.length === 0) return "";
+  const isoStamp = new Date(timestampMs).toISOString();
+  const lines = [`# Dreamed ${isoStamp}`, ""];
+  for (let i = 0; i < clusters.length; i++) {
+    const c = clusters[i];
+    if (c === void 0) continue;
+    lines.push(`## Cluster ${i + 1}: ${c.representativeText}`);
+    lines.push("");
+    for (const member of c.members) lines.push(`- ${member.text}`);
+    lines.push("");
+  }
+  return `${lines.join("\n")}
+`;
+}
+function cosineSimilarity(a, b) {
+  if (a.length === 0 || b.length === 0 || a.length !== b.length) return 0;
+  let dot = 0;
+  let aNorm = 0;
+  let bNorm = 0;
+  for (let i = 0; i < a.length; i++) {
+    const ai = a[i] ?? 0;
+    const bi = b[i] ?? 0;
+    dot += ai * bi;
+    aNorm += ai * ai;
+    bNorm += bi * bi;
+  }
+  const denom = Math.sqrt(aNorm) * Math.sqrt(bNorm);
+  return denom === 0 ? 0 : dot / denom;
+}
+function findRoot(parents, i) {
+  let root = i;
+  while (parents[root] !== root) {
+    const next = parents[root] ?? root;
+    if (next === root) break;
+    root = next;
+  }
+  parents[i] = root;
+  return root;
+}
+function unifyClusters(parents, a, b) {
+  const rootA = findRoot(parents, a);
+  const rootB = findRoot(parents, b);
+  if (rootA !== rootB) parents[rootB] = rootA;
+}
+
+// src/internal/memory/dreaming/run.ts
+function runDreamingSweep(options) {
+  return chunkZF2LDKQQ_cjs.withCwdMutex(`dream:${options.cwd}`, () => runInner(options));
+}
+async function runInner(options) {
+  const now = options.now ?? Date.now;
+  const timestampMs = now();
+  try {
+    const root = options.memoryRoot ?? chunkNQTNSHSB_cjs.resolveMemoryRoot(options.cwd);
+    const facts = await chunkNQTNSHSB_cjs.readFactsFromMarkdown(
+      options.cwd,
+      options.memoryRoot ? { directory: options.memoryRoot } : void 0
+    );
+    if (facts.length === 0) {
+      return emptyResult("skipped");
+    }
+    const dedup = await lightPhase(facts, options.embedding, options.dedupThreshold);
+    const rem = await remPhase(dedup.kept, options.embedding, options.clusterThreshold);
+    const notesWritten = await writeConsolidatedNotes(root, rem.clusters, timestampMs);
+    const result = {
+      status: "ok",
+      factsBefore: facts.length,
+      factsAfter: dedup.kept.length,
+      duplicatesRemoved: dedup.duplicatesRemoved,
+      clustersCreated: rem.clusters.length,
+      notesWritten,
+      diaryEntryHash: void 0
+    };
+    await chunkVPK6PHIE_cjs.appendDiaryEntry(root, {
+      timestampMs,
+      factsBefore: result.factsBefore,
+      factsAfter: result.factsAfter,
+      duplicatesRemoved: result.duplicatesRemoved,
+      clustersCreated: result.clustersCreated,
+      notesWritten: result.notesWritten
+    });
+    return result;
+  } catch (cause) {
+    const message = cause instanceof Error ? cause.message : String(cause);
+    chunk6LHQPOMI_cjs.diag(`[theokit-sdk] dreaming sweep failed: ${message}
+`);
+    return emptyResult("error");
+  }
+}
+async function writeConsolidatedNotes(root, clusters, timestampMs) {
+  if (clusters.length === 0) return 0;
+  const notesDir = path.join(root, "notes");
+  await promises.mkdir(notesDir, { recursive: true });
+  const isoSlug = new Date(timestampMs).toISOString().replace(/[^\dT]/g, "-");
+  const file = path.join(notesDir, `dreamed-${isoSlug}.md`);
+  const body = deepPhase(clusters, timestampMs);
+  await chunkJLRLCBJ4_cjs.replaceFileAtomic(file, body);
+  return 1;
+}
+function emptyResult(status) {
+  return {
+    status,
+    factsBefore: 0,
+    factsAfter: 0,
+    duplicatesRemoved: 0,
+    clustersCreated: 0,
+    notesWritten: 0,
+    diaryEntryHash: void 0
+  };
+}
+
+// src/internal/memory/sdk-memory-peer-loader.ts
+var cachedAttempt;
+async function loadPeer() {
+  try {
+    const spec = "@theokit/sdk-memory";
+    const mod = await import(spec);
+    if (hasExpectedSurface(mod)) return mod;
+    chunk6LHQPOMI_cjs.diag(
+      "sdk-memory peer loaded but does not expose the expected surface (runDreamingSweep / MEMORY_EMBEDDING_ADAPTERS / IndexManager / migrateSqliteToLance) \u2014 falling back to the legacy memory path"
+    );
+    return null;
+  } catch (err) {
+    if (err?.code !== "ERR_MODULE_NOT_FOUND") {
+      chunk6LHQPOMI_cjs.diag(
+        `sdk-memory peer is installed but failed to load \u2014 falling back to the legacy memory path: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    return null;
+  }
+}
+function hasExpectedSurface(mod) {
+  return typeof mod.runDreamingSweep === "function" && mod.MEMORY_EMBEDDING_ADAPTERS !== void 0 && mod.IndexManager !== void 0 && typeof mod.migrateSqliteToLance === "function";
+}
+function tryLoadSdkMemoryPeer() {
+  if (cachedAttempt !== void 0) return cachedAttempt;
+  cachedAttempt = loadPeer();
+  return cachedAttempt;
+}
+
+// src/memory.ts
+var Memory = {
+  /**
+   * Open a memory index. Dispatches to SQLite-vec (default, zero deps) or
+   * LanceDB (opt-in via `backend: "lance"`, requires `@lancedb/lancedb`
+   * peer dep + an embedding runtime).
+   *
+   * Returns a `MemoryIndex` with `sync()`, `search(query, opts?)`,
+   * `status()`, and `close()`. Use this when you want a direct index
+   * handle outside of `Agent.create({ memory: ... })`.
+   *
+   * @throws ConfigurationError({code:"invalid_memory_backend"}) for typos
+   *   like `"lancedb"`.
+   * @throws ConfigurationError({code:"lance_requires_embedding"}) when
+   *   `backend: "lance"` is requested without `embedding`.
+   * @throws ConfigurationError({code:"lance_backend_unavailable"}) when
+   *   `backend: "lance"` is requested but the peer dep is absent.
+   *
+   * @public
+   */
+  async openIndex(opts) {
+    const peer = await tryLoadSdkMemoryPeer();
+    const openArgs = buildIndexOpenArgs(opts);
+    if (peer !== null) {
+      openArgs.embedding = await resolveEmbedding(opts.embedding, peer.MEMORY_EMBEDDING_ADAPTERS);
+      return await peer.IndexManager.open(openArgs);
+    }
+    const { IndexManager } = await import('./index-manager-3UNPYH34.cjs');
+    openArgs.embedding = await resolveEmbedding(opts.embedding, chunkD3CCY3A2_cjs.MEMORY_EMBEDDING_ADAPTERS);
+    return await IndexManager.open(openArgs);
+  },
+  /**
+   * Run a dreaming sweep: dedup near-duplicate facts, cluster thematically
+   * related ones, and write a consolidated note + diary entry.
+   *
+   * @public
+   */
+  async runDreamingSweep(opts) {
+    const peer = await tryLoadSdkMemoryPeer();
+    const catalog = peer !== null ? peer.MEMORY_EMBEDDING_ADAPTERS : chunkD3CCY3A2_cjs.MEMORY_EMBEDDING_ADAPTERS;
+    const sweepArgs = await buildDreamingSweepArgs(opts, catalog);
+    const result = peer !== null ? (
+      // biome-ignore lint/suspicious/noExplicitAny: peer is dynamically loaded — structural compat ensured by sdk-memory
+      await peer.runDreamingSweep(sweepArgs)
+    ) : (
+      // biome-ignore lint/suspicious/noExplicitAny: legacy path accepts the same shape
+      await runDreamingSweep(sweepArgs)
+    );
+    return toDreamingSweepResult(result);
+  }
+};
+async function resolveEmbedding(embeddingOpts, catalog) {
+  if (embeddingOpts === void 0) return void 0;
+  const adapter = catalog[embeddingOpts.provider];
+  if (adapter === void 0) {
+    throw new Error(
+      `Unknown embedding provider "${embeddingOpts.provider}". Supported: ${Object.keys(catalog).join(", ")}.`
+    );
+  }
+  return adapter.create(embeddingOpts.model !== void 0 ? { model: embeddingOpts.model } : {});
+}
+function buildIndexOpenArgs(opts, embedding) {
+  return {
+    cwd: opts.cwd,
+    ...opts.filePath !== void 0 ? { filePath: opts.filePath } : {},
+    ...{},
+    ...opts.backend !== void 0 ? { backend: opts.backend } : {}
+  };
+}
+async function buildDreamingSweepArgs(opts, catalog) {
+  const runtime = await resolveEmbedding(opts.embedding, catalog);
+  return {
+    cwd: opts.cwd,
+    memoryRoot: chunkNQTNSHSB_cjs.resolveMemoryRoot(opts.cwd, { directory: opts.directory }),
+    embedding: runtime,
+    ...opts.dedupThreshold !== void 0 ? { dedupThreshold: opts.dedupThreshold } : {},
+    ...opts.clusterThreshold !== void 0 ? { clusterThreshold: opts.clusterThreshold } : {}
+  };
+}
+function toDreamingSweepResult(result) {
+  return {
+    status: result.status,
+    factsBefore: result.factsBefore,
+    factsAfter: result.factsAfter,
+    duplicatesRemoved: result.duplicatesRemoved,
+    clustersCreated: result.clustersCreated,
+    notesWritten: result.notesWritten
+  };
+}
+
+// src/memory-adapter-helpers.ts
+function mkMemoryId(adapterId, rawId) {
+  return `${adapterId}:${rawId}`;
+}
+function extractRawId(id, expectedAdapterId) {
+  const prefix = `${expectedAdapterId}:`;
+  if (!id.startsWith(prefix)) {
+    const sourcePrefix = id.split(":", 1)[0] ?? "<malformed>";
+    throw new chunkJ7J7J2GN_cjs.MemoryAdapterError(
+      `MemoryId belongs to a different adapter (expected "${expectedAdapterId}", got "${sourcePrefix}")`,
+      { adapterId: expectedAdapterId, code: "invalid_input" }
+    );
+  }
+  return id.slice(prefix.length);
+}
+
+// src/migrate.ts
+async function migrateSqliteToLance2(options) {
+  const peer = await tryLoadSdkMemoryPeer();
+  if (peer !== null) {
+    return peer.migrateSqliteToLance(options);
+  }
+  return chunkVPK6PHIE_cjs.migrateSqliteToLance(options);
+}
+
+// src/permission-engine.ts
+function applyMode(verdict, mode, explicit) {
+  if (verdict === "deny") return "deny";
+  switch (mode) {
+    case "default":
+      return verdict;
+    case "plan":
+      return verdict === "allow" ? "allow" : "deny";
+    case "acceptEdits":
+      if (verdict === "ask") return explicit ? "ask" : "allow";
+      return verdict;
+    // allow stays allow
+    case "bypass":
+    case "bypassPermissions":
+      return "allow";
+  }
+}
+function argMatches(matcher, value) {
+  if (value === void 0) return false;
+  if (typeof matcher === "function") return matcher(value);
+  if (matcher instanceof RegExp) {
+    matcher.lastIndex = 0;
+    return matcher.test(String(value));
+  }
+  return matcher === value;
+}
+var PermissionEngine = class {
+  constructor(rules, options = {}) {
+    this.rules = rules;
+    this.defaultAction = options.defaultAction ?? "ask";
+  }
+  rules;
+  defaultAction;
+  /**
+   * Evaluate a tool name (and optional arguments) against the rules. First
+   * match wins; falls back to the configured `defaultAction` (default `"ask"`,
+   * fail-closed) when no rule matches. #55 — a rule with `args` gates on the
+   * argument values, so the same tool name can resolve to different actions
+   * depending on what it is asked to do.
+   */
+  evaluate(toolName, args, mode = "default") {
+    for (const rule of this.rules) {
+      const nameMatches = typeof rule.tool === "string" ? rule.tool === toolName : rule.tool.test(toolName);
+      if (!nameMatches) continue;
+      if (rule.args !== void 0 && !this.#argsMatch(rule.args, args)) continue;
+      return applyMode(rule.action, mode, true);
+    }
+    return applyMode(this.defaultAction, mode, false);
+  }
+  #argsMatch(matchers, args) {
+    const call = args ?? {};
+    for (const [key, matcher] of Object.entries(matchers)) {
+      if (!argMatches(matcher, call[key])) return false;
+    }
+    return true;
+  }
+};
+
+// src/permission-plugin.ts
+async function resolveAsk(opts, name, args, mode) {
+  if (opts.canUseTool !== void 0) {
+    let decision;
+    try {
+      decision = await opts.canUseTool(name, args, { toolName: name, mode });
+    } catch {
+      return { block: true, message: `permission gate error (fail-closed): ${name}` };
+    }
+    return decision?.behavior === "allow" ? void 0 : { block: true, message: decision?.message ?? `denied: ${name}` };
+  }
+  return opts.onAsk ? opts.onAsk(name) : { block: true, message: `requires approval: ${name}` };
+}
+function createPermissionPlugin(engine, opts = {}) {
+  return definePlugin({
+    name: opts.name ?? "permission-engine",
+    version: "1.0.0",
+    kind: "general",
+    register(ctx) {
+      ctx.on("pre_tool_call", async (rawCtx) => {
+        const { name, args, permissionMode } = rawCtx;
+        const mode = permissionMode ?? opts.mode ?? "default";
+        const action = engine.evaluate(name, args, mode);
+        if (action === "deny") {
+          return { block: true, message: `denied by permission engine: ${name}` };
+        }
+        if (action === "ask") return resolveAsk(opts, name, args, mode);
+        return void 0;
+      });
+    }
+  });
+}
+var PermissionPlugin = class {
+  constructor() {
+  }
+  static create(engine, opts = {}) {
+    return createPermissionPlugin(engine, opts);
+  }
+};
+
+// src/project-env.ts
+var SOVEREIGN_ENV_KEYS = [
+  /** Locates the SDK home — sessions, and the credential store beneath it. */
+  "THEOKIT_HOME",
+  /** Locates the credential store explicitly, independently of `THEOKIT_HOME`. */
+  "THEOKIT_AUTH_HOME",
+  /** A trust decision: which providers are honoured without further checks. */
+  "THEOKIT_TRUSTED_PROVIDERS",
+  /** Turning redaction off from a repository's `.env` would put secrets into logs. */
+  "THEOKIT_REDACT_SECRETS",
+  /** Cryptographic material for the OAuth transaction cookie. */
+  "THEOKIT_OAUTH_TX_SALT"
+];
+function loadProjectEnv(env = process.env, load = typeof process.loadEnvFile === "function" ? () => {
+  process.loadEnvFile();
+} : void 0) {
+  if (load === void 0) return;
+  const sovereign = new Map(
+    SOVEREIGN_ENV_KEYS.map((key) => [key, env[key]])
+  );
+  try {
+    load();
+  } catch {
+    return;
+  }
+  for (const [key, original] of sovereign) {
+    if (original === void 0) delete env[key];
+    else env[key] = original;
+  }
+}
+
+// src/reap-plan.ts
+var RetentionPolicyError = class extends chunkJ7J7J2GN_cjs.TheokitAgentError {
+  name = "RetentionPolicyError";
+};
+function assertPolicy(retention) {
+  const { maxAgeMs, keepLast } = retention;
+  if (!Number.isFinite(maxAgeMs) || maxAgeMs < 0) {
+    throw new RetentionPolicyError(
+      `retention.maxAgeMs must be a non-negative number of milliseconds, got ${String(maxAgeMs)}`
+    );
+  }
+  if (!Number.isInteger(keepLast) || keepLast < 0) {
+    throw new RetentionPolicyError(
+      `retention.keepLast must be a non-negative integer, got ${String(keepLast)}`
+    );
+  }
+}
+function classifyByOwnReason(input) {
+  const keep = [];
+  const atRisk = [];
+  for (const artifact of input.artifacts) {
+    if (artifact.live === "unknown") continue;
+    if (artifact.live === true) {
+      keep.push({ ...artifact, reason: "live" });
+      continue;
+    }
+    if (input.nowMs - artifact.lastModifiedMs <= input.retention.maxAgeMs) {
+      keep.push({ ...artifact, reason: "within-retention" });
+      continue;
+    }
+    atRisk.push(artifact);
+  }
+  return { keep, atRisk };
+}
+function applyFloor(kept, atRisk, keepLast) {
+  const shortfall = Math.max(0, keepLast - kept.length);
+  const newestFirst = [...atRisk].sort((a, b) => b.lastModifiedMs - a.lastModifiedMs);
+  const spared = new Set(newestFirst.slice(0, shortfall).map((a) => a.id));
+  const rescued = [];
+  const reap = [];
+  for (const artifact of atRisk) {
+    if (spared.has(artifact.id)) rescued.push({ ...artifact, reason: "keep-last" });
+    else reap.push(artifact);
+  }
+  return { rescued, reap };
+}
+function planReaping(input) {
+  assertPolicy(input.retention);
+  const undetermined = input.artifacts.filter((a) => a.live === "unknown");
+  const { keep, atRisk } = classifyByOwnReason(input);
+  const { rescued, reap } = applyFloor(keep, atRisk, input.retention.keepLast);
+  return { reap, keep: [...keep, ...rescued], undetermined };
+}
+
+// src/schema-normalizer.ts
+function isJsonSchemaObject(s) {
+  if (typeof s !== "object" || s === null) return false;
+  const o = s;
+  if ("$schema" in o) return true;
+  return o.type === "object" && typeof o.properties === "object" && o.properties !== null;
+}
+function hasToJsonSchemaMethod(s) {
+  return typeof s === "object" && s !== null && typeof s.toJsonSchema === "function";
+}
+function isZodSchema(s) {
+  if (typeof s !== "object" || s === null) return false;
+  const o = s;
+  return typeof o.safeParse === "function" && ("_def" in o || "def" in o);
+}
+function isValibotSchema(s) {
+  if (typeof s !== "object" || s === null) return false;
+  const o = s;
+  return o.kind === "schema" && "type" in o && typeof o.toJsonSchema !== "function";
+}
+function isMissingModuleError(err) {
+  if (err?.code === "ERR_MODULE_NOT_FOUND") return true;
+  return err instanceof Error && /Cannot find|Cannot resolve|ERR_MODULE_NOT_FOUND/.test(err.message);
+}
+async function normalizeValibotSchema(schema) {
+  const specifier = "@valibot/to-json-schema";
+  try {
+    const mod = await import(specifier);
+    return mod.toJsonSchema(schema);
+  } catch (err) {
+    if (!isMissingModuleError(err)) throw err;
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError(
+      "normalizeSchema: a Valibot schema requires the optional '@valibot/to-json-schema' package. Install it, or use a Zod schema (the default recommendation).",
+      { code: "valibot_converter_missing" }
+    );
+  }
+}
+async function normalizeSchema(schema) {
+  if (isJsonSchemaObject(schema)) return schema;
+  if (isValibotSchema(schema)) return await normalizeValibotSchema(schema);
+  if (isZodSchema(schema)) {
+    return chunkAA27GEYS_cjs.toJsonSchema(schema, { unrepresentable: "any" });
+  }
+  if (hasToJsonSchemaMethod(schema)) return schema.toJsonSchema();
+  throw new chunkJ7J7J2GN_cjs.ConfigurationError(
+    "normalizeSchema: unsupported schema. Supported: Zod (default), JSON Schema, ArkType (.toJsonSchema()), Valibot (with @valibot/to-json-schema).",
+    { code: "unsupported_schema" }
+  );
+}
+
+// src/security.ts
+var Security = class {
+  constructor() {
+  }
+  /**
+   * Redact known credential patterns from `text` and return the masked
+   * string. Use this at any consumer output boundary the SDK does not
+   * directly own (custom stdout loggers, app-level metrics, debug-share
+   * artifacts, etc.).
+   *
+   * Coerces non-strings (objects via JSON.stringify, null/undefined → "").
+   * Two-bucket masking: tokens shorter than 18 chars → `***`; longer
+   * tokens preserve `prefix...suffix` for debuggability without revealing
+   * the secret middle.
+   *
+   * @param text - The value to redact. Strings, objects, primitives all OK.
+   * @param opts.codeFile - When `true`, skips the parametric `key=value`
+   *   matcher so file content like `.env.example` placeholders is left
+   *   intact. Built-in pattern matches still apply.
+   *
+   * @example
+   * console.log(`[bot] received: ${Security.redact(userText)}`);
+   * // → "[bot] received: please remember sk-abc...xyz1"
+   */
+  static redact(text, opts) {
+    return chunk6LHQPOMI_cjs.redactSecrets(text, opts);
+  }
+  /**
+   * Register a custom redaction pattern. Additive — built-in patterns
+   * (OpenAI, Anthropic, GitHub PAT, AWS, etc.) cannot be removed.
+   *
+   * @param re - RegExp with `/g` flag. Throws if `/g` is missing
+   *             (without /g, only first match is replaced and the rest
+   *             leaks).
+   *
+   * Process-global mutable state. The SDK is designed for single-tenant
+   * processes (Theo PaaS user runtime, local CLI). Multi-tenant
+   * deployments running multiple SDK consumers in the same Node process
+   * share this list — patterns added by tenant A apply to tenant B's
+   * redactions. Acceptable for v1; future isolate-aware refactor would
+   * thread patterns through a context if needed.
+   *
+   * @example
+   * Security.addPattern(/MYORG-[A-Z0-9]{32}/g);
+   * // → text containing "MYORG-AAAA...AAAA" now masks like a builtin.
+   */
+  static addPattern(re) {
+    if (!re.global) {
+      throw new chunkJ7J7J2GN_cjs.ConfigurationError(
+        "Security.addPattern: regex must have /g flag for replace-all semantics",
+        { code: "invalid_redaction_pattern" }
+      );
+    }
+    chunk6LHQPOMI_cjs.addPattern(re);
+  }
+};
+
+// src/security-floor.ts
+function permissivenessOf(order, value) {
+  if (value === void 0) return -1;
+  return order.indexOf(value);
+}
+function baseline(input) {
+  const { restricted, override, layers } = input;
+  let value;
+  for (const [name, candidate] of Object.entries(layers)) {
+    if (name === override || restricted.includes(name)) continue;
+    if (candidate !== void 0) value = candidate;
+  }
+  return value;
+}
+function tightenOnly(input, start) {
+  const { permissiveness, restricted, layers } = input;
+  let resolved = start;
+  let ceiling = permissivenessOf(permissiveness, start);
+  for (const layer of restricted) {
+    const candidate = layers[layer];
+    if (candidate === void 0) continue;
+    const level = permissivenessOf(permissiveness, candidate);
+    if (level < 0) continue;
+    if (ceiling >= 0 && level > ceiling) continue;
+    resolved = candidate;
+    ceiling = level;
+  }
+  return resolved;
+}
+function applySecurityFloor(input) {
+  return input.layers[input.override] ?? tightenOnly(input, baseline(input));
+}
+
+// src/session-guard.ts
+var LiveSessionError = class extends chunkJ7J7J2GN_cjs.TheokitAgentError {
+  name = "LiveSessionError";
+  sessionId;
+  reason;
+  constructor(sessionId, reason) {
+    super(
+      reason === "session-is-live" ? `refusing to destroy session ${sessionId}: it is live \u2014 another process is probably still appending to it. Switch to another session first.` : `refusing to destroy session ${sessionId}: the set of live sessions could not be determined, so this cannot be shown to be safe. Resolve that before deleting.`
+    );
+    this.sessionId = sessionId;
+    this.reason = reason;
+  }
+};
+function guardSessionDestruction(sessionId, live) {
+  if (live === void 0) {
+    throw new LiveSessionError(sessionId, "liveness-undetermined");
+  }
+  if (live.includes(sessionId)) {
+    throw new LiveSessionError(sessionId, "session-is-live");
+  }
+}
+
+// src/session-messages.ts
+async function readSessionMessages2(options) {
+  const cwd = options.cwd ?? process.cwd();
+  const baseDir = chunkD3CCY3A2_cjs.resolveSessionDir({ sessionDir: options.sessionDir });
+  return chunkYIFFF23U_cjs.readSessionMessages(new chunk7FDKWDA2_cjs.FsSessionStore({ baseDir, cwd }), options.sessionId);
+}
+
+// src/session-scope.ts
+function scopedConversationId(scope, id) {
+  return `${scope}__${id}`;
+}
+function sessionScopePrefix(scope) {
+  return `${scope}__`;
+}
+
+// src/squad.ts
+function isBuiltAgent(m) {
+  return typeof m.send === "function";
+}
+async function materialize(def, index) {
+  const { Agent: Agent2 } = await import('./agent-ARLOD4JX.cjs');
+  return Agent2.create({
+    // `AgentDefinition.model` admits the sentinel `'inherit'`, which is not a model id. Inheriting
+    // here means "declare nothing and let the default apply" — forwarding the literal would create
+    // an agent asking for a model literally named `inherit`.
+    ...def.model !== void 0 && def.model !== "inherit" ? { model: def.model } : {},
+    ...def.prompt !== void 0 ? { systemPrompt: def.prompt } : {},
+    agentId: `squad-member-${String(index)}`,
+    local: {}
+  });
+}
+function createSquad(options) {
+  const { agents } = options;
+  if (!Array.isArray(agents) || agents.length === 0) {
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError("createSquad requires a non-empty `agents` array", {
+      code: "invalid_squad"
+    });
+  }
+  if (options.process !== void 0 && options.process !== "sequential") {
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError(
+      `createSquad only supports process "sequential"; for manager\u2192worker delegation use subagents or @theokit/sdk-handoff`,
+      { code: "squad_process_unsupported" }
+    );
+  }
+  return {
+    run: async (input) => {
+      const run = await (await buildPipeline(agents, options.name)).run(input);
+      return { result: run.output, status: run.status, steps: run.stepResults };
+    }
+  };
+}
+async function buildPipeline(agents, name) {
+  let builder = chunk4HS6FFGL_cjs.Workflow.create({ name: name ?? "squad" });
+  for (let i = 0; i < agents.length; i++) {
+    const member = agents[i];
+    if (member === void 0) continue;
+    const agent = isBuiltAgent(member) ? member : await materialize(member, i);
+    const opts = i > 0 ? { origin: { kind: "peer", from: `agent-${i - 1}` } } : void 0;
+    builder = builder.then(chunk4HS6FFGL_cjs.agentStep(`agent-${i}`, agent, (prev) => String(prev), opts));
+  }
+  return builder.commit();
+}
+var Squad = class {
+  constructor() {
+  }
+  static create(options) {
+    return createSquad(options);
+  }
+};
+
+// src/task.ts
+var Task = class {
+  // D361 — static class with private constructor.
+  constructor() {
+    throw new Error("Task is static; do not instantiate");
+  }
+  /**
+   * Configure the registry. **Must be called before the first `submit`**
+   * (EC-13). Available knobs: pluggable store (D364), concurrency cap
+   * (D369), and retention (D373).
+   */
+  static configure(opts) {
+    chunkKVSAY6NZ_cjs.configure(opts);
+  }
+  /**
+   * Submit a unit of asynchronous work to the registry.
+   *
+   * The `work` function receives `{ signal, emit }` — `signal` is the
+   * AbortSignal honored on cancel; `emit(payload)` produces a
+   * `progress` event observable via `Task.subscribe`.
+   *
+   * Returns a `TaskHandle` in `state: "queued"`. Subsequent state
+   * transitions are observable via `Task.subscribe(handle.id)` OR
+   * polled via `Task.get(handle.id)`.
+   *
+   * **Idempotency (D367):** submitting twice with the same `id` returns
+   * the existing handle without re-invoking work.
+   *
+   * **Grammar (D368):** user-supplied ids must match
+   * `^[a-z0-9][a-z0-9_-]*$` and must not start with reserved prefixes
+   * `wf-` / `b-` / `cron-`. Otherwise `InvalidTaskIdError` is thrown.
+   *
+   * **Pre-aborted signal (EC-4):** if `options.signal` is already
+   * aborted, the task short-circuits to `cancelled` without acquiring
+   * a semaphore slot and without invoking `work`.
+   */
+  static async submit(kind, work, options = {}) {
+    return chunkKVSAY6NZ_cjs.submit({
+      kind,
+      work,
+      ...options.id !== void 0 ? { id: options.id } : {},
+      ...options.meta !== void 0 ? { meta: options.meta } : {},
+      ...options.signal !== void 0 ? { signal: options.signal } : {},
+      ...options.onRunEvent !== void 0 ? { onRunEvent: options.onRunEvent } : {}
+    });
+  }
+  /** Returns matching handles, capped at `filter.limit ?? 100`. */
+  static list(filter = {}) {
+    return chunkKVSAY6NZ_cjs.list(filter);
+  }
+  /** Returns a single handle by id, or `undefined` if unknown / evicted. */
+  static get(id) {
+    return chunkKVSAY6NZ_cjs.get(id);
+  }
+  /**
+   * Idempotent cancel (D365). Returns:
+   *   - `{ cancelled: true, alreadyTerminal: false }` — transitioned
+   *     queued/running task to `cancelled`.
+   *   - `{ cancelled: false, alreadyTerminal: true }` — task already
+   *     terminal.
+   *   - `{ cancelled: false, alreadyTerminal: false }` — task unknown.
+   *
+   * Never throws.
+   */
+  static cancel(id, reason) {
+    return chunkKVSAY6NZ_cjs.cancel(id, reason);
+  }
+  /**
+   * Subscribe to a task's event stream. The returned `AsyncIterable<TaskEvent>`
+   * starts by replaying buffered events (ring buffer cap 64, D372) and
+   * then yields live events until a terminal event (finished / errored
+   * / cancelled) is emitted, at which point it closes automatically.
+   *
+   * Calling `.return()` on the iterator (or `break` in a `for await`)
+   * cleans up the subscriber callback (EC-10).
+   *
+   * Throws `TaskNotFoundError` if the id is unknown or has been evicted.
+   */
+  static subscribe(id) {
+    return chunkKVSAY6NZ_cjs.subscribe(id);
+  }
+};
+
+// src/internal/catalog/fixtures.ts
+var FIXTURE_TIMESTAMP = "2024-01-01T00:00:00.000Z";
+var FIXTURE_USER = {
+  apiKeyName: "Contract Test Key",
+  userEmail: "sdk-contract@example.com",
+  createdAt: FIXTURE_TIMESTAMP
+};
+var FIXTURE_MODELS = [
+  {
+    id: chunkD3CCY3A2_cjs.DEFAULT_AGENTIC_MODEL_ID,
+    name: "Gemini 2.0 Flash",
+    displayName: "Gemini 2.0 Flash",
+    parameters: [
+      {
+        id: "thinking",
+        displayName: "Thinking",
+        values: [
+          { value: "low", displayName: "Low" },
+          { value: "high", displayName: "High" }
+        ]
+      }
+    ],
+    variants: [
+      {
+        displayName: "High thinking",
+        params: [{ id: "thinking", value: "high" }],
+        isDefault: false
+      }
+    ]
+  }
+];
+var FIXTURE_REPOSITORIES = [
+  { url: "https://github.com/usetheo/example" }
+];
+var GENERIC_SETUP_SCHEMA = {
+  type: "object",
+  description: "Configuration values for this provider.",
+  required: ["credential"],
+  properties: { credential: { type: "string" } }
+};
+var FIXTURE_PROVIDERS = [
+  {
+    name: "anthropic",
+    displayName: "Anthropic",
+    capabilities: ["chat"],
+    isAvailable: true,
+    setupSchema: GENERIC_SETUP_SCHEMA
+  },
+  {
+    name: "openai",
+    displayName: "OpenAI",
+    capabilities: ["chat", "embedding", "image"],
+    isAvailable: false,
+    setupSchema: GENERIC_SETUP_SCHEMA
+  },
+  {
+    name: "openrouter",
+    displayName: "OpenRouter",
+    capabilities: ["chat"],
+    isAvailable: true,
+    setupSchema: GENERIC_SETUP_SCHEMA
+  },
+  {
+    name: "nous",
+    displayName: "Nous Research",
+    capabilities: ["chat"],
+    isAvailable: true,
+    setupSchema: GENERIC_SETUP_SCHEMA
+  },
+  {
+    name: "fixture-search",
+    displayName: "Fixture Search",
+    capabilities: ["web_search"],
+    isAvailable: true,
+    setupSchema: GENERIC_SETUP_SCHEMA
+  }
+];
+
+// src/internal/catalog/local-models.ts
+async function listLocalModelsViaOpenAiCompat(baseUrl) {
+  const url = `${baseUrl}/v1/models`;
+  let response;
+  try {
+    response = await fetch(url, { method: "GET" });
+  } catch (fetchErr) {
+    const mapped = chunk2HPNT6HH_cjs.mapOllamaTransportError({
+      providerId: "ollama",
+      cause: fetchErr,
+      endpoint: "/v1/models"
+    });
+    if (mapped !== void 0) throw mapped;
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError(
+      `Failed to reach local provider at ${baseUrl}: ${fetchErr.message}`,
+      { code: "local_provider_unreachable" }
+    );
+  }
+  if (!response.ok) {
+    const body = await chunk2HPNT6HH_cjs.readErrorResponseBody(response);
+    const mapped = chunk2HPNT6HH_cjs.mapOllamaHttpError({
+      providerId: "ollama",
+      status: response.status,
+      body,
+      headers: response.headers,
+      endpoint: "/v1/models"
+    });
+    if (mapped !== void 0) throw mapped;
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError(
+      `Local provider at ${baseUrl} returned HTTP ${response.status} on /v1/models`,
+      { code: "local_provider_http_error" }
+    );
+  }
+  let parsed;
+  try {
+    parsed = await response.json();
+  } catch {
+    return [];
+  }
+  const data = parsed.data ?? [];
+  return data.filter(
+    (entry) => typeof entry?.id === "string" && entry.id.length > 0
+  ).map((entry) => ({
+    id: entry.id,
+    displayName: entry.id,
+    name: entry.id
+  }));
+}
+
+// src/theokit.ts
+var Theokit = class {
+  constructor() {
+  }
+  /**
+   * Return the user behind the current API key.
+   *
+   * @public
+   */
+  static me(options = {}) {
+    return executeCatalogRequest({
+      apiKey: options.apiKey,
+      fixture: FIXTURE_USER,
+      path: "/v1/me"
+    });
+  }
+  /**
+   * Model catalog reads.
+   *
+   * @public
+   */
+  static models = {
+    list: async (options = {}) => {
+      if (options.provider !== void 0) {
+        const localModels = await maybeListLocalModels(options.provider);
+        if (localModels !== void 0) return localModels;
+      }
+      return executeCatalogRequest({
+        apiKey: options.apiKey,
+        fixture: FIXTURE_MODELS,
+        path: "/v1/models"
+      });
+    },
+    capabilities: (providerOrModelId) => {
+      chunkQC55H6RJ_cjs.registerBuiltins();
+      const providerId = providerOrModelId.includes("/") ? providerOrModelId.split("/")[0] ?? providerOrModelId : providerOrModelId;
+      return chunkQC55H6RJ_cjs.getCatalogCapabilities(providerId);
+    }
+  };
+  /**
+   * Connected GitHub repositories for the calling user's team. Cloud only.
+   *
+   * @public
+   */
+  static repositories = {
+    list: (options = {}) => executeCatalogRequest({
+      apiKey: options.apiKey,
+      fixture: FIXTURE_REPOSITORIES,
+      path: "/v1/repositories"
+    })
+  };
+  /**
+   * Provider catalog. Lists every provider known to the platform, including
+   * plugin-registered ones, with capability and availability metadata.
+   *
+   * @public
+   */
+  static providers = {
+    list: (options = {}) => executeCatalogRequest({
+      apiKey: options.apiKey,
+      fixture: FIXTURE_PROVIDERS,
+      path: "/v1/providers"
+    })
+  };
+  /**
+   * Local introspection of bundled SDK assets (ADR D201). Unlike the
+   * cloud-catalog `providers.list()` (which hits the TheoCloud HTTP API),
+   * `inspect.*` reads the SDK's own bundled registries — useful for
+   * tooling (e.g. `@theokit/cli`'s `theokit inspect`) that needs to know
+   * what's available WITHOUT a network round-trip.
+   *
+   * @public
+   */
+  static inspect = {
+    builtinProviders: () => {
+      chunkQC55H6RJ_cjs.registerBuiltins();
+      return chunkQC55H6RJ_cjs.listProviders().map((p) => ({
+        name: p.name,
+        apiMode: p.apiMode,
+        authType: p.authType,
+        baseUrl: p.baseUrl,
+        ...p.aliases !== void 0 ? { aliases: p.aliases } : {},
+        envVars: p.envVars
+      }));
+    },
+    embeddingAdapters: () => Object.entries(chunkD3CCY3A2_cjs.MEMORY_EMBEDDING_ADAPTERS).map(([id, adapter]) => ({
+      id,
+      transport: adapter.transport,
+      defaultModel: adapter.defaultModel
+    }))
+  };
+  // NOTE: `Theokit.subscribe` is exported from `@theokit/sdk/subscription`
+  // sub-path entry instead of the main `Theokit` static class to avoid
+  // pulling the subscription module into the main `index.ts` DTS bundle
+  // (which trips on the pre-existing `types/agent.ts ↔ fork-agent.ts` cycle
+  // — same pattern as `path-safety` per ADR D425/D429 + see tsup.config.ts
+  // header comment). Consumers import via:
+  //   `import { subscribe } from "@theokit/sdk/subscription"`
+  // The function shape mirrors a hypothetical `Theokit.subscribe(name, input, opts)`
+  // and may be promoted onto Theokit once the agent.ts cycle is broken.
+};
+async function maybeListLocalModels(providerName) {
+  chunkQC55H6RJ_cjs.registerBuiltins();
+  await chunk2HPNT6HH_cjs.discoverProviderPlugins();
+  const profile = chunkQC55H6RJ_cjs.getProviderProfile(providerName);
+  if (profile === void 0) return void 0;
+  if (profile.authType !== "none") return void 0;
+  const baseUrl = resolveLocalProviderBaseUrl(profile.name, profile.baseUrl);
+  return listLocalModelsViaOpenAiCompat(baseUrl);
+}
+function resolveLocalProviderBaseUrl(providerName, fallback) {
+  if (providerName === "ollama" && process.env.OLLAMA_HOST !== void 0) {
+    return process.env.OLLAMA_HOST;
+  }
+  return fallback;
+}
+async function executeCatalogRequest(request) {
+  const apiKey = chunk6LHQPOMI_cjs.resolveApiKey(request.apiKey);
+  if (apiKey === void 0) {
+    throw new chunkJ7J7J2GN_cjs.AuthenticationError("Missing API key", { code: "missing_api_key" });
+  }
+  if (chunk2HPNT6HH_cjs.shouldUseFixtureMode(apiKey)) {
+    return request.fixture;
+  }
+  if (!chunk2HPNT6HH_cjs.isFixtureApiKey(apiKey) && process.env.THEOKIT_API_BASE_URL === void 0) {
+    throw new chunkJ7J7J2GN_cjs.AuthenticationError("Invalid API key", { code: "authentication_error" });
+  }
+  return chunk2HPNT6HH_cjs.httpRequest(request.path, { apiKey });
+}
+
+// src/tool-blast-radius.ts
+var DECLARED = /* @__PURE__ */ Symbol.for("@theokit/sdk.blastRadius");
+function withBlastRadius(tool, action) {
+  return Object.defineProperty(tool, DECLARED, {
+    value: action,
+    // `enumerable: false` is defensive and NOT load-bearing — checked, not assumed. Flipping it to
+    // true leaves every case green, because the symbol key already excludes this from `Object.keys`
+    // and `JSON.stringify`. It stays because a future string-keyed variant would need it, and the
+    // next reader should not have to discover that the flag has no test behind it.
+    enumerable: false,
+    configurable: true
+  });
+}
+function describeAction(tool) {
+  return tool[DECLARED];
+}
+
+// src/trajectory-helpers.ts
+function toShareGptTrajectory(result, options) {
+  if (!result.ok) return null;
+  const conversations = buildConversations(result, options?.messages);
+  const trajectory = {
+    conversations,
+    metadata: {
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      durationMs: result.durationMs,
+      promptIndex: result.index,
+      ...options?.model !== void 0 ? { model: options.model } : {}
+    },
+    completed: true
+  };
+  const usage = extractUsage(result.result);
+  if (usage !== void 0) trajectory.usage = usage;
+  return trajectory;
+}
+function buildConversations(result, messages) {
+  const conversations = [{ from: "human", value: result.prompt }];
+  if (Array.isArray(messages) && messages.length > 0) {
+    for (const m of messages) {
+      for (const entry of mapSdkMessage(m)) conversations.push(entry);
+    }
+    return conversations;
+  }
+  const finalText = typeof result.result.result === "string" ? result.result.result : "";
+  conversations.push({ from: "gpt", value: finalText });
+  return conversations;
+}
+function extractUsage(runResult) {
+  const usage = runResult?.usage;
+  if (usage === void 0) return void 0;
+  if (typeof usage.inputTokens !== "number" || typeof usage.outputTokens !== "number") {
+    return void 0;
+  }
+  return { inputTokens: usage.inputTokens, outputTokens: usage.outputTokens };
+}
+function mapSdkMessage(m) {
+  if (m === null || typeof m !== "object") return [];
+  switch (m.type) {
+    case "assistant":
+      return mapAssistant(m);
+    case "tool_call":
+      return mapToolCall(m);
+    case "thinking":
+    case "system":
+    case "user":
+    case "status":
+    case "task":
+    case "request":
+    case "object_delta":
+      return [];
+    default: {
+      return [];
+    }
+  }
+}
+function mapAssistant(m) {
+  const content = m.message?.content;
+  if (!Array.isArray(content)) return [];
+  const textParts = [];
+  const toolCalls = [];
+  for (const block of content) {
+    appendBlock(block, textParts, toolCalls);
+  }
+  const entry = { from: "gpt", value: textParts.join("") };
+  if (toolCalls.length > 0) entry.tool_calls = toolCalls;
+  return [entry];
+}
+function appendBlock(block, textParts, toolCalls) {
+  if (block === null || typeof block !== "object") return;
+  const text = block;
+  if (text.type === "text" && typeof text.text === "string") {
+    textParts.push(text.text);
+    return;
+  }
+  const tu = block;
+  if (tu.type !== "tool_use") return;
+  const args = tu.input !== null && typeof tu.input === "object" ? tu.input : {};
+  toolCalls.push({ name: tu.name, arguments: args });
+}
+function mapToolCall(m) {
+  if (m.status !== "completed") return [];
+  const value = typeof m.result === "string" ? m.result : m.result === void 0 ? "" : safeStringify(m.result);
+  return [{ from: "tool", value }];
+}
+function safeStringify(v) {
+  try {
+    return JSON.stringify(v);
+  } catch {
+    return String(v);
+  }
+}
+
+// src/trust-posture.ts
+function resolveTrustPosture(input) {
+  const source = input.envOverride === true ? "env" : input.isTrusted() ? "store" : "default";
+  const level = source === "default" ? "untrusted" : "trusted";
+  const granted = level === "trusted";
+  const allows = Object.fromEntries(input.capabilities.map((key) => [key, granted]));
+  return { level, source, allows };
+}
+
+// src/wiring-record.ts
+var UngatedCapabilityError = class extends chunkJ7J7J2GN_cjs.TheokitAgentError {
+  name = "UngatedCapabilityError";
+};
+function recordWiring(input) {
+  const record = {};
+  for (const [capability, requested] of Object.entries(input.requested)) {
+    const allowed = input.posture.allows[capability];
+    if (allowed === void 0) {
+      throw new UngatedCapabilityError(
+        `capability \`${capability}\` was recorded as wired but the posture does not gate it; gated capabilities are: ${Object.keys(input.posture.allows).join(", ") || "(none)"}`
+      );
+    }
+    record[capability] = {
+      // Copied, not aliased. See the @returns note.
+      active: allowed ? [...requested] : [],
+      requested: [...requested],
+      suppressedByTrust: !allowed && requested.length > 0
+    };
+  }
+  return record;
+}
+
+Object.defineProperty(exports, "StreamObjectError", {
+  enumerable: true,
+  get: function () { return chunkTFG5IBZS_cjs.StreamObjectError; }
+});
+Object.defineProperty(exports, "GOAL_CONTINUATION_MARKER", {
+  enumerable: true,
+  get: function () { return chunkOBA6YK2R_cjs.GOAL_CONTINUATION_MARKER; }
+});
+Object.defineProperty(exports, "JudgeCredentialError", {
+  enumerable: true,
+  get: function () { return chunkQDM3OHUT_cjs.JudgeCredentialError; }
+});
+Object.defineProperty(exports, "GenerateObjectError", {
+  enumerable: true,
+  get: function () { return chunkQWD4RDZ3_cjs.GenerateObjectError; }
+});
+Object.defineProperty(exports, "Workflow", {
+  enumerable: true,
+  get: function () { return chunk4HS6FFGL_cjs.Workflow; }
+});
+Object.defineProperty(exports, "agentStep", {
+  enumerable: true,
+  get: function () { return chunk4HS6FFGL_cjs.agentStep; }
+});
+Object.defineProperty(exports, "fn", {
+  enumerable: true,
+  get: function () { return chunk4HS6FFGL_cjs.fn; }
+});
+Object.defineProperty(exports, "Cron", {
+  enumerable: true,
+  get: function () { return chunk67SBTGMA_cjs.Cron; }
+});
+Object.defineProperty(exports, "Agent", {
+  enumerable: true,
+  get: function () { return chunkD3CCY3A2_cjs.Agent; }
+});
+Object.defineProperty(exports, "AgentBuilder", {
+  enumerable: true,
+  get: function () { return chunkD3CCY3A2_cjs.AgentBuilder; }
+});
+Object.defineProperty(exports, "Tool", {
+  enumerable: true,
+  get: function () { return chunkD3CCY3A2_cjs.Tool; }
+});
+Object.defineProperty(exports, "ToolError", {
+  enumerable: true,
+  get: function () { return chunkD3CCY3A2_cjs.ToolError; }
+});
+Object.defineProperty(exports, "UsageAccumulator", {
+  enumerable: true,
+  get: function () { return chunkD3CCY3A2_cjs.UsageAccumulator; }
+});
+Object.defineProperty(exports, "computeCost", {
+  enumerable: true,
+  get: function () { return chunkD3CCY3A2_cjs.computeCost; }
+});
+Object.defineProperty(exports, "getPricingEntry", {
+  enumerable: true,
+  get: function () { return chunkD3CCY3A2_cjs.getPricingEntry; }
+});
+Object.defineProperty(exports, "emitRunEvent", {
+  enumerable: true,
+  get: function () { return chunkKVSAY6NZ_cjs.emitRunEvent; }
+});
+Object.defineProperty(exports, "withCwdMutex", {
+  enumerable: true,
+  get: function () { return chunkZF2LDKQQ_cjs.withCwdMutex; }
+});
+Object.defineProperty(exports, "TASK_RESERVED_PREFIXES", {
+  enumerable: true,
+  get: function () { return chunkHCT4HPCL_cjs.TASK_RESERVED_PREFIXES; }
+});
+Object.defineProperty(exports, "isValidTaskId", {
+  enumerable: true,
+  get: function () { return chunkHCT4HPCL_cjs.isValidTaskId; }
+});
+Object.defineProperty(exports, "estimateTokens", {
+  enumerable: true,
+  get: function () { return chunkATT276RD_cjs.estimateTokens; }
+});
+Object.defineProperty(exports, "AgentDisposedError", {
+  enumerable: true,
+  get: function () { return chunkJ7J7J2GN_cjs.AgentDisposedError; }
+});
+Object.defineProperty(exports, "AgentRunError", {
+  enumerable: true,
+  get: function () { return chunkJ7J7J2GN_cjs.AgentRunError; }
+});
+Object.defineProperty(exports, "AuthenticationError", {
+  enumerable: true,
+  get: function () { return chunkJ7J7J2GN_cjs.AuthenticationError; }
+});
+Object.defineProperty(exports, "BudgetExceededError", {
+  enumerable: true,
+  get: function () { return chunkJ7J7J2GN_cjs.BudgetExceededError; }
+});
+Object.defineProperty(exports, "ConfigurationError", {
+  enumerable: true,
+  get: function () { return chunkJ7J7J2GN_cjs.ConfigurationError; }
+});
+Object.defineProperty(exports, "IntegrationNotConnectedError", {
+  enumerable: true,
+  get: function () { return chunkJ7J7J2GN_cjs.IntegrationNotConnectedError; }
+});
+Object.defineProperty(exports, "InvalidTaskIdError", {
+  enumerable: true,
+  get: function () { return chunkJ7J7J2GN_cjs.InvalidTaskIdError; }
+});
+Object.defineProperty(exports, "MemoryAdapterError", {
+  enumerable: true,
+  get: function () { return chunkJ7J7J2GN_cjs.MemoryAdapterError; }
+});
+Object.defineProperty(exports, "NetworkError", {
+  enumerable: true,
+  get: function () { return chunkJ7J7J2GN_cjs.NetworkError; }
+});
+Object.defineProperty(exports, "RateLimitError", {
+  enumerable: true,
+  get: function () { return chunkJ7J7J2GN_cjs.RateLimitError; }
+});
+Object.defineProperty(exports, "TaskNotFoundError", {
+  enumerable: true,
+  get: function () { return chunkJ7J7J2GN_cjs.TaskNotFoundError; }
+});
+Object.defineProperty(exports, "TheokitAgentError", {
+  enumerable: true,
+  get: function () { return chunkJ7J7J2GN_cjs.TheokitAgentError; }
+});
+Object.defineProperty(exports, "UnknownAgentError", {
+  enumerable: true,
+  get: function () { return chunkJ7J7J2GN_cjs.UnknownAgentError; }
+});
+Object.defineProperty(exports, "UnsupportedBudgetOperationError", {
+  enumerable: true,
+  get: function () { return chunkJ7J7J2GN_cjs.UnsupportedBudgetOperationError; }
+});
+Object.defineProperty(exports, "UnsupportedRunOperationError", {
+  enumerable: true,
+  get: function () { return chunkJ7J7J2GN_cjs.UnsupportedRunOperationError; }
+});
+Object.defineProperty(exports, "UnsupportedTaskOperationError", {
+  enumerable: true,
+  get: function () { return chunkJ7J7J2GN_cjs.UnsupportedTaskOperationError; }
+});
+Object.defineProperty(exports, "isTransientError", {
+  enumerable: true,
+  get: function () { return chunkJ7J7J2GN_cjs.isTransientError; }
+});
+Object.defineProperty(exports, "setDiagnosticsSink", {
+  enumerable: true,
+  get: function () { return chunk6LHQPOMI_cjs.setDiagnosticsSink; }
+});
+exports.AgentFactory = AgentFactory;
+exports.Budget = Budget;
+exports.EventBus = EventBus;
+exports.JobQueue = JobQueue;
+exports.LayerOrderError = LayerOrderError;
+exports.LiveSessionError = LiveSessionError;
+exports.Memory = Memory;
+exports.NoopMemoryProvider = NoopMemoryProvider;
+exports.PermissionEngine = PermissionEngine;
+exports.PermissionPlugin = PermissionPlugin;
+exports.Plugin = Plugin;
+exports.Provider = Provider;
+exports.RetentionPolicyError = RetentionPolicyError;
+exports.SOVEREIGN_ENV_KEYS = SOVEREIGN_ENV_KEYS;
+exports.Security = Security;
+exports.Skill = Skill;
+exports.SkillReadTool = SkillReadTool;
+exports.Squad = Squad;
+exports.Task = Task;
+exports.Theokit = Theokit;
+exports.TokenLimiter = TokenLimiter;
+exports.UngatedCapabilityError = UngatedCapabilityError;
+exports.UnicodeNormalizer = UnicodeNormalizer;
+exports.applyMode = applyMode;
+exports.applySecurityFloor = applySecurityFloor;
+exports.auditEnvReachability = auditEnvReachability;
+exports.chargeAndCheckThresholds = chargeAndCheckThresholds;
+exports.createCounterBudgetTracker = createCounterBudgetTracker;
+exports.decideApproval = decideApproval;
+exports.describeAction = describeAction;
+exports.describeCredential = describeCredential;
+exports.evaluateBlastRadius = evaluateBlastRadius;
+exports.extractRawId = extractRawId;
+exports.foldLayers = foldLayers;
+exports.guardSessionDestruction = guardSessionDestruction;
+exports.inferApiMode = inferApiMode;
+exports.loadProjectEnv = loadProjectEnv;
+exports.migrateSqliteToLance = migrateSqliteToLance2;
+exports.mkMemoryId = mkMemoryId;
+exports.normalizeSchema = normalizeSchema;
+exports.normalizeUsage = normalizeUsage;
+exports.planReaping = planReaping;
+exports.preflightCheck = preflightCheck;
+exports.readSessionMessages = readSessionMessages2;
+exports.recordWiring = recordWiring;
+exports.resolveTrustPosture = resolveTrustPosture;
+exports.runGoalLoop = runGoalLoop;
+exports.scopedConversationId = scopedConversationId;
+exports.sessionScopePrefix = sessionScopePrefix;
+exports.toShareGptTrajectory = toShareGptTrajectory;
+exports.verifyLayerOrdering = verifyLayerOrdering;
+exports.withBlastRadius = withBlastRadius;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map