@theokit/sdk 4.28.0 → 4.30.0

package/dist/{chunk-XW6RXVGB.js → chunk-ISZ3MBUD.js}

@@ -1,32 +1,34 @@
+import { extractCodePlugins } from './chunk-2SFBB54R.js';
 import { submit, emitRunEvent } from './chunk-HRA3CPGG.js';
 import { enqueueSessionWrite, hydrateSession, flushSessionWrites, appendSessionMessage, persistTurnToTranscript, getSessionMessages, clearSession } from './chunk-SQLZ7ONU.js';
+import { FsSessionStore } from './chunk-U6QGZHPN.js';
 import { discoverProviderPlugins, CircuitBreaker, buildDefaultSummarizer, parseSseStream, resolveProviderChain, inferProviderFromApiKey, detectPrimaryProvider, tryFirstEvent, relayStream, mapOpenAICompatibleError, renderToolResultContentText } from './chunk-NRSH7RJY.js';
-import { IndexManager, writeSessionSummary, memoryDir, globalEmbeddingCache, appendFact, readFacts, legacyMemoryJsonPath, memoryMdPath, appendFactToMarkdown } from './chunk-G6GO6BXD.js';
+import { IndexManager, writeSessionSummary, memoryDir, globalEmbeddingCache, appendFact, readFacts, legacyMemoryJsonPath, memoryMdPath, appendFactToMarkdown } from './chunk-XAUBQMQU.js';
 import { loadHookConfig, warnOnce, currentPersonalityContext, warnPersonalitySwitchInsideFork } from './chunk-XIG2IE3L.js';
-import { extractCodePlugins } from './chunk-2SFBB54R.js';
+import { resolveChildEnv } from './chunk-7GFX45DD.js';
 import { readVersionedJson, getTheokitHome, writeVersionedJson } from './chunk-DGRZNMTU.js';
-import { FsSessionStore } from './chunk-U6QGZHPN.js';
 import { sanitizeToolInput } from './chunk-U54XCYG3.js';
 import { subAgentToolsFromDefinitions, inheritSubAgentCredentials } from './chunk-FV3YEMQ7.js';
 import { setAgentFacade } from './chunk-6X6ID4MO.js';
-import { resolveChildEnv } from './chunk-7GFX45DD.js';
+import { findGitRoot, DEFAULT_DISCOVERY_SPECS, walkUpForFile, walkUpForGlob } from './chunk-UJ7IQJAG.js';
 import { withToolWhitelist, checkToolWhitelist } from './chunk-7AD3ZTZL.js';
 import { mapWithConcurrency } from './chunk-V4XRLPEF.js';
 import { withFileLock } from './chunk-HZQEDNF6.js';
 import { withCwdMutex } from './chunk-2XLKLVVR.js';
 import { defaultBaseDir, expandTilde } from './chunk-ZZWTY3RX.js';
 import { toJsonSchema } from './chunk-4VPXM6UU.js';
+import { atomicWriteJson } from './chunk-S2BBRVQX.js';
+import { loadSubagents } from './chunk-BNIFFFH3.js';
 import { resolveEffectiveContextWindow, CONTEXT_WINDOW_FLOOR, CONTEXT_WINDOW_MARGIN } from './chunk-WA3FO4R7.js';
 import { parseModelId } from './chunk-X2FR4OIT.js';
 import { getCatalogModelInfo, registerBuiltins, getProviderProfile, registerProvider, isPatchedModelKey } from './chunk-KAP4GJHO.js';
-import { escapeBlockBody, buildSkillsBlock, discoverSkills, stripSkillFrontmatter, readWorkspaceDir, parseSimpleYaml } from './chunk-AKSBP7OO.js';
+import { escapeBlockBody, buildSkillsBlock, discoverSkills, stripSkillFrontmatter } from './chunk-5IB2UKSN.js';
 import { validateArtifactPath, PathTraversalError, safePathJoin } from './chunk-POQT2OIF.js';
-import { findGitRoot, DEFAULT_DISCOVERY_SPECS, walkUpForFile, walkUpForGlob } from './chunk-UJ7IQJAG.js';
-import { atomicWriteJson } from './chunk-S2BBRVQX.js';
+import { readWorkspaceDir, parseSimpleYaml } from './chunk-FKCC2MED.js';
 import { AgentRunError, coerceToKnownAgentRunErrorCode, UnknownAgentError, ConfigurationError, AuthenticationError, UnsupportedRunOperationError, AgentDisposedError, NetworkError, IntegrationNotConnectedError, RateLimitError, TheokitAgentError } from './chunk-WLKFWQSJ.js';
 import { redactSecrets } from './chunk-JTFYYKDT.js';
-import { randomUUID, createHash } from 'crypto';
 import { stat, mkdir, readFile, readdir, access, unlink } from 'fs/promises';
+import { randomUUID, createHash } from 'crypto';
 import { existsSync } from 'fs';
 import { join, dirname, resolve, relative, isAbsolute } from 'path';
 import { spawn } from 'child_process';
@@ -98,506 +100,47 @@ var AgentBuilder = class {
     this.opts.skills = s;
     return this;
   }
-  agentId(id) {
-    this.opts.agentId = id;
-    return this;
-  }
-  /**
-   * Synchronous snapshot of the accumulated options. Returns a SHALLOW CLONE
-   * so external mutation of the result doesn't pollute the builder state (EC-2).
-   */
-  build() {
-    return { ...this.opts };
-  }
-  /**
-   * Validate + create a fresh agent. Delegates to `Agent.create` via the
-   * injected `deps.create`. Throws if the builder was instantiated without
-   * deps (i.e., direct `new AgentBuilder()` instead of `Agent.builder()`).
-   */
-  create() {
-    if (this.deps === void 0) {
-      return Promise.reject(
-        new Error(
-          "AgentBuilder.create() requires Agent.builder() entry \u2014 direct construction has no terminals."
-        )
-      );
-    }
-    return this.deps.create(this.build());
-  }
-  /**
-   * Resume an existing agent or create one if the ID is unknown. Delegates to
-   * `Agent.getOrCreate` via the injected `deps.getOrCreate` (ADR D22).
-   */
-  getOrCreate(agentId) {
-    if (this.deps === void 0) {
-      return Promise.reject(
-        new Error(
-          "AgentBuilder.getOrCreate() requires Agent.builder() entry \u2014 direct construction has no terminals."
-        )
-      );
-    }
-    return this.deps.getOrCreate(agentId, this.build());
-  }
-};
-
-// src/internal/env.ts
-var API_KEY_ENV_VAR = "THEOKIT_API_KEY";
-function resolveApiKey(explicit) {
-  if (explicit !== void 0 && explicit.length > 0) {
-    return explicit;
-  }
-  const fromEnv = process.env[API_KEY_ENV_VAR];
-  if (fromEnv !== void 0 && fromEnv.length > 0) {
-    return fromEnv;
-  }
-  return void 0;
-}
-var PREFIX = {
-  localAgent: "agent-",
-  cloudAgent: "bc-",
-  run: "run-",
-  call: "call-",
-  cron: "cron-",
-  request: "request-"
-};
-function generateLocalAgentId() {
-  return `${PREFIX.localAgent}${randomUUID()}`;
-}
-function generateCloudAgentId() {
-  return `${PREFIX.cloudAgent}${randomUUID()}`;
-}
-function generateRunId() {
-  return `${PREFIX.run}${randomUUID()}`;
-}
-function generateCallId() {
-  return `${PREFIX.call}${randomUUID()}`;
-}
-function generateCronId() {
-  return `${PREFIX.cron}${randomUUID()}`;
-}
-function generateRequestId() {
-  return `${PREFIX.request}${randomUUID()}`;
-}
-function isLocalAgentId(id) {
-  return id.startsWith(PREFIX.localAgent);
-}
-
-// src/define-tool.ts
-var TOOL_SPLIT_RESOLVER = /* @__PURE__ */ Symbol("theokit.toolSplitResolver");
-async function runValidated(spec, input, ctx) {
-  const raw = spec.sanitize ? sanitizeToolInput(input, {
-    ...spec.sanitize === true ? {} : spec.sanitize,
-    schema: spec.inputSchema
-  }).value : input;
-  const parsed = spec.inputSchema.parse(raw);
-  const out = await spec.handler(parsed, ctx);
-  return spec.outputSchema === void 0 ? out : spec.outputSchema.parse(out);
-}
-function serializeOutput(validated) {
-  return typeof validated === "string" ? validated : JSON.stringify(validated);
-}
-function shapeModelOutput(spec, validated) {
-  if (spec.toModelOutput !== void 0) return spec.toModelOutput(validated);
-  return serializeOutput(validated);
-}
-var Tool = class {
-  constructor() {
-  }
-  static create(spec) {
-    return defineTool(spec);
-  }
-};
-function defineTool(spec) {
-  const inputSchema = toJsonSchema(spec.inputSchema, {
-    unrepresentable: "any"
-  });
-  const handler = async (input, ctx) => {
-    const validated = await runValidated(spec, input, ctx);
-    return shapeModelOutput(spec, validated);
-  };
-  const tool = { name: spec.name, description: spec.description, inputSchema, handler };
-  if (spec.toModelOutput !== void 0) {
-    const resolver = async (input, ctx) => {
-      const validated = await runValidated(spec, input, ctx);
-      return { model: shapeModelOutput(spec, validated), app: serializeOutput(validated) };
-    };
-    handler[TOOL_SPLIT_RESOLVER] = resolver;
-  }
-  return tool;
-}
-
-// src/internal/budget/usage-accumulator.ts
-var UsageAccumulator = class {
-  input = 0;
-  output = 0;
-  cacheRead = 0;
-  cacheWrite = 0;
-  reasoning = 0;
-  requests = [];
-  add(step) {
-    const inputTokens = step.inputTokens ?? 0;
-    const outputTokens = step.outputTokens ?? 0;
-    const cacheReadTokens = step.cacheReadTokens ?? 0;
-    const cacheWriteTokens = step.cacheWriteTokens ?? 0;
-    const reasoningTokens = step.reasoningTokens ?? 0;
-    this.input += inputTokens;
-    this.output += outputTokens;
-    this.cacheRead += cacheReadTokens;
-    this.cacheWrite += cacheWriteTokens;
-    this.reasoning += reasoningTokens;
-    this.requests.push({
-      inputTokens,
-      outputTokens,
-      ...cacheReadTokens > 0 ? { cacheReadTokens } : {},
-      ...cacheWriteTokens > 0 ? { cacheWriteTokens } : {},
-      ...reasoningTokens > 0 ? { reasoningTokens } : {},
-      totalTokens: inputTokens + outputTokens
-    });
-  }
-  /** Did we observe any usage at all? */
-  hasAny() {
-    return this.requests.length > 0;
-  }
-  toTokenUsage() {
-    return {
-      inputTokens: this.input,
-      outputTokens: this.output,
-      ...this.cacheRead > 0 ? { cacheReadTokens: this.cacheRead } : {},
-      ...this.cacheWrite > 0 ? { cacheWriteTokens: this.cacheWrite } : {},
-      ...this.reasoning > 0 ? { reasoningTokens: this.reasoning } : {},
-      totalTokens: this.input + this.output,
-      ...this.requests.length > 1 ? { requests: this.requests.slice() } : {}
-    };
-  }
-};
-
-// src/tool-error.ts
-var ToolError = class extends TheokitAgentError {
-  name = "ToolError";
-  /** The error content surfaced to the model: a string, or text/image blocks. */
-  content;
-  constructor(content, options = {}) {
-    super(renderToolErrorMessage(content), { ...options, isRetryable: false });
-    this.content = content;
-  }
-};
-function renderToolErrorMessage(content) {
-  if (typeof content === "string") return content;
-  return content.map((block) => block.type === "text" ? block.text : `[${block.source.media_type} image]`).join("\n");
-}
-
-// src/internal/budget/pricing-data.json
-var pricing_data_default = {
-  _meta: {
-    pricingVersion: "litellm-2026-05-snapshot"},
-  models: {
-    "anthropic/claude-opus-4-7": {
-      input: 5,
-      output: 25,
-      cacheRead: 0.5,
-      cacheWrite: 6.25
-    },
-    "anthropic/claude-opus-4-6": {
-      input: 5,
-      output: 25,
-      cacheRead: 0.5,
-      cacheWrite: 6.25
-    },
-    "anthropic/claude-opus-4-5": {
-      input: 5,
-      output: 25,
-      cacheRead: 0.5,
-      cacheWrite: 6.25
-    },
-    "anthropic/claude-sonnet-4-6": {
-      input: 3,
-      output: 15,
-      cacheRead: 0.3,
-      cacheWrite: 3.75
-    },
-    "anthropic/claude-sonnet-4-5": {
-      input: 3,
-      output: 15,
-      cacheRead: 0.3,
-      cacheWrite: 3.75
-    },
-    "anthropic/claude-haiku-4-5": {
-      input: 1,
-      output: 5,
-      cacheRead: 0.1,
-      cacheWrite: 1.25
-    },
-    "anthropic/claude-3-5-sonnet": {
-      input: 3,
-      output: 15,
-      cacheRead: 0.3,
-      cacheWrite: 3.75
-    },
-    "anthropic/claude-3-5-haiku": {
-      input: 0.8,
-      output: 4,
-      cacheRead: 0.08,
-      cacheWrite: 1
-    },
-    "anthropic/claude-3-opus": {
-      input: 15,
-      output: 75,
-      cacheRead: 1.5,
-      cacheWrite: 18.75
-    },
-    "anthropic/claude-3-haiku": {
-      input: 0.25,
-      output: 1.25,
-      cacheRead: 0.03,
-      cacheWrite: 0.3
-    },
-    "openai/gpt-4o": {
-      input: 2.5,
-      output: 10,
-      cacheRead: 1.25
-    },
-    "openai/gpt-4o-mini": {
-      input: 0.15,
-      output: 0.6,
-      cacheRead: 0.075
-    },
-    "openai/gpt-4.1": {
-      input: 2,
-      output: 8,
-      cacheRead: 0.5
-    },
-    "openai/gpt-4.1-mini": {
-      input: 0.4,
-      output: 1.6,
-      cacheRead: 0.1
-    },
-    "openai/gpt-4.1-nano": {
-      input: 0.1,
-      output: 0.4,
-      cacheRead: 0.025
-    },
-    "openai/o3": {
-      input: 2,
-      output: 8,
-      cacheRead: 0.5
-    },
-    "openai/o3-mini": {
-      input: 1.1,
-      output: 4.4,
-      cacheRead: 0.55
-    },
-    "openai/o4-mini": {
-      input: 1.1,
-      output: 4.4,
-      cacheRead: 0.275
-    },
-    "deepseek/deepseek-chat": {
-      input: 0.14,
-      output: 0.28
-    },
-    "deepseek/deepseek-reasoner": {
-      input: 0.55,
-      output: 2.19
-    },
-    "google/gemini-2.5-pro": {
-      input: 1.25,
-      output: 10
-    },
-    "google/gemini-2.5-flash": {
-      input: 0.15,
-      output: 0.6
-    },
-    "google/gemini-2.0-flash": {
-      input: 0.1,
-      output: 0.4
-    }
-  }
-};
-
-// src/internal/budget/pricing-registry.ts
-var data = pricing_data_default;
-function buildEntry(key, raw) {
-  const [provider, ...modelParts] = key.split("/");
-  return {
-    provider: provider ?? "unknown",
-    model: modelParts.join("/"),
-    inputCostPerMillion: raw.input,
-    outputCostPerMillion: raw.output,
-    ...raw.cacheRead !== void 0 ? { cacheReadCostPerMillion: raw.cacheRead } : {},
-    ...raw.cacheWrite !== void 0 ? { cacheWriteCostPerMillion: raw.cacheWrite } : {},
-    ...raw.reasoning !== void 0 ? { reasoningCostPerMillion: raw.reasoning } : {},
-    pricingVersion: data._meta.pricingVersion
-  };
-}
-function stripDateSuffix(model) {
-  return model.replace(/-\d{4}-?\d{2}-?\d{2}$/, "");
-}
-function normalizeAnthropicDots(model) {
-  return model.replace(/(\d+)\.(\d+)/g, "$1-$2");
-}
-function stripOpenRouterPrefix(modelId) {
-  return modelId.startsWith("openrouter/") ? modelId.slice("openrouter/".length) : modelId;
-}
-function lookupRaw(key) {
-  return data.models[key];
-}
-function getPricingEntry(opts) {
-  const cleaned = stripOpenRouterPrefix(opts.model);
-  const directKey = `${opts.provider}/${cleaned}`;
-  const direct = lookupRaw(directKey);
-  if (direct !== void 0) return buildEntry(directKey, direct);
-  const noSuffix = stripDateSuffix(cleaned);
-  if (noSuffix !== cleaned) {
-    const noSuffixKey = `${opts.provider}/${noSuffix}`;
-    const found = lookupRaw(noSuffixKey);
-    if (found !== void 0) return buildEntry(noSuffixKey, found);
-  }
-  if (opts.provider === "anthropic") {
-    const normalized = normalizeAnthropicDots(stripDateSuffix(cleaned));
-    const normKey = `${opts.provider}/${normalized}`;
-    const found = lookupRaw(normKey);
-    if (found !== void 0) return buildEntry(normKey, found);
-  }
-  if (cleaned.includes("/")) {
-    const found = lookupRaw(cleaned);
-    if (found !== void 0) return buildEntry(cleaned, found);
-    const stripped = stripDateSuffix(cleaned);
-    if (stripped !== cleaned) {
-      const found2 = lookupRaw(stripped);
-      if (found2 !== void 0) return buildEntry(stripped, found2);
-    }
-  }
-  const catalogEntry = catalogCostFallback(opts.provider, cleaned);
-  if (catalogEntry !== void 0) return catalogEntry;
-  return void 0;
-}
-function catalogCostFallback(provider, cleanedModel) {
-  const stripped = stripDateSuffix(cleanedModel);
-  const candidates = [`${provider}/${cleanedModel}`, cleanedModel];
-  if (stripped !== cleanedModel) candidates.push(`${provider}/${stripped}`, stripped);
-  for (const key of candidates) {
-    const info = getCatalogModelInfo(key);
-    const cost = info?.cost;
-    if (cost === void 0) continue;
-    const [prov, ...modelParts] = key.split("/");
-    return {
-      provider: prov ?? provider,
-      model: modelParts.join("/") || cleanedModel,
-      inputCostPerMillion: cost.input,
-      outputCostPerMillion: cost.output,
-      ...cost.cache_read !== void 0 ? { cacheReadCostPerMillion: cost.cache_read } : {},
-      ...cost.cache_write !== void 0 ? { cacheWriteCostPerMillion: cost.cache_write } : {},
-      // M44 M5 fix — honest provenance: a key patched by the LIVE models-dev source is not "vendored".
-      pricingVersion: isPatchedModelKey(key) ? "catalog-models-dev" : "catalog-vendored"
-    };
-  }
-  return void 0;
-}
-
-// src/internal/budget/compute-cost.ts
-var MICROCENT = 1e6;
-function isSubscriptionIncluded(provider) {
-  return provider === "openai-codex" || provider === "codex";
-}
-function pricingHasValidRates(entry) {
-  return entry.inputCostPerMillion >= 0 && entry.outputCostPerMillion >= 0 && (entry.cacheReadCostPerMillion === void 0 || entry.cacheReadCostPerMillion >= 0) && (entry.cacheWriteCostPerMillion === void 0 || entry.cacheWriteCostPerMillion >= 0) && (entry.reasoningCostPerMillion === void 0 || entry.reasoningCostPerMillion >= 0);
-}
-function costForTokens(tokens, perMillion) {
-  if (tokens === 0 || perMillion === 0) return 0;
-  return Math.round(tokens * perMillion * MICROCENT / 1e6) / MICROCENT;
-}
-function computeCost(args) {
-  if (isSubscriptionIncluded(args.provider)) {
-    return {
-      amountUsd: 0,
-      status: "included",
-      currency: "USD",
-      source: "subscription_included",
-      pricingVersion: void 0
-    };
-  }
-  const entry = getPricingEntry({
-    provider: args.provider,
-    model: args.model,
-    ...args.baseUrl !== void 0 ? { baseUrl: args.baseUrl } : {}
-  });
-  if (entry === void 0) {
-    return {
-      amountUsd: void 0,
-      status: "unknown",
-      currency: "USD",
-      source: "unknown",
-      pricingVersion: void 0
-    };
-  }
-  if (!pricingHasValidRates(entry)) {
-    return {
-      amountUsd: void 0,
-      status: "unknown",
-      currency: "USD",
-      source: "unknown",
-      pricingVersion: entry.pricingVersion,
-      notes: ["pricing entry has negative rates; treated as invalid"]
-    };
+  agentId(id) {
+    this.opts.agentId = id;
+    return this;
   }
-  const notes = [];
-  const detail = {};
-  const u = args.usage;
-  const inputCost = costForTokens(u.inputTokens, entry.inputCostPerMillion);
-  const outputCost = costForTokens(u.outputTokens, entry.outputCostPerMillion);
-  detail.input = inputCost;
-  detail.output = outputCost;
-  let total = inputCost + outputCost;
-  if (u.cacheReadTokens !== void 0 && u.cacheReadTokens > 0) {
-    if (entry.cacheReadCostPerMillion === void 0) {
-      return {
-        amountUsd: void 0,
-        status: "unknown",
-        currency: "USD",
-        source: "litellm_snapshot",
-        pricingVersion: entry.pricingVersion,
-        notes: ["cache-read tokens present but cacheReadCostPerMillion is undefined"]
-      };
-    }
-    const c = costForTokens(u.cacheReadTokens, entry.cacheReadCostPerMillion);
-    detail.cacheRead = c;
-    total += c;
+  /**
+   * Synchronous snapshot of the accumulated options. Returns a SHALLOW CLONE
+   * so external mutation of the result doesn't pollute the builder state (EC-2).
+   */
+  build() {
+    return { ...this.opts };
   }
-  if (u.cacheWriteTokens !== void 0 && u.cacheWriteTokens > 0) {
-    if (entry.cacheWriteCostPerMillion === void 0) {
-      return {
-        amountUsd: void 0,
-        status: "unknown",
-        currency: "USD",
-        source: "litellm_snapshot",
-        pricingVersion: entry.pricingVersion,
-        notes: ["cache-write tokens present but cacheWriteCostPerMillion is undefined"]
-      };
+  /**
+   * Validate + create a fresh agent. Delegates to `Agent.create` via the
+   * injected `deps.create`. Throws if the builder was instantiated without
+   * deps (i.e., direct `new AgentBuilder()` instead of `Agent.builder()`).
+   */
+  create() {
+    if (this.deps === void 0) {
+      return Promise.reject(
+        new Error(
+          "AgentBuilder.create() requires Agent.builder() entry \u2014 direct construction has no terminals."
+        )
+      );
     }
-    const c = costForTokens(u.cacheWriteTokens, entry.cacheWriteCostPerMillion);
-    detail.cacheWrite = c;
-    total += c;
+    return this.deps.create(this.build());
   }
-  if (u.reasoningTokens !== void 0 && u.reasoningTokens > 0) {
-    const rate = entry.reasoningCostPerMillion ?? entry.outputCostPerMillion;
-    const c = costForTokens(u.reasoningTokens, rate);
-    detail.reasoning = c;
-    total += c;
-    if (entry.reasoningCostPerMillion === void 0) {
-      notes.push("reasoning tokens billed at output rate (no dedicated reasoning rate available)");
+  /**
+   * Resume an existing agent or create one if the ID is unknown. Delegates to
+   * `Agent.getOrCreate` via the injected `deps.getOrCreate` (ADR D22).
+   */
+  getOrCreate(agentId) {
+    if (this.deps === void 0) {
+      return Promise.reject(
+        new Error(
+          "AgentBuilder.getOrCreate() requires Agent.builder() entry \u2014 direct construction has no terminals."
+        )
+      );
     }
+    return this.deps.getOrCreate(agentId, this.build());
   }
-  const amountUsd = Math.round(total * MICROCENT) / MICROCENT;
-  return {
-    amountUsd,
-    status: "estimated",
-    currency: "USD",
-    source: "litellm_snapshot",
-    pricingVersion: entry.pricingVersion,
-    ...notes.length > 0 ? { notes } : {},
-    detail
-  };
-}
+};
 
 // src/internal/auth/api-key-validator.ts
 var FIXTURE_KEY_PREFIX = "theo_test_";
@@ -732,6 +275,48 @@ function structurableAnswerOrThrow(result, GenerateObjectError) {
   }
   return answer;
 }
+
+// src/internal/env.ts
+var API_KEY_ENV_VAR = "THEOKIT_API_KEY";
+function resolveApiKey(explicit) {
+  if (explicit !== void 0 && explicit.length > 0) {
+    return explicit;
+  }
+  const fromEnv = process.env[API_KEY_ENV_VAR];
+  if (fromEnv !== void 0 && fromEnv.length > 0) {
+    return fromEnv;
+  }
+  return void 0;
+}
+var PREFIX = {
+  localAgent: "agent-",
+  cloudAgent: "bc-",
+  run: "run-",
+  call: "call-",
+  cron: "cron-",
+  request: "request-"
+};
+function generateLocalAgentId() {
+  return `${PREFIX.localAgent}${randomUUID()}`;
+}
+function generateCloudAgentId() {
+  return `${PREFIX.cloudAgent}${randomUUID()}`;
+}
+function generateRunId() {
+  return `${PREFIX.run}${randomUUID()}`;
+}
+function generateCallId() {
+  return `${PREFIX.call}${randomUUID()}`;
+}
+function generateCronId() {
+  return `${PREFIX.cron}${randomUUID()}`;
+}
+function generateRequestId() {
+  return `${PREFIX.request}${randomUUID()}`;
+}
+function isLocalAgentId(id) {
+  return id.startsWith(PREFIX.localAgent);
+}
 var FIXTURE_API_KEY_PREFIX = "theo_test_";
 function isFixtureApiKey(apiKey) {
   if (apiKey === void 0) return false;
@@ -3382,126 +2967,52 @@ var LiveAgentRegistry = class {
   }
 };
 var liveAgentRegistry = new LiveAgentRegistry();
-async function loadSubagents(cwd, settingSourcesIncludeProject, inline) {
-  const result = {};
-  if (settingSourcesIncludeProject) {
-    const projectAgents = await readProjectSubagents(cwd);
-    for (const [name, definition] of Object.entries(projectAgents)) {
-      result[name] = definition;
-    }
-  }
-  if (inline !== void 0) {
-    for (const [name, definition] of Object.entries(inline)) {
-      result[name] = definition;
-    }
-  }
-  return result;
-}
-async function readProjectSubagents(cwd) {
-  const root = join(cwd, ".theokit", "agents");
-  const entries = await readWorkspaceDir(root, "subagents_read_error", "subagents directory");
-  const subagents = {};
-  for (const entry of entries) {
-    if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
-    const path = join(root, entry.name);
-    const raw = await readFile(path, "utf8");
-    const definition = parseSubagentMarkdown(raw, entry.name);
-    subagents[definition.name] = definition.definition;
-  }
-  return subagents;
-}
-var ACCEPTED_FIELDS = /* @__PURE__ */ new Set([
-  "name",
-  "description",
-  "model",
-  "tools",
-  "reasoning_effort",
-  "mcp",
-  "sandbox"
-]);
-function parseSubagentMarkdown(raw, filename) {
-  const { frontmatter, body } = splitFrontmatter(raw, filename);
-  const fields = parseFrontmatterFields(frontmatter);
-  rejectUnknownFields(fields, filename);
-  rejectMcp(fields, filename);
-  const definition = {
-    description: asString(fields.description) ?? "",
-    prompt: body
-  };
-  const model = resolveModel(fields, filename);
-  if (model !== void 0) definition.model = model;
-  const tools = toStringList(fields.tools);
-  if (tools.length > 0) definition.tools = tools;
-  const sandbox = resolveSandbox(fields, filename);
-  if (sandbox !== void 0) definition.sandbox = sandbox;
-  const name = asString(fields.name) ?? filename.replace(/\.md$/, "");
-  return { name, definition };
-}
-function rejectUnknownFields(fields, filename) {
-  for (const key of Object.keys(fields)) {
-    if (!ACCEPTED_FIELDS.has(key)) {
-      throw new ConfigurationError(
-        `Subagent ${filename}: unknown frontmatter field "${key}" (accepted: ${[...ACCEPTED_FIELDS].join(", ")})`,
-        { code: "subagent_unknown_field" }
-      );
-    }
-  }
+
+// src/define-tool.ts
+var TOOL_SPLIT_RESOLVER = /* @__PURE__ */ Symbol("theokit.toolSplitResolver");
+async function runValidated(spec, input, ctx) {
+  const raw = spec.sanitize ? sanitizeToolInput(input, {
+    ...spec.sanitize === true ? {} : spec.sanitize,
+    schema: spec.inputSchema
+  }).value : input;
+  const parsed = spec.inputSchema.parse(raw);
+  const out = await spec.handler(parsed, ctx);
+  return spec.outputSchema === void 0 ? out : spec.outputSchema.parse(out);
 }
-function rejectMcp(fields, filename) {
-  if (fields.mcp !== void 0) {
-    throw new ConfigurationError(
-      `Subagent ${filename}: per-subagent "mcp" is not yet supported on the local delegation path; declare MCP servers in .theokit/mcp.json (or the parent) instead`,
-      { code: "subagent_mcp_unsupported_local" }
-    );
-  }
+function serializeOutput(validated) {
+  return typeof validated === "string" ? validated : JSON.stringify(validated);
 }
-function resolveModel(fields, filename) {
-  const modelId = asString(fields.model);
-  const effort = asString(fields.reasoning_effort);
-  if (effort !== void 0 && (modelId === void 0 || modelId === "inherit")) {
-    throw new ConfigurationError(
-      `Subagent ${filename}: reasoning_effort requires a concrete model (effort is a model parameter; an absent model or "inherit" cannot carry it)`,
-      { code: "subagent_reasoning_effort_without_model" }
-    );
-  }
-  if (modelId === void 0) return void 0;
-  if (modelId === "inherit") return "inherit";
-  return effort !== void 0 ? { id: modelId, params: [{ id: "thinking", value: effort }] } : { id: modelId };
+function shapeModelOutput(spec, validated) {
+  if (spec.toModelOutput !== void 0) return spec.toModelOutput(validated);
+  return serializeOutput(validated);
 }
-function resolveSandbox(fields, filename) {
-  if (fields.sandbox === void 0) return void 0;
-  if (typeof fields.sandbox !== "boolean") {
-    throw new ConfigurationError(
-      `Subagent ${filename}: sandbox must be a boolean (got "${String(fields.sandbox)}"); granular sandbox modes are not supported by the runtime`,
-      { code: "subagent_sandbox_not_boolean" }
-    );
+var Tool = class {
+  constructor() {
   }
-  return fields.sandbox;
-}
-function asString(v) {
-  if (typeof v !== "string") return void 0;
-  const m = /^(["'])(.*)\1$/.exec(v);
-  return m ? m[2] : v;
-}
-function toStringList(v) {
-  if (Array.isArray(v)) return v.map((t) => t.trim()).filter((t) => t.length > 0);
-  if (typeof v === "string") {
-    return v.split(/[\s,]+/).map((t) => t.trim()).filter((t) => t.length > 0);
+  static create(spec) {
+    return defineTool(spec);
   }
-  return [];
-}
-function splitFrontmatter(raw, filename) {
-  const match = /^---\s*\n([\s\S]*?)\n---\s*\n([\s\S]*)$/.exec(raw);
-  if (match === null) {
-    throw new ConfigurationError(`Subagent ${filename} is missing frontmatter`, {
-      code: "subagent_missing_frontmatter"
-    });
+};
+function defineTool(spec) {
+  const inputSchema = toJsonSchema(spec.inputSchema, {
+    unrepresentable: "any"
+  });
+  const handler = async (input, ctx) => {
+    const validated = await runValidated(spec, input, ctx);
+    return shapeModelOutput(spec, validated);
+  };
+  const tool = { name: spec.name, description: spec.description, inputSchema, handler };
+  if (spec.toModelOutput !== void 0) {
+    const resolver = async (input, ctx) => {
+      const validated = await runValidated(spec, input, ctx);
+      return { model: shapeModelOutput(spec, validated), app: serializeOutput(validated) };
+    };
+    handler[TOOL_SPLIT_RESOLVER] = resolver;
   }
-  return { frontmatter: match[1] ?? "", body: (match[2] ?? "").trim() };
-}
-function parseFrontmatterFields(frontmatter) {
-  return parseSimpleYaml(frontmatter);
+  return tool;
 }
+
+// src/internal/runtime/reasoning/native-reasoning.ts
 var NATIVE_REASONING_PARAM_IDS = /* @__PURE__ */ new Set(["thinking", "reasoning", "reasoning_effort"]);
 var REASONING_PREAMBLE = "Think step by step before answering: use the `think` tool to reason through each step, validate your work, then answer. Reason about magnitude before comparing numbers.";
 function createThinkTool() {
@@ -4498,7 +4009,7 @@ async function loadMarkdownEntities(opts) {
     await assertFileSizeUnderCap(resolved.source, errorCodePrefix);
     const raw = await readFile(resolved.source, "utf8").catch(() => null);
     if (raw === null) continue;
-    const split = splitFrontmatter2(raw, resolved.source, errorCodePrefix);
+    const split = splitFrontmatter(raw, resolved.source, errorCodePrefix);
     const fields = parseSimpleYaml(split.frontmatter);
     const parsed = schema.safeParse(fields);
     if (!parsed.success) {
@@ -4549,7 +4060,7 @@ function resolveEntryPath(entry, pattern, dir) {
   if (!entry.isDirectory()) return null;
   return { slug: entry.name, source: join(dir, entry.name, "PLUGIN.md") };
 }
-function splitFrontmatter2(raw, source, errorCodePrefix) {
+function splitFrontmatter(raw, source, errorCodePrefix) {
   const match = /^---\s*\n([\s\S]*?)\n---\s*(?:\n|$)/.exec(raw);
   if (match === null) {
     throw new ConfigurationError(
@@ -4717,7 +4228,7 @@ function anyGlobMatches(patterns, paths) {
 
 // src/internal/runtime/context/context-yaml-lite.ts
 var FRONTMATTER_RE = /^---\s*\n([\s\S]*?)\n---\s*\n([\s\S]*)$/;
-function splitFrontmatter3(content) {
+function splitFrontmatter2(content) {
   const m = FRONTMATTER_RE.exec(content);
   if (m === null) return { yaml: void 0, body: content };
   return { yaml: m[1] ?? "", body: m[2] ?? "" };
@@ -4775,7 +4286,7 @@ var McdFrontmatterSchema = z.object({
   alwaysApply: z.boolean().optional()
 });
 function parseMdc(content) {
-  const { yaml, body } = splitFrontmatter3(content);
+  const { yaml, body } = splitFrontmatter2(content);
   if (yaml === void 0) {
     return { frontmatter: { alwaysApply: true }, body: content };
   }
@@ -4801,7 +4312,7 @@ var RulesFrontmatterSchema = z.object({
   enabled: z.boolean().optional()
 });
 function parseRules(content) {
-  const { yaml, body } = splitFrontmatter3(content);
+  const { yaml, body } = splitFrontmatter2(content);
   if (yaml === void 0) {
     return { frontmatter: { alwaysApply: true }, body: content };
   }
@@ -5629,15 +5140,60 @@ var DoomLoopTracker = class {
     this.#count = 0;
   }
 };
-function firstDoomLoopVerdict(tracker, calls) {
-  let escalation = { kind: "ok" };
-  for (const call of calls) {
-    const v = tracker.inspect(call);
-    if (v.kind === "hard") return v;
-    if (v.kind === "soft" && escalation.kind === "ok") escalation = v;
-  }
-  return escalation;
-}
+function firstDoomLoopVerdict(tracker, calls) {
+  let escalation = { kind: "ok" };
+  for (const call of calls) {
+    const v = tracker.inspect(call);
+    if (v.kind === "hard") return v;
+    if (v.kind === "soft" && escalation.kind === "ok") escalation = v;
+  }
+  return escalation;
+}
+
+// src/internal/budget/usage-accumulator.ts
+var UsageAccumulator = class {
+  input = 0;
+  output = 0;
+  cacheRead = 0;
+  cacheWrite = 0;
+  reasoning = 0;
+  requests = [];
+  add(step) {
+    const inputTokens = step.inputTokens ?? 0;
+    const outputTokens = step.outputTokens ?? 0;
+    const cacheReadTokens = step.cacheReadTokens ?? 0;
+    const cacheWriteTokens = step.cacheWriteTokens ?? 0;
+    const reasoningTokens = step.reasoningTokens ?? 0;
+    this.input += inputTokens;
+    this.output += outputTokens;
+    this.cacheRead += cacheReadTokens;
+    this.cacheWrite += cacheWriteTokens;
+    this.reasoning += reasoningTokens;
+    this.requests.push({
+      inputTokens,
+      outputTokens,
+      ...cacheReadTokens > 0 ? { cacheReadTokens } : {},
+      ...cacheWriteTokens > 0 ? { cacheWriteTokens } : {},
+      ...reasoningTokens > 0 ? { reasoningTokens } : {},
+      totalTokens: inputTokens + outputTokens
+    });
+  }
+  /** Did we observe any usage at all? */
+  hasAny() {
+    return this.requests.length > 0;
+  }
+  toTokenUsage() {
+    return {
+      inputTokens: this.input,
+      outputTokens: this.output,
+      ...this.cacheRead > 0 ? { cacheReadTokens: this.cacheRead } : {},
+      ...this.cacheWrite > 0 ? { cacheWriteTokens: this.cacheWrite } : {},
+      ...this.reasoning > 0 ? { reasoningTokens: this.reasoning } : {},
+      totalTokens: this.input + this.output,
+      ...this.requests.length > 1 ? { requests: this.requests.slice() } : {}
+    };
+  }
+};
 
 // src/internal/agent-loop/message-builders.ts
 function buildSystemEvent(inputs, toolNames) {
@@ -6118,6 +5674,21 @@ function coerceArgsToSchema(args, schema) {
   return { value: out, changed };
 }
 
+// src/tool-error.ts
+var ToolError = class extends TheokitAgentError {
+  name = "ToolError";
+  /** The error content surfaced to the model: a string, or text/image blocks. */
+  content;
+  constructor(content, options = {}) {
+    super(renderToolErrorMessage(content), { ...options, isRetryable: false });
+    this.content = content;
+  }
+};
+function renderToolErrorMessage(content) {
+  if (typeof content === "string") return content;
+  return content.map((block) => block.type === "text" ? block.text : `[${block.source.media_type} image]`).join("\n");
+}
+
 // src/internal/runtime/tools/shell-tool.ts
 async function runShell(options) {
   if (options.sandbox === true && isObviouslyUnsafe(options.command)) {
@@ -6538,101 +6109,414 @@ function finalizeSpanAndPostHook(inputs, call, callId, result, events, toolSpan)
     );
   });
   return {
-    type: "tool_result",
-    toolUseId: call.id,
-    // SE7 — structured content blocks (handler-returned or ToolError-carried)
-    // are authoritative; otherwise the legacy string rendering.
-    content: result.content !== void 0 ? result.content : renderToolResult(result),
-    ...result.exitCode !== 0 && result.exitCode !== void 0 ? { isError: true } : {}
+    type: "tool_result",
+    toolUseId: call.id,
+    // SE7 — structured content blocks (handler-returned or ToolError-carried)
+    // are authoritative; otherwise the legacy string rendering.
+    content: result.content !== void 0 ? result.content : renderToolResult(result),
+    ...result.exitCode !== 0 && result.exitCode !== void 0 ? { isError: true } : {}
+  };
+}
+async function emitToolLifecycleDelta(inputs, update) {
+  if (inputs.onDelta === void 0) return;
+  try {
+    await inputs.onDelta({ update });
+  } catch (err) {
+    process.stderr.write(
+      `[theokit-sdk] onDelta tool-lifecycle emit error (swallowed): ${err instanceof Error ? err.message : String(err)}
+`
+    );
+  }
+}
+async function safeEmitToolHook(callback, event) {
+  if (callback === void 0) return;
+  try {
+    await callback(event);
+  } catch (cause) {
+    const msg = cause instanceof Error ? cause.message : String(cause);
+    process.stderr.write(`[theokit-sdk] tool lifecycle hook threw: ${msg}
+`);
+  }
+}
+function buildToolUseRunning(inputs, callId, call) {
+  return {
+    type: "tool_call",
+    agent_id: inputs.agentId,
+    run_id: inputs.runId,
+    call_id: callId,
+    name: call.name,
+    status: "running",
+    args: call.input
+  };
+}
+function buildRepairRegistry(tools) {
+  const out = /* @__PURE__ */ new Map();
+  for (const t of tools) {
+    out.set(t.name, { name: t.name, inputSchema: t.inputSchema });
+  }
+  return out;
+}
+function buildToolUseCompleted(inputs, callId, call, result) {
+  return {
+    type: "tool_call",
+    agent_id: inputs.agentId,
+    run_id: inputs.runId,
+    call_id: callId,
+    name: call.name,
+    status: "completed",
+    args: call.input,
+    result: {
+      stdout: result.stdout,
+      stderr: result.stderr,
+      exitCode: result.exitCode ?? 0
+    }
+  };
+}
+
+// src/internal/agent-loop/tool-result-guard.ts
+var OPEN = "<untrusted-tool-output>";
+var CLOSE = "</untrusted-tool-output>";
+var PII_PATTERNS = [
+  /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g,
+  // email
+  /\b(?:\+?\d{1,3}[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/g
+  // phone
+];
+function guardText(content, opts) {
+  let out = content;
+  if (opts.redactPii === true) {
+    for (const re of PII_PATTERNS) out = out.replace(re, "[REDACTED]");
+  }
+  if (opts.delimit === true) {
+    const safe2 = out.split(CLOSE).join("</ untrusted-tool-output>");
+    out = `${OPEN}
+${safe2}
+${CLOSE}`;
+  }
+  return out;
+}
+function applyToolResultGuard(parts, opts) {
+  if (opts.delimit !== true && opts.redactPii !== true) return parts;
+  return parts.map(
+    (p) => (
+      // SE7 — guard the TEXT of a tool result (string or the text blocks of a
+      // structured content); image blocks pass through untouched.
+      p.type === "tool_result" ? { ...p, content: renderToolResultContentText(p.content, (t) => guardText(t, opts)) } : p
+    )
+  );
+}
+
+// src/internal/budget/pricing-data.json
+var pricing_data_default = {
+  _meta: {
+    pricingVersion: "litellm-2026-05-snapshot"},
+  models: {
+    "anthropic/claude-opus-4-7": {
+      input: 5,
+      output: 25,
+      cacheRead: 0.5,
+      cacheWrite: 6.25
+    },
+    "anthropic/claude-opus-4-6": {
+      input: 5,
+      output: 25,
+      cacheRead: 0.5,
+      cacheWrite: 6.25
+    },
+    "anthropic/claude-opus-4-5": {
+      input: 5,
+      output: 25,
+      cacheRead: 0.5,
+      cacheWrite: 6.25
+    },
+    "anthropic/claude-sonnet-4-6": {
+      input: 3,
+      output: 15,
+      cacheRead: 0.3,
+      cacheWrite: 3.75
+    },
+    "anthropic/claude-sonnet-4-5": {
+      input: 3,
+      output: 15,
+      cacheRead: 0.3,
+      cacheWrite: 3.75
+    },
+    "anthropic/claude-haiku-4-5": {
+      input: 1,
+      output: 5,
+      cacheRead: 0.1,
+      cacheWrite: 1.25
+    },
+    "anthropic/claude-3-5-sonnet": {
+      input: 3,
+      output: 15,
+      cacheRead: 0.3,
+      cacheWrite: 3.75
+    },
+    "anthropic/claude-3-5-haiku": {
+      input: 0.8,
+      output: 4,
+      cacheRead: 0.08,
+      cacheWrite: 1
+    },
+    "anthropic/claude-3-opus": {
+      input: 15,
+      output: 75,
+      cacheRead: 1.5,
+      cacheWrite: 18.75
+    },
+    "anthropic/claude-3-haiku": {
+      input: 0.25,
+      output: 1.25,
+      cacheRead: 0.03,
+      cacheWrite: 0.3
+    },
+    "openai/gpt-4o": {
+      input: 2.5,
+      output: 10,
+      cacheRead: 1.25
+    },
+    "openai/gpt-4o-mini": {
+      input: 0.15,
+      output: 0.6,
+      cacheRead: 0.075
+    },
+    "openai/gpt-4.1": {
+      input: 2,
+      output: 8,
+      cacheRead: 0.5
+    },
+    "openai/gpt-4.1-mini": {
+      input: 0.4,
+      output: 1.6,
+      cacheRead: 0.1
+    },
+    "openai/gpt-4.1-nano": {
+      input: 0.1,
+      output: 0.4,
+      cacheRead: 0.025
+    },
+    "openai/o3": {
+      input: 2,
+      output: 8,
+      cacheRead: 0.5
+    },
+    "openai/o3-mini": {
+      input: 1.1,
+      output: 4.4,
+      cacheRead: 0.55
+    },
+    "openai/o4-mini": {
+      input: 1.1,
+      output: 4.4,
+      cacheRead: 0.275
+    },
+    "deepseek/deepseek-chat": {
+      input: 0.14,
+      output: 0.28
+    },
+    "deepseek/deepseek-reasoner": {
+      input: 0.55,
+      output: 2.19
+    },
+    "google/gemini-2.5-pro": {
+      input: 1.25,
+      output: 10
+    },
+    "google/gemini-2.5-flash": {
+      input: 0.15,
+      output: 0.6
+    },
+    "google/gemini-2.0-flash": {
+      input: 0.1,
+      output: 0.4
+    }
+  }
+};
+
+// src/internal/budget/pricing-registry.ts
+var data = pricing_data_default;
+function buildEntry(key, raw) {
+  const [provider, ...modelParts] = key.split("/");
+  return {
+    provider: provider ?? "unknown",
+    model: modelParts.join("/"),
+    inputCostPerMillion: raw.input,
+    outputCostPerMillion: raw.output,
+    ...raw.cacheRead !== void 0 ? { cacheReadCostPerMillion: raw.cacheRead } : {},
+    ...raw.cacheWrite !== void 0 ? { cacheWriteCostPerMillion: raw.cacheWrite } : {},
+    ...raw.reasoning !== void 0 ? { reasoningCostPerMillion: raw.reasoning } : {},
+    pricingVersion: data._meta.pricingVersion
   };
 }
-async function emitToolLifecycleDelta(inputs, update) {
-  if (inputs.onDelta === void 0) return;
-  try {
-    await inputs.onDelta({ update });
-  } catch (err) {
-    process.stderr.write(
-      `[theokit-sdk] onDelta tool-lifecycle emit error (swallowed): ${err instanceof Error ? err.message : String(err)}
-`
-    );
-  }
+function stripDateSuffix(model) {
+  return model.replace(/-\d{4}-?\d{2}-?\d{2}$/, "");
 }
-async function safeEmitToolHook(callback, event) {
-  if (callback === void 0) return;
-  try {
-    await callback(event);
-  } catch (cause) {
-    const msg = cause instanceof Error ? cause.message : String(cause);
-    process.stderr.write(`[theokit-sdk] tool lifecycle hook threw: ${msg}
-`);
-  }
+function normalizeAnthropicDots(model) {
+  return model.replace(/(\d+)\.(\d+)/g, "$1-$2");
 }
-function buildToolUseRunning(inputs, callId, call) {
-  return {
-    type: "tool_call",
-    agent_id: inputs.agentId,
-    run_id: inputs.runId,
-    call_id: callId,
-    name: call.name,
-    status: "running",
-    args: call.input
-  };
+function stripOpenRouterPrefix(modelId) {
+  return modelId.startsWith("openrouter/") ? modelId.slice("openrouter/".length) : modelId;
 }
-function buildRepairRegistry(tools) {
-  const out = /* @__PURE__ */ new Map();
-  for (const t of tools) {
-    out.set(t.name, { name: t.name, inputSchema: t.inputSchema });
-  }
-  return out;
+function lookupRaw(key) {
+  return data.models[key];
 }
-function buildToolUseCompleted(inputs, callId, call, result) {
-  return {
-    type: "tool_call",
-    agent_id: inputs.agentId,
-    run_id: inputs.runId,
-    call_id: callId,
-    name: call.name,
-    status: "completed",
-    args: call.input,
-    result: {
-      stdout: result.stdout,
-      stderr: result.stderr,
-      exitCode: result.exitCode ?? 0
+function getPricingEntry(opts) {
+  const cleaned = stripOpenRouterPrefix(opts.model);
+  const directKey = `${opts.provider}/${cleaned}`;
+  const direct = lookupRaw(directKey);
+  if (direct !== void 0) return buildEntry(directKey, direct);
+  const noSuffix = stripDateSuffix(cleaned);
+  if (noSuffix !== cleaned) {
+    const noSuffixKey = `${opts.provider}/${noSuffix}`;
+    const found = lookupRaw(noSuffixKey);
+    if (found !== void 0) return buildEntry(noSuffixKey, found);
+  }
+  if (opts.provider === "anthropic") {
+    const normalized = normalizeAnthropicDots(stripDateSuffix(cleaned));
+    const normKey = `${opts.provider}/${normalized}`;
+    const found = lookupRaw(normKey);
+    if (found !== void 0) return buildEntry(normKey, found);
+  }
+  if (cleaned.includes("/")) {
+    const found = lookupRaw(cleaned);
+    if (found !== void 0) return buildEntry(cleaned, found);
+    const stripped = stripDateSuffix(cleaned);
+    if (stripped !== cleaned) {
+      const found2 = lookupRaw(stripped);
+      if (found2 !== void 0) return buildEntry(stripped, found2);
     }
-  };
+  }
+  const catalogEntry = catalogCostFallback(opts.provider, cleaned);
+  if (catalogEntry !== void 0) return catalogEntry;
+  return void 0;
+}
+function catalogCostFallback(provider, cleanedModel) {
+  const stripped = stripDateSuffix(cleanedModel);
+  const candidates = [`${provider}/${cleanedModel}`, cleanedModel];
+  if (stripped !== cleanedModel) candidates.push(`${provider}/${stripped}`, stripped);
+  for (const key of candidates) {
+    const info = getCatalogModelInfo(key);
+    const cost = info?.cost;
+    if (cost === void 0) continue;
+    const [prov, ...modelParts] = key.split("/");
+    return {
+      provider: prov ?? provider,
+      model: modelParts.join("/") || cleanedModel,
+      inputCostPerMillion: cost.input,
+      outputCostPerMillion: cost.output,
+      ...cost.cache_read !== void 0 ? { cacheReadCostPerMillion: cost.cache_read } : {},
+      ...cost.cache_write !== void 0 ? { cacheWriteCostPerMillion: cost.cache_write } : {},
+      // M44 M5 fix — honest provenance: a key patched by the LIVE models-dev source is not "vendored".
+      pricingVersion: isPatchedModelKey(key) ? "catalog-models-dev" : "catalog-vendored"
+    };
+  }
+  return void 0;
 }
 
-// src/internal/agent-loop/tool-result-guard.ts
-var OPEN = "<untrusted-tool-output>";
-var CLOSE = "</untrusted-tool-output>";
-var PII_PATTERNS = [
-  /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g,
-  // email
-  /\b(?:\+?\d{1,3}[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/g
-  // phone
-];
-function guardText(content, opts) {
-  let out = content;
-  if (opts.redactPii === true) {
-    for (const re of PII_PATTERNS) out = out.replace(re, "[REDACTED]");
+// src/internal/budget/compute-cost.ts
+var MICROCENT = 1e6;
+function isSubscriptionIncluded(provider) {
+  return provider === "openai-codex" || provider === "codex";
+}
+function pricingHasValidRates(entry) {
+  return entry.inputCostPerMillion >= 0 && entry.outputCostPerMillion >= 0 && (entry.cacheReadCostPerMillion === void 0 || entry.cacheReadCostPerMillion >= 0) && (entry.cacheWriteCostPerMillion === void 0 || entry.cacheWriteCostPerMillion >= 0) && (entry.reasoningCostPerMillion === void 0 || entry.reasoningCostPerMillion >= 0);
+}
+function costForTokens(tokens, perMillion) {
+  if (tokens === 0 || perMillion === 0) return 0;
+  return Math.round(tokens * perMillion * MICROCENT / 1e6) / MICROCENT;
+}
+function computeCost(args) {
+  if (isSubscriptionIncluded(args.provider)) {
+    return {
+      amountUsd: 0,
+      status: "included",
+      currency: "USD",
+      source: "subscription_included",
+      pricingVersion: void 0
+    };
   }
-  if (opts.delimit === true) {
-    const safe2 = out.split(CLOSE).join("</ untrusted-tool-output>");
-    out = `${OPEN}
-${safe2}
-${CLOSE}`;
+  const entry = getPricingEntry({
+    provider: args.provider,
+    model: args.model,
+    ...args.baseUrl !== void 0 ? { baseUrl: args.baseUrl } : {}
+  });
+  if (entry === void 0) {
+    return {
+      amountUsd: void 0,
+      status: "unknown",
+      currency: "USD",
+      source: "unknown",
+      pricingVersion: void 0
+    };
   }
-  return out;
-}
-function applyToolResultGuard(parts, opts) {
-  if (opts.delimit !== true && opts.redactPii !== true) return parts;
-  return parts.map(
-    (p) => (
-      // SE7 — guard the TEXT of a tool result (string or the text blocks of a
-      // structured content); image blocks pass through untouched.
-      p.type === "tool_result" ? { ...p, content: renderToolResultContentText(p.content, (t) => guardText(t, opts)) } : p
-    )
-  );
+  if (!pricingHasValidRates(entry)) {
+    return {
+      amountUsd: void 0,
+      status: "unknown",
+      currency: "USD",
+      source: "unknown",
+      pricingVersion: entry.pricingVersion,
+      notes: ["pricing entry has negative rates; treated as invalid"]
+    };
+  }
+  const notes = [];
+  const detail = {};
+  const u = args.usage;
+  const inputCost = costForTokens(u.inputTokens, entry.inputCostPerMillion);
+  const outputCost = costForTokens(u.outputTokens, entry.outputCostPerMillion);
+  detail.input = inputCost;
+  detail.output = outputCost;
+  let total = inputCost + outputCost;
+  if (u.cacheReadTokens !== void 0 && u.cacheReadTokens > 0) {
+    if (entry.cacheReadCostPerMillion === void 0) {
+      return {
+        amountUsd: void 0,
+        status: "unknown",
+        currency: "USD",
+        source: "litellm_snapshot",
+        pricingVersion: entry.pricingVersion,
+        notes: ["cache-read tokens present but cacheReadCostPerMillion is undefined"]
+      };
+    }
+    const c = costForTokens(u.cacheReadTokens, entry.cacheReadCostPerMillion);
+    detail.cacheRead = c;
+    total += c;
+  }
+  if (u.cacheWriteTokens !== void 0 && u.cacheWriteTokens > 0) {
+    if (entry.cacheWriteCostPerMillion === void 0) {
+      return {
+        amountUsd: void 0,
+        status: "unknown",
+        currency: "USD",
+        source: "litellm_snapshot",
+        pricingVersion: entry.pricingVersion,
+        notes: ["cache-write tokens present but cacheWriteCostPerMillion is undefined"]
+      };
+    }
+    const c = costForTokens(u.cacheWriteTokens, entry.cacheWriteCostPerMillion);
+    detail.cacheWrite = c;
+    total += c;
+  }
+  if (u.reasoningTokens !== void 0 && u.reasoningTokens > 0) {
+    const rate = entry.reasoningCostPerMillion ?? entry.outputCostPerMillion;
+    const c = costForTokens(u.reasoningTokens, rate);
+    detail.reasoning = c;
+    total += c;
+    if (entry.reasoningCostPerMillion === void 0) {
+      notes.push("reasoning tokens billed at output rate (no dedicated reasoning rate available)");
+    }
+  }
+  const amountUsd = Math.round(total * MICROCENT) / MICROCENT;
+  return {
+    amountUsd,
+    status: "estimated",
+    currency: "USD",
+    source: "litellm_snapshot",
+    pricingVersion: entry.pricingVersion,
+    ...notes.length > 0 ? { notes } : {},
+    detail
+  };
 }
 
 // src/internal/agent-loop/usage-and-cost.ts
@@ -6898,9 +6782,12 @@ async function runIteration(inputs, ctx) {
 async function transformLlmOutputText(inputs, text, ctx) {
   return inputs.pluginManager !== void 0 ? inputs.pluginManager.runTransformLlmOutputHooks(text, ctx) : text;
 }
-async function guardAndTransformToolResults(inputs, raw, ctx) {
+async function guardAndTransformToolResults(inputs, raw, ctx, toolCalls) {
   const guarded = inputs.toolResultGuard !== void 0 ? applyToolResultGuard(raw, inputs.toolResultGuard) : raw;
-  return inputs.pluginManager !== void 0 ? inputs.pluginManager.runTransformToolResultHooks(guarded, ctx) : guarded;
+  return inputs.pluginManager !== void 0 ? inputs.pluginManager.runTransformToolResultHooks(guarded, {
+    ...ctx,
+    toolCalls: toolCalls.map((c) => ({ id: c.id, name: c.name, args: c.input }))
+  }) : guarded;
 }
 async function continueOrTerminate(inputs, ctx, llmOutput) {
   if (llmOutput.errored) return "error";
@@ -6923,7 +6810,12 @@ async function continueOrTerminate(inputs, ctx, llmOutput) {
     ctx.sendSpan
     // M3 #64 — nest tool.call spans under agent.send
   );
-  const toolResults = await guardAndTransformToolResults(inputs, rawResults, tCtx);
+  const toolResults = await guardAndTransformToolResults(
+    inputs,
+    rawResults,
+    tCtx,
+    llmOutput.toolCalls
+  );
   ctx.messages.push({ role: "user", content: toolResults });
   if (inputs.onStep !== void 0) {
     const cb = inputs.onStep;
@@ -10569,5 +10461,5 @@ async function abrirStoreLocal(reg) {
 }
 
 export { Agent, AgentBuilder, DEFAULT_AGENTIC_MODEL_ID, MEMORY_EMBEDDING_ADAPTERS, Tool, ToolError, UsageAccumulator, computeCost, generateCronId, getPricingEntry, httpRequest, isFixtureApiKey, openRouterMemoryEmbeddingProviderAdapter, resolveApiKey, shouldUseFixtureMode };
-//# sourceMappingURL=chunk-XW6RXVGB.js.map
-//# sourceMappingURL=chunk-XW6RXVGB.js.map
+//# sourceMappingURL=chunk-ISZ3MBUD.js.map
+//# sourceMappingURL=chunk-ISZ3MBUD.js.map