@theokit/sdk 4.45.0 → 4.47.0

package/dist/index.d.cts

@@ -1578,6 +1578,68 @@ declare class JobQueue {
     cancel(id: string): boolean;
 }
 
+/**
+ * Fold configuration layers in a declared order — later layers win, named keys accumulate.
+ *
+ * Every product that reads configuration from more than one place rebuilds these two rules, and the
+ * second one is not a nicety. With plain last-wins, a project file DISPLACES the user's entries for
+ * a list-valued key rather than adding to them — and for a key like `hooks`, which carries arbitrary
+ * command execution, that is the difference between a repository adding a hook and a repository
+ * removing yours.
+ *
+ * The layer NAMES are the caller's, supplied as data. One product's chain is
+ * defaults/user/project/profile/env/cli; `profile` is that product's idea and does not belong here.
+ * That is the same test the security floor passed: a vocabulary expressible as data generalises, an
+ * open-ended interface shaped by one product does not.
+ *
+ * @public
+ */
+
+/** Raised when a declared layer chain is not strictly ascending. @public */
+declare class LayerOrderError extends TheokitAgentError {
+    readonly name = "LayerOrderError";
+}
+/** @public */
+interface DeclaredLayer {
+    readonly layer: string;
+    /** Higher wins. Optional — omit it to mean "this array is already the order". */
+    readonly precedence?: number;
+}
+/** @public */
+interface LayerValues extends DeclaredLayer {
+    readonly values: Readonly<Record<string, unknown>>;
+}
+/**
+ * Assert that each layer strictly outranks the one before it.
+ *
+ * Entries without a `precedence` are skipped rather than treated as zero: omitting it means the
+ * caller is expressing order by position, and inventing a number for them would manufacture a
+ * conflict out of a legitimate usage.
+ *
+ * @throws LayerOrderError naming both layers and both precedences — a refusal that only says "out
+ *   of order" sends the reader to compare the whole list by hand.
+ * @public
+ */
+declare function verifyLayerOrdering(layers: readonly DeclaredLayer[]): void;
+/**
+ * Combine `entries` into one record.
+ *
+ * Later entries win. A value of `undefined` never overwrites — a layer that does not mention a key
+ * must not erase it, because "said nothing" is overwhelmingly more common than "said nothing on
+ * purpose".
+ *
+ * Keys in `accumulatingKeys` whose value is an array are CONCATENATED across layers instead of
+ * replaced. A non-array value for such a key replaces, deliberately: a malformed config must not
+ * corrupt the accumulator into a mixed list, and leaving the raw value visible lets the consumer's
+ * own validation reject it with its own message.
+ *
+ * The accumulator is per-call and the inputs are never mutated, so folding twice yields the same
+ * answer — which a consumer that folds once to display and once to apply depends on.
+ *
+ * @public
+ */
+declare function foldLayers(entries: readonly LayerValues[], accumulatingKeys?: readonly string[]): Record<string, unknown>;
+
 /**
  * Public handle to an open memory index. Mirrors the internal `MemoryIndex`
  * contract structurally; defined here (NOT re-exported from internal/) so
@@ -2633,4 +2695,68 @@ declare function toShareGptTrajectory(result: BatchResult, options?: {
     model?: string;
 }): ShareGptTrajectory | null;
 
-export { Agent, AgentBuilder, AgentDefinition, AgentDescription, AgentFactory, AgentOperationOptions, AgentOptions, type AgentPromptResult, type AgentRegistryOptions, type BatchItem, type BatchOptions, type BatchProgress, type BatchResult, Budget, BudgetHandle, BudgetOptions, BudgetSnapshot, BudgetTracker, CloudOptions, ContextSettings, type CounterBudgetTrackerOptions, CustomTool, type DeepPartial, type DefineProviderOptions, type DefineToolSpec, type DiagnosticsSink, type DreamingSweepOptions, type DreamingSweepResult, ErrorMetadata, EventBus, type EvictReason, GOAL_CONTINUATION_MARKER, GenerateObjectError, type GenerateObjectOptions, type GenerateObjectResult, GetAgentOptions, GetRunOptions, GoalEvent, type GoalLoopAgent, GoalOptions, GoalResult, InlineSkill, JobQueue, type JobQueueOptions, JudgeCredentialError, JudgeResult, ListAgentsOptions, ListResult, ListRunsOptions, LiveAgentRegistry, LocalOptions, McpServerConfig, Memory, MemoryId, MemoryProvider, MemorySettings, type MigrateOptions, type MigrateResult, type ModelListItem, type ModelParameterDefinition, ModelSelection, type ModelVariant, NoopMemoryProvider, type NormalizedJsonSchema, PermissionEngine, type PermissionGate, type PermissionGateContext, type PermissionGateDecision, PermissionMode, PermissionPlugin, type PermissionPluginOptions, Plugin, PluginsSettings, PreToolCallDecision, Processor, Provider, ProviderProfile, ProviderRoutingSettings, Run, RunEventSink, RunResult, SDKAgent, SDKAgentInfo, SDKMessage, type SDKModel, SDKProvider, type SDKRepository, type SDKUser, SOVEREIGN_ENV_KEYS, Security, type SecurityFloorInput, type SessionMessage, type SessionMessagePart, type SessionScope, type ShareGptMessage, type ShareGptTrajectory, SkillReadTool, SkillsSettings, type SovereignEnvKey, Squad, type SquadOptions, type SquadRun, StreamObjectError, type StreamObjectEvent, type StreamObjectOptions, SystemPromptResolver, TASK_RESERVED_PREFIXES, Task, type TaskCancelResult, type TaskConfigureOptions, type TaskEvent, type TaskFilter, type TaskHandle, type TaskKind, type TaskState, type TaskStoreOptions, type TaskSubmitOptions, type TaskWorkContext, type TaskWorkFn, Theokit, TheokitAgentError, type TheokitRequestOptions, TokenLimiter, type TokenLimiterOptions, Tool, ToolError, ToolResultContentBlock, UnicodeNormalizer, type UnicodeNormalizerOptions, UsageAccumulator, applySecurityFloor, chargeAndCheckThresholds, computeCost, createCounterBudgetTracker, estimateTokens, extractRawId, getPricingEntry, inferApiMode, isValidTaskId, loadProjectEnv, migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, preflightCheck, runGoalLoop, scopedConversationId, sessionScopePrefix, setDiagnosticsSink, toShareGptTrajectory, withCwdMutex };
+/**
+ * Decide what a project directory is allowed to switch on.
+ *
+ * A product that reads a repository has to answer this before it builds anything: are that
+ * repository's hooks honoured, are its MCP servers started, do its instructions enter the persona?
+ * The stakes are not configuration-shaped. A hook is arbitrary command execution on every tool
+ * call, and an MCP server is an external process SPAWNED while the agent is built — before any
+ * per-tool approval exists to refuse it. A product that gets this wrong grants local execution on
+ * first build, in a directory the user only meant to open.
+ *
+ * ## What this is, and what it deliberately is not
+ *
+ * The arithmetic is small: pick a level, derive one boolean per capability. The value is the
+ * INVARIANT — untrusted means EVERY declared capability is off, and `allows` is built FROM the
+ * declared list, so a product that adds a ninth capability cannot forget to gate it. That failure
+ * is invisible when it happens: the new capability simply works in a directory where it should not,
+ * and nothing reports anything.
+ *
+ * It does NOT decide what "trusted" means. Where the record lives, what the environment variable is
+ * called, whether a legacy alias is still honoured — all of that is the consumer's, because all of
+ * it is that product's vocabulary. The framework owns the shape of the answer and the guarantee
+ * that the answer covers everything declared.
+ *
+ * ## Why `source` is reported
+ *
+ * "Trusted because the operator recorded this directory" and "trusted because a blanket environment
+ * switch is on" are different facts. A surface that only shows `trusted` cannot warn about the
+ * second, which is the one that stays on across every directory the process ever opens.
+ *
+ * @public
+ */
+/** @public */
+type TrustLevel = "trusted" | "untrusted";
+/** Where the decision came from. @public */
+type TrustSource = "env" | "store" | "default";
+/** @public */
+interface TrustPostureInput<K extends string> {
+    /**
+     * Every capability a repository could switch on. `allows` is built from exactly this list — the
+     * guarantee that nothing is left ungated.
+     */
+    readonly capabilities: readonly K[];
+    /**
+     * Whether the operator has recorded this directory as trusted. Called at most once, and not at
+     * all when `envOverride` already granted trust — it may touch the filesystem.
+     */
+    readonly isTrusted: () => boolean;
+    /**
+     * A blanket override from the consumer's own environment vocabulary. `true` grants trust;
+     * `false` and `undefined` both mean "the operator did not switch it on" — NOT "switched it off",
+     * because an unset variable must not override a trusted store.
+     */
+    readonly envOverride?: boolean;
+}
+/** @public */
+interface TrustPosture<K extends string> {
+    readonly level: TrustLevel;
+    readonly source: TrustSource;
+    /** One entry per declared capability. Every value is `false` when the level is untrusted. */
+    readonly allows: Readonly<Record<K, boolean>>;
+}
+/** @public */
+declare function resolveTrustPosture<K extends string>(input: TrustPostureInput<K>): TrustPosture<K>;
+
+export { Agent, AgentBuilder, AgentDefinition, AgentDescription, AgentFactory, AgentOperationOptions, AgentOptions, type AgentPromptResult, type AgentRegistryOptions, type BatchItem, type BatchOptions, type BatchProgress, type BatchResult, Budget, BudgetHandle, BudgetOptions, BudgetSnapshot, BudgetTracker, CloudOptions, ContextSettings, type CounterBudgetTrackerOptions, CustomTool, type DeclaredLayer, type DeepPartial, type DefineProviderOptions, type DefineToolSpec, type DiagnosticsSink, type DreamingSweepOptions, type DreamingSweepResult, ErrorMetadata, EventBus, type EvictReason, GOAL_CONTINUATION_MARKER, GenerateObjectError, type GenerateObjectOptions, type GenerateObjectResult, GetAgentOptions, GetRunOptions, GoalEvent, type GoalLoopAgent, GoalOptions, GoalResult, InlineSkill, JobQueue, type JobQueueOptions, JudgeCredentialError, JudgeResult, LayerOrderError, type LayerValues, ListAgentsOptions, ListResult, ListRunsOptions, LiveAgentRegistry, LocalOptions, McpServerConfig, Memory, MemoryId, MemoryProvider, MemorySettings, type MigrateOptions, type MigrateResult, type ModelListItem, type ModelParameterDefinition, ModelSelection, type ModelVariant, NoopMemoryProvider, type NormalizedJsonSchema, PermissionEngine, type PermissionGate, type PermissionGateContext, type PermissionGateDecision, PermissionMode, PermissionPlugin, type PermissionPluginOptions, Plugin, PluginsSettings, PreToolCallDecision, Processor, Provider, ProviderProfile, ProviderRoutingSettings, Run, RunEventSink, RunResult, SDKAgent, SDKAgentInfo, SDKMessage, type SDKModel, SDKProvider, type SDKRepository, type SDKUser, SOVEREIGN_ENV_KEYS, Security, type SecurityFloorInput, type SessionMessage, type SessionMessagePart, type SessionScope, type ShareGptMessage, type ShareGptTrajectory, SkillReadTool, SkillsSettings, type SovereignEnvKey, Squad, type SquadOptions, type SquadRun, StreamObjectError, type StreamObjectEvent, type StreamObjectOptions, SystemPromptResolver, TASK_RESERVED_PREFIXES, Task, type TaskCancelResult, type TaskConfigureOptions, type TaskEvent, type TaskFilter, type TaskHandle, type TaskKind, type TaskState, type TaskStoreOptions, type TaskSubmitOptions, type TaskWorkContext, type TaskWorkFn, Theokit, TheokitAgentError, type TheokitRequestOptions, TokenLimiter, type TokenLimiterOptions, Tool, ToolError, ToolResultContentBlock, type TrustLevel, type TrustPosture, type TrustPostureInput, type TrustSource, UnicodeNormalizer, type UnicodeNormalizerOptions, UsageAccumulator, applySecurityFloor, chargeAndCheckThresholds, computeCost, createCounterBudgetTracker, estimateTokens, extractRawId, foldLayers, getPricingEntry, inferApiMode, isValidTaskId, loadProjectEnv, migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, preflightCheck, resolveTrustPosture, runGoalLoop, scopedConversationId, sessionScopePrefix, setDiagnosticsSink, toShareGptTrajectory, verifyLayerOrdering, withCwdMutex };

package/dist/index.d.ts

@@ -1578,6 +1578,68 @@ declare class JobQueue {
     cancel(id: string): boolean;
 }
 
+/**
+ * Fold configuration layers in a declared order — later layers win, named keys accumulate.
+ *
+ * Every product that reads configuration from more than one place rebuilds these two rules, and the
+ * second one is not a nicety. With plain last-wins, a project file DISPLACES the user's entries for
+ * a list-valued key rather than adding to them — and for a key like `hooks`, which carries arbitrary
+ * command execution, that is the difference between a repository adding a hook and a repository
+ * removing yours.
+ *
+ * The layer NAMES are the caller's, supplied as data. One product's chain is
+ * defaults/user/project/profile/env/cli; `profile` is that product's idea and does not belong here.
+ * That is the same test the security floor passed: a vocabulary expressible as data generalises, an
+ * open-ended interface shaped by one product does not.
+ *
+ * @public
+ */
+
+/** Raised when a declared layer chain is not strictly ascending. @public */
+declare class LayerOrderError extends TheokitAgentError {
+    readonly name = "LayerOrderError";
+}
+/** @public */
+interface DeclaredLayer {
+    readonly layer: string;
+    /** Higher wins. Optional — omit it to mean "this array is already the order". */
+    readonly precedence?: number;
+}
+/** @public */
+interface LayerValues extends DeclaredLayer {
+    readonly values: Readonly<Record<string, unknown>>;
+}
+/**
+ * Assert that each layer strictly outranks the one before it.
+ *
+ * Entries without a `precedence` are skipped rather than treated as zero: omitting it means the
+ * caller is expressing order by position, and inventing a number for them would manufacture a
+ * conflict out of a legitimate usage.
+ *
+ * @throws LayerOrderError naming both layers and both precedences — a refusal that only says "out
+ *   of order" sends the reader to compare the whole list by hand.
+ * @public
+ */
+declare function verifyLayerOrdering(layers: readonly DeclaredLayer[]): void;
+/**
+ * Combine `entries` into one record.
+ *
+ * Later entries win. A value of `undefined` never overwrites — a layer that does not mention a key
+ * must not erase it, because "said nothing" is overwhelmingly more common than "said nothing on
+ * purpose".
+ *
+ * Keys in `accumulatingKeys` whose value is an array are CONCATENATED across layers instead of
+ * replaced. A non-array value for such a key replaces, deliberately: a malformed config must not
+ * corrupt the accumulator into a mixed list, and leaving the raw value visible lets the consumer's
+ * own validation reject it with its own message.
+ *
+ * The accumulator is per-call and the inputs are never mutated, so folding twice yields the same
+ * answer — which a consumer that folds once to display and once to apply depends on.
+ *
+ * @public
+ */
+declare function foldLayers(entries: readonly LayerValues[], accumulatingKeys?: readonly string[]): Record<string, unknown>;
+
 /**
  * Public handle to an open memory index. Mirrors the internal `MemoryIndex`
  * contract structurally; defined here (NOT re-exported from internal/) so
@@ -2633,4 +2695,68 @@ declare function toShareGptTrajectory(result: BatchResult, options?: {
     model?: string;
 }): ShareGptTrajectory | null;
 
-export { Agent, AgentBuilder, AgentDefinition, AgentDescription, AgentFactory, AgentOperationOptions, AgentOptions, type AgentPromptResult, type AgentRegistryOptions, type BatchItem, type BatchOptions, type BatchProgress, type BatchResult, Budget, BudgetHandle, BudgetOptions, BudgetSnapshot, BudgetTracker, CloudOptions, ContextSettings, type CounterBudgetTrackerOptions, CustomTool, type DeepPartial, type DefineProviderOptions, type DefineToolSpec, type DiagnosticsSink, type DreamingSweepOptions, type DreamingSweepResult, ErrorMetadata, EventBus, type EvictReason, GOAL_CONTINUATION_MARKER, GenerateObjectError, type GenerateObjectOptions, type GenerateObjectResult, GetAgentOptions, GetRunOptions, GoalEvent, type GoalLoopAgent, GoalOptions, GoalResult, InlineSkill, JobQueue, type JobQueueOptions, JudgeCredentialError, JudgeResult, ListAgentsOptions, ListResult, ListRunsOptions, LiveAgentRegistry, LocalOptions, McpServerConfig, Memory, MemoryId, MemoryProvider, MemorySettings, type MigrateOptions, type MigrateResult, type ModelListItem, type ModelParameterDefinition, ModelSelection, type ModelVariant, NoopMemoryProvider, type NormalizedJsonSchema, PermissionEngine, type PermissionGate, type PermissionGateContext, type PermissionGateDecision, PermissionMode, PermissionPlugin, type PermissionPluginOptions, Plugin, PluginsSettings, PreToolCallDecision, Processor, Provider, ProviderProfile, ProviderRoutingSettings, Run, RunEventSink, RunResult, SDKAgent, SDKAgentInfo, SDKMessage, type SDKModel, SDKProvider, type SDKRepository, type SDKUser, SOVEREIGN_ENV_KEYS, Security, type SecurityFloorInput, type SessionMessage, type SessionMessagePart, type SessionScope, type ShareGptMessage, type ShareGptTrajectory, SkillReadTool, SkillsSettings, type SovereignEnvKey, Squad, type SquadOptions, type SquadRun, StreamObjectError, type StreamObjectEvent, type StreamObjectOptions, SystemPromptResolver, TASK_RESERVED_PREFIXES, Task, type TaskCancelResult, type TaskConfigureOptions, type TaskEvent, type TaskFilter, type TaskHandle, type TaskKind, type TaskState, type TaskStoreOptions, type TaskSubmitOptions, type TaskWorkContext, type TaskWorkFn, Theokit, TheokitAgentError, type TheokitRequestOptions, TokenLimiter, type TokenLimiterOptions, Tool, ToolError, ToolResultContentBlock, UnicodeNormalizer, type UnicodeNormalizerOptions, UsageAccumulator, applySecurityFloor, chargeAndCheckThresholds, computeCost, createCounterBudgetTracker, estimateTokens, extractRawId, getPricingEntry, inferApiMode, isValidTaskId, loadProjectEnv, migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, preflightCheck, runGoalLoop, scopedConversationId, sessionScopePrefix, setDiagnosticsSink, toShareGptTrajectory, withCwdMutex };
+/**
+ * Decide what a project directory is allowed to switch on.
+ *
+ * A product that reads a repository has to answer this before it builds anything: are that
+ * repository's hooks honoured, are its MCP servers started, do its instructions enter the persona?
+ * The stakes are not configuration-shaped. A hook is arbitrary command execution on every tool
+ * call, and an MCP server is an external process SPAWNED while the agent is built — before any
+ * per-tool approval exists to refuse it. A product that gets this wrong grants local execution on
+ * first build, in a directory the user only meant to open.
+ *
+ * ## What this is, and what it deliberately is not
+ *
+ * The arithmetic is small: pick a level, derive one boolean per capability. The value is the
+ * INVARIANT — untrusted means EVERY declared capability is off, and `allows` is built FROM the
+ * declared list, so a product that adds a ninth capability cannot forget to gate it. That failure
+ * is invisible when it happens: the new capability simply works in a directory where it should not,
+ * and nothing reports anything.
+ *
+ * It does NOT decide what "trusted" means. Where the record lives, what the environment variable is
+ * called, whether a legacy alias is still honoured — all of that is the consumer's, because all of
+ * it is that product's vocabulary. The framework owns the shape of the answer and the guarantee
+ * that the answer covers everything declared.
+ *
+ * ## Why `source` is reported
+ *
+ * "Trusted because the operator recorded this directory" and "trusted because a blanket environment
+ * switch is on" are different facts. A surface that only shows `trusted` cannot warn about the
+ * second, which is the one that stays on across every directory the process ever opens.
+ *
+ * @public
+ */
+/** @public */
+type TrustLevel = "trusted" | "untrusted";
+/** Where the decision came from. @public */
+type TrustSource = "env" | "store" | "default";
+/** @public */
+interface TrustPostureInput<K extends string> {
+    /**
+     * Every capability a repository could switch on. `allows` is built from exactly this list — the
+     * guarantee that nothing is left ungated.
+     */
+    readonly capabilities: readonly K[];
+    /**
+     * Whether the operator has recorded this directory as trusted. Called at most once, and not at
+     * all when `envOverride` already granted trust — it may touch the filesystem.
+     */
+    readonly isTrusted: () => boolean;
+    /**
+     * A blanket override from the consumer's own environment vocabulary. `true` grants trust;
+     * `false` and `undefined` both mean "the operator did not switch it on" — NOT "switched it off",
+     * because an unset variable must not override a trusted store.
+     */
+    readonly envOverride?: boolean;
+}
+/** @public */
+interface TrustPosture<K extends string> {
+    readonly level: TrustLevel;
+    readonly source: TrustSource;
+    /** One entry per declared capability. Every value is `false` when the level is untrusted. */
+    readonly allows: Readonly<Record<K, boolean>>;
+}
+/** @public */
+declare function resolveTrustPosture<K extends string>(input: TrustPostureInput<K>): TrustPosture<K>;
+
+export { Agent, AgentBuilder, AgentDefinition, AgentDescription, AgentFactory, AgentOperationOptions, AgentOptions, type AgentPromptResult, type AgentRegistryOptions, type BatchItem, type BatchOptions, type BatchProgress, type BatchResult, Budget, BudgetHandle, BudgetOptions, BudgetSnapshot, BudgetTracker, CloudOptions, ContextSettings, type CounterBudgetTrackerOptions, CustomTool, type DeclaredLayer, type DeepPartial, type DefineProviderOptions, type DefineToolSpec, type DiagnosticsSink, type DreamingSweepOptions, type DreamingSweepResult, ErrorMetadata, EventBus, type EvictReason, GOAL_CONTINUATION_MARKER, GenerateObjectError, type GenerateObjectOptions, type GenerateObjectResult, GetAgentOptions, GetRunOptions, GoalEvent, type GoalLoopAgent, GoalOptions, GoalResult, InlineSkill, JobQueue, type JobQueueOptions, JudgeCredentialError, JudgeResult, LayerOrderError, type LayerValues, ListAgentsOptions, ListResult, ListRunsOptions, LiveAgentRegistry, LocalOptions, McpServerConfig, Memory, MemoryId, MemoryProvider, MemorySettings, type MigrateOptions, type MigrateResult, type ModelListItem, type ModelParameterDefinition, ModelSelection, type ModelVariant, NoopMemoryProvider, type NormalizedJsonSchema, PermissionEngine, type PermissionGate, type PermissionGateContext, type PermissionGateDecision, PermissionMode, PermissionPlugin, type PermissionPluginOptions, Plugin, PluginsSettings, PreToolCallDecision, Processor, Provider, ProviderProfile, ProviderRoutingSettings, Run, RunEventSink, RunResult, SDKAgent, SDKAgentInfo, SDKMessage, type SDKModel, SDKProvider, type SDKRepository, type SDKUser, SOVEREIGN_ENV_KEYS, Security, type SecurityFloorInput, type SessionMessage, type SessionMessagePart, type SessionScope, type ShareGptMessage, type ShareGptTrajectory, SkillReadTool, SkillsSettings, type SovereignEnvKey, Squad, type SquadOptions, type SquadRun, StreamObjectError, type StreamObjectEvent, type StreamObjectOptions, SystemPromptResolver, TASK_RESERVED_PREFIXES, Task, type TaskCancelResult, type TaskConfigureOptions, type TaskEvent, type TaskFilter, type TaskHandle, type TaskKind, type TaskState, type TaskStoreOptions, type TaskSubmitOptions, type TaskWorkContext, type TaskWorkFn, Theokit, TheokitAgentError, type TheokitRequestOptions, TokenLimiter, type TokenLimiterOptions, Tool, ToolError, ToolResultContentBlock, type TrustLevel, type TrustPosture, type TrustPostureInput, type TrustSource, UnicodeNormalizer, type UnicodeNormalizerOptions, UsageAccumulator, applySecurityFloor, chargeAndCheckThresholds, computeCost, createCounterBudgetTracker, estimateTokens, extractRawId, foldLayers, getPricingEntry, inferApiMode, isValidTaskId, loadProjectEnv, migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, preflightCheck, resolveTrustPosture, runGoalLoop, scopedConversationId, sessionScopePrefix, setDiagnosticsSink, toShareGptTrajectory, verifyLayerOrdering, withCwdMutex };

package/dist/index.js

@@ -53,7 +53,7 @@ import './chunk-5NBUH3NO.js';
 import './chunk-2S6B5B2A.js';
 import './chunk-6FSQ3CHQ.js';
 import './chunk-OLLOUAUJ.js';
-import { BudgetExceededError, MemoryAdapterError, AuthenticationError, ConfigurationError } from './chunk-MRKSSN36.js';
+import { BudgetExceededError, TheokitAgentError, MemoryAdapterError, AuthenticationError, ConfigurationError } from './chunk-MRKSSN36.js';
 export { AgentDisposedError, AgentRunError, AuthenticationError, BudgetExceededError, ConfigurationError, IntegrationNotConnectedError, InvalidTaskIdError, MemoryAdapterError, NetworkError, RateLimitError, TaskNotFoundError, TheokitAgentError, UnknownAgentError, UnsupportedBudgetOperationError, UnsupportedRunOperationError, UnsupportedTaskOperationError, isTransientError } from './chunk-MRKSSN36.js';
 import { diag, redactSecrets, addPattern } from './chunk-PBML2FHN.js';
 export { setDiagnosticsSink } from './chunk-PBML2FHN.js';
@@ -922,6 +922,42 @@ var JobQueue = class {
     if (next !== void 0) next();
   }
 };
+
+// src/layer-fold.ts
+var LayerOrderError = class extends TheokitAgentError {
+  name = "LayerOrderError";
+};
+function verifyLayerOrdering(layers) {
+  let previous;
+  for (const current of layers) {
+    if (current.precedence === void 0) continue;
+    const declared = { layer: current.layer, precedence: current.precedence };
+    if (previous !== void 0 && declared.precedence <= previous.precedence) {
+      throw new LayerOrderError(
+        `layers out of order: \`${declared.layer}\` (precedence ${String(declared.precedence)}) comes after \`${previous.layer}\` (precedence ${String(previous.precedence)}) but does not outrank it`
+      );
+    }
+    previous = declared;
+  }
+}
+function foldLayers(entries, accumulatingKeys = []) {
+  verifyLayerOrdering(entries);
+  const accumulated = new Map(accumulatingKeys.map((k) => [k, []]));
+  const combined = {};
+  for (const { values } of entries) {
+    for (const [key, value] of Object.entries(values)) {
+      if (value === void 0) continue;
+      const stack = accumulated.get(key);
+      if (stack !== void 0 && Array.isArray(value)) {
+        stack.push(...value);
+        combined[key] = [...stack];
+        continue;
+      }
+      combined[key] = value;
+    }
+  }
+  return combined;
+}
 function diaryPath(cwd) {
   return join(memoryDir(cwd), "dream-diary.md");
 }
@@ -2155,6 +2191,15 @@ function safeStringify(v) {
   }
 }
 
-export { AgentFactory, Budget, EventBus, JobQueue, Memory, NoopMemoryProvider, PermissionEngine, PermissionPlugin, Plugin, Provider, SOVEREIGN_ENV_KEYS, Security, Skill, SkillReadTool, Squad, Task, Theokit, TokenLimiter, UnicodeNormalizer, applyMode, applySecurityFloor, chargeAndCheckThresholds, createCounterBudgetTracker, estimateTokens, extractRawId, inferApiMode, loadProjectEnv, migrateSqliteToLance2 as migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, preflightCheck, runGoalLoop, scopedConversationId, sessionScopePrefix, toShareGptTrajectory };
+// src/trust-posture.ts
+function resolveTrustPosture(input) {
+  const source = input.envOverride === true ? "env" : input.isTrusted() ? "store" : "default";
+  const level = source === "default" ? "untrusted" : "trusted";
+  const granted = level === "trusted";
+  const allows = Object.fromEntries(input.capabilities.map((key) => [key, granted]));
+  return { level, source, allows };
+}
+
+export { AgentFactory, Budget, EventBus, JobQueue, LayerOrderError, Memory, NoopMemoryProvider, PermissionEngine, PermissionPlugin, Plugin, Provider, SOVEREIGN_ENV_KEYS, Security, Skill, SkillReadTool, Squad, Task, Theokit, TokenLimiter, UnicodeNormalizer, applyMode, applySecurityFloor, chargeAndCheckThresholds, createCounterBudgetTracker, estimateTokens, extractRawId, foldLayers, inferApiMode, loadProjectEnv, migrateSqliteToLance2 as migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, preflightCheck, resolveTrustPosture, runGoalLoop, scopedConversationId, sessionScopePrefix, toShareGptTrajectory, verifyLayerOrdering };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map