@theokit/sdk 4.47.0 → 4.49.0

package/dist/index.d.cts

@@ -1263,6 +1263,63 @@ declare class Tool {
     static create<T extends ZodType, O extends ZodType = never>(spec: DefineToolSpec<T, O>): CustomTool;
 }
 
+/**
+ * Audit whether every configuration key can be set from the environment, or says why not.
+ *
+ * A key settable only by editing a file cannot be set in CI, in a container, or for a single
+ * invocation. That is usually an oversight rather than a decision, and it is invisible — nothing
+ * fails, the key simply has no environment path, and nobody notices until someone needs one.
+ *
+ * The opposite failure rots more quietly. An opt-out written for a key that has since gained an
+ * environment path, or for a key that no longer exists, still reads as a considered decision while
+ * exempting nothing. Both questions are answered by one call so a consumer cannot check the gap and
+ * forget the rot: they fail for opposite reasons, and a suite that asks only one looks complete.
+ *
+ * ## Why the framework owns the rule and not the keys
+ *
+ * A framework cannot enumerate a consumer's configuration keys, and should not try. Which keys exist
+ * is that product's vocabulary — the same reason the security floor takes its permissiveness order
+ * as data and the trust posture takes its capability list. So the consumer ranges over its own keys
+ * with this, rather than registering them here.
+ *
+ * That is a narrower claim than "reachability is checked in the framework", and it is the honest
+ * one: the failure still surfaces in the consumer's own suite. What the consumer no longer writes is
+ * the detector, which is where the subtlety lives — the stale-opt-out half is the part everyone
+ * forgets.
+ *
+ * @public
+ */
+/** A key deliberately left off the environment, with the reason and what would reverse it. @public */
+interface EnvOptOut {
+    readonly key: string;
+    /** Why an environment variable is the wrong shape for this key. */
+    readonly reason: string;
+    /** What would make this opt-out obsolete. An opt-out with no exit is a permanent excuse. */
+    readonly exitCriterion: string;
+}
+/** @public */
+interface EnvReachabilityInput {
+    /** Every configuration key the product declares. */
+    readonly keys: readonly string[];
+    /** The subset that an environment variable can set. */
+    readonly reachable: readonly string[];
+    /** Documented exemptions for keys that deliberately have no environment path. */
+    readonly optOuts: readonly EnvOptOut[];
+}
+/** @public */
+interface EnvReachabilityAudit {
+    /** Keys with neither an environment path nor a documented opt-out. */
+    readonly unreachable: readonly string[];
+    /** Opt-outs that exempt nothing: the key gained an environment path, or no longer exists. */
+    readonly staleOptOuts: readonly string[];
+}
+/**
+ * @returns both axes, in the order the caller declared them — a stable order so a failure message
+ *   does not change between runs for reasons unrelated to the code.
+ * @public
+ */
+declare function auditEnvReachability(input: EnvReachabilityInput): EnvReachabilityAudit;
+
 /**
  * `EventBus` — typed EventEmitter wrapper.
  *
@@ -2759,4 +2816,80 @@ interface TrustPosture<K extends string> {
 /** @public */
 declare function resolveTrustPosture<K extends string>(input: TrustPostureInput<K>): TrustPosture<K>;
 
-export { Agent, AgentBuilder, AgentDefinition, AgentDescription, AgentFactory, AgentOperationOptions, AgentOptions, type AgentPromptResult, type AgentRegistryOptions, type BatchItem, type BatchOptions, type BatchProgress, type BatchResult, Budget, BudgetHandle, BudgetOptions, BudgetSnapshot, BudgetTracker, CloudOptions, ContextSettings, type CounterBudgetTrackerOptions, CustomTool, type DeclaredLayer, type DeepPartial, type DefineProviderOptions, type DefineToolSpec, type DiagnosticsSink, type DreamingSweepOptions, type DreamingSweepResult, ErrorMetadata, EventBus, type EvictReason, GOAL_CONTINUATION_MARKER, GenerateObjectError, type GenerateObjectOptions, type GenerateObjectResult, GetAgentOptions, GetRunOptions, GoalEvent, type GoalLoopAgent, GoalOptions, GoalResult, InlineSkill, JobQueue, type JobQueueOptions, JudgeCredentialError, JudgeResult, LayerOrderError, type LayerValues, ListAgentsOptions, ListResult, ListRunsOptions, LiveAgentRegistry, LocalOptions, McpServerConfig, Memory, MemoryId, MemoryProvider, MemorySettings, type MigrateOptions, type MigrateResult, type ModelListItem, type ModelParameterDefinition, ModelSelection, type ModelVariant, NoopMemoryProvider, type NormalizedJsonSchema, PermissionEngine, type PermissionGate, type PermissionGateContext, type PermissionGateDecision, PermissionMode, PermissionPlugin, type PermissionPluginOptions, Plugin, PluginsSettings, PreToolCallDecision, Processor, Provider, ProviderProfile, ProviderRoutingSettings, Run, RunEventSink, RunResult, SDKAgent, SDKAgentInfo, SDKMessage, type SDKModel, SDKProvider, type SDKRepository, type SDKUser, SOVEREIGN_ENV_KEYS, Security, type SecurityFloorInput, type SessionMessage, type SessionMessagePart, type SessionScope, type ShareGptMessage, type ShareGptTrajectory, SkillReadTool, SkillsSettings, type SovereignEnvKey, Squad, type SquadOptions, type SquadRun, StreamObjectError, type StreamObjectEvent, type StreamObjectOptions, SystemPromptResolver, TASK_RESERVED_PREFIXES, Task, type TaskCancelResult, type TaskConfigureOptions, type TaskEvent, type TaskFilter, type TaskHandle, type TaskKind, type TaskState, type TaskStoreOptions, type TaskSubmitOptions, type TaskWorkContext, type TaskWorkFn, Theokit, TheokitAgentError, type TheokitRequestOptions, TokenLimiter, type TokenLimiterOptions, Tool, ToolError, ToolResultContentBlock, type TrustLevel, type TrustPosture, type TrustPostureInput, type TrustSource, UnicodeNormalizer, type UnicodeNormalizerOptions, UsageAccumulator, applySecurityFloor, chargeAndCheckThresholds, computeCost, createCounterBudgetTracker, estimateTokens, extractRawId, foldLayers, getPricingEntry, inferApiMode, isValidTaskId, loadProjectEnv, migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, preflightCheck, resolveTrustPosture, runGoalLoop, scopedConversationId, sessionScopePrefix, setDiagnosticsSink, toShareGptTrajectory, verifyLayerOrdering, withCwdMutex };
+/**
+ * Record what a build actually wired, as opposed to what configuration asked for.
+ *
+ * A product that reads a project directory decides, while building, which of that directory's
+ * entities it will honour: MCP servers, skills, hook events, commands. When a trust posture withholds
+ * them, the build simply proceeds with fewer — and every surface that later asks "what is loaded?"
+ * sees an empty list. Empty because nothing was configured and empty because everything was withheld
+ * are the same emptiness to the reader, and only one of them is something they can act on.
+ *
+ * ## Why this is not a re-read
+ *
+ * The obvious implementation of any "what is loaded?" listing is to read the configuration again.
+ * That is the defect this exists to prevent: a re-read cannot detect a disagreement between what
+ * config asked for and what the build did, because it IS the config. The two disagree exactly when
+ * something suppressed an entity, which is the case worth reporting.
+ *
+ * So this function is pure and parameterized. It performs no I/O, which is what makes "no second
+ * read" checkable rather than promised — the caller passes the values it handed to the builder, at
+ * the moment it handed them over, and what comes back is an observation of that moment.
+ *
+ * ## What is generic here, and what is not
+ *
+ * The RULE is generic: for each capability, active is the request when allowed and empty when not,
+ * and suppression is only claimed when something was actually removed. The VOCABULARY is not —
+ * which capabilities exist and what the entities are called belong to the product, and arrive as
+ * data.
+ *
+ * @public
+ */
+
+/** Raised when a recorded capability has no entry in the gate. @public */
+declare class UngatedCapabilityError extends TheokitAgentError {
+    readonly name = "UngatedCapabilityError";
+}
+/** What one capability asked for, and what it got. @public */
+interface WiredEntity {
+    /** The names actually handed to the builder. Empty when the capability was withheld. */
+    readonly active: readonly string[];
+    /**
+     * The names configuration ASKED for. Equal to `active` when nothing was withheld; the difference
+     * is exactly what the reader cannot otherwise see.
+     */
+    readonly requested: readonly string[];
+    /**
+     * True only when the gate is what emptied `active`.
+     *
+     * Deliberately false for a withheld capability that requested nothing: an untrusted directory with
+     * no skills and a trusted one with no skills are the same emptiness, and a flag that fires when
+     * nothing happened teaches the reader to ignore it.
+     */
+    readonly suppressedByTrust: boolean;
+}
+/** @public */
+interface WiringRecordInput<K extends string> {
+    /**
+     * The gate. Typically the output of `resolveTrustPosture`, which is what makes the name
+     * `suppressedByTrust` accurate rather than decorative — a posture is the only thing in this
+     * package that withholds a capability.
+     *
+     * It may gate MORE than `requested` covers: a posture also gates things that are not lists of
+     * names, like durable memory. Those are not entities and do not appear in the record.
+     */
+    readonly posture: {
+        readonly allows: Readonly<Record<string, boolean>>;
+    };
+    /** Per capability, the entity names the build was given. Drives which keys the record has. */
+    readonly requested: Readonly<Record<K, readonly string[]>>;
+}
+/**
+ * @returns one entry per key of `requested`, each a snapshot rather than a view of the caller's
+ *   arrays — the record is read long after the build, and aliasing would make it answer with what
+ *   the process holds now instead of with what was wired.
+ * @public
+ */
+declare function recordWiring<K extends string>(input: WiringRecordInput<K>): Readonly<Record<K, WiredEntity>>;
+
+export { Agent, AgentBuilder, AgentDefinition, AgentDescription, AgentFactory, AgentOperationOptions, AgentOptions, type AgentPromptResult, type AgentRegistryOptions, type BatchItem, type BatchOptions, type BatchProgress, type BatchResult, Budget, BudgetHandle, BudgetOptions, BudgetSnapshot, BudgetTracker, CloudOptions, ContextSettings, type CounterBudgetTrackerOptions, CustomTool, type DeclaredLayer, type DeepPartial, type DefineProviderOptions, type DefineToolSpec, type DiagnosticsSink, type DreamingSweepOptions, type DreamingSweepResult, type EnvOptOut, type EnvReachabilityAudit, type EnvReachabilityInput, ErrorMetadata, EventBus, type EvictReason, GOAL_CONTINUATION_MARKER, GenerateObjectError, type GenerateObjectOptions, type GenerateObjectResult, GetAgentOptions, GetRunOptions, GoalEvent, type GoalLoopAgent, GoalOptions, GoalResult, InlineSkill, JobQueue, type JobQueueOptions, JudgeCredentialError, JudgeResult, LayerOrderError, type LayerValues, ListAgentsOptions, ListResult, ListRunsOptions, LiveAgentRegistry, LocalOptions, McpServerConfig, Memory, MemoryId, MemoryProvider, MemorySettings, type MigrateOptions, type MigrateResult, type ModelListItem, type ModelParameterDefinition, ModelSelection, type ModelVariant, NoopMemoryProvider, type NormalizedJsonSchema, PermissionEngine, type PermissionGate, type PermissionGateContext, type PermissionGateDecision, PermissionMode, PermissionPlugin, type PermissionPluginOptions, Plugin, PluginsSettings, PreToolCallDecision, Processor, Provider, ProviderProfile, ProviderRoutingSettings, Run, RunEventSink, RunResult, SDKAgent, SDKAgentInfo, SDKMessage, type SDKModel, SDKProvider, type SDKRepository, type SDKUser, SOVEREIGN_ENV_KEYS, Security, type SecurityFloorInput, type SessionMessage, type SessionMessagePart, type SessionScope, type ShareGptMessage, type ShareGptTrajectory, SkillReadTool, SkillsSettings, type SovereignEnvKey, Squad, type SquadOptions, type SquadRun, StreamObjectError, type StreamObjectEvent, type StreamObjectOptions, SystemPromptResolver, TASK_RESERVED_PREFIXES, Task, type TaskCancelResult, type TaskConfigureOptions, type TaskEvent, type TaskFilter, type TaskHandle, type TaskKind, type TaskState, type TaskStoreOptions, type TaskSubmitOptions, type TaskWorkContext, type TaskWorkFn, Theokit, TheokitAgentError, type TheokitRequestOptions, TokenLimiter, type TokenLimiterOptions, Tool, ToolError, ToolResultContentBlock, type TrustLevel, type TrustPosture, type TrustPostureInput, type TrustSource, UngatedCapabilityError, UnicodeNormalizer, type UnicodeNormalizerOptions, UsageAccumulator, type WiredEntity, type WiringRecordInput, applySecurityFloor, auditEnvReachability, chargeAndCheckThresholds, computeCost, createCounterBudgetTracker, estimateTokens, extractRawId, foldLayers, getPricingEntry, inferApiMode, isValidTaskId, loadProjectEnv, migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, preflightCheck, recordWiring, resolveTrustPosture, runGoalLoop, scopedConversationId, sessionScopePrefix, setDiagnosticsSink, toShareGptTrajectory, verifyLayerOrdering, withCwdMutex };

package/dist/index.d.ts

@@ -1263,6 +1263,63 @@ declare class Tool {
     static create<T extends ZodType, O extends ZodType = never>(spec: DefineToolSpec<T, O>): CustomTool;
 }
 
+/**
+ * Audit whether every configuration key can be set from the environment, or says why not.
+ *
+ * A key settable only by editing a file cannot be set in CI, in a container, or for a single
+ * invocation. That is usually an oversight rather than a decision, and it is invisible — nothing
+ * fails, the key simply has no environment path, and nobody notices until someone needs one.
+ *
+ * The opposite failure rots more quietly. An opt-out written for a key that has since gained an
+ * environment path, or for a key that no longer exists, still reads as a considered decision while
+ * exempting nothing. Both questions are answered by one call so a consumer cannot check the gap and
+ * forget the rot: they fail for opposite reasons, and a suite that asks only one looks complete.
+ *
+ * ## Why the framework owns the rule and not the keys
+ *
+ * A framework cannot enumerate a consumer's configuration keys, and should not try. Which keys exist
+ * is that product's vocabulary — the same reason the security floor takes its permissiveness order
+ * as data and the trust posture takes its capability list. So the consumer ranges over its own keys
+ * with this, rather than registering them here.
+ *
+ * That is a narrower claim than "reachability is checked in the framework", and it is the honest
+ * one: the failure still surfaces in the consumer's own suite. What the consumer no longer writes is
+ * the detector, which is where the subtlety lives — the stale-opt-out half is the part everyone
+ * forgets.
+ *
+ * @public
+ */
+/** A key deliberately left off the environment, with the reason and what would reverse it. @public */
+interface EnvOptOut {
+    readonly key: string;
+    /** Why an environment variable is the wrong shape for this key. */
+    readonly reason: string;
+    /** What would make this opt-out obsolete. An opt-out with no exit is a permanent excuse. */
+    readonly exitCriterion: string;
+}
+/** @public */
+interface EnvReachabilityInput {
+    /** Every configuration key the product declares. */
+    readonly keys: readonly string[];
+    /** The subset that an environment variable can set. */
+    readonly reachable: readonly string[];
+    /** Documented exemptions for keys that deliberately have no environment path. */
+    readonly optOuts: readonly EnvOptOut[];
+}
+/** @public */
+interface EnvReachabilityAudit {
+    /** Keys with neither an environment path nor a documented opt-out. */
+    readonly unreachable: readonly string[];
+    /** Opt-outs that exempt nothing: the key gained an environment path, or no longer exists. */
+    readonly staleOptOuts: readonly string[];
+}
+/**
+ * @returns both axes, in the order the caller declared them — a stable order so a failure message
+ *   does not change between runs for reasons unrelated to the code.
+ * @public
+ */
+declare function auditEnvReachability(input: EnvReachabilityInput): EnvReachabilityAudit;
+
 /**
  * `EventBus` — typed EventEmitter wrapper.
  *
@@ -2759,4 +2816,80 @@ interface TrustPosture<K extends string> {
 /** @public */
 declare function resolveTrustPosture<K extends string>(input: TrustPostureInput<K>): TrustPosture<K>;
 
-export { Agent, AgentBuilder, AgentDefinition, AgentDescription, AgentFactory, AgentOperationOptions, AgentOptions, type AgentPromptResult, type AgentRegistryOptions, type BatchItem, type BatchOptions, type BatchProgress, type BatchResult, Budget, BudgetHandle, BudgetOptions, BudgetSnapshot, BudgetTracker, CloudOptions, ContextSettings, type CounterBudgetTrackerOptions, CustomTool, type DeclaredLayer, type DeepPartial, type DefineProviderOptions, type DefineToolSpec, type DiagnosticsSink, type DreamingSweepOptions, type DreamingSweepResult, ErrorMetadata, EventBus, type EvictReason, GOAL_CONTINUATION_MARKER, GenerateObjectError, type GenerateObjectOptions, type GenerateObjectResult, GetAgentOptions, GetRunOptions, GoalEvent, type GoalLoopAgent, GoalOptions, GoalResult, InlineSkill, JobQueue, type JobQueueOptions, JudgeCredentialError, JudgeResult, LayerOrderError, type LayerValues, ListAgentsOptions, ListResult, ListRunsOptions, LiveAgentRegistry, LocalOptions, McpServerConfig, Memory, MemoryId, MemoryProvider, MemorySettings, type MigrateOptions, type MigrateResult, type ModelListItem, type ModelParameterDefinition, ModelSelection, type ModelVariant, NoopMemoryProvider, type NormalizedJsonSchema, PermissionEngine, type PermissionGate, type PermissionGateContext, type PermissionGateDecision, PermissionMode, PermissionPlugin, type PermissionPluginOptions, Plugin, PluginsSettings, PreToolCallDecision, Processor, Provider, ProviderProfile, ProviderRoutingSettings, Run, RunEventSink, RunResult, SDKAgent, SDKAgentInfo, SDKMessage, type SDKModel, SDKProvider, type SDKRepository, type SDKUser, SOVEREIGN_ENV_KEYS, Security, type SecurityFloorInput, type SessionMessage, type SessionMessagePart, type SessionScope, type ShareGptMessage, type ShareGptTrajectory, SkillReadTool, SkillsSettings, type SovereignEnvKey, Squad, type SquadOptions, type SquadRun, StreamObjectError, type StreamObjectEvent, type StreamObjectOptions, SystemPromptResolver, TASK_RESERVED_PREFIXES, Task, type TaskCancelResult, type TaskConfigureOptions, type TaskEvent, type TaskFilter, type TaskHandle, type TaskKind, type TaskState, type TaskStoreOptions, type TaskSubmitOptions, type TaskWorkContext, type TaskWorkFn, Theokit, TheokitAgentError, type TheokitRequestOptions, TokenLimiter, type TokenLimiterOptions, Tool, ToolError, ToolResultContentBlock, type TrustLevel, type TrustPosture, type TrustPostureInput, type TrustSource, UnicodeNormalizer, type UnicodeNormalizerOptions, UsageAccumulator, applySecurityFloor, chargeAndCheckThresholds, computeCost, createCounterBudgetTracker, estimateTokens, extractRawId, foldLayers, getPricingEntry, inferApiMode, isValidTaskId, loadProjectEnv, migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, preflightCheck, resolveTrustPosture, runGoalLoop, scopedConversationId, sessionScopePrefix, setDiagnosticsSink, toShareGptTrajectory, verifyLayerOrdering, withCwdMutex };
+/**
+ * Record what a build actually wired, as opposed to what configuration asked for.
+ *
+ * A product that reads a project directory decides, while building, which of that directory's
+ * entities it will honour: MCP servers, skills, hook events, commands. When a trust posture withholds
+ * them, the build simply proceeds with fewer — and every surface that later asks "what is loaded?"
+ * sees an empty list. Empty because nothing was configured and empty because everything was withheld
+ * are the same emptiness to the reader, and only one of them is something they can act on.
+ *
+ * ## Why this is not a re-read
+ *
+ * The obvious implementation of any "what is loaded?" listing is to read the configuration again.
+ * That is the defect this exists to prevent: a re-read cannot detect a disagreement between what
+ * config asked for and what the build did, because it IS the config. The two disagree exactly when
+ * something suppressed an entity, which is the case worth reporting.
+ *
+ * So this function is pure and parameterized. It performs no I/O, which is what makes "no second
+ * read" checkable rather than promised — the caller passes the values it handed to the builder, at
+ * the moment it handed them over, and what comes back is an observation of that moment.
+ *
+ * ## What is generic here, and what is not
+ *
+ * The RULE is generic: for each capability, active is the request when allowed and empty when not,
+ * and suppression is only claimed when something was actually removed. The VOCABULARY is not —
+ * which capabilities exist and what the entities are called belong to the product, and arrive as
+ * data.
+ *
+ * @public
+ */
+
+/** Raised when a recorded capability has no entry in the gate. @public */
+declare class UngatedCapabilityError extends TheokitAgentError {
+    readonly name = "UngatedCapabilityError";
+}
+/** What one capability asked for, and what it got. @public */
+interface WiredEntity {
+    /** The names actually handed to the builder. Empty when the capability was withheld. */
+    readonly active: readonly string[];
+    /**
+     * The names configuration ASKED for. Equal to `active` when nothing was withheld; the difference
+     * is exactly what the reader cannot otherwise see.
+     */
+    readonly requested: readonly string[];
+    /**
+     * True only when the gate is what emptied `active`.
+     *
+     * Deliberately false for a withheld capability that requested nothing: an untrusted directory with
+     * no skills and a trusted one with no skills are the same emptiness, and a flag that fires when
+     * nothing happened teaches the reader to ignore it.
+     */
+    readonly suppressedByTrust: boolean;
+}
+/** @public */
+interface WiringRecordInput<K extends string> {
+    /**
+     * The gate. Typically the output of `resolveTrustPosture`, which is what makes the name
+     * `suppressedByTrust` accurate rather than decorative — a posture is the only thing in this
+     * package that withholds a capability.
+     *
+     * It may gate MORE than `requested` covers: a posture also gates things that are not lists of
+     * names, like durable memory. Those are not entities and do not appear in the record.
+     */
+    readonly posture: {
+        readonly allows: Readonly<Record<string, boolean>>;
+    };
+    /** Per capability, the entity names the build was given. Drives which keys the record has. */
+    readonly requested: Readonly<Record<K, readonly string[]>>;
+}
+/**
+ * @returns one entry per key of `requested`, each a snapshot rather than a view of the caller's
+ *   arrays — the record is read long after the build, and aliasing would make it answer with what
+ *   the process holds now instead of with what was wired.
+ * @public
+ */
+declare function recordWiring<K extends string>(input: WiringRecordInput<K>): Readonly<Record<K, WiredEntity>>;
+
+export { Agent, AgentBuilder, AgentDefinition, AgentDescription, AgentFactory, AgentOperationOptions, AgentOptions, type AgentPromptResult, type AgentRegistryOptions, type BatchItem, type BatchOptions, type BatchProgress, type BatchResult, Budget, BudgetHandle, BudgetOptions, BudgetSnapshot, BudgetTracker, CloudOptions, ContextSettings, type CounterBudgetTrackerOptions, CustomTool, type DeclaredLayer, type DeepPartial, type DefineProviderOptions, type DefineToolSpec, type DiagnosticsSink, type DreamingSweepOptions, type DreamingSweepResult, type EnvOptOut, type EnvReachabilityAudit, type EnvReachabilityInput, ErrorMetadata, EventBus, type EvictReason, GOAL_CONTINUATION_MARKER, GenerateObjectError, type GenerateObjectOptions, type GenerateObjectResult, GetAgentOptions, GetRunOptions, GoalEvent, type GoalLoopAgent, GoalOptions, GoalResult, InlineSkill, JobQueue, type JobQueueOptions, JudgeCredentialError, JudgeResult, LayerOrderError, type LayerValues, ListAgentsOptions, ListResult, ListRunsOptions, LiveAgentRegistry, LocalOptions, McpServerConfig, Memory, MemoryId, MemoryProvider, MemorySettings, type MigrateOptions, type MigrateResult, type ModelListItem, type ModelParameterDefinition, ModelSelection, type ModelVariant, NoopMemoryProvider, type NormalizedJsonSchema, PermissionEngine, type PermissionGate, type PermissionGateContext, type PermissionGateDecision, PermissionMode, PermissionPlugin, type PermissionPluginOptions, Plugin, PluginsSettings, PreToolCallDecision, Processor, Provider, ProviderProfile, ProviderRoutingSettings, Run, RunEventSink, RunResult, SDKAgent, SDKAgentInfo, SDKMessage, type SDKModel, SDKProvider, type SDKRepository, type SDKUser, SOVEREIGN_ENV_KEYS, Security, type SecurityFloorInput, type SessionMessage, type SessionMessagePart, type SessionScope, type ShareGptMessage, type ShareGptTrajectory, SkillReadTool, SkillsSettings, type SovereignEnvKey, Squad, type SquadOptions, type SquadRun, StreamObjectError, type StreamObjectEvent, type StreamObjectOptions, SystemPromptResolver, TASK_RESERVED_PREFIXES, Task, type TaskCancelResult, type TaskConfigureOptions, type TaskEvent, type TaskFilter, type TaskHandle, type TaskKind, type TaskState, type TaskStoreOptions, type TaskSubmitOptions, type TaskWorkContext, type TaskWorkFn, Theokit, TheokitAgentError, type TheokitRequestOptions, TokenLimiter, type TokenLimiterOptions, Tool, ToolError, ToolResultContentBlock, type TrustLevel, type TrustPosture, type TrustPostureInput, type TrustSource, UngatedCapabilityError, UnicodeNormalizer, type UnicodeNormalizerOptions, UsageAccumulator, type WiredEntity, type WiringRecordInput, applySecurityFloor, auditEnvReachability, chargeAndCheckThresholds, computeCost, createCounterBudgetTracker, estimateTokens, extractRawId, foldLayers, getPricingEntry, inferApiMode, isValidTaskId, loadProjectEnv, migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, preflightCheck, recordWiring, resolveTrustPosture, runGoalLoop, scopedConversationId, sessionScopePrefix, setDiagnosticsSink, toShareGptTrajectory, verifyLayerOrdering, withCwdMutex };

package/dist/index.js

@@ -664,6 +664,17 @@ var SkillReadTool = class {
   }
 };
 
+// src/env-reachability.ts
+function auditEnvReachability(input) {
+  const reachable = new Set(input.reachable);
+  const exempt = new Set(input.optOuts.map((o) => o.key));
+  const declared = new Set(input.keys);
+  return {
+    unreachable: input.keys.filter((k) => !reachable.has(k) && !exempt.has(k)),
+    staleOptOuts: input.optOuts.filter((o) => !declared.has(o.key) || reachable.has(o.key)).map((o) => o.key)
+  };
+}
+
 // src/event-bus.ts
 var EventBus = class {
   handlers = /* @__PURE__ */ new Map();
@@ -2200,6 +2211,29 @@ function resolveTrustPosture(input) {
   return { level, source, allows };
 }
 
-export { AgentFactory, Budget, EventBus, JobQueue, LayerOrderError, Memory, NoopMemoryProvider, PermissionEngine, PermissionPlugin, Plugin, Provider, SOVEREIGN_ENV_KEYS, Security, Skill, SkillReadTool, Squad, Task, Theokit, TokenLimiter, UnicodeNormalizer, applyMode, applySecurityFloor, chargeAndCheckThresholds, createCounterBudgetTracker, estimateTokens, extractRawId, foldLayers, inferApiMode, loadProjectEnv, migrateSqliteToLance2 as migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, preflightCheck, resolveTrustPosture, runGoalLoop, scopedConversationId, sessionScopePrefix, toShareGptTrajectory, verifyLayerOrdering };
+// src/wiring-record.ts
+var UngatedCapabilityError = class extends TheokitAgentError {
+  name = "UngatedCapabilityError";
+};
+function recordWiring(input) {
+  const record = {};
+  for (const [capability, requested] of Object.entries(input.requested)) {
+    const allowed = input.posture.allows[capability];
+    if (allowed === void 0) {
+      throw new UngatedCapabilityError(
+        `capability \`${capability}\` was recorded as wired but the posture does not gate it; gated capabilities are: ${Object.keys(input.posture.allows).join(", ") || "(none)"}`
+      );
+    }
+    record[capability] = {
+      // Copied, not aliased. See the @returns note.
+      active: allowed ? [...requested] : [],
+      requested: [...requested],
+      suppressedByTrust: !allowed && requested.length > 0
+    };
+  }
+  return record;
+}
+
+export { AgentFactory, Budget, EventBus, JobQueue, LayerOrderError, Memory, NoopMemoryProvider, PermissionEngine, PermissionPlugin, Plugin, Provider, SOVEREIGN_ENV_KEYS, Security, Skill, SkillReadTool, Squad, Task, Theokit, TokenLimiter, UngatedCapabilityError, UnicodeNormalizer, applyMode, applySecurityFloor, auditEnvReachability, chargeAndCheckThresholds, createCounterBudgetTracker, estimateTokens, extractRawId, foldLayers, inferApiMode, loadProjectEnv, migrateSqliteToLance2 as migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, preflightCheck, recordWiring, resolveTrustPosture, runGoalLoop, scopedConversationId, sessionScopePrefix, toShareGptTrajectory, verifyLayerOrdering };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map