@theokit/sdk 4.50.0 → 4.51.0

package/dist/index.js

@@ -3,13 +3,13 @@ export { JudgeCredentialError } from './chunk-PAV4ZPSW.js';
 export { StreamObjectError } from './chunk-3KY7MHR4.js';
 export { GenerateObjectError } from './chunk-35NFZ7QB.js';
 import './chunk-O3IZ7JEL.js';
-import { Workflow, agentStep } from './chunk-EON4YTR6.js';
+import { Workflow, agentStep } from './chunk-R2A3WIJY.js';
 import './chunk-HK4HRLWE.js';
 import './chunk-CAH3G4IS.js';
-export { Cron } from './chunk-MZQHVN7C.js';
-import { MEMORY_EMBEDDING_ADAPTERS, resolveApiKey, DEFAULT_AGENTIC_MODEL_ID, Agent } from './chunk-XARLSCKA.js';
-export { Agent, AgentBuilder, Tool, ToolError, UsageAccumulator, computeCost, getPricingEntry } from './chunk-XARLSCKA.js';
-import './chunk-UJ7HK7BX.js';
+export { Cron } from './chunk-SEZJGV7C.js';
+import { MEMORY_EMBEDDING_ADAPTERS, resolveApiKey, DEFAULT_AGENTIC_MODEL_ID, Agent } from './chunk-ACHVCIDQ.js';
+export { Agent, AgentBuilder, Tool, ToolError, UsageAccumulator, computeCost, getPricingEntry } from './chunk-ACHVCIDQ.js';
+import './chunk-VK7SIDYI.js';
 import './chunk-2SFBB54R.js';
 import { configure, submit, list, get, cancel, subscribe } from './chunk-GNMPCZNN.js';
 export { emitRunEvent } from './chunk-GNMPCZNN.js';
@@ -19,10 +19,10 @@ import { discoverProviderPlugins, shouldUseFixtureMode, isFixtureApiKey, httpReq
 import './chunk-4QEC4CCS.js';
 import './chunk-F4RUADRC.js';
 import './chunk-ZTEAJAE6.js';
-import { lanceStoragePath, LanceIndex, readFactsFromMarkdown, defaultIndexPath, openMemoryDb, memoryDir } from './chunk-RJBHWM6D.js';
+import { lanceStoragePath, LanceIndex, readFactsFromMarkdown, defaultIndexPath, openMemoryDb, memoryDir } from './chunk-E54KDYOE.js';
 import './chunk-J5RW43IR.js';
 import './chunk-AM2CNBKE.js';
-import './chunk-3NLOQEJR.js';
+import './chunk-34XOCZJO.js';
 import './chunk-ZS6SLELQ.js';
 import './chunk-LLE7HPRI.js';
 import './chunk-SNKY3C2L.js';
@@ -50,15 +50,16 @@ import { parseModelId } from './chunk-X2FR4OIT.js';
 import { registerBuiltins, listProviders, getCatalogCapabilities, getProviderProfile } from './chunk-Z6N6SDNR.js';
 import './chunk-L4JFQCG4.js';
 import './chunk-5NBUH3NO.js';
-import './chunk-2S6B5B2A.js';
-import './chunk-6FSQ3CHQ.js';
+import './chunk-E7WDXT4X.js';
+import './chunk-JGYYNDAZ.js';
+import './chunk-RIAM53CP.js';
 import './chunk-OLLOUAUJ.js';
 import { BudgetExceededError, TheokitAgentError, MemoryAdapterError, AuthenticationError, ConfigurationError } from './chunk-MRKSSN36.js';
 export { AgentDisposedError, AgentRunError, AuthenticationError, BudgetExceededError, ConfigurationError, IntegrationNotConnectedError, InvalidTaskIdError, MemoryAdapterError, NetworkError, RateLimitError, TaskNotFoundError, TheokitAgentError, UnknownAgentError, UnsupportedBudgetOperationError, UnsupportedRunOperationError, UnsupportedTaskOperationError, isTransientError } from './chunk-MRKSSN36.js';
 import { diag, redactSecrets, addPattern } from './chunk-PBML2FHN.js';
 export { setDiagnosticsSink } from './chunk-PBML2FHN.js';
+import { createHash, randomUUID } from 'crypto';
 import { z } from 'zod';
-import { randomUUID, createHash } from 'crypto';
 import { mkdir, readFile } from 'fs/promises';
 import { join } from 'path';
 import { existsSync, rmSync, mkdirSync, renameSync } from 'fs';
@@ -106,6 +107,39 @@ var AgentFactory = class {
   }
 };
 
+// src/approval-policy.ts
+var BY_MODE = {
+  ask: { outcome: "ask", reason: "mode-ask" },
+  "never-ask": { outcome: "allow", reason: "mode-never-ask" },
+  "refuse-all": { outcome: "deny", reason: "mode-refuse-all" }
+};
+function decideApproval(input) {
+  const { tool } = input;
+  if ((input.denied ?? []).includes(tool)) {
+    return { outcome: "deny", reason: "explicitly-denied", tool };
+  }
+  if ((input.allowed ?? []).includes(tool)) {
+    return { outcome: "allow", reason: "explicitly-allowed", tool };
+  }
+  const fromMode = BY_MODE[input.mode];
+  return { outcome: fromMode.outcome, reason: fromMode.reason, tool };
+}
+
+// src/blast-radius.ts
+function evaluateBlastRadius(input) {
+  const { scope, reversible } = input.action;
+  if (scope.length === 0) {
+    return { outcome: "refuse", reason: "scope-undeclared", scope };
+  }
+  if (!input.granted.includes(scope)) {
+    return { outcome: "refuse", reason: "scope-not-granted", scope };
+  }
+  if (!reversible && !(input.irreversibleAllowed ?? []).includes(scope)) {
+    return { outcome: "require-approval", reason: "irreversible", scope };
+  }
+  return { outcome: "allow", reason: "within-granted-scope", scope };
+}
+
 // src/internal/budget/calendar-window.ts
 function startOfDayUtc(now = /* @__PURE__ */ new Date()) {
   return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()));
@@ -571,6 +605,18 @@ var Skill = class {
     return createSkill(spec);
   }
 };
+function describeCredential(input) {
+  const secret = (input.value ?? "").trim();
+  if (secret.length === 0) {
+    return { provider: input.provider, present: false, source: input.source };
+  }
+  return {
+    provider: input.provider,
+    present: true,
+    source: input.source,
+    fingerprint: createHash("sha256").update(secret).digest("hex").slice(0, 8)
+  };
+}
 
 // src/define-provider.ts
 function defineProvider(profile, opts) {
@@ -1217,7 +1263,7 @@ var Memory = {
       openArgs.embedding = await resolveEmbedding(opts.embedding, peer.MEMORY_EMBEDDING_ADAPTERS);
       return await peer.IndexManager.open(openArgs);
     }
-    const { IndexManager } = await import('./index-manager-X5IPG2JL.js');
+    const { IndexManager } = await import('./index-manager-OMJVYS2U.js');
     openArgs.embedding = await resolveEmbedding(opts.embedding, MEMORY_EMBEDDING_ADAPTERS);
     return await IndexManager.open(openArgs);
   },
@@ -1758,6 +1804,28 @@ function applySecurityFloor(input) {
   return input.layers[input.override] ?? tightenOnly(input, baseline(input));
 }
 
+// src/session-guard.ts
+var LiveSessionError = class extends TheokitAgentError {
+  name = "LiveSessionError";
+  sessionId;
+  reason;
+  constructor(sessionId, reason) {
+    super(
+      reason === "session-is-live" ? `refusing to destroy session ${sessionId}: it is live \u2014 another process is probably still appending to it. Switch to another session first.` : `refusing to destroy session ${sessionId}: the set of live sessions could not be determined, so this cannot be shown to be safe. Resolve that before deleting.`
+    );
+    this.sessionId = sessionId;
+    this.reason = reason;
+  }
+};
+function guardSessionDestruction(sessionId, live) {
+  if (live === void 0) {
+    throw new LiveSessionError(sessionId, "liveness-undetermined");
+  }
+  if (live.includes(sessionId)) {
+    throw new LiveSessionError(sessionId, "session-is-live");
+  }
+}
+
 // src/session-scope.ts
 function scopedConversationId(scope, id) {
   return `${scope}__${id}`;
@@ -1771,7 +1839,7 @@ function isBuiltAgent(m) {
   return typeof m.send === "function";
 }
 async function materialize(def, index) {
-  const { Agent: Agent2 } = await import('./agent-GKX5FE5K.js');
+  const { Agent: Agent2 } = await import('./agent-DI2QQHSJ.js');
   return Agent2.create({
     // `AgentDefinition.model` admits the sentinel `'inherit'`, which is not a model id. Inheriting
     // here means "declare nothing and let the default apply" — forwarding the literal would create
@@ -2161,6 +2229,23 @@ async function executeCatalogRequest(request) {
   return httpRequest(request.path, { apiKey });
 }
 
+// src/tool-blast-radius.ts
+var DECLARED = /* @__PURE__ */ Symbol.for("@theokit/sdk.blastRadius");
+function withBlastRadius(tool, action) {
+  return Object.defineProperty(tool, DECLARED, {
+    value: action,
+    // `enumerable: false` is defensive and NOT load-bearing — checked, not assumed. Flipping it to
+    // true leaves every case green, because the symbol key already excludes this from `Object.keys`
+    // and `JSON.stringify`. It stays because a future string-keyed variant would need it, and the
+    // next reader should not have to discover that the flag has no test behind it.
+    enumerable: false,
+    configurable: true
+  });
+}
+function describeAction(tool) {
+  return tool[DECLARED];
+}
+
 // src/trajectory-helpers.ts
 function toShareGptTrajectory(result, options) {
   if (!result.ok) return null;
@@ -2288,6 +2373,6 @@ function recordWiring(input) {
   return record;
 }
 
-export { AgentFactory, Budget, EventBus, JobQueue, LayerOrderError, Memory, NoopMemoryProvider, PermissionEngine, PermissionPlugin, Plugin, Provider, RetentionPolicyError, SOVEREIGN_ENV_KEYS, Security, Skill, SkillReadTool, Squad, Task, Theokit, TokenLimiter, UngatedCapabilityError, UnicodeNormalizer, applyMode, applySecurityFloor, auditEnvReachability, chargeAndCheckThresholds, createCounterBudgetTracker, estimateTokens, extractRawId, foldLayers, inferApiMode, loadProjectEnv, migrateSqliteToLance2 as migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, planReaping, preflightCheck, recordWiring, resolveTrustPosture, runGoalLoop, scopedConversationId, sessionScopePrefix, toShareGptTrajectory, verifyLayerOrdering };
+export { AgentFactory, Budget, EventBus, JobQueue, LayerOrderError, LiveSessionError, Memory, NoopMemoryProvider, PermissionEngine, PermissionPlugin, Plugin, Provider, RetentionPolicyError, SOVEREIGN_ENV_KEYS, Security, Skill, SkillReadTool, Squad, Task, Theokit, TokenLimiter, UngatedCapabilityError, UnicodeNormalizer, applyMode, applySecurityFloor, auditEnvReachability, chargeAndCheckThresholds, createCounterBudgetTracker, decideApproval, describeAction, describeCredential, estimateTokens, evaluateBlastRadius, extractRawId, foldLayers, guardSessionDestruction, inferApiMode, loadProjectEnv, migrateSqliteToLance2 as migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, planReaping, preflightCheck, recordWiring, resolveTrustPosture, runGoalLoop, scopedConversationId, sessionScopePrefix, toShareGptTrajectory, verifyLayerOrdering, withBlastRadius };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map