@theokit/sdk 4.50.0 → 4.51.1

package/dist/index.cjs

@@ -1,31 +1,31 @@
 'use strict';
 
 var chunkOBA6YK2R_cjs = require('./chunk-OBA6YK2R.cjs');
-var chunkUJMEWGO6_cjs = require('./chunk-UJMEWGO6.cjs');
-var chunk57KX5WTP_cjs = require('./chunk-57KX5WTP.cjs');
-var chunkGC44RATP_cjs = require('./chunk-GC44RATP.cjs');
-require('./chunk-WIGJGFH4.cjs');
-var chunkJO76RWCA_cjs = require('./chunk-JO76RWCA.cjs');
-require('./chunk-RBQYHEZD.cjs');
+var chunkBWGXYOBZ_cjs = require('./chunk-BWGXYOBZ.cjs');
+var chunkV45L2OYP_cjs = require('./chunk-V45L2OYP.cjs');
+var chunkK42QGAKM_cjs = require('./chunk-K42QGAKM.cjs');
+require('./chunk-EUBGGYPH.cjs');
+var chunkZ5U2JGEK_cjs = require('./chunk-Z5U2JGEK.cjs');
+require('./chunk-FBZMSLDC.cjs');
 require('./chunk-PNVDQL5Y.cjs');
-var chunk74VVGK7P_cjs = require('./chunk-74VVGK7P.cjs');
-var chunkTSK4VVBW_cjs = require('./chunk-TSK4VVBW.cjs');
-require('./chunk-FAUKVJCC.cjs');
+var chunk2S7IB4O3_cjs = require('./chunk-2S7IB4O3.cjs');
+var chunkXI4L45SS_cjs = require('./chunk-XI4L45SS.cjs');
+require('./chunk-3BKWFISQ.cjs');
 require('./chunk-BV2MWEMV.cjs');
-var chunkKCQUYQ3V_cjs = require('./chunk-KCQUYQ3V.cjs');
+var chunk6DCTL32L_cjs = require('./chunk-6DCTL32L.cjs');
 require('./chunk-BUUUWQMB.cjs');
-require('./chunk-NRA36JKG.cjs');
-var chunkQFFNMJAS_cjs = require('./chunk-QFFNMJAS.cjs');
+require('./chunk-OI6RHLGC.cjs');
+var chunkN6NUMXAJ_cjs = require('./chunk-N6NUMXAJ.cjs');
 require('./chunk-4JBHSLQO.cjs');
-require('./chunk-HLNLYLNN.cjs');
-require('./chunk-FZ4YMZA3.cjs');
-var chunkGH52NOCL_cjs = require('./chunk-GH52NOCL.cjs');
-require('./chunk-HECR7KF5.cjs');
+require('./chunk-RAACTJ7C.cjs');
+require('./chunk-3R4ZCQAZ.cjs');
+var chunkEQMLJ52C_cjs = require('./chunk-EQMLJ52C.cjs');
+require('./chunk-3YYDHUNH.cjs');
 require('./chunk-BBZYXVLZ.cjs');
-require('./chunk-UU7MAO2D.cjs');
-require('./chunk-6X2HUT4A.cjs');
-require('./chunk-7PESI6YD.cjs');
-require('./chunk-S4Q5OMIK.cjs');
+require('./chunk-OKLYRPKL.cjs');
+require('./chunk-CZHPR2G7.cjs');
+require('./chunk-ADVZIC43.cjs');
+require('./chunk-E3OCRJU6.cjs');
 require('./chunk-2RW7K6FN.cjs');
 require('./chunk-MUUQ2WFJ.cjs');
 require('./chunk-6JSIEDKL.cjs');
@@ -33,29 +33,30 @@ require('./chunk-B4YA6BRS.cjs');
 require('./chunk-NINIJCHU.cjs');
 require('./chunk-L5YO6PWL.cjs');
 require('./chunk-VJ26EKGJ.cjs');
-require('./chunk-OEFFPR2S.cjs');
-require('./chunk-27DYRARU.cjs');
-require('./chunk-JA4FEA5Z.cjs');
-require('./chunk-WCXOKGOQ.cjs');
-require('./chunk-6W4U2G3J.cjs');
-require('./chunk-BV42CCRP.cjs');
+require('./chunk-KNZU4YO5.cjs');
+require('./chunk-NFATC6ZF.cjs');
+require('./chunk-T6QUCG7L.cjs');
+require('./chunk-ECPL5RV6.cjs');
+require('./chunk-SDJYLCJK.cjs');
+require('./chunk-QLAWEGTZ.cjs');
 var chunkYLQQX5W2_cjs = require('./chunk-YLQQX5W2.cjs');
-require('./chunk-XR4LPBXH.cjs');
+require('./chunk-7HQVDLFI.cjs');
 var chunkWJVHMTKB_cjs = require('./chunk-WJVHMTKB.cjs');
-var chunkNETYW4V3_cjs = require('./chunk-NETYW4V3.cjs');
-require('./chunk-X2YQP452.cjs');
-require('./chunk-NNNUQELM.cjs');
+var chunk2CFEET3Y_cjs = require('./chunk-2CFEET3Y.cjs');
+require('./chunk-RTLUZKDL.cjs');
+require('./chunk-AMYY3JHQ.cjs');
 var chunkVYHJZVL5_cjs = require('./chunk-VYHJZVL5.cjs');
-var chunkGLEKLAUW_cjs = require('./chunk-GLEKLAUW.cjs');
-require('./chunk-4JRRFRV4.cjs');
+var chunkT6ZCG5AP_cjs = require('./chunk-T6ZCG5AP.cjs');
+require('./chunk-XK54DTRF.cjs');
 require('./chunk-C6Y6CWYD.cjs');
-require('./chunk-64TJCXY5.cjs');
-require('./chunk-XA3TSBAH.cjs');
-require('./chunk-BRHRQOJA.cjs');
-var chunkYULF6FPB_cjs = require('./chunk-YULF6FPB.cjs');
-var chunkZHPET3LZ_cjs = require('./chunk-ZHPET3LZ.cjs');
-var zod = require('zod');
+require('./chunk-FUASIT3E.cjs');
+require('./chunk-YTO5BRBD.cjs');
+require('./chunk-VKJ7V7EB.cjs');
+require('./chunk-44IISBRZ.cjs');
+var chunk2YGIBOUH_cjs = require('./chunk-2YGIBOUH.cjs');
+var chunkSXSPMRSV_cjs = require('./chunk-SXSPMRSV.cjs');
 var crypto = require('crypto');
+var zod = require('zod');
 var promises = require('fs/promises');
 var path = require('path');
 var fs = require('fs');
@@ -63,8 +64,8 @@ var fs = require('fs');
 // src/agent-factory.ts
 function createAgentFactory(common) {
   return {
-    forSession: (agentId, overrides) => chunkTSK4VVBW_cjs.Agent.create(mergeAgentOptions(common, overrides, agentId)),
-    getOrCreate: (agentId, overrides) => chunkTSK4VVBW_cjs.Agent.getOrCreate(agentId, mergeAgentOptions(common, overrides, agentId))
+    forSession: (agentId, overrides) => chunkXI4L45SS_cjs.Agent.create(mergeAgentOptions(common, overrides, agentId)),
+    getOrCreate: (agentId, overrides) => chunkXI4L45SS_cjs.Agent.getOrCreate(agentId, mergeAgentOptions(common, overrides, agentId))
   };
 }
 function mergeAgentOptions(common, overrides, agentId) {
@@ -103,6 +104,39 @@ var AgentFactory = class {
   }
 };
 
+// src/approval-policy.ts
+var BY_MODE = {
+  ask: { outcome: "ask", reason: "mode-ask" },
+  "never-ask": { outcome: "allow", reason: "mode-never-ask" },
+  "refuse-all": { outcome: "deny", reason: "mode-refuse-all" }
+};
+function decideApproval(input) {
+  const { tool } = input;
+  if ((input.denied ?? []).includes(tool)) {
+    return { outcome: "deny", reason: "explicitly-denied", tool };
+  }
+  if ((input.allowed ?? []).includes(tool)) {
+    return { outcome: "allow", reason: "explicitly-allowed", tool };
+  }
+  const fromMode = BY_MODE[input.mode];
+  return { outcome: fromMode.outcome, reason: fromMode.reason, tool };
+}
+
+// src/blast-radius.ts
+function evaluateBlastRadius(input) {
+  const { scope, reversible } = input.action;
+  if (scope.length === 0) {
+    return { outcome: "refuse", reason: "scope-undeclared", scope };
+  }
+  if (!input.granted.includes(scope)) {
+    return { outcome: "refuse", reason: "scope-not-granted", scope };
+  }
+  if (!reversible && !(input.irreversibleAllowed ?? []).includes(scope)) {
+    return { outcome: "require-approval", reason: "irreversible", scope };
+  }
+  return { outcome: "allow", reason: "within-granted-scope", scope };
+}
+
 // src/internal/budget/calendar-window.ts
 function startOfDayUtc(now = /* @__PURE__ */ new Date()) {
   return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()));
@@ -185,12 +219,12 @@ var NAME_GRAMMAR = /^[a-z0-9][a-z0-9_-]*$/;
 var registry = /* @__PURE__ */ new Map();
 function validateBudgetName(name) {
   if (typeof name !== "string" || name.length === 0) {
-    throw new chunkYULF6FPB_cjs.ConfigurationError("Budget name must be a non-empty string", {
+    throw new chunk2YGIBOUH_cjs.ConfigurationError("Budget name must be a non-empty string", {
       code: "invalid_budget_name"
     });
   }
   if (!NAME_GRAMMAR.test(name)) {
-    throw new chunkYULF6FPB_cjs.ConfigurationError(
+    throw new chunk2YGIBOUH_cjs.ConfigurationError(
       `Budget name "${name}" must match ^[a-z0-9][a-z0-9_-]*$ (lowercase + dash/underscore, start alphanumeric)`,
       { code: "invalid_budget_name" }
     );
@@ -199,7 +233,7 @@ function validateBudgetName(name) {
 function createBudget(opts) {
   validateBudgetName(opts.name);
   if (registry.has(opts.name)) {
-    throw new chunkYULF6FPB_cjs.ConfigurationError(`Budget "${opts.name}" already exists`, {
+    throw new chunk2YGIBOUH_cjs.ConfigurationError(`Budget "${opts.name}" already exists`, {
       code: "invalid_budget_name"
     });
   }
@@ -263,7 +297,7 @@ function preflightCheck(name, estimatedUsd) {
   for (const lim of opts.limits) {
     const currentSpent = spentIn(opts.name, lim.window);
     if (currentSpent + estimatedUsd > lim.limitUsd) {
-      throw new chunkYULF6FPB_cjs.BudgetExceededError({
+      throw new chunk2YGIBOUH_cjs.BudgetExceededError({
         budgetName: opts.name,
         window: lim.window,
         spentUsd: currentSpent + estimatedUsd,
@@ -276,7 +310,7 @@ function preflightCheck(name, estimatedUsd) {
 async function chargeAndCheckThresholds(name, actualUsd) {
   const opts = getBudgetOptionsRaw(name);
   if (opts === void 0) {
-    chunkZHPET3LZ_cjs.diag(
+    chunkSXSPMRSV_cjs.diag(
       `[budget] charge for deleted budget "${name}" is a no-op (was the budget removed during in-flight send?)
 `
     );
@@ -319,14 +353,14 @@ async function dispatchThreshold(opts, window, spentUsd, limitUsd, threshold) {
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    chunkZHPET3LZ_cjs.diag(`[budget] onThreshold callback threw: ${msg}
+    chunkSXSPMRSV_cjs.diag(`[budget] onThreshold callback threw: ${msg}
 `);
   }
 }
 async function dispatchExceed(opts, window, spentUsd, limitUsd, mode) {
   if (opts.onExceed === void 0) {
     if (mode === "warn") {
-      chunkZHPET3LZ_cjs.diag(
+      chunkSXSPMRSV_cjs.diag(
         `[budget] "${opts.name}" exceeded ${window} limit: $${spentUsd.toFixed(4)} > $${limitUsd.toFixed(4)}
 `
       );
@@ -343,7 +377,7 @@ async function dispatchExceed(opts, window, spentUsd, limitUsd, mode) {
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    chunkZHPET3LZ_cjs.diag(`[budget] onExceed callback threw: ${msg}
+    chunkSXSPMRSV_cjs.diag(`[budget] onExceed callback threw: ${msg}
 `);
   }
 }
@@ -568,6 +602,18 @@ var Skill = class {
     return createSkill(spec);
   }
 };
+function describeCredential(input) {
+  const secret = (input.value ?? "").trim();
+  if (secret.length === 0) {
+    return { provider: input.provider, present: false, source: input.source };
+  }
+  return {
+    provider: input.provider,
+    present: true,
+    source: input.source,
+    fingerprint: crypto.createHash("sha256").update(secret).digest("hex").slice(0, 8)
+  };
+}
 
 // src/define-provider.ts
 function defineProvider(profile, opts) {
@@ -593,8 +639,8 @@ var Provider = class _Provider {
    * `.plugins(Provider.builtins())` once, then pick a `provider/model` id. @public
    */
   static builtins() {
-    chunkGLEKLAUW_cjs.registerBuiltins();
-    return chunkGLEKLAUW_cjs.listProviders().map((profile) => defineProvider(profile));
+    chunkT6ZCG5AP_cjs.registerBuiltins();
+    return chunkT6ZCG5AP_cjs.listProviders().map((profile) => defineProvider(profile));
   }
   /**
    * The builtin serving `modelId`, or `undefined` when none does.
@@ -708,7 +754,7 @@ var EventBus = class {
       } catch (cause) {
         this.#handlerErrorCount += 1;
         const message = cause instanceof Error ? cause.message : String(cause);
-        chunkZHPET3LZ_cjs.diag(`[theokit-sdk] event-bus: handler for "${String(event)}" threw: ${message}
+        chunkSXSPMRSV_cjs.diag(`[theokit-sdk] event-bus: handler for "${String(event)}" threw: ${message}
 `);
       }
     }
@@ -731,7 +777,7 @@ function runGoalLoop(agent, goal, options, depsOverride) {
   async function* wrap() {
     const { runUntilImpl } = await import('./run-until-U2B5FJJI.cjs');
     const deps = depsOverride ?? await (async () => {
-      const { judgeCallImpl } = await import('./judge-call-J5EETJL3.cjs');
+      const { judgeCallImpl } = await import('./judge-call-GVIJWQVE.cjs');
       const { getAgentFacade } = await import('./agent-factory-registry-UU46BUMU.cjs');
       const create = getAgentFacade().create;
       return {
@@ -932,7 +978,7 @@ var JobQueue = class {
 };
 
 // src/layer-fold.ts
-var LayerOrderError = class extends chunkYULF6FPB_cjs.TheokitAgentError {
+var LayerOrderError = class extends chunk2YGIBOUH_cjs.TheokitAgentError {
   name = "LayerOrderError";
 };
 function verifyLayerOrdering(layers) {
@@ -967,7 +1013,7 @@ function foldLayers(entries, accumulatingKeys = []) {
   return combined;
 }
 function diaryPath(cwd) {
-  return path.join(chunkGH52NOCL_cjs.memoryDir(cwd), "dream-diary.md");
+  return path.join(chunkEQMLJ52C_cjs.memoryDir(cwd), "dream-diary.md");
 }
 function renderDiaryEntry(entry) {
   const stamp = new Date(entry.timestampMs).toISOString();
@@ -994,7 +1040,7 @@ async function appendDiaryEntry(cwd, entry) {
   }
   const next = `${raw.endsWith("\n") ? raw : `${raw}
 `}${renderDiaryEntry(entry)}`;
-  await chunkNETYW4V3_cjs.replaceFileAtomic(path, next);
+  await chunk2CFEET3Y_cjs.replaceFileAtomic(path, next);
 }
 function entryHash(entry) {
   return crypto.createHash("sha256").update(
@@ -1114,7 +1160,7 @@ async function runInner(options) {
   const now = options.now ?? Date.now;
   const timestampMs = now();
   try {
-    const facts = await chunkGH52NOCL_cjs.readFactsFromMarkdown(options.cwd);
+    const facts = await chunkEQMLJ52C_cjs.readFactsFromMarkdown(options.cwd);
     if (facts.length === 0) {
       return emptyResult("skipped");
     }
@@ -1141,19 +1187,19 @@ async function runInner(options) {
     return result;
   } catch (cause) {
     const message = cause instanceof Error ? cause.message : String(cause);
-    chunkZHPET3LZ_cjs.diag(`[theokit-sdk] dreaming sweep failed: ${message}
+    chunkSXSPMRSV_cjs.diag(`[theokit-sdk] dreaming sweep failed: ${message}
 `);
     return emptyResult("error");
   }
 }
 async function writeConsolidatedNotes(cwd, clusters, timestampMs) {
   if (clusters.length === 0) return 0;
-  const notesDir = path.join(chunkGH52NOCL_cjs.memoryDir(cwd), "notes");
+  const notesDir = path.join(chunkEQMLJ52C_cjs.memoryDir(cwd), "notes");
   await promises.mkdir(notesDir, { recursive: true });
   const isoSlug = new Date(timestampMs).toISOString().replace(/[^\dT]/g, "-");
   const file = path.join(notesDir, `dreamed-${isoSlug}.md`);
   const body = deepPhase(clusters, timestampMs);
-  await chunkNETYW4V3_cjs.replaceFileAtomic(file, body);
+  await chunk2CFEET3Y_cjs.replaceFileAtomic(file, body);
   return 1;
 }
 function emptyResult(status) {
@@ -1214,8 +1260,8 @@ var Memory = {
       openArgs.embedding = await resolveEmbedding(opts.embedding, peer.MEMORY_EMBEDDING_ADAPTERS);
       return await peer.IndexManager.open(openArgs);
     }
-    const { IndexManager } = await import('./index-manager-YFFEPISE.cjs');
-    openArgs.embedding = await resolveEmbedding(opts.embedding, chunkTSK4VVBW_cjs.MEMORY_EMBEDDING_ADAPTERS);
+    const { IndexManager } = await import('./index-manager-HGGL4DD5.cjs');
+    openArgs.embedding = await resolveEmbedding(opts.embedding, chunkXI4L45SS_cjs.MEMORY_EMBEDDING_ADAPTERS);
     return await IndexManager.open(openArgs);
   },
   /**
@@ -1226,7 +1272,7 @@ var Memory = {
    */
   async runDreamingSweep(opts) {
     const peer = await tryLoadSdkMemoryPeer();
-    const catalog = peer !== null ? peer.MEMORY_EMBEDDING_ADAPTERS : chunkTSK4VVBW_cjs.MEMORY_EMBEDDING_ADAPTERS;
+    const catalog = peer !== null ? peer.MEMORY_EMBEDDING_ADAPTERS : chunkXI4L45SS_cjs.MEMORY_EMBEDDING_ADAPTERS;
     const sweepArgs = await buildDreamingSweepArgs(opts, catalog);
     const result = peer !== null ? (
       // biome-ignore lint/suspicious/noExplicitAny: peer is dynamically loaded — structural compat ensured by sdk-memory
@@ -1284,7 +1330,7 @@ function extractRawId(id, expectedAdapterId) {
   const prefix = `${expectedAdapterId}:`;
   if (!id.startsWith(prefix)) {
     const sourcePrefix = id.split(":", 1)[0] ?? "<malformed>";
-    throw new chunkYULF6FPB_cjs.MemoryAdapterError(
+    throw new chunk2YGIBOUH_cjs.MemoryAdapterError(
       `MemoryId belongs to a different adapter (expected "${expectedAdapterId}", got "${sourcePrefix}")`,
       { adapterId: expectedAdapterId, code: "invalid_input" }
     );
@@ -1292,9 +1338,9 @@ function extractRawId(id, expectedAdapterId) {
   return id.slice(prefix.length);
 }
 async function readAllSqliteFacts(cwd) {
-  const dbPath = chunkGH52NOCL_cjs.defaultIndexPath(cwd);
+  const dbPath = chunkEQMLJ52C_cjs.defaultIndexPath(cwd);
   if (!fs.existsSync(dbPath)) return [];
-  const db = await chunkGH52NOCL_cjs.openMemoryDb({ filePath: dbPath });
+  const db = await chunkEQMLJ52C_cjs.openMemoryDb({ filePath: dbPath });
   try {
     const stmt = db.prepare("SELECT id, path, source, start_line, end_line, text FROM chunks");
     const rows = stmt.all();
@@ -1313,12 +1359,12 @@ function nfcEqual(a, b) {
 }
 async function migrateSqliteToLance(opts) {
   const cwd = opts.cwd;
-  const finalPath = chunkGH52NOCL_cjs.lanceStoragePath(cwd);
+  const finalPath = chunkEQMLJ52C_cjs.lanceStoragePath(cwd);
   const newPath = path.join(cwd, ".theokit", "memory", "lance-new");
   const rawLog = opts.logger ?? ((m) => console.log(m));
-  const log = (m) => rawLog(chunkZHPET3LZ_cjs.redactSecrets(m));
+  const log = (m) => rawLog(chunkSXSPMRSV_cjs.redactSecrets(m));
   if (fs.existsSync(finalPath)) {
-    throw new chunkYULF6FPB_cjs.ConfigurationError(
+    throw new chunk2YGIBOUH_cjs.ConfigurationError(
       `Destination already exists: ${finalPath}. Remove it manually (\`rm -rf ${finalPath}\`) and re-run.`,
       { code: "migration_destination_exists" }
     );
@@ -1357,7 +1403,7 @@ async function migrateSqliteToLance(opts) {
   };
   fs.mkdirSync(newPath, { recursive: true });
   log(`Writing Lance index to ${newPath} ...`);
-  const lance = await chunkGH52NOCL_cjs.LanceIndex.open({
+  const lance = await chunkEQMLJ52C_cjs.LanceIndex.open({
     cwd,
     embedding: placeholderEmbedding,
     storagePath: newPath
@@ -1572,7 +1618,7 @@ function loadProjectEnv(env = process.env, load = typeof process.loadEnvFile ===
 }
 
 // src/reap-plan.ts
-var RetentionPolicyError = class extends chunkYULF6FPB_cjs.TheokitAgentError {
+var RetentionPolicyError = class extends chunk2YGIBOUH_cjs.TheokitAgentError {
   name = "RetentionPolicyError";
 };
 function assertPolicy(retention) {
@@ -1696,7 +1742,7 @@ var Security = class {
    * // → "[bot] received: please remember sk-abc...xyz1"
    */
   static redact(text, opts) {
-    return chunkZHPET3LZ_cjs.redactSecrets(text, opts);
+    return chunkSXSPMRSV_cjs.redactSecrets(text, opts);
   }
   /**
    * Register a custom redaction pattern. Additive — built-in patterns
@@ -1718,7 +1764,7 @@ var Security = class {
    * // → text containing "MYORG-AAAA...AAAA" now masks like a builtin.
    */
   static addPattern(re) {
-    chunkZHPET3LZ_cjs.addPattern(re);
+    chunkSXSPMRSV_cjs.addPattern(re);
   }
 };
 
@@ -1755,6 +1801,28 @@ function applySecurityFloor(input) {
   return input.layers[input.override] ?? tightenOnly(input, baseline(input));
 }
 
+// src/session-guard.ts
+var LiveSessionError = class extends chunk2YGIBOUH_cjs.TheokitAgentError {
+  name = "LiveSessionError";
+  sessionId;
+  reason;
+  constructor(sessionId, reason) {
+    super(
+      reason === "session-is-live" ? `refusing to destroy session ${sessionId}: it is live \u2014 another process is probably still appending to it. Switch to another session first.` : `refusing to destroy session ${sessionId}: the set of live sessions could not be determined, so this cannot be shown to be safe. Resolve that before deleting.`
+    );
+    this.sessionId = sessionId;
+    this.reason = reason;
+  }
+};
+function guardSessionDestruction(sessionId, live) {
+  if (live === void 0) {
+    throw new LiveSessionError(sessionId, "liveness-undetermined");
+  }
+  if (live.includes(sessionId)) {
+    throw new LiveSessionError(sessionId, "session-is-live");
+  }
+}
+
 // src/session-scope.ts
 function scopedConversationId(scope, id) {
   return `${scope}__${id}`;
@@ -1768,7 +1836,7 @@ function isBuiltAgent(m) {
   return typeof m.send === "function";
 }
 async function materialize(def, index) {
-  const { Agent: Agent2 } = await import('./agent-JA4ILE5O.cjs');
+  const { Agent: Agent2 } = await import('./agent-2KSLHB6B.cjs');
   return Agent2.create({
     // `AgentDefinition.model` admits the sentinel `'inherit'`, which is not a model id. Inheriting
     // here means "declare nothing and let the default apply" — forwarding the literal would create
@@ -1782,12 +1850,12 @@ async function materialize(def, index) {
 function createSquad(options) {
   const { agents } = options;
   if (!Array.isArray(agents) || agents.length === 0) {
-    throw new chunkYULF6FPB_cjs.ConfigurationError("createSquad requires a non-empty `agents` array", {
+    throw new chunk2YGIBOUH_cjs.ConfigurationError("createSquad requires a non-empty `agents` array", {
       code: "invalid_squad"
     });
   }
   if (options.process !== void 0 && options.process !== "sequential") {
-    throw new chunkYULF6FPB_cjs.ConfigurationError(
+    throw new chunk2YGIBOUH_cjs.ConfigurationError(
       `createSquad only supports process "sequential"; for manager\u2192worker delegation use subagents or @theokit/sdk-handoff`,
       { code: "squad_process_unsupported" }
     );
@@ -1800,13 +1868,13 @@ function createSquad(options) {
   };
 }
 async function buildPipeline(agents, nome) {
-  let builder = chunkJO76RWCA_cjs.Workflow.create({ name: nome ?? "squad" });
+  let builder = chunkZ5U2JGEK_cjs.Workflow.create({ name: nome ?? "squad" });
   for (let i = 0; i < agents.length; i++) {
     const member = agents[i];
     if (member === void 0) continue;
     const agent = isBuiltAgent(member) ? member : await materialize(member, i);
     const opts = i > 0 ? { origin: { kind: "peer", from: `agent-${i - 1}` } } : void 0;
-    builder = builder.then(chunkJO76RWCA_cjs.agentStep(`agent-${i}`, agent, (prev) => String(prev), opts));
+    builder = builder.then(chunkZ5U2JGEK_cjs.agentStep(`agent-${i}`, agent, (prev) => String(prev), opts));
   }
   return builder.commit();
 }
@@ -1830,7 +1898,7 @@ var Task = class {
    * (D369), and retention (D373).
    */
   static configure(opts) {
-    chunkKCQUYQ3V_cjs.configure(opts);
+    chunk6DCTL32L_cjs.configure(opts);
   }
   /**
    * Submit a unit of asynchronous work to the registry.
@@ -1855,7 +1923,7 @@ var Task = class {
    * a semaphore slot and without invoking `work`.
    */
   static async submit(kind, work, options = {}) {
-    return chunkKCQUYQ3V_cjs.submit({
+    return chunk6DCTL32L_cjs.submit({
       kind,
       work,
       ...options.id !== void 0 ? { id: options.id } : {},
@@ -1866,11 +1934,11 @@ var Task = class {
   }
   /** Returns matching handles, capped at `filter.limit ?? 100`. */
   static list(filter = {}) {
-    return chunkKCQUYQ3V_cjs.list(filter);
+    return chunk6DCTL32L_cjs.list(filter);
   }
   /** Returns a single handle by id, or `undefined` if unknown / evicted. */
   static get(id) {
-    return chunkKCQUYQ3V_cjs.get(id);
+    return chunk6DCTL32L_cjs.get(id);
   }
   /**
    * Idempotent cancel (D365). Returns:
@@ -1883,7 +1951,7 @@ var Task = class {
    * Never throws.
    */
   static cancel(id, reason) {
-    return chunkKCQUYQ3V_cjs.cancel(id, reason);
+    return chunk6DCTL32L_cjs.cancel(id, reason);
   }
   /**
    * Subscribe to a task's event stream. The returned `AsyncIterable<TaskEvent>`
@@ -1897,7 +1965,7 @@ var Task = class {
    * Throws `TaskNotFoundError` if the id is unknown or has been evicted.
    */
   static subscribe(id) {
-    return chunkKCQUYQ3V_cjs.subscribe(id);
+    return chunk6DCTL32L_cjs.subscribe(id);
   }
 };
 
@@ -1910,7 +1978,7 @@ var FIXTURE_USER = {
 };
 var FIXTURE_MODELS = [
   {
-    id: chunkTSK4VVBW_cjs.DEFAULT_AGENTIC_MODEL_ID,
+    id: chunkXI4L45SS_cjs.DEFAULT_AGENTIC_MODEL_ID,
     name: "Gemini 2.0 Flash",
     displayName: "Gemini 2.0 Flash",
     parameters: [
@@ -1986,20 +2054,20 @@ async function listLocalModelsViaOpenAiCompat(baseUrl) {
   try {
     response = await fetch(url, { method: "GET" });
   } catch (fetchErr) {
-    const mapped = chunkQFFNMJAS_cjs.mapOllamaTransportError({
+    const mapped = chunkN6NUMXAJ_cjs.mapOllamaTransportError({
       providerId: "ollama",
       cause: fetchErr,
       endpoint: "/v1/models"
     });
     if (mapped !== void 0) throw mapped;
-    throw new chunkYULF6FPB_cjs.ConfigurationError(
+    throw new chunk2YGIBOUH_cjs.ConfigurationError(
       `Failed to reach local provider at ${baseUrl}: ${fetchErr.message}`,
       { code: "local_provider_unreachable" }
     );
   }
   if (!response.ok) {
-    const body = await chunkQFFNMJAS_cjs.readErrorResponseBody(response);
-    const mapped = chunkQFFNMJAS_cjs.mapOllamaHttpError({
+    const body = await chunkN6NUMXAJ_cjs.readErrorResponseBody(response);
+    const mapped = chunkN6NUMXAJ_cjs.mapOllamaHttpError({
       providerId: "ollama",
       status: response.status,
       body,
@@ -2007,7 +2075,7 @@ async function listLocalModelsViaOpenAiCompat(baseUrl) {
       endpoint: "/v1/models"
     });
     if (mapped !== void 0) throw mapped;
-    throw new chunkYULF6FPB_cjs.ConfigurationError(
+    throw new chunk2YGIBOUH_cjs.ConfigurationError(
       `Local provider at ${baseUrl} returned HTTP ${response.status} on /v1/models`,
       { code: "local_provider_http_error" }
     );
@@ -2062,9 +2130,9 @@ var Theokit = class {
       });
     },
     capabilities: (providerOrModelId) => {
-      chunkGLEKLAUW_cjs.registerBuiltins();
+      chunkT6ZCG5AP_cjs.registerBuiltins();
       const providerId = providerOrModelId.includes("/") ? providerOrModelId.split("/")[0] ?? providerOrModelId : providerOrModelId;
-      return chunkGLEKLAUW_cjs.getCatalogCapabilities(providerId);
+      return chunkT6ZCG5AP_cjs.getCatalogCapabilities(providerId);
     }
   };
   /**
@@ -2103,8 +2171,8 @@ var Theokit = class {
    */
   static inspect = {
     builtinProviders: () => {
-      chunkGLEKLAUW_cjs.registerBuiltins();
-      return chunkGLEKLAUW_cjs.listProviders().map((p) => ({
+      chunkT6ZCG5AP_cjs.registerBuiltins();
+      return chunkT6ZCG5AP_cjs.listProviders().map((p) => ({
         name: p.name,
         apiMode: p.apiMode,
         authType: p.authType,
@@ -2113,7 +2181,7 @@ var Theokit = class {
         envVars: p.envVars
       }));
     },
-    embeddingAdapters: () => Object.entries(chunkTSK4VVBW_cjs.MEMORY_EMBEDDING_ADAPTERS).map(([id, adapter]) => ({
+    embeddingAdapters: () => Object.entries(chunkXI4L45SS_cjs.MEMORY_EMBEDDING_ADAPTERS).map(([id, adapter]) => ({
       id,
       transport: adapter.transport,
       defaultModel: adapter.defaultModel
@@ -2130,9 +2198,9 @@ var Theokit = class {
   // and may be promoted onto Theokit once the agent.ts cycle is broken.
 };
 async function maybeListLocalModels(providerName) {
-  chunkGLEKLAUW_cjs.registerBuiltins();
-  await chunkQFFNMJAS_cjs.discoverProviderPlugins();
-  const profile = chunkGLEKLAUW_cjs.getProviderProfile(providerName);
+  chunkT6ZCG5AP_cjs.registerBuiltins();
+  await chunkN6NUMXAJ_cjs.discoverProviderPlugins();
+  const profile = chunkT6ZCG5AP_cjs.getProviderProfile(providerName);
   if (profile === void 0) return void 0;
   if (profile.authType !== "none") return void 0;
   const baseUrl = resolveLocalProviderBaseUrl(profile.name, profile.baseUrl);
@@ -2145,17 +2213,34 @@ function resolveLocalProviderBaseUrl(providerName, fallback) {
   return fallback;
 }
 async function executeCatalogRequest(request) {
-  const apiKey = chunkTSK4VVBW_cjs.resolveApiKey(request.apiKey);
+  const apiKey = chunkXI4L45SS_cjs.resolveApiKey(request.apiKey);
   if (apiKey === void 0) {
-    throw new chunkYULF6FPB_cjs.AuthenticationError("Missing API key", { code: "missing_api_key" });
+    throw new chunk2YGIBOUH_cjs.AuthenticationError("Missing API key", { code: "missing_api_key" });
   }
-  if (chunkQFFNMJAS_cjs.shouldUseFixtureMode(apiKey)) {
+  if (chunkN6NUMXAJ_cjs.shouldUseFixtureMode(apiKey)) {
     return request.fixture;
   }
-  if (!chunkQFFNMJAS_cjs.isFixtureApiKey(apiKey) && process.env.THEOKIT_API_BASE_URL === void 0) {
-    throw new chunkYULF6FPB_cjs.AuthenticationError("Invalid API key", { code: "authentication_error" });
+  if (!chunkN6NUMXAJ_cjs.isFixtureApiKey(apiKey) && process.env.THEOKIT_API_BASE_URL === void 0) {
+    throw new chunk2YGIBOUH_cjs.AuthenticationError("Invalid API key", { code: "authentication_error" });
   }
-  return chunkQFFNMJAS_cjs.httpRequest(request.path, { apiKey });
+  return chunkN6NUMXAJ_cjs.httpRequest(request.path, { apiKey });
+}
+
+// src/tool-blast-radius.ts
+var DECLARED = /* @__PURE__ */ Symbol.for("@theokit/sdk.blastRadius");
+function withBlastRadius(tool, action) {
+  return Object.defineProperty(tool, DECLARED, {
+    value: action,
+    // `enumerable: false` is defensive and NOT load-bearing — checked, not assumed. Flipping it to
+    // true leaves every case green, because the symbol key already excludes this from `Object.keys`
+    // and `JSON.stringify`. It stays because a future string-keyed variant would need it, and the
+    // next reader should not have to discover that the flag has no test behind it.
+    enumerable: false,
+    configurable: true
+  });
+}
+function describeAction(tool) {
+  return tool[DECLARED];
 }
 
 // src/trajectory-helpers.ts
@@ -2263,7 +2348,7 @@ function resolveTrustPosture(input) {
 }
 
 // src/wiring-record.ts
-var UngatedCapabilityError = class extends chunkYULF6FPB_cjs.TheokitAgentError {
+var UngatedCapabilityError = class extends chunk2YGIBOUH_cjs.TheokitAgentError {
   name = "UngatedCapabilityError";
 };
 function recordWiring(input) {
@@ -2291,51 +2376,51 @@ Object.defineProperty(exports, "GOAL_CONTINUATION_MARKER", {
 });
 Object.defineProperty(exports, "JudgeCredentialError", {
   enumerable: true,
-  get: function () { return chunkUJMEWGO6_cjs.JudgeCredentialError; }
+  get: function () { return chunkBWGXYOBZ_cjs.JudgeCredentialError; }
 });
 Object.defineProperty(exports, "StreamObjectError", {
   enumerable: true,
-  get: function () { return chunk57KX5WTP_cjs.StreamObjectError; }
+  get: function () { return chunkV45L2OYP_cjs.StreamObjectError; }
 });
 Object.defineProperty(exports, "GenerateObjectError", {
   enumerable: true,
-  get: function () { return chunkGC44RATP_cjs.GenerateObjectError; }
+  get: function () { return chunkK42QGAKM_cjs.GenerateObjectError; }
 });
 Object.defineProperty(exports, "Cron", {
   enumerable: true,
-  get: function () { return chunk74VVGK7P_cjs.Cron; }
+  get: function () { return chunk2S7IB4O3_cjs.Cron; }
 });
 Object.defineProperty(exports, "Agent", {
   enumerable: true,
-  get: function () { return chunkTSK4VVBW_cjs.Agent; }
+  get: function () { return chunkXI4L45SS_cjs.Agent; }
 });
 Object.defineProperty(exports, "AgentBuilder", {
   enumerable: true,
-  get: function () { return chunkTSK4VVBW_cjs.AgentBuilder; }
+  get: function () { return chunkXI4L45SS_cjs.AgentBuilder; }
 });
 Object.defineProperty(exports, "Tool", {
   enumerable: true,
-  get: function () { return chunkTSK4VVBW_cjs.Tool; }
+  get: function () { return chunkXI4L45SS_cjs.Tool; }
 });
 Object.defineProperty(exports, "ToolError", {
   enumerable: true,
-  get: function () { return chunkTSK4VVBW_cjs.ToolError; }
+  get: function () { return chunkXI4L45SS_cjs.ToolError; }
 });
 Object.defineProperty(exports, "UsageAccumulator", {
   enumerable: true,
-  get: function () { return chunkTSK4VVBW_cjs.UsageAccumulator; }
+  get: function () { return chunkXI4L45SS_cjs.UsageAccumulator; }
 });
 Object.defineProperty(exports, "computeCost", {
   enumerable: true,
-  get: function () { return chunkTSK4VVBW_cjs.computeCost; }
+  get: function () { return chunkXI4L45SS_cjs.computeCost; }
 });
 Object.defineProperty(exports, "getPricingEntry", {
   enumerable: true,
-  get: function () { return chunkTSK4VVBW_cjs.getPricingEntry; }
+  get: function () { return chunkXI4L45SS_cjs.getPricingEntry; }
 });
 Object.defineProperty(exports, "emitRunEvent", {
   enumerable: true,
-  get: function () { return chunkKCQUYQ3V_cjs.emitRunEvent; }
+  get: function () { return chunk6DCTL32L_cjs.emitRunEvent; }
 });
 Object.defineProperty(exports, "withCwdMutex", {
   enumerable: true,
@@ -2343,81 +2428,82 @@ Object.defineProperty(exports, "withCwdMutex", {
 });
 Object.defineProperty(exports, "AgentDisposedError", {
   enumerable: true,
-  get: function () { return chunkYULF6FPB_cjs.AgentDisposedError; }
+  get: function () { return chunk2YGIBOUH_cjs.AgentDisposedError; }
 });
 Object.defineProperty(exports, "AgentRunError", {
   enumerable: true,
-  get: function () { return chunkYULF6FPB_cjs.AgentRunError; }
+  get: function () { return chunk2YGIBOUH_cjs.AgentRunError; }
 });
 Object.defineProperty(exports, "AuthenticationError", {
   enumerable: true,
-  get: function () { return chunkYULF6FPB_cjs.AuthenticationError; }
+  get: function () { return chunk2YGIBOUH_cjs.AuthenticationError; }
 });
 Object.defineProperty(exports, "BudgetExceededError", {
   enumerable: true,
-  get: function () { return chunkYULF6FPB_cjs.BudgetExceededError; }
+  get: function () { return chunk2YGIBOUH_cjs.BudgetExceededError; }
 });
 Object.defineProperty(exports, "ConfigurationError", {
   enumerable: true,
-  get: function () { return chunkYULF6FPB_cjs.ConfigurationError; }
+  get: function () { return chunk2YGIBOUH_cjs.ConfigurationError; }
 });
 Object.defineProperty(exports, "IntegrationNotConnectedError", {
   enumerable: true,
-  get: function () { return chunkYULF6FPB_cjs.IntegrationNotConnectedError; }
+  get: function () { return chunk2YGIBOUH_cjs.IntegrationNotConnectedError; }
 });
 Object.defineProperty(exports, "InvalidTaskIdError", {
   enumerable: true,
-  get: function () { return chunkYULF6FPB_cjs.InvalidTaskIdError; }
+  get: function () { return chunk2YGIBOUH_cjs.InvalidTaskIdError; }
 });
 Object.defineProperty(exports, "MemoryAdapterError", {
   enumerable: true,
-  get: function () { return chunkYULF6FPB_cjs.MemoryAdapterError; }
+  get: function () { return chunk2YGIBOUH_cjs.MemoryAdapterError; }
 });
 Object.defineProperty(exports, "NetworkError", {
   enumerable: true,
-  get: function () { return chunkYULF6FPB_cjs.NetworkError; }
+  get: function () { return chunk2YGIBOUH_cjs.NetworkError; }
 });
 Object.defineProperty(exports, "RateLimitError", {
   enumerable: true,
-  get: function () { return chunkYULF6FPB_cjs.RateLimitError; }
+  get: function () { return chunk2YGIBOUH_cjs.RateLimitError; }
 });
 Object.defineProperty(exports, "TaskNotFoundError", {
   enumerable: true,
-  get: function () { return chunkYULF6FPB_cjs.TaskNotFoundError; }
+  get: function () { return chunk2YGIBOUH_cjs.TaskNotFoundError; }
 });
 Object.defineProperty(exports, "TheokitAgentError", {
   enumerable: true,
-  get: function () { return chunkYULF6FPB_cjs.TheokitAgentError; }
+  get: function () { return chunk2YGIBOUH_cjs.TheokitAgentError; }
 });
 Object.defineProperty(exports, "UnknownAgentError", {
   enumerable: true,
-  get: function () { return chunkYULF6FPB_cjs.UnknownAgentError; }
+  get: function () { return chunk2YGIBOUH_cjs.UnknownAgentError; }
 });
 Object.defineProperty(exports, "UnsupportedBudgetOperationError", {
   enumerable: true,
-  get: function () { return chunkYULF6FPB_cjs.UnsupportedBudgetOperationError; }
+  get: function () { return chunk2YGIBOUH_cjs.UnsupportedBudgetOperationError; }
 });
 Object.defineProperty(exports, "UnsupportedRunOperationError", {
   enumerable: true,
-  get: function () { return chunkYULF6FPB_cjs.UnsupportedRunOperationError; }
+  get: function () { return chunk2YGIBOUH_cjs.UnsupportedRunOperationError; }
 });
 Object.defineProperty(exports, "UnsupportedTaskOperationError", {
   enumerable: true,
-  get: function () { return chunkYULF6FPB_cjs.UnsupportedTaskOperationError; }
+  get: function () { return chunk2YGIBOUH_cjs.UnsupportedTaskOperationError; }
 });
 Object.defineProperty(exports, "isTransientError", {
   enumerable: true,
-  get: function () { return chunkYULF6FPB_cjs.isTransientError; }
+  get: function () { return chunk2YGIBOUH_cjs.isTransientError; }
 });
 Object.defineProperty(exports, "setDiagnosticsSink", {
   enumerable: true,
-  get: function () { return chunkZHPET3LZ_cjs.setDiagnosticsSink; }
+  get: function () { return chunkSXSPMRSV_cjs.setDiagnosticsSink; }
 });
 exports.AgentFactory = AgentFactory;
 exports.Budget = Budget;
 exports.EventBus = EventBus;
 exports.JobQueue = JobQueue;
 exports.LayerOrderError = LayerOrderError;
+exports.LiveSessionError = LiveSessionError;
 exports.Memory = Memory;
 exports.NoopMemoryProvider = NoopMemoryProvider;
 exports.PermissionEngine = PermissionEngine;
@@ -2440,9 +2526,14 @@ exports.applySecurityFloor = applySecurityFloor;
 exports.auditEnvReachability = auditEnvReachability;
 exports.chargeAndCheckThresholds = chargeAndCheckThresholds;
 exports.createCounterBudgetTracker = createCounterBudgetTracker;
+exports.decideApproval = decideApproval;
+exports.describeAction = describeAction;
+exports.describeCredential = describeCredential;
 exports.estimateTokens = estimateTokens;
+exports.evaluateBlastRadius = evaluateBlastRadius;
 exports.extractRawId = extractRawId;
 exports.foldLayers = foldLayers;
+exports.guardSessionDestruction = guardSessionDestruction;
 exports.inferApiMode = inferApiMode;
 exports.loadProjectEnv = loadProjectEnv;
 exports.migrateSqliteToLance = migrateSqliteToLance2;
@@ -2458,5 +2549,6 @@ exports.scopedConversationId = scopedConversationId;
 exports.sessionScopePrefix = sessionScopePrefix;
 exports.toShareGptTrajectory = toShareGptTrajectory;
 exports.verifyLayerOrdering = verifyLayerOrdering;
+exports.withBlastRadius = withBlastRadius;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map