@theokit/sdk 5.0.1 → 5.1.0

package/dist/chunk-DLRP7BI6.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/internal/runtime/compat/foreign-config-sources.ts","../src/internal/persistence/paths.ts"],"names":["join","existsSync","diagFailure","homedir"],"mappings":";;;;;;;AAmDO,IAAM,mBAAA,GAAsB,UAAA;AAG5B,IAAM,eAAA,GAAkB,SAAA;AAkBxB,IAAM,aAAA,GAAqC;AAAA,EAChD,IAAA,EAAM,SAAA;AAAA,EACN,OAAA,EAAS,mBAAA;AAAA,EACT,UAAA,EAAY,OAAO,EAAC;AACtB,CAAA;AAWO,IAAM,kBAAA,GAA0C;AAAA,EACrD,IAAA,EAAM,aAAA;AAAA,EACN,OAAA,EAAS,eAAA;AAAA,EACT,UAAA,EAAY,CAAC,GAAA,MAAS,EAAE,oBAAoB,GAAA,EAAI;AAClD,CAAA;AAEA,IAAM,eAAA,GAAkD,CAAC,kBAAkB,CAAA;AAE3E,IAAM,cAAwD,IAAI,GAAA;AAAA,EAChE,CAAC,aAAA,EAAe,GAAG,eAAe,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,OAAA,EAAS,CAAC,CAAC;AAC/D,CAAA;AASO,SAAS,YAAY,KAAA,EAAiD;AAC3E,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,eAAA,CAAgB,GAAA,CAAI,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,IAAA,EAAM,CAAC,CAAC,CAAC,CAAA;AAC9D,EAAA,MAAM,MAA6B,EAAC;AACpC,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AAC/B,IAAA,IAAI,OAAA,KAAY,UAAa,CAAC,GAAA,CAAI,SAAS,OAAO,CAAA,EAAG,GAAA,CAAI,IAAA,CAAK,OAAO,CAAA;AAAA,EACvE;AACA,EAAA,OAAO,GAAA;AACT;AAYA,IAAM,eAAA,GAA4C,CAAC,OAAA,EAAS,SAAA,EAAW,UAAU,WAAW,CAAA;AAsBrF,SAAS,kBAAA,CACd,SACA,OAAA,EACuB;AACvB,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,IAAI,OAAO,WAAW,QAAA,EAAU;AAC9B,MAAA,QAAA,CAAS,KAAK,MAAM,CAAA;AACpB,MAAA;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,IAAU,EAAC;AACjC,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,KAAM,WAAW,eAAA,CAAgB,QAAA,CAAS,CAAkB,CAAC,CAAA,EAAG;AACrF,MAAA,QAAA,CAAS,IAAA,CAAK,OAAO,IAAI,CAAA;AAAA,IAC3B;AAAA,EACF;AACA,EAAA,OAAO,YAAY,QAAQ,CAAA;AAC7B;AASO,SAAS,qBAAqB,IAAA,EAA+C;AAClF,EAAA,KAAA,MAAW,OAAA,IAAW,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA,EAAG;AACzC,IAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,CAAI,OAAO,CAAA;AACvC,IAAA,IAAI,OAAA,KAAY,QAAW,OAAO,OAAA;AAAA,EACpC;AACA,EAAA,OAAO,MAAA;AACT;AAuBO,SAAS,oBAAA,CACd,OAAA,EACA,QAAA,EACA,GAAA,GAAoD,QAAQ,GAAA,EAClD;AAEV,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,OAAA,CAAQ,UAAA,EAAY,GAAG,CAAA;AAChD,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAC9B,EAAA,KAAA,MAAW,SAAS,QAAA,CAAS,QAAA;AAAA,IAC3B;AAAA,GACF,EAAG;AACD,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,CAAC,CAAA,IAAK,MAAM,CAAC,CAAA;AAChC,IAAA,IAAI,SAAS,MAAA,EAAW;AACxB,IAAA,IAAI,QAAQ,QAAA,EAAU;AACtB,IAAA,IAAI,GAAA,CAAI,IAAI,CAAA,KAAM,MAAA,EAAW;AAC7B,IAAA,KAAA,CAAM,IAAI,IAAI,CAAA;AAAA,EAChB;AACA,EAAA,OAAO,CAAC,GAAG,KAAK,CAAA;AAClB;AAQA,IAAM,QAAA,uBAAe,GAAA,EAAY;AA4C1B,SAAS,uBAAA,CACd,KACA,QAAA,EACM;AAKN,EAAA,MAAM,gBAAgB,IAAI,GAAA;AAAA,IACxB,YAAY,QAAA,CAAS,GAAA,CAAI,CAAC,CAAA,KAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,CAAA,CAAE,IAAK,CAAC,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI;AAAA,GAC1F;AACA,EAAA,KAAA,MAAW,WAAW,eAAA,EAAiB;AACrC,IAAA,IAAI,aAAA,CAAc,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,EAAG;AACrC,IAAA,MAAM,GAAA,GAAMA,SAAA,CAAK,GAAA,EAAK,OAAA,CAAQ,OAAO,CAAA;AACrC,IAAA,IAAI,CAACC,aAAA,CAAW,GAAG,CAAA,EAAG;AACtB,IAAA,IAAI,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,EAAG;AACvB,IAAA,QAAA,CAAS,IAAI,GAAG,CAAA;AAChB,IAAAC,6BAAA;AAAA,MACE,CAAA,UAAA,EAAa,OAAA,CAAQ,OAAO,CAAA,mIAAA,EAEG,QAAQ,IAAI,CAAA;AAAA;AAAA,KAC7C;AAAA,EACF;AACF;;;ACvOO,SAAS,eAAe,GAAA,EAAqB;AAClD,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,YAAA,EAAc,IAAA,EAAK;AAChD,EAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AACjD,IAAA,OAAO,QAAA;AAAA,EACT;AACA,EAAA,OAAOF,SAAAA,CAAK,KAAK,mBAAmB,CAAA;AACtC;AAmBO,SAAS,kBAAkB,GAAA,EAAqB;AACrD,EAAA,OAAOA,SAAAA,CAAK,KAAK,mBAAmB,CAAA;AACtC;AAuBO,SAAS,kBAAA,CACd,GAAA,EACA,OAAA,EACA,OAAA,EACU;AACV,EAAA,OAAO;AAAA,IACL,kBAAkB,GAAG,CAAA;AAAA,IACrB,GAAG,kBAAA,CAAmB,OAAA,EAAS,OAAO,CAAA,CAAE,GAAA,CAAI,CAAC,OAAA,KAAYA,SAAAA,CAAK,GAAA,EAAK,OAAA,CAAQ,OAAO,CAAC;AAAA,GACrF;AACF;AAeO,SAAS,iBAAA,CACd,KACA,OAAA,EACU;AAMV,EAAA,OAAO,kBAAA,CAAmB,GAAA,EAAK,OAAA,EAAS,SAAS,CAAA,CAAE,GAAA,CAAI,CAAC,IAAA,KAASA,SAAAA,CAAK,IAAA,EAAM,SAAS,CAAC,CAAA;AACxF;AAeO,SAAS,eAAA,GAA0B;AACxC,EAAA,OAAOA,SAAAA,CAAKG,UAAA,EAAQ,EAAG,mBAAA,EAAqB,UAAU,CAAA;AACxD;AAmBO,SAAS,mBAAmB,GAAA,EAAqB;AACtD,EAAA,MAAM,QAAA,GAAW,eAAe,GAAG,CAAA;AACnC,EAAA,MAAM,OAAOA,UAAA,EAAQ;AACrB,EAAA,IAAI,QAAA,KAAa,MAAM,OAAO,GAAA;AAC9B,EAAA,IAAI,QAAA,CAAS,UAAA,CAAW,CAAA,EAAG,IAAI,GAAG,CAAA,EAAG;AACnC,IAAA,OAAO,CAAA,CAAA,EAAI,QAAA,CAAS,KAAA,CAAM,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA;AAAA,EACxC;AACA,EAAA,OAAO,QAAA;AACT","file":"chunk-DLRP7BI6.cjs","sourcesContent":["import { existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\nimport { diagFailure } from \"../../diagnostics.js\";\n\n/*\n * The foreign configuration dialects this SDK can read, and what each one PRESUMES.\n *\n * ## Why a registry and not a list of directory names\n *\n * `projectConfigRoots` returned `[\".theokit\", \".claude\"]` — two paths — and that shape is what\n * usetheokit/theokit-sdk#522 fell through. A path says WHERE a file lives. It does not say how the\n * file is parsed, and it does not say what runtime the commands inside it were written against.\n *\n * Claude Code defines `$CLAUDE_PROJECT_DIR` for the hook commands in its `settings.json`, and its\n * documentation tells authors to reach project files through it — an absolute path would break for\n * every other person on the team, so the shape that failed here is the shape upstream recommends.\n * This SDK read the file and ran the command without the variable. `sh` expands an unset variable to\n * the empty string, so\n *\n *     bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/guard.sh\"   became   bash \"/.claude/hooks/guard.sh\"\n *\n * which does not exist, which a hook runner correctly reads as a refusal. Every turn denied, in any\n * repository that also had Claude Code set up, with a message naming a file that was present and\n * executable all along.\n *\n * Importing a format means accepting the contract that format presumes. An adapter is where that\n * contract is written down, so the next dialect (`.codex/` is the obvious one) declares its own\n * instead of inheriting a hole.\n *\n * ## What an adapter deliberately does NOT do\n *\n * It does not make the foreign source trusted, and it does not make its hooks permissive: a script\n * that exits non-zero is still a refusal. It supplies the variables the format's authors were\n * entitled to assume, and nothing else — `env` here is merged over the scrubbed inherit policy by\n * `spawnAndCollect`, so it adds names rather than widening what a child can see.\n *\n * @internal\n */\n\n/**\n * The project config directory literal.\n *\n * Renamed from `THEOKIT_DIR_NAME` in #410. Sharing a name with the (now removed) sovereign env var\n * was the MECHANISM of that defect, not scenery: every grep for the variable landed on that const\n * and looked answered, so \"is it read?\" returned five hits and nobody checked what they were.\n *\n * Lives here rather than in `persistence/paths.ts` because a directory name is one third of what a\n * dialect is — the other two being how it parses and what it presumes — and splitting the three\n * across two modules is what let the third go unwritten.\n */\nexport const THEOKIT_DIR_LITERAL = \".theokit\";\n\n/** The Claude Code CLI's project configuration directory. */\nexport const CLAUDE_DIR_NAME = \".claude\";\n\n/** A configuration dialect this SDK understands. `theokit` is native; the rest are foreign. */\nexport interface ConfigSourceAdapter {\n  /** Stable identifier, and what a consumer names to opt in. */\n  readonly kind: string;\n  /** The project-relative directory the dialect keeps its configuration in. */\n  readonly dirName: string;\n  /**\n   * Variables the dialect's own runtime defines for commands it executes.\n   *\n   * Empty for the native source: a `.theokit/` hook is written against THIS runtime and inherits it\n   * already. Non-empty is what makes a foreign command runnable rather than silently broken.\n   */\n  runtimeEnv(cwd: string): Record<string, string>;\n}\n\n/** The native source. Always read, never opted into, always first for precedence. */\nexport const NATIVE_SOURCE: ConfigSourceAdapter = {\n  kind: \"theokit\",\n  dirName: THEOKIT_DIR_LITERAL,\n  runtimeEnv: () => ({}),\n};\n\n/**\n * Claude Code.\n *\n * `CLAUDE_PROJECT_DIR` is the documented way for a hook command in `settings.json` to reach a file\n * in the project. Only that one variable is supplied: `$CLAUDE_PLUGIN_ROOT` and the rest of that\n * runtime's surface are NOT defined here, because supplying a name whose value this SDK would have\n * to invent is worse than leaving it unset — an invented root sends a script somewhere real and\n * wrong, where an unset one fails loudly.\n */\nexport const CLAUDE_CODE_SOURCE: ConfigSourceAdapter = {\n  kind: \"claude-code\",\n  dirName: CLAUDE_DIR_NAME,\n  runtimeEnv: (cwd) => ({ CLAUDE_PROJECT_DIR: cwd }),\n};\n\nconst FOREIGN_SOURCES: readonly ConfigSourceAdapter[] = [CLAUDE_CODE_SOURCE];\n\nconst BY_DIR_NAME: ReadonlyMap<string, ConfigSourceAdapter> = new Map(\n  [NATIVE_SOURCE, ...FOREIGN_SOURCES].map((a) => [a.dirName, a]),\n);\n\n/**\n * The adapters a caller declared, in declaration order, skipping any name that names no adapter.\n *\n * An unknown name is DROPPED rather than turned into `<cwd>/<name>`: a typo must fail closed. Making\n * a directory out of an unrecognised string would import a dialect nothing knows how to parse — and\n * the whole reason this exists is that a directory name was never enough to describe a dialect.\n */\nexport function adaptersFor(kinds: readonly string[]): ConfigSourceAdapter[] {\n  const byKind = new Map(FOREIGN_SOURCES.map((a) => [a.kind, a]));\n  const out: ConfigSourceAdapter[] = [];\n  for (const kind of kinds) {\n    const adapter = byKind.get(kind);\n    if (adapter !== undefined && !out.includes(adapter)) out.push(adapter);\n  }\n  return out;\n}\n\n/**\n * A surface a foreign source may be admitted to. The four the SDK reads a project directory for.\n *\n * They are listed separately because they carry very different risk, which is the whole reason\n * #524 asks for per-surface control: a skill is text that enters the system prompt, a hook is\n * command execution, a plugin is code loading. A consumer who wants their skills back has no\n * reason to be handed the other two along with them.\n */\nexport type CompatSurface = \"hooks\" | \"plugins\" | \"skills\" | \"subagents\";\n\nconst COMPAT_SURFACES: readonly CompatSurface[] = [\"hooks\", \"plugins\", \"skills\", \"subagents\"];\n\n/**\n * A declared foreign source: a bare kind, or a kind with the surfaces it may be read for.\n */\nexport type CompatSourceDeclaration =\n  | string\n  | { readonly kind: string; readonly import?: readonly string[] };\n\n/**\n * The adapters admitted to ONE surface.\n *\n * Three rules, and each one fails closed:\n *\n * - A bare string admits every surface. It is what `5.0.0-next.1` published, so narrowing it\n *   silently would turn a working opt-in into a no-op — the exact defect #524 is about, one level\n *   up.\n * - An object with no `import` admits nothing. The issue's own rule, and safe to apply strictly\n *   because the object form is new and nobody can be depending on it.\n * - An unrecognised surface name is dropped rather than matched loosely, for the same reason an\n *   unrecognised KIND is dropped in {@link adaptersFor}: a typo must not silently widen access.\n */\nexport function adaptersForSurface(\n  sources: readonly CompatSourceDeclaration[],\n  surface: CompatSurface,\n): ConfigSourceAdapter[] {\n  const admitted: string[] = [];\n  for (const source of sources) {\n    if (typeof source === \"string\") {\n      admitted.push(source);\n      continue;\n    }\n    const wanted = source.import ?? [];\n    if (wanted.some((s) => s === surface && COMPAT_SURFACES.includes(s as CompatSurface))) {\n      admitted.push(source.kind);\n    }\n  }\n  return adaptersFor(admitted);\n}\n\n/**\n * The adapter whose directory an absolute config path sits under, or `undefined` for a path that\n * belongs to no registered dialect.\n *\n * Matched on the path SEGMENT rather than with `includes`, so a workspace that happens to live under\n * `/home/me/.claude-backups/repo` does not read as a Claude Code source.\n */\nexport function adapterForConfigPath(path: string): ConfigSourceAdapter | undefined {\n  for (const segment of path.split(/[\\\\/]/)) {\n    const adapter = BY_DIR_NAME.get(segment);\n    if (adapter !== undefined) return adapter;\n  }\n  return undefined;\n}\n\n/**\n * Variable references in a shell command that nothing will define.\n *\n * The second half of #522, and the half that cost the debugging session. `sh` expands an unset\n * variable to the empty string and says nothing, so the failure surfaces ten characters later as a\n * path: `bash: /.claude/hooks/guard.sh: No such file or directory` — which reads as \"your script is\n * missing\" while the script is present and executable. Nothing in that message contains the name of\n * the variable that was actually missing, so the reader looks in the wrong place.\n *\n * Checked against BOTH the process environment and the variables the dialect supplies, because\n * either is a legitimate source: a hook may reasonably use `$HOME`.\n *\n * ## What it deliberately does not try to be\n *\n * This is not a shell parser. It finds `$NAME` and `${NAME}` outside single quotes, which is the\n * shape a config file's hook commands take. It does NOT understand `${NAME:-default}` (a default\n * makes the variable optional, so it is not reported), assignments earlier in the same command, or\n * variables a sourced script exports. A false NEGATIVE there costs the old behaviour — the confusing\n * path error — and a false positive would deny a hook that would have worked, so the parse errs\n * toward silence and the check only ever ADDS a name to a failure that already happened.\n */\nexport function undefinedVariablesIn(\n  command: string,\n  supplied: Readonly<Record<string, string>>,\n  env: Readonly<Record<string, string | undefined>> = process.env,\n): string[] {\n  // Single-quoted spans are literal in `sh`: `echo '$FOO'` prints the dollar sign.\n  const unquoted = command.replace(/'[^']*'/g, \" \");\n  const names = new Set<string>();\n  for (const match of unquoted.matchAll(\n    /\\$\\{([A-Za-z_][A-Za-z0-9_]*)\\}|\\$([A-Za-z_][A-Za-z0-9_]*)/g,\n  )) {\n    const name = match[1] ?? match[2];\n    if (name === undefined) continue;\n    if (name in supplied) continue;\n    if (env[name] !== undefined) continue;\n    names.add(name);\n  }\n  return [...names];\n}\n\n/**\n * Workspaces already reported, so repeated agent construction in one process says it once.\n *\n * Keyed by the resolved directory rather than by dialect kind, so a long-lived host that drives\n * several workspaces still reports each of them.\n */\nconst reported = new Set<string>();\n\n/**\n * Reports a foreign configuration directory that exists in the workspace and was not declared.\n *\n * ## Why the flip needs a voice\n *\n * Before #524 a `.claude/` was read with no opt-in; after it, the same directory is ignored. From\n * inside the repository the two states are indistinguishable — the hook file is there, it is\n * executable, and it does not run. The only remaining way to learn why is a CHANGELOG entry for a\n * version the reader may not know they crossed.\n *\n * ## Why `diagFailure` rather than `diag` (#563)\n *\n * This used `diag`, on the reasoning that ignoring an undeclared directory is not a failure and\n * that a repository which does NOT want the import should not pay a stderr line for behaving as\n * instructed. The reasoning was sound and rested on a premise nobody checked: that a host would\n * have installed a sink.\n *\n * Measured against the published `5.0.0`. `diag` returns without doing anything when no sink is\n * installed. The SDK installs none — `currentSink()` reads a `globalThis` slot only\n * `setDiagnosticsSink` fills. Neither observable host installs one either: `theocode` renamed the\n * key, and `theokit` exports `installDiagnosticSink` and never calls it. Two hosts out of two, and\n * the SDK itself. So the message the CHANGELOG promised — \"says so once, on the diagnostics\n * channel\" — reached nobody, while the consumer lost hooks, skills, subagents and plugins.\n *\n * A mitigation announced in release notes for a silent loss of capability is not a diagnostic. It\n * is the error path of the breaking change itself, and `diagFailure` exists for exactly the message\n * that must not be swallowed.\n *\n * The cost the old reasoning named is real and is now paid: a repository that wants the directory\n * ignored sees a line. What makes that acceptable — ONCE per directory per process, not per turn\n * (`reported` below); and before #524 that repository was having `.claude/` imported anyway, so the\n * line it now sees confirms the fix it wanted. The asymmetry is one line of text against silently\n * losing four subsystems.\n *\n * A host that installs a sink still owns its render surface: `diagFailure` prefers the sink and\n * only falls back to stderr when there is none.\n *\n * NOT solved here: there is no way to say \"I know, and I want none\". `compatSources: []` would be\n * the natural spelling, but `resolveCompatSources` collapses it into the same `[]` an absent option\n * produces, so this function cannot tell them apart. If the noise turns out to matter, threading\n * that distinction through is the shape of the fix.\n */\nexport function reportUndeclaredSources(\n  cwd: string,\n  declared: readonly CompatSourceDeclaration[],\n): void {\n  // A kind named with a NARROW import list has still been declared: the consumer knows the\n  // directory is there and chose which surfaces to admit. Warning them anyway would be the noise\n  // that gets a warning ignored, and this one has exactly one job — telling somebody who does NOT\n  // know the directory is being skipped.\n  const declaredKinds = new Set(\n    adaptersFor(declared.map((d) => (typeof d === \"string\" ? d : d.kind))).map((a) => a.kind),\n  );\n  for (const adapter of FOREIGN_SOURCES) {\n    if (declaredKinds.has(adapter.kind)) continue;\n    const dir = join(cwd, adapter.dirName);\n    if (!existsSync(dir)) continue;\n    if (reported.has(dir)) continue;\n    reported.add(dir);\n    diagFailure(\n      `[theokit] ${adapter.dirName}/ is present but not declared, so its hooks, skills, subagents ` +\n        `and plugins are ignored. To read it, pass ` +\n        `local: { compatSources: [\"${adapter.kind}\"] } (usetheokit/theokit-sdk#524).\\n`,\n    );\n  }\n}\n","/**\n * Path resolution for SDK state files (ADR D60).\n *\n * Theokit anchors state at `<cwd>/.theokit/` by default (per-cwd). An\n * optional `THEOKIT_HOME` environment variable overrides this, enabling\n * test isolation, profile switching, and multi-tenant deployments.\n *\n * Rules:\n *   - `getTheokitHome(cwd)` is the canonical resolver **for cwd-anchored state**. Never hardcode\n *     `path.join(cwd, \".theokit\")` in callers — use this function so tests\n *     and overrides stay consistent.\n *\n *     M94 — this comment said \"the ONLY canonical resolver\", and stopped being true: the\n *     transcript gained `transcriptRoot()`, which is **home-anchored** (`~/.theokit`) with the same\n *     `THEOKIT_HOME` override. The two defaults differ on purpose — unifying would move the\n *     transcript of everyone who does NOT set the variable, which is a data migration and not a\n *     re-export.\n *\n *     A consequence worth writing down: **without `THEOKIT_HOME` the state stays split in two**\n *     — registry in `<cwd>/.theokit`, transcript in `~/.theokit`. M94 unifies only for those who set\n *     the variable. Unifying both defaults is another milestone's work.\n *   - `getProfilesRoot()` is intentionally home-anchored (not affected by\n *     `THEOKIT_HOME`) so `theokit profile list` discovers all profiles\n *     regardless of which is active.\n *   - `displayTheokitHome(cwd)` returns a human-readable path for logs.\n *\n * @internal\n */\n\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\n\nimport {\n  adaptersForSurface,\n  type CompatSourceDeclaration,\n  type CompatSurface,\n  THEOKIT_DIR_LITERAL,\n} from \"../runtime/compat/foreign-config-sources.js\";\n\n// The directory names live with the dialect registry that owns them — a name is one third of what a\n// configuration dialect is, and keeping the three together is what stops the next one shipping\n// without its runtime contract (#522).\n\n/**\n * Resolve the directory cwd-anchored SDK state lives in.\n *\n * `THEOKIT_HOME` wins when it is set and not blank after trimming; the trimmed value is used, and\n * it is used VERBATIM — it is not resolved against `cwd`, so a relative value stays relative and\n * `.theokit` is not appended to it. Otherwise the answer is `<cwd>/.theokit`.\n *\n * The environment is read on every call, so a change to the variable takes effect immediately\n * rather than being frozen at import.\n *\n * This creates nothing and checks nothing: the returned path may not exist, and the caller owns\n * the `mkdir`. Call it instead of writing `join(cwd, \".theokit\")` by hand, or the override stops\n * working for that one call site and tests silently touch the real home.\n *\n * Not the whole story about where state lives — the transcript is home-anchored via\n * `transcriptRoot()`, honoring the same variable but defaulting to `~/.theokit`. With\n * `THEOKIT_HOME` unset, state is genuinely split between two roots.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function getTheokitHome(cwd: string): string {\n  const override = process.env.THEOKIT_HOME?.trim();\n  if (override !== undefined && override.length > 0) {\n    return override;\n  }\n  return join(cwd, THEOKIT_DIR_LITERAL);\n}\n\n/**\n * The project's own configuration root: `<cwd>/.theokit`, always — never `THEOKIT_HOME`.\n *\n * `THEOKIT_HOME` relocates cwd-anchored SDK STATE (sessions, credentials). A project's\n * CONFIGURATION belongs to the repository: hooks, MCP servers, context sources, subagents, the\n * personality a project declares, all committed to git and shared by a team. Following the\n * override for any of them would move where a project's declared capabilities come from — a\n * behaviour change wearing the costume of a refactor, which is exactly what this function exists\n * to make impossible to do by accident: every config-class reader calls this instead of writing\n * `join(cwd, \".theokit\")` by hand.\n *\n * NOT for the `.claude/`-style foreign roots {@link adaptersForSurface} adds — those are additive,\n * opt-in, and each has its own directory name.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function theokitConfigRoot(cwd: string): string {\n  return join(cwd, THEOKIT_DIR_LITERAL);\n}\n\n/**\n * Every directory a project's configuration may be read from, in precedence order.\n *\n * `.theokit` first — via {@link theokitConfigRoot}, so it is NEVER affected by `THEOKIT_HOME` for\n * the reason documented there — then `.claude`. The order is the whole contract: a project that\n * declares a skill, agent or rule in both means the explicit namespace to win, and a caller merging\n * these roots must therefore keep the FIRST occurrence of a name rather than the last.\n *\n * `.claude` is read because the formats already agree and only the location did not. Measured\n * 2026-08-26: the SKILL.md frontmatter this SDK requires (`name` + `description`) is exactly what\n * the CLI writes, its hook config is the same JSON shape, and 59 of the CLI's agent declarations\n * parse here unchanged. A repository set up for the CLI was failing on the directory name alone.\n *\n * NOT a rename of `.theokit`, and not a migration. Both are read, so nothing that works today stops\n * working — which is why this returns a LIST and not a single resolved answer.\n *\n * Creates nothing and checks nothing; either path may not exist, and the caller owns that.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function projectConfigRoots(\n  cwd: string,\n  sources: readonly CompatSourceDeclaration[],\n  surface: CompatSurface,\n): string[] {\n  return [\n    theokitConfigRoot(cwd),\n    ...adaptersForSurface(sources, surface).map((adapter) => join(cwd, adapter.dirName)),\n  ];\n}\n\n/**\n * Every directory that may hold a plugin BUNDLE contributed by the Claude Code CLI.\n *\n * A CLI plugin is not a JS entry point — it is a folder whose `skills/` and `agents/` are what it\n * exists to provide. Measured 2026-08-26 on an installed one: seven agents and three skills beside\n * a manifest in `.claude-plugin/plugin.json`. Parsing that manifest and stopping there produced a\n * plugin that loaded and did nothing.\n *\n * Project-scoped deliberately. The CLI also keeps plugins under `~/.claude/plugins/cache`, behind\n * its own installer and enable/disable state — reproducing that is an installation system, not\n * reading a project's configuration, and guessing at someone's enablement would run code they\n * turned off.\n */\nexport function pluginBundleRoots(\n  cwd: string,\n  sources: readonly CompatSourceDeclaration[],\n): string[] {\n  // Always the `plugins` surface, including when the caller wants the SKILLS a bundle carries.\n  // A bundle is code, and its skills arrive attached to it: admitting `skills` alone must not\n  // reach inside a foreign plugin directory, or the narrower permission would silently grant the\n  // wider one. `skills-manager` and `subagents-loader` both read bundle contents and both go\n  // through here, so the rule holds in one place rather than three.\n  return projectConfigRoots(cwd, sources, \"plugins\").map((root) => join(root, \"plugins\"));\n}\n\n/**\n * The directory holding every profile: always `~/.theokit/profiles`, from `os.homedir()`.\n *\n * Deliberately NOT affected by `THEOKIT_HOME`, which is the one thing to remember about it. If it\n * followed the override, a session pointed at one profile would only be able to see that profile,\n * and `theokit profile list` could never enumerate the rest. Profiles are the thing the override\n * switches between, so their index cannot live behind it.\n *\n * Takes no `cwd` for the same reason. Creates nothing; the path may not exist.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function getProfilesRoot(): string {\n  return join(homedir(), THEOKIT_DIR_LITERAL, \"profiles\");\n}\n\n/**\n * The same path `getTheokitHome(cwd)` returns, shortened for display: the home directory prefix\n * collapses to `~`, so `/home/ada/.theokit` prints as `~/.theokit`.\n *\n * For humans only — log lines, CLI output, error messages. The result is NOT a usable path: `~`\n * is a shell convention that `fs` does not expand, so passing this to a filesystem call resolves\n * a literal directory named `~` relative to the process cwd. Use `getTheokitHome` for anything\n * that touches disk.\n *\n * Collapsing is a prefix match on the home directory followed by a literal `/`, so a sibling like\n * `/home/adalovelace` is left alone even though `/home/ada` is a string prefix of it. A path\n * outside the home directory comes back unchanged — and so does a Windows path, where the\n * separator is a backslash and the prefix test therefore never matches.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function displayTheokitHome(cwd: string): string {\n  const resolved = getTheokitHome(cwd);\n  const home = homedir();\n  if (resolved === home) return \"~\";\n  if (resolved.startsWith(`${home}/`)) {\n    return `~${resolved.slice(home.length)}`;\n  }\n  return resolved;\n}\n"]}

package/dist/chunk-DRL7URI4.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/internal/judge/parse-verdict.ts","../src/internal/judge/judge-call.ts"],"names":["TheokitAgentError"],"mappings":";;;;;AAaA,IAAM,WAAA,GAAc,OAAA;AACpB,IAAM,eAAA,GAAkB,WAAA;AACxB,IAAM,cAAA,GAAiB,UAAA;AAEvB,IAAM,cAAA,GAAiB,UAAA;AAEhB,SAAS,aAAa,IAAA,EAA2B;AACtD,EAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAE1B,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,WAAW,CAAA,EAAG;AACnC,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,MAAA;AAAA,MACT,QAAQ,OAAA,CAAQ,KAAA,CAAM,WAAA,CAAY,MAAM,EAAE,IAAA,EAAK;AAAA,MAC/C,WAAA,EAAa;AAAA,KACf;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,eAAe,CAAA,EAAG;AACvC,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,UAAA;AAAA,MACT,QAAQ,OAAA,CAAQ,KAAA,CAAM,eAAA,CAAgB,MAAM,EAAE,IAAA,EAAK;AAAA,MACnD,WAAA,EAAa;AAAA,KACf;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,cAAc,CAAA,EAAG;AACtC,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,SAAA;AAAA,MACT,QAAQ,OAAA,CAAQ,KAAA,CAAM,cAAA,CAAe,MAAM,EAAE,IAAA,EAAK;AAAA,MAClD,WAAA,EAAa;AAAA,KACf;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,cAAc,CAAA,EAAG;AACtC,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,SAAA;AAAA,MACT,QAAQ,OAAA,CAAQ,KAAA,CAAM,cAAA,CAAe,MAAM,EAAE,IAAA,EAAK;AAAA,MAClD,WAAA,EAAa;AAAA,KACf;AAAA,EACF;AAKA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,UAAA;AAAA,IACT,QAAQ,CAAA,2BAAA,EAA8B,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,IAC3D,WAAA,EAAa;AAAA,GACf;AACF;;;ACIO,IAAM,oBAAA,GAAN,cAAmCA,mCAAA,CAAkB;AAAA,EAG1D,WAAA,CACW,UAAA,EACA,UAAA,EACT,KAAA,EACA;AACA,IAAA,KAAA;AAAA,MACE,CAAA,0BAAA,EAA6B,UAAU,CAAA,WAAA,EAAc,MAAA,CAAO,UAAU,CAAC,CAAA,iIAAA,CAAA;AAAA,MAGvE,EAAE,IAAA,EAAM,kBAAA,EAAoB,KAAA,EAAO,aAAa,KAAA;AAAM,KACxD;AATS,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAAA,EASX;AAAA,EAVW,UAAA;AAAA,EACA,UAAA;AAAA,EAJO,IAAA,GAAO,sBAAA;AAc3B;AAGA,SAAS,aAAa,GAAA,EAAkC;AACtD,EAAA,MAAM,CAAA,GACH,GAAA,CAAmD,MAAA,IACnD,GAAA,CAAiC,UAAA;AACpC,EAAA,IAAI,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,CAAA;AAClC,EAAA,MAAM,CAAA,GAAI,oBAAoB,IAAA,CAAK,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AACnF,EAAA,OAAO,CAAA,GAAI,CAAC,CAAA,KAAM,MAAA,GAAY,OAAO,CAAA,CAAE,CAAC,CAAC,CAAA,GAAI,MAAA;AAC/C;AAgBA,eAAsB,aAAA,CACpB,GAAA,EACA,OAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,MAAA,GAAS,mBAAmB,GAAG,CAAA;AAErC,EAAA,MAAM,MAAA,GAAS,OAAA,EAAS,MAAA,IAAU,OAAA,CAAQ,GAAA,CAAI,kBAAA;AAC9C,EAAA,IAAI,WAAW,MAAA,EAAW;AACxB,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,UAAA;AAAA,MACT,MAAA,EACE,yFAAA;AAAA,MACF,WAAA,EAAa;AAAA,KACf;AAAA,EACF;AAIA,EAAA,MAAM,UAAA,GAAa,OAAA,EAAS,UAAA,IAAc,OAAA,EAAS,UAAA,IAAc,oBAAA;AACjE,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,KAAK,MAAA,CAAO;AAAA,MAC3B,MAAA;AAAA,MACA,KAAA,EAAO,EAAE,EAAA,EAAI,UAAA,EAAW;AAAA,MACxB,OAAO,EAAC;AAAA,MACR,OAAO,EAAC;AAAA,MACR,QAAA,EAAU,EAAE,UAAA,EAAY,OAAA;AAAQ,KACjB,CAAA;AACjB,IAAA,MAAM,GAAA,GAAM,MAAM,QAAA,CAAS,IAAA,CAAK,MAAM,CAAA;AACtC,IAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,IAAA,OAAO,YAAA,CAAa,MAAA,CAAO,MAAA,IAAU,EAAE,CAAA;AAAA,EACzC,SAAS,GAAA,EAAK;AAIZ,IAAA,MAAM,MAAA,GAAS,aAAa,GAAG,CAAA;AAC/B,IAAA,IAAI,MAAA,KAAW,GAAA,IAAO,MAAA,KAAW,GAAA,IAAO,WAAW,GAAA,EAAK;AACtD,MAAA,MAAM,IAAI,oBAAA,CAAqB,MAAA,EAAQ,UAAA,EAAY,GAAG,CAAA;AAAA,IACxD;AACA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,UAAA;AAAA,MACT,MAAA,EAAQ,sBAAsB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MAC9E,WAAA,EAAa;AAAA,KACf;AAAA,EACF,CAAA,SAAE;AACA,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,IAAI;AACF,QAAA,MAAM,SAAS,OAAA,EAAQ;AAAA,MACzB,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;AAOO,SAAS,mBAAmB,GAAA,EAA2B;AAC5D,EAAA,MAAM,QAAA,GACJ,GAAA,CAAI,QAAA,KAAa,MAAA,IAAa,GAAA,CAAI,QAAA,CAAS,MAAA,GAAS,CAAA,GAAI,GAAA,CAAI,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,GAAI,QAAA;AACpF,EAAA,OAAO,CAAA;;AAAA,MAAA,EAED,IAAI,IAAI;AAAA,UAAA,EACJ,QAAQ;AAAA,qBAAA,EACG,IAAI,YAAY;;AAAA;AAAA;AAAA;AAAA;;AAAA,uCAAA,CAAA;AAQvC","file":"chunk-DRL7URI4.cjs","sourcesContent":["/**\n * Pure verdict parser (T2.1, ADRs D120-D121).\n *\n * Strict prefix matching against `DONE:`, `CONTINUE:`, `SKIPPED:`. Reason\n * is the suffix, trimmed. Anything else is fail-safe: verdict = `continue`,\n * `parseFailed: true` — caller's max-consecutive-failure cap stops the\n * loop after N flakes.\n *\n * @internal\n */\n\nimport type { JudgeResult } from \"../../types/goal-events.js\";\n\nconst DONE_PREFIX = \"DONE:\";\nconst CONTINUE_PREFIX = \"CONTINUE:\";\nconst SKIPPED_PREFIX = \"SKIPPED:\";\n/** M80 — the judge can now declare impossibility, not just \"continue\". */\nconst BLOCKED_PREFIX = \"BLOCKED:\";\n\nexport function parseVerdict(text: string): JudgeResult {\n  const trimmed = text.trim();\n\n  if (trimmed.startsWith(DONE_PREFIX)) {\n    return {\n      verdict: \"done\",\n      reason: trimmed.slice(DONE_PREFIX.length).trim(),\n      parseFailed: false,\n    };\n  }\n  if (trimmed.startsWith(CONTINUE_PREFIX)) {\n    return {\n      verdict: \"continue\",\n      reason: trimmed.slice(CONTINUE_PREFIX.length).trim(),\n      parseFailed: false,\n    };\n  }\n  if (trimmed.startsWith(BLOCKED_PREFIX)) {\n    return {\n      verdict: \"blocked\",\n      reason: trimmed.slice(BLOCKED_PREFIX.length).trim(),\n      parseFailed: false,\n    };\n  }\n  if (trimmed.startsWith(SKIPPED_PREFIX)) {\n    return {\n      verdict: \"skipped\",\n      reason: trimmed.slice(SKIPPED_PREFIX.length).trim(),\n      parseFailed: false,\n    };\n  }\n\n  // Fail-safe: ADR D121 — prefer \"continue\" so we don't stop prematurely.\n  // The runUntil loop counts consecutive parseFailed responses and bails\n  // after `maxConsecutiveJudgeFailures` (default 3).\n  return {\n    verdict: \"continue\",\n    reason: `judge response malformed: \"${trimmed.slice(0, 100)}\"`,\n    parseFailed: true,\n  };\n}\n","import { TheokitAgentError } from \"../../errors.js\";\n/**\n * Judge call primitive (T2.2, ADRs D119-D121).\n *\n * Instantiates a short-lived auxiliary agent that evaluates whether a\n * goal is satisfied. The auxiliary judge runs with `tools: []` and a\n * cheap model (default `openai/gpt-4o-mini`) — see ADR D119. The judge\n * model needs only API access; we read `OPENROUTER_API_KEY` directly\n * from the environment (EC-A — single source of truth) and let the\n * caller override via {@link JudgeOptions.apiKey} for Anthropic or\n * direct-OpenAI environments.\n *\n * NOTE: judge aux agents created from inside a `forkAgent` context will\n * inherit the parent fork's whitelist via AsyncLocalStorage (EC-J).\n * `tools: []` keeps this benign today; future callers that add tools to\n * a judge should be aware.\n *\n * @internal\n */\n\nimport type { AgentOptions, SDKAgent } from \"../../types/agent.js\";\nimport type { JudgeResult } from \"../../types/goal-events.js\";\nimport { parseVerdict } from \"./parse-verdict.js\";\n\n/** Inputs to the judge — pure data. */\nexport interface JudgeContext {\n  goal: string;\n  lastResponse: string;\n  subgoals?: string[];\n}\n\n/** Caller-supplied tuning knobs for the judge call. */\nexport interface JudgeOptions {\n  /**\n   * Judge model identifier. When absent, it DERIVES from {@link agentModel} — and only falls back to the literal\n   * `\"openai/gpt-4o-mini\"` when neither is provided.\n   *\n   * M80 — the fixed default was provider-blind: it only resolves on OpenRouter. With an Anthropic key it gives\n   * 404, with an OAuth bearer it gives 401, and in both the goal burned 3 whole turns before failing with\n   * a misleading reason. The agent-builder already worked around this by deriving on its own; the knowledge\n   * belongs here.\n   */\n  judgeModel?: string;\n  /**\n   * M80 — the DRIVEN agent's model. It is the basis of the derivation: a judge running on the same model as the\n   * chat works wherever chat works.\n   */\n  agentModel?: string;\n  /** Override env. Default `process.env.OPENROUTER_API_KEY` (EC-A). */\n  apiKey?: string;\n}\n\n/**\n * M80 — the judge's credential or model does not work: 401/404.\n *\n * Fails FAST by design. `rules/error-handling.md` § 2 separates recoverable from unrecoverable, and a\n * nonexistent model does not start existing on retry — folding that into `{parseFailed: true}` made the loop\n * try three times and report \"failed\" on a consecutive-failure limit, hiding that the cause was the\n * credential. A slow, opaque failure traded for a fast, clear one.\n *\n * PARSE failures and network errors stay folded: they are recoverable, and the loop already decides on\n * in a row.\n */\nexport class JudgeCredentialError extends TheokitAgentError {\n  override readonly name = \"JudgeCredentialError\";\n\n  constructor(\n    readonly httpStatus: number,\n    readonly judgeModel: string,\n    cause: unknown,\n  ) {\n    super(\n      `judge unavailable: model \"${judgeModel}\" returned ${String(httpStatus)}. ` +\n        \"Pass `judgeModel`/`apiKey` that resolve for this provider, or omit `judgeModel` to derive \" +\n        \"it from the agent being driven.\",\n      { code: \"judge_credential\", cause, isRetryable: false },\n    );\n  }\n}\n\n/** Extracts the HTTP status from a provider error, when it carries one. */\nfunction httpStatusOf(err: unknown): number | undefined {\n  const s =\n    (err as { status?: unknown; statusCode?: unknown }).status ??\n    (err as { statusCode?: unknown }).statusCode;\n  if (typeof s === \"number\") return s;\n  const m = /\\b(401|403|404)\\b/.exec(err instanceof Error ? err.message : String(err));\n  return m?.[1] !== undefined ? Number(m[1]) : undefined;\n}\n\n/** Dependencies injected so `judge-call.ts` stays free of `Agent` import. */\nexport interface JudgeDeps {\n  create: (options: AgentOptions) => Promise<SDKAgent>;\n}\n\n/**\n * Run the judge auxiliary agent and parse the verdict. Always returns a\n * `JudgeResult` — failures are folded into `{ parseFailed: true,\n * verdict: \"continue\" }` so the loop can decide based on consecutive\n * failures (ADR D121).\n *\n * @internal\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: judge call must (1) check env or override, (2) catch errors as fail-safe, (3) ensure aux dispose runs once regardless of outcome — three concerns linearly arranged, harm clarity to extract.\nexport async function judgeCallImpl(\n  ctx: JudgeContext,\n  options: JudgeOptions | undefined,\n  deps: JudgeDeps,\n): Promise<JudgeResult> {\n  const prompt = composeJudgePrompt(ctx);\n  // EC-A: single env source — OpenRouter only. No multi-provider fallback.\n  const apiKey = options?.apiKey ?? process.env.OPENROUTER_API_KEY;\n  if (apiKey === undefined) {\n    return {\n      verdict: \"continue\",\n      reason:\n        \"judge unavailable: OPENROUTER_API_KEY missing and no override passed via options.apiKey\",\n      parseFailed: true,\n    };\n  }\n\n  // M80 — precedence: explicit > driven agent's model > the historical literal. The literal only\n  // survives as a last resort, so as not to break callers who never passed either.\n  const judgeModel = options?.judgeModel ?? options?.agentModel ?? \"openai/gpt-4o-mini\";\n  let auxAgent: SDKAgent | undefined;\n  try {\n    auxAgent = await deps.create({\n      apiKey,\n      model: { id: judgeModel },\n      tools: [],\n      local: {},\n      metadata: { forkOrigin: \"judge\" },\n    } as AgentOptions);\n    const run = await auxAgent.send(prompt);\n    const result = await run.wait();\n    return parseVerdict(result.result ?? \"\");\n  } catch (err) {\n    // M80 — 401/403/404 are credential/model errors: unrecoverable, failing fast and typed. Everything\n    // else (network, timeout, 5xx) stays folded, because it IS recoverable and the loop already decides on\n    // in a row.\n    const status = httpStatusOf(err);\n    if (status === 401 || status === 403 || status === 404) {\n      throw new JudgeCredentialError(status, judgeModel, err);\n    }\n    return {\n      verdict: \"continue\",\n      reason: `judge call failed: ${err instanceof Error ? err.message : String(err)}`,\n      parseFailed: true,\n    };\n  } finally {\n    if (auxAgent !== undefined) {\n      try {\n        await auxAgent.dispose();\n      } catch {\n        // dispose errors are non-fatal; judge result is already prepared\n      }\n    }\n  }\n}\n\n/**\n * Build the strict-format prompt the judge expects.\n *\n * @internal\n */\nexport function composeJudgePrompt(ctx: JudgeContext): string {\n  const subgoals =\n    ctx.subgoals !== undefined && ctx.subgoals.length > 0 ? ctx.subgoals.join(\", \") : \"(none)\";\n  return `You are a goal judge. Determine if this goal is satisfied.\n\nGoal: ${ctx.goal}\nSubgoals: ${subgoals}\nLast agent response: ${ctx.lastResponse}\n\nRespond with EXACTLY one of:\n- DONE: <reason>\n- CONTINUE: <what's left>\n- SKIPPED: <why not applicable>\n\nBe strict. If unclear, prefer CONTINUE.`;\n}\n"]}

package/dist/chunk-GUKPXDGJ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/internal/runtime/compat/foreign-config-sources.ts","../src/internal/persistence/paths.ts"],"names":["join"],"mappings":";;;;;AAmDO,IAAM,mBAAA,GAAsB,UAAA;AAG5B,IAAM,eAAA,GAAkB,SAAA;AAkBxB,IAAM,aAAA,GAAqC;AAAA,EAChD,IAAA,EAAM,SAAA;AAAA,EACN,OAAA,EAAS,mBAAA;AAAA,EACT,UAAA,EAAY,OAAO,EAAC;AACtB,CAAA;AAWO,IAAM,kBAAA,GAA0C;AAAA,EACrD,IAAA,EAAM,aAAA;AAAA,EACN,OAAA,EAAS,eAAA;AAAA,EACT,UAAA,EAAY,CAAC,GAAA,MAAS,EAAE,oBAAoB,GAAA,EAAI;AAClD,CAAA;AAEA,IAAM,eAAA,GAAkD,CAAC,kBAAkB,CAAA;AAE3E,IAAM,cAAwD,IAAI,GAAA;AAAA,EAChE,CAAC,aAAA,EAAe,GAAG,eAAe,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,OAAA,EAAS,CAAC,CAAC;AAC/D,CAAA;AASO,SAAS,YAAY,KAAA,EAAiD;AAC3E,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,eAAA,CAAgB,GAAA,CAAI,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,IAAA,EAAM,CAAC,CAAC,CAAC,CAAA;AAC9D,EAAA,MAAM,MAA6B,EAAC;AACpC,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AAC/B,IAAA,IAAI,OAAA,KAAY,UAAa,CAAC,GAAA,CAAI,SAAS,OAAO,CAAA,EAAG,GAAA,CAAI,IAAA,CAAK,OAAO,CAAA;AAAA,EACvE;AACA,EAAA,OAAO,GAAA;AACT;AAYA,IAAM,eAAA,GAA4C,CAAC,OAAA,EAAS,SAAA,EAAW,UAAU,WAAW,CAAA;AAsBrF,SAAS,kBAAA,CACd,SACA,OAAA,EACuB;AACvB,EAAA,MAAM,WAAqB,EAAC;AAC5B,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,IAAI,OAAO,WAAW,QAAA,EAAU;AAC9B,MAAA,QAAA,CAAS,KAAK,MAAM,CAAA;AACpB,MAAA;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,IAAU,EAAC;AACjC,IAAA,IAAI,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,KAAM,WAAW,eAAA,CAAgB,QAAA,CAAS,CAAkB,CAAC,CAAA,EAAG;AACrF,MAAA,QAAA,CAAS,IAAA,CAAK,OAAO,IAAI,CAAA;AAAA,IAC3B;AAAA,EACF;AACA,EAAA,OAAO,YAAY,QAAQ,CAAA;AAC7B;AASO,SAAS,qBAAqB,IAAA,EAA+C;AAClF,EAAA,KAAA,MAAW,OAAA,IAAW,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA,EAAG;AACzC,IAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,CAAI,OAAO,CAAA;AACvC,IAAA,IAAI,OAAA,KAAY,QAAW,OAAO,OAAA;AAAA,EACpC;AACA,EAAA,OAAO,MAAA;AACT;AAuBO,SAAS,oBAAA,CACd,OAAA,EACA,QAAA,EACA,GAAA,GAAoD,QAAQ,GAAA,EAClD;AAEV,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,OAAA,CAAQ,UAAA,EAAY,GAAG,CAAA;AAChD,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAC9B,EAAA,KAAA,MAAW,SAAS,QAAA,CAAS,QAAA;AAAA,IAC3B;AAAA,GACF,EAAG;AACD,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,CAAC,CAAA,IAAK,MAAM,CAAC,CAAA;AAChC,IAAA,IAAI,SAAS,MAAA,EAAW;AACxB,IAAA,IAAI,QAAQ,QAAA,EAAU;AACtB,IAAA,IAAI,GAAA,CAAI,IAAI,CAAA,KAAM,MAAA,EAAW;AAC7B,IAAA,KAAA,CAAM,IAAI,IAAI,CAAA;AAAA,EAChB;AACA,EAAA,OAAO,CAAC,GAAG,KAAK,CAAA;AAClB;AAQA,IAAM,QAAA,uBAAe,GAAA,EAAY;AA4C1B,SAAS,uBAAA,CACd,KACA,QAAA,EACM;AAKN,EAAA,MAAM,gBAAgB,IAAI,GAAA;AAAA,IACxB,YAAY,QAAA,CAAS,GAAA,CAAI,CAAC,CAAA,KAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,CAAA,CAAE,IAAK,CAAC,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,EAAE,IAAI;AAAA,GAC1F;AACA,EAAA,KAAA,MAAW,WAAW,eAAA,EAAiB;AACrC,IAAA,IAAI,aAAA,CAAc,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,EAAG;AACrC,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,EAAK,OAAA,CAAQ,OAAO,CAAA;AACrC,IAAA,IAAI,CAAC,UAAA,CAAW,GAAG,CAAA,EAAG;AACtB,IAAA,IAAI,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,EAAG;AACvB,IAAA,QAAA,CAAS,IAAI,GAAG,CAAA;AAChB,IAAA,WAAA;AAAA,MACE,CAAA,UAAA,EAAa,OAAA,CAAQ,OAAO,CAAA,mIAAA,EAEG,QAAQ,IAAI,CAAA;AAAA;AAAA,KAC7C;AAAA,EACF;AACF;;;ACvOO,SAAS,eAAe,GAAA,EAAqB;AAClD,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,YAAA,EAAc,IAAA,EAAK;AAChD,EAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AACjD,IAAA,OAAO,QAAA;AAAA,EACT;AACA,EAAA,OAAOA,IAAAA,CAAK,KAAK,mBAAmB,CAAA;AACtC;AAmBO,SAAS,kBAAkB,GAAA,EAAqB;AACrD,EAAA,OAAOA,IAAAA,CAAK,KAAK,mBAAmB,CAAA;AACtC;AAuBO,SAAS,kBAAA,CACd,GAAA,EACA,OAAA,EACA,OAAA,EACU;AACV,EAAA,OAAO;AAAA,IACL,kBAAkB,GAAG,CAAA;AAAA,IACrB,GAAG,kBAAA,CAAmB,OAAA,EAAS,OAAO,CAAA,CAAE,GAAA,CAAI,CAAC,OAAA,KAAYA,IAAAA,CAAK,GAAA,EAAK,OAAA,CAAQ,OAAO,CAAC;AAAA,GACrF;AACF;AAeO,SAAS,iBAAA,CACd,KACA,OAAA,EACU;AAMV,EAAA,OAAO,kBAAA,CAAmB,GAAA,EAAK,OAAA,EAAS,SAAS,CAAA,CAAE,GAAA,CAAI,CAAC,IAAA,KAASA,IAAAA,CAAK,IAAA,EAAM,SAAS,CAAC,CAAA;AACxF;AAeO,SAAS,eAAA,GAA0B;AACxC,EAAA,OAAOA,IAAAA,CAAK,OAAA,EAAQ,EAAG,mBAAA,EAAqB,UAAU,CAAA;AACxD;AAmBO,SAAS,mBAAmB,GAAA,EAAqB;AACtD,EAAA,MAAM,QAAA,GAAW,eAAe,GAAG,CAAA;AACnC,EAAA,MAAM,OAAO,OAAA,EAAQ;AACrB,EAAA,IAAI,QAAA,KAAa,MAAM,OAAO,GAAA;AAC9B,EAAA,IAAI,QAAA,CAAS,UAAA,CAAW,CAAA,EAAG,IAAI,GAAG,CAAA,EAAG;AACnC,IAAA,OAAO,CAAA,CAAA,EAAI,QAAA,CAAS,KAAA,CAAM,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA;AAAA,EACxC;AACA,EAAA,OAAO,QAAA;AACT","file":"chunk-GUKPXDGJ.js","sourcesContent":["import { existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\nimport { diagFailure } from \"../../diagnostics.js\";\n\n/*\n * The foreign configuration dialects this SDK can read, and what each one PRESUMES.\n *\n * ## Why a registry and not a list of directory names\n *\n * `projectConfigRoots` returned `[\".theokit\", \".claude\"]` — two paths — and that shape is what\n * usetheokit/theokit-sdk#522 fell through. A path says WHERE a file lives. It does not say how the\n * file is parsed, and it does not say what runtime the commands inside it were written against.\n *\n * Claude Code defines `$CLAUDE_PROJECT_DIR` for the hook commands in its `settings.json`, and its\n * documentation tells authors to reach project files through it — an absolute path would break for\n * every other person on the team, so the shape that failed here is the shape upstream recommends.\n * This SDK read the file and ran the command without the variable. `sh` expands an unset variable to\n * the empty string, so\n *\n *     bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/guard.sh\"   became   bash \"/.claude/hooks/guard.sh\"\n *\n * which does not exist, which a hook runner correctly reads as a refusal. Every turn denied, in any\n * repository that also had Claude Code set up, with a message naming a file that was present and\n * executable all along.\n *\n * Importing a format means accepting the contract that format presumes. An adapter is where that\n * contract is written down, so the next dialect (`.codex/` is the obvious one) declares its own\n * instead of inheriting a hole.\n *\n * ## What an adapter deliberately does NOT do\n *\n * It does not make the foreign source trusted, and it does not make its hooks permissive: a script\n * that exits non-zero is still a refusal. It supplies the variables the format's authors were\n * entitled to assume, and nothing else — `env` here is merged over the scrubbed inherit policy by\n * `spawnAndCollect`, so it adds names rather than widening what a child can see.\n *\n * @internal\n */\n\n/**\n * The project config directory literal.\n *\n * Renamed from `THEOKIT_DIR_NAME` in #410. Sharing a name with the (now removed) sovereign env var\n * was the MECHANISM of that defect, not scenery: every grep for the variable landed on that const\n * and looked answered, so \"is it read?\" returned five hits and nobody checked what they were.\n *\n * Lives here rather than in `persistence/paths.ts` because a directory name is one third of what a\n * dialect is — the other two being how it parses and what it presumes — and splitting the three\n * across two modules is what let the third go unwritten.\n */\nexport const THEOKIT_DIR_LITERAL = \".theokit\";\n\n/** The Claude Code CLI's project configuration directory. */\nexport const CLAUDE_DIR_NAME = \".claude\";\n\n/** A configuration dialect this SDK understands. `theokit` is native; the rest are foreign. */\nexport interface ConfigSourceAdapter {\n  /** Stable identifier, and what a consumer names to opt in. */\n  readonly kind: string;\n  /** The project-relative directory the dialect keeps its configuration in. */\n  readonly dirName: string;\n  /**\n   * Variables the dialect's own runtime defines for commands it executes.\n   *\n   * Empty for the native source: a `.theokit/` hook is written against THIS runtime and inherits it\n   * already. Non-empty is what makes a foreign command runnable rather than silently broken.\n   */\n  runtimeEnv(cwd: string): Record<string, string>;\n}\n\n/** The native source. Always read, never opted into, always first for precedence. */\nexport const NATIVE_SOURCE: ConfigSourceAdapter = {\n  kind: \"theokit\",\n  dirName: THEOKIT_DIR_LITERAL,\n  runtimeEnv: () => ({}),\n};\n\n/**\n * Claude Code.\n *\n * `CLAUDE_PROJECT_DIR` is the documented way for a hook command in `settings.json` to reach a file\n * in the project. Only that one variable is supplied: `$CLAUDE_PLUGIN_ROOT` and the rest of that\n * runtime's surface are NOT defined here, because supplying a name whose value this SDK would have\n * to invent is worse than leaving it unset — an invented root sends a script somewhere real and\n * wrong, where an unset one fails loudly.\n */\nexport const CLAUDE_CODE_SOURCE: ConfigSourceAdapter = {\n  kind: \"claude-code\",\n  dirName: CLAUDE_DIR_NAME,\n  runtimeEnv: (cwd) => ({ CLAUDE_PROJECT_DIR: cwd }),\n};\n\nconst FOREIGN_SOURCES: readonly ConfigSourceAdapter[] = [CLAUDE_CODE_SOURCE];\n\nconst BY_DIR_NAME: ReadonlyMap<string, ConfigSourceAdapter> = new Map(\n  [NATIVE_SOURCE, ...FOREIGN_SOURCES].map((a) => [a.dirName, a]),\n);\n\n/**\n * The adapters a caller declared, in declaration order, skipping any name that names no adapter.\n *\n * An unknown name is DROPPED rather than turned into `<cwd>/<name>`: a typo must fail closed. Making\n * a directory out of an unrecognised string would import a dialect nothing knows how to parse — and\n * the whole reason this exists is that a directory name was never enough to describe a dialect.\n */\nexport function adaptersFor(kinds: readonly string[]): ConfigSourceAdapter[] {\n  const byKind = new Map(FOREIGN_SOURCES.map((a) => [a.kind, a]));\n  const out: ConfigSourceAdapter[] = [];\n  for (const kind of kinds) {\n    const adapter = byKind.get(kind);\n    if (adapter !== undefined && !out.includes(adapter)) out.push(adapter);\n  }\n  return out;\n}\n\n/**\n * A surface a foreign source may be admitted to. The four the SDK reads a project directory for.\n *\n * They are listed separately because they carry very different risk, which is the whole reason\n * #524 asks for per-surface control: a skill is text that enters the system prompt, a hook is\n * command execution, a plugin is code loading. A consumer who wants their skills back has no\n * reason to be handed the other two along with them.\n */\nexport type CompatSurface = \"hooks\" | \"plugins\" | \"skills\" | \"subagents\";\n\nconst COMPAT_SURFACES: readonly CompatSurface[] = [\"hooks\", \"plugins\", \"skills\", \"subagents\"];\n\n/**\n * A declared foreign source: a bare kind, or a kind with the surfaces it may be read for.\n */\nexport type CompatSourceDeclaration =\n  | string\n  | { readonly kind: string; readonly import?: readonly string[] };\n\n/**\n * The adapters admitted to ONE surface.\n *\n * Three rules, and each one fails closed:\n *\n * - A bare string admits every surface. It is what `5.0.0-next.1` published, so narrowing it\n *   silently would turn a working opt-in into a no-op — the exact defect #524 is about, one level\n *   up.\n * - An object with no `import` admits nothing. The issue's own rule, and safe to apply strictly\n *   because the object form is new and nobody can be depending on it.\n * - An unrecognised surface name is dropped rather than matched loosely, for the same reason an\n *   unrecognised KIND is dropped in {@link adaptersFor}: a typo must not silently widen access.\n */\nexport function adaptersForSurface(\n  sources: readonly CompatSourceDeclaration[],\n  surface: CompatSurface,\n): ConfigSourceAdapter[] {\n  const admitted: string[] = [];\n  for (const source of sources) {\n    if (typeof source === \"string\") {\n      admitted.push(source);\n      continue;\n    }\n    const wanted = source.import ?? [];\n    if (wanted.some((s) => s === surface && COMPAT_SURFACES.includes(s as CompatSurface))) {\n      admitted.push(source.kind);\n    }\n  }\n  return adaptersFor(admitted);\n}\n\n/**\n * The adapter whose directory an absolute config path sits under, or `undefined` for a path that\n * belongs to no registered dialect.\n *\n * Matched on the path SEGMENT rather than with `includes`, so a workspace that happens to live under\n * `/home/me/.claude-backups/repo` does not read as a Claude Code source.\n */\nexport function adapterForConfigPath(path: string): ConfigSourceAdapter | undefined {\n  for (const segment of path.split(/[\\\\/]/)) {\n    const adapter = BY_DIR_NAME.get(segment);\n    if (adapter !== undefined) return adapter;\n  }\n  return undefined;\n}\n\n/**\n * Variable references in a shell command that nothing will define.\n *\n * The second half of #522, and the half that cost the debugging session. `sh` expands an unset\n * variable to the empty string and says nothing, so the failure surfaces ten characters later as a\n * path: `bash: /.claude/hooks/guard.sh: No such file or directory` — which reads as \"your script is\n * missing\" while the script is present and executable. Nothing in that message contains the name of\n * the variable that was actually missing, so the reader looks in the wrong place.\n *\n * Checked against BOTH the process environment and the variables the dialect supplies, because\n * either is a legitimate source: a hook may reasonably use `$HOME`.\n *\n * ## What it deliberately does not try to be\n *\n * This is not a shell parser. It finds `$NAME` and `${NAME}` outside single quotes, which is the\n * shape a config file's hook commands take. It does NOT understand `${NAME:-default}` (a default\n * makes the variable optional, so it is not reported), assignments earlier in the same command, or\n * variables a sourced script exports. A false NEGATIVE there costs the old behaviour — the confusing\n * path error — and a false positive would deny a hook that would have worked, so the parse errs\n * toward silence and the check only ever ADDS a name to a failure that already happened.\n */\nexport function undefinedVariablesIn(\n  command: string,\n  supplied: Readonly<Record<string, string>>,\n  env: Readonly<Record<string, string | undefined>> = process.env,\n): string[] {\n  // Single-quoted spans are literal in `sh`: `echo '$FOO'` prints the dollar sign.\n  const unquoted = command.replace(/'[^']*'/g, \" \");\n  const names = new Set<string>();\n  for (const match of unquoted.matchAll(\n    /\\$\\{([A-Za-z_][A-Za-z0-9_]*)\\}|\\$([A-Za-z_][A-Za-z0-9_]*)/g,\n  )) {\n    const name = match[1] ?? match[2];\n    if (name === undefined) continue;\n    if (name in supplied) continue;\n    if (env[name] !== undefined) continue;\n    names.add(name);\n  }\n  return [...names];\n}\n\n/**\n * Workspaces already reported, so repeated agent construction in one process says it once.\n *\n * Keyed by the resolved directory rather than by dialect kind, so a long-lived host that drives\n * several workspaces still reports each of them.\n */\nconst reported = new Set<string>();\n\n/**\n * Reports a foreign configuration directory that exists in the workspace and was not declared.\n *\n * ## Why the flip needs a voice\n *\n * Before #524 a `.claude/` was read with no opt-in; after it, the same directory is ignored. From\n * inside the repository the two states are indistinguishable — the hook file is there, it is\n * executable, and it does not run. The only remaining way to learn why is a CHANGELOG entry for a\n * version the reader may not know they crossed.\n *\n * ## Why `diagFailure` rather than `diag` (#563)\n *\n * This used `diag`, on the reasoning that ignoring an undeclared directory is not a failure and\n * that a repository which does NOT want the import should not pay a stderr line for behaving as\n * instructed. The reasoning was sound and rested on a premise nobody checked: that a host would\n * have installed a sink.\n *\n * Measured against the published `5.0.0`. `diag` returns without doing anything when no sink is\n * installed. The SDK installs none — `currentSink()` reads a `globalThis` slot only\n * `setDiagnosticsSink` fills. Neither observable host installs one either: `theocode` renamed the\n * key, and `theokit` exports `installDiagnosticSink` and never calls it. Two hosts out of two, and\n * the SDK itself. So the message the CHANGELOG promised — \"says so once, on the diagnostics\n * channel\" — reached nobody, while the consumer lost hooks, skills, subagents and plugins.\n *\n * A mitigation announced in release notes for a silent loss of capability is not a diagnostic. It\n * is the error path of the breaking change itself, and `diagFailure` exists for exactly the message\n * that must not be swallowed.\n *\n * The cost the old reasoning named is real and is now paid: a repository that wants the directory\n * ignored sees a line. What makes that acceptable — ONCE per directory per process, not per turn\n * (`reported` below); and before #524 that repository was having `.claude/` imported anyway, so the\n * line it now sees confirms the fix it wanted. The asymmetry is one line of text against silently\n * losing four subsystems.\n *\n * A host that installs a sink still owns its render surface: `diagFailure` prefers the sink and\n * only falls back to stderr when there is none.\n *\n * NOT solved here: there is no way to say \"I know, and I want none\". `compatSources: []` would be\n * the natural spelling, but `resolveCompatSources` collapses it into the same `[]` an absent option\n * produces, so this function cannot tell them apart. If the noise turns out to matter, threading\n * that distinction through is the shape of the fix.\n */\nexport function reportUndeclaredSources(\n  cwd: string,\n  declared: readonly CompatSourceDeclaration[],\n): void {\n  // A kind named with a NARROW import list has still been declared: the consumer knows the\n  // directory is there and chose which surfaces to admit. Warning them anyway would be the noise\n  // that gets a warning ignored, and this one has exactly one job — telling somebody who does NOT\n  // know the directory is being skipped.\n  const declaredKinds = new Set(\n    adaptersFor(declared.map((d) => (typeof d === \"string\" ? d : d.kind))).map((a) => a.kind),\n  );\n  for (const adapter of FOREIGN_SOURCES) {\n    if (declaredKinds.has(adapter.kind)) continue;\n    const dir = join(cwd, adapter.dirName);\n    if (!existsSync(dir)) continue;\n    if (reported.has(dir)) continue;\n    reported.add(dir);\n    diagFailure(\n      `[theokit] ${adapter.dirName}/ is present but not declared, so its hooks, skills, subagents ` +\n        `and plugins are ignored. To read it, pass ` +\n        `local: { compatSources: [\"${adapter.kind}\"] } (usetheokit/theokit-sdk#524).\\n`,\n    );\n  }\n}\n","/**\n * Path resolution for SDK state files (ADR D60).\n *\n * Theokit anchors state at `<cwd>/.theokit/` by default (per-cwd). An\n * optional `THEOKIT_HOME` environment variable overrides this, enabling\n * test isolation, profile switching, and multi-tenant deployments.\n *\n * Rules:\n *   - `getTheokitHome(cwd)` is the canonical resolver **for cwd-anchored state**. Never hardcode\n *     `path.join(cwd, \".theokit\")` in callers — use this function so tests\n *     and overrides stay consistent.\n *\n *     M94 — this comment said \"the ONLY canonical resolver\", and stopped being true: the\n *     transcript gained `transcriptRoot()`, which is **home-anchored** (`~/.theokit`) with the same\n *     `THEOKIT_HOME` override. The two defaults differ on purpose — unifying would move the\n *     transcript of everyone who does NOT set the variable, which is a data migration and not a\n *     re-export.\n *\n *     A consequence worth writing down: **without `THEOKIT_HOME` the state stays split in two**\n *     — registry in `<cwd>/.theokit`, transcript in `~/.theokit`. M94 unifies only for those who set\n *     the variable. Unifying both defaults is another milestone's work.\n *   - `getProfilesRoot()` is intentionally home-anchored (not affected by\n *     `THEOKIT_HOME`) so `theokit profile list` discovers all profiles\n *     regardless of which is active.\n *   - `displayTheokitHome(cwd)` returns a human-readable path for logs.\n *\n * @internal\n */\n\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\n\nimport {\n  adaptersForSurface,\n  type CompatSourceDeclaration,\n  type CompatSurface,\n  THEOKIT_DIR_LITERAL,\n} from \"../runtime/compat/foreign-config-sources.js\";\n\n// The directory names live with the dialect registry that owns them — a name is one third of what a\n// configuration dialect is, and keeping the three together is what stops the next one shipping\n// without its runtime contract (#522).\n\n/**\n * Resolve the directory cwd-anchored SDK state lives in.\n *\n * `THEOKIT_HOME` wins when it is set and not blank after trimming; the trimmed value is used, and\n * it is used VERBATIM — it is not resolved against `cwd`, so a relative value stays relative and\n * `.theokit` is not appended to it. Otherwise the answer is `<cwd>/.theokit`.\n *\n * The environment is read on every call, so a change to the variable takes effect immediately\n * rather than being frozen at import.\n *\n * This creates nothing and checks nothing: the returned path may not exist, and the caller owns\n * the `mkdir`. Call it instead of writing `join(cwd, \".theokit\")` by hand, or the override stops\n * working for that one call site and tests silently touch the real home.\n *\n * Not the whole story about where state lives — the transcript is home-anchored via\n * `transcriptRoot()`, honoring the same variable but defaulting to `~/.theokit`. With\n * `THEOKIT_HOME` unset, state is genuinely split between two roots.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function getTheokitHome(cwd: string): string {\n  const override = process.env.THEOKIT_HOME?.trim();\n  if (override !== undefined && override.length > 0) {\n    return override;\n  }\n  return join(cwd, THEOKIT_DIR_LITERAL);\n}\n\n/**\n * The project's own configuration root: `<cwd>/.theokit`, always — never `THEOKIT_HOME`.\n *\n * `THEOKIT_HOME` relocates cwd-anchored SDK STATE (sessions, credentials). A project's\n * CONFIGURATION belongs to the repository: hooks, MCP servers, context sources, subagents, the\n * personality a project declares, all committed to git and shared by a team. Following the\n * override for any of them would move where a project's declared capabilities come from — a\n * behaviour change wearing the costume of a refactor, which is exactly what this function exists\n * to make impossible to do by accident: every config-class reader calls this instead of writing\n * `join(cwd, \".theokit\")` by hand.\n *\n * NOT for the `.claude/`-style foreign roots {@link adaptersForSurface} adds — those are additive,\n * opt-in, and each has its own directory name.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function theokitConfigRoot(cwd: string): string {\n  return join(cwd, THEOKIT_DIR_LITERAL);\n}\n\n/**\n * Every directory a project's configuration may be read from, in precedence order.\n *\n * `.theokit` first — via {@link theokitConfigRoot}, so it is NEVER affected by `THEOKIT_HOME` for\n * the reason documented there — then `.claude`. The order is the whole contract: a project that\n * declares a skill, agent or rule in both means the explicit namespace to win, and a caller merging\n * these roots must therefore keep the FIRST occurrence of a name rather than the last.\n *\n * `.claude` is read because the formats already agree and only the location did not. Measured\n * 2026-08-26: the SKILL.md frontmatter this SDK requires (`name` + `description`) is exactly what\n * the CLI writes, its hook config is the same JSON shape, and 59 of the CLI's agent declarations\n * parse here unchanged. A repository set up for the CLI was failing on the directory name alone.\n *\n * NOT a rename of `.theokit`, and not a migration. Both are read, so nothing that works today stops\n * working — which is why this returns a LIST and not a single resolved answer.\n *\n * Creates nothing and checks nothing; either path may not exist, and the caller owns that.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function projectConfigRoots(\n  cwd: string,\n  sources: readonly CompatSourceDeclaration[],\n  surface: CompatSurface,\n): string[] {\n  return [\n    theokitConfigRoot(cwd),\n    ...adaptersForSurface(sources, surface).map((adapter) => join(cwd, adapter.dirName)),\n  ];\n}\n\n/**\n * Every directory that may hold a plugin BUNDLE contributed by the Claude Code CLI.\n *\n * A CLI plugin is not a JS entry point — it is a folder whose `skills/` and `agents/` are what it\n * exists to provide. Measured 2026-08-26 on an installed one: seven agents and three skills beside\n * a manifest in `.claude-plugin/plugin.json`. Parsing that manifest and stopping there produced a\n * plugin that loaded and did nothing.\n *\n * Project-scoped deliberately. The CLI also keeps plugins under `~/.claude/plugins/cache`, behind\n * its own installer and enable/disable state — reproducing that is an installation system, not\n * reading a project's configuration, and guessing at someone's enablement would run code they\n * turned off.\n */\nexport function pluginBundleRoots(\n  cwd: string,\n  sources: readonly CompatSourceDeclaration[],\n): string[] {\n  // Always the `plugins` surface, including when the caller wants the SKILLS a bundle carries.\n  // A bundle is code, and its skills arrive attached to it: admitting `skills` alone must not\n  // reach inside a foreign plugin directory, or the narrower permission would silently grant the\n  // wider one. `skills-manager` and `subagents-loader` both read bundle contents and both go\n  // through here, so the rule holds in one place rather than three.\n  return projectConfigRoots(cwd, sources, \"plugins\").map((root) => join(root, \"plugins\"));\n}\n\n/**\n * The directory holding every profile: always `~/.theokit/profiles`, from `os.homedir()`.\n *\n * Deliberately NOT affected by `THEOKIT_HOME`, which is the one thing to remember about it. If it\n * followed the override, a session pointed at one profile would only be able to see that profile,\n * and `theokit profile list` could never enumerate the rest. Profiles are the thing the override\n * switches between, so their index cannot live behind it.\n *\n * Takes no `cwd` for the same reason. Creates nothing; the path may not exist.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function getProfilesRoot(): string {\n  return join(homedir(), THEOKIT_DIR_LITERAL, \"profiles\");\n}\n\n/**\n * The same path `getTheokitHome(cwd)` returns, shortened for display: the home directory prefix\n * collapses to `~`, so `/home/ada/.theokit` prints as `~/.theokit`.\n *\n * For humans only — log lines, CLI output, error messages. The result is NOT a usable path: `~`\n * is a shell convention that `fs` does not expand, so passing this to a filesystem call resolves\n * a literal directory named `~` relative to the process cwd. Use `getTheokitHome` for anything\n * that touches disk.\n *\n * Collapsing is a prefix match on the home directory followed by a literal `/`, so a sibling like\n * `/home/adalovelace` is left alone even though `/home/ada` is a string prefix of it. A path\n * outside the home directory comes back unchanged — and so does a Windows path, where the\n * separator is a backslash and the prefix test therefore never matches.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function displayTheokitHome(cwd: string): string {\n  const resolved = getTheokitHome(cwd);\n  const home = homedir();\n  if (resolved === home) return \"~\";\n  if (resolved.startsWith(`${home}/`)) {\n    return `~${resolved.slice(home.length)}`;\n  }\n  return resolved;\n}\n"]}

package/dist/chunk-QME6FDFG.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/internal/concurrency/delegation-depth.ts","../src/internal/concurrency/subagent-credentials.ts","../src/a2a/subagent.ts"],"names":["AsyncLocalStorage","TheokitAgentError","getAgentFacade","z"],"mappings":";;;;;;;AA6BA,IAAM,UAAA,GAAa,IAAIA,6BAAA,EAA0B;AAWjD,eAAsB,mBAAA,CAAuB,OAAe,EAAA,EAAkC;AAC5F,EAAA,OAAO,UAAA,CAAW,GAAA,CAAI,KAAA,EAAO,EAAE,CAAA;AACjC;AAUO,SAAS,sBAAA,GAAiC;AAC/C,EAAA,OAAO,UAAA,CAAW,UAAS,IAAK,CAAA;AAClC;ACiBA,IAAM,gBAAA,GAAmB,IAAIA,6BAAAA,EAAwC;AAUrE,eAAsB,gCAAA,CACpB,aACA,EAAA,EACY;AACZ,EAAA,OAAO,gBAAA,CAAiB,GAAA,CAAI,WAAA,EAAa,EAAE,CAAA;AAC7C;AAWO,SAAS,mCAAA,GAAwE;AACtF,EAAA,OAAO,iBAAiB,QAAA,EAAS;AACnC;;;ACsHO,IAAM,uBAAA,GAAN,cAAsCC,mCAAA,CAAkB;AAAA,EAG7D,WAAA,CACkB,cACA,QAAA,EAChB;AAEA,IAAA,KAAA,CAAM,CAAA,qBAAA,EAAwB,QAAQ,CAAA,oBAAA,EAAuB,YAAY,CAAA,CAAA,CAAA,EAAK;AAAA,MAC5E,IAAA,EAAM,sBAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACd,CAAA;AAPe,IAAA,IAAA,CAAA,YAAA,GAAA,YAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAOlB;AAAA,EARkB,YAAA;AAAA,EACA,QAAA;AAAA,EAJA,IAAA,GAAO,yBAAA;AAAA,EACP,IAAA,GAAO,sBAAA;AAW3B;AAMA,eAAe,oBAAA,CACb,IAAA,EACA,KAAA,EACA,SAAA,EACoE;AACpE,EAAA,IAAI,IAAA,CAAK,iBAAA,KAAsB,MAAA,EAAW,OAAO,EAAE,KAAA,EAAM;AACzD,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,iBAAA,CAAkB,EAAE,OAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,SAAA,EAAW,CAAA;AACnF,EAAA,IAAI,QAAA,KAAa,MAAA,EAAW,OAAO,EAAE,KAAA,EAAM;AAC3C,EAAA,IAAI,SAAS,OAAA,KAAY,KAAA;AACvB,IAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,CAAS,eAAA,IAAmB,uBAAA,EAAwB;AACvE,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,SAAS,aAAA,IAAiB,KAAA;AAAA,IACjC,GAAI,SAAS,gBAAA,KAAqB,MAAA,GAAY,EAAE,QAAA,EAAU,QAAA,CAAS,gBAAA,EAAiB,GAAI;AAAC,GAC3F;AACF;AAOA,eAAe,wBAAwB,GAAA,EAA2B;AAChE,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,WAAA,MAAiB,KAAA,IAAS,GAAA,CAAI,MAAA,EAAO,EAAG;AACtC,IAAA,IAAI,KAAA,CAAM,IAAA,KAAS,WAAA,IAAe,KAAA,CAAM,WAAW,WAAA,EAAa;AAC9D,MAAA,MAAM,QAAA,GACJ,OAAO,KAAA,CAAM,MAAA,KAAW,QAAA,GAAW,KAAA,CAAM,MAAA,GAAS,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,MAAA,IAAU,IAAI,CAAA;AACvF,MAAA,KAAA,CAAM,KAAK,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,QAAQ,CAAA,CAAE,CAAA;AAAA,IACzC;AAAA,EACF;AACA,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC/B,EAAA,OAAO;;AAAA;AAAA,EAAgC,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,wBAAA,CAAA;AACzD;AAQO,SAAS,uBAAA,CACd,MACA,SAAA,EACc;AAKd,EAAA,MAAM,KAAA,GACJ,IAAA,CAAK,KAAA,KAAU,MAAA,GACX,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,GACpB,EAAE,IAAI,IAAA,CAAK,KAAA,EAAM,GACjB,IAAA,CAAK,QACP,SAAA,EAAW,KAAA;AAGjB,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,IAAW,SAAA,EAAW,OAAA;AAC3C,EAAA,OAAO;AAAA,IACL,GAAI,WAAW,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,SAAA,CAAU,MAAA,EAAO,GAAI,EAAC;AAAA,IACtE,GAAI,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,KAAU,EAAC;AAAA,IACvC,GAAI,OAAA,KAAY,MAAA,GAAY,EAAE,KAAA,EAAO,EAAE,cAAA,EAAgB,EAAE,OAAA,EAAS,OAAA,EAAQ,EAAE,KAAM,EAAC;AAAA,IACnF,GAAI,WAAW,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,EAAS,SAAA,CAAU,OAAA,EAAQ,GAAI,EAAC;AAAA,IACzE,cAAc,IAAA,CAAK,YAAA;AAAA,IACnB,KAAA,EAAO,IAAA,CAAK,KAAA,IAAS;AAAC,GACxB;AACF;AAQA,eAAe,cACb,IAAA,EACA,KAAA,EACA,MAAA,EACA,QAAA,EACA,WACA,KAAA,EACiB;AAIjB,EAAA,OAAO,mBAAA;AAAA,IAAoB,KAAA;AAAA,IAAO,MAChC,oBAAA,CAAqB,IAAA,EAAM,KAAA,EAAO,MAAA,EAAQ,UAAU,SAAS;AAAA,GAC/D;AACF;AAEA,eAAe,oBAAA,CACb,IAAA,EACA,KAAA,EACA,MAAA,EACA,UACA,SAAA,EACiB;AAMjB,EAAA,MAAM,KAAA,GAAQ,MAAMC,gCAAA,EAAe,CAAE,OAAO,uBAAA,CAAwB,IAAA,EAAM,SAAS,CAAC,CAAA;AACpF,EAAA,IAAI;AACF,IAAA,MAAM,WAAA,GAIF;AAAA,MACF,GAAI,MAAA,KAAW,KAAA,CAAA,GAAY,EAAE,MAAA,KAAW,EAAC;AAAA,MACzC,GAAI,QAAA,KAAa,KAAA,CAAA,GAAY,EAAE,aAAA,EAAe,QAAA,KAAa,EAAC;AAAA;AAAA,MAE5D,MAAA,EAAQ,EAAE,IAAA,EAAM,aAAA;AAAc,KAChC;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,IAAA,CAAK,OAAO,WAAW,CAAA;AAC/C,IAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAG9B,IAAA,IAAI,MAAA,CAAO,WAAW,OAAA,EAAS;AAC7B,MAAA,MAAM,QAAS,MAAA,CAA4C,KAAA;AAC3D,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,aAAa,IAAA,CAAK,IAAI,CAAA,cAAA,EAAiB,KAAA,EAAO,WAAW,eAAe,CAAA,CAAA;AAAA,QACxE,KAAA,KAAU,KAAA,CAAA,GAAY,EAAE,KAAA,EAAM,GAAI,KAAA;AAAA,OACpC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,OAAO,MAAA,IAAU,eAAA;AAE9B,IAAA,OAAO,KAAK,kBAAA,KAAuB,IAAA,GAAO,OAAQ,MAAM,uBAAA,CAAwB,GAAG,CAAA,GAAK,IAAA;AAAA,EAC1F,CAAA,SAAE;AACA,IAAA,KAAA,CAAM,OAAA,EAAQ;AAAA,EAChB;AACF;AAQA,eAAe,qBAAA,CACb,IAAA,EACA,KAAA,EACA,KAAA,EACA,SAAA,EACe;AACf,EAAA,IAAI,IAAA,CAAK,yBAAyB,MAAA,EAAW;AAC7C,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,CAAK,qBAAqB,EAAE,KAAA,EAAO,MAAM,IAAA,CAAK,IAAA,EAAM,KAAA,EAAO,SAAA,EAAW,CAAA;AAAA,EAC9E,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAQA,SAAS,kBAAA,CACP,IAAA,EACA,KAAA,EACA,QAAA,EACQ;AACR,EAAA,IAAI,IAAA,CAAK,aAAA,KAAkB,MAAA,IAAa,QAAA,KAAa,QAAW,OAAO,KAAA;AACvE,EAAA,MAAM,QAAA,GAAW,KAAK,aAAA,CAAc,EAAE,UAAU,KAAA,EAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,CAAA;AACxE,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAClC,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AACzE,EAAA,OAAO,CAAA;AAAA,EAAwB,QAAQ;;AAAA;AAAA,EAAc,KAAK,CAAA,CAAA;AAC5D;AAGA,eAAe,uBAAA,CACb,IAAA,EACA,KAAA,EACA,MAAA,EACA,SAAA,EACiB;AACjB,EAAA,IAAI,IAAA,CAAK,oBAAA,KAAyB,MAAA,EAAW,OAAO,MAAA;AACpD,EAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,oBAAA,CAAqB,EAAE,KAAA,EAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ,SAAA,EAAW,CAAA;AAChG,EAAA,OAAO,UAAA,EAAY,QAAA,KAAa,MAAA,GAAY,MAAA,GAAS,WAAW,QAAA,GAAW,MAAA;AAC7E;AAEA,SAAS,cAAA,CAAe,IAAA,EAAoB,YAAA,GAAe,CAAA,EAAe;AACxE,EAAA,MAAM,QAAA,GAAW,KAAK,kBAAA,IAAsB,CAAA;AAM5C,EAAA,IAAI,YAAA,GAAe,IAAI,QAAA,EAAU;AAC/B,IAAA,MAAM,IAAI,uBAAA,CAAwB,YAAA,GAAe,CAAA,EAAG,QAAQ,CAAA;AAAA,EAC9D;AAGA,EAAA,MAAM,QAAA,GAAWC,MAAE,MAAA,CAAO;AAAA,IACxB,KAAA,EAAOA,KAAA,CAAE,MAAA,EAAO,CAAE,SAAS,uBAAuB;AAAA,GACnD,CAAA;AAKD,EAAA,MAAM,WAAA,GAAuC;AAAA,IAC3C,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,uBAAA;AAAwB,KAChE;AAAA,IACA,QAAA,EAAU,CAAC,OAAO,CAAA;AAAA,IAClB,oBAAA,EAAsB;AAAA,GACxB;AAIA,EAAA,IAAI,SAAA,GAAY,CAAA;AAEhB,EAAA,MAAM,IAAA,GAAmB;AAAA,IACvB,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,aAAa,IAAA,CAAK,WAAA;AAAA,IAClB,WAAA;AAAA,IACA,OAAA,EAAS,OACP,QAAA,EACA,GAAA,KAKoB;AACpB,MAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAO,GAAI,QAAA,CAAS,MAAM,QAAQ,CAAA;AAMjD,MAAA,MAAM,YAAY,mCAAA,EAAoC;AAItD,MAAA,MAAM,YAAA,GAAe,YAAA,GAAe,sBAAA,EAAuB,GAAI,CAAA;AAC/D,MAAA,IAAI,eAAe,QAAA,EAAU;AAC3B,QAAA,MAAM,IAAI,uBAAA,CAAwB,YAAA,EAAc,QAAQ,CAAA;AAAA,MAC1D;AACA,MAAA,SAAA,IAAa,CAAA;AAIb,MAAA,MAAM,iBAAA,GAAoB,SAAA;AAE1B,MAAA,MAAM,KAAA,GAAQ,MAAM,oBAAA,CAAqB,IAAA,EAAM,QAAQ,iBAAiB,CAAA;AACxE,MAAA,IAAI,QAAA,IAAY,KAAA,EAAO,OAAO,KAAA,CAAM,MAAA;AAEpC,MAAA,MAAM,QAAQ,kBAAA,CAAmB,IAAA,EAAM,KAAA,CAAM,KAAA,EAAO,KAAK,QAAQ,CAAA;AAEjE,MAAA,IAAI,MAAA;AACJ,MAAA,IAAI;AAEF,QAAA,MAAA,GAAS,MAAM,aAAA;AAAA,UACb,IAAA;AAAA,UACA,KAAA;AAAA,UACA,GAAA,EAAK,MAAA;AAAA,UACL,KAAA,CAAM,QAAA;AAAA,UACN,SAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF,SAAS,KAAA,EAAO;AAId,QAAA,MAAM,qBAAA,CAAsB,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,iBAAiB,CAAA;AACjE,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,OAAO,uBAAA,CAAwB,IAAA,EAAM,KAAA,EAAO,MAAA,EAAQ,iBAAiB,CAAA;AAAA,IACvE;AAAA,GACF;AAKA,EAAA,OAAO,IAAA;AACT;AAMO,IAAM,WAAN,MAAe;AAAA,EACZ,WAAA,GAAc;AAAA,EAAC;AAAA,EACvB,OAAO,MAAA,CAAO,IAAA,EAAoB,WAAA,GAAc,CAAA,EAAe;AAC7D,IAAA,OAAO,cAAA,CAAe,MAAM,WAAW,CAAA;AAAA,EACzC;AACF;AAsBO,SAAS,4BAAA,CACd,QACA,WAAA,EACc;AACd,EAAA,OAAO,MAAA,CAAO,QAAQ,MAAM,CAAA,CAAE,IAAI,CAAC,CAAC,IAAA,EAAM,GAAG,CAAA,KAAM;AACjD,IAAA,MAAM,SAAA,GACJ,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA,IAAK,GAAA,CAAI,KAAA,CAAM,MAAA,GAAS,CAAA,GAAI,IAAI,GAAA,CAAI,GAAA,CAAI,KAAK,CAAA,GAAI,MAAA;AAC1E,IAAA,MAAM,UAAA,GAAa,SAAA,GAAY,WAAA,CAAY,MAAA,CAAO,CAAC,CAAA,KAAM,SAAA,CAAU,GAAA,CAAI,CAAA,CAAE,IAAI,CAAC,CAAA,GAAI,WAAA;AAClF,IAAA,OAAO,cAAA,CAAe;AAAA,MACpB,IAAA;AAAA,MACA,aAAa,GAAA,CAAI,WAAA;AAAA,MACjB,cAAc,GAAA,CAAI,MAAA;AAAA;AAAA;AAAA,MAGlB,GAAI,GAAA,CAAI,KAAA,KAAU,MAAA,IAAa,GAAA,CAAI,KAAA,KAAU,SAAA,GAAY,EAAE,KAAA,EAAO,GAAA,CAAI,KAAA,EAAM,GAAI,EAAC;AAAA,MACjF,GAAI,IAAI,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,EAAS,GAAA,CAAI,OAAA,EAAQ,GAAI,EAAC;AAAA,MAC5D,KAAA,EAAO,CAAC,GAAG,UAAU;AAAA,KACtB,CAAA;AAAA,EACH,CAAC,CAAA;AACH","file":"chunk-QME6FDFG.cjs","sourcesContent":["/**\n * #364 — how deep the current delegation chain already is, delivered through the CALL.\n *\n * ## The bug this replaces\n *\n * `maxDelegationDepth` was checked once, at tool-CONSTRUCTION time, against a `_parentDepth`\n * argument that nothing in the SDK ever incremented. Constructing a tool says nothing about how\n * deep it will later be invoked, so with the documented call — `SubAgent.create(spec)` — the test\n * was `1 > maxDepth`, false for every spec that did not ask for depth 0. A subagent whose tools\n * include another subagent recursed unbounded, which is precisely what the guard exists to stop.\n * The only path that ever tripped it was a caller threading the number by hand.\n *\n * ## Why the async scope closes it\n *\n * Depth is a property of the RUN, not of the object. A child's run loop — and therefore every tool\n * it dispatches — executes inside the async continuation of its parent's handler, so a value\n * published on that context is exactly what a nested dispatch needs to read. This is the same seam\n * `subagent-credentials.ts` uses, and for the same reason: what survives every layer that rebuilds\n * a tool object is the call, never the object.\n *\n * It is kept in its own module rather than folded into the credentials payload because depth is a\n * separate concern with a separate lifetime — the credentials scope is opened once per run by the\n * run loop, while depth is opened per delegation by the dispatching tool.\n *\n * @internal\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\n\nconst depthStore = new AsyncLocalStorage<number>();\n\n/**\n * Run `fn` with `depth` published as the delegation depth of the current chain.\n *\n * Nested scopes shadow the outer one and the outer is restored on return, so two sibling\n * delegations from the same parent each start from the parent's depth rather than from each\n * other's.\n *\n * @internal\n */\nexport async function withDelegationDepth<T>(depth: number, fn: () => Promise<T>): Promise<T> {\n  return depthStore.run(depth, fn);\n}\n\n/**\n * The delegation depth of the current chain — `0` outside any delegation.\n *\n * `0` is the honest default rather than a fallback to some previous chain's value: a subagent\n * dispatched with no parent delegation IS at depth zero.\n *\n * @internal\n */\nexport function currentDelegationDepth(): number {\n  return depthStore.getStore() ?? 0;\n}\n","/**\n * theokit#148 — the parent's credentials, delivered through the CALL, not through the tool object.\n *\n * ## The class of bug this replaces\n *\n * Credential inheritance used to ride a property installed on the subagent tool object — first a\n * unique `Symbol()`, then `Symbol.for` after #143. Both are the same shape of contract: \"this\n * object will reach the dispatcher with an extra property intact\". Nothing enforces that, and it\n * broke twice for two different reasons:\n *\n *  - **Module duplication** (#142/#143): `tsup splitting: false` inlined a separate copy of the\n *    module into each public entry, so the two copies disagreed on a unique `Symbol()` key. Fixed at\n *    the build level by M78's `splitting: true`, but the fragile contract remained.\n *  - **Object normalization** (#148): any layer that rebuilds the tool from its known fields drops\n *    the property. `@theokit/agents`' `toCompiledTool` does exactly that, and had to add an explicit\n *    `Object.getOwnPropertySymbols` copy loop to compensate — a band-aid the SDK's contract forced\n *    onto a consumer. A named field would have been dropped by the same four-field rebuild, which is\n *    why \"make it a typed field\" alone does not close this.\n *\n * ## Why the async scope closes it\n *\n * What survives a rebuild is not the object — it is the CALL. A normalizing wrapper builds a new\n * object but still invokes the original handler, inside the parent run's async context. So\n * credentials published on that context reach the handler regardless of what the tool object looks\n * like by then. There is no property left for a layer to drop.\n *\n * It also fixes a defect the per-object slot could not: credentials were stored per tool INSTANCE,\n * so one subagent tool shared by two agents got last-writer-wins. The scope is per run.\n *\n * Nothing is exposed to third-party tool code: the store is module-private, credentials never touch\n * a handler's `ctx`, and `currentInheritedSubAgentCredentials` is `@internal`.\n *\n * @internal\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport type { ModelSelection } from \"../../types/agent-prims.js\";\nimport type { Plugin } from \"../plugins/types.js\";\n\n/**\n * Credentials a parent agent hands down to its subagent tools so the child inherits the parent's\n * auth (and, absent an explicit `spec.model`, its model).\n *\n * Declared here rather than in `a2a/subagent.ts` so the delivery mechanism owns the payload shape\n * and the dependency runs one way (`a2a/subagent` -> this module). `a2a/subagent.ts` briefly\n * re-exported it \"for back-compat\"; knip proved there was no back-compat surface to preserve — the\n * type was never in the public barrel nor the exports map — so the re-export was deleted.\n *\n * Emitted rather than erased: `a2a/subagent.d.ts` imports it by name, and that entry IS published,\n * so erasing this declaration ships a `.d.ts` that does not compile. Not being in the exports map\n * is what keeps it out of the semver contract; erasure is not what does that.\n */\nexport interface InheritedCredentials {\n  readonly apiKey?: string;\n  readonly model?: ModelSelection;\n  /**\n   * The parent's shell-sandbox posture (`local.sandboxOptions.enabled`), handed down so a delegated\n   * child of a sandboxed parent stays sandboxed unless its role explicitly opts out. Without this a\n   * child ran unsandboxed whenever its role omitted `sandbox` — a default-open the sandbox wiring\n   * exists to prevent.\n   */\n  readonly sandbox?: boolean;\n  /**\n   * #55 — the parent's code-registered plugins (e.g. a `PermissionPlugin`) handed down so the child\n   * runs under the SAME policy. Without this, a delegated child's inner tool calls escape the\n   * parent's argument-level permission gate. First-party delegation path only — never exposed to\n   * third-party tool `ctx`.\n   */\n  readonly plugins?: readonly Plugin[];\n}\n\nconst credentialsStore = new AsyncLocalStorage<InheritedCredentials>();\n\n/**\n * Run `fn` with `credentials` published as the delegation credentials of the current run.\n *\n * Nested scopes shadow the outer one and the outer is restored on return, so a delegated child that\n * itself delegates hands down ITS credentials, not its parent's.\n *\n * @internal\n */\nexport async function withInheritedSubAgentCredentials<T>(\n  credentials: InheritedCredentials,\n  fn: () => Promise<T>,\n): Promise<T> {\n  return credentialsStore.run(credentials, fn);\n}\n\n/**\n * The delegation credentials of the current run, or `undefined` outside a run scope.\n *\n * `undefined` is deliberately NOT a fallback to some previous run's value: a subagent dispatched\n * with no parent context must create its child without an inherited key rather than reuse a\n * credential that belonged to someone else.\n *\n * @internal\n */\nexport function currentInheritedSubAgentCredentials(): InheritedCredentials | undefined {\n  return credentialsStore.getStore();\n}\n","/**\n * Subagent delegation — declarative child agent invocable as a tool.\n *\n * Per ADR D2: `defineSubAgent(spec)` returns a `CustomTool` that, when\n * invoked by the LLM, creates a child agent and sends the input as a\n * message. EC-2: delegation depth is tracked across the RUN (#364) — each\n * delegation publishes its depth on the async scope its child executes in, so a\n * subagent that delegates to a subagent is bounded by `maxDelegationDepth`\n * without the caller threading a counter by hand.\n *\n * SE10 — the handler forwards the parent run's `AbortSignal` to the child.\n * SE11 — optional `onDelegationStart` / `onDelegationComplete` lifecycle hooks\n * let the caller reject, rewrite, observe, or annotate a delegation.\n *\n * @public\n */\n\nimport { z } from \"zod\";\nimport { TheokitAgentError } from \"../errors.js\";\nimport {\n  currentDelegationDepth,\n  withDelegationDepth,\n} from \"../internal/concurrency/delegation-depth.js\";\nimport {\n  currentInheritedSubAgentCredentials,\n  type InheritedCredentials,\n} from \"../internal/concurrency/subagent-credentials.js\";\nimport { getAgentFacade } from \"../internal/runtime/registry/agent-factory-registry.js\";\nimport type {\n  AgentDefinition,\n  AgentOptions,\n  CustomTool,\n  ToolContextMessage,\n} from \"../types/agent.js\";\nimport type { ModelSelection } from \"../types/agent-prims.js\";\nimport type { Run } from \"../types/run.js\";\n\n/** Arguments passed to {@link SubAgentSpec.messageFilter} (SE12). */\nexport interface MessageFilterArgs {\n  /** The supervisor transcript (read-only text projection) available to this delegation. */\n  messages: readonly ToolContextMessage[];\n  /** The prompt about to be delegated (after any `onDelegationStart` rewrite). */\n  input: string;\n  /** The subagent's name. */\n  name: string;\n}\n\n/** Context passed to {@link SubAgentSpec.onDelegationStart} before the child runs. */\nexport interface DelegationStartContext {\n  input: string;\n  name: string;\n  /**\n   * SE15 — 1-based count of times THIS subagent tool has been invoked (a\n   * per-`defineSubAgent`-instance counter). Incremented before this hook runs;\n   * a rejected delegation still counts. Enables reject-after-N patterns.\n   */\n  iteration: number;\n}\n\n/**\n * Decision returned from {@link SubAgentSpec.onDelegationStart}. Discriminated on\n * `proceed` so a rejection (`proceed: false` + `rejectionReason`) and an approval\n * (`modifiedInput`) cannot be mixed into one nonsensical object.\n */\nexport type DelegationStartDecision =\n  | { proceed: false; rejectionReason?: string }\n  | {\n      proceed?: true;\n      modifiedInput?: string;\n      /** SE13 — cap the child's iteration count (forwarded as `SendOptions.maxIterations`). */\n      modifiedMaxSteps?: number;\n    };\n\n/** Context passed to {@link SubAgentSpec.onDelegationComplete} after the child settles. */\nexport interface DelegationCompleteContext {\n  input: string;\n  name: string;\n  /** The child's text result (present on success). */\n  result?: string;\n  /** The error the child threw (present on failure); the error is still re-thrown. */\n  error?: unknown;\n  /** SE15 — the same 1-based iteration this delegation's `onDelegationStart` saw. */\n  iteration: number;\n}\n\n/**\n * The return of a delegation hook: a decision, a promise of one, or nothing —\n * `void` lets a side-effect-only callback (`(ctx) => { log(ctx) }`) type-check,\n * which is the common case (mirrors a peer framework's `async ctx => { ... }` hooks).\n */\n// biome-ignore lint/suspicious/noConfusingVoidType: `void` is the idiomatic return for an optional-return callback; the rule false-positives on callback return unions.\ntype DelegationHookResult<T> = T | void | Promise<T | void>;\n\n/** Decision returned from {@link SubAgentSpec.onDelegationComplete}. */\nexport interface DelegationCompleteDecision {\n  /** Appended to the child's result string. */\n  feedback?: string;\n}\n\n/**\n * The declaration of a delegating child agent, handed to `SubAgent.create(spec)`.\n *\n * `name`, `description` and `instructions` are the only required fields: the first\n * two become the tool the supervisor's model sees, the third becomes the child's\n * system prompt. Everything else narrows what the child inherits.\n *\n *   const research = SubAgent.create({\n *     name: \"research\",\n *     description: \"Look a fact up\",\n *     instructions: \"You answer with one sentence.\",\n *   });\n *   const agent = await Agent.create({ tools: [research] });\n *\n * The tool's own input schema is fixed — one required string property, `input`.\n * It is not derived from this spec and cannot be widened here.\n *\n * What the child inherits from the parent AT DISPATCH TIME, not from this object:\n * the API key, the model (unless `model` is set), the parent's plugins, and the\n * parent's sandbox posture (unless `sandbox` is set). An absent `sandbox` inherits;\n * an explicit `sandbox: false` turns confinement OFF for a child of a confined\n * parent, which is not the same thing.\n *\n * How it fails: the child's failure is re-thrown to the supervisor as a tool error\n * — a run ending in `status: \"error\"` becomes\n * `subagent \"<name>\" run failed: <cause>`. `onDelegationStart` and `messageFilter`\n * propagate their own throws; only a throw from `onDelegationComplete` ON THE\n * ERROR PATH is suppressed, so it cannot mask the real cause.\n *\n * Traps:\n *  - `model` as a bare string drops reasoning parameters. Pass the\n *    {@link ModelSelection} object form when the child needs `params`.\n *  - `maxDelegationDepth` (default 3) bounds the delegation CHAIN, counted at\n *    dispatch across the run (#364) — the depth is not something you thread. The\n *    `parentDepth` argument of `SubAgent.create` still offsets it, for a supervisor\n *    that wants a lower ceiling than the chain it sits in.\n *  - Context isolation is the DEFAULT. Without `messageFilter` the child sees only\n *    the delegated string; without `includeToolResults` the supervisor gets only\n *    the child's final text.\n */\nexport interface SubAgentSpec {\n  name: string;\n  description: string;\n  instructions: string;\n  /**\n   * A bare id string (back-compat) OR a full {@link ModelSelection} carrying\n   * `params` (e.g. `[{ id: \"thinking\", value: \"low\" }]` for reasoning effort). The\n   * object form is required for per-subagent reasoning effort to survive to the child\n   * — the pre-M33 path took only `.id` and dropped params.\n   */\n  model?: string | ModelSelection;\n  tools?: CustomTool[];\n  /** Per-subagent shell sandbox toggle (M33). `true` ⇒ child `local.sandboxOptions.enabled`. */\n  sandbox?: boolean;\n  /**\n   * Maximum length of the delegation CHAIN rooted at this tool, counted at dispatch\n   * (default 3). Depth 1 is this subagent; a subagent it delegates to is depth 2.\n   * Exceeding it throws {@link MaxDelegationDepthError} from the tool handler.\n   */\n  maxDelegationDepth?: number;\n  /**\n   * SE11 — called before the supervisor delegates. Return `{ proceed: false }`\n   * to reject (the child never runs and `rejectionReason` becomes the tool\n   * result), or `{ modifiedInput }` to rewrite the delegated prompt. A throwing\n   * hook surfaces (never silently swallowed).\n   */\n  onDelegationStart?: (\n    ctx: DelegationStartContext,\n  ) => DelegationHookResult<DelegationStartDecision>;\n  /**\n   * SE11 — called after the delegation settles. On success `ctx.result` is set\n   * and an optional `{ feedback }` is appended to it. On failure `ctx.error` is\n   * set and the original error is ALWAYS re-thrown after this hook runs — a throw\n   * from this hook on the error path is suppressed so it cannot mask the\n   * delegation's real failure (on the success path a throw does propagate).\n   */\n  onDelegationComplete?: (\n    ctx: DelegationCompleteContext,\n  ) => DelegationHookResult<DelegationCompleteDecision>;\n  /**\n   * SE12 — opt-in parent-context forwarding. When set, the supervisor transcript\n   * (`ctx.messages`, a read-only text projection) is passed to this filter and the\n   * returned subset is forwarded to the child as a role-tagged context preamble\n   * prepended to the delegated input. When ABSENT the child runs input-only —\n   * memory isolation stays the default. A filter returning `[]` forwards nothing.\n   * A throwing filter propagates (fail-fast, never swallowed — same contract as\n   * `onDelegationStart`); the delegation surfaces as a tool error.\n   */\n  messageFilter?: (args: MessageFilterArgs) => readonly ToolContextMessage[];\n  /**\n   * SE14 — opt-in subagent result-context control. When `true`, the child's\n   * completed tool-call results (name + result) are appended to the delegation\n   * payload returned to the supervisor, inside a `<subagent-tool-results>` block.\n   * When absent/`false` the delegation returns the child's final text only —\n   * text-only stays the default (a peer framework's scoped posture). See ADR 0006.\n   */\n  includeToolResults?: boolean;\n}\n\n/**\n * Raised by `SubAgent.create(spec, parentDepth)` when `parentDepth + 1` exceeds\n * `spec.maxDelegationDepth` (default 3). Carries `currentDepth`, `maxDepth` and a\n * stable `code: \"max_delegation_depth\"`.\n *\n * Thrown from the subagent tool's handler when a delegation would exceed\n * `maxDelegationDepth` (default 3), so it surfaces as the tool call's failure —\n * catching it around the dispatching `agent.send()` works.\n *\n * Also thrown eagerly at TOOL-CONSTRUCTION time when a caller threads its own\n * `parentDepth` that is already past the limit; such a tool could never be\n * dispatched, so refusing to build it fails earlier and clearer.\n *\n * Before #364 the construction-time check was the ONLY one, against a depth\n * nothing in the SDK incremented — so under the documented `SubAgent.create(spec)`\n * call this error could not fire at all and nested delegation was unbounded. The\n * chain length now travels with the run (`internal/runtime/concurrency/delegation-depth.ts`),\n * and a caller-threaded `parentDepth` still adds to it.\n */\nexport class MaxDelegationDepthError extends TheokitAgentError {\n  override readonly name = \"MaxDelegationDepthError\";\n  override readonly code = \"max_delegation_depth\" as const;\n  constructor(\n    public readonly currentDepth: number,\n    public readonly maxDepth: number,\n  ) {\n    // Not retryable: the depth is a property of the call graph, and it is the same on a retry.\n    super(`Max delegation depth ${maxDepth} exceeded (current: ${currentDepth})`, {\n      code: \"max_delegation_depth\",\n      isRetryable: false,\n    });\n  }\n}\n\n/**\n * Run the `onDelegationStart` hook; returns either a rejection or the (possibly\n * rewritten) input plus the optional SE13 `maxSteps` cap.\n */\nasync function applyDelegationStart(\n  spec: SubAgentSpec,\n  input: string,\n  iteration: number,\n): Promise<{ reject: string } | { input: string; maxSteps?: number }> {\n  if (spec.onDelegationStart === undefined) return { input };\n  const decision = await spec.onDelegationStart({ input, name: spec.name, iteration });\n  if (decision === undefined) return { input };\n  if (decision.proceed === false)\n    return { reject: decision.rejectionReason ?? \"(delegation rejected)\" };\n  return {\n    input: decision.modifiedInput ?? input,\n    ...(decision.modifiedMaxSteps !== undefined ? { maxSteps: decision.modifiedMaxSteps } : {}),\n  };\n}\n\n/**\n * SE14 — replay the child run's stream (a safe post-`wait()` idiom — the run buffers\n * events, `stream()` replays them) and collect every completed tool-call result into\n * a delimited block. Returns `\"\"` when the child ran no completed tool calls. See ADR 0006.\n */\nasync function collectChildToolResults(run: Run): Promise<string> {\n  const lines: string[] = [];\n  for await (const event of run.stream()) {\n    if (event.type === \"tool_call\" && event.status === \"completed\") {\n      const rendered =\n        typeof event.result === \"string\" ? event.result : JSON.stringify(event.result ?? null);\n      lines.push(`${event.name}: ${rendered}`);\n    }\n  }\n  if (lines.length === 0) return \"\";\n  return `\\n\\n<subagent-tool-results>\\n${lines.join(\"\\n\")}\\n</subagent-tool-results>`;\n}\n\n/**\n * Build the child agent's `Agent.create` options: the child inherits the parent's\n * apiKey (else `Agent.create` throws \"Missing API key\"), its model (unless the spec\n * overrides it), and — #55 — the parent's plugins (permission gate/guards) so the\n * child's inner tool calls run under the same policy.\n */\nexport function buildChildCreateOptions(\n  spec: SubAgentSpec,\n  inherited: InheritedCredentials | undefined,\n): AgentOptions {\n  // M33 — carry the WHOLE model (a bare id becomes `{ id }`; a ModelSelection with\n  // `params` keeps its reasoning effort). The pre-M33 path wrapped `spec.model` as\n  // `{ id: spec.model }`, which only worked because spec.model was a string and\n  // silently dropped reasoning params.\n  const model: string | ModelSelection | undefined =\n    spec.model !== undefined\n      ? typeof spec.model === \"string\"\n        ? { id: spec.model }\n        : spec.model\n      : inherited?.model;\n  // M33 — the role's own `sandbox` wins; when it omits the field, inherit the parent's posture. A role's\n  // explicit `sandbox: false` therefore confines-OFF a child of a sandboxed parent (distinct from absent).\n  const sandbox = spec.sandbox ?? inherited?.sandbox;\n  return {\n    ...(inherited?.apiKey !== undefined ? { apiKey: inherited.apiKey } : {}),\n    ...(model !== undefined ? { model } : {}),\n    ...(sandbox !== undefined ? { local: { sandboxOptions: { enabled: sandbox } } } : {}),\n    ...(inherited?.plugins !== undefined ? { plugins: inherited.plugins } : {}),\n    systemPrompt: spec.instructions,\n    tools: spec.tools ?? [],\n  };\n}\n\n/**\n * Create the transient child agent and send the input, composing every forwarded\n * `SendOptions` onto ONE `send` call — SE10 `signal` + SE13 `maxIterations`. Absent\n * every option ⇒ the pre-SE10 single-arg `send(input)` shape. SE14 — when\n * `includeToolResults` is set, append the child's completed tool results. Dispose in `finally`.\n */\nasync function runChildAgent(\n  spec: SubAgentSpec,\n  input: string,\n  signal: AbortSignal | undefined,\n  maxSteps: number | undefined,\n  inherited: InheritedCredentials | undefined,\n  depth: number,\n): Promise<string> {\n  // #364 — publish THIS delegation's depth for the whole child run. The child's loop, and every\n  // tool it dispatches, runs inside this scope, so a nested subagent reads the real chain length\n  // instead of the 0 every construction-time check saw.\n  return withDelegationDepth(depth, () =>\n    runChildAgentInScope(spec, input, signal, maxSteps, inherited),\n  );\n}\n\nasync function runChildAgentInScope(\n  spec: SubAgentSpec,\n  input: string,\n  signal: AbortSignal | undefined,\n  maxSteps: number | undefined,\n  inherited: InheritedCredentials | undefined,\n): Promise<string> {\n  // SE45 cycle 3 — use the registered Agent facade via the DIP seam\n  // (agent-factory-registry) instead of a dynamic `import(\"../agent.js\")`.\n  // This removes the last madge cycle (a2a/subagent -> agent -> ... -> real-local-run-tools\n  // -> a2a/subagent): the facade registers itself at module-init via setAgentFacade,\n  // so subagent depends only on the registry port, never on the facade module.\n  const agent = await getAgentFacade().create(buildChildCreateOptions(spec, inherited));\n  try {\n    const sendOptions: {\n      signal?: AbortSignal;\n      maxIterations?: number;\n      origin?: import(\"../types/run.js\").MessageOrigin;\n    } = {\n      ...(signal !== undefined ? { signal } : {}),\n      ...(maxSteps !== undefined ? { maxIterations: maxSteps } : {}),\n      // SE3 — a delegated child's turn is initiated by the coordinating parent.\n      origin: { kind: \"coordinator\" },\n    };\n    const run = await agent.send(input, sendOptions);\n    const result = await run.wait();\n    // Fail-fast, don't swallow (Rule 8): a child that ended in error must surface — otherwise a real\n    // failure (e.g. `provider_unresolved`) is hidden behind \"(no response)\" and the parent loops on it.\n    if (result.status === \"error\") {\n      const cause = (result as { error?: { message?: string } }).error;\n      throw new Error(\n        `subagent \"${spec.name}\" run failed: ${cause?.message ?? \"unknown error\"}`,\n        cause !== undefined ? { cause } : undefined,\n      );\n    }\n    const text = result.result ?? \"(no response)\";\n    // SE14 — text-only by default; opt-in appends the child's tool results.\n    return spec.includeToolResults === true ? text + (await collectChildToolResults(run)) : text;\n  } finally {\n    agent.dispose();\n  }\n}\n\n/**\n * Best-effort error-path notification: run `onDelegationComplete` with the child's\n * error so the caller can observe the failure. The observer's own throw (sync or\n * async) is suppressed here so it cannot mask the delegation's real error, which the\n * handler re-throws next.\n */\nasync function notifyDelegationError(\n  spec: SubAgentSpec,\n  input: string,\n  error: unknown,\n  iteration: number,\n): Promise<void> {\n  if (spec.onDelegationComplete === undefined) return;\n  try {\n    await spec.onDelegationComplete({ input, name: spec.name, error, iteration });\n  } catch {\n    // Subordinate to `error`; the child's real cause wins.\n  }\n}\n\n/**\n * SE12 — apply `messageFilter` (if set) and prepend the filtered supervisor\n * transcript to the delegated input as a role-tagged context preamble. Absent\n * filter OR no messages OR an empty filtered subset ⇒ the original input\n * (isolation-by-default preserved).\n */\nfunction applyMessageFilter(\n  spec: SubAgentSpec,\n  input: string,\n  messages: readonly ToolContextMessage[] | undefined,\n): string {\n  if (spec.messageFilter === undefined || messages === undefined) return input;\n  const filtered = spec.messageFilter({ messages, input, name: spec.name });\n  if (filtered.length === 0) return input;\n  const preamble = filtered.map((m) => `${m.role}: ${m.content}`).join(\"\\n\");\n  return `Prior conversation:\\n${preamble}\\n\\nTask:\\n${input}`;\n}\n\n/** Run the success-path `onDelegationComplete` hook; appends its `feedback` to the result. */\nasync function applyDelegationComplete(\n  spec: SubAgentSpec,\n  input: string,\n  result: string,\n  iteration: number,\n): Promise<string> {\n  if (spec.onDelegationComplete === undefined) return result;\n  const completion = await spec.onDelegationComplete({ input, name: spec.name, result, iteration });\n  return completion?.feedback !== undefined ? result + completion.feedback : result;\n}\n\nfunction defineSubAgent(spec: SubAgentSpec, _parentDepth = 0): CustomTool {\n  const maxDepth = spec.maxDelegationDepth ?? 3;\n\n  // A caller that threads its own depth still gets the eager failure it always got: a spec that is\n  // already too deep to ever be dispatchable is worth refusing at construction. What this check\n  // CANNOT see is the runtime chain — constructing a tool says nothing about how deep it will later\n  // be invoked — which is why the guard that actually bounds recursion lives at dispatch (#364).\n  if (_parentDepth + 1 > maxDepth) {\n    throw new MaxDelegationDepthError(_parentDepth + 1, maxDepth);\n  }\n\n  // Zod for RUNTIME validation of the tool_use input …\n  const inputZod = z.object({\n    input: z.string().describe(\"Task for the subagent\"),\n  });\n  // … and a real Draft-7 JSON Schema for the LLM. `CustomTool.inputSchema` is sent\n  // to the model verbatim; a raw Zod object would serialize to garbage, so the\n  // model emits malformed input that fails `inputZod.parse` and the delegation\n  // never runs (the previous bug — the schema and the validator are now distinct).\n  const inputSchema: Record<string, unknown> = {\n    type: \"object\",\n    properties: {\n      input: { type: \"string\", description: \"Task for the subagent\" },\n    },\n    required: [\"input\"],\n    additionalProperties: false,\n  };\n\n  // SE15 — per-instance delegation counter, surfaced as `iteration` on the hook\n  // contexts. Incremented once per handler invocation before onDelegationStart.\n  let iteration = 0;\n\n  const tool: CustomTool = {\n    name: spec.name,\n    description: spec.description,\n    inputSchema,\n    handler: async (\n      rawInput: Record<string, unknown>,\n      ctx?: {\n        signal?: AbortSignal;\n        context?: unknown;\n        messages?: readonly ToolContextMessage[];\n      },\n    ): Promise<string> => {\n      const { input: parsed } = inputZod.parse(rawInput);\n      // theokit#148 — read the parent's credentials from the RUN's async scope, at dispatch time.\n      // They used to be stashed on this tool object by the runtime, which meant any layer that\n      // rebuilt the object (e.g. `@theokit/agents`' `toCompiledTool`) silently dropped them and the\n      // child failed with `provider_unresolved`. The scope travels with the call, so nothing about\n      // the object's shape matters — and two concurrent runs sharing one tool each read their own.\n      const inherited = currentInheritedSubAgentCredentials();\n      // #364 — the real bound. `currentDelegationDepth()` is the length of the chain that led here,\n      // published by each ancestor's `runChildAgent`; a caller-threaded `_parentDepth` still adds to\n      // it, so the pre-#364 hand-threaded behaviour is unchanged when the ambient depth is 0.\n      const currentDepth = _parentDepth + currentDelegationDepth() + 1;\n      if (currentDepth > maxDepth) {\n        throw new MaxDelegationDepthError(currentDepth, maxDepth);\n      }\n      iteration += 1; // SE15 — before onDelegationStart; a rejected delegation still counts.\n      // Pin THIS invocation's iteration before any await so a concurrent invocation\n      // bumping the shared counter cannot change the value onDelegationComplete /\n      // notifyDelegationError observe — they see the same iteration onDelegationStart did.\n      const capturedIteration = iteration;\n\n      const start = await applyDelegationStart(spec, parsed, capturedIteration);\n      if (\"reject\" in start) return start.reject;\n      // SE12 — opt-in: forward the filtered supervisor transcript as a preamble.\n      const input = applyMessageFilter(spec, start.input, ctx?.messages);\n\n      let result: string;\n      try {\n        // SE13 — apply the optional onDelegationStart maxSteps cap on the child send.\n        result = await runChildAgent(\n          spec,\n          input,\n          ctx?.signal,\n          start.maxSteps,\n          inherited,\n          currentDepth,\n        );\n      } catch (error) {\n        // SE11 — notify the completion hook of the failure (best-effort observer),\n        // then re-throw the ORIGINAL error (Rule 8: never swallow the delegation's\n        // own failure).\n        await notifyDelegationError(spec, input, error, capturedIteration);\n        throw error;\n      }\n      return applyDelegationComplete(spec, input, result, capturedIteration);\n    },\n  };\n\n  // theokit#148 — nothing is installed on the tool. The credentials arrive through the run's async\n  // scope (see `internal/runtime/concurrency/subagent-credentials.ts`), so there is no extra\n  // property for a normalizing layer to drop.\n  return tool;\n}\n\n/** SE36 — `SubAgent.create` replaces `defineSubAgent` (ADR 0015). @public  *\n * `SubAgent.create` returns a **`CustomTool`** — the sub-agent is exposed to the\n * parent as a callable tool, not as a `SubAgent` instance.\n */\nexport class SubAgent {\n  private constructor() {}\n  static create(spec: SubAgentSpec, parentDepth = 0): CustomTool {\n    return defineSubAgent(spec, parentDepth);\n  }\n}\n\n/**\n * Convert a parent's declarative `agents` map ({@link AgentDefinition} per key)\n * into delegation tools for the LOCAL runtime — the counterpart of the\n * cloud/fixture subagent wiring. Each child inherits the parent's `apiKey`/model\n * from the CALL, not from the tool object: `inheritSubAgentCredentials` used to\n * attach them to the tool, and any layer that rebuilt that object dropped them —\n * including the SDK's own rebuild (theokit#148). Credentials now ride the\n * dispatch, so a rebuilt tool cannot lose them. `def.model` overrides the model\n * (`\"inherit\"` keeps the parent's), and `def.tools` scopes the child to that\n * subset of the parent's tools (absent → the parent's full toolset, per the\n * `AgentDefinition.tools` contract).\n *\n * M33 — per-subagent `model` (with reasoning `params`) and `sandbox` are now wired\n * into local delegation: each is carried onto the {@link SubAgentSpec} and applied to\n * the child in {@link buildChildCreateOptions}. `\"inherit\"` (or an absent field) keeps\n * the parent's value. Per-subagent `mcp` is rejected at load (see subagents-loader) —\n * resolving server names→config on the local path is a follow-up.\n *\n * @internal\n */\nexport function subAgentToolsFromDefinitions(\n  agents: Record<string, AgentDefinition>,\n  parentTools: readonly CustomTool[],\n): CustomTool[] {\n  return Object.entries(agents).map(([name, def]) => {\n    const whitelist =\n      Array.isArray(def.tools) && def.tools.length > 0 ? new Set(def.tools) : undefined;\n    const childTools = whitelist ? parentTools.filter((t) => whitelist.has(t.name)) : parentTools;\n    return defineSubAgent({\n      name,\n      description: def.description,\n      instructions: def.prompt,\n      // Carry the FULL ModelSelection (id + reasoning params), not just the id, so\n      // per-subagent reasoning effort survives to buildChildCreateOptions.\n      ...(def.model !== undefined && def.model !== \"inherit\" ? { model: def.model } : {}),\n      ...(def.sandbox !== undefined ? { sandbox: def.sandbox } : {}),\n      tools: [...childTools],\n    });\n  });\n}\n"]}