@theokit/sdk 5.7.0 → 5.9.0

package/dist/{chunk-IUMAQURF.js.map → chunk-X6DUEDAF.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/judge/parse-verdict.ts","../src/internal/judge/judge-call.ts"],"names":[],"mappings":";;;AAaA,IAAM,WAAA,GAAc,OAAA;AACpB,IAAM,eAAA,GAAkB,WAAA;AACxB,IAAM,cAAA,GAAiB,UAAA;AAEvB,IAAM,cAAA,GAAiB,UAAA;AAEhB,SAAS,aAAa,IAAA,EAA2B;AACtD,EAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAE1B,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,WAAW,CAAA,EAAG;AACnC,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,MAAA;AAAA,MACT,QAAQ,OAAA,CAAQ,KAAA,CAAM,WAAA,CAAY,MAAM,EAAE,IAAA,EAAK;AAAA,MAC/C,WAAA,EAAa;AAAA,KACf;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,eAAe,CAAA,EAAG;AACvC,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,UAAA;AAAA,MACT,QAAQ,OAAA,CAAQ,KAAA,CAAM,eAAA,CAAgB,MAAM,EAAE,IAAA,EAAK;AAAA,MACnD,WAAA,EAAa;AAAA,KACf;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,cAAc,CAAA,EAAG;AACtC,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,SAAA;AAAA,MACT,QAAQ,OAAA,CAAQ,KAAA,CAAM,cAAA,CAAe,MAAM,EAAE,IAAA,EAAK;AAAA,MAClD,WAAA,EAAa;AAAA,KACf;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,cAAc,CAAA,EAAG;AACtC,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,SAAA;AAAA,MACT,QAAQ,OAAA,CAAQ,KAAA,CAAM,cAAA,CAAe,MAAM,EAAE,IAAA,EAAK;AAAA,MAClD,WAAA,EAAa;AAAA,KACf;AAAA,EACF;AAKA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,UAAA;AAAA,IACT,QAAQ,CAAA,2BAAA,EAA8B,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,IAC3D,WAAA,EAAa;AAAA,GACf;AACF;;;ACIO,IAAM,oBAAA,GAAN,cAAmC,iBAAA,CAAkB;AAAA,EAG1D,WAAA,CACW,UAAA,EACA,UAAA,EACT,KAAA,EACA;AACA,IAAA,KAAA;AAAA,MACE,CAAA,0BAAA,EAA6B,UAAU,CAAA,WAAA,EAAc,MAAA,CAAO,UAAU,CAAC,CAAA,iIAAA,CAAA;AAAA,MAGvE,EAAE,IAAA,EAAM,kBAAA,EAAoB,KAAA,EAAO,aAAa,KAAA;AAAM,KACxD;AATS,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAAA,EASX;AAAA,EAVW,UAAA;AAAA,EACA,UAAA;AAAA,EAJO,IAAA,GAAO,sBAAA;AAc3B;AAGA,SAAS,aAAa,GAAA,EAAkC;AACtD,EAAA,MAAM,CAAA,GACH,GAAA,CAAmD,MAAA,IACnD,GAAA,CAAiC,UAAA;AACpC,EAAA,IAAI,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,CAAA;AAClC,EAAA,MAAM,CAAA,GAAI,oBAAoB,IAAA,CAAK,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AACnF,EAAA,OAAO,CAAA,GAAI,CAAC,CAAA,KAAM,MAAA,GAAY,OAAO,CAAA,CAAE,CAAC,CAAC,CAAA,GAAI,MAAA;AAC/C;AAgBA,eAAsB,aAAA,CACpB,GAAA,EACA,OAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,MAAA,GAAS,mBAAmB,GAAG,CAAA;AAErC,EAAA,MAAM,MAAA,GAAS,OAAA,EAAS,MAAA,IAAU,OAAA,CAAQ,GAAA,CAAI,kBAAA;AAC9C,EAAA,IAAI,WAAW,MAAA,EAAW;AACxB,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,UAAA;AAAA,MACT,MAAA,EACE,yFAAA;AAAA,MACF,WAAA,EAAa;AAAA,KACf;AAAA,EACF;AAIA,EAAA,MAAM,UAAA,GAAa,OAAA,EAAS,UAAA,IAAc,OAAA,EAAS,UAAA,IAAc,oBAAA;AACjE,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,KAAK,MAAA,CAAO;AAAA,MAC3B,MAAA;AAAA,MACA,KAAA,EAAO,EAAE,EAAA,EAAI,UAAA,EAAW;AAAA,MACxB,OAAO,EAAC;AAAA,MACR,OAAO,EAAC;AAAA;AAAA;AAAA;AAAA;AAAA,MAKR,oBAAA,EAAsB,CAAC,OAAO,CAAA;AAAA,MAC9B,QAAA,EAAU,EAAE,UAAA,EAAY,OAAA;AAAQ,KACjB,CAAA;AACjB,IAAA,MAAM,GAAA,GAAM,MAAM,QAAA,CAAS,IAAA,CAAK,MAAM,CAAA;AACtC,IAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,IAAA,OAAO,YAAA,CAAa,MAAA,CAAO,MAAA,IAAU,EAAE,CAAA;AAAA,EACzC,SAAS,GAAA,EAAK;AAIZ,IAAA,MAAM,MAAA,GAAS,aAAa,GAAG,CAAA;AAC/B,IAAA,IAAI,MAAA,KAAW,GAAA,IAAO,MAAA,KAAW,GAAA,IAAO,WAAW,GAAA,EAAK;AACtD,MAAA,MAAM,IAAI,oBAAA,CAAqB,MAAA,EAAQ,UAAA,EAAY,GAAG,CAAA;AAAA,IACxD;AACA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,UAAA;AAAA,MACT,MAAA,EAAQ,sBAAsB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MAC9E,WAAA,EAAa;AAAA,KACf;AAAA,EACF,CAAA,SAAE;AACA,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,IAAI;AACF,QAAA,MAAM,SAAS,OAAA,EAAQ;AAAA,MACzB,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;AAOO,SAAS,mBAAmB,GAAA,EAA2B;AAC5D,EAAA,MAAM,QAAA,GACJ,GAAA,CAAI,QAAA,KAAa,MAAA,IAAa,GAAA,CAAI,QAAA,CAAS,MAAA,GAAS,CAAA,GAAI,GAAA,CAAI,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,GAAI,QAAA;AACpF,EAAA,OAAO,CAAA;;AAAA,MAAA,EAED,IAAI,IAAI;AAAA,UAAA,EACJ,QAAQ;AAAA,qBAAA,EACG,IAAI,YAAY;;AAAA;AAAA;AAAA;AAAA;;AAAA,uCAAA,CAAA;AAQvC","file":"chunk-IUMAQURF.js","sourcesContent":["/**\n * Pure verdict parser (T2.1, ADRs D120-D121).\n *\n * Strict prefix matching against `DONE:`, `CONTINUE:`, `SKIPPED:`. Reason\n * is the suffix, trimmed. Anything else is fail-safe: verdict = `continue`,\n * `parseFailed: true` — caller's max-consecutive-failure cap stops the\n * loop after N flakes.\n *\n * @internal\n */\n\nimport type { JudgeResult } from \"../../types/goal-events.js\";\n\nconst DONE_PREFIX = \"DONE:\";\nconst CONTINUE_PREFIX = \"CONTINUE:\";\nconst SKIPPED_PREFIX = \"SKIPPED:\";\n/** M80 — the judge can now declare impossibility, not just \"continue\". */\nconst BLOCKED_PREFIX = \"BLOCKED:\";\n\nexport function parseVerdict(text: string): JudgeResult {\n  const trimmed = text.trim();\n\n  if (trimmed.startsWith(DONE_PREFIX)) {\n    return {\n      verdict: \"done\",\n      reason: trimmed.slice(DONE_PREFIX.length).trim(),\n      parseFailed: false,\n    };\n  }\n  if (trimmed.startsWith(CONTINUE_PREFIX)) {\n    return {\n      verdict: \"continue\",\n      reason: trimmed.slice(CONTINUE_PREFIX.length).trim(),\n      parseFailed: false,\n    };\n  }\n  if (trimmed.startsWith(BLOCKED_PREFIX)) {\n    return {\n      verdict: \"blocked\",\n      reason: trimmed.slice(BLOCKED_PREFIX.length).trim(),\n      parseFailed: false,\n    };\n  }\n  if (trimmed.startsWith(SKIPPED_PREFIX)) {\n    return {\n      verdict: \"skipped\",\n      reason: trimmed.slice(SKIPPED_PREFIX.length).trim(),\n      parseFailed: false,\n    };\n  }\n\n  // Fail-safe: ADR D121 — prefer \"continue\" so we don't stop prematurely.\n  // The runUntil loop counts consecutive parseFailed responses and bails\n  // after `maxConsecutiveJudgeFailures` (default 3).\n  return {\n    verdict: \"continue\",\n    reason: `judge response malformed: \"${trimmed.slice(0, 100)}\"`,\n    parseFailed: true,\n  };\n}\n","import { TheokitAgentError } from \"../../errors.js\";\n/**\n * Judge call primitive (T2.2, ADRs D119-D121).\n *\n * Instantiates a short-lived auxiliary agent that evaluates whether a\n * goal is satisfied. The auxiliary judge runs with `tools: []` and a\n * cheap model (default `openai/gpt-4o-mini`) — see ADR D119. The judge\n * model needs only API access; we read `OPENROUTER_API_KEY` directly\n * from the environment (EC-A — single source of truth) and let the\n * caller override via {@link JudgeOptions.apiKey} for Anthropic or\n * direct-OpenAI environments.\n *\n * NOTE: judge aux agents created from inside a `forkAgent` context will\n * inherit the parent fork's whitelist via AsyncLocalStorage (EC-J).\n * `tools: []` keeps this benign today; future callers that add tools to\n * a judge should be aware.\n *\n * @internal\n */\n\nimport type { AgentOptions, SDKAgent } from \"../../types/agent.js\";\nimport type { JudgeResult } from \"../../types/goal-events.js\";\nimport { parseVerdict } from \"./parse-verdict.js\";\n\n/** Inputs to the judge — pure data. */\nexport interface JudgeContext {\n  goal: string;\n  lastResponse: string;\n  subgoals?: string[];\n}\n\n/** Caller-supplied tuning knobs for the judge call. */\nexport interface JudgeOptions {\n  /**\n   * Judge model identifier. When absent, it DERIVES from {@link agentModel} — and only falls back to the literal\n   * `\"openai/gpt-4o-mini\"` when neither is provided.\n   *\n   * M80 — the fixed default was provider-blind: it only resolves on OpenRouter. With an Anthropic key it gives\n   * 404, with an OAuth bearer it gives 401, and in both the goal burned 3 whole turns before failing with\n   * a misleading reason. The agent-builder already worked around this by deriving on its own; the knowledge\n   * belongs here.\n   */\n  judgeModel?: string;\n  /**\n   * M80 — the DRIVEN agent's model. It is the basis of the derivation: a judge running on the same model as the\n   * chat works wherever chat works.\n   */\n  agentModel?: string;\n  /** Override env. Default `process.env.OPENROUTER_API_KEY` (EC-A). */\n  apiKey?: string;\n}\n\n/**\n * M80 — the judge's credential or model does not work: 401/404.\n *\n * Fails FAST by design. `rules/error-handling.md` § 2 separates recoverable from unrecoverable, and a\n * nonexistent model does not start existing on retry — folding that into `{parseFailed: true}` made the loop\n * try three times and report \"failed\" on a consecutive-failure limit, hiding that the cause was the\n * credential. A slow, opaque failure traded for a fast, clear one.\n *\n * PARSE failures and network errors stay folded: they are recoverable, and the loop already decides on\n * in a row.\n */\nexport class JudgeCredentialError extends TheokitAgentError {\n  override readonly name = \"JudgeCredentialError\";\n\n  constructor(\n    readonly httpStatus: number,\n    readonly judgeModel: string,\n    cause: unknown,\n  ) {\n    super(\n      `judge unavailable: model \"${judgeModel}\" returned ${String(httpStatus)}. ` +\n        \"Pass `judgeModel`/`apiKey` that resolve for this provider, or omit `judgeModel` to derive \" +\n        \"it from the agent being driven.\",\n      { code: \"judge_credential\", cause, isRetryable: false },\n    );\n  }\n}\n\n/** Extracts the HTTP status from a provider error, when it carries one. */\nfunction httpStatusOf(err: unknown): number | undefined {\n  const s =\n    (err as { status?: unknown; statusCode?: unknown }).status ??\n    (err as { statusCode?: unknown }).statusCode;\n  if (typeof s === \"number\") return s;\n  const m = /\\b(401|403|404)\\b/.exec(err instanceof Error ? err.message : String(err));\n  return m?.[1] !== undefined ? Number(m[1]) : undefined;\n}\n\n/** Dependencies injected so `judge-call.ts` stays free of `Agent` import. */\nexport interface JudgeDeps {\n  create: (options: AgentOptions) => Promise<SDKAgent>;\n}\n\n/**\n * Run the judge auxiliary agent and parse the verdict. Always returns a\n * `JudgeResult` — failures are folded into `{ parseFailed: true,\n * verdict: \"continue\" }` so the loop can decide based on consecutive\n * failures (ADR D121).\n *\n * @internal\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: judge call must (1) check env or override, (2) catch errors as fail-safe, (3) ensure aux dispose runs once regardless of outcome — three concerns linearly arranged, harm clarity to extract.\nexport async function judgeCallImpl(\n  ctx: JudgeContext,\n  options: JudgeOptions | undefined,\n  deps: JudgeDeps,\n): Promise<JudgeResult> {\n  const prompt = composeJudgePrompt(ctx);\n  // EC-A: single env source — OpenRouter only. No multi-provider fallback.\n  const apiKey = options?.apiKey ?? process.env.OPENROUTER_API_KEY;\n  if (apiKey === undefined) {\n    return {\n      verdict: \"continue\",\n      reason:\n        \"judge unavailable: OPENROUTER_API_KEY missing and no override passed via options.apiKey\",\n      parseFailed: true,\n    };\n  }\n\n  // M80 — precedence: explicit > driven agent's model > the historical literal. The literal only\n  // survives as a last resort, so as not to break callers who never passed either.\n  const judgeModel = options?.judgeModel ?? options?.agentModel ?? \"openai/gpt-4o-mini\";\n  let auxAgent: SDKAgent | undefined;\n  try {\n    auxAgent = await deps.create({\n      apiKey,\n      model: { id: judgeModel },\n      tools: [],\n      local: {},\n      // #581 — `tools: []` READS as \"no tools\" and is not: a `shell` tool is always registered on a\n      // local agent, this line included. This judge is sandboxed (unlike the scorer's), so the\n      // exposure is smaller — but it still held a capability it never asked for, and whose absence\n      // the line above appears to declare. Withholding is what actually declares it.\n      withheldBuiltinTools: [\"shell\"],\n      metadata: { forkOrigin: \"judge\" },\n    } as AgentOptions);\n    const run = await auxAgent.send(prompt);\n    const result = await run.wait();\n    return parseVerdict(result.result ?? \"\");\n  } catch (err) {\n    // M80 — 401/403/404 are credential/model errors: unrecoverable, failing fast and typed. Everything\n    // else (network, timeout, 5xx) stays folded, because it IS recoverable and the loop already decides on\n    // in a row.\n    const status = httpStatusOf(err);\n    if (status === 401 || status === 403 || status === 404) {\n      throw new JudgeCredentialError(status, judgeModel, err);\n    }\n    return {\n      verdict: \"continue\",\n      reason: `judge call failed: ${err instanceof Error ? err.message : String(err)}`,\n      parseFailed: true,\n    };\n  } finally {\n    if (auxAgent !== undefined) {\n      try {\n        await auxAgent.dispose();\n      } catch {\n        // dispose errors are non-fatal; judge result is already prepared\n      }\n    }\n  }\n}\n\n/**\n * Build the strict-format prompt the judge expects.\n *\n * @internal\n */\nexport function composeJudgePrompt(ctx: JudgeContext): string {\n  const subgoals =\n    ctx.subgoals !== undefined && ctx.subgoals.length > 0 ? ctx.subgoals.join(\", \") : \"(none)\";\n  return `You are a goal judge. Determine if this goal is satisfied.\n\nGoal: ${ctx.goal}\nSubgoals: ${subgoals}\nLast agent response: ${ctx.lastResponse}\n\nRespond with EXACTLY one of:\n- DONE: <reason>\n- CONTINUE: <what's left>\n- SKIPPED: <why not applicable>\n\nBe strict. If unclear, prefer CONTINUE.`;\n}\n"]}
+{"version":3,"sources":["../src/internal/judge/parse-verdict.ts","../src/internal/judge/judge-call.ts"],"names":[],"mappings":";;;AAaA,IAAM,WAAA,GAAc,OAAA;AACpB,IAAM,eAAA,GAAkB,WAAA;AACxB,IAAM,cAAA,GAAiB,UAAA;AAEvB,IAAM,cAAA,GAAiB,UAAA;AAEhB,SAAS,aAAa,IAAA,EAA2B;AACtD,EAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAE1B,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,WAAW,CAAA,EAAG;AACnC,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,MAAA;AAAA,MACT,QAAQ,OAAA,CAAQ,KAAA,CAAM,WAAA,CAAY,MAAM,EAAE,IAAA,EAAK;AAAA,MAC/C,WAAA,EAAa;AAAA,KACf;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,eAAe,CAAA,EAAG;AACvC,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,UAAA;AAAA,MACT,QAAQ,OAAA,CAAQ,KAAA,CAAM,eAAA,CAAgB,MAAM,EAAE,IAAA,EAAK;AAAA,MACnD,WAAA,EAAa;AAAA,KACf;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,cAAc,CAAA,EAAG;AACtC,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,SAAA;AAAA,MACT,QAAQ,OAAA,CAAQ,KAAA,CAAM,cAAA,CAAe,MAAM,EAAE,IAAA,EAAK;AAAA,MAClD,WAAA,EAAa;AAAA,KACf;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,cAAc,CAAA,EAAG;AACtC,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,SAAA;AAAA,MACT,QAAQ,OAAA,CAAQ,KAAA,CAAM,cAAA,CAAe,MAAM,EAAE,IAAA,EAAK;AAAA,MAClD,WAAA,EAAa;AAAA,KACf;AAAA,EACF;AAKA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,UAAA;AAAA,IACT,QAAQ,CAAA,2BAAA,EAA8B,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,IAC3D,WAAA,EAAa;AAAA,GACf;AACF;;;ACIO,IAAM,oBAAA,GAAN,cAAmC,iBAAA,CAAkB;AAAA,EAG1D,WAAA,CACW,UAAA,EACA,UAAA,EACT,KAAA,EACA;AACA,IAAA,KAAA;AAAA,MACE,CAAA,0BAAA,EAA6B,UAAU,CAAA,WAAA,EAAc,MAAA,CAAO,UAAU,CAAC,CAAA,iIAAA,CAAA;AAAA,MAGvE,EAAE,IAAA,EAAM,kBAAA,EAAoB,KAAA,EAAO,aAAa,KAAA;AAAM,KACxD;AATS,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAAA,EASX;AAAA,EAVW,UAAA;AAAA,EACA,UAAA;AAAA,EAJO,IAAA,GAAO,sBAAA;AAc3B;AAGA,SAAS,aAAa,GAAA,EAAkC;AACtD,EAAA,MAAM,CAAA,GACH,GAAA,CAAmD,MAAA,IACnD,GAAA,CAAiC,UAAA;AACpC,EAAA,IAAI,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,CAAA;AAClC,EAAA,MAAM,CAAA,GAAI,oBAAoB,IAAA,CAAK,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AACnF,EAAA,OAAO,CAAA,GAAI,CAAC,CAAA,KAAM,MAAA,GAAY,OAAO,CAAA,CAAE,CAAC,CAAC,CAAA,GAAI,MAAA;AAC/C;AAgBA,eAAsB,aAAA,CACpB,GAAA,EACA,OAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,MAAA,GAAS,mBAAmB,GAAG,CAAA;AAErC,EAAA,MAAM,MAAA,GAAS,OAAA,EAAS,MAAA,IAAU,OAAA,CAAQ,GAAA,CAAI,kBAAA;AAC9C,EAAA,IAAI,WAAW,MAAA,EAAW;AACxB,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,UAAA;AAAA,MACT,MAAA,EACE,yFAAA;AAAA,MACF,WAAA,EAAa;AAAA,KACf;AAAA,EACF;AAIA,EAAA,MAAM,UAAA,GAAa,OAAA,EAAS,UAAA,IAAc,OAAA,EAAS,UAAA,IAAc,oBAAA;AACjE,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,KAAK,MAAA,CAAO;AAAA,MAC3B,MAAA;AAAA,MACA,KAAA,EAAO,EAAE,EAAA,EAAI,UAAA,EAAW;AAAA,MACxB,OAAO,EAAC;AAAA,MACR,OAAO,EAAC;AAAA;AAAA;AAAA;AAAA;AAAA,MAKR,oBAAA,EAAsB,CAAC,OAAO,CAAA;AAAA,MAC9B,QAAA,EAAU,EAAE,UAAA,EAAY,OAAA;AAAQ,KACjB,CAAA;AACjB,IAAA,MAAM,GAAA,GAAM,MAAM,QAAA,CAAS,IAAA,CAAK,MAAM,CAAA;AACtC,IAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,IAAA,OAAO,YAAA,CAAa,MAAA,CAAO,MAAA,IAAU,EAAE,CAAA;AAAA,EACzC,SAAS,GAAA,EAAK;AAIZ,IAAA,MAAM,MAAA,GAAS,aAAa,GAAG,CAAA;AAC/B,IAAA,IAAI,MAAA,KAAW,GAAA,IAAO,MAAA,KAAW,GAAA,IAAO,WAAW,GAAA,EAAK;AACtD,MAAA,MAAM,IAAI,oBAAA,CAAqB,MAAA,EAAQ,UAAA,EAAY,GAAG,CAAA;AAAA,IACxD;AACA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,UAAA;AAAA,MACT,MAAA,EAAQ,sBAAsB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,MAC9E,WAAA,EAAa;AAAA,KACf;AAAA,EACF,CAAA,SAAE;AACA,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,IAAI;AACF,QAAA,MAAM,SAAS,OAAA,EAAQ;AAAA,MACzB,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;AAOO,SAAS,mBAAmB,GAAA,EAA2B;AAC5D,EAAA,MAAM,QAAA,GACJ,GAAA,CAAI,QAAA,KAAa,MAAA,IAAa,GAAA,CAAI,QAAA,CAAS,MAAA,GAAS,CAAA,GAAI,GAAA,CAAI,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,GAAI,QAAA;AACpF,EAAA,OAAO,CAAA;;AAAA,MAAA,EAED,IAAI,IAAI;AAAA,UAAA,EACJ,QAAQ;AAAA,qBAAA,EACG,IAAI,YAAY;;AAAA;AAAA;AAAA;AAAA;;AAAA,uCAAA,CAAA;AAQvC","file":"chunk-X6DUEDAF.js","sourcesContent":["/**\n * Pure verdict parser (T2.1, ADRs D120-D121).\n *\n * Strict prefix matching against `DONE:`, `CONTINUE:`, `SKIPPED:`. Reason\n * is the suffix, trimmed. Anything else is fail-safe: verdict = `continue`,\n * `parseFailed: true` — caller's max-consecutive-failure cap stops the\n * loop after N flakes.\n *\n * @internal\n */\n\nimport type { JudgeResult } from \"../../types/goal-events.js\";\n\nconst DONE_PREFIX = \"DONE:\";\nconst CONTINUE_PREFIX = \"CONTINUE:\";\nconst SKIPPED_PREFIX = \"SKIPPED:\";\n/** M80 — the judge can now declare impossibility, not just \"continue\". */\nconst BLOCKED_PREFIX = \"BLOCKED:\";\n\nexport function parseVerdict(text: string): JudgeResult {\n  const trimmed = text.trim();\n\n  if (trimmed.startsWith(DONE_PREFIX)) {\n    return {\n      verdict: \"done\",\n      reason: trimmed.slice(DONE_PREFIX.length).trim(),\n      parseFailed: false,\n    };\n  }\n  if (trimmed.startsWith(CONTINUE_PREFIX)) {\n    return {\n      verdict: \"continue\",\n      reason: trimmed.slice(CONTINUE_PREFIX.length).trim(),\n      parseFailed: false,\n    };\n  }\n  if (trimmed.startsWith(BLOCKED_PREFIX)) {\n    return {\n      verdict: \"blocked\",\n      reason: trimmed.slice(BLOCKED_PREFIX.length).trim(),\n      parseFailed: false,\n    };\n  }\n  if (trimmed.startsWith(SKIPPED_PREFIX)) {\n    return {\n      verdict: \"skipped\",\n      reason: trimmed.slice(SKIPPED_PREFIX.length).trim(),\n      parseFailed: false,\n    };\n  }\n\n  // Fail-safe: ADR D121 — prefer \"continue\" so we don't stop prematurely.\n  // The runUntil loop counts consecutive parseFailed responses and bails\n  // after `maxConsecutiveJudgeFailures` (default 3).\n  return {\n    verdict: \"continue\",\n    reason: `judge response malformed: \"${trimmed.slice(0, 100)}\"`,\n    parseFailed: true,\n  };\n}\n","import { TheokitAgentError } from \"../../errors.js\";\n/**\n * Judge call primitive (T2.2, ADRs D119-D121).\n *\n * Instantiates a short-lived auxiliary agent that evaluates whether a\n * goal is satisfied. The auxiliary judge runs with `tools: []` and a\n * cheap model (default `openai/gpt-4o-mini`) — see ADR D119. The judge\n * model needs only API access; we read `OPENROUTER_API_KEY` directly\n * from the environment (EC-A — single source of truth) and let the\n * caller override via {@link JudgeOptions.apiKey} for Anthropic or\n * direct-OpenAI environments.\n *\n * NOTE: judge aux agents created from inside a `forkAgent` context will\n * inherit the parent fork's whitelist via AsyncLocalStorage (EC-J).\n * `tools: []` keeps this benign today; future callers that add tools to\n * a judge should be aware.\n *\n * @internal\n */\n\nimport type { AgentOptions, SDKAgent } from \"../../types/agent.js\";\nimport type { JudgeResult } from \"../../types/goal-events.js\";\nimport { parseVerdict } from \"./parse-verdict.js\";\n\n/** Inputs to the judge — pure data. */\nexport interface JudgeContext {\n  goal: string;\n  lastResponse: string;\n  subgoals?: string[];\n}\n\n/** Caller-supplied tuning knobs for the judge call. */\nexport interface JudgeOptions {\n  /**\n   * Judge model identifier. When absent, it DERIVES from {@link agentModel} — and only falls back to the literal\n   * `\"openai/gpt-4o-mini\"` when neither is provided.\n   *\n   * M80 — the fixed default was provider-blind: it only resolves on OpenRouter. With an Anthropic key it gives\n   * 404, with an OAuth bearer it gives 401, and in both the goal burned 3 whole turns before failing with\n   * a misleading reason. The agent-builder already worked around this by deriving on its own; the knowledge\n   * belongs here.\n   */\n  judgeModel?: string;\n  /**\n   * M80 — the DRIVEN agent's model. It is the basis of the derivation: a judge running on the same model as the\n   * chat works wherever chat works.\n   */\n  agentModel?: string;\n  /** Override env. Default `process.env.OPENROUTER_API_KEY` (EC-A). */\n  apiKey?: string;\n}\n\n/**\n * M80 — the judge's credential or model does not work: 401/404.\n *\n * Fails FAST by design. `rules/error-handling.md` § 2 separates recoverable from unrecoverable, and a\n * nonexistent model does not start existing on retry — folding that into `{parseFailed: true}` made the loop\n * try three times and report \"failed\" on a consecutive-failure limit, hiding that the cause was the\n * credential. A slow, opaque failure traded for a fast, clear one.\n *\n * PARSE failures and network errors stay folded: they are recoverable, and the loop already decides on\n * in a row.\n */\nexport class JudgeCredentialError extends TheokitAgentError {\n  override readonly name = \"JudgeCredentialError\";\n\n  constructor(\n    readonly httpStatus: number,\n    readonly judgeModel: string,\n    cause: unknown,\n  ) {\n    super(\n      `judge unavailable: model \"${judgeModel}\" returned ${String(httpStatus)}. ` +\n        \"Pass `judgeModel`/`apiKey` that resolve for this provider, or omit `judgeModel` to derive \" +\n        \"it from the agent being driven.\",\n      { code: \"judge_credential\", cause, isRetryable: false },\n    );\n  }\n}\n\n/** Extracts the HTTP status from a provider error, when it carries one. */\nfunction httpStatusOf(err: unknown): number | undefined {\n  const s =\n    (err as { status?: unknown; statusCode?: unknown }).status ??\n    (err as { statusCode?: unknown }).statusCode;\n  if (typeof s === \"number\") return s;\n  const m = /\\b(401|403|404)\\b/.exec(err instanceof Error ? err.message : String(err));\n  return m?.[1] !== undefined ? Number(m[1]) : undefined;\n}\n\n/** Dependencies injected so `judge-call.ts` stays free of `Agent` import. */\nexport interface JudgeDeps {\n  create: (options: AgentOptions) => Promise<SDKAgent>;\n}\n\n/**\n * Run the judge auxiliary agent and parse the verdict. Always returns a\n * `JudgeResult` — failures are folded into `{ parseFailed: true,\n * verdict: \"continue\" }` so the loop can decide based on consecutive\n * failures (ADR D121).\n *\n * @internal\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: judge call must (1) check env or override, (2) catch errors as fail-safe, (3) ensure aux dispose runs once regardless of outcome — three concerns linearly arranged, harm clarity to extract.\nexport async function judgeCallImpl(\n  ctx: JudgeContext,\n  options: JudgeOptions | undefined,\n  deps: JudgeDeps,\n): Promise<JudgeResult> {\n  const prompt = composeJudgePrompt(ctx);\n  // EC-A: single env source — OpenRouter only. No multi-provider fallback.\n  const apiKey = options?.apiKey ?? process.env.OPENROUTER_API_KEY;\n  if (apiKey === undefined) {\n    return {\n      verdict: \"continue\",\n      reason:\n        \"judge unavailable: OPENROUTER_API_KEY missing and no override passed via options.apiKey\",\n      parseFailed: true,\n    };\n  }\n\n  // M80 — precedence: explicit > driven agent's model > the historical literal. The literal only\n  // survives as a last resort, so as not to break callers who never passed either.\n  const judgeModel = options?.judgeModel ?? options?.agentModel ?? \"openai/gpt-4o-mini\";\n  let auxAgent: SDKAgent | undefined;\n  try {\n    auxAgent = await deps.create({\n      apiKey,\n      model: { id: judgeModel },\n      tools: [],\n      local: {},\n      // #581 — `tools: []` READS as \"no tools\" and is not: a `shell` tool is always registered on a\n      // local agent, this line included. This judge is sandboxed (unlike the scorer's), so the\n      // exposure is smaller — but it still held a capability it never asked for, and whose absence\n      // the line above appears to declare. Withholding is what actually declares it.\n      withheldBuiltinTools: [\"shell\"],\n      metadata: { forkOrigin: \"judge\" },\n    } as AgentOptions);\n    const run = await auxAgent.send(prompt);\n    const result = await run.wait();\n    return parseVerdict(result.result ?? \"\");\n  } catch (err) {\n    // M80 — 401/403/404 are credential/model errors: unrecoverable, failing fast and typed. Everything\n    // else (network, timeout, 5xx) stays folded, because it IS recoverable and the loop already decides on\n    // in a row.\n    const status = httpStatusOf(err);\n    if (status === 401 || status === 403 || status === 404) {\n      throw new JudgeCredentialError(status, judgeModel, err);\n    }\n    return {\n      verdict: \"continue\",\n      reason: `judge call failed: ${err instanceof Error ? err.message : String(err)}`,\n      parseFailed: true,\n    };\n  } finally {\n    if (auxAgent !== undefined) {\n      try {\n        await auxAgent.dispose();\n      } catch {\n        // dispose errors are non-fatal; judge result is already prepared\n      }\n    }\n  }\n}\n\n/**\n * Build the strict-format prompt the judge expects.\n *\n * @internal\n */\nexport function composeJudgePrompt(ctx: JudgeContext): string {\n  const subgoals =\n    ctx.subgoals !== undefined && ctx.subgoals.length > 0 ? ctx.subgoals.join(\", \") : \"(none)\";\n  return `You are a goal judge. Determine if this goal is satisfied.\n\nGoal: ${ctx.goal}\nSubgoals: ${subgoals}\nLast agent response: ${ctx.lastResponse}\n\nRespond with EXACTLY one of:\n- DONE: <reason>\n- CONTINUE: <what's left>\n- SKIPPED: <why not applicable>\n\nBe strict. If unclear, prefer CONTINUE.`;\n}\n"]}

package/dist/{chunk-CFE6QF2Q.js → chunk-XCQ432OX.js}

@@ -1,5 +1,5 @@
 import { getAgentFacade } from './chunk-6X6ID4MO.js';
-import { TheokitAgentError } from './chunk-ALUN2B4W.js';
+import { TheokitAgentError } from './chunk-B5MHRQJZ.js';
 import { z } from 'zod';
 import { AsyncLocalStorage } from 'async_hooks';
 
@@ -217,5 +217,5 @@ function subAgentToolsFromDefinitions(agents, parentTools) {
 }
 
 export { MaxDelegationDepthError, SubAgent, subAgentToolsFromDefinitions, withInheritedSubAgentCredentials };
-//# sourceMappingURL=chunk-CFE6QF2Q.js.map
-//# sourceMappingURL=chunk-CFE6QF2Q.js.map
+//# sourceMappingURL=chunk-XCQ432OX.js.map
+//# sourceMappingURL=chunk-XCQ432OX.js.map

package/dist/{chunk-CFE6QF2Q.js.map → chunk-XCQ432OX.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/concurrency/delegation-depth.ts","../src/internal/concurrency/subagent-credentials.ts","../src/a2a/subagent.ts"],"names":["AsyncLocalStorage"],"mappings":";;;;;AA6BA,IAAM,UAAA,GAAa,IAAI,iBAAA,EAA0B;AAWjD,eAAsB,mBAAA,CAAuB,OAAe,EAAA,EAAkC;AAC5F,EAAA,OAAO,UAAA,CAAW,GAAA,CAAI,KAAA,EAAO,EAAE,CAAA;AACjC;AAUO,SAAS,sBAAA,GAAiC;AAC/C,EAAA,OAAO,UAAA,CAAW,UAAS,IAAK,CAAA;AAClC;ACkEA,IAAM,gBAAA,GAAmB,IAAIA,iBAAAA,EAAwC;AAUrE,eAAsB,gCAAA,CACpB,aACA,EAAA,EACY;AACZ,EAAA,OAAO,gBAAA,CAAiB,GAAA,CAAI,WAAA,EAAa,EAAE,CAAA;AAC7C;AAWO,SAAS,mCAAA,GAAwE;AACtF,EAAA,OAAO,iBAAiB,QAAA,EAAS;AACnC;;;ACwFO,IAAM,uBAAA,GAAN,cAAsC,iBAAA,CAAkB;AAAA,EAG7D,WAAA,CACkB,cACA,QAAA,EAChB;AAEA,IAAA,KAAA,CAAM,CAAA,qBAAA,EAAwB,QAAQ,CAAA,oBAAA,EAAuB,YAAY,CAAA,CAAA,CAAA,EAAK;AAAA,MAC5E,IAAA,EAAM,sBAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACd,CAAA;AAPe,IAAA,IAAA,CAAA,YAAA,GAAA,YAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAOlB;AAAA,EARkB,YAAA;AAAA,EACA,QAAA;AAAA,EAJA,IAAA,GAAO,yBAAA;AAAA,EACP,IAAA,GAAO,sBAAA;AAW3B;AAMA,eAAe,oBAAA,CACb,IAAA,EACA,KAAA,EACA,SAAA,EACoE;AACpE,EAAA,IAAI,IAAA,CAAK,iBAAA,KAAsB,MAAA,EAAW,OAAO,EAAE,KAAA,EAAM;AACzD,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,iBAAA,CAAkB,EAAE,OAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,SAAA,EAAW,CAAA;AACnF,EAAA,IAAI,QAAA,KAAa,MAAA,EAAW,OAAO,EAAE,KAAA,EAAM;AAC3C,EAAA,IAAI,SAAS,OAAA,KAAY,KAAA;AACvB,IAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,CAAS,eAAA,IAAmB,uBAAA,EAAwB;AACvE,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,SAAS,aAAA,IAAiB,KAAA;AAAA,IACjC,GAAI,SAAS,gBAAA,KAAqB,MAAA,GAAY,EAAE,QAAA,EAAU,QAAA,CAAS,gBAAA,EAAiB,GAAI;AAAC,GAC3F;AACF;AAOA,eAAe,wBAAwB,GAAA,EAA2B;AAChE,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,WAAA,MAAiB,KAAA,IAAS,GAAA,CAAI,MAAA,EAAO,EAAG;AACtC,IAAA,IAAI,KAAA,CAAM,IAAA,KAAS,WAAA,IAAe,KAAA,CAAM,WAAW,WAAA,EAAa;AAC9D,MAAA,MAAM,QAAA,GACJ,OAAO,KAAA,CAAM,MAAA,KAAW,QAAA,GAAW,KAAA,CAAM,MAAA,GAAS,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,MAAA,IAAU,IAAI,CAAA;AACvF,MAAA,KAAA,CAAM,KAAK,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,QAAQ,CAAA,CAAE,CAAA;AAAA,IACzC;AAAA,EACF;AACA,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC/B,EAAA,OAAO;;AAAA;AAAA,EAAgC,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,wBAAA,CAAA;AACzD;AAkBA,SAAS,sBAAA,CACP,SACA,SAAA,EACmC;AACnC,EAAA,MAAM,QAA4C,EAAC;AACnD,EAAA,IAAI,YAAY,MAAA,EAAW,KAAA,CAAM,cAAA,GAAiB,EAAE,SAAS,OAAA,EAAQ;AACrE,EAAA,IAAI,SAAA,EAAW,mBAAmB,MAAA,EAAW,KAAA,CAAM,iBAAiB,CAAC,GAAG,UAAU,cAAc,CAAA;AAChG,EAAA,IAAI,SAAA,EAAW,kBAAkB,MAAA,EAAW,KAAA,CAAM,gBAAgB,CAAC,GAAG,UAAU,aAAa,CAAA;AAC7F,EAAA,OAAO,OAAO,IAAA,CAAK,KAAK,CAAA,CAAE,MAAA,GAAS,IAAI,KAAA,GAAQ,MAAA;AACjD;AAYA,SAAS,0BAAA,CACP,MACA,SAAA,EACwC;AACxC,EAAA,MAAM,MAAM,IAAA,CAAK,oBAAA;AACjB,EAAA,MAAM,SAAS,SAAA,EAAW,oBAAA;AAC1B,EAAA,IAAI,GAAA,KAAQ,MAAA,IAAa,MAAA,KAAW,MAAA,EAAW,OAAO,MAAA;AACtD,EAAA,OAAO,CAAC,mBAAG,IAAI,GAAA,CAAI,CAAC,GAAI,MAAA,IAAU,EAAC,EAAI,GAAI,GAAA,IAAO,EAAG,CAAC,CAAC,CAAA;AACzD;AASO,SAAS,uBAAA,CACd,MACA,SAAA,EACc;AAKd,EAAA,MAAM,KAAA,GACJ,IAAA,CAAK,KAAA,KAAU,MAAA,GACX,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,GACpB,EAAE,IAAI,IAAA,CAAK,KAAA,EAAM,GACjB,IAAA,CAAK,QACP,SAAA,EAAW,KAAA;AAGjB,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,IAAW,SAAA,EAAW,OAAA;AAC3C,EAAA,MAAM,KAAA,GAAQ,sBAAA,CAAuB,OAAA,EAAS,SAAS,CAAA;AACvD,EAAA,MAAM,QAAA,GAAW,0BAAA,CAA2B,IAAA,EAAM,SAAS,CAAA;AAC3D,EAAA,OAAO;AAAA,IACL,GAAI,WAAW,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,SAAA,CAAU,MAAA,EAAO,GAAI,EAAC;AAAA,IACtE,GAAI,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,KAAU,EAAC;AAAA,IACvC,GAAI,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,KAAU,EAAC;AAAA,IACvC,GAAI,QAAA,KAAa,MAAA,GAAY,EAAE,oBAAA,EAAsB,QAAA,KAAa,EAAC;AAAA,IACnE,GAAI,WAAW,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,EAAS,SAAA,CAAU,OAAA,EAAQ,GAAI,EAAC;AAAA,IACzE,cAAc,IAAA,CAAK,YAAA;AAAA,IACnB,KAAA,EAAO,IAAA,CAAK,KAAA,IAAS;AAAC,GACxB;AACF;AAQA,eAAe,cACb,IAAA,EACA,KAAA,EACA,MAAA,EACA,QAAA,EACA,WACA,KAAA,EACiB;AAIjB,EAAA,OAAO,mBAAA;AAAA,IAAoB,KAAA;AAAA,IAAO,MAChC,oBAAA,CAAqB,IAAA,EAAM,KAAA,EAAO,MAAA,EAAQ,UAAU,SAAS;AAAA,GAC/D;AACF;AAEA,eAAe,oBAAA,CACb,IAAA,EACA,KAAA,EACA,MAAA,EACA,UACA,SAAA,EACiB;AAMjB,EAAA,MAAM,KAAA,GAAQ,MAAM,cAAA,EAAe,CAAE,OAAO,uBAAA,CAAwB,IAAA,EAAM,SAAS,CAAC,CAAA;AACpF,EAAA,IAAI;AACF,IAAA,MAAM,WAAA,GAIF;AAAA,MACF,GAAI,MAAA,KAAW,KAAA,CAAA,GAAY,EAAE,MAAA,KAAW,EAAC;AAAA,MACzC,GAAI,QAAA,KAAa,KAAA,CAAA,GAAY,EAAE,aAAA,EAAe,QAAA,KAAa,EAAC;AAAA;AAAA,MAE5D,MAAA,EAAQ,EAAE,IAAA,EAAM,aAAA;AAAc,KAChC;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,IAAA,CAAK,OAAO,WAAW,CAAA;AAC/C,IAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAG9B,IAAA,IAAI,MAAA,CAAO,WAAW,OAAA,EAAS;AAC7B,MAAA,MAAM,QAAS,MAAA,CAA4C,KAAA;AAC3D,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,aAAa,IAAA,CAAK,IAAI,CAAA,cAAA,EAAiB,KAAA,EAAO,WAAW,eAAe,CAAA,CAAA;AAAA,QACxE,KAAA,KAAU,KAAA,CAAA,GAAY,EAAE,KAAA,EAAM,GAAI,KAAA;AAAA,OACpC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,OAAO,MAAA,IAAU,eAAA;AAE9B,IAAA,OAAO,KAAK,kBAAA,KAAuB,IAAA,GAAO,OAAQ,MAAM,uBAAA,CAAwB,GAAG,CAAA,GAAK,IAAA;AAAA,EAC1F,CAAA,SAAE;AACA,IAAA,KAAA,CAAM,OAAA,EAAQ;AAAA,EAChB;AACF;AAQA,eAAe,qBAAA,CACb,IAAA,EACA,KAAA,EACA,KAAA,EACA,SAAA,EACe;AACf,EAAA,IAAI,IAAA,CAAK,yBAAyB,MAAA,EAAW;AAC7C,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,CAAK,qBAAqB,EAAE,KAAA,EAAO,MAAM,IAAA,CAAK,IAAA,EAAM,KAAA,EAAO,SAAA,EAAW,CAAA;AAAA,EAC9E,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAQA,SAAS,kBAAA,CACP,IAAA,EACA,KAAA,EACA,QAAA,EACQ;AACR,EAAA,IAAI,IAAA,CAAK,aAAA,KAAkB,MAAA,IAAa,QAAA,KAAa,QAAW,OAAO,KAAA;AACvE,EAAA,MAAM,QAAA,GAAW,KAAK,aAAA,CAAc,EAAE,UAAU,KAAA,EAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,CAAA;AACxE,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAClC,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AACzE,EAAA,OAAO,CAAA;AAAA,EAAwB,QAAQ;;AAAA;AAAA,EAAc,KAAK,CAAA,CAAA;AAC5D;AAGA,eAAe,uBAAA,CACb,IAAA,EACA,KAAA,EACA,MAAA,EACA,SAAA,EACiB;AACjB,EAAA,IAAI,IAAA,CAAK,oBAAA,KAAyB,MAAA,EAAW,OAAO,MAAA;AACpD,EAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,oBAAA,CAAqB,EAAE,KAAA,EAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ,SAAA,EAAW,CAAA;AAChG,EAAA,OAAO,UAAA,EAAY,QAAA,KAAa,MAAA,GAAY,MAAA,GAAS,WAAW,QAAA,GAAW,MAAA;AAC7E;AAEA,SAAS,cAAA,CAAe,IAAA,EAAoB,YAAA,GAAe,CAAA,EAAe;AACxE,EAAA,MAAM,QAAA,GAAW,KAAK,kBAAA,IAAsB,CAAA;AAM5C,EAAA,IAAI,YAAA,GAAe,IAAI,QAAA,EAAU;AAC/B,IAAA,MAAM,IAAI,uBAAA,CAAwB,YAAA,GAAe,CAAA,EAAG,QAAQ,CAAA;AAAA,EAC9D;AAGA,EAAA,MAAM,QAAA,GAAW,EAAE,MAAA,CAAO;AAAA,IACxB,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,uBAAuB;AAAA,GACnD,CAAA;AAKD,EAAA,MAAM,WAAA,GAAuC;AAAA,IAC3C,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,uBAAA;AAAwB,KAChE;AAAA,IACA,QAAA,EAAU,CAAC,OAAO,CAAA;AAAA,IAClB,oBAAA,EAAsB;AAAA,GACxB;AAIA,EAAA,IAAI,SAAA,GAAY,CAAA;AAEhB,EAAA,MAAM,IAAA,GAAmB;AAAA,IACvB,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,aAAa,IAAA,CAAK,WAAA;AAAA,IAClB,WAAA;AAAA,IACA,OAAA,EAAS,OACP,QAAA,EACA,GAAA,KAKoB;AACpB,MAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAO,GAAI,QAAA,CAAS,MAAM,QAAQ,CAAA;AAMjD,MAAA,MAAM,YAAY,mCAAA,EAAoC;AAItD,MAAA,MAAM,YAAA,GAAe,YAAA,GAAe,sBAAA,EAAuB,GAAI,CAAA;AAC/D,MAAA,IAAI,eAAe,QAAA,EAAU;AAC3B,QAAA,MAAM,IAAI,uBAAA,CAAwB,YAAA,EAAc,QAAQ,CAAA;AAAA,MAC1D;AACA,MAAA,SAAA,IAAa,CAAA;AAIb,MAAA,MAAM,iBAAA,GAAoB,SAAA;AAE1B,MAAA,MAAM,KAAA,GAAQ,MAAM,oBAAA,CAAqB,IAAA,EAAM,QAAQ,iBAAiB,CAAA;AACxE,MAAA,IAAI,QAAA,IAAY,KAAA,EAAO,OAAO,KAAA,CAAM,MAAA;AAEpC,MAAA,MAAM,QAAQ,kBAAA,CAAmB,IAAA,EAAM,KAAA,CAAM,KAAA,EAAO,KAAK,QAAQ,CAAA;AAEjE,MAAA,IAAI,MAAA;AACJ,MAAA,IAAI;AAEF,QAAA,MAAA,GAAS,MAAM,aAAA;AAAA,UACb,IAAA;AAAA,UACA,KAAA;AAAA,UACA,GAAA,EAAK,MAAA;AAAA,UACL,KAAA,CAAM,QAAA;AAAA,UACN,SAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF,SAAS,KAAA,EAAO;AAId,QAAA,MAAM,qBAAA,CAAsB,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,iBAAiB,CAAA;AACjE,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,OAAO,uBAAA,CAAwB,IAAA,EAAM,KAAA,EAAO,MAAA,EAAQ,iBAAiB,CAAA;AAAA,IACvE;AAAA,GACF;AAKA,EAAA,OAAO,IAAA;AACT;AAMO,IAAM,WAAN,MAAe;AAAA,EACZ,WAAA,GAAc;AAAA,EAAC;AAAA,EACvB,OAAO,MAAA,CAAO,IAAA,EAAoB,WAAA,GAAc,CAAA,EAAe;AAC7D,IAAA,OAAO,cAAA,CAAe,MAAM,WAAW,CAAA;AAAA,EACzC;AACF;AAsBO,SAAS,4BAAA,CACd,QACA,WAAA,EACc;AACd,EAAA,OAAO,MAAA,CAAO,QAAQ,MAAM,CAAA,CAAE,IAAI,CAAC,CAAC,IAAA,EAAM,GAAG,CAAA,KAAM;AACjD,IAAA,MAAM,SAAA,GACJ,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA,IAAK,GAAA,CAAI,KAAA,CAAM,MAAA,GAAS,CAAA,GAAI,IAAI,GAAA,CAAI,GAAA,CAAI,KAAK,CAAA,GAAI,MAAA;AAC1E,IAAA,MAAM,UAAA,GAAa,SAAA,GAAY,WAAA,CAAY,MAAA,CAAO,CAAC,CAAA,KAAM,SAAA,CAAU,GAAA,CAAI,CAAA,CAAE,IAAI,CAAC,CAAA,GAAI,WAAA;AAClF,IAAA,OAAO,cAAA,CAAe;AAAA,MACpB,IAAA;AAAA,MACA,aAAa,GAAA,CAAI,WAAA;AAAA,MACjB,cAAc,GAAA,CAAI,MAAA;AAAA;AAAA;AAAA,MAGlB,GAAI,GAAA,CAAI,KAAA,KAAU,MAAA,IAAa,GAAA,CAAI,KAAA,KAAU,SAAA,GAAY,EAAE,KAAA,EAAO,GAAA,CAAI,KAAA,EAAM,GAAI,EAAC;AAAA,MACjF,GAAI,IAAI,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,EAAS,GAAA,CAAI,OAAA,EAAQ,GAAI,EAAC;AAAA,MAC5D,KAAA,EAAO,CAAC,GAAG,UAAU;AAAA,KACtB,CAAA;AAAA,EACH,CAAC,CAAA;AACH","file":"chunk-CFE6QF2Q.js","sourcesContent":["/**\n * #364 — how deep the current delegation chain already is, delivered through the CALL.\n *\n * ## The bug this replaces\n *\n * `maxDelegationDepth` was checked once, at tool-CONSTRUCTION time, against a `_parentDepth`\n * argument that nothing in the SDK ever incremented. Constructing a tool says nothing about how\n * deep it will later be invoked, so with the documented call — `SubAgent.create(spec)` — the test\n * was `1 > maxDepth`, false for every spec that did not ask for depth 0. A subagent whose tools\n * include another subagent recursed unbounded, which is precisely what the guard exists to stop.\n * The only path that ever tripped it was a caller threading the number by hand.\n *\n * ## Why the async scope closes it\n *\n * Depth is a property of the RUN, not of the object. A child's run loop — and therefore every tool\n * it dispatches — executes inside the async continuation of its parent's handler, so a value\n * published on that context is exactly what a nested dispatch needs to read. This is the same seam\n * `subagent-credentials.ts` uses, and for the same reason: what survives every layer that rebuilds\n * a tool object is the call, never the object.\n *\n * It is kept in its own module rather than folded into the credentials payload because depth is a\n * separate concern with a separate lifetime — the credentials scope is opened once per run by the\n * run loop, while depth is opened per delegation by the dispatching tool.\n *\n * @internal\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\n\nconst depthStore = new AsyncLocalStorage<number>();\n\n/**\n * Run `fn` with `depth` published as the delegation depth of the current chain.\n *\n * Nested scopes shadow the outer one and the outer is restored on return, so two sibling\n * delegations from the same parent each start from the parent's depth rather than from each\n * other's.\n *\n * @internal\n */\nexport async function withDelegationDepth<T>(depth: number, fn: () => Promise<T>): Promise<T> {\n  return depthStore.run(depth, fn);\n}\n\n/**\n * The delegation depth of the current chain — `0` outside any delegation.\n *\n * `0` is the honest default rather than a fallback to some previous chain's value: a subagent\n * dispatched with no parent delegation IS at depth zero.\n *\n * @internal\n */\nexport function currentDelegationDepth(): number {\n  return depthStore.getStore() ?? 0;\n}\n","/**\n * theokit#148 — the parent's credentials, delivered through the CALL, not through the tool object.\n *\n * ## The class of bug this replaces\n *\n * Credential inheritance used to ride a property installed on the subagent tool object — first a\n * unique `Symbol()`, then `Symbol.for` after #143. Both are the same shape of contract: \"this\n * object will reach the dispatcher with an extra property intact\". Nothing enforces that, and it\n * broke twice for two different reasons:\n *\n *  - **Module duplication** (#142/#143): `tsup splitting: false` inlined a separate copy of the\n *    module into each public entry, so the two copies disagreed on a unique `Symbol()` key. Fixed at\n *    the build level by M78's `splitting: true`, but the fragile contract remained.\n *  - **Object normalization** (#148): any layer that rebuilds the tool from its known fields drops\n *    the property. `@theokit/agents`' `toCompiledTool` does exactly that, and had to add an explicit\n *    `Object.getOwnPropertySymbols` copy loop to compensate — a band-aid the SDK's contract forced\n *    onto a consumer. A named field would have been dropped by the same four-field rebuild, which is\n *    why \"make it a typed field\" alone does not close this.\n *\n * ## Why the async scope closes it\n *\n * What survives a rebuild is not the object — it is the CALL. A normalizing wrapper builds a new\n * object but still invokes the original handler, inside the parent run's async context. So\n * credentials published on that context reach the handler regardless of what the tool object looks\n * like by then. There is no property left for a layer to drop.\n *\n * It also fixes a defect the per-object slot could not: credentials were stored per tool INSTANCE,\n * so one subagent tool shared by two agents got last-writer-wins. The scope is per run.\n *\n * Nothing is exposed to third-party tool code: the store is module-private, credentials never touch\n * a handler's `ctx`, and `currentInheritedSubAgentCredentials` is `@internal`.\n *\n * @internal\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\n// The PUBLIC, validated shapes — `CompatSource`, not the loose `CompatSourceDeclaration` the\n// internal loader accepts. What travels here is what the parent already resolved, so it is typed\n// against the option it came from and the option it is handed to. Typing it loosely and casting at\n// the destination would hide exactly the mismatch the compiler caught on the first attempt.\nimport type { BuiltinToolName, CompatSource, SettingSource } from \"../../types/agent.js\";\nimport type { ModelSelection } from \"../../types/agent-prims.js\";\nimport type { Plugin } from \"../plugins/types.js\";\n\n/**\n * Credentials a parent agent hands down to its subagent tools so the child inherits the parent's\n * auth (and, absent an explicit `spec.model`, its model).\n *\n * Declared here rather than in `a2a/subagent.ts` so the delivery mechanism owns the payload shape\n * and the dependency runs one way (`a2a/subagent` -> this module). `a2a/subagent.ts` briefly\n * re-exported it \"for back-compat\"; knip proved there was no back-compat surface to preserve — the\n * type was never in the public barrel nor the exports map — so the re-export was deleted.\n *\n * Emitted rather than erased: `a2a/subagent.d.ts` imports it by name, and that entry IS published,\n * so erasing this declaration ships a `.d.ts` that does not compile. Not being in the exports map\n * is what keeps it out of the semver contract; erasure is not what does that.\n */\nexport interface InheritedCredentials {\n  readonly apiKey?: string;\n  readonly model?: ModelSelection;\n  /**\n   * The parent's shell-sandbox posture (`local.sandboxOptions.enabled`), handed down so a delegated\n   * child of a sandboxed parent stays sandboxed unless its role explicitly opts out. Without this a\n   * child ran unsandboxed whenever its role omitted `sandbox` — a default-open the sandbox wiring\n   * exists to prevent.\n   */\n  readonly sandbox?: boolean;\n  /**\n   * #55 — the parent's code-registered plugins (e.g. a `PermissionPlugin`) handed down so the child\n   * runs under the SAME policy. Without this, a delegated child's inner tool calls escape the\n   * parent's argument-level permission gate. First-party delegation path only — never exposed to\n   * third-party tool `ctx`.\n   */\n  readonly plugins?: readonly Plugin[];\n  /**\n   * #578 — the parent's RESOLVED `local.settingSources` / `local.compatSources`, handed down so a\n   * delegated child can see the configuration surfaces its parent was declared to read.\n   *\n   * `compatSources` arrived with #524 and neither carrier was updated, so a parent declaring\n   * `compatSources: [\"claude-code\"]` read `.claude/agents/` and its child did not: a team could\n   * delegate TO a role by name and the child could not resolve the rest of the team.\n   *\n   * ## Why inheriting is safe here, unlike widening\n   *\n   * Every other field on this interface hands DOWN a restriction (the sandbox posture, the\n   * permission plugins) and the danger is a child escaping it. These two are the mirror image: the\n   * child is currently MORE restricted than its parent, so the failure is a missing capability\n   * rather than an open door. Inheritance cannot widen — the child receives what the parent already\n   * resolved, and it runs in the parent's cwd, so it reads no directory the parent could not.\n   *\n   * A role's explicit value still wins; these are the fallback, exactly as `model` and `sandbox` are.\n   */\n  readonly settingSources?: readonly SettingSource[];\n  /** @see {@link InheritedCredentials.settingSources} — carried together, same reasoning. */\n  readonly compatSources?: readonly CompatSource[];\n  /**\n   * #580 — the builtin tools the parent removed from its catalog, handed down so a delegated child\n   * cannot recover one its parent revoked.\n   *\n   * This is the third field here that hands down a RESTRICTION, and it was the one that crossed no\n   * carrier at all: measured, a parent with `withheldBuiltinTools: [\"shell\"]` produced a child whose\n   * value was `undefined`, so the child got the shell back. Delegation widened authority the operator\n   * had revoked — the inverse of #578 and materially worse, because there the child was merely\n   * over-restricted.\n   *\n   * It bites because of a documented default (`types/agent.ts` § LocalOptions): a `shell` tool is\n   * ALWAYS registered on a local agent, including when `tools: []` is passed. Withholding is the only\n   * mechanism that removes it, so a withholding that does not survive delegation leaves no other way\n   * for a child to be without a shell.\n   *\n   * ## The union rule\n   *\n   * A child's own list is UNIONED with this one, never substituted for it — see\n   * {@link buildChildWithheldBuiltins}. Every other field on this interface lets the role's own value\n   * win, and copying that here would let a child un-withhold what its parent revoked: the bug,\n   * reintroduced by its own fix.\n   */\n  readonly withheldBuiltinTools?: readonly BuiltinToolName[];\n}\n\nconst credentialsStore = new AsyncLocalStorage<InheritedCredentials>();\n\n/**\n * Run `fn` with `credentials` published as the delegation credentials of the current run.\n *\n * Nested scopes shadow the outer one and the outer is restored on return, so a delegated child that\n * itself delegates hands down ITS credentials, not its parent's.\n *\n * @internal\n */\nexport async function withInheritedSubAgentCredentials<T>(\n  credentials: InheritedCredentials,\n  fn: () => Promise<T>,\n): Promise<T> {\n  return credentialsStore.run(credentials, fn);\n}\n\n/**\n * The delegation credentials of the current run, or `undefined` outside a run scope.\n *\n * `undefined` is deliberately NOT a fallback to some previous run's value: a subagent dispatched\n * with no parent context must create its child without an inherited key rather than reuse a\n * credential that belonged to someone else.\n *\n * @internal\n */\nexport function currentInheritedSubAgentCredentials(): InheritedCredentials | undefined {\n  return credentialsStore.getStore();\n}\n","/**\n * Subagent delegation — declarative child agent invocable as a tool.\n *\n * Per ADR D2: `defineSubAgent(spec)` returns a `CustomTool` that, when\n * invoked by the LLM, creates a child agent and sends the input as a\n * message. EC-2: delegation depth is tracked across the RUN (#364) — each\n * delegation publishes its depth on the async scope its child executes in, so a\n * subagent that delegates to a subagent is bounded by `maxDelegationDepth`\n * without the caller threading a counter by hand.\n *\n * SE10 — the handler forwards the parent run's `AbortSignal` to the child.\n * SE11 — optional `onDelegationStart` / `onDelegationComplete` lifecycle hooks\n * let the caller reject, rewrite, observe, or annotate a delegation.\n *\n * @public\n */\n\nimport { z } from \"zod\";\nimport { TheokitAgentError } from \"../errors.js\";\nimport {\n  currentDelegationDepth,\n  withDelegationDepth,\n} from \"../internal/concurrency/delegation-depth.js\";\nimport {\n  currentInheritedSubAgentCredentials,\n  type InheritedCredentials,\n} from \"../internal/concurrency/subagent-credentials.js\";\nimport { getAgentFacade } from \"../internal/runtime/registry/agent-factory-registry.js\";\nimport type {\n  AgentDefinition,\n  AgentOptions,\n  BuiltinToolName,\n  CustomTool,\n  ToolContextMessage,\n} from \"../types/agent.js\";\nimport type { ModelSelection } from \"../types/agent-prims.js\";\nimport type { Run } from \"../types/run.js\";\n\n/** Arguments passed to {@link SubAgentSpec.messageFilter} (SE12). */\nexport interface MessageFilterArgs {\n  /** The supervisor transcript (read-only text projection) available to this delegation. */\n  messages: readonly ToolContextMessage[];\n  /** The prompt about to be delegated (after any `onDelegationStart` rewrite). */\n  input: string;\n  /** The subagent's name. */\n  name: string;\n}\n\n/** Context passed to {@link SubAgentSpec.onDelegationStart} before the child runs. */\nexport interface DelegationStartContext {\n  input: string;\n  name: string;\n  /**\n   * SE15 — 1-based count of times THIS subagent tool has been invoked (a\n   * per-`defineSubAgent`-instance counter). Incremented before this hook runs;\n   * a rejected delegation still counts. Enables reject-after-N patterns.\n   */\n  iteration: number;\n}\n\n/**\n * Decision returned from {@link SubAgentSpec.onDelegationStart}. Discriminated on\n * `proceed` so a rejection (`proceed: false` + `rejectionReason`) and an approval\n * (`modifiedInput`) cannot be mixed into one nonsensical object.\n */\nexport type DelegationStartDecision =\n  | { proceed: false; rejectionReason?: string }\n  | {\n      proceed?: true;\n      modifiedInput?: string;\n      /** SE13 — cap the child's iteration count (forwarded as `SendOptions.maxIterations`). */\n      modifiedMaxSteps?: number;\n    };\n\n/** Context passed to {@link SubAgentSpec.onDelegationComplete} after the child settles. */\nexport interface DelegationCompleteContext {\n  input: string;\n  name: string;\n  /** The child's text result (present on success). */\n  result?: string;\n  /** The error the child threw (present on failure); the error is still re-thrown. */\n  error?: unknown;\n  /** SE15 — the same 1-based iteration this delegation's `onDelegationStart` saw. */\n  iteration: number;\n}\n\n/**\n * The return of a delegation hook: a decision, a promise of one, or nothing —\n * `void` lets a side-effect-only callback (`(ctx) => { log(ctx) }`) type-check,\n * which is the common case (mirrors a peer framework's `async ctx => { ... }` hooks).\n */\n// biome-ignore lint/suspicious/noConfusingVoidType: `void` is the idiomatic return for an optional-return callback; the rule false-positives on callback return unions.\ntype DelegationHookResult<T> = T | void | Promise<T | void>;\n\n/** Decision returned from {@link SubAgentSpec.onDelegationComplete}. */\nexport interface DelegationCompleteDecision {\n  /** Appended to the child's result string. */\n  feedback?: string;\n}\n\n/**\n * The declaration of a delegating child agent, handed to `SubAgent.create(spec)`.\n *\n * `name`, `description` and `instructions` are the only required fields: the first\n * two become the tool the supervisor's model sees, the third becomes the child's\n * system prompt. Everything else narrows what the child inherits.\n *\n *   const research = SubAgent.create({\n *     name: \"research\",\n *     description: \"Look a fact up\",\n *     instructions: \"You answer with one sentence.\",\n *   });\n *   const agent = await Agent.create({ tools: [research] });\n *\n * The tool's own input schema is fixed — one required string property, `input`.\n * It is not derived from this spec and cannot be widened here.\n *\n * What the child inherits from the parent AT DISPATCH TIME, not from this object:\n * the API key, the model (unless `model` is set), the parent's plugins, and the\n * parent's sandbox posture (unless `sandbox` is set). An absent `sandbox` inherits;\n * an explicit `sandbox: false` turns confinement OFF for a child of a confined\n * parent, which is not the same thing.\n *\n * How it fails: the child's failure is re-thrown to the supervisor as a tool error\n * — a run ending in `status: \"error\"` becomes\n * `subagent \"<name>\" run failed: <cause>`. `onDelegationStart` and `messageFilter`\n * propagate their own throws; only a throw from `onDelegationComplete` ON THE\n * ERROR PATH is suppressed, so it cannot mask the real cause.\n *\n * Traps:\n *  - `model` as a bare string drops reasoning parameters. Pass the\n *    {@link ModelSelection} object form when the child needs `params`.\n *  - `maxDelegationDepth` (default 3) bounds the delegation CHAIN, counted at\n *    dispatch across the run (#364) — the depth is not something you thread. The\n *    `parentDepth` argument of `SubAgent.create` still offsets it, for a supervisor\n *    that wants a lower ceiling than the chain it sits in.\n *  - Context isolation is the DEFAULT. Without `messageFilter` the child sees only\n *    the delegated string; without `includeToolResults` the supervisor gets only\n *    the child's final text.\n */\nexport interface SubAgentSpec {\n  name: string;\n  description: string;\n  instructions: string;\n  /**\n   * A bare id string (back-compat) OR a full {@link ModelSelection} carrying\n   * `params` (e.g. `[{ id: \"thinking\", value: \"low\" }]` for reasoning effort). The\n   * object form is required for per-subagent reasoning effort to survive to the child\n   * — the pre-M33 path took only `.id` and dropped params.\n   */\n  model?: string | ModelSelection;\n  tools?: CustomTool[];\n  /** Per-subagent shell sandbox toggle (M33). `true` ⇒ child `local.sandboxOptions.enabled`. */\n  sandbox?: boolean;\n  /**\n   * #580 — builtin tools this role removes from its child's catalog, UNIONED with whatever the\n   * parent already withheld.\n   *\n   * A role declared read-only in prose is not read-only: a `shell` tool is always registered on a\n   * local agent, including when `tools: []` is passed, so withholding is the only mechanism that\n   * removes it — and until #580 a spec could not ask for it and a parent's withholding did not\n   * survive delegation either.\n   *\n   * ## Union, not override — and this is the one field here that works that way\n   *\n   * `model` and `sandbox` let the role's own value WIN, including `sandbox: false` turning\n   * confinement off for a child of a confined parent. That asymmetry is deliberate: a posture is\n   * declared, whereas withholding removes a capability from the catalog. Letting a role override a\n   * withholding would let a child recover a tool its parent revoked, which is the defect #580\n   * reports — so a child may only ever ADD to the set.\n   */\n  withheldBuiltinTools?: readonly BuiltinToolName[];\n  /**\n   * Maximum length of the delegation CHAIN rooted at this tool, counted at dispatch\n   * (default 3). Depth 1 is this subagent; a subagent it delegates to is depth 2.\n   * Exceeding it throws {@link MaxDelegationDepthError} from the tool handler.\n   */\n  maxDelegationDepth?: number;\n  /**\n   * SE11 — called before the supervisor delegates. Return `{ proceed: false }`\n   * to reject (the child never runs and `rejectionReason` becomes the tool\n   * result), or `{ modifiedInput }` to rewrite the delegated prompt. A throwing\n   * hook surfaces (never silently swallowed).\n   */\n  onDelegationStart?: (\n    ctx: DelegationStartContext,\n  ) => DelegationHookResult<DelegationStartDecision>;\n  /**\n   * SE11 — called after the delegation settles. On success `ctx.result` is set\n   * and an optional `{ feedback }` is appended to it. On failure `ctx.error` is\n   * set and the original error is ALWAYS re-thrown after this hook runs — a throw\n   * from this hook on the error path is suppressed so it cannot mask the\n   * delegation's real failure (on the success path a throw does propagate).\n   */\n  onDelegationComplete?: (\n    ctx: DelegationCompleteContext,\n  ) => DelegationHookResult<DelegationCompleteDecision>;\n  /**\n   * SE12 — opt-in parent-context forwarding. When set, the supervisor transcript\n   * (`ctx.messages`, a read-only text projection) is passed to this filter and the\n   * returned subset is forwarded to the child as a role-tagged context preamble\n   * prepended to the delegated input. When ABSENT the child runs input-only —\n   * memory isolation stays the default. A filter returning `[]` forwards nothing.\n   * A throwing filter propagates (fail-fast, never swallowed — same contract as\n   * `onDelegationStart`); the delegation surfaces as a tool error.\n   */\n  messageFilter?: (args: MessageFilterArgs) => readonly ToolContextMessage[];\n  /**\n   * SE14 — opt-in subagent result-context control. When `true`, the child's\n   * completed tool-call results (name + result) are appended to the delegation\n   * payload returned to the supervisor, inside a `<subagent-tool-results>` block.\n   * When absent/`false` the delegation returns the child's final text only —\n   * text-only stays the default (a peer framework's scoped posture). See ADR 0006.\n   */\n  includeToolResults?: boolean;\n}\n\n/**\n * Raised by `SubAgent.create(spec, parentDepth)` when `parentDepth + 1` exceeds\n * `spec.maxDelegationDepth` (default 3). Carries `currentDepth`, `maxDepth` and a\n * stable `code: \"max_delegation_depth\"`.\n *\n * Thrown from the subagent tool's handler when a delegation would exceed\n * `maxDelegationDepth` (default 3), so it surfaces as the tool call's failure —\n * catching it around the dispatching `agent.send()` works.\n *\n * Also thrown eagerly at TOOL-CONSTRUCTION time when a caller threads its own\n * `parentDepth` that is already past the limit; such a tool could never be\n * dispatched, so refusing to build it fails earlier and clearer.\n *\n * Before #364 the construction-time check was the ONLY one, against a depth\n * nothing in the SDK incremented — so under the documented `SubAgent.create(spec)`\n * call this error could not fire at all and nested delegation was unbounded. The\n * chain length now travels with the run (`internal/runtime/concurrency/delegation-depth.ts`),\n * and a caller-threaded `parentDepth` still adds to it.\n */\nexport class MaxDelegationDepthError extends TheokitAgentError {\n  override readonly name = \"MaxDelegationDepthError\";\n  override readonly code = \"max_delegation_depth\" as const;\n  constructor(\n    public readonly currentDepth: number,\n    public readonly maxDepth: number,\n  ) {\n    // Not retryable: the depth is a property of the call graph, and it is the same on a retry.\n    super(`Max delegation depth ${maxDepth} exceeded (current: ${currentDepth})`, {\n      code: \"max_delegation_depth\",\n      isRetryable: false,\n    });\n  }\n}\n\n/**\n * Run the `onDelegationStart` hook; returns either a rejection or the (possibly\n * rewritten) input plus the optional SE13 `maxSteps` cap.\n */\nasync function applyDelegationStart(\n  spec: SubAgentSpec,\n  input: string,\n  iteration: number,\n): Promise<{ reject: string } | { input: string; maxSteps?: number }> {\n  if (spec.onDelegationStart === undefined) return { input };\n  const decision = await spec.onDelegationStart({ input, name: spec.name, iteration });\n  if (decision === undefined) return { input };\n  if (decision.proceed === false)\n    return { reject: decision.rejectionReason ?? \"(delegation rejected)\" };\n  return {\n    input: decision.modifiedInput ?? input,\n    ...(decision.modifiedMaxSteps !== undefined ? { maxSteps: decision.modifiedMaxSteps } : {}),\n  };\n}\n\n/**\n * SE14 — replay the child run's stream (a safe post-`wait()` idiom — the run buffers\n * events, `stream()` replays them) and collect every completed tool-call result into\n * a delimited block. Returns `\"\"` when the child ran no completed tool calls. See ADR 0006.\n */\nasync function collectChildToolResults(run: Run): Promise<string> {\n  const lines: string[] = [];\n  for await (const event of run.stream()) {\n    if (event.type === \"tool_call\" && event.status === \"completed\") {\n      const rendered =\n        typeof event.result === \"string\" ? event.result : JSON.stringify(event.result ?? null);\n      lines.push(`${event.name}: ${rendered}`);\n    }\n  }\n  if (lines.length === 0) return \"\";\n  return `\\n\\n<subagent-tool-results>\\n${lines.join(\"\\n\")}\\n</subagent-tool-results>`;\n}\n\n/**\n * The child's `local` slice, accumulated ONCE from all three contributors — or `undefined` when the\n * parent declared none of them, so the pre-#578 shape (no `local` key at all) is preserved.\n *\n * #578 — this exists as a function rather than three spreads in the return, and the reason is a\n * hazard rather than tidiness. `local` is a single object: the old code wrote it whole from the\n * sandbox posture alone, so adding a second `...{ local: … }` spread beside it would have silently\n * DROPPED that posture — turning a missing-capability bug into a default-open one, which is the\n * wrong direction to trade. One accumulator makes that collision impossible to reintroduce.\n *\n * The configuration surfaces are the parent's RESOLVED values. Inheriting cannot widen: the child\n * receives what the parent already resolved and runs in the parent's cwd, so it reads no directory\n * the parent could not. Without this, a parent declaring `compatSources: [\"claude-code\"]` saw\n * `.claude/agents/` and its child did not — a team could delegate TO a role by name while the child\n * could not resolve the rest of the team.\n */\nfunction buildChildLocalOptions(\n  sandbox: boolean | undefined,\n  inherited: InheritedCredentials | undefined,\n): AgentOptions[\"local\"] | undefined {\n  const local: NonNullable<AgentOptions[\"local\"]> = {};\n  if (sandbox !== undefined) local.sandboxOptions = { enabled: sandbox };\n  if (inherited?.settingSources !== undefined) local.settingSources = [...inherited.settingSources];\n  if (inherited?.compatSources !== undefined) local.compatSources = [...inherited.compatSources];\n  return Object.keys(local).length > 0 ? local : undefined;\n}\n\n/**\n * The builtins withheld from the child: the UNION of the parent's set and the role's own — or\n * `undefined` when neither withheld anything.\n *\n * #580 — union rather than override, and that is the security property rather than a preference.\n * The role's own value wins for `model` and for `sandbox`; copying that here would let a child\n * un-withhold what its parent revoked, which is the defect being fixed, reintroduced by its own fix.\n * **A restriction may be tightened by a child and never loosened.** So `withheldBuiltinTools: []` on\n * a role subtracts nothing — it is an empty contribution to a union, not a reset.\n */\nfunction buildChildWithheldBuiltins(\n  spec: SubAgentSpec,\n  inherited: InheritedCredentials | undefined,\n): readonly BuiltinToolName[] | undefined {\n  const own = spec.withheldBuiltinTools;\n  const parent = inherited?.withheldBuiltinTools;\n  if (own === undefined && parent === undefined) return undefined;\n  return [...new Set([...(parent ?? []), ...(own ?? [])])];\n}\n\n/**\n * Build the child agent's `Agent.create` options: the child inherits the parent's\n * apiKey (else `Agent.create` throws \"Missing API key\"), its model (unless the spec\n * overrides it), — #55 — the parent's plugins (permission gate/guards) so the\n * child's inner tool calls run under the same policy, and — #578 — the configuration\n * surfaces the parent was declared to read (see {@link buildChildLocalOptions}).\n */\nexport function buildChildCreateOptions(\n  spec: SubAgentSpec,\n  inherited: InheritedCredentials | undefined,\n): AgentOptions {\n  // M33 — carry the WHOLE model (a bare id becomes `{ id }`; a ModelSelection with\n  // `params` keeps its reasoning effort). The pre-M33 path wrapped `spec.model` as\n  // `{ id: spec.model }`, which only worked because spec.model was a string and\n  // silently dropped reasoning params.\n  const model: string | ModelSelection | undefined =\n    spec.model !== undefined\n      ? typeof spec.model === \"string\"\n        ? { id: spec.model }\n        : spec.model\n      : inherited?.model;\n  // M33 — the role's own `sandbox` wins; when it omits the field, inherit the parent's posture. A role's\n  // explicit `sandbox: false` therefore confines-OFF a child of a sandboxed parent (distinct from absent).\n  const sandbox = spec.sandbox ?? inherited?.sandbox;\n  const local = buildChildLocalOptions(sandbox, inherited);\n  const withheld = buildChildWithheldBuiltins(spec, inherited);\n  return {\n    ...(inherited?.apiKey !== undefined ? { apiKey: inherited.apiKey } : {}),\n    ...(model !== undefined ? { model } : {}),\n    ...(local !== undefined ? { local } : {}),\n    ...(withheld !== undefined ? { withheldBuiltinTools: withheld } : {}),\n    ...(inherited?.plugins !== undefined ? { plugins: inherited.plugins } : {}),\n    systemPrompt: spec.instructions,\n    tools: spec.tools ?? [],\n  };\n}\n\n/**\n * Create the transient child agent and send the input, composing every forwarded\n * `SendOptions` onto ONE `send` call — SE10 `signal` + SE13 `maxIterations`. Absent\n * every option ⇒ the pre-SE10 single-arg `send(input)` shape. SE14 — when\n * `includeToolResults` is set, append the child's completed tool results. Dispose in `finally`.\n */\nasync function runChildAgent(\n  spec: SubAgentSpec,\n  input: string,\n  signal: AbortSignal | undefined,\n  maxSteps: number | undefined,\n  inherited: InheritedCredentials | undefined,\n  depth: number,\n): Promise<string> {\n  // #364 — publish THIS delegation's depth for the whole child run. The child's loop, and every\n  // tool it dispatches, runs inside this scope, so a nested subagent reads the real chain length\n  // instead of the 0 every construction-time check saw.\n  return withDelegationDepth(depth, () =>\n    runChildAgentInScope(spec, input, signal, maxSteps, inherited),\n  );\n}\n\nasync function runChildAgentInScope(\n  spec: SubAgentSpec,\n  input: string,\n  signal: AbortSignal | undefined,\n  maxSteps: number | undefined,\n  inherited: InheritedCredentials | undefined,\n): Promise<string> {\n  // SE45 cycle 3 — use the registered Agent facade via the DIP seam\n  // (agent-factory-registry) instead of a dynamic `import(\"../agent.js\")`.\n  // This removes the last madge cycle (a2a/subagent -> agent -> ... -> real-local-run-tools\n  // -> a2a/subagent): the facade registers itself at module-init via setAgentFacade,\n  // so subagent depends only on the registry port, never on the facade module.\n  const agent = await getAgentFacade().create(buildChildCreateOptions(spec, inherited));\n  try {\n    const sendOptions: {\n      signal?: AbortSignal;\n      maxIterations?: number;\n      origin?: import(\"../types/run.js\").MessageOrigin;\n    } = {\n      ...(signal !== undefined ? { signal } : {}),\n      ...(maxSteps !== undefined ? { maxIterations: maxSteps } : {}),\n      // SE3 — a delegated child's turn is initiated by the coordinating parent.\n      origin: { kind: \"coordinator\" },\n    };\n    const run = await agent.send(input, sendOptions);\n    const result = await run.wait();\n    // Fail-fast, don't swallow (Rule 8): a child that ended in error must surface — otherwise a real\n    // failure (e.g. `provider_unresolved`) is hidden behind \"(no response)\" and the parent loops on it.\n    if (result.status === \"error\") {\n      const cause = (result as { error?: { message?: string } }).error;\n      throw new Error(\n        `subagent \"${spec.name}\" run failed: ${cause?.message ?? \"unknown error\"}`,\n        cause !== undefined ? { cause } : undefined,\n      );\n    }\n    const text = result.result ?? \"(no response)\";\n    // SE14 — text-only by default; opt-in appends the child's tool results.\n    return spec.includeToolResults === true ? text + (await collectChildToolResults(run)) : text;\n  } finally {\n    agent.dispose();\n  }\n}\n\n/**\n * Best-effort error-path notification: run `onDelegationComplete` with the child's\n * error so the caller can observe the failure. The observer's own throw (sync or\n * async) is suppressed here so it cannot mask the delegation's real error, which the\n * handler re-throws next.\n */\nasync function notifyDelegationError(\n  spec: SubAgentSpec,\n  input: string,\n  error: unknown,\n  iteration: number,\n): Promise<void> {\n  if (spec.onDelegationComplete === undefined) return;\n  try {\n    await spec.onDelegationComplete({ input, name: spec.name, error, iteration });\n  } catch {\n    // Subordinate to `error`; the child's real cause wins.\n  }\n}\n\n/**\n * SE12 — apply `messageFilter` (if set) and prepend the filtered supervisor\n * transcript to the delegated input as a role-tagged context preamble. Absent\n * filter OR no messages OR an empty filtered subset ⇒ the original input\n * (isolation-by-default preserved).\n */\nfunction applyMessageFilter(\n  spec: SubAgentSpec,\n  input: string,\n  messages: readonly ToolContextMessage[] | undefined,\n): string {\n  if (spec.messageFilter === undefined || messages === undefined) return input;\n  const filtered = spec.messageFilter({ messages, input, name: spec.name });\n  if (filtered.length === 0) return input;\n  const preamble = filtered.map((m) => `${m.role}: ${m.content}`).join(\"\\n\");\n  return `Prior conversation:\\n${preamble}\\n\\nTask:\\n${input}`;\n}\n\n/** Run the success-path `onDelegationComplete` hook; appends its `feedback` to the result. */\nasync function applyDelegationComplete(\n  spec: SubAgentSpec,\n  input: string,\n  result: string,\n  iteration: number,\n): Promise<string> {\n  if (spec.onDelegationComplete === undefined) return result;\n  const completion = await spec.onDelegationComplete({ input, name: spec.name, result, iteration });\n  return completion?.feedback !== undefined ? result + completion.feedback : result;\n}\n\nfunction defineSubAgent(spec: SubAgentSpec, _parentDepth = 0): CustomTool {\n  const maxDepth = spec.maxDelegationDepth ?? 3;\n\n  // A caller that threads its own depth still gets the eager failure it always got: a spec that is\n  // already too deep to ever be dispatchable is worth refusing at construction. What this check\n  // CANNOT see is the runtime chain — constructing a tool says nothing about how deep it will later\n  // be invoked — which is why the guard that actually bounds recursion lives at dispatch (#364).\n  if (_parentDepth + 1 > maxDepth) {\n    throw new MaxDelegationDepthError(_parentDepth + 1, maxDepth);\n  }\n\n  // Zod for RUNTIME validation of the tool_use input …\n  const inputZod = z.object({\n    input: z.string().describe(\"Task for the subagent\"),\n  });\n  // … and a real Draft-7 JSON Schema for the LLM. `CustomTool.inputSchema` is sent\n  // to the model verbatim; a raw Zod object would serialize to garbage, so the\n  // model emits malformed input that fails `inputZod.parse` and the delegation\n  // never runs (the previous bug — the schema and the validator are now distinct).\n  const inputSchema: Record<string, unknown> = {\n    type: \"object\",\n    properties: {\n      input: { type: \"string\", description: \"Task for the subagent\" },\n    },\n    required: [\"input\"],\n    additionalProperties: false,\n  };\n\n  // SE15 — per-instance delegation counter, surfaced as `iteration` on the hook\n  // contexts. Incremented once per handler invocation before onDelegationStart.\n  let iteration = 0;\n\n  const tool: CustomTool = {\n    name: spec.name,\n    description: spec.description,\n    inputSchema,\n    handler: async (\n      rawInput: Record<string, unknown>,\n      ctx?: {\n        signal?: AbortSignal;\n        context?: unknown;\n        messages?: readonly ToolContextMessage[];\n      },\n    ): Promise<string> => {\n      const { input: parsed } = inputZod.parse(rawInput);\n      // theokit#148 — read the parent's credentials from the RUN's async scope, at dispatch time.\n      // They used to be stashed on this tool object by the runtime, which meant any layer that\n      // rebuilt the object (e.g. `@theokit/agents`' `toCompiledTool`) silently dropped them and the\n      // child failed with `provider_unresolved`. The scope travels with the call, so nothing about\n      // the object's shape matters — and two concurrent runs sharing one tool each read their own.\n      const inherited = currentInheritedSubAgentCredentials();\n      // #364 — the real bound. `currentDelegationDepth()` is the length of the chain that led here,\n      // published by each ancestor's `runChildAgent`; a caller-threaded `_parentDepth` still adds to\n      // it, so the pre-#364 hand-threaded behaviour is unchanged when the ambient depth is 0.\n      const currentDepth = _parentDepth + currentDelegationDepth() + 1;\n      if (currentDepth > maxDepth) {\n        throw new MaxDelegationDepthError(currentDepth, maxDepth);\n      }\n      iteration += 1; // SE15 — before onDelegationStart; a rejected delegation still counts.\n      // Pin THIS invocation's iteration before any await so a concurrent invocation\n      // bumping the shared counter cannot change the value onDelegationComplete /\n      // notifyDelegationError observe — they see the same iteration onDelegationStart did.\n      const capturedIteration = iteration;\n\n      const start = await applyDelegationStart(spec, parsed, capturedIteration);\n      if (\"reject\" in start) return start.reject;\n      // SE12 — opt-in: forward the filtered supervisor transcript as a preamble.\n      const input = applyMessageFilter(spec, start.input, ctx?.messages);\n\n      let result: string;\n      try {\n        // SE13 — apply the optional onDelegationStart maxSteps cap on the child send.\n        result = await runChildAgent(\n          spec,\n          input,\n          ctx?.signal,\n          start.maxSteps,\n          inherited,\n          currentDepth,\n        );\n      } catch (error) {\n        // SE11 — notify the completion hook of the failure (best-effort observer),\n        // then re-throw the ORIGINAL error (Rule 8: never swallow the delegation's\n        // own failure).\n        await notifyDelegationError(spec, input, error, capturedIteration);\n        throw error;\n      }\n      return applyDelegationComplete(spec, input, result, capturedIteration);\n    },\n  };\n\n  // theokit#148 — nothing is installed on the tool. The credentials arrive through the run's async\n  // scope (see `internal/runtime/concurrency/subagent-credentials.ts`), so there is no extra\n  // property for a normalizing layer to drop.\n  return tool;\n}\n\n/** SE36 — `SubAgent.create` replaces `defineSubAgent` (ADR 0015). @public  *\n * `SubAgent.create` returns a **`CustomTool`** — the sub-agent is exposed to the\n * parent as a callable tool, not as a `SubAgent` instance.\n */\nexport class SubAgent {\n  private constructor() {}\n  static create(spec: SubAgentSpec, parentDepth = 0): CustomTool {\n    return defineSubAgent(spec, parentDepth);\n  }\n}\n\n/**\n * Convert a parent's declarative `agents` map ({@link AgentDefinition} per key)\n * into delegation tools for the LOCAL runtime — the counterpart of the\n * cloud/fixture subagent wiring. Each child inherits the parent's `apiKey`/model\n * from the CALL, not from the tool object: `inheritSubAgentCredentials` used to\n * attach them to the tool, and any layer that rebuilt that object dropped them —\n * including the SDK's own rebuild (theokit#148). Credentials now ride the\n * dispatch, so a rebuilt tool cannot lose them. `def.model` overrides the model\n * (`\"inherit\"` keeps the parent's), and `def.tools` scopes the child to that\n * subset of the parent's tools (absent → the parent's full toolset, per the\n * `AgentDefinition.tools` contract).\n *\n * M33 — per-subagent `model` (with reasoning `params`) and `sandbox` are now wired\n * into local delegation: each is carried onto the {@link SubAgentSpec} and applied to\n * the child in {@link buildChildCreateOptions}. `\"inherit\"` (or an absent field) keeps\n * the parent's value. Per-subagent `mcp` is rejected at load (see subagents-loader) —\n * resolving server names→config on the local path is a follow-up.\n *\n * @internal\n */\nexport function subAgentToolsFromDefinitions(\n  agents: Record<string, AgentDefinition>,\n  parentTools: readonly CustomTool[],\n): CustomTool[] {\n  return Object.entries(agents).map(([name, def]) => {\n    const whitelist =\n      Array.isArray(def.tools) && def.tools.length > 0 ? new Set(def.tools) : undefined;\n    const childTools = whitelist ? parentTools.filter((t) => whitelist.has(t.name)) : parentTools;\n    return defineSubAgent({\n      name,\n      description: def.description,\n      instructions: def.prompt,\n      // Carry the FULL ModelSelection (id + reasoning params), not just the id, so\n      // per-subagent reasoning effort survives to buildChildCreateOptions.\n      ...(def.model !== undefined && def.model !== \"inherit\" ? { model: def.model } : {}),\n      ...(def.sandbox !== undefined ? { sandbox: def.sandbox } : {}),\n      tools: [...childTools],\n    });\n  });\n}\n"]}
+{"version":3,"sources":["../src/internal/concurrency/delegation-depth.ts","../src/internal/concurrency/subagent-credentials.ts","../src/a2a/subagent.ts"],"names":["AsyncLocalStorage"],"mappings":";;;;;AA6BA,IAAM,UAAA,GAAa,IAAI,iBAAA,EAA0B;AAWjD,eAAsB,mBAAA,CAAuB,OAAe,EAAA,EAAkC;AAC5F,EAAA,OAAO,UAAA,CAAW,GAAA,CAAI,KAAA,EAAO,EAAE,CAAA;AACjC;AAUO,SAAS,sBAAA,GAAiC;AAC/C,EAAA,OAAO,UAAA,CAAW,UAAS,IAAK,CAAA;AAClC;ACkEA,IAAM,gBAAA,GAAmB,IAAIA,iBAAAA,EAAwC;AAUrE,eAAsB,gCAAA,CACpB,aACA,EAAA,EACY;AACZ,EAAA,OAAO,gBAAA,CAAiB,GAAA,CAAI,WAAA,EAAa,EAAE,CAAA;AAC7C;AAWO,SAAS,mCAAA,GAAwE;AACtF,EAAA,OAAO,iBAAiB,QAAA,EAAS;AACnC;;;ACwFO,IAAM,uBAAA,GAAN,cAAsC,iBAAA,CAAkB;AAAA,EAG7D,WAAA,CACkB,cACA,QAAA,EAChB;AAEA,IAAA,KAAA,CAAM,CAAA,qBAAA,EAAwB,QAAQ,CAAA,oBAAA,EAAuB,YAAY,CAAA,CAAA,CAAA,EAAK;AAAA,MAC5E,IAAA,EAAM,sBAAA;AAAA,MACN,WAAA,EAAa;AAAA,KACd,CAAA;AAPe,IAAA,IAAA,CAAA,YAAA,GAAA,YAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAOlB;AAAA,EARkB,YAAA;AAAA,EACA,QAAA;AAAA,EAJA,IAAA,GAAO,yBAAA;AAAA,EACP,IAAA,GAAO,sBAAA;AAW3B;AAMA,eAAe,oBAAA,CACb,IAAA,EACA,KAAA,EACA,SAAA,EACoE;AACpE,EAAA,IAAI,IAAA,CAAK,iBAAA,KAAsB,MAAA,EAAW,OAAO,EAAE,KAAA,EAAM;AACzD,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,iBAAA,CAAkB,EAAE,OAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,SAAA,EAAW,CAAA;AACnF,EAAA,IAAI,QAAA,KAAa,MAAA,EAAW,OAAO,EAAE,KAAA,EAAM;AAC3C,EAAA,IAAI,SAAS,OAAA,KAAY,KAAA;AACvB,IAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,CAAS,eAAA,IAAmB,uBAAA,EAAwB;AACvE,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,SAAS,aAAA,IAAiB,KAAA;AAAA,IACjC,GAAI,SAAS,gBAAA,KAAqB,MAAA,GAAY,EAAE,QAAA,EAAU,QAAA,CAAS,gBAAA,EAAiB,GAAI;AAAC,GAC3F;AACF;AAOA,eAAe,wBAAwB,GAAA,EAA2B;AAChE,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,WAAA,MAAiB,KAAA,IAAS,GAAA,CAAI,MAAA,EAAO,EAAG;AACtC,IAAA,IAAI,KAAA,CAAM,IAAA,KAAS,WAAA,IAAe,KAAA,CAAM,WAAW,WAAA,EAAa;AAC9D,MAAA,MAAM,QAAA,GACJ,OAAO,KAAA,CAAM,MAAA,KAAW,QAAA,GAAW,KAAA,CAAM,MAAA,GAAS,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,MAAA,IAAU,IAAI,CAAA;AACvF,MAAA,KAAA,CAAM,KAAK,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,QAAQ,CAAA,CAAE,CAAA;AAAA,IACzC;AAAA,EACF;AACA,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC/B,EAAA,OAAO;;AAAA;AAAA,EAAgC,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,wBAAA,CAAA;AACzD;AAkBA,SAAS,sBAAA,CACP,SACA,SAAA,EACmC;AACnC,EAAA,MAAM,QAA4C,EAAC;AACnD,EAAA,IAAI,YAAY,MAAA,EAAW,KAAA,CAAM,cAAA,GAAiB,EAAE,SAAS,OAAA,EAAQ;AACrE,EAAA,IAAI,SAAA,EAAW,mBAAmB,MAAA,EAAW,KAAA,CAAM,iBAAiB,CAAC,GAAG,UAAU,cAAc,CAAA;AAChG,EAAA,IAAI,SAAA,EAAW,kBAAkB,MAAA,EAAW,KAAA,CAAM,gBAAgB,CAAC,GAAG,UAAU,aAAa,CAAA;AAC7F,EAAA,OAAO,OAAO,IAAA,CAAK,KAAK,CAAA,CAAE,MAAA,GAAS,IAAI,KAAA,GAAQ,MAAA;AACjD;AAYA,SAAS,0BAAA,CACP,MACA,SAAA,EACwC;AACxC,EAAA,MAAM,MAAM,IAAA,CAAK,oBAAA;AACjB,EAAA,MAAM,SAAS,SAAA,EAAW,oBAAA;AAC1B,EAAA,IAAI,GAAA,KAAQ,MAAA,IAAa,MAAA,KAAW,MAAA,EAAW,OAAO,MAAA;AACtD,EAAA,OAAO,CAAC,mBAAG,IAAI,GAAA,CAAI,CAAC,GAAI,MAAA,IAAU,EAAC,EAAI,GAAI,GAAA,IAAO,EAAG,CAAC,CAAC,CAAA;AACzD;AASO,SAAS,uBAAA,CACd,MACA,SAAA,EACc;AAKd,EAAA,MAAM,KAAA,GACJ,IAAA,CAAK,KAAA,KAAU,MAAA,GACX,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,GACpB,EAAE,IAAI,IAAA,CAAK,KAAA,EAAM,GACjB,IAAA,CAAK,QACP,SAAA,EAAW,KAAA;AAGjB,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,IAAW,SAAA,EAAW,OAAA;AAC3C,EAAA,MAAM,KAAA,GAAQ,sBAAA,CAAuB,OAAA,EAAS,SAAS,CAAA;AACvD,EAAA,MAAM,QAAA,GAAW,0BAAA,CAA2B,IAAA,EAAM,SAAS,CAAA;AAC3D,EAAA,OAAO;AAAA,IACL,GAAI,WAAW,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,SAAA,CAAU,MAAA,EAAO,GAAI,EAAC;AAAA,IACtE,GAAI,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,KAAU,EAAC;AAAA,IACvC,GAAI,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,KAAU,EAAC;AAAA,IACvC,GAAI,QAAA,KAAa,MAAA,GAAY,EAAE,oBAAA,EAAsB,QAAA,KAAa,EAAC;AAAA,IACnE,GAAI,WAAW,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,EAAS,SAAA,CAAU,OAAA,EAAQ,GAAI,EAAC;AAAA,IACzE,cAAc,IAAA,CAAK,YAAA;AAAA,IACnB,KAAA,EAAO,IAAA,CAAK,KAAA,IAAS;AAAC,GACxB;AACF;AAQA,eAAe,cACb,IAAA,EACA,KAAA,EACA,MAAA,EACA,QAAA,EACA,WACA,KAAA,EACiB;AAIjB,EAAA,OAAO,mBAAA;AAAA,IAAoB,KAAA;AAAA,IAAO,MAChC,oBAAA,CAAqB,IAAA,EAAM,KAAA,EAAO,MAAA,EAAQ,UAAU,SAAS;AAAA,GAC/D;AACF;AAEA,eAAe,oBAAA,CACb,IAAA,EACA,KAAA,EACA,MAAA,EACA,UACA,SAAA,EACiB;AAMjB,EAAA,MAAM,KAAA,GAAQ,MAAM,cAAA,EAAe,CAAE,OAAO,uBAAA,CAAwB,IAAA,EAAM,SAAS,CAAC,CAAA;AACpF,EAAA,IAAI;AACF,IAAA,MAAM,WAAA,GAIF;AAAA,MACF,GAAI,MAAA,KAAW,KAAA,CAAA,GAAY,EAAE,MAAA,KAAW,EAAC;AAAA,MACzC,GAAI,QAAA,KAAa,KAAA,CAAA,GAAY,EAAE,aAAA,EAAe,QAAA,KAAa,EAAC;AAAA;AAAA,MAE5D,MAAA,EAAQ,EAAE,IAAA,EAAM,aAAA;AAAc,KAChC;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,IAAA,CAAK,OAAO,WAAW,CAAA;AAC/C,IAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAG9B,IAAA,IAAI,MAAA,CAAO,WAAW,OAAA,EAAS;AAC7B,MAAA,MAAM,QAAS,MAAA,CAA4C,KAAA;AAC3D,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,aAAa,IAAA,CAAK,IAAI,CAAA,cAAA,EAAiB,KAAA,EAAO,WAAW,eAAe,CAAA,CAAA;AAAA,QACxE,KAAA,KAAU,KAAA,CAAA,GAAY,EAAE,KAAA,EAAM,GAAI,KAAA;AAAA,OACpC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,OAAO,MAAA,IAAU,eAAA;AAE9B,IAAA,OAAO,KAAK,kBAAA,KAAuB,IAAA,GAAO,OAAQ,MAAM,uBAAA,CAAwB,GAAG,CAAA,GAAK,IAAA;AAAA,EAC1F,CAAA,SAAE;AACA,IAAA,KAAA,CAAM,OAAA,EAAQ;AAAA,EAChB;AACF;AAQA,eAAe,qBAAA,CACb,IAAA,EACA,KAAA,EACA,KAAA,EACA,SAAA,EACe;AACf,EAAA,IAAI,IAAA,CAAK,yBAAyB,MAAA,EAAW;AAC7C,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,CAAK,qBAAqB,EAAE,KAAA,EAAO,MAAM,IAAA,CAAK,IAAA,EAAM,KAAA,EAAO,SAAA,EAAW,CAAA;AAAA,EAC9E,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAQA,SAAS,kBAAA,CACP,IAAA,EACA,KAAA,EACA,QAAA,EACQ;AACR,EAAA,IAAI,IAAA,CAAK,aAAA,KAAkB,MAAA,IAAa,QAAA,KAAa,QAAW,OAAO,KAAA;AACvE,EAAA,MAAM,QAAA,GAAW,KAAK,aAAA,CAAc,EAAE,UAAU,KAAA,EAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,CAAA;AACxE,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAClC,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AACzE,EAAA,OAAO,CAAA;AAAA,EAAwB,QAAQ;;AAAA;AAAA,EAAc,KAAK,CAAA,CAAA;AAC5D;AAGA,eAAe,uBAAA,CACb,IAAA,EACA,KAAA,EACA,MAAA,EACA,SAAA,EACiB;AACjB,EAAA,IAAI,IAAA,CAAK,oBAAA,KAAyB,MAAA,EAAW,OAAO,MAAA;AACpD,EAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,oBAAA,CAAqB,EAAE,KAAA,EAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ,SAAA,EAAW,CAAA;AAChG,EAAA,OAAO,UAAA,EAAY,QAAA,KAAa,MAAA,GAAY,MAAA,GAAS,WAAW,QAAA,GAAW,MAAA;AAC7E;AAEA,SAAS,cAAA,CAAe,IAAA,EAAoB,YAAA,GAAe,CAAA,EAAe;AACxE,EAAA,MAAM,QAAA,GAAW,KAAK,kBAAA,IAAsB,CAAA;AAM5C,EAAA,IAAI,YAAA,GAAe,IAAI,QAAA,EAAU;AAC/B,IAAA,MAAM,IAAI,uBAAA,CAAwB,YAAA,GAAe,CAAA,EAAG,QAAQ,CAAA;AAAA,EAC9D;AAGA,EAAA,MAAM,QAAA,GAAW,EAAE,MAAA,CAAO;AAAA,IACxB,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,uBAAuB;AAAA,GACnD,CAAA;AAKD,EAAA,MAAM,WAAA,GAAuC;AAAA,IAC3C,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,uBAAA;AAAwB,KAChE;AAAA,IACA,QAAA,EAAU,CAAC,OAAO,CAAA;AAAA,IAClB,oBAAA,EAAsB;AAAA,GACxB;AAIA,EAAA,IAAI,SAAA,GAAY,CAAA;AAEhB,EAAA,MAAM,IAAA,GAAmB;AAAA,IACvB,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,aAAa,IAAA,CAAK,WAAA;AAAA,IAClB,WAAA;AAAA,IACA,OAAA,EAAS,OACP,QAAA,EACA,GAAA,KAKoB;AACpB,MAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAO,GAAI,QAAA,CAAS,MAAM,QAAQ,CAAA;AAMjD,MAAA,MAAM,YAAY,mCAAA,EAAoC;AAItD,MAAA,MAAM,YAAA,GAAe,YAAA,GAAe,sBAAA,EAAuB,GAAI,CAAA;AAC/D,MAAA,IAAI,eAAe,QAAA,EAAU;AAC3B,QAAA,MAAM,IAAI,uBAAA,CAAwB,YAAA,EAAc,QAAQ,CAAA;AAAA,MAC1D;AACA,MAAA,SAAA,IAAa,CAAA;AAIb,MAAA,MAAM,iBAAA,GAAoB,SAAA;AAE1B,MAAA,MAAM,KAAA,GAAQ,MAAM,oBAAA,CAAqB,IAAA,EAAM,QAAQ,iBAAiB,CAAA;AACxE,MAAA,IAAI,QAAA,IAAY,KAAA,EAAO,OAAO,KAAA,CAAM,MAAA;AAEpC,MAAA,MAAM,QAAQ,kBAAA,CAAmB,IAAA,EAAM,KAAA,CAAM,KAAA,EAAO,KAAK,QAAQ,CAAA;AAEjE,MAAA,IAAI,MAAA;AACJ,MAAA,IAAI;AAEF,QAAA,MAAA,GAAS,MAAM,aAAA;AAAA,UACb,IAAA;AAAA,UACA,KAAA;AAAA,UACA,GAAA,EAAK,MAAA;AAAA,UACL,KAAA,CAAM,QAAA;AAAA,UACN,SAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF,SAAS,KAAA,EAAO;AAId,QAAA,MAAM,qBAAA,CAAsB,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,iBAAiB,CAAA;AACjE,QAAA,MAAM,KAAA;AAAA,MACR;AACA,MAAA,OAAO,uBAAA,CAAwB,IAAA,EAAM,KAAA,EAAO,MAAA,EAAQ,iBAAiB,CAAA;AAAA,IACvE;AAAA,GACF;AAKA,EAAA,OAAO,IAAA;AACT;AAMO,IAAM,WAAN,MAAe;AAAA,EACZ,WAAA,GAAc;AAAA,EAAC;AAAA,EACvB,OAAO,MAAA,CAAO,IAAA,EAAoB,WAAA,GAAc,CAAA,EAAe;AAC7D,IAAA,OAAO,cAAA,CAAe,MAAM,WAAW,CAAA;AAAA,EACzC;AACF;AAsBO,SAAS,4BAAA,CACd,QACA,WAAA,EACc;AACd,EAAA,OAAO,MAAA,CAAO,QAAQ,MAAM,CAAA,CAAE,IAAI,CAAC,CAAC,IAAA,EAAM,GAAG,CAAA,KAAM;AACjD,IAAA,MAAM,SAAA,GACJ,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA,IAAK,GAAA,CAAI,KAAA,CAAM,MAAA,GAAS,CAAA,GAAI,IAAI,GAAA,CAAI,GAAA,CAAI,KAAK,CAAA,GAAI,MAAA;AAC1E,IAAA,MAAM,UAAA,GAAa,SAAA,GAAY,WAAA,CAAY,MAAA,CAAO,CAAC,CAAA,KAAM,SAAA,CAAU,GAAA,CAAI,CAAA,CAAE,IAAI,CAAC,CAAA,GAAI,WAAA;AAClF,IAAA,OAAO,cAAA,CAAe;AAAA,MACpB,IAAA;AAAA,MACA,aAAa,GAAA,CAAI,WAAA;AAAA,MACjB,cAAc,GAAA,CAAI,MAAA;AAAA;AAAA;AAAA,MAGlB,GAAI,GAAA,CAAI,KAAA,KAAU,MAAA,IAAa,GAAA,CAAI,KAAA,KAAU,SAAA,GAAY,EAAE,KAAA,EAAO,GAAA,CAAI,KAAA,EAAM,GAAI,EAAC;AAAA,MACjF,GAAI,IAAI,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,EAAS,GAAA,CAAI,OAAA,EAAQ,GAAI,EAAC;AAAA,MAC5D,KAAA,EAAO,CAAC,GAAG,UAAU;AAAA,KACtB,CAAA;AAAA,EACH,CAAC,CAAA;AACH","file":"chunk-XCQ432OX.js","sourcesContent":["/**\n * #364 — how deep the current delegation chain already is, delivered through the CALL.\n *\n * ## The bug this replaces\n *\n * `maxDelegationDepth` was checked once, at tool-CONSTRUCTION time, against a `_parentDepth`\n * argument that nothing in the SDK ever incremented. Constructing a tool says nothing about how\n * deep it will later be invoked, so with the documented call — `SubAgent.create(spec)` — the test\n * was `1 > maxDepth`, false for every spec that did not ask for depth 0. A subagent whose tools\n * include another subagent recursed unbounded, which is precisely what the guard exists to stop.\n * The only path that ever tripped it was a caller threading the number by hand.\n *\n * ## Why the async scope closes it\n *\n * Depth is a property of the RUN, not of the object. A child's run loop — and therefore every tool\n * it dispatches — executes inside the async continuation of its parent's handler, so a value\n * published on that context is exactly what a nested dispatch needs to read. This is the same seam\n * `subagent-credentials.ts` uses, and for the same reason: what survives every layer that rebuilds\n * a tool object is the call, never the object.\n *\n * It is kept in its own module rather than folded into the credentials payload because depth is a\n * separate concern with a separate lifetime — the credentials scope is opened once per run by the\n * run loop, while depth is opened per delegation by the dispatching tool.\n *\n * @internal\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\n\nconst depthStore = new AsyncLocalStorage<number>();\n\n/**\n * Run `fn` with `depth` published as the delegation depth of the current chain.\n *\n * Nested scopes shadow the outer one and the outer is restored on return, so two sibling\n * delegations from the same parent each start from the parent's depth rather than from each\n * other's.\n *\n * @internal\n */\nexport async function withDelegationDepth<T>(depth: number, fn: () => Promise<T>): Promise<T> {\n  return depthStore.run(depth, fn);\n}\n\n/**\n * The delegation depth of the current chain — `0` outside any delegation.\n *\n * `0` is the honest default rather than a fallback to some previous chain's value: a subagent\n * dispatched with no parent delegation IS at depth zero.\n *\n * @internal\n */\nexport function currentDelegationDepth(): number {\n  return depthStore.getStore() ?? 0;\n}\n","/**\n * theokit#148 — the parent's credentials, delivered through the CALL, not through the tool object.\n *\n * ## The class of bug this replaces\n *\n * Credential inheritance used to ride a property installed on the subagent tool object — first a\n * unique `Symbol()`, then `Symbol.for` after #143. Both are the same shape of contract: \"this\n * object will reach the dispatcher with an extra property intact\". Nothing enforces that, and it\n * broke twice for two different reasons:\n *\n *  - **Module duplication** (#142/#143): `tsup splitting: false` inlined a separate copy of the\n *    module into each public entry, so the two copies disagreed on a unique `Symbol()` key. Fixed at\n *    the build level by M78's `splitting: true`, but the fragile contract remained.\n *  - **Object normalization** (#148): any layer that rebuilds the tool from its known fields drops\n *    the property. `@theokit/agents`' `toCompiledTool` does exactly that, and had to add an explicit\n *    `Object.getOwnPropertySymbols` copy loop to compensate — a band-aid the SDK's contract forced\n *    onto a consumer. A named field would have been dropped by the same four-field rebuild, which is\n *    why \"make it a typed field\" alone does not close this.\n *\n * ## Why the async scope closes it\n *\n * What survives a rebuild is not the object — it is the CALL. A normalizing wrapper builds a new\n * object but still invokes the original handler, inside the parent run's async context. So\n * credentials published on that context reach the handler regardless of what the tool object looks\n * like by then. There is no property left for a layer to drop.\n *\n * It also fixes a defect the per-object slot could not: credentials were stored per tool INSTANCE,\n * so one subagent tool shared by two agents got last-writer-wins. The scope is per run.\n *\n * Nothing is exposed to third-party tool code: the store is module-private, credentials never touch\n * a handler's `ctx`, and `currentInheritedSubAgentCredentials` is `@internal`.\n *\n * @internal\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\n// The PUBLIC, validated shapes — `CompatSource`, not the loose `CompatSourceDeclaration` the\n// internal loader accepts. What travels here is what the parent already resolved, so it is typed\n// against the option it came from and the option it is handed to. Typing it loosely and casting at\n// the destination would hide exactly the mismatch the compiler caught on the first attempt.\nimport type { BuiltinToolName, CompatSource, SettingSource } from \"../../types/agent.js\";\nimport type { ModelSelection } from \"../../types/agent-prims.js\";\nimport type { Plugin } from \"../plugins/types.js\";\n\n/**\n * Credentials a parent agent hands down to its subagent tools so the child inherits the parent's\n * auth (and, absent an explicit `spec.model`, its model).\n *\n * Declared here rather than in `a2a/subagent.ts` so the delivery mechanism owns the payload shape\n * and the dependency runs one way (`a2a/subagent` -> this module). `a2a/subagent.ts` briefly\n * re-exported it \"for back-compat\"; knip proved there was no back-compat surface to preserve — the\n * type was never in the public barrel nor the exports map — so the re-export was deleted.\n *\n * Emitted rather than erased: `a2a/subagent.d.ts` imports it by name, and that entry IS published,\n * so erasing this declaration ships a `.d.ts` that does not compile. Not being in the exports map\n * is what keeps it out of the semver contract; erasure is not what does that.\n */\nexport interface InheritedCredentials {\n  readonly apiKey?: string;\n  readonly model?: ModelSelection;\n  /**\n   * The parent's shell-sandbox posture (`local.sandboxOptions.enabled`), handed down so a delegated\n   * child of a sandboxed parent stays sandboxed unless its role explicitly opts out. Without this a\n   * child ran unsandboxed whenever its role omitted `sandbox` — a default-open the sandbox wiring\n   * exists to prevent.\n   */\n  readonly sandbox?: boolean;\n  /**\n   * #55 — the parent's code-registered plugins (e.g. a `PermissionPlugin`) handed down so the child\n   * runs under the SAME policy. Without this, a delegated child's inner tool calls escape the\n   * parent's argument-level permission gate. First-party delegation path only — never exposed to\n   * third-party tool `ctx`.\n   */\n  readonly plugins?: readonly Plugin[];\n  /**\n   * #578 — the parent's RESOLVED `local.settingSources` / `local.compatSources`, handed down so a\n   * delegated child can see the configuration surfaces its parent was declared to read.\n   *\n   * `compatSources` arrived with #524 and neither carrier was updated, so a parent declaring\n   * `compatSources: [\"claude-code\"]` read `.claude/agents/` and its child did not: a team could\n   * delegate TO a role by name and the child could not resolve the rest of the team.\n   *\n   * ## Why inheriting is safe here, unlike widening\n   *\n   * Every other field on this interface hands DOWN a restriction (the sandbox posture, the\n   * permission plugins) and the danger is a child escaping it. These two are the mirror image: the\n   * child is currently MORE restricted than its parent, so the failure is a missing capability\n   * rather than an open door. Inheritance cannot widen — the child receives what the parent already\n   * resolved, and it runs in the parent's cwd, so it reads no directory the parent could not.\n   *\n   * A role's explicit value still wins; these are the fallback, exactly as `model` and `sandbox` are.\n   */\n  readonly settingSources?: readonly SettingSource[];\n  /** @see {@link InheritedCredentials.settingSources} — carried together, same reasoning. */\n  readonly compatSources?: readonly CompatSource[];\n  /**\n   * #580 — the builtin tools the parent removed from its catalog, handed down so a delegated child\n   * cannot recover one its parent revoked.\n   *\n   * This is the third field here that hands down a RESTRICTION, and it was the one that crossed no\n   * carrier at all: measured, a parent with `withheldBuiltinTools: [\"shell\"]` produced a child whose\n   * value was `undefined`, so the child got the shell back. Delegation widened authority the operator\n   * had revoked — the inverse of #578 and materially worse, because there the child was merely\n   * over-restricted.\n   *\n   * It bites because of a documented default (`types/agent.ts` § LocalOptions): a `shell` tool is\n   * ALWAYS registered on a local agent, including when `tools: []` is passed. Withholding is the only\n   * mechanism that removes it, so a withholding that does not survive delegation leaves no other way\n   * for a child to be without a shell.\n   *\n   * ## The union rule\n   *\n   * A child's own list is UNIONED with this one, never substituted for it — see\n   * {@link buildChildWithheldBuiltins}. Every other field on this interface lets the role's own value\n   * win, and copying that here would let a child un-withhold what its parent revoked: the bug,\n   * reintroduced by its own fix.\n   */\n  readonly withheldBuiltinTools?: readonly BuiltinToolName[];\n}\n\nconst credentialsStore = new AsyncLocalStorage<InheritedCredentials>();\n\n/**\n * Run `fn` with `credentials` published as the delegation credentials of the current run.\n *\n * Nested scopes shadow the outer one and the outer is restored on return, so a delegated child that\n * itself delegates hands down ITS credentials, not its parent's.\n *\n * @internal\n */\nexport async function withInheritedSubAgentCredentials<T>(\n  credentials: InheritedCredentials,\n  fn: () => Promise<T>,\n): Promise<T> {\n  return credentialsStore.run(credentials, fn);\n}\n\n/**\n * The delegation credentials of the current run, or `undefined` outside a run scope.\n *\n * `undefined` is deliberately NOT a fallback to some previous run's value: a subagent dispatched\n * with no parent context must create its child without an inherited key rather than reuse a\n * credential that belonged to someone else.\n *\n * @internal\n */\nexport function currentInheritedSubAgentCredentials(): InheritedCredentials | undefined {\n  return credentialsStore.getStore();\n}\n","/**\n * Subagent delegation — declarative child agent invocable as a tool.\n *\n * Per ADR D2: `defineSubAgent(spec)` returns a `CustomTool` that, when\n * invoked by the LLM, creates a child agent and sends the input as a\n * message. EC-2: delegation depth is tracked across the RUN (#364) — each\n * delegation publishes its depth on the async scope its child executes in, so a\n * subagent that delegates to a subagent is bounded by `maxDelegationDepth`\n * without the caller threading a counter by hand.\n *\n * SE10 — the handler forwards the parent run's `AbortSignal` to the child.\n * SE11 — optional `onDelegationStart` / `onDelegationComplete` lifecycle hooks\n * let the caller reject, rewrite, observe, or annotate a delegation.\n *\n * @public\n */\n\nimport { z } from \"zod\";\nimport { TheokitAgentError } from \"../errors.js\";\nimport {\n  currentDelegationDepth,\n  withDelegationDepth,\n} from \"../internal/concurrency/delegation-depth.js\";\nimport {\n  currentInheritedSubAgentCredentials,\n  type InheritedCredentials,\n} from \"../internal/concurrency/subagent-credentials.js\";\nimport { getAgentFacade } from \"../internal/runtime/registry/agent-factory-registry.js\";\nimport type {\n  AgentDefinition,\n  AgentOptions,\n  BuiltinToolName,\n  CustomTool,\n  ToolContextMessage,\n} from \"../types/agent.js\";\nimport type { ModelSelection } from \"../types/agent-prims.js\";\nimport type { Run } from \"../types/run.js\";\n\n/** Arguments passed to {@link SubAgentSpec.messageFilter} (SE12). */\nexport interface MessageFilterArgs {\n  /** The supervisor transcript (read-only text projection) available to this delegation. */\n  messages: readonly ToolContextMessage[];\n  /** The prompt about to be delegated (after any `onDelegationStart` rewrite). */\n  input: string;\n  /** The subagent's name. */\n  name: string;\n}\n\n/** Context passed to {@link SubAgentSpec.onDelegationStart} before the child runs. */\nexport interface DelegationStartContext {\n  input: string;\n  name: string;\n  /**\n   * SE15 — 1-based count of times THIS subagent tool has been invoked (a\n   * per-`defineSubAgent`-instance counter). Incremented before this hook runs;\n   * a rejected delegation still counts. Enables reject-after-N patterns.\n   */\n  iteration: number;\n}\n\n/**\n * Decision returned from {@link SubAgentSpec.onDelegationStart}. Discriminated on\n * `proceed` so a rejection (`proceed: false` + `rejectionReason`) and an approval\n * (`modifiedInput`) cannot be mixed into one nonsensical object.\n */\nexport type DelegationStartDecision =\n  | { proceed: false; rejectionReason?: string }\n  | {\n      proceed?: true;\n      modifiedInput?: string;\n      /** SE13 — cap the child's iteration count (forwarded as `SendOptions.maxIterations`). */\n      modifiedMaxSteps?: number;\n    };\n\n/** Context passed to {@link SubAgentSpec.onDelegationComplete} after the child settles. */\nexport interface DelegationCompleteContext {\n  input: string;\n  name: string;\n  /** The child's text result (present on success). */\n  result?: string;\n  /** The error the child threw (present on failure); the error is still re-thrown. */\n  error?: unknown;\n  /** SE15 — the same 1-based iteration this delegation's `onDelegationStart` saw. */\n  iteration: number;\n}\n\n/**\n * The return of a delegation hook: a decision, a promise of one, or nothing —\n * `void` lets a side-effect-only callback (`(ctx) => { log(ctx) }`) type-check,\n * which is the common case (mirrors a peer framework's `async ctx => { ... }` hooks).\n */\n// biome-ignore lint/suspicious/noConfusingVoidType: `void` is the idiomatic return for an optional-return callback; the rule false-positives on callback return unions.\ntype DelegationHookResult<T> = T | void | Promise<T | void>;\n\n/** Decision returned from {@link SubAgentSpec.onDelegationComplete}. */\nexport interface DelegationCompleteDecision {\n  /** Appended to the child's result string. */\n  feedback?: string;\n}\n\n/**\n * The declaration of a delegating child agent, handed to `SubAgent.create(spec)`.\n *\n * `name`, `description` and `instructions` are the only required fields: the first\n * two become the tool the supervisor's model sees, the third becomes the child's\n * system prompt. Everything else narrows what the child inherits.\n *\n *   const research = SubAgent.create({\n *     name: \"research\",\n *     description: \"Look a fact up\",\n *     instructions: \"You answer with one sentence.\",\n *   });\n *   const agent = await Agent.create({ tools: [research] });\n *\n * The tool's own input schema is fixed — one required string property, `input`.\n * It is not derived from this spec and cannot be widened here.\n *\n * What the child inherits from the parent AT DISPATCH TIME, not from this object:\n * the API key, the model (unless `model` is set), the parent's plugins, and the\n * parent's sandbox posture (unless `sandbox` is set). An absent `sandbox` inherits;\n * an explicit `sandbox: false` turns confinement OFF for a child of a confined\n * parent, which is not the same thing.\n *\n * How it fails: the child's failure is re-thrown to the supervisor as a tool error\n * — a run ending in `status: \"error\"` becomes\n * `subagent \"<name>\" run failed: <cause>`. `onDelegationStart` and `messageFilter`\n * propagate their own throws; only a throw from `onDelegationComplete` ON THE\n * ERROR PATH is suppressed, so it cannot mask the real cause.\n *\n * Traps:\n *  - `model` as a bare string drops reasoning parameters. Pass the\n *    {@link ModelSelection} object form when the child needs `params`.\n *  - `maxDelegationDepth` (default 3) bounds the delegation CHAIN, counted at\n *    dispatch across the run (#364) — the depth is not something you thread. The\n *    `parentDepth` argument of `SubAgent.create` still offsets it, for a supervisor\n *    that wants a lower ceiling than the chain it sits in.\n *  - Context isolation is the DEFAULT. Without `messageFilter` the child sees only\n *    the delegated string; without `includeToolResults` the supervisor gets only\n *    the child's final text.\n */\nexport interface SubAgentSpec {\n  name: string;\n  description: string;\n  instructions: string;\n  /**\n   * A bare id string (back-compat) OR a full {@link ModelSelection} carrying\n   * `params` (e.g. `[{ id: \"thinking\", value: \"low\" }]` for reasoning effort). The\n   * object form is required for per-subagent reasoning effort to survive to the child\n   * — the pre-M33 path took only `.id` and dropped params.\n   */\n  model?: string | ModelSelection;\n  tools?: CustomTool[];\n  /** Per-subagent shell sandbox toggle (M33). `true` ⇒ child `local.sandboxOptions.enabled`. */\n  sandbox?: boolean;\n  /**\n   * #580 — builtin tools this role removes from its child's catalog, UNIONED with whatever the\n   * parent already withheld.\n   *\n   * A role declared read-only in prose is not read-only: a `shell` tool is always registered on a\n   * local agent, including when `tools: []` is passed, so withholding is the only mechanism that\n   * removes it — and until #580 a spec could not ask for it and a parent's withholding did not\n   * survive delegation either.\n   *\n   * ## Union, not override — and this is the one field here that works that way\n   *\n   * `model` and `sandbox` let the role's own value WIN, including `sandbox: false` turning\n   * confinement off for a child of a confined parent. That asymmetry is deliberate: a posture is\n   * declared, whereas withholding removes a capability from the catalog. Letting a role override a\n   * withholding would let a child recover a tool its parent revoked, which is the defect #580\n   * reports — so a child may only ever ADD to the set.\n   */\n  withheldBuiltinTools?: readonly BuiltinToolName[];\n  /**\n   * Maximum length of the delegation CHAIN rooted at this tool, counted at dispatch\n   * (default 3). Depth 1 is this subagent; a subagent it delegates to is depth 2.\n   * Exceeding it throws {@link MaxDelegationDepthError} from the tool handler.\n   */\n  maxDelegationDepth?: number;\n  /**\n   * SE11 — called before the supervisor delegates. Return `{ proceed: false }`\n   * to reject (the child never runs and `rejectionReason` becomes the tool\n   * result), or `{ modifiedInput }` to rewrite the delegated prompt. A throwing\n   * hook surfaces (never silently swallowed).\n   */\n  onDelegationStart?: (\n    ctx: DelegationStartContext,\n  ) => DelegationHookResult<DelegationStartDecision>;\n  /**\n   * SE11 — called after the delegation settles. On success `ctx.result` is set\n   * and an optional `{ feedback }` is appended to it. On failure `ctx.error` is\n   * set and the original error is ALWAYS re-thrown after this hook runs — a throw\n   * from this hook on the error path is suppressed so it cannot mask the\n   * delegation's real failure (on the success path a throw does propagate).\n   */\n  onDelegationComplete?: (\n    ctx: DelegationCompleteContext,\n  ) => DelegationHookResult<DelegationCompleteDecision>;\n  /**\n   * SE12 — opt-in parent-context forwarding. When set, the supervisor transcript\n   * (`ctx.messages`, a read-only text projection) is passed to this filter and the\n   * returned subset is forwarded to the child as a role-tagged context preamble\n   * prepended to the delegated input. When ABSENT the child runs input-only —\n   * memory isolation stays the default. A filter returning `[]` forwards nothing.\n   * A throwing filter propagates (fail-fast, never swallowed — same contract as\n   * `onDelegationStart`); the delegation surfaces as a tool error.\n   */\n  messageFilter?: (args: MessageFilterArgs) => readonly ToolContextMessage[];\n  /**\n   * SE14 — opt-in subagent result-context control. When `true`, the child's\n   * completed tool-call results (name + result) are appended to the delegation\n   * payload returned to the supervisor, inside a `<subagent-tool-results>` block.\n   * When absent/`false` the delegation returns the child's final text only —\n   * text-only stays the default (a peer framework's scoped posture). See ADR 0006.\n   */\n  includeToolResults?: boolean;\n}\n\n/**\n * Raised by `SubAgent.create(spec, parentDepth)` when `parentDepth + 1` exceeds\n * `spec.maxDelegationDepth` (default 3). Carries `currentDepth`, `maxDepth` and a\n * stable `code: \"max_delegation_depth\"`.\n *\n * Thrown from the subagent tool's handler when a delegation would exceed\n * `maxDelegationDepth` (default 3), so it surfaces as the tool call's failure —\n * catching it around the dispatching `agent.send()` works.\n *\n * Also thrown eagerly at TOOL-CONSTRUCTION time when a caller threads its own\n * `parentDepth` that is already past the limit; such a tool could never be\n * dispatched, so refusing to build it fails earlier and clearer.\n *\n * Before #364 the construction-time check was the ONLY one, against a depth\n * nothing in the SDK incremented — so under the documented `SubAgent.create(spec)`\n * call this error could not fire at all and nested delegation was unbounded. The\n * chain length now travels with the run (`internal/runtime/concurrency/delegation-depth.ts`),\n * and a caller-threaded `parentDepth` still adds to it.\n */\nexport class MaxDelegationDepthError extends TheokitAgentError {\n  override readonly name = \"MaxDelegationDepthError\";\n  override readonly code = \"max_delegation_depth\" as const;\n  constructor(\n    public readonly currentDepth: number,\n    public readonly maxDepth: number,\n  ) {\n    // Not retryable: the depth is a property of the call graph, and it is the same on a retry.\n    super(`Max delegation depth ${maxDepth} exceeded (current: ${currentDepth})`, {\n      code: \"max_delegation_depth\",\n      isRetryable: false,\n    });\n  }\n}\n\n/**\n * Run the `onDelegationStart` hook; returns either a rejection or the (possibly\n * rewritten) input plus the optional SE13 `maxSteps` cap.\n */\nasync function applyDelegationStart(\n  spec: SubAgentSpec,\n  input: string,\n  iteration: number,\n): Promise<{ reject: string } | { input: string; maxSteps?: number }> {\n  if (spec.onDelegationStart === undefined) return { input };\n  const decision = await spec.onDelegationStart({ input, name: spec.name, iteration });\n  if (decision === undefined) return { input };\n  if (decision.proceed === false)\n    return { reject: decision.rejectionReason ?? \"(delegation rejected)\" };\n  return {\n    input: decision.modifiedInput ?? input,\n    ...(decision.modifiedMaxSteps !== undefined ? { maxSteps: decision.modifiedMaxSteps } : {}),\n  };\n}\n\n/**\n * SE14 — replay the child run's stream (a safe post-`wait()` idiom — the run buffers\n * events, `stream()` replays them) and collect every completed tool-call result into\n * a delimited block. Returns `\"\"` when the child ran no completed tool calls. See ADR 0006.\n */\nasync function collectChildToolResults(run: Run): Promise<string> {\n  const lines: string[] = [];\n  for await (const event of run.stream()) {\n    if (event.type === \"tool_call\" && event.status === \"completed\") {\n      const rendered =\n        typeof event.result === \"string\" ? event.result : JSON.stringify(event.result ?? null);\n      lines.push(`${event.name}: ${rendered}`);\n    }\n  }\n  if (lines.length === 0) return \"\";\n  return `\\n\\n<subagent-tool-results>\\n${lines.join(\"\\n\")}\\n</subagent-tool-results>`;\n}\n\n/**\n * The child's `local` slice, accumulated ONCE from all three contributors — or `undefined` when the\n * parent declared none of them, so the pre-#578 shape (no `local` key at all) is preserved.\n *\n * #578 — this exists as a function rather than three spreads in the return, and the reason is a\n * hazard rather than tidiness. `local` is a single object: the old code wrote it whole from the\n * sandbox posture alone, so adding a second `...{ local: … }` spread beside it would have silently\n * DROPPED that posture — turning a missing-capability bug into a default-open one, which is the\n * wrong direction to trade. One accumulator makes that collision impossible to reintroduce.\n *\n * The configuration surfaces are the parent's RESOLVED values. Inheriting cannot widen: the child\n * receives what the parent already resolved and runs in the parent's cwd, so it reads no directory\n * the parent could not. Without this, a parent declaring `compatSources: [\"claude-code\"]` saw\n * `.claude/agents/` and its child did not — a team could delegate TO a role by name while the child\n * could not resolve the rest of the team.\n */\nfunction buildChildLocalOptions(\n  sandbox: boolean | undefined,\n  inherited: InheritedCredentials | undefined,\n): AgentOptions[\"local\"] | undefined {\n  const local: NonNullable<AgentOptions[\"local\"]> = {};\n  if (sandbox !== undefined) local.sandboxOptions = { enabled: sandbox };\n  if (inherited?.settingSources !== undefined) local.settingSources = [...inherited.settingSources];\n  if (inherited?.compatSources !== undefined) local.compatSources = [...inherited.compatSources];\n  return Object.keys(local).length > 0 ? local : undefined;\n}\n\n/**\n * The builtins withheld from the child: the UNION of the parent's set and the role's own — or\n * `undefined` when neither withheld anything.\n *\n * #580 — union rather than override, and that is the security property rather than a preference.\n * The role's own value wins for `model` and for `sandbox`; copying that here would let a child\n * un-withhold what its parent revoked, which is the defect being fixed, reintroduced by its own fix.\n * **A restriction may be tightened by a child and never loosened.** So `withheldBuiltinTools: []` on\n * a role subtracts nothing — it is an empty contribution to a union, not a reset.\n */\nfunction buildChildWithheldBuiltins(\n  spec: SubAgentSpec,\n  inherited: InheritedCredentials | undefined,\n): readonly BuiltinToolName[] | undefined {\n  const own = spec.withheldBuiltinTools;\n  const parent = inherited?.withheldBuiltinTools;\n  if (own === undefined && parent === undefined) return undefined;\n  return [...new Set([...(parent ?? []), ...(own ?? [])])];\n}\n\n/**\n * Build the child agent's `Agent.create` options: the child inherits the parent's\n * apiKey (else `Agent.create` throws \"Missing API key\"), its model (unless the spec\n * overrides it), — #55 — the parent's plugins (permission gate/guards) so the\n * child's inner tool calls run under the same policy, and — #578 — the configuration\n * surfaces the parent was declared to read (see {@link buildChildLocalOptions}).\n */\nexport function buildChildCreateOptions(\n  spec: SubAgentSpec,\n  inherited: InheritedCredentials | undefined,\n): AgentOptions {\n  // M33 — carry the WHOLE model (a bare id becomes `{ id }`; a ModelSelection with\n  // `params` keeps its reasoning effort). The pre-M33 path wrapped `spec.model` as\n  // `{ id: spec.model }`, which only worked because spec.model was a string and\n  // silently dropped reasoning params.\n  const model: string | ModelSelection | undefined =\n    spec.model !== undefined\n      ? typeof spec.model === \"string\"\n        ? { id: spec.model }\n        : spec.model\n      : inherited?.model;\n  // M33 — the role's own `sandbox` wins; when it omits the field, inherit the parent's posture. A role's\n  // explicit `sandbox: false` therefore confines-OFF a child of a sandboxed parent (distinct from absent).\n  const sandbox = spec.sandbox ?? inherited?.sandbox;\n  const local = buildChildLocalOptions(sandbox, inherited);\n  const withheld = buildChildWithheldBuiltins(spec, inherited);\n  return {\n    ...(inherited?.apiKey !== undefined ? { apiKey: inherited.apiKey } : {}),\n    ...(model !== undefined ? { model } : {}),\n    ...(local !== undefined ? { local } : {}),\n    ...(withheld !== undefined ? { withheldBuiltinTools: withheld } : {}),\n    ...(inherited?.plugins !== undefined ? { plugins: inherited.plugins } : {}),\n    systemPrompt: spec.instructions,\n    tools: spec.tools ?? [],\n  };\n}\n\n/**\n * Create the transient child agent and send the input, composing every forwarded\n * `SendOptions` onto ONE `send` call — SE10 `signal` + SE13 `maxIterations`. Absent\n * every option ⇒ the pre-SE10 single-arg `send(input)` shape. SE14 — when\n * `includeToolResults` is set, append the child's completed tool results. Dispose in `finally`.\n */\nasync function runChildAgent(\n  spec: SubAgentSpec,\n  input: string,\n  signal: AbortSignal | undefined,\n  maxSteps: number | undefined,\n  inherited: InheritedCredentials | undefined,\n  depth: number,\n): Promise<string> {\n  // #364 — publish THIS delegation's depth for the whole child run. The child's loop, and every\n  // tool it dispatches, runs inside this scope, so a nested subagent reads the real chain length\n  // instead of the 0 every construction-time check saw.\n  return withDelegationDepth(depth, () =>\n    runChildAgentInScope(spec, input, signal, maxSteps, inherited),\n  );\n}\n\nasync function runChildAgentInScope(\n  spec: SubAgentSpec,\n  input: string,\n  signal: AbortSignal | undefined,\n  maxSteps: number | undefined,\n  inherited: InheritedCredentials | undefined,\n): Promise<string> {\n  // SE45 cycle 3 — use the registered Agent facade via the DIP seam\n  // (agent-factory-registry) instead of a dynamic `import(\"../agent.js\")`.\n  // This removes the last madge cycle (a2a/subagent -> agent -> ... -> real-local-run-tools\n  // -> a2a/subagent): the facade registers itself at module-init via setAgentFacade,\n  // so subagent depends only on the registry port, never on the facade module.\n  const agent = await getAgentFacade().create(buildChildCreateOptions(spec, inherited));\n  try {\n    const sendOptions: {\n      signal?: AbortSignal;\n      maxIterations?: number;\n      origin?: import(\"../types/run.js\").MessageOrigin;\n    } = {\n      ...(signal !== undefined ? { signal } : {}),\n      ...(maxSteps !== undefined ? { maxIterations: maxSteps } : {}),\n      // SE3 — a delegated child's turn is initiated by the coordinating parent.\n      origin: { kind: \"coordinator\" },\n    };\n    const run = await agent.send(input, sendOptions);\n    const result = await run.wait();\n    // Fail-fast, don't swallow (Rule 8): a child that ended in error must surface — otherwise a real\n    // failure (e.g. `provider_unresolved`) is hidden behind \"(no response)\" and the parent loops on it.\n    if (result.status === \"error\") {\n      const cause = (result as { error?: { message?: string } }).error;\n      throw new Error(\n        `subagent \"${spec.name}\" run failed: ${cause?.message ?? \"unknown error\"}`,\n        cause !== undefined ? { cause } : undefined,\n      );\n    }\n    const text = result.result ?? \"(no response)\";\n    // SE14 — text-only by default; opt-in appends the child's tool results.\n    return spec.includeToolResults === true ? text + (await collectChildToolResults(run)) : text;\n  } finally {\n    agent.dispose();\n  }\n}\n\n/**\n * Best-effort error-path notification: run `onDelegationComplete` with the child's\n * error so the caller can observe the failure. The observer's own throw (sync or\n * async) is suppressed here so it cannot mask the delegation's real error, which the\n * handler re-throws next.\n */\nasync function notifyDelegationError(\n  spec: SubAgentSpec,\n  input: string,\n  error: unknown,\n  iteration: number,\n): Promise<void> {\n  if (spec.onDelegationComplete === undefined) return;\n  try {\n    await spec.onDelegationComplete({ input, name: spec.name, error, iteration });\n  } catch {\n    // Subordinate to `error`; the child's real cause wins.\n  }\n}\n\n/**\n * SE12 — apply `messageFilter` (if set) and prepend the filtered supervisor\n * transcript to the delegated input as a role-tagged context preamble. Absent\n * filter OR no messages OR an empty filtered subset ⇒ the original input\n * (isolation-by-default preserved).\n */\nfunction applyMessageFilter(\n  spec: SubAgentSpec,\n  input: string,\n  messages: readonly ToolContextMessage[] | undefined,\n): string {\n  if (spec.messageFilter === undefined || messages === undefined) return input;\n  const filtered = spec.messageFilter({ messages, input, name: spec.name });\n  if (filtered.length === 0) return input;\n  const preamble = filtered.map((m) => `${m.role}: ${m.content}`).join(\"\\n\");\n  return `Prior conversation:\\n${preamble}\\n\\nTask:\\n${input}`;\n}\n\n/** Run the success-path `onDelegationComplete` hook; appends its `feedback` to the result. */\nasync function applyDelegationComplete(\n  spec: SubAgentSpec,\n  input: string,\n  result: string,\n  iteration: number,\n): Promise<string> {\n  if (spec.onDelegationComplete === undefined) return result;\n  const completion = await spec.onDelegationComplete({ input, name: spec.name, result, iteration });\n  return completion?.feedback !== undefined ? result + completion.feedback : result;\n}\n\nfunction defineSubAgent(spec: SubAgentSpec, _parentDepth = 0): CustomTool {\n  const maxDepth = spec.maxDelegationDepth ?? 3;\n\n  // A caller that threads its own depth still gets the eager failure it always got: a spec that is\n  // already too deep to ever be dispatchable is worth refusing at construction. What this check\n  // CANNOT see is the runtime chain — constructing a tool says nothing about how deep it will later\n  // be invoked — which is why the guard that actually bounds recursion lives at dispatch (#364).\n  if (_parentDepth + 1 > maxDepth) {\n    throw new MaxDelegationDepthError(_parentDepth + 1, maxDepth);\n  }\n\n  // Zod for RUNTIME validation of the tool_use input …\n  const inputZod = z.object({\n    input: z.string().describe(\"Task for the subagent\"),\n  });\n  // … and a real Draft-7 JSON Schema for the LLM. `CustomTool.inputSchema` is sent\n  // to the model verbatim; a raw Zod object would serialize to garbage, so the\n  // model emits malformed input that fails `inputZod.parse` and the delegation\n  // never runs (the previous bug — the schema and the validator are now distinct).\n  const inputSchema: Record<string, unknown> = {\n    type: \"object\",\n    properties: {\n      input: { type: \"string\", description: \"Task for the subagent\" },\n    },\n    required: [\"input\"],\n    additionalProperties: false,\n  };\n\n  // SE15 — per-instance delegation counter, surfaced as `iteration` on the hook\n  // contexts. Incremented once per handler invocation before onDelegationStart.\n  let iteration = 0;\n\n  const tool: CustomTool = {\n    name: spec.name,\n    description: spec.description,\n    inputSchema,\n    handler: async (\n      rawInput: Record<string, unknown>,\n      ctx?: {\n        signal?: AbortSignal;\n        context?: unknown;\n        messages?: readonly ToolContextMessage[];\n      },\n    ): Promise<string> => {\n      const { input: parsed } = inputZod.parse(rawInput);\n      // theokit#148 — read the parent's credentials from the RUN's async scope, at dispatch time.\n      // They used to be stashed on this tool object by the runtime, which meant any layer that\n      // rebuilt the object (e.g. `@theokit/agents`' `toCompiledTool`) silently dropped them and the\n      // child failed with `provider_unresolved`. The scope travels with the call, so nothing about\n      // the object's shape matters — and two concurrent runs sharing one tool each read their own.\n      const inherited = currentInheritedSubAgentCredentials();\n      // #364 — the real bound. `currentDelegationDepth()` is the length of the chain that led here,\n      // published by each ancestor's `runChildAgent`; a caller-threaded `_parentDepth` still adds to\n      // it, so the pre-#364 hand-threaded behaviour is unchanged when the ambient depth is 0.\n      const currentDepth = _parentDepth + currentDelegationDepth() + 1;\n      if (currentDepth > maxDepth) {\n        throw new MaxDelegationDepthError(currentDepth, maxDepth);\n      }\n      iteration += 1; // SE15 — before onDelegationStart; a rejected delegation still counts.\n      // Pin THIS invocation's iteration before any await so a concurrent invocation\n      // bumping the shared counter cannot change the value onDelegationComplete /\n      // notifyDelegationError observe — they see the same iteration onDelegationStart did.\n      const capturedIteration = iteration;\n\n      const start = await applyDelegationStart(spec, parsed, capturedIteration);\n      if (\"reject\" in start) return start.reject;\n      // SE12 — opt-in: forward the filtered supervisor transcript as a preamble.\n      const input = applyMessageFilter(spec, start.input, ctx?.messages);\n\n      let result: string;\n      try {\n        // SE13 — apply the optional onDelegationStart maxSteps cap on the child send.\n        result = await runChildAgent(\n          spec,\n          input,\n          ctx?.signal,\n          start.maxSteps,\n          inherited,\n          currentDepth,\n        );\n      } catch (error) {\n        // SE11 — notify the completion hook of the failure (best-effort observer),\n        // then re-throw the ORIGINAL error (Rule 8: never swallow the delegation's\n        // own failure).\n        await notifyDelegationError(spec, input, error, capturedIteration);\n        throw error;\n      }\n      return applyDelegationComplete(spec, input, result, capturedIteration);\n    },\n  };\n\n  // theokit#148 — nothing is installed on the tool. The credentials arrive through the run's async\n  // scope (see `internal/runtime/concurrency/subagent-credentials.ts`), so there is no extra\n  // property for a normalizing layer to drop.\n  return tool;\n}\n\n/** SE36 — `SubAgent.create` replaces `defineSubAgent` (ADR 0015). @public  *\n * `SubAgent.create` returns a **`CustomTool`** — the sub-agent is exposed to the\n * parent as a callable tool, not as a `SubAgent` instance.\n */\nexport class SubAgent {\n  private constructor() {}\n  static create(spec: SubAgentSpec, parentDepth = 0): CustomTool {\n    return defineSubAgent(spec, parentDepth);\n  }\n}\n\n/**\n * Convert a parent's declarative `agents` map ({@link AgentDefinition} per key)\n * into delegation tools for the LOCAL runtime — the counterpart of the\n * cloud/fixture subagent wiring. Each child inherits the parent's `apiKey`/model\n * from the CALL, not from the tool object: `inheritSubAgentCredentials` used to\n * attach them to the tool, and any layer that rebuilt that object dropped them —\n * including the SDK's own rebuild (theokit#148). Credentials now ride the\n * dispatch, so a rebuilt tool cannot lose them. `def.model` overrides the model\n * (`\"inherit\"` keeps the parent's), and `def.tools` scopes the child to that\n * subset of the parent's tools (absent → the parent's full toolset, per the\n * `AgentDefinition.tools` contract).\n *\n * M33 — per-subagent `model` (with reasoning `params`) and `sandbox` are now wired\n * into local delegation: each is carried onto the {@link SubAgentSpec} and applied to\n * the child in {@link buildChildCreateOptions}. `\"inherit\"` (or an absent field) keeps\n * the parent's value. Per-subagent `mcp` is rejected at load (see subagents-loader) —\n * resolving server names→config on the local path is a follow-up.\n *\n * @internal\n */\nexport function subAgentToolsFromDefinitions(\n  agents: Record<string, AgentDefinition>,\n  parentTools: readonly CustomTool[],\n): CustomTool[] {\n  return Object.entries(agents).map(([name, def]) => {\n    const whitelist =\n      Array.isArray(def.tools) && def.tools.length > 0 ? new Set(def.tools) : undefined;\n    const childTools = whitelist ? parentTools.filter((t) => whitelist.has(t.name)) : parentTools;\n    return defineSubAgent({\n      name,\n      description: def.description,\n      instructions: def.prompt,\n      // Carry the FULL ModelSelection (id + reasoning params), not just the id, so\n      // per-subagent reasoning effort survives to buildChildCreateOptions.\n      ...(def.model !== undefined && def.model !== \"inherit\" ? { model: def.model } : {}),\n      ...(def.sandbox !== undefined ? { sandbox: def.sandbox } : {}),\n      tools: [...childTools],\n    });\n  });\n}\n"]}

package/dist/{chunk-QWD4RDZ3.cjs → chunk-XDUGSTYJ.cjs}

@@ -1,10 +1,10 @@
 'use strict';
 
-var chunk7JJ3A6AT_cjs = require('./chunk-7JJ3A6AT.cjs');
-var chunkJ7J7J2GN_cjs = require('./chunk-J7J7J2GN.cjs');
+var chunkD5KXKBEN_cjs = require('./chunk-D5KXKBEN.cjs');
+var chunkUNFBHV46_cjs = require('./chunk-UNFBHV46.cjs');
 
 // src/generate-object.ts
-var GenerateObjectError = class extends chunkJ7J7J2GN_cjs.StructuredOutputError {
+var GenerateObjectError = class extends chunkUNFBHV46_cjs.StructuredOutputError {
   name = "GenerateObjectError";
 };
 function salvagePartial(schema, raw) {
@@ -35,11 +35,11 @@ async function runReasoningPhase(options, deps) {
     const text = result.result;
     return typeof text === "string" ? text : options.prompt;
   } finally {
-    await chunk7JJ3A6AT_cjs.disposeAndDeleteTransient(reasoningAgent, deps.delete);
+    await chunkD5KXKBEN_cjs.disposeAndDeleteTransient(reasoningAgent, deps.delete);
   }
 }
 async function generateObjectImpl(options, deps) {
-  const { jsonSchema, maxRetries, initialUsage } = chunk7JJ3A6AT_cjs.setupStructuredOutput(
+  const { jsonSchema, maxRetries, initialUsage } = chunkD5KXKBEN_cjs.setupStructuredOutput(
     options.schema,
     options.maxRetries
   );
@@ -54,7 +54,7 @@ async function generateObjectImpl(options, deps) {
     captured;
     [sentinel] = true;
   }
-  const outputTool = chunk7JJ3A6AT_cjs.makeOutputTool(jsonSchema, (input) => {
+  const outputTool = chunkD5KXKBEN_cjs.makeOutputTool(jsonSchema, (input) => {
     if (capturedRaw === void 0) {
       capturedRaw = input;
     }
@@ -63,7 +63,7 @@ async function generateObjectImpl(options, deps) {
   const reasoningText = options.structuringModel !== void 0 ? await runReasoningPhase(options, deps) : void 0;
   const structuringModel = options.structuringModel ?? options.model;
   const structuringPrompt = reasoningText ?? options.prompt;
-  const agentOptions = chunk7JJ3A6AT_cjs.buildTransientAgentOptions({
+  const agentOptions = chunkD5KXKBEN_cjs.buildTransientAgentOptions({
     model: structuringModel,
     local: options.local,
     outputTool,
@@ -73,23 +73,23 @@ async function generateObjectImpl(options, deps) {
   });
   const agent = await deps.create(agentOptions);
   try {
-    const userMessage = chunk7JJ3A6AT_cjs.buildToolPrompt(structuringPrompt);
+    const userMessage = chunkD5KXKBEN_cjs.buildToolPrompt(structuringPrompt);
     let lastParseError;
     for (let attempt = 0; attempt <= maxRetries; attempt += 1) {
       capturedRaw = void 0;
       const run = await agent.send(userMessage);
       const result = await run.wait();
-      lastUsage = chunk7JJ3A6AT_cjs.extractUsage(result);
+      lastUsage = chunkD5KXKBEN_cjs.extractUsage(result);
       if (capturedRaw === void 0) {
         if (result.status === "error" && result.error !== void 0) {
           throw new GenerateObjectError(
             "no_tool_call",
-            chunk7JJ3A6AT_cjs.STRUCTURED_OUTPUT_MESSAGES.runFailed(result.error.message, result.error.code),
+            chunkD5KXKBEN_cjs.STRUCTURED_OUTPUT_MESSAGES.runFailed(result.error.message, result.error.code),
             result.error
           );
         }
         if (attempt === maxRetries) {
-          throw new GenerateObjectError("no_tool_call", chunk7JJ3A6AT_cjs.STRUCTURED_OUTPUT_MESSAGES.noToolCall);
+          throw new GenerateObjectError("no_tool_call", chunkD5KXKBEN_cjs.STRUCTURED_OUTPUT_MESSAGES.noToolCall);
         }
         continue;
       }
@@ -122,15 +122,15 @@ async function generateObjectImpl(options, deps) {
     }
     throw new GenerateObjectError(
       "parse_failed",
-      chunk7JJ3A6AT_cjs.STRUCTURED_OUTPUT_MESSAGES.parseFailed,
+      chunkD5KXKBEN_cjs.STRUCTURED_OUTPUT_MESSAGES.parseFailed,
       lastParseError
     );
   } finally {
-    await chunk7JJ3A6AT_cjs.disposeAndDeleteTransient(agent, deps.delete);
+    await chunkD5KXKBEN_cjs.disposeAndDeleteTransient(agent, deps.delete);
   }
 }
 
 exports.GenerateObjectError = GenerateObjectError;
 exports.generateObjectImpl = generateObjectImpl;
-//# sourceMappingURL=chunk-QWD4RDZ3.cjs.map
-//# sourceMappingURL=chunk-QWD4RDZ3.cjs.map
+//# sourceMappingURL=chunk-XDUGSTYJ.cjs.map
+//# sourceMappingURL=chunk-XDUGSTYJ.cjs.map

package/dist/{chunk-QWD4RDZ3.cjs.map → chunk-XDUGSTYJ.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/generate-object.ts"],"names":["StructuredOutputError","disposeAndDeleteTransient","setupStructuredOutput","makeOutputTool","buildTransientAgentOptions","buildToolPrompt","extractUsage","STRUCTURED_OUTPUT_MESSAGES"],"mappings":";;;;;;AA0FO,IAAM,mBAAA,GAAN,cAAkCA,uCAAA,CAAsB;AAAA,EAC3C,IAAA,GAAO,qBAAA;AAC3B;AAaA,SAAS,cAAA,CAAkC,QAAW,GAAA,EAAuB;AAC3E,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,MAAM,OAAO,GAAA;AACpD,EAAA,MAAM,QAAS,MAAA,CAA+C,KAAA;AAC9D,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,OAAO,KAAA,KAAU,UAAU,OAAO,GAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,GAAA;AACf,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,WAAW,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AACtD,IAAA,IAAI,OAAO,WAAA,EAAa,SAAA,KAAc,UAAA,EAAY;AAClD,IAAA,MAAM,MAAA,GAAS,WAAA,CAAY,SAAA,CAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAChD,IAAA,IAAI,MAAA,CAAO,OAAA,EAAS,GAAA,CAAI,GAAG,IAAI,MAAA,CAAO,IAAA;AAAA,EACxC;AACA,EAAA,OAAO,GAAA;AACT;AAOA,eAAe,iBAAA,CACb,SACA,IAAA,EACiB;AACjB,EAAA,MAAM,gBAAA,GAAiC;AAAA,IACrC,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,GAAI,QAAQ,YAAA,KAAiB,MAAA,GAAY,EAAE,YAAA,EAAc,OAAA,CAAQ,YAAA,EAAa,GAAI,EAAC;AAAA,IACnF,GAAI,QAAQ,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAO,GAAI,EAAC;AAAA,IACjE,GAAI,QAAQ,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,EAAW,OAAA,CAAQ,SAAA,EAAU,GAAI;AAAC,GAC5E;AACA,EAAA,MAAM,cAAA,GAAiB,MAAM,IAAA,CAAK,MAAA,CAAO,gBAAgB,CAAA;AACzD,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,cAAA,CAAe,IAAA,CAAK,QAAQ,MAAM,CAAA;AACpD,IAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,IAAA,MAAM,OAAQ,MAAA,CAAgC,MAAA;AAC9C,IAAA,OAAO,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,OAAA,CAAQ,MAAA;AAAA,EACnD,CAAA,SAAE;AACA,IAAA,MAAMC,2CAAA,CAA0B,cAAA,EAAgB,IAAA,CAAK,MAAM,CAAA;AAAA,EAC7D;AACF;AAuBA,eAAsB,kBAAA,CACpB,SACA,IAAA,EACsD;AACtD,EAAA,MAAM,EAAE,UAAA,EAAY,UAAA,EAAY,YAAA,EAAa,GAAIC,uCAAA;AAAA,IAC/C,OAAA,CAAQ,MAAA;AAAA,IACR,OAAA,CAAQ;AAAA,GACV;AACA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI,SAAA,GAAY,YAAA;AAChB,EAAA,MAAM,QAAA,0BAAkB,0BAA0B,CAAA;AAAA,EAClD,MAAM,wBAAwB,KAAA,CAAM;AAAA,IAElC,YAA4B,QAAA,EAAmB;AAC7C,MAAA,KAAA,CAAM,yBAAyB,CAAA;AADL,MAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,IAE5B;AAAA,IAF4B,QAAA;AAAA,IAD5B,CAAU,QAAQ,IAAI,IAAA;AAAA;AAMxB,EAAA,MAAM,UAAA,GAAaC,gCAAA,CAAe,UAAA,EAAY,CAAC,KAAA,KAAU;AAGvD,IAAA,IAAI,gBAAgB,MAAA,EAAW;AAC7B,MAAA,WAAA,GAAc,KAAA;AAAA,IAChB;AACA,IAAA,MAAM,IAAI,gBAAgB,KAAK,CAAA;AAAA,EACjC,CAAC,CAAA;AAID,EAAA,MAAM,aAAA,GACJ,QAAQ,gBAAA,KAAqB,MAAA,GAAY,MAAM,iBAAA,CAAkB,OAAA,EAAS,IAAI,CAAA,GAAI,MAAA;AACpF,EAAA,MAAM,gBAAA,GAAmB,OAAA,CAAQ,gBAAA,IAAoB,OAAA,CAAQ,KAAA;AAC7D,EAAA,MAAM,iBAAA,GAAoB,iBAAiB,OAAA,CAAQ,MAAA;AAEnD,EAAA,MAAM,eAA6BC,4CAAA,CAA2B;AAAA,IAC5D,KAAA,EAAO,gBAAA;AAAA,IACP,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,UAAA;AAAA,IACA,GAAI,QAAQ,YAAA,KAAiB,MAAA,GAAY,EAAE,YAAA,EAAc,OAAA,CAAQ,YAAA,EAAa,GAAI,EAAC;AAAA,IACnF,GAAI,QAAQ,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAO,GAAI,EAAC;AAAA,IACjE,GAAI,QAAQ,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,EAAW,OAAA,CAAQ,SAAA,EAAU,GAAI;AAAC,GAC3E,CAAA;AACD,EAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAE5C,EAAA,IAAI;AACF,IAAA,MAAM,WAAA,GAAcC,kCAAgB,iBAAiB,CAAA;AACrD,IAAA,IAAI,cAAA;AAEJ,IAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,UAAA,EAAY,WAAW,CAAA,EAAG;AACzD,MAAA,WAAA,GAAc,KAAA,CAAA;AACd,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,IAAA,CAAK,WAAW,CAAA;AACxC,MAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,MAAA,SAAA,GAAYC,+BAAa,MAAM,CAAA;AAE/B,MAAA,IAAI,gBAAgB,KAAA,CAAA,EAAW;AAI7B,QAAA,IAAI,MAAA,CAAO,MAAA,KAAW,OAAA,IAAW,MAAA,CAAO,UAAU,KAAA,CAAA,EAAW;AAC3D,UAAA,MAAM,IAAI,mBAAA;AAAA,YACR,cAAA;AAAA,YACAC,6CAA2B,SAAA,CAAU,MAAA,CAAO,MAAM,OAAA,EAAS,MAAA,CAAO,MAAM,IAAI,CAAA;AAAA,YAC5E,MAAA,CAAO;AAAA,WACT;AAAA,QACF;AAEA,QAAA,IAAI,YAAY,UAAA,EAAY;AAC1B,UAAA,MAAM,IAAI,mBAAA,CAAoB,cAAA,EAAgBA,4CAAA,CAA2B,UAAU,CAAA;AAAA,QACrF;AACA,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,SAAA,CAAU,WAAW,CAAA;AACnD,MAAA,IAAI,OAAO,OAAA,EAAS;AAClB,QAAA,OAAO;AAAA,UACL,QAAQ,MAAA,CAAO,IAAA;AAAA,UACf,GAAA,EAAK,WAAA;AAAA,UACL,KAAA,EAAO,SAAA;AAAA,UACP,YAAA,EAAc;AAAA,SAChB;AAAA,MACF;AACA,MAAA,cAAA,GAAiB,MAAA,CAAO,KAAA;AAAA,IAC1B;AAIA,IAAA,IAAI,OAAA,CAAQ,kBAAkB,YAAA,EAAc;AAC1C,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,WAAA;AAAA,QACR,GAAA,EAAK,WAAA;AAAA,QACL,KAAA,EAAO,SAAA;AAAA,QACP,YAAA,EAAc;AAAA,OAChB;AAAA,IACF;AACA,IAAA,IAAI,OAAA,CAAQ,kBAAkB,gBAAA,EAAkB;AAC9C,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,cAAA,CAAe,OAAA,CAAQ,MAAA,EAAQ,WAAW,CAAA;AAAA,QAClD,GAAA,EAAK,WAAA;AAAA,QACL,KAAA,EAAO,SAAA;AAAA,QACP,YAAA,EAAc;AAAA,OAChB;AAAA,IACF;AACA,IAAA,MAAM,IAAI,mBAAA;AAAA,MACR,cAAA;AAAA,MACAA,4CAAA,CAA2B,WAAA;AAAA,MAC3B;AAAA,KACF;AAAA,EACF,CAAA,SAAE;AAGA,IAAA,MAAMN,2CAAA,CAA0B,KAAA,EAAO,IAAA,CAAK,MAAM,CAAA;AAAA,EACpD;AACF","file":"chunk-QWD4RDZ3.cjs","sourcesContent":["import type { z as ZodNamespace, ZodType } from \"zod\";\nimport { StructuredOutputError } from \"./errors.js\";\nimport {\n  buildToolPrompt,\n  buildTransientAgentOptions,\n  disposeAndDeleteTransient,\n  extractUsage,\n  makeOutputTool,\n  STRUCTURED_OUTPUT_MESSAGES,\n  setupStructuredOutput,\n} from \"./internal/structured-output-helpers.js\";\nimport type { AgentOptions, LocalOptions, ModelSelection, SDKAgent } from \"./types/agent.js\";\nimport type { ProviderRoutingSettings } from \"./types/providers.js\";\n\n/**\n * Options accepted by {@link Agent.generateObject}. Returns a typed object\n * matching the supplied Zod schema. See ADR D33.\n *\n * @public\n */\nexport interface GenerateObjectOptions<T extends ZodType> {\n  /** Zod schema describing the expected object shape. */\n  schema: T;\n  /** User prompt — the model is asked to fill the schema given this prompt. */\n  prompt: string;\n  /** Optional system prompt steering the model. */\n  systemPrompt?: string;\n  /** Model selection. Required (transient agents need a model). SE8 — accepts a\n   *  bare-string id shorthand (`\"openai/gpt-4o-mini\"`) or a {@link ModelSelection}. */\n  model: string | ModelSelection;\n  /**\n   * M21 — optional separate model for the STRUCTURING step. When set, `model` first produces a\n   * free-text reasoned answer to the prompt (phase 1), then `structuringModel` extracts the\n   * schema-matched object by calling the `output` tool over that answer (phase 2). Lets a large\n   * model reason while a cheap fast model does the extraction. Absent ⇒ today's single-model flow.\n   */\n  structuringModel?: string | ModelSelection;\n  /** API key. Falls back to env (THEOKIT_API_KEY etc). */\n  apiKey?: string;\n  /** Local runtime config (cwd, sandbox). Required to keep the transient agent local-only. */\n  local: LocalOptions;\n  /**\n   * Retry budget on parse failures. Default 1 (initial attempt + 1 retry).\n   * The transient agent is REUSED across retries so the registry sees a\n   * single entry (EC-3).\n   */\n  maxRetries?: number;\n  /**\n   * Optional provider routing forwarded to the transient agent. Required when\n   * `model.id` uses a prefix (e.g. `openai/gpt-4o-mini`) but the credential is\n   * for a unified gateway (e.g. OpenRouter). Without this, the SDK infers\n   * provider from the prefix and may fail with `provider_unresolved` even\n   * when the right env key is set under a different provider name.\n   */\n  providers?: ProviderRoutingSettings;\n  /**\n   * What to do when the model's output fails schema validation after all\n   * retries are exhausted (M14):\n   * - `'throw'` (default) — throw {@link GenerateObjectError} `parse_failed`.\n   * - `'return-raw'` — resolve with the raw, UNVALIDATED input the model sent\n   *   (`object` may not match the schema; inspect `raw` too).\n   * - `'return-partial'` — for object schemas, resolve with only the fields that\n   *   individually validate (best-effort salvage); non-object schemas fall back\n   *   to raw.\n   */\n  errorStrategy?: \"throw\" | \"return-partial\" | \"return-raw\";\n}\n\n/**\n * Successful return from {@link Agent.generateObject}.\n *\n * @public\n */\nexport interface GenerateObjectResult<T> {\n  /** Typed object parsed via the Zod schema. */\n  object: T;\n  /** Raw input the model passed to the synthetic tool, before Zod parse. */\n  raw: unknown;\n  /** Token usage of the LLM call(s) that produced the result. */\n  usage: { inputTokens: number; outputTokens: number };\n  /** Stop reason of the underlying agent run. */\n  finishReason: \"tool_use\" | \"error\";\n}\n\n/**\n * Typed error thrown by {@link Agent.generateObject} when the model refuses\n * to call the synthetic `output` tool or when retries are exhausted.\n *\n * @public\n */\nexport class GenerateObjectError extends StructuredOutputError {\n  override readonly name = \"GenerateObjectError\";\n}\n\ninterface GenerateObjectDeps {\n  create: (options: AgentOptions) => Promise<SDKAgent>;\n  /** Hard-delete the transient agent from the registry after dispose. */\n  delete: (agentId: string) => Promise<void>;\n}\n\n/**\n * M14 — best-effort partial salvage for `errorStrategy: 'return-partial'`. For an object schema,\n * keep only the fields that individually validate; anything else (non-object schema or non-object\n * raw) falls back to the raw value. Works across Zod v3/v4 via the `.shape` record both expose.\n */\nfunction salvagePartial<T extends ZodType>(schema: T, raw: unknown): unknown {\n  if (typeof raw !== \"object\" || raw === null) return raw;\n  const shape = (schema as { shape?: Record<string, ZodType> }).shape;\n  if (shape === undefined || typeof shape !== \"object\") return raw;\n  const rawObj = raw as Record<string, unknown>;\n  const out: Record<string, unknown> = {};\n  for (const [key, fieldSchema] of Object.entries(shape)) {\n    if (typeof fieldSchema?.safeParse !== \"function\") continue;\n    const parsed = fieldSchema.safeParse(rawObj[key]);\n    if (parsed.success) out[key] = parsed.data;\n  }\n  return out;\n}\n\n/**\n * M21 — phase 1: run `options.model` as a plain reasoning agent (no output tool) and return its\n * free-text answer, which phase 2's structuring model then extracts. The transient reasoning agent\n * is disposed + hard-deleted so the registry count stays stable (EC-3, mirrors the phase-2 finally).\n */\nasync function runReasoningPhase<T extends ZodType>(\n  options: GenerateObjectOptions<T>,\n  deps: GenerateObjectDeps,\n): Promise<string> {\n  const reasoningOptions: AgentOptions = {\n    model: options.model,\n    local: options.local,\n    ...(options.systemPrompt !== undefined ? { systemPrompt: options.systemPrompt } : {}),\n    ...(options.apiKey !== undefined ? { apiKey: options.apiKey } : {}),\n    ...(options.providers !== undefined ? { providers: options.providers } : {}),\n  };\n  const reasoningAgent = await deps.create(reasoningOptions);\n  try {\n    const run = await reasoningAgent.send(options.prompt);\n    const result = await run.wait();\n    const text = (result as { result?: unknown }).result;\n    return typeof text === \"string\" ? text : options.prompt;\n  } finally {\n    await disposeAndDeleteTransient(reasoningAgent, deps.delete);\n  }\n}\n\n/**\n * Implementation of `Agent.generateObject`. Receives the `Agent.create`\n * factory as a callback to keep the dependency graph acyclic (mirrors the\n * AgentBuilder pattern in D25 / agent.ts injection).\n *\n * Algorithm:\n *   1. Convert the consumer's Zod schema to JSON Schema.\n *   2. Build a single synthetic `output` CustomTool whose handler captures\n *      the raw input and short-circuits the agent loop. The handler\n *      THROWS a sentinel so the loop terminates immediately without a\n *      second LLM round-trip.\n *   3. Create ONE transient agent (per the entire generateObject call,\n *      not per retry — EC-3). Each retry re-sends through the same agent,\n *      driving fresh LLM rounds.\n *   4. On each attempt, send a wrapper prompt instructing the model to\n *      call the `output` tool. Capture the raw input via the sentinel.\n *   5. Parse the raw input via schema.parse. On success, return typed.\n *      On failure, retry until the budget is exhausted.\n *   6. Always dispose the transient agent in `finally`.\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: retry loop + capture sentinel + dispose-and-delete is a single transaction; splitting harms locality and the finally block.\nexport async function generateObjectImpl<T extends ZodType>(\n  options: GenerateObjectOptions<T>,\n  deps: GenerateObjectDeps,\n): Promise<GenerateObjectResult<ZodNamespace.infer<T>>> {\n  const { jsonSchema, maxRetries, initialUsage } = setupStructuredOutput(\n    options.schema,\n    options.maxRetries,\n  );\n  let capturedRaw: unknown;\n  let lastUsage = initialUsage;\n  const sentinel = Symbol(\"generate-object-sentinel\");\n  class CaptureSentinel extends Error {\n    readonly [sentinel] = true;\n    constructor(public readonly captured: unknown) {\n      super(\"generate-object-capture\");\n    }\n  }\n\n  const outputTool = makeOutputTool(jsonSchema, (input) => {\n    // EC-D10 (parallel tool use): first capture wins. Subsequent calls\n    // in the same response are ignored.\n    if (capturedRaw === undefined) {\n      capturedRaw = input;\n    }\n    throw new CaptureSentinel(input);\n  });\n\n  // M21 — when a separate structuring model is set, `model` first reasons in free text (phase 1),\n  // and `structuringModel` extracts the object over that text (phase 2). Absent ⇒ single-model flow.\n  const reasoningText =\n    options.structuringModel !== undefined ? await runReasoningPhase(options, deps) : undefined;\n  const structuringModel = options.structuringModel ?? options.model;\n  const structuringPrompt = reasoningText ?? options.prompt;\n\n  const agentOptions: AgentOptions = buildTransientAgentOptions({\n    model: structuringModel,\n    local: options.local,\n    outputTool,\n    ...(options.systemPrompt !== undefined ? { systemPrompt: options.systemPrompt } : {}),\n    ...(options.apiKey !== undefined ? { apiKey: options.apiKey } : {}),\n    ...(options.providers !== undefined ? { providers: options.providers } : {}),\n  });\n  const agent = await deps.create(agentOptions);\n\n  try {\n    const userMessage = buildToolPrompt(structuringPrompt);\n    let lastParseError: unknown;\n\n    for (let attempt = 0; attempt <= maxRetries; attempt += 1) {\n      capturedRaw = undefined;\n      const run = await agent.send(userMessage);\n      const result = await run.wait();\n      lastUsage = extractUsage(result);\n\n      if (capturedRaw === undefined) {\n        // EC: when the underlying run errored (e.g. provider_unresolved),\n        // surface the original cause instead of the misleading \"model\n        // returned text\" message — there was no model call at all.\n        if (result.status === \"error\" && result.error !== undefined) {\n          throw new GenerateObjectError(\n            \"no_tool_call\",\n            STRUCTURED_OUTPUT_MESSAGES.runFailed(result.error.message, result.error.code),\n            result.error,\n          );\n        }\n        // Model didn't call the output tool.\n        if (attempt === maxRetries) {\n          throw new GenerateObjectError(\"no_tool_call\", STRUCTURED_OUTPUT_MESSAGES.noToolCall);\n        }\n        continue;\n      }\n\n      const parsed = options.schema.safeParse(capturedRaw);\n      if (parsed.success) {\n        return {\n          object: parsed.data,\n          raw: capturedRaw,\n          usage: lastUsage,\n          finishReason: \"tool_use\",\n        };\n      }\n      lastParseError = parsed.error;\n    }\n\n    // M14 — all retries exhausted with a parse failure. `errorStrategy` decides the outcome; the\n    // tool WAS called (capturedRaw is set), so `finishReason` stays `tool_use`.\n    if (options.errorStrategy === \"return-raw\") {\n      return {\n        object: capturedRaw as ZodNamespace.infer<T>,\n        raw: capturedRaw,\n        usage: lastUsage,\n        finishReason: \"tool_use\",\n      };\n    }\n    if (options.errorStrategy === \"return-partial\") {\n      return {\n        object: salvagePartial(options.schema, capturedRaw) as ZodNamespace.infer<T>,\n        raw: capturedRaw,\n        usage: lastUsage,\n        finishReason: \"tool_use\",\n      };\n    }\n    throw new GenerateObjectError(\n      \"parse_failed\",\n      STRUCTURED_OUTPUT_MESSAGES.parseFailed,\n      lastParseError,\n    );\n  } finally {\n    // EC-3: dispose AND hard-delete the transient agent so registry count\n    // stays stable across retries.\n    await disposeAndDeleteTransient(agent, deps.delete);\n  }\n}\n"]}
+{"version":3,"sources":["../src/generate-object.ts"],"names":["StructuredOutputError","disposeAndDeleteTransient","setupStructuredOutput","makeOutputTool","buildTransientAgentOptions","buildToolPrompt","extractUsage","STRUCTURED_OUTPUT_MESSAGES"],"mappings":";;;;;;AA0FO,IAAM,mBAAA,GAAN,cAAkCA,uCAAA,CAAsB;AAAA,EAC3C,IAAA,GAAO,qBAAA;AAC3B;AAaA,SAAS,cAAA,CAAkC,QAAW,GAAA,EAAuB;AAC3E,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,MAAM,OAAO,GAAA;AACpD,EAAA,MAAM,QAAS,MAAA,CAA+C,KAAA;AAC9D,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,OAAO,KAAA,KAAU,UAAU,OAAO,GAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,GAAA;AACf,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,WAAW,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AACtD,IAAA,IAAI,OAAO,WAAA,EAAa,SAAA,KAAc,UAAA,EAAY;AAClD,IAAA,MAAM,MAAA,GAAS,WAAA,CAAY,SAAA,CAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAChD,IAAA,IAAI,MAAA,CAAO,OAAA,EAAS,GAAA,CAAI,GAAG,IAAI,MAAA,CAAO,IAAA;AAAA,EACxC;AACA,EAAA,OAAO,GAAA;AACT;AAOA,eAAe,iBAAA,CACb,SACA,IAAA,EACiB;AACjB,EAAA,MAAM,gBAAA,GAAiC;AAAA,IACrC,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,GAAI,QAAQ,YAAA,KAAiB,MAAA,GAAY,EAAE,YAAA,EAAc,OAAA,CAAQ,YAAA,EAAa,GAAI,EAAC;AAAA,IACnF,GAAI,QAAQ,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAO,GAAI,EAAC;AAAA,IACjE,GAAI,QAAQ,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,EAAW,OAAA,CAAQ,SAAA,EAAU,GAAI;AAAC,GAC5E;AACA,EAAA,MAAM,cAAA,GAAiB,MAAM,IAAA,CAAK,MAAA,CAAO,gBAAgB,CAAA;AACzD,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,cAAA,CAAe,IAAA,CAAK,QAAQ,MAAM,CAAA;AACpD,IAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,IAAA,MAAM,OAAQ,MAAA,CAAgC,MAAA;AAC9C,IAAA,OAAO,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,OAAA,CAAQ,MAAA;AAAA,EACnD,CAAA,SAAE;AACA,IAAA,MAAMC,2CAAA,CAA0B,cAAA,EAAgB,IAAA,CAAK,MAAM,CAAA;AAAA,EAC7D;AACF;AAuBA,eAAsB,kBAAA,CACpB,SACA,IAAA,EACsD;AACtD,EAAA,MAAM,EAAE,UAAA,EAAY,UAAA,EAAY,YAAA,EAAa,GAAIC,uCAAA;AAAA,IAC/C,OAAA,CAAQ,MAAA;AAAA,IACR,OAAA,CAAQ;AAAA,GACV;AACA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI,SAAA,GAAY,YAAA;AAChB,EAAA,MAAM,QAAA,0BAAkB,0BAA0B,CAAA;AAAA,EAClD,MAAM,wBAAwB,KAAA,CAAM;AAAA,IAElC,YAA4B,QAAA,EAAmB;AAC7C,MAAA,KAAA,CAAM,yBAAyB,CAAA;AADL,MAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,IAE5B;AAAA,IAF4B,QAAA;AAAA,IAD5B,CAAU,QAAQ,IAAI,IAAA;AAAA;AAMxB,EAAA,MAAM,UAAA,GAAaC,gCAAA,CAAe,UAAA,EAAY,CAAC,KAAA,KAAU;AAGvD,IAAA,IAAI,gBAAgB,MAAA,EAAW;AAC7B,MAAA,WAAA,GAAc,KAAA;AAAA,IAChB;AACA,IAAA,MAAM,IAAI,gBAAgB,KAAK,CAAA;AAAA,EACjC,CAAC,CAAA;AAID,EAAA,MAAM,aAAA,GACJ,QAAQ,gBAAA,KAAqB,MAAA,GAAY,MAAM,iBAAA,CAAkB,OAAA,EAAS,IAAI,CAAA,GAAI,MAAA;AACpF,EAAA,MAAM,gBAAA,GAAmB,OAAA,CAAQ,gBAAA,IAAoB,OAAA,CAAQ,KAAA;AAC7D,EAAA,MAAM,iBAAA,GAAoB,iBAAiB,OAAA,CAAQ,MAAA;AAEnD,EAAA,MAAM,eAA6BC,4CAAA,CAA2B;AAAA,IAC5D,KAAA,EAAO,gBAAA;AAAA,IACP,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,UAAA;AAAA,IACA,GAAI,QAAQ,YAAA,KAAiB,MAAA,GAAY,EAAE,YAAA,EAAc,OAAA,CAAQ,YAAA,EAAa,GAAI,EAAC;AAAA,IACnF,GAAI,QAAQ,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAO,GAAI,EAAC;AAAA,IACjE,GAAI,QAAQ,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,EAAW,OAAA,CAAQ,SAAA,EAAU,GAAI;AAAC,GAC3E,CAAA;AACD,EAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAE5C,EAAA,IAAI;AACF,IAAA,MAAM,WAAA,GAAcC,kCAAgB,iBAAiB,CAAA;AACrD,IAAA,IAAI,cAAA;AAEJ,IAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,UAAA,EAAY,WAAW,CAAA,EAAG;AACzD,MAAA,WAAA,GAAc,KAAA,CAAA;AACd,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,IAAA,CAAK,WAAW,CAAA;AACxC,MAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,MAAA,SAAA,GAAYC,+BAAa,MAAM,CAAA;AAE/B,MAAA,IAAI,gBAAgB,KAAA,CAAA,EAAW;AAI7B,QAAA,IAAI,MAAA,CAAO,MAAA,KAAW,OAAA,IAAW,MAAA,CAAO,UAAU,KAAA,CAAA,EAAW;AAC3D,UAAA,MAAM,IAAI,mBAAA;AAAA,YACR,cAAA;AAAA,YACAC,6CAA2B,SAAA,CAAU,MAAA,CAAO,MAAM,OAAA,EAAS,MAAA,CAAO,MAAM,IAAI,CAAA;AAAA,YAC5E,MAAA,CAAO;AAAA,WACT;AAAA,QACF;AAEA,QAAA,IAAI,YAAY,UAAA,EAAY;AAC1B,UAAA,MAAM,IAAI,mBAAA,CAAoB,cAAA,EAAgBA,4CAAA,CAA2B,UAAU,CAAA;AAAA,QACrF;AACA,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,SAAA,CAAU,WAAW,CAAA;AACnD,MAAA,IAAI,OAAO,OAAA,EAAS;AAClB,QAAA,OAAO;AAAA,UACL,QAAQ,MAAA,CAAO,IAAA;AAAA,UACf,GAAA,EAAK,WAAA;AAAA,UACL,KAAA,EAAO,SAAA;AAAA,UACP,YAAA,EAAc;AAAA,SAChB;AAAA,MACF;AACA,MAAA,cAAA,GAAiB,MAAA,CAAO,KAAA;AAAA,IAC1B;AAIA,IAAA,IAAI,OAAA,CAAQ,kBAAkB,YAAA,EAAc;AAC1C,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,WAAA;AAAA,QACR,GAAA,EAAK,WAAA;AAAA,QACL,KAAA,EAAO,SAAA;AAAA,QACP,YAAA,EAAc;AAAA,OAChB;AAAA,IACF;AACA,IAAA,IAAI,OAAA,CAAQ,kBAAkB,gBAAA,EAAkB;AAC9C,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,cAAA,CAAe,OAAA,CAAQ,MAAA,EAAQ,WAAW,CAAA;AAAA,QAClD,GAAA,EAAK,WAAA;AAAA,QACL,KAAA,EAAO,SAAA;AAAA,QACP,YAAA,EAAc;AAAA,OAChB;AAAA,IACF;AACA,IAAA,MAAM,IAAI,mBAAA;AAAA,MACR,cAAA;AAAA,MACAA,4CAAA,CAA2B,WAAA;AAAA,MAC3B;AAAA,KACF;AAAA,EACF,CAAA,SAAE;AAGA,IAAA,MAAMN,2CAAA,CAA0B,KAAA,EAAO,IAAA,CAAK,MAAM,CAAA;AAAA,EACpD;AACF","file":"chunk-XDUGSTYJ.cjs","sourcesContent":["import type { z as ZodNamespace, ZodType } from \"zod\";\nimport { StructuredOutputError } from \"./errors.js\";\nimport {\n  buildToolPrompt,\n  buildTransientAgentOptions,\n  disposeAndDeleteTransient,\n  extractUsage,\n  makeOutputTool,\n  STRUCTURED_OUTPUT_MESSAGES,\n  setupStructuredOutput,\n} from \"./internal/structured-output-helpers.js\";\nimport type { AgentOptions, LocalOptions, ModelSelection, SDKAgent } from \"./types/agent.js\";\nimport type { ProviderRoutingSettings } from \"./types/providers.js\";\n\n/**\n * Options accepted by {@link Agent.generateObject}. Returns a typed object\n * matching the supplied Zod schema. See ADR D33.\n *\n * @public\n */\nexport interface GenerateObjectOptions<T extends ZodType> {\n  /** Zod schema describing the expected object shape. */\n  schema: T;\n  /** User prompt — the model is asked to fill the schema given this prompt. */\n  prompt: string;\n  /** Optional system prompt steering the model. */\n  systemPrompt?: string;\n  /** Model selection. Required (transient agents need a model). SE8 — accepts a\n   *  bare-string id shorthand (`\"openai/gpt-4o-mini\"`) or a {@link ModelSelection}. */\n  model: string | ModelSelection;\n  /**\n   * M21 — optional separate model for the STRUCTURING step. When set, `model` first produces a\n   * free-text reasoned answer to the prompt (phase 1), then `structuringModel` extracts the\n   * schema-matched object by calling the `output` tool over that answer (phase 2). Lets a large\n   * model reason while a cheap fast model does the extraction. Absent ⇒ today's single-model flow.\n   */\n  structuringModel?: string | ModelSelection;\n  /** API key. Falls back to env (THEOKIT_API_KEY etc). */\n  apiKey?: string;\n  /** Local runtime config (cwd, sandbox). Required to keep the transient agent local-only. */\n  local: LocalOptions;\n  /**\n   * Retry budget on parse failures. Default 1 (initial attempt + 1 retry).\n   * The transient agent is REUSED across retries so the registry sees a\n   * single entry (EC-3).\n   */\n  maxRetries?: number;\n  /**\n   * Optional provider routing forwarded to the transient agent. Required when\n   * `model.id` uses a prefix (e.g. `openai/gpt-4o-mini`) but the credential is\n   * for a unified gateway (e.g. OpenRouter). Without this, the SDK infers\n   * provider from the prefix and may fail with `provider_unresolved` even\n   * when the right env key is set under a different provider name.\n   */\n  providers?: ProviderRoutingSettings;\n  /**\n   * What to do when the model's output fails schema validation after all\n   * retries are exhausted (M14):\n   * - `'throw'` (default) — throw {@link GenerateObjectError} `parse_failed`.\n   * - `'return-raw'` — resolve with the raw, UNVALIDATED input the model sent\n   *   (`object` may not match the schema; inspect `raw` too).\n   * - `'return-partial'` — for object schemas, resolve with only the fields that\n   *   individually validate (best-effort salvage); non-object schemas fall back\n   *   to raw.\n   */\n  errorStrategy?: \"throw\" | \"return-partial\" | \"return-raw\";\n}\n\n/**\n * Successful return from {@link Agent.generateObject}.\n *\n * @public\n */\nexport interface GenerateObjectResult<T> {\n  /** Typed object parsed via the Zod schema. */\n  object: T;\n  /** Raw input the model passed to the synthetic tool, before Zod parse. */\n  raw: unknown;\n  /** Token usage of the LLM call(s) that produced the result. */\n  usage: { inputTokens: number; outputTokens: number };\n  /** Stop reason of the underlying agent run. */\n  finishReason: \"tool_use\" | \"error\";\n}\n\n/**\n * Typed error thrown by {@link Agent.generateObject} when the model refuses\n * to call the synthetic `output` tool or when retries are exhausted.\n *\n * @public\n */\nexport class GenerateObjectError extends StructuredOutputError {\n  override readonly name = \"GenerateObjectError\";\n}\n\ninterface GenerateObjectDeps {\n  create: (options: AgentOptions) => Promise<SDKAgent>;\n  /** Hard-delete the transient agent from the registry after dispose. */\n  delete: (agentId: string) => Promise<void>;\n}\n\n/**\n * M14 — best-effort partial salvage for `errorStrategy: 'return-partial'`. For an object schema,\n * keep only the fields that individually validate; anything else (non-object schema or non-object\n * raw) falls back to the raw value. Works across Zod v3/v4 via the `.shape` record both expose.\n */\nfunction salvagePartial<T extends ZodType>(schema: T, raw: unknown): unknown {\n  if (typeof raw !== \"object\" || raw === null) return raw;\n  const shape = (schema as { shape?: Record<string, ZodType> }).shape;\n  if (shape === undefined || typeof shape !== \"object\") return raw;\n  const rawObj = raw as Record<string, unknown>;\n  const out: Record<string, unknown> = {};\n  for (const [key, fieldSchema] of Object.entries(shape)) {\n    if (typeof fieldSchema?.safeParse !== \"function\") continue;\n    const parsed = fieldSchema.safeParse(rawObj[key]);\n    if (parsed.success) out[key] = parsed.data;\n  }\n  return out;\n}\n\n/**\n * M21 — phase 1: run `options.model` as a plain reasoning agent (no output tool) and return its\n * free-text answer, which phase 2's structuring model then extracts. The transient reasoning agent\n * is disposed + hard-deleted so the registry count stays stable (EC-3, mirrors the phase-2 finally).\n */\nasync function runReasoningPhase<T extends ZodType>(\n  options: GenerateObjectOptions<T>,\n  deps: GenerateObjectDeps,\n): Promise<string> {\n  const reasoningOptions: AgentOptions = {\n    model: options.model,\n    local: options.local,\n    ...(options.systemPrompt !== undefined ? { systemPrompt: options.systemPrompt } : {}),\n    ...(options.apiKey !== undefined ? { apiKey: options.apiKey } : {}),\n    ...(options.providers !== undefined ? { providers: options.providers } : {}),\n  };\n  const reasoningAgent = await deps.create(reasoningOptions);\n  try {\n    const run = await reasoningAgent.send(options.prompt);\n    const result = await run.wait();\n    const text = (result as { result?: unknown }).result;\n    return typeof text === \"string\" ? text : options.prompt;\n  } finally {\n    await disposeAndDeleteTransient(reasoningAgent, deps.delete);\n  }\n}\n\n/**\n * Implementation of `Agent.generateObject`. Receives the `Agent.create`\n * factory as a callback to keep the dependency graph acyclic (mirrors the\n * AgentBuilder pattern in D25 / agent.ts injection).\n *\n * Algorithm:\n *   1. Convert the consumer's Zod schema to JSON Schema.\n *   2. Build a single synthetic `output` CustomTool whose handler captures\n *      the raw input and short-circuits the agent loop. The handler\n *      THROWS a sentinel so the loop terminates immediately without a\n *      second LLM round-trip.\n *   3. Create ONE transient agent (per the entire generateObject call,\n *      not per retry — EC-3). Each retry re-sends through the same agent,\n *      driving fresh LLM rounds.\n *   4. On each attempt, send a wrapper prompt instructing the model to\n *      call the `output` tool. Capture the raw input via the sentinel.\n *   5. Parse the raw input via schema.parse. On success, return typed.\n *      On failure, retry until the budget is exhausted.\n *   6. Always dispose the transient agent in `finally`.\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: retry loop + capture sentinel + dispose-and-delete is a single transaction; splitting harms locality and the finally block.\nexport async function generateObjectImpl<T extends ZodType>(\n  options: GenerateObjectOptions<T>,\n  deps: GenerateObjectDeps,\n): Promise<GenerateObjectResult<ZodNamespace.infer<T>>> {\n  const { jsonSchema, maxRetries, initialUsage } = setupStructuredOutput(\n    options.schema,\n    options.maxRetries,\n  );\n  let capturedRaw: unknown;\n  let lastUsage = initialUsage;\n  const sentinel = Symbol(\"generate-object-sentinel\");\n  class CaptureSentinel extends Error {\n    readonly [sentinel] = true;\n    constructor(public readonly captured: unknown) {\n      super(\"generate-object-capture\");\n    }\n  }\n\n  const outputTool = makeOutputTool(jsonSchema, (input) => {\n    // EC-D10 (parallel tool use): first capture wins. Subsequent calls\n    // in the same response are ignored.\n    if (capturedRaw === undefined) {\n      capturedRaw = input;\n    }\n    throw new CaptureSentinel(input);\n  });\n\n  // M21 — when a separate structuring model is set, `model` first reasons in free text (phase 1),\n  // and `structuringModel` extracts the object over that text (phase 2). Absent ⇒ single-model flow.\n  const reasoningText =\n    options.structuringModel !== undefined ? await runReasoningPhase(options, deps) : undefined;\n  const structuringModel = options.structuringModel ?? options.model;\n  const structuringPrompt = reasoningText ?? options.prompt;\n\n  const agentOptions: AgentOptions = buildTransientAgentOptions({\n    model: structuringModel,\n    local: options.local,\n    outputTool,\n    ...(options.systemPrompt !== undefined ? { systemPrompt: options.systemPrompt } : {}),\n    ...(options.apiKey !== undefined ? { apiKey: options.apiKey } : {}),\n    ...(options.providers !== undefined ? { providers: options.providers } : {}),\n  });\n  const agent = await deps.create(agentOptions);\n\n  try {\n    const userMessage = buildToolPrompt(structuringPrompt);\n    let lastParseError: unknown;\n\n    for (let attempt = 0; attempt <= maxRetries; attempt += 1) {\n      capturedRaw = undefined;\n      const run = await agent.send(userMessage);\n      const result = await run.wait();\n      lastUsage = extractUsage(result);\n\n      if (capturedRaw === undefined) {\n        // EC: when the underlying run errored (e.g. provider_unresolved),\n        // surface the original cause instead of the misleading \"model\n        // returned text\" message — there was no model call at all.\n        if (result.status === \"error\" && result.error !== undefined) {\n          throw new GenerateObjectError(\n            \"no_tool_call\",\n            STRUCTURED_OUTPUT_MESSAGES.runFailed(result.error.message, result.error.code),\n            result.error,\n          );\n        }\n        // Model didn't call the output tool.\n        if (attempt === maxRetries) {\n          throw new GenerateObjectError(\"no_tool_call\", STRUCTURED_OUTPUT_MESSAGES.noToolCall);\n        }\n        continue;\n      }\n\n      const parsed = options.schema.safeParse(capturedRaw);\n      if (parsed.success) {\n        return {\n          object: parsed.data,\n          raw: capturedRaw,\n          usage: lastUsage,\n          finishReason: \"tool_use\",\n        };\n      }\n      lastParseError = parsed.error;\n    }\n\n    // M14 — all retries exhausted with a parse failure. `errorStrategy` decides the outcome; the\n    // tool WAS called (capturedRaw is set), so `finishReason` stays `tool_use`.\n    if (options.errorStrategy === \"return-raw\") {\n      return {\n        object: capturedRaw as ZodNamespace.infer<T>,\n        raw: capturedRaw,\n        usage: lastUsage,\n        finishReason: \"tool_use\",\n      };\n    }\n    if (options.errorStrategy === \"return-partial\") {\n      return {\n        object: salvagePartial(options.schema, capturedRaw) as ZodNamespace.infer<T>,\n        raw: capturedRaw,\n        usage: lastUsage,\n        finishReason: \"tool_use\",\n      };\n    }\n    throw new GenerateObjectError(\n      \"parse_failed\",\n      STRUCTURED_OUTPUT_MESSAGES.parseFailed,\n      lastParseError,\n    );\n  } finally {\n    // EC-3: dispose AND hard-delete the transient agent so registry count\n    // stays stable across retries.\n    await disposeAndDeleteTransient(agent, deps.delete);\n  }\n}\n"]}

package/dist/{chunk-K2VMFZQ5.js → chunk-XKMVJ443.js}

@@ -1,7 +1,7 @@
 import { getTracer, noopSpan } from './chunk-K2BQQ445.js';
-import { createSemaphore } from './chunk-G7BLGBRN.js';
-import { InMemoryTaskStore, getTaskStoreFor, isValidTaskId } from './chunk-EIQFAOFD.js';
-import { InvalidTaskIdError, TaskNotFoundError } from './chunk-ALUN2B4W.js';
+import { createSemaphore } from './chunk-ZWFTECOE.js';
+import { InMemoryTaskStore, getTaskStoreFor, isValidTaskId } from './chunk-GGRPAQ3B.js';
+import { InvalidTaskIdError, TaskNotFoundError } from './chunk-B5MHRQJZ.js';
 import { diag } from './chunk-CZJ6Q7CW.js';
 import { AsyncLocalStorage } from 'async_hooks';
 import { randomUUID } from 'crypto';
@@ -483,5 +483,5 @@ var subscribe = buildSubscribe({
 });
 
 export { __getSubscribersCountForTests, __resetTaskRegistryForTests, cancel, configure, emitRunEvent, get, list, submit, subscribe };
-//# sourceMappingURL=chunk-K2VMFZQ5.js.map
-//# sourceMappingURL=chunk-K2VMFZQ5.js.map
+//# sourceMappingURL=chunk-XKMVJ443.js.map
+//# sourceMappingURL=chunk-XKMVJ443.js.map