theorum 0.1.3 → 0.1.4

package/esm/src/kernel/registry/ingress.js

@@ -1,163 +0,0 @@
-/**
- * Kernel ingress: input parts, image pins, and speech-role checks.
- *
- * Owned by the kernel so `resolveTurn` does not import provider adapters.
- *
- * @module
- */
-import { TheorumError } from '../../guardrails/error.js';
-import { wrapUserData } from '../engine/boundary.js';
-import { synthesizeRepairPrompt } from '../engine/repair.js';
-import { assertAttachmentLimits, requireMediaLimits } from './attachments.js';
-import { geminiKindForMime, mimeAllowed, mimeEssence } from './catalog.js';
-function listedValue(allowed, value) {
-    if (!value) {
-        return undefined;
-    }
-    if (!allowed || allowed.length === 0) {
-        return value;
-    }
-    if (allowed.includes(value)) {
-        return value;
-    }
-    return undefined;
-}
-function resolveSlotOrPin(profileId, label, slotValue, pin, allow) {
-    if (slotValue !== undefined) {
-        const fromSlot = listedValue(allow, slotValue);
-        if (!fromSlot) {
-            throw new TheorumError(`Unknown image ${label} for ${profileId}`);
-        }
-        return fromSlot;
-    }
-    if (pin === undefined) {
-        return undefined;
-    }
-    const fromPin = listedValue(allow, pin);
-    if (!fromPin) {
-        throw new TheorumError(`Unknown image ${label} for ${profileId}`);
-    }
-    return fromPin;
-}
-function assertImageRole(profile) {
-    const pins = profile.outputs.image;
-    if (!pins) {
-        throw new TheorumError(`Profile ${profile.id} requests image output but does not set outputs.image`);
-    }
-    assertExclusiveNativeOutput(profile, 'image');
-    return pins;
-}
-function assertSpeechRole(profile) {
-    if (!profile.outputs.speech) {
-        return;
-    }
-    assertExclusiveNativeOutput(profile, 'speech');
-    if (profile.outputs.speech.format === 'mp3' && profile.model.protocol === 'geminiInteractions') {
-        throw new TheorumError(`Profile ${profile.id}: outputs.speech.format 'mp3' requires protocol 'openAi' ` +
-            `(geminiInteractions speech returns PCM and emits WAV)`);
-    }
-}
-function assertExclusiveNativeOutput(profile, kind) {
-    const other = kind === 'image' ? 'speech' : 'image';
-    if (profile.outputs[other]) {
-        throw new TheorumError(`Profile ${profile.id} cannot mix outputs.${kind} with outputs.${other}`);
-    }
-    if (profile.outputs.structured !== null && profile.outputs.structured !== undefined) {
-        throw new TheorumError(`Profile ${profile.id} cannot mix structured JSON with native ${kind} output`);
-    }
-}
-function resolveImageFormat(profile, _model, slots) {
-    if (!profile.outputs.image) {
-        return null;
-    }
-    const pins = assertImageRole(profile);
-    const aspectRatio = resolveSlotOrPin(profile.id, 'aspect', slots?.aspectRatio, pins.aspectRatio, profile.inputs.slots?.aspectRatio);
-    const size = resolveSlotOrPin(profile.id, 'size', slots?.size, pins.size, profile.inputs.slots?.size);
-    if (!(aspectRatio && size)) {
-        throw new TheorumError(`Unknown image aspect or size for ${profile.id}`);
-    }
-    return {
-        type: 'image',
-        mimeType: pins.mimeType ?? 'image/jpeg',
-        aspectRatio,
-        size,
-    };
-}
-function assertGeminiMime(mime) {
-    const kind = geminiKindForMime(mime);
-    if (!kind) {
-        throw new TheorumError(`MIME '${mime}' is not a Gemini input type`);
-    }
-    return kind;
-}
-function mediaParts(profile, model, blobs, channel) {
-    const accept = channel === 'voice' ? profile.inputs.voice?.accept : profile.inputs.attachments?.accept;
-    if (!accept) {
-        throw new TheorumError(`Profile ${profile.id} does not accept ${channel}`);
-    }
-    const maxInputImages = profile.outputs.image?.maxInputImages;
-    const imageCount = blobs.filter((blob) => geminiKindForMime(blob.mimeType) === 'image').length;
-    if (maxInputImages !== undefined && imageCount > maxInputImages) {
-        throw new TheorumError(`At most ${maxInputImages} reference images on ${model}`);
-    }
-    return blobs.map((blob) => {
-        const kind = assertGeminiMime(blob.mimeType);
-        if (!mimeAllowed(accept, blob.mimeType)) {
-            throw new TheorumError(`MIME '${blob.mimeType}' is not accepted on ${profile.id}`);
-        }
-        const essence = mimeEssence(blob.mimeType);
-        return {
-            type: kind,
-            mimeType: essence === 'image/jpg' ? 'image/jpeg' : essence,
-            data: blob.data,
-        };
-    });
-}
-function extractTextPart(profile, req) {
-    const { text, repair, history } = req.input ?? {};
-    if (profile.inputs.text === false) {
-        if (text) {
-            throw new TheorumError(`Profile ${profile.id} does not accept text input`);
-        }
-        return null;
-    }
-    let promptText = text;
-    if (repair) {
-        promptText = synthesizeRepairPrompt({ profile, repair, history });
-    }
-    if (!promptText) {
-        return null;
-    }
-    return { type: 'text', text: wrapUserData(promptText) };
-}
-function extractMediaParts(profile, model, req) {
-    const { attachments, voice } = req.input ?? {};
-    const files = attachments ?? [];
-    const clips = voice ?? [];
-    if (files.length + clips.length > 0) {
-        assertAttachmentLimits([...files, ...clips], requireMediaLimits(profile));
-    }
-    const parts = [];
-    if (files.length > 0) {
-        parts.push(...mediaParts(profile, model, files, 'attachments'));
-    }
-    if (clips.length > 0) {
-        parts.push(...mediaParts(profile, model, clips, 'voice'));
-    }
-    return parts;
-}
-function resolveInputParts(profile, model, req) {
-    const parts = [];
-    const textPart = extractTextPart(profile, req);
-    if (textPart) {
-        parts.push(textPart);
-    }
-    parts.push(...extractMediaParts(profile, model, req));
-    return parts;
-}
-function assertImageGrounding(profile, model, builtins) {
-    if (profile.outputs.image?.allowsGrounding === false && builtins.length > 0) {
-        throw new TheorumError(`Grounding tools are not valid on ${model}`);
-    }
-}
-export { assertImageGrounding, assertSpeechRole, resolveImageFormat, resolveInputParts };

package/esm/src/kernel/registry/profiles.d.ts

@@ -1,34 +0,0 @@
-/**
- * Runtime profile registry for host-owned THEORUM profiles.
- *
- * THEORUM ships profile types and defaults, not application profiles. Host apps
- * register their profiles at process startup or test setup.
- *
- * @module
- */
-import type { Profile } from '../types.js';
-/** Host-authored profile definition, with defaults applied to omitted sections. */
-export type ProfileDefinition = {
-    id: Profile['id'];
-    identity?: Partial<Profile['identity']>;
-    model: Partial<Profile['model']> & Pick<Profile['model'], 'allow' | 'config'>;
-    tools?: Partial<Profile['tools']>;
-    inputs?: Partial<Profile['inputs']>;
-    outputs?: Partial<Profile['outputs']>;
-    guardrails?: Partial<Profile['guardrails']>;
-};
-/** Define a typed profile with stable defaults for optional properties. */
-declare function defineProfile(input: ProfileDefinition): Profile;
-/** Register one host-owned profile in the process-local registry. */
-declare function registerProfile(profileInput: Profile | ProfileDefinition): void;
-/** Register several host-owned profiles in order. */
-declare function registerProfiles(profilesList: Array<Profile | ProfileDefinition>): void;
-/** Return whether a profile id is currently registered. */
-declare function hasProfile(id: string): boolean;
-/** List all currently registered profiles. */
-declare function listProfiles(): Profile[];
-/** Clear the process-local registry; intended for tests and host reloads. */
-declare function clearProfiles(): void;
-/** Fetch a registered profile or throw a `TheorumError`. */
-declare function getProfile(id: string): Profile;
-export { clearProfiles, defineProfile, getProfile, hasProfile, listProfiles, registerProfile, registerProfiles, };

package/esm/src/kernel/registry/profiles.js

@@ -1,120 +0,0 @@
-/**
- * Runtime profile registry for host-owned THEORUM profiles.
- *
- * THEORUM ships profile types and defaults, not application profiles. Host apps
- * register their profiles at process startup or test setup.
- *
- * @module
- */
-import { TheorumError } from '../../guardrails/error.js';
-const profiles = new Map();
-function assertModelSpecs(profileId, allow, config) {
-    for (const id of allow) {
-        if (!config[id]) {
-            throw new TheorumError(`Profile ${profileId} allowlists '${id}' without a model spec`);
-        }
-    }
-}
-function buildDefaultIdentity(id, identity) {
-    return {
-        handle: identity?.handle ?? id,
-        chat: identity?.chat,
-        system: identity?.system,
-        systemByRole: identity?.systemByRole,
-    };
-}
-function buildDefaultModel(profileId, model) {
-    assertModelSpecs(profileId, model.allow, model.config);
-    return {
-        protocol: model.protocol ?? 'geminiInteractions',
-        provider: model.provider ?? 'google',
-        allow: model.allow,
-        config: model.config,
-        thinking: model.thinking ?? 'minimal',
-        controls: model.controls ?? [],
-        maxSteps: model.maxSteps ?? 1,
-        key: model.key ?? 'freeA',
-        select: model.select,
-    };
-}
-function buildDefaultInputs(inputs) {
-    return {
-        text: inputs?.text ?? true,
-        attachments: inputs?.attachments,
-        voice: inputs?.voice,
-        maxFiles: inputs?.maxFiles,
-        maxBytes: inputs?.maxBytes,
-        maxTurnBytes: inputs?.maxTurnBytes,
-        limitsByMime: inputs?.limitsByMime,
-        slots: inputs?.slots,
-    };
-}
-function buildDefaultOutputs(outputs) {
-    return {
-        structured: outputs?.structured ?? null,
-        image: outputs?.image,
-        speech: outputs?.speech,
-        validation: outputs?.validation,
-        streaming: outputs?.streaming,
-    };
-}
-function buildDefaultGuardrails(guardrails) {
-    return {
-        quota: guardrails?.quota,
-        canary: guardrails?.canary ?? true,
-        sanitizeInput: guardrails?.sanitizeInput ?? true,
-        redactSensitive: guardrails?.redactSensitive ?? true,
-        egress: guardrails?.egress,
-    };
-}
-/** Define a typed profile with stable defaults for optional properties. */
-function defineProfile(input) {
-    return {
-        id: input.id,
-        identity: buildDefaultIdentity(input.id, input.identity),
-        model: buildDefaultModel(input.id, input.model),
-        tools: { allow: input.tools?.allow ?? [] },
-        inputs: buildDefaultInputs(input.inputs),
-        outputs: buildDefaultOutputs(input.outputs),
-        guardrails: buildDefaultGuardrails(input.guardrails),
-    };
-}
-/** Register one host-owned profile in the process-local registry. */
-function registerProfile(profileInput) {
-    const profile = defineProfile(profileInput);
-    assertModelSpecs(profile.id, profile.model.allow, profile.model.config);
-    const { attachments, voice, maxFiles, maxBytes, maxTurnBytes } = profile.inputs;
-    if (attachments || voice) {
-        if (!(maxFiles && maxBytes && maxTurnBytes)) {
-            throw new TheorumError(`Profile ${profile.id} must set maxFiles, maxBytes, and maxTurnBytes`);
-        }
-    }
-    profiles.set(profile.id, profile);
-}
-/** Register several host-owned profiles in order. */
-function registerProfiles(profilesList) {
-    for (const p of profilesList) {
-        registerProfile(p);
-    }
-}
-/** Return whether a profile id is currently registered. */
-function hasProfile(id) {
-    return profiles.has(id);
-}
-/** List all currently registered profiles. */
-function listProfiles() {
-    return Array.from(profiles.values());
-}
-/** Clear the process-local registry; intended for tests and host reloads. */
-function clearProfiles() {
-    profiles.clear();
-}
-/** Fetch a registered profile or throw a `TheorumError`. */
-function getProfile(id) {
-    const profile = profiles.get(id);
-    if (!profile) {
-        throw new TheorumError(`Unknown profile '${id}'`);
-    }
-    return profile;
-}
-export { clearProfiles, defineProfile, getProfile, hasProfile, listProfiles, registerProfile, registerProfiles, };

package/esm/src/kernel/registry/provider-request.d.ts

@@ -1,4 +0,0 @@
-import type { ProviderCompleteRequest, ResolvedGeneration } from '../types.js';
-/** Build the provider request projection shared by execution and tracing. */
-declare function providerCompleteRequest(generation: ResolvedGeneration, system: string): ProviderCompleteRequest;
-export { providerCompleteRequest };

package/esm/src/kernel/registry/provider-request.js

@@ -1,25 +0,0 @@
-/** Build the provider request projection shared by execution and tracing. */
-function providerCompleteRequest(generation, system) {
-    return {
-        model: generation.model,
-        apiId: generation.apiId,
-        openRouterId: generation.openRouterId,
-        previousInteractionId: generation.previousInteractionId,
-        store: generation.store,
-        thinking: generation.thinking,
-        summaries: generation.summaries,
-        maxOutputTokens: generation.maxOutputTokens,
-        temperature: generation.temperature,
-        builtins: generation.builtins,
-        system,
-        input: generation.input,
-        history: generation.history,
-        dynamicTools: generation.dynamicTools,
-        dynamicToolLoader: generation.dynamicToolLoader,
-        structured: generation.structured,
-        image: generation.image,
-        speech: generation.speech,
-        geminiBucket: generation.geminiBucket,
-    };
-}
-export { providerCompleteRequest };

package/esm/src/kernel/registry/resolve.d.ts

@@ -1,19 +0,0 @@
-/**
- * Profile resolution for THEORUM turns.
- *
- * This module validates caller overrides, selects models and tools, normalizes
- * input parts, and produces the provider request state consumed by `runTurn`.
- *
- * @module
- */
-import type { Profile, ProjectedProfile, ResolvedGeneration, ToolId, TurnRequest } from '../types.js';
-declare function assertToolAllowed(profile: Profile, name: ToolId): void;
-/** Resolve a host `TurnRequest` into provider-ready generation state. */
-declare function resolveTurn(req: TurnRequest): {
-    profile: Profile;
-    generation: ResolvedGeneration;
-};
-/** Project a registered profile into a safe host/UI inspection object. */
-declare function projectProfile(id: Profile['id']): ProjectedProfile;
-declare function pickSystemRole(profile: Profile, requested?: string): string;
-export { assertToolAllowed, pickSystemRole, projectProfile, resolveTurn };

package/esm/src/kernel/registry/resolve.js

@@ -1,217 +0,0 @@
-/**
- * Profile resolution for THEORUM turns.
- *
- * This module validates caller overrides, selects models and tools, normalizes
- * input parts, and produces the provider request state consumed by `runTurn`.
- *
- * @module
- */
-import { TheorumError } from '../../guardrails/error.js';
-import { sanitizeTurnRequest } from '../../guardrails/sanitize.js';
-import { mintCanary } from '../engine/boundary.js';
-import { CATALOG, clampThinkingLevel, getTool, listBuiltinIds, requireModelSpec, } from './catalog.js';
-import { assertImageGrounding, assertSpeechRole, resolveImageFormat, resolveInputParts, } from './ingress.js';
-import { getProfile } from './profiles.js';
-import { resolveGeminiBucket } from './vault.js';
-function applyBuiltinMutualExclusions(requested) {
-    return requested.filter((id) => {
-        const conflicts = getTool(id)?.conflictsWith ?? [];
-        return !conflicts.some((other) => requested.includes(other));
-    });
-}
-function firstSelectKey(selectMap) {
-    const [key] = Object.keys(selectMap);
-    return key;
-}
-function lookupSelectId(profile, select) {
-    const { select: selectMap } = profile.model;
-    if (!selectMap) {
-        return undefined;
-    }
-    let key = select;
-    if (!key) {
-        key = firstSelectKey(selectMap);
-    }
-    if (!key) {
-        return undefined;
-    }
-    return selectMap[key];
-}
-function pickModel(profile, select) {
-    if (profile.model.select) {
-        const id = lookupSelectId(profile, select);
-        if (!(id && profile.model.allow.includes(id))) {
-            let label = '';
-            if (select) {
-                label = select;
-            }
-            throw new TheorumError(`Unknown model select '${label}' for ${profile.id}`);
-        }
-        return id;
-    }
-    const [only] = profile.model.allow;
-    if (!only) {
-        throw new TheorumError(`Profile ${profile.id} has no models`);
-    }
-    return only;
-}
-function thinkingFromControl(spec, thinkingOn) {
-    if (thinkingOn) {
-        return spec.thinking.on;
-    }
-    return spec.thinking.off;
-}
-function pinnedLevel(pinned, key) {
-    if (!key) {
-        return undefined;
-    }
-    return pinned[key];
-}
-function thinkingFromPin(profile, select) {
-    const pinned = profile.model.thinking;
-    if (typeof pinned === 'string') {
-        return pinned;
-    }
-    if (!pinned) {
-        throw new TheorumError(`Profile ${profile.id} must pin thinking or list it in controls`);
-    }
-    const fromSelect = pinnedLevel(pinned, select);
-    if (fromSelect) {
-        return fromSelect;
-    }
-    const fromFirst = pinnedLevel(pinned, firstSelectKey(profile.model.select ?? {}));
-    if (fromFirst) {
-        return fromFirst;
-    }
-    throw new TheorumError(`Profile ${profile.id} must pin thinking or list it in controls`);
-}
-function resolveThinking(profile, spec, thinkingOn, select) {
-    const raw = profile.model.controls?.includes('thinking')
-        ? thinkingFromControl(spec, thinkingOn)
-        : thinkingFromPin(profile, select);
-    return clampThinkingLevel(spec, raw);
-}
-function resolveSummaries(profile, spec, thinkingOn) {
-    if (profile.model.controls?.includes('thinking')) {
-        if (thinkingOn) {
-            return spec.summaries.on;
-        }
-        return spec.summaries.off;
-    }
-    return spec.summaries.on;
-}
-function isGatedOn(requested, id) {
-    if (!requested) {
-        return false;
-    }
-    return requested[id] === true;
-}
-function resolveBuiltins(profile, requested) {
-    const allowed = profile.tools.allow.filter((id) => CATALOG.tools[id]?.kind === 'builtin');
-    const picked = listBuiltinIds().filter((id) => allowed.includes(id) && isGatedOn(requested, id));
-    return applyBuiltinMutualExclusions(picked);
-}
-function resolveCustom(profile, requested) {
-    return profile.tools.allow.filter((id) => CATALOG.tools[id]?.kind === 'custom' && isGatedOn(requested, id));
-}
-function assertToolAllowed(profile, name) {
-    if (!profile.tools.allow.includes(name)) {
-        throw new TheorumError(`Tool '${name}' is not allowed on ${profile.id}`);
-    }
-}
-function resolveStructured(profile, slots) {
-    const { structured } = profile.outputs;
-    if (!structured) {
-        return null;
-    }
-    if (typeof structured === 'string') {
-        return structured;
-    }
-    const value = slots?.[structured.by];
-    if (value) {
-        const mapped = structured.map[value];
-        if (mapped) {
-            return mapped;
-        }
-    }
-    return structured.fallback;
-}
-/** Resolve a host `TurnRequest` into provider-ready generation state. */
-function resolveTurn(req) {
-    const safe = sanitizeTurnRequest(req);
-    const input = safe.input ?? {};
-    const profile = getProfile(safe.profile);
-    const model = pickModel(profile, safe.select);
-    const spec = requireModelSpec(profile, model);
-    const thinkingOn = safe.thinking === true;
-    const builtins = resolveBuiltins(profile, safe.tools);
-    assertImageGrounding(profile, model, builtins);
-    assertSpeechRole(profile);
-    const geminiBucket = profile.model.provider === 'google'
-        ? resolveGeminiBucket(profile.model.key ?? 'freeA', spec, builtins)
-        : undefined;
-    return {
-        profile,
-        generation: {
-            model,
-            apiId: spec.apiId,
-            openRouterId: spec.openRouterId,
-            previousInteractionId: safe.previousInteractionId,
-            store: safe.store,
-            thinking: resolveThinking(profile, spec, thinkingOn, safe.select),
-            summaries: resolveSummaries(profile, spec, thinkingOn),
-            maxOutputTokens: spec.maxOutputTokens,
-            temperature: spec.temperature,
-            builtins,
-            custom: resolveCustom(profile, safe.tools),
-            dynamicTools: safe.dynamicTools,
-            dynamicToolLoader: safe.dynamicToolLoader,
-            sessionPermissions: safe.sessionPermissions,
-            history: input.history,
-            maxSteps: profile.model.maxSteps ?? 1,
-            structured: resolveStructured(profile, input.slots),
-            image: resolveImageFormat(profile, model, input.slots),
-            speech: profile.outputs.speech,
-            input: resolveInputParts(profile, model, safe),
-            geminiBucket,
-            canary: profile.guardrails.canary !== false ? mintCanary() : '',
-        },
-    };
-}
-function primaryImageSpec(profile) {
-    return profile.outputs.image;
-}
-/** Project a registered profile into a safe host/UI inspection object. */
-function projectProfile(id) {
-    const profile = getProfile(id);
-    const { model, identity, tools, inputs, outputs } = profile;
-    const { select, allow, maxSteps, controls } = model;
-    const { handle, chat } = identity;
-    const { slots } = inputs;
-    return {
-        id: profile.id,
-        handle,
-        chat: chat !== false,
-        maxSteps: maxSteps ?? 1,
-        models: allow,
-        select: select ?? null,
-        controls: controls ?? [],
-        tools: tools.allow.map((name) => ({
-            name,
-            ...(CATALOG.tools[name] ?? { kind: 'custom', ui: true }),
-        })),
-        inputs,
-        slots: slots ?? {},
-        outputs,
-        image: primaryImageSpec(profile),
-    };
-}
-function pickSystemRole(profile, requested) {
-    const { identity } = profile;
-    const { handle, systemByRole } = identity;
-    if (requested && systemByRole && Object.hasOwn(systemByRole, requested)) {
-        return requested;
-    }
-    return handle;
-}
-export { assertToolAllowed, pickSystemRole, projectProfile, resolveTurn };

package/esm/src/kernel/registry/schemas.d.ts

@@ -1,14 +0,0 @@
-/**
- * Runtime structured-output schema registry.
- *
- * Host apps register schemas by id, then reference those ids from profile output
- * declarations.
- *
- * @module
- */
-import type { StructuredSpec } from '../types.js';
-/** Register a host-owned structured output schema. */
-declare function registerStructured(id: string, spec: StructuredSpec): void;
-/** Fetch a registered structured output schema or throw a `TheorumError`. */
-declare function getStructured(id: string): StructuredSpec;
-export { getStructured, registerStructured };

package/esm/src/kernel/registry/schemas.js

@@ -1,23 +0,0 @@
-/**
- * Runtime structured-output schema registry.
- *
- * Host apps register schemas by id, then reference those ids from profile output
- * declarations.
- *
- * @module
- */
-import { TheorumError } from '../../guardrails/error.js';
-const schemas = new Map();
-/** Register a host-owned structured output schema. */
-function registerStructured(id, spec) {
-    schemas.set(id, spec);
-}
-/** Fetch a registered structured output schema or throw a `TheorumError`. */
-function getStructured(id) {
-    const spec = schemas.get(id);
-    if (!spec) {
-        throw new TheorumError(`Unknown structured schema '${id}'`);
-    }
-    return spec;
-}
-export { getStructured, registerStructured };

package/esm/src/kernel/registry/tools.d.ts

@@ -1,12 +0,0 @@
-/**
- * Generic built-in custom tool executor.
- *
- * Static custom tools are intentionally minimal. Application-specific tools
- * should be supplied as dynamic declarations with host-owned handlers.
- *
- * @module
- */
-import type { CustomToolId, Profile, ToolEnvelope } from '../types.js';
-/** Execute a static tool after enforcing the profile allowlist. */
-declare function executeTool(profile: Profile, name: CustomToolId, args: Record<string, unknown>): ToolEnvelope;
-export { executeTool };

package/esm/src/kernel/registry/tools.js

@@ -1,36 +0,0 @@
-/**
- * Generic built-in custom tool executor.
- *
- * Static custom tools are intentionally minimal. Application-specific tools
- * should be supplied as dynamic declarations with host-owned handlers.
- *
- * @module
- */
-import { getTool } from './catalog.js';
-import { assertToolAllowed } from './resolve.js';
-function executeAskUser(args) {
-    const { kind, prompt } = args;
-    if (kind !== 'confirm' && kind !== 'choice' && kind !== 'text') {
-        return { status: 'error', finding: 'askUser.kind must be confirm, choice, or text' };
-    }
-    if (typeof prompt !== 'string' || !prompt.trim()) {
-        return { status: 'error', finding: 'askUser.prompt is required' };
-    }
-    return {
-        status: 'pause',
-        finding: prompt,
-        data: { ...args, schema: getTool('askUser')?.schema },
-    };
-}
-/** Execute a static tool after enforcing the profile allowlist. */
-function executeTool(profile, name, args) {
-    assertToolAllowed(profile, name);
-    if (name === 'askUser') {
-        return executeAskUser(args);
-    }
-    return {
-        status: 'error',
-        finding: `Tool '${name}' has no kernel executor; pass a dynamic tool handler instead.`,
-    };
-}
-export { executeTool };