chore: merge dependency updates and close audit issues

Closes #16, #22, #23, #24, #25, #27

Author: nficano

.github/workflows/codeql.yml

@@ -106,7 +106,6 @@ $serverFuture->await();
 | §8 Authentication | [src/Auth/](src/Auth/) |
 | §10 Jobs | [src/Runtime/JobManager.php](src/Runtime/JobManager.php) + [JobContext](src/Runtime/JobContext.php) |
 | §11 Streaming | `JobContext::openStream()` (text/event/log/thought; binary base64 only) |
-| §12 Human-in-the-loop | [src/Client/Handlers/](src/Client/Handlers/) + `JobContext::requestHumanInput/Choice` |
 | §13 Subscriptions | [src/Runtime/SubscriptionManager.php](src/Runtime/SubscriptionManager.php) |
 | §15 Permissions & leases | [src/Runtime/LeaseManager.php](src/Runtime/LeaseManager.php) |
 | §16 Artifacts | [src/Runtime/ArtifactStore.php](src/Runtime/ArtifactStore.php) |
@@ -118,16 +117,11 @@ $serverFuture->await();
 
 ## Samples
 
-Six runnable scripts under [samples/](samples/), each backed by a
-single sentence of context at the top. They all use `MemoryTransport`
-to keep the example self-contained:
-
-1. `01_minimal_session.php` — handshake.
-2. `02_tool_invoke_with_progress.php` — tool + progress events.
-3. `03_human_input_request.php` — HITL input.
-4. `04_permission_challenge.php` — permission/lease.
-5. `05_observer_subscription.php` — passive observer.
-6. `06_relay_human_in_the_loop.php` — multi-channel HITL relay.
+Canonical cross-SDK sample blueprints live under [samples/](samples/).
+They are named to match the TypeScript SDK examples, including
+`submit-and-stream`, `progress`, `subscribe`, `resume`, `delegate`,
+`lease-expires-at`, `lease-violation`, `custom-auth`, and
+`vendor-extensions`.
 
 ## Docs
 

README.md

@@ -75,5 +75,5 @@ core `Auth` fields compatible with the canonical schemes.
 
 ## Runnable example
 
-See `samples/capability_negotiation/` and the handshake tests under
+See `samples/capability-negotiation/` and the handshake tests under
 `tests/Integration/HandshakeTest.php`.

docs/guides/auth.md

@@ -42,5 +42,5 @@ Reuse idempotency keys when retrying the same delegated operation.
 
 ## Runnable example
 
-See `samples/delegation/`, `samples/handoff/`, and
-`samples/reasoning_streams/`.
+See `samples/delegate/`, `samples/handoff/`, and
+`samples/reasoning-streams/`.

docs/guides/delegation.md

@@ -77,4 +77,4 @@ previous exception and its `code()`.
 
 ## Runnable example
 
-See `samples/cost_budget/` and `tests/Unit/ErrorsTest.php`.
+See `samples/cost-budget/` and `tests/Unit/ErrorsTest.php`.

docs/guides/errors.md

@@ -56,5 +56,5 @@ Keep subscriber callbacks short and do heavy work outside the read loop.
 
 ## Runnable examples
 
-See `samples/result_chunk/`, `samples/subscriptions/`, and
-`samples/reasoning_streams/`.
+See `samples/result-chunk/`, `samples/subscribe/`, and
+`samples/reasoning-streams/`.

docs/guides/job-events.md

@@ -61,5 +61,5 @@ exceptions to errors, and removes terminal jobs from the live list.
 
 ## Runnable examples
 
-See `samples/agent_versions/`, `samples/list_jobs/`, and
+See `samples/agent-versions/`, `samples/list-jobs/`, and
 `tests/Integration/JobLifecycleTest.php`.

docs/guides/jobs.md

@@ -94,5 +94,5 @@ canonical error codes.
 
 ## Runnable examples
 
-See `samples/leases/`, `samples/lease_revocation/`, and
-`samples/cost_budget/`, and `samples/provisioned_credentials/`.
+See `samples/leases/`, `samples/lease-revocation/`, and
+`samples/cost-budget/`, and `samples/provisioned-credentials/`.

docs/guides/leases.md

@@ -44,4 +44,4 @@ job states.
 
 ## Runnable example
 
-See `samples/capability_negotiation/` and `samples/reasoning_streams/`.
+See `samples/capability-negotiation/` and `samples/reasoning-streams/`.

docs/guides/observability.md

@@ -41,4 +41,4 @@ Combine `IdempotencyKey` with event-log replay to avoid duplicate work.
 
 ## Runnable example
 
-See `samples/resumability/` and `tests/Integration/ResumeTest.php`.
+See `samples/resume/` and `tests/Integration/ResumeTest.php`.