@byok-sdk/client 0.1.0

package/dist/daemon/truth-memory-client.d.ts

@@ -0,0 +1,94 @@
+import { type ContentHash, type TruthRecordKind, type TruthRecordSelector } from '@byok-sdk/core';
+import type { DeviceProofSigner } from './device-proof-signer';
+export interface TruthManifestRecord {
+    readonly kind: TruthRecordKind;
+    readonly recordKey: string;
+    readonly rev: number;
+    readonly contentHash: ContentHash;
+    readonly byteSize: number;
+    readonly label?: string;
+    readonly updatedAt: string;
+}
+export interface TruthManifestQueryInput {
+    readonly kind?: TruthRecordKind;
+    readonly keyPrefix?: string;
+    readonly limit?: number;
+}
+/** Cloud-agnostic local semantic selection. It sees metadata and no body bytes. */
+export interface MemorySelector {
+    select(manifest: readonly TruthManifestRecord[]): readonly TruthRecordSelector[] | Promise<readonly TruthRecordSelector[]>;
+}
+/** A body reaches this seam only after manifest equality, byte-size and SHA-256 checks. */
+export interface VerifiedTruthRecord extends TruthManifestRecord {
+    readonly bytes: Uint8Array;
+}
+/** The only value returned by `loadSelected`; runtime prompt/context shape stays host-owned. */
+export interface LocalMemoryFilter<Context> {
+    filter(records: readonly VerifiedTruthRecord[]): Context | Promise<Context>;
+}
+export interface TruthMemoryMetric {
+    readonly kind: 'truth.snapshot.large';
+    readonly selector: TruthRecordSelector;
+    readonly byteSize: number;
+    readonly thresholdBytes: number;
+}
+export interface TruthMemoryClientOptions {
+    readonly serverUrl: string;
+    readonly signer: DeviceProofSigner;
+    /** Exact http(s) origins permitted to receive object-download grants. An empty list disables object reads. */
+    readonly allowedObjectDownloadOrigins: readonly string[];
+    readonly fetch?: typeof globalThis.fetch;
+    readonly requestId?: () => string;
+    readonly onMetric?: (metric: TruthMemoryMetric) => void;
+}
+export type TruthWriteBody = {
+    readonly kind: 'inline';
+    readonly content: string;
+} | {
+    readonly kind: 'object';
+    readonly contentHash: string;
+    readonly byteSize: number;
+};
+export interface TruthSnapshotWriteInput {
+    readonly kind: 'profile' | 'memory';
+    readonly recordKey: string;
+    readonly expectedRev: number;
+    readonly body: TruthWriteBody;
+    readonly requestId: string;
+    readonly label?: string;
+}
+export interface TruthSnapshotCandidateInput {
+    readonly kind: 'profile' | 'memory';
+    readonly recordKey: string;
+    readonly expectedRev: number;
+    readonly body: TruthWriteBody;
+    readonly label?: string;
+}
+export interface TruthTerminalWriteInput {
+    readonly taskId: string;
+    readonly body: TruthWriteBody;
+    readonly requestId: string;
+    readonly label?: string;
+    readonly snapshots?: readonly TruthSnapshotCandidateInput[];
+}
+export interface TruthWriteResult {
+    readonly primary: TruthManifestRecord;
+    readonly snapshots: readonly TruthManifestRecord[];
+    readonly replayed: boolean;
+}
+export type TruthMemoryClientErrorCode = 'truth_http_failed' | 'truth_response_invalid' | 'truth_selection_invalid' | 'truth_manifest_changed' | 'truth_content_size_mismatch' | 'truth_content_hash_mismatch' | 'truth_object_url_rejected' | 'truth_write_invalid' | 'truth_write_confirmation_mismatch';
+export declare class TruthMemoryClientError extends Error {
+    readonly code: TruthMemoryClientErrorCode;
+    readonly status?: number | undefined;
+    constructor(code: TruthMemoryClientErrorCode, message: string, status?: number | undefined);
+}
+/** Proof-only client for S6 truth records. It never sends a bearer token. */
+export declare class TruthMemoryClient {
+    #private;
+    private readonly options;
+    constructor(options: TruthMemoryClientOptions);
+    listManifest(query?: TruthManifestQueryInput): Promise<readonly TruthManifestRecord[]>;
+    loadSelected<Context>(selector: MemorySelector, filter: LocalMemoryFilter<Context>, query?: TruthManifestQueryInput): Promise<Context>;
+    writeSnapshot(input: TruthSnapshotWriteInput): Promise<TruthWriteResult>;
+    writeTerminal(input: TruthTerminalWriteInput): Promise<TruthWriteResult>;
+}

package/dist/daemon/url.d.ts

@@ -0,0 +1,60 @@
+/** Normalize a configured `serverUrl` (http/https/ws/wss, any path) to an http(s) base with no path/query. */
+export declare function toHttpBase(serverUrl: string): string;
+/** Derive the `/byok/ws` WebSocket URL from a configured `serverUrl`. */
+export declare function toWsUrl(serverUrl: string): string;
+/**
+ * M5: thrown by {@link assertServerUrlAllowed} — see that function's own doc
+ * comment for the full allow/deny rule this names. Deliberately ONE error
+ * type for every way the gate can refuse a `serverUrl` (plaintext-to-remote,
+ * or a scheme this SDK's transport has no meaning for at all): a catching
+ * caller only ever needs "the configured server URL failed the
+ * transport-security gate", never which specific sub-case fired — the
+ * message text (not the type) carries that detail.
+ */
+export declare class InsecureServerUrlError extends Error {
+    constructor(message: string);
+}
+export interface AssertServerUrlAllowedOptions {
+    /**
+     * Explicit escape hatch: when `true`, a `http:`/`ws:` `serverUrl` whose
+     * host is NOT loopback is allowed through instead of throwing. Does
+     * nothing for an unsupported scheme (see {@link assertServerUrlAllowed}'s
+     * own doc comment) — that rejection is unconditional. Threaded from
+     * `DaemonConfig.dangerouslyAllowInsecureRemote`; this function itself
+     * never logs anything when the hatch is exercised — it stays a pure,
+     * synchronous, easily-unit-testable gate — so a caller that sets this
+     * true is expected to emit its own warning (see `create-daemon.ts`'s
+     * `checkServerUrl`).
+     */
+    dangerouslyAllowInsecureRemote?: boolean;
+}
+/**
+ * M5: transport-security gate for a configured `serverUrl` — refuses
+ * plaintext (`ws:`/`http:`) transport to any non-loopback host, so a device
+ * can never be talked into pairing with (and sending its pairing code /
+ * device credentials to) a remote host in the clear. Call this ONCE at each
+ * real entry point a raw, operator-supplied `serverUrl` first enters the
+ * client (`create-daemon.ts`'s `pair()`/`start()`) rather than inside
+ * `toHttpBase`/`toWsUrl` themselves: ws-transport, the long-poll fallback,
+ * and blob-client all read `serverUrl` from that SAME `DaemonConfig`, never
+ * an independently-supplied URL of their own, so those two call sites are
+ * already the single common path every one of them goes through.
+ *
+ * Rules, checked in order:
+ *  - `https:`/`wss:` — always allowed, any host (TLS is the actual
+ *    plaintext-network defense; this gate has nothing further to add there).
+ *  - `http:`/`ws:` — allowed only when the hostname is loopback: exactly
+ *    `localhost` or any `*.localhost` subdomain, an IPv4 literal in
+ *    `127.0.0.0/8`, or the IPv6 loopback `::1` — see {@link isLoopbackHostname}.
+ *  - `http:`/`ws:` to any other host — refused with a clear, typed
+ *    {@link InsecureServerUrlError} naming the offending URL and the fix
+ *    (use `wss:`/`https:`, or pass `dangerouslyAllowInsecureRemote: true` if
+ *    this is a deliberate, understood exception) — UNLESS
+ *    `opts.dangerouslyAllowInsecureRemote` is `true`.
+ *  - Any other scheme (or a `serverUrl` that fails to parse as a URL at
+ *    all) — always refused, regardless of `dangerouslyAllowInsecureRemote`:
+ *    the escape hatch is specifically for "plaintext to a remote host I
+ *    understand the risk of", not "a scheme this transport doesn't
+ *    implement at all".
+ */
+export declare function assertServerUrlAllowed(rawUrl: string, opts?: AssertServerUrlAllowedOptions): void;

package/dist/daemon/ws-transport.d.ts

@@ -0,0 +1,110 @@
+import { type CapabilityFlag, type Envelope, type RuntimeInfo } from '@byok-sdk/protocol';
+export type ConnectionState = 'connecting' | 'open' | 'closed' | 'degraded' | 'revoked';
+/** The WS upgrade itself was rejected with a non-101 HTTP status (e.g. 401 for an expired/invalid bearer token). Surfaced via `onConnectOutcome` so `ConnectionManager` can force a reactive token renewal before the next attempt (protocol §6.2, "reactively on 401"). */
+export declare class WsUnexpectedStatusError extends Error {
+    readonly status: number;
+    constructor(status: number);
+}
+export interface BackoffOptions {
+    baseMs?: number;
+    maxMs?: number;
+    factor?: number;
+}
+export interface LivenessOptions {
+    /** Terminate and reconnect if no data/ping arrives for this long. Default 75s (server pings every 30s per the pinned heartbeat convention). */
+    timeoutMs?: number;
+    /** How often to check for silence. Default: timeoutMs/3, floored at 1s. */
+    checkIntervalMs?: number;
+}
+export interface WsTransportOptions {
+    serverUrl: string;
+    /** Resolves the current valid bearer token; called fresh before every connect attempt (initial and every reconnect) so a proactively-renewed token is always used. */
+    getToken: () => Promise<string>;
+    deviceId: string;
+    productId: string;
+    capabilities: CapabilityFlag[];
+    /** Detected runtimes, sent on every `conn.hello` (protocol §10 gap #4/#11). */
+    runtimes?: RuntimeInfo[];
+    /** The redelivery cursor to send as `conn.hello.cursor` (protocol §9) — read fresh on every connect so a value learned mid-connection is used on the next reconnect. */
+    getCursor?: () => number | undefined;
+    onEnvelope: (envelope: Envelope) => void;
+    onStateChange?: (state: ConnectionState) => void;
+    /**
+     * Fired the moment `conn.ack` is processed and the connection becomes
+     * usable — independent of `onConnectOutcome`, which only fires on close (a
+     * healthy, still-open connection never reaches it). Carries the ack's own
+     * `capabilities` (untyped `string[]` on the wire, forward-compat — a
+     * server may advertise a flag this build doesn't recognize yet), so a
+     * caller can learn what the CURRENTLY connected server understands (e.g.
+     * the `approval_resolved` capability flag — see
+     * `ConnectionManager.getServerCapabilities`) instead of it being silently
+     * discarded after the handshake completes.
+     */
+    onAcked?: (capabilities: string[]) => void;
+    /**
+     * Fired once per connection attempt when the socket closes, reporting
+     * whether that attempt ever reached `conn.ack` (`acked`) before closing,
+     * and the causing error when the attempt failed before a socket even
+     * opened (e.g. `getToken()` rejecting). Used by `ConnectionManager` to
+     * count consecutive failures for the long-poll fallback (protocol §8).
+     */
+    onConnectOutcome?: (acked: boolean, err?: unknown) => void;
+    backoff?: BackoffOptions;
+    liveness?: LivenessOptions;
+    /** Deterministic automatic reconnect delay. Manual `connect({auto:false})` never reaches this scheduler. */
+    reconnectDelayMs?: (attempt: number, baseDelayMs: number) => number;
+}
+/**
+ * The daemon's outbound-only WS connection: opens, sends `conn.hello`, waits
+ * for `conn.ack`, and reconnects with capped exponential backoff + jitter on
+ * drop.
+ *
+ * Design B (finding N4): this transport is a stateless drainer — it holds no
+ * outbound queue of its own. `ConnectionManager` owns the single shared
+ * outbox both transports drain from (so a transport switch never strands a
+ * queued envelope); `sendNow` just attempts to hand one envelope to the
+ * live socket right now and reports back whether that actually happened,
+ * leaving all queueing/retry policy to the caller.
+ *
+ * Auto-reconnect can be paused (`stopAutoReconnect`) and single attempts
+ * made on demand (`connect({ auto: false })`) — used by `ConnectionManager`
+ * to probe WS recovery every few minutes while long-polling, without this
+ * transport's own backoff loop fighting that cadence.
+ */
+export declare class WsTransport {
+    private readonly opts;
+    private socket;
+    private closedByUser;
+    private autoReconnect;
+    private acked;
+    private everAckedThisAttempt;
+    private reconnectAttempt;
+    private reconnectTimer;
+    private livenessTimer;
+    private lastActivity;
+    private lastUnexpectedStatus;
+    private ackWaiters;
+    constructor(opts: WsTransportOptions);
+    connect(opts?: {
+        auto?: boolean;
+    }): void;
+    /** Stop scheduling further reconnect attempts (any pending one is cancelled too); the current socket, if any, is left alone. Used when handing retry ownership to a slower external cadence (e.g. the long-poll fallback's periodic WS probe). */
+    stopAutoReconnect(): void;
+    /** Resume normal auto-reconnect-on-close behavior (does not itself trigger a connect — only affects future closes). */
+    resumeAutoReconnect(): void;
+    get isOpen(): boolean;
+    /**
+     * Attempt to send ONE envelope right now; returns whether it actually went
+     * out. `false` means the socket isn't currently open+acked — the caller
+     * (`ConnectionManager.drainOutbox`, Design B/finding N4) owns re-queueing
+     * and retrying later (e.g. on the next `onAcked`), since this transport no
+     * longer buffers anything itself.
+     */
+    sendNow(envelope: Envelope): boolean;
+    waitForAck(timeoutMs?: number): Promise<void>;
+    close(): void;
+    private openSocket;
+    private scheduleReconnect;
+    private startLivenessCheck;
+    private stopLivenessCheck;
+}

package/dist/diagnostics/diagnostics.d.ts

@@ -0,0 +1,114 @@
+import type { DaemonConfig, RuntimeAdapter } from '../index';
+import { connectControlClient } from '../bin/control-client';
+import type { ControlStatusResult } from '../daemon/control-protocol';
+import { type OperationalHealthFileInspection, OPERATIONAL_HEALTH_FILENAME } from '../daemon/operational-health';
+export declare const MAX_QUARANTINE_ENTRIES = 100;
+export declare const MAX_QUARANTINE_SCAN_ENTRIES: number;
+export declare const MAX_QUARANTINE_READ_BYTES: number;
+export declare const MAX_DEVICE_RECORD_BYTES: number;
+export declare const MAX_JOURNAL_COPY_BYTES: number;
+export type DiagnosticStatus = 'pass' | 'warn' | 'fail';
+export interface DiagnosticCheck {
+    id: 'config' | 'device' | 'runtimes' | 'control' | 'health' | 'journal' | 'workspace' | 'quarantine';
+    status: DiagnosticStatus;
+    summary: string;
+}
+export interface DiagnosticsSnapshot {
+    version: 1;
+    generatedAt: string;
+    product: {
+        nameHash: string;
+        idHash: string;
+    };
+    system: {
+        node: string;
+        platform: NodeJS.Platform;
+        arch: string;
+        sqliteAvailable: boolean;
+    };
+    config: {
+        serverProtocol: 'http' | 'https' | 'ws' | 'wss' | 'invalid' | 'unsupported';
+        customStoreDir: boolean;
+        hostedJournal: boolean;
+        runtimeAllowlistCount?: number;
+    };
+    device: {
+        status: 'paired' | 'unpaired' | 'unavailable';
+        deviceIdHash?: string;
+    };
+    runtimes: Array<{
+        idHash: string;
+        present: boolean;
+        versionPresent: boolean;
+        authPresent?: boolean;
+        steer: boolean;
+        resume: boolean;
+        permissionModeCount: number;
+    }>;
+    control: {
+        status: 'offline';
+        reason: string;
+    } | {
+        status: 'online';
+        pid: number;
+        uptimeMs: number;
+        transport: string;
+        activeTaskCount: number;
+        pendingApprovalCount: number;
+        operationalHealth: ControlStatusResult['operationalHealth'];
+        storage?: ControlStatusResult['storage'];
+    };
+    health: OperationalHealthFileInspection;
+    journal: {
+        status: 'missing' | 'present' | 'corrupt' | 'unavailable';
+        sizeBytes?: number;
+        walBytes?: number;
+        integrity?: 'ok' | 'not-checked';
+        reason?: string;
+    };
+    workspace: {
+        status: 'available' | 'missing' | 'unavailable';
+        writable?: boolean;
+        reason?: string;
+    };
+    quarantine: {
+        status: 'available' | 'missing' | 'unavailable';
+        count: number;
+        scannedCount: number;
+        truncated: boolean;
+        entries: Array<{
+            nameHash: string;
+            sizeBytes: number;
+            modifiedAt: string;
+        }>;
+        reason?: string;
+    };
+    checks: DiagnosticCheck[];
+}
+export interface CollectDiagnosticsOptions {
+    clock?: () => Date;
+    adapters?: RuntimeAdapter[];
+    connectControl?: typeof connectControlClient;
+    runtimeProbeTimeoutMs?: number;
+}
+export type OperationalHealthFixResult = {
+    status: 'not-needed';
+    reason: 'missing' | 'valid';
+} | {
+    status: 'quarantined';
+    evidenceName: string;
+    manifestName: string;
+    sha256: string;
+    sizeBytes: number;
+};
+export declare function collectDiagnostics(config: DaemonConfig, storeDir: string, options?: CollectDiagnosticsOptions): Promise<DiagnosticsSnapshot>;
+export declare function stableIdentifierHash(value: string): string;
+/**
+ * The only S7-b repair: preserve a confirmed-corrupt health file in the
+ * never-auto-delete quarantine. Callers must separately enforce the CLI's
+ * `--fix --yes` and offline-daemon preconditions.
+ */
+export declare function quarantineCorruptOperationalHealth(storeDir: string, options?: {
+    clock?: () => Date;
+}): Promise<OperationalHealthFixResult>;
+export { OPERATIONAL_HEALTH_FILENAME };

package/dist/diagnostics/support-bundle.d.ts

@@ -0,0 +1,81 @@
+import type { DaemonConfig, DaemonEvent } from '../index';
+import { type EnsureSecureDirOptions } from '../util/secure-dir';
+import { type CollectDiagnosticsOptions, type DiagnosticsSnapshot } from './diagnostics';
+export declare const MAX_SUPPORT_AUDIT_TAIL_BYTES: number;
+export declare const MAX_SUPPORT_AUDIT_FACTS = 200;
+export interface SupportBundle {
+    version: 1;
+    generatedAt: string;
+    product: {
+        nameHash: string;
+        idHash: string;
+    };
+    system: DiagnosticsSnapshot['system'];
+    config: {
+        serverProtocol: 'http' | 'https' | 'ws' | 'wss' | 'invalid' | 'unsupported';
+        customStoreDir: boolean;
+        hostedJournal: boolean;
+        runtimeAllowlistCount?: number;
+    };
+    device: {
+        status: DiagnosticsSnapshot['device']['status'];
+        deviceIdHash?: string;
+    };
+    runtimes: DiagnosticsSnapshot['runtimes'];
+    control: {
+        status: 'offline';
+    } | {
+        status: 'online';
+        pid: number;
+        uptimeMs: number;
+        transport: 'connecting' | 'open' | 'closed' | 'degraded' | 'revoked' | 'unavailable';
+        activeTaskCount: number;
+        pendingApprovalCount: number;
+        operationalHealth: {
+            availability: 'unavailable';
+        } | {
+            availability: 'available';
+            state: 'healthy' | 'degraded' | 'recovering';
+            failureCount: number;
+            windowMs: number;
+            failureThreshold: number;
+            crashCount: number;
+            lastCrashAt?: string;
+            currentRunStartedAt?: string;
+        };
+        storagePresent: boolean;
+    };
+    health: DiagnosticsSnapshot['health'];
+    journal: DiagnosticsSnapshot['journal'];
+    workspace: DiagnosticsSnapshot['workspace'];
+    quarantine: {
+        status: DiagnosticsSnapshot['quarantine']['status'];
+        count: number;
+        scannedCount: number;
+        truncated: boolean;
+        entries: DiagnosticsSnapshot['quarantine']['entries'];
+    };
+    checks: Array<Pick<DiagnosticsSnapshot['checks'][number], 'id' | 'status'>>;
+    recentEvents: {
+        status: 'available' | 'missing' | 'unavailable';
+        included: number;
+        sourceBytesRead: number;
+        sourceTruncated: boolean;
+        facts: Array<{
+            kind: DaemonEvent['kind'];
+            ts: string;
+        }>;
+    };
+    redaction: {
+        policy: 'allowlist-v1';
+        omitted: string[];
+        transformed: string[];
+    };
+}
+export declare function createSupportBundle(config: DaemonConfig, storeDir: string, options?: CollectDiagnosticsOptions): Promise<SupportBundle>;
+/**
+ * Publish a complete bundle at a previously-unused path. The same-directory
+ * hard-link makes publication atomic and `EEXIST`-safe: no reader can see a
+ * partial JSON file and an existing operator artifact is never overwritten.
+ */
+export declare function writeSupportBundle(outputPath: string, bundle: SupportBundle, secureFileOptions?: EnsureSecureDirOptions): Promise<void>;

package/dist/index.d.ts

@@ -0,0 +1,42 @@
+export type { RuntimeAdapter, RuntimeCapabilities, RuntimeDetectResult, Session, TaskContext, GitWorkspaceConfig, } from './types';
+export { PolicyUnsupportedError, SteerUnsupportedError } from './types';
+export type { RuntimeEnvironmentRequirements } from './daemon/environment';
+export { GitWorkspaceManager, GitWorkspaceError, isGitWorkspaceConfig, prependGitWorkspaceGuidance } from './daemon/git-workspace';
+export type { GitWorkspaceObservation, GitWorkspaceLease, GitWorkspaceOptions, GitErrorCategory } from './daemon/git-workspace';
+export { GitWorkspaceStore } from './daemon/git-workspace-store';
+export type { GitWorkspaceLedger, GitWorkspaceLedgerRecord, GitWorkspacePhase } from './daemon/git-workspace-store';
+export { createDaemon, createDaemonWithAdapters } from './daemon/create-daemon';
+export type { Daemon, DaemonConfig, DaemonStatus, DaemonOverrides, DaemonBranding, HostedJournalConfig } from './daemon/create-daemon';
+export type { OperationalHealthSnapshot, OperationalHealthState } from './daemon/operational-health';
+export { journalHash, JournalUnavailableError, JournalCorruptError, JournalRecordTooLargeError, JournalUnknownTaskError, JournalClosedError, } from './daemon/journal/journal';
+export type { LocalTaskJournal, JournalIdentity, JournalReceipt, ReceivedEnvelopeRecord, AdmissionRecord, LocalTransitionRecord, LocalTerminalRecord, TerminalTruthState, RecoverableTask, RecoveryOutcome, RecoveryDisposition, LocalStorageUsage, StorageCategory, CategoryUsage, CleanableCategory, CleanupCandidate, CleanupResult, CompactOptions, CompactResult, } from './daemon/journal/journal';
+export { SqliteLocalTaskJournal, JOURNAL_DB_FILENAME, JOURNAL_QUARANTINE_DIRNAME } from './daemon/journal/sqlite-journal';
+export type { SqliteLocalTaskJournalOptions } from './daemon/journal/sqlite-journal';
+export { LocalStoragePressureEngine, LocalStoragePolicyError, LocalStorageEmergencyError, resolveLocalStoragePolicy, computePressureState, cleanupOrderFor, cleanupEligibleAt, createFilesystemCleanupExecutor, createStatfsFreeBytesProvider, JOURNAL_TASK_REF_PREFIX, DEFAULT_SOFT_BUDGET_RATIO, DEFAULT_HARD_BUDGET_RATIO, DEFAULT_ACK_CRITICAL_RESERVE_BYTES, DEFAULT_CLEANUP_BATCH_LIMIT, DEFAULT_INCREMENTAL_VACUUM_PAGES, DEFAULT_NORMAL_COMPACTION_INTERVAL_MS, DEFAULT_PRESSURE_COMPACTION_INTERVAL_MS, DEFAULT_RETENTION_MS, DEFAULT_LOG_ROTATION, } from './daemon/journal/storage-policy';
+export type { LocalStoragePolicy, LocalStoragePolicyInput, LocalStoragePressureEngineOptions, LogRotationPolicy, CompactionPolicy, StoragePressureState, StoragePressureEvent, StorageMeasurement, StorageStatusSnapshot, StorageTickResult, CleanupExecutor, CleanupExecution, TimerLike, } from './daemon/journal/storage-policy';
+export type { DeviceRecord } from './daemon/store';
+export { AuthManager, DeviceRevokedError } from './daemon/auth-manager';
+export { StoredDeviceProofSigner } from './daemon/device-proof-signer';
+export type { DeviceProofRequest, DeviceProofSigner, StoredDeviceProofSignerOptions, } from './daemon/device-proof-signer';
+export { TruthMemoryClient, TruthMemoryClientError } from './daemon/truth-memory-client';
+export type { LocalMemoryFilter, MemorySelector, TruthManifestQueryInput, TruthManifestRecord, TruthMemoryClientErrorCode, TruthMemoryClientOptions, TruthMemoryMetric, TruthSnapshotCandidateInput, TruthSnapshotWriteInput, TruthTerminalWriteInput, TruthWriteBody, TruthWriteResult, VerifiedTruthRecord, } from './daemon/truth-memory-client';
+export type { ConnectionState } from './daemon/ws-transport';
+export { BlobClient } from './daemon/blob-client';
+export type { BlobResolver } from './daemon/blob-client';
+export { DaemonObserver } from './daemon/observer';
+export type { DaemonEvent, DaemonEventKind, DaemonEventListener, DaemonTaskInfo, Unsubscribe } from './daemon/observer';
+export { createServiceLifecycle, UnsupportedServicePlatformError } from './lifecycle/create-service-lifecycle';
+export type { CreateServiceLifecycleOptions } from './lifecycle/create-service-lifecycle';
+export { nodeAgentProgram, sanitizeServiceName } from './lifecycle/service-types';
+export type { NodeAgentProgramOptions, ServiceDefinition, ServiceInstallOptions, ServiceLifecycle, ServiceProgram, ServiceStatusResult, } from './lifecycle/service-types';
+export { generateLaunchdPlist } from './lifecycle/launchd';
+export { generateSystemdUnit } from './lifecycle/systemd';
+export { generateWinswXml } from './lifecycle/winsw';
+export { ensureSecureDir, buildIcaclsArgs, SecureDirHardeningError } from './util/secure-dir';
+export type { EnsureSecureDirOptions } from './util/secure-dir';
+export { PiAdapter } from './adapters/pi/pi-adapter';
+export type { PiAdapterOptions } from './adapters/pi/pi-adapter';
+export { PI_PACKAGE_NAME } from './adapters/pi/resolve-bin';
+export { ClaudeAdapter } from './adapters/claude/claude-adapter';
+export type { ClaudeAdapterOptions } from './adapters/claude/claude-adapter';
+export { CodexAdapter, type CodexAdapterOptions } from './adapters/codex/codex-adapter';