@scp-dev/core 0.1.0 → 0.1.2

package/README.md

@@ -0,0 +1,40 @@
+# @scp-dev/core
+
+The SCP protocol core: wire types, message framing, scopes, policy, the judge and the relay core that brokers and hubs run on.
+
+```sh
+npm install @scp-dev/core
+```
+
+## Usage
+
+```ts
+import { Database } from "bun:sqlite"
+import { RelayCore, sha256Hex, type Sql, type SqlValue, wrapMessage } from "@scp-dev/core"
+
+const db = new Database(":memory:")
+const sql: Sql = { all: <T>(query: string, ...params: SqlValue[]) => db.query(query).all(...params) as T[] }
+const core = new RelayCore(sql, { hash: sha256Hex, transaction: (fn) => db.transaction(fn)() })
+core.migrate()
+const orch = core.claim({ handle: "orch", harness: "claude-code" })
+const parser = core.claim({ handle: "parser", harness: "codex" })
+core.send(orch.endpoint.id, { to: "parser", body: "Also cover the empty-input case." })
+for (const message of core.inbox(parser.endpoint.id)) console.log(wrapMessage(message))
+```
+
+`RelayCore` runs on any synchronous `Sql` store: SQLite locally, a Durable Object in the cloud.
+
+## Provides
+
+- `RelayCore`: endpoints, claims, inboxes, threads, replies, asks, grants, loop guards and rate limits.
+- Wire types, `LIMITS` and `RelayError` codes for `scp/1`.
+- Untrusted-content framing: `wrapMessage`, `wrapPeek` and the delivery preambles.
+- Scopes and policy: `parsePolicy`, `scopeDecision` and the tree selectors.
+- Credential and PII scanning: `findSecret`, `redactSecrets`, `redactPii`.
+- The judge: `prefilter`, `runJudge`, `parseJudgePolicy`, `HttpJudgeClient`, with no default model.
+
+Implements [Messages](https://scp.dev/spec#7-messages), [Authorization](https://scp.dev/spec#10-authorization) and [Judging](https://scp.dev/spec#15-judging). See the [root README](https://github.com/scphq/scp#readme).
+
+## License
+
+[Apache-2.0](LICENSE).

package/dist/index.d.ts

@@ -352,10 +352,18 @@ declare const LIMITS: {
     readonly pushes: 20;
     /** how long a live worker's next message waits after a push showed one of its own */
     readonly pushGapS: 30;
+    /** with other workers still running, how long a stop's push waits for one more worker result before it goes */
+    readonly pushQuietS: 3;
+    /** the longest a stop's push gathers worker results, from the first it has to show */
+    readonly pushGraceS: 6;
     readonly stopBlocks: 3;
     /** the stops a session's late parent directives may hold */
     readonly directiveHolds: 5;
     readonly injectHoldS: 10;
+    /** how long inbox still lists a message a background hook showed, whose text the harness may hand the agent only after its next tool call */
+    readonly deferredShowS: 600;
+    /** a deferred showing older than this settles at the session's next tool event or prompt: the harness has handed it over by then */
+    readonly deferredSettleMs: 2000;
     readonly listOfflineWithinS: 86400;
     readonly handleBoundS: number;
     readonly idempotencyS: 86400;
@@ -377,8 +385,10 @@ declare const LIMITS: {
     readonly grantTtlS: number;
     readonly groupIdleS: 86400;
     readonly policyLoadsKept: 8;
+    /** the prompts between two refreshes of a title a hook inferred */
+    readonly titleRefreshTurns: 5;
 };
-type ErrorCode = "not_found" | "inbox_full" | "rate_limited" | "loop_guard" | "data_class_refused" | "secret_refused" | "policy_refused" | "too_large" | "invalid_params" | "unauthorized" | "method_not_found" | "scope_refused" | "unavailable" | "judge_refused";
+type ErrorCode = "not_found" | "inbox_full" | "rate_limited" | "loop_guard" | "data_class_refused" | "secret_refused" | "policy_refused" | "too_large" | "invalid_params" | "unauthorized" | "method_not_found" | "scope_refused" | "unavailable" | "judge_refused" | "not_live";
 declare class RelayError extends Error {
     readonly code: ErrorCode;
     readonly retryAfterS?: number | undefined;
@@ -636,6 +646,8 @@ interface Envelope {
     expires_at: string;
     /** a request whose sender holds the recipient's stop until it replies */
     require_reply?: true;
+    /** set by inbox on a message a background hook already showed (and marked read), whose text may reach the agent only after this call */
+    shown_at?: string;
     /**
      * the sender as the local broker sees it from the recipient, never from anything the sender claims: `parent` when it issued the grant the
      * recipient's current incarnation spent or is its ancestor, `child` when it is the recipient's descendant; unset for humans and other machines.
@@ -663,6 +675,8 @@ interface StopWaitResult {
     more: number;
     workers: string[];
     starting: number;
+    /** the live --no-push workers it spawned, which no stop waits on, by address */
+    background?: string[];
     others: number;
     others_shown?: number;
     pushes_left: number;
@@ -683,6 +697,8 @@ interface SendParams {
     mime?: string;
     /** on a request only: the recipient's stop is held until it replies */
     require_reply?: boolean;
+    /** refuse `not_live`, queueing nothing, when an agent recipient has no live session */
+    live?: boolean;
 }
 /** what ask and ask_wait answer: the reply; or pending, with `ended` once every recipient present at the send went offline without replying; or expired */
 interface AskResult {
@@ -732,10 +748,26 @@ interface SendResult {
         last_seen: string | null;
         state?: Reach;
     }[];
+    /** one line per agent recipient no live session holds: `queued: no live session holds <address>` */
+    warnings?: string[];
     duplicate?: boolean;
     held?: JudgeHeld;
     redacted?: JudgeRedacted;
 }
+/**
+ * a message the caller sent and, per recipient, when it read the message (acked), or when a background hook delivered it (acked by that
+ * showing; the agent gets it with its next request), and when a hook or channel showed it: ISO times, or null
+ */
+interface MessageReceipts {
+    id: string;
+    thread: string;
+    recipients: {
+        address: string;
+        read_at: string | null;
+        delivered_at?: string | null;
+        shown_at: string | null;
+    }[];
+}
 interface AuditRow {
     id: number;
     at: string;
@@ -777,6 +809,8 @@ interface PolicyDefaults {
     /** `inherit`: a child of a capped parent reaches only what the parent reaches; a preset caps every placed child without grant caps */
     child_default?: ScopePreset | "inherit";
     verify_lineage?: "spike" | boolean;
+    /** who may rename an agent besides the human at a terminal: `root` (default) only a root session itself, `self` any agent itself, spawned ones too */
+    rename?: "root" | "self";
 }
 interface Policy {
     rules: PolicyRule[];
@@ -982,7 +1016,7 @@ declare function relation(sender: PolicySubject, recipient: PolicySubject): stri
 
 type SqlValue = string | number | null;
 /**
- * The one SQLite method the core needs: bun:sqlite locally, `ctx.storage.sql` in a Durable Object.
+ * The one SQLite method the core needs: bun:sqlite or node:sqlite locally, `ctx.storage.sql` in a Durable Object.
  * Calls stay synchronous, so every read-modify-write in the core is atomic between awaits.
  */
 interface Sql {
@@ -991,6 +1025,8 @@ interface Sql {
 declare const one: <T>(sql: Sql, query: string, ...params: SqlValue[]) => T | undefined;
 
 declare const HUMAN_HANDLE = "_human";
+/** an agent title's length cap */
+declare const TITLE_CHARS = 64;
 declare const SYSTEM_HANDLE = "_relay";
 declare const GONE_PREFIX = "_gone_";
 interface EndpointRow {
@@ -1038,12 +1074,20 @@ interface EndpointRow {
     /** JSON {@link ScopeCaps} */
     caps: string | null;
     title: string | null;
+    /** the title a hook last inferred: the title is inferred while it equals this */
+    title_auto: string | null;
+    /** the prompt count when a summary last set the inferred title; null when the first prompt set it */
+    title_turn: number | null;
+    /** the prompt count when the status note last changed or a hook last reminded the agent to refresh it */
+    tldr_turn: number | null;
     /** when a new spawn last took the endpoint over: mail and messages from before it were the earlier holder's */
     reset_at: number | null;
     /** when a new spawn last took the endpoint over: with its id, names the holder another machine sees */
     spawned_at: number | null;
     /** who may peek: null is off */
     peek: PeekLevel | null;
+    /** when the session last set its handle itself (join or rename): a later claim with another handle does not rename it back */
+    named: number | null;
 }
 interface MessageRow {
     id: string;
@@ -1068,7 +1112,7 @@ interface CoreOptions {
     now?: () => number;
     /** a synchronous hash for resume tokens (sha256 hex) */
     hash: (value: string) => string;
-    /** runs `fn` atomically: bun:sqlite's db.transaction, a Durable Object's transactionSync */
+    /** runs `fn` atomically: a local SQLite transaction, a Durable Object's transactionSync */
     transaction?: <T>(fn: () => T) => T;
     /** count every sender but the relay itself, humans included, against LIMITS.userPerDay, and trust no client's terminal claim for a hop reset (default: agents and non-terminal humans count) */
     capEverySender?: boolean;
@@ -1092,6 +1136,8 @@ declare class RelayCore {
     private readonly capEverySender;
     private readonly alive;
     private readonly hostMachine;
+    private readonly namedMachine;
+    private readonly hostname;
     private policy;
     /** the identity each policy `group:<name>` naming no policy group bound to when the policy's text first loaded: that group's then, or `none` */
     private policyBinds;
@@ -1100,6 +1146,8 @@ declare class RelayCore {
     private scopeMemo;
     private readonly deferred;
     constructor(sql: Sql, options: CoreOptions);
+    /** a `machine` label naming this host by its hostname, as clients default it, names it by its machine name when one is set */
+    private machineLabel;
     migrate(): void;
     /** every stored list that is exactly `tree:self`, the tree preset's old list, narrows once to the preset's list */
     private migrateTreePreset;
@@ -1253,6 +1301,49 @@ declare class RelayCore {
     status(endpoint: string, state: unknown, note: unknown): void;
     /** an agent's own title, shown in list and whoami; empty clears it, and no claim overwrites it */
     title(endpoint: string, value: unknown): EndpointView;
+    /**
+     * a hook's guess at the session's title, from the harness's own summary or the first prompt's first line; whether it changed the title.
+     * Never over a title set explicitly; the first prompt fills only an empty title, and a summary replaces an inferred one at most every
+     * ${LIMITS.titleRefreshTurns} prompts, or at once over the first prompt's
+     */
+    inferTitle(endpoint: string, params: {
+        text?: unknown;
+        from?: unknown;
+    }, options?: {
+        transient?: boolean;
+        process?: string;
+    }): boolean;
+    /**
+     * a session joins on demand: its hook claim registers or takes back its endpoint, marked seen now even right after a leave, and `handle`,
+     * when given, renames it in place ({@link rename}'s rules). Nothing is kept when the rename is refused
+     */
+    joinSession(claim: Claim, handle?: unknown): EndpointView;
+    /**
+     * renames an agent in place: its id, mail, threads, status, title and relations stay. An agent renames only itself, and only a root unless
+     * the policy's `defaults.rename` is `self`; the human at a terminal renames any local agent. The new handle is valid and held by no other endpoint
+     */
+    rename(actor: ScopeActor, params: {
+        endpoint?: unknown;
+        handle: unknown;
+    }): {
+        endpoint: EndpointView;
+        from: string;
+        session: string | null;
+    };
+    /** the endpoint's handle set to `value`, with the stored `ep:` and `fleet:` selectors that named it */
+    private renameRow;
+    /**
+     * a session leaves: it lets go of its session and token and shows offline, its mail kept; a later join takes it back. An agent leaves only
+     * itself, the human at a terminal any local root. A spawned worker stays joined while it runs
+     */
+    leaveSession(actor: ScopeActor, params?: {
+        endpoint?: unknown;
+    }): {
+        endpoint: EndpointView;
+        session: string | null;
+    };
+    /** the harness session key an endpoint holds, if any */
+    sessionOf(endpoint: string): string | null;
     /**
      * `origin.tty` is recorded on messages the human inbox sends: whether its client said a terminal was attached. `origin.unverified`: the human
      * sends without a terminal, so the scopes check it like any unplaced sender
@@ -1278,7 +1369,11 @@ declare class RelayCore {
      * that the endpoint has a subject: one it refuses is dropped, audited for the spawner
      */
     private takePending;
-    /** the oldest unacked deliveries after the cursor; reading counts as receiving for the causal hop */
+    /**
+     * the oldest unacked deliveries after the cursor, and those a background hook showed in the last ${LIMITS.deferredShowS} s whose showing has
+     * not settled ({@link injected}), with `shown_at`: the harness may hand the agent that hook's text only after this call; reading counts as
+     * receiving for the causal hop
+     */
     inbox(endpoint: string, options?: {
         after?: number | undefined;
         limit?: number | undefined;
@@ -1309,6 +1404,7 @@ declare class RelayCore {
      * `directive_seqs`. Any call says `brief` once the session was shown the full preamble ({@link briefed}), and one that is no stop names in
      * `intro` the spawner of an endpoint a `swarm spawn` grant placed, with the grant's steer key in `intro_key`, until a hook showed it
      * ({@link introduced}). A hook of another process than the one holding the endpoint (a child that inherited the session key) gets nothing.
+     * A wake also offers live workers' messages.
      */
     inject(endpoint: string, options?: {
         stop?: boolean;
@@ -1317,6 +1413,7 @@ declare class RelayCore {
         directives?: boolean;
         transient?: boolean;
         process?: string;
+        wake?: boolean;
     }): {
         messages: Envelope[];
         offered: number[];
@@ -1358,12 +1455,13 @@ declare class RelayCore {
      * messages no hook has shown or holds follow theirs ({@link pushOthers}), `others_shown` of them, held with them; `others` counts the other
      * unread ones left. A live worker's messages wait ${LIMITS.pushGapS} s after a push showed one of its own ({@link pushed}), and with no
      * push left since the last prompt nothing is shown. `prompted` says a prompt came since inject handed out the `prompts` mark. A hook of
-     * another process than the one holding the endpoint gets nothing.
+     * another process than the one holding the endpoint gets nothing. `peek`: the same answer, nothing held (`hold` null) or marked received.
      */
     stopWait(endpoint: string, options?: {
         transient?: boolean;
         process?: string;
         prompts?: number;
+        peek?: boolean;
     }): StopWaitResult;
     /**
      * the unread messages no hook has shown or holds that a push shows after its workers' ({@link pushable}): newest first, up to
@@ -1384,6 +1482,10 @@ declare class RelayCore {
         transient?: boolean;
         process?: string;
     }): boolean;
+    /** whether a prompt should remind the agent to refresh its status note: `every` prompts passed since the note or the last reminder; counts the reminder */
+    tldrDue(endpoint: string, every: number): boolean;
+    /** the background hooks' showings ({@link injected}) older than ${LIMITS.deferredSettleMs} ms reached the agent: inbox no longer lists them */
+    private settle;
     /**
      * The endpoint's live spawned workers: its unrevoked spawn grants (minted by `swarm spawn` without --no-push, never by spawn-env) from its
      * current spawn that are either unspent and unexpired (`starting`: the harness has not joined yet) or spent by an endpoint whose status is not
@@ -1431,11 +1533,14 @@ declare class RelayCore {
     }): number;
     /**
      * a hook or channel showed these deliveries, offered to it under `hold`: no hook offers them again; those of them it marked that are `read`
-     * (printed in full) and delivered to `endpoint` are acked; how many it marked
+     * (printed in full) and delivered to `endpoint` are acked, and with `deferred` (a background hook, whose text the harness hands the agent
+     * later) still listed by {@link inbox} until that settles ({@link settle}) and marked delivered rather than read ({@link receipts}) until
+     * the agent acks it itself; how many it marked
      */
     injected(seqs: unknown, hold: unknown, options?: {
         endpoint?: string;
         read?: unknown;
+        deferred?: boolean;
     }): number;
     /**
      * whether a caller acts for the harness process holding the endpoint: any non-hook caller, a hook of that process (equal keys, or a bare and a
@@ -1451,6 +1556,14 @@ declare class RelayCore {
      * ${MESSAGE_SUFFIX_MIN} characters, such as its {@link shortId}. Null when there is none; invalid_params when the reference is ambiguous
      */
     delivered(endpoint: string, id: unknown): Envelope | null;
+    /**
+     * a message `endpoint` sent, by its id, a unique suffix of at least ${MESSAGE_SUFFIX_MIN} characters such as its {@link shortId}, or `last`
+     * (the newest it sent), with when each recipient read it (acked), or when a background hook delivered it (acked by that showing, the agent
+     * gets it with its next request, `delivered_at` and no `read_at`), and when a hook or channel showed it; a recipient still waiting for a
+     * `swarm spawn` to join is named by the spawn's address. not_found when it sent no such message; invalid_params when a suffix names more
+     * than one
+     */
+    receipts(endpoint: string, id: unknown): MessageReceipts;
     /**
      * another endpoint's message in a thread `endpoint` sent or got a message in, by its id or a unique suffix of at least ${MESSAGE_SUFFIX_MIN}
      * characters: enough to reply to it, never its body. Null when there is none; invalid_params when the suffix names more than one
@@ -1472,6 +1585,7 @@ declare class RelayCore {
     /** reading messages counts as receiving them for the causal hop */
     private received;
     hasUnread(endpoint: string, after?: number): boolean;
+    /** marks these deliveries to `endpoint` read, one a background hook's showing acked ({@link injected}) read now too; how many were unread */
     ack(endpoint: string, seqs: unknown): number;
     /**
      * the first reply to a request this endpoint sent, delivered to it from an endpoint the request was delivered to (any, for one the hub
@@ -1499,6 +1613,8 @@ declare class RelayCore {
     }): AuditRow[];
     /** drops what expired: deliveries, message bodies past their grace, old guard state and old audit rows */
     sweep(): void;
+    /** ends the hook presence of local agent endpoints whose harness process exited without a session_end, as one would */
+    endExited(now?: number): void;
     /** an agent endpoint left offline drops a working or waiting status, which no one is left to keep current */
     private settleOffline;
     /**
@@ -1608,6 +1724,8 @@ declare class RelayCore {
         in?: string[];
         out?: string[];
     }): ScopeChange;
+    /** the grant issuer's messages to the endpoint that spent it, sent since the grant, that it read, all but those among `unapplied`, oldest first */
+    private readSteers;
     /**
      * a message needs both ends: for each `ep:` selector `widen` added on `target`, the other end's side is widened to admit `target` too when
      * `me` has authority over it, audited as its own widening; when that side still refuses, the change names it and the command that would fix it.
@@ -1695,8 +1813,9 @@ declare class RelayCore {
     /**
      * a spawn's handback to its spawner `me`, the grant's issuer, from the worker (the relay when it never joined): past scopes, pair limits and
      * the judge, since the spawner minted the grant and is the recipient. One per grant (null once sent), in the thread the two last wrote in,
-     * else one derived from the grant, naming by short id the spawner's messages the worker left unread; its hop follows the worker's causal
-     * hop, capped, and a full thread drops it (null). A worker that never joined or exited non-zero gets its `stderr` last, labelled, its
+     * else one derived from the grant, naming by short id the spawner's messages the worker read, with when (one a background hook showed only
+     * delivered, unless the worker then exited 0: its model had the next request), and those it left unread; its hop follows the worker's
+     * causal hop, capped, and a full thread drops it (null). A worker that never joined or exited non-zero gets its `stderr` last, labelled, its
      * output cut from the front so both stay within ${LIMITS.handbackBytes} bytes
      */
     private handback;
@@ -1946,6 +2065,13 @@ type Delivery = Pick<SendResult["deliveries"][number], "address" | "offline" | "
  * when the broker named no state. With `late`, only those that will not see it at their next turn boundary
  */
 declare function reachLines(deliveries: Delivery[], late?: boolean): string[];
+/** a time, as ms or ISO, as `HH:MM:SS` in local time */
+declare function clock(at: number | string): string;
+/**
+ * a sent message's recipients as lines, one each: when it read the message, else when a background hook delivered it, else when a hook or
+ * channel showed it, else unread
+ */
+declare function receiptLines(receipts: Pick<MessageReceipts, "recipients">): string[];
 /** a widening's result: what it added and clipped, the other ends it widened too, and those that still refuse with the fix */
 declare function widenText(change: ScopeChange, endpoint: string): string[];
 /** tool names collapsed in first-seen order, `Edit x3` for repeats */
@@ -2027,8 +2153,9 @@ declare function redactPii(text: string): string;
 /** what stands where a handback lost earlier output, on its own line */
 declare const HANDBACK_CUT = "[earlier output cut]";
 /**
- * clean text's last `bytes` bytes: all of it when it fits and nothing was `dropped`, else from the first line that starts in reach (a
- * character boundary when one line is longer than that) behind {@link HANDBACK_CUT} on its own line, when the cap has room for it
+ * clean text's last `bytes` bytes: all of it when it fits and nothing was `dropped`, else from the first line that starts in reach behind
+ * {@link HANDBACK_CUT} on its own line, when the cap has room for it; from a character boundary within the line cut instead when that line
+ * alone is longer than the reach and starting at the next one would keep less than half of it
  */
 declare function keepLast(text: string, bytes: number, dropped?: boolean): string;
 /**
@@ -2295,4 +2422,4 @@ declare function sha256Hex(text: string): string;
 /** the UTF-8 byte length of text, the unit every byte limit counts in */
 declare function utf8Bytes(text: string): number;
 
-export { ACCOUNT_HANDLE, ACTIVITY_KINDS, type ActivityKind, type ActivityRow, type Admission, type AskResult, type Attachment, type AuditRow, BROKER_CAPABILITIES, type BreakerAdmission, CAPABILITIES, CLI_NAME, type Claim, type CoreOptions, type CrossAccountGate, type CrossAccountLink, DEFAULT_IMPLEMENTATION_PREFIXES, DEFAULT_JUDGE_BUDGET, DEFAULT_JUDGE_EFFORT, type DataClass, ERROR_CODES, type EndpointKind, type EndpointRow, type EndpointView, type Envelope, type ErrorCode, FakeJudgeClient, GONE_PREFIX, GROUP_NAME, type GateContext, type GateVerdict, HANDBACK_CUT, HUMAN_HANDLE, HttpJudgeClient, type HttpJudgeOptions, JUDGE_BREAKER_DEFAULTS, JUDGE_CATEGORIES, JUDGE_EFFORTS, JUDGE_FALLBACK_NOTE, JUDGE_MAX_OUTPUT_TOKENS, JUDGE_PROMPT_VERSION, JUDGE_PROVIDERS, JUDGE_VERDICTS, type JudgeAuditDetail, type JudgeAuditEvent, type JudgeBoundary, JudgeBreaker, type JudgeBreakerOptions, type JudgeBudget, type JudgeCategory, type JudgeClient, type JudgeContext, type JudgeEffort, type JudgeHeld, type JudgeModelConfig, type JudgePolicy, type JudgeProvider, JudgeProviderError, type JudgeRedacted, type JudgeSide, type JudgeStats, type JudgeVerdict, LIMITS, MESSAGE_KINDS, type MessageKind, type MessageRow, OMITTED, PASS_GATE, PEEK, PREAMBLE, PREAMBLE_BRIEF, PRESET_LISTS, PROTOCOL, type PeekLevel, type PeekResult, type PeekSeen, type PeekState, type PeekTurn, type PeerView, type PiiHit, type Policy, type PolicyDefaults, type PolicyGroup, type PolicyRule, type PolicySubject, type Prefiltered, type Presence, REDACTION_KINDS, type Reach, type Redaction, RelayCore, RelayError, type RunJudgeInput, SCOPE_PRESETS, SERVER_FIELDS, SHORT_ID, STATUS_STATES, SYSTEM_HANDLE, type ScopeActor, type ScopeCap, type ScopeCaps, type ScopeChange, type ScopeDecision, type ScopeDirection, type ScopeEntry, type ScopeGroupIdentity, type ScopeGroupRules, type ScopeList, type ScopeNode, type ScopePolicyCap, type ScopePreset, type ScopeRules, type ScopeSubject, type ScopeView, type ScopeWorld, type SecretScanner, type Selector, type SendParams, type SendResult, type Sql, type SqlValue, type StatusState, type StopNudge, type StopWaitResult, type ThreadMessage, type Verdict, VerdictCache, type WhyResult, type XAllow, type XContact, XCounters, type XDelivered, type XEnvelopeFrom, XLIMITS, type XLimitConfig, type XLimits, type XListed, type XMessage, type XRelease, admits, allowlisted, applyRedactions, canonicalPolicy, cleanLabels, cleanText, clip, clipPasses, clipped, collapseTools, createSecretScanner, crossFleet, dayStart, declaredLimits, deliveryText, digestText, dropQuoted, effectiveSelector, expandRules, findPii, findSecret, gateRefusal, groupCapKey, handbackOutput, hasScope, honestSender, isLeaving, joinRedacted, judgeBoundary, judgeDetailForAgents, judgeFellBack, judgeModel, judgePrompt, keepLast, leavesFleet, matches, mergeVerdicts, narrower, newId, newJudgeStats, one, parseJudgePolicy, parsePolicy, parseVerdict, parseXMessage, peekLevel, policyRefusal, prefilter, presetOf, randomHex, reachLines, readText, redactPii, redactSecrets, redactionKind, relation, relationText, replyGrant, runJudge, sameSecret, scopeDecision, scopeLists, seqList, setImplementationPrefixes, sha256Hex, shortId, steerNote, stripControl, stripRelaySpans, stripSteerNote, unreachable, untilTomorrow, utf8Bytes, validHandle, validHarness, validSelector, widenText, wrapMessage, wrapPeek, xlimits };
+export { ACCOUNT_HANDLE, ACTIVITY_KINDS, type ActivityKind, type ActivityRow, type Admission, type AskResult, type Attachment, type AuditRow, BROKER_CAPABILITIES, type BreakerAdmission, CAPABILITIES, CLI_NAME, type Claim, type CoreOptions, type CrossAccountGate, type CrossAccountLink, DEFAULT_IMPLEMENTATION_PREFIXES, DEFAULT_JUDGE_BUDGET, DEFAULT_JUDGE_EFFORT, type DataClass, ERROR_CODES, type EndpointKind, type EndpointRow, type EndpointView, type Envelope, type ErrorCode, FakeJudgeClient, GONE_PREFIX, GROUP_NAME, type GateContext, type GateVerdict, HANDBACK_CUT, HUMAN_HANDLE, HttpJudgeClient, type HttpJudgeOptions, JUDGE_BREAKER_DEFAULTS, JUDGE_CATEGORIES, JUDGE_EFFORTS, JUDGE_FALLBACK_NOTE, JUDGE_MAX_OUTPUT_TOKENS, JUDGE_PROMPT_VERSION, JUDGE_PROVIDERS, JUDGE_VERDICTS, type JudgeAuditDetail, type JudgeAuditEvent, type JudgeBoundary, JudgeBreaker, type JudgeBreakerOptions, type JudgeBudget, type JudgeCategory, type JudgeClient, type JudgeContext, type JudgeEffort, type JudgeHeld, type JudgeModelConfig, type JudgePolicy, type JudgeProvider, JudgeProviderError, type JudgeRedacted, type JudgeSide, type JudgeStats, type JudgeVerdict, LIMITS, MESSAGE_KINDS, type MessageKind, type MessageReceipts, type MessageRow, OMITTED, PASS_GATE, PEEK, PREAMBLE, PREAMBLE_BRIEF, PRESET_LISTS, PROTOCOL, type PeekLevel, type PeekResult, type PeekSeen, type PeekState, type PeekTurn, type PeerView, type PiiHit, type Policy, type PolicyDefaults, type PolicyGroup, type PolicyRule, type PolicySubject, type Prefiltered, type Presence, REDACTION_KINDS, type Reach, type Redaction, RelayCore, RelayError, type RunJudgeInput, SCOPE_PRESETS, SERVER_FIELDS, SHORT_ID, STATUS_STATES, SYSTEM_HANDLE, type ScopeActor, type ScopeCap, type ScopeCaps, type ScopeChange, type ScopeDecision, type ScopeDirection, type ScopeEntry, type ScopeGroupIdentity, type ScopeGroupRules, type ScopeList, type ScopeNode, type ScopePolicyCap, type ScopePreset, type ScopeRules, type ScopeSubject, type ScopeView, type ScopeWorld, type SecretScanner, type Selector, type SendParams, type SendResult, type Sql, type SqlValue, type StatusState, type StopNudge, type StopWaitResult, TITLE_CHARS, type ThreadMessage, type Verdict, VerdictCache, type WhyResult, type XAllow, type XContact, XCounters, type XDelivered, type XEnvelopeFrom, XLIMITS, type XLimitConfig, type XLimits, type XListed, type XMessage, type XRelease, admits, allowlisted, applyRedactions, canonicalPolicy, cleanLabels, cleanText, clip, clipPasses, clipped, clock, collapseTools, createSecretScanner, crossFleet, dayStart, declaredLimits, deliveryText, digestText, dropQuoted, effectiveSelector, expandRules, findPii, findSecret, gateRefusal, groupCapKey, handbackOutput, hasScope, honestSender, isLeaving, joinRedacted, judgeBoundary, judgeDetailForAgents, judgeFellBack, judgeModel, judgePrompt, keepLast, leavesFleet, matches, mergeVerdicts, narrower, newId, newJudgeStats, one, parseJudgePolicy, parsePolicy, parseVerdict, parseXMessage, peekLevel, policyRefusal, prefilter, presetOf, randomHex, reachLines, readText, receiptLines, redactPii, redactSecrets, redactionKind, relation, relationText, replyGrant, runJudge, sameSecret, scopeDecision, scopeLists, seqList, setImplementationPrefixes, sha256Hex, shortId, steerNote, stripControl, stripRelaySpans, stripSteerNote, unreachable, untilTomorrow, utf8Bytes, validHandle, validHarness, validSelector, widenText, wrapMessage, wrapPeek, xlimits };