humanish 0.117.0 → 0.119.0

package/dist/analysis/responses.d.ts

@@ -0,0 +1,19 @@
+import type { RejectedAnalysisOutput } from "./diagnostics.js";
+import type { AnalysisProviderResult } from "./provider.js";
+import type { AnalysisArtifact, AnalysisConfig, AnalysisInput, AnalysisResult } from "./types.js";
+export type CheckedProviderAnalysis = {
+    ok: true;
+    result: AnalysisResult;
+} | {
+    ok: false;
+    error: string;
+    rejected?: RejectedAnalysisOutput;
+};
+export declare function checkProviderAnalysis(input: AnalysisInput, value: unknown): CheckedProviderAnalysis;
+/**
+ * Copy the reported tokens of every response onto the artifact, summed. OpenAI usage is priced with
+ * each response as its own request, since the long-context tier re-prices one request at a time.
+ */
+export declare function recordProviderUsage(artifact: AnalysisArtifact, config: AnalysisConfig, responses: readonly AnalysisProviderResult[]): void;
+/** The warnings a Codex response carries about its CLI release and protocol. */
+export declare function codexWarnings(config: AnalysisConfig, response: AnalysisProviderResult): string[];

package/dist/analysis/responses.js

@@ -0,0 +1,201 @@
+// What the provider responses of one attempt give it: the usage they report, the warnings a Codex
+// response carries, and each response checked before it becomes an analysis result (the response
+// schema, the scrub of known transient values from generated prose, and the evidence rules in
+// validation.ts). Only an allowlisted code leaves a check; the rejected output goes to the caller
+// for local diagnosis.
+import { truncatedFrameWarning, unknownNotificationsWarning, } from "../actors/codex/restricted-notifications.js";
+import { protocolAdditionsWarning, protocolIncompatibilityMessage, } from "../actors/codex/protocol-compat.js";
+import { estimateActorCost } from "../run/pricing.js";
+import { transientCommsKnownValueScrub } from "../run/transient-comms-secrets.js";
+import { analysisResponseSchema, checkAnalysisResult } from "./validation.js";
+/** Scrub only generated prose. Source evidence, provenance and integrity hashes remain exact. A
+ * known value is found as written and in its encoded forms. */
+function scrubGeneratedNarrative(result) {
+    const scrub = transientCommsKnownValueScrub();
+    const observation = (value) => ({
+        ...value,
+        claim: scrub(value.claim),
+        limitation: scrub(value.limitation),
+    });
+    // A model can also echo a key as a syntactically valid finding ID. Refuse it without rewriting
+    // IDs, references or enums (including accidental collisions); never repair citation structure.
+    const structural = [
+        ...result.participants.flatMap((value) => [
+            value.streamId,
+            value.outcome,
+            ...value.evidenceIds,
+            ...value.feedback.map((quote) => quote.evidenceId),
+        ]),
+        ...result.findings.flatMap((value) => [
+            value.id,
+            value.impact,
+            value.recovery,
+            value.confidence,
+            ...value.affectedStreamIds,
+            ...value.exposedStreamIds,
+            ...value.observations.flatMap((item) => [item.basis, ...item.evidenceIds]),
+        ]),
+        ...(result.designFindings ?? []).flatMap((value) => [
+            value.id,
+            value.severity,
+            value.confidence,
+            ...value.seenByStreamIds,
+            ...value.evidenceIds,
+        ]),
+        ...(result.concernReviews ?? []).flatMap((value) => [
+            value.basis,
+            value.disposition,
+            ...(value.findingId === null ? [] : [value.findingId]),
+            ...value.evidenceIds,
+        ]),
+    ];
+    if (structural.some((value) => scrub(value) !== value))
+        throw new Error("ANALYSIS_TRANSIENT_SECRET_IN_STRUCTURE");
+    return {
+        ...result,
+        summary: scrub(result.summary),
+        limitations: result.limitations.map(scrub),
+        participants: result.participants.map((value) => ({
+            ...value,
+            summary: scrub(value.summary),
+            intent: scrub(value.intent),
+            outcomeReason: scrub(value.outcomeReason),
+            limitations: value.limitations.map(scrub),
+            feedback: value.feedback.map((quote) => ({ ...quote, text: scrub(quote.text) })),
+        })),
+        findings: result.findings.map((value) => ({
+            ...value,
+            title: scrub(value.title),
+            ...(value.headline === undefined ? {} : { headline: scrub(value.headline) }),
+            ...(value.experience === undefined ? {} : { experience: scrub(value.experience) }),
+            summary: scrub(value.summary),
+            exposureReason: scrub(value.exposureReason),
+            nextStep: scrub(value.nextStep),
+            priorityReason: scrub(value.priorityReason),
+            observations: value.observations.map(observation),
+        })),
+        ...(result.designFindings === undefined
+            ? {}
+            : {
+                designFindings: result.designFindings.map((value) => ({
+                    ...value,
+                    headline: scrub(value.headline),
+                    screen: scrub(value.screen),
+                    notice: scrub(value.notice),
+                    whyItMatters: scrub(value.whyItMatters),
+                    suggestion: scrub(value.suggestion),
+                })),
+            }),
+        ...(result.concernReviews === undefined
+            ? {}
+            : {
+                concernReviews: result.concernReviews.map((value) => ({
+                    ...observation(value),
+                    reason: scrub(value.reason),
+                })),
+            }),
+    };
+}
+const VALIDATION_FAILURES = Object.freeze({
+    ANALYSIS_RESULT_SCHEMA_INVALID: "analysis_validation_failed_schema_invalid",
+    ANALYSIS_DESIGN_FINDING_ID_DUPLICATE: "analysis_validation_failed_design_finding_id_duplicate",
+    ANALYSIS_DESIGN_REFERENCE_INVALID: "analysis_validation_failed_design_reference_invalid",
+    ANALYSIS_DESIGN_WITHOUT_CAPTURE: "analysis_validation_failed_design_without_capture",
+    ANALYSIS_DESIGN_MEMBERSHIP_INVALID: "analysis_validation_failed_design_membership_invalid",
+    ANALYSIS_INPUT_DUPLICATES: "analysis_validation_failed_input_duplicates",
+    ANALYSIS_PARTICIPANT_COVERAGE_INVALID: "analysis_validation_failed_participant_coverage_invalid",
+    ANALYSIS_PARTICIPANT_REFERENCE_INVALID: "analysis_validation_failed_participant_reference_invalid",
+    ANALYSIS_OUTCOME_WITHOUT_EVIDENCE: "analysis_validation_failed_outcome_without_evidence",
+    ANALYSIS_QUOTE_INVALID: "analysis_validation_failed_quote_invalid",
+    ANALYSIS_FINDING_ID_DUPLICATE: "analysis_validation_failed_finding_id_duplicate",
+    ANALYSIS_OBSERVATION_REFERENCE_INVALID: "analysis_validation_failed_observation_reference_invalid",
+    ANALYSIS_VISUAL_WITHOUT_CAPTURE: "analysis_validation_failed_visual_without_capture",
+    ANALYSIS_ACTION_SOURCE_INVALID: "analysis_validation_failed_action_source_invalid",
+    ANALYSIS_STATEMENT_SOURCE_INVALID: "analysis_validation_failed_statement_source_invalid",
+    ANALYSIS_FINDING_MEMBERSHIP_INVALID: "analysis_validation_failed_finding_membership_invalid",
+    ANALYSIS_AFFECTED_WITHOUT_EVIDENCE: "analysis_validation_failed_affected_without_evidence",
+    ANALYSIS_CONCERN_FINDING_INVALID: "analysis_validation_failed_concern_finding_invalid",
+});
+export function checkProviderAnalysis(input, value) {
+    try {
+        const parsed = analysisResponseSchema.safeParse(value);
+        if (!parsed.success) {
+            const error = VALIDATION_FAILURES.ANALYSIS_RESULT_SCHEMA_INVALID;
+            return { ok: false, error, rejected: { error, errors: [], output: value } };
+        }
+        let scrubbed;
+        try {
+            scrubbed = scrubGeneratedNarrative(parsed.data);
+        }
+        catch (error) {
+            if (!(error instanceof Error && error.message === "ANALYSIS_TRANSIENT_SECRET_IN_STRUCTURE"))
+                return { ok: false, error: "analysis_validation_failed_unexpected" };
+            const rejected = "analysis_validation_failed_scrub_rejected";
+            return {
+                ok: false,
+                error: rejected,
+                rejected: { error: rejected, errors: [], output: value },
+            };
+        }
+        const checked = checkAnalysisResult(input, scrubbed);
+        if (!checked.ok) {
+            const error = VALIDATION_FAILURES[checked.errors[0] ?? ""] ?? "analysis_validation_failed_unexpected";
+            return {
+                ok: false,
+                error,
+                rejected: { error, errors: [...checked.errors], output: scrubbed },
+            };
+        }
+        return checked;
+    }
+    catch {
+        return { ok: false, error: "analysis_validation_failed_unexpected" };
+    }
+}
+/**
+ * Copy the reported tokens of every response onto the artifact, summed. OpenAI usage is priced with
+ * each response as its own request, since the long-context tier re-prices one request at a time.
+ */
+export function recordProviderUsage(artifact, config, responses) {
+    const { usage } = artifact;
+    usage.dispatched = responses.some((response) => response.dispatched);
+    const turns = responses.flatMap((response) => (response.usage ? [response.usage] : []));
+    if (turns.length === 0)
+        return;
+    const total = (key) => turns.some((turn) => turn[key] !== undefined)
+        ? turns.reduce((sum, turn) => sum + (turn[key] ?? 0), 0)
+        : undefined;
+    const tokens = {
+        input: total("input"),
+        output: total("output"),
+        ...(total("cachedInput") === undefined ? {} : { cachedInput: total("cachedInput") }),
+        ...(total("cacheWriteInput") === undefined
+            ? {}
+            : { cacheWriteInput: total("cacheWriteInput") }),
+    };
+    const priced = config.provider === "codex"
+        ? { estimatedCostUsd: null, ratesAsOf: null }
+        : estimateActorCost({ ...tokens, turns }, config.model);
+    usage.inputTokens = tokens.input;
+    usage.outputTokens = tokens.output;
+    usage.cachedInputTokens = tokens.cachedInput ?? null;
+    usage.cacheWriteInputTokens = tokens.cacheWriteInput ?? null;
+    usage.usageComplete = responses.every((response) => !response.dispatched ||
+        (response.usage !== null && (response.usageComplete ?? config.provider !== "codex")));
+    usage.estimatedCostUsd = priced.estimatedCostUsd;
+    usage.ratesAsOf = priced.ratesAsOf;
+}
+/** The warnings a Codex response carries about its CLI release and protocol. */
+export function codexWarnings(config, response) {
+    if (config.provider !== "codex")
+        return [];
+    const { cliVersion } = config.identity;
+    return [
+        response.protocolIncompatibilities === undefined
+            ? undefined
+            : protocolIncompatibilityMessage(cliVersion, response.protocolIncompatibilities),
+        protocolAdditionsWarning(cliVersion, response.protocolAdditions),
+        unknownNotificationsWarning(response.unknownNotifications, cliVersion),
+        truncatedFrameWarning(response.truncatedFrameBytes),
+    ].filter((warning) => warning !== undefined);
+}

package/dist/analysis/store.js

@@ -10,7 +10,8 @@ import { ANALYSIS_ID_PATTERN, } from "./types.js";
 import { RUN_BUNDLE_FILE } from "../run/bundle.js";
 export const ANALYSIS_DIRECTORY = "analysis";
 export const ANALYSIS_EXECUTION_DIRECTORY = "analysis-attempts";
-export const ANALYSIS_MAX_BYTES = 4 * 1024 * 1024;
+// 4 MiB held one packet; a run of 128 participants stores eight cohorts' packets.
+export const ANALYSIS_MAX_BYTES = 16 * 1024 * 1024;
 export const MAX_VERSIONS = 256;
 const MAX_CORRECTIONS = 256;
 const MAX_CORRECTION_BYTES = 32 * 1024;

package/dist/analysis/validation.js

@@ -2,7 +2,7 @@ import { validStoredCodexAnalysisConfig } from "./codex-config.js";
 import { createHash } from "node:crypto";
 import { z } from "zod";
 import { ACTOR_STATUSES, ACTOR_STOP_CAUSES } from "../actors/contract.js";
-import { ANALYSIS_LIMITS, hasControlCharacter, hasRevisionFields } from "./analysis-limits.js";
+import { ANALYSIS_LIMITS, EVIDENCE_LIMITS, MAX_ANALYSIS_COHORTS, hasControlCharacter, hasRevisionFields, } from "./analysis-limits.js";
 import { SHA256_HEX_PATTERN, ACTION_CAPTURE_VERSION, ANALYSIS_SCHEMA, ANALYSIS_CORRECTION_SCHEMA, } from "./types.js";
 const text = (max) => z
     .string()
@@ -17,7 +17,7 @@ const id = z
 const sourceId = text(256).min(1);
 const digest = z.string().regex(SHA256_HEX_PATTERN);
 const timestamp = z.string().datetime({ offset: true });
-const sourceIds = z.array(sourceId).max(128);
+const sourceIds = z.array(sourceId).max(EVIDENCE_LIMITS.participants);
 const refs = z.array(id).min(1).max(ANALYSIS_LIMITS.evidenceRefs);
 const limitations = z.array(text(2000).min(1)).max(100);
 const observationSchema = z
@@ -60,7 +60,7 @@ const analysisResultSchema = z
         limitations,
     })
         .strict())
-        .max(128),
+        .max(EVIDENCE_LIMITS.participants),
     findings: z
         .array(z
         .object({
@@ -116,12 +116,18 @@ const normalizedResult = ({ concernReviews, designFindings, findings, ...result
     ...(designFindings === undefined ? {} : { designFindings }),
     ...(concernReviews === undefined ? {} : { concernReviews }),
 });
+// A run's packet holds every cohort's packet.
+const MAX_PACKET_EVIDENCE = EVIDENCE_LIMITS.evidence * MAX_ANALYSIS_COHORTS;
 const analysisCoverageSchema = z
     .object({
     includedStreamIds: sourceIds,
     omittedStreamIds: sourceIds,
-    evidenceCount: z.number().int().min(0).max(2000),
-    captureCount: z.number().int().min(0).max(64),
+    evidenceCount: z.number().int().min(0).max(MAX_PACKET_EVIDENCE),
+    captureCount: z
+        .number()
+        .int()
+        .min(0)
+        .max(EVIDENCE_LIMITS.captures * MAX_ANALYSIS_COHORTS),
     complete: z.boolean(),
     omissions: limitations,
 })
@@ -264,9 +270,9 @@ const analysisArtifactSchema = z
         provenance: analysisParticipantProvenanceSchema,
     })
         .strict())
-        .max(128),
+        .max(EVIDENCE_LIMITS.participants),
     coverage: analysisCoverageSchema,
-    evidence: z.array(analysisEvidenceSchema).max(2000),
+    evidence: z.array(analysisEvidenceSchema).max(MAX_PACKET_EVIDENCE),
     result: analysisResultSchema.nullable(),
     error: z
         .string()

package/dist/cli/commands/analyze.js

@@ -1,7 +1,8 @@
-import { resolveAutomaticAnalysis, DEFAULT_ANALYSIS_MODEL, DEFAULT_ANALYSIS_TIMEOUT_MS, } from "../../analysis/automatic-config.js";
+import { analysisRequestsText, resolveAutomaticAnalysis, DEFAULT_ANALYSIS_MODEL, DEFAULT_ANALYSIS_TIMEOUT_MS, } from "../../analysis/automatic-config.js";
 import { Command, Option } from "commander";
 import { forTerminal } from "../../routes/terminal/encoding.js";
 import { analyzeRun, correctAnalysis, dryRunBundleRefusal, showAnalysis, } from "../../analysis/service.js";
+import { admissionRule } from "../../analysis/admission.js";
 import { listAnalyses } from "../../analysis/store.js";
 import { listAnalysisExecutions } from "../../analysis/store-executions.js";
 import { resolveRunPath } from "../../run/locate.js";
@@ -30,7 +31,7 @@ export function registerAnalyzeCommand(parent, io) {
         .option("--run <id>", RUN_OPTION_DESCRIPTION, "latest")
         .option("--cwd <path>", CWD_OPTION_DESCRIPTION, ".")
         .option("--provider <name>", "Analyst: openai (default) or restricted codex account. No provider fallback.")
-        .option("--max-cost <usd>", "Required for OpenAI, also with --dry-run: send nothing when the expected cost in USD, plus a 10% margin, is above this. It does not limit billing. Unsupported for Codex.")
+        .option("--max-cost <usd>", `Required for OpenAI, also with --dry-run: an analysis is refused before it sends anything if ${admissionRule("this")}. It does not limit billing. Unsupported for Codex.`)
         .option("--model <id>", "Supported vision model. OpenAI uses high effort; qualified Codex account analysis uses low effort.", DEFAULT_ANALYSIS_MODEL)
         .option("--question <text>", "Additional reviewer question; does not change participant instructions.")
         .option("--timeout-ms <ms>", "Request timeout, at most 600000 ms.", String(DEFAULT_ANALYSIS_TIMEOUT_MS))
@@ -232,8 +233,13 @@ async function handleAnalyzeCorrect(io, options, command) {
         io.setExitCode(2);
     }
 }
-/** An admitted dry run's costs: the expected cost, the worst case and the cap it was admitted under. */
+/**
+ * An admitted dry run's costs: the expected cost, the worst case and the cap it was admitted
+ * under. The worst case of an analysis in cohorts is every request writing its whole allowance.
+ */
 function admittedDryRunText(admission) {
     const usd = (value) => value === null || value === undefined ? "unknown" : `$${value.toFixed(2)}`;
-    return `Expected cost: ${usd(admission?.estimatedCostUsd)}. Worst case: ${usd(admission?.worstCaseCostUsd)}, if the analyst writes its whole ${admission?.outputTokenAllowance ?? "unknown"}-token output allowance, reasoning included. Admitted under the $${admission?.maxCostUsd ?? "unknown"} cap. No request sent.\n`;
+    const requests = analysisRequestsText(admission?.requests ?? 1);
+    const writer = requests === undefined ? "the analyst writes its" : `every request (${requests}) writes its`;
+    return `Expected cost: ${usd(admission?.estimatedCostUsd)}. Worst case: ${usd(admission?.worstCaseCostUsd)}, if ${writer} whole ${admission?.outputTokenAllowance ?? "unknown"}-token output allowance, reasoning included. Admitted under the $${admission?.maxCostUsd ?? "unknown"} cap. No request sent.\n`;
 }

package/dist/cli/commands/study-format.js

@@ -1,5 +1,6 @@
 import { participantCaption } from "../../run/participant-caption.js";
 import { formatCuaDiagnostics, formatCuaStopCause } from "../../routes/computer-use/diagnostics.js";
+import { subjectName } from "../../run/subject-name.js";
 /**
  * A run's first lines: the command that ran, whether it was a dry run, how it ended, and its route.
  * `runOk` is the run's own ok, which automaticAnalysisEnvelope keeps when an analysis that did not
@@ -38,16 +39,12 @@ function sandboxIdsLine(result) {
         : [];
 }
 /**
- * How a run's output names its subject: by the URL its participants open. A product studied at a
- * desktop has no URL, so it is named with its source, as in `humanish (desktop-cli)`. A refusal
- * made before the route resolved a URL has none either, so it names the URL the study declares.
+ * The `subject:` line's name for the study's declared subject. A refusal made before the route
+ * resolved a URL has none, so it names the URL the study declares.
  */
-function subjectName(appUrl, subject) {
-    if (appUrl !== "")
-        return appUrl;
-    if (subject.product !== undefined)
-        return `${subject.product.name} (${subject.source})`;
-    return subject.appUrl ?? subject.serve?.url ?? subject.source;
+function subjectLine(appUrl, subject) {
+    const named = subjectName(appUrl, { source: subject.source, product: subject.product?.name });
+    return named !== "" ? named : (subject.appUrl ?? subject.serve?.url ?? subject.source);
 }
 /** A participant's status in words: a dry run's placeholder status says that nothing ran live. */
 function participantStatus(status) {
@@ -107,7 +104,7 @@ export function formatScriptedStudyHuman(result, subject) {
         ...runHeader(result, "scripted"),
         `run: ${result.runId}`,
         `actor: ${result.actor}`,
-        `subject: ${subjectName(result.appUrl, subject)}`,
+        `subject: ${subjectLine(result.appUrl, subject)}`,
         ...(result.scenario
             ? [
                 `scenario: ${result.scenario.id} @ ${result.scenario.sourceDigest.slice(0, 12)} (${result.scenario.source}, ${result.scenario.steps} step${result.scenario.steps === 1 ? "" : "s"})`,
@@ -133,7 +130,7 @@ export function formatCuaStudyHuman(result, subject) {
         ...runHeader(result, "computer-use"),
         `run: ${result.runId}`,
         `actor: ${result.actor}`,
-        `subject: ${subjectName(result.appUrl, subject)}`,
+        `subject: ${subjectLine(result.appUrl, subject)}`,
         ...(result.subject?.source === "clone"
             ? [
                 `repo: ${result.subject.repo}${result.subject.commit ? `@${result.subject.commit.slice(0, 12)}` : ""}${result.subject.envNames && result.subject.envNames.length > 0 ? ` env=[${result.subject.envNames.join(", ")}]` : ""}`,

package/dist/cli/commands/study-route-shared-world.js

@@ -39,7 +39,9 @@ export function sharedWorldRouteRun(args) {
             topology: "shared-world",
             topologyMode: "concurrent",
             roleCount: participantList(args.config)?.length ?? 0,
-            concurrency: args.config.execution?.concurrency ?? 1,
+            // Refused before it planned: the declared cap, else every participant.
+            concurrency: args.config.execution?.concurrency ??
+                Math.max(1, participantList(args.config)?.length ?? 0),
             dryRun,
             runId: runId ?? args.options.runId ?? "not-created",
             roles: [],

package/dist/cli/commands/study-run.js

@@ -1,8 +1,8 @@
-import { automaticAnalysisBudget, formatAutomaticAnalysisBudget, } from "../../analysis/automatic-config.js";
 import { resolve } from "node:path";
 import { Command } from "commander";
 import { deriveRunFacts } from "../telemetry.js";
 import { resolveStudyManifest } from "../../study/discover.js";
+import { automaticAnalysisBudget, formatAutomaticAnalysisBudget, } from "../../analysis/automatic-config.js";
 import { warnAndQueue } from "../deprecations.js";
 import { planStudy, resolveStudyDryRun } from "../../study/plan.js";
 import { keyNamesOf } from "../../study/requirements.js";

package/dist/cli/doctor.js

@@ -4,7 +4,7 @@ import { existsSync } from "node:fs";
 import path from "node:path";
 import { DOCTOR_KEYS, probeKeySources, } from "../keys/key-resolution.js";
 import { desktopPeerAdvice, humanishInstall, } from "../substrates/e2b/peer-install.js";
-import { describeSandboxCeiling, sandboxCeiling } from "../substrates/e2b/lifetime.js";
+import { concurrentSandboxes, describeConcurrentSandboxes, describeSandboxCeiling, sandboxCeiling, } from "../substrates/e2b/lifetime.js";
 import { nodeSupportsTui, terminalSurfaceMessage, TUI_BUNDLE_URL } from "../tui/contract.js";
 import { detectLocalAgents, localAgentDoctorMessage, localAgentReady, NO_LOCAL_AGENT_MESSAGE, } from "../actors/local-agent/cli.js";
 import { leftoverClaudeTranscripts } from "../actors/local-agent/claude-participant.js";
@@ -97,6 +97,7 @@ export async function doctor(cwdInput, options = {}) {
         ...(await projectChecks(projectRoot)),
         await desktopSdkCheck(setup),
         sandboxCeilingCheck(env),
+        concurrentSandboxesCheck(env),
         terminalSurfaceCheck(),
         ...versionCheck(env),
         ...localAgentChecks(agents),
@@ -198,6 +199,15 @@ function sandboxCeilingCheck(env) {
     const ceiling = sandboxCeiling(env);
     return { name: "e2b sandbox ceiling", ok: ceiling.ok, message: describeSandboxCeiling(ceiling) };
 }
+/** How many sandboxes the E2B planners run at once, and where that number came from. */
+function concurrentSandboxesCheck(env) {
+    const limit = concurrentSandboxes(env);
+    return {
+        name: "e2b concurrent sandboxes",
+        ok: limit.ok,
+        message: describeConcurrentSandboxes(limit),
+    };
+}
 /**
  * The optional peer dep every live browser and terminal route needs. `npx -y humanish` does not
  * pull optional peers, so without this check an adopter's first live run fails on it, safely and at

package/dist/comms/lease-store.d.ts

@@ -1,4 +1,4 @@
-import type { ReceivingIdentity, ReceivingLease } from "./receiving-types.js";
+import { type ReceivingIdentity, type ReceivingLease } from "./receiving-types.js";
 declare const SCHEMA = "humanish.comms-lease-journal.v1";
 type PhysicalIdentity = {
     path: string;

package/dist/comms/lease-store.js

@@ -6,6 +6,7 @@ import { homedir, hostname } from "node:os";
 import path from "node:path";
 import { isRecord } from "../run/type-guards.js";
 import { isReceivingProviderId } from "./providers.js";
+import { MAX_RECEIVING_INBOXES, } from "./receiving-types.js";
 const SCHEMA = "humanish.comms-lease-journal.v1";
 const MAX_BYTES = 1_048_576;
 const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/;
@@ -117,7 +118,7 @@ function parseJournal(text) {
         !safeString(value.updatedAt) ||
         !Array.isArray(value.leases) ||
         value.leases.length < 1 ||
-        value.leases.length > 64)
+        value.leases.length > MAX_RECEIVING_INBOXES)
         fail();
     const participants = new Set();
     const leaseIds = new Set();
@@ -470,7 +471,7 @@ export class CommsLeaseStore {
             !KEY_ENV.test(options.apiKeyEnv) ||
             !validReceivingIdentity(options.identity) ||
             options.participants.length < 1 ||
-            options.participants.length > 64 ||
+            options.participants.length > MAX_RECEIVING_INBOXES ||
             new Set(options.participants).size !== options.participants.length ||
             options.participants.some((id) => !LOCAL_ID.test(id)))
             fail();

package/dist/comms/receiving-types.d.ts

@@ -3,6 +3,8 @@ import type { ReceivingProviderId } from "./providers.js";
 import type { CommsInlineImage } from "./types.js";
 /** authenticate() rejects with this code when the credential cannot acquire fresh inboxes. */
 export declare const RECEIVING_SCOPE_UNSUPPORTED = "comms_scope_unsupported";
+/** The most inboxes one run leases, one per participant; the lease journal holds this many. */
+export declare const MAX_RECEIVING_INBOXES = 64;
 export interface ReceivingContext {
     signal?: AbortSignal;
     timeoutMs?: number;

package/dist/comms/receiving-types.js

@@ -1,3 +1,5 @@
 /** authenticate() rejects with this code when the credential cannot acquire fresh inboxes. */
 export const RECEIVING_SCOPE_UNSUPPORTED = "comms_scope_unsupported";
+/** The most inboxes one run leases, one per participant; the lease journal holds this many. */
+export const MAX_RECEIVING_INBOXES = 64;
 export const COMMS_RECEIVING_SCHEMA = "humanish.comms-receiving.v2";