@ai-matrx/meet 0.7.6 → 0.7.8

package/dist/index.d.ts

@@ -605,6 +605,55 @@ declare function createMeetApi(options: MeetApiOptions): MeetApi;
 /** `GET /files/{id}/download?inline=1` — the platform files route (R3). */
 declare function fileDownloadPath(fileId: string): string;
 
+/**
+ * ONE error classification for the whole package (C22).
+ *
+ * The banned alternative is a host catching a LiveKit or PostgREST error and
+ * deciding for itself whether the camera is busy, the token expired, or the
+ * meeting is locked — which is how the same five-branch `if` gets copy-pasted
+ * into every consumer and drifts. Everything this package throws is a
+ * `MeetError` with a stable `code` and a `remedy` SENTENCE. Nothing fails
+ * silently, and nothing fails without saying what to do about it.
+ *
+ * The device codes exist because "it doesn't work" in a video product is almost
+ * always one of four specific, differently-remediable things: permission
+ * denied, no such device, device already in use by another app, or insecure
+ * context (http, where `getUserMedia` does not exist at all). A single
+ * "media-error" would make the UI say the wrong sentence three times out of
+ * four.
+ */
+type MeetErrorCode = "session-unavailable" | "forbidden" | "not-found" | "conflict" | "token" | "transport" | "invalid-response" | "misconfigured" | "permission-denied" | "device-not-found" | "device-in-use" | "insecure-context" | "media-unsupported" | "room-locked" | "lobby-denied" | "capacity"
+/** Meet wave 1: the meeting was cancelled — its link resolves, its room never opens. */
+ | "cancelled" | "unknown";
+declare class MeetError extends Error {
+    readonly code: MeetErrorCode;
+    /** What to DO. Rendered to the user for the device codes. */
+    readonly remedy: string;
+    readonly cause?: unknown;
+    constructor(code: MeetErrorCode, message: string, remedy: string, cause?: unknown);
+    /** True when retrying after the host re-establishes a session is the fix. */
+    get isRetryable(): boolean;
+    /** True when the user, not the code, must act — the UI shows `remedy`. */
+    get isUserActionable(): boolean;
+}
+/**
+ * THE ONE PLACE a raw database/transport error becomes a typed one. Called at
+ * every repository boundary; nothing else in the package inspects a raw error,
+ * and no consumer should ever have to.
+ */
+declare function normalizeMeetError(error: unknown, operation: string): MeetError;
+/**
+ * THE DEVICE ERROR TRANSLATOR — the second-most-copied block in every video app.
+ *
+ * `getUserMedia` rejects with DOMException names, and every one of them means
+ * something a user could fix if we told them. This is the whole reason the
+ * device layer lives in the package (C22 test 3: less-than-perfect unless done
+ * perfectly).
+ */
+declare function normalizeDeviceError(error: unknown, operation: string): MeetError;
+/** A response whose SHAPE is wrong — the ingress boundary, not the wire. */
+declare function invalidResponse(operation: string, detail: string): MeetError;
+
 /**
  * WHO SAID THAT — one answer, every surface, both lanes (MRI-A16).
  *
@@ -666,55 +715,6 @@ declare function learnNames(book: NameBook, entries: readonly {
  */
 declare function displayNameFor(book: NameBook, identity: ParticipantIdentity | string, preferred?: string | null | undefined): string;
 
-/**
- * ONE error classification for the whole package (C22).
- *
- * The banned alternative is a host catching a LiveKit or PostgREST error and
- * deciding for itself whether the camera is busy, the token expired, or the
- * meeting is locked — which is how the same five-branch `if` gets copy-pasted
- * into every consumer and drifts. Everything this package throws is a
- * `MeetError` with a stable `code` and a `remedy` SENTENCE. Nothing fails
- * silently, and nothing fails without saying what to do about it.
- *
- * The device codes exist because "it doesn't work" in a video product is almost
- * always one of four specific, differently-remediable things: permission
- * denied, no such device, device already in use by another app, or insecure
- * context (http, where `getUserMedia` does not exist at all). A single
- * "media-error" would make the UI say the wrong sentence three times out of
- * four.
- */
-type MeetErrorCode = "session-unavailable" | "forbidden" | "not-found" | "conflict" | "token" | "transport" | "invalid-response" | "misconfigured" | "permission-denied" | "device-not-found" | "device-in-use" | "insecure-context" | "media-unsupported" | "room-locked" | "lobby-denied" | "capacity"
-/** Meet wave 1: the meeting was cancelled — its link resolves, its room never opens. */
- | "cancelled" | "unknown";
-declare class MeetError extends Error {
-    readonly code: MeetErrorCode;
-    /** What to DO. Rendered to the user for the device codes. */
-    readonly remedy: string;
-    readonly cause?: unknown;
-    constructor(code: MeetErrorCode, message: string, remedy: string, cause?: unknown);
-    /** True when retrying after the host re-establishes a session is the fix. */
-    get isRetryable(): boolean;
-    /** True when the user, not the code, must act — the UI shows `remedy`. */
-    get isUserActionable(): boolean;
-}
-/**
- * THE ONE PLACE a raw database/transport error becomes a typed one. Called at
- * every repository boundary; nothing else in the package inspects a raw error,
- * and no consumer should ever have to.
- */
-declare function normalizeMeetError(error: unknown, operation: string): MeetError;
-/**
- * THE DEVICE ERROR TRANSLATOR — the second-most-copied block in every video app.
- *
- * `getUserMedia` rejects with DOMException names, and every one of them means
- * something a user could fix if we told them. This is the whole reason the
- * device layer lives in the package (C22 test 3: less-than-perfect unless done
- * perfectly).
- */
-declare function normalizeDeviceError(error: unknown, operation: string): MeetError;
-/** A response whose SHAPE is wrong — the ingress boundary, not the wire. */
-declare function invalidResponse(operation: string, detail: string): MeetError;
-
 /**
  * LISTEN-ONLY ATTENDANCE — being IN the room is never contingent on a device.
  *
@@ -995,6 +995,17 @@ interface MeetSnapshot {
         readonly failed: boolean;
         readonly at: number;
     } | null;
+    /**
+     * "Message privately" asked for from ANY per-person menu — a tile's, the
+     * People panel's — and answered by the one `ControlBar` that owns the chat
+     * panel (0.7.8). Through 0.7.7 only the People panel could open a private
+     * chat, so the Board's tile menu (and the Room's) had no such item while the
+     * People panel did: two menus for one person that disagreed.
+     */
+    readonly privateChatRequest: {
+        readonly to: ParticipantIdentity;
+        readonly at: number;
+    } | null;
     readonly effects: MediaEffects;
     /**
      * Captions AND durable rows, reconciled into one list (D16). A record
@@ -1342,6 +1353,10 @@ declare const RPCS: {
     readonly meetingOccurrences: "meet_meeting_occurrences";
     /** Every occurrence the reader can see between two instants — the Upcoming list. */
     readonly occurrencesBetween: "meet_occurrences_between";
+    /** The recordings library. */
+    readonly myRecordings: "meet_my_recordings";
+    /** Titles, agendas, current notes and final transcript lines; snippets mark hits with ⟦ ⟧. */
+    readonly search: "meet_search";
 };
 type Row = Record<string, unknown>;
 interface CreateCallInviteInput {
@@ -1428,6 +1443,17 @@ interface MeetRepository {
         acknowledgedAt: string;
     }): Promise<void>;
     recordings(meetingId: MeetingId): Promise<readonly RecordingRecord[]>;
+    /** Meet wave 3: every recording of the reader's own meetings, newest first. */
+    myRecordings(args?: {
+        includeArchived?: boolean;
+        limit?: number;
+    }): Promise<readonly LibraryRecording[]>;
+    /** Meet wave 3: search the reader's own meetings. */
+    searchMeetings(query: string, limit?: number): Promise<readonly MeetingSearchHit[]>;
+    /** Meet wave 3: name a recording (`null` = back to the meeting's title and date). */
+    renameRecording(recordingId: string, title: string | null): Promise<void>;
+    /** Meet wave 3: archive (soft delete) or restore a recording. Never a purge. */
+    setRecordingArchived(recordingId: string, archived: boolean): Promise<void>;
     scheduleMeeting(input: ScheduleMeetingInput): Promise<MeetingRecord>;
     /** `expectedVersion` from the row you edited; a stale one is a `conflict`. */
     updateMeeting(meetingId: MeetingId, changes: MeetingChanges, options?: {
@@ -1521,6 +1547,50 @@ declare function settingsPatch(settings: MeetingSettings): Record<string, unknow
  */
 declare function changesPatch(changes: MeetingChanges): Record<string, unknown>;
 declare function createMeetRepository(options: RepositoryOptions): MeetRepository;
+/** One row of the recordings library (`meet_my_recordings`). */
+interface LibraryRecording {
+    readonly id: string;
+    readonly meetingId: MeetingId;
+    readonly meetingTitle: string;
+    readonly meetingSlug: string;
+    /** The reader's strongest role on the meeting. */
+    readonly role: "host" | "cohost" | "invitee" | "attendee";
+    readonly state: RecordingState;
+    /** A name a host gave it; null = show the meeting title. */
+    readonly title: string | null;
+    readonly fileId: string | null;
+    readonly startedAt: string | null;
+    readonly endedAt: string | null;
+    readonly durationMs: number | null;
+    readonly sizeBytes: number | null;
+    readonly failureReason: string | null;
+    readonly archivedAt: string | null;
+    readonly organizationId: OrganizationId;
+}
+declare function projectLibraryRecording(row: Row): LibraryRecording;
+/** Where a search hit was found. */
+type MeetingSearchSource = "title" | "summary" | "decision" | "action_item" | "note" | "transcript";
+/** One hit from `meet_search`. `snippet` marks matched words with ⟦ ⟧. */
+interface MeetingSearchHit {
+    readonly meetingId: MeetingId;
+    readonly meetingTitle: string;
+    readonly meetingSlug: string;
+    readonly meetingAt: string | null;
+    readonly source: MeetingSearchSource;
+    /** The note or transcript segment id (the meeting id for a title hit). */
+    readonly refId: string;
+    readonly speaker: string | null;
+    readonly snippet: string;
+    /** When it was said / written. */
+    readonly at: string | null;
+    readonly rank: number;
+}
+declare function projectSearchHit(row: Row): MeetingSearchHit;
+/** A snippet split into plain and matched runs, for highlighting without HTML. */
+declare function snippetRuns(snippet: string): readonly {
+    readonly text: string;
+    readonly hit: boolean;
+}[];
 
 /**
  * THE CALL CENTER — ringing, answering, and the six ways a call ends badly.
@@ -2266,6 +2336,15 @@ interface MeetingSessionOptions {
      * to `engine.rejoin()`.
      */
     onAdmitted?: (() => void) | undefined;
+    /**
+     * 🚨 THE HOST DENIED *US*. Called once per denial verdict that names this
+     * knocker. Without it the waiting room kept promising "you will join
+     * automatically" to a person the host had already turned away (production
+     * 2026-09-27). The provider wires it to `engine.rejoin()`: the server then
+     * refuses the mint with its own sentence ("The host did not admit you…"),
+     * so the words on screen are the server's decision, never the client's guess.
+     */
+    onDenied?: (() => void) | undefined;
 }
 interface MeetingSession {
     /** Subscribe to the room's out-of-band plane. Hosts see knocks; guests see verdicts. */
@@ -2357,39 +2436,6 @@ declare function createRecordingController(options: RecordingControllerOptions):
 /** The indicator's words. One definition, so no surface invents a softer one. */
 declare function recordingLabel(state: RecordingState): string | null;
 
-/**
- * MEET WAVE 1 — the two server calls a management screen makes (0.8).
- *
- * Every WRITE (schedule, edit, reschedule, cancel, archive, occurrence change,
- * invite, answer) goes straight to the database through `MeetRepository` — the
- * database decides who may. What a browser cannot do is send an email with a
- * calendar object in it, so after any of those writes a screen calls
- * `announceMeeting`: the server tells each invitee exactly what they have not
- * been told (invitation, update or cancellation, each with its `.ics`), and
- * re-queues reminders. It is idempotent — call it after every save.
- */
-
-interface AnnounceResult {
-    readonly invitations: number;
-    readonly updates: number;
-    readonly cancellations: number;
-    readonly alreadyCurrent: number;
-    readonly remindersQueued: number;
-    readonly remindersCancelled: number;
-}
-/** Bring every invitee's inbox and calendar up to date. The host, a co-host or an editor. */
-declare function announceMeeting(api: MeetApi, meetingId: MeetingId): Promise<AnnounceResult>;
-/**
- * Put a one-off meeting on the caller's own connected Google Calendar. GATED by
- * the server to Google's review accounts while the Calendar scope is in review —
- * a refusal is a `forbidden` MeetError carrying the server's sentence. Everyone
- * already gets the meeting into any calendar through the invitation's `.ics`.
- */
-declare function pushMeetingToGoogleCalendar(api: MeetApi, meetingId: MeetingId, target: {
-    connectionId: string;
-    calendarId?: string;
-}): Promise<Record<string, unknown>>;
-
 /**
  * THE TOKEN FLOW — the ONLY authorization path into a room (R1).
  *
@@ -2546,6 +2592,12 @@ declare const MEET_ROUTES: {
     readonly meetingAnnounce: "/api/v1/meet/meetings/{meeting_id}/announce";
     /** Put a one-off meeting on the caller's own Google Calendar (gated by the server). */
     readonly meetingGoogleCalendar: "/api/v1/meet/meetings/{meeting_id}/google-calendar";
+    /**
+     * Meet wave 3: the recap email after the meeting. `GET` = the draft (subject,
+     * body from the wrap-up, who it can go to); `POST` = send what the host
+     * reviewed (`dry_run` renders and queues nothing). Never sent automatically.
+     */
+    readonly meetingFollowUp: "/api/v1/meet/meetings/{meeting_id}/follow-up";
     /**
      * Meet wave 2: EVERY in-meeting host power (mute, stop video, mute all, ask to
      * unmute, spotlight, lower hands, co-host, hand over, rename, remove, report).
@@ -2564,56 +2616,533 @@ declare function parseRoomToken(body: unknown, roomName: RoomName): RoomToken;
 declare function createTokenClient(options: TokenClientOptions): TokenClient;
 
 /**
- * THE ROOM ENGINE — the object a host mounts once and never reasons about.
+ * THE MEETING RECORD — what a meeting IS once the room is gone (MRI-D2).
  *
- * It owns every sequence a calling product gets wrong: ask for a token, connect,
- * project the roster, carry the in-room control plane, keep the phase honest
- * through a reconnect, and tear everything down exactly once. A consumer's job
- * is `engine.join(...)` and rendering a snapshot.
+ * 🚨 THE DEFECT THIS EXISTS TO KILL. Through 2026-09-08 a meeting produced a
+ * wrap-up summary, decisions, owner-assigned action items, five windows of live
+ * notes, thirty-two transcript segments and a recording — and then had NO
+ * SURFACE AT ALL. `/meet/<slug>` fell back to `<PreJoin>` on an ended meeting,
+ * so the durable link that R3 promises would outlive the meeting resolved to a
+ * screen offering to join a room that no longer exists. Everything the campaign
+ * built after the room closed was reachable only from SQL.
  *
- * THREE rules are structural here, not documented-and-hoped:
+ * Three rules hold this file together:
  *
- * 1. **The phase never lies.** `connecting` becomes `connected` only when the
- *    driver says so, and any failure becomes `failed` WITH the remedy attached
- *    to the snapshot. There is no path that leaves a spinner running forever —
- *    the single most common complaint about every video product.
- * 2. **Role comes from the TOKEN, never from the client.** A participant's role
- *    is read out of the server-minted metadata. A client that could decide it
- *    was host could mute anyone; here the claim is unforgeable because the
- *    server signed it.
- * 3. **Teardown is idempotent and total.** Leaving twice, or unmounting during
- *    a connect, disconnects once and leaves no listener behind. The half-torn
- *    room is what produces "my camera light stays on after the call".
+ * 1. **Every read is INDEPENDENT and every refusal is NAMED.** The transcript,
+ *    the notes, the attendance list and the recording live in four RLS-guarded
+ *    tables, and a guest holding the link can read NONE of them (only
+ *    `meet_meeting_by_slug` is granted to `anon`). One `Promise.all` would turn
+ *    a permission boundary into a blank page. Known guest restrictions never issue private reads; each authenticated read that is refused
+ *    becomes a `MeetingRecordRestriction` with a sentence — the reader is told
+ *    what exists and why they cannot see it, which is the difference between a
+ *    record they can ask for and a product that looks broken.
+ * 2. **A partial record is still a record.** A failed transcript read never
+ *    hides the summary somebody CAN read.
+ * 3. **Nothing here computes meaning.** Grouping, ordering and formatting only.
+ *    The summary, decisions and action items are durable rows written by the
+ *    wrap-up mandate (D5/D18); this module never re-derives them from the
+ *    transcript, because two sources for one fact is how they start to disagree.
  */
 
-interface JoinRequest {
-    readonly roomName: RoomName;
-    readonly meetingId?: string | undefined;
-    readonly slug?: string | undefined;
-    /** `audio` joins with the camera off. Same room, same code path (D3). */
-    readonly mode: CallMode;
+/** One thing the reader could not see, and the honest reason. Never a blank. */
+interface MeetingRecordRestriction {
+    /** Which part of the record: `transcript`, `notes`, `attendance`, `recording`. */
+    readonly part: "transcript" | "notes" | "attendance" | "recording";
+    readonly message: string;
+    readonly remedy: string;
+}
+/** One visible access state, made from restrictions that share one remedy. */
+interface MeetingRecordRestrictionNotice {
+    readonly parts: readonly MeetingRecordRestriction["part"][];
+    readonly message: string;
+    readonly remedy: string;
+}
+/** A run of consecutive lines by one speaker — how a person reads a transcript. */
+interface TranscriptBlock {
+    readonly id: string;
+    /** Who spoke. Blocks break on THIS, never on the rendered name (MRI-A16). */
+    readonly identity: ParticipantIdentity;
+    readonly speaker: string;
+    /** ISO of the first line in the block. */
+    readonly startedAt: string;
+    readonly lines: readonly TranscriptSegment[];
+}
+interface MeetingRecordBundle {
+    readonly meeting: MeetingRecord;
+    readonly attendees: readonly MeetingAttendee[];
+    /** The wrap-up summary: `kind='note'` with `metadata.role='summary'` (D5). */
+    readonly summary: MeetingNote | null;
+    /** D20: the AUTHORITATIVE set — window rows the wrap-up superseded are out. */
+    readonly decisions: readonly MeetingNote[];
+    readonly actionItems: readonly MeetingNote[];
+    /** The live-notes windows, in window order (D3). */
+    readonly liveNotes: readonly MeetingNote[];
+    readonly transcript: readonly TranscriptSegment[];
+    /** The most recent recording attempt, whatever state it reached. */
+    readonly recording: RecordingRecord | null;
+    /** What this reader could NOT see. Rendered; never swallowed. */
+    readonly restrictions: readonly MeetingRecordRestriction[];
     /**
-     * Whether to ATTEMPT the microphone on join. Defaults to true. `false` is a
-     * deliberate listen-only join — the pre-join screen's "Join with microphone"
-     * toggle. Either way the join itself never depends on the outcome; a refused
-     * device lands in `snapshot.media.microphone.unavailable`, not in a throw.
+     * Identity → name, learned from everything this read COULD see: the durable
+     * attendance rows and the transcript's own `speaker` column. It is what stops
+     * a raw LiveKit token reaching the screen when one of those reads was refused
+     * (MRI-A16).
      */
-    readonly microphone?: boolean | undefined;
+    readonly names: NameBook;
 }
-interface RoomEngineOptions {
-    store: MeetStore;
-    tokens: TokenClient;
-    identity: MeetIdentity;
-    driverFactory: RoomDriverFactory;
-    /** Canonical public metadata read; room packets alone never authorize teardown. */
-    resolveMeeting?: ((slug: string) => Promise<MeetingRecord>) | undefined;
-    onDiagnostic?: ((event: {
-        level: "info" | "warn" | "error";
-        message: string;
-        remedy?: string;
-    }) => void) | undefined;
-    /** Fired when the local participant leaves for any reason, including kicked. */
-    onLeft?: ((reason: string | null) => void) | undefined;
+/**
+ * The current wrap-up summary.  Repairs preserve the prior durable row for
+ * history, then mark it `superseded_by`; every current-facing projection must
+ * therefore make the same distinction as decisions and action items.
+ */
+declare function activeWrapUpSummary(notes: readonly MeetingNote[]): MeetingNote | null;
+/**
+ * Load the record parts the reader may request; state all restrictions.
+ *
+ * `meeting` is passed in when the caller already resolved it (the slug route
+ * does, through the `anon`-granted RPC) — re-reading it through the table would
+ * fail for exactly the reader who most needs the page to work.
+ */
+declare function loadMeetingRecord(repository: MeetRepository, meetingId: MeetingId, meeting: MeetingRecord, reader?: Pick<MeetIdentity, "userId">): Promise<MeetingRecordBundle>;
+/**
+ * 🚨 **A READ THAT WAS REFUSED IS NOT AN EMPTY RESULT (MRI-A16).**
+ *
+ * On production 2026-09-09 a guest's record view said *"No wrap-up was written
+ * for this meeting"* directly underneath a panel that had just told them, in
+ * the same screen, that the notes are not readable from their account — and
+ * *"Nothing was recorded as a decision"* beside a decision that exists
+ * (MRI-C8). The page asserted an absence it had no way to know, which is worse
+ * than saying nothing: a person who reads "no wrap-up was written" stops
+ * looking for one.
+ *
+ * So no surface writes its own empty sentence any more. It asks here, and gets
+ * either its absence sentence — earned, because the read SUCCEEDED and returned
+ * nothing — or the refusal, said plainly.
+ */
+declare const REFUSED_ABSENCE = "This record is not shared with guests.";
+/** Was this part of the record refused to this reader? */
+declare function wasRefused(bundle: MeetingRecordBundle, part: MeetingRecordRestriction["part"]): boolean;
+/**
+ * The sentence to show where a part of the record has nothing in it. NEVER an
+ * absence claim over a read that was refused.
+ */
+declare function absenceSentence(bundle: MeetingRecordBundle, part: MeetingRecordRestriction["part"], absence: string): string;
+/**
+ * 🚨 **"NO WRAP-UP WAS WRITTEN" IS A CLAIM, AND FOR ~33 SECONDS IT WAS FALSE.**
+ *
+ * On production 2026-09-09 the HOST's record view said *"No wrap-up was written
+ * for this meeting"* between 04:46:42 — the flip from the room to the record —
+ * and 04:47:15, when the wrap-up landed. The read was permitted and genuinely
+ * empty, so this is not the refusal class above; it is the OTHER way a screen
+ * lies, by reading "not here yet" as "never happened". A person who reads *"no
+ * wrap-up was written"* closes the tab.
+ *
+ * The meeting row already knows the difference, and it is not a guess: the
+ * wrap-up is a durable job, `enqueue_wrap_up` stamps
+ * `metadata.note_taker.intelligence.wrap_up` when it queues it, and the graph
+ * action stamps `state: "failed"` when the pass refuses TERMINALLY. So:
+ *
+ * - a summary exists → `written`;
+ * - the notes read was refused → `refused` (never an absence claim);
+ * - the job is marked failed → `failed`, in the server's own words;
+ * - the job is queued or running → `in-progress`, with a refresh affordance;
+ * - nothing ever queued one → `absent`, which is the only EARNED absence.
+ *
+ * There is no timeout that flips `in-progress` into `absent`. A wrap-up that is
+ * genuinely stuck says it is still being written — which is TRUE — rather than
+ * inventing a verdict this browser has no way to reach.
+ */
+type WrapUpStatus = {
+    readonly state: "written";
+} | {
+    readonly state: "in-progress";
+    readonly message: string;
+    readonly canRefresh: true;
+} | {
+    readonly state: "failed";
+    readonly message: string;
+} | {
+    readonly state: "refused";
+    readonly message: string;
+} | {
+    readonly state: "absent";
+    readonly message: string;
+};
+/** Where the wrap-up actually is. Never "absent" over a job that is running. */
+declare function wrapUpStatus(bundle: MeetingRecordBundle): WrapUpStatus;
+/**
+ * GROUP THE TRANSCRIPT THE WAY A PERSON READS IT: consecutive lines by one
+ * speaker become one block with one timestamp. Reading thirty-two rows each
+ * re-stamped with a name and a clock is how a transcript becomes unreadable.
+ */
+declare function groupTranscript(segments: readonly TranscriptSegment[], names?: NameBook): readonly TranscriptBlock[];
+/**
+ * WHAT THE RECORDING IS DOING, in a sentence — including the two states people
+ * hit most and understand least. `processing` is not "broken" and `failed` is
+ * never silence: both say what happened and what to do.
+ */
+declare function recordingNotice(recording: RecordingRecord | null): string | null;
+/** Only an `available` recording has a file to play. Nothing else pretends to. */
+declare function playableRecordingFileId(recording: RecordingRecord | null): string | null;
+/**
+ * A MEETING IS OVER WHEN THE SERVER SAYS SO. `ended_at` is stamped by
+ * `POST /v1/meet/end` or by the auto-end evaluation (MRI-A6) — never by a
+ * client noticing the room is empty.
+ */
+declare function hasEnded(meeting: MeetingRecord | null): boolean;
+/**
+ * "Thursday, 8 September 2026, 4:21 PM · 19 minutes". One shape everywhere.
+ *
+ * THE SPAN IS `formatDurationMs`'s (2026-09-12). This body used to divide by
+ * `60_000` and pluralise "minute" itself — a duration formatter living in a
+ * PACKAGE, found the day `aidream/apps/shared` became a scan root. `@ai-matrx/
+ * meet` already depends on `@ai-matrx/kit`, and `style: "long"` is precisely
+ * this voice ("19 minutes", "1 minute"). Three things improve by adopting it:
+ * a 40-second meeting read "0 minutes" and now reads "40 seconds" (the
+ * confident zero the package refuses), a 19-minute-35-second meeting read
+ * "20 minutes" and now reads "19 minutes" (prose asserts at-least, so it
+ * floors), and a 90-minute meeting reads "1 hour" instead of "90 minutes".
+ */
+declare function meetingWhen(meeting: MeetingRecord, locale?: string): string;
+/** How much of a finished meeting a GUEST may read. Pinned with the server. */
+type GuestRecordAccess = "none" | "summary" | "full";
+/** Widest last. The ORDER is the comparison, exactly as it is on the server. */
+declare const GUEST_RECORD_ACCESS_LEVELS: readonly GuestRecordAccess[];
+/**
+ * What a HOST may choose for one meeting. `default` is not a fourth level — it
+ * is the absence of a per-meeting choice, and it is the only way to un-choose.
+ */
+type GuestRecordAccessSetting = "default" | GuestRecordAccess;
+declare const GUEST_RECORD_ACCESS_CHOICES: readonly GuestRecordAccessSetting[];
+/** `meet_meetings.metadata.guest_record_access`. No DDL; a setting on a row. */
+declare const GUEST_RECORD_ACCESS_METADATA_KEY = "guest_record_access";
+/** What a host chose for THIS meeting, read from the row they already have. */
+declare function guestRecordAccessSetting(meeting: MeetingRecord | null): GuestRecordAccessSetting;
+/** The sentence on the host's control. Plain English, never a token. */
+declare function guestRecordAccessLabel(setting: GuestRecordAccessSetting): string;
+/** What each choice actually means for the people who were in the room. */
+declare function guestRecordAccessExplanation(setting: GuestRecordAccessSetting): string;
+/** What came back from the server, so a surface never has to infer a level. */
+interface GuestRecordAccessResolution {
+    readonly level: GuestRecordAccess;
+    /** `meeting` when a host chose for this one; `organization` otherwise. */
+    readonly source: "meeting" | "organization";
+}
+/**
+ * Repeated policy refusals are one access state, not four alarming cards.
+ *
+ * The individual rows remain durable data for absence handling in their own
+ * sections. This projection groups only rows with the exact same remedy, so a
+ * distinct transport or integrity failure remains visible on its own.
+ */
+declare function summarizeMeetingRecordRestrictions(restrictions: readonly MeetingRecordRestriction[]): readonly MeetingRecordRestrictionNotice[];
+/**
+ * Read the record the server shares with THIS guest.
+ *
+ * `roomToken` is the pass this device kept from the meeting
+ * (`TokenClient.remembered`). It is presented in a header, never appended to
+ * the URL. A guest with no pass, an expired pass, or a level of `none` gets the
+ * server's refusal — as restrictions on a real bundle, so the screen says what
+ * it cannot show instead of collapsing into an error page.
+ */
+declare function loadGuestMeetingRecord(args: {
+    api: MeetApi;
+    repository: MeetRepository;
+    meetingId: MeetingId;
+    meeting: MeetingRecord;
+    roomToken: RoomToken | null;
+}): Promise<MeetingRecordBundle>;
+/**
+ * A HOST chooses what guests may read of THIS meeting.
+ *
+ * Host power is the SERVER's decision and it re-checks it; this function exists
+ * so the control has one call to make, and it returns what the choice RESOLVES
+ * to so the screen never has to guess what "my organization's setting" means
+ * today.
+ */
+declare function setGuestRecordAccess(args: {
+    api: MeetApi;
+    meetingId: MeetingId;
+    organizationId: OrganizationId;
+    access: GuestRecordAccessSetting;
+}): Promise<{
+    readonly setting: GuestRecordAccessSetting;
+    readonly effective: GuestRecordAccessResolution;
+}>;
+/** What a guest is told when the level shares nothing. Rendered, never hidden. */
+declare const GUEST_RECORD_NOT_SHARED: Readonly<Record<"recording" | "transcript" | "notes" | "attendance", string>>;
+
+/**
+ * AFTER THE MEETING (Meet wave 3) — the pure pieces every client needs once the
+ * room is gone: the attendance report, the transcript and notes as documents,
+ * a moment in the transcript as a moment in the recording, search within one
+ * transcript, and the two server calls behind the recap email and the saved
+ * chat.
+ *
+ * Nothing here computes MEANING (same rule as `record.ts`): the summary,
+ * decisions and action items are the wrap-up's durable rows; this file only
+ * arranges, measures and formats them. Every function is framework-free so a
+ * worker, a test and a browser produce byte-identical exports.
+ */
+
+/**
+ * Who someone was, in the words an attendance report uses. `signed-in guest` is
+ * an account from outside the meeting's organization that followed the link;
+ * `guest` has no account at all.
+ */
+type AttendanceKind = "host" | "cohost" | "member" | "signed-in guest" | "guest" | "assistant";
+interface AttendanceRow {
+    readonly id: string;
+    readonly identity: string;
+    readonly name: string;
+    readonly userId: string | null;
+    readonly kind: AttendanceKind;
+    /** First time they were in the room; null when they knocked and never came in. */
+    readonly joinedAt: string | null;
+    /** When they left; null while still in the room or when the leave was never recorded. */
+    readonly leftAt: string | null;
+    /**
+     * Time in the room. A missing `leftAt` is measured to the meeting's end —
+     * the room closed around them — and `null` only when neither is known.
+     */
+    readonly durationMs: number | null;
+    /** True when `durationMs` was measured to the meeting's end, not a recorded leave. */
+    readonly durationToEnd: boolean;
+    readonly admission: MeetingAttendee["admissionState"];
+    /** How many times this person came in (a rejoin or a second device). */
+    readonly joins: number;
+}
+/**
+ * The attendance report of ONE meeting, host first then by arrival. People who
+ * knocked and were never let in are kept (with no join time) — "who asked to
+ * come in" is part of the record — but a denied knock has no duration.
+ */
+/**
+ * WHO a participant row is, as a PERSON (verifier, 2026-09-27: an export listed
+ * the same attendee twice under "attended"). A signed-in person is their
+ * account — every device and every rejoin is one person. A guest without an
+ * account gets a fresh `guest:<random>` identity on every join, so the name
+ * they typed is the only thread between their joins (Zoom's attendee report
+ * merges link guests the same way); two different accountless guests who
+ * typed the identical name read as one, which is the lesser error.
+ */
+declare function attendeeKey(person: MeetingAttendee, names?: NameBook): string;
+/**
+ * One row per PERSON, in first-seen order: the row that actually joined (the
+ * earliest) represents them. For a list of names or a head-count; the
+ * attendance REPORT merges times as well (`attendanceReport`).
+ */
+declare function uniqueAttendees(attendees: readonly MeetingAttendee[], names?: NameBook): readonly MeetingAttendee[];
+declare function attendanceReport(meeting: MeetingRecord, attendees: readonly MeetingAttendee[], names?: NameBook): readonly AttendanceRow[];
+/** Headline numbers for the top of a report. The assistant is never a person. */
+declare function attendanceTotals(rows: readonly AttendanceRow[]): {
+    readonly people: number;
+    readonly guests: number;
+    readonly neverAdmitted: number;
+    readonly averageMs: number | null;
+};
+declare const ATTENDANCE_CSV_HEADER: readonly ["Meeting", "Meeting started", "Name", "Attended as", "Joined", "Left", "Minutes in the meeting", "Admission"];
+/**
+ * CSV for a spreadsheet: one header row, one row per person, ISO timestamps (a
+ * spreadsheet parses them; a formatted local clock loses the zone). Several
+ * meetings — a series — concatenate with one header.
+ */
+declare function attendanceCsv(reports: readonly {
+    meeting: MeetingRecord;
+    rows: readonly AttendanceRow[];
+}[]): string;
+/**
+ * Where an instant of the meeting falls in the RECORDING, in milliseconds from
+ * its start — or `null` when the recording does not cover it (a recording is
+ * often a few minutes of a longer meeting). Never a clamp: seeking a line that
+ * was said before recording began to 0:00 would play the wrong words.
+ */
+declare function recordingOffsetMs(at: string, recording: RecordingRecord | null): number | null;
+/** `m:ss` or `h:mm:ss` — a position in a recording or a meeting. */
+declare function clockPosition(offsetMs: number): string;
+interface TranscriptMatch {
+    readonly segmentId: string;
+    /** [start, end) character ranges inside the segment's text, in order. */
+    readonly ranges: readonly (readonly [number, number])[];
+}
+/**
+ * Case-insensitive search of the transcript text AND the speaker's
+ * name. Returns matches in transcript order. An empty query matches nothing.
+ */
+declare function searchTranscript(segments: readonly TranscriptSegment[], query: string, names?: NameBook): readonly TranscriptMatch[];
+type TranscriptFormat = "txt" | "md" | "vtt";
+interface ExportOptions {
+    readonly names?: NameBook;
+    /** Timestamps as a clock of day (default) or offsets from `zero`. */
+    readonly locale?: string;
+    readonly timeZone?: string;
+}
+/**
+ * The transcript as a document. `txt` and `md` group consecutive lines by one
+ * speaker with the clock of day; `vtt` is WebVTT cued from the recording's
+ * start when a recording exists (so it plays as captions over it), otherwise
+ * from the meeting's start — and a cue ends where the next line begins.
+ */
+declare function transcriptDocument(bundle: Pick<MeetingRecordBundle, "meeting" | "transcript" | "recording" | "names">, format: TranscriptFormat, options?: ExportOptions): string;
+/**
+ * The meeting's notes as Markdown: when, who attended, the summary, decisions
+ * and action items (with owners), and the link back. What a person pastes into
+ * a doc or an email; also the source for PDF / Word export.
+ */
+declare function notesDocument(bundle: Pick<MeetingRecordBundle, "meeting" | "summary" | "decisions" | "actionItems" | "attendees" | "names">, options?: {
+    readonly link?: string | null;
+    readonly when?: string | null;
+}): string;
+/** How long the meeting ran, in words ("42 minutes"), or null when unknown. */
+declare function meetingLength(meeting: MeetingRecord): string | null;
+interface MeetingChatHistory {
+    readonly messages: readonly RoomChatMessage[];
+    /** The server's refusal, in its words, when the history could not be read. */
+    readonly refusal: {
+        readonly message: string;
+        readonly remedy: string;
+    } | null;
+}
+/**
+ * The saved chat of a finished meeting (`GET /v1/meet/chat`). Private messages
+ * are never saved, by design, so they are never here. A refusal is returned as
+ * data — the record still renders everything else.
+ */
+declare function loadMeetingChat(api: MeetApi, meetingId: MeetingId, roomToken?: string | null): Promise<MeetingChatHistory>;
+/** One person the recap can go to, as the server resolved them. */
+interface FollowUpRecipient {
+    /** Stable key for the choice: `user:<id>` or `email:<address>`. */
+    readonly key: string;
+    readonly name: string;
+    /** The address, when this reader may see it (the host sees their guests'). */
+    readonly email: string | null;
+    readonly userId: string | null;
+    /** `invitee`, `attendee` or both — where the server found them. */
+    readonly sources: readonly ("invitee" | "attendee")[];
+    /** False when the server has no way to reach them (no account, no address). */
+    readonly reachable: boolean;
+}
+/** The draft the host reviews. The text is the wrap-up's own, arranged. */
+interface FollowUpDraft {
+    readonly subject: string;
+    readonly body: string;
+    readonly recipients: readonly FollowUpRecipient[];
+    /** False while the wrap-up has not been written — the draft says so. */
+    readonly wrapUpWritten: boolean;
+    /** When a recap for this meeting was last sent, and to how many. */
+    readonly lastSent: {
+        readonly at: string;
+        readonly count: number;
+    } | null;
+}
+interface FollowUpSendResult {
+    readonly dryRun: boolean;
+    /** Recipients the send queued (or, on a dry run, would queue). */
+    readonly queued: readonly string[];
+    /** Recipient keys skipped, each with the reason. */
+    readonly skipped: readonly {
+        readonly key: string;
+        readonly reason: string;
+    }[];
+}
+/** The recap draft for a finished meeting. The host, a co-host or an editor. */
+declare function loadFollowUpDraft(api: MeetApi, meetingId: MeetingId): Promise<FollowUpDraft>;
+/**
+ * Send the recap the host reviewed. `dryRun` resolves every recipient and
+ * renders every email but queues nothing — how a test proves the path without
+ * mailing a real inbox. Never called automatically.
+ */
+declare function sendFollowUp(api: MeetApi, meetingId: MeetingId, input: {
+    readonly subject: string;
+    readonly body: string;
+    readonly recipientKeys: readonly string[];
+    readonly dryRun?: boolean;
+}): Promise<FollowUpSendResult>;
+
+/**
+ * MEET WAVE 1 — the two server calls a management screen makes (0.8).
+ *
+ * Every WRITE (schedule, edit, reschedule, cancel, archive, occurrence change,
+ * invite, answer) goes straight to the database through `MeetRepository` — the
+ * database decides who may. What a browser cannot do is send an email with a
+ * calendar object in it, so after any of those writes a screen calls
+ * `announceMeeting`: the server tells each invitee exactly what they have not
+ * been told (invitation, update or cancellation, each with its `.ics`), and
+ * re-queues reminders. It is idempotent — call it after every save.
+ */
+
+interface AnnounceResult {
+    readonly invitations: number;
+    readonly updates: number;
+    readonly cancellations: number;
+    readonly alreadyCurrent: number;
+    readonly remindersQueued: number;
+    readonly remindersCancelled: number;
+}
+/** Bring every invitee's inbox and calendar up to date. The host, a co-host or an editor. */
+declare function announceMeeting(api: MeetApi, meetingId: MeetingId): Promise<AnnounceResult>;
+/**
+ * Put a one-off meeting on the caller's own connected Google Calendar. GATED by
+ * the server to Google's review accounts while the Calendar scope is in review —
+ * a refusal is a `forbidden` MeetError carrying the server's sentence. Everyone
+ * already gets the meeting into any calendar through the invitation's `.ics`.
+ */
+declare function pushMeetingToGoogleCalendar(api: MeetApi, meetingId: MeetingId, target: {
+    connectionId: string;
+    calendarId?: string;
+}): Promise<Record<string, unknown>>;
+
+/**
+ * THE ROOM ENGINE — the object a host mounts once and never reasons about.
+ *
+ * It owns every sequence a calling product gets wrong: ask for a token, connect,
+ * project the roster, carry the in-room control plane, keep the phase honest
+ * through a reconnect, and tear everything down exactly once. A consumer's job
+ * is `engine.join(...)` and rendering a snapshot.
+ *
+ * THREE rules are structural here, not documented-and-hoped:
+ *
+ * 1. **The phase never lies.** `connecting` becomes `connected` only when the
+ *    driver says so, and any failure becomes `failed` WITH the remedy attached
+ *    to the snapshot. There is no path that leaves a spinner running forever —
+ *    the single most common complaint about every video product.
+ * 2. **Role comes from the TOKEN, never from the client.** A participant's role
+ *    is read out of the server-minted metadata. A client that could decide it
+ *    was host could mute anyone; here the claim is unforgeable because the
+ *    server signed it.
+ * 3. **Teardown is idempotent and total.** Leaving twice, or unmounting during
+ *    a connect, disconnects once and leaves no listener behind. The half-torn
+ *    room is what produces "my camera light stays on after the call".
+ */
+
+interface JoinRequest {
+    readonly roomName: RoomName;
+    readonly meetingId?: string | undefined;
+    readonly slug?: string | undefined;
+    /** `audio` joins with the camera off. Same room, same code path (D3). */
+    readonly mode: CallMode;
+    /**
+     * Whether to ATTEMPT the microphone on join. Defaults to true. `false` is a
+     * deliberate listen-only join — the pre-join screen's "Join with microphone"
+     * toggle. Either way the join itself never depends on the outcome; a refused
+     * device lands in `snapshot.media.microphone.unavailable`, not in a throw.
+     */
+    readonly microphone?: boolean | undefined;
+}
+interface RoomEngineOptions {
+    store: MeetStore;
+    tokens: TokenClient;
+    identity: MeetIdentity;
+    driverFactory: RoomDriverFactory;
+    /** Canonical public metadata read; room packets alone never authorize teardown. */
+    resolveMeeting?: ((slug: string) => Promise<MeetingRecord>) | undefined;
+    onDiagnostic?: ((event: {
+        level: "info" | "warn" | "error";
+        message: string;
+        remedy?: string;
+    }) => void) | undefined;
+    /** Fired when the local participant leaves for any reason, including kicked. */
+    onLeft?: ((reason: string | null) => void) | undefined;
     now?: (() => number) | undefined;
     /** Remembered noise suppression / background choice (Meet wave 2). */
     effectsStorage?: EffectsStorage | undefined;
@@ -2755,198 +3284,4 @@ interface InRoomClientOptions {
 }
 declare function createInRoomClient(options: InRoomClientOptions): InRoomClient;
 
-/**
- * THE MEETING RECORD — what a meeting IS once the room is gone (MRI-D2).
- *
- * 🚨 THE DEFECT THIS EXISTS TO KILL. Through 2026-09-08 a meeting produced a
- * wrap-up summary, decisions, owner-assigned action items, five windows of live
- * notes, thirty-two transcript segments and a recording — and then had NO
- * SURFACE AT ALL. `/meet/<slug>` fell back to `<PreJoin>` on an ended meeting,
- * so the durable link that R3 promises would outlive the meeting resolved to a
- * screen offering to join a room that no longer exists. Everything the campaign
- * built after the room closed was reachable only from SQL.
- *
- * Three rules hold this file together:
- *
- * 1. **Every read is INDEPENDENT and every refusal is NAMED.** The transcript,
- *    the notes, the attendance list and the recording live in four RLS-guarded
- *    tables, and a guest holding the link can read NONE of them (only
- *    `meet_meeting_by_slug` is granted to `anon`). One `Promise.all` would turn
- *    a permission boundary into a blank page. Known guest restrictions never issue private reads; each authenticated read that is refused
- *    becomes a `MeetingRecordRestriction` with a sentence — the reader is told
- *    what exists and why they cannot see it, which is the difference between a
- *    record they can ask for and a product that looks broken.
- * 2. **A partial record is still a record.** A failed transcript read never
- *    hides the summary somebody CAN read.
- * 3. **Nothing here computes meaning.** Grouping, ordering and formatting only.
- *    The summary, decisions and action items are durable rows written by the
- *    wrap-up mandate (D5/D18); this module never re-derives them from the
- *    transcript, because two sources for one fact is how they start to disagree.
- */
-
-/** One thing the reader could not see, and the honest reason. Never a blank. */
-interface MeetingRecordRestriction {
-    /** Which part of the record: `transcript`, `notes`, `attendance`, `recording`. */
-    readonly part: "transcript" | "notes" | "attendance" | "recording";
-    readonly message: string;
-    readonly remedy: string;
-}
-/** A run of consecutive lines by one speaker — how a person reads a transcript. */
-interface TranscriptBlock {
-    readonly id: string;
-    /** Who spoke. Blocks break on THIS, never on the rendered name (MRI-A16). */
-    readonly identity: ParticipantIdentity;
-    readonly speaker: string;
-    /** ISO of the first line in the block. */
-    readonly startedAt: string;
-    readonly lines: readonly TranscriptSegment[];
-}
-interface MeetingRecordBundle {
-    readonly meeting: MeetingRecord;
-    readonly attendees: readonly MeetingAttendee[];
-    /** The wrap-up summary: `kind='note'` with `metadata.role='summary'` (D5). */
-    readonly summary: MeetingNote | null;
-    /** D20: the AUTHORITATIVE set — window rows the wrap-up superseded are out. */
-    readonly decisions: readonly MeetingNote[];
-    readonly actionItems: readonly MeetingNote[];
-    /** The live-notes windows, in window order (D3). */
-    readonly liveNotes: readonly MeetingNote[];
-    readonly transcript: readonly TranscriptSegment[];
-    /** The most recent recording attempt, whatever state it reached. */
-    readonly recording: RecordingRecord | null;
-    /** What this reader could NOT see. Rendered; never swallowed. */
-    readonly restrictions: readonly MeetingRecordRestriction[];
-    /**
-     * Identity → name, learned from everything this read COULD see: the durable
-     * attendance rows and the transcript's own `speaker` column. It is what stops
-     * a raw LiveKit token reaching the screen when one of those reads was refused
-     * (MRI-A16).
-     */
-    readonly names: NameBook;
-}
-/**
- * Load the record parts the reader may request; state all restrictions.
- *
- * `meeting` is passed in when the caller already resolved it (the slug route
- * does, through the `anon`-granted RPC) — re-reading it through the table would
- * fail for exactly the reader who most needs the page to work.
- */
-declare function loadMeetingRecord(repository: MeetRepository, meetingId: MeetingId, meeting: MeetingRecord, reader?: Pick<MeetIdentity, "userId">): Promise<MeetingRecordBundle>;
-/**
- * 🚨 **A READ THAT WAS REFUSED IS NOT AN EMPTY RESULT (MRI-A16).**
- *
- * On production 2026-09-09 a guest's record view said *"No wrap-up was written
- * for this meeting"* directly underneath a panel that had just told them, in
- * the same screen, that the notes are not readable from their account — and
- * *"Nothing was recorded as a decision"* beside a decision that exists
- * (MRI-C8). The page asserted an absence it had no way to know, which is worse
- * than saying nothing: a person who reads "no wrap-up was written" stops
- * looking for one.
- *
- * So no surface writes its own empty sentence any more. It asks here, and gets
- * either its absence sentence — earned, because the read SUCCEEDED and returned
- * nothing — or the refusal, said plainly.
- */
-declare const REFUSED_ABSENCE = "This record is not shared with guests.";
-/** Was this part of the record refused to this reader? */
-declare function wasRefused(bundle: MeetingRecordBundle, part: MeetingRecordRestriction["part"]): boolean;
-/**
- * The sentence to show where a part of the record has nothing in it. NEVER an
- * absence claim over a read that was refused.
- */
-declare function absenceSentence(bundle: MeetingRecordBundle, part: MeetingRecordRestriction["part"], absence: string): string;
-/**
- * GROUP THE TRANSCRIPT THE WAY A PERSON READS IT: consecutive lines by one
- * speaker become one block with one timestamp. Reading thirty-two rows each
- * re-stamped with a name and a clock is how a transcript becomes unreadable.
- */
-declare function groupTranscript(segments: readonly TranscriptSegment[], names?: NameBook): readonly TranscriptBlock[];
-/**
- * WHAT THE RECORDING IS DOING, in a sentence — including the two states people
- * hit most and understand least. `processing` is not "broken" and `failed` is
- * never silence: both say what happened and what to do.
- */
-declare function recordingNotice(recording: RecordingRecord | null): string | null;
-/** Only an `available` recording has a file to play. Nothing else pretends to. */
-declare function playableRecordingFileId(recording: RecordingRecord | null): string | null;
-/**
- * A MEETING IS OVER WHEN THE SERVER SAYS SO. `ended_at` is stamped by
- * `POST /v1/meet/end` or by the auto-end evaluation (MRI-A6) — never by a
- * client noticing the room is empty.
- */
-declare function hasEnded(meeting: MeetingRecord | null): boolean;
-/**
- * "Thursday, 8 September 2026, 4:21 PM · 19 minutes". One shape everywhere.
- *
- * THE SPAN IS `formatDurationMs`'s (2026-09-12). This body used to divide by
- * `60_000` and pluralise "minute" itself — a duration formatter living in a
- * PACKAGE, found the day `aidream/apps/shared` became a scan root. `@ai-matrx/
- * meet` already depends on `@ai-matrx/kit`, and `style: "long"` is precisely
- * this voice ("19 minutes", "1 minute"). Three things improve by adopting it:
- * a 40-second meeting read "0 minutes" and now reads "40 seconds" (the
- * confident zero the package refuses), a 19-minute-35-second meeting read
- * "20 minutes" and now reads "19 minutes" (prose asserts at-least, so it
- * floors), and a 90-minute meeting reads "1 hour" instead of "90 minutes".
- */
-declare function meetingWhen(meeting: MeetingRecord, locale?: string): string;
-/** How much of a finished meeting a GUEST may read. Pinned with the server. */
-type GuestRecordAccess = "none" | "summary" | "full";
-/** Widest last. The ORDER is the comparison, exactly as it is on the server. */
-declare const GUEST_RECORD_ACCESS_LEVELS: readonly GuestRecordAccess[];
-/**
- * What a HOST may choose for one meeting. `default` is not a fourth level — it
- * is the absence of a per-meeting choice, and it is the only way to un-choose.
- */
-type GuestRecordAccessSetting = "default" | GuestRecordAccess;
-declare const GUEST_RECORD_ACCESS_CHOICES: readonly GuestRecordAccessSetting[];
-/** `meet_meetings.metadata.guest_record_access`. No DDL; a setting on a row. */
-declare const GUEST_RECORD_ACCESS_METADATA_KEY = "guest_record_access";
-/** What a host chose for THIS meeting, read from the row they already have. */
-declare function guestRecordAccessSetting(meeting: MeetingRecord | null): GuestRecordAccessSetting;
-/** The sentence on the host's control. Plain English, never a token. */
-declare function guestRecordAccessLabel(setting: GuestRecordAccessSetting): string;
-/** What each choice actually means for the people who were in the room. */
-declare function guestRecordAccessExplanation(setting: GuestRecordAccessSetting): string;
-/** What came back from the server, so a surface never has to infer a level. */
-interface GuestRecordAccessResolution {
-    readonly level: GuestRecordAccess;
-    /** `meeting` when a host chose for this one; `organization` otherwise. */
-    readonly source: "meeting" | "organization";
-}
-/**
- * Read the record the server shares with THIS guest.
- *
- * `roomToken` is the pass this device kept from the meeting
- * (`TokenClient.remembered`). It is presented in a header, never appended to
- * the URL. A guest with no pass, an expired pass, or a level of `none` gets the
- * server's refusal — as restrictions on a real bundle, so the screen says what
- * it cannot show instead of collapsing into an error page.
- */
-declare function loadGuestMeetingRecord(args: {
-    api: MeetApi;
-    repository: MeetRepository;
-    meetingId: MeetingId;
-    meeting: MeetingRecord;
-    roomToken: RoomToken | null;
-}): Promise<MeetingRecordBundle>;
-/**
- * A HOST chooses what guests may read of THIS meeting.
- *
- * Host power is the SERVER's decision and it re-checks it; this function exists
- * so the control has one call to make, and it returns what the choice RESOLVES
- * to so the screen never has to guess what "my organization's setting" means
- * today.
- */
-declare function setGuestRecordAccess(args: {
-    api: MeetApi;
-    meetingId: MeetingId;
-    organizationId: OrganizationId;
-    access: GuestRecordAccessSetting;
-}): Promise<{
-    readonly setting: GuestRecordAccessSetting;
-    readonly effective: GuestRecordAccessResolution;
-}>;
-/** What a guest is told when the level shares nothing. Rendered, never hidden. */
-declare const GUEST_RECORD_NOT_SHARED: Readonly<Record<"recording" | "transcript" | "notes" | "attendance", string>>;
-
-export { type AccessTokenSource, type AdmissionState, type AnnounceResult, type ApplyRoomEventArgs, type AskArgs, type AudioProcessing, CALL_INVITE_KIND, CALL_INVITE_VERSION, CONSENT_NOTICE_ATTRIBUTE, type CallCenter, type CallCenterOptions, type CallId, type CallInvite, type CallInviteHandlerOptions, type CallInvitePayload, type CallMode, type CallState, type CallablePerson, type ConnectionQuality, type CreateCallInviteInput, type CreateMeetingInput, DATA_TOPICS, DEFAULT_EFFECTS, DEFAULT_PAGE_SIZE, type DataTopic, type DeviceKind, type DeviceManager, type DeviceManagerOptions, type DeviceSnapshot, type DeviceStorage, type DriverConnectionState, type DriverParticipant, type DriverTrackKind, type DriverTranscription, END_MEETING_NOT_SERVED, type EffectsStorage, type EndMeetingResult, FILE_SESSION_PATH, GUEST_RECORD_ACCESS_CHOICES, GUEST_RECORD_ACCESS_LEVELS, GUEST_RECORD_ACCESS_METADATA_KEY, GUEST_RECORD_NOT_SHARED, type GuestRecordAccess, type GuestRecordAccessResolution, type GuestRecordAccessSetting, IDLE_MEDIA, IDLE_TRACK, type InRoomClient, type InRoomClientOptions, type InviteeInput, type InviteeRole, type JoinRequest, type JsonObject, type JsonValue, LISTEN_ONLY_NOTICE, type LiveKitDriverOptions, type LobbyEntry, type LocalMediaState, type LocalTrackState, MEETING_INVITE_KIND, MEETING_INVITE_VERSION, MEET_ANSWER_CONTEXT_EVENT, MEET_ANSWER_EVENTS, MEET_EVENTS, MEET_ROUTES, MEET_SCHEMA, MODERATION_ACTIONS, type MediaDevicesLike, type MediaEffects, type MediaUnavailable, type MeetAi, type MeetAiAnswer, type MeetAiOptions, type MeetAnswerCoverage, type MeetApi, type MeetApiOptions, type MeetApiRequest, type MeetDevice, MeetError, type MeetErrorCode, type MeetEvent, type MeetFileMedia, type MeetGrants, type MeetIdentity, type MeetParticipant, type MeetRepository, type MeetRoomDriver, type MeetSnapshot, type MeetStore, type MeetingAttendee, type MeetingChanges, type MeetingId, type MeetingInviteHandlerOptions, type MeetingInvitePayload, type MeetingInvitee, type MeetingKind, type MeetingNote, type MeetingNoteKind, type MeetingOccurrence, type MeetingRecord, type MeetingRecordBundle, type MeetingRecordRestriction, type MeetingSession, type MeetingSessionOptions, type MeetingSettings, type ModerationAction, type ModerationNotice, type ModerationRequest, type ModerationResult, NOTE_TAKER_IDENTITY_PREFIX, NOTE_TAKER_METADATA_KEY, NO_GRANTS, type NameBook, type NoteTakerDispatch, type NoteTakerRefusal, type NoteTakerState, type NoteTakerStatus, ORGANIZATION_HEADER, type OccurrenceOverride, type OccurrenceState, type OrganizationId, PARTICIPANT_CAN_RECORD_ATTRIBUTE, PARTICIPANT_ROLE_ATTRIBUTE, type ParticipantIdentity, type ParticipantRole, REACTION_TTL_MS, REFUSED_ABSENCE, ROLE_RANK, ROOM_EVENTS, ROOM_EVENT_PREFIX, ROOM_TOKEN_HEADER, RPCS, type RecordingController, type RecordingControllerOptions, type RecordingPolicy, type RecordingRecord, type RecordingState, type RepositoryOptions, type RoomChatMessage, type RoomDriverFactory, type RoomDriverHandlers, type RoomEngine, type RoomEngineOptions, type RoomEventOutcome, type RoomEventTopic, type RoomName, type RoomPhase, type RoomReaction, type RoomToken, type RoomTokenStorage, type RsvpAnswer, type RsvpInvitation, type RsvpState, type ScheduleMeetingInput, type Stage, type StageArgs, type StageLayout, TABLES, TRANSCRIPTION_ATTRIBUTES, TRANSCRIPTION_TOPIC, type TokenClient, type TokenClientOptions, type TokenRequest, type TranscriptBlock, type TranscriptSegment, type TranscriptSource, type UpcomingOccurrence, type UserId, type VideoEffect, type WrapUpAnnouncement, absenceSentence, announceMeeting, applyRoomEvent, asCallId, asMeetingId, asOrganizationId, asParticipantIdentity, asRoomName, asUserId, callInviteAction, callInviteText, callStateLabel, canModerate, canModerateParticipant, canTransition, captionSegment, changesPatch, computeStage, countLabel, createCallCenter, createCallInviteHandler, createDeviceManager, createInRoomClient, createLiveKitDriver, createMeetAi, createMeetApi, createMeetRepository, createMeetStore, createMeetingInviteHandler, createMeetingSession, createMemoryDeviceStorage, createRecordingController, createRoomEngine, createTokenClient, createWebDeviceStorage, createWebEffectsStorage, createWebRoomTokenStorage, displayNameFor, fileDownloadPath, gridColumns, groupTranscript, guestRecordAccessExplanation, guestRecordAccessLabel, guestRecordAccessSetting, hasEnded, hostUserIds, invalidResponse, isGuest, isGuestIdentity, isHostRole, isListenOnly, isNoteTaker, isRealName, isRoomEventTopic, learnName, learnNames, listenOnlyNotice, loadGuestMeetingRecord, loadMeetingRecord, mapConnectionState, mapQuality, meetingInviteAction, meetingLink, meetingPath, meetingSlug, meetingTopic, meetingWhen, mergeCaption, mergeRecord, normalizeDeviceError, normalizeMeetError, normalizeSpoken, noteTakerIdentity, noteTakerLabel, noteTakerParticipant, noteTakerStatus, orderParticipants, parseRoomToken, participantSummary, playableRecordingFileId, projectInvitee, projectNote, projectOccurrence, projectOverride, projectParticipant, projectRsvpInvitation, projectSegment, projectUpcoming, pushMeetingToGoogleCalendar, readServerRefusal, readableTranscript, recordingLabel, recordingNotice, roleOf, roomTopic, setGuestRecordAccess, settingsPatch, snapshotParticipant, unavailableFrom, userTopic, wasRefused };
+export { ATTENDANCE_CSV_HEADER, type AccessTokenSource, type AdmissionState, type AnnounceResult, type ApplyRoomEventArgs, type AskArgs, type AttendanceKind, type AttendanceRow, type AudioProcessing, CALL_INVITE_KIND, CALL_INVITE_VERSION, CONSENT_NOTICE_ATTRIBUTE, type CallCenter, type CallCenterOptions, type CallId, type CallInvite, type CallInviteHandlerOptions, type CallInvitePayload, type CallMode, type CallState, type CallablePerson, type ConnectionQuality, type CreateCallInviteInput, type CreateMeetingInput, DATA_TOPICS, DEFAULT_EFFECTS, DEFAULT_PAGE_SIZE, type DataTopic, type DeviceKind, type DeviceManager, type DeviceManagerOptions, type DeviceSnapshot, type DeviceStorage, type DriverConnectionState, type DriverParticipant, type DriverTrackKind, type DriverTranscription, END_MEETING_NOT_SERVED, type EffectsStorage, type EndMeetingResult, FILE_SESSION_PATH, type FollowUpDraft, type FollowUpRecipient, type FollowUpSendResult, GUEST_RECORD_ACCESS_CHOICES, GUEST_RECORD_ACCESS_LEVELS, GUEST_RECORD_ACCESS_METADATA_KEY, GUEST_RECORD_NOT_SHARED, type GuestRecordAccess, type GuestRecordAccessResolution, type GuestRecordAccessSetting, IDLE_MEDIA, IDLE_TRACK, type InRoomClient, type InRoomClientOptions, type InviteeInput, type InviteeRole, type JoinRequest, type JsonObject, type JsonValue, LISTEN_ONLY_NOTICE, type LibraryRecording, type LiveKitDriverOptions, type LobbyEntry, type LocalMediaState, type LocalTrackState, MEETING_INVITE_KIND, MEETING_INVITE_VERSION, MEET_ANSWER_CONTEXT_EVENT, MEET_ANSWER_EVENTS, MEET_EVENTS, MEET_ROUTES, MEET_SCHEMA, MODERATION_ACTIONS, type MediaDevicesLike, type MediaEffects, type MediaUnavailable, type MeetAi, type MeetAiAnswer, type MeetAiOptions, type MeetAnswerCoverage, type MeetApi, type MeetApiOptions, type MeetApiRequest, type MeetDevice, MeetError, type MeetErrorCode, type MeetEvent, type MeetFileMedia, type MeetGrants, type MeetIdentity, type MeetParticipant, type MeetRepository, type MeetRoomDriver, type MeetSnapshot, type MeetStore, type MeetingAttendee, type MeetingChanges, type MeetingChatHistory, type MeetingId, type MeetingInviteHandlerOptions, type MeetingInvitePayload, type MeetingInvitee, type MeetingKind, type MeetingNote, type MeetingNoteKind, type MeetingOccurrence, type MeetingRecord, type MeetingRecordBundle, type MeetingRecordRestriction, type MeetingRecordRestrictionNotice, type MeetingSearchHit, type MeetingSearchSource, type MeetingSession, type MeetingSessionOptions, type MeetingSettings, type ModerationAction, type ModerationNotice, type ModerationRequest, type ModerationResult, NOTE_TAKER_IDENTITY_PREFIX, NOTE_TAKER_METADATA_KEY, NO_GRANTS, type NameBook, type NoteTakerDispatch, type NoteTakerRefusal, type NoteTakerState, type NoteTakerStatus, ORGANIZATION_HEADER, type OccurrenceOverride, type OccurrenceState, type OrganizationId, PARTICIPANT_CAN_RECORD_ATTRIBUTE, PARTICIPANT_ROLE_ATTRIBUTE, type ParticipantIdentity, type ParticipantRole, REACTION_TTL_MS, REFUSED_ABSENCE, ROLE_RANK, ROOM_EVENTS, ROOM_EVENT_PREFIX, ROOM_TOKEN_HEADER, RPCS, type RecordingController, type RecordingControllerOptions, type RecordingPolicy, type RecordingRecord, type RecordingState, type RepositoryOptions, type RoomChatMessage, type RoomDriverFactory, type RoomDriverHandlers, type RoomEngine, type RoomEngineOptions, type RoomEventOutcome, type RoomEventTopic, type RoomName, type RoomPhase, type RoomReaction, type RoomToken, type RoomTokenStorage, type RsvpAnswer, type RsvpInvitation, type RsvpState, type ScheduleMeetingInput, type Stage, type StageArgs, type StageLayout, TABLES, TRANSCRIPTION_ATTRIBUTES, TRANSCRIPTION_TOPIC, type TokenClient, type TokenClientOptions, type TokenRequest, type TranscriptBlock, type TranscriptFormat, type TranscriptMatch, type TranscriptSegment, type TranscriptSource, type UpcomingOccurrence, type UserId, type VideoEffect, type WrapUpAnnouncement, type WrapUpStatus, absenceSentence, activeWrapUpSummary, announceMeeting, applyRoomEvent, asCallId, asMeetingId, asOrganizationId, asParticipantIdentity, asRoomName, asUserId, attendanceCsv, attendanceReport, attendanceTotals, attendeeKey, callInviteAction, callInviteText, callStateLabel, canModerate, canModerateParticipant, canTransition, captionSegment, changesPatch, clockPosition, computeStage, countLabel, createCallCenter, createCallInviteHandler, createDeviceManager, createInRoomClient, createLiveKitDriver, createMeetAi, createMeetApi, createMeetRepository, createMeetStore, createMeetingInviteHandler, createMeetingSession, createMemoryDeviceStorage, createRecordingController, createRoomEngine, createTokenClient, createWebDeviceStorage, createWebEffectsStorage, createWebRoomTokenStorage, displayNameFor, fileDownloadPath, gridColumns, groupTranscript, guestRecordAccessExplanation, guestRecordAccessLabel, guestRecordAccessSetting, hasEnded, hostUserIds, invalidResponse, isGuest, isGuestIdentity, isHostRole, isListenOnly, isNoteTaker, isRealName, isRoomEventTopic, learnName, learnNames, listenOnlyNotice, loadFollowUpDraft, loadGuestMeetingRecord, loadMeetingChat, loadMeetingRecord, mapConnectionState, mapQuality, meetingInviteAction, meetingLength, meetingLink, meetingPath, meetingSlug, meetingTopic, meetingWhen, mergeCaption, mergeRecord, normalizeDeviceError, normalizeMeetError, normalizeSpoken, noteTakerIdentity, noteTakerLabel, noteTakerParticipant, noteTakerStatus, notesDocument, orderParticipants, parseRoomToken, participantSummary, playableRecordingFileId, projectInvitee, projectLibraryRecording, projectNote, projectOccurrence, projectOverride, projectParticipant, projectRsvpInvitation, projectSearchHit, projectSegment, projectUpcoming, pushMeetingToGoogleCalendar, readServerRefusal, readableTranscript, recordingLabel, recordingNotice, recordingOffsetMs, roleOf, roomTopic, searchTranscript, sendFollowUp, setGuestRecordAccess, settingsPatch, snapshotParticipant, snippetRuns, summarizeMeetingRecordRestrictions, transcriptDocument, unavailableFrom, uniqueAttendees, userTopic, wasRefused, wrapUpStatus };