@ai-matrx/meet 0.7.84 → 0.7.85

package/dist/core.d.cts

@@ -0,0 +1,3048 @@
+import { P as ParticipantIdentity, $ as NoteTakerState, a as MeetParticipant, M as MeetingRecord, a7 as RoomPhase, e as ParticipantRole, S as StageLayout, L as LobbyEntry, a6 as RecordingState, U as UserId, av as RecordingSource, ab as TranscriptSegment, g as MeetingNote, W as WrapUpAnnouncement, i as CollabSnapshot, o as ConnectionQuality, j as AdmissionState, h as MeetingId, R as RoomName, b as MeetApi, d as CallInvite, f as CallMode, O as OrganizationId, l as CallId, m as CallState, X as MeetingKind, a4 as RecordingPolicy, a5 as RecordingRecord, N as MeetingAttendee, _ as MeetingSettings, Q as MeetingChanges, a1 as OccurrenceOverride, Z as MeetingOccurrence, ac as UpcomingOccurrence, V as MeetingInvitee, I as InviteeInput, p as InviteeRole, a8 as RsvpAnswer, a9 as RsvpInvitation, c as MeetIdentity, C as CollabPanel } from './collab-Bss-_Jfp.cjs';
+export { A as AccessTokenSource, k as CAPTION_LANGUAGES, n as CallablePerson, E as EMPTY_COLLAB, F as FILE_SESSION_PATH, J as JsonObject, q as JsonValue, r as MeetApiOptions, s as MeetApiRequest, t as MeetBreakoutBroadcast, u as MeetBreakoutPlan, v as MeetBreakoutRoom, w as MeetCollabSettings, x as MeetFileMedia, y as MeetPoll, z as MeetPollOption, B as MeetPollState, D as MeetQuestion, G as MeetQuestionState, H as MeetStroke, K as MeetingActivities, Y as MeetingNoteKind, a0 as ORGANIZATION_HEADER, a2 as OccurrenceState, a3 as ROLE_RANK, aa as RsvpState, T as TranscriptSource, ad as applyCollabPacket, ae as asCallId, af as asMeetingId, ag as asOrganizationId, ah as asParticipantIdentity, ai as asRoomName, aj as asUserId, ak as assignedRoom, al as autoAssign, am as breakoutRemainingMs, an as collabFromState, ao as createMeetApi, ap as defaultCaptionLanguage, aq as fileDownloadPath, ar as isGuest, as as isHostRole, at as loadMeetingActivities, au as withItem } from './collab-Bss-_Jfp.cjs';
+import { RealtimeManager } from '@ai-matrx/realtime';
+import { MessagingSupabaseClient, ActionHandler } from '@ai-matrx/messaging';
+import { RoomOptions, ConnectionQuality as ConnectionQuality$1, Participant } from 'livekit-client';
+
+/**
+ * ONE error classification for the whole package (C22).
+ *
+ * The banned alternative is a host catching a LiveKit or PostgREST error and
+ * deciding for itself whether the camera is busy, the token expired, or the
+ * meeting is locked — which is how the same five-branch `if` gets copy-pasted
+ * into every consumer and drifts. Everything this package throws is a
+ * `MeetError` with a stable `code` and a `remedy` SENTENCE. Nothing fails
+ * silently, and nothing fails without saying what to do about it.
+ *
+ * The device codes exist because "it doesn't work" in a video product is almost
+ * always one of four specific, differently-remediable things: permission
+ * denied, no such device, device already in use by another app, or insecure
+ * context (http, where `getUserMedia` does not exist at all). A single
+ * "media-error" would make the UI say the wrong sentence three times out of
+ * four.
+ */
+type MeetErrorCode = "session-unavailable" | "forbidden" | "not-found" | "conflict" | "token" | "transport" | "invalid-response" | "misconfigured" | "permission-denied" | "device-not-found" | "device-in-use" | "insecure-context" | "media-unsupported" | "room-locked" | "lobby-denied" | "capacity"
+/** Meet wave 1: the meeting was cancelled — its link resolves, its room never opens. */
+ | "cancelled" | "unknown";
+declare class MeetError extends Error {
+    readonly code: MeetErrorCode;
+    /** What to DO. Rendered to the user for the device codes. */
+    readonly remedy: string;
+    readonly cause?: unknown;
+    constructor(code: MeetErrorCode, message: string, remedy: string, cause?: unknown);
+    /** True when retrying after the host re-establishes a session is the fix. */
+    get isRetryable(): boolean;
+    /** True when the user, not the code, must act — the UI shows `remedy`. */
+    get isUserActionable(): boolean;
+}
+/**
+ * THE ONE PLACE a raw database/transport error becomes a typed one. Called at
+ * every repository boundary; nothing else in the package inspects a raw error,
+ * and no consumer should ever have to.
+ */
+declare function normalizeMeetError(error: unknown, operation: string): MeetError;
+/**
+ * THE DEVICE ERROR TRANSLATOR — the second-most-copied block in every video app.
+ *
+ * `getUserMedia` rejects with DOMException names, and every one of them means
+ * something a user could fix if we told them. This is the whole reason the
+ * device layer lives in the package (C22 test 3: less-than-perfect unless done
+ * perfectly).
+ */
+declare function normalizeDeviceError(error: unknown, operation: string): MeetError;
+/** A response whose SHAPE is wrong — the ingress boundary, not the wire. */
+declare function invalidResponse(operation: string, detail: string): MeetError;
+
+/**
+ * WHO SAID THAT — one answer, every surface, both lanes (MRI-A16).
+ *
+ * 🚨 **A RAW LIVEKIT IDENTITY IS NEVER A PERSON'S NAME.** On production
+ * 2026-09-09 the host's caption rail read *"Ada Lovelace: I planted a marigold
+ * in the courtyard"* and the guest's — the same meeting, the same second —
+ * read *"guest:c8-spk-1"*, because the host resolved the name from the durable
+ * rows it can read and the guest had no fallback at all and printed the token
+ * (MRI-C8). Two surfaces disagreeing about who is speaking is worse than either
+ * one being ugly: a person reading the transcript cannot tell whether those are
+ * one speaker or two.
+ *
+ * The cure is that nothing resolves a name for itself. Every source that
+ * happens to KNOW a name teaches this book — the LiveKit roster, a durable
+ * `meet_transcript_segments` row, a durable `meet_participants` row, a chat
+ * message, our own identity — and every surface asks it. Three rules:
+ *
+ * 1. **A name is learned, never unlearned.** Someone who leaves the room keeps
+ *    the name they had; a caption that lands after them still says who spoke.
+ *    This is the "last known name" rule, and it is why the book is a store
+ *    field rather than a derivation over the current roster.
+ * 2. **An identity is not a name.** `learn` refuses a "name" that is the
+ *    identity itself — which is exactly what the LiveKit roster hands back for
+ *    a participant whose token carried no name, and exactly how the token got
+ *    onto the screen in the first place.
+ * 3. **When nobody knows, SAY nobody knows.** `displayNameFor` answers with an
+ *    honest placeholder — "Unnamed guest" / "Unnamed participant" — never a
+ *    token, and never an invented name. The placeholder is deliberately not
+ *    unique, so surfaces that must keep two unnamed people apart group by
+ *    IDENTITY rather than by the rendered name.
+ */
+
+/** Identity → the best display name anything has ever known for it. */
+type NameBook = Readonly<Record<string, string>>;
+/** A guest's identity is minted `guest:<something>` by the token route. */
+declare function isGuestIdentity(identity: ParticipantIdentity | string): boolean;
+/**
+ * Would this string be a real name for this identity? A name equal to the
+ * identity is the roster's way of saying it has none.
+ */
+declare function isRealName(identity: ParticipantIdentity | string, name: string | null | undefined): boolean;
+/**
+ * Teach the book one identity's name. Returns the SAME book when nothing was
+ * learned, so a store commit can be skipped rather than waking every subscriber
+ * on every caption.
+ */
+declare function learnName(book: NameBook, identity: ParticipantIdentity | string, name: string | null | undefined): NameBook;
+/** Teach the book several at once — a roster replace, or a durable read. */
+declare function learnNames(book: NameBook, entries: readonly {
+    identity: ParticipantIdentity | string;
+    displayName?: string | null | undefined;
+}[]): NameBook;
+/**
+ * The name a surface renders for `identity`. Never a raw token, never invented.
+ *
+ * `preferred` is what the arriving thing itself claimed (a caption's roster
+ * lookup, a durable row's `speaker` column); it wins when it is a real name,
+ * because it is the freshest, and teaches the book on its way past.
+ */
+declare function displayNameFor(book: NameBook, identity: ParticipantIdentity | string, preferred?: string | null | undefined): string;
+
+/**
+ * LISTEN-ONLY ATTENDANCE — being IN the room is never contingent on a device.
+ *
+ * 0.3.1 and every version before it enabled the microphone as the last step of
+ * `connect()`, inside the same `try` as the join. So a denied, absent, or busy
+ * microphone did not produce a muted participant — it threw, the join was
+ * failed with a device remedy, and the user was dropped back to `<PreJoin>`
+ * having never entered the meeting. The whole in-room surface (tiles, captions,
+ * live notes, Q&A, the note-taker consent notice) was unreachable to anyone
+ * without a working mic, which is ordinary: a locked-down laptop, a conference
+ * room dial-in, a phone on a call, a browser profile that denies capture by
+ * policy, or a person who simply wants to listen. Every competitor allows it.
+ *
+ * THE CLASS, and how it is closed here:
+ *
+ * 1. **Connecting and publishing are two different operations.** The engine
+ *    reaches `connected` the moment the transport is up. Media is attempted
+ *    AFTER that, per track, and a rejection never unwinds the join.
+ * 2. **A track that could not be acquired is STATE, not an exception.** The
+ *    reason and its remedy — the browser's own, translated by
+ *    `normalizeDeviceError` — ride in the snapshot so the UI says WHY the mic
+ *    is off instead of showing a mute button that silently does nothing.
+ * 3. **Enabling later runs the SAME code path.** `setMicrophoneEnabled(true)`
+ *    from the control bar records exactly what the join attempt records, so a
+ *    person who plugs in a headset mid-meeting is one click from speaking and
+ *    a person whose second attempt also fails gets the same honest sentence.
+ *    A separate "retry" path is how the two drift.
+ * 4. **The notice is one sentence, defined once.** Both the package's own room
+ *    chrome and any host that renders its own read `listenOnlyNotice()`, so
+ *    there is no second wording to keep in sync.
+ */
+
+/** Why a local track is not publishing, in the browser's terms plus a remedy. */
+interface MediaUnavailable {
+    readonly code: string;
+    readonly message: string;
+    readonly remedy: string;
+}
+interface LocalTrackState {
+    /** True only when the track is actually published. Never optimistic. */
+    readonly enabled: boolean;
+    /**
+     * Set when acquisition was ATTEMPTED and refused. `null` covers both "on"
+     * and "deliberately off" — a user who unchecked the mic in pre-join is not
+     * looking at an error, they are looking at a choice they made.
+     */
+    readonly unavailable: MediaUnavailable | null;
+}
+interface LocalMediaState {
+    readonly microphone: LocalTrackState;
+    readonly camera: LocalTrackState;
+}
+declare const IDLE_TRACK: LocalTrackState;
+declare const IDLE_MEDIA: LocalMediaState;
+declare function unavailableFrom(error: MeetError): MediaUnavailable;
+/**
+ * THE SENTENCE. One definition, so the room chrome, a host's own chrome and the
+ * tests cannot say three different things about the same fact.
+ */
+declare const LISTEN_ONLY_NOTICE = "You're attending without a microphone \u2014 others can't hear you";
+/**
+ * True when this participant is in the room with NO USABLE microphone — the
+ * device was refused or is missing. A person who simply muted themselves has a
+ * working microphone and is not "attending without" one, so a mute never
+ * counts: `unavailable` is the only signal.
+ */
+declare function isListenOnly(media: LocalMediaState): boolean;
+/**
+ * The notice to render while in the room, or `null` when the mic is live.
+ * Returns the plain sentence; the reason and remedy, when there is one, are
+ * rendered beside it from `media.microphone.unavailable`.
+ */
+declare function listenOnlyNotice(media: LocalMediaState): string | null;
+
+/**
+ * THE NOTE-TAKER, AS A SURFACE MUST RENDER IT.
+ *
+ * 🚨 **THE PACKAGE NEVER GUESSES WHAT THE AGENT IS DOING.** Two facts decide
+ * everything here and both come from outside this client: the meeting row's
+ * `metadata.note_taker` (written by the server with a CAS, MRI-A2/D9) and
+ * whether the agent participant is actually in the LiveKit room. A spinner —
+ * "starting…" held open by a client-side timer — is the exact lie this file
+ * exists to prevent: it survives a worker that never came, a dispatch nobody
+ * claimed, and a job that died on a release.
+ *
+ * 🚨 **A REFUSAL IS RENDERED VERBATIM.** `/agent/start` answers a 503 whose body
+ * carries `reason` and `remedy` written by the readiness gate (D7) — "no worker
+ * is registered under matrx-note-taker", "every worker is at capacity",
+ * "the fleet is draining". Those sentences are the truth about the system and
+ * they reach the screen unedited. This package adds no sentence of its own on
+ * top of one the server already wrote.
+ *
+ * The agent's identity is DETERMINISTIC — `agent:note_taker:<meeting_id>` (D9) —
+ * which is what makes "is it in the room" answerable without a round trip, and
+ * what makes a second note-taker impossible to mistake for the first.
+ */
+
+/** The one spelling of the agent's participant identity (D9). */
+declare const NOTE_TAKER_IDENTITY_PREFIX = "agent:note_taker:";
+declare function noteTakerIdentity(meetingId: string): string;
+/**
+ * The participant attribute the note-taker sets on itself so EVERY client —
+ * including one that cannot read the token metadata — knows a notice is owed
+ * (D10).
+ */
+declare const CONSENT_NOTICE_ATTRIBUTE = "matrx.agent.consent_notice";
+/** Where the state lives on the meeting row. One spelling, one file. */
+declare const NOTE_TAKER_METADATA_KEY = "note_taker";
+/** The server's refusal, as it wrote it. Never paraphrased. */
+interface NoteTakerRefusal {
+    readonly reason: string;
+    readonly remedy: string;
+    readonly status: number;
+}
+interface NoteTakerStatus {
+    readonly state: NoteTakerState;
+    /** The server's own words for why it is in this state, when it gave any. */
+    readonly detail: string | null;
+    /** True when the agent participant is in the room RIGHT NOW. */
+    readonly present: boolean;
+    /** The last dispatch refusal, rendered verbatim. */
+    readonly refusal: NoteTakerRefusal | null;
+}
+/** Is this participant the note-taker (or any agent that owes a notice, D10)? */
+declare function isNoteTaker(participant: MeetParticipant): boolean;
+/** The agent participant in the room, if any. */
+declare function noteTakerParticipant(participants: readonly MeetParticipant[]): MeetParticipant | null;
+/**
+ * THE STATE, from the two facts that decide it.
+ *
+ * The durable row is the authority for work. Exact room presence corroborates
+ * only a durable `transcribing` state; an arbitrary agent, a consent marker,
+ * or a stale note-taker participant never proves speech capture.
+ */
+declare function noteTakerStatus(args: {
+    meeting: MeetingRecord | null;
+    participants: readonly MeetParticipant[];
+    refusal?: NoteTakerRefusal | null;
+}): NoteTakerStatus;
+/**
+ * THE SENTENCE FOR EACH STATE. One place, so the room, the panel and any future
+ * surface say the same true thing — and so a state can never render as a bare
+ * enum name.
+ */
+declare function noteTakerLabel(status: NoteTakerStatus): string;
+
+/**
+ * THE ROOM SNAPSHOT — one immutable object the UI renders and nothing else.
+ *
+ * Deliberately NOT Redux, NOT a context full of `useState`, and NOT a bag of
+ * refs: one store with `getSnapshot`/`subscribe` is exactly what
+ * `useSyncExternalStore` wants, which is what makes tearing impossible when a
+ * roster event and a speaker event land in the same tick.
+ *
+ * The rules encoded here:
+ *
+ * - **The roster is replaced wholesale, never patched.** The driver hands us
+ *   the full truth on every media event (see `room-driver.ts`); merging deltas
+ *   from six event sources is how a tile for someone who left stays on screen.
+ * - **Ephemera EXPIRE.** Reactions and speaking flags are time-boxed in the
+ *   snapshot, so a dropped "stop" event cannot leave a permanent 🎉 or a
+ *   permanently-speaking ring. (Nothing here relies on receiving an end event.)
+ * - **An interim transcript line is REPLACED in place by its final.** Appending
+ *   both is how a transcript ends up saying everything twice.
+ */
+
+interface RoomChatMessage {
+    readonly id: string;
+    readonly identity: ParticipantIdentity;
+    readonly displayName: string;
+    readonly text: string;
+    readonly at: string;
+    /**
+     * Set for a PRIVATE message: the one identity it was addressed to (from the
+     * sender's side) or this participant (from the receiver's). Private messages
+     * travel the data plane only and are never saved (Meet wave 2).
+     */
+    readonly to?: ParticipantIdentity | null | undefined;
+    /** True once the server has SAVED it — a message everyone sees, late joiners too. */
+    readonly saved?: boolean | undefined;
+    /** A send the server refused, with its sentence. The message stays visible, marked. */
+    readonly failed?: string | undefined;
+}
+/**
+ * A HOST ACTED ON *ME* (Meet wave 2) — the server's own `matrx.meet.moderation`
+ * packet, addressed to this participant. Rendered once, dismissible, in words.
+ */
+interface ModerationNotice {
+    readonly kind: "muted" | "ask-unmute" | "removed" | "role";
+    readonly text: string;
+    readonly at: number;
+}
+/** What this participant chose for their own media. Remembered per browser. */
+interface MediaEffects {
+    readonly noiseSuppression: boolean;
+    readonly background: "none" | "blur" | "image";
+    readonly backgroundImage: string | null;
+}
+declare const DEFAULT_EFFECTS: MediaEffects;
+interface RoomReaction {
+    readonly id: string;
+    readonly identity: ParticipantIdentity;
+    readonly emoji: string;
+    readonly at: number;
+}
+/**
+ * 🚨 WHAT THE SERVER GRANTED THIS JOINER, straight off the token response
+ * (MRI-A11). It is placed in the snapshot the instant the token lands — before
+ * the LiveKit roster exists at all — so a host's controls are correct on the
+ * first frame of the room rather than one roster event later. The roster entry
+ * for the local participant carries the SAME decision as a LiveKit attribute;
+ * the two agree because one server statement produced both, and the UI reads
+ * whichever has arrived.
+ */
+interface MeetGrants {
+    readonly role: ParticipantRole;
+    readonly canRecord: boolean;
+    readonly canPublish: boolean;
+    readonly canSubscribe: boolean;
+}
+/** No token yet grants nothing. Never "assume host until told otherwise". */
+declare const NO_GRANTS: MeetGrants;
+interface MeetSnapshot {
+    readonly phase: RoomPhase;
+    readonly meeting: MeetingRecord | null;
+    readonly localIdentity: ParticipantIdentity | null;
+    /** The server's word on what THIS joiner may do. See `MeetGrants`. */
+    readonly grants: MeetGrants;
+    readonly participants: readonly MeetParticipant[];
+    readonly activeSpeakers: readonly ParticipantIdentity[];
+    readonly pinned: ParticipantIdentity | null;
+    readonly layout: StageLayout;
+    readonly lobby: readonly LobbyEntry[];
+    readonly locked: boolean;
+    /**
+     * 🚨 THE DURABLE `meet_recordings.state`, not a client's hope. Through 0.4.7
+     * this only ever held what THIS browser optimistically patched — `starting`
+     * on the click, `stopping` on the stop — so the indicator read "Starting
+     * recording…" for the whole meeting while a perfectly healthy egress ran, and
+     * "Stopping recording…" forever after (MRI-C8). The server's transitions
+     * arrive on two transports now: the `meet_recordings` row for a member, and
+     * a `matrx.meet.recording` room event for a guest, who has no database.
+     */
+    readonly recording: RecordingState;
+    readonly recordingStartedBy: UserId | null;
+    /**
+     * WHICH transport last spoke, so the two cannot undo each other (D16). The
+     * database wins: `"record"` is never overwritten by `"room"` or `"local"`.
+     */
+    readonly recordingSource: RecordingSource;
+    /**
+     * WHICH recording this state is about. It is what tells a LATE packet for a
+     * finished recording apart from the FIRST packet of the next one — without
+     * it, "the database wins" either blocks a second recording forever or lets a
+     * stale packet drag a finished one back to `recording`.
+     */
+    readonly recordingId: string | null;
+    readonly chat: readonly RoomChatMessage[];
+    /** Whether the SAVED chat has been read for this meeting (late joiners see history). */
+    readonly chatLoaded: boolean;
+    /** Why the saved chat could not be read on join, in words — or null. */
+    readonly chatHistoryError: string | null;
+    readonly reactions: readonly RoomReaction[];
+    /**
+     * The participant a HOST spotlighted for everyone, from the room's metadata
+     * (server-set, delivered on join). A local pin outranks it on this screen only.
+     */
+    readonly spotlight: ParticipantIdentity | null;
+    /** The last thing a host did to THIS participant, in words. Dismissible. */
+    readonly moderationNotice: ModerationNotice | null;
+    /**
+     * The server's answer to the last host action THIS participant took ("Muted 3
+     * people", or the refusal). One place, so whichever surface acted — a tile's
+     * menu, the People panel, More options — the sentence survives the menu closing.
+     */
+    readonly actionNotice: {
+        readonly text: string;
+        readonly failed: boolean;
+        readonly at: number;
+    } | null;
+    /**
+     * "Message privately" asked for from ANY per-person menu — a tile's, the
+     * People panel's — and answered by the one `ControlBar` that owns the chat
+     * panel (0.7.8). Through 0.7.7 only the People panel could open a private
+     * chat, so the Board's tile menu (and the Room's) had no such item while the
+     * People panel did: two menus for one person that disagreed.
+     */
+    readonly privateChatRequest: {
+        readonly to: ParticipantIdentity;
+        readonly at: number;
+    } | null;
+    readonly effects: MediaEffects;
+    /**
+     * Captions AND durable rows, reconciled into one list (D16). A record
+     * replaces the caption it supersedes; a caption never overwrites a record.
+     */
+    readonly transcript: readonly TranscriptSegment[];
+    readonly notes: readonly MeetingNote[];
+    /**
+     * 🚨 IDENTITY → THE BEST NAME ANYTHING HAS EVER KNOWN (MRI-A16). Learned from
+     * every source that has one — the roster, a durable segment, a durable
+     * attendance row, a chat message — and never unlearned, so a caption that
+     * lands after somebody leaves still says who spoke. It exists because the
+     * host and the guest rendered DIFFERENT names for the same speaker in the
+     * same second, one of them a raw LiveKit token (MRI-C8). See `core/names.ts`.
+     */
+    readonly names: NameBook;
+    /**
+     * The wrap-up pass ANNOUNCED itself (MRI-A12). `null` means it has not been
+     * announced in this room — which is not the same as "no summary exists", and
+     * no surface may render it as such.
+     */
+    readonly wrapUp: WrapUpAnnouncement | null;
+    /**
+     * The server's last refusal to dispatch the note-taker, in ITS words (D7).
+     * Rendered verbatim; never replaced by a spinner or a house sentence.
+     */
+    readonly noteTakerRefusal: NoteTakerRefusal | null;
+    /**
+     * What the LOCAL participant is actually publishing, and why not when it is
+     * not. Attendance never depends on it (see `attendance.ts`): a refused
+     * microphone is a state with a remedy, not a failed join.
+     */
+    readonly media: LocalMediaState;
+    /** The last failure, with its remedy. Never null-and-hoping. */
+    readonly failure: {
+        readonly message: string;
+        readonly remedy: string;
+    } | null;
+    /**
+     * Meet wave 5: polls, Q&A, the shared whiteboard and the breakout plan — what the
+     * server said, per viewer (`core/collab.ts`). Read once per join, then packets.
+     */
+    readonly collab: CollabSnapshot;
+    /** The breakout room THIS participant is in, or null for the main room. */
+    readonly breakoutRoomId: string | null;
+}
+/** Reactions live this long. A dropped end event cannot outlive it. */
+declare const REACTION_TTL_MS = 5000;
+interface MeetStore {
+    snapshot(): MeetSnapshot;
+    subscribe(listener: () => void): () => void;
+    patch(next: Partial<MeetSnapshot>): void;
+    setParticipants(participants: readonly MeetParticipant[]): void;
+    setSpeaking(identities: readonly ParticipantIdentity[]): void;
+    setQuality(identity: ParticipantIdentity, quality: ConnectionQuality): void;
+    /**
+     * Raise or lower a hand. `at` is WHEN it went up, which is the hand queue's
+     * order — first raised, first called on, the way Meet orders it.
+     */
+    setHand(identity: ParticipantIdentity, raised: boolean, at?: number): void;
+    addChat(message: RoomChatMessage): void;
+    /** The saved chat, read once per join. Merged with anything that arrived live. */
+    loadChat(messages: readonly RoomChatMessage[]): void;
+    /** Replace a pending message (by id) with what the server saved, or mark it failed. */
+    settleChat(localId: string, next: RoomChatMessage | {
+        failed: string;
+    }): void;
+    addReaction(reaction: RoomReaction): void;
+    /** Drops reactions past their TTL. Called by the UI's animation frame. */
+    expireReactions(now: number): void;
+    /**
+     * The recording reached a state, and WHO says so. `"local"` is this browser's
+     * optimistic `starting`/`stopping`; `"room"` is the server's packet on the
+     * media plane; `"record"` is the durable row. Precedence is D16's: the
+     * database's word stands until the database changes it.
+     */
+    setRecording(state: RecordingState, by: UserId | null, source: RecordingSource, recordingId?: string | null): void;
+    upsertLobby(entry: LobbyEntry): void;
+    setAdmission(identity: ParticipantIdentity, state: AdmissionState, by: UserId | null): void;
+    /**
+     * Teach the name book. Every source that knows a name calls this, and only
+     * a REAL name is learned — an identity handed back as its own name is not one.
+     */
+    learn(entries: readonly {
+        identity: ParticipantIdentity;
+        displayName?: string | null;
+    }[]): void;
+    /** A live caption from the media plane. A HINT (D16). */
+    ingestCaption(segment: TranscriptSegment): void;
+    /** A durable `meet_transcript_segments` row. THE TRANSCRIPT (D16). */
+    ingestRecord(segment: TranscriptSegment): void;
+    /** Durable notes are re-written in place — a re-run rewrites the same ids. */
+    upsertNote(note: MeetingNote): void;
+    /** The wrap-up pass finished. Announced on the media plane only (MRI-A12). */
+    announceWrapUp(announcement: WrapUpAnnouncement): void;
+    /** Record what a local track ACTUALLY did — published, or refused and why. */
+    setLocalTrack(kind: "microphone" | "camera", state: LocalTrackState): void;
+    reset(): void;
+}
+declare function createMeetStore(initial?: Partial<MeetSnapshot>): MeetStore;
+
+/**
+ * AI-NATIVE, ON BY DEFAULT — and SERVER-OWNED as of 0.3.0 (R4, D2, D16).
+ *
+ * 🚨 **THE PACKAGE NO LONGER KNOWS WHO ANSWERS.** Through 0.2.1 a host injected
+ * `MeetAgents` — four database row ids — and this module ran the agent itself,
+ * shipping the transcript up as `variables`. Both halves of that are gone:
+ *
+ * 1. **No agent id crosses this boundary, and none is injected.** Reasoning runs
+ *    behind Mandates whose Holder is resolved from the database at run time
+ *    (`meet.live_notes`, `meet.live_intelligence`, `meet.wrap_up`), so an
+ *    organization rebinds the job in the Mandate admin with no release of this
+ *    package and no change in the host. A host that had to supply an id was a
+ *    host that could supply the WRONG id, and a capability that silently
+ *    disappeared when nobody had filled a config line.
+ * 2. **No transcript crosses this boundary either.** `POST /v1/meet/intelligence/ask`
+ *    takes `{meeting_id, question}` and NOTHING else; the answer is built
+ *    server-side from durable rows. Captions are hints and this client holds
+ *    only hints (D16) — sending them would be sending the model our guesses.
+ *
+ * What is left here is small and honest: ask a question and render the answer
+ * as it streams, summon or dismiss the note-taker, end the meeting for
+ * everyone, and report the server's refusal in the server's own words.
+ *
+ * 🚨 **THE USER-INPUT LAW still holds** and is now the server's to keep:
+ * `question` is the one genuine human utterance in this module, and it is the
+ * only free text this package sends anywhere near a model.
+ */
+
+interface MeetAiOptions {
+    /** The ONE org-aware aidream client (MRI-A16). Owns base url and headers. */
+    api: MeetApi;
+    store: MeetStore;
+    /**
+     * Resolves the current meeting's room pass for a guest Q&A request. The
+     * provider owns this because it alone has both the active room and its
+     * persisted guest pass. `null` leaves the header absent for signed-in record
+     * Q&A, where the session remains the credential.
+     */
+    resolveRoomToken?: (() => string | null) | undefined;
+}
+/** What the answer was built from. The server measures it; we never guess it. */
+interface MeetAnswerCoverage {
+    readonly segmentsUsed: number;
+    readonly segmentsTotal: number;
+    readonly truncated: boolean;
+    readonly speakers: readonly string[];
+}
+interface MeetAiAnswer {
+    readonly text: string;
+    readonly coverage: MeetAnswerCoverage | null;
+}
+interface AskArgs {
+    readonly meetingId: MeetingId;
+    readonly question: string;
+    readonly signal?: AbortSignal | undefined;
+    /** Called with the answer so far, every time it grows. Rendering is live. */
+    readonly onText?: ((text: string) => void) | undefined;
+    /** The server's phase, verbatim, so a slow answer is never a bare spinner. */
+    readonly onPhase?: ((phase: string) => void) | undefined;
+}
+interface NoteTakerDispatch {
+    readonly dispatched: boolean;
+    /** The server's sentence. Never empty on a refusal. */
+    readonly detail: string;
+}
+interface MeetAi {
+    /** In-meeting Q&A. The ONE human utterance this package sends (D16). */
+    ask(args: AskArgs): Promise<MeetAiAnswer>;
+    /** Ask aidream to dispatch the note-taker INTO the room. Host-only. */
+    startNoteTaker(args: {
+        meetingId: MeetingId;
+        roomName: RoomName;
+    }): Promise<NoteTakerDispatch>;
+    /** Dismiss it. Nothing automatic brings a dismissed note-taker back (D9). */
+    stopNoteTaker(args: {
+        meetingId: MeetingId;
+    }): Promise<NoteTakerDispatch>;
+}
+/** The event vocabulary `/intelligence/ask` emits, pinned by the server's FEATURE.md. */
+declare const MEET_ANSWER_EVENTS: {
+    readonly chunk: "chunk";
+    readonly info: "info";
+    readonly phase: "phase";
+    readonly error: "error";
+    readonly end: "end";
+};
+/** The `info` event carrying what the answer was built from. */
+declare const MEET_ANSWER_CONTEXT_EVENT = "meet_intelligence_context";
+
+interface ServerRefusal {
+    readonly reason: string;
+    readonly remedy: string;
+}
+/**
+ * THE SERVER'S REFUSAL, READ RATHER THAN RE-WRITTEN.
+ *
+ * aidream answers a refused dispatch with a body carrying its own `reason` and
+ * `remedy` — "no worker is registered under matrx-note-taker", and what to do
+ * about it. FastAPI nests a raised `HTTPException` under `detail`, and a
+ * validation failure produces a list. All three shapes are read here so the
+ * screen shows the system's own words instead of "something went wrong".
+ */
+declare function readServerRefusal(body: unknown): ServerRefusal | null;
+declare function createMeetAi(options: MeetAiOptions): MeetAi;
+
+/**
+ * CAPTIONS ARE HINTS; SEGMENTS ARE TRUTH (D16).
+ *
+ * Two independent streams describe the same speech and they arrive out of order
+ * with different identities:
+ *
+ * 1. **Captions** ride the LiveKit `lk.transcription` text stream, keyed by
+ *    `lk.segment_id`, interim-then-final, milliseconds behind the voice. They
+ *    exist so a person can READ the room live. Their `sender_identity` is
+ *    supplied by the publishing client and LiveKit does not validate it, so
+ *    nothing downstream — notes, Q&A, the wrap-up — may ever read them.
+ * 2. **Records** are `communication.meet_transcript_segments` rows, written
+ *    server-side by the note-taker with a deterministic id (D6) and delivered
+ *    here by Postgres Changes. They are the meeting's transcript.
+ *
+ * The reconciliation below is what keeps the screen from saying everything
+ * twice. A record REPLACES the caption it supersedes — matched by the caption
+ * id the worker carries into the row, and failing that by speaker + text — and
+ * a caption never overwrites a record, however late it lands.
+ *
+ * Everything here is a pure function over a list so the rules are provable
+ * without a store, a socket, or a browser.
+ */
+
+/** Comparable text: case, punctuation and spacing are not differences. */
+declare function normalizeSpoken(text: string): string;
+/**
+ * A caption arrived. Interim replaces interim in place; a final never loses to a
+ * late interim; a record is never touched.
+ */
+declare function mergeCaption(list: readonly TranscriptSegment[], caption: TranscriptSegment): readonly TranscriptSegment[];
+/**
+ * A durable row arrived. It replaces the caption it supersedes — in place, so
+ * the line does not jump down the panel — or lands as a new line if no caption
+ * ever showed it (a surface that joined late, or captions that never came).
+ */
+declare function mergeRecord(list: readonly TranscriptSegment[], record: TranscriptSegment): readonly TranscriptSegment[];
+/** The transcript a person reads: chronological, and never an empty line. */
+declare function readableTranscript(list: readonly TranscriptSegment[]): readonly TranscriptSegment[];
+/** Build a caption line from the media plane. */
+declare function captionSegment(args: {
+    captionId: string;
+    meetingId: TranscriptSegment["meetingId"];
+    identity: ParticipantIdentity;
+    speaker: string;
+    text: string;
+    final: boolean;
+    startedAt: string;
+}): TranscriptSegment;
+
+/**
+ * THE DATA CONTRACT — the ONE place a meet table or RPC name exists.
+ *
+ * 🚨 **STATE OF THE SCHEMA (read this before believing a green test).** The
+ * `communication.meet_*` tables below are the canonical schema DESIGNED by this
+ * package per R8; they are **not deployed to Matrx Main yet**. They were placed
+ * by inspecting the live database on 2026-08-31: `communication` is the schema
+ * that already holds `dm_*` (messaging) and `sms_*` (telephony), so meet takes
+ * the `meet_*` prefix in the same schema rather than inventing a new one. Until
+ * the migration lands, every read here fails LOUDLY with `not-found` and a
+ * remedy naming this file — never silently, and never with a fabricated row.
+ * The migration and the aidream server half are one deliverable; see FEATURE.md
+ * § Deliberately NOT in this package.
+ *
+ * Four rules hold this file together — the same four that hold messaging's:
+ *
+ * 1. **Org is explicit on every write (R5).** Not defaulted by a trigger we
+ *    hope fires — passed, and refused in-package when absent.
+ * 2. **Authorization is the database's job.** There is no permission branch in
+ *    this file. An RPC that says no is a `forbidden` MeetError, never a
+ *    client-side re-decision. Guest capability is scoped by the room TOKEN, not
+ *    by a row this client could write.
+ * 3. **Writes go through SECURITY DEFINER RPCs; reads are RLS-backed table
+ *    reads** (C17's hybrid ruling). Every write here is an RPC, which is also
+ *    what keeps admission and settle-a-call ATOMIC — two hosts clicking "admit"
+ *    and a callee accepting on two devices are the ordinary case, not the edge.
+ * 4. **Pagination is keyset, terminated by a unique column.** `(created_at,
+ *    id)` — never a timestamp alone, which duplicates or skips rows whenever
+ *    two share a millisecond.
+ *
+ * The Supabase client is accepted STRUCTURALLY, through the shape
+ * `@ai-matrx/messaging` already owns. One definition of "a Supabase client" for
+ * the whole communications family; this package adds no second copy.
+ *
+ * 🚨 AND THE PUBLIC BOUNDARY IS THE SHALLOW ONE (0.2.1). `RepositoryOptions`
+ * and `<MeetProvider client>` take `MessagingSupabaseClient` — method names and
+ * arity, results as `unknown` — never the rich `SupabaseLike`. Checking a
+ * host's real `SupabaseClient<Database>` (built from generated types) against
+ * the rich shape makes tsc chase PostgREST's schema machinery until it bails
+ * with `TS2589: Type instantiation is excessively deep and possibly infinite`,
+ * so the only way to pass the client a host ALREADY HAS was a cast — which is
+ * what the first real consumer had to write (register MRI-D1). Messaging 0.9.0
+ * learned this and wrote it down; this package did not apply the lesson until
+ * now. The rich shape stays the INTERNAL contract, and we narrow to it ONCE,
+ * here, in-package.
+ */
+
+/** The schema. Meet is never in `public`. */
+declare const MEET_SCHEMA = "communication";
+declare const TABLES: {
+    readonly meetings: "meet_meetings";
+    readonly participants: "meet_participants";
+    readonly invites: "meet_call_invites";
+    readonly recordings: "meet_recordings";
+    readonly transcripts: "meet_transcript_segments";
+    readonly notes: "meet_notes";
+    /** Wave 1 (0.8): who a meeting was sent to, and what they answered. */
+    readonly invitees: "meet_invitees";
+    /** Wave 1 (0.8): one occurrence of a series cancelled or moved. */
+    readonly occurrenceOverrides: "meet_occurrence_overrides";
+};
+declare const RPCS: {
+    /** Atomic: create the invite row and stamp its expiry in one statement. */
+    readonly createCallInvite: "meet_create_call_invite";
+    /** Atomic settle. Refuses a transition out of a terminal state. */
+    readonly settleCallInvite: "meet_settle_call_invite";
+    /** Every invite still ringing this user — the reconnect backfill door. */
+    readonly pendingCallInvites: "meet_pending_call_invites";
+    /** Instant meeting, or the durable one behind a recurring link. */
+    readonly getOrCreateMeeting: "meet_get_or_create_meeting";
+    /** Resolve a durable public link, before/during/after its scheduled time. */
+    readonly meetingBySlug: "meet_meeting_by_slug";
+    readonly admit: "meet_admit_participant";
+    readonly setLock: "meet_set_lock";
+    readonly endMeeting: "meet_end_meeting";
+    readonly recordConsent: "meet_record_consent";
+    /** Schedule with every setting at create; unset settings come from the knobs. */
+    readonly scheduleMeeting: "meet_schedule_meeting";
+    /** Edit / reschedule — a JSON patch with a version compare-and-swap. */
+    readonly updateMeeting: "meet_update_meeting";
+    /** Cancel is a state (`cancelled_at`); the link keeps resolving. */
+    readonly cancelMeeting: "meet_cancel_meeting";
+    /** Archive (soft delete) — the invitations and exceptions cascade. */
+    readonly archiveMeeting: "meet_archive_meeting";
+    readonly restoreMeeting: "meet_restore_meeting";
+    /** Cancel, move or restore ONE occurrence of a series by its original start. */
+    readonly setOccurrence: "meet_set_occurrence";
+    readonly addInvitees: "meet_add_invitees";
+    readonly setInviteeRole: "meet_set_invitee_role";
+    readonly removeInvitee: "meet_remove_invitee";
+    /** A signed-in invitee answers for themselves. */
+    readonly respond: "meet_respond";
+    /** The emailed RSVP link (no account): read and answer. */
+    readonly invitationByToken: "meet_invitation_by_token";
+    readonly respondByToken: "meet_respond_by_token";
+    /** One meeting's occurrences between two instants (INVOKER — the reader's RLS). */
+    readonly meetingOccurrences: "meet_meeting_occurrences";
+    /** Every occurrence the reader can see between two instants — the Upcoming list. */
+    readonly occurrencesBetween: "meet_occurrences_between";
+    /** The recordings library. */
+    readonly myRecordings: "meet_my_recordings";
+    /** Titles, agendas, current notes and final transcript lines; snippets mark hits with ⟦ ⟧. */
+    readonly search: "meet_search";
+};
+type Row = Record<string, unknown>;
+interface CreateCallInviteInput {
+    readonly roomName: RoomName;
+    readonly mode: CallMode;
+    readonly callerUserId: UserId;
+    readonly callerName: string;
+    readonly callerAvatarUrl: string | null;
+    readonly calleeUserIds: readonly UserId[];
+    readonly organizationId: OrganizationId;
+    readonly conversationId: string | null;
+    readonly expiresAt: string;
+}
+interface CreateMeetingInput {
+    readonly organizationId: OrganizationId;
+    readonly hostUserId: UserId;
+    readonly title: string;
+    readonly kind: MeetingKind;
+    readonly scheduledFor?: string | null;
+    readonly scheduledDurationMinutes?: number | null;
+    readonly lobbyEnabled?: boolean;
+    readonly recordingPolicy?: RecordingPolicy;
+    readonly aiEnabled?: boolean;
+    /** Reuse a durable slug (a recurring meeting keeps ONE link — R3). */
+    readonly slug?: string | undefined;
+}
+interface MeetRepository {
+    readonly schema: string;
+    readonly tables: typeof TABLES;
+    projectInvite(row: Row): CallInvite;
+    projectMeeting(row: Row): MeetingRecord;
+    createCallInvite(input: CreateCallInviteInput): Promise<CallInvite>;
+    settleCallInvite(id: CallId, state: CallState, declineMessage: string | null): Promise<CallInvite>;
+    pendingInvites(userId: UserId): Promise<readonly CallInvite[]>;
+    getOrCreateMeeting(input: CreateMeetingInput): Promise<MeetingRecord>;
+    meetingBySlug(slug: string): Promise<MeetingRecord>;
+    meeting(id: MeetingId): Promise<MeetingRecord>;
+    /**
+     * Keyset paged, `(scheduled_for, id)`. Every meeting the person can access, in
+     * ALL their organizations — `organizationId` is an OPTIONAL page filter
+     * (absent/null = all organizations), never the active organization
+     * (active-org-is-never-a-list-filter.md). Access is decided by RLS.
+     */
+    listMeetings(args: {
+        organizationId?: OrganizationId | null;
+        limit?: number;
+        before?: {
+            scheduledFor: string;
+            id: MeetingId;
+        } | null;
+    }): Promise<{
+        readonly items: readonly MeetingRecord[];
+        readonly hasMore: boolean;
+    }>;
+    admit(args: {
+        meetingId: MeetingId;
+        identity: string;
+        admitted: boolean;
+        byUserId: UserId;
+    }): Promise<void>;
+    setLock(meetingId: MeetingId, locked: boolean, byUserId: UserId): Promise<MeetingRecord>;
+    endMeeting(meetingId: MeetingId, byUserId: UserId): Promise<MeetingRecord>;
+    projectSegment(row: Row): TranscriptSegment;
+    projectNote(row: Row): MeetingNote;
+    /** One `meet_recordings` row, however it arrived (row or room packet). */
+    projectRecording(row: Row): RecordingRecord;
+    /** One durable `meet_participants` row — attendance, and the lobby queue. */
+    projectAttendee(row: Row): MeetingAttendee;
+    projectAttendee(row: Row): MeetingAttendee;
+    /**
+     * WHO ATTENDED, oldest arrival first. Everyone the meeting ever admitted —
+     * including the note-taker, which is a labelled participant and never a hidden
+     * listener (R4) — so the record can say who was in the room AND that it was
+     * transcribed.
+     */
+    attendees(meetingId: MeetingId): Promise<readonly MeetingAttendee[]>;
+    /**
+     * THE DURABLE TRANSCRIPT (D16). Final rows only — the table holds nothing
+     * else — oldest first, capped so a four-hour meeting cannot hand a surface
+     * fifty thousand rows in one read.
+     */
+    transcript(meetingId: MeetingId, limit?: number): Promise<readonly TranscriptSegment[]>;
+    /** Live notes, decisions, action items and the wrap-up summary, oldest first. */
+    notes(meetingId: MeetingId): Promise<readonly MeetingNote[]>;
+    /** R5: consent is RECORDED, not assumed. One row per participant per recording. */
+    recordConsent(args: {
+        meetingId: MeetingId;
+        identity: string;
+        acknowledgedAt: string;
+    }): Promise<void>;
+    recordings(meetingId: MeetingId): Promise<readonly RecordingRecord[]>;
+    /** Meet wave 3: every recording of the reader's own meetings, newest first. */
+    myRecordings(args?: {
+        includeArchived?: boolean;
+        limit?: number;
+    }): Promise<readonly LibraryRecording[]>;
+    /** Meet wave 3: search the reader's own meetings. */
+    searchMeetings(query: string, limit?: number): Promise<readonly MeetingSearchHit[]>;
+    /** Meet wave 3: name a recording (`null` = back to the meeting's title and date). */
+    renameRecording(recordingId: string, title: string | null): Promise<void>;
+    /** Meet wave 3: archive (soft delete) or restore a recording. Never a purge. */
+    setRecordingArchived(recordingId: string, archived: boolean): Promise<void>;
+    scheduleMeeting(input: ScheduleMeetingInput): Promise<MeetingRecord>;
+    /** `expectedVersion` from the row you edited; a stale one is a `conflict`. */
+    updateMeeting(meetingId: MeetingId, changes: MeetingChanges, options?: {
+        expectedVersion?: number | null;
+        byUserId?: UserId | null;
+    }): Promise<MeetingRecord>;
+    cancelMeeting(meetingId: MeetingId, reason: string | null, byUserId?: UserId | null): Promise<MeetingRecord>;
+    archiveMeeting(meetingId: MeetingId, byUserId?: UserId | null): Promise<MeetingRecord>;
+    restoreMeeting(meetingId: MeetingId, byUserId?: UserId | null): Promise<MeetingRecord>;
+    setOccurrence(args: {
+        meetingId: MeetingId;
+        originalStart: string;
+        action: "cancel" | "move" | "restore";
+        newStart?: string | null;
+        newDurationMinutes?: number | null;
+        reason?: string | null;
+        byUserId?: UserId | null;
+    }): Promise<OccurrenceOverride>;
+    meetingOccurrences(meetingId: MeetingId, range: {
+        from: string;
+        to: string;
+        limit?: number;
+    }): Promise<readonly MeetingOccurrence[]>;
+    /** The Upcoming list: every occurrence the reader may see. `organizationId` FILTERS; RLS decides. */
+    occurrencesBetween(range: {
+        from: string;
+        to: string;
+        organizationId?: OrganizationId | null;
+        limit?: number;
+    }): Promise<readonly UpcomingOccurrence[]>;
+    invitees(meetingId: MeetingId): Promise<readonly MeetingInvitee[]>;
+    addInvitees(meetingId: MeetingId, people: readonly InviteeInput[], byUserId?: UserId | null): Promise<readonly MeetingInvitee[]>;
+    setInviteeRole(inviteeId: string, role: InviteeRole, byUserId?: UserId | null): Promise<MeetingInvitee>;
+    removeInvitee(inviteeId: string, byUserId?: UserId | null): Promise<MeetingInvitee>;
+    respond(meetingId: MeetingId, answer: RsvpAnswer, note?: string | null): Promise<MeetingInvitee>;
+    invitationByToken(secret: string): Promise<RsvpInvitation>;
+    respondByToken(secret: string, answer: RsvpAnswer, note?: string | null): Promise<RsvpInvitation>;
+    projectInvitee(row: Row): MeetingInvitee;
+}
+interface ScheduleMeetingInput {
+    readonly organizationId: OrganizationId;
+    readonly hostUserId: UserId;
+    readonly title: string;
+    readonly scheduledFor: string | null;
+    /** IANA zone, e.g. `America/Los_Angeles`. The wall-clock time a series keeps across DST. */
+    readonly timeZone: string;
+    /** Omit to use the person's `meet.default_duration_minutes`. */
+    readonly durationMinutes?: number | null | undefined;
+    readonly agenda?: string | null | undefined;
+    /** RRULE subset: FREQ=DAILY|WEEKLY|MONTHLY, INTERVAL, BYDAY, BYMONTHDAY, COUNT, UNTIL. */
+    readonly recurrenceRule?: string | null | undefined;
+    readonly settings?: MeetingSettings | undefined;
+}
+interface RepositoryOptions {
+    /**
+     * Any Supabase client. Deliberately the SHALLOW public shape — pass the
+     * `SupabaseClient<Database>` you already have, with no cast. See the header.
+     */
+    client: MessagingSupabaseClient;
+    /** Resolve a session; used to retry ONCE across the sign-in gap. */
+    session?: (() => Promise<unknown>) | undefined;
+}
+/**
+ * 🚨 THE PROJECTIONS ARE MODULE-LEVEL AND EXPORTED, DELIBERATELY (MRI-A12).
+ *
+ * A durable Meet row reaches a client on one of two transports: as a
+ * `meet_notes` / `meet_transcript_segments` row over Postgres Changes, which
+ * needs a Supabase session and an org grant, or as a `matrx.meet.*` packet on
+ * the LiveKit data plane, which needs only the room token — and is therefore the
+ * ONLY one a session-less guest can receive (MRI-A10 settled that `anon` never
+ * gets a grant on an org-scoped table).
+ *
+ * Both carry the same row. If each transport projected it with its own function,
+ * a guest and a member would render the same meeting differently the first time
+ * the two drifted. So there is one function per row shape, it takes no client,
+ * and `core/room-events.ts` calls exactly these.
+ */
+declare function projectSegment(row: Row): TranscriptSegment;
+declare function projectNote(row: Row): MeetingNote;
+declare function projectInvitee(row: Row): MeetingInvitee;
+declare function projectOccurrence(row: Row): MeetingOccurrence;
+declare function projectUpcoming(row: Row): UpcomingOccurrence;
+declare function projectOverride(row: Row): OccurrenceOverride;
+/** The jsonb the RSVP doors return, typed. A body that is neither shape is refused loudly. */
+declare function projectRsvpInvitation(body: unknown): RsvpInvitation;
+/** Settings → the door's snake_case object, carrying ONLY what was set. */
+declare function settingsPatch(settings: MeetingSettings): Record<string, unknown>;
+/**
+ * A partial edit → the `meet_update_meeting` patch. `undefined` = leave alone,
+ * `null` = clear — the difference a JSON patch exists to carry.
+ */
+declare function changesPatch(changes: MeetingChanges): Record<string, unknown>;
+declare function createMeetRepository(options: RepositoryOptions): MeetRepository;
+/** One row of the recordings library (`meet_my_recordings`). */
+interface LibraryRecording {
+    readonly id: string;
+    readonly meetingId: MeetingId;
+    readonly meetingTitle: string;
+    readonly meetingSlug: string;
+    /** The reader's strongest role on the meeting. */
+    readonly role: "host" | "cohost" | "invitee" | "attendee";
+    readonly state: RecordingState;
+    /** A name a host gave it; null = show the meeting title. */
+    readonly title: string | null;
+    readonly fileId: string | null;
+    readonly startedAt: string | null;
+    readonly endedAt: string | null;
+    readonly durationMs: number | null;
+    readonly sizeBytes: number | null;
+    readonly failureReason: string | null;
+    readonly archivedAt: string | null;
+    readonly organizationId: OrganizationId;
+}
+declare function projectLibraryRecording(row: Row): LibraryRecording;
+/** Where a search hit was found. */
+type MeetingSearchSource = "title" | "summary" | "decision" | "action_item" | "note" | "transcript";
+/** One hit from `meet_search`. `snippet` marks matched words with ⟦ ⟧. */
+interface MeetingSearchHit {
+    readonly meetingId: MeetingId;
+    readonly meetingTitle: string;
+    readonly meetingSlug: string;
+    readonly meetingAt: string | null;
+    readonly source: MeetingSearchSource;
+    /** The note or transcript segment id (the meeting id for a title hit). */
+    readonly refId: string;
+    readonly speaker: string | null;
+    readonly snippet: string;
+    /** When it was said / written. */
+    readonly at: string | null;
+    readonly rank: number;
+}
+declare function projectSearchHit(row: Row): MeetingSearchHit;
+/** A snippet split into plain and matched runs, for highlighting without HTML. */
+declare function snippetRuns(snippet: string): readonly {
+    readonly text: string;
+    readonly hit: boolean;
+}[];
+
+/**
+ * THE CALL CENTER — ringing, answering, and the six ways a call ends badly.
+ *
+ * A call reaches you on whatever surface you are on (R2), which is why this is
+ * mounted by the provider and not by a call page. It is also why delivery is
+ * DUAL by design, not by belt-and-braces nervousness:
+ *
+ * - **The durable leg** is the invite ROW plus its Postgres Changes event. It
+ *   survives a reload, a late-joining tab, and a dropped socket, and it is what
+ *   makes a missed call a fact rather than a lost packet.
+ * - **The instant leg** is a broadcast on the callee's user channel, which
+ *   arrives without a database round trip.
+ *
+ * Both are deduplicated on the invite id, so a call rings ONCE however it
+ * arrives. Neither is a fallback for the other: removing the durable leg loses
+ * calls, and removing the instant leg makes ringing feel slow.
+ *
+ * 🚨 THE FOUR RULES THAT MAKE RINGING SURVIVABLE
+ *
+ * 1. **A ring always ends.** Every outgoing call arms a timeout that writes
+ *    `missed`. A ring with no terminal state is a phone that never stops.
+ * 2. **Answering on one device stops every other.** The `settled` signal on
+ *    your OWN user channel silences the other tabs. Without it, answering on a
+ *    laptop leaves a phone ringing in the room.
+ * 3. **Busy is answered, not ignored.** Being in an active call auto-declines
+ *    with `busy`, so the caller learns something instead of ringing out.
+ * 4. **The state machine is a MACHINE.** Transitions are validated: a
+ *    `declined` call cannot become `active` because a late accept arrived.
+ */
+
+declare function canTransition(from: CallState, to: CallState): boolean;
+interface CallCenterOptions {
+    manager: RealtimeManager;
+    repository: MeetRepository;
+    store: MeetStore;
+    identity: MeetIdentity;
+    /** Ring for this long before the call is `missed`. Org knob, not a constant. */
+    ringTimeoutMs?: number | undefined;
+    onIncoming?: ((invite: CallInvite) => void) | undefined;
+    onSettled?: ((invite: CallInvite) => void) | undefined;
+    onDiagnostic?: ((event: {
+        level: "info" | "warn" | "error";
+        message: string;
+        remedy?: string;
+    }) => void) | undefined;
+    timers?: {
+        setTimeout: (run: () => void, ms: number) => unknown;
+        clearTimeout: (handle: unknown) => void;
+        now: () => number;
+    };
+}
+interface CallCenter {
+    /** Subscribe to this user's calling channel. Call once, from the provider. */
+    start(): Promise<void>;
+    /** Ring someone. Returns the invite the UI shows as "calling…". */
+    call(args: {
+        people: readonly UserId[];
+        mode: CallMode;
+        conversationId?: string | undefined;
+    }): Promise<CallInvite>;
+    accept(id: CallId, mode: CallMode): Promise<CallInvite>;
+    decline(id: CallId, message?: string): Promise<CallInvite>;
+    cancel(id: CallId): Promise<CallInvite>;
+    /** Every invite currently ringing this device. */
+    incoming(): readonly CallInvite[];
+    outgoing(): CallInvite | null;
+    /** Feed a ring that arrived through another path (a messaging action chip). */
+    ingest(invite: CallInvite): void;
+    dispose(): void;
+}
+declare function createCallCenter(options: CallCenterOptions): CallCenter;
+
+/**
+ * THE MEET CHANNEL NAMESPACES.
+ *
+ * Zero hand-rolled `.channel(` in this package (the realtime doctrine). Every
+ * topic is declared through `@ai-matrx/realtime`'s registry, which refuses a
+ * colliding re-declaration.
+ *
+ * THREE channels, each because it has a different AUDIENCE:
+ *
+ * - `meet-user` (per user): where a call REACHES you — the ring, the cancel,
+ *   the "answered on another device". You are subscribed to this everywhere the
+ *   provider is mounted, whether or not you are in a meeting.
+ * - `meet-room` (per room): the pre-media room — who is knocking, who was
+ *   admitted, whether recording started. It carries the moments that happen
+ *   BEFORE and AFTER media, which LiveKit's own data plane cannot: a guest in
+ *   the lobby is not in the LiveKit room yet, by construction (D6).
+ * - `meet-meeting` (per meeting): the durable record's feed — transcript
+ *   segments, notes, the recording row going `available` — so a surface that is
+ *   NOT in the call (a meeting page, an admin console) stays live.
+ *
+ * 🚨 The in-MEDIA control plane (hand raise, reactions, in-room chat) rides
+ * LiveKit data messages, NOT these channels — see `DATA_TOPICS`. Splitting them
+ * this way is deliberate: anything that must reach a guest with no Supabase
+ * session travels on the media plane, where their room token is the authority.
+ */
+
+declare function userTopic(userId: UserId): string;
+declare function roomTopic(roomName: RoomName): string;
+declare function meetingTopic(meetingId: MeetingId): string;
+/** Broadcast event names. One place, so a sender and a receiver cannot drift. */
+declare const MEET_EVENTS: {
+    /** A call is ringing you. Carries the whole invite; no follow-up read. */
+    readonly ring: "mx.call.ring";
+    /** The caller hung up before you answered. */
+    readonly cancel: "mx.call.cancel";
+    /** You answered (or declined) on another device. Stop ringing here. */
+    readonly settled: "mx.call.settled";
+    /** Someone is in the lobby. Hosts render the knock. */
+    readonly knock: "mx.lobby.knock";
+    /** A host decided. The knocker learns it here — they have no DB read. */
+    readonly admission: "mx.lobby.admission";
+    /** The room was locked or unlocked. */
+    readonly lock: "mx.room.lock";
+    /** Recording started or stopped. EVERY participant renders the indicator. */
+    readonly recording: "mx.room.recording";
+};
+/**
+ * 🚨 `mx.meeting.transcript` and `mx.meeting.note` WERE declared here and
+ * emitted and subscribed by nothing — a broadcast fallback that existed only as
+ * a name (MRI-A10 found it; feedback `b25db4d4`). They are gone. The thing they
+ * described is real now and lives somewhere better: the platform publishes the
+ * durable rows into the LIVEKIT ROOM under `matrx.meet.*` (`core/room-events.ts`,
+ * MRI-A12), where a session-less guest's room token is the authority. Sending
+ * them over a Supabase broadcast channel would have required the guest to hold a
+ * Supabase connection, which is the exact thing they do not have.
+ */
+type MeetEvent = (typeof MEET_EVENTS)[keyof typeof MEET_EVENTS];
+
+/**
+ * THE PLATFORM'S OWN VOICE IN THE ROOM — and the ONLY live feed a guest has.
+ *
+ * 🚨 **Why this file exists.** Everything durable a meeting produces — a live
+ * note, a decision, an action item, the note-taker's state, the ending — lands
+ * in `communication.meet_*`, and a signed-in member learns about it over
+ * Postgres Changes. A GUEST cannot: `anon` holds no SELECT grant on
+ * `meet_notes`, `meet_transcript_segments` or `meet_participants`, and MRI-A10
+ * settled that widening it is forbidden, because those are org-scoped tables and
+ * a meeting link is not org membership. A guest's authority is the ROOM TOKEN.
+ * So the platform publishes the same rows into the room, where the token is the
+ * authorization, and this file turns those packets into exactly the same store
+ * calls the database path makes.
+ *
+ * Three rules hold it together:
+ *
+ * 1. **Same row, same projection, same reducer.** A `matrx.meet.note` packet
+ *    carries a `meet_notes` row and is projected by `projectNote` — the very
+ *    function the Postgres Changes handler uses — then handed to
+ *    `store.upsertNote`. A guest and a member therefore converge on one code
+ *    path rather than on two implementations that agree until they don't.
+ * 2. **Keyed by the row id, so both copies are one thing.** A member receives
+ *    every note TWICE. They render once because the id is the row's id on both
+ *    transports, and where the two could disagree the database wins
+ *    (`store.upsertNote`'s precedence rule, D16).
+ * 3. **`matrx.meet.*` is the server's namespace and nothing else's.** LiveKit
+ *    does not validate a data packet's sender, so any participant could publish
+ *    any bytes under any topic. What makes these trustworthy is that publishing
+ *    them requires a `roomAdmin` grant, which only the server's own control
+ *    token carries — a participant token cannot claim it. The in-room control
+ *    plane participants DO publish (hand, reaction, chat) lives under `mx.*`
+ *    and is handled separately, precisely so the two can never be confused.
+ */
+
+/**
+ * The server's namespace. Pinned against `aidream/services/meet/livekit.py`'s
+ * `ROOM_EVENT_PREFIX` — a rename on either side must break a named test here.
+ */
+declare const ROOM_EVENT_PREFIX = "matrx.meet.";
+declare const ROOM_EVENTS: {
+    /** One durable `meet_notes` row was written. Payload `{ note: <row> }`. */
+    readonly note: "matrx.meet.note";
+    /** `meet_meetings.metadata.note_taker` changed. Payload `{ meeting_id, note_taker }`. */
+    readonly noteTaker: "matrx.meet.note_taker";
+    /** A wrap-up pass finished. Payload `{ meeting_id, note_ids, segment_count }`. */
+    readonly wrapUp: "matrx.meet.wrap_up";
+    /** The meeting ended for everyone. Payload `{ meeting_id, ended_at, trigger }`. */
+    readonly ended: "matrx.meet.ended";
+    /**
+     * A `meet_recordings` row changed state. Payload
+     * `{ meeting_id, recording: { id, state, started_by } }`.
+     *
+     * 🚨 THIS IS THE ONLY WAY A GUEST LEARNS A RECORDING IS RUNNING. PreJoin
+     * promises every joiner an indicator, and `anon` holds no SELECT grant on
+     * `meet_recordings` (MRI-A10 settled that widening it is forbidden), so
+     * without this packet the promise was a sentence with nothing behind it: on
+     * production 2026-09-09 the guest lane showed no indicator at all while the
+     * host recorded (MRI-C8).
+     */
+    readonly recording: "matrx.meet.recording";
+    /**
+     * A chat message to everyone was SAVED (Meet wave 2). Payload
+     * `{ message: { id, meeting_id, sender_identity, sender_name, body, created_at } }`.
+     */
+    readonly chat: "matrx.meet.chat";
+    /**
+     * A host or co-host acted (Meet wave 2). Payload `{ meeting_id, kind, … }`:
+     * `muted {source, by}` · `ask-unmute {by}` · `removed {by}` — addressed to the
+     * person concerned; `lower-hands {identities: [...] | "*"}` · `role {identity,
+     * role}` — to everyone.
+     */
+    readonly moderation: "matrx.meet.moderation";
+    /**
+     * A meeting ROOM ITEM changed (Meet wave 5): a poll, a Q&A question, a whiteboard
+     * stroke or the breakout plan. Payload `{ meeting_id, item }` · `{ removed: [ids] }` ·
+     * `{ hidden: [ids] }` · `{ cleared: "whiteboard" }` · `{ broadcast }` · `{ item, move }`.
+     * A host's fuller copy of a poll or question carries `audience: "hosts"`.
+     */
+    readonly collab: "matrx.meet.collab";
+};
+type RoomEventTopic = (typeof ROOM_EVENTS)[keyof typeof ROOM_EVENTS];
+declare function isRoomEventTopic(topic: string): boolean;
+/**
+ * What happened to one packet. Returned rather than logged from inside, so the
+ * room engine can report a drop with its own diagnostic channel and a test can
+ * assert on it — a packet that is silently ignored is indistinguishable from
+ * one that never arrived, which is the failure this whole item is about.
+ */
+interface RoomEventOutcome {
+    readonly handled: boolean;
+    /** Present when `handled` is false. Says what was wrong, in a sentence. */
+    readonly ignored?: string;
+}
+interface ApplyRoomEventArgs {
+    readonly store: MeetStore;
+    readonly topic: string;
+    /** The packet's already-parsed JSON body. */
+    readonly payload: unknown;
+    readonly now?: (() => number) | undefined;
+}
+/**
+ * Apply one `matrx.meet.*` packet to the store. Never throws.
+ *
+ * A malformed packet is DROPPED with a reason, never partially applied: half a
+ * note on a guest's screen is worse than no note, because the guest cannot tell
+ * which half they are missing.
+ */
+declare function applyRoomEvent(args: ApplyRoomEventArgs): RoomEventOutcome;
+
+/**
+ * DEVICE MANAGEMENT — the part users blame the product for.
+ *
+ * Every rule here exists because it is a support ticket somewhere:
+ *
+ * - **Labels are empty until permission is granted.** `enumerateDevices()`
+ *   happily returns three cameras with blank labels before the prompt. A picker
+ *   rendering "Camera 1 / Camera 2" is the classic symptom; we report
+ *   `labelsHidden` so the UI can say *why* instead.
+ * - **A remembered device can vanish.** Unplug a headset between meetings and a
+ *   stored `deviceId` produces `OverconstrainedError`. The manager falls back to
+ *   the system default AND SAYS SO — a silent fallback is how someone joins on
+ *   the laptop mic while believing they are on their headset.
+ * - **Selections persist per KIND, per device.** Injected storage (C10:
+ *   persistence-injected — this package's core purpose is not storage), with a
+ *   memory fallback that announces itself rather than pretending to be durable.
+ * - **Enumeration is repeated on `devicechange`.** A picker that lists what was
+ *   plugged in at mount is wrong within seconds of a headset arriving.
+ */
+type DeviceKind = "audioinput" | "videoinput" | "audiooutput";
+interface MeetDevice {
+    readonly deviceId: string;
+    readonly kind: DeviceKind;
+    readonly label: string;
+}
+interface DeviceSnapshot {
+    readonly devices: Readonly<Record<DeviceKind, readonly MeetDevice[]>>;
+    readonly selected: Readonly<Record<DeviceKind, string | null>>;
+    /** True when the browser is hiding labels because permission was not granted. */
+    readonly labelsHidden: boolean;
+    readonly permission: "unknown" | "granted" | "denied";
+    /** Set when a remembered device was gone and we fell back. Shown, not swallowed. */
+    readonly fallbackNotice: string | null;
+}
+interface DeviceStorage {
+    read(): Record<string, string>;
+    write(value: Record<string, string>): void;
+    readonly durable: boolean;
+}
+interface MediaDevicesLike {
+    enumerateDevices(): Promise<readonly {
+        deviceId: string;
+        kind: string;
+        label: string;
+    }[]>;
+    getUserMedia(constraints: {
+        audio?: unknown;
+        video?: unknown;
+    }): Promise<{
+        getTracks(): readonly {
+            stop(): void;
+        }[];
+    }>;
+    addEventListener?: ((type: "devicechange", handler: () => void) => void) | undefined;
+    removeEventListener?: ((type: "devicechange", handler: () => void) => void) | undefined;
+}
+interface DeviceManagerOptions {
+    media: MediaDevicesLike;
+    storage?: DeviceStorage | undefined;
+    onChange?: ((snapshot: DeviceSnapshot) => void) | undefined;
+}
+interface DeviceManager {
+    /**
+     * 🚨 THE SAME REFERENCE until something actually changes. This is a
+     * `useSyncExternalStore` `getSnapshot` source (see `useDeviceSnapshot`), and
+     * React compares snapshots by IDENTITY: a fresh object literal per call makes
+     * every render report a change, which React reports as *"The result of
+     * getSnapshot should be cached"* and then kills the tree with *"Maximum
+     * update depth exceeded"*. `createMeetStore()` has always held this contract;
+     * 0.2.0 shipped without it here and every room crashed at `<PreJoin>`.
+     */
+    snapshot(): DeviceSnapshot;
+    /** Enumerate without prompting. Labels may be hidden; that is reported. */
+    refresh(): Promise<DeviceSnapshot>;
+    /** Prompt, then enumerate with real labels. The pre-join screen calls this. */
+    requestPermission(kinds: {
+        audio: boolean;
+        video: boolean;
+    }): Promise<DeviceSnapshot>;
+    select(kind: DeviceKind, deviceId: string): DeviceSnapshot;
+    /** The id to actually use — the remembered one, or the default when it is gone. */
+    resolve(kind: DeviceKind): string | null;
+    subscribe(listener: (snapshot: DeviceSnapshot) => void): () => void;
+    dispose(): void;
+}
+/** localStorage when it exists; memory otherwise — and it says which. */
+declare function createWebDeviceStorage(key?: string): DeviceStorage;
+declare function createMemoryDeviceStorage(): DeviceStorage;
+declare function createDeviceManager(options: DeviceManagerOptions): DeviceManager;
+
+/**
+ * PRESENTATION HELPERS specific to a CALL. Pure, tested, and shared by every
+ * surface — so a roster line reads the same in the meeting, in the history
+ * list, and in the notification.
+ *
+ * The GENERIC formatters this file used to define — `formatDuration`,
+ * `getInitials`, `avatarPaletteIndex` — moved to `@ai-matrx/kit/format` on
+ * 2026-09-07 (duplication census H1). They were byte-for-byte duplicated in
+ * `@ai-matrx/messaging`, and because two packages claimed them, ~65 host
+ * twins across six repos had no correct owner to point at: no surface should
+ * take a dependency on the video-calling package to print a duration. Nothing
+ * is re-exported from here — import `@ai-matrx/kit/format` directly.
+ */
+
+/** "Ana, Ben and 3 others" — the roster line, never a raw array join. */
+declare function participantSummary(participants: readonly MeetParticipant[]): string;
+/** What a settled call says in history. One sentence per terminal state. */
+declare function callStateLabel(state: CallState, outgoing: boolean): string;
+/** "2 waiting" for the lobby badge — plural handled once, not per surface. */
+declare function countLabel(count: number, singular: string, plural?: string): string;
+
+/**
+ * THE MESSAGING SEAM — a call invitation is an ACTIONABLE MESSAGE (D8).
+ *
+ * `@ai-matrx/messaging` deliberately knows nothing about meetings; its action
+ * registry exists so packages like this one can add a kind without messaging
+ * learning about them. This file is that registration, and it is the whole
+ * coupling between the two packages.
+ *
+ * Why an invitation is a message and not only a ring: a ring is EPHEMERAL. If
+ * you were away from your desk, a broadcast that expired is gone, and "someone
+ * tried to reach me" is exactly the information you most needed. The message is
+ * the durable half — it is still in the thread tomorrow, with the outcome
+ * stamped on it.
+ *
+ * 🚨 **THE PAYLOAD IS NOT AUTHORIZATION.** The chip's payload says what was
+ * ASKED, never what is ALLOWED. The handler re-resolves the invite through the
+ * repository (an auth-checked RPC) before it joins anything. Trusting the
+ * payload would turn any message anyone can send into a room grant.
+ *
+ * Idempotence is the registry's, not ours: two tabs and a double tap settle
+ * ONCE and share one receipt.
+ */
+
+declare const CALL_INVITE_KIND = "meet.call-invite";
+declare const CALL_INVITE_VERSION = 1;
+interface CallInvitePayload {
+    readonly invite_id: string;
+    readonly room_name: string;
+    readonly mode: CallMode;
+    readonly caller_name: string;
+    readonly expires_at: string;
+}
+/** The `action_data` a caller attaches to the invitation message. */
+declare function callInviteAction(invite: CallInvite): {
+    readonly kind: string;
+    readonly version: number;
+    readonly payload: CallInvitePayload;
+};
+/** The message body. Readable on a surface that cannot render the chips. */
+declare function callInviteText(invite: CallInvite): string;
+interface CallInviteHandlerOptions {
+    calls: CallCenter;
+    repository: MeetRepository;
+    /** Called after a successful accept, with the room to enter. */
+    onJoin: (invite: CallInvite) => void | Promise<void>;
+    now?: (() => number) | undefined;
+}
+declare function createCallInviteHandler(options: CallInviteHandlerOptions): ActionHandler<CallInvitePayload>;
+/**
+ * A meeting invitation — the scheduled twin. Deliberately NOT the same kind: a
+ * scheduled meeting's chip must never say "Join call" three days early, and a
+ * receiver that only understands calls must render NOTHING for it rather than a
+ * button it cannot honor.
+ */
+declare const MEETING_INVITE_KIND = "meet.meeting-invite";
+declare const MEETING_INVITE_VERSION = 1;
+interface MeetingInvitePayload {
+    readonly meeting_id: string;
+    readonly slug: string;
+    readonly title: string;
+    readonly scheduled_for: string | null;
+    readonly link: string;
+}
+declare function meetingInviteAction(payload: MeetingInvitePayload): {
+    readonly kind: string;
+    readonly version: number;
+    readonly payload: MeetingInvitePayload;
+};
+interface MeetingInviteHandlerOptions {
+    onOpen: (payload: MeetingInvitePayload) => void | Promise<void>;
+    now?: (() => number) | undefined;
+}
+declare function createMeetingInviteHandler(options: MeetingInviteHandlerOptions): ActionHandler<MeetingInvitePayload>;
+
+/**
+ * THE STAGE — who is big, who is small, and who is not rendered at all.
+ *
+ * This is pure arithmetic on purpose: layout is the part of a meeting UI that
+ * everyone re-derives inside a component and gets subtly wrong, and it is
+ * trivially testable once it stops living in JSX.
+ *
+ * R5 SCALE HONESTY lives here. A 200-person meeting does not render 200 video
+ * tiles — every browser dies, and LiveKit's adaptive stream cannot save a
+ * layout that asked for 200 subscriptions. The grid PAGES, and the ordering is
+ * deliberate rather than "whatever the roster map iterated":
+ *
+ *   1. a screen share (or an explicit pin) owns the stage;
+ *   2. then the active speakers, most recent first;
+ *   3. then anyone with a hand raised — they are asking to be seen;
+ *   4. then cameras on before cameras off (an avatar tile is cheap);
+ *   5. then stable by join time, so tiles do not shuffle every time someone
+ *      breathes. Shuffling tiles is the single most disorienting thing a
+ *      meeting UI can do.
+ */
+
+interface StageArgs {
+    readonly participants: readonly MeetParticipant[];
+    readonly layout: StageLayout;
+    readonly pinned: ParticipantIdentity | null;
+    readonly activeSpeakers: readonly ParticipantIdentity[];
+    /**
+     * The participant a HOST spotlighted for everyone (Meet wave 2). A local pin
+     * outranks it on this screen; a screen share outranks both.
+     */
+    readonly spotlight?: ParticipantIdentity | null | undefined;
+    /** How many tiles this viewport can honestly render. Default 12. */
+    readonly pageSize?: number;
+    readonly page?: number;
+}
+interface Stage {
+    /** The large tile, when the layout has one. */
+    readonly feature: MeetParticipant | null;
+    /** What actually renders as a tile, already paged. */
+    readonly tiles: readonly MeetParticipant[];
+    /** Everyone not on this page. Rendered as "+N others", never dropped silently. */
+    readonly overflow: number;
+    readonly page: number;
+    readonly pageCount: number;
+    /** True when a screen share, not a person, is the reason for the big tile. */
+    readonly presenting: boolean;
+}
+declare const DEFAULT_PAGE_SIZE = 12;
+declare function orderParticipants(participants: readonly MeetParticipant[], activeSpeakers: readonly ParticipantIdentity[]): readonly MeetParticipant[];
+declare function computeStage(args: StageArgs): Stage;
+/** Column count for a grid of N tiles — the shape that keeps tiles squarest. */
+declare function gridColumns(count: number): number;
+
+/**
+ * THE MEDIA SEAM — the ONE interface the room engine talks to.
+ *
+ * D1/D2: LiveKit Cloud is the media infrastructure, hardcoded. This interface
+ * is NOT a provider abstraction and is not here so a second SFU can be swapped
+ * in — it exists for two reasons that are both about correctness:
+ *
+ * 1. **The engine must be provable without a browser.** Everything expensive in
+ *    a calling product (ring timeouts, reconnection, admission, escalation,
+ *    speaker tracking) is logic, and logic proven only through a real SFU is
+ *    logic that is never proven. `testing/fake-driver.ts` drives every one of
+ *    those paths in a node test.
+ * 2. **The SDK stays out of the initial chunk.** `livekit-client` is reached
+ *    only through a dynamic `import()` inside the default driver, so importing
+ *    this package during SSR — or on a page with a call BUTTON but no call —
+ *    costs nothing and touches no browser API.
+ *
+ * The default implementation ships (`createLiveKitDriver`) and is what
+ * `<MeetProvider>` uses when a host injects nothing (THE ALL-INCLUSIVE LAW).
+ */
+
+/** A participant as the media layer sees them, before roles or profiles. */
+interface DriverParticipant {
+    readonly identity: string;
+    readonly name: string;
+    /** Opaque JSON string the token minted for this participant. */
+    readonly metadata: string | null;
+    /**
+     * The participant's LiveKit attributes. Unlike `metadata` these are set by
+     * the participant itself at run time, which is how the note-taker announces
+     * that a consent notice is owed (D10).
+     */
+    readonly attributes: Readonly<Record<string, string>>;
+    readonly isLocal: boolean;
+    readonly micEnabled: boolean;
+    readonly cameraEnabled: boolean;
+    readonly screenSharing: boolean;
+}
+type DriverConnectionState = "connecting" | "connected" | "reconnecting" | "disconnected";
+type DriverTrackKind = "camera" | "microphone" | "screen";
+/**
+ * ONE LIVE CAPTION off the `lk.transcription` text stream.
+ *
+ * `speakerIdentity` is `lk.transcribed_participant_identity` — WHO IS BEING
+ * TRANSCRIBED, not who published the stream (the note-taker publishes every
+ * one of them). The SFU-reported publisher identity below is independently
+ * checked against the meeting's note-taker; captions remain hints and durable
+ * segments remain the record (D16).
+ */
+interface DriverTranscription {
+    /** `lk.segment_id`. Interim and final share it; that is what makes replacement possible. */
+    readonly segmentId: string;
+    readonly speakerIdentity: string;
+    /**
+     * The LiveKit participant that opened this text stream. Unlike
+     * `speakerIdentity`, this comes from the SFU and is the authority for who
+     * published a caption.
+     */
+    readonly publisherIdentity: string;
+    readonly text: string;
+    /** `lk.transcription_final`. */
+    readonly final: boolean;
+    /** `lk.transcribed_track_id`, when the sender supplied it. */
+    readonly trackId: string | null;
+    readonly at: string;
+}
+interface RoomDriverHandlers {
+    /** The FULL roster, every time. A delta protocol here drifts; a snapshot cannot. */
+    participants(participants: readonly DriverParticipant[]): void;
+    activeSpeakers(identities: readonly string[]): void;
+    quality(identity: string, quality: ConnectionQuality): void;
+    connectionState(state: DriverConnectionState): void;
+    /** In-room data messages: hand raise, reactions, in-room chat, AI events. */
+    data(topic: string, payload: string, fromIdentity: string | null): void;
+    /** A live caption. Interim and final both arrive here (D16). */
+    transcription(event: DriverTranscription): void;
+    /** The room ended for this client. `reason` is shown to the user verbatim. */
+    disconnected(reason: string | null): void;
+    /**
+     * The ROOM's metadata — set only by the server (`UpdateRoomMetadata`), and
+     * delivered to every joiner ON JOIN, which is why the spotlight rides it: a
+     * data packet reaches only the people already in the room. Called once after
+     * connect and on every change. Optional so an older host driver still works.
+     */
+    roomMetadata?(metadata: string): void;
+}
+/** A camera background effect. `image` replaces the background with `imageUrl`. */
+type VideoEffect = {
+    readonly kind: "none";
+} | {
+    readonly kind: "blur";
+    readonly radius?: number;
+} | {
+    readonly kind: "image";
+    readonly imageUrl: string;
+};
+/** Microphone processing the browser applies before anything is sent. */
+interface AudioProcessing {
+    readonly noiseSuppression: boolean;
+    readonly echoCancellation: boolean;
+    readonly autoGainControl: boolean;
+}
+interface MeetRoomDriver {
+    connect(serverUrl: string, token: string): Promise<void>;
+    disconnect(): Promise<void>;
+    setMicrophoneEnabled(enabled: boolean): Promise<void>;
+    setCameraEnabled(enabled: boolean): Promise<void>;
+    setScreenShareEnabled(enabled: boolean): Promise<void>;
+    /**
+     * Reliable, topic-addressed data. The in-room control plane. `to` addresses
+     * named identities only (a private chat message); absent = everyone.
+     */
+    publishData(topic: string, payload: string, to?: readonly string[]): Promise<void>;
+    /**
+     * Apply microphone processing to the live track and to every future one.
+     * Optional: a driver without it makes the control ABSENT, never dead.
+     */
+    setAudioProcessing?(processing: AudioProcessing): Promise<void>;
+    /**
+     * Apply a background effect to the live camera and to every future one.
+     * Rejects with a sentence when this browser cannot run it.
+     */
+    setVideoEffect?(effect: VideoEffect): Promise<void>;
+    /** Whether this browser can run background effects at all. */
+    supportsVideoEffects?(): boolean;
+    /** Whether this browser can share a screen at all (iOS cannot). Absent = assume yes. */
+    supportsScreenShare?(): boolean;
+    /**
+     * Attach a participant's track to a media element. Returns the detach
+     * function — returning it (rather than exposing `detach`) is what makes a
+     * leaked attachment impossible from the React side: the effect's cleanup IS
+     * the return value.
+     */
+    attach(identity: string, kind: DriverTrackKind, element: HTMLMediaElement): () => void;
+    /** The device the driver actually selected, so the UI never lies about it. */
+    activeDevices(): Readonly<Record<"audioinput" | "videoinput" | "audiooutput", string | null>>;
+    switchDevice(kind: "audioinput" | "videoinput" | "audiooutput", deviceId: string): Promise<void>;
+}
+type RoomDriverFactory = (handlers: RoomDriverHandlers) => MeetRoomDriver | Promise<MeetRoomDriver>;
+/** Topics for the in-room control plane. One place, so senders cannot drift. */
+declare const DATA_TOPICS: {
+    readonly hand: "mx.hand";
+    readonly reaction: "mx.reaction";
+    readonly chat: "mx.chat";
+};
+/**
+ * 🚨 `mx.ai.note` and `mx.ai.transcript` WERE declared here and emitted by
+ * nothing. They are gone (MRI-A12): the platform's own events are published by
+ * the SERVER under `matrx.meet.*` — see `core/room-events.ts` — because a packet
+ * a participant could publish is a packet a guest could forge, and these carry
+ * durable rows. A participant topic for the same thing would be a second,
+ * unauthenticated way to say it.
+ */
+type DataTopic = (typeof DATA_TOPICS)[keyof typeof DATA_TOPICS];
+/**
+ * THE LIVEKIT TRANSCRIPTION CONTRACT — not ours, so it is written down once
+ * rather than spelled inline. The topic and these four attribute names are the
+ * SDK's own (`lk.*`); the worker publishes to exactly them (MRI-A2) and a
+ * rename on either side must break here, loudly, in one place.
+ */
+declare const TRANSCRIPTION_TOPIC = "lk.transcription";
+declare const TRANSCRIPTION_ATTRIBUTES: {
+    readonly segmentId: "lk.segment_id";
+    readonly trackId: "lk.transcribed_track_id";
+    readonly final: "lk.transcription_final";
+    /**
+     * WHO IS BEING TRANSCRIBED. The LiveKit JS client reports the PUBLISHER of a
+     * text stream, and the publisher is always the note-taker — so a caption
+     * carries the speaker in this attribute and falls back to the publisher only
+     * when it is absent (which attributes the line to the agent, visibly, rather
+     * than to the wrong person, silently).
+     */
+    readonly speakerIdentity: "lk.transcribed_participant_identity";
+};
+
+/**
+ * THE ONE PLACE `livekit-client` IS TOUCHED.
+ *
+ * Everything above this file talks to `MeetRoomDriver`. That containment is
+ * what lets the engine's whole behavior — ring timeouts, admission, escalation,
+ * reconnection — be proven in a node test, and it is why an SDK upgrade is a
+ * single-file review rather than a package-wide audit.
+ *
+ * 🚨 **THE IMPORT IS DYNAMIC, DELIBERATELY.** `import type` is erased, and the
+ * runtime `await import("livekit-client")` happens inside `connect()`. So:
+ * importing `@ai-matrx/meet` during SSR, or on a page that renders a call
+ * BUTTON but never a call, pulls in none of the media SDK and touches no
+ * browser API (independence contract §4). A static import here would put ~400KB
+ * of WebRTC into every consumer's first load and break RSC rendering.
+ *
+ * The mapping helpers below are exported for their own tests: an SDK enum
+ * renamed upstream must fail a named test, not silently become "unknown" on
+ * every tile.
+ */
+
+/**
+ * LiveKit's quality enum → ours. Mapped explicitly rather than cast: the SDK
+ * has five states and our UI has five sentences, and an unmapped one must
+ * degrade to `unknown` (an honest "we don't know") rather than to `excellent`
+ * (a lie that hides a failing call).
+ */
+declare function mapQuality(quality: ConnectionQuality$1 | string): ConnectionQuality;
+declare function mapConnectionState(state: string): DriverConnectionState;
+/**
+ * A LiveKit participant → our snapshot.
+ *
+ * 🚨 `name` IS REPORTED EXACTLY AS LIVEKIT GAVE IT, empty string and all
+ * (MRI-A18). Through 0.4.12 it fell back to the identity here, which meant a
+ * driver — the thing furthest from any screen — invented a "name" that
+ * `core/names.ts` then had to recognize and refuse. A driver reports; it does
+ * not name. The one fallback lives in `projectParticipant`, and it is the name
+ * book's honest placeholder rather than a token.
+ */
+declare function snapshotParticipant(participant: Pick<Participant, "identity" | "name" | "metadata" | "isMicrophoneEnabled" | "isCameraEnabled" | "isScreenShareEnabled"> & {
+    attributes?: Readonly<Record<string, string>> | undefined;
+}, isLocal: boolean): DriverParticipant;
+interface LiveKitDriverOptions {
+    /** Adaptive stream + dynacast default ON — R5 scale honesty, not a knob. */
+    roomOptions?: RoomOptions | undefined;
+}
+declare function createLiveKitDriver(handlers: RoomDriverHandlers, options?: LiveKitDriverOptions): MeetRoomDriver;
+
+/**
+ * MEETINGS — the lobby, the host powers, and the durable link.
+ *
+ * A meeting is a room plus scheduling, lobby and host metadata (D3). Everything
+ * here is about the moments OUTSIDE the media session, which is exactly why it
+ * cannot ride LiveKit's data plane: a guest waiting in the lobby is not in the
+ * LiveKit room yet, by construction. The lobby therefore lives on the meet-room
+ * realtime channel.
+ *
+ * 🚨 THE THREE THINGS THAT MAKE GUEST JOIN SAFE (D6)
+ *
+ * 1. **The link is an identity, not a session.** A durable slug resolves before,
+ *    during, and after the scheduled time, and a recurring meeting keeps ONE
+ *    link. Nothing here mints a per-occurrence URL.
+ * 2. **A guest's capability is the TOKEN, and nothing else.** They are scoped to
+ *    exactly one room. There is no guest row this client writes that could grant
+ *    anything, and no client-side "is this person allowed" branch.
+ * 3. **Admission is a SERVER decision, recorded.** `admit` is an RPC; the
+ *    broadcast that tells the knocker is a NOTIFICATION of that decision, never
+ *    the decision itself. Two hosts clicking admit is the ordinary case, and the
+ *    RPC is what makes it idempotent.
+ *
+ * Host powers are checked against the role the SERVER minted into the token
+ * (see `room.ts`), and the UI hides what an actor cannot do rather than
+ * rendering a dead button (no dead ends).
+ */
+
+interface MeetingSessionOptions {
+    manager: RealtimeManager;
+    repository: MeetRepository;
+    store: MeetStore;
+    identity: MeetIdentity;
+    /**
+     * The ONE org-aware aidream client (MRI-A16) — `endForEveryone` is a SERVER
+     * decision (MRI-A6), and every request it makes carries the organization.
+     */
+    api: MeetApi;
+    onDiagnostic?: ((event: {
+        level: "info" | "warn" | "error";
+        message: string;
+        remedy?: string;
+    }) => void) | undefined;
+    /**
+     * 🚨 THE HOST ADMITTED *US*. Called exactly once per admission verdict that
+     * names this participant, and only for `admitted`.
+     *
+     * Admission is not a UI state change: a lobby token is minted with
+     * `canPublish: false` and `canSubscribe: false`, so the waiting room can only
+     * become a room by minting a NEW token. Before this existed the waiting room
+     * said "you will join automatically once you are admitted" and then waited
+     * forever — a sentence on screen that was not true. The provider wires this
+     * to `engine.rejoin()`.
+     */
+    onAdmitted?: (() => void) | undefined;
+    /**
+     * 🚨 THE HOST DENIED *US*. Called once per denial verdict that names this
+     * knocker. Without it the waiting room kept promising "you will join
+     * automatically" to a person the host had already turned away (production
+     * 2026-09-27). The provider wires it to `engine.rejoin()`: the server then
+     * refuses the mint with its own sentence ("The host did not admit you…"),
+     * so the words on screen are the server's decision, never the client's guess.
+     */
+    onDenied?: (() => void) | undefined;
+}
+interface MeetingSession {
+    /** Subscribe to the room's out-of-band plane. Hosts see knocks; guests see verdicts. */
+    watch(roomName: RoomName): void;
+    /**
+     * Subscribe to the MEETING RECORD's durable feed — transcript segments, notes,
+     * and the meeting row itself (which is where the note-taker's state lives).
+     * Reconnecting IS re-reading: the backfill door re-reads all three, because
+     * realtime has no replay and a socket blip would otherwise leave a transcript
+     * permanently missing the minute nobody noticed.
+     */
+    watchMeeting(meetingId: MeetingId): void;
+    /** A guest (or a late arrival at a locked room) announces themselves. */
+    knock(roomName: RoomName): void;
+    admit(entry: LobbyEntry, admitted: boolean): Promise<void>;
+    admitAll(): Promise<void>;
+    setLock(locked: boolean): Promise<MeetingRecord>;
+    /** End it for everyone, through the server (MRI-A6). */
+    endForEveryone(): Promise<EndMeetingResult>;
+    dispose(): void;
+}
+/** Can `actor` moderate `target`? A host outranks a co-host outranks everyone. */
+declare function canModerateParticipant(actor: MeetParticipant | undefined, target: MeetParticipant | undefined): boolean;
+declare function roleOf(participants: readonly MeetParticipant[], identity: ParticipantIdentity | null): ParticipantRole;
+/**
+ * What ending a meeting produced. `served: false` is the honest answer from a
+ * server that has not landed `POST /v1/meet/end` yet (MRI-A6) — the control is
+ * real, the refusal is a sentence, and nothing pretends the meeting ended.
+ */
+interface EndMeetingResult {
+    readonly endedAt: string | null;
+    readonly served: boolean;
+}
+/** The sentence a server without MRI-A6 earns. Pinned so every surface says it. */
+declare const END_MEETING_NOT_SERVED = "Ending a meeting is not available on this server yet";
+declare function createMeetingSession(options: MeetingSessionOptions): MeetingSession;
+declare function meetingSlug(random?: () => number): string;
+/** The link a host copies. ONE shape, so every surface produces the same URL. */
+declare function meetingLink(baseUrl: string, slug: string): string;
+
+/**
+ * RECORDING — LiveKit Egress, host-controlled, consent-enforced (R3/R5).
+ *
+ * 🚨 **CONSENT IS NOT OPTIONAL AND NOT A PROP.** There is no
+ * `showRecordingIndicator={false}`. Recording a person without telling them is
+ * illegal in a two-party-consent jurisdiction and is indefensible everywhere
+ * else, so the indicator and the join-time notice are properties of the
+ * package, not decisions a consumer gets to make. The only knob is the org's
+ * `recordingPolicy` — disabled / host-controlled / always-on — which decides
+ * whether recording may happen at all, never whether people are told.
+ *
+ * 🚨 **THE RECORDING BELONGS TO THE PLATFORM, NOT TO LIVEKIT.** The server
+ * lands the artifact in the platform files system and returns a FILE ID. A
+ * provider URL would be an orphan the day the room is garbage collected — the
+ * reason `RecordingRecord.fileId` is not `url`.
+ *
+ * The client half is small on purpose: start/stop are aidream calls (the API
+ * secret never comes near a browser), and the truth about a recording arrives
+ * from the server's webhook through the room channel. This module never
+ * *guesses* that a recording started.
+ */
+
+interface RecordingControllerOptions {
+    /** The ONE org-aware aidream client (MRI-A16). Owns base url and headers. */
+    api: MeetApi;
+    store: MeetStore;
+    /** Announce the new state to everyone in the room (the indicator is for all). */
+    announce?: ((state: RecordingState, by: UserId | null) => void) | undefined;
+    /** Persist that this participant saw the notice. Consent is RECORDED (R5). */
+    acknowledgeConsent?: ((meetingId: MeetingId) => Promise<void>) | undefined;
+}
+interface RecordingController {
+    /** True when the org policy and the actor's role allow starting a recording. */
+    canStart(meeting: MeetingRecord | null, isHost: boolean): boolean;
+    start(args: {
+        meetingId: MeetingId;
+        roomName: RoomName;
+        by: UserId;
+    }): Promise<void>;
+    stop(args: {
+        meetingId: MeetingId;
+        by: UserId;
+    }): Promise<void>;
+    /** The join-time notice text. One sentence, one place, every surface. */
+    consentNotice(meeting: MeetingRecord | null): string | null;
+    acknowledge(meetingId: MeetingId): Promise<void>;
+}
+declare function createRecordingController(options: RecordingControllerOptions): RecordingController;
+/** The indicator's words. One definition, so no surface invents a softer one. */
+declare function recordingLabel(state: RecordingState): string | null;
+
+/**
+ * THE TOKEN FLOW — the ONLY authorization path into a room (R1).
+ *
+ * 🚨 **THE CLIENT NEVER HOLDS A LIVEKIT SECRET.** Not in an env var, not in a
+ * build-time constant, not "just for local dev". A LiveKit API secret in a
+ * browser bundle mints a token for ANY room in the project, including one the
+ * holder was never invited to — it is a full compromise of every meeting in the
+ * organization. This package therefore has no code path that could accept one:
+ * it asks aidream, and aidream mints.
+ *
+ * Four hard parts live here so no host reimplements them (C22):
+ *
+ * 1. **Single flight.** A React strict-mode double effect, a re-render, and a
+ *    reconnect all ask at once; they share ONE request. Two tokens for one
+ *    identity is not harmless — LiveKit disconnects the older session, which
+ *    looks exactly like "my call randomly drops when I open the tab".
+ * 2. **Expiry is honored BEFORE it bites.** A token is refreshed at 80% of its
+ *    life, not when a reconnect fails at 100%. A meeting that outlives its
+ *    token and cannot reconnect is the classic 2-hour-meeting bug.
+ * 3. **Guests are first-class, not an exception.** A guest has no session and
+ *    the request carries a display name instead; the SERVER decides what a
+ *    guest may do. There is no client-side "is this person allowed" branch.
+ * 4. **A missing session is a lifecycle moment.** Between sign-in and token
+ *    arrival, the fetch retries ONCE after the host's session resolves and then
+ *    reports `session-unavailable` as a warning — never a red error, never a
+ *    retry storm.
+ */
+
+interface RoomToken {
+    readonly token: string;
+    readonly serverUrl: string;
+    readonly roomName: RoomName;
+    readonly identity: ParticipantIdentity;
+    readonly displayName: string;
+    /** ISO. The package refreshes at 80% of the remaining life. */
+    readonly expiresAt: string;
+    /** What the SERVER granted. The client renders from this; it never decides. */
+    readonly canPublish: boolean;
+    readonly canSubscribe: boolean;
+    readonly canRecord: boolean;
+    readonly isHost: boolean;
+    /**
+     * 🚨 THE SERVER'S WORD ON WHO THIS JOINER IS (MRI-A11) — `host`,
+     * `participant` or `guest`, minted from `host_user_id` or a real iam grant.
+     * The same string is minted into the LiveKit token's participant metadata and
+     * its `matrx.participant.role` attribute, so the roster and this response
+     * cannot disagree. A server that predates MRI-A11 sends no role, and the
+     * fallback below reads the older `is_host` boolean rather than pretending.
+     */
+    readonly role: ParticipantRole;
+    /** True when the server put this joiner in the lobby (D6). */
+    readonly lobby: boolean;
+    /**
+     * Meet wave 5: the breakout room this pass is for, or null for the main room. The
+     * pass is still keyed by the MEETING's room name — it is this person's pass for the
+     * meeting, and the server accepts a breakout pass wherever the meeting's is asked.
+     */
+    readonly breakoutRoomId?: string | null | undefined;
+}
+
+interface TokenClientOptions {
+    /** The ONE org-aware aidream client (MRI-A16). Owns base url and headers. */
+    api: MeetApi;
+    /** Injected clock, so expiry logic is provable without waiting two hours. */
+    now?: (() => number) | undefined;
+    /**
+     * Where a GUEST's pass survives a page close (MRF-1). Absent means passes
+     * live only in memory, which is correct for a member (they have a session to
+     * mint a new one from) and is why this is optional rather than assumed.
+     */
+    storage?: RoomTokenStorage | undefined;
+}
+/**
+ * 🚨 **WHY A GUEST'S PASS MUST OUTLIVE THE TAB (MRF-1).**
+ *
+ * A guest has no session, so their only credential for a meeting is the room
+ * token this server minted for them. After the meeting ends, `/token` refuses
+ * to mint another one — correctly: the room is gone and nobody may rejoin it.
+ * So a guest who closes the tab and comes back to read the summary has, in a
+ * purely in-memory client, *no way to prove they were ever there* — and the one
+ * honest thing left to show them is a refusal.
+ *
+ * Persisting the pass is what makes the durable link durable for them. It is
+ * per-device by nature (it is stored beside the device id that minted it) and
+ * it expires on its own: `meet.room_token_ttl_seconds` is the organization's
+ * setting for how long, and an expired pass produces the renew-the-link
+ * sentence, never "you were never here".
+ */
+interface RoomTokenStorage {
+    read(roomName: RoomName): string | null;
+    write(roomName: RoomName, serialized: string): void;
+    remove(roomName: RoomName): void;
+}
+/** `localStorage` when it exists; a no-op that SAYS so otherwise. */
+declare function createWebRoomTokenStorage(onDiagnostic?: (message: string, remedy: string) => void): RoomTokenStorage;
+interface TokenRequest {
+    readonly roomName: RoomName;
+    readonly identity: MeetIdentity;
+    /** Present for a meeting join; absent for an ad-hoc call room. */
+    readonly meetingId?: string | undefined;
+    /** The public meeting slug, when joining by link without knowing the id. */
+    readonly slug?: string | undefined;
+    /** Meet wave 5: a breakout room of this meeting; absent = the main room. */
+    readonly breakoutRoomId?: string | null | undefined;
+}
+interface TokenClient {
+    /** A currently-valid token, minting or refreshing only when it must. */
+    get(request: TokenRequest): Promise<RoomToken>;
+    /** Drop the cached token for a room (after a `denied`, or on leave). */
+    invalidate(roomName: RoomName): void;
+    /** True when the cached token is inside its refresh window. */
+    needsRefresh(roomName: RoomName): boolean;
+    /**
+     * The pass this DEVICE holds for a room, **including an expired one** (MRF-1).
+     *
+     * 🚨 The expired case is the whole reason this returns the token instead of
+     * `null`: "your pass expired, open the link again" and "you were never in
+     * this meeting" are different sentences, and only the caller that can see the
+     * expiry can say the right one. Never used to join — `get` mints for that.
+     */
+    remembered(roomName: RoomName): RoomToken | null;
+}
+/** The aidream routes this package calls. ONE place, so a rename is one edit. */
+/**
+ * EVERY aidream ROUTE THIS PACKAGE CALLS, in one object.
+ *
+ * This is the contract in both directions: aidream carries a test
+ * (`services/meet/tests/test_meet_service.py`) that reads THIS object out of
+ * this source file and fails if the server stops serving one of these paths.
+ * The package is the spec.
+ *
+ * `meetingEnd` is pinned here BEFORE the server serves it (MRI-A6 owns landing
+ * it). That is deliberate and it is not a lie on screen: the control that calls
+ * it renders, and a 404 from a server that has not landed A6 is reported as the
+ * honest sentence "Ending a meeting is not available on this server yet" —
+ * never a dead button, never a spinner, and never a silent no-op.
+ */
+declare const MEET_ROUTES: {
+    readonly token: "/api/v1/meet/token";
+    readonly recordingStart: "/api/v1/meet/recording/start";
+    readonly recordingStop: "/api/v1/meet/recording/stop";
+    readonly noteTakerStart: "/api/v1/meet/agent/start";
+    readonly noteTakerStop: "/api/v1/meet/agent/stop";
+    /** In-meeting Q&A. Streams NDJSON; body is `{meeting_id, question}` only. */
+    readonly intelligenceAsk: "/api/v1/meet/intelligence/ask";
+    /** A host ends the meeting for everyone. Served by MRI-A6. */
+    readonly meetingEnd: "/api/v1/meet/end";
+    /**
+     * THE POST-MEETING RECORD FOR A READER WITH NO DATABASE (MRF-1). A `GET`,
+     * authorized by the room token this device already holds, carried in the
+     * `x-meet-room-token` header — never a query parameter, because a bearer
+     * credential in a URL lands in access logs, referrers and history.
+     */
+    readonly record: "/api/v1/meet/record";
+    /** A host chooses what guests may read of ONE meeting (MRF-1). */
+    readonly recordAccess: "/api/v1/meet/record/access";
+    /**
+     * KEEP YOUR NOTES (2026-10-01): a guest who just created an account presents
+     * their kept pass in `x-meet-room-token` with their new session, and the
+     * meeting they attended becomes theirs to read. Idempotent; never a grant.
+     */
+    readonly claim: "/api/v1/meet/claim";
+    /**
+     * Meet wave 1 (0.8): bring every invitee up to date after a write — sends the
+     * invitation / update / cancellation emails with their `.ics` and re-queues
+     * reminders. Idempotent. `{meeting_id}` is substituted by `meetingPath`.
+     */
+    readonly meetingAnnounce: "/api/v1/meet/meetings/{meeting_id}/announce";
+    /** Put a one-off meeting on the caller's own Google Calendar (gated by the server). */
+    readonly meetingGoogleCalendar: "/api/v1/meet/meetings/{meeting_id}/google-calendar";
+    /**
+     * Meet wave 3: the recap email after the meeting. `GET` = the draft (subject,
+     * body from the wrap-up, who it can go to); `POST` = send what the host
+     * reviewed (`dry_run` renders and queues nothing). Never sent automatically.
+     */
+    readonly meetingFollowUp: "/api/v1/meet/meetings/{meeting_id}/follow-up";
+    /**
+     * Meet wave 2: EVERY in-meeting host power (mute, stop video, mute all, ask to
+     * unmute, spotlight, lower hands, co-host, hand over, rename, remove, report).
+     * Decided by the server from the meeting itself; a guest's pass rides
+     * `x-meet-room-token`.
+     */
+    readonly moderate: "/api/v1/meet/moderate";
+    /** Meet wave 2: the SAVED chat — `POST` sends to everyone, `GET ?meeting_id=` reads history. */
+    readonly chat: "/api/v1/meet/chat";
+    /**
+     * Meet wave 5: polls, Q&A, the shared whiteboard and breakout rooms. `POST` acts
+     * (`{meeting_id, action, …}`), `GET ?meeting_id=` reads what this viewer may see.
+     */
+    readonly collab: "/api/v1/meet/collab";
+    /** Meet wave 5: translate finished caption lines into this viewer's language. */
+    readonly captionsTranslate: "/api/v1/meet/captions/translate";
+};
+/** A `MEET_ROUTES` template with its `{meeting_id}` filled in, URL-encoded. */
+declare function meetingPath(template: string, meetingId: string): string;
+/** The header the guest's pass rides on. Pinned on both sides. */
+declare const ROOM_TOKEN_HEADER = "x-meet-room-token";
+declare function parseRoomToken(body: unknown, roomName: RoomName): RoomToken;
+declare function createTokenClient(options: TokenClientOptions): TokenClient;
+
+/**
+ * THE MEETING RECORD — what a meeting IS once the room is gone (MRI-D2).
+ *
+ * 🚨 THE DEFECT THIS EXISTS TO KILL. Through 2026-09-08 a meeting produced a
+ * wrap-up summary, decisions, owner-assigned action items, five windows of live
+ * notes, thirty-two transcript segments and a recording — and then had NO
+ * SURFACE AT ALL. `/meet/<slug>` fell back to `<PreJoin>` on an ended meeting,
+ * so the durable link that R3 promises would outlive the meeting resolved to a
+ * screen offering to join a room that no longer exists. Everything the campaign
+ * built after the room closed was reachable only from SQL.
+ *
+ * Three rules hold this file together:
+ *
+ * 1. **Every read is INDEPENDENT and every refusal is NAMED.** The transcript,
+ *    the notes, the attendance list and the recording live in four RLS-guarded
+ *    tables, and a guest holding the link can read NONE of them (only
+ *    `meet_meeting_by_slug` is granted to `anon`). One `Promise.all` would turn
+ *    a permission boundary into a blank page. Known guest restrictions never issue private reads; each authenticated read that is refused
+ *    becomes a `MeetingRecordRestriction` with a sentence — the reader is told
+ *    what exists and why they cannot see it, which is the difference between a
+ *    record they can ask for and a product that looks broken.
+ * 2. **A partial record is still a record.** A failed transcript read never
+ *    hides the summary somebody CAN read.
+ * 3. **Nothing here computes meaning.** Grouping, ordering and formatting only.
+ *    The summary, decisions and action items are durable rows written by the
+ *    wrap-up mandate (D5/D18); this module never re-derives them from the
+ *    transcript, because two sources for one fact is how they start to disagree.
+ */
+
+/** One thing the reader could not see, and the honest reason. Never a blank. */
+interface MeetingRecordRestriction {
+    /** Which part of the record: `transcript`, `notes`, `attendance`, `recording`. */
+    readonly part: "transcript" | "notes" | "attendance" | "recording";
+    readonly message: string;
+    readonly remedy: string;
+}
+/** One visible access state, made from restrictions that share one remedy. */
+interface MeetingRecordRestrictionNotice {
+    readonly parts: readonly MeetingRecordRestriction["part"][];
+    readonly message: string;
+    readonly remedy: string;
+}
+/** A run of consecutive lines by one speaker — how a person reads a transcript. */
+interface TranscriptBlock {
+    readonly id: string;
+    /** Who spoke. Blocks break on THIS, never on the rendered name (MRI-A16). */
+    readonly identity: ParticipantIdentity;
+    readonly speaker: string;
+    /** ISO of the first line in the block. */
+    readonly startedAt: string;
+    readonly lines: readonly TranscriptSegment[];
+}
+interface MeetingRecordBundle {
+    readonly meeting: MeetingRecord;
+    readonly attendees: readonly MeetingAttendee[];
+    /** The wrap-up summary: `kind='note'` with `metadata.role='summary'` (D5). */
+    readonly summary: MeetingNote | null;
+    /** D20: the AUTHORITATIVE set — window rows the wrap-up superseded are out. */
+    readonly decisions: readonly MeetingNote[];
+    readonly actionItems: readonly MeetingNote[];
+    /** The live-notes windows, in window order (D3). */
+    readonly liveNotes: readonly MeetingNote[];
+    readonly transcript: readonly TranscriptSegment[];
+    /** The most recent recording attempt, whatever state it reached. */
+    readonly recording: RecordingRecord | null;
+    /** What this reader could NOT see. Rendered; never swallowed. */
+    readonly restrictions: readonly MeetingRecordRestriction[];
+    /**
+     * Identity → name, learned from everything this read COULD see: the durable
+     * attendance rows and the transcript's own `speaker` column. It is what stops
+     * a raw LiveKit token reaching the screen when one of those reads was refused
+     * (MRI-A16).
+     */
+    readonly names: NameBook;
+}
+/**
+ * The current wrap-up summary.  Repairs preserve the prior durable row for
+ * history, then mark it `superseded_by`; every current-facing projection must
+ * therefore make the same distinction as decisions and action items.
+ */
+declare function activeWrapUpSummary(notes: readonly MeetingNote[]): MeetingNote | null;
+/**
+ * The four durable reads behind a record, as the database returned them, plus
+ * what the reader could not see. `assembleMeetingRecord` turns them into the
+ * bundle; a cache that keeps them can apply a realtime row to one part and
+ * assemble again, without reading the other three (0.7.79).
+ */
+interface MeetingRecordParts {
+    readonly attendees: readonly MeetingAttendee[];
+    /** Every note row (all kinds, superseded included), oldest first. */
+    readonly notes: readonly MeetingNote[];
+    readonly transcript: readonly TranscriptSegment[];
+    /** Newest first; archived recordings are not here. */
+    readonly recordings: readonly RecordingRecord[];
+    readonly restrictions: readonly MeetingRecordRestriction[];
+}
+/**
+ * Load the record parts the reader may request; state all restrictions.
+ *
+ * `meeting` is passed in when the caller already resolved it (the slug route
+ * does, through the `anon`-granted RPC) — re-reading it through the table would
+ * fail for exactly the reader who most needs the page to work.
+ */
+declare function loadMeetingRecord(repository: MeetRepository, meetingId: MeetingId, meeting: MeetingRecord, reader?: Pick<MeetIdentity, "userId">): Promise<MeetingRecordBundle>;
+/** The four reads, each with its own verdict (see `loadMeetingRecord`). */
+declare function loadMeetingRecordParts(repository: MeetRepository, meetingId: MeetingId, reader?: Pick<MeetIdentity, "userId">): Promise<MeetingRecordParts>;
+/** The bundle a reader sees, from the parts. Grouping and ordering only (rule 3). */
+declare function assembleMeetingRecord(meeting: MeetingRecord, parts: MeetingRecordParts): MeetingRecordBundle;
+/**
+ * 🚨 **A READ THAT WAS REFUSED IS NOT AN EMPTY RESULT (MRI-A16).**
+ *
+ * On production 2026-09-09 a guest's record view said *"No wrap-up was written
+ * for this meeting"* directly underneath a panel that had just told them, in
+ * the same screen, that the notes are not readable from their account — and
+ * *"Nothing was recorded as a decision"* beside a decision that exists
+ * (MRI-C8). The page asserted an absence it had no way to know, which is worse
+ * than saying nothing: a person who reads "no wrap-up was written" stops
+ * looking for one.
+ *
+ * So no surface writes its own empty sentence any more. It asks here, and gets
+ * either its absence sentence — earned, because the read SUCCEEDED and returned
+ * nothing — or the refusal, said plainly.
+ */
+declare const REFUSED_ABSENCE = "This record is not shared with guests.";
+/** Was this part of the record refused to this reader? */
+declare function wasRefused(bundle: MeetingRecordBundle, part: MeetingRecordRestriction["part"]): boolean;
+/**
+ * The sentence to show where a part of the record has nothing in it. NEVER an
+ * absence claim over a read that was refused.
+ */
+declare function absenceSentence(bundle: MeetingRecordBundle, part: MeetingRecordRestriction["part"], absence: string): string;
+/**
+ * 🚨 **"NO WRAP-UP WAS WRITTEN" IS A CLAIM, AND FOR ~33 SECONDS IT WAS FALSE.**
+ *
+ * On production 2026-09-09 the HOST's record view said *"No wrap-up was written
+ * for this meeting"* between 04:46:42 — the flip from the room to the record —
+ * and 04:47:15, when the wrap-up landed. The read was permitted and genuinely
+ * empty, so this is not the refusal class above; it is the OTHER way a screen
+ * lies, by reading "not here yet" as "never happened". A person who reads *"no
+ * wrap-up was written"* closes the tab.
+ *
+ * The meeting row already knows the difference, and it is not a guess: the
+ * wrap-up is a durable job, `enqueue_wrap_up` stamps
+ * `metadata.note_taker.intelligence.wrap_up` when it queues it, and the graph
+ * action stamps `state: "failed"` when the pass refuses TERMINALLY. So:
+ *
+ * - a summary exists → `written`;
+ * - the notes read was refused → `refused` (never an absence claim);
+ * - the job is marked failed → `failed`, in the server's own words;
+ * - the job is queued or running → `in-progress`, with a refresh affordance;
+ * - nothing ever queued one → `absent`, which is the only EARNED absence.
+ *
+ * There is no timeout that flips `in-progress` into `absent`. A wrap-up that is
+ * genuinely stuck says it is still being written — which is TRUE — rather than
+ * inventing a verdict this browser has no way to reach.
+ */
+type WrapUpStatus = {
+    readonly state: "written";
+} | {
+    readonly state: "in-progress";
+    readonly message: string;
+    readonly canRefresh: true;
+} | {
+    readonly state: "failed";
+    readonly message: string;
+} | {
+    readonly state: "refused";
+    readonly message: string;
+} | {
+    readonly state: "absent";
+    readonly message: string;
+};
+/** Where the wrap-up actually is. Never "absent" over a job that is running. */
+declare function wrapUpStatus(bundle: MeetingRecordBundle): WrapUpStatus;
+/**
+ * GROUP THE TRANSCRIPT THE WAY A PERSON READS IT: consecutive lines by one
+ * speaker become one block with one timestamp. Reading thirty-two rows each
+ * re-stamped with a name and a clock is how a transcript becomes unreadable.
+ */
+declare function groupTranscript(segments: readonly TranscriptSegment[], names?: NameBook): readonly TranscriptBlock[];
+/**
+ * WHAT THE RECORDING IS DOING, in a sentence — including the two states people
+ * hit most and understand least. `processing` is not "broken" and `failed` is
+ * never silence: both say what happened and what to do.
+ */
+declare function recordingNotice(recording: RecordingRecord | null): string | null;
+/** Only an `available` recording has a file to play. Nothing else pretends to. */
+declare function playableRecordingFileId(recording: RecordingRecord | null): string | null;
+/**
+ * A MEETING IS OVER WHEN THE SERVER SAYS SO. `ended_at` is stamped by
+ * `POST /v1/meet/end` or by the auto-end evaluation (MRI-A6) — never by a
+ * client noticing the room is empty.
+ */
+declare function hasEnded(meeting: MeetingRecord | null): boolean;
+/**
+ * "Thursday, 8 September 2026, 4:21 PM · 19 minutes". One shape everywhere.
+ *
+ * THE SPAN IS `formatDurationMs`'s (2026-09-12). This body used to divide by
+ * `60_000` and pluralise "minute" itself — a duration formatter living in a
+ * PACKAGE, found the day `aidream/apps/shared` became a scan root. `@ai-matrx/
+ * meet` already depends on `@ai-matrx/kit`, and `style: "long"` is precisely
+ * this voice ("19 minutes", "1 minute"). Three things improve by adopting it:
+ * a 40-second meeting read "0 minutes" and now reads "40 seconds" (the
+ * confident zero the package refuses), a 19-minute-35-second meeting read
+ * "20 minutes" and now reads "19 minutes" (prose asserts at-least, so it
+ * floors), and a 90-minute meeting reads "1 hour" instead of "90 minutes".
+ */
+declare function meetingWhen(meeting: MeetingRecord, locale?: string): string;
+/** How much of a finished meeting a GUEST may read. Pinned with the server. */
+type GuestRecordAccess = "none" | "summary" | "full";
+/** Widest last. The ORDER is the comparison, exactly as it is on the server. */
+declare const GUEST_RECORD_ACCESS_LEVELS: readonly GuestRecordAccess[];
+/**
+ * What a HOST may choose for one meeting. `default` is not a fourth level — it
+ * is the absence of a per-meeting choice, and it is the only way to un-choose.
+ */
+type GuestRecordAccessSetting = "default" | GuestRecordAccess;
+declare const GUEST_RECORD_ACCESS_CHOICES: readonly GuestRecordAccessSetting[];
+/** `meet_meetings.metadata.guest_record_access`. No DDL; a setting on a row. */
+declare const GUEST_RECORD_ACCESS_METADATA_KEY = "guest_record_access";
+/** What a host chose for THIS meeting, read from the row they already have. */
+declare function guestRecordAccessSetting(meeting: MeetingRecord | null): GuestRecordAccessSetting;
+/** The sentence on the host's control. Plain English, never a token. */
+declare function guestRecordAccessLabel(setting: GuestRecordAccessSetting): string;
+/** What each choice actually means for the people who were in the room. */
+declare function guestRecordAccessExplanation(setting: GuestRecordAccessSetting): string;
+/** What came back from the server, so a surface never has to infer a level. */
+interface GuestRecordAccessResolution {
+    readonly level: GuestRecordAccess;
+    /** `meeting` when a host chose for this one; `organization` otherwise. */
+    readonly source: "meeting" | "organization";
+}
+/**
+ * Repeated policy refusals are one access state, not four alarming cards.
+ *
+ * The individual rows remain durable data for absence handling in their own
+ * sections. This projection groups only rows with the exact same remedy, so a
+ * distinct transport or integrity failure remains visible on its own.
+ */
+declare function summarizeMeetingRecordRestrictions(restrictions: readonly MeetingRecordRestriction[]): readonly MeetingRecordRestrictionNotice[];
+/**
+ * Read the record the server shares with THIS guest.
+ *
+ * `roomToken` is the pass this device kept from the meeting
+ * (`TokenClient.remembered`). It is presented in a header, never appended to
+ * the URL. A guest with no pass, an expired pass, or a level of `none` gets the
+ * server's refusal — as restrictions on a real bundle, so the screen says what
+ * it cannot show instead of collapsing into an error page.
+ */
+declare function loadGuestMeetingRecord(args: {
+    api: MeetApi;
+    repository: MeetRepository;
+    meetingId: MeetingId;
+    meeting: MeetingRecord;
+    roomToken: RoomToken | null;
+    /**
+     * A SIGNED-IN reader the database refused (from another organization, or a
+     * guest who later created an account). Their session stands in for the
+     * pass: the server reads their `user:<id>` admission or the attendance they
+     * claimed, and shares what guests may read (2026-10-01).
+     */
+    session?: boolean;
+}): Promise<MeetingRecordBundle>;
+/**
+ * A HOST chooses what guests may read of THIS meeting.
+ *
+ * Host power is the SERVER's decision and it re-checks it; this function exists
+ * so the control has one call to make, and it returns what the choice RESOLVES
+ * to so the screen never has to guess what "my organization's setting" means
+ * today.
+ */
+declare function setGuestRecordAccess(args: {
+    api: MeetApi;
+    meetingId: MeetingId;
+    organizationId: OrganizationId;
+    access: GuestRecordAccessSetting;
+}): Promise<{
+    readonly setting: GuestRecordAccessSetting;
+    readonly effective: GuestRecordAccessResolution;
+}>;
+/** What a guest is told when the level shares nothing. Rendered, never hidden. */
+declare const GUEST_RECORD_NOT_SHARED: Readonly<Record<"recording" | "transcript" | "notes" | "attendance", string>>;
+
+/**
+ * AFTER THE MEETING (Meet wave 3) — the pure pieces every client needs once the
+ * room is gone: the attendance report, the transcript and notes as documents,
+ * a moment in the transcript as a moment in the recording, search within one
+ * transcript, and the two server calls behind the recap email and the saved
+ * chat.
+ *
+ * Nothing here computes MEANING (same rule as `record.ts`): the summary,
+ * decisions and action items are the wrap-up's durable rows; this file only
+ * arranges, measures and formats them. Every function is framework-free so a
+ * worker, a test and a browser produce byte-identical exports.
+ */
+
+/**
+ * Who someone was, in the words an attendance report uses. `signed-in guest` is
+ * an account from outside the meeting's organization that followed the link;
+ * `guest` has no account at all.
+ */
+type AttendanceKind = "host" | "cohost" | "member" | "signed-in guest" | "guest" | "assistant";
+interface AttendanceRow {
+    readonly id: string;
+    readonly identity: string;
+    readonly name: string;
+    readonly userId: string | null;
+    readonly kind: AttendanceKind;
+    /** First time they were in the room; null when they knocked and never came in. */
+    readonly joinedAt: string | null;
+    /** When they left; null while still in the room or when the leave was never recorded. */
+    readonly leftAt: string | null;
+    /**
+     * Time in the room. A missing `leftAt` is measured to the meeting's end —
+     * the room closed around them — and `null` only when neither is known.
+     */
+    readonly durationMs: number | null;
+    /** True when `durationMs` was measured to the meeting's end, not a recorded leave. */
+    readonly durationToEnd: boolean;
+    readonly admission: MeetingAttendee["admissionState"];
+    /** How many times this person came in (a rejoin or a second device). */
+    readonly joins: number;
+}
+/**
+ * The attendance report of ONE meeting, host first then by arrival. People who
+ * knocked and were never let in are kept (with no join time) — "who asked to
+ * come in" is part of the record — but a denied knock has no duration.
+ */
+/**
+ * WHO a participant row is, as a PERSON (verifier, 2026-09-27: an export listed
+ * the same attendee twice under "attended"). A signed-in person is their
+ * account — every device and every rejoin is one person. A guest without an
+ * account gets a fresh `guest:<random>` identity on every join, so the name
+ * they typed is the only thread between their joins (Zoom's attendee report
+ * merges link guests the same way); two different accountless guests who
+ * typed the identical name read as one, which is the lesser error.
+ */
+declare function attendeeKey(person: MeetingAttendee, names?: NameBook): string;
+/**
+ * One row per PERSON, in first-seen order: the row that actually joined (the
+ * earliest) represents them. For a list of names or a head-count; the
+ * attendance REPORT merges times as well (`attendanceReport`).
+ */
+declare function uniqueAttendees(attendees: readonly MeetingAttendee[], names?: NameBook): readonly MeetingAttendee[];
+declare function attendanceReport(meeting: MeetingRecord, attendees: readonly MeetingAttendee[], names?: NameBook): readonly AttendanceRow[];
+/** Headline numbers for the top of a report. The assistant is never a person. */
+declare function attendanceTotals(rows: readonly AttendanceRow[]): {
+    readonly people: number;
+    readonly guests: number;
+    readonly neverAdmitted: number;
+    readonly averageMs: number | null;
+};
+declare const ATTENDANCE_CSV_HEADER: readonly ["Meeting", "Meeting started", "Name", "Attended as", "Joined", "Left", "Minutes in the meeting", "Admission"];
+/**
+ * CSV for a spreadsheet: one header row, one row per person, ISO timestamps (a
+ * spreadsheet parses them; a formatted local clock loses the zone). Several
+ * meetings — a series — concatenate with one header.
+ */
+declare function attendanceCsv(reports: readonly {
+    meeting: MeetingRecord;
+    rows: readonly AttendanceRow[];
+}[]): string;
+/**
+ * Where an instant of the meeting falls in the RECORDING, in milliseconds from
+ * its start — or `null` when the recording does not cover it (a recording is
+ * often a few minutes of a longer meeting). Never a clamp: seeking a line that
+ * was said before recording began to 0:00 would play the wrong words.
+ */
+declare function recordingOffsetMs(at: string, recording: RecordingRecord | null): number | null;
+/** `m:ss` or `h:mm:ss` — a position in a recording or a meeting. */
+declare function clockPosition(offsetMs: number): string;
+interface TranscriptMatch {
+    readonly segmentId: string;
+    /** [start, end) character ranges inside the segment's text, in order. */
+    readonly ranges: readonly (readonly [number, number])[];
+}
+/**
+ * Case-insensitive search of the transcript text AND the speaker's
+ * name. Returns matches in transcript order. An empty query matches nothing.
+ */
+declare function searchTranscript(segments: readonly TranscriptSegment[], query: string, names?: NameBook): readonly TranscriptMatch[];
+type TranscriptFormat = "txt" | "md" | "vtt";
+interface ExportOptions {
+    readonly names?: NameBook;
+    /** Timestamps as a clock of day (default) or offsets from `zero`. */
+    readonly locale?: string;
+    readonly timeZone?: string;
+}
+/**
+ * The transcript as a document. `txt` and `md` group consecutive lines by one
+ * speaker with the clock of day; `vtt` is WebVTT cued from the recording's
+ * start when a recording exists (so it plays as captions over it), otherwise
+ * from the meeting's start — and a cue ends where the next line begins.
+ */
+declare function transcriptDocument(bundle: Pick<MeetingRecordBundle, "meeting" | "transcript" | "recording" | "names">, format: TranscriptFormat, options?: ExportOptions): string;
+/**
+ * The meeting's notes as Markdown: when, who attended, the summary, decisions
+ * and action items (with owners), and the link back. What a person pastes into
+ * a doc or an email; also the source for PDF / Word export.
+ */
+declare function notesDocument(bundle: Pick<MeetingRecordBundle, "meeting" | "summary" | "decisions" | "actionItems" | "attendees" | "names">, options?: {
+    readonly link?: string | null;
+    readonly when?: string | null;
+}): string;
+/** How long the meeting ran, in words ("42 minutes"), or null when unknown. */
+declare function meetingLength(meeting: MeetingRecord): string | null;
+interface MeetingChatHistory {
+    readonly messages: readonly RoomChatMessage[];
+    /** The server's refusal, in its words, when the history could not be read. */
+    readonly refusal: {
+        readonly message: string;
+        readonly remedy: string;
+    } | null;
+}
+/**
+ * The saved chat of a finished meeting (`GET /v1/meet/chat`). Private messages
+ * are never saved, by design, so they are never here. A refusal is returned as
+ * data — the record still renders everything else.
+ */
+declare function loadMeetingChat(api: MeetApi, meetingId: MeetingId, roomToken?: string | null): Promise<MeetingChatHistory>;
+/** One person the recap can go to, as the server resolved them. */
+interface FollowUpRecipient {
+    /** Stable key for the choice: `user:<id>` or `email:<address>`. */
+    readonly key: string;
+    readonly name: string;
+    /** The address, when this reader may see it (the host sees their guests'). */
+    readonly email: string | null;
+    readonly userId: string | null;
+    /** `invitee`, `attendee` or both — where the server found them. */
+    readonly sources: readonly ("invitee" | "attendee")[];
+    /** False when the server has no way to reach them (no account, no address). */
+    readonly reachable: boolean;
+}
+/** The draft the host reviews. The text is the wrap-up's own, arranged. */
+interface FollowUpDraft {
+    readonly subject: string;
+    readonly body: string;
+    readonly recipients: readonly FollowUpRecipient[];
+    /** False while the wrap-up has not been written — the draft says so. */
+    readonly wrapUpWritten: boolean;
+    /** When a recap for this meeting was last sent, and to how many. */
+    readonly lastSent: {
+        readonly at: string;
+        readonly count: number;
+    } | null;
+}
+interface FollowUpSendResult {
+    readonly dryRun: boolean;
+    /** Recipients the send queued (or, on a dry run, would queue). */
+    readonly queued: readonly string[];
+    /** Recipient keys skipped, each with the reason. */
+    readonly skipped: readonly {
+        readonly key: string;
+        readonly reason: string;
+    }[];
+}
+/** The recap draft for a finished meeting. The host, a co-host or an editor. */
+declare function loadFollowUpDraft(api: MeetApi, meetingId: MeetingId): Promise<FollowUpDraft>;
+/**
+ * Send the recap the host reviewed. `dryRun` resolves every recipient and
+ * renders every email but queues nothing — how a test proves the path without
+ * mailing a real inbox. Never called automatically.
+ */
+declare function sendFollowUp(api: MeetApi, meetingId: MeetingId, input: {
+    readonly subject: string;
+    readonly body: string;
+    readonly recipientKeys: readonly string[];
+    readonly dryRun?: boolean;
+}): Promise<FollowUpSendResult>;
+
+/**
+ * MEET WAVE 1 — the two server calls a management screen makes (0.8).
+ *
+ * Every WRITE (schedule, edit, reschedule, cancel, archive, occurrence change,
+ * invite, answer) goes straight to the database through `MeetRepository` — the
+ * database decides who may. What a browser cannot do is send an email with a
+ * calendar object in it, so after any of those writes a screen calls
+ * `announceMeeting`: the server tells each invitee exactly what they have not
+ * been told (invitation, update or cancellation, each with its `.ics`), and
+ * re-queues reminders. It is idempotent — call it after every save.
+ */
+
+interface AnnounceResult {
+    readonly invitations: number;
+    readonly updates: number;
+    readonly cancellations: number;
+    readonly alreadyCurrent: number;
+    readonly remindersQueued: number;
+    readonly remindersCancelled: number;
+}
+/** Bring every invitee's inbox and calendar up to date. The host, a co-host or an editor. */
+declare function announceMeeting(api: MeetApi, meetingId: MeetingId): Promise<AnnounceResult>;
+/**
+ * Put a one-off meeting on the caller's own connected Google Calendar. GATED by
+ * the server to Google's review accounts while the Calendar scope is in review —
+ * a refusal is a `forbidden` MeetError carrying the server's sentence. Everyone
+ * already gets the meeting into any calendar through the invitation's `.ics`.
+ */
+declare function pushMeetingToGoogleCalendar(api: MeetApi, meetingId: MeetingId, target: {
+    connectionId: string;
+    calendarId?: string;
+}): Promise<Record<string, unknown>>;
+
+/**
+ * THE ROOM ENGINE — the object a host mounts once and never reasons about.
+ *
+ * It owns every sequence a calling product gets wrong: ask for a token, connect,
+ * project the roster, carry the in-room control plane, keep the phase honest
+ * through a reconnect, and tear everything down exactly once. A consumer's job
+ * is `engine.join(...)` and rendering a snapshot.
+ *
+ * THREE rules are structural here, not documented-and-hoped:
+ *
+ * 1. **The phase never lies.** `connecting` becomes `connected` only when the
+ *    driver says so, and any failure becomes `failed` WITH the remedy attached
+ *    to the snapshot. There is no path that leaves a spinner running forever —
+ *    the single most common complaint about every video product.
+ * 2. **Role comes from the TOKEN, never from the client.** A participant's role
+ *    is read out of the server-minted metadata. A client that could decide it
+ *    was host could mute anyone; here the claim is unforgeable because the
+ *    server signed it.
+ * 3. **Teardown is idempotent and total.** Leaving twice, or unmounting during
+ *    a connect, disconnects once and leaves no listener behind. The half-torn
+ *    room is what produces "my camera light stays on after the call".
+ */
+
+interface JoinRequest {
+    readonly roomName: RoomName;
+    readonly meetingId?: string | undefined;
+    readonly slug?: string | undefined;
+    /** `audio` joins with the camera off. Same room, same code path (D3). */
+    readonly mode: CallMode;
+    /**
+     * Whether to ATTEMPT the microphone on join. Defaults to true. `false` is a
+     * deliberate listen-only join — the pre-join screen's "Join with microphone"
+     * toggle. Either way the join itself never depends on the outcome; a refused
+     * device lands in `snapshot.media.microphone.unavailable`, not in a throw.
+     */
+    readonly microphone?: boolean | undefined;
+    /** Meet wave 5: a breakout room of this meeting; absent/null = the main room. */
+    readonly breakoutRoomId?: string | null | undefined;
+}
+interface RoomEngineOptions {
+    store: MeetStore;
+    tokens: TokenClient;
+    identity: MeetIdentity;
+    driverFactory: RoomDriverFactory;
+    /** Canonical public metadata read; room packets alone never authorize teardown. */
+    resolveMeeting?: ((slug: string) => Promise<MeetingRecord>) | undefined;
+    onDiagnostic?: ((event: {
+        level: "info" | "warn" | "error";
+        message: string;
+        remedy?: string;
+    }) => void) | undefined;
+    /** Fired when the local participant leaves for any reason, including kicked. */
+    onLeft?: ((reason: string | null) => void) | undefined;
+    now?: (() => number) | undefined;
+    /** Remembered noise suppression / background choice (Meet wave 2). */
+    effectsStorage?: EffectsStorage | undefined;
+    /**
+     * The device the person PICKED for each kind (the pre-join pickers, the
+     * settings panel). Applied before any track is created — through 0.7.x the
+     * pickers stored a choice nothing ever read, so every join used the browser
+     * default whatever the screen said.
+     */
+    resolveDevice?: ((kind: "audioinput" | "videoinput" | "audiooutput") => string | null) | undefined;
+}
+interface RoomEngine {
+    join(request: JoinRequest): Promise<void>;
+    /**
+     * 🚨 THE HOST SAID YES — COME IN.
+     *
+     * A lobby token is minted with `canPublish: false` and `canSubscribe: false`
+     * (that is what makes the lobby real rather than a screen over a live
+     * microphone), so admission is not a UI state change: the cached token has to
+     * be thrown away and a NEW one minted with the grants the server now gives.
+     * Without this the waiting room's own sentence — "you will join automatically
+     * once you are admitted" — is a lie, and the guest waits forever.
+     */
+    rejoin(): Promise<void>;
+    /**
+     * Meet wave 5: go to a breakout room (`null` = back to the main room). The server
+     * mints the pass (`/token` with `breakout_room_id`) and refuses a room the plan does
+     * not allow; the move is a reconnect that never reads as leaving the meeting.
+     */
+    moveToBreakout(roomId: string | null): Promise<void>;
+    leave(): Promise<void>;
+    setMicrophoneEnabled(enabled: boolean): Promise<void>;
+    setCameraEnabled(enabled: boolean): Promise<void>;
+    setScreenShareEnabled(enabled: boolean): Promise<void>;
+    raiseHand(raised: boolean): Promise<void>;
+    react(emoji: string): Promise<void>;
+    /**
+     * A PRIVATE message to one person (Meet wave 2). Data plane only, addressed
+     * to that identity, NEVER saved — see `core/chat.ts` for the saved,
+     * everyone-chat, which goes through the server.
+     */
+    sendPrivateChat(to: ParticipantIdentity, text: string): Promise<void>;
+    /**
+     * Change this participant's own media processing — noise suppression and the
+     * camera background — on the live tracks, and remember it in this browser.
+     * A refused effect is a diagnostic and a revert, never a lost camera.
+     */
+    setEffects(next: Partial<MediaEffects>): Promise<void>;
+    /** Whether this browser can run a background effect at all (absent, never dead). */
+    supportsVideoEffects(): boolean;
+    /** Whether this browser can share a screen at all — the control is ABSENT where it cannot. */
+    supportsScreenShare(): boolean;
+    /** Choose the speaker (audio output) for this meeting. */
+    switchDevice(kind: "audioinput" | "videoinput" | "audiooutput", deviceId: string): Promise<void>;
+    pin(identity: ParticipantIdentity | null): void;
+    setLayout(layout: StageLayout): void;
+    attach(identity: ParticipantIdentity, kind: "camera" | "microphone" | "screen", element: HTMLMediaElement): () => void;
+    token(): RoomToken | null;
+    dispose(): Promise<void>;
+}
+/** Where this browser keeps a participant's media choices. */
+interface EffectsStorage {
+    load(): MediaEffects;
+    save(effects: MediaEffects): void;
+}
+/**
+ * 🚨 THE SERVER'S WORD, ON TWO CARRIERS (MRI-A11, feedback `7418ef78`).
+ *
+ * aidream mints the role into the token's participant METADATA (a JSON blob)
+ * AND as a LiveKit participant ATTRIBUTE. Both come out of one decision in
+ * `services/meet/service.py`; neither can be written by a client. The attribute
+ * is preferred because LiveKit delivers the attribute map on every roster
+ * update, while a roster event can carry an empty metadata string — which is
+ * precisely how, through 2026-09-08, EVERY participant projected as
+ * "participant" and no host ever saw a host control in a browser.
+ *
+ * These strings are pinned on the server side too: `test_meet_service.py` reads
+ * them out of THIS file and fails if the two sides drift.
+ */
+declare const PARTICIPANT_ROLE_ATTRIBUTE = "matrx.participant.role";
+declare const PARTICIPANT_CAN_RECORD_ATTRIBUTE = "matrx.participant.can_record";
+/**
+ * Metadata is SERVER-MINTED and therefore trusted; it is still parsed
+ * defensively, because a malformed blob must degrade a tile to "participant"
+ * rather than throw inside a roster event and freeze the whole grid.
+ */
+declare function projectParticipant(driver: DriverParticipant, joinedAt: string): MeetParticipant;
+declare function createRoomEngine(options: RoomEngineOptions): RoomEngine;
+/** Exported for the host-power check in UI code — one definition, one rank. */
+declare function canModerate(participant: MeetParticipant | undefined): boolean;
+declare function hostUserIds(participants: readonly MeetParticipant[]): readonly UserId[];
+
+/**
+ * A PARTICIPANT'S OWN MEDIA CHOICES, REMEMBERED (Meet wave 2).
+ *
+ * Noise suppression and the camera background are personal and per device —
+ * Zoom and Meet both remember them — so they live in this browser, never on a
+ * server. Blocked storage means the defaults (suppression on, no background),
+ * never a failed join.
+ */
+
+declare function createWebEffectsStorage(key?: string): EffectsStorage;
+
+/**
+ * THE IN-ROOM SERVER CALLS (Meet wave 2) — host moderation and the SAVED chat.
+ *
+ * 🚨 **Why these are server calls and not data packets.** Through 0.7.x a host's
+ * "Mute" and "Remove" were published on the room's data plane (`mx.host`) and
+ * nothing anywhere listened: the buttons did nothing. A client cannot be the
+ * authority on host power, and a guest cannot write the database. So both go to
+ * aidream (`POST /v1/meet/moderate`, `POST|GET /v1/meet/chat`), which decides the
+ * actor's role from the meeting itself, performs the act through LiveKit's server
+ * API, writes what is durable, and tells the room on its own `matrx.meet.*` topic.
+ *
+ * A guest proves who they are with the room pass this server signed for them, in
+ * `x-meet-room-token` — a header, never a URL.
+ */
+
+/** Every host power the server performs. One vocabulary with `services/meet/moderation.py`. */
+type ModerationAction = "mute" | "stop_video" | "stop_screen" | "mute_all" | "ask_unmute" | "ask_all_unmute" | "spotlight" | "lower_hand" | "lower_all_hands" | "make_cohost" | "revoke_cohost" | "transfer_host" | "rename" | "remove" | "report";
+declare const MODERATION_ACTIONS: readonly ModerationAction[];
+interface ModerationRequest {
+    readonly action: ModerationAction;
+    readonly identity?: ParticipantIdentity | null | undefined;
+    readonly name?: string | undefined;
+    readonly reason?: string | undefined;
+}
+interface ModerationResult {
+    readonly action: ModerationAction;
+    readonly affected: readonly string[];
+    /** The server's sentence for the actor. */
+    readonly message: string;
+}
+interface InRoomClient {
+    moderate(request: ModerationRequest): Promise<ModerationResult>;
+    /** Send a message to EVERYONE. Saved; shows at once as pending, then as saved. */
+    sendChat(text: string): Promise<void>;
+    /** Read the saved chat once per join, so a late joiner sees what was said. */
+    loadChat(): Promise<void>;
+    /**
+     * Meet wave 5: read the polls, questions, whiteboard and breakout plan this viewer
+     * may see, once per join. A refusal is written to `collab.error`, never thrown away.
+     */
+    loadCollab(): Promise<void>;
+    /**
+     * Meet wave 5: one poll / Q&A / whiteboard / breakout action. The server's answer is
+     * folded into the store at once (the room packet that follows is the same item).
+     * Returns the server's sentence; throws a `MeetError` with the server's words.
+     */
+    collab(request: CollabRequest): Promise<CollabResult>;
+    /**
+     * Meet wave 5: translate finished caption lines into `language` for this viewer.
+     * Results land in `collab.captionTranslations`; a refusal in `captionTranslationError`.
+     */
+    translateCaptions(language: string, lines: readonly {
+        id: string;
+        text: string;
+    }[]): Promise<void>;
+}
+/** Every room-item action the server performs. One vocabulary with `services/meet/collab.py`. */
+type CollabAction = "poll_create" | "poll_update" | "poll_launch" | "poll_close" | "poll_share" | "poll_vote" | "poll_delete" | "question_ask" | "question_upvote" | "question_answer" | "question_reopen" | "question_dismiss" | "question_delete" | "stroke_add" | "stroke_erase" | "whiteboard_clear" | "breakout_open" | "breakout_update" | "breakout_broadcast" | "breakout_move" | "breakout_join" | "breakout_close" | "breakout_expire";
+interface CollabRequest {
+    readonly action: CollabAction;
+    readonly itemId?: string | undefined;
+    readonly question?: string | undefined;
+    readonly options?: readonly string[] | undefined;
+    readonly multiple?: boolean | undefined;
+    readonly anonymous?: boolean | undefined;
+    readonly optionIds?: readonly string[] | undefined;
+    readonly text?: string | undefined;
+    readonly stroke?: {
+        readonly points: readonly (readonly [number, number])[];
+        readonly color: string;
+        readonly width: number;
+        readonly tool: "pen" | "highlighter";
+    } | undefined;
+    readonly rooms?: readonly {
+        readonly name: string;
+        readonly identities: readonly string[];
+    }[] | undefined;
+    readonly allowChoose?: boolean | undefined;
+    readonly minutes?: number | undefined;
+    readonly identity?: string | undefined;
+    /** `null` = the main room (breakout_join / breakout_move). */
+    readonly roomId?: string | null | undefined;
+}
+interface CollabResult {
+    readonly action: CollabAction;
+    readonly message: string;
+    readonly removed: readonly string[];
+    /** The id of the item the server returned (a created poll, a new question), or null. */
+    readonly itemId: string | null;
+}
+interface InRoomClientOptions {
+    api: MeetApi;
+    store: MeetStore;
+    /** The room pass for THIS meeting, or null (a signed-in member needs none). */
+    resolveRoomToken: () => string | null;
+    now?: (() => number) | undefined;
+}
+declare function createInRoomClient(options: InRoomClientOptions): InRoomClient;
+
+/**
+ * ONE MEETING RECORD PER READER PER TAB — read once, kept current by one
+ * ref-counted channel (0.7.79).
+ *
+ * 🚨 THE DEFECT THIS CLOSES. `useMeetingRecord` held the bundle in its own
+ * component state and read all four parts (`meet_participants`, `meet_notes`,
+ * `meet_transcript_segments`, `meet_recordings`) in a mount effect. A host that
+ * hides a view without unmounting its data — a board tile asleep under React
+ * `<Activity>`, which tears every effect down and runs it again on wake — read
+ * the whole record again on every wake, on a Remove + Undo, and once more for
+ * every second view of the same meeting (the record tab, the meeting's agent
+ * surface, five "meeting notes" tiles). The view owned the data.
+ *
+ * THE SHAPE. One entry per (reader, meeting). The first view reads; every later
+ * view — the same view after a wake or a remount included — renders the entry
+ * and reads nothing. A read already in flight is joined. A forced read (Retry,
+ * a reconnect) supersedes it, and an answer that lands after a newer read was
+ * asked is DROPPED (the late-answer guard), so an old answer can never paint
+ * over a newer one.
+ *
+ * LIVE WHILE HELD. A member's entry (a direct read, kept as its four parts) is
+ * patched row by row from the database's change feed for the four tables, then
+ * assembled again — one row, never four reads. The channel opens on the first
+ * holder and closes `MEETING_RECORD_GRACE_MS` after the last one lets go, so a
+ * wake or an Undo inside the grace costs nothing. Past the grace nothing
+ * watched the meeting, so the entry is marked stale and the next view reads it
+ * once. A guest's record arrives through the server as a finished bundle; it
+ * has no change feed and is kept as it is.
+ *
+ * Framework-free on purpose: `react/hooks.ts` is one reader of it.
+ */
+
+/** How long a meeting's channel and kept record outlive the last view of it. */
+declare const MEETING_RECORD_GRACE_MS = 60000;
+interface MeetingRecordFailure {
+    readonly message: string;
+    readonly remedy: string;
+}
+interface MeetingRecordState {
+    readonly loading: boolean;
+    readonly record: MeetingRecordBundle | null;
+    /** A failure that stopped the WHOLE record loading (never kept as an answer). */
+    readonly failure: MeetingRecordFailure | null;
+}
+/** What a read produced: the four parts (patchable), or a finished bundle (a guest's). */
+type MeetingRecordAnswer = {
+    readonly kind: "parts";
+    readonly meeting: MeetingRecord;
+    readonly parts: MeetingRecordParts;
+} | {
+    readonly kind: "bundle";
+    readonly bundle: MeetingRecordBundle;
+};
+/** One changed row, already projected by the repository. `null` + `removedId` = gone. */
+type MeetingRecordChange = {
+    readonly part: "transcript";
+    readonly row: MeetingRecordParts["transcript"][number] | null;
+    readonly removedId?: string | undefined;
+} | {
+    readonly part: "notes";
+    readonly row: MeetingRecordParts["notes"][number] | null;
+    readonly removedId?: string | undefined;
+} | {
+    readonly part: "attendance";
+    readonly row: MeetingRecordParts["attendees"][number] | null;
+    readonly removedId?: string | undefined;
+} | {
+    readonly part: "recording";
+    readonly row: MeetingRecordParts["recordings"][number] | null;
+    readonly removedId?: string | undefined;
+};
+interface MeetingRecordCache {
+    /** The kept state for `key` (stable until it changes). */
+    state(key: string | null): MeetingRecordState;
+    subscribe(listener: () => void): () => void;
+    /**
+     * Read unless the entry is kept and current (or a read is in flight — joined).
+     * `force` reads anyway and supersedes a read in flight. Never rejects: a
+     * failure is in the state.
+     */
+    ensure(key: string, read: () => Promise<MeetingRecordAnswer>, options?: {
+        force?: boolean;
+    }): Promise<void>;
+    /** The meeting row moved (a rename, it ended): assemble again — no read. */
+    setMeeting(key: string, meeting: MeetingRecord): void;
+    /** Apply one changed row from the change feed — no read. */
+    apply(key: string, change: MeetingRecordChange): void;
+    /**
+     * Hold the live half: `open` on the first holder, its close a grace after the
+     * last. `owner` is what the channel runs on (the realtime manager): a new
+     * owner means the old one's channels are gone, so it opens again.
+     */
+    hold(key: string, open: () => () => void, owner?: unknown): () => void;
+    /** Tests only. */
+    reset(): void;
+}
+declare function createMeetingRecordCache(options?: {
+    graceMs?: number;
+}): MeetingRecordCache;
+
+/**
+ * The reaction ids every skin offers (CORE-DESIGN §5.3). The id IS the emoji
+ * the wire carries; a skin may draw its own art for each, never a different set.
+ */
+declare const MEET_REACTIONS: readonly string[];
+
+/**
+ * COLLAB AND CAPTION LOGIC, HEADLESS (CORE-DESIGN §5.3, step S1).
+ *
+ * What used to live inside the React hooks of the in-room activities: which
+ * activities a person has, when the Activities door deserves a dot, the act /
+ * move-to-breakout calls with their sentences, the caption-translation work
+ * queue, and the one-shot panel and language requests on the store. Pure or
+ * store-shaped, so every skin reads the same answers; the `/react` hooks are
+ * thin selectors over these.
+ */
+
+/** The activities this person has, in the order Meet lists them. */
+declare function availableActivities(collab: CollabSnapshot | null, isHost: boolean): CollabPanel[];
+/** Something worth a dot on the Activities button: a live poll unanswered, a new question for a host. */
+declare function activityAttention(collab: CollabSnapshot | null, isHost: boolean): boolean;
+interface CollabRuntime {
+    readonly inRoom: {
+        collab(request: CollabRequest): Promise<CollabResult>;
+    };
+    readonly engine: {
+        moveToBreakout(roomId: string | null): Promise<unknown>;
+    };
+}
+/** Perform one act; resolves with the server's sentence, or its refusal (never throws). */
+declare function performCollab(runtime: CollabRuntime | null, request: CollabRequest): Promise<{
+    ok: boolean;
+    message: string;
+    itemId?: string | null;
+}>;
+/** Go to a breakout room (`null` = the main room), with the sentence to show. */
+declare function moveToRoom(runtime: CollabRuntime | null, roomId: string | null): Promise<{
+    ok: boolean;
+    message: string;
+}>;
+interface CollabStoreLike {
+    snapshot(): MeetSnapshot;
+    patch(next: Partial<MeetSnapshot>): void;
+}
+/** Finished caption lines that still need a translation into `language`. */
+declare function untranslatedLines(lines: readonly {
+    id: string;
+    text: string;
+    final: boolean;
+}[], translations: Readonly<Record<string, string>>): {
+    id: string;
+    text: string;
+}[];
+/** The next batch to send: never a line already asked for in this language, at most 20. */
+declare function nextTranslationBatch(pending: readonly {
+    id: string;
+    text: string;
+}[], language: string, asked: Set<string>): {
+    id: string;
+    text: string;
+}[];
+/** The viewer chose a caption language (or `null` = as spoken): start over in it. */
+declare function setCaptionLanguage(store: CollabStoreLike, next: string | null): void;
+/** Take (and clear) the one-shot "open this panel" request, if any. */
+declare function takePanelRequest(store: CollabStoreLike): CollabPanel | null;
+/** Take (and clear) the one-shot "move to this breakout room" request, if any. */
+declare function takeMoveRequest(store: CollabStoreLike): {
+    roomId: string | null;
+} | null;
+
+/**
+ * THE OBSERVATION CONTRACT, DERIVED FROM TODAY'S STORE (CORE-DESIGN §7 step S0).
+ *
+ * The real-browser scenario harness reads a meeting through a small set of
+ * `data-meet-*` attributes (common-docs `meet/duplicates/HARNESS-CONTRACT.md`,
+ * owned by the harness lane). This module turns the store's `MeetSnapshot`
+ * into exactly those values — pure, framework-free, rendered ONCE by the
+ * package (`useCoreRootProps()` / `<MeetRoot>`), never per skin.
+ *
+ * S0 rule: TODAY'S VALUES ONLY. Every value here is what the person actually
+ * sees on today's screens, including today's defects — a `failed` or `left`
+ * room renders the pre-join screen, so its phase is `prejoin`, and the harness
+ * records that as the defect it is. A value the store does not know (host
+ * presence before joining, autoplay blocking) is OMITTED rather than guessed:
+ * an absent attribute reads as "unknown", a guessed one would lie.
+ */
+
+/** `data-meet-phase` values this release renders (a subset of the contract's §2). */
+type ObservedPhase = "resolving" | `refused:${string}` | "prejoin" | "joining" | "waiting:knocking" | "in_call" | "disconnected" | "ended";
+type ObservedConnection = "stable" | "reconnecting" | "server_unreachable";
+interface MeetObservation {
+    readonly phase: ObservedPhase;
+    readonly reason: string | null;
+    readonly role: ParticipantRole | "none";
+    readonly connection: ObservedConnection;
+    /** null = this tab does not know (it is not in the room). */
+    readonly hostPresent: boolean | null;
+    readonly lobbyCount: number;
+    readonly recording: boolean;
+    /** null = today's store does not track autoplay blocking. */
+    readonly audioBlocked: boolean | null;
+    /** null outside `joining` / `in_call` — no device is in play there today. */
+    readonly camera: string | null;
+    readonly microphone: string | null;
+}
+interface ObserveInput {
+    readonly snapshot: MeetSnapshot | null;
+    /** The row the consumer resolved, when the store has none yet (the guest lane). */
+    readonly meeting?: MeetingRecord | null | undefined;
+}
+/** The store's device state → the contract's `camera` / `microphone` value. */
+declare function observedDevice(track: LocalTrackState): string;
+/**
+ * The phase the person is looking at, by the same branches `<MeetingRoom>`
+ * renders on: record → pre-join (idle/failed/left) → waiting room (lobby) →
+ * the room (everything else).
+ */
+declare function observedPhase(input: ObserveInput): ObservedPhase;
+declare function observe(input: ObserveInput): MeetObservation;
+/** A phase the consumer renders itself (link resolution, the guest-name step, a dead link). */
+declare function staticObservation(phase: ObservedPhase, reason?: string | null): MeetObservation;
+/** The root element's attributes. Unknown values are omitted, never guessed. */
+declare function rootAttributes(o: MeetObservation): Record<string, string>;
+/** The contract's per-person connection vocabulary. `unknown` is not a reading. */
+declare function observedQuality(quality: ConnectionQuality): string | null;
+/** `[data-meet-participant]` attributes for one person's tile or roster row. */
+declare function participantAttributes(p: MeetParticipant): Record<string, string>;
+/** The listen-only notice's contract code, from why the microphone is off. */
+declare function microphoneNoticeCode(track: LocalTrackState): "mic-blocked" | "device-lost" | null;
+
+export { ATTENDANCE_CSV_HEADER, AdmissionState, type AnnounceResult, type ApplyRoomEventArgs, type AskArgs, type AttendanceKind, type AttendanceRow, type AudioProcessing, CALL_INVITE_KIND, CALL_INVITE_VERSION, CONSENT_NOTICE_ATTRIBUTE, type CallCenter, type CallCenterOptions, CallId, CallInvite, type CallInviteHandlerOptions, type CallInvitePayload, CallMode, CallState, type CollabAction, CollabPanel, type CollabRequest, type CollabResult, type CollabRuntime, CollabSnapshot, type CollabStoreLike, ConnectionQuality, type CreateCallInviteInput, type CreateMeetingInput, DATA_TOPICS, DEFAULT_EFFECTS, DEFAULT_PAGE_SIZE, type DataTopic, type DeviceKind, type DeviceManager, type DeviceManagerOptions, type DeviceSnapshot, type DeviceStorage, type DriverConnectionState, type DriverParticipant, type DriverTrackKind, type DriverTranscription, END_MEETING_NOT_SERVED, type EffectsStorage, type EndMeetingResult, type FollowUpDraft, type FollowUpRecipient, type FollowUpSendResult, GUEST_RECORD_ACCESS_CHOICES, GUEST_RECORD_ACCESS_LEVELS, GUEST_RECORD_ACCESS_METADATA_KEY, GUEST_RECORD_NOT_SHARED, type GuestRecordAccess, type GuestRecordAccessResolution, type GuestRecordAccessSetting, IDLE_MEDIA, IDLE_TRACK, type InRoomClient, type InRoomClientOptions, InviteeInput, InviteeRole, type JoinRequest, LISTEN_ONLY_NOTICE, type LibraryRecording, type LiveKitDriverOptions, LobbyEntry, type LocalMediaState, type LocalTrackState, MEETING_INVITE_KIND, MEETING_INVITE_VERSION, MEETING_RECORD_GRACE_MS, MEET_ANSWER_CONTEXT_EVENT, MEET_ANSWER_EVENTS, MEET_EVENTS, MEET_REACTIONS, MEET_ROUTES, MEET_SCHEMA, MODERATION_ACTIONS, type MediaDevicesLike, type MediaEffects, type MediaUnavailable, type MeetAi, type MeetAiAnswer, type MeetAiOptions, type MeetAnswerCoverage, MeetApi, type MeetDevice, MeetError, type MeetErrorCode, type MeetEvent, type MeetGrants, MeetIdentity, type MeetObservation, MeetParticipant, type MeetRepository, type MeetRoomDriver, type MeetSnapshot, type MeetStore, MeetingAttendee, MeetingChanges, type MeetingChatHistory, MeetingId, type MeetingInviteHandlerOptions, type MeetingInvitePayload, MeetingInvitee, MeetingKind, MeetingNote, MeetingOccurrence, MeetingRecord, type MeetingRecordAnswer, type MeetingRecordBundle, type MeetingRecordCache, type MeetingRecordChange, type MeetingRecordFailure, type MeetingRecordParts, type MeetingRecordRestriction, type MeetingRecordRestrictionNotice, type MeetingRecordState, type MeetingSearchHit, type MeetingSearchSource, type MeetingSession, type MeetingSessionOptions, MeetingSettings, type ModerationAction, type ModerationNotice, type ModerationRequest, type ModerationResult, NOTE_TAKER_IDENTITY_PREFIX, NOTE_TAKER_METADATA_KEY, NO_GRANTS, type NameBook, type NoteTakerDispatch, type NoteTakerRefusal, NoteTakerState, type NoteTakerStatus, type ObserveInput, type ObservedConnection, type ObservedPhase, OccurrenceOverride, OrganizationId, PARTICIPANT_CAN_RECORD_ATTRIBUTE, PARTICIPANT_ROLE_ATTRIBUTE, ParticipantIdentity, ParticipantRole, REACTION_TTL_MS, REFUSED_ABSENCE, ROOM_EVENTS, ROOM_EVENT_PREFIX, ROOM_TOKEN_HEADER, RPCS, type RecordingController, type RecordingControllerOptions, RecordingPolicy, RecordingRecord, RecordingState, type RepositoryOptions, type RoomChatMessage, type RoomDriverFactory, type RoomDriverHandlers, type RoomEngine, type RoomEngineOptions, type RoomEventOutcome, type RoomEventTopic, RoomName, RoomPhase, type RoomReaction, type RoomToken, type RoomTokenStorage, RsvpAnswer, RsvpInvitation, type ScheduleMeetingInput, type Stage, type StageArgs, StageLayout, TABLES, TRANSCRIPTION_ATTRIBUTES, TRANSCRIPTION_TOPIC, type TokenClient, type TokenClientOptions, type TokenRequest, type TranscriptBlock, type TranscriptFormat, type TranscriptMatch, TranscriptSegment, UpcomingOccurrence, UserId, type VideoEffect, WrapUpAnnouncement, type WrapUpStatus, absenceSentence, activeWrapUpSummary, activityAttention, announceMeeting, applyRoomEvent, assembleMeetingRecord, attendanceCsv, attendanceReport, attendanceTotals, attendeeKey, availableActivities, callInviteAction, callInviteText, callStateLabel, canModerate, canModerateParticipant, canTransition, captionSegment, changesPatch, clockPosition, computeStage, countLabel, createCallCenter, createCallInviteHandler, createDeviceManager, createInRoomClient, createLiveKitDriver, createMeetAi, createMeetRepository, createMeetStore, createMeetingInviteHandler, createMeetingRecordCache, createMeetingSession, createMemoryDeviceStorage, createRecordingController, createRoomEngine, createTokenClient, createWebDeviceStorage, createWebEffectsStorage, createWebRoomTokenStorage, displayNameFor, gridColumns, groupTranscript, guestRecordAccessExplanation, guestRecordAccessLabel, guestRecordAccessSetting, hasEnded, hostUserIds, invalidResponse, isGuestIdentity, isListenOnly, isNoteTaker, isRealName, isRoomEventTopic, learnName, learnNames, listenOnlyNotice, loadFollowUpDraft, loadGuestMeetingRecord, loadMeetingChat, loadMeetingRecord, loadMeetingRecordParts, mapConnectionState, mapQuality, meetingInviteAction, meetingLength, meetingLink, meetingPath, meetingSlug, meetingTopic, meetingWhen, mergeCaption, mergeRecord, microphoneNoticeCode, moveToRoom, nextTranslationBatch, normalizeDeviceError, normalizeMeetError, normalizeSpoken, noteTakerIdentity, noteTakerLabel, noteTakerParticipant, noteTakerStatus, notesDocument, observe as observeMeeting, observedDevice, observedPhase, observedQuality, orderParticipants, parseRoomToken, participantAttributes, participantSummary, performCollab, playableRecordingFileId, projectInvitee, projectLibraryRecording, projectNote, projectOccurrence, projectOverride, projectParticipant, projectRsvpInvitation, projectSearchHit, projectSegment, projectUpcoming, pushMeetingToGoogleCalendar, readServerRefusal, readableTranscript, recordingLabel, recordingNotice, recordingOffsetMs, roleOf, roomTopic, rootAttributes, searchTranscript, sendFollowUp, setCaptionLanguage, setGuestRecordAccess, settingsPatch, snapshotParticipant, snippetRuns, staticObservation, summarizeMeetingRecordRestrictions, takeMoveRequest, takePanelRequest, transcriptDocument, unavailableFrom, uniqueAttendees, untranslatedLines, userTopic, wasRefused, wrapUpStatus };