@buildaharness/aielia 0.3.3 → 0.3.5

package/dist/layer-policy-wiring.d.ts

@@ -0,0 +1,77 @@
+import { LayerPolicy, LayerPolicyMode, OptInLayer, PolicyBudget, PolicyRules, RunState, TurnSignals, TurnTier } from '@buildaharness/harness';
+import { TurnIntentClassification } from './turn-intent-classifier.js';
+/**
+ * The opt-in layers (default OFF, one `AUDIT_*` flag each) the operator has switched on. Each flag is still read
+ * where the layer runs; this only tells the policy which ones exist this turn so its record is true.
+ */
+export declare function enabledOptInLayers(env?: Record<string, string | undefined>): OptInLayer[];
+/**
+ * Whether an opt-in layer runs this turn. Restrict-only (AL-1): the layer's own `AUDIT_*` flag must be on (`flagOn`) AND the
+ * plan must not have switched it `off` (`budget_exhausted`) — a plan can never turn a disabled layer on. Only an `adaptive`
+ * plan exists (`resolveOptInPlan`); with none, or a decision the plan lacks, or a plan that throws, the flag alone decides,
+ * i.e. today's behaviour.
+ */
+export declare function optInLayerEnabled(layer: OptInLayer, flagOn: boolean, plan: EscalationPlan | undefined): boolean;
+/**
+ * The plan the opt-in layers are gated by, resolved once per turn right after classification — before the tool-less draft
+ * and the harness run, which is where the earliest opt-in call sits. Their decisions depend only on which are enabled and on
+ * the per-turn call budget (risk and posture), none of which needs the task graph, so the minimal signals here give the same
+ * answer the harness's own plan would. `undefined` unless `adaptive`: static and shadow execute today's behaviour.
+ */
+export declare function resolveOptInPlan(mode: LayerPolicyMode, classification: TurnIntentClassification): EscalationPlan | undefined;
+export declare const SEMANTIC_ESCALATIONS: readonly ["semantic_contradiction", "failure_match", "criterion_coverage", "change_review", "model_inferred_facts"];
+export type SemanticEscalation = (typeof SEMANTIC_ESCALATIONS)[number];
+export declare const ESCALATION_ENV: Readonly<Record<SemanticEscalation, string>>;
+/** `true`/`false` when the operator set the env var explicitly; `undefined` when unset/empty. */
+export declare function explicitEnvOverride(varName: string, env?: Record<string, string | undefined>): boolean | undefined;
+export interface EscalationPlan {
+    mode: LayerPolicyMode;
+    tier: TurnTier;
+    /** The policy that executes (static under static/shadow). */
+    policy: LayerPolicy;
+    /** Under shadow only: what adaptive would have decided. Recorded, never acted on. */
+    shadow?: {
+        policy: LayerPolicy;
+        tier: TurnTier;
+    };
+}
+/** AL9a: the per-turn LLM-call budget view for a turn's signals (risk- and posture-scaled). Static mode ignores it. */
+export declare function turnPolicyBudget(signals: TurnSignals): PolicyBudget;
+/** Resolves the executed policy for a turn. Never throws; any failure ⇒ today's static behaviour. */
+export declare function resolveEscalationPlan(mode: LayerPolicyMode, signals: TurnSignals, state: RunState | undefined, rules?: PolicyRules, budget?: PolicyBudget): EscalationPlan;
+/**
+ * Whether `layer`'s semantic (LLM) form runs this turn. `cheap` is a non-linguistic form, so for
+ * these layers only `full` runs the LLM hook. An explicit env override wins; a missing/broken plan
+ * keeps today's behaviour (ON).
+ */
+export declare function escalationEnabled(layer: SemanticEscalation, plan: EscalationPlan | undefined, env?: Record<string, string | undefined>): boolean;
+/**
+ * Whether a semantic escalation hook is supplied to the harness at all: unless the operator's explicit `AUDIT_*` value switches
+ * it off. The plan no longer decides this — it is consulted per call (`HarnessRunOptions.hookEnabled`), so a hook the opening
+ * plan would have left off can still run once mid-turn evidence changes the plan. With a static plan the result is exactly
+ * what `escalationEnabled` gave (the plan says `full`, so only the env override mattered).
+ */
+export declare function escalationHookWired(layer: SemanticEscalation, env?: Record<string, string | undefined>): boolean;
+/** The policy the harness runtime's ad hoc gates read: only an executed `adaptive` policy differs from today's. */
+export declare function harnessGatePolicy(plan: EscalationPlan | undefined): LayerPolicy | undefined;
+/**
+ * Decomposition reframe (`reframeTaskDescriptionWithLLM`). Precedence: explicit `AUDIT_DECOMPOSITION`
+ * env > the policy's decision > today's ON. `cheap` has no LLM-free form ⇒ off (only `full` reframes).
+ */
+export declare function decompositionReframeEnabled(plan: EscalationPlan | undefined, env?: Record<string, string | undefined>): boolean;
+/**
+ * LLM injection detection on fetched content (AL-1 security rule). Skippable ONLY on a
+ * non-linguistic proof of safety: no untrusted content in context, or no tool-capable next step.
+ * Anything the policy says short of `full` without such a proof is overridden back to ON — the
+ * check never trusts a message/LLM-derived signal, and the wiring re-verifies what
+ * `resolveLayerPolicy` already clamps so a hand-built plan cannot bypass it.
+ */
+export declare function injectionDetectionEnabled(plan: EscalationPlan | undefined, proof: {
+    untrustedContentInContext: boolean;
+    toolCapableNextStep: boolean;
+}): boolean;
+/** One-line reason a layer's decision is worth surfacing (escalated / skipped-with-reason), or `undefined` when routine. */
+export declare function decisionNote(event: {
+    decision?: string;
+    trigger?: string;
+}): string | undefined;

package/dist/layer-settings.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The user-facing on/off surface for reasoning layers, shared by the CLI (`/layers`) and the desktop/browser
+ * Settings screen. It is a thin layer over the existing `AUDIT_*` env flags, which every layer already reads in
+ * exactly one place: `applyLayerSettings` writes the persisted `config.layers` choices into an env object, so no
+ * layer needed a second code path. An env value the operator set themselves always wins and renders as pinned,
+ * the same precedence `explicitEnvOverride` already gives it.
+ *
+ * Floor layers (safety, approval, tool policy, verification, diagnostics) are listed but locked: there is no
+ * flag for them and the adaptive policy's types make them un-decidable on purpose.
+ */
+export type LayerGroup = 'escalation' | 'opt_in' | 'floor';
+export interface LayerSetting {
+    id: string;
+    group: LayerGroup;
+    /** The env flag that carries the choice; absent for locked layers. */
+    flag?: string;
+    /** What the layer does when the user hasn't chosen. */
+    defaultOn: boolean;
+    summary: string;
+    /** Rough extra cost when it fires, in plain words. */
+    cost: string;
+    /** What the audit found, in plain words — the record, not a promise. */
+    evidence: string;
+}
+export declare const LAYER_SETTINGS: readonly LayerSetting[];
+export type LayerChoices = Readonly<Record<string, boolean>>;
+export declare function findLayer(id: string): LayerSetting | undefined;
+/** The layers a user may change: everything except the locked floor. */
+export declare function isToggleable(layer: LayerSetting): boolean;
+type Env = Record<string, string | undefined>;
+export interface AppliedLayers {
+    /** Layer ids whose env flag was set outside this module (shell env / build var), so the saved choice is ignored. */
+    pinned: Set<string>;
+}
+/**
+ * Makes `env` reflect `choices`. Idempotent: a layer no longer in `choices` is restored to unset, and a flag that
+ * holds a value this module did not write is left alone and reported as pinned. Unknown ids and locked layers are ignored.
+ */
+export declare function applyLayerSettings(choices: LayerChoices | undefined, env: Env): AppliedLayers;
+/** What a layer will do right now: the saved choice, else its default; a pinned layer reports its env value. */
+export declare function effectiveState(layer: LayerSetting, choices: LayerChoices | undefined, pinned: ReadonlySet<string>, env: Env): boolean;
+/** Returns the choices after setting one layer; throws on an unknown or locked id so a typo never silently persists. */
+export declare function withLayerChoice(choices: LayerChoices | undefined, id: string, on: boolean | undefined): Record<string, boolean>;
+export declare class LayerSettingError extends Error {
+}
+/** Drops anything in a persisted value that is not a known toggleable layer with a boolean, so a stale or hand-edited file can't smuggle junk in. */
+export declare function sanitizeLayerChoices(raw: unknown): Record<string, boolean>;
+export declare function formatLayerListing(choices: LayerChoices | undefined, pinned: ReadonlySet<string>, env: Env): string;
+export {};

package/dist/layer-telemetry.d.ts

@@ -0,0 +1,2 @@
+import { ExperienceStore, LayerTelemetryRow } from '@buildaharness/harness';
+export declare function recordLayerTelemetry(store: ExperienceStore, row: LayerTelemetryRow | undefined, key: string): void;

package/dist/lexical/lexical-mode.d.ts

@@ -0,0 +1,29 @@
+export declare const LEXICAL_FAMILIES: readonly ["fact-markers", "coding-fact", "injection", "enumeration", "risk", "task-cancel", "plan-mode", "batch-list", "tool-yield", "template-keywords"];
+export type LexicalFamily = (typeof LEXICAL_FAMILIES)[number];
+/** The families `lexicalMode: 'disabled'` (the default) switches off: all of them. */
+export declare const LEXICAL_CHECK_FAMILIES: readonly LexicalFamily[];
+export type LexicalMode = 'enabled' | 'disabled';
+export declare const DEFAULT_LEXICAL_MODE: LexicalMode;
+type EnvLike = Record<string, string | undefined>;
+export declare function isLexicalFamily(v: string): v is LexicalFamily;
+/** Unset/empty ⇒ default silently; an unrecognized value ⇒ default with a warning. */
+export declare function resolveLexicalMode(env?: EnvLike): LexicalMode;
+/** Every family currently switched off: named in OFF, or not named in ON while the mode is disabled. */
+export declare function resolveLexicalOff(env?: EnvLike): ReadonlySet<LexicalFamily>;
+/** True only if this family is switched on. */
+export declare function lexicalActive(family: LexicalFamily, env?: EnvLike): boolean;
+/**
+ * The off families as a comma list, for handing to an out-of-process helper (the MCP server). Always
+ * pass it, even empty: the helper reads an unset variable as "every family off" (the default) and an
+ * empty one as "none off".
+ */
+export declare function lexicalOffEnvValue(env?: EnvLike): string;
+/**
+ * Hands this mode to the harness package's own lexical switch (`setHarnessLexicalMode`), so
+ * `ASSISTANT_LEXICAL_MODE=enabled` turns the harness's checks back on too. Works in a browser as well
+ * as in Node (it sets no environment variable), and an explicit HARNESS_LEXICAL_MODE /
+ * HARNESS_LEXICAL_ON / HARNESS_LEXICAL_OFF still wins inside the harness. Called at the start of every
+ * harness run.
+ */
+export declare function syncHarnessLexicalEnv(env?: EnvLike): void;
+export {};

package/dist/live-steering-channel.d.ts

@@ -0,0 +1,31 @@
+/**
+ * R1 (mid-task steering) of plans/hierarchical_goal_tree_and_steering_plan.html — a message sent
+ * while a turn is already running is absorbed here instead of waiting for the CLI's
+ * `dispatchQueue` or chat-ui's disabled composer to free up (see Figure 1 of that plan). One
+ * instance per session, mirroring `OneShotAnswerChannel`'s per-session lifetime
+ * (ask-clarification-service.ts) but with a different shape: that channel resumes a *paused* run
+ * with exactly one answer, this one accumulates zero or more raw steering messages while a turn
+ * keeps running and hands them all back at once.
+ *
+ * Phase 3 only builds the queue and the producer-side routing (cli.ts's line-handler split,
+ * chat-ui's composer un-disabling) — `poll()` has no consumer yet. Phase 4 wires it into
+ * `checkCallerUpdates` via the Scope×Urgency classifier at the harness's own iteration boundary
+ * (`UpdateChannel.poll()` in check-caller-updates.ts), turning each drained message into a real
+ * `CallerUpdate`. This class is deliberately unaware of `GoalGraphRecord`/`GoalThread` — same
+ * "standalone, unused until the wiring phase" discipline `goal-identity-matcher.ts` (Phase 2)
+ * already used.
+ */
+export interface SteeringEvent {
+    message: string;
+    enqueuedAt: number;
+}
+export declare class LiveSteeringChannel {
+    private queue;
+    enqueue(message: string): void;
+    /**
+     * Drains every event queued since the last poll, oldest first (FIFO) — never partial, never
+     * re-delivered: a second call with nothing newly enqueued returns an empty array.
+     */
+    poll(): SteeringEvent[];
+    get pendingCount(): number;
+}

package/dist/memory-consolidation.d.ts

@@ -0,0 +1,80 @@
+import { ILLMClient, TokenUsage } from '@buildaharness/runtime';
+import { UserFact } from './fact-extraction.js';
+/**
+ * Memory consolidation and staged forgetting (M5 of the agent memory framework plan).
+ *
+ * Pure pieces only: the flag, the retention window, the bounded model pass that PROPOSES changes, and
+ * the deterministic archive-candidate rule. Applying a proposal lives in MemoryService (the only
+ * place allowed to write the durable store, through `commitDurable`). Nothing here writes anything.
+ *
+ * D2: no lexical similarity anywhere. Whether two facts overlap is the model's judgement; the only
+ * deterministic rule is on the usage fields M1 added (timestamps and counters), never on text.
+ */
+/** `AUDIT_MEMORY_CONSOLIDATION`: default OFF; `1/true/on/yes/enabled` enables. Read fresh each call. */
+export declare function memoryConsolidationEnabled(env?: Record<string, string | undefined>): boolean;
+/** D4: retention window, start 90 days, to be calibrated. `AUDIT_MEMORY_RETENTION_DAYS` overrides (a positive number). */
+export declare const DEFAULT_MEMORY_RETENTION_DAYS = 90;
+export declare function memoryRetentionDays(env?: Record<string, string | undefined>): number;
+export type ProposalKind = 'merge' | 'supersede' | 'tighten' | 'archive';
+/** A staged change waiting for the user (`/memory consolidate accept|dismiss <n>`). Nothing here has been applied. */
+export interface ConsolidationProposal {
+    id: string;
+    kind: ProposalKind;
+    /** `text|extractedAt` ids of the durable facts the proposal touches. */
+    factIds: string[];
+    /** merge/tighten: the replacement wording. */
+    text?: string;
+    /** supersede: the id of the fact that replaces the retired ones in meaning (informational). */
+    by?: string;
+    reason: string;
+    createdAt: string;
+    /** True when any touched fact is `user_asserted`: the user said it themselves, so the UI must say so. */
+    touchesUserAsserted: boolean;
+}
+export interface ConsolidationState {
+    /** Highest audit seq already considered. The audit log's rotation keeps everything newer than this. */
+    lastSeq: number;
+    at?: string;
+    nextProposalNo?: number;
+    /** Signatures of proposals the user dismissed, so the same proposal is not raised again. */
+    dismissed?: string[];
+}
+export interface RawProposal {
+    kind: 'merge' | 'supersede' | 'tighten';
+    refs: string[];
+    text?: string;
+    by?: string;
+    reason: string;
+}
+export interface ConsolidationInput {
+    facts: Array<{
+        ref: string;
+        text: string;
+        source: string;
+        key?: string;
+        injectedCount?: number;
+        lastInjectedAt?: string;
+    }>;
+    recentChanges: Array<{
+        op: string;
+        text: string;
+    }>;
+    budget: {
+        usedChars: number;
+        budgetChars: number;
+    };
+}
+export declare const CONSOLIDATION_SYSTEM_PROMPT: string;
+/**
+ * One bounded call proposing merges, supersessions and tightenings. Returns the validated proposals,
+ * or `undefined` when the call failed or its answer was unusable (the caller then changes nothing,
+ * not even the watermark, so the next run retries). Anything the model returns that does not name
+ * real refs, repeats a ref, or has the wrong shape for its kind is dropped individually.
+ */
+export declare function proposeConsolidationOps(input: ConsolidationInput, llmClient: ILLMClient, model?: string, onUsage?: (usage: TokenUsage) => void): Promise<RawProposal[] | undefined>;
+/**
+ * Deterministic archive rule over M1's usage fields, never over text: a live fact whose last sign of
+ * use (`lastInjectedAt`, else when it was stated) is older than the retention window. "Injected" means
+ * "was in the prompt", which is weaker than "was used"; the proposal says so rather than claiming usage.
+ */
+export declare function findArchiveCandidates(facts: UserFact[], nowMs: number, windowDays: number): UserFact[];

package/dist/memory-governance.d.ts

@@ -0,0 +1,30 @@
+import { UserFact } from './fact-extraction.js';
+/**
+ * M6 governance: WHERE a candidate memory write is allowed to land. Pure and structural: it reads
+ * the fact's own `source`/`confidence`/`durable` bits and the configured mode, never its wording
+ * (D2: no lexical checks). `MemoryService` is the only caller (`memoryWriteMode` is resolved in
+ * MemoryService only), so no writer can pick its own route.
+ *
+ * - `auto`      model-inferred in-turn facts follow today's confidence policy; cross-turn writers
+ *               (digest/reviewer/consolidation, M3/M4/M5) may add durable facts directly.
+ * - `staged`    (default, D1) in-turn writer keeps today's policy; every cross-turn writer is
+ *               staged in the pending queue. Nothing is auto-deleted.
+ * - `user_only` the model never creates a durable fact on its own: every model-inferred candidate
+ *               that would have been durable waits in the pending queue for `/memory confirm`.
+ *               Facts the user stated in their own words (`user_asserted`) are the user writing.
+ */
+export type MemoryWriteMode = 'auto' | 'staged' | 'user_only';
+export declare const MEMORY_WRITE_MODES: readonly MemoryWriteMode[];
+export declare const DEFAULT_MEMORY_WRITE_MODE: MemoryWriteMode;
+/**
+ * Which writer produced the candidate. `in_turn` is the classifier/lexical pass that already
+ * exists. The other three are EXTENSION POINTS owned by later phases: M3 digests (`digest`), M4's
+ * post-turn reviewer (`reviewer`), M5 consolidation proposals (`consolidation`). They are routed
+ * by `MemoryService.submitCandidate()` and are not built here.
+ */
+export type MemoryWriter = 'in_turn' | 'digest' | 'reviewer' | 'consolidation';
+export type CrossTurnWriter = Exclude<MemoryWriter, 'in_turn'>;
+export type WriteRoute = 'durable' | 'pending' | 'session';
+/** Unknown / absent values resolve to the default instead of throwing: a typo must never silently widen write authority. */
+export declare function resolveMemoryWriteMode(raw: unknown): MemoryWriteMode;
+export declare function resolveWriteRoute(mode: MemoryWriteMode, writer: MemoryWriter, fact: Pick<UserFact, 'source' | 'durable' | 'confidence'>): WriteRoute;

package/dist/memory-reviewer.d.ts

@@ -0,0 +1,114 @@
+import { ChatMessage, ILLMClient, TokenUsage } from '@buildaharness/runtime';
+import { MemoryService, StageReviewerResult } from './memory-service.js';
+import { UserFact, CandidateJudgement } from './fact-extraction.js';
+import { FactCategory } from './turn-intent-classifier.js';
+/**
+ * M4 of the agent memory framework plan: a post-turn, cross-turn memory reviewer. The in-turn writer already catches a
+ * fact stated in one message; the only thing this adds is aggregation across turns (a preference enforced by repetition,
+ * a decision that held). It reads the session's USER messages only (the injected memory block stripped), proposes typed
+ * operations, has each judged by a bounded semantic verifier, and hands the survivors to `MemoryService.stageReviewerOps`,
+ * which stages them in the pending queue with their evidence (decision D1). No keyword, regex or substring judgement of
+ * natural language anywhere here: language is judged by the two model calls, structure by plain code.
+ *
+ * Integration point for M3 (episodic digests): `ReviewerInput.digests` is accepted and passed to the reviewer as
+ * additional context but nothing populates it yet; M3's session-edge digest can feed it without changing this module.
+ */
+/** `AUDIT_MEMORY_REVIEWER`: default **OFF** (opt-in layer; M4 always ships off). `1`/`true`/`on`/`yes`/`enabled` enables. */
+export declare function memoryReviewerEnabled(env?: Record<string, string | undefined>): boolean;
+/** `AUDIT_MEMORY_REVIEWER_VERIFY`: the bounded verifier call. Default ON when the reviewer runs; a falsy value skips it (the negative control: ops are then staged unverified). */
+export declare function memoryReviewerVerifyEnabled(env?: Record<string, string | undefined>): boolean;
+/** `AUDIT_MEMORY_REVIEWER_EVERY`: review every N user turns. Default 5 (to be calibrated in the pilot). */
+export declare const DEFAULT_REVIEW_EVERY = 5;
+export declare function memoryReviewerEvery(env?: Record<string, string | undefined>): number;
+/** Most operations one review may stage; a bound on the output, not a language judgement. */
+export declare const MAX_REVIEW_OPS = 5;
+export type ReviewScope = 'general' | 'this_context';
+export type ReviewVerification = 'supported' | 'unsupported' | 'not_checked';
+/** One typed operation the reviewer proposes. `evidence` is the user's own words; it is stored and shown, never string-matched. */
+export interface ReviewOp {
+    kind: 'upsert' | 'retire' | 'noop';
+    /** upsert: stable model-chosen key for a single-valued attribute (M1 supersession). */
+    key?: string;
+    /** upsert: the claim, phrased to preserve what the user said ("asked for X in this context" unless they stated a general preference). */
+    text?: string;
+    /** retire: the `id` of the existing fact (from the list the reviewer was shown) to propose retiring. */
+    targetId?: number;
+    evidence?: string;
+    scope?: ReviewScope;
+    category?: FactCategory;
+    judgement?: CandidateJudgement;
+}
+export interface VerifiedReviewOp extends ReviewOp {
+    verification: ReviewVerification;
+    /** Verifier's one-line reason when it said unsupported. */
+    reason?: string;
+}
+export interface ReviewerInput {
+    /** The session transcript; only `user` messages are read as claims. */
+    transcript: readonly ChatMessage[];
+    /** Block last injected into the prompt; removed verbatim from every user message (feedback-loop prevention). */
+    injectedBlock: string;
+    /** Current durable facts, shown to the reviewer so a retire can name its target. `id` is the index the reviewer uses. */
+    existingFacts: readonly {
+        id: number;
+        text: string;
+        source: string;
+    }[];
+    /** M3 integration point: episodic digests of earlier sessions, context only. Unused until M3 lands. */
+    digests?: readonly string[];
+}
+/** The user-only digest the reviewer sees: recent turns verbatim, older turns clipped, memory block stripped, total bounded. Pure formatting, no language judgement. */
+export declare function buildUserDigest(transcript: readonly ChatMessage[], injectedBlock: string): string[];
+/** One bounded reviewer call. Returns no ops (never throws) on any error or unparseable output: a failed review writes nothing. */
+export declare function proposeMemoryOps(input: ReviewerInput, llmClient: ILLMClient, model?: string, onUsage?: (usage: TokenUsage) => void): Promise<ReviewOp[]>;
+/**
+ * One bounded verifier call (same shape as grounding-check.ts, fail-open): is each op supported by the user's messages, at
+ * the stated scope, and not a generalisation of a one-off request. Fail-open: an error, an unparseable answer or a missing
+ * verdict leaves the op `not_checked` (it still only reaches the pending queue, never durable memory).
+ */
+export declare function verifyMemoryOps(ops: readonly ReviewOp[], input: ReviewerInput, llmClient: ILLMClient, model?: string, onUsage?: (usage: TokenUsage) => void): Promise<VerifiedReviewOp[]>;
+/** The facts the reviewer must read through `UserFact` shape — re-exported so the staging method has one type to take. */
+export type ReviewerFact = UserFact;
+/**
+ * Trigger bookkeeping: a per-session counter of user turns since the last memory write (or review). Fires on the Nth
+ * turn; a turn in which any memory write occurred resets it (the in-turn writer is already doing the job). Pure state,
+ * no timers: it can only fire when `noteTurn` is called after a turn finished, so it never fires during a turn.
+ */
+export declare class ReviewTrigger {
+    private readonly every;
+    private counts;
+    constructor(every?: () => number);
+    noteTurn(sessionId: string, wroteMemoryThisTurn: boolean): boolean;
+    reset(sessionId: string): void;
+    count(sessionId: string): number;
+}
+export interface ReviewRunResult {
+    proposed: number;
+    stage: StageReviewerResult | undefined;
+    /** The run was aborted (a new turn began) before it wrote anything. */
+    aborted: boolean;
+}
+/**
+ * Orchestrates one review: reviewer call, verifier call, staging. Owns the trigger counter and the single in-flight run,
+ * which `abort()` cancels (checked between every await and again immediately before the writes, so an abort leaves no
+ * partial write). Never throws. LLM usage is reported through `onUsage`, which the host folds into the session's spend.
+ */
+export declare class MemoryReviewer {
+    private readonly memoryService;
+    private readonly llmClient;
+    private readonly model;
+    private readonly getTranscript;
+    readonly trigger: ReviewTrigger;
+    private controller;
+    private inFlight;
+    constructor(memoryService: MemoryService, llmClient: ILLMClient, model: () => string | undefined, getTranscript: (sessionId: string) => Promise<ChatMessage[]>);
+    /** Cancels the run in progress, if any (a new user turn began). */
+    abort(): void;
+    /** Resolves when the run in progress (if any) has finished; for hosts that must not exit mid-review and for tests. */
+    settled(): Promise<void>;
+    /** Starts a review off the caller's critical path and returns immediately. */
+    start(sessionId: string, onUsage?: (u: TokenUsage) => void): void;
+    /** Runs a review to completion (session edge). */
+    runNow(sessionId: string, onUsage?: (u: TokenUsage) => void): Promise<ReviewRunResult>;
+    private run;
+}