@nelsonlongxiang/dsh-open-a2a-net 0.6.36 → 0.6.38

package/lib/types/faces/admin.d.ts

@@ -70,6 +70,10 @@ export interface AdminFaceDeps extends Pick<CanvasNotifyDeps, 'verifyOriginClaim
     }>;
     readonly layoutStore: LayoutStore;
     readonly taskLedger: TaskLedger;
+    readonly enforceRefused?: {
+        reason: string;
+        blockers: readonly string[];
+    };
     /** #114 S6: observe (lazily) and return the /state `authorization` block. */
     readonly authorizationView: () => unknown;
     readonly idempotencyStore: IdempotencyStore;
@@ -140,7 +144,14 @@ export interface AdminFaceDeps extends Pick<CanvasNotifyDeps, 'verifyOriginClaim
     readonly legacyInboundCount: number;
     readonly unboundInboundCount: number;
     readonly boundMissInboundCount: number;
+    readonly boundMissRecent: ReadonlyArray<{
+        caller: string;
+        audience: string;
+        count: number;
+        lastAt: number;
+    }>;
     readonly ownCardUrl: string;
+    ownerSeatNames: Record<string, string>;
     ownerAllowlist: string[];
     ownerTeamScopeInfo: boolean;
     ownerAnnounceRestartPending: boolean;

package/lib/types/faces/canvas-notify.d.ts

@@ -44,7 +44,9 @@ export interface CanvasNotifyDeps {
     readonly canvasStore: CanvasStore;
     readonly cardCache: Map<string, CardCacheEntry>;
     readonly originClaimHeaders: (target: OriginClaimTarget) => Record<string, string>;
-    readonly verifyOriginClaim: (req: IncomingMessage) => Promise<{
+    readonly verifyOriginClaim: (req: IncomingMessage, options?: {
+        readonly rawBody?: Uint8Array;
+    }) => Promise<{
         ok: true;
         caller: string;
         callerUrl: string;

package/lib/types/faces/wire.d.ts

@@ -128,8 +128,10 @@ export interface WireDeps {
     readonly idempotencyStore: IdempotencyStore;
     readonly verifyOriginClaim: (req: IncomingMessage, options?: {
         readonly cli?: boolean;
+        readonly rawBody?: Uint8Array;
     }) => Promise<OriginClaimResult>;
     readonly forwardDirect: (request: ForwardRequest) => Promise<A2aRouteResult>;
+    readonly diagnoseCanvas: (team: string, reason: string, caller?: string) => Promise<string>;
     readonly remoteCliProof: (handle: string, claim: Extract<OriginClaimResult, {
         ok: true;
     }>) => Promise<RemoteCliProof | undefined>;
@@ -168,6 +170,7 @@ export interface WireDeps {
     /** gh#224: refuses a new delivery once the target already owes `targetQueueCap` receipts. */
     readonly refuseIfQueueFull: (caller: string, message: string, team: string, taskId: string, mailbox: boolean, res: ServerResponse) => boolean;
     /** Settles a receipt; returns the enforce refusal of the row its header names (#139), if any. */
+    readonly waitForForwardBirth: (message: string) => Promise<void>;
     readonly settleAndAnnounce: (message: string, settler?: Settler) => SettlementRefusal | undefined;
     readonly touchWakeDemand: () => void;
     readonly session: string;
@@ -198,7 +201,7 @@ export interface WireDeps {
     readonly nativeTeamsRound: (prepared: Extract<NativePrepared, {
         ok: true;
     }>, team: string, caller: string, message: string, taskId: string | undefined, proofClause: string, external?: AbortSignal, proofHeader?: (team: string, taskId: string, from: string, proofClause: string) => string) => Promise<NativeRoundOutcome>;
-    readonly routeIntoAgent: (team: string, message: string, caller: string, taskId?: string, proofClause?: string, directHeader?: (from: string) => string) => Promise<RouteOutcome>;
+    readonly routeIntoAgent: (team: string, message: string, caller: string, taskId?: string, proofClause?: string, directHeader?: (from: string) => string, localFrom?: string, onSteered?: (target: Agent, floor: number) => void) => Promise<RouteOutcome>;
 }
 /**
  * #187: what a verified claim may vouch for at settlement. The signing key always (the card was

package/lib/types/index.d.ts

@@ -91,7 +91,7 @@ export interface Config {
      * (which is left untouched). Inbound faces keep answering. Default false.
      */
     readonly isolated: boolean;
-    /** Forward online local CLI deliveries one hop after a local miss. Default off. */
+    /** Forward online local CLI deliveries one hop after a local miss. Default on from 0.6.38; explicit false opts out. */
     readonly forwardDirect: boolean;
     /** Human-facing name published on the agent card. */
     readonly agentName: string;
@@ -228,6 +228,8 @@ export interface Config {
      * nobody created. Empty list denies every join (default).
      */
     readonly teamJoinAllowlist: string[];
+    /** Human-owned stable display labels keyed by full local session id; never a routing identity. */
+    readonly seatNames: Record<string, unknown>;
     /**
      * S3 (phase-2 default-ON, owner ruling 2026-09-01): route dispatch checks
      * caller↔target shared team membership before addressing; set false to

package/lib/types/origin-claim.d.ts

@@ -4,7 +4,7 @@
  * face (card, /a2a/direct, /a2a/log, /a2a/canvas-op, /a2a/canvas-changed)
  * runs.
  *
- * Two canonical forms ride the same four base headers
+ * Three canonical forms share the base caller headers
  * (X-A2A-Caller / -Url / -Ts):
  *   · bound (v2, §2.1): JSON.stringify([tag, caller, callerUrl, ts,
  *     audience, METHOD, path]) in X-A2A-Caller-Sig2, the audience origin in
@@ -14,7 +14,8 @@
  *   · unbound (v1, legacy): JSON.stringify([caller, callerUrl, ts]) in
  *     X-A2A-Caller-Sig. Emitted and accepted only while the unbound window
  *     is open (originClaimUnboundWindow); accepted ones are counted.
- * Once the window closes a present Sig2 is the only thing verified. While
+ * A present Sig3 requires the exact raw body and v3 signature, with no downgrade.
+ * Without Sig3, once the window closes a present Sig2 is the only thing verified. While
  * it is open, a Sig2 that misses (audience or signature) falls back to the
  * Sig the envelope also carries — no more than stripping Sig2 would give —
  * and the miss is counted, so a peer dialled by an unlisted name keeps
@@ -29,12 +30,16 @@ import type { A2aPeerCard } from './types.ts';
 export declare const ORIGIN_CLAIM_SKEW_MS: number;
 /** Domain tag of the bound form: a v1 signature can never verify as v2. */
 export declare const ORIGIN_CLAIM_BOUND_TAG = "a2a-origin-claim/2";
+export declare const ORIGIN_CLAIM_BODY_TAG = "a2a-origin-claim/3";
+/** Digest the exact UTF-8 string/bytes passed to transport, never reserialized JSON. */
+export declare const originBodySha256: (body: string | Uint8Array) => string;
 /** Where an outbound request goes: the bound form signs both. */
 export interface OriginClaimTarget {
     readonly url: string;
     readonly method: string;
+    readonly body?: string | Uint8Array;
 }
-export type OriginClaimRefusal = 'absent' | 'bad-caller-shape' | 'bad-ts' | 'no-card' | 'bad-sig' | 'not-derivable' | 'wrong-audience' | 'unbound-closed';
+export type OriginClaimRefusal = 'absent' | 'bad-caller-shape' | 'bad-ts' | 'no-card' | 'bad-sig' | 'not-derivable' | 'wrong-audience' | 'unbound-closed' | 'body-mismatch';
 /** Only the canonical origin root can claim that origin's identity. */
 export declare function isRootOriginUrl(value: string): boolean;
 /**
@@ -59,6 +64,8 @@ export type OriginClaimVerdict = {
 export declare function unboundCanonical(caller: string, callerUrl: string, ts: number): string;
 /** The bound (v2) canonical form; method upper-cased, path without query. */
 export declare function boundCanonical(caller: string, callerUrl: string, ts: number, audience: string, method: string, path: string): string;
+/** The body-bound v3 form is domain-separated from v1/v2, with the digest appended. */
+export declare function bodyBoundCanonical(caller: string, callerUrl: string, ts: number, audience: string, method: string, path: string, bodySha256: string): string;
 /** An origin in URL's normal form, or '' when the text is not an http(s) URL. */
 export declare function originOf(url: string): string;
 /** The path a request names, without its query (the bound form signs this). */
@@ -110,10 +117,15 @@ export declare function verifyOriginClaim(req: IncomingMessage, d: {
     /** Count one accepted unbound envelope (the drain gauge). */
     readonly onUnbound: () => void;
     /** Count one bound form that missed and fell back to the unbound one. */
-    readonly onBoundMiss?: () => void;
+    readonly onBoundMiss?: (miss: {
+        readonly caller: string;
+        readonly audience: string;
+    }) => void;
     /** A loopback arrival is an audience of its own (default); off when originClaimUrl declares a tunnel or proxy. */
     readonly loopbackArrival?: boolean;
     readonly now: number;
+    /** Exact received bytes, supplied by the bounded body reader. Missing bytes cannot verify Sig3. */
+    readonly rawBody?: Uint8Array;
     /** On the faces that admit CLI identities: the deposit a claim URL names. */
     readonly cliDeposit?: (callerUrl: string) => CliDepositCard | undefined;
 }): Promise<OriginClaimVerdict>;

package/lib/types/owner-settings.d.ts

@@ -12,7 +12,12 @@ export interface OwnerSettings {
     teamJoinAllowlist?: string[];
     teamScopeInfo?: boolean;
     announce?: boolean;
+    seatNames?: Record<string, string>;
 }
+/** Shared validation for boot config and owner POST; labels are plain text, never handles or authority. */
+export declare function parseSeatNames(value: unknown): Record<string, string> | undefined;
+/** Boot config degrades entry-by-entry; owner POST remains all-or-nothing. Never echo label contents in warnings. */
+export declare function loadSeatNames(value: unknown, warn: (reason: string) => void): Record<string, string>;
 export declare function applyOwnerSettings(patchYaml: string, changes: OwnerSettings): {
     yaml: string;
     restartNeeded: boolean;

package/lib/types/peer-link-display.d.ts

@@ -0,0 +1,13 @@
+/** Host-specific badge projection only. Never use this to admit callers or choose CLI homes. */
+import type { A2aPeerCard } from './types.ts';
+export declare function peerLinkDisplay(peerUrl: string, d: {
+    readonly card: A2aPeerCard | undefined;
+    readonly ownUrl: string;
+    readonly seeds: readonly string[];
+    readonly refs: readonly string[];
+    readonly ownHandles: ReadonlySet<string>;
+    readonly cards: readonly A2aPeerCard[];
+}): {
+    link: 'linked' | 'stranger';
+    verified: boolean;
+};

package/lib/types/task-auth.d.ts

@@ -232,6 +232,8 @@ export interface SettlementRow {
     readonly peerHost?: string;
     /** #139: the member that actually received the task (canvas and bare-zone deliveries). */
     readonly deliveredTo?: string;
+    readonly forwarded?: true;
+    readonly receiverMembers?: readonly string[];
 }
 /** Facts from outside the row. */
 export interface SettlementFacts {

package/lib/types/task-ledger-rows.d.ts

@@ -0,0 +1,352 @@
+/** Stateless ledger row types, classifiers and restore projections; moved verbatim for #258. */
+import { type AuthProof, type ChainRole, type SettlementReason, type SettlementVerdict, type TaskAuthorization } from './task-auth.ts';
+import type { ReceiptOutcomeV2 } from './receipt.ts';
+import type { ConservationSnapshot } from './ledger-conservation.ts';
+/**
+ * Caller-ended summaries (abandon / cancel) share one isolation law: late
+ * receipts never rewrite the verdict — they only stamp lateReceiptAt, and
+ * the projected outcome collapses to 'abandoned'.
+ */
+export declare const CALLER_ENDED_PREFIX: RegExp;
+/** Hard cap on the owed book (pending + dead-lettered rows, most recent first). */
+export declare const TASK_CAP = 64;
+/** Hard cap on the settled archive (most recent kept). */
+export declare const ARCHIVE_CAP = 64;
+/** Longest receipt summary kept on a record (multi-line outcomes collapse). */
+export declare const SUMMARY_CAP = 200;
+/**
+ * Longest dispatch brief kept per row. A ledger row without its payload is
+ * unreadable to supervision — "direct-8f3a1c2b → dsh/ec4ce7f8, 3h old" says
+ * nothing about whether to nudge, abandon, or read the receipt. The brief is
+ * the first non-empty line of the message, capped; the full body never enters
+ * the ledger (it can be arbitrarily large and may quote another session's log).
+ */
+export declare const BRIEF_CAP = 120;
+/** Reduce a dispatch body to one readable line: first non-empty line, collapsed, capped. */
+export declare function briefOf(message: string | undefined): string | undefined;
+/**
+ * Age at which an unsettled task auto-dead-letters. A dead row exits the
+ * owed view, disarms its async-nudge retry (a cold session cannot consume a
+ * re-steer anyway), and still accepts a late receipt from a revived target.
+ * Injectable per instance so tests can use short windows; sweeping stays
+ * lazy — every read/write entry point sweeps first.
+ */
+export declare const TASK_STALE_TTL_MS: number;
+/**
+ * The receipt correlation template now lives in `receipt.ts` (shared codec
+ * for header + v2 envelope line). This ledger consumes `parseReceipt` so
+ * human summaries and machine projections can never drift apart again.
+ */
+/** Lifecycle of a tracked outbound task inside the owed book. */
+export type TaskStatus = 'pending' | 'dead';
+/** F5 layer-3: why a dead row aged out (stamped by the sweep at flip time). */
+export type DeadReason = 'fire-forget' | 'unconsumed';
+/** gh#31: which archive path ended a row — a receipt, a content echo, or the caller. */
+export type ArchiveEnd = 'receipt' | 'echo' | 'abandoned' | 'cancelled' | 'evicted';
+export declare const ARCHIVE_ENDS: readonly string[];
+/** Summary marker {@link TaskLedger.resolveEcho} writes on echo-settled rows. */
+export declare const ECHO_SUMMARY = "(settled by content echo)";
+/**
+ * #114 S3: who really sent one outbound task — the routing session, the
+ * agent-less host face, or a native-teams bridge submitter. Before this
+ * field every outbound row was attributable only to the host ("home"), so
+ * same-host seats could not be told apart.
+ */
+export interface Sender {
+    readonly kind: 'session' | 'host' | 'bridge' | 'cli';
+    /**
+     * A session's `<zone>/<id8>` node team, the host process label, or the
+     * bridge submitter. Group senders by `kind:id`, never by `id` alone: a host
+     * label set by hand may look like a session handle.
+     */
+    readonly id: string;
+    /**
+     * Host senders only: the label the call borrowed on the wire when it
+     * differs from {@link id} (quick dispatch rides a live joined session's
+     * team). Display context, never a bucket key.
+     */
+    readonly face?: string;
+}
+/** Longest sender id kept; anything longer is malformed, not truncated. */
+export declare const SENDER_ID_CAP = 256;
+/**
+ * Restore-side allowlist for one persisted sender: a well-formed value comes
+ * back as a fresh object holding only kind, id and (when present) face; anything else is dropped whole (the row
+ * itself survives — a bad sender never costs the debt record).
+ * @param raw - the persisted value.
+ * @returns the sender, or undefined when absent or malformed.
+ */
+export declare function parseSender(raw: unknown): Sender | undefined;
+/**
+ * Spread helper for restore: `{ sender }` when the persisted value parses and
+ * the row is not inbound (an inbound row's originator is its caller, never a
+ * sender this host recorded), else nothing.
+ */
+export declare function withSender(raw: unknown, direction: unknown): {
+    sender?: Sender;
+};
+/**
+ * #114 S2: `{ auth }` when a persisted INBOUND row carries a record that
+ * parses whole (parseAuthorization) and belongs to THIS row — its target is
+ * the row's team and its receipt target the row's peer — else nothing: the
+ * row survives as a pre-S2 row, never with a partially adopted or borrowed
+ * record.
+ */
+export declare function withAuth(raw: unknown, entry: {
+    direction?: unknown;
+    team?: unknown;
+    peer?: unknown;
+    forwarded?: unknown;
+    sender?: unknown;
+}, now: number): {
+    auth?: TaskAuthorization;
+};
+/** Routing and answer facts copied unchanged between a row and its archive entry. */
+export declare function routingOf(row: Pick<TaskRecord, 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded' | 'answeredAt' | 'receiverMembers'>): Pick<TaskRecord, 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded' | 'answeredAt' | 'receiverMembers'>;
+/** #139: what an outbound row is born with besides its sender. */
+export interface OutboundBirth {
+    readonly forwarded?: true;
+    /** Local-candidate admission, or a forwarded online CLI's verified wire admission. */
+    readonly auth?: TaskAuthorization;
+    readonly peerKey?: string;
+    readonly peerHost?: string;
+    readonly deliveredTo?: string;
+    /** Verified selected peer canvas membership at dispatch; actual deliveredTo remains stricter when available. */
+    readonly receiverMembers?: readonly string[];
+}
+/** The facts of one outbound birth that fit the row (see {@link withRouting} for the same shape on restore). */
+export declare function birthFacts(peer: string, birth: OutboundBirth | undefined, team?: string, sender?: Sender, now?: number, warn?: (message: string) => void): Pick<TaskRecord, 'auth' | 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded' | 'receiverMembers'>;
+/** Bound on a persisted routing fact; anything longer (or empty, or not a string) is dropped on restore. */
+export declare const ROUTING_FACT_CAP = 256;
+export declare function parseReceiverMembers(value: unknown, warn?: (message: string) => void): readonly string[] | undefined;
+/**
+ * #139: restore-side allowlist for the routing facts. Each is kept only in
+ * its shape — a non-empty string within the cap — and the peer facts only on
+ * a remote outbound row; anything else is dropped (the row survives as one
+ * born before the fields, judged by current membership and origin).
+ */
+export declare function withRouting(entry: Record<string, unknown>, warn?: (message: string) => void): Pick<TaskRecord, 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded' | 'answeredAt' | 'receiverMembers'>;
+/** One tracked outbound task still in the owed book (unsettled). */
+export interface TaskRecord {
+    readonly taskId: string;
+    readonly team: string;
+    readonly peer: string;
+    readonly startedAt: number;
+    /**
+     * Which side of the wire this row serves: 'outbound' (this node sent and
+     * awaits a receipt) or 'inbound' (this node received and owes one).
+     * Absent on rows persisted before F2' — those are outbound by birth.
+     */
+    readonly direction?: 'inbound' | 'outbound';
+    /**
+     * F5: whether a receipt is actually owed. Absent ⇒ true (back-compat).
+     * `false` marks fire-and-forget deliveries — the caller's label could not
+     * receive a receipt at dispatch (process-form label), so no debt was born
+     * and supervision must not chase this row.
+     */
+    readonly receiptExpected?: boolean;
+    /** The conversation the delivery steered, for follow-up routes. */
+    readonly contextId?: string;
+    /**
+     * Head of the dispatched message (first non-empty line, {@link BRIEF_CAP}).
+     * What the row is ABOUT — the fact that makes the ledger readable without
+     * replaying the conversation. Absent on rows persisted before this field.
+     */
+    readonly brief?: string;
+    /** #114 S3: the real sender of an outbound row (absent on inbound rows and rows persisted before the field). */
+    readonly sender?: Sender;
+    /** Home host forwarded an online CLI request to a peer. */
+    readonly forwarded?: true;
+    /**
+     * #114 S2: the immutable authorization the row was born with — an inbound
+     * row's wire admission, or (#139) an outbound row's local-candidate
+     * admission (`ingress: 'local'`). Absent on remote outbound and older rows.
+     */
+    readonly auth?: TaskAuthorization;
+    /** #139: the public key of the peer card a remote outbound row was dispatched to. */
+    readonly peerKey?: string;
+    /** #139: that card's session label (the peer host's process label). */
+    readonly peerHost?: string;
+    /** #139: the member that actually received the task (canvas / bare-zone deliveries). */
+    readonly deliveredTo?: string;
+    /** Verified selected peer canvas membership at dispatch; actual deliveredTo remains stricter when available. */
+    readonly receiverMembers?: readonly string[];
+    /** Local target has produced an answer; still owed until receipt delivery/settlement, but no longer queued. */
+    answeredAt?: number;
+    status: TaskStatus;
+    /** When the row was swept to dead-letter (absent while pending). */
+    deadAt?: number;
+    /**
+     * F5 layer-3: why the row aged out. 'fire-forget' — a receiptExpected:false
+     * row expiring is expected bookkeeping, not a failure; 'unconsumed' — a
+     * receipt-owed row never settled, the actionable stale shape. Absent on
+     * dead rows persisted before this field (rendered as 'unspecified').
+     */
+    reason?: DeadReason;
+}
+/** One settled task kept for audit, with its receipt-correlated outcome. */
+export interface ArchivedRecord {
+    readonly taskId: string;
+    readonly team: string;
+    readonly peer: string;
+    readonly startedAt: number;
+    readonly contextId?: string;
+    readonly resolvedAt: number;
+    readonly summary?: string;
+    /** Head of the dispatched message that this row settled (see {@link TaskRecord.brief}). */
+    readonly brief?: string;
+    /** Controlled vocabulary verdict when the settling receipt carried a v2 envelope; forced 'abandoned' for caller-abandoned rows. */
+    readonly outcome?: ReceiptOutcomeV2 | 'abandoned';
+    /** Remote-turn wall-clock cost, when the settling envelope carried it. */
+    readonly elapsedMs?: number;
+    /**
+     * When a receipt arrived for an explicitly abandoned row ({@link TaskLedger.abandon}).
+     * Orphan isolation: the abandonment outcome stays verbatim; the late answer is
+     * recorded as metadata only, never promoted to resolution.
+     */
+    readonly lateReceiptAt?: number;
+    /**
+     * gh#31: which archive path ended the row, recorded at archive time. Absent
+     * on rows archived before the field — {@link archivedEndedBy} derives it.
+     */
+    readonly endedBy?: ArchiveEnd;
+    /** gh#31: which side of the wire the row served, copied from the owed row (absent on rows archived before the field). */
+    readonly direction?: 'inbound' | 'outbound';
+    /**
+     * gh#68: copied from the owed row when it awaited no receipt, so a tidied
+     * fire-forget expiry is not read as a send we gave up on. Only `false` is
+     * ever stored; absent means a receipt was owed (or the row predates the field).
+     */
+    readonly receiptExpected?: false;
+    /** #114 S3: copied from the owed row (absent on inbound rows and rows archived before the field). */
+    readonly sender?: Sender;
+    /** Home host forwarded an online CLI request to a peer. */
+    readonly forwarded?: true;
+    /** #114 S2: carried over from the live row unchanged. */
+    readonly auth?: TaskAuthorization;
+    /** #139: carried over from the live row unchanged (a late receipt is judged against them). */
+    readonly peerKey?: string;
+    readonly peerHost?: string;
+    readonly deliveredTo?: string;
+    /** Verified selected peer canvas membership at dispatch; actual deliveredTo remains stricter when available. */
+    readonly receiverMembers?: readonly string[];
+    /** Local answer time retained as audit metadata, independent of resolution time. */
+    readonly answeredAt?: number;
+    /** #114 S4: who settled the row (receipt and echo ends), and their chain role. */
+    readonly settledBy?: SettledBy;
+}
+/**
+ * How one archived row ended (gh#31). The recorded field wins; legacy rows
+ * fall back to the summary markers this ledger writes itself. The fallback
+ * reads a receipt-settled row's summary, which is the peer's text, so it is
+ * only as exact as the legacy data allows.
+ * @param row - the archived record.
+ * @returns the archive path that ended it.
+ */
+export declare function archivedEndedBy(row: ArchivedRecord): ArchiveEnd;
+/** Result of an explicit caller-side abandon. Total and never-thrown. */
+export type AbandonOutcome = 'cleared' | 'already-terminal' | 'unknown';
+/** Structured verdict for one {@link TaskLedger.abandon} call (consumer contract: idempotent). */
+export interface AbandonResult {
+    readonly outcome: AbandonOutcome;
+    readonly taskId: string;
+    /** Settle time: fresh abandonment's clock tick, or the already-settled row's original resolvedAt. */
+    readonly archivedAt?: number;
+}
+/** Result of a cooperative {@link TaskLedger.cancel}; adds routing facts for the notify half. */
+export interface CancelledResult extends AbandonResult {
+    /** Team the ended row addressed — the route layer reaches a live local target through it. */
+    readonly team?: string;
+    readonly contextId?: string;
+}
+/** Per-instance knobs; defaults come from the exported constants. */
+export interface TaskLedgerOptions {
+    /** Invalid persisted member entries are dropped individually and reported without their content. */
+    warn?: (message: string) => void;
+    /** Stale-TTL override (tests inject short windows); defaults to {@link TASK_STALE_TTL_MS}. */
+    staleTtlMs?: number;
+    /** Archive capacity override; defaults to {@link ARCHIVE_CAP}. */
+    archiveCap?: number;
+    /**
+     * Clock injection for tests: every sweep/TTL decision reads the time from
+     * here. Defaults to Date.now. Injecting a steppable clock makes the stale
+     * transition deterministic - no real sleeps to race under load.
+     */
+    now?: () => number;
+}
+/**
+ * What one correlated receipt settled — the payload of the
+ * `a2a/receipt-resolved` event, emitted for consumers that react to receipt
+ * arrivals (P2: native-teams settles its outstanding async submissions from
+ * this seam). `outcome` carries the v2 envelope's controlled-vocabulary
+ * verdict when the receipt rode one; `late` marks a receipt answering a
+ * dead-lettered row (revival) or an abandoned row (arrival recorded) — a
+ * healthy row's duplicate receipt refreshes the archive with NO marker.
+ */
+export interface ReceiptResolvedInfo {
+    readonly taskId: string;
+    /** The team the task was routed to (as the dispatcher recorded it). */
+    readonly team: string;
+    /** The peer (or `'local'`) the task was dispatched through. */
+    readonly peer: string;
+    /** v2 envelope outcome, when the receipt rode one. */
+    readonly outcome?: string;
+    /** One-line outcome summary, when the receipt carried one. */
+    readonly summary?: string;
+    /** True when the receipt answered a dead-lettered or abandoned row. */
+    readonly late?: boolean;
+}
+/** The persisted ledger document: the owed book plus its settled archive. */
+export interface TaskLedgerSnapshot {
+    readonly tasks: readonly TaskRecord[];
+    readonly archived?: readonly ArchivedRecord[];
+    /** #114 S4: the bounded ring of refused / would-be-refused settlements. */
+    readonly settlementRefusals?: readonly SettlementRefusalRecord[];
+    /** #114 S4: monotonic count of every refusal noted. */
+    readonly settlementRefusalsTotal?: number;
+    /** gh#154: lifetime conservation counters (persisted; absent = pre-#154 legacy) — the module contract, shared by classifier, counters, and this schema (review P3). */
+    readonly conservation?: ConservationSnapshot;
+}
+/** #114 S4: who settled an archived row, and how they stood on its authorization chain. */
+export interface SettledBy {
+    readonly caller: string;
+    readonly chain_role: ChainRole | 'off-chain';
+}
+/** #114 S4: one settlement the judgement refused (enforce) or would have refused (observe). */
+export interface SettlementRefusalRecord {
+    readonly taskId: string;
+    readonly at: number;
+    readonly settler: {
+        readonly caller: string;
+        readonly proof: AuthProof;
+        readonly ingress: 'wire' | 'local';
+    };
+    readonly reason: SettlementReason;
+    /** The receipt's first line, bounded. */
+    readonly head: string;
+    /** true: the settlement was refused (enforce); false: recorded only (observe). */
+    readonly enforced: boolean;
+    /** Repeats of the same (task, settler, reason) folded into this entry, so a flood cannot push older evidence out (review of PR #140 P2-4). */
+    readonly count: number;
+}
+/** Bound on ids and callers kept in settlement records; longer values are cut on write and refused on restore. */
+export declare const SETTLEMENT_ID_CAP = 256;
+/** Bound of the refusal ring (design §4.4). */
+export declare const SETTLEMENT_REFUSAL_CAP = 64;
+/**
+ * #114 S4: how the ledger asks whether a settler may settle a row. `check`
+ * is the pure judgement (task-auth.ts judgeSettlement) bound to this
+ * receipt's facts; `enforce` decides whether an off-chain verdict blocks
+ * the settlement or is only recorded.
+ */
+export interface SettlementJudge {
+    readonly enforce: boolean;
+    readonly settler: SettlementRefusalRecord['settler'];
+    check(row: Pick<TaskRecord, 'team' | 'peer' | 'direction' | 'auth' | 'peerKey' | 'peerHost' | 'deliveredTo' | 'forwarded' | 'receiverMembers'>, echo: boolean): SettlementVerdict;
+}
+/** Restore-side allowlist for settledBy: whole or nothing. */
+export declare function withSettledBy(raw: unknown): {
+    settledBy?: SettledBy;
+};
+/** Restore-side allowlist for one refusal record: whole or nothing. */
+export declare function parseRefusal(raw: unknown): SettlementRefusalRecord | undefined;