@securecoms/agent-bridge 0.2.0 → 0.3.0

package/dist/bridge-agent.d.ts

@@ -2,6 +2,7 @@ import { MlsGroupKeyProvider } from "@agentvault/connect-sdk-ts";
 import type { BridgeConfig } from "./config.js";
 import { LatencyRecorder } from "./latency.js";
 import type { AttachmentMeta } from "./attachments.js";
+import type { AgentActionNodeType, AgentActionNodeStatus, AgentActionNodeDetail } from "@agentvault/connect-core";
 export interface BridgeMessage {
     channel_id: string;
     message_id: string;
@@ -60,6 +61,19 @@ export interface BridgeAgentDeps {
      * recent (a real-time messaging consumer cares about the newest). Default 1000.
      */
     maxBuffer?: number;
+    /**
+     * Review I3/M3: clock seam for the agent.action.* partial-throttle token
+     * buckets AND the unsettled-run stale-TTL sweep. Defaults to Date.now.
+     * Injected so tests can simulate a full minute (or a stale-run TTL window)
+     * of elapsed time without a real wait.
+     */
+    actionThrottleNow?: () => number;
+    /**
+     * C3: randomness seam for self-heal-sweep jitter (fleet decorrelation).
+     * Defaults to Math.random. Injected so tests can assert deterministic jittered
+     * timer delays.
+     */
+    rng?: () => number;
 }
 /** Default inbound-buffer cap (messages) when deps.maxBuffer is unset. */
 export declare const DEFAULT_MAX_BUFFER = 1000;
@@ -91,6 +105,71 @@ export declare class InvalidPathError extends Error {
     readonly filePath: string;
     constructor(filePath: string, cause?: unknown);
 }
+/**
+ * Per-room agent pause toggle (daemon side): the backend rejected a publish
+ * with `403 {detail:{error:"agent_paused"}}`, which the SDK's `RestTransport`
+ * classifies into {@link AgentPausedError} (Task 8). This is a TERMINAL
+ * outcome — an owner/admin has deliberately muted this agent in this room, it
+ * is not a transient/network failure — so the daemon rethrows its OWN typed
+ * error (mirroring {@link ChannelPendingError} / {@link RateLimitedError}) for
+ * `send()`/`sendA2A()`/`sendAttachment()` callers to `instanceof`-check,
+ * instead of letting a heal path retry or re-Welcome into a paused room.
+ */
+export declare class AgentPausedSendError extends Error {
+    readonly channelId: string;
+    constructor(channelId: string);
+}
+/** Thrown by `agent.action.*` when a runId (or nodeId within a run) is unknown
+ * or the run has already settled — settle() is terminal, mirroring the client
+ * ingest side's "later partials for a settled run are dropped" rule. */
+export declare class UnknownActionRunError extends Error {
+    readonly runId: string;
+    constructor(runId: string);
+}
+export interface AgentActionStartOpts {
+    runId: string;
+    type: AgentActionNodeType;
+    title: string;
+    parentId?: string;
+}
+export interface AgentActionUpdatePatch {
+    status?: AgentActionNodeStatus;
+    detail?: AgentActionNodeDetail;
+}
+export interface AgentActionFinishPatch {
+    status: "done" | "error";
+    detail?: AgentActionNodeDetail;
+}
+export interface AgentActionSettleOpts {
+    resultMessageId?: string;
+}
+export interface AgentActionWrapOpts {
+    title: string;
+    type: AgentActionNodeType;
+    parentId?: string;
+}
+/**
+ * The agent action tree emit surface. A "run" groups the nodes (steps /
+ * tool_calls / sub_tasks / results) of one agent turn under `runId`.
+ * `start`/`update`/`finish` mutate the run's local node tree and attempt a
+ * throttled `partial` send (~1/sec per run — see `flushActionPartial`);
+ * `settle` always sends exactly once, carrying the FULL node set (folding in
+ * anything the throttle held back) plus an optional `resultMessageId`.
+ */
+export interface AgentActionAPI {
+    /** Start a new run scoped to `channelId`. Local-only (no send). */
+    begin(channelId: string): string;
+    /** Add a node (default status "running") to the run's tree. May emit a throttled partial. */
+    start(opts: AgentActionStartOpts): Promise<string>;
+    /** Patch an existing node's status/detail. May emit a throttled partial. */
+    update(runId: string, nodeId: string, patch: AgentActionUpdatePatch): Promise<void>;
+    /** Terminal patch for a node (status "done" | "error"). May emit a throttled partial. */
+    finish(runId: string, nodeId: string, patch: AgentActionFinishPatch): Promise<void>;
+    /** Flush + freeze the run: sends exactly one `settled` frame with all nodes. */
+    settle(runId: string, opts?: AgentActionSettleOpts): Promise<void>;
+    /** Auto-capture helper: start a node, run `fn`, finish it done/error from the outcome. */
+    wrap<T>(runId: string, fn: () => T | Promise<T>, opts: AgentActionWrapOpts): Promise<T>;
+}
 export declare const BRIDGE_VERSION = "0.0.0";
 export declare class BridgeAgent {
     private readonly cfg;
@@ -121,6 +200,15 @@ export declare class BridgeAgent {
      * per channel on a miss.
      */
     private readonly channelRoster;
+    /**
+     * Task 8 (owner-attested Reset Secure Session): per-channel STRUCTURAL owner
+     * cache, fed by resolveAndPinOwner() on every roster refresh and consumed by
+     * the onResolvePinnedOwner hook passed to MlsGroupKeyProvider. "anomalous"
+     * means the DM roster shape was not exactly one non-self, non-agent
+     * counterpart, OR the freshly-fetched key no longer matches an existing pin —
+     * either way the hook must fail closed (return null) for that channel.
+     */
+    private readonly channelOwner;
     private readonly buffer;
     private readonly maxBuffer;
     /** Cumulative count of messages shed by the buffer cap (surfaced on health()/metrics()). */
@@ -135,6 +223,13 @@ export declare class BridgeAgent {
     private rateLimitedSends;
     /** Cumulative count of requestWelcome calls fired for no-local-state deliveries (self-heal signal). */
     private welcomeRequestsSent;
+    /** 2026-07-03 latency triage: cumulative delivery pings received on the WS
+     *  stream. 0 while messages still flow = the stream is dead and inbound is
+     *  riding the 25s safety floor (surfaced on health()/metrics). */
+    private pingsReceived;
+    /** True once close() begins — gates the ping-stream-death stderr warning so
+     *  a normal shutdown doesn't cry wolf. */
+    private closingDown;
     /**
      * Track 5: cumulative count of artifact_share messages where download/decrypt/digest
      * failed. Fail-soft — failures are acked (no redelivery), logged to stderr, and this
@@ -145,7 +240,87 @@ export declare class BridgeAgent {
     private readonly lastWelcomeRequest;
     /** Minimum gap between requestWelcome calls for the same channel (2 minutes). */
     private static readonly REQUEST_WELCOME_COOLDOWN_MS;
+    private static readonly GRACEFUL_DRAIN_MS;
+    /**
+     * P0b (daemon-stability): collapses the onDecryptError console.warn from
+     * "one line per failure" (the 114 MB/765k-line-in-a-day log source) to at
+     * most one line immediately + one summary line per 60s per channel. LOG
+     * OUTPUT ONLY — does not touch errorStats()/quarantine counters, which
+     * live entirely in the SDK provider and are unaffected by this class.
+     */
+    private readonly decryptErrorLogLimiter;
+    /**
+     * Task 12: proactive self-heal sweep kill-switch. Task 11's held-KP signal
+     * only fires reactively, from ingestOnce's Phase-0 pass over PULLED delivery
+     * rows — an idle-but-wiped channel therefore loses its NEXT message (the
+     * very message that would have proven it diverged). selfHealSweep() closes
+     * that gap by proactively walking every non-DM member channel at boot and
+     * on an interval. `SECURECOMS_SELF_HEAL_SWEEP=false` disables it, falling
+     * back to the delivery-row-driven Task 11 behaviour only.
+     */
+    private readonly selfHealSweepEnabled;
+    /** Task 12: proactive sweep cadence (in addition to the once-at-boot fire). */
+    private static readonly SELF_HEAL_SWEEP_INTERVAL_MS;
+    private static readonly SELF_HEAL_SWEEP_JITTER_MS;
+    private selfHealTimer?;
+    private bootSweepTimer?;
+    private readonly rng;
     private readonly rateFloor;
+    /**
+     * agent.action.* run state, keyed by runId.
+     *
+     * Review M3 (bug fix): the ORIGINAL comment here said "deliberately
+     * unbounded" — but nothing ever bounded it either. Only actionSettle()
+     * deleted an entry; a begun-but-never-settled run (agent crash, bug,
+     * dropped/never-sent reply) leaked for the daemon's entire lifetime. Now
+     * bounded by MAX_UNSETTLED_ACTION_RUNS (LRU eviction by startedAt) plus a
+     * lazy ACTION_RUN_STALE_MS sweep, both applied on every actionBegin() —
+     * mirrors the send-side inbound-buffer bound (capBuffer/maxBuffer).
+     */
+    private readonly actionRuns;
+    /** Review M3: hard cap on concurrently-tracked UNSETTLED runs. Exceeding it
+     *  evicts the oldest (LRU by startedAt) to make room — never grows past
+     *  this regardless of how many runs are begun and abandoned. */
+    private static readonly MAX_UNSETTLED_ACTION_RUNS;
+    /** Review M3: an unsettled run older than this (by startedAt, relative to
+     *  actionClock()) is swept away on the next actionBegin(), independent of
+     *  the count-based cap — bounds memory even when begin() calls are rare. */
+    private static readonly ACTION_RUN_STALE_MS;
+    /** Review I3/M3: injected clock (defaults Date.now) for the action-partial
+     *  token buckets AND the stale-run sweep — a single seam so tests can
+     *  simulate elapsed time deterministically. */
+    private readonly actionClock;
+    /**
+     * Per-run token bucket for `agent_action` PARTIAL frames (Global
+     * Constraint: do NOT model on the unthrottled reportStatus; do NOT reuse
+     * `rateFloor`/`enforceRateFloor`, whose semantics are "throw past
+     * capacity" — partials instead COALESCE: a throttled call just leaves its
+     * change in `dirty` for the next allowed send to pick up).
+     *
+     * Review I3 (bug fix): capacity 1 / refill 60-per-minute was EXACTLY the
+     * backend's MESSAGING_LIMIT (60/60s per sender) — no headroom. Partials +
+     * the settled frame + the agent's real reply + reportStatus all compete
+     * for that one shared per-sender budget, so a long run's settled frame or
+     * reply could 429 right at the end. Lowered to 30/min (~1 per 2s) so
+     * partials alone use at most ~half the identity's send budget, leaving
+     * headroom for the settled frame / reply / status traffic riding the SAME
+     * cap. Independent of `cfg.rateLimitCapacity` (room/a2a/attachment floor).
+     * `settled` frames bypass this bucket entirely — they always send, exactly
+     * once, per run.
+     */
+    private readonly actionRateFloor;
+    /**
+     * Review I3 (bug fix): a GLOBAL bucket shared across every run, on top of
+     * the per-run bucket above. Without this, N concurrent runs each get their
+     * OWN ~30/min budget, so the partial send rate multiplies with agent
+     * concurrency and can still blow past the shared 60/min identity edge cap
+     * (each run individually "has headroom" but the SUM doesn't). Same
+     * capacity/refill as the per-run bucket — it caps the aggregate, not any
+     * single run.
+     */
+    private readonly globalActionRateFloor;
+    /** Public `agent.action.*` surface — assigned once at the end of the constructor. */
+    readonly action: AgentActionAPI;
     private readonly waiters;
     private pingHandle?;
     private safetyTimer?;
@@ -173,13 +348,120 @@ export declare class BridgeAgent {
      */
     private capBuffer;
     start(): Promise<void>;
+    /** C3: a random 0..SELF_HEAL_SWEEP_JITTER_MS decorrelation offset. */
+    private sweepJitter;
     private reconcileJoin;
+    /**
+     * The held-KP re-Welcome signal (Task 11), shared by EVERY heal path: the
+     * reactive no-local-state branch in ingestOnce(), the proactive
+     * selfHealSweep() (Task 12), the onWedged forked-state recovery
+     * (healWedgedChannel), and the reset supersede (healSupersedeUnopenable).
+     *
+     * Before asking the committer to (re-)Welcome us, it RECONCILES the server's
+     * published KeyPackage to our held bundle. This is the fix for the observed
+     * "fresh DM never replies" AND "reset doesn't work": the committer seals every
+     * Welcome to our SERVER-PUBLISHED KP, but that KP had diverged from our
+     * locally-HELD bundle, so joinFromWelcome throws "No matching secret found" /
+     * "private KeyPackage key no longer held" and the Welcome is discarded. A bare
+     * re-Welcome re-seals to the SAME diverged published KP — un-openable again —
+     * looping until the channel quarantines. So:
+     *   - published == held  → publishKeyPackage() (no-op while held; mints only if
+     *     somehow none is held), then re-Welcome re-seals to the current KP we hold.
+     *   - published != held  → forceRepublishKeyPackage() re-syncs the server to a
+     *     bundle we hold, so the owner's re-Welcome is openable. Orphan-safe: a
+     *     diverged published KP means every other pending Welcome sealed via the
+     *     server is un-openable too, so replacing the shared per-device bundle
+     *     strands nothing that was openable (see heldBundleMatchesPublishedKp).
+     * getLastPublishedKpId then names the reconciled KP so the owner re-seals to it.
+     * Callers own their cooldown/rate-limit gate and try/catch — this does neither.
+     */
+    private signalHeldKpWelcome;
+    /**
+     * P0b (daemon-stability): the onWedged→heal path. onWedged only hands us a
+     * `connect_channel_id` — resolve it to an MLS groupId the SAME way
+     * selfHealSweep does, via the read-only getConnectChannelGroup probe
+     * (never initConnectChannelGroup, which side-effects a member_device_ids
+     * union + commit), then fire the existing held-KP re-Welcome signal.
+     * Respects the SAME per-channel cooldown (lastWelcomeRequest /
+     * REQUEST_WELCOME_COOLDOWN_MS) used by ingestOnce's Task-11 branch and
+     * selfHealSweep — this must never hammer requestWelcome on its own.
+     *
+     * Best-effort in every sense: if the channel has no resolvable group (no
+     * local state to probe from), this logs nothing further and just returns —
+     * the channel is left to the next selfHealSweep pass or reactive Task-11
+     * branch, mirroring how those two paths already treat an unresolvable
+     * group (`continue`, no signal). ANY failure along the way (probe throws,
+     * signal throws) is swallowed: a wedge heal must never throw back into the
+     * SDK's onWedged caller. Single-shot per wedge episode — full rejoin
+     * reliability is P1, not this hook's job.
+     */
+    private healWedgedChannel;
+    /**
+     * P1a self-heal (onSupersedeUnopenable): a fully-verified reset supersede whose
+     * Welcome we cannot open — it was sealed to a stale published KeyPackage our
+     * held bundle no longer matches ("No matching secret found"). trySupersede has
+     * verified owner + attestation + signature, so this is a real reset we WANT; we
+     * just can't open THIS Welcome. Ask the committer to re-Welcome us to the reset
+     * `groupId` with our CURRENT KeyPackage (signalHeldKpWelcome republishes/ensures
+     * a held KP, then requestWelcome), so the owner re-seals a Welcome we can open
+     * and the reset converges. The groupId is known (handed in), so no probe needed.
+     *
+     * Returns true ONLY when a re-Welcome was actually requested — trySupersede then
+     * discards the un-openable row. Under the shared per-channel cooldown (or on any
+     * failure) returns false, so trySupersede LEAVES the row for a bounded retry
+     * rather than dropping it with no replacement in flight. Never throws.
+     */
+    private healSupersedeUnopenable;
+    /**
+     * Task 12: proactive self-heal sweep. ingestOnce's Task-11 divergence
+     * branch only fires reactively — off a delivery ROW that already arrived
+     * for a diverged channel. A wiped-but-IDLE channel (no traffic since the
+     * wipe) never produces that row, so its next real message would be the
+     * first thing lost. This sweep walks every member channel — rooms AND DMs
+     * (H2: a wiped, idle DM with no traffic since the wipe otherwise never
+     * proactively re-Welcomes, so it stays dark until the owner happens to send)
+     * — fired once at boot + on SELF_HEAL_SWEEP_INTERVAL_MS, and, for any with no
+     * persisted state even after a reconcile attempt, resolves group_id via
+     * the READ-ONLY getConnectChannelGroup probe (never initConnectChannelGroup,
+     * which would side-effect a member_device_ids union + commit) and applies
+     * the same held-KP signal — respecting the existing per-channel cooldown.
+     *
+     * Each channel is wrapped in its own try/catch: `listChannels` filters at
+     * the identity level while `requestWelcome` (via request_welcome) gates at
+     * the device level, so a channel where this identity is a member but this
+     * DEVICE never held a leaf can 403 on the signal call. That's harmless and
+     * must not abort the sweep for every other channel.
+     */
+    private selfHealSweep;
     /**
      * Per-channel send-floor check. No-op on allow; throws RateLimitedError on a
      * trip (incrementing the observable counter). `kind` namespaces the bucket so
      * room and a2a traffic on the same channel are tracked separately.
      */
     private enforceRateFloor;
+    /**
+     * The ONE seam every application-send path (send/sendA2A/sendAttachment)
+     * calls to publish, wrapping the SDK's {@link sendWithSelfHeal} with the
+     * daemon's per-room-pause terminal classification (Task 9).
+     *
+     * `AgentPausedError` (Task 8's SDK classification of the backend's 403
+     * `agent_paused`) means an owner/admin has deliberately muted this agent in
+     * this room — NOT a transient/network failure. That distinction MUST be
+     * made here, before control returns to any caller, so:
+     *   - it never reaches a heal/self-heal trigger (healWedgedChannel /
+     *     onWedged re-Welcome are wired off the RECEIVE path via SDK provider
+     *     callbacks, not off a send failure — this seam guarantees a send
+     *     failure never grows one either, now or as the code evolves), and
+     *   - it never gets treated as a generic/retryable failure by a caller —
+     *     rethrown as the daemon's OWN typed `AgentPausedSendError` (mirroring
+     *     ChannelPendingError/RateLimitedError, both also bridge-agent.ts
+     *     locals) so http-server.ts/ws-server.ts can `instanceof`-check it the
+     *     same way they already do for those two, instead of it falling into
+     *     their generic "internal error" bucket.
+     * Any other error (including StaleEpochError retries, which sendWithSelfHeal
+     * already resolves internally) propagates unchanged.
+     */
+    private sendWithSelfHealTerminal;
     send(channelId: string, text: string, messageId?: string): Promise<{
         message_id: string;
         status: "sent";
@@ -223,7 +505,65 @@ export declare class BridgeAgent {
      * attribution must NEVER block or drop a message.
      */
     private refreshChannelRoster;
+    /**
+     * Task 8 (owner-attested Reset Secure Session): STRUCTURAL owner selection —
+     * NEVER read the server's `role` field to pick the owner. In a DM the owner
+     * is the SINGLE non-self, non-agent counterpart; any other roster shape
+     * (zero or 2+ non-agent counterparts) is anomalous and REFUSES (no pin, no
+     * supersede eligibility). On the first clean sighting of an unambiguous
+     * owner with no existing pin, TOFU-pin its public key. On a later sighting
+     * where a pin already exists and the freshly-fetched key differs, this is an
+     * anomaly: surface it (log) and refuse — NEVER silently re-pin. Fail-soft:
+     * this must never throw into the roster refresh path.
+     */
+    private resolveAndPinOwner;
+    /**
+     * Task 8: the `onResolvePinnedOwner` hook handed to MlsGroupKeyProvider. The
+     * SDK's step-0 guard calls this before honoring an owner-authored supersede;
+     * returning null makes it fail closed. Returns a value ONLY when (a) the
+     * structural owner cache has an unambiguous entry for this channel AND (b) a
+     * persisted pin still exists and matches it — a bare in-memory cache hit is
+     * never trusted on its own, it is always reconfirmed against the store.
+     */
+    private resolvePinnedOwnerHook;
     reportStatus(channelId: string, state: "idle" | "working" | "stalled" | "error", detail?: string): Promise<void>;
+    /** `runId` must exist and not have settled yet — settle() is terminal. */
+    private requireActionRun;
+    /**
+     * Build + send one `agent_action` E2E body over `system_event` (mirrors
+     * sendA2A/reportStatus's envelope construction — same self-heal seam). Used
+     * for BOTH partial and settled frames; the caller decides whether a send is
+     * throttle-gated (partials, via flushActionPartial) or unconditional
+     * (settled, always exactly once).
+     */
+    private sendActionFrame;
+    /**
+     * The coalescing throttle (review H4 / Global Constraint: ~1/sec per run).
+     * If the run has no dirty nodes, no-op. If the per-run bucket has no token,
+     * no-op too — the change stays in `dirty` and rides along with whatever the
+     * NEXT allowed send captures (a later start/update/finish call, or settle(),
+     * which always flushes regardless of the bucket). This is the coalescing:
+     * a burst of rapid calls collapses into however many sends the ~1/sec floor
+     * actually allows, each carrying every node changed since the last send.
+     */
+    private flushActionPartial;
+    /** Review M3: drop any unsettled run older than ACTION_RUN_STALE_MS
+     *  (relative to `now`). Lazy — invoked on every actionBegin() rather than
+     *  a background timer, mirroring the client store's orphan-TTL pattern. */
+    private sweepStaleActionRuns;
+    private actionBegin;
+    private actionStart;
+    private actionUpdate;
+    private actionFinish;
+    private actionSettle;
+    /**
+     * Auto-capture seam (Task 4 "auto-capture"): wraps a tool-call / sub-agent
+     * invocation so a bare agent gets a start→finish node pair without hand-
+     * rolling the begin/start/update/finish calls itself. Success → status
+     * "done"; a thrown error → status "error" with the message captured in
+     * `detail.error`, then the original error is rethrown (wrap never swallows).
+     */
+    private actionWrap;
     protected startReceivePump(): void;
     private ingestOnce;
     drain(channelId: string | undefined, waitSeconds: number): Promise<BridgeMessage[]>;
@@ -263,6 +603,9 @@ export declare class BridgeAgent {
         permanently_skipped: number;
         /** Track 5: cumulative artifact_share messages where download/decrypt/digest failed (fail-soft — acked, no redeliver). */
         failed_attachments: number;
+        /** 2026-07-03 latency triage: delivery pings received on the WS stream.
+         *  0 while messages flow = push is dead; inbound rides the 25s floor. */
+        delivery_pings: number;
         uptime_s: number;
         version: string;
     };

package/dist/decrypt-error-log-limiter.d.ts

@@ -0,0 +1,52 @@
+export interface DecryptErrorInfo {
+    /** MLS epoch the failing row was at, if known. */
+    epoch?: number | string;
+    /** Delivery queue id the failing row came from, if known. */
+    queueId?: string;
+    /** The decrypt error's message (already stringified by the caller). */
+    message: string;
+}
+export interface DecryptErrorLogLimiterOpts {
+    /** Suppression window in ms. Default 60_000 (60s). */
+    windowMs?: number;
+    /** Clock seam for tests. Defaults to Date.now. */
+    now?: () => number;
+    /** Log sink. Defaults to console.warn. Injectable so tests can assert on
+     *  emitted lines without capturing the real console. */
+    log?: (line: string) => void;
+}
+/** Default suppression window: 60 seconds. */
+export declare const DEFAULT_DECRYPT_ERROR_LOG_WINDOW_MS = 60000;
+/** Hard cap on distinct error reasons surfaced per channel per window. A wedged
+ *  channel has a small handful of genuine reasons; beyond this the extra volume
+ *  is noise (or an adversarial/buggy server cycling messages) and is suppressed. */
+export declare const MAX_DISTINCT_PER_WINDOW = 4;
+export declare class DecryptErrorLogLimiter {
+    private readonly windowMs;
+    private readonly now;
+    private readonly log;
+    private readonly windows;
+    constructor(opts?: DecryptErrorLogLimiterOpts);
+    /**
+     * Record one decrypt error for `channelId`. Logs immediately if this is
+     * the channel's first error since its window opened (or its prior window
+     * had already elapsed, in which case a summary for that just-closed
+     * window is flushed first); otherwise the error is counted silently
+     * toward the window's eventual summary line.
+     */
+    record(channelId: string, info: DecryptErrorInfo): void;
+    /**
+     * Clear a channel's window (e.g. once the caller learns the channel
+     * cleared/healed) so its NEXT error logs immediately as a fresh "first"
+     * rather than being folded into a stale window's summary. There is
+     * currently no onDecryptSuccess-style hook from the SDK to wire this to
+     * automatically (see bridge-agent.ts's onDecryptError wiring comment) —
+     * exposed here so a future success signal (or a caller with its own
+     * channel-cleared signal) can reset explicitly. In its absence, the
+     * window simply rolls over on interval elapse, which is an accepted
+     * simplification (see report).
+     */
+    reset(channelId: string): void;
+    private logFirst;
+    private flushSummary;
+}

package/dist/errors.d.ts

@@ -6,7 +6,7 @@
  * WebSocket returns `{type:"error", error, message, detail?}`. A client gets the
  * same `error` code regardless of which transport it used. (A2A §9.5/§10.6 pattern.)
  */
-export type BridgeErrorCode = "unauthorized" | "forbidden_origin" | "not_found" | "invalid_request" | "invalid_json" | "body_too_large" | "channel_pending" | "rate_limited" | "internal";
+export type BridgeErrorCode = "unauthorized" | "forbidden_origin" | "not_found" | "invalid_request" | "invalid_json" | "body_too_large" | "channel_pending" | "rate_limited" | "unknown_action_run" | "internal";
 export interface BridgeErrorSpec {
     /** HTTP status this code maps to (the WS binding ignores it). */
     http: number;