@securecoms/agent-bridge 0.26.5 → 0.27.0

package/dist/bridge-agent.d.ts

@@ -33,6 +33,7 @@ import { type OwnerAuthorityStore, type OwnerPin } from "@agentvault/connect-cli
 import type { BridgeConfig } from "./config.js";
 import { LatencyRecorder } from "./latency.js";
 import type { AttachmentMeta, VaultRefEntry } from "./attachments.js";
+import { type MemoryNoteResultFrame } from "./memory/note-frames.js";
 import { type ChatMessage } from "./voice/fast-prompt.js";
 import { VOICE_CALL_START_MARKER } from "./voice/prompt-compiler.js";
 import { type VaultListNode, type VaultReadExpectations } from "./vault.js";
@@ -65,6 +66,9 @@ export type BridgeToolGrant = {
  * note. Every
  * other audience, an unpinned or anomalous owner, and the kill switch
  * `SECURECOMS_OWNER_DM_DEFAULT_GRANTS` (anything but unset/`on`) get `[]`.
+ * PR R adds exactly one more non-empty list, ROOM_DEFAULT_READ_GRANTS
+ * (`current_time` only), for an INTERNAL room's same-org human sender; see
+ * authorizationFor.
  * SEC-06 is LIVE for these two tools: docs/security/sec-06-runtime-bounds-audit.md.
  */
 /**
@@ -75,18 +79,84 @@ export type BridgeToolGrant = {
  * and `http_request` are deliberately absent.
  */
 export declare const OWNER_DM_DEFAULT_READ_GRANTS: readonly BridgeToolGrant[];
+/**
+ * PR R (spec §7A.1a; controller ruling 2026-10-05, audit r1: current_time
+ * only). Granted only in a room classified INTERNAL from the server roster
+ * (every row, leaf rows included, in the agent owner's org), to a same-org
+ * human sender, while the roster is as fresh as the agent's MLS epoch, while
+ * a declared per-tool consumer is attached (audit C-B1), and while
+ * SECURECOMS_ROOM_DEFAULT_GRANTS is on (plan OQ-3). Frozen; the runtime intersects
+ * it with ROOM_SAFE_READ_TOOLS (turn-loop.ts).
+ */
+export declare const ROOM_DEFAULT_READ_GRANTS: readonly BridgeToolGrant[];
 /**
  * Kill switch for OWNER_DM_DEFAULT_READ_GRANTS, read once at BridgeAgent
  * construction (daemon startup). Unset or exactly `on` keeps the grants;
  * any other value (`off`, `0`, `false`, empty) sends `[]` on every turn.
  */
 export declare function ownerDmDefaultGrantsEnabled(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Kill switch for ROOM_DEFAULT_READ_GRANTS (plan OQ-3, RULED), read once at
+ * BridgeAgent construction exactly like ownerDmDefaultGrantsEnabled. Unset or
+ * exactly `on` keeps the room default; any other value sends `[]` on every
+ * room turn. It never touches the owner DM.
+ */
+export declare function roomDefaultGrantsEnabled(env?: NodeJS.ProcessEnv): boolean;
 export interface BridgeAuthorization {
     readonly version: 1;
     readonly audience: AgentAudience;
     readonly sender_membership: "active" | "unknown";
     readonly tool_grants: readonly BridgeToolGrant[];
+    /**
+     * Audit r2 R2-T1 (plan OQ-6 ruling): "owner" ONLY on authorizationFor's
+     * ownerRelayed branch: the channel's server-marked relay sent a turn whose
+     * relayed speaker is the channel's pinned owner. Set by the daemon, never
+     * copied from message text. A harness connector honours a grant on
+     * audience owner_dm or on this mark, nothing else.
+     */
+    readonly relay_speaker?: "owner";
+    /**
+     * Markdown memory 7a (spec §8.3, OQ-B): true ONLY on authorizationFor's
+     * ownerDirect branch with memoryProvider "securecoms": the channel's pinned
+     * owner (never "anomalous") typed this turn in their DM, the roster is
+     * fresh at the held epoch and group (or the DM is cycle-fresh), and the
+     * owner-DM kill switch is on. Present only when true. An OFFER HINT: the
+     * bridge's W1 to W8 are the gate. Never set on the ownerRelayed branch
+     * (OQ-C, Eric approved 2026-10-06): voice turns read notes, never write,
+     * and never on any turn with a relay speaker claim (review I-1).
+     * NOT a tool grant: it is not, and must never be, in `tool_grants`.
+     * Reaches only the per-tool runtime consumer: withConsumerGrants strips it
+     * for a harness socket and the HTTP/SSE paths (review m-3).
+     */
+    readonly memory_write?: true;
+}
+/**
+ * Spec §8.2: what ws-server tells applyMemoryNote about the socket a
+ * memory_note frame arrived on. Read live: W2 is re-evaluated after awaits.
+ */
+export interface MemoryNoteContext {
+    /**
+     * THIS socket's in-flight record for a message id (the original, never the
+     * consumer copy) and the token of that delivery. A nack, backoff and
+     * redelivery on the same socket reuses the record object but gets a new
+     * token (review m-1).
+     */
+    lookup(messageId: string): {
+        record: BridgeMessage;
+        token: number;
+    } | undefined;
+    /** The socket's own session facts (OQ-J): consumer and the sticky harness claim. */
+    readonly session: {
+        readonly consumer: "runtime" | "unknown";
+        readonly harnessClaimed?: boolean;
+    };
+    /** The delivery token of the frame's message id, captured when the frame arrived; undefined when not in flight. */
+    token: number | undefined;
+    /** Per-socket request ids still being decided (M-2). At most MAX_PENDING_NOTE_REQUESTS (review m-3). */
+    pendingRequests: Set<string>;
 }
+/** Review m-3: pending memory_note requests per socket; a frame beyond this refuses `invalid` with no echo. */
+export declare const MAX_PENDING_NOTE_REQUESTS = 8;
 export interface BridgeMessage {
     channel_id: string;
     message_id: string;
@@ -114,6 +184,27 @@ export interface BridgeMessage {
      * @mention filter reads (not recomputed differently).
      */
     sender_is_agent?: boolean;
+    /**
+     * Audit r2 N-L3 (PR-1): this turn is a voice transcript. W8 never quotes
+     * such a record. Present only when true. Set when either holds:
+     *   - the turn is relay-attributed (`speaker` set). `speaker` is honoured
+     *     only from a sender the server roster marks `is_relay`, so on this path
+     *     the mark does not depend on the body. The room relay's `sendTurn`
+     *     (connect-room-relay/src/turns.ts) also sets `transcribed: true`, and
+     *     the hosted voice worker reaches the bridge only through that relay;
+     *   - the E2E body says `transcribed: true`. The owner's own web client sets
+     *     it on an on-device transcript (connect-web MessagingShell.tsx
+     *     `sendConfirmedVoiceToChannel`, reached from CallPanel's
+     *     `sendAgentMessage` via `confirmedSendBody`).
+     * LIMITATION (spec §15): on the owner-device path the mark is an
+     * UNAUTHENTICATED claim in the body. A modified or legacy client, or a
+     * device added under the owner's identity by a compromised server (the
+     * ADR-0010 gap), can send speech-derived text without it, and the bridge
+     * then treats it as typed. That adds no capability (the sender could type
+     * the same words), so the mark is fail-closed but not a cryptographic
+     * guarantee.
+     */
+    transcribed?: true;
     /**
      * Track 5: materialized attachment metadata for `artifact_share` messages.
      * Each entry corresponds to one downloaded+decrypted file saved to disk.
@@ -517,6 +608,15 @@ export declare class SendForbiddenError extends Error {
     readonly channelId: string;
     constructor(channelId: string);
 }
+/**
+ * Audit M-B1 (controller ruling 2026-10-05): a reply to a room-granted turn
+ * would be sealed at an epoch the room was not classified at, and the room is
+ * not internal there. Dropped. A SendForbiddenError, so both transports treat
+ * it as terminal (send_forbidden: the runtime acks, nothing redelivers).
+ */
+export declare class RoomClassChangedSendError extends SendForbiddenError {
+    constructor(channelId: string);
+}
 /**
  * Stranded sender (spec 2026-09-26 §7.4): the backend refused a publish with
  * 409 `mls.group_superseded`: the envelope was sealed under a group that is no
@@ -896,6 +996,21 @@ export declare class BridgeAgent {
     private readonly selfHealSweepEnabled;
     /** Read once at startup; see ownerDmDefaultGrantsEnabled. */
     private readonly ownerDmDefaultGrants;
+    /** Read once at startup; see roomDefaultGrantsEnabled. */
+    private readonly roomDefaultGrants;
+    /**
+     * Audit M-B4: DM channels whose roster was epoch-fresh at THIS ingest
+     * cycle's refresh (refreshRostersForCycle). Cleared at each cycle's start.
+     */
+    private readonly ownerDmCycleFresh;
+    /**
+     * Audit M-B1: room-granted turns, keyed by the inbound message id, with the
+     * channel, MLS group and epoch the room was classified at (review I-1: an
+     * epoch NUMBER alone repeats across channels and across a supersede). A
+     * reply to one is sealed only there, or re-classified once
+     * (publishBodyForReply). Forgotten at the runtime's ack.
+     */
+    private readonly roomGrantEpochs;
     /** Task 12: proactive sweep cadence (in addition to the once-at-boot fire). */
     private static readonly SELF_HEAL_SWEEP_INTERVAL_MS;
     /**
@@ -1015,6 +1130,56 @@ export declare class BridgeAgent {
     private startedAt;
     private readonly store;
     private readonly memory;
+    /**
+     * Markdown memory 7a: the one owner of every note mutation and of the
+     * delivery cache (spec §6.3, §7.2). One per store, so one per identity.
+     */
+    private readonly notes;
+    /**
+     * Fix round 1 (concern 1): the applied clear generation when each pending
+     * runtime turn was FIRST staged (W7b compares it). Keyed by message id,
+     * persisted inside the sealed runtime_inbox payload and restored with it;
+     * never a BridgeMessage field. Removed when the turn is acked or shed.
+     */
+    private readonly ingestGeneration;
+    /** Spec §11.2 (OQ-L): set by refetchRuntimeConfig (Task 8); notes are on until a payload says otherwise. */
+    private memoryConfig;
+    /**
+     * Task 8 fix round 1 (review I-1, N-L5): set once the BOOT refetch has
+     * returned, on success or failure. Until then prepareNotesForTurn only
+     * fills and never runs the legacy import: the boot drain pulls turns before
+     * the boot refetch, and an import there would move facts into notes that a
+     * clear issued while the machine was offline then deletes for good.
+     * warmRestoredNotes runs the import for the buffered (drained) turns after.
+     */
+    private bootConfigSettled;
+    /**
+     * Final review M-1: false until a config refetch has returned a payload in
+     * THIS process. Until then notes are off for reads and writes
+     * (notesProviderOn), whatever memoryConfig says: the last applied payload
+     * may have turned notes off, and that state is not persisted. Distinct from
+     * bootConfigSettled, which turns true when the boot refetch RETURNED, on
+     * success or failure (settled is not notes-on).
+     */
+    private memoryConfigConfirmed;
+    /**
+     * Final review I-1: true once a /v1/ws consumer completed a hello that
+     * declares it reads notes (MEMORY_NOTES_FEATURE) as the runtime, with no
+     * harness claim on that socket (ws-server). A 0.9.x runtime's hello does not
+     * declare it, a harness socket never qualifies, and a socket that sends no
+     * hello never does. Until then no legacy fact is moved into notes (those
+     * consumers recall facts, never notes) and the report says
+     * memory_notes: false. Per process and never reset: a runtime restart
+     * closes the socket but is not a downgrade.
+     */
+    private notesConsumerSeen;
+    /** Review M-1: the refetch now running, and the ONE follow-up every caller during it shares. */
+    private refetchInFlight;
+    private refetchFollowUp;
+    /** Review M-4: the (payload, applied) pair last logged as regressed. */
+    private regressedLogged;
+    /** Review M-5: an out-of-range applied generation is logged once. */
+    private generationRangeLogged;
     /** Task 2: warn-once-per-channel guard for the enclave-map fallback (below). */
     private enclaveFallbackWarned;
     /** Task 2: dedupe guard so ingestOnce writes a channel's enclave at most once
@@ -1076,6 +1241,7 @@ export declare class BridgeAgent {
      * loose until the next save.
      */
     refetchRuntimeConfig(): Promise<void>;
+    private refetchRuntimeConfigOnce;
     /**
      * Enforce the inbound-buffer cap with a DROP-OLDEST policy.
      *
@@ -1509,6 +1675,25 @@ export declare class BridgeAgent {
      * there so a retry can resend the exact bytes).
      */
     private publishBody;
+    /**
+     * Audit M-B1 (controller ruling): a reply to a room-granted turn is sealed
+     * only at the epoch the room was classified at. On a move, the room is
+     * re-classified ONCE from a roster fetched at the new epoch: still internal,
+     * the reply is sealed at that epoch; anything else, it is dropped. The check
+     * throws before an envelope is built, so nothing is stored or posted.
+     *
+     * `inReplyTo` is the STORED intent's inbound id, not the send's options, so
+     * the redelivery replay (replayReplyIntents, which has no in_reply_to in its
+     * options) is checked the same as a live send.
+     */
+    private publishBodyForReply;
+    /**
+     * Re-read the room at the agent's current group and epoch; true only if it
+     * is still internal there. Review I-1: the entry must come from THIS re-read
+     * (a fail-soft refresh leaves an older entry whose epoch label can repeat
+     * across a supersede), and the group must not move around the reads.
+     */
+    private reclassifyForReply;
     private enforceBodyRateFloor;
     /** Bookkeeping after a CONFIRMED publish of `body` under `id`. */
     private afterPublish;
@@ -1706,6 +1891,101 @@ export declare class BridgeAgent {
      * never falls back to the runtime's retired plaintext JSON files.
      */
     private memoryForTurn;
+    /**
+     * Spec §11.2 (OQ-L), §6.5: apply one parsed `payload.memory`. An unreadable
+     * value turns notes off and deletes nothing. A readable one goes through
+     * NotesBook.clear, which purges only on a HIGHER generation (under the note
+     * mutex) and resyncs on equal or lower; a lower one logs
+     * memory.clear_generation_regressed. Content-free logs only.
+     *
+     * While a purge is pending (the payload is above the applied generation)
+     * notes are held OFF, and they come back on only after the purge committed.
+     * A purge that throws therefore leaves notes off (fail closed); it is
+     * caught here (review M-2) so the rest of the config still applies and
+     * reports, and the next refetch retries it. A refetch that fails before
+     * this point keeps the last applied state.
+     */
+    private applyPayloadMemory;
+    /**
+     * Review M-5: the report key only for a value the backend accepts
+     * (0..MAX_CLEAR_GENERATION); otherwise the key is omitted, so one bad
+     * mirror value cannot 422 the whole report, and the event logs once.
+     */
+    private reportedClearGeneration;
+    /**
+     * W1 and R1: the provider is securecoms, a config payload has arrived in
+     * this process (final review M-1), and the parsed payload keeps notes on.
+     */
+    private notesProviderOn;
+    /**
+     * Final review I-1: ws-server calls this when a socket completes a hello as
+     * the runtime (no harness claim) that declares MEMORY_NOTES_FEATURE. The
+     * first one also refetches the runtime config, so the report says
+     * memory_notes: true now rather than at the next 6-hour refetch.
+     */
+    noteNotesConsumer(): void;
+    /**
+     * R2 (spec §7.3): the frozen marks that only the full owner predicate in
+     * authorizationFor sets. `memory_write` (the pinned owner typed this turn)
+     * or `relay_speaker === "owner"` (the pinned owner spoke it through the
+     * relay; read only, never write, OQ-C). Strict `=== true` / `=== "owner"`:
+     * `audience === "owner_dm"` alone is not enough (§0.1 item 7).
+     *
+     * Review I-1 (spec §8.3): the owner-DM kill switch is re-checked HERE, at
+     * read time, and so is the provider (R1). A turn restored from
+     * runtime_inbox carries the marks frozen by the previous process; with
+     * SECURECOMS_OWNER_DM_DEFAULT_GRANTS now off, or the provider no longer
+     * securecoms, it gets no notes, and the boot warm runs no legacy import.
+     */
+    private notesReadable;
+    /** The applied clear generation, for a socket that gets no notes (R5 decided first, review m-2). */
+    notesAppliedGeneration(): number;
+    /**
+     * ws-server flush (synchronous). R1 to R3 here; R5 in withConsumerNotes; R4
+     * holds because nothing else calls this. Reads only the generation-checked
+     * cache (N-M1): a miss gives no notes. `generation` is the applied clear
+     * generation the socket records for W7b.
+     */
+    notesForDelivery(m: BridgeMessage): {
+        notes?: string;
+        generation: number;
+    };
+    /**
+     * §7.2 Warm and §10 import, BEFORE the turn is staged. Never throws.
+     * The import runs only for a `memory_write` turn (M-6: owner-DM channels
+     * only); the turn's own frozen authorization is the proof NotesBook checks.
+     */
+    private prepareNotesForTurn;
+    /**
+     * §7.2 + N-L5: after the boot refetch applied any clear, warm each channel
+     * holding an R2-eligible restored turn, before start() returns (bin.ts
+     * attaches /v1/ws only after start()). `this.buffer` also holds the turns
+     * the boot drain pulled; their prepare ran fill-only (review I-1), so the
+     * legacy import for them runs here, after the purge.
+     */
+    private warmRestoredNotes;
+    /**
+     * Spec §8.2: the write gate for one `memory_note` frame, fail closed, in
+     * table order: W1, well formed (and a request_id not already pending on
+     * this socket, M-2), W2, W3, W4(a), W4(b), W8, W5, then W2 and W1 once more
+     * after the await, then under the note mutex W7, W2 and W1 again after the
+     * seal and right before the synchronous commit, and W7b (the generation
+     * stamped when the turn was first staged, re-checked inside the store
+     * transaction; a turn with no stamp refuses `cleared`). Every refusal logs `memory.note_refused
+     * { reason_class }` and nothing else (§8.6); no note text, frame body or id
+     * is ever logged. Never rejects: an unexpected throw refuses with `store`.
+     *
+     * Everything that decides WHERE and WHETHER a note is written comes from
+     * the bridge-held in-flight record that `ctx.lookup` returns for THIS
+     * socket, never from the frame: the channel (W3), the frozen
+     * authorization (W4(a)), the sender (W4(b)), and the source text and the
+     * `transcribed` mark (W8). The note text that reaches NotesBook is the
+     * owner's own span, produced only by `prepareStoredNote` (W8 then W5).
+     *
+     * LEAF LOCK: heldPosition (W4(b)) is awaited BEFORE the note mutex is
+     * taken; nothing under the mutex awaits it.
+     */
+    applyMemoryNote(raw: Record<string, unknown>, ctx: MemoryNoteContext): Promise<MemoryNoteResultFrame>;
     memoryContext(conversationId: string, limit?: number): Promise<import("@agentvault/connect-mls-store").MemoryContextResult>;
     /**
      * Voice front desk, step 1 — decided SYNCHRONOUSLY inside the ingest cycle,
@@ -1947,6 +2227,19 @@ export declare class BridgeAgent {
     private enclavesToCover;
     /** A live roster for a channel, or undefined if missing OR expired past the TTL. */
     private freshRoster;
+    /** The whole cache entry when fresh, else undefined (TTL; the epoch is checked by the caller). */
+    private freshRosterEntry;
+    /** The agent's held MLS group id for a channel; null when none (fail closed). */
+    private heldGroupFor;
+    /**
+     * Review I-1 + fix round 2: the agent's held (group, epoch) for a channel.
+     * The group is read on BOTH sides of the epoch read, so the epoch provably
+     * belongs to it (a supersede in between installs a new group whose epoch
+     * counter restarts); a group that moved, or none held, is null (fail closed).
+     */
+    private heldPosition;
+    /** The agent's own MLS epoch for a channel; null when no group is held (fail closed). */
+    private heldEpochFor;
     /**
      * Resolve one channel's roster (members + display names + is-agent) from the
      * GET members endpoint into the roster cache. Called AT MOST ONCE per ingest
@@ -1955,6 +2248,15 @@ export declare class BridgeAgent {
      * attribution must NEVER block or drop a message.
      */
     private refreshChannelRoster;
+    /**
+     * S-1 (roster) + §7A.5 + audit M-B4: once per ingest cycle, per distinct
+     * channel, re-read the roster when the TTL lapsed OR the epoch moved since
+     * the fetch, then record which DMs are epoch-fresh for the rest of this
+     * cycle. Fail-soft inside refreshChannelRoster (never blocks ingest).
+     */
+    private refreshRostersForCycle;
+    /** Classify one inbound turn at the agent's CURRENT epoch for its channel. */
+    private authorizeTurn;
     /**
      * Classify the sender only from server-authenticated channel/roster data.
      * Missing or stale metadata is UNKNOWN with zero grants, never a permissive
@@ -1972,6 +2274,13 @@ export declare class BridgeAgent {
      *       relayed `speaker_identity_id` (passed by the caller only for relay
      *       turns) is that same pinned owner, whose roster row is the agent's
      *       owner. A speaker claim from any non-relay sender gets nothing.
+     * Both need the roster fetched at `heldEpoch` (the agent's current MLS
+     * epoch for the channel), or the DM marked epoch-fresh at this ingest
+     * cycle's refresh (audit M-B4).
+     * PR R: ROOM_DEFAULT_READ_GRANTS only when the room kill switch is on, a
+     * per-tool consumer is attached, the roster was fetched at `heldEpoch`
+     * (no cycle carve-out), the room is INTERNAL (roomIsCrossOrg === false
+     * over every row, leaf rows included) and the audience is team_room.
      * Everything else gets the frozen empty list.
      *
      *   LIMIT (harness gate review H2, 2026-10-05): "pinned structural owner"
@@ -2000,6 +2309,15 @@ export declare class BridgeAgent {
      *                            startup: `on` = default grants enabled
      *   meta_fresh / roster_fresh whether the channel meta / roster caches were
      *                            fresh (either stale forces audience=unknown)
+     *   room_class               the room's class from the server roster (`na`
+     *                            for a DM): internal | cross_org | unknown
+     *   epoch_fresh              the roster was fetched at the agent's current
+     *                            MLS epoch for the channel
+     *   room_kill_switch         SECURECOMS_ROOM_DEFAULT_GRANTS as read at startup
+     *   per_tool_consumer        a consumer that declared per-tool grant
+     *                            enforcement is attached
+     *   memory_write             the turn carries memory_write (Markdown memory
+     *                            7a, spec §8.3): a boolean, never content
      */
     private logAuthzDecision;
     /**
@@ -2270,6 +2588,19 @@ export declare class BridgeAgent {
     isRuntimeMessageRetired(messageId: string): boolean;
     /** Complete the durable handoff only after the runtime explicitly acks. */
     ackRuntimeMessages(messageIds: string[]): void;
+    /** The sealed runtime_inbox payload: the message plus its ingest stamp (never on the message object). */
+    private stagedPayload;
+    /**
+     * Seal `message` into runtime_inbox with the current ingest stamp and record
+     * the stamp that is actually persisted. Task 7 n-1: a same-id re-stage is
+     * compared on the MESSAGE only, never the stamp, so a clear between two
+     * stagings of one message is not a payload conflict (which would fail the
+     * stage and leave the backend row redelivered forever). The row is not
+     * rewritten, so the FIRST staging's stamp stays authoritative: the owner's
+     * clear still covers a turn first ingested before it. A prior row with no
+     * valid stamp gets none, so its write refuses `cleared`.
+     */
+    private stageSealed;
     private restoreRuntimeInbox;
     /**
      * Seal a runtime frame before the backend queue id may be acknowledged.
@@ -2326,6 +2657,18 @@ export declare class BridgeAgent {
     clearHarnessReport(report: HarnessReport): void;
     /** The latest harness report, or null (GET /v1/status). */
     harnessReport(): HarnessReport | null;
+    /**
+     * Audit C-B1: the attached /v1/ws consumer that declared per-tool grant
+     * enforcement (its hello carried "per_tool_grants" and no harness report),
+     * or null. authorizationFor issues a room grant only while one is attached
+     * (Task R2); every delivery path also strips room grants for any other
+     * consumer (consumer-grants.ts). The token is the socket's session object.
+     */
+    private perToolConsumer;
+    notePerToolConsumer(token: object): void;
+    /** Forget `token` when its socket closes; a newer consumer's token is kept. */
+    clearPerToolConsumer(token: object): void;
+    perToolConsumerAttached(): boolean;
     health(): {
         status: "ok";
         identity_id: string;

package/dist/consumer-grants.d.ts

@@ -0,0 +1,23 @@
+import type { BridgeMessage } from "./bridge-agent.js";
+/**
+ * The /v1/ws hello feature a consumer sends to declare per-tool grant
+ * enforcement. The runtime exports the same value (connect-agent-runtime
+ * data-plane.ts PER_TOOL_GRANTS_FEATURE); the two packages share no
+ * dependency, so ws-server.test.ts pins them equal and drives the bridge with
+ * the runtime's own hello frame.
+ */
+export declare const PER_TOOL_GRANTS_FEATURE = "per_tool_grants";
+/**
+ * `m` unchanged for a per-tool consumer; otherwise `m` with any room grant
+ * stripped to []. The owner's own turns, which a harness has always been
+ * granted for, pass unchanged: the owner's DM, and the owner-spoken relayed
+ * voice turn the daemon marks relay_speaker "owner" (audit r2 R2-T1; the SAME
+ * rule the connectors apply, Task R2a). Everything else with grants is
+ * stripped: an allowlist fails closed on any new granted audience.
+ *
+ * Never mutates `m`: the buffer and in-flight records keep the original, so a
+ * later per-tool consumer still receives it. The stripped copy keeps every
+ * other field (audience, relay_speaker) as is, except `memory_write`, which
+ * no non-per-tool consumer ever receives (Markdown memory 7a, review m-3).
+ */
+export declare function withConsumerGrants(m: BridgeMessage, perToolConsumer: boolean): BridgeMessage;

package/dist/http-server.d.ts

@@ -16,6 +16,16 @@ export declare function writeSse(res: {
     writableEnded?: boolean;
     write: (s: string) => boolean;
 }, msgs: BridgeMessage[], onWriteError?: (error: unknown) => void): BridgeMessage[];
+/**
+ * Audit C-B1 / r2 R2-T2: deliver one SSE batch. An SSE consumer never declares
+ * per-tool enforcement, so the WRITTEN copies have room grants stripped; the
+ * unwritten tail is requeued as the ORIGINAL messages, never a stripped copy,
+ * so a later per-tool consumer still receives the grant.
+ */
+export declare function deliverSseBatch(res: Parameters<typeof writeSse>[0], batch: BridgeMessage[], agent: {
+    ackRuntimeMessages(ids: string[]): void;
+    requeueFront(msgs: BridgeMessage[]): void;
+}, onWriteError?: (error: unknown) => void): void;
 /**
  * Once-per-connection write-failure reporter (#335). A throwing `res.write`
  * means the socket is dying — teardown follows via the request's `'close'` —