@securecoms/agent-bridge 0.26.6 → 0.28.0

package/dist/memory/embedder/windows.d.ts

@@ -0,0 +1,46 @@
+/** Compiled; flipped only by Task 27b's follow-up PR. While false, a win32 bridge reports `unsupported_platform`. */
+export declare const WINDOWS_SEMANTIC_ENABLED = false;
+export declare const windowsSemanticOn: (platform: NodeJS.Platform, enabled?: boolean) => boolean;
+/** %LOCALAPPDATA%\SecureComs\run\embedder; it lives in embedder-paths.ts so the embedder bundle never imports this module. */
+export { windowsRunDir } from "./embedder-paths.js";
+/** icacls /save writes UTF-16LE: line 1 is the path, line 2 the SDDL. */
+export declare function parseSaveSddl(saveFile: Buffer): string;
+/**
+ * P-7 delta M2 and 11d review L1/L2. The SDDL is parsed, not pattern-matched:
+ * - the owner (`O:`), when the save file carries one, must be the user SID, SYSTEM (SY) or Administrators (BA);
+ * - the DACL is anchored on the FIRST `D:`; its flags are letters only; then one or more `(…)` ACEs whose bodies may not
+ *   contain `(` (a conditional ACE such as `(XA;;FA;;;S-1-…;(@User.x))` is rejected outright); after the ACEs only an
+ *   `S:` section or the end may follow (a second `D:` or any trailing text is rejected);
+ * - "A" (allow) must name the user SID, SY or BA; "D" (deny) grants nothing and is accepted; every other type (OA, XA,
+ *   ZA, AU, …), a missing DACL and an empty `D:` are rejected. Inherited entries (the ID flag) get no exemption.
+ */
+export declare function aclAllows(sddl: string, ownerSid: string): boolean;
+/** Any component of the path is a reparse point (Node reports junctions and symlinks as symbolic links). */
+export declare function hasReparsePoint(path: string, lstat?: (p: string) => {
+    isSymbolicLink(): boolean;
+}): boolean;
+type Runner = (cmd: string, args: string[]) => Promise<Buffer | string> | Buffer | string;
+/** P-7 delta M1: the SID from `whoami /user /fo csv /nh`, never the environment; any S-1-… (local, domain, Microsoft account or Entra S-1-12-1-…). */
+export declare function currentUserSid(run?: Runner): Promise<string>;
+export interface AclDeps {
+    run?: Runner;
+    lstat?: (p: string) => {
+        isSymbolicLink(): boolean;
+    };
+    tmp?: string;
+}
+/**
+ * True only when `path` (the run directory, or the token file inside it) has no reparse point on the way and its DACL
+ * allows only this user, SYSTEM and Administrators. P-7 delta H1: icacls' stdout is localized text and is never parsed;
+ * the /save FILE is always read. Any failure is false (fail closed). `sid` is the cached per-process SID (WindowsAcl).
+ */
+export declare function verifyRunDirAcl(path: string, deps?: AclDeps, sid?: () => Promise<string>): Promise<boolean>;
+/** One per process: the current user's SID is read once (a failed read is not cached, so the next check retries). */
+export declare class WindowsAcl {
+    private readonly deps;
+    private sidP;
+    constructor(deps?: AclDeps);
+    sid(): Promise<string>;
+    check(path: string): Promise<boolean>;
+}
+export declare const PROCESS_WINDOWS_ACL: WindowsAcl;

package/dist/memory/embedder/worker-body.d.ts

@@ -0,0 +1,44 @@
+import type { EmbedderWorkerData } from "./types.js";
+/** The slice of onnxruntime-web this body uses; the real module satisfies it. */
+export interface OrtLike {
+    env: {
+        wasm: {
+            wasmBinary?: ArrayBufferLike | Uint8Array;
+            numThreads?: number;
+            proxy?: boolean;
+        };
+    };
+    Tensor: new (type: "int64", data: BigInt64Array, dims: number[]) => unknown;
+    InferenceSession: {
+        create(model: Uint8Array): Promise<{
+            run(feeds: Record<string, unknown>): Promise<Record<string, {
+                data: unknown;
+            }>>;
+        }>;
+    };
+}
+export interface PortLike {
+    postMessage(m: unknown, transfer?: ArrayBuffer[]): void;
+    on(ev: "message", f: (m: {
+        job_id: number;
+        text: string;
+    }) => void): void;
+}
+type Spec = {
+    path: string;
+    sha256: string;
+    size: number;
+};
+/** What the body needs: the worker data with a lookup key per file (erratum E1: `read` maps the key to the bytes it was handed). */
+export type WorkerBodyData = Omit<EmbedderWorkerData, "bytes" | "model" | "vocab" | "wasm"> & {
+    model: Spec;
+    vocab: Spec;
+    wasm: Spec;
+};
+export declare function runWorker(o: {
+    read: (path: string) => Uint8Array;
+    ort: OrtLike;
+    port: PortLike;
+    data: WorkerBodyData;
+}): Promise<"ready" | "fatal">;
+export {};

package/dist/memory/embedder/worker.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/memory/memory-config.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Spec §11.2 (OQ-L), plan D-5: the bridge parse of `payload.memory`.
+ *
+ * The mode is not a security control. A value the bridge cannot read turns
+ * notes OFF (no reads, writes refused with `mode`) and deletes nothing; it
+ * never purges. Absent and `{}` mean `{ mode: "markdown", clear_generation: 0 }`
+ * (an old backend, or a row never given a memory value). `null` is neither,
+ * so it fails closed (D-5). `"semantic"` turns recall on as well (7b, spec §5.3);
+ * notes stay on in both modes.
+ */
+import { type RecallDays } from "@agentvault/connect-mls-store";
+export type PayloadMemory = {
+    notesOn: true;
+    clearGeneration: number;
+    mode: "markdown" | "semantic";
+    recallDays?: RecallDays;
+    unrecognized?: undefined;
+} | {
+    notesOn: false;
+    clearGeneration?: undefined;
+    unrecognized: "mode" | "generation";
+};
+export declare function parsePayloadMemory(raw: unknown): PayloadMemory;

package/dist/memory/note-frames.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Spec §8.1 (audit r1 M-2): the memory_note frames between the runtime and
+ * the bridge. The bridge trusts no field of the frame but these five, and
+ * none of them decides WHERE a note goes or WHO may write it: the channel,
+ * the sender, the authorization and the source text all come from the
+ * bridge-held in-flight record (W2 to W8 in BridgeAgent.applyMemoryNote).
+ * A `channel_id`, `audience`, `authorization` or `transcribed` in the frame
+ * is ignored.
+ */
+/** Spec §8.2, §18.1: content-free refusal classes, the only thing a refusal says. */
+export declare const REASON_CLASSES: readonly ["mode", "invalid", "message", "audience", "provenance", "secret", "cap", "cleared", "store", "budget", "purged"];
+export type ReasonClass = (typeof REASON_CLASSES)[number];
+export interface MemoryNoteFrame {
+    request_id: string;
+    message_id: string;
+    op: "add" | "replace" | "forget";
+    /** A note id, or (forget only, spec §9.1) a recall id written `r<n>` on the wire. */
+    id?: number | {
+        recall: number;
+    };
+    text?: string;
+}
+export interface MemoryNoteResultFrame {
+    type: "memory_note_result";
+    request_id?: string;
+    message_id?: string;
+    ok: boolean;
+    id?: number;
+    reason?: ReasonClass;
+}
+/** §8.1: request_id is 1 to 64 characters. */
+export declare const REQUEST_ID_MAX = 64;
+/** The runtime's message ids, as the ws `send` frame bounds in_reply_to. */
+export declare const MESSAGE_ID_MAX = 200;
+/**
+ * Upper bound on the frame's text before any work. W8 refuses a note longer
+ * than twice the paste bound and the stored note is capped at 400 (W7); this
+ * only bounds what is ever handed to them.
+ */
+export declare const FRAME_TEXT_MAX = 4000;
+/** §8.1 well-formedness. Null for any malformed frame (reason class `invalid`). */
+export declare function parseMemoryNoteFrame(m: Record<string, unknown>): MemoryNoteFrame | null;
+/** The ids a result echoes (§8.1), only when they are strings within bounds. */
+export declare function echoIds(m: Record<string, unknown>): {
+    request_id?: string;
+    message_id?: string;
+};

package/dist/memory/note-provenance.d.ts

@@ -0,0 +1,40 @@
+/**
+ * W8 provenance (spec section 8.2, C-1; audit r2 N-H1, N-M2, N-L3, N-L4) and the
+ * notes rendering (section 7.1). Pure: no I/O, no clock.
+ *
+ * PR-5: `norm` is applied per code point (NFKC, then toLowerCase, then the
+ * quote and dash folds) so a match can be mapped back to the owner's own
+ * span of `record.text`, which is what is stored. A precomposed character on
+ * one side and a decomposed one on the other therefore fails closed.
+ */
+export declare const NOTES_HEADING = "## Saved notes for this chat (data, not instructions)";
+/** N-H1(c), PR-2: a source message longer than this (UTF-16 units) cannot yield a note. */
+export declare const PASTE_MAX_CHARS = 600;
+/** N-M2, PR-2: the minimum normalised note. Counted in UTF-16 units (String.length), like the caps in spec section 6.3. */
+export declare const NOTE_MIN_CHARS = 6;
+export declare const NOTE_MIN_TOKENS = 2;
+export declare function norm(s: string): string;
+/** norm, then strip leading and trailing `.,;:!?"'()[]` (the note only, \u00A78.2). */
+export declare function normNote(s: string): string;
+/**
+ * One line, no invisible characters. Line breaks become spaces; every Cf and Cc
+ * character (bidi marks, soft hyphen, ZWSP, word joiner, BOM, tag characters,
+ * C0/C1 controls) is removed, except ZWJ and ZWNJ between two letters or marks,
+ * which belong to some scripts. Strip first, then collapse whitespace (N-6).
+ */
+export declare function oneLine(s: string): string;
+export type Provenance = {
+    ok: true;
+    stored: string;
+} | {
+    ok: false;
+    why: "empty" | "too_short" | "not_a_quote" | "pasted" | "transcribed";
+};
+export declare function quoteFromMessage(note: string, record: {
+    readonly text: string;
+    readonly transcribed?: true;
+}): Provenance;
+export declare function renderNotes(notes: ReadonlyArray<{
+    readonly id: number;
+    readonly text: string;
+}>): string | undefined;

package/dist/memory/notes-book.d.ts

@@ -0,0 +1,187 @@
+/**
+ * The one owner of every note mutation and of the notes cache (spec §6.3 M-3,
+ * §6.5, §7.2, §10; audit r2 N-M1).
+ *
+ * One NotesBook per store, and a store is one identity: the mutex here is the
+ * per-identity note mutex of spec §6.3. Every add, replace, forget, the legacy
+ * import, the clear purge, the channel purge and every cache fill run inside it.
+ *
+ * LEAF LOCK: code under the mutex awaits only store seal/open/read calls.
+ * Never await heldPosition, the network, an MLS operation or an SDK lock here.
+ *
+ * TEXT CONTRACT: the `text` of an add or replace is a `StoredNoteText`. The
+ * only producer is `prepareStoredNote`, which runs W8 (`quoteFromMessage`, the
+ * owner's own span on one line) and then W5 (`scanNote` on that stored span),
+ * in the spec §8.2 table order. The model's text can therefore never reach
+ * write() without a cast. NotesBook then runs the duplicate check and the caps
+ * (W7) on that text. It also passes the text through `oneLine` (idempotent on
+ * `stored`) as a floor.
+ *
+ * Known limitation (Task 1 review m6): a forget or a clear deletes rows
+ * logically. The sealed ciphertext can remain in SQLite free pages and the WAL
+ * until overwritten, and still opens under the same device key. `secure_delete`
+ * is not enabled (database-wide cost). Recorded for the release notes.
+ */
+import { type NoteCommit, type NoteCommitResult, type NotesSnapshot, type RuntimeInboxRewrite } from "@agentvault/connect-mls-store";
+import { type Provenance } from "./note-provenance.js";
+import { type ServiceLog } from "../service-log.js";
+export interface NotesStore {
+    memoryClearGeneration(): number;
+    readMemoryNotes(conversationId: string): Promise<NotesSnapshot>;
+    sealMemoryNote(conversationId: string, text: string): Promise<Uint8Array>;
+    peekNextMemoryNoteId(conversationId: string): number;
+    commitMemoryNote(c: NoteCommit): NoteCommitResult;
+    applyMemoryClear(generation: number): boolean;
+    readMemoryFactsForImport(conversationId: string): Promise<Array<{
+        factId: number;
+        text: string;
+    }>>;
+    purgeMemory(conversationId: string): void;
+    conversationPurgeEpoch(conversationId: string): number;
+}
+/** FIFO async mutex. A rejected holder releases the lock; it never wedges the queue. */
+export declare class AsyncMutex {
+    private tail;
+    run<T>(fn: () => Promise<T>): Promise<T>;
+}
+declare const storedNoteBrand: unique symbol;
+/** A note text that passed W8 and then W5. Produced only by prepareStoredNote (Task 4 review m6b). */
+export type StoredNoteText = string & {
+    readonly [storedNoteBrand]: true;
+};
+export type PreparedNote = {
+    ok: true;
+    text: StoredNoteText;
+} | {
+    ok: false;
+    reason: "provenance";
+    why: Extract<Provenance, {
+        ok: false;
+    }>["why"];
+} | {
+    ok: false;
+    reason: "secret";
+};
+/**
+ * W8 then W5 (spec §8.2 table order). W5 runs on the STORED span (the owner's
+ * own words, on one line), never on the model's text. A refusal yields no brand.
+ */
+export declare function prepareStoredNote(modelText: string, record: {
+    readonly text: string;
+    readonly transcribed?: true;
+}): PreparedNote;
+/** Proof that the caller classified this channel's turn as an owner-DM write (spec §8.3, §10 M-6). */
+export interface ImportAuthorization {
+    readonly memory_write: true;
+}
+export type ClearOutcome = "applied" | "equal" | "lower" | "out_of_range";
+/**
+ * 7b Task 18 (spec §9.1 W9, audit r2 M-B): a replace and a forget are destructive, so each carries the
+ * prepared runtime_inbox rewrite that spends this message's one destructive operation. It is REQUIRED by
+ * type: the count commits in the same transaction as the change, or neither does.
+ */
+export type NoteMutation = {
+    op: "add";
+    text: StoredNoteText;
+} | {
+    op: "replace";
+    id: number;
+    text: StoredNoteText;
+    rewrite: RuntimeInboxRewrite;
+} | {
+    op: "forget";
+    id: number;
+    rewrite: RuntimeInboxRewrite;
+};
+/**
+ * `budget`: this message already spent its destructive operation (W9). `purged`: the
+ * conversation was purged after the write was queued (Task 14 M-A; Task 18 carry 5, distinct
+ * from the owner's clear).
+ */
+export type NoteWriteResult = {
+    ok: true;
+    id: number;
+    notesCount: number;
+    docChars: number;
+    deduped?: true;
+} | {
+    ok: false;
+    reason: "cap" | "cleared" | "purged" | "budget" | "store" | "invalid" | PrecommitVeto;
+};
+/**
+ * A caller's last check, run inside the mutex after the seal and immediately
+ * before the synchronous commit (Task 7 fix round 1: W1 and W2 there). A
+ * non-null result refuses with that reason and writes nothing.
+ */
+export type PrecommitVeto = "message" | "mode";
+export declare class NotesBook {
+    private readonly store;
+    private readonly log;
+    private readonly onClearedLocked;
+    private readonly mutex;
+    private readonly cache;
+    /**
+     * Review m-4: channels whose legacy import ran to completion in this
+     * process. A per-turn re-run re-read and re-opened every remaining fact and
+     * logged memory.import_partial on every owner turn. Invalidation: an
+     * applied clear empties the set; invalidateLegacyImport(channel) re-arms
+     * one channel when a new legacy assignment lands (Task 8 wires it). An
+     * import that throws is not recorded. A restart re-arms all channels.
+     * Cost (accepted): a fact refused for a cap stays a fact after the owner
+     * forgets notes, until a clear, a new assignment or a restart.
+     */
+    private readonly imported;
+    /** In-memory mirror of the stored applied generation, changed only inside clear() (an apply or a resync). */
+    private generation;
+    constructor(store: NotesStore, log?: ServiceLog, onClearedLocked?: () => void);
+    /** The memory mutex for recall work (spec §4 M2: the NotesBook mutex is the per-identity memory mutex). Leaf lock. */
+    exclusive<T>(fn: () => Promise<T>): Promise<T>;
+    appliedGeneration(): number;
+    /** Synchronous, for ws-server flush. A missing entry or a stale generation is a miss (N-M1). */
+    deliverable(channelId: string): {
+        notes?: string;
+        generation: number;
+        miss: boolean;
+    };
+    /** Warm one channel's entry under the mutex (N-M1). Never rejects: a read failure leaves a miss. */
+    fill(channelId: string): Promise<void>;
+    private fillQuiet;
+    /** Call only under the mutex. On a read failure or another generation the entry is dropped (a miss), never kept stale. */
+    private fillLocked;
+    write(channelId: string, mutation: NoteMutation, expectGeneration: number, precommit?: () => PrecommitVeto | null): Promise<NoteWriteResult>;
+    /**
+     * §6.5, N-M1: the commit, the mirror and the cache empty run with NO await between them.
+     * L-4: a generation outside 0..MAX_CLEAR_GENERATION is refused before the store.
+     * The outcome lets the caller log `memory.clear_generation_regressed` on "lower"
+     * (review m6c) without re-reading appliedGeneration().
+     */
+    clear(generation: number): Promise<ClearOutcome>;
+    /** The clear is committed: a hook failure must not reject it (the caller would retry a done clear). Call only under the mutex. */
+    private callClearedHook;
+    /** §6.4 (OQ-K): the channel purge, with its cache entry emptied inside the mutex. */
+    purgeChannel(channelId: string): Promise<void>;
+    /**
+     * §10 (M-6): move this channel's legacy facts into notes, oldest first.
+     *
+     * `auth` is the proof (review m6a): the caller passes the turn's frozen
+     * authorization, which carries `memory_write: true` only for an owner-DM turn.
+     * Room and partner facts stay facts.
+     * §10 is the authority: this runs lazily per owner-DM channel, never as a
+     * sweep at bridge start (OQ-F as superseded by M-6, audit r2 N-M3).
+     *
+     * A fact moves only when it passes the secret scan, is not a duplicate of an
+     * existing note, and fits the 200-note and 8,000-character caps (it is exempt
+     * from the 400-character note cap and from W8). Anything else stays a fact
+     * under its 90-day clock, counted in `memory.import_partial { remaining }`.
+     */
+    importLegacy(channelId: string, auth: ImportAuthorization): Promise<void>;
+    /**
+     * Review m-4: re-arm one channel's import (a new legacy assignment landed).
+     * Task 8: under the mutex, so an import already in flight for the channel
+     * (which read the facts before the assignment landed) records itself first
+     * and this delete then wins; a bare delete would be undone by that record.
+     */
+    invalidateLegacyImport(channelId: string): Promise<void>;
+    private importLocked;
+}
+export {};

package/dist/memory/provider.d.ts

@@ -4,6 +4,7 @@ export interface MemoryProvider {
     record(input: MemoryRecordInput): Promise<{
         seq: number;
         deduped: boolean;
+        dropped?: true;
     }>;
     context(conversationId: string, limit?: number): Promise<MemoryContextResult>;
     /** Optional adapter counters surfaced on the daemon healthcheck. */
@@ -16,6 +17,7 @@ export declare class SecureComsLocalMemory implements MemoryProvider {
     record(input: MemoryRecordInput): Promise<{
         seq: number;
         deduped: boolean;
+        dropped?: true;
     }>;
     context(conversationId: string, limit?: number): Promise<MemoryContextResult>;
 }

package/dist/memory/recall/call-heartbeat.d.ts

@@ -0,0 +1,35 @@
+import { type ServiceLog } from "../../service-log.js";
+import { HEARTBEAT_STALE_MS } from "../embedder/heartbeats.js";
+/** Ruling P-1 (plan, controller rulings): a `voiceMode` turn ingested within the last 120 s means a live call. */
+export declare const VOICE_LIVE_WINDOW_MS = 120000;
+/** Spec §8: the heartbeat's mtime is refreshed every 10 s while live. */
+export declare const HEARTBEAT_REFRESH_MS = 10000;
+/** Spec §8, §20 E1.4: background jobs are held while any heartbeat is newer than 30 s (fix M1: and not far in the future). */
+export { HEARTBEAT_STALE_MS };
+export declare class CallHeartbeat {
+    /** null: disabled (Task 19 fix M2, a construction without machine paths): nothing is written or read. */
+    private readonly dir;
+    private readonly identityId;
+    private readonly liveWindowMs;
+    private readonly now;
+    private readonly log;
+    private lastVoiceAt;
+    private wrote;
+    private refusedLogged;
+    constructor(
+    /** null: disabled (Task 19 fix M2, a construction without machine paths): nothing is written or read. */
+    dir: string | null, identityId: string, liveWindowMs: number, now?: () => number, log?: ServiceLog);
+    private live;
+    /** A `voiceMode` turn was ingested. Going live writes the heartbeat at once (no 10 s lag before other bridges pause). */
+    noteVoiceActivity(): void;
+    /** Every 10 s: touch the file while live (ruling P-1), remove it when not. Never throws. */
+    refresh(): void;
+    /** Bridge stop: the call (as far as this bridge knows) ends with it. */
+    stop(): void;
+    /** True when any identity's heartbeat (a regular file) is fresh (heartbeats.ts: age in [-60 s, staleMs]). Never throws. */
+    anyLive(staleMs?: number): boolean;
+    /** The checked directory, or null when disabled or refused. */
+    private dirOk;
+    private touch;
+    private remove;
+}

package/dist/memory/recall/membership-purge.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Spec §5.4 (H4, D-6) with audit r2 H-A and audit r1 (plan) C2, H6, M6, plus
+ * the Task 13 dr-evil fix round. The only production caller of purgeMemory.
+ * Purges turns, facts, notes and recall of a conversation the agent has left,
+ * on evidence only:
+ *
+ * - The conversation's OWN recorded enclave was listed successfully and
+ *   NON-EMPTY in this sweep, and that listing does not contain it. Nothing
+ *   else is evidence: no recorded enclave, a failed listing, an empty listing
+ *   (a membership or RLS false-zero answers 200 []) and an enclave not
+ *   enumerated this sweep all leave the record as it is.
+ * - The conversation has been listed before (the store's persisted is_dm is
+ *   set only from a listing). A channel no listing has ever shown (a hidden
+ *   FileSafe vault channel) is never evidence, across restarts too.
+ * - A DM (store is_dm === true) additionally needs a per-channel 404 in the
+ *   same sweep. A DM is never purged on the listing alone, and a 404 alone is
+ *   never enough either (fix round CRITICAL: an empty listing plus a 404 on
+ *   every probe must not purge the owner DM).
+ * - No inbound message arrived for it since the previous absence (LOW 3 veto).
+ * - The absences are consecutive: a record whose newest absence is older than
+ *   two sweep intervals restarts (MEDIUM 1).
+ * - Two absences at least an hour apart; more than one NEW absence in one
+ *   sweep is held.
+ *
+ * A malicious backend can still cause a purge by hiding one channel twice:
+ * availability only (§2).
+ *
+ * Limitation (stated, not fixed): removal from a whole enclave makes its
+ * listing 404, which is a failed listing, so no conversation in it is ever
+ * purged.
+ */
+import { type ServiceLog } from "../../service-log.js";
+export declare const PURGE_MIN_GAP_MS: number;
+export declare const PURGE_SWEEP_INTERVAL_MS: number;
+/** Fix round MEDIUM 1: a record whose newest absence is older than this restarts. */
+export declare const PURGE_ABSENCE_EXPIRY_MS: number;
+export type ProbeResult = "member" | "gone" | "error";
+export type AbsenceRecord = {
+    firstAbsentAt: number;
+    refreshes: number;
+    lastAbsentAt: number;
+};
+/** Audit r1 C2: only a 404 is "gone"; 2xx is "member"; 401, 403, any other status, and a throw are "error". */
+export declare function probeResultFor(status: number | "threw"): ProbeResult;
+export interface MembershipPurgeDeps {
+    conversations(): string[];
+    enclaveOf(conversationId: string): string | undefined;
+    /** The store's persisted is_dm: true, false, or undefined when no listing has ever shown the channel. */
+    isDm(conversationId: string): boolean | undefined;
+    enclaves(): Promise<Iterable<string>>;
+    listChannels(enclaveId: string): Promise<ReadonlyArray<{
+        channel_id: string;
+    }>>;
+    probeChannel(conversationId: string): Promise<ProbeResult>;
+    absenceOf(conversationId: string): AbsenceRecord | undefined;
+    markAbsent(conversationId: string, now: number): AbsenceRecord;
+    clearAbsence(conversationId: string): void;
+    purge(conversationId: string): Promise<void>;
+    now(): number;
+    /** LOW 3: when an inbound message for the conversation was last received, if known. */
+    lastInboundAt?(conversationId: string): number | undefined;
+    /** MEDIUM 3: true once the host is closing; the sweep stops before its next step. */
+    stopping?(): boolean;
+    log?: ServiceLog;
+}
+export type SweepOutcome = {
+    purged: string[];
+    held: number;
+    absent: number;
+};
+export declare class MembershipPurgeSweeper {
+    private readonly d;
+    private running;
+    private held;
+    private prevSweepAt;
+    constructor(d: MembershipPurgeDeps);
+    /** Audit r2 LOW: the held-departure count of the newest sweep, for machine_report.memory_purge_held. */
+    lastHeld(): number;
+    /** Task 13 carry LOW 1: the start time of the newest COMPLETED sweep (a sweep stopped while closing is not one). */
+    lastSweepAt(): number | undefined;
+    sweep(): Promise<SweepOutcome>;
+}

package/dist/memory/recall/rank.d.ts

@@ -0,0 +1,15 @@
+/** Spec §7.3: brute-force cosine (dot product of normalised vectors), on the main thread (≤ 5,000 × 384 multiply-adds). */
+export declare function rankRecall(query: Float32Array, cache: {
+    vecs: Float32Array;
+    dims: number;
+    messageIds: readonly string[];
+    recallIds: readonly number[];
+}, o: {
+    exclude: ReadonlySet<string>;
+    threshold: number;
+    k: number;
+}): Array<{
+    recallId: number;
+    messageId: string;
+    score: number;
+}>;