@securecoms/agent-bridge 0.27.0 → 0.28.0

package/dist/memory/embedder/worker-body.d.ts

@@ -0,0 +1,44 @@
+import type { EmbedderWorkerData } from "./types.js";
+/** The slice of onnxruntime-web this body uses; the real module satisfies it. */
+export interface OrtLike {
+    env: {
+        wasm: {
+            wasmBinary?: ArrayBufferLike | Uint8Array;
+            numThreads?: number;
+            proxy?: boolean;
+        };
+    };
+    Tensor: new (type: "int64", data: BigInt64Array, dims: number[]) => unknown;
+    InferenceSession: {
+        create(model: Uint8Array): Promise<{
+            run(feeds: Record<string, unknown>): Promise<Record<string, {
+                data: unknown;
+            }>>;
+        }>;
+    };
+}
+export interface PortLike {
+    postMessage(m: unknown, transfer?: ArrayBuffer[]): void;
+    on(ev: "message", f: (m: {
+        job_id: number;
+        text: string;
+    }) => void): void;
+}
+type Spec = {
+    path: string;
+    sha256: string;
+    size: number;
+};
+/** What the body needs: the worker data with a lookup key per file (erratum E1: `read` maps the key to the bytes it was handed). */
+export type WorkerBodyData = Omit<EmbedderWorkerData, "bytes" | "model" | "vocab" | "wasm"> & {
+    model: Spec;
+    vocab: Spec;
+    wasm: Spec;
+};
+export declare function runWorker(o: {
+    read: (path: string) => Uint8Array;
+    ort: OrtLike;
+    port: PortLike;
+    data: WorkerBodyData;
+}): Promise<"ready" | "fatal">;
+export {};

package/dist/memory/embedder/worker.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/memory/memory-config.d.ts

@@ -1,6 +1,19 @@
+/**
+ * Spec §11.2 (OQ-L), plan D-5: the bridge parse of `payload.memory`.
+ *
+ * The mode is not a security control. A value the bridge cannot read turns
+ * notes OFF (no reads, writes refused with `mode`) and deletes nothing; it
+ * never purges. Absent and `{}` mean `{ mode: "markdown", clear_generation: 0 }`
+ * (an old backend, or a row never given a memory value). `null` is neither,
+ * so it fails closed (D-5). `"semantic"` turns recall on as well (7b, spec §5.3);
+ * notes stay on in both modes.
+ */
+import { type RecallDays } from "@agentvault/connect-mls-store";
 export type PayloadMemory = {
     notesOn: true;
     clearGeneration: number;
+    mode: "markdown" | "semantic";
+    recallDays?: RecallDays;
     unrecognized?: undefined;
 } | {
     notesOn: false;

package/dist/memory/note-frames.d.ts

@@ -8,13 +8,16 @@
  * is ignored.
  */
 /** Spec §8.2, §18.1: content-free refusal classes, the only thing a refusal says. */
-export declare const REASON_CLASSES: readonly ["mode", "invalid", "message", "audience", "provenance", "secret", "cap", "cleared", "store"];
+export declare const REASON_CLASSES: readonly ["mode", "invalid", "message", "audience", "provenance", "secret", "cap", "cleared", "store", "budget", "purged"];
 export type ReasonClass = (typeof REASON_CLASSES)[number];
 export interface MemoryNoteFrame {
     request_id: string;
     message_id: string;
     op: "add" | "replace" | "forget";
-    id?: number;
+    /** A note id, or (forget only, spec §9.1) a recall id written `r<n>` on the wire. */
+    id?: number | {
+        recall: number;
+    };
     text?: string;
 }
 export interface MemoryNoteResultFrame {

package/dist/memory/notes-book.d.ts

@@ -22,7 +22,7 @@
  * until overwritten, and still opens under the same device key. `secure_delete`
  * is not enabled (database-wide cost). Recorded for the release notes.
  */
-import { type NoteCommit, type NoteCommitResult, type NotesSnapshot } from "@agentvault/connect-mls-store";
+import { type NoteCommit, type NoteCommitResult, type NotesSnapshot, type RuntimeInboxRewrite } from "@agentvault/connect-mls-store";
 import { type Provenance } from "./note-provenance.js";
 import { type ServiceLog } from "../service-log.js";
 export interface NotesStore {
@@ -37,6 +37,7 @@ export interface NotesStore {
         text: string;
     }>>;
     purgeMemory(conversationId: string): void;
+    conversationPurgeEpoch(conversationId: string): number;
 }
 /** FIFO async mutex. A rejected holder releases the lock; it never wedges the queue. */
 export declare class AsyncMutex {
@@ -74,6 +75,11 @@ export interface ImportAuthorization {
     readonly memory_write: true;
 }
 export type ClearOutcome = "applied" | "equal" | "lower" | "out_of_range";
+/**
+ * 7b Task 18 (spec §9.1 W9, audit r2 M-B): a replace and a forget are destructive, so each carries the
+ * prepared runtime_inbox rewrite that spends this message's one destructive operation. It is REQUIRED by
+ * type: the count commits in the same transaction as the change, or neither does.
+ */
 export type NoteMutation = {
     op: "add";
     text: StoredNoteText;
@@ -81,10 +87,17 @@ export type NoteMutation = {
     op: "replace";
     id: number;
     text: StoredNoteText;
+    rewrite: RuntimeInboxRewrite;
 } | {
     op: "forget";
     id: number;
+    rewrite: RuntimeInboxRewrite;
 };
+/**
+ * `budget`: this message already spent its destructive operation (W9). `purged`: the
+ * conversation was purged after the write was queued (Task 14 M-A; Task 18 carry 5, distinct
+ * from the owner's clear).
+ */
 export type NoteWriteResult = {
     ok: true;
     id: number;
@@ -93,7 +106,7 @@ export type NoteWriteResult = {
     deduped?: true;
 } | {
     ok: false;
-    reason: "cap" | "cleared" | "store" | "invalid" | PrecommitVeto;
+    reason: "cap" | "cleared" | "purged" | "budget" | "store" | "invalid" | PrecommitVeto;
 };
 /**
  * A caller's last check, run inside the mutex after the seal and immediately
@@ -104,6 +117,7 @@ export type PrecommitVeto = "message" | "mode";
 export declare class NotesBook {
     private readonly store;
     private readonly log;
+    private readonly onClearedLocked;
     private readonly mutex;
     private readonly cache;
     /**
@@ -119,7 +133,9 @@ export declare class NotesBook {
     private readonly imported;
     /** In-memory mirror of the stored applied generation, changed only inside clear() (an apply or a resync). */
     private generation;
-    constructor(store: NotesStore, log?: ServiceLog);
+    constructor(store: NotesStore, log?: ServiceLog, onClearedLocked?: () => void);
+    /** The memory mutex for recall work (spec §4 M2: the NotesBook mutex is the per-identity memory mutex). Leaf lock. */
+    exclusive<T>(fn: () => Promise<T>): Promise<T>;
     appliedGeneration(): number;
     /** Synchronous, for ws-server flush. A missing entry or a stale generation is a miss (N-M1). */
     deliverable(channelId: string): {
@@ -140,6 +156,8 @@ export declare class NotesBook {
      * (review m6c) without re-reading appliedGeneration().
      */
     clear(generation: number): Promise<ClearOutcome>;
+    /** The clear is committed: a hook failure must not reject it (the caller would retry a done clear). Call only under the mutex. */
+    private callClearedHook;
     /** §6.4 (OQ-K): the channel purge, with its cache entry emptied inside the mutex. */
     purgeChannel(channelId: string): Promise<void>;
     /**

package/dist/memory/provider.d.ts

@@ -4,6 +4,7 @@ export interface MemoryProvider {
     record(input: MemoryRecordInput): Promise<{
         seq: number;
         deduped: boolean;
+        dropped?: true;
     }>;
     context(conversationId: string, limit?: number): Promise<MemoryContextResult>;
     /** Optional adapter counters surfaced on the daemon healthcheck. */
@@ -16,6 +17,7 @@ export declare class SecureComsLocalMemory implements MemoryProvider {
     record(input: MemoryRecordInput): Promise<{
         seq: number;
         deduped: boolean;
+        dropped?: true;
     }>;
     context(conversationId: string, limit?: number): Promise<MemoryContextResult>;
 }

package/dist/memory/recall/call-heartbeat.d.ts

@@ -0,0 +1,35 @@
+import { type ServiceLog } from "../../service-log.js";
+import { HEARTBEAT_STALE_MS } from "../embedder/heartbeats.js";
+/** Ruling P-1 (plan, controller rulings): a `voiceMode` turn ingested within the last 120 s means a live call. */
+export declare const VOICE_LIVE_WINDOW_MS = 120000;
+/** Spec §8: the heartbeat's mtime is refreshed every 10 s while live. */
+export declare const HEARTBEAT_REFRESH_MS = 10000;
+/** Spec §8, §20 E1.4: background jobs are held while any heartbeat is newer than 30 s (fix M1: and not far in the future). */
+export { HEARTBEAT_STALE_MS };
+export declare class CallHeartbeat {
+    /** null: disabled (Task 19 fix M2, a construction without machine paths): nothing is written or read. */
+    private readonly dir;
+    private readonly identityId;
+    private readonly liveWindowMs;
+    private readonly now;
+    private readonly log;
+    private lastVoiceAt;
+    private wrote;
+    private refusedLogged;
+    constructor(
+    /** null: disabled (Task 19 fix M2, a construction without machine paths): nothing is written or read. */
+    dir: string | null, identityId: string, liveWindowMs: number, now?: () => number, log?: ServiceLog);
+    private live;
+    /** A `voiceMode` turn was ingested. Going live writes the heartbeat at once (no 10 s lag before other bridges pause). */
+    noteVoiceActivity(): void;
+    /** Every 10 s: touch the file while live (ruling P-1), remove it when not. Never throws. */
+    refresh(): void;
+    /** Bridge stop: the call (as far as this bridge knows) ends with it. */
+    stop(): void;
+    /** True when any identity's heartbeat (a regular file) is fresh (heartbeats.ts: age in [-60 s, staleMs]). Never throws. */
+    anyLive(staleMs?: number): boolean;
+    /** The checked directory, or null when disabled or refused. */
+    private dirOk;
+    private touch;
+    private remove;
+}

package/dist/memory/recall/membership-purge.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Spec §5.4 (H4, D-6) with audit r2 H-A and audit r1 (plan) C2, H6, M6, plus
+ * the Task 13 dr-evil fix round. The only production caller of purgeMemory.
+ * Purges turns, facts, notes and recall of a conversation the agent has left,
+ * on evidence only:
+ *
+ * - The conversation's OWN recorded enclave was listed successfully and
+ *   NON-EMPTY in this sweep, and that listing does not contain it. Nothing
+ *   else is evidence: no recorded enclave, a failed listing, an empty listing
+ *   (a membership or RLS false-zero answers 200 []) and an enclave not
+ *   enumerated this sweep all leave the record as it is.
+ * - The conversation has been listed before (the store's persisted is_dm is
+ *   set only from a listing). A channel no listing has ever shown (a hidden
+ *   FileSafe vault channel) is never evidence, across restarts too.
+ * - A DM (store is_dm === true) additionally needs a per-channel 404 in the
+ *   same sweep. A DM is never purged on the listing alone, and a 404 alone is
+ *   never enough either (fix round CRITICAL: an empty listing plus a 404 on
+ *   every probe must not purge the owner DM).
+ * - No inbound message arrived for it since the previous absence (LOW 3 veto).
+ * - The absences are consecutive: a record whose newest absence is older than
+ *   two sweep intervals restarts (MEDIUM 1).
+ * - Two absences at least an hour apart; more than one NEW absence in one
+ *   sweep is held.
+ *
+ * A malicious backend can still cause a purge by hiding one channel twice:
+ * availability only (§2).
+ *
+ * Limitation (stated, not fixed): removal from a whole enclave makes its
+ * listing 404, which is a failed listing, so no conversation in it is ever
+ * purged.
+ */
+import { type ServiceLog } from "../../service-log.js";
+export declare const PURGE_MIN_GAP_MS: number;
+export declare const PURGE_SWEEP_INTERVAL_MS: number;
+/** Fix round MEDIUM 1: a record whose newest absence is older than this restarts. */
+export declare const PURGE_ABSENCE_EXPIRY_MS: number;
+export type ProbeResult = "member" | "gone" | "error";
+export type AbsenceRecord = {
+    firstAbsentAt: number;
+    refreshes: number;
+    lastAbsentAt: number;
+};
+/** Audit r1 C2: only a 404 is "gone"; 2xx is "member"; 401, 403, any other status, and a throw are "error". */
+export declare function probeResultFor(status: number | "threw"): ProbeResult;
+export interface MembershipPurgeDeps {
+    conversations(): string[];
+    enclaveOf(conversationId: string): string | undefined;
+    /** The store's persisted is_dm: true, false, or undefined when no listing has ever shown the channel. */
+    isDm(conversationId: string): boolean | undefined;
+    enclaves(): Promise<Iterable<string>>;
+    listChannels(enclaveId: string): Promise<ReadonlyArray<{
+        channel_id: string;
+    }>>;
+    probeChannel(conversationId: string): Promise<ProbeResult>;
+    absenceOf(conversationId: string): AbsenceRecord | undefined;
+    markAbsent(conversationId: string, now: number): AbsenceRecord;
+    clearAbsence(conversationId: string): void;
+    purge(conversationId: string): Promise<void>;
+    now(): number;
+    /** LOW 3: when an inbound message for the conversation was last received, if known. */
+    lastInboundAt?(conversationId: string): number | undefined;
+    /** MEDIUM 3: true once the host is closing; the sweep stops before its next step. */
+    stopping?(): boolean;
+    log?: ServiceLog;
+}
+export type SweepOutcome = {
+    purged: string[];
+    held: number;
+    absent: number;
+};
+export declare class MembershipPurgeSweeper {
+    private readonly d;
+    private running;
+    private held;
+    private prevSweepAt;
+    constructor(d: MembershipPurgeDeps);
+    /** Audit r2 LOW: the held-departure count of the newest sweep, for machine_report.memory_purge_held. */
+    lastHeld(): number;
+    /** Task 13 carry LOW 1: the start time of the newest COMPLETED sweep (a sweep stopped while closing is not one). */
+    lastSweepAt(): number | undefined;
+    sweep(): Promise<SweepOutcome>;
+}

package/dist/memory/recall/rank.d.ts

@@ -0,0 +1,15 @@
+/** Spec §7.3: brute-force cosine (dot product of normalised vectors), on the main thread (≤ 5,000 × 384 multiply-adds). */
+export declare function rankRecall(query: Float32Array, cache: {
+    vecs: Float32Array;
+    dims: number;
+    messageIds: readonly string[];
+    recallIds: readonly number[];
+}, o: {
+    exclude: ReadonlySet<string>;
+    threshold: number;
+    k: number;
+}): Array<{
+    recallId: number;
+    messageId: string;
+    score: number;
+}>;

package/dist/memory/recall/recall-book.d.ts

@@ -0,0 +1,140 @@
+/**
+ * Semantic memory 7b: the bridge's recall index and read path (spec §4, §7).
+ * Runs every mutation inside the NotesBook mutex (`exclusive`), which is the
+ * per-identity memory mutex. Embedding and sealing happen OUTSIDE it (M2).
+ *
+ * I8: `index` is reached only from BridgeAgent.tapRecall (the ingest tap and
+ * the restore re-run). recall-single-writer.arch.test.ts pins that.
+ */
+import type { RecallCapture, RecallRow, RuntimeInboxRewrite, SqliteMlsStateStore } from "@agentvault/connect-mls-store";
+import { type ServiceLog } from "../../service-log.js";
+import type { Embedder } from "../embedder/client.js";
+export type IndexSkip = "mode" | "audience" | "voice" | "length" | "secret" | "stamp_missing" | "cleared" | "epoch" | "purged" | "duplicate" | "store";
+export interface RecallTapCapture {
+    readonly generation: number | undefined;
+    readonly capture: RecallCapture;
+}
+export interface RecallItem {
+    readonly id: number;
+    readonly text: string;
+    readonly sent_at: number;
+}
+export type RecallStore = Pick<SqliteMlsStateStore, "recallState" | "recallCapture" | "sealRecallText" | "sealRecallVec" | "insertRecall" | "readRecallRows" | "readRecallRow" | "openRecallText" | "openRecallVec" | "updateRecallVec" | "listPendingRecall" | "deleteRecall" | "recentMemoryMessageIds">;
+export declare class RecallBook {
+    private readonly d;
+    constructor(d: {
+        store: RecallStore;
+        embedder: Embedder;
+        exclusive: <T>(fn: () => Promise<T>) => Promise<T>;
+        modelId: string;
+        threshold: number;
+        now?: () => number;
+        log?: ServiceLog;
+    });
+    /**
+     * Spec §4 order: (1) seal and embed outside the mutex; (2) take the mutex;
+     * (3) one transaction (insertRecall) that re-checks I6, I7 and M-A, then I9.
+     * A seal failure inserts nothing (fail closed, §5.2). An embedder failure
+     * inserts a pending row (sealed_vec NULL) for the re-embed (§8).
+     */
+    index(i: {
+        conversationId: string;
+        messageId: string;
+        text: string;
+        sentAt: number;
+        capture: RecallCapture;
+    }): Promise<{
+        ok: true;
+        recallId: number;
+    } | {
+        ok: false;
+        reason: IndexSkip;
+    }>;
+    private static readonly MAP_MAX;
+    private static readonly IDLE_MS;
+    private static readonly TOP_K;
+    private static readonly TEXT_MAX_CHARS;
+    private static readonly QUERY_TIMEOUT_MS;
+    private readonly caches;
+    private readonly entries;
+    private readonly warming;
+    private same;
+    private nowMs;
+    cacheWarm(conversationId: string): boolean;
+    /**
+     * §7.3 (H2): snapshot first, open outside the mutex, install under it. Never on a turn's path. Never rejects:
+     * a read failure leaves the cache cold (fail closed: no recall).
+     *
+     * Final-review item 1 (HIGH): prepare() starts this warm on a cold cache and the same turn's tap inserts while
+     * the vectors are still opening. At the row cap that insert count-prunes and moves the content epoch, so the old
+     * "install only if all four epochs are unchanged" rule never installed, and the next turn repeated the race
+     * forever; below the cap the new row was missing from the installed cache. So at install, under the mutex, the
+     * rows and the capture are re-read synchronously:
+     *   - the clear generation, the mode epoch and the purge epoch must equal the snapshot's, else NOTHING installs
+     *     (a clear, a mode change or a purge during the warm always wins);
+     *   - the content epoch may differ (an insert, a prune, a forget or a re-embed): the cache is reconciled to the
+     *     re-read rows (ids gone are dropped, the few new ids are opened here, under the mutex) and installed with the
+     *     re-read capture.
+     */
+    warm(conversationId: string): Promise<void>;
+    /**
+     * §7.1: compute at ingest. Snapshot the capture FIRST (H2); `receipt`
+     * replaces its purge and mode epochs with the ones captured when the turn
+     * was received (Task 16 fix H-2), so a purge or a mode change after receipt
+     * refuses too. 150 ms bound on the query embed; a cold cache starts a warm
+     * and gives nothing.
+     */
+    prepare(p: {
+        messageId: string;
+        conversationId: string;
+        query: string;
+        excludeIds: ReadonlySet<string>;
+        timeoutMs?: number;
+        receipt?: {
+            purgeEpoch: number;
+            modeEpoch: number;
+        };
+    }): Promise<void>;
+    /** Q3 + Q6: the entry's own conversation, and its capture still current at delivery. Synchronous (ws flush). */
+    deliverable(messageId: string, conversationId: string): readonly RecallItem[] | undefined;
+    /**
+     * Spec §9.1 (H5, W9): delete one recall row and spend this message's destructive operation, in ONE store
+     * transaction (`deleteRecall` with the prepared rewrite). The caller has already checked that the id was
+     * shown with this delivery. `precommit` is the caller's last check (W1, W2), run inside the mutex with no
+     * await before the synchronous delete; a non-null veto deletes nothing.
+     *
+     * A forget is a delete, never an insert: I8 (single writer of insertRecall) is untouched.
+     * The delete moves the content epoch (audit r1 H5). The vector cache is dropped. A pending map entry that
+     * matched the capture just before the delete keeps its other items and adopts the new capture (the delete
+     * is the only change between the two reads, both inside the mutex with no await between them).
+     */
+    forget(conversationId: string, recallId: number, rewrite: RuntimeInboxRewrite, precommit?: () => "message" | "mode" | null): Promise<"ok" | "unknown_id" | "budget" | "message" | "mode">;
+    /**
+     * Spec §8 (Task 19): a pending row just took its vector (`updateRecallVec`, which moves no epoch). A warm cache
+     * whose capture is still current gains the row, so an active conversation's cache (kept warm by use) does not
+     * hide re-embedded rows until it idles out. A stale cache is dropped. Called inside `exclusive`.
+     */
+    onReembeddedLocked(conversationId: string, row: RecallRow, vec: Float32Array): void;
+    /** Spec §7.1: removed at ack, nack or retire. */
+    drop(messageId: string): void;
+    /** §5.4: one conversation's cache and its pending map entries. Called inside `exclusive`. */
+    dropConversationLocked(conversationId: string): void;
+    /** A retention change or a prune can remove rows: drop every vector cache. Called inside `exclusive`. */
+    dropAllCachesLocked(): void;
+    /** A clear or markdown mode: drop every cache and every map entry. Called inside `exclusive`. */
+    dropAllLocked(): void;
+    /** §7.3: a cache idle for 30 minutes is dropped. */
+    dropIdleCaches(now: number): void;
+    /**
+     * Task 17 fix round 1 (HIGH): at the row cap every insert count-prunes, so without this every pending map
+     * entry of the conversation went stale at the next insert and recall stopped. An entry is rebased only when
+     * its capture equals the exact pre-insert capture (clear generation, mode and purge epochs equal; the content
+     * epoch moved by this one insert alone) and none of its items was pruned. Anything else stays stale.
+     */
+    private rebaseEntriesLocked;
+    /** Spec §7.3 and audit r1 H7: an insert APPENDS its vector to a warm, current cache, inside the mutex. */
+    protected onInsertedLocked(conversationId: string, row: RecallRow, vec: Float32Array | null, r: {
+        pruned: readonly number[];
+        capture: RecallCapture;
+    }): void;
+}

package/dist/memory/recall/reembed.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Spec §8: lazy re-embed. Rows whose model_id is NULL (pending) or another model's are embedded again by background
+ * jobs: open the text, a priority-1 embedder job, seal under the new vector AAD, then inside the memory mutex a
+ * compare-and-set on the old model_id. One row per job, at most 16 rows per tick (the bridge ticks once a second;
+ * the shared embedder enforces 16 per second per machine, §20 E1.4). Paused while any call heartbeat of this OS user
+ * is fresh (H1, B-20).
+ *
+ * The capture is read BEFORE the row is re-read, opened and embedded, and the write re-checks it inside its
+ * transaction (`updateRecallVec`), bound to the recall id read (Task 18 carry M-4). A clear, a mode change or a purge
+ * that lands during the embed refuses the write; a row forgotten, pruned or purged takes no vector.
+ *
+ * Never an insert: the single-writer rule (I8) is untouched. Embedding and sealing happen outside the mutex (M2).
+ */
+import type { RecallRow, SqliteMlsStateStore } from "@agentvault/connect-mls-store";
+import type { Embedder } from "../embedder/client.js";
+export type ReembedStore = Pick<SqliteMlsStateStore, "recallCapture" | "listPendingRecall" | "readRecallRow" | "openRecallText" | "sealRecallVec" | "updateRecallVec">;
+export declare class ReembedQueue {
+    private readonly d;
+    constructor(d: {
+        store: ReembedStore;
+        embedder: Embedder;
+        exclusive: <T>(fn: () => Promise<T>) => Promise<T>;
+        modelId: string;
+        paused: () => boolean;
+        now?: () => number;
+        /** Inside the mutex, after a successful write: the bridge appends the vector to a warm, current cache. */
+        onEmbeddedLocked?: (conversationId: string, row: RecallRow, vec: Float32Array) => void;
+        embedTimeoutMs?: number;
+    });
+    private running;
+    private readonly parked;
+    /** Rows embedded and written by this call (0 when paused, not ready, already running or nothing pending). */
+    tick(): Promise<number>;
+    private tickOnce;
+}

package/dist/memory-taps.d.ts

@@ -3,6 +3,7 @@ interface MemorySink {
     record(input: MemoryRecordInput): Promise<{
         seq: number;
         deduped: boolean;
+        dropped?: true;
     }>;
 }
 /** Record an inbound (peer) text turn the agent actually consumed. Best-effort:
@@ -11,8 +12,8 @@ interface MemorySink {
  *  `modality` defaults to "text"; Task 4 (voice-mode carrier) passes "voice"
  *  for a turn whose InboxEntry had the server-set `voiceMode` flag, so memory
  *  continuity reflects how the turn actually arrived. */
-export declare function recordInboundMemory(sink: MemorySink, channelId: string, senderId: string, text: string, messageId: string, modality?: "text" | "voice"): Promise<void>;
+export declare function recordInboundMemory(sink: MemorySink, channelId: string, senderId: string, text: string, messageId: string, modality?: "text" | "voice", expectPurgeEpoch?: number): Promise<void>;
 /** Record the agent's own outbound reply. Best-effort. `modality` is "voice"
  *  for a line the voice fast path spoke (H1), else "text". */
-export declare function recordOutboundMemory(sink: MemorySink, channelId: string, text: string, messageId: string, modality?: "text" | "voice"): Promise<void>;
+export declare function recordOutboundMemory(sink: MemorySink, channelId: string, text: string, messageId: string, modality?: "text" | "voice", expectPurgeEpoch?: number): Promise<void>;
 export {};

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const BRIDGE_VERSION = "0.27.0";
+export declare const BRIDGE_VERSION = "0.28.0";

package/dist/ws-server.d.ts

@@ -36,6 +36,18 @@ export declare const INFLIGHT_STALE_AFTER_MS: number;
 export declare const HELLO_WAIT_MS = 2000;
 /** Spec §8.5: the hello-reply feature that tells the runtime it may offer memory_note on this socket. */
 export declare const MEMORY_NOTES_FEATURE = "memory_notes";
-export declare function attachAgentWebSocket(server: HttpServer, agent: BridgeAgent, opts: AgentWebSocketOptions): {
+/** Semantic memory 7b (spec §7.2 Q4): the hello feature a runtime declares to receive `memory.recall`; the bridge echoes it. */
+export declare const MEMORY_RECALL_FEATURE = "memory_recall";
+/**
+ * Every BridgeAgent member this module touches, directly or through the
+ * consumer helpers. The handlers take `WsAgent`, so tsc rejects a call to a
+ * member missing from this list. The ws-server test fakes are passed `as
+ * never` from files tsc does not check, so the fake-coverage tests assert each
+ * fake against this list at run time (7b gate fix: a member added here without
+ * a fake made three tests throw "is not a function").
+ */
+export declare const WS_AGENT_MEMBERS: readonly ["ackRuntimeMessages", "action", "admitRuntimeDelivery", "applyMemoryNote", "clearHarnessReport", "clearPerToolConsumer", "isRuntimeMessageRetired", "noteNotesConsumer", "notePerToolConsumer", "noteRecallConsumer", "noteSessionClose", "noteSessionEvicted", "noteSessionOpen", "notesAppliedGeneration", "notesForDelivery", "recallForDelivery", "recordHarnessReport", "recordRuntimeReply", "reportStatusGated", "requeueFailedRuntimeDeliveries", "requeueFront", "runtimeReplyReceipt", "send", "sendA2A", "subscribe", "takeDeliverable", "wakeListeners"];
+export type WsAgent = Pick<BridgeAgent, (typeof WS_AGENT_MEMBERS)[number]>;
+export declare function attachAgentWebSocket(server: HttpServer, agent: WsAgent, opts: AgentWebSocketOptions): {
     close(): void;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securecoms/agent-bridge",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "type": "module",
   "engines": {
     "node": ">=22.5.0"
@@ -58,6 +58,7 @@
     "@types/node": "^22.0.0",
     "@types/ws": "^8.18.1",
     "esbuild": "0.24.0",
+    "onnxruntime-web": "1.29.0",
     "typescript": "^5.4.0",
     "vitest": "^3.2.6"
   }