@securecoms/agent-bridge 0.29.0 → 0.30.1

package/dist/bridge-agent.d.ts

@@ -43,11 +43,16 @@ import { type ChatMessage } from "./voice/fast-prompt.js";
 import { VOICE_CALL_START_MARKER } from "./voice/prompt-compiler.js";
 import { type VaultListNode, type VaultReadExpectations } from "./vault.js";
 import type { AgentActionNodeType, AgentActionNodeStatus, AgentActionNodeDetail } from "@agentvault/connect-core";
+import { removeManagedLlmSource, writeManagedFiles, writeManifestPolicy } from "./service/runtime-config-dir.js";
+import { bindRuntimeConfig } from "./grants/binding.js";
 import type { RuntimeReplyReceipt } from "./reply-receipts.js";
 export type AgentAudience = "owner_dm" | "team_room" | "partner_room" | "other_human_dm" | "agent_to_agent" | "unknown";
-export type BridgeToolGrant = {
+export type BridgeToolGrant = 
+/** `source: "manifest"` (owner grants plan 4): issued from an owner-signed manifest; enforced only by a manifest_grants_v1 runtime. */
+{
     readonly tool: string;
     readonly mode: "read";
+    readonly source?: "manifest";
 } | {
     readonly tool: string;
     readonly mode: "side_effect";
@@ -99,6 +104,8 @@ export declare const ROOM_DEFAULT_READ_GRANTS: readonly BridgeToolGrant[];
  * construction (daemon startup). Unset or exactly `on` keeps the grants;
  * any other value (`off`, `0`, `false`, empty) sends `[]` on every turn.
  */
+/** Audit L-2: the owner replay prune runs at most once per this interval. */
+export declare const OWNER_REPLAY_PRUNE_INTERVAL_MS: number;
 export declare function ownerDmDefaultGrantsEnabled(env?: NodeJS.ProcessEnv): boolean;
 /**
  * Kill switch for ROOM_DEFAULT_READ_GRANTS (plan OQ-3, RULED), read once at
@@ -107,6 +114,13 @@ export declare function ownerDmDefaultGrantsEnabled(env?: NodeJS.ProcessEnv): bo
  * room turn. It never touches the owner DM.
  */
 export declare function roomDefaultGrantsEnabled(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Owner-signed tool grants kill switch, owner DM (spec §7.4). Read once at startup; unset or exactly
+ * "on" keeps. Off gives the fallback (constants ∩ signed, plus current_time), never more.
+ */
+export declare function ownerDmManifestGrantsEnabled(env?: NodeJS.ProcessEnv): boolean;
+/** Owner-signed tool grants kill switch, internal rooms (spec §7.4). Same rule as the owner-DM switch. */
+export declare function roomManifestGrantsEnabled(env?: NodeJS.ProcessEnv): boolean;
 export interface BridgeAuthorization {
     readonly version: 1;
     readonly audience: AgentAudience;
@@ -316,7 +330,16 @@ export declare const ROOM_VOICE_GUIDANCE_WITH_RESPONDER = "You are in a group vo
  * `voiceDefaultResponder` (never a body-supplied claim).
  */
 export declare function selectVoiceGuidance(isDm: boolean | undefined, voiceDefaultResponder: boolean | undefined): string;
+/** Owner grants plan 4 Task 11: TEST SEAM for the refetch's writers and binder (call order, throws). Production omits it. */
+export interface GrantWriters {
+    writeManifestPolicy?: typeof writeManifestPolicy;
+    writeManagedFiles?: typeof writeManagedFiles;
+    bindRuntimeConfig?: typeof bindRuntimeConfig;
+    removeManagedLlmSource?: typeof removeManagedLlmSource;
+}
 export interface BridgeAgentDeps {
+    /** Owner grants plan 4 Task 11: TEST SEAM only (see GrantWriters). */
+    grantWriters?: GrantWriters;
     /**
      * Unified memory part 1 (plan Task 8): TEST SEAM ONLY. Production (bin.ts) never passes it, so the compiled
      * UNIFIED_MEMORY_PART1 decides (switch.arch.test.ts pins both).
@@ -330,6 +353,9 @@ export interface BridgeAgentDeps {
     transport?: any;
     backend?: any;
     fetchImpl?: typeof fetch;
+    /** TEST SEAM: WebSocket constructor for the real RestTransport's delivery-ping
+     *  socket. Production leaves it undefined (globalThis.WebSocket). */
+    wsImpl?: typeof WebSocket;
     /**
      * Round 5 (runtime config delivery): the home directory under which the
      * managed runtime-config directory lives. Injected only by tests, so they can
@@ -506,6 +532,7 @@ export declare function redeliveryDelayMs(attempts: number): number;
  * messages is dead-lettered. Fixed text — it never echoes the message.
  */
 export declare const DEAD_LETTER_NOTICE = "I couldn't process a message. Please resend it.";
+export declare const ROOM_SEARCH_CAP_NOTICE = "I've used today's web searches for this room. I can still help without searching. Searches are available again tomorrow (UTC).";
 /** At most one {@link DEAD_LETTER_NOTICE} per channel per this window. */
 export declare const DEAD_LETTER_NOTICE_INTERVAL_MS: number;
 /**
@@ -690,6 +717,15 @@ export declare class RoomClassChangedSendError extends SendForbiddenError {
  * `activeGroupId` is the group the backend named, or null when the channel has
  * no active group (fail closed: nothing to converge to).
  */
+/**
+ * C10 (spec P-15, §4.1.6): start() was superseded (4409) before it finished.
+ * start() has already run the memoized close() quiesce when this is thrown, and
+ * armed none of its timers or the receive pump. runMode catches it: the process
+ * stays alive holding the lock and the port, and serves no route.
+ */
+export declare class SessionSupersededError extends Error {
+    constructor();
+}
 export declare class GroupSupersededSendError extends Error {
     readonly channelId: string;
     readonly activeGroupId: string | null;
@@ -756,8 +792,39 @@ export declare class BridgeAgent {
     private readonly backend;
     private readonly custody;
     private readonly fetchImpl;
+    /** P-1: set once a 4409 close says another copy took this agent's session.
+     *  The gated fetch built in the constructor refuses every request after it. */
+    private sessionSuperseded;
+    /** C9: who hears `session_superseded` (runMode's quiesce). */
+    private readonly sessionSupersededListeners;
+    /** C9 (spec §4.1.6, low 3): the one close() run every caller shares. */
+    private closing;
     /** Round 5: home for the managed runtime-config directory (test seam). */
     private readonly home;
+    private readonly grantWriters;
+    /** Owner grants (spec §7.5, OQ-2): the operator cap, read once; the same variable the runtime reads. 0 = no room search. */
+    private readonly roomSearchDailyCap;
+    /** Review M-3 (ERIC APPROVALS 3): the per-agent total across rooms, read once; the same variable the runtime reads. */
+    private readonly agentRoomSearchDailyCap;
+    /** `${day}\n${channel}` keys already logged reached today (in memory; the store holds the durable flag). */
+    private readonly roomCapLogged;
+    /** Rooms whose K-14 send is in flight: a second frame posts nothing more. */
+    private readonly roomCapNoticePending;
+    /** Held entries whose staged copy lost web_search to the backstop; applied again at release. */
+    private readonly backstopStripped;
+    /**
+     * Owner grants plan 4 Task 11 (P-4, P-6): what the managed directory holds under the current manifest.
+     * Manifest grants require state "bound" at the applied counter (Task 13). null at startup, while a
+     * refetch narrows it, and after any throw (the fallback).
+     */
+    private manifestBinding;
+    /** skills.json tools.deny from the latest fetch, manifest or not (spec §5.2 `disabled`). */
+    private payloadToolDeny;
+    /** Spec §7.7 (OQ-5): the latest fetch's binding outcome, reported in tool_grant_status (Task 15). */
+    private configBindingMismatches;
+    private targetMismatches;
+    /** P-5 (Task 14): the legacy fact decisions the latest bound fetch may apply (assigns verified against the signed set). */
+    private boundLegacyDecisions;
     private readonly joinState;
     /**
      * Phase 2: lazy channel-metadata cache (channel_id → { is_dm, name, at }) used
@@ -1057,11 +1124,27 @@ export declare class BridgeAgent {
     private readonly ownerDmDefaultGrants;
     /** Read once at startup; see roomDefaultGrantsEnabled. */
     private readonly roomDefaultGrants;
+    /** Owner grants (spec §7.4): the two manifest switches, read once at construction. */
+    private readonly ownerDmManifestGrants;
+    private readonly roomManifestGrants;
     /**
      * Audit M-B4: DM channels whose roster was epoch-fresh at THIS ingest
      * cycle's refresh (refreshRostersForCycle). Cleared at each cycle's start.
      */
     private readonly ownerDmCycleFresh;
+    private toolGrantManifest;
+    private toolGrantCounter;
+    private manifestState;
+    /** Failed owner-turn checks since the last successful runtime-config report (§7.7). */
+    private ownerVerifyFailures;
+    /** Verified owner turns of this ingest cycle, recorded in owner_replay when staged (P-3). */
+    private readonly ownerReplayPending;
+    /** D-9: ids of owner turns that failed verification (never `replay`, audit E-3), id -> channel. Persisted too. */
+    private readonly ownerVerifyFailedIds;
+    private serverOwnerMismatchLogged;
+    /** Audit L-2: the replay prune runs at most once per interval, on a monotonic clock. */
+    private monoNow;
+    private lastOwnerReplayPruneAt;
     /**
      * Audit M-B1: room-granted turns, keyed by the inbound message id, with the
      * channel, MLS group and epoch the room was classified at (review I-1: an
@@ -1179,6 +1262,12 @@ export declare class BridgeAgent {
     readonly action: AgentActionAPI;
     private readonly waiters;
     private pingHandle?;
+    /** C10 (P-15): the delivery-ping subscription start() opens at its top,
+     *  held unconsumed until startReceivePump() takes it. */
+    private earlyPings;
+    /** C10 fix round 1: settles (never rejects) when start()'s body does; close()
+     *  awaits it, bounded, so the store never closes under a start() step. */
+    private startInFlight;
     private safetyTimer?;
     /** The ingest cycle now running, if any (see ingestOnce: single-flight). */
     private ingestInFlight;
@@ -1400,6 +1489,20 @@ export declare class BridgeAgent {
      */
     refetchRuntimeConfig(): Promise<void>;
     private refetchRuntimeConfigOnce;
+    /**
+     * Plan 4 Task 11: the refetch under a manifest in force. Returns false when the binding failed (H-4),
+     * after the memory was applied; the caller then writes nothing else. Throws only from a file write, with
+     * the binding left null.
+     */
+    private applyUnderManifest;
+    /** Spec §7.6 (plan 4 Task 15): content-free. One line per mismatched field, one per dropped target. */
+    private logConfigBinding;
+    /** H-4: the binding could not be computed. The memory still applies, with the signed mode; nothing else is written. */
+    private bindFailed;
+    /** No manifest in force: a manifest-policy.json left by an earlier one is replaced by an empty tool list. */
+    private overwriteStalePolicy;
+    /** The report half of refetchRuntimeConfigOnce (split out for the plan 4 Task 11 bind_failed path). */
+    private postRuntimeConfigReport;
     /**
      * Enforce the inbound-buffer cap with a DROP-OLDEST policy.
      *
@@ -1412,7 +1515,24 @@ export declare class BridgeAgent {
      * shed so a silently-dropping daemon stays observable (item 3 / ADR-0002).
      */
     private capBuffer;
+    /**
+     * C10 (spec P-15, OQ-8 (b)): subscribe early, consume late. The
+     * delivery-ping socket opens here, before anything else, so this copy claims
+     * the device's session (and another copy gets its 4409) BEFORE this copy's
+     * boot drain runs. The pings it carries are NOT consumed until
+     * startReceivePump(), the same place as before: starting the pump first is
+     * still forbidden (DRAIN BEFORE ROTATE, startBody).
+     *
+     * A 4409 during start() (audit H-3): the gated fetch is already set (C9 step
+     * 0). start() then arms nothing more (supersededDuringStart before each
+     * timer and before the pump), runs the memoized close() quiesce, and rejects
+     * with SessionSupersededError. A step that FAILED because of the supersede
+     * (a refused fetch, a store the quiesce closed) is the same outcome.
+     */
     start(): Promise<void>;
+    /** C10: true once a 4409 landed; checked before each arming step of start(). */
+    private supersededDuringStart;
+    private startBody;
     /**
      * #811 L-1: send the re-Welcome signal ONCE for each channel whose onWedged
      * heal the boot drain refused. Runs after the drain settled and after the
@@ -2079,6 +2199,11 @@ export declare class BridgeAgent {
      * stale cache is refreshed once; any failure remains a fail-closed denial.
      */
     private mayReadOpenClawMemory;
+    /**
+     * Decision D-9 (audit H-3): a turn that failed owner verification gets only
+     * its own text, never the prior-turn history snapshot, for every provider.
+     */
+    private mayReadHistoryForTurn;
     /** An inbound turn may receive OpenClaw memory only from an active owner DM. */
     private mayReadOpenClawMemoryForTurn;
     /**
@@ -2087,6 +2212,49 @@ export declare class BridgeAgent {
      * never falls back to the runtime's retired plaintext JSON files.
      */
     private memoryForTurn;
+    /**
+     * Owner grants plan 4 Task 16 (T-30, audit r2 H-1): the voice fence is on whenever a pin is loaded, on EVERY runtime
+     * turn (manifest, fallback, greeting, relayed, constants-only alike). It never depends on a turn's grants.
+     */
+    private voiceFenceOn;
+    /** The keyed and legacy fast-reply ids of every peer row of the conversation (audit r2 M-1; never the 50-row window). */
+    private fenceContext;
+    /**
+     * Drop agent lines classified fast_path, untrusted or unknown from a turn's memory (every turn of a pinned agent).
+     * `strict` (review H-3, a turn that holds a manifest grant): relay-class peer lines go too (sender not the pinned
+     * owner, or voice modality). Otherwise peer lines are never dropped.
+     */
+    private fenceMemory;
+    /**
+     * Review H-3: true when a delivered frame holds a line a manifest turn would exclude (a relay-class peer line; agent
+     * lines in a frame are already fenced). Such a turn's reply is recorded "untrusted".
+     */
+    private frameHoldsRelayClass;
+    /**
+     * Review H-3 attribution: message ids of turns delivered on a pinned agent whose frame held no relay-class line.
+     * A reply is recorded "reply" only when its in-reply-to is here; anything else (tainted, unknown after a restart,
+     * no in-reply-to) is "untrusted". Bounded; the oldest are forgotten first (forgetting only makes a reply untrusted).
+     */
+    private readonly cleanTurns;
+    private noteDeliveredFrame;
+    private readonly taintedTurns;
+    /**
+     * Review R2-H2: on a pinned agent a 7a note or a unified memory_note is written only from a turn delivered with a clean
+     * frame in the owner DM (cleanTurns, not taintedTurns), so a tainted fallback turn cannot plant a note that a later
+     * manifest turn reads. Taint is noted at delivery, before any note frame for the turn can arrive.
+     */
+    private noteTurnClean;
+    /**
+     * Review R2-H1: the turn itself is relay-class (its frame memory is prior-turn only, so its own sender is never in it):
+     * a sender that is not the pinned owner, a relay speaker claim, or a voice turn.
+     */
+    private turnIsRelayClass;
+    /**
+     * R2-M1 ruling: the channel where the H-3 taint and the `untrusted` exclusion apply, on a pinned agent: the signed
+     * owner_dm_channel_id of the manifest in force. Before any manifest is held there is no signed DM, so every channel
+     * not known to be a room counts (fail closed: a reply recorded there before the first manifest must not reach it).
+     */
+    private taintScope;
     /**
      * Spec §11.2 (OQ-L), §6.5: apply one parsed `payload.memory`. An unreadable
      * value turns notes off and deletes nothing. A readable one goes through
@@ -2630,6 +2798,41 @@ export declare class BridgeAgent {
      * cycle. Fail-soft inside refreshChannelRoster (never blocks ingest).
      */
     private refreshRostersForCycle;
+    /**
+     * Owner-signed tool grants, step 1 (spec §7.2; decisions D-1, D-2, D-4, D-8,
+     * D-9; audits H-1, M-2, M-4, E-1..E-3). The verdict for one delivered turn.
+     *
+     * `unchecked` when no pin is loaded or the sender is not the pinned owner.
+     * Otherwise, in order, the first failure wins: the identity signature over the
+     * raw payload bytes with the pinned key; the verified bytes must be the
+     * decrypted envelope; in a DM only (D-1), the signed DM channel and the MLS
+     * leaf set; then the replay set and closed epochs, keyed by the agent's OWN
+     * held group (never the backend's row label, M-2). NEVER throws (M-4): any
+     * exception is `failed verify_error`, and the row is acked like any other turn.
+     */
+    private verifyOwnerTurn;
+    /** Log, count and (except a replay, audit E-3) record one failed owner-turn check. Never throws (audit E-2). */
+    private ownerTurnFailed;
+    /** Review M-A: a verified original of this id was staged and is still pending, or was recorded in the replay set. */
+    private isVerifiedOwnerOriginal;
+    /** Review M-A: a verified original of this id was staged and acked (it is in the replay set, no longer pending). */
+    private isAckedOwnerOriginal;
+    /** D-9: memory first, then the store (a restart before the reply). Unpinned: never. A store read that throws withholds (fail closed). */
+    private isOwnerVerifyFailed;
+    /**
+     * Decision D-2, audit L-2: prune the owner replay set at most once per
+     * OWNER_REPLAY_PRUNE_INTERVAL_MS, keeping each channel's current (group,
+     * epoch). A channel whose held position is unknown is left out (not pruned).
+     */
+    private maybePruneOwnerReplay;
+    /** start(): drop other keys' manifest state, re-verify the stored one for the pinned key, and prune. */
+    private loadToolGrantState;
+    /**
+     * Spec §7.1: verify and record a served manifest. Never writes a file and
+     * never changes a grant in step 1. A save that throws keeps the old state.
+     */
+    private applyToolGrantManifest;
+    private logManifest;
     /** Classify one inbound turn at the agent's CURRENT epoch for its channel. */
     private authorizeTurn;
     /**
@@ -2693,6 +2896,8 @@ export declare class BridgeAgent {
      *                            enforcement is attached
      *   memory_write             the turn carries memory_write (Markdown memory
      *                            7a, spec §8.3): a boolean, never content
+     *   grant_source             where the grants came from: constant | none in
+     *                            step 1 (owner-signed tool grants §7.6)
      */
     private logAuthzDecision;
     /**
@@ -2860,7 +3065,19 @@ export declare class BridgeAgent {
     /** Notify-only SSE signal: fired after a buffer push. Listener pulls via takeBuffered. */
     subscribe(listener: () => void): () => void;
     /** Synchronous splice of buffered messages (all, or one channel). Shared by drain + SSE. */
+    /** Review H-1: every buffer exit narrows manifest grants again to the state at delivery. */
     takeBuffered(channelId?: string): BridgeMessage[];
+    takeDeliverable(busyChannels: ReadonlySet<string>): BridgeMessage[];
+    /** Every buffer exit: re-narrow manifest grants (review H-1), then note the frame's attribution class (review H-3). */
+    private delivering;
+    /**
+     * Review H-1 (kill switches reach staged and restored turns): a grant marked source "manifest" survives delivery
+     * only while its audience's manifest switch is on, the binding is bound at the applied counter, and the current
+     * manifest still signs the tool. Otherwise it becomes the fallback: kept unmarked if it is a constant of the
+     * audience that is still signed, else dropped. Only narrows; an unchanged message is returned by reference.
+     */
+    private renarrowManifestGrants;
+    private takeBufferedRaw;
     /**
      * Phase 3 F2: per-channel ordered delivery for the /v1/ws runtime consumer.
      * Splices out, oldest first, at most ONE buffered message per channel that
@@ -2870,7 +3087,7 @@ export declare class BridgeAgent {
      * working on — which it used to refuse with a "busy" reply and ack — and a
      * backlog replays one message per channel at a time after a restart.
      */
-    takeDeliverable(busyChannels: ReadonlySet<string>): BridgeMessage[];
+    private takeDeliverableRaw;
     private hasReplyIntent;
     /**
      * SEC-06 #18: answer a redelivered message from its reply intent. Counts as
@@ -2911,6 +3128,20 @@ export declare class BridgeAgent {
      * at most once per channel per hour. Logs carry counts only.
      */
     private deadLetter;
+    /** Spec §7.5: the room is capped today: cap 0, reached (by the runtime or the backstop), or at the cap. Fails closed. */
+    private roomSearchCapped;
+    /** Spec §7.5 (T-14c, M-4): the runtime reports an executed-call cap for a room. Never throws. */
+    noteRoomCapReached(channelId: string): void;
+    /** K-14, once per room per UTC day; the flag is persisted only after the send resolves. Called only from noteRoomCapReached. */
+    private noticeRoomSearchCap;
+    private logRoomCap;
+    /**
+     * Spec §7.5 (T-14b, audit r1 H-3): the silent bridge backstop. Counts a team_room turn that actually goes out
+     * to the runtime with web_search, once per message id (callers run it after their runtimePendingIds early
+     * return). Past the cap, and on a store failure (fail closed), the entry loses web_search. Never posts K-14.
+     */
+    private applyRoomSearchBackstop;
+    private withoutWebSearch;
     private noticeDeadLetter;
     /** Poke consumers once the earliest redelivery backoff ends. */
     private armRedeliveryWake;
@@ -3056,6 +3287,24 @@ export declare class BridgeAgent {
     /** Forget `token` when its socket closes; a newer consumer's token is kept. */
     clearPerToolConsumer(token: object): void;
     perToolConsumerAttached(): boolean;
+    /**
+     * Owner grants (spec §7.9, plan 4 Task 5): the attached per-tool runtime socket whose hello
+     * declared manifest_grants_v1, or null. A manifest grant is issued only while one is attached
+     * (Task 13); every other socket receives manifest grants narrowed to the constants.
+     * Newest wins, like perToolConsumer.
+     */
+    private manifestConsumer;
+    /** OQ-5: the latest hello's class; "missing" until any hello. Reported in tool_grant_status (Task 15). */
+    private lastConsumerCapability;
+    noteManifestConsumer(token: object): void;
+    clearManifestConsumer(token: object): void;
+    manifestConsumerAttached(): boolean;
+    noteConsumerCapability(state: "ok" | "missing" | "harness_consumer"): void;
+    /**
+     * Harness re-rule (2026-10-12, audit r2 H-3): true exactly when this agent has a pin loaded and a good
+     * manifest. A harness consumer then receives [] in every audience (consumer-grants.ts withHarnessGrants).
+     */
+    harnessGrantsWithheld(): boolean;
     health(): {
         status: "ok";
         identity_id: string;
@@ -3278,5 +3527,23 @@ export declare class BridgeAgent {
          * and zero on restart (spec §5.5). */
         build: string;
     };
+    /** C9: `session_superseded` once a 4409 said another copy took this
+     *  agent's session (the gated fetch already refuses every request). The
+     *  local HTTP routes read it: every route but `/healthz` answers 503. */
+    get sessionState(): "live" | "session_superseded";
+    /** C9: subscribe to `session_superseded`. runMode subscribes right after
+     *  construction, before start(), so a 4409 during start() is heard too. */
+    on(event: "session_superseded", listener: () => void): () => void;
+    /** P-1 step 0, then the event (spec §4.1.6): another copy of this agent took
+     *  the session (4409). The gated-fetch switch is set FIRST, so no HTTP
+     *  request leaves the process after this, whatever a listener does. */
+    private onSessionSuperseded;
+    /**
+     * Idempotent (C9, spec §4.1.6 low 3): every call returns the FIRST call's
+     * promise, so a SIGTERM during or after the supersede quiesce never runs
+     * store.close() twice. A rejected close stays rejected: a retry would close
+     * the store a second time.
+     */
     close(): Promise<void>;
+    private closeOnce;
 }

package/dist/config.d.ts

@@ -1,4 +1,5 @@
 import { type VoiceConfig } from "./voice/persona.js";
+import { type OwnerGrantPinResult } from "./grants/pin.js";
 import { type FastPathMode } from "./voice/defer-intent.js";
 export interface BridgeConfig {
     apiKey: string;
@@ -47,6 +48,12 @@ export interface BridgeConfig {
     modelSource: "download" | "import_only";
     /** Spec section 13 (R-U20): credential `memory.enabled`. Absent or true is on; any other value is off (plan I-9). Local only: the backend cannot set it. */
     memoryEnabled?: boolean;
+    /**
+     * Owner-signed tool grants (spec §6.1, §6.5): the grant pin, loaded once here
+     * from the credential's `owner_signing_key` and `owner-signing-key.json` beside
+     * the credential, never from the backend. Absent means `no_pin`.
+     */
+    ownerGrantPin?: OwnerGrantPinResult;
 }
 export declare const REQUIRED: readonly ["api_key", "identity_id", "device_id", "signing_private_key", "enclave_id", "api_base"];
 export declare function loadConfig(opts: {

package/dist/consumer-grants.d.ts

@@ -21,3 +21,22 @@ export declare const PER_TOOL_GRANTS_FEATURE = "per_tool_grants";
  * no non-per-tool consumer ever receives (Markdown memory 7a, review m-3).
  */
 export declare function withConsumerGrants(m: BridgeMessage, perToolConsumer: boolean): BridgeMessage;
+/** The /v1/ws hello feature of a runtime that enforces manifest grants (runtime 0.13.0+). Pinned to the runtime's by capability-parity.test.ts. */
+export declare const MANIFEST_GRANTS_FEATURE = "manifest_grants_v1";
+export declare const CONSTANT_TOOL_NAMES: Readonly<Record<"owner_dm" | "team_room", readonly string[]>>;
+/**
+ * Spec §7.9: a consumer that did not declare manifest_grants_v1 (runtime 0.12.2, a harness,
+ * every HTTP path) never receives a manifest grant. Its grants are narrowed to constants(a):
+ * a manifest-marked tool that is also a constant is kept unmarked; any other is dropped.
+ * Never mutates `m`.
+ */
+export declare function withManifestCapability(m: BridgeMessage, manifestConsumer: boolean): BridgeMessage;
+/**
+ * Harness re-rule (2026-10-12, supersedes P4 OQ-8's "constants ∩ signed"), audit r2 H-3. A harness turns
+ * ANY non-empty tool_grants into the owner's whole configured toolset (header of this file), so no
+ * non-empty list can stay within what the owner signed. On a pinned agent with a good manifest
+ * (`withheld === true`) a harness receives [] in EVERY audience. `withheld === false` (no pin, or no good
+ * manifest): `m` unchanged, by reference (today's behaviour). An issued [] is returned by reference.
+ * Never mutates `m`. Callers: the three harness delivery paths, after withConsumerGrants.
+ */
+export declare function withHarnessGrants(m: BridgeMessage, withheld: boolean): BridgeMessage;

package/dist/errors.d.ts

@@ -6,7 +6,7 @@
  * WebSocket returns `{type:"error", error, message, detail?}`. A client gets the
  * same `error` code regardless of which transport it used. (A2A §9.5/§10.6 pattern.)
  */
-export type BridgeErrorCode = "unauthorized" | "forbidden_origin" | "not_found" | "invalid_request" | "invalid_json" | "body_too_large" | "channel_pending" | "rate_limited" | "agent_paused" | "send_forbidden" | "group_superseded" | "unknown_action_run" | "vault_integrity_failed" | "vault_ref_changed" | "internal";
+export type BridgeErrorCode = "unauthorized" | "forbidden_origin" | "not_found" | "invalid_request" | "invalid_json" | "body_too_large" | "channel_pending" | "rate_limited" | "agent_paused" | "send_forbidden" | "group_superseded" | "unknown_action_run" | "vault_integrity_failed" | "vault_ref_changed" | "session_superseded" | "internal";
 export interface BridgeErrorSpec {
     /** HTTP status this code maps to (the WS binding ignores it). */
     http: number;

package/dist/grants/binding.d.ts

@@ -0,0 +1,58 @@
+import { type ToolGrantManifest } from "./manifest.js";
+import type { ManifestPolicyDoc } from "../service/runtime-config-dir.js";
+export declare const CONFIG_BINDING_FIELDS: readonly ["persona", "memory", "search", "tools_allow", "flags", "llm", "files", "legacy_assign"];
+export type ConfigBindingField = (typeof CONFIG_BINDING_FIELDS)[number];
+export interface BindPayload {
+    readonly version?: number;
+    readonly files?: Record<string, string>;
+    readonly skills_json?: Record<string, unknown>;
+    readonly memory?: unknown;
+    readonly persona?: unknown;
+    /** Raw, unfiltered saved tokens (runtime_config_service.py memory_prunes). Untrusted. */
+    readonly memory_prunes?: unknown;
+    readonly legacy_memory_fact_decisions?: unknown;
+}
+/** The search block last written under a good search match for this pinned key (Task 11's sealed record); undefined = never. */
+export type AppliedSearch = {
+    readonly provider: "brave" | "tavily";
+    readonly keyFile?: string;
+} | null;
+export interface BindPrior {
+    readonly search: AppliedSearch | undefined;
+}
+export interface BindResult {
+    readonly mismatches: readonly ConfigBindingField[];
+    readonly targetMismatches: {
+        readonly endpoint: number;
+        readonly database: number;
+    };
+    readonly files: Record<string, string>;
+    readonly memory: unknown;
+    readonly signedTargets: {
+        readonly endpoints: number;
+        readonly databases: number;
+    };
+    readonly policy: ManifestPolicyDoc;
+    /** Set only when `search` matched: the block written, to be saved as the new last good one after the write succeeds. */
+    readonly appliedSearch: AppliedSearch | undefined;
+    /**
+     * P-5 (Task 14): the decisions to hand applyLegacyMemoryFactDecisions. On a legacy_assign match: the
+     * deletes plus each assign whose token, rebuilt from its own fields, is in the verified saved set. On a
+     * mismatch: the deletes only.
+     */
+    readonly legacyDecisions: unknown[];
+}
+/** P4 OQ-7: hex SHA-256 of JCS(sorted, deduplicated memory_prunes entries that begin "legacy-fact-assign:"). Non-strings are ignored. */
+export declare function legacyAssignSha256(prunes: readonly unknown[]): string;
+/** The backend's assign token (runtime_config_service.py _legacy_memory_fact_decision_token), rebuilt from the fields. */
+export declare function legacyAssignToken(d: {
+    source_id: string;
+    fact_hash: string;
+    channel_id: string;
+}): string;
+export declare function bindRuntimeConfig(manifest: ToolGrantManifest, payload: BindPayload, prior: BindPrior, 
+/** Review H-1: the two manifest kill switches; an audience switched off contributes no tool to the policy file. */
+switches?: {
+    readonly ownerDm: boolean;
+    readonly room: boolean;
+}): BindResult;

package/dist/grants/effective.d.ts

@@ -0,0 +1,47 @@
+/**
+ * The effective grant (owner-signed tool grants, spec §5.2, §5.4, §7.4; plan 4 Task 6).
+ * The one formula, pure, so every rule has its own test and the issuing code decides nothing.
+ *
+ *   signed(a)    = manifest.grants[a] ∩ TOOL_GRANT_CODE_CEILING[a]
+ *   effective(a) = signed(a) ∖ disabled, minus http_request with no signed endpoint, minus sql_query
+ *                  with no signed database, minus team_room web_search when capped, ∪ {current_time}
+ *                  (only when every precondition holds: `eligible` and the manifest switch on)
+ *   fallback(a)  = (constants(a) ∩ signed(a)) ∪ {current_time}   when a precondition fails
+ *                = constants(a) by reference                      with no good manifest
+ *   []                                                            when today's predicate gives []
+ */
+import { type ToolGrantManifest } from "./manifest.js";
+/** Spec §5.4 code ceiling. The same frozen lists Plan 1 uses to drop unknown entries. */
+export declare const TOOL_GRANT_CODE_CEILING: {
+    readonly owner_dm: readonly string[];
+    readonly team_room: readonly string[];
+};
+export type GrantAudience = "owner_dm" | "team_room";
+export type GrantSource = "constant" | "manifest" | "fallback" | "none";
+export interface ReadGrant {
+    readonly tool: string;
+    readonly mode: "read";
+    readonly source?: "manifest";
+}
+export interface EffectiveInput {
+    readonly audience: GrantAudience;
+    /** Today's list from the existing predicate: OWNER_DM_DEFAULT_READ_GRANTS, ROOM_DEFAULT_READ_GRANTS, or a frozen []. */
+    readonly base: readonly ReadGrant[];
+    /** The last good manifest, or null (no pin, or none verified). */
+    readonly manifest: ToolGrantManifest | null;
+    /** Every manifest-only precondition held (Task 13 computes it). */
+    readonly eligible: boolean;
+    readonly manifestSwitchOn: boolean;
+    readonly disabled: ReadonlySet<string>;
+    readonly signedTargets: {
+        readonly endpoints: number;
+        readonly databases: number;
+    };
+    readonly roomSearchCapped: boolean;
+}
+export interface EffectiveGrant {
+    readonly grants: readonly ReadGrant[];
+    readonly source: GrantSource;
+    readonly withheldBySearchCap: boolean;
+}
+export declare function effectiveToolGrants(i: EffectiveInput): EffectiveGrant;

package/dist/grants/manifest.d.ts

@@ -0,0 +1,68 @@
+import { type OwnerGrantPin } from "./pin.js";
+export declare const TOOL_GRANTS_DOMAIN = "SECURECOMS-TOOL-GRANTS-V1:";
+export declare const MANIFEST_STATES: readonly ["ok", "unchanged", "no_pin", "no_manifest", "malformed", "unsupported_algo", "bad_signature", "wrong_agent", "wrong_owner", "rollback", "unknown_entry", "kept_last_good"];
+export type ManifestState = (typeof MANIFEST_STATES)[number];
+/** Known names only for dropping unknown entries (§7.1 step 6). These are the §5.4 code-ceiling names; step 4 uses them as the ceiling. */
+export declare const MANIFEST_KNOWN_TOOLS: {
+    readonly owner_dm: readonly string[];
+    readonly team_room: readonly string[];
+};
+export interface ToolGrantManifest {
+    readonly type: "securecoms.tool-grants";
+    readonly v: 1;
+    readonly agent_identity_id: string;
+    readonly owner_identity_id: string;
+    readonly owner_dm_channel_id?: string;
+    readonly owner_dm_relay_identity_id?: string;
+    readonly counter: number;
+    readonly grants: {
+        readonly owner_dm?: readonly string[];
+        readonly team_room?: readonly string[];
+    };
+    /** Plan 4 Task 7 (spec §8.1): signed targets. Absent in the wrapper = {}. A `headersFile: ""` is dropped (L-4). */
+    readonly endpoints: Readonly<Record<string, SignedEndpoint>>;
+    readonly databases: Readonly<Record<string, SignedDatabase>>;
+    /** Plan 4 Task 7 (spec §8.1, §7.10): the signed values the config binding compares. Required. */
+    readonly config: SignedConfig;
+}
+export interface SignedEndpoint {
+    readonly baseUrl: string;
+    readonly headersFile?: string;
+}
+export type SignedDatabase = {
+    readonly sqlite: string;
+} | {
+    readonly postgresUrlFile: string;
+};
+export interface SignedConfig {
+    readonly persona_sha256: string;
+    readonly llm?: {
+        readonly provider: string;
+        readonly model: string;
+    };
+    readonly search?: {
+        readonly provider: "brave" | "tavily";
+    };
+    readonly tools_allow?: readonly string[];
+    readonly flags: readonly string[];
+    readonly memory: {
+        readonly mode: "markdown" | "semantic" | "off";
+        readonly recall_days?: 30 | 90 | 365;
+    };
+    readonly legacy_assign_sha256: string;
+}
+export type ManifestVerdict = {
+    state: "ok";
+    manifest: ToolGrantManifest;
+    droppedUnknown: boolean;
+    wrapper: unknown;
+} | {
+    state: "unchanged" | "malformed" | "unsupported_algo" | "bad_signature" | "wrong_agent" | "wrong_owner" | "rollback";
+};
+/** utf8(TOOL_GRANTS_DOMAIN) || canonicalize(manifest). The domain keeps an envelope signature from ever verifying as a manifest. */
+export declare function manifestSignedBytes(manifest: unknown): Uint8Array;
+export declare function verifyToolGrantManifest(raw: unknown, ctx: {
+    pin: OwnerGrantPin;
+    agentIdentityId: string;
+    storedCounter: number | null;
+}): ManifestVerdict;