@securecoms/agent-bridge 0.30.2 → 0.31.0

package/dist/bridge-agent.d.ts

@@ -41,11 +41,13 @@ import { type UnifiedFrameItem } from "./memory/unified/read-book.js";
 import { type MemoryNoteResultFrame } from "./memory/note-frames.js";
 import { type ChatMessage } from "./voice/fast-prompt.js";
 import { VOICE_CALL_START_MARKER } from "./voice/prompt-compiler.js";
+import { type CallBufferTurn } from "./voice/call-buffer.js";
 import { type VaultListNode, type VaultReadExpectations } from "./vault.js";
 import type { AgentActionNodeType, AgentActionNodeStatus, AgentActionNodeDetail } from "@agentvault/connect-core";
 import { removeManagedLlmSource, writeManagedFiles, writeManifestPolicy } from "./service/runtime-config-dir.js";
 import { bindRuntimeConfig } from "./grants/binding.js";
 import type { RuntimeReplyReceipt } from "./reply-receipts.js";
+import type { SearchProvider } from "./grants/search-providers.js";
 export type AgentAudience = "owner_dm" | "team_room" | "partner_room" | "other_human_dm" | "agent_to_agent" | "unknown";
 export type BridgeToolGrant = 
 /** `source: "manifest"` (owner grants plan 4): issued from an owner-signed manifest; enforced only by a manifest_grants_v1 runtime. */
@@ -68,10 +70,12 @@ export type BridgeToolGrant =
  * the envelope's authenticated sender is the channel's server-marked relay.
  *
  * Tool grants (architect ruling, 2026-10-02): until channel-grant persistence
- * lands, the ONLY non-empty grant list is OWNER_DM_DEFAULT_READ_GRANTS
- * (`current_time` + `web_search`, read mode), and only on a DM whose sender is
- * that DM's pinned human counterpart AND server-marked `is_agent_owner` (or a
- * relayed voice turn whose speaker is). The pin is per channel, so the
+ * lands, the owner DM's constant grant lists are OWNER_DM_DEFAULT_READ_GRANTS
+ * (`current_time` + `web_search`, read mode) on a typed turn whose sender is
+ * that DM's pinned human counterpart AND server-marked `is_agent_owner`, and
+ * RELAYED_VOICE_GRANTS (equal today, never manifest-eligible) on a relayed
+ * voice turn whose speaker is, or on any voice-scoped owner turn (P-5, G-1).
+ * The pin is per channel, so the
  * owner distinction rests on the server's flag: see authorizationFor's LIMIT
  * note. Every
  * other audience, an unpinned or anomalous owner, and the kill switch
@@ -100,9 +104,17 @@ export declare const OWNER_DM_DEFAULT_READ_GRANTS: readonly BridgeToolGrant[];
  */
 export declare const ROOM_DEFAULT_READ_GRANTS: readonly BridgeToolGrant[];
 /**
- * Kill switch for OWNER_DM_DEFAULT_READ_GRANTS, read once at BridgeAgent
- * construction (daemon startup). Unset or exactly `on` keeps the grants;
- * any other value (`off`, `0`, `false`, empty) sends `[]` on every turn.
+ * Voice fast-path privacy, P-5 (spec §9). The grants of a relayed owner voice turn (and, from Task 4, of every
+ * voice-scoped owner turn). A constant of its own, frozen and written out, so a later change to
+ * OWNER_DM_DEFAULT_READ_GRANTS cannot widen a spoken turn. It still passes through effectiveToolGrants in
+ * authorizationFor, so the owner's signed web_search off-switch holds. Equal to the owner-DM default today.
+ */
+export declare const RELAYED_VOICE_GRANTS: readonly BridgeToolGrant[];
+/**
+ * Kill switch for OWNER_DM_DEFAULT_READ_GRANTS and RELAYED_VOICE_GRANTS (the
+ * relayed owner voice turn and every voice-scoped owner turn), read once at
+ * BridgeAgent construction (daemon startup). Unset or exactly `on` keeps the
+ * grants; any other value (`off`, `0`, `false`, empty) sends `[]` on every turn.
  */
 /** Audit L-2: the owner replay prune runs at most once per this interval. */
 export declare const OWNER_REPLAY_PRUNE_INTERVAL_MS: number;
@@ -142,7 +154,8 @@ export interface BridgeAuthorization {
      * owner-DM kill switch is on. Present only when true. An OFFER HINT: the
      * bridge's W1 to W8 are the gate. Never set on the ownerRelayed branch
      * (OQ-C, Eric approved 2026-10-06): voice turns read notes, never write,
-     * and never on any turn with a relay speaker claim (review I-1).
+     * and never on any turn with a relay speaker claim (review I-1), nor on a
+     * voice-scoped owner-direct turn (G-1, voice fast-path privacy spec §1).
      * NOT a tool grant: it is not, and must never be, in `tool_grants`.
      * Reaches only the per-tool runtime consumer: withConsumerGrants strips it
      * for a harness socket and the HTTP/SSE paths (review m-3).
@@ -277,6 +290,12 @@ export interface BridgeMessage {
         identityId: string;
         displayName: string;
     };
+    /**
+     * Voice fast-path privacy, Task 4 (spec §1): set when the ingest loop found the turn VOICE-SCOPED (isVoiceScopedTurn:
+     * VS-1 relay speaker, VS-2 `transcribed`, VS-3 relay sender, VS-4 call-start marker). Absent on every other turn,
+     * including a typed message sent during a live call. A narrowing mark only: it never widens anything.
+     */
+    voice_scoped?: true;
 }
 /**
  * Task 4 (voice-mode carrier): the one-sentence reply guidance compiled in
@@ -444,6 +463,14 @@ export interface BridgeAgentDeps {
      * see start(). Injected so tests do not wait a minute.
      */
     bootDrainWaitMs?: number;
+    /**
+     * B-4 (D35): the debounce before the runtime-config refetch that follows a search_providers_v2 capability change.
+     * The policy file is rewritten at once; this only bounds the refetch to one per burst. Test seam; production
+     * uses {@link SEARCH_CAPABILITY_REFETCH_DEBOUNCE_MS}.
+     */
+    searchCapabilityRefetchDebounceMs?: number;
+    /** B-4 fix round 1: the longest a burst may defer its refetch after its first change. Test seam. */
+    searchCapabilityRefetchMaxWaitMs?: number;
     /**
      * SEC-06 #18: the wait between in-process reply publish retries after a rate
      * limit. Defaults to an unref'd setTimeout. Injected so tests do not sleep.
@@ -651,6 +678,22 @@ export interface SendOptions {
     inReplyTo?: string;
     /** SEC-06 #18: caller idempotency key (WS path); names the reply part. */
     idempotencyKey?: string;
+    /**
+     * Voice fast-path privacy, Task 4b (spec §2.1 agent appends, §2.2 A-3): set ONLY by the ws send handler, computed at
+     * frame arrival, for a per-tool SecureComs runtime socket with no harness claim whose `in_reply_to` was in flight on
+     * THAT socket (same delivery), for the same channel, and not retired. Only such a reply to a voice-scoped turn may
+     * enter the call buffer. `POST /v1/send`, SSE and harness replies never set it.
+     */
+    callBufferReply?: true;
+}
+/**
+ * Task 4b (spec §2.2 A-6): a voice-scoped turn's history, read ONCE at ingest, the buffer seq it ends at and the
+ * buffer's reset generation then (final fix M-4: agent lines of a later call never join it).
+ */
+export interface VoiceSnapshot {
+    recent: CallBufferTurn[];
+    endSeq: number;
+    generation: number;
 }
 /**
  * B7 (FileSafe vault): a file-backed {@link OwnerAuthorityStore} for the
@@ -785,6 +828,10 @@ export interface AgentActionAPI {
 export declare const BRIDGE_VERSION: string;
 /** start() waits this long for its boot drain before it stops blocking on it. */
 export declare const BOOT_DRAIN_WAIT_MS_DEFAULT = 60000;
+/** B-4 (D35): the refetch after a search_providers_v2 change waits this long, so a reconnect burst (close, then hello) runs one. */
+export declare const SEARCH_CAPABILITY_REFETCH_DEBOUNCE_MS = 1000;
+/** B-4 fix round 1: a flapping socket still refetches no later than this after the first change of a burst. */
+export declare const SEARCH_CAPABILITY_REFETCH_MAX_WAIT_MS = 10000;
 export declare class BridgeAgent {
     private readonly cfg;
     private readonly transport;
@@ -1174,6 +1221,8 @@ export declare class BridgeAgent {
     private bootSweepTimer?;
     private readonly rng;
     private readonly bootDrainWaitMs;
+    private readonly searchCapabilityRefetchDebounceMs;
+    private readonly searchCapabilityRefetchMaxWaitMs;
     /** Resolved (and cleared) each time an ingest cycle settles: see start(). */
     private ingestSettledWaiters;
     /** The boot key-package publish, when start() had to defer it. Test seam. */
@@ -1375,6 +1424,11 @@ export declare class BridgeAgent {
     private startedAt;
     private readonly store;
     private readonly memory;
+    /**
+     * Voice fast-path privacy, Task 4b (spec §2.1, OQ-1 ruled): the current calls' spoken turns, in process only. The
+     * ONLY history a voice-scoped turn sees; read through voiceScopedHistory, once per turn, at ingest.
+     */
+    private readonly callBuffer;
     /**
      * Markdown memory 7a: the one owner of every note mutation and of the
      * delivery cache (spec §6.3, §7.2). One per store, so one per identity.
@@ -2204,6 +2258,18 @@ export declare class BridgeAgent {
      * its own text, never the prior-turn history snapshot, for every provider.
      */
     private mayReadHistoryForTurn;
+    /**
+     * Voice fast-path privacy (spec §2.1, OQ-1 ruled): the ONLY history source of a voice-scoped turn, the call buffer.
+     * Never reads the memory provider, the store, the unified store or the 7b index. A-6: called once per turn, at ingest
+     * (takeVoiceSnapshot), after the reset signals and before the turn's own append.
+     */
+    private voiceScopedHistory;
+    /**
+     * Task 4b (A-6): the turn's snapshot, taken BEFORE its own text is appended (audit finding 2). Final fix I-1: a turn
+     * already admitted to this call (a redelivered row) is snapshotted up to just before its own entry, as it was the
+     * first time, so its snapshot never contains itself.
+     */
+    private takeVoiceSnapshot;
     /** An inbound turn may receive OpenClaw memory only from an active owner DM. */
     private mayReadOpenClawMemoryForTurn;
     /**
@@ -2212,6 +2278,12 @@ export declare class BridgeAgent {
      * never falls back to the runtime's retired plaintext JSON files.
      */
     private memoryForTurn;
+    /**
+     * Task 6 (spec §2.2 A-1, N1): call-buffer entries as runtime-frame turns. Under the voice fence (a pin is loaded) the
+     * fast model's own lines (origin "fast_path") are dropped, as fenceMemory drops them from store history; the fast
+     * prompt keeps them. The internal origin is not carried into the frame; `seq` stays 0 (A-5).
+     */
+    private voiceFrameTurns;
     /**
      * Owner grants plan 4 Task 16 (T-30, audit r2 H-1): the voice fence is on whenever a pin is loaded, on EVERY runtime
      * turn (manifest, fallback, greeting, relayed, constants-only alike). It never depends on a turn's grants.
@@ -2321,6 +2393,12 @@ export declare class BridgeAgent {
      * but lack an epoch give no recall (fail closed). Never throws.
      */
     private prepareRecallForTurn;
+    /**
+     * Voice fast-path privacy, Task 7 (spec §4): the frame-keyed delivery check. A voice-scoped frame gets no notes, no
+     * recall and no unified items, whatever its authorization says. Keys on the frame's own marks, NEVER on the call
+     * buffer's id set (a reset evicts ids; the staged frame must stay scoped).
+     */
+    private frameIsVoiceScoped;
     /** ws flush (synchronous). Q1 to Q3 and Q6 again at delivery, on the ORIGINAL message; Q4 lives in withConsumerRecall. */
     recallForDelivery(m: BridgeMessage): readonly RecallItem[] | undefined;
     /** ws-server: a runtime socket with no harness claim declared memory_recall. */
@@ -2575,7 +2653,13 @@ export declare class BridgeAgent {
     private stageRuntimeMessageInOrder;
     /** Test seam: resolves once every queued fast reply has settled. */
     settleFastReplies(): Promise<void>;
-    /** Send a line the voice fast path speaks: its memory record is "voice" (H1). */
+    /**
+     * Send a line the voice fast path speaks: its memory record is "voice" (H1).
+     * Task 4b (spec §2.1 agent appends (1), A-1, A-2): once published, the line enters the call buffer as "fast_path",
+     * unless the turn it answers failed owner verification (its id, or any fragment of a coalesced turn). A line answering
+     * a turn the ingest did not find voice-scoped is not appended either (defense in depth: the fast path fires only on
+     * voice-scoped turns, Task 5).
+     */
     private sendSpoken;
     /** Speak a fixed acknowledgement line; failures are counted, never thrown. */
     private sendFastLine;
@@ -2584,8 +2668,8 @@ export declare class BridgeAgent {
      * the fast model's reply — or, in `ack_only`, the greeting template — is
      * spoken, and the outcome decides whether the runtime answers next.
      *
-     * MUST NEVER throw: every failure path (memory lookup, the LLM call,
-     * normalization, or the send itself) is caught, counted in
+     * MUST NEVER throw: every failure path (the LLM call, normalization,
+     * or the send itself) is caught, counted in
      * `fastPathFailed`, and logged WITHOUT the turn text or the model's reply.
      * The `fastReplyId(...)` send id is deterministic, so a duplicate that
      * slipped past the in-memory dedupe (e.g. a restart) resolves to the same
@@ -2841,17 +2925,22 @@ export declare class BridgeAgent {
      * guess. The returned object and grant array are frozen before they cross the
      * daemon boundary so one consumer cannot widen a later execution check.
      *
-     * Grants (architect ruling 2026-10-02): OWNER_DM_DEFAULT_READ_GRANTS only when
-     * the kill switch is on, the channel is a DM, and EITHER
+     * Grants (architect ruling 2026-10-02; P-5 and G-1, spec §9): an owner-DM
+     * constant only when the kill switch is on, the channel is a DM, and EITHER
      *   (a) audience is owner_dm AND the sender is the channel's pinned DM
      *       counterpart (`channelOwner`, never "anomalous"). A server-marked
      *       `is_agent_owner` on a member who is NOT the DM's single human
      *       counterpart gets nothing; on the counterpart it is trusted (see
-     *       LIMIT below); OR
+     *       LIMIT below). OWNER_DM_DEFAULT_READ_GRANTS on a typed turn;
+     *       RELAYED_VOICE_GRANTS and no memory_write when `opts.voiceScoped`
+     *       (G-1: the ingest predicate isVoiceScopedTurn, spec §1); OR
      *   (b) the sender is this channel's server-marked relay (`is_relay`) and the
      *       relayed `speaker_identity_id` (passed by the caller only for relay
      *       turns) is that same pinned owner, whose roster row is the agent's
-     *       owner. A speaker claim from any non-relay sender gets nothing.
+     *       owner: RELAYED_VOICE_GRANTS. A speaker claim from any non-relay
+     *       sender gets nothing.
+     * RELAYED_VOICE_GRANTS is never manifest-eligible: effectiveToolGrants gives
+     * the constant by reference, or the fallback when a good manifest is held.
      * Both need the roster fetched at `heldEpoch` (the agent's current MLS
      * epoch for the channel), or the DM marked epoch-fresh at this ingest
      * cycle's refresh (audit M-B4).
@@ -3299,6 +3388,51 @@ export declare class BridgeAgent {
     noteManifestConsumer(token: object): void;
     clearManifestConsumer(token: object): void;
     manifestConsumerAttached(): boolean;
+    /**
+     * D28 (B-4): every socket that said hello, with whether its latest hello declared search_providers_v2 on the
+     * manifest_grants_v1 predicate (ws-server.ts). The agent value is the AND over all of them, absent (false) with
+     * none: unlike manifestConsumer, never newest wins. The per-delivery filter judges each socket by its own hello.
+     */
+    private readonly searchProvidersSockets;
+    /**
+     * The D28 value the files were last recomputed for; null until the first socket observation, so that observation
+     * always recomputes (final review I-1), even when it is non-capable.
+     */
+    private searchProvidersState;
+    private searchCapabilityRefetchTimer;
+    /** When the current burst's first change happened (valid while the timer is set). */
+    private searchCapabilityBurstStart;
+    /** The D28 value in the last report posted (null until one is); a change needs a refetch to reach the web. */
+    private lastReportedSearchProviders;
+    noteSearchProvidersSocket(token: object, declared: boolean): void;
+    clearSearchProvidersSocket(token: object): void;
+    /** D28: every attached runtime socket declared search_providers_v2; no socket attached means absent (false). */
+    searchProvidersCapable(): boolean;
+    /**
+     * D19 item 3 (B-6): the search provider signed in the stored verified manifest in force (a pin loaded and a good
+     * manifest), never the server payload; undefined with no pin, no manifest, or no signed search block. The
+     * per-delivery filter (consumer-grants.ts withSearchCapability) and the S-28 report reason both read this.
+     */
+    signedSearchProvider(): SearchProvider | undefined;
+    /** D19 item 4, D34: the in-force signed provider is not brave, and the attached runtime(s) lack the capability. */
+    private searchProviderUnsupported;
+    /**
+     * D35 (P-4): on a capability change, rewrite manifest-policy.json at once from the stored manifest, the kill
+     * switches and the new capability, then a debounced refetch (one per burst) only when needed.
+     */
+    private onSearchProvidersMaybeChanged;
+    /**
+     * A refetch re-renders skills.json (owner_dm_search_cap counts web_extract only with the capability, D39) and posts
+     * the report. Needed under a manifest in force, or when the reported value is stale. Never before the boot fetch.
+     */
+    private searchCapabilityRefetchNeeded;
+    /**
+     * D35: the local recompute. Widening (web_extract back in) only while the binding for the in-force manifest stands,
+     * so a policy is never written ahead of its skills.json. Narrowing never waits: with no binding in force, a file that
+     * lists web_extract loses it at once, so an older runtime never reads it as unreadable (which drops every grant).
+     * Content-free; a write failure is logged and the debounced refetch tries again.
+     */
+    private recomputeManifestPolicy;
     noteConsumerCapability(state: "ok" | "missing" | "harness_consumer"): void;
     /**
      * Harness re-rule (2026-10-12, audit r2 H-3): true exactly when this agent has a pin loaded and a good

package/dist/consumer-grants.d.ts

@@ -1,4 +1,5 @@
 import type { BridgeMessage } from "./bridge-agent.js";
+import type { SearchProvider } from "./grants/search-providers.js";
 /**
  * The /v1/ws hello feature a consumer sends to declare per-tool grant
  * enforcement. The runtime exports the same value (connect-agent-runtime
@@ -23,6 +24,8 @@ export declare const PER_TOOL_GRANTS_FEATURE = "per_tool_grants";
 export declare function withConsumerGrants(m: BridgeMessage, perToolConsumer: boolean): BridgeMessage;
 /** The /v1/ws hello feature of a runtime that enforces manifest grants (runtime 0.13.0+). Pinned to the runtime's by capability-parity.test.ts. */
 export declare const MANIFEST_GRANTS_FEATURE = "manifest_grants_v1";
+/** The /v1/ws hello feature of a runtime that supports the five signed search providers and web_extract (spec D3, D28). Pinned to the runtime's by capability-parity.test.ts. */
+export declare const SEARCH_PROVIDERS_FEATURE = "search_providers_v2";
 export declare const CONSTANT_TOOL_NAMES: Readonly<Record<"owner_dm" | "team_room", readonly string[]>>;
 /**
  * Spec §7.9: a consumer that did not declare manifest_grants_v1 (runtime 0.12.2, a harness,
@@ -40,3 +43,15 @@ export declare function withManifestCapability(m: BridgeMessage, manifestConsume
  * Never mutates `m`. Callers: the three harness delivery paths, after withConsumerGrants.
  */
 export declare function withHarnessGrants(m: BridgeMessage, withheld: boolean): BridgeMessage;
+/**
+ * D19 item 3, D34, M-3, P-2 (B-6): the per-delivery search filter, applied on every delivery path AFTER
+ * withManifestCapability (and so after withHarnessGrants), judged by the consumer's OWN hello. A consumer that did not
+ * declare search_providers_v2 (an older runtime, a harness, every HTTP path) never receives:
+ * - a `web_extract` grant, whatever the signed provider (defence in depth beside the policy file, D19 item 1); and
+ * - a `web_search` grant, marked OR unmarked (the owner-DM constant and `constants ∩ signed` included), whenever the
+ *   provider signed in the stored verified manifest is defined and not `brave`. `tavily` too (D34): an older runtime
+ *   reads a readable install-time Brave key first, so only a signed `brave` cannot reach an unsigned vendor.
+ * `signedProvider` comes from the agent's stored verified manifest (BridgeAgent.signedSearchProvider), never the payload.
+ * Every other grant and field is unchanged. Returns `m` by reference when nothing is dropped; never mutates `m`.
+ */
+export declare function withSearchCapability(m: BridgeMessage, consumerHasFeature: boolean, signedProvider: SearchProvider | undefined): BridgeMessage;

package/dist/grants/binding.d.ts

@@ -1,3 +1,17 @@
+/**
+ * The config binding and signed-target composer (owner-signed tool grants, spec §7.8, §7.10, §7.12;
+ * plan 4 Task 10). One pure function decides every file the bridge writes under a manifest.
+ *
+ * Rule: under a manifest the bridge writes a widening input only from a signed value, or from the
+ * payload when it equals the signed value; it never writes a mismatched widening input. Two ruled
+ * exceptions: a mismatched search block is replaced by the last applied good one (rulings item 3), or with none
+ * usable by the signed provider alone with no key file (D24 (i)),
+ * and llm-source.json is always the bridge's own render of the signed provider and model (item 5).
+ *
+ * Never throws (audit r1 H-4): every read of server data goes through `guarded`, and a failure is a
+ * mismatch of that field with nothing written for it.
+ */
+import type { SearchProvider } from "./search-providers.js";
 import { type ToolGrantManifest } from "./manifest.js";
 import type { ManifestPolicyDoc } from "../service/runtime-config-dir.js";
 export declare const CONFIG_BINDING_FIELDS: readonly ["persona", "memory", "search", "tools_allow", "flags", "llm", "files", "legacy_assign"];
@@ -14,7 +28,7 @@ export interface BindPayload {
 }
 /** The search block last written under a good search match for this pinned key (Task 11's sealed record); undefined = never. */
 export type AppliedSearch = {
-    readonly provider: "brave" | "tavily";
+    readonly provider: SearchProvider;
     readonly keyFile?: string;
 } | null;
 export interface BindPrior {
@@ -50,9 +64,23 @@ export declare function legacyAssignToken(d: {
     fact_hash: string;
     channel_id: string;
 }): string;
+/** The manifest's signed tools for one audience, inside the code ceiling; web_extract only with the capability (D19 item 1, D28). */
+export declare function signedManifestTools(manifest: ToolGrantManifest, audience: "owner_dm" | "team_room", searchProvidersCapable: boolean): string[];
+/**
+ * manifest-policy.json from the stored manifest, the kill switches and the capability alone (D35): the bridge
+ * recomputes it locally on a capability change, without a refetch or a cached BindResult. An audience switched off
+ * contributes no tool (review H-1).
+ */
+export declare function manifestPolicyFor(manifest: ToolGrantManifest, switches: {
+    readonly ownerDm: boolean;
+    readonly room: boolean;
+}, searchProvidersCapable: boolean): ManifestPolicyDoc;
 export declare function bindRuntimeConfig(manifest: ToolGrantManifest, payload: BindPayload, prior: BindPrior, 
 /** Review H-1: the two manifest kill switches; an audience switched off contributes no tool to the policy file. */
 switches?: {
     readonly ownerDm: boolean;
     readonly room: boolean;
-}): BindResult;
+}, 
+/** D19 item 1, D28: every attached runtime socket declared search_providers_v2. Default false = fail closed:
+ *  an older runtime reads an unknown tool in manifest-policy.json as an unreadable file and drops every grant. */
+searchProvidersCapable?: boolean): BindResult;

package/dist/grants/manifest.d.ts

@@ -1,3 +1,12 @@
+/**
+ * Owner-signed tool grants, step 1 (spec §7.1, §8.1): verify the owner-signed
+ * tool-grant manifest wrapper `{ manifest, algo, signature }`.
+ *
+ * A pure function: an untrusted payload value in, "verified" or one named
+ * refusal out. In step 1 a verified manifest is only RECORDED; no grant code
+ * reads it (Task 8 pins that).
+ */
+import { type SearchProvider } from "./search-providers.js";
 import { type OwnerGrantPin } from "./pin.js";
 export declare const TOOL_GRANTS_DOMAIN = "SECURECOMS-TOOL-GRANTS-V1:";
 export declare const MANIFEST_STATES: readonly ["ok", "unchanged", "no_pin", "no_manifest", "malformed", "unsupported_algo", "bad_signature", "wrong_agent", "wrong_owner", "rollback", "unknown_entry", "kept_last_good"];
@@ -41,7 +50,8 @@ export interface SignedConfig {
         readonly model: string;
     };
     readonly search?: {
-        readonly provider: "brave" | "tavily";
+        readonly provider: SearchProvider;
+        readonly owner_dm_daily_cap?: number;
     };
     readonly tools_allow?: readonly string[];
     readonly flags: readonly string[];

package/dist/grants/search-providers.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Search providers the bridge accepts in a signed manifest (spec 2026-10-16 5.1, D2, D36).
+ * The ONE bridge copy of the union; a parity test pins it against the runtime's SEARCH_PROVIDERS (ST-38).
+ */
+export type SearchProvider = "brave" | "tavily" | "parallel" | "exa" | "firecrawl";
+export declare const SEARCH_PROVIDERS: ReadonlySet<SearchProvider>;
+/** Upper bound of the signed owner-DM daily search cap (D36, approved OQ-7). */
+export declare const OWNER_DM_SEARCH_DAILY_CAP_MAX = 2000;
+export declare function isSearchProvider(value: unknown): value is SearchProvider;

package/dist/http-server.d.ts

@@ -1,6 +1,7 @@
 import { type Server } from "node:http";
 import { z } from "zod";
 import type { BridgeAgent, BridgeMessage } from "./bridge-agent.js";
+import type { SearchProvider } from "./grants/search-providers.js";
 /**
  * #335 handling decision: the throwing-write swallow stays (a dying socket
  * must cost only that connection's remainder — the caller requeues it and
@@ -26,6 +27,7 @@ export declare function deliverSseBatch(res: Parameters<typeof writeSse>[0], bat
     ackRuntimeMessages(ids: string[]): void;
     requeueFront(msgs: BridgeMessage[]): void;
     harnessGrantsWithheld(): boolean;
+    signedSearchProvider(): SearchProvider | undefined;
 }, onWriteError?: (error: unknown) => void): void;
 /**
  * Once-per-connection write-failure reporter (#335). A throwing `res.write`