@agentcomms/resend 0.15.1 → 0.16.0

package/dist/{send-BcM5UKMt.mjs → send-BwyJM23a.mjs}

@@ -1,4 +1,4 @@
-import { S as union, b as strictObject, c as boolean, h as number, i as _enum, m as looseObject, n as datetime, p as literal$1, s as array, x as string, y as record } from "./iso-USuVU_sk.mjs";
+import { S as union, b as strictObject, c as boolean, h as number, i as _enum, l as discriminatedUnion, m as looseObject, n as datetime, p as literal$1, s as array, x as string, y as record } from "./iso-USuVU_sk.mjs";
 import { access, chmod, constants, link, lstat, mkdir, open, readFile, readdir, readlink, realpath, rename, rm, stat, unlink, utimes } from "node:fs/promises";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { domainToASCII, fileURLToPath, pathToFileURL } from "node:url";
@@ -12,7 +12,7 @@ import { execFile, spawn } from "node:child_process";
 //#endregion
 //#region src/version.ts
 /** The package version, read from package.json at build time. */
-const VERSION$1 = "0.15.1";
+const VERSION$1 = "0.16.0";
 //#endregion
 //#region src/api/routes.ts
 /**
@@ -201,7 +201,7 @@ const RESEND_CALLER = Object.freeze({
 	packageName: PACKAGE_NAME
 });
 //#endregion
-//#region ../core/dist/update-check-CZwCVNLB.mjs
+//#region ../core/dist/update-check-23Ii90fQ.mjs
 /**
 * Every failure a user or an agent can act on carries a specific, stable code from this registry, a message, an
 * optional one-line hint and structured `details`. The code decides the process exit status; agents and skills branch
@@ -317,6 +317,11 @@ const ERROR_REGISTRY = {
 		retryable: true,
 		summary: "the mail provider is unavailable"
 	},
+	SOURCE_UNAVAILABLE: {
+		exit: EXIT_CODES.UNAVAILABLE,
+		retryable: false,
+		summary: "the selected local event source is unavailable"
+	},
 	SECRET_STORE_UNAVAILABLE: {
 		exit: EXIT_CODES.UNAVAILABLE,
 		retryable: false,
@@ -347,6 +352,11 @@ const ERROR_REGISTRY = {
 		retryable: false,
 		summary: "the inbox was not granted this permission"
 	},
+	WHATSAPP_VISIBILITY_SEAM_REQUIRED: {
+		exit: EXIT_CODES.CONFIG,
+		retryable: false,
+		summary: "the WhatsApp event visibility fence is unavailable"
+	},
 	CONFIG: {
 		exit: EXIT_CODES.CONFIG,
 		retryable: false,
@@ -843,12 +853,29 @@ function dedupeBy(items, key) {
 	}
 	return out;
 }
+const ORIGINS$1 = ["event", "read"];
+function sortedOrigins(origins) {
+	const known = new Set(origins);
+	return ORIGINS$1.filter((origin) => known.has(origin));
+}
+function originEntry(entry) {
+	if (entry === void 0) return ["read"];
+	const known = Array.isArray(entry.origins) ? entry.origins.filter((origin) => origin === "event" || origin === "read") : [];
+	return known.length === 0 ? ["read"] : sortedOrigins(known);
+}
+function isNewer(at, than) {
+	const left = new Date(at).getTime();
+	const right = new Date(than).getTime();
+	return Number.isFinite(left) && Number.isFinite(right) && left > right;
+}
 var TaintStore = class {
 	directory;
 	#now;
-	constructor(stateDir, now = () => /* @__PURE__ */ new Date()) {
+	#hooks;
+	constructor(stateDir, now = () => /* @__PURE__ */ new Date(), hooks = {}) {
 		this.directory = join(stateDir, "taint");
 		this.#now = now;
+		this.#hooks = hooks;
 	}
 	get #path() {
 		return join(this.directory, "taint.json");
@@ -856,6 +883,9 @@ var TaintStore = class {
 	get #handlesPath() {
 		return join(this.directory, "handles.json");
 	}
+	get #originsPath() {
+		return join(this.directory, "origins.json");
+	}
 	async #readJson(path, empty) {
 		try {
 			const parsed = JSON.parse(await readFile(path, "utf8"));
@@ -881,6 +911,13 @@ var TaintStore = class {
 	async #readHandles() {
 		return this.#readJson(this.#handlesPath, () => ({ handles: {} }));
 	}
+	async #readOrigins() {
+		return this.#readJson(this.#originsPath, () => ({
+			addresses: {},
+			domains: {},
+			handles: {}
+		}));
+	}
 	#prune(file) {
 		const cutoff = this.#now().getTime() - TAINT_WINDOW_MS;
 		const keep = (map) => {
@@ -904,6 +941,35 @@ var TaintStore = class {
 			handles: Object.fromEntries(fresh.slice(0, MAX_ENTRIES))
 		};
 	}
+	#mergeOrigins(origins, addresses, domains, handles, touched, at) {
+		const merge = (sidecar, base, observed) => {
+			const merged = {};
+			for (const [key, entry] of Object.entries(sidecar)) {
+				const baseEntry = base[key];
+				if (baseEntry === void 0) continue;
+				const mergedOrigins = new Set(originEntry(entry));
+				if (isNewer(baseEntry.at, entry.at)) mergedOrigins.add("read");
+				merged[key] = {
+					at: isNewer(baseEntry.at, entry.at) ? baseEntry.at : entry.at,
+					origins: sortedOrigins(mergedOrigins)
+				};
+			}
+			for (const [key, observedOrigins] of observed) {
+				const existing = merged[key];
+				merged[key] = {
+					at,
+					origins: sortedOrigins([...existing?.origins ?? [], ...observedOrigins])
+				};
+			}
+			return merged;
+		};
+		return {
+			...origins,
+			addresses: merge(origins.addresses, addresses, touched.addresses),
+			domains: merge(origins.domains, domains, touched.domains),
+			handles: merge(origins.handles, handles, touched.handles)
+		};
+	}
 	/**
 	* Records observations. Throws if it cannot — callers must fail the read rather than return content whose taint
 	* was not recorded.
@@ -922,7 +988,17 @@ var TaintStore = class {
 		})).filter((o) => o.address.includes("@") && !own.has(o.address) && !internal.has(domainOf(o.address) ?? "")).sort((a, b) => a.source === b.source ? 0 : a.source === "header" ? -1 : 1), (o) => o.address).slice(0, MAX_PER_MESSAGE);
 		if (kept.length === 0 && keptHandles.length === 0) return;
 		const at = this.#now().toISOString();
-		const touch = (map, key, o) => {
+		const touched = {
+			addresses: /* @__PURE__ */ new Map(),
+			domains: /* @__PURE__ */ new Map(),
+			handles: /* @__PURE__ */ new Map()
+		};
+		const rememberOrigin = (map, key, origin) => {
+			const origins = touched[map].get(key) ?? /* @__PURE__ */ new Set();
+			origins.add(origin ?? "read");
+			touched[map].set(key, origins);
+		};
+		const touch = (map, key, o, originMap) => {
 			const existing = map[key];
 			const inboxIds = [.../* @__PURE__ */ new Set([...existing?.inboxIds ?? [], o.inboxId])];
 			const source = existing?.source === "header" ? "header" : o.source;
@@ -931,27 +1007,38 @@ var TaintStore = class {
 				source,
 				inboxIds
 			};
+			rememberOrigin(originMap, key, o.origin);
 		};
-		if (kept.length > 0) {
-			const path = this.#path;
-			await withFileLock(`${path}.lock`, async () => {
-				const file = this.#prune(await this.#read());
-				for (const o of kept) {
-					touch(file.addresses, o.address, o);
-					const domain = domainOf(o.address);
-					if (domain && !PUBLIC_MAILBOX_DOMAINS.has(domain)) touch(file.domains, domain, o);
-				}
-				await writeFileAtomic(path, JSON.stringify(file));
-			});
-		}
-		if (keptHandles.length > 0) {
-			const path = this.#handlesPath;
-			await withFileLock(`${path}.lock`, async () => {
-				const file = this.#pruneHandles(await this.#readHandles());
-				for (const o of keptHandles) touch(file.handles, o.key, o);
-				await writeFileAtomic(path, JSON.stringify(file));
+		const commit = async () => {
+			const taint = this.#prune(await this.#read());
+			const handles = this.#pruneHandles(await this.#readHandles());
+			if (kept.length > 0) for (const o of kept) {
+				touch(taint.addresses, o.address, o, "addresses");
+				const domain = domainOf(o.address);
+				if (domain && !PUBLIC_MAILBOX_DOMAINS.has(domain)) touch(taint.domains, domain, o, "domains");
+			}
+			if (keptHandles.length > 0) for (const o of keptHandles) touch(handles.handles, o.key, o, "handles");
+			const finalTaint = this.#prune(taint);
+			const finalHandles = this.#pruneHandles(handles);
+			const origins = this.#mergeOrigins(await this.#readOrigins(), finalTaint.addresses, finalTaint.domains, finalHandles.handles, touched, at);
+			await writeFileAtomic(this.#originsPath, JSON.stringify(origins));
+			await this.#hooks.afterOriginsCommit?.();
+			if (kept.length > 0) await writeFileAtomic(this.#path, JSON.stringify(finalTaint));
+			if (keptHandles.length > 0) await writeFileAtomic(this.#handlesPath, JSON.stringify(finalHandles));
+		};
+		const withBaseLocks = async () => {
+			await withFileLock(`${this.#path}.lock`, async () => {
+				this.#hooks.onLockAcquired?.("taint");
+				await withFileLock(`${this.#handlesPath}.lock`, async () => {
+					this.#hooks.onLockAcquired?.("handles");
+					await commit();
+				});
 			});
-		}
+		};
+		await withFileLock(`${this.#originsPath}.lock`, async () => {
+			this.#hooks.onLockAcquired?.("origins");
+			await withBaseLocks();
+		});
 	}
 	/**
 	* Whether an address, or its (non-public) domain, was seen in email content in the window — from any inbox — and the
@@ -959,20 +1046,22 @@ var TaintStore = class {
 	*/
 	async check(address) {
 		const file = this.#prune(await this.#read());
+		const origins = await this.#readOrigins();
 		const canonical = canonicalAddress(address);
 		const domain = domainOf(canonical);
 		const exact = Object.hasOwn(file.addresses, canonical) ? file.addresses[canonical] : void 0;
 		const byDomain = domain !== null && !PUBLIC_MAILBOX_DOMAINS.has(domain) && Object.hasOwn(file.domains, domain) ? file.domains[domain] : void 0;
-		const aggregate = (entry) => ({
+		const aggregate = (entry, origin) => ({
 			at: entry.at,
 			source: entry.source,
-			inboxIds: [...entry.inboxIds]
+			inboxIds: [...entry.inboxIds],
+			origins: sortedOrigins([...originEntry(origin), ...origin !== void 0 && isNewer(entry.at, origin.at) ? ["read"] : []])
 		});
 		return {
 			address: exact !== void 0,
 			domain: byDomain !== void 0,
-			...exact === void 0 ? {} : { addressSeen: aggregate(exact) },
-			...byDomain === void 0 ? {} : { domainSeen: aggregate(byDomain) }
+			...exact === void 0 ? {} : { addressSeen: aggregate(exact, origins.addresses[canonical]) },
+			...byDomain === void 0 ? {} : { domainSeen: aggregate(byDomain, origins.domains[domain ?? ""]) }
 		};
 	}
 	/**
@@ -985,6 +1074,15 @@ var TaintStore = class {
 		const file = this.#pruneHandles(await this.#readHandles());
 		return canonicalHandle(handle) in file.handles;
 	}
+	/** The merged provenance of a retained handle, or no origins when it is not in the taint window. */
+	async checkHandleOrigins(handle) {
+		const file = this.#pruneHandles(await this.#readHandles());
+		const key = canonicalHandle(handle);
+		const entry = file.handles[key];
+		if (entry === void 0) return [];
+		const sidecar = (await this.#readOrigins()).handles[key];
+		return sortedOrigins([...originEntry(sidecar), ...sidecar !== void 0 && isNewer(entry.at, sidecar.at) ? ["read"] : []]);
+	}
 };
 /**
 * The context every read path uses to put sender-controlled content into a result. It wraps strings in the untrusted
@@ -1000,21 +1098,23 @@ var TaintCollector = class {
 		this.#messageId = messageId;
 	}
 	/** Scans free text (bodies, subjects, snippets, attachment text) for addresses. */
-	observeText(text) {
+	observeText(text, origin = "read") {
 		for (const address of extractAddresses(text)) this.#observations.push({
 			address,
 			source: "body",
+			origin,
 			inboxId: this.#inboxId,
 			messageId: this.#messageId
 		});
 	}
 	/** Records parsed header addresses (From, Reply-To, Sender, To, Cc). */
-	observeHeaders(addresses) {
+	observeHeaders(addresses, origin = "read") {
 		for (const address of addresses) {
 			const canonical = canonicalAddress(address);
 			if (canonical.includes("@")) this.#observations.push({
 				address: canonical,
 				source: "header",
+				origin,
 				inboxId: this.#inboxId,
 				messageId: this.#messageId
 			});
@@ -1027,10 +1127,11 @@ var TaintCollector = class {
 	* second place to keep it correct. What core insists on is that the caller hands over ids rather than the display
 	* names beside them, which the account being named can change at any time.
 	*/
-	observeHandles(handles, source = "body") {
+	observeHandles(handles, source = "body", origin = "read") {
 		for (const handle of handles) this.#handles.push({
 			handle,
 			source,
+			origin,
 			inboxId: this.#inboxId,
 			messageId: this.#messageId
 		});
@@ -1127,7 +1228,19 @@ const CHANNEL_SNAPSHOT = [
 				prefix: "gmail-",
 				contract: "skills/_shared/contract-gmail.md"
 			},
-			approvalGrouping: "draft"
+			approvalGrouping: "draft",
+			events: {
+				types: [
+					"gmail.message.received",
+					"gmail.message.sent",
+					"gmail.message.labelled"
+				],
+				minimumIntervalMs: 6e4,
+				access: {
+					kind: "oauth-user",
+					requiredScopes: ["https://www.googleapis.com/auth/gmail.readonly"]
+				}
+			}
 		}
 	},
 	{
@@ -1167,7 +1280,12 @@ const CHANNEL_SNAPSHOT = [
 				prefix: "resend-",
 				contract: "skills/_shared/contract-resend.md"
 			},
-			approvalGrouping: "draft"
+			approvalGrouping: "draft",
+			events: {
+				types: ["resend.email.received", "resend.email.status_changed"],
+				minimumIntervalMs: 6e4,
+				access: { kind: "resend-full-access" }
+			}
 		}
 	},
 	{
@@ -1207,7 +1325,20 @@ const CHANNEL_SNAPSHOT = [
 				prefix: "slack-",
 				contract: "skills/_shared/contract-slack.md"
 			},
-			approvalGrouping: "draft-revision-digest"
+			approvalGrouping: "draft-revision-digest",
+			events: {
+				types: ["slack.message.posted"],
+				minimumIntervalMs: 6e4,
+				access: {
+					kind: "oauth-user",
+					requiredScopes: [
+						"channels:history",
+						"groups:history",
+						"im:history",
+						"mpim:history"
+					]
+				}
+			}
 		}
 	},
 	{
@@ -1246,10 +1377,76 @@ const CHANNEL_SNAPSHOT = [
 			skills: {
 				prefix: "whatsapp-",
 				contract: "skills/_shared/contract-whatsapp.md"
+			},
+			events: {
+				types: ["whatsapp.message.received"],
+				minimumIntervalMs: 6e4,
+				access: { kind: "local-store" }
 			}
 		}
 	}
 ];
+const DISCLOSURE_VERSION_KINDS = [
+	"rule",
+	"target",
+	"subscriber",
+	"judge",
+	"judge-budget",
+	"judge-kind"
+];
+const DISCLOSURE_ACTIVATION_KINDS = [
+	"rule",
+	"judge-budget",
+	"judge-kind",
+	"enable-all"
+];
+const HEX64$1 = /^[0-9a-f]{64}$/;
+function disclosureFailure() {
+	throw new CommsError("BAD_DATA", "a disclosure binding is not in its canonical activation shape");
+}
+function compareDisclosureVersions(left, right) {
+	const compareText = (one, two) => one < two ? -1 : one > two ? 1 : 0;
+	return compareText(left.kind, right.kind) || compareText(left.id, right.id) || left.version - right.version;
+}
+/**
+* Validates and copies a disclosure binding without reordering it. A caller must provide the
+* daemon-derived canonical list, already sorted by (kind, id, version), so a different document
+* cannot become authorised by a convenient normalisation here.
+*/
+function canonicalDisclosureBinding(binding) {
+	if (!HEX64$1.test(binding.digest) || typeof binding.activationIntentId !== "string" || binding.activationIntentId.length === 0 || !DISCLOSURE_ACTIVATION_KINDS.includes(binding.activationKind) || !Array.isArray(binding.versions)) return disclosureFailure();
+	const versions = binding.versions.map((entry) => {
+		if (!DISCLOSURE_VERSION_KINDS.includes(entry.kind) || typeof entry.id !== "string" || entry.id.length === 0 || !Number.isSafeInteger(entry.version) || entry.version < 1) return disclosureFailure();
+		return {
+			kind: entry.kind,
+			id: entry.id,
+			version: entry.version
+		};
+	});
+	for (let index = 1; index < versions.length; index += 1) if (compareDisclosureVersions(versions[index - 1], versions[index]) >= 0) return disclosureFailure();
+	const kinds = new Set(versions.map((entry) => entry.kind));
+	if (binding.activationKind === "rule") {
+		if (!kinds.has("rule") || kinds.has("judge-budget") || kinds.has("judge-kind")) return disclosureFailure();
+	} else if (binding.activationKind === "judge-budget") {
+		if (versions.length !== 1 || versions[0]?.kind !== "judge-budget") return disclosureFailure();
+	} else if (binding.activationKind === "judge-kind") {
+		if (versions.length !== 1 || versions[0]?.kind !== "judge-kind") return disclosureFailure();
+	} else if (versions.some((entry) => entry.kind !== "rule")) return disclosureFailure();
+	return {
+		digest: binding.digest,
+		activationIntentId: binding.activationIntentId,
+		activationKind: binding.activationKind,
+		versions
+	};
+}
+/** Exact canonical equality for each re-check at approval and claim. */
+function sameDisclosureBinding(left, right) {
+	try {
+		return canonicalJson$1(canonicalDisclosureBinding(left)) === canonicalJson$1(canonicalDisclosureBinding(right));
+	} catch {
+		return false;
+	}
+}
 /** The lifetime profile, in milliseconds: pending on each route, approved, and a download's question. */
 const APPROVAL_LIFETIMES = Object.freeze({
 	chat: 6e5,
@@ -1327,18 +1524,25 @@ function listedEntry(file) {
 * folders it offered, and the listing exactly as stored, left out when the record has none.
 */
 function bindingObjectOf(record) {
-	const identity = identityOf(record);
-	if (record.kind === "download") {
-		const download = record.download;
+	if (record.kind === "disclosure" && "disclosure" in record && record.disclosure !== void 0) return {
+		v: 2,
+		kind: "disclosure",
+		approvalId: record.approvalId,
+		disclosure: canonicalDisclosureBinding(record.disclosure)
+	};
+	const ordinary = record;
+	const identity = identityOf(ordinary);
+	if (ordinary.kind === "download") {
+		const download = ordinary.download;
 		if (download === void 0) throw new CommsError("BAD_DATA", "a download’s approval does not hold the question it was asked for");
 		return {
 			v: 2,
 			kind: "download",
-			contentDigest: record.contentDigest,
+			contentDigest: ordinary.contentDigest,
 			profile: {
-				pendingMs: record.pendingMs,
-				policy: record.policy,
-				requiredPolicy: record.requiredPolicy
+				pendingMs: ordinary.pendingMs,
+				policy: ordinary.policy,
+				requiredPolicy: ordinary.requiredPolicy
 			},
 			identity,
 			offered: {
@@ -1350,11 +1554,11 @@ function bindingObjectOf(record) {
 	}
 	return {
 		v: 2,
-		kind: record.kind,
-		contentDigest: record.contentDigest,
-		route: record.route,
-		pendingMs: record.pendingMs,
-		approvedMs: record.approvedMs,
+		kind: ordinary.kind,
+		contentDigest: ordinary.contentDigest,
+		route: ordinary.route,
+		pendingMs: ordinary.pendingMs,
+		approvedMs: ordinary.approvedMs,
 		identity
 	};
 }
@@ -6342,7 +6546,11 @@ const NO_CONFIGURATION = "this approval store was opened without a configuration
 const sentAtWords = (usedAt) => `sent at ${usedAt}`;
 /** The refusal prefix and detail key of each kind: a send sends nothing, a change changes nothing, a question saves nothing. */
 function refusalOf(kind) {
-	const [prefix, idKey, hint] = kind === "change" ? [
+	const [prefix, idKey, hint] = kind === "disclosure" ? [
+		"nothing was disclosed",
+		"approvalId",
+		"Prepare a new standing disclosure authorisation and show its exact activation preview to the person."
+	] : kind === "change" ? [
 		"nothing was changed",
 		"approvalId",
 		"Prepare the change again and show the new preview to the user."
@@ -6369,7 +6577,7 @@ function refusalOf(kind) {
 * or one a pinned surface may not see — byte for byte the same, with `approval: null`, and nothing of any record in it.
 */
 function approvalNotFound(approvalId, kind) {
-	return new CommsError("NOT_FOUND", `${kind === "change" ? "nothing was changed" : kind === "download" ? "nothing was saved" : "nothing was sent"}: no approval ${approvalId}`, {
+	return new CommsError("NOT_FOUND", `${kind === "disclosure" ? "nothing was disclosed" : kind === "change" ? "nothing was changed" : kind === "download" ? "nothing was saved" : "nothing was sent"}: no approval ${approvalId}`, {
 		hint: "Check the id: an approval is only found by the surface, the kind and the owner it was prepared for.",
 		details: { approval: null }
 	});
@@ -6401,6 +6609,24 @@ function objectOf(record, state, claimable, ownerRemoved, reason) {
 		...optional("expiredAt", record.expiredAt)
 	};
 }
+/** Standing disclosure has no channel owner, draft, policy or sender-controlled field to classify. */
+function disclosureObjectOf(record, claimable, reason) {
+	return {
+		id: record.approvalId,
+		kind: "disclosure",
+		channel: null,
+		state: record.state,
+		claimable,
+		...reason === void 0 ? {} : { reason },
+		createdAt: record.createdAt,
+		expiresAt: record.expiresAt,
+		...record.approvedAt === void 0 ? {} : { approvedAt: record.approvedAt },
+		...record.usableUntil === void 0 ? {} : { usableUntil: record.usableUntil },
+		...record.usedAt === void 0 ? {} : { usedAt: record.usedAt },
+		...record.revokedAt === void 0 ? {} : { revokedAt: record.revokedAt },
+		...record.expiredAt === void 0 ? {} : { expiredAt: record.expiredAt }
+	};
+}
 Object.freeze([
 	"expect.to",
 	"expect.cc",
@@ -6436,7 +6662,7 @@ function saidOf(approval, facts, options) {
 	if (approval.state === "answered") return facts.answeredWords;
 	if (approval.state === "expired") {
 		if (facts.kind === "download") return downloadExpiredWords(facts.answered);
-		const nothing = `nothing was ${facts.kind === "change" ? "changed" : "sent"} with it`;
+		const nothing = facts.kind === "change" ? "nothing was changed with it" : facts.kind === "disclosure" ? "nothing was disclosed with it" : "nothing was sent with it";
 		return approval.reason === "clock-anomaly" ? `the clock moved backwards; this approval was expired safely at ${approval.expiredAt}; ${nothing}` : `this approval expired; ${nothing}`;
 	}
 	if (approval.state === "used" && facts.kind === "send" && approval.usedAt !== void 0) return options.usedSaid?.(approval.usedAt) ?? `accepted by ${approval.channel === null ? "its provider" : labelOf$1(approval.channel)} at ${approval.usedAt}`;
@@ -6456,7 +6682,7 @@ function publicApproval(stored, outcome, options = {}) {
 		field,
 		id: approval.id
 	}, boundary));
-	const source = stored.form === "v2" ? {
+	const source = stored.form === "v2" && stored.record.kind !== "disclosure" ? {
 		inboxId: stored.record.inboxId,
 		draftId: stored.record.draftId,
 		expect: stored.record.expect,
@@ -6470,7 +6696,7 @@ function publicApproval(stored, outcome, options = {}) {
 		download: stored.record.download,
 		answered: stored.record.approvedVia !== void 0,
 		answeredWords: void 0
-	} : stored.form === "corrupt" && stored.safe !== null ? {
+	} : stored.form === "corrupt" && stored.safe !== null && stored.safe.kind !== "disclosure" ? {
 		inboxId: stored.safe.inboxId,
 		draftId: stored.safe.draftId,
 		expect: stored.safe.expect,
@@ -6511,6 +6737,7 @@ function publicApproval(stored, outcome, options = {}) {
 * nothing claimable. Pure: what decides is the store's locked classification, and this only says where it stands.
 */
 function approvalObjectOf(record, live, now) {
+	if (record.kind === "disclosure") return classifyDisclosure(record).approval;
 	return classifyV2(record, {
 		action: "inspect",
 		live,
@@ -6590,7 +6817,7 @@ function approvalOutcome(stored, context) {
 			approval: {
 				id,
 				kind: safe?.kind ?? null,
-				channel: safe?.channel ?? null,
+				channel: safe?.kind === "disclosure" ? null : safe?.channel ?? null,
 				state: "corrupt",
 				claimable: false,
 				reason
@@ -6601,6 +6828,7 @@ function approvalOutcome(stored, context) {
 	return classifyV2(stored.record, context);
 }
 function classifyV2(read, context) {
+	if (read.kind === "disclosure") return classifyDisclosure(read);
 	const { live, action } = context;
 	const at = context.now.toISOString();
 	const ownerRemoved = read.ownerScope === "owner" && live?.owner === "removed";
@@ -6649,12 +6877,42 @@ function classifyV2(read, context) {
 		...error === void 0 ? {} : { error }
 	};
 }
+/** The isolated disclosure state machine never follows a config policy or a channel-owner fence. */
+function classifyDisclosure(record) {
+	const claimable = record.state === "approved";
+	const approval = disclosureObjectOf(record, claimable, record.reason);
+	let error;
+	switch (record.state) {
+		case "pending":
+		case "approved": break;
+		case "used":
+			error = refusalOf("disclosure")("APPROVAL_VOID", `the standing disclosure approval was used already at ${record.usedAt}`, record, approval);
+			break;
+		case "expired":
+			error = refusalOf("disclosure")("APPROVAL_EXPIRED", "the standing disclosure approval expired unused", record, approval);
+			break;
+		case "revoked":
+			error = refusalOf("disclosure")("APPROVAL_VOID", `the standing disclosure approval was voided (${record.reason ?? "revoked"})`, record, approval);
+			break;
+		default: error = refusalOf("disclosure")("APPROVAL_VOID", "the standing disclosure approval is in an invalid state", record, approval);
+	}
+	return {
+		state: record.state,
+		claimable,
+		...record.reason === void 0 ? {} : { reason: record.reason },
+		record,
+		revokes: false,
+		approval,
+		...error === void 0 ? {} : { error }
+	};
+}
 /** Whether an active record can be claimed under `live` (D2, `claimable`). */
 function isClaimable(record, live) {
 	switch (record.kind) {
 		case "send": return record.state === "approved" || record.route === "chat" && live.sendPolicy === "chat";
 		case "change": return record.state === "approved" || record.route === "chat" && live.changePolicy === "chat";
 		case "download": return downloadClaimable(record, live.changePolicy);
+		case "disclosure": return record.state === "approved";
 	}
 }
 /**
@@ -6712,6 +6970,7 @@ function errorOf(record, approval, context) {
 			});
 		}
 		case "used":
+			if (record.kind === "disclosure") return refuse("APPROVAL_VOID", `the standing disclosure approval was used already at ${record.usedAt}`, record, approval);
 			if (download) return refuse("APPROVAL_VOID", "the question was answered already, and an answer is used once", record, approval);
 			if (record.kind === "change") return refuse("APPROVAL_VOID", `the approved change was already claimed at ${record.usedAt}`, record, approval);
 			return refuse("APPROVAL_VOID", `the approval was used already: it was ${context.usedSaid(String(record.usedAt))}, message id ${record.sentMessageId}`, record, approval, "Prepare a new send only for a new message.");
@@ -6922,10 +7181,24 @@ function refuseDownload(code, reason, record, hint) {
 		} : {}
 	});
 }
+/** The disclosure path has no send, draft or provider outcome: its refusal must never imply one. */
+function refuseDisclosure(code, reason, record, hint) {
+	return new CommsError(code, `nothing was disclosed: ${reason}`, {
+		hint: hint ?? "Prepare a new standing disclosure authorisation and show its exact activation preview to the person.",
+		details: record ? {
+			approvalId: record.approvalId,
+			state: record.state
+		} : {}
+	});
+}
 /** The refusal in the words of the record's own kind. */
 function refusalFor(record) {
-	const kind = approvalKind(record);
-	return kind === "change" ? refuseChange : kind === "download" ? refuseDownload : refuse$1;
+	switch (approvalKind(record)) {
+		case "send": return refuse$1;
+		case "change": return refuseChange;
+		case "download": return refuseDownload;
+		case "disclosure": return refuseDisclosure;
+	}
 }
 /**
 * The refusal of a record prepared under another digest version, in the words of its own kind: the one every locked
@@ -6942,23 +7215,40 @@ function otherVersionRefusal(record) {
 * nothing is sent by answering one. The record is as it was, and the hint says so.
 */
 function cancelledClaim(record) {
-	const kind = approvalKind(record);
-	if (kind === "download") return new CommsError("USAGE", "cancelled: nothing was saved", {
-		hint: "The question was not used: the same call, made again with the same answer, can still use it until it expires.",
-		details: {
-			choiceId: record.approvalId,
-			state: record.state,
-			reason: "cancelled"
-		}
-	});
-	return new CommsError("USAGE", `cancelled: ${kind === "change" ? "nothing was changed" : "nothing was sent"}`, {
-		hint: "The approval was not used: the same call, made again, can still use it until it expires.",
-		details: {
-			approvalId: record.approvalId,
-			state: record.state,
-			reason: "cancelled"
-		}
-	});
+	switch (approvalKind(record)) {
+		case "send": return new CommsError("USAGE", "cancelled: nothing was sent", {
+			hint: "The approval was not used: the same call, made again, can still use it until it expires.",
+			details: {
+				approvalId: record.approvalId,
+				state: record.state,
+				reason: "cancelled"
+			}
+		});
+		case "change": return new CommsError("USAGE", "cancelled: nothing was changed", {
+			hint: "The approval was not used: the same call, made again, can still use it until it expires.",
+			details: {
+				approvalId: record.approvalId,
+				state: record.state,
+				reason: "cancelled"
+			}
+		});
+		case "download": return new CommsError("USAGE", "cancelled: nothing was saved", {
+			hint: "The question was not used: the same call, made again with the same answer, can still use it until it expires.",
+			details: {
+				choiceId: record.approvalId,
+				state: record.state,
+				reason: "cancelled"
+			}
+		});
+		case "disclosure": return new CommsError("USAGE", "cancelled: nothing was disclosed", {
+			hint: "The standing disclosure approval was not used: it can still be completed until it expires.",
+			details: {
+				approvalId: record.approvalId,
+				state: record.state,
+				reason: "cancelled"
+			}
+		});
+	}
 }
 /** The refusal of a renewal or an outcome from a call that does not hold the send's claim. It names no token. */
 function notTheClaim(approvalId) {
@@ -6985,7 +7275,9 @@ function approvePendingHint(handoffs, approvalId, platform) {
 function matchesExpectation(found, expect) {
 	const kind = kindOf(found);
 	const owner = ownerOf(found);
-	if (kind === null || owner === null) return expect.owner === void 0;
+	if (kind === null) return expect.owner === void 0;
+	if (kind === "disclosure") return (expect.kind === void 0 || expect.kind === "disclosure") && expect.channel === void 0 && expect.owner === void 0;
+	if (owner === null) return expect.owner === void 0;
 	if (expect.kind !== void 0 && kind !== expect.kind) return false;
 	if (expect.channel !== void 0 && channelOf(found) !== expect.channel) return false;
 	return expect.owner === void 0 || owner === expect.owner;
@@ -7110,6 +7402,18 @@ var ApprovalStore = class {
 	* profile checked first, so nothing is written that names a channel this release does not know.
 	*/
 	#bound(record) {
+		if (record.kind === "disclosure") {
+			const disclosure = canonicalDisclosureBinding(record.disclosure);
+			return {
+				...record,
+				disclosure,
+				bindingDigest: bindingDigestOf({
+					approvalId: record.approvalId,
+					kind: "disclosure",
+					disclosure
+				})
+			};
+		}
 		requireKnownChannel(record.channel);
 		return {
 			...record,
@@ -7157,6 +7461,28 @@ var ApprovalStore = class {
 		await this.#write(record);
 		return record;
 	}
+	/** Creates only a pending standing disclosure approval from a daemon-derived canonical binding. */
+	async createDisclosure(binding) {
+		await this.ensurePruned();
+		const disclosure = canonicalDisclosureBinding(binding);
+		const now = this.#now();
+		const pendingMs = APPROVAL_LIFETIMES.confirm;
+		const record = this.#bound({
+			approvalId: newApprovalId(),
+			kind: "disclosure",
+			digestVersion: 2,
+			pendingMs,
+			approvedMs: APPROVAL_LIFETIMES.approved,
+			disclosure,
+			challengeAttempts: 0,
+			state: "pending",
+			createdAt: now.toISOString(),
+			expiresAt: new Date(now.getTime() + pendingMs).toISOString(),
+			updatedAt: now.toISOString()
+		});
+		await this.#write(record);
+		return record;
+	}
 	/**
 	* One approval, in whichever of its four forms it is (`StoredApproval`), read against one configuration snapshot —
 	* or null when there is none. Nothing is written.
@@ -7307,17 +7633,33 @@ var ApprovalStore = class {
 	* approval can be used as it is.
 	*/
 	#alreadyApproved(record, outcome) {
-		return new CommsError("USAGE", `${record.kind === "change" ? "nothing was changed" : "nothing was sent"}: it is approved already, and a person approves it once`, {
-			hint: "Nothing more is needed from the person: try the same call again with the same approval.",
-			details: {
-				approvalId: record.approvalId,
-				state: record.state,
-				approval: outcome.approval
-			}
-		});
+		const detail = {
+			approvalId: record.approvalId,
+			state: record.state,
+			approval: outcome.approval
+		};
+		switch (record.kind) {
+			case "send": return new CommsError("USAGE", "nothing was sent: it is approved already, and a person approves it once", {
+				hint: "Nothing more is needed from the person: try the same call again with the same approval.",
+				details: detail
+			});
+			case "change": return new CommsError("USAGE", "nothing was changed: it is approved already, and a person approves it once", {
+				hint: "Nothing more is needed from the person: try the same call again with the same approval.",
+				details: detail
+			});
+			case "download": return new CommsError("USAGE", "nothing was saved: it is approved already, and a person approves it once", {
+				hint: "Nothing more is needed from the person: try the same call again with the same approval.",
+				details: detail
+			});
+			case "disclosure": return new CommsError("USAGE", "nothing was disclosed: it is approved already, and a person approves it once", {
+				hint: "Nothing more is needed from the person: complete the same activation with the same approval.",
+				details: detail
+			});
+		}
 	}
 	/** Issues a new challenge to show a human; only its hash is kept. */
 	async issueChallenge(approvalId, kind = "send", _platform = process.platform, options = {}) {
+		if (kind === "disclosure") throw new CommsError("APPROVAL_REQUIRED", "nothing was disclosed: a standing disclosure challenge is only issued to the trusted terminal or app route");
 		const challenge = newChallenge();
 		await this.#transition(approvalId, { kind }, "approve", (current, outcome) => {
 			if (outcome.error) throw outcome.error;
@@ -7329,6 +7671,139 @@ var ApprovalStore = class {
 		}, { usedSaid: options.usedSaid });
 		return challenge;
 	}
+	/** Issues the typed challenge that a terminal or the trusted desktop app must answer for disclosure. */
+	async issueDisclosureChallenge(approvalId) {
+		const challenge = newChallenge();
+		await this.#transition(approvalId, { kind: "disclosure" }, "approve", (current, outcome) => {
+			if (outcome.error) throw outcome.error;
+			if (current.state !== "pending") throw this.#alreadyApproved(current, outcome);
+			return {
+				...current,
+				challengeHash: hashChallenge(challenge)
+			};
+		});
+		return challenge;
+	}
+	/**
+	* Approves one exact standing disclosure authority. MCP/chat forms are never an approval channel here: `app` means
+	* the desktop application's trusted typed-challenge bridge, not a client form.
+	*/
+	async approveDisclosure(approvalId, liveBinding, answer, via) {
+		let failure = null;
+		const done = await this.#transition(approvalId, { kind: "disclosure" }, "approve", (current, outcome) => {
+			if (outcome.error) throw outcome.error;
+			if (current.state !== "pending") throw this.#alreadyApproved(current, outcome);
+			if (via !== "terminal" && via !== "app") throw new CommsError("APPROVAL_REQUIRED", "nothing was disclosed: approval is only at the terminal or the trusted app", { details: {
+				approvalId: current.approvalId,
+				state: current.state
+			} });
+			if (!current.challengeHash) throw new CommsError("APPROVAL_REQUIRED", "nothing was disclosed: no challenge was issued for this approval", { details: {
+				approvalId: current.approvalId,
+				state: current.state
+			} });
+			const at = this.#now();
+			const binding = current.disclosure;
+			if (!sameDisclosureBinding(binding, liveBinding)) {
+				failure = {
+					code: "APPROVAL_VOID",
+					reason: "the disclosure binding changed after it was prepared"
+				};
+				return {
+					...current,
+					state: "revoked",
+					reason: failure.reason,
+					revokedAt: at.toISOString(),
+					challengeHash: void 0
+				};
+			}
+			if (!challengeMatches(answer, current.challengeHash)) {
+				const attempts = current.challengeAttempts + 1;
+				if (attempts >= 3) {
+					failure = {
+						code: "APPROVAL_VOID",
+						reason: "too many wrong answers to the challenge"
+					};
+					return {
+						...current,
+						challengeAttempts: attempts,
+						state: "revoked",
+						reason: failure.reason,
+						revokedAt: at.toISOString()
+					};
+				}
+				failure = {
+					code: "APPROVAL_REQUIRED",
+					reason: "the challenge did not match"
+				};
+				return {
+					...current,
+					challengeAttempts: attempts
+				};
+			}
+			return {
+				...current,
+				state: "approved",
+				approvedVia: via,
+				approvedAt: at.toISOString(),
+				usableUntil: new Date(at.getTime() + APPROVAL_LIFETIMES.approved).toISOString(),
+				approvedDigest: binding.digest,
+				challengeHash: void 0
+			};
+		});
+		const refused = failure;
+		if (refused !== null) throw refusedAfter(refusalFor(done.record)(refused.code, refused.reason, done.record), done);
+		return done.record;
+	}
+	/**
+	* Claims an approved disclosure once, persisting the exact `usedAt` that recovery must subsequently reuse.
+	* A specialised caller may impose a shorter deadline; it is evaluated while this record's transition lock is held,
+	* so a check made before waiting on that lock cannot accidentally consume the approval after it has expired.
+	*/
+	async claimForDisclosure(approvalId, liveBinding, options = {}) {
+		if (options.deadlineMs !== void 0 && (!Number.isSafeInteger(options.deadlineMs) || options.deadlineMs <= 0)) throw new CommsError("BAD_DATA", "the disclosure claim deadline is not a readable instant");
+		let failure = null;
+		const done = await this.#transition(approvalId, { kind: "disclosure" }, "claim", (current, outcome) => {
+			if (outcome.error) throw outcome.error;
+			const now = this.#now();
+			if (options.deadlineMs !== void 0 && now.getTime() >= options.deadlineMs) throw new CommsError("APPROVAL_VOID", "nothing was disclosed: the disclosure challenge expired before claim", { details: {
+				approvalId: current.approvalId,
+				state: current.state,
+				reason: "CHALLENGE_EXPIRED"
+			} });
+			const at = now.toISOString();
+			const binding = current.disclosure;
+			if (current.state === "pending") throw new CommsError("APPROVAL_PENDING", "nothing was disclosed: the standing disclosure approval is pending", { details: {
+				approvalId: current.approvalId,
+				state: current.state
+			} });
+			if (current.state !== "approved") throw new CommsError("APPROVAL_VOID", "nothing was disclosed: the standing disclosure approval was used already", { details: {
+				approvalId: current.approvalId,
+				state: current.state
+			} });
+			if (!sameDisclosureBinding(binding, liveBinding) || current.approvedDigest !== binding.digest) {
+				failure = {
+					code: "APPROVAL_VOID",
+					reason: "the disclosure binding changed after it was approved"
+				};
+				return {
+					...current,
+					state: "revoked",
+					reason: failure.reason,
+					revokedAt: at,
+					challengeHash: void 0
+				};
+			}
+			return {
+				...current,
+				state: "used",
+				usedAt: at
+			};
+		});
+		const refused = failure;
+		if (refused !== null) throw refusedAfter(refusalFor(done.record)(refused.code, refused.reason, done.record), done);
+		await this.#markClaimed(done);
+		return done.record;
+	}
 	/**
 	* A human approved through a confirm channel by typing the issued challenge. The draft must still be exactly what the
 	* record was prepared for; otherwise the record is voided, because the human would be approving content the record
@@ -7338,6 +7813,7 @@ var ApprovalStore = class {
 	* `createChange`), so a person's typed code means one thing whichever kind of approval it is typed for.
 	*/
 	async approve(approvalId, via, live, answer, kind = "send", _platform = process.platform, options = {}) {
+		if (kind === "disclosure") throw new CommsError("APPROVAL_REQUIRED", "nothing was disclosed: a standing disclosure approval is only accepted on the trusted terminal or app route");
 		let failure = null;
 		const done = await this.#transition(approvalId, { kind }, "approve", (current, outcome) => {
 			if (outcome.error) throw outcome.error;
@@ -8072,6 +8548,7 @@ function fail(reason, attribution = "verified") {
 function checkVerified(record, raw) {
 	if (raw.digestVersion !== 2) return fail("digest-version");
 	const kind = raw.kind;
+	if (kind === "disclosure") return checkDisclosure(record, raw);
 	if (kind !== "send" && kind !== "change" && kind !== "download") return fail("wrong-shape");
 	if (!STATES$1.includes(raw.state)) return fail("state-impossible");
 	const state = raw.state;
@@ -8095,6 +8572,59 @@ function checkVerified(record, raw) {
 	}
 	return checkTimestamps(raw, kind, state, times) ?? checkEvidence(record, raw, kind, state);
 }
+/** Validates the closed disclosure union member without borrowing a sender approval's shape. */
+function checkDisclosure(record, raw) {
+	if (![
+		"pending",
+		"approved",
+		"used",
+		"expired",
+		"revoked"
+	].includes(raw.state)) return fail("state-impossible");
+	const disclosure = record.disclosure;
+	if (disclosure === void 0) return fail("wrong-shape");
+	let binding;
+	try {
+		binding = canonicalDisclosureBinding(disclosure);
+	} catch {
+		return fail("wrong-shape");
+	}
+	if (raw.pendingMs !== APPROVAL_LIFETIMES.confirm || raw.approvedMs !== APPROVAL_LIFETIMES.approved) return fail("lifetime-mismatch");
+	const times = {};
+	for (const field of TIMESTAMPS) {
+		const at = timeOf(raw[field]);
+		if (at === "invalid") return fail("timestamp-invalid");
+		if (at !== null) times[field] = at;
+	}
+	const { createdAt, expiresAt, approvedAt, usableUntil, usedAt, revokedAt, expiredAt } = times;
+	if (createdAt === void 0 || expiresAt === void 0) return fail("timestamp-missing");
+	if (expiresAt - createdAt !== APPROVAL_LIFETIMES.confirm) return fail("lifetime-mismatch");
+	const state = raw.state;
+	const approved = approvedAt !== void 0 || usableUntil !== void 0;
+	if (approvedAt === void 0 !== (usableUntil === void 0)) return fail("timestamp-missing");
+	if (approvedAt !== void 0 && usableUntil !== void 0) {
+		if (!(createdAt <= approvedAt && approvedAt < expiresAt)) return fail("timestamp-misordered");
+		if (usableUntil - approvedAt !== APPROVAL_LIFETIMES.approved) return fail("lifetime-mismatch");
+	}
+	if (state === "approved" && !approved) return fail("timestamp-missing");
+	if (state === "used" && usedAt === void 0) return fail("timestamp-missing");
+	if (state !== "used" && usedAt !== void 0) return fail("timestamp-misplaced");
+	if (state === "revoked" && revokedAt === void 0) return fail("timestamp-missing");
+	if (state !== "revoked" && revokedAt !== void 0) return fail("timestamp-misplaced");
+	if (state === "expired" && expiredAt === void 0) return fail("timestamp-missing");
+	if (state !== "expired" && expiredAt !== void 0) return fail("timestamp-misplaced");
+	const deadline = usableUntil ?? expiresAt;
+	if (usedAt !== void 0 && !(approvedAt !== void 0 && approvedAt <= usedAt && usedAt < deadline)) return fail("timestamp-misordered");
+	if (revokedAt !== void 0 && !(createdAt <= revokedAt && revokedAt < deadline)) return fail("timestamp-misordered");
+	if (expiredAt !== void 0 && expiredAt < (approvedAt ?? createdAt)) return fail("timestamp-misordered");
+	if (raw.challengeAttempts !== 0 && raw.challengeAttempts !== 1 && raw.challengeAttempts !== 2 && raw.challengeAttempts !== 3) return fail("evidence-invalid");
+	const via = raw.approvedVia;
+	const digest = raw.approvedDigest;
+	if (!approved) {
+		if (via !== void 0 || digest !== void 0) return fail("evidence-contradictory");
+	} else if (via !== "terminal" && via !== "app" || digest !== binding.digest) return fail("evidence-contradictory");
+	return null;
+}
 /** The identity the binding covers is also consistent with itself: who it belongs to, and what it is about. */
 function checkIdentity(record, raw, kind) {
 	if (!isKnownChannel(raw.channel)) return fail("identity-contradiction");
@@ -8237,7 +8767,8 @@ const STATES = [
 const KINDS = [
 	"send",
 	"change",
-	"download"
+	"download",
+	"disclosure"
 ];
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const isString = (value) => typeof value === "string";
@@ -8294,6 +8825,59 @@ function commonShape(raw) {
 	}
 	return null;
 }
+/** The disclosure union member is deliberately closed: it cannot acquire a send-shaped field by optionality. */
+function disclosureShape(raw) {
+	for (const field of [
+		"approvalId",
+		"state",
+		"createdAt",
+		"expiresAt",
+		"updatedAt",
+		"bindingDigest"
+	]) if (!isString(raw[field])) return "wrong-shape";
+	for (const field of [
+		"pendingMs",
+		"approvedMs",
+		"challengeAttempts"
+	]) if (typeof raw[field] !== "number") return "wrong-shape";
+	for (const field of [
+		"approvedDigest",
+		"approvedVia",
+		"approvedAt",
+		"usableUntil",
+		"challengeHash",
+		"usedAt",
+		"revokedAt",
+		"expiredAt",
+		"reason"
+	]) if (!optional(raw[field], isString)) return "wrong-shape";
+	const disclosure = raw.disclosure;
+	if (!isObject(disclosure) || !isString(disclosure.digest) || !isString(disclosure.activationIntentId) || !isString(disclosure.activationKind) || !Array.isArray(disclosure.versions) || !disclosure.versions.every((entry) => isObject(entry) && isString(entry.kind) && isString(entry.id) && typeof entry.version === "number")) return "wrong-shape";
+	for (const field of [
+		"channel",
+		"ownerScope",
+		"route",
+		"inboxId",
+		"inboxSub",
+		"draftId",
+		"draftMessageId",
+		"expect",
+		"sendEpoch",
+		"policy",
+		"requiredPolicy",
+		"riskFlags",
+		"approvedBindingDigest",
+		"sendingAt",
+		"sendingHeartbeatAt",
+		"sentAt",
+		"sentMessageId",
+		"failedAt",
+		"change",
+		"download",
+		"contentDigest"
+	]) if (Object.hasOwn(raw, field)) return "wrong-shape";
+	return null;
+}
 /** The version-2 fields' types: a number where a number belongs, a string where a string does. */
 function v2Shape(raw) {
 	for (const field of [
@@ -8336,6 +8920,24 @@ function decodeStored(fileId, text, config, now) {
 	}
 	if (!isObject(raw)) return unreadable(fileId, "wrong-shape");
 	if (!isString(raw.approvalId)) return unreadable(fileId, "wrong-shape");
+	if (raw.kind === "disclosure") {
+		if (raw.digestVersion === 1) return unreadable(fileId, "wrong-shape");
+		const shape = disclosureShape(raw);
+		if (shape !== null) return unreadable(fileId, shape);
+		const record = raw;
+		const validation = validateV2(record, fileId);
+		if (validation.ok) return {
+			form: "v2",
+			record
+		};
+		return {
+			form: "corrupt",
+			approvalId: fileId,
+			reason: validation.reason,
+			attribution: validation.attribution,
+			safe: validation.attribution === "verified" ? safeFieldsOf(record) : null
+		};
+	}
 	const shape = commonShape(raw);
 	if (shape !== null) return unreadable(fileId, shape);
 	if (raw.digestVersion === 1) {
@@ -8367,6 +8969,7 @@ function decodeStored(fileId, text, config, now) {
 	};
 }
 function safeFieldsOf(record) {
+	if (record.kind === "disclosure") return { kind: "disclosure" };
 	return {
 		kind: record.kind,
 		channel: record.channel,
@@ -8394,9 +8997,9 @@ function asLegacy(stored) {
 function ownerOf(stored) {
 	if (stored === null) return null;
 	switch (stored.form) {
-		case "v2": return stored.record.inboxId;
+		case "v2": return stored.record.kind === "disclosure" ? null : stored.record.inboxId;
 		case "legacy": return stored.record.inboxId;
-		case "corrupt": return stored.safe?.inboxId ?? null;
+		case "corrupt": return stored.safe?.kind === "disclosure" ? null : stored.safe?.inboxId ?? null;
 		case "unreadable": return null;
 	}
 }
@@ -8418,9 +9021,9 @@ function kindOf(stored) {
 function channelOf(stored) {
 	if (stored === null) return null;
 	switch (stored.form) {
-		case "v2": return stored.record.channel;
+		case "v2": return stored.record.kind === "disclosure" ? null : stored.record.channel;
 		case "legacy": return stored.view.channel;
-		case "corrupt": return stored.safe?.channel ?? null;
+		case "corrupt": return stored.safe?.kind === "disclosure" ? null : stored.safe?.channel ?? null;
 		case "unreadable": return null;
 	}
 }
@@ -8569,7 +9172,7 @@ function verdictOf(stored, now) {
 		const providerId = record.kind === "send" && record.state === "used" && typeof record.sentMessageId === "string" ? record.sentMessageId : "";
 		return {
 			keep: false,
-			owner: record.inboxId,
+			owner: record.kind === "disclosure" ? "" : record.inboxId,
 			row: {
 				kind: record.kind,
 				state: record.state,
@@ -9040,7 +9643,7 @@ function folding(platform) {
 	return platform === "win32" ? (text) => text.toLowerCase() : (text) => text;
 }
 /** The package version, read from package.json at build time. */
-const VERSION = "0.15.1";
+const VERSION = "0.16.0";
 /**
 * Versions as semver writes and orders them — what an update compares, and what the daily update check's reader needs
 * to decide whether the release it last heard of is newer than the one running.
@@ -11726,7 +12329,7 @@ function serverPruneChange(core, env, request, own) {
 	};
 	const { packageName, version } = ownProduct(request.channel, own) ?? {
 		packageName: channelServer(request.channel).packageName,
-		version: "0.15.1"
+		version: "0.16.0"
 	};
 	const product = {
 		packageName,
@@ -13443,7 +14046,7 @@ function terminalUpdateHooks(core, env, options) {
 	};
 }
 //#endregion
-//#region ../core/dist/tool-arguments-jABbxaql.mjs
+//#region ../core/dist/tool-arguments-DA5ZqgoB.mjs
 const APPLIED = Symbol.for("agentcomms.strictToolArguments");
 const TARGET = "draft-2020-12";
 /**
@@ -23087,6 +23690,19 @@ const narrowingSchema = strictObject({
 	flag: string().regex(/^--[a-z][a-z-]*$/, "a long flag, `--like-this`"),
 	kind: _enum(["pin", "switch"])
 });
+const eventAccessSchema = discriminatedUnion("kind", [
+	strictObject({
+		kind: literal$1("oauth-user"),
+		requiredScopes: array(line).min(1)
+	}),
+	strictObject({ kind: literal$1("resend-full-access") }),
+	strictObject({ kind: literal$1("local-store") })
+]);
+const eventsSchema = strictObject({
+	types: array(line).min(1),
+	minimumIntervalMs: number().int().positive(),
+	access: eventAccessSchema
+});
 /**
 * The shapes Gmail and Slack had before there was a manifest, kept because their entries, tools and skills already
 * say them — and nobody else's.
@@ -23169,7 +23785,8 @@ strictObject({
 		prefix: string().regex(/^[a-z][a-z0-9]*-$/, "a word and a hyphen: `gmail-`"),
 		contract: line
 	}).optional(),
-	approvalGrouping: _enum(["draft", "draft-revision-digest"]).optional()
+	approvalGrouping: _enum(["draft", "draft-revision-digest"]).optional(),
+	events: eventsSchema.optional()
 }).superRefine((manifest, ctx) => {
 	const issue = (path, message) => ctx.addIssue({
 		code: "custom",
@@ -24808,13 +25425,11 @@ var Throttle = class {
 	* Counted per holder, a caller gives up only once one holder has kept the lock for five seconds: the stuck lock
 	* the timeout is there for.
 	*
-	* Each request takes the lock once, to reserve its slot, and does its waiting outside it, so the line is only the
-	* requests in flight. But the lock is polled, not queued: whoever looks first after a release takes it, and a
-	* request that keeps looking at the wrong moment watches later ones go ahead of it, for as long as later ones keep
-	* arriving — and several servers each paging through sent mail keep them arriving. So the wait also has an end
-	* that no hand-over moves, `LOCK_MAX_WAIT_MS`, and past it the request is refused as a busy lock rather than left
-	* hanging. `after` waits the same way, because a stop it gave up on recording is a 429 that every other account
-	* carries on into.
+	* An interactive request takes the lock once to reserve its slot and waits outside it. A background event read
+	* reserves nothing while it waits, so a person can always reserve the next free slot; it returns to the lock no
+	* more often than once per interval. The lock is polled, not queued, so its overall wait limit still ends a caller
+	* that keeps losing hand-overs to later callers. `after` waits the same way, because a stop it gave up on recording
+	* is a 429 that every other account carries on into.
 	*/
 	#lock;
 	/** Takes no account on purpose: see above. Every throttle on a state directory is the same one. */
@@ -24834,7 +25449,8 @@ var Throttle = class {
 			const parsed = JSON.parse(await readFile(this.path, "utf8"));
 			return {
 				next: Number.isFinite(parsed.next) ? Number(parsed.next) : 0,
-				blockedUntil: Number.isFinite(parsed.blockedUntil) ? Number(parsed.blockedUntil) : 0
+				blockedUntil: Number.isFinite(parsed.blockedUntil) ? Number(parsed.blockedUntil) : 0,
+				...Number.isFinite(parsed.lastBackgroundAt) ? { lastBackgroundAt: Number(parsed.lastBackgroundAt) } : {}
 			};
 		} catch (error) {
 			if (error.code === "ENOENT" || error instanceof SyntaxError) return {
@@ -24874,21 +25490,50 @@ var Throttle = class {
 	* still waiting when that one comes back 429, and the stop Resend asked for covers it as much as anything asked
 	* later.
 	*/
-	async before() {
-		const wait = await this.#locked(async () => {
-			const state = await this.#read();
-			this.#refuseIfHeld(state);
-			const now = this.#now();
-			const slot = Math.max(now, state.next);
-			await writeFileAtomic(this.path, JSON.stringify({
-				...state,
-				next: slot + this.#interval
-			}));
-			return slot - now;
-		});
-		if (wait > 0) {
-			await this.#sleep(wait);
-			this.#refuseIfHeld(await this.#read());
+	async before(priority = "interactive") {
+		if (priority === "interactive") {
+			const wait = await this.#locked(async () => {
+				const state = await this.#read();
+				this.#refuseIfHeld(state);
+				const now = this.#now();
+				const slot = Math.max(now, state.next);
+				await writeFileAtomic(this.path, JSON.stringify({
+					next: slot + this.#interval,
+					blockedUntil: state.blockedUntil,
+					...state.lastBackgroundAt === void 0 ? {} : { lastBackgroundAt: state.lastBackgroundAt }
+				}));
+				return slot - now;
+			});
+			if (wait > 0) {
+				await this.#sleep(wait);
+				this.#refuseIfHeld(await this.#read());
+			}
+			return;
+		}
+		for (;;) {
+			const decision = await this.#locked(async () => {
+				const state = await this.#read();
+				this.#refuseIfHeld(state);
+				const now = this.#now();
+				const backgroundWait = state.lastBackgroundAt === void 0 ? 0 : Math.max(0, state.lastBackgroundAt + 2 * this.#interval - now);
+				if (state.next <= now && backgroundWait === 0) {
+					await writeFileAtomic(this.path, JSON.stringify({
+						next: now + this.#interval,
+						blockedUntil: state.blockedUntil,
+						lastBackgroundAt: now
+					}));
+					return {
+						granted: true,
+						wait: 0
+					};
+				}
+				return {
+					granted: false,
+					wait: Math.max(state.next - now, backgroundWait, this.#interval)
+				};
+			});
+			if (decision.granted) return;
+			await this.#sleep(decision.wait);
 		}
 	}
 	/**
@@ -25244,7 +25889,7 @@ async function resendRequest(transport, method, path, options = {}) {
 	if (options.body !== void 0) headers["content-type"] = "application/json";
 	if (options.idempotencyKey !== void 0) headers["idempotency-key"] = options.idempotencyKey;
 	try {
-		await transport.throttle.before();
+		await transport.throttle.before(options.throttlePriority);
 	} catch (error) {
 		if (writing && error instanceof CommsError) throw new CommsError(error.code, error.message, {
 			...error.hint === void 0 ? {} : { hint: error.hint },
@@ -28045,4 +28690,4 @@ async function revokeSendApproval(context, approvalId) {
 	});
 }
 //#endregion
-export { exemptFromUpdateGate as $, CHANGE_POLICIES as A, RESEND_API_ORIGIN as At, UPDATE_CHECK_CHILD_COMMAND as B, policyChange as C, waitCallOptions as Ct, sendPolicyOf as D, PACKAGE_NAME as Dt, removeAccountChange as E, writeResult as Et, CHANNEL_SERVERS as F, canPrompt as G, approvalsOf as H, CommsError as I, cliHandoffs as J, changeToolResult as K, EXIT_CODES as L, SEND_POLICIES as M, ROUTES as Mt, checkNewName as N, VERSION$1 as Nt, showAccount as O, RESEND_CALLER as Ot, strictToolArguments as P, escapeForDisplay as Q, PATH_OPTIONS as R, policyApprovalRefusal as S, updateToolGate as St, policyWanted as T, wholeNumber as Tt, approveChangeAtTerminal as U, agentMarker as V, approveRefusedHint as W, commandPathOf as X, colorEnabled as Y, describeFenceReport as Z, runDoctor as _, serverPruneChange as _t, revokeSendApproval as a, kindOf as at, listAccounts as b, truncateDisplay as bt, downloadReceived as c, pathOverridesFromCliOptions as ct, listReceived as d, renderInstall as dt, gatedChange as et, listScheduled as f, renderPrune as ft, showSentEmail as g, serverInstallChange as gt, showReceived as h, runUpdateCheckChild as ht, prepareSend as i, installExitStatus as it, MODES as j, RESEND_DOWNLOAD_ORIGIN as jt, ResendContext as k, REFUSED as kt, getMetrics as l, refuseUnclaimedApproval as lt, listSuppressions as m, runCommand as mt, executeSend as n, handoffSentence as nt, sendStatus as o, openCore as ot, listSentEmails as p, resolvePaths as pt, checkForUpdates as q, finishSendApproval as r, handoffSentenceToFill as rt, cancelScheduledChange as s, paint as st, beginSendApproval as t, gatedChangeAtTerminal as tt, listDomains as u, renderApprovalWait as ut, addAccountChange as v, terminalUpdateHooks as vt, policyReport as w, waitForApproval as wt, modeOf as x, updateGateAtTerminal as xt, inspectKey as y, toCommsError as yt, SEND_LOOKUP as z };
+export { checkForUpdates as $, removeAccountChange as A, updateGateAtTerminal as At, strictToolArguments as B, RESEND_DOWNLOAD_ORIGIN as Bt, inspectKey as C, runUpdateCheckChild as Ct, policyChange as D, terminalUpdateHooks as Dt, policyApprovalRefusal as E, stripInvisible as Et, CHANGE_POLICIES as F, writeResult as Ft, SEND_LOOKUP as G, CommsError as H, VERSION$1 as Ht, MODES as I, PACKAGE_NAME as It, approvalsOf as J, UPDATE_CHECK_CHILD_COMMAND as K, SEND_POLICIES as L, RESEND_CALLER as Lt, showAccount as M, waitCallOptions as Mt, resendRequest as N, waitForApproval as Nt, policyReport as O, toCommsError as Ot, ResendContext as P, wholeNumber as Pt, changeToolResult as Q, checkNewName as R, REFUSED as Rt, addAccountChange as S, runCommand as St, modeOf as T, serverPruneChange as Tt, EXIT_CODES as U, CHANNEL_SERVERS as V, ROUTES as Vt, PATH_OPTIONS as W, approveRefusedHint as X, approveChangeAtTerminal as Y, canPrompt as Z, showSentEmail as _, refuseUnclaimedApproval as _t, revokeSendApproval as a, exemptFromUpdateGate as at, readBody as b, renderPrune as bt, downloadReceived as c, handoffSentence as ct, listReceived as d, kindOf as dt, cliHandoffs as et, listScheduled as f, neutralise as ft, showReceived as g, pathOverridesFromCliOptions as gt, resendId as h, paint as ht, prepareSend as i, escapeForDisplay as it, sendPolicyOf as j, updateToolGate as jt, policyWanted as k, truncateDisplay as kt, getMetrics as l, handoffSentenceToFill as lt, listSuppressions as m, openCore as mt, executeSend as n, commandPathOf as nt, sendStatus as o, gatedChange as ot, listSentEmails as p, newBoundary as pt, agentMarker as q, finishSendApproval as r, describeFenceReport as rt, cancelScheduledChange as s, gatedChangeAtTerminal as st, beginSendApproval as t, colorEnabled as tt, listDomains as u, installExitStatus as ut, addressesOf as v, renderApprovalWait as vt, listAccounts as w, serverInstallChange as wt, runDoctor as x, resolvePaths as xt, attachmentRisks as y, renderInstall as yt, keyPermissionOf as z, RESEND_API_ORIGIN as zt };