@agentcomms/whatsapp 0.15.2 → 0.16.0

package/dist/{sync-Ce-u-zuv.mjs → sync-Dx4QM1gQ.mjs}

@@ -1,4 +1,4 @@
-import { C as unknown, S as union, b as strictObject, c as boolean, h as number, i as _enum, m as looseObject, n as datetime, p as literal, s as array, x as string, y as record } from "./iso-USuVU_sk.mjs";
+import { C as unknown, S as union, b as strictObject, c as boolean, h as number, i as _enum, l as discriminatedUnion, m as looseObject, n as datetime, p as literal, s as array, x as string, y as record } from "./iso-USuVU_sk.mjs";
 import { access, chmod, constants, link, lstat, mkdir, open, readFile, readdir, readlink, realpath, rename, rm, stat, unlink, utimes } from "node:fs/promises";
 import path, { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { domainToASCII, fileURLToPath, pathToFileURL } from "node:url";
@@ -11,7 +11,7 @@ import { execFile, spawn } from "node:child_process";
 //#endregion
 //#region src/version.ts
 /** The package version, read from package.json at build time. */
-const VERSION$1 = "0.15.2";
+const VERSION$1 = "0.16.0";
 //#endregion
 //#region src/caller.ts
 /** This package's name, as its manifest has it. */
@@ -28,7 +28,7 @@ const CALLER = Object.freeze({
 	packageName: PACKAGE_NAME
 });
 //#endregion
-//#region ../core/dist/update-check-DbyonjY4.mjs
+//#region ../core/dist/update-check-23Ii90fQ.mjs
 /**
 * Every failure a user or an agent can act on carries a specific, stable code from this registry, a message, an
 * optional one-line hint and structured `details`. The code decides the process exit status; agents and skills branch
@@ -144,6 +144,11 @@ const ERROR_REGISTRY = {
 		retryable: true,
 		summary: "the mail provider is unavailable"
 	},
+	SOURCE_UNAVAILABLE: {
+		exit: EXIT_CODES.UNAVAILABLE,
+		retryable: false,
+		summary: "the selected local event source is unavailable"
+	},
 	SECRET_STORE_UNAVAILABLE: {
 		exit: EXIT_CODES.UNAVAILABLE,
 		retryable: false,
@@ -174,6 +179,11 @@ const ERROR_REGISTRY = {
 		retryable: false,
 		summary: "the inbox was not granted this permission"
 	},
+	WHATSAPP_VISIBILITY_SEAM_REQUIRED: {
+		exit: EXIT_CODES.CONFIG,
+		retryable: false,
+		summary: "the WhatsApp event visibility fence is unavailable"
+	},
 	CONFIG: {
 		exit: EXIT_CODES.CONFIG,
 		retryable: false,
@@ -662,12 +672,29 @@ function dedupeBy(items, key) {
 	}
 	return out;
 }
+const ORIGINS = ["event", "read"];
+function sortedOrigins(origins) {
+	const known = new Set(origins);
+	return ORIGINS.filter((origin) => known.has(origin));
+}
+function originEntry(entry) {
+	if (entry === void 0) return ["read"];
+	const known = Array.isArray(entry.origins) ? entry.origins.filter((origin) => origin === "event" || origin === "read") : [];
+	return known.length === 0 ? ["read"] : sortedOrigins(known);
+}
+function isNewer(at, than) {
+	const left = new Date(at).getTime();
+	const right = new Date(than).getTime();
+	return Number.isFinite(left) && Number.isFinite(right) && left > right;
+}
 var TaintStore = class {
 	directory;
 	#now;
-	constructor(stateDir, now = () => /* @__PURE__ */ new Date()) {
+	#hooks;
+	constructor(stateDir, now = () => /* @__PURE__ */ new Date(), hooks = {}) {
 		this.directory = join(stateDir, "taint");
 		this.#now = now;
+		this.#hooks = hooks;
 	}
 	get #path() {
 		return join(this.directory, "taint.json");
@@ -675,6 +702,9 @@ var TaintStore = class {
 	get #handlesPath() {
 		return join(this.directory, "handles.json");
 	}
+	get #originsPath() {
+		return join(this.directory, "origins.json");
+	}
 	async #readJson(path, empty) {
 		try {
 			const parsed = JSON.parse(await readFile(path, "utf8"));
@@ -700,6 +730,13 @@ var TaintStore = class {
 	async #readHandles() {
 		return this.#readJson(this.#handlesPath, () => ({ handles: {} }));
 	}
+	async #readOrigins() {
+		return this.#readJson(this.#originsPath, () => ({
+			addresses: {},
+			domains: {},
+			handles: {}
+		}));
+	}
 	#prune(file) {
 		const cutoff = this.#now().getTime() - TAINT_WINDOW_MS;
 		const keep = (map) => {
@@ -723,6 +760,35 @@ var TaintStore = class {
 			handles: Object.fromEntries(fresh.slice(0, MAX_ENTRIES))
 		};
 	}
+	#mergeOrigins(origins, addresses, domains, handles, touched, at) {
+		const merge = (sidecar, base, observed) => {
+			const merged = {};
+			for (const [key, entry] of Object.entries(sidecar)) {
+				const baseEntry = base[key];
+				if (baseEntry === void 0) continue;
+				const mergedOrigins = new Set(originEntry(entry));
+				if (isNewer(baseEntry.at, entry.at)) mergedOrigins.add("read");
+				merged[key] = {
+					at: isNewer(baseEntry.at, entry.at) ? baseEntry.at : entry.at,
+					origins: sortedOrigins(mergedOrigins)
+				};
+			}
+			for (const [key, observedOrigins] of observed) {
+				const existing = merged[key];
+				merged[key] = {
+					at,
+					origins: sortedOrigins([...existing?.origins ?? [], ...observedOrigins])
+				};
+			}
+			return merged;
+		};
+		return {
+			...origins,
+			addresses: merge(origins.addresses, addresses, touched.addresses),
+			domains: merge(origins.domains, domains, touched.domains),
+			handles: merge(origins.handles, handles, touched.handles)
+		};
+	}
 	/**
 	* Records observations. Throws if it cannot — callers must fail the read rather than return content whose taint
 	* was not recorded.
@@ -741,7 +807,17 @@ var TaintStore = class {
 		})).filter((o) => o.address.includes("@") && !own.has(o.address) && !internal.has(domainOf(o.address) ?? "")).sort((a, b) => a.source === b.source ? 0 : a.source === "header" ? -1 : 1), (o) => o.address).slice(0, MAX_PER_MESSAGE);
 		if (kept.length === 0 && keptHandles.length === 0) return;
 		const at = this.#now().toISOString();
-		const touch = (map, key, o) => {
+		const touched = {
+			addresses: /* @__PURE__ */ new Map(),
+			domains: /* @__PURE__ */ new Map(),
+			handles: /* @__PURE__ */ new Map()
+		};
+		const rememberOrigin = (map, key, origin) => {
+			const origins = touched[map].get(key) ?? /* @__PURE__ */ new Set();
+			origins.add(origin ?? "read");
+			touched[map].set(key, origins);
+		};
+		const touch = (map, key, o, originMap) => {
 			const existing = map[key];
 			const inboxIds = [.../* @__PURE__ */ new Set([...existing?.inboxIds ?? [], o.inboxId])];
 			const source = existing?.source === "header" ? "header" : o.source;
@@ -750,27 +826,38 @@ var TaintStore = class {
 				source,
 				inboxIds
 			};
+			rememberOrigin(originMap, key, o.origin);
 		};
-		if (kept.length > 0) {
-			const path = this.#path;
-			await withFileLock(`${path}.lock`, async () => {
-				const file = this.#prune(await this.#read());
-				for (const o of kept) {
-					touch(file.addresses, o.address, o);
-					const domain = domainOf(o.address);
-					if (domain && !PUBLIC_MAILBOX_DOMAINS.has(domain)) touch(file.domains, domain, o);
-				}
-				await writeFileAtomic(path, JSON.stringify(file));
-			});
-		}
-		if (keptHandles.length > 0) {
-			const path = this.#handlesPath;
-			await withFileLock(`${path}.lock`, async () => {
-				const file = this.#pruneHandles(await this.#readHandles());
-				for (const o of keptHandles) touch(file.handles, o.key, o);
-				await writeFileAtomic(path, JSON.stringify(file));
+		const commit = async () => {
+			const taint = this.#prune(await this.#read());
+			const handles = this.#pruneHandles(await this.#readHandles());
+			if (kept.length > 0) for (const o of kept) {
+				touch(taint.addresses, o.address, o, "addresses");
+				const domain = domainOf(o.address);
+				if (domain && !PUBLIC_MAILBOX_DOMAINS.has(domain)) touch(taint.domains, domain, o, "domains");
+			}
+			if (keptHandles.length > 0) for (const o of keptHandles) touch(handles.handles, o.key, o, "handles");
+			const finalTaint = this.#prune(taint);
+			const finalHandles = this.#pruneHandles(handles);
+			const origins = this.#mergeOrigins(await this.#readOrigins(), finalTaint.addresses, finalTaint.domains, finalHandles.handles, touched, at);
+			await writeFileAtomic(this.#originsPath, JSON.stringify(origins));
+			await this.#hooks.afterOriginsCommit?.();
+			if (kept.length > 0) await writeFileAtomic(this.#path, JSON.stringify(finalTaint));
+			if (keptHandles.length > 0) await writeFileAtomic(this.#handlesPath, JSON.stringify(finalHandles));
+		};
+		const withBaseLocks = async () => {
+			await withFileLock(`${this.#path}.lock`, async () => {
+				this.#hooks.onLockAcquired?.("taint");
+				await withFileLock(`${this.#handlesPath}.lock`, async () => {
+					this.#hooks.onLockAcquired?.("handles");
+					await commit();
+				});
 			});
-		}
+		};
+		await withFileLock(`${this.#originsPath}.lock`, async () => {
+			this.#hooks.onLockAcquired?.("origins");
+			await withBaseLocks();
+		});
 	}
 	/**
 	* Whether an address, or its (non-public) domain, was seen in email content in the window — from any inbox — and the
@@ -778,20 +865,22 @@ var TaintStore = class {
 	*/
 	async check(address) {
 		const file = this.#prune(await this.#read());
+		const origins = await this.#readOrigins();
 		const canonical = canonicalAddress(address);
 		const domain = domainOf(canonical);
 		const exact = Object.hasOwn(file.addresses, canonical) ? file.addresses[canonical] : void 0;
 		const byDomain = domain !== null && !PUBLIC_MAILBOX_DOMAINS.has(domain) && Object.hasOwn(file.domains, domain) ? file.domains[domain] : void 0;
-		const aggregate = (entry) => ({
+		const aggregate = (entry, origin) => ({
 			at: entry.at,
 			source: entry.source,
-			inboxIds: [...entry.inboxIds]
+			inboxIds: [...entry.inboxIds],
+			origins: sortedOrigins([...originEntry(origin), ...origin !== void 0 && isNewer(entry.at, origin.at) ? ["read"] : []])
 		});
 		return {
 			address: exact !== void 0,
 			domain: byDomain !== void 0,
-			...exact === void 0 ? {} : { addressSeen: aggregate(exact) },
-			...byDomain === void 0 ? {} : { domainSeen: aggregate(byDomain) }
+			...exact === void 0 ? {} : { addressSeen: aggregate(exact, origins.addresses[canonical]) },
+			...byDomain === void 0 ? {} : { domainSeen: aggregate(byDomain, origins.domains[domain ?? ""]) }
 		};
 	}
 	/**
@@ -804,6 +893,15 @@ var TaintStore = class {
 		const file = this.#pruneHandles(await this.#readHandles());
 		return canonicalHandle(handle) in file.handles;
 	}
+	/** The merged provenance of a retained handle, or no origins when it is not in the taint window. */
+	async checkHandleOrigins(handle) {
+		const file = this.#pruneHandles(await this.#readHandles());
+		const key = canonicalHandle(handle);
+		const entry = file.handles[key];
+		if (entry === void 0) return [];
+		const sidecar = (await this.#readOrigins()).handles[key];
+		return sortedOrigins([...originEntry(sidecar), ...sidecar !== void 0 && isNewer(entry.at, sidecar.at) ? ["read"] : []]);
+	}
 };
 /** Every first-party channel, the core first: what core knows about each without installing it. */
 const CHANNEL_SNAPSHOT = [
@@ -883,7 +981,19 @@ const CHANNEL_SNAPSHOT = [
 				prefix: "gmail-",
 				contract: "skills/_shared/contract-gmail.md"
 			},
-			approvalGrouping: "draft"
+			approvalGrouping: "draft",
+			events: {
+				types: [
+					"gmail.message.received",
+					"gmail.message.sent",
+					"gmail.message.labelled"
+				],
+				minimumIntervalMs: 6e4,
+				access: {
+					kind: "oauth-user",
+					requiredScopes: ["https://www.googleapis.com/auth/gmail.readonly"]
+				}
+			}
 		}
 	},
 	{
@@ -923,7 +1033,12 @@ const CHANNEL_SNAPSHOT = [
 				prefix: "resend-",
 				contract: "skills/_shared/contract-resend.md"
 			},
-			approvalGrouping: "draft"
+			approvalGrouping: "draft",
+			events: {
+				types: ["resend.email.received", "resend.email.status_changed"],
+				minimumIntervalMs: 6e4,
+				access: { kind: "resend-full-access" }
+			}
 		}
 	},
 	{
@@ -963,7 +1078,20 @@ const CHANNEL_SNAPSHOT = [
 				prefix: "slack-",
 				contract: "skills/_shared/contract-slack.md"
 			},
-			approvalGrouping: "draft-revision-digest"
+			approvalGrouping: "draft-revision-digest",
+			events: {
+				types: ["slack.message.posted"],
+				minimumIntervalMs: 6e4,
+				access: {
+					kind: "oauth-user",
+					requiredScopes: [
+						"channels:history",
+						"groups:history",
+						"im:history",
+						"mpim:history"
+					]
+				}
+			}
 		}
 	},
 	{
@@ -1002,10 +1130,76 @@ const CHANNEL_SNAPSHOT = [
 			skills: {
 				prefix: "whatsapp-",
 				contract: "skills/_shared/contract-whatsapp.md"
+			},
+			events: {
+				types: ["whatsapp.message.received"],
+				minimumIntervalMs: 6e4,
+				access: { kind: "local-store" }
 			}
 		}
 	}
 ];
+const DISCLOSURE_VERSION_KINDS = [
+	"rule",
+	"target",
+	"subscriber",
+	"judge",
+	"judge-budget",
+	"judge-kind"
+];
+const DISCLOSURE_ACTIVATION_KINDS = [
+	"rule",
+	"judge-budget",
+	"judge-kind",
+	"enable-all"
+];
+const HEX64$1 = /^[0-9a-f]{64}$/;
+function disclosureFailure() {
+	throw new CommsError("BAD_DATA", "a disclosure binding is not in its canonical activation shape");
+}
+function compareDisclosureVersions(left, right) {
+	const compareText = (one, two) => one < two ? -1 : one > two ? 1 : 0;
+	return compareText(left.kind, right.kind) || compareText(left.id, right.id) || left.version - right.version;
+}
+/**
+* Validates and copies a disclosure binding without reordering it. A caller must provide the
+* daemon-derived canonical list, already sorted by (kind, id, version), so a different document
+* cannot become authorised by a convenient normalisation here.
+*/
+function canonicalDisclosureBinding(binding) {
+	if (!HEX64$1.test(binding.digest) || typeof binding.activationIntentId !== "string" || binding.activationIntentId.length === 0 || !DISCLOSURE_ACTIVATION_KINDS.includes(binding.activationKind) || !Array.isArray(binding.versions)) return disclosureFailure();
+	const versions = binding.versions.map((entry) => {
+		if (!DISCLOSURE_VERSION_KINDS.includes(entry.kind) || typeof entry.id !== "string" || entry.id.length === 0 || !Number.isSafeInteger(entry.version) || entry.version < 1) return disclosureFailure();
+		return {
+			kind: entry.kind,
+			id: entry.id,
+			version: entry.version
+		};
+	});
+	for (let index = 1; index < versions.length; index += 1) if (compareDisclosureVersions(versions[index - 1], versions[index]) >= 0) return disclosureFailure();
+	const kinds = new Set(versions.map((entry) => entry.kind));
+	if (binding.activationKind === "rule") {
+		if (!kinds.has("rule") || kinds.has("judge-budget") || kinds.has("judge-kind")) return disclosureFailure();
+	} else if (binding.activationKind === "judge-budget") {
+		if (versions.length !== 1 || versions[0]?.kind !== "judge-budget") return disclosureFailure();
+	} else if (binding.activationKind === "judge-kind") {
+		if (versions.length !== 1 || versions[0]?.kind !== "judge-kind") return disclosureFailure();
+	} else if (versions.some((entry) => entry.kind !== "rule")) return disclosureFailure();
+	return {
+		digest: binding.digest,
+		activationIntentId: binding.activationIntentId,
+		activationKind: binding.activationKind,
+		versions
+	};
+}
+/** Exact canonical equality for each re-check at approval and claim. */
+function sameDisclosureBinding(left, right) {
+	try {
+		return canonicalJson$1(canonicalDisclosureBinding(left)) === canonicalJson$1(canonicalDisclosureBinding(right));
+	} catch {
+		return false;
+	}
+}
 /** The lifetime profile, in milliseconds: pending on each route, approved, and a download's question. */
 const APPROVAL_LIFETIMES = Object.freeze({
 	chat: 6e5,
@@ -1081,18 +1275,25 @@ function listedEntry(file) {
 * folders it offered, and the listing exactly as stored, left out when the record has none.
 */
 function bindingObjectOf(record) {
-	const identity = identityOf(record);
-	if (record.kind === "download") {
-		const download = record.download;
+	if (record.kind === "disclosure" && "disclosure" in record && record.disclosure !== void 0) return {
+		v: 2,
+		kind: "disclosure",
+		approvalId: record.approvalId,
+		disclosure: canonicalDisclosureBinding(record.disclosure)
+	};
+	const ordinary = record;
+	const identity = identityOf(ordinary);
+	if (ordinary.kind === "download") {
+		const download = ordinary.download;
 		if (download === void 0) throw new CommsError("BAD_DATA", "a download’s approval does not hold the question it was asked for");
 		return {
 			v: 2,
 			kind: "download",
-			contentDigest: record.contentDigest,
+			contentDigest: ordinary.contentDigest,
 			profile: {
-				pendingMs: record.pendingMs,
-				policy: record.policy,
-				requiredPolicy: record.requiredPolicy
+				pendingMs: ordinary.pendingMs,
+				policy: ordinary.policy,
+				requiredPolicy: ordinary.requiredPolicy
 			},
 			identity,
 			offered: {
@@ -1104,11 +1305,11 @@ function bindingObjectOf(record) {
 	}
 	return {
 		v: 2,
-		kind: record.kind,
-		contentDigest: record.contentDigest,
-		route: record.route,
-		pendingMs: record.pendingMs,
-		approvedMs: record.approvedMs,
+		kind: ordinary.kind,
+		contentDigest: ordinary.contentDigest,
+		route: ordinary.route,
+		pendingMs: ordinary.pendingMs,
+		approvedMs: ordinary.approvedMs,
 		identity
 	};
 }
@@ -5678,7 +5879,11 @@ const NO_CONFIGURATION = "this approval store was opened without a configuration
 const sentAtWords = (usedAt) => `sent at ${usedAt}`;
 /** The refusal prefix and detail key of each kind: a send sends nothing, a change changes nothing, a question saves nothing. */
 function refusalOf(kind) {
-	const [prefix, idKey, hint] = kind === "change" ? [
+	const [prefix, idKey, hint] = kind === "disclosure" ? [
+		"nothing was disclosed",
+		"approvalId",
+		"Prepare a new standing disclosure authorisation and show its exact activation preview to the person."
+	] : kind === "change" ? [
 		"nothing was changed",
 		"approvalId",
 		"Prepare the change again and show the new preview to the user."
@@ -5705,7 +5910,7 @@ function refusalOf(kind) {
 * or one a pinned surface may not see — byte for byte the same, with `approval: null`, and nothing of any record in it.
 */
 function approvalNotFound(approvalId, kind) {
-	return new CommsError("NOT_FOUND", `${kind === "change" ? "nothing was changed" : kind === "download" ? "nothing was saved" : "nothing was sent"}: no approval ${approvalId}`, {
+	return new CommsError("NOT_FOUND", `${kind === "disclosure" ? "nothing was disclosed" : kind === "change" ? "nothing was changed" : kind === "download" ? "nothing was saved" : "nothing was sent"}: no approval ${approvalId}`, {
 		hint: "Check the id: an approval is only found by the surface, the kind and the owner it was prepared for.",
 		details: { approval: null }
 	});
@@ -5737,6 +5942,24 @@ function objectOf(record, state, claimable, ownerRemoved, reason) {
 		...optional("expiredAt", record.expiredAt)
 	};
 }
+/** Standing disclosure has no channel owner, draft, policy or sender-controlled field to classify. */
+function disclosureObjectOf(record, claimable, reason) {
+	return {
+		id: record.approvalId,
+		kind: "disclosure",
+		channel: null,
+		state: record.state,
+		claimable,
+		...reason === void 0 ? {} : { reason },
+		createdAt: record.createdAt,
+		expiresAt: record.expiresAt,
+		...record.approvedAt === void 0 ? {} : { approvedAt: record.approvedAt },
+		...record.usableUntil === void 0 ? {} : { usableUntil: record.usableUntil },
+		...record.usedAt === void 0 ? {} : { usedAt: record.usedAt },
+		...record.revokedAt === void 0 ? {} : { revokedAt: record.revokedAt },
+		...record.expiredAt === void 0 ? {} : { expiredAt: record.expiredAt }
+	};
+}
 Object.freeze([
 	"expect.to",
 	"expect.cc",
@@ -5758,6 +5981,7 @@ function downloadExpiredWords(answered) {
 * nothing claimable. Pure: what decides is the store's locked classification, and this only says where it stands.
 */
 function approvalObjectOf(record, live, now) {
+	if (record.kind === "disclosure") return classifyDisclosure(record).approval;
 	return classifyV2(record, {
 		action: "inspect",
 		live,
@@ -5837,7 +6061,7 @@ function approvalOutcome(stored, context) {
 			approval: {
 				id,
 				kind: safe?.kind ?? null,
-				channel: safe?.channel ?? null,
+				channel: safe?.kind === "disclosure" ? null : safe?.channel ?? null,
 				state: "corrupt",
 				claimable: false,
 				reason
@@ -5848,6 +6072,7 @@ function approvalOutcome(stored, context) {
 	return classifyV2(stored.record, context);
 }
 function classifyV2(read, context) {
+	if (read.kind === "disclosure") return classifyDisclosure(read);
 	const { live, action } = context;
 	const at = context.now.toISOString();
 	const ownerRemoved = read.ownerScope === "owner" && live?.owner === "removed";
@@ -5896,12 +6121,42 @@ function classifyV2(read, context) {
 		...error === void 0 ? {} : { error }
 	};
 }
+/** The isolated disclosure state machine never follows a config policy or a channel-owner fence. */
+function classifyDisclosure(record) {
+	const claimable = record.state === "approved";
+	const approval = disclosureObjectOf(record, claimable, record.reason);
+	let error;
+	switch (record.state) {
+		case "pending":
+		case "approved": break;
+		case "used":
+			error = refusalOf("disclosure")("APPROVAL_VOID", `the standing disclosure approval was used already at ${record.usedAt}`, record, approval);
+			break;
+		case "expired":
+			error = refusalOf("disclosure")("APPROVAL_EXPIRED", "the standing disclosure approval expired unused", record, approval);
+			break;
+		case "revoked":
+			error = refusalOf("disclosure")("APPROVAL_VOID", `the standing disclosure approval was voided (${record.reason ?? "revoked"})`, record, approval);
+			break;
+		default: error = refusalOf("disclosure")("APPROVAL_VOID", "the standing disclosure approval is in an invalid state", record, approval);
+	}
+	return {
+		state: record.state,
+		claimable,
+		...record.reason === void 0 ? {} : { reason: record.reason },
+		record,
+		revokes: false,
+		approval,
+		...error === void 0 ? {} : { error }
+	};
+}
 /** Whether an active record can be claimed under `live` (D2, `claimable`). */
 function isClaimable(record, live) {
 	switch (record.kind) {
 		case "send": return record.state === "approved" || record.route === "chat" && live.sendPolicy === "chat";
 		case "change": return record.state === "approved" || record.route === "chat" && live.changePolicy === "chat";
 		case "download": return downloadClaimable(record, live.changePolicy);
+		case "disclosure": return record.state === "approved";
 	}
 }
 /**
@@ -5959,6 +6214,7 @@ function errorOf(record, approval, context) {
 			});
 		}
 		case "used":
+			if (record.kind === "disclosure") return refuse("APPROVAL_VOID", `the standing disclosure approval was used already at ${record.usedAt}`, record, approval);
 			if (download) return refuse("APPROVAL_VOID", "the question was answered already, and an answer is used once", record, approval);
 			if (record.kind === "change") return refuse("APPROVAL_VOID", `the approved change was already claimed at ${record.usedAt}`, record, approval);
 			return refuse("APPROVAL_VOID", `the approval was used already: it was ${context.usedSaid(String(record.usedAt))}, message id ${record.sentMessageId}`, record, approval, "Prepare a new send only for a new message.");
@@ -6169,10 +6425,24 @@ function refuseDownload(code, reason, record, hint) {
 		} : {}
 	});
 }
+/** The disclosure path has no send, draft or provider outcome: its refusal must never imply one. */
+function refuseDisclosure(code, reason, record, hint) {
+	return new CommsError(code, `nothing was disclosed: ${reason}`, {
+		hint: hint ?? "Prepare a new standing disclosure authorisation and show its exact activation preview to the person.",
+		details: record ? {
+			approvalId: record.approvalId,
+			state: record.state
+		} : {}
+	});
+}
 /** The refusal in the words of the record's own kind. */
 function refusalFor(record) {
-	const kind = approvalKind(record);
-	return kind === "change" ? refuseChange : kind === "download" ? refuseDownload : refuse;
+	switch (approvalKind(record)) {
+		case "send": return refuse;
+		case "change": return refuseChange;
+		case "download": return refuseDownload;
+		case "disclosure": return refuseDisclosure;
+	}
 }
 /**
 * The refusal of a record prepared under another digest version, in the words of its own kind: the one every locked
@@ -6189,23 +6459,40 @@ function otherVersionRefusal(record) {
 * nothing is sent by answering one. The record is as it was, and the hint says so.
 */
 function cancelledClaim(record) {
-	const kind = approvalKind(record);
-	if (kind === "download") return new CommsError("USAGE", "cancelled: nothing was saved", {
-		hint: "The question was not used: the same call, made again with the same answer, can still use it until it expires.",
-		details: {
-			choiceId: record.approvalId,
-			state: record.state,
-			reason: "cancelled"
-		}
-	});
-	return new CommsError("USAGE", `cancelled: ${kind === "change" ? "nothing was changed" : "nothing was sent"}`, {
-		hint: "The approval was not used: the same call, made again, can still use it until it expires.",
-		details: {
-			approvalId: record.approvalId,
-			state: record.state,
-			reason: "cancelled"
-		}
-	});
+	switch (approvalKind(record)) {
+		case "send": return new CommsError("USAGE", "cancelled: nothing was sent", {
+			hint: "The approval was not used: the same call, made again, can still use it until it expires.",
+			details: {
+				approvalId: record.approvalId,
+				state: record.state,
+				reason: "cancelled"
+			}
+		});
+		case "change": return new CommsError("USAGE", "cancelled: nothing was changed", {
+			hint: "The approval was not used: the same call, made again, can still use it until it expires.",
+			details: {
+				approvalId: record.approvalId,
+				state: record.state,
+				reason: "cancelled"
+			}
+		});
+		case "download": return new CommsError("USAGE", "cancelled: nothing was saved", {
+			hint: "The question was not used: the same call, made again with the same answer, can still use it until it expires.",
+			details: {
+				choiceId: record.approvalId,
+				state: record.state,
+				reason: "cancelled"
+			}
+		});
+		case "disclosure": return new CommsError("USAGE", "cancelled: nothing was disclosed", {
+			hint: "The standing disclosure approval was not used: it can still be completed until it expires.",
+			details: {
+				approvalId: record.approvalId,
+				state: record.state,
+				reason: "cancelled"
+			}
+		});
+	}
 }
 /** The refusal of a renewal or an outcome from a call that does not hold the send's claim. It names no token. */
 function notTheClaim(approvalId) {
@@ -6232,7 +6519,9 @@ function approvePendingHint(handoffs, approvalId, platform) {
 function matchesExpectation(found, expect) {
 	const kind = kindOf$1(found);
 	const owner = ownerOf(found);
-	if (kind === null || owner === null) return expect.owner === void 0;
+	if (kind === null) return expect.owner === void 0;
+	if (kind === "disclosure") return (expect.kind === void 0 || expect.kind === "disclosure") && expect.channel === void 0 && expect.owner === void 0;
+	if (owner === null) return expect.owner === void 0;
 	if (expect.kind !== void 0 && kind !== expect.kind) return false;
 	if (expect.channel !== void 0 && channelOf(found) !== expect.channel) return false;
 	return expect.owner === void 0 || owner === expect.owner;
@@ -6357,6 +6646,18 @@ var ApprovalStore = class {
 	* profile checked first, so nothing is written that names a channel this release does not know.
 	*/
 	#bound(record) {
+		if (record.kind === "disclosure") {
+			const disclosure = canonicalDisclosureBinding(record.disclosure);
+			return {
+				...record,
+				disclosure,
+				bindingDigest: bindingDigestOf({
+					approvalId: record.approvalId,
+					kind: "disclosure",
+					disclosure
+				})
+			};
+		}
 		requireKnownChannel(record.channel);
 		return {
 			...record,
@@ -6404,6 +6705,28 @@ var ApprovalStore = class {
 		await this.#write(record);
 		return record;
 	}
+	/** Creates only a pending standing disclosure approval from a daemon-derived canonical binding. */
+	async createDisclosure(binding) {
+		await this.ensurePruned();
+		const disclosure = canonicalDisclosureBinding(binding);
+		const now = this.#now();
+		const pendingMs = APPROVAL_LIFETIMES.confirm;
+		const record = this.#bound({
+			approvalId: newApprovalId(),
+			kind: "disclosure",
+			digestVersion: 2,
+			pendingMs,
+			approvedMs: APPROVAL_LIFETIMES.approved,
+			disclosure,
+			challengeAttempts: 0,
+			state: "pending",
+			createdAt: now.toISOString(),
+			expiresAt: new Date(now.getTime() + pendingMs).toISOString(),
+			updatedAt: now.toISOString()
+		});
+		await this.#write(record);
+		return record;
+	}
 	/**
 	* One approval, in whichever of its four forms it is (`StoredApproval`), read against one configuration snapshot —
 	* or null when there is none. Nothing is written.
@@ -6554,17 +6877,33 @@ var ApprovalStore = class {
 	* approval can be used as it is.
 	*/
 	#alreadyApproved(record, outcome) {
-		return new CommsError("USAGE", `${record.kind === "change" ? "nothing was changed" : "nothing was sent"}: it is approved already, and a person approves it once`, {
-			hint: "Nothing more is needed from the person: try the same call again with the same approval.",
-			details: {
-				approvalId: record.approvalId,
-				state: record.state,
-				approval: outcome.approval
-			}
-		});
+		const detail = {
+			approvalId: record.approvalId,
+			state: record.state,
+			approval: outcome.approval
+		};
+		switch (record.kind) {
+			case "send": return new CommsError("USAGE", "nothing was sent: it is approved already, and a person approves it once", {
+				hint: "Nothing more is needed from the person: try the same call again with the same approval.",
+				details: detail
+			});
+			case "change": return new CommsError("USAGE", "nothing was changed: it is approved already, and a person approves it once", {
+				hint: "Nothing more is needed from the person: try the same call again with the same approval.",
+				details: detail
+			});
+			case "download": return new CommsError("USAGE", "nothing was saved: it is approved already, and a person approves it once", {
+				hint: "Nothing more is needed from the person: try the same call again with the same approval.",
+				details: detail
+			});
+			case "disclosure": return new CommsError("USAGE", "nothing was disclosed: it is approved already, and a person approves it once", {
+				hint: "Nothing more is needed from the person: complete the same activation with the same approval.",
+				details: detail
+			});
+		}
 	}
 	/** Issues a new challenge to show a human; only its hash is kept. */
 	async issueChallenge(approvalId, kind = "send", _platform = process.platform, options = {}) {
+		if (kind === "disclosure") throw new CommsError("APPROVAL_REQUIRED", "nothing was disclosed: a standing disclosure challenge is only issued to the trusted terminal or app route");
 		const challenge = newChallenge();
 		await this.#transition(approvalId, { kind }, "approve", (current, outcome) => {
 			if (outcome.error) throw outcome.error;
@@ -6576,6 +6915,139 @@ var ApprovalStore = class {
 		}, { usedSaid: options.usedSaid });
 		return challenge;
 	}
+	/** Issues the typed challenge that a terminal or the trusted desktop app must answer for disclosure. */
+	async issueDisclosureChallenge(approvalId) {
+		const challenge = newChallenge();
+		await this.#transition(approvalId, { kind: "disclosure" }, "approve", (current, outcome) => {
+			if (outcome.error) throw outcome.error;
+			if (current.state !== "pending") throw this.#alreadyApproved(current, outcome);
+			return {
+				...current,
+				challengeHash: hashChallenge(challenge)
+			};
+		});
+		return challenge;
+	}
+	/**
+	* Approves one exact standing disclosure authority. MCP/chat forms are never an approval channel here: `app` means
+	* the desktop application's trusted typed-challenge bridge, not a client form.
+	*/
+	async approveDisclosure(approvalId, liveBinding, answer, via) {
+		let failure = null;
+		const done = await this.#transition(approvalId, { kind: "disclosure" }, "approve", (current, outcome) => {
+			if (outcome.error) throw outcome.error;
+			if (current.state !== "pending") throw this.#alreadyApproved(current, outcome);
+			if (via !== "terminal" && via !== "app") throw new CommsError("APPROVAL_REQUIRED", "nothing was disclosed: approval is only at the terminal or the trusted app", { details: {
+				approvalId: current.approvalId,
+				state: current.state
+			} });
+			if (!current.challengeHash) throw new CommsError("APPROVAL_REQUIRED", "nothing was disclosed: no challenge was issued for this approval", { details: {
+				approvalId: current.approvalId,
+				state: current.state
+			} });
+			const at = this.#now();
+			const binding = current.disclosure;
+			if (!sameDisclosureBinding(binding, liveBinding)) {
+				failure = {
+					code: "APPROVAL_VOID",
+					reason: "the disclosure binding changed after it was prepared"
+				};
+				return {
+					...current,
+					state: "revoked",
+					reason: failure.reason,
+					revokedAt: at.toISOString(),
+					challengeHash: void 0
+				};
+			}
+			if (!challengeMatches(answer, current.challengeHash)) {
+				const attempts = current.challengeAttempts + 1;
+				if (attempts >= 3) {
+					failure = {
+						code: "APPROVAL_VOID",
+						reason: "too many wrong answers to the challenge"
+					};
+					return {
+						...current,
+						challengeAttempts: attempts,
+						state: "revoked",
+						reason: failure.reason,
+						revokedAt: at.toISOString()
+					};
+				}
+				failure = {
+					code: "APPROVAL_REQUIRED",
+					reason: "the challenge did not match"
+				};
+				return {
+					...current,
+					challengeAttempts: attempts
+				};
+			}
+			return {
+				...current,
+				state: "approved",
+				approvedVia: via,
+				approvedAt: at.toISOString(),
+				usableUntil: new Date(at.getTime() + APPROVAL_LIFETIMES.approved).toISOString(),
+				approvedDigest: binding.digest,
+				challengeHash: void 0
+			};
+		});
+		const refused = failure;
+		if (refused !== null) throw refusedAfter(refusalFor(done.record)(refused.code, refused.reason, done.record), done);
+		return done.record;
+	}
+	/**
+	* Claims an approved disclosure once, persisting the exact `usedAt` that recovery must subsequently reuse.
+	* A specialised caller may impose a shorter deadline; it is evaluated while this record's transition lock is held,
+	* so a check made before waiting on that lock cannot accidentally consume the approval after it has expired.
+	*/
+	async claimForDisclosure(approvalId, liveBinding, options = {}) {
+		if (options.deadlineMs !== void 0 && (!Number.isSafeInteger(options.deadlineMs) || options.deadlineMs <= 0)) throw new CommsError("BAD_DATA", "the disclosure claim deadline is not a readable instant");
+		let failure = null;
+		const done = await this.#transition(approvalId, { kind: "disclosure" }, "claim", (current, outcome) => {
+			if (outcome.error) throw outcome.error;
+			const now = this.#now();
+			if (options.deadlineMs !== void 0 && now.getTime() >= options.deadlineMs) throw new CommsError("APPROVAL_VOID", "nothing was disclosed: the disclosure challenge expired before claim", { details: {
+				approvalId: current.approvalId,
+				state: current.state,
+				reason: "CHALLENGE_EXPIRED"
+			} });
+			const at = now.toISOString();
+			const binding = current.disclosure;
+			if (current.state === "pending") throw new CommsError("APPROVAL_PENDING", "nothing was disclosed: the standing disclosure approval is pending", { details: {
+				approvalId: current.approvalId,
+				state: current.state
+			} });
+			if (current.state !== "approved") throw new CommsError("APPROVAL_VOID", "nothing was disclosed: the standing disclosure approval was used already", { details: {
+				approvalId: current.approvalId,
+				state: current.state
+			} });
+			if (!sameDisclosureBinding(binding, liveBinding) || current.approvedDigest !== binding.digest) {
+				failure = {
+					code: "APPROVAL_VOID",
+					reason: "the disclosure binding changed after it was approved"
+				};
+				return {
+					...current,
+					state: "revoked",
+					reason: failure.reason,
+					revokedAt: at,
+					challengeHash: void 0
+				};
+			}
+			return {
+				...current,
+				state: "used",
+				usedAt: at
+			};
+		});
+		const refused = failure;
+		if (refused !== null) throw refusedAfter(refusalFor(done.record)(refused.code, refused.reason, done.record), done);
+		await this.#markClaimed(done);
+		return done.record;
+	}
 	/**
 	* A human approved through a confirm channel by typing the issued challenge. The draft must still be exactly what the
 	* record was prepared for; otherwise the record is voided, because the human would be approving content the record
@@ -6585,6 +7057,7 @@ var ApprovalStore = class {
 	* `createChange`), so a person's typed code means one thing whichever kind of approval it is typed for.
 	*/
 	async approve(approvalId, via, live, answer, kind = "send", _platform = process.platform, options = {}) {
+		if (kind === "disclosure") throw new CommsError("APPROVAL_REQUIRED", "nothing was disclosed: a standing disclosure approval is only accepted on the trusted terminal or app route");
 		let failure = null;
 		const done = await this.#transition(approvalId, { kind }, "approve", (current, outcome) => {
 			if (outcome.error) throw outcome.error;
@@ -7319,6 +7792,7 @@ function fail(reason, attribution = "verified") {
 function checkVerified(record, raw) {
 	if (raw.digestVersion !== 2) return fail("digest-version");
 	const kind = raw.kind;
+	if (kind === "disclosure") return checkDisclosure(record, raw);
 	if (kind !== "send" && kind !== "change" && kind !== "download") return fail("wrong-shape");
 	if (!STATES$1.includes(raw.state)) return fail("state-impossible");
 	const state = raw.state;
@@ -7342,6 +7816,59 @@ function checkVerified(record, raw) {
 	}
 	return checkTimestamps(raw, kind, state, times) ?? checkEvidence(record, raw, kind, state);
 }
+/** Validates the closed disclosure union member without borrowing a sender approval's shape. */
+function checkDisclosure(record, raw) {
+	if (![
+		"pending",
+		"approved",
+		"used",
+		"expired",
+		"revoked"
+	].includes(raw.state)) return fail("state-impossible");
+	const disclosure = record.disclosure;
+	if (disclosure === void 0) return fail("wrong-shape");
+	let binding;
+	try {
+		binding = canonicalDisclosureBinding(disclosure);
+	} catch {
+		return fail("wrong-shape");
+	}
+	if (raw.pendingMs !== APPROVAL_LIFETIMES.confirm || raw.approvedMs !== APPROVAL_LIFETIMES.approved) return fail("lifetime-mismatch");
+	const times = {};
+	for (const field of TIMESTAMPS) {
+		const at = timeOf(raw[field]);
+		if (at === "invalid") return fail("timestamp-invalid");
+		if (at !== null) times[field] = at;
+	}
+	const { createdAt, expiresAt, approvedAt, usableUntil, usedAt, revokedAt, expiredAt } = times;
+	if (createdAt === void 0 || expiresAt === void 0) return fail("timestamp-missing");
+	if (expiresAt - createdAt !== APPROVAL_LIFETIMES.confirm) return fail("lifetime-mismatch");
+	const state = raw.state;
+	const approved = approvedAt !== void 0 || usableUntil !== void 0;
+	if (approvedAt === void 0 !== (usableUntil === void 0)) return fail("timestamp-missing");
+	if (approvedAt !== void 0 && usableUntil !== void 0) {
+		if (!(createdAt <= approvedAt && approvedAt < expiresAt)) return fail("timestamp-misordered");
+		if (usableUntil - approvedAt !== APPROVAL_LIFETIMES.approved) return fail("lifetime-mismatch");
+	}
+	if (state === "approved" && !approved) return fail("timestamp-missing");
+	if (state === "used" && usedAt === void 0) return fail("timestamp-missing");
+	if (state !== "used" && usedAt !== void 0) return fail("timestamp-misplaced");
+	if (state === "revoked" && revokedAt === void 0) return fail("timestamp-missing");
+	if (state !== "revoked" && revokedAt !== void 0) return fail("timestamp-misplaced");
+	if (state === "expired" && expiredAt === void 0) return fail("timestamp-missing");
+	if (state !== "expired" && expiredAt !== void 0) return fail("timestamp-misplaced");
+	const deadline = usableUntil ?? expiresAt;
+	if (usedAt !== void 0 && !(approvedAt !== void 0 && approvedAt <= usedAt && usedAt < deadline)) return fail("timestamp-misordered");
+	if (revokedAt !== void 0 && !(createdAt <= revokedAt && revokedAt < deadline)) return fail("timestamp-misordered");
+	if (expiredAt !== void 0 && expiredAt < (approvedAt ?? createdAt)) return fail("timestamp-misordered");
+	if (raw.challengeAttempts !== 0 && raw.challengeAttempts !== 1 && raw.challengeAttempts !== 2 && raw.challengeAttempts !== 3) return fail("evidence-invalid");
+	const via = raw.approvedVia;
+	const digest = raw.approvedDigest;
+	if (!approved) {
+		if (via !== void 0 || digest !== void 0) return fail("evidence-contradictory");
+	} else if (via !== "terminal" && via !== "app" || digest !== binding.digest) return fail("evidence-contradictory");
+	return null;
+}
 /** The identity the binding covers is also consistent with itself: who it belongs to, and what it is about. */
 function checkIdentity(record, raw, kind) {
 	if (!isKnownChannel(raw.channel)) return fail("identity-contradiction");
@@ -7484,7 +8011,8 @@ const STATES = [
 const KINDS$1 = [
 	"send",
 	"change",
-	"download"
+	"download",
+	"disclosure"
 ];
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const isString = (value) => typeof value === "string";
@@ -7541,6 +8069,59 @@ function commonShape(raw) {
 	}
 	return null;
 }
+/** The disclosure union member is deliberately closed: it cannot acquire a send-shaped field by optionality. */
+function disclosureShape(raw) {
+	for (const field of [
+		"approvalId",
+		"state",
+		"createdAt",
+		"expiresAt",
+		"updatedAt",
+		"bindingDigest"
+	]) if (!isString(raw[field])) return "wrong-shape";
+	for (const field of [
+		"pendingMs",
+		"approvedMs",
+		"challengeAttempts"
+	]) if (typeof raw[field] !== "number") return "wrong-shape";
+	for (const field of [
+		"approvedDigest",
+		"approvedVia",
+		"approvedAt",
+		"usableUntil",
+		"challengeHash",
+		"usedAt",
+		"revokedAt",
+		"expiredAt",
+		"reason"
+	]) if (!optional(raw[field], isString)) return "wrong-shape";
+	const disclosure = raw.disclosure;
+	if (!isObject(disclosure) || !isString(disclosure.digest) || !isString(disclosure.activationIntentId) || !isString(disclosure.activationKind) || !Array.isArray(disclosure.versions) || !disclosure.versions.every((entry) => isObject(entry) && isString(entry.kind) && isString(entry.id) && typeof entry.version === "number")) return "wrong-shape";
+	for (const field of [
+		"channel",
+		"ownerScope",
+		"route",
+		"inboxId",
+		"inboxSub",
+		"draftId",
+		"draftMessageId",
+		"expect",
+		"sendEpoch",
+		"policy",
+		"requiredPolicy",
+		"riskFlags",
+		"approvedBindingDigest",
+		"sendingAt",
+		"sendingHeartbeatAt",
+		"sentAt",
+		"sentMessageId",
+		"failedAt",
+		"change",
+		"download",
+		"contentDigest"
+	]) if (Object.hasOwn(raw, field)) return "wrong-shape";
+	return null;
+}
 /** The version-2 fields' types: a number where a number belongs, a string where a string does. */
 function v2Shape(raw) {
 	for (const field of [
@@ -7583,6 +8164,24 @@ function decodeStored(fileId, text, config, now) {
 	}
 	if (!isObject(raw)) return unreadable(fileId, "wrong-shape");
 	if (!isString(raw.approvalId)) return unreadable(fileId, "wrong-shape");
+	if (raw.kind === "disclosure") {
+		if (raw.digestVersion === 1) return unreadable(fileId, "wrong-shape");
+		const shape = disclosureShape(raw);
+		if (shape !== null) return unreadable(fileId, shape);
+		const record = raw;
+		const validation = validateV2(record, fileId);
+		if (validation.ok) return {
+			form: "v2",
+			record
+		};
+		return {
+			form: "corrupt",
+			approvalId: fileId,
+			reason: validation.reason,
+			attribution: validation.attribution,
+			safe: validation.attribution === "verified" ? safeFieldsOf(record) : null
+		};
+	}
 	const shape = commonShape(raw);
 	if (shape !== null) return unreadable(fileId, shape);
 	if (raw.digestVersion === 1) {
@@ -7614,6 +8213,7 @@ function decodeStored(fileId, text, config, now) {
 	};
 }
 function safeFieldsOf(record) {
+	if (record.kind === "disclosure") return { kind: "disclosure" };
 	return {
 		kind: record.kind,
 		channel: record.channel,
@@ -7641,9 +8241,9 @@ function asLegacy(stored) {
 function ownerOf(stored) {
 	if (stored === null) return null;
 	switch (stored.form) {
-		case "v2": return stored.record.inboxId;
+		case "v2": return stored.record.kind === "disclosure" ? null : stored.record.inboxId;
 		case "legacy": return stored.record.inboxId;
-		case "corrupt": return stored.safe?.inboxId ?? null;
+		case "corrupt": return stored.safe?.kind === "disclosure" ? null : stored.safe?.inboxId ?? null;
 		case "unreadable": return null;
 	}
 }
@@ -7665,9 +8265,9 @@ function kindOf$1(stored) {
 function channelOf(stored) {
 	if (stored === null) return null;
 	switch (stored.form) {
-		case "v2": return stored.record.channel;
+		case "v2": return stored.record.kind === "disclosure" ? null : stored.record.channel;
 		case "legacy": return stored.view.channel;
-		case "corrupt": return stored.safe?.channel ?? null;
+		case "corrupt": return stored.safe?.kind === "disclosure" ? null : stored.safe?.channel ?? null;
 		case "unreadable": return null;
 	}
 }
@@ -7816,7 +8416,7 @@ function verdictOf(stored, now) {
 		const providerId = record.kind === "send" && record.state === "used" && typeof record.sentMessageId === "string" ? record.sentMessageId : "";
 		return {
 			keep: false,
-			owner: record.inboxId,
+			owner: record.kind === "disclosure" ? "" : record.inboxId,
 			row: {
 				kind: record.kind,
 				state: record.state,
@@ -8262,7 +8862,7 @@ function folding(platform) {
 	return platform === "win32" ? (text) => text.toLowerCase() : (text) => text;
 }
 /** The package version, read from package.json at build time. */
-const VERSION = "0.15.2";
+const VERSION = "0.16.0";
 /**
 * Versions as semver writes and orders them — what an update compares, and what the daily update check's reader needs
 * to decide whether the release it last heard of is newer than the one running.
@@ -10534,7 +11134,7 @@ function serverPruneChange(core, env, request, own) {
 	};
 	const { packageName, version } = ownProduct(request.channel, own) ?? {
 		packageName: channelServer(request.channel).packageName,
-		version: "0.15.2"
+		version: "0.16.0"
 	};
 	const product = {
 		packageName,
@@ -11188,7 +11788,7 @@ async function askLine(streams, question) {
 }
 channelServer("core").packageName;
 //#endregion
-//#region ../core/dist/tool-arguments-g84XDkWq.mjs
+//#region ../core/dist/tool-arguments-DA5ZqgoB.mjs
 const APPLIED = Symbol.for("agentcomms.strictToolArguments");
 const TARGET = "draft-2020-12";
 /**
@@ -12076,6 +12676,19 @@ const narrowingSchema = strictObject({
 	flag: string().regex(/^--[a-z][a-z-]*$/, "a long flag, `--like-this`"),
 	kind: _enum(["pin", "switch"])
 });
+const eventAccessSchema = discriminatedUnion("kind", [
+	strictObject({
+		kind: literal("oauth-user"),
+		requiredScopes: array(line).min(1)
+	}),
+	strictObject({ kind: literal("resend-full-access") }),
+	strictObject({ kind: literal("local-store") })
+]);
+const eventsSchema = strictObject({
+	types: array(line).min(1),
+	minimumIntervalMs: number().int().positive(),
+	access: eventAccessSchema
+});
 /**
 * The shapes Gmail and Slack had before there was a manifest, kept because their entries, tools and skills already
 * say them — and nobody else's.
@@ -12158,7 +12771,8 @@ strictObject({
 		prefix: string().regex(/^[a-z][a-z0-9]*-$/, "a word and a hyphen: `gmail-`"),
 		contract: line
 	}).optional(),
-	approvalGrouping: _enum(["draft", "draft-revision-digest"]).optional()
+	approvalGrouping: _enum(["draft", "draft-revision-digest"]).optional(),
+	events: eventsSchema.optional()
 }).superRefine((manifest, ctx) => {
 	const issue = (path, message) => ctx.addIssue({
 		code: "custom",
@@ -13437,6 +14051,25 @@ var ChatListStore = class {
 	async of(accountId) {
 		return entryOf(await this.#load(), accountId);
 	}
+	/**
+	* Reads the live list while holding the same inter-process gate as allow/deny/clear.  Event consumers get the
+	* parsed policy and its canonical digest, never a second mutable copy of the list file.
+	*/
+	async withCurrent(accountId, work) {
+		return withFileLock(this.#lockPath, async () => {
+			const file = await this.#load();
+			const lists = entryOf(file, accountId);
+			const digest = createHash("sha256").update(canonicalJson$1({
+				allow: [...lists.allow],
+				deny: [...lists.deny]
+			}), "utf8").digest("hex");
+			return work({
+				version: file.version,
+				lists,
+				digest
+			});
+		});
+	}
 	/** Changes one account's lists under the file's lock; an account left with neither list has no entry. */
 	async update(accountId, change) {
 		return withFileLock(this.#lockPath, async () => {
@@ -13838,6 +14471,31 @@ function listKey(jid) {
 	const person = /^(\d{7,15})@(?:s\.whatsapp\.net|status)$/.exec(id);
 	return person ? `+${person[1]}` : id;
 }
+/**
+* The one visibility unit a raw row belongs to.  The daemon persists this key, but only this channel defines the
+* vocabulary: an ordinary chat is its list key; a status post is the pair of its status chat and its author (or no
+* author), because the lists can hide either one — denying the status feed hides every author in it.
+*/
+function visibilityUnitKey(chatId, chatKind, senderJid) {
+	if (chatKind !== "status") return listKey(chatId);
+	const author = statusAuthor(chatId, senderJid);
+	return JSON.stringify([
+		STATUS_UNIT,
+		listKey(chatId),
+		author === null ? null : listKey(author)
+	]);
+}
+const STATUS_UNIT = "status-unit";
+function statusUnit(unitKey) {
+	if (!unitKey.startsWith(`["${STATUS_UNIT}",`)) return void 0;
+	try {
+		const parsed = JSON.parse(unitKey);
+		if (Array.isArray(parsed) && parsed.length === 3 && parsed[0] === STATUS_UNIT && typeof parsed[1] === "string" && (parsed[2] === null || typeof parsed[2] === "string")) return {
+			chat: parsed[1],
+			author: parsed[2]
+		};
+	} catch {}
+}
 var Visibility = class {
 	#allow;
 	#deny;
@@ -13861,6 +14519,14 @@ var Visibility = class {
 		const author = statusAuthor(chatId, senderJid);
 		return author === null ? !this.#hidesAnyone() : this.seesChat(author);
 	}
+	/** Whether a durable source unit remains visible under these same lists. */
+	seesUnit(unitKey) {
+		const status = statusUnit(unitKey);
+		if (unitKey.startsWith(`["${STATUS_UNIT}",`) && status === void 0) return false;
+		if (status === void 0) return this.seesChat(unitKey);
+		if (!this.seesChat(status.chat)) return false;
+		return status.author === null ? !this.#hidesAnyone() : this.seesChat(status.author);
+	}
 	/** A status post someone else wrote with no author the lists can be checked against: hidden while they hide anyone. */
 	unattributed(chatId, chatKind, senderJid, fromMe) {
 		return chatKind === "status" && !fromMe && statusAuthor(chatId, senderJid) === null;
@@ -14688,29 +15354,24 @@ function sameLists(a, b) {
 	return JSON.stringify([a.allow, a.deny]) === JSON.stringify([b.allow, b.deny]);
 }
 /**
-* Held against a person's commands that land while it runs:
-*
-* - **`remove`** holds the same lock (`WhatsAppContext.syncLock`), so it waits for a running sync and then deletes
-*   everything, the new index with it; and a sync that waited behind a remove looks its account up again once it
-*   holds the lock, finds it gone, and writes nothing.
-* - **`allow`, `deny`, `clear`**: the lists are read again just before the new index replaces the old. If they
-*   changed while it was built, it is built again, from the same copy, with the lists as they are now — so what a
-*   deny hides is never written, not merely filtered out when read.
+* Owns the source-copy lifecycle shared by normal sync and the local event reader.  Callers can use values from the
+* copy only inside `work`; the copy is always closed and removed afterwards.
 */
-async function syncAccount(context, request) {
-	const { name, account } = await context.account(request.account);
+async function withCheckedCopy(context, request, work) {
+	const resolved = request.accountId === void 0 ? await context.account(request.account) : await context.accountById(request.accountId);
+	if (resolved === null) throw new CommsError("NOT_FOUND", "the WhatsApp account was removed before its store was read");
+	const { name, account } = resolved;
 	const store = context.storeOf(account);
 	const directory = context.accountDir(account);
 	return withFileLock(context.syncLock(account), async () => {
-		let current = await context.accountById(account.id);
-		if (!current) throw removedWhileSyncing(context, name, account);
+		if (!await context.accountById(account.id)) throw removedWhileSyncing(context, name, account);
 		await ensurePrivateDir(directory);
 		const staleRemoved = await removeStaleSnapshots(directory);
 		const snapshot = await snapshotStore(store.path, directory, context.sourceOptions(store.isDefault));
 		try {
-			const db = await openDatabase(snapshot.database);
+			const database = await openDatabase(snapshot.database);
 			try {
-				const check = db.prepare("PRAGMA quick_check").get();
+				const check = database.prepare("PRAGMA quick_check").get();
 				const verdict = check ? String(Object.values(check)[0]) : "no answer";
 				if (verdict !== "ok") throw new CommsError("TRANSIENT", "the copy of WhatsApp’s message store did not pass SQLite’s check", {
 					hint: "Nothing was indexed. Try again; if it keeps failing, quit WhatsApp for a moment and sync.",
@@ -14719,38 +15380,18 @@ async function syncAccount(context, request) {
 						verdict
 					}
 				});
-				const report = inspectSchema(db);
-				for (let round = 1;; round++) {
-					const built = current;
-					const stats = await rebuildIndex(directory, db, report, {
-						indexedAt: context.now().toISOString(),
-						copied: snapshot.copied
-					}, new Visibility(built.lists), async () => {
-						const now = await context.accountById(account.id);
-						if (!now) throw removedWhileSyncing(context, built.name, account);
-						current = now;
-						return sameLists(now.lists, built.lists);
-					});
-					if (stats) return {
-						account: built.name,
-						store: {
-							path: store.path,
-							default: store.isDefault
-						},
-						...stats,
-						snapshot: {
-							attempts: snapshot.attempts,
-							deleted: true,
-							staleRemoved
-						}
-					};
-					if (round === LIST_ROUNDS) throw new CommsError("TRANSIENT", "the chat lists kept changing while the index was built", {
-						hint: "The previous index is kept as it was. Run the sync again.",
-						details: { reason: "LISTS_CHANGED" }
-					});
-				}
+				return await work({
+					accountName: name,
+					account,
+					directory,
+					database,
+					report: inspectSchema(database),
+					snapshot,
+					staleRemoved,
+					store
+				});
 			} finally {
-				db.close();
+				database.close();
 			}
 		} finally {
 			await snapshot.dispose();
@@ -14760,5 +15401,50 @@ async function syncAccount(context, request) {
 		renewMs: 5e3
 	});
 }
+/**
+* Held against a person's commands that land while it runs:
+*
+* - **`remove`** holds the same lock (`WhatsAppContext.syncLock`), so it waits for a running sync and then deletes
+*   everything, the new index with it; and a sync that waited behind a remove looks its account up again once it
+*   holds the lock, finds it gone, and writes nothing.
+* - **`allow`, `deny`, `clear`**: the lists are read again just before the new index replaces the old. If they
+*   changed while it was built, it is built again, from the same copy, with the lists as they are now — so what a
+*   deny hides is never written, not merely filtered out when read.
+*/
+async function syncAccount(context, request) {
+	return withCheckedCopy(context, request, async (copy) => {
+		let current = await context.accountById(copy.account.id);
+		if (!current) throw removedWhileSyncing(context, copy.accountName, copy.account);
+		for (let round = 1;; round++) {
+			const built = current;
+			const stats = await rebuildIndex(copy.directory, copy.database, copy.report, {
+				indexedAt: context.now().toISOString(),
+				copied: copy.snapshot.copied
+			}, new Visibility(built.lists), async () => {
+				const now = await context.accountById(copy.account.id);
+				if (!now) throw removedWhileSyncing(context, built.name, copy.account);
+				current = now;
+				return sameLists(now.lists, built.lists);
+			});
+			if (stats) return {
+				account: built.name,
+				store: {
+					path: copy.store.path,
+					default: copy.store.isDefault
+				},
+				...stats,
+				snapshot: {
+					attempts: copy.snapshot.attempts,
+					deleted: true,
+					staleRemoved: copy.staleRemoved
+				}
+			};
+			if (round === LIST_ROUNDS) throw new CommsError("TRANSIENT", "the chat lists kept changing while the index was built", {
+				hint: "The previous index is kept as it was. Run the sync again.",
+				details: { reason: "LISTS_CHANGED" }
+			});
+		}
+	});
+}
 //#endregion
-export { paint as $, PATH_OPTIONS as A, colorEnabled as B, checkStorePath as C, CHANNEL_SERVERS as D, strictToolArguments as E, approveAndWaitSentence as F, handoffSentence as G, escapeForDisplay as H, approveChangeAtTerminal as I, isCommsError as J, handoffText as K, canPrompt as L, absoluteSearchPath as M, agentMarker as N, CommsError as O, approvalsOf as P, openCore as Q, childEnvironment as R, storeIdentity as S, expandSource as T, exemptFromUpdateGate as U, commandPathOf as V, gatedChangeAtTerminal as W, nameAvailable as X, lookupName as Y, nameShapeProblem as Z, chatRefOf as _, listChats as a, serverInstallChange as at, requireAccount as b, Presenter as c, truncateDisplay as ct, draftMessage as d, windowsSystemProgram as dt, pathOverridesFromCliOptions as et, Visibility as f, withFileLock as ft, requireSupportedNode as g, VERSION$1 as gt, WhatsAppIndex as h, PACKAGE_NAME as ht, CHAT_KINDS as i, runCommand as it, UNTRUSTED_NOTICE as j, EXIT_CODES as k, innerText as l, updateGateAtTerminal as lt, WhatsAppContext as m, CALLER as mt, whatsappStatus as n, renderPrune as nt, readChat as o, serverPruneChange as ot, listKey as p, writeResult as pt, installExitStatus as q, probeStore as r, resolvePaths as rt, searchMessages as s, toCommsError as st, syncAccount as t, renderInstall as tt, composeDraft as u, updateToolGate as ut, PLATFORM as v, defaultStorePath as w, requireNamedConfig as x, newWhatsAppAccount as y, cliHandoffs as z };
+export { exemptFromUpdateGate as $, requireAccount as A, PATH_OPTIONS as B, chatKindOf as C, writeResult as Ct, text as D, numeric as E, VERSION$1 as Et, expandSource as F, approveAndWaitSentence as G, absoluteSearchPath as H, strictToolArguments as I, childEnvironment as J, approveChangeAtTerminal as K, CHANNEL_SERVERS as L, storeIdentity as M, checkStorePath as N, PLATFORM as O, defaultStorePath as P, escapeForDisplay as Q, CommsError as R, chatRefOf as S, withFileLock as St, kindOf as T, PACKAGE_NAME as Tt, agentMarker as U, UNTRUSTED_NOTICE as V, approvalsOf as W, colorEnabled as X, cliHandoffs as Y, commandPathOf as Z, WhatsAppContext as _, toCommsError as _t, CHAT_KINDS as a, lookupName as at, requireSupportedNode as b, updateToolGate as bt, searchMessages as c, openCore as ct, composeDraft as d, renderInstall as dt, gatedChangeAtTerminal as et, draftMessage as f, renderPrune as ft, visibilityUnitKey as g, serverPruneChange as gt, statusAuthor as h, serverInstallChange as ht, probeStore as i, isCommsError as it, requireNamedConfig as j, newWhatsAppAccount as k, Presenter as l, paint as lt, listKey as m, runCommand as mt, withCheckedCopy as n, handoffText as nt, listChats as o, nameAvailable as ot, Visibility as p, resolvePaths as pt, canPrompt as q, whatsappStatus as r, installExitStatus as rt, readChat as s, nameShapeProblem as st, syncAccount as t, handoffSentence as tt, innerText as u, pathOverridesFromCliOptions as ut, WhatsAppIndex as v, truncateDisplay as vt, coreDataToIso as w, CALLER as wt, inspectSchema as x, windowsSystemProgram as xt, rebuildIndex as y, updateGateAtTerminal as yt, EXIT_CODES as z };