@joe-broadhead/messaging-bin-win32-x64 0.8.0 → 0.9.0

package/lib/messagingd.mjs

@@ -6376,7 +6376,8 @@ var init_common = __esm(() => {
   URI = {
     binding: "urn:messaging:binding:relay:v1",
     provenance: "urn:messaging:ext:provenance:v1",
-    presence: "urn:messaging:ext:presence:v1"
+    presence: "urn:messaging:ext:presence:v1",
+    signIn: "urn:messaging:ext:sign-in:v1"
   };
   Base64Url = string2().regex(/^[A-Za-z0-9_-]*$/, "base64url without padding");
   Key32 = string2().regex(/^[A-Za-z0-9_-]{43}$/, "32 bytes, base64url without padding");
@@ -6550,6 +6551,7 @@ var init_errors3 = __esm(() => {
     "jelly_unavailable",
     "log_conflict",
     "conv_conflict",
+    "conflict",
     "stale_epoch",
     "device_limit",
     "admission_required",
@@ -6803,7 +6805,7 @@ var init_directory = __esm(() => {
 });
 
 // packages/core/dist/schema/a2a.js
-var Struct, TaskState, TERMINAL_STATES, Role, Part, Message, TaskStatus, Artifact, Task, TaskStatusUpdateEvent, TaskArtifactUpdateEvent;
+var Struct, TaskState, TERMINAL_STATES, INTERRUPTED_STATES, Role, Part, Message, TaskStatus, Artifact, Task, TaskStatusUpdateEvent, TaskArtifactUpdateEvent;
 var init_a2a = __esm(() => {
   init_zod();
   Struct = record(string2(), unknown());
@@ -6823,6 +6825,7 @@ var init_a2a = __esm(() => {
     "TASK_STATE_CANCELED",
     "TASK_STATE_REJECTED"
   ];
+  INTERRUPTED_STATES = ["TASK_STATE_INPUT_REQUIRED", "TASK_STATE_AUTH_REQUIRED"];
   Role = _enum(["ROLE_USER", "ROLE_AGENT"]);
   Part = object({
     text: string2().optional(),
@@ -7173,6 +7176,16 @@ function grantProblem(grant) {
   if ("conv" in grant.subject && (grant.chat !== undefined || grant.trustedUntil !== undefined || grant.discoverable !== undefined)) {
     return "a conversation grant sets only ask and agentMail";
   }
+  if ("relation" in grant.subject) {
+    if (grant.agentMail !== undefined || grant.trustedUntil !== undefined || grant.discoverable !== undefined)
+      return "a relation grant sets only chat or ask";
+    if (grant.subject.relation === "outside" && grant.ask !== undefined)
+      return "the outside relation grant sets only chat";
+    if (grant.subject.relation === "outside" && grant.chat === "muted")
+      return "the outside relation grant sets chat open or blocked";
+    if (grant.subject.relation === "org" && grant.chat !== undefined)
+      return "the org relation grant sets only ask";
+  }
   if (own && (grant.chat !== undefined || grant.agentMail !== undefined || grant.ask !== undefined || grant.trustedUntil !== undefined)) {
     return "a grant about its own person sets only discoverable";
   }
@@ -7195,7 +7208,7 @@ function cardProblem(card) {
     return "trustedUntil needs ask open";
   return;
 }
-var ChatLevel, AgentMailLevel, AskLevel, GrantSubject, ConsentGrant, GRANTS_PER_SYNC = 100, GrantSync, CardCan, ContactCard, CardData, CardGetData;
+var ChatLevel, AgentMailLevel, AskLevel, GrantRelation, GrantSubject, ConsentGrant, GRANTS_PER_SYNC = 100, GrantSync, CardCan, ContactCard, CardData, CardGetData;
 var init_consent = __esm(() => {
   init_zod();
   init_common();
@@ -7204,7 +7217,8 @@ var init_consent = __esm(() => {
   ChatLevel = _enum(["open", "muted", "blocked"]);
   AgentMailLevel = _enum(["open", "blocked"]);
   AskLevel = _enum(["open", "request", "no"]);
-  GrantSubject = union([strictObject({ person: PersonId }), strictObject({ conv: ConvId })]);
+  GrantRelation = _enum(["outside", "org"]);
+  GrantSubject = union([strictObject({ person: PersonId }), strictObject({ conv: ConvId }), strictObject({ relation: GrantRelation })]);
   ConsentGrant = object({
     v: literal(PROTOCOL),
     realm: RealmId,
@@ -7554,13 +7568,14 @@ function hostedRelayAuthPayload(args) {
 function dirReadPayload(args) {
   return { proto: RELAY_PROTOCOL, relay: args.relay, realm: args.realm, device: args.device, nonce: args.nonce };
 }
-var Req3, Size, Handle, Email, OrgId, DirReadProof, DirBindFrame, HostedHelloFrame, DirAppendFrame, DirKeysFrame, DirSthFrame, DirLookupFrame, DirHeadsFrame, DirDeviceFrame, DirResolveFrame, DirSearchFrame, DirWatchFrame, PresenceWatchFrame, DirEraseFrame, WAKE_AGENTS = 64, WAKE_AWAITING = 500, WAKE_TICKET_BYTES = 4096, WAKE_TICKET_MAX_S, WakeUrl, WakeArmFrame, WakeDisarmFrame, DirectoryClientFrame, HostedWelcomeFrame, DirOkFrame, DirSthIsFrame, DirPersonsFrame, DirHeadsAreFrame, ResolvedPerson, DirResolvedFrame, DirChangedFrame, DirUnboundFrame, DirectoryRelayFrame;
+var Req3, Size, Handle, Email, OrgId, DirReadProof, DirBindFrame, HostedHelloFrame, DirAppendFrame, DirKeysFrame, DirSthFrame, DirLookupFrame, DirHeadsFrame, DirDeviceFrame, DirResolveFrame, DirSearchFrame, DirWatchFrame, PresenceWatchFrame, DirEraseFrame, WAKE_AGENTS = 64, WAKE_AWAITING = 500, WAKE_DMS = 256, WAKE_TICKET_BYTES = 4096, WAKE_TICKET_MAX_S, WakeUrl, WakeArmFrame, WakeDisarmFrame, DirectoryClientFrame, HostedWelcomeFrame, DirOkFrame, DirSthIsFrame, DirPersonsFrame, DirHeadsAreFrame, ResolvedPerson, DirResolvedFrame, DirChangedFrame, DirUnboundFrame, DirectoryRelayFrame;
 var init_directory_frames = __esm(() => {
   init_zod();
   init_common();
   init_directory();
   init_realm();
   init_directory();
+  init_conversation();
   init_jelly();
   Req3 = string2().min(1).max(64);
   Size = number2().int().positive();
@@ -7635,7 +7650,8 @@ var init_directory_frames = __esm(() => {
     url: WakeUrl,
     ticket: Jws.refine((ticket) => ticket.length <= WAKE_TICKET_BYTES, { message: `at most ${WAKE_TICKET_BYTES} bytes` }),
     agents: array(SessionName).max(WAKE_AGENTS),
-    awaiting: array(Ulid).max(WAKE_AWAITING)
+    awaiting: array(Ulid).max(WAKE_AWAITING),
+    dms: array(ConvId).max(WAKE_DMS).optional()
   });
   WakeDisarmFrame = object({ t: literal("wake.disarm"), req: Req3 });
   DirectoryClientFrame = discriminatedUnion("t", [
@@ -7717,7 +7733,7 @@ var init_directory_frames = __esm(() => {
 });
 
 // packages/core/dist/schema/ipc/device.js
-var BindingState, RealmAlarmSummary, DeviceStatus, DeviceChangeView, DeviceListEntry, LinkText, Sas, LinkPreview, KeyFingerprint, LoginUserCode, LoginPurpose, LoginKind, LoginShown, LoginState, DeviceRemoveParams, DeviceApproveParams, IdentityReplaceParams, SignInStep, DirectoryEraseParams, DEVICE_METHODS;
+var BindingState, RealmAlarmSummary, DeviceStatus, DeviceChangeView, PresenceFeature, DeviceListEntry, LinkText, Sas, LinkPreview, KeyFingerprint, LoginUserCode, LoginPurpose, LoginKind, LoginShown, LoginState, DeviceRemoveParams, DeviceApproveParams, IdentityReplaceParams, SignInStep, DirectoryEraseParams, DEVICE_METHODS;
 var init_device = __esm(() => {
   init_zod();
   init_common();
@@ -7749,6 +7765,7 @@ var init_device = __esm(() => {
     approver: MachineLabel.optional(),
     at: Millis
   });
+  PresenceFeature = string2().regex(/^[a-z][a-z0-9-]{0,31}$/, "a feature name");
   DeviceListEntry = object({
     device: MachineId,
     label: MachineLabel,
@@ -7759,7 +7776,8 @@ var init_device = __esm(() => {
     self: boolean2(),
     away: literal(true).optional(),
     since: Millis.optional(),
-    unbound: object({ at: Millis, reason: UnbindReason, by: MachineId }).optional()
+    unbound: object({ at: Millis, reason: UnbindReason, by: MachineId }).optional(),
+    features: array(PresenceFeature).max(32).optional()
   });
   LinkText = string2().min(1).max(2048);
   Sas = string2().regex(/^[0-9]{6}$/, "six digits");
@@ -7866,7 +7884,10 @@ var init_device = __esm(() => {
 });
 
 // packages/core/dist/schema/ipc/shapes.js
-var SessionKey, SendExpect, DirectoryEntry, PeerRef, InboxItem, TaskFollowUp, TaskRecord, SendTarget, SendResult;
+function taskViewRules(schema) {
+  return schema.refine((r) => r.signIn === undefined || r.task.status.state === "TASK_STATE_AUTH_REQUIRED", "signIn is for an AUTH_REQUIRED task").refine((r) => r.refusal === undefined || r.task.status.state === "TASK_STATE_REJECTED", "refusal is for a REJECTED task").refine((r) => r.question === undefined || r.role === "executor" && (r.task.status.state === "TASK_STATE_AUTH_REQUIRED" || r.task.status.state === "TASK_STATE_INPUT_REQUIRED"), "question is for the executor's side of an AUTH_REQUIRED or INPUT_REQUIRED task");
+}
+var SessionKey, ActionToken, SendExpect, DirectoryEntry, PeerRef, InboxItem, TaskFollowUp, TASK_SIGN_IN_TOOL_CHARS, TASK_REFUSAL_CHARS, HostLocalId, TaskQuestion, TaskRecordFields, TaskRecord, PersonTask, SendTarget, SendResult;
 var init_shapes = __esm(() => {
   init_zod();
   init_a2a();
@@ -7875,6 +7896,7 @@ var init_shapes = __esm(() => {
   init_delegation();
   init_errors3();
   SessionKey = string2().min(1).max(200);
+  ActionToken = string2().regex(/^[A-Za-z0-9_-]{43}$/, "action token");
   SendExpect = _enum(["next_turn", "wake", "next_prompt", "on_read", "kept", "offline"]);
   DirectoryEntry = object({
     address: SessionAddress,
@@ -7926,7 +7948,11 @@ var init_shapes = __esm(() => {
     stage: DeliveryStage,
     at: Millis
   });
-  TaskRecord = object({
+  TASK_SIGN_IN_TOOL_CHARS = LIMITS.previewChars;
+  TASK_REFUSAL_CHARS = LIMITS.requestChars;
+  HostLocalId = string2().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/, "a plain identifier of at most 200 characters");
+  TaskQuestion = strictObject({ sessionId: HostLocalId, approvalId: HostLocalId });
+  TaskRecordFields = object({
     task: Task.extend({ id: Ulid }),
     role: _enum(["requester", "executor"]),
     key: SessionKey.describe("local session that owns this side of the task"),
@@ -7934,8 +7960,20 @@ var init_shapes = __esm(() => {
     createdAt: Millis,
     updatedAt: Millis,
     chain: DelegationSummary.optional(),
-    followUps: array(TaskFollowUp).min(1).max(LIMITS.taskFollowUps).optional()
-  });
+    followUps: array(TaskFollowUp).min(1).max(LIMITS.taskFollowUps).optional(),
+    agent: SessionName.optional(),
+    person: object({ id: PersonId, name: string2().max(200) }).optional(),
+    org: _enum(["same", "other", "none"]).optional(),
+    signIn: object({ tool: string2().min(1).max(TASK_SIGN_IN_TOOL_CHARS).optional(), by: _enum(["you", "them"]) }).optional(),
+    refusal: object({ reason: string2().min(1).max(TASK_REFUSAL_CHARS) }).optional(),
+    question: TaskQuestion.optional()
+  });
+  TaskRecord = taskViewRules(TaskRecordFields);
+  PersonTask = taskViewRules(TaskRecordFields.omit({ key: true }).extend({
+    key: never().optional(),
+    session: SessionName.describe("this person's agent on this device that holds this side of the task"),
+    cancel: strictObject({ name: literal("cancel"), token: ActionToken }).optional()
+  })).refine((r) => r.cancel === undefined || r.role === "requester", "cancel is for the requester side");
   SendTarget = SessionAddress;
   SendResult = object({
     to: SendTarget,
@@ -7950,13 +7988,14 @@ var init_shapes = __esm(() => {
 });
 
 // packages/core/dist/schema/ipc/consent.js
-var GrantTarget, Levels, GrantView, GrantReview, GrantSetParams, AskRequest, ContactRequestView, AgentInvitationRequest, ContactSuggestion, HeldRequest, RequestAnswer, RequestText, PersonReach, RequestAnswerParams, ContactRequestParams, CONSENT_METHODS;
+var GrantTarget, Levels, GrantView, GrantReview, GrantSetParams, RequestAnswer, RequestAction, Actions, AskRequest, ContactRequestView, AgentInvitationRequest, ContactSuggestion, HeldRequest, RequestText, PersonReach, RequestAnswerParams, ContactRequestParams, ReachGroupId, ReachValue, ReachOption, ReachGroup, ReachSnapshot, ReachSetParams, REACH_QUESTIONS, CONSENT_METHODS;
 var init_consent2 = __esm(() => {
   init_zod();
   init_common();
   init_conversation();
   init_consent();
   init_directory_frames();
+  init_shapes();
   GrantTarget = union([strictObject({ person: PersonId }), strictObject({ conv: ConvId })]);
   Levels = {
     chat: ChatLevel.optional(),
@@ -7983,6 +8022,9 @@ var init_consent2 = __esm(() => {
     at: Millis
   });
   GrantSetParams = strictObject({ subject: GrantTarget, ...Levels, trust: literal(true).optional() });
+  RequestAnswer = _enum(["once", "always", "accept", "decline", "block"]);
+  RequestAction = strictObject({ name: RequestAnswer, token: ActionToken });
+  Actions = { actions: array(RequestAction).max(4).optional() };
   AskRequest = object({
     id: Ulid,
     kind: _enum(["message", "task"]),
@@ -7990,7 +8032,8 @@ var init_consent2 = __esm(() => {
     to: SessionName,
     preview: string2().max(LIMITS.previewChars),
     at: Millis,
-    exp: Millis
+    exp: Millis,
+    ...Actions
   });
   ContactRequestView = object({
     id: Ulid,
@@ -8007,23 +8050,62 @@ var init_consent2 = __esm(() => {
     }),
     text: string2().max(LIMITS.requestChars),
     at: Millis,
-    exp: Millis
+    exp: Millis,
+    ...Actions
   });
-  AgentInvitationRequest = strictObject({ kind: literal("agent-invitation"), id: Ulid, cid: ConvId, from: ParticipantId, to: ParticipantId, at: Millis });
+  AgentInvitationRequest = strictObject({ kind: literal("agent-invitation"), id: Ulid, cid: ConvId, from: ParticipantId, to: ParticipantId, at: Millis, ...Actions });
   ContactSuggestion = object({
     id: Ulid,
     kind: literal("suggestion"),
     agent: SessionName,
     email: Email,
-    at: Millis
+    at: Millis,
+    ...Actions
   });
   HeldRequest = union([AskRequest, ContactRequestView, ContactSuggestion, AgentInvitationRequest]);
-  RequestAnswer = _enum(["once", "always", "accept", "decline", "block"]);
   RequestText = string2().min(1).refine((text) => text.length <= LIMITS.requestChars, { message: `at most ${LIMITS.requestChars} UTF-16 code units` });
   PersonReach = object({ person: PersonId, can: CardCan, source: _enum(["card", "default"]), at: Millis.optional(), devicesChangedAt: Millis.optional() });
-  RequestAnswerParams = strictObject({ id: Ulid, answer: RequestAnswer, all: boolean2().optional() });
+  RequestAnswerParams = strictObject({ id: Ulid, answer: RequestAnswer, all: boolean2().optional(), token: ActionToken.optional() }).refine((p) => p.token === undefined || p.all !== true, "an action token answers one request: drop all");
   ContactRequestParams = strictObject({ email: Email, text: RequestText, suggestion: Ulid.optional() });
+  ReachGroupId = _enum(["message", "ask"]);
+  ReachValue = _enum(["open", "ask", "never"]);
+  ReachOption = object({ value: ReachValue, label: string2().max(40), description: string2().max(300) });
+  ReachGroup = object({
+    id: ReachGroupId,
+    label: string2().max(80),
+    options: array(ReachOption).length(3),
+    value: ReachValue.nullable(),
+    lapsed: ReachValue.optional()
+  });
+  ReachSnapshot = object({ revision: string2().min(1).max(64), available: boolean2(), groups: array(ReachGroup).length(2) });
+  ReachSetParams = strictObject({
+    revision: string2().min(1).max(64),
+    changes: strictObject({ message: ReachValue.optional(), ask: ReachValue.optional() })
+  });
+  REACH_QUESTIONS = [
+    {
+      id: "message",
+      label: "Who can message you",
+      options: [
+        { value: "open", label: "Open", description: "Anyone outside your org may message you." },
+        { value: "ask", label: "Ask me first", description: "People outside your org send a message request first, and you accept or decline it. People you have accepted may message you." },
+        { value: "never", label: "Never", description: "No one outside your org may message you or send you a request. Your org, and people you have let message you, still can." }
+      ]
+    },
+    {
+      id: "ask",
+      label: "How agents may ask yours",
+      options: [
+        { value: "open", label: "Open", description: "Your teammates' agents may ask your agents without asking you. Their requests run guarded." },
+        { value: "ask", label: "Ask me first", description: "Each request from a teammate's agent to yours waits for your answer." },
+        { value: "never", label: "Never", description: "Your teammates' agents may not ask yours. Agents of people outside your org never may." }
+      ]
+    }
+  ];
   CONSENT_METHODS = {
+    "reach.get": { params: strictObject({}), result: ReachSnapshot },
+    "reach.set": { params: ReachSetParams, result: ReachSnapshot },
+    "reach.set.preview": { params: ReachSetParams, result: object({ sentence: string2().max(500) }) },
     "grant.list": {
       params: strictObject({ subject: GrantTarget.optional() }),
       result: object({ grants: array(GrantView), review: array(GrantReview) })
@@ -8124,6 +8206,7 @@ var init_jelly2 = __esm(() => {
     from: object({ name: string2().max(200), email: string2().max(320).optional(), org: _enum(["same", "other", "none"]) }).optional(),
     line: string2().max(NOTICE_LINE_CHARS).optional(),
     device: NoticeDevice.optional(),
+    key: string2().regex(/^task:[0-9A-HJKMNP-TV-Z]{26}$/, "task:<task id>").optional(),
     at: Millis
   });
   NoticeCounts = object({ requests: number2().int().nonnegative() });
@@ -8155,7 +8238,7 @@ var init_jelly2 = __esm(() => {
         ticket: Jws.refine((ticket) => ticket.length <= WAKE_TICKET_BYTES, { message: `at most ${WAKE_TICKET_BYTES} bytes` }),
         agents: array(SessionName).max(WAKE_AGENTS)
       }),
-      result: object({ relay: _enum(["armed", "pending"]), awaiting: number2().int().nonnegative() })
+      result: object({ relay: _enum(["armed", "pending"]), awaiting: number2().int().nonnegative(), dms: number2().int().nonnegative() })
     },
     "wake.disarm": { params: strictObject({}), result: object({ relay: _enum(["disarmed", "pending"]) }) },
     "daemon.snapshot": {
@@ -8192,6 +8275,7 @@ var init_conversation_views = __esm(() => {
   init_common();
   init_conversation();
   init_a2a();
+  init_shapes();
   Count = number2().int().nonnegative().safe();
   Seq2 = number2().int().nonnegative().safe();
   Name = string2().max(200);
@@ -8219,7 +8303,7 @@ var init_conversation_views = __esm(() => {
     mime: string2().max(100),
     bytes: number2().int().positive().max(LIMITS.blobBytes)
   });
-  TaskView = object({ id: Ulid, state: TaskState });
+  TaskView = object({ id: Ulid, state: TaskState, cancel: strictObject({ name: literal("cancel"), token: ActionToken }).optional() });
   EventView = object({
     cid: ConvId,
     id: Ulid,
@@ -8299,7 +8383,8 @@ var init_conversation_views = __esm(() => {
     object({ type: literal("read"), pos: Seq2, cid: ConvId, readUpTo: Seq2, unread: Count, mentions: Count }),
     object({ type: literal("typing"), cid: ConvId, p: ParticipantId, thread: Ulid.optional(), until: Millis }),
     object({ type: literal("activity"), body: ActivityBody }),
-    object({ type: literal("gap"), pos: Seq2 })
+    object({ type: literal("gap"), pos: Seq2 }),
+    object({ type: literal("task"), pos: Seq2, task: PersonTask })
   ]).refine((entry) => entry.type !== "event.update" || entry.cid === entry.event.cid && entry.id === entry.event.id, {
     message: "event.update names the same conversation and event as its projection"
   });
@@ -8356,7 +8441,7 @@ var init_conversations = __esm(() => {
     at: Millis,
     cid: ConvId.optional(),
     agent: SessionName.optional(),
-    state: _enum(["held", "pending-delivery"])
+    state: _enum(["held", "pending-delivery", "resend", "outdated"])
   });
   ConvListParams = strictObject({ key: Key, filter: strictObject({ unread: boolean2().optional(), mentions: boolean2().optional(), kind: ConvKind.optional(), archived: boolean2().optional() }).optional(), ...Page });
   ConvListResult = ConvPage;
@@ -8671,12 +8756,35 @@ var init_ipc = __esm(() => {
         message: strictObject({ parts: array(Part).min(1).max(LIMITS.partsPerMessage) }).optional(),
         artifact: Artifact.optional(),
         append: boolean2().optional(),
-        lastChunk: boolean2().optional()
-      }),
+        lastChunk: boolean2().optional(),
+        signIn: strictObject({ tool: string2().min(1).max(TASK_SIGN_IN_TOOL_CHARS) }).optional()
+      }).refine((p) => p.signIn === undefined || p.state === "TASK_STATE_AUTH_REQUIRED", "signIn goes with TASK_STATE_AUTH_REQUIRED"),
       result: TaskRecord
     },
+    "task.question": {
+      params: strictObject({ key: SessionKey, taskId: Ulid, question: TaskQuestion.nullable() }),
+      result: object({ ok: literal(true) })
+    },
+    "tasks.list": {
+      params: strictObject({
+        role: _enum(["requester", "executor"]).optional(),
+        state: TaskState.optional(),
+        session: SessionName.optional().describe("only this agent's tasks"),
+        cursor: string2().min(1).max(200).optional().describe("opaque; from a previous nextCursor"),
+        limit: number2().int().min(1).max(100).optional()
+      }),
+      result: object({
+        tasks: array(PersonTask),
+        nextCursor: string2().max(200).optional().describe("absent when there are no more pages"),
+        total: number2().int().nonnegative()
+      })
+    },
+    "tasks.get": {
+      params: strictObject({ taskId: Ulid, role: _enum(["requester", "executor"]).optional() }),
+      result: PersonTask
+    },
     "task.cancel": {
-      params: strictObject({ key: SessionKey, taskId: Ulid, reason: string2().max(1000).optional() }),
+      params: strictObject({ key: SessionKey.optional(), taskId: Ulid, reason: string2().max(1000).optional(), token: ActionToken.optional() }).refine((p) => p.key === undefined !== (p.token === undefined), "give exactly one of key or token"),
       result: TaskRecord
     },
     "events.subscribe": { params: strictObject({ keys: array(SessionKey).min(1).max(256) }), result: Ok2 },
@@ -8764,7 +8872,8 @@ var init_ipc = __esm(() => {
     "task.list",
     "task.get",
     "task.update",
-    "task.cancel"
+    "task.cancel",
+    "task.question"
   ];
   HUMAN_METHODS = [
     ...conversationTier("human"),
@@ -8773,6 +8882,9 @@ var init_ipc = __esm(() => {
     "grant.list",
     "grant.set",
     "grant.set.preview",
+    "reach.get",
+    "reach.set",
+    "reach.set.preview",
     "request.list",
     "request.answer",
     "request.answer.preview",
@@ -8782,6 +8894,8 @@ var init_ipc = __esm(() => {
     "notice.subscribe",
     "notice.list",
     "notice.ack",
+    "tasks.list",
+    "tasks.get",
     "device.approve.preview",
     "device.remove.preview",
     "identity.replace.preview",
@@ -8880,7 +8994,12 @@ var init_conv_frames = __esm(() => {
   });
   ConvHeadView = strictObject({ cid: ConvId, head: ConvHead, opHead: ConvHead, shares: Count3 });
   ConvHeadsFrame = strictObject({ t: literal("conv.heads"), req: Req4, heads: array(ConvHeadView).max(LIMITS.convHeads), more: boolean2() });
-  ConvCapabilitiesFrame = strictObject({ t: literal("conv.capabilities"), req: Req4, outdated: array(PersonId).max(LIMITS.convOpParticipants) });
+  ConvCapabilitiesFrame = strictObject({
+    t: literal("conv.capabilities"),
+    req: Req4,
+    outdated: array(PersonId).max(LIMITS.convOpParticipants),
+    unknown: array(PersonId).min(1).max(LIMITS.convOpParticipants).optional()
+  });
   ConvPushFrame = union([
     strictObject({ t: literal("conv.push"), cid: ConvId, entry: ConvLogEntry }),
     strictObject({ t: literal("conv.push"), cid: ConvId, share: ConvShareEntry })
@@ -9028,6 +9147,11 @@ var init_agent_tools = __esm(() => {
     titleAuthor: Author.optional().describe("With title: who wrote the request; ours when you asked (mine)"),
     status: authored("The latest status message").optional(),
     statusAuthor: Author.optional().describe("With status: who wrote it; ours when you run the task (asked)"),
+    signIn: object({
+      tool: authored("The tool the executor named").optional(),
+      by: _enum(["you", "them"]).describe("Whose sign-in it is: you (your person, for an agent of theirs) or them (the other person); your Messaging daemon decides, never the peer")
+    }).optional().describe("auth_required only: the task waits on a sign-in; the tool was written by the executor, as statusAuthor says"),
+    refusal: object({ reason: authored("The executor's reason") }).optional().describe("rejected only: why the executor declined, in its words, as statusAuthor says"),
     createdAt: iso,
     updatedAt: iso,
     consent: ToolConsentSchema.optional(),
@@ -9204,7 +9328,7 @@ var init_b64u = __esm(() => {
 });
 
 // packages/core/dist/version.js
-var VERSION = "0.8.0";
+var VERSION = "0.9.0";
 
 // packages/core/dist/jcs.js
 function hasLoneSurrogate(text) {
@@ -11061,8 +11185,11 @@ var init_jelly_host = __esm(() => {
     "people.search",
     "people.get",
     "grant.list",
+    "reach.get",
     "request.list",
     "sessions.list",
+    "tasks.list",
+    "tasks.get",
     "notice.subscribe",
     "notice.list",
     "device.list"
@@ -12387,7 +12514,17 @@ function verifyConsentGrant(raw, ctx) {
   }
 }
 function grantSubjectKey(subject) {
-  return "person" in subject ? `person:${subject.person}` : `conv:${subject.conv}`;
+  return "person" in subject ? `person:${subject.person}` : ("conv" in subject) ? `conv:${subject.conv}` : `relation:${subject.relation}`;
+}
+function reachChoices(outside, org) {
+  const message = outside === undefined ? undefined : outside.chat === "open" ? "open" : outside.chat === "blocked" ? "never" : "ask";
+  const ask = org?.ask === "open" ? "open" : org?.ask === "request" ? "ask" : org?.ask === "no" ? "never" : undefined;
+  return { ...message ? { message } : {}, ...ask ? { ask } : {} };
+}
+function reachGrant(group, value) {
+  if (group === "message")
+    return { subject: { relation: "outside" }, levels: value === "open" ? { chat: "open" } : value === "never" ? { chat: "blocked" } : {} };
+  return { subject: { relation: "org" }, levels: { ask: value === "open" ? "open" : value === "never" ? "no" : "request" } };
 }
 function preferGrant(a, b, current) {
   if (a.ts !== b.ts)
@@ -12429,8 +12566,18 @@ function resignGrant(identity, grant, opts) {
 function levelsOf(grant) {
   return defined({ chat: grant.chat, agentMail: grant.agentMail, ask: grant.ask, trustedUntil: grant.trustedUntil, discoverable: grant.discoverable });
 }
-function effectivePolicy(relation, person, channels, now) {
+function baseLevels(relation, reach) {
   const base = DEFAULTS[relation];
+  if (relation === "org")
+    return reach.ask === undefined ? base : { ...base, ask: reach.ask === "open" ? "open" : reach.ask === "never" ? "no" : "request" };
+  if (reach.message === "never")
+    return { ...base, chat: "blocked" };
+  if (relation === "stranger" && reach.message === "open")
+    return { ...base, chat: "open" };
+  return base;
+}
+function effectivePolicy(relation, person, channels, now, reach = {}) {
+  const base = baseLevels(relation, reach);
   const channelAsk = channels.map((grant) => grant.ask).filter((level) => level !== undefined);
   const channelMail = channels.map((grant) => grant.agentMail).filter((level) => level !== undefined);
   const ask = person?.ask ?? (channelAsk.length > 0 ? channelAsk.reduce((a, b) => ASK_RANK[b] > ASK_RANK[a] ? b : a) : undefined);
@@ -12448,15 +12595,19 @@ function decide(args) {
   const { inbound } = args;
   if (args.relation === "self" || args.sender === args.self)
     return { action: "deliver", consent: "self" };
-  const policy = effectivePolicy(args.relation, args.grant, args.channels, args.now);
+  const policy = effectivePolicy(args.relation, args.grant, args.channels, args.now, args.reach);
   const trusted = (chain) => policy.trustedUntil !== undefined && chain.every((person) => person === args.sender || person === args.self);
   if (inbound.kind === "answer")
     return { action: "deliver", consent: trusted([args.sender]) ? "trusted" : "guarded" };
-  if (policy.chat === "blocked")
+  const blocked = policy.chat === "blocked";
+  if (blocked && policy.granted.chat)
     return { action: "refuse", code: "refused" };
   const stranger = args.relation === "stranger";
+  const defaultCode = (outside) => outside && !blocked ? "request_required" : "refused";
   switch (inbound.kind) {
     case "op":
+      if (blocked)
+        return { action: "refuse", code: "refused" };
       if (stranger)
         return { action: "refuse", code: "request_required" };
       return { action: "deliver", consent: "guarded" };
@@ -12464,13 +12615,17 @@ function decide(args) {
       if (inbound.agent) {
         if (policy.agentMail === "open")
           return { action: "deliver", consent: "guarded" };
-        return { action: "refuse", code: stranger && !policy.granted.agentMail ? "request_required" : "refused" };
+        return { action: "refuse", code: defaultCode(stranger && !policy.granted.agentMail) };
       }
+      if (blocked)
+        return { action: "refuse", code: "refused" };
       if (policy.chat === "request_required")
         return { action: "refuse", code: "request_required" };
       return policy.chat === "muted" ? { action: "deliver", consent: "guarded", silent: true } : { action: "deliver", consent: "guarded" };
     case "request":
-      if (stranger)
+      if (blocked)
+        return { action: "refuse", code: "refused" };
+      if (policy.chat === "request_required")
         return { action: "hold" };
       return policy.chat === "muted" ? { action: "deliver", consent: "guarded", silent: true } : { action: "deliver", consent: "guarded" };
     case "ask":
@@ -12478,7 +12633,7 @@ function decide(args) {
         return { action: "deliver", consent: trusted(inbound.chain) ? "trusted" : "guarded" };
       if (policy.ask === "request")
         return { action: "hold" };
-      return { action: "refuse", code: !policy.granted.ask && (stranger || args.relation === "contact") ? "request_required" : "refused" };
+      return { action: "refuse", code: defaultCode(!policy.granted.ask && (stranger || args.relation === "contact")) };
   }
 }
 function defined(value) {
@@ -12543,8 +12698,8 @@ function verifyContactCard(raw, ctx) {
     throw asMessagingError(error, "card");
   }
 }
-function cardCan(relation, grant, now) {
-  const policy = effectivePolicy(relation, grant, [], now);
+function cardCan(relation, grant, now, reach = {}) {
+  const policy = effectivePolicy(relation, grant, [], now, reach);
   return {
     chat: policy.chat === "open" || policy.chat === "muted",
     agentMail: policy.agentMail === "open",
@@ -12718,6 +12873,9 @@ function canTransition(from, to) {
 function isTerminal(state) {
   return TERMINAL_STATES.includes(state);
 }
+function isInterrupted(state) {
+  return INTERRUPTED_STATES.includes(state);
+}
 var NEXT;
 var init_task = __esm(() => {
   init_a2a();
@@ -13960,6 +14118,7 @@ var init_present = __esm(() => {
   init_errors3();
   init_peer_text();
   init_common();
+  init_ipc();
   init_text();
   PART_CHARS = LIMITS.toolTextChars;
   OWN = createFence({ tag: PEER_FENCE_TAG });
@@ -18665,6 +18824,12 @@ class Store {
     const rows = person === undefined ? this.#all("SELECT * FROM contact_requests ORDER BY at, id") : this.#all("SELECT * FROM contact_requests WHERE person = ? ORDER BY at, id", person);
     return rows.map(contactRequestRow);
   }
+  legacyOutgoingRequests(now) {
+    return this.#all(`SELECT t.id AS id, substr(t.room, 4) AS person, t.at AS at FROM transcript t
+       WHERE t.direction = 'out' AND t.room LIKE 'dm:%'
+         AND EXISTS (SELECT 1 FROM chat_sent c WHERE c.line = t.id AND c.stage = 'sent' AND c.held_at IS NOT NULL AND c.exp > ?)
+       ORDER BY t.at, t.id`, now).map((r) => ({ id: String(r.id), person: String(r.person), at: Number(r.at) }));
+  }
   contactRequestCount() {
     return Number(this.#get("SELECT COUNT(*) AS n FROM contact_requests")?.n ?? 0);
   }
@@ -18694,38 +18859,56 @@ class Store {
     return this.#run("DELETE FROM contact_suggestions WHERE at < ?", before);
   }
   putGrant(subject, grant) {
+    const relation = relationOf(subject);
+    if (relation !== undefined) {
+      this.#run("INSERT INTO reach_grants (relation, grant) VALUES (?, ?) ON CONFLICT (relation) DO UPDATE SET grant = excluded.grant", relation, JSON.stringify(grant));
+      return;
+    }
     this.#run("INSERT INTO grants (subject, grant) VALUES (?, ?) ON CONFLICT (subject) DO UPDATE SET grant = excluded.grant", subject, JSON.stringify(grant));
   }
   grant(subject) {
-    const row = this.#get("SELECT grant FROM grants WHERE subject = ?", subject);
+    const relation = relationOf(subject);
+    const row = relation !== undefined ? this.#get("SELECT grant FROM reach_grants WHERE relation = ?", relation) : this.#get("SELECT grant FROM grants WHERE subject = ?", subject);
     return row === undefined ? undefined : JSON.parse(String(row.grant));
   }
   grants() {
-    return this.#all("SELECT subject, grant FROM grants ORDER BY subject").map((row) => ({ subject: String(row.subject), grant: JSON.parse(String(row.grant)) }));
+    return [
+      ...this.#all("SELECT subject, grant FROM grants ORDER BY subject").map((row) => ({ subject: String(row.subject), grant: JSON.parse(String(row.grant)) })),
+      ...this.#all("SELECT relation, grant FROM reach_grants ORDER BY relation").map((row) => ({ subject: `${RELATION}${String(row.relation)}`, grant: JSON.parse(String(row.grant)) }))
+    ];
   }
   grantCount() {
     return Number(this.#get("SELECT COUNT(*) AS n FROM grants")?.n ?? 0);
   }
   deleteGrant(subject) {
-    this.#run("DELETE FROM grants WHERE subject = ?", subject);
+    const relation = relationOf(subject);
+    if (relation !== undefined)
+      this.#run("DELETE FROM reach_grants WHERE relation = ?", relation);
+    else
+      this.#run("DELETE FROM grants WHERE subject = ?", subject);
   }
   putGrantReview(subject, id, levels, at) {
-    this.#run("INSERT INTO grant_reviews (subject, id, levels, at) VALUES (?, ?, ?, ?) ON CONFLICT (subject) DO UPDATE SET id = excluded.id, levels = excluded.levels, at = excluded.at", subject, id, JSON.stringify(levels), at);
+    const relation = relationOf(subject);
+    this.#run(relation !== undefined ? "INSERT INTO reach_reviews (relation, id, levels, at) VALUES (?, ?, ?, ?) ON CONFLICT (relation) DO UPDATE SET id = excluded.id, levels = excluded.levels, at = excluded.at" : "INSERT INTO grant_reviews (subject, id, levels, at) VALUES (?, ?, ?, ?) ON CONFLICT (subject) DO UPDATE SET id = excluded.id, levels = excluded.levels, at = excluded.at", relation ?? subject, id, JSON.stringify(levels), at);
   }
   grantReviews() {
-    return this.#all("SELECT * FROM grant_reviews ORDER BY at DESC, subject").map((row) => ({
-      subject: String(row.subject),
-      id: String(row.id),
-      levels: JSON.parse(String(row.levels)),
-      at: Number(row.at)
-    }));
+    const row = (subject, r) => ({ subject, id: String(r.id), levels: JSON.parse(String(r.levels)), at: Number(r.at) });
+    return [
+      ...this.#all("SELECT * FROM grant_reviews ORDER BY at DESC, subject").map((r) => row(String(r.subject), r)),
+      ...this.#all("SELECT * FROM reach_reviews ORDER BY at DESC, relation").map((r) => row(`${RELATION}${String(r.relation)}`, r))
+    ];
   }
   grantReview(subject) {
-    const row = this.#get("SELECT id FROM grant_reviews WHERE subject = ?", subject);
+    const relation = relationOf(subject);
+    const row = relation !== undefined ? this.#get("SELECT id FROM reach_reviews WHERE relation = ?", relation) : this.#get("SELECT id FROM grant_reviews WHERE subject = ?", subject);
     return row === undefined ? undefined : { id: String(row.id) };
   }
   deleteGrantReview(subject) {
-    this.#run("DELETE FROM grant_reviews WHERE subject = ?", subject);
+    const relation = relationOf(subject);
+    if (relation !== undefined)
+      this.#run("DELETE FROM reach_reviews WHERE relation = ?", relation);
+    else
+      this.#run("DELETE FROM grant_reviews WHERE subject = ?", subject);
   }
   sentUndelivered(now) {
     return this.#all("SELECT * FROM sent WHERE exp <= ? AND stage IN ('accepted', 'relayed')", now).map(sentRow);
@@ -18795,12 +18978,14 @@ class Store {
     }
   }
   listTasks(filter) {
-    const where = ["key = ?"];
-    const params = [filter.key];
+    const where = ["1 = 1"];
+    const params = [];
     const add = (clause, ...values) => {
       where.push(clause);
       params.push(...values);
     };
+    if (filter.key !== undefined)
+      add("key = ?", filter.key);
     if (filter.role !== undefined)
       add("role = ?", filter.role);
     if (filter.state !== undefined)
@@ -19187,7 +19372,7 @@ CREATE TABLE IF NOT EXISTS contact_requests (
 ) STRICT;
 CREATE INDEX IF NOT EXISTS contact_requests_person ON contact_requests (person);
 CREATE TABLE IF NOT EXISTS contact_suggestions (id TEXT PRIMARY KEY, session TEXT NOT NULL, email TEXT NOT NULL, at INTEGER NOT NULL) STRICT;
-`, MIGRATIONS, STORE_SCHEMA, kvGet = (db, k) => {
+`, MIGRATIONS, RELATION = "relation:", relationOf = (subject) => subject.startsWith(RELATION) ? subject.slice(RELATION.length) : undefined, STORE_SCHEMA, kvGet = (db, k) => {
   const row = db.prepare("SELECT v FROM kv WHERE k = ?").get(k);
   return row?.v === undefined || row.v === null ? undefined : String(row.v);
 }, kvSet = (db, k, v) => {
@@ -19263,6 +19448,10 @@ CREATE TABLE IF NOT EXISTS conv_evidence (
   at INTEGER NOT NULL,
   UNIQUE (cid, digest, code)
 ) STRICT;
+`,
+    `
+CREATE TABLE IF NOT EXISTS reach_grants (relation TEXT PRIMARY KEY, grant TEXT NOT NULL) STRICT;
+CREATE TABLE IF NOT EXISTS reach_reviews (relation TEXT PRIMARY KEY, id TEXT NOT NULL, levels TEXT NOT NULL, at INTEGER NOT NULL) STRICT;
 `
   ];
   STORE_SCHEMA = 1 + MIGRATIONS.length;
@@ -19854,7 +20043,7 @@ class ConversationEngine {
       const pending = this.options.store.convPending(cid);
       if (rekey.cause === "device" && pending) {
         const first = admitConvEvent(parseWire(pending.event));
-        if (first.class === "op" && first.body.op === "rekey" && first.body.cause === "device" && first.body.device === rekey.device)
+        if (first.class === "op" && first.body.op === "rekey" && first.body.cause === "device" && first.body.device === rekey.device && (rekey.until === undefined || first.body.until !== undefined && first.body.until <= rekey.until))
           return first.id;
         return await this.#queueRekey(cid, rekey, true);
       }
@@ -20637,6 +20826,14 @@ class ConversationIpc {
   inboxNotify(key, cid) {
     this.#label(this.#current(), cid, { key, own: this.options.own().person });
   }
+  taskChanged(side) {
+    this.#ring.push({ pos: ++this.#pos, task: { id: side.id, role: side.role } });
+    if (this.#ring.length > REPLAY)
+      this.#floor = this.#ring.shift().pos;
+    this.options.put("conv.ipc.pos", String(this.#pos));
+    for (const wake of [...this.#waiters])
+      wake();
+  }
   bind(engine) {
     if (this.#engine === engine)
       return;
@@ -20732,7 +20929,7 @@ class ConversationIpc {
         if (authority?.scope === "host")
           throw new MessagingError("forbidden", "conversation content needs an action grant");
         const name = method;
-        const result = await this.call(name, params, ctx);
+        const result = await this.call(name, params, ctx, authority);
         const parsed = LIVE_CONVERSATION_METHODS[name].result.parse(result);
         if (Buffer.byteLength(JSON.stringify(parsed)) > RESPONSE_BYTES)
           throw new MessagingError("too_large", "conversation response exceeds the byte budget");
@@ -20833,7 +21030,13 @@ class ConversationIpc {
       throw new MessagingError("forbidden", "the session cannot read this conversation");
     if (access.access === "ask")
       return HOLD;
-    const all = await projectEvents(engine, cid, scope.participant, this.#name, (p) => !this.options.blocked(participantPerson(p)));
+    const orgs = new Map;
+    const name = async (p) => {
+      const profile = await this.#name(p);
+      orgs.set(p, profile.org);
+      return profile;
+    };
+    const all = await projectEvents(engine, cid, scope.participant, name, (p) => !this.options.blocked(p, orgs.get(p) ?? "none"));
     let visible = all.filter((e) => e.seq >= access.since && e.at >= access.after);
     if (scope.agent && this.#state(engine, cid, scope).state.agentContext === "none") {
       const roots = new Set(visible.filter((e) => e.author.p === scope.participant || e.mentions?.some((m) => ("p" in m) && m.p === scope.participant)).map((e) => e.thread ?? e.id));
@@ -20908,10 +21111,30 @@ class ConversationIpc {
         return { events: [{ type: "gap", pos: this.#pos }], pos: this.#pos };
       const events = [];
       let pos = after;
-      for (const item of this.#ring.filter((i) => i.pos > after)) {
+      const range = this.#ring.filter((i) => i.pos > after);
+      for (const [index, item] of range.entries()) {
         pos = item.pos;
-        const c = item.change;
         let rendered;
+        if ("task" in item) {
+          const side = item.task;
+          if (scope.key !== undefined || scope.ctx.tier !== "admin" || !this.options.task)
+            continue;
+          if (range.slice(index + 1).some((later) => ("task" in later) && later.task.id === side.id && later.task.role === side.role))
+            continue;
+          const task = await this.options.task(side.id, side.role, scope.ctx, scope.authority);
+          if (!task)
+            continue;
+          rendered = { type: "task", pos, task };
+          if (Buffer.byteLength(JSON.stringify([...events, rendered])) > RESPONSE_BYTES - 4096) {
+            pos = item.pos - 1;
+            break;
+          }
+          events.push(rendered);
+          if (events.length >= (p.limit ?? 50))
+            break;
+          continue;
+        }
+        const c = item.change;
         try {
           if (this.#access(engine, c.cid, scope).access !== "allow")
             continue;
@@ -20981,7 +21204,7 @@ class ConversationIpc {
     result = await read();
     return result;
   }
-  async call(method, raw, ctx) {
+  async call(method, raw, ctx, authority) {
     if (ctx.tier === "agent" && CONVERSATION_TIERS[method] !== "agent")
       throw new MessagingError("forbidden", "this method is human-only");
     const p = LIVE_CONVERSATION_METHODS[method].params.parse(raw);
@@ -21003,7 +21226,7 @@ class ConversationIpc {
       const sessions = this.options.sessions().map((s) => ({ ...s, seats: engine?.list().filter((c) => c.state?.participants.some((p) => p.p === `${this.options.own().person}/${s.agent}` && p.state === "member")).map((c) => c.cid) ?? [] }));
       return { sessions };
     }
-    const scope = this.#scope("key" in p ? p.key : undefined, ctx);
+    const scope = { ...this.#scope("key" in p ? p.key : undefined, ctx), authority };
     const engine = this.#current();
     const { cursor: _cursor, ...position } = p;
     const query = canonicalize({ method, person: scope.own, session: scope.key ?? null, ...position });
@@ -21212,8 +21435,11 @@ class ConversationIpc {
           await this.options.current?.(p.participants.map((s) => participantPerson(s.p)));
         }
         const { cid, ...fields } = p;
-        if (method !== "conv.meta" && engine.pending(cid).length > 0)
+        for (let drains = 0;method !== "conv.meta" && engine.pending(cid).length > 0; drains++) {
+          if (drains === CONTROL_DRAINS)
+            throw new MessagingError("conv_conflict", "the conversation is busy sending; try again");
           await engine.flush(cid);
+        }
         if (method === "conv.meta")
           await engine.queueMeta(cid, p.meta);
         else
@@ -21241,7 +21467,7 @@ class ConversationIpc {
     }
   }
 }
-var DEFERRED_LINES = 50, DEFERRED_MS, HOLD, REPLAY = 1e4, RESPONSE_BYTES;
+var DEFERRED_LINES = 50, DEFERRED_MS, CONTROL_DRAINS = 3, HOLD, REPLAY = 1e4, RESPONSE_BYTES;
 var init_conv_ipc = __esm(() => {
   init_dist();
   init_conv_project();
@@ -22140,19 +22366,19 @@ function expectation(view, target, wake, policy) {
     const s = view.sessions.find((row) => row.name === target.session);
     if (!s)
       return;
-    return reach({ kept: s.unregisteredAt !== undefined, tier: s.tier, state: s.state, wakes: policy.wake(s) }, wake);
+    return reach2({ kept: s.unregisteredAt !== undefined, tier: s.tier, state: s.state, wakes: policy.wake(s) }, wake);
   }
   const s = view.peers.find((row) => row.machine === target.machine)?.presence.sessions.find((info) => info.session === target.session);
   if (!s)
     return;
   if (!view.online.has(target.machine))
     return "offline";
-  return reach({ kept: s.kept === true, tier: s.tier, state: s.state, wakes: s.wake === true }, wake);
+  return reach2({ kept: s.kept === true, tier: s.tier, state: s.state, wakes: s.wake === true }, wake);
 }
 function withExpect(expect) {
   return expect === undefined ? {} : { expect };
 }
-function reach(s, wake) {
+function reach2(s, wake) {
   if (s.kept)
     return wake && s.wakes ? "wake" : "kept";
   if (s.tier === "pull")
@@ -22196,7 +22422,7 @@ function fitPresence(sessions, baseBytes, limit) {
 var FEATURES;
 var init_directory2 = __esm(() => {
   init_dist();
-  FEATURES = ["tasks", "conversations"];
+  FEATURES = ["tasks", "conversations", "reach"];
 });
 
 // packages/daemon/dist/delegation.js
@@ -22905,6 +23131,22 @@ class DirectoryIdentity {
     const head = this.#head;
     return head !== undefined && this.#options.now() - head.sth.ts > maxAgeMs + LIMITS.epochHeartbeatMs;
   }
+  async freshen(persons, batch = LIMITS.dirLookupPersons) {
+    const size1 = Math.max(1, Math.min(batch, LIMITS.dirLookupPersons));
+    const now = this.#options.now();
+    const size = this.#head?.sth.size ?? 0;
+    const stale = [...new Set(persons)].filter((person) => {
+      if (!isHosted(person))
+        return false;
+      const held = this.#persons.get(person);
+      return !held || now - held.fetchedAt >= LIMITS.dirFreshMs || held.size < size;
+    });
+    if (stale.length === 0 && !this.#headOlderThan(LIMITS.dirFreshMs))
+      return;
+    await this.#latest();
+    for (let i = 0;i < stale.length; i += size1)
+      await this.#fetch(stale.slice(i, i + size1));
+  }
   async profile(person) {
     if (!isHosted(person))
       throw new MessagingError("not_found", "no such person in this realm");
@@ -24041,8 +24283,10 @@ class JellyAuth {
     this.#deps = deps;
   }
   authorize(call) {
-    const sessionCall = call.params !== null && typeof call.params === "object" && "key" in call.params && typeof call.params.key === "string";
-    if (call.ctx.tier === "agent" || AGENT.has(call.method) && (!Object.hasOwn(CONVERSATION_METHODS, call.method) || sessionCall))
+    const params = call.params !== null && typeof call.params === "object" ? call.params : undefined;
+    const sessionCall = params !== undefined && typeof params.key === "string";
+    const tokenCall = params !== undefined && Object.hasOwn(params, "token");
+    if (call.ctx.tier === "agent" || AGENT.has(call.method) && !tokenCall && (!Object.hasOwn(CONVERSATION_METHODS, call.method) || sessionCall))
       return;
     const refuse = (error) => {
       this.#deps.log("warn", "jelly.grant.refused", { method: call.method, code: error.code, reason: error.message });
@@ -24075,7 +24319,7 @@ class JellyAuth {
       ...grant.dev !== undefined ? { dev: grant.dev.slice(0, 200) } : {},
       ...grant.mbr !== undefined ? { mbr: grant.mbr.slice(0, 200) } : {}
     });
-    return { scope: grant.scope, expiresAt: (grant.exp + JELLY_HOST_SKEW_S) * 1000 };
+    return { scope: grant.scope, expiresAt: (grant.exp + JELLY_HOST_SKEW_S) * 1000, ...grant.dev !== undefined ? { dev: grant.dev } : {}, ...grant.mbr !== undefined ? { mbr: grant.mbr } : {} };
   }
   ticket(p) {
     const refuse = (error) => {
@@ -24409,6 +24653,9 @@ class Notices {
   held(row) {
     this.#file({ id: `r_${row.id}`, category: "request", person: row.person, source: row.id, at: row.at });
   }
+  task(row) {
+    this.#file({ id: `m_task${row.taskId}`, category: "message", person: row.person, source: `${TASK_SOURCE}${row.taskId}`, at: row.at });
+  }
   alert(kind, at) {
     this.#file({ id: `a_${kind.replace(/_/g, "")}${at}`, category: "alert", source: kind, at });
   }
@@ -24421,7 +24668,7 @@ class Notices {
   #file(row) {
     if (!this.#host.store.putNotice(row))
       return;
-    this.#host.emit({ type: "notice", notice: { id: row.id, category: row.category, at: row.at } });
+    this.#host.emit({ type: "notice", notice: { id: row.id, category: row.category, ...row.source.startsWith(TASK_SOURCE) ? { key: `task:${row.source.slice(TASK_SOURCE.length)}` } : {}, at: row.at } });
   }
   async subscribe(ctx, p, until) {
     const rows = this.#host.store.noticesAfter(p.after, REPLAY2);
@@ -24477,6 +24724,8 @@ class Notices {
       const own = row.person === this.#host.me();
       notice.from = profile ? { name: profile.name.slice(0, 200), ...profile.email !== undefined ? { email: profile.email.slice(0, 320) } : {}, org: profile.org } : { name: row.person, org: own ? "same" : "none" };
     }
+    if (row.category === "message" && row.source.startsWith(TASK_SOURCE))
+      notice.key = `task:${row.source.slice(TASK_SOURCE.length)}`;
     if (row.category === "alert" && row.source.startsWith("device:")) {
       const device = this.#host.device?.(Number(row.source.slice("device:".length)));
       if (device)
@@ -24502,7 +24751,7 @@ function deviceLine(d) {
   const line = d.change === "added" ? `New device on your account: ${what}, ${vouchWords(d)}.` : d.change === "vouched" ? `${what} on your account is now vouched by Jelly ID: ${vouchWords(d)}.` : d.change === "replaced" ? `'${d.replaces?.label ?? "a device"}' was replaced by ${what}, ${vouchWords(d)}.` : `${what} was removed from your account.`;
   return line.length <= NOTICE_LINE_CHARS ? line : `${line.slice(0, NOTICE_LINE_CHARS - 1)}\u2026`;
 }
-var ALERT_TEXT, REPLAY2 = 500;
+var ALERT_TEXT, TASK_SOURCE = "task:", REPLAY2 = 500;
 var init_notices = __esm(() => {
   init_dist();
   ALERT_TEXT = {
@@ -24512,6 +24761,68 @@ var init_notices = __esm(() => {
   };
 });
 
+// packages/daemon/dist/task-view.js
+function plainCapped(text, max, singleLine) {
+  let budget = max;
+  for (;; ) {
+    const out = cleanPeerText(text, { singleLine, maxChars: budget }).trim();
+    if (out.length <= max)
+      return out.length > 0 ? out : undefined;
+    budget = Math.max(0, budget - (out.length - max));
+  }
+}
+function executorWords(record) {
+  const message = record.task.status.message;
+  return message !== undefined && (record.role === "executor" || message.metadata?.[URI.provenance] !== undefined);
+}
+function signInTool(record) {
+  if (!executorWords(record))
+    return;
+  const value = record.task.status.message?.metadata?.[URI.signIn];
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return;
+  const tool = value.tool;
+  return typeof tool === "string" ? plainCapped(tool, TASK_SIGN_IN_TOOL_CHARS, true) : undefined;
+}
+function refusalReason2(record) {
+  if (!executorWords(record))
+    return;
+  const text = (record.task.status.message?.parts ?? []).flatMap((part) => typeof part.text === "string" ? [part.text] : []).join(`
+`);
+  return plainCapped(text, TASK_REFUSAL_CHARS, false);
+}
+function withTaskView(record, me, named) {
+  const view = { ...record };
+  delete view.agent;
+  delete view.person;
+  delete view.org;
+  delete view.signIn;
+  delete view.refusal;
+  delete view.question;
+  if (record.peer.agent !== undefined)
+    view.agent = record.peer.agent;
+  if (named !== undefined) {
+    view.person = { id: record.peer.person, name: named.name.slice(0, 200) };
+    view.org = named.org;
+  }
+  const state = record.task.status.state;
+  if (state === "TASK_STATE_AUTH_REQUIRED") {
+    const mine = record.role === "executor" || me !== undefined && record.peer.person === me;
+    const tool = signInTool(record);
+    view.signIn = { ...tool !== undefined ? { tool } : {}, by: mine ? "you" : "them" };
+  }
+  if (state === "TASK_STATE_REJECTED") {
+    const reason = refusalReason2(record);
+    if (reason !== undefined)
+      view.refusal = { reason };
+  }
+  return view;
+}
+var SIGN_IN_TEXT = "Sign-in required.";
+var init_task_view = __esm(() => {
+  init_dist();
+});
+
 // packages/daemon/dist/realm/counterpart.js
 function successors(realm, recorded) {
   const chain = [recorded];
@@ -25408,6 +25719,104 @@ var init_wake_bridge = __esm(() => {
   };
 });
 
+// packages/daemon/dist/action-tokens.js
+import { randomBytes as randomBytes14 } from "crypto";
+function actionView(ctx, authority, sessionKey) {
+  if (ctx.tier !== "admin" || sessionKey !== undefined || authority?.scope === "host")
+    return;
+  return { connection: ctx.id, ...authority?.dev !== undefined ? { dev: authority.dev } : {}, ...authority?.mbr !== undefined ? { mbr: authority.mbr } : {} };
+}
+function taskCancelAction(tokens, task, view) {
+  if (view === undefined || task.role !== "requester" || task.ended)
+    return;
+  return { name: "cancel", token: tokens.offer(view, "cancel", `task:${task.id}`) };
+}
+
+class ActionTokens {
+  now;
+  limits;
+  #held = new Map;
+  #offers = new Map;
+  #perView = new Map;
+  constructor(now, limits = { perView: ACTION_TOKENS_PER_VIEW, total: ACTION_TOKENS_TOTAL, ttlMs: ACTION_TOKEN_TTL_MS }) {
+    this.now = now;
+    this.limits = limits;
+  }
+  get size() {
+    return this.#held.size;
+  }
+  offer(view, name, target) {
+    const now = this.now();
+    const key = viewKey(view);
+    const offered = this.#offers.get(offerKey(key, name, target));
+    if (offered !== undefined) {
+      const held = this.#held.get(offered);
+      if (held !== undefined && held.exp - now > this.limits.ttlMs / 2)
+        return offered;
+    }
+    this.sweep();
+    while ((this.#perView.get(key) ?? 0) >= this.limits.perView && this.#dropOldest((h) => h.view === key))
+      ;
+    while (this.#held.size >= this.limits.total && this.#dropOldest(() => true))
+      ;
+    const token = randomBytes14(32).toString("base64url");
+    this.#held.set(token, { name, target, view: key, connection: view.connection, exp: now + this.limits.ttlMs });
+    this.#offers.set(offerKey(key, name, target), token);
+    this.#perView.set(key, (this.#perView.get(key) ?? 0) + 1);
+    return token;
+  }
+  redeem(token, want) {
+    const held = this.#held.get(token);
+    if (held !== undefined)
+      this.#delete(token, held);
+    this.#match(held, want);
+  }
+  check(token, want) {
+    this.#match(this.#held.get(token), want);
+  }
+  disconnected(connection) {
+    for (const [token, held] of [...this.#held])
+      if (held.connection === connection)
+        this.#delete(token, held);
+  }
+  sweep() {
+    const now = this.now();
+    for (const [token, held] of [...this.#held])
+      if (held.exp <= now)
+        this.#delete(token, held);
+  }
+  #match(held, want) {
+    const ok = held !== undefined && held.exp > this.now() && held.name === want.name && held.target === want.target && held.view === viewKey(want.view);
+    if (!ok)
+      throw new MessagingError("grant_invalid", "the action token is not one this daemon offered for this action, item and view, or it was spent or expired; read the view again");
+  }
+  #dropOldest(which) {
+    for (const [token, held] of this.#held) {
+      if (!which(held))
+        continue;
+      this.#delete(token, held);
+      return true;
+    }
+    return false;
+  }
+  #delete(token, held) {
+    this.#held.delete(token);
+    const key = offerKey(held.view, held.name, held.target);
+    if (this.#offers.get(key) === token)
+      this.#offers.delete(key);
+    const count = (this.#perView.get(held.view) ?? 1) - 1;
+    if (count > 0)
+      this.#perView.set(held.view, count);
+    else
+      this.#perView.delete(held.view);
+  }
+}
+var ACTION_TOKEN_TTL_MS, ACTION_TOKENS_PER_VIEW = 256, ACTION_TOKENS_TOTAL = 4096, viewKey = (view) => JSON.stringify([view.connection, view.dev ?? null, view.mbr ?? null]), offerKey = (view, name, target) => JSON.stringify([view, name, target]);
+var init_action_tokens = __esm(() => {
+  init_dist();
+  ACTION_TOKEN_TTL_MS = 10 * 60000;
+});
+
 // packages/daemon/dist/consent/grants.js
 class Grants {
   #host;
@@ -25447,14 +25856,44 @@ class Grants {
         const members = this.#host.participants(cid, event?.seq);
         return members.includes(person) && members.includes(me.person);
       })),
+      reach: this.reach(),
       inbound,
       now: this.#host.now()
     });
   }
+  hides(participant, org) {
+    const slash = participant.indexOf("/");
+    const person = slash === -1 ? participant : participant.slice(0, slash);
+    const { me } = this.#host.joined();
+    if (person === me.person)
+      return false;
+    const grant = this.personGrant(person);
+    if (grant?.chat === "blocked")
+      return true;
+    if (slash !== -1 || org !== "other")
+      return false;
+    const relation = this.hasGrant(person) ? "contact" : "stranger";
+    return effectivePolicy(relation, grant, [], this.#host.now(), this.reach()).chat === "blocked";
+  }
   personGrant(person) {
     const grant = this.#current(grantSubjectKey({ person }));
     return grant && levelsOf(grant);
   }
+  relationGrant(relation) {
+    const grant = this.#current(grantSubjectKey({ relation }));
+    return grant && levelsOf(grant);
+  }
+  reach() {
+    return reachChoices(this.relationGrant("outside"), this.relationGrant("org"));
+  }
+  relationRecord(relation) {
+    const key = grantSubjectKey({ relation });
+    return { grant: this.#store.grant(key) ?? null, review: this.#store.grantReviews().find(({ subject }) => subject === key) ?? null };
+  }
+  relationReview(relation) {
+    const row = this.#store.grantReviews().find(({ subject }) => subject === grantSubjectKey({ relation }));
+    return row?.levels;
+  }
   conversationGrants(conversations) {
     return conversations.flatMap((conv) => {
       const grant = this.#current(grantSubjectKey({ conv }));
@@ -25476,8 +25915,8 @@ class Grants {
   }
   list(p) {
     const only = p.subject === undefined ? undefined : this.#subjectKey(p.subject, false);
-    const grants = this.#all().filter(({ subject }) => only === undefined || subject === only).map(({ grant }) => this.#view(grant)).sort((a, b) => b.ts - a.ts || (a.id < b.id ? 1 : -1));
-    const review = this.#store.grantReviews().filter(({ subject }) => only === undefined || subject === only).map(({ subject, levels, at }) => ({ subject: this.#subjectView(subject), ...levels, at }));
+    const grants = this.#all().filter(({ subject }) => !isRelationKey(subject)).filter(({ subject }) => only === undefined || subject === only).map(({ grant }) => this.#view(grant)).sort((a, b) => b.ts - a.ts || (a.id < b.id ? 1 : -1));
+    const review = this.#store.grantReviews().filter(({ subject }) => !isRelationKey(subject)).filter(({ subject }) => only === undefined || subject === only).map(({ subject, levels, at }) => ({ subject: this.#subjectView(subject), ...levels, at }));
     return { grants, review };
   }
   set(p, opts = {}) {
@@ -25505,6 +25944,22 @@ class Grants {
       delete levels.trustedUntil;
     return this.set({ subject: { person }, ...levels }, opts);
   }
+  setRelations(changes) {
+    if (changes.length === 0)
+      return;
+    const { identity, realm, me } = this.#host.joined();
+    const now = this.#host.now();
+    const grants = changes.map(({ subject, levels }) => signConsentGrant(identity, { realm: realm.realm, person: me.person, subject, levels, now }));
+    this.#host.tx(() => {
+      for (const grant of grants) {
+        const key = grantSubjectKey(grant.subject);
+        this.#store.putGrant(key, grant);
+        this.#store.deleteGrantReview(key);
+      }
+      this.#sync("grant", grants);
+    });
+    this.#host.log("grant.set", { subject: "relation", grants: grants.length });
+  }
   check(p) {
     const { identity, realm, me } = this.#host.joined();
     const now = this.#host.now();
@@ -25531,7 +25986,7 @@ class Grants {
       }
       const key = grantSubjectKey(grant.subject);
       const held = this.#held(key);
-      if (!held && this.#store.grantCount() >= LIMITS.grantsPerPerson) {
+      if (!held && !isRelationKey(key) && this.#store.grantCount() >= LIMITS.grantsPerPerson) {
         this.#host.log("grant.sync.skipped", { id: env.id, code: "rate_limited" });
         continue;
       }
@@ -25665,10 +26120,17 @@ class Grants {
     return grantSubjectKey(target);
   }
   #subjectOf(key) {
-    return key.startsWith("person:") ? { person: key.slice("person:".length) } : { conv: key.slice("conv:".length) };
+    if (key.startsWith("person:"))
+      return { person: key.slice("person:".length) };
+    if (isRelationKey(key))
+      return { relation: key.slice("relation:".length) };
+    return { conv: key.slice("conv:".length) };
   }
   #subjectView(key) {
-    return this.#subjectOf(key);
+    const subject = this.#subjectOf(key);
+    if ("relation" in subject)
+      throw new MessagingError("internal", "a relation grant has no grant view");
+    return subject;
   }
   #view(grant) {
     return {
@@ -25681,6 +26143,9 @@ class Grants {
     };
   }
 }
+function isRelationKey(key) {
+  return key.startsWith("relation:");
+}
 function levelsFrom(p, now) {
   const trustedUntil = p.trustedUntil ?? (p.trust ? now + LIMITS.trustDefaultMs : undefined);
   return levelsOf({ chat: p.chat, agentMail: p.agentMail, ask: p.ask, trustedUntil, discoverable: p.discoverable });
@@ -25816,7 +26281,7 @@ class Cards {
       seq,
       now,
       ...grant !== undefined && typeof held?.id === "string" ? { grantId: held.id } : {},
-      can: cardCan(relation, grant, now)
+      can: cardCan(relation, grant, now, this.#host.reach?.() ?? {})
     });
     for (const device of realm.known(person).devices) {
       this.#host.route(this.#host.seal(device.machine, cardMessage2({ card }, "card")));
@@ -25943,7 +26408,10 @@ class ConversationRequests {
     return this.#ids().map((id) => this.get(id)).sort((a, b) => a.at - b.at || a.id.localeCompare(b.id));
   }
   waitingOnThem() {
-    return this.list().filter((r) => r.direction === "outgoing" && r.state === "submitted" && r.request.descriptor.expiresAt > this.host.now()).map((r) => ({ id: r.id, kind: "contact", to: r.person, name: r.person, at: r.at, cid: r.request.descriptor.cid }));
+    const now = this.host.now(), rows = this.list().filter((r) => r.direction === "outgoing");
+    const submitted = rows.filter((r) => r.state === "submitted" && r.request.descriptor.expiresAt > now).map((r) => ({ id: r.id, kind: "contact", to: r.person, name: r.person, at: r.at, cid: r.request.descriptor.cid }));
+    const resend = rows.filter((r) => r.state === "resend" && r.at + LIMITS.ttlMs > now && !rows.some((n) => n.person === r.person && n.request && n.at >= r.at)).map((r) => ({ id: r.id, kind: "contact", to: r.person, name: r.person, at: r.at, cid: dmConvId(this.host.person, r.person), resend: true }));
+    return [...submitted, ...resend];
   }
   cutoverLegacy(outgoing = []) {
     this.host.store.tx(() => {
@@ -26015,6 +26483,8 @@ class ConversationRequests {
       throw new MessagingError("expired", "request has expired");
     if (this.host.chat(d.from) === "blocked")
       throw new MessagingError("declined", "request declined");
+    if (this.host.refuses?.(d.from))
+      throw new MessagingError("refused", "this person accepts no message requests from outside their org");
     return this.host.store.tx(() => {
       const old = this.get(d.id);
       if (old) {
@@ -26180,6 +26650,7 @@ class Requests {
       resolve: (email) => this.#resolve(email),
       current: (person) => h.current?.([person]) ?? Promise.resolve(),
       chat: (person) => h.grants.personGrant(person)?.chat,
+      refuses: (person) => h.grants.decide(person, { kind: "request" }).action === "refuse",
       grantChat: (person, chat) => {
         h.grants.setPerson(person, { chat }, { card: false });
       },
@@ -26246,7 +26717,7 @@ class Requests {
         }, proof, body);
       }
     });
-    this.#lifecycle.cutoverLegacy();
+    this.#lifecycle.cutoverLegacy(h.store.legacyOutgoingRequests(h.now()));
     return this.#lifecycle;
   }
   #mailbox() {
@@ -26327,12 +26798,17 @@ class Requests {
       return true;
     if (payload.stage === "held")
       this.host.store.setKv(`conv.request.held.${sent.request}`, "true");
+    if (payload.stage === "delivered" || payload.stage === "read") {
+      if (!this.host.store.getKv(`conv.request.outdated.${sent.request}`))
+        this.host.log("request.outdated", { id: sent.request });
+      this.host.store.setKv(`conv.request.outdated.${sent.request}`, "true");
+    }
     return true;
   }
   async waitingOnThem() {
-    return this.#current().waitingOnThem().map((row) => ({
+    return this.#current().waitingOnThem().map(({ resend, ...row }) => ({
       ...row,
-      state: this.host.store.getKv(`conv.request.held.${row.id}`) === "true" ? "held" : "pending-delivery"
+      state: resend ? "resend" : this.host.store.getKv(`conv.request.outdated.${row.id}`) === "true" ? "outdated" : this.host.store.getKv(`conv.request.held.${row.id}`) === "true" ? "held" : "pending-delivery"
     }));
   }
   get(id) {
@@ -26449,6 +26925,91 @@ var init_requests2 = __esm(() => {
   init_request_importer();
 });
 
+// packages/daemon/dist/consent/reach.js
+function revision(grants, choices) {
+  const records = Object.fromEntries(GROUPS2.map((group) => [group, grants.relationRecord(RELATION2[group])]));
+  return sha256(canonicalize({ records, choices })).slice(0, 32);
+}
+function reachSnapshot(grants) {
+  const choices = grants.reach();
+  const lapsed = reachChoices(grants.relationReview("outside"), grants.relationReview("org"));
+  return {
+    revision: revision(grants, choices),
+    available: true,
+    groups: REACH_QUESTIONS.map((question) => ({
+      id: question.id,
+      label: question.label,
+      options: question.options.map((option) => ({ ...option })),
+      value: choices[question.id] ?? null,
+      ...lapsed[question.id] !== undefined ? { lapsed: lapsed[question.id] } : {}
+    }))
+  };
+}
+function changesOf(grants, p) {
+  if (p.revision !== revision(grants, grants.reach())) {
+    throw new MessagingError("conflict", "your reach choices changed since they were read; read them again and choose again");
+  }
+  return GROUPS2.flatMap((group) => p.changes[group] === undefined ? [] : [[group, p.changes[group]]]);
+}
+function reachSet(grants, p) {
+  const changes = changesOf(grants, p);
+  grants.setRelations(changes.map(([group, value]) => {
+    const { levels } = reachGrant(group, value);
+    return { subject: { relation: RELATION2[group] }, levels };
+  }));
+  return reachSnapshot(grants);
+}
+function reachPreview(grants, p) {
+  const changes = changesOf(grants, p);
+  if (changes.length === 0)
+    return "Nothing changes.";
+  return changes.map(([group, value]) => SENTENCES[group][value]).join(" ");
+}
+var RELATION2, GROUPS2, SENTENCES;
+var init_reach = __esm(() => {
+  init_dist();
+  RELATION2 = { message: "outside", ask: "org" };
+  GROUPS2 = ["message", "ask"];
+  SENTENCES = {
+    message: {
+      open: "Anyone outside your org may message you.",
+      ask: "People outside your org send you a message request first.",
+      never: "No one outside your org may message you or send you a request, except people you have let message you."
+    },
+    ask: {
+      open: "Your teammates' agents may ask yours without asking you; their requests run guarded.",
+      ask: "You answer each request from a teammate's agent to yours first.",
+      never: "Your teammates' agents may not ask yours."
+    }
+  };
+});
+
+// packages/daemon/dist/conv-caps.js
+async function ensureCurrent(link, own, persons, handle) {
+  const others = [...new Set(persons)].filter((p) => p !== own);
+  if (!others.length)
+    return;
+  let outdated;
+  try {
+    outdated = (await link?.convCaps?.(others))?.outdated ?? [];
+  } catch {
+    return;
+  }
+  if (!outdated.length)
+    return;
+  const handles = await Promise.all(outdated.map(async (p) => {
+    try {
+      return await handle(p);
+    } catch {
+      return p;
+    }
+  }));
+  throw new MessagingError("peer_outdated", `${handles.join(", ")} ${handles.length === 1 ? "needs" : "need"} to update Messaging`);
+}
+var init_conv_caps = __esm(() => {
+  init_dist();
+});
+
 // packages/daemon/dist/consent/sentence.js
 function grantSentence(p, me, now) {
   const levels = levelsFrom(p, now);
@@ -26487,6 +27048,41 @@ var init_sentence = __esm(() => {
   init_grants();
 });
 
+// packages/daemon/dist/wake-dms.js
+function teammateDms(conversations, self) {
+  const member = (state, person) => state.participants.some((p) => p.person === person && p.state === "member");
+  const seated = (state, person) => state.participants.some((p) => p.p === person && p.state === "member");
+  const channels = conversations.flatMap((c) => c.state?.kind === "channel" && seated(c.state, self) ? [c.state] : []);
+  const shares = new Map;
+  const shared = (person) => {
+    let found = shares.get(person);
+    if (found === undefined)
+      shares.set(person, found = channels.some((state) => seated(state, person)));
+    return found;
+  };
+  const found = [];
+  for (const { cid, state } of conversations) {
+    if (state?.kind !== "dm" || !member(state, self))
+      continue;
+    const others = [...new Set(state.participants.filter((p) => p.person !== self).map((p) => p.person))];
+    if (others.length !== 1)
+      continue;
+    const person = others[0];
+    if (!member(state, person) || !shared(person))
+      continue;
+    found.push({ cid, person });
+  }
+  return found;
+}
+function wakeArmable(grants, person, org) {
+  const chat = grants.personGrant(person)?.chat;
+  if (chat === "blocked" || chat === "muted")
+    return false;
+  if (grants.hides(person, org))
+    return false;
+  return true;
+}
+
 // packages/daemon/dist/daemon.js
 async function startDaemon(options) {
   const daemon = await Daemon.start(options);
@@ -26498,6 +27094,7 @@ async function startDaemon(options) {
     status: () => daemon.status(),
     conversations: () => daemon.conversations(),
     conversationsReady: () => daemon.conversationsReady(),
+    actionTokens: () => daemon.actionTokens(),
     sweep: () => daemon.sweep(),
     close: () => daemon.close()
   };
@@ -26562,11 +27159,14 @@ class Daemon {
   #cards;
   #requests;
   #notices;
+  #named = new Map;
+  #questions = new Map;
   #jellyHost;
   #attached = false;
   #wakeArmed = false;
   #snapshots;
   #jellyAuth;
+  #actions;
   #state = "starting";
   #sync;
   #pending = [];
@@ -26602,6 +27202,7 @@ class Daemon {
     this.#jellyHttp = options.jellyHttp;
     this.#loginWait = options.loginWait;
     this.#jellyHost = options.jellyHost;
+    this.#actions = new ActionTokens(() => this.#now());
     this.#config = readConfig(paths.config);
     this.#configStamp = configStamp(paths.config);
     this.closed = new Promise((resolve) => this.#settleClosed = resolve);
@@ -26619,9 +27220,10 @@ class Daemon {
       put: (key, value) => store.setKv(key, value),
       fresh: (people) => this.#withFresh(people, () => {}),
       refuseSecrets: (value) => this.#refuseSecrets(value, "conv.send", "conversation line"),
-      blocked: (person) => this.#grants.personGrant(person)?.chat === "blocked",
+      blocked: (participant, org) => this.#grants.hides(participant, org),
       current: (persons) => this.#ensureCurrent(persons),
-      outgoingRequests: () => this.#requests.waitingOnThem()
+      outgoingRequests: () => this.#requests.waitingOnThem(),
+      task: (id, role, ctx, authority) => this.#personTaskEntry(id, role, ctx, authority)
     });
     this.#conversationInbox = new ConversationInbox({
       engine: () => this.#conversationEngine(),
@@ -26706,6 +27308,7 @@ class Daemon {
       joined: () => this.#joined(),
       relation: (person) => this.#grants.relation(person),
       personGrant: (person) => this.#grants.personGrant(person),
+      reach: () => this.#grants.reach(),
       prefetch: (person) => this.#grants.prefetch(person),
       fresh: async (persons, fn) => {
         await this.#withFresh(persons, () => this.#tx(fn), { first: false });
@@ -27051,7 +27654,7 @@ class Daemon {
       },
       "device.list": () => {
         const result = this.#directory?.list() ?? this.#rosterDevices();
-        return { devices: result.devices.map((d) => d.self && this.#away() ? { ...d, away: true } : d) };
+        return { devices: result.devices.map((d) => this.#withFeatures(d.self && this.#away() ? { ...d, away: true } : d)) };
       },
       "device.remove": (p) => this.#homeDirectory("device.remove").remove(p),
       "device.link": (p) => this.#homeDirectory("device.link").link(p),
@@ -27095,10 +27698,10 @@ class Daemon {
       "inbox.ack": (p, ctx) => this.#ack(this.#bound(p, ctx), ctx),
       "task.create": (p, ctx) => this.#sendTask({ ...this.#bound(p, ctx), kind: "task" }),
       "task.continue": (p, ctx) => this.#sendTask({ ...this.#bound(p, ctx), kind: "message" }),
-      "task.list": (p, ctx) => this.#listTasks(this.#bound(p, ctx)),
-      "task.get": (p, ctx) => this.#getTask(this.#bound(p, ctx)),
-      "task.update": (p, ctx) => this.#updateTask(this.#bound(p, ctx)),
-      "task.cancel": (p, ctx) => this.#cancelTask(this.#bound(p, ctx)),
+      "task.list": (p, ctx) => this.#listTasks(this.#bound(p, ctx), ctx.tier === "admin"),
+      "task.get": (p, ctx) => this.#getTask(this.#bound(p, ctx), ctx.tier === "admin"),
+      "task.update": (p, ctx) => this.#updateTask(this.#bound(p, ctx), ctx.tier === "admin"),
+      "task.cancel": (p, ctx, authority) => p.token === undefined ? this.#cancelTask(this.#bound({ ...p, key: p.key }, ctx), ctx.tier === "admin") : this.#cancelByToken(p, p.token, this.#tokenView("task.cancel", ctx, authority)),
       "events.subscribe": (p, ctx) => {
         for (const key of p.keys)
           this.#bound({ key }, ctx);
@@ -27128,9 +27731,24 @@ class Daemon {
         this.#grants.check(p);
         return { sentence: grantSentence(p, this.#joined().me.person, this.#now()) };
       },
-      "request.list": async () => ({ requests: [...this.#holds.list().requests, ...await this.#requests.list(), ...this.#conversationInvitations.list()] }),
-      "request.answer": (p) => this.#conversationInvitations.holds(p.id) ? this.#conversationInvitations.answer(p.id, p.answer, p.all) : this.#requests.holds(p.id) ? this.#requests.answer(p) : this.#holds.answer(p),
-      "request.answer.preview": (p) => this.#answerPreview(p),
+      "reach.get": () => reachSnapshot(this.#grants),
+      "reach.set": (p) => reachSet(this.#grants, p),
+      "reach.set.preview": (p) => ({ sentence: reachPreview(this.#grants, p) }),
+      "request.list": async (_p, ctx, authority) => {
+        const requests = [...this.#holds.list().requests, ...await this.#requests.list(), ...this.#conversationInvitations.list()];
+        const view = actionView(ctx, authority, undefined);
+        return { requests: view === undefined ? requests : requests.map((request) => this.#withActions(request, view)) };
+      },
+      "request.answer": (p, ctx, authority) => {
+        this.#requestToken("request.answer", p, ctx, authority, "redeem");
+        const { token: _token, ...answer } = p;
+        return this.#conversationInvitations.holds(answer.id) ? this.#conversationInvitations.answer(answer.id, answer.answer, answer.all) : this.#requests.holds(answer.id) ? this.#requests.answer(answer) : this.#holds.answer(answer);
+      },
+      "request.answer.preview": (p, ctx, authority) => {
+        this.#requestToken("request.answer.preview", p, ctx, authority, "check");
+        const { token: _token, ...answer } = p;
+        return this.#answerPreview(answer);
+      },
       "contact.request": (p) => this.#requests.request(p),
       "contact.request.preview": (p) => this.#requests.preview(p),
       "card.get": async (p) => {
@@ -27147,6 +27765,9 @@ class Daemon {
       "notice.subscribe": (p, ctx, authority) => this.#notices.subscribe(ctx, p, authority?.scope === "host" ? authority.expiresAt : undefined),
       "notice.list": (p) => this.#notices.list(p),
       "notice.ack": (p) => this.#notices.ack(p),
+      "task.question": (p, ctx) => this.#setQuestion(this.#bound(p, ctx)),
+      "tasks.list": (p, ctx, authority) => this.#personTasks(p, actionView(ctx, authority, undefined)),
+      "tasks.get": (p, ctx, authority) => this.#personTaskGet(p, actionView(ctx, authority, undefined)),
       "device.remove.preview": (p) => this.#removePreview(p),
       ...this.#conversationIpc.handlers()
     };
@@ -27214,8 +27835,9 @@ class Daemon {
       this.#publish(event);
   }
   #emitTask(row, origin, update) {
-    const record = this.#withFollowUps(boundedRecord(row.record, TASK_BYTES));
+    const record = this.#taskView(this.#withFollowUps(boundedRecord(row.record, TASK_BYTES)));
     this.#emit({ type: "task", key: row.record.key, record, origin, ...update ? { update: structuredClone(update) } : {} });
+    this.#conversationIpc.taskChanged({ id: row.record.task.id, role: row.record.role });
   }
   #overBudget(before, after) {
     const size = jsonBytes(after);
@@ -27420,6 +28042,7 @@ class Daemon {
   #disconnected(ctx) {
     if (this.#closed)
       return;
+    this.#actions.disconnected(ctx.id);
     this.#notices.disconnected(ctx.id);
     let changed = false;
     for (const [key, lapsed] of [...this.#lapsed])
@@ -28335,6 +28958,8 @@ ${row.receipt ? "receipt" : "envelope"}`;
       };
       this.#store.putTask(row);
       this.#emitTask(row, "peer");
+      if (sender.person !== this.#joined().me.person)
+        this.#notices.task({ taskId, person: sender.person, at: now });
     } else if (executor) {
       executor.record.task.history = [...executor.record.task.history ?? [], message];
       executor.record.updatedAt = now;
@@ -28407,6 +29032,7 @@ ${row.receipt ? "receipt" : "envelope"}`;
     if (isTerminal(row.record.task.status.state))
       return this.#dropped("invalid_state", env.id);
     const status = { state: "TASK_STATE_CANCELED", timestamp: iso3(now) };
+    this.#questions.delete(row.record.task.id);
     row.record.task.status = status;
     row.record.updatedAt = now;
     this.#store.putTask(row);
@@ -28488,11 +29114,11 @@ ${row.receipt ? "receipt" : "envelope"}`;
     }
     throw new MessagingError("not_found", "no such task for this session");
   }
-  #getTask(p) {
+  async#getTask(p, owner) {
     for (const role of ["requester", "executor"]) {
       const row = this.#store.task(p.taskId, role);
       if (row && row.record.key === p.key)
-        return this.#withFollowUps(row.record);
+        return this.#withQuestion(await this.#viewNamed(this.#withFollowUps(row.record)), owner);
     }
     throw new MessagingError("not_found", "no such task for this session");
   }
@@ -28511,7 +29137,7 @@ ${row.receipt ? "receipt" : "envelope"}`;
     }));
     return { ...record, followUps };
   }
-  #listTasks(p) {
+  async#listTasks(p, owner) {
     const limit = p.limit ?? 50;
     const { rows, total, more } = this.#store.listTasks({
       key: p.key,
@@ -28535,13 +29161,14 @@ ${row.receipt ? "receipt" : "envelope"}`;
     }
     const last = tasks.at(-1);
     const truncated = tasks.length < rows.length;
+    await Promise.all([...new Set(tasks.map((t) => t.peer.person))].map((person) => this.#nameOf(person)));
     return {
-      tasks,
+      tasks: tasks.map((t) => this.#withQuestion(this.#taskView(t), owner)),
       total,
       ...(more || truncated) && last ? { nextCursor: encodeCursor({ updatedAt: last.updatedAt, taskId: last.task.id, role: last.role }) } : {}
     };
   }
-  async#updateTask(p) {
+  async#updateTask(p, owner) {
     this.#joined();
     const row = this.#ownTask(p.key, p.taskId, "executor");
     this.#refuseSecrets(p, "task.update", "task update");
@@ -28555,7 +29182,7 @@ ${row.receipt ? "receipt" : "envelope"}`;
     const now = this.#now();
     const status = statusChange ? {
       state: p.state,
-      ...p.message !== undefined ? { message: agentMessage(p.message.parts, task.id, task.contextId, now) } : {},
+      ...p.signIn !== undefined ? { message: signInMessage(agentMessage(p.message?.parts ?? [{ text: SIGN_IN_TEXT }], task.id, task.contextId, now), p.signIn.tool) } : p.message !== undefined ? { message: agentMessage(p.message.parts, task.id, task.contextId, now) } : {},
       timestamp: iso3(now)
     } : undefined;
     const after = structuredClone(row.record);
@@ -28581,6 +29208,7 @@ ${row.receipt ? "receipt" : "envelope"}`;
       }
       if (status) {
         const env = this.#seal("task.status", requester, session, { taskId: task.id, contextId, status }, { replyTo: request });
+        this.#questions.delete(task.id);
         task.status = status;
         row.record.updatedAt = now;
         this.#emitTask(row, "local", { status });
@@ -28590,12 +29218,63 @@ ${row.receipt ? "receipt" : "envelope"}`;
       this.#store.putTask(row);
     });
     await this.#settle(ids);
-    return boundedRecord(this.#store.task(p.taskId, "executor")?.record ?? row.record, TASK_BYTES);
+    return this.#withQuestion(await this.#viewNamed(boundedRecord(this.#store.task(p.taskId, "executor")?.record ?? row.record, TASK_BYTES)), owner);
   }
-  async#cancelTask(p) {
+  async#cancelTask(p, owner) {
     this.#joined();
-    const row = this.#ownTask(p.key, p.taskId, "requester");
-    this.#refuseSecrets(p, "task.cancel", "task cancel");
+    return this.#cancelRow(this.#ownTask(p.key, p.taskId, "requester"), p, owner);
+  }
+  #tokenView(method, ctx, authority) {
+    const view = actionView(ctx, authority, undefined);
+    if (view === undefined) {
+      this.#log("warn", "action.token.refused", { method, reason: "not the human tier" });
+      throw new MessagingError("forbidden", `${method} takes an action token only on the human tier`);
+    }
+    return view;
+  }
+  #requestToken(method, p, ctx, authority, use) {
+    if (p.token === undefined) {
+      if (this.#jellyHost === undefined)
+        return;
+      this.#log("warn", "action.token.refused", { method, reason: "missing" });
+      throw new MessagingError("grant_required", `${method} under a Jelly host needs the request's action token from request.list`);
+    }
+    this.#useToken(method, p.token, { name: p.answer, target: `request:${p.id}`, view: this.#tokenView(method, ctx, authority) }, use);
+  }
+  #useToken(method, token, want, use) {
+    try {
+      if (use === "redeem")
+        this.#actions.redeem(token, want);
+      else
+        this.#actions.check(token, want);
+    } catch (error) {
+      this.#log("warn", "action.token.refused", { method, reason: "no matching live token" });
+      throw error;
+    }
+  }
+  actionTokens() {
+    return this.#actions.size;
+  }
+  #withActions(request, view) {
+    if (request.kind === "contact" && request.state !== "pending")
+      return request;
+    const names = request.kind === "suggestion" ? ["decline"] : request.kind === "contact" ? ["accept", "decline", "block"] : request.kind === "agent-invitation" ? ["accept", "decline"] : ["once", "always", "decline", "block"];
+    return { ...request, actions: names.map((name) => ({ name, token: this.#actions.offer(view, name, `request:${request.id}`) })) };
+  }
+  taskCancel(row, role, view) {
+    return taskCancelAction(this.#actions, { id: row.record.task.id, role, ended: isTerminal(row.record.task.status.state) }, view);
+  }
+  async#cancelByToken(p, token, view) {
+    this.#joined();
+    this.#useToken("task.cancel", token, { name: "cancel", target: `task:${p.taskId}`, view }, "redeem");
+    const row = this.#store.task(p.taskId, "requester");
+    if (row === undefined)
+      throw new MessagingError("not_found", "no task this person's agent asked has that id");
+    return this.#cancelRow(row, p, true);
+  }
+  async#cancelRow(row, p, owner) {
+    const { token: _token, ...scanned } = p;
+    this.#refuseSecrets(scanned, "task.cancel", "task cancel");
     if (isTerminal(row.record.task.status.state))
       throw new MessagingError("invalid_state", "the task is in a terminal state");
     const env = this.#tx(() => {
@@ -28604,11 +29283,112 @@ ${row.receipt ? "receipt" : "envelope"}`;
       return env;
     });
     await this.#settle([env.id]);
-    return boundedRecord(this.#store.task(p.taskId, "requester")?.record ?? row.record, TASK_BYTES);
+    return this.#withQuestion(await this.#viewNamed(boundedRecord(this.#store.task(p.taskId, "requester")?.record ?? row.record, TASK_BYTES)), owner);
+  }
+  async#nameOf(person) {
+    const realm = this.#realm ?? this.#directory?.realm;
+    if (!realm)
+      return this.#named.get(person);
+    let named;
+    try {
+      const profile = await realm.profile(person);
+      named = { name: profile.name, org: profile.org };
+    } catch (error) {
+      if (!(error instanceof MessagingError) || error.code !== "not_found")
+        return this.#named.get(person);
+      named = { name: person, org: "none" };
+    }
+    if (this.#named.size >= NAMED_PERSONS && !this.#named.has(person))
+      this.#named.clear();
+    this.#named.set(person, named);
+    return named;
+  }
+  #taskView(record) {
+    const named = this.#named.get(record.peer.person);
+    if (named === undefined)
+      this.#nameOf(record.peer.person).catch(() => {
+        return;
+      });
+    return withTaskView(record, this.#me(), named);
+  }
+  #setQuestion(p) {
+    const row = this.#ownTask(p.key, p.taskId, "executor");
+    if (p.question === null) {
+      if (this.#questions.delete(p.taskId))
+        this.#conversationIpc.taskChanged({ id: p.taskId, role: "executor" });
+      return { ok: true };
+    }
+    if (!isInterrupted(row.record.task.status.state))
+      throw new MessagingError("invalid_state", "only a task in auth-required or input-required waits on a question");
+    const host = this.#store.sessionHost(p.key);
+    if (host !== undefined && host.sessionID !== p.question.sessionId)
+      throw new MessagingError("forbidden", "a question names the session's own host session");
+    this.#questions.set(p.taskId, { sessionId: p.question.sessionId, approvalId: p.question.approvalId });
+    this.#conversationIpc.taskChanged({ id: p.taskId, role: "executor" });
+    return { ok: true };
+  }
+  async#personTask(row, view) {
+    const record = this.#withQuestion(await this.#viewNamed(this.#withFollowUps(boundedRecord(row.record, TASK_BYTES))), true);
+    const { key: _key, ...rest } = record;
+    const cancel = this.taskCancel(row, row.record.role, view);
+    return { ...rest, session: this.#sessionName(row), ...cancel ? { cancel } : {} };
+  }
+  async#personTasks(p, view) {
+    const limit = p.limit ?? 50;
+    const key = p.session === undefined ? undefined : this.#store.sessionByName(p.session)?.key;
+    if (p.session !== undefined && key === undefined)
+      return { tasks: [], total: 0 };
+    const { rows, total, more } = this.#store.listTasks({
+      ...key !== undefined ? { key } : {},
+      role: p.role,
+      state: p.state,
+      after: p.cursor === undefined ? undefined : decodeCursor(p.cursor),
+      limit
+    });
+    const tasks = [];
+    let bytes = 0;
+    for (const row of rows) {
+      const task = await this.#personTask(row, view);
+      const size = jsonBytes(task);
+      if (tasks.length > 0 && bytes + size > LIST_BYTES)
+        break;
+      tasks.push(task);
+      bytes += size;
+    }
+    const last = tasks.at(-1);
+    return {
+      tasks,
+      total,
+      ...(more || tasks.length < rows.length) && last ? { nextCursor: encodeCursor({ updatedAt: last.updatedAt, taskId: last.task.id, role: last.role }) } : {}
+    };
+  }
+  async#personTaskGet(p, view) {
+    const rows = (p.role !== undefined ? [p.role] : ["requester", "executor"]).flatMap((role) => this.#store.task(p.taskId, role) ?? []);
+    if (rows.length === 0)
+      throw new MessagingError("not_found", "no task of this person's agents has that id");
+    if (rows.length > 1)
+      throw new MessagingError("invalid_request", "this device holds both sides of that task; supply role");
+    return await this.#personTask(rows[0], view);
+  }
+  async#personTaskEntry(id, role, ctx, authority) {
+    const row = this.#store.task(id, role);
+    return row ? await this.#personTask(row, actionView(ctx, authority, undefined)) : undefined;
+  }
+  #withQuestion(view, owner) {
+    const question = this.#questions.get(view.task.id);
+    if (!owner || question === undefined || view.role !== "executor" || !isInterrupted(view.task.status.state))
+      return view;
+    return { ...view, question: { ...question } };
+  }
+  async#viewNamed(record) {
+    return withTaskView(record, this.#me(), await this.#nameOf(record.peer.person).catch(() => {
+      return;
+    }));
   }
   sweep() {
     if (this.#closed)
       return;
+    this.#actions.sweep();
     this.#directory?.sweep();
     const now = this.#now();
     this.#expireTickets(now);
@@ -28663,6 +29443,7 @@ ${row.receipt ? "receipt" : "envelope"}`;
       message: agentMessage([{ text: INPUT_TIMEOUT_TEXT }], row.record.task.id, row.record.task.contextId, now),
       timestamp: iso3(now)
     };
+    this.#questions.delete(row.record.task.id);
     row.record.task.status = status;
     row.record.updatedAt = now;
     this.#store.putTask(row);
@@ -28670,26 +29451,7 @@ ${row.receipt ? "receipt" : "envelope"}`;
     this.#sendStatus(row);
   }
   async#ensureCurrent(persons) {
-    const own = this.#joined().me.person;
-    const others = [...new Set(persons)].filter((p) => p !== own);
-    if (!others.length)
-      return;
-    let outdated;
-    try {
-      outdated = (await this.#transport?.conversations?.convCaps?.(others))?.outdated ?? [];
-    } catch {
-      return;
-    }
-    if (!outdated.length)
-      return;
-    const handles = await Promise.all(outdated.map(async (p) => {
-      try {
-        return (await this.#joined().realm.profile(p)).handle;
-      } catch {
-        return p;
-      }
-    }));
-    throw new MessagingError("peer_outdated", `${handles.join(", ")} ${handles.length === 1 ? "needs" : "need"} to update Messaging`);
+    await ensureCurrent(this.#transport?.conversations, this.#joined().me.person, persons, async (p) => (await this.#joined().realm.profile(p)).handle);
   }
   conversations() {
     return this.#conversationEngine();
@@ -29059,6 +29821,13 @@ ${row.receipt ? "receipt" : "envelope"}`;
     const devices = realm.known(me.person).devices.map((d) => ({ device: d.machine, label: d.label, vouched: "admin", current: true, self: d.machine === identity.machine }));
     return { devices };
   }
+  #withFeatures(d) {
+    const raw = d.self ? [...FEATURES] : this.#store.directoryRow(d.device)?.presence.features;
+    if (raw === undefined)
+      return d;
+    const features = [...new Set(raw.filter((f) => PresenceFeature.safeParse(f).success))].slice(0, 32);
+    return { ...d, features };
+  }
   #away() {
     return this.#jellyHost !== undefined && !this.#attached;
   }
@@ -29094,10 +29863,37 @@ ${row.receipt ? "receipt" : "envelope"}`;
       throw new MessagingError("invalid_request", "the wake URL is not on the realm's Jelly ID");
     const agents = [...new Set(p.agents)];
     const awaiting = this.#store.awaitedRequests(agents, TERMINAL_STATES, WAKE_AWAITING);
-    const sent = await home.wake({ url: p.url, ticket: p.ticket, agents, awaiting });
+    const dms = await this.#wakeDms();
+    const sent = await home.wake({ url: p.url, ticket: p.ticket, agents, awaiting, dms });
     this.#wakeArmed = true;
-    this.#log("info", "wake.arm", { relay: sent === "sent" ? "armed" : "pending", agents: agents.length, awaiting: awaiting.length });
-    return { relay: sent === "sent" ? "armed" : "pending", awaiting: awaiting.length };
+    this.#log("info", "wake.arm", { relay: sent === "sent" ? "armed" : "pending", agents: agents.length, awaiting: awaiting.length, dms: dms.length });
+    return { relay: sent === "sent" ? "armed" : "pending", awaiting: awaiting.length, dms: dms.length };
+  }
+  async#wakeDms() {
+    const engine = this.#conversationEngine();
+    if (!engine)
+      return [];
+    const { me, realm } = this.#joined();
+    const orgs = new Map;
+    const orgOf = (person) => {
+      let org = orgs.get(person);
+      if (!org)
+        orgs.set(person, org = realm.profile(person).then((profile) => profile.org, () => "none"));
+      return org;
+    };
+    const candidates = teammateDms(engine.list(), me.person);
+    await realm.freshen?.(candidates.map((c) => c.person)).catch(() => {});
+    const dms = [];
+    for (const { cid, person } of candidates) {
+      if (dms.length >= WAKE_DMS)
+        break;
+      if (this.#shouldArm(person, await orgOf(person)))
+        dms.push(cid);
+    }
+    return dms;
+  }
+  #shouldArm(person, org) {
+    return wakeArmable(this.#grants, person, org);
   }
   async#wakeDisarm() {
     const home = this.#directory;
@@ -29782,6 +30578,9 @@ ${row.receipt ? "receipt" : "envelope"}`;
 function jsonBytes(value) {
   return Buffer.byteLength(JSON.stringify(value) ?? "");
 }
+function signInMessage(message, tool) {
+  return { ...message, metadata: { ...message.metadata, [URI.signIn]: { tool } }, extensions: [...message.extensions ?? [], URI.signIn] };
+}
 function boundedRecord(record, limit) {
   if (jsonBytes(record) <= limit)
     return structuredClone(record);
@@ -29879,7 +30678,7 @@ function signInToken(token) {
     return false;
   }
 }
-var DAY3 = 86400000, KEYCHAIN_LEFTOVERS_KEY = "keychain.stale", DEFAULT_TUNING, KEPT_MS, INPUT_TIMEOUT_MS, TASK_BYTES = 1048576, PREDECESSOR_KEY = "identity.predecessor", REPLACE_LABEL_KEY = "identity.replace.label", REPLACED_KEY = "identity.replaced", ERASURES_PER_DAY = 10, DEVICE_NOTICES_KEY = "notice.devices.seq", TRUST_NOTICE_MS, DEVICES_CHANGED_MS, MACHINE_KEY = "identity.machine", DEFAULT_INVITE_TTL_MS, LIST_BYTES = 1572864;
+var DAY3 = 86400000, KEYCHAIN_LEFTOVERS_KEY = "keychain.stale", DEFAULT_TUNING, KEPT_MS, INPUT_TIMEOUT_MS, TASK_BYTES = 1048576, PREDECESSOR_KEY = "identity.predecessor", REPLACE_LABEL_KEY = "identity.replace.label", REPLACED_KEY = "identity.replaced", ERASURES_PER_DAY = 10, DEVICE_NOTICES_KEY = "notice.devices.seq", TRUST_NOTICE_MS, DEVICES_CHANGED_MS, MACHINE_KEY = "identity.machine", DEFAULT_INVITE_TTL_MS, LIST_BYTES = 1572864, NAMED_PERSONS = 1000;
 var init_daemon = __esm(() => {
   init_dist();
   init_dist2();
@@ -29908,6 +30707,7 @@ var init_daemon = __esm(() => {
   init_answer_preview();
   init_snapshot();
   init_notices();
+  init_task_view();
   init_resolve();
   init_secrets();
   init_roster_sync();
@@ -29916,10 +30716,13 @@ var init_daemon = __esm(() => {
   init_tasks2();
   init_version();
   init_wake_bridge();
+  init_action_tokens();
   init_grants();
   init_holds();
   init_cards2();
   init_requests2();
+  init_reach();
+  init_conv_caps();
   init_sentence();
   DEFAULT_TUNING = {
     presenceMinMs: 2000,
@@ -30035,6 +30838,15 @@ CREATE TABLE IF NOT EXISTS conv_request_decisions (
   decision TEXT NOT NULL,
   PRIMARY KEY (realm, id)
 );
+`,
+    `
+CREATE TABLE IF NOT EXISTS dir_wake_dms (
+  device TEXT NOT NULL,
+  cid TEXT NOT NULL,
+  exp INTEGER NOT NULL,
+  PRIMARY KEY (device, cid)
+);
+CREATE INDEX IF NOT EXISTS dir_wake_dms_exp ON dir_wake_dms (exp);
 `
   ];
   RELAY_SCHEMA = 1 + MIGRATIONS2.length;
@@ -30350,7 +31162,7 @@ class RelayClient {
     return this.#dir("dir.ok", { t: "presence.watch", persons });
   }
   wakeArm(arm) {
-    return this.#dir("dir.ok", { t: "wake.arm", url: arm.url, ticket: arm.ticket, agents: arm.agents, awaiting: arm.awaiting });
+    return this.#dir("dir.ok", { t: "wake.arm", url: arm.url, ticket: arm.ticket, agents: arm.agents, awaiting: arm.awaiting, ...arm.dms ? { dms: arm.dms } : {} });
   }
   wakeDisarm() {
     return this.#dir("dir.ok", { t: "wake.disarm" });
@@ -31308,6 +32120,7 @@ var HINTS = {
   login_denied: "the sign-in was denied at Jelly ID; run messaging login again if it was you, or check the account.",
   log_conflict: "retry: the device log changed at the same time.",
   conv_conflict: "retry: the conversation changed at the same time.",
+  conflict: "your settings changed at the same time: run the command again to see them, then choose again.",
   stale_epoch: "retry: the conversation's keys changed at the same time.",
   device_limit: "remove one of this person's devices first.",
   admission_required: "bind this device from Jelly, or approve it from one of your Jelly devices.",
@@ -31951,6 +32764,72 @@ var grant2 = {
 function optional2(key, value) {
   return value === undefined ? {} : { [key]: value };
 }
+function choiceLabel(group, value) {
+  return group.options.find((o) => o.value === value)?.label ?? value;
+}
+function printReach(ctx, snapshot) {
+  ctx.out.lines(table(["QUESTION", "CHOICE", "MEANS"], snapshot.groups.map((g) => {
+    const option = g.options.find((o) => o.value === (g.value ?? "ask"));
+    return [g.label, g.value === null ? `${choiceLabel(g, "ask")} (the default)` : choiceLabel(g, g.value), option?.description ?? ""];
+  }), ctx.out.style));
+  for (const g of snapshot.groups) {
+    if (g.lapsed !== undefined)
+      ctx.out.line(ctx.out.style.yellow(`${g.label}: ${choiceLabel(g, g.lapsed)} lapsed with the device that chose it; choose again.`));
+  }
+}
+var reach = {
+  name: "reach",
+  summary: "Show or set who can message you and how agents may ask yours: open, ask (me first) or never",
+  usage: "[--message open|ask|never] [--ask open|ask|never] [--dry-run]",
+  details: [
+    "--message (Who can message you) is for people outside your org: open lets anyone message you; ask (the default)",
+    "has them send a message request first; never refuses them and their requests. Your org can always message you.",
+    "--ask (How agents may ask yours) is for your teammates' agents: open lets them ask your agents without asking you",
+    "(guarded); ask (the default) holds each request for you (messaging requests); never refuses them. Agents of people",
+    "outside your org never may. A grant you set for one person (messaging grant) wins over either choice.",
+    "With no option it shows your choices. --dry-run prints what the change would do and changes nothing.",
+    "A device of yours on an older Messaging release does not enforce these choices: update every device."
+  ].join(`
+`),
+  options: {
+    message: { type: "string", value: "open|ask|never", description: "Who can message you (people outside your org)" },
+    ask: { type: "string", value: "open|ask|never", description: "How your teammates' agents may ask yours" },
+    "dry-run": { type: "boolean", description: "Print what it would do and change nothing" }
+  },
+  args: { min: 0, max: 0 },
+  async run(ctx, _positionals, values) {
+    const changes = {
+      ...optional2("message", levelOption(values, "message", ReachValue, "open, ask or never")),
+      ...optional2("ask", levelOption(values, "ask", ReachValue, "open, ask or never"))
+    };
+    const none = Object.keys(changes).length === 0;
+    if (none && values["dry-run"] === true)
+      throw new UsageError("--dry-run goes with --message or --ask");
+    const client = await ctx.client();
+    const shown = await client.call("reach.get", {});
+    if (none) {
+      if (ctx.json)
+        return ctx.out.json(shown);
+      printReach(ctx, shown);
+      ctx.out.note("Change with: messaging reach --message open|ask|never --ask open|ask|never");
+      return;
+    }
+    const params = { revision: shown.revision, changes };
+    const { sentence } = await client.call("reach.set.preview", params);
+    if (values["dry-run"] === true) {
+      if (ctx.json)
+        ctx.out.json({ sentence });
+      else
+        ctx.out.line(sentence);
+      return;
+    }
+    const result = await client.call("reach.set", params);
+    if (ctx.json)
+      return ctx.out.json({ sentence, ...result });
+    ctx.out.line(sentence);
+    printReach(ctx, result);
+  }
+};
 var requests2 = {
   name: "requests",
   summary: "List the requests waiting for you, or answer one: once, always, accept, decline or block",
@@ -31986,7 +32865,7 @@ var requests2 = {
       throw new UsageError("--all goes with `requests answer`");
     const { requests: held } = await client.call("request.list", {});
     if (ctx.json) {
-      ctx.out.json({ requests: held });
+      ctx.out.json({ requests: held.map(({ actions: _actions, ...request }) => request) });
       return;
     }
     if (held.length === 0) {
@@ -32072,7 +32951,7 @@ var card = {
     ctx.out.line(sent ? "Asked. Their card comes when one of their devices answers." : "You asked them in the last day; their card comes when they answer.");
   }
 };
-var CONSENT_COMMANDS = [grants, grant2, requests2, contact, card];
+var CONSENT_COMMANDS = [grants, grant2, reach, requests2, contact, card];
 
 // packages/daemon/dist/cli/commands/daemon.js
 init_dist();
@@ -32941,6 +33820,8 @@ function conversationEvent(event) {
       return { type: event.type };
     case "gap":
       return { type: event.type, pos: event.pos };
+    case "task":
+      return { type: event.type, task: event.task.task.id, role: event.task.role, state: event.task.task.status.state };
   }
 }
 async function syncConversations(client, ctx, position) {
@@ -34031,7 +34912,7 @@ var SECTIONS = [
   ["Daemon", ["daemon start", "daemon stop", "status"]],
   ["Team", ["team prepare", "team create", "team card", "team invite", "team join", "team pair", "team add", "team claim", "team pair-cancel", "team members", "team remove", "team role", "team revoke-invite"]],
   ["Identity", ["identity show", "identity migrate", "identity rotate-enc", "identity replace", "erase"]],
-  ["People", ["login", "people", "devices", "grants", "grant", "requests", "contact", "card", "notices"]],
+  ["People", ["login", "people", "devices", "grants", "grant", "reach", "requests", "contact", "card", "notices"]],
   ["Messages", ["who", "send", "inbox", "read"]],
   ["Chats", ["chat list", "chat read", "chat post", "chat search"]],
   ["Tasks", ["tasks", "task", "cancel"]],