@joe-broadhead/messaging 0.8.0 → 0.9.0

package/dist/bin/messagingd.js

@@ -5868,7 +5868,8 @@ var init_common = __esmMin((() => {
 	URI = {
 		binding: "urn:messaging:binding:relay:v1",
 		provenance: "urn:messaging:ext:provenance:v1",
-		presence: "urn:messaging:ext:presence:v1"
+		presence: "urn:messaging:ext:presence:v1",
+		signIn: "urn:messaging:ext:sign-in:v1"
 	};
 	Base64Url = string$1().regex(/^[A-Za-z0-9_-]*$/, "base64url without padding");
 	Key32 = string$1().regex(/^[A-Za-z0-9_-]{43}$/, "32 bytes, base64url without padding");
@@ -6039,6 +6040,7 @@ var init_errors = __esmMin((() => {
 		"jelly_unavailable",
 		"log_conflict",
 		"conv_conflict",
+		"conflict",
 		"stale_epoch",
 		"device_limit",
 		"admission_required",
@@ -6345,7 +6347,7 @@ var init_directory$2 = __esmMin((() => {
 	});
 }));
 // packages/core/dist/schema/a2a.js
-var Struct, TaskState, TERMINAL_STATES, Role, Part$1, Message, TaskStatus, Artifact, Task$1, TaskStatusUpdateEvent, TaskArtifactUpdateEvent;
+var Struct, TaskState, TERMINAL_STATES, INTERRUPTED_STATES, Role, Part$1, Message, TaskStatus, Artifact, Task$1, TaskStatusUpdateEvent, TaskArtifactUpdateEvent;
 var init_a2a = __esmMin((() => {
 	init_zod();
 	Struct = record(string$1(), unknown());
@@ -6365,6 +6367,7 @@ var init_a2a = __esmMin((() => {
 		"TASK_STATE_CANCELED",
 		"TASK_STATE_REJECTED"
 	];
+	INTERRUPTED_STATES = ["TASK_STATE_INPUT_REQUIRED", "TASK_STATE_AUTH_REQUIRED"];
 	Role = _enum(["ROLE_USER", "ROLE_AGENT"]);
 	Part$1 = object$1({
 		text: string$1().optional(),
@@ -7029,6 +7032,12 @@ var init_conversation = __esmMin((() => {
 function grantProblem(grant) {
 	const own = "person" in grant.subject && grant.subject.person === grant.person;
 	if ("conv" in grant.subject && (grant.chat !== void 0 || grant.trustedUntil !== void 0 || grant.discoverable !== void 0)) return "a conversation grant sets only ask and agentMail";
+	if ("relation" in grant.subject) {
+		if (grant.agentMail !== void 0 || grant.trustedUntil !== void 0 || grant.discoverable !== void 0) return "a relation grant sets only chat or ask";
+		if (grant.subject.relation === "outside" && grant.ask !== void 0) return "the outside relation grant sets only chat";
+		if (grant.subject.relation === "outside" && grant.chat === "muted") return "the outside relation grant sets chat open or blocked";
+		if (grant.subject.relation === "org" && grant.chat !== void 0) return "the org relation grant sets only ask";
+	}
 	if (own && (grant.chat !== void 0 || grant.agentMail !== void 0 || grant.ask !== void 0 || grant.trustedUntil !== void 0)) return "a grant about its own person sets only discoverable";
 	if (!own && grant.discoverable !== void 0) return "discoverable is set only on a grant about its own person";
 	if (grant.trustedUntil !== void 0) {
@@ -7041,7 +7050,7 @@ function cardProblem(card) {
 	if (card.from === card.to) return "a card is about another person";
 	if (card.can.trustedUntil !== void 0 && card.can.ask !== "open") return "trustedUntil needs ask open";
 }
-var ChatLevel, AgentMailLevel, AskLevel, GrantSubject, ConsentGrant, GrantSync, CardCan, ContactCard, CardData, CardGetData;
+var ChatLevel, AgentMailLevel, AskLevel, GrantRelation, GrantSubject, ConsentGrant, GrantSync, CardCan, ContactCard, CardData, CardGetData;
 var init_consent$2 = __esmMin((() => {
 	init_zod();
 	init_common();
@@ -7058,7 +7067,12 @@ var init_consent$2 = __esmMin((() => {
 		"request",
 		"no"
 	]);
-	GrantSubject = union$1([strictObject({ person: PersonId }), strictObject({ conv: ConvId })]);
+	GrantRelation = _enum(["outside", "org"]);
+	GrantSubject = union$1([
+		strictObject({ person: PersonId }),
+		strictObject({ conv: ConvId }),
+		strictObject({ relation: GrantRelation })
+	]);
 	ConsentGrant = object$1({
 		v: literal(PROTOCOL),
 		realm: RealmId,
@@ -7520,6 +7534,7 @@ var init_directory_frames = __esmMin((() => {
 	init_common();
 	init_directory$2();
 	init_realm$1();
+	init_conversation();
 	init_jelly$3();
 	Req$1 = string$1().min(1).max(64);
 	Size = number$1().int().positive();
@@ -7617,7 +7632,8 @@ var init_directory_frames = __esmMin((() => {
 		url: WakeUrl,
 		ticket: Jws.refine((ticket) => ticket.length <= WAKE_TICKET_BYTES, { message: `at most ${WAKE_TICKET_BYTES} bytes` }),
 		agents: array(SessionName).max(64),
-		awaiting: array(Ulid).max(500)
+		awaiting: array(Ulid).max(500),
+		dms: array(ConvId).max(256).optional()
 	});
 	WakeDisarmFrame = object$1({
 		t: literal("wake.disarm"),
@@ -7708,7 +7724,7 @@ var init_directory_frames = __esmMin((() => {
 	]);
 }));
 // packages/core/dist/schema/ipc/device.js
-var BindingState, RealmAlarmSummary, DeviceStatus, DeviceChangeView, DeviceListEntry, LinkText, Sas, LinkPreview, KeyFingerprint, LoginUserCode, LoginPurpose, LoginKind, LoginShown, LoginState, DeviceRemoveParams, DeviceApproveParams, IdentityReplaceParams, SignInStep, DirectoryEraseParams, DEVICE_METHODS;
+var BindingState, RealmAlarmSummary, DeviceStatus, DeviceChangeView, PresenceFeature, DeviceListEntry, LinkText, Sas, LinkPreview, KeyFingerprint, LoginUserCode, LoginPurpose, LoginKind, LoginShown, LoginState, DeviceRemoveParams, DeviceApproveParams, IdentityReplaceParams, SignInStep, DirectoryEraseParams, DEVICE_METHODS;
 var init_device = __esmMin((() => {
 	init_zod();
 	init_common();
@@ -7759,6 +7775,7 @@ var init_device = __esmMin((() => {
 		approver: MachineLabel.optional(),
 		at: Millis
 	});
+	PresenceFeature = string$1().regex(/^[a-z][a-z0-9-]{0,31}$/, "a feature name");
 	DeviceListEntry = object$1({
 		device: MachineId,
 		label: MachineLabel,
@@ -7777,7 +7794,8 @@ var init_device = __esmMin((() => {
 			at: Millis,
 			reason: UnbindReason,
 			by: MachineId
-		}).optional()
+		}).optional(),
+		features: array(PresenceFeature).max(32).optional()
 	});
 	LinkText = string$1().min(1).max(2048);
 	Sas = string$1().regex(/^[0-9]{6}$/, "six digits");
@@ -7984,7 +8002,10 @@ var init_device = __esmMin((() => {
 	};
 }));
 // packages/core/dist/schema/ipc/shapes.js
-var SessionKey, SendExpect, DirectoryEntry, PeerRef, InboxItem, TaskFollowUp, TaskRecord, SendTarget, SendResult;
+function taskViewRules(schema) {
+	return schema.refine((r) => r.signIn === void 0 || r.task.status.state === "TASK_STATE_AUTH_REQUIRED", "signIn is for an AUTH_REQUIRED task").refine((r) => r.refusal === void 0 || r.task.status.state === "TASK_STATE_REJECTED", "refusal is for a REJECTED task").refine((r) => r.question === void 0 || r.role === "executor" && (r.task.status.state === "TASK_STATE_AUTH_REQUIRED" || r.task.status.state === "TASK_STATE_INPUT_REQUIRED"), "question is for the executor's side of an AUTH_REQUIRED or INPUT_REQUIRED task");
+}
+var SessionKey, ActionToken, SendExpect, DirectoryEntry, PeerRef, InboxItem, TaskFollowUp, TASK_SIGN_IN_TOOL_CHARS, TASK_REFUSAL_CHARS, HostLocalId, TaskQuestion, TaskRecordFields, TaskRecord, PersonTask, SendTarget, SendResult;
 var init_shapes = __esmMin((() => {
 	init_zod();
 	init_a2a();
@@ -7993,6 +8014,7 @@ var init_shapes = __esmMin((() => {
 	init_delegation$2();
 	init_errors();
 	SessionKey = string$1().min(1).max(200);
+	ActionToken = string$1().regex(/^[A-Za-z0-9_-]{43}$/, "action token");
 	SendExpect = _enum([
 		"next_turn",
 		"wake",
@@ -8063,7 +8085,14 @@ var init_shapes = __esmMin((() => {
 		stage: DeliveryStage,
 		at: Millis
 	});
-	TaskRecord = object$1({
+	TASK_SIGN_IN_TOOL_CHARS = LIMITS.previewChars;
+	TASK_REFUSAL_CHARS = LIMITS.requestChars;
+	HostLocalId = string$1().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/, "a plain identifier of at most 200 characters");
+	TaskQuestion = strictObject({
+		sessionId: HostLocalId,
+		approvalId: HostLocalId
+	});
+	TaskRecordFields = object$1({
 		task: Task$1.extend({ id: Ulid }),
 		role: _enum(["requester", "executor"]),
 		key: SessionKey.describe("local session that owns this side of the task"),
@@ -8071,8 +8100,33 @@ var init_shapes = __esmMin((() => {
 		createdAt: Millis,
 		updatedAt: Millis,
 		chain: DelegationSummary.optional(),
-		followUps: array(TaskFollowUp).min(1).max(LIMITS.taskFollowUps).optional()
-	});
+		followUps: array(TaskFollowUp).min(1).max(LIMITS.taskFollowUps).optional(),
+		agent: SessionName.optional(),
+		person: object$1({
+			id: PersonId,
+			name: string$1().max(200)
+		}).optional(),
+		org: _enum([
+			"same",
+			"other",
+			"none"
+		]).optional(),
+		signIn: object$1({
+			tool: string$1().min(1).max(TASK_SIGN_IN_TOOL_CHARS).optional(),
+			by: _enum(["you", "them"])
+		}).optional(),
+		refusal: object$1({ reason: string$1().min(1).max(TASK_REFUSAL_CHARS) }).optional(),
+		question: TaskQuestion.optional()
+	});
+	TaskRecord = taskViewRules(TaskRecordFields);
+	PersonTask = taskViewRules(TaskRecordFields.omit({ key: true }).extend({
+		key: never().optional(),
+		session: SessionName.describe("this person's agent on this device that holds this side of the task"),
+		cancel: strictObject({
+			name: literal("cancel"),
+			token: ActionToken
+		}).optional()
+	})).refine((r) => r.cancel === void 0 || r.role === "requester", "cancel is for the requester side");
 	SendTarget = SessionAddress;
 	SendResult = object$1({
 		to: SendTarget,
@@ -8086,13 +8140,14 @@ var init_shapes = __esmMin((() => {
 	});
 }));
 // packages/core/dist/schema/ipc/consent.js
-var GrantTarget, Levels, GrantView, GrantReview, GrantSetParams, AskRequest, ContactRequestView, AgentInvitationRequest, ContactSuggestion, HeldRequest, RequestAnswer, RequestText, PersonReach, RequestAnswerParams, ContactRequestParams, CONSENT_METHODS;
+var GrantTarget, Levels, GrantView, GrantReview, GrantSetParams, RequestAnswer, RequestAction, Actions, AskRequest, ContactRequestView, AgentInvitationRequest, ContactSuggestion, HeldRequest, RequestText, PersonReach, RequestAnswerParams, ContactRequestParams, ReachGroupId, ReachValue, ReachOption, ReachGroup, ReachSnapshot, ReachSetParams, REACH_QUESTIONS, CONSENT_METHODS;
 var init_consent$1 = __esmMin((() => {
 	init_zod();
 	init_common();
 	init_conversation();
 	init_consent$2();
 	init_directory_frames();
+	init_shapes();
 	GrantTarget = union$1([strictObject({ person: PersonId }), strictObject({ conv: ConvId })]);
 	Levels = {
 		chat: ChatLevel.optional(),
@@ -8123,6 +8178,18 @@ var init_consent$1 = __esmMin((() => {
 		...Levels,
 		trust: literal(true).optional()
 	});
+	RequestAnswer = _enum([
+		"once",
+		"always",
+		"accept",
+		"decline",
+		"block"
+	]);
+	RequestAction = strictObject({
+		name: RequestAnswer,
+		token: ActionToken
+	});
+	Actions = { actions: array(RequestAction).max(4).optional() };
 	AskRequest = object$1({
 		id: Ulid,
 		kind: _enum(["message", "task"]),
@@ -8136,7 +8203,8 @@ var init_consent$1 = __esmMin((() => {
 		to: SessionName,
 		preview: string$1().max(LIMITS.previewChars),
 		at: Millis,
-		exp: Millis
+		exp: Millis,
+		...Actions
 	});
 	ContactRequestView = object$1({
 		id: Ulid,
@@ -8162,7 +8230,8 @@ var init_consent$1 = __esmMin((() => {
 		}),
 		text: string$1().max(LIMITS.requestChars),
 		at: Millis,
-		exp: Millis
+		exp: Millis,
+		...Actions
 	});
 	AgentInvitationRequest = strictObject({
 		kind: literal("agent-invitation"),
@@ -8170,14 +8239,16 @@ var init_consent$1 = __esmMin((() => {
 		cid: ConvId,
 		from: ParticipantId,
 		to: ParticipantId,
-		at: Millis
+		at: Millis,
+		...Actions
 	});
 	ContactSuggestion = object$1({
 		id: Ulid,
 		kind: literal("suggestion"),
 		agent: SessionName,
 		email: Email,
-		at: Millis
+		at: Millis,
+		...Actions
 	});
 	HeldRequest = union$1([
 		AskRequest,
@@ -8185,13 +8256,6 @@ var init_consent$1 = __esmMin((() => {
 		ContactSuggestion,
 		AgentInvitationRequest
 	]);
-	RequestAnswer = _enum([
-		"once",
-		"always",
-		"accept",
-		"decline",
-		"block"
-	]);
 	RequestText = string$1().min(1).refine((text) => text.length <= LIMITS.requestChars, { message: `at most ${LIMITS.requestChars} UTF-16 code units` });
 	PersonReach = object$1({
 		person: PersonId,
@@ -8203,14 +8267,98 @@ var init_consent$1 = __esmMin((() => {
 	RequestAnswerParams = strictObject({
 		id: Ulid,
 		answer: RequestAnswer,
-		all: boolean().optional()
-	});
+		all: boolean().optional(),
+		token: ActionToken.optional()
+	}).refine((p) => p.token === void 0 || p.all !== true, "an action token answers one request: drop all");
 	ContactRequestParams = strictObject({
 		email: Email,
 		text: RequestText,
 		suggestion: Ulid.optional()
 	});
+	ReachGroupId = _enum(["message", "ask"]);
+	ReachValue = _enum([
+		"open",
+		"ask",
+		"never"
+	]);
+	ReachOption = object$1({
+		value: ReachValue,
+		label: string$1().max(40),
+		description: string$1().max(300)
+	});
+	ReachGroup = object$1({
+		id: ReachGroupId,
+		label: string$1().max(80),
+		options: array(ReachOption).length(3),
+		value: ReachValue.nullable(),
+		lapsed: ReachValue.optional()
+	});
+	ReachSnapshot = object$1({
+		revision: string$1().min(1).max(64),
+		available: boolean(),
+		groups: array(ReachGroup).length(2)
+	});
+	ReachSetParams = strictObject({
+		revision: string$1().min(1).max(64),
+		changes: strictObject({
+			message: ReachValue.optional(),
+			ask: ReachValue.optional()
+		})
+	});
+	REACH_QUESTIONS = [{
+		id: "message",
+		label: "Who can message you",
+		options: [
+			{
+				value: "open",
+				label: "Open",
+				description: "Anyone outside your org may message you."
+			},
+			{
+				value: "ask",
+				label: "Ask me first",
+				description: "People outside your org send a message request first, and you accept or decline it. People you have accepted may message you."
+			},
+			{
+				value: "never",
+				label: "Never",
+				description: "No one outside your org may message you or send you a request. Your org, and people you have let message you, still can."
+			}
+		]
+	}, {
+		id: "ask",
+		label: "How agents may ask yours",
+		options: [
+			{
+				value: "open",
+				label: "Open",
+				description: "Your teammates' agents may ask your agents without asking you. Their requests run guarded."
+			},
+			{
+				value: "ask",
+				label: "Ask me first",
+				description: "Each request from a teammate's agent to yours waits for your answer."
+			},
+			{
+				value: "never",
+				label: "Never",
+				description: "Your teammates' agents may not ask yours. Agents of people outside your org never may."
+			}
+		]
+	}];
 	CONSENT_METHODS = {
+		"reach.get": {
+			params: strictObject({}),
+			result: ReachSnapshot
+		},
+		"reach.set": {
+			params: ReachSetParams,
+			result: ReachSnapshot
+		},
+		"reach.set.preview": {
+			params: ReachSetParams,
+			result: object$1({ sentence: string$1().max(500) })
+		},
 		"grant.list": {
 			params: strictObject({ subject: GrantTarget.optional() }),
 			result: object$1({
@@ -8391,6 +8539,7 @@ var init_jelly$2 = __esmMin((() => {
 		}).optional(),
 		line: string$1().max(120).optional(),
 		device: NoticeDevice.optional(),
+		key: string$1().regex(/^task:[0-9A-HJKMNP-TV-Z]{26}$/, "task:<task id>").optional(),
 		at: Millis
 	});
 	NoticeCounts = object$1({ requests: number$1().int().nonnegative() });
@@ -8461,7 +8610,8 @@ var init_jelly$2 = __esmMin((() => {
 			}),
 			result: object$1({
 				relay: _enum(["armed", "pending"]),
-				awaiting: number$1().int().nonnegative()
+				awaiting: number$1().int().nonnegative(),
+				dms: number$1().int().nonnegative()
 			})
 		},
 		"wake.disarm": {
@@ -8506,6 +8656,7 @@ var init_conversation_views = __esmMin((() => {
 	init_common();
 	init_conversation();
 	init_a2a();
+	init_shapes();
 	Count$2 = number$1().int().nonnegative().safe();
 	Seq$1 = number$1().int().nonnegative().safe();
 	Name = string$1().max(200);
@@ -8581,7 +8732,11 @@ var init_conversation_views = __esmMin((() => {
 	});
 	TaskView = object$1({
 		id: Ulid,
-		state: TaskState
+		state: TaskState,
+		cancel: strictObject({
+			name: literal("cancel"),
+			token: ActionToken
+		}).optional()
 	});
 	EventView = object$1({
 		cid: ConvId,
@@ -8740,6 +8895,11 @@ var init_conversation_views = __esmMin((() => {
 		object$1({
 			type: literal("gap"),
 			pos: Seq$1
+		}),
+		object$1({
+			type: literal("task"),
+			pos: Seq$1,
+			task: PersonTask
 		})
 	]).refine((entry) => entry.type !== "event.update" || entry.cid === entry.event.cid && entry.id === entry.event.id, { message: "event.update names the same conversation and event as its projection" });
 }));
@@ -8855,7 +9015,12 @@ var init_conversations = __esmMin((() => {
 		at: Millis,
 		cid: ConvId.optional(),
 		agent: SessionName.optional(),
-		state: _enum(["held", "pending-delivery"])
+		state: _enum([
+			"held",
+			"pending-delivery",
+			"resend",
+			"outdated"
+		])
 	});
 	ConvListParams = strictObject({
 		key: Key,
@@ -9497,16 +9662,47 @@ var init_ipc = __esmMin((() => {
 				message: strictObject({ parts: array(Part$1).min(1).max(LIMITS.partsPerMessage) }).optional(),
 				artifact: Artifact.optional(),
 				append: boolean().optional(),
-				lastChunk: boolean().optional()
-			}),
+				lastChunk: boolean().optional(),
+				signIn: strictObject({ tool: string$1().min(1).max(TASK_SIGN_IN_TOOL_CHARS) }).optional()
+			}).refine((p) => p.signIn === void 0 || p.state === "TASK_STATE_AUTH_REQUIRED", "signIn goes with TASK_STATE_AUTH_REQUIRED"),
 			result: TaskRecord
 		},
-		"task.cancel": {
+		"task.question": {
 			params: strictObject({
 				key: SessionKey,
 				taskId: Ulid,
-				reason: string$1().max(1e3).optional()
+				question: TaskQuestion.nullable()
+			}),
+			result: object$1({ ok: literal(true) })
+		},
+		"tasks.list": {
+			params: strictObject({
+				role: _enum(["requester", "executor"]).optional(),
+				state: TaskState.optional(),
+				session: SessionName.optional().describe("only this agent's tasks"),
+				cursor: string$1().min(1).max(200).optional().describe("opaque; from a previous nextCursor"),
+				limit: number$1().int().min(1).max(100).optional()
+			}),
+			result: object$1({
+				tasks: array(PersonTask),
+				nextCursor: string$1().max(200).optional().describe("absent when there are no more pages"),
+				total: number$1().int().nonnegative()
+			})
+		},
+		"tasks.get": {
+			params: strictObject({
+				taskId: Ulid,
+				role: _enum(["requester", "executor"]).optional()
 			}),
+			result: PersonTask
+		},
+		"task.cancel": {
+			params: strictObject({
+				key: SessionKey.optional(),
+				taskId: Ulid,
+				reason: string$1().max(1e3).optional(),
+				token: ActionToken.optional()
+			}).refine((p) => p.key === void 0 !== (p.token === void 0), "give exactly one of key or token"),
 			result: TaskRecord
 		},
 		"events.subscribe": {
@@ -9659,7 +9855,8 @@ var init_ipc = __esmMin((() => {
 		"task.list",
 		"task.get",
 		"task.update",
-		"task.cancel"
+		"task.cancel",
+		"task.question"
 	];
 	HUMAN_METHODS = [
 		...conversationTier("human"),
@@ -9668,6 +9865,9 @@ var init_ipc = __esmMin((() => {
 		"grant.list",
 		"grant.set",
 		"grant.set.preview",
+		"reach.get",
+		"reach.set",
+		"reach.set.preview",
 		"request.list",
 		"request.answer",
 		"request.answer.preview",
@@ -9677,6 +9877,8 @@ var init_ipc = __esmMin((() => {
 		"notice.subscribe",
 		"notice.list",
 		"notice.ack",
+		"tasks.list",
+		"tasks.get",
 		"device.approve.preview",
 		"device.remove.preview",
 		"identity.replace.preview",
@@ -9842,7 +10044,8 @@ var init_conv_frames = __esmMin((() => {
 	ConvCapabilitiesFrame = strictObject({
 		t: literal("conv.capabilities"),
 		req: Req,
-		outdated: array(PersonId).max(LIMITS.convOpParticipants)
+		outdated: array(PersonId).max(LIMITS.convOpParticipants),
+		unknown: array(PersonId).min(1).max(LIMITS.convOpParticipants).optional()
 	});
 	ConvPushFrame = union$1([strictObject({
 		t: literal("conv.push"),
@@ -10055,6 +10258,11 @@ var init_agent_tools = __esmMin((() => {
 		titleAuthor: Author$1.optional().describe("With title: who wrote the request; ours when you asked (mine)"),
 		status: authored("The latest status message").optional(),
 		statusAuthor: Author$1.optional().describe("With status: who wrote it; ours when you run the task (asked)"),
+		signIn: object$1({
+			tool: authored("The tool the executor named").optional(),
+			by: _enum(["you", "them"]).describe("Whose sign-in it is: you (your person, for an agent of theirs) or them (the other person); your Messaging daemon decides, never the peer")
+		}).optional().describe("auth_required only: the task waits on a sign-in; the tool was written by the executor, as statusAuthor says"),
+		refusal: object$1({ reason: authored("The executor's reason") }).optional().describe("rejected only: why the executor declined, in its words, as statusAuthor says"),
 		createdAt: iso$1,
 		updatedAt: iso$1,
 		consent: ToolConsentSchema.optional(),
@@ -10335,7 +10543,7 @@ var init_b64u = __esmMin((() => {
 // packages/core/dist/version.js
 var VERSION;
 var init_version$1 = __esmMin((() => {
-	VERSION = "0.8.0";
+	VERSION = "0.9.0";
 }));
 // packages/core/dist/jcs.js
 function hasLoneSurrogate(text) {
@@ -12192,8 +12400,11 @@ var init_jelly_host = __esmMin((() => {
 		"people.search",
 		"people.get",
 		"grant.list",
+		"reach.get",
 		"request.list",
 		"sessions.list",
+		"tasks.list",
+		"tasks.get",
 		"notice.subscribe",
 		"notice.list",
 		"device.list"
@@ -13548,7 +13759,25 @@ function verifyConsentGrant(raw, ctx) {
 	}
 }
 function grantSubjectKey(subject) {
-	return "person" in subject ? `person:${subject.person}` : `conv:${subject.conv}`;
+	return "person" in subject ? `person:${subject.person}` : "conv" in subject ? `conv:${subject.conv}` : `relation:${subject.relation}`;
+}
+function reachChoices(outside, org) {
+	const message = outside === void 0 ? void 0 : outside.chat === "open" ? "open" : outside.chat === "blocked" ? "never" : "ask";
+	const ask = org?.ask === "open" ? "open" : org?.ask === "request" ? "ask" : org?.ask === "no" ? "never" : void 0;
+	return {
+		...message ? { message } : {},
+		...ask ? { ask } : {}
+	};
+}
+function reachGrant(group, value) {
+	if (group === "message") return {
+		subject: { relation: "outside" },
+		levels: value === "open" ? { chat: "open" } : value === "never" ? { chat: "blocked" } : {}
+	};
+	return {
+		subject: { relation: "org" },
+		levels: { ask: value === "open" ? "open" : value === "never" ? "no" : "request" }
+	};
 }
 function preferGrant(a, b, current) {
 	if (a.ts !== b.ts) return a.ts > b.ts ? a : b;
@@ -13600,8 +13829,24 @@ function levelsOf(grant) {
 		discoverable: grant.discoverable
 	});
 }
-function effectivePolicy(relation, person, channels, now) {
+function baseLevels(relation, reach) {
 	const base = DEFAULTS[relation];
+	if (relation === "org") return reach.ask === void 0 ? base : {
+		...base,
+		ask: reach.ask === "open" ? "open" : reach.ask === "never" ? "no" : "request"
+	};
+	if (reach.message === "never") return {
+		...base,
+		chat: "blocked"
+	};
+	if (relation === "stranger" && reach.message === "open") return {
+		...base,
+		chat: "open"
+	};
+	return base;
+}
+function effectivePolicy(relation, person, channels, now, reach = {}) {
+	const base = baseLevels(relation, reach);
 	const channelAsk = channels.map((grant) => grant.ask).filter((level) => level !== void 0);
 	const channelMail = channels.map((grant) => grant.agentMail).filter((level) => level !== void 0);
 	const ask = person?.ask ?? (channelAsk.length > 0 ? channelAsk.reduce((a, b) => ASK_RANK[b] > ASK_RANK[a] ? b : a) : void 0);
@@ -13625,19 +13870,25 @@ function decide(args) {
 		action: "deliver",
 		consent: "self"
 	};
-	const policy = effectivePolicy(args.relation, args.grant, args.channels, args.now);
+	const policy = effectivePolicy(args.relation, args.grant, args.channels, args.now, args.reach);
 	const trusted = (chain) => policy.trustedUntil !== void 0 && chain.every((person) => person === args.sender || person === args.self);
 	if (inbound.kind === "answer") return {
 		action: "deliver",
 		consent: trusted([args.sender]) ? "trusted" : "guarded"
 	};
-	if (policy.chat === "blocked") return {
+	const blocked = policy.chat === "blocked";
+	if (blocked && policy.granted.chat) return {
 		action: "refuse",
 		code: "refused"
 	};
 	const stranger = args.relation === "stranger";
+	const defaultCode = (outside) => outside && !blocked ? "request_required" : "refused";
 	switch (inbound.kind) {
 		case "op":
+			if (blocked) return {
+				action: "refuse",
+				code: "refused"
+			};
 			if (stranger) return {
 				action: "refuse",
 				code: "request_required"
@@ -13654,9 +13905,13 @@ function decide(args) {
 				};
 				return {
 					action: "refuse",
-					code: stranger && !policy.granted.agentMail ? "request_required" : "refused"
+					code: defaultCode(stranger && !policy.granted.agentMail)
 				};
 			}
+			if (blocked) return {
+				action: "refuse",
+				code: "refused"
+			};
 			if (policy.chat === "request_required") return {
 				action: "refuse",
 				code: "request_required"
@@ -13670,7 +13925,11 @@ function decide(args) {
 				consent: "guarded"
 			};
 		case "request":
-			if (stranger) return { action: "hold" };
+			if (blocked) return {
+				action: "refuse",
+				code: "refused"
+			};
+			if (policy.chat === "request_required") return { action: "hold" };
 			return policy.chat === "muted" ? {
 				action: "deliver",
 				consent: "guarded",
@@ -13687,7 +13946,7 @@ function decide(args) {
 			if (policy.ask === "request") return { action: "hold" };
 			return {
 				action: "refuse",
-				code: !policy.granted.ask && (stranger || args.relation === "contact") ? "request_required" : "refused"
+				code: defaultCode(!policy.granted.ask && (stranger || args.relation === "contact"))
 			};
 	}
 }
@@ -13769,8 +14028,8 @@ function verifyContactCard(raw, ctx) {
 		throw asMessagingError(error, "card");
 	}
 }
-function cardCan(relation, grant, now) {
-	const policy = effectivePolicy(relation, grant, [], now);
+function cardCan(relation, grant, now, reach = {}) {
+	const policy = effectivePolicy(relation, grant, [], now, reach);
 	return {
 		chat: policy.chat === "open" || policy.chat === "muted",
 		agentMail: policy.agentMail === "open",
@@ -13916,6 +14175,9 @@ function canTransition(from, to) {
 function isTerminal(state) {
 	return TERMINAL_STATES.includes(state);
 }
+function isInterrupted(state) {
+	return INTERRUPTED_STATES.includes(state);
+}
 var NEXT;
 var init_task = __esmMin((() => {
 	init_a2a();
@@ -14939,6 +15201,7 @@ var init_present = __esmMin((() => {
 	init_errors();
 	init_peer_text();
 	init_common();
+	init_ipc();
 	init_text();
 	LIMITS.toolTextChars;
 	createFence({ tag: PEER_FENCE_TAG });
@@ -16786,7 +17049,7 @@ async function createServer(options, conversations) {
 		method: "hello",
 		params: {
 			daemon: "messagingd",
-			version: options.version ?? "0.8.0",
+			version: options.version ?? "0.9.0",
 			protocol: 1,
 			pid: process.pid,
 			...options.deployment ? { deployment: options.deployment } : {}
@@ -18859,7 +19122,7 @@ function taskRow(r) {
 	}
 	return row;
 }
-var DatabaseSync$1, CONV_JUNK_ALARM_LIMIT, STORE_BASELINE, MIGRATIONS$1, STORE_SCHEMA, kvGet, kvSet, storeNumber, RESET_HINT, TASKS, text$1, num, json, opt, Store;
+var DatabaseSync$1, CONV_JUNK_ALARM_LIMIT, STORE_BASELINE, MIGRATIONS$1, RELATION$1, relationOf, STORE_SCHEMA, kvGet, kvSet, storeNumber, RESET_HINT, TASKS, text$1, num, json, opt, Store;
 var init_store$3 = __esmMin((() => {
 	init_dist$3();
 	({DatabaseSync: DatabaseSync$1} = process.getBuiltinModule("node:sqlite"));
@@ -19168,8 +19431,14 @@ CREATE TABLE IF NOT EXISTS conv_evidence (
   at INTEGER NOT NULL,
   UNIQUE (cid, digest, code)
 ) STRICT;
+`,
+		`
+CREATE TABLE IF NOT EXISTS reach_grants (relation TEXT PRIMARY KEY, grant TEXT NOT NULL) STRICT;
+CREATE TABLE IF NOT EXISTS reach_reviews (relation TEXT PRIMARY KEY, id TEXT NOT NULL, levels TEXT NOT NULL, at INTEGER NOT NULL) STRICT;
 `
 	];
+	RELATION$1 = "relation:";
+	relationOf = (subject) => subject.startsWith(RELATION$1) ? subject.slice(9) : void 0;
 	STORE_SCHEMA = 1 + MIGRATIONS$1.length;
 	kvGet = (db, k) => {
 		const row = db.prepare("SELECT v FROM kv WHERE k = ?").get(k);
@@ -19740,6 +20009,16 @@ CREATE TABLE IF NOT EXISTS conv_evidence (
 		contactRequests(person) {
 			return (person === void 0 ? this.#all("SELECT * FROM contact_requests ORDER BY at, id") : this.#all("SELECT * FROM contact_requests WHERE person = ? ORDER BY at, id", person)).map(contactRequestRow);
 		}
+		legacyOutgoingRequests(now) {
+			return this.#all(`SELECT t.id AS id, substr(t.room, 4) AS person, t.at AS at FROM transcript t
+       WHERE t.direction = 'out' AND t.room LIKE 'dm:%'
+         AND EXISTS (SELECT 1 FROM chat_sent c WHERE c.line = t.id AND c.stage = 'sent' AND c.held_at IS NOT NULL AND c.exp > ?)
+       ORDER BY t.at, t.id`, now).map((r) => ({
+				id: String(r.id),
+				person: String(r.person),
+				at: Number(r.at)
+			}));
+		}
 		contactRequestCount() {
 			return Number(this.#get("SELECT COUNT(*) AS n FROM contact_requests")?.n ?? 0);
 		}
@@ -19779,41 +20058,57 @@ CREATE TABLE IF NOT EXISTS conv_evidence (
 			return this.#run("DELETE FROM contact_suggestions WHERE at < ?", before);
 		}
 		putGrant(subject, grant) {
+			const relation = relationOf(subject);
+			if (relation !== void 0) {
+				this.#run("INSERT INTO reach_grants (relation, grant) VALUES (?, ?) ON CONFLICT (relation) DO UPDATE SET grant = excluded.grant", relation, JSON.stringify(grant));
+				return;
+			}
 			this.#run("INSERT INTO grants (subject, grant) VALUES (?, ?) ON CONFLICT (subject) DO UPDATE SET grant = excluded.grant", subject, JSON.stringify(grant));
 		}
 		grant(subject) {
-			const row = this.#get("SELECT grant FROM grants WHERE subject = ?", subject);
+			const relation = relationOf(subject);
+			const row = relation !== void 0 ? this.#get("SELECT grant FROM reach_grants WHERE relation = ?", relation) : this.#get("SELECT grant FROM grants WHERE subject = ?", subject);
 			return row === void 0 ? void 0 : JSON.parse(String(row.grant));
 		}
 		grants() {
-			return this.#all("SELECT subject, grant FROM grants ORDER BY subject").map((row) => ({
+			return [...this.#all("SELECT subject, grant FROM grants ORDER BY subject").map((row) => ({
 				subject: String(row.subject),
 				grant: JSON.parse(String(row.grant))
-			}));
+			})), ...this.#all("SELECT relation, grant FROM reach_grants ORDER BY relation").map((row) => ({
+				subject: `${RELATION$1}${String(row.relation)}`,
+				grant: JSON.parse(String(row.grant))
+			}))];
 		}
 		grantCount() {
 			return Number(this.#get("SELECT COUNT(*) AS n FROM grants")?.n ?? 0);
 		}
 		deleteGrant(subject) {
-			this.#run("DELETE FROM grants WHERE subject = ?", subject);
+			const relation = relationOf(subject);
+			if (relation !== void 0) this.#run("DELETE FROM reach_grants WHERE relation = ?", relation);
+			else this.#run("DELETE FROM grants WHERE subject = ?", subject);
 		}
 		putGrantReview(subject, id, levels, at) {
-			this.#run("INSERT INTO grant_reviews (subject, id, levels, at) VALUES (?, ?, ?, ?) ON CONFLICT (subject) DO UPDATE SET id = excluded.id, levels = excluded.levels, at = excluded.at", subject, id, JSON.stringify(levels), at);
+			const relation = relationOf(subject);
+			this.#run(relation !== void 0 ? "INSERT INTO reach_reviews (relation, id, levels, at) VALUES (?, ?, ?, ?) ON CONFLICT (relation) DO UPDATE SET id = excluded.id, levels = excluded.levels, at = excluded.at" : "INSERT INTO grant_reviews (subject, id, levels, at) VALUES (?, ?, ?, ?) ON CONFLICT (subject) DO UPDATE SET id = excluded.id, levels = excluded.levels, at = excluded.at", relation ?? subject, id, JSON.stringify(levels), at);
 		}
 		grantReviews() {
-			return this.#all("SELECT * FROM grant_reviews ORDER BY at DESC, subject").map((row) => ({
-				subject: String(row.subject),
-				id: String(row.id),
-				levels: JSON.parse(String(row.levels)),
-				at: Number(row.at)
-			}));
+			const row = (subject, r) => ({
+				subject,
+				id: String(r.id),
+				levels: JSON.parse(String(r.levels)),
+				at: Number(r.at)
+			});
+			return [...this.#all("SELECT * FROM grant_reviews ORDER BY at DESC, subject").map((r) => row(String(r.subject), r)), ...this.#all("SELECT * FROM reach_reviews ORDER BY at DESC, relation").map((r) => row(`${RELATION$1}${String(r.relation)}`, r))];
 		}
 		grantReview(subject) {
-			const row = this.#get("SELECT id FROM grant_reviews WHERE subject = ?", subject);
+			const relation = relationOf(subject);
+			const row = relation !== void 0 ? this.#get("SELECT id FROM reach_reviews WHERE relation = ?", relation) : this.#get("SELECT id FROM grant_reviews WHERE subject = ?", subject);
 			return row === void 0 ? void 0 : { id: String(row.id) };
 		}
 		deleteGrantReview(subject) {
-			this.#run("DELETE FROM grant_reviews WHERE subject = ?", subject);
+			const relation = relationOf(subject);
+			if (relation !== void 0) this.#run("DELETE FROM reach_reviews WHERE relation = ?", relation);
+			else this.#run("DELETE FROM grant_reviews WHERE subject = ?", subject);
 		}
 		sentUndelivered(now) {
 			return this.#all("SELECT * FROM sent WHERE exp <= ? AND stage IN ('accepted', 'relayed')", now).map(sentRow);
@@ -19878,12 +20173,13 @@ CREATE TABLE IF NOT EXISTS conv_evidence (
 			if (r.chain !== void 0) this.#run("INSERT OR IGNORE INTO delegations (task_id, role, grants, chain) VALUES (?, ?, ?, ?)", r.task.id, r.role, JSON.stringify(row.grants), JSON.stringify(r.chain));
 		}
 		listTasks(filter) {
-			const where = ["key = ?"];
-			const params = [filter.key];
+			const where = ["1 = 1"];
+			const params = [];
 			const add = (clause, ...values) => {
 				where.push(clause);
 				params.push(...values);
 			};
+			if (filter.key !== void 0) add("key = ?", filter.key);
 			if (filter.role !== void 0) add("role = ?", filter.role);
 			if (filter.state !== void 0) add("state = ?", filter.state);
 			if (filter.contextId !== void 0) add("context_id = ?", filter.contextId);
@@ -20613,7 +20909,7 @@ var init_conv_engine = __esmMin((() => {
 				const pending = this.options.store.convPending(cid);
 				if (rekey.cause === "device" && pending) {
 					const first = admitConvEvent(parseWire(pending.event));
-					if (first.class === "op" && first.body.op === "rekey" && first.body.cause === "device" && first.body.device === rekey.device) return first.id;
+					if (first.class === "op" && first.body.op === "rekey" && first.body.cause === "device" && first.body.device === rekey.device && (rekey.until === void 0 || first.body.until !== void 0 && first.body.until <= rekey.until)) return first.id;
 					return await this.#queueRekey(cid, rekey, true);
 				}
 				return await this.#queueRekey(cid, rekey, false);
@@ -21394,12 +21690,13 @@ var init_conv_project = __esmMin((() => {
 	]);
 }));
 // packages/daemon/dist/conv-ipc.js
-var DEFERRED_LINES, DEFERRED_MS, HOLD, REPLAY$1, RESPONSE_BYTES, ConversationIpc;
+var DEFERRED_LINES, DEFERRED_MS, CONTROL_DRAINS, HOLD, REPLAY$1, RESPONSE_BYTES, ConversationIpc;
 var init_conv_ipc = __esmMin((() => {
 	init_dist$3();
 	init_conv_project();
 	DEFERRED_LINES = 50;
 	DEFERRED_MS = 6048e5;
+	CONTROL_DRAINS = 3;
 	HOLD = {
 		stage: "held",
 		code: "context",
@@ -21440,6 +21737,18 @@ var init_conv_ipc = __esmMin((() => {
 				own: this.options.own().person
 			});
 		}
+		taskChanged(side) {
+			this.#ring.push({
+				pos: ++this.#pos,
+				task: {
+					id: side.id,
+					role: side.role
+				}
+			});
+			if (this.#ring.length > REPLAY$1) this.#floor = this.#ring.shift().pos;
+			this.options.put("conv.ipc.pos", String(this.#pos));
+			for (const wake of [...this.#waiters]) wake();
+		}
 		bind(engine) {
 			if (this.#engine === engine) return;
 			this.#unsubscribe?.();
@@ -21538,7 +21847,7 @@ var init_conv_ipc = __esmMin((() => {
 			return Object.fromEntries(Object.keys(LIVE_CONVERSATION_METHODS).map((method) => [method, async (params, ctx, authority) => {
 				if (authority?.scope === "host") throw new MessagingError("forbidden", "conversation content needs an action grant");
 				const name = method;
-				const result = await this.call(name, params, ctx);
+				const result = await this.call(name, params, ctx, authority);
 				const parsed = LIVE_CONVERSATION_METHODS[name].result.parse(result);
 				if (Buffer.byteLength(JSON.stringify(parsed)) > RESPONSE_BYTES) throw new MessagingError("too_large", "conversation response exceeds the byte budget");
 				return parsed;
@@ -21664,7 +21973,13 @@ var init_conv_ipc = __esmMin((() => {
 			const access = this.#access(engine, cid, scope);
 			if (access.access === "forbidden") throw new MessagingError("forbidden", "the session cannot read this conversation");
 			if (access.access === "ask") return HOLD;
-			let visible = (await projectEvents(engine, cid, scope.participant, this.#name, (p) => !this.options.blocked(participantPerson(p)))).filter((e) => e.seq >= access.since && e.at >= access.after);
+			const orgs = new Map();
+			const name = async (p) => {
+				const profile = await this.#name(p);
+				orgs.set(p, profile.org);
+				return profile;
+			};
+			let visible = (await projectEvents(engine, cid, scope.participant, name, (p) => !this.options.blocked(p, orgs.get(p) ?? "none"))).filter((e) => e.seq >= access.since && e.at >= access.after);
 			if (scope.agent && this.#state(engine, cid, scope).state.agentContext === "none") {
 				const roots = new Set(visible.filter((e) => e.author.p === scope.participant || e.mentions?.some((m) => "p" in m && m.p === scope.participant)).map((e) => e.thread ?? e.id));
 				visible = visible.filter((e) => roots.has(e.id) || e.thread !== void 0 && roots.has(e.thread));
@@ -21747,10 +22062,30 @@ var init_conv_ipc = __esmMin((() => {
 				};
 				const events = [];
 				let pos = after;
-				for (const item of this.#ring.filter((i) => i.pos > after)) {
+				const range = this.#ring.filter((i) => i.pos > after);
+				for (const [index, item] of range.entries()) {
 					pos = item.pos;
-					const c = item.change;
 					let rendered;
+					if ("task" in item) {
+						const side = item.task;
+						if (scope.key !== void 0 || scope.ctx.tier !== "admin" || !this.options.task) continue;
+						if (range.slice(index + 1).some((later) => "task" in later && later.task.id === side.id && later.task.role === side.role)) continue;
+						const task = await this.options.task(side.id, side.role, scope.ctx, scope.authority);
+						if (!task) continue;
+						rendered = {
+							type: "task",
+							pos,
+							task
+						};
+						if (Buffer.byteLength(JSON.stringify([...events, rendered])) > 520192) {
+							pos = item.pos - 1;
+							break;
+						}
+						events.push(rendered);
+						if (events.length >= (p.limit ?? 50)) break;
+						continue;
+					}
+					const c = item.change;
 					try {
 						if (this.#access(engine, c.cid, scope).access !== "allow") continue;
 						if (c.type === "members.changed") rendered = {
@@ -21834,7 +22169,7 @@ var init_conv_ipc = __esmMin((() => {
 			result = await read();
 			return result;
 		}
-		async call(method, raw, ctx) {
+		async call(method, raw, ctx, authority) {
 			if (ctx.tier === "agent" && CONVERSATION_TIERS[method] !== "agent") throw new MessagingError("forbidden", "this method is human-only");
 			const p = LIVE_CONVERSATION_METHODS[method].params.parse(raw);
 			if (method === "people.get") {
@@ -21857,7 +22192,10 @@ var init_conv_ipc = __esmMin((() => {
 					seats: engine?.list().filter((c) => c.state?.participants.some((p) => p.p === `${this.options.own().person}/${s.agent}` && p.state === "member")).map((c) => c.cid) ?? []
 				})) };
 			}
-			const scope = this.#scope("key" in p ? p.key : void 0, ctx);
+			const scope = {
+				...this.#scope("key" in p ? p.key : void 0, ctx),
+				authority
+			};
 			const engine = this.#current();
 			const { cursor: _cursor, ...position } = p;
 			const query = canonicalize({
@@ -22125,7 +22463,10 @@ var init_conv_ipc = __esmMin((() => {
 						await this.options.current?.(p.participants.map((s) => participantPerson(s.p)));
 					}
 					const { cid, ...fields } = p;
-					if (method !== "conv.meta" && engine.pending(cid).length > 0) await engine.flush(cid);
+					for (let drains = 0; method !== "conv.meta" && engine.pending(cid).length > 0; drains++) {
+						if (drains === CONTROL_DRAINS) throw new MessagingError("conv_conflict", "the conversation is busy sending; try again");
+						await engine.flush(cid);
+					}
 					if (method === "conv.meta") await engine.queueMeta(cid, p.meta);
 					else engine.control(cid, {
 						op: method.slice(5),
@@ -23118,7 +23459,11 @@ function fitPresence(sessions, baseBytes, limit) {
 var FEATURES;
 var init_directory$1 = __esmMin((() => {
 	init_dist$3();
-	FEATURES = ["tasks", "conversations"];
+	FEATURES = [
+		"tasks",
+		"conversations",
+		"reach"
+	];
 }));
 // packages/daemon/dist/delegation.js
 function parentChain(store, key, p) {
@@ -23973,6 +24318,19 @@ var init_directory_identity = __esmMin((() => {
 			const head = this.#head;
 			return head !== void 0 && this.#options.now() - head.sth.ts > maxAgeMs + LIMITS.epochHeartbeatMs;
 		}
+		async freshen(persons, batch = LIMITS.dirLookupPersons) {
+			const size1 = Math.max(1, Math.min(batch, LIMITS.dirLookupPersons));
+			const now = this.#options.now();
+			const size = this.#head?.sth.size ?? 0;
+			const stale = [...new Set(persons)].filter((person) => {
+				if (!isHosted(person)) return false;
+				const held = this.#persons.get(person);
+				return !held || now - held.fetchedAt >= LIMITS.dirFreshMs || held.size < size;
+			});
+			if (stale.length === 0 && !this.#headOlderThan(LIMITS.dirFreshMs)) return;
+			await this.#latest();
+			for (let i = 0; i < stale.length; i += size1) await this.#fetch(stale.slice(i, i + size1));
+		}
 		async profile(person) {
 			if (!isHosted(person)) throw new MessagingError("not_found", "no such person in this realm");
 			await this.devices(person);
@@ -25138,8 +25496,10 @@ var init_jelly$1 = __esmMin((() => {
 			this.#deps = deps;
 		}
 		authorize(call) {
-			const sessionCall = call.params !== null && typeof call.params === "object" && "key" in call.params && typeof call.params.key === "string";
-			if (call.ctx.tier === "agent" || AGENT.has(call.method) && (!Object.hasOwn(CONVERSATION_METHODS, call.method) || sessionCall)) return void 0;
+			const params = call.params !== null && typeof call.params === "object" ? call.params : void 0;
+			const sessionCall = params !== void 0 && typeof params.key === "string";
+			const tokenCall = params !== void 0 && Object.hasOwn(params, "token");
+			if (call.ctx.tier === "agent" || AGENT.has(call.method) && !tokenCall && (!Object.hasOwn(CONVERSATION_METHODS, call.method) || sessionCall)) return void 0;
 			const refuse = (error) => {
 				this.#deps.log("warn", "jelly.grant.refused", {
 					method: call.method,
@@ -25181,7 +25541,9 @@ var init_jelly$1 = __esmMin((() => {
 			});
 			return {
 				scope: grant.scope,
-				expiresAt: (grant.exp + 5) * 1e3
+				expiresAt: (grant.exp + 5) * 1e3,
+				...grant.dev !== void 0 ? { dev: grant.dev } : {},
+				...grant.mbr !== void 0 ? { mbr: grant.mbr } : {}
 			};
 		}
 		ticket(p) {
@@ -25529,7 +25891,7 @@ function deviceLine(d) {
 	const line = d.change === "added" ? `New device on your account: ${what}, ${vouchWords(d)}.` : d.change === "vouched" ? `${what} on your account is now vouched by Jelly ID: ${vouchWords(d)}.` : d.change === "replaced" ? `'${d.replaces?.label ?? "a device"}' was replaced by ${what}, ${vouchWords(d)}.` : `${what} was removed from your account.`;
 	return line.length <= 120 ? line : `${line.slice(0, 119)}…`;
 }
-var ALERT_TEXT, REPLAY, Notices;
+var ALERT_TEXT, TASK_SOURCE, REPLAY, Notices;
 var init_notices = __esmMin((() => {
 	init_dist$3();
 	ALERT_TEXT = {
@@ -25537,6 +25899,7 @@ var init_notices = __esmMin((() => {
 		restored: "This device was restored from an older copy: it publishes no keys until it is replaced.",
 		directory: "The key directory gave inconsistent answers about your devices; the evidence is kept."
 	};
+	TASK_SOURCE = "task:";
 	REPLAY = 500;
 	Notices = class {
 		#host;
@@ -25554,6 +25917,15 @@ var init_notices = __esmMin((() => {
 				at: row.at
 			});
 		}
+		task(row) {
+			this.#file({
+				id: `m_task${row.taskId}`,
+				category: "message",
+				person: row.person,
+				source: `${TASK_SOURCE}${row.taskId}`,
+				at: row.at
+			});
+		}
 		alert(kind, at) {
 			this.#file({
 				id: `a_${kind.replace(/_/g, "")}${at}`,
@@ -25586,6 +25958,7 @@ var init_notices = __esmMin((() => {
 				notice: {
 					id: row.id,
 					category: row.category,
+					...row.source.startsWith(TASK_SOURCE) ? { key: `task:${row.source.slice(5)}` } : {},
 					at: row.at
 				}
 			});
@@ -25659,6 +26032,7 @@ var init_notices = __esmMin((() => {
 					org: own ? "same" : "none"
 				};
 			}
+			if (row.category === "message" && row.source.startsWith(TASK_SOURCE)) notice.key = `task:${row.source.slice(5)}`;
 			if (row.category === "alert" && row.source.startsWith("device:")) {
 				const device = this.#host.device?.(Number(row.source.slice(7)));
 				if (device) notice.device = device;
@@ -25671,6 +26045,67 @@ var init_notices = __esmMin((() => {
 		}
 	};
 }));
+// packages/daemon/dist/task-view.js
+function plainCapped(text, max, singleLine) {
+	let budget = max;
+	for (;;) {
+		const out = cleanPeerText(text, {
+			singleLine,
+			maxChars: budget
+		}).trim();
+		if (out.length <= max) return out.length > 0 ? out : void 0;
+		budget = Math.max(0, budget - (out.length - max));
+	}
+}
+function executorWords(record) {
+	const message = record.task.status.message;
+	return message !== void 0 && (record.role === "executor" || message.metadata?.[URI.provenance] !== void 0);
+}
+function signInTool(record) {
+	if (!executorWords(record)) return void 0;
+	const value = record.task.status.message?.metadata?.[URI.signIn];
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const tool = value.tool;
+	return typeof tool === "string" ? plainCapped(tool, TASK_SIGN_IN_TOOL_CHARS, true) : void 0;
+}
+function refusalReason(record) {
+	if (!executorWords(record)) return void 0;
+	return plainCapped((record.task.status.message?.parts ?? []).flatMap((part) => typeof part.text === "string" ? [part.text] : []).join("\n"), TASK_REFUSAL_CHARS, false);
+}
+function withTaskView(record, me, named) {
+	const view = { ...record };
+	delete view.agent;
+	delete view.person;
+	delete view.org;
+	delete view.signIn;
+	delete view.refusal;
+	delete view.question;
+	if (record.peer.agent !== void 0) view.agent = record.peer.agent;
+	if (named !== void 0) {
+		view.person = {
+			id: record.peer.person,
+			name: named.name.slice(0, 200)
+		};
+		view.org = named.org;
+	}
+	const state = record.task.status.state;
+	if (state === "TASK_STATE_AUTH_REQUIRED") {
+		const mine = record.role === "executor" || me !== void 0 && record.peer.person === me;
+		const tool = signInTool(record);
+		view.signIn = {
+			...tool !== void 0 ? { tool } : {},
+			by: mine ? "you" : "them"
+		};
+	}
+	if (state === "TASK_STATE_REJECTED") {
+		const reason = refusalReason(record);
+		if (reason !== void 0) view.refusal = { reason };
+	}
+	return view;
+}
+var init_task_view = __esmMin((() => {
+	init_dist$3();
+}));
 // packages/daemon/dist/realm/counterpart.js
 function successors(realm, recorded) {
 	const chain = [recorded];
@@ -26667,7 +27102,117 @@ var init_wake_bridge = __esmMin((() => {
 	};
 	AnswerTooLarge = class extends Error {};
 }));
+// packages/daemon/dist/action-tokens.js
+function actionView(ctx, authority, sessionKey) {
+	if (ctx.tier !== "admin" || sessionKey !== void 0 || authority?.scope === "host") return void 0;
+	return {
+		connection: ctx.id,
+		...authority?.dev !== void 0 ? { dev: authority.dev } : {},
+		...authority?.mbr !== void 0 ? { mbr: authority.mbr } : {}
+	};
+}
+function taskCancelAction(tokens, task, view) {
+	if (view === void 0 || task.role !== "requester" || task.ended) return void 0;
+	return {
+		name: "cancel",
+		token: tokens.offer(view, "cancel", `task:${task.id}`)
+	};
+}
+var ACTION_TOKEN_TTL_MS, ACTION_TOKENS_TOTAL, viewKey, offerKey, ActionTokens;
+var init_action_tokens = __esmMin((() => {
+	init_dist$3();
+	ACTION_TOKEN_TTL_MS = 6e5;
+	ACTION_TOKENS_TOTAL = 4096;
+	viewKey = (view) => JSON.stringify([
+		view.connection,
+		view.dev ?? null,
+		view.mbr ?? null
+	]);
+	offerKey = (view, name, target) => JSON.stringify([
+		view,
+		name,
+		target
+	]);
+	ActionTokens = class {
+		now;
+		limits;
+		#held = new Map();
+		#offers = new Map();
+		#perView = new Map();
+		constructor(now, limits = {
+			perView: 256,
+			total: ACTION_TOKENS_TOTAL,
+			ttlMs: ACTION_TOKEN_TTL_MS
+		}) {
+			this.now = now;
+			this.limits = limits;
+		}
+		get size() {
+			return this.#held.size;
+		}
+		offer(view, name, target) {
+			const now = this.now();
+			const key = viewKey(view);
+			const offered = this.#offers.get(offerKey(key, name, target));
+			if (offered !== void 0) {
+				const held = this.#held.get(offered);
+				if (held !== void 0 && held.exp - now > this.limits.ttlMs / 2) return offered;
+			}
+			this.sweep();
+			while ((this.#perView.get(key) ?? 0) >= this.limits.perView && this.#dropOldest((h) => h.view === key));
+			while (this.#held.size >= this.limits.total && this.#dropOldest(() => true));
+			const token = randomBytes(32).toString("base64url");
+			this.#held.set(token, {
+				name,
+				target,
+				view: key,
+				connection: view.connection,
+				exp: now + this.limits.ttlMs
+			});
+			this.#offers.set(offerKey(key, name, target), token);
+			this.#perView.set(key, (this.#perView.get(key) ?? 0) + 1);
+			return token;
+		}
+		redeem(token, want) {
+			const held = this.#held.get(token);
+			if (held !== void 0) this.#delete(token, held);
+			this.#match(held, want);
+		}
+		check(token, want) {
+			this.#match(this.#held.get(token), want);
+		}
+		disconnected(connection) {
+			for (const [token, held] of [...this.#held]) if (held.connection === connection) this.#delete(token, held);
+		}
+		sweep() {
+			const now = this.now();
+			for (const [token, held] of [...this.#held]) if (held.exp <= now) this.#delete(token, held);
+		}
+		#match(held, want) {
+			if (!(held !== void 0 && held.exp > this.now() && held.name === want.name && held.target === want.target && held.view === viewKey(want.view))) throw new MessagingError("grant_invalid", "the action token is not one this daemon offered for this action, item and view, or it was spent or expired; read the view again");
+		}
+		#dropOldest(which) {
+			for (const [token, held] of this.#held) {
+				if (!which(held)) continue;
+				this.#delete(token, held);
+				return true;
+			}
+			return false;
+		}
+		#delete(token, held) {
+			this.#held.delete(token);
+			const key = offerKey(held.view, held.name, held.target);
+			if (this.#offers.get(key) === token) this.#offers.delete(key);
+			const count = (this.#perView.get(held.view) ?? 1) - 1;
+			if (count > 0) this.#perView.set(held.view, count);
+			else this.#perView.delete(held.view);
+		}
+	};
+}));
 // packages/daemon/dist/consent/grants.js
+function isRelationKey(key) {
+	return key.startsWith("relation:");
+}
 function levelsFrom(p, now) {
 	const trustedUntil = p.trustedUntil ?? (p.trust ? now + LIMITS.trustDefaultMs : void 0);
 	return levelsOf({
@@ -26718,14 +27263,42 @@ var init_grants = __esmMin((() => {
 					const members = this.#host.participants(cid, event?.seq);
 					return members.includes(person) && members.includes(me.person);
 				})),
+				reach: this.reach(),
 				inbound,
 				now: this.#host.now()
 			});
 		}
+		hides(participant, org) {
+			const slash = participant.indexOf("/");
+			const person = slash === -1 ? participant : participant.slice(0, slash);
+			const { me } = this.#host.joined();
+			if (person === me.person) return false;
+			const grant = this.personGrant(person);
+			if (grant?.chat === "blocked") return true;
+			if (slash !== -1 || org !== "other") return false;
+			return effectivePolicy(this.hasGrant(person) ? "contact" : "stranger", grant, [], this.#host.now(), this.reach()).chat === "blocked";
+		}
 		personGrant(person) {
 			const grant = this.#current(grantSubjectKey({ person }));
 			return grant && levelsOf(grant);
 		}
+		relationGrant(relation) {
+			const grant = this.#current(grantSubjectKey({ relation }));
+			return grant && levelsOf(grant);
+		}
+		reach() {
+			return reachChoices(this.relationGrant("outside"), this.relationGrant("org"));
+		}
+		relationRecord(relation) {
+			const key = grantSubjectKey({ relation });
+			return {
+				grant: this.#store.grant(key) ?? null,
+				review: this.#store.grantReviews().find(({ subject }) => subject === key) ?? null
+			};
+		}
+		relationReview(relation) {
+			return this.#store.grantReviews().find(({ subject }) => subject === grantSubjectKey({ relation }))?.levels;
+		}
 		conversationGrants(conversations) {
 			return conversations.flatMap((conv) => {
 				const grant = this.#current(grantSubjectKey({ conv }));
@@ -26751,8 +27324,8 @@ var init_grants = __esmMin((() => {
 		list(p) {
 			const only = p.subject === void 0 ? void 0 : this.#subjectKey(p.subject, false);
 			return {
-				grants: this.#all().filter(({ subject }) => only === void 0 || subject === only).map(({ grant }) => this.#view(grant)).sort((a, b) => b.ts - a.ts || (a.id < b.id ? 1 : -1)),
-				review: this.#store.grantReviews().filter(({ subject }) => only === void 0 || subject === only).map(({ subject, levels, at }) => ({
+				grants: this.#all().filter(({ subject }) => !isRelationKey(subject)).filter(({ subject }) => only === void 0 || subject === only).map(({ grant }) => this.#view(grant)).sort((a, b) => b.ts - a.ts || (a.id < b.id ? 1 : -1)),
+				review: this.#store.grantReviews().filter(({ subject }) => !isRelationKey(subject)).filter(({ subject }) => only === void 0 || subject === only).map(({ subject, levels, at }) => ({
 					subject: this.#subjectView(subject),
 					...levels,
 					at
@@ -26792,6 +27365,30 @@ var init_grants = __esmMin((() => {
 				...levels
 			}, opts);
 		}
+		setRelations(changes) {
+			if (changes.length === 0) return;
+			const { identity, realm, me } = this.#host.joined();
+			const now = this.#host.now();
+			const grants = changes.map(({ subject, levels }) => signConsentGrant(identity, {
+				realm: realm.realm,
+				person: me.person,
+				subject,
+				levels,
+				now
+			}));
+			this.#host.tx(() => {
+				for (const grant of grants) {
+					const key = grantSubjectKey(grant.subject);
+					this.#store.putGrant(key, grant);
+					this.#store.deleteGrantReview(key);
+				}
+				this.#sync("grant", grants);
+			});
+			this.#host.log("grant.set", {
+				subject: "relation",
+				grants: grants.length
+			});
+		}
 		check(p) {
 			const { identity, realm, me } = this.#host.joined();
 			const now = this.#host.now();
@@ -26835,7 +27432,7 @@ var init_grants = __esmMin((() => {
 				}
 				const key = grantSubjectKey(grant.subject);
 				const held = this.#held(key);
-				if (!held && this.#store.grantCount() >= LIMITS.grantsPerPerson) {
+				if (!held && !isRelationKey(key) && this.#store.grantCount() >= LIMITS.grantsPerPerson) {
 					this.#host.log("grant.sync.skipped", {
 						id: env.id,
 						code: "rate_limited"
@@ -26976,10 +27573,14 @@ var init_grants = __esmMin((() => {
 			return grantSubjectKey(target);
 		}
 		#subjectOf(key) {
-			return key.startsWith("person:") ? { person: key.slice(7) } : { conv: key.slice(5) };
+			if (key.startsWith("person:")) return { person: key.slice(7) };
+			if (isRelationKey(key)) return { relation: key.slice(9) };
+			return { conv: key.slice(5) };
 		}
 		#subjectView(key) {
-			return this.#subjectOf(key);
+			const subject = this.#subjectOf(key);
+			if ("relation" in subject) throw new MessagingError("internal", "a relation grant has no grant view");
+			return subject;
 		}
 		#view(grant) {
 			return {
@@ -27140,7 +27741,7 @@ var init_cards = __esmMin((() => {
 				seq,
 				now,
 				...grant !== void 0 && typeof held?.id === "string" ? { grantId: held.id } : {},
-				can: cardCan(relation, grant, now)
+				can: cardCan(relation, grant, now, this.#host.reach?.() ?? {})
 			});
 			for (const device of realm.known(person).devices) this.#host.route(this.#host.seal(device.machine, cardMessage({ card }, "card")));
 			this.#host.log("card.sent", { seq });
@@ -27270,7 +27871,8 @@ var init_conversation_requests = __esmMin((() => {
 			return this.#ids().map((id) => this.get(id)).sort((a, b) => a.at - b.at || a.id.localeCompare(b.id));
 		}
 		waitingOnThem() {
-			return this.list().filter((r) => r.direction === "outgoing" && r.state === "submitted" && r.request.descriptor.expiresAt > this.host.now()).map((r) => ({
+			const now = this.host.now(), rows = this.list().filter((r) => r.direction === "outgoing");
+			const submitted = rows.filter((r) => r.state === "submitted" && r.request.descriptor.expiresAt > now).map((r) => ({
 				id: r.id,
 				kind: "contact",
 				to: r.person,
@@ -27278,6 +27880,16 @@ var init_conversation_requests = __esmMin((() => {
 				at: r.at,
 				cid: r.request.descriptor.cid
 			}));
+			const resend = rows.filter((r) => r.state === "resend" && r.at + LIMITS.ttlMs > now && !rows.some((n) => n.person === r.person && n.request && n.at >= r.at)).map((r) => ({
+				id: r.id,
+				kind: "contact",
+				to: r.person,
+				name: r.person,
+				at: r.at,
+				cid: dmConvId(this.host.person, r.person),
+				resend: true
+			}));
+			return [...submitted, ...resend];
 		}
 		cutoverLegacy(outgoing = []) {
 			this.host.store.tx(() => {
@@ -27359,6 +27971,7 @@ var init_conversation_requests = __esmMin((() => {
 			if (d.realm !== this.host.realm || d.to !== this.host.person) throw new MessagingError("invalid_request", "request is for another recipient");
 			if (d.issuedAt > this.host.now() + LIMITS.clockSkewMs || d.expiresAt <= this.host.now()) throw new MessagingError("expired", "request has expired");
 			if (this.host.chat(d.from) === "blocked") throw new MessagingError("declined", "request declined");
+			if (this.host.refuses?.(d.from)) throw new MessagingError("refused", "this person accepts no message requests from outside their org");
 			return this.host.store.tx(() => {
 				const old = this.get(d.id);
 				if (old) {
@@ -27565,6 +28178,7 @@ var init_requests = __esmMin((() => {
 				resolve: (email) => this.#resolve(email),
 				current: (person) => h.current?.([person]) ?? Promise.resolve(),
 				chat: (person) => h.grants.personGrant(person)?.chat,
+				refuses: (person) => h.grants.decide(person, { kind: "request" }).action === "refuse",
 				grantChat: (person, chat) => {
 					h.grants.setPerson(person, { chat }, { card: false });
 				},
@@ -27628,7 +28242,7 @@ var init_requests = __esmMin((() => {
 					}, proof, body);
 				}
 			});
-			this.#lifecycle.cutoverLegacy();
+			this.#lifecycle.cutoverLegacy(h.store.legacyOutgoingRequests(h.now()));
 			return this.#lifecycle;
 		}
 		#mailbox() {
@@ -27714,12 +28328,16 @@ var init_requests = __esmMin((() => {
 			const sent = parseWire(value);
 			if (machine !== sent.device) return true;
 			if (payload.stage === "held") this.host.store.setKv(`conv.request.held.${sent.request}`, "true");
+			if (payload.stage === "delivered" || payload.stage === "read") {
+				if (!this.host.store.getKv(`conv.request.outdated.${sent.request}`)) this.host.log("request.outdated", { id: sent.request });
+				this.host.store.setKv(`conv.request.outdated.${sent.request}`, "true");
+			}
 			return true;
 		}
 		async waitingOnThem() {
-			return this.#current().waitingOnThem().map((row) => ({
+			return this.#current().waitingOnThem().map(({ resend, ...row }) => ({
 				...row,
-				state: this.host.store.getKv(`conv.request.held.${row.id}`) === "true" ? "held" : "pending-delivery"
+				state: resend ? "resend" : this.host.store.getKv(`conv.request.outdated.${row.id}`) === "true" ? "outdated" : this.host.store.getKv(`conv.request.held.${row.id}`) === "true" ? "held" : "pending-delivery"
 			}));
 		}
 		get(id) {
@@ -27829,6 +28447,92 @@ var init_requests = __esmMin((() => {
 		}
 	};
 }));
+// packages/daemon/dist/consent/reach.js
+function revision(grants, choices) {
+	return sha256(canonicalize({
+		records: Object.fromEntries(GROUPS.map((group) => [group, grants.relationRecord(RELATION[group])])),
+		choices
+	})).slice(0, 32);
+}
+function reachSnapshot(grants) {
+	const choices = grants.reach();
+	const lapsed = reachChoices(grants.relationReview("outside"), grants.relationReview("org"));
+	return {
+		revision: revision(grants, choices),
+		available: true,
+		groups: REACH_QUESTIONS.map((question) => ({
+			id: question.id,
+			label: question.label,
+			options: question.options.map((option) => ({ ...option })),
+			value: choices[question.id] ?? null,
+			...lapsed[question.id] !== void 0 ? { lapsed: lapsed[question.id] } : {}
+		}))
+	};
+}
+function changesOf(grants, p) {
+	if (p.revision !== revision(grants, grants.reach())) throw new MessagingError("conflict", "your reach choices changed since they were read; read them again and choose again");
+	return GROUPS.flatMap((group) => p.changes[group] === void 0 ? [] : [[group, p.changes[group]]]);
+}
+function reachSet(grants, p) {
+	const changes = changesOf(grants, p);
+	grants.setRelations(changes.map(([group, value]) => {
+		const { levels } = reachGrant(group, value);
+		return {
+			subject: { relation: RELATION[group] },
+			levels
+		};
+	}));
+	return reachSnapshot(grants);
+}
+function reachPreview(grants, p) {
+	const changes = changesOf(grants, p);
+	if (changes.length === 0) return "Nothing changes.";
+	return changes.map(([group, value]) => SENTENCES[group][value]).join(" ");
+}
+var RELATION, GROUPS, SENTENCES;
+var init_reach = __esmMin((() => {
+	init_dist$3();
+	RELATION = {
+		message: "outside",
+		ask: "org"
+	};
+	GROUPS = ["message", "ask"];
+	SENTENCES = {
+		message: {
+			open: "Anyone outside your org may message you.",
+			ask: "People outside your org send you a message request first.",
+			never: "No one outside your org may message you or send you a request, except people you have let message you."
+		},
+		ask: {
+			open: "Your teammates' agents may ask yours without asking you; their requests run guarded.",
+			ask: "You answer each request from a teammate's agent to yours first.",
+			never: "Your teammates' agents may not ask yours."
+		}
+	};
+}));
+// packages/daemon/dist/conv-caps.js
+async function ensureCurrent(link, own, persons, handle) {
+	const others = [...new Set(persons)].filter((p) => p !== own);
+	if (!others.length) return;
+	let outdated;
+	try {
+		outdated = (await link?.convCaps?.(others))?.outdated ?? [];
+	} catch {
+		return;
+	}
+	if (!outdated.length) return;
+	const handles = await Promise.all(outdated.map(async (p) => {
+		try {
+			return await handle(p);
+		} catch {
+			return p;
+		}
+	}));
+	throw new MessagingError("peer_outdated", `${handles.join(", ")} ${handles.length === 1 ? "needs" : "need"} to update Messaging`);
+}
+var init_conv_caps = __esmMin((() => {
+	init_dist$3();
+}));
 // packages/daemon/dist/consent/sentence.js
 function grantSentence(p, me, now) {
 	const levels = levelsFrom(p, now);
@@ -27857,6 +28561,38 @@ function grantSentence(p, me, now) {
 var init_sentence = __esmMin((() => {
 	init_grants();
 }));
+// packages/daemon/dist/wake-dms.js
+function teammateDms(conversations, self) {
+	const member = (state, person) => state.participants.some((p) => p.person === person && p.state === "member");
+	const seated = (state, person) => state.participants.some((p) => p.p === person && p.state === "member");
+	const channels = conversations.flatMap((c) => c.state?.kind === "channel" && seated(c.state, self) ? [c.state] : []);
+	const shares = new Map();
+	const shared = (person) => {
+		let found = shares.get(person);
+		if (found === void 0) shares.set(person, found = channels.some((state) => seated(state, person)));
+		return found;
+	};
+	const found = [];
+	for (const { cid, state } of conversations) {
+		if (state?.kind !== "dm" || !member(state, self)) continue;
+		const others = [...new Set(state.participants.filter((p) => p.person !== self).map((p) => p.person))];
+		if (others.length !== 1) continue;
+		const person = others[0];
+		if (!member(state, person) || !shared(person)) continue;
+		found.push({
+			cid,
+			person
+		});
+	}
+	return found;
+}
+function wakeArmable(grants, person, org) {
+	const chat = grants.personGrant(person)?.chat;
+	if (chat === "blocked" || chat === "muted") return false;
+	if (grants.hides(person, org)) return false;
+	return true;
+}
+var init_wake_dms = __esmMin((() => {}));
 // packages/daemon/dist/daemon.js
 async function startDaemon$1(options) {
 	const daemon = await Daemon.start(options);
@@ -27868,6 +28604,7 @@ async function startDaemon$1(options) {
 		status: () => daemon.status(),
 		conversations: () => daemon.conversations(),
 		conversationsReady: () => daemon.conversationsReady(),
+		actionTokens: () => daemon.actionTokens(),
 		sweep: () => daemon.sweep(),
 		close: () => daemon.close()
 	};
@@ -27875,6 +28612,16 @@ async function startDaemon$1(options) {
 function jsonBytes(value) {
 	return Buffer.byteLength(JSON.stringify(value) ?? "");
 }
+function signInMessage(message, tool) {
+	return {
+		...message,
+		metadata: {
+			...message.metadata,
+			[URI.signIn]: { tool }
+		},
+		extensions: [...message.extensions ?? [], URI.signIn]
+	};
+}
 function boundedRecord(record, limit) {
 	if (jsonBytes(record) <= limit) return structuredClone(record);
 	const { history: _history, artifacts: _artifacts, ...task } = record.task;
@@ -27982,7 +28729,7 @@ function signInToken(token) {
 		return false;
 	}
 }
-var DAY, KEYCHAIN_LEFTOVERS_KEY, DEFAULT_TUNING, KEPT_MS, INPUT_TIMEOUT_MS, TASK_BYTES, PREDECESSOR_KEY, REPLACE_LABEL_KEY, REPLACED_KEY, ERASURES_PER_DAY, DEVICE_NOTICES_KEY, TRUST_NOTICE_MS, DEVICES_CHANGED_MS, MACHINE_KEY, DEFAULT_INVITE_TTL_MS, Daemon, LIST_BYTES;
+var DAY, KEYCHAIN_LEFTOVERS_KEY, DEFAULT_TUNING, KEPT_MS, INPUT_TIMEOUT_MS, TASK_BYTES, PREDECESSOR_KEY, REPLACE_LABEL_KEY, REPLACED_KEY, ERASURES_PER_DAY, DEVICE_NOTICES_KEY, TRUST_NOTICE_MS, DEVICES_CHANGED_MS, MACHINE_KEY, DEFAULT_INVITE_TTL_MS, Daemon, LIST_BYTES, NAMED_PERSONS;
 var init_daemon = __esmMin((() => {
 	init_dist$3();
 	init_dist$2();
@@ -28012,6 +28759,7 @@ var init_daemon = __esmMin((() => {
 	init_answer_preview();
 	init_snapshot();
 	init_notices();
+	init_task_view();
 	init_counterpart();
 	init_resolve();
 	init_secrets();
@@ -28021,11 +28769,15 @@ var init_daemon = __esmMin((() => {
 	init_tasks();
 	init_version();
 	init_wake_bridge();
+	init_action_tokens();
 	init_grants();
 	init_holds();
 	init_cards();
 	init_requests();
+	init_reach();
+	init_conv_caps();
 	init_sentence();
+	init_wake_dms();
 	DAY = 864e5;
 	KEYCHAIN_LEFTOVERS_KEY = "keychain.stale";
 	DEFAULT_TUNING = {
@@ -28108,11 +28860,14 @@ var init_daemon = __esmMin((() => {
 		#cards;
 		#requests;
 		#notices;
+		#named = new Map();
+		#questions = new Map();
 		#jellyHost;
 		#attached = false;
 		#wakeArmed = false;
 		#snapshots;
 		#jellyAuth;
+		#actions;
 		#state = "starting";
 		#sync;
 		#pending = [];
@@ -28151,6 +28906,7 @@ var init_daemon = __esmMin((() => {
 			this.#jellyHttp = options.jellyHttp;
 			this.#loginWait = options.loginWait;
 			this.#jellyHost = options.jellyHost;
+			this.#actions = new ActionTokens(() => this.#now());
 			this.#config = readConfig(paths.config);
 			this.#configStamp = configStamp(paths.config);
 			this.closed = new Promise((resolve) => this.#settleClosed = resolve);
@@ -28177,9 +28933,10 @@ var init_daemon = __esmMin((() => {
 				put: (key, value) => store.setKv(key, value),
 				fresh: (people) => this.#withFresh(people, () => {}),
 				refuseSecrets: (value) => this.#refuseSecrets(value, "conv.send", "conversation line"),
-				blocked: (person) => this.#grants.personGrant(person)?.chat === "blocked",
+				blocked: (participant, org) => this.#grants.hides(participant, org),
 				current: (persons) => this.#ensureCurrent(persons),
-				outgoingRequests: () => this.#requests.waitingOnThem()
+				outgoingRequests: () => this.#requests.waitingOnThem(),
+				task: (id, role, ctx, authority) => this.#personTaskEntry(id, role, ctx, authority)
 			});
 			this.#conversationInbox = new ConversationInbox({
 				engine: () => this.#conversationEngine(),
@@ -28283,6 +29040,7 @@ var init_daemon = __esmMin((() => {
 				joined: () => this.#joined(),
 				relation: (person) => this.#grants.relation(person),
 				personGrant: (person) => this.#grants.personGrant(person),
+				reach: () => this.#grants.reach(),
 				prefetch: (person) => this.#grants.prefetch(person),
 				fresh: async (persons, fn) => {
 					await this.#withFresh(persons, () => this.#tx(fn), { first: false });
@@ -28656,10 +29414,10 @@ var init_daemon = __esmMin((() => {
 					} : p);
 				},
 				"device.list": () => {
-					return { devices: (this.#directory?.list() ?? this.#rosterDevices()).devices.map((d) => d.self && this.#away() ? {
+					return { devices: (this.#directory?.list() ?? this.#rosterDevices()).devices.map((d) => this.#withFeatures(d.self && this.#away() ? {
 						...d,
 						away: true
-					} : d) };
+					} : d)) };
 				},
 				"device.remove": (p) => this.#homeDirectory("device.remove").remove(p),
 				"device.link": (p) => this.#homeDirectory("device.link").link(p),
@@ -28719,10 +29477,13 @@ var init_daemon = __esmMin((() => {
 					...this.#bound(p, ctx),
 					kind: "message"
 				}),
-				"task.list": (p, ctx) => this.#listTasks(this.#bound(p, ctx)),
-				"task.get": (p, ctx) => this.#getTask(this.#bound(p, ctx)),
-				"task.update": (p, ctx) => this.#updateTask(this.#bound(p, ctx)),
-				"task.cancel": (p, ctx) => this.#cancelTask(this.#bound(p, ctx)),
+				"task.list": (p, ctx) => this.#listTasks(this.#bound(p, ctx), ctx.tier === "admin"),
+				"task.get": (p, ctx) => this.#getTask(this.#bound(p, ctx), ctx.tier === "admin"),
+				"task.update": (p, ctx) => this.#updateTask(this.#bound(p, ctx), ctx.tier === "admin"),
+				"task.cancel": (p, ctx, authority) => p.token === void 0 ? this.#cancelTask(this.#bound({
+					...p,
+					key: p.key
+				}, ctx), ctx.tier === "admin") : this.#cancelByToken(p, p.token, this.#tokenView("task.cancel", ctx, authority)),
 				"events.subscribe": (p, ctx) => {
 					for (const key of p.keys) this.#bound({ key }, ctx);
 					return { ok: true };
@@ -28751,13 +29512,28 @@ var init_daemon = __esmMin((() => {
 					this.#grants.check(p);
 					return { sentence: grantSentence(p, this.#joined().me.person, this.#now()) };
 				},
-				"request.list": async () => ({ requests: [
-					...this.#holds.list().requests,
-					...await this.#requests.list(),
-					...this.#conversationInvitations.list()
-				] }),
-				"request.answer": (p) => this.#conversationInvitations.holds(p.id) ? this.#conversationInvitations.answer(p.id, p.answer, p.all) : this.#requests.holds(p.id) ? this.#requests.answer(p) : this.#holds.answer(p),
-				"request.answer.preview": (p) => this.#answerPreview(p),
+				"reach.get": () => reachSnapshot(this.#grants),
+				"reach.set": (p) => reachSet(this.#grants, p),
+				"reach.set.preview": (p) => ({ sentence: reachPreview(this.#grants, p) }),
+				"request.list": async (_p, ctx, authority) => {
+					const requests = [
+						...this.#holds.list().requests,
+						...await this.#requests.list(),
+						...this.#conversationInvitations.list()
+					];
+					const view = actionView(ctx, authority, void 0);
+					return { requests: view === void 0 ? requests : requests.map((request) => this.#withActions(request, view)) };
+				},
+				"request.answer": (p, ctx, authority) => {
+					this.#requestToken("request.answer", p, ctx, authority, "redeem");
+					const { token: _token, ...answer } = p;
+					return this.#conversationInvitations.holds(answer.id) ? this.#conversationInvitations.answer(answer.id, answer.answer, answer.all) : this.#requests.holds(answer.id) ? this.#requests.answer(answer) : this.#holds.answer(answer);
+				},
+				"request.answer.preview": (p, ctx, authority) => {
+					this.#requestToken("request.answer.preview", p, ctx, authority, "check");
+					const { token: _token, ...answer } = p;
+					return this.#answerPreview(answer);
+				},
 				"contact.request": (p) => this.#requests.request(p),
 				"contact.request.preview": (p) => this.#requests.preview(p),
 				"card.get": async (p) => {
@@ -28774,6 +29550,9 @@ var init_daemon = __esmMin((() => {
 				"notice.subscribe": (p, ctx, authority) => this.#notices.subscribe(ctx, p, authority?.scope === "host" ? authority.expiresAt : void 0),
 				"notice.list": (p) => this.#notices.list(p),
 				"notice.ack": (p) => this.#notices.ack(p),
+				"task.question": (p, ctx) => this.#setQuestion(this.#bound(p, ctx)),
+				"tasks.list": (p, ctx, authority) => this.#personTasks(p, actionView(ctx, authority, void 0)),
+				"tasks.get": (p, ctx, authority) => this.#personTaskGet(p, actionView(ctx, authority, void 0)),
 				"device.remove.preview": (p) => this.#removePreview(p),
 				...this.#conversationIpc.handlers()
 			};
@@ -28840,7 +29619,7 @@ var init_daemon = __esmMin((() => {
 			else this.#publish(event);
 		}
 		#emitTask(row, origin, update) {
-			const record = this.#withFollowUps(boundedRecord(row.record, TASK_BYTES));
+			const record = this.#taskView(this.#withFollowUps(boundedRecord(row.record, TASK_BYTES)));
 			this.#emit({
 				type: "task",
 				key: row.record.key,
@@ -28848,6 +29627,10 @@ var init_daemon = __esmMin((() => {
 				origin,
 				...update ? { update: structuredClone(update) } : {}
 			});
+			this.#conversationIpc.taskChanged({
+				id: row.record.task.id,
+				role: row.record.role
+			});
 		}
 		#overBudget(before, after) {
 			const size = jsonBytes(after);
@@ -29049,6 +29832,7 @@ var init_daemon = __esmMin((() => {
 		}
 		#disconnected(ctx) {
 			if (this.#closed) return;
+			this.#actions.disconnected(ctx.id);
 			this.#notices.disconnected(ctx.id);
 			let changed = false;
 			for (const [key, lapsed] of [...this.#lapsed]) if (lapsed.delete(ctx.id) && lapsed.size === 0) this.#lapsed.delete(key);
@@ -30042,6 +30826,11 @@ var init_daemon = __esmMin((() => {
 				};
 				this.#store.putTask(row);
 				this.#emitTask(row, "peer");
+				if (sender.person !== this.#joined().me.person) this.#notices.task({
+					taskId,
+					person: sender.person,
+					at: now
+				});
 			} else if (executor) {
 				executor.record.task.history = [...executor.record.task.history ?? [], message];
 				executor.record.updatedAt = now;
@@ -30129,6 +30918,7 @@ var init_daemon = __esmMin((() => {
 				state: "TASK_STATE_CANCELED",
 				timestamp: iso(now)
 			};
+			this.#questions.delete(row.record.task.id);
 			row.record.task.status = status;
 			row.record.updatedAt = now;
 			this.#store.putTask(row);
@@ -30198,10 +30988,10 @@ var init_daemon = __esmMin((() => {
 			if (other && other.record.key === key) throw new MessagingError("invalid_state", role === "executor" ? "only the executor session may update this task" : "only the requester session may cancel this task");
 			throw new MessagingError("not_found", "no such task for this session");
 		}
-		#getTask(p) {
+		async #getTask(p, owner) {
 			for (const role of ["requester", "executor"]) {
 				const row = this.#store.task(p.taskId, role);
-				if (row && row.record.key === p.key) return this.#withFollowUps(row.record);
+				if (row && row.record.key === p.key) return this.#withQuestion(await this.#viewNamed(this.#withFollowUps(row.record)), owner);
 			}
 			throw new MessagingError("not_found", "no such task for this session");
 		}
@@ -30221,7 +31011,7 @@ var init_daemon = __esmMin((() => {
 				followUps
 			};
 		}
-		#listTasks(p) {
+		async #listTasks(p, owner) {
 			const limit = p.limit ?? 50;
 			const { rows, total, more } = this.#store.listTasks({
 				key: p.key,
@@ -30244,8 +31034,9 @@ var init_daemon = __esmMin((() => {
 			}
 			const last = tasks.at(-1);
 			const truncated = tasks.length < rows.length;
+			await Promise.all([...new Set(tasks.map((t) => t.peer.person))].map((person) => this.#nameOf(person)));
 			return {
-				tasks,
+				tasks: tasks.map((t) => this.#withQuestion(this.#taskView(t), owner)),
 				total,
 				...(more || truncated) && last ? { nextCursor: encodeCursor({
 					updatedAt: last.updatedAt,
@@ -30254,7 +31045,7 @@ var init_daemon = __esmMin((() => {
 				}) } : {}
 			};
 		}
-		async #updateTask(p) {
+		async #updateTask(p, owner) {
 			this.#joined();
 			const row = this.#ownTask(p.key, p.taskId, "executor");
 			this.#refuseSecrets(p, "task.update", "task update");
@@ -30266,7 +31057,7 @@ var init_daemon = __esmMin((() => {
 			const now = this.#now();
 			const status = statusChange ? {
 				state: p.state,
-				...p.message !== void 0 ? { message: agentMessage(p.message.parts, task.id, task.contextId, now) } : {},
+				...p.signIn !== void 0 ? { message: signInMessage(agentMessage(p.message?.parts ?? [{ text: "Sign-in required." }], task.id, task.contextId, now), p.signIn.tool) } : p.message !== void 0 ? { message: agentMessage(p.message.parts, task.id, task.contextId, now) } : {},
 				timestamp: iso(now)
 			} : void 0;
 			const after = structuredClone(row.record);
@@ -30305,6 +31096,7 @@ var init_daemon = __esmMin((() => {
 						contextId,
 						status
 					}, { replyTo: request });
+					this.#questions.delete(task.id);
 					task.status = status;
 					row.record.updatedAt = now;
 					this.#emitTask(row, "local", { status });
@@ -30314,12 +31106,94 @@ var init_daemon = __esmMin((() => {
 				this.#store.putTask(row);
 			});
 			await this.#settle(ids);
-			return boundedRecord(this.#store.task(p.taskId, "executor")?.record ?? row.record, TASK_BYTES);
+			return this.#withQuestion(await this.#viewNamed(boundedRecord(this.#store.task(p.taskId, "executor")?.record ?? row.record, TASK_BYTES)), owner);
+		}
+		async #cancelTask(p, owner) {
+			this.#joined();
+			return this.#cancelRow(this.#ownTask(p.key, p.taskId, "requester"), p, owner);
+		}
+		#tokenView(method, ctx, authority) {
+			const view = actionView(ctx, authority, void 0);
+			if (view === void 0) {
+				this.#log("warn", "action.token.refused", {
+					method,
+					reason: "not the human tier"
+				});
+				throw new MessagingError("forbidden", `${method} takes an action token only on the human tier`);
+			}
+			return view;
+		}
+		#requestToken(method, p, ctx, authority, use) {
+			if (p.token === void 0) {
+				if (this.#jellyHost === void 0) return;
+				this.#log("warn", "action.token.refused", {
+					method,
+					reason: "missing"
+				});
+				throw new MessagingError("grant_required", `${method} under a Jelly host needs the request's action token from request.list`);
+			}
+			this.#useToken(method, p.token, {
+				name: p.answer,
+				target: `request:${p.id}`,
+				view: this.#tokenView(method, ctx, authority)
+			}, use);
+		}
+		#useToken(method, token, want, use) {
+			try {
+				if (use === "redeem") this.#actions.redeem(token, want);
+				else this.#actions.check(token, want);
+			} catch (error) {
+				this.#log("warn", "action.token.refused", {
+					method,
+					reason: "no matching live token"
+				});
+				throw error;
+			}
+		}
+		actionTokens() {
+			return this.#actions.size;
+		}
+		#withActions(request, view) {
+			if (request.kind === "contact" && request.state !== "pending") return request;
+			const names = request.kind === "suggestion" ? ["decline"] : request.kind === "contact" ? [
+				"accept",
+				"decline",
+				"block"
+			] : request.kind === "agent-invitation" ? ["accept", "decline"] : [
+				"once",
+				"always",
+				"decline",
+				"block"
+			];
+			return {
+				...request,
+				actions: names.map((name) => ({
+					name,
+					token: this.#actions.offer(view, name, `request:${request.id}`)
+				}))
+			};
 		}
-		async #cancelTask(p) {
+		taskCancel(row, role, view) {
+			return taskCancelAction(this.#actions, {
+				id: row.record.task.id,
+				role,
+				ended: isTerminal(row.record.task.status.state)
+			}, view);
+		}
+		async #cancelByToken(p, token, view) {
 			this.#joined();
-			const row = this.#ownTask(p.key, p.taskId, "requester");
-			this.#refuseSecrets(p, "task.cancel", "task cancel");
+			this.#useToken("task.cancel", token, {
+				name: "cancel",
+				target: `task:${p.taskId}`,
+				view
+			}, "redeem");
+			const row = this.#store.task(p.taskId, "requester");
+			if (row === void 0) throw new MessagingError("not_found", "no task this person's agent asked has that id");
+			return this.#cancelRow(row, p, true);
+		}
+		async #cancelRow(row, p, owner) {
+			const { token: _token, ...scanned } = p;
+			this.#refuseSecrets(scanned, "task.cancel", "task cancel");
 			if (isTerminal(row.record.task.status.state)) throw new MessagingError("invalid_state", "the task is in a terminal state");
 			const env = this.#tx(() => {
 				const env = this.#seal("task.cancel", row.record.peer.device, this.#sessionName(row), {
@@ -30330,10 +31204,123 @@ var init_daemon = __esmMin((() => {
 				return env;
 			});
 			await this.#settle([env.id]);
-			return boundedRecord(this.#store.task(p.taskId, "requester")?.record ?? row.record, TASK_BYTES);
+			return this.#withQuestion(await this.#viewNamed(boundedRecord(this.#store.task(p.taskId, "requester")?.record ?? row.record, TASK_BYTES)), owner);
+		}
+		async #nameOf(person) {
+			const realm = this.#realm ?? this.#directory?.realm;
+			if (!realm) return this.#named.get(person);
+			let named;
+			try {
+				const profile = await realm.profile(person);
+				named = {
+					name: profile.name,
+					org: profile.org
+				};
+			} catch (error) {
+				if (!(error instanceof MessagingError) || error.code !== "not_found") return this.#named.get(person);
+				named = {
+					name: person,
+					org: "none"
+				};
+			}
+			if (this.#named.size >= NAMED_PERSONS && !this.#named.has(person)) this.#named.clear();
+			this.#named.set(person, named);
+			return named;
+		}
+		#taskView(record) {
+			const named = this.#named.get(record.peer.person);
+			if (named === void 0) this.#nameOf(record.peer.person).catch(() => void 0);
+			return withTaskView(record, this.#me(), named);
+		}
+		#setQuestion(p) {
+			const row = this.#ownTask(p.key, p.taskId, "executor");
+			if (p.question === null) {
+				if (this.#questions.delete(p.taskId)) this.#conversationIpc.taskChanged({
+					id: p.taskId,
+					role: "executor"
+				});
+				return { ok: true };
+			}
+			if (!isInterrupted(row.record.task.status.state)) throw new MessagingError("invalid_state", "only a task in auth-required or input-required waits on a question");
+			const host = this.#store.sessionHost(p.key);
+			if (host !== void 0 && host.sessionID !== p.question.sessionId) throw new MessagingError("forbidden", "a question names the session's own host session");
+			this.#questions.set(p.taskId, {
+				sessionId: p.question.sessionId,
+				approvalId: p.question.approvalId
+			});
+			this.#conversationIpc.taskChanged({
+				id: p.taskId,
+				role: "executor"
+			});
+			return { ok: true };
+		}
+		async #personTask(row, view) {
+			const { key: _key, ...rest } = this.#withQuestion(await this.#viewNamed(this.#withFollowUps(boundedRecord(row.record, TASK_BYTES))), true);
+			const cancel = this.taskCancel(row, row.record.role, view);
+			return {
+				...rest,
+				session: this.#sessionName(row),
+				...cancel ? { cancel } : {}
+			};
+		}
+		async #personTasks(p, view) {
+			const limit = p.limit ?? 50;
+			const key = p.session === void 0 ? void 0 : this.#store.sessionByName(p.session)?.key;
+			if (p.session !== void 0 && key === void 0) return {
+				tasks: [],
+				total: 0
+			};
+			const { rows, total, more } = this.#store.listTasks({
+				...key !== void 0 ? { key } : {},
+				role: p.role,
+				state: p.state,
+				after: p.cursor === void 0 ? void 0 : decodeCursor(p.cursor),
+				limit
+			});
+			const tasks = [];
+			let bytes = 0;
+			for (const row of rows) {
+				const task = await this.#personTask(row, view);
+				const size = jsonBytes(task);
+				if (tasks.length > 0 && bytes + size > LIST_BYTES) break;
+				tasks.push(task);
+				bytes += size;
+			}
+			const last = tasks.at(-1);
+			return {
+				tasks,
+				total,
+				...(more || tasks.length < rows.length) && last ? { nextCursor: encodeCursor({
+					updatedAt: last.updatedAt,
+					taskId: last.task.id,
+					role: last.role
+				}) } : {}
+			};
+		}
+		async #personTaskGet(p, view) {
+			const rows = (p.role !== void 0 ? [p.role] : ["requester", "executor"]).flatMap((role) => this.#store.task(p.taskId, role) ?? []);
+			if (rows.length === 0) throw new MessagingError("not_found", "no task of this person's agents has that id");
+			if (rows.length > 1) throw new MessagingError("invalid_request", "this device holds both sides of that task; supply role");
+			return await this.#personTask(rows[0], view);
+		}
+		async #personTaskEntry(id, role, ctx, authority) {
+			const row = this.#store.task(id, role);
+			return row ? await this.#personTask(row, actionView(ctx, authority, void 0)) : void 0;
+		}
+		#withQuestion(view, owner) {
+			const question = this.#questions.get(view.task.id);
+			if (!owner || question === void 0 || view.role !== "executor" || !isInterrupted(view.task.status.state)) return view;
+			return {
+				...view,
+				question: { ...question }
+			};
+		}
+		async #viewNamed(record) {
+			return withTaskView(record, this.#me(), await this.#nameOf(record.peer.person).catch(() => void 0));
 		}
 		sweep() {
 			if (this.#closed) return;
+			this.#actions.sweep();
 			this.#directory?.sweep();
 			const now = this.#now();
 			this.#expireTickets(now);
@@ -30383,6 +31370,7 @@ var init_daemon = __esmMin((() => {
 				message: agentMessage([{ text: INPUT_TIMEOUT_TEXT }], row.record.task.id, row.record.task.contextId, now),
 				timestamp: iso(now)
 			};
+			this.#questions.delete(row.record.task.id);
 			row.record.task.status = status;
 			row.record.updatedAt = now;
 			this.#store.putTask(row);
@@ -30390,24 +31378,7 @@ var init_daemon = __esmMin((() => {
 			this.#sendStatus(row);
 		}
 		async #ensureCurrent(persons) {
-			const own = this.#joined().me.person;
-			const others = [...new Set(persons)].filter((p) => p !== own);
-			if (!others.length) return;
-			let outdated;
-			try {
-				outdated = (await this.#transport?.conversations?.convCaps?.(others))?.outdated ?? [];
-			} catch {
-				return;
-			}
-			if (!outdated.length) return;
-			const handles = await Promise.all(outdated.map(async (p) => {
-				try {
-					return (await this.#joined().realm.profile(p)).handle;
-				} catch {
-					return p;
-				}
-			}));
-			throw new MessagingError("peer_outdated", `${handles.join(", ")} ${handles.length === 1 ? "needs" : "need"} to update Messaging`);
+			await ensureCurrent(this.#transport?.conversations, this.#joined().me.person, persons, async (p) => (await this.#joined().realm.profile(p)).handle);
 		}
 		conversations() {
 			return this.#conversationEngine();
@@ -30767,6 +31738,15 @@ var init_daemon = __esmMin((() => {
 				self: d.machine === identity.machine
 			})) };
 		}
+		#withFeatures(d) {
+			const raw = d.self ? [...FEATURES] : this.#store.directoryRow(d.device)?.presence.features;
+			if (raw === void 0) return d;
+			const features = [...new Set(raw.filter((f) => PresenceFeature.safeParse(f).success))].slice(0, 32);
+			return {
+				...d,
+				features
+			};
+		}
 		#away() {
 			return this.#jellyHost !== void 0 && !this.#attached;
 		}
@@ -30798,23 +31778,49 @@ var init_daemon = __esmMin((() => {
 			if (issuer === void 0 || new URL(p.url).origin !== new URL(issuer).origin) throw new MessagingError("invalid_request", "the wake URL is not on the realm's Jelly ID");
 			const agents = [...new Set(p.agents)];
 			const awaiting = this.#store.awaitedRequests(agents, TERMINAL_STATES, 500);
+			const dms = await this.#wakeDms();
 			const sent = await home.wake({
 				url: p.url,
 				ticket: p.ticket,
 				agents,
-				awaiting
+				awaiting,
+				dms
 			});
 			this.#wakeArmed = true;
 			this.#log("info", "wake.arm", {
 				relay: sent === "sent" ? "armed" : "pending",
 				agents: agents.length,
-				awaiting: awaiting.length
+				awaiting: awaiting.length,
+				dms: dms.length
 			});
 			return {
 				relay: sent === "sent" ? "armed" : "pending",
-				awaiting: awaiting.length
+				awaiting: awaiting.length,
+				dms: dms.length
 			};
 		}
+		async #wakeDms() {
+			const engine = this.#conversationEngine();
+			if (!engine) return [];
+			const { me, realm } = this.#joined();
+			const orgs = new Map();
+			const orgOf = (person) => {
+				let org = orgs.get(person);
+				if (!org) orgs.set(person, org = realm.profile(person).then((profile) => profile.org, () => "none"));
+				return org;
+			};
+			const candidates = teammateDms(engine.list(), me.person);
+			await realm.freshen?.(candidates.map((c) => c.person)).catch(() => {});
+			const dms = [];
+			for (const { cid, person } of candidates) {
+				if (dms.length >= 256) break;
+				if (this.#shouldArm(person, await orgOf(person))) dms.push(cid);
+			}
+			return dms;
+		}
+		#shouldArm(person, org) {
+			return wakeArmable(this.#grants, person, org);
+		}
 		async #wakeDisarm() {
 			const home = this.#directory;
 			if (!home) throw new MessagingError("invalid_state", "wake tickets are for a directory realm");
@@ -31625,6 +32631,7 @@ var init_daemon = __esmMin((() => {
 		}
 	};
 	LIST_BYTES = 1572864;
+	NAMED_PERSONS = 1e3;
 }));
 // node_modules/ws/lib/constants.js
 var require_constants = __commonJSMin(((exports, module) => {
@@ -34164,7 +35171,8 @@ var init_pages = __esmMin((() => {
 var init_store$2 = __esmMin((() => {
 	init_dist$3();
 	({DatabaseSync} = process.getBuiltinModule("node:sqlite"));
-	MIGRATIONS = [`
+	MIGRATIONS = [
+		`
 CREATE TABLE IF NOT EXISTS conv_logs (
   realm TEXT NOT NULL,
   cid TEXT NOT NULL,
@@ -34215,7 +35223,8 @@ CREATE TABLE IF NOT EXISTS conv_shares (
 CREATE INDEX IF NOT EXISTS conv_shares_to ON conv_shares (realm, cid, to_device, n);
 CREATE INDEX IF NOT EXISTS conv_shares_pair ON conv_shares (realm, cid, from_device, to_device);
 CREATE INDEX IF NOT EXISTS conv_shares_at ON conv_shares (at);
-`, `
+`,
+		`
 CREATE TABLE IF NOT EXISTS conv_request_decisions (
   realm TEXT NOT NULL,
   id TEXT NOT NULL,
@@ -34223,7 +35232,17 @@ CREATE TABLE IF NOT EXISTS conv_request_decisions (
   decision TEXT NOT NULL,
   PRIMARY KEY (realm, id)
 );
-`];
+`,
+		`
+CREATE TABLE IF NOT EXISTS dir_wake_dms (
+  device TEXT NOT NULL,
+  cid TEXT NOT NULL,
+  exp INTEGER NOT NULL,
+  PRIMARY KEY (device, cid)
+);
+CREATE INDEX IF NOT EXISTS dir_wake_dms_exp ON dir_wake_dms (exp);
+`
+	];
 	1 + MIGRATIONS.length;
 }));
 // packages/relay/dist/backoff.js
@@ -34879,7 +35898,8 @@ var init_client = __esmMin((() => {
 				url: arm.url,
 				ticket: arm.ticket,
 				agents: arm.agents,
-				awaiting: arm.awaiting
+				awaiting: arm.awaiting,
+				...arm.dms ? { dms: arm.dms } : {}
 			});
 		}
 		wakeDisarm() {