@masons/agent-network 0.6.22 → 0.6.24

package/dist/_vendor/runtime-adapter-client/work-target.js

@@ -4,13 +4,19 @@ export function parseRuntimeWorkTargetRef(value) {
     const raw = value;
     if (raw.kind !== "projection_endpoint" ||
         typeof raw.projection_endpoint_id !== "string" ||
-        raw.projection_endpoint_id.trim().length === 0) {
+        raw.projection_endpoint_id.length === 0 ||
+        raw.projection_endpoint_id.trim() !== raw.projection_endpoint_id) {
         return null;
     }
-    const projectionEndpointId = raw.projection_endpoint_id.trim();
+    const projectionEndpointId = raw.projection_endpoint_id;
     if (raw.background_exchange_mode === "resident_endpoint") {
-        if (raw.runtime_session_id !== undefined)
+        if (!hasExactKeys(raw, [
+            "kind",
+            "projection_endpoint_id",
+            "background_exchange_mode",
+        ])) {
             return null;
+        }
         return {
             kind: "projection_endpoint",
             projection_endpoint_id: projectionEndpointId,
@@ -20,16 +26,28 @@ export function parseRuntimeWorkTargetRef(value) {
     if ((raw.background_exchange_mode === "adapter_managed_turn" ||
         raw.background_exchange_mode === "session_attached_pull") &&
         typeof raw.runtime_session_id === "string" &&
-        raw.runtime_session_id.trim().length > 0) {
+        raw.runtime_session_id.length > 0 &&
+        raw.runtime_session_id.trim() === raw.runtime_session_id &&
+        hasExactKeys(raw, [
+            "kind",
+            "projection_endpoint_id",
+            "runtime_session_id",
+            "background_exchange_mode",
+        ])) {
         return {
             kind: "projection_endpoint",
             projection_endpoint_id: projectionEndpointId,
-            runtime_session_id: raw.runtime_session_id.trim(),
+            runtime_session_id: raw.runtime_session_id,
             background_exchange_mode: raw.background_exchange_mode,
         };
     }
     return null;
 }
+function hasExactKeys(value, expected) {
+    const actual = Object.keys(value).sort();
+    return (actual.length === expected.length &&
+        [...expected].sort().every((key, index) => actual[index] === key));
+}
 export function isRuntimeWorkTargetRef(value) {
     return parseRuntimeWorkTargetRef(value) !== null;
 }

package/dist/channel-setup.d.ts

@@ -2,6 +2,7 @@ interface StartChannelSetupOptions {
     apiHost: string;
     connectorUrl?: string;
     idpBaseUrl: string;
+    idpBaseUrlIsDefault?: boolean;
     invitedBy?: string;
 }
 export interface ChannelSetupResult {

package/dist/channel-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"channel-setup.d.ts","sourceRoot":"","sources":["../src/channel-setup.ts"],"names":[],"mappings":"AAeA,UAAU,wBAAwB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IAMnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA2BD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAOD,wBAAgB,6BAA6B,IAAI,wBAAwB,CAKxE;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,CAAC,CAqC7B;AAED,wBAAgB,qBAAqB,IAAI,kBAAkB,GAAG,IAAI,CAcjE;AAED,wBAAgB,yBAAyB,IAAI,kBAAkB,GAAG,IAAI,CAMrE;AAmFD,wBAAgB,4BAA4B,IAAI,IAAI,CAGnD;AAED,eAAO,MAAM,oBAAoB,QAAqB,CAAC"}
+{"version":3,"file":"channel-setup.d.ts","sourceRoot":"","sources":["../src/channel-setup.ts"],"names":[],"mappings":"AAeA,UAAU,wBAAwB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IAEnB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAM9B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA2BD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAOD,wBAAgB,6BAA6B,IAAI,wBAAwB,CAKxE;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,CAAC,CAsC7B;AAED,wBAAgB,qBAAqB,IAAI,kBAAkB,GAAG,IAAI,CAcjE;AAED,wBAAgB,yBAAyB,IAAI,kBAAkB,GAAG,IAAI,CAMrE;AAmFD,wBAAgB,4BAA4B,IAAI,IAAI,CAGnD;AAED,eAAO,MAAM,oBAAoB,QAAqB,CAAC"}

package/dist/channel-setup.js

@@ -32,6 +32,7 @@ export async function startOrGetChannelSetup(options) {
     const session = await beginBridgeHandoff({
         apiHost: options.apiHost,
         idpBaseUrl: options.idpBaseUrl,
+        idpBaseUrlIsDefault: options.idpBaseUrlIsDefault,
     });
     const record = {
         session,
@@ -78,7 +79,7 @@ function getActivePendingSetup() {
         return pendingSetup;
     lastSetupStatus = {
         status: "expired",
-        message: "The previous setup link expired before the browser handoff completed.",
+        message: "The previous Link URL expired before the browser handoff completed.",
         finishedAt: Date.now(),
     };
     pendingSetup = null;
@@ -131,8 +132,8 @@ function isExpiryError(err) {
 function safeSetupErrorMessage(err) {
     if (err instanceof SetupFlowError)
         return err.message;
-    dbg("setup failed with an unexpected error: %O", err);
-    return "Setup failed for an unexpected reason; check debug logs.";
+    dbg("link failed with an unexpected error: %O", err);
+    return "Link failed for an unexpected reason; check debug logs.";
 }
 export function _resetChannelSetupForTesting() {
     pendingSetup = null;

package/dist/cli-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-setup.d.ts","sourceRoot":"","sources":["../src/cli-setup.ts"],"names":[],"mappings":"AA8FA,UAAU,eAAe;IACvB,GAAG,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC9B,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAOD,UAAU,gBAAgB;IACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAmFD,wBAAsB,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2EhE"}
+{"version":3,"file":"cli-setup.d.ts","sourceRoot":"","sources":["../src/cli-setup.ts"],"names":[],"mappings":"AA8FA,UAAU,eAAe;IACvB,GAAG,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC9B,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAOD,UAAU,gBAAgB;IACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAqFD,wBAAsB,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+EhE"}

package/dist/cli-setup.js

@@ -3,14 +3,15 @@ import { ConnectorUrlConfigurationError, resolveConnectorUrlForSetup, } from "./
 import { beginBridgeHandoff, completeBridgeHandoff, DEFAULT_IDP_BASE_URL, SetupFlowError, } from "./handoff.js";
 import { acceptBridgeHandoff } from "./handoff-acceptance.js";
 import { DEFAULT_API_HOST, DEFAULT_CONNECTOR_URL, PlatformApiError, } from "./platform-client.js";
-async function serverBridgeHandoffFlow(apiHost, idpBaseUrl, runtime) {
+async function serverBridgeHandoffFlow(apiHost, idpBaseUrl, idpBaseUrlIsDefault, runtime) {
     const session = await beginBridgeHandoff({
         apiHost,
         idpBaseUrl,
+        idpBaseUrlIsDefault,
     });
     runtime.writeStdout([
         "",
-        "Open this link in your browser to finish setup:",
+        "Open this link in your browser to complete the Link:",
         `  ${session.handoffUrl}`,
         "",
         "Waiting for the runtime key to be issued and delivered…",
@@ -23,12 +24,11 @@ async function serverBridgeHandoffFlow(apiHost, idpBaseUrl, runtime) {
 }
 export async function login(ctx) {
     const apiHost = typeof ctx.cfg.apiHost === "string" ? ctx.cfg.apiHost : DEFAULT_API_HOST;
-    const idpBaseUrl = typeof ctx.cfg.idpBaseUrl === "string"
-        ? ctx.cfg.idpBaseUrl
-        : DEFAULT_IDP_BASE_URL;
+    const configuredIdpBaseUrl = typeof ctx.cfg.idpBaseUrl === "string" ? ctx.cfg.idpBaseUrl : undefined;
+    const idpBaseUrl = configuredIdpBaseUrl ?? DEFAULT_IDP_BASE_URL;
     let completed;
     try {
-        completed = await serverBridgeHandoffFlow(apiHost, idpBaseUrl, ctx.runtime);
+        completed = await serverBridgeHandoffFlow(apiHost, idpBaseUrl, configuredIdpBaseUrl === undefined, ctx.runtime);
     }
     catch (err) {
         if (err instanceof SetupFlowError) {
@@ -36,7 +36,7 @@ export async function login(ctx) {
             return;
         }
         if (err instanceof PlatformApiError) {
-            ctx.runtime.error(`Setup failed (HTTP ${err.status} ${err.code}): ${err.message}`);
+            ctx.runtime.error(`Link failed (HTTP ${err.status} ${err.code}): ${err.message}`);
             return;
         }
         throw err;

package/dist/config.js

@@ -104,7 +104,7 @@ export function requirePlatformConfig() {
 }
 export function requireApiKey() {
     if (!storedApiKey) {
-        throw new Error("No runtime key configured. Complete setup first.");
+        throw new Error("No runtime key configured. Complete Link first.");
     }
     return storedApiKey;
 }

package/dist/handoff-acceptance.js

@@ -32,20 +32,20 @@ async function refreshCanonicalNode(options) {
         throw acceptanceFailure(err, options.apiHost);
     }
     if (node === null) {
-        throw new SetupFlowError(`The delivered runtime key is valid, but the network reports no active Node for it to represent, so it was not accepted. ${NOTHING_CHANGED} Choose or create an Agent Node in the console, then re-run setup.`);
+        throw new SetupFlowError(`The delivered runtime key is valid, but the network reports no active Node for it to represent, so it was not accepted. ${NOTHING_CHANGED} Choose or create an Agent Node in the console, then re-run Link.`);
     }
     return node;
 }
 function acceptanceFailure(err, apiHost) {
     switch (classifyIdentityError(err)) {
         case "credential-refused":
-            return new SetupFlowError(`The network rejected the runtime key delivered by the browser${httpStatusSuffix(err)}, so it was not accepted. That is a credential-class refusal — retrying will not change it. ${NOTHING_CHANGED} Re-run setup to authorize a new runtime key.`);
+            return new SetupFlowError(`The network rejected the runtime key delivered by the browser${httpStatusSuffix(err)}, so it was not accepted. That is a credential-class refusal — retrying will not change it. ${NOTHING_CHANGED} Re-run Link to authorize a new runtime key.`);
         case "entity-missing":
-            return new SetupFlowError(`The delivered runtime key authenticates, but the Node it represents has no backing entity on the network — it is missing or deleted — so it was not accepted. ${NOTHING_CHANGED} Choose or create an Agent Node in the console, then re-run setup.`);
+            return new SetupFlowError(`The delivered runtime key authenticates, but the Node it represents has no backing entity on the network — it is missing or deleted — so it was not accepted. ${NOTHING_CHANGED} Choose or create an Agent Node in the console, then re-run Link.`);
         case "endpoint-absent":
-            return new SetupFlowError(`This MASONS Services deployment does not serve the identity endpoint (HTTP 404 for GET /v1/me/identity at ${apiHost}), so the delivered runtime key could not be verified and was not accepted. That is a property of this host — an older or self-hosted apps/api — not an expired link. ${NOTHING_CHANGED} Point setup at a Services deployment that serves the identity endpoint, or upgrade this one, then re-run setup.`);
+            return new SetupFlowError(`This MASONS Services deployment does not serve the identity endpoint (HTTP 404 for GET /v1/me/identity at ${apiHost}), so the delivered runtime key could not be verified and was not accepted. That is a property of this host — an older or self-hosted apps/api — not an expired link. ${NOTHING_CHANGED} Point Link at a Services deployment that serves the identity endpoint, or upgrade this one, then re-run Link.`);
         case "unavailable":
-            return new SetupFlowError(`The network could not confirm which Node the delivered runtime key represents (${unavailableDetail(err)}), so it was not accepted. ${NOTHING_CHANGED} Re-run setup to try again.`);
+            return new SetupFlowError(`The network could not confirm which Node the delivered runtime key represents (${unavailableDetail(err)}), so it was not accepted. ${NOTHING_CHANGED} Re-run Link to try again.`);
         default:
             return err;
     }

package/dist/handoff-deadline.js

@@ -2,6 +2,6 @@ export class SetupFlowError extends Error {
 }
 export function assertHandoffDeadlineActive(expiresAt) {
     if (Date.now() >= expiresAt) {
-        throw new SetupFlowError("Handoff session expired before the runtime key was delivered. Re-run setup.");
+        throw new SetupFlowError("Handoff session expired before the runtime key was delivered. Re-run Link.");
     }
 }

package/dist/handoff.d.ts

@@ -20,6 +20,7 @@ export interface BridgeHandoffSession {
 export interface BeginBridgeHandoffOptions {
     apiHost: string;
     idpBaseUrl: string;
+    idpBaseUrlIsDefault?: boolean;
 }
 export declare function beginBridgeHandoff(options: BeginBridgeHandoffOptions): Promise<BridgeHandoffSession>;
 export declare function completeBridgeHandoff(session: BridgeHandoffSession): Promise<BridgeHandoffResult>;

package/dist/handoff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handoff.d.ts","sourceRoot":"","sources":["../src/handoff.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,SAAS,EAEf,MAAM,aAAa,CAAC;AAQrB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAavD,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAWhE,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AA0BjD,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1D;AAQD,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAOhB,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,oBAAoB,CAAC,CAkD/B;AAKD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CA0C9B"}
+{"version":3,"file":"handoff.d.ts","sourceRoot":"","sources":["../src/handoff.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,SAAS,EAEf,MAAM,aAAa,CAAC;AAQrB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAavD,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAWhE,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AA0BjD,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1D;AAQD,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAOhB,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IAMnB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAMD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,oBAAoB,CAAC,CAiE/B;AAKD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CA0C9B"}

package/dist/handoff.js

@@ -15,6 +15,7 @@ export async function beginBridgeHandoff(options) {
         .toString("base64url");
     const apiBase = normalizeHttpBase(options.apiHost);
     let sessionId;
+    let ownerChoiceUrl;
     try {
         const initRes = await apiFetch(`${apiBase}/v1/cli-handoff/init`, {
             method: "POST",
@@ -24,25 +25,29 @@ export async function beginBridgeHandoff(options) {
             }),
         });
         if (!initRes.ok) {
-            throw new SetupFlowError(`Setup service rejected init (HTTP ${initRes.status}). Retry in a moment; if it persists, check that ${apiBase} is reachable and not behind a proxy that strips the request body.`);
+            throw new SetupFlowError(`Link service rejected init (HTTP ${initRes.status}). Retry in a moment; if it persists, check that ${apiBase} is reachable and not behind a proxy that strips the request body.`);
         }
         const initBody = (await initRes.json());
         if (typeof initBody.session_id !== "string" ||
             initBody.session_id.length === 0) {
-            throw new SetupFlowError("Setup service returned a malformed response (missing session_id). Retry; if it persists, this is a server-side bug worth reporting.");
+            throw new SetupFlowError("Link service returned a malformed response (missing session_id). Retry; if it persists, this is a server-side bug worth reporting.");
+        }
+        if (typeof initBody.owner_choice_url !== "string" ||
+            initBody.owner_choice_url.length === 0) {
+            throw new SetupFlowError("The Link service did not return a usable owner_choice_url in the init response (missing, empty, or not a string). Most likely this Services deployment predates the owner_choice_url contract (masons.ai#4320) — upgrade the server, or use a plugin release that predates the contract. This runtime does not compose that address itself.");
         }
         sessionId = initBody.session_id;
+        ownerChoiceUrl = initBody.owner_choice_url;
     }
     catch (err) {
         if (err instanceof SetupFlowError)
             throw err;
         const message = err instanceof Error ? err.message : "unknown error";
-        throw new SetupFlowError(`Could not reach the setup service at ${apiBase} (${message}). Retry in a moment.`);
+        throw new SetupFlowError(`Could not reach the Link service at ${apiBase} (${message}). Retry in a moment.`);
     }
-    const handoffUrl = `${options.idpBaseUrl}/console/handoff?session=${encodeURIComponent(sessionId)}`;
     return {
         sessionId,
-        handoffUrl,
+        handoffUrl: verifyOwnerChoiceUrl(ownerChoiceUrl, options.idpBaseUrl, options.idpBaseUrlIsDefault ?? false),
         apiBase,
         privateKey,
         expiresAt: Date.now() + HANDOFF_TIMEOUT_MS,
@@ -56,14 +61,14 @@ export async function completeBridgeHandoff(session) {
     }
     catch (err) {
         const message = err instanceof Error ? err.message : "unknown error";
-        throw new SetupFlowError(`Handoff received but could not be decrypted (${message}). The link may have been tampered with — re-run setup. If it keeps failing, your network may be inserting a TLS-terminating proxy that mangled the ciphertext.`);
+        throw new SetupFlowError(`Handoff received but could not be decrypted (${message}). The link may have been tampered with — re-run Link. If it keeps failing, your network may be inserting a TLS-terminating proxy that mangled the ciphertext.`);
     }
     assertHandoffDeadlineActive(session.expiresAt);
     if (typeof payload.token !== "string" ||
         !RUNTIME_KEY_PATTERN.test(payload.token) ||
         typeof payload.agent?.handle !== "string" ||
         typeof payload.agent?.agentId !== "string") {
-        throw new SetupFlowError("Handoff payload did not match the expected shape. Re-run setup; if it keeps happening, this is a server-side bug worth reporting.");
+        throw new SetupFlowError("Handoff payload did not match the expected shape. Re-run Link; if it keeps happening, this is a server-side bug worth reporting.");
     }
     return {
         token: payload.token,
@@ -94,7 +99,7 @@ async function pollForCompletion(apiBase, sessionId, expiresAt) {
         if (Date.now() >= expiresAt)
             break;
         if (res.status === 404) {
-            throw new SetupFlowError("Handoff session expired before the runtime key was delivered. Re-run setup.");
+            throw new SetupFlowError("Handoff session expired before the runtime key was delivered. Re-run Link.");
         }
         if (!res.ok) {
             await sleepBeforeNextPoll(expiresAt);
@@ -109,8 +114,8 @@ async function pollForCompletion(apiBase, sessionId, expiresAt) {
         await sleepBeforeNextPoll(expiresAt);
     }
     throw new SetupFlowError(lastNetworkError
-        ? `Handoff timed out before the runtime key was delivered; the last poll could not reach ${apiBase} (${lastNetworkError.message}). Re-run setup; if you're behind a proxy that blocks long-running fetches, retry on a different network.`
-        : "Handoff timed out before the runtime key was delivered. Re-run setup; if you're behind a proxy that blocks long-running fetches, retry on a different network.");
+        ? `Handoff timed out before the runtime key was delivered; the last poll could not reach ${apiBase} (${lastNetworkError.message}). Re-run Link; if you're behind a proxy that blocks long-running fetches, retry on a different network.`
+        : "Handoff timed out before the runtime key was delivered. Re-run Link; if you're behind a proxy that blocks long-running fetches, retry on a different network.");
 }
 async function sleepBeforeNextPoll(expiresAt) {
     const remainingMs = expiresAt - Date.now();
@@ -144,6 +149,34 @@ function decryptBridgeEnvelope(privateKey, envelope) {
     ]);
     return JSON.parse(plaintext.toString("utf-8"));
 }
+function verifyOwnerChoiceUrl(ownerChoiceUrl, idpBaseUrl, idpBaseUrlIsDefault) {
+    const configured = parseAbsoluteUrl(idpBaseUrl);
+    if (!configured) {
+        throw new SetupFlowError("This Runtime's identity provider (idpBaseUrl) is not an absolute http(s) URL, so the owner-choice address the Link service named cannot be verified. Set idpBaseUrl for this channel to an absolute http(s) URL and re-run Link.");
+    }
+    const named = parseAbsoluteUrl(ownerChoiceUrl);
+    if (!named) {
+        throw new SetupFlowError("The Link service named an owner-choice address that is not a valid absolute URL; refusing to direct the owner's browser to it. Retry; if it persists, this is a server-side bug worth reporting.");
+    }
+    if (named.protocol !== "http:" && named.protocol !== "https:") {
+        throw new SetupFlowError(`The Link service named an owner-choice address using the "${named.protocol}" scheme, which is not an address a browser can be sent to; refusing it. Retry; if it persists, this is a server-side bug worth reporting.`);
+    }
+    if (named.origin !== configured.origin) {
+        const anchor = idpBaseUrlIsDefault
+            ? "the built-in default identity provider (idpBaseUrl is not set)"
+            : "your configured identity provider (idpBaseUrl)";
+        throw new SetupFlowError(`The Link service named an owner-choice address on ${named.origin}, which is not ${anchor}: ${configured.origin}. Refusing to direct the owner's browser there. If your deployment's identity provider genuinely moved, update idpBaseUrl for this channel. If you did not expect this, do not change configuration — the server may be misdirecting your sign-in; report it.`);
+    }
+    return named.href;
+}
+function parseAbsoluteUrl(value) {
+    try {
+        return new URL(value);
+    }
+    catch {
+        return null;
+    }
+}
 function normalizeHttpBase(apiHost) {
     const trimmed = apiHost.replace(/\/+$/, "");
     if (/^https?:\/\//.test(trimmed))

package/dist/platform-client.d.ts

@@ -13,10 +13,6 @@ export declare class PlatformNetworkError extends Error {
     readonly detail: string;
     constructor(code: "timeout" | "network", detail: string);
 }
-export interface RequestConnectionResponse {
-    requestIds: string[];
-    status: string;
-}
 export interface ConnectionNodeRef {
     kind: string;
     mstpAddress: string;
@@ -24,31 +20,43 @@ export interface ConnectionNodeRef {
     displayName?: string;
     avatarUrl?: string;
 }
-export interface ListRequestsItem {
+export type PackagedRequestStatus = "awaiting-your-decision" | "awaiting-counterparty" | "accepted" | "ignored" | "withdrawn";
+export interface PackagedTombstoneCounterparty {
     id: string;
-    direction: "incoming" | "outgoing";
-    fromNode?: ConnectionNodeRef | null;
-    toNode?: ConnectionNodeRef | null;
-    variant: string;
-    status: string;
-    matchmaking: {
-        title: string | null;
-        benefit: string | null;
-        scenario: string | null;
-    };
+    kind?: string;
+    handle?: string;
+    mstpAddress?: string;
+    tombstone: true;
+}
+export type PackagedCounterparty = ConnectionNodeRef | PackagedTombstoneCounterparty;
+export declare function isPackagedTombstone(c: PackagedCounterparty): c is PackagedTombstoneCounterparty;
+export interface PackagedRequest {
+    id: string;
+    counterparty: PackagedCounterparty;
+    counterpartyProfile?: {
+        tagline: string | null;
+    } | null;
+    status: PackagedRequestStatus;
+    shadowed?: true;
     createdAt: string;
+    resolvedAt?: string;
 }
 export interface ListRequestsResponse {
-    total: number;
-    items: ListRequestsItem[];
-}
-export interface AcceptRequestResponse {
-    status: "accepted";
-    counterparty: ConnectionNodeRef | null;
+    items: PackagedRequest[];
+    nextCursor: string | null;
 }
-export interface DeclineRequestResponse {
-    status: "declined";
+export interface CreateRequestResult {
+    request: PackagedRequest | null;
+    created: boolean;
 }
+export type ResolveRequestResult = {
+    outcome: "resolved";
+    idempotent: boolean;
+    request: PackagedRequest | null;
+} | {
+    outcome: "already_resolved";
+    status: string | null;
+};
 export interface UpdateProfileParams {
     name?: string;
     scope?: string;
@@ -73,18 +81,15 @@ export interface ListConnectionsResponse {
     }>;
 }
 export declare function apiFetch(url: string, init?: RequestInit): Promise<Response>;
-export declare function requestConnection(cfg: PlatformClientConfig, runtimeKey: string, params: {
-    targetHandle: string;
-    variants: ("distribute" | "receive")[];
-}): Promise<RequestConnectionResponse>;
+export declare function requestConnection(cfg: PlatformClientConfig, runtimeKey: string, targetHandle: string): Promise<CreateRequestResult>;
 export declare function listRequests(cfg: PlatformClientConfig, runtimeKey: string, params?: {
-    status?: string;
-    direction?: string;
-    page?: number;
     limit?: number;
+    cursor?: string;
+    counterparty?: string;
 }): Promise<ListRequestsResponse>;
-export declare function acceptRequest(cfg: PlatformClientConfig, runtimeKey: string, requestId: string): Promise<AcceptRequestResponse>;
-export declare function declineRequest(cfg: PlatformClientConfig, runtimeKey: string, requestId: string): Promise<DeclineRequestResponse>;
+export declare const acceptRequest: (cfg: PlatformClientConfig, runtimeKey: string, requestId: string) => Promise<ResolveRequestResult>;
+export declare const ignoreRequest: (cfg: PlatformClientConfig, runtimeKey: string, requestId: string) => Promise<ResolveRequestResult>;
+export declare const withdrawRequest: (cfg: PlatformClientConfig, runtimeKey: string, requestId: string) => Promise<ResolveRequestResult>;
 export declare function updateProfile(cfg: PlatformClientConfig, runtimeKey: string, params: UpdateProfileParams): Promise<UpdateProfileResponse>;
 export declare function listConnections(cfg: PlatformClientConfig, runtimeKey: string): Promise<ListConnectionsResponse>;
 export declare function getIdentity(cfg: PlatformClientConfig, runtimeKey: string): Promise<ConnectionNodeRef | null>;

package/dist/platform-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-client.d.ts","sourceRoot":"","sources":["../src/platform-client.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,gBAAgB,0BAA0B,CAAC;AASxD,eAAO,MAAM,qBAAqB,iDACc,CAAC;AAEjD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD,qBAAa,gBAAiB,SAAQ,KAAK;aAEvB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM;CAKlB;AAiBD,qBAAa,oBAAqB,SAAQ,KAAK;aAE3B,IAAI,EAAE,SAAS,GAAG,SAAS;aAE3B,MAAM,EAAE,MAAM;gBAFd,IAAI,EAAE,SAAS,GAAG,SAAS,EAE3B,MAAM,EAAE,MAAM;CAKjC;AAMD,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAYD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,UAAU,GAAG,UAAU,CAAC;IAEnC,QAAQ,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAEpC,MAAM,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE;QACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,CAAC;IACF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,gBAAgB,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,UAAU,CAAC;IACnB,YAAY,EAAE,iBAAiB,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,CAAC,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,KAAK,CAAC;QACjB,YAAY,EAAE,iBAAiB,CAAC;QAChC,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;QACnD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC,CAAC;CACJ;AAyGD,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,QAAQ,CAAC,CAanB;AAYD,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,oBAAoB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,CAAC,YAAY,GAAG,SAAS,CAAC,EAAE,CAAA;CAAE,GACvE,OAAO,CAAC,yBAAyB,CAAC,CAWpC;AAQD,wBAAsB,YAAY,CAChC,GAAG,EAAE,oBAAoB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE;IACP,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GACA,OAAO,CAAC,oBAAoB,CAAC,CAc/B;AAOD,wBAAsB,aAAa,CACjC,GAAG,EAAE,oBAAoB,EACzB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC,CAUhC;AAOD,wBAAsB,cAAc,CAClC,GAAG,EAAE,oBAAoB,EACzB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,sBAAsB,CAAC,CAUjC;AAQD,wBAAsB,aAAa,CACjC,GAAG,EAAE,oBAAoB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CAWhC;AAQD,wBAAsB,eAAe,CACnC,GAAG,EAAE,oBAAoB,EACzB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,uBAAuB,CAAC,CAMlC;AA4BD,wBAAsB,WAAW,CAC/B,GAAG,EAAE,oBAAoB,EACzB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAyBnC"}
+{"version":3,"file":"platform-client.d.ts","sourceRoot":"","sources":["../src/platform-client.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,gBAAgB,0BAA0B,CAAC;AASxD,eAAO,MAAM,qBAAqB,iDACc,CAAC;AAEjD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD,qBAAa,gBAAiB,SAAQ,KAAK;aAEvB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM;CAKlB;AAiBD,qBAAa,oBAAqB,SAAQ,KAAK;aAE3B,IAAI,EAAE,SAAS,GAAG,SAAS;aAE3B,MAAM,EAAE,MAAM;gBAFd,IAAI,EAAE,SAAS,GAAG,SAAS,EAE3B,MAAM,EAAE,MAAM;CAKjC;AAgBD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AASD,MAAM,MAAM,qBAAqB,GAC7B,wBAAwB,GACxB,uBAAuB,GACvB,UAAU,GACV,SAAS,GACT,WAAW,CAAC;AAQhB,MAAM,WAAW,6BAA6B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;CACjB;AAOD,MAAM,MAAM,oBAAoB,GAC5B,iBAAiB,GACjB,6BAA6B,CAAC;AAElC,wBAAgB,mBAAmB,CACjC,CAAC,EAAE,oBAAoB,GACtB,CAAC,IAAI,6BAA6B,CAEpC;AAGD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,oBAAoB,CAAC;IACnC,mBAAmB,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACxD,MAAM,EAAE,qBAAqB,CAAC;IAE9B,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAOD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAQD,MAAM,WAAW,mBAAmB;IAOlC,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;IAChC,OAAO,EAAE,OAAO,CAAC;CAClB;AAYD,MAAM,MAAM,oBAAoB,GAC5B;IACE,OAAO,EAAE,UAAU,CAAC;IACpB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;CACjC,GACD;IAAE,OAAO,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAE3D,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,CAAC,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,KAAK,CAAC;QACjB,YAAY,EAAE,iBAAiB,CAAC;QAChC,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;QACnD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC,CAAC;CACJ;AAyGD,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,QAAQ,CAAC,CAanB;AA8BD,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,oBAAoB,EACzB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAiB9B;AAiBD,wBAAsB,YAAY,CAChC,GAAG,EAAE,oBAAoB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAClE,OAAO,CAAC,oBAAoB,CAAC,CAc/B;AA6DD,eAAO,MAAM,aAAa,QAvCjB,oBAAoB,cACb,MAAM,aACP,MAAM,KAChB,OAAO,CAAC,oBAAoB,CAoCiB,CAAC;AAEnD,eAAO,MAAM,aAAa,QAzCjB,oBAAoB,cACb,MAAM,aACP,MAAM,KAChB,OAAO,CAAC,oBAAoB,CAsCiB,CAAC;AAEnD,eAAO,MAAM,eAAe,QA3CnB,oBAAoB,cACb,MAAM,aACP,MAAM,KAChB,OAAO,CAAC,oBAAoB,CAwCqB,CAAC;AAQvD,wBAAsB,aAAa,CACjC,GAAG,EAAE,oBAAoB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CAWhC;AAQD,wBAAsB,eAAe,CACnC,GAAG,EAAE,oBAAoB,EACzB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,uBAAuB,CAAC,CAMlC;AA4BD,wBAAsB,WAAW,CAC/B,GAAG,EAAE,oBAAoB,EACzB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAyBnC"}

package/dist/platform-client.js

@@ -20,6 +20,9 @@ export class PlatformNetworkError extends Error {
         this.name = "PlatformNetworkError";
     }
 }
+export function isPackagedTombstone(c) {
+    return "tombstone" in c && c.tombstone === true;
+}
 function baseUrl(cfg) {
     const trimmed = cfg.apiHost.replace(/\/+$/, "");
     const origin = /^https?:\/\//.test(trimmed) ? trimmed : `https://${trimmed}`;
@@ -73,31 +76,31 @@ export async function apiFetch(url, init = {}) {
         clearTimeout(timer);
     }
 }
-export async function requestConnection(cfg, runtimeKey, params) {
-    const res = await apiFetch(`${baseUrl(cfg)}/me/connections/requests`, {
+const REQUESTS_PATH = "/me/connection-requests";
+export async function requestConnection(cfg, runtimeKey, targetHandle) {
+    const res = await apiFetch(`${baseUrl(cfg)}${REQUESTS_PATH}`, {
         method: "POST",
         headers: {
             "Content-Type": "application/json",
             Authorization: `Bearer ${runtimeKey}`,
         },
-        body: JSON.stringify(params),
+        body: JSON.stringify({ targetHandle }),
     });
     if (!res.ok)
         return handleError(res);
-    return (await res.json());
+    const body = (await res.json().catch(() => ({})));
+    return { request: body.request ?? null, created: res.status === 201 };
 }
 export async function listRequests(cfg, runtimeKey, params) {
     const query = new URLSearchParams();
-    if (params?.status != null)
-        query.set("status", params.status);
-    if (params?.direction != null)
-        query.set("direction", params.direction);
-    if (params?.page != null)
-        query.set("page", String(params.page));
     if (params?.limit != null)
         query.set("limit", String(params.limit));
+    if (params?.cursor != null)
+        query.set("cursor", params.cursor);
+    if (params?.counterparty != null)
+        query.set("counterparty", params.counterparty);
     const qs = query.toString();
-    const url = `${baseUrl(cfg)}/me/connections/requests${qs ? `?${qs}` : ""}`;
+    const url = `${baseUrl(cfg)}${REQUESTS_PATH}${qs ? `?${qs}` : ""}`;
     const res = await apiFetch(url, {
         headers: { Authorization: `Bearer ${runtimeKey}` },
     });
@@ -105,24 +108,34 @@ export async function listRequests(cfg, runtimeKey, params) {
         return handleError(res);
     return (await res.json());
 }
-export async function acceptRequest(cfg, runtimeKey, requestId) {
-    const res = await apiFetch(`${baseUrl(cfg)}/me/connections/requests/${encodeURIComponent(requestId)}/accept`, {
-        method: "POST",
-        headers: { Authorization: `Bearer ${runtimeKey}` },
-    });
-    if (!res.ok)
-        return handleError(res);
-    return (await res.json());
-}
-export async function declineRequest(cfg, runtimeKey, requestId) {
-    const res = await apiFetch(`${baseUrl(cfg)}/me/connections/requests/${encodeURIComponent(requestId)}/decline`, {
-        method: "POST",
-        headers: { Authorization: `Bearer ${runtimeKey}` },
-    });
-    if (!res.ok)
-        return handleError(res);
-    return (await res.json());
-}
+function resolveVerb(verb) {
+    return async (cfg, runtimeKey, requestId) => {
+        const res = await apiFetch(`${baseUrl(cfg)}${REQUESTS_PATH}/${encodeURIComponent(requestId)}/${verb}`, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${runtimeKey}` },
+        });
+        if (res.status === 409) {
+            const conflict = (await res.json().catch(() => ({})));
+            if (conflict.error === "already_resolved") {
+                return {
+                    outcome: "already_resolved",
+                    status: typeof conflict.status === "string" ? conflict.status : null,
+                };
+            }
+        }
+        if (!res.ok)
+            return handleError(res);
+        const body = (await res.json().catch(() => ({})));
+        return {
+            outcome: "resolved",
+            idempotent: body.idempotent === true,
+            request: body.request ?? null,
+        };
+    };
+}
+export const acceptRequest = resolveVerb("accept");
+export const ignoreRequest = resolveVerb("ignore");
+export const withdrawRequest = resolveVerb("withdraw");
 export async function updateProfile(cfg, runtimeKey, params) {
     const res = await apiFetch(`${baseUrl(cfg)}/me/profile`, {
         method: "PATCH",

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAUrE,OAAO,EACL,kCAAkC,EAEnC,MAAM,oCAAoC,CAAC;AA8D5C,wBAAgB,uBAAuB,CACrC,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,iBAAiB,EAAE,MAAM,GAAG,IAAI,EAChC,mBAAmB,GAAE,mBAAmB,GAAG,IAA+B,GACzE,MAAM,GAAG,SAAS,CA6EpB;AAKD,UAAU,iBAAiB;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACjD,YAAY,CACV,IAAI,EAAE,OAAO,EACb,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,IAAI,CAAC;IACR,yBAAyB,CAAC,MAAM,EAAE;QAChC,EAAE,EAAE,MAAM,CAAC;QACX,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,OAAO,kCAAkC,CAAC;KACrD,GAAG,IAAI,CAAC;IACT,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,GAAG,IAAI,CAAC;CACnE;AAqCD,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAaI,iBAAiB;CA8ZhC,CAAC;AAEF,eAAe,MAAM,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAUrE,OAAO,EACL,kCAAkC,EAEnC,MAAM,oCAAoC,CAAC;AA8D5C,wBAAgB,uBAAuB,CACrC,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,iBAAiB,EAAE,MAAM,GAAG,IAAI,EAChC,mBAAmB,GAAE,mBAAmB,GAAG,IAA+B,GACzE,MAAM,GAAG,SAAS,CA6EpB;AAKD,UAAU,iBAAiB;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACjD,YAAY,CACV,IAAI,EAAE,OAAO,EACb,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3C,IAAI,CAAC;IACR,yBAAyB,CAAC,MAAM,EAAE;QAChC,EAAE,EAAE,MAAM,CAAC;QACX,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,OAAO,kCAAkC,CAAC;KACrD,GAAG,IAAI,CAAC;IACT,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,GAAG,IAAI,CAAC;CACnE;AAqCD,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAaI,iBAAiB;CAoahC,CAAC;AAEF,eAAe,MAAM,CAAC"}

package/dist/plugin.js

@@ -143,9 +143,11 @@ const plugin = {
             "separate from your owner's conversation; " +
             "masons_note_for_owner(content, from?) — save a note for your owner's next turn. " +
             "Other network tools: masons_list_requests, masons_send_connection_request, " +
-            "masons_accept_request, masons_decline_request, masons_list_connections, " +
+            "masons_accept_request, masons_list_connections, " +
             "masons_end_conversation (rare one-shot close signal only), " +
             "masons_status (your canonical identity and participation status). " +
+            "masons_withdraw_request (take back a connection request you sent). " +
+            "masons_ignore_request (set aside a connection request awaiting your decision; silent — the sender is not notified). " +
             "Always try these tools first for network operations. " +
             "If a tool call fails, report the error to your user — do not silently work around it. " +
             "You interact with multiple entities simultaneously — your owner and agents on the network. " +
@@ -193,18 +195,18 @@ const plugin = {
                 dynamicContext =
                     "[Context: Agent Network] You recently installed the agent network plugin " +
                         "but it is not yet authorized. If your current channel sender is the verified " +
-                        "OpenClaw owner, call masons_setup to generate a MASONS handoff URL here. " +
+                        "OpenClaw owner, call masons_link to generate a MASONS handoff URL here. " +
                         "If owner authority is unavailable, tell your user to run this terminal fallback: " +
                         "`openclaw channels login --channel agent-network`. Browser sign-in handles " +
-                        "agent selection or creation. After setup completes, OpenClaw will reload and " +
+                        "agent selection or creation. After the Link completes, OpenClaw will reload and " +
                         "the agent network tools will become available.";
                 if (state.pendingTarget) {
-                    dynamicContext += ` After setup, send a connection request to ${state.pendingTarget} — they invited your user to join.`;
+                    dynamicContext += ` After the Link completes, send a connection request to ${state.pendingTarget} — they invited your user to join.`;
                 }
             }
             else if (state.needsProfile) {
                 dynamicContext =
-                    "[Context: Agent Network] You are set up on the agent network, but your agent's profile is empty. " +
+                    "[Context: Agent Network] You are linked to the agent network, but your agent's profile is empty. " +
                         "Generate a profile based on what you know about the user and their agent, then show it to the user for confirmation. " +
                         "Once confirmed, call masons_update_profile with all four fields (name, scope, about, audience). " +
                         "Without a profile, other agents can't see who you are — " +
@@ -214,7 +216,7 @@ const plugin = {
                 }
             }
             else if (state.pendingTarget) {
-                dynamicContext = `[Context: Agent Network] You are set up on the agent network. You have a pending connection — call the masons_send_connection_request tool with targetHandle "${state.pendingTarget}" to send a connection request.`;
+                dynamicContext = `[Context: Agent Network] You are linked to the agent network. You have a pending connection — call the masons_send_connection_request tool with targetHandle "${state.pendingTarget}" to send a connection request.`;
             }
             if (!dynamicContext &&
                 state.hasCredentials &&

package/dist/tools.d.ts

@@ -1,3 +1,4 @@
+import { type ChannelSetupResult } from "./channel-setup.js";
 interface ToolContent {
     content: Array<{
         type: "text";
@@ -25,6 +26,9 @@ interface ToolApi {
     }): void;
 }
 export declare function _resetToolsForTesting(): void;
+export declare function terminalSetupInstructions(): string;
+export declare function ownerRefusalText(reason: "known-non-owner" | "ambiguous"): string;
+export declare function formatChannelSetupResult(result: ChannelSetupResult): string;
 export declare function registerTools(api: ToolApi): void;
 export {};
 //# sourceMappingURL=tools.d.ts.map