@murphai/murph 1.3.0 → 1.3.1

package/node_modules/@murphai/operator-config/dist/linq-runtime.js

@@ -1,19 +1,27 @@
+import { createHash } from 'node:crypto';
 import { isIP } from 'node:net';
+import LinqAPIV3, { APIConnectionError, APIConnectionTimeoutError, APIError, APIUserAbortError, } from '@linqapp/sdk';
+import { containsHttpUrlText, splitTrailingHttpsLink, } from '@murphai/contracts';
 import { createTimeoutAbortController, waitForRetryDelay, } from './http-retry.js';
-import { fetchJsonResponse, readJsonErrorResponse, requestJsonWithRetry, } from './http-json-retry.js';
+import { readJsonErrorResponse, requestJsonWithRetry, } from './http-json-retry.js';
 import { errorMessage, normalizeNullableString, } from './text/shared.js';
 import { normalizeAssistantResponseMediaUrl } from './assistant-cli-contracts.js';
-import { renderMarkdownMessageText, } from './message-formatting.js';
+import { renderMarkdownMessageText, sanitizeUserFacingMessageLinks, } from './message-formatting.js';
 import { VaultCliError } from './vault-cli-errors.js';
 import { createAssistantDeliveryBlockedError, } from './assistant/delivery-failure.js';
+import { buildLinqIMessageAppFallbackText, buildLinqIMessageAppCardUrl, buildLinqIMessageAppLayout, } from './assistant-response-cards.js';
 const DEFAULT_LINQ_API_BASE_URL = 'https://api.linqapp.com/api/partner/v3';
 const LINQ_HTTP_TIMEOUT_MS = 30_000;
+const LINQ_IMESSAGE_CAPABILITY_TIMEOUT_MS = 2_500;
 const LINQ_HTTP_MAX_ATTEMPTS = 3;
 const LINQ_HTTP_RETRY_DELAYS_MS = Object.freeze([1_000, 3_000]);
+const LINQ_SDK_BASE_URL = 'https://linq-sdk.invalid';
+const LINQ_SDK_RESPONSE_MAX_BYTES = 256 * 1024;
 const LINQ_CHAT_NOT_FOUND_CODES = new Set(['CHAT_NOT_FOUND', 'chat_not_found']);
 const LINQ_CHAT_NOT_FOUND_MESSAGES = new Set(['Chat not found']);
 const LINQ_MAX_MESSAGE_PARTS = 100;
 const LINQ_MAX_MEDIA_PARTS = 40;
+const LINQ_MAX_TEXT_PART_LENGTH = 10_000;
 const LINQ_SUPPORTED_ATTACHMENT_CONTENT_TYPES = [
     'image/jpeg',
     'image/png',
@@ -121,7 +129,7 @@ export function resolveLinqWebhookSecret(env) {
 }
 export async function probeLinqApi(dependencies = {}) {
     const env = dependencies.env ?? process.env;
-    const response = await requestLinqJson({
+    const response = await requestLinqSdk({
         details: {
             operation: 'list_phone_numbers',
             provider: 'linq',
@@ -130,6 +138,7 @@ export async function probeLinqApi(dependencies = {}) {
         fetchImplementation: dependencies.fetchImplementation,
         method: 'GET',
         path: '/phone_numbers',
+        request: (client, signal) => client.phoneNumbers.list({ signal }),
         signal: dependencies.signal,
     });
     return {
@@ -150,7 +159,75 @@ export function isLinqChatNotFoundSendMessageError(error) {
         && error.context?.failureStage === 'http'
         && error.context?.linqFailureKind === 'chat_not_found';
 }
+export function isDefinitiveLinqIMessageAppCardRejection(error) {
+    const status = error instanceof VaultCliError ? error.context?.status : null;
+    return error instanceof VaultCliError
+        && error.code === 'LINQ_API_REQUEST_FAILED'
+        && error.context?.provider === 'linq'
+        && error.context?.operation === 'send_imessage_app_card'
+        && error.context?.method === 'POST'
+        && error.context?.path === '/chats/[chat]/messages'
+        && error.context?.failureStage === 'http'
+        && error.context?.retryable === false
+        && (status === 400
+            || status === 415
+            || status === 422
+            || (status === 404
+                && error.context?.linqFailureKind === 'chat_not_found'));
+}
 export async function sendLinqChatMessage(input, dependencies = {}) {
+    const split = splitTrailingHttpsLink(sanitizeUserFacingMessageLinks(input.message));
+    if (!split.linkUrl) {
+        return sendLinqChatMessageParts(input, dependencies);
+    }
+    const hasPrimaryMessage = split.message.trim().length > 0 || (input.media?.length ?? 0) > 0;
+    if (!hasPrimaryMessage) {
+        if (input.nativeReplyRequested === true) {
+            return sendLinqChatMessageParts({
+                ...input,
+                message: split.linkUrl,
+            }, dependencies);
+        }
+        return sendLinqChatRichLinkWithTextFallback({
+            chatId: input.chatId,
+            idempotencyKey: input.idempotencyKey,
+            linkUrl: split.linkUrl,
+        }, dependencies);
+    }
+    const primaryResponse = await sendLinqChatMessageParts({
+        ...input,
+        message: split.message,
+    }, dependencies);
+    const primaryMessageId = requireLinqPrimaryMessageIdForRichLink({
+        messageId: primaryResponse.message?.id,
+        operation: 'send_message',
+    });
+    let linkResponse;
+    try {
+        linkResponse = await sendLinqChatRichLinkWithTextFallback({
+            chatId: input.chatId,
+            idempotencyKey: buildLinqRichLinkIdempotencyKey(input.idempotencyKey),
+            linkUrl: split.linkUrl,
+        }, dependencies);
+    }
+    catch (error) {
+        throw createLinqRichLinkPartialDeliveryFailure(error, input.idempotencyKey ?? null, primaryResponse.providerMessageEffects ?? [], collectLinqProviderMessageIds(primaryMessageId), input.chatId);
+    }
+    const providerMessageIds = collectLinqProviderMessageIds(primaryMessageId, linkResponse.message?.id);
+    const providerMessageEffects = [
+        ...(primaryResponse.providerMessageEffects ?? []),
+        ...(linkResponse.providerMessageEffects ?? []),
+    ];
+    if (providerMessageIds.length !== 2) {
+        throw createLinqRichLinkPartialDeliveryFailure(new Error('Linq did not return an identity for every accepted rich-link message.'), input.idempotencyKey ?? null, providerMessageEffects, providerMessageIds, input.chatId);
+    }
+    return {
+        ...linkResponse,
+        ...(providerMessageEffects.length > 0 ? { providerMessageEffects } : {}),
+        providerMessageIds,
+    };
+}
+async function sendLinqChatMessageParts(input, dependencies) {
     const chatId = normalizeRequiredString(input.chatId, 'chat id');
     const message = normalizeNullableString(input.message) ?? '';
     const idempotencyKey = normalizeNullableString(input.idempotencyKey);
@@ -159,21 +236,151 @@ export async function sendLinqChatMessage(input, dependencies = {}) {
         idempotencyKey: input.idempotencyKey,
         media: input.media ?? [],
         message,
+        operation: 'send_message',
         ...(input.nativeReplyRequested === true ? { nativeReplyRequested: true } : {}),
         replyToMessageId,
     });
-    return requestLinqJson({
+    const response = await sendLinqChatMessageBody({
+        body,
+        chatId,
+        idempotencyKey,
+        replyToMessageId: input.nativeReplyRequested === true ? replyToMessageId : null,
+    }, dependencies);
+    const providerMessageEffects = buildLinqProviderMessageEffects({
+        body,
+        providerMessageId: response.message?.id,
+    });
+    return {
+        ...response,
+        ...(providerMessageEffects.length > 0 ? { providerMessageEffects } : {}),
+    };
+}
+async function sendLinqChatRichLink(input, dependencies) {
+    const chatId = normalizeRequiredString(input.chatId, 'chat id');
+    const idempotencyKey = normalizeNullableString(input.idempotencyKey);
+    const replyToMessageId = input.nativeReplyRequested === true
+        ? normalizeRequiredString(input.replyToMessageId, 'native reply target message id')
+        : null;
+    const body = buildLinqRichLinkMessageBody({
+        idempotencyKey,
+        linkUrl: input.linkUrl,
+        replyToMessageId,
+    });
+    const response = await sendLinqChatMessageBody({
+        body,
+        chatId,
+        idempotencyKey,
+        replyToMessageId,
+    }, dependencies);
+    const providerMessageEffects = buildLinqProviderMessageEffects({
+        body,
+        providerMessageId: response.message?.id,
+    });
+    return {
+        ...response,
+        ...(providerMessageEffects.length > 0 ? { providerMessageEffects } : {}),
+    };
+}
+async function sendLinqChatRichLinkWithTextFallback(input, dependencies) {
+    try {
+        return await sendLinqChatRichLink(input, dependencies);
+    }
+    catch (error) {
+        if (!isDefinitiveLinqRichLinkRejection(error)) {
+            throw error;
+        }
+    }
+    return sendLinqChatMessageParts({
+        chatId: input.chatId,
+        idempotencyKey: buildLinqRichLinkFallbackIdempotencyKey(input.idempotencyKey),
+        message: input.linkUrl,
+    }, dependencies);
+}
+function isDefinitiveLinqRichLinkRejection(error) {
+    const status = error instanceof VaultCliError ? error.context?.status : null;
+    return error instanceof VaultCliError
+        && error.code === 'LINQ_API_REQUEST_FAILED'
+        && error.context?.failureStage === 'http'
+        && error.context?.retryable === false
+        && (status === 400 || status === 415 || status === 422);
+}
+async function sendLinqChatMessageBody(input, dependencies) {
+    return requestLinqSdk({
+        body: input.body,
         details: {
-            hasIdempotencyKey: idempotencyKey !== null,
-            hasReplyToMessageId: input.nativeReplyRequested === true && replyToMessageId !== null,
+            hasIdempotencyKey: input.idempotencyKey !== null,
+            hasReplyToMessageId: input.replyToMessageId !== null,
             operation: 'send_message',
             provider: 'linq',
         },
         env: dependencies.env ?? process.env,
         fetchImplementation: dependencies.fetchImplementation,
         method: 'POST',
-        path: `/chats/${encodeURIComponent(chatId)}/messages`,
+        path: `/chats/${encodeURIComponent(input.chatId)}/messages`,
+        request: (client, signal) => client.chats.messages.send(input.chatId, input.body, { signal }),
+        signal: dependencies.signal,
+    });
+}
+export async function checkLinqIMessageCapability(input, dependencies = {}) {
+    const address = normalizeRequiredString(input.address, 'capability address');
+    const from = normalizeNullableString(input.from);
+    const body = {
+        address,
+    };
+    if (from)
+        body.from = from;
+    const response = await requestLinqSdk({
+        allowRateLimitRetries: false,
         body,
+        details: {
+            operation: 'check_imessage_capability',
+            provider: 'linq',
+        },
+        env: dependencies.env ?? process.env,
+        fetchImplementation: dependencies.fetchImplementation,
+        method: 'POST',
+        path: '/capability/check_imessage',
+        request: (client, signal) => client.capability.checkIMessage(body, { signal }),
+        signal: dependencies.signal,
+        singleAttemptTimeoutMs: LINQ_IMESSAGE_CAPABILITY_TIMEOUT_MS,
+    });
+    return response?.available === true;
+}
+export async function sendLinqIMessageAppCard(input, dependencies = {}) {
+    const chatId = normalizeRequiredString(input.chatId, 'chat id');
+    const idempotencyKey = normalizeRequiredString(input.idempotencyKey, 'iMessage app card idempotency key');
+    const body = {
+        message: {
+            preferred_service: 'iMessage',
+            idempotency_key: idempotencyKey,
+            parts: [{
+                    type: 'imessage_app',
+                    // `app_store_id` is intentionally absent. Linq otherwise substitutes
+                    // square artwork in app-absent static Messages cards.
+                    app: {
+                        name: 'Murph',
+                        team_id: 'G9DJH2XUMK',
+                        bundle_id: 'ai.withmurph.app.messages',
+                    },
+                    interactive: true,
+                    url: buildLinqIMessageAppCardUrl(input.card),
+                    fallback_text: buildLinqIMessageAppFallbackText(input.card),
+                    layout: buildLinqIMessageAppLayout(input.card),
+                }],
+        },
+    };
+    return requestLinqSdk({
+        body,
+        details: {
+            hasIdempotencyKey: true,
+            operation: 'send_imessage_app_card',
+            provider: 'linq',
+        },
+        env: dependencies.env ?? process.env,
+        fetchImplementation: dependencies.fetchImplementation,
+        method: 'POST',
+        path: `/chats/${encodeURIComponent(chatId)}/messages`,
+        request: (client, signal) => client.chats.messages.send(chatId, body, { signal }),
         signal: dependencies.signal,
     });
 }
@@ -186,8 +393,9 @@ async function createLinqAttachmentUpload(input, dependencies = {}) {
         filename,
         size_bytes: sizeBytes,
     };
-    const response = await requestLinqJson({
+    return requestLinqSdk({
         allowRateLimitRetries: false,
+        body,
         details: {
             operation: 'create_attachment_upload',
             provider: 'linq',
@@ -198,10 +406,23 @@ async function createLinqAttachmentUpload(input, dependencies = {}) {
         fetchImplementation: dependencies.fetchImplementation,
         method: 'POST',
         path: '/attachments',
-        body,
+        request: async (client, signal) => {
+            const response = await client.attachments.create(body, { signal }).asResponse();
+            let payload;
+            try {
+                payload = await response.json();
+            }
+            catch {
+                throw createLinqAttachmentReservationResponseError({
+                    message: 'Linq attachment upload response was not valid JSON.',
+                    responseBodyKind: 'invalid_json',
+                    status: response.status,
+                });
+            }
+            return parseLinqAttachmentUploadResponse(payload, response.status);
+        },
         signal: dependencies.signal,
     });
-    return parseLinqAttachmentUploadResponse(response);
 }
 async function uploadLinqAttachmentBytes(input, dependencies = {}) {
     const bytes = normalizeLinqAttachmentBytes(input.bytes);
@@ -214,49 +435,96 @@ async function uploadLinqAttachmentBytes(input, dependencies = {}) {
             provider: 'linq',
         });
     }
+    const details = {
+        operation: 'create_attachment_upload',
+        provider: 'linq',
+        requestAttachmentBytes: bytes.byteLength,
+        requestAttachmentHeaderCount: Object.keys(headers).length,
+    };
+    const body = new Blob([copyUint8ArrayToArrayBuffer(bytes)], {
+        type: headers['content-type'] ?? 'application/octet-stream',
+    });
     const timeout = createTimeoutAbortController(dependencies.signal, LINQ_HTTP_TIMEOUT_MS);
-    let response;
+    let lastRetryableFailure = null;
     try {
-        response = await fetchImplementation(uploadUrl, {
-            body: new Blob([copyUint8ArrayToArrayBuffer(bytes)], {
-                type: headers['content-type'] ?? 'application/octet-stream',
-            }),
-            headers,
-            method: 'PUT',
-            redirect: 'error',
+        await requestJsonWithRetry({
+            createHttpError: async (response) => {
+                const failure = await createLinqHttpError(response, details, 'PUT', '[presigned-upload]', false, true);
+                if (isRetryableLinqRequestError(failure)) {
+                    lastRetryableFailure = failure;
+                }
+                return failure;
+            },
+            fetchResponse: async () => {
+                if (timeout.signal.aborted) {
+                    if (dependencies.signal?.aborted) {
+                        dependencies.signal.throwIfAborted();
+                    }
+                    if (lastRetryableFailure) {
+                        throw lastRetryableFailure;
+                    }
+                    timeout.signal.throwIfAborted();
+                }
+                try {
+                    // provider-request-boundary-allow-next-line: linq-presigned-bytes
+                    return await fetchImplementation(uploadUrl, {
+                        body,
+                        headers,
+                        method: 'PUT',
+                        redirect: 'error',
+                        signal: timeout.signal,
+                    });
+                }
+                catch (error) {
+                    if (dependencies.signal?.aborted) {
+                        throw error;
+                    }
+                    const failure = createLinqRequestError({
+                        details,
+                        error,
+                        method: 'PUT',
+                        path: '[presigned-upload]',
+                        requestOrigin: readRequestOrigin(uploadUrl),
+                        retryable: true,
+                        timedOut: timeout.timedOut(),
+                        timeoutMs: LINQ_HTTP_TIMEOUT_MS,
+                    });
+                    lastRetryableFailure = failure;
+                    throw failure;
+                }
+            },
+            isRetryableError: isRetryableLinqRequestError,
+            maxAttempts: LINQ_HTTP_MAX_ATTEMPTS,
+            parseResponse: () => undefined,
             signal: timeout.signal,
+            waitForRetryDelay: async (attempt, signal, responseHeaders) => {
+                try {
+                    await waitForLinqRetryDelay(attempt, signal, responseHeaders);
+                }
+                catch (error) {
+                    if (dependencies.signal?.aborted) {
+                        throw error;
+                    }
+                    if (timeout.timedOut() && lastRetryableFailure) {
+                        throw lastRetryableFailure;
+                    }
+                    throw error;
+                }
+            },
         });
     }
     catch (error) {
-        if (dependencies.signal?.aborted) {
+        if (!isRetryableLinqRequestError(error)) {
             throw error;
         }
-        throw createLinqRequestError({
-            details: {
-                operation: 'create_attachment_upload',
-                provider: 'linq',
-                requestAttachmentBytes: bytes.byteLength,
-                requestAttachmentHeaderCount: Object.keys(headers).length,
-            },
-            error,
-            method: 'PUT',
-            path: '[presigned-upload]',
-            requestOrigin: readRequestOrigin(uploadUrl),
+        throw new VaultCliError(error.code, error.message, {
+            ...error.context,
             retryable: false,
-            timedOut: timeout.timedOut(),
         });
     }
     finally {
         timeout.cleanup();
     }
-    if (!response.ok) {
-        throw await createLinqHttpError(response, {
-            operation: 'create_attachment_upload',
-            provider: 'linq',
-            requestAttachmentBytes: bytes.byteLength,
-            requestAttachmentHeaderCount: Object.keys(headers).length,
-        }, 'PUT', '[presigned-upload]', false, false);
-    }
 }
 export async function uploadLinqAttachment(input, dependencies = {}) {
     const bytes = normalizeLinqAttachmentBytes(input.bytes);
@@ -286,7 +554,8 @@ export async function sendLinqVoiceMemo(input, dependencies = {}) {
     const body = {
         attachment_id: attachmentId,
     };
-    const response = await requestLinqJson({
+    const response = await requestLinqSdk({
+        body,
         details: {
             hasIdempotencyKey: false,
             operation: 'send_voice_memo',
@@ -296,7 +565,7 @@ export async function sendLinqVoiceMemo(input, dependencies = {}) {
         fetchImplementation: dependencies.fetchImplementation,
         method: 'POST',
         path: `/chats/${encodeURIComponent(chatId)}/voicememo`,
-        body,
+        request: (client, signal) => client.chats.sendVoicememo(chatId, body, { signal }),
         signal: dependencies.signal,
     });
     return parseLinqVoiceMemoResponse({
@@ -308,7 +577,7 @@ export async function sendLinqVoiceMemo(input, dependencies = {}) {
 export async function deleteLinqMessage(input, dependencies = {}) {
     const messageId = normalizeRequiredString(input.messageId, 'message id');
     try {
-        await requestLinqNoContent({
+        await requestLinqSdk({
             allowDeleteRetries: true,
             details: {
                 operation: 'delete_message',
@@ -318,6 +587,7 @@ export async function deleteLinqMessage(input, dependencies = {}) {
             fetchImplementation: dependencies.fetchImplementation,
             method: 'DELETE',
             path: `/messages/${encodeURIComponent(messageId)}`,
+            request: (client, signal) => client.messages.delete(messageId, { signal }),
             signal: dependencies.signal,
         });
     }
@@ -334,7 +604,8 @@ export async function setLinqMessageReaction(input, dependencies = {}) {
         operation: 'add',
         type: resolveLinqReactionType(input.reaction),
     };
-    await requestLinqJson({
+    await requestLinqSdk({
+        body,
         details: {
             hasIdempotencyKey: false,
             operation: 'set_message_reaction',
@@ -344,7 +615,7 @@ export async function setLinqMessageReaction(input, dependencies = {}) {
         fetchImplementation: dependencies.fetchImplementation,
         method: 'POST',
         path: `/messages/${encodeURIComponent(targetMessageId)}/reactions`,
-        body,
+        request: (client, signal) => client.messages.addReaction(targetMessageId, body, { signal }),
         signal: dependencies.signal,
     });
     return {
@@ -354,7 +625,7 @@ export async function setLinqMessageReaction(input, dependencies = {}) {
 }
 export async function startLinqChatTypingIndicator(input, dependencies = {}) {
     const chatId = normalizeRequiredString(input.chatId, 'chat id');
-    await requestLinqNoContent({
+    await requestLinqSdk({
         details: {
             operation: 'typing_start',
             provider: 'linq',
@@ -363,12 +634,13 @@ export async function startLinqChatTypingIndicator(input, dependencies = {}) {
         fetchImplementation: dependencies.fetchImplementation,
         method: 'POST',
         path: `/chats/${encodeURIComponent(chatId)}/typing`,
+        request: (client, signal) => client.chats.typing.start(chatId, { signal }),
         signal: dependencies.signal,
     });
 }
 export async function stopLinqChatTypingIndicator(input, dependencies = {}) {
     const chatId = normalizeRequiredString(input.chatId, 'chat id');
-    await requestLinqNoContent({
+    await requestLinqSdk({
         details: {
             operation: 'typing_stop',
             provider: 'linq',
@@ -377,12 +649,13 @@ export async function stopLinqChatTypingIndicator(input, dependencies = {}) {
         fetchImplementation: dependencies.fetchImplementation,
         method: 'DELETE',
         path: `/chats/${encodeURIComponent(chatId)}/typing`,
+        request: (client, signal) => client.chats.typing.stop(chatId, { signal }),
         signal: dependencies.signal,
     });
 }
 export async function markLinqChatRead(input, dependencies = {}) {
     const chatId = normalizeRequiredString(input.chatId, 'chat id');
-    await requestLinqNoContent({
+    await requestLinqSdk({
         details: {
             operation: 'mark_read',
             provider: 'linq',
@@ -391,23 +664,77 @@ export async function markLinqChatRead(input, dependencies = {}) {
         fetchImplementation: dependencies.fetchImplementation,
         method: 'POST',
         path: `/chats/${encodeURIComponent(chatId)}/read`,
+        request: (client, signal) => client.chats.markAsRead(chatId, { signal }),
         signal: dependencies.signal,
     });
 }
 export async function createLinqChat(input, dependencies = {}) {
+    const split = splitTrailingHttpsLink(sanitizeUserFacingMessageLinks(input.message));
+    if (!split.linkUrl) {
+        if (containsHttpUrlText(input.message)) {
+            throw new VaultCliError('LINQ_INVALID_INPUT', 'A new Linq chat cannot include URL text in its first message.');
+        }
+        return createLinqChatWithPrimaryMessage(input, dependencies);
+    }
+    if (split.message.trim().length === 0 && (input.media?.length ?? 0) === 0) {
+        throw new VaultCliError('LINQ_INVALID_INPUT', 'A new Linq chat with a rich link must include caller-supplied text or media.');
+    }
+    if (containsHttpUrlText(split.message)) {
+        throw new VaultCliError('LINQ_INVALID_INPUT', 'A new Linq chat cannot include URL text in its first message.');
+    }
+    const result = await createLinqChatWithPrimaryMessage({
+        ...input,
+        message: split.message,
+    }, dependencies);
+    const chatId = requireLinqCreatedChatIdForRichLink(result);
+    const primaryMessageId = requireLinqPrimaryMessageIdForRichLink({
+        messageId: result.messageId,
+        operation: 'create_chat',
+    });
+    let linkResponse;
+    try {
+        linkResponse = await sendLinqChatRichLinkWithTextFallback({
+            chatId,
+            idempotencyKey: buildLinqRichLinkIdempotencyKey(input.idempotencyKey),
+            linkUrl: split.linkUrl,
+        }, dependencies);
+    }
+    catch (error) {
+        throw createLinqRichLinkPartialDeliveryFailure(error, input.idempotencyKey ?? null, result.providerMessageEffects ?? [], collectLinqProviderMessageIds(primaryMessageId), chatId);
+    }
+    const linkMessageId = normalizeNullableString(linkResponse.message?.id ?? null);
+    const providerMessageIds = collectLinqProviderMessageIds(primaryMessageId, linkMessageId);
+    const providerMessageEffects = [
+        ...(result.providerMessageEffects ?? []),
+        ...(linkResponse.providerMessageEffects ?? []),
+    ];
+    if (providerMessageIds.length !== 2) {
+        throw createLinqRichLinkPartialDeliveryFailure(new Error('Linq did not return an identity for every accepted rich-link message.'), input.idempotencyKey ?? null, providerMessageEffects, providerMessageIds, chatId);
+    }
+    return {
+        ...result,
+        messageId: linkMessageId,
+        ...(providerMessageEffects.length > 0 ? { providerMessageEffects } : {}),
+        providerMessageIds,
+    };
+}
+async function createLinqChatWithPrimaryMessage(input, dependencies) {
     const from = normalizeRequiredString(input.from, 'from');
     const recipients = normalizeLinqStringList(input.to, 'recipient');
     const idempotencyKey = normalizeNullableString(input.idempotencyKey);
+    const messageBody = buildLinqMessageBody({
+        idempotencyKey: input.idempotencyKey,
+        media: input.media ?? [],
+        message: input.message,
+        operation: 'create_chat',
+    });
     const body = {
         from,
-        message: buildLinqMessageBody({
-            idempotencyKey: input.idempotencyKey,
-            media: input.media ?? [],
-            message: input.message,
-        }).message,
+        message: messageBody.message,
         to: recipients,
     };
-    const response = await requestLinqJson({
+    const response = await requestLinqSdk({
+        body,
         details: {
             hasIdempotencyKey: idempotencyKey !== null,
             operation: 'create_chat',
@@ -418,29 +745,108 @@ export async function createLinqChat(input, dependencies = {}) {
         fetchImplementation: dependencies.fetchImplementation,
         method: 'POST',
         path: '/chats',
-        body,
+        request: (client, signal) => client.chats.create(body, { signal }),
         signal: dependencies.signal,
     });
+    const messageId = normalizeNullableString(response.chat?.message?.id ?? null);
+    const providerMessageEffects = buildLinqProviderMessageEffects({
+        body: messageBody,
+        providerMessageId: messageId,
+    });
     return {
         chatId: normalizeNullableString(response.chat?.id ?? null),
-        messageId: normalizeNullableString(response.chat?.message?.id ?? null),
+        messageId,
+        ...(providerMessageEffects.length > 0 ? { providerMessageEffects } : {}),
     };
 }
+function requireLinqCreatedChatIdForRichLink(result) {
+    const chatId = normalizeNullableString(result.chatId);
+    if (chatId) {
+        return chatId;
+    }
+    throw new VaultCliError('LINQ_API_REQUEST_FAILED', 'Linq chat create response was missing a chat id for the rich-link follow-up.', {
+        failureStage: 'http',
+        method: 'POST',
+        operation: 'create_chat',
+        path: '/chats',
+        provider: 'linq',
+        retryable: true,
+    });
+}
+function requireLinqPrimaryMessageIdForRichLink(input) {
+    const messageId = normalizeNullableString(typeof input.messageId === 'string' ? input.messageId : null);
+    if (messageId) {
+        return messageId;
+    }
+    throw Object.assign(new VaultCliError('LINQ_API_REQUEST_FAILED', 'Linq response was missing the primary message identity for a rich-link follow-up.', {
+        failureStage: 'http',
+        operation: input.operation,
+        provider: 'linq',
+        retryable: true,
+    }), { deliveryMayHaveSucceeded: true });
+}
+function collectLinqProviderMessageIds(...values) {
+    const output = [];
+    for (const value of values) {
+        const messageId = normalizeNullableString(typeof value === 'string' ? value : null);
+        if (messageId && !output.includes(messageId)) {
+            output.push(messageId);
+        }
+    }
+    return output;
+}
+function buildLinqProviderMessageEffects(input) {
+    const providerMessageId = normalizeNullableString(typeof input.providerMessageId === 'string'
+        ? input.providerMessageId
+        : null);
+    if (!providerMessageId) {
+        return [];
+    }
+    const textParts = (input.body.message.parts ?? []).filter((part) => part.type === 'text');
+    const text = textParts.length > 0
+        ? textParts.map((part) => part.value).join('')
+        : null;
+    return [{
+            ...(input.body.message.parts?.some((part) => part.type === 'media') === true
+                ? { carriesIntentMedia: true }
+                : {}),
+            message: typeof text === 'string' && text.length > 0 ? text : null,
+            providerMessageId,
+        }];
+}
+function createLinqRichLinkPartialDeliveryFailure(error, idempotencyKey, providerMessageEffects, providerMessageIds, providerThreadId) {
+    const failure = new VaultCliError('ASSISTANT_LINQ_RICH_LINK_PARTIAL_DELIVERY', 'iMessage rich-link delivery could not confirm both provider messages after the primary request was accepted; deterministic recovery must reuse the same provider keys.', {
+        idempotencyKey,
+        providerMessageEffects,
+        providerMessageIds,
+        providerThreadId,
+        target: providerThreadId,
+        targetKind: 'thread',
+    });
+    return Object.assign(failure, {
+        cause: error,
+        deliveryMayHaveSucceeded: true,
+        providerMessageId: providerMessageIds.at(-1) ?? null,
+        providerMessageIds,
+        providerThreadId,
+        target: providerThreadId,
+        targetKind: 'thread',
+    });
+}
 export async function createLinqWebhookSubscription(input, dependencies = {}) {
     const phoneNumbers = input.phoneNumbers && input.phoneNumbers.length > 0
         ? normalizeLinqStringList(input.phoneNumbers, 'phone number')
         : null;
     const subscribedEvents = normalizeLinqWebhookEventTypeList(input.subscribedEvents);
     const body = {
-        ...(phoneNumbers
-            ? {
-                phone_numbers: phoneNumbers,
-            }
-            : {}),
         subscribed_events: subscribedEvents,
         target_url: normalizeRequiredString(input.targetUrl, 'target url'),
     };
-    const response = await requestLinqJson({
+    if (phoneNumbers) {
+        body.phone_numbers = phoneNumbers;
+    }
+    const response = await requestLinqSdk({
+        body,
         details: {
             operation: 'create_webhook_subscription',
             phoneNumberCount: phoneNumbers?.length ?? 0,
@@ -451,7 +857,7 @@ export async function createLinqWebhookSubscription(input, dependencies = {}) {
         fetchImplementation: dependencies.fetchImplementation,
         method: 'POST',
         path: '/webhook-subscriptions',
-        body,
+        request: (client, signal) => client.webhookSubscriptions.create(body, { signal }),
         signal: dependencies.signal,
     });
     return {
@@ -465,68 +871,422 @@ export async function createLinqWebhookSubscription(input, dependencies = {}) {
         updatedAt: normalizeNullableString(response.updated_at ?? null),
     };
 }
-async function requestLinqJson(input) {
-    return requestLinq({
-        ...input,
-        parseResponse: async (response) => (await response.json()),
-    });
-}
-async function requestLinqNoContent(input) {
-    await requestLinq({
-        ...input,
-        parseResponse: async () => undefined,
-    });
+class LinqSdkResponseTooLargeError extends Error {
+    headers;
+    status;
+    constructor(status, headers) {
+        super('Linq SDK response exceeded the configured byte limit.');
+        this.name = 'LinqSdkResponseTooLargeError';
+        this.headers = headers;
+        this.status = status;
+    }
 }
-async function requestLinq(input) {
-    const request = resolveLinqRequest(input);
+async function requestLinqSdk(input) {
+    const runtime = resolveLinqSdkRuntime(input);
     const diagnosticPath = sanitizeLinqPathForDiagnostics(input.path);
+    const serializedBody = input.body === undefined
+        ? undefined
+        : JSON.stringify(input.body);
     const details = {
         ...input.details,
-        ...buildLinqRequestBodyDiagnostics(input.body, request.body),
+        ...buildLinqRequestBodyDiagnostics(input.body, serializedBody),
         path: diagnosticPath,
     };
-    return requestJsonWithRetry({
-        createHttpError: (response) => createLinqHttpError(response, details, input.method, diagnosticPath, input.allowDeleteRetries === true, input.allowRateLimitRetries !== false),
-        fetchResponse: () => fetchLinqResponse({
-            allowDeleteRetries: input.allowDeleteRetries === true,
-            allowRateLimitRetries: input.allowRateLimitRetries !== false,
-            body: request.body,
-            details,
-            fetchImplementation: request.fetchImplementation,
-            headers: request.headers,
-            method: input.method,
-            path: diagnosticPath,
-            signal: input.signal,
-            url: request.url,
-        }),
-        isRetryableError: isRetryableLinqRequestError,
-        maxAttempts: LINQ_HTTP_MAX_ATTEMPTS,
-        parseResponse: input.parseResponse,
-        signal: input.signal,
-        waitForRetryDelay: waitForLinqRetryDelay,
-    });
+    const timeoutMs = input.singleAttemptTimeoutMs ?? LINQ_HTTP_TIMEOUT_MS;
+    const maxAttempts = input.singleAttemptTimeoutMs === undefined
+        ? LINQ_HTTP_MAX_ATTEMPTS
+        : 1;
+    for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+        input.signal?.throwIfAborted();
+        const state = {
+            errorResponse: null,
+            requestOrigin: null,
+            transportError: null,
+        };
+        const client = createLinqSdkClient({
+            apiRoot: runtime.apiRoot,
+            fetchImplementation: runtime.fetchImplementation,
+            state,
+            timeoutMs,
+            token: runtime.token,
+        });
+        try {
+            return await input.request(client, input.signal);
+        }
+        catch (error) {
+            if (input.signal?.aborted) {
+                input.signal.throwIfAborted();
+            }
+            const failure = normalizeLinqSdkRequestFailure({
+                allowDeleteRetries: input.allowDeleteRetries === true,
+                allowRateLimitRetries: input.allowRateLimitRetries !== false,
+                details,
+                error,
+                method: input.method,
+                path: diagnosticPath,
+                state,
+                timeoutMs,
+            });
+            if (!isRetryableLinqRequestError(failure) || attempt >= maxAttempts) {
+                throw failure;
+            }
+            await waitForLinqRetryDelay(attempt, input.signal, state.errorResponse?.headers
+                ?? (error instanceof APIError ? error.headers : undefined));
+        }
+    }
+    throw new Error('Unreachable Linq SDK retry state.');
 }
-function resolveLinqRequest(input) {
+function resolveLinqSdkRuntime(input) {
     const token = resolveLinqApiToken(input.env);
     if (!token) {
         throw createLinqConfigurationError('LINQ_API_TOKEN_REQUIRED', 'Linq access requires LINQ_API_TOKEN.', input.details);
     }
-    const fetchImplementation = input.fetchImplementation ?? globalThis.fetch?.bind(globalThis);
-    if (typeof fetchImplementation !== 'function') {
+    const fetchImplementation = input.fetchImplementation ?? resolveDefaultLinqFetch();
+    if (!fetchImplementation) {
         throw createLinqConfigurationError('LINQ_UNAVAILABLE', 'Linq access requires fetch support in the current Node.js runtime.', input.details);
     }
-    const baseUrl = normalizeLinqBaseUrl(resolveLinqApiBaseUrl(input.env) ?? DEFAULT_LINQ_API_BASE_URL);
-    const body = input.body ? JSON.stringify(input.body) : undefined;
     return {
-        body,
+        apiRoot: normalizeLinqBaseUrl(resolveLinqApiBaseUrl(input.env) ?? DEFAULT_LINQ_API_BASE_URL),
         fetchImplementation,
-        headers: {
-            authorization: `Bearer ${token}`,
-            ...(body ? { 'content-type': 'application/json' } : {}),
-        },
-        url: buildLinqRequestUrl(baseUrl, input.path),
+        token,
     };
 }
+function resolveDefaultLinqFetch() {
+    if (typeof globalThis.fetch !== 'function') {
+        return null;
+    }
+    return (input, init) => globalThis.fetch(input, init);
+}
+function createLinqSdkClient(input) {
+    return new LinqAPIV3({
+        apiKey: input.token,
+        baseURL: LINQ_SDK_BASE_URL,
+        fetch: createLinqSdkFetch(input),
+        logLevel: 'off',
+        maxRetries: 0,
+        timeout: input.timeoutMs,
+    });
+}
+function createLinqSdkFetch(input) {
+    return async (request, init) => {
+        const url = mapLinqSdkRequestUrl(request, input.apiRoot);
+        input.state.requestOrigin = readRequestOrigin(url);
+        let response;
+        try {
+            response = await input.fetchImplementation.call(undefined, url, {
+                ...(init?.body === null || init?.body === undefined
+                    ? {}
+                    : { body: normalizeLinqSdkRequestBody(init.body) }),
+                headers: normalizeLinqSdkRequestHeaders(init?.headers),
+                method: normalizeNullableString(init?.method) ?? 'GET',
+                ...(init?.signal ? { signal: init.signal } : {}),
+            });
+        }
+        catch (error) {
+            input.state.transportError = error;
+            throw error;
+        }
+        return await bufferLinqSdkResponse(response, input.state, LINQ_SDK_RESPONSE_MAX_BYTES);
+    };
+}
+function mapLinqSdkRequestUrl(request, apiRoot) {
+    const source = new URL(typeof request === 'string'
+        ? request
+        : request instanceof URL
+            ? request.toString()
+            : request.url);
+    const sdkBase = new URL(LINQ_SDK_BASE_URL);
+    if (source.origin !== sdkBase.origin
+        || !/^\/v3(?:\/|$)/u.test(source.pathname)) {
+        throw new TypeError('Linq SDK emitted an unexpected request URL.');
+    }
+    const relativePath = encodeLinqSdkPath(source.pathname.replace(/^\/v3\/?/u, ''));
+    const target = new URL(buildLinqRequestUrl(apiRoot, relativePath));
+    target.search = source.search;
+    return target.toString();
+}
+function encodeLinqSdkPath(pathname) {
+    return pathname
+        .split('/')
+        .map((segment) => encodeURIComponent(decodeURIComponent(segment)))
+        .join('/');
+}
+function normalizeLinqSdkRequestBody(body) {
+    if (typeof body === 'string' || body instanceof Blob) {
+        return body;
+    }
+    throw new TypeError('Linq SDK emitted an unsupported control-plane request body.');
+}
+function normalizeLinqSdkRequestHeaders(headers) {
+    const source = new Headers(headers);
+    const normalized = {};
+    for (const name of ['authorization', 'content-type', 'idempotency-key']) {
+        const value = source.get(name);
+        if (value !== null) {
+            normalized[name] = value;
+        }
+    }
+    return normalized;
+}
+async function bufferLinqSdkResponse(response, state, maxResponseBytes) {
+    const headers = normalizeLinqSdkResponseHeaders(response.headers);
+    const declaredLength = Number(headers.get('content-length'));
+    if (Number.isFinite(declaredLength) && declaredLength > maxResponseBytes) {
+        await response.body?.cancel().catch(() => undefined);
+        state.errorResponse = {
+            bodyKind: 'oversize',
+            headers,
+            payload: null,
+            rawText: null,
+            status: response.status,
+        };
+        throw new LinqSdkResponseTooLargeError(response.status, headers);
+    }
+    const bytes = response.body
+        ? await readBoundedLinqSdkStream(response.body, maxResponseBytes, response.status, headers, state)
+        : new Uint8Array(await response.arrayBuffer());
+    if (bytes.byteLength > maxResponseBytes) {
+        state.errorResponse = {
+            bodyKind: 'oversize',
+            headers,
+            payload: null,
+            rawText: null,
+            status: response.status,
+        };
+        throw new LinqSdkResponseTooLargeError(response.status, headers);
+    }
+    if (!response.ok) {
+        state.errorResponse = parseLinqSdkErrorResponse(bytes, response.status, headers);
+    }
+    if (bytes.byteLength > 0) {
+        headers.set('content-type', 'application/json');
+    }
+    const body = bytes.byteLength === 0
+        || response.status === 204
+        || response.status === 205
+        || response.status === 304
+        ? null
+        : copyLinqSdkResponseBytes(bytes);
+    return new Response(body, {
+        headers,
+        status: response.status,
+        ...(response.statusText ? { statusText: response.statusText } : {}),
+    });
+}
+function copyLinqSdkResponseBytes(bytes) {
+    const body = new ArrayBuffer(bytes.byteLength);
+    new Uint8Array(body).set(bytes);
+    return body;
+}
+async function readBoundedLinqSdkStream(stream, maxResponseBytes, status, headers, state) {
+    const reader = stream.getReader();
+    const chunks = [];
+    let total = 0;
+    while (true) {
+        const next = await reader.read();
+        if (next.done) {
+            break;
+        }
+        total += next.value.byteLength;
+        if (total > maxResponseBytes) {
+            await reader.cancel().catch(() => undefined);
+            state.errorResponse = {
+                bodyKind: 'oversize',
+                headers,
+                payload: null,
+                rawText: null,
+                status,
+            };
+            throw new LinqSdkResponseTooLargeError(status, headers);
+        }
+        chunks.push(next.value);
+    }
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return bytes;
+}
+function normalizeLinqSdkResponseHeaders(source) {
+    if (source instanceof Headers) {
+        return new Headers(source);
+    }
+    const headers = new Headers();
+    const record = readRecord(source);
+    if (record) {
+        for (const [name, value] of Object.entries(record)) {
+            if (typeof value === 'string') {
+                headers.set(name, value);
+            }
+        }
+    }
+    if (source && typeof source.get === 'function') {
+        for (const name of [
+            'content-length',
+            'content-type',
+            'retry-after',
+            'x-should-retry',
+        ]) {
+            const value = source.get(name);
+            if (value !== null && value !== undefined) {
+                headers.set(name, value);
+            }
+        }
+    }
+    return headers;
+}
+function parseLinqSdkErrorResponse(bytes, status, headers) {
+    const text = new TextDecoder().decode(bytes);
+    if (!text.trim()) {
+        return {
+            headers,
+            payload: null,
+            rawText: null,
+            status,
+        };
+    }
+    try {
+        return {
+            headers,
+            payload: JSON.parse(text),
+            rawText: null,
+            status,
+        };
+    }
+    catch {
+        return {
+            headers,
+            payload: null,
+            rawText: text,
+            status,
+        };
+    }
+}
+function normalizeLinqSdkRequestFailure(input) {
+    if (input.error instanceof VaultCliError) {
+        return input.error;
+    }
+    const preProviderError = readPreProviderLinqRequestErrorFromChain(input.error);
+    if (preProviderError) {
+        return preProviderError;
+    }
+    const tooLarge = readLinqSdkResponseTooLargeError(input.error);
+    if (tooLarge) {
+        return createLinqSdkHttpError({
+            ...input,
+            errorResponse: input.state.errorResponse ?? {
+                bodyKind: 'oversize',
+                headers: tooLarge.headers,
+                payload: null,
+                rawText: null,
+                status: tooLarge.status,
+            },
+        });
+    }
+    if (input.error instanceof APIError && typeof input.error.status === 'number') {
+        return createLinqSdkHttpError({
+            ...input,
+            errorResponse: input.state.errorResponse ?? {
+                headers: input.error.headers ?? new Headers(),
+                payload: normalizeLinqSdkApiErrorPayload(input.error.error),
+                rawText: null,
+                status: input.error.status,
+            },
+        });
+    }
+    const timedOut = input.error instanceof APIConnectionTimeoutError;
+    const transportCause = input.state.transportError
+        ?? readLinqSdkTransportCause(input.error);
+    return createLinqRequestError({
+        details: input.details,
+        error: transportCause,
+        requestOrigin: input.state.requestOrigin,
+        method: input.method,
+        path: input.path,
+        timedOut,
+        timeoutMs: input.timeoutMs,
+        retryable: shouldRetryLinqTransportFailure(input.method, input.allowDeleteRetries, input.details.hasIdempotencyKey === true),
+    });
+}
+function createLinqSdkHttpError(input) {
+    const responseDiagnostics = input.errorResponse.bodyKind
+        ? { responseBodyKind: input.errorResponse.bodyKind }
+        : buildLinqErrorResponseDiagnostics(input.errorResponse.payload, input.errorResponse.rawText);
+    const responseTraceId = readSafeLinqResponseHeader(input.errorResponse.headers, 'x-trace-id');
+    const linqFailureKind = classifyLinqFailureKind(input.errorResponse.payload);
+    return new VaultCliError('LINQ_API_REQUEST_FAILED', `Linq request ${input.method} ${input.path} failed with HTTP ${input.errorResponse.status}.`, {
+        ...input.details,
+        ...responseDiagnostics,
+        ...(!responseDiagnostics.providerRequestId && responseTraceId
+            ? { providerRequestId: responseTraceId }
+            : {}),
+        failureStage: 'http',
+        ...(linqFailureKind ? { linqFailureKind } : {}),
+        method: input.method,
+        path: input.path,
+        retryable: shouldRetryLinqHttpStatus(input.method, input.errorResponse.status, input.allowDeleteRetries, input.details.hasIdempotencyKey === true, input.allowRateLimitRetries),
+        status: input.errorResponse.status,
+    });
+}
+function normalizeLinqSdkApiErrorPayload(value) {
+    if (value === null || value === undefined) {
+        return null;
+    }
+    return typeof value === 'string' ? { error: value } : value;
+}
+function readPreProviderLinqRequestErrorFromChain(error) {
+    let current = error;
+    let depth = 0;
+    while (current !== null && current !== undefined && depth < 8) {
+        const preProviderError = readPreProviderLinqRequestError(current);
+        if (preProviderError) {
+            return preProviderError;
+        }
+        current = readLinqSdkErrorCause(current);
+        depth += 1;
+    }
+    return null;
+}
+function readLinqSdkResponseTooLargeError(error) {
+    let current = error;
+    let depth = 0;
+    while (current !== null && current !== undefined && depth < 8) {
+        if (current instanceof LinqSdkResponseTooLargeError) {
+            return current;
+        }
+        current = readLinqSdkErrorCause(current);
+        depth += 1;
+    }
+    return null;
+}
+function readLinqSdkTransportCause(error) {
+    if (!(error instanceof APIConnectionError)
+        && !(error instanceof APIUserAbortError)) {
+        return error;
+    }
+    let current = error;
+    let previous = error;
+    let depth = 0;
+    while (current !== null && current !== undefined && depth < 8) {
+        previous = current;
+        const next = readLinqSdkErrorCause(current);
+        if (next === undefined) {
+            break;
+        }
+        current = next;
+        depth += 1;
+    }
+    return previous;
+}
+function readLinqSdkErrorCause(error) {
+    return typeof error === 'object'
+        && error !== null
+        && 'cause' in error
+        ? error.cause
+        : undefined;
+}
 function createLinqConfigurationError(code, message, details) {
     return createAssistantDeliveryBlockedError(code, message, {
         blockKind: 'linq_configuration',
@@ -537,33 +1297,17 @@ function createLinqConfigurationError(code, message, details) {
         resume: 'deploy_or_config_change',
     });
 }
-async function fetchLinqResponse(input) {
-    return fetchJsonResponse({
-        body: input.body,
-        createTransportError: ({ error, timedOut }) => createLinqRequestError({
-            details: input.details,
-            error,
-            requestOrigin: readRequestOrigin(input.url),
-            method: input.method,
-            path: input.path,
-            timedOut,
-            retryable: shouldRetryLinqTransportFailure(input.method, input.allowDeleteRetries, input.details.hasIdempotencyKey === true),
-        }),
-        fetchImplementation: input.fetchImplementation,
-        headers: input.headers,
-        method: input.method,
-        signal: input.signal,
-        timeoutMs: LINQ_HTTP_TIMEOUT_MS,
-        url: input.url,
-    });
-}
 async function createLinqHttpError(response, details, method, path, allowDeleteRetries, allowRateLimitRetries) {
     const { payload, rawText } = await readJsonErrorResponse(response);
     const responseDiagnostics = buildLinqErrorResponseDiagnostics(payload, rawText);
+    const responseTraceId = readSafeLinqResponseHeader(response.headers, 'x-trace-id');
     const linqFailureKind = classifyLinqFailureKind(payload);
     return new VaultCliError('LINQ_API_REQUEST_FAILED', `Linq request ${method} ${path} failed with HTTP ${response.status}.`, {
         ...details,
         ...responseDiagnostics,
+        ...(!responseDiagnostics.providerRequestId && responseTraceId
+            ? { providerRequestId: responseTraceId }
+            : {}),
         failureStage: 'http',
         ...(linqFailureKind ? { linqFailureKind } : {}),
         method,
@@ -572,6 +1316,16 @@ async function createLinqHttpError(response, details, method, path, allowDeleteR
         status: response.status,
     });
 }
+function readSafeLinqResponseHeader(headers, name) {
+    if (!headers) {
+        return null;
+    }
+    const rawValue = typeof headers.get === 'function'
+        ? headers.get(name)
+        : Object.entries(headers).find(([key]) => key.toLowerCase() === name)?.[1];
+    const value = typeof rawValue === 'string' ? rawValue.trim() : '';
+    return /^[A-Za-z0-9_.:-]{1,120}$/u.test(value) ? value : null;
+}
 function buildLinqRequestBodyDiagnostics(body, serializedBody) {
     if (!body || !serializedBody) {
         return {};
@@ -582,20 +1336,27 @@ function buildLinqRequestBodyDiagnostics(body, serializedBody) {
     }
     const message = readRecord(record.message);
     const parts = Array.isArray(message?.parts) ? message.parts : [];
+    const partRecords = parts.map(readRecord).filter((part) => part !== null);
+    const mediaParts = partRecords.filter((part) => part.type === 'media');
     const requestMessageLength = parts.reduce((total, part) => {
         const record = readRecord(part);
         return total + (typeof record?.value === 'string' ? record.value.length : 0);
     }, 0);
     return {
+        requestAttachmentMediaPartCount: mediaParts.filter((part) => typeof part.attachment_id === 'string').length,
         requestBodyShape: summarizeLinqJsonObjectShape(record),
+        requestMediaPartCount: mediaParts.length,
         requestMessageLength,
         requestMessagePartCount: parts.length,
+        requestPublicUrlMediaPartCount: mediaParts.filter((part) => typeof part.url === 'string').length,
+        requestTextPartCount: partRecords.filter((part) => part.type === 'text').length,
     };
 }
 function buildLinqErrorResponseDiagnostics(payload, rawText) {
     if (rawText !== null) {
         return {
             responseBodyKind: 'text',
+            responseBodySha256: hashLinqDiagnosticBody(rawText),
             responseBodyTextLength: rawText.length,
         };
     }
@@ -608,6 +1369,7 @@ function buildLinqErrorResponseDiagnostics(payload, rawText) {
     if (Array.isArray(payload)) {
         return {
             responseBodyKind: 'json_array',
+            responseBodySha256: hashLinqDiagnosticBody(serialized),
             responseBodyTextLength: serialized.length,
         };
     }
@@ -615,20 +1377,48 @@ function buildLinqErrorResponseDiagnostics(payload, rawText) {
         const record = payload;
         const keys = Object.keys(record).sort();
         const safeKeys = keys.filter(isSafeLinqResponseBodyKey);
+        const safeStringFields = safeKeys.filter((key) => typeof record[key] === 'string');
+        const providerError = readRecord(record.error);
+        const providerErrorCode = readSafeLinqDiagnosticToken(providerError ?? record, ['code', 'type']);
+        const providerRequestId = readSafeLinqDiagnosticToken(record, ['request_id', 'trace_id']);
         return {
+            ...(providerErrorCode ? { providerErrorCode } : {}),
+            ...(providerRequestId ? { providerRequestId } : {}),
             responseBodyKind: 'json_object',
             responseBodyKeyCount: keys.length,
+            ...(safeKeys.length > 0 ? { responseBodyKeySummary: safeKeys.join(',') } : {}),
             responseBodyKeys: safeKeys,
+            responseBodySha256: hashLinqDiagnosticBody(serialized),
             responseBodyStringFieldCount: keys.filter((key) => typeof record[key] === 'string').length,
-            responseBodyStringFields: safeKeys.filter((key) => typeof record[key] === 'string'),
+            ...(safeStringFields.length > 0
+                ? { responseBodyStringFieldSummary: safeStringFields.join(',') }
+                : {}),
+            responseBodyStringFields: safeStringFields,
             responseBodyTextLength: serialized.length,
         };
     }
     return {
         responseBodyKind: `json_${typeof payload}`,
+        responseBodySha256: hashLinqDiagnosticBody(serialized),
         responseBodyTextLength: serialized.length,
     };
 }
+function hashLinqDiagnosticBody(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function readSafeLinqDiagnosticToken(record, keys) {
+    for (const key of keys) {
+        const value = readStringField(record, key)?.trim() ?? '';
+        if (/^[A-Za-z0-9_.:-]{1,120}$/u.test(value)) {
+            return value;
+        }
+        const numericValue = record[key];
+        if (typeof numericValue === 'number' && Number.isSafeInteger(numericValue)) {
+            return String(numericValue);
+        }
+    }
+    return null;
+}
 function resolveLinqReactionType(reaction) {
     switch (reaction) {
         case 'heart':
@@ -641,20 +1431,36 @@ function resolveLinqReactionType(reaction) {
 }
 function createLinqRequestError(input) {
     const transportErrorDiagnostics = buildLinqTransportErrorDiagnostics(input.error);
+    const attachmentReservationMayHaveSucceeded = readRecord(input.error)?.linqAttachmentReservationMayHaveSucceeded === true;
+    const retryable = attachmentReservationMayHaveSucceeded
+        ? false
+        : input.retryable;
     const baseMessage = input.timedOut
-        ? `Linq request ${input.method} ${input.path} timed out after ${LINQ_HTTP_TIMEOUT_MS}ms.`
+        ? `Linq request ${input.method} ${input.path} timed out after ${input.timeoutMs}ms.`
         : `Linq request ${input.method} ${input.path} failed before a response was returned.`;
-    return new VaultCliError('LINQ_API_REQUEST_FAILED', baseMessage, {
+    const error = new VaultCliError('LINQ_API_REQUEST_FAILED', baseMessage, {
         ...input.details,
         ...transportErrorDiagnostics,
         failureStage: 'transport',
         method: input.method,
         path: input.path,
         ...(input.requestOrigin ? { requestOrigin: input.requestOrigin } : {}),
-        retryable: input.retryable,
-        timeoutMs: LINQ_HTTP_TIMEOUT_MS,
+        retryable,
+        timeoutMs: input.timeoutMs,
         timedOut: input.timedOut,
     });
+    return attachmentReservationMayHaveSucceeded
+        ? Object.assign(error, {
+            linqAttachmentReservationMayHaveSucceeded: true,
+        })
+        : error;
+}
+function readPreProviderLinqRequestError(error) {
+    return error instanceof Error
+        && 'deliveryMayHaveSucceeded' in error
+        && error.deliveryMayHaveSucceeded === false
+        ? error
+        : null;
 }
 function buildLinqTransportErrorDiagnostics(error) {
     const messages = readTransportErrorMessages(error);
@@ -711,37 +1517,59 @@ function shouldRetryLinqHttpStatus(method, status, allowDeleteRetries = false, h
         return allowRateLimitRetries && (method !== 'DELETE' || allowDeleteRetries);
     }
     return ((method === 'GET' ||
+        method === 'PUT' ||
         (method === 'POST' && hasIdempotencyKey) ||
         (method === 'DELETE' && allowDeleteRetries)) &&
         (status === 408 || status >= 500));
 }
-function parseLinqAttachmentUploadResponse(value) {
+function parseLinqAttachmentUploadResponse(value, status) {
     const record = readRecord(value);
     const attachmentId = normalizeNullableString(readStringField(record, 'attachment_id'));
     const rawUploadUrl = normalizeNullableString(readStringField(record, 'upload_url'));
     const expiresAt = normalizeNullableString(readStringField(record, 'expires_at'));
     const downloadUrl = normalizeNullableString(readStringField(record, 'download_url'));
     const httpMethod = normalizeNullableString(readStringField(record, 'http_method'));
-    const requiredHeaders = readStringRecord(record?.required_headers);
-    if (!attachmentId || !rawUploadUrl || !expiresAt || !requiredHeaders) {
-        throw new VaultCliError('LINQ_API_REQUEST_FAILED', 'Linq attachment upload response was missing required fields.', {
-            failureStage: 'http',
-            operation: 'create_attachment_upload',
-            provider: 'linq',
-            responseBodyKind: record ? 'json_object' : 'unknown',
-            responseBodyKeys: record ? Object.keys(record).sort() : [],
-            retryable: false,
+    const rawRequiredHeaders = readStringRecord(record?.required_headers);
+    if (!attachmentId || !rawUploadUrl || !expiresAt || !rawRequiredHeaders) {
+        throw createLinqAttachmentReservationResponseError({
+            message: 'Linq attachment upload response was missing required fields.',
+            payload: value,
+            status,
         });
     }
     if (httpMethod && httpMethod.toUpperCase() !== 'PUT') {
-        throw new VaultCliError('LINQ_API_REQUEST_FAILED', 'Linq attachment upload response returned an unsupported upload method.', {
-            failureStage: 'http',
-            operation: 'create_attachment_upload',
-            provider: 'linq',
-            retryable: false,
+        throw createLinqAttachmentReservationResponseError({
+            message: 'Linq attachment upload response returned an unsupported upload method.',
+            payload: value,
+            status,
+        });
+    }
+    let requiredHeaders;
+    try {
+        requiredHeaders = normalizeLinqRequiredHeaders(rawRequiredHeaders);
+    }
+    catch (error) {
+        throw createLinqAttachmentReservationResponseError({
+            message: error instanceof VaultCliError
+                ? error.message
+                : 'Linq attachment upload response returned invalid upload headers.',
+            payload: value,
+            status,
+        });
+    }
+    let uploadUrl;
+    try {
+        uploadUrl = normalizeLinqAttachmentUploadUrl(rawUploadUrl);
+    }
+    catch (error) {
+        throw createLinqAttachmentReservationResponseError({
+            message: error instanceof VaultCliError
+                ? error.message
+                : 'Linq attachment upload response returned an invalid upload URL.',
+            payload: value,
+            status,
         });
     }
-    const uploadUrl = normalizeLinqAttachmentUploadUrl(rawUploadUrl);
     return {
         attachmentId,
         downloadUrl,
@@ -750,6 +1578,23 @@ function parseLinqAttachmentUploadResponse(value) {
         uploadUrl,
     };
 }
+function createLinqAttachmentReservationResponseError(input) {
+    return Object.assign(new VaultCliError('LINQ_API_REQUEST_FAILED', input.message, {
+        ...(input.responseBodyKind
+            ? { responseBodyKind: input.responseBodyKind }
+            : buildLinqErrorResponseDiagnostics(input.payload, null)),
+        failureStage: 'http',
+        method: 'POST',
+        operation: 'create_attachment_upload',
+        path: '/attachments',
+        provider: 'linq',
+        retryable: false,
+        status: input.status,
+    }), {
+        deliveryMayHaveSucceeded: true,
+        retryable: false,
+    });
+}
 function normalizeLinqAttachmentUploadUrl(value) {
     let parsed;
     try {
@@ -783,8 +1628,7 @@ function isPublicLinqAttachmentUploadHost(hostname) {
     return isIP(ipLiteral) === 0;
 }
 function parseLinqVoiceMemoResponse(input) {
-    const record = readRecord(input.response);
-    const voiceMemoRecord = readRecord(record?.voice_memo);
+    const voiceMemoRecord = readRecord(input.response.voice_memo);
     const nestedVoiceMemo = readRecord(voiceMemoRecord?.voice_memo);
     const chatRecord = readRecord(voiceMemoRecord?.chat);
     return {
@@ -831,6 +1675,7 @@ function normalizeLinqRequiredHeaders(headers) {
 }
 function shouldRetryLinqTransportFailure(method, allowDeleteRetries = false, hasIdempotencyKey = false) {
     return method === 'GET' ||
+        method === 'PUT' ||
         (method === 'POST' && hasIdempotencyKey) ||
         (method === 'DELETE' && allowDeleteRetries);
 }
@@ -933,6 +1778,31 @@ function normalizeRequiredString(value, label) {
     }
     return normalized;
 }
+function buildLinqRichLinkMessageBody(input) {
+    const idempotencyKey = normalizeNullableString(input.idempotencyKey);
+    const replyToMessageId = normalizeNullableString(input.replyToMessageId);
+    const message = {
+        parts: [{
+                type: 'link',
+                value: normalizeRequiredString(input.linkUrl, 'rich link url'),
+            }],
+    };
+    if (idempotencyKey) {
+        message.idempotency_key = idempotencyKey;
+    }
+    if (replyToMessageId) {
+        message.reply_to = { message_id: replyToMessageId };
+    }
+    return { message };
+}
+function buildLinqRichLinkIdempotencyKey(value) {
+    const idempotencyKey = normalizeNullableString(value);
+    return idempotencyKey ? `${idempotencyKey}:link` : null;
+}
+function buildLinqRichLinkFallbackIdempotencyKey(value) {
+    const idempotencyKey = normalizeNullableString(value);
+    return idempotencyKey ? `${idempotencyKey}:fallback` : null;
+}
 function buildLinqMessageBody(input) {
     const idempotencyKey = normalizeNullableString(input.idempotencyKey);
     const replyToMessageId = input.nativeReplyRequested === true
@@ -940,43 +1810,108 @@ function buildLinqMessageBody(input) {
         : null;
     const media = normalizeLinqMediaList(input.media ?? []);
     const normalizedMessage = normalizeNullableString(input.message);
-    let textPart = null;
-    if (normalizedMessage !== null) {
-        const renderedText = renderMarkdownMessageText(normalizedMessage);
-        textPart = {
-            ...(renderedText.decorations.length > 0
-                ? {
-                    text_decorations: renderedText.decorations,
-                }
-                : {}),
-            type: 'text',
-            value: renderedText.text,
-        };
-    }
-    const parts = textPart ? [textPart, ...media] : media;
+    const textParts = normalizedMessage === null
+        ? []
+        : buildLinqTextPartsWithinLimits({
+            message: normalizedMessage,
+            operation: input.operation,
+            requestAttachmentMediaPartCount: media.filter((part) => 'attachment_id' in part).length,
+            requestMediaPartCount: media.length,
+            requestPublicUrlMediaPartCount: media.filter((part) => 'url' in part).length,
+        });
+    const parts = [...textParts, ...media];
     if (parts.length === 0) {
         throw new VaultCliError('LINQ_INVALID_INPUT', 'Linq messages must include text or media.');
     }
     if (parts.length > LINQ_MAX_MESSAGE_PARTS) {
         throw new VaultCliError('LINQ_INVALID_INPUT', `Linq message must contain at most ${LINQ_MAX_MESSAGE_PARTS} parts.`);
     }
-    return {
-        message: {
-            parts,
-            ...(idempotencyKey
-                ? {
-                    idempotency_key: idempotencyKey,
-                }
-                : {}),
-            ...(replyToMessageId
-                ? {
-                    reply_to: {
-                        message_id: replyToMessageId,
-                    },
-                }
-                : {}),
-        },
+    const message = {
+        parts,
     };
+    if (idempotencyKey) {
+        message.idempotency_key = idempotencyKey;
+    }
+    if (replyToMessageId) {
+        message.reply_to = { message_id: replyToMessageId };
+    }
+    return { message };
+}
+export function assertLinqMessagePartsWithinLimits(input) {
+    const normalizedMessage = normalizeNullableString(input.message);
+    if (normalizedMessage === null) {
+        return;
+    }
+    buildLinqTextPartsWithinLimits({
+        ...input,
+        message: normalizedMessage,
+    });
+}
+function buildLinqTextPartsWithinLimits(input) {
+    const renderedText = renderMarkdownMessageText(input.message);
+    const textParts = splitLinqTextParts(renderedText);
+    const requestMessagePartCount = input.requestMediaPartCount + textParts.length;
+    if (requestMessagePartCount > LINQ_MAX_MESSAGE_PARTS) {
+        throw Object.assign(new VaultCliError('LINQ_INVALID_INPUT', `Linq message must contain at most ${LINQ_MAX_MESSAGE_PARTS} parts.`, {
+            failureStage: 'configuration',
+            operation: input.operation,
+            provider: 'linq',
+            requestAttachmentMediaPartCount: input.requestAttachmentMediaPartCount,
+            requestMediaPartCount: input.requestMediaPartCount,
+            requestMessageLength: renderedText.text.length,
+            requestMessagePartCount,
+            requestPublicUrlMediaPartCount: input.requestPublicUrlMediaPartCount,
+            requestTextPartCount: textParts.length,
+            retryable: false,
+        }), {
+            deliveryMayHaveSucceeded: false,
+            retryable: false,
+        });
+    }
+    return textParts;
+}
+function splitLinqTextParts(renderedText) {
+    const parts = [];
+    let rangeStart = 0;
+    while (rangeStart < renderedText.text.length) {
+        let rangeEnd = Math.min(rangeStart + LINQ_MAX_TEXT_PART_LENGTH, renderedText.text.length);
+        if (rangeEnd < renderedText.text.length &&
+            isHighSurrogate(renderedText.text.charCodeAt(rangeEnd - 1)) &&
+            isLowSurrogate(renderedText.text.charCodeAt(rangeEnd))) {
+            rangeEnd -= 1;
+        }
+        const decorations = renderedText.decorations
+            .map((decoration) => {
+            const decorationStart = Math.max(decoration.range[0], rangeStart);
+            const decorationEnd = Math.min(decoration.range[1], rangeEnd);
+            return decorationEnd <= decorationStart
+                ? null
+                : {
+                    range: [
+                        decorationStart - rangeStart,
+                        decorationEnd - rangeStart,
+                    ],
+                    style: decoration.style,
+                };
+        })
+            .filter((decoration) => decoration !== null);
+        const part = {
+            type: 'text',
+            value: renderedText.text.slice(rangeStart, rangeEnd),
+        };
+        if (decorations.length > 0) {
+            part.text_decorations = decorations;
+        }
+        parts.push(part);
+        rangeStart = rangeEnd;
+    }
+    return parts;
+}
+function isHighSurrogate(value) {
+    return value >= 0xd800 && value <= 0xdbff;
+}
+function isLowSurrogate(value) {
+    return value >= 0xdc00 && value <= 0xdfff;
 }
 function normalizeLinqMediaList(values) {
     const parts = values