@open-everywhere/core 0.1.0

package/dist/agent/channels/normalized-wake.js

@@ -0,0 +1,153 @@
+// normalized-wake — ONE typed shape every inbound event normalizes into, and ONE renderer that turns it into the turn message an OE-owned dispatch sends. The renderer NEVER branches on `platform`: a branch inside it is exactly the drift this module exists to kill. It is PURE and platform-agnostic and must NEVER import a surface file — surface files import THIS, never the reverse.
+// SECURITY, carried structurally: every surface-supplied string in the shape is RAW, and escaping and untrusted-wrapping happen ONLY inside the envelope and context renderers, so no caller string reaches a trusted prose frame; the attributes are renderer-side emissions from typed fields, so they cannot be forged; the type never carries a pre-rendered string; and a `direct` body is never wrapped while a judged one always is. A JUDGED WAKE RENDERS ITS ENVELOPE AND NOTHING ABOVE IT — the attributes carry the facts and one standing block carries the policy, so there is no per-wake preamble and no second render to fall back to.
+import { renderWakeEnvelope, } from "./wake-envelope.js";
+import { hydrationSlices, renderContext } from "./context-render.js";
+// OPE-746 — the opaque channel key. A PURE leaf module with no imports of its own, so it keeps this
+// module's "imports only wake-envelope + context-render" discipline honest: it adds an encoder, not
+// a dependency on any surface.
+import { encodeChannelKey } from "./channel-key.js";
+// The silence vocabulary: TRUSTED, core-owned constants naming the silence contract. The render no longer emits them — a judged wake is its envelope alone — but the sentinel is still the string a turn-final text is matched against, and the standing prompt names both.
+// They live here rather than in a surface file, so no dialect can drift its own copy.
+/** Turn-final text that means "post nothing" (see slack-events.ts isNoReply). */
+export const NO_REPLY_SENTINEL = "NO_REPLY";
+/**
+ * The trigger-message id prefix the ONE corrective re-drive wake carries (`redrive-<original wake id>`, minted in channels/unified-redrive.ts's `buildRedriveWake`). It reaches the served prompt as a `<message … id="redrive-…">` attribute, so it is the marker that names a corrective turn to any reader of the prompt alone.
+ * 🔴 IT IS A MARKER, NOT A GATE (OPE-1982). Nothing in the product branches on it: the corrective wake is an ordinary ambient wake and the seat must not treat it as special. The SCRIPTED MODEL reads it (agent/model/scripted-resolve.ts) to tell the one legitimate cross-turn re-entry of a still-registered script — a turn the host itself re-drove — from the handle leak the OPE-727 guard exists to catch. It lives here, beside the silence vocabulary, so the builder and that reader cannot drift two copies of the string.
+ */
+export const REDRIVE_TRIGGER_ID_PREFIX = "redrive-";
+/**
+ * THE ONE SENTENCE THAT ENDS A SILENT TURN. eve runs one step per model call and reads a step with no tool call and no text as a FAILURE, then reissues the call once with a nudge to answer now — so a turn that correctly chose silence gets commanded to reply.
+ * Every terminal-verb result that ends a turn in silence therefore NAMES this output, which makes the next step non-empty and keeps eve out of its recovery path. Three sites say it, and they must say the SAME thing, because they are all answering the same nudge.
+ */
+export const END_TURN_WITH_SENTINEL_INSTRUCTION = `Now end the turn: output exactly ${NO_REPLY_SENTINEL} and nothing else.`;
+/**
+ * Shared addendum for every judged-silence instruction: prefer the `no_reply` TOOL over the bare sentinel where one is available, because it is audited and carries a closed reason on the identical suppression path.
+ * It lives in ONE place rather than copy-pasted across every wake instruction.
+ */
+export const PREFER_NO_REPLY_TOOL = `If you have a \`no_reply\` tool, prefer calling it (with a reason) over the bare ` +
+    `${NO_REPLY_SENTINEL} text — it's audited and unambiguous; the text sentinel still works if you don't.`;
+/**
+ * Wrap a fully-built trigger message as the sole `{ kind: "message" }` trigger.
+ * It STAMPS `trigger: true` structurally — callers never set it — so the renderer's exactly-one-trigger invariant is satisfied by construction rather than by convention.
+ */
+export function mkMessageTrigger(message) {
+    return { kind: "message", message: { ...message, trigger: true } };
+}
+/**
+ * The SINGLE wake renderer — no platform branch. `direct` emits the trigger body VERBATIM and unwrapped; every judged addressing emits the `<wake>` envelope ALONE, body untrusted-wrapped by the envelope renderer, with nothing rendered above it.
+ * Context is the untrusted-wrapped block when there are context lines, and is omitted otherwise so the payload stays message-only. `now` is a clock seam, so the envelope's current time is deterministic in tests.
+ */
+export function renderWake(nw, now = () => new Date().toISOString()) {
+    let message;
+    switch (nw.trigger.kind) {
+        case "message": {
+            if (nw.addressing === "direct") {
+                // W4: the addressed turn is the conversation driver — verbatim, never untrusted-wrapped.
+                message = nw.trigger.message.body;
+            }
+            else {
+                message = renderWakeEnvelope({
+                    reason: nw.reason,
+                    currentTime: now(),
+                    wakeId: nw.wakeId,
+                    // The typed facts the model reads its obligation off: `addressing` mirrors the wake's own value and is never rendered on `direct`, which this branch never runs for; `engagement` mirrors the tier, a resolved "neutral" included; `follow-up` is the name-drop mechanic's own value, or the builder-stated contract for a wake that has one ({@link NormalizedWake.followUp}), and is undefined on every wake that states neither.
+                    // `channel.container` falls back to the wake's container noun, then to "channel".
+                    addressing: nw.addressing,
+                    engagement: nw.engagementTier,
+                    followUp: nw.nameDrop?.followUp ?? nw.followUp,
+                    // The always-known platform drives each message body's untrusted-wrap `source` label — the ONE platform-DERIVED token in the render.
+                    // It is NOT a code branch: it is input DATA interpolated into a provenance label, exactly like an author name, and it is distinct from the locus platform, which the platform-blind render does not emit at all.
+                    sourcePlatform: nw.platform,
+                    // THE OPAQUE CHANNEL KEY: `<channel id>` carries the KEY, never the raw vendor id, so the model never holds two names for one place and never states a surface — the read verbs take this exact string.
+                    // Minting it HERE, in the SINGLE renderer, is what makes that true on every surface at once: no provider builder has to know about the key, and none can forget it. This is still not a platform BRANCH — the platform is input data fed to a pure encoder.
+                    channel: {
+                        ...nw.locus.channel,
+                        id: encodeChannelKey(nw.platform, nw.locus.channel.id),
+                        container: nw.locus.channel.container ?? nw.containerNoun ?? "channel",
+                    },
+                    participants: nw.participants,
+                    thread: nw.locus.thread,
+                    // Oldest-first backscroll siblings, ending at the sole trigger (renderWakeEnvelope's
+                    // own exactly-one-trigger / trigger-last invariant).
+                    messages: [...(nw.backscroll ?? []), nw.trigger.message],
+                    catchUpUnavailable: nw.catchUpUnavailable,
+                    systemNote: nw.systemNote,
+                });
+            }
+            break;
+        }
+        case "notice": {
+            // A notice is never `direct`: nobody addressed the seat, so there is no body to pass verbatim.
+            // It has no triggering message, so it has no backscroll to end at one either. Both are builder
+            // bugs, and they fail loud here rather than rendering a wake with a cause nobody can read.
+            if (nw.addressing === "direct")
+                throw new Error("renderWake: a notice wake cannot be direct");
+            if (nw.backscroll && nw.backscroll.length > 0)
+                throw new Error("renderWake: a notice wake carries no backscroll");
+            if (nw.systemNote === undefined || nw.systemNote.length === 0)
+                throw new Error("renderWake: a notice wake needs a non-empty systemNote");
+            message = renderWakeEnvelope({
+                reason: nw.reason,
+                currentTime: now(),
+                wakeId: nw.wakeId,
+                addressing: nw.addressing,
+                engagement: nw.engagementTier,
+                followUp: nw.nameDrop?.followUp ?? nw.followUp,
+                channel: {
+                    ...nw.locus.channel,
+                    id: encodeChannelKey(nw.platform, nw.locus.channel.id),
+                    container: nw.locus.channel.container ?? nw.containerNoun ?? "channel",
+                },
+                participants: nw.participants,
+                thread: nw.locus.thread,
+                messages: [],
+                catchUpUnavailable: nw.catchUpUnavailable,
+                systemNote: nw.systemNote,
+            });
+            break;
+        }
+        default: {
+            // Step-5 `{ kind: "event" }` lands here as a compile-forced addition, not a silent
+            // fall-through (there is no event consumer yet — no-extrapolation discipline).
+            const _exhaustive = nw.trigger;
+            throw new Error(`renderWake: unknown trigger kind ${String(_exhaustive.kind)}`);
+        }
+    }
+    // The "changed since your last wake" PUSH, appended after the envelope on its own line. It is an OPAQUE TRUSTED CONSTANT — built entirely from OE-controlled pointers, with no interpolation here.
+    // Only on an ENVELOPED wake, never a raw `direct` body, which must stay verbatim; unset means nothing is appended at all.
+    if (nw.memoryDelta !== undefined && nw.addressing !== "direct") {
+        message = `${message}\n\n${nw.memoryDelta}`;
+    }
+    // Side-channel conversation context: the renderer calls renderContext itself (W3 — the type never
+    // carries a pre-rendered string). renderContext returns null when every line is empty; a
+    // non-empty contextLines with all-empty text therefore renders no context block.
+    //
+    // 🔴 THE CAP SITS BELOW THE DE-DUPLICATION, HERE (OPE-1749). This is the SINGLE wake renderer and the
+    // one place holding BOTH slots — the envelope siblings and the hydration — so `hydrationSlices` is
+    // applied once, in core. Dropping the envelope's own copies first is what lets the cap spend its whole
+    // budget on the older conversation the envelope never carried; capping first rendered a shallow block.
+    // It is idempotent, so a surface that already resolved its own slices (Slack's name-drop road, which
+    // needs the join half) renders byte-identically.
+    //
+    // 🔴 IT REACHES A SURFACE ONLY IF THAT SURFACE FILLS THIS SLOT, and that is a per-surface fact, not a
+    // property of this function. A road that renders its own block and hands the wake a STRING bypasses
+    // the ordering entirely — Discord's window road did, until OPE-1749 moved it onto `contextLines`.
+    // `scripts/standing-seat-test.ts` bans a provider from rendering its own block, with an allow-list of
+    // the NATIVE roads that carry no envelope siblings and so have no order to get wrong. TWO SURFACES
+    // ALSO TAKE THE ROAD AND MATCH NOTHING: on GitHub and Linear a context line's `ts` is an issue label
+    // (`#123`, `OPE-1`) that no sibling id ever equals, so the de-duplication drops nothing there and the
+    // slice is the cap alone — the same block those surfaces rendered before.
+    if (nw.contextLines && nw.contextLines.length > 0) {
+        // A `direct` wake renders the body VERBATIM and emits no envelope at all, so its `backscroll`
+        // renders NOWHERE — de-duplicating against it would drop a line to make room for a copy that was
+        // never shown. No builder sets both today; the guard makes that structural rather than a
+        // convention the next DM-seat builder could break.
+        const envelope = nw.addressing === "direct" ? [] : (nw.backscroll ?? []);
+        const lines = hydrationSlices(nw.contextLines, envelope).rendered;
+        const rendered = renderContext(lines, nw.contextSource ?? "", { readMoreHint: nw.readMoreHint });
+        if (rendered)
+            return { message, context: [rendered] };
+    }
+    return { message };
+}
+//# sourceMappingURL=normalized-wake.js.map

package/dist/agent/channels/normalized-wake.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalized-wake.js","sourceRoot":"","sources":["../../../agent/channels/normalized-wake.ts"],"names":[],"mappings":"AAAA,+XAA+X;AAC/X,unBAAunB;AAEvnB,OAAO,EACL,kBAAkB,GASnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,aAAa,EAAoB,MAAM,qBAAqB,CAAC;AACvF,oGAAoG;AACpG,oGAAoG;AACpG,+BAA+B;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAQpD,4QAA4Q;AAC5Q,sFAAsF;AAEtF,iFAAiF;AACjF,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,UAAU,CAAC;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,oCAAoC,iBAAiB,oBAAoB,CAAC;AAE5H;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,mFAAmF;IACnF,GAAG,iBAAiB,mFAAmF,CAAC;AAiH1G;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAyB;IACxD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,EAAkB,EAAE,GAAG,GAAiB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAC/F,IAAI,OAAe,CAAC;IACpB,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,SAAS,EAAE,CAAC;YACf,IAAI,EAAE,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAC/B,yFAAyF;gBACzF,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,kBAAkB,CAAC;oBACzB,MAAM,EAAE,EAAE,CAAC,MAAM;oBACjB,WAAW,EAAE,GAAG,EAAE;oBAClB,MAAM,EAAE,EAAE,CAAC,MAAM;oBACjB,oaAAoa;oBACpa,kFAAkF;oBAClF,UAAU,EAAE,EAAE,CAAC,UAAU;oBACzB,UAAU,EAAE,EAAE,CAAC,cAAc;oBAC7B,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC,QAAQ;oBAC9C,qIAAqI;oBACrI,iNAAiN;oBACjN,cAAc,EAAE,EAAE,CAAC,QAAQ;oBAC3B,wMAAwM;oBACxM,4PAA4P;oBAC5P,OAAO,EAAE;wBACP,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO;wBACnB,EAAE,EAAE,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;wBACtD,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,aAAa,IAAI,SAAS;qBACvE;oBACD,YAAY,EAAE,EAAE,CAAC,YAAY;oBAC7B,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM;oBACvB,qFAAqF;oBACrF,qDAAqD;oBACrD,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;oBACxD,kBAAkB,EAAE,EAAE,CAAC,kBAAkB;oBACzC,UAAU,EAAE,EAAE,CAAC,UAAU;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,QAAQ,EAAE,CAAC;YACd,+FAA+F;YAC/F,+FAA+F;YAC/F,2FAA2F;YAC3F,IAAI,EAAE,CAAC,UAAU,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAC9F,IAAI,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YAClH,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;YACzI,OAAO,GAAG,kBAAkB,CAAC;gBAC3B,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,WAAW,EAAE,GAAG,EAAE;gBAClB,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,UAAU,EAAE,EAAE,CAAC,UAAU;gBACzB,UAAU,EAAE,EAAE,CAAC,cAAc;gBAC7B,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC,QAAQ;gBAC9C,OAAO,EAAE;oBACP,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO;oBACnB,EAAE,EAAE,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtD,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,aAAa,IAAI,SAAS;iBACvE;gBACD,YAAY,EAAE,EAAE,CAAC,YAAY;gBAC7B,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM;gBACvB,QAAQ,EAAE,EAAE;gBACZ,kBAAkB,EAAE,EAAE,CAAC,kBAAkB;gBACzC,UAAU,EAAE,EAAE,CAAC,UAAU;aAC1B,CAAC,CAAC;YACH,MAAM;QACR,CAAC;QACD,SAAS,CAAC;YACR,mFAAmF;YACnF,+EAA+E;YAC/E,MAAM,WAAW,GAAU,EAAE,CAAC,OAAO,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAE,WAAkC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IAED,mMAAmM;IACnM,0HAA0H;IAC1H,IAAI,EAAE,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC/D,OAAO,GAAG,GAAG,OAAO,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,CAAC;IAED,kGAAkG;IAClG,yFAAyF;IACzF,iFAAiF;IACjF,EAAE;IACF,sGAAsG;IACtG,mGAAmG;IACnG,uGAAuG;IACvG,uGAAuG;IACvG,qGAAqG;IACrG,iDAAiD;IACjD,EAAE;IACF,sGAAsG;IACtG,oGAAoG;IACpG,kGAAkG;IAClG,sGAAsG;IACtG,mGAAmG;IACnG,qGAAqG;IACrG,sGAAsG;IACtG,0EAA0E;IAC1E,IAAI,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,8FAA8F;QAC9F,iGAAiG;QACjG,yFAAyF;QACzF,mDAAmD;QACnD,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC;QAClE,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;QACjG,IAAI,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC"}

package/dist/agent/channels/oe-oauth-callback.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("eve/channels").Channel<undefined, Record<string, unknown>, Record<string, unknown>>;
+export default _default;
+//# sourceMappingURL=oe-oauth-callback.d.ts.map

package/dist/agent/channels/oe-oauth-callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oe-oauth-callback.d.ts","sourceRoot":"","sources":["../../../agent/channels/oe-oauth-callback.ts"],"names":[],"mappings":""}

package/dist/agent/channels/oe-oauth-callback.js

@@ -0,0 +1,8 @@
+// Deployment mount for `GET /oauth/v1/callback`; the behaviour lives in connections/oe-oauth-callback.ts.
+// The completer resolves per request, so the route fails closed (404) whenever the own-rolled OAuth adapter is not registered.
+import { defineChannel, GET } from "eve/channels";
+import { OE_OAUTH_CALLBACK_PATH, handleOeOauthCallback, resolveOeOauthCallbackCompleter, } from "../connections/oe-oauth-callback.js";
+export default defineChannel({
+    routes: [GET(OE_OAUTH_CALLBACK_PATH, async (req) => handleOeOauthCallback(req, resolveOeOauthCallbackCompleter()))],
+});
+//# sourceMappingURL=oe-oauth-callback.js.map

package/dist/agent/channels/oe-oauth-callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oe-oauth-callback.js","sourceRoot":"","sources":["../../../agent/channels/oe-oauth-callback.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,+HAA+H;AAE/H,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,+BAA+B,GAChC,MAAM,qCAAqC,CAAC;AAE7C,eAAe,aAAa,CAAC;IAC3B,MAAM,EAAE,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,+BAA+B,EAAE,CAAC,CAAC,CAAC;CACpH,CAAC,CAAC"}

package/dist/agent/channels/own-post-ledger.d.ts

@@ -0,0 +1,35 @@
+/**
+ * How long after posting a message stays editable: long enough for a working session in which a posted list or summary needs updating, short enough that the verb stays about a RECENT post.
+ * The `event_dedupe` housekeeping sweep bounds the row regardless, so raising this past that ceiling would buy nothing.
+ */
+export declare const OWN_POST_TTL_MS: number;
+/**
+ * WHERE a message this deployment posted lives. Every field is host-resolved — from the session binding or the frozen wake origin — and never from model input.
+ * `channelId` is the conversation the message sits in: a Slack channel id, a Discord channel id (a Discord thread IS its own channel), a Teams conversation id.
+ */
+export interface OwnPostLocus {
+    readonly platform: string;
+    readonly channelId: string;
+}
+/** The injectable store seams (tests script them; the live path reads the operational store). */
+export interface OwnPostLedgerDeps {
+    readonly markEventSeen?: (org: string, key: string, atIso: string, ttlMs: number) => Promise<boolean>;
+    readonly hasEventSeen?: (org: string, key: string, atIso: string, ttlMs: number) => Promise<boolean>;
+    readonly now?: () => number;
+}
+/**
+ * The `event_dedupe` key for one posted message, hashed over (platform, channel, message id) so the key is opaque and fixed-length whatever a platform's id grammar is.
+ * The platform tag stays human-legible outside the digest, matching `outboundKey`'s convention.
+ */
+export declare function ownPostKey(locus: OwnPostLocus, messageId: string): string;
+/**
+ * Record that THIS deployment posted `messageId` at `locus` — called at the reply CHOKE POINTS beside the canonical `reply.post` audit row, so the ledger and the audit trail record the same event in the same place.
+ * Best-effort and never throws. A blank org, a blank message id or the dedupe sentinel records nothing, and a lost row only means this message cannot be edited later — the fail-closed direction.
+ */
+export declare function recordOwnPost(org: string | undefined, locus: OwnPostLocus, messageId: string, deps?: OwnPostLedgerDeps): Promise<void>;
+/**
+ * Is `messageId` at `locus` a message THIS deployment's reply spine posted, inside the edit window?
+ * Fail-closed on every unknown — no org, no message id, a store error all answer `false` — and channels/reply-edit.ts turns that `false` into an audited refusal rather than a quiet one.
+ */
+export declare function isOwnPost(org: string | undefined, locus: OwnPostLocus, messageId: string, deps?: OwnPostLedgerDeps): Promise<boolean>;
+//# sourceMappingURL=own-post-ledger.d.ts.map

package/dist/agent/channels/own-post-ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"own-post-ledger.d.ts","sourceRoot":"","sources":["../../../agent/channels/own-post-ledger.ts"],"names":[],"mappings":"AASA;;;GAGG;AACH,eAAO,MAAM,eAAe,QAAkB,CAAC;AAE/C;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,iGAAiG;AACjG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtG,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrG,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAGzE;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhJ;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAS/I"}

package/dist/agent/channels/own-post-ledger.js

@@ -0,0 +1,57 @@
+// own-post-ledger — the record of WHICH platform messages this deployment's own reply spines posted, and so the ONE fence that lets `edit_reply` touch a message at all. A platform refusal is a backstop, not the control: it cannot say which of the bot's messages this is.
+// The model authors one field, the message id; the locus is host-resolved. FAIL-CLOSED, the inverse of operational/post-once.ts — an unreadable store, a missing org or any thrown error answers `false`, which is a refusal and never a permission.
+import { createHash } from "node:crypto";
+import { getOperationalStore } from "../operational/provider.js";
+/** Namespace prefix — keeps own-post keys from colliding with inbound event ids or `outbound:` keys. */
+const OWN_POST_KEY_PREFIX = "ownpost:";
+/**
+ * How long after posting a message stays editable: long enough for a working session in which a posted list or summary needs updating, short enough that the verb stays about a RECENT post.
+ * The `event_dedupe` housekeeping sweep bounds the row regardless, so raising this past that ceiling would buy nothing.
+ */
+export const OWN_POST_TTL_MS = 6 * 60 * 60_000;
+/**
+ * The `event_dedupe` key for one posted message, hashed over (platform, channel, message id) so the key is opaque and fixed-length whatever a platform's id grammar is.
+ * The platform tag stays human-legible outside the digest, matching `outboundKey`'s convention.
+ */
+export function ownPostKey(locus, messageId) {
+    const digest = createHash("sha256").update([locus.platform, locus.channelId, messageId].join(" ")).digest("hex");
+    return `${OWN_POST_KEY_PREFIX}${locus.platform}:${digest}`;
+}
+/**
+ * Record that THIS deployment posted `messageId` at `locus` — called at the reply CHOKE POINTS beside the canonical `reply.post` audit row, so the ledger and the audit trail record the same event in the same place.
+ * Best-effort and never throws. A blank org, a blank message id or the dedupe sentinel records nothing, and a lost row only means this message cannot be edited later — the fail-closed direction.
+ */
+export async function recordOwnPost(org, locus, messageId, deps = {}) {
+    if (!org || !messageId || !locus.channelId)
+        return;
+    if (!isRecordableMessageId(messageId))
+        return;
+    const mark = deps.markEventSeen ?? ((o, k, at, ttl) => getOperationalStore().markEventSeen(o, k, at, ttl));
+    const at = new Date((deps.now ?? Date.now)()).toISOString();
+    await mark(org, ownPostKey(locus, messageId), at, OWN_POST_TTL_MS).catch(() => undefined);
+}
+/**
+ * Is `messageId` at `locus` a message THIS deployment's reply spine posted, inside the edit window?
+ * Fail-closed on every unknown — no org, no message id, a store error all answer `false` — and channels/reply-edit.ts turns that `false` into an audited refusal rather than a quiet one.
+ */
+export async function isOwnPost(org, locus, messageId, deps = {}) {
+    if (!org || !messageId || !locus.channelId)
+        return false;
+    const has = deps.hasEventSeen ?? ((o, k, at, ttl) => getOperationalStore().hasEventSeen(o, k, at, ttl));
+    const at = new Date((deps.now ?? Date.now)()).toISOString();
+    try {
+        return await has(org, ownPostKey(locus, messageId), at, OWN_POST_TTL_MS);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The dedupe sentinel the reply spines return for a suppressed repost — never a real platform id, so it must never enter the ledger.
+ * Duplicated as a literal rather than imported, to keep this module free of a cycle back into the reply spines; channels/reply-post.ts owns the exported constant and a test pins the two equal.
+ */
+const DEDUPE_SENTINEL = "deduped:reply";
+function isRecordableMessageId(messageId) {
+    return messageId !== DEDUPE_SENTINEL;
+}
+//# sourceMappingURL=own-post-ledger.js.map

package/dist/agent/channels/own-post-ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"own-post-ledger.js","sourceRoot":"","sources":["../../../agent/channels/own-post-ledger.ts"],"names":[],"mappings":"AAAA,+QAA+Q;AAC/Q,qPAAqP;AAErP,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,wGAAwG;AACxG,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAEvC;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;AAkB/C;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAmB,EAAE,SAAiB;IAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjH,OAAO,GAAG,mBAAmB,GAAG,KAAK,CAAC,QAAQ,IAAI,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAuB,EAAE,KAAmB,EAAE,SAAiB,EAAE,IAAI,GAAsB,EAAE;IAC/H,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO;IACnD,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC;QAAE,OAAO;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,mBAAmB,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3G,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,MAAM,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5F,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAuB,EAAE,KAAmB,EAAE,SAAiB,EAAE,IAAI,GAAsB,EAAE;IAC3H,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,mBAAmB,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACxG,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,eAAe,GAAG,eAAe,CAAC;AAExC,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,OAAO,SAAS,KAAK,eAAe,CAAC;AACvC,CAAC"}

package/dist/agent/channels/platform-failure.d.ts

@@ -0,0 +1,20 @@
+/** DEFINITIVE = the platform proves nothing happened. AMBIGUOUS = it may have. */
+export type PlatformFailureClass = "definitive" | "ambiguous";
+/**
+ * The platform HTTP status an arm attached to a thrown error, or undefined.
+ * Only a finite NUMBER is read, so nothing an arm attaches can smuggle a body, a URL or a token into an audit row.
+ */
+export declare function platformFailureStatus(err: unknown): number | undefined;
+/** Which class is this failure? See the header — two signals, no string matching. */
+export declare function platformFailureClass(err: unknown): PlatformFailureClass;
+/**
+ * Stamp an error as a DEFINITIVE failure — the call did NOT take effect at the platform. Exported through adapter-api.ts so a provider arm can say it about its own calls.
+ * Say it only where the arm KNOWS: a decided refusal, or a pre-flight the host refused. Never about a call whose answer never arrived.
+ */
+export declare function markNotApplied<E extends Error>(err: E): E;
+/**
+ * Copy the failure signals from one error onto another — for a caller that RE-WRAPS a platform error in its own copy.
+ * Without this a re-wrap silently downgrades every failure to AMBIGUOUS: the signals live on the error OBJECT, not in its message, so `new Error(old.message)` drops them. Both fields travel or neither does.
+ */
+export declare function carryFailureSignals<E extends Error>(from: unknown, to: E): E;
+//# sourceMappingURL=platform-failure.d.ts.map

package/dist/agent/channels/platform-failure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-failure.d.ts","sourceRoot":"","sources":["../../../agent/channels/platform-failure.ts"],"names":[],"mappings":"AAGA,kFAAkF;AAClF,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,WAAW,CAAC;AAK9D;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGtE;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,oBAAoB,CAKvE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAEzD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAM5E"}

package/dist/agent/channels/platform-failure.js

@@ -0,0 +1,42 @@
+// platform-failure — one vocabulary for "what kind of failure was that", shared by every terminal verb that asks a platform to act. The rule it serves lives in channels/turn-terminal-actions.ts.
+// The SHAPE of the answer is the signal, never the words in it: an arm's own `applied === false` first, then the numeric HTTP status, where a 4xx is definitive except 408 and 429. An error carrying neither signal is AMBIGUOUS, which fails closed.
+/** Statuses that are 4xx yet carry no proof either way. */
+const AMBIGUOUS_CLIENT_STATUSES = new Set([408, 429]);
+/**
+ * The platform HTTP status an arm attached to a thrown error, or undefined.
+ * Only a finite NUMBER is read, so nothing an arm attaches can smuggle a body, a URL or a token into an audit row.
+ */
+export function platformFailureStatus(err) {
+    const status = err?.status;
+    return typeof status === "number" && Number.isFinite(status) ? status : undefined;
+}
+/** Which class is this failure? See the header — two signals, no string matching. */
+export function platformFailureClass(err) {
+    if (err?.applied === false)
+        return "definitive";
+    const status = platformFailureStatus(err);
+    if (status !== undefined && status >= 400 && status < 500 && !AMBIGUOUS_CLIENT_STATUSES.has(status))
+        return "definitive";
+    return "ambiguous";
+}
+/**
+ * Stamp an error as a DEFINITIVE failure — the call did NOT take effect at the platform. Exported through adapter-api.ts so a provider arm can say it about its own calls.
+ * Say it only where the arm KNOWS: a decided refusal, or a pre-flight the host refused. Never about a call whose answer never arrived.
+ */
+export function markNotApplied(err) {
+    return Object.assign(err, { applied: false });
+}
+/**
+ * Copy the failure signals from one error onto another — for a caller that RE-WRAPS a platform error in its own copy.
+ * Without this a re-wrap silently downgrades every failure to AMBIGUOUS: the signals live on the error OBJECT, not in its message, so `new Error(old.message)` drops them. Both fields travel or neither does.
+ */
+export function carryFailureSignals(from, to) {
+    const applied = from?.applied;
+    if (applied === false)
+        markNotApplied(to);
+    const status = platformFailureStatus(from);
+    if (status !== undefined)
+        Object.assign(to, { status });
+    return to;
+}
+//# sourceMappingURL=platform-failure.js.map

package/dist/agent/channels/platform-failure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-failure.js","sourceRoot":"","sources":["../../../agent/channels/platform-failure.ts"],"names":[],"mappings":"AAAA,mMAAmM;AACnM,uPAAuP;AAKvP,2DAA2D;AAC3D,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE3E;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,MAAM,MAAM,GAAI,GAA+C,EAAE,MAAM,CAAC;IACxE,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,IAAK,GAAgD,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,YAAY,CAAC;IAC9F,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,YAAY,CAAC;IACzH,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAkB,GAAM;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAc,EAAE,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAkB,IAAa,EAAE,EAAK;IACvE,MAAM,OAAO,GAAI,IAAiD,EAAE,OAAO,CAAC;IAC5E,IAAI,OAAO,KAAK,KAAK;QAAE,cAAc,CAAC,EAAE,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACxD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/agent/channels/policy-pages.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("eve/channels").Channel<undefined, Record<string, unknown>, Record<string, unknown>>;
+export default _default;
+//# sourceMappingURL=policy-pages.d.ts.map

package/dist/agent/channels/policy-pages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-pages.d.ts","sourceRoot":"","sources":["../../../agent/channels/policy-pages.ts"],"names":[],"mappings":""}

package/dist/agent/channels/policy-pages.js

@@ -0,0 +1,14 @@
+// Deployment mount for the two PUBLIC policy pages — `GET /privacy` and `GET /terms`. The
+// behaviour lives in pages/policy-pages.ts; the text is the operator's, declared as
+// `policyPages.privacy` / `policyPages.terms` in `agent/settings/settings.ts`.
+// GET only, and both answer 200 with or without operator text: `teams-app/manifest.json` points
+// `privacyUrl` and `termsOfUseUrl` here, and a route that 404s is the defect this mount removes.
+import { defineChannel, GET } from "eve/channels";
+import { PRIVACY_PAGE_PATH, TERMS_PAGE_PATH, policyPageResponse } from "../pages/policy-pages.js";
+export default defineChannel({
+    routes: [
+        GET(PRIVACY_PAGE_PATH, async () => policyPageResponse("privacy")),
+        GET(TERMS_PAGE_PATH, async () => policyPageResponse("terms")),
+    ],
+});
+//# sourceMappingURL=policy-pages.js.map

package/dist/agent/channels/policy-pages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-pages.js","sourceRoot":"","sources":["../../../agent/channels/policy-pages.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,oFAAoF;AACpF,+EAA+E;AAC/E,gGAAgG;AAChG,iGAAiG;AAEjG,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAElG,eAAe,aAAa,CAAC;IAC3B,MAAM,EAAE;QACN,GAAG,CAAC,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACjE,GAAG,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;KAC9D;CACF,CAAC,CAAC"}

package/dist/agent/channels/post-arms.d.ts

@@ -0,0 +1,202 @@
+import type { BindableContext } from "../identity/binding.js";
+import type { ReplyTarget, ReplierLabel } from "./reply-post.js";
+import type { EditLocus } from "./reply-edit.js";
+import type { UnifiedWakeOrigin } from "./unified-window.js";
+import type { UnifiedReplyDeps } from "./unified-reply.js";
+import type { LinkedAccount } from "../identity/link-store.js";
+/**
+ * The bag a mid-turn {@link PostArm.resolveTarget} reads from — the binding's post-back target, narrowed by the spine so an arm needs no binding import of its own.
+ * Every value comes from the per-delivery auth the surface stowed, NEVER a tool argument: `reply` can only post where it was woken.
+ */
+export interface TargetResolveBag {
+    str(k: string): string | undefined;
+    num(k: string): number | undefined;
+    readonly threadTs?: string;
+    /** The raw bindable ctx, for the rare arm that needs a field the bag doesn't pre-narrow. */
+    readonly ctx: BindableContext;
+}
+/**
+ * Where a DM delivery landed — public ids only (safe for an audit row; never the content).
+ */
+export interface DirectMessageDelivery {
+    /** The DM conversation/channel id the message landed in (Slack: `conversations.open`'s channel id). */
+    readonly surfaceId: string;
+    /** The platform message id of the delivered message. */
+    readonly messageId: string;
+}
+/**
+ * One tappable action a DM may carry beside its text, platform-NEUTRAL by construction. THE TEXT MUST STAND ON ITS OWN: an arm with no component plane ignores `actions`, and an arm that renders them may still have its buttons stripped by the platform, so a caller must never write copy that only makes sense with a button.
+ * `id` is the CALLER's own opaque routing key — it is what comes back on the click, so the caller owns its grammar and its length budget. `label` is core-owned copy and never model text: it renders inside the agent's own message.
+ */
+export interface DirectMessageAction {
+    readonly id: string;
+    readonly label: string;
+    /** What the tap MEANS, so each surface picks its own affirmative/destructive styling. */
+    readonly intent: "affirm" | "reject";
+}
+/**
+ * What {@link PostArm.deliverDirectMessage} is asked to do — a principal, the text, and optionally a row of tappable actions.
+ * Deliberately free of hosting topology and surface identity: the caller names WHO, never WHERE, and opening or reusing the 1:1 conversation is the provider's business.
+ */
+export interface DirectMessageRequest {
+    /** The bare platform principal id of the recipient (Slack member id, Discord user id, …). */
+    readonly principalId: string;
+    readonly text: string;
+    /** Tappable shortcuts. Ignored by an arm with no component plane — see {@link DirectMessageAction}. */
+    readonly actions?: readonly DirectMessageAction[];
+}
+/**
+ * The `dm.delivery.skipped` audit `detail.reason` — one greppable string, shared by the emitter
+ * and its test (same convention as `UNADMITTED_TENANT_DROP_REASON` in access/tenant-admission.ts).
+ */
+export declare const DM_WORKSPACE_UNREACHABLE_REASON = "workspace-unreachable";
+/** Can THIS deployment's arm even reach `targetTenant`? `reachable: false` is the loud floor
+ *  (OPE-354); the two `reachable: true` shapes are collapsed into one — a caller that wants to know
+ *  WHY it was told "go ahead" doesn't need to, because both mean the same thing: attempt the send. */
+export type DmWorkspaceReachability = {
+    readonly reachable: true;
+} | {
+    readonly reachable: false;
+    readonly targetTenant: string;
+    readonly armTenant: string;
+};
+/**
+ * PURE decision table for the DM-workspace floor: it takes the arm's own tenant as an argument, so the table is unit-testable without a config. It is the DETECTION seam ONLY — it never picks a credential and never changes which token an arm uses, it just tells the caller whether to bother trying.
+ * THREE branches answer `reachable: true` on purpose, stated so a future reader does not "fix" them into a skip: a platform whose ids are vendor-global has no same-platform workspace to alias across; a blank target tenant is not evidence of a FOREIGN workspace, so comparing it would invent a mismatch rather than detect one; and an UNDETERMINED arm tenant is the FAIL-OPEN-ON-UNKNOWN pin, because today's code always attempts the send and this floor must never newly refuse a delivery that used to go through. It answers false only when the arm tenant is KNOWN and differs.
+ */
+export declare function classifyDmWorkspaceReachability(platform: string, targetTenant: string | undefined, armTenant: string | undefined): DmWorkspaceReachability;
+/** {@link classifyDmWorkspaceReachability} against the registered app config's sole admitted tenant
+ *  for `platform` (access/tenant-admission.ts) — the real call this floor makes at DM-delivery time. */
+export declare function dmWorkspaceReachableFromConfig(platform: string, targetTenant: string | undefined): DmWorkspaceReachability;
+/**
+ * REACT: where a react lands, for a provider whose react target is not a specific message but the conversation ANCHOR — the issue or ticket the surface tracks.
+ * Deliberately its own small union rather than a narrowing of the reply target: a reaction primitive can address an issue or comment id and never an agent-session id, so a react must resolve its anchor on its own account even on the agent-session reply route. Slack keeps its own direct implementation and never populates this type.
+ */
+export type ReactTarget = {
+    readonly platform: "linear";
+    readonly issueId: string;
+    readonly organizationId?: string;
+} | {
+    readonly platform: "github";
+    readonly owner: string;
+    readonly repo: string;
+    readonly issueNumber: number;
+    readonly installationId?: number;
+} | {
+    readonly platform: "discord";
+    readonly channelId: string;
+    readonly messageId: string;
+};
+/**
+ * Is this post the WHOLE answer to its wake, or one part of an answer still being written? The reply tool's own `done` input is the fact. Most arms never need it — a chat surface treats every post the same way — but one does: an agent-session route ENDS the session with a terminal activity, so a non-terminal part posted as one makes the real answer unpostable.
+ * ABSENT MEANS TERMINAL. Every caller with no `done` to give is by construction posting a complete answer, so the default is the one that needs no thought.
+ */
+export interface PostIntent {
+    /** True ⇒ this post completes the answer to its wake. False ⇒ another part follows. An arm that
+     *  is handed NO {@link PostIntent} at all must read that as terminal — see the note above. */
+    readonly terminal: boolean;
+}
+export interface PostArm {
+    readonly platform: string;
+    /** MID-TURN: build this surface's {@link ReplyTarget} from the binding, or null when unresolvable. */
+    resolveTarget?(bag: TargetResolveBag): ReplyTarget | null;
+    /**
+     * MID-TURN: post a resolved target and return the platform message id, throwing a token-free error if it did not land. The `reply` tool's choke point funnels through this one call, and since OPE-2006 it is the only caller — the terminal-prose poster that shared it is deleted.
+     * `replier` is passed ONLY when {@link displayNameCapable} is true for this arm; every other arm never sees it, because the spine bakes the tier bracket into the text first.
+     */
+    dispatchReply?(target: ReplyTarget, text: string, replier?: ReplierLabel): Promise<string>;
+    /**
+     * Does this arm's `dispatchReply` apply a worker-turn REPLIER label itself, through a native per-message display-name override?
+     * Undefined or false means the spine renders the shared bracket-prefix fallback onto the body BEFORE calling `dispatchReply`, and `replier` is never passed down.
+     */
+    readonly displayNameCapable?: boolean;
+    /**
+     * UNIFIED: post a single-window reply for this origin and return the message id. `deps` carry the test-injectable per-surface overrides, and an arm resolves `deps.postX ?? live` itself.
+     * `replier` is passed only when {@link displayNameCapable} is true; a test-injected override, when present, is used verbatim and never sees it.
+     */
+    dispatchUnified?(origin: UnifiedWakeOrigin, text: string, deps: UnifiedReplyDeps, replier?: ReplierLabel, intent?: PostIntent): Promise<string>;
+    /**
+     * UNIFIED, WITH A COMPONENT PLANE (OPE-1720): post the same single-window reply AND a row of tappable {@link DirectMessageAction}s beside it, returning the message id. This is what lets an interactive card — eve's bridged `tool-approval`, and the tap-through choices that follow it — reach a unified origin at all; until it existed `dispatchUnified` took one string, so a DM seat could only ever be shown a question as prose.
+     * PRESENCE IS THE DECLARATION, exactly as it is for {@link deliverDirectMessage}: an arm without this member has no unified component plane and the spine posts the TEXT through {@link dispatchUnified} instead — never a faked or silently dropped button row. 🔴 AN ARM MUST NOT IMPLEMENT IT UNTIL THE TAP ROUTE EXISTS ON ITS SURFACE. A button that settles nothing is worse than no button on a governed approval: the person taps Approve, the turn stays parked, and the room cannot tell. The text still stands on its own here for the same reason it does on a DM ({@link DirectMessageAction}), so the fallback loses the shortcut and never the meaning.
+     * `deps` carry the same test-injectable per-surface overrides `dispatchUnified` reads. A test override that cannot carry components is honoured verbatim, so an injected post never renders a card the test did not ask for.
+     */
+    dispatchUnifiedActions?(origin: UnifiedWakeOrigin, text: string, actions: readonly DirectMessageAction[], deps: UnifiedReplyDeps, replier?: ReplierLabel, intent?: PostIntent): Promise<string>;
+    /**
+     * UNIFIED: complete an OPEN session for a turn that judged SILENCE — only for a surface that holds a session across the divert. NO MODEL PROSE ever posts through this member, and what the arm leaves in the room is the ARM's decision: a surface with no invisible close renders a fixed HOST ack.
+     * `answered` says the turn ALREADY answered this origin's own container through a SIBLING wake, which the spine proves from the per-turn reply record and never from the model. The session still closes; only the line changes, and an arm that ignores the flag closes exactly as it did before.
+     */
+    closeUnifiedSilently?(origin: UnifiedWakeOrigin, deps: UnifiedReplyDeps, answered?: boolean): Promise<void>;
+    /**
+     * EDIT: rewrite the text of a message THIS deployment already posted, in place. Both reply spines share this ONE member — the caller resolves the locus from the session binding or the frozen wake origin, so an arm never has to know which spine asked. It throws token-free when the platform rejected the edit, and returns nothing, because an edit mints no new message id.
+     * PRESENCE IS THE DECLARATION: an arm without it cannot edit and the spine refuses with an audited `no-edit-arm`, while `edit_reply` stays mounted on every surface regardless. Two absences are PLATFORM LIMITS rather than not-yets — an agent-activity reply has no update mutation, and a comment API with no update endpoint. THE ARM MUST NEVER TREAT ITS OWN CHECK AS THE FENCE: ownership is decided against the own-post ledger before this is ever called.
+     */
+    editMessage?(locus: EditLocus, messageId: string, text: string): Promise<void>;
+    /**
+     * CAN {@link editMessage} ACTUALLY BE ISSUED at this locus, under the credential it would resolve? (OPE-1753.)
+     * PRESENCE IS THE DECLARATION, and absence means "nothing narrows it beyond the member existing" — so an arm that adds no fence keeps today's answer exactly.
+     * 🔴 IT EXISTS BECAUSE `editMessage`'S PRESENCE IS NOT THE WHOLE ANSWER. A credential may carry endpoint rules that forbid the very method the edit issues, and those rules are enforced in-process before any byte leaves (`access/credential-endpoints.ts`). Notion is the measured case: the arm PATCHes `/v1/comments/{id}` while this deployment's channel key declares `GET,POST` on purpose, so every edit was refused before dispatch — and the should-be-edit policy, reading only the member's presence, kept steering the seat at a verb that could never work.
+     * It must be READ-ONLY and cheap, it must never throw (an arm that cannot decide answers true, leaving today's behaviour), and it decides only whether to OFFER an edit — the fence itself stays the wall.
+     */
+    editReachable?(locus: {
+        readonly platform: string;
+        readonly channelId: string;
+    }): Promise<boolean>;
+    /**
+     * EDIT, ADDRESS HALF: move the host-resolved edit locus onto the conversation the reply ACTUALLY landed in, for a surface that can post somewhere its frozen wake origin cannot name. Exactly one arm needs it, and the reason is structural — a thread that IS its own channel id, opened during the turn, leaves the reply at an address the frozen origin never carried.
+     * It is called BEFORE the ownership fence, so the ledger read and the transport both address the conversation the message is in. It must be READ-ONLY — it resolves an address and must never create the container it names — and it returns `locus` unchanged whenever it cannot prove a better one.
+     */
+    retargetEditLocus?(origin: UnifiedWakeOrigin, locus: EditLocus): Promise<EditLocus>;
+    /** REDRIVE: a token-free "where the dropped answer was owed" description (public ids only). */
+    describeRedriveTarget?(origin: UnifiedWakeOrigin): string;
+    /** REDRIVE: a best-effort primary container id for the corrective envelope (cosmetic; never routes). */
+    redriveContainerId?(origin: UnifiedWakeOrigin): string;
+    /**
+     * DM: open, or reuse, the 1:1 direct-message conversation with `principalId` and post `text` there, returning the DM surface and message ids. Throws token-free if it did not land.
+     * ABSENT means this provider cannot DM-deliver, and the governance arm then REFUSES fail-closed — it never falls back to rendering org-scope substance in the room. One surface cannot cold-address a person at all: its arm posts into a captured 1:1 chat, opens one from a captured region, or refuses out loud when it has neither.
+     */
+    deliverDirectMessage?(input: DirectMessageRequest): Promise<DirectMessageDelivery>;
+    /**
+     * REACT: resolve this surface's {@link ReactTarget} from the binding, or null when unresolvable. It mirrors {@link resolveTarget}'s bag pattern but is independent of it — see {@link ReactTarget} for why.
+     * It is called only for a non-Slack platform, and its presence is what lets a react reach a ticketing surface at all.
+     */
+    resolveReactTarget?(bag: TargetResolveBag): ReactTarget | null;
+    /**
+     * REACT: leave a reaction at `target`. `emoji` is the model's bare, lowercase name, which some platforms' own vocabulary matches directly, so those arms pass it straight through.
+     * An arm whose platform uses a narrower vocabulary maps it internally, and throws an honest, token-free error naming that surface's real options when the name has no equivalent — never a silent no-op.
+     */
+    react?(target: ReactTarget, emoji: string): Promise<void>;
+}
+/** Register (or replace) one provider's post arm. Called once per provider at module load — see the
+ *  bottom of this file. Exported so a future surface registers the same way. */
+export declare function registerPostArm(arm: PostArm): void;
+/** The arm for `platform`, or undefined when no provider registered one — or the platform itself is
+ *  undefined (channelPlatform returns `string | undefined`) — so the spine refuses/returns null,
+ *  never a faked or mis-routed post. */
+export declare function postArm(platform: string | undefined): PostArm | undefined;
+/** The platforms with ANY post arm registered — for the "no arm" refusal messages. */
+export declare function registeredPostArmPlatforms(): readonly string[];
+/** The platforms whose arm implements {@link PostArm.deliverDirectMessage} — for the refusal copy. */
+export declare function directMessageCapablePlatforms(): readonly string[];
+/** Does `platform` support DM delivery? Checked BEFORE any pane substance is computed, so the
+ *  governance arm can refuse without ever materialising what it can't deliver. */
+export declare function canDeliverDirectMessage(platform: string | undefined): boolean;
+/** Can a unified post on `platform` carry tappable actions — that is, does its arm implement
+ *  {@link PostArm.dispatchUnifiedActions}? Read BEFORE a caller mints any click state, so a surface
+ *  with no component plane never writes a ticket row for buttons that will not be posted. */
+export declare function canPostUnifiedActions(platform: string | undefined): boolean;
+/** The platforms whose arm can carry tappable actions on a unified post — for the same honest
+ *  "which surfaces actually do this" answer {@link directMessageCapablePlatforms} gives for DMs. */
+export declare function unifiedActionCapablePlatforms(): readonly string[];
+/**
+ * Deliver `text` to `principalId`'s DM on `platform` through that provider's post arm.
+ * It throws a LOUD, token-free error when the platform has no DM arm, naming the platforms that do — the same refuse-rather-than-mis-route posture the dispatch spines take, and what keeps the governance DM arm fail-closed on a provider that cannot DM.
+ */
+export declare function dispatchDirectMessage(platform: string | undefined, input: DirectMessageRequest): Promise<DirectMessageDelivery>;
+/**
+ * Tell EVERY confirmed member of a link-set that it changed. It is NOT a gate and must never become one: under the collapsed consent model MEMBERSHIP IS THE CONSENT, and any confirmed member may grow or sever the set. What this adds is the one thing that collapse left missing — a compromised account cannot change the shape of somebody's identity QUIETLY, because the person hears about it on their other accounts.
+ * BEST-EFFORT on every axis, and each is a real hole: only an account on a DM-CAPABLE surface is reachable, and the registry is the only honest answer to which those are; if the set's ONLY DM-capable account is the compromised one, the notice goes to the attacker and nobody else; a throwing or hanging arm must never fail the tool turn; and a member on a workspace this deployment's arm cannot reach is SKIPPED WITH AN AUDIT ROW, a loud non-delivery rather than a new hole. It never throws, and returns how many deliveries actually landed.
+ */
+export declare function notifyLinkSetMembers(org: string, linkSetId: string, text: string, opts?: {
+    readonly except?: readonly LinkedAccount[];
+}): Promise<number>;
+//# sourceMappingURL=post-arms.d.ts.map