@open-everywhere/core 0.1.0

package/dist/agent/identity/link-flow.d.ts

@@ -0,0 +1,260 @@
+/** How act 2 identifies the target. See the module header. */
+export type LinkTransport = "directory" | "code";
+/** Every transport this deployment implements — the runtime guard for a value read back off a row
+ *  (a store is a string column; a row written by a later version must not silently read as
+ *  "directory" and skip the forced code-back). */
+export declare function asLinkTransport(raw: string | undefined): LinkTransport;
+/** Decided once, at consent time; the answer is materialised on the row and every later decision reads the row. A code-back that the transport requires but this surface cannot deliver degrades to the acknowledged ratification with an audit row, rather than refusing the claim. */
+export type CodeBackDecision = {
+    readonly mint: true;
+} | {
+    readonly mint: false;
+    readonly reason: "not-required" | "undeliverable";
+};
+export declare function codeBackDecision(input: {
+    readonly transport: LinkTransport;
+    readonly knobArmed: boolean;
+    readonly deliverable: boolean;
+}): CodeBackDecision;
+/**
+ * What a finalize call may do. `peek` writes NOTHING and names the consent; `commit` ratifies;
+ * `refuse` is a sentence the caller throws.
+ */
+export type FinalizeVerdict = {
+    readonly kind: "peek";
+} | {
+    readonly kind: "commit";
+} | {
+    readonly kind: "refuse";
+    readonly reason: string;
+};
+/**
+ * THE FINALIZE GATE — the one decision standing between a recorded consent and a written link.
+ *
+ * Three properties, and what each one is actually worth:
+ *
+ *  1. THE PEEK (OPE-618). A call that carries neither `acknowledge` nor `code` PEEKS: the caller gets
+ *     the consenting account named back and nothing is written. A call that DOES carry one must also
+ *     name the challenge it acts on (`challengeId`), and the refusal deliberately does not echo an id.
+ *     ⚠️ THIS IS NOT A BARRIER AGAINST A DISOBEDIENT MODEL, and must not be described as one:
+ *     `link_identity` returns the `challengeId` at act 1, so a model that kept it can pass
+ *     `acknowledge: true` on its first `confirm_link` call and commit an account it never showed
+ *     anybody — wherever no code-back digest is on the row. What the peek buys is stated once, in
+ *     tools/confirm_link.ts's own header: it repairs BLINDNESS, so the sentence the model puts in
+ *     front of the person names a real account off the row instead of a question. Property 2 is the
+ *     only one here that a model cannot answer out of its own context.
+ *  2. FORCED CODE-BACK. When the row carries a `backNonceHash`, `acknowledge: true` alone is REFUSED.
+ *     The only thing that commits is the code itself, compared by hash — a knowledge proof cannot be
+ *     answered by a reflex, and cannot be answered from context either.
+ *  3. NO CODE WHERE NONE WAS ISSUED. A `code` on a row with no `backNonceHash` is refused rather than
+ *     ignored. Ignoring it would let a person believe a second factor was checked when nothing was.
+ *
+ * PURE: the hash comparison is `hashLinkCode` over the supplied text, so the raw code-2 never has to
+ * be at rest for this to be decidable.
+ *
+ * 🔴 A BLANK `code` IS NO CODE, AND THAT IS A PEEK, NOT A REFUSAL. An empty or whitespace-only string
+ * normalises to absent, so a caller that fills every optional field with a placeholder lands on the
+ * peek rather than on a sentence telling it what went wrong. That is the RIGHT verdict — a peek
+ * writes nothing and is repeatable — but it means the PEEK'S OWN ANSWER is the only thing that can
+ * get such a caller moving again. On deploy #212 it could not: the answer said to go and ask the
+ * person for a code the person had already given, and the link was never written (OPE-1858). The
+ * answer now tells the caller to finish in the same turn; tools/confirm_link.ts owns that text.
+ */
+export declare function finalizeGate(input: {
+    /** The row's own code-back hash, or undefined when the consent step minted none. */
+    readonly backNonceHash: string | undefined;
+    readonly acknowledge?: boolean;
+    readonly code?: string;
+    readonly challengeId?: string;
+}): FinalizeVerdict;
+/**
+ * THE CONSENT GATE — act 2's twin of {@link finalizeGate}, for the account being ASKED.
+ *
+ * The same no-blind-answer property, aimed the other way: a consent call that carries no
+ * `acknowledge` PEEKS and is answered with the INITIATOR named, and a call that does acknowledge must
+ * name the request it answers. The person on this side is being asked about a STRANGER — that is the
+ * whole security value of the reverse flow (an unexpected DM naming someone you do not know is an
+ * easy human judgement), and it is worth nothing if the model can say yes before the name is in front
+ * of it.
+ *
+ * Separate from `finalizeGate` rather than a call into it with an absent hash, because the two steps
+ * refuse for different reasons and a person reads the sentence: this side has no code to be missing,
+ * and telling them one is would be wrong.
+ */
+export declare function consentGate(input: {
+    readonly acknowledge?: boolean;
+    readonly challengeId?: string;
+    readonly code?: string;
+}): FinalizeVerdict;
+/**
+ * The claim VENUE rule (Tommy, 2026-08-16): on a platform this deployment can DM, a `link <code>`
+ * claim is DM-ONLY, and a claim addressed to the agent in a channel or a group DM is REFUSED with a
+ * pointer to the DM.
+ *
+ * WHY. Code-1 is a bearer token for the length of its TTL. Posting it in a room publishes it to
+ * everybody in that room, and the reverse-initiated design exists precisely to stop a bearer secret
+ * from ever being public. Where the agent can be DM'd, no code ever needs to leave a 1:1
+ * conversation — so it must not.
+ *
+ * SCOPED TO DM-CAPABLE PLATFORMS, and that scoping is the whole design. On every platform with NO DM
+ * arm (channels/post-arms.ts `deliverDirectMessage`) a room is the only place a claim can be made at
+ * all, so refusing there would delete the cross-platform claim the code transport exists for.
+ *
+ * 🔴 STATE THE PROPERTY, NEVER A PLATFORM LIST. `dmCapable` comes from the arm registry on every
+ * call, so a platform that gains an arm starts refusing room claims the same day, with no edit here,
+ * and a platform that has none keeps its room claim. A list written into this comment would be stale
+ * the moment a bundle ships an arm, and would teach the next reader the opposite of what the code
+ * does — it already did once, when it named Slack as the only DM-capable surface and OPE-623 added a
+ * second.
+ *
+ * A GROUP DM (`mpim`) is refused with the channel copy: it has an audience, which is the property
+ * that matters, and `link_identity` refuses to START there for the same reason.
+ *
+ * Returns the refusal a person reads, or `undefined` when the venue is fine.
+ */
+export declare function claimVenueRefusal(input: {
+    readonly dmCapable: boolean;
+    readonly mode: string | undefined;
+}): string | undefined;
+/**
+ * The claim ADDRESSING rule (Tommy, 2026-09-13): a `link <code>` line only claims when the person
+ * ADDRESSED the agent. An unaddressed line sitting in a room claims nothing, and the code is not
+ * spent.
+ *
+ * WHY. A link binds one human to a second account, so the claim is the evidence that a person MEANT
+ * to bind it. An ambient line in a busy room is not that: the agent is watching the room anyway, so
+ * anyone who can type there could land a claim on whichever wake happened to carry their line. The
+ * minted instruction (identity/link-challenge.ts `linkClaimInstructions`) has always promised this
+ * — "a bare, unaddressed line will not count" — and the code now keeps the promise.
+ *
+ * 🔴 ADDRESSING IS THE SURFACE'S OWN, AND THE SURFACE DECIDES IT, NOT THIS MODULE. The caller passes
+ * the AUTHORITATIVE host-set verdict (identity/binding.ts `currentTurnAddressed`). Which sites stamp
+ * it, exactly:
+ *   • every DM divert, UNCONDITIONALLY — Slack, Discord and Teams stamp `oe_addressing` on each 1:1
+ *     delivery, with no capability gate;
+ *   • each provider's NATIVE comment leg, on its own mention verdict — Notion's name-drop
+ *     (notion-webhook.ts), GitHub's `isMention` (github.ts) and Linear's agent session (linear.ts);
+ *   • the single-window mention policy, where `window.topology` is armed AND the surface is
+ *     operator-vouched (channels/unified-window.ts `singleWindowMentionPolicy`).
+ * 🔴 THE NATIVE LEG IS THE ONE THAT MATTERS FOR THE SHIPPED DEFAULT: `window.topology` is
+ * `shipped: false`, so a stock deployment never reaches the single-window stamp. A surface whose
+ * native leg does not stamp has NO claim path at all — which is why adding a surface means adding its
+ * stamp, not a special case here.
+ *
+ * Notion is the reason the rule reads "the surface's own form" rather than "an @mention": Notion lets
+ * no user @mention an integration at all, so its classifier promotes a NAME-DROP to `direct`. A
+ * surface with no mentions and no DMs therefore keeps its claim path, and every surface is held to the
+ * same rule. There is exactly ONE addressing notion in this tree, and this is a reader of it — never a
+ * second one.
+ *
+ * Returns the refusal a person reads, or `undefined` when the wake was addressed.
+ */
+export declare function claimAddressingRefusal(input: {
+    readonly addressed: boolean;
+}): string | undefined;
+/**
+ * ONE LIVE CODE PER PROOF-OF-CONTROL LOOP (Tommy, 2026-09-19): a turn that has just ANSWERED a link
+ * request refuses to start a fresh one.
+ *
+ * WHY. An answer is the middle of a loop, not the end of one. The account that answered still owes
+ * the initiator a step — the code-back, or a confirmation on the initiator's own side. A
+ * `link_identity` start in that same conversation mints a SECOND live code and tells the person to
+ * send it from their other account, so one DM then carries two codes and two contradictory
+ * instructions, and the person has no way to tell which one the agent is waiting on. Measured on the
+ * ship #223 board (2026-09-19, S-LINK-SLACK): the claimant's seat claimed at 15:52:02, started again
+ * at 15:52:04, and told the same account nine seconds later that "the link code hasn't been claimed
+ * yet".
+ *
+ * 🔴 TWO DOORS REACH THIS SENTENCE, AND THEY ARE DIFFERENT ACTS. The CODE transport's answer is a
+ * CLAIM (the person posted `link <code>`); the DIRECTORY transport's answer is a CONSENT (the person
+ * was asked and agreed). Both land in the same `claimed_*` triple — `consentLinkChallenge` writes it
+ * too, see the store contract — so `transport` is what keeps the copy honest. A consenter told "the
+ * one you just claimed" is being named for an act they never performed, and the whole product value
+ * of this line is that it names the person's real next step.
+ *
+ * NARROWING ONLY. It refuses a start; it grants nothing, widens no audience and changes no
+ * finalize rule. An expired answer is not an open one (identity/link-store.ts
+ * `openChallengeAnsweredBy` compares the TTL), so nobody is stranded: the loop the refusal points at
+ * is always one the person can still finish.
+ *
+ * `codeBack` is whether the answered row carries a code-back digest. When the code-back was
+ * undeliverable the finalize degrades to the acknowledged ratification ({@link codeBackDecision}),
+ * and the copy must not send the person looking for a code nobody posted.
+ *
+ * Returns the refusal a person reads, or `undefined` when no loop of theirs is open.
+ */
+export declare function linkStartOpenLoopRefusal(input: {
+    readonly openLoop: boolean;
+    readonly transport: LinkTransport;
+    readonly codeBack: boolean;
+}): string | undefined;
+/** What the initiator is told after a DIRECTORY-transport request goes out. Core-owned TRUSTED text;
+ *  `targetName` is the resolved, SANITIZED account label (identity/account-display-name.ts) and is
+ *  the only interpolation. PLAIN TEXT — this reaches whichever surface the person is on. */
+export declare function linkConsentPendingInstructions(targetName: string, ttlMinutes: number): string;
+/**
+ * What the TARGET is asked, in their own DM, on the directory transport.
+ *
+ * 🔴 THIS IS AN UNSOLICITED MESSAGE TO A THIRD PARTY, AND ITS SHAPE IS A SECURITY DECISION. The
+ * recipient asked for nothing. Somebody else named their account, and the agent is about to put that
+ * stranger's chosen words in front of them. So the copy is built ANCHOR-FIRST:
+ *
+ *   • `initiatorAnchor` LEADS. It is composed from facts this deployment's own mapper captured — the
+ *     platform, the workspace and the account id — and is the one part of this message nobody can
+ *     choose. It is what the recipient should judge on.
+ *   • `initiatorName` is ATTRIBUTED, never asserted. It is the initiating account's own self-set
+ *     profile string, so the sentence says so in as many words: the agent reports what the account
+ *     CALLS ITSELF. Sanitizing (identity/account-display-name.ts) strips control characters and caps
+ *     the length, which stops a crafted name forging a second line — it does NOT remove a URL, a
+ *     brand name, or prose written to imitate the agent's own voice. Attribution is what makes those
+ *     harmless: a claim marked as a claim cannot borrow the agent's authority.
+ *   • The name is ABSENT entirely when none resolves. A placeholder would add nothing a reader can
+ *     check, and the anchor already names the account.
+ *
+ * The TARGET's own account is named by anchor too, never by profile name — the recipient knows who
+ * they are, and a second self-set string here would only be a second thing to spoof.
+ *
+ * PLAIN TEXT (no markdown — the direct-post path has no per-platform formatter).
+ */
+export declare function linkConsentAsk(input: {
+    readonly initiatorAnchor: string;
+    readonly initiatorName?: string;
+    readonly targetAnchor: string;
+    readonly ttlMinutes: number;
+}): string;
+/**
+ * The two BUTTON labels a consent ask carries on a surface that can render them (OPE-622).
+ *
+ * 🔴 NO INTERPOLATION, EVER. A label is the shortest thing on the screen and the least likely to be
+ * read carefully, so it must never be able to carry a self-set profile string. The ask's TEXT names
+ * the initiator and attributes their name as a claim; the buttons only name the two answers.
+ *
+ * They deliberately do not say "yes"/"no": the reader is being asked about a STRANGER's request, and
+ * a label that names the ACT ("this account is mine") is what makes an accidental tap unlikely.
+ */
+export declare function linkConsentButtonLabels(): {
+    readonly confirm: string;
+    readonly deny: string;
+};
+/**
+ * What the person who TAPPED sees, privately, on each outcome (OPE-622). Core-owned; the surface
+ * shows it to the clicker alone.
+ *
+ * 🔴 `notYours` ANSWERS TWO CASES WITH ONE SENTENCE — "this request is not yours" and "this request
+ * is gone" — and identity/link-consent.ts states why: a distinguishable answer would turn the button
+ * into an oracle that tells a stranger holding a challenge id whether it names somebody real.
+ */
+export declare function linkConsentClickAnswers(): {
+    readonly consented: string;
+    readonly consentedWithCode: (code: string) => string;
+    readonly denied: string;
+    readonly notYours: string;
+    readonly gone: string;
+};
+/** What the TARGET is told once their consent is recorded and a code-back was minted. The code is
+ *  the one interpolation and this module never stores it. */
+export declare function codeBackInstructions(code: string): string;
+/** What a CLAIMANT is told on the code transport once their `link <code>` lands and a code-back was
+ *  minted. Same act as {@link codeBackInstructions}, different door, so the copy names the door. */
+export declare function claimCodeBackReply(code: string): string;
+//# sourceMappingURL=link-flow.d.ts.map

package/dist/agent/identity/link-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-flow.d.ts","sourceRoot":"","sources":["../../../agent/identity/link-flow.ts"],"names":[],"mappings":"AAKA,8DAA8D;AAC9D,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,MAAM,CAAC;AAEjD;;kDAEkD;AAClD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,CAEtE;AAED,wRAAwR;AACxR,MAAM,MAAM,gBAAgB,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,eAAe,CAAA;CAAE,CAAC;AAErI,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GAAG,gBAAgB,CAI3J;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7I;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,oFAAoF;IACpF,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B,GAAG,eAAe,CAoClB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe,CAgB7I;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CAO/H;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CAOjG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CAOjK;AAED;;4FAE4F;AAC5F,wBAAgB,8BAA8B,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAQ7F;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GAAG,MAAM,CAgBT;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,IAAI;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAE7F;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,IAAI;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAgBA;AAED;6DAC6D;AAC7D,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMzD;AAED;oGACoG;AACpG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMvD"}

package/dist/agent/identity/link-flow.js

@@ -0,0 +1,327 @@
+// The pure decision core of account linking: the initiator asks, the target consents in their own conversation, then the initiator finalizes. Whether a finalize needs a code-back is read off the challenge row, never off the setting at finalize time.
+// The two transports differ only in how act 2 identifies the target. The CODE transport forces a code-back because code-1 is a bearer token and the initiator's ratification arrives exactly when they expect one, so an intercepted code plus a reflexive yes would link an attacker's account; code-2 removes that reflex by making the initiator read the consent on the other account's own surface. The DIRECTORY transport addresses both ends itself, so its code-back is an off-by-default knob.
+import { hashLinkCode } from "./link-challenge.js";
+/** Every transport this deployment implements — the runtime guard for a value read back off a row
+ *  (a store is a string column; a row written by a later version must not silently read as
+ *  "directory" and skip the forced code-back). */
+export function asLinkTransport(raw) {
+    return raw === "directory" ? "directory" : "code";
+}
+export function codeBackDecision(input) {
+    const required = input.transport === "code" || input.knobArmed;
+    if (!required)
+        return { mint: false, reason: "not-required" };
+    return input.deliverable ? { mint: true } : { mint: false, reason: "undeliverable" };
+}
+/**
+ * THE FINALIZE GATE — the one decision standing between a recorded consent and a written link.
+ *
+ * Three properties, and what each one is actually worth:
+ *
+ *  1. THE PEEK (OPE-618). A call that carries neither `acknowledge` nor `code` PEEKS: the caller gets
+ *     the consenting account named back and nothing is written. A call that DOES carry one must also
+ *     name the challenge it acts on (`challengeId`), and the refusal deliberately does not echo an id.
+ *     ⚠️ THIS IS NOT A BARRIER AGAINST A DISOBEDIENT MODEL, and must not be described as one:
+ *     `link_identity` returns the `challengeId` at act 1, so a model that kept it can pass
+ *     `acknowledge: true` on its first `confirm_link` call and commit an account it never showed
+ *     anybody — wherever no code-back digest is on the row. What the peek buys is stated once, in
+ *     tools/confirm_link.ts's own header: it repairs BLINDNESS, so the sentence the model puts in
+ *     front of the person names a real account off the row instead of a question. Property 2 is the
+ *     only one here that a model cannot answer out of its own context.
+ *  2. FORCED CODE-BACK. When the row carries a `backNonceHash`, `acknowledge: true` alone is REFUSED.
+ *     The only thing that commits is the code itself, compared by hash — a knowledge proof cannot be
+ *     answered by a reflex, and cannot be answered from context either.
+ *  3. NO CODE WHERE NONE WAS ISSUED. A `code` on a row with no `backNonceHash` is refused rather than
+ *     ignored. Ignoring it would let a person believe a second factor was checked when nothing was.
+ *
+ * PURE: the hash comparison is `hashLinkCode` over the supplied text, so the raw code-2 never has to
+ * be at rest for this to be decidable.
+ *
+ * 🔴 A BLANK `code` IS NO CODE, AND THAT IS A PEEK, NOT A REFUSAL. An empty or whitespace-only string
+ * normalises to absent, so a caller that fills every optional field with a placeholder lands on the
+ * peek rather than on a sentence telling it what went wrong. That is the RIGHT verdict — a peek
+ * writes nothing and is repeatable — but it means the PEEK'S OWN ANSWER is the only thing that can
+ * get such a caller moving again. On deploy #212 it could not: the answer said to go and ask the
+ * person for a code the person had already given, and the link was never written (OPE-1858). The
+ * answer now tells the caller to finish in the same turn; tools/confirm_link.ts owns that text.
+ */
+export function finalizeGate(input) {
+    const code = typeof input.code === "string" && input.code.trim().length > 0 ? input.code.trim() : undefined;
+    const acknowledged = input.acknowledge === true;
+    if (!acknowledged && code === undefined)
+        return { kind: "peek" };
+    if (input.challengeId === undefined) {
+        return {
+            kind: "refuse",
+            reason: "a finalizing confirm must pass back the challengeId of the consent it acts on — call confirm_link with neither `acknowledge` nor `code` first: it names the waiting account and returns the challengeId.",
+        };
+    }
+    if (input.backNonceHash !== undefined) {
+        if (code === undefined) {
+            // 🔴 THE SAME "FINISH IT NOW" SENTENCE THE PEEK CARRIES (OPE-1858), and this branch needs it
+            // MORE, not less: `confirm_link`'s own description prescribes `acknowledge: true` + challengeId
+            // as the second call, so a caller that follows the description on a code-back row lands exactly
+            // here. Telling it only to "ask the person for that code" sends a caller that is already
+            // holding the code away for a second copy — the deploy #212 outcome, one branch over.
+            return {
+                kind: "refuse",
+                reason: "this link needs the code I posted back to the other account — `acknowledge` alone does not finalize it. " +
+                    "If you ALREADY have that code, call again NOW with it and this challengeId: both calls belong in one turn, " +
+                    "and the person often gives you the code in the very message you are answering. Ask them to read it off the " +
+                    "other account only when you do not have it.",
+            };
+        }
+        if (hashLinkCode(code) !== input.backNonceHash) {
+            return { kind: "refuse", reason: "that code does not match the one I posted to the other account. Ask for it again — it is single-use and expires with the request." };
+        }
+        return { kind: "commit" };
+    }
+    if (code !== undefined) {
+        return { kind: "refuse", reason: "no second code was issued for this request — finalize it with `acknowledge: true` once the person has confirmed the account is theirs." };
+    }
+    return { kind: "commit" };
+}
+/**
+ * THE CONSENT GATE — act 2's twin of {@link finalizeGate}, for the account being ASKED.
+ *
+ * The same no-blind-answer property, aimed the other way: a consent call that carries no
+ * `acknowledge` PEEKS and is answered with the INITIATOR named, and a call that does acknowledge must
+ * name the request it answers. The person on this side is being asked about a STRANGER — that is the
+ * whole security value of the reverse flow (an unexpected DM naming someone you do not know is an
+ * easy human judgement), and it is worth nothing if the model can say yes before the name is in front
+ * of it.
+ *
+ * Separate from `finalizeGate` rather than a call into it with an absent hash, because the two steps
+ * refuse for different reasons and a person reads the sentence: this side has no code to be missing,
+ * and telling them one is would be wrong.
+ */
+export function consentGate(input) {
+    // A code on THIS side is refused rather than ignored, for the same reason `finalizeGate` refuses
+    // one where none was issued: the code-back travels initiator-ward, and silently dropping one here
+    // would let a person believe a factor was checked when nothing was.
+    if (typeof input.code === "string" && input.code.trim().length > 0) {
+        return { kind: "refuse", reason: "there is no code to give me here — a second code, if this link needs one, goes to the person who asked. Confirm with `acknowledge: true` and the challengeId." };
+    }
+    if (input.acknowledge !== true)
+        return { kind: "peek" };
+    if (input.challengeId === undefined) {
+        return {
+            kind: "refuse",
+            reason: "a consent must pass back the challengeId of the request it answers — call confirm_link without `acknowledge` first: it names the person who asked and returns the challengeId.",
+        };
+    }
+    return { kind: "commit" };
+}
+/**
+ * The claim VENUE rule (Tommy, 2026-08-16): on a platform this deployment can DM, a `link <code>`
+ * claim is DM-ONLY, and a claim addressed to the agent in a channel or a group DM is REFUSED with a
+ * pointer to the DM.
+ *
+ * WHY. Code-1 is a bearer token for the length of its TTL. Posting it in a room publishes it to
+ * everybody in that room, and the reverse-initiated design exists precisely to stop a bearer secret
+ * from ever being public. Where the agent can be DM'd, no code ever needs to leave a 1:1
+ * conversation — so it must not.
+ *
+ * SCOPED TO DM-CAPABLE PLATFORMS, and that scoping is the whole design. On every platform with NO DM
+ * arm (channels/post-arms.ts `deliverDirectMessage`) a room is the only place a claim can be made at
+ * all, so refusing there would delete the cross-platform claim the code transport exists for.
+ *
+ * 🔴 STATE THE PROPERTY, NEVER A PLATFORM LIST. `dmCapable` comes from the arm registry on every
+ * call, so a platform that gains an arm starts refusing room claims the same day, with no edit here,
+ * and a platform that has none keeps its room claim. A list written into this comment would be stale
+ * the moment a bundle ships an arm, and would teach the next reader the opposite of what the code
+ * does — it already did once, when it named Slack as the only DM-capable surface and OPE-623 added a
+ * second.
+ *
+ * A GROUP DM (`mpim`) is refused with the channel copy: it has an audience, which is the property
+ * that matters, and `link_identity` refuses to START there for the same reason.
+ *
+ * Returns the refusal a person reads, or `undefined` when the venue is fine.
+ */
+export function claimVenueRefusal(input) {
+    if (!input.dmCapable)
+        return undefined;
+    if (input.mode === "dm")
+        return undefined;
+    return ("I can't take a link code here — a code is a secret for as long as it lasts, and this conversation has " +
+        "an audience. DM me and send it there instead. The code is still good; nothing was used up.");
+}
+/**
+ * The claim ADDRESSING rule (Tommy, 2026-09-13): a `link <code>` line only claims when the person
+ * ADDRESSED the agent. An unaddressed line sitting in a room claims nothing, and the code is not
+ * spent.
+ *
+ * WHY. A link binds one human to a second account, so the claim is the evidence that a person MEANT
+ * to bind it. An ambient line in a busy room is not that: the agent is watching the room anyway, so
+ * anyone who can type there could land a claim on whichever wake happened to carry their line. The
+ * minted instruction (identity/link-challenge.ts `linkClaimInstructions`) has always promised this
+ * — "a bare, unaddressed line will not count" — and the code now keeps the promise.
+ *
+ * 🔴 ADDRESSING IS THE SURFACE'S OWN, AND THE SURFACE DECIDES IT, NOT THIS MODULE. The caller passes
+ * the AUTHORITATIVE host-set verdict (identity/binding.ts `currentTurnAddressed`). Which sites stamp
+ * it, exactly:
+ *   • every DM divert, UNCONDITIONALLY — Slack, Discord and Teams stamp `oe_addressing` on each 1:1
+ *     delivery, with no capability gate;
+ *   • each provider's NATIVE comment leg, on its own mention verdict — Notion's name-drop
+ *     (notion-webhook.ts), GitHub's `isMention` (github.ts) and Linear's agent session (linear.ts);
+ *   • the single-window mention policy, where `window.topology` is armed AND the surface is
+ *     operator-vouched (channels/unified-window.ts `singleWindowMentionPolicy`).
+ * 🔴 THE NATIVE LEG IS THE ONE THAT MATTERS FOR THE SHIPPED DEFAULT: `window.topology` is
+ * `shipped: false`, so a stock deployment never reaches the single-window stamp. A surface whose
+ * native leg does not stamp has NO claim path at all — which is why adding a surface means adding its
+ * stamp, not a special case here.
+ *
+ * Notion is the reason the rule reads "the surface's own form" rather than "an @mention": Notion lets
+ * no user @mention an integration at all, so its classifier promotes a NAME-DROP to `direct`. A
+ * surface with no mentions and no DMs therefore keeps its claim path, and every surface is held to the
+ * same rule. There is exactly ONE addressing notion in this tree, and this is a reader of it — never a
+ * second one.
+ *
+ * Returns the refusal a person reads, or `undefined` when the wake was addressed.
+ */
+export function claimAddressingRefusal(input) {
+    if (input.addressed)
+        return undefined;
+    return ("I can't take a link code from a line that isn't addressed to me — anybody can type in here, so a " +
+        "bare line is not evidence you meant it for me. Send the same line again, addressed to me: " +
+        "@mention me, or name-drop me where I have no @mention. The code is still good; nothing was used up.");
+}
+/**
+ * ONE LIVE CODE PER PROOF-OF-CONTROL LOOP (Tommy, 2026-09-19): a turn that has just ANSWERED a link
+ * request refuses to start a fresh one.
+ *
+ * WHY. An answer is the middle of a loop, not the end of one. The account that answered still owes
+ * the initiator a step — the code-back, or a confirmation on the initiator's own side. A
+ * `link_identity` start in that same conversation mints a SECOND live code and tells the person to
+ * send it from their other account, so one DM then carries two codes and two contradictory
+ * instructions, and the person has no way to tell which one the agent is waiting on. Measured on the
+ * ship #223 board (2026-09-19, S-LINK-SLACK): the claimant's seat claimed at 15:52:02, started again
+ * at 15:52:04, and told the same account nine seconds later that "the link code hasn't been claimed
+ * yet".
+ *
+ * 🔴 TWO DOORS REACH THIS SENTENCE, AND THEY ARE DIFFERENT ACTS. The CODE transport's answer is a
+ * CLAIM (the person posted `link <code>`); the DIRECTORY transport's answer is a CONSENT (the person
+ * was asked and agreed). Both land in the same `claimed_*` triple — `consentLinkChallenge` writes it
+ * too, see the store contract — so `transport` is what keeps the copy honest. A consenter told "the
+ * one you just claimed" is being named for an act they never performed, and the whole product value
+ * of this line is that it names the person's real next step.
+ *
+ * NARROWING ONLY. It refuses a start; it grants nothing, widens no audience and changes no
+ * finalize rule. An expired answer is not an open one (identity/link-store.ts
+ * `openChallengeAnsweredBy` compares the TTL), so nobody is stranded: the loop the refusal points at
+ * is always one the person can still finish.
+ *
+ * `codeBack` is whether the answered row carries a code-back digest. When the code-back was
+ * undeliverable the finalize degrades to the acknowledged ratification ({@link codeBackDecision}),
+ * and the copy must not send the person looking for a code nobody posted.
+ *
+ * Returns the refusal a person reads, or `undefined` when no loop of theirs is open.
+ */
+export function linkStartOpenLoopRefusal(input) {
+    if (!input.openLoop)
+        return undefined;
+    const subject = input.transport === "directory" ? "the link you just agreed to is still open" : "the link you just claimed is still open";
+    const finish = input.codeBack
+        ? "it finishes when you give whoever started it the code I posted you in this conversation."
+        : "it finishes when whoever started it confirms it on their own side.";
+    return `I can't start another link here: ${subject}, and ${finish}`;
+}
+/** What the initiator is told after a DIRECTORY-transport request goes out. Core-owned TRUSTED text;
+ *  `targetName` is the resolved, SANITIZED account label (identity/account-display-name.ts) and is
+ *  the only interpolation. PLAIN TEXT — this reaches whichever surface the person is on. */
+export function linkConsentPendingInstructions(targetName, ttlMinutes) {
+    return (`I have asked ${targetName} to confirm, in their own DM with me, that the account is theirs. ` +
+        `Nothing is linked yet, and nothing will be until you finalize it here.\n\n` +
+        `The request expires in ${ttlMinutes} minutes. When they answer I will come back to you in this ` +
+        `conversation. If you did not expect to be asked about that account, do nothing — a request that ` +
+        `is never finalized writes nothing at all.`);
+}
+/**
+ * What the TARGET is asked, in their own DM, on the directory transport.
+ *
+ * 🔴 THIS IS AN UNSOLICITED MESSAGE TO A THIRD PARTY, AND ITS SHAPE IS A SECURITY DECISION. The
+ * recipient asked for nothing. Somebody else named their account, and the agent is about to put that
+ * stranger's chosen words in front of them. So the copy is built ANCHOR-FIRST:
+ *
+ *   • `initiatorAnchor` LEADS. It is composed from facts this deployment's own mapper captured — the
+ *     platform, the workspace and the account id — and is the one part of this message nobody can
+ *     choose. It is what the recipient should judge on.
+ *   • `initiatorName` is ATTRIBUTED, never asserted. It is the initiating account's own self-set
+ *     profile string, so the sentence says so in as many words: the agent reports what the account
+ *     CALLS ITSELF. Sanitizing (identity/account-display-name.ts) strips control characters and caps
+ *     the length, which stops a crafted name forging a second line — it does NOT remove a URL, a
+ *     brand name, or prose written to imitate the agent's own voice. Attribution is what makes those
+ *     harmless: a claim marked as a claim cannot borrow the agent's authority.
+ *   • The name is ABSENT entirely when none resolves. A placeholder would add nothing a reader can
+ *     check, and the anchor already names the account.
+ *
+ * The TARGET's own account is named by anchor too, never by profile name — the recipient knows who
+ * they are, and a second self-set string here would only be a second thing to spoof.
+ *
+ * PLAIN TEXT (no markdown — the direct-post path has no per-platform formatter).
+ */
+export function linkConsentAsk(input) {
+    const attributed = input.initiatorName
+        ? `\n\nThat account calls itself "${input.initiatorName}". That is a name the account sets for ` +
+            `itself, so read it as a claim rather than as something I checked — the account id above is the ` +
+            `part nobody can change.`
+        : "";
+    return (`Somebody asked me to link your account to theirs, and I need your say-so first.\n\n` +
+        `Who asked: ${input.initiatorAnchor}\n` +
+        `Your account: ${input.targetAnchor}${attributed}\n\n` +
+        `Linking means the two accounts count as ONE PERSON everywhere I can see, so their work and yours ` +
+        `are attributed together.\n\n` +
+        `If that account is yours, tell me here and I will record your consent. If you do not recognise it, ` +
+        `tell me to deny it. Nothing is written unless you agree, and the request expires on its own in ` +
+        `${input.ttlMinutes} minutes if you ignore it.`);
+}
+/**
+ * The two BUTTON labels a consent ask carries on a surface that can render them (OPE-622).
+ *
+ * 🔴 NO INTERPOLATION, EVER. A label is the shortest thing on the screen and the least likely to be
+ * read carefully, so it must never be able to carry a self-set profile string. The ask's TEXT names
+ * the initiator and attributes their name as a claim; the buttons only name the two answers.
+ *
+ * They deliberately do not say "yes"/"no": the reader is being asked about a STRANGER's request, and
+ * a label that names the ACT ("this account is mine") is what makes an accidental tap unlikely.
+ */
+export function linkConsentButtonLabels() {
+    return { confirm: "Yes — that account is mine", deny: "No — I don't recognise this" };
+}
+/**
+ * What the person who TAPPED sees, privately, on each outcome (OPE-622). Core-owned; the surface
+ * shows it to the clicker alone.
+ *
+ * 🔴 `notYours` ANSWERS TWO CASES WITH ONE SENTENCE — "this request is not yours" and "this request
+ * is gone" — and identity/link-consent.ts states why: a distinguishable answer would turn the button
+ * into an oracle that tells a stranger holding a challenge id whether it names somebody real.
+ */
+export function linkConsentClickAnswers() {
+    return {
+        consented: "Recorded — thank you. NOTHING IS LINKED YET: the person who asked still has to finish it on " +
+            "their side, and I have told them you agreed. If you did not mean to do that, tell me here and " +
+            "I will take it back.",
+        consentedWithCode: (code) => `Recorded — thank you. Nothing is linked yet. To finish, the person who asked has to prove they ` +
+            `can read this conversation, so give them this code and let them enter it where they started the ` +
+            `link:\n\n    ${code}\n\nIt is single-use and expires with the request.`,
+        denied: "Declined. Nothing was written and nothing was linked, and that request is now closed for good.",
+        notYours: "I have no open request for you to answer here. It was either already decided, or it has expired " +
+            "on its own. Nothing was written either way.",
+        gone: "That request is no longer open — it was already answered, or it expired. Nothing was written.",
+    };
+}
+/** What the TARGET is told once their consent is recorded and a code-back was minted. The code is
+ *  the one interpolation and this module never stores it. */
+export function codeBackInstructions(code) {
+    return (`Consent recorded. To finish, the person who asked has to prove they can read this conversation, ` +
+        `so give them this code and let them enter it where they started the link:\n\n    ${code}\n\n` +
+        `It is single-use and expires with the request. Nothing is linked until they enter it.`);
+}
+/** What a CLAIMANT is told on the code transport once their `link <code>` lands and a code-back was
+ *  minted. Same act as {@link codeBackInstructions}, different door, so the copy names the door. */
+export function claimCodeBackReply(code) {
+    return (`That is a good code — I have recorded that this account is claiming the link. One step left: ` +
+        `whoever started the link has to prove they can read this, so enter this code where they started it:\n\n    ${code}\n\n` +
+        `It is single-use and expires with the request. Nothing is linked until it is entered.`);
+}
+//# sourceMappingURL=link-flow.js.map

package/dist/agent/identity/link-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-flow.js","sourceRoot":"","sources":["../../../agent/identity/link-flow.ts"],"names":[],"mappings":"AAAA,0PAA0P;AAC1P,yeAAye;AAEze,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKnD;;kDAEkD;AAClD,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,OAAO,GAAG,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;AACpD,CAAC;AAKD,MAAM,UAAU,gBAAgB,CAAC,KAAwG;IACvI,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,KAAK,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC;IAC/D,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC9D,OAAO,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACvF,CAAC;AAQD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,YAAY,CAAC,KAM5B;IACC,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5G,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC;IAChD,IAAI,CAAC,YAAY,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACjE,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EACJ,0MAA0M;SAC7M,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,6FAA6F;YAC7F,gGAAgG;YAChG,gGAAgG;YAChG,yFAAyF;YACzF,sFAAsF;YACtF,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,MAAM,EACJ,0GAA0G;oBAC1G,6GAA6G;oBAC7G,6GAA6G;oBAC7G,6CAA6C;aAChD,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;YAC/C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,mIAAmI,EAAE,CAAC;QACzK,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,wIAAwI,EAAE,CAAC;IAC9K,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgG;IAC1H,iGAAiG;IACjG,kGAAkG;IAClG,oEAAoE;IACpE,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,+JAA+J,EAAE,CAAC;IACrM,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACxD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EACJ,gLAAgL;SACnL,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAyE;IACzG,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACvC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,CACL,wGAAwG;QACxG,4FAA4F,CAC7F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAsC;IAC3E,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,CACL,mGAAmG;QACnG,4FAA4F;QAC5F,qGAAqG,CACtG,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAoG;IAC3I,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,yCAAyC,CAAC;IAC1I,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ;QAC3B,CAAC,CAAC,0FAA0F;QAC5F,CAAC,CAAC,oEAAoE,CAAC;IACzE,OAAO,oCAAoC,OAAO,SAAS,MAAM,EAAE,CAAC;AACtE,CAAC;AAED;;4FAE4F;AAC5F,MAAM,UAAU,8BAA8B,CAAC,UAAkB,EAAE,UAAkB;IACnF,OAAO,CACL,gBAAgB,UAAU,oEAAoE;QAC9F,4EAA4E;QAC5E,0BAA0B,UAAU,6DAA6D;QACjG,kGAAkG;QAClG,2CAA2C,CAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,cAAc,CAAC,KAK9B;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa;QACpC,CAAC,CAAC,kCAAkC,KAAK,CAAC,aAAa,yCAAyC;YAC9F,iGAAiG;YACjG,yBAAyB;QAC3B,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,CACL,qFAAqF;QACrF,cAAc,KAAK,CAAC,eAAe,IAAI;QACvC,iBAAiB,KAAK,CAAC,YAAY,GAAG,UAAU,MAAM;QACtD,mGAAmG;QACnG,8BAA8B;QAC9B,qGAAqG;QACrG,iGAAiG;QACjG,GAAG,KAAK,CAAC,UAAU,4BAA4B,CAChD,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,EAAE,OAAO,EAAE,4BAA4B,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB;IAOrC,OAAO;QACL,SAAS,EACP,8FAA8F;YAC9F,gGAAgG;YAChG,sBAAsB;QACxB,iBAAiB,EAAE,CAAC,IAAY,EAAE,EAAE,CAClC,iGAAiG;YACjG,kGAAkG;YAClG,gBAAgB,IAAI,oDAAoD;QAC1E,MAAM,EAAE,gGAAgG;QACxG,QAAQ,EACN,kGAAkG;YAClG,6CAA6C;QAC/C,IAAI,EAAE,+FAA+F;KACtG,CAAC;AACJ,CAAC;AAED;6DAC6D;AAC7D,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,CACL,kGAAkG;QAClG,oFAAoF,IAAI,MAAM;QAC9F,uFAAuF,CACxF,CAAC;AACJ,CAAC;AAED;oGACoG;AACpG,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,CACL,+FAA+F;QAC/F,8GAA8G,IAAI,MAAM;QACxH,uFAAuF,CACxF,CAAC;AACJ,CAAC"}

package/dist/agent/identity/link-initiator.d.ts

@@ -0,0 +1,16 @@
+import type { Trust } from "./binding.js";
+/**
+ * The refusal a link-growing verb must throw, or `undefined` when the caller may proceed.
+ *
+ * A REFUSAL IS A VALUE here rather than a throw so the caller keeps its own error shape and the
+ * sentence is written once for both verbs. `act` completes "I can't ⟨act⟩ from here" — a short
+ * verb phrase ("start a link", "confirm a link"), never anything interpolated from content.
+ *
+ * The text is deliberately readable by the person who is refused: a guest DMing the agent should
+ * learn that membership is what is missing, not that something went wrong.
+ */
+export declare function linkInitiatorRefusal(binding: {
+    readonly platform: string;
+    readonly trust: Trust;
+}, act: string): string | undefined;
+//# sourceMappingURL=link-initiator.d.ts.map

package/dist/agent/identity/link-initiator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-initiator.d.ts","sourceRoot":"","sources":["../../../agent/identity/link-initiator.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAE1C;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUnI"}