@agenticprimitives/fabric 0.0.0-alpha.4 → 0.0.0-alpha.41

package/dist/cloudflare/vault-interaction-store.js

@@ -0,0 +1,259 @@
+// The VAULT-BACKED `InteractionStore` (spec 316 §0b, ADR-0055 amendment, audit G-2).
+//
+// Same residency decision as the exchange store, for the same reason: **each party holds their own copy**.
+// An Interaction is a governed situation with participants, and each participant's vault holds their view
+// of it. No single system of record; no copy authoritative over another. A rebuild is therefore a
+// SINGLE-VAULT read — recovery never waits on a counterparty being reachable, willing, or still extant.
+//
+// SIX FAMILIES, ONE INDEX. Interactions, decisions, commitments, inbox entries, context snapshots and
+// protocol bindings each get their own vault resource; one `interaction.index` document carries the ids.
+// Six index documents would mean six writes to keep in step and six ways for them to drift.
+//
+// THE TWO INVARIANTS OF THE DO-LOCAL STORE ARE PRESERVED EXACTLY, because they are about immutability and
+// they do not become negotiable when the backing store changes:
+//
+//   1. A ContextSnapshot is CONTENT-ADDRESSED and the digest is verified before storing. A forged snapshot
+//      is refused at the door rather than detected later. Re-putting a verified digest that is already
+//      present is a no-op — that is what content-addressing means.
+//   2. Every transition goes THROUGH its machine. This store never assigns a state, so "the creditor
+//      discharges, not the debtor" cannot be bypassed by writing the row. A rejected transition writes
+//      NOTHING: persisting it "for the audit trail" would make the machine advisory.
+//
+// It confers nothing. Persisting a commitment does not make it owed; persisting a decision authorizes
+// nothing (ADR-0041).
+import { verifyContextSnapshot } from '../interaction-record.js';
+import { applyInteractionTransition, applyDecisionTransition, applyCommitmentTransition, applyInboxTransition, } from '../interaction-machines.js';
+import { bindingKey, resolveInteractionByBinding, } from '../protocol-binding.js';
+import { guardPutOverTerminal } from './interaction-store.js';
+export const INTERACTION_INDEX_RESOURCE = 'interaction.index';
+export const interactionResource = (id) => `interaction:${String(id)}`;
+export const decisionResource = (id) => `interaction.decision:${id}`;
+export const commitmentResource = (id) => `interaction.commitment:${id}`;
+export const snapshotResource = (digest) => `interaction.snapshot:${digest}`;
+export const inboxEntryResource = (viewer, exchangeId) => `interaction.inbox:${viewer.toLowerCase()}:${exchangeId}`;
+/** States an obligation is still live in. `discharged`/`breached`/`void` are ended, differently. */
+const OPEN_COMMITMENT_STATES = new Set(['proposed', 'active', 'fulfilment-claimed']);
+const EMPTY = {
+    version: 1, interactions: [], decisions: [], commitments: [], snapshots: [], inboxEntries: [], bindings: {},
+};
+export function createVaultInteractionStore(vault, owner, cache) {
+    const readIndex = async () => {
+        const obj = await vault.read({ owner, resource: INTERACTION_INDEX_RESOURCE });
+        return { ...EMPTY, ...(obj?.data ?? {}) };
+    };
+    const writeIndex = async (mutate) => {
+        const next = mutate(await readIndex());
+        await vault.write({ owner, resource: INTERACTION_INDEX_RESOURCE, data: next, classification: 'internal' });
+    };
+    /** WRITE-THROUGH. The vault first — the durable fact — then the index, then the DO-local cache. A crash
+     *  after the first leaves a cache that can be re-derived; the reverse order leaves one that cannot. */
+    const save = async (resource, data, index) => {
+        await vault.write({ owner, resource, data, classification: 'internal' });
+        if (index)
+            await writeIndex(index);
+        cache?.put(resource, data);
+    };
+    const load = async (resource) => {
+        const hit = cache?.get(resource);
+        // A cache hit is the SAME answer the vault holds, not a second mechanism (ADR-0013).
+        if (hit)
+            return hit;
+        const obj = await vault.read({ owner, resource });
+        return obj?.data ?? null;
+    };
+    const addOnce = (list, id) => (list.includes(id) ? list : [...list, id]);
+    const store = {
+        // ── Interactions ────────────────────────────────────────────────────────────────────────────────
+        // A put never replaces an ENDED record (spec 445 §3.4, audit DATB-6) — here the write would land in
+        // the owner's vault, the record itself. The read-then-write is sound only inside the single-writer
+        // DO. `transition*` below still writes through these methods: a machine only ever advances a
+        // non-terminal record, so the guard never refuses a legitimate transition.
+        async putInteraction(record) {
+            const existing = await this.getInteraction(record.interactionId);
+            if (guardPutOverTerminal('interaction', String(record.interactionId), existing, record, (r) => r.lifecycleState) === 'skip')
+                return;
+            await save(interactionResource(record.interactionId), record, (i) => ({
+                ...i, interactions: addOnce(i.interactions, String(record.interactionId)),
+            }));
+        },
+        async getInteraction(id) {
+            return load(interactionResource(id));
+        },
+        async listInteractions() {
+            const idx = await readIndex();
+            const all = await Promise.all(idx.interactions.map((id) => this.getInteraction(id)));
+            return all.filter((r) => r !== null);
+        },
+        async transitionInteraction(id, event) {
+            const record = await this.getInteraction(id);
+            if (!record)
+                return null;
+            const result = applyInteractionTransition(lifecycleOf(record), event);
+            // Fail-closed: a rejection leaves the record exactly as it was.
+            if (result.ok) {
+                await this.putInteraction({
+                    ...record, lifecycleState: result.next.state, updatedAt: event.at, rev: record.rev + 1,
+                });
+            }
+            return result;
+        },
+        // ── Protocol bindings ───────────────────────────────────────────────────────────────────────────
+        async bindProtocolTo(id, binding) {
+            const key = bindingKey(binding.protocol, binding.field, binding.value);
+            await writeIndex((i) => ({
+                ...i,
+                // Appended, never de-duplicated across interactions: a correlator naming two interactions IS the
+                // ambiguity, and collapsing it here would answer an ambiguous question with a confident wrong one.
+                bindings: { ...i.bindings, [key]: [...(i.bindings[key] ?? []), String(id)] },
+            }));
+        },
+        async resolveByBinding(protocol, field, value) {
+            const idx = await readIndex();
+            const key = bindingKey(protocol, field, value);
+            // Reuses the in-memory resolver so every backing store agrees on what "ambiguous" means.
+            return resolveInteractionByBinding(new Map([[key, (idx.bindings[key] ?? [])]]), protocol, field, value);
+        },
+        // ── Context snapshots (content-addressed) ───────────────────────────────────────────────────────
+        async putContextSnapshot(snapshot) {
+            // Verified BEFORE storing. A snapshot whose digest does not match its bytes is not evidence, and
+            // storing it would make a later verification failure look like tampering rather than corruption.
+            if (!(await verifyContextSnapshot(snapshot)))
+                return { ok: false, reason: 'digest-mismatch' };
+            if (await load(snapshotResource(snapshot.digest))) {
+                // Digest verified and already present ⇒ the content is the same. Two parties observing one
+                // context legitimately store it twice; the stored bytes win.
+                return { ok: true, stored: 'identical' };
+            }
+            await save(snapshotResource(snapshot.digest), snapshot, (i) => ({
+                ...i, snapshots: addOnce(i.snapshots, snapshot.digest),
+            }));
+            return { ok: true, stored: 'new' };
+        },
+        async getContextSnapshot(digest) {
+            return load(snapshotResource(digest));
+        },
+        // ── Decisions ───────────────────────────────────────────────────────────────────────────────────
+        async putDecision(record) {
+            const existing = await this.getDecision(record.decisionId);
+            if (guardPutOverTerminal('decision', record.decisionId, existing, record, (r) => r.state) === 'skip')
+                return;
+            await save(decisionResource(record.decisionId), record, (i) => ({
+                ...i, decisions: addOnce(i.decisions, record.decisionId),
+            }));
+        },
+        async getDecision(id) {
+            return load(decisionResource(id));
+        },
+        async transitionDecision(id, event) {
+            const record = await this.getDecision(id);
+            if (!record)
+                return null;
+            const result = applyDecisionTransition(record, event);
+            if (result.ok)
+                await this.putDecision(result.next);
+            return result;
+        },
+        // ── Commitments ─────────────────────────────────────────────────────────────────────────────────
+        async putCommitment(record) {
+            const existing = await this.getCommitment(record.commitmentId);
+            if (guardPutOverTerminal('commitment', record.commitmentId, existing, record, (r) => r.state) === 'skip')
+                return;
+            await save(commitmentResource(record.commitmentId), record, (i) => ({
+                ...i, commitments: addOnce(i.commitments, record.commitmentId),
+            }));
+        },
+        async getCommitment(id) {
+            return load(commitmentResource(id));
+        },
+        async listOpenCommitments() {
+            const idx = await readIndex();
+            const all = await Promise.all(idx.commitments.map((id) => this.getCommitment(id)));
+            // Filtered on the RECORD's state, never on a state cached in the index. "What is still owed" is
+            // machine-owned, and an index that answered it from its own copy could report an obligation as open
+            // after the creditor discharged it — the exact confusion the six machines exist to prevent.
+            return all
+                .filter((r) => r !== null && OPEN_COMMITMENT_STATES.has(r.state))
+                .sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
+        },
+        async transitionCommitment(id, event) {
+            const record = await this.getCommitment(id);
+            if (!record)
+                return null;
+            const result = applyCommitmentTransition(record, event);
+            if (result.ok)
+                await this.putCommitment(result.next);
+            return result;
+        },
+        // ── Inbox entries ───────────────────────────────────────────────────────────────────────────────
+        async putInboxEntry(entry) {
+            const viewer = String(entry.viewer).toLowerCase();
+            await save(inboxEntryResource(viewer, entry.exchangeId), entry, (i) => ({
+                ...i,
+                inboxEntries: i.inboxEntries.some((e) => e.viewer === viewer && e.exchangeId === entry.exchangeId)
+                    ? i.inboxEntries
+                    : [...i.inboxEntries, { viewer, exchangeId: entry.exchangeId }],
+            }));
+        },
+        async getInboxEntry(viewer, exchangeId) {
+            return load(inboxEntryResource(String(viewer), exchangeId));
+        },
+        async transitionInbox(viewer, exchangeId, event) {
+            const entry = await this.getInboxEntry(viewer, exchangeId);
+            if (!entry)
+                return null;
+            const result = applyInboxTransition(entry, event);
+            if (result.ok)
+                await this.putInboxEntry(result.next);
+            return result;
+        },
+        // ── Rebuild ─────────────────────────────────────────────────────────────────────────────────────
+        async rebuild() {
+            cache?.clear();
+            const idx = await readIndex();
+            const missing = [];
+            const recovered = {
+                interactions: 0, decisions: 0, commitments: 0, snapshots: 0, inboxEntries: 0,
+            };
+            const pull = async (family, resource) => {
+                const obj = await vault.read({ owner, resource });
+                if (!obj?.data) {
+                    missing.push(resource);
+                    return;
+                }
+                cache?.put(resource, obj.data);
+                recovered[family] = (recovered[family] ?? 0) + 1;
+            };
+            for (const id of idx.interactions)
+                await pull('interactions', interactionResource(id));
+            for (const id of idx.decisions)
+                await pull('decisions', decisionResource(id));
+            for (const id of idx.commitments)
+                await pull('commitments', commitmentResource(id));
+            for (const d of idx.snapshots)
+                await pull('snapshots', snapshotResource(d));
+            for (const e of idx.inboxEntries)
+                await pull('inboxEntries', inboxEntryResource(e.viewer, e.exchangeId));
+            return { recovered, missing };
+        },
+    };
+    return store;
+}
+/**
+ * The lifecycle facet of a stored interaction, for the machine to operate on.
+ *
+ * `principal` and `participations` are NOT optional decoration. The interaction machine decides who may
+ * drive a transition from them, so a facet that omitted them would hand the machine an interaction with
+ * no participants and no custodian — every transition rejected, for a reason that reads like a state-model
+ * problem. (Which is how this was found: the first version dropped both and the legal-transition test
+ * failed while the rejection tests still "passed".)
+ */
+function lifecycleOf(record) {
+    return {
+        interactionId: record.interactionId,
+        state: record.lifecycleState,
+        principal: record.principal,
+        participations: record.participations,
+        updatedAt: record.updatedAt,
+    };
+}
+//# sourceMappingURL=vault-interaction-store.js.map

package/dist/cloudflare/vault-interaction-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-interaction-store.js","sourceRoot":"","sources":["../../src/cloudflare/vault-interaction-store.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,EAAE;AACF,2GAA2G;AAC3G,0GAA0G;AAC1G,kGAAkG;AAClG,wGAAwG;AACxG,EAAE;AACF,sGAAsG;AACtG,yGAAyG;AACzG,4FAA4F;AAC5F,EAAE;AACF,0GAA0G;AAC1G,gEAAgE;AAChE,EAAE;AACF,2GAA2G;AAC3G,uGAAuG;AACvG,mEAAmE;AACnE,qGAAqG;AACrG,uGAAuG;AACvG,qFAAqF;AACrF,EAAE;AACF,sGAAsG;AACtG,sBAAsB;AAKtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,GAKrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,UAAU,EACV,2BAA2B,GAE5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAyB,MAAM,wBAAwB,CAAC;AAErF,MAAM,CAAC,MAAM,0BAA0B,GAAG,mBAAmB,CAAC;AAE9D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,EAA0B,EAAU,EAAE,CAAC,eAAe,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;AACvG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,wBAAwB,EAAE,EAAE,CAAC;AACrF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,0BAA0B,EAAE,EAAE,CAAC;AACzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,wBAAwB,MAAM,EAAE,CAAC;AAC7F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAAE,UAAkB,EAAU,EAAE,CAC/E,qBAAqB,MAAM,CAAC,WAAW,EAAE,IAAI,UAAU,EAAE,CAAC;AAE5D,oGAAoG;AACpG,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAgBrF,MAAM,KAAK,GAAuB;IAChC,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE;CAC5G,CAAC;AAaF,MAAM,UAAU,2BAA2B,CACzC,KAAY,EACZ,KAAa,EACb,KAIC;IAED,MAAM,SAAS,GAAG,KAAK,IAAiC,EAAE;QACxD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAqB,EAAE,KAAK,EAAE,QAAQ,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAClG,OAAO,EAAE,GAAG,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5C,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,EAAE,MAAuD,EAAiB,EAAE;QAClG,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;QACvC,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,0BAA0B,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7G,CAAC,CAAC;IAEF;2GACuG;IACvG,MAAM,IAAI,GAAG,KAAK,EAAE,QAAgB,EAAE,IAAa,EAAE,KAAqD,EAAiB,EAAE;QAC3H,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;QACzE,IAAI,KAAK;YAAE,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QACnC,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,EAAK,QAAgB,EAAqB,EAAE;QAC5D,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,qFAAqF;QACrF,IAAI,GAAG;YAAE,OAAO,GAAQ,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrD,OAAO,GAAG,EAAE,IAAI,IAAI,IAAI,CAAC;IAC3B,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,IAAc,EAAE,EAAU,EAAY,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAErG,MAAM,KAAK,GAA0B;QACnC,mGAAmG;QACnG,oGAAoG;QACpG,mGAAmG;QACnG,6FAA6F;QAC7F,2EAA2E;QAC3E,KAAK,CAAC,cAAc,CAAC,MAAM;YACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACjE,IAAI,oBAAoB,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,MAAM;gBAAE,OAAO;YACpI,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACpE,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;aAC1E,CAAC,CAAC,CAAC;QACN,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,EAAE;YACrB,OAAO,IAAI,CAAsB,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,KAAK,CAAC,gBAAgB;YACpB,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACrF,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAA4B,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QACjE,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,EAAE,EAAE,KAAK;YACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,MAAM,GAAG,0BAA0B,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YACtE,gEAAgE;YAChE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,cAAc,CAAC;oBACxB,GAAG,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC;iBACvF,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,mGAAmG;QACnG,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE,OAAO;YAC9B,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvB,GAAG,CAAC;gBACJ,iGAAiG;gBACjG,mGAAmG;gBACnG,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE;aAC7E,CAAC,CAAC,CAAC;QACN,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK;YAC3C,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAC/C,yFAAyF;YACzF,OAAO,2BAA2B,CAChC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAoB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CACvF,CAAC;QACJ,CAAC;QAED,mGAAmG;QACnG,KAAK,CAAC,kBAAkB,CAAC,QAAQ;YAC/B,iGAAiG;YACjG,iGAAiG;YACjG,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;YAC9F,IAAI,MAAM,IAAI,CAAoB,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACrE,2FAA2F;gBAC3F,6DAA6D;gBAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YAC3C,CAAC;YACD,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9D,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC;aACvD,CAAC,CAAC,CAAC;YACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,MAAM;YAC7B,OAAO,IAAI,CAAoB,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,CAAC;QAED,mGAAmG;QACnG,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC3D,IAAI,oBAAoB,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,MAAM;gBAAE,OAAO;YAC7G,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9D,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;aACzD,CAAC,CAAC,CAAC;QACN,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAE;YAClB,OAAO,IAAI,CAAmB,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAK;YAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACtD,IAAI,MAAM,CAAC,EAAE;gBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,mGAAmG;QACnG,KAAK,CAAC,aAAa,CAAC,MAAM;YACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC/D,IAAI,oBAAoB,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,MAAM;gBAAE,OAAO;YACjH,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClE,GAAG,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC;aAC/D,CAAC,CAAC,CAAC;QACN,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE;YACpB,OAAO,IAAI,CAAqB,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,KAAK,CAAC,mBAAmB;YACvB,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACnF,gGAAgG;YAChG,oGAAoG;YACpG,4FAA4F;YAC5F,OAAO,GAAG;iBACP,MAAM,CAAC,CAAC,CAAC,EAA2B,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;iBACzF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,EAAE,EAAE,KAAK;YAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACxD,IAAI,MAAM,CAAC,EAAE;gBAAE,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,mGAAmG;QACnG,KAAK,CAAC,aAAa,CAAC,KAAK;YACvB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAClD,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtE,GAAG,CAAC;gBACJ,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;oBAChG,CAAC,CAAC,CAAC,CAAC,YAAY;oBAChB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;aAClE,CAAC,CAAC,CAAC;QACN,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU;YACpC,OAAO,IAAI,CAAe,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5E,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK;YAC7C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,EAAE;gBAAE,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,mGAAmG;QACnG,KAAK,CAAC,OAAO;YACX,KAAK,EAAE,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,SAAS,GAA2B;gBACxC,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;aAC7E,CAAC;YAEF,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAE,QAAgB,EAAiB,EAAE;gBACrE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAClD,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACnD,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC/B,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACnD,CAAC,CAAC;YAEF,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,YAAY;gBAAE,MAAM,IAAI,CAAC,cAAc,EAAE,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC;YACvF,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS;gBAAE,MAAM,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9E,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,WAAW;gBAAE,MAAM,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC;YACpF,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,SAAS;gBAAE,MAAM,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,YAAY;gBAAE,MAAM,IAAI,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAEzG,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QAChC,CAAC;KACF,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,MAA2B;IAC9C,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,KAAK,EAAE,MAAM,CAAC,cAAc;QAC5B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC"}

package/dist/communicative-act.d.ts

@@ -1,5 +1,5 @@
 import type { CanonicalAgentId } from '@agenticprimitives/types';
-import type { Hex32, MessageId, MessageKind } from './messaging/index.js';
+import type { Hex32, MessageId, MessageKind, MessageEnvelopeV1, AnyMessageEnvelope } from './messaging/index.js';
 import type { VaultRef } from '@agenticprimitives/vault';
 export type Performative = 'INFORM' | 'QUERY' | 'REQUEST' | 'PROPOSE' | 'COUNTER' | 'ACCEPT' | 'REJECT' | 'NOTIFY' | 'ACKNOWLEDGE' | 'ISSUE' | 'RETRACT' | 'SUBSCRIBE' | 'UNSUBSCRIBE';
 /** A by-reference pointer at a piece of semantic content an act expresses or carries — a Situation, a
@@ -38,6 +38,29 @@ export interface CommunicativeActV1 {
     /** The message this act responds to, if any. */
     inRespondsTo?: MessageId;
 }
+/**
+ * The performative of ANY envelope — the dual-read seam (spec 340 W9).
+ *
+ * V2 states it; V1 derives it. One mechanism per version, never a fallback chain: a V2 envelope is
+ * never re-derived from a kind it does not have, and a V1 envelope never invents a `performative`
+ * field (ADR-0013).
+ */
+export declare function performativeOf(envelope: AnyMessageEnvelope, act?: CommunicativeActV1): Performative;
+/**
+ * Is this an ORIGINAL message rather than a reply?
+ *
+ * THE READER THAT FOUND A LATENT BUG. The auto-reply gate was `kind !== 'plain'`, which excluded
+ * `response` — so the assistant never replied to a reply. Under V2 that exclusion evaporates, because
+ * `plain` and `response` BOTH map to `INFORM` and are indistinguishable by performative alone. A naive
+ * translation to `performative === 'INFORM'` would have made the assistant start answering replies,
+ * i.e. answering itself.
+ *
+ * The fix is not to keep the taxonomy. It is that `inReplyTo` — the causal edge — was always the thing
+ * that actually distinguished them, and the enum had been standing in for it. Expressing the rule as
+ * "an original message has no antecedent" is both correct under V1 and correct under V2, and it says
+ * what the rule means instead of naming a label that implied it.
+ */
+export declare function isOriginalMessage(envelope: Pick<MessageEnvelopeV1, 'inReplyTo'>): boolean;
 /**
  * The TOTAL `MessageKind` → `Performative` derivation for V1 envelopes (spec 324 §9). Exhaustive: every
  * `MessageKind` maps. A `response` refines to the act's performative when it is one of the response family

package/dist/communicative-act.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"communicative-act.d.ts","sourceRoot":"","sources":["../src/communicative-act.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEzD,MAAM,MAAM,YAAY,GACpB,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAC5E,QAAQ,GAAG,aAAa,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAC;AAEjF;iHACiH;AACjH,MAAM,WAAW,kBAAkB;IACjC,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,EAAE,EAAE,MAAM,CAAC;IACX,qFAAqF;IACrF,IAAI,CAAC,EAAE,KAAK,CAAC;CACd;AAED,gGAAgG;AAChG,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,QAAQ,CAAC;IACd,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,WAAW,CAAC;IACrB,YAAY,EAAE,YAAY,CAAC;IAC3B,6BAA6B;IAC7B,KAAK,EAAE,gBAAgB,CAAC;IACxB,mHAAmH;IACnH,SAAS,EAAE,gBAAgB,CAAC;IAC5B,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,qDAAqD;IACrD,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC3C,2FAA2F;IAC3F,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC3C,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,gDAAgD;IAChD,YAAY,CAAC,EAAE,SAAS,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,kBAAkB,GAAG,YAAY,CAmB7F"}
+{"version":3,"file":"communicative-act.d.ts","sourceRoot":"","sources":["../src/communicative-act.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAEjH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEzD,MAAM,MAAM,YAAY,GACpB,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAC5E,QAAQ,GAAG,aAAa,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAC;AAEjF;iHACiH;AACjH,MAAM,WAAW,kBAAkB;IACjC,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,EAAE,EAAE,MAAM,CAAC;IACX,qFAAqF;IACrF,IAAI,CAAC,EAAE,KAAK,CAAC;CACd;AAED,gGAAgG;AAChG,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,QAAQ,CAAC;IACd,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,WAAW,CAAC;IACrB,YAAY,EAAE,YAAY,CAAC;IAC3B,6BAA6B;IAC7B,KAAK,EAAE,gBAAgB,CAAC;IACxB,mHAAmH;IACnH,SAAS,EAAE,gBAAgB,CAAC;IAC5B,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,qDAAqD;IACrD,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC3C,2FAA2F;IAC3F,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC3C,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,gDAAgD;IAChD,YAAY,CAAC,EAAE,SAAS,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,kBAAkB,EAAE,GAAG,CAAC,EAAE,kBAAkB,GAAG,YAAY,CAEnG;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,GAAG,OAAO,CAEzF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,kBAAkB,GAAG,YAAY,CAmB7F"}

package/dist/communicative-act.js

@@ -8,6 +8,34 @@
 // V1 envelopes carry no native performative, so for legacy/communication envelopes the performative is DERIVED
 // from `MessageKind` via one TOTAL mapping (`performativeForKind`, golden-vectored). A future `ap.exchange.v2`
 // envelope carries `performative`/`actor`/`principal` natively.
+import { isEnvelopeV2 } from './messaging/index.js';
+/**
+ * The performative of ANY envelope — the dual-read seam (spec 340 W9).
+ *
+ * V2 states it; V1 derives it. One mechanism per version, never a fallback chain: a V2 envelope is
+ * never re-derived from a kind it does not have, and a V1 envelope never invents a `performative`
+ * field (ADR-0013).
+ */
+export function performativeOf(envelope, act) {
+    return isEnvelopeV2(envelope) ? envelope.performative : performativeForKind(envelope.kind, act);
+}
+/**
+ * Is this an ORIGINAL message rather than a reply?
+ *
+ * THE READER THAT FOUND A LATENT BUG. The auto-reply gate was `kind !== 'plain'`, which excluded
+ * `response` — so the assistant never replied to a reply. Under V2 that exclusion evaporates, because
+ * `plain` and `response` BOTH map to `INFORM` and are indistinguishable by performative alone. A naive
+ * translation to `performative === 'INFORM'` would have made the assistant start answering replies,
+ * i.e. answering itself.
+ *
+ * The fix is not to keep the taxonomy. It is that `inReplyTo` — the causal edge — was always the thing
+ * that actually distinguished them, and the enum had been standing in for it. Expressing the rule as
+ * "an original message has no antecedent" is both correct under V1 and correct under V2, and it says
+ * what the rule means instead of naming a label that implied it.
+ */
+export function isOriginalMessage(envelope) {
+    return envelope.inReplyTo === undefined;
+}
 /**
  * The TOTAL `MessageKind` → `Performative` derivation for V1 envelopes (spec 324 §9). Exhaustive: every
  * `MessageKind` maps. A `response` refines to the act's performative when it is one of the response family

package/dist/communicative-act.js.map

@@ -1 +1 @@
-{"version":3,"file":"communicative-act.js","sourceRoot":"","sources":["../src/communicative-act.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,4GAA4G;AAC5G,8GAA8G;AAC9G,4GAA4G;AAC5G,8GAA8G;AAC9G,iEAAiE;AACjE,EAAE;AACF,+GAA+G;AAC/G,+GAA+G;AAC/G,gEAAgE;AAiDhE;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAiB,EAAE,GAAwB;IAC7E,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO,QAAQ,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,CAAC,GAAG,GAAG,EAAE,YAAY,CAAC;YAC5B,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9F,CAAC;QACD,KAAK,qBAAqB;YACxB,OAAO,OAAO,CAAC;QACjB,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC;QACvB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,WAAW;YACd,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC"}
+{"version":3,"file":"communicative-act.js","sourceRoot":"","sources":["../src/communicative-act.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,4GAA4G;AAC5G,8GAA8G;AAC9G,4GAA4G;AAC5G,8GAA8G;AAC9G,iEAAiE;AACjE,EAAE;AACF,+GAA+G;AAC/G,+GAA+G;AAC/G,gEAAgE;AAIhE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AA8CpD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,QAA4B,EAAE,GAAwB;IACnF,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAClG,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA8C;IAC9E,OAAO,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAiB,EAAE,GAAwB;IAC7E,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO,QAAQ,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,CAAC,GAAG,GAAG,EAAE,YAAY,CAAC;YAC5B,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9F,CAAC;QACD,KAAK,qBAAqB;YACxB,OAAO,OAAO,CAAC;QACjB,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC;QACvB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,WAAW;YACd,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/delivery-envelope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delivery-envelope.d.ts","sourceRoot":"","sources":["../src/delivery-envelope.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAE3F,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,yBAAyB,CAAC;IACnC,UAAU,EAAE,UAAU,GAAG,MAAM,CAAC;IAChC,+FAA+F;IAC/F,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,4GAA4G;IAC5G,WAAW,EAAE,gBAAgB,CAAC;IAC9B,SAAS,EAAE,gBAAgB,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,GAAG,kBAAkB,CAGpG;AAED,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE;IAAE,SAAS,EAAE,gBAAgB,CAAA;CAAE,GACpC,iBAAiB,CAQnB;AAED;oEACoE;AACpE,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACxC,gBAAgB,CAelB"}
+{"version":3,"file":"delivery-envelope.d.ts","sourceRoot":"","sources":["../src/delivery-envelope.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAE3F,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,yBAAyB,CAAC;IACnC,UAAU,EAAE,UAAU,GAAG,MAAM,CAAC;IAChC,+FAA+F;IAC/F,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,4GAA4G;IAC5G,WAAW,EAAE,gBAAgB,CAAC;IAC9B,SAAS,EAAE,gBAAgB,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,GAAG,kBAAkB,CAGpG;AAED,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE;IAAE,SAAS,EAAE,gBAAgB,CAAA;CAAE,GACpC,iBAAiB,CAQnB;AAED;oEACoE;AACpE,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACxC,gBAAgB,CAclB"}

package/dist/delivery-envelope.js

@@ -29,7 +29,6 @@ export function deliveryToExchangeRecord(delivery, opts) {
     return {
         version: 'ap.exchange.v1',
         exchangeId: delivery.exchangeId,
-        kind: e.kind,
         tier: opts.tier,
         principal: delivery.toGateway,
         parties: { from: e.from, to: e.to },

package/dist/delivery-envelope.js.map

@@ -1 +1 @@
-{"version":3,"file":"delivery-envelope.js","sourceRoot":"","sources":["../src/delivery-envelope.ts"],"names":[],"mappings":"AA0BA,MAAM,UAAU,qBAAqB,CAAC,KAA0C;IAC9E,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAC7G,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,GAAG,KAAK,EAAE,CAAC;AAC1D,CAAC;AAID;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,IAAqC;IAErC,IAAI,QAAQ,CAAC,OAAO,KAAK,yBAAyB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAChG,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC9F,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACnF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;oEACoE;AACpE,MAAM,UAAU,wBAAwB,CACtC,QAA4B,EAC5B,IAAyC;IAEzC,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC5B,OAAO;QACL,OAAO,EAAE,gBAAgB;QACzB,UAAU,EAAE,QAAQ,CAAC,UAAwB;QAC7C,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE;QACnC,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,EAAE;QACV,GAAG,EAAE,CAAC;QACN,SAAS,EAAE,IAAI,CAAC,EAAE;KACnB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"delivery-envelope.js","sourceRoot":"","sources":["../src/delivery-envelope.ts"],"names":[],"mappings":"AA0BA,MAAM,UAAU,qBAAqB,CAAC,KAA0C;IAC9E,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAC7G,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,GAAG,KAAK,EAAE,CAAC;AAC1D,CAAC;AAID;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,IAAqC;IAErC,IAAI,QAAQ,CAAC,OAAO,KAAK,yBAAyB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAChG,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC9F,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACnF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;oEACoE;AACpE,MAAM,UAAU,wBAAwB,CACtC,QAA4B,EAC5B,IAAyC;IAEzC,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC5B,OAAO;QACL,OAAO,EAAE,gBAAgB;QACzB,UAAU,EAAE,QAAQ,CAAC,UAAwB;QAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE;QACnC,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,CAAC,CAAC,CAAC;QACd,MAAM,EAAE,EAAE;QACV,GAAG,EAAE,CAAC;QACN,SAAS,EAAE,IAAI,CAAC,EAAE;KACnB,CAAC;AACJ,CAAC"}

package/dist/email/index.d.ts

@@ -0,0 +1,79 @@
+/** What a provider needs to send one message. Deliberately small — no attachments, no templates. */
+export interface OutboundEmailV1 {
+    to: string;
+    subject: string;
+    text: string;
+    /** Optional HTML alternative. Providers that cannot send it fall back to `text`. */
+    html?: string;
+    /** Set when this mail continues a conversation, so replies thread in the recipient's mail client. */
+    inReplyTo?: string;
+}
+export interface EmailSendResultV1 {
+    ok: boolean;
+    /** The provider's own id for the message, when it gives one — kept so a thread can cite it. */
+    messageId?: string;
+    error?: string;
+    /** Which provider actually sent it. Recorded, because "the email went" is a different fact per rail. */
+    via?: string;
+}
+/**
+ * THE PORT. One method, and the implementations are leaves.
+ *
+ * `available` is separate from `send` on purpose: a surface must be able to say "email is not set up
+ * here" BEFORE offering somebody an email invitation, rather than accepting the address and failing.
+ */
+export interface EmailSenderPort {
+    readonly name: string;
+    available(): boolean;
+    send(msg: OutboundEmailV1): Promise<EmailSendResultV1>;
+}
+/**
+ * TWO INTEGRATIONS, ONE PORT — the first that is available sends.
+ *
+ * Not a fallback chain (ADR-0013): the order is a DEPLOYMENT PREFERENCE stated once, and a provider that
+ * is configured but fails returns an error rather than handing the message to the next one. Sending the
+ * same mail twice because the first attempt's response was slow is worse than not sending it.
+ */
+export declare function firstAvailableSender(senders: readonly EmailSenderPort[]): EmailSenderPort | null;
+/** An inbound message, already parsed. The adapter does the MIME; this is what the inbox needs. */
+export interface InboundEmailV1 {
+    /** What the mail was sent TO — the only routable fact in it. */
+    to: string;
+    /** What it CLAIMS to be from. Unverified by construction; shown as a claim, never resolved as identity. */
+    from: string;
+    subject: string;
+    text: string;
+    /** Provider message id, for de-duplication and for citing the mail this message came from. */
+    messageId?: string;
+    /** Names only. An attachment is announced, never admitted (rule 4). */
+    attachments?: Array<{
+        name: string;
+        size?: number;
+        contentType?: string;
+    }>;
+}
+/** The handle an address routes to: `alice@faithnet.me` → `alice`. Empty when the zone is not ours. */
+export declare function handleFromAddress(address: string, zones: readonly string[]): string;
+/** Is this a well-formed address at all? Shape only — nothing here says a mailbox exists. */
+export declare function isEmailAddress(v: string): boolean;
+export declare const EMAIL_BODY_LIMIT = 16000;
+/**
+ * An inbound email as the message a thread will hold.
+ *
+ * WHAT IT KEEPS: the words, who it says it is from, what it was about, and what came with it BY NAME.
+ * WHAT IT REFUSES: anything past the cap (truncated, and it says so — a body silently cut in half is a
+ * message that misleads), and every attachment's content.
+ *
+ * The result is deliberately plain text: a thread that renders remote HTML from an unverified sender is
+ * a phishing surface with a nice font.
+ */
+export declare function inboundEmailToMessage(mail: InboundEmailV1): {
+    bodyText: string;
+    subject: string;
+    claimedFrom: string;
+};
+export declare const EMAIL_ADDRESS_LIMIT = 320;
+export declare const EMAIL_SUBJECT_LIMIT = 300;
+export declare const EMAIL_ATTACHMENT_NAME_LIMIT = 120;
+export declare const EMAIL_ATTACHMENT_NAMES_LIMIT = 20;
+//# sourceMappingURL=index.d.ts.map

package/dist/email/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/email/index.ts"],"names":[],"mappings":"AAwBA,oGAAoG;AACpG,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qGAAqG;IACrG,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,+FAA+F;IAC/F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wGAAwG;IACxG,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,SAAS,IAAI,OAAO,CAAC;IACrB,IAAI,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACxD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,GAAG,eAAe,GAAG,IAAI,CAEhG;AAED,mGAAmG;AACnG,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,EAAE,EAAE,MAAM,CAAC;IACX,2GAA2G;IAC3G,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5E;AAED,uGAAuG;AACvG,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAQnF;AAED,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,eAAO,MAAM,gBAAgB,QAAS,CAAC;AAEvC;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,cAAc,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAqBtH;AAED,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C,eAAO,MAAM,4BAA4B,KAAK,CAAC"}

package/dist/email/index.js

@@ -0,0 +1,91 @@
+// EMAIL AS A CHANNEL INTO THE INBOX — spec 365.
+//
+// A person's agent should be reachable by the address they already have, and an email they send or
+// receive should land in the SAME thread as everything else they say to that person. Two mailboxes for
+// one relationship is how half a conversation goes missing.
+//
+// FOUR RULES, and the whole design is these:
+//
+//   1. AN EMAIL IS NOT AUTHORITY (spec 309 §4.2). Inbound mail creates a MESSAGE and can never trigger
+//      an act. Nobody sends an email that moves money; the acts a person can take from a thread are the
+//      ones their own surface offers them, under their own mandate.
+//   2. THE SENDER IS AN UNVERIFIED CLAIM. `From:` is a header anyone can write, so routing is done by
+//      the address the mail was SENT TO (`<handle>@<zone>` → the naming service → an agent), never by
+//      who it says it is from. The claim travels with the message, labelled as a claim.
+//   3. PARSE IN MEMORY, STORE IN THE VAULT (spec 362 §6.2). The raw message is read into a message body
+//      the owner's vault holds and is never written to a serving-plane store — a mailbox is exactly the
+//      kind of durable private record ADR-0055 keeps out of DO storage.
+//   4. BOUNDED, ALWAYS. A body has a size cap and attachments are named, not admitted: an inbox that
+//      accepts whatever arrives is a way to fill somebody's vault from the outside.
+//
+// The SENDER PORT is here and the providers are not: a transport is a leaf binding that depends inward
+// (ADR-0057), and this package must not know whether the deployment sends through an HTTP API or a
+// platform binding.
+/**
+ * TWO INTEGRATIONS, ONE PORT — the first that is available sends.
+ *
+ * Not a fallback chain (ADR-0013): the order is a DEPLOYMENT PREFERENCE stated once, and a provider that
+ * is configured but fails returns an error rather than handing the message to the next one. Sending the
+ * same mail twice because the first attempt's response was slow is worse than not sending it.
+ */
+export function firstAvailableSender(senders) {
+    return senders.find((s) => s.available()) ?? null;
+}
+/** The handle an address routes to: `alice@faithnet.me` → `alice`. Empty when the zone is not ours. */
+export function handleFromAddress(address, zones) {
+    const at = address.trim().toLowerCase();
+    const m = /^([^@\s]+)@([^@\s]+)$/.exec(at);
+    if (!m)
+        return '';
+    const [, local = '', domain = ''] = m;
+    if (!zones.some((z) => domain === z.toLowerCase() || domain.endsWith(`.${z.toLowerCase()}`)))
+        return '';
+    // Plus-addressing is the person's own tag, not part of who they are: `alice+bills@` is alice.
+    return (local.split('+')[0] ?? '').trim();
+}
+/** Is this a well-formed address at all? Shape only — nothing here says a mailbox exists. */
+export function isEmailAddress(v) {
+    return /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(v.trim());
+}
+export const EMAIL_BODY_LIMIT = 16_000;
+/**
+ * An inbound email as the message a thread will hold.
+ *
+ * WHAT IT KEEPS: the words, who it says it is from, what it was about, and what came with it BY NAME.
+ * WHAT IT REFUSES: anything past the cap (truncated, and it says so — a body silently cut in half is a
+ * message that misleads), and every attachment's content.
+ *
+ * The result is deliberately plain text: a thread that renders remote HTML from an unverified sender is
+ * a phishing surface with a nice font.
+ */
+export function inboundEmailToMessage(mail) {
+    const body = (mail.text ?? '').trim();
+    const truncated = body.length > EMAIL_BODY_LIMIT;
+    const kept = truncated ? `${body.slice(0, EMAIL_BODY_LIMIT)}\n\n[…] this email was longer than ${EMAIL_BODY_LIMIT} characters and the rest was not kept.` : body;
+    // Header-derived strings are the sender's and go onto single lines the reader trusts — the trailer
+    // most of all (audit DATA-30). One line each, bounded; a line break in `from` would otherwise let
+    // the sender write text AFTER "not a verified agent".
+    const from = oneLine(mail.from, EMAIL_ADDRESS_LIMIT);
+    const files = (mail.attachments ?? []).map((a) => oneLine(a.name, EMAIL_ATTACHMENT_NAME_LIMIT)).filter(Boolean);
+    const named = files.slice(0, EMAIL_ATTACHMENT_NAMES_LIMIT);
+    const more = files.length - named.length;
+    const noted = files.length
+        ? `\n\n${files.length === 1 ? 'It came with a file' : `It came with ${files.length} files`}, which were not saved: ${named.join(', ')}${more > 0 ? `, and ${more} more` : ''}.`
+        : '';
+    return {
+        subject: oneLine(mail.subject, EMAIL_SUBJECT_LIMIT) || '(no subject)',
+        claimedFrom: from,
+        // WHO IT SAYS IT IS FROM, said as a claim. A person reading this must not be able to mistake an
+        // email address for a verified identity — that mistake is the whole of email fraud.
+        bodyText: `${kept}${noted}\n\n— sent by email from ${from} (an email address, not a verified agent)`,
+    };
+}
+export const EMAIL_ADDRESS_LIMIT = 320;
+export const EMAIL_SUBJECT_LIMIT = 300;
+export const EMAIL_ATTACHMENT_NAME_LIMIT = 120;
+export const EMAIL_ATTACHMENT_NAMES_LIMIT = 20;
+/** A header value as one bounded line: line breaks and control characters become spaces. */
+function oneLine(v, max) {
+    return String(v ?? '').replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029]+/g, ' ').replace(/\s+/g, ' ').trim().slice(0, max);
+}
+//# sourceMappingURL=index.js.map

package/dist/email/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/email/index.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,mGAAmG;AACnG,uGAAuG;AACvG,4DAA4D;AAC5D,EAAE;AACF,6CAA6C;AAC7C,EAAE;AACF,uGAAuG;AACvG,wGAAwG;AACxG,oEAAoE;AACpE,sGAAsG;AACtG,sGAAsG;AACtG,wFAAwF;AACxF,wGAAwG;AACxG,wGAAwG;AACxG,wEAAwE;AACxE,qGAAqG;AACrG,oFAAoF;AACpF,EAAE;AACF,uGAAuG;AACvG,mGAAmG;AACnG,oBAAoB;AAkCpB;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAmC;IACtE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,IAAI,IAAI,CAAC;AACpD,CAAC;AAgBD,uGAAuG;AACvG,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,KAAwB;IACzE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACxG,8FAA8F;IAC9F,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAoB;IACxD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC;IACjD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,sCAAsC,gBAAgB,wCAAwC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjK,mGAAmG;IACnG,kGAAkG;IAClG,sDAAsD;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM;QACxB,CAAC,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,gBAAgB,KAAK,CAAC,MAAM,QAAQ,2BAA2B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG;QAC/K,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,IAAI,cAAc;QACrE,WAAW,EAAE,IAAI;QACjB,gGAAgG;QAChG,oFAAoF;QACpF,QAAQ,EAAE,GAAG,IAAI,GAAG,KAAK,4BAA4B,IAAI,2CAA2C;KACrG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAC/C,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAE/C,4FAA4F;AAC5F,SAAS,OAAO,CAAC,CAAqB,EAAE,GAAW;IACjD,OAAO,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9H,CAAC"}

package/dist/enum-retirement.d.ts

@@ -0,0 +1,43 @@
+import type { MessageKind } from './messaging/index.js';
+import type { CaseState } from './exchange-state.js';
+import type { ProfileVersion } from './interaction-record.js';
+/**
+ * Every `MessageKind` (still the ENVELOPE's, see the header), mapped to the profile that replaces it.
+ *
+ * `Record<MessageKind, …>` rather than a lookup function: adding a `MessageKind` without deciding its
+ * profile then fails the build, which is the only way a "total" mapping stays total.
+ *
+ * Three of the seven collapse onto `direct`, and that is the finding rather than laziness. `plain`,
+ * `system` and `tombstone` were never different KINDS of interaction — they are a message, a message
+ * from the substrate, and a deletion marker. They differed in rendering, not in what was permitted,
+ * which is exactly the kind of distinction an interaction-type enum should not have been carrying.
+ */
+export declare const PROFILE_FOR_MESSAGE_KIND: Record<MessageKind, ProfileVersion>;
+/** Which of the six machines each `CaseState` actually belongs to. */
+export type OwningMachine = 'execution' | 'decision' | 'commitment';
+/**
+ * Every `CaseState`, mapped to the machine that owns it.
+ *
+ * THE POINT OF THIS TABLE: the eleven states were never one machine's. `denied` is a DECISION,
+ * `completed` is an EXECUTION outcome, and `revoked` is what happens to a COMMITMENT — three
+ * different questions with three different signers, answered by one field. That is why a case could
+ * be `denied` and a commitment still outstanding with nowhere to say so.
+ *
+ * `issued` and `approved` are the two that look ambiguous and are not: approving is a decision,
+ * issuing is work performed under it. Reading `approved` as execution progress is precisely the
+ * "deciding is not doing" collapse.
+ */
+export declare const MACHINE_FOR_CASE_STATE: Record<CaseState, OwningMachine>;
+/**
+ * How many distinct machines the single `CaseState` field stands in for.
+ *
+ * It was THREE, and that number was the whole argument for W10b-3. It is now ONE, and this function is
+ * kept — rather than deleted along with the states — precisely so that claim stays falsifiable: if
+ * anyone re-adds a decision-shaped or commitment-shaped member to `CaseState`, they must give it a home
+ * in the table above, and this count moves off 1 and the test fails.
+ *
+ * A cleanup is not finished when the code compiles; it is finished when re-introducing the thing you
+ * removed is caught automatically.
+ */
+export declare function machinesSpannedByCaseState(): number;
+//# sourceMappingURL=enum-retirement.d.ts.map

package/dist/enum-retirement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enum-retirement.d.ts","sourceRoot":"","sources":["../src/enum-retirement.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAG9D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,WAAW,EAAE,cAAc,CAcxE,CAAC;AAEF,sEAAsE;AACtE,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,UAAU,GAAG,YAAY,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,CASnE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAEnD"}