@indexnetwork/protocol 21.0.0-rc.488.1 → 21.0.0-rc.490.1

package/dist/negotiations/negotiation.question-safety.js

@@ -36,6 +36,71 @@ export function isSafeNegotiationQuestionText(value, options) {
     }
     return true;
 }
+/**
+ * Instruction-shaped text that must never survive into a rendered question.
+ *
+ * Applies ONLY to `isSafeAuthoredNegotiationQuestion` — deliberately not added
+ * to `isSafeNegotiationQuestionText`, which guards a live path whose verdicts
+ * must not move. The exposure is specific to the authored question: the client
+ * reads these strings verbatim on a card, and whatever they select comes BACK
+ * into the negotiator's prompt as a user answer. An option labelled "ignore
+ * previous instructions" is therefore a round-trip injection with a human
+ * clicking the button.
+ *
+ * Two families. Override phrasings ("ignore the above", "you are now a…"), and
+ * forged structure: role headers and the `--- section ---` delimiter this
+ * codebase actually uses to fence prompt sections (see
+ * `renderNegotiatorClientDmSection`), which is what a forged block would have
+ * to imitate to be read as one.
+ */
+const PROMPT_INJECTION_PATTERN = /\b(?:ignore|disregard|forget|override|bypass)\b[^.!?\n]{0,40}\b(?:instructions?|prompts?|rules?|directives?|guidelines?|everything\s+above|the\s+above|all\s+of\s+the\s+above)\b|\byou\s+are\s+now\s+(?:an?|the)\b|\bnew\s+instructions?\s*:|^\s*(?:#{1,6}\s*|\*{2}\s*)?(?:system|assistant|developer|human)\s*:|<\|[^|>]{0,40}\|>|\[\/?(?:INST|SYS)\]|^\s*-{3,}[^\n]*-{3,}\s*$/im;
+/**
+ * Whole-question gate for a question the NEGOTIATOR authored.
+ *
+ * The pre-A2H `disclosureSubject` never reached the client as written — the
+ * server templated the copy around it. An authored `StructuredQuestion` is
+ * rendered verbatim, so every visible field needs the same gate the subject
+ * got, and it needs it with the identifiers in hand.
+ *
+ * That is the capability the api-side `isSafeNegotiationQuestionPayload` lacks
+ * and cannot gain: at the DB boundary it holds only generic patterns, so it
+ * cannot tell that a perfectly well-formed question is naming THIS counterparty
+ * or paraphrasing THIS seed assessment. The turn node has both, which is why
+ * this runs here and not there.
+ *
+ * Fail-closed and non-rewriting, like every guard in this file: a caller that
+ * gets `false` drops the question and keeps the enum-only path, rather than
+ * shipping a repaired one.
+ *
+ * @param options.forbiddenIdentifiers Names that must not appear as words —
+ *        the counterparty's, at the call site.
+ * @param options.forbiddenSourceText Private inputs that must not be echoed —
+ *        the seed assessment's reasoning, at the call site.
+ */
+export function isSafeAuthoredNegotiationQuestion(question, options) {
+    if (!question || typeof question !== 'object')
+        return false;
+    // Re-checked rather than trusted from the schema: this gate also runs on
+    // turns that arrive from an external agent, and a rendered card with one
+    // option (or fifteen) is a broken card regardless of how it validated.
+    const questionOptions = question.options;
+    if (!Array.isArray(questionOptions) || questionOptions.length < 2 || questionOptions.length > 4)
+        return false;
+    const fields = [
+        question.title,
+        question.prompt,
+        ...questionOptions.flatMap((option) => [option?.label, option?.description]),
+    ];
+    for (const field of fields) {
+        if (typeof field !== 'string')
+            return false;
+        if (!isSafeNegotiationQuestionText(field, options))
+            return false;
+        if (PROMPT_INJECTION_PATTERN.test(field))
+            return false;
+    }
+    return true;
+}
 /** Validate the only structured fields allowed to enter the inflight Questioner prompt. */
 export function validateInflightAskUserFields(input) {
     const disclosureSubject = input.disclosureSubject?.trim();

package/dist/negotiations/negotiation.scope.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The boundary between a negotiation and the conversation it runs in.
+ *
+ * Two agents share one DM permanently — `getOrCreateDM` keys on the agent pair
+ * alone — so that conversation accumulates every negotiation the pair has ever
+ * had. A negotiation is a bounded episode about ONE match inside it.
+ *
+ * Every question about a negotiation's own state (whose turn it is, whether it
+ * has opened, how many turns it has run) must be answered from the
+ * negotiation's messages. Conversation-wide reads remain valid for CONTEXT —
+ * what the pair discussed before — but must never decide state, or a fresh
+ * match inherits the turn parity of an unrelated concluded one.
+ *
+ * Every surface that resolves the floor shares this rule. If the graph and the
+ * respond/polling surfaces disagreed about a negotiation's scope, an external
+ * agent would be told it is not its turn forever.
+ */
+/** Minimal task-metadata shape needed to identify a negotiation. */
+export interface NegotiationScopeMetadata {
+    opportunityId?: unknown;
+}
+/**
+ * The opportunity a negotiation belongs to, or null when the task carries no
+ * opportunity. Keyed on opportunity rather than task because an `ask_user`
+ * pause resumes into a successor task: both tasks' turns are one negotiation.
+ */
+export declare function negotiationScopeKey(metadata: NegotiationScopeMetadata | null | undefined): string | null;
+/**
+ * Reads the messages that constitute one negotiation.
+ *
+ * A task with no opportunity has no identity separate from its conversation
+ * (direct and legacy invocations), so the conversation is its scope — there is
+ * no other match it could be confused with.
+ */
+export declare function readNegotiationMessages<M>(readers: {
+    byNegotiation: (opportunityId: string) => Promise<M[]>;
+    byConversation: (conversationId: string) => Promise<M[]>;
+}, scope: {
+    conversationId: string;
+    metadata: NegotiationScopeMetadata | null | undefined;
+}): Promise<M[]>;

package/dist/negotiations/negotiation.scope.js

@@ -0,0 +1,39 @@
+/**
+ * The boundary between a negotiation and the conversation it runs in.
+ *
+ * Two agents share one DM permanently — `getOrCreateDM` keys on the agent pair
+ * alone — so that conversation accumulates every negotiation the pair has ever
+ * had. A negotiation is a bounded episode about ONE match inside it.
+ *
+ * Every question about a negotiation's own state (whose turn it is, whether it
+ * has opened, how many turns it has run) must be answered from the
+ * negotiation's messages. Conversation-wide reads remain valid for CONTEXT —
+ * what the pair discussed before — but must never decide state, or a fresh
+ * match inherits the turn parity of an unrelated concluded one.
+ *
+ * Every surface that resolves the floor shares this rule. If the graph and the
+ * respond/polling surfaces disagreed about a negotiation's scope, an external
+ * agent would be told it is not its turn forever.
+ */
+/**
+ * The opportunity a negotiation belongs to, or null when the task carries no
+ * opportunity. Keyed on opportunity rather than task because an `ask_user`
+ * pause resumes into a successor task: both tasks' turns are one negotiation.
+ */
+export function negotiationScopeKey(metadata) {
+    const id = metadata?.opportunityId;
+    return typeof id === 'string' && id.length > 0 ? id : null;
+}
+/**
+ * Reads the messages that constitute one negotiation.
+ *
+ * A task with no opportunity has no identity separate from its conversation
+ * (direct and legacy invocations), so the conversation is its scope — there is
+ * no other match it could be confused with.
+ */
+export async function readNegotiationMessages(readers, scope) {
+    const opportunityId = negotiationScopeKey(scope.metadata);
+    return opportunityId
+        ? readers.byNegotiation(opportunityId)
+        : readers.byConversation(scope.conversationId);
+}

package/dist/negotiations/negotiation.screen.js

@@ -59,10 +59,14 @@ export class NegotiationScreener {
         };
         // IND-569: prefer the attributed rendering (labeled per-opportunity blocks)
         // when the graph supplies it; otherwise fall back to the flat prior-turn list.
-        const hasAttributed = input.isContinuation
-            && input.priorDialogueAttributed != null
+        //
+        // Deliberately NOT gated on `isContinuation`, which means "this negotiation
+        // has already spoken". The gate this section exists for is the opposite
+        // case — a FRESH signal against a counterparty the client has prior dialogue
+        // with (IND-563), which is precisely when duplicate outreach must be caught.
+        const hasAttributed = input.priorDialogueAttributed != null
             && !attributedDialogueIsEmpty(input.priorDialogueAttributed);
-        const flatPriorDialogue = input.isContinuation && input.priorDialogue && input.priorDialogue.length > 0
+        const flatPriorDialogue = input.priorDialogue && input.priorDialogue.length > 0
             ? input.priorDialogue
             : [];
         const priorDialogueBody = hasAttributed

package/dist/negotiations/negotiation.state.d.ts

@@ -40,10 +40,75 @@ export declare const NegotiationTurnSchema: z.ZodObject<{
     /** Present when action is `ask_user` (v2, P3.2). */
     askUser: z.ZodOptional<z.ZodNullable<z.ZodObject<{
         reason: z.ZodEnum<["unresolved_owner_constraint", "consequential_disclosure_permission", "repeated_non_convergence", "insufficient_commitment_authority"]>;
+        question: z.ZodEffects<z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            title: z.ZodString;
+            prompt: z.ZodString;
+            options: z.ZodArray<z.ZodObject<{
+                label: z.ZodString;
+                description: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                label: string;
+                description: string;
+            }, {
+                label: string;
+                description: string;
+            }>, "many">;
+            multiSelect: z.ZodBoolean;
+        }, "strip", z.ZodTypeAny, {
+            prompt: string;
+            options: {
+                label: string;
+                description: string;
+            }[];
+            title: string;
+            multiSelect: boolean;
+        }, {
+            prompt: string;
+            options: {
+                label: string;
+                description: string;
+            }[];
+            title: string;
+            multiSelect: boolean;
+        }>>>, {
+            prompt: string;
+            options: {
+                label: string;
+                description: string;
+            }[];
+            title: string;
+            multiSelect: boolean;
+        } | undefined, {
+            prompt: string;
+            options: {
+                label: string;
+                description: string;
+            }[];
+            title: string;
+            multiSelect: boolean;
+        } | null | undefined>;
     }, "strict", z.ZodTypeAny, {
         reason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority";
+        question?: {
+            prompt: string;
+            options: {
+                label: string;
+                description: string;
+            }[];
+            title: string;
+            multiSelect: boolean;
+        } | undefined;
     }, {
         reason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority";
+        question?: {
+            prompt: string;
+            options: {
+                label: string;
+                description: string;
+            }[];
+            title: string;
+            multiSelect: boolean;
+        } | null | undefined;
     }>>>;
 }, "strip", z.ZodTypeAny, {
     action: "propose" | "accept" | "reject" | "counter" | "question" | "outreach" | "withdraw" | "decline" | "ask_user";
@@ -57,6 +122,15 @@ export declare const NegotiationTurnSchema: z.ZodObject<{
     message?: string | null | undefined;
     askUser?: {
         reason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority";
+        question?: {
+            prompt: string;
+            options: {
+                label: string;
+                description: string;
+            }[];
+            title: string;
+            multiSelect: boolean;
+        } | undefined;
     } | null | undefined;
 }, {
     action: "propose" | "accept" | "reject" | "counter" | "question" | "outreach" | "withdraw" | "decline" | "ask_user";
@@ -70,6 +144,15 @@ export declare const NegotiationTurnSchema: z.ZodObject<{
     message?: string | null | undefined;
     askUser?: {
         reason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority";
+        question?: {
+            prompt: string;
+            options: {
+                label: string;
+                description: string;
+            }[];
+            title: string;
+            multiSelect: boolean;
+        } | null | undefined;
     } | null | undefined;
 }>;
 /** Restricted v1 turn schema for the system agent (no question action). */
@@ -414,6 +497,15 @@ export declare const NegotiationGraphState: import("@langchain/langgraph").Annot
         message?: string | null | undefined;
         askUser?: {
             reason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority";
+            question?: {
+                prompt: string;
+                options: {
+                    label: string;
+                    description: string;
+                }[];
+                title: string;
+                multiSelect: boolean;
+            } | undefined;
         } | null | undefined;
     } | null, {
         action: "propose" | "accept" | "reject" | "counter" | "question" | "outreach" | "withdraw" | "decline" | "ask_user";
@@ -427,6 +519,15 @@ export declare const NegotiationGraphState: import("@langchain/langgraph").Annot
         message?: string | null | undefined;
         askUser?: {
             reason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority";
+            question?: {
+                prompt: string;
+                options: {
+                    label: string;
+                    description: string;
+                }[];
+                title: string;
+                multiSelect: boolean;
+            } | undefined;
         } | null | undefined;
     } | import("@langchain/langgraph").OverwriteValue<{
         action: "propose" | "accept" | "reject" | "counter" | "question" | "outreach" | "withdraw" | "decline" | "ask_user";
@@ -440,6 +541,15 @@ export declare const NegotiationGraphState: import("@langchain/langgraph").Annot
         message?: string | null | undefined;
         askUser?: {
             reason: "unresolved_owner_constraint" | "consequential_disclosure_permission" | "repeated_non_convergence" | "insufficient_commitment_authority";
+            question?: {
+                prompt: string;
+                options: {
+                    label: string;
+                    description: string;
+                }[];
+                title: string;
+                multiSelect: boolean;
+            } | undefined;
         } | null | undefined;
     } | null> | null, unknown>;
     /**

package/dist/negotiations/negotiation.tools.js

@@ -9,6 +9,7 @@ import { readAuthorizedNegotiationDetail } from './negotiation.detail-reader.js'
 import { buildLifecycleNarration } from './negotiation.lifecycle-narration.js';
 import { isNegotiationTurnCapReached } from './negotiation.turn-cap.js';
 import { expectedNegotiationSpeaker } from './negotiation.expected-speaker.js';
+import { readNegotiationMessages } from './negotiation.scope.js';
 export { buildLifecycleNarration } from './negotiation.lifecycle-narration.js';
 const logger = protocolLogger('ChatTools:Negotiation');
 /**
@@ -150,8 +151,12 @@ export function createNegotiationTools(defineTool, deps) {
                     }
                     const isSource = meta.sourceUserId === context.userId;
                     const counterpartyId = isSource ? meta.candidateUserId : meta.sourceUserId;
-                    // Get messages for preview (and turns when narrative detail requested)
-                    const messages = await negotiationDatabase.getMessagesForConversation(task.conversationId);
+                    // This negotiation's own turns: the preview, turn count and floor all
+                    // describe THIS match, and the pair's DM also holds other matches.
+                    const messages = await readNegotiationMessages({
+                        byNegotiation: (id) => negotiationDatabase.getNegotiationMessages(id),
+                        byConversation: (id) => negotiationDatabase.getMessagesForConversation(id),
+                    }, { conversationId: task.conversationId, metadata: meta });
                     const lastMessage = messages[messages.length - 1];
                     const lastTurnData = lastMessage
                         ? lastMessage.parts?.find(p => p.kind === 'data')?.data
@@ -296,7 +301,10 @@ export function createNegotiationTools(defineTool, deps) {
                     metadata: meta,
                     callerUserId: context.userId,
                     callerRole: isSource ? 'source' : 'candidate',
-                    readMessages: (conversationId) => negotiationDatabase.getMessagesForConversation(conversationId),
+                    readMessages: (conversationId) => readNegotiationMessages({
+                        byNegotiation: (id) => negotiationDatabase.getNegotiationMessages(id),
+                        byConversation: (id) => negotiationDatabase.getMessagesForConversation(id),
+                    }, { conversationId, metadata: meta }),
                     readArtifacts: (taskId) => negotiationDatabase.getArtifactsForTask(taskId),
                     readLifecycleEvidence: (opportunityIds, ownerUserId) => readOpportunityLifecycles(negotiationDatabase, opportunityIds, ownerUserId),
                 });
@@ -386,7 +394,10 @@ export function createNegotiationTools(defineTool, deps) {
                 if (!allowedActionsFor(protocolVersion, seat).includes(query.action)) {
                     return error(seatViolationMessage(query.action, seat, protocolVersion));
                 }
-                const messages = await negotiationDatabase.getMessagesForConversation(task.conversationId);
+                const messages = await readNegotiationMessages({
+                    byNegotiation: (id) => negotiationDatabase.getNegotiationMessages(id),
+                    byConversation: (id) => negotiationDatabase.getMessagesForConversation(id),
+                }, { conversationId: task.conversationId, metadata: meta });
                 const turnCount = messages.length;
                 const expectedSpeaker = expectedNegotiationSpeaker(meta, messages);
                 if (expectedSpeaker !== context.userId) {

package/dist/opportunities/negotiation-context.loader.d.ts

@@ -24,7 +24,7 @@ import type { NegotiationOutcome, NegotiationTurn } from '../negotiations/negoti
  * Narrow slice of {@link NegotiationGraphDatabase} required by the loader. Kept
  * minimal so call sites can opt into a smaller surface.
  */
-export type NegotiationContextDatabase = Pick<NegotiationGraphDatabase, 'getNegotiationTaskForOpportunity' | 'getMessagesForConversation' | 'getArtifactsForTask'>;
+export type NegotiationContextDatabase = Pick<NegotiationGraphDatabase, 'getNegotiationTaskForOpportunity' | 'getNegotiationMessages' | 'getArtifactsForTask'>;
 /**
  * Snapshot of a negotiation surfaced to the presenter. `turns` and `outcome`
  * are only populated for post-negotiation statuses (pending/stalled/

package/dist/opportunities/negotiation-context.loader.js

@@ -42,7 +42,9 @@ export async function loadNegotiationContext(db, opportunityId, opportunityStatu
         return null;
     }
     const turnCap = readNumber(task.metadata, 'maxTurns') ?? 0;
-    const messages = await db.getMessagesForConversation(task.conversationId);
+    // Scoped to this opportunity: `turnCount`/`turns` describe THIS negotiation,
+    // and the pair's shared DM also holds concluded negotiations for other matches.
+    const messages = await db.getNegotiationMessages(opportunityId);
     const turns = extractTurns(messages);
     const turnCount = turns.length;
     if (opportunityStatus === 'negotiating') {

package/dist/questions/question.schema.d.ts

@@ -7,29 +7,21 @@
  */
 import { z } from "zod";
 import { UnderspecificationTypeSchema, type UnderspecificationType } from "../shared/schemas/underspecification.schema.js";
+import { QuestionOptionSchema, StructuredQuestionSchema, type QuestionOption } from "../shared/schemas/structured-question.schema.js";
 export { UnderspecificationTypeSchema };
-export declare const QuestionOptionSchema: z.ZodObject<{
-    /** Display text. Suffix " (Recommended)" on the safest path; list it first. */
-    label: z.ZodString;
-    /** Explains the consequence of choosing this option, not just its definition. */
-    description: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    label: string;
-    description: string;
-}, {
-    label: string;
-    description: string;
-}>;
+/**
+ * The renderer-facing quartet (title/prompt/options/multiSelect) lives in
+ * `shared/schemas/structured-question.schema.ts` so the negotiator can author a
+ * question without `shared/` importing this capability. Re-exported here so
+ * `questions/question.schema.js` stays the import site every caller already uses.
+ */
+export { QuestionOptionSchema, StructuredQuestionSchema };
+export type { StructuredQuestion } from "../shared/schemas/structured-question.schema.js";
 export declare const QuestionSchema: z.ZodObject<{
-    /** ≤12 chars. Noun of the decision domain — e.g. "Stage", "Timing", "Role". */
     title: z.ZodString;
-    /** ≤2 sentences, ≤400 chars. Ends in a question mark. */
     prompt: z.ZodString;
-    /** 2–4 options. No explicit "Other" — clients provide that automatically. */
     options: z.ZodArray<z.ZodObject<{
-        /** Display text. Suffix " (Recommended)" on the safest path; list it first. */
         label: z.ZodString;
-        /** Explains the consequence of choosing this option, not just its definition. */
         description: z.ZodString;
     }, "strip", z.ZodTypeAny, {
         label: string;
@@ -38,8 +30,8 @@ export declare const QuestionSchema: z.ZodObject<{
         label: string;
         description: string;
     }>, "many">;
-    /** True when options are not mutually exclusive (priorities, bundles). */
     multiSelect: z.ZodBoolean;
+} & {
     /**
      * Optional provenance line rendered as a muted chip above the prompt
      * (e.g. "based on 18 people matching this intent"). Aggregate counts only —
@@ -77,15 +69,10 @@ export declare const QuestionSchema: z.ZodObject<{
 }>;
 export declare const QuestionStrategySchema: z.ZodEnum<["refine_intent", "surface_missing_detail", "open_adjacent_thread", "reflective_summary", "surface_emergent_knowledge"]>;
 export declare const QuestionWithStrategySchema: z.ZodObject<{
-    /** ≤12 chars. Noun of the decision domain — e.g. "Stage", "Timing", "Role". */
     title: z.ZodString;
-    /** ≤2 sentences, ≤400 chars. Ends in a question mark. */
     prompt: z.ZodString;
-    /** 2–4 options. No explicit "Other" — clients provide that automatically. */
     options: z.ZodArray<z.ZodObject<{
-        /** Display text. Suffix " (Recommended)" on the safest path; list it first. */
         label: z.ZodString;
-        /** Explains the consequence of choosing this option, not just its definition. */
         description: z.ZodString;
     }, "strip", z.ZodTypeAny, {
         label: string;
@@ -94,8 +81,8 @@ export declare const QuestionWithStrategySchema: z.ZodObject<{
         label: string;
         description: string;
     }>, "many">;
-    /** True when options are not mutually exclusive (priorities, bundles). */
     multiSelect: z.ZodBoolean;
+} & {
     /**
      * Optional provenance line rendered as a muted chip above the prompt
      * (e.g. "based on 18 people matching this intent"). Aggregate counts only —
@@ -141,15 +128,10 @@ export declare const QuestionWithStrategySchema: z.ZodObject<{
 }>;
 export declare const QuestionGeneratorResponseSchema: z.ZodObject<{
     questions: z.ZodArray<z.ZodObject<{
-        /** ≤12 chars. Noun of the decision domain — e.g. "Stage", "Timing", "Role". */
         title: z.ZodString;
-        /** ≤2 sentences, ≤400 chars. Ends in a question mark. */
         prompt: z.ZodString;
-        /** 2–4 options. No explicit "Other" — clients provide that automatically. */
         options: z.ZodArray<z.ZodObject<{
-            /** Display text. Suffix " (Recommended)" on the safest path; list it first. */
             label: z.ZodString;
-            /** Explains the consequence of choosing this option, not just its definition. */
             description: z.ZodString;
         }, "strip", z.ZodTypeAny, {
             label: string;
@@ -158,8 +140,8 @@ export declare const QuestionGeneratorResponseSchema: z.ZodObject<{
             label: string;
             description: string;
         }>, "many">;
-        /** True when options are not mutually exclusive (priorities, bundles). */
         multiSelect: z.ZodBoolean;
+    } & {
         /**
          * Optional provenance line rendered as a muted chip above the prompt
          * (e.g. "based on 18 people matching this intent"). Aggregate counts only —
@@ -230,7 +212,7 @@ export declare const QuestionGeneratorResponseSchema: z.ZodObject<{
         evidence?: string | null | undefined;
     }[];
 }>;
-export type QuestionOption = z.infer<typeof QuestionOptionSchema>;
+export type { QuestionOption };
 export type Question = z.infer<typeof QuestionSchema>;
 export type { UnderspecificationType };
 export type QuestionStrategy = z.infer<typeof QuestionStrategySchema>;

package/dist/questions/question.schema.js

@@ -7,22 +7,16 @@
  */
 import { z } from "zod";
 import { UnderspecificationTypeSchema } from "../shared/schemas/underspecification.schema.js";
+import { QuestionOptionSchema, StructuredQuestionSchema } from "../shared/schemas/structured-question.schema.js";
 export { UnderspecificationTypeSchema };
-export const QuestionOptionSchema = z.object({
-    /** Display text. Suffix " (Recommended)" on the safest path; list it first. */
-    label: z.string().min(1).max(120),
-    /** Explains the consequence of choosing this option, not just its definition. */
-    description: z.string().min(1).max(280),
-});
-export const QuestionSchema = z.object({
-    /** ≤12 chars. Noun of the decision domain — e.g. "Stage", "Timing", "Role". */
-    title: z.string().min(1).max(12),
-    /** ≤2 sentences, ≤400 chars. Ends in a question mark. */
-    prompt: z.string().min(1).max(400),
-    /** 2–4 options. No explicit "Other" — clients provide that automatically. */
-    options: z.array(QuestionOptionSchema).min(2).max(4),
-    /** True when options are not mutually exclusive (priorities, bundles). */
-    multiSelect: z.boolean(),
+/**
+ * The renderer-facing quartet (title/prompt/options/multiSelect) lives in
+ * `shared/schemas/structured-question.schema.ts` so the negotiator can author a
+ * question without `shared/` importing this capability. Re-exported here so
+ * `questions/question.schema.js` stays the import site every caller already uses.
+ */
+export { QuestionOptionSchema, StructuredQuestionSchema };
+export const QuestionSchema = StructuredQuestionSchema.extend({
     /**
      * Optional provenance line rendered as a muted chip above the prompt
      * (e.g. "based on 18 people matching this intent"). Aggregate counts only —

package/dist/shared/interfaces/database.capabilities.d.ts

@@ -97,4 +97,4 @@ export type HydeGraphDatabase = Pick<Database, 'getHydeDocument' | 'getHydeDocum
  *
  * Access layer: UserDatabase (own opportunities and profile)
  */
-export type RadarGraphDatabase = Pick<Database, 'getOpportunitiesForUser' | 'getOpportunity' | 'getProfile' | 'getActiveIntents' | 'getNetwork' | 'getUser'> & Pick<NegotiationGraphDatabase, 'getNegotiationTaskForOpportunity' | 'getMessagesForConversation' | 'getArtifactsForTask'>;
+export type RadarGraphDatabase = Pick<Database, 'getOpportunitiesForUser' | 'getOpportunity' | 'getProfile' | 'getActiveIntents' | 'getNetwork' | 'getUser'> & Pick<NegotiationGraphDatabase, 'getNegotiationTaskForOpportunity' | 'getNegotiationMessages' | 'getArtifactsForTask'>;

package/dist/shared/interfaces/database.negotiation.d.ts

@@ -274,6 +274,30 @@ export type NegotiationGraphDatabase = Pick<Database, 'getOrCreateDM' | 'getUser
         createdAt: Date;
         taskId?: string | null;
     }>>;
+    /**
+     * Gets the messages belonging to ONE negotiation — those written by tasks
+     * carrying `type: 'negotiation'` and the given `opportunityId` — ordered by
+     * creation time.
+     *
+     * A negotiation is keyed by opportunity, not by task: an `ask_user` pause
+     * parks its task and resumes into a pre-claimed successor, so one negotiation
+     * spans several tasks. This is the read behind every question ABOUT a
+     * negotiation (whose turn it is, whether it has opened, how many turns it has
+     * run). `getMessagesForConversation` remains the read for conversation-wide
+     * CONTEXT — prior matches between the same pair — which must never determine
+     * a negotiation's own state.
+     *
+     * Messages with no `taskId`, or whose task carries no opportunityId, are not
+     * part of any negotiation and are never returned here.
+     */
+    getNegotiationMessages(opportunityId: string): Promise<Array<{
+        id: string;
+        senderId: string;
+        role: 'user' | 'agent';
+        parts: unknown[];
+        createdAt: Date;
+        taskId?: string | null;
+    }>>;
     /** Gets artifacts for a task (e.g. negotiation outcome). */
     getArtifactsForTask(taskId: string): Promise<Array<{
         id: string;