@indexnetwork/protocol 6.12.0-rc.403.1 → 6.13.22-rc.405.1

package/CHANGELOG.md

@@ -12,10 +12,251 @@ See [STABILITY.md](./STABILITY.md) for the public-contract and tier definitions.
 
 ## [Unreleased]
 
+## [6.13.22] — 2026-07-25
+
+### Added
+- Establish `contacts/` domain-first module spine (IND-549).
+  New directories: `contacts/domain/`, `contacts/application/`,
+  `contacts/ports/`, `contacts/public/`, plus `contacts/index.ts` barrel.
+  Canonical home for contact management (import, list, add, remove, search)
+  and the invite message generator, retaining participant reachability
+  semantics. Port types: `ContactServiceAdapter`, `ContactToolDeps`.
+- Establish `integrations/` domain-first module spine (IND-549).
+  New directories: `integrations/domain/`, `integrations/application/`,
+  `integrations/ports/`, `integrations/public/`, plus `integrations/index.ts`
+  barrel. Canonical home for host-integration configuration/actions
+  (OAuth session lifecycle, bulk contact import). Port types:
+  `IntegrationAdapter`, `IntegrationImporter`, `IntegrationToolDeps`.
+  `IntegrationImporter` is now a named interface (previously inline in
+  `shared/agent/tool.helpers.ts`).
+
+### Changed
+- `capabilities/contacts.facade.ts` now routes through `contacts/public/`
+  (IND-549).
+- `capabilities/integrations.facade.ts` now routes through
+  `integrations/public/` (IND-549).
+- Capability boundary script updated: `contacts/` and `integrations/`
+  directories now map to their respective capabilities (alongside legacy
+  `contact/` and `integration/`) (IND-549).
+
+### Deprecated
+- `contact/contact.tools.ts` is now a thin compatibility re-export shim
+  pointing to `contacts/application/` (IND-549).
+- `contact/contact.inviter.ts` is now a thin compatibility re-export shim
+  pointing to `contacts/application/` (IND-549).
+- `integration/integration.tools.ts` is now a thin compatibility re-export
+  shim pointing to `integrations/application/` (IND-549).
+- `shared/interfaces/contact.interface.ts` is now a thin compatibility shim
+  pointing to `contacts/domain/` and `contacts/ports/` (IND-549).
+- `shared/interfaces/integration.interface.ts` is now a thin compatibility
+  shim pointing to `integrations/domain/` and `integrations/ports/`
+  (IND-549).
+- `capabilities/contacts.tools.port.ts` is now a thin compatibility shim
+  pointing to `contacts/ports/` (IND-549).
+- `capabilities/integrations.tools.port.ts` is now a thin compatibility shim
+  pointing to `integrations/ports/` (IND-549).
+
+## [6.13.21] — 2026-07-25
+
+### Added
+- Establish `questions/` domain-first module spine (IND-547).
+  New directories: `questions/domain/`, `questions/application/`,
+  `questions/ports/`, `questions/public/`, plus `questions/index.ts` barrel.
+  Canonical home for question generation, eligibility, validation, provenance,
+  settlement policy, and continuation behaviour.
+- Establish `participant-agents/` domain-first module spine (IND-548).
+  New directories: `participant-agents/domain/`, `participant-agents/application/`,
+  `participant-agents/ports/`, `participant-agents/public/`, plus
+  `participant-agents/index.ts` barrel.  Canonical home for agent registration,
+  permission-aware behaviour, and dispatch contracts.
+
+### Changed
+- `capabilities/questions.facade.ts` now routes through `questions/public/` (IND-547).
+- `capabilities/participant-agents.facade.ts` agent-registry portion now
+  routes through `participant-agents/application/` and
+  `participant-agents/ports/` (IND-548).
+- Capability boundary script updated: `participant-agents/` directory now
+  maps to the `participant-agents` capability (alongside legacy `chat/`
+  and `agent/`) (IND-548).
+
+### Deprecated
+- `agent/agent.tools.ts` is now a thin compatibility re-export shim pointing
+  to `participant-agents/application/` (IND-548).
+- `shared/interfaces/agent.interface.ts` is now a thin compatibility re-export
+  shim pointing to `participant-agents/domain/` and `participant-agents/ports/`
+  (IND-548).
+- `capabilities/participant-agents.tools.port.ts` is now a thin compatibility
+  re-export shim pointing to `participant-agents/ports/` (IND-548).
+- `questioner/*` paths are now thin compatibility shims pointing to
+  `questions/application/` (IND-547).
+- `shared/schemas/question.schema.ts` is now a thin compatibility shim
+  pointing to `questions/domain/` (IND-547).
+- `shared/interfaces/questioner.interface.ts` and
+  `shared/interfaces/question-generator.interface.ts` are now thin
+  compatibility shims pointing to `questions/ports/` (IND-547).
+
+## [6.13.20] — 2026-07-25
+
+### Added
+- Establish `communities/` domain-first module spine (IND-546).
+  New directories: `communities/domain/`, `communities/application/`,
+  `communities/ports/`, `communities/public/`, plus `communities/tests/` for
+  policy characterization.
+- Characterization specs for membership authority (join-policy enforcement,
+  owner-only removal), privacy/scope intersection (scoped vs unscoped read,
+  `showAll` bypass), and signal assignment policy (direct / evaluated /
+  no-prompt fast path, membership re-check at persistence time, unassign
+  authority).
+
+### Changed
+- `capabilities/communities.facade.ts` now imports from
+  `communities/application/` instead of the old `network/` paths.
+- `capabilities/signals.indexing.facade.ts` updated to import
+  `IntentIndexer` from `capabilities/signals.facade.ts` (canonical) instead
+  of the legacy `intent/intent.indexer.ts` shim.
+- Communities capability boundary script updated: `communities/` directory now
+  maps to the `communities` capability (alongside legacy `network/`).
+
+### Deprecated
+- `network/network.graph.ts`, `network/network.state.ts`,
+  `network/network.tools.ts`, `network/network.recommender.ts`,
+  `network/membership/membership.{graph,state}.ts`, and
+  `network/indexer/indexer.{graph,state}.ts` are now thin compatibility
+  re-export shims pointing to their canonical `communities/` counterparts.
+
+## [6.13.19] — 2026-07-25
+
+### Added
+- Establish `participant-context/` domain-first module spine (IND-545).
+  New directories: `participant-context/domain/`, `participant-context/application/`,
+  `participant-context/ports/`, `participant-context/public/`, plus
+  `participant-context/index.ts` barrel.  The four existing implementation
+  directories (`premise/`, `context/`, `enrichment/`, `shared/hyde/`) remain in
+  place as the canonical code and are re-exported through the new spine — no
+  big-bang rewrite.  Characterizes premise provenance invariants
+  (`source: explicit | integration | generated`), validity/regeneration invariants
+  (`volatile` flag, auto-retraction semantics, regeneration boundary), and
+  foreground vs. ambient adapter ownership in block-comment documentation.
+
+### Changed
+- `capabilities/participant-context.facade.ts` is now a thin shim over the
+  canonical `participant-context/` module.  The facade also absorbs the three
+  HyDE exports (`HydeGraphFactory`, `HydeGenerator`, `LensInferrer`) that were
+  previously exported from root `index.ts` via direct `shared/hyde/` imports.
+  Root `index.ts` routes those three symbols through the facade (no change to
+  the public symbols or their shapes).
+- `scripts/architecture/capability-boundaries.ts` registers `participant-context/`
+  as the canonical capability directory (joining the existing `premise/`,
+  `context/`, and `enrichment/` mappings that already pointed to
+  `"participant-context"`).  Notes `shared/hyde/` as a cross-capability technology
+  binding (used by both participant-context for generation and opportunities for
+  search) — left unclassified so both can access it without a boundary fault.
+- `architecture/exports.snapshot.json` regenerated; 327 exports unchanged in
+  count and shape, three source paths updated to reflect the new facade routing.
+
+## [6.13.18] — 2026-07-24
+
+### Changed
+- Establish outer runtime and platform target shells (IND-543). Physically
+  relocate `createToolRegistry` to
+  `runtime/foreground/composition/tool.registry.ts` (interaction-composition
+  boundary); the old `shared/agent/tool.registry.ts` path becomes a
+  backward-compat re-export shim. Add declaration-only shells:
+  `runtime/foreground/index.ts`, `runtime/background/index.ts`,
+  `platform/index.ts` (curated cross-domain primitives), and `public/index.ts`
+  (future curated root assembly). Extend `capability-boundaries.ts` to classify
+  and enforce four new boundary types: `interaction-composition` (FG),
+  `ambient-background` (BG), `neutral-platform` (no capability imports allowed),
+  and `public-compatibility` (facades only); new paths are checked rather than
+  silently skipped. `mcp.server.ts` updated to import directly from the
+  canonical composition path. 14 new architecture-boundary fixture tests added.
+  No public root export or runtime behavior changes.
+
+### Changed
+- Restore a directed Protocol production module graph: tool-composition
+  contracts no longer own opportunity runtime types, discovery continuation
+  finalization owns a neutral result contract, and deadlock metadata is owned
+  independently of negotiation state. The architecture gate now rejects every
+  production cycle (IND-531). No public root export or runtime behavior changes.
+- Extract authorized negotiation-detail read/projection behind narrow message,
+  artifact, and lifecycle-evidence ports while retaining facade-owned lookup,
+  scope admission, participant privacy, and tool IO (IND-530 Batch 16).
+- Extract MCP discovery-result lifecycle reconciliation and deferred-result
+  narration behind a narrow read/warning/safe-card port while retaining tool
+  IO, link minting, and response assembly in the tools facade (IND-530 Batch 15).
+- Extract actionable opportunity-feed admission and digest candidate selection
+  behind narrow read/ledger/warning ports while retaining tool IO, presenters,
+  delivery writes, and response assembly in the tools facade (IND-530 Batch 14).
+- Extract continuation post-graph finalization into a narrow handler while
+  retaining cache lookup, scope admission, graph invocation, and the public
+  response boundary in discovery orchestration (IND-530 Batch 13).
+- Extract independently timed, failure-isolated discovery-negotiation summary
+  execution into a narrow handler while retaining discovery admission and outer
+  orchestration in the facade (IND-530 Batch 12).
+- Extract safe negotiation lifecycle-to-narration presentation translation while
+  retaining lifecycle reads, tool IO, response assembly, and a compatibility
+  re-export in the negotiation tools facade (IND-530 Batch 11).
+- Move enforce-mode negotiation screen admission into the existing screen
+  capability while retaining graph-owned routing, persistence, and lifecycle
+  effects (IND-530 Batch 10).
+- Extract state-aware negotiation conversation-lock admission, including the
+  full consultation answer-window hold, into a narrow lifecycle policy while
+  retaining graph-owned task reads and busy routing (IND-530 Batch 9).
+- Extract immutable negotiation task intent-snapshot provenance into a narrow
+  persistence handler while retaining LangGraph init-node task wiring and
+  lifecycle boundaries (IND-530 Batch 8).
+- Extract MCP discovery-run coalescing identity and admission into a narrow
+  capability-owned policy while retaining run-store reads, queueing, and tool
+  responses in the opportunity tools facade (IND-530 Batch 7).
+- Extract safe opportunity-card presentation translation for web/MCP, including
+  actionable-link ID suppression, digest markers, code-fence escaping, and
+  unsupported-claim/UUID sanitization, while preserving the tools-facade export
+  and IO contract (IND-530 Batch 6).
+- Extract `update_opportunity` actor, lifecycle, network, and selected-intent
+  admission behind a narrow persistence-read port while retaining tool schema,
+  uptake advisory, graph invocation, and telemetry wiring in the tools facade
+  (IND-530 Batch 5).
+- Extract final opportunity-persistence admission (authoritative scope,
+  participant-pair eligibility, and guarded reactivation anchors) behind a
+  narrow port while keeping dedup routing, writes, and graph observability in
+  the opportunity graph (IND-530 Batch 4).
+- Extract the existing-opportunity negotiation continuation admission,
+  exact-intent translation, and non-introducer notification handler behind a
+  narrow opportunity persistence port while retaining graph-owned node wiring
+  and observability (IND-530 Batch 3).
+- Extract the owned-intent newborn-opportunity stamping eligibility policy and
+  fail-open host callback handler from the opportunity persist node while
+  preserving graph-owned persistence and observability (IND-530 Batch 2).
+- Extract opportunity lifecycle admission rules and persistence handlers from
+  the graph while retaining its LangGraph node routing and externally visible
+  lifecycle semantics (IND-530).
+- Slice tool-factory dependencies into named capability-owned ports for
+  enrichment, signals, communities, opportunities, premises, contacts,
+  integrations, participant agents, negotiations, and questions. `ToolDeps`
+  and `ToolContext` remain structurally compatible composition intersections at
+  registry/runtime boundaries; ports are declared and exported through their
+  owning capability facades, while individual factories no longer receive the
+  all-capability aggregate (IND-529).
+- Publish Protocol tarballs without JavaScript or declaration source maps while
+  retaining map generation for the first-party Sentry upload build. Published
+  declarations remain available for downstream type checking and navigation
+  (IND-521).
+
 ### Fixed
+- Make the Questioner clarifying-questions schema survive strict structured-output conversion: the `Question.evidence` provenance field is now declared `.nullable().optional()` (was bare `.optional()`, which OpenAI/OpenRouter strict mode rejects), so every `QuestionerAgent` LLM call no longer failed client-side before any network I/O. A `.transform()` normalizes an LLM-returned `null` back to `undefined` so a null is never persisted or treated as "evidence present"; real string evidence chips (pool_discovery) flow through unchanged and the intent-recovery `!question.evidence` selection filter is unaffected (regression from the IND-418 pool_discovery work).
+- Log failed network-create rollback attempts with an allowlisted network correlation ID and rollback step while preserving the original create or owner-membership failure response (IND-519).
+- Move `dotenv` to development dependencies: test/preload environment loading remains available to contributors while published runtime consumers no longer receive it as a direct dependency (IND-518).
+- Stop emitting source-test helpers, test directories, and spec/test files in published protocol build artifacts while preserving source-test execution (IND-515).
 - Allow the private intent-refinement provenance snapshot to identify intent creation as a producer and make the shared refinement prompt independent of no-opportunity process state, enabling creation and authoritative discovery producers to converge on one ordinary intent-page question cadence.
 
 ### Added
+- Capability facades for Signals, Participant context, Communities,
+  Opportunities, Negotiation, Questions, Participant agents, Contacts, and
+  Integrations. Cross-capability callers now use named, narrow facade contracts;
+  the root barrel remains backward compatible and also adds the corresponding
+  explicit tool-factory entry points. Architecture tooling records every allowed
+  dependency direction and preserves the in-place directory layout for later
+  extraction work (IND-528).
 - Add the private `recovery` Questioner purpose and one-question intent recovery preset for post-discovery signal refinement (IND-506). The preset receives only the owned intent, global owner context, and an optional bounded aggregate count of fail-closed validated no-opportunity outcomes; it forbids candidate/counterparty/process narration, preserves the existing creation-time intent preset, persists publicly as ordinary `mode='intent'` questions with versioned internal recovery metadata, and carries optional material-fingerprint plus expected-owner guards through answer-only updates so the final database write can recheck lifecycle as well as content.
 - Add versioned internal negotiation-question provenance and explicit source/candidate opportunity-actor intent threading for ordinary follow-up, inflight consultation, and uptake questions (IND-507). Runtime mode/purpose discriminants, structured `askUser` safety validation, neutral uptake context, and visible-field output gates exclude raw counterparty profile/identity/intent, private transcript, evaluator reasoning, match reasons, event/community inference, evidence, and internal IDs. Exact settlement/task correlation now threads through run-existing continuation admission without changing producer triggers or the ≤2 ordinary/inflight and ≤1 uptake cardinality.
 - Add the restricted persisted `onboarding` chat persona (IND-450) with an exact consent/profile/guided-signal/completion allowlist, an onboarding-specific privacy and explicit-approval prompt, Signal's proposal-only live-membership narrowing, shared guided intake stages, and durable `profileConfirmedAt` / exact `firstSignalIntentId` completion markers; selected first signals must be active, owned, and created no earlier than a valid profile-confirmation timestamp. Gmail/contact import, opportunity/discovery/negotiation, community and membership mutation, administration, arbitrary scraping, and unreviewed shared tools remain excluded; the legacy orchestrator onboarding flow remains available to flag-off and non-web consumers.

package/IMPLEMENTATION.md

@@ -19,6 +19,26 @@ deep imports are not part of the contract. Every symbol is re-exported explicitl
 See [STABILITY.md](./STABILITY.md) for the full policy and the deprecation path,
 and [CHANGELOG.md](./CHANGELOG.md) for release history.
 
+## Source-map publication policy
+
+Published `@indexnetwork/protocol` tarballs contain **no source maps**: neither
+JavaScript (`*.js.map`) nor declaration (`*.d.ts.map`) maps. The zero-map budget
+is enforced by the `prepack` build (`tsconfig.package.json`) and by
+`architecture:artifacts`; it is intentionally separate from the normal `build`.
+
+This is a registry-size and downstream-support tradeoff. The ordinary build keeps
+maps so the deployment Sentry workflow can upload them for first-party debugging,
+but they are not copied into the npm registry. A downstream runtime stack therefore
+names a `dist/*.js` location rather than the original TypeScript source. Consumers
+should retain the package version with an incident and use the matching source
+revision or their own observability mapping when they need source-level diagnosis.
+
+Declaration navigation is unchanged: `dist/**/*.d.ts` remains published and is the
+supported editor/type-checking surface. Declaration maps are deliberately omitted
+because they are not required to navigate those declarations and would expose the
+same source-map size cost. This policy is reversible by changing only
+`tsconfig.package.json`; do not add maps to the package file list ad hoc.
+
 ## Install
 
 ```bash

package/STABILITY.md

@@ -14,6 +14,9 @@ change. It is the reference behind the tier annotations in `src/index.ts`.
 - The contract is exactly the set of symbols re-exported from `src/index.ts`.
   Exports are listed explicitly (no `export *` wildcards), so the surface is
   reviewable and additions are always intentional.
+- Root exports are assembled through named capability facades. Those facades are
+  implementation seams, not package subpath entry points: consumers must still
+  import only from `@indexnetwork/protocol`.
 
 ## Stability tiers
 
@@ -31,6 +34,7 @@ Covered by SemVer below. Breaking changes require a **major** bump.
 | **Graph factories** | `*GraphFactory` classes (`ChatGraphFactory`, `OpportunityGraphFactory`, `NegotiationGraphFactory`, …). |
 | **Agents** | Structured LLM agents (`UserContextGenerator`, `IndexNegotiator`, `OpportunityEvaluator`, …). |
 | **MCP** | `createMcpServer` and its supporting types. |
+| **Capability tools** | Named tool-factory entry points for Signals, Participant context, Communities, Opportunities, Negotiation, Questions, Participant agents, Contacts, and Integrations. |
 
 ### Experimental
 

package/dist/agent/agent.tools.d.ts

@@ -1,3 +1,11 @@
-import type { DefineTool, ToolDeps } from '../shared/agent/tool.helpers.js';
-export declare function createAgentTools(defineTool: DefineTool, deps: ToolDeps): never[] | readonly [any, any, any, any, any, any];
-//# sourceMappingURL=agent.tools.d.ts.map
+/**
+ * @deprecated — compatibility shim.
+ *
+ * Canonical implementation has moved to participant-agents/application.
+ * This re-export exists solely to avoid breaking imports that pre-date IND-548.
+ * Import from the participant-agents module or capabilities/participant-agents.facade.ts
+ * for new code.
+ *
+ * IND-548: migrated to src/participant-agents/application/agent.tools.ts.
+ */
+export { createAgentTools } from '../participant-agents/application/index.js';

package/dist/agent/agent.tools.js

@@ -1,301 +1,11 @@
-import { z } from 'zod';
-import { error, success } from '../shared/agent/tool.helpers.js';
-import { protocolLogger } from '../shared/observability/protocol.logger.js';
-const logger = protocolLogger('ChatTools:Agent');
-const AGENT_ACTIONS = [
-    'manage:profile',
-    'manage:intents',
-    'manage:networks',
-    'manage:contacts',
-    'manage:opportunities',
-    'manage:negotiations',
-];
-function invalidActionMessage(action) {
-    return `Invalid action: ${action}. Valid actions: ${AGENT_ACTIONS.join(', ')}`;
-}
-function isValidAction(action) {
-    return AGENT_ACTIONS.includes(action);
-}
-function requireAgentDatabase(deps) {
-    if (!deps.agentDatabase) {
-        return null;
-    }
-    return deps.agentDatabase;
-}
-function ensureAgentScopedAccess(context, requestedAgentId) {
-    if (context.agentId && context.agentId !== requestedAgentId) {
-        return 'This agent can only manage its own registration.';
-    }
-    return null;
-}
-function sanitizeAgentForOutput(agent) {
-    return {
-        ...agent,
-        transports: agent.transports,
-    };
-}
-function sanitizeAgentName(name) {
-    const cleanName = name.trim();
-    return cleanName ? cleanName : null;
-}
-function normalizePermissions(permissions) {
-    return [...new Set((permissions ?? []).map((action) => action.trim()).filter(Boolean))];
-}
-export function createAgentTools(defineTool, deps) {
-    const agentDb = requireAgentDatabase(deps);
-    if (!agentDb) {
-        return [];
-    }
-    const registerAgent = defineTool({
-        name: 'register_agent',
-        description: 'Register a new personal agent for the current user. Optionally configure initial permissions. ' +
-            'Use this when connecting an external agent to Index.',
-        querySchema: z.object({
-            name: z.string().min(1).describe('Display name for the agent.'),
-            description: z.string().optional().describe('What the agent does.'),
-            permissions: z.array(z.string()).optional().describe('Optional initial permission actions to grant.'),
-        }),
-        handler: async ({ context, query }) => {
-            if (context.agentId) {
-                return error('Agent registration must be done from a user session (web UI or personal API key), ' +
-                    'not from within an existing agent context. To register a new agent, visit the Index web app.');
-            }
-            try {
-                const name = sanitizeAgentName(query.name);
-                if (!name) {
-                    return error('Agent name is required.');
-                }
-                const permissions = normalizePermissions(query.permissions);
-                for (const permission of permissions) {
-                    if (!isValidAction(permission)) {
-                        return error(invalidActionMessage(permission));
-                    }
-                }
-                const agent = await agentDb.createAgent({
-                    ownerId: context.userId,
-                    name,
-                    description: query.description?.trim() || undefined,
-                    type: 'external',
-                });
-                try {
-                    if (permissions.length > 0) {
-                        await agentDb.grantPermission({
-                            agentId: agent.id,
-                            userId: context.userId,
-                            scope: 'global',
-                            actions: permissions,
-                        });
-                    }
-                }
-                catch (setupError) {
-                    try {
-                        await agentDb.deleteAgent(agent.id);
-                    }
-                    catch {
-                        // Best-effort cleanup to avoid leaving partially registered agents behind.
-                    }
-                    throw setupError;
-                }
-                const fullAgent = await agentDb.getAgentWithRelations(agent.id);
-                return success({
-                    message: `Agent "${agent.name}" registered successfully.`,
-                    agent: sanitizeAgentForOutput(fullAgent ?? ({ ...agent, transports: [], permissions: [] })),
-                });
-            }
-            catch (err) {
-                logger.error('Failed to register agent', { err });
-                return error('Failed to register agent. Please try again.');
-            }
-        },
-    });
-    const listAgents = defineTool({
-        name: 'list_agents',
-        description: 'List all agents the current user owns or has authorized.',
-        querySchema: z.object({}),
-        handler: async ({ context }) => {
-            try {
-                const agents = await agentDb.listAgentsForUser(context.userId);
-                const filteredAgents = context.agentId
-                    ? agents.filter((agent) => agent.id === context.agentId)
-                    : agents;
-                return success({
-                    agents: filteredAgents.map((agent) => sanitizeAgentForOutput(agent)),
-                    count: filteredAgents.length,
-                });
-            }
-            catch (err) {
-                logger.error('Failed to list agents', { err });
-                return error('Failed to list agents. Please try again.');
-            }
-        },
-    });
-    const updateAgent = defineTool({
-        name: 'update_agent',
-        description: 'Update an agent name, description, or status.',
-        querySchema: z.object({
-            agent_id: z.string().min(1).describe('The agent ID to update.'),
-            name: z.string().optional().describe('Updated display name.'),
-            description: z.string().optional().describe('Updated description.'),
-            status: z.enum(['active', 'inactive']).optional().describe('Updated status.'),
-        }),
-        handler: async ({ context, query }) => {
-            const scopeError = ensureAgentScopedAccess(context, query.agent_id);
-            if (scopeError) {
-                return error(scopeError);
-            }
-            try {
-                const agent = await agentDb.getAgent(query.agent_id);
-                if (!agent || agent.ownerId !== context.userId) {
-                    return error('Agent not found');
-                }
-                if (agent.type === 'system') {
-                    return error('System agents cannot be modified');
-                }
-                const updates = {};
-                if (query.name !== undefined) {
-                    const name = query.name.trim();
-                    if (!name) {
-                        return error('Agent name is required');
-                    }
-                    updates.name = name;
-                }
-                if (query.description !== undefined) {
-                    updates.description = query.description.trim() || null;
-                }
-                if (query.status) {
-                    updates.status = query.status;
-                }
-                if (Object.keys(updates).length === 0) {
-                    return error('At least one field is required.');
-                }
-                const updated = await agentDb.updateAgent(query.agent_id, updates);
-                if (!updated) {
-                    return error('Agent not found');
-                }
-                const fullAgent = await agentDb.getAgentWithRelations(query.agent_id);
-                return success({
-                    message: 'Agent updated.',
-                    agent: sanitizeAgentForOutput(fullAgent ?? ({ ...updated, transports: [], permissions: [] })),
-                });
-            }
-            catch (err) {
-                logger.error('Failed to update agent', { err });
-                return error('Failed to update agent. Please try again.');
-            }
-        },
-    });
-    const deleteAgent = defineTool({
-        name: 'delete_agent',
-        description: 'Soft-delete a personal agent and deactivate its transports.',
-        querySchema: z.object({
-            agent_id: z.string().min(1).describe('The agent ID to delete.'),
-        }),
-        handler: async ({ context, query }) => {
-            const scopeError = ensureAgentScopedAccess(context, query.agent_id);
-            if (scopeError) {
-                return error(scopeError);
-            }
-            try {
-                const agent = await agentDb.getAgent(query.agent_id);
-                if (!agent || agent.ownerId !== context.userId) {
-                    return error('Agent not found');
-                }
-                if (agent.type === 'system') {
-                    return error('System agents cannot be deleted');
-                }
-                await agentDb.deleteAgent(query.agent_id);
-                return success({ message: `Agent "${agent.name}" deleted.` });
-            }
-            catch (err) {
-                logger.error('Failed to delete agent', { err });
-                return error('Failed to delete agent. Please try again.');
-            }
-        },
-    });
-    const grantAgentPermission = defineTool({
-        name: 'grant_agent_permission',
-        description: 'Grant one or more permissions to an agent for the current user. ' +
-            'Valid actions: manage:profile, manage:intents, manage:networks, manage:contacts, manage:opportunities, manage:negotiations.',
-        querySchema: z.object({
-            agent_id: z.string().min(1).describe('The agent ID to grant permissions to.'),
-            actions: z.array(z.string()).min(1).describe('Permission actions to grant. Valid values: manage:profile, manage:intents, manage:networks, manage:contacts, manage:opportunities, manage:negotiations.'),
-            scope: z.enum(['global', 'node', 'network']).optional().describe('Optional permission scope.'),
-            scope_id: z.string().optional().describe('Scope target ID for node/network scopes.'),
-        }),
-        handler: async ({ context, query }) => {
-            const scopeError = ensureAgentScopedAccess(context, query.agent_id);
-            if (scopeError) {
-                return error(scopeError);
-            }
-            const actions = normalizePermissions(query.actions);
-            if (actions.length === 0) {
-                return error('At least one non-empty action is required.');
-            }
-            for (const action of actions) {
-                if (!isValidAction(action)) {
-                    return error(invalidActionMessage(action));
-                }
-            }
-            if ((query.scope === 'network' || query.scope === 'node') && !query.scope_id?.trim()) {
-                return error(`scope_id is required for ${query.scope} permissions.`);
-            }
-            try {
-                const agent = await agentDb.getAgent(query.agent_id);
-                if (!agent || agent.ownerId !== context.userId) {
-                    return error('Agent not found');
-                }
-                const permission = await agentDb.grantPermission({
-                    agentId: query.agent_id,
-                    userId: context.userId,
-                    scope: query.scope,
-                    scopeId: query.scope === 'global' || query.scope === undefined ? undefined : query.scope_id?.trim(),
-                    actions,
-                });
-                return success({ message: 'Permission granted.', permission });
-            }
-            catch (err) {
-                logger.error('Failed to grant permission', { err });
-                return error('Failed to grant permission. Please try again.');
-            }
-        },
-    });
-    const revokeAgentPermission = defineTool({
-        name: 'revoke_agent_permission',
-        description: 'Revoke a specific permission from an agent.',
-        querySchema: z.object({
-            agent_id: z.string().min(1).describe('The agent ID that owns the permission.'),
-            permission_id: z.string().min(1).describe('The permission ID to revoke.'),
-        }),
-        handler: async ({ context, query }) => {
-            const scopeError = ensureAgentScopedAccess(context, query.agent_id);
-            if (scopeError) {
-                return error(scopeError);
-            }
-            try {
-                const agent = await agentDb.getAgentWithRelations(query.agent_id);
-                if (!agent || agent.ownerId !== context.userId) {
-                    return error('Agent not found');
-                }
-                const permission = agent.permissions.find((item) => item.id === query.permission_id);
-                if (!permission) {
-                    return error('Permission not found');
-                }
-                await agentDb.revokePermission(query.permission_id);
-                return success({ message: 'Permission revoked.' });
-            }
-            catch (err) {
-                logger.error('Failed to revoke permission', { err });
-                return error('Failed to revoke permission. Please try again.');
-            }
-        },
-    });
-    return [
-        registerAgent,
-        listAgents,
-        updateAgent,
-        deleteAgent,
-        grantAgentPermission,
-        revokeAgentPermission,
-    ];
-}
-//# sourceMappingURL=agent.tools.js.map
+/**
+ * @deprecated — compatibility shim.
+ *
+ * Canonical implementation has moved to participant-agents/application.
+ * This re-export exists solely to avoid breaking imports that pre-date IND-548.
+ * Import from the participant-agents module or capabilities/participant-agents.facade.ts
+ * for new code.
+ *
+ * IND-548: migrated to src/participant-agents/application/agent.tools.ts.
+ */
+export { createAgentTools } from '../participant-agents/application/index.js';

package/dist/capabilities/communities.facade.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Communities capability's supported graph and tool entry points.
+ *
+ * IND-546: canonical implementations live in src/communities/; the old
+ * network/, network/membership/, and network/indexer/ paths remain as
+ * compatibility re-exports.  This facade now imports from the communities
+ * domain-first module.
+ */
+export { NetworkGraphFactory } from "../communities/application/index.js";
+export { NetworkMembershipGraphFactory } from "../communities/application/index.js";
+export { IntentNetworkGraphFactory } from "../communities/application/index.js";
+export { createNetworkTools } from "../communities/application/index.js";
+export type { NetworkToolDeps } from "./communities.tools.port.js";

package/dist/capabilities/communities.facade.js

@@ -0,0 +1,12 @@
+/**
+ * Communities capability's supported graph and tool entry points.
+ *
+ * IND-546: canonical implementations live in src/communities/; the old
+ * network/, network/membership/, and network/indexer/ paths remain as
+ * compatibility re-exports.  This facade now imports from the communities
+ * domain-first module.
+ */
+export { NetworkGraphFactory } from "../communities/application/index.js";
+export { NetworkMembershipGraphFactory } from "../communities/application/index.js";
+export { IntentNetworkGraphFactory } from "../communities/application/index.js";
+export { createNetworkTools } from "../communities/application/index.js";

package/dist/capabilities/communities.tools.port.d.ts

@@ -0,0 +1,5 @@
+import type { ToolRegistryCompositionDeps } from "../shared/agent/tool.helpers.js";
+/** Host capabilities consumed by community discovery and membership tools. */
+export type NetworkToolDeps = Pick<ToolRegistryCompositionDeps, "userDb" | "systemDb" | "getUserContextText" | "networkRanker" | "reportToolError"> & {
+    graphs: Pick<ToolRegistryCompositionDeps["graphs"], "index" | "networkMembership">;
+};