@motebit/protocol 1.3.0 → 2.0.0

package/README.md

@@ -37,11 +37,13 @@ const relayFee = PLATFORM_FEE_RATE; // 0.05 — the universal 5% relay fee.
 - **Identity** — `MotebitIdentity`, `KeySuccessionRecord`, `DeviceRegistration`
 - **Execution receipts** — `ExecutionReceipt` with nested delegation chains
 - **Credentials** — W3C VC 2.0 types (`ReputationCredentialSubject`, `TrustCredentialSubject`)
-- **Settlement** — `BudgetAllocation`, `SettlementRecord`, `PLATFORM_FEE_RATE`
+- **Settlement** — `BudgetAllocation`, `SettlementRecord`, `PLATFORM_FEE_RATE`; `SettlementMode` closed union (`"relay" | "p2p"`) with `ALL_SETTLEMENT_MODES` for iteration and `isSettlementMode` for narrowing wire-format payloads pulled from discovery / peer-negotiation responses; `SettlementAsset` closed union (`"USDC"` at sub-phase A) with `ALL_SETTLEMENT_ASSETS` for iteration and `isSettlementAsset` for narrowing — the typed vocabulary of stablecoin assets the protocol clears settlement in; `SovereignRail.asset` is structurally tightened to this union so a peer announcing an unknown asset fails closed. **Guest-rail capability marker interfaces** + type guards — `GuestRail` carries `supportsDeposit` / `supportsWithdraw` / `supportsBatch` discriminants; `DepositableGuestRail` / `WithdrawableGuestRail` / `BatchableGuestRail` add the corresponding methods; `isDepositableRail` / `isWithdrawableRail` / `isBatchableRail` narrow at the call site. The marker on `WithdrawableGuestRail` is the structural enforcement of the off-ramp doctrine: rails that don't opt in (e.g., Bridge, treasury-only) cannot drive user-facing withdrawals because `withdraw` does not exist on the base type
 - **Trust algebra** — semiring operations for delegation-chain trust computation
-- **Policy** — `ToolDefinition`, `PolicyDecision`, `RiskLevel`, `SensitivityLevel`
+- **Policy** — `ToolDefinition`, `PolicyDecision`, `RiskLevel`, `SensitivityLevel` (the 5-tier privacy ladder, the most load-bearing closed registry; `ALL_SENSITIVITY_LEVELS` for iteration, `isSensitivityLevel` for narrowing unknown payloads, `rankSensitivity` / `maxSensitivity` / `sensitivityPermits` for the algebra)
+- **Event-log vocabulary** — `EventType` closed enum (59 entries spanning identity / memory / goals / approvals / plans / consolidation / co-browse / agents); `ALL_EVENT_TYPES` for iteration, `isEventType` for narrowing wire-format payloads pulled from sync peers or federation
 - **Storage adapters** — pluggable persistence contracts for any backend
 - **Cryptosuite registry** — `SuiteId` union for crypto-agile wire artifacts
+- **Auto-router registry** — `TaskShape` closed union (`ALL_TASK_SHAPES`, `isTaskShape`) for the model-selection primitive; named constants `QUICK_TASK_SHAPE`, `CHAT_TASK_SHAPE`, `REASONING_TASK_SHAPE`, `CODE_TASK_SHAPE`, `RESEARCH_TASK_SHAPE`, `CREATIVE_TASK_SHAPE`, `MATH_TASK_SHAPE`. Paired with `ProviderCapability` + `RoutingConstraint` + `RoutingDecision` types consumed by `@motebit/policy::dispatchRouting`
 
 Product-level types (state vectors, creature behavior, rendering spec) live in [`@motebit/sdk`](https://www.npmjs.com/package/@motebit/sdk), which re-exports everything here plus the product vocabulary.
 

package/dist/artifact-type.d.ts

@@ -31,10 +31,19 @@
  */
 /**
  * The closed set of content-artifact categories motebit currently
- * signs. Today's set covers the twelve state-export endpoints at
- * `services/relay/src/state-export.ts`, each wrapped in a
- * relay-asserted `ContentArtifactManifest` per the doctrine §8
- * recognition note (`docs/doctrine/nist-alignment.md`).
+ * signs. The first twelve cover the state-export endpoints at
+ * `services/relay/src/state-export.ts` (relay-assembled bundles
+ * the relay signs as a witness over its database state per the
+ * recognition note in `docs/doctrine/nist-alignment.md` §8). The
+ * thirteenth — `goal-result` — is the **first non-relay-state-export
+ * consumer**: a motebit-direct, per-fire artifact that the motebit
+ * itself signs as the producer (the agent's own work product, not
+ * a relay-assembled bundle). The expansion is doctrinally aligned —
+ * the registry's stated semantic is "content-artifact category for
+ * C2PA-shape provenance," not "relay state-export bundle." Goals
+ * is the first arc to prove the registry generalizes; future
+ * motebit-direct artifacts (chat-bundle exports, generated documents,
+ * tool-call-result bundles) compose against the same shape.
  *
  *   - `state-snapshot` — relay's stored state vector for a motebit
  *     (`/api/v1/state/:motebitId`)
@@ -63,6 +72,12 @@
  *     inner motebit-signed delegation receipt summaries; the
  *     canonical layered-signing consumer
  *     (`/api/v1/execution/:motebitId/:goalId`)
+ *   - `goal-result` — per-fire content motebit produced for a
+ *     scheduled goal. Producer = motebit identity (not relay).
+ *     Doctrine: `docs/doctrine/goal-results.md` §"The three
+ *     categories" — the artifact category's cryptographic
+ *     provenance envelope. Bound to the fire via `invocation`
+ *     (goal_id + execution-receipt id when present).
  *
  * Adding an endpoint is intentional protocol-level work: a new
  * `ContentArtifactType` entry here, a new named constant, a new
@@ -70,9 +85,11 @@
  * update in `scripts/check-artifact-type-canonical.ts`. Drift gate
  * `check-state-export-signed` enforces that every new `app.get(...)`
  * in `services/relay/src/state-export.ts` emits a manifest before
- * returning.
+ * returning — that gate scopes only to relay state-export endpoints,
+ * not to motebit-direct consumers like `goal-result`, which the
+ * runtime signs at fire-time through its own helper.
  */
-export type ContentArtifactType = "state-snapshot" | "memory-export" | "goal-list" | "conversation-list" | "conversation-messages" | "device-list" | "audit-trail" | "plan-list" | "plan-detail" | "gradient-history" | "sync-pull" | "execution-ledger";
+export type ContentArtifactType = "state-snapshot" | "memory-export" | "goal-list" | "conversation-list" | "conversation-messages" | "device-list" | "audit-trail" | "plan-list" | "plan-detail" | "gradient-history" | "sync-pull" | "execution-ledger" | "goal-result";
 /** Relay's stored state-vector snapshot for a motebit. */
 export declare const STATE_SNAPSHOT_ARTIFACT: ContentArtifactType;
 /** Relay-assembled memory-graph snapshot (nodes + edges). */
@@ -102,6 +119,15 @@ export declare const SYNC_PULL_ARTIFACT: ContentArtifactType;
  * byte-identical. See `spec/execution-ledger-v1.md`.
  */
 export declare const EXECUTION_LEDGER_ARTIFACT: ContentArtifactType;
+/**
+ * Per-fire artifact bytes for a scheduled goal — the content motebit
+ * produced when the goal cadence fired (or the user invoked
+ * `runNow`). First non-relay-state-export consumer of the registry:
+ * the motebit identity signs as producer, not the relay. Doctrine:
+ * `docs/doctrine/goal-results.md` §"The three categories" — the
+ * artifact category's cryptographic provenance envelope.
+ */
+export declare const GOAL_RESULT_ARTIFACT: ContentArtifactType;
 /**
  * Canonical iteration order, frozen. Consumers that need to iterate
  * (drift gates, tooling, docs) use this so TypeScript sees the narrow

package/dist/artifact-type.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifact-type.d.ts","sourceRoot":"","sources":["../src/artifact-type.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB,eAAe,GACf,WAAW,GACX,mBAAmB,GACnB,uBAAuB,GACvB,aAAa,GACb,aAAa,GACb,WAAW,GACX,aAAa,GACb,kBAAkB,GAClB,WAAW,GACX,kBAAkB,CAAC;AAUvB,0DAA0D;AAC1D,eAAO,MAAM,uBAAuB,EAAE,mBAAsC,CAAC;AAE7E,6DAA6D;AAC7D,eAAO,MAAM,sBAAsB,EAAE,mBAAqC,CAAC;AAE3E,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,EAAE,mBAAiC,CAAC;AAEnE,wDAAwD;AACxD,eAAO,MAAM,0BAA0B,EAAE,mBAAyC,CAAC;AAEnF,mEAAmE;AACnE,eAAO,MAAM,8BAA8B,EAAE,mBAA6C,CAAC;AAE3F,+DAA+D;AAC/D,eAAO,MAAM,oBAAoB,EAAE,mBAAmC,CAAC;AAEvE,+CAA+C;AAC/C,eAAO,MAAM,oBAAoB,EAAE,mBAAmC,CAAC;AAEvE,6EAA6E;AAC7E,eAAO,MAAM,kBAAkB,EAAE,mBAAiC,CAAC;AAEnE,yDAAyD;AACzD,eAAO,MAAM,oBAAoB,EAAE,mBAAmC,CAAC;AAEvE,4DAA4D;AAC5D,eAAO,MAAM,yBAAyB,EAAE,mBAAwC,CAAC;AAEjF,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,EAAE,mBAAiC,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAAwC,CAAC;AAIjF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,mBAAmB,EAanE,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAIlF"}
+{"version":3,"file":"artifact-type.d.ts","sourceRoot":"","sources":["../src/artifact-type.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB,eAAe,GACf,WAAW,GACX,mBAAmB,GACnB,uBAAuB,GACvB,aAAa,GACb,aAAa,GACb,WAAW,GACX,aAAa,GACb,kBAAkB,GAClB,WAAW,GACX,kBAAkB,GAClB,aAAa,CAAC;AAUlB,0DAA0D;AAC1D,eAAO,MAAM,uBAAuB,EAAE,mBAAsC,CAAC;AAE7E,6DAA6D;AAC7D,eAAO,MAAM,sBAAsB,EAAE,mBAAqC,CAAC;AAE3E,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,EAAE,mBAAiC,CAAC;AAEnE,wDAAwD;AACxD,eAAO,MAAM,0BAA0B,EAAE,mBAAyC,CAAC;AAEnF,mEAAmE;AACnE,eAAO,MAAM,8BAA8B,EAAE,mBAA6C,CAAC;AAE3F,+DAA+D;AAC/D,eAAO,MAAM,oBAAoB,EAAE,mBAAmC,CAAC;AAEvE,+CAA+C;AAC/C,eAAO,MAAM,oBAAoB,EAAE,mBAAmC,CAAC;AAEvE,6EAA6E;AAC7E,eAAO,MAAM,kBAAkB,EAAE,mBAAiC,CAAC;AAEnE,yDAAyD;AACzD,eAAO,MAAM,oBAAoB,EAAE,mBAAmC,CAAC;AAEvE,4DAA4D;AAC5D,eAAO,MAAM,yBAAyB,EAAE,mBAAwC,CAAC;AAEjF,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,EAAE,mBAAiC,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAAwC,CAAC;AAEjF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,EAAE,mBAAmC,CAAC;AAIvE;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,mBAAmB,EAcnE,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAIlF"}

package/dist/artifact-type.js

@@ -65,6 +65,15 @@ export const SYNC_PULL_ARTIFACT = "sync-pull";
  * byte-identical. See `spec/execution-ledger-v1.md`.
  */
 export const EXECUTION_LEDGER_ARTIFACT = "execution-ledger";
+/**
+ * Per-fire artifact bytes for a scheduled goal — the content motebit
+ * produced when the goal cadence fired (or the user invoked
+ * `runNow`). First non-relay-state-export consumer of the registry:
+ * the motebit identity signs as producer, not the relay. Doctrine:
+ * `docs/doctrine/goal-results.md` §"The three categories" — the
+ * artifact category's cryptographic provenance envelope.
+ */
+export const GOAL_RESULT_ARTIFACT = "goal-result";
 // === Iteration + type guard =================================================
 /**
  * Canonical iteration order, frozen. Consumers that need to iterate
@@ -84,6 +93,7 @@ export const ALL_CONTENT_ARTIFACT_TYPES = Object.freeze([
     "gradient-history",
     "sync-pull",
     "execution-ledger",
+    "goal-result",
 ]);
 /**
  * Type guard — narrows `unknown` to `ContentArtifactType`. Drift-gate-driven

package/dist/artifact-type.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifact-type.js","sourceRoot":"","sources":["../src/artifact-type.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AA2DH,+EAA+E;AAC/E,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,4EAA4E;AAC5E,6EAA6E;AAC7E,kBAAkB;AAElB,0DAA0D;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAwB,gBAAgB,CAAC;AAE7E,6DAA6D;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAwB,eAAe,CAAC;AAE3E,+CAA+C;AAC/C,MAAM,CAAC,MAAM,kBAAkB,GAAwB,WAAW,CAAC;AAEnE,wDAAwD;AACxD,MAAM,CAAC,MAAM,0BAA0B,GAAwB,mBAAmB,CAAC;AAEnF,mEAAmE;AACnE,MAAM,CAAC,MAAM,8BAA8B,GAAwB,uBAAuB,CAAC;AAE3F,+DAA+D;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAwB,aAAa,CAAC;AAEvE,+CAA+C;AAC/C,MAAM,CAAC,MAAM,oBAAoB,GAAwB,aAAa,CAAC;AAEvE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAwB,WAAW,CAAC;AAEnE,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAwB,aAAa,CAAC;AAEvE,4DAA4D;AAC5D,MAAM,CAAC,MAAM,yBAAyB,GAAwB,kBAAkB,CAAC;AAEjF,sEAAsE;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAwB,WAAW,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAwB,kBAAkB,CAAC;AAEjF,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAmC,MAAM,CAAC,MAAM,CAAC;IACtF,gBAAgB;IAChB,eAAe;IACf,WAAW;IACX,mBAAmB;IACnB,uBAAuB;IACvB,aAAa;IACb,aAAa;IACb,WAAW;IACX,aAAa;IACb,kBAAkB;IAClB,WAAW;IACX,kBAAkB;CACnB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ,IAAK,0BAAgD,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC/F,CAAC;AACJ,CAAC"}
+{"version":3,"file":"artifact-type.js","sourceRoot":"","sources":["../src/artifact-type.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AA6EH,+EAA+E;AAC/E,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,4EAA4E;AAC5E,6EAA6E;AAC7E,kBAAkB;AAElB,0DAA0D;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAwB,gBAAgB,CAAC;AAE7E,6DAA6D;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAwB,eAAe,CAAC;AAE3E,+CAA+C;AAC/C,MAAM,CAAC,MAAM,kBAAkB,GAAwB,WAAW,CAAC;AAEnE,wDAAwD;AACxD,MAAM,CAAC,MAAM,0BAA0B,GAAwB,mBAAmB,CAAC;AAEnF,mEAAmE;AACnE,MAAM,CAAC,MAAM,8BAA8B,GAAwB,uBAAuB,CAAC;AAE3F,+DAA+D;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAwB,aAAa,CAAC;AAEvE,+CAA+C;AAC/C,MAAM,CAAC,MAAM,oBAAoB,GAAwB,aAAa,CAAC;AAEvE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAwB,WAAW,CAAC;AAEnE,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAwB,aAAa,CAAC;AAEvE,4DAA4D;AAC5D,MAAM,CAAC,MAAM,yBAAyB,GAAwB,kBAAkB,CAAC;AAEjF,sEAAsE;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAwB,WAAW,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAwB,kBAAkB,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,aAAa,CAAC;AAEvE,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAmC,MAAM,CAAC,MAAM,CAAC;IACtF,gBAAgB;IAChB,eAAe;IACf,WAAW;IACX,mBAAmB;IACnB,uBAAuB;IACvB,aAAa;IACb,aAAa;IACb,WAAW;IACX,aAAa;IACb,kBAAkB;IAClB,WAAW;IACX,kBAAkB;IAClB,aAAa;CACd,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ,IAAK,0BAAgD,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC/F,CAAC;AACJ,CAAC"}

package/dist/event-type.d.ts

@@ -0,0 +1,62 @@
+/**
+ * `EventType` canonical-registry tooling.
+ *
+ * The `EventType` enum (in `./index.ts`) is the closed vocabulary of
+ * event-log entry discriminators that flow through every motebit's
+ * append-only event substrate. Every `EventLogEntry` carries an
+ * `event_type` field; sync peers, federation participants, audit
+ * verifiers, and consolidation cycles dispatch on it. Cross-
+ * implementation drift would break interop — a motebit emitting an
+ * unknown event_type to a peer would surface as a silent
+ * type-narrowing failure on the receiving side.
+ *
+ * Promoted to a registered registry per
+ * `docs/doctrine/registry-pattern-canonical.md` on 2026-05-14 — the
+ * sixth instance after `SuiteId`, `TokenAudience`,
+ * `ContentArtifactType`, `TaskShape`, and `SensitivityLevel`. The
+ * arc validates the meta-gate's claim that adding a sixth registry
+ * is template growth, not new design.
+ *
+ * Same shape as `audience.ts`, `artifact-type.ts`, `routing.ts`'s
+ * `ALL_TASK_SHAPES`/`isTaskShape` pair, and `sensitivity.ts`'s
+ * `ALL_SENSITIVITY_LEVELS`/`isSensitivityLevel` pair.
+ *
+ * Pure deterministic data + type guard. Permissive-floor primitive
+ * per `packages/protocol/CLAUDE.md` rule 1 (closed-registry tooling
+ * is structural, not policy).
+ */
+import type { EventType } from "./index.js";
+/**
+ * Canonical iteration order over `EventType`, frozen. The single
+ * source of truth for "every event type" — drift gates, exhaustive
+ * switches, sync filters, and the protocol's registry-coverage gate
+ * (`check-event-type-canonical`) all enumerate through this array.
+ *
+ * Ordered in declaration order from the enum in `index.ts`. The
+ * gate's sibling-alignment block verifies the array mirrors the
+ * enum exactly — a registry append in the enum without a
+ * corresponding array append fails CI.
+ *
+ * Same shape as `ALL_SUITE_IDS`, `ALL_TOKEN_AUDIENCES`,
+ * `ALL_CONTENT_ARTIFACT_TYPES`, `ALL_TASK_SHAPES`,
+ * `ALL_SENSITIVITY_LEVELS`. Adding an event type is intentional
+ * protocol-level work: new enum entry + new entry here + gate
+ * reference update + spec/event-log entry if wire-format-relevant.
+ *
+ * Values are the enum's string literals (not enum members) to avoid
+ * the init-order cycle the file's `import type` already documents.
+ */
+export declare const ALL_EVENT_TYPES: readonly EventType[];
+/**
+ * Type guard — narrows `unknown` to `EventType`. Drift-gate-driven
+ * literal scanners use this to validate values pulled from
+ * wire-format payloads; consumers that derive event types from
+ * external sources (sync intake, federation peer payloads) call
+ * this before dispatching so an unchecked cast is a fail-open path
+ * the type system can't catch.
+ *
+ * Same shape as `isSuiteId`, `isTokenAudience`,
+ * `isContentArtifactType`, `isTaskShape`, `isSensitivityLevel`.
+ */
+export declare function isEventType(value: unknown): value is EventType;
+//# sourceMappingURL=event-type.d.ts.map

package/dist/event-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-type.d.ts","sourceRoot":"","sources":["../src/event-type.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAOH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,SAAS,EA4D/B,CAAC;AAElB;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAE9D"}

package/dist/event-type.js

@@ -0,0 +1,123 @@
+/**
+ * `EventType` canonical-registry tooling.
+ *
+ * The `EventType` enum (in `./index.ts`) is the closed vocabulary of
+ * event-log entry discriminators that flow through every motebit's
+ * append-only event substrate. Every `EventLogEntry` carries an
+ * `event_type` field; sync peers, federation participants, audit
+ * verifiers, and consolidation cycles dispatch on it. Cross-
+ * implementation drift would break interop — a motebit emitting an
+ * unknown event_type to a peer would surface as a silent
+ * type-narrowing failure on the receiving side.
+ *
+ * Promoted to a registered registry per
+ * `docs/doctrine/registry-pattern-canonical.md` on 2026-05-14 — the
+ * sixth instance after `SuiteId`, `TokenAudience`,
+ * `ContentArtifactType`, `TaskShape`, and `SensitivityLevel`. The
+ * arc validates the meta-gate's claim that adding a sixth registry
+ * is template growth, not new design.
+ *
+ * Same shape as `audience.ts`, `artifact-type.ts`, `routing.ts`'s
+ * `ALL_TASK_SHAPES`/`isTaskShape` pair, and `sensitivity.ts`'s
+ * `ALL_SENSITIVITY_LEVELS`/`isSensitivityLevel` pair.
+ *
+ * Pure deterministic data + type guard. Permissive-floor primitive
+ * per `packages/protocol/CLAUDE.md` rule 1 (closed-registry tooling
+ * is structural, not policy).
+ */
+/**
+ * Canonical iteration order over `EventType`, frozen. The single
+ * source of truth for "every event type" — drift gates, exhaustive
+ * switches, sync filters, and the protocol's registry-coverage gate
+ * (`check-event-type-canonical`) all enumerate through this array.
+ *
+ * Ordered in declaration order from the enum in `index.ts`. The
+ * gate's sibling-alignment block verifies the array mirrors the
+ * enum exactly — a registry append in the enum without a
+ * corresponding array append fails CI.
+ *
+ * Same shape as `ALL_SUITE_IDS`, `ALL_TOKEN_AUDIENCES`,
+ * `ALL_CONTENT_ARTIFACT_TYPES`, `ALL_TASK_SHAPES`,
+ * `ALL_SENSITIVITY_LEVELS`. Adding an event type is intentional
+ * protocol-level work: new enum entry + new entry here + gate
+ * reference update + spec/event-log entry if wire-format-relevant.
+ *
+ * Values are the enum's string literals (not enum members) to avoid
+ * the init-order cycle the file's `import type` already documents.
+ */
+export const ALL_EVENT_TYPES = Object.freeze([
+    "identity_created",
+    "state_updated",
+    "memory_formed",
+    "memory_decayed",
+    "memory_deleted",
+    "memory_accessed",
+    "provider_swapped",
+    "export_requested",
+    "delete_requested",
+    "sync_completed",
+    "audit_entry",
+    "tool_used",
+    "policy_violation",
+    "goal_created",
+    "goal_executed",
+    "goal_removed",
+    "approval_requested",
+    "approval_approved",
+    "approval_denied",
+    "approval_expired",
+    "goal_completed",
+    "goal_progress",
+    "memory_audit",
+    "memory_pinned",
+    "plan_created",
+    "plan_step_started",
+    "plan_step_completed",
+    "plan_step_failed",
+    "plan_completed",
+    "plan_step_delegated",
+    "credential_revoked",
+    "identity_revoked",
+    "plan_failed",
+    "housekeeping_run",
+    "reflection_completed",
+    "idle_tick_fired",
+    "memory_consolidated",
+    "memory_promoted",
+    "consolidation_cycle_run",
+    "consolidation_receipt_signed",
+    "consolidation_receipts_anchored",
+    "agent_task_completed",
+    "agent_task_failed",
+    "agent_task_denied",
+    "proposal_created",
+    "proposal_accepted",
+    "proposal_rejected",
+    "proposal_countered",
+    "collaborative_step_completed",
+    "chain_trust_computed",
+    "trust_level_changed",
+    "key_rotated",
+    "computer_session_opened",
+    "computer_session_closed",
+    "computer_session_summarized",
+    "co_browse_control_changed",
+    "user_input_forwarded",
+    "skill_loaded",
+    "sensitivity_gate_fired",
+]);
+/**
+ * Type guard — narrows `unknown` to `EventType`. Drift-gate-driven
+ * literal scanners use this to validate values pulled from
+ * wire-format payloads; consumers that derive event types from
+ * external sources (sync intake, federation peer payloads) call
+ * this before dispatching so an unchecked cast is a fail-open path
+ * the type system can't catch.
+ *
+ * Same shape as `isSuiteId`, `isTokenAudience`,
+ * `isContentArtifactType`, `isTaskShape`, `isSensitivityLevel`.
+ */
+export function isEventType(value) {
+    return typeof value === "string" && ALL_EVENT_TYPES.includes(value);
+}
+//# sourceMappingURL=event-type.js.map

package/dist/event-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-type.js","sourceRoot":"","sources":["../src/event-type.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AASH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAyB,MAAM,CAAC,MAAM,CAAC;IACjE,kBAAkB;IAClB,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,gBAAgB;IAChB,aAAa;IACb,WAAW;IACX,kBAAkB;IAClB,cAAc;IACd,eAAe;IACf,cAAc;IACd,oBAAoB;IACpB,mBAAmB;IACnB,iBAAiB;IACjB,kBAAkB;IAClB,gBAAgB;IAChB,eAAe;IACf,cAAc;IACd,eAAe;IACf,cAAc;IACd,mBAAmB;IACnB,qBAAqB;IACrB,kBAAkB;IAClB,gBAAgB;IAChB,qBAAqB;IACrB,oBAAoB;IACpB,kBAAkB;IAClB,aAAa;IACb,kBAAkB;IAClB,sBAAsB;IACtB,iBAAiB;IACjB,qBAAqB;IACrB,iBAAiB;IACjB,yBAAyB;IACzB,8BAA8B;IAC9B,iCAAiC;IACjC,sBAAsB;IACtB,mBAAmB;IACnB,mBAAmB;IACnB,kBAAkB;IAClB,mBAAmB;IACnB,mBAAmB;IACnB,oBAAoB;IACpB,8BAA8B;IAC9B,sBAAsB;IACtB,qBAAqB;IACrB,aAAa;IACb,yBAAyB;IACzB,yBAAyB;IACzB,6BAA6B;IAC7B,2BAA2B;IAC3B,sBAAsB;IACtB,cAAc;IACd,wBAAwB;CACV,CAAC,CAAC;AAElB;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,eAAqC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC7F,CAAC"}

package/dist/index.d.ts

@@ -1389,6 +1389,22 @@ export interface SettlementRecord {
     platform_fee: number;
     /** Fee rate applied (e.g. 0.05 = 5%). Recorded per-settlement for auditability. */
     platform_fee_rate: number;
+    /**
+     * How the money moved for this settlement: `relay` (relay holds custody;
+     * virtual-account credit/debit on the relay's books) or `p2p` (peer-to-
+     * peer onchain transfer; relay records the audit but never held the
+     * funds). Closed registry — see `SettlementMode` in `./settlement-mode.ts`.
+     *
+     * Carried in the signed body so the lane is part of the relay's
+     * attestation, not a derivable side-fact. Auditors and counsel reading
+     * the receipt see the custody posture directly; the relay cannot
+     * silently re-label a custodied settlement as p2p after the fact.
+     *
+     * Treasury reconciliation (operator fee accrual vs. onchain balance)
+     * is structurally NOT a settlement and never appears here — see
+     * `docs/doctrine/settlement-rails.md` § "Lanes for external readers".
+     */
+    settlement_mode: SettlementMode;
     /** x402 payment transaction hash (when paid on-chain). */
     x402_tx_hash?: string;
     /** x402 network used for payment (CAIP-2 identifier). */
@@ -1493,6 +1509,26 @@ export interface GuestRail extends SettlementRail {
     readonly railType: "fiat" | "protocol" | "orchestration";
     /** Whether this rail supports proactive deposits. False for pay-per-request rails (x402, MPP). */
     readonly supportsDeposit: boolean;
+    /**
+     * Whether this rail supports user-facing withdrawal — i.e., the relay
+     * may invoke `rail.withdraw(...)` to transmit user funds to an
+     * external destination on the user's behalf. When `false`, the rail
+     * is registered for other purposes (treasury orchestration, deposit
+     * intake, anchor submission) but NEVER appears in the user-withdrawal
+     * dispatch path.
+     *
+     * `BridgeSettlementRail.supportsWithdraw = false` is the structural
+     * embodiment of the off-ramp doctrine: Motebit is not a transmitter
+     * of user funds. Bridge stays registered for own-account treasury
+     * conversion via `BridgeOfframpAdapter`, but the rail itself cannot
+     * be a withdrawal target — `withdraw()` is structurally absent from
+     * the type (it lives on `WithdrawableGuestRail`, not on the base).
+     *
+     * Mirrors `supportsDeposit` + `DepositableGuestRail` and `supportsBatch`
+     * + `BatchableGuestRail` as a discriminant narrowing to
+     * `WithdrawableGuestRail`.
+     */
+    readonly supportsWithdraw: boolean;
     /**
      * Whether the rail exposes a single-call batch withdrawal primitive.
      * When true, `withdrawBatch` MUST be implemented. When false (the
@@ -1501,21 +1537,11 @@ export interface GuestRail extends SettlementRail {
      * defers sub-threshold items and fires serially once the policy
      * clears — but the rail itself settles one item per call.
      * Mirrors `supportsDeposit` + `DepositableGuestRail` as a
-     * discriminant narrowing to `BatchableGuestRail`.
+     * discriminant narrowing to `BatchableGuestRail`. Implies
+     * `supportsWithdraw: true` — batch is a specialization of single
+     * withdraw.
      */
     readonly supportsBatch: boolean;
-    /**
-     * Execute a withdrawal to an external destination.
-     * Fail-closed: throws on any error.
-     */
-    withdraw(motebitId: string, amount: number, currency: string, destination: string, idempotencyKey: string): Promise<WithdrawalResult>;
-    /**
-     * Submit multiple withdrawals in one rail call when the rail
-     * supports a native batch primitive (e.g., a future x402 multi-
-     * authorization, a Bridge bulk-transfer). Present only when
-     * `supportsBatch` is true — narrow with `isBatchableRail`.
-     */
-    withdrawBatch?(items: readonly BatchWithdrawalItem[]): Promise<BatchWithdrawalResult>;
     /**
      * Record a payment proof with a settlement (e.g., x402 tx hash, Stripe charge ID).
      * Called after settleOnReceipt() computes the settlement record.
@@ -1550,11 +1576,46 @@ export interface BatchWithdrawalResult {
         reason: string;
     }>;
 }
+/**
+ * A guest rail that supports user-facing withdrawal — the relay may
+ * invoke `withdraw()` to transmit user funds to an external destination.
+ *
+ * Use the `supportsWithdraw` discriminant for runtime narrowing from
+ * `GuestRail`. The marker exists so `BridgeSettlementRail` (orchestration,
+ * treasury-only) is structurally distinct from `StripeSettlementRail`
+ * (fiat, user-facing) and `X402SettlementRail` (protocol, user-facing).
+ *
+ * The doctrinal frame: Motebit is not a transmitter of user funds. User-
+ * facing withdrawal is permitted only to user-held wallets (the sovereign
+ * Solana path via `OperatorSolanaTransfer` on the operator side, or to
+ * a user-held EVM wallet via x402 on a `WithdrawableGuestRail`). Bridge
+ * is excluded structurally — the method does not exist on its type, so
+ * the relay cannot orchestrate user-facing transfers through Bridge no
+ * matter what env vars are set. The doctrine is enforced by absence.
+ */
+export interface WithdrawableGuestRail extends GuestRail {
+    readonly supportsWithdraw: true;
+    /**
+     * Execute a withdrawal to an external destination.
+     * Fail-closed: throws on any error.
+     */
+    withdraw(motebitId: string, amount: number, currency: string, destination: string, idempotencyKey: string): Promise<WithdrawalResult>;
+    /**
+     * Submit multiple withdrawals in one rail call when the rail
+     * supports a native batch primitive (e.g., a future x402 multi-
+     * authorization). Present only when `supportsBatch` is true — narrow
+     * with `isBatchableRail`. A rail can be withdrawable without being
+     * batchable, but the reverse is forbidden by the type hierarchy:
+     * `BatchableGuestRail extends WithdrawableGuestRail`.
+     */
+    withdrawBatch?(items: readonly BatchWithdrawalItem[]): Promise<BatchWithdrawalResult>;
+}
 /**
  * A guest rail that supports batch withdrawal submission.
  * Use the `supportsBatch` discriminant for runtime narrowing from `GuestRail`.
+ * Batchable implies withdrawable — batch is a specialization of single withdraw.
  */
-export interface BatchableGuestRail extends GuestRail {
+export interface BatchableGuestRail extends WithdrawableGuestRail {
     readonly supportsBatch: true;
     withdrawBatch(items: readonly BatchWithdrawalItem[]): Promise<BatchWithdrawalResult>;
 }
@@ -1574,6 +1635,19 @@ export interface DepositableGuestRail extends GuestRail {
 }
 /** Type guard: narrows GuestRail to DepositableGuestRail. */
 export declare function isDepositableRail(rail: GuestRail): rail is DepositableGuestRail;
+/**
+ * Type guard: narrows GuestRail to WithdrawableGuestRail.
+ *
+ * The relay's user-withdrawal dispatch (services/relay/src/budget.ts)
+ * MUST narrow through this guard before calling `rail.withdraw(...)`.
+ * Compile-time enforcement: `withdraw` does not exist on bare `GuestRail`,
+ * so an un-narrowed call site fails to typecheck. Runtime defense-in-
+ * depth: a rail with `supportsWithdraw: true` AND a non-function
+ * `withdraw` property would shape-match the interface but fail this
+ * guard, surfacing as "this rail does not support withdrawal" rather
+ * than a `TypeError: rail.withdraw is not a function` at the dispatch.
+ */
+export declare function isWithdrawableRail(rail: GuestRail): rail is WithdrawableGuestRail;
 /** Type guard: narrows GuestRail to BatchableGuestRail. */
 export declare function isBatchableRail(rail: GuestRail): rail is BatchableGuestRail;
 /**
@@ -1598,8 +1672,13 @@ export interface SovereignRail extends SettlementRail {
     readonly custody: "agent";
     /** Chain identifier (e.g., "solana"). Future: "aptos", "sui". */
     readonly chain: string;
-    /** Asset symbol (e.g., "USDC"). */
-    readonly asset: string;
+    /**
+     * Settlement asset this rail clears in. Closed union — see
+     * `SettlementAsset` in `./settlement-asset.ts`. Sub-phase A: USDC
+     * only at land; second-asset promotion lifts the registry to the
+     * 8th registered registry per `registry-pattern-canonical.md`.
+     */
+    readonly asset: SettlementAsset;
     /** Agent's own address on this chain. Equals the motebit identity public key for Ed25519-native chains. */
     readonly address: string;
     /** Current balance in micro-units (1e6 = 1 unit of asset). */
@@ -2063,7 +2142,10 @@ export type { AgentSettlementAnchorBatch, AgentSettlementChainAnchor, AgentSettl
 export type { RelayMetadata, RelayMetadataPeer, AgentResolutionResult } from "./discovery.js";
 export type { MigrationState, MigrationRequest, MigrationToken, DepartureAttestation, CredentialBundle, BalanceWaiver, MigrationPresentation, } from "./migration.js";
 export type { DisputeState, DisputeOutcome, DisputeCategory, DisputeFundAction, DisputeRequest, DisputeEvidence, DisputeEvidenceType, AdjudicatorVote, VoteRequest, DisputeResolution, DisputeAppeal, WitnessOmissionDispute, WitnessOmissionEvidence, WitnessOmissionInclusionProofEvidence, WitnessOmissionAlternativePeeringEvidence, } from "./dispute.js";
-export type { SettlementMode, P2pPaymentProof, PaymentVerificationStatus, SettlementEligibility, SolvencyProof, } from "./settlement-mode.js";
+export type { SettlementMode, WritableSettlementMode, P2pPaymentProof, PaymentVerificationStatus, SettlementEligibility, SolvencyProof, } from "./settlement-mode.js";
+export { ALL_SETTLEMENT_MODES, isSettlementMode } from "./settlement-mode.js";
+export type { SettlementAsset } from "./settlement-asset.js";
+export { ALL_SETTLEMENT_ASSETS, isSettlementAsset } from "./settlement-asset.js";
 export type { SuiteId, SuiteEntry, SuiteStatus, SuiteAlgorithm, SuiteCanonicalization, SuiteSignatureEncoding, SuitePublicKeyEncoding, } from "./crypto-suite.js";
 export { SUITE_REGISTRY, ALL_SUITE_IDS, isSuiteId, getSuiteEntry } from "./crypto-suite.js";
 export { MAX_RETENTION_DAYS_BY_SENSITIVITY, REFERENCE_RETENTION_DAYS_BY_SENSITIVITY, RUNTIME_RETENTION_REGISTRY, EMPTY_FEDERATION_GRAPH_ANCHOR, } from "./retention-policy.js";
@@ -2079,15 +2161,21 @@ export type { ToolMode } from "./tool-mode.js";
 export { TOOL_MODES, toolModePriority } from "./tool-mode.js";
 export type { DropPayloadKind, DropTarget, DropPayload, UserActionAttestation, SensitivityGateEntry, SensitivityElevationSource, SensitivityGateFiredPayload, } from "./perception.js";
 export { resolveDropTarget } from "./perception.js";
-export { rankSensitivity, maxSensitivity, sensitivityPermits } from "./sensitivity.js";
+export { rankSensitivity, maxSensitivity, sensitivityPermits, ALL_SENSITIVITY_LEVELS, isSensitivityLevel, } from "./sensitivity.js";
+export type { SensitivityCleared } from "./sensitivity.js";
+export { ALL_EVENT_TYPES, isEventType } from "./event-type.js";
 export { MICRO, CENTS, toMicro, fromMicro, toCents, fromCents } from "./money.js";
+export type { InferenceHost, ModelLab, Jurisdiction, TaskShape, ProviderCapability, RoutingConstraint, RoutingDecision, } from "./routing.js";
+export { ALL_TASK_SHAPES, isTaskShape, QUICK_TASK_SHAPE, CHAT_TASK_SHAPE, REASONING_TASK_SHAPE, CODE_TASK_SHAPE, RESEARCH_TASK_SHAPE, CREATIVE_TASK_SHAPE, MATH_TASK_SHAPE, } from "./routing.js";
 export type { TokenAudience } from "./audience.js";
 export { ALL_TOKEN_AUDIENCES, isTokenAudience, SYNC_AUDIENCE, DEVICE_AUTH_AUDIENCE, PAIR_AUDIENCE, ROTATE_KEY_AUDIENCE, PUSH_REGISTER_AUDIENCE, TASK_SUBMIT_AUDIENCE, ADMIN_QUERY_AUDIENCE, PROPOSAL_AUDIENCE, ACCOUNT_BALANCE_AUDIENCE, ACCOUNT_DEPOSIT_AUDIENCE, ACCOUNT_WITHDRAW_AUDIENCE, ACCOUNT_WITHDRAWALS_AUDIENCE, ACCOUNT_CHECKOUT_AUDIENCE, BROWSER_SANDBOX_GRANT_AUDIENCE, BROWSER_SANDBOX_AUDIENCE, } from "./audience.js";
 export type { ContentArtifactType } from "./artifact-type.js";
-export { ALL_CONTENT_ARTIFACT_TYPES, isContentArtifactType, STATE_SNAPSHOT_ARTIFACT, MEMORY_EXPORT_ARTIFACT, GOAL_LIST_ARTIFACT, CONVERSATION_LIST_ARTIFACT, CONVERSATION_MESSAGES_ARTIFACT, DEVICE_LIST_ARTIFACT, AUDIT_TRAIL_ARTIFACT, PLAN_LIST_ARTIFACT, PLAN_DETAIL_ARTIFACT, GRADIENT_HISTORY_ARTIFACT, SYNC_PULL_ARTIFACT, EXECUTION_LEDGER_ARTIFACT, } from "./artifact-type.js";
+export { ALL_CONTENT_ARTIFACT_TYPES, isContentArtifactType, STATE_SNAPSHOT_ARTIFACT, MEMORY_EXPORT_ARTIFACT, GOAL_LIST_ARTIFACT, CONVERSATION_LIST_ARTIFACT, CONVERSATION_MESSAGES_ARTIFACT, DEVICE_LIST_ARTIFACT, AUDIT_TRAIL_ARTIFACT, PLAN_LIST_ARTIFACT, PLAN_DETAIL_ARTIFACT, GRADIENT_HISTORY_ARTIFACT, SYNC_PULL_ARTIFACT, EXECUTION_LEDGER_ARTIFACT, GOAL_RESULT_ARTIFACT, } from "./artifact-type.js";
 export type { SignedTransparencyDeclaration, TransparencySignedPayload, TransparencyAnchorRecord, } from "./transparency.js";
 export { TRANSPARENCY_SUITE, TRANSPARENCY_ANCHOR_MEMO_PREFIX, TRANSPARENCY_SPEC_ID, isSignedTransparencyDeclaration, } from "./transparency.js";
 import type { ToolMode } from "./tool-mode.js";
+import type { SettlementMode } from "./settlement-mode.js";
+import type { SettlementAsset } from "./settlement-asset.js";
 export type { SkillSensitivity, SkillPlatform, SkillHardwareAttestationGate, SkillSignature, SkillManifestMetadata, SkillManifestMotebit, SkillManifest, SkillEnvelopeFile, SkillEnvelopeSkillRef, SkillEnvelope, SkillLoadPayload, } from "./skills.js";
 export { SKILL_SENSITIVITY_TIERS, SKILL_AUTO_LOADABLE_TIERS, SKILL_PLATFORMS } from "./skills.js";
 export type { SkillRegistryEntry, SkillRegistrySubmitRequest, SkillRegistrySubmitResponse, SkillRegistryListing, SkillRegistryBundle, } from "./skills.js";