@rine-network/eve 0.1.0 → 0.3.0

package/README.md

@@ -102,12 +102,34 @@ undecryptable mail is dropped by default.
 | `rine_reply` | Reply to a message by id, in-thread |
 | `rine_thread` | Decrypted both-sided transcript of a conversation |
 | `rine_discover` / `rine_inspect` | Search the directory / read a profile |
-| `rine_group_create` / `_invite` / `_remove` / `_inspect` | MLS-by-default groups |
+| `rine_group_create` / `_invite` / `_remove` / `_inspect` / `_join` / `_invites` | MLS-by-default groups |
+| `rine_pay` | Pay a received `rine.v1.x402_payment_required` quote under the local spend policy |
+| `rine_fulfill` | Payee side: verify + settle a received payment and reply with a receipt |
 
 Identity is resolved from the environment (`RINE_CONFIG_DIR`, `RINE_AGENT`,
 `RINE_API_URL`) — never from a tool's model-visible input. Tools return plain text
 and never surface ciphertext.
 
+## Payments (x402)
+
+`rine_pay` and `rine_fulfill` carry [x402](https://docs.rine.network/concepts/x402-payments/)
+stablecoin payments as signed messages in the same encrypted thread; both wrap
+`client.payments`. An inbound x402 frame **wakes a payment-aware turn** — a
+`payment_required` points the agent at `rine_pay`, a `payment` at `rine_fulfill`, a
+`receipt` is informational — and the terminal assistant prose into a payment thread stays
+suppressed. `init --tools payments` scaffolds both tools. The wallet key stays on the host
+and is never returned to the model, and a deny-by-default spend policy bounds every
+signature. `rine_pay` returns one of the shared payer statuses (`payment-submitted`,
+`no-wallet`, `not-payment-required`, `policy-refused`, `above-auto-pay-threshold`,
+`already-paid`, `wallet-busy`); `rine_fulfill` reports `settled` / `settlement-failed` /
+`verification-failed` / `facilitator-error` / `no-facilitator`.
+
+Auto-pay is **opt-in, off by default**: `rineChannel({ payments: { autoPay: true } })` or
+`RINE_X402_AUTO_PAY=1` lets an inbound quote at/below the wallet policy's auto-pay threshold
+be paid with no LLM turn; a quote above the threshold falls back to surfacing it to the
+model. `rine_fulfill`'s facilitator comes from `RINE_FACILITATOR` (a preset — `cdp` /
+`payai` / `x402-rs` — or an `https://` base URL) or the tool's `facilitator` option.
+
 **Human-in-the-loop (optional).** The mutating tools (`send`, `send_and_wait`,
 `reply`, `group_*`) accept an opt-in approval gate — `rineSendTool({ needsApproval:
 "once" })` (or `"always"`) — wired to Eve's approval flow. It's off by default, since
@@ -127,6 +149,8 @@ forever. Configure via `rineChannel({ ignoreTypes: [...] })`.
 | `RINE_WEBHOOK_SECRET` | HMAC secret the channel verifies inbound with |
 | `RINE_WEBHOOK_ID` | registered webhook id (for `webhook --delete`) |
 | `RINE_INBOUND_PATH` | channel route path (default `/rine/v1/inbound`) |
+| `RINE_X402_AUTO_PAY` | set `1` to auto-pay quotes at/below the policy's auto-pay threshold (default off) |
+| `RINE_FACILITATOR` | `rine_fulfill` facilitator: a preset (`cdp` / `payai` / `x402-rs`) or an `https://` base URL |
 
 ## License
 

package/dist/_zod.d.ts

@@ -9,7 +9,7 @@
  * accuracy) and parse the raw model input with the zod schema inside `execute`
  * (applying defaults + coercion). One source of truth (zod), version-independent.
  *
- * Every tool's `outputSchema` is `string` (R4) — a tool returns clean text, so
+ * Every tool's `outputSchema` is `string` — a tool returns clean text, so
  * ciphertext can never ride a struct field.
  */
 import { z, type ZodTypeAny } from "zod";

package/dist/{channel-Bg8l58gg.js → channel-WlN3x1wP.js}

@@ -1,10 +1,10 @@
-import { _ as senderLabel, f as renderMessageBody, g as renderThreadLine, n as asRecipient, v as verifiedNote } from "./tool-BC49DldZ.js";
+import { b as verifiedNote, m as renderMessageBody, n as asRecipient, v as renderThreadLine, y as senderLabel } from "./tool-xlLdY8kn.js";
 import { n as verifyRineSignature } from "./hmac-CoaKHmf6.js";
-import { t as getRineClient } from "./client-X_-9CpQT.js";
+import { t as getRineClient } from "./client-DsG2xtKs.js";
 import { POST, defineChannel } from "eve/channels";
-import { asMessageUuid } from "@rine-network/sdk";
+import { X402Error, X402_MESSAGE_TYPE, asMessageUuid } from "@rine-network/sdk";
 //#region src/transcript.ts
-/** char ≈ 4 × tokens — the coarse proxy the spec specifies (REQ-CTX-01, OQ1). */
+/** char ≈ 4 × tokens — the coarse proxy the spec specifies. */
 const CHARS_PER_TOKEN = 4;
 /** Marker prepended when older turns were dropped to fit the budget. */
 const OMITTED_MARKER = "[…earlier turns omitted]";
@@ -40,20 +40,31 @@ function renderTranscriptContext(entries, tokenBudget) {
 * Inbound webhook helpers for the rine channel: extracting the message id from a
 * rine standard-webhook body, and the continuation-token codec.
 *
-* The continuation token is how the channel makes outbound replies STATELESS (R7):
+* The continuation token is how the channel makes outbound replies STATELESS:
 * it encodes the rine `conversation_id`, the reply target (the group handle for
 * group mail, else the sender handle), and — for 1:1 inbound only — the inbound
 * `message id` so the `message.completed` handler can reply IN-PLACE (via the reply
 * endpoint, preserving the inbound conversation) without any durable per-session map.
 * Because the token bakes in the per-message `m`, it differs on every 1:1 inbound
 * turn, so Eve does NOT resume a prior session from it — cross-turn continuity comes
-* from the general thread primitive (push-injected transcript, Slice E), not session
+* from the general thread primitive (push-injected transcript), not session
 * resume. The message id is optional: group inbound and tokens minted by an older
 * build carry only `{c,r}` and decode with `messageId === undefined`, so the outbound
 * handler falls back to the `send()+parentConversationId` broadcast path.
 */
 /** Sentinel marking our token payload, robust to Eve's `<channel>:` namespacing. */
 const TOKEN_MARKER = "r1.";
+/**
+* Record a handled message id in the bounded per-runtime dedupe set. The set is
+* cleared wholesale when it reaches {@link SEEN_CAP} (a coarse but allocation-free
+* eviction — the server-side `delivered_at` ack is the durable dedupe). A no-op
+* when no set is provided.
+*/
+function rememberSeen(seen, id) {
+	if (!seen) return;
+	if (seen.size >= 5e3) seen.clear();
+	seen.add(id);
+}
 /** base64url (no padding) encode of a UTF-8 string. */
 function b64urlEncode(s) {
 	return Buffer.from(s, "utf-8").toString("base64url");
@@ -67,12 +78,13 @@ function b64urlDecode(s) {
 * (`rine:`); we additionally fence our payload with {@link TOKEN_MARKER} so the
 * decoder can recover it regardless of any prefix the framework adds.
 */
-function encodeReplyToken(conversationId, replyTarget, messageId) {
+function encodeReplyToken(conversationId, replyTarget, messageId, opts = {}) {
 	const payload = {
 		c: conversationId,
 		r: replyTarget
 	};
 	if (messageId) payload.m = messageId;
+	if (opts.x402) payload.x = 1;
 	return `${TOKEN_MARKER}${b64urlEncode(JSON.stringify(payload))}`;
 }
 /**
@@ -94,7 +106,8 @@ function decodeReplyToken(token) {
 		return {
 			conversationId,
 			replyTarget,
-			messageId: typeof m === "string" && m.length > 0 ? m : void 0
+			messageId: typeof m === "string" && m.length > 0 ? m : void 0,
+			x402: payload?.x === 1 ? true : void 0
 		};
 	} catch {
 		return null;
@@ -118,18 +131,134 @@ function messageIdFromWebhook(body) {
 	return typeof id === "string" && id.length > 0 ? id : void 0;
 }
 //#endregion
+//#region src/x402.ts
+/**
+* x402 payment-aware inbound re-surfacing for the rine channel.
+*
+* The three x402 payment frames are first-class message types carrying a verbatim
+* x402 V2 object, NOT a chat turn. v1.0 dropped them wholesale (a stateless gateway
+* that auto-replied prose into a payment handshake would corrupt it). v1.1 re-surfaces
+* them as an agent turn with STRUCTURED payment context so the model can act via the
+* dedicated pay / fulfill tools — while the terminal assistant prose stays suppressed
+* in EVERY case (the `x402` continuation-token flag; the guard hazard never re-arms):
+*
+*   - `x402_payment_required` → the quote + guidance to pay via `rine_pay`.
+*   - `x402_payment`          → the signed authorization + guidance to `rine_fulfill`.
+*   - `x402_receipt`          → the settlement outcome, informational (no reply).
+*
+* Auto-pay (opt-in, DEFAULT OFF): when enabled, a `payment_required` at/below the
+* policy's `autoPayThreshold` is paid with NO LLM turn — still bounded by the policy
+* caps, deny-by-default, journal and reserve-lock (all in rine-core). Any decline
+* falls back to surfacing the quote to the model.
+*/
+/** The three x402 frame types this module re-surfaces. */
+const X402_FRAME_TYPES = [
+	X402_MESSAGE_TYPE.PAYMENT_REQUIRED,
+	X402_MESSAGE_TYPE.PAYMENT,
+	X402_MESSAGE_TYPE.RECEIPT
+];
+const X402_FRAME_SET = new Set(X402_FRAME_TYPES);
+/** Whether a message type is one of the three x402 payment frames. */
+function isX402Frame(type) {
+	return X402_FRAME_SET.has(type);
+}
+/** Atomic-unit amount of a requirement (x402 V2 `amount`, else V1 spelling). */
+function requirementAmount(r) {
+	return r.amount ?? r.maxAmountRequired ?? "?";
+}
+/** One `accepts[]` requirement as a compact model-readable line. */
+function requirementLine(r) {
+	return `${requirementAmount(r)} of ${r.asset} on ${r.network} → ${r.payTo}`;
+}
+/**
+* The structured payment body handed to the model as the turn's primary message.
+* Reads only the decrypted plaintext (the verbatim x402 object) — never ciphertext.
+*/
+function renderX402Body(msg) {
+	const p = msg.plaintext;
+	if (msg.type === X402_MESSAGE_TYPE.PAYMENT_REQUIRED) {
+		const pr = p ?? {};
+		const accepts = Array.isArray(pr.accepts) ? pr.accepts : [];
+		const opts = accepts.length > 0 ? accepts.map((r) => `  - ${requirementLine(r)}`).join("\n") : "  (no acceptable requirements advertised)";
+		const res = pr.resource?.description ?? pr.resource?.url;
+		return `x402 payment request. Accepted ways to pay:\n${opts}${res ? `\nfor: ${res}` : ""}`;
+	}
+	if (msg.type === X402_MESSAGE_TYPE.PAYMENT) {
+		const pp = p ?? {};
+		const acc = pp.accepted;
+		return `x402 signed payment authorization from ${pp.payload?.authorization?.from ?? "unknown payer"}${acc ? ` for ${requirementLine(acc)}` : ""}.`;
+	}
+	const sr = p ?? {};
+	return `x402 settlement receipt — ${sr.success ? "settled" : "failed"} (${sr.success ? `tx ${sr.transaction} on ${sr.network}` : `reason: ${sr.errorReason ?? "unknown"}`}).`;
+}
+/** The routing-guidance line: what the model should do, and the do-not-reply rule. */
+function x402GuidanceLine(msg) {
+	const who = senderLabel(msg);
+	const note = verifiedNote(msg);
+	if (msg.type === X402_MESSAGE_TYPE.PAYMENT_REQUIRED) return `x402 quote from ${who} (${note}). To pay, call rine_pay with message_id ${msg.id} — the spend is bounded by your local policy (deny-by-default, caps). Do NOT send a text reply into this payment thread.`;
+	if (msg.type === X402_MESSAGE_TYPE.PAYMENT) return `x402 payment from ${who} (${note}). To verify, settle, and send a receipt, call rine_fulfill with message_id ${msg.id}. Do NOT send a text reply into this payment thread.`;
+	return `x402 receipt from ${who} (${note}). This is informational — no reply is expected.`;
+}
+/**
+* Auto-pay attempt. Returns `null` when the quote was paid (no session needed),
+* or a one-line decline note when auto-pay was refused or errored (the caller then
+* surfaces the quote to the model). A policy refusal / above-threshold quote is a
+* typed {@link X402Error}; anything else (network, wallet) is reported verbatim.
+*/
+async function tryAutoPay(deps, msg) {
+	try {
+		await deps.client.payments.pay(msg, { autoPay: true });
+		return null;
+	} catch (err) {
+		if (err instanceof X402Error) return `[auto-pay declined (${err.code}): ${err.message}]`;
+		return `[auto-pay failed: ${err instanceof Error ? err.message : String(err)}]`;
+	}
+}
+/** Surface an x402 frame to the model without arming the prose auto-reply. */
+async function surfaceX402(deps, msg, messageId, note) {
+	const replyTarget = msg.group_handle ?? msg.sender_handle ?? senderLabel(msg);
+	await deps.client.markDelivered([msg.id]).catch(() => {});
+	rememberSeen(deps.seen, messageId);
+	const context = [x402GuidanceLine(msg)];
+	if (note) context.push(note);
+	const token = encodeReplyToken(msg.conversation_id, replyTarget, void 0, { x402: true });
+	await deps.send({
+		message: renderX402Body(msg),
+		context
+	}, {
+		auth: null,
+		continuationToken: token
+	});
+	return new Response("ok", { status: 200 });
+}
+/**
+* Handle a verified inbound x402 frame. `payment_required` may auto-pay
+* when enabled and at/below threshold; otherwise, and for `payment` / `receipt`,
+* the frame is surfaced to the model as a payment-aware turn.
+*/
+async function handleX402Inbound(deps, msg, messageId) {
+	if (msg.type === X402_MESSAGE_TYPE.PAYMENT_REQUIRED && deps.autoPay) {
+		const decline = await tryAutoPay(deps, msg);
+		if (decline === null) {
+			await deps.client.markDelivered([msg.id]).catch(() => {});
+			rememberSeen(deps.seen, messageId);
+			return new Response("auto-paid", { status: 200 });
+		}
+		return surfaceX402(deps, msg, messageId, decline);
+	}
+	return surfaceX402(deps, msg, messageId, null);
+}
+//#endregion
 //#region src/channel-core.ts
 /**
-* Pure inbound/outbound pipeline for the rine channel — no `eve` import, so it is
-* unit-testable with fake clients/sends. `channel.ts` wires these to Eve's
-* `defineChannel` routes + events.
+* INBOUND half of the pure rine channel pipeline — no `eve` import, so it is
+* unit-testable with fake clients/sends. `channel.ts` wires this to Eve's
+* `defineChannel` route; the OUTBOUND half (`processCompletion`/`processFailure`)
+* lives in `channel-outbound.ts`.
 *
-*   - INBOUND (`processInbound`): HMAC-verify (transport auth, R5) → parse → dedupe
+*   - INBOUND (`processInbound`): HMAC-verify (transport auth) → parse → dedupe
 *     → `client.read(id)` to HPKE-decrypt + verify the sender's Ed25519 signature
-*     (content auth, R5) → loop-guard → mark delivered → start/resume the session.
-*   - OUTBOUND (`processCompletion`): on a terminal assistant message (R6) reply
-*     back over rine IN-PLACE via the reply endpoint, preserving the inbound
-*     conversation (R7); falls back to `parentConversationId` for legacy tokens.
+*     (content auth) → loop-guard → mark delivered → start/resume the session.
 *
 * TRUST NOTE: `verified === true` cryptographically binds the message's *signer*
 * (the envelope `kid`), but the SDK exposes only the server-asserted
@@ -138,17 +267,16 @@ function messageIdFromWebhook(body) {
 * verified signer needs an SDK change to surface `senderKid`; tracked as a
 * follow-up. Matches the sibling rine connectors' behavior.
 */
-const SEEN_CAP = 5e3;
 /** The line of context handed to the model so it knows who/where the message is from. */
 function senderContextLine(msg) {
 	const where = msg.group_handle ? ` in group ${msg.group_handle}` : "";
 	return `Inbound rine message from ${senderLabel(msg)}${where} (type ${msg.type}, ${verifiedNote(msg)}). Your reply is delivered back to the sender over rine.`;
 }
-/** Cap on turns fetched for the push-injected transcript (REQ-SRV-04). */
+/** Cap on turns fetched for the push-injected transcript. */
 const THREAD_FETCH_LIMIT = 50;
 /**
 * The inbound pipeline. Returns the HTTP {@link Response} the route should send.
-* Status codes are retry-aware (R8/#10): `5xx` = transient (caller should retry),
+* Status codes are retry-aware: `5xx` = transient (caller should retry),
 * `4xx` = terminal drop, `2xx` = accepted/benign-ignore.
 */
 async function processInbound(deps) {
@@ -173,17 +301,15 @@ async function processInbound(deps) {
 	if (msg.decrypt_error) return new Response("undecryptable", { status: 422 });
 	if (!msg.verified && !deps.acceptUnverified) return new Response("unverified sender signature", { status: 422 });
 	if (deps.ignoreTypes.includes(msg.type)) {
-		deps.seen?.add(messageId);
+		rememberSeen(deps.seen, messageId);
 		return new Response("ignored type", { status: 202 });
 	}
+	if (isX402Frame(msg.type)) return handleX402Inbound(deps, msg, messageId);
 	const replyTarget = msg.group_handle ?? msg.sender_handle;
 	if (!replyTarget) return new Response("no reply target", { status: 422 });
 	const token = msg.group_handle ? encodeReplyToken(msg.conversation_id, replyTarget) : encodeReplyToken(msg.conversation_id, replyTarget, msg.id);
 	await deps.client.markDelivered([msg.id]).catch(() => {});
-	if (deps.seen) {
-		if (deps.seen.size >= SEEN_CAP) deps.seen.clear();
-		deps.seen.add(messageId);
-	}
+	rememberSeen(deps.seen, messageId);
 	const context = [senderContextLine(msg)];
 	if (deps.threadContextTokenBudget != null) {
 		const priorTurns = (await deps.client.thread(msg.conversation_id, { limit: THREAD_FETCH_LIMIT }).catch(() => [])).slice(0, -1);
@@ -198,9 +324,22 @@ async function processInbound(deps) {
 	});
 	return new Response("ok", { status: 200 });
 }
+//#endregion
+//#region src/channel-outbound.ts
+/**
+* OUTBOUND half of the pure rine channel pipeline — no `eve` import, so it is
+* unit-testable with fake clients. `channel.ts` wires these to Eve's
+* `message.completed` / failure events; the INBOUND half lives in `channel-core.ts`.
+*
+* On a terminal assistant message, reply back over rine IN-PLACE via the reply
+* endpoint, preserving the inbound conversation; falls back to
+* `parentConversationId` for legacy tokens. A session started by an x402 frame never
+* prose-replies into the payment thread (the pay / fulfill tools transmit the signed
+* frame in-thread instead) — the `x402` continuation-token flag short-circuits both.
+*/
 /**
 * Outbound for `message.completed`: every TERMINAL assistant message (any
-* `finishReason` except the intermediate `tool-calls`, R6) with text becomes a
+* `finishReason` except the intermediate `tool-calls`) with text becomes a
 * reply. When the continuation token carries the inbound message id we reply
 * IN-PLACE via the reply endpoint (same conversation, no fork) keeping the
 * connector's `replyMessageType` unchanged — type-preserving, so terminal/wake
@@ -213,6 +352,7 @@ async function processCompletion(deps) {
 	if (!deps.message) return;
 	const rc = decodeReplyToken(deps.continuationToken);
 	if (!rc) return;
+	if (rc.x402) return;
 	if (rc.messageId) {
 		await deps.client.reply(asMessageUuid(rc.messageId), { text: deps.message }, { type: deps.replyMessageType });
 		return;
@@ -230,6 +370,7 @@ async function processCompletion(deps) {
 async function processFailure(continuationToken, client) {
 	const rc = decodeReplyToken(continuationToken);
 	if (!rc) return;
+	if (rc.x402) return;
 	const text = "Sorry — I hit an internal error handling your request.";
 	if (rc.messageId) {
 		await client.reply(asMessageUuid(rc.messageId), { text }, { type: "rine.v1.error" });
@@ -245,14 +386,27 @@ async function processFailure(continuationToken, client) {
 const DEFAULT_INBOUND_PATH = "/rine/v1/inbound";
 const DEFAULT_REPLY_TYPE = "rine.v1.task_response";
 const DEFAULT_MAX_BODY_BYTES = 512 * 1024;
-/** Default token budget for the push-injected transcript (REQ-CTX-01, ≈8000 chars). */
+/** Default token budget for the push-injected transcript (≈8000 chars). */
 const DEFAULT_THREAD_CONTEXT_TOKEN_BUDGET = 2e3;
-/** Message types the connector itself emits — never auto-replied to (loop guard, R2). */
+/**
+* Message types never auto-replied to (loop guard): the connector's OWN
+* outbound types (task_response/error/receipt), so two rine-eve agents don't
+* auto-reply to each other forever.
+*
+* The three x402 payment frames are NOT here: v1.1 re-surfaces them as
+* payment-aware agent turns, routed by `handleX402Inbound` with the prose
+* auto-reply suppressed (the `x402` continuation-token flag), never by the generic
+* assistant reply. Adding them here would revert to the v1.0 silent-drop behavior.
+*/
 const DEFAULT_IGNORE_TYPES = [
 	"rine.v1.task_response",
 	"rine.v1.error",
 	"rine.v1.receipt"
 ];
+/** Whether an env flag is truthy (`1` / `true`, case-insensitive). */
+function envFlag(value) {
+	return value === "1" || value?.toLowerCase() === "true";
+}
 /** Build the rine channel. Default-export the result from `agent/channels/rine.ts`. */
 function rineChannel(opts = {}) {
 	const path = opts.path ?? process.env.RINE_INBOUND_PATH ?? DEFAULT_INBOUND_PATH;
@@ -261,6 +415,7 @@ function rineChannel(opts = {}) {
 	const acceptUnverified = opts.acceptUnverified ?? false;
 	const ignoreTypes = opts.ignoreTypes ?? DEFAULT_IGNORE_TYPES;
 	const threadContextTokenBudget = opts.threadContextTokenBudget ?? DEFAULT_THREAD_CONTEXT_TOKEN_BUDGET;
+	const autoPay = opts.payments?.autoPay ?? envFlag(process.env.RINE_X402_AUTO_PAY);
 	const seen = /* @__PURE__ */ new Set();
 	const client = () => opts.client ?? getRineClient({
 		agent: opts.agent ?? process.env.RINE_AGENT,
@@ -278,7 +433,8 @@ function rineChannel(opts = {}) {
 			maxBodyBytes,
 			ignoreTypes,
 			seen,
-			threadContextTokenBudget
+			threadContextTokenBudget,
+			autoPay
 		}))],
 		events: {
 			"message.completed": async (data, channel) => {
@@ -301,4 +457,4 @@ function rineChannel(opts = {}) {
 	});
 }
 //#endregion
-export { senderContextLine as a, messageIdFromWebhook as c, processInbound as i, processCompletion as n, decodeReplyToken as o, processFailure as r, encodeReplyToken as s, rineChannel as t };
+export { processInbound as a, handleX402Inbound as c, x402GuidanceLine as d, decodeReplyToken as f, processFailure as i, isX402Frame as l, messageIdFromWebhook as m, rineChannel as n, senderContextLine as o, encodeReplyToken as p, processCompletion as r, X402_FRAME_TYPES as s, DEFAULT_IGNORE_TYPES as t, renderX402Body as u };

package/dist/channel-core.d.ts

@@ -1,14 +1,12 @@
 /**
- * Pure inbound/outbound pipeline for the rine channel — no `eve` import, so it is
- * unit-testable with fake clients/sends. `channel.ts` wires these to Eve's
- * `defineChannel` routes + events.
+ * INBOUND half of the pure rine channel pipeline — no `eve` import, so it is
+ * unit-testable with fake clients/sends. `channel.ts` wires this to Eve's
+ * `defineChannel` route; the OUTBOUND half (`processCompletion`/`processFailure`)
+ * lives in `channel-outbound.ts`.
  *
- *   - INBOUND (`processInbound`): HMAC-verify (transport auth, R5) → parse → dedupe
+ *   - INBOUND (`processInbound`): HMAC-verify (transport auth) → parse → dedupe
  *     → `client.read(id)` to HPKE-decrypt + verify the sender's Ed25519 signature
- *     (content auth, R5) → loop-guard → mark delivered → start/resume the session.
- *   - OUTBOUND (`processCompletion`): on a terminal assistant message (R6) reply
- *     back over rine IN-PLACE via the reply endpoint, preserving the inbound
- *     conversation (R7); falls back to `parentConversationId` for legacy tokens.
+ *     (content auth) → loop-guard → mark delivered → start/resume the session.
  *
  * TRUST NOTE: `verified === true` cryptographically binds the message's *signer*
  * (the envelope `kid`), but the SDK exposes only the server-asserted
@@ -42,41 +40,24 @@ export interface InboundDeps {
     maxBodyBytes: number;
     /** Inbound types to ignore (loop guard). */
     ignoreTypes: readonly string[];
+    /**
+     * Opt-in auto-pay (default OFF). When true, an inbound `x402_payment_required`
+     * at/below the policy's `autoPayThreshold` is paid with NO LLM turn — still
+     * bounded by the caps, deny-by-default, journal and reserve-lock. Any decline
+     * falls back to surfacing the quote to the model.
+     */
+    autoPay?: boolean;
     /** Bounded set of already-handled message ids (dedupe across retries/replays). */
     seen?: Set<string>;
     /**
      * Approximate token budget for the role-tagged transcript push-injected into the
-     * session context (REQ-CTX-01). When unset, only the sender line is injected.
+     * session context. When unset, only the sender line is injected.
      */
     threadContextTokenBudget?: number;
 }
 /**
  * The inbound pipeline. Returns the HTTP {@link Response} the route should send.
- * Status codes are retry-aware (R8/#10): `5xx` = transient (caller should retry),
+ * Status codes are retry-aware: `5xx` = transient (caller should retry),
  * `4xx` = terminal drop, `2xx` = accepted/benign-ignore.
  */
 export declare function processInbound(deps: InboundDeps): Promise<Response>;
-export interface CompletionDeps {
-    finishReason: string;
-    message: string | null;
-    continuationToken: string;
-    client: AsyncRineClient;
-    replyMessageType: string;
-}
-/**
- * Outbound for `message.completed`: every TERMINAL assistant message (any
- * `finishReason` except the intermediate `tool-calls`, R6) with text becomes a
- * reply. When the continuation token carries the inbound message id we reply
- * IN-PLACE via the reply endpoint (same conversation, no fork) keeping the
- * connector's `replyMessageType` unchanged — type-preserving, so terminal/wake
- * semantics are exactly as before. Legacy tokens (no message id) fall back to the
- * historical `send()+parentConversationId` path. No-ops for non-rine sessions
- * (token not ours) or empty messages.
- */
-export declare function processCompletion(deps: CompletionDeps): Promise<void>;
-/**
- * Best-effort error notice back to the sender on a terminal session failure.
- * Replies IN-PLACE (reply endpoint, same conversation) keeping the `rine.v1.error`
- * type; falls back to `send()+parentConversationId` for legacy tokens.
- */
-export declare function processFailure(continuationToken: string, client: AsyncRineClient): Promise<void>;

package/dist/channel-outbound.d.ts

@@ -0,0 +1,36 @@
+/**
+ * OUTBOUND half of the pure rine channel pipeline — no `eve` import, so it is
+ * unit-testable with fake clients. `channel.ts` wires these to Eve's
+ * `message.completed` / failure events; the INBOUND half lives in `channel-core.ts`.
+ *
+ * On a terminal assistant message, reply back over rine IN-PLACE via the reply
+ * endpoint, preserving the inbound conversation; falls back to
+ * `parentConversationId` for legacy tokens. A session started by an x402 frame never
+ * prose-replies into the payment thread (the pay / fulfill tools transmit the signed
+ * frame in-thread instead) — the `x402` continuation-token flag short-circuits both.
+ */
+import type { AsyncRineClient } from "@rine-network/sdk";
+export interface CompletionDeps {
+    finishReason: string;
+    message: string | null;
+    continuationToken: string;
+    client: AsyncRineClient;
+    replyMessageType: string;
+}
+/**
+ * Outbound for `message.completed`: every TERMINAL assistant message (any
+ * `finishReason` except the intermediate `tool-calls`) with text becomes a
+ * reply. When the continuation token carries the inbound message id we reply
+ * IN-PLACE via the reply endpoint (same conversation, no fork) keeping the
+ * connector's `replyMessageType` unchanged — type-preserving, so terminal/wake
+ * semantics are exactly as before. Legacy tokens (no message id) fall back to the
+ * historical `send()+parentConversationId` path. No-ops for non-rine sessions
+ * (token not ours) or empty messages.
+ */
+export declare function processCompletion(deps: CompletionDeps): Promise<void>;
+/**
+ * Best-effort error notice back to the sender on a terminal session failure.
+ * Replies IN-PLACE (reply endpoint, same conversation) keeping the `rine.v1.error`
+ * type; falls back to `send()+parentConversationId` for legacy tokens.
+ */
+export declare function processFailure(continuationToken: string, client: AsyncRineClient): Promise<void>;

package/dist/channel.d.ts

@@ -10,8 +10,21 @@
  * `channel-core.ts` (pure, testable); this file is the `defineChannel` wiring.
  */
 import type { AsyncRineClient } from "@rine-network/sdk";
-export { processInbound, processCompletion, processFailure, senderContextLine, } from "./channel-core.js";
-export type { ChannelSend, InboundDeps, CompletionDeps } from "./channel-core.js";
+export { processInbound, senderContextLine } from "./channel-core.js";
+export { processCompletion, processFailure } from "./channel-outbound.js";
+export type { ChannelSend, InboundDeps } from "./channel-core.js";
+export type { CompletionDeps } from "./channel-outbound.js";
+/**
+ * Message types never auto-replied to (loop guard): the connector's OWN
+ * outbound types (task_response/error/receipt), so two rine-eve agents don't
+ * auto-reply to each other forever.
+ *
+ * The three x402 payment frames are NOT here: v1.1 re-surfaces them as
+ * payment-aware agent turns, routed by `handleX402Inbound` with the prose
+ * auto-reply suppressed (the `x402` continuation-token flag), never by the generic
+ * assistant reply. Adding them here would revert to the v1.0 silent-drop behavior.
+ */
+export declare const DEFAULT_IGNORE_TYPES: string[];
 /** Options for {@link rineChannel}. All optional; identity defaults to env. */
 export interface RineChannelOptions {
     /** Acting agent (handle/name/UUID); defaults to `process.env.RINE_AGENT`. */
@@ -34,13 +47,23 @@ export interface RineChannelOptions {
     maxBodyBytes?: number;
     /**
      * Approximate token budget for the role-tagged recent-transcript push-injected
-     * into the stateless Eve session context on each inbound (REQ-CTX-01). Older
+     * into the stateless Eve session context on each inbound. Older
      * turns are truncated first with a `[…earlier turns omitted]` marker; a
      * single-message thread injects no extra transcript. Default ~2000 tokens.
      */
     threadContextTokenBudget?: number;
     /** A pre-built client (tests / advanced use); otherwise env-resolved lazily. */
     client?: AsyncRineClient;
+    /**
+     * x402 payment behavior. `autoPay` is OPT-IN and DEFAULT OFF: when true, an
+     * inbound `x402_payment_required` at/below the policy's `autoPayThreshold` is paid
+     * with no LLM turn (still bounded by the caps, deny-by-default, journal and
+     * reserve-lock). Off ⇒ every quote is surfaced to the agent, which pays via
+     * `rine_pay`. Falls back to `RINE_X402_AUTO_PAY` (`1`/`true`) when unset.
+     */
+    payments?: {
+        autoPay?: boolean;
+    };
 }
 /** Build the rine channel. Default-export the result from `agent/channels/rine.ts`. */
 export declare function rineChannel(opts?: RineChannelOptions): import("eve/channels").Channel<undefined, Record<string, unknown>, Record<string, unknown>>;

package/dist/channel.js

@@ -1,2 +1,2 @@
-import { a as senderContextLine, i as processInbound, n as processCompletion, r as processFailure, t as rineChannel } from "./channel-Bg8l58gg.js";
-export { processCompletion, processFailure, processInbound, rineChannel, senderContextLine };
+import { a as processInbound, i as processFailure, n as rineChannel, o as senderContextLine, r as processCompletion, t as DEFAULT_IGNORE_TYPES } from "./channel-WlN3x1wP.js";
+export { DEFAULT_IGNORE_TYPES, processCompletion, processFailure, processInbound, rineChannel, senderContextLine };

package/dist/{client-X_-9CpQT.js → client-DsG2xtKs.js}

@@ -2,7 +2,7 @@ import { AsyncRineClient } from "@rine-network/sdk";
 import { resolveApiUrl, resolveConfigDir } from "@rine-network/core";
 //#region src/client.ts
 /**
-* Lazy `AsyncRineClient` construction (invariant R1: side-effect-free import).
+* Lazy `AsyncRineClient` construction (side-effect-free import).
 *
 * No client is built at module load. The SDK client is created the first time a
 * tool's `execute` (or a channel handler) actually fires, then memoized per
@@ -24,7 +24,7 @@ function cacheKey(configDir, apiUrl) {
 /**
 * Get (or lazily build + memoize) the shared `AsyncRineClient` for `opts`,
 * already scoped to `opts.agent` when present. Call ONLY from inside a tool
-* `execute` / a channel handler — never at module top level (R1).
+* `execute` / a channel handler — never at module top level.
 */
 function getRineClient(opts = {}) {
 	const configDir = opts.configDir ?? resolveConfigDir();

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 /**
- * Lazy `AsyncRineClient` construction (invariant R1: side-effect-free import).
+ * Lazy `AsyncRineClient` construction (side-effect-free import).
  *
  * No client is built at module load. The SDK client is created the first time a
  * tool's `execute` (or a channel handler) actually fires, then memoized per
@@ -27,7 +27,7 @@ export interface RineClientOpts {
 /**
  * Get (or lazily build + memoize) the shared `AsyncRineClient` for `opts`,
  * already scoped to `opts.agent` when present. Call ONLY from inside a tool
- * `execute` / a channel handler — never at module top level (R1).
+ * `execute` / a channel handler — never at module top level.
  */
 export declare function getRineClient(opts?: RineClientOpts): AsyncRineClient;
 /** Test-only: drop all memoized clients (not part of the public surface). */

package/dist/errors.d.ts

@@ -1,5 +1,5 @@
 /**
- * `formatError(err)` — invariant R2: turn any thrown SDK error into a readable
+ * `formatError(err)` — turns any thrown SDK error into a readable
  * string for the LLM, never a stack trace. Tools wrap their one `await client.*`
  * call in `try/catch → formatError` and RESOLVE (never reject) for mapped errors.
  *

package/dist/format.d.ts

@@ -2,12 +2,12 @@
  * Pure render functions: turn SDK return values into the human-readable strings
  * tools + the channel hand to the LLM / send back over rine.
  *
- * Invariant R4: these read ONLY `plaintext` / `decrypt_error` / verification
+ * These read ONLY `plaintext` / `decrypt_error` / verification
  * fields. They NEVER read `encrypted_payload` or any envelope/ciphertext field,
  * so ciphertext can never reach the LLM context through a rendered string.
  */
 import type { ThreadEntry } from "@rine-network/sdk";
-import type { AgentProfile, AgentSummary, DecryptedMessage, GroupRead } from "./types.js";
+import type { AgentProfile, AgentSummary, DecryptedMessage, GroupRead, JoinRequestRead, JoinResult } from "./types.js";
 /** One thread turn as a role-tagged line: `[sent] you: …` / `[received] alice@org: …`. */
 export declare function renderThreadLine(e: ThreadEntry): string;
 /**
@@ -41,11 +41,15 @@ export declare function renderProfile(p: AgentProfile): string;
 /**
  * Self-diagnose a group's E2EE mode. Uses `mls_group_id !== null`, OR the
  * explicit `mls_enabled`/`mls_pending` flags. With MLS support present this is a
- * CAPABILITY flag, not a failure flag (R9).
+ * CAPABILITY flag, not a failure flag.
  */
 export declare function groupIsMls(g: GroupRead): boolean;
 /**
  * A group rendered for `rine_group_inspect`. Both the MLS and sender-key branches
- * are `[OK]` — an MLS group is readable/postable from here (R9).
+ * are `[OK]` — an MLS group is readable/postable from here.
  */
 export declare function renderGroup(g: GroupRead): string;
+/** `rine_group_join` outcome: immediate membership vs a pending vote. */
+export declare function renderJoinResult(target: string, result: JoinResult): string;
+/** A numbered list of the caller's pending group invites, or the empty-state line. */
+export declare function renderInvites(items: readonly JoinRequestRead[]): string;