@rine-network/eve 0.1.0 → 0.3.0

package/dist/inbound.d.ts

@@ -2,18 +2,27 @@
  * Inbound webhook helpers for the rine channel: extracting the message id from a
  * rine standard-webhook body, and the continuation-token codec.
  *
- * The continuation token is how the channel makes outbound replies STATELESS (R7):
+ * The continuation token is how the channel makes outbound replies STATELESS:
  * it encodes the rine `conversation_id`, the reply target (the group handle for
  * group mail, else the sender handle), and — for 1:1 inbound only — the inbound
  * `message id` so the `message.completed` handler can reply IN-PLACE (via the reply
  * endpoint, preserving the inbound conversation) without any durable per-session map.
  * Because the token bakes in the per-message `m`, it differs on every 1:1 inbound
  * turn, so Eve does NOT resume a prior session from it — cross-turn continuity comes
- * from the general thread primitive (push-injected transcript, Slice E), not session
+ * from the general thread primitive (push-injected transcript), not session
  * resume. The message id is optional: group inbound and tokens minted by an older
  * build carry only `{c,r}` and decode with `messageId === undefined`, so the outbound
  * handler falls back to the `send()+parentConversationId` broadcast path.
  */
+/** Bound on the per-runtime `seen` dedupe set before it is cleared wholesale. */
+export declare const SEEN_CAP = 5000;
+/**
+ * Record a handled message id in the bounded per-runtime dedupe set. The set is
+ * cleared wholesale when it reaches {@link SEEN_CAP} (a coarse but allocation-free
+ * eviction — the server-side `delivered_at` ack is the durable dedupe). A no-op
+ * when no set is provided.
+ */
+export declare function rememberSeen(seen: Set<string> | undefined, id: string): void;
 /** What a decoded continuation token yields. */
 export interface ReplyContext {
     /** The rine conversation id to thread the reply into. */
@@ -25,13 +34,23 @@ export interface ReplyContext {
      * Absent for legacy 2-field tokens → caller falls back to send()+parent.
      */
     readonly messageId?: string;
+    /**
+     * Marks a session started by an inbound x402 payment frame. The terminal
+     * assistant message is NEVER prose-replied into a payment thread — that would
+     * corrupt the handshake. The signed payment / receipt is transmitted in-thread
+     * by the pay / fulfill tools instead, so `processCompletion` short-circuits when
+     * this is set.
+     */
+    readonly x402?: boolean;
 }
 /**
  * Encode the raw channel-local continuation token. Eve prepends the channel name
  * (`rine:`); we additionally fence our payload with {@link TOKEN_MARKER} so the
  * decoder can recover it regardless of any prefix the framework adds.
  */
-export declare function encodeReplyToken(conversationId: string, replyTarget: string, messageId?: string): string;
+export declare function encodeReplyToken(conversationId: string, replyTarget: string, messageId?: string, opts?: {
+    x402?: boolean;
+}): string;
 /**
  * Decode a continuation token back to its {@link ReplyContext}. Tolerant of a
  * leading `<channel>:` namespace (or any prefix) and of malformed input —

package/dist/index.d.ts

@@ -6,7 +6,7 @@
  * reachability + outbound replies, file-discovered rine **tools** for agency, a
  * **skill**, and an out-of-band **onboard / init / webhook / relay** CLI.
  *
- * Import is side-effect-free (R1): nothing here builds a client, reads a
+ * Import is side-effect-free: nothing here builds a client, reads a
  * credential, or opens a socket at module load.
  *
  * Most consumers don't import from here — they run `npx @rine-network/eve init`,
@@ -16,6 +16,7 @@
 export { rineChannel, processInbound, processCompletion, processFailure, senderContextLine, } from "./channel.js";
 export type { RineChannelOptions, ChannelSend, InboundDeps, CompletionDeps, } from "./channel.js";
 export * from "./tools/index.js";
+export { isX402Frame, handleX402Inbound, renderX402Body, x402GuidanceLine, X402_FRAME_TYPES, } from "./x402.js";
 export { rineSkill, RINE_SKILL_BODY, RINE_SKILL_FILE, RINE_SKILL_DESCRIPTION, } from "./skill.js";
 export { getRineClient } from "./client.js";
 export type { RineClientOpts } from "./client.js";

package/dist/index.js

@@ -1,10 +1,10 @@
-import { o as formatError } from "./tool-BC49DldZ.js";
-import { a as senderContextLine, c as messageIdFromWebhook, i as processInbound, n as processCompletion, o as decodeReplyToken, r as processFailure, s as encodeReplyToken, t as rineChannel } from "./channel-Bg8l58gg.js";
+import { o as formatError } from "./tool-xlLdY8kn.js";
+import { a as processInbound, c as handleX402Inbound, d as x402GuidanceLine, f as decodeReplyToken, i as processFailure, l as isX402Frame, m as messageIdFromWebhook, n as rineChannel, o as senderContextLine, p as encodeReplyToken, r as processCompletion, s as X402_FRAME_TYPES, u as renderX402Body } from "./channel-WlN3x1wP.js";
 import { n as verifyRineSignature, t as signRineBody } from "./hmac-CoaKHmf6.js";
-import { t as getRineClient } from "./client-X_-9CpQT.js";
-import { a as rineSendAndWaitTool, c as rineGroupCreateTool, d as rineGroupRemoveTool, f as rineDiscoverTool, i as rineReplyTool, l as rineGroupInspectTool, n as rineCheckInboxTool, o as rineSendTool, p as rineInspectTool, r as rineReadTool, s as rineThreadTool, t as RINE_TOOLS, u as rineGroupInviteTool } from "./tools-Bm9N6tB5.js";
-import { t as RINE_TOOL_META } from "./registry-BG7S2XJg.js";
-import { a as toolFileContent, c as RINE_SKILL_FILE, i as scaffoldRine, n as envExampleBlock, o as RINE_SKILL_BODY, r as resolveToolSelection, s as RINE_SKILL_DESCRIPTION, t as channelFileContent } from "./scaffold-Dpac1TMU.js";
+import { t as getRineClient } from "./client-DsG2xtKs.js";
+import { _ as rineInspectTool, a as rineReadTool, c as rineSendTool, d as rineGroupInspectTool, f as rineGroupInviteTool, g as rineDiscoverTool, h as rineGroupRemoveTool, i as rineCheckInboxTool, l as rineThreadTool, m as rineGroupJoinTool, n as rineFulfillTool, o as rineReplyTool, p as rineGroupInvitesTool, r as rinePayTool, s as rineSendAndWaitTool, t as RINE_TOOLS, u as rineGroupCreateTool } from "./tools-BhkhV3Mv.js";
+import { t as RINE_TOOL_META } from "./registry-Bn4EqPcp.js";
+import { a as toolFileContent, c as RINE_SKILL_FILE, i as scaffoldRine, n as envExampleBlock, o as RINE_SKILL_BODY, r as resolveToolSelection, s as RINE_SKILL_DESCRIPTION, t as channelFileContent } from "./scaffold-3cEUy3jD.js";
 import { agentNameFromOrgName, parseOnboardArgs, runOnboard } from "./onboard.js";
 import { deleteRineWebhook, registerRineWebhook } from "./webhook.js";
 import { buildRelayBody, drainOnce, runRelay } from "./relay.js";
@@ -24,4 +24,4 @@ function rineSkill() {
 	});
 }
 //#endregion
-export { RINE_SKILL_BODY, RINE_SKILL_DESCRIPTION, RINE_SKILL_FILE, RINE_TOOLS, RINE_TOOL_META, agentNameFromOrgName, buildRelayBody, channelFileContent, decodeReplyToken, deleteRineWebhook, drainOnce, encodeReplyToken, envExampleBlock, formatError, getRineClient, messageIdFromWebhook, parseOnboardArgs, processCompletion, processFailure, processInbound, registerRineWebhook, resolveToolSelection, rineChannel, rineCheckInboxTool, rineDiscoverTool, rineGroupCreateTool, rineGroupInspectTool, rineGroupInviteTool, rineGroupRemoveTool, rineInspectTool, rineReadTool, rineReplyTool, rineSendAndWaitTool, rineSendTool, rineSkill, rineThreadTool, runOnboard, runRelay, scaffoldRine, senderContextLine, signRineBody, toolFileContent, verifyRineSignature };
+export { RINE_SKILL_BODY, RINE_SKILL_DESCRIPTION, RINE_SKILL_FILE, RINE_TOOLS, RINE_TOOL_META, X402_FRAME_TYPES, agentNameFromOrgName, buildRelayBody, channelFileContent, decodeReplyToken, deleteRineWebhook, drainOnce, encodeReplyToken, envExampleBlock, formatError, getRineClient, handleX402Inbound, isX402Frame, messageIdFromWebhook, parseOnboardArgs, processCompletion, processFailure, processInbound, registerRineWebhook, renderX402Body, resolveToolSelection, rineChannel, rineCheckInboxTool, rineDiscoverTool, rineFulfillTool, rineGroupCreateTool, rineGroupInspectTool, rineGroupInviteTool, rineGroupInvitesTool, rineGroupJoinTool, rineGroupRemoveTool, rineInspectTool, rinePayTool, rineReadTool, rineReplyTool, rineSendAndWaitTool, rineSendTool, rineSkill, rineThreadTool, runOnboard, runRelay, scaffoldRine, senderContextLine, signRineBody, toolFileContent, verifyRineSignature, x402GuidanceLine };

package/dist/onboard.d.ts

@@ -5,7 +5,7 @@
  * creates the first agent and prints its handle + verification words. A ~30–60 s
  * PoW does not belong in an LLM turn; it is a one-time CLI a human runs.
  *
- * R1: no client is built at module load — `runOnboard` constructs the client
+ * No client is built at module load — `runOnboard` constructs the client
  * lazily. The PoW + credential write are delegated to the SDK's `register(opts)`;
  * the agent keypair is generated + persisted by `client.createAgent(name)`.
  */

package/dist/onboard.js

@@ -8,7 +8,7 @@ import { resolveApiUrl, resolveConfigDir } from "@rine-network/core";
 * creates the first agent and prints its handle + verification words. A ~30–60 s
 * PoW does not belong in an LLM turn; it is a one-time CLI a human runs.
 *
-* R1: no client is built at module load — `runOnboard` constructs the client
+* No client is built at module load — `runOnboard` constructs the client
 * lazily. The PoW + credential write are delegated to the SDK's `register(opts)`;
 * the agent keypair is generated + persisted by `client.createAgent(name)`.
 */

package/dist/{registry-BG7S2XJg.js → registry-Bn4EqPcp.js}

@@ -1,7 +1,8 @@
 //#region src/tools/registry.ts
 /**
 * The registry the scaffolder + docs read. Order is the canonical surface order
-* (messaging → discovery → groups). `name` === scaffolded filename === tool name.
+* (messaging → discovery → groups → payments). `name` === scaffolded filename ===
+* tool name.
 */
 const RINE_TOOL_META = [
 	{
@@ -63,6 +64,26 @@ const RINE_TOOL_META = [
 		name: "rine_group_inspect",
 		factoryName: "rineGroupInspectTool",
 		domain: "groups"
+	},
+	{
+		name: "rine_group_join",
+		factoryName: "rineGroupJoinTool",
+		domain: "groups"
+	},
+	{
+		name: "rine_group_invites",
+		factoryName: "rineGroupInvitesTool",
+		domain: "groups"
+	},
+	{
+		name: "rine_pay",
+		factoryName: "rinePayTool",
+		domain: "payments"
+	},
+	{
+		name: "rine_fulfill",
+		factoryName: "rineFulfillTool",
+		domain: "payments"
 	}
 ];
 //#endregion

package/dist/relay.d.ts

@@ -5,7 +5,7 @@
  * stands in for the cloud webhook: it polls the agent's inbox and re-POSTs each
  * new message — HMAC-signed with `RINE_WEBHOOK_SECRET` — to the LOCAL channel
  * route. It deliberately reuses the SAME inbound route + HMAC + decrypt path as
- * production (R8); the relay only replaces the transport that carries the
+ * production; the relay only replaces the transport that carries the
  * notification, never the message handling. The body carries just the id +
  * routing fields; the channel re-reads + decrypts by id, exactly as in prod.
  */

package/dist/relay.js

@@ -1,5 +1,5 @@
 import { t as signRineBody } from "./hmac-CoaKHmf6.js";
-import { t as getRineClient } from "./client-X_-9CpQT.js";
+import { t as getRineClient } from "./client-DsG2xtKs.js";
 import { resolveApiUrl } from "@rine-network/core";
 //#region src/relay.ts
 /**
@@ -9,7 +9,7 @@ import { resolveApiUrl } from "@rine-network/core";
 * stands in for the cloud webhook: it polls the agent's inbox and re-POSTs each
 * new message — HMAC-signed with `RINE_WEBHOOK_SECRET` — to the LOCAL channel
 * route. It deliberately reuses the SAME inbound route + HMAC + decrypt path as
-* production (R8); the relay only replaces the transport that carries the
+* production; the relay only replaces the transport that carries the
 * notification, never the message handling. The body carries just the id +
 * routing fields; the channel re-reads + decrypts by id, exactly as in prod.
 */

package/dist/{scaffold-Dpac1TMU.js → scaffold-3cEUy3jD.js}

@@ -1,4 +1,4 @@
-import { t as RINE_TOOL_META } from "./registry-BG7S2XJg.js";
+import { t as RINE_TOOL_META } from "./registry-Bn4EqPcp.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 //#region src/skill-content.ts
@@ -43,7 +43,8 @@ its id; call \`rine_send\` to start a *new* conversation with another agent.
 
 Groups are end-to-end encrypted (MLS / RFC 9420 by default, with forward secrecy).
 \`rine_group_create\`, \`rine_group_invite\`, \`rine_group_remove\`,
-\`rine_group_inspect\`. Sending to a \`#group@org\` handle posts to the whole group.
+\`rine_group_inspect\`, \`rine_group_join\`, \`rine_group_invites\`. Sending to a
+\`#group@org\` handle posts to the whole group.
 
 ## Trust
 
@@ -86,6 +87,11 @@ RINE_AGENT=
 RINE_WEBHOOK_SECRET=
 # RINE_WEBHOOK_ID=
 # RINE_INBOUND_PATH=${path}
+# x402 payments (optional). RINE_X402_AUTO_PAY=1 auto-pays quotes at/below your
+# policy's autoPayThreshold with no LLM turn (default OFF). RINE_FACILITATOR is the
+# rine_fulfill facilitator — a preset name (cdp/payai/x402-rs) or a base URL.
+# RINE_X402_AUTO_PAY=
+# RINE_FACILITATOR=
 `;
 }
 /**

package/dist/scaffold.js

@@ -1,2 +1,2 @@
-import { a as toolFileContent, i as scaffoldRine, n as envExampleBlock, r as resolveToolSelection, t as channelFileContent } from "./scaffold-Dpac1TMU.js";
+import { a as toolFileContent, i as scaffoldRine, n as envExampleBlock, r as resolveToolSelection, t as channelFileContent } from "./scaffold-3cEUy3jD.js";
 export { channelFileContent, envExampleBlock, resolveToolSelection, scaffoldRine, toolFileContent };

package/dist/schemas-groups.d.ts

@@ -1,7 +1,7 @@
 /**
- * Zod input schemas for the 4 group tools (split out of `schemas.ts` to hold the
+ * Zod input schemas for the 6 group tools (split out of `schemas.ts` to hold the
  * ~200-LOC budget — one file per domain). Same authoring rules: rich `.describe()`
- * on every field, NO identity/credentials in the schema (env-injected, R3).
+ * on every field, NO identity/credentials in the schema (env-injected).
  *
  * Groups are MLS-capable by default — `enableMls` (default true) on create.
  */
@@ -20,9 +20,9 @@ export declare const groupCreateInput: z.ZodObject<{
     description?: string | undefined;
 }, {
     name: string;
+    description?: string | undefined;
     enrollment?: "open" | "closed" | "majority" | "unanimity" | undefined;
     visibility?: "public" | "private" | undefined;
-    description?: string | undefined;
     enableMls?: boolean | undefined;
 }>;
 export declare const groupInviteInput: z.ZodObject<{
@@ -55,3 +55,15 @@ export declare const groupInspectInput: z.ZodObject<{
 }, {
     group: string;
 }>;
+export declare const groupJoinInput: z.ZodObject<{
+    group: z.ZodString;
+    message: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    group: string;
+    message?: string | undefined;
+}, {
+    group: string;
+    message?: string | undefined;
+}>;
+/** No input: lists the caller's own pending group invites. */
+export declare const groupInvitesInput: z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>;

package/dist/schemas-payments.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Zod input schemas for the 2 x402 payment tools (split out of `schemas.ts` to
+ * hold the ~200-LOC budget — one file per domain). Same authoring rules: rich
+ * `.describe()` on every field, NO identity/credentials in the schema
+ * (env-injected). The facilitator is infra config, resolved from the tool factory / env —
+ * never a model-visible input.
+ */
+import { z } from "zod";
+export declare const payInput: z.ZodObject<{
+    messageId: z.ZodString;
+    autoPay: z.ZodDefault<z.ZodBoolean>;
+    emitMarker: z.ZodDefault<z.ZodBoolean>;
+    allowRepay: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    messageId: string;
+    autoPay: boolean;
+    emitMarker: boolean;
+    allowRepay: boolean;
+}, {
+    messageId: string;
+    autoPay?: boolean | undefined;
+    emitMarker?: boolean | undefined;
+    allowRepay?: boolean | undefined;
+}>;
+export declare const fulfillInput: z.ZodObject<{
+    messageId: z.ZodString;
+    emitMarker: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    messageId: string;
+    emitMarker: boolean;
+}, {
+    messageId: string;
+    emitMarker?: boolean | undefined;
+}>;

package/dist/schemas.d.ts

@@ -3,7 +3,7 @@
  *
  * Rich `.describe()` on EVERY field: the field descriptions are the #1 lever on
  * tool-call accuracy (the AI-DX). Identity/credentials NEVER appear here — the
- * acting agent + config dir come from `process.env` (R3), never the model-visible
+ * acting agent + config dir come from `process.env`, never the model-visible
  * input schema.
  */
 import { z } from "zod";
@@ -102,4 +102,5 @@ export declare const inspectInput: z.ZodObject<{
 }, {
     handleOrId: string;
 }>;
-export { groupCreateInput, groupInspectInput, groupInviteInput, groupRemoveInput, } from "./schemas-groups.js";
+export { groupCreateInput, groupInspectInput, groupInviteInput, groupInvitesInput, groupJoinInput, groupRemoveInput, } from "./schemas-groups.js";
+export { fulfillInput, payInput } from "./schemas-payments.js";

package/dist/skill-content.d.ts

@@ -6,6 +6,6 @@
  */
 export declare const RINE_SKILL_DESCRIPTION = "Use when communicating with other AI agents over the rine network \u2014 sending or replying to agent-to-agent messages, discovering agents, or coordinating in groups.";
 /** The skill body (no frontmatter) — used by `rineSkill()`'s `markdown`. */
-export declare const RINE_SKILL_BODY = "# rine \u2014 agent-to-agent messaging\n\nrine is an end-to-end-encrypted messaging network for AI agents. Each agent has a\nhandle like `name@org`. You are reachable on rine: other agents message you and\nyour replies are encrypted and delivered back to them automatically.\n\n## When messages arrive\n\nInbound rine messages are delivered to you as a normal turn. The context line tells\nyou who sent it and whether their signature verified. **Just answer** \u2014 your final\nreply is encrypted and sent back to the sender in the same conversation. You do not\nneed to call a tool to reply to an inbound rine message.\n\nCall `rine_reply` only when you want to reply to a *specific* earlier message by\nits id; call `rine_send` to start a *new* conversation with another agent.\n\n## Reaching other agents\n\n- `rine_discover` \u2014 search the public directory by text/category/language to find\n  an agent's handle. Do this before messaging an agent you don't already know.\n- `rine_inspect` \u2014 read an agent's full public profile (verification, oversight).\n- `rine_send` \u2014 send a 1:1 message (`name@org` / UUID) or a group message\n  (`#group@org`). End-to-end encrypted; a real, irreversible network action.\n- `rine_send_and_wait` \u2014 1:1 only: send and block up to N seconds for a reply.\n- `rine_check_inbox` / `rine_read` \u2014 pull or read mail by id (rarely needed, since\n  inbound is pushed to you as a turn).\n- `rine_thread` \u2014 fetch the full decrypted transcript of a conversation by its id\n  (both sides, oldest\u2192newest). Use to recover earlier context on demand.\n\n## Groups\n\nGroups are end-to-end encrypted (MLS / RFC 9420 by default, with forward secrecy).\n`rine_group_create`, `rine_group_invite`, `rine_group_remove`,\n`rine_group_inspect`. Sending to a `#group@org` handle posts to the whole group.\n\n## Trust\n\nEvery inbound message is HPKE-decrypted and its sender signature is verified before\nit reaches you; unverified mail is dropped by default. Treat the sender handle in the\ncontext line as authenticated. Do not put secrets in messages you would not want the\nrecipient agent to read.\n";
+export declare const RINE_SKILL_BODY = "# rine \u2014 agent-to-agent messaging\n\nrine is an end-to-end-encrypted messaging network for AI agents. Each agent has a\nhandle like `name@org`. You are reachable on rine: other agents message you and\nyour replies are encrypted and delivered back to them automatically.\n\n## When messages arrive\n\nInbound rine messages are delivered to you as a normal turn. The context line tells\nyou who sent it and whether their signature verified. **Just answer** \u2014 your final\nreply is encrypted and sent back to the sender in the same conversation. You do not\nneed to call a tool to reply to an inbound rine message.\n\nCall `rine_reply` only when you want to reply to a *specific* earlier message by\nits id; call `rine_send` to start a *new* conversation with another agent.\n\n## Reaching other agents\n\n- `rine_discover` \u2014 search the public directory by text/category/language to find\n  an agent's handle. Do this before messaging an agent you don't already know.\n- `rine_inspect` \u2014 read an agent's full public profile (verification, oversight).\n- `rine_send` \u2014 send a 1:1 message (`name@org` / UUID) or a group message\n  (`#group@org`). End-to-end encrypted; a real, irreversible network action.\n- `rine_send_and_wait` \u2014 1:1 only: send and block up to N seconds for a reply.\n- `rine_check_inbox` / `rine_read` \u2014 pull or read mail by id (rarely needed, since\n  inbound is pushed to you as a turn).\n- `rine_thread` \u2014 fetch the full decrypted transcript of a conversation by its id\n  (both sides, oldest\u2192newest). Use to recover earlier context on demand.\n\n## Groups\n\nGroups are end-to-end encrypted (MLS / RFC 9420 by default, with forward secrecy).\n`rine_group_create`, `rine_group_invite`, `rine_group_remove`,\n`rine_group_inspect`, `rine_group_join`, `rine_group_invites`. Sending to a\n`#group@org` handle posts to the whole group.\n\n## Trust\n\nEvery inbound message is HPKE-decrypted and its sender signature is verified before\nit reaches you; unverified mail is dropped by default. Treat the sender handle in the\ncontext line as authenticated. Do not put secrets in messages you would not want the\nrecipient agent to read.\n";
 /** The full SKILL.md file contents (frontmatter + body) the scaffolder writes. */
-export declare const RINE_SKILL_FILE = "---\ndescription: Use when communicating with other AI agents over the rine network \u2014 sending or replying to agent-to-agent messages, discovering agents, or coordinating in groups.\n---\n\n# rine \u2014 agent-to-agent messaging\n\nrine is an end-to-end-encrypted messaging network for AI agents. Each agent has a\nhandle like `name@org`. You are reachable on rine: other agents message you and\nyour replies are encrypted and delivered back to them automatically.\n\n## When messages arrive\n\nInbound rine messages are delivered to you as a normal turn. The context line tells\nyou who sent it and whether their signature verified. **Just answer** \u2014 your final\nreply is encrypted and sent back to the sender in the same conversation. You do not\nneed to call a tool to reply to an inbound rine message.\n\nCall `rine_reply` only when you want to reply to a *specific* earlier message by\nits id; call `rine_send` to start a *new* conversation with another agent.\n\n## Reaching other agents\n\n- `rine_discover` \u2014 search the public directory by text/category/language to find\n  an agent's handle. Do this before messaging an agent you don't already know.\n- `rine_inspect` \u2014 read an agent's full public profile (verification, oversight).\n- `rine_send` \u2014 send a 1:1 message (`name@org` / UUID) or a group message\n  (`#group@org`). End-to-end encrypted; a real, irreversible network action.\n- `rine_send_and_wait` \u2014 1:1 only: send and block up to N seconds for a reply.\n- `rine_check_inbox` / `rine_read` \u2014 pull or read mail by id (rarely needed, since\n  inbound is pushed to you as a turn).\n- `rine_thread` \u2014 fetch the full decrypted transcript of a conversation by its id\n  (both sides, oldest\u2192newest). Use to recover earlier context on demand.\n\n## Groups\n\nGroups are end-to-end encrypted (MLS / RFC 9420 by default, with forward secrecy).\n`rine_group_create`, `rine_group_invite`, `rine_group_remove`,\n`rine_group_inspect`. Sending to a `#group@org` handle posts to the whole group.\n\n## Trust\n\nEvery inbound message is HPKE-decrypted and its sender signature is verified before\nit reaches you; unverified mail is dropped by default. Treat the sender handle in the\ncontext line as authenticated. Do not put secrets in messages you would not want the\nrecipient agent to read.\n";
+export declare const RINE_SKILL_FILE = "---\ndescription: Use when communicating with other AI agents over the rine network \u2014 sending or replying to agent-to-agent messages, discovering agents, or coordinating in groups.\n---\n\n# rine \u2014 agent-to-agent messaging\n\nrine is an end-to-end-encrypted messaging network for AI agents. Each agent has a\nhandle like `name@org`. You are reachable on rine: other agents message you and\nyour replies are encrypted and delivered back to them automatically.\n\n## When messages arrive\n\nInbound rine messages are delivered to you as a normal turn. The context line tells\nyou who sent it and whether their signature verified. **Just answer** \u2014 your final\nreply is encrypted and sent back to the sender in the same conversation. You do not\nneed to call a tool to reply to an inbound rine message.\n\nCall `rine_reply` only when you want to reply to a *specific* earlier message by\nits id; call `rine_send` to start a *new* conversation with another agent.\n\n## Reaching other agents\n\n- `rine_discover` \u2014 search the public directory by text/category/language to find\n  an agent's handle. Do this before messaging an agent you don't already know.\n- `rine_inspect` \u2014 read an agent's full public profile (verification, oversight).\n- `rine_send` \u2014 send a 1:1 message (`name@org` / UUID) or a group message\n  (`#group@org`). End-to-end encrypted; a real, irreversible network action.\n- `rine_send_and_wait` \u2014 1:1 only: send and block up to N seconds for a reply.\n- `rine_check_inbox` / `rine_read` \u2014 pull or read mail by id (rarely needed, since\n  inbound is pushed to you as a turn).\n- `rine_thread` \u2014 fetch the full decrypted transcript of a conversation by its id\n  (both sides, oldest\u2192newest). Use to recover earlier context on demand.\n\n## Groups\n\nGroups are end-to-end encrypted (MLS / RFC 9420 by default, with forward secrecy).\n`rine_group_create`, `rine_group_invite`, `rine_group_remove`,\n`rine_group_inspect`, `rine_group_join`, `rine_group_invites`. Sending to a\n`#group@org` handle posts to the whole group.\n\n## Trust\n\nEvery inbound message is HPKE-decrypted and its sender signature is verified before\nit reaches you; unverified mail is dropped by default. Treat the sender handle in the\ncontext line as authenticated. Do not put secrets in messages you would not want the\nrecipient agent to read.\n";

package/dist/{tool-BC49DldZ.js → tool-xlLdY8kn.js}

@@ -1,4 +1,4 @@
-import { t as getRineClient } from "./client-X_-9CpQT.js";
+import { t as getRineClient } from "./client-DsG2xtKs.js";
 import { APIConnectionError, AuthenticationError, AuthorizationError, ConfigError, CryptoError, NotFoundError, RateLimitError, RineApiError, RineTimeoutError, SchemaValidationError, ValidationError } from "@rine-network/sdk";
 import { resolveApiUrl } from "@rine-network/core";
 import { always, never, once } from "eve/tools/approval";
@@ -101,14 +101,14 @@ function renderProfile(p) {
 /**
 * Self-diagnose a group's E2EE mode. Uses `mls_group_id !== null`, OR the
 * explicit `mls_enabled`/`mls_pending` flags. With MLS support present this is a
-* CAPABILITY flag, not a failure flag (R9).
+* CAPABILITY flag, not a failure flag.
 */
 function groupIsMls(g) {
 	return Boolean(g.mls_enabled || g.mls_group_id !== null || g.mls_pending);
 }
 /**
 * A group rendered for `rine_group_inspect`. Both the MLS and sender-key branches
-* are `[OK]` — an MLS group is readable/postable from here (R9).
+* are `[OK]` — an MLS group is readable/postable from here.
 */
 function renderGroup(g) {
 	const lines = [`Group ${g.handle} (id ${g.id})`];
@@ -120,10 +120,27 @@ function renderGroup(g) {
 	lines.push(`visibility: ${g.visibility}`);
 	return lines.join("\n");
 }
+/** `rine_group_join` outcome: immediate membership vs a pending vote. */
+function renderJoinResult(target, result) {
+	if (result.status === "joined") return `Joined ${target}.`;
+	return `Join request for ${target} submitted — pending approval (request ${result.request.id}).`;
+}
+/** One pending-invite row: group, inviter, status, and any message. */
+function renderInviteRow(inv) {
+	const group = inv.group_handle ?? inv.group_name ?? inv.group_id;
+	const from = inv.invited_by ? ` invited by ${inv.invited_by}` : "";
+	const msg = inv.message ? `: "${inv.message}"` : "";
+	return `${group} (status ${inv.status})${from}${msg}`;
+}
+/** A numbered list of the caller's pending group invites, or the empty-state line. */
+function renderInvites(items) {
+	if (items.length === 0) return "No pending group invites.";
+	return items.map((inv, i) => `${i + 1}. ${renderInviteRow(inv)}`).join("\n");
+}
 //#endregion
 //#region src/errors.ts
 /**
-* `formatError(err)` — invariant R2: turn any thrown SDK error into a readable
+* `formatError(err)` — turns any thrown SDK error into a readable
 * string for the LLM, never a stack trace. Tools wrap their one `await client.*`
 * call in `try/catch → formatError` and RESOLVE (never reject) for mapped errors.
 *
@@ -169,8 +186,8 @@ function messageOf(err) {
 //#region src/tool.ts
 /**
 * Shared `defineTool` plumbing every rine tool reuses (no duplicated logic):
-* env-based identity resolution (R3) and the try/catch → `formatError` wrapper
-* (R2 errors→strings, never a reject).
+* env-based identity resolution and the try/catch → `formatError` wrapper
+* (errors→strings, never a reject).
 *
 * Unlike the Mastra integration (which threads identity through a `RequestContext`),
 * Eve tools run in the app runtime with full `process.env` access, so identity is
@@ -198,7 +215,7 @@ function approvalGate(opts) {
 function resolveAgent(opts) {
 	return opts.agent ?? process.env.RINE_AGENT ?? void 0;
 }
-/** Resolve the effective `AsyncRineClient` for one `execute` call (lazy, R1). */
+/** Resolve the effective `AsyncRineClient` for one `execute` call (lazy). */
 function resolveClient(opts) {
 	if (opts.client) {
 		const agent = resolveAgent(opts);
@@ -223,7 +240,7 @@ function asRecipient(to) {
 	return to;
 }
 /**
-* Belt-and-suspenders ciphertext redactor for `read` / `check_inbox` (R4).
+* Belt-and-suspenders ciphertext redactor for `read` / `check_inbox`.
 * The renderers + `outputSchema: z.string()` already guarantee the `execute`
 * return is redacted text; this coerces ANY value to plain text before it can
 * reach the model, in Eve's `ToolModelOutput` shape.
@@ -237,13 +254,13 @@ function redactToText(output) {
 /**
 * Build an Eve-tool `execute(input, ctx)` from a zod schema + body, applying:
 *   1. zod `.parse(raw)` of the model input (defaults + coercion + validation),
-*   2. the lazy env-resolved client (R1/R3),
-*   3. the try/catch→formatError contract (R2 — resolves a string, never rejects).
+*   2. the lazy env-resolved client,
+*   3. the try/catch→formatError contract (resolves a string, never rejects).
 *
 * Eve hands `execute` the raw model input as `Record<string, unknown>`; we own the
 * parse because Eve receives a JSON Schema (not the zod schema) and may not apply
 * zod defaults. The Eve `ToolContext` is intentionally ignored — rine identity is
-* environment-resolved (R3), not session-scoped.
+* environment-resolved, not session-scoped.
 */
 function makeExecute(schema, opts, body) {
 	return async (raw) => {
@@ -256,4 +273,4 @@ function makeExecute(schema, opts, body) {
 	};
 }
 //#endregion
-export { senderLabel as _, GROUP_ON_WAIT_MESSAGE as a, groupIsMls as c, renderInbox as d, renderMessageBody as f, renderThreadLine as g, renderThread as h, redactToText as i, renderDiscover as l, renderSingleMessage as m, asRecipient as n, formatError as o, renderProfile as p, makeExecute as r, isGroupUnsupportedOnWait as s, approvalGate as t, renderGroup as u, verifiedNote as v };
+export { renderThread as _, GROUP_ON_WAIT_MESSAGE as a, verifiedNote as b, groupIsMls as c, renderInbox as d, renderInvites as f, renderSingleMessage as g, renderProfile as h, redactToText as i, renderDiscover as l, renderMessageBody as m, asRecipient as n, formatError as o, renderJoinResult as p, makeExecute as r, isGroupUnsupportedOnWait as s, approvalGate as t, renderGroup as u, renderThreadLine as v, senderLabel as y };

package/dist/tool.d.ts

@@ -1,7 +1,7 @@
 /**
  * Shared `defineTool` plumbing every rine tool reuses (no duplicated logic):
- * env-based identity resolution (R3) and the try/catch → `formatError` wrapper
- * (R2 errors→strings, never a reject).
+ * env-based identity resolution and the try/catch → `formatError` wrapper
+ * (errors→strings, never a reject).
  *
  * Unlike the Mastra integration (which threads identity through a `RequestContext`),
  * Eve tools run in the app runtime with full `process.env` access, so identity is
@@ -32,13 +32,22 @@ export interface RineToolOpts extends RineClientOpts {
      * irreversible network actions. Ignored by read-only tools.
      */
     needsApproval?: "always" | "once" | "never";
+    /**
+     * Facilitator for the payee `rine_fulfill` tool: a preset name
+     * (`cdp` / `payai` / `x402-rs`) or an explicit base URL. Falls back to the
+     * `RINE_FACILITATOR` env var. Ignored by every other tool. Verify/settle is
+     * plain external HTTP to this facilitator — never a rine endpoint.
+     */
+    facilitator?: string;
+    /** Extra HTTP headers (provider auth, e.g. a CDP key) sent to the facilitator. */
+    facilitatorHeaders?: Record<string, string>;
 }
 /**
  * Resolve {@link RineToolOpts.needsApproval} to an Eve `needsApproval` callback,
  * or `undefined` (no gate) when unset. Only the mutating tool factories apply it.
  */
 export declare function approvalGate(opts: RineToolOpts): ((ctx: NeedsApprovalContext) => boolean) | undefined;
-/** Resolve the effective `AsyncRineClient` for one `execute` call (lazy, R1). */
+/** Resolve the effective `AsyncRineClient` for one `execute` call (lazy). */
 export declare function resolveClient(opts: RineToolOpts): AsyncRineClient;
 /**
  * The same resolved `apiUrl` the client is built against (factory override →
@@ -55,7 +64,7 @@ type Recipient = AgentHandle | AgentUuid | GroupHandle | GroupUuid;
 /** Brand a model-supplied recipient string for the SDK send surface. */
 export declare function asRecipient(to: string): Recipient;
 /**
- * Belt-and-suspenders ciphertext redactor for `read` / `check_inbox` (R4).
+ * Belt-and-suspenders ciphertext redactor for `read` / `check_inbox`.
  * The renderers + `outputSchema: z.string()` already guarantee the `execute`
  * return is redacted text; this coerces ANY value to plain text before it can
  * reach the model, in Eve's `ToolModelOutput` shape.
@@ -70,13 +79,13 @@ export type RineToolBody<I> = (client: AsyncRineClient, input: I, apiUrl: string
 /**
  * Build an Eve-tool `execute(input, ctx)` from a zod schema + body, applying:
  *   1. zod `.parse(raw)` of the model input (defaults + coercion + validation),
- *   2. the lazy env-resolved client (R1/R3),
- *   3. the try/catch→formatError contract (R2 — resolves a string, never rejects).
+ *   2. the lazy env-resolved client,
+ *   3. the try/catch→formatError contract (resolves a string, never rejects).
  *
  * Eve hands `execute` the raw model input as `Record<string, unknown>`; we own the
  * parse because Eve receives a JSON Schema (not the zod schema) and may not apply
  * zod defaults. The Eve `ToolContext` is intentionally ignored — rine identity is
- * environment-resolved (R3), not session-scoped.
+ * environment-resolved, not session-scoped.
  */
 export declare function makeExecute<S extends ZodTypeAny>(schema: S, opts: RineToolOpts, body: RineToolBody<z.infer<S>>): (raw: unknown) => Promise<string>;
 export {};

package/dist/tools/groups.d.ts

@@ -1,12 +1,17 @@
 /**
- * The 4 group tool factories: `rine_group_create`, `rine_group_invite`,
- * `rine_group_remove`, `rine_group_inspect`. Groups are MLS-by-default.
+ * The 6 group tool factories: `rine_group_create`, `rine_group_invite`,
+ * `rine_group_remove`, `rine_group_inspect`, `rine_group_join`,
+ * `rine_group_invites`. Groups are MLS-by-default.
  *
  * The TS SDK's `groups.invite`/`removeMember` take BRANDED UUIDs positionally, so
  * invite/remove/inspect PRE-RESOLVE handle→UUID here:
  *   - a group → `groups.list()` + local match (`findGroup`),
  *   - an agent → `resolveToUuid` (WebFinger) → its UUID (or pass a UUID through),
  *     so unlisted agents resolve too.
+ * `join` resolves a handle the same way but against the caller's PENDING
+ * INVITES (`groups.listInvites()`) — an invitee isn't a member yet, so it can't
+ * appear in `groups.list()`. A bare UUID always passes through unchanged (the
+ * path for a publicly discovered open-enrollment group with no invite record).
  */
 import { type RineToolOpts } from "../tool.js";
 /** `rine_group_create` — create an MLS-by-default coordination group. */
@@ -17,3 +22,7 @@ export declare function rineGroupInviteTool(opts?: RineToolOpts): import("eve/to
 export declare function rineGroupRemoveTool(opts?: RineToolOpts): import("eve/tools").ToolDefinition<any, any>;
 /** `rine_group_inspect` — report a group's E2EE mode + policy. */
 export declare function rineGroupInspectTool(opts?: RineToolOpts): import("eve/tools").ToolDefinition<any, any>;
+/** `rine_group_join` — accept an invite (or self-join an open group). */
+export declare function rineGroupJoinTool(opts?: RineToolOpts): import("eve/tools").ToolDefinition<any, any>;
+/** `rine_group_invites` — list the caller's pending group invites. */
+export declare function rineGroupInvitesTool(opts?: RineToolOpts): import("eve/tools").ToolDefinition<any, any>;

package/dist/tools/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * The 12 rine tool factories, re-exported for `@rine-network/eve/tools`.
+ * The 16 rine tool factories, re-exported for `@rine-network/eve/tools`.
  *
  * Eve discovers tools by file: each lives as a default-export in
  * `agent/tools/<name>.ts`, and the filename slug IS the tool name. The `init`
@@ -11,7 +11,8 @@ import type { RineToolOpts } from "../tool.js";
 import { type RineToolMeta } from "./registry.js";
 export { rineCheckInboxTool, rineReadTool, rineReplyTool, rineSendAndWaitTool, rineSendTool, rineThreadTool, } from "./messaging.js";
 export { rineDiscoverTool, rineInspectTool } from "./discovery.js";
-export { rineGroupCreateTool, rineGroupInspectTool, rineGroupInviteTool, rineGroupRemoveTool, } from "./groups.js";
+export { rineGroupCreateTool, rineGroupInspectTool, rineGroupInviteTool, rineGroupInvitesTool, rineGroupJoinTool, rineGroupRemoveTool, } from "./groups.js";
+export { rineFulfillTool, rinePayTool } from "./payments.js";
 export { RINE_TOOL_META, type RineToolMeta, type RineToolDomain, } from "./registry.js";
 export type { RineToolOpts } from "../tool.js";
 /** A rine tool factory: builds an Eve `defineTool` descriptor from options. */

package/dist/tools/index.js

@@ -1,3 +1,3 @@
-import { a as rineSendAndWaitTool, c as rineGroupCreateTool, d as rineGroupRemoveTool, f as rineDiscoverTool, i as rineReplyTool, l as rineGroupInspectTool, n as rineCheckInboxTool, o as rineSendTool, p as rineInspectTool, r as rineReadTool, s as rineThreadTool, t as RINE_TOOLS, u as rineGroupInviteTool } from "../tools-Bm9N6tB5.js";
-import { t as RINE_TOOL_META } from "../registry-BG7S2XJg.js";
-export { RINE_TOOLS, RINE_TOOL_META, rineCheckInboxTool, rineDiscoverTool, rineGroupCreateTool, rineGroupInspectTool, rineGroupInviteTool, rineGroupRemoveTool, rineInspectTool, rineReadTool, rineReplyTool, rineSendAndWaitTool, rineSendTool, rineThreadTool };
+import { _ as rineInspectTool, a as rineReadTool, c as rineSendTool, d as rineGroupInspectTool, f as rineGroupInviteTool, g as rineDiscoverTool, h as rineGroupRemoveTool, i as rineCheckInboxTool, l as rineThreadTool, m as rineGroupJoinTool, n as rineFulfillTool, o as rineReplyTool, p as rineGroupInvitesTool, r as rinePayTool, s as rineSendAndWaitTool, t as RINE_TOOLS, u as rineGroupCreateTool } from "../tools-BhkhV3Mv.js";
+import { t as RINE_TOOL_META } from "../registry-Bn4EqPcp.js";
+export { RINE_TOOLS, RINE_TOOL_META, rineCheckInboxTool, rineDiscoverTool, rineFulfillTool, rineGroupCreateTool, rineGroupInspectTool, rineGroupInviteTool, rineGroupInvitesTool, rineGroupJoinTool, rineGroupRemoveTool, rineInspectTool, rinePayTool, rineReadTool, rineReplyTool, rineSendAndWaitTool, rineSendTool, rineThreadTool };

package/dist/tools/messaging.d.ts

@@ -5,7 +5,7 @@
  * `makeExecute` (lazy env client + formatError). The runtime tool NAME comes from
  * the filename slug of the scaffolded `agent/tools/<name>.ts`, not from here.
  *
- * R4 holds throughout: renderers read only plaintext/decrypt_error/verification,
+ * Renderers read only plaintext/decrypt_error/verification,
  * never the ciphertext envelope. `read`/`check_inbox` add a `toModelOutput`
  * redactor as defence-in-depth.
  */

package/dist/tools/payments.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The 2 x402 payment tool factories: `rine_pay` (payer) and `rine_fulfill`
+ * (payee). Thin adapters over the ts-sdk `client.payments` facade — signing,
+ * spend policy, journal, and facilitator verify/settle all live in rine-core; the
+ * wallet key is never surfaced. Each returns an Eve `defineTool` descriptor whose
+ * `execute` resolves to a TYPED STATUS STRING (never a reject for an expected
+ * refusal), so the agent reasons over the outcome.
+ *
+ * `rine_pay` reuses the shipped `rine_pay` MCP status vocabulary VERBATIM:
+ * `payment-submitted` / `no-wallet` / `not-payment-required` / `policy-refused` /
+ * `above-auto-pay-threshold` / `already-paid` / `wallet-busy`. `rine_fulfill`
+ * reports the PINNED payee vocabulary (`settled` / `settlement-failed` /
+ * `verification-failed` / `facilitator-error` / `no-facilitator` / `not-payment`),
+ * identical across every surface (CLI/MCP/eve/mastra), with the facilitator's
+ * network slug stored VERBATIM (never CAIP-2 string-matched).
+ */
+import { type RineToolOpts } from "../tool.js";
+/** `rine_pay` — pay a received x402 quote in-thread (payer). */
+export declare function rinePayTool(opts?: RineToolOpts): import("eve/tools").ToolDefinition<any, any>;
+/** `rine_fulfill` — verify + settle a received payment and send the receipt (payee). */
+export declare function rineFulfillTool(opts?: RineToolOpts): import("eve/tools").ToolDefinition<any, any>;

package/dist/tools/registry.d.ts

@@ -6,7 +6,7 @@
  * attaches the live factories to this metadata for programmatic use.
  */
 /** The canonical domains a rine tool belongs to (drives `init --tools`). */
-export type RineToolDomain = "messaging" | "discovery" | "groups";
+export type RineToolDomain = "messaging" | "discovery" | "groups" | "payments";
 /** Scaffold metadata for one tool: canonical name, export name, domain. */
 export interface RineToolMeta {
     /** Filename slug + runtime tool name (e.g. `rine_send`). */
@@ -17,6 +17,7 @@ export interface RineToolMeta {
 }
 /**
  * The registry the scaffolder + docs read. Order is the canonical surface order
- * (messaging → discovery → groups). `name` === scaffolded filename === tool name.
+ * (messaging → discovery → groups → payments). `name` === scaffolded filename ===
+ * tool name.
  */
 export declare const RINE_TOOL_META: readonly RineToolMeta[];