@rine-network/eve 0.1.0

package/dist/tools/messaging.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The 5 messaging tool factories: `rine_send`, `rine_send_and_wait`,
+ * `rine_check_inbox`, `rine_read`, `rine_reply`. Each returns an Eve `defineTool`
+ * descriptor — one `AsyncRineClient` call rendered to a string, wrapped by
+ * `makeExecute` (lazy env client + formatError). The runtime tool NAME comes from
+ * the filename slug of the scaffolded `agent/tools/<name>.ts`, not from here.
+ *
+ * R4 holds throughout: renderers read only plaintext/decrypt_error/verification,
+ * never the ciphertext envelope. `read`/`check_inbox` add a `toModelOutput`
+ * redactor as defence-in-depth.
+ */
+import { type RineToolOpts } from "../tool.js";
+/** `rine_send` — send a 1:1 or `#`-group message (the SDK auto-routes groups). */
+export declare function rineSendTool(opts?: RineToolOpts): import("eve/tools").ToolDefinition<any, any>;
+/** `rine_send_and_wait` — 1:1 send that blocks for a reply (ms timeout). */
+export declare function rineSendAndWaitTool(opts?: RineToolOpts): import("eve/tools").ToolDefinition<any, any>;
+/**
+ * `rine_check_inbox` — poll the newest new messages, decrypt them, then
+ * best-effort `markDelivered` the decryptable ids so a later check returns only
+ * newer mail. On ack failure: warn but still return the reads.
+ */
+export declare function rineCheckInboxTool(opts?: RineToolOpts): import("eve/tools").ToolDefinition<any, any>;
+/** `rine_read` — fetch + decrypt one message by id. */
+export declare function rineReadTool(opts?: RineToolOpts): import("eve/tools").ToolDefinition<any, any>;
+/** `rine_thread` — fetch the both-sided, decrypted transcript of a conversation. */
+export declare function rineThreadTool(opts?: RineToolOpts): import("eve/tools").ToolDefinition<any, any>;
+/** `rine_reply` — reply to a message, threading into the same conversation. */
+export declare function rineReplyTool(opts?: RineToolOpts): import("eve/tools").ToolDefinition<any, any>;

package/dist/tools/registry.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Pure tool metadata (name / export name / domain) — NO `eve` import, NO factory
+ * references. The scaffolder and CLI depend only on this, so `init` runs without
+ * resolving the `eve` peer dependency (the eve-importing factories load only when
+ * the Eve runtime imports the scaffolded `agent/tools/*.ts` files). `tools/index.ts`
+ * attaches the live factories to this metadata for programmatic use.
+ */
+/** The canonical domains a rine tool belongs to (drives `init --tools`). */
+export type RineToolDomain = "messaging" | "discovery" | "groups";
+/** Scaffold metadata for one tool: canonical name, export name, domain. */
+export interface RineToolMeta {
+    /** Filename slug + runtime tool name (e.g. `rine_send`). */
+    readonly name: string;
+    /** Named export in `@rine-network/eve/tools` that builds the descriptor. */
+    readonly factoryName: string;
+    readonly domain: RineToolDomain;
+}
+/**
+ * The registry the scaffolder + docs read. Order is the canonical surface order
+ * (messaging → discovery → groups). `name` === scaffolded filename === tool name.
+ */
+export declare const RINE_TOOL_META: readonly RineToolMeta[];

package/dist/tools-Bm9N6tB5.js

@@ -0,0 +1,369 @@
+import { a as GROUP_ON_WAIT_MESSAGE, c as groupIsMls, d as renderInbox, f as renderMessageBody, h as renderThread, i as redactToText, l as renderDiscover, m as renderSingleMessage, n as asRecipient, p as renderProfile, r as makeExecute, s as isGroupUnsupportedOnWait, t as approvalGate, u as renderGroup, v as verifiedNote } from "./tool-BC49DldZ.js";
+import { t as RINE_TOOL_META } from "./registry-BG7S2XJg.js";
+import { NotFoundError, asAgentUuid, asGroupUuid, asMessageUuid } from "@rine-network/sdk";
+import { UUID_RE, normalizeHandle, resolveToUuid } from "@rine-network/core";
+import { z } from "zod";
+import { defineTool } from "eve/tools";
+import { zodToJsonSchema } from "zod-to-json-schema";
+//#region src/_zod.ts
+/**
+* Convert a zod schema to a plain JSON Schema for `defineTool`'s `inputSchema`.
+* Returns `any` deliberately: it bridges into Eve's internal `JsonObject` type,
+* which is not exported for us to name.
+*/
+function jsonSchema(schema) {
+	return zodToJsonSchema(schema, { $refStrategy: "none" });
+}
+/** The shared `outputSchema` for every rine tool: a JSON-Schema string. */
+const STRING_OUTPUT = { type: "string" };
+//#endregion
+//#region src/schemas-groups.ts
+/**
+* Zod input schemas for the 4 group tools (split out of `schemas.ts` to hold the
+* ~200-LOC budget — one file per domain). Same authoring rules: rich `.describe()`
+* on every field, NO identity/credentials in the schema (env-injected, R3).
+*
+* Groups are MLS-capable by default — `enableMls` (default true) on create.
+*/
+const groupCreateInput = z.object({
+	name: z.string().describe("Human-readable group name. A group handle is derived from it."),
+	enrollment: z.enum([
+		"open",
+		"closed",
+		"majority",
+		"unanimity"
+	]).default("closed").describe("Who may join and how: `open` (anyone), `closed` (invite-only, default), `majority` (member vote), `unanimity` (all must approve)."),
+	visibility: z.enum(["public", "private"]).default("private").describe("`public` (listed in discovery) or `private` (hidden, default)."),
+	description: z.string().optional().describe("Optional group description."),
+	enableMls: z.boolean().default(true).describe("Create the group with MLS (RFC 9420) end-to-end encryption (default true). MLS gives forward secrecy and post-compromise security; disable only to force the legacy sender-key scheme.")
+});
+const groupInviteInput = z.object({
+	group: z.string().describe("The target group: a handle (`#name@org`) or a UUID. Resolved to a UUID before inviting."),
+	agentToInvite: z.string().describe("The agent to invite: a handle (`name@org`) or a UUID. Resolved to a UUID before inviting."),
+	message: z.string().optional().describe("Optional message included with the invite.")
+});
+const groupRemoveInput = z.object({
+	group: z.string().describe("The target group: a handle (`#name@org`) or a UUID. Resolved to a UUID before removal."),
+	agentId: z.string().describe("The member to remove: a handle (`name@org`) or a UUID. Group keys are rotated after removal.")
+});
+const groupInspectInput = z.object({ group: z.string().describe("The group to inspect: a handle (`#name@org`) or a UUID. Reports its E2EE mode and policy.") });
+//#endregion
+//#region src/schemas.ts
+/**
+* Shared Zod input schemas for the 12 rine tools.
+*
+* Rich `.describe()` on EVERY field: the field descriptions are the #1 lever on
+* tool-call accuracy (the AI-DX). Identity/credentials NEVER appear here — the
+* acting agent + config dir come from `process.env` (R3), never the model-visible
+* input schema.
+*/
+const DEFAULT_MESSAGE_TYPE = "rine.v1.task_request";
+const DEFAULT_REPLY_TYPE = "rine.v1.task_response";
+const sendInput = z.object({
+	to: z.string().describe("Recipient address: a 1:1 agent handle `name@org`, a UUID, or a group handle prefixed with `#` (e.g. `#ops@acme`). A `#` target sends to the whole group over its E2EE channel (MLS or sender-key, chosen automatically)."),
+	body: z.string().describe("The plaintext message text to send. It is end-to-end encrypted before transmission."),
+	messageType: z.string().default(DEFAULT_MESSAGE_TYPE).describe("The rine message type, e.g. `rine.v1.task_request` (default) or `rine.v1.text`. Leave as the default unless you know the recipient expects a specific type."),
+	idempotencyKey: z.string().optional().describe("Optional idempotency key. Reusing the same key for a retry prevents a duplicate send if the first attempt's response was lost.")
+});
+const sendAndWaitInput = z.object({
+	to: z.string().describe("Recipient agent address (1:1 ONLY): a handle `name@org` or a UUID. Group handles (`#…`) are NOT supported here — use rine_send for groups."),
+	body: z.string().describe("The plaintext message text to send. End-to-end encrypted before transmission."),
+	waitSeconds: z.number().int().min(1).max(300).default(30).describe("How long to block waiting for a reply, in SECONDS (1–300, default 30). Returns the reply if one arrives in time, otherwise a 'no reply' note."),
+	messageType: z.string().default(DEFAULT_MESSAGE_TYPE).describe(`The rine message type (default \`${DEFAULT_MESSAGE_TYPE}\`).`)
+});
+const checkInboxInput = z.object({ limit: z.number().int().min(1).max(100).default(20).describe("Maximum number of new messages to fetch and decrypt (1–100, default 20). Fetched messages are marked delivered so a later check returns only newer mail.") });
+const readInput = z.object({ messageId: z.string().describe("The UUID of the message to fetch and decrypt. Returns the decrypted body and signature status.") });
+const replyInput = z.object({
+	messageId: z.string().describe("The UUID of the message you are replying to. The reply threads into the same conversation."),
+	body: z.string().describe("The plaintext reply text. End-to-end encrypted before transmission."),
+	messageType: z.string().default(DEFAULT_REPLY_TYPE).describe(`The rine message type for the reply (default \`${DEFAULT_REPLY_TYPE}\`).`)
+});
+const threadInput = z.object({
+	conversationId: z.string().describe("The UUID of the conversation to fetch the transcript of. Returns every turn (yours and the peer's) decrypted and role-tagged, oldest→newest."),
+	limit: z.number().int().min(1).max(100).optional().describe("Optional max number of most-recent turns to return (1–100). Omit for the server default.")
+});
+const discoverInput = z.object({
+	q: z.string().optional().describe("Free-text search query matched against agent names, handles, and descriptions."),
+	category: z.string().optional().describe("Filter by agent category (e.g. `research`, `support`)."),
+	language: z.string().optional().describe("Filter by the agent's working language (e.g. `en`, `de`)."),
+	verified: z.boolean().optional().describe("When true, return only verified agents; when false, only unverified; omit for both."),
+	limit: z.number().int().min(1).max(100).default(10).describe("Maximum number of agents to return (1–100, default 10).")
+});
+const inspectInput = z.object({ handleOrId: z.string().describe("An agent handle (`name@org`, resolved via WebFinger) or a UUID. Returns the full public profile.") });
+//#endregion
+//#region src/tools/discovery.ts
+/**
+* The 2 discovery tool factories: `rine_discover`, `rine_inspect`. Both are
+* unauthenticated directory reads.
+*/
+/** `rine_discover` — search the public agent directory. */
+function rineDiscoverTool(opts = {}) {
+	return defineTool({
+		description: "Search the public rine agent directory by free text, category, language, and/or verification status. Returns a numbered list of matching agents with their handles. Use this to find an agent's handle before messaging it.",
+		inputSchema: jsonSchema(discoverInput),
+		outputSchema: STRING_OUTPUT,
+		execute: makeExecute(discoverInput, opts, async (client, i) => {
+			return renderDiscover((await client.discover({
+				q: i.q,
+				category: i.category,
+				language: i.language,
+				verified: i.verified,
+				limit: i.limit
+			})).items);
+		})
+	});
+}
+/** `rine_inspect` — fetch one agent's full public profile. */
+function rineInspectTool(opts = {}) {
+	return defineTool({
+		description: "Fetch the full public profile of an agent by its handle (`name@org`) or UUID — name, description, category, verification, and human-oversight status.",
+		inputSchema: jsonSchema(inspectInput),
+		outputSchema: STRING_OUTPUT,
+		execute: makeExecute(inspectInput, opts, async (client, i) => {
+			return renderProfile(await client.inspect(i.handleOrId));
+		})
+	});
+}
+//#endregion
+//#region src/tools/groups.ts
+/**
+* The 4 group tool factories: `rine_group_create`, `rine_group_invite`,
+* `rine_group_remove`, `rine_group_inspect`. Groups are MLS-by-default.
+*
+* The TS SDK's `groups.invite`/`removeMember` take BRANDED UUIDs positionally, so
+* invite/remove/inspect PRE-RESOLVE handle→UUID here:
+*   - a group → `groups.list()` + local match (`findGroup`),
+*   - an agent → `resolveToUuid` (WebFinger) → its UUID (or pass a UUID through),
+*     so unlisted agents resolve too.
+*/
+/** True for a bare UUID string (no `@`, matches the rine UUID shape). */
+function isUuid(s) {
+	return UUID_RE.test(s);
+}
+/** A handle's bare local name: `#ops@acme` / `ops` → `ops`. */
+function bareLocalName(handle) {
+	return handle.replace(/^#/, "").split("@")[0] ?? handle;
+}
+/** Match a group among the caller's groups by UUID, full handle, or bare name. */
+function findGroup(groups, target) {
+	if (isUuid(target)) return groups.find((g) => g.id === target);
+	if (!target.includes("@")) {
+		const want = bareLocalName(target);
+		return groups.find((g) => bareLocalName(g.handle) === want);
+	}
+	const want = normalizeHandle(target.startsWith("#") ? target : `#${target}`);
+	return groups.find((g) => normalizeHandle(g.handle) === want);
+}
+/** Resolve a group handle/UUID to its `GroupUuid` via the caller's group list. */
+async function resolveGroupUuid(client, target) {
+	if (isUuid(target)) return asGroupUuid(target);
+	const match = findGroup((await client.groups.list()).items, target);
+	if (!match) throw new NotFoundError(`No group '${target}' among the groups this agent belongs to`);
+	return asGroupUuid(match.id);
+}
+/** Resolve an agent handle/UUID to its `AgentUuid` (UUIDs pass through). */
+async function resolveAgentUuid(apiUrl, target) {
+	if (isUuid(target)) return asAgentUuid(target);
+	return asAgentUuid(await resolveToUuid(apiUrl, target));
+}
+/** `rine_group_create` — create an MLS-by-default coordination group. */
+function rineGroupCreateTool(opts = {}) {
+	return defineTool({
+		description: "Create a new end-to-end-encrypted coordination group. By default the group uses MLS (RFC 9420) encryption with forward secrecy. This is a real, irreversible network action. Returns the new group handle, id, E2EE mode, and enrollment policy.",
+		inputSchema: jsonSchema(groupCreateInput),
+		outputSchema: STRING_OUTPUT,
+		needsApproval: approvalGate(opts),
+		execute: makeExecute(groupCreateInput, opts, async (client, i) => {
+			const g = await client.groups.create(i.name, {
+				description: i.description,
+				enrollment: i.enrollment,
+				visibility: i.visibility,
+				enableMls: i.enableMls
+			});
+			const mode = groupIsMls(g) ? "MLS" : "sender-key";
+			return `Created group ${g.handle} (id ${g.id}, ${mode} E2EE, enrollment ${g.enrollment_policy}).`;
+		})
+	});
+}
+/** `rine_group_invite` — invite an agent into a group (handle→UUID pre-resolved). */
+function rineGroupInviteTool(opts = {}) {
+	return defineTool({
+		description: "Invite an agent into a group your agent administers (group and agent may be handles or UUIDs). This is a real, irreversible network action. Returns the invite status.",
+		inputSchema: jsonSchema(groupInviteInput),
+		outputSchema: STRING_OUTPUT,
+		needsApproval: approvalGate(opts),
+		execute: makeExecute(groupInviteInput, opts, async (client, i, apiUrl) => {
+			const groupId = await resolveGroupUuid(client, i.group);
+			const agentId = await resolveAgentUuid(apiUrl, i.agentToInvite);
+			const result = await client.groups.invite(groupId, agentId, { message: i.message });
+			return `Invited ${i.agentToInvite} to ${i.group} (status ${result.status}).`;
+		})
+	});
+}
+/** `rine_group_remove` — remove a member; group keys rotate (handle→UUID pre-resolved). */
+function rineGroupRemoveTool(opts = {}) {
+	return defineTool({
+		description: "Remove a member from a group your agent administers (group and agent may be handles or UUIDs). Group keys are rotated for forward secrecy. This is a real, irreversible network action.",
+		inputSchema: jsonSchema(groupRemoveInput),
+		outputSchema: STRING_OUTPUT,
+		needsApproval: approvalGate(opts),
+		execute: makeExecute(groupRemoveInput, opts, async (client, i, apiUrl) => {
+			const groupId = await resolveGroupUuid(client, i.group);
+			const agentId = await resolveAgentUuid(apiUrl, i.agentId);
+			await client.groups.removeMember(groupId, agentId);
+			return `Removed ${i.agentId} from ${i.group}; keys rotated.`;
+		})
+	});
+}
+/** `rine_group_inspect` — report a group's E2EE mode + policy. */
+function rineGroupInspectTool(opts = {}) {
+	return defineTool({
+		description: "Show a group's details and encryption status (MLS vs sender-key) so you can confirm your agent can read and post to it. Accepts a group handle or UUID.",
+		inputSchema: jsonSchema(groupInspectInput),
+		outputSchema: STRING_OUTPUT,
+		execute: makeExecute(groupInspectInput, opts, async (client, i) => {
+			const match = findGroup((await client.groups.list()).items, i.group);
+			if (!match) throw new NotFoundError(`No group '${i.group}' among the groups this agent belongs to`);
+			return renderGroup(match);
+		})
+	});
+}
+//#endregion
+//#region src/tools/messaging.ts
+/**
+* The 5 messaging tool factories: `rine_send`, `rine_send_and_wait`,
+* `rine_check_inbox`, `rine_read`, `rine_reply`. Each returns an Eve `defineTool`
+* descriptor — one `AsyncRineClient` call rendered to a string, wrapped by
+* `makeExecute` (lazy env client + formatError). The runtime tool NAME comes from
+* the filename slug of the scaffolded `agent/tools/<name>.ts`, not from here.
+*
+* R4 holds throughout: renderers read only plaintext/decrypt_error/verification,
+* never the ciphertext envelope. `read`/`check_inbox` add a `toModelOutput`
+* redactor as defence-in-depth.
+*/
+/** `rine_send` — send a 1:1 or `#`-group message (the SDK auto-routes groups). */
+function rineSendTool(opts = {}) {
+	return defineTool({
+		description: "Send an end-to-end-encrypted message to another agent (`name@org` / UUID) or, with a `#`-prefixed handle, to a whole group over its E2EE channel. This is a real, irreversible network action: the message is delivered to a live recipient. Returns the new message id and conversation id.",
+		inputSchema: jsonSchema(sendInput),
+		outputSchema: STRING_OUTPUT,
+		needsApproval: approvalGate(opts),
+		execute: makeExecute(sendInput, opts, async (client, i) => {
+			const msg = await client.send(asRecipient(i.to), { text: i.body }, {
+				type: i.messageType,
+				idempotencyKey: i.idempotencyKey
+			});
+			return `Sent message ${msg.id} to ${i.to} (conversation ${msg.conversation_id}).`;
+		})
+	});
+}
+/** `rine_send_and_wait` — 1:1 send that blocks for a reply (ms timeout). */
+function rineSendAndWaitTool(opts = {}) {
+	return defineTool({
+		description: "Send an end-to-end-encrypted message to a single agent (`name@org` / UUID) and block up to `waitSeconds` for a reply, returning the decrypted reply if one arrives. 1:1 only — use rine_send for groups. This is a real, irreversible network action.",
+		inputSchema: jsonSchema(sendAndWaitInput),
+		outputSchema: STRING_OUTPUT,
+		needsApproval: approvalGate(opts),
+		execute: makeExecute(sendAndWaitInput, opts, async (client, i) => {
+			try {
+				const { sent, reply } = await client.sendAndWait(asRecipient(i.to), { text: i.body }, {
+					timeout: i.waitSeconds * 1e3,
+					type: i.messageType
+				});
+				if (!reply) return `Sent ${sent.id}; no reply within ${i.waitSeconds}s.`;
+				return `Reply: ${renderMessageBody(reply)} (${verifiedNote(reply)})`;
+			} catch (err) {
+				if (isGroupUnsupportedOnWait(err)) return GROUP_ON_WAIT_MESSAGE;
+				throw err;
+			}
+		})
+	});
+}
+/**
+* `rine_check_inbox` — poll the newest new messages, decrypt them, then
+* best-effort `markDelivered` the decryptable ids so a later check returns only
+* newer mail. On ack failure: warn but still return the reads.
+*/
+function rineCheckInboxTool(opts = {}) {
+	return defineTool({
+		description: "Fetch and decrypt your newest unread messages (1:1 and group), then mark them delivered so a later check returns only newer mail. Returns a numbered list of decrypted messages, or 'No new messages.'.",
+		inputSchema: jsonSchema(checkInboxInput),
+		outputSchema: STRING_OUTPUT,
+		toModelOutput: redactToText,
+		execute: makeExecute(checkInboxInput, opts, async (client, i) => {
+			const items = (await client.inbox({
+				status: "new",
+				limit: i.limit
+			})).items;
+			const rendered = renderInbox(items);
+			const decryptableIds = items.filter((m) => !m.decrypt_error).map((m) => m.id);
+			if (decryptableIds.length === 0) return rendered;
+			try {
+				await client.markDelivered(decryptableIds);
+				return rendered;
+			} catch {
+				return `${rendered}\n[WARN] could not mark messages delivered; they may reappear on the next check.`;
+			}
+		})
+	});
+}
+/** `rine_read` — fetch + decrypt one message by id. */
+function rineReadTool(opts = {}) {
+	return defineTool({
+		description: "Fetch and decrypt a single message by its UUID. Returns the sender, type, decrypted body, and signature status.",
+		inputSchema: jsonSchema(readInput),
+		outputSchema: STRING_OUTPUT,
+		toModelOutput: redactToText,
+		execute: makeExecute(readInput, opts, async (client, i) => {
+			return renderSingleMessage(await client.read(asMessageUuid(i.messageId)));
+		})
+	});
+}
+/** `rine_thread` — fetch the both-sided, decrypted transcript of a conversation. */
+function rineThreadTool(opts = {}) {
+	return defineTool({
+		description: "Fetch the both-sided, decrypted transcript of a conversation by its UUID. Returns every turn (yours and the peer's) ordered oldest→newest, each role-tagged (`[sent] you:` / `[received] handle:`). A turn you cannot decrypt renders `[unavailable]`. Use to recover the full context of a conversation on demand.",
+		inputSchema: jsonSchema(threadInput),
+		outputSchema: STRING_OUTPUT,
+		toModelOutput: redactToText,
+		execute: makeExecute(threadInput, opts, async (client, i) => {
+			return renderThread(await client.thread(i.conversationId, { limit: i.limit }));
+		})
+	});
+}
+/** `rine_reply` — reply to a message, threading into the same conversation. */
+function rineReplyTool(opts = {}) {
+	return defineTool({
+		description: "Send an end-to-end-encrypted reply to a message (by its UUID), threading into the same conversation. This is a real, irreversible network action. Returns the reply's message id.",
+		inputSchema: jsonSchema(replyInput),
+		outputSchema: STRING_OUTPUT,
+		needsApproval: approvalGate(opts),
+		execute: makeExecute(replyInput, opts, async (client, i) => {
+			const reply = await client.reply(asMessageUuid(i.messageId), { text: i.body }, { type: i.messageType });
+			return `Replied to ${i.messageId} -> ${reply.id}.`;
+		})
+	});
+}
+//#endregion
+//#region src/tools/index.ts
+const FACTORIES = {
+	rineSendTool,
+	rineSendAndWaitTool,
+	rineCheckInboxTool,
+	rineReadTool,
+	rineReplyTool,
+	rineThreadTool,
+	rineDiscoverTool,
+	rineInspectTool,
+	rineGroupCreateTool,
+	rineGroupInviteTool,
+	rineGroupRemoveTool,
+	rineGroupInspectTool
+};
+/** The metadata registry with live factories attached (programmatic use). */
+const RINE_TOOLS = RINE_TOOL_META.map((m) => ({
+	...m,
+	factory: FACTORIES[m.factoryName]
+}));
+//#endregion
+export { rineSendAndWaitTool as a, rineGroupCreateTool as c, rineGroupRemoveTool as d, rineDiscoverTool as f, rineReplyTool as i, rineGroupInspectTool as l, rineCheckInboxTool as n, rineSendTool as o, rineInspectTool as p, rineReadTool as r, rineThreadTool as s, RINE_TOOLS as t, rineGroupInviteTool as u };

package/dist/transcript.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Token-budgeted, role-tagged transcript rendering for the Eve channel's
+ * push-injection (REQ-CTX-01). The Eve session is STATELESS per inbound message,
+ * so cross-turn memory comes from injecting the recent thread into the session
+ * `context[]` on each inbound. This module renders that transcript within a
+ * char-approximated token budget, truncating the OLDEST turns first.
+ *
+ * R4 holds: it reads only `ThreadEntry.text` (already decrypted + rendered by the
+ * SDK), never any ciphertext field.
+ */
+import type { ThreadEntry } from "@rine-network/sdk";
+/** Marker prepended when older turns were dropped to fit the budget. */
+export declare const OMITTED_MARKER = "[\u2026earlier turns omitted]";
+/**
+ * Render the most-recent turns of a thread as role-tagged `context[]` lines within
+ * a token budget. Turns are accumulated from the NEWEST end backwards until the
+ * char budget (`tokenBudget * 4`) is hit; if any older turns were dropped, a single
+ * {@link OMITTED_MARKER} line is prepended. Returns lines oldest→newest, ready to
+ * slot into the Eve session `context` array.
+ *
+ * @param entries Thread entries, ordered oldest→newest (SDK `client.thread()`).
+ * @param tokenBudget Approximate token budget for the transcript.
+ */
+export declare function renderTranscriptContext(entries: readonly ThreadEntry[], tokenBudget: number): string[];

package/dist/types.d.ts

@@ -0,0 +1,21 @@
+/**
+ * SDK return-type aliases for the renderers + tools + channel.
+ *
+ * The SDK exports the `*Schema` Zod schemas from its root but NOT the inferred
+ * type aliases (`GroupRead`, `AgentSummary`, …). We re-derive the handful we need
+ * via the schemas' `_output` projection — a thin, drift-proof bridge (if the SDK
+ * schema changes, these follow). These are type-only re-derivations; runtime tool
+ * schemas are authored with the host `zod` in `schemas.ts`.
+ */
+import type { AgentProfileSchema, AgentSummarySchema, DecryptedMessageSchema, GroupReadSchema, InviteResultSchema, MessageReadSchema } from "@rine-network/sdk";
+/** Project a Zod schema's output type without importing the SDK's `z` instance. */
+type Infer<S> = S extends {
+    _output: infer O;
+} ? O : never;
+export type DecryptedMessage = Infer<typeof DecryptedMessageSchema>;
+export type MessageRead = Infer<typeof MessageReadSchema>;
+export type GroupRead = Infer<typeof GroupReadSchema>;
+export type InviteResult = Infer<typeof InviteResultSchema>;
+export type AgentSummary = Infer<typeof AgentSummarySchema>;
+export type AgentProfile = Infer<typeof AgentProfileSchema>;
+export {};

package/dist/webhook.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Prod inbound wiring — `npx @rine-network/eve webhook --url <publicBase>`.
+ *
+ * A Vercel-deployed Eve agent has a public URL, so inbound rine messages arrive
+ * by webhook (no daemon, serverless-native). This registers a rine webhook that
+ * POSTs new-message notifications to the channel route, and returns the HMAC
+ * `secret` the channel verifies with (`RINE_WEBHOOK_SECRET`). `--delete` tears it
+ * down. R1: the client is built lazily inside the call.
+ */
+/** Options shared by register/delete. */
+export interface WebhookOptions {
+    /** Public base URL of the deployed Eve agent (e.g. `https://x.vercel.app`). */
+    baseUrl: string;
+    /** Acting agent handle/UUID; defaults to `process.env.RINE_AGENT`. */
+    agent?: string;
+    apiUrl?: string;
+    configDir?: string;
+    /** Inbound path; defaults to `RINE_INBOUND_PATH` env or `/rine/v1/inbound`. */
+    path?: string;
+}
+/** The persisted result of registering a webhook. */
+export interface RegisteredWebhook {
+    readonly id: string;
+    readonly secret: string;
+    readonly url: string;
+}
+/**
+ * Register a rine webhook pointing at the deployed agent's inbound route. Returns
+ * the webhook id + the HMAC secret (shown once) for `RINE_WEBHOOK_SECRET`.
+ */
+export declare function registerRineWebhook(opts: WebhookOptions): Promise<RegisteredWebhook>;
+/** Delete a previously-registered webhook by id (best-effort teardown). */
+export declare function deleteRineWebhook(id: string, opts?: Pick<WebhookOptions, "agent" | "apiUrl" | "configDir">): Promise<void>;

package/dist/webhook.js

@@ -0,0 +1,54 @@
+import { t as getRineClient } from "./client-X_-9CpQT.js";
+import { asAgentUuid, asWebhookUuid } from "@rine-network/sdk";
+import { UUID_RE, resolveApiUrl, resolveToUuid } from "@rine-network/core";
+//#region src/webhook.ts
+/**
+* Prod inbound wiring — `npx @rine-network/eve webhook --url <publicBase>`.
+*
+* A Vercel-deployed Eve agent has a public URL, so inbound rine messages arrive
+* by webhook (no daemon, serverless-native). This registers a rine webhook that
+* POSTs new-message notifications to the channel route, and returns the HMAC
+* `secret` the channel verifies with (`RINE_WEBHOOK_SECRET`). `--delete` tears it
+* down. R1: the client is built lazily inside the call.
+*/
+const DEFAULT_INBOUND_PATH = "/rine/v1/inbound";
+function inboundUrl(opts) {
+	const path = opts.path ?? process.env.RINE_INBOUND_PATH ?? DEFAULT_INBOUND_PATH;
+	return `${opts.baseUrl.replace(/\/$/, "")}${path}`;
+}
+async function resolveAgentUuid(apiUrl, agent) {
+	if (UUID_RE.test(agent)) return asAgentUuid(agent);
+	return asAgentUuid(await resolveToUuid(apiUrl, agent));
+}
+/**
+* Register a rine webhook pointing at the deployed agent's inbound route. Returns
+* the webhook id + the HMAC secret (shown once) for `RINE_WEBHOOK_SECRET`.
+*/
+async function registerRineWebhook(opts) {
+	const agent = opts.agent ?? process.env.RINE_AGENT;
+	if (!agent) throw new Error("no acting agent — set RINE_AGENT or pass --agent <handle>");
+	const apiUrl = opts.apiUrl ?? resolveApiUrl();
+	const client = getRineClient({
+		agent,
+		apiUrl: opts.apiUrl,
+		configDir: opts.configDir
+	});
+	const agentUuid = await resolveAgentUuid(apiUrl, agent);
+	const url = inboundUrl(opts);
+	const created = await client.webhooks.create(agentUuid, url);
+	return {
+		id: created.id,
+		secret: created.secret,
+		url
+	};
+}
+/** Delete a previously-registered webhook by id (best-effort teardown). */
+async function deleteRineWebhook(id, opts = {}) {
+	await getRineClient({
+		agent: opts.agent ?? process.env.RINE_AGENT,
+		apiUrl: opts.apiUrl,
+		configDir: opts.configDir
+	}).webhooks.delete(asWebhookUuid(id));
+}
+//#endregion
+export { deleteRineWebhook, registerRineWebhook };

package/package.json

@@ -0,0 +1,90 @@
+{
+  "name": "@rine-network/eve",
+  "version": "0.1.0",
+  "description": "Native Vercel Eve connector for the rine network \u2014 a custom channel that makes an Eve agent reachable over E2E-encrypted (HPKE 1:1, MLS groups RFC 9420, PQ-hybrid) agent-to-agent messaging, plus file-discovered rine tools, a skill, and an init/onboard/relay CLI.",
+  "author": "mmmbs <mmmbs@proton.me>",
+  "license": "EUPL-1.2",
+  "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
+  "bin": {
+    "rine-eve": "bin/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./channel": {
+      "types": "./dist/channel.d.ts",
+      "import": "./dist/channel.js",
+      "default": "./dist/channel.js"
+    },
+    "./tools": {
+      "types": "./dist/tools/index.d.ts",
+      "import": "./dist/tools/index.js",
+      "default": "./dist/tools/index.js"
+    },
+    "./onboard": {
+      "types": "./dist/onboard.d.ts",
+      "import": "./dist/onboard.js",
+      "default": "./dist/onboard.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist/",
+    "bin/",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsdown && tsc -p tsconfig.build.json --emitDeclarationOnly",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "prepublishOnly": "node scripts/check-no-file-deps.mjs"
+  },
+  "dependencies": {
+    "@rine-network/core": "^0.7.0",
+    "@rine-network/sdk": "^0.4.0",
+    "zod": "^3.25.0",
+    "zod-to-json-schema": "^3.24.1"
+  },
+  "peerDependencies": {
+    "eve": ">=0.11.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "eve": "^0.11.6",
+    "tsdown": "^0.12.0",
+    "typescript": "^5.7.0",
+    "vitest": "^3.0.0"
+  },
+  "homepage": "https://rine.network",
+  "repository": {
+    "type": "git",
+    "url": "https://codeberg.org/rine/rine-eve"
+  },
+  "bugs": {
+    "url": "https://codeberg.org/rine/rine-eve/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "eve",
+    "vercel",
+    "rine",
+    "ai-agents",
+    "agent-framework",
+    "channel",
+    "tools",
+    "a2a",
+    "e2ee",
+    "mls",
+    "messaging"
+  ]
+}