@rine-network/eve 0.2.0 → 0.3.0

package/README.md

@@ -102,7 +102,7 @@ undecryptable mail is dropped by default.
 | `rine_reply` | Reply to a message by id, in-thread |
 | `rine_thread` | Decrypted both-sided transcript of a conversation |
 | `rine_discover` / `rine_inspect` | Search the directory / read a profile |
-| `rine_group_create` / `_invite` / `_remove` / `_inspect` | MLS-by-default groups |
+| `rine_group_create` / `_invite` / `_remove` / `_inspect` / `_join` / `_invites` | MLS-by-default groups |
 | `rine_pay` | Pay a received `rine.v1.x402_payment_required` quote under the local spend policy |
 | `rine_fulfill` | Payee side: verify + settle a received payment and reply with a receipt |
 

package/dist/_zod.d.ts

@@ -9,7 +9,7 @@
  * accuracy) and parse the raw model input with the zod schema inside `execute`
  * (applying defaults + coercion). One source of truth (zod), version-independent.
  *
- * Every tool's `outputSchema` is `string` (R4) — a tool returns clean text, so
+ * Every tool's `outputSchema` is `string` — a tool returns clean text, so
  * ciphertext can never ride a struct field.
  */
 import { z, type ZodTypeAny } from "zod";

package/dist/{channel-b0iIAZTh.js → channel-WlN3x1wP.js}

@@ -1,10 +1,10 @@
-import { _ as senderLabel, f as renderMessageBody, g as renderThreadLine, n as asRecipient, v as verifiedNote } from "./tool-BC49DldZ.js";
+import { b as verifiedNote, m as renderMessageBody, n as asRecipient, v as renderThreadLine, y as senderLabel } from "./tool-xlLdY8kn.js";
 import { n as verifyRineSignature } from "./hmac-CoaKHmf6.js";
-import { t as getRineClient } from "./client-X_-9CpQT.js";
+import { t as getRineClient } from "./client-DsG2xtKs.js";
 import { POST, defineChannel } from "eve/channels";
 import { X402Error, X402_MESSAGE_TYPE, asMessageUuid } from "@rine-network/sdk";
 //#region src/transcript.ts
-/** char ≈ 4 × tokens — the coarse proxy the spec specifies (REQ-CTX-01, OQ1). */
+/** char ≈ 4 × tokens — the coarse proxy the spec specifies. */
 const CHARS_PER_TOKEN = 4;
 /** Marker prepended when older turns were dropped to fit the budget. */
 const OMITTED_MARKER = "[…earlier turns omitted]";
@@ -40,14 +40,14 @@ function renderTranscriptContext(entries, tokenBudget) {
 * Inbound webhook helpers for the rine channel: extracting the message id from a
 * rine standard-webhook body, and the continuation-token codec.
 *
-* The continuation token is how the channel makes outbound replies STATELESS (R7):
+* The continuation token is how the channel makes outbound replies STATELESS:
 * it encodes the rine `conversation_id`, the reply target (the group handle for
 * group mail, else the sender handle), and — for 1:1 inbound only — the inbound
 * `message id` so the `message.completed` handler can reply IN-PLACE (via the reply
 * endpoint, preserving the inbound conversation) without any durable per-session map.
 * Because the token bakes in the per-message `m`, it differs on every 1:1 inbound
 * turn, so Eve does NOT resume a prior session from it — cross-turn continuity comes
-* from the general thread primitive (push-injected transcript, Slice E), not session
+* from the general thread primitive (push-injected transcript), not session
 * resume. The message id is optional: group inbound and tokens minted by an older
 * build carry only `{c,r}` and decode with `messageId === undefined`, so the outbound
 * handler falls back to the `send()+parentConversationId` broadcast path.
@@ -133,7 +133,7 @@ function messageIdFromWebhook(body) {
 //#endregion
 //#region src/x402.ts
 /**
-* x402 payment-aware inbound re-surfacing for the rine channel (D1 + D2).
+* x402 payment-aware inbound re-surfacing for the rine channel.
 *
 * The three x402 payment frames are first-class message types carrying a verbatim
 * x402 V2 object, NOT a chat turn. v1.0 dropped them wholesale (a stateless gateway
@@ -146,7 +146,7 @@ function messageIdFromWebhook(body) {
 *   - `x402_payment`          → the signed authorization + guidance to `rine_fulfill`.
 *   - `x402_receipt`          → the settlement outcome, informational (no reply).
 *
-* D2 auto-pay (opt-in, DEFAULT OFF): when enabled, a `payment_required` at/below the
+* Auto-pay (opt-in, DEFAULT OFF): when enabled, a `payment_required` at/below the
 * policy's `autoPayThreshold` is paid with NO LLM turn — still bounded by the policy
 * caps, deny-by-default, journal and reserve-lock (all in rine-core). Any decline
 * falls back to surfacing the quote to the model.
@@ -200,7 +200,7 @@ function x402GuidanceLine(msg) {
 	return `x402 receipt from ${who} (${note}). This is informational — no reply is expected.`;
 }
 /**
-* D2 auto-pay attempt. Returns `null` when the quote was paid (no session needed),
+* Auto-pay attempt. Returns `null` when the quote was paid (no session needed),
 * or a one-line decline note when auto-pay was refused or errored (the caller then
 * surfaces the quote to the model). A policy refusal / above-threshold quote is a
 * typed {@link X402Error}; anything else (network, wallet) is reported verbatim.
@@ -232,7 +232,7 @@ async function surfaceX402(deps, msg, messageId, note) {
 	return new Response("ok", { status: 200 });
 }
 /**
-* Handle a verified inbound x402 frame (D1). `payment_required` may auto-pay (D2)
+* Handle a verified inbound x402 frame. `payment_required` may auto-pay
 * when enabled and at/below threshold; otherwise, and for `payment` / `receipt`,
 * the frame is surfaced to the model as a payment-aware turn.
 */
@@ -256,9 +256,9 @@ async function handleX402Inbound(deps, msg, messageId) {
 * `defineChannel` route; the OUTBOUND half (`processCompletion`/`processFailure`)
 * lives in `channel-outbound.ts`.
 *
-*   - INBOUND (`processInbound`): HMAC-verify (transport auth, R5) → parse → dedupe
+*   - INBOUND (`processInbound`): HMAC-verify (transport auth) → parse → dedupe
 *     → `client.read(id)` to HPKE-decrypt + verify the sender's Ed25519 signature
-*     (content auth, R5) → loop-guard → mark delivered → start/resume the session.
+*     (content auth) → loop-guard → mark delivered → start/resume the session.
 *
 * TRUST NOTE: `verified === true` cryptographically binds the message's *signer*
 * (the envelope `kid`), but the SDK exposes only the server-asserted
@@ -272,11 +272,11 @@ function senderContextLine(msg) {
 	const where = msg.group_handle ? ` in group ${msg.group_handle}` : "";
 	return `Inbound rine message from ${senderLabel(msg)}${where} (type ${msg.type}, ${verifiedNote(msg)}). Your reply is delivered back to the sender over rine.`;
 }
-/** Cap on turns fetched for the push-injected transcript (REQ-SRV-04). */
+/** Cap on turns fetched for the push-injected transcript. */
 const THREAD_FETCH_LIMIT = 50;
 /**
 * The inbound pipeline. Returns the HTTP {@link Response} the route should send.
-* Status codes are retry-aware (R8/#10): `5xx` = transient (caller should retry),
+* Status codes are retry-aware: `5xx` = transient (caller should retry),
 * `4xx` = terminal drop, `2xx` = accepted/benign-ignore.
 */
 async function processInbound(deps) {
@@ -331,15 +331,15 @@ async function processInbound(deps) {
 * unit-testable with fake clients. `channel.ts` wires these to Eve's
 * `message.completed` / failure events; the INBOUND half lives in `channel-core.ts`.
 *
-* On a terminal assistant message (R6) reply back over rine IN-PLACE via the reply
-* endpoint, preserving the inbound conversation (R7); falls back to
+* On a terminal assistant message, reply back over rine IN-PLACE via the reply
+* endpoint, preserving the inbound conversation; falls back to
 * `parentConversationId` for legacy tokens. A session started by an x402 frame never
 * prose-replies into the payment thread (the pay / fulfill tools transmit the signed
 * frame in-thread instead) — the `x402` continuation-token flag short-circuits both.
 */
 /**
 * Outbound for `message.completed`: every TERMINAL assistant message (any
-* `finishReason` except the intermediate `tool-calls`, R6) with text becomes a
+* `finishReason` except the intermediate `tool-calls`) with text becomes a
 * reply. When the continuation token carries the inbound message id we reply
 * IN-PLACE via the reply endpoint (same conversation, no fork) keeping the
 * connector's `replyMessageType` unchanged — type-preserving, so terminal/wake
@@ -386,15 +386,15 @@ async function processFailure(continuationToken, client) {
 const DEFAULT_INBOUND_PATH = "/rine/v1/inbound";
 const DEFAULT_REPLY_TYPE = "rine.v1.task_response";
 const DEFAULT_MAX_BODY_BYTES = 512 * 1024;
-/** Default token budget for the push-injected transcript (REQ-CTX-01, ≈8000 chars). */
+/** Default token budget for the push-injected transcript (≈8000 chars). */
 const DEFAULT_THREAD_CONTEXT_TOKEN_BUDGET = 2e3;
 /**
-* Message types never auto-replied to (loop guard, R2): the connector's OWN
+* Message types never auto-replied to (loop guard): the connector's OWN
 * outbound types (task_response/error/receipt), so two rine-eve agents don't
 * auto-reply to each other forever.
 *
 * The three x402 payment frames are NOT here: v1.1 re-surfaces them as
-* payment-aware agent turns (D1), routed by `handleX402Inbound` with the prose
+* payment-aware agent turns, routed by `handleX402Inbound` with the prose
 * auto-reply suppressed (the `x402` continuation-token flag), never by the generic
 * assistant reply. Adding them here would revert to the v1.0 silent-drop behavior.
 */

package/dist/channel-core.d.ts

@@ -4,9 +4,9 @@
  * `defineChannel` route; the OUTBOUND half (`processCompletion`/`processFailure`)
  * lives in `channel-outbound.ts`.
  *
- *   - INBOUND (`processInbound`): HMAC-verify (transport auth, R5) → parse → dedupe
+ *   - INBOUND (`processInbound`): HMAC-verify (transport auth) → parse → dedupe
  *     → `client.read(id)` to HPKE-decrypt + verify the sender's Ed25519 signature
- *     (content auth, R5) → loop-guard → mark delivered → start/resume the session.
+ *     (content auth) → loop-guard → mark delivered → start/resume the session.
  *
  * TRUST NOTE: `verified === true` cryptographically binds the message's *signer*
  * (the envelope `kid`), but the SDK exposes only the server-asserted
@@ -41,7 +41,7 @@ export interface InboundDeps {
     /** Inbound types to ignore (loop guard). */
     ignoreTypes: readonly string[];
     /**
-     * D2 opt-in auto-pay (default OFF). When true, an inbound `x402_payment_required`
+     * Opt-in auto-pay (default OFF). When true, an inbound `x402_payment_required`
      * at/below the policy's `autoPayThreshold` is paid with NO LLM turn — still
      * bounded by the caps, deny-by-default, journal and reserve-lock. Any decline
      * falls back to surfacing the quote to the model.
@@ -51,13 +51,13 @@ export interface InboundDeps {
     seen?: Set<string>;
     /**
      * Approximate token budget for the role-tagged transcript push-injected into the
-     * session context (REQ-CTX-01). When unset, only the sender line is injected.
+     * session context. When unset, only the sender line is injected.
      */
     threadContextTokenBudget?: number;
 }
 /**
  * The inbound pipeline. Returns the HTTP {@link Response} the route should send.
- * Status codes are retry-aware (R8/#10): `5xx` = transient (caller should retry),
+ * Status codes are retry-aware: `5xx` = transient (caller should retry),
  * `4xx` = terminal drop, `2xx` = accepted/benign-ignore.
  */
 export declare function processInbound(deps: InboundDeps): Promise<Response>;

package/dist/channel-outbound.d.ts

@@ -3,8 +3,8 @@
  * unit-testable with fake clients. `channel.ts` wires these to Eve's
  * `message.completed` / failure events; the INBOUND half lives in `channel-core.ts`.
  *
- * On a terminal assistant message (R6) reply back over rine IN-PLACE via the reply
- * endpoint, preserving the inbound conversation (R7); falls back to
+ * On a terminal assistant message, reply back over rine IN-PLACE via the reply
+ * endpoint, preserving the inbound conversation; falls back to
  * `parentConversationId` for legacy tokens. A session started by an x402 frame never
  * prose-replies into the payment thread (the pay / fulfill tools transmit the signed
  * frame in-thread instead) — the `x402` continuation-token flag short-circuits both.
@@ -19,7 +19,7 @@ export interface CompletionDeps {
 }
 /**
  * Outbound for `message.completed`: every TERMINAL assistant message (any
- * `finishReason` except the intermediate `tool-calls`, R6) with text becomes a
+ * `finishReason` except the intermediate `tool-calls`) with text becomes a
  * reply. When the continuation token carries the inbound message id we reply
  * IN-PLACE via the reply endpoint (same conversation, no fork) keeping the
  * connector's `replyMessageType` unchanged — type-preserving, so terminal/wake

package/dist/channel.d.ts

@@ -15,12 +15,12 @@ export { processCompletion, processFailure } from "./channel-outbound.js";
 export type { ChannelSend, InboundDeps } from "./channel-core.js";
 export type { CompletionDeps } from "./channel-outbound.js";
 /**
- * Message types never auto-replied to (loop guard, R2): the connector's OWN
+ * Message types never auto-replied to (loop guard): the connector's OWN
  * outbound types (task_response/error/receipt), so two rine-eve agents don't
  * auto-reply to each other forever.
  *
  * The three x402 payment frames are NOT here: v1.1 re-surfaces them as
- * payment-aware agent turns (D1), routed by `handleX402Inbound` with the prose
+ * payment-aware agent turns, routed by `handleX402Inbound` with the prose
  * auto-reply suppressed (the `x402` continuation-token flag), never by the generic
  * assistant reply. Adding them here would revert to the v1.0 silent-drop behavior.
  */
@@ -47,7 +47,7 @@ export interface RineChannelOptions {
     maxBodyBytes?: number;
     /**
      * Approximate token budget for the role-tagged recent-transcript push-injected
-     * into the stateless Eve session context on each inbound (REQ-CTX-01). Older
+     * into the stateless Eve session context on each inbound. Older
      * turns are truncated first with a `[…earlier turns omitted]` marker; a
      * single-message thread injects no extra transcript. Default ~2000 tokens.
      */
@@ -55,7 +55,7 @@ export interface RineChannelOptions {
     /** A pre-built client (tests / advanced use); otherwise env-resolved lazily. */
     client?: AsyncRineClient;
     /**
-     * x402 payment behavior (D2). `autoPay` is OPT-IN and DEFAULT OFF: when true, an
+     * x402 payment behavior. `autoPay` is OPT-IN and DEFAULT OFF: when true, an
      * inbound `x402_payment_required` at/below the policy's `autoPayThreshold` is paid
      * with no LLM turn (still bounded by the caps, deny-by-default, journal and
      * reserve-lock). Off ⇒ every quote is surfaced to the agent, which pays via

package/dist/channel.js

@@ -1,2 +1,2 @@
-import { a as processInbound, i as processFailure, n as rineChannel, o as senderContextLine, r as processCompletion, t as DEFAULT_IGNORE_TYPES } from "./channel-b0iIAZTh.js";
+import { a as processInbound, i as processFailure, n as rineChannel, o as senderContextLine, r as processCompletion, t as DEFAULT_IGNORE_TYPES } from "./channel-WlN3x1wP.js";
 export { DEFAULT_IGNORE_TYPES, processCompletion, processFailure, processInbound, rineChannel, senderContextLine };

package/dist/{client-X_-9CpQT.js → client-DsG2xtKs.js}

@@ -2,7 +2,7 @@ import { AsyncRineClient } from "@rine-network/sdk";
 import { resolveApiUrl, resolveConfigDir } from "@rine-network/core";
 //#region src/client.ts
 /**
-* Lazy `AsyncRineClient` construction (invariant R1: side-effect-free import).
+* Lazy `AsyncRineClient` construction (side-effect-free import).
 *
 * No client is built at module load. The SDK client is created the first time a
 * tool's `execute` (or a channel handler) actually fires, then memoized per
@@ -24,7 +24,7 @@ function cacheKey(configDir, apiUrl) {
 /**
 * Get (or lazily build + memoize) the shared `AsyncRineClient` for `opts`,
 * already scoped to `opts.agent` when present. Call ONLY from inside a tool
-* `execute` / a channel handler — never at module top level (R1).
+* `execute` / a channel handler — never at module top level.
 */
 function getRineClient(opts = {}) {
 	const configDir = opts.configDir ?? resolveConfigDir();

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 /**
- * Lazy `AsyncRineClient` construction (invariant R1: side-effect-free import).
+ * Lazy `AsyncRineClient` construction (side-effect-free import).
  *
  * No client is built at module load. The SDK client is created the first time a
  * tool's `execute` (or a channel handler) actually fires, then memoized per
@@ -27,7 +27,7 @@ export interface RineClientOpts {
 /**
  * Get (or lazily build + memoize) the shared `AsyncRineClient` for `opts`,
  * already scoped to `opts.agent` when present. Call ONLY from inside a tool
- * `execute` / a channel handler — never at module top level (R1).
+ * `execute` / a channel handler — never at module top level.
  */
 export declare function getRineClient(opts?: RineClientOpts): AsyncRineClient;
 /** Test-only: drop all memoized clients (not part of the public surface). */

package/dist/errors.d.ts

@@ -1,5 +1,5 @@
 /**
- * `formatError(err)` — invariant R2: turn any thrown SDK error into a readable
+ * `formatError(err)` — turns any thrown SDK error into a readable
  * string for the LLM, never a stack trace. Tools wrap their one `await client.*`
  * call in `try/catch → formatError` and RESOLVE (never reject) for mapped errors.
  *

package/dist/format.d.ts

@@ -2,12 +2,12 @@
  * Pure render functions: turn SDK return values into the human-readable strings
  * tools + the channel hand to the LLM / send back over rine.
  *
- * Invariant R4: these read ONLY `plaintext` / `decrypt_error` / verification
+ * These read ONLY `plaintext` / `decrypt_error` / verification
  * fields. They NEVER read `encrypted_payload` or any envelope/ciphertext field,
  * so ciphertext can never reach the LLM context through a rendered string.
  */
 import type { ThreadEntry } from "@rine-network/sdk";
-import type { AgentProfile, AgentSummary, DecryptedMessage, GroupRead } from "./types.js";
+import type { AgentProfile, AgentSummary, DecryptedMessage, GroupRead, JoinRequestRead, JoinResult } from "./types.js";
 /** One thread turn as a role-tagged line: `[sent] you: …` / `[received] alice@org: …`. */
 export declare function renderThreadLine(e: ThreadEntry): string;
 /**
@@ -41,11 +41,15 @@ export declare function renderProfile(p: AgentProfile): string;
 /**
  * Self-diagnose a group's E2EE mode. Uses `mls_group_id !== null`, OR the
  * explicit `mls_enabled`/`mls_pending` flags. With MLS support present this is a
- * CAPABILITY flag, not a failure flag (R9).
+ * CAPABILITY flag, not a failure flag.
  */
 export declare function groupIsMls(g: GroupRead): boolean;
 /**
  * A group rendered for `rine_group_inspect`. Both the MLS and sender-key branches
- * are `[OK]` — an MLS group is readable/postable from here (R9).
+ * are `[OK]` — an MLS group is readable/postable from here.
  */
 export declare function renderGroup(g: GroupRead): string;
+/** `rine_group_join` outcome: immediate membership vs a pending vote. */
+export declare function renderJoinResult(target: string, result: JoinResult): string;
+/** A numbered list of the caller's pending group invites, or the empty-state line. */
+export declare function renderInvites(items: readonly JoinRequestRead[]): string;

package/dist/inbound.d.ts

@@ -2,14 +2,14 @@
  * Inbound webhook helpers for the rine channel: extracting the message id from a
  * rine standard-webhook body, and the continuation-token codec.
  *
- * The continuation token is how the channel makes outbound replies STATELESS (R7):
+ * The continuation token is how the channel makes outbound replies STATELESS:
  * it encodes the rine `conversation_id`, the reply target (the group handle for
  * group mail, else the sender handle), and — for 1:1 inbound only — the inbound
  * `message id` so the `message.completed` handler can reply IN-PLACE (via the reply
  * endpoint, preserving the inbound conversation) without any durable per-session map.
  * Because the token bakes in the per-message `m`, it differs on every 1:1 inbound
  * turn, so Eve does NOT resume a prior session from it — cross-turn continuity comes
- * from the general thread primitive (push-injected transcript, Slice E), not session
+ * from the general thread primitive (push-injected transcript), not session
  * resume. The message id is optional: group inbound and tokens minted by an older
  * build carry only `{c,r}` and decode with `messageId === undefined`, so the outbound
  * handler falls back to the `send()+parentConversationId` broadcast path.
@@ -35,7 +35,7 @@ export interface ReplyContext {
      */
     readonly messageId?: string;
     /**
-     * Marks a session started by an inbound x402 payment frame (D1). The terminal
+     * Marks a session started by an inbound x402 payment frame. The terminal
      * assistant message is NEVER prose-replied into a payment thread — that would
      * corrupt the handshake. The signed payment / receipt is transmitted in-thread
      * by the pay / fulfill tools instead, so `processCompletion` short-circuits when

package/dist/index.d.ts

@@ -6,7 +6,7 @@
  * reachability + outbound replies, file-discovered rine **tools** for agency, a
  * **skill**, and an out-of-band **onboard / init / webhook / relay** CLI.
  *
- * Import is side-effect-free (R1): nothing here builds a client, reads a
+ * Import is side-effect-free: nothing here builds a client, reads a
  * credential, or opens a socket at module load.
  *
  * Most consumers don't import from here — they run `npx @rine-network/eve init`,

package/dist/index.js

@@ -1,10 +1,10 @@
-import { o as formatError } from "./tool-BC49DldZ.js";
-import { a as processInbound, c as handleX402Inbound, d as x402GuidanceLine, f as decodeReplyToken, i as processFailure, l as isX402Frame, m as messageIdFromWebhook, n as rineChannel, o as senderContextLine, p as encodeReplyToken, r as processCompletion, s as X402_FRAME_TYPES, u as renderX402Body } from "./channel-b0iIAZTh.js";
+import { o as formatError } from "./tool-xlLdY8kn.js";
+import { a as processInbound, c as handleX402Inbound, d as x402GuidanceLine, f as decodeReplyToken, i as processFailure, l as isX402Frame, m as messageIdFromWebhook, n as rineChannel, o as senderContextLine, p as encodeReplyToken, r as processCompletion, s as X402_FRAME_TYPES, u as renderX402Body } from "./channel-WlN3x1wP.js";
 import { n as verifyRineSignature, t as signRineBody } from "./hmac-CoaKHmf6.js";
-import { t as getRineClient } from "./client-X_-9CpQT.js";
-import { a as rineReadTool, c as rineSendTool, d as rineGroupInspectTool, f as rineGroupInviteTool, h as rineInspectTool, i as rineCheckInboxTool, l as rineThreadTool, m as rineDiscoverTool, n as rineFulfillTool, o as rineReplyTool, p as rineGroupRemoveTool, r as rinePayTool, s as rineSendAndWaitTool, t as RINE_TOOLS, u as rineGroupCreateTool } from "./tools-BcVm_Onx.js";
-import { t as RINE_TOOL_META } from "./registry-6sWyhOyF.js";
-import { a as toolFileContent, c as RINE_SKILL_FILE, i as scaffoldRine, n as envExampleBlock, o as RINE_SKILL_BODY, r as resolveToolSelection, s as RINE_SKILL_DESCRIPTION, t as channelFileContent } from "./scaffold-0luQyBRK.js";
+import { t as getRineClient } from "./client-DsG2xtKs.js";
+import { _ as rineInspectTool, a as rineReadTool, c as rineSendTool, d as rineGroupInspectTool, f as rineGroupInviteTool, g as rineDiscoverTool, h as rineGroupRemoveTool, i as rineCheckInboxTool, l as rineThreadTool, m as rineGroupJoinTool, n as rineFulfillTool, o as rineReplyTool, p as rineGroupInvitesTool, r as rinePayTool, s as rineSendAndWaitTool, t as RINE_TOOLS, u as rineGroupCreateTool } from "./tools-BhkhV3Mv.js";
+import { t as RINE_TOOL_META } from "./registry-Bn4EqPcp.js";
+import { a as toolFileContent, c as RINE_SKILL_FILE, i as scaffoldRine, n as envExampleBlock, o as RINE_SKILL_BODY, r as resolveToolSelection, s as RINE_SKILL_DESCRIPTION, t as channelFileContent } from "./scaffold-3cEUy3jD.js";
 import { agentNameFromOrgName, parseOnboardArgs, runOnboard } from "./onboard.js";
 import { deleteRineWebhook, registerRineWebhook } from "./webhook.js";
 import { buildRelayBody, drainOnce, runRelay } from "./relay.js";
@@ -24,4 +24,4 @@ function rineSkill() {
 	});
 }
 //#endregion
-export { RINE_SKILL_BODY, RINE_SKILL_DESCRIPTION, RINE_SKILL_FILE, RINE_TOOLS, RINE_TOOL_META, X402_FRAME_TYPES, agentNameFromOrgName, buildRelayBody, channelFileContent, decodeReplyToken, deleteRineWebhook, drainOnce, encodeReplyToken, envExampleBlock, formatError, getRineClient, handleX402Inbound, isX402Frame, messageIdFromWebhook, parseOnboardArgs, processCompletion, processFailure, processInbound, registerRineWebhook, renderX402Body, resolveToolSelection, rineChannel, rineCheckInboxTool, rineDiscoverTool, rineFulfillTool, rineGroupCreateTool, rineGroupInspectTool, rineGroupInviteTool, rineGroupRemoveTool, rineInspectTool, rinePayTool, rineReadTool, rineReplyTool, rineSendAndWaitTool, rineSendTool, rineSkill, rineThreadTool, runOnboard, runRelay, scaffoldRine, senderContextLine, signRineBody, toolFileContent, verifyRineSignature, x402GuidanceLine };
+export { RINE_SKILL_BODY, RINE_SKILL_DESCRIPTION, RINE_SKILL_FILE, RINE_TOOLS, RINE_TOOL_META, X402_FRAME_TYPES, agentNameFromOrgName, buildRelayBody, channelFileContent, decodeReplyToken, deleteRineWebhook, drainOnce, encodeReplyToken, envExampleBlock, formatError, getRineClient, handleX402Inbound, isX402Frame, messageIdFromWebhook, parseOnboardArgs, processCompletion, processFailure, processInbound, registerRineWebhook, renderX402Body, resolveToolSelection, rineChannel, rineCheckInboxTool, rineDiscoverTool, rineFulfillTool, rineGroupCreateTool, rineGroupInspectTool, rineGroupInviteTool, rineGroupInvitesTool, rineGroupJoinTool, rineGroupRemoveTool, rineInspectTool, rinePayTool, rineReadTool, rineReplyTool, rineSendAndWaitTool, rineSendTool, rineSkill, rineThreadTool, runOnboard, runRelay, scaffoldRine, senderContextLine, signRineBody, toolFileContent, verifyRineSignature, x402GuidanceLine };

package/dist/onboard.d.ts

@@ -5,7 +5,7 @@
  * creates the first agent and prints its handle + verification words. A ~30–60 s
  * PoW does not belong in an LLM turn; it is a one-time CLI a human runs.
  *
- * R1: no client is built at module load — `runOnboard` constructs the client
+ * No client is built at module load — `runOnboard` constructs the client
  * lazily. The PoW + credential write are delegated to the SDK's `register(opts)`;
  * the agent keypair is generated + persisted by `client.createAgent(name)`.
  */

package/dist/onboard.js

@@ -8,7 +8,7 @@ import { resolveApiUrl, resolveConfigDir } from "@rine-network/core";
 * creates the first agent and prints its handle + verification words. A ~30–60 s
 * PoW does not belong in an LLM turn; it is a one-time CLI a human runs.
 *
-* R1: no client is built at module load — `runOnboard` constructs the client
+* No client is built at module load — `runOnboard` constructs the client
 * lazily. The PoW + credential write are delegated to the SDK's `register(opts)`;
 * the agent keypair is generated + persisted by `client.createAgent(name)`.
 */

package/dist/{registry-6sWyhOyF.js → registry-Bn4EqPcp.js}

@@ -65,6 +65,16 @@ const RINE_TOOL_META = [
 		factoryName: "rineGroupInspectTool",
 		domain: "groups"
 	},
+	{
+		name: "rine_group_join",
+		factoryName: "rineGroupJoinTool",
+		domain: "groups"
+	},
+	{
+		name: "rine_group_invites",
+		factoryName: "rineGroupInvitesTool",
+		domain: "groups"
+	},
 	{
 		name: "rine_pay",
 		factoryName: "rinePayTool",

package/dist/relay.d.ts

@@ -5,7 +5,7 @@
  * stands in for the cloud webhook: it polls the agent's inbox and re-POSTs each
  * new message — HMAC-signed with `RINE_WEBHOOK_SECRET` — to the LOCAL channel
  * route. It deliberately reuses the SAME inbound route + HMAC + decrypt path as
- * production (R8); the relay only replaces the transport that carries the
+ * production; the relay only replaces the transport that carries the
  * notification, never the message handling. The body carries just the id +
  * routing fields; the channel re-reads + decrypts by id, exactly as in prod.
  */

package/dist/relay.js

@@ -1,5 +1,5 @@
 import { t as signRineBody } from "./hmac-CoaKHmf6.js";
-import { t as getRineClient } from "./client-X_-9CpQT.js";
+import { t as getRineClient } from "./client-DsG2xtKs.js";
 import { resolveApiUrl } from "@rine-network/core";
 //#region src/relay.ts
 /**
@@ -9,7 +9,7 @@ import { resolveApiUrl } from "@rine-network/core";
 * stands in for the cloud webhook: it polls the agent's inbox and re-POSTs each
 * new message — HMAC-signed with `RINE_WEBHOOK_SECRET` — to the LOCAL channel
 * route. It deliberately reuses the SAME inbound route + HMAC + decrypt path as
-* production (R8); the relay only replaces the transport that carries the
+* production; the relay only replaces the transport that carries the
 * notification, never the message handling. The body carries just the id +
 * routing fields; the channel re-reads + decrypts by id, exactly as in prod.
 */

package/dist/{scaffold-0luQyBRK.js → scaffold-3cEUy3jD.js}

@@ -1,4 +1,4 @@
-import { t as RINE_TOOL_META } from "./registry-6sWyhOyF.js";
+import { t as RINE_TOOL_META } from "./registry-Bn4EqPcp.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 //#region src/skill-content.ts
@@ -43,7 +43,8 @@ its id; call \`rine_send\` to start a *new* conversation with another agent.
 
 Groups are end-to-end encrypted (MLS / RFC 9420 by default, with forward secrecy).
 \`rine_group_create\`, \`rine_group_invite\`, \`rine_group_remove\`,
-\`rine_group_inspect\`. Sending to a \`#group@org\` handle posts to the whole group.
+\`rine_group_inspect\`, \`rine_group_join\`, \`rine_group_invites\`. Sending to a
+\`#group@org\` handle posts to the whole group.
 
 ## Trust
 

package/dist/scaffold.js

@@ -1,2 +1,2 @@
-import { a as toolFileContent, i as scaffoldRine, n as envExampleBlock, r as resolveToolSelection, t as channelFileContent } from "./scaffold-0luQyBRK.js";
+import { a as toolFileContent, i as scaffoldRine, n as envExampleBlock, r as resolveToolSelection, t as channelFileContent } from "./scaffold-3cEUy3jD.js";
 export { channelFileContent, envExampleBlock, resolveToolSelection, scaffoldRine, toolFileContent };

package/dist/schemas-groups.d.ts

@@ -1,7 +1,7 @@
 /**
- * Zod input schemas for the 4 group tools (split out of `schemas.ts` to hold the
+ * Zod input schemas for the 6 group tools (split out of `schemas.ts` to hold the
  * ~200-LOC budget — one file per domain). Same authoring rules: rich `.describe()`
- * on every field, NO identity/credentials in the schema (env-injected, R3).
+ * on every field, NO identity/credentials in the schema (env-injected).
  *
  * Groups are MLS-capable by default — `enableMls` (default true) on create.
  */
@@ -55,3 +55,15 @@ export declare const groupInspectInput: z.ZodObject<{
 }, {
     group: string;
 }>;
+export declare const groupJoinInput: z.ZodObject<{
+    group: z.ZodString;
+    message: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    group: string;
+    message?: string | undefined;
+}, {
+    group: string;
+    message?: string | undefined;
+}>;
+/** No input: lists the caller's own pending group invites. */
+export declare const groupInvitesInput: z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>;

package/dist/schemas-payments.d.ts

@@ -1,8 +1,8 @@
 /**
  * Zod input schemas for the 2 x402 payment tools (split out of `schemas.ts` to
  * hold the ~200-LOC budget — one file per domain). Same authoring rules: rich
- * `.describe()` on every field, NO identity/credentials in the schema (env-injected,
- * R3). The facilitator is infra config, resolved from the tool factory / env —
+ * `.describe()` on every field, NO identity/credentials in the schema
+ * (env-injected). The facilitator is infra config, resolved from the tool factory / env —
  * never a model-visible input.
  */
 import { z } from "zod";

package/dist/schemas.d.ts

@@ -3,7 +3,7 @@
  *
  * Rich `.describe()` on EVERY field: the field descriptions are the #1 lever on
  * tool-call accuracy (the AI-DX). Identity/credentials NEVER appear here — the
- * acting agent + config dir come from `process.env` (R3), never the model-visible
+ * acting agent + config dir come from `process.env`, never the model-visible
  * input schema.
  */
 import { z } from "zod";
@@ -102,5 +102,5 @@ export declare const inspectInput: z.ZodObject<{
 }, {
     handleOrId: string;
 }>;
-export { groupCreateInput, groupInspectInput, groupInviteInput, groupRemoveInput, } from "./schemas-groups.js";
+export { groupCreateInput, groupInspectInput, groupInviteInput, groupInvitesInput, groupJoinInput, groupRemoveInput, } from "./schemas-groups.js";
 export { fulfillInput, payInput } from "./schemas-payments.js";

package/dist/skill-content.d.ts

@@ -6,6 +6,6 @@
  */
 export declare const RINE_SKILL_DESCRIPTION = "Use when communicating with other AI agents over the rine network \u2014 sending or replying to agent-to-agent messages, discovering agents, or coordinating in groups.";
 /** The skill body (no frontmatter) — used by `rineSkill()`'s `markdown`. */
-export declare const RINE_SKILL_BODY = "# rine \u2014 agent-to-agent messaging\n\nrine is an end-to-end-encrypted messaging network for AI agents. Each agent has a\nhandle like `name@org`. You are reachable on rine: other agents message you and\nyour replies are encrypted and delivered back to them automatically.\n\n## When messages arrive\n\nInbound rine messages are delivered to you as a normal turn. The context line tells\nyou who sent it and whether their signature verified. **Just answer** \u2014 your final\nreply is encrypted and sent back to the sender in the same conversation. You do not\nneed to call a tool to reply to an inbound rine message.\n\nCall `rine_reply` only when you want to reply to a *specific* earlier message by\nits id; call `rine_send` to start a *new* conversation with another agent.\n\n## Reaching other agents\n\n- `rine_discover` \u2014 search the public directory by text/category/language to find\n  an agent's handle. Do this before messaging an agent you don't already know.\n- `rine_inspect` \u2014 read an agent's full public profile (verification, oversight).\n- `rine_send` \u2014 send a 1:1 message (`name@org` / UUID) or a group message\n  (`#group@org`). End-to-end encrypted; a real, irreversible network action.\n- `rine_send_and_wait` \u2014 1:1 only: send and block up to N seconds for a reply.\n- `rine_check_inbox` / `rine_read` \u2014 pull or read mail by id (rarely needed, since\n  inbound is pushed to you as a turn).\n- `rine_thread` \u2014 fetch the full decrypted transcript of a conversation by its id\n  (both sides, oldest\u2192newest). Use to recover earlier context on demand.\n\n## Groups\n\nGroups are end-to-end encrypted (MLS / RFC 9420 by default, with forward secrecy).\n`rine_group_create`, `rine_group_invite`, `rine_group_remove`,\n`rine_group_inspect`. Sending to a `#group@org` handle posts to the whole group.\n\n## Trust\n\nEvery inbound message is HPKE-decrypted and its sender signature is verified before\nit reaches you; unverified mail is dropped by default. Treat the sender handle in the\ncontext line as authenticated. Do not put secrets in messages you would not want the\nrecipient agent to read.\n";
+export declare const RINE_SKILL_BODY = "# rine \u2014 agent-to-agent messaging\n\nrine is an end-to-end-encrypted messaging network for AI agents. Each agent has a\nhandle like `name@org`. You are reachable on rine: other agents message you and\nyour replies are encrypted and delivered back to them automatically.\n\n## When messages arrive\n\nInbound rine messages are delivered to you as a normal turn. The context line tells\nyou who sent it and whether their signature verified. **Just answer** \u2014 your final\nreply is encrypted and sent back to the sender in the same conversation. You do not\nneed to call a tool to reply to an inbound rine message.\n\nCall `rine_reply` only when you want to reply to a *specific* earlier message by\nits id; call `rine_send` to start a *new* conversation with another agent.\n\n## Reaching other agents\n\n- `rine_discover` \u2014 search the public directory by text/category/language to find\n  an agent's handle. Do this before messaging an agent you don't already know.\n- `rine_inspect` \u2014 read an agent's full public profile (verification, oversight).\n- `rine_send` \u2014 send a 1:1 message (`name@org` / UUID) or a group message\n  (`#group@org`). End-to-end encrypted; a real, irreversible network action.\n- `rine_send_and_wait` \u2014 1:1 only: send and block up to N seconds for a reply.\n- `rine_check_inbox` / `rine_read` \u2014 pull or read mail by id (rarely needed, since\n  inbound is pushed to you as a turn).\n- `rine_thread` \u2014 fetch the full decrypted transcript of a conversation by its id\n  (both sides, oldest\u2192newest). Use to recover earlier context on demand.\n\n## Groups\n\nGroups are end-to-end encrypted (MLS / RFC 9420 by default, with forward secrecy).\n`rine_group_create`, `rine_group_invite`, `rine_group_remove`,\n`rine_group_inspect`, `rine_group_join`, `rine_group_invites`. Sending to a\n`#group@org` handle posts to the whole group.\n\n## Trust\n\nEvery inbound message is HPKE-decrypted and its sender signature is verified before\nit reaches you; unverified mail is dropped by default. Treat the sender handle in the\ncontext line as authenticated. Do not put secrets in messages you would not want the\nrecipient agent to read.\n";
 /** The full SKILL.md file contents (frontmatter + body) the scaffolder writes. */
-export declare const RINE_SKILL_FILE = "---\ndescription: Use when communicating with other AI agents over the rine network \u2014 sending or replying to agent-to-agent messages, discovering agents, or coordinating in groups.\n---\n\n# rine \u2014 agent-to-agent messaging\n\nrine is an end-to-end-encrypted messaging network for AI agents. Each agent has a\nhandle like `name@org`. You are reachable on rine: other agents message you and\nyour replies are encrypted and delivered back to them automatically.\n\n## When messages arrive\n\nInbound rine messages are delivered to you as a normal turn. The context line tells\nyou who sent it and whether their signature verified. **Just answer** \u2014 your final\nreply is encrypted and sent back to the sender in the same conversation. You do not\nneed to call a tool to reply to an inbound rine message.\n\nCall `rine_reply` only when you want to reply to a *specific* earlier message by\nits id; call `rine_send` to start a *new* conversation with another agent.\n\n## Reaching other agents\n\n- `rine_discover` \u2014 search the public directory by text/category/language to find\n  an agent's handle. Do this before messaging an agent you don't already know.\n- `rine_inspect` \u2014 read an agent's full public profile (verification, oversight).\n- `rine_send` \u2014 send a 1:1 message (`name@org` / UUID) or a group message\n  (`#group@org`). End-to-end encrypted; a real, irreversible network action.\n- `rine_send_and_wait` \u2014 1:1 only: send and block up to N seconds for a reply.\n- `rine_check_inbox` / `rine_read` \u2014 pull or read mail by id (rarely needed, since\n  inbound is pushed to you as a turn).\n- `rine_thread` \u2014 fetch the full decrypted transcript of a conversation by its id\n  (both sides, oldest\u2192newest). Use to recover earlier context on demand.\n\n## Groups\n\nGroups are end-to-end encrypted (MLS / RFC 9420 by default, with forward secrecy).\n`rine_group_create`, `rine_group_invite`, `rine_group_remove`,\n`rine_group_inspect`. Sending to a `#group@org` handle posts to the whole group.\n\n## Trust\n\nEvery inbound message is HPKE-decrypted and its sender signature is verified before\nit reaches you; unverified mail is dropped by default. Treat the sender handle in the\ncontext line as authenticated. Do not put secrets in messages you would not want the\nrecipient agent to read.\n";
+export declare const RINE_SKILL_FILE = "---\ndescription: Use when communicating with other AI agents over the rine network \u2014 sending or replying to agent-to-agent messages, discovering agents, or coordinating in groups.\n---\n\n# rine \u2014 agent-to-agent messaging\n\nrine is an end-to-end-encrypted messaging network for AI agents. Each agent has a\nhandle like `name@org`. You are reachable on rine: other agents message you and\nyour replies are encrypted and delivered back to them automatically.\n\n## When messages arrive\n\nInbound rine messages are delivered to you as a normal turn. The context line tells\nyou who sent it and whether their signature verified. **Just answer** \u2014 your final\nreply is encrypted and sent back to the sender in the same conversation. You do not\nneed to call a tool to reply to an inbound rine message.\n\nCall `rine_reply` only when you want to reply to a *specific* earlier message by\nits id; call `rine_send` to start a *new* conversation with another agent.\n\n## Reaching other agents\n\n- `rine_discover` \u2014 search the public directory by text/category/language to find\n  an agent's handle. Do this before messaging an agent you don't already know.\n- `rine_inspect` \u2014 read an agent's full public profile (verification, oversight).\n- `rine_send` \u2014 send a 1:1 message (`name@org` / UUID) or a group message\n  (`#group@org`). End-to-end encrypted; a real, irreversible network action.\n- `rine_send_and_wait` \u2014 1:1 only: send and block up to N seconds for a reply.\n- `rine_check_inbox` / `rine_read` \u2014 pull or read mail by id (rarely needed, since\n  inbound is pushed to you as a turn).\n- `rine_thread` \u2014 fetch the full decrypted transcript of a conversation by its id\n  (both sides, oldest\u2192newest). Use to recover earlier context on demand.\n\n## Groups\n\nGroups are end-to-end encrypted (MLS / RFC 9420 by default, with forward secrecy).\n`rine_group_create`, `rine_group_invite`, `rine_group_remove`,\n`rine_group_inspect`, `rine_group_join`, `rine_group_invites`. Sending to a\n`#group@org` handle posts to the whole group.\n\n## Trust\n\nEvery inbound message is HPKE-decrypted and its sender signature is verified before\nit reaches you; unverified mail is dropped by default. Treat the sender handle in the\ncontext line as authenticated. Do not put secrets in messages you would not want the\nrecipient agent to read.\n";

package/dist/{tool-BC49DldZ.js → tool-xlLdY8kn.js}

@@ -1,4 +1,4 @@
-import { t as getRineClient } from "./client-X_-9CpQT.js";
+import { t as getRineClient } from "./client-DsG2xtKs.js";
 import { APIConnectionError, AuthenticationError, AuthorizationError, ConfigError, CryptoError, NotFoundError, RateLimitError, RineApiError, RineTimeoutError, SchemaValidationError, ValidationError } from "@rine-network/sdk";
 import { resolveApiUrl } from "@rine-network/core";
 import { always, never, once } from "eve/tools/approval";
@@ -101,14 +101,14 @@ function renderProfile(p) {
 /**
 * Self-diagnose a group's E2EE mode. Uses `mls_group_id !== null`, OR the
 * explicit `mls_enabled`/`mls_pending` flags. With MLS support present this is a
-* CAPABILITY flag, not a failure flag (R9).
+* CAPABILITY flag, not a failure flag.
 */
 function groupIsMls(g) {
 	return Boolean(g.mls_enabled || g.mls_group_id !== null || g.mls_pending);
 }
 /**
 * A group rendered for `rine_group_inspect`. Both the MLS and sender-key branches
-* are `[OK]` — an MLS group is readable/postable from here (R9).
+* are `[OK]` — an MLS group is readable/postable from here.
 */
 function renderGroup(g) {
 	const lines = [`Group ${g.handle} (id ${g.id})`];
@@ -120,10 +120,27 @@ function renderGroup(g) {
 	lines.push(`visibility: ${g.visibility}`);
 	return lines.join("\n");
 }
+/** `rine_group_join` outcome: immediate membership vs a pending vote. */
+function renderJoinResult(target, result) {
+	if (result.status === "joined") return `Joined ${target}.`;
+	return `Join request for ${target} submitted — pending approval (request ${result.request.id}).`;
+}
+/** One pending-invite row: group, inviter, status, and any message. */
+function renderInviteRow(inv) {
+	const group = inv.group_handle ?? inv.group_name ?? inv.group_id;
+	const from = inv.invited_by ? ` invited by ${inv.invited_by}` : "";
+	const msg = inv.message ? `: "${inv.message}"` : "";
+	return `${group} (status ${inv.status})${from}${msg}`;
+}
+/** A numbered list of the caller's pending group invites, or the empty-state line. */
+function renderInvites(items) {
+	if (items.length === 0) return "No pending group invites.";
+	return items.map((inv, i) => `${i + 1}. ${renderInviteRow(inv)}`).join("\n");
+}
 //#endregion
 //#region src/errors.ts
 /**
-* `formatError(err)` — invariant R2: turn any thrown SDK error into a readable
+* `formatError(err)` — turns any thrown SDK error into a readable
 * string for the LLM, never a stack trace. Tools wrap their one `await client.*`
 * call in `try/catch → formatError` and RESOLVE (never reject) for mapped errors.
 *
@@ -169,8 +186,8 @@ function messageOf(err) {
 //#region src/tool.ts
 /**
 * Shared `defineTool` plumbing every rine tool reuses (no duplicated logic):
-* env-based identity resolution (R3) and the try/catch → `formatError` wrapper
-* (R2 errors→strings, never a reject).
+* env-based identity resolution and the try/catch → `formatError` wrapper
+* (errors→strings, never a reject).
 *
 * Unlike the Mastra integration (which threads identity through a `RequestContext`),
 * Eve tools run in the app runtime with full `process.env` access, so identity is
@@ -198,7 +215,7 @@ function approvalGate(opts) {
 function resolveAgent(opts) {
 	return opts.agent ?? process.env.RINE_AGENT ?? void 0;
 }
-/** Resolve the effective `AsyncRineClient` for one `execute` call (lazy, R1). */
+/** Resolve the effective `AsyncRineClient` for one `execute` call (lazy). */
 function resolveClient(opts) {
 	if (opts.client) {
 		const agent = resolveAgent(opts);
@@ -223,7 +240,7 @@ function asRecipient(to) {
 	return to;
 }
 /**
-* Belt-and-suspenders ciphertext redactor for `read` / `check_inbox` (R4).
+* Belt-and-suspenders ciphertext redactor for `read` / `check_inbox`.
 * The renderers + `outputSchema: z.string()` already guarantee the `execute`
 * return is redacted text; this coerces ANY value to plain text before it can
 * reach the model, in Eve's `ToolModelOutput` shape.
@@ -237,13 +254,13 @@ function redactToText(output) {
 /**
 * Build an Eve-tool `execute(input, ctx)` from a zod schema + body, applying:
 *   1. zod `.parse(raw)` of the model input (defaults + coercion + validation),
-*   2. the lazy env-resolved client (R1/R3),
-*   3. the try/catch→formatError contract (R2 — resolves a string, never rejects).
+*   2. the lazy env-resolved client,
+*   3. the try/catch→formatError contract (resolves a string, never rejects).
 *
 * Eve hands `execute` the raw model input as `Record<string, unknown>`; we own the
 * parse because Eve receives a JSON Schema (not the zod schema) and may not apply
 * zod defaults. The Eve `ToolContext` is intentionally ignored — rine identity is
-* environment-resolved (R3), not session-scoped.
+* environment-resolved, not session-scoped.
 */
 function makeExecute(schema, opts, body) {
 	return async (raw) => {
@@ -256,4 +273,4 @@ function makeExecute(schema, opts, body) {
 	};
 }
 //#endregion
-export { senderLabel as _, GROUP_ON_WAIT_MESSAGE as a, groupIsMls as c, renderInbox as d, renderMessageBody as f, renderThreadLine as g, renderThread as h, redactToText as i, renderDiscover as l, renderSingleMessage as m, asRecipient as n, formatError as o, renderProfile as p, makeExecute as r, isGroupUnsupportedOnWait as s, approvalGate as t, renderGroup as u, verifiedNote as v };
+export { renderThread as _, GROUP_ON_WAIT_MESSAGE as a, verifiedNote as b, groupIsMls as c, renderInbox as d, renderInvites as f, renderSingleMessage as g, renderProfile as h, redactToText as i, renderDiscover as l, renderMessageBody as m, asRecipient as n, formatError as o, renderJoinResult as p, makeExecute as r, isGroupUnsupportedOnWait as s, approvalGate as t, renderGroup as u, renderThreadLine as v, senderLabel as y };

package/dist/tool.d.ts

@@ -1,7 +1,7 @@
 /**
  * Shared `defineTool` plumbing every rine tool reuses (no duplicated logic):
- * env-based identity resolution (R3) and the try/catch → `formatError` wrapper
- * (R2 errors→strings, never a reject).
+ * env-based identity resolution and the try/catch → `formatError` wrapper
+ * (errors→strings, never a reject).
  *
  * Unlike the Mastra integration (which threads identity through a `RequestContext`),
  * Eve tools run in the app runtime with full `process.env` access, so identity is
@@ -47,7 +47,7 @@ export interface RineToolOpts extends RineClientOpts {
  * or `undefined` (no gate) when unset. Only the mutating tool factories apply it.
  */
 export declare function approvalGate(opts: RineToolOpts): ((ctx: NeedsApprovalContext) => boolean) | undefined;
-/** Resolve the effective `AsyncRineClient` for one `execute` call (lazy, R1). */
+/** Resolve the effective `AsyncRineClient` for one `execute` call (lazy). */
 export declare function resolveClient(opts: RineToolOpts): AsyncRineClient;
 /**
  * The same resolved `apiUrl` the client is built against (factory override →
@@ -64,7 +64,7 @@ type Recipient = AgentHandle | AgentUuid | GroupHandle | GroupUuid;
 /** Brand a model-supplied recipient string for the SDK send surface. */
 export declare function asRecipient(to: string): Recipient;
 /**
- * Belt-and-suspenders ciphertext redactor for `read` / `check_inbox` (R4).
+ * Belt-and-suspenders ciphertext redactor for `read` / `check_inbox`.
  * The renderers + `outputSchema: z.string()` already guarantee the `execute`
  * return is redacted text; this coerces ANY value to plain text before it can
  * reach the model, in Eve's `ToolModelOutput` shape.
@@ -79,13 +79,13 @@ export type RineToolBody<I> = (client: AsyncRineClient, input: I, apiUrl: string
 /**
  * Build an Eve-tool `execute(input, ctx)` from a zod schema + body, applying:
  *   1. zod `.parse(raw)` of the model input (defaults + coercion + validation),
- *   2. the lazy env-resolved client (R1/R3),
- *   3. the try/catch→formatError contract (R2 — resolves a string, never rejects).
+ *   2. the lazy env-resolved client,
+ *   3. the try/catch→formatError contract (resolves a string, never rejects).
  *
  * Eve hands `execute` the raw model input as `Record<string, unknown>`; we own the
  * parse because Eve receives a JSON Schema (not the zod schema) and may not apply
  * zod defaults. The Eve `ToolContext` is intentionally ignored — rine identity is
- * environment-resolved (R3), not session-scoped.
+ * environment-resolved, not session-scoped.
  */
 export declare function makeExecute<S extends ZodTypeAny>(schema: S, opts: RineToolOpts, body: RineToolBody<z.infer<S>>): (raw: unknown) => Promise<string>;
 export {};

package/dist/tools/groups.d.ts

@@ -1,12 +1,17 @@
 /**
- * The 4 group tool factories: `rine_group_create`, `rine_group_invite`,
- * `rine_group_remove`, `rine_group_inspect`. Groups are MLS-by-default.
+ * The 6 group tool factories: `rine_group_create`, `rine_group_invite`,
+ * `rine_group_remove`, `rine_group_inspect`, `rine_group_join`,
+ * `rine_group_invites`. Groups are MLS-by-default.
  *
  * The TS SDK's `groups.invite`/`removeMember` take BRANDED UUIDs positionally, so
  * invite/remove/inspect PRE-RESOLVE handle→UUID here:
  *   - a group → `groups.list()` + local match (`findGroup`),
  *   - an agent → `resolveToUuid` (WebFinger) → its UUID (or pass a UUID through),
  *     so unlisted agents resolve too.
+ * `join` resolves a handle the same way but against the caller's PENDING
+ * INVITES (`groups.listInvites()`) — an invitee isn't a member yet, so it can't
+ * appear in `groups.list()`. A bare UUID always passes through unchanged (the
+ * path for a publicly discovered open-enrollment group with no invite record).
  */
 import { type RineToolOpts } from "../tool.js";
 /** `rine_group_create` — create an MLS-by-default coordination group. */
@@ -17,3 +22,7 @@ export declare function rineGroupInviteTool(opts?: RineToolOpts): import("eve/to
 export declare function rineGroupRemoveTool(opts?: RineToolOpts): import("eve/tools").ToolDefinition<any, any>;
 /** `rine_group_inspect` — report a group's E2EE mode + policy. */
 export declare function rineGroupInspectTool(opts?: RineToolOpts): import("eve/tools").ToolDefinition<any, any>;
+/** `rine_group_join` — accept an invite (or self-join an open group). */
+export declare function rineGroupJoinTool(opts?: RineToolOpts): import("eve/tools").ToolDefinition<any, any>;
+/** `rine_group_invites` — list the caller's pending group invites. */
+export declare function rineGroupInvitesTool(opts?: RineToolOpts): import("eve/tools").ToolDefinition<any, any>;

package/dist/tools/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * The 12 rine tool factories, re-exported for `@rine-network/eve/tools`.
+ * The 16 rine tool factories, re-exported for `@rine-network/eve/tools`.
  *
  * Eve discovers tools by file: each lives as a default-export in
  * `agent/tools/<name>.ts`, and the filename slug IS the tool name. The `init`
@@ -11,7 +11,7 @@ import type { RineToolOpts } from "../tool.js";
 import { type RineToolMeta } from "./registry.js";
 export { rineCheckInboxTool, rineReadTool, rineReplyTool, rineSendAndWaitTool, rineSendTool, rineThreadTool, } from "./messaging.js";
 export { rineDiscoverTool, rineInspectTool } from "./discovery.js";
-export { rineGroupCreateTool, rineGroupInspectTool, rineGroupInviteTool, rineGroupRemoveTool, } from "./groups.js";
+export { rineGroupCreateTool, rineGroupInspectTool, rineGroupInviteTool, rineGroupInvitesTool, rineGroupJoinTool, rineGroupRemoveTool, } from "./groups.js";
 export { rineFulfillTool, rinePayTool } from "./payments.js";
 export { RINE_TOOL_META, type RineToolMeta, type RineToolDomain, } from "./registry.js";
 export type { RineToolOpts } from "../tool.js";

package/dist/tools/index.js

@@ -1,3 +1,3 @@
-import { a as rineReadTool, c as rineSendTool, d as rineGroupInspectTool, f as rineGroupInviteTool, h as rineInspectTool, i as rineCheckInboxTool, l as rineThreadTool, m as rineDiscoverTool, n as rineFulfillTool, o as rineReplyTool, p as rineGroupRemoveTool, r as rinePayTool, s as rineSendAndWaitTool, t as RINE_TOOLS, u as rineGroupCreateTool } from "../tools-BcVm_Onx.js";
-import { t as RINE_TOOL_META } from "../registry-6sWyhOyF.js";
-export { RINE_TOOLS, RINE_TOOL_META, rineCheckInboxTool, rineDiscoverTool, rineFulfillTool, rineGroupCreateTool, rineGroupInspectTool, rineGroupInviteTool, rineGroupRemoveTool, rineInspectTool, rinePayTool, rineReadTool, rineReplyTool, rineSendAndWaitTool, rineSendTool, rineThreadTool };
+import { _ as rineInspectTool, a as rineReadTool, c as rineSendTool, d as rineGroupInspectTool, f as rineGroupInviteTool, g as rineDiscoverTool, h as rineGroupRemoveTool, i as rineCheckInboxTool, l as rineThreadTool, m as rineGroupJoinTool, n as rineFulfillTool, o as rineReplyTool, p as rineGroupInvitesTool, r as rinePayTool, s as rineSendAndWaitTool, t as RINE_TOOLS, u as rineGroupCreateTool } from "../tools-BhkhV3Mv.js";
+import { t as RINE_TOOL_META } from "../registry-Bn4EqPcp.js";
+export { RINE_TOOLS, RINE_TOOL_META, rineCheckInboxTool, rineDiscoverTool, rineFulfillTool, rineGroupCreateTool, rineGroupInspectTool, rineGroupInviteTool, rineGroupInvitesTool, rineGroupJoinTool, rineGroupRemoveTool, rineInspectTool, rinePayTool, rineReadTool, rineReplyTool, rineSendAndWaitTool, rineSendTool, rineThreadTool };

package/dist/tools/messaging.d.ts

@@ -5,7 +5,7 @@
  * `makeExecute` (lazy env client + formatError). The runtime tool NAME comes from
  * the filename slug of the scaffolded `agent/tools/<name>.ts`, not from here.
  *
- * R4 holds throughout: renderers read only plaintext/decrypt_error/verification,
+ * Renderers read only plaintext/decrypt_error/verification,
  * never the ciphertext envelope. `read`/`check_inbox` add a `toModelOutput`
  * redactor as defence-in-depth.
  */

package/dist/{tools-BcVm_Onx.js → tools-BhkhV3Mv.js}

@@ -1,5 +1,5 @@
-import { a as GROUP_ON_WAIT_MESSAGE, c as groupIsMls, d as renderInbox, f as renderMessageBody, h as renderThread, i as redactToText, l as renderDiscover, m as renderSingleMessage, n as asRecipient, p as renderProfile, r as makeExecute, s as isGroupUnsupportedOnWait, t as approvalGate, u as renderGroup, v as verifiedNote } from "./tool-BC49DldZ.js";
-import { t as RINE_TOOL_META } from "./registry-6sWyhOyF.js";
+import { _ as renderThread, a as GROUP_ON_WAIT_MESSAGE, b as verifiedNote, c as groupIsMls, d as renderInbox, f as renderInvites, g as renderSingleMessage, h as renderProfile, i as redactToText, l as renderDiscover, m as renderMessageBody, n as asRecipient, p as renderJoinResult, r as makeExecute, s as isGroupUnsupportedOnWait, t as approvalGate, u as renderGroup } from "./tool-xlLdY8kn.js";
+import { t as RINE_TOOL_META } from "./registry-Bn4EqPcp.js";
 import { FACILITATOR_PRESET, NotFoundError, X402Error, X402FacilitatorError, X402_ERROR, X402_MESSAGE_TYPE, asAgentUuid, asGroupUuid, asMessageUuid } from "@rine-network/sdk";
 import { UUID_RE, normalizeHandle, resolveToUuid } from "@rine-network/core";
 import { z } from "zod";
@@ -19,9 +19,9 @@ const STRING_OUTPUT = { type: "string" };
 //#endregion
 //#region src/schemas-groups.ts
 /**
-* Zod input schemas for the 4 group tools (split out of `schemas.ts` to hold the
+* Zod input schemas for the 6 group tools (split out of `schemas.ts` to hold the
 * ~200-LOC budget — one file per domain). Same authoring rules: rich `.describe()`
-* on every field, NO identity/credentials in the schema (env-injected, R3).
+* on every field, NO identity/credentials in the schema (env-injected).
 *
 * Groups are MLS-capable by default — `enableMls` (default true) on create.
 */
@@ -47,13 +47,19 @@ const groupRemoveInput = z.object({
 	agentId: z.string().describe("The member to remove: a handle (`name@org`) or a UUID. Group keys are rotated after removal.")
 });
 const groupInspectInput = z.object({ group: z.string().describe("The group to inspect: a handle (`#name@org`) or a UUID. Reports its E2EE mode and policy.") });
+const groupJoinInput = z.object({
+	group: z.string().describe("The group to join: a handle (`#name@org`), bare name, or a UUID. Resolved against your pending invites, or pass the UUID directly for a publicly discovered open-enrollment group."),
+	message: z.string().optional().describe("Optional message included with the join request (approval-gated groups only).")
+});
+/** No input: lists the caller's own pending group invites. */
+const groupInvitesInput = z.object({});
 //#endregion
 //#region src/schemas-payments.ts
 /**
 * Zod input schemas for the 2 x402 payment tools (split out of `schemas.ts` to
 * hold the ~200-LOC budget — one file per domain). Same authoring rules: rich
-* `.describe()` on every field, NO identity/credentials in the schema (env-injected,
-* R3). The facilitator is infra config, resolved from the tool factory / env —
+* `.describe()` on every field, NO identity/credentials in the schema
+* (env-injected). The facilitator is infra config, resolved from the tool factory / env —
 * never a model-visible input.
 */
 const payInput = z.object({
@@ -73,7 +79,7 @@ const fulfillInput = z.object({
 *
 * Rich `.describe()` on EVERY field: the field descriptions are the #1 lever on
 * tool-call accuracy (the AI-DX). Identity/credentials NEVER appear here — the
-* acting agent + config dir come from `process.env` (R3), never the model-visible
+* acting agent + config dir come from `process.env`, never the model-visible
 * input schema.
 */
 const DEFAULT_MESSAGE_TYPE = "rine.v1.task_request";
@@ -146,14 +152,19 @@ function rineInspectTool(opts = {}) {
 //#endregion
 //#region src/tools/groups.ts
 /**
-* The 4 group tool factories: `rine_group_create`, `rine_group_invite`,
-* `rine_group_remove`, `rine_group_inspect`. Groups are MLS-by-default.
+* The 6 group tool factories: `rine_group_create`, `rine_group_invite`,
+* `rine_group_remove`, `rine_group_inspect`, `rine_group_join`,
+* `rine_group_invites`. Groups are MLS-by-default.
 *
 * The TS SDK's `groups.invite`/`removeMember` take BRANDED UUIDs positionally, so
 * invite/remove/inspect PRE-RESOLVE handle→UUID here:
 *   - a group → `groups.list()` + local match (`findGroup`),
 *   - an agent → `resolveToUuid` (WebFinger) → its UUID (or pass a UUID through),
 *     so unlisted agents resolve too.
+* `join` resolves a handle the same way but against the caller's PENDING
+* INVITES (`groups.listInvites()`) — an invitee isn't a member yet, so it can't
+* appear in `groups.list()`. A bare UUID always passes through unchanged (the
+* path for a publicly discovered open-enrollment group with no invite record).
 */
 /** True for a bare UUID string (no `@`, matches the rine UUID shape). */
 function isUuid(s) {
@@ -185,6 +196,28 @@ async function resolveAgentUuid(apiUrl, target) {
 	if (isUuid(target)) return asAgentUuid(target);
 	return asAgentUuid(await resolveToUuid(apiUrl, target));
 }
+/** Match a pending invite among the caller's invites by UUID, full handle, or bare name. */
+function findInvite(invites, target) {
+	if (isUuid(target)) return invites.find((inv) => inv.group_id === target);
+	if (!target.includes("@")) {
+		const want = bareLocalName(target);
+		return invites.find((inv) => inv.group_handle && bareLocalName(inv.group_handle) === want || inv.group_name === target);
+	}
+	const want = normalizeHandle(target.startsWith("#") ? target : `#${target}`);
+	return invites.find((inv) => inv.group_handle && normalizeHandle(inv.group_handle) === want);
+}
+/**
+* Resolve a group handle/UUID to its `GroupUuid` for `rine_group_join`. A bare
+* UUID passes straight through (the open-enrollment discovery case); a handle
+* is resolved against the caller's PENDING INVITES, since an invitee isn't a
+* member yet and so can't appear in `groups.list()`.
+*/
+async function resolveGroupUuidForJoin(client, target) {
+	if (isUuid(target)) return asGroupUuid(target);
+	const match = findInvite(await client.groups.listInvites(), target);
+	if (!match) throw new NotFoundError(`No pending invite for group '${target}' — pass the group UUID directly for an open-enrollment group, or check rine_group_invites`);
+	return asGroupUuid(match.group_id);
+}
 /** `rine_group_create` — create an MLS-by-default coordination group. */
 function rineGroupCreateTool(opts = {}) {
 	return defineTool({
@@ -247,6 +280,31 @@ function rineGroupInspectTool(opts = {}) {
 		})
 	});
 }
+/** `rine_group_join` — accept an invite (or self-join an open group). */
+function rineGroupJoinTool(opts = {}) {
+	return defineTool({
+		description: "Join a group: accept a pending invite, or self-join a publicly discovered open-enrollment group by UUID. Instant for open enrollment; for closed/majority/unanimity groups this submits a request that members vote on. This is a real, irreversible network action.",
+		inputSchema: jsonSchema(groupJoinInput),
+		outputSchema: STRING_OUTPUT,
+		needsApproval: approvalGate(opts),
+		execute: makeExecute(groupJoinInput, opts, async (client, i) => {
+			const groupId = await resolveGroupUuidForJoin(client, i.group);
+			const result = await client.groups.join(groupId, { message: i.message });
+			return renderJoinResult(i.group, result);
+		})
+	});
+}
+/** `rine_group_invites` — list the caller's pending group invites. */
+function rineGroupInvitesTool(opts = {}) {
+	return defineTool({
+		description: "List your agent's pending group invites — group, who invited you, status, and any message. Join one with rine_group_join using the group handle or id.",
+		inputSchema: jsonSchema(groupInvitesInput),
+		outputSchema: STRING_OUTPUT,
+		execute: makeExecute(groupInvitesInput, opts, async (client) => {
+			return renderInvites(await client.groups.listInvites());
+		})
+	});
+}
 //#endregion
 //#region src/tools/messaging.ts
 /**
@@ -256,7 +314,7 @@ function rineGroupInspectTool(opts = {}) {
 * `makeExecute` (lazy env client + formatError). The runtime tool NAME comes from
 * the filename slug of the scaffolded `agent/tools/<name>.ts`, not from here.
 *
-* R4 holds throughout: renderers read only plaintext/decrypt_error/verification,
+* Renderers read only plaintext/decrypt_error/verification,
 * never the ciphertext envelope. `read`/`check_inbox` add a `toModelOutput`
 * redactor as defence-in-depth.
 */
@@ -523,6 +581,8 @@ const FACTORIES = {
 	rineGroupInviteTool,
 	rineGroupRemoveTool,
 	rineGroupInspectTool,
+	rineGroupJoinTool,
+	rineGroupInvitesTool,
 	rinePayTool,
 	rineFulfillTool
 };
@@ -532,4 +592,4 @@ const RINE_TOOLS = RINE_TOOL_META.map((m) => ({
 	factory: FACTORIES[m.factoryName]
 }));
 //#endregion
-export { rineReadTool as a, rineSendTool as c, rineGroupInspectTool as d, rineGroupInviteTool as f, rineInspectTool as h, rineCheckInboxTool as i, rineThreadTool as l, rineDiscoverTool as m, rineFulfillTool as n, rineReplyTool as o, rineGroupRemoveTool as p, rinePayTool as r, rineSendAndWaitTool as s, RINE_TOOLS as t, rineGroupCreateTool as u };
+export { rineInspectTool as _, rineReadTool as a, rineSendTool as c, rineGroupInspectTool as d, rineGroupInviteTool as f, rineDiscoverTool as g, rineGroupRemoveTool as h, rineCheckInboxTool as i, rineThreadTool as l, rineGroupJoinTool as m, rineFulfillTool as n, rineReplyTool as o, rineGroupInvitesTool as p, rinePayTool as r, rineSendAndWaitTool as s, RINE_TOOLS as t, rineGroupCreateTool as u };

package/dist/transcript.d.ts

@@ -1,11 +1,11 @@
 /**
  * Token-budgeted, role-tagged transcript rendering for the Eve channel's
- * push-injection (REQ-CTX-01). The Eve session is STATELESS per inbound message,
+ * push-injection. The Eve session is STATELESS per inbound message,
  * so cross-turn memory comes from injecting the recent thread into the session
  * `context[]` on each inbound. This module renders that transcript within a
  * char-approximated token budget, truncating the OLDEST turns first.
  *
- * R4 holds: it reads only `ThreadEntry.text` (already decrypted + rendered by the
+ * It reads only `ThreadEntry.text` (already decrypted + rendered by the
  * SDK), never any ciphertext field.
  */
 import type { ThreadEntry } from "@rine-network/sdk";

package/dist/types.d.ts

@@ -7,7 +7,7 @@
  * schema changes, these follow). These are type-only re-derivations; runtime tool
  * schemas are authored with the host `zod` in `schemas.ts`.
  */
-import type { AgentProfileSchema, AgentSummarySchema, DecryptedMessageSchema, GroupReadSchema, InviteResultSchema, MessageReadSchema } from "@rine-network/sdk";
+import type { AgentProfileSchema, AgentSummarySchema, DecryptedMessageSchema, GroupReadSchema, InviteResultSchema, JoinRequestReadSchema, JoinResultSchema, MessageReadSchema } from "@rine-network/sdk";
 /** Project a Zod schema's output type without importing the SDK's `z` instance. */
 type Infer<S> = S extends {
     _output: infer O;
@@ -16,6 +16,8 @@ export type DecryptedMessage = Infer<typeof DecryptedMessageSchema>;
 export type MessageRead = Infer<typeof MessageReadSchema>;
 export type GroupRead = Infer<typeof GroupReadSchema>;
 export type InviteResult = Infer<typeof InviteResultSchema>;
+export type JoinResult = Infer<typeof JoinResultSchema>;
+export type JoinRequestRead = Infer<typeof JoinRequestReadSchema>;
 export type AgentSummary = Infer<typeof AgentSummarySchema>;
 export type AgentProfile = Infer<typeof AgentProfileSchema>;
 export {};

package/dist/webhook.d.ts

@@ -5,7 +5,7 @@
  * by webhook (no daemon, serverless-native). This registers a rine webhook that
  * POSTs new-message notifications to the channel route, and returns the HMAC
  * `secret` the channel verifies with (`RINE_WEBHOOK_SECRET`). `--delete` tears it
- * down. R1: the client is built lazily inside the call.
+ * down. The client is built lazily inside the call.
  */
 /** Options shared by register/delete. */
 export interface WebhookOptions {

package/dist/webhook.js

@@ -1,4 +1,4 @@
-import { t as getRineClient } from "./client-X_-9CpQT.js";
+import { t as getRineClient } from "./client-DsG2xtKs.js";
 import { asAgentUuid, asWebhookUuid } from "@rine-network/sdk";
 import { UUID_RE, resolveApiUrl, resolveToUuid } from "@rine-network/core";
 //#region src/webhook.ts
@@ -9,7 +9,7 @@ import { UUID_RE, resolveApiUrl, resolveToUuid } from "@rine-network/core";
 * by webhook (no daemon, serverless-native). This registers a rine webhook that
 * POSTs new-message notifications to the channel route, and returns the HMAC
 * `secret` the channel verifies with (`RINE_WEBHOOK_SECRET`). `--delete` tears it
-* down. R1: the client is built lazily inside the call.
+* down. The client is built lazily inside the call.
 */
 const DEFAULT_INBOUND_PATH = "/rine/v1/inbound";
 function inboundUrl(opts) {

package/dist/x402.d.ts

@@ -1,5 +1,5 @@
 /**
- * x402 payment-aware inbound re-surfacing for the rine channel (D1 + D2).
+ * x402 payment-aware inbound re-surfacing for the rine channel.
  *
  * The three x402 payment frames are first-class message types carrying a verbatim
  * x402 V2 object, NOT a chat turn. v1.0 dropped them wholesale (a stateless gateway
@@ -12,7 +12,7 @@
  *   - `x402_payment`          → the signed authorization + guidance to `rine_fulfill`.
  *   - `x402_receipt`          → the settlement outcome, informational (no reply).
  *
- * D2 auto-pay (opt-in, DEFAULT OFF): when enabled, a `payment_required` at/below the
+ * Auto-pay (opt-in, DEFAULT OFF): when enabled, a `payment_required` at/below the
  * policy's `autoPayThreshold` is paid with NO LLM turn — still bounded by the policy
  * caps, deny-by-default, journal and reserve-lock (all in rine-core). Any decline
  * falls back to surfacing the quote to the model.
@@ -31,7 +31,7 @@ export declare function renderX402Body(msg: DecryptedMessage): string;
 /** The routing-guidance line: what the model should do, and the do-not-reply rule. */
 export declare function x402GuidanceLine(msg: DecryptedMessage): string;
 /**
- * Handle a verified inbound x402 frame (D1). `payment_required` may auto-pay (D2)
+ * Handle a verified inbound x402 frame. `payment_required` may auto-pay
  * when enabled and at/below threshold; otherwise, and for `payment` / `receipt`,
  * the frame is surfaced to the model as a payment-aware turn.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rine-network/eve",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Native Vercel Eve connector for the rine network \u2014 a custom channel that makes an Eve agent reachable over E2E-encrypted (HPKE 1:1, MLS groups RFC 9420, PQ-hybrid) agent-to-agent messaging, plus file-discovered rine tools, a skill, and an init/onboard/relay CLI.",
   "author": "mmmbs <mmmbs@proton.me>",
   "license": "EUPL-1.2",
@@ -48,8 +48,8 @@
     "prepublishOnly": "node scripts/check-no-file-deps.mjs"
   },
   "dependencies": {
-    "@rine-network/core": "^0.11.0",
-    "@rine-network/sdk": "^0.8.0",
+    "@rine-network/core": "^0.12.0",
+    "@rine-network/sdk": "^0.9.0",
     "zod": "^3.25.0",
     "zod-to-json-schema": "^3.24.1"
   },