@rine-network/mastra 0.1.0

package/dist/onboard.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Setup helper — `npx @rine-network/mastra onboard` (SPEC §11, D-not-tools).
+ *
+ * Runs the SDK's RSA time-lock proof-of-work to register a fresh org, then
+ * creates the first agent and prints its handle + verification words. This is
+ * NEVER a `createTool` — a ~30–60 s PoW does not belong in an LLM turn; it is an
+ * out-of-band CLI a human runs once.
+ *
+ * I-1: no client is built at module load — `runOnboard` constructs the client
+ * lazily, only when invoked. The PoW + credential write are delegated wholesale
+ * to the SDK's `register(opts)` (over rine-core `performRegistration`); the agent
+ * keypair is generated + persisted by `client.createAgent(name)`.
+ *
+ * Config resolution is explicit (D-config-resolve): `register` REQUIRES concrete
+ * `apiUrl`/`configDir` strings, so we resolve them via rine-core unless the caller
+ * passed overrides (the SDK never resolves them itself).
+ */
+/** Options for {@link runOnboard}. */
+export interface OnboardOptions {
+    /** Registration email address. */
+    email: string;
+    /** Organisation slug (validated client-side by the SDK's `register`). */
+    slug: string;
+    /** Organisation display name (the first agent's name derives from it). */
+    name: string;
+    /** API base URL; when omitted, `resolveApiUrl()` is used. */
+    apiUrl?: string;
+    /** Config dir for credential + key persistence; `resolveConfigDir()` if omitted. */
+    configDir?: string;
+    /**
+     * Handle-safe first-agent name (handle local-part); defaults to
+     * {@link agentNameFromOrgName}(`name`, `slug`). A free-form `name` like
+     * "My Org" is invalid verbatim (server rejects uppercase/spaces).
+     */
+    agentName?: string;
+}
+/**
+ * Derive a server-valid agent name (handle local-part: 1–200 lowercase alnum +
+ * interior hyphens) from a free-form display name: lowercase, fold non-alnum
+ * runs to single hyphens, trim edges, cap at 200; fall back to `slug` if empty.
+ */
+export declare function agentNameFromOrgName(name: string, slug: string): string;
+/** Where {@link runOnboard} writes its progress/output (stdout by default). */
+export interface OnboardIO {
+    log: (line: string) => void;
+}
+/**
+ * Register a fresh org (RSA PoW), create its first agent, and print the handle +
+ * verification words. Returns the new agent's handle. Errors propagate (this is a
+ * CLI, not an LLM tool — a failed onboard should exit non-zero).
+ */
+export declare function runOnboard(opts: OnboardOptions, io?: OnboardIO): Promise<string>;
+/** Parsed `onboard` CLI arguments. */
+export interface OnboardArgs {
+    email: string;
+    slug: string;
+    name: string;
+    apiUrl?: string;
+    configDir?: string;
+    agentName?: string;
+}
+/**
+ * Parse `onboard` argv (the slice AFTER the `onboard` subcommand). Throws on a
+ * missing required flag or unknown flag so the bin can print usage + exit 1.
+ * Pure + side-effect-free so it is unit-testable without running a real PoW.
+ */
+export declare function parseOnboardArgs(argv: readonly string[]): OnboardArgs;
+/**
+ * The `bin` entry point. `argv` is the full `process.argv.slice(2)` (with the
+ * `onboard` subcommand as the first element). Prints usage + exits non-zero on a
+ * parse error; otherwise runs the onboard flow.
+ */
+export declare function main(argv: readonly string[], io?: OnboardIO): Promise<void>;

package/dist/onboard.js

@@ -0,0 +1,134 @@
+import { resolveApiUrl, resolveConfigDir } from "@rine-network/core";
+import { AsyncRineClient, register } from "@rine-network/sdk";
+//#region src/onboard.ts
+/**
+* Setup helper — `npx @rine-network/mastra onboard` (SPEC §11, D-not-tools).
+*
+* Runs the SDK's RSA time-lock proof-of-work to register a fresh org, then
+* creates the first agent and prints its handle + verification words. This is
+* NEVER a `createTool` — a ~30–60 s PoW does not belong in an LLM turn; it is an
+* out-of-band CLI a human runs once.
+*
+* I-1: no client is built at module load — `runOnboard` constructs the client
+* lazily, only when invoked. The PoW + credential write are delegated wholesale
+* to the SDK's `register(opts)` (over rine-core `performRegistration`); the agent
+* keypair is generated + persisted by `client.createAgent(name)`.
+*
+* Config resolution is explicit (D-config-resolve): `register` REQUIRES concrete
+* `apiUrl`/`configDir` strings, so we resolve them via rine-core unless the caller
+* passed overrides (the SDK never resolves them itself).
+*/
+/**
+* Derive a server-valid agent name (handle local-part: 1–200 lowercase alnum +
+* interior hyphens) from a free-form display name: lowercase, fold non-alnum
+* runs to single hyphens, trim edges, cap at 200; fall back to `slug` if empty.
+*/
+function agentNameFromOrgName(name, slug) {
+	const derived = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 200).replace(/-+$/g, "");
+	return derived.length > 0 ? derived : slug;
+}
+const stdoutIO = { log: (line) => process.stdout.write(`${line}\n`) };
+/**
+* Register a fresh org (RSA PoW), create its first agent, and print the handle +
+* verification words. Returns the new agent's handle. Errors propagate (this is a
+* CLI, not an LLM tool — a failed onboard should exit non-zero).
+*/
+async function runOnboard(opts, io = stdoutIO) {
+	const apiUrl = opts.apiUrl ?? resolveApiUrl();
+	const configDir = opts.configDir ?? resolveConfigDir();
+	io.log(`Onboarding org "${opts.slug}" at ${apiUrl} …`);
+	io.log("Solving registration proof-of-work (this takes ~30–60 s) …");
+	let lastPct = -1;
+	await register({
+		apiUrl,
+		configDir,
+		email: opts.email,
+		slug: opts.slug,
+		name: opts.name,
+		onProgress: (pct) => {
+			const whole = Math.floor(pct);
+			if (whole > lastPct) {
+				lastPct = whole;
+				io.log(`  proof-of-work ${whole}%`);
+			}
+		}
+	});
+	io.log("Registered. Creating your first agent …");
+	const client = new AsyncRineClient({
+		configDir,
+		apiUrl
+	});
+	const agentName = opts.agentName ?? agentNameFromOrgName(opts.name, opts.slug);
+	const agent = await client.createAgent(agentName);
+	io.log("");
+	io.log(`Agent ready: ${agent.handle}`);
+	if (agent.verification_words) io.log(`Verification words: ${agent.verification_words}`);
+	io.log(`Config dir: ${configDir}`);
+	io.log("Set RINE_CONFIG_DIR to this path (or RINE_CLIENT_ID/RINE_CLIENT_SECRET) so your Mastra tools authenticate.");
+	return agent.handle;
+}
+const USAGE = "Usage: npx @rine-network/mastra onboard --email <e> --slug <s> --name <n> [--agent-name <a>] [--api-url <u>] [--config-dir <d>]";
+/**
+* Parse `onboard` argv (the slice AFTER the `onboard` subcommand). Throws on a
+* missing required flag or unknown flag so the bin can print usage + exit 1.
+* Pure + side-effect-free so it is unit-testable without running a real PoW.
+*/
+function parseOnboardArgs(argv) {
+	const flags = {};
+	for (let i = 0; i < argv.length; i++) {
+		const arg = argv[i];
+		if (!arg?.startsWith("--")) throw new Error(`Unexpected argument: ${arg}`);
+		const key = arg.slice(2);
+		const value = argv[++i];
+		if (value === void 0) throw new Error(`Missing value for --${key}`);
+		flags[key] = value;
+	}
+	const known = new Set([
+		"email",
+		"slug",
+		"name",
+		"agent-name",
+		"api-url",
+		"config-dir"
+	]);
+	for (const key of Object.keys(flags)) if (!known.has(key)) throw new Error(`Unknown flag: --${key}`);
+	const missing = [
+		"email",
+		"slug",
+		"name"
+	].filter((k) => !flags[k]);
+	if (missing.length > 0) throw new Error(`Missing required flag(s): ${missing.map((m) => `--${m}`).join(", ")}`);
+	return {
+		email: flags.email,
+		slug: flags.slug,
+		name: flags.name,
+		apiUrl: flags["api-url"],
+		configDir: flags["config-dir"],
+		agentName: flags["agent-name"]
+	};
+}
+/**
+* The `bin` entry point. `argv` is the full `process.argv.slice(2)` (with the
+* `onboard` subcommand as the first element). Prints usage + exits non-zero on a
+* parse error; otherwise runs the onboard flow.
+*/
+async function main(argv, io = stdoutIO) {
+	const [sub, ...rest] = argv;
+	if (sub !== "onboard") {
+		io.log(USAGE);
+		process.exitCode = 1;
+		return;
+	}
+	let args;
+	try {
+		args = parseOnboardArgs(rest);
+	} catch (err) {
+		io.log(err instanceof Error ? err.message : String(err));
+		io.log(USAGE);
+		process.exitCode = 1;
+		return;
+	}
+	await runOnboard(args, io);
+}
+//#endregion
+export { agentNameFromOrgName, main, parseOnboardArgs, runOnboard };

package/dist/schemas-groups.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Zod input schemas for the 4 group tools (split out of `schemas.ts` to hold the
+ * ~200-LOC budget — the schema concentration the SPEC §4 endorses, one file per
+ * domain). Same authoring rules: HOST `zod`, rich `.describe()` on every field,
+ * NO identity/credentials in the schema (host-injected via `ctx.requestContext`).
+ *
+ * Groups are MLS-capable by default — `enableMls` (default true) on create is the
+ * headline inversion vs the Python siblings (D-mls).
+ */
+import { z } from "zod";
+export declare const groupCreateInput: z.ZodObject<{
+    name: z.ZodString;
+    enrollment: z.ZodDefault<z.ZodEnum<["open", "closed", "majority", "unanimity"]>>;
+    visibility: z.ZodDefault<z.ZodEnum<["public", "private"]>>;
+    description: z.ZodOptional<z.ZodString>;
+    enableMls: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    enrollment: "open" | "closed" | "majority" | "unanimity";
+    visibility: "public" | "private";
+    enableMls: boolean;
+    description?: string | undefined;
+}, {
+    name: string;
+    enrollment?: "open" | "closed" | "majority" | "unanimity" | undefined;
+    visibility?: "public" | "private" | undefined;
+    description?: string | undefined;
+    enableMls?: boolean | undefined;
+}>;
+export declare const groupInviteInput: z.ZodObject<{
+    group: z.ZodString;
+    agentToInvite: z.ZodString;
+    message: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    group: string;
+    agentToInvite: string;
+    message?: string | undefined;
+}, {
+    group: string;
+    agentToInvite: string;
+    message?: string | undefined;
+}>;
+export declare const groupRemoveInput: z.ZodObject<{
+    group: z.ZodString;
+    agentId: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    group: string;
+    agentId: string;
+}, {
+    group: string;
+    agentId: string;
+}>;
+export declare const groupInspectInput: z.ZodObject<{
+    group: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    group: string;
+}, {
+    group: string;
+}>;

package/dist/schemas.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Shared Zod input schemas for the 11 rine tools.
+ *
+ * Authored with the HOST `zod` (`import { z } from "zod"`) — the single hoisted
+ * instance Mastra validates against — NOT the SDK's re-exported `z`. Rich
+ * `.describe()` on EVERY field: the field descriptions are the #1 lever on
+ * tool-call accuracy (the AI-DX). Identity/credentials NEVER appear here — the
+ * acting agent + config dir are read from `ctx.requestContext`, never the model-
+ * visible input schema (I-2 / Mastra's own security rule).
+ *
+ * `messageType`/`idempotencyKey`/etc. ports drop the Python `tag`/`jurisdiction`/
+ * `pricingModel` discover fields (the TS `DiscoveryFilters` lacks them) and add
+ * `enableMls` (default true) on group_create — the headline inversion (D-mls).
+ */
+import { z } from "zod";
+export declare const sendInput: z.ZodObject<{
+    to: z.ZodString;
+    body: z.ZodString;
+    messageType: z.ZodDefault<z.ZodString>;
+    idempotencyKey: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    to: string;
+    body: string;
+    messageType: string;
+    idempotencyKey?: string | undefined;
+}, {
+    to: string;
+    body: string;
+    messageType?: string | undefined;
+    idempotencyKey?: string | undefined;
+}>;
+export declare const sendAndWaitInput: z.ZodObject<{
+    to: z.ZodString;
+    body: z.ZodString;
+    waitSeconds: z.ZodDefault<z.ZodNumber>;
+    messageType: z.ZodDefault<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    to: string;
+    body: string;
+    messageType: string;
+    waitSeconds: number;
+}, {
+    to: string;
+    body: string;
+    messageType?: string | undefined;
+    waitSeconds?: number | undefined;
+}>;
+export declare const checkInboxInput: z.ZodObject<{
+    limit: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    limit: number;
+}, {
+    limit?: number | undefined;
+}>;
+export declare const readInput: z.ZodObject<{
+    messageId: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    messageId: string;
+}, {
+    messageId: string;
+}>;
+export declare const replyInput: z.ZodObject<{
+    messageId: z.ZodString;
+    body: z.ZodString;
+    messageType: z.ZodDefault<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    body: string;
+    messageType: string;
+    messageId: string;
+}, {
+    body: string;
+    messageId: string;
+    messageType?: string | undefined;
+}>;
+export declare const discoverInput: z.ZodObject<{
+    q: z.ZodOptional<z.ZodString>;
+    category: z.ZodOptional<z.ZodString>;
+    language: z.ZodOptional<z.ZodString>;
+    verified: z.ZodOptional<z.ZodBoolean>;
+    limit: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    limit: number;
+    verified?: boolean | undefined;
+    q?: string | undefined;
+    category?: string | undefined;
+    language?: string | undefined;
+}, {
+    verified?: boolean | undefined;
+    limit?: number | undefined;
+    q?: string | undefined;
+    category?: string | undefined;
+    language?: string | undefined;
+}>;
+export declare const inspectInput: z.ZodObject<{
+    handleOrId: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    handleOrId: string;
+}, {
+    handleOrId: string;
+}>;
+export { groupCreateInput, groupInspectInput, groupInviteInput, groupRemoveInput, } from "./schemas-groups.js";

package/dist/threadmap.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Tier-3 thread map (D-tier3-store): a durable `(handle, conversation_id) →
+ * runId` map. This is OUR responsibility — the LangGraph `thread_id` analog —
+ * and is SEPARATE from Mastra's own workflow-snapshot storage (`@mastra/libsql`/
+ * `@mastra/pg`). The snapshot is Mastra's; this map tells the resumer WHICH
+ * suspended run an inbound rine message belongs to, so a fresh process finds it.
+ *
+ * Two implementations:
+ *   - {@link InMemoryThreadMap} — tests / single-process ephemeral use.
+ *   - {@link SqliteThreadMap} — the documented production default; libsql-backed
+ *     (file URL for durability across restarts, `:memory:` for a throwaway).
+ *
+ * I-1: building a `SqliteThreadMap` opens a libsql handle, so do it where the
+ * driver/resumer is wired (a long-lived host start), never at module import.
+ */
+/**
+ * Durable map keying a rine thread `(handle, conversation_id)` to the suspended
+ * Mastra workflow `runId` that owns it. All methods are async so a SQL-backed
+ * implementation fits the same interface as the in-memory one.
+ */
+export interface ThreadMapStore {
+    /** The `runId` for this thread, or `undefined` if none is mapped. */
+    get(handle: string, conversation: string): Promise<string | undefined>;
+    /** Map (or remap) this thread to `runId`. */
+    set(handle: string, conversation: string, runId: string): Promise<void>;
+    /** Drop the mapping for this thread (e.g. once the run has completed). */
+    delete(handle: string, conversation: string): Promise<void>;
+}
+/**
+ * In-process `(handle, conversation) → runId` map. Per-process only — it does
+ * NOT survive a restart, so it is for tests / single-long-lived-process demos.
+ * Use {@link SqliteThreadMap} for anything that must outlive the process.
+ */
+export declare class InMemoryThreadMap implements ThreadMapStore {
+    private readonly map;
+    get(handle: string, conversation: string): Promise<string | undefined>;
+    set(handle: string, conversation: string, runId: string): Promise<void>;
+    delete(handle: string, conversation: string): Promise<void>;
+}
+/** Options for {@link SqliteThreadMap.open}. */
+export interface SqliteThreadMapOptions {
+    /**
+     * libsql URL. `file:rine-threadmap.db` (durable, the production default),
+     * `:memory:` (ephemeral), or a remote `libsql://…` for a hosted Turso DB.
+     */
+    url: string;
+    /** Optional auth token for a remote libsql/Turso URL. */
+    authToken?: string;
+}
+/**
+ * libsql-backed {@link ThreadMapStore} — the documented production default. A
+ * file URL persists the map so a FRESH process can resolve an inbound message's
+ * `(handle, conversation)` to the right suspended `runId` and resume it.
+ *
+ * Construct via the async {@link SqliteThreadMap.open} factory so the table is
+ * created before the first `get`/`set`. The libsql handle is owned here; call
+ * {@link close} on teardown.
+ */
+export declare class SqliteThreadMap implements ThreadMapStore {
+    private readonly client;
+    private constructor();
+    /** Open the store and ensure its table exists. */
+    static open(opts: SqliteThreadMapOptions): Promise<SqliteThreadMap>;
+    get(handle: string, conversation: string): Promise<string | undefined>;
+    set(handle: string, conversation: string, runId: string): Promise<void>;
+    delete(handle: string, conversation: string): Promise<void>;
+    /** Close the underlying libsql handle. */
+    close(): void;
+}

package/dist/tool.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Shared `createTool` plumbing every rine tool reuses (no duplicated logic):
+ * identity injection (I-1 lazy client + I-2 no-creds-in-schema) and the
+ * try/catch → `formatError` wrapper (I-3 errors→strings, never a reject).
+ *
+ * A tool's per-tool body is just `(client, inputData) => string`; this helper
+ * supplies the surrounding contract:
+ *   1. read the acting agent + config-dir/api-url overrides from
+ *      `ctx.requestContext` (NEVER `inputSchema`), falling back to the
+ *      `rineToolkit(opts)` overrides closed over at factory time,
+ *   2. lazily build/get the shared `AsyncRineClient` (I-1 — first call only),
+ *   3. run the body, and on any thrown SDK error return `formatError(err)` so
+ *      the tool RESOLVES a readable string and never rejects (I-3).
+ *
+ * `createTool` from `@mastra/core/tools` is invoked by each domain module; this
+ * file only builds the `execute` closure and the shared option/ctx types.
+ */
+import type { AgentHandle, AgentUuid, AsyncRineClient, GroupHandle, GroupUuid } from "@rine-network/sdk";
+import { type RineClientOpts } from "./client.js";
+import { type RineToolContext } from "./context.js";
+/**
+ * Per-factory overrides threaded from `rineToolkit(opts)` / an individual
+ * `createRine<X>Tool(opts)` call. A live `client` may be passed so every tool in
+ * one `rineToolkit(...)` call shares ONE lazily-built client (AC-11); when
+ * omitted, each tool resolves its own client lazily on first `execute`.
+ */
+export interface RineToolOpts extends RineClientOpts {
+    /** A shared client to reuse (set by `rineToolkit` for AC-11). */
+    client?: AsyncRineClient;
+}
+/**
+ * Resolve the effective `AsyncRineClient` for one `execute` call: prefer a
+ * shared client from the toolkit, else build one from the ctx-injected identity
+ * layered over the factory defaults. Lazy by construction — only runs inside
+ * `execute` (I-1).
+ */
+export declare function resolveClient(opts: RineToolOpts, ctx: RineToolContext | undefined): AsyncRineClient;
+/**
+ * The same resolved `apiUrl` `resolveClient` builds its client against (ctx
+ * override → factory override → `resolveApiUrl()`). Exposed so handle→UUID
+ * pre-resolution (`resolveToUuid`) hits the SAME server WebFinger the client
+ * uses, since the SDK client has no public `apiUrl` getter.
+ */
+export declare function resolveApiUrlFor(opts: RineToolOpts, ctx: RineToolContext | undefined): string;
+/**
+ * The recipient union `client.send`/`sendAndWait` accept. The model supplies a
+ * free-form `to` string (a `name@org` handle, a `#group@org` handle, or a UUID);
+ * the SDK normalizes + validates it at runtime, so this brands the string once,
+ * in one documented place, rather than scattering casts.
+ */
+type Recipient = AgentHandle | AgentUuid | GroupHandle | GroupUuid;
+/** Brand a model-supplied recipient string for the SDK send surface. */
+export declare function asRecipient(to: string): Recipient;
+/**
+ * I-2 layer (c): the belt-and-suspenders ciphertext redactor for `read` /
+ * `check_inbox` (SPEC §2.2 / D-output). Layers (a) plaintext-only renderers and
+ * (b) `outputSchema: z.string()` already guarantee the `execute` return is a
+ * redacted string; this coerces ANY value to plain text content before it can
+ * reach the model, so even a regression that returned a richer object containing
+ * ciphertext could not surface it. Returns Mastra's default text-content shape.
+ */
+export declare function redactToText(output: unknown): {
+    type: "text";
+    value: string;
+};
+/**
+ * A tool body: one client call rendered to a string. The wrapper handles errors.
+ * `apiUrl` is the server the client is bound to (for handle→UUID pre-resolution);
+ * bodies that don't resolve handles ignore it.
+ */
+export type RineToolBody<I> = (client: AsyncRineClient, inputData: I, apiUrl: string) => Promise<string>;
+/**
+ * Build a Mastra-tool `execute(inputData, ctx)` from a body, applying the
+ * lazy-client + try/catch→formatError contract. Use as the `execute` value of a
+ * `createTool({...})` config.
+ */
+export declare function makeExecute<I>(opts: RineToolOpts, body: RineToolBody<I>): (inputData: I, ctx: RineToolContext) => Promise<string>;
+export {};

package/dist/tools.d.ts

@@ -0,0 +1,37 @@
+/**
+ * `rineToolkit(opts)` — the aggregator (SPEC §7). Returns a plain keyed
+ * `Record<string, Tool>` (Mastra has no `BaseToolkit` class). The object KEY is
+ * the model-facing tool name, so each entry is keyed by its `id`
+ * (`toolName === id`). Drop the record straight into a Mastra `Agent`'s
+ * `tools: {}` map.
+ *
+ * `include` curates the surface: `"all"` (11), one domain
+ * (`"messaging"`/`"discovery"`/`"groups"`), or an array union of domains.
+ *
+ * AC-11 shared client: ONE lazily-built `AsyncRineClient` is created per
+ * `rineToolkit(...)` call and threaded into every tool's `opts.client`, so all
+ * tools share a client (and the warm OAuth token cache). Per-acting-agent
+ * variants derive cheaply via `client.withAgent(...)` inside each `execute`.
+ *
+ * The individual `createRine<X>Tool(opts)` factories are also re-exported for the
+ * "attach only what you need" ergonomic.
+ */
+import type { Tool } from "@mastra/core/tools";
+/** The domains a toolkit can be filtered to. */
+export type RineToolDomain = "messaging" | "discovery" | "groups";
+/** Options for {@link rineToolkit}. */
+export interface RineToolkitOptions {
+    /** Explicit config dir; when omitted, `resolveConfigDir()` is used. */
+    configDir?: string;
+    /** Explicit API URL; when omitted, `resolveApiUrl()` is used. */
+    apiUrl?: string;
+    /** Acting agent (handle/name/UUID) sent on every request. */
+    agent?: string;
+    /** Which tools to include. Default `"all"`. */
+    include?: "all" | RineToolDomain | readonly RineToolDomain[];
+}
+/**
+ * Build the rine tool record. The returned object is keyed by each tool's `id`
+ * (so `toolName === id`), ready to spread into a Mastra `Agent`'s `tools` map.
+ */
+export declare function rineToolkit(opts?: RineToolkitOptions): Record<string, Tool>;

package/dist/types.d.ts

@@ -0,0 +1,22 @@
+/**
+ * SDK return-type aliases for the renderers + tools.
+ *
+ * The SDK exports the `*Schema` Zod schemas from its root but NOT the inferred
+ * type aliases (`GroupRead`, `AgentSummary`, …), and it has no subpath exports.
+ * So we re-derive the handful we need via the schemas' `_output` projection — a
+ * thin, drift-proof bridge (if the SDK schema changes, these follow). These are
+ * type-only re-derivations; runtime tool schemas are authored with the host
+ * `zod` in `schemas.ts`.
+ */
+import type { AgentProfileSchema, AgentSummarySchema, DecryptedMessageSchema, GroupReadSchema, InviteResultSchema, MessageReadSchema } from "@rine-network/sdk";
+/** Project a Zod schema's output type without importing the SDK's `z` instance. */
+type Infer<S> = S extends {
+    _output: infer O;
+} ? O : never;
+export type DecryptedMessage = Infer<typeof DecryptedMessageSchema>;
+export type MessageRead = Infer<typeof MessageReadSchema>;
+export type GroupRead = Infer<typeof GroupReadSchema>;
+export type InviteResult = Infer<typeof InviteResultSchema>;
+export type AgentSummary = Infer<typeof AgentSummarySchema>;
+export type AgentProfile = Infer<typeof AgentProfileSchema>;
+export {};

package/package.json

@@ -0,0 +1,86 @@
+{
+  "name": "@rine-network/mastra",
+  "version": "0.1.0",
+  "description": "Native Mastra.ai tools for the rine network \u2014 E2E-encrypted (HPKE 1:1, MLS groups, PQ-hybrid) agent-to-agent messaging, discovery, and coordination as createTool tools, a toolkit aggregator, a lifecycle bridge, a Tier-3 workflow-resume bridge, and a setup CLI.",
+  "author": "mmmbs <mmmbs@proton.me>",
+  "license": "EUPL-1.2",
+  "type": "module",
+  "engines": {
+    "node": ">=22.13.0"
+  },
+  "bin": {
+    "rine-mastra": "bin/onboard.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./onboard": {
+      "types": "./dist/onboard.d.ts",
+      "import": "./dist/onboard.js",
+      "default": "./dist/onboard.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist/",
+    "bin/",
+    "README.md",
+    "MASTRA.md",
+    "AGENTS.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsdown src/index.ts src/onboard.ts --format esm --outDir dist --clean && tsc -p tsconfig.build.json --emitDeclarationOnly",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "biome check .",
+    "prepublishOnly": "node scripts/check-no-file-deps.mjs"
+  },
+  "dependencies": {
+    "@libsql/client": "^0.15.0",
+    "@rine-network/core": "^0.5.1",
+    "@rine-network/sdk": "^0.3.0"
+  },
+  "peerDependencies": {
+    "@mastra/core": ">=1.0.0 <2.0.0",
+    "zod": ">=3.25.0 || >=4.0.0"
+  },
+  "devDependencies": {
+    "@ai-sdk/openai-compatible": "^2.0.49",
+    "@biomejs/biome": "^1.9.0",
+    "@mastra/core": "^1.41.0",
+    "@mastra/libsql": "^1.12.1",
+    "@types/node": "^22.0.0",
+    "ai": "^6.0.0",
+    "tsdown": "^0.12.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0",
+    "vitest": "^3.0.0",
+    "zod": "^3.25.0"
+  },
+  "homepage": "https://rine.network",
+  "repository": {
+    "type": "git",
+    "url": "https://codeberg.org/rine/rine-mastra"
+  },
+  "bugs": {
+    "url": "https://codeberg.org/rine/rine-mastra/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "mastra",
+    "rine",
+    "ai-agents",
+    "tools",
+    "a2a",
+    "e2ee",
+    "mls",
+    "messaging"
+  ]
+}