@rine-network/mastra 0.3.0 → 0.6.0

package/dist/index.d.ts

@@ -11,29 +11,31 @@
  * (client builder, error formatter, renderers, schemas) is exported now so
  * tests and downstream stages can consume it.
  *
- * Import is side-effect-free (I-1): nothing here constructs a client, reads a
+ * Import is side-effect-free: nothing here constructs a client, reads a
  * credential, or opens a socket at module load.
  */
 export { getRineClient } from "./client.js";
 export type { RineClientOpts } from "./client.js";
 export { formatError } from "./errors.js";
 export type { RinePaymentToolOpts, RineToolOpts } from "./tool.js";
-export { createRineCheckInboxTool, createRineReadTool, createRineReplyTool, createRineSendAndWaitTool, createRineSendTool, createRineThreadTool, } from "./messaging.js";
-export { createRineDiscoverTool, createRineInspectTool, } from "./discovery.js";
-export { createRineGroupCreateTool, createRineGroupInspectTool, createRineGroupInviteTool, createRineGroupRemoveTool, } from "./groups.js";
-export { createRineFulfillTool, createRinePayTool, } from "./payments.js";
+export { createRineInboxTool, createRineReadTool, createRineReplyTool, createRineSendAndWaitTool, createRineSendTool, createRineThreadTool, } from "./messaging.js";
+export { createRineDiscoverTool, createRineInspectTool, createRineWhoamiTool, } from "./discovery.js";
+export { createRineDiscoverGroupsTool, createRineGroupRosterTool, createRineGroupsTool, } from "./groups-list.js";
+export { createRineGroupCreateTool, createRineGroupInspectTool, createRineGroupInviteTool, createRineGroupInvitesTool, createRineGroupJoinTool, createRineGroupRemoveTool, } from "./groups.js";
+export { createRineGroupLeaveTool, createRineGroupReclaimTool, createRineGroupRequestsTool, createRineGroupSyncTool, createRineGroupVoteTool, } from "./groups-admin.js";
+export { createRineFulfillTool, createRinePayTool } from "./payments.js";
 export { rineToolkit } from "./tools.js";
 export type { RinePaymentsConfig, RineToolDomain, RineToolkitOptions, } from "./tools.js";
 export { rineLifecycle } from "./lifecycle.js";
 export type { RineLifecycleCallbacks, RineLifecycleEvent, RineLifecycleOptions, } from "./lifecycle.js";
 export { RineThreadResumer } from "./inbound.js";
 export type { ResumableRun, ResumableWorkflow, ResumeData, ResumeOutcome, RineThreadResumerOptions, WorkflowSnapshot, } from "./inbound.js";
-export { InMemoryThreadMap, SqliteThreadMap, } from "./threadmap.js";
-export type { SqliteThreadMapOptions, ThreadMapStore, } from "./threadmap.js";
+export { InMemoryThreadMap, SqliteThreadMap } from "./threadmap.js";
+export type { SqliteThreadMapOptions, ThreadMapStore } from "./threadmap.js";
 export { makeWebhookHandler, PollDriver } from "./drivers.js";
 export type { PollDriverOptions, WebhookHandler, WebhookHandlerOptions, } from "./drivers.js";
 export { parseOnboardArgs, runOnboard } from "./onboard.js";
 export type { OnboardArgs, OnboardIO, OnboardOptions } from "./onboard.js";
-export { RINE_ACTING_AGENT, RINE_API_URL, RINE_CONFIG_DIR, } from "./context.js";
+export { RINE_ACTING_AGENT, RINE_API_URL, RINE_CONFIG_DIR } from "./context.js";
 export type { RineToolContext } from "./context.js";
-export type { AgentProfile, AgentSummary, DecryptedMessage, GroupRead, InviteResult, MessageRead, } from "./types.js";
+export type { AgentProfile, AgentSummary, DecryptedMessage, GroupRead, InviteResult, JoinRequestRead, MessageRead, } from "./types.js";

package/dist/lifecycle.d.ts

@@ -1,10 +1,10 @@
 /**
- * Outbound lifecycle bridge `rineLifecycle` (SPEC §8 + PHASE0_CONTRACT P0-7).
+ * Outbound lifecycle bridge `rineLifecycle`.
  *
  * Mastra has NO callback-handler object class. The faithful 1:1 of the Python
  * `RineCallbackHandler` is a FACTORY returning the top-level callbacks
  * `agent.stream(...)` / `agent.generate(...)` accept — verified identical across
- * both methods (P0-7). Spread the result into either:
+ * both methods. Spread the result into either:
  *   const cb = rineLifecycle({ to: "ops@acme", on: ["finish", "error"] });
  *   await agent.stream(input, { ...cb });    // or .generate(input, { ...cb })
  *
@@ -14,21 +14,22 @@
  *   step   → onStepFinish ({toolCalls,…})         → "step: {toolName}"
  *
  * Invariants:
- *   - I-1: opt-in by instantiation; the `AsyncRineClient` is built lazily on the
- *     FIRST fired callback (never at module load or in this factory body).
- *   - I-2: only the model-visible `text` / tool name / error message is summarized
+ *   - Opt-in by instantiation; the `AsyncRineClient` is built lazily on the
+ *     FIRST fired callback (never at module load or in this factory body), so
+ *     importing the package stays side-effect-free.
+ *   - Only the model-visible `text` / tool name / error message is summarized
  *     into the notify body — never ciphertext (these callbacks never see an
  *     envelope).
- *   - Best-effort: each fired callback attempts EXACTLY ONE `client.send` (AC-13);
+ *   - Best-effort: each fired callback attempts EXACTLY ONE `client.send`;
  *     a send failure is swallowed + debug-logged and never thrown out of the
- *     callback (AC-14) — a notify failure must not crash the agent run.
+ *     callback — a notify failure must not crash the agent run.
  */
 import { type RineClientOpts } from "./client.js";
 /** The lifecycle selectors a caller can opt into. */
 export type RineLifecycleEvent = "finish" | "error" | "step";
 /** Options for {@link rineLifecycle}. */
 export interface RineLifecycleOptions extends RineClientOpts {
-    /** Recipient handle/UUID every notify is sent to (`name@org`, `#group@org`). */
+    /** Recipient handle/UUID every notify is sent to (`name@org`, `#logistics@acme.rine.network`). */
     to: string;
     /** Which lifecycle events fire a notify. Defaults to `["finish", "error"]`. */
     on?: readonly RineLifecycleEvent[];
@@ -42,6 +43,7 @@ export interface RineLifecycleCallbacks {
 /**
  * Build the opt-in outbound lifecycle bridge. Returns ONLY the callbacks for the
  * selected events (so `{ ...cb }` never installs a no-op for an unselected one).
- * The client is resolved lazily on the first fired callback (I-1).
+ * The client is resolved lazily on the first fired callback — this factory
+ * builds nothing.
  */
 export declare function rineLifecycle(opts: RineLifecycleOptions): RineLifecycleCallbacks;

package/dist/messaging.d.ts

@@ -1,29 +1,31 @@
 /**
- * The 5 messaging tools: `rine_send`, `rine_send_and_wait`, `rine_check_inbox`,
- * `rine_read`, `rine_reply` (SPEC §6 messaging table). Each is a thin
+ * The 6 messaging tools: `rine_send`, `rine_send_and_wait`, `rine_inbox`,
+ * `rine_read`, `rine_thread`, `rine_reply`. Each is a thin
  * `createTool` adapter: one `AsyncRineClient` call rendered to a string, wrapped
  * by `makeExecute` (lazy client + formatError). Identity comes from
  * `ctx.requestContext`, never the model-visible `inputSchema`.
  *
- * I-2 holds throughout: renderers read only plaintext/decrypt_error/verification
- * (`format.ts`), never the ciphertext envelope. `rine_check_inbox` is the
- * Track-0 poll+ack receive primitive (Tier-1).
+ * Ciphertext never reaches the model through any of them: renderers read only
+ * plaintext/decrypt_error/verification (`format.ts`), never the ciphertext
+ * envelope. `rine_inbox` on its default
+ * `new` status is the Track-0 poll+ack receive primitive (Tier-1).
  */
 import { type RineToolOpts } from "./tool.js";
-/** `rine_send` — send a 1:1 or `#`-group message (the SDK auto-routes groups). */
+/** `rine_send` — send a 1:1 or group message (the SDK auto-routes groups). */
 export declare function createRineSendTool(opts?: RineToolOpts): import("@mastra/core/tools").Tool<any, any, any, any, import("@mastra/core/tools").ToolExecutionContext<any, any, unknown>, "rine_send", unknown>;
 /** `rine_send_and_wait` — 1:1 send that blocks for a reply (Tier-2, ms timeout). */
 export declare function createRineSendAndWaitTool(opts?: RineToolOpts): import("@mastra/core/tools").Tool<any, any, any, any, import("@mastra/core/tools").ToolExecutionContext<any, any, unknown>, "rine_send_and_wait", unknown>;
 /**
- * `rine_check_inbox` — poll the newest new messages, decrypt them, then
- * best-effort `markDelivered` the decryptable ids so a later check returns only
- * newer mail (Track-0 poll+ack, Tier-1). On ack failure: warn + note the
- * messages "may reappear" but still return the reads (AC-5).
+ * `rine_inbox` — poll the inbox under one status filter, decrypt what it
+ * returns, and on the `new` path best-effort `markDelivered` the decryptable
+ * ids so a later check returns only newer mail (Track-0 poll+ack, Tier-1). On
+ * ack failure: warn + note the messages "may reappear" but still return the
+ * reads.
  */
-export declare function createRineCheckInboxTool(opts?: RineToolOpts): import("@mastra/core/tools").Tool<any, any, any, any, import("@mastra/core/tools").ToolExecutionContext<any, any, unknown>, "rine_check_inbox", unknown>;
+export declare function createRineInboxTool(opts?: RineToolOpts): import("@mastra/core/tools").Tool<any, any, any, any, import("@mastra/core/tools").ToolExecutionContext<any, any, unknown>, "rine_inbox", unknown>;
 /** `rine_read` — fetch + decrypt one message by id. */
 export declare function createRineReadTool(opts?: RineToolOpts): import("@mastra/core/tools").Tool<any, any, any, any, import("@mastra/core/tools").ToolExecutionContext<any, any, unknown>, "rine_read", unknown>;
-/** `rine_thread` — fetch the both-sided, decrypted transcript of a conversation. */
+/** `rine_thread` — fetch the both-sided, decrypted transcript of a conversation or a group. */
 export declare function createRineThreadTool(opts?: RineToolOpts): import("@mastra/core/tools").Tool<any, any, any, any, import("@mastra/core/tools").ToolExecutionContext<any, any, unknown>, "rine_thread", unknown>;
 /** `rine_reply` — reply to a message, threading into the same conversation. */
 export declare function createRineReplyTool(opts?: RineToolOpts): import("@mastra/core/tools").Tool<any, any, any, any, import("@mastra/core/tools").ToolExecutionContext<any, any, unknown>, "rine_reply", unknown>;

package/dist/onboard.d.ts

@@ -1,17 +1,17 @@
 /**
- * Setup helper — `npx @rine-network/mastra onboard` (SPEC §11, D-not-tools).
+ * Setup helper — `npx @rine-network/mastra onboard`.
  *
  * Runs the SDK's RSA time-lock proof-of-work to register a fresh org, then
  * creates the first agent and prints its handle + verification words. This is
  * NEVER a `createTool` — a ~30–60 s PoW does not belong in an LLM turn; it is an
  * out-of-band CLI a human runs once.
  *
- * I-1: no client is built at module load — `runOnboard` constructs the client
+ * No client is built at module load — `runOnboard` constructs the client
  * lazily, only when invoked. The PoW + credential write are delegated wholesale
  * to the SDK's `register(opts)` (over rine-core `performRegistration`); the agent
  * keypair is generated + persisted by `client.createAgent(name)`.
  *
- * Config resolution is explicit (D-config-resolve): `register` REQUIRES concrete
+ * Config resolution is explicit: `register` REQUIRES concrete
  * `apiUrl`/`configDir` strings, so we resolve them via rine-core unless the caller
  * passed overrides (the SDK never resolves them itself).
  */

package/dist/onboard.js

@@ -1,20 +1,20 @@
-import { resolveApiUrl, resolveConfigDir } from "@rine-network/core";
+import { compareVerificationWordsForAgent, resolveApiUrl, resolveConfigDir, verificationWordsLines } from "@rine-network/core";
 import { AsyncRineClient, register } from "@rine-network/sdk";
 //#region src/onboard.ts
 /**
-* Setup helper — `npx @rine-network/mastra onboard` (SPEC §11, D-not-tools).
+* Setup helper — `npx @rine-network/mastra onboard`.
 *
 * Runs the SDK's RSA time-lock proof-of-work to register a fresh org, then
 * creates the first agent and prints its handle + verification words. This is
 * NEVER a `createTool` — a ~30–60 s PoW does not belong in an LLM turn; it is an
 * out-of-band CLI a human runs once.
 *
-* I-1: no client is built at module load — `runOnboard` constructs the client
+* No client is built at module load — `runOnboard` constructs the client
 * lazily, only when invoked. The PoW + credential write are delegated wholesale
 * to the SDK's `register(opts)` (over rine-core `performRegistration`); the agent
 * keypair is generated + persisted by `client.createAgent(name)`.
 *
-* Config resolution is explicit (D-config-resolve): `register` REQUIRES concrete
+* Config resolution is explicit: `register` REQUIRES concrete
 * `apiUrl`/`configDir` strings, so we resolve them via rine-core unless the caller
 * passed overrides (the SDK never resolves them itself).
 */
@@ -62,7 +62,7 @@ async function runOnboard(opts, io = stdoutIO) {
 	const agent = await client.createAgent(agentName);
 	io.log("");
 	io.log(`Agent ready: ${agent.handle}`);
-	if (agent.verification_words) io.log(`Verification words: ${agent.verification_words}`);
+	for (const line of verificationWordsLines(compareVerificationWordsForAgent(configDir, agent.id, agent.verification_words))) io.log(line);
 	io.log(`Config dir: ${configDir}`);
 	io.log("Set RINE_CONFIG_DIR to this path (or RINE_CLIENT_ID/RINE_CLIENT_SECRET) so your Mastra tools authenticate.");
 	return agent.handle;

package/dist/payments.d.ts

@@ -2,7 +2,7 @@
  * The 2 x402 payment tools: `rine_pay` (payer) and `rine_fulfill` (payee). Each
  * is a thin `createTool` adapter over the ts-sdk `client.payments` facade — the
  * SAME single implementation the CLI/MCP payer and the ts-sdk payee use, so no
- * signing / policy / journal / facilitator logic is reimplemented here (I-14).
+ * signing / policy / journal / facilitator logic is reimplemented here.
  *
  * `rine_pay` consumes a received `rine.v1.x402_payment_required` and returns the
  * `rine_pay` 7-status vocabulary VERBATIM (parity with MCP `rine_pay` and the
@@ -23,7 +23,7 @@ import { type RinePaymentToolOpts } from "./tool.js";
 /**
  * `rine_pay` — pay a received x402 quote in-thread (payer). Mode T: an explicit
  * tool call is the authorization, hard-bounded by the spend caps. The toolkit's
- * `payments.autoPay` config (D2, default OFF) sets the default of the `autoPay`
+ * `payments.autoPay` config (default OFF) sets the default of the `autoPay`
  * input; when on, only quotes at/below the policy's `autoPayThreshold` are paid.
  */
 export declare function createRinePayTool(opts?: RinePaymentToolOpts): import("@mastra/core/tools").Tool<any, any, any, any, import("@mastra/core/tools").ToolExecutionContext<any, any, unknown>, "rine_pay", unknown>;

package/dist/schemas-discovery.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Zod input schemas for the three discovery tools (`rine_discover`,
+ * `rine_inspect`, `rine_whoami`).
+ *
+ * One file per domain (mirrors `schemas-groups.ts` and `schemas-payments.ts`)
+ * to keep `schemas.ts` within the ~200-LOC budget; re-exported from
+ * `schemas.ts` so the schema entry point stays single. Authored with the HOST
+ * `zod` (`import { z } from "zod"`) — the one hoisted instance Mastra
+ * validates against. Identity/credentials NEVER appear here — an input schema
+ * is model-visible and model-controllable, so the acting agent + config dir
+ * come from `ctx.requestContext` instead.
+ *
+ * `rine_discover` and `rine_discover_groups` are unauthenticated reads of the
+ * public directory; `rine_inspect` and `rine_whoami` are not, and the split is
+ * by tool DOMAIN, not by auth. The group-directory schema lives beside the
+ * other group reads in `schemas-groups-list.ts`.
+ */
+import { z } from "zod";
+export declare const discoverInput: z.ZodObject<{
+    q: z.ZodOptional<z.ZodString>;
+    category: z.ZodOptional<z.ZodString>;
+    language: z.ZodOptional<z.ZodString>;
+    verified: z.ZodOptional<z.ZodBoolean>;
+    limit: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    limit: number;
+    verified?: boolean | undefined;
+    q?: string | undefined;
+    category?: string | undefined;
+    language?: string | undefined;
+}, {
+    verified?: boolean | undefined;
+    q?: string | undefined;
+    category?: string | undefined;
+    language?: string | undefined;
+    limit?: number | undefined;
+}>;
+export declare const inspectInput: z.ZodObject<{
+    handleOrId: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    handleOrId: string;
+}, {
+    handleOrId: string;
+}>;
+/** No input: reports this agent's OWN org, trust tier, and live handles. */
+export declare const whoamiInput: z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>;

package/dist/schemas-groups-list.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Zod input schemas for the three group READ tools (`groups-list.ts`):
+ * `rine_groups`, `rine_discover_groups`, `rine_group_roster`.
+ *
+ * Their own module because `schemas-groups.ts` already carries the ten write
+ * and admission verbs at its ~200-LOC budget. Same authoring rules as the rest:
+ * the HOST `zod`, rich `.describe()` on every field, and NO identity or
+ * credentials in a model-visible schema (both come from `ctx.requestContext`).
+ */
+import { z } from "zod";
+/** No input: lists the groups this agent's ORG belongs to, never one agent's own. */
+export declare const groupsInput: z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>;
+export declare const discoverGroupsInput: z.ZodObject<{
+    q: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    limit: number;
+    q?: string | undefined;
+}, {
+    q?: string | undefined;
+    limit?: number | undefined;
+}>;
+export declare const groupRosterInput: z.ZodObject<{
+    group: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    group: string;
+}, {
+    group: string;
+}>;

package/dist/schemas-groups.d.ts

@@ -1,44 +1,74 @@
 /**
- * Zod input schemas for the 4 group tools (split out of `schemas.ts` to hold the
- * ~200-LOC budget — the schema concentration the SPEC §4 endorses, one file per
- * domain). Same authoring rules: HOST `zod`, rich `.describe()` on every field,
- * NO identity/credentials in the schema (host-injected via `ctx.requestContext`).
+ * Zod input schemas for the 11 group WRITE and admission tools (split out of
+ * `schemas.ts` to hold the ~200-LOC budget — one file per domain; the three
+ * group READ schemas are in `schemas-groups-list.ts`). Same authoring rules:
+ * HOST `zod`, rich `.describe()` on every field, NO identity/credentials in the
+ * schema (host-injected via `ctx.requestContext`).
  *
- * Groups are MLS-capable by default — `enableMls` (default true) on create is the
- * headline inversion vs the Python siblings (D-mls).
+ * Groups are MLS-capable by default — `enableMls` (default true) on create.
+ *
+ * `visibility` carries no default and never will. Every surface used to invent
+ * one and they disagreed, so the same call produced a group listed at
+ * dir.rine.network from here and an unlisted one from the CLI — and the listing
+ * also flips the member-joined signal, so the two differed in who gets told
+ * about a join as well as in who can find the group. The description states
+ * both choices and that coupling, so a model picks at the point of choice
+ * rather than after being refused.
+ *
+ * Admission is plural: `members` on create and `agentsToInvite` on invite each
+ * take a batch and report one outcome per requested agent.
  */
 import { z } from "zod";
+/**
+ * The refusal when no visibility was named.
+ *
+ * It sits on the schema rather than in the handler because Mastra validates
+ * `inputSchema` before `execute` ever runs, so the handler could never speak
+ * here — and a bare zod "Required" would be the dump this obligation exists to
+ * replace. It names both choices and what each one does, so a model that reads
+ * it can pick without consulting docs.
+ */
+export declare const VISIBILITY_REQUIRED = "visibility is required and has no default. Choose \"public\" \u2014 the group is listed at dir.rine.network for anyone to find, and the member-joined signal is off \u2014 or \"private\" \u2014 it is not listed, and members are signalled when someone joins.";
 export declare const groupCreateInput: z.ZodObject<{
     name: z.ZodString;
     enrollment: z.ZodDefault<z.ZodEnum<["open", "closed", "majority", "unanimity"]>>;
-    visibility: z.ZodDefault<z.ZodEnum<["public", "private"]>>;
+    visibility: z.ZodEnum<["public", "private"]>;
     description: z.ZodOptional<z.ZodString>;
+    voteDurationHours: z.ZodOptional<z.ZodNumber>;
+    members: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     enableMls: z.ZodDefault<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     name: string;
-    enrollment: "open" | "closed" | "majority" | "unanimity";
     visibility: "public" | "private";
+    enrollment: "open" | "closed" | "majority" | "unanimity";
     enableMls: boolean;
     description?: string | undefined;
+    voteDurationHours?: number | undefined;
+    members?: string[] | undefined;
 }, {
     name: string;
+    visibility: "public" | "private";
     enrollment?: "open" | "closed" | "majority" | "unanimity" | undefined;
-    visibility?: "public" | "private" | undefined;
     description?: string | undefined;
+    voteDurationHours?: number | undefined;
+    members?: string[] | undefined;
     enableMls?: boolean | undefined;
 }>;
 export declare const groupInviteInput: z.ZodObject<{
     group: z.ZodString;
-    agentToInvite: z.ZodString;
+    agentToInvite: z.ZodOptional<z.ZodString>;
+    agentsToInvite: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     message: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     group: string;
-    agentToInvite: string;
     message?: string | undefined;
+    agentToInvite?: string | undefined;
+    agentsToInvite?: string[] | undefined;
 }, {
     group: string;
-    agentToInvite: string;
     message?: string | undefined;
+    agentToInvite?: string | undefined;
+    agentsToInvite?: string[] | undefined;
 }>;
 export declare const groupRemoveInput: z.ZodObject<{
     group: z.ZodString;
@@ -57,3 +87,59 @@ export declare const groupInspectInput: z.ZodObject<{
 }, {
     group: string;
 }>;
+export declare const groupJoinInput: z.ZodObject<{
+    group: z.ZodString;
+    message: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    group: string;
+    message?: string | undefined;
+}, {
+    group: string;
+    message?: string | undefined;
+}>;
+/** `rine_group_invites` takes no input — it lists the caller's own pending invites. */
+export declare const groupInvitesInput: z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>;
+export declare const groupRequestsInput: z.ZodObject<{
+    group: z.ZodString;
+    outstanding: z.ZodDefault<z.ZodEnum<["pending", "invited", "live"]>>;
+}, "strip", z.ZodTypeAny, {
+    group: string;
+    outstanding: "pending" | "invited" | "live";
+}, {
+    group: string;
+    outstanding?: "pending" | "invited" | "live" | undefined;
+}>;
+export declare const groupVoteInput: z.ZodObject<{
+    group: z.ZodString;
+    requestId: z.ZodString;
+    vote: z.ZodEnum<["approve", "deny"]>;
+}, "strip", z.ZodTypeAny, {
+    group: string;
+    requestId: string;
+    vote: "approve" | "deny";
+}, {
+    group: string;
+    requestId: string;
+    vote: "approve" | "deny";
+}>;
+export declare const groupLeaveInput: z.ZodObject<{
+    group: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    group: string;
+}, {
+    group: string;
+}>;
+export declare const groupSyncInput: z.ZodObject<{
+    group: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    group: string;
+}, {
+    group: string;
+}>;
+export declare const groupReclaimInput: z.ZodObject<{
+    group: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    group: string;
+}, {
+    group: string;
+}>;

package/dist/schemas-payments.d.ts

@@ -5,7 +5,8 @@
  * the ~200-LOC budget; re-exported from `schemas.ts` so the schema entry point
  * stays single. Authored with the HOST `zod` (`import { z } from "zod"`) — the
  * one hoisted instance Mastra validates against. Identity/credentials NEVER
- * appear here (I-2): the acting agent + config dir come from `ctx.requestContext`.
+ * appear here — an input schema is model-visible and model-controllable, so the
+ * acting agent + config dir come from `ctx.requestContext` instead.
  *
  * The wallet key, spend policy, caps, and facilitator auth are NEVER model
  * inputs — they live on disk / in the toolkit config. A tool input can name a

package/dist/schemas.d.ts

@@ -1,27 +1,42 @@
 /**
- * Shared Zod input schemas for the 12 rine tools.
+ * Shared Zod input schemas for the 25 rine tools.
  *
  * Authored with the HOST `zod` (`import { z } from "zod"`) — the single hoisted
  * instance Mastra validates against — NOT the SDK's re-exported `z`. Rich
  * `.describe()` on EVERY field: the field descriptions are the #1 lever on
  * tool-call accuracy (the AI-DX). Identity/credentials NEVER appear here — the
  * acting agent + config dir are read from `ctx.requestContext`, never the model-
- * visible input schema (I-2 / Mastra's own security rule).
+ * visible input schema, which the model both sees and controls (also Mastra's
+ * own security rule).
  *
  * `messageType`/`idempotencyKey`/etc. ports drop the Python `tag`/`jurisdiction`/
  * `pricingModel` discover fields (the TS `DiscoveryFilters` lacks them) and add
- * `enableMls` (default true) on group_create — the headline inversion (D-mls).
+ * `enableMls` (default true) on group_create — the headline inversion.
  */
 import { z } from "zod";
+/**
+ * The exactly-one-of rule for `rine_thread`'s two references, in the words the
+ * refusal will use if it is broken.
+ *
+ * One string teaches the schema and answers the mistake, so the model can never
+ * be told a rule the product does not enforce. Its spellings come from
+ * `rine-core` — these tools name the two references exactly as the TypeScript
+ * SDK does (`group` / `conversationId`), which is what `THREAD_REF_SURFACES.sdk`
+ * holds.
+ */
+export declare const THREAD_REF_RULE: string;
 export declare const threadInput: z.ZodObject<{
-    conversationId: z.ZodString;
+    group: z.ZodOptional<z.ZodString>;
+    conversationId: z.ZodOptional<z.ZodString>;
     limit: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
-    conversationId: string;
     limit?: number | undefined;
+    group?: string | undefined;
+    conversationId?: string | undefined;
 }, {
-    conversationId: string;
     limit?: number | undefined;
+    group?: string | undefined;
+    conversationId?: string | undefined;
 }>;
 export declare const sendInput: z.ZodObject<{
     to: z.ZodString;
@@ -55,11 +70,14 @@ export declare const sendAndWaitInput: z.ZodObject<{
     messageType?: string | undefined;
     waitSeconds?: number | undefined;
 }>;
-export declare const checkInboxInput: z.ZodObject<{
+export declare const inboxInput: z.ZodObject<{
+    status: z.ZodDefault<z.ZodEnum<["new", "delivered", "read", "all"]>>;
     limit: z.ZodDefault<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
+    status: "delivered" | "new" | "read" | "all";
     limit: number;
 }, {
+    status?: "delivered" | "new" | "read" | "all" | undefined;
     limit?: number | undefined;
 }>;
 export declare const readInput: z.ZodObject<{
@@ -82,31 +100,7 @@ export declare const replyInput: z.ZodObject<{
     body: string;
     messageType?: string | undefined;
 }>;
-export declare const discoverInput: z.ZodObject<{
-    q: z.ZodOptional<z.ZodString>;
-    category: z.ZodOptional<z.ZodString>;
-    language: z.ZodOptional<z.ZodString>;
-    verified: z.ZodOptional<z.ZodBoolean>;
-    limit: z.ZodDefault<z.ZodNumber>;
-}, "strip", z.ZodTypeAny, {
-    limit: number;
-    verified?: boolean | undefined;
-    q?: string | undefined;
-    category?: string | undefined;
-    language?: string | undefined;
-}, {
-    verified?: boolean | undefined;
-    limit?: number | undefined;
-    q?: string | undefined;
-    category?: string | undefined;
-    language?: string | undefined;
-}>;
-export declare const inspectInput: z.ZodObject<{
-    handleOrId: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    handleOrId: string;
-}, {
-    handleOrId: string;
-}>;
-export { groupCreateInput, groupInspectInput, groupInviteInput, groupRemoveInput, } from "./schemas-groups.js";
+export { discoverInput, inspectInput, whoamiInput, } from "./schemas-discovery.js";
+export { discoverGroupsInput, groupRosterInput, groupsInput, } from "./schemas-groups-list.js";
+export { groupCreateInput, groupInspectInput, groupInviteInput, groupInvitesInput, groupJoinInput, groupLeaveInput, groupReclaimInput, groupRemoveInput, groupRequestsInput, groupSyncInput, groupVoteInput, } from "./schemas-groups.js";
 export { fulfillInput, payInput } from "./schemas-payments.js";

package/dist/threadmap.d.ts

@@ -1,5 +1,5 @@
 /**
- * Tier-3 thread map (D-tier3-store): a durable `(handle, conversation_id) →
+ * Tier-3 thread map: a durable `(handle, conversation_id) →
  * runId` map. This is OUR responsibility — the LangGraph `thread_id` analog —
  * and is SEPARATE from Mastra's own workflow-snapshot storage (`@mastra/libsql`/
  * `@mastra/pg`). The snapshot is Mastra's; this map tells the resumer WHICH
@@ -10,7 +10,7 @@
  *   - {@link SqliteThreadMap} — the documented production default; libsql-backed
  *     (file URL for durability across restarts, `:memory:` for a throwaway).
  *
- * I-1: building a `SqliteThreadMap` opens a libsql handle, so do it where the
+ * Building a `SqliteThreadMap` opens a libsql handle, so do it where the
  * driver/resumer is wired (a long-lived host start), never at module import.
  */
 /**