@absol-labs/agent 0.10.0 → 0.11.0

package/dist/cli/privy.d.ts

@@ -0,0 +1,83 @@
+import { type Account, type Transport } from "viem";
+import { type AutonomousWalletCredentialStore } from "../wallet/autonomous-wallet.js";
+/**
+ * The CLI's two Privy wallet shapes.
+ *
+ * Privy differs from the private-key and CDP paths in ONE structural way: the
+ * account it yields has no local `signTransaction`. It signs and broadcasts by
+ * sending `eth_sendTransaction` / `eth_signTypedData_v4` to a provider, so the
+ * viem wallet client's TRANSPORT must be that provider rather than a plain HTTP
+ * RPC. That is the whole difference, and it is what `transport` below carries.
+ *
+ * Neither shape puts a wallet key on this machine. The signing key lives at
+ * Privy; the broker holds the Privy authorization key. What the CLI holds is
+ * either a short-lived session token (`session`) or a P-256 authorization key
+ * in the host credential store (`autonomous`) — a key that authorizes a
+ * policy-bounded request, not a key that can move funds by itself.
+ */
+export type PrivyCliWalletSource = "privy-autonomous" | "privy-session";
+/** The store key naming the agent-owned wallet in the host credential store. */
+export declare const PRIVY_WALLET_KEY_ENV = "METRIK_AGENT_PRIVY_WALLET_KEY";
+/** Broker base URL. Optional for `autonomous`, REQUIRED for `session`. */
+export declare const PRIVY_BROKER_URL_ENV = "METRIK_AGENT_PRIVY_BROKER_URL";
+/** A scoped session token minted by the broker's `POST /v1/sessions`. */
+export declare const PRIVY_SESSION_TOKEN_ENV = "METRIK_AGENT_PRIVY_SESSION_TOKEN";
+/** The embedded wallet address the session is bound to. */
+export declare const PRIVY_ADDRESS_ENV = "METRIK_AGENT_PRIVY_ADDRESS";
+/** The PUBLIC Privy app id. Not a secret — the broker serves it at `/v1/config`. */
+export declare const PRIVY_APP_ID_ENV = "METRIK_AGENT_PRIVY_APP_ID";
+/** Every variable either Privy shape reads. Named in errors, never printed. */
+export declare const PRIVY_ENV_VARS: readonly ["METRIK_AGENT_PRIVY_WALLET_KEY", "METRIK_AGENT_PRIVY_BROKER_URL", "METRIK_AGENT_PRIVY_SESSION_TOKEN", "METRIK_AGENT_PRIVY_ADDRESS", "METRIK_AGENT_PRIVY_APP_ID"];
+/** The variables the user-owned session shape needs, all of them. */
+export declare const PRIVY_SESSION_ENV_VARS: readonly ["METRIK_AGENT_PRIVY_BROKER_URL", "METRIK_AGENT_PRIVY_SESSION_TOKEN", "METRIK_AGENT_PRIVY_ADDRESS", "METRIK_AGENT_PRIVY_APP_ID"];
+/**
+ * The spend ceiling a broker enforces server-side, read from `GET /v1/config`.
+ *
+ * These are the SAME numbers the broker checks `openStream` against
+ * (`deposit <= maxTotalUsdc`, `ratePerSecond <= maxRatePerSecondUsdc`,
+ * `duration <= maxDurationSeconds`), which is why the CLI can use them to
+ * refuse an over-ceiling hire locally instead of paying gas to learn a knowable
+ * fact. It reads them rather than hardcoding them: the ceiling belongs to the
+ * broker, and a copy in this file would be a second source of truth that goes
+ * stale silently.
+ */
+export interface PrivySpendPolicy {
+    readonly brokerUrl: string;
+    readonly chainId: number;
+    readonly maxTotalUsdc: bigint;
+    readonly maxRatePerSecondUsdc: bigint;
+    readonly maxDurationSeconds: number;
+}
+/** Reads a broker's public policy. No credential is sent; nothing secret is served. */
+export declare function fetchPrivySpendPolicy(brokerUrl: string, fetchImpl?: typeof fetch): Promise<PrivySpendPolicy>;
+export interface ResolvedPrivyCliWallet {
+    readonly source: PrivyCliWalletSource;
+    /** A JSON-RPC account: `signTypedData` works, `signTransaction` does not exist. */
+    readonly account: Account;
+    /** The provider-as-transport. Without this every write goes to a plain RPC and fails. */
+    readonly transport: Transport;
+    /** One line naming the wallet's origin. Safe to print: no credential in it. */
+    readonly description: string;
+    /** Reads the broker ceiling this wallet is capped at. Bound to its broker URL. */
+    readonly readSpendPolicy: () => Promise<PrivySpendPolicy>;
+}
+export interface ResolvePrivyCliWalletOptions {
+    /** `--rpc-url`, so a Privy wallet's READS use the same endpoint as everything else. */
+    readonly rpcUrl?: string;
+    readonly note?: (line: string) => void;
+    /** Test seam. Defaults to the real credential store selected from `env`. */
+    readonly store?: AutonomousWalletCredentialStore;
+    /** Test seam for the broker HTTP contract. */
+    readonly fetchImpl?: typeof fetch;
+}
+/**
+ * Resolves a Privy wallet from the environment, or `null` when no Privy
+ * variable is set at all.
+ *
+ * A PARTIALLY configured Privy setup is an error, not a `null` — "you set the
+ * session token but not the address" and "you configured no Privy wallet" are
+ * different facts, and rendering the first as the second sends the reader
+ * looking in the wrong place. This mirrors the CDP path exactly.
+ */
+export declare function resolvePrivyCliWallet(env: NodeJS.ProcessEnv, options?: ResolvePrivyCliWalletOptions): Promise<ResolvedPrivyCliWallet | null>;
+//# sourceMappingURL=privy.d.ts.map

package/dist/cli/privy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privy.d.ts","sourceRoot":"","sources":["../../src/cli/privy.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,SAAS,EACf,MAAM,MAAM,CAAC;AAEd,OAAO,EAQL,KAAK,+BAA+B,EAErC,MAAM,gCAAgC,CAAC;AAQxC;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,oBAAoB,GAAG,kBAAkB,GAAG,eAAe,CAAC;AAExE,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,kCAAkC,CAAC;AACpE,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,kCAAkC,CAAC;AACpE,yEAAyE;AACzE,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAC1E,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,+BAA+B,CAAC;AAC9D,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,8BAA8B,CAAC;AAE5D,+EAA+E;AAC/E,eAAO,MAAM,cAAc,4KAMjB,CAAC;AAEX,qEAAqE;AACrE,eAAO,MAAM,sBAAsB,2IAKzB,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,uFAAuF;AACvF,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAyC3B;AAUD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,kFAAkF;IAClF,QAAQ,CAAC,eAAe,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,4BAA4B;IAC3C,uFAAuF;IACvF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,+BAA+B,CAAC;IACjD,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CA8CxC"}

package/dist/cli/privy.js

@@ -0,0 +1,230 @@
+import { custom, isAddress, getAddress, } from "viem";
+import { AutonomousWalletError, EncryptedFileCredentialStore, HttpAutonomousWalletBroker, METRIK_AUTONOMOUS_WALLET_BROKER_URL, METRIK_WALLET_ENCRYPTION_KEY_ENV, createAutonomousWalletProvider, createDefaultAutonomousWalletStore, } from "../wallet/autonomous-wallet.js";
+import { createPrivySessionProvider } from "../wallet/privy-session-provider.js";
+import { createPrivyEmbeddedAccount, } from "../wallet/provider.js";
+import { configError } from "./errors.js";
+/** The store key naming the agent-owned wallet in the host credential store. */
+export const PRIVY_WALLET_KEY_ENV = "METRIK_AGENT_PRIVY_WALLET_KEY";
+/** Broker base URL. Optional for `autonomous`, REQUIRED for `session`. */
+export const PRIVY_BROKER_URL_ENV = "METRIK_AGENT_PRIVY_BROKER_URL";
+/** A scoped session token minted by the broker's `POST /v1/sessions`. */
+export const PRIVY_SESSION_TOKEN_ENV = "METRIK_AGENT_PRIVY_SESSION_TOKEN";
+/** The embedded wallet address the session is bound to. */
+export const PRIVY_ADDRESS_ENV = "METRIK_AGENT_PRIVY_ADDRESS";
+/** The PUBLIC Privy app id. Not a secret — the broker serves it at `/v1/config`. */
+export const PRIVY_APP_ID_ENV = "METRIK_AGENT_PRIVY_APP_ID";
+/** Every variable either Privy shape reads. Named in errors, never printed. */
+export const PRIVY_ENV_VARS = [
+    PRIVY_WALLET_KEY_ENV,
+    PRIVY_BROKER_URL_ENV,
+    PRIVY_SESSION_TOKEN_ENV,
+    PRIVY_ADDRESS_ENV,
+    PRIVY_APP_ID_ENV,
+];
+/** The variables the user-owned session shape needs, all of them. */
+export const PRIVY_SESSION_ENV_VARS = [
+    PRIVY_BROKER_URL_ENV,
+    PRIVY_SESSION_TOKEN_ENV,
+    PRIVY_ADDRESS_ENV,
+    PRIVY_APP_ID_ENV,
+];
+/** Reads a broker's public policy. No credential is sent; nothing secret is served. */
+export async function fetchPrivySpendPolicy(brokerUrl, fetchImpl = fetch) {
+    const base = brokerUrl.replace(/\/$/, "");
+    const response = await fetchImpl(`${base}/v1/config`, {
+        headers: { accept: "application/json" },
+    }).catch((error) => {
+        throw configError(`the Privy broker at ${base} did not answer its public policy`, `${describe(error)} The CLI reads GET /v1/config to know the ceiling your wallet is capped at; without it, it cannot tell you before broadcasting whether a hire fits.`);
+    });
+    const body = (await response.json().catch(() => null));
+    if (!response.ok || body === null) {
+        throw configError(`the Privy broker at ${base} rejected the public policy read (${response.status})`);
+    }
+    const chainId = Number(body.chainId);
+    const maxTotalUsdc = asBigint(body.maxTotalUsdcAtomic);
+    const maxRatePerSecondUsdc = asBigint(body.maxRatePerSecondAtomic);
+    const maxDurationSeconds = Number(body.maxDurationSeconds);
+    if (!Number.isSafeInteger(chainId) ||
+        maxTotalUsdc === null ||
+        maxRatePerSecondUsdc === null ||
+        !Number.isSafeInteger(maxDurationSeconds)) {
+        throw configError(`the Privy broker at ${base} returned a policy this CLI cannot read`, "expected chainId, maxTotalUsdcAtomic, maxRatePerSecondAtomic and maxDurationSeconds.");
+    }
+    return {
+        brokerUrl: base,
+        chainId,
+        maxTotalUsdc,
+        maxRatePerSecondUsdc,
+        maxDurationSeconds,
+    };
+}
+function asBigint(value) {
+    if (typeof value === "bigint")
+        return value;
+    if (typeof value === "number" && Number.isSafeInteger(value))
+        return BigInt(value);
+    if (typeof value === "string" && /^[0-9]+$/.test(value))
+        return BigInt(value);
+    return null;
+}
+/**
+ * Resolves a Privy wallet from the environment, or `null` when no Privy
+ * variable is set at all.
+ *
+ * A PARTIALLY configured Privy setup is an error, not a `null` — "you set the
+ * session token but not the address" and "you configured no Privy wallet" are
+ * different facts, and rendering the first as the second sends the reader
+ * looking in the wrong place. This mirrors the CDP path exactly.
+ */
+export async function resolvePrivyCliWallet(env, options = {}) {
+    const walletKey = read(env, PRIVY_WALLET_KEY_ENV);
+    const brokerUrl = read(env, PRIVY_BROKER_URL_ENV);
+    const sessionToken = read(env, PRIVY_SESSION_TOKEN_ENV);
+    const address = read(env, PRIVY_ADDRESS_ENV);
+    const appId = read(env, PRIVY_APP_ID_ENV);
+    if (walletKey === null &&
+        brokerUrl === null &&
+        sessionToken === null &&
+        address === null &&
+        appId === null) {
+        return null;
+    }
+    if (walletKey !== null) {
+        if (sessionToken !== null) {
+            options.note?.(`warning: both ${PRIVY_WALLET_KEY_ENV} and ${PRIVY_SESSION_TOKEN_ENV} are set; using the agent-owned wallet named by ${PRIVY_WALLET_KEY_ENV}. Unset it to sign with the session token.`);
+        }
+        return await resolveAutonomous(walletKey, brokerUrl, env, options);
+    }
+    const missing = PRIVY_SESSION_ENV_VARS.filter((name) => read(env, name) === null);
+    if (missing.length > 0) {
+        throw configError(`the Privy wallet is partially configured: ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} not set`, `a Privy wallet is configured one of two ways: set ${PRIVY_WALLET_KEY_ENV} to the store key of an agent-owned wallet you provisioned with provisionMetrikAutonomousWallet(), or set all of ${PRIVY_SESSION_ENV_VARS.join(", ")} for a broker session. Set the missing one${missing.length === 1 ? "" : "s"}, or unset the others to use a different wallet.`);
+    }
+    return resolveSession({
+        brokerUrl: brokerUrl,
+        sessionToken: sessionToken,
+        address: address,
+        appId: appId,
+        ...(options.rpcUrl === undefined ? {} : { rpcUrl: options.rpcUrl }),
+        ...(options.fetchImpl === undefined
+            ? {}
+            : { fetchImpl: options.fetchImpl }),
+    });
+}
+async function resolveAutonomous(walletKey, brokerUrlOverride, env, options) {
+    const store = options.store ?? selectCredentialStore(env);
+    let record;
+    try {
+        record = await store.load(walletKey);
+    }
+    catch (error) {
+        throw configError(`could not read the agent-owned Privy wallet "${walletKey}" from the credential store`, `${describe(error)} On a headless host the OS credential store is often unavailable; set ${METRIK_WALLET_ENCRYPTION_KEY_ENV} to use the encrypted-file store instead.`);
+    }
+    if (record === null) {
+        throw configError(`no agent-owned Privy wallet is stored under the key "${walletKey}"`, `the CLI never provisions a wallet on your behalf — a fund-moving command is the wrong place to mint one. Provision it once with provisionMetrikAutonomousWallet({ storeKey: "${walletKey}" }) (see docs/autonomous-privy-wallet.md), then re-run this command.`);
+    }
+    if (record.walletId === undefined || record.address === undefined) {
+        throw configError(`the agent-owned Privy wallet "${walletKey}" was never finished provisioning`, "the local key exists but the broker never returned a wallet id and address. Re-run provisionMetrikAutonomousWallet() with the same store key — it retries with the same key and idempotency nonce.");
+    }
+    const brokerUrl = brokerUrlOverride ?? record.brokerUrl;
+    if (brokerUrlOverride !== null && brokerUrlOverride !== record.brokerUrl) {
+        options.note?.(`note: ${PRIVY_BROKER_URL_ENV} (${brokerUrlOverride}) overrides the broker this wallet was provisioned against (${record.brokerUrl}); only a broker holding this wallet's Privy authorization key can authorize it.`);
+    }
+    let broker;
+    try {
+        broker = new HttpAutonomousWalletBroker(brokerUrl, {
+            ...(options.fetchImpl === undefined
+                ? {}
+                : { fetchImpl: options.fetchImpl }),
+        });
+    }
+    catch (error) {
+        throw configError(`the autonomous wallet broker URL is not usable: ${describe(error)}`, `set ${PRIVY_BROKER_URL_ENV} to an HTTPS broker you control (the default is ${METRIK_AUTONOMOUS_WALLET_BROKER_URL}).`);
+    }
+    const provider = createAutonomousWalletProvider({
+        wallet: record,
+        broker,
+        ...(options.rpcUrl === undefined ? {} : { rpcUrl: options.rpcUrl }),
+        ...(options.fetchImpl === undefined
+            ? {}
+            : { fetchImpl: options.fetchImpl }),
+    });
+    const account = await embeddedAccount(provider, record.appId, record.address);
+    return {
+        source: "privy-autonomous",
+        account,
+        transport: custom(provider),
+        description: `${record.address} (agent-owned Privy wallet "${walletKey}" via ${brokerUrl})`,
+        readSpendPolicy: async () => await fetchPrivySpendPolicy(brokerUrl, options.fetchImpl ?? globalThis.fetch.bind(globalThis)),
+    };
+}
+function resolveSession(input) {
+    if (!isAddress(input.address)) {
+        throw configError(`${PRIVY_ADDRESS_ENV} must be a 0x-prefixed 20-byte address`);
+    }
+    const address = getAddress(input.address);
+    let provider;
+    try {
+        provider = createPrivySessionProvider({
+            brokerUrl: input.brokerUrl,
+            sessionToken: input.sessionToken,
+            address,
+            ...(input.rpcUrl === undefined ? {} : { rpcUrl: input.rpcUrl }),
+            ...(input.fetchImpl === undefined ? {} : { fetchImpl: input.fetchImpl }),
+        });
+    }
+    catch (error) {
+        throw configError(`the Privy session broker URL is not usable: ${describe(error)}`, `set ${PRIVY_BROKER_URL_ENV} to the HTTPS broker that minted ${PRIVY_SESSION_TOKEN_ENV}. A session token is only valid against the broker that issued it.`);
+    }
+    return embeddedAccount(provider, input.appId, address).then((account) => ({
+        source: "privy-session",
+        account,
+        transport: custom(provider),
+        description: `${address} (Privy broker session via ${input.brokerUrl})`,
+        readSpendPolicy: async () => await fetchPrivySpendPolicy(input.brokerUrl, input.fetchImpl ?? globalThis.fetch.bind(globalThis)),
+    }));
+}
+/**
+ * Wraps a provider in the package's existing Privy EOA adapter.
+ *
+ * Both CLI providers answer `eth_chainId` and `eth_accounts` locally, so the
+ * adapter's session assertion is a pure local consistency check here — no
+ * network call happens while the wallet is being resolved.
+ */
+async function embeddedAccount(provider, appId, address) {
+    try {
+        return await createPrivyEmbeddedAccount({
+            appId,
+            address,
+            provider,
+            chainId: 84532,
+        });
+    }
+    catch (error) {
+        throw configError(`the Privy wallet could not be prepared: ${describe(error)}`, `check ${PRIVY_ENV_VARS.join(", ")}. Metrik Privy wallets are Base Sepolia (84532) only.`);
+    }
+}
+/**
+ * The credential store the autonomous wallet was provisioned into.
+ *
+ * Selection mirrors `provisionMetrikAutonomousWallet`'s documented options:
+ * setting `METRIK_WALLET_ENCRYPTION_KEY` means the encrypted-file store (the
+ * durable option for a headless host), otherwise the host OS store. Picking a
+ * different store than provisioning used simply finds no record, and the
+ * "no wallet is stored under this key" error above says so.
+ */
+function selectCredentialStore(env) {
+    if (read(env, METRIK_WALLET_ENCRYPTION_KEY_ENV) !== null) {
+        return new EncryptedFileCredentialStore({ env });
+    }
+    return createDefaultAutonomousWalletStore();
+}
+function read(env, name) {
+    const value = env[name];
+    return value === undefined || value.length === 0 ? null : value;
+}
+function describe(error) {
+    if (error instanceof AutonomousWalletError)
+        return error.message;
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=privy.js.map

package/dist/cli/privy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privy.js","sourceRoot":"","sources":["../../src/cli/privy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,SAAS,EACT,UAAU,GAGX,MAAM,MAAM,CAAC;AAEd,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,EACnC,gCAAgC,EAChC,8BAA8B,EAC9B,kCAAkC,GAGnC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EACL,0BAA0B,GAE3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAmB1C,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,+BAA+B,CAAC;AACpE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,oBAAoB,GAAG,+BAA+B,CAAC;AACpE,yEAAyE;AACzE,MAAM,CAAC,MAAM,uBAAuB,GAAG,kCAAkC,CAAC;AAC1E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AAC9D,oFAAoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,oBAAoB;IACpB,oBAAoB;IACpB,uBAAuB;IACvB,iBAAiB;IACjB,gBAAgB;CACR,CAAC;AAEX,qEAAqE;AACrE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,oBAAoB;IACpB,uBAAuB;IACvB,iBAAiB;IACjB,gBAAgB;CACR,CAAC;AAqBX,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,YAA0B,KAAK;IAE/B,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,YAAY,EAAE;QACpD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1B,MAAM,WAAW,CACf,uBAAuB,IAAI,mCAAmC,EAC9D,GAAG,QAAQ,CAAC,KAAK,CAAC,qJAAqJ,CACxK,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAG7C,CAAC;IACT,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,WAAW,CACf,uBAAuB,IAAI,qCAAqC,QAAQ,CAAC,MAAM,GAAG,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,oBAAoB,GAAG,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnE,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC3D,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAC9B,YAAY,KAAK,IAAI;QACrB,oBAAoB,KAAK,IAAI;QAC7B,CAAC,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,EACzC,CAAC;QACD,MAAM,WAAW,CACf,uBAAuB,IAAI,yCAAyC,EACpE,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,IAAI;QACf,OAAO;QACP,YAAY;QACZ,oBAAoB;QACpB,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAC1D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAwBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAsB,EACtB,UAAwC,EAAE;IAE1C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAE1C,IACE,SAAS,KAAK,IAAI;QAClB,SAAS,KAAK,IAAI;QAClB,YAAY,KAAK,IAAI;QACrB,OAAO,KAAK,IAAI;QAChB,KAAK,KAAK,IAAI,EACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,EAAE,CACZ,iBAAiB,oBAAoB,QAAQ,uBAAuB,mDAAmD,oBAAoB,4CAA4C,CACxL,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAC3C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,IAAI,CACnC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,WAAW,CACf,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,EAChH,qDAAqD,oBAAoB,oHAAoH,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,6CAA6C,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,kDAAkD,CAC7V,CAAC;IACJ,CAAC;IAED,OAAO,cAAc,CAAC;QACpB,SAAS,EAAE,SAAmB;QAC9B,YAAY,EAAE,YAAsB;QACpC,OAAO,EAAE,OAAiB;QAC1B,KAAK,EAAE,KAAe;QACtB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;KACtC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,SAAiB,EACjB,iBAAgC,EAChC,GAAsB,EACtB,OAAqC;IAErC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,MAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,CACf,gDAAgD,SAAS,6BAA6B,EACtF,GAAG,QAAQ,CAAC,KAAK,CAAC,yEAAyE,gCAAgC,2CAA2C,CACvK,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,WAAW,CACf,wDAAwD,SAAS,GAAG,EACpE,gLAAgL,SAAS,uEAAuE,CACjQ,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,WAAW,CACf,iCAAiC,SAAS,mCAAmC,EAC7E,oMAAoM,CACrM,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,iBAAiB,IAAI,MAAM,CAAC,SAAS,CAAC;IACxD,IAAI,iBAAiB,KAAK,IAAI,IAAI,iBAAiB,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QACzE,OAAO,CAAC,IAAI,EAAE,CACZ,SAAS,oBAAoB,KAAK,iBAAiB,+DAA+D,MAAM,CAAC,SAAS,kFAAkF,CACrN,CAAC;IACJ,CAAC;IAED,IAAI,MAAkC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,0BAA0B,CAAC,SAAS,EAAE;YACjD,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;gBACjC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,CACf,mDAAmD,QAAQ,CAAC,KAAK,CAAC,EAAE,EACpE,OAAO,oBAAoB,mDAAmD,mCAAmC,IAAI,CACtH,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,8BAA8B,CAAC;QAC9C,MAAM,EAAE,MAAM;QACd,MAAM;QACN,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;KACtC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAE9E,OAAO;QACL,MAAM,EAAE,kBAAkB;QAC1B,OAAO;QACP,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC3B,WAAW,EAAE,GAAG,MAAM,CAAC,OAAO,+BAA+B,SAAS,SAAS,SAAS,GAAG;QAC3F,eAAe,EAAE,KAAK,IAAI,EAAE,CAC1B,MAAM,qBAAqB,CACzB,SAAS,EACT,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CACvD;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAOvB;IACC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,WAAW,CACf,GAAG,iBAAiB,wCAAwC,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,QAA8B,CAAC;IACnC,IAAI,CAAC;QACH,QAAQ,GAAG,0BAA0B,CAAC;YACpC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,OAAO;YACP,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;SACzE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,CACf,+CAA+C,QAAQ,CAAC,KAAK,CAAC,EAAE,EAChE,OAAO,oBAAoB,oCAAoC,uBAAuB,oEAAoE,CAC3J,CAAC;IACJ,CAAC;IACD,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACxE,MAAM,EAAE,eAAwB;QAChC,OAAO;QACP,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC3B,WAAW,EAAE,GAAG,OAAO,8BAA8B,KAAK,CAAC,SAAS,GAAG;QACvE,eAAe,EAAE,KAAK,IAAI,EAAE,CAC1B,MAAM,qBAAqB,CACzB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CACrD;KACJ,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAC5B,QAA8B,EAC9B,KAAa,EACb,OAAsB;IAEtB,IAAI,CAAC;QACH,OAAO,MAAM,0BAA0B,CAAC;YACtC,KAAK;YACL,OAAO;YACP,QAAQ;YACR,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,CACf,2CAA2C,QAAQ,CAAC,KAAK,CAAC,EAAE,EAC5D,SAAS,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,uDAAuD,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAC5B,GAAsB;IAEtB,IAAI,IAAI,CAAC,GAAG,EAAE,gCAAgC,CAAC,KAAK,IAAI,EAAE,CAAC;QACzD,OAAO,IAAI,4BAA4B,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,kCAAkC,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,IAAI,CAAC,GAAsB,EAAE,IAAY;IAChD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAClE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,YAAY,qBAAqB;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjE,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/cli/spend-policy.d.ts

@@ -0,0 +1,60 @@
+import type { PrivySpendPolicy } from "./privy.js";
+import type { RequestedSpend } from "./mandate.js";
+import type { ServerMandateCaps } from "../mandates/env.js";
+/**
+ * Where a hire's spend ceiling comes from, and who enforces it.
+ *
+ * The CLI has two kinds of wallet, and they differ in WHO holds the key — which
+ * is the whole reason the self-signed spend mandate exists at all:
+ *
+ *  - **Key-holding wallet** (a raw private key, a CDP account). The person
+ *    typing the command holds the key, so nothing outside this process bounds
+ *    what that key can spend. `signCliMandate()` makes the agent state its own
+ *    ceiling, and `checkMandate()` enforces it here. That is the best available
+ *    guarantee when the client is the last line of defence.
+ *
+ *  - **Policy-enforced wallet** (Privy, either shape). The key lives at Privy
+ *    and is exercised by the broker, which caps every `openStream` against a
+ *    policy the client CANNOT reach or raise. Re-signing a local mandate on top
+ *    of that adds nothing: it is an agent attesting to its own limits when a
+ *    stronger limit is already enforced somewhere the agent cannot touch. Worse,
+ *    it cannot even be produced — the broker's typed-data policy allows an
+ *    `InvocationCapability` and nothing else — so insisting on it would block
+ *    the wallet whose ceiling is the stronger of the two.
+ *
+ * So for a policy-enforced wallet the CLI does not self-sign a mandate. It
+ * SUBSTITUTES the real ceiling rather than dropping the check: it reads the
+ * broker's public `/v1/config` and refuses an over-ceiling hire locally, in the
+ * same shape as the gas and USDC preflights — fail early with an actionable
+ * message instead of paying gas to learn a knowable fact.
+ *
+ * **Do not "restore" the mandate here for consistency.** Its premise is
+ * key-holding, and that premise is false for these wallets. Reinstating it
+ * would weaken the property that makes them non-custodial (the broker would
+ * have to be widened to sign `SpendMandate`) while making every fund-moving
+ * command fail against the broker as deployed.
+ */
+export interface SpendCeiling {
+    readonly policy: PrivySpendPolicy;
+}
+/**
+ * Refuse a hire the broker will refuse anyway, before any gas is spent.
+ *
+ * Mirrors the broker's own `openStream` check exactly — `deposit`,
+ * `ratePerSecond` and `duration` each against their ceiling — because a
+ * divergent copy would either block hires the broker would allow or promise
+ * hires it will not.
+ */
+export declare function assertWithinSpendPolicy(policy: PrivySpendPolicy, spend: RequestedSpend): void;
+/**
+ * Refuse a hire that exceeds an OPERATOR-SET standing ceiling.
+ *
+ * `METRIK_AGENT_MANDATE_*` is not the self-signed mandate: it is a ceiling the
+ * operator deliberately configured, and it can be TIGHTER than the broker
+ * policy. A policy-enforced wallet skips the self-signed mandate, so without
+ * this the env caps would silently stop applying to exactly the wallets an
+ * unattended run is most likely to use. Enforced locally here instead, with the
+ * same comparisons `checkMandate()` makes.
+ */
+export declare function assertWithinOperatorCaps(caps: ServerMandateCaps, spend: RequestedSpend): void;
+//# sourceMappingURL=spend-policy.d.ts.map

package/dist/cli/spend-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spend-policy.d.ts","sourceRoot":"","sources":["../../src/cli/spend-policy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,gBAAgB,EACxB,KAAK,EAAE,cAAc,GACpB,IAAI,CA4BN;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,iBAAiB,EACvB,KAAK,EAAE,cAAc,GACpB,IAAI,CAyCN"}

package/dist/cli/spend-policy.js

@@ -0,0 +1,65 @@
+import { formatUsdc } from "./amounts.js";
+import { CliError } from "./errors.js";
+/**
+ * Refuse a hire the broker will refuse anyway, before any gas is spent.
+ *
+ * Mirrors the broker's own `openStream` check exactly — `deposit`,
+ * `ratePerSecond` and `duration` each against their ceiling — because a
+ * divergent copy would either block hires the broker would allow or promise
+ * hires it will not.
+ */
+export function assertWithinSpendPolicy(policy, spend) {
+    const over = [];
+    if (spend.budgetUsdc > policy.maxTotalUsdc) {
+        over.push(`--budget ${formatUsdc(spend.budgetUsdc)} exceeds the policy ceiling of ${formatUsdc(policy.maxTotalUsdc)}`);
+    }
+    if (spend.ratePerSecondUsdc > policy.maxRatePerSecondUsdc) {
+        over.push(`--rate ${spend.ratePerSecondUsdc} atomic/second exceeds the policy ceiling of ${policy.maxRatePerSecondUsdc} atomic/second`);
+    }
+    if (spend.durationSeconds > policy.maxDurationSeconds) {
+        over.push(`--duration ${spend.durationSeconds}s exceeds the policy ceiling of ${policy.maxDurationSeconds}s`);
+    }
+    if (over.length === 0)
+        return;
+    throw new CliError(`this hire is outside the spend policy your wallet is capped at: ${over.join("; ")}`, {
+        exitCode: 3,
+        hint: `the ceiling is enforced by the broker at ${policy.brokerUrl} (GET /v1/config), not by this CLI — you cannot raise it from this side, ` +
+            "which is exactly what makes the wallet non-custodial. Size the stream to fit, or use a key-holding wallet.",
+    });
+}
+/**
+ * Refuse a hire that exceeds an OPERATOR-SET standing ceiling.
+ *
+ * `METRIK_AGENT_MANDATE_*` is not the self-signed mandate: it is a ceiling the
+ * operator deliberately configured, and it can be TIGHTER than the broker
+ * policy. A policy-enforced wallet skips the self-signed mandate, so without
+ * this the env caps would silently stop applying to exactly the wallets an
+ * unattended run is most likely to use. Enforced locally here instead, with the
+ * same comparisons `checkMandate()` makes.
+ */
+export function assertWithinOperatorCaps(caps, spend) {
+    const over = [];
+    if (spend.budgetUsdc > caps.maxPerStreamUsdc) {
+        over.push(`--budget ${formatUsdc(spend.budgetUsdc)} exceeds METRIK_AGENT_MANDATE max-per-stream ${formatUsdc(caps.maxPerStreamUsdc)}`);
+    }
+    if (spend.budgetUsdc > caps.maxTotalUsdc) {
+        over.push(`--budget ${formatUsdc(spend.budgetUsdc)} exceeds METRIK_AGENT_MANDATE max-total ${formatUsdc(caps.maxTotalUsdc)}`);
+    }
+    if (spend.ratePerSecondUsdc > caps.maxRatePerSecondUsdc) {
+        over.push(`--rate ${spend.ratePerSecondUsdc} atomic/second exceeds METRIK_AGENT_MANDATE max rate ${caps.maxRatePerSecondUsdc} atomic/second`);
+    }
+    if (spend.durationSeconds > caps.maxDurationSeconds) {
+        over.push(`--duration ${spend.durationSeconds}s exceeds METRIK_AGENT_MANDATE max duration ${caps.maxDurationSeconds}s`);
+    }
+    if (caps.allowedOperators.length > 0 &&
+        !caps.allowedOperators.some((operator) => operator.toLowerCase() === spend.operator.toLowerCase())) {
+        over.push(`operator ${spend.operator} is not in METRIK_AGENT_MANDATE_ALLOWED_OPERATORS`);
+    }
+    if (over.length === 0)
+        return;
+    throw new CliError(`this hire is outside the standing mandate caps in your environment: ${over.join("; ")}`, {
+        exitCode: 3,
+        hint: "these caps come from METRIK_AGENT_MANDATE_* and are yours to change. They are enforced locally for a policy-enforced wallet, which signs no mandate of its own.",
+    });
+}
+//# sourceMappingURL=spend-policy.js.map

package/dist/cli/spend-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spend-policy.js","sourceRoot":"","sources":["../../src/cli/spend-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AA0CvC;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAwB,EACxB,KAAqB;IAErB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;QAC3C,IAAI,CAAC,IAAI,CACP,YAAY,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,kCAAkC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,GAAG,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAC1D,IAAI,CAAC,IAAI,CACP,UAAU,KAAK,CAAC,iBAAiB,gDAAgD,MAAM,CAAC,oBAAoB,gBAAgB,CAC7H,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACtD,IAAI,CAAC,IAAI,CACP,cAAc,KAAK,CAAC,eAAe,mCAAmC,MAAM,CAAC,kBAAkB,GAAG,CACnG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE9B,MAAM,IAAI,QAAQ,CAChB,mEAAmE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACpF;QACE,QAAQ,EAAE,CAAC;QACX,IAAI,EACF,4CAA4C,MAAM,CAAC,SAAS,2EAA2E;YACvI,4GAA4G;KAC/G,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAuB,EACvB,KAAqB;IAErB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CACP,YAAY,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,gDAAgD,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAC5H,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CACP,YAAY,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,2CAA2C,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CACnH,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxD,IAAI,CAAC,IAAI,CACP,UAAU,KAAK,CAAC,iBAAiB,wDAAwD,IAAI,CAAC,oBAAoB,gBAAgB,CACnI,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,CACP,cAAc,KAAK,CAAC,eAAe,+CAA+C,IAAI,CAAC,kBAAkB,GAAG,CAC7G,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAChC,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CACzB,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CACtE,EACD,CAAC;QACD,IAAI,CAAC,IAAI,CACP,YAAY,KAAK,CAAC,QAAQ,mDAAmD,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE9B,MAAM,IAAI,QAAQ,CAChB,uEAAuE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACxF;QACE,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,iKAAiK;KACxK,CACF,CAAC;AACJ,CAAC"}