@decentrys/agent 0.1.0

package/dist/browser/decentrys-agent.js

@@ -0,0 +1,2051 @@
+"use strict";
+var DecentrysAgent = (() => {
+  var __defProp = Object.defineProperty;
+  var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+  var __getOwnPropNames = Object.getOwnPropertyNames;
+  var __hasOwnProp = Object.prototype.hasOwnProperty;
+  var __export = (target, all) => {
+    for (var name in all)
+      __defProp(target, name, { get: all[name], enumerable: true });
+  };
+  var __copyProps = (to, from, except, desc) => {
+    if (from && typeof from === "object" || typeof from === "function") {
+      for (let key of __getOwnPropNames(from))
+        if (!__hasOwnProp.call(to, key) && key !== except)
+          __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+    }
+    return to;
+  };
+  var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+  // src/index.ts
+  var index_exports = {};
+  __export(index_exports, {
+    AGENT_ACTION_TYPES: () => AGENT_ACTION_TYPES,
+    AGENT_MODEL_VERSION: () => AGENT_MODEL_VERSION,
+    AGENT_RULES: () => AGENT_RULES,
+    AGENT_SDK_VERSION: () => AGENT_SDK_VERSION,
+    AgentGuard: () => AgentGuard,
+    DEFAULT_AGENT_RISK_POLICY: () => DEFAULT_AGENT_RISK_POLICY,
+    SpendLedger: () => SpendLedger,
+    describeDuration: () => describeDuration,
+    evaluatePolicy: () => evaluatePolicy,
+    explainAgentAction: () => explainAgentAction,
+    fingerprint: () => fingerprint,
+    isReservationLedger: () => isReservationLedger,
+    isUnlimitedAllowance: () => isUnlimitedAllowance,
+    narrowPolicy: () => narrowPolicy,
+    newDecisionId: () => newDecisionId,
+    sealPolicy: () => sealPolicy,
+    unavailableReason: () => unavailableReason
+  });
+
+  // src/model.ts
+  var AGENT_MODEL_VERSION = "agent-1.0.0";
+  var AGENT_ACTION_TYPES = [
+    "transfer",
+    "swap",
+    "approve",
+    "contract_call",
+    "bridge",
+    "stake",
+    "unstake",
+    "deploy",
+    "sign_message",
+    "unknown"
+  ];
+  var AGENT_RULES = [
+    "AGENT_BINDING",
+    "ACTION_TYPE",
+    "CHAIN",
+    "COUNTERPARTY",
+    "CONTRACT",
+    "TOKEN",
+    "APPROVAL_ALLOWANCE",
+    "VALUE_PER_ACTION",
+    "CUMULATIVE_SPEND",
+    "RATE_LIMIT",
+    "RISK_LEVEL",
+    "ASSESSMENT_AVAILABILITY",
+    "HUMAN_APPROVAL_THRESHOLD"
+  ];
+
+  // ../protect/dist/browser/decentrys-protect.mjs
+  var RISK_LEVELS = [
+    "NO_CRITICAL_RISK_DETECTED",
+    "INFORMATIONAL",
+    "CAUTION",
+    "ELEVATED_RISK",
+    "HIGH_RISK",
+    "CRITICAL_THREAT",
+    "KNOWN_MALICIOUS"
+  ];
+  var RISK_LEVEL_MEANING = {
+    NO_CRITICAL_RISK_DETECTED: "No known critical threat evidence was identified. This is not an assurance of safety.",
+    INFORMATIONAL: "Facts worth knowing before proceeding. Nothing here indicates danger.",
+    CAUTION: "A security-sensitive capability or behaviour exists that deserves attention.",
+    ELEVATED_RISK: "Several meaningful risk signals are present together.",
+    HIGH_RISK: "Strong technical or behavioural evidence of significant danger.",
+    CRITICAL_THREAT: "Severe threat supported by concrete evidence.",
+    KNOWN_MALICIOUS: "Confirmed malicious infrastructure or behaviour, verified against evidence."
+  };
+  var HISTORY_STATUS_MEANING = {
+    ESTABLISHED: "Substantial on-chain history is available.",
+    MODERATE: "Some history is available.",
+    LIMITED: "Little history is available yet. This is normal for anything recently deployed and is not a risk finding.",
+    NONE: "No history is available. This is not a risk finding."
+  };
+  var PROTECT_MODEL_VERSION = "protect-1.0.0";
+  var RAISING_STATUSES = ["ACTIVE"];
+  var MIN_RAISING_CONFIDENCE = 0.5;
+  function classify(input) {
+    const now = input.now ?? /* @__PURE__ */ new Date();
+    const facts = input.facts ?? [];
+    const capabilities = input.capabilities ?? [];
+    const unknowns = input.unknowns ?? [];
+    const historyStatus = input.historyStatus ?? "LIMITED";
+    const threatSignals = (input.threatSignals ?? []).map((signal) => applyDecay(signal, now));
+    const raising = threatSignals.filter(
+      (s) => RAISING_STATUSES.includes(s.status) && s.confidence >= MIN_RAISING_CONFIDENCE
+    );
+    const explanation = [];
+    let level = "NO_CRITICAL_RISK_DETECTED";
+    const confirmed = raising.filter(
+      (s) => s.severity === "CRITICAL" && s.evidence.some((e) => e.analystVerified)
+    );
+    const confirmedMalicious = confirmed.length > 0;
+    if (confirmedMalicious) {
+      level = "KNOWN_MALICIOUS";
+      for (const signal of confirmed) {
+        explanation.push(`${signal.explanation} (verified by an analyst)`);
+      }
+    } else {
+      const critical = raising.filter((s) => s.severity === "CRITICAL");
+      const high = raising.filter((s) => s.severity === "HIGH");
+      const medium = raising.filter((s) => s.severity === "MEDIUM");
+      if (critical.length > 0) {
+        level = "CRITICAL_THREAT";
+        for (const s of critical) explanation.push(s.explanation);
+      } else if (high.length > 0) {
+        level = high.length > 1 ? "HIGH_RISK" : "ELEVATED_RISK";
+        for (const s of high) explanation.push(s.explanation);
+      } else if (medium.length > 1) {
+        level = "ELEVATED_RISK";
+        for (const s of medium) explanation.push(s.explanation);
+      } else if (medium.length === 1) {
+        level = "CAUTION";
+        explanation.push(medium[0].explanation);
+      }
+      const significant = capabilities.filter((c) => c.severity === "SIGNIFICANT");
+      if (significant.length > 0 && rank(level) < rank("CAUTION")) {
+        level = "CAUTION";
+        for (const c of significant) explanation.push(c.statement);
+      } else if (rank(level) < rank("INFORMATIONAL") && capabilities.length > 0) {
+        level = "INFORMATIONAL";
+        for (const c of capabilities.slice(0, 3)) explanation.push(c.statement);
+      }
+    }
+    for (const signal of threatSignals) {
+      if (raising.includes(signal)) continue;
+      if (signal.status !== "ACTIVE") {
+        explanation.push(
+          `${signal.explanation} \u2014 this signal is ${signal.status.toLowerCase()} and did not affect the assessment.`
+        );
+      } else if (signal.confidence < MIN_RAISING_CONFIDENCE) {
+        explanation.push(
+          `${signal.explanation} \u2014 reported at ${Math.round(signal.confidence * 100)}% confidence, which is too low to raise the risk level on its own.`
+        );
+      }
+    }
+    if (level === "NO_CRITICAL_RISK_DETECTED" && facts.length > 0) {
+      level = "INFORMATIONAL";
+    }
+    if (historyStatus === "LIMITED" || historyStatus === "NONE") {
+      explanation.push(HISTORY_STATUS_MEANING[historyStatus]);
+    }
+    if (unknowns.length > 0) {
+      explanation.push(
+        `${unknowns.length} ${unknowns.length === 1 ? "attribute is" : "attributes are"} unknown. Unknown is reported as unknown; it does not contribute to risk.`
+      );
+    }
+    if (explanation.length === 0) {
+      explanation.push(RISK_LEVEL_MEANING[level]);
+    }
+    return {
+      riskLevel: level,
+      confirmedMalicious,
+      confidence: confidenceFor(level, raising, historyStatus),
+      historyStatus,
+      facts,
+      capabilities,
+      threatSignals,
+      unknowns,
+      components: {
+        technicalRisk: technicalRisk(capabilities),
+        behavioralRisk: behavioralRisk(raising),
+        threatIntelligenceRisk: threatIntelligenceRisk(raising),
+        // Coverage, reported separately so it cannot be summed into a risk total.
+        historyConfidence: input.historyConfidence ?? historyConfidenceFor(historyStatus)
+      },
+      explanation,
+      modelVersion: PROTECT_MODEL_VERSION,
+      assessedAt: now.toISOString()
+    };
+  }
+  function rank(level) {
+    return [
+      "NO_CRITICAL_RISK_DETECTED",
+      "INFORMATIONAL",
+      "CAUTION",
+      "ELEVATED_RISK",
+      "HIGH_RISK",
+      "CRITICAL_THREAT",
+      "KNOWN_MALICIOUS"
+    ].indexOf(level);
+  }
+  function applyDecay(signal, now) {
+    if (signal.status !== "ACTIVE") return signal;
+    if (!signal.expiresAt) return signal;
+    return Date.parse(signal.expiresAt) <= now.getTime() ? { ...signal, status: "STALE" } : signal;
+  }
+  function confidenceFor(level, raising, history) {
+    if (raising.length > 0) {
+      const best = Math.max(...raising.map((s) => s.confidence));
+      return Number(best.toFixed(2));
+    }
+    switch (history) {
+      case "ESTABLISHED":
+        return 0.85;
+      case "MODERATE":
+        return 0.7;
+      case "LIMITED":
+        return 0.5;
+      default:
+        return 0.35;
+    }
+  }
+  function technicalRisk(capabilities) {
+    const weight = { INFO: 4, NOTABLE: 12, SIGNIFICANT: 25 };
+    return Math.min(100, capabilities.reduce((sum, c) => sum + weight[c.severity], 0));
+  }
+  function behavioralRisk(raising) {
+    const weight = { LOW: 5, MEDIUM: 20, HIGH: 40, CRITICAL: 70 };
+    return Math.min(100, raising.filter((s) => s.hops === 0).reduce((sum, s) => sum + weight[s.severity] * s.confidence, 0));
+  }
+  function threatIntelligenceRisk(raising) {
+    const weight = { LOW: 5, MEDIUM: 15, HIGH: 35, CRITICAL: 60 };
+    return Math.min(100, raising.reduce((sum, s) => {
+      const decay = Math.pow(0.6, Math.max(0, s.hops));
+      return sum + weight[s.severity] * s.confidence * decay;
+    }, 0));
+  }
+  function historyConfidenceFor(status) {
+    switch (status) {
+      case "ESTABLISHED":
+        return 90;
+      case "MODERATE":
+        return 60;
+      case "LIMITED":
+        return 25;
+      default:
+        return 5;
+    }
+  }
+  var DEFAULT_POLICY = {
+    NO_CRITICAL_RISK_DETECTED: "allow",
+    INFORMATIONAL: "inform",
+    CAUTION: "warn",
+    ELEVATED_RISK: "warn_strong",
+    HIGH_RISK: "require_confirmation",
+    CRITICAL_THREAT: "require_confirmation",
+    KNOWN_MALICIOUS: "block"
+  };
+  function applyPolicy(assessment, policy = {}) {
+    const action = policy[assessment.riskLevel] ?? DEFAULT_POLICY[assessment.riskLevel];
+    return {
+      action,
+      reason: assessment.explanation[0] ?? RISK_LEVEL_MEANING[assessment.riskLevel]
+    };
+  }
+  function unavailableAssessment(failMode, reason, now = /* @__PURE__ */ new Date()) {
+    return {
+      riskLevel: "NO_CRITICAL_RISK_DETECTED",
+      confirmedMalicious: false,
+      confidence: 0,
+      historyStatus: "NONE",
+      facts: [],
+      capabilities: [],
+      threatSignals: [],
+      unknowns: [{
+        field: "assessment",
+        reason: "PROVIDER_UNAVAILABLE",
+        statement: `Decentrys could not be reached: ${reason}. Nothing was checked.`
+      }],
+      components: { technicalRisk: 0, behavioralRisk: 0, threatIntelligenceRisk: 0, historyConfidence: 0 },
+      explanation: [
+        `Decentrys could not be reached: ${reason}.`,
+        failMode === "closed" ? "This deployment is configured to refuse unverified transactions." : failMode === "warn" ? "No security check was performed. Proceed with the care you would use without any tool." : "No security check was performed."
+      ],
+      modelVersion: PROTECT_MODEL_VERSION,
+      assessedAt: now.toISOString()
+    };
+  }
+  var COVERAGE_SIGNAL_TYPES = /* @__PURE__ */ new Set([
+    "NEW_ADDRESS",
+    "NEW_CONTRACT",
+    "NEW_DEPLOYMENT",
+    "LOW_ACTIVITY",
+    "LIMITED_HISTORY",
+    "NO_HISTORY",
+    "ESTABLISHED_HISTORY",
+    "UNVERIFIED_SOURCE",
+    "UNVERIFIED_CONTRACT",
+    "NO_AUDIT",
+    "UNAUDITED",
+    "ANONYMOUS_DEPLOYER",
+    "ANONYMOUS_TEAM",
+    "UNKNOWN_DEPLOYER",
+    "LOW_LIQUIDITY",
+    "THIN_LIQUIDITY",
+    "SMALL_MARKET_CAP",
+    "HOLDER_CONCENTRATION",
+    "LOW_HOLDER_COUNT",
+    "NOT_ON_TOKEN_LIST",
+    "UNKNOWN_TOKEN",
+    "NO_SOCIAL_PRESENCE"
+  ]);
+  var NO_HISTORY_TYPES = /* @__PURE__ */ new Set(["NO_HISTORY", "UNKNOWN_TOKEN"]);
+  function normalizeEvidence(raw, fallback) {
+    const body = isRecord(raw) ? raw : {};
+    const demotedSignals = [];
+    const facts = asArray(body.facts).map(toFact).filter(isPresent);
+    const capabilities = asArray(body.capabilities).map(toCapability).filter(isPresent);
+    const unknowns = asArray(body.unknowns).map(toUnknown).filter(isPresent);
+    const threatSignals = [];
+    let noHistoryObserved = false;
+    for (const item of asArray(body.threatSignals)) {
+      const signal = toSignal(item);
+      if (!signal) continue;
+      if (COVERAGE_SIGNAL_TYPES.has(signal.type)) {
+        demotedSignals.push(signal.type);
+        if (NO_HISTORY_TYPES.has(signal.type)) noHistoryObserved = true;
+        facts.push({
+          type: signal.type,
+          value: null,
+          statement: signal.explanation,
+          source: signal.evidence[0]?.source ?? "decentrys",
+          observedAt: signal.lastSeen
+        });
+        continue;
+      }
+      threatSignals.push(signal);
+    }
+    const declaredHistory = asHistoryStatus(body.historyStatus);
+    const historyStatus = declaredHistory ?? (noHistoryObserved ? "NONE" : "LIMITED");
+    return {
+      subject: toSubject(body.subject, fallback),
+      facts,
+      capabilities,
+      threatSignals,
+      unknowns,
+      historyStatus,
+      historyConfidence: asNumber(body.historyConfidence) ?? void 0,
+      producedAt: asString(body.producedAt) ?? (/* @__PURE__ */ new Date()).toISOString(),
+      demotedSignals
+    };
+  }
+  function toSubject(raw, fallback) {
+    if (!isRecord(raw)) return fallback;
+    const kind = asString(raw.kind);
+    return {
+      kind: isSubjectKind(kind) ? kind : fallback.kind,
+      chain: asString(raw.chain) ?? fallback.chain,
+      identifier: asString(raw.identifier) ?? fallback.identifier
+    };
+  }
+  function toFact(raw) {
+    if (!isRecord(raw)) return null;
+    const type = asString(raw.type);
+    const statement = asString(raw.statement);
+    if (!type || !statement) return null;
+    return {
+      type,
+      value: asFactValue(raw.value),
+      statement,
+      source: asString(raw.source) ?? "decentrys",
+      observedAt: asString(raw.observedAt) ?? (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  function toCapability(raw) {
+    if (!isRecord(raw)) return null;
+    const type = asString(raw.type);
+    const statement = asString(raw.statement);
+    if (!type || !statement) return null;
+    const severity = asString(raw.severity);
+    return {
+      type,
+      // An unrecognised severity becomes INFO, the least consequential value.
+      // Guessing upward would let a typo raise someone's risk level.
+      severity: severity === "NOTABLE" || severity === "SIGNIFICANT" ? severity : "INFO",
+      statement,
+      grantedBy: asString(raw.grantedBy) ?? void 0
+    };
+  }
+  function toSignal(raw) {
+    if (!isRecord(raw)) return null;
+    const type = asString(raw.type);
+    const explanation = asString(raw.explanation);
+    if (!type || !explanation) return null;
+    const evidence = asArray(raw.evidence).map(toEvidence).filter(isPresent);
+    const createdAt = asString(raw.createdAt) ?? (/* @__PURE__ */ new Date()).toISOString();
+    return {
+      type,
+      severity: asSeverity(raw.severity),
+      confidence: clamp01(asNumber(raw.confidence) ?? 0),
+      explanation,
+      // A missing hop count means we do not know how far away this is, and an
+      // unknown distance is an inference, not a direct observation.
+      hops: Math.max(0, Math.trunc(asNumber(raw.hops) ?? 1)),
+      evidence,
+      status: asSignalStatus(raw.status),
+      createdAt,
+      lastSeen: asString(raw.lastSeen) ?? createdAt,
+      expiresAt: asString(raw.expiresAt) ?? void 0
+    };
+  }
+  function toEvidence(raw) {
+    if (!isRecord(raw)) return null;
+    const id = asString(raw.id);
+    const type = asString(raw.type);
+    if (!id || !type) return null;
+    return {
+      id,
+      type,
+      source: asString(raw.source) ?? "decentrys",
+      chain: asString(raw.chain) ?? void 0,
+      txHash: asString(raw.txHash) ?? void 0,
+      contract: asString(raw.contract) ?? void 0,
+      address: asString(raw.address) ?? void 0,
+      observedAt: asString(raw.observedAt) ?? (/* @__PURE__ */ new Date()).toISOString(),
+      confidence: clamp01(asNumber(raw.confidence) ?? 0),
+      // Defaults to false. `analystVerified` is what gates KNOWN_MALICIOUS, so
+      // an absent field must never be read as a human having checked.
+      analystVerified: raw.analystVerified === true,
+      metadata: isRecord(raw.metadata) ? raw.metadata : void 0
+    };
+  }
+  function toUnknown(raw) {
+    if (!isRecord(raw)) return null;
+    const field = asString(raw.field);
+    const statement = asString(raw.statement);
+    if (!field || !statement) return null;
+    const reason = asString(raw.reason);
+    const reasons = ["UNKNOWN", "INSUFFICIENT_DATA", "PROVIDER_UNAVAILABLE", "NOT_APPLICABLE"];
+    return {
+      field,
+      reason: reasons.includes(reason) ? reason : "UNKNOWN",
+      statement
+    };
+  }
+  function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+  }
+  function asArray(value) {
+    return Array.isArray(value) ? value : [];
+  }
+  function asString(value) {
+    return typeof value === "string" && value.length > 0 ? value : null;
+  }
+  function asNumber(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : null;
+  }
+  function asFactValue(value) {
+    if (typeof value === "string" || typeof value === "boolean") return value;
+    if (typeof value === "number" && Number.isFinite(value)) return value;
+    return null;
+  }
+  function asSeverity(value) {
+    const severities = ["LOW", "MEDIUM", "HIGH", "CRITICAL"];
+    return severities.includes(value) ? value : "LOW";
+  }
+  function asSignalStatus(value) {
+    const statuses = ["ACTIVE", "STALE", "RESOLVED", "DISPUTED_FACT", "REMOVED"];
+    return statuses.includes(value) ? value : "ACTIVE";
+  }
+  function asHistoryStatus(value) {
+    const statuses = ["ESTABLISHED", "MODERATE", "LIMITED", "NONE"];
+    return statuses.includes(value) ? value : null;
+  }
+  function isSubjectKind(value) {
+    return value === "address" || value === "contract" || value === "token" || value === "transaction" || value === "approval" || value === "dapp";
+  }
+  function clamp01(value) {
+    return Math.min(1, Math.max(0, value));
+  }
+  function isPresent(value) {
+    return value !== null;
+  }
+  function unavailableSimulation(reason, now = /* @__PURE__ */ new Date()) {
+    return {
+      outcome: "UNAVAILABLE",
+      balanceChanges: [],
+      approvalChanges: [],
+      contractsCalled: [],
+      unavailableReason: reason,
+      simulatedAt: now.toISOString()
+    };
+  }
+  var TransportError = class extends Error {
+    failure;
+    status;
+    constructor(failure, message, status) {
+      super(message);
+      this.name = "TransportError";
+      this.failure = failure;
+      this.status = status;
+    }
+  };
+  function failureForStatus(status) {
+    if (status === 401) return "unauthorized";
+    if (status === 403) return "forbidden";
+    if (status === 429) return "rate_limited";
+    if (status >= 400 && status < 500) return "invalid_request";
+    return "server_error";
+  }
+  var RETRYABLE = ["network", "timeout", "server_error", "rate_limited"];
+  var HttpTransport = class {
+    constructor(config) {
+      this.config = config;
+    }
+    config;
+    async request(options) {
+      const attempts = options.idempotent ? this.config.retries + 1 : 1;
+      let last = new TransportError("network", "No attempt was made.");
+      for (let attempt = 0; attempt < attempts; attempt += 1) {
+        try {
+          return await this.attempt(options);
+        } catch (error) {
+          last = error instanceof TransportError ? error : new TransportError("network", error instanceof Error ? error.message : "Unknown error.");
+          if (!RETRYABLE.includes(last.failure)) throw last;
+          if (attempt === attempts - 1) throw last;
+          await delay(120 * (attempt + 1));
+        }
+      }
+      throw last;
+    }
+    async attempt(options) {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), this.config.timeoutMs);
+      const onAbort = () => controller.abort();
+      options.signal?.addEventListener("abort", onAbort);
+      try {
+        const response = await this.config.fetch(joinUrl(this.config.baseUrl, options.path), {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            "x-api-key": this.config.apiKey,
+            "user-agent": this.config.userAgent
+          },
+          body: JSON.stringify(options.body ?? {}),
+          signal: controller.signal
+        });
+        const text = await response.text();
+        if (!response.ok) {
+          throw new TransportError(
+            failureForStatus(response.status),
+            messageFrom(text) ?? `Decentrys returned HTTP ${response.status}.`,
+            response.status
+          );
+        }
+        let parsed;
+        try {
+          parsed = JSON.parse(text);
+        } catch {
+          throw new TransportError("malformed_response", "The response was not valid JSON.");
+        }
+        const envelope = parsed;
+        return envelope && typeof envelope === "object" && "data" in envelope ? envelope.data : parsed;
+      } catch (error) {
+        if (error instanceof TransportError) throw error;
+        if (isAbort(error)) {
+          throw options.signal?.aborted ? new TransportError("network", "The request was cancelled by the caller.") : new TransportError("timeout", `No response within ${this.config.timeoutMs}ms.`);
+        }
+        throw new TransportError("network", error instanceof Error ? error.message : "Network request failed.");
+      } finally {
+        clearTimeout(timer);
+        options.signal?.removeEventListener("abort", onAbort);
+      }
+    }
+  };
+  function isAbort(error) {
+    return typeof error === "object" && error !== null && (error.name === "AbortError" || error.code === "ABORT_ERR");
+  }
+  function messageFrom(text) {
+    try {
+      const body = JSON.parse(text);
+      if (typeof body.message === "string" && body.message.trim()) return body.message;
+      if (typeof body.error === "string" && body.error.trim()) return body.error;
+    } catch {
+    }
+    return null;
+  }
+  function joinUrl(base, path) {
+    return `${base.replace(/\/+$/, "")}/${path.replace(/^\/+/, "")}`;
+  }
+  function delay(ms) {
+    return new Promise((resolve) => {
+      setTimeout(resolve, ms);
+    });
+  }
+  var TtlCache = class {
+    constructor(options) {
+      this.options = options;
+      this.now = options.now ?? (() => Date.now());
+    }
+    options;
+    entries = /* @__PURE__ */ new Map();
+    now;
+    get(key) {
+      const entry = this.entries.get(key);
+      if (!entry) return void 0;
+      if (entry.expiresAt <= this.now()) {
+        this.entries.delete(key);
+        return void 0;
+      }
+      this.entries.delete(key);
+      this.entries.set(key, entry);
+      return entry.value;
+    }
+    set(key, value, ttlMs = this.options.ttlMs) {
+      if (ttlMs <= 0 || this.options.maxEntries <= 0) return;
+      this.entries.delete(key);
+      this.entries.set(key, { value, expiresAt: this.now() + ttlMs });
+      while (this.entries.size > this.options.maxEntries) {
+        const oldest = this.entries.keys().next();
+        if (oldest.done) break;
+        this.entries.delete(oldest.value);
+      }
+    }
+    delete(key) {
+      this.entries.delete(key);
+    }
+    clear() {
+      this.entries.clear();
+    }
+    get size() {
+      return this.entries.size;
+    }
+  };
+  function cacheKey(kind, parts) {
+    return [kind, ...parts.map((p) => p === void 0 || p === null ? "" : String(p))].join("|");
+  }
+  var SDK_VERSION = "0.1.0";
+  var DEFAULT_BASE_URL = "https://api.decentrys.com";
+  var DEFAULT_TIMEOUT_MS = 4e3;
+  var DEFAULT_CACHE_TTL_MS = 12e4;
+  var DEFAULT_CACHE_ENTRIES = 500;
+  var Decentrys = class {
+    transport;
+    failMode;
+    policy;
+    cache;
+    constructor(config) {
+      if (!config.apiKey || !config.apiKey.trim()) {
+        throw new Error("Decentrys: an apiKey is required. Create one at https://decentrys.com/developers.");
+      }
+      this.failMode = config.failMode ?? "warn";
+      this.policy = config.policy ?? {};
+      this.cache = new TtlCache({
+        ttlMs: config.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS,
+        maxEntries: config.cacheMaxEntries ?? DEFAULT_CACHE_ENTRIES
+      });
+      this.transport = config.transport ?? new HttpTransport({
+        baseUrl: config.baseUrl ?? DEFAULT_BASE_URL,
+        apiKey: config.apiKey,
+        timeoutMs: config.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+        retries: config.retries ?? 1,
+        fetch: config.fetch ?? resolveFetch(),
+        userAgent: `decentrys-protect/${SDK_VERSION}`
+      });
+    }
+    // -------------------------------------------------------------------------
+    // Assessments
+    // -------------------------------------------------------------------------
+    /** Pre-sign analysis of a transaction the user is about to approve. */
+    async assessTransaction(tx, options = {}) {
+      return this.assess({
+        path: "/v1/protect/transaction",
+        body: tx,
+        subject: { kind: "transaction", chain: tx.chain, identifier: tx.to ?? tx.from },
+        // A transaction's assessment depends on its calldata and its moment.
+        // Caching one would serve a stale answer for a different transaction.
+        cacheable: false,
+        idempotent: true,
+        options
+      });
+    }
+    /** What a contract *can* do — capabilities, proxy status, admin controls. */
+    async scanContract(request, options = {}) {
+      return this.assess({
+        path: "/v1/protect/contract",
+        body: request,
+        subject: { kind: "contract", chain: request.chain, identifier: request.address },
+        cacheable: true,
+        idempotent: true,
+        options
+      });
+    }
+    async screenAddress(request, options = {}) {
+      return this.assess({
+        path: "/v1/protect/address",
+        body: request,
+        subject: { kind: "address", chain: request.chain, identifier: request.address },
+        cacheable: true,
+        idempotent: true,
+        options
+      });
+    }
+    async screenToken(request, options = {}) {
+      return this.assess({
+        path: "/v1/protect/token",
+        body: request,
+        subject: { kind: "token", chain: request.chain, identifier: request.address },
+        cacheable: true,
+        idempotent: true,
+        options
+      });
+    }
+    /**
+     * An approval is assessed on the spender and the allowance together.
+     *
+     * Not cached: the same spender with an unlimited allowance and with a
+     * one-off allowance are different decisions, and the amount is the part a
+     * user most needs told.
+     */
+    async screenApproval(request, options = {}) {
+      return this.assess({
+        path: "/v1/protect/approval",
+        body: request,
+        subject: { kind: "approval", chain: request.chain, identifier: request.spender },
+        cacheable: false,
+        idempotent: true,
+        options
+      });
+    }
+    async assessDapp(request, options = {}) {
+      return this.assess({
+        path: "/v1/protect/dapp",
+        body: request,
+        subject: { kind: "dapp", chain: request.chain ?? "multi", identifier: request.origin },
+        cacheable: true,
+        idempotent: true,
+        options
+      });
+    }
+    /**
+     * The threat signals on a subject, without a classification.
+     *
+     * For integrators building their own presentation. An empty array means no
+     * signals were found — which is not the same as safe, and the SDK will not
+     * pretend otherwise on their behalf.
+     */
+    async getThreatSignals(request, options = {}) {
+      try {
+        const raw = await this.transport.request({
+          path: "/v1/protect/signals",
+          body: request,
+          idempotent: true,
+          signal: options.signal
+        });
+        return normalizeEvidence(raw, {
+          kind: "address",
+          chain: request.chain,
+          identifier: request.address
+        }).threatSignals;
+      } catch {
+        return [];
+      }
+    }
+    // -------------------------------------------------------------------------
+    // Decoding and simulation
+    // -------------------------------------------------------------------------
+    /** What this transaction does, in the words a user would use. */
+    async explainTransaction(tx, options = {}) {
+      try {
+        const raw = await this.transport.request({
+          path: "/v1/protect/explain",
+          body: tx,
+          idempotent: true,
+          signal: options.signal
+        });
+        return {
+          summary: typeof raw?.summary === "string" && raw.summary ? raw.summary : "This transaction could not be decoded.",
+          actions: stringList(raw?.actions),
+          exposure: stringList(raw?.exposure),
+          undecoded: stringList(raw?.undecoded)
+        };
+      } catch (error) {
+        return {
+          summary: "This transaction could not be decoded.",
+          actions: [],
+          exposure: [],
+          undecoded: [`Decentrys could not be reached: ${describe(error)}.`]
+        };
+      }
+    }
+    /** Execute the transaction against a fork and report what would change. */
+    async simulateTransaction(tx, options = {}) {
+      try {
+        const raw = await this.transport.request({
+          path: "/v1/protect/simulate",
+          body: tx,
+          idempotent: true,
+          signal: options.signal
+        });
+        return normalizeSimulation(raw);
+      } catch (error) {
+        return unavailableSimulation(describe(error));
+      }
+    }
+    // -------------------------------------------------------------------------
+    // Cache control
+    // -------------------------------------------------------------------------
+    /** Drop cached evidence. Call after a user reports a stale result. */
+    clearCache() {
+      this.cache.clear();
+    }
+    // -------------------------------------------------------------------------
+    // Internals
+    // -------------------------------------------------------------------------
+    async assess(params) {
+      const key = params.cacheable ? cacheKey(params.subject.kind, [params.subject.chain, params.subject.identifier]) : null;
+      if (key && !params.options.skipCache) {
+        const hit = this.cache.get(key);
+        if (hit) return this.finish(hit, true);
+      }
+      let evidence;
+      try {
+        const raw = await this.transport.request({
+          path: params.path,
+          body: params.body,
+          idempotent: params.idempotent,
+          signal: params.options.signal
+        });
+        evidence = normalizeEvidence(raw, params.subject);
+      } catch (error) {
+        return {
+          subject: params.subject,
+          assessment: unavailableAssessment(this.failMode, describe(error)),
+          decision: {
+            // `closed` is the only mode where unavailability is itself a stop.
+            // The others must not fabricate a risk level to justify blocking.
+            action: this.failMode === "closed" ? "block" : "warn",
+            reason: `Decentrys could not be reached: ${describe(error)}.`
+          },
+          cached: false,
+          demotedSignals: []
+        };
+      }
+      if (key) this.cache.set(key, evidence);
+      return this.finish(evidence, false);
+    }
+    finish(evidence, cached) {
+      const assessment = classify({
+        facts: evidence.facts,
+        capabilities: evidence.capabilities,
+        threatSignals: evidence.threatSignals,
+        unknowns: evidence.unknowns,
+        historyStatus: evidence.historyStatus,
+        historyConfidence: evidence.historyConfidence
+      });
+      return {
+        subject: evidence.subject,
+        assessment,
+        decision: applyPolicy(assessment, this.policy),
+        cached,
+        demotedSignals: evidence.demotedSignals
+      };
+    }
+  };
+  function resolveFetch() {
+    const candidate = globalThis.fetch;
+    if (typeof candidate !== "function") {
+      throw new Error(
+        "Decentrys: no global fetch was found. Pass one via `new Decentrys({ fetch })` (Node 18+, modern browsers and React Native provide one)."
+      );
+    }
+    return candidate.bind(globalThis);
+  }
+  function describe(error) {
+    if (error instanceof TransportError) return error.message;
+    if (error instanceof Error) return error.message;
+    return "unknown error";
+  }
+  function stringList(value) {
+    return Array.isArray(value) ? value.filter((v) => typeof v === "string" && v.length > 0) : [];
+  }
+  function normalizeSimulation(raw) {
+    const body = typeof raw === "object" && raw !== null ? raw : {};
+    const outcomes = ["SUCCESS", "REVERT", "NOT_SUPPORTED", "UNAVAILABLE"];
+    return {
+      // An unrecognised outcome is not a success. Defaulting the other way would
+      // let a malformed response read as "this transaction is fine".
+      outcome: outcomes.includes(body.outcome) ? body.outcome : "UNAVAILABLE",
+      revertReason: typeof body.revertReason === "string" ? body.revertReason : void 0,
+      balanceChanges: Array.isArray(body.balanceChanges) ? body.balanceChanges : [],
+      approvalChanges: Array.isArray(body.approvalChanges) ? body.approvalChanges : [],
+      contractsCalled: stringList(body.contractsCalled),
+      gasUsed: typeof body.gasUsed === "string" ? body.gasUsed : void 0,
+      unavailableReason: typeof body.unavailableReason === "string" ? body.unavailableReason : void 0,
+      simulatedAt: typeof body.simulatedAt === "string" ? body.simulatedAt : (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+
+  // src/policy.ts
+  var DEFAULT_AGENT_RISK_POLICY = {
+    NO_CRITICAL_RISK_DETECTED: "allow",
+    INFORMATIONAL: "allow",
+    CAUTION: "allow",
+    ELEVATED_RISK: "require_confirmation",
+    HIGH_RISK: "require_confirmation",
+    CRITICAL_THREAT: "require_confirmation",
+    KNOWN_MALICIOUS: "block"
+  };
+  var UNLIMITED_ALLOWANCE_THRESHOLD = 1n << 255n;
+  var POLICY_ACTION_STRICTNESS = {
+    allow: 0,
+    inform: 1,
+    warn: 2,
+    warn_strong: 3,
+    require_confirmation: 4,
+    block: 5
+  };
+  var FAIL_MODE_STRICTNESS = { open: 0, escalate: 1, closed: 2 };
+  var SEALED_POLICY = /* @__PURE__ */ Symbol("decentrys.agent.sealedPolicy");
+  function sealPolicy(policy) {
+    const risk = policy.risk ?? {};
+    for (const [level, action] of Object.entries(risk)) {
+      if (action === "warn" || action === "warn_strong") {
+        throw new Error(
+          `AgentGuard: '${action}' is not a valid action for an agent policy (at ${level}). There is nobody to warn. Use 'allow' to permit and record it, or 'require_confirmation' to route it to a person.`
+        );
+      }
+    }
+    const cloned = clonePolicy(policy);
+    const warnings = [];
+    const effectiveRisk = { ...DEFAULT_AGENT_RISK_POLICY, ...cloned.risk };
+    if (effectiveRisk.KNOWN_MALICIOUS !== "block") {
+      warnings.push(
+        "This policy does not deny KNOWN_MALICIOUS counterparties. That level requires analyst-verified evidence and is the one classification Decentrys treats as an accusation."
+      );
+    }
+    if (!hasAnyLimit(cloned)) {
+      warnings.push(
+        "This policy sets no value cap, no cumulative window, no allowlist and no rate ceiling. The agent is bounded only by risk classification."
+      );
+    }
+    return deepFreeze({
+      [SEALED_POLICY]: true,
+      policy: cloned,
+      fingerprint: fingerprint(cloned),
+      warnings
+    });
+  }
+  function narrowPolicy(base, restriction) {
+    const a = base.policy;
+    const b = clonePolicy(restriction);
+    if (a.agentId && b.agentId && a.agentId !== b.agentId) {
+      throw new Error(
+        `AgentGuard: cannot narrow a policy bound to agent '${a.agentId}' with one bound to '${b.agentId}'.`
+      );
+    }
+    return sealPolicy({
+      version: [a.version, b.version].filter(Boolean).join("+") || void 0,
+      agentId: a.agentId ?? b.agentId,
+      risk: strictestRisk(a.risk, b.risk),
+      maxRiskLevel: lowerRiskLevel(a.maxRiskLevel, b.maxRiskLevel),
+      maxValuePerActionUsd: minDefined(a.maxValuePerActionUsd, b.maxValuePerActionUsd),
+      spendWindows: concatWindows(a.spendWindows, b.spendWindows),
+      rateWindows: concatWindows(a.rateWindows, b.rateWindows),
+      allowedCounterparties: intersectLists(a.allowedCounterparties, b.allowedCounterparties),
+      blockedCounterparties: unionLists(a.blockedCounterparties, b.blockedCounterparties),
+      allowedContracts: intersectLists(a.allowedContracts, b.allowedContracts),
+      allowedTokens: intersectLists(a.allowedTokens, b.allowedTokens),
+      allowedActions: intersectLists(a.allowedActions, b.allowedActions),
+      deniedActions: unionLists(a.deniedActions, b.deniedActions),
+      allowedChains: intersectLists(a.allowedChains, b.allowedChains),
+      allowUnlimitedApprovals: (a.allowUnlimitedApprovals ?? false) && (b.allowUnlimitedApprovals ?? false),
+      humanApprovalAboveUsd: minDefined(a.humanApprovalAboveUsd, b.humanApprovalAboveUsd),
+      humanApprovalAtRiskLevel: lowerRiskLevel(a.humanApprovalAtRiskLevel, b.humanApprovalAtRiskLevel),
+      failMode: stricterFailMode(a.failMode, b.failMode)
+    });
+  }
+  function evaluatePolicy(input) {
+    const now = input.now ?? /* @__PURE__ */ new Date();
+    const nowMs = now.getTime();
+    const { action } = input;
+    const policy = input.policy.policy;
+    const evaluations = [];
+    if (policy.agentId) {
+      const bound = policy.agentId === action.agentId;
+      evaluations.push({
+        rule: "AGENT_BINDING",
+        outcome: bound ? "pass" : "fail",
+        statement: bound ? `This policy is bound to agent '${policy.agentId}', which proposed the action.` : `This policy is bound to agent '${policy.agentId}'; the action was proposed by '${action.agentId}'.`,
+        limit: policy.agentId,
+        observed: action.agentId
+      });
+    } else {
+      evaluations.push({
+        rule: "AGENT_BINDING",
+        outcome: "not_configured",
+        statement: "This policy is not bound to a specific agent."
+      });
+    }
+    evaluations.push(evaluateActionType(action.type, policy.allowedActions, policy.deniedActions));
+    evaluations.push(evaluateAllowlist(
+      "CHAIN",
+      "chain",
+      action.chain,
+      policy.allowedChains
+    ));
+    evaluations.push(evaluateCounterparty(action, policy));
+    evaluations.push(evaluateContract(action, policy));
+    evaluations.push(evaluateAllowlist("TOKEN", "token", action.token, policy.allowedTokens));
+    evaluations.push(evaluateAllowance(action, policy.allowUnlimitedApprovals ?? false));
+    evaluations.push(evaluatePerActionValue(action, policy.maxValuePerActionUsd));
+    evaluations.push(evaluateCumulativeSpend(action, policy.spendWindows, input.usage, nowMs));
+    evaluations.push(evaluateRate(action, policy.rateWindows, input.usage, nowMs));
+    const effectiveRisk = { ...DEFAULT_AGENT_RISK_POLICY, ...policy.risk };
+    evaluations.push(evaluateAvailability(input.assessment, input.assessmentUnavailable, policy.failMode ?? "escalate"));
+    evaluations.push(evaluateRisk(input.assessment, effectiveRisk, policy.maxRiskLevel));
+    evaluations.push(evaluateHumanApproval(action, policy, input.assessment));
+    const verdict = verdictFrom(evaluations);
+    const reasons = evaluations.filter((e) => e.outcome === "fail" || e.outcome === "escalate").map((e) => e.statement);
+    return {
+      decisionId: input.decisionId ?? newDecisionId(),
+      agentId: action.agentId,
+      verdict,
+      reasons,
+      evaluations,
+      ...input.assessment ? { assessment: input.assessment } : {},
+      ...input.assessmentUnavailable ? { assessmentUnavailable: input.assessmentUnavailable } : {},
+      policyFingerprint: input.policy.fingerprint,
+      ...policy.version ? { policyVersion: policy.version } : {},
+      actionDigest: fingerprint(canonicalAction(action)),
+      modelVersion: AGENT_MODEL_VERSION,
+      decidedAt: now.toISOString()
+    };
+  }
+  function verdictFrom(evaluations) {
+    if (evaluations.some((e) => e.outcome === "fail")) return "deny";
+    if (evaluations.some((e) => e.outcome === "escalate")) return "require_human_approval";
+    return "allow";
+  }
+  function evaluateActionType(type, allowed, denied) {
+    if (denied?.includes(type)) {
+      return {
+        rule: "ACTION_TYPE",
+        outcome: "fail",
+        statement: `Actions of type '${type}' are denied by this policy.`,
+        limit: `denied: ${denied.join(", ")}`,
+        observed: type
+      };
+    }
+    if (allowed) {
+      const ok = allowed.includes(type);
+      return {
+        rule: "ACTION_TYPE",
+        outcome: ok ? "pass" : "fail",
+        statement: ok ? `'${type}' is one of the action types this agent may perform.` : `'${type}' is not among the action types this agent may perform.`,
+        limit: allowed.join(", "),
+        observed: type
+      };
+    }
+    return {
+      rule: "ACTION_TYPE",
+      outcome: "not_configured",
+      statement: "This policy does not restrict which action types the agent may perform.",
+      observed: type
+    };
+  }
+  function evaluateAllowlist(rule, label, value, allowed) {
+    if (!allowed) {
+      return {
+        rule,
+        outcome: "not_configured",
+        statement: `This policy does not restrict the ${label}.`,
+        ...value === void 0 ? {} : { observed: value }
+      };
+    }
+    if (value === void 0) {
+      return {
+        rule,
+        outcome: "not_applicable",
+        statement: `The action carries no ${label}, so the ${label} allowlist does not apply.`,
+        limit: allowed.join(", ")
+      };
+    }
+    const ok = matchesList(value, allowed);
+    return {
+      rule,
+      outcome: ok ? "pass" : "fail",
+      statement: ok ? `The ${label} '${value}' is on the allowlist.` : `The ${label} '${value}' is not on the allowlist.`,
+      limit: allowed.join(", "),
+      observed: value
+    };
+  }
+  var CODE_ADDRESSED = ["contract_call", "approve", "swap", "bridge", "stake", "unstake"];
+  function evaluateCounterparty(action, policy) {
+    const to = action.to;
+    const blocked = policy.blockedCounterparties;
+    const allowed = policy.allowedCounterparties;
+    if (to && blocked && matchesList(to, blocked)) {
+      return {
+        rule: "COUNTERPARTY",
+        outcome: "fail",
+        statement: `The counterparty ${to} is on this policy's blocklist.`,
+        limit: "blocklist",
+        observed: to
+      };
+    }
+    if (!allowed) {
+      return {
+        rule: "COUNTERPARTY",
+        outcome: blocked && blocked.length > 0 ? "pass" : "not_configured",
+        statement: blocked && blocked.length > 0 ? `The counterparty ${to ?? "(none)"} is not on this policy's blocklist.` : "This policy does not restrict counterparties.",
+        ...to === void 0 ? {} : { observed: to }
+      };
+    }
+    if (!to) {
+      return {
+        rule: "COUNTERPARTY",
+        outcome: "fail",
+        statement: "This policy allowlists counterparties, and the action names none. An action with no identifiable recipient cannot be checked against an allowlist.",
+        limit: `${allowed.length} allowlisted`
+      };
+    }
+    const ok = matchesList(to, allowed);
+    return {
+      rule: "COUNTERPARTY",
+      outcome: ok ? "pass" : "fail",
+      statement: ok ? `The counterparty ${to} is on this policy's allowlist.` : `The counterparty ${to} is not on this policy's allowlist.`,
+      limit: `${allowed.length} allowlisted`,
+      observed: to
+    };
+  }
+  function evaluateContract(action, policy) {
+    const allowed = policy.allowedContracts;
+    if (!allowed) {
+      return {
+        rule: "CONTRACT",
+        outcome: "not_configured",
+        statement: "This policy does not restrict which contracts the agent may call."
+      };
+    }
+    if (!CODE_ADDRESSED.includes(action.type)) {
+      return {
+        rule: "CONTRACT",
+        outcome: "not_applicable",
+        statement: `A '${action.type}' action does not call a contract, so the contract allowlist does not apply.`,
+        limit: `${allowed.length} allowlisted`
+      };
+    }
+    if (!action.to) {
+      return {
+        rule: "CONTRACT",
+        outcome: "fail",
+        statement: `A '${action.type}' action must name the contract it calls for the allowlist to be applied.`,
+        limit: `${allowed.length} allowlisted`
+      };
+    }
+    const ok = matchesList(action.to, allowed);
+    return {
+      rule: "CONTRACT",
+      outcome: ok ? "pass" : "fail",
+      statement: ok ? `The contract ${action.to} is on this policy's allowlist.` : `The contract ${action.to} is not on this policy's allowlist.`,
+      limit: `${allowed.length} allowlisted`,
+      observed: action.to
+    };
+  }
+  function evaluateAllowance(action, allowUnlimited) {
+    if (action.type !== "approve") {
+      return {
+        rule: "APPROVAL_ALLOWANCE",
+        outcome: "not_applicable",
+        statement: `A '${action.type}' action grants no allowance.`
+      };
+    }
+    const amount = action.approvalAmount;
+    if (amount === void 0) {
+      return {
+        rule: "APPROVAL_ALLOWANCE",
+        outcome: "fail",
+        statement: "An approval was proposed without stating the allowance. The size of an allowance is the whole of what is being granted, and an unstated one cannot be bounded."
+      };
+    }
+    const unlimited = isUnlimitedAllowance(amount);
+    if (!unlimited) {
+      return {
+        rule: "APPROVAL_ALLOWANCE",
+        outcome: "pass",
+        statement: `The approval grants a bounded allowance of ${amount} base units.`,
+        observed: amount
+      };
+    }
+    return {
+      rule: "APPROVAL_ALLOWANCE",
+      outcome: allowUnlimited ? "pass" : "fail",
+      statement: allowUnlimited ? "The approval is unlimited, which this policy explicitly permits." : "The approval grants an unlimited allowance. This policy does not permit one \u2014 an unlimited allowance turns any later compromise of the spender into an unbounded loss.",
+      limit: allowUnlimited ? "unlimited permitted" : "bounded allowances only",
+      observed: "unlimited"
+    };
+  }
+  function isUnlimitedAllowance(amount) {
+    const trimmed = amount.trim();
+    if (/^unlimited$/i.test(trimmed) || /^max$/i.test(trimmed) || /^infinite$/i.test(trimmed)) return true;
+    try {
+      const parsed = /^0x[0-9a-f]+$/i.test(trimmed) ? BigInt(trimmed) : BigInt(trimmed.replace(/^\+/, ""));
+      return parsed >= UNLIMITED_ALLOWANCE_THRESHOLD;
+    } catch {
+      return false;
+    }
+  }
+  function evaluatePerActionValue(action, cap) {
+    if (cap === void 0) {
+      return {
+        rule: "VALUE_PER_ACTION",
+        outcome: "not_configured",
+        statement: "This policy sets no per-action value cap.",
+        ...action.valueUsd === void 0 ? {} : { observed: action.valueUsd }
+      };
+    }
+    if (action.valueUsd === void 0) {
+      return {
+        rule: "VALUE_PER_ACTION",
+        outcome: "fail",
+        statement: `This policy caps a single action at $${cap.toLocaleString("en-US")}, and the action's value was not stated. An unpriced action cannot be shown to be under a cap. Pass \`valueUsd\` \u2014 use 0 for an action that moves nothing.`,
+        limit: cap,
+        observed: "unknown"
+      };
+    }
+    const ok = action.valueUsd <= cap;
+    return {
+      rule: "VALUE_PER_ACTION",
+      outcome: ok ? "pass" : "fail",
+      statement: ok ? `$${action.valueUsd.toLocaleString("en-US")} is within the $${cap.toLocaleString("en-US")} per-action cap.` : `$${action.valueUsd.toLocaleString("en-US")} exceeds the $${cap.toLocaleString("en-US")} per-action cap.`,
+      limit: cap,
+      observed: action.valueUsd
+    };
+  }
+  function evaluateCumulativeSpend(action, windows, usage, nowMs) {
+    if (!windows || windows.length === 0) {
+      return {
+        rule: "CUMULATIVE_SPEND",
+        outcome: "not_configured",
+        statement: "This policy sets no cumulative spend limit."
+      };
+    }
+    if (action.valueUsd === void 0) {
+      return {
+        rule: "CUMULATIVE_SPEND",
+        outcome: "fail",
+        statement: "This policy limits cumulative spend, and the action's value was not stated. An unpriced action cannot be added to a running total.",
+        limit: windows.map(describeSpendWindow).join("; "),
+        observed: "unknown"
+      };
+    }
+    const breached = [];
+    const lines = [];
+    for (const window of windows) {
+      const spent = usage?.spentUsdSince(action.agentId, nowMs - window.windowMs) ?? 0;
+      const projected = spent + action.valueUsd;
+      lines.push(
+        `${window.label}: $${round2(spent).toLocaleString("en-US")} committed, $${round2(projected).toLocaleString("en-US")} with this action, against $${window.maxValueUsd.toLocaleString("en-US")}`
+      );
+      if (projected > window.maxValueUsd) breached.push(window.label);
+    }
+    return {
+      rule: "CUMULATIVE_SPEND",
+      outcome: breached.length > 0 ? "fail" : "pass",
+      statement: breached.length > 0 ? `This action would take the agent past its ${breached.join(" and ")} spend limit. ${lines.join("; ")}.` : `Within every cumulative spend limit. ${lines.join("; ")}.`,
+      limit: windows.map(describeSpendWindow).join("; "),
+      observed: action.valueUsd
+    };
+  }
+  function evaluateRate(action, windows, usage, nowMs) {
+    if (!windows || windows.length === 0) {
+      return {
+        rule: "RATE_LIMIT",
+        outcome: "not_configured",
+        statement: "This policy sets no rate ceiling. An agent in a loop is bounded only by its value limits."
+      };
+    }
+    const breached = [];
+    const lines = [];
+    for (const window of windows) {
+      const admitted = usage?.actionsSince(action.agentId, nowMs - window.windowMs) ?? 0;
+      lines.push(`${window.label}: ${admitted} admitted, ${admitted + 1} with this action, against ${window.maxActions}`);
+      if (admitted + 1 > window.maxActions) breached.push(window.label);
+    }
+    return {
+      rule: "RATE_LIMIT",
+      outcome: breached.length > 0 ? "fail" : "pass",
+      statement: breached.length > 0 ? `This action would exceed the agent's ${breached.join(" and ")} rate ceiling. ${lines.join("; ")}.` : `Within every rate ceiling. ${lines.join("; ")}.`,
+      limit: windows.map((w) => `${w.maxActions} per ${describeDuration(w.windowMs)} (${w.label})`).join("; ")
+    };
+  }
+  function evaluateAvailability(assessment, unavailable, failMode) {
+    if (assessment) {
+      return {
+        rule: "ASSESSMENT_AVAILABILITY",
+        outcome: "pass",
+        statement: "A Decentrys assessment was obtained for this action.",
+        observed: assessment.riskLevel
+      };
+    }
+    const why = unavailable ?? "no assessment was supplied";
+    const outcome = failMode === "closed" ? "fail" : failMode === "escalate" ? "escalate" : "pass";
+    return {
+      rule: "ASSESSMENT_AVAILABILITY",
+      outcome,
+      statement: failMode === "closed" ? `No risk assessment could be obtained (${why}), and this policy is configured to stop rather than act on unscreened actions.` : failMode === "escalate" ? `No risk assessment could be obtained (${why}). The operator's own limits still applied and still bind; only the external check is missing, so this action needs a person.` : `No risk assessment could be obtained (${why}). This policy is configured to proceed on the operator's own limits alone.`,
+      limit: `failMode: ${failMode}`,
+      observed: "unavailable"
+    };
+  }
+  function evaluateRisk(assessment, risk, maxRiskLevel) {
+    if (!assessment) {
+      return {
+        rule: "RISK_LEVEL",
+        outcome: "not_applicable",
+        statement: "No assessment was available, so no risk level was applied. See ASSESSMENT_AVAILABILITY."
+      };
+    }
+    const level = assessment.riskLevel;
+    if (maxRiskLevel && riskRank(level) > riskRank(maxRiskLevel)) {
+      return {
+        rule: "RISK_LEVEL",
+        outcome: "fail",
+        statement: `The subject classified as ${level}, above this policy's ceiling of ${maxRiskLevel}. ` + (assessment.explanation[0] ?? ""),
+        limit: maxRiskLevel,
+        observed: level
+      };
+    }
+    const decision = applyPolicy(assessment, risk);
+    const outcome = decision.action === "block" ? "fail" : decision.action === "require_confirmation" ? "escalate" : "pass";
+    const statement = decision.action === "block" ? `The subject classified as ${level} and this policy denies at that level. ${decision.reason}` : decision.action === "require_confirmation" ? `The subject classified as ${level}, which this policy routes to a person. ${decision.reason}` : `The subject classified as ${level}, which this policy permits. ${decision.reason}`;
+    return { rule: "RISK_LEVEL", outcome, statement, limit: `${level} \u2192 ${decision.action}`, observed: level };
+  }
+  function evaluateHumanApproval(action, policy, assessment) {
+    const valueThreshold = policy.humanApprovalAboveUsd;
+    const riskThreshold = policy.humanApprovalAtRiskLevel;
+    if (valueThreshold === void 0 && riskThreshold === void 0) {
+      return {
+        rule: "HUMAN_APPROVAL_THRESHOLD",
+        outcome: "not_configured",
+        statement: "This policy sets no threshold above which a person must approve."
+      };
+    }
+    const triggers = [];
+    if (valueThreshold !== void 0) {
+      if (action.valueUsd === void 0) {
+        triggers.push(
+          `a person approves anything above $${valueThreshold.toLocaleString("en-US")} and this action's value was not stated, so it cannot be shown to be below that`
+        );
+      } else if (action.valueUsd > valueThreshold) {
+        triggers.push(
+          `$${action.valueUsd.toLocaleString("en-US")} is above the $${valueThreshold.toLocaleString("en-US")} threshold for human approval`
+        );
+      }
+    }
+    if (riskThreshold && assessment && riskRank(assessment.riskLevel) >= riskRank(riskThreshold)) {
+      triggers.push(`the subject classified as ${assessment.riskLevel}, at or above the ${riskThreshold} threshold`);
+    }
+    if (triggers.length === 0) {
+      return {
+        rule: "HUMAN_APPROVAL_THRESHOLD",
+        outcome: "pass",
+        statement: "Below every threshold that would require a person to approve.",
+        ...valueThreshold === void 0 ? {} : { limit: valueThreshold },
+        ...action.valueUsd === void 0 ? {} : { observed: action.valueUsd }
+      };
+    }
+    return {
+      rule: "HUMAN_APPROVAL_THRESHOLD",
+      outcome: "escalate",
+      statement: `A person must approve this action: ${triggers.join("; ")}.`,
+      ...valueThreshold === void 0 ? {} : { limit: valueThreshold },
+      ...action.valueUsd === void 0 ? {} : { observed: action.valueUsd }
+    };
+  }
+  function riskRank(level) {
+    return RISK_LEVELS.indexOf(level);
+  }
+  function matchesList(value, list) {
+    const needle = value.trim().toLowerCase();
+    return list.some((entry) => entry.trim().toLowerCase() === needle);
+  }
+  function describeSpendWindow(window) {
+    return `$${window.maxValueUsd.toLocaleString("en-US")} per ${describeDuration(window.windowMs)} (${window.label})`;
+  }
+  function describeDuration(ms) {
+    if (ms % 864e5 === 0) return plural(ms / 864e5, "day");
+    if (ms % 36e5 === 0) return plural(ms / 36e5, "hour");
+    if (ms % 6e4 === 0) return plural(ms / 6e4, "minute");
+    if (ms % 1e3 === 0) return plural(ms / 1e3, "second");
+    return `${ms}ms`;
+  }
+  function plural(count, unit) {
+    return count === 1 ? unit : `${count} ${unit}s`;
+  }
+  function round2(value) {
+    return Math.round(value * 100) / 100;
+  }
+  function hasAnyLimit(policy) {
+    return policy.maxValuePerActionUsd !== void 0 || (policy.spendWindows?.length ?? 0) > 0 || (policy.rateWindows?.length ?? 0) > 0 || policy.allowedCounterparties !== void 0 || (policy.blockedCounterparties?.length ?? 0) > 0 || policy.allowedContracts !== void 0 || policy.allowedTokens !== void 0 || policy.allowedActions !== void 0 || (policy.deniedActions?.length ?? 0) > 0 || policy.allowedChains !== void 0 || policy.humanApprovalAboveUsd !== void 0 || policy.humanApprovalAtRiskLevel !== void 0;
+  }
+  function clonePolicy(policy) {
+    const cloned = {};
+    if (policy.version !== void 0) cloned.version = policy.version;
+    if (policy.agentId !== void 0) cloned.agentId = policy.agentId;
+    if (policy.risk !== void 0) cloned.risk = { ...policy.risk };
+    if (policy.maxRiskLevel !== void 0) cloned.maxRiskLevel = policy.maxRiskLevel;
+    if (policy.maxValuePerActionUsd !== void 0) cloned.maxValuePerActionUsd = policy.maxValuePerActionUsd;
+    if (policy.spendWindows !== void 0) cloned.spendWindows = policy.spendWindows.map((w) => ({ ...w }));
+    if (policy.rateWindows !== void 0) cloned.rateWindows = policy.rateWindows.map((w) => ({ ...w }));
+    if (policy.allowedCounterparties !== void 0) cloned.allowedCounterparties = [...policy.allowedCounterparties];
+    if (policy.blockedCounterparties !== void 0) cloned.blockedCounterparties = [...policy.blockedCounterparties];
+    if (policy.allowedContracts !== void 0) cloned.allowedContracts = [...policy.allowedContracts];
+    if (policy.allowedTokens !== void 0) cloned.allowedTokens = [...policy.allowedTokens];
+    if (policy.allowedActions !== void 0) cloned.allowedActions = [...policy.allowedActions];
+    if (policy.deniedActions !== void 0) cloned.deniedActions = [...policy.deniedActions];
+    if (policy.allowedChains !== void 0) cloned.allowedChains = [...policy.allowedChains];
+    if (policy.allowUnlimitedApprovals !== void 0) cloned.allowUnlimitedApprovals = policy.allowUnlimitedApprovals;
+    if (policy.humanApprovalAboveUsd !== void 0) cloned.humanApprovalAboveUsd = policy.humanApprovalAboveUsd;
+    if (policy.humanApprovalAtRiskLevel !== void 0) cloned.humanApprovalAtRiskLevel = policy.humanApprovalAtRiskLevel;
+    if (policy.failMode !== void 0) cloned.failMode = policy.failMode;
+    return cloned;
+  }
+  function deepFreeze(value) {
+    if (value === null || typeof value !== "object") return value;
+    for (const key of Object.getOwnPropertyNames(value)) {
+      deepFreeze(value[key]);
+    }
+    return Object.freeze(value);
+  }
+  function minDefined(a, b) {
+    if (a === void 0) return b;
+    if (b === void 0) return a;
+    return Math.min(a, b);
+  }
+  function lowerRiskLevel(a, b) {
+    if (a === void 0) return b;
+    if (b === void 0) return a;
+    return riskRank(a) <= riskRank(b) ? a : b;
+  }
+  function stricterFailMode(a, b) {
+    if (a === void 0) return b;
+    if (b === void 0) return a;
+    return FAIL_MODE_STRICTNESS[a] >= FAIL_MODE_STRICTNESS[b] ? a : b;
+  }
+  function strictestRisk(a, b) {
+    if (!a) return b;
+    if (!b) return a;
+    const merged = { ...a };
+    for (const level of RISK_LEVELS) {
+      const left = a[level];
+      const right = b[level];
+      if (left === void 0) {
+        if (right !== void 0) merged[level] = right;
+        continue;
+      }
+      if (right === void 0) continue;
+      merged[level] = POLICY_ACTION_STRICTNESS[left] >= POLICY_ACTION_STRICTNESS[right] ? left : right;
+    }
+    return merged;
+  }
+  function intersectLists(a, b) {
+    if (!a) return b ? [...b] : void 0;
+    if (!b) return [...a];
+    const right = new Set(b.map((v) => v.trim().toLowerCase()));
+    return a.filter((v) => right.has(v.trim().toLowerCase()));
+  }
+  function unionLists(a, b) {
+    if (!a && !b) return void 0;
+    const seen = /* @__PURE__ */ new Set();
+    const out = [];
+    for (const v of [...a ?? [], ...b ?? []]) {
+      const key = v.trim().toLowerCase();
+      if (seen.has(key)) continue;
+      seen.add(key);
+      out.push(v);
+    }
+    return out;
+  }
+  function concatWindows(a, b) {
+    if (!a && !b) return void 0;
+    const out = [...a ?? []];
+    for (const window of b ?? []) {
+      out.push(out.some((existing) => existing.label === window.label) ? { ...window, label: `${window.label} (narrowed)` } : window);
+    }
+    return out;
+  }
+  function canonicalAction(action) {
+    return {
+      agentId: action.agentId,
+      chain: action.chain,
+      type: action.type,
+      from: action.from,
+      to: action.to ?? null,
+      token: action.token ?? null,
+      value: action.value ?? null,
+      valueUsd: action.valueUsd ?? null,
+      data: action.data ?? null,
+      raw: action.raw ?? null,
+      origin: action.origin ?? null,
+      approvalAmount: action.approvalAmount ?? null
+    };
+  }
+  function fingerprint(value) {
+    const json = canonicalJson(value);
+    let hash = 2166136261;
+    for (let i = 0; i < json.length; i += 1) {
+      hash ^= json.charCodeAt(i);
+      hash = Math.imul(hash, 16777619) >>> 0;
+    }
+    return hash.toString(16).padStart(8, "0");
+  }
+  function canonicalJson(value) {
+    if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+    if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+    const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+  }
+  var decisionCounter = 0;
+  function newDecisionId() {
+    const webCrypto = globalThis.crypto;
+    if (typeof webCrypto?.randomUUID === "function") return `ad_${webCrypto.randomUUID()}`;
+    decisionCounter += 1;
+    return `ad_${Date.now().toString(36)}_${decisionCounter.toString(36)}`;
+  }
+
+  // src/ledger.ts
+  function isReservationLedger(usage) {
+    const candidate = usage;
+    return typeof candidate.reserve === "function" && typeof candidate.confirm === "function" && typeof candidate.release === "function";
+  }
+  var DEFAULT_RESERVATION_TTL_MS = 5 * 6e4;
+  var DEFAULT_RETENTION_MS = 8 * 24 * 60 * 6e4;
+  var DEFAULT_MAX_ENTRIES = 5e4;
+  var SpendLedger = class {
+    reservationTtlMs;
+    retentionMs;
+    maxEntries;
+    clock;
+    entries = [];
+    byDecision = /* @__PURE__ */ new Map();
+    byIdempotencyKey = /* @__PURE__ */ new Map();
+    constructor(options = {}) {
+      this.reservationTtlMs = options.reservationTtlMs ?? DEFAULT_RESERVATION_TTL_MS;
+      this.retentionMs = options.retentionMs ?? DEFAULT_RETENTION_MS;
+      this.maxEntries = options.maxEntries ?? DEFAULT_MAX_ENTRIES;
+      this.clock = options.clock ?? (() => Date.now());
+    }
+    /**
+     * Hold budget for an admitted decision.
+     *
+     * A repeated `idempotencyKey` returns the existing hold instead of taking a
+     * second one. An agent retrying a call after a timeout is one action, and
+     * counting it twice would tighten its own cap against it for no reason.
+     */
+    reserve(input) {
+      const nowMs = input.now ? input.now.getTime() : this.clock();
+      this.prune(nowMs);
+      if (input.idempotencyKey) {
+        const existing = this.byIdempotencyKey.get(this.keyFor(input.agentId, input.idempotencyKey));
+        if (existing && existing.state !== "released" && existing.state !== "expired") return existing;
+      }
+      const reservation = {
+        decisionId: input.decisionId,
+        agentId: input.agentId,
+        // A negative value would be a credit against the agent's own cap, which
+        // is a way to spend more than the cap allows. Clamped, not trusted.
+        valueUsd: Number.isFinite(input.valueUsd) ? Math.max(0, input.valueUsd) : 0,
+        ...input.idempotencyKey ? { idempotencyKey: input.idempotencyKey } : {},
+        state: "held",
+        createdAtMs: nowMs,
+        expiresAtMs: nowMs + this.reservationTtlMs
+      };
+      this.entries.push(reservation);
+      this.byDecision.set(reservation.decisionId, reservation);
+      if (input.idempotencyKey) {
+        this.byIdempotencyKey.set(this.keyFor(input.agentId, input.idempotencyKey), reservation);
+      }
+      this.enforceCeiling();
+      return reservation;
+    }
+    /** The action happened. The hold becomes a permanent commitment. */
+    confirm(decisionId, options = {}) {
+      return this.settle(decisionId, "confirmed", {
+        ...options.txHash === void 0 ? {} : { txHash: options.txHash },
+        ...options.now === void 0 ? {} : { now: options.now }
+      });
+    }
+    /** The action did not happen. The hold is returned to the budget. */
+    release(decisionId, options = {}) {
+      return this.settle(decisionId, "released", {
+        ...options.note === void 0 ? {} : { note: options.note },
+        ...options.now === void 0 ? {} : { now: options.now }
+      });
+    }
+    /**
+     * Value held or committed in the window.
+     *
+     * Released and expired holds do not count. They are actions that did not
+     * happen, and charging an agent for them would shrink a cap the operator
+     * set for real spending.
+     */
+    spentUsdSince(agentId, sinceMs) {
+      this.prune(this.clock());
+      let total = 0;
+      for (const entry of this.entries) {
+        if (entry.agentId !== agentId) continue;
+        if (entry.state === "released" || entry.state === "expired") continue;
+        if (entry.createdAtMs < sinceMs) continue;
+        total += entry.valueUsd;
+      }
+      return total;
+    }
+    /**
+     * Decisions admitted in the window — regardless of how they settled.
+     *
+     * A rate ceiling counts what the guard admitted, not what landed on chain.
+     * An agent that spins through assess-and-abandon at machine speed is exactly
+     * the loop the ceiling exists to catch, and it would be invisible to a
+     * counter that only saw confirmed transactions.
+     */
+    actionsSince(agentId, sinceMs) {
+      this.prune(this.clock());
+      let count = 0;
+      for (const entry of this.entries) {
+        if (entry.agentId !== agentId) continue;
+        if (entry.createdAtMs < sinceMs) continue;
+        count += 1;
+      }
+      return count;
+    }
+    reservation(decisionId) {
+      return this.byDecision.get(decisionId);
+    }
+    /** Snapshot for inspection. Copies, so a caller cannot edit the ledger. */
+    list(agentId) {
+      return this.entries.filter((entry) => !agentId || entry.agentId === agentId).map((entry) => ({ ...entry }));
+    }
+    clear() {
+      this.entries.length = 0;
+      this.byDecision.clear();
+      this.byIdempotencyKey.clear();
+    }
+    // -------------------------------------------------------------------------
+    settle(decisionId, state, options) {
+      const now = options.now ?? new Date(this.clock());
+      const entry = this.byDecision.get(decisionId);
+      if (!entry) return null;
+      const lapsed = entry.state === "expired";
+      entry.state = state;
+      entry.settledAtMs = now.getTime();
+      if (options.txHash !== void 0) entry.txHash = options.txHash;
+      if (options.note !== void 0) entry.note = options.note;
+      return {
+        decisionId,
+        state,
+        ...entry.txHash === void 0 ? {} : { txHash: entry.txHash },
+        ...lapsed ? { note: "The hold had already expired when this was settled; the reservation TTL may be too short." } : entry.note === void 0 ? {} : { note: entry.note },
+        at: now.toISOString()
+      };
+    }
+    prune(nowMs) {
+      for (const entry of this.entries) {
+        if (entry.state === "held" && entry.expiresAtMs <= nowMs) entry.state = "expired";
+      }
+      for (let i = this.entries.length - 1; i >= 0; i -= 1) {
+        const entry = this.entries[i];
+        if (nowMs - entry.createdAtMs <= this.retentionMs) continue;
+        this.entries.splice(i, 1);
+        this.byDecision.delete(entry.decisionId);
+        if (entry.idempotencyKey) this.byIdempotencyKey.delete(this.keyFor(entry.agentId, entry.idempotencyKey));
+      }
+    }
+    enforceCeiling() {
+      while (this.entries.length > this.maxEntries) {
+        const entry = this.entries.shift();
+        if (!entry) break;
+        this.byDecision.delete(entry.decisionId);
+        if (entry.idempotencyKey) this.byIdempotencyKey.delete(this.keyFor(entry.agentId, entry.idempotencyKey));
+      }
+    }
+    /** Idempotency keys are the caller's, so they are namespaced per agent. */
+    keyFor(agentId, idempotencyKey) {
+      return `${agentId}\0${idempotencyKey}`;
+    }
+  };
+
+  // src/explain.ts
+  var VERDICT_HEADLINE = {
+    allow: "Permitted",
+    require_human_approval: "Held for human approval",
+    deny: "Denied"
+  };
+  var REMEDIATION = {
+    AGENT_BINDING: "Use the policy sealed for this agent, or bind this policy to it.",
+    ACTION_TYPE: "Add this action type to `allowedActions`, or remove it from `deniedActions`.",
+    CHAIN: "Add this chain to `allowedChains`.",
+    COUNTERPARTY: "Add this counterparty to `allowedCounterparties`, or remove it from `blockedCounterparties`.",
+    CONTRACT: "Add this contract to `allowedContracts`.",
+    TOKEN: "Add this token to `allowedTokens`.",
+    APPROVAL_ALLOWANCE: "Have the agent request a bounded allowance, or set `allowUnlimitedApprovals` \u2014 which makes any later compromise of the spender unbounded.",
+    VALUE_PER_ACTION: "Raise `maxValuePerActionUsd`, or state the action's `valueUsd`.",
+    CUMULATIVE_SPEND: "Wait for the window to roll over, raise the window's `maxValueUsd`, or state the action's `valueUsd`.",
+    RATE_LIMIT: "Wait for the window to roll over, or raise the window's `maxActions`. A rate ceiling being hit repeatedly is usually the agent looping, not the ceiling being wrong.",
+    RISK_LEVEL: "A person should review the evidence on the decision's assessment before this is permitted.",
+    ASSESSMENT_AVAILABILITY: "Restore connectivity to Decentrys, or accept unscreened actions by setting `failMode: 'open'` \u2014 which signs during precisely the window an attacker would choose.",
+    HUMAN_APPROVAL_THRESHOLD: "A person must approve this action. Raise the threshold only if the operator intends actions of this size to proceed unattended."
+  };
+  function explainAgentAction(decision) {
+    const failing = decision.evaluations.filter((e) => e.outcome === "fail");
+    const escalating = decision.evaluations.filter((e) => e.outcome === "escalate");
+    const blocking = [...failing, ...escalating];
+    const headline = buildHeadline(decision, failing, escalating);
+    const because = blocking.map((e) => e.statement);
+    const unbounded = decision.evaluations.filter((e) => e.outcome === "not_configured").map((e) => e.statement);
+    const toProceed = [...new Set(blocking.map((e) => REMEDIATION[e.rule]))];
+    const explanation = {
+      decisionId: decision.decisionId,
+      agentId: decision.agentId,
+      verdict: decision.verdict,
+      headline,
+      because,
+      rulesApplied: decision.evaluations,
+      unbounded,
+      toProceed,
+      provenance: {
+        policyFingerprint: decision.policyFingerprint,
+        ...decision.policyVersion === void 0 ? {} : { policyVersion: decision.policyVersion },
+        actionDigest: decision.actionDigest,
+        modelVersion: decision.modelVersion,
+        ...decision.assessment === void 0 ? {} : {
+          riskModelVersion: decision.assessment.modelVersion,
+          riskLevel: decision.assessment.riskLevel
+        },
+        decidedAt: decision.decidedAt
+      },
+      text: ""
+    };
+    explanation.text = render(decision, explanation);
+    return explanation;
+  }
+  function buildHeadline(decision, failing, escalating) {
+    const prefix = VERDICT_HEADLINE[decision.verdict];
+    if (decision.verdict === "allow") {
+      const checked = decision.evaluations.filter((e) => e.outcome === "pass").length;
+      const unconfigured = decision.evaluations.filter((e) => e.outcome === "not_configured").length;
+      return `${prefix}: ${checked} ${checked === 1 ? "rule" : "rules"} were applied and passed` + (unconfigured > 0 ? `, and ${unconfigured} ${unconfigured === 1 ? "axis was" : "axes were"} left unbounded by this policy.` : ".");
+    }
+    const driving = failing[0] ?? escalating[0];
+    return driving ? `${prefix}: ${driving.statement}` : `${prefix}.`;
+  }
+  function render(decision, explanation) {
+    const lines = [
+      `${explanation.headline}`,
+      "",
+      `Agent:    ${decision.agentId}`,
+      `Decision: ${decision.decisionId} at ${decision.decidedAt}`,
+      `Policy:   ${decision.policyVersion ? `${decision.policyVersion} ` : ""}#${decision.policyFingerprint}`,
+      `Action:   #${decision.actionDigest}`
+    ];
+    if (decision.assessment) {
+      lines.push(
+        `Risk:     ${decision.assessment.riskLevel} (confidence ${decision.assessment.confidence}) \u2014 ${RISK_LEVEL_MEANING[decision.assessment.riskLevel]}`
+      );
+    } else if (decision.assessmentUnavailable) {
+      lines.push(`Risk:     not assessed \u2014 ${decision.assessmentUnavailable}`);
+    }
+    lines.push("", "Rules applied:");
+    for (const rule of decision.evaluations) {
+      const bound = rule.limit === void 0 ? "" : `  [limit ${rule.limit}]`;
+      const seen = rule.observed === void 0 ? "" : `  [observed ${rule.observed}]`;
+      lines.push(`  ${symbolFor(rule.outcome)} ${rule.rule}: ${rule.statement}${bound}${seen}`);
+    }
+    if (explanation.unbounded.length > 0) {
+      lines.push("", "Left unbounded by this policy:");
+      for (const line of explanation.unbounded) lines.push(`  - ${line}`);
+    }
+    if (explanation.toProceed.length > 0) {
+      lines.push("", "For this to proceed, the operator would have to:");
+      for (const line of explanation.toProceed) lines.push(`  - ${line}`);
+    }
+    return lines.join("\n");
+  }
+  function symbolFor(outcome) {
+    switch (outcome) {
+      case "pass":
+        return "PASS ";
+      case "fail":
+        return "FAIL ";
+      case "escalate":
+        return "HOLD ";
+      case "not_applicable":
+        return "n/a  ";
+      case "not_configured":
+        return "unset";
+    }
+  }
+
+  // src/client.ts
+  var AGENT_SDK_VERSION = "0.1.0";
+  var DEFAULT_AUDIT_LOG_ENTRIES = 1e3;
+  var AgentGuard = class _AgentGuard {
+    protect;
+    sealed;
+    ledgerImpl;
+    reserving;
+    auditEntries = [];
+    auditLimit;
+    onDecision;
+    constructor(config) {
+      if (!config.policy || typeof config.policy !== "object" || typeof config.policy.fingerprint !== "string") {
+        throw new Error(
+          "AgentGuard: a sealed policy is required. Build one with sealPolicy({ ... }) at wiring time, from a human-owned configuration \u2014 not from anything the agent produces."
+        );
+      }
+      if (config.protect) {
+        this.protect = config.protect;
+      } else if (config.apiKey || config.transport) {
+        const protectConfig = {
+          apiKey: config.apiKey ?? "transport-provided",
+          // Protect's own failMode only shapes the wording of an unavailable
+          // assessment; AgentGuard's `failMode` decides what actually happens.
+          // Pinning it to `open` keeps the two from being applied twice.
+          failMode: "open",
+          ...config.baseUrl === void 0 ? {} : { baseUrl: config.baseUrl },
+          ...config.timeoutMs === void 0 ? {} : { timeoutMs: config.timeoutMs },
+          ...config.retries === void 0 ? {} : { retries: config.retries },
+          ...config.fetch === void 0 ? {} : { fetch: config.fetch },
+          ...config.transport === void 0 ? {} : { transport: config.transport }
+        };
+        this.protect = new Decentrys(protectConfig);
+      } else {
+        throw new Error(
+          "AgentGuard: pass an apiKey or an existing Decentrys client. Screening a counterparty is the part of this that no local policy can do \u2014 an allowlist cannot tell you the address on it was labelled malicious yesterday."
+        );
+      }
+      this.sealed = config.policy;
+      this.ledgerImpl = config.ledger ?? new SpendLedger();
+      this.reserving = isReservationLedger(this.ledgerImpl) ? this.ledgerImpl : null;
+      this.auditLimit = config.auditLogEntries ?? DEFAULT_AUDIT_LOG_ENTRIES;
+      this.onDecision = config.onDecision;
+    }
+    /** The policy in force. Frozen — reading it is safe, changing it is impossible. */
+    get policy() {
+      return this.sealed;
+    }
+    /** Configurations that are legal but worth an operator's attention. */
+    get policyWarnings() {
+      return this.sealed.warnings;
+    }
+    /**
+     * Whether admitted actions hold budget before they execute.
+     *
+     * False when the guard was given a read-only usage source. Cumulative caps
+     * then count settled history only, so two actions that each fit under the
+     * cap can both be admitted and together exceed it. Exposed rather than
+     * assumed, because the difference is invisible until it costs something.
+     */
+    get reservesBudget() {
+      return this.reserving !== null;
+    }
+    // -------------------------------------------------------------------------
+    // The main path
+    // -------------------------------------------------------------------------
+    /**
+     * Assess a proposed action and decide whether the agent may sign it.
+     *
+     * Screening happens first and always — including when a local rule has
+     * already failed. A record saying an action exceeded its value cap, while
+     * omitting that its counterparty was confirmed malicious, would send an
+     * operator to raise the cap and ship the same hole.
+     *
+     * On `allow` or `require_human_approval` the action's value and its slot in
+     * the rate window are held immediately; call `confirm()` when it lands or
+     * `release()` when it does not. The hold is taken synchronously in the same
+     * turn as the evaluation, so two concurrent calls in one process cannot both
+     * pass a cap that only one of them fits under. Across processes they can —
+     * see `ledger.ts`, which says so plainly.
+     */
+    async assessAgentTransaction(action, options = {}) {
+      const policy = options.restrict ? narrowPolicy(this.sealed, options.restrict) : this.sealed;
+      const decisionId = newDecisionId();
+      let assessment = options.assessment;
+      if (!assessment) {
+        assessment = await this.screen(action, options);
+      }
+      const unavailable = unavailableReason(assessment);
+      const decision = evaluatePolicy({
+        action,
+        policy,
+        assessment: unavailable ? null : assessment,
+        ...unavailable === void 0 ? {} : { assessmentUnavailable: unavailable },
+        usage: this.ledgerImpl,
+        decisionId,
+        ...options.now === void 0 ? {} : { now: options.now }
+      });
+      if (decision.verdict !== "deny" && this.reserving) {
+        const reservation = this.reserving.reserve({
+          decisionId,
+          agentId: action.agentId,
+          // Reaching here with no stated value means no value-based rule was
+          // configured; if one had been, this would already be a denial.
+          valueUsd: action.valueUsd ?? 0,
+          ...action.idempotencyKey === void 0 ? {} : { idempotencyKey: action.idempotencyKey },
+          ...options.now === void 0 ? {} : { now: options.now }
+        });
+        decision.reservationId = reservation.decisionId;
+      }
+      this.record(decision);
+      return decision;
+    }
+    /**
+     * Decide without going to the network.
+     *
+     * For an operator replaying a decision against a different policy, and for
+     * an agent runtime that already holds an assessment. It applies the same
+     * rules; what it cannot do is discover that a counterparty was labelled
+     * since the assessment was taken.
+     */
+    evaluate(action, options = {}) {
+      const policy = options.restrict ? narrowPolicy(this.sealed, options.restrict) : this.sealed;
+      const decision = evaluatePolicy({
+        action,
+        policy,
+        assessment: options.assessment ?? null,
+        ...options.assessment ? {} : { assessmentUnavailable: options.assessmentUnavailable ?? "no assessment was supplied to evaluate()" },
+        usage: this.ledgerImpl,
+        ...options.now === void 0 ? {} : { now: options.now }
+      });
+      this.record(decision);
+      return decision;
+    }
+    // -------------------------------------------------------------------------
+    // Settling
+    // -------------------------------------------------------------------------
+    /** The agent signed and broadcast it. The held value becomes committed. */
+    confirm(decisionId, options = {}) {
+      const outcome = this.reserving?.confirm(decisionId, options) ?? null;
+      if (outcome) this.attachOutcome(outcome);
+      return outcome;
+    }
+    /** The agent did not proceed. The held value returns to the budget. */
+    release(decisionId, options = {}) {
+      const outcome = this.reserving?.release(decisionId, options) ?? null;
+      if (outcome) this.attachOutcome(outcome);
+      return outcome;
+    }
+    // -------------------------------------------------------------------------
+    // The trail
+    // -------------------------------------------------------------------------
+    /**
+     * Explain a decision, by id or by value.
+     *
+     * Returns `null` for an id this process never made or no longer holds —
+     * stated rather than reconstructed, because an explanation assembled from a
+     * decision that is no longer in hand is a guess wearing a record's clothes.
+     */
+    explain(decision) {
+      if (typeof decision !== "string") return explainAgentAction(decision);
+      const entry = this.auditEntries.find((e) => e.decision.decisionId === decision);
+      return entry ? explainAgentAction(entry.decision) : null;
+    }
+    /**
+     * Recent decisions, newest last.
+     *
+     * In memory and bounded; it does not survive a restart. Use `onDecision` for
+     * a trail that does. Saying which of the two this is matters — an operator
+     * who believes this is the audit log will discover otherwise at the worst
+     * possible moment.
+     */
+    auditLog(filter = {}) {
+      return this.auditEntries.filter((e) => !filter.agentId || e.decision.agentId === filter.agentId).filter((e) => !filter.verdict || e.decision.verdict === filter.verdict).map((e) => ({ decision: e.decision, ...e.outcome ? { outcome: e.outcome } : {} }));
+    }
+    /**
+     * A guard for a narrower task, sharing this one's ledger and client.
+     *
+     * The shared ledger is the point: a sub-task that spends against a tighter
+     * per-task cap still spends against the agent's daily one.
+     */
+    withPolicy(restriction) {
+      return new _AgentGuard({
+        policy: narrowPolicy(this.sealed, restriction),
+        protect: this.protect,
+        ledger: this.ledgerImpl,
+        auditLogEntries: this.auditLimit,
+        ...this.onDecision === void 0 ? {} : { onDecision: this.onDecision }
+      });
+    }
+    // -------------------------------------------------------------------------
+    // Internals
+    // -------------------------------------------------------------------------
+    /**
+     * Route the action to the right Protect endpoint.
+     *
+     * An approval is assessed on its spender *and its allowance together*,
+     * which is a different question from "is this transaction dangerous" and
+     * the one an unlimited approval turns on.
+     */
+    async screen(action, options) {
+      const call = {
+        ...options.signal === void 0 ? {} : { signal: options.signal },
+        ...options.skipCache === void 0 ? {} : { skipCache: options.skipCache }
+      };
+      if (action.type === "approve" && action.token && action.to) {
+        const result2 = await this.protect.screenApproval({
+          chain: action.chain,
+          owner: action.from,
+          spender: action.to,
+          token: action.token,
+          ...action.approvalAmount === void 0 ? {} : { amount: action.approvalAmount }
+        }, call);
+        return result2.assessment;
+      }
+      const result = await this.protect.assessTransaction({
+        chain: action.chain,
+        from: action.from,
+        ...action.to === void 0 ? {} : { to: action.to },
+        ...action.value === void 0 ? {} : { value: action.value },
+        ...action.data === void 0 ? {} : { data: action.data },
+        ...action.raw === void 0 ? {} : { raw: action.raw },
+        ...action.origin === void 0 ? {} : { origin: action.origin }
+      }, call);
+      return result.assessment;
+    }
+    record(decision) {
+      this.auditEntries.push({ decision });
+      while (this.auditEntries.length > this.auditLimit) this.auditEntries.shift();
+      if (!this.onDecision) return;
+      try {
+        this.onDecision(decision);
+      } catch {
+      }
+    }
+    attachOutcome(outcome) {
+      const entry = this.auditEntries.find((e) => e.decision.decisionId === outcome.decisionId);
+      if (entry) entry.outcome = outcome;
+    }
+  };
+  function unavailableReason(assessment) {
+    if (!assessment) return "no assessment was obtained";
+    const unknown = assessment.unknowns.find((u) => u.reason === "PROVIDER_UNAVAILABLE");
+    return unknown ? unknown.statement : void 0;
+  }
+  return __toCommonJS(index_exports);
+})();