@decentrys/agent 0.1.0

package/dist/explain.js

@@ -0,0 +1,144 @@
+"use strict";
+/**
+ * Turning a decision into something a person can be held to.
+ *
+ * The question this file exists to answer is not "why was that blocked" — a
+ * block explains itself, loudly, at the moment it happens. It is **"why was
+ * that allowed"**, asked weeks later by someone looking at a drained account.
+ * A record that lists only what went wrong cannot answer it, so
+ * `explainAgentAction` renders every rule that was applied, the bound it
+ * carried and the value it saw, alongside the axes on which the policy set no
+ * bound at all. An allow with nothing behind it reads, correctly, as an allow
+ * with nothing behind it.
+ *
+ * Nothing here recomputes anything. The explanation is a rendering of the
+ * decision record and cannot disagree with it — an explanation that is
+ * generated separately from the decision eventually explains a decision that
+ * was not made.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.explainAgentAction = explainAgentAction;
+const protect_1 = require("@decentrys/protect");
+const VERDICT_HEADLINE = {
+    allow: 'Permitted',
+    require_human_approval: 'Held for human approval',
+    deny: 'Denied',
+};
+/** What an operator would change, per rule, to permit the action. */
+const REMEDIATION = {
+    AGENT_BINDING: 'Use the policy sealed for this agent, or bind this policy to it.',
+    ACTION_TYPE: 'Add this action type to `allowedActions`, or remove it from `deniedActions`.',
+    CHAIN: 'Add this chain to `allowedChains`.',
+    COUNTERPARTY: 'Add this counterparty to `allowedCounterparties`, or remove it from `blockedCounterparties`.',
+    CONTRACT: 'Add this contract to `allowedContracts`.',
+    TOKEN: 'Add this token to `allowedTokens`.',
+    APPROVAL_ALLOWANCE: 'Have the agent request a bounded allowance, or set `allowUnlimitedApprovals` — '
+        + 'which makes any later compromise of the spender unbounded.',
+    VALUE_PER_ACTION: 'Raise `maxValuePerActionUsd`, or state the action\'s `valueUsd`.',
+    CUMULATIVE_SPEND: 'Wait for the window to roll over, raise the window\'s `maxValueUsd`, or state the '
+        + 'action\'s `valueUsd`.',
+    RATE_LIMIT: 'Wait for the window to roll over, or raise the window\'s `maxActions`. A rate ceiling being '
+        + 'hit repeatedly is usually the agent looping, not the ceiling being wrong.',
+    RISK_LEVEL: 'A person should review the evidence on the decision\'s assessment before this is permitted.',
+    ASSESSMENT_AVAILABILITY: 'Restore connectivity to Decentrys, or accept unscreened actions by setting '
+        + '`failMode: \'open\'` — which signs during precisely the window an attacker would choose.',
+    HUMAN_APPROVAL_THRESHOLD: 'A person must approve this action. Raise the threshold only if the operator '
+        + 'intends actions of this size to proceed unattended.',
+};
+function explainAgentAction(decision) {
+    const failing = decision.evaluations.filter((e) => e.outcome === 'fail');
+    const escalating = decision.evaluations.filter((e) => e.outcome === 'escalate');
+    const blocking = [...failing, ...escalating];
+    const headline = buildHeadline(decision, failing, escalating);
+    const because = blocking.map((e) => e.statement);
+    const unbounded = decision.evaluations
+        .filter((e) => e.outcome === 'not_configured')
+        .map((e) => e.statement);
+    // Deduplicated: two rules can share a remedy, and telling an operator the
+    // same thing twice trains them to skim the list.
+    const toProceed = [...new Set(blocking.map((e) => REMEDIATION[e.rule]))];
+    const explanation = {
+        decisionId: decision.decisionId,
+        agentId: decision.agentId,
+        verdict: decision.verdict,
+        headline,
+        because,
+        rulesApplied: decision.evaluations,
+        unbounded,
+        toProceed,
+        provenance: {
+            policyFingerprint: decision.policyFingerprint,
+            ...(decision.policyVersion === undefined ? {} : { policyVersion: decision.policyVersion }),
+            actionDigest: decision.actionDigest,
+            modelVersion: decision.modelVersion,
+            ...(decision.assessment === undefined ? {} : {
+                riskModelVersion: decision.assessment.modelVersion,
+                riskLevel: decision.assessment.riskLevel,
+            }),
+            decidedAt: decision.decidedAt,
+        },
+        text: '',
+    };
+    explanation.text = render(decision, explanation);
+    return explanation;
+}
+function buildHeadline(decision, failing, escalating) {
+    const prefix = VERDICT_HEADLINE[decision.verdict];
+    if (decision.verdict === 'allow') {
+        const checked = decision.evaluations.filter((e) => e.outcome === 'pass').length;
+        const unconfigured = decision.evaluations.filter((e) => e.outcome === 'not_configured').length;
+        return `${prefix}: ${checked} ${checked === 1 ? 'rule' : 'rules'} were applied and passed`
+            + (unconfigured > 0
+                ? `, and ${unconfigured} ${unconfigured === 1 ? 'axis was' : 'axes were'} left unbounded by this policy.`
+                : '.');
+    }
+    const driving = failing[0] ?? escalating[0];
+    return driving
+        ? `${prefix}: ${driving.statement}`
+        : `${prefix}.`;
+}
+function render(decision, explanation) {
+    const lines = [
+        `${explanation.headline}`,
+        '',
+        `Agent:    ${decision.agentId}`,
+        `Decision: ${decision.decisionId} at ${decision.decidedAt}`,
+        `Policy:   ${decision.policyVersion ? `${decision.policyVersion} ` : ''}#${decision.policyFingerprint}`,
+        `Action:   #${decision.actionDigest}`,
+    ];
+    if (decision.assessment) {
+        lines.push(`Risk:     ${decision.assessment.riskLevel} `
+            + `(confidence ${decision.assessment.confidence}) — `
+            + `${protect_1.RISK_LEVEL_MEANING[decision.assessment.riskLevel]}`);
+    }
+    else if (decision.assessmentUnavailable) {
+        lines.push(`Risk:     not assessed — ${decision.assessmentUnavailable}`);
+    }
+    lines.push('', 'Rules applied:');
+    for (const rule of decision.evaluations) {
+        const bound = rule.limit === undefined ? '' : `  [limit ${rule.limit}]`;
+        const seen = rule.observed === undefined ? '' : `  [observed ${rule.observed}]`;
+        lines.push(`  ${symbolFor(rule.outcome)} ${rule.rule}: ${rule.statement}${bound}${seen}`);
+    }
+    if (explanation.unbounded.length > 0) {
+        lines.push('', 'Left unbounded by this policy:');
+        for (const line of explanation.unbounded)
+            lines.push(`  - ${line}`);
+    }
+    if (explanation.toProceed.length > 0) {
+        lines.push('', 'For this to proceed, the operator would have to:');
+        for (const line of explanation.toProceed)
+            lines.push(`  - ${line}`);
+    }
+    return lines.join('\n');
+}
+function symbolFor(outcome) {
+    switch (outcome) {
+        case 'pass': return 'PASS ';
+        case 'fail': return 'FAIL ';
+        case 'escalate': return 'HOLD ';
+        case 'not_applicable': return 'n/a  ';
+        case 'not_configured': return 'unset';
+    }
+}
+//# sourceMappingURL=explain.js.map

package/dist/explain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"explain.js","sourceRoot":"","sources":["../src/explain.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;AA8EH,gDAyCC;AArHD,gDAAwD;AAgDxD,MAAM,gBAAgB,GAAiC;IACrD,KAAK,EAAE,WAAW;IAClB,sBAAsB,EAAE,yBAAyB;IACjD,IAAI,EAAE,QAAQ;CACf,CAAC;AAEF,qEAAqE;AACrE,MAAM,WAAW,GAAgC;IAC/C,aAAa,EAAE,kEAAkE;IACjF,WAAW,EAAE,8EAA8E;IAC3F,KAAK,EAAE,oCAAoC;IAC3C,YAAY,EAAE,8FAA8F;IAC5G,QAAQ,EAAE,0CAA0C;IACpD,KAAK,EAAE,oCAAoC;IAC3C,kBAAkB,EAAE,iFAAiF;UACjG,4DAA4D;IAChE,gBAAgB,EAAE,kEAAkE;IACpF,gBAAgB,EAAE,oFAAoF;UAClG,uBAAuB;IAC3B,UAAU,EAAE,8FAA8F;UACtG,2EAA2E;IAC/E,UAAU,EAAE,6FAA6F;IACzG,uBAAuB,EAAE,6EAA6E;UAClG,0FAA0F;IAC9F,wBAAwB,EAAE,8EAA8E;UACpG,qDAAqD;CAC1D,CAAC;AAEF,SAAgB,kBAAkB,CAAC,QAAuB;IACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjD,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW;SACnC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,gBAAgB,CAAC;SAC7C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE3B,0EAA0E;IAC1E,iDAAiD;IACjD,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzE,MAAM,WAAW,GAA2B;QAC1C,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ;QACR,OAAO;QACP,YAAY,EAAE,QAAQ,CAAC,WAAW;QAClC,SAAS;QACT,SAAS;QACT,UAAU,EAAE;YACV,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC1F,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,GAAG,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC3C,gBAAgB,EAAE,QAAQ,CAAC,UAAU,CAAC,YAAY;gBAClD,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,SAAS;aACzC,CAAC;YACF,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B;QACD,IAAI,EAAE,EAAE;KACT,CAAC;IAEF,WAAW,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACjD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,aAAa,CACpB,QAAuB,EAAE,OAAyB,EAAE,UAA4B;IAEhF,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QAChF,MAAM,YAAY,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,gBAAgB,CAAC,CAAC,MAAM,CAAC;QAC/F,OAAO,GAAG,MAAM,KAAK,OAAO,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,0BAA0B;cACtF,CAAC,YAAY,GAAG,CAAC;gBACjB,CAAC,CAAC,SAAS,YAAY,IAAI,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,iCAAiC;gBACzG,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,OAAO,OAAO;QACZ,CAAC,CAAC,GAAG,MAAM,KAAK,OAAO,CAAC,SAAS,EAAE;QACnC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC;AACnB,CAAC;AAED,SAAS,MAAM,CAAC,QAAuB,EAAE,WAAmC;IAC1E,MAAM,KAAK,GAAa;QACtB,GAAG,WAAW,CAAC,QAAQ,EAAE;QACzB,EAAE;QACF,aAAa,QAAQ,CAAC,OAAO,EAAE;QAC/B,aAAa,QAAQ,CAAC,UAAU,OAAO,QAAQ,CAAC,SAAS,EAAE;QAC3D,aAAa,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,QAAQ,CAAC,iBAAiB,EAAE;QACvG,cAAc,QAAQ,CAAC,YAAY,EAAE;KACtC,CAAC;IAEF,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CACR,aAAa,QAAQ,CAAC,UAAU,CAAC,SAAS,GAAG;cAC3C,eAAe,QAAQ,CAAC,UAAU,CAAC,UAAU,MAAM;cACnD,GAAG,4BAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CACzD,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,4BAA4B,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,KAAK,GAAG,CAAC;QACxE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,QAAQ,GAAG,CAAC;QAChF,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,GAAG,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,WAAW,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,gCAAgC,CAAC,CAAC;QACjD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,WAAW,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,kDAAkD,CAAC,CAAC;QACnE,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,OAAkC;IACnD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC;QAC5B,KAAK,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC;QAC5B,KAAK,UAAU,CAAC,CAAC,OAAO,OAAO,CAAC;QAChC,KAAK,gBAAgB,CAAC,CAAC,OAAO,OAAO,CAAC;QACtC,KAAK,gBAAgB,CAAC,CAAC,OAAO,OAAO,CAAC;IACxC,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export * from './model';
+export * from './policy';
+export * from './ledger';
+export * from './explain';
+export * from './client';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC"}

package/dist/index.js

@@ -0,0 +1,22 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./model"), exports);
+__exportStar(require("./policy"), exports);
+__exportStar(require("./ledger"), exports);
+__exportStar(require("./explain"), exports);
+__exportStar(require("./client"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,2CAAyB;AACzB,2CAAyB;AACzB,4CAA0B;AAC1B,2CAAyB"}

package/dist/ledger.d.ts

@@ -0,0 +1,166 @@
+/**
+ * Cumulative spend and rate accounting.
+ *
+ * ## What this is, honestly
+ *
+ * **This ledger is in-process and in-memory.** It counts what one instance of
+ * one process admitted. It is not shared, not durable, and not correct across
+ * a restart or a horizontal scale-out: two replicas each enforcing a $10,000
+ * daily cap enforce $20,000 between them, and a restart resets the day to
+ * zero.
+ *
+ * That is stated rather than papered over, and the shape of the API is chosen
+ * so it can be fixed without a rewrite: `evaluatePolicy` depends only on the
+ * `AgentUsage` interface below, so a Redis- or Postgres-backed implementation
+ * of two methods replaces this class entirely. A distributed limit needs
+ * shared storage with atomic reservation, which is a later concern and a real
+ * one — do not deploy a fleet of agents behind this class and describe the cap
+ * as enforced.
+ *
+ * ## Why reservations, rather than counting on the way out
+ *
+ * An agent asks "may I", gets an allow, and then signs. If budget were only
+ * counted when the transaction is confirmed, an agent could ask a hundred
+ * times before the first answer was recorded and get a hundred allows against
+ * a cap of one. So an admitted decision holds its value immediately, and the
+ * hold is released when the caller says the action did not happen or when it
+ * expires unclaimed. The failure direction is a briefly over-tight budget,
+ * which is the right way for this to be wrong.
+ */
+import type { AgentOutcomeRecord } from './model';
+/**
+ * What `evaluatePolicy` needs to know about the past.
+ *
+ * Deliberately two read methods and nothing else. Anything satisfying this can
+ * be handed to the evaluator — including a shared store, which is how this
+ * becomes correct across processes.
+ */
+export interface AgentUsage {
+    /** Value held or committed by this agent at or after `sinceMs`. */
+    spentUsdSince(agentId: string, sinceMs: number): number;
+    /** Decisions this guard admitted for the agent at or after `sinceMs`. */
+    actionsSince(agentId: string, sinceMs: number): number;
+}
+/**
+ * A usage source that can also hold budget.
+ *
+ * Kept separate from `AgentUsage` because the two are genuinely different
+ * capabilities: a read-only source (a warehouse query, a metrics store) can
+ * answer "how much has this agent spent today" without being able to take a
+ * hold. `AgentGuard` accepts either, and says which it got — a guard running
+ * on a read-only source enforces cumulative caps against *settled* history
+ * only, which cannot stop two concurrent actions that each fit alone.
+ */
+export interface ReservationLedger extends AgentUsage {
+    reserve(input: {
+        decisionId: string;
+        agentId: string;
+        valueUsd: number;
+        idempotencyKey?: string;
+        now?: Date;
+    }): Reservation;
+    confirm(decisionId: string, options?: {
+        txHash?: string;
+        now?: Date;
+    }): AgentOutcomeRecord | null;
+    release(decisionId: string, options?: {
+        note?: string;
+        now?: Date;
+    }): AgentOutcomeRecord | null;
+}
+export declare function isReservationLedger(usage: AgentUsage): usage is ReservationLedger;
+export type ReservationState = 'held' | 'confirmed' | 'released' | 'expired';
+export interface Reservation {
+    decisionId: string;
+    agentId: string;
+    valueUsd: number;
+    idempotencyKey?: string;
+    state: ReservationState;
+    createdAtMs: number;
+    expiresAtMs: number;
+    settledAtMs?: number;
+    txHash?: string;
+    note?: string;
+}
+export interface SpendLedgerOptions {
+    /**
+     * How long an unsettled hold survives. Default 5 minutes — long enough for a
+     * signature and a broadcast, short enough that an agent that crashed
+     * mid-action does not hold its budget until the window rolls over.
+     */
+    reservationTtlMs?: number;
+    /**
+     * How long settled entries are kept. Must exceed the longest policy window,
+     * or a cumulative cap silently stops being cumulative. Default 8 days.
+     */
+    retentionMs?: number;
+    /** A hard ceiling on entries, so a runaway agent cannot exhaust memory. */
+    maxEntries?: number;
+    /**
+     * The clock, injected for the same reason Protect injects `fetch`: expiry
+     * and retention are time-dependent behaviour, and behaviour that can only be
+     * exercised by waiting is behaviour that does not get tested.
+     */
+    clock?: () => number;
+}
+export declare class SpendLedger implements ReservationLedger {
+    private readonly reservationTtlMs;
+    private readonly retentionMs;
+    private readonly maxEntries;
+    private readonly clock;
+    private readonly entries;
+    private readonly byDecision;
+    private readonly byIdempotencyKey;
+    constructor(options?: SpendLedgerOptions);
+    /**
+     * Hold budget for an admitted decision.
+     *
+     * A repeated `idempotencyKey` returns the existing hold instead of taking a
+     * second one. An agent retrying a call after a timeout is one action, and
+     * counting it twice would tighten its own cap against it for no reason.
+     */
+    reserve(input: {
+        decisionId: string;
+        agentId: string;
+        valueUsd: number;
+        idempotencyKey?: string;
+        now?: Date;
+    }): Reservation;
+    /** The action happened. The hold becomes a permanent commitment. */
+    confirm(decisionId: string, options?: {
+        txHash?: string;
+        now?: Date;
+    }): AgentOutcomeRecord | null;
+    /** The action did not happen. The hold is returned to the budget. */
+    release(decisionId: string, options?: {
+        note?: string;
+        now?: Date;
+    }): AgentOutcomeRecord | null;
+    /**
+     * Value held or committed in the window.
+     *
+     * Released and expired holds do not count. They are actions that did not
+     * happen, and charging an agent for them would shrink a cap the operator
+     * set for real spending.
+     */
+    spentUsdSince(agentId: string, sinceMs: number): number;
+    /**
+     * Decisions admitted in the window — regardless of how they settled.
+     *
+     * A rate ceiling counts what the guard admitted, not what landed on chain.
+     * An agent that spins through assess-and-abandon at machine speed is exactly
+     * the loop the ceiling exists to catch, and it would be invisible to a
+     * counter that only saw confirmed transactions.
+     */
+    actionsSince(agentId: string, sinceMs: number): number;
+    reservation(decisionId: string): Reservation | undefined;
+    /** Snapshot for inspection. Copies, so a caller cannot edit the ledger. */
+    list(agentId?: string): Reservation[];
+    clear(): void;
+    private settle;
+    private prune;
+    private enforceCeiling;
+    /** Idempotency keys are the caller's, so they are namespaced per agent. */
+    private keyFor;
+}
+//# sourceMappingURL=ledger.d.ts.map

package/dist/ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../src/ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACxD,yEAAyE;IACzE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CACxD;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD,OAAO,CAAC,KAAK,EAAE;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,GAAG,CAAC,EAAE,IAAI,CAAC;KACZ,GAAG,WAAW,CAAC;IAChB,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,IAAI,CAAA;KAAE,GAAG,kBAAkB,GAAG,IAAI,CAAC;IAClG,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,IAAI,CAAA;KAAE,GAAG,kBAAkB,GAAG,IAAI,CAAC;CACjG;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,IAAI,iBAAiB,CAKjF;AAED,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,CAAC;AAE7E,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,gBAAgB,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAMD,qBAAa,WAAY,YAAW,iBAAiB;IACnD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkC;IAC7D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAkC;gBAEvD,OAAO,GAAE,kBAAuB;IAO5C;;;;;;OAMG;IACH,OAAO,CAAC,KAAK,EAAE;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,GAAG,CAAC,EAAE,IAAI,CAAC;KACZ,GAAG,WAAW;IA8Bf,oEAAoE;IACpE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,IAAI,CAAA;KAAO,GAAG,kBAAkB,GAAG,IAAI;IAOrG,qEAAqE;IACrE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,IAAI,CAAA;KAAO,GAAG,kBAAkB,GAAG,IAAI;IAOnG;;;;;;OAMG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAYvD;;;;;;;OAOG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAWtD,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAIxD,2EAA2E;IAC3E,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,WAAW,EAAE;IAMrC,KAAK,IAAI,IAAI;IAQb,OAAO,CAAC,MAAM;IA4Bd,OAAO,CAAC,KAAK;IAab,OAAO,CAAC,cAAc;IAStB,2EAA2E;IAC3E,OAAO,CAAC,MAAM;CAGf"}

package/dist/ledger.js

@@ -0,0 +1,218 @@
+"use strict";
+/**
+ * Cumulative spend and rate accounting.
+ *
+ * ## What this is, honestly
+ *
+ * **This ledger is in-process and in-memory.** It counts what one instance of
+ * one process admitted. It is not shared, not durable, and not correct across
+ * a restart or a horizontal scale-out: two replicas each enforcing a $10,000
+ * daily cap enforce $20,000 between them, and a restart resets the day to
+ * zero.
+ *
+ * That is stated rather than papered over, and the shape of the API is chosen
+ * so it can be fixed without a rewrite: `evaluatePolicy` depends only on the
+ * `AgentUsage` interface below, so a Redis- or Postgres-backed implementation
+ * of two methods replaces this class entirely. A distributed limit needs
+ * shared storage with atomic reservation, which is a later concern and a real
+ * one — do not deploy a fleet of agents behind this class and describe the cap
+ * as enforced.
+ *
+ * ## Why reservations, rather than counting on the way out
+ *
+ * An agent asks "may I", gets an allow, and then signs. If budget were only
+ * counted when the transaction is confirmed, an agent could ask a hundred
+ * times before the first answer was recorded and get a hundred allows against
+ * a cap of one. So an admitted decision holds its value immediately, and the
+ * hold is released when the caller says the action did not happen or when it
+ * expires unclaimed. The failure direction is a briefly over-tight budget,
+ * which is the right way for this to be wrong.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SpendLedger = void 0;
+exports.isReservationLedger = isReservationLedger;
+function isReservationLedger(usage) {
+    const candidate = usage;
+    return typeof candidate.reserve === 'function'
+        && typeof candidate.confirm === 'function'
+        && typeof candidate.release === 'function';
+}
+const DEFAULT_RESERVATION_TTL_MS = 5 * 60_000;
+const DEFAULT_RETENTION_MS = 8 * 24 * 60 * 60_000;
+const DEFAULT_MAX_ENTRIES = 50_000;
+class SpendLedger {
+    reservationTtlMs;
+    retentionMs;
+    maxEntries;
+    clock;
+    entries = [];
+    byDecision = new Map();
+    byIdempotencyKey = new Map();
+    constructor(options = {}) {
+        this.reservationTtlMs = options.reservationTtlMs ?? DEFAULT_RESERVATION_TTL_MS;
+        this.retentionMs = options.retentionMs ?? DEFAULT_RETENTION_MS;
+        this.maxEntries = options.maxEntries ?? DEFAULT_MAX_ENTRIES;
+        this.clock = options.clock ?? (() => Date.now());
+    }
+    /**
+     * Hold budget for an admitted decision.
+     *
+     * A repeated `idempotencyKey` returns the existing hold instead of taking a
+     * second one. An agent retrying a call after a timeout is one action, and
+     * counting it twice would tighten its own cap against it for no reason.
+     */
+    reserve(input) {
+        const nowMs = input.now ? input.now.getTime() : this.clock();
+        this.prune(nowMs);
+        if (input.idempotencyKey) {
+            const existing = this.byIdempotencyKey.get(this.keyFor(input.agentId, input.idempotencyKey));
+            if (existing && existing.state !== 'released' && existing.state !== 'expired')
+                return existing;
+        }
+        const reservation = {
+            decisionId: input.decisionId,
+            agentId: input.agentId,
+            // A negative value would be a credit against the agent's own cap, which
+            // is a way to spend more than the cap allows. Clamped, not trusted.
+            valueUsd: Number.isFinite(input.valueUsd) ? Math.max(0, input.valueUsd) : 0,
+            ...(input.idempotencyKey ? { idempotencyKey: input.idempotencyKey } : {}),
+            state: 'held',
+            createdAtMs: nowMs,
+            expiresAtMs: nowMs + this.reservationTtlMs,
+        };
+        this.entries.push(reservation);
+        this.byDecision.set(reservation.decisionId, reservation);
+        if (input.idempotencyKey) {
+            this.byIdempotencyKey.set(this.keyFor(input.agentId, input.idempotencyKey), reservation);
+        }
+        this.enforceCeiling();
+        return reservation;
+    }
+    /** The action happened. The hold becomes a permanent commitment. */
+    confirm(decisionId, options = {}) {
+        return this.settle(decisionId, 'confirmed', {
+            ...(options.txHash === undefined ? {} : { txHash: options.txHash }),
+            ...(options.now === undefined ? {} : { now: options.now }),
+        });
+    }
+    /** The action did not happen. The hold is returned to the budget. */
+    release(decisionId, options = {}) {
+        return this.settle(decisionId, 'released', {
+            ...(options.note === undefined ? {} : { note: options.note }),
+            ...(options.now === undefined ? {} : { now: options.now }),
+        });
+    }
+    /**
+     * Value held or committed in the window.
+     *
+     * Released and expired holds do not count. They are actions that did not
+     * happen, and charging an agent for them would shrink a cap the operator
+     * set for real spending.
+     */
+    spentUsdSince(agentId, sinceMs) {
+        this.prune(this.clock());
+        let total = 0;
+        for (const entry of this.entries) {
+            if (entry.agentId !== agentId)
+                continue;
+            if (entry.state === 'released' || entry.state === 'expired')
+                continue;
+            if (entry.createdAtMs < sinceMs)
+                continue;
+            total += entry.valueUsd;
+        }
+        return total;
+    }
+    /**
+     * Decisions admitted in the window — regardless of how they settled.
+     *
+     * A rate ceiling counts what the guard admitted, not what landed on chain.
+     * An agent that spins through assess-and-abandon at machine speed is exactly
+     * the loop the ceiling exists to catch, and it would be invisible to a
+     * counter that only saw confirmed transactions.
+     */
+    actionsSince(agentId, sinceMs) {
+        this.prune(this.clock());
+        let count = 0;
+        for (const entry of this.entries) {
+            if (entry.agentId !== agentId)
+                continue;
+            if (entry.createdAtMs < sinceMs)
+                continue;
+            count += 1;
+        }
+        return count;
+    }
+    reservation(decisionId) {
+        return this.byDecision.get(decisionId);
+    }
+    /** Snapshot for inspection. Copies, so a caller cannot edit the ledger. */
+    list(agentId) {
+        return this.entries
+            .filter((entry) => !agentId || entry.agentId === agentId)
+            .map((entry) => ({ ...entry }));
+    }
+    clear() {
+        this.entries.length = 0;
+        this.byDecision.clear();
+        this.byIdempotencyKey.clear();
+    }
+    // -------------------------------------------------------------------------
+    settle(decisionId, state, options) {
+        const now = options.now ?? new Date(this.clock());
+        const entry = this.byDecision.get(decisionId);
+        if (!entry)
+            return null;
+        // An expired hold that later confirms is a real and dangerous case: the
+        // budget was already returned, so the spend happened outside the cap. It
+        // is recorded as confirmed so the total is right, and the note says the
+        // hold had lapsed, because that is a tuning signal for the TTL.
+        const lapsed = entry.state === 'expired';
+        entry.state = state;
+        entry.settledAtMs = now.getTime();
+        if (options.txHash !== undefined)
+            entry.txHash = options.txHash;
+        if (options.note !== undefined)
+            entry.note = options.note;
+        return {
+            decisionId,
+            state,
+            ...(entry.txHash === undefined ? {} : { txHash: entry.txHash }),
+            ...(lapsed
+                ? { note: 'The hold had already expired when this was settled; the reservation TTL may be too short.' }
+                : entry.note === undefined ? {} : { note: entry.note }),
+            at: now.toISOString(),
+        };
+    }
+    prune(nowMs) {
+        for (const entry of this.entries) {
+            if (entry.state === 'held' && entry.expiresAtMs <= nowMs)
+                entry.state = 'expired';
+        }
+        for (let i = this.entries.length - 1; i >= 0; i -= 1) {
+            const entry = this.entries[i];
+            if (nowMs - entry.createdAtMs <= this.retentionMs)
+                continue;
+            this.entries.splice(i, 1);
+            this.byDecision.delete(entry.decisionId);
+            if (entry.idempotencyKey)
+                this.byIdempotencyKey.delete(this.keyFor(entry.agentId, entry.idempotencyKey));
+        }
+    }
+    enforceCeiling() {
+        while (this.entries.length > this.maxEntries) {
+            const entry = this.entries.shift();
+            if (!entry)
+                break;
+            this.byDecision.delete(entry.decisionId);
+            if (entry.idempotencyKey)
+                this.byIdempotencyKey.delete(this.keyFor(entry.agentId, entry.idempotencyKey));
+        }
+    }
+    /** Idempotency keys are the caller's, so they are namespaced per agent. */
+    keyFor(agentId, idempotencyKey) {
+        return `${agentId}${idempotencyKey}`;
+    }
+}
+exports.SpendLedger = SpendLedger;
+//# sourceMappingURL=ledger.js.map

package/dist/ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.js","sourceRoot":"","sources":["../src/ledger.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;;;AAwCH,kDAKC;AALD,SAAgB,mBAAmB,CAAC,KAAiB;IACnD,MAAM,SAAS,GAAG,KAAmC,CAAC;IACtD,OAAO,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU;WACzC,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU;WACvC,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,CAAC;AAC/C,CAAC;AAuCD,MAAM,0BAA0B,GAAG,CAAC,GAAG,MAAM,CAAC;AAC9C,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAClD,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,MAAa,WAAW;IACL,gBAAgB,CAAS;IACzB,WAAW,CAAS;IACpB,UAAU,CAAS;IACnB,KAAK,CAAe;IACpB,OAAO,GAAkB,EAAE,CAAC;IAC5B,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC5C,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEnE,YAAY,UAA8B,EAAE;QAC1C,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;QAC/E,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC/D,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;QAC5D,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,KAMP;QACC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7D,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAElB,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;YAC7F,IAAI,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,UAAU,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAC;QACjG,CAAC;QAED,MAAM,WAAW,GAAgB;YAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,wEAAwE;YACxE,oEAAoE;YACpE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3E,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,KAAK,EAAE,MAAM;YACb,WAAW,EAAE,KAAK;YAClB,WAAW,EAAE,KAAK,GAAG,IAAI,CAAC,gBAAgB;SAC3C,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,oEAAoE;IACpE,OAAO,CAAC,UAAkB,EAAE,UAA2C,EAAE;QACvE,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE;YAC1C,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YACnE,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,OAAO,CAAC,UAAkB,EAAE,UAAyC,EAAE;QACrE,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE;YACzC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,OAAe,EAAE,OAAe;QAC5C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACzB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;gBAAE,SAAS;YACxC,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS;YACtE,IAAI,KAAK,CAAC,WAAW,GAAG,OAAO;gBAAE,SAAS;YAC1C,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC;QAC1B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACH,YAAY,CAAC,OAAe,EAAE,OAAe;QAC3C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACzB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;gBAAE,SAAS;YACxC,IAAI,KAAK,CAAC,WAAW,GAAG,OAAO;gBAAE,SAAS;YAC1C,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,WAAW,CAAC,UAAkB;QAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAED,2EAA2E;IAC3E,IAAI,CAAC,OAAgB;QACnB,OAAO,IAAI,CAAC,OAAO;aAChB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC;aACxD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAED,4EAA4E;IAEpE,MAAM,CACZ,UAAkB,EAAE,KAA+B,EACnD,OAAuD;QAEvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,gEAAgE;QAChE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC;QACzC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;QACpB,KAAK,CAAC,WAAW,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAChE,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAE1D,OAAO;YACL,UAAU;YACV,KAAK;YACL,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM;gBACR,CAAC,CAAC,EAAE,IAAI,EAAE,2FAA2F,EAAE;gBACvG,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YACzD,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE;SACtB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,KAAa;QACzB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK;gBAAE,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;QACpF,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC;YAC/B,IAAI,KAAK,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW;gBAAE,SAAS;YAC5D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,cAAc;gBAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IAEO,cAAc;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,MAAM;YAClB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,cAAc;gBAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IAED,2EAA2E;IACnE,MAAM,CAAC,OAAe,EAAE,cAAsB;QACpD,OAAO,GAAG,OAAO,IAAI,cAAc,EAAE,CAAC;IACxC,CAAC;CACF;AA1LD,kCA0LC"}