@eco-incorp/sauce 0.99.6 → 0.99.8

package/sdk/dist/cli/policy.js

@@ -0,0 +1,702 @@
+/**
+ * What a wallet may send: its policy, `<name>.policy.json` beside it in the wallet directory, and
+ * the ledger of what it sent, `<name>.ledger.jsonl`. With no policy file a wallet sends anything
+ * its signer could, and every result says no limits are set.
+ *
+ * A policy (every field optional, every amount a string — whole units, `"1.5"`, or base units
+ * ending in `n`, `"1500000n"`, as `--fund` takes them):
+ *
+ *     {
+ *       "chains": ["base", "ethereum"],
+ *       "to": ["0x…"],
+ *       "native": { "perTransaction": "0.01", "perDay": "0.05" },
+ *       "tokens": { "USDC": { "perTransaction": "100", "perDay": "500" } }
+ *     }
+ *
+ *  - `chains`: the only chains it sends on (slugs, aliases or ids).
+ *  - `to`: the only addresses a transaction may be sent to — on Solana, the programs its
+ *    instructions call (the compute-budget program aside).
+ *  - `native`: the chain's native coin, in its own units (ETH, SOL), leaving the wallet or the Pot
+ *    a transaction cooks on; on Solana the fee and any rent it pays are included.
+ *  - `tokens`: by registry symbol or by address (an EVM token, a Solana mint); what leaves the
+ *    wallet or the Pot it cooks on, and any approval it grants above what is left of the limit
+ *    (Permit2 aside, which moves nothing without the wallet's signature in a later cook). A token
+ *    the policy does not name is not limited.
+ *  - `perDay` is the last 24 hours, every chain together, counted from the ledger.
+ *
+ * What a transaction moves is MEASURED, not read from its calldata: an EVM transaction is rehearsed
+ * by `eth_simulateV1` with transfers traced, and the ERC-20 Transfer and Approval logs and native
+ * transfers out of the wallet and its Pot are what count; a Solana one is simulated with the
+ * accounts it writes reported, and the wallet's and its Pot's lamports and token accounts compared
+ * before and after. What cannot be measured — an endpoint without `eth_simulateV1`, a cook whose
+ * native transfers are not traced, a Solana transaction loading accounts from lookup tables — is
+ * refused wherever a limit would need it.
+ *
+ * Every wallet unlocked is GUARDED, policy or not: {@link guardWallet} registers it by address, and
+ * the two places every send of this command passes — `chain.ts#sendAndWait` on an EVM chain,
+ * `solana.ts`'s `sendAndConfirm` on Solana — ask {@link guardOf} for the sender's guard before
+ * sending. A check and its reservation in the ledger happen under a lock file, so two processes
+ * cannot both spend the last of a day's limit; the outcome is appended after.
+ *
+ * NODE-ONLY, like the rest of `cli/`.
+ */
+import { randomUUID } from "node:crypto";
+import { closeSync, openSync, readFileSync, statSync, unlinkSync, writeSync, } from "node:fs";
+import { join } from "node:path";
+import { address as solanaAddress, getBase64EncodedWireTransaction, getBase64Encoder, getCompiledTransactionMessageDecoder, isAddress as isSolanaAddress, } from "@solana/kit";
+import { decodeAbiParameters, formatUnits, getAddress, isAddress, parseUnits, toFunctionSelector, } from "viem";
+import { requireChain } from "../chains/canonical.js";
+import { v12SvmKitchenProgramId } from "../deployments/index.js";
+import { addressOn, getDescriptor } from "../descriptors/query.js";
+import { v12PotAbi } from "../evm/engine.js";
+import { TOKEN_REGISTRY } from "../routes/token-registry.js";
+import { derivePotPda } from "../svm/index.js";
+import { CliError, UsageError } from "./args.js";
+import { nativeSymbol, tokenInfo } from "./effects.js";
+import { requireSupported } from "./support.js";
+import { accountsNow, movedBy, writableAccounts } from "./svm-effects.js";
+/** A policy refused: which limit, and why, in one sentence. */
+export class PolicyRefusal extends CliError {
+    limit;
+    constructor(
+    /** The limit, as the policy file spells its path: `tokens.USDC.perDay`, `chains`, `to`. */
+    limit, message) {
+        super(message);
+        this.limit = limit;
+    }
+}
+const AMOUNT = /^(?:\d+(?:\.\d+)?|\d+n)$/;
+function amountOf(raw, where) {
+    if (typeof raw !== "string" || !AMOUNT.test(raw)) {
+        throw new UsageError(`${where} is not an amount: a string of whole units ("1.5") or of base units ending in n ` +
+            '("1500000n")');
+    }
+    return raw.endsWith("n") ? { base: BigInt(raw.slice(0, -1)) } : { units: raw };
+}
+function limitOf(raw, where) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new UsageError(`${where} is not { "perTransaction": …, "perDay": … }`);
+    }
+    const extra = Object.keys(raw).find((key) => key !== "perTransaction" && key !== "perDay");
+    if (extra !== undefined) {
+        throw new UsageError(`${where}.${extra} is not a limit: perTransaction or perDay`);
+    }
+    const { perTransaction, perDay } = raw;
+    return {
+        ...(perTransaction === undefined
+            ? {}
+            : { perTransaction: amountOf(perTransaction, `${where}.perTransaction`) }),
+        ...(perDay === undefined ? {} : { perDay: amountOf(perDay, `${where}.perDay`) }),
+    };
+}
+const POLICY_KEYS = new Set(["chains", "to", "native", "tokens"]);
+/** A policy file's text, checked whole: an unknown field is an error, never ignored. */
+export function parsePolicy(text, path) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new UsageError(`${path} is not JSON`);
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new UsageError(`${path} is not a JSON object`);
+    }
+    const fields = parsed;
+    const unknown = Object.keys(fields).find((key) => !POLICY_KEYS.has(key));
+    if (unknown !== undefined) {
+        throw new UsageError(`${path}: ${unknown} is not a policy field (chains, to, native, tokens)`);
+    }
+    const list = (key) => {
+        const value = fields[key];
+        if (value === undefined)
+            return undefined;
+        if (!Array.isArray(value))
+            throw new UsageError(`${path}: ${key} is not a list`);
+        return value;
+    };
+    const chains = list("chains")?.map((raw) => {
+        try {
+            return requireChain(typeof raw === "number" ? raw : String(raw));
+        }
+        catch {
+            throw new UsageError(`${path}: chains names ${JSON.stringify(raw)}, which is not a chain`);
+        }
+    });
+    const to = list("to")?.map((raw) => {
+        if (typeof raw === "string" && isAddress(raw, { strict: false }))
+            return raw.toLowerCase();
+        if (typeof raw === "string" && isSolanaAddress(raw))
+            return raw;
+        throw new UsageError(`${path}: to names ${JSON.stringify(raw)}, which is not an address`);
+    });
+    const tokens = new Map();
+    if (fields.tokens !== undefined) {
+        if (fields.tokens === null ||
+            typeof fields.tokens !== "object" ||
+            Array.isArray(fields.tokens)) {
+            throw new UsageError(`${path}: tokens is not an object of token to limit`);
+        }
+        for (const [key, raw] of Object.entries(fields.tokens)) {
+            const named = isAddress(key, { strict: false })
+                ? key.toLowerCase()
+                : isSolanaAddress(key)
+                    ? key
+                    : /^[A-Za-z][A-Za-z0-9.]{0,15}$/.test(key)
+                        ? key.toUpperCase()
+                        : undefined;
+            if (named === undefined) {
+                throw new UsageError(`${path}: tokens.${key} is neither a token symbol nor an address`);
+            }
+            tokens.set(named, limitOf(raw, `${path}: tokens.${key}`));
+        }
+    }
+    return {
+        path,
+        ...(chains === undefined ? {} : { chains }),
+        ...(to === undefined ? {} : { to }),
+        ...(fields.native === undefined ? {} : { native: limitOf(fields.native, `${path}: native`) }),
+        tokens,
+    };
+}
+/**
+ * The wallet's policy, `undefined` when it has none. A file that others may write is refused: they
+ * could loosen it.
+ */
+export function readPolicy(info) {
+    let stats;
+    try {
+        stats = statSync(info.policyPath);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw new CliError(`${info.policyPath} is unreadable`);
+    }
+    if (process.platform !== "win32" && (stats.mode & 0o022) !== 0) {
+        throw new CliError(`${info.policyPath} can be written by others (mode ${(stats.mode & 0o777).toString(8)}), ` +
+            `who could loosen it: \`chmod 600 ${info.policyPath}\``);
+    }
+    return parsePolicy(readFileSync(info.policyPath, "utf8"), info.policyPath);
+}
+/** What a send result says of a wallet with no policy. */
+export const noPolicyNote = (info) => `wallet ${info.name} has no policy, so no limits are set on what it sends: ${info.policyPath} ` +
+    "sets them (per transaction and per day, by chain, by recipient, native and per token)";
+// ---------------------------------------------------------------------------------------------
+// Amounts, compared across chains
+// ---------------------------------------------------------------------------------------------
+/** Every amount is compared at 36 decimals: exact for any token with up to 36 of its own. */
+const SCALE = 36;
+const scaled = (amount, decimals) => amount * 10n ** BigInt(SCALE - Math.min(decimals, SCALE));
+const limitScaled = (limit, decimals) => "base" in limit ? scaled(limit.base, decimals) : parseUnits(limit.units, SCALE);
+/** `value` at {@link SCALE}, as whole units for a person. */
+const whole = (value) => formatUnits(value, SCALE);
+const TRANSFER = "0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef";
+const APPROVAL = "0x8c5be1e5ebec7d5bd14f71427d1e84f3dd0314c0f7b2291e5b200ac8c7c3b925";
+/** Where `traceTransfers` reports native transfers, as ERC-20 Transfer logs. */
+const NATIVE_EMITTER = getAddress("0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE");
+const COOK = toFunctionSelector(v12PotAbi.find((item) => item.type === "function" && item.name === "cook"));
+const topicAddress = (topic) => getAddress(`0x${topic.slice(26)}`);
+const wordOf = (data) => data.length === 66 ? decodeAbiParameters([{ type: "uint256" }], data)[0] : undefined;
+/** The token's registry symbol and decimals on `chain`, else its own decimals. */
+async function evmToken(client, chain, token) {
+    const row = (TOKEN_REGISTRY[chain.id] ?? []).find((entry) => getAddress(entry.address) === token);
+    if (row !== undefined)
+        return { symbol: row.symbol, decimals: row.decimals };
+    const info = await tokenInfo(client, chain, token);
+    return info.decimals === undefined ? {} : { decimals: info.decimals };
+}
+/**
+ * `calls` rehearsed in order from `wallet` in one `eth_simulateV1` block, state carried from each to
+ * the next and native transfers traced; `undefined` where the endpoint does not run it.
+ */
+export async function rehearsePlan(client, wallet, calls) {
+    try {
+        const [block] = await client.simulateBlocks({
+            blocks: [
+                {
+                    calls: calls.map((call) => ({
+                        account: wallet,
+                        to: call.to,
+                        data: call.data,
+                        value: call.value,
+                    })),
+                },
+            ],
+            traceTransfers: true,
+            validation: false,
+        });
+        return (block?.calls ?? []).map((call) => ({
+            status: call.status === "success" ? "success" : "failure",
+            logs: (call.logs ?? []).map((log) => ({
+                address: getAddress(log.address),
+                topics: log.topics,
+                data: log.data,
+            })),
+            data: call.data,
+        }));
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * What `calls`, sent in order from `wallet`, move out of the wallet and the Pot each cooks on: one
+ * {@link Measured} per call, from `rehearsed` (a {@link rehearsePlan} of them; rehearsed here when
+ * not given). Where the endpoint does not run `eth_simulateV1` the movements are unmeasured; a call
+ * that fails is refused, as a send would be.
+ */
+export async function measureEvm(client, chain, wallet, calls, rehearsed) {
+    const results = rehearsed ?? (await rehearsePlan(client, wallet, calls));
+    const measured = [];
+    for (const [index, call] of calls.entries()) {
+        const cook = call.data.slice(0, 10).toLowerCase() === COOK ? getAddress(call.to) : undefined;
+        const ours = new Set([getAddress(wallet), ...(cook === undefined ? [] : [cook])]);
+        const base = {
+            chain,
+            to: [call.to.toLowerCase()],
+            approvals: [],
+        };
+        const nativeOf = (amount) => ({
+            token: "native",
+            symbol: nativeSymbol(chain),
+            decimals: 18,
+            amount,
+        });
+        const result = results?.[index];
+        if (result === undefined) {
+            measured.push({
+                ...base,
+                native: nativeOf(call.value),
+                tokens: [],
+                unmeasured: {
+                    tokens: "the endpoint did not run eth_simulateV1, which shows what a transaction moves",
+                    ...(cook === undefined
+                        ? {}
+                        : {
+                            native: "the endpoint did not run eth_simulateV1, so what the cook moves from the Pot is not known",
+                        }),
+                },
+            });
+            continue;
+        }
+        if (result.status !== "success") {
+            throw new CliError(`transaction ${index + 1} of ${calls.length} would revert in the rehearsal, so nothing was sent`);
+        }
+        const logs = result.logs ?? [];
+        const traced = logs.some((log) => getAddress(log.address) === NATIVE_EMITTER);
+        let native = 0n;
+        const tokens = new Map();
+        const approvals = [];
+        for (const log of logs) {
+            const [topic, one, two] = log.topics;
+            const amount = wordOf(log.data);
+            if (amount === undefined || log.topics.length !== 3)
+                continue;
+            const emitter = getAddress(log.address);
+            if (topic?.toLowerCase() === TRANSFER) {
+                const from = topicAddress(one);
+                const to = topicAddress(two);
+                if (!ours.has(from) || ours.has(to))
+                    continue;
+                if (emitter === NATIVE_EMITTER)
+                    native += amount;
+                else
+                    tokens.set(emitter, (tokens.get(emitter) ?? 0n) + amount);
+            }
+            else if (topic?.toLowerCase() === APPROVAL && ours.has(topicAddress(one))) {
+                approvals.push({ token: emitter, spender: topicAddress(two), amount });
+            }
+        }
+        // An account's own native leaves only as a transaction's value, which a trace shows; with no
+        // trace, the value is what the wallet sends, and a cook's Pot is not seen.
+        const untraced = !traced && (call.value > 0n || cook !== undefined);
+        const known = new Map();
+        const info = async (token) => {
+            if (!known.has(token))
+                known.set(token, await evmToken(client, chain, token));
+            return known.get(token);
+        };
+        measured.push({
+            ...base,
+            native: nativeOf(untraced ? call.value : native),
+            tokens: await Promise.all([...tokens].map(async ([token, amount]) => ({
+                token,
+                ...(await info(token)),
+                amount,
+            }))),
+            approvals: await Promise.all(approvals.map(async (approval) => ({
+                token: approval.token,
+                ...(await info(approval.token)),
+                amount: approval.amount,
+                spender: approval.spender,
+            }))),
+            unmeasured: untraced && cook !== undefined
+                ? {
+                    native: "the endpoint does not trace native transfers, so what the cook moves from the Pot is not known",
+                }
+                : {},
+        });
+    }
+    return measured;
+}
+/** The Kitchen's two cooks, whose data starts with the Pot's salt. */
+const KITCHEN_COOKS = [
+    [147, 233, 205, 239, 200, 21, 190, 159],
+    [247, 166, 195, 248, 78, 176, 147, 84],
+];
+/** The compute-budget program: a transaction's plumbing, not where it goes. */
+const COMPUTE_BUDGET = "ComputeBudget111111111111111111111111111111";
+/**
+ * What a signed Solana `transaction` moves out of `wallet` and the Pots it cooks on, as a
+ * simulation that reports its writable accounts shows it; a transaction that would fail is refused.
+ */
+export async function measureSvm(rpc, chain, wallet, transaction) {
+    const message = getCompiledTransactionMessageDecoder().decode(transaction.messageBytes);
+    const kitchen = solanaAddress(v12SvmKitchenProgramId());
+    const pots = [];
+    const programs = new Set();
+    for (const instruction of message.instructions) {
+        const program = message.staticAccounts[instruction.programAddressIndex];
+        if (program !== COMPUTE_BUDGET)
+            programs.add(program);
+        const data = instruction.data ?? new Uint8Array();
+        const owner = message.staticAccounts[instruction.accountIndices?.[0] ?? -1];
+        if (program === kitchen &&
+            owner === wallet &&
+            data.length >= 40 &&
+            KITCHEN_COOKS.some((head) => head.every((byte, at) => data[at] === byte))) {
+            pots.push((await derivePotPda(kitchen, wallet, data.slice(8, 40))).address);
+        }
+    }
+    const base = { chain, to: [...programs] };
+    const native = (amount) => ({
+        token: "native",
+        symbol: "SOL",
+        decimals: 9,
+        amount,
+    });
+    if ((message.addressTableLookups ?? []).length > 0) {
+        return {
+            ...base,
+            native: native(0n),
+            tokens: [],
+            approvals: [],
+            unmeasured: {
+                native: "it loads accounts from lookup tables, which are not measured",
+                tokens: "it loads accounts from lookup tables, which are not measured",
+            },
+        };
+    }
+    const tracked = writableAccounts(transaction);
+    const before = await accountsNow(rpc, tracked);
+    const wire = getBase64EncodedWireTransaction(transaction);
+    const { value } = await rpc
+        .simulateTransaction(wire, {
+        encoding: "base64",
+        sigVerify: false,
+        accounts: { addresses: tracked, encoding: "base64" },
+    })
+        .send();
+    if (value.err !== null) {
+        throw new CliError("the transaction would fail in the rehearsal, so nothing was sent");
+    }
+    const after = (value.accounts ?? []).map((account) => account === null
+        ? null
+        : {
+            lamports: BigInt(account.lamports),
+            owner: account.owner,
+            data: new Uint8Array(getBase64Encoder().encode(account.data[0])),
+            executable: account.executable,
+        });
+    const moved = await movedBy(rpc, chain, tracked, before, after, new Map(), wallet);
+    const ours = new Set([wallet, ...pots]);
+    const lamports = moved.lamports
+        .filter((change) => ours.has(change.account))
+        .reduce((sum, change) => sum + change.before - change.after, 0n);
+    const byMint = new Map();
+    for (const change of moved.tokens) {
+        if (!ours.has(change.owner))
+            continue;
+        const seen = byMint.get(change.mint) ?? {
+            amount: 0n,
+            ...(change.symbol === undefined ? {} : { symbol: change.symbol }),
+            ...(change.decimals === undefined ? {} : { decimals: change.decimals }),
+        };
+        byMint.set(change.mint, { ...seen, amount: seen.amount + change.before - change.after });
+    }
+    return {
+        ...base,
+        native: native(lamports > 0n ? lamports : 0n),
+        tokens: [...byMint]
+            .filter(([, out]) => out.amount > 0n)
+            .map(([token, out]) => ({ token, ...out })),
+        approvals: [],
+        unmeasured: {},
+    };
+}
+const DAY_MS = 24 * 60 * 60 * 1000;
+/** Each limit's total over the last 24 hours, at {@link SCALE}: every reservation not released. */
+function dayTotals(path, now) {
+    let text;
+    try {
+        text = readFileSync(path, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return new Map();
+        throw new CliError(`${path} is unreadable`);
+    }
+    const reserved = new Map();
+    const released = new Set();
+    for (const line of text.split("\n")) {
+        if (line.trim() === "")
+            continue;
+        let entry;
+        try {
+            entry = JSON.parse(line);
+        }
+        catch {
+            // A line cut short by a crash: what it reserved is not known, so the policy cannot be held.
+            throw new CliError(`${path} has a line that is not JSON: the day's spending cannot be counted. Look at the ` +
+                "file, and remove the broken line");
+        }
+        if (entry.state === "reserved")
+            reserved.set(entry.id, entry);
+        else if (entry.state === "released")
+            released.add(entry.id);
+    }
+    const totals = new Map();
+    for (const [id, entry] of reserved) {
+        if (released.has(id) || now - Date.parse(entry.time) >= DAY_MS)
+            continue;
+        for (const [limit, spent] of Object.entries(entry.spend)) {
+            totals.set(limit, (totals.get(limit) ?? 0n) + scaled(BigInt(spent.amount), spent.decimals));
+        }
+    }
+    return totals;
+}
+/** Appends `line` to the ledger in one write, 0600. */
+function appendLine(path, line) {
+    const fd = openSync(path, "a", 0o600);
+    try {
+        writeSync(fd, `${JSON.stringify(line)}\n`);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Runs `body` holding the wallet's lock file, so a check and its reservation are one step. */
+async function locked(path, body) {
+    for (const started = Date.now();;) {
+        try {
+            closeSync(openSync(path, "wx", 0o600));
+            break;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            // A lock older than a minute is a process that died holding it.
+            const age = Date.now() - (statSync(path, { throwIfNoEntry: false })?.mtimeMs ?? Date.now());
+            if (age > 60_000) {
+                unlinkSync(path);
+                continue;
+            }
+            if (Date.now() - started > 15_000) {
+                throw new CliError(`${path} has been held for 15s by another send: try again`);
+            }
+            await new Promise((resolve) => setTimeout(resolve, 50));
+        }
+    }
+    try {
+        return body();
+    }
+    finally {
+        unlinkSync(path);
+    }
+}
+/** Whether the policy's token key `key` names `outflow` on its chain. */
+function names(key, outflow) {
+    if (outflow.token === "native")
+        return false;
+    if (key.startsWith("0x"))
+        return outflow.token.toLowerCase() === key;
+    if (isSolanaAddress(key))
+        return outflow.token === key;
+    return outflow.symbol?.toUpperCase() === key;
+}
+const shown = (amount, outflow) => `${outflow.decimals === undefined ? `${amount} base units` : formatUnits(amount, outflow.decimals)} ${outflow.symbol ?? outflow.token}`;
+/** The registry's Permit2 on `chain`, lowercase; `undefined` where it has none. */
+function permit2Of(chain) {
+    const descriptor = getDescriptor("permit2", "Permit2");
+    return descriptor === undefined ? undefined : addressOn(descriptor, chain)?.toLowerCase();
+}
+/** What `measured` counts against each of `policy`'s limits; a refusal naming the first it breaks. */
+function spendOf(wallet, policy, measured, totals) {
+    const refuse = (limit, why) => {
+        throw new PolicyRefusal(limit, `refused by the policy of wallet ${wallet} (${policy.path}): ${why}`);
+    };
+    const { chain } = measured;
+    if (policy.chains !== undefined && !policy.chains.some((each) => each.id === chain.id)) {
+        refuse("chains", `chains allows ${policy.chains.map((each) => each.slug).join(", ")}, and this transaction is on ${chain.slug}`);
+    }
+    if (policy.to !== undefined) {
+        const off = measured.to.find((to) => !policy.to.includes(to));
+        if (off !== undefined) {
+            refuse("to", `to allows ${policy.to.length} address(es), and this transaction goes to ${off}`);
+        }
+    }
+    const spend = {};
+    const hold = (limitName, limit, amount, unit) => {
+        if (unit.decimals === undefined) {
+            refuse(limitName, `the decimals of ${unit.symbol ?? unit.token} could not be read, so it cannot be held to the limit`);
+        }
+        const value = scaled(amount, unit.decimals);
+        const text = (at) => `${whole(at)} ${unit.symbol ?? unit.token}`;
+        if (limit.perTransaction !== undefined) {
+            const cap = limitScaled(limit.perTransaction, unit.decimals);
+            if (value > cap) {
+                refuse(`${limitName}.perTransaction`, `${limitName}.perTransaction is ${text(cap)}, and this transaction sends ${shown(amount, unit)}`);
+            }
+        }
+        if (limit.perDay !== undefined) {
+            const cap = limitScaled(limit.perDay, unit.decimals);
+            const before = totals.get(limitName) ?? 0n;
+            if (before + value > cap) {
+                refuse(`${limitName}.perDay`, `${limitName}.perDay is ${text(cap)}; ${text(before)} went in the last 24 hours, and ` +
+                    `this transaction sends ${shown(amount, unit)}`);
+            }
+        }
+        if (amount > 0n)
+            spend[limitName] = { amount: amount.toString(), decimals: unit.decimals };
+    };
+    if (policy.native !== undefined) {
+        if (measured.unmeasured.native !== undefined) {
+            refuse("native", `native is limited, and ${measured.unmeasured.native}`);
+        }
+        hold("native", policy.native, measured.native.amount, measured.native);
+    }
+    for (const [key, limit] of policy.tokens) {
+        if (measured.unmeasured.tokens !== undefined) {
+            refuse(`tokens.${key}`, `tokens.${key} is limited, and ${measured.unmeasured.tokens}`);
+        }
+        const matching = measured.tokens.filter((outflow) => names(key, outflow));
+        for (const outflow of matching)
+            hold(`tokens.${key}`, limit, outflow.amount, outflow);
+        const permit2 = permit2Of(chain);
+        for (const approval of measured.approvals.filter((each) => names(key, each))) {
+            if (approval.spender.toLowerCase() === permit2 || approval.decimals === undefined)
+                continue;
+            const value = scaled(approval.amount, approval.decimals);
+            const caps = [
+                limit.perTransaction === undefined
+                    ? undefined
+                    : limitScaled(limit.perTransaction, approval.decimals),
+                limit.perDay === undefined
+                    ? undefined
+                    : limitScaled(limit.perDay, approval.decimals) - (totals.get(`tokens.${key}`) ?? 0n),
+            ].filter((cap) => cap !== undefined);
+            const cap = caps.length === 0 ? undefined : caps.reduce((a, b) => (a < b ? a : b));
+            if (cap !== undefined && value > cap) {
+                refuse(`tokens.${key}`, `this transaction approves ${approval.spender} for ${shown(approval.amount, approval)}, ` +
+                    `more than the ${whole(cap > 0n ? cap : 0n)} ${approval.symbol ?? approval.token} tokens.${key} leaves room for`);
+            }
+        }
+    }
+    return spend;
+}
+const NOTHING = { sent: () => undefined, released: () => undefined };
+/**
+ * The release's chain gate (`support.ts#requireSupported`), for every send a wallet makes: wallets
+ * send only where the release sends at all, so a raw transaction a wallet is handed is held to it
+ * as a built one is — refused on a preview chain before anything is measured, signed or sent.
+ */
+const releaseGate = (chain) => requireSupported("sending from a wallet", [chain]);
+/** A wallet's guard: its policy (if any), and the ledger and lock beside it. */
+export class SendGuard {
+    wallet;
+    policy;
+    ledger;
+    lock;
+    constructor(wallet, policy) {
+        this.wallet = wallet;
+        this.policy = policy;
+        const dir = wallet.policyPath.slice(0, -`${wallet.name}.policy.json`.length);
+        this.ledger = join(dir, `${wallet.name}.ledger.jsonl`);
+        this.lock = join(dir, `${wallet.name}.lock`);
+    }
+    /** Every check before a send that does not need what the transaction moves. */
+    gate(chain) {
+        releaseGate(chain);
+    }
+    /**
+     * Checks a plan's transactions against the policy before any is sent: each one's limits, and
+     * the day's totals with the earlier ones counted. Nothing is reserved; each is again when sent.
+     */
+    async preflight(measured) {
+        for (const each of measured)
+            this.gate(each.chain);
+        const policy = this.policy;
+        if (policy === undefined)
+            return;
+        await locked(this.lock, () => {
+            const totals = dayTotals(this.ledger, Date.now());
+            for (const each of measured) {
+                for (const [limit, spent] of Object.entries(spendOf(this.wallet.name, policy, each, totals))) {
+                    totals.set(limit, (totals.get(limit) ?? 0n) + scaled(BigInt(spent.amount), spent.decimals));
+                }
+            }
+        });
+    }
+    /** Checks one transaction and reserves what it spends, in one step under the lock. */
+    async reserve(policy, measured) {
+        const id = randomUUID();
+        const ledger = this.ledger;
+        const close = (line) => appendLine(ledger, line);
+        return locked(this.lock, () => {
+            const spend = spendOf(this.wallet.name, policy, measured, dayTotals(ledger, Date.now()));
+            close({
+                v: 1,
+                id,
+                state: "reserved",
+                time: new Date().toISOString(),
+                chain: measured.chain.slug,
+                spend,
+            });
+            return {
+                sent: (tx) => close({ v: 1, id, state: "sent", time: new Date().toISOString(), tx }),
+                released: (why) => close({ v: 1, id, state: "released", time: new Date().toISOString(), why }),
+            };
+        });
+    }
+    /** Measures and reserves one EVM transaction, just before it is sent. */
+    async evm(client, tx) {
+        const chain = requireChain(await client.getChainId());
+        this.gate(chain);
+        if (this.policy === undefined)
+            return NOTHING;
+        const [measured] = await measureEvm(client, chain, getAddress(this.wallet.address), [tx]);
+        return this.reserve(this.policy, measured);
+    }
+    /** Measures and reserves one signed Solana transaction, just before it is sent. */
+    async svm(rpc, transaction) {
+        const chain = requireChain("solana");
+        this.gate(chain);
+        if (this.policy === undefined)
+            return NOTHING;
+        const measured = await measureSvm(rpc, chain, solanaAddress(this.wallet.address), transaction);
+        return this.reserve(this.policy, measured);
+    }
+}
+/** Every wallet this process has unlocked, by address: the guard its sends pass. */
+const guards = new Map();
+/** Guards the wallet `info`: from now on every send from its address passes its policy. */
+export function guardWallet(info, policy) {
+    const guard = new SendGuard(info, policy);
+    guards.set(keyOf(info.address), guard);
+    return guard;
+}
+const keyOf = (address) => address.startsWith("0x") ? address.toLowerCase() : address;
+/** The guard of the wallet at `address`, if this process unlocked one there. */
+export const guardOf = (address) => guards.get(keyOf(address));
+//# sourceMappingURL=policy.js.map