@elisym/cli 0.28.0 → 0.29.0

package/dist/index.js

@@ -5318,7 +5318,15 @@ var AgentRuntime = class {
           return;
         }
         this.ledger.recordDeliveredContent(job.jobId, deliveredContent);
+        delegatedPull.chargedSubunits = this.resolveMeteredCharge(
+          job,
+          matched,
+          delegatedPull.priceSubunits,
+          output.chargeSubunits,
+          log
+        );
         const outcome = await this.executeDelegatedPull(job, delegatedPull, log);
+        netAmount = Number(delegatedPull.chargedSubunits ?? delegatedPull.priceSubunits);
         if (outcome === "dead") {
           this.ledger.markFailed(job.jobId);
           await this.transport.sendFeedback(job, {
@@ -5353,6 +5361,59 @@ var AgentRuntime = class {
       }
     }
   }
+  /**
+   * Decide what a delegated pull should move, for a skill that opted into
+   * metered pricing.
+   *
+   * The skill reports a figure through `ELISYM_CHARGE_FILE`; we clamp it into
+   * the range the CARD published, so the buyer can never be billed above the
+   * `price` they approved nor below the `min` they were quoted. A skill that is
+   * not metered, or one that reported nothing usable, charges the ceiling -
+   * that is exactly today's behaviour and exactly what the buyer consented to,
+   * so a provider-side bug costs the provider nothing and surprises no one.
+   * The "reported nothing" case is logged loudly because on a metered skill it
+   * means the script is broken, not that the job was cheap.
+   *
+   * Returns `undefined` to mean "charge the ceiling", which is what every
+   * caller already falls back to.
+   */
+  resolveMeteredCharge(job, skill, ceiling, reported, log) {
+    const floor = skill?.meteredMinSubunits;
+    if (floor === void 0) {
+      return void 0;
+    }
+    if (typeof floor !== "bigint" || floor <= 0n) {
+      log(
+        `[${job.jobId.slice(0, 8)}] Metered skill has an unusable floor (${String(floor)}) - billing the ${ceiling} ceiling.`
+      );
+      return void 0;
+    }
+    if (reported !== void 0 && typeof reported !== "bigint") {
+      log(
+        `[${job.jobId.slice(0, 8)}] Metered skill reported a non-bigint charge - billing the ${ceiling} ceiling.`
+      );
+      return void 0;
+    }
+    if (reported === void 0) {
+      log(
+        `[${job.jobId.slice(0, 8)}] Metered skill reported no charge - billing the ${ceiling} ceiling. The script should write its cost in subunits to ELISYM_CHARGE_FILE.`
+      );
+      return void 0;
+    }
+    let charged = reported;
+    if (charged < floor) {
+      charged = floor;
+    }
+    if (charged > ceiling) {
+      charged = ceiling;
+    }
+    if (charged !== reported) {
+      log(
+        `[${job.jobId.slice(0, 8)}] Metered charge ${reported} clamped to ${charged} (published range ${floor}..${ceiling}).`
+      );
+    }
+    return charged;
+  }
   reserveDelegation(owner, amount) {
     this.delegationInFlight.set(owner, (this.delegationInFlight.get(owner) ?? 0n) + amount);
   }
@@ -5484,13 +5545,13 @@ var AgentRuntime = class {
         "the delegation account balance is below this skill price."
       );
     }
-    this.reserveDelegation(request.owner, priceSubunits);
     log(
       `[${job.jobId.slice(0, 8)}] Delegated pre-check ok: ${formatAssetAmount(
         delegationAsset,
         priceSubunits
       )} from ${request.owner.slice(0, 8)}... (pull after work)`
     );
+    this.reserveDelegation(request.owner, priceSubunits);
     return { request, delegateSigner, ownerAta, priceSubunits, rpc, network };
   }
   /**
@@ -5504,11 +5565,12 @@ var AgentRuntime = class {
       throw new Error("Solana address not configured");
     }
     const destinationAta = await deriveOwnerDelegationAta(this.config.solanaAddress, ctx.network);
+    const amount = ctx.chargedSubunits ?? ctx.priceSubunits;
     const instructions = await buildDelegatedTransfer({
       delegate: ctx.delegateSigner,
       source: ctx.ownerAta,
       destination: destinationAta,
-      amount: ctx.priceSubunits,
+      amount,
       network: ctx.network,
       // Idempotent create (delegate-paid rent) so a fresh provider wallet's
       // first delegated job does not dead-letter on a missing ATA.
@@ -5521,11 +5583,13 @@ var AgentRuntime = class {
       job.jobId,
       pull.signature,
       Number(pull.lastValidBlockHeight),
-      Number(ctx.priceSubunits)
+      Number(amount)
     );
     ctx.pullSignature = pull.signature;
     const outcome = await sendConfirmToTerminal(ctx.rpc, pull, {});
-    log(`[${job.jobId.slice(0, 8)}] Delegated pull ${outcome}: ${pull.signature.slice(0, 16)}...`);
+    log(
+      `[${job.jobId.slice(0, 8)}] Delegated pull ${outcome}: ${amount} subunits, ${pull.signature.slice(0, 16)}...`
+    );
     return outcome;
   }
   /**
@@ -7025,6 +7089,9 @@ function buildCliSkill(parsed, entryPath, scriptEnv, network) {
   if (parsed.executionTimeoutSecs !== void 0) {
     skill.executionTimeoutSecs = parsed.executionTimeoutSecs;
   }
+  if (parsed.meteredMinSubunits !== void 0) {
+    skill.meteredMinSubunits = parsed.meteredMinSubunits;
+  }
   if (parsed.delegation) {
     skill.delegation = parsed.delegation;
   }
@@ -8926,6 +8993,19 @@ function buildCapabilityCard(skill, inputs) {
     // exists (delegatePubkey resolved). The pubkey is injected here, never
     // taken from the SKILL.md - the operator declares only the cap/mechanism.
     ...skill.delegation && delegatePubkey ? { delegation: { ...skill.delegation, delegate_pubkey: delegatePubkey } } : {},
+    // Metered descriptor. The gate is COMPOUND on purpose and both halves
+    // matter: `delegatePubkey` is agent-wide (hoisted when ANY skill declares
+    // delegation), while `skill.delegation` is per-skill. Stamping on the agent
+    // half alone would advertise pay-per-use on a card that ships no delegation
+    // block - the buyer would be told "you pay for what you use" while the only
+    // rail they can reach charges the ceiling. The loader already refuses
+    // `metered` without `delegation`, so this is defence in depth.
+    // `solanaAddress` is in the gate too: without it the `payment` block below
+    // is omitted, and a metered descriptor with no price to clamp against is
+    // incoherent by construction - the write-side mirror would then reject the
+    // card with a misleading "malformed metered descriptor" instead of the real
+    // reason, which is that the agent has no payment address.
+    ...skill.meteredMinSubunits !== void 0 && skill.delegation && delegatePubkey && solanaAddress ? { metered: { min_subunits: skill.meteredMinSubunits.toString() } } : {},
     // On-chain promise (`mode: onchain`): the network is stamped from the
     // agent's wallet here, never from SKILL.md, so a capability copied between
     // a devnet and a mainnet agent cannot advertise the wrong chain.