@engramx/idl 0.16.0-rc.19 → 0.16.0-rc.20

package/dist/engram.did

@@ -70,9 +70,13 @@ type TimersWake =
 type TimerHealth = 
  record {
    alertTimerArmed: bool;
+   checkInsUnfinished: opt nat;
+   ic402Maintenance: opt Ic402Maintenance;
+   ic402MaintenanceTimerArmed: opt bool;
    jobExpiryArmed: bool;
    jobExpiryFastMode: bool;
    sessionExpiryArmed: bool;
+   upkeepRejected: opt nat;
  };
 type StorageReport = 
  record {
@@ -727,6 +731,17 @@ type PurgedAgent =
    purgedAtNs: int;
    root: principal;
  };
+type PaymentsStop = 
+ variant {
+   dailySignatureLimit;
+   paymentsBrake;
+   signingFloor;
+ };
+type PaymentsNow = 
+ record {
+   largestPayment: opt nat;
+   leftToday: opt nat;
+ };
 type PaymentSignatureCounts = 
  record {
    agents: Page_5;
@@ -1149,6 +1164,15 @@ type KeyNomination =
    atNs: int;
    key: principal;
  };
+type Ic402Maintenance = 
+ record {
+   dailySpendRemoved: nat;
+   lastRunAtNs: int;
+   more: bool;
+   rateLimitRemoved: nat;
+   revokedGrantsRemoved: nat;
+   runs: nat;
+ };
 type HttpResponse = 
  record {
    body: blob;
@@ -1567,6 +1591,16 @@ type Engram =
    /// 
    /// A principal that is already a GUARDIAN cannot become an agent — a guardian is an
    /// independent check on agents, so one wallet must not hold both.
+   /// 
+   /// ⟨2026-10-29, the owner's ruling "a"⟩ `name` MAY BE EMPTY (or only whitespace): the agent is then
+   /// named after its key when it pairs — "agent-" and the key's first five characters, e.g.
+   /// "agent-hsffu" (`People.nameAtPairing` says why five, and the first). ⟨2026-10-29, later, beside "its key"⟩ Its
+   /// PERMANENT key (the root it enrolled with), not the key that pairs, so the name stays right across
+   /// a key replacement and matches the app's "Copy permanent key". A name the owner gives
+   /// always wins. Before this an empty name was refused, so an app that wanted no name had to invent
+   /// one ("agent"), and two agents read alike.
+   /// ⟨2026-10-29, review F7⟩ A name the owner gives meets the rule `renameAgent` applies: a line break
+   /// or another control character is `#Invalid` (`People.nameRefusal`), as a rename to it would be.
    createAgentInvite: (name: text, permissions: AgentPermissions) ->
     (Result_53);
    /// Owner-only: mint an invite for a GUARDIAN — an independent check on agents, not a
@@ -2124,6 +2158,14 @@ type Engram =
    /// The pause's id sweep cancels ic402's sweeps, but ic402 keeps their stale ids, so its own
    /// "armed" reads would answer true for a timer that no longer exists (a fabricated answer,
    /// ADR-0002). `alertTimerArmed` needs no guard: the sweep nulls `alertTimerId` itself.
+   /// ⟨2026-10-29, the owner's ruling "A", beside the line above⟩ …the sweep zeroes the arm, and an arm
+   /// past its due time reads stale. `alertTimerArmed` is TRUE ONLY WHILE A DELIVERY IS OWED OR RETRYING
+   /// (the alert drain is a one-shot armed per owed delivery); alerts configured on a quiet engram read
+   /// false, and that is correct — the IDLE STEADY STATE line above now holds with a webhook set too.
+   /// It reads the arm's DUE TIME, not only its id (`ActionAlerts.armLive`): a job that traps before its
+   /// first await rolls back its own `alertTimerId := null`, so a bare id would read armed forever.
+   /// ONE BOUNDED UNTRUTH (the spec's critic, F12): for ARM_STALE_NS (120 s) after the due time of such a
+   /// trapped job, the flag reads true although no timer exists.
    getTimerHealth: () -> (TimerHealth) query;
    /// PUBLIC: a cap identifies no user, and a caller deserves to know the rule before it stops them.
    /// 
@@ -2758,6 +2800,13 @@ type Engram =
    /// owner by name (`People.OWNER_HAS_NO_GRANT`), a revoked or resigned agent ("Agent is revoked" /
    /// "Agent has resigned" — an ended agent may do nothing, and its old grant would read as powers),
    /// a guardian and a stranger ("Not authorized"), the anonymous caller. A query: it writes nothing.
+   /// 
+   /// ⟨2026-10-29, the owner's ruling "b: fix"⟩ It also says whether the payments brake is on and what
+   /// the key could pay now (`paymentsFrozen`, `paymentsNow`), read from the values `x402SignFor`
+   /// checks — the brake, the key's policy and stored total, the engram-wide ceiling and total — so
+   /// the caps alone no longer read as money an agent can spend. `People.SpendState` names each one.
+   /// ⟨2026-10-29, review F2⟩ And which whole-key refusal stops every payment now, if one does
+   /// (`paymentsStoppedBy`: the brake, the signing floor, the daily count of payment signatures).
    myGrant: () -> (Result_26) query;
    /// The AGENT's current key nominates the key that will replace it. Nothing moves yet: the new
    /// key must accept, by its own call, within 24 hours (`acceptAgentKeyNomination`). One pending
@@ -3349,7 +3398,8 @@ type Engram =
    sessionReadMemory: (voucher: Voucher, path: text) -> (Result_12);
    /// Configure action alerts: an https webhook that receives new chained-audit entries matching the
    /// enabled event classes (money / approvals / guardian / agentWrites), batched, at most one
-   /// POST per minute. Owner-only. Payloads carry audit METADATA (operation, caller, role, bounded
+   /// POST per minute. ⟨2026-10-29⟩ Delivered within seconds of the action (a 5 s batch window), and
+   /// nothing runs while nothing is owed. Owner-only. Payloads carry audit METADATA (operation, caller, role, bounded
    /// details) — never memory file contents. Setting a URL (re)arms delivery FROM NOW: the cursor
    /// jumps to the current end of the log so history is not replayed. Passing url = null disables.
    /// The URL itself is never written to the audit log (webhook URLs often embed secret tokens).
@@ -3976,10 +4026,12 @@ type Engram =
     text, amount: nat, tokenName: text, tokenVersion: text, rationale:
     opt text, approvalId: opt text) -> (Result_4);
    /// Write an `alerts.test` entry into the audit log; the drain timer delivers it to the webhook
-   /// within ~60s. Owner-only; requires a configured URL so the test can actually go somewhere.
+   /// within ~60s. ⟨2026-10-29, beside "within ~60s"⟩ Within seconds (a minute if a delivery was just
+   /// made). Owner-only; requires a configured URL so the test can actually go somewhere.
    testActionAlert: () -> (Result_2);
    /// Guardian test alert — an audited guardian action (`alerts.test`, role Guardian) that every
-   /// armed channel (owner + guardians) receives within ~60s. Requires the caller's own channel
+   /// armed channel (owner + guardians) receives within ~60s (⟨2026-10-29⟩ within seconds; a minute if
+   /// a delivery was just made). Requires the caller's own channel
    /// to be armed so the test has somewhere to land for them.
    testGuardianAlert: () -> (Result_2);
    /// RENAMED from `init` (L2.4). This is the OWNERSHIP-TRANSFER method — the most consequential
@@ -4396,8 +4448,11 @@ type AnchorPushStatus =
    attemptTotal: nat;
    cadenceSeconds: nat;
    carrierArmedAtNs: int;
+   checkInIntervalSeconds: opt nat;
    currentTotal: nat;
    lastError: text;
+   nextAnchorAttemptAtNs: opt int;
+   nextCheckInDueAtNs: opt int;
    okAtNs: opt int;
    okTotal: nat;
    skipCursor: nat;
@@ -4498,6 +4553,9 @@ type AgentGrant =
    key: principal;
    name: text;
    paymentLimits: PaymentLimits;
+   paymentsFrozen: opt bool;
+   paymentsNow: opt PaymentsNow;
+   paymentsStoppedBy: opt PaymentsStop;
    permissions: AgentPermissions;
  };
 type AgentEnding = 
@@ -4534,12 +4592,14 @@ type ActionAuth =
  };
 type About = 
  record {
+   activeAgentCount: opt nat;
    agentCount: nat;
    agentMemoryReads: nat;
    agentMemoryWrites: nat;
    auditLogSize: nat;
    backupCount: nat;
    encryptionEnabled: bool;
+   endedAgentCount: opt nat;
    firstAgentWriteAtNs: opt int;
    firstWriteAtNs: opt int;
    guardianCount: nat;

package/dist/engram.idl.d.ts

@@ -10,9 +10,11 @@ export interface About {
   lastWriteAtNs: [] | [bigint];
   totalBackupSize: bigint;
   backupCount: bigint;
+  endedAgentCount: [] | [bigint];
   lastAgentReadAtNs: [] | [bigint];
   firstWriteAtNs: [] | [bigint];
   agentCount: bigint;
+  activeAgentCount: [] | [bigint];
   paidMemoryReadEnabled: boolean;
   version: string;
   timersPausedSinceDayNs: [] | [bigint];
@@ -59,6 +61,9 @@ export interface AgentGrant {
   key: Principal;
   permissions: AgentPermissions;
   name: string;
+  paymentsStoppedBy: [] | [PaymentsStop];
+  paymentsFrozen: [] | [boolean];
+  paymentsNow: [] | [PaymentsNow];
   paymentLimits: PaymentLimits;
 }
 export interface AgentPaymentSignatures {
@@ -140,12 +145,15 @@ export interface AnchorPushStatus {
   currentTotal: bigint;
   timerTickAtNs: [] | [bigint];
   okTotal: bigint;
+  checkInIntervalSeconds: [] | [bigint];
   carrierArmedAtNs: bigint;
   attemptAtNs: [] | [bigint];
   skipCursor: bigint;
   timersPauseReason: [] | [string];
   lastError: string;
+  nextCheckInDueAtNs: [] | [bigint];
   timersPausedAtNs: [] | [bigint];
+  nextAnchorAttemptAtNs: [] | [bigint];
 }
 export interface ApprovalRequest {
   id: string;
@@ -676,6 +684,16 @@ export interface Engram {
    * /
    * / A principal that is already a GUARDIAN cannot become an agent — a guardian is an
    * / independent check on agents, so one wallet must not hold both.
+   * /
+   * / ⟨2026-10-29, the owner's ruling "a"⟩ `name` MAY BE EMPTY (or only whitespace): the agent is then
+   * / named after its key when it pairs — "agent-" and the key's first five characters, e.g.
+   * / "agent-hsffu" (`People.nameAtPairing` says why five, and the first). ⟨2026-10-29, later, beside "its key"⟩ Its
+   * / PERMANENT key (the root it enrolled with), not the key that pairs, so the name stays right across
+   * / a key replacement and matches the app's "Copy permanent key". A name the owner gives
+   * / always wins. Before this an empty name was refused, so an app that wanted no name had to invent
+   * / one ("agent"), and two agents read alike.
+   * / ⟨2026-10-29, review F7⟩ A name the owner gives meets the rule `renameAgent` applies: a line break
+   * / or another control character is `#Invalid` (`People.nameRefusal`), as a rename to it would be.
    */
   createAgentInvite: ActorMethod<[string, AgentPermissions], Result_53>;
   /**
@@ -1316,6 +1334,14 @@ export interface Engram {
    * / The pause's id sweep cancels ic402's sweeps, but ic402 keeps their stale ids, so its own
    * / "armed" reads would answer true for a timer that no longer exists (a fabricated answer,
    * / ADR-0002). `alertTimerArmed` needs no guard: the sweep nulls `alertTimerId` itself.
+   * / ⟨2026-10-29, the owner's ruling "A", beside the line above⟩ …the sweep zeroes the arm, and an arm
+   * / past its due time reads stale. `alertTimerArmed` is TRUE ONLY WHILE A DELIVERY IS OWED OR RETRYING
+   * / (the alert drain is a one-shot armed per owed delivery); alerts configured on a quiet engram read
+   * / false, and that is correct — the IDLE STEADY STATE line above now holds with a webhook set too.
+   * / It reads the arm's DUE TIME, not only its id (`ActionAlerts.armLive`): a job that traps before its
+   * / first await rolls back its own `alertTimerId := null`, so a bare id would read armed forever.
+   * / ONE BOUNDED UNTRUTH (the spec's critic, F12): for ARM_STALE_NS (120 s) after the due time of such a
+   * / trapped job, the flag reads true although no timer exists.
    */
   getTimerHealth: ActorMethod<[], TimerHealth>;
   /**
@@ -2022,6 +2048,13 @@ export interface Engram {
    * / owner by name (`People.OWNER_HAS_NO_GRANT`), a revoked or resigned agent ("Agent is revoked" /
    * / "Agent has resigned" — an ended agent may do nothing, and its old grant would read as powers),
    * / a guardian and a stranger ("Not authorized"), the anonymous caller. A query: it writes nothing.
+   * /
+   * / ⟨2026-10-29, the owner's ruling "b: fix"⟩ It also says whether the payments brake is on and what
+   * / the key could pay now (`paymentsFrozen`, `paymentsNow`), read from the values `x402SignFor`
+   * / checks — the brake, the key's policy and stored total, the engram-wide ceiling and total — so
+   * / the caps alone no longer read as money an agent can spend. `People.SpendState` names each one.
+   * / ⟨2026-10-29, review F2⟩ And which whole-key refusal stops every payment now, if one does
+   * / (`paymentsStoppedBy`: the brake, the signing floor, the daily count of payment signatures).
    */
   myGrant: ActorMethod<[], Result_26>;
   /**
@@ -2677,7 +2710,8 @@ export interface Engram {
   /**
    * / Configure action alerts: an https webhook that receives new chained-audit entries matching the
    * / enabled event classes (money / approvals / guardian / agentWrites), batched, at most one
-   * / POST per minute. Owner-only. Payloads carry audit METADATA (operation, caller, role, bounded
+   * / POST per minute. ⟨2026-10-29⟩ Delivered within seconds of the action (a 5 s batch window), and
+   * / nothing runs while nothing is owed. Owner-only. Payloads carry audit METADATA (operation, caller, role, bounded
    * / details) — never memory file contents. Setting a URL (re)arms delivery FROM NOW: the cursor
    * / jumps to the current end of the log so history is not replayed. Passing url = null disables.
    * / The URL itself is never written to the audit log (webhook URLs often embed secret tokens).
@@ -3373,12 +3407,14 @@ export interface Engram {
   >;
   /**
    * / Write an `alerts.test` entry into the audit log; the drain timer delivers it to the webhook
-   * / within ~60s. Owner-only; requires a configured URL so the test can actually go somewhere.
+   * / within ~60s. ⟨2026-10-29, beside "within ~60s"⟩ Within seconds (a minute if a delivery was just
+   * / made). Owner-only; requires a configured URL so the test can actually go somewhere.
    */
   testActionAlert: ActorMethod<[], Result_2>;
   /**
    * / Guardian test alert — an audited guardian action (`alerts.test`, role Guardian) that every
-   * / armed channel (owner + guardians) receives within ~60s. Requires the caller's own channel
+   * / armed channel (owner + guardians) receives within ~60s (⟨2026-10-29⟩ within seconds; a minute if
+   * / a delivery was just made). Requires the caller's own channel
    * / to be armed so the test has somewhere to land for them.
    */
   testGuardianAlert: ActorMethod<[], Result_2>;
@@ -3592,6 +3628,14 @@ export interface HttpResponse {
   upgrade: [] | [boolean];
   status_code: number;
 }
+export interface Ic402Maintenance {
+  revokedGrantsRemoved: bigint;
+  dailySpendRemoved: bigint;
+  more: boolean;
+  runs: bigint;
+  rateLimitRemoved: bigint;
+  lastRunAtNs: bigint;
+}
 export interface KeyNomination {
   key: Principal;
   atNs: bigint;
@@ -3946,6 +3990,12 @@ export interface PaymentSignatureCounts {
   agents: Page_5;
   limit: bigint;
 }
+export interface PaymentsNow {
+  leftToday: [] | [bigint];
+  largestPayment: [] | [bigint];
+}
+export type PaymentsStop =
+  { paymentsBrake: null } | { dailySignatureLimit: null } | { signingFloor: null };
 export interface PurgedAgent {
   principal: Principal;
   pairedAtNs: bigint;
@@ -4237,8 +4287,12 @@ export interface StorageReport {
 export interface TimerHealth {
   jobExpiryFastMode: boolean;
   jobExpiryArmed: boolean;
+  ic402Maintenance: [] | [Ic402Maintenance];
   alertTimerArmed: boolean;
+  upkeepRejected: [] | [bigint];
   sessionExpiryArmed: boolean;
+  ic402MaintenanceTimerArmed: [] | [boolean];
+  checkInsUnfinished: [] | [bigint];
 }
 export interface TimersWake {
   gap: bigint;

package/dist/engram.idl.js

@@ -7,9 +7,11 @@ export const idlFactory = ({ IDL }) => {
     lastWriteAtNs: IDL.Opt(IDL.Int),
     totalBackupSize: IDL.Nat,
     backupCount: IDL.Nat,
+    endedAgentCount: IDL.Opt(IDL.Nat),
     lastAgentReadAtNs: IDL.Opt(IDL.Int),
     firstWriteAtNs: IDL.Opt(IDL.Int),
     agentCount: IDL.Nat,
+    activeAgentCount: IDL.Opt(IDL.Nat),
     paidMemoryReadEnabled: IDL.Bool,
     version: IDL.Text,
     timersPausedSinceDayNs: IDL.Opt(IDL.Int),
@@ -247,12 +249,15 @@ export const idlFactory = ({ IDL }) => {
     currentTotal: IDL.Nat,
     timerTickAtNs: IDL.Opt(IDL.Int),
     okTotal: IDL.Nat,
+    checkInIntervalSeconds: IDL.Opt(IDL.Nat),
     carrierArmedAtNs: IDL.Int,
     attemptAtNs: IDL.Opt(IDL.Int),
     skipCursor: IDL.Nat,
     timersPauseReason: IDL.Opt(IDL.Text),
     lastError: IDL.Text,
+    nextCheckInDueAtNs: IDL.Opt(IDL.Int),
     timersPausedAtNs: IDL.Opt(IDL.Int),
+    nextAnchorAttemptAtNs: IDL.Opt(IDL.Int),
   });
   const AuditHead = IDL.Record({
     headHash: IDL.Vec(IDL.Nat8),
@@ -479,11 +484,23 @@ export const idlFactory = ({ IDL }) => {
     sessionFilesCount: IDL.Nat,
   });
   const Result_59 = IDL.Variant({ Ok: StorageReport, Err: Error });
+  const Ic402Maintenance = IDL.Record({
+    revokedGrantsRemoved: IDL.Nat,
+    dailySpendRemoved: IDL.Nat,
+    more: IDL.Bool,
+    runs: IDL.Nat,
+    rateLimitRemoved: IDL.Nat,
+    lastRunAtNs: IDL.Int,
+  });
   const TimerHealth = IDL.Record({
     jobExpiryFastMode: IDL.Bool,
     jobExpiryArmed: IDL.Bool,
+    ic402Maintenance: IDL.Opt(Ic402Maintenance),
     alertTimerArmed: IDL.Bool,
+    upkeepRejected: IDL.Opt(IDL.Nat),
     sessionExpiryArmed: IDL.Bool,
+    ic402MaintenanceTimerArmed: IDL.Opt(IDL.Bool),
+    checkInsUnfinished: IDL.Opt(IDL.Nat),
   });
   const WalletBalances = IDL.Record({
     icpE8s: IDL.Nat,
@@ -965,6 +982,15 @@ export const idlFactory = ({ IDL }) => {
     items: IDL.Vec(SignIn),
   });
   const Result_27 = IDL.Variant({ Ok: Page, Err: Error });
+  const PaymentsStop = IDL.Variant({
+    paymentsBrake: IDL.Null,
+    dailySignatureLimit: IDL.Null,
+    signingFloor: IDL.Null,
+  });
+  const PaymentsNow = IDL.Record({
+    leftToday: IDL.Opt(IDL.Nat),
+    largestPayment: IDL.Opt(IDL.Nat),
+  });
   const PaymentLimits = IDL.Record({
     maxSessionDeposit: IDL.Opt(IDL.Nat),
     maxPerDay: IDL.Opt(IDL.Nat),
@@ -978,6 +1004,9 @@ export const idlFactory = ({ IDL }) => {
     key: IDL.Principal,
     permissions: AgentPermissions,
     name: IDL.Text,
+    paymentsStoppedBy: IDL.Opt(PaymentsStop),
+    paymentsFrozen: IDL.Opt(IDL.Bool),
+    paymentsNow: IDL.Opt(PaymentsNow),
     paymentLimits: PaymentLimits,
   });
   const Result_26 = IDL.Variant({ Ok: AgentGrant, Err: Error });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@engramx/idl",
-  "version": "0.16.0-rc.19",
+  "version": "0.16.0-rc.20",
   "description": "The Candid interfaces of the EngramX canisters (engram, registry, market) — the .did files and the JS/TS IDL factories generated from them, published with every release so code that calls them pins the interface by version.",
   "license": "Apache-2.0",
   "author": "EngramX <developer@engramx.ai>",