@event4u/agent-config 14.20.0 → 14.22.0

package/dist/cli-delegate/{chunk-KPBWFOPZ.js → chunk-2FTMENJL.js}

@@ -81,7 +81,7 @@ __export(clients_exports, {
   record_cli_call: () => record_cli_call,
   reset_cli_call_counts: () => reset_cli_call_counts
 });
-import { spawnSync } from "node:child_process";
+import { spawnSync as spawnSync2 } from "node:child_process";
 import * as fs3 from "node:fs";
 import * as os from "node:os";
 import * as path3 from "node:path";
@@ -205,6 +205,88 @@ function boundFor(member) {
   return AGENCY_BOUNDS.find((b) => b.member === member)?.bound ?? [];
 }
 
+// src/scripts/ai_council/api_transport.ts
+import { spawnSync } from "node:child_process";
+var GEMINI_BASE_URL = "https://generativelanguage.googleapis.com/v1beta";
+function curlJsonPost(url, extraHeaders, body) {
+  const args = ["-sS", "-X", "POST", url, "-H", "content-type: application/json"];
+  for (const h of extraHeaders) {
+    args.push("-H", h);
+  }
+  args.push("--connect-timeout", "30", "--max-time", "290");
+  args.push("-w", "\n%{http_code}", "--data-binary", "@-");
+  const r = spawnSync("curl", args, {
+    input: JSON.stringify(body),
+    encoding: "utf8",
+    maxBuffer: 64 * 1024 * 1024,
+    timeout: 3e5
+  });
+  if (r.error) {
+    throw new Error(`curl spawn failed: ${r.error.message}`);
+  }
+  if (r.status !== 0) {
+    throw new Error(
+      `curl exited ${r.status ?? "null"}: ${(r.stderr ?? "").toString().slice(0, 500)}`
+    );
+  }
+  const out = (r.stdout ?? "").toString();
+  const nl = out.lastIndexOf("\n");
+  const httpCode = (nl >= 0 ? out.slice(nl + 1) : out).trim();
+  const bodyText = nl >= 0 ? out.slice(0, nl) : out;
+  if (!/^2\d\d$/.test(httpCode)) {
+    throw new Error(`HTTP ${httpCode}: ${bodyText.slice(0, 500)}`);
+  }
+  return JSON.parse(bodyText);
+}
+function openAiCompatibleClient(baseUrl, apiKey, post = curlJsonPost) {
+  const url = `${baseUrl.replace(/\/+$/, "")}/chat/completions`;
+  return {
+    chat: {
+      completions: {
+        create: (kwargs) => post(url, [`authorization: Bearer ${apiKey}`], kwargs)
+      }
+    }
+  };
+}
+function geminiRestClient(apiKey, post = curlJsonPost, baseUrl = GEMINI_BASE_URL) {
+  return {
+    models: {
+      generate_content: (kwargs) => {
+        const model = String(kwargs["model"] ?? "");
+        const cfg = kwargs["config"] ?? {};
+        const url = `${baseUrl.replace(/\/+$/, "")}/models/${model}:generateContent`;
+        const raw = post(
+          url,
+          [`x-goog-api-key: ${apiKey}`],
+          {
+            contents: [{ role: "user", parts: [{ text: String(kwargs["contents"] ?? "") }] }],
+            generationConfig: { maxOutputTokens: cfg["max_output_tokens"] ?? null }
+          }
+        );
+        return normaliseGeminiRest(raw);
+      }
+    }
+  };
+}
+function normaliseGeminiRest(raw) {
+  const env = raw ?? {};
+  const candidates = Array.isArray(env["candidates"]) ? env["candidates"] : [];
+  const first = candidates[0] ?? {};
+  const content = first["content"] ?? {};
+  const parts = Array.isArray(content["parts"]) ? content["parts"] : [];
+  const text = parts.map((p) => String((p ?? {})["text"] ?? "")).join("");
+  const usage = env["usageMetadata"] ?? {};
+  const num = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
+  return {
+    text,
+    model_version: String(env["modelVersion"] ?? ""),
+    usage_metadata: {
+      prompt_token_count: num(usage["promptTokenCount"]),
+      candidates_token_count: num(usage["candidatesTokenCount"])
+    }
+  };
+}
+
 // src/scripts/_lib/session_role.ts
 var SESSION_ROLE_ENV = "AGENT_CONFIG_SESSION_ROLE";
 var KNOWN_ROLES = /* @__PURE__ */ new Set(["orchestrator", "worker", "reviewer"]);
@@ -899,34 +981,6 @@ var ExternalAIClient = class {
     return this.ask(system_prompt, user_prompt, max_tokens);
   }
 };
-function _curlJsonPost(url, extraHeaders, body) {
-  const args = ["-sS", "-X", "POST", url, "-H", "content-type: application/json"];
-  for (const h of extraHeaders) {
-    args.push("-H", h);
-  }
-  args.push("--connect-timeout", "30", "--max-time", "290");
-  args.push("-w", "\n%{http_code}", "--data-binary", "@-");
-  const r = spawnSync("curl", args, {
-    input: JSON.stringify(body),
-    encoding: "utf8",
-    maxBuffer: 64 * 1024 * 1024,
-    timeout: 3e5
-  });
-  if (r.error) {
-    throw new Error(`curl spawn failed: ${r.error.message}`);
-  }
-  if (r.status !== 0) {
-    throw new Error(`curl exited ${r.status ?? "null"}: ${(r.stderr ?? "").toString().slice(0, 500)}`);
-  }
-  const out = (r.stdout ?? "").toString();
-  const nl = out.lastIndexOf("\n");
-  const httpCode = (nl >= 0 ? out.slice(nl + 1) : out).trim();
-  const bodyText = nl >= 0 ? out.slice(0, nl) : out;
-  if (!/^2\d\d$/.test(httpCode)) {
-    throw new Error(`HTTP ${httpCode}: ${bodyText.slice(0, 500)}`);
-  }
-  return JSON.parse(bodyText);
-}
 var AnthropicClient = class extends ExternalAIClient {
   name = "anthropic";
   billable = true;
@@ -957,7 +1011,7 @@ var AnthropicClient = class extends ExternalAIClient {
     }
     this._client = {
       messages: {
-        create: (kwargs) => _curlJsonPost(
+        create: (kwargs) => curlJsonPost(
           "https://api.anthropic.com/v1/messages",
           [`x-api-key: ${api_key}`, "anthropic-version: 2023-06-01"],
           kwargs
@@ -1081,7 +1135,7 @@ var OpenAIClient = class extends ExternalAIClient {
     this._client = {
       chat: {
         completions: {
-          create: (kwargs) => _curlJsonPost(
+          create: (kwargs) => curlJsonPost(
             "https://api.openai.com/v1/chat/completions",
             [`authorization: Bearer ${api_key}`],
             kwargs
@@ -1164,7 +1218,7 @@ var GeminiClient = class extends ExternalAIClient {
         "GeminiClient requires explicit api_key or injected client. Use `api_key_ref: env:GEMINI_API_KEY` in ~/.event4u/agent-config/settings/.ai-council.yml."
       );
     }
-    throw new Error("google-genai package not installed. `pip install google-genai`.");
+    this._client = geminiRestClient(api_key, opts.transport ?? curlJsonPost);
   }
   ask(system_prompt, user_prompt, max_tokens = DEFAULT_MAX_TOKENS) {
     const t0 = _nowMs();
@@ -1226,7 +1280,11 @@ var _OpenAICompatibleClient = class extends ExternalAIClient {
         `${this.constructor.name} requires explicit api_key or injected client.`
       );
     }
-    throw new Error("openai package not installed. `pip install openai`.");
+    this._client = openAiCompatibleClient(
+      opts.base_url,
+      api_key,
+      opts.transport ?? curlJsonPost
+    );
   }
   ask(system_prompt, user_prompt, max_tokens = DEFAULT_MAX_TOKENS) {
     const t0 = _nowMs();
@@ -1279,7 +1337,13 @@ var XAIClient = class extends _OpenAICompatibleClient {
   name = "xai";
   base_url = XAI_BASE_URL;
   constructor(opts = {}) {
-    super({ model: opts.model ?? DEFAULT_XAI_MODEL, client: opts.client, api_key: opts.api_key });
+    super({
+      model: opts.model ?? DEFAULT_XAI_MODEL,
+      client: opts.client,
+      api_key: opts.api_key,
+      transport: opts.transport,
+      base_url: XAI_BASE_URL
+    });
   }
 };
 var PerplexityClient = class extends _OpenAICompatibleClient {
@@ -1289,7 +1353,9 @@ var PerplexityClient = class extends _OpenAICompatibleClient {
     super({
       model: opts.model ?? DEFAULT_PERPLEXITY_MODEL,
       client: opts.client,
-      api_key: opts.api_key
+      api_key: opts.api_key,
+      transport: opts.transport,
+      base_url: PERPLEXITY_BASE_URL
     });
   }
 };
@@ -1546,7 +1612,7 @@ var CliClient = class extends ExternalAIClient {
     if (stdinPayload !== null) {
       spawnOpts.input = stdinPayload;
     }
-    const r = spawnSync(argv0, cmd.slice(1), spawnOpts);
+    const r = spawnSync2(argv0, cmd.slice(1), spawnOpts);
     if (r.error) {
       const err = r.error;
       if (r.signal === "SIGTERM" || err.code === "ETIMEDOUT") {
@@ -2636,6 +2702,89 @@ import * as fs4 from "node:fs";
 import * as os2 from "node:os";
 import * as path4 from "node:path";
 
+// src/scripts/ai_council/content_ceiling.ts
+var CONTENT_CLASSES = ["public-artifact", "project-content"];
+var DEFAULT_CONTENT_CLASS = "project-content";
+var DEFAULT_SEAT_CEILING = "project-content";
+var _SET = new Set(CONTENT_CLASSES);
+function classifyContentClass(raw, fallback = DEFAULT_CONTENT_CLASS) {
+  if (typeof raw === "string" && _SET.has(raw)) {
+    return raw;
+  }
+  return fallback;
+}
+function admitsContent(seatCeiling, contentClass) {
+  if (seatCeiling === "public-artifact" && contentClass === "project-content") {
+    return {
+      admitted: false,
+      reason: "seat ceiling is 'public-artifact'; the payload is classified 'project-content' (consumer-supplied)"
+    };
+  }
+  return { admitted: true, reason: null };
+}
+
+// src/scripts/ai_council/seat_policy.ts
+var POLICY_EXCLUSIONS = [
+  /** The provider's terms forbid this use of the route. */
+  "policy_terms",
+  /** A privacy constraint forbids sending to this route. */
+  "policy_privacy",
+  /** The route's cost property is asserted rather than proven. */
+  "policy_unproven_cost",
+  /** The route serves a model other than the one requested. */
+  "policy_model_mismatch",
+  /** 2.2 — the payload's content class exceeds the seat's ceiling. */
+  "policy_content_ceiling",
+  /** The config named an exclusion this build does not understand. */
+  "policy_unknown"
+];
+var _SET2 = new Set(POLICY_EXCLUSIONS);
+function isPolicyExclusion(v) {
+  return typeof v === "string" && _SET2.has(v);
+}
+function classifyPolicyExclusion(raw) {
+  if (raw === void 0 || raw === null) {
+    return null;
+  }
+  return isPolicyExclusion(raw) ? raw : "policy_unknown";
+}
+function policyExclusionReason(p, provider) {
+  const who = provider === void 0 ? "this seat" : provider;
+  switch (p) {
+    case "policy_terms":
+      return `${who} is excluded by policy: the route's terms forbid this use`;
+    case "policy_privacy":
+      return `${who} is excluded by policy: a privacy constraint forbids this route`;
+    case "policy_unproven_cost":
+      return `${who} is excluded by policy: the route's cost property is asserted, not proven`;
+    case "policy_model_mismatch":
+      return `${who} is excluded by policy: the route serves a model other than the one requested`;
+    case "policy_content_ceiling":
+      return `${who} is excluded by policy: the payload exceeds the seat's content ceiling`;
+    case "policy_unknown":
+      return `${who} is excluded by policy: an exclusion this build does not understand (failing closed)`;
+  }
+}
+function parseSeatFields(name, raw) {
+  const dr = raw["disabled_reason"];
+  let disabled_reason = null;
+  if (dr !== void 0 && dr !== null) {
+    if (typeof dr !== "string" || dr.trim() === "") {
+      return {
+        error: `members.${name}.disabled_reason must be a non-empty string when set (got ${JSON.stringify(dr)}).`
+      };
+    }
+    disabled_reason = dr.trim();
+  }
+  return {
+    fields: {
+      disabled_reason,
+      policy_exclusion: classifyPolicyExclusion(raw["policy_exclusion"]),
+      content_ceiling: classifyContentClass(raw["content_ceiling"], DEFAULT_SEAT_CEILING)
+    }
+  };
+}
+
 // src/scripts/ai_council/fallback_config.ts
 var SECOND_MODEL_PROVIDERS = /* @__PURE__ */ new Set([
   "anthropic",
@@ -3830,6 +3979,10 @@ function _build_member(name, cfg, default_mode = "auto", ignored = []) {
     }
     verified_at = coerced;
   }
+  const seat = parseSeatFields(name, cfg);
+  if ("error" in seat) {
+    throw new CouncilConfigError(seat.error);
+  }
   const prompt_cache_raw = _get(cfg, "prompt_cache", null);
   let prompt_cache_ttl = "5m";
   if (prompt_cache_raw !== null && prompt_cache_raw !== void 0 && !_isBool(prompt_cache_raw)) {
@@ -3857,7 +4010,8 @@ function _build_member(name, cfg, default_mode = "auto", ignored = []) {
     participate_low_impact: participate_raw,
     tier,
     prompt_cache_ttl,
-    verified_at
+    verified_at,
+    ...seat.fields
   };
 }
 var DEFAULT_CLI_CALLS_PER_DAY2 = DEFAULT_CLI_CALLS_PER_DAY;
@@ -4210,6 +4364,9 @@ export {
   hardenedSpawnEnv,
   load_cli_call_counts,
   clients_exports,
+  DEFAULT_SEAT_CEILING,
+  admitsContent,
+  policyExclusionReason,
   _RAW_KEY_PREFIXES,
   config_exports
 };

package/dist/cli-delegate/{chunk-PI2GU3DP.js → chunk-2TAQ2K4V.js}

@@ -978,6 +978,7 @@ var SAFE_DEFAULT = {
   separate_quota_pool: false,
   agent_teams: false,
   worker_respawn: false,
+  structured_ask: false,
   reads_project_mcp_config: false,
   // `true` because the safe answer here is "there is still a step", not
   // "there is nothing to do" — see the field's own note.
@@ -999,6 +1000,7 @@ function normalizeHostManifest(input) {
     separate_quota_pool: asBool(src.separate_quota_pool),
     agent_teams: asBool(src.agent_teams),
     worker_respawn: asBool(src.worker_respawn),
+    structured_ask: asBool(src.structured_ask),
     reads_project_mcp_config: asBool(src.reads_project_mcp_config),
     // Inverted coercion, matching the inverted default: only an explicit
     // `false` clears the residual, so an absent or malformed value keeps
@@ -1007,7 +1009,7 @@ function normalizeHostManifest(input) {
   };
 }
 var HOST_CAPABILITY_REGISTRY = {
-  claude: { subagent_spawn: true, parallel_spawn: true }
+  claude: { subagent_spawn: true, parallel_spawn: true, structured_ask: false }
 };
 function resolveHostCapabilities(hostId, override) {
   if (override !== void 0 && override !== null && typeof override === "object" && !Array.isArray(override)) {
@@ -1032,6 +1034,7 @@ var CAPABILITY_FIELDS = [
   "separate_quota_pool",
   "agent_teams",
   "worker_respawn",
+  "structured_ask",
   "reads_project_mcp_config",
   "mcp_needs_manual_activation"
 ];

package/dist/cli-delegate/chunk-5EK5WQN6.js

@@ -0,0 +1,28 @@
+import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
+
+// src/agent-src/scripts/_cli_entry.ts
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+function isCliEntry(moduleUrl, name) {
+  const argv1 = process.argv[1];
+  if (argv1 === void 0) {
+    return false;
+  }
+  if (path.basename(argv1, ".js") === name) {
+    return true;
+  }
+  const argvPath = path.resolve(argv1);
+  if (moduleUrl === pathToFileURL(argvPath).href) {
+    return true;
+  }
+  try {
+    return fs.realpathSync(fileURLToPath(moduleUrl)) === fs.realpathSync(argvPath);
+  } catch {
+    return false;
+  }
+}
+
+export {
+  isCliEntry
+};

package/dist/cli-delegate/chunk-7XGD2OEU.js

@@ -0,0 +1,96 @@
+import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
+
+// src/agent-src/scripts/dashboard_mode.ts
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+function isTrackedInGit(abs, repo_root) {
+  const r = spawnSync("git", ["ls-files", "--error-unmatch", "--", abs], {
+    cwd: repo_root,
+    encoding: "utf-8",
+    timeout: 1e4
+  });
+  return r.status === 0;
+}
+var REGEN = "Run `./scripts-run src/agent-src/scripts/update_roadmap_progress` to regenerate (or `task roadmap-progress` in Taskfile projects).";
+function evaluateDashboardState(inp) {
+  const { mode, present, trackedInGit, current, rel } = inp;
+  const regen = inp.regen ?? REGEN;
+  const noun = inp.noun ?? "dashboard";
+  if (mode === "untracked" && trackedInGit) {
+    return {
+      stale: true,
+      error: `\u274C  ${rel} is still tracked by git, but this repository runs \`--untracked-mode\`. Untrack it, keeping the working-tree file:
+      git rm --cached ${rel}
+`,
+      ok: null
+    };
+  }
+  if (!present) {
+    if (mode === "tracked") {
+      return {
+        stale: true,
+        error: `\u274C  ${rel} is missing. ` + regen.replace("to regenerate", "to generate it") + ` If this repository deliberately does not commit the ${noun}, pass \`--untracked-mode\`.
+`,
+        ok: null
+      };
+    }
+    return {
+      stale: false,
+      error: null,
+      ok: `\u2705  ${rel} is not committed here (--untracked-mode) and no stale copy is on disk.
+`
+    };
+  }
+  if (!current) {
+    return { stale: true, error: `\u274C  ${rel} is stale. ${regen}
+`, ok: null };
+  }
+  return { stale: false, error: null, ok: `\u2705  ${rel} is up to date.
+` };
+}
+function evaluateDashboardOnDisk(opts) {
+  const present = fs.existsSync(opts.target);
+  return evaluateDashboardState({
+    mode: opts.mode,
+    present,
+    trackedInGit: opts.mode === "untracked" && isTrackedInGit(opts.target, opts.repo_root),
+    current: present && fs.readFileSync(opts.target, { encoding: "utf-8" }) === opts.rendered,
+    rel: opts.rel,
+    ...opts.regen === void 0 ? {} : { regen: opts.regen },
+    ...opts.noun === void 0 ? {} : { noun: opts.noun }
+  });
+}
+function reportCheckVerdict(inp) {
+  const { verdict, dashboardOnly } = inp;
+  const complete = dashboardOnly ? [] : inp.complete;
+  const pending = dashboardOnly ? [] : inp.pending;
+  let err = verdict.error ?? "";
+  if (complete.length) {
+    err += "\u274C  Completed roadmaps are still in `agents/roadmaps/` \u2014 move them to `agents/roadmaps/archive/` (per the `roadmap-progress-sync` rule):\n";
+    for (const r of complete) err += `      - ${r.rel}  (${r.done}/${r.total_active} done)
+`;
+  }
+  if (pending.length) {
+    err += "\u274C  Iron Law 3 \u2014 roadmaps with unresolved `[~]` deferred items must NOT auto-archive. Resolve via `roadmap-management \xA7 4b` (spawn follow-up, restore, or cancel):\n";
+    for (const r of pending) {
+      err += `      - ${r.rel}  (${r.done}/${r.total_active} done \xB7 ${r.deferred} deferred)
+`;
+    }
+  }
+  if (!dashboardOnly && inp.gatedCount > 0) inp.warnMergeGated();
+  const rc = verdict.stale || complete.length > 0 || pending.length > 0 ? 1 : 0;
+  return { rc, stdout: rc === 0 ? verdict.ok ?? "" : "", stderr: err };
+}
+function parseModeToken(tok) {
+  if (tok === "--tracked-mode") return "tracked";
+  if (tok === "--untracked-mode") return "untracked";
+  return null;
+}
+
+export {
+  isTrackedInGit,
+  evaluateDashboardState,
+  evaluateDashboardOnDisk,
+  reportCheckVerdict,
+  parseModeToken
+};

package/dist/cli-delegate/{chunk-C6IPZRDA.js → chunk-BIXEDQPZ.js}

@@ -30,7 +30,7 @@ import {
   save_inventory,
   upsert_tool,
   write_manifest
-} from "./chunk-PI2GU3DP.js";
+} from "./chunk-2TAQ2K4V.js";
 import {
   check_version,
   classify_mismatch,
@@ -748,6 +748,12 @@ function format_drift_report(entries) {
 // src/scripts/_lib/skill_catalogue.ts
 import * as fs4 from "node:fs";
 import * as path4 from "node:path";
+var PROJECT_CATALOGUE_ROOTS = ["src/skills", ".claude/skills"];
+var HOST_CATALOGUE_ROOT = ".claude/skills";
+var DEFAULT_CATALOGUE_ROOTS = [
+  ...PROJECT_CATALOGUE_ROOTS,
+  `~/${HOST_CATALOGUE_ROOT}`
+];
 var OBSERVATION_LOG = path4.join(
   "agents",
   "evidence",

package/dist/cli-delegate/chunk-DBH4AHDK.js

@@ -0,0 +1,155 @@
+import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
+
+// src/agent-src/scripts/gate_budget.ts
+import * as fs from "node:fs";
+import * as path from "node:path";
+var GATE_BUDGET_LEDGER_REL = path.join(
+  "agents",
+  "runtime",
+  "state",
+  "gate-budget-ledger.jsonl"
+);
+function gateBudgetLedgerPath(workspaceRoot) {
+  return path.join(workspaceRoot, GATE_BUDGET_LEDGER_REL);
+}
+var ROLLING_WINDOW_DAYS = 7;
+function _num(value) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return value;
+  }
+  return null;
+}
+function _dig(settings, keys) {
+  let cursor = settings;
+  for (const k of keys) {
+    if (cursor === null || typeof cursor !== "object" || Array.isArray(cursor)) {
+      return void 0;
+    }
+    cursor = cursor[k];
+  }
+  return cursor;
+}
+function readGateBudgetCaps(settings) {
+  const perRun = _num(_dig(settings, ["roadmap", "gate_budget", "max_cost_per_run_usd"]));
+  const rolling = _num(
+    _dig(settings, ["roadmap", "gate_budget", "max_cost_per_rolling_7d_usd"])
+  );
+  if (perRun === null || rolling === null) {
+    return null;
+  }
+  return { maxCostPerRunUsd: perRun, maxCostPerRolling7dUsd: rolling };
+}
+function parseBudgetUsd(field) {
+  const text = field.trim();
+  if (text === "") {
+    return null;
+  }
+  const dollar = /\$\s*([0-9]+(?:[.,][0-9]+)?)/.exec(text);
+  if (dollar) {
+    return Number.parseFloat(dollar[1].replace(",", "."));
+  }
+  const usd = /([0-9]+(?:[.,][0-9]+)?)\s*(?:usd|dollars?)\b/i.exec(text);
+  if (usd) {
+    return Number.parseFloat(usd[1].replace(",", "."));
+  }
+  return null;
+}
+function readGateBudgetLedger(workspaceRoot) {
+  const file = gateBudgetLedgerPath(workspaceRoot);
+  if (!fs.existsSync(file)) {
+    return [];
+  }
+  const out = [];
+  for (const line of fs.readFileSync(file, "utf-8").split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed === "") {
+      continue;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    if (parsed === null || typeof parsed !== "object") {
+      continue;
+    }
+    const rec = parsed;
+    if (rec["kind"] !== "consumption" || typeof rec["blocker"] !== "string") {
+      continue;
+    }
+    out.push({
+      kind: "consumption",
+      blocker: rec["blocker"],
+      authorization: "confirm-flag",
+      estimated_usd: _num(rec["estimated_usd"]) ?? 0,
+      actual_usd: _num(rec["actual_usd"]),
+      at: typeof rec["at"] === "string" ? rec["at"] : "",
+      single_use: true
+    });
+  }
+  return out;
+}
+function appendGateBudgetReceipt(workspaceRoot, receipt) {
+  const file = gateBudgetLedgerPath(workspaceRoot);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.appendFileSync(file, `${JSON.stringify(receipt)}
+`, "utf-8");
+}
+function rollingSpendUsd(records, now) {
+  const cutoff = now.getTime() - ROLLING_WINDOW_DAYS * 24 * 60 * 60 * 1e3;
+  let total = 0;
+  for (const r of records) {
+    const stamp = Date.parse(r.at);
+    if (Number.isFinite(stamp) && stamp < cutoff) {
+      continue;
+    }
+    total += r.actual_usd ?? r.estimated_usd;
+  }
+  return total;
+}
+function evaluateGateBudget(opts) {
+  const { caps, records, estimateUsd, now } = opts;
+  if (caps === null) {
+    return {
+      ok: false,
+      reason: "no_caps",
+      detail: "no standing class-1 budget is configured (`roadmap.gate_budget.max_cost_per_run_usd` and `roadmap.gate_budget.max_cost_per_rolling_7d_usd`)"
+    };
+  }
+  if (estimateUsd === null) {
+    return {
+      ok: false,
+      reason: "no_estimate",
+      detail: "the entry states no USD estimate in its **Budget:** field, so no cap can be compared against it"
+    };
+  }
+  if (estimateUsd > caps.maxCostPerRunUsd) {
+    return {
+      ok: false,
+      reason: "over_per_run",
+      detail: `the estimate ($${estimateUsd.toFixed(2)}) exceeds the per-run cap ($${caps.maxCostPerRunUsd.toFixed(2)})`
+    };
+  }
+  const spent = rollingSpendUsd(records, now);
+  if (spent + estimateUsd > caps.maxCostPerRolling7dUsd) {
+    return {
+      ok: false,
+      reason: "over_rolling_7d",
+      detail: `$${spent.toFixed(2)} is already receipted in the last ${String(ROLLING_WINDOW_DAYS)} days and this run would add $${estimateUsd.toFixed(2)}, over the rolling cap ($${caps.maxCostPerRolling7dUsd.toFixed(2)})`
+    };
+  }
+  return { ok: true, estimateUsd, rollingUsd: spent };
+}
+
+export {
+  GATE_BUDGET_LEDGER_REL,
+  gateBudgetLedgerPath,
+  ROLLING_WINDOW_DAYS,
+  readGateBudgetCaps,
+  parseBudgetUsd,
+  readGateBudgetLedger,
+  appendGateBudgetReceipt,
+  rollingSpendUsd,
+  evaluateGateBudget
+};