@meantjs/consent 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 The five Candid Profile library packages (`@meantjs/profile`, `/format`, `/consent`, `/tools`, `/reconcile`) release together under one version and pin each other exactly; a version appears here even when this package did not change. Release steps: `docs/releasing.md` in the repository.
 
+## 0.4.0 — 2026-10-30
+
+- What a request grants (spec §5.3, D-056). `evmConsent`, `eip712Consent` and `generateConsent` also return `values`,
+  the decoded arguments or message, and `grant`: who may take tokens because of the request, which token, how many
+  and until when, read from the effect's `grant` (`{ kind, spender | to, token, amount: { units, unlimited }, ends }`),
+  or null. Addresses are EIP-55, accounts their ICRC-1 text, units a decimal string and ends exact seconds, never
+  rounded. A grant that cannot be read is null with a `W_GRANT` diagnostic, and the text is the same.
+  `generateConsent` takes `canisterId`, the ledger called, and reads the grant only then, so an ICRC-21 message is
+  unchanged.
+- `@meantjs/consent/terms`, new: terms the user confirms for one task, and the check of a request's grant against them
+  (spec §5.3, "Confirmed terms"; §11 item 10). `readTerms` reads an agent's terms in the wallet's values (a token by
+  its symbol, an app by its name, an amount never rounded, an end as a date, a length, hours or "never") or throws a
+  `TermsError` with a message for the agent; `termsText` writes them out exactly for the wallet's own screen;
+  `confirmTerms` freezes them with an id; `checkGrant` says whether a grant fits, and why not; `termsGate` keeps the
+  order (confirmed before the request is read, fixed after, one request, named by the id the wallet gives it). It runs
+  in browsers.
+
 ## 0.3.0 — 2026-10-29
 
 - `@meantjs/consent/evm`: `eip712Consent`, the consent text of an EIP-712 signing request (spec §15.9, D-055),

package/README.md

@@ -6,8 +6,8 @@ ICRC-21 consent messages, and the text an SNS proposal's validator returns, from
 npm install @meantjs/consent
 ```
 
-- **Runs on:** Node 22 or later and browsers for the main entry and the EVM subpaths (no Node built-in, no `Buffer`;
-  checked with esbuild). `@meantjs/consent/sns` hashes with `node:crypto` and is Node only.
+- **Runs on:** Node 22 or later and browsers for the main entry, the EVM subpaths and `./terms` (no Node built-in, no
+  `Buffer`; checked with esbuild). `@meantjs/consent/sns` hashes with `node:crypto` and is Node only.
 - **Module format:** ES modules only, with hand-written TypeScript declarations for every entry.
 - **Spec:** [Candid Profile v0](https://github.com/B3Pay/Meant/blob/main/profile/docs/profile-v0.md). **Licence:** Apache-2.0.
 - **Versions:** the five Candid Profile packages (`@meantjs/profile`, `/format`, `/consent`, `/tools`,
@@ -47,7 +47,7 @@ bundles it with esbuild for the browser platform). The three SNS rows below are
 | `snsValidatorRendering({ payload, resolved, method, refs, limits })` | An SNS generic-function validator as a function: payload bytes in, `{ Ok: text }` or `{ Err: text }` out (section below). Non-enumerable `diagnostics` and `provenance`, as above. |
 | `handleSnsValidatorCall(payload, context)` / `encodeValidatorResult` / `decodeValidatorResult` | The canister-side wrapper and the codec of `variant { Ok : text; Err : text }`. |
 | `verifySnsRendering({ payloadTextRendering, payload, resolved, targetCanisterId, method, refs })`, `parseGovernanceRendering(text)` | The reviewer's check of a stored proposal rendering; `SNS_RENDERING_RULES` names the rules. |
-| `generateConsent({ resolved, method, arg, refs, form, utcOffsetMinutes, rawArguments })` | One form without the ICRC-21 envelope; returns `{ message, zoneSensitive, diagnostics, provenance, model }`. |
+| `generateConsent({ resolved, method, arg, refs, form, utcOffsetMinutes, rawArguments, canisterId })` | One form without the ICRC-21 envelope; returns `{ message, zoneSensitive, values, grant, diagnostics, provenance, model }`. `values`: the decoded arguments. `grant`: what the call grants (section "Terms the user confirms"), read only when `canisterId` names the canister called, its token; else null. |
 | `decodeArguments(method, bytes, limits)` | Step 1 alone: argument bytes to the value tree. |
 | `parseTemplate`, `resolvePath`, `valuesAt`, `Renderer`, `renderFields`, `renderGeneric`, `codeSpan`, `escapeMarkdown`, `visible` | The parts. |
 
@@ -72,6 +72,7 @@ a Candid one.
 | `decodeCalldata(resolved, calldata, limits)` (`/evm`) | The function a selector names and its arguments, keyed by parameter name. Strict: values read from anything but their canonical ABI encoding are `E_DECODE`. |
 | `evmConsent({ resolved, calldata, to, chainId, refs, tokens, form, utcOffsetMinutes, rawArguments, limits })` (`/evm`) | The consent text of a call: the same model and the same two forms as ICRC-21, without its envelope (`"generic"` Markdown, or `"fields"` as an intent line and `[label, text]` rows), ending with the contract's address and chain, which a person must see because a pack matches any contract with the right functions. A call to a contract its profiles do not list is `E_DEPLOYMENT`; a payable function is `E_UNSUPPORTED_TYPE` (its native value has no position yet). `tokens`: the decimals and symbol of each token an amount's `token` field names, by address; the address is shown beside the symbol. |
 | `eip712Consent({ resolved, typedData, chainId, refs, tokens, form, utcOffsetMinutes, rawArguments, limits })` (`/evm`) | The consent text of an EIP-712 signing request (`eth_signTypedData_v4`'s JSON), matched to a message of the resolved form by its type hash, never its name. Refused before anything is shown: a domain for another chain than the wallet's, without `chainId` or `verifyingContract`, with a salt, or whose name or version is not its profiles' (`E_DOMAIN`); a contract its profiles do not list (`E_DEPLOYMENT`); no message with the type hash (`E_TYPE_HASH`); values that are not exactly the members, canonically written (`E_DECODE`); a token not in `tokens` (`E_REF_UNRESOLVED`). Ends with the verifying contract, the EIP-712 digest and "This is a signature, not a transaction: whoever holds it can submit it." Returns `typeHash`, `digest`, `verifyingContract` and `chainId` with the text. |
+| `values`, `grant` (both, `/evm`) | `evmConsent` and `eip712Consent` also return the decoded arguments or message by name (`values`), and what the call or signature grants (`grant`, below), or null. |
 | `erc7730Descriptor(resolved, { context, deployments, owner, contractName, info, token })` (`/erc7730`) | The contract's ERC-7730 clear-signing file and its ERC-8176 `descriptorHash`: deterministic, `$schema` pinned to the exact 2.1.0 file, one entry per function a transaction calls, or with `context: "eip712"` one per message, keyed by its `encodeType`. What an ERC-7730 file cannot say (a time in ms, `utf8` bytes, an amount in another token, an unnamed parameter) is `E_EXPORT`, never written as something near it; no deployment is `E_DEPLOYMENT`. What it cannot say but changes no value (a timestamp's "Never", a template over an array) is left out and listed in `notes`. The mapping is spec §15.7 and §15.9. |
 | `descriptorHash(descriptor)` (`/erc7730`) | Keccak-256 of the RFC 8785 form: the hash of a file someone edited. |
 | `erc8176Attestation({ descriptorHash, time, expirationTime, salt, refUID })` (`/erc7730`) | The unsigned ERC-8176 attestation (EAS offchain v2 typed data) and its EIP-712 digest, for a reviewer to sign with their own key. Nothing is signed or sent. |
@@ -96,6 +97,55 @@ independent implementation. **Fact** (ERC-7730): a wallet that finds no ticker f
 raw value instead with an 'Unknown token' warning"; this package would produce no message there, and a file cannot make
 a wallet refuse. The Rust version does not cover EVM.
 
+## Terms the user confirms (`src/terms.mjs`, `@meantjs/consent/terms`)
+
+Spec §5.3 ("What a call grants", "Confirmed terms") and §11 item 10, D-056. An agent that signs for a user should sign
+only what the user asked for. The consent functions above return each request's `grant`, read from the profile's
+`effect.grant`:
+
+```js
+{ kind: "approve", spender: "0x66a9893cC07D91D95644AEDD05D03f95e1dBA8Af", token: "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
+  amount: { units: "500000000", unlimited: false }, ends: { at: "1796083199" } } // or { never: true }, or { now: true } for a transfer
+```
+
+Addresses are EIP-55, accounts their ICRC-1 text, a canister's token its canonical id, units a decimal string and ends
+exact seconds, never rounded. A Permit2 allowance whose expiration is 0 ends at `sigDeadline`, and an EIP-2612 or DAI
+permit never ends (their deadlines are the signature's). A batch, a request without a grant, or a grant that cannot be
+read is null; the last with a `W_GRANT` diagnostic, and the text is the same.
+
+The subpath compares a grant with terms the user confirmed for one task:
+
+| Function | Does |
+|---|---|
+| `readTerms(fields, wallet)` | The agent's terms (`token`, `spender` or `to`, `max_amount`, `expires_by`, as a tool takes them) in the wallet's values: a token by its symbol and an app by its name from the wallet's lists, never guessed; an address or account the user gave, checked; the most never rounded; the end as a date (its whole day in the user's zone), a length ("30 days", "1 month", calendar months), hours from now (an exact time) or "never". "unlimited" and "never" only as those words. Throws `TermsError` with a code and a message for the agent. `wallet`: `{ tokens, apps, now, utcOffsetMinutes }`, `now` in nanoseconds as a bigint. |
+| `termsText(terms)` | The terms in words, exactly, for the wallet's own screen: "Uniswap (0x66a9893cC07D91D95644AEDD05D03f95e1dBA8Af) may spend at most 500 USDC, until the end of 30 November 2026 (UTC)." "any amount (unlimited)" and "never ends" are written out. |
+| `confirmTerms(terms)` | Once the user confirmed exactly that text, never through a tool the agent can call: the terms frozen, with `id`, the SHA-256 of their canonical JSON. |
+| `checkGrant(confirmed, grant, wallet)` | `{ fits, reasons }`. A grant fits when its token and its spender or recipient are the terms', its amount is at most the most (unlimited only under unlimited terms; a grant of nothing under any), and it ends no later than the terms (never only under never; a transfer while the terms have not ended). A request that fits needs no second yes; one that does not is refused with the reasons, and the agent asks the user for new terms. A null grant is not covered by terms. |
+| `termsGate()` | The order, kept: `propose(terms)` returns the text to show, `confirm(shown)` takes the text the user confirmed, `read()` before the agent reads the request, `check(grant, wallet, requestId)`. The request cannot be read before the terms are confirmed, the terms cannot change once it is read, and they cover one request: `requestId` names it (`eip712Consent`'s `digest`, or the wallet's own id of a call), and another is refused even when it grants the same. Out of order is `E_TERMS_ORDER`. |
+
+```js
+import { checkGrant, readTerms, termsGate, termsText } from "@meantjs/consent/terms";
+import { eip712Consent } from "@meantjs/consent/evm";
+
+const wallet = {
+  tokens: { USDC: { address: "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48", decimals: 6 } },
+  apps: { Uniswap: "0x66a9893cC07D91D95644AEDD05D03f95e1dBA8Af" },
+  now: BigInt(Date.now()) * 1_000_000n,
+};
+const gate = termsGate();
+const shown = gate.propose(readTerms({ token: "USDC", spender: "Uniswap", max_amount: "500", expires_by: "2026-11-30" }, wallet));
+// the wallet shows `shown` on its own screen; when the user confirms it:
+gate.confirm(shown);
+gate.read(); // now the agent may read the request
+const { grant, digest } = eip712Consent({ resolved: permit2, typedData, chainId: 1, tokens });
+gate.check(grant, wallet, digest); // { fits: true, reasons: [] }, or { fits: false, reasons: ["the request is unlimited, the terms say at most 500 USDC"] }
+```
+
+The rules come from Meant's signing test, where the comparison in code held every time and the terms agents wrote from
+everyday words were the weak point (spec §11 item 10); hence the user's confirmation. The checks cover the eight
+requests of the proposal (Permit2 `PermitSingle` and `PermitTransferFrom`, EIP-2612, DAI, ERC-20 `approve` and
+`transfer`, ICRC-2 `icrc2_approve`, ICRC-1 `icrc1_transfer`) end to end, both traps, and the test's planted faults.
+
 ## SNS proposal validators (`src/sns.mjs`)
 
 The governance counterpart of ICRC-21. An SNS proposal that executes a generic nervous system function calls a dapp method with a payload. Apart from the proposer's own title and summary, the only description of that payload governance shows is the text the dapp's validator method returns. `snsValidatorRendering` is that validator, generated from the profile. Proposal for the spec text: `docs/proposals/w4-sns-validator-rendering.md`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meantjs/consent",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "ICRC-21 consent messages and SNS proposal validator renderings generated from a Candid Profile resolved form: any method, both GenericDisplayMessage and FieldsDisplayMessage, values formatted and escaped, nothing rounded.",
   "license": "Apache-2.0",
   "repository": {
@@ -46,6 +46,10 @@
       "types": "./src/erc7730.d.mts",
       "default": "./src/erc7730.mjs"
     },
+    "./terms": {
+      "types": "./src/terms.d.mts",
+      "default": "./src/terms.mjs"
+    },
     "./package.json": "./package.json"
   },
   "files": [
@@ -64,8 +68,8 @@
   },
   "dependencies": {
     "@candid-core/schema": "0.5.0",
-    "@meantjs/format": "0.3.0",
-    "@meantjs/profile": "0.3.0"
+    "@meantjs/format": "0.4.0",
+    "@meantjs/profile": "0.4.0"
   },
   "devDependencies": {
     "@dfinity/didc": "0.0.4",

package/src/consent.mjs

@@ -2,8 +2,10 @@
 // `icrc21.mjs` wraps this into the ICRC-21 request/response shapes.
 
 import { Renderer } from "./display.mjs";
+import { canisterText, grantOf } from "./grant.mjs";
 import { buildModel } from "./model.mjs";
 import { renderFields, renderGeneric } from "./render.mjs";
+import { methodOf } from "./resolved.mjs";
 
 /**
  * @param {object} input
@@ -15,14 +17,20 @@ import { renderFields, renderGeneric } from "./render.mjs";
  * @param {number | null} [input.utcOffsetMinutes]  generic form only: show timestamps in this zone (default 0, UTC). The fields form is always UTC seconds
  * @param {boolean} [input.rawArguments]  append the decoded raw arguments (spec section 11 item 1)
  * @param {object} [input.limits]  decoder limits (maxBytes, maxDepth, maxElements)
- * @returns {{ form: "fields" | "generic", message: object, zoneSensitive: boolean, diagnostics: object[], provenance: object, model: object }}
+ * @param {string} [input.canisterId]  the canister called: the token of a grant (spec section 5.3, D-056). Without it
+ *   nothing is read: `grant` is null and no diagnostic says so, since a caller that does not name the canister is not
+ *   asking what the call grants (an ICRC-21 message, for one)
+ * @returns {{ form: "fields" | "generic", message: object, zoneSensitive: boolean, values: unknown[], grant: object | null, diagnostics: object[], provenance: object, model: object }}
  *   `message` is `{ FieldsDisplayMessage: { intent, fields } }` or `{ GenericDisplayMessage: string }` (ICRC-21 shapes,
- *   integers as bigint). `zoneSensitive` is true when a timestamp was shown in the requested zone.
+ *   integers as bigint). `zoneSensitive` is true when a timestamp was shown in the requested zone. `values` are the
+ *   decoded arguments as `decodeArguments` gives them, and `grant` what the call grants (`grant.mjs`), or null.
  */
-export function generateConsent({ resolved, method, arg, refs = {}, form = "generic", utcOffsetMinutes = null, rawArguments = false, limits }) {
+export function generateConsent({ resolved, method, arg, refs = {}, form = "generic", utcOffsetMinutes = null, rawArguments = false, limits, canisterId }) {
+  const called = canisterId === undefined ? undefined : canisterText(canisterId);
   const model = buildModel({ resolved, method, arg, limits });
   const diagnostics = model.diagnostics;
-  const done = (rest) => ({ ...rest, diagnostics: dedupe(diagnostics), provenance: model.provenance, model });
+  const grant = called === undefined ? null : grantOf({ name: method, method: methodOf(resolved, method), argValues: model.argValues, called, diagnostics });
+  const done = (rest) => ({ ...rest, values: model.argValues, grant, diagnostics: dedupe(diagnostics), provenance: model.provenance, model });
   if (form === "fields") {
     const renderer = new Renderer({ refs, utcOffsetMinutes: null, diagnostics });
     const { intent, fields } = renderFields(model, renderer, { rawArguments });

package/src/evm.d.mts

@@ -1,7 +1,7 @@
 // Types for @meantjs/consent/evm: the consent text of an EVM call (spec section 15, D-054). Hand-written; the source is
 // src/evm.mjs. scripts/types.test.mjs keeps the declared names equal to the runtime exports.
 import type { AbiLimits, AbiValue } from "@meantjs/profile/evm";
-import type { ConsentDiagnostic, Model, Provenance, ResolvedForm } from "./index.mjs";
+import type { ConsentDiagnostic, Grant, Model, Provenance, ResolvedForm } from "./index.mjs";
 
 /** An EVM contract's resolved form: `chain: "evm"`, and each method with its selector and named signature. */
 export type EvmResolvedForm = ResolvedForm & { chain: "evm" };
@@ -50,6 +50,10 @@ export function evmConsent(input: EvmConsentInput): {
   /** The contract, in its EIP-55 form. */
   to: string;
   chainId: string | null;
+  /** The decoded arguments by parameter name, as `decodeCalldata` gives them. */
+  values: Record<string, AbiValue>;
+  /** What the call grants (its token is the contract called, unless the amount's tag names a field), or null; a W_GRANT diagnostic says why one cannot be read. */
+  grant: Grant | null;
   diagnostics: ConsentDiagnostic[];
   provenance: Provenance;
   model: Model;
@@ -100,6 +104,10 @@ export function eip712Consent(input: Eip712ConsentInput): {
   /** The verifying contract, in its EIP-55 form. */
   verifyingContract: string;
   chainId: string;
+  /** The message's values by member name, as read from the typed data: integers as decimal strings, addresses in EIP-55 form. */
+  values: Record<string, AbiValue>;
+  /** What the signature grants (its token is the verifying contract, unless the amount's tag names a member), or null; a W_GRANT diagnostic says why one cannot be read. */
+  grant: Grant | null;
   diagnostics: ConsentDiagnostic[];
   provenance: Provenance;
   model: Model;

package/src/evm.mjs

@@ -22,6 +22,7 @@
 import { AbiError, DEFAULT_ABI_LIMITS, decodeParams, eip712TypeHash, keccak256Hex, parseEip712Types, parseSignature, readAddress, typedDataDigest } from "@meantjs/profile/evm";
 import { Renderer, TokenAmount } from "./display.mjs";
 import { CODES, ConsentError, fail } from "./errors.mjs";
+import { grantOf } from "./grant.mjs";
 import { modelOf } from "./model.mjs";
 import { resolvePath } from "./paths.mjs";
 import { renderGeneric, renderPlain } from "./render.mjs";
@@ -149,7 +150,9 @@ function withTokens(name, viewed, args, tokens) {
  * @param {number | null} [input.utcOffsetMinutes]  generic form only (default 0, UTC)
  * @param {boolean} [input.rawArguments]  append the decoded arguments (spec section 11 item 1)
  * @param {object} [input.limits]  decoder limits (maxBytes, maxDepth, maxElements)
- * @returns {{ form: string, message: string | { intent: string, fields: Array<[string, string]> }, method: string, selector: string, to: string, chainId: string | null, diagnostics: object[], provenance: object, model: object }}
+ * @returns {{ form: string, message: string | { intent: string, fields: Array<[string, string]> }, method: string, selector: string, to: string, chainId: string | null, values: Record<string, unknown>, grant: object | null, diagnostics: object[], provenance: object, model: object }}
+ *   `values` are the decoded arguments as `decodeCalldata` gives them, and `grant` what the call grants (spec section
+ *   5.3, D-056; its token is the contract called unless the amount's tag names a field), or null.
  */
 export function evmConsent({ resolved, calldata, to, chainId, refs = {}, tokens = {}, form = "generic", utcOffsetMinutes = null, rawArguments = false, limits }) {
   if (form !== "generic" && form !== "fields") fail(CODES.REQUEST, `form must be "generic" or "fields", got ${JSON.stringify(form)}`);
@@ -167,8 +170,9 @@ export function evmConsent({ resolved, calldata, to, chainId, refs = {}, tokens
   if (method.state_mutability === "payable") fail(CODES.UNSUPPORTED_TYPE, `${name} is payable: the native value a call sends has no position in a profile yet (spec section 15, O2)`);
   const viewed = { ...method, args: method.args.map((n, i) => abiView(n, `${name}(${i})`)) };
   const model = modelOf(resolved, name, viewed, viewed.args.length ? withTokens(name, viewed, [values], tokenTable(tokens)) : []);
+  const grant = grantOf({ name, method: viewed, argValues: viewed.args.length ? [values] : [], called: target, diagnostics: model.diagnostics });
   const where = `${target}${chain === null ? "" : ` on chain ${chain}`}`;
-  const done = (rest) => ({ ...rest, method: name, selector, to: target, chainId: chain, diagnostics: model.diagnostics, provenance: model.provenance, model });
+  const done = (rest) => ({ ...rest, method: name, selector, to: target, chainId: chain, values, grant, diagnostics: model.diagnostics, provenance: model.provenance, model });
   if (form === "fields") {
     const plain = renderPlain(model, new Renderer({ refs, diagnostics: model.diagnostics }), { rawArguments });
     plain.fields.push(["Contract", where]);
@@ -312,6 +316,9 @@ function checkDomain(resolved, domain) {
  * @param {number | null} [input.utcOffsetMinutes]  generic form only (default 0, UTC)
  * @param {boolean} [input.rawArguments]  append the message's values (spec section 11 item 1)
  * @param {{ maxBytes?: number, maxElements?: number }} [input.limits]
+ * @returns the text, `primaryType`, `typeHash`, `digest`, `verifyingContract`, `chainId`, `values` (the message as read
+ *   from the typed data, by member name), `grant` (what the signature grants, spec section 5.3, D-056; its token is
+ *   the verifying contract unless the amount's tag names a field), or null, `diagnostics`, `provenance` and `model`
  */
 export function eip712Consent({ resolved, typedData, chainId, refs = {}, tokens = {}, form = "generic", utcOffsetMinutes = null, rawArguments = false, limits = {} }) {
   if (form !== "generic" && form !== "fields") fail(CODES.REQUEST, `form must be "generic" or "fields", got ${JSON.stringify(form)}`);
@@ -342,8 +349,9 @@ export function eip712Consent({ resolved, typedData, chainId, refs = {}, tokens
   }
   const viewed = { ...message, args: message.args.map((n, i) => abiView(n, `${name}(${i})`)) };
   const model = modelOf(resolved, name, viewed, withTokens(name, viewed, [values], tokenTable(tokens)));
+  const grant = grantOf({ name, method: viewed, argValues: [values], called: contract, diagnostics: model.diagnostics });
   const where = `${contract} on chain ${chain}`;
-  const done = (rest) => ({ ...rest, primaryType: name, typeHash, digest, verifyingContract: contract, chainId: chain, diagnostics: model.diagnostics, provenance: model.provenance, model });
+  const done = (rest) => ({ ...rest, primaryType: name, typeHash, digest, verifyingContract: contract, chainId: chain, values, grant, diagnostics: model.diagnostics, provenance: model.provenance, model });
   if (form === "fields") {
     const plain = renderPlain(model, new Renderer({ refs, diagnostics: model.diagnostics }), { rawArguments });
     plain.fields.push(["Contract", where], ["Signature", SIGNATURE_NOTE], ["EIP-712 digest", digest]);

package/src/grant.mjs

@@ -0,0 +1,140 @@
+// What a call or a signature grants (docs/profile-v0.md section 5.3, D-056): who may take tokens because of it, which
+// token, how many and until when, read from its effect's `grant` and its decoded values. A wallet compares it with the
+// terms the user confirmed (`@meantjs/consent/terms`).
+//
+// A grant that cannot be read is no grant: `null`, with a W_GRANT diagnostic. The request then needs its confirmation,
+// as any request without a grant does, and the consent text is the same either way.
+
+import { displayAccount, principalFromText, principalToText } from "@meantjs/format";
+import { CODES, fail } from "./errors.mjs";
+import { callTag, tagArgs } from "./resolved.mjs";
+import { resolvePath, valuesAt } from "./paths.mjs";
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const NATURAL = /^(0|[1-9][0-9]*)$/;
+const INTEGER = /^-?(0|[1-9][0-9]*)$/;
+/** Nanoseconds per unit of a `timestamp` tag (spec section 5.3); every grant end is compared in nanoseconds, exactly. */
+const NS = { s: 1_000_000_000n, ms: 1_000_000n, us: 1_000n, ns: 1n };
+
+/** Nanoseconds as exact seconds: a decimal string with a fraction only when there is one, never rounded. */
+export function secondsText(ns) {
+  const sign = ns < 0n ? "-" : "";
+  const a = ns < 0n ? -ns : ns;
+  const frac = (a % NS.s).toString().padStart(9, "0").replace(/0+$/, "");
+  return `${sign}${a / NS.s}${frac ? `.${frac}` : ""}`;
+}
+
+/** The canonical text of a canister id; anything else is E_REQUEST. */
+export function canisterText(id) {
+  try {
+    return principalToText(principalFromText(id));
+  } catch {
+    fail(CODES.REQUEST, `canisterId must be a principal's text, got ${JSON.stringify(String(id))}`);
+  }
+}
+
+class Skip extends Error {}
+
+/**
+ * @param {object} input
+ * @param {string} input.name  the method or message, for the diagnostic
+ * @param {object} input.method  its resolved-form entry (an EVM one as abiView reads it)
+ * @param {unknown[]} input.argValues  its decoded arguments, before any amount is boxed with its token
+ * @param {string | undefined} input.called  the contract or canister the call is for: the token, unless the amount's
+ *   tag names a field that holds it (spec section 15.9)
+ * @param {object[]} input.diagnostics  where W_GRANT goes
+ * @returns {null | { kind: "transfer" | "approve", spender?: string, to?: string, token: string,
+ *   amount: { units: string | null, unlimited: boolean }, ends: { at: string } | { never: true } | { now: true } }}
+ */
+export function grantOf({ name, method, argValues, called, diagnostics }) {
+  const effect = callTag(method, argValues, "effect");
+  const grant = effect?.args?.grant;
+  if (grant === undefined) return null;
+  try {
+    return read(method, argValues, effect, grant, called);
+  } catch (e) {
+    if (!(e instanceof Skip)) throw e;
+    diagnostics.push({ code: "W_GRANT", at: name, message: `${e.message}; the request has no grant, so terms the user confirmed cannot cover it` });
+    return null;
+  }
+}
+
+function read(method, argValues, effect, grant, called) {
+  const skip = (why) => {
+    throw new Skip(why);
+  };
+  if (effect !== method.tags?.effect) skip("a grant on the effect of a case is not read in this version (D-056)");
+  const { kind } = effect.args;
+  if (kind !== "transfer" && kind !== "approve") skip(`a grant goes with effect kind transfer or approve, not ${String(kind)}`);
+  if (!isObject(grant) || (grant.spender === undefined) === (grant.to === undefined)) skip("the grant names neither or both of spender and to");
+
+  /** The one value at a grant position: no [] and no case of a variant on the way, so a call holds it once at most. */
+  const at = (what, path, mayBeAbsent = false) => {
+    if (typeof path !== "string") skip(`grant ${what} is not a path`);
+    const rp = resolvePath(method, path);
+    if (rp.error) skip(`grant ${what} ${JSON.stringify(path)}: ${rp.error}`);
+    if (rp.steps.some((s) => s.kind !== "field")) skip(`grant ${what} ${JSON.stringify(path)} steps into [] or a case of a variant`);
+    const values = valuesAt(rp, argValues);
+    if (values.length === 0 && !mayBeAbsent) skip(`grant ${what} ${JSON.stringify(path)} is absent from this call`);
+    return { node: rp.node, value: values[0] };
+  };
+
+  const who = grant.spender !== undefined ? "spender" : "to";
+  const party = at(who, grant[who]);
+  let address;
+  if (party.node.abi === "address" && typeof party.value === "string") address = party.value; // EIP-55, as decoded
+  else if (tagArgs(party.node, "account") !== undefined && isObject(party.value)) {
+    try {
+      address = displayAccount(party.value);
+    } catch (e) {
+      skip(`grant ${who}: ${e.message}`);
+    }
+  } else skip(`grant ${who} ${JSON.stringify(grant[who])} is neither an address nor an account`);
+
+  const amt = at("amount", grant.amount);
+  const tag = tagArgs(amt.node, "amount");
+  let amount;
+  if ((amt.node.abi ?? amt.node.candid) === "bool" && typeof amt.value === "boolean") {
+    amount = amt.value ? { units: null, unlimited: true } : { units: "0", unlimited: false }; // DAI's allowed (spec 15.9)
+  } else {
+    if (tag === undefined || typeof amt.value !== "string" || !NATURAL.test(amt.value)) skip(`grant amount ${JSON.stringify(grant.amount)} is neither an amount nor a bool`);
+    if (tag.threshold !== undefined && (typeof tag.threshold !== "string" || !NATURAL.test(tag.threshold))) skip("the amount tag's threshold is not a decimal string");
+    amount = { units: amt.value, unlimited: tag.threshold !== undefined && BigInt(amt.value) >= BigInt(tag.threshold) };
+  }
+
+  let token;
+  if (tag?.token !== undefined) {
+    const t = at("amount token", tag.token);
+    if (t.node.abi !== "address" || typeof t.value !== "string") skip(`the amount's token ${JSON.stringify(tag.token)} is not an address`);
+    token = t.value;
+  } else if (typeof called === "string") token = called;
+  else skip("the canister the call is for was not given (canisterId), so its token is not known");
+
+  let ends;
+  if (grant.ends === undefined) ends = kind === "approve" ? { never: true } : { now: true };
+  else {
+    if (!Array.isArray(grant.ends) || grant.ends.length === 0) skip("grant ends is not a list of paths");
+    let latest = null;
+    let never = false;
+    for (const path of grant.ends) {
+      const end = at("ends", path, true);
+      if (end.value === undefined) { // an optional end left out: the grant never ends (spec 5.3)
+        never = true;
+        continue;
+      }
+      const ts = tagArgs(end.node, "timestamp");
+      if (ts === undefined || !Object.hasOwn(NS, ts.unit) || (ts.epoch ?? "unix") !== "unix" || typeof end.value !== "string" || !INTEGER.test(end.value)) {
+        skip(`grant ends ${JSON.stringify(path)} is not a unix timestamp`);
+      }
+      if (ts.threshold !== undefined && (typeof ts.threshold !== "string" || !NATURAL.test(ts.threshold))) skip(`the timestamp tag of ${JSON.stringify(path)} has a threshold that is not a decimal string`);
+      if (ts.threshold !== undefined && BigInt(end.value) >= BigInt(ts.threshold)) { // at its threshold: never (spec 5.3)
+        never = true;
+        continue;
+      }
+      const ns = BigInt(end.value) * NS[ts.unit]; // a label is how a value is shown; here it is the time it is
+      if (latest === null || ns > latest) latest = ns;
+    }
+    ends = never ? { never: true } : { at: secondsText(latest) };
+  }
+  return { kind, [who]: address, token, amount, ends };
+}

package/src/index.d.mts

@@ -126,6 +126,24 @@ export interface Model {
   [key: string]: unknown;
 }
 
+/**
+ * What a call or a signature grants (spec section 5.3, D-056): who may take tokens because of it, which token, how many
+ * and until when, read from its effect's `grant`. Compare it with terms the user confirmed (`@meantjs/consent/terms`).
+ */
+export interface Grant {
+  kind: "transfer" | "approve";
+  /** Who may take the tokens: an EIP-55 address, or an account in its ICRC-1 text. Exactly one of `spender` and `to`. */
+  spender?: string;
+  /** Who is paid directly: an EIP-55 address, or an account in its ICRC-1 text. */
+  to?: string;
+  /** The token: an EIP-55 address, or a canister id in its canonical text. */
+  token: string;
+  /** Base units as a decimal string; `null` when unlimited without a count (DAI's `allowed: true`). A grant of nothing is `"0"`. */
+  amount: { units: string | null; unlimited: boolean };
+  /** `at`: exact seconds since the Unix epoch as a decimal string, never rounded ("1767225600.123456789"). `now`: a transfer, made when it is sent. */
+  ends: { at: string } | { never: true } | { now: true };
+}
+
 export interface GenerateConsentInput {
   resolved: ResolvedForm;
   method: string;
@@ -138,12 +156,21 @@ export interface GenerateConsentInput {
   utcOffsetMinutes?: number | null;
   rawArguments?: boolean;
   limits?: DecodeLimits;
+  /**
+   * The canister called, the token of a grant. Without it nothing asks what the call grants: `grant` is null, with no
+   * diagnostic. Any spelling of a principal; anything else is E_REQUEST.
+   */
+  canisterId?: string;
 }
 /** One form without the ICRC-21 envelope. `zoneSensitive` is true when a timestamp was shown in the requested zone. */
 export function generateConsent(input: GenerateConsentInput): {
   form: "fields" | "generic";
   message: Icrc21ConsentMessage;
   zoneSensitive: boolean;
+  /** The decoded arguments, one value tree per argument, as `decodeArguments` gives them. */
+  values: unknown[];
+  /** What the call grants, or null: no `canisterId`, no grant in its effect, or one that cannot be read (a W_GRANT diagnostic says why). */
+  grant: Grant | null;
   diagnostics: ConsentDiagnostic[];
   provenance: Provenance;
   model: Model;

package/src/sha256.mjs

@@ -0,0 +1,60 @@
+// SHA-256 in plain JavaScript, synchronous, so that the id of confirmed terms (terms.mjs) needs no node:crypto and the
+// ./terms subpath bundles for a browser (WebCrypto is asynchronous). The same code as the resolver's src/sha256.mjs;
+// test/terms.test.mjs compares it with node:crypto.
+
+const K = new Uint32Array([
+  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+
+const rotr = (x, n) => (x >>> n) | (x << (32 - n));
+
+/** SHA-256 of a byte array, as 32 bytes. */
+export function sha256(bytes) {
+  const h = new Uint32Array([0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19]);
+  const bitLength = bytes.length * 8;
+  const padded = new Uint8Array(((bytes.length + 9 + 63) >> 6) << 6);
+  padded.set(bytes);
+  padded[bytes.length] = 0x80;
+  const view = new DataView(padded.buffer);
+  view.setUint32(padded.length - 8, Math.floor(bitLength / 2 ** 32), false);
+  view.setUint32(padded.length - 4, bitLength >>> 0, false);
+  const w = new Uint32Array(64);
+  for (let off = 0; off < padded.length; off += 64) {
+    for (let i = 0; i < 16; i++) w[i] = view.getUint32(off + 4 * i, false);
+    for (let i = 16; i < 64; i++) {
+      const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >>> 3);
+      const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >>> 10);
+      w[i] = (w[i - 16] + s0 + w[i - 7] + s1) | 0;
+    }
+    let [a, b, c, d, e, f, g, hh] = h;
+    for (let i = 0; i < 64; i++) {
+      const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+      const ch = (e & f) ^ (~e & g);
+      const t1 = (hh + S1 + ch + K[i] + w[i]) | 0;
+      const S0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+      const maj = (a & b) ^ (a & c) ^ (b & c);
+      const t2 = (S0 + maj) | 0;
+      hh = g;
+      g = f;
+      f = e;
+      e = (d + t1) | 0;
+      d = c;
+      c = b;
+      b = a;
+      a = (t1 + t2) | 0;
+    }
+    h[0] += a; h[1] += b; h[2] += c; h[3] += d; h[4] += e; h[5] += f; h[6] += g; h[7] += hh;
+  }
+  const out = new Uint8Array(32);
+  const ov = new DataView(out.buffer);
+  h.forEach((x, i) => ov.setUint32(4 * i, x, false));
+  return out;
+}
+
+/** Lowercase hex SHA-256 of a string's UTF-8 bytes. */
+export function sha256Hex(text) {
+  return Array.from(sha256(new TextEncoder().encode(text)), (b) => b.toString(16).padStart(2, "0")).join("");
+}

package/src/terms.d.mts

@@ -0,0 +1,103 @@
+// Types for @meantjs/consent/terms: terms the user confirms for one task, and the check of a request's grant against
+// them (spec section 5.3, "Confirmed terms", D-056). Hand-written; the source is src/terms.mjs. scripts/types.test.mjs
+// keeps the declared names equal to the runtime exports.
+import type { Grant } from "./index.mjs";
+
+/** A term the agent wrote that cannot be read, or a step out of order: `message` is written for the agent. */
+export declare class TermsError extends Error {
+  constructor(code: string, message: string);
+  readonly code: TermsCode;
+}
+export declare const TERMS_CODES: {
+  /** A field is missing or empty, or both spender and to are given. */
+  readonly MISSING: "E_TERMS_MISSING";
+  /** A token the wallet does not know. */
+  readonly TOKEN: "E_TERMS_TOKEN";
+  /** An app the wallet does not know, or an address or account that is not one. */
+  readonly PARTY: "E_TERMS_PARTY";
+  /** An amount that cannot be read, or has more decimals than its token: never rounded. */
+  readonly AMOUNT: "E_TERMS_AMOUNT";
+  /** An end that cannot be read, or a date before today. */
+  readonly END: "E_TERMS_END";
+  /** termsGate: a step out of order. */
+  readonly ORDER: "E_TERMS_ORDER";
+};
+export type TermsCode = (typeof TERMS_CODES)[keyof typeof TERMS_CODES];
+
+/** What the terms functions read from the wallet. Pure: the wallet's clock and zone come in here. */
+export interface Wallet {
+  /** The tokens it knows, by symbol: an EVM token's address or a ledger's canister id, and its decimals. */
+  tokens: Record<string, { address: string; decimals: number } | { canister: string; decimals: number }>;
+  /** The apps and people it knows by name: an address, or an account in its ICRC-1 text. */
+  apps?: Record<string, string>;
+  /** Nanoseconds since the Unix epoch. */
+  now: bigint;
+  /** The user's zone (default 0, UTC): a date allows its whole day there. */
+  utcOffsetMinutes?: number;
+}
+
+/** The terms as the agent writes them, a tool's arguments: `spender` or `to`, exactly one. */
+export interface TermsFields {
+  /** The token, by the symbol the wallet knows. */
+  token: string;
+  /** Who may spend the tokens: an app's name as the wallet knows it, or an address or account the user gave. */
+  spender?: string;
+  /** Who is paid directly: a name the wallet knows, or an address or account the user gave. */
+  to?: string;
+  /** The most, in tokens ("100", "0.5", "100 USDC"), or "unlimited". */
+  max_amount: string;
+  /** YYYY-MM-DD (the whole day counts), a length from today ("30 days", "2 weeks", "1 month", "1 year"), hours from now ("2 hours", an exact time), or "never". */
+  expires_by: string;
+}
+
+/** What the user allows for one task, in the wallet's own values: `spender` or `to`, exactly one. */
+export interface Terms {
+  /** The token: an EIP-55 address, or a canister id in its canonical text. */
+  token: string;
+  symbol: string;
+  decimals: number;
+  spender?: string;
+  to?: string;
+  /** The app's name in the wallet's list, or null. */
+  name: string | null;
+  /** The most, in base units as a decimal string; `null` when unlimited. */
+  amount: { units: string; unlimited: false } | { units: null; unlimited: true };
+  /** `at`: the latest end, exact seconds since the Unix epoch as a decimal string; `day`: the local date whose whole day counts. */
+  ends: { at: string; day?: string } | { never: true };
+  utcOffsetMinutes: number;
+  /** The fields as the agent wrote them, trimmed. */
+  written: Record<string, string>;
+}
+/** Terms the user confirmed: `id` is the SHA-256 of their canonical JSON (RFC 8785), lowercase hex. */
+export type ConfirmedTerms = Readonly<Terms & { id: string }>;
+
+/** Reads the agent's terms. Throws TermsError when a term cannot be read; it never guesses a token, an app, decimals or a date. */
+export function readTerms(fields: TermsFields | Record<string, unknown>, wallet: Wallet): Terms;
+/** The terms in words, exactly, for the user to confirm on the wallet's own screen. */
+export function termsText(terms: Terms | ConfirmedTerms): string;
+/** The terms once the user has confirmed exactly `termsText(terms)`: frozen, with their `id`. */
+export function confirmTerms(terms: Terms): ConfirmedTerms;
+/** Whether a request's grant fits confirmed terms, and if not, why, in words. A null grant is not covered by terms. */
+export function checkGrant(confirmed: ConfirmedTerms, grant: Grant | null, wallet: Wallet): { fits: boolean; reasons: string[] };
+
+/** The order of one task: propose, confirm on the wallet's screen, read, check. Steps out of order throw TermsError E_TERMS_ORDER. */
+export interface TermsGate {
+  readonly state: "open" | "proposed" | "confirmed" | "read";
+  readonly proposed: Readonly<Terms> | null;
+  readonly confirmed: ConfirmedTerms | null;
+  /** The agent's draft; replaces an earlier one and its confirmation. Returns the text to show the user. Refused once the request was read. */
+  propose(terms: Terms): string;
+  /** The user confirmed `shown`, which must be exactly the draft's text. */
+  confirm(shown: string): ConfirmedTerms;
+  /** The user said no: the draft is dropped. */
+  reject(): void;
+  /** Before the agent reads the request: refused until the user has confirmed terms. */
+  read(): void;
+  /**
+   * The grant of the request read. `requestId` names the request the wallet will sign or send: eip712Consent's `digest`,
+   * or for a call the wallet's own id of it. The terms cover one request, the first checked: another is refused, even
+   * one that grants the same.
+   */
+  check(grant: Grant | null, wallet: Wallet, requestId: string): { fits: boolean; reasons: string[] };
+}
+export function termsGate(): TermsGate;

package/src/terms.mjs

@@ -0,0 +1,500 @@
+// Terms the user allows for one task (docs/profile-v0.md section 5.3, "Confirmed terms", D-056): the token, who may
+// take it, the most and the latest end. The agent drafts them from the user's words (readTerms). The wallet shows them
+// exactly (termsText), and the user confirms them on the wallet's own screen, never through a tool the agent can call
+// (section 11 item 10; confirmTerms). A request whose grant (grant.mjs) fits them then needs no second yes, and one
+// that does not is refused with its reasons (checkGrant). termsGate keeps the order: the terms are confirmed before the
+// request is read, and they cannot change after.
+//
+// Pure: no clock and no zone of their own. The wallet passes `now`, nanoseconds since the Unix epoch as a bigint (as
+// @meantjs/format takes it), and its UTC offset. Nothing is rounded: an amount with more decimals than its token has is
+// refused (spec section 5.3, D-006), and times are compared in nanoseconds.
+
+import { displayAccount, displayAmount, normalizeName, parseAccount, parseAmount, principalFromText, principalToText } from "@meantjs/format";
+import { jcs, readAddress } from "@meantjs/profile/evm";
+import { zoneName } from "./display.mjs";
+import { CODES, fail } from "./errors.mjs";
+import { secondsText } from "./grant.mjs";
+import { sha256Hex } from "./sha256.mjs";
+
+/** A term the agent wrote that cannot be read, or a step out of order. `message` is written for the agent, which asks the user when it cannot fix the term itself. */
+export class TermsError extends Error {
+  /**
+   * @param {string} code  one of TERMS_CODES
+   * @param {string} message
+   */
+  constructor(code, message) {
+    super(message);
+    this.name = "TermsError";
+    this.code = code;
+  }
+}
+
+export const TERMS_CODES = Object.freeze({
+  MISSING: "E_TERMS_MISSING", // a field is missing or empty, or both spender and to are given
+  TOKEN: "E_TERMS_TOKEN", // a token the wallet does not know
+  PARTY: "E_TERMS_PARTY", // an app the wallet does not know, or an address or account that is not one
+  AMOUNT: "E_TERMS_AMOUNT", // an amount that cannot be read, or has more decimals than its token
+  END: "E_TERMS_END", // an end that cannot be read, or a date before today
+  ORDER: "E_TERMS_ORDER", // termsGate: a step out of order
+});
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const NS_PER_S = 1_000_000_000n;
+const NS_PER_MINUTE = 60n * NS_PER_S;
+const NS_PER_DAY = 86_400n * NS_PER_S;
+/** As icrc21.mjs takes a zone: a fixed offset of at most a day. */
+const MAX_OFFSET_MINUTES = 24 * 60;
+const HOURS = /^(\d{1,3})\s*hours?$/i;
+const LENGTH = /^(\d{1,4})\s*(day|week|month|year)s?$/i;
+const DATE = /^(\d{4})-(\d{2})-(\d{2})$/;
+const SECONDS = /^(-?)(0|[1-9][0-9]*)(?:\.([0-9]{1,9}))?$/;
+const NATURAL = /^(0|[1-9][0-9]*)$/;
+const MONTHS = ["January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December"];
+
+/** How a token or an app is looked up by name: NFKC, lowercase, letters and digits only, so "Uni-swap" and "1 inch" find Uniswap and 1inch. */
+const nameKey = (s) => normalizeName(s).replace(/[^\p{L}\p{N}]/gu, "");
+/** "A", "A and B", "A, B and C". */
+const listText = (names) => (names.length < 2 ? names.join("") : `${names.slice(0, -1).join(", ")} and ${names.at(-1)}`);
+const ADDRESS = /^0x/i;
+
+// ------------------------------------------------------------------------------------------------ days, exactly
+
+const floorDiv = (a, b) => (a >= 0n ? a / b : -((-a + b - 1n) / b));
+/** Days since 1970-01-01 of a date in the proleptic Gregorian calendar (H. Hinnant's days_from_civil), any year. */
+function daysFrom(y, m, d) {
+  const yy = BigInt(y) - (m <= 2 ? 1n : 0n);
+  const era = floorDiv(yy, 400n);
+  const yoe = yy - era * 400n;
+  const doy = (153n * BigInt(m > 2 ? m - 3 : m + 9) + 2n) / 5n + BigInt(d) - 1n;
+  return era * 146097n + yoe * 365n + yoe / 4n - yoe / 100n + doy - 719468n;
+}
+/** The date of a day count (civil_from_days): { y, m, d } with y a bigint. */
+function dateOf(days) {
+  const z = days + 719468n;
+  const era = floorDiv(z, 146097n);
+  const doe = z - era * 146097n;
+  const yoe = (doe - doe / 1460n + doe / 36524n - doe / 146096n) / 365n;
+  const doy = doe - (365n * yoe + yoe / 4n - yoe / 100n);
+  const mp = (5n * doy + 2n) / 153n;
+  const d = Number(doy - (153n * mp + 2n) / 5n + 1n);
+  const m = Number(mp < 10n ? mp + 3n : mp - 9n);
+  return { y: yoe + era * 400n + (m <= 2 ? 1n : 0n), m, d };
+}
+const daysIn = (y, m) => Number(daysFrom(m === 12 ? BigInt(y) + 1n : y, m === 12 ? 1 : m + 1, 1) - daysFrom(y, m, 1));
+const isoDate = ({ y, m, d }) => `${String(y).padStart(4, "0")}-${String(m).padStart(2, "0")}-${String(d).padStart(2, "0")}`;
+/** A YYYY-MM-DD that names a real day, as { y, m, d }; null otherwise ("2027-02-30"). */
+function readDate(text) {
+  const m = DATE.exec(text);
+  if (!m) return null;
+  const [y, mo, d] = [Number(m[1]), Number(m[2]), Number(m[3])];
+  return mo >= 1 && mo <= 12 && d >= 1 && d <= daysIn(y, mo) ? { y: BigInt(y), m: mo, d } : null;
+}
+/** Local time in ns at an offset -> its day count. */
+const localDays = (ns, offset) => floorDiv(ns + BigInt(offset) * NS_PER_MINUTE, NS_PER_DAY);
+/** The last nanosecond of a local date: a date allows its whole day. */
+const endOfDay = (date, offset) => (daysFrom(date.y, date.m, date.d) + 1n) * NS_PER_DAY - BigInt(offset) * NS_PER_MINUTE - 1n;
+
+/**
+ * A length of time from a date as the date it ends on. Days and weeks count days. Months and years count calendar
+ * months, and a day the target month does not have becomes its last day (31 January and 1 month is 28 or 29 February).
+ */
+function addLength(n, unit, from) {
+  if (unit === "day" || unit === "week") return dateOf(daysFrom(from.y, from.m, from.d) + BigInt(n * (unit === "week" ? 7 : 1)));
+  const months = from.y * 12n + BigInt(from.m - 1) + BigInt(n * (unit === "year" ? 12 : 1));
+  const y = floorDiv(months, 12n);
+  const m = Number(months - y * 12n) + 1;
+  return { y, m, d: Math.min(from.d, daysIn(y, m)) };
+}
+
+/** Exact seconds (a decimal string, as a grant writes them) -> ns. */
+function nsOf(seconds) {
+  const m = SECONDS.exec(seconds);
+  const ns = BigInt(m[2]) * NS_PER_S + BigInt((m[3] ?? "").padEnd(9, "0"));
+  return m[1] ? -ns : ns;
+}
+const dayText = ({ y, m, d }) => `${d} ${MONTHS[m - 1]} ${y}`;
+/** A moment in the zone, exactly: "2 November 2026 at 14:00", with seconds and their fraction only when there are any. */
+function timeText(ns, offset) {
+  const local = ns + BigInt(offset) * NS_PER_MINUTE;
+  const days = floorDiv(local, NS_PER_DAY);
+  const rest = local - days * NS_PER_DAY;
+  const s = rest / NS_PER_S;
+  const frac = (rest % NS_PER_S).toString().padStart(9, "0").replace(/0+$/, "");
+  const hm = `${String(s / 3600n).padStart(2, "0")}:${String((s / 60n) % 60n).padStart(2, "0")}`;
+  const sec = s % 60n !== 0n || frac ? `:${String(s % 60n).padStart(2, "0")}${frac ? `.${frac}` : ""}` : "";
+  return `${dayText(dateOf(days))} at ${hm}${sec}`;
+}
+
+// ------------------------------------------------------------------------------------------------ the wallet
+
+/**
+ * @typedef {object} Wallet
+ * @property {Record<string, { address?: string, canister?: string, decimals: number }>} tokens  the tokens it knows, by
+ *   symbol: an EVM token's address or an Internet Computer ledger's canister id, and its decimals
+ * @property {Record<string, string>} [apps]  the apps and people it knows by name: an address, or an account in its
+ *   ICRC-1 text. The agent names one and code looks it up: the agent never turns a name into an address itself
+ * @property {bigint} now  nanoseconds since the Unix epoch, from the wallet's clock
+ * @property {number} [utcOffsetMinutes]  the user's zone, default 0 (UTC): a date allows its whole day there
+ */
+
+const canister = (text) => principalToText(principalFromText(text));
+/** An address in EIP-55 form, or an account in its ICRC-1 text, or null. */
+function partyId(text) {
+  if (typeof text !== "string") return null;
+  try {
+    return ADDRESS.test(text) ? { chain: "evm", id: readAddress(text) } : { chain: "icp", id: displayAccount(parseAccount(text)) };
+  } catch {
+    return null;
+  }
+}
+function tokenId(text) {
+  if (typeof text !== "string") return null;
+  try {
+    return ADDRESS.test(text) ? { chain: "evm", id: readAddress(text) } : { chain: "icp", id: canister(text) };
+  } catch {
+    return null;
+  }
+}
+
+function walletOf(wallet) {
+  const bad = (why) => fail(CODES.REQUEST, `wallet ${why}`);
+  if (!isObject(wallet)) bad("must be { tokens, apps, now, utcOffsetMinutes }");
+  const { tokens, apps = {}, now, utcOffsetMinutes = 0 } = wallet;
+  if (typeof now !== "bigint" || now < 0n) bad(".now must be nanoseconds since the Unix epoch, a bigint");
+  if (!Number.isInteger(utcOffsetMinutes) || Math.abs(utcOffsetMinutes) > MAX_OFFSET_MINUTES) bad(`.utcOffsetMinutes must be whole minutes within +-${MAX_OFFSET_MINUTES}`);
+  if (!isObject(tokens) || Object.keys(tokens).length === 0) bad(".tokens must name its tokens by symbol: { USDC: { address, decimals }, ICP: { canister, decimals } }");
+  if (!isObject(apps)) bad(".apps must be { name: address or account }");
+  const byKey = new Map();
+  const unique = (kind, name) => {
+    const key = nameKey(name);
+    if (!key) bad(`${kind} ${JSON.stringify(name)} has no letters or digits`);
+    if (byKey.has(`${kind}:${key}`)) bad(`${kind}s ${JSON.stringify(byKey.get(`${kind}:${key}`))} and ${JSON.stringify(name)} are one name once case, spaces and punctuation are set aside`);
+    byKey.set(`${kind}:${key}`, name);
+    return key;
+  };
+  const ids = new Map();
+  const tokenList = Object.entries(tokens).map(([symbol, t]) => {
+    const key = unique("token", symbol);
+    if (!isObject(t) || (t.address === undefined) === (t.canister === undefined)) bad(`.tokens.${symbol} must give its address or its canister, not both`);
+    const id = t.address !== undefined ? tokenId(t.address) : tokenId(t.canister);
+    if (id === null || (t.address !== undefined) !== (id.chain === "evm")) bad(`.tokens.${symbol}: ${JSON.stringify(t.address ?? t.canister)} is not ${t.address !== undefined ? "an address (0x and 40 hex digits)" : "a canister id"}`);
+    if (ids.has(id.id)) bad(`.tokens ${ids.get(id.id)} and ${symbol} are the same token`);
+    ids.set(id.id, symbol);
+    try {
+      displayAmount("0", { decimals: t.decimals, symbol });
+    } catch (e) {
+      bad(`.tokens.${symbol}: ${e.message}`);
+    }
+    return { symbol, key, ...id, decimals: Number(t.decimals) };
+  });
+  const appList = Object.entries(apps).map(([name, value]) => {
+    const key = unique("app", name);
+    const id = partyId(value);
+    if (id === null) bad(`.apps.${name}: ${JSON.stringify(value)} is neither an address (0x and 40 hex digits) nor an ICRC-1 account`);
+    return { name, key, ...id };
+  });
+  return { tokens: tokenList, apps: appList, now, offset: utcOffsetMinutes };
+}
+
+/** The one app with this address or account, by name; null for none. */
+const appNamed = (w, id) => w.apps.find((a) => a.id === id)?.name ?? null;
+
+// ------------------------------------------------------------------------------------------------ terms
+
+/**
+ * The agent's terms, read: what the user allows, in the wallet's own values. Throws TermsError with a message for the
+ * agent when a term cannot be read; it never guesses a token, an app, a number of decimals or a date.
+ *
+ * @param {{ token: string, spender?: string, to?: string, max_amount: string, expires_by: string }} fields  as the agent
+ *   wrote them: the token by symbol; `spender` (who may spend the tokens) or `to` (who is paid directly), by the name
+ *   the wallet knows or an address or account the user gave; the most, in tokens ("100", "0.5"), or "unlimited"; the
+ *   latest end, as YYYY-MM-DD (the whole day counts), a length from today ("30 days", "2 weeks", "1 month", "1 year"),
+ *   a number of hours from now ("2 hours", an exact time), or "never"
+ * @param {Wallet} wallet
+ */
+export function readTerms(fields, wallet) {
+  const w = walletOf(wallet);
+  const o = isObject(fields) ? fields : {};
+  const given = (k) => typeof o[k] === "string" && o[k].trim() !== "";
+  if (given("spender") && given("to")) throw new TermsError(TERMS_CODES.MISSING, "give spender or to, not both: spender for who may spend the tokens, to for who is paid directly");
+  const role = given("to") ? "to" : "spender";
+  const str = (k, what = k) => {
+    if (!given(k)) throw new TermsError(TERMS_CODES.MISSING, `missing parameter: ${what}`);
+    return o[k].trim();
+  };
+  const written = { token: str("token"), [role]: str(role, "spender or to"), max_amount: str("max_amount"), expires_by: str("expires_by") };
+
+  const token = w.tokens.find((t) => t.key === nameKey(written.token));
+  if (!token) {
+    throw new TermsError(TERMS_CODES.TOKEN, `the wallet knows no token named ${JSON.stringify(written.token)}; it knows ${listText(w.tokens.map((t) => t.symbol))}. If the user named another token, or did not say which, ask the user`);
+  }
+  const party = readParty(role, written[role], token, w);
+
+  let amount;
+  if (written.max_amount.toLowerCase() === "unlimited") amount = { units: null, unlimited: true };
+  else {
+    try {
+      amount = { units: parseAmount(written.max_amount, { decimals: token.decimals, symbol: token.symbol, candid: token.chain === "evm" ? "uint256" : "nat" }), unlimited: false };
+    } catch (e) {
+      if (typeof e?.code !== "string") throw e;
+      throw new TermsError(TERMS_CODES.AMOUNT, `max_amount: ${e.message}`); // refuses, never rounds
+    }
+  }
+
+  const exp = written.expires_by;
+  const today = dateOf(localDays(w.now, w.offset));
+  let ends;
+  const hours = HOURS.exec(exp);
+  const length = LENGTH.exec(exp);
+  if (exp.toLowerCase() === "never") ends = { never: true };
+  else if (hours) ends = { at: secondsText((w.now / NS_PER_S) * NS_PER_S + BigInt(hours[1]) * 3600n * NS_PER_S) }; // from now in whole seconds: an exact time
+  else {
+    const date = length ? addLength(Number(length[1]), length[2].toLowerCase(), today) : readDate(exp);
+    if (!date) {
+      throw new TermsError(TERMS_CODES.END, `expires_by must be a date as YYYY-MM-DD, a length of time from now as a number and a unit (hours, days, weeks, months or years), such as "2 hours", "30 days" or "1 month", or "never"; got ${JSON.stringify(exp)}`);
+    }
+    if (date.y > 9999n) throw new TermsError(TERMS_CODES.END, `expires_by ${JSON.stringify(exp)} ends after the year 9999; write "never" only if the user plainly accepts no end`);
+    if (daysFrom(date.y, date.m, date.d) < daysFrom(today.y, today.m, today.d)) throw new TermsError(TERMS_CODES.END, `expires_by ${isoDate(date)} is before today, ${isoDate(today)}`);
+    ends = { at: secondsText(endOfDay(date, w.offset)), day: isoDate(date) };
+  }
+  return { token: token.id, symbol: token.symbol, decimals: token.decimals, [role]: party.id, name: party.name, amount, ends, utcOffsetMinutes: w.offset, written };
+}
+
+function readParty(role, text, token, w) {
+  const evm = token.chain === "evm";
+  if (evm && ADDRESS.test(text)) {
+    try {
+      const id = readAddress(text);
+      return { id, name: appNamed(w, id) };
+    } catch (e) {
+      if (e?.code === "E_ADDRESS_CHECKSUM") throw new TermsError(TERMS_CODES.PARTY, `${role} ${text} is in mixed case, but its EIP-55 checksum does not match: a character may be mistyped. Ask the user to check the address`);
+      throw new TermsError(TERMS_CODES.PARTY, `${role} ${JSON.stringify(text)} is not a 0x address with 40 hex digits`);
+    }
+  }
+  if (!evm) {
+    const id = partyId(text);
+    if (id?.chain === "icp") return { id: id.id, name: appNamed(w, id.id) };
+  }
+  const what = evm ? "a 0x address" : "an account: a principal, or its ICRC-1 text with a subaccount";
+  const app = w.apps.find((a) => a.key === nameKey(text));
+  const here = w.apps.filter((a) => a.chain === token.chain).map((a) => a.name);
+  if (!app && here.length === 0) throw new TermsError(TERMS_CODES.PARTY, `${role} must be ${what}; got ${JSON.stringify(text)}`);
+  if (!app) {
+    throw new TermsError(TERMS_CODES.PARTY, `the wallet knows no app named ${JSON.stringify(text)}; it knows ${listText(here)}. If the user named another app, or none, ask the user which app they mean, or for its ${evm ? "address" : "account"}`);
+  }
+  if (app.chain !== token.chain) {
+    throw new TermsError(TERMS_CODES.PARTY, `the wallet has ${app.chain === "evm" ? "an EVM address" : "an Internet Computer account"} for ${app.name}, and ${token.symbol} is a token ${evm ? "on an EVM chain" : "on the Internet Computer"}; ask the user for ${what}`);
+  }
+  return { id: app.id, name: app.name };
+}
+
+/** Terms as readTerms wrote them (with `id` when confirmed), checked so that their text cannot say less than they allow. */
+function termsOf(terms, { confirmed = false } = {}) {
+  const bad = (why) => fail(CODES.REQUEST, `terms ${why}: they come from readTerms${confirmed ? ", then confirmTerms" : ""}`);
+  if (!isObject(terms)) bad("must be an object");
+  const role = terms.spender !== undefined ? "spender" : "to";
+  const want = ["token", "symbol", "decimals", role, "name", "amount", "ends", "utcOffsetMinutes", "written", ...(confirmed ? ["id"] : [])];
+  const keys = Object.keys(terms).filter((k) => !(k === "id" && !confirmed));
+  if (keys.length !== want.length || !want.every((k) => Object.hasOwn(terms, k))) bad(`must have exactly ${want.join(", ")}`);
+  const token = tokenId(terms.token);
+  const party = partyId(terms[role]);
+  if (!token || token.id !== terms.token) bad("name their token by its address (EIP-55) or canister id");
+  if (!party || party.id !== terms[role] || party.chain !== token.chain) bad(`name their ${role} by an address (EIP-55) or an account (ICRC-1 text) on the token's chain`);
+  if (terms.name !== null && (typeof terms.name !== "string" || !terms.name)) bad("name the party's app by a non-empty string, or null");
+  try {
+    displayAmount("0", { decimals: terms.decimals, symbol: terms.symbol });
+  } catch (e) {
+    bad(`have a symbol and decimals: ${e.message}`);
+  }
+  const { amount, ends, utcOffsetMinutes: offset } = terms;
+  if (!isObject(amount) || Object.keys(amount).length !== 2 || typeof amount.unlimited !== "boolean" || (amount.unlimited ? amount.units !== null : typeof amount.units !== "string" || !NATURAL.test(amount.units))) {
+    bad("give their amount as { units, unlimited: false } or { units: null, unlimited: true }");
+  }
+  if (!Number.isInteger(offset) || Math.abs(offset) > MAX_OFFSET_MINUTES) bad("give their zone in whole minutes");
+  const keysOf = isObject(ends) ? Object.keys(ends).sort().join() : "";
+  const at = keysOf === "at" || keysOf === "at,day" ? SECONDS.test(ends.at) && !ends.at.startsWith("-") : keysOf === "never" && ends.never === true;
+  if (!at) bad("give their end as { at }, { at, day } or { never: true }");
+  if (keysOf === "at,day") {
+    const date = typeof ends.day === "string" ? readDate(ends.day) : null;
+    if (!date || nsOf(ends.at) !== endOfDay(date, offset)) bad("end with the last moment of their day");
+  }
+  if (!isObject(terms.written) || !Object.values(terms.written).every((v) => typeof v === "string")) bad("keep what the agent wrote, as strings");
+  if (confirmed && terms.id !== termsId(terms)) bad("are not the ones the user confirmed: they changed after confirmTerms");
+  return terms;
+}
+
+const termsId = ({ id, ...rest }) => sha256Hex(jcs(rest));
+const partyText = (name, id) => (name ? `${name} (${id})` : id);
+const zoneOf = (offset) => `(${zoneName(offset)})`;
+const mostText = (t) => displayAmount(t.amount.units, { decimals: t.decimals, symbol: t.symbol });
+function untilText(t) {
+  if (t.ends.day !== undefined) return `until the end of ${dayText(readDate(t.ends.day))} ${zoneOf(t.utcOffsetMinutes)}`;
+  return `until ${timeText(nsOf(t.ends.at), t.utcOffsetMinutes)} ${zoneOf(t.utcOffsetMinutes)}`;
+}
+
+/**
+ * The terms in words, for the user to confirm on the wallet's own screen: the full address, the amount without
+ * rounding, and "any amount (unlimited)" or "never ends" written out (spec section 11 item 10). For example: "Uniswap
+ * (0x66a9893cC07D91D95644AEDD05D03f95e1dBA8Af) may spend at most 500 USDC, until the end of 30 November 2026 (UTC)."
+ */
+export function termsText(terms) {
+  const t = termsOf(terms, { confirmed: terms?.id !== undefined });
+  const role = t.spender !== undefined ? "spender" : "to";
+  const verb = role === "spender" ? "may spend" : "may be sent";
+  const amount = t.amount.unlimited ? `any amount of ${t.symbol} (unlimited)` : `at most ${mostText(t)}`;
+  const end = t.ends.never ? "and this permission never ends" : untilText(t);
+  return `${partyText(t.name, t[role])} ${verb} ${amount}, ${end}.`;
+}
+
+/**
+ * The terms as the user confirmed them, with `id`: the SHA-256 of their canonical JSON (RFC 8785), lowercase hex. Call it
+ * only once the user has confirmed exactly `termsText(terms)` on the wallet's own screen. The result is frozen, and
+ * checkGrant refuses terms whose id no longer matches.
+ */
+export function confirmTerms(terms) {
+  const { id, ...rest } = isObject(terms) ? terms : {};
+  termsOf(rest);
+  return deepFreeze(structuredClone({ ...rest, id: termsId(rest) }));
+}
+
+function deepFreeze(value) {
+  if (value !== null && typeof value === "object") {
+    for (const v of Object.values(value)) deepFreeze(v);
+    Object.freeze(value);
+  }
+  return value;
+}
+
+/** A grant from the consent functions, checked; its token and party as the terms write theirs. */
+function grantOf(grant) {
+  const bad = (why) => fail(CODES.REQUEST, `grant ${why}: it comes from evmConsent, eip712Consent or generateConsent`);
+  if (!isObject(grant)) bad("must be an object or null");
+  if (grant.kind !== "transfer" && grant.kind !== "approve") bad("has kind transfer or approve");
+  if ((grant.spender === undefined) === (grant.to === undefined)) bad("names spender or to");
+  const role = grant.spender !== undefined ? "spender" : "to";
+  const token = tokenId(grant.token);
+  const party = partyId(grant[role]);
+  if (!token || !party || token.chain !== party.chain) bad(`names its token and its ${role} on one chain`);
+  const { amount, ends } = grant;
+  if (!isObject(amount) || typeof amount.unlimited !== "boolean" || !(amount.units === null ? amount.unlimited : typeof amount.units === "string" && NATURAL.test(amount.units))) bad("gives its amount as { units, unlimited }");
+  const end = isObject(ends) ? Object.keys(ends).join() : "";
+  if (!(end === "at" ? typeof ends.at === "string" && SECONDS.test(ends.at) : (end === "never" && ends.never === true) || (end === "now" && ends.now === true))) bad("ends { at }, { never: true } or { now: true }");
+  return { role, token: token.id, party: party.id, amount, ends };
+}
+
+/**
+ * Whether a request's grant fits terms the user confirmed (spec section 5.3, "Confirmed terms"): its token and its
+ * spender or recipient are the terms', its amount is at most the terms' most (unlimited only under unlimited terms; a
+ * grant of nothing fits any), and it ends no later than the terms' end (one that never ends only under terms that never
+ * end; a transfer while the terms have not ended). A request that fits may be signed or sent without a second yes. One
+ * that does not is refused with the reasons, and the agent asks the user for new terms. A request without a grant
+ * (`null`) is not covered by terms and needs its confirmation.
+ *
+ * @param {object} confirmed  confirmTerms' result, unchanged
+ * @param {object | null} grant  the `grant` of evmConsent, eip712Consent or generateConsent
+ * @param {Wallet} wallet  its clock, and the names it shows: its tokens and apps
+ * @returns {{ fits: boolean, reasons: string[] }}
+ */
+export function checkGrant(confirmed, grant, wallet) {
+  const t = termsOf(confirmed, { confirmed: true });
+  const w = walletOf(wallet);
+  if (grant === null || grant === undefined) {
+    return { fits: false, reasons: ["the request has no grant a profile describes, so no terms cover it: it needs the user's confirmation"] };
+  }
+  const g = grantOf(grant);
+  const role = t.spender !== undefined ? "spender" : "to";
+  const tokenName = (id) => w.tokens.find((k) => k.id === id)?.symbol ?? id;
+  const named = (id) => partyText(appNamed(w, id), id);
+  const terms = partyText(t.name, t[role]);
+  const reasons = [];
+  const sameToken = g.token === t.token;
+  if (!sameToken) reasons.push(`the request is for ${tokenName(g.token)}, the terms say ${t.symbol}`);
+  if (g.role !== role) reasons.push(role === "spender" ? `the request pays ${named(g.party)} directly, the terms let ${terms} spend` : `the request lets ${named(g.party)} spend, the terms pay ${terms} directly`);
+  else if (g.party !== t[role]) reasons.push(`the ${role === "spender" ? "spender" : "recipient"} is ${named(g.party)}, the terms say ${terms}`);
+  if (sameToken && !t.amount.unlimited) {
+    if (g.amount.unlimited) reasons.push(`the request is unlimited, the terms say at most ${mostText(t)}`);
+    else if (BigInt(g.amount.units) > BigInt(t.amount.units)) reasons.push(`the request allows ${displayAmount(g.amount.units, { decimals: t.decimals, symbol: t.symbol })}, the terms say at most ${mostText(t)}`);
+  }
+  if (!t.ends.never) {
+    const end = nsOf(t.ends.at);
+    if (g.ends.never) reasons.push(`the permission never ends, the terms say ${untilText(t)}`);
+    else if (g.ends.now) {
+      if (w.now > end) reasons.push(`the terms have ended: they said ${untilText(t)}`);
+    } else if (nsOf(g.ends.at) > end) reasons.push(`the permission lasts until ${timeText(nsOf(g.ends.at), t.utcOffsetMinutes)} ${zoneOf(t.utcOffsetMinutes)}, the terms say ${untilText(t)}`);
+  }
+  return { fits: reasons.length === 0, reasons };
+}
+
+/**
+ * The order of one task, kept (spec section 5.3, "Confirmed terms"; the order surface D2 of the everyday-wording test
+ * kept): the agent proposes terms, the user confirms exactly their text on the wallet's own screen, the agent reads the
+ * request, and its grant is checked. Once the request is read the terms cannot change: new terms are a new task, with a
+ * new gate. The terms cover one request, the first checked, named by the id the wallet gives it. Steps out of order
+ * throw TermsError E_TERMS_ORDER, with a message for the agent.
+ */
+export function termsGate() {
+  let proposed = null;
+  let confirmed = null;
+  let read = false;
+  let request = null;
+  const order = (why) => {
+    throw new TermsError(TERMS_CODES.ORDER, why);
+  };
+  const fixed = () => read && order("the request was read under the confirmed terms, so they cannot be changed now; new terms start a new task");
+  return {
+    /** "open", "proposed", "confirmed" or "read". */
+    get state() {
+      return read ? "read" : confirmed ? "confirmed" : proposed ? "proposed" : "open";
+    },
+    /** The terms waiting for the user, or null. */
+    get proposed() {
+      return proposed;
+    },
+    /** The terms the user confirmed, or null. */
+    get confirmed() {
+      return confirmed;
+    },
+    /** The agent's draft, readTerms' terms. It replaces an earlier draft and its confirmation. Returns the text to show the user. */
+    propose(terms) {
+      fixed();
+      const { id, ...draft } = isObject(terms) ? terms : {};
+      proposed = deepFreeze(structuredClone(termsOf(draft)));
+      confirmed = null;
+      return termsText(proposed);
+    },
+    /** The wallet, when the user confirmed `shown` on its own screen: it must be exactly termsText of the draft. Returns the confirmed terms. */
+    confirm(shown) {
+      fixed();
+      if (proposed === null) order("there are no terms to confirm: the agent proposes them first");
+      if (shown !== termsText(proposed)) order("the text the user confirmed is not the text of the terms proposed; show termsText(gate.proposed) and ask again");
+      confirmed = confirmTerms(proposed);
+      return confirmed;
+    },
+    /** The user said no: the draft is dropped, and the agent may propose other terms or ask the user. */
+    reject() {
+      fixed();
+      proposed = null;
+      confirmed = null;
+    },
+    /** Before the agent reads the request: refused until the user has confirmed terms. */
+    read() {
+      if (confirmed === null) order(proposed ? "the user has not confirmed the terms yet; the request can be read once they do" : "there are no terms yet: propose the user's terms, and read the request once the user confirms them");
+      read = true;
+    },
+    /**
+     * The grant of the request read, against the confirmed terms: checkGrant's { fits, reasons }. `requestId` names the
+     * request the wallet will sign or send: eip712Consent's `digest`, or for a call the wallet's own id of it (an EVM
+     * transaction's hash, an Internet Computer request's id). The same request may be checked again; another is refused
+     * even when it grants the same, since two Permit2 transfers that differ only in their nonce are two transfers.
+     */
+    check(grant, wallet, requestId) {
+      if (!read) order("read the request first: its grant is checked against the terms it was read under");
+      if (typeof requestId !== "string" || requestId === "") fail(CODES.REQUEST, "termsGate's check needs the request's id: eip712Consent's digest, or the wallet's own id of a call");
+      const result = checkGrant(confirmed, grant, wallet);
+      const key = jcs(grant ?? null);
+      if (request !== null && (requestId !== request.id || key !== request.grant)) order("these terms cover one request, the one already checked; another request is a new task, with new terms");
+      request = { id: requestId, grant: key };
+      return result;
+    },
+  };
+}