@melra/policy-core 0.3.0-alpha.10 → 0.3.0-alpha.12

package/README.md

@@ -30,12 +30,22 @@ never reaches a runtime.
 - Terminal commands must be allowlisted by basename. Shell interpreters and
   `sudo`/`su` are denied unconditionally. `git` counts as a read only for a small
   read-only subcommand set; `npm`, `npx`, and `pnpm` are high-risk mutations.
-- Browser destinations default to `allowedDomains: ["*"]` with localhost allowed,
-  because the allowlist is a narrowing control, not the safety boundary — the
-  browser runtime independently blocks private and metadata destinations.
+- Browser and HTTP destinations default to `allowedDomains: ["*"]` with localhost
+  allowed, because the allowlist is a narrowing control, not the safety boundary
+  — `assertSafeDestination`, exported from this package, is what blocks private
+  and metadata destinations, and it holds even with `allowedDomains: ["*"]`.
 - `classifyOperation` is the single place effect and risk are decided. An action
   that is not classified there is mis-classified, not unclassified.
 
+## The destination boundary
+
+`assertSafeDestination` lives here rather than in a runtime so every adapter that
+opens a socket shares one implementation. It rejects non-`http(s)` protocols and
+URL credentials, resolves DNS first and checks **every** answer, and blocks
+private, loopback, link-local, and cloud-metadata ranges in IPv4, IPv6, and
+IPv4-mapped IPv6 form. It returns the address it checked so the caller can pin
+the socket to it instead of letting the name resolve a second time.
+
 ## Capability grants
 
 `policy.capabilities` is authority; everything above is rules. It is empty by
@@ -72,6 +82,12 @@ rules it was not written for.
 caller's own `forbiddenEffects` and `constraints` are honoured, because those are
 the caller bounding its own task rather than a guardrail MELRA imposes.
 
+`mode` is `developer` or `enforced` and is not about a request at all: it records
+how this kernel is deployed, and therefore what it refuses about its own setup
+rather than about a caller. `deploymentMode` parses it from the flag, the
+environment, and the policy file through one function, so a typo fails loudly
+instead of leaving a machine permissive with a config that claims otherwise.
+
 Requires Node.js 22 or newer. Full documentation:
 [github.com/XAGI-Lab/melra](https://github.com/XAGI-Lab/melra)
 

package/dist/credentials.d.ts

@@ -0,0 +1,29 @@
+import type { CredentialDefinition } from "@melra/protocol";
+export interface BrokeredHeaders {
+    /** Headers to merge into the outgoing request, lowercased. */
+    headers: Record<string, string>;
+    /** Names of the credentials that were injected — never their values. */
+    used: string[];
+}
+/**
+ * Holds the secrets so the agent does not have to.
+ *
+ * An adapter asks for the headers one operation may carry and gets back either
+ * a header it can send or nothing at all. It never receives the secret as a
+ * value it could log, return, or persist, and the broker never writes one down:
+ * every call re-reads the source, so rotating a key takes effect on the next
+ * request rather than on the next restart.
+ */
+export declare class CredentialBroker {
+    private readonly definitions;
+    private readonly environment;
+    constructor(definitions?: Record<string, CredentialDefinition>, environment?: NodeJS.ProcessEnv);
+    /** True when nothing is configured, so a caller can skip the await. */
+    get empty(): boolean;
+    headersFor(request: {
+        host: string;
+        capability: string;
+        target: string;
+    }): Promise<BrokeredHeaders>;
+}
+//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wEAAwE;IACxE,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AA4DD;;;;;;;;GAQG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAM,EACtD,WAAW,GAAE,MAAM,CAAC,UAAwB;IAG/D,uEAAuE;IACvE,IAAI,KAAK,IAAI,OAAO,CAEnB;IAEK,UAAU,CAAC,OAAO,EAAE;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,eAAe,CAAC;CAkC7B"}

package/dist/credentials.js

@@ -0,0 +1,112 @@
+// Copyright 2026 XAGI Labs Private Limited
+// SPDX-License-Identifier: Apache-2.0
+import { constants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+function patternMatches(pattern, value) {
+    if (pattern === "*")
+        return true;
+    const escaped = pattern
+        .replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+        .replaceAll("\\*", ".*");
+    return new RegExp(`^${escaped}$`).test(value);
+}
+function errorCode(error) {
+    return error !== null && typeof error === "object" && "code" in error
+        ? String(error.code)
+        : undefined;
+}
+/**
+ * Read a secret out of a file the same way the payload key is read: refuse a
+ * symlink, refuse anything but a regular file, and refuse a mode any other user
+ * can read. A secret in a world-readable file is one the agent could have read
+ * for itself, which would make the whole broker decorative.
+ */
+async function readSecretFile(path) {
+    const before = await lstat(path);
+    if (before.isSymbolicLink()) {
+        throw new Error("credential_file_must_not_be_symlink");
+    }
+    let handle;
+    try {
+        handle = await open(path, constants.O_RDONLY |
+            (process.platform === "win32" ? 0 : constants.O_NOFOLLOW));
+    }
+    catch (error) {
+        if (errorCode(error) === "ELOOP") {
+            throw new Error("credential_file_must_not_be_symlink");
+        }
+        throw error;
+    }
+    try {
+        const metadata = await handle.stat();
+        if (!metadata.isFile() ||
+            metadata.dev !== before.dev ||
+            metadata.ino !== before.ino) {
+            throw new Error("credential_file_not_regular_file");
+        }
+        if (process.platform !== "win32" && (metadata.mode & 0o077) !== 0) {
+            throw new Error("credential_file_permissions_too_open");
+        }
+        const secret = (await handle.readFile("utf8")).trim();
+        if (secret === "")
+            throw new Error("credential_file_empty");
+        return secret;
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * Holds the secrets so the agent does not have to.
+ *
+ * An adapter asks for the headers one operation may carry and gets back either
+ * a header it can send or nothing at all. It never receives the secret as a
+ * value it could log, return, or persist, and the broker never writes one down:
+ * every call re-reads the source, so rotating a key takes effect on the next
+ * request rather than on the next restart.
+ */
+export class CredentialBroker {
+    definitions;
+    environment;
+    constructor(definitions = {}, environment = process.env) {
+        this.definitions = definitions;
+        this.environment = environment;
+    }
+    /** True when nothing is configured, so a caller can skip the await. */
+    get empty() {
+        return Object.keys(this.definitions).length === 0;
+    }
+    async headersFor(request) {
+        const headers = {};
+        const used = [];
+        const operation = `${request.capability}:${request.target}`;
+        const host = request.host.toLowerCase();
+        for (const [name, definition] of Object.entries(this.definitions)) {
+            if (!definition.hosts.some((pattern) => patternMatches(pattern.toLowerCase(), host))) {
+                // Not this credential's host. The request still goes out, just
+                // unauthenticated — which is what stops a URL the caller chose from
+                // walking somebody's bearer token to an origin it was never issued for.
+                continue;
+            }
+            if (!patternMatches(definition.capability, operation)) {
+                // Refused before the source is touched. The credential could perform
+                // this call; the delegation did not say it may, and that gap is the
+                // entire difference between holding a credential and holding authority.
+                throw new Error(`credential_capability_not_covered:${name}`);
+            }
+            const secret = "env" in definition.source
+                ? this.environment[definition.source.env]
+                : await readSecretFile(definition.source.file);
+            if (secret === undefined || secret === "") {
+                throw new Error(`credential_source_missing:${name}`);
+            }
+            headers[definition.inject.header.toLowerCase()] =
+                definition.inject.scheme === undefined
+                    ? secret
+                    : `${definition.inject.scheme} ${secret}`;
+            used.push(name);
+        }
+        return { headers, used };
+    }
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAmB,MAAM,kBAAkB,CAAC;AAUhE,SAAS,cAAc,CAAC,OAAe,EAAE,KAAa;IACpD,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC;SACtC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3B,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK;QACnE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CACjB,IAAI,EACJ,SAAS,CAAC,QAAQ;YAChB,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAC5D,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,IACE,CAAC,QAAQ,CAAC,MAAM,EAAE;YAClB,QAAQ,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YAC3B,QAAQ,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAC3B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,IAAI,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC5D,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,gBAAgB;IAER;IACA;IAFnB,YACmB,cAAoD,EAAE,EACtD,cAAiC,OAAO,CAAC,GAAG;QAD5C,gBAAW,GAAX,WAAW,CAA2C;QACtD,gBAAW,GAAX,WAAW,CAAiC;IAC5D,CAAC;IAEJ,uEAAuE;IACvE,IAAI,KAAK;QACP,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAIhB;QACC,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAExC,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBACrF,+DAA+D;gBAC/D,oEAAoE;gBACpE,wEAAwE;gBACxE,SAAS;YACX,CAAC;YACD,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC;gBACtD,qEAAqE;gBACrE,oEAAoE;gBACpE,wEAAwE;gBACxE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,MAAM,GACV,KAAK,IAAI,UAAU,CAAC,MAAM;gBACxB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC;gBACzC,CAAC,CAAC,MAAM,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBAC7C,UAAU,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS;oBACpC,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF"}

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import type { ApprovalChallenge, ApprovalResponse, CapabilityGrant, CapabilityTrait, Effect, EvidencePredicate, Identity, Operation, PolicyDecision, Risk, TaskRequest } from "@melra/protocol";
+import type { ApprovalChallenge, ApprovalResponse, CapabilityGrant, CapabilityTrait, CredentialDefinition, DeploymentMode, Effect, EvidencePredicate, HttpOperation, Identity, Operation, PolicyDecision, Risk, TaskRequest } from "@melra/protocol";
 export interface LocalPolicy {
     version: string;
     workspaceRoot: string;
@@ -53,6 +53,16 @@ export interface LocalPolicy {
      * holding authority over one directory rather than over the whole workspace.
      */
     capabilities: CapabilityGrant[];
+    /**
+     * Secrets the kernel injects on the caller's behalf, keyed by a name the
+     * caller may see in a receipt. Empty by default.
+     *
+     * The agent never holds one. It names an operation; if a definition's `hosts`
+     * cover the destination *and* its `capability` covers the operation, the
+     * kernel reads the secret at send time and puts it on the wire. See
+     * `CredentialBroker` for why those two lists behave differently on a miss.
+     */
+    credentials: Record<string, CredentialDefinition>;
     /**
      * Stops a task from re-running an operation whose target keeps failing.
      *
@@ -79,10 +89,32 @@ export interface LocalPolicy {
      * derives it from another setting.
      */
     unhinged: boolean;
+    /**
+     * How this kernel is deployed, and therefore what it refuses about its own
+     * setup rather than about a caller's request.
+     *
+     * `developer` is the default and changes nothing: MELRA governs the effects it
+     * is asked for, and the operator accepts that the harness may have another way
+     * to the same disk. `enforced` is the operator asserting there is no other way
+     * — the harness is sandboxed, holds no privileged secrets, and reaches systems
+     * only through here. MELRA cannot verify that assertion, so what it does
+     * instead is remove every door it owns that would contradict it: no
+     * `--unsafe-local`, no bind outside loopback, no client registering itself.
+     *
+     * Named on every receipt, because "was this effect governed by the only door
+     * or by one of several" is not something an auditor should have to infer.
+     */
+    mode: DeploymentMode;
 }
 export interface PolicyEvaluation {
     decision: PolicyDecision;
     challenge?: ApprovalChallenge;
+    /**
+     * The grant that authorised this, when `policy.capabilities` is non-empty.
+     * What the commit meters against — absent means no grants are configured and
+     * there is nothing to draw down.
+     */
+    grantId?: string;
 }
 export declare function normalizeCommandName(command: string): string;
 /**
@@ -103,6 +135,7 @@ export declare function normalizeCommandName(command: string): string;
  *   network at all, not "no network except the browser".
  */
 export type { CapabilityTrait } from "@melra/protocol";
+export { CredentialBroker, type BrokeredHeaders, } from "./credentials.js";
 /**
  * Classify a terminal command by what it does, not just by its name.
  *
@@ -122,6 +155,8 @@ export declare function classifyOperation(operation: Operation): {
     capability: string;
     target: string;
     traits: CapabilityTrait[];
+    /** What the caller declared this operation moves, when it declared one. */
+    spend?: DeclaredSpend;
 };
 /**
  * Evidence a mutation must satisfy when the caller declared none.
@@ -140,16 +175,51 @@ export declare function classifyOperation(operation: Operation): {
  */
 export declare function defaultEvidenceFor(operation: Operation): EvidencePredicate[];
 /**
- * Why the issued capabilities do not cover this effect, or `undefined` if they
- * do. An empty grant list is not a closed world — it means the operator has not
- * issued grants at all, and the rest of policy decides on its own.
+ * What a grant has already drawn down, read from wherever commits are counted.
+ *
+ * A lookup rather than a number because policy is evaluated more than once per
+ * task and a grant may be metered by any of several bounds; the caller that
+ * owns the durable count decides how to answer.
  */
-export declare function capabilityRefusal(classified: {
+/**
+ * What an operation declared it moves. Taken from the schema that defines it
+ * rather than restated, so a field added there cannot go unnoticed here.
+ */
+export type DeclaredSpend = NonNullable<HttpOperation["spend"]>;
+export type CapabilityUsageReader = (grantId: string) => {
+    /** Operations committed against this grant, ever. */
+    operations: number;
+    /** Declared amounts committed against it in the last 24 hours. */
+    amountToday: number;
+};
+/** What the issued grants say about one effect. */
+export interface CapabilityCheck {
+    /** Why they do not cover it, or `undefined` if they do. */
+    refusal?: string;
+    /** The grant it will be metered against, when a grant was needed at all. */
+    grantId?: string;
+}
+type ClassifiedForGrant = {
     effect: Effect;
     capability: string;
     target: string;
-}, identity: Identity, policy: LocalPolicy): string | undefined;
-export declare function evaluatePolicy(taskId: string, request: TaskRequest, policy: LocalPolicy): PolicyEvaluation;
+    spend?: DeclaredSpend;
+};
+/** Milliseconds in the rolling window `provider.dailyMax` is measured over. */
+export declare const CAPABILITY_DAY_MS: number;
+/**
+ * Which issued grant covers this effect, or why none does.
+ *
+ * An empty grant list is not a closed world — it means the operator has not
+ * issued grants at all, and the rest of policy decides on its own.
+ */
+export declare function capabilityCheck(classified: ClassifiedForGrant, identity: Identity, policy: LocalPolicy, usage?: CapabilityUsageReader): CapabilityCheck;
+/**
+ * Why the issued capabilities do not cover this effect, or `undefined` if they
+ * do. `capabilityCheck` also reports which grant covered it.
+ */
+export declare function capabilityRefusal(classified: ClassifiedForGrant, identity: Identity, policy: LocalPolicy, usage?: CapabilityUsageReader): string | undefined;
+export declare function evaluatePolicy(taskId: string, request: TaskRequest, policy: LocalPolicy, usage?: CapabilityUsageReader): PolicyEvaluation;
 export declare function digestOperation(taskId: string, operation: Operation): string;
 export declare function validateApproval(challenge: ApprovalChallenge | undefined, response: ApprovalResponse | undefined): {
     ok: true;
@@ -157,4 +227,5 @@ export declare function validateApproval(challenge: ApprovalChallenge | undefine
     ok: false;
     reason: string;
 };
+export * from "./network-policy.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,SAAS,EACT,cAAc,EACd,IAAI,EACJ,WAAW,EACZ,MAAM,iBAAiB,CAAC;AAOzB,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;;;;OASG;IACH,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,eAAe,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D;;;;;;;;;OASG;IACH,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC;;;;;;;;OAQG;IACH,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC;;;;;;;;;;OAUG;IACH,cAAc,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D;;;;;;;;;OASG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,cAAc,CAAC;IACzB,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAqDD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAI5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AA6HvD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,eAAe,EAAE,CAAA;CAAE,CA6C9C;AAED,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,WAAW,CAsCtE;AAED,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC,CAuBtB;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,SAAS,GAAG;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B,CAiJA;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,SAAS,GACnB,iBAAiB,EAAE,CAiDrB;AAiDD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAClE,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,WAAW,GAClB,MAAM,GAAG,SAAS,CA2BpB;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,WAAW,GAClB,gBAAgB,CA6FlB;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,MAAM,CAI5E;AAYD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,iBAAiB,GAAG,SAAS,EACxC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GACrC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAc9C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,MAAM,EACN,iBAAiB,EACjB,aAAa,EACb,QAAQ,EACR,SAAS,EACT,cAAc,EACd,IAAI,EACJ,WAAW,EACZ,MAAM,iBAAiB,CAAC;AASzB,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;;;;OASG;IACH,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,eAAe,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D;;;;;;;;;OASG;IACH,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC;;;;;;;;OAQG;IACH,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC;;;;;;;;OAQG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAClD;;;;;;;;;;OAUG;IACH,cAAc,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D;;;;;;;;;OASG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;;;OAcG;IACH,IAAI,EAAE,cAAc,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,cAAc,CAAC;IACzB,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAqDD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAI5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EACL,gBAAgB,EAChB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AA6H1B;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,eAAe,EAAE,CAAA;CAAE,CA6C9C;AAED,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,WAAW,CAwCtE;AAED,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC,CAkCtB;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,SAAS,GAAG;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB,CAmKA;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,SAAS,GACnB,iBAAiB,EAAE,CAoDrB;AAwDD;;;;;;GAMG;AACH;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;AAEhE,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK;IACvD,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,KAAK,kBAAkB,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB,CAAC;AAuBF,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,QAAsB,CAAC;AAyCrD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,kBAAkB,EAC9B,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,qBAAqB,GAC5B,eAAe,CA0DjB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,kBAAkB,EAC9B,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,qBAAqB,GAC5B,MAAM,GAAG,SAAS,CAEpB;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,qBAAqB,GAC5B,gBAAgB,CAoGlB;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,MAAM,CAI5E;AAYD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,iBAAiB,GAAG,SAAS,EACxC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GACrC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAc9C;AAED,cAAc,qBAAqB,CAAC"}

package/dist/index.js

@@ -3,7 +3,8 @@
 import { readFile } from "node:fs/promises";
 import { basename, resolve } from "node:path";
 import { createHash, randomUUID } from "node:crypto";
-import { CapabilityGrantSchema, LOCAL_IDENTITY, principalRef, } from "@melra/protocol";
+import { hostOf } from "./network-policy.js";
+import { CapabilityGrantSchema, CredentialsSchema, deploymentMode, LOCAL_IDENTITY, principalRef, } from "@melra/protocol";
 const READ_ONLY_GIT_ACTIONS = new Set([
     "branch",
     "diff",
@@ -29,15 +30,15 @@ const ALWAYS_DENIED_COMMANDS = new Set([
  * Defaults tuned so a fresh install is usable without editing `policy.json`.
  *
  * `allowedDomains: ["*"]` is not the SSRF boundary and never was. `assertSafeUrl`
- * in `@melra/browser-runtime` independently rejects non-http(s) protocols, URL
+ * in `./network-policy.js` independently rejects non-http(s) protocols, URL
  * credentials, private ranges, and cloud metadata (169.254/16), and it resolves
  * DNS before allowing a navigation so a public name cannot be rebound to a
  * private address. The domain list is a *narrowing* control on top of that guard,
  * for operators who want to restrict which public sites are reachable — it is not
- * what stops a browser from reaching the loopback interface.
+ * what stops a browser or an HTTP call from reaching the loopback interface.
  *
  * Defaulting it to `[]` made every single navigation fail with
- * `browser_domain_not_allowed` out of the box, which is why browser use was
+ * `destination_domain_not_allowed` out of the box, which is why browser use was
  * reported as unusable. Operators who want an allowlist set one explicitly.
  */
 /**
@@ -57,6 +58,7 @@ export function normalizeCommandName(command) {
     const suffix = EXECUTABLE_SUFFIXES.find((item) => name.endsWith(item));
     return suffix === undefined ? name : name.slice(0, -suffix.length);
 }
+export { CredentialBroker, } from "./credentials.js";
 /**
  * Subcommands that install, per package manager, and the ones that only read.
  *
@@ -257,8 +259,10 @@ export function createDefaultPolicy(workspaceRoot) {
         memoryRetention: { maxAgeDays: 30, maxPerScope: 0 },
         deniedTraits: [],
         capabilities: [],
+        credentials: {},
         circuitBreaker: { threshold: 3, cooldownMs: 60_000 },
         unhinged: false,
+        mode: "developer",
     };
 }
 export async function loadPolicy(path, workspaceRoot) {
@@ -283,6 +287,16 @@ export async function loadPolicy(path, workspaceRoot) {
         capabilities: parsed.capabilities === undefined
             ? defaults.capabilities
             : CapabilityGrantSchema.array().max(200).parse(parsed.capabilities),
+        // Same reasoning as `capabilities`: a malformed credential definition must
+        // not land as an object whose `hosts` happen to match nothing — an operator
+        // would read that as "scoped" when it is "silently absent".
+        credentials: parsed.credentials === undefined
+            ? defaults.credentials
+            : CredentialsSchema.parse(parsed.credentials),
+        // Through the same parser the environment variable and the flag go through,
+        // so `"mode": "enfroced"` in a policy file fails loudly instead of leaving a
+        // machine in developer mode with a file that claims otherwise.
+        mode: deploymentMode(parsed.mode),
     };
 }
 export function classifyOperation(operation) {
@@ -412,6 +426,24 @@ export function classifyOperation(operation) {
                 traits: [],
             };
         }
+        case "http": {
+            // The method is the classification. A GET that a server treats as a write
+            // is that server misusing HTTP, and MELRA cannot see it — which is why a
+            // read still gets no approval but also no retry-into-a-duplicate: the
+            // guarantee comes from the effect, and the effect comes from here.
+            const read = operation.method === "GET" || operation.method === "HEAD";
+            const target = new URL(operation.url);
+            target.search = "";
+            target.hash = "";
+            return {
+                effect: read ? "read" : "mutate",
+                risk: read ? "low" : "medium",
+                capability: `http.${operation.method.toLowerCase()}`,
+                target: target.toString(),
+                traits: ["network"],
+                ...(operation.spend === undefined ? {} : { spend: operation.spend }),
+            };
+        }
         case "system":
             return {
                 effect: "read",
@@ -473,8 +505,11 @@ export function defaultEvidenceFor(operation) {
                     : [];
         case "browser":
         case "computer":
+        case "http":
             // These adapters report an explicit `success` flag; hold the task to it
-            // rather than letting a silent no-op pass as a completed action.
+            // rather than letting a silent no-op pass as a completed action. For HTTP
+            // that flag is the response status, which is the far end's own word — the
+            // independent re-read that would be stronger is a caller's to declare.
             return [{ type: "result_equals", path: "success", value: true }];
         case "terminal":
             // `run`/`start` say nothing about what the command should leave behind,
@@ -509,12 +544,18 @@ function isCommandAllowed(operation, policy) {
     return policy.allowedCommands.some((allowed) => normalizeCommandName(allowed) === command);
 }
 function domainAllowed(operation, policy) {
-    if (operation.kind !== "browser" || operation.url === undefined)
+    // Every kind that names a destination is checked by the same allowlist. The
+    // browser and the HTTP adapter reach the same hosts; a policy that let one
+    // through and not the other would only describe which package made the call.
+    const raw = operation.kind === "browser" || operation.kind === "http"
+        ? operation.url
+        : undefined;
+    if (raw === undefined)
         return true;
-    const url = new URL(operation.url);
+    const url = new URL(raw);
     if (!["http:", "https:"].includes(url.protocol))
         return false;
-    const host = url.hostname.toLowerCase();
+    const host = hostOf(url);
     if (host === "localhost" || host.endsWith(".localhost"))
         return policy.allowLocalhost;
     return policy.allowedDomains.some((domain) => domain === "*" ||
@@ -535,35 +576,118 @@ function patternMatches(pattern, value) {
     return new RegExp(`^${escaped}$`).test(value);
 }
 /**
- * Why the issued capabilities do not cover this effect, or `undefined` if they
- * do. An empty grant list is not a closed world — it means the operator has not
+ * Whether a provider-shaped grant covers what this operation declared.
+ *
+ * Exact comparison, not patterns: `stripe` and `stripe-test` are different
+ * providers, and a grant meaning one must not quietly cover the other. A grant
+ * with money bounds and an operation that declared nothing do not match — an
+ * undeclared spend is an ungranted one, not a free one.
+ */
+function providerCovers(grant, spend) {
+    if (grant.provider === undefined)
+        return true;
+    if (spend === undefined)
+        return false;
+    return (grant.provider.name === spend.provider &&
+        (grant.provider.account === undefined ||
+            grant.provider.account === spend.account));
+}
+/** Milliseconds in the rolling window `provider.dailyMax` is measured over. */
+export const CAPABILITY_DAY_MS = 24 * 60 * 60 * 1000;
+/**
+ * Why a matching, unexpired grant still cannot pay for this effect.
+ *
+ * Fails closed when a metered grant is evaluated without a way to read its
+ * count: a budget nobody can count is not a budget, and treating an
+ * uncountable one as full would make the metered grant the loosest kind there
+ * is.
+ */
+function meteringRefusal(grant, spend, usage) {
+    const { amountMax, dailyMax } = grant.provider ?? {};
+    if (grant.maxOperations === undefined &&
+        amountMax === undefined &&
+        dailyMax === undefined) {
+        return undefined;
+    }
+    if (usage === undefined)
+        return `capability_usage_unmeterable:${grant.id}`;
+    const amount = spend?.amount ?? 0;
+    if (amountMax !== undefined && amount > amountMax) {
+        return `capability_amount_exceeded:${grant.id}`;
+    }
+    const drawn = usage(grant.id);
+    if (grant.maxOperations !== undefined &&
+        drawn.operations >= grant.maxOperations) {
+        return `capability_usage_exhausted:${grant.id}`;
+    }
+    if (dailyMax !== undefined && drawn.amountToday + amount > dailyMax) {
+        return `capability_daily_limit_exceeded:${grant.id}`;
+    }
+    return undefined;
+}
+/**
+ * Which issued grant covers this effect, or why none does.
+ *
+ * An empty grant list is not a closed world — it means the operator has not
  * issued grants at all, and the rest of policy decides on its own.
  */
-export function capabilityRefusal(classified, identity, policy) {
+export function capabilityCheck(classified, identity, policy, usage) {
     if (policy.capabilities.length === 0)
-        return undefined;
+        return {};
     const holder = principalRef(identity.principal);
-    const matching = policy.capabilities.filter((grant) => patternMatches(grant.capability, classified.capability) &&
+    const candidates = policy.capabilities.filter((grant) => patternMatches(grant.capability, classified.capability) &&
         grant.effects.includes(classified.effect) &&
         patternMatches(grant.target, classified.target) &&
         patternMatches(grant.principal, holder));
+    const matching = candidates.filter((grant) => providerCovers(grant, classified.spend));
     if (matching.length === 0) {
-        return `capability_not_granted:${classified.capability}`;
+        // A grant did cover the effect and was turned away on the money block
+        // alone. Saying `not_granted` there would send the caller looking for a
+        // grant it already holds, so name the two fixes apart: declare a spend, or
+        // declare the right one.
+        if (candidates.some((grant) => grant.provider !== undefined)) {
+            return {
+                refusal: classified.spend === undefined
+                    ? `capability_spend_not_declared:${classified.capability}`
+                    : `capability_provider_mismatch:${classified.spend.provider}`,
+            };
+        }
+        return { refusal: `capability_not_granted:${classified.capability}` };
     }
     const usable = matching.filter((grant) => (grant.validUntil === undefined ||
         Date.parse(grant.validUntil) > Date.now()) &&
         (grant.policyVersion === undefined ||
             grant.policyVersion === policy.version));
-    if (usable.length > 0)
-        return undefined;
-    // Every candidate matched the effect and was refused for a reason the holder
-    // can act on, so name it rather than reporting a missing grant.
-    const stale = matching.find((grant) => grant.policyVersion !== policy.version);
-    return stale?.policyVersion !== undefined
-        ? `capability_policy_version_mismatch:${stale.id}`
-        : `capability_expired:${matching[0]?.id ?? classified.capability}`;
+    if (usable.length === 0) {
+        // Every candidate matched the effect and was refused for a reason the
+        // holder can act on, so name it rather than reporting a missing grant.
+        const stale = matching.find((grant) => grant.policyVersion !== policy.version);
+        return {
+            refusal: stale?.policyVersion !== undefined
+                ? `capability_policy_version_mismatch:${stale.id}`
+                : `capability_expired:${matching[0]?.id ?? classified.capability}`,
+        };
+    }
+    // A grant list is a set of authorities, not a single budget: one that is
+    // spent out does not refuse work another still covers. Only when every
+    // usable grant is exhausted does the first one's reason become the answer.
+    let exhausted;
+    for (const grant of usable) {
+        const refusal = meteringRefusal(grant, classified.spend, usage);
+        if (refusal === undefined)
+            return { grantId: grant.id };
+        exhausted ??= refusal;
+    }
+    return exhausted === undefined ? {} : { refusal: exhausted };
+}
+/**
+ * Why the issued capabilities do not cover this effect, or `undefined` if they
+ * do. `capabilityCheck` also reports which grant covered it.
+ */
+export function capabilityRefusal(classified, identity, policy, usage) {
+    return capabilityCheck(classified, identity, policy, usage).refusal;
 }
-export function evaluatePolicy(taskId, request, policy) {
+export function evaluatePolicy(taskId, request, policy, usage) {
     const classified = classifyOperation(request.operation);
     // Every decision reports the same classification it was made from, including
     // the traits, so an approver reading a `confirm` sees that the command
@@ -596,10 +720,13 @@ export function evaluatePolicy(taskId, request, policy) {
     // Authority before rules: a caller that was never granted this effect is
     // refused without consulting the allowlists, which describe what the grant
     // holder may do, not whether they hold one.
-    const ungranted = capabilityRefusal(classified, request.identity ?? LOCAL_IDENTITY, policy);
-    if (ungranted !== undefined) {
-        return { decision: decide("deny", ungranted, "critical") };
+    const granted = capabilityCheck(classified, request.identity ?? LOCAL_IDENTITY, policy, usage);
+    if (granted.refusal !== undefined) {
+        return { decision: decide("deny", granted.refusal, "critical") };
     }
+    // Carried on every non-deny outcome so the commit knows what to meter. A deny
+    // never reaches an adapter, so it never draws anything down.
+    const metered = granted.grantId === undefined ? {} : { grantId: granted.grantId };
     const deniedTrait = classified.traits.find((trait) => policy.deniedTraits.includes(trait));
     if (deniedTrait !== undefined) {
         return { decision: decide("deny", `trait_denied:${deniedTrait}`) };
@@ -611,14 +738,14 @@ export function evaluatePolicy(taskId, request, policy) {
     }
     if (!domainAllowed(request.operation, policy)) {
         return {
-            decision: decide("deny", "browser_domain_not_allowed", "high"),
+            decision: decide("deny", "destination_domain_not_allowed", "high"),
         };
     }
     if (classified.effect !== "read" && request.requiredEvidence.length === 0) {
         return { decision: decide("deny", "mutation_requires_evidence") };
     }
     if (classified.effect === "read") {
-        return { decision: decide("allow", "read_only_operation") };
+        return { decision: decide("allow", "read_only_operation"), ...metered };
     }
     if (policy.mutations === "deny") {
         return { decision: decide("deny", "mutations_disabled") };
@@ -628,6 +755,7 @@ export function evaluatePolicy(taskId, request, policy) {
     const phrase = `APPROVE ${digest.slice(0, 12)}`;
     return {
         decision: decide("confirm", "explicit_approval_required"),
+        ...metered,
         challenge: {
             approvalId,
             taskId,
@@ -668,4 +796,5 @@ export function validateApproval(challenge, response) {
     }
     return { ok: true };
 }
+export * from "./network-policy.js";
 //# sourceMappingURL=index.js.map