@olurabian/audit 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Oluwasegun Araba
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,63 @@
+# @olurabian/audit
+
+Can a compromised agent move money outside policy?
+
+The Agent Payment Security Audit as a runnable. Nine questions about your agent's payment setup, scored on eight dimensions, with the blast radius in your own numbers. Anything you leave out comes back as Unknown with the exact question to ask, never a guess. No model in the loop, nothing leaves your machine.
+
+## Run it
+
+```bash
+npx @olurabian/audit
+```
+
+It asks the questions in your terminal and prints the readout.
+
+- `--intake <file>` scores a saved intake instead of asking
+- `--out <dir>` also writes `audit.md` and `audit.html`, and still runs alongside `--json`
+- `--json` prints the readout as JSON
+- `--example` prints an example intake to edit
+- `--help` prints this list
+
+To keep a copy, add `--out ./audit` and you get `audit.md` and `audit.html`. To answer once and rerun, start from `npx @olurabian/audit --example > intake.json`, edit it, then `npx @olurabian/audit --intake intake.json`.
+
+A browser version with the same engine lives at https://deadlatch.dev/audit. Nothing you type there leaves the page either.
+
+## What it scores
+
+Eight dimensions, each Closed, Partial, Exposed, or Unknown.
+
+1. Single path. Every money path funnels through one enforcement point.
+2. Custody. The credential lives where the agent cannot read it.
+3. Mediated execution. The agent submits an intent and something else pays.
+4. Intent-binding. Each approved spend is bound to an exact payee and amount.
+5. No splitting. Budget is reserved when a spend is approved, not when it settles.
+6. Human approval. Large spends wait for a person the agent cannot impersonate.
+7. Provable audit. Every decision and the settled amount sit in a tamper-evident record.
+8. Continuous verification. The money path is re-checked whenever the tool set changes.
+
+Two framings come out of the score. Forgery is open when custody, single path, or mediated execution is exposed, meaning the agent can make a payment it was never handed the means to make. Misdirection is open when intent-binding is exposed or the agent approves its own spends, meaning it can hand you a perfectly in-policy request that is not what you meant.
+
+## The readout
+
+Six sections, in this order and nothing else. Posture in one line. The money-path map, one path per line, mediated or not. Exposure, the eight verdicts with a one-line finding and the question to ask for each Unknown. Top breaches, at most three, each with the loss in money and the fix in one line. Which is open, forgery or misdirection or both. The shortest path, as many steps as it takes to close every open dimension, at most six, each named plainly as a governance layer, hands-on work, or a practice you keep, and none when nothing is open.
+
+The last line is a plain next step. This is a diagnostic, not a sales tool.
+
+## Use the engine
+
+```js
+import { score, render, exampleIntake } from "@olurabian/audit";
+
+const readout = score(exampleIntake());
+console.log(render(readout, "markdown"));
+```
+
+The intake schema is exported as `questions`, so any form can render it. `score` is pure and deterministic. `render` gives you text, Markdown, or a self-contained HTML report.
+
+## The prompt
+
+If you would rather use a model, the original prompt is in `prompts/agent-payment-security-audit.md`. It scores the same dimensions and follows the same rules.
+
+## License
+
+MIT

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,157 @@
+#!/usr/bin/env node
+import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { stdin, stdout } from "node:process";
+import { questions } from "./questions.js";
+import { score } from "./score.js";
+import { render } from "./render.js";
+import { exampleIntake } from "./example.js";
+const args = process.argv.slice(2);
+const flag = (name) => { const i = args.indexOf(name); return i >= 0 ? args[i + 1] : undefined; };
+const has = (name) => args.includes(name);
+if (has("--help") || has("-h")) {
+    stdout.write(`audit. Can a compromised agent move money outside policy?
+
+  npx @olurabian/audit                 ask the nine questions in the terminal
+  npx @olurabian/audit --intake a.json score a saved intake
+  --out <dir>                          also write audit.md and audit.html
+  --json                               print the readout as JSON
+  --example                            print an example intake to edit
+  --help                               print this list
+`);
+    process.exit(0);
+}
+if (has("--example")) {
+    stdout.write(JSON.stringify(exampleIntake(), null, 2) + "\n");
+    process.exit(0);
+}
+function parseMoney(s) {
+    const m = s.trim().match(/^([£$€])?\s*([0-9]+(?:\.[0-9]+)?)\s*([A-Za-z]{3})?$/);
+    if (!m)
+        return undefined;
+    const sym = { "£": "GBP", "$": "USD", "€": "EUR" };
+    const currency = (m[3] ?? (m[1] ? sym[m[1]] : undefined) ?? "USD").toUpperCase();
+    return { amount: Number(m[2]), currency };
+}
+const BLANK = Symbol("blank");
+const INVALID = Symbol("invalid");
+async function ask() {
+    const rl = createInterface({ input: stdin, output: stdout });
+    const intake = {};
+    stdout.write("\nAgent Payment Security Audit. Nine questions. Leave a line blank to mark it unknown.\n");
+    try {
+        for (const q of questions) {
+            stdout.write(`\n${q.title}\n${q.prompt}\n`);
+            const answers = {};
+            let answered = false;
+            for (const f of q.fields) {
+                const v = await askField(rl, f);
+                if (v === INVALID) {
+                    stdout.write("  Not a valid answer, marked unknown.\n");
+                    if (f.kind === "choice" || f.kind === "boolean" || f.kind === "number")
+                        answers[f.key] = "unknown";
+                    // money: left absent, as today. list and text never produce INVALID.
+                }
+                else if (v === BLANK) {
+                    if (f.kind === "choice" || f.kind === "boolean" || f.kind === "number" || f.kind === "list")
+                        answers[f.key] = "unknown";
+                    // money and text: left absent.
+                }
+                else {
+                    answers[f.key] = v;
+                    answered = true;
+                }
+            }
+            const notes = (await rl.question("  Notes, optional. ")).trim();
+            if (notes) {
+                answers.notes = notes;
+                answered = true;
+            }
+            if (answered)
+                intake[q.id] = answers;
+        }
+    }
+    finally {
+        rl.close();
+    }
+    return intake;
+}
+async function askField(rl, f) {
+    if (f.kind === "choice") {
+        const cs = f.choices ?? [];
+        stdout.write(`  ${f.label}\n${cs.map((c, i) => `    ${i + 1}. ${c.label}`).join("\n")}\n`);
+        const a = (await rl.question("  Number. ")).trim();
+        if (!a)
+            return BLANK;
+        const n = Number(a);
+        if (!Number.isInteger(n) || n < 1 || n > cs.length)
+            return INVALID;
+        const v = cs[n - 1].value;
+        return v === "unknown" ? BLANK : v;
+    }
+    const a = (await rl.question(`  ${f.label}${f.optional ? ", optional" : ""}. `)).trim();
+    if (!a)
+        return BLANK;
+    if (f.kind === "money") {
+        const m = parseMoney(a);
+        return m ?? INVALID;
+    }
+    if (f.kind === "list")
+        return a.split(",").map((s) => s.trim()).filter(Boolean);
+    if (f.kind === "boolean") {
+        if (/^(y|yes|true)$/i.test(a))
+            return true;
+        if (/^(n|no|false)$/i.test(a))
+            return false;
+        return INVALID;
+    }
+    if (f.kind === "number") {
+        const n = Number(a);
+        return Number.isFinite(n) ? n : INVALID;
+    }
+    return a;
+}
+async function main() {
+    let intake;
+    if (has("--intake")) {
+        const file = flag("--intake");
+        if (!file) {
+            process.stderr.write("audit: --intake needs a file path\n");
+            process.exit(1);
+        }
+        try {
+            const parsed = JSON.parse(readFileSync(file, "utf8"));
+            if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+                throw new Error("expected a JSON object with the intake fields");
+            intake = parsed;
+        }
+        catch (e) {
+            process.stderr.write(`audit: cannot read intake ${file} (${e.message})\n`);
+            process.exit(1);
+        }
+    }
+    else {
+        if (!stdin.isTTY) {
+            process.stderr.write("audit: no --intake given and no terminal to ask in; try --example\n");
+            process.exit(1);
+        }
+        intake = await ask();
+    }
+    const readout = score(intake);
+    const out = flag("--out");
+    if (out) {
+        mkdirSync(out, { recursive: true });
+        writeFileSync(join(out, "audit.md"), render(readout, "markdown"));
+        writeFileSync(join(out, "audit.html"), render(readout, "html"));
+    }
+    if (has("--json")) {
+        stdout.write(JSON.stringify(readout, null, 2) + "\n");
+        return;
+    }
+    stdout.write("\n" + render(readout, "text"));
+    if (out) {
+        stdout.write(`\nWritten. ${join(out, "audit.md")} and ${join(out, "audit.html")}\n`);
+    }
+}
+main().catch((e) => { process.stderr.write(`audit: ${e.message}\n`); process.exit(1); });

package/dist/example.d.ts

@@ -0,0 +1,3 @@
+import type { Intake } from "./types.js";
+/** A filled intake to start from. An honest, common shape, an agent with a rail key and settlement-time caps. */
+export declare function exampleIntake(): Intake;

package/dist/example.js

@@ -0,0 +1,14 @@
+/** A filled intake to start from. An honest, common shape, an agent with a rail key and settlement-time caps. */
+export function exampleIntake() {
+    return {
+        spend: { what: ["API credits", "data"], frequency: "daily", typical: { amount: 12.5, currency: "USD" }, notes: "Mostly LLM and search APIs." },
+        reach: { tools: ["http", "stripe-sdk", "filesystem"], mcpServers: ["search"], keysInRuntime: ["STRIPE_SECRET_KEY"], paymentPaths: 1 },
+        custody: { where: "agent-runtime" },
+        execution: { who: "agent-calls-rail" },
+        binding: { mode: "any-in-policy" },
+        limits: { perAction: { amount: 50, currency: "USD" }, perDay: { amount: 500, currency: "USD" }, enforcedAt: "at-settlement", reservedAtGrant: false },
+        approval: { mode: "in-band", threshold: { amount: 100, currency: "USD" } },
+        record: { exists: true, tamperEvident: false, settledAmountRecorded: false },
+        drift: { changeFrequency: "weekly", recheck: "never" },
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { DIMENSIONS, DIMENSION_LABEL } from "./types.js";
+export type { Money, Verdict, Dimension, Intake, Field, FieldKind, Question, Readout, Openness, StepKind } from "./types.js";
+export { questions } from "./questions.js";
+export { score } from "./score.js";
+export { render } from "./render.js";
+export type { Format } from "./render.js";
+export { exampleIntake } from "./example.js";
+export { formatMoney } from "./money.js";

package/dist/index.js

@@ -0,0 +1,6 @@
+export { DIMENSIONS, DIMENSION_LABEL } from "./types.js";
+export { questions } from "./questions.js";
+export { score } from "./score.js";
+export { render } from "./render.js";
+export { exampleIntake } from "./example.js";
+export { formatMoney } from "./money.js";

package/dist/money.d.ts

@@ -0,0 +1,7 @@
+import type { Money } from "./types.js";
+export declare function formatMoney(m: Money): string;
+/** The binding cap for blast radius: per day first, then per spend, then none. */
+export declare function capOf(limits: {
+    perAction?: Money;
+    perDay?: Money;
+} | undefined): Money | undefined;

package/dist/money.js

@@ -0,0 +1,13 @@
+const SYMBOL = { USD: "$", GBP: "£", EUR: "€" };
+export function formatMoney(m) {
+    const n = m.amount.toLocaleString("en-US", { minimumFractionDigits: 2, maximumFractionDigits: 2 });
+    if (!m.currency)
+        return n;
+    const cur = m.currency.toUpperCase();
+    const s = SYMBOL[cur];
+    return s ? `${s}${n}` : `${n} ${cur}`;
+}
+/** The binding cap for blast radius: per day first, then per spend, then none. */
+export function capOf(limits) {
+    return limits?.perDay ?? limits?.perAction;
+}

package/dist/questions.d.ts

@@ -0,0 +1,2 @@
+import type { Question } from "./types.js";
+export declare const questions: Question[];

package/dist/questions.js

@@ -0,0 +1,97 @@
+const unknown = { value: "unknown", label: "Unknown" };
+export const questions = [
+    {
+        id: "spend",
+        title: "What the agent buys",
+        prompt: "What does the agent buy, and how often? API credits, compute, data, vendors, on-chain.",
+        fields: [
+            { key: "what", label: "What it buys", kind: "list" },
+            { key: "frequency", label: "How often", kind: "choice", choices: [
+                    { value: "rare", label: "Rarely, a few times a month" }, { value: "daily", label: "Daily" }, { value: "continuous", label: "Continuously, many times an hour" }, unknown
+                ] },
+            { key: "typical", label: "Typical spend", kind: "money", optional: true },
+        ],
+    },
+    {
+        id: "reach",
+        title: "What the runtime can reach",
+        prompt: "What can the agent's runtime reach? List every tool, MCP server, SDK, and key in the agent's process.",
+        fields: [
+            { key: "tools", label: "Tools and SDKs", kind: "list" },
+            { key: "mcpServers", label: "MCP servers", kind: "list" },
+            { key: "keysInRuntime", label: "Payment credentials present in the agent's process, prompt, memory, or tools", kind: "list" },
+            { key: "paymentPaths", label: "How many distinct ways the runtime can move money", kind: "number", optional: true },
+        ],
+    },
+    {
+        id: "custody",
+        title: "Where the credential lives",
+        prompt: "Where does the payment credential live? In the agent's process or prompt or memory, or behind a separate service or signer.",
+        fields: [{ key: "where", label: "Credential location", kind: "choice", choices: [
+                    { value: "agent-runtime", label: "In the agent's process, prompt, memory, or tools" }, { value: "separate-service", label: "Behind a separate service or signer the agent cannot read" }, unknown
+                ] }],
+    },
+    {
+        id: "execution",
+        title: "Who executes the payment",
+        prompt: "Who executes the payment? The agent calls the rail itself, or it submits an intent to something that executes.",
+        fields: [{ key: "who", label: "Executor", kind: "choice", choices: [
+                    { value: "agent-calls-rail", label: "The agent calls the rail itself" }, { value: "intent-to-executor", label: "The agent submits an intent and something else executes behind a boundary" }, unknown
+                ] }],
+    },
+    {
+        id: "binding",
+        title: "What a grant is bound to",
+        prompt: "When a spend is approved, is it bound to a specific payee and amount, or can the agent supply any in-policy value?",
+        fields: [{ key: "mode", label: "Binding", kind: "choice", choices: [
+                    { value: "bound-payee-and-amount", label: "Bound to an exact payee and amount, single use" }, { value: "any-in-policy", label: "The agent chooses the payee and amount within policy" }, unknown
+                ] }],
+    },
+    {
+        id: "limits",
+        title: "Limits and where they bite",
+        prompt: "What limits exist and where are they enforced? Per-action, daily, per-vendor. Checked before the spend or only at settlement.",
+        fields: [
+            { key: "perAction", label: "Cap per spend", kind: "money", optional: true },
+            { key: "perDay", label: "Cap per day", kind: "money", optional: true },
+            { key: "enforcedAt", label: "Where caps are checked", kind: "choice", choices: [
+                    { value: "before-spend", label: "Before the spend" }, { value: "at-settlement", label: "Only when the spend settles" }, { value: "none", label: "No caps" }, unknown
+                ] },
+            { key: "reservedAtGrant", label: "Budget is reserved the moment a spend is approved, not when it settles", kind: "boolean" },
+        ],
+    },
+    {
+        id: "approval",
+        title: "Human approval",
+        prompt: "Is there human approval for large spends? None, in-band where the agent decides, or out of band where a person approves the exact spend.",
+        fields: [
+            { key: "mode", label: "Approval", kind: "choice", choices: [
+                    { value: "none", label: "None" }, { value: "in-band", label: "In-band, the agent decides" }, { value: "out-of-band", label: "Out of band, a person approves the exact spend" }, unknown
+                ] },
+            { key: "threshold", label: "Approval threshold", kind: "money", optional: true },
+        ],
+    },
+    {
+        id: "record",
+        title: "The record",
+        prompt: "Is there a record of every decision and the amount actually settled, and can it be tampered with?",
+        fields: [
+            { key: "exists", label: "A record of every decision exists", kind: "boolean" },
+            { key: "tamperEvident", label: "The record is tamper-evident, hash-chained or signed", kind: "boolean" },
+            { key: "settledAmountRecorded", label: "The amount actually settled is in the record", kind: "boolean" },
+        ],
+    },
+    {
+        id: "drift",
+        title: "Drift",
+        prompt: "How often does the agent's tool or dependency set change, and is the money-path re-checked when it does?",
+        fields: [
+            { key: "changeFrequency", label: "How often tools or dependencies change", kind: "choice", choices: [
+                    { value: "rare", label: "Rarely" }, { value: "weekly", label: "Weekly" }, { value: "daily", label: "Daily or more" }, unknown
+                ] },
+            { key: "recheck", label: "When the money path is re-checked", kind: "choice", choices: [
+                    { value: "on-change", label: "Every time the tool or dependency set changes" }, { value: "at-deploy", label: "Once, at deploy" }, { value: "never", label: "Never" }, unknown
+                ] },
+        ],
+    },
+];

package/dist/render.d.ts

@@ -0,0 +1,3 @@
+import type { Readout } from "./types.js";
+export type Format = "text" | "markdown" | "html";
+export declare function render(r: Readout, format: Format): string;

package/dist/render.js

@@ -0,0 +1,68 @@
+import { DIMENSION_LABEL } from "./types.js";
+const TITLES = ["Posture", "Money-path map", "Exposure", "Top breaches", "Which is open", "Shortest path"];
+function lines(r) {
+    return [
+        { title: TITLES[0], body: [r.posture] },
+        { title: TITLES[1], body: r.moneyPaths.map((p) => p.path) },
+        { title: TITLES[2], body: r.exposure.map((e) => `${DIMENSION_LABEL[e.dimension]}. ${e.verdict}. ${e.finding}${e.question ? ` Ask. ${e.question}` : ""}`) },
+        { title: TITLES[3], body: r.topBreaches.length ? r.topBreaches.map((b, i) => `${i + 1}. ${DIMENSION_LABEL[b.dimension]}. ${b.blastRadius} Fix. ${b.fix}`) : ["None from what was described."] },
+        { title: TITLES[4], body: [`Forgery ${r.open.forgery}, misdirection ${r.open.misdirection}. ${r.open.why}`] },
+        { title: TITLES[5], body: [...r.shortestPath.map((s, i) => `${i + 1}. ${s.step} (${kindLabel(s.kind)})`), r.lastLine] },
+    ];
+}
+function kindLabel(k) {
+    return { "governance-layer": "a payment-governance layer", "hosted-control-plane": "a hosted control plane", "hands-on": "hands-on implementation", practice: "a practice you keep" }[k];
+}
+function collapseWs(s) {
+    return s.replace(/\s+/g, " ").trim();
+}
+function notesBlock(r) {
+    return r.notes.map((n) => `${n.dimension === "spend" ? "Spend" : DIMENSION_LABEL[n.dimension]}. ${collapseWs(n.text)}`);
+}
+export function render(r, format) {
+    if (format !== "text" && format !== "markdown" && format !== "html")
+        throw new Error("unknown format");
+    const secs = lines(r);
+    if (format === "text") {
+        const out = secs.map((s, i) => `${i + 1}. ${s.title}\n${s.body.map((b) => `   ${b}`).join("\n")}`);
+        if (r.notes.length)
+            out.push(`Notes you gave, echoed and never scored\n${notesBlock(r).map((b) => `   ${b}`).join("\n")}`);
+        return out.join("\n\n") + "\n";
+    }
+    if (format === "markdown") {
+        const out = ["# Agent Payment Security Audit", "", "Can a compromised agent move money outside policy?", ""];
+        secs.forEach((s, i) => { out.push(`## ${i + 1}. ${s.title}`, "", ...s.body.map((b) => (s.title === TITLES[2] || s.title === TITLES[1] ? `- ${b}` : b)), ""); });
+        if (r.notes.length)
+            out.push("## Notes you gave, echoed and never scored", "", ...notesBlock(r).map((b) => `- ${b}`), "");
+        return out.join("\n");
+    }
+    const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+    const link = (s) => esc(s).replace(/(https?:\/\/[^\s"'<>&]+)/g, (m) => {
+        const mm = m.match(/^(.*?)([.,;)\]]+)$/);
+        const url = mm ? mm[1] : m;
+        const trail = mm ? mm[2] : "";
+        return `<a href="${url}">${url}</a>${trail}`;
+    });
+    const verdictClass = (b) => (/\. Exposed\./.test(b) ? "exposed" : /\. Partial\./.test(b) ? "partial" : /\. Unknown\./.test(b) ? "unknown" : "closed");
+    const body = secs.map((s, i) => `<section><h2><span class="n">${i + 1}</span>${esc(s.title)}</h2>${s.title === TITLES[2] ? `<ul>${s.body.map((b) => `<li class="${verdictClass(b)}">${link(b)}</li>`).join("")}</ul>` : s.body.map((b) => `<p>${link(b)}</p>`).join("")}</section>`).join("");
+    const notes = r.notes.length ? `<section class="notes"><h2>Notes you gave, echoed and never scored</h2><ul>${notesBlock(r).map((b) => `<li>${esc(b)}</li>`).join("")}</ul></section>` : "";
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Agent Payment Security Audit</title>
+<style>
+:root{--bg:#f7f6f2;--ink:#161a1f;--muted:#5b6470;--line:#d9d6cc;--closed:#1f7a4d;--partial:#a3660d;--exposed:#b3261e;--unknown:#4a5563}
+@media (prefers-color-scheme: dark){:root{--bg:#0b0e14;--ink:#e6ebf2;--muted:#9aa4b2;--line:#252a33;--closed:#5fd39a;--partial:#f0c060;--exposed:#ff7a6e;--unknown:#9aa4b2}}
+body{margin:0;background:var(--bg);color:var(--ink);font:16px/1.55 system-ui,-apple-system,"Segoe UI",Roboto,sans-serif}
+main{max-width:760px;margin:0 auto;padding:40px 20px 64px}
+h1{font-size:1.6rem;margin:0 0 4px}.q{color:var(--muted);margin:0 0 28px}
+section{border-top:1px solid var(--line);padding:18px 0}
+h2{font-size:1.05rem;margin:0 0 8px}.n{display:inline-block;width:1.6em;color:var(--muted);font-variant-numeric:tabular-nums}
+p,li{margin:6px 0}ul{padding-left:1.2em}
+li.closed::marker{color:var(--closed)}li.partial::marker{color:var(--partial)}li.exposed::marker{color:var(--exposed)}li.unknown::marker{color:var(--unknown)}
+a{color:inherit}.foot{color:var(--muted);font-size:.85rem;margin-top:28px}
+</style></head><body><main>
+<h1>Agent Payment Security Audit</h1><p class="q">Can a compromised agent move money outside policy?</p>
+${body}${notes}
+<p class="foot">Produced by @olurabian/audit. Deterministic, no model, nothing left your machine.</p>
+</main></body></html>
+`;
+}

package/dist/score.d.ts

@@ -0,0 +1,20 @@
+import type { Dimension, Intake, Readout, StepKind } from "./types.js";
+export declare function blastRadius(d: Dimension, i: Intake): string;
+export type Step = {
+    closes: Dimension[];
+    effort: number;
+    kind: StepKind;
+    step: string;
+};
+export declare const STEPS: Step[];
+/**
+ * Greedy set cover over STEPS for the given open dimensions.
+ * Each iteration recomputes, for every candidate not yet chosen, the ratio of
+ * still-open dimensions it would close to its effort; picks the highest ratio,
+ * ties toward the candidate that closes more still-open dimensions, then table
+ * order for determinism. A candidate is kept only if it closes at least one
+ * dimension still open. Stops when nothing is open. Since STEPS has six
+ * entries, the result has at most six steps.
+ */
+export declare function coverSteps(open: Dimension[]): Step[];
+export declare function score(rawIntake: Intake): Readout;

package/dist/score.js

@@ -0,0 +1,460 @@
+import { DIMENSIONS, DIMENSION_LABEL } from "./types.js";
+import { formatMoney, capOf } from "./money.js";
+import { questions } from "./questions.js";
+function promptFor(id) {
+    const q = questions.find((q) => q.id === id);
+    if (!q)
+        throw new Error(`no question for ${id}`);
+    return q.prompt;
+}
+const DIMENSION_QUESTION_ID = {
+    "single-path": "execution",
+    "custody": "custody",
+    "mediated-execution": "execution",
+    "intent-binding": "binding",
+    "no-splitting": "limits",
+    "human-approval": "approval",
+    "provable-audit": "record",
+    "continuous-verification": "drift",
+};
+// ---------- normalisation ----------
+function isPlainObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** Collapse runs of whitespace, including newlines, to one space. */
+function collapseWhitespace(s) {
+    return s.replace(/\s+/g, " ").trim();
+}
+function normList(v) {
+    if (Array.isArray(v))
+        return v.filter((x) => typeof x === "string").map(collapseWhitespace);
+    if (v === "unknown")
+        return "unknown";
+    if (typeof v === "string" && v.length > 0)
+        return [collapseWhitespace(v)];
+    return "unknown";
+}
+function normMoney(v) {
+    if (!isPlainObject(v))
+        return undefined;
+    let amount = v.amount;
+    if (typeof amount === "string" && amount.trim() !== "") {
+        const n = Number(amount);
+        if (Number.isFinite(n))
+            amount = n;
+    }
+    if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0)
+        return undefined;
+    const currency = typeof v.currency === "string" && v.currency.length > 0 ? v.currency : undefined;
+    return currency !== undefined ? { amount, currency } : { amount };
+}
+function normPaymentPaths(v) {
+    let n = v;
+    if (typeof n === "string" && n.trim() !== "") {
+        const parsed = Number(n);
+        if (Number.isFinite(parsed))
+            n = parsed;
+    }
+    if (typeof n === "number" && Number.isInteger(n) && n > 0)
+        return n;
+    return "unknown";
+}
+function normBool(v) {
+    if (v === true || v === false)
+        return v;
+    if (v === "true")
+        return true;
+    if (v === "false")
+        return false;
+    return "unknown";
+}
+function str(v) {
+    return typeof v === "string" ? collapseWhitespace(v) : undefined;
+}
+/** Normalise a hand-edited intake on a deep copy. score() never mutates its input. */
+function normalize(intake) {
+    const src = intake;
+    const out = {};
+    const spend = isPlainObject(src.spend) ? src.spend : undefined;
+    if (spend) {
+        const notes = str(spend.notes);
+        const typical = normMoney(spend.typical);
+        out.spend = {
+            what: normList(spend.what),
+            frequency: spend.frequency,
+            ...(typical ? { typical } : {}),
+            ...(notes ? { notes } : {}),
+        };
+    }
+    const reach = isPlainObject(src.reach) ? src.reach : undefined;
+    if (reach) {
+        const notes = str(reach.notes);
+        out.reach = {
+            tools: normList(reach.tools),
+            mcpServers: normList(reach.mcpServers),
+            keysInRuntime: normList(reach.keysInRuntime),
+            paymentPaths: normPaymentPaths(reach.paymentPaths),
+            ...(notes ? { notes } : {}),
+        };
+    }
+    const custody = isPlainObject(src.custody) ? src.custody : undefined;
+    if (custody) {
+        const notes = str(custody.notes);
+        out.custody = { where: custody.where, ...(notes ? { notes } : {}) };
+    }
+    const execution = isPlainObject(src.execution) ? src.execution : undefined;
+    if (execution) {
+        const notes = str(execution.notes);
+        out.execution = { who: execution.who, ...(notes ? { notes } : {}) };
+    }
+    const binding = isPlainObject(src.binding) ? src.binding : undefined;
+    if (binding) {
+        const notes = str(binding.notes);
+        out.binding = { mode: binding.mode, ...(notes ? { notes } : {}) };
+    }
+    const limits = isPlainObject(src.limits) ? src.limits : undefined;
+    if (limits) {
+        const notes = str(limits.notes);
+        const perAction = normMoney(limits.perAction);
+        const perDay = normMoney(limits.perDay);
+        out.limits = {
+            ...(perAction ? { perAction } : {}),
+            ...(perDay ? { perDay } : {}),
+            enforcedAt: limits.enforcedAt,
+            reservedAtGrant: normBool(limits.reservedAtGrant),
+            ...(notes ? { notes } : {}),
+        };
+    }
+    const approval = isPlainObject(src.approval) ? src.approval : undefined;
+    if (approval) {
+        const notes = str(approval.notes);
+        const threshold = normMoney(approval.threshold);
+        out.approval = { mode: approval.mode, ...(threshold ? { threshold } : {}), ...(notes ? { notes } : {}) };
+    }
+    const record = isPlainObject(src.record) ? src.record : undefined;
+    if (record) {
+        const notes = str(record.notes);
+        out.record = {
+            exists: normBool(record.exists),
+            tamperEvident: normBool(record.tamperEvident),
+            settledAmountRecorded: normBool(record.settledAmountRecorded),
+            ...(notes ? { notes } : {}),
+        };
+    }
+    const drift = isPlainObject(src.drift) ? src.drift : undefined;
+    if (drift) {
+        const notes = str(drift.notes);
+        out.drift = { changeFrequency: drift.changeFrequency, recheck: drift.recheck, ...(notes ? { notes } : {}) };
+    }
+    return out;
+}
+function rule(d, i) {
+    const cap = capOf(i.limits);
+    switch (d) {
+        case "single-path": {
+            const who = i.execution?.who ?? "unknown";
+            const rawKeys = i.reach?.keysInRuntime;
+            const keys = Array.isArray(rawKeys) ? rawKeys : undefined;
+            if (who === "agent-calls-rail" || i.custody?.where === "agent-runtime" || (keys && keys.length > 0)) {
+                let finding;
+                if (keys && keys.length > 0) {
+                    const n = keys.length;
+                    finding = `The runtime holds ${n} payment credential${n === 1 ? "" : "s"}, so the agent can reach the rail on its own.`;
+                }
+                else if (i.custody?.where === "agent-runtime") {
+                    finding = "The credential lives in the agent's runtime, so the agent can reach the rail on its own whatever the executor does.";
+                }
+                else {
+                    finding = "The agent calls the rail itself, so nothing stands between a poisoned instruction and the money.";
+                }
+                return { verdict: "Exposed", finding };
+            }
+            if (rawKeys === "unknown" && who === "intent-to-executor") {
+                return {
+                    verdict: "Partial",
+                    finding: "Execution is mediated, but whether the runtime holds a payment credential is not described.",
+                    question: promptFor("reach"),
+                };
+            }
+            if (who === "intent-to-executor") {
+                const paths = i.reach?.paymentPaths ?? "unknown";
+                if (paths === 1)
+                    return { verdict: "Closed", finding: "Every money path funnels through one enforcement point." };
+                return { verdict: "Partial", finding: paths === "unknown" ? "Execution is mediated, but the number of money paths is not described." : `Execution is mediated, but the runtime has ${paths} money paths.` };
+            }
+            return { verdict: "Unknown", finding: "Execution is not described.", question: promptFor("execution") };
+        }
+        case "custody": {
+            const w = i.custody?.where ?? "unknown";
+            if (w === "separate-service")
+                return { verdict: "Closed", finding: "The credential lives behind a boundary the agent cannot read." };
+            if (w === "agent-runtime")
+                return { verdict: "Exposed", finding: "The credential sits where a compromised agent can read it." };
+            return { verdict: "Unknown", finding: "Credential location is not described." };
+        }
+        case "mediated-execution": {
+            const who = i.execution?.who ?? "unknown";
+            if (who === "intent-to-executor")
+                return { verdict: "Closed", finding: "The agent submits an intent and something else executes." };
+            if (who === "agent-calls-rail")
+                return { verdict: "Exposed", finding: "The agent calls the rail itself, so policy is advice." };
+            return { verdict: "Unknown", finding: "Execution is not described." };
+        }
+        case "intent-binding": {
+            const m = i.binding?.mode ?? "unknown";
+            if (m === "bound-payee-and-amount")
+                return { verdict: "Closed", finding: "Each approved spend is bound to an exact payee and amount." };
+            if (m === "any-in-policy")
+                return { verdict: "Exposed", finding: "The agent chooses the who and the how-much within policy." };
+            return { verdict: "Unknown", finding: "Binding is not described." };
+        }
+        case "no-splitting": {
+            const l = i.limits;
+            if (!l)
+                return { verdict: "Unknown", finding: "Limits are not described." };
+            if (l.enforcedAt === "none")
+                return { verdict: "Exposed", finding: "There is no cap to split under, and nothing stops a burst." };
+            if (l.enforcedAt === "at-settlement")
+                return { verdict: "Exposed", finding: "Caps bite only at settlement, so many small spends can clear before any of them count." };
+            if (l.reservedAtGrant === false)
+                return { verdict: "Exposed", finding: "Caps bite only at settlement, so many small spends can clear before any of them count." };
+            if (l.reservedAtGrant === true && cap)
+                return { verdict: "Closed", finding: "Budget is reserved when a spend is approved, so small spends cannot slip under the cap." };
+            if (l.enforcedAt === "before-spend" && l.reservedAtGrant === "unknown")
+                return { verdict: "Partial", finding: "Caps are checked before the spend, but reservation at approval is not described." };
+            if (l.enforcedAt === "before-spend" && l.reservedAtGrant === true && !cap)
+                return { verdict: "Partial", finding: "Budget is reserved at approval, but no cap is described." };
+            return { verdict: "Unknown", finding: "Where caps are enforced is not described." };
+        }
+        case "human-approval": {
+            const a = i.approval;
+            const m = a?.mode ?? "unknown";
+            if (m === "out-of-band" && a?.threshold)
+                return { verdict: "Closed", finding: `Spends above ${formatMoney(a.threshold)} wait for a person the agent cannot impersonate.` };
+            if (m === "out-of-band")
+                return { verdict: "Partial", finding: "Approval is out of band, but the threshold is not described." };
+            if (m === "in-band")
+                return { verdict: "Exposed", finding: "The agent approves its own request." };
+            if (m === "none")
+                return { verdict: "Exposed", finding: "Large spends auto-execute." };
+            return { verdict: "Unknown", finding: "Approval is not described." };
+        }
+        case "provable-audit": {
+            const r = i.record;
+            if (!r || r.exists === "unknown")
+                return { verdict: "Unknown", finding: "The record is not described." };
+            if (r.exists === false)
+                return { verdict: "Exposed", finding: "There is no record of decisions." };
+            if (r.tamperEvident === false || r.settledAmountRecorded === false)
+                return { verdict: "Exposed", finding: r.tamperEvident === false ? "The record can be edited after the fact." : "The settled amount is not in the record." };
+            if (r.tamperEvident === true && r.settledAmountRecorded === true)
+                return { verdict: "Closed", finding: "Every decision and the settled amount sit in a tamper-evident record." };
+            return { verdict: "Partial", finding: "A record exists, but its tamper evidence or the settled amount is not described." };
+        }
+        case "continuous-verification": {
+            const c = i.drift?.recheck ?? "unknown";
+            if (c === "on-change")
+                return { verdict: "Closed", finding: "The money path is re-checked whenever the tool set changes." };
+            if (c === "at-deploy")
+                return { verdict: "Partial", finding: "The money path was verified once at deploy and the tool set can drift." };
+            if (c === "never")
+                return { verdict: "Exposed", finding: "The capability surface can drift with no re-check." };
+            return { verdict: "Unknown", finding: "Re-checking is not described." };
+        }
+    }
+}
+export function blastRadius(d, i) {
+    const cap = capOf(i.limits);
+    const capText = cap ? `up to ${formatMoney(cap)}` : "unbounded, up to the balance behind the credential";
+    const perActionText = i.limits?.perAction ? `${formatMoney(i.limits.perAction)} per spend` : "unbounded per spend";
+    const perDayText = i.limits?.perDay ? `${formatMoney(i.limits.perDay)} per day` : "unbounded per day";
+    switch (d) {
+        case "single-path":
+        case "custody":
+        case "mediated-execution":
+            return `One poisoned tool result pays any address, ${capText}, with nothing between the agent and the rail.`;
+        case "intent-binding":
+            return `A compromised agent hands you a perfectly in-policy request that is not what you meant, ${perActionText} and ${perDayText}.`;
+        case "no-splitting": {
+            if (i.limits?.perDay && i.limits?.perAction)
+                return `Many small spends slip under ${formatMoney(i.limits.perDay)} before any of them settle, so the real cap is ${formatMoney(i.limits.perAction)} times however many spends fit inside the settlement lag.`;
+            if (i.limits?.perDay)
+                return `Many small spends slip under ${formatMoney(i.limits.perDay)} before any of them settle, so the real cap is set by the settlement lag, not the number.`;
+            return "Many small spends slip through before any of them settle, unbounded.";
+        }
+        case "human-approval": {
+            if (i.approval?.mode === "in-band") {
+                return i.approval.threshold
+                    ? `The agent approves its own request, so the threshold of ${formatMoney(i.approval.threshold)} is advice.`
+                    : "The agent approves its own request and no threshold applies, so the amount is unbounded, up to the balance behind the credential.";
+            }
+            if (i.limits?.perDay)
+                return `Spends of any size execute without a person, ${formatMoney(i.limits.perDay)} per day at most.`;
+            if (i.limits?.perAction)
+                return `Spends of any size execute without a person, ${formatMoney(i.limits.perAction)} per spend at most and no daily cap.`;
+            return "Spends of any size execute without a person, unbounded.";
+        }
+        case "provable-audit":
+            return "After an incident you cannot prove what moved. The log can be edited and the settled amount is not in it.";
+        case "continuous-verification":
+            return "A new tool or dependency can reopen a money path with no one noticing until money moves.";
+    }
+}
+const FIX = {
+    "single-path": "Make one broker the only path to the rail and remove every other payment primitive from the runtime.",
+    "custody": "Move the credential behind a service or signer the agent cannot read.",
+    "mediated-execution": "Have the agent submit intents and let the broker execute behind the boundary.",
+    "intent-binding": "Mint single-use grants bound to an exact payee and amount.",
+    "no-splitting": "Reserve budget when a grant is minted, not when it settles.",
+    "human-approval": "Gate spends above a threshold on an out-of-band approval.",
+    "provable-audit": "Write every decision and the settled amount to a hash-chained receipt store.",
+    "continuous-verification": "Re-check the money path on every tool or dependency change and alarm on drift.",
+};
+const SEVERITY = ["single-path", "custody", "mediated-execution", "intent-binding", "human-approval", "no-splitting", "provable-audit", "continuous-verification"];
+export const STEPS = [
+    { closes: ["custody", "mediated-execution", "single-path"], effort: 3, kind: "governance-layer", step: "A payment-governance layer sits between the agent and the rail. The credential moves behind it, the agent submits intents, and the layer is the only path that can pay. Purse enforcement mode is one such layer." },
+    { closes: ["intent-binding", "no-splitting"], effort: 2, kind: "governance-layer", step: "The layer binds every grant to a payee and an amount, enforces caps before the spend, and reserves budget the moment a grant is minted, so an in-policy request cannot be misdirected and parallel small spends cannot outrun the day's limit." },
+    { closes: ["human-approval"], effort: 1, kind: "governance-layer", step: "Spends above a threshold wait for a person's approval given out of band, on a channel the agent cannot reach." },
+    { closes: ["provable-audit"], effort: 1, kind: "governance-layer", step: "Every decision and the settled amount sit in a hash-chained receipt store that anyone can verify with plain SHA-256." },
+    { closes: ["continuous-verification"], effort: 2, kind: "practice", step: "The money path is re-checked whenever the agent gains a tool, MCP server, or dependency, with an alarm on drift. A watcher can do the checking, the practice stays with you." },
+    { closes: ["single-path"], effort: 1, kind: "hands-on", step: "The agent has exactly one payment path, with no key, SDK, or tool in its runtime that reaches a rail on its own." },
+];
+/**
+ * Greedy set cover over STEPS for the given open dimensions.
+ * Each iteration recomputes, for every candidate not yet chosen, the ratio of
+ * still-open dimensions it would close to its effort; picks the highest ratio,
+ * ties toward the candidate that closes more still-open dimensions, then table
+ * order for determinism. A candidate is kept only if it closes at least one
+ * dimension still open. Stops when nothing is open. Since STEPS has six
+ * entries, the result has at most six steps.
+ */
+export function coverSteps(open) {
+    const remaining = new Set(open);
+    const pool = STEPS.filter((s) => s.closes.some((d) => remaining.has(d)));
+    const chosen = [];
+    while (remaining.size > 0) {
+        const ranked = pool
+            .filter((s) => !chosen.includes(s))
+            .map((s) => ({ s, gain: s.closes.filter((d) => remaining.has(d)).length }))
+            .filter((x) => x.gain > 0)
+            .sort((a, b) => b.gain / b.s.effort - a.gain / a.s.effort || b.gain - a.gain);
+        if (ranked.length === 0)
+            break;
+        const best = ranked[0].s;
+        chosen.push(best);
+        for (const d of best.closes)
+            remaining.delete(d);
+    }
+    return chosen;
+}
+function openness(verdicts, dims, exposedIf, partialIf) {
+    const vs = dims.map((d) => verdicts[d]);
+    if (dims.some((d) => exposedIf(d)))
+        return "open";
+    if (vs.includes("Partial") || dims.some((d) => partialIf?.(d)))
+        return "partial";
+    if (vs.every((v) => v === "Closed"))
+        return "closed";
+    return "unknown";
+}
+function cap1(s) {
+    return s.length ? s.charAt(0).toUpperCase() + s.slice(1) : s;
+}
+export function score(rawIntake) {
+    const intake = normalize(rawIntake);
+    const ruled = Object.fromEntries(DIMENSIONS.map((d) => [d, rule(d, intake)]));
+    const verdicts = Object.fromEntries(DIMENSIONS.map((d) => [d, ruled[d].verdict]));
+    const exposure = DIMENSIONS.map((d) => {
+        const verdict = verdicts[d];
+        const question = ruled[d].question ?? (verdict === "Unknown" ? promptFor(DIMENSION_QUESTION_ID[d]) : undefined);
+        return { dimension: d, verdict, finding: ruled[d].finding, ...(question ? { question } : {}) };
+    });
+    const forgery = openness(verdicts, ["single-path", "custody", "mediated-execution"], (d) => verdicts[d] === "Exposed");
+    const misdirection = openness(verdicts, ["intent-binding", "human-approval"], (d) => (d === "intent-binding" && verdicts[d] === "Exposed") || (d === "human-approval" && verdicts[d] === "Exposed" && intake.approval?.mode === "in-band"), (d) => d === "human-approval" && verdicts[d] === "Exposed" && intake.approval?.mode === "none" && verdicts["intent-binding"] === "Closed");
+    const unknowns = DIMENSIONS.filter((d) => verdicts[d] === "Unknown").length;
+    const closed = (ds) => ds.every((d) => verdicts[d] === "Closed");
+    const noneUnknown5to8 = DIMENSIONS.slice(4).every((d) => verdicts[d] !== "Unknown");
+    const noDimensionClosed = !DIMENSIONS.some((d) => verdicts[d] === "Closed");
+    const noDimensionUnknown = !DIMENSIONS.some((d) => verdicts[d] === "Unknown");
+    let posture;
+    if (closed([...DIMENSIONS]))
+        posture = "enforcement-grade";
+    else if (closed(DIMENSIONS.slice(0, 4)) && noneUnknown5to8)
+        posture = `enforcement-grade except ${DIMENSIONS.slice(4).filter((d) => verdicts[d] !== "Closed").map((d) => DIMENSION_LABEL[d].toLowerCase()).join(", ")}`;
+    else if (intake.execution?.who === "agent-calls-rail" && capOf(intake.limits))
+        posture = `advisory with caps, forgery ${forgery} and misdirection ${misdirection}`;
+    else if (noDimensionClosed && noDimensionUnknown)
+        posture = "no controls";
+    else if (unknowns >= 4)
+        posture = "mostly unknown";
+    else
+        posture = `partial controls, forgery ${forgery} and misdirection ${misdirection}`;
+    const moneyPaths = [];
+    const rawKeys = intake.reach?.keysInRuntime;
+    if (Array.isArray(rawKeys)) {
+        for (const k of rawKeys)
+            moneyPaths.push({ path: `agent to rail via ${k}, unmediated`, mediated: false });
+    }
+    else if (rawKeys === "unknown") {
+        moneyPaths.push({ path: "unknown, runtime credentials not described", mediated: "unknown" });
+    }
+    const who = intake.execution?.who ?? "unknown";
+    if (who === "intent-to-executor")
+        moneyPaths.push({ path: "agent to executor to rail, mediated", mediated: true });
+    else if (who === "agent-calls-rail")
+        moneyPaths.push({ path: "agent to rail, unmediated", mediated: false });
+    else
+        moneyPaths.push({ path: "unknown, execution not described", mediated: "unknown" });
+    const topBreaches = SEVERITY.filter((d) => verdicts[d] === "Exposed").slice(0, 3).map((d) => ({ dimension: d, blastRadius: blastRadius(d, intake), fix: FIX[d] }));
+    const open = DIMENSIONS.filter((d) => verdicts[d] === "Exposed" || verdicts[d] === "Partial");
+    const chosen = coverSteps(open);
+    const shortestPath = chosen.map((s) => ({ step: s.step, kind: s.kind }));
+    // Framing why-sentence, built from the dimensions actually open.
+    const keysArr = Array.isArray(rawKeys) ? rawKeys : undefined;
+    const forgeryClauses = [];
+    if (keysArr && keysArr.length > 0)
+        forgeryClauses.push("the runtime holds a payment credential");
+    if (intake.custody?.where === "agent-runtime")
+        forgeryClauses.push("the credential lives in the agent's runtime");
+    if (intake.execution?.who === "agent-calls-rail")
+        forgeryClauses.push("the agent calls the rail itself");
+    const approvalNoneBound = intake.approval?.mode === "none" && verdicts["intent-binding"] === "Closed";
+    const misdirectionClauses = [];
+    if (intake.binding?.mode === "any-in-policy")
+        misdirectionClauses.push("the agent chooses the who and the how-much within policy");
+    if (intake.approval?.mode === "in-band")
+        misdirectionClauses.push("the agent approves its own requests");
+    if (approvalNoneBound)
+        misdirectionClauses.push("large spends execute against bound grants without a person");
+    const forgerySentence = forgeryClauses.length ? `${cap1(forgeryClauses.join(" and "))}, so a poisoned instruction can forge a spend.` : undefined;
+    const misdirectionSentence = misdirectionClauses.length ? `${cap1(misdirectionClauses.join(" and "))}, so the agent can misdirect a spend it is allowed to request.` : undefined;
+    let why;
+    if (forgerySentence && misdirectionSentence)
+        why = `${forgerySentence} ${misdirectionSentence}`;
+    else if (forgerySentence)
+        why = forgerySentence;
+    else if (misdirectionSentence)
+        why = misdirectionSentence;
+    else if (forgery === "unknown" || misdirection === "unknown")
+        why = "Not enough of the setup is described to say which is open.";
+    else if (forgery === "partial" || misdirection === "partial")
+        why = "Neither is fully open, but one side rests on something not yet closed.";
+    else
+        why = "Custody stops forgery and binding stops misdirection.";
+    const lastLine = shortestPath.length > 0
+        ? `Start with the first step. If you want this done for you, https://olurabian.com/work`
+        : `Nothing to close from what was described. If you want it verified hands-on, https://olurabian.com/work`;
+    const notes = [];
+    const noteOf = (dimension, text) => { if (text?.trim())
+        notes.push({ dimension, text: text.trim() }); };
+    noteOf("spend", intake.spend?.notes);
+    noteOf("single-path", intake.reach?.notes);
+    noteOf("custody", intake.custody?.notes);
+    noteOf("mediated-execution", intake.execution?.notes);
+    noteOf("intent-binding", intake.binding?.notes);
+    noteOf("no-splitting", intake.limits?.notes);
+    noteOf("human-approval", intake.approval?.notes);
+    noteOf("provable-audit", intake.record?.notes);
+    noteOf("continuous-verification", intake.drift?.notes);
+    return { posture, moneyPaths, exposure, topBreaches, open: { forgery, misdirection, why }, shortestPath, lastLine, notes };
+}

package/dist/types.d.ts

@@ -0,0 +1,110 @@
+export type Money = {
+    amount: number;
+    currency?: string;
+};
+export type Verdict = "Closed" | "Partial" | "Exposed" | "Unknown";
+export type Dimension = "single-path" | "custody" | "mediated-execution" | "intent-binding" | "no-splitting" | "human-approval" | "provable-audit" | "continuous-verification";
+export declare const DIMENSIONS: readonly Dimension[];
+export declare const DIMENSION_LABEL: Record<Dimension, string>;
+export type Unknownable<T> = T | "unknown";
+export interface Intake {
+    spend?: {
+        what: string[] | "unknown";
+        frequency: "rare" | "daily" | "continuous" | "unknown";
+        typical?: Money;
+        notes?: string;
+    };
+    reach?: {
+        tools: string[] | "unknown";
+        mcpServers: string[] | "unknown";
+        keysInRuntime: string[] | "unknown";
+        paymentPaths: number | "unknown";
+        notes?: string;
+    };
+    custody?: {
+        where: "agent-runtime" | "separate-service" | "unknown";
+        notes?: string;
+    };
+    execution?: {
+        who: "agent-calls-rail" | "intent-to-executor" | "unknown";
+        notes?: string;
+    };
+    binding?: {
+        mode: "bound-payee-and-amount" | "any-in-policy" | "unknown";
+        notes?: string;
+    };
+    limits?: {
+        perAction?: Money;
+        perDay?: Money;
+        enforcedAt: "before-spend" | "at-settlement" | "none" | "unknown";
+        reservedAtGrant: boolean | "unknown";
+        notes?: string;
+    };
+    approval?: {
+        mode: "none" | "in-band" | "out-of-band" | "unknown";
+        threshold?: Money;
+        notes?: string;
+    };
+    record?: {
+        exists: boolean | "unknown";
+        tamperEvident: boolean | "unknown";
+        settledAmountRecorded: boolean | "unknown";
+        notes?: string;
+    };
+    drift?: {
+        changeFrequency: "rare" | "weekly" | "daily" | "unknown";
+        recheck: "on-change" | "at-deploy" | "never" | "unknown";
+        notes?: string;
+    };
+}
+export type FieldKind = "choice" | "money" | "list" | "boolean" | "number" | "text";
+export interface Field {
+    key: string;
+    label: string;
+    kind: FieldKind;
+    choices?: {
+        value: string;
+        label: string;
+    }[];
+    optional?: boolean;
+}
+export interface Question {
+    id: keyof Intake;
+    title: string;
+    prompt: string;
+    fields: Field[];
+}
+export type Openness = "open" | "partial" | "closed" | "unknown";
+export type StepKind = "governance-layer" | "hosted-control-plane" | "hands-on" | "practice";
+export interface Readout {
+    posture: string;
+    moneyPaths: {
+        path: string;
+        mediated: boolean | "unknown";
+    }[];
+    exposure: {
+        dimension: Dimension;
+        verdict: Verdict;
+        finding: string;
+        question?: string;
+    }[];
+    topBreaches: {
+        dimension: Dimension;
+        blastRadius: string;
+        fix: string;
+    }[];
+    open: {
+        forgery: Openness;
+        misdirection: Openness;
+        why: string;
+    };
+    shortestPath: {
+        step: string;
+        kind: StepKind;
+    }[];
+    lastLine: string;
+    notes: {
+        dimension: Dimension | "spend";
+        text: string;
+    }[];
+}

package/dist/types.js

@@ -0,0 +1,14 @@
+export const DIMENSIONS = [
+    "single-path", "custody", "mediated-execution", "intent-binding",
+    "no-splitting", "human-approval", "provable-audit", "continuous-verification",
+];
+export const DIMENSION_LABEL = {
+    "single-path": "Single path",
+    "custody": "Custody",
+    "mediated-execution": "Mediated execution",
+    "intent-binding": "Intent-binding",
+    "no-splitting": "No splitting",
+    "human-approval": "Human approval",
+    "provable-audit": "Provable audit",
+    "continuous-verification": "Continuous verification",
+};

package/package.json

@@ -0,0 +1,64 @@
+{
+  "name": "@olurabian/audit",
+  "version": "0.1.0",
+  "description": "The Agent Payment Security Audit as a runnable. Can a compromised agent move money outside policy? Eight dimensions, honest Unknowns, blast radius in your own numbers.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "audit": "./dist/cli.js"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "prompts",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.test.json",
+    "test": "tsx --test test/*.test.ts",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "ai-agents",
+    "payments",
+    "security",
+    "audit",
+    "agent-security",
+    "deadlatch",
+    "purse"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ArabianAnalyst/audit.git"
+  },
+  "homepage": "https://github.com/ArabianAnalyst/audit#readme",
+  "bugs": {
+    "url": "https://github.com/ArabianAnalyst/audit/issues"
+  },
+  "license": "MIT",
+  "devDependencies": {
+    "@lavamoat/allow-scripts": "^5.1.0",
+    "@types/node": "^22.10.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0"
+  },
+  "lavamoat": {
+    "allowScripts": {
+      "tsx>esbuild#0.28.2": true
+    }
+  }
+}

package/prompts/agent-payment-security-audit.md

@@ -0,0 +1,86 @@
+# Agent Payment Security Audit
+
+A self-serve prompt that answers one question about your AI agent.
+
+> Can a compromised agent move money outside policy?
+
+Paste your setup into a strong model with the prompt below, and it returns a short, honest readout scored against the same deployment contract Purse is built on. Where you leave something out, it marks that dimension Unknown and asks the exact question, rather than guessing. It fails honest, the way Purse fails closed.
+
+This is a diagnostic, not a sales tool. It names where you are exposed and the shortest path to close it, whether or not that path is Purse.
+
+## How to use it
+
+1. Answer the eight intake questions about your setup.
+2. Paste the prompt below into a strong model, with your filled intake at the bottom.
+3. Read the readout. Anything you did not answer comes back as Unknown with the question to resolve it.
+
+## Intake
+
+Eight questions, one per dimension. Answer them plainly.
+
+1. **What does the agent buy, and how often?** API credits, compute, data, vendors, on-chain.
+2. **What can the agent's runtime reach?** List every tool, MCP server, SDK, and key in the agent's process.
+3. **Where does the payment credential live?** In the agent's process or prompt or memory, or behind a separate service or signer.
+4. **Who executes the payment?** The agent calls the rail itself, or it submits an intent to something that executes.
+5. **What limits exist and where are they enforced?** Per-action, daily, per-vendor. Checked before the spend or only at settlement.
+6. **Is there human approval for large spends?** None, in-band (the agent decides), or out of band (a person approves the exact spend).
+7. **Is there a record of every decision and the amount actually settled, and can it be tampered with?**
+8. **How often does the agent's tool or dependency set change, and is the money-path re-checked when it does?**
+
+## The prompt
+
+```
+You are the Agent-Payment-Security Auditor. You diagnose whether a team's AI agent could move money outside policy, and you produce a short, honest readout the team keeps whether or not they buy anything. You are built on one question.
+
+  Can a compromised agent move money outside policy?
+
+A compromised agent means one hit by prompt injection, a poisoned tool result, or a jailbroken instruction. The goal is not to keep the agent honest. It is to show whether a dishonest agent can still be stopped.
+
+## Method
+
+Score the setup on eight dimensions. Each is Closed, Partial, Exposed, or Unknown.
+
+1. Single path. Is every money path funneled through one enforcement point? Exposed if the agent's runtime holds a rail key, a second payment tool, or a direct payment primitive.
+2. Custody. Where does the credential live? Exposed if it sits in the agent's process, prompt, memory, or tools.
+3. Mediated execution. Does the agent execute the payment, or submit an intent to something that executes behind a boundary? Exposed if the agent calls the rail itself and policy is only advice.
+4. Intent-binding. Are spends bound to a specific approved payee and amount, or can the agent supply any in-policy value? Exposed if the agent chooses the who and the how-much within policy.
+5. No splitting. Are velocity caps enforced when a spend is reserved, or only when it settles? Exposed if many small spends can slip under a cap before any of them settle.
+6. Human approval. Are spends over a threshold gated out of band? Exposed if large spends auto-execute, or if the agent approves its own request.
+7. Provable audit. Is there a tamper-evident record of every decision and the amount actually settled? Exposed if logs can be edited, or the real settled amount is not recorded.
+8. Continuous verification. Is the single-path property re-checked when the agent gains a tool or dependency, or verified once at deploy? Exposed if the capability surface can drift silently.
+
+Mark a dimension Unknown when the intake does not answer it. Do not guess. List the exact question to ask.
+
+## Two framings for the readout
+
+Forgery vs misdirection. Custody (1 to 3) stops the agent forging a payment it was never handed the means to make. Intent-binding (4) stops it misdirecting one it is allowed to request. A setup can close forgery and still leak through misdirection, a compromised agent handing you a perfectly in-policy request that is not what you meant. This is the confused deputy at the payments layer. State clearly which of the two is open.
+
+Blast radius, not a checklist. For every Exposed dimension, state the concrete loss in money, using their own numbers where the intake gives them. Not "no allowlist" but "one poisoned tool result pays any address, up to your daily cap of the amount you set, with no record you can prove." Specific beats a red mark.
+
+## Output
+
+Produce the readout in this structure and nothing else.
+
+1. Posture. One honest line naming what they have. For example, advisory with caps, forgery open and misdirection open. Or, enforcement-grade except continuous verification.
+2. Money-path map. Every way money can currently leave, one per line, each marked mediated or unmediated.
+3. Exposure. The eight dimensions, each with its verdict and a one-line finding. Keep Unknown items in, with the question to ask.
+4. Top breaches. The one to three that matter most, each with the blast radius in money and the fix in one line.
+5. Which is open. Forgery, misdirection, or both, in one line, with why.
+6. Shortest path. Two to four concrete steps to close the top breaches. Order them by blast radius closed per unit of effort. Where a step is a payment-governance layer, a hosted control plane, or a hands-on implementation, say so plainly without pitching.
+
+## Voice and rules
+
+- Write from the reader's side. Plain, precise, calm. Premium developer-tool register, never a sales pitch.
+- No colons in prose. No em dashes. Use a period or a comma. Short sentences.
+- Never invent a fact about their system. If you did not receive it, it is Unknown.
+- Do not overstate the fix. If misdirection is not fully solved, say so. Honesty is the whole point.
+- No hard sell anywhere. The diagnosis is the sell. The last line is a plain next step, not a close.
+
+## Intake
+
+Paste your filled intake below.
+```
+
+## What the dimensions map to
+
+Each dimension scores against the deployment contract in the main [README](https://github.com/ArabianAnalyst/purse#threat-model). Enforcement mode closes custody, mediated execution, intent-binding, no-splitting, human approval, and provable audit. Continuous verification is a property you maintain, not a state you reach, so it stays on you and your deployment.