@plasius/economy 0.6.0 → 0.8.0

package/dist/index.js

@@ -501,6 +501,1155 @@ function mapBitLabsConversionState(state) {
   return transition;
 }
 
+// src/admin-reporting.ts
+var ADMIN_TOKEN_DEFAULT_WINDOW_DAYS = 30;
+var ADMIN_TOKEN_MAXIMUM_WINDOW_DAYS = 365;
+var ADMIN_TOKEN_MAXIMUM_HOURLY_WINDOW_DAYS = 31;
+var ADMIN_TOKEN_MAXIMUM_PAGE_SIZE = 100;
+var ADMIN_TOKEN_MAXIMUM_TREND_POINTS = ADMIN_TOKEN_MAXIMUM_HOURLY_WINDOW_DAYS * 24 * 5;
+var ADMIN_TOKEN_MINIMUM_COHORT_SIZE = 5;
+var ADMIN_TOKEN_ANOMALY_BASELINE_DAYS = 28;
+var DAY_MILLISECONDS = 864e5;
+var HOUR_MILLISECONDS = 36e5;
+var ACTIVITY_TYPES = /* @__PURE__ */ new Set([
+  "acquisition",
+  "spend",
+  "reversal",
+  "hold",
+  "failure"
+]);
+var ACTIVITY_STATUSES = /* @__PURE__ */ new Set([
+  "pending",
+  "held",
+  "settled",
+  "reversed",
+  "failed"
+]);
+var ACTIVITY_SOURCES = /* @__PURE__ */ new Set([
+  "paid-purchase",
+  "subscription",
+  "rewarded-activity",
+  "gameplay",
+  "system-adjustment",
+  "unknown"
+]);
+var SAFE_LABELS = /* @__PURE__ */ new Set([
+  "token-acquisition",
+  "token-spend",
+  "token-reversal",
+  "token-hold",
+  "token-activity-failed",
+  "token-system-adjustment",
+  "token-activity-unclassified"
+]);
+var SAFE_LABELS_BY_ACTIVITY_TYPE = {
+  acquisition: /* @__PURE__ */ new Set([
+    "token-acquisition",
+    "token-system-adjustment",
+    "token-activity-unclassified"
+  ]),
+  spend: /* @__PURE__ */ new Set([
+    "token-spend",
+    "token-system-adjustment",
+    "token-activity-unclassified"
+  ]),
+  reversal: /* @__PURE__ */ new Set([
+    "token-reversal",
+    "token-system-adjustment",
+    "token-activity-unclassified"
+  ]),
+  hold: /* @__PURE__ */ new Set([
+    "token-hold",
+    "token-system-adjustment",
+    "token-activity-unclassified"
+  ]),
+  failure: /* @__PURE__ */ new Set([
+    "token-activity-failed",
+    "token-activity-unclassified"
+  ])
+};
+var ACTIVITY_SORTS = /* @__PURE__ */ new Set([
+  "occurred-at-desc",
+  "amount-absolute-desc"
+]);
+var PSEUDONYM_AUDIENCES = /* @__PURE__ */ new Set([
+  "admin-token-activity",
+  "mcp-token-activity"
+]);
+var BALANCE_PSEUDONYM_AUDIENCES = /* @__PURE__ */ new Set([
+  "admin-token-balances",
+  "mcp-token-balances"
+]);
+var WALLET_COMPONENTS = /* @__PURE__ */ new Set([
+  "household",
+  "personal",
+  "gameplay-allocation"
+]);
+var WALLET_STATUSES = /* @__PURE__ */ new Set([
+  "active",
+  "closed"
+]);
+var WALLET_BALANCE_SORTS = /* @__PURE__ */ new Set([
+  "available-desc",
+  "updated-at-desc"
+]);
+var TREND_GRANULARITIES = /* @__PURE__ */ new Set([
+  "hour",
+  "day"
+]);
+var ALIAS = /^[A-Za-z0-9_-]{16,96}$/u;
+var OPAQUE_CURSOR = /^c1\.[A-Za-z0-9_-]{32,480}$/u;
+var PSEUDONYM_VERSION = /^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/u;
+var EXACT_STATISTIC_INTEGER = /^(?:0|-?[1-9][0-9]*)$/u;
+var POSITIVE_UNSIGNED_INTEGER = /^[1-9][0-9]*$/u;
+var MAXIMUM_STATISTIC_HALF_SUBUNITS = (TOKEN_SUBUNITS_MAX - TOKEN_SUBUNITS_MIN) * 2n;
+var ANOMALY_UNAVAILABLE_REASONS = /* @__PURE__ */ new Set([
+  "insufficient-history",
+  "privacy-suppressed-baseline"
+]);
+function assertPlainObject(value, label) {
+  economyAssert(
+    typeof value === "object" && value !== null && !Array.isArray(value),
+    "INVALID_CONTRACT",
+    `${label} must be an object`
+  );
+  const prototype = Object.getPrototypeOf(value);
+  economyAssert(
+    (prototype === Object.prototype || prototype === null) && !Reflect.has(value, "toJSON"),
+    "INVALID_CONTRACT",
+    `${label} must be a plain data object without serialization hooks`
+  );
+}
+function assertExactKeys(value, allowedKeys, label) {
+  assertPlainObject(value, label);
+  const allowed = new Set(allowedKeys);
+  const keys = Reflect.ownKeys(value);
+  economyAssert(
+    allowedKeys.every(
+      (key) => !Reflect.has(value, key) || Object.hasOwn(value, key)
+    ) && keys.every((key) => {
+      if (typeof key !== "string" || !allowed.has(key)) {
+        return false;
+      }
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      return descriptor !== void 0 && descriptor.enumerable && "value" in descriptor;
+    }),
+    "INVALID_CONTRACT",
+    `${label} contains an unsupported, identifying, or non-data property`
+  );
+}
+function assertAlias(value, label) {
+  economyAssert(
+    typeof value === "string" && ALIAS.test(value),
+    "INVALID_CONTRACT",
+    `${label} must be an opaque pseudonymous alias`
+  );
+}
+function assertOpaqueCursor(value) {
+  economyAssert(
+    typeof value === "string" && OPAQUE_CURSOR.test(value),
+    "INVALID_CONTRACT",
+    "Admin Token cursor must be a bounded confidentiality-protected opaque value"
+  );
+}
+function assertUniqueValues(values, allowed, label) {
+  economyAssert(
+    Array.isArray(values),
+    "INVALID_CONTRACT",
+    `${label} must be a list`
+  );
+  const unique = new Set(values);
+  economyAssert(
+    values.length > 0 && values.length === unique.size && values.every((value) => allowed.has(value)),
+    "INVALID_CONTRACT",
+    `${label} must contain unique supported values`
+  );
+}
+function absolute(value) {
+  return value < 0n ? -value : value;
+}
+function compareTextDescending(left, right) {
+  if (left === right) {
+    return 0;
+  }
+  return left > right ? -1 : 1;
+}
+function assertReportingWindow(window, maximumDays = ADMIN_TOKEN_MAXIMUM_WINDOW_DAYS) {
+  assertExactKeys(
+    window,
+    ["fromInclusive", "toExclusive"],
+    "Admin Token reporting window"
+  );
+  const from = parseIsoTimestamp(window.fromInclusive);
+  const to = parseIsoTimestamp(window.toExclusive);
+  economyAssert(
+    from < to && to - from <= maximumDays * DAY_MILLISECONDS,
+    "INVALID_TIME_WINDOW",
+    `Admin Token reporting window must be positive and no longer than ${maximumDays} days`
+  );
+  return { from, to };
+}
+function createDefaultAdminTokenReportingWindow(asOf) {
+  const to = parseIsoTimestamp(asOf);
+  return {
+    fromInclusive: new Date(
+      to - ADMIN_TOKEN_DEFAULT_WINDOW_DAYS * DAY_MILLISECONDS
+    ).toISOString(),
+    toExclusive: new Date(to).toISOString()
+  };
+}
+function assertNonNegativeTokenAmounts(amounts, label) {
+  economyAssert(
+    amounts.every((amount) => parseTokenSubunits(amount) >= 0n),
+    "INVALID_AMOUNT",
+    `${label} cannot contain a negative amount`
+  );
+}
+function assertPositiveAuthoritySequence(sequence, label) {
+  economyAssert(
+    typeof sequence === "string" && POSITIVE_UNSIGNED_INTEGER.test(sequence),
+    "INVALID_CONTRACT",
+    `${label} must be a canonical positive integer`
+  );
+}
+function assertAdminTokenEconomySummary(summary) {
+  assertExactKeys(
+    summary,
+    [
+      "schemaVersion",
+      "generatedAt",
+      "projectionAsOf",
+      "authoritySequence",
+      "walletCount",
+      "activeWalletCount",
+      "balances",
+      "lifetime",
+      "rawIdentifiersIncluded"
+    ],
+    "Admin Token economy summary"
+  );
+  assertExactKeys(
+    summary.balances,
+    ["schemaVersion", "available", "reserved", "held", "rewardProgress"],
+    "Admin Token aggregate balances"
+  );
+  assertExactKeys(
+    summary.lifetime,
+    [
+      "schemaVersion",
+      "bought",
+      "earned",
+      "allocated",
+      "reclaimed",
+      "spent",
+      "reversed"
+    ],
+    "Admin Token aggregate lifetime"
+  );
+  economyAssert(
+    summary.schemaVersion === ECONOMY_CONTRACT_VERSION && summary.balances.schemaVersion === ECONOMY_CONTRACT_VERSION && summary.lifetime.schemaVersion === ECONOMY_CONTRACT_VERSION && summary.rawIdentifiersIncluded === false && Number.isSafeInteger(summary.walletCount) && summary.walletCount >= 0 && Number.isSafeInteger(summary.activeWalletCount) && summary.activeWalletCount >= 0 && summary.activeWalletCount <= summary.walletCount,
+    "INVALID_CONTRACT",
+    "Admin Token economy summary metadata is invalid"
+  );
+  const generatedAt = parseIsoTimestamp(summary.generatedAt);
+  const projectionAsOf = parseIsoTimestamp(summary.projectionAsOf);
+  economyAssert(
+    projectionAsOf <= generatedAt,
+    "INVALID_TIME_WINDOW",
+    "Admin Token projection cannot be newer than its generated result"
+  );
+  assertPositiveAuthoritySequence(
+    summary.authoritySequence,
+    "Admin Token summary authority sequence"
+  );
+  assertNonNegativeTokenAmounts(
+    [
+      summary.balances.available,
+      summary.balances.reserved,
+      summary.balances.held,
+      summary.balances.rewardProgress,
+      summary.lifetime.bought,
+      summary.lifetime.earned,
+      summary.lifetime.allocated,
+      summary.lifetime.reclaimed,
+      summary.lifetime.spent,
+      summary.lifetime.reversed
+    ],
+    "Admin Token economy summary"
+  );
+}
+function assertAdminTokenWalletBalanceFilter(filter) {
+  assertExactKeys(
+    filter,
+    ["components", "statuses", "subjectAlias"],
+    "Admin Token wallet balance filter"
+  );
+  if (filter.components !== void 0) {
+    assertUniqueValues(
+      filter.components,
+      WALLET_COMPONENTS,
+      "Admin Token wallet components"
+    );
+  }
+  if (filter.statuses !== void 0) {
+    assertUniqueValues(
+      filter.statuses,
+      WALLET_STATUSES,
+      "Admin Token wallet statuses"
+    );
+  }
+  if (filter.subjectAlias !== void 0) {
+    assertAlias(filter.subjectAlias, "Wallet subject alias filter");
+  }
+}
+function sameWalletBalanceFilter(left, right) {
+  if (left === void 0 || right === void 0) {
+    return left === right;
+  }
+  return sameOptionalValues(left.components, right.components) && sameOptionalValues(left.statuses, right.statuses) && left.subjectAlias === right.subjectAlias;
+}
+function assertAdminTokenWalletBalanceCursorBinding(binding) {
+  assertExactKeys(
+    binding,
+    [
+      "schemaVersion",
+      "sort",
+      "filter",
+      "audience",
+      "pseudonymVersion"
+    ],
+    "Admin Token wallet balance cursor binding"
+  );
+  economyAssert(
+    binding.schemaVersion === ECONOMY_CONTRACT_VERSION && WALLET_BALANCE_SORTS.has(binding.sort) && BALANCE_PSEUDONYM_AUDIENCES.has(binding.audience) && PSEUDONYM_VERSION.test(binding.pseudonymVersion),
+    "INVALID_CONTRACT",
+    "Unsupported Admin Token wallet balance cursor binding"
+  );
+  if (binding.filter !== void 0) {
+    assertAdminTokenWalletBalanceFilter(binding.filter);
+  }
+}
+function assertAdminTokenWalletBalancePageRequest(request) {
+  assertExactKeys(
+    request,
+    [
+      "schemaVersion",
+      "limit",
+      "cursor",
+      "cursorBinding",
+      "sort",
+      "filter",
+      "audience",
+      "pseudonymVersion"
+    ],
+    "Admin Token wallet balance request"
+  );
+  economyAssert(
+    request.schemaVersion === ECONOMY_CONTRACT_VERSION && Number.isSafeInteger(request.limit) && request.limit >= 1 && request.limit <= ADMIN_TOKEN_MAXIMUM_PAGE_SIZE && WALLET_BALANCE_SORTS.has(request.sort) && BALANCE_PSEUDONYM_AUDIENCES.has(request.audience) && PSEUDONYM_VERSION.test(request.pseudonymVersion),
+    "INVALID_CONTRACT",
+    "Unsupported or unbounded Admin Token wallet balance request"
+  );
+  if (request.filter !== void 0) {
+    assertAdminTokenWalletBalanceFilter(request.filter);
+  }
+  economyAssert(
+    request.cursor === void 0 === (request.cursorBinding === void 0),
+    "INVALID_CONTRACT",
+    "Admin Token wallet balance cursor and binding must be provided together"
+  );
+  if (request.cursor === void 0 || request.cursorBinding === void 0) {
+    return;
+  }
+  assertOpaqueCursor(request.cursor);
+  assertAdminTokenWalletBalanceCursorBinding(request.cursorBinding);
+  economyAssert(
+    request.cursorBinding.sort === request.sort && request.cursorBinding.audience === request.audience && request.cursorBinding.pseudonymVersion === request.pseudonymVersion && sameWalletBalanceFilter(request.cursorBinding.filter, request.filter),
+    "INVALID_CONTRACT",
+    "Admin Token wallet balance cursor is not bound to the normalized query"
+  );
+}
+function assertAdminTokenWalletBalanceEntry(entry) {
+  assertExactKeys(
+    entry,
+    [
+      "schemaVersion",
+      "walletAlias",
+      "subjectAlias",
+      "component",
+      "status",
+      "available",
+      "reserved",
+      "held",
+      "rewardProgress",
+      "updatedAt",
+      "authoritySequence"
+    ],
+    "Admin Token wallet balance entry"
+  );
+  economyAssert(
+    entry.schemaVersion === ECONOMY_CONTRACT_VERSION && WALLET_COMPONENTS.has(entry.component) && WALLET_STATUSES.has(entry.status),
+    "INVALID_CONTRACT",
+    "Unsupported Admin Token wallet balance entry"
+  );
+  assertAlias(entry.walletAlias, "Wallet alias");
+  assertAlias(entry.subjectAlias, "Wallet subject alias");
+  economyAssert(
+    entry.walletAlias !== entry.subjectAlias,
+    "INVALID_CONTRACT",
+    "Wallet and subject aliases must use separate pseudonym domains"
+  );
+  assertNonNegativeTokenAmounts(
+    [entry.available, entry.reserved, entry.held, entry.rewardProgress],
+    "Admin Token wallet balance entry"
+  );
+  parseIsoTimestamp(entry.updatedAt);
+  assertPositiveAuthoritySequence(
+    entry.authoritySequence,
+    "Admin Token wallet balance authority sequence"
+  );
+}
+function compareWalletBalanceEntries(left, right, sort) {
+  if (sort === "available-desc") {
+    const leftAvailable = parseTokenSubunits(left.available);
+    const rightAvailable = parseTokenSubunits(right.available);
+    if (leftAvailable !== rightAvailable) {
+      return leftAvailable > rightAvailable ? -1 : 1;
+    }
+  }
+  const leftUpdatedAt = parseIsoTimestamp(left.updatedAt);
+  const rightUpdatedAt = parseIsoTimestamp(right.updatedAt);
+  if (leftUpdatedAt !== rightUpdatedAt) {
+    return leftUpdatedAt > rightUpdatedAt ? -1 : 1;
+  }
+  return compareTextDescending(left.walletAlias, right.walletAlias);
+}
+function assertAdminTokenWalletBalancePage(page) {
+  assertExactKeys(
+    page,
+    ["schemaVersion", "entries", "hasMore", "nextCursor", "metadata"],
+    "Admin Token wallet balance page"
+  );
+  assertExactKeys(
+    page.metadata,
+    [
+      "schemaVersion",
+      "generatedAt",
+      "sort",
+      "filter",
+      "pageLimit",
+      "audience",
+      "pseudonymVersion",
+      "rawIdentifiersIncluded"
+    ],
+    "Admin Token wallet balance metadata"
+  );
+  economyAssert(
+    page.schemaVersion === ECONOMY_CONTRACT_VERSION && page.metadata.schemaVersion === ECONOMY_CONTRACT_VERSION && typeof page.hasMore === "boolean" && page.metadata.rawIdentifiersIncluded === false && WALLET_BALANCE_SORTS.has(page.metadata.sort) && BALANCE_PSEUDONYM_AUDIENCES.has(page.metadata.audience) && PSEUDONYM_VERSION.test(page.metadata.pseudonymVersion) && Number.isSafeInteger(page.metadata.pageLimit) && page.metadata.pageLimit >= 1 && page.metadata.pageLimit <= ADMIN_TOKEN_MAXIMUM_PAGE_SIZE && Array.isArray(page.entries) && page.entries.length <= page.metadata.pageLimit && page.hasMore === (page.nextCursor !== void 0) && (!page.hasMore || page.entries.length > 0),
+    "INVALID_CONTRACT",
+    "Unsupported or unbounded Admin Token wallet balance page"
+  );
+  if (page.metadata.filter !== void 0) {
+    assertAdminTokenWalletBalanceFilter(page.metadata.filter);
+  }
+  parseIsoTimestamp(page.metadata.generatedAt);
+  if (page.nextCursor !== void 0) {
+    assertOpaqueCursor(page.nextCursor);
+  }
+  const walletAliases = /* @__PURE__ */ new Set();
+  let previous;
+  for (const entry of page.entries) {
+    assertAdminTokenWalletBalanceEntry(entry);
+    const filter = page.metadata.filter;
+    economyAssert(
+      filter === void 0 || (filter.components === void 0 || filter.components.includes(entry.component)) && (filter.statuses === void 0 || filter.statuses.includes(entry.status)) && (filter.subjectAlias === void 0 || filter.subjectAlias === entry.subjectAlias),
+      "INVALID_CONTRACT",
+      "Admin Token wallet balance result contains an unrequested row"
+    );
+    economyAssert(
+      !walletAliases.has(entry.walletAlias),
+      "DUPLICATE_IDENTIFIER",
+      "Admin Token wallet balance page cannot repeat a wallet alias"
+    );
+    walletAliases.add(entry.walletAlias);
+    if (previous !== void 0) {
+      economyAssert(
+        compareWalletBalanceEntries(previous, entry, page.metadata.sort) < 0,
+        "INVALID_CONTRACT",
+        "Admin Token wallet balance page does not use its declared stable sort"
+      );
+    }
+    previous = entry;
+  }
+}
+function assertAdminTokenWalletBalancePageForRequest(page, request) {
+  assertAdminTokenWalletBalancePageRequest(request);
+  assertAdminTokenWalletBalancePage(page);
+  economyAssert(
+    page.metadata.sort === request.sort && sameWalletBalanceFilter(page.metadata.filter, request.filter) && page.metadata.pageLimit === request.limit && page.metadata.audience === request.audience && page.metadata.pseudonymVersion === request.pseudonymVersion,
+    "INVALID_CONTRACT",
+    "Admin Token wallet balance result does not match its normalized request"
+  );
+}
+function assertAdminTokenActivityEntry(entry) {
+  assertExactKeys(
+    entry,
+    [
+      "schemaVersion",
+      "occurredAt",
+      "activityType",
+      "status",
+      "source",
+      "amount",
+      "safeLabel",
+      "rowAlias",
+      "subjectAlias"
+    ],
+    "Admin Token activity entry"
+  );
+  economyAssert(
+    entry.schemaVersion === ECONOMY_CONTRACT_VERSION && ACTIVITY_TYPES.has(entry.activityType) && ACTIVITY_STATUSES.has(entry.status) && ACTIVITY_SOURCES.has(entry.source),
+    "INVALID_CONTRACT",
+    "Unsupported Admin Token activity contract"
+  );
+  parseIsoTimestamp(entry.occurredAt);
+  const amount = parseTokenSubunits(entry.amount);
+  economyAssert(
+    (amount !== 0n || entry.activityType === "failure") && (entry.activityType !== "acquisition" || amount > 0n) && (entry.activityType !== "spend" || amount < 0n),
+    "INVALID_AMOUNT",
+    "Admin Token activity amount has an invalid sign or zero value"
+  );
+  economyAssert(
+    entry.activityType === "failure" === (entry.status === "failed"),
+    "INVALID_CONTRACT",
+    "Failed rows must use the failure activity type"
+  );
+  economyAssert(
+    SAFE_LABELS.has(entry.safeLabel) && SAFE_LABELS_BY_ACTIVITY_TYPE[entry.activityType]?.has(entry.safeLabel) === true,
+    "INVALID_CONTRACT",
+    "Admin Token activity label must use the approved non-identifying allowlist"
+  );
+  assertAlias(entry.rowAlias, "Row alias");
+  assertAlias(entry.subjectAlias, "Subject alias");
+  economyAssert(
+    entry.rowAlias !== entry.subjectAlias,
+    "INVALID_CONTRACT",
+    "Row and subject aliases must use separate pseudonym domains"
+  );
+}
+function assertAdminTokenActivityFilter(filter) {
+  assertExactKeys(
+    filter,
+    [
+      "activityTypes",
+      "statuses",
+      "sources",
+      "subjectAlias"
+    ],
+    "Admin Token activity filter"
+  );
+  if (filter.activityTypes !== void 0) {
+    assertUniqueValues(
+      filter.activityTypes,
+      ACTIVITY_TYPES,
+      "Admin Token activity types"
+    );
+  }
+  if (filter.statuses !== void 0) {
+    assertUniqueValues(
+      filter.statuses,
+      ACTIVITY_STATUSES,
+      "Admin Token activity statuses"
+    );
+  }
+  if (filter.sources !== void 0) {
+    assertUniqueValues(
+      filter.sources,
+      ACTIVITY_SOURCES,
+      "Admin Token activity sources"
+    );
+  }
+  if (filter.subjectAlias !== void 0) {
+    assertAlias(filter.subjectAlias, "Subject alias filter");
+  }
+}
+function sameOptionalValues(left, right) {
+  if (left === void 0 || right === void 0) {
+    return left === right;
+  }
+  return left.length === right.length && left.every((value) => right.includes(value));
+}
+function sameActivityFilter(left, right) {
+  if (left === void 0 || right === void 0) {
+    return left === right;
+  }
+  return sameOptionalValues(left.activityTypes, right.activityTypes) && sameOptionalValues(left.statuses, right.statuses) && sameOptionalValues(left.sources, right.sources) && left.subjectAlias === right.subjectAlias;
+}
+function assertAdminTokenActivityCursorBinding(binding) {
+  assertExactKeys(
+    binding,
+    [
+      "schemaVersion",
+      "sort",
+      "window",
+      "filter",
+      "audience",
+      "pseudonymVersion"
+    ],
+    "Admin Token activity cursor binding"
+  );
+  economyAssert(
+    binding.schemaVersion === ECONOMY_CONTRACT_VERSION && ACTIVITY_SORTS.has(binding.sort) && PSEUDONYM_AUDIENCES.has(binding.audience) && PSEUDONYM_VERSION.test(binding.pseudonymVersion),
+    "INVALID_CONTRACT",
+    "Unsupported Admin Token activity cursor binding"
+  );
+  assertReportingWindow(binding.window);
+  if (binding.filter !== void 0) {
+    assertAdminTokenActivityFilter(binding.filter);
+  }
+}
+function assertAdminTokenActivityPageRequest(request) {
+  assertExactKeys(
+    request,
+    [
+      "schemaVersion",
+      "limit",
+      "cursor",
+      "cursorBinding",
+      "sort",
+      "window",
+      "filter",
+      "audience",
+      "pseudonymVersion"
+    ],
+    "Admin Token activity request"
+  );
+  economyAssert(
+    request.schemaVersion === ECONOMY_CONTRACT_VERSION && Number.isSafeInteger(request.limit) && request.limit >= 1 && request.limit <= ADMIN_TOKEN_MAXIMUM_PAGE_SIZE && ACTIVITY_SORTS.has(request.sort) && PSEUDONYM_AUDIENCES.has(request.audience) && PSEUDONYM_VERSION.test(request.pseudonymVersion),
+    "INVALID_CONTRACT",
+    "Unsupported or unbounded Admin Token activity request"
+  );
+  assertReportingWindow(request.window);
+  if (request.filter !== void 0) {
+    assertAdminTokenActivityFilter(request.filter);
+  }
+  economyAssert(
+    request.cursor === void 0 === (request.cursorBinding === void 0),
+    "INVALID_CONTRACT",
+    "Admin Token activity cursor and trusted binding must be provided together"
+  );
+  if (request.cursor === void 0 || request.cursorBinding === void 0) {
+    return;
+  }
+  assertOpaqueCursor(request.cursor);
+  assertAdminTokenActivityCursorBinding(request.cursorBinding);
+  economyAssert(
+    request.cursorBinding.sort === request.sort && request.cursorBinding.window.fromInclusive === request.window.fromInclusive && request.cursorBinding.window.toExclusive === request.window.toExclusive && request.cursorBinding.audience === request.audience && request.cursorBinding.pseudonymVersion === request.pseudonymVersion && sameActivityFilter(request.cursorBinding.filter, request.filter),
+    "INVALID_CONTRACT",
+    "Admin Token cursor is not bound to the normalized query"
+  );
+}
+function compareActivityEntries(left, right, sort) {
+  if (sort === "amount-absolute-desc") {
+    const leftAmount = absolute(parseTokenSubunits(left.amount));
+    const rightAmount = absolute(parseTokenSubunits(right.amount));
+    if (leftAmount !== rightAmount) {
+      return leftAmount > rightAmount ? -1 : 1;
+    }
+  }
+  const leftTime = parseIsoTimestamp(left.occurredAt);
+  const rightTime = parseIsoTimestamp(right.occurredAt);
+  if (leftTime !== rightTime) {
+    return leftTime > rightTime ? -1 : 1;
+  }
+  return compareTextDescending(left.rowAlias, right.rowAlias);
+}
+function assertAdminTokenActivityPage(page) {
+  assertExactKeys(
+    page,
+    ["schemaVersion", "entries", "hasMore", "nextCursor", "metadata"],
+    "Admin Token activity page"
+  );
+  assertExactKeys(
+    page.metadata,
+    [
+      "schemaVersion",
+      "generatedAt",
+      "fromInclusive",
+      "toExclusive",
+      "sort",
+      "filter",
+      "pageLimit",
+      "audience",
+      "pseudonymVersion",
+      "rawIdentifiersIncluded"
+    ],
+    "Admin Token activity metadata"
+  );
+  economyAssert(
+    page.schemaVersion === ECONOMY_CONTRACT_VERSION && page.metadata.schemaVersion === ECONOMY_CONTRACT_VERSION && typeof page.hasMore === "boolean" && page.metadata.rawIdentifiersIncluded === false && ACTIVITY_SORTS.has(page.metadata.sort) && PSEUDONYM_AUDIENCES.has(page.metadata.audience) && PSEUDONYM_VERSION.test(page.metadata.pseudonymVersion) && Number.isSafeInteger(page.metadata.pageLimit) && page.metadata.pageLimit >= 1 && page.metadata.pageLimit <= ADMIN_TOKEN_MAXIMUM_PAGE_SIZE,
+    "INVALID_CONTRACT",
+    "Unsupported Admin Token activity result metadata"
+  );
+  const window = assertReportingWindow({
+    fromInclusive: page.metadata.fromInclusive,
+    toExclusive: page.metadata.toExclusive
+  });
+  if (page.metadata.filter !== void 0) {
+    assertAdminTokenActivityFilter(page.metadata.filter);
+  }
+  parseIsoTimestamp(page.metadata.generatedAt);
+  economyAssert(
+    Array.isArray(page.entries) && page.entries.length <= page.metadata.pageLimit && page.hasMore === (page.nextCursor !== void 0) && (!page.hasMore || page.entries.length > 0),
+    "INVALID_CONTRACT",
+    "Admin Token activity page is unbounded or has inconsistent pagination"
+  );
+  if (page.nextCursor !== void 0) {
+    assertOpaqueCursor(page.nextCursor);
+  }
+  const rowAliases = /* @__PURE__ */ new Set();
+  let previous;
+  for (const entry of page.entries) {
+    assertAdminTokenActivityEntry(entry);
+    const occurredAt = parseIsoTimestamp(entry.occurredAt);
+    economyAssert(
+      occurredAt >= window.from && occurredAt < window.to,
+      "INVALID_TIME_WINDOW",
+      "Admin Token activity falls outside the declared result window"
+    );
+    const filter = page.metadata.filter;
+    economyAssert(
+      filter === void 0 || (filter.activityTypes === void 0 || filter.activityTypes.includes(entry.activityType)) && (filter.statuses === void 0 || filter.statuses.includes(entry.status)) && (filter.sources === void 0 || filter.sources.includes(entry.source)) && (filter.subjectAlias === void 0 || filter.subjectAlias === entry.subjectAlias),
+      "INVALID_CONTRACT",
+      "Admin Token activity result contains a row outside its metadata filters"
+    );
+    economyAssert(
+      !rowAliases.has(entry.rowAlias),
+      "DUPLICATE_IDENTIFIER",
+      "Admin Token activity page cannot repeat a row alias"
+    );
+    rowAliases.add(entry.rowAlias);
+    if (previous !== void 0) {
+      economyAssert(
+        compareActivityEntries(previous, entry, page.metadata.sort) < 0,
+        "INVALID_CONTRACT",
+        "Admin Token activity page does not use its declared stable sort"
+      );
+    }
+    previous = entry;
+  }
+}
+function assertAdminTokenActivityPageForRequest(page, request) {
+  assertAdminTokenActivityPageRequest(request);
+  assertAdminTokenActivityPage(page);
+  economyAssert(
+    page.metadata.fromInclusive === request.window.fromInclusive && page.metadata.toExclusive === request.window.toExclusive && page.metadata.sort === request.sort && sameActivityFilter(page.metadata.filter, request.filter) && page.metadata.pageLimit === request.limit && page.metadata.audience === request.audience && page.metadata.pseudonymVersion === request.pseudonymVersion,
+    "INVALID_CONTRACT",
+    "Admin Token activity result metadata does not match its normalized request"
+  );
+}
+function assertAdminTokenTrendRequest(request) {
+  assertExactKeys(
+    request,
+    ["schemaVersion", "window", "granularity", "activityTypes"],
+    "Admin Token trend request"
+  );
+  economyAssert(
+    request.schemaVersion === ECONOMY_CONTRACT_VERSION && TREND_GRANULARITIES.has(request.granularity),
+    "INVALID_CONTRACT",
+    "Unsupported Admin Token trend request"
+  );
+  assertReportingWindow(
+    request.window,
+    request.granularity === "hour" ? ADMIN_TOKEN_MAXIMUM_HOURLY_WINDOW_DAYS : ADMIN_TOKEN_MAXIMUM_WINDOW_DAYS
+  );
+  if (request.activityTypes !== void 0) {
+    assertUniqueValues(
+      request.activityTypes,
+      ACTIVITY_TYPES,
+      "Admin Token trend activity types"
+    );
+  }
+}
+function medianHalfSubunits(values) {
+  const ordered = [...values].sort(
+    (left, right) => left === right ? 0 : left < right ? -1 : 1
+  );
+  const lower = ordered[Math.floor((ordered.length - 1) / 2)];
+  const upper = ordered[Math.floor(ordered.length / 2)];
+  economyAssert(
+    lower !== void 0 && upper !== void 0,
+    "INVALID_CONTRACT",
+    "Median requires at least one value"
+  );
+  const sum = lower + upper;
+  economyAssert(
+    sum % 2n === 0n,
+    "INVALID_AMOUNT",
+    "Median cannot be represented in exact half TokenSubunits"
+  );
+  return sum / 2n;
+}
+function serializeExactStatistic(halfSubunits) {
+  economyAssert(
+    absolute(halfSubunits) <= MAXIMUM_STATISTIC_HALF_SUBUNITS,
+    "AMOUNT_OUT_OF_RANGE",
+    "Admin Token statistic exceeds its exact bounded representation"
+  );
+  if (halfSubunits % 2n === 0n) {
+    return {
+      numerator: (halfSubunits / 2n).toString(10),
+      denominator: 1
+    };
+  }
+  return {
+    numerator: halfSubunits.toString(10),
+    denominator: 2
+  };
+}
+function parseExactStatistic(value, label) {
+  assertExactKeys(value, ["numerator", "denominator"], label);
+  economyAssert(
+    typeof value.numerator === "string" && value.numerator.length <= 22 && EXACT_STATISTIC_INTEGER.test(value.numerator) && (value.denominator === 1 || value.denominator === 2),
+    "INVALID_AMOUNT",
+    `${label} must be an exact bounded rational TokenSubunit value`
+  );
+  const numerator = BigInt(value.numerator);
+  economyAssert(
+    value.denominator === 1 || numerator % 2n !== 0n,
+    "INVALID_AMOUNT",
+    `${label} must use a reduced exact representation`
+  );
+  const halfSubunits = numerator * BigInt(2 / value.denominator);
+  economyAssert(
+    absolute(halfSubunits) <= MAXIMUM_STATISTIC_HALF_SUBUNITS,
+    "AMOUNT_OUT_OF_RANGE",
+    `${label} exceeds its exact bounded representation`
+  );
+  return halfSubunits;
+}
+function classifyAnomaly(options) {
+  if (options.absoluteDeltaHalfSubunits < options.minimumAbsoluteDeltaHalfSubunits) {
+    return {
+      status: "normal",
+      explanationCode: "below-absolute-minimum"
+    };
+  }
+  if (options.medianAbsoluteDeviationHalfSubunits === 0n) {
+    return options.absoluteDeltaHalfSubunits > 0n ? {
+      status: "irregular-spike",
+      explanationCode: "zero-mad-absolute-threshold-exceeded"
+    } : {
+      status: "normal",
+      explanationCode: "within-baseline-variation"
+    };
+  }
+  const exceedsBaseline = options.absoluteDeltaHalfSubunits * 1000n >= options.medianAbsoluteDeviationHalfSubunits * BigInt(options.madMultiplierMilli);
+  return exceedsBaseline ? {
+    status: "irregular-spike",
+    explanationCode: "median-mad-and-absolute-threshold-exceeded"
+  } : {
+    status: "normal",
+    explanationCode: "within-baseline-variation"
+  };
+}
+function createAdminTokenAnomalyIndicator(input) {
+  assertExactKeys(
+    input,
+    [
+      "observedAmount",
+      "baselineSamples",
+      "minimumAbsoluteDelta",
+      "madMultiplierMilli"
+    ],
+    "Admin Token anomaly input"
+  );
+  economyAssert(
+    Array.isArray(input.baselineSamples) && input.baselineSamples.length === ADMIN_TOKEN_ANOMALY_BASELINE_DAYS && Number.isSafeInteger(input.madMultiplierMilli) && input.madMultiplierMilli >= 1 && input.madMultiplierMilli <= 1e6,
+    "INVALID_CONTRACT",
+    "Admin Token anomaly input requires 28 baselines and a bounded fixed-point multiplier"
+  );
+  const observed = parseTokenSubunits(input.observedAmount);
+  const baseline = input.baselineSamples.map((sample) => {
+    assertExactKeys(
+      sample,
+      ["amount", "distinctSubjects"],
+      "Admin Token anomaly baseline sample"
+    );
+    economyAssert(
+      Number.isSafeInteger(sample.distinctSubjects) && sample.distinctSubjects >= ADMIN_TOKEN_MINIMUM_COHORT_SIZE,
+      "INVALID_CONTRACT",
+      "Admin Token anomaly baselines must exclude privacy-suppressed cohorts"
+    );
+    return parseTokenSubunits(sample.amount);
+  });
+  const minimum = parseTokenSubunits(input.minimumAbsoluteDelta);
+  economyAssert(
+    minimum > 0n,
+    "INVALID_AMOUNT",
+    "Admin Token anomaly absolute minimum must be positive"
+  );
+  const baselineHalfSubunits = baseline.map((amount) => amount * 2n);
+  const medianHalf = medianHalfSubunits(baselineHalfSubunits);
+  const medianAbsoluteDeviationHalf = medianHalfSubunits(
+    baselineHalfSubunits.map((amount) => absolute(amount - medianHalf))
+  );
+  const deviationHalf = observed * 2n - medianHalf;
+  const classification = classifyAnomaly({
+    absoluteDeltaHalfSubunits: absolute(deviationHalf),
+    medianAbsoluteDeviationHalfSubunits: medianAbsoluteDeviationHalf,
+    minimumAbsoluteDeltaHalfSubunits: minimum * 2n,
+    madMultiplierMilli: input.madMultiplierMilli
+  });
+  return {
+    method: "same-window-median-mad-v1",
+    ...classification,
+    baselineWindowCount: ADMIN_TOKEN_ANOMALY_BASELINE_DAYS,
+    medianAmount: serializeExactStatistic(medianHalf),
+    medianAbsoluteDeviation: serializeExactStatistic(medianAbsoluteDeviationHalf),
+    minimumAbsoluteDelta: input.minimumAbsoluteDelta,
+    deviationFromMedian: serializeExactStatistic(deviationHalf),
+    madMultiplierMilli: input.madMultiplierMilli
+  };
+}
+function createAdminTokenAnomalyUnavailable(input) {
+  assertExactKeys(
+    input,
+    ["reason", "eligibleBaselineWindowCount"],
+    "Unavailable Admin Token anomaly input"
+  );
+  economyAssert(
+    ANOMALY_UNAVAILABLE_REASONS.has(input.reason) && Number.isSafeInteger(input.eligibleBaselineWindowCount) && input.eligibleBaselineWindowCount >= 0 && input.eligibleBaselineWindowCount < ADMIN_TOKEN_ANOMALY_BASELINE_DAYS,
+    "INVALID_CONTRACT",
+    "Unavailable Admin Token anomaly requires a bounded reason and eligible baseline count"
+  );
+  return {
+    method: "same-window-median-mad-v1",
+    status: "unavailable",
+    reason: input.reason,
+    eligibleBaselineWindowCount: input.eligibleBaselineWindowCount,
+    requiredBaselineWindowCount: ADMIN_TOKEN_ANOMALY_BASELINE_DAYS
+  };
+}
+function assertAdminTokenAnomalyIndicator(anomaly, observedAmount) {
+  assertExactKeys(
+    anomaly,
+    [
+      "method",
+      "status",
+      "baselineWindowCount",
+      "medianAmount",
+      "medianAbsoluteDeviation",
+      "minimumAbsoluteDelta",
+      "deviationFromMedian",
+      "madMultiplierMilli",
+      "explanationCode"
+    ],
+    "Admin Token anomaly indicator"
+  );
+  const observed = parseTokenSubunits(observedAmount);
+  const medianHalf = parseExactStatistic(
+    anomaly.medianAmount,
+    "Admin Token anomaly median"
+  );
+  const madHalf = parseExactStatistic(
+    anomaly.medianAbsoluteDeviation,
+    "Admin Token anomaly median absolute deviation"
+  );
+  const minimum = parseTokenSubunits(anomaly.minimumAbsoluteDelta);
+  const deviationHalf = parseExactStatistic(
+    anomaly.deviationFromMedian,
+    "Admin Token anomaly deviation"
+  );
+  economyAssert(
+    anomaly.method === "same-window-median-mad-v1" && anomaly.baselineWindowCount === ADMIN_TOKEN_ANOMALY_BASELINE_DAYS && medianHalf >= TOKEN_SUBUNITS_MIN * 2n && medianHalf <= TOKEN_SUBUNITS_MAX * 2n && madHalf >= 0n && minimum > 0n && Number.isSafeInteger(anomaly.madMultiplierMilli) && anomaly.madMultiplierMilli >= 1 && anomaly.madMultiplierMilli <= 1e6 && deviationHalf === observed * 2n - medianHalf,
+    "INVALID_CONTRACT",
+    "Admin Token anomaly arithmetic or method is invalid"
+  );
+  const expected = classifyAnomaly({
+    absoluteDeltaHalfSubunits: absolute(deviationHalf),
+    medianAbsoluteDeviationHalfSubunits: madHalf,
+    minimumAbsoluteDeltaHalfSubunits: minimum * 2n,
+    madMultiplierMilli: anomaly.madMultiplierMilli
+  });
+  economyAssert(
+    anomaly.status === expected.status && anomaly.explanationCode === expected.explanationCode,
+    "INVALID_CONTRACT",
+    "Admin Token anomaly classification is inconsistent with its explanation"
+  );
+}
+function assertAdminTokenAnomalyUnavailable(anomaly) {
+  assertExactKeys(
+    anomaly,
+    [
+      "method",
+      "status",
+      "reason",
+      "eligibleBaselineWindowCount",
+      "requiredBaselineWindowCount"
+    ],
+    "Unavailable Admin Token anomaly"
+  );
+  economyAssert(
+    anomaly.method === "same-window-median-mad-v1" && anomaly.status === "unavailable" && ANOMALY_UNAVAILABLE_REASONS.has(anomaly.reason) && Number.isSafeInteger(anomaly.eligibleBaselineWindowCount) && anomaly.eligibleBaselineWindowCount >= 0 && anomaly.eligibleBaselineWindowCount < ADMIN_TOKEN_ANOMALY_BASELINE_DAYS && anomaly.requiredBaselineWindowCount === ADMIN_TOKEN_ANOMALY_BASELINE_DAYS,
+    "INVALID_CONTRACT",
+    "Unavailable Admin Token anomaly metadata is invalid"
+  );
+}
+function assertTrendBucketAlignment(start, end, granularity) {
+  const expectedDuration = granularity === "hour" ? HOUR_MILLISECONDS : DAY_MILLISECONDS;
+  const date = new Date(start);
+  const aligned = date.getUTCMinutes() === 0 && date.getUTCSeconds() === 0 && date.getUTCMilliseconds() === 0 && (granularity === "hour" || date.getUTCHours() === 0);
+  economyAssert(
+    aligned && end - start === expectedDuration,
+    "INVALID_TIME_WINDOW",
+    "Admin Token trend bucket is not aligned to its declared granularity"
+  );
+}
+function assertTrendAggregate(aggregate) {
+  assertPlainObject(aggregate, "Admin Token trend aggregate");
+  if (aggregate.visibility === "suppressed") {
+    assertExactKeys(
+      aggregate,
+      ["visibility", "reason", "threshold"],
+      "Suppressed Admin Token trend aggregate"
+    );
+    economyAssert(
+      aggregate.reason === "cohort-below-minimum" && aggregate.threshold === ADMIN_TOKEN_MINIMUM_COHORT_SIZE,
+      "INVALID_CONTRACT",
+      "Suppressed Admin Token trend aggregate has invalid privacy metadata"
+    );
+    return;
+  }
+  assertExactKeys(
+    aggregate,
+    [
+      "visibility",
+      "distinctSubjects",
+      "activityCount",
+      "signedAmount"
+    ],
+    "Reported Admin Token trend aggregate"
+  );
+  parseTokenSubunits(aggregate.signedAmount);
+  economyAssert(
+    aggregate.visibility === "reported" && Number.isSafeInteger(aggregate.distinctSubjects) && aggregate.distinctSubjects >= ADMIN_TOKEN_MINIMUM_COHORT_SIZE && Number.isSafeInteger(aggregate.activityCount) && aggregate.activityCount >= aggregate.distinctSubjects,
+    "INVALID_CONTRACT",
+    "Reported Admin Token trend aggregate is invalid or below the privacy threshold"
+  );
+}
+function assertAdminTokenTrendResult(result) {
+  assertExactKeys(
+    result,
+    ["schemaVersion", "series", "metadata"],
+    "Admin Token trend result"
+  );
+  assertExactKeys(
+    result.metadata,
+    [
+      "schemaVersion",
+      "generatedAt",
+      "fromInclusive",
+      "toExclusive",
+      "granularity",
+      "activityTypes",
+      "minimumCohortSize",
+      "anomalyBaselineDays",
+      "rawIdentifiersIncluded"
+    ],
+    "Admin Token trend metadata"
+  );
+  economyAssert(
+    result.schemaVersion === ECONOMY_CONTRACT_VERSION && result.metadata.schemaVersion === ECONOMY_CONTRACT_VERSION && TREND_GRANULARITIES.has(result.metadata.granularity) && result.metadata.minimumCohortSize === ADMIN_TOKEN_MINIMUM_COHORT_SIZE && result.metadata.anomalyBaselineDays === ADMIN_TOKEN_ANOMALY_BASELINE_DAYS && result.metadata.rawIdentifiersIncluded === false && Array.isArray(result.series) && result.series.length <= ADMIN_TOKEN_MAXIMUM_TREND_POINTS,
+    "INVALID_CONTRACT",
+    "Unsupported or unbounded Admin Token trend result"
+  );
+  assertUniqueValues(
+    result.metadata.activityTypes,
+    ACTIVITY_TYPES,
+    "Admin Token trend result activity types"
+  );
+  const window = assertReportingWindow(
+    {
+      fromInclusive: result.metadata.fromInclusive,
+      toExclusive: result.metadata.toExclusive
+    },
+    result.metadata.granularity === "hour" ? ADMIN_TOKEN_MAXIMUM_HOURLY_WINDOW_DAYS : ADMIN_TOKEN_MAXIMUM_WINDOW_DAYS
+  );
+  parseIsoTimestamp(result.metadata.generatedAt);
+  const pointKeys = /* @__PURE__ */ new Set();
+  let previousKey;
+  for (const point of result.series) {
+    assertExactKeys(
+      point,
+      [
+        "schemaVersion",
+        "bucketStart",
+        "bucketEnd",
+        "activityType",
+        "aggregate",
+        "anomaly"
+      ],
+      "Admin Token trend point"
+    );
+    economyAssert(
+      point.schemaVersion === ECONOMY_CONTRACT_VERSION && ACTIVITY_TYPES.has(point.activityType) && result.metadata.activityTypes.includes(point.activityType),
+      "INVALID_CONTRACT",
+      "Unsupported Admin Token trend point"
+    );
+    const start = parseIsoTimestamp(point.bucketStart);
+    const end = parseIsoTimestamp(point.bucketEnd);
+    economyAssert(
+      start >= window.from && end <= window.to,
+      "INVALID_TIME_WINDOW",
+      "Admin Token trend bucket falls outside the declared result window"
+    );
+    assertTrendBucketAlignment(start, end, result.metadata.granularity);
+    assertTrendAggregate(point.aggregate);
+    if (point.aggregate.visibility === "suppressed") {
+      economyAssert(
+        point.anomaly === void 0,
+        "INVALID_CONTRACT",
+        "Suppressed Admin Token cohorts cannot include anomaly details"
+      );
+    } else {
+      economyAssert(
+        point.anomaly !== void 0,
+        "INVALID_CONTRACT",
+        "Reported Admin Token cohorts require an anomaly result"
+      );
+      if (point.anomaly.status === "unavailable") {
+        assertAdminTokenAnomalyUnavailable(point.anomaly);
+      } else {
+        assertAdminTokenAnomalyIndicator(
+          point.anomaly,
+          point.aggregate.signedAmount
+        );
+      }
+    }
+    const key = `${point.bucketStart}\0${point.activityType}`;
+    economyAssert(
+      !pointKeys.has(key) && (previousKey === void 0 || previousKey < key),
+      "DUPLICATE_IDENTIFIER",
+      "Admin Token trend points must be unique and stably ordered"
+    );
+    pointKeys.add(key);
+    previousKey = key;
+  }
+}
+function assertAdminTokenTrendResultForRequest(result, request) {
+  assertAdminTokenTrendRequest(request);
+  assertAdminTokenTrendResult(result);
+  const requestedActivityTypes = request.activityTypes ?? [...ACTIVITY_TYPES];
+  economyAssert(
+    result.metadata.fromInclusive === request.window.fromInclusive && result.metadata.toExclusive === request.window.toExclusive && result.metadata.granularity === request.granularity && sameOptionalValues(
+      result.metadata.activityTypes,
+      requestedActivityTypes
+    ),
+    "INVALID_CONTRACT",
+    "Admin Token trend result metadata does not match its normalized request"
+  );
+}
+
 // src/allocations.ts
 function assertWholePositive(amount, label) {
   const parsed = parseTokenSubunits(amount);
@@ -837,7 +1986,7 @@ var COMMAND_ENVELOPE_KEYS = /* @__PURE__ */ new Set([
   "acceptedRegion",
   "writerFencingToken"
 ]);
-function assertExactKeys(value, allowedKeys, label) {
+function assertExactKeys2(value, allowedKeys, label) {
   economyAssert(
     value !== null && typeof value === "object" && !Array.isArray(value),
     "INVALID_CONTRACT",
@@ -881,7 +2030,7 @@ function assertRelationshipContext(relationshipId, authorizationVersion) {
   );
 }
 function assertEconomyHmacFingerprint(fingerprint, expectedDomain) {
-  assertExactKeys(
+  assertExactKeys2(
     fingerprint,
     /* @__PURE__ */ new Set([
       "schemaVersion",
@@ -906,7 +2055,7 @@ function assertEconomyHmacFingerprint(fingerprint, expectedDomain) {
   );
 }
 function assertEconomyAuthorizationEvidence(evidence) {
-  assertExactKeys(
+  assertExactKeys2(
     evidence,
     /* @__PURE__ */ new Set([
       "schemaVersion",
@@ -943,7 +2092,7 @@ function assertEconomyAuthorizationEvidence(evidence) {
   );
 }
 function assertCausationReference(causation) {
-  assertExactKeys(
+  assertExactKeys2(
     causation,
     /* @__PURE__ */ new Set(["schemaVersion", "kind", "causationId"]),
     "Economy causation reference"
@@ -998,7 +2147,7 @@ function assertCommandSourcePrincipal(envelope) {
   }
 }
 function assertAuditedEconomyCommandEnvelope(envelope) {
-  assertExactKeys(
+  assertExactKeys2(
     envelope,
     COMMAND_ENVELOPE_KEYS,
     "Audited economy command envelope"
@@ -1064,7 +2213,7 @@ function assertAuditedEconomyCommandEnvelope(envelope) {
   );
 }
 function assertEconomyProviderEvidenceHash(evidence) {
-  assertExactKeys(
+  assertExactKeys2(
     evidence,
     /* @__PURE__ */ new Set([
       "schemaVersion",
@@ -1135,7 +2284,7 @@ function assertEconomyProviderEvidenceHash(evidence) {
   }
 }
 function assertEconomyEncryptedOperationalHandleBinding(binding) {
-  assertExactKeys(
+  assertExactKeys2(
     binding,
     /* @__PURE__ */ new Set([
       "schemaVersion",
@@ -1170,7 +2319,7 @@ function assertEconomyEncryptedOperationalHandleBinding(binding) {
   parseIsoTimestamp(binding.createdAt);
 }
 function assertEvidenceRecordReference(reference) {
-  assertExactKeys(
+  assertExactKeys2(
     reference,
     /* @__PURE__ */ new Set(["schemaVersion", "recordId", "contentHash"]),
     "Evidence record reference"
@@ -1201,7 +2350,7 @@ function assertUniqueSortedReferences(references, label) {
   }
 }
 function assertEconomyProviderEvidenceManifest(manifest) {
-  assertExactKeys(
+  assertExactKeys2(
     manifest,
     /* @__PURE__ */ new Set([
       "schemaVersion",
@@ -1243,7 +2392,7 @@ function assertEconomyProviderEvidenceManifest(manifest) {
   parseIsoTimestamp(manifest.createdAt);
 }
 function assertEconomyAcceptedCommandReceipt(receipt) {
-  assertExactKeys(
+  assertExactKeys2(
     receipt,
     /* @__PURE__ */ new Set([
       "schemaVersion",
@@ -1267,7 +2416,7 @@ function assertEconomyAcceptedCommandReceipt(receipt) {
   parseIsoTimestamp(receipt.acceptedAt);
 }
 function assertEconomyCommandResultReceipt(receipt) {
-  assertExactKeys(
+  assertExactKeys2(
     receipt,
     /* @__PURE__ */ new Set([
       "schemaVersion",
@@ -1324,7 +2473,7 @@ function assertEconomyCommandResultReceipt(receipt) {
   }
 }
 function assertEconomyAuditedIdempotencyScope(scope) {
-  assertExactKeys(
+  assertExactKeys2(
     scope,
     /* @__PURE__ */ new Set([
       "schemaVersion",
@@ -1355,7 +2504,7 @@ function assertEconomyAuditedIdempotencyScope(scope) {
   );
 }
 function assertEconomyAuditedIdempotencyResult(result) {
-  assertExactKeys(
+  assertExactKeys2(
     result,
     /* @__PURE__ */ new Set([
       "schemaVersion",
@@ -1646,7 +2795,7 @@ var MANIFEST_KEYS = /* @__PURE__ */ new Set([
   "recordReferences",
   "committedAt"
 ]);
-function assertExactKeys2(value, allowedKeys, label) {
+function assertExactKeys3(value, allowedKeys, label) {
   economyAssert(
     value !== null && typeof value === "object" && !Array.isArray(value),
     "INVALID_CONTRACT",
@@ -1684,7 +2833,7 @@ function referenceOrder(left, right) {
   return byKind === 0 ? compareUnicodeCodeUnits(left.recordId, right.recordId) : byKind;
 }
 function assertEconomyAuthorityRecordReference(reference) {
-  assertExactKeys2(
+  assertExactKeys3(
     reference,
     /* @__PURE__ */ new Set([
       "schemaVersion",
@@ -1848,7 +2997,7 @@ function assertCommitAllowedInState(manifest) {
   }
 }
 function assertEconomyAuthorityCommitManifest(manifest) {
-  assertExactKeys2(manifest, MANIFEST_KEYS, "Authority commit manifest");
+  assertExactKeys3(manifest, MANIFEST_KEYS, "Authority commit manifest");
   economyAssert(
     manifest.schemaVersion === ECONOMY_CONTRACT_VERSION && COMMIT_KINDS.has(manifest.commitKind) && AUTHORITY_STATES.has(manifest.authorityStateBefore) && AUTHORITY_STATES.has(manifest.authorityStateAfter),
     "INVALID_CONTRACT",
@@ -1895,7 +3044,7 @@ function assertEconomyAuthorityCommitManifest(manifest) {
   parseIsoTimestamp(manifest.committedAt);
 }
 function assertEconomyAuthorityHead(head) {
-  assertExactKeys2(head, HEAD_KEYS, "Economy authority head");
+  assertExactKeys3(head, HEAD_KEYS, "Economy authority head");
   economyAssert(
     head.schemaVersion === ECONOMY_CONTRACT_VERSION && AUTHORITY_STATES.has(head.state),
     "INVALID_CONTRACT",
@@ -1954,7 +3103,7 @@ function advanceEconomyAuthorityHead(head, manifest, manifestCanonicalHash) {
   };
 }
 function assertEconomyIntegrityVerificationReceipt(receipt) {
-  assertExactKeys2(
+  assertExactKeys3(
     receipt,
     /* @__PURE__ */ new Set([
       "schemaVersion",
@@ -2100,7 +3249,7 @@ function assertEconomyIntegrityVerificationReceipt(receipt) {
   parseIsoTimestamp(receipt.verifiedAt);
 }
 function assertEconomyIntegrityAnchorManifest(manifest) {
-  assertExactKeys2(
+  assertExactKeys3(
     manifest,
     /* @__PURE__ */ new Set([
       "schemaVersion",
@@ -2262,7 +3411,7 @@ function sortEconomyAuthorityRecordReferences(references) {
 }
 
 // src/ledger.ts
-var ACTIVITY_TYPES = /* @__PURE__ */ new Set([
+var ACTIVITY_TYPES2 = /* @__PURE__ */ new Set([
   "purchase",
   "subscription",
   "rewarded-ad",
@@ -2279,14 +3428,14 @@ var ACTIVITY_TYPES = /* @__PURE__ */ new Set([
   "event",
   "competition"
 ]);
-var ACTIVITY_STATUSES = /* @__PURE__ */ new Set([
+var ACTIVITY_STATUSES2 = /* @__PURE__ */ new Set([
   "pending",
   "held",
   "settled",
   "reversed",
   "failed"
 ]);
-var ACTIVITY_SOURCES = /* @__PURE__ */ new Set([
+var ACTIVITY_SOURCES2 = /* @__PURE__ */ new Set([
   "shopify",
   "ayet",
   "bitlabs",
@@ -2316,7 +3465,7 @@ function assertActivityEntry(entry) {
   );
   assertEconomyIdentifier(entry.transactionId, "transactionId");
   economyAssert(
-    ACTIVITY_TYPES.has(entry.activityType) && ACTIVITY_STATUSES.has(entry.status) && ACTIVITY_SOURCES.has(entry.source),
+    ACTIVITY_TYPES2.has(entry.activityType) && ACTIVITY_STATUSES2.has(entry.status) && ACTIVITY_SOURCES2.has(entry.source),
     "INVALID_CONTRACT",
     "Activity type, status, or source is unsupported"
   );
@@ -2354,7 +3503,7 @@ function assertBalancedTransaction(transaction) {
   assertEconomyIdentifier(transaction.transactionId, "transactionId");
   assertEconomyIdentifier(transaction.idempotencyKey, "idempotencyKey");
   economyAssert(
-    ACTIVITY_TYPES.has(transaction.activityType) && ACTIVITY_STATUSES.has(transaction.status),
+    ACTIVITY_TYPES2.has(transaction.activityType) && ACTIVITY_STATUSES2.has(transaction.status),
     "INVALID_CONTRACT",
     "Transaction activity type or status is unsupported"
   );
@@ -4319,6 +5468,341 @@ function assertDistinctAdjustmentApproval(request) {
   }
 }
 
+// src/operator-adjustments.ts
+var PREVIEW_KEYS = /* @__PURE__ */ new Set([
+  "schemaVersion",
+  "previewId",
+  "adjustmentId",
+  "operation",
+  "targetAccountId",
+  "targetComponent",
+  "targetWalletId",
+  "targetLedgerAccountId",
+  "offsetLedgerAccountId",
+  "sourceLotId",
+  "amount",
+  "reasonCode",
+  "ticketReferenceHash",
+  "transferPolicy",
+  "refundPolicy",
+  "originalSourceLotId",
+  "originalTransactionId",
+  "preparedAt",
+  "expiresAt"
+]);
+var DECISION_KEYS = /* @__PURE__ */ new Set([
+  "schemaVersion",
+  "decisionId",
+  "adjustmentId",
+  "proposalId",
+  "proposalHash",
+  "previewHash",
+  "decision",
+  "proposedByAccountId",
+  "decidedByAccountId",
+  "proposedAt",
+  "decidedAt"
+]);
+var PROPOSAL_KEYS = /* @__PURE__ */ new Set([
+  "schemaVersion",
+  "proposalId",
+  "adjustmentId",
+  "previewHash",
+  "status",
+  "proposedByAccountId",
+  "proposedAt",
+  "expiresAt"
+]);
+var EXECUTION_KEYS = /* @__PURE__ */ new Set([
+  "schemaVersion",
+  "executionId",
+  "adjustmentId",
+  "previewHash",
+  "proposalHash",
+  "decisionHash",
+  "sourceLotId",
+  "transactionId",
+  "resultReceiptId",
+  "executedAt"
+]);
+var OPERATIONS = /* @__PURE__ */ new Set([
+  "credit",
+  "reverse-credit"
+]);
+var TARGET_COMPONENTS = /* @__PURE__ */ new Set([
+  "personal",
+  "household-treasury"
+]);
+var TRANSFER_POLICIES = /* @__PURE__ */ new Set([
+  "household-allocatable",
+  "same-user-only",
+  "non-transferable"
+]);
+var DECISIONS = /* @__PURE__ */ new Set([
+  "approve",
+  "reject"
+]);
+function assertExactKeys4(value, allowed, label) {
+  economyAssert(
+    value !== null && typeof value === "object" && !Array.isArray(value),
+    "INVALID_CONTRACT",
+    `${label} must be an object`
+  );
+  economyAssert(
+    Object.keys(value).every((key) => allowed.has(key)),
+    "INVALID_CONTRACT",
+    `${label} contains an unsupported field`
+  );
+}
+function assertCanonicalHash6(value, label) {
+  economyAssert(
+    /^sha256:[a-f0-9]{64}$/u.test(value),
+    "INVALID_CONTRACT",
+    `${label} must be a canonical SHA-256 reference`
+  );
+}
+function assertReasonCode(reasonCode) {
+  economyAssert(
+    /^[A-Z][A-Z0-9_]{2,95}$/u.test(reasonCode),
+    "INVALID_CONTRACT",
+    "Adjustment reasonCode must be a bounded uppercase identifier"
+  );
+}
+function assertOperatorAdjustmentPreview(preview) {
+  assertExactKeys4(preview, PREVIEW_KEYS, "Operator adjustment preview");
+  economyAssert(
+    preview.schemaVersion === ECONOMY_CONTRACT_VERSION && OPERATIONS.has(preview.operation) && TARGET_COMPONENTS.has(preview.targetComponent) && TRANSFER_POLICIES.has(preview.transferPolicy) && preview.refundPolicy === "not-refundable",
+    "INVALID_CONTRACT",
+    "Unsupported operator adjustment preview"
+  );
+  assertEconomyIdentifier(preview.previewId, "previewId");
+  assertEconomyIdentifier(preview.adjustmentId, "adjustmentId");
+  assertEconomyIdentifier(preview.targetAccountId, "targetAccountId");
+  assertEconomyIdentifier(preview.targetWalletId, "targetWalletId");
+  assertEconomyIdentifier(
+    preview.targetLedgerAccountId,
+    "targetLedgerAccountId"
+  );
+  assertEconomyIdentifier(
+    preview.offsetLedgerAccountId,
+    "offsetLedgerAccountId"
+  );
+  assertEconomyIdentifier(preview.sourceLotId, "sourceLotId");
+  economyAssert(
+    parseTokenSubunits(preview.amount) > 0n,
+    "INVALID_AMOUNT",
+    "Operator adjustment amount must be positive"
+  );
+  assertReasonCode(preview.reasonCode);
+  assertCanonicalHash6(preview.ticketReferenceHash, "ticketReferenceHash");
+  const preparedAt = parseIsoTimestamp(preview.preparedAt);
+  const expiresAt = parseIsoTimestamp(preview.expiresAt);
+  economyAssert(
+    expiresAt > preparedAt,
+    "INVALID_TIME_WINDOW",
+    "Operator adjustment preview must expire after preparation"
+  );
+  if (preview.operation === "credit") {
+    economyAssert(
+      preview.originalSourceLotId === void 0 && preview.originalTransactionId === void 0,
+      "INVALID_CONTRACT",
+      "A credit preview cannot bind an original transaction"
+    );
+    return;
+  }
+  economyAssert(
+    preview.originalSourceLotId !== void 0 && preview.originalTransactionId !== void 0,
+    "INVALID_CONTRACT",
+    "A reversal preview must bind the original lot and transaction"
+  );
+  assertEconomyIdentifier(preview.originalSourceLotId, "originalSourceLotId");
+  assertEconomyIdentifier(
+    preview.originalTransactionId,
+    "originalTransactionId"
+  );
+}
+function canonicalOperatorAdjustmentPreviewPayload(preview) {
+  assertOperatorAdjustmentPreview(preview);
+  return JSON.stringify({
+    schemaVersion: preview.schemaVersion,
+    previewId: preview.previewId,
+    adjustmentId: preview.adjustmentId,
+    operation: preview.operation,
+    targetAccountId: preview.targetAccountId,
+    targetComponent: preview.targetComponent,
+    targetWalletId: preview.targetWalletId,
+    targetLedgerAccountId: preview.targetLedgerAccountId,
+    offsetLedgerAccountId: preview.offsetLedgerAccountId,
+    sourceLotId: preview.sourceLotId,
+    amount: preview.amount,
+    reasonCode: preview.reasonCode,
+    ticketReferenceHash: preview.ticketReferenceHash,
+    transferPolicy: preview.transferPolicy,
+    refundPolicy: preview.refundPolicy,
+    ...preview.originalSourceLotId === void 0 ? {} : { originalSourceLotId: preview.originalSourceLotId },
+    ...preview.originalTransactionId === void 0 ? {} : { originalTransactionId: preview.originalTransactionId },
+    preparedAt: preview.preparedAt,
+    expiresAt: preview.expiresAt
+  });
+}
+function assertOperatorAdjustmentProposal(proposal, preview, expectedPreviewHash) {
+  assertOperatorAdjustmentPreview(preview);
+  assertCanonicalHash6(expectedPreviewHash, "expectedPreviewHash");
+  assertExactKeys4(proposal, PROPOSAL_KEYS, "Operator adjustment proposal");
+  economyAssert(
+    proposal.schemaVersion === ECONOMY_CONTRACT_VERSION && proposal.status === "pending-approval",
+    "INVALID_CONTRACT",
+    "Unsupported operator adjustment proposal"
+  );
+  assertEconomyIdentifier(proposal.proposalId, "proposalId");
+  assertEconomyIdentifier(proposal.adjustmentId, "adjustmentId");
+  assertCanonicalHash6(proposal.previewHash, "previewHash");
+  assertEconomyIdentifier(
+    proposal.proposedByAccountId,
+    "proposedByAccountId"
+  );
+  economyAssert(
+    proposal.adjustmentId === preview.adjustmentId && proposal.previewHash === expectedPreviewHash,
+    "ADJUSTMENT_PREVIEW_MISMATCH",
+    "Operator adjustment proposal does not match its preview"
+  );
+  const proposedAt = parseIsoTimestamp(proposal.proposedAt);
+  const expiresAt = parseIsoTimestamp(proposal.expiresAt);
+  economyAssert(
+    proposedAt >= parseIsoTimestamp(preview.preparedAt) && expiresAt === parseIsoTimestamp(preview.expiresAt) && expiresAt > proposedAt,
+    "INVALID_TIME_WINDOW",
+    "Operator adjustment proposal times are inconsistent"
+  );
+}
+function canonicalOperatorAdjustmentProposalPayload(proposal) {
+  assertExactKeys4(proposal, PROPOSAL_KEYS, "Operator adjustment proposal");
+  return JSON.stringify({
+    schemaVersion: proposal.schemaVersion,
+    proposalId: proposal.proposalId,
+    adjustmentId: proposal.adjustmentId,
+    previewHash: proposal.previewHash,
+    status: proposal.status,
+    proposedByAccountId: proposal.proposedByAccountId,
+    proposedAt: proposal.proposedAt,
+    expiresAt: proposal.expiresAt
+  });
+}
+function assertOperatorAdjustmentDecision(decision, proposal, preview, expectedPreviewHash, expectedProposalHash) {
+  assertOperatorAdjustmentProposal(proposal, preview, expectedPreviewHash);
+  assertCanonicalHash6(expectedProposalHash, "expectedProposalHash");
+  assertExactKeys4(decision, DECISION_KEYS, "Operator adjustment decision");
+  economyAssert(
+    decision.schemaVersion === ECONOMY_CONTRACT_VERSION && DECISIONS.has(decision.decision),
+    "INVALID_CONTRACT",
+    "Unsupported operator adjustment decision"
+  );
+  assertEconomyIdentifier(decision.decisionId, "decisionId");
+  assertEconomyIdentifier(decision.adjustmentId, "adjustmentId");
+  assertEconomyIdentifier(decision.proposalId, "proposalId");
+  assertCanonicalHash6(decision.proposalHash, "proposalHash");
+  assertCanonicalHash6(decision.previewHash, "previewHash");
+  assertEconomyIdentifier(
+    decision.proposedByAccountId,
+    "proposedByAccountId"
+  );
+  assertEconomyIdentifier(
+    decision.decidedByAccountId,
+    "decidedByAccountId"
+  );
+  economyAssert(
+    decision.proposedByAccountId !== decision.decidedByAccountId,
+    "ADJUSTMENT_SELF_APPROVAL",
+    "Operator adjustment approval requires a distinct operator"
+  );
+  economyAssert(
+    decision.adjustmentId === preview.adjustmentId && decision.proposalId === proposal.proposalId && decision.proposalHash === expectedProposalHash && decision.previewHash === expectedPreviewHash,
+    "ADJUSTMENT_PREVIEW_MISMATCH",
+    "Operator adjustment decision does not match its preview"
+  );
+  const proposedAt = parseIsoTimestamp(decision.proposedAt);
+  const decidedAt = parseIsoTimestamp(decision.decidedAt);
+  economyAssert(
+    decision.proposedByAccountId === proposal.proposedByAccountId && proposedAt === parseIsoTimestamp(proposal.proposedAt) && decidedAt >= proposedAt,
+    "INVALID_TIME_WINDOW",
+    "Operator adjustment decision times are inconsistent"
+  );
+  economyAssert(
+    decidedAt <= parseIsoTimestamp(preview.expiresAt),
+    "ADJUSTMENT_EXPIRED",
+    "Operator adjustment preview has expired"
+  );
+}
+function canonicalOperatorAdjustmentDecisionPayload(decision) {
+  assertExactKeys4(decision, DECISION_KEYS, "Operator adjustment decision");
+  return JSON.stringify({
+    schemaVersion: decision.schemaVersion,
+    decisionId: decision.decisionId,
+    adjustmentId: decision.adjustmentId,
+    proposalId: decision.proposalId,
+    proposalHash: decision.proposalHash,
+    previewHash: decision.previewHash,
+    decision: decision.decision,
+    proposedByAccountId: decision.proposedByAccountId,
+    decidedByAccountId: decision.decidedByAccountId,
+    proposedAt: decision.proposedAt,
+    decidedAt: decision.decidedAt
+  });
+}
+function assertOperatorAdjustmentExecution(execution, preview, proposal, decision, expectedPreviewHash, expectedProposalHash, expectedDecisionHash) {
+  assertOperatorAdjustmentDecision(
+    decision,
+    proposal,
+    preview,
+    expectedPreviewHash,
+    expectedProposalHash
+  );
+  assertCanonicalHash6(expectedDecisionHash, "expectedDecisionHash");
+  assertExactKeys4(execution, EXECUTION_KEYS, "Operator adjustment execution");
+  economyAssert(
+    execution.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    "INVALID_CONTRACT",
+    "Unsupported operator adjustment execution"
+  );
+  assertEconomyIdentifier(execution.executionId, "executionId");
+  assertEconomyIdentifier(execution.adjustmentId, "adjustmentId");
+  assertCanonicalHash6(execution.previewHash, "previewHash");
+  assertCanonicalHash6(execution.proposalHash, "proposalHash");
+  assertCanonicalHash6(execution.decisionHash, "decisionHash");
+  assertEconomyIdentifier(execution.sourceLotId, "sourceLotId");
+  assertEconomyIdentifier(execution.transactionId, "transactionId");
+  assertEconomyIdentifier(execution.resultReceiptId, "resultReceiptId");
+  economyAssert(
+    decision.decision === "approve",
+    "ADJUSTMENT_NOT_APPROVED",
+    "Only an approved adjustment may execute"
+  );
+  economyAssert(
+    execution.adjustmentId === preview.adjustmentId && execution.previewHash === expectedPreviewHash && execution.proposalHash === expectedProposalHash && execution.decisionHash === expectedDecisionHash && execution.sourceLotId === preview.sourceLotId,
+    "ADJUSTMENT_PREVIEW_MISMATCH",
+    "Operator adjustment execution does not match its approval plan"
+  );
+  economyAssert(
+    parseIsoTimestamp(execution.executedAt) >= parseIsoTimestamp(decision.decidedAt),
+    "INVALID_TIME_WINDOW",
+    "Operator adjustment execution predates its decision"
+  );
+}
+function canonicalOperatorAdjustmentExecutionPayload(execution) {
+  assertExactKeys4(execution, EXECUTION_KEYS, "Operator adjustment execution");
+  return JSON.stringify({
+    schemaVersion: execution.schemaVersion,
+    executionId: execution.executionId,
+    adjustmentId: execution.adjustmentId,
+    previewHash: execution.previewHash,
+    proposalHash: execution.proposalHash,
+    decisionHash: execution.decisionHash,
+    sourceLotId: execution.sourceLotId,
+    transactionId: execution.transactionId,
+    resultReceiptId: execution.resultReceiptId,
+    executedAt: execution.executedAt
+  });
+}
+
 // src/paid-lots.ts
 var ZERO_ARITHMETIC = Object.freeze({
   retainedDelta: serializeTokenSubunits(0n),
@@ -5349,7 +6833,7 @@ function createProjectionSnapshot(transactions, rebuiltAt) {
 }
 
 // src/ports/query.ts
-var ACTIVITY_TYPES2 = /* @__PURE__ */ new Set([
+var ACTIVITY_TYPES3 = /* @__PURE__ */ new Set([
   "purchase",
   "subscription",
   "rewarded-ad",
@@ -5366,14 +6850,14 @@ var ACTIVITY_TYPES2 = /* @__PURE__ */ new Set([
   "event",
   "competition"
 ]);
-var ACTIVITY_STATUSES2 = /* @__PURE__ */ new Set([
+var ACTIVITY_STATUSES3 = /* @__PURE__ */ new Set([
   "pending",
   "held",
   "settled",
   "reversed",
   "failed"
 ]);
-var ACTIVITY_SOURCES2 = /* @__PURE__ */ new Set([
+var ACTIVITY_SOURCES3 = /* @__PURE__ */ new Set([
   "shopify",
   "ayet",
   "bitlabs",
@@ -5401,14 +6885,14 @@ function assertSafeDisplayString(value, label) {
     `${label} must be bounded and safe for display`
   );
 }
-function assertOpaqueCursor(value) {
+function assertOpaqueCursor2(value) {
   economyAssert(
     typeof value === "string" && value.length > 0 && value.length <= 512 && !hasControlCharacters2(value),
     "INVALID_CONTRACT",
     "Activity cursor must be a bounded opaque value"
   );
 }
-function assertUniqueValues(values, allowed, label) {
+function assertUniqueValues2(values, allowed, label) {
   const unique = new Set(values);
   economyAssert(
     values.length > 0 && values.length === unique.size && values.every((value) => allowed.has(value)),
@@ -5671,7 +7155,7 @@ function assertWalletActivityEntry(entry) {
   assertEconomyIdentifier(entry.activityId, "activityId");
   assertEconomyIdentifier(entry.walletId, "walletId");
   economyAssert(
-    ACTIVITY_TYPES2.has(entry.activityType) && ACTIVITY_STATUSES2.has(entry.status) && ACTIVITY_SOURCES2.has(entry.source),
+    ACTIVITY_TYPES3.has(entry.activityType) && ACTIVITY_STATUSES3.has(entry.status) && ACTIVITY_SOURCES3.has(entry.source),
     "INVALID_CONTRACT",
     "Wallet activity type, status, or source is unsupported"
   );
@@ -5719,20 +7203,20 @@ function assertWalletActivityPageRequest(request) {
     "Activity page limit must be between one and 100"
   );
   if (request.cursor !== void 0) {
-    assertOpaqueCursor(request.cursor);
+    assertOpaqueCursor2(request.cursor);
   }
   const filter = request.filter;
   if (filter === void 0) {
     return;
   }
   if (filter.activityTypes !== void 0) {
-    assertUniqueValues(filter.activityTypes, ACTIVITY_TYPES2, "Activity types");
+    assertUniqueValues2(filter.activityTypes, ACTIVITY_TYPES3, "Activity types");
   }
   if (filter.statuses !== void 0) {
-    assertUniqueValues(filter.statuses, ACTIVITY_STATUSES2, "Activity statuses");
+    assertUniqueValues2(filter.statuses, ACTIVITY_STATUSES3, "Activity statuses");
   }
   if (filter.sources !== void 0) {
-    assertUniqueValues(filter.sources, ACTIVITY_SOURCES2, "Activity sources");
+    assertUniqueValues2(filter.sources, ACTIVITY_SOURCES3, "Activity sources");
   }
   if (filter.beneficiaryAccountId !== void 0) {
     assertEconomyIdentifier(
@@ -5765,7 +7249,7 @@ function assertWalletActivityPage(page) {
     "Activity pages are bounded and cannot advertise more rows from an empty page"
   );
   if (page.nextCursor !== void 0) {
-    assertOpaqueCursor(page.nextCursor);
+    assertOpaqueCursor2(page.nextCursor);
   }
   const activityIds = /* @__PURE__ */ new Set();
   let previous;
@@ -6747,7 +8231,7 @@ var RESULT_OUTCOMES = /* @__PURE__ */ new Set([
   "failed",
   "no-op"
 ]);
-var ACTIVITY_TYPES3 = /* @__PURE__ */ new Set([
+var ACTIVITY_TYPES4 = /* @__PURE__ */ new Set([
   "purchase",
   "subscription",
   "rewarded-ad",
@@ -6859,7 +8343,7 @@ var PORTABLE_KEYS = /* @__PURE__ */ new Set([
   "signature",
   ...PORTABLE_BODY_KEYS
 ]);
-function assertExactKeys3(value, allowedKeys, label) {
+function assertExactKeys5(value, allowedKeys, label) {
   economyAssert(
     value !== null && typeof value === "object" && !Array.isArray(value),
     "INVALID_CONTRACT",
@@ -6871,7 +8355,7 @@ function assertExactKeys3(value, allowedKeys, label) {
     `${label} contains an unsupported field`
   );
 }
-function assertCanonicalHash6(value, label) {
+function assertCanonicalHash7(value, label) {
   economyAssert(
     typeof value === "string" && CANONICAL_HASH.test(value),
     "INVALID_CONTRACT",
@@ -6880,7 +8364,7 @@ function assertCanonicalHash6(value, label) {
 }
 function canonicalHash(payload, hashCanonicalPayload2, label) {
   const value = hashCanonicalPayload2(payload);
-  assertCanonicalHash6(value, label);
+  assertCanonicalHash7(value, label);
   return value;
 }
 function assertUnsignedInteger(value, label) {
@@ -6948,7 +8432,7 @@ function canonicalSignatureMetadata(signature) {
   };
 }
 function assertEconomySealedRecoveryPayload(payload) {
-  assertExactKeys3(
+  assertExactKeys5(
     payload,
     /* @__PURE__ */ new Set([
       "schemaVersion",
@@ -6978,17 +8462,17 @@ function assertEconomySealedRecoveryPayload(payload) {
     22,
     22
   );
-  assertCanonicalHash6(
+  assertCanonicalHash7(
     payload.plaintextContentHash,
     "Recovery plaintext-content hash"
   );
-  assertCanonicalHash6(
+  assertCanonicalHash7(
     payload.encryptionContextHash,
     "Recovery encryption-context hash"
   );
 }
 function assertAcceptanceBody(body) {
-  assertExactKeys3(
+  assertExactKeys5(
     body,
     "acceptanceEnvelopeId" in body ? ACCEPTANCE_KEYS : ACCEPTANCE_BODY_KEYS,
     "Recovery acceptance body"
@@ -7007,9 +8491,9 @@ function assertAcceptanceBody(body) {
     body.idempotencyFingerprint,
     "economy.idempotency-key.v1"
   );
-  assertCanonicalHash6(body.commandEnvelopeHash, "Command-envelope hash");
+  assertCanonicalHash7(body.commandEnvelopeHash, "Command-envelope hash");
   assertEconomyIdentifier(body.acceptedReceiptId, "acceptedReceiptId");
-  assertCanonicalHash6(body.acceptedReceiptHash, "Accepted-receipt hash");
+  assertCanonicalHash7(body.acceptedReceiptHash, "Accepted-receipt hash");
   assertEconomySealedRecoveryPayload(body.sealedPayload);
   const preparedAt = parseIsoTimestamp(body.preparedAt);
   const acceptedAt = parseIsoTimestamp(body.acceptedAt);
@@ -7057,7 +8541,7 @@ function createEconomyRecoveryAcceptanceEnvelope(body, hashCanonicalPayload2) {
   };
 }
 function assertEconomyRecoveryAcceptanceEnvelope(envelope, hashCanonicalPayload2) {
-  assertExactKeys3(envelope, ACCEPTANCE_KEYS, "Recovery acceptance envelope");
+  assertExactKeys5(envelope, ACCEPTANCE_KEYS, "Recovery acceptance envelope");
   assertAcceptanceBody(envelope);
   assertEconomyIdentifier(
     envelope.acceptanceEnvelopeId,
@@ -7098,7 +8582,7 @@ function canonicalEconomyRecoveryAcceptanceEnvelopePayload(envelope, hashCanonic
   });
 }
 function assertCommittedResultBody(body) {
-  assertExactKeys3(
+  assertExactKeys5(
     body,
     "committedResultId" in body ? COMMITTED_RESULT_KEYS : COMMITTED_RESULT_BODY_KEYS,
     "Recovery committed-result body"
@@ -7126,7 +8610,7 @@ function assertCommittedResultBody(body) {
     [body.authorityCommitHash, "Authority-commit hash"],
     [body.authorityHeadHashAfter, "Authority-head hash"]
   ]) {
-    assertCanonicalHash6(value, label);
+    assertCanonicalHash7(value, label);
   }
   economyAssert(
     RESULT_OUTCOMES.has(body.outcome),
@@ -7149,7 +8633,7 @@ function assertCommittedResultBody(body) {
     assertEconomyIdentifier(body.transactionId, "transactionId");
   }
   if (body.transactionCanonicalHash !== void 0) {
-    assertCanonicalHash6(
+    assertCanonicalHash7(
       body.transactionCanonicalHash,
       "Transaction canonical hash"
     );
@@ -7192,7 +8676,7 @@ function createEconomyRecoveryCommittedResult(body, hashCanonicalPayload2) {
   };
 }
 function assertEconomyRecoveryCommittedResult(result, hashCanonicalPayload2) {
-  assertExactKeys3(
+  assertExactKeys5(
     result,
     COMMITTED_RESULT_KEYS,
     "Recovery committed result"
@@ -7251,7 +8735,7 @@ function assertEconomyRecoveryResultLink(acceptance, result, hashCanonicalPayloa
   );
 }
 function assertEconomyEvidenceSignatureMetadata(signature) {
-  assertExactKeys3(
+  assertExactKeys5(
     signature,
     /* @__PURE__ */ new Set([
       "schemaVersion",
@@ -7271,7 +8755,7 @@ function assertEconomyEvidenceSignatureMetadata(signature) {
   parseIsoTimestamp(signature.signedAt);
 }
 function assertEconomyEvidenceSignature(signature) {
-  assertExactKeys3(
+  assertExactKeys5(
     signature,
     /* @__PURE__ */ new Set([
       "schemaVersion",
@@ -7293,7 +8777,7 @@ function assertEconomyEvidenceSignature(signature) {
   assertBase64url(signature.value, "Evidence signature value", 32, 2048);
 }
 function assertRegionalEvidenceBody(body) {
-  assertExactKeys3(
+  assertExactKeys5(
     body,
     "evidenceReceiptId" in body ? REGIONAL_KEYS : REGIONAL_BODY_KEYS,
     "Regional evidence-receipt body"
@@ -7325,7 +8809,7 @@ function assertRegionalEvidenceBody(body) {
     "INVALID_CONTRACT",
     "Unsupported recovery record kind"
   );
-  assertCanonicalHash6(
+  assertCanonicalHash7(
     body.recoveryRecordContentHash,
     "Recovery-record content hash"
   );
@@ -7341,7 +8825,7 @@ function assertRegionalEvidenceBody(body) {
       "INVALID_CONTRACT",
       "Non-genesis regional evidence receipt requires a previous hash"
     );
-    assertCanonicalHash6(
+    assertCanonicalHash7(
       body.previousReceiptHash,
       "Previous evidence-receipt hash"
     );
@@ -7385,7 +8869,7 @@ function createEconomyRegionalEvidenceReceipt(body, signature, hashCanonicalPayl
   };
 }
 function assertEconomyRegionalEvidenceReceipt(receipt, hashCanonicalPayload2) {
-  assertExactKeys3(receipt, REGIONAL_KEYS, "Regional evidence receipt");
+  assertExactKeys5(receipt, REGIONAL_KEYS, "Regional evidence receipt");
   assertRegionalEvidenceBody(receipt);
   assertEconomyIdentifier(receipt.evidenceReceiptId, "evidenceReceiptId");
   assertEconomyEvidenceSignature(receipt.signature);
@@ -7516,7 +9000,7 @@ function assertEconomyRegionalEvidenceChain(receipts, expectedPreviousReceiptHas
       "INVALID_CONTRACT",
       "Partial evidence chain requires its trusted preceding hash"
     );
-    assertCanonicalHash6(
+    assertCanonicalHash7(
       expectedPreviousReceiptHash,
       "Expected preceding evidence-receipt hash"
     );
@@ -7587,7 +9071,7 @@ function assertEconomyRegionalEvidenceEquality(receipts, expectedRegions, hashCa
   );
 }
 function assertEconomyMerkleInclusionProof(proof) {
-  assertExactKeys3(
+  assertExactKeys5(
     proof,
     /* @__PURE__ */ new Set([
       "schemaVersion",
@@ -7608,8 +9092,8 @@ function assertEconomyMerkleInclusionProof(proof) {
     "Unsupported Merkle inclusion proof"
   );
   assertEconomyIdentifier(proof.anchorId, "anchorId");
-  assertCanonicalHash6(proof.anchorManifestHash, "Anchor-manifest hash");
-  assertCanonicalHash6(proof.leafHash, "Merkle leaf hash");
+  assertCanonicalHash7(proof.anchorManifestHash, "Anchor-manifest hash");
+  assertCanonicalHash7(proof.leafHash, "Merkle leaf hash");
   assertUnsignedInteger(proof.leafIndex, "Merkle leaf index");
   assertUnsignedInteger(proof.leafCount, "Merkle leaf count");
   economyAssert(
@@ -7618,7 +9102,7 @@ function assertEconomyMerkleInclusionProof(proof) {
     "Merkle leaf position is outside its bounded tree"
   );
   for (const step of proof.siblings) {
-    assertExactKeys3(
+    assertExactKeys5(
       step,
       /* @__PURE__ */ new Set(["schemaVersion", "side", "hash"]),
       "Merkle proof step"
@@ -7628,7 +9112,7 @@ function assertEconomyMerkleInclusionProof(proof) {
       "INVALID_CONTRACT",
       "Unsupported Merkle proof step"
     );
-    assertCanonicalHash6(step.hash, "Merkle sibling hash");
+    assertCanonicalHash7(step.hash, "Merkle sibling hash");
   }
 }
 function canonicalMerkleProof(proof) {
@@ -7707,7 +9191,7 @@ function assertEconomyMerkleInclusion(proof, anchor, hashCanonicalPayload2) {
   );
 }
 function assertPortableEvidenceReference(reference) {
-  assertExactKeys3(
+  assertExactKeys5(
     reference,
     /* @__PURE__ */ new Set([
       "schemaVersion",
@@ -7727,7 +9211,7 @@ function assertPortableEvidenceReference(reference) {
     reference.evidenceReceiptId,
     "evidenceReceiptId"
   );
-  assertCanonicalHash6(
+  assertCanonicalHash7(
     reference.evidenceReceiptHash,
     "Evidence-receipt hash"
   );
@@ -7744,7 +9228,7 @@ function canonicalPortableEvidenceReference(reference) {
   };
 }
 function assertPortableBody(body) {
-  assertExactKeys3(
+  assertExactKeys5(
     body,
     "portableReceiptId" in body ? PORTABLE_KEYS : PORTABLE_BODY_KEYS,
     "Portable customer-receipt body"
@@ -7768,7 +9252,7 @@ function assertPortableBody(body) {
     assertEconomyIdentifier(value, label);
   }
   economyAssert(
-    ACTIVITY_TYPES3.has(body.activityType) && (body.direction === "credit" || body.direction === "debit"),
+    ACTIVITY_TYPES4.has(body.activityType) && (body.direction === "credit" || body.direction === "debit"),
     "INVALID_CONTRACT",
     "Portable customer receipt has an unsupported activity or direction"
   );
@@ -7783,7 +9267,7 @@ function assertPortableBody(body) {
     [body.committedResultContentHash, "Committed-result content hash"],
     [body.authorityCommitHash, "Authority-commit hash"]
   ]) {
-    assertCanonicalHash6(value, label);
+    assertCanonicalHash7(value, label);
   }
   assertUnsignedInteger(body.authoritySequence, "Authority sequence");
   economyAssert(
@@ -7868,7 +9352,7 @@ function createEconomyPortableCustomerReceipt(body, signature, hashCanonicalPayl
   };
 }
 function assertEconomyPortableCustomerReceipt(receipt, hashCanonicalPayload2) {
-  assertExactKeys3(receipt, PORTABLE_KEYS, "Portable customer receipt");
+  assertExactKeys5(receipt, PORTABLE_KEYS, "Portable customer receipt");
   assertPortableBody(receipt);
   assertEconomyIdentifier(receipt.portableReceiptId, "portableReceiptId");
   assertEconomyEvidenceSignature(receipt.signature);
@@ -8168,7 +9652,7 @@ var DOCUMENT_ID_KEYS = /* @__PURE__ */ new Set([
   "lifetimeProjectionId",
   "outboxEventId"
 ]);
-function assertExactKeys4(value, allowed, label) {
+function assertExactKeys6(value, allowed, label) {
   economyAssert(
     value !== null && typeof value === "object" && !Array.isArray(value),
     "INVALID_CONTRACT",
@@ -8208,7 +9692,7 @@ function createPersonalWalletInitializationDocumentIds(subjectAccountId, hash) {
   };
 }
 function assertPersonalWalletInitializationCommand(command) {
-  assertExactKeys4(command, COMMAND_KEYS, "Wallet initialization command");
+  assertExactKeys6(command, COMMAND_KEYS, "Wallet initialization command");
   economyAssert(
     command.schemaVersion === ECONOMY_CONTRACT_VERSION && command.commandType === "initialize-wallet" && command.walletKind === "personal",
     "INVALID_CONTRACT",
@@ -8232,7 +9716,7 @@ function canonicalPersonalWalletInitializationCommandPayload(command) {
   });
 }
 function assertPersonalWalletInitializationOutboxIntent(intent) {
-  assertExactKeys4(intent, OUTBOX_KEYS, "Wallet initialization outbox intent");
+  assertExactKeys6(intent, OUTBOX_KEYS, "Wallet initialization outbox intent");
   economyAssert(
     intent.schemaVersion === ECONOMY_CONTRACT_VERSION && intent.eventType === "wallet.initialized.v1",
     "INVALID_CONTRACT",
@@ -8332,8 +9816,8 @@ function createPersonalWalletInitializationState(input, hash) {
   return state;
 }
 function assertPersonalWalletInitializationState(state) {
-  assertExactKeys4(state, STATE_KEYS, "Wallet initialization state");
-  assertExactKeys4(
+  assertExactKeys6(state, STATE_KEYS, "Wallet initialization state");
+  assertExactKeys6(
     state.documentIds,
     DOCUMENT_ID_KEYS,
     "Wallet initialization document IDs"
@@ -8364,6 +9848,13 @@ function assertPersonalWalletInitializationState(state) {
   );
 }
 export {
+  ADMIN_TOKEN_ANOMALY_BASELINE_DAYS,
+  ADMIN_TOKEN_DEFAULT_WINDOW_DAYS,
+  ADMIN_TOKEN_MAXIMUM_HOURLY_WINDOW_DAYS,
+  ADMIN_TOKEN_MAXIMUM_PAGE_SIZE,
+  ADMIN_TOKEN_MAXIMUM_TREND_POINTS,
+  ADMIN_TOKEN_MAXIMUM_WINDOW_DAYS,
+  ADMIN_TOKEN_MINIMUM_COHORT_SIZE,
   BASELINE_GBP_CATALOG_VERSION,
   BASELINE_GBP_REFERENCE_RATE,
   BASELINE_GBP_TOKEN_PACKS,
@@ -8391,6 +9882,19 @@ export {
   applyWalletBalanceDelta,
   applyWalletLifetimeDeltas,
   assertActivityEntry,
+  assertAdminTokenActivityCursorBinding,
+  assertAdminTokenActivityEntry,
+  assertAdminTokenActivityPage,
+  assertAdminTokenActivityPageForRequest,
+  assertAdminTokenActivityPageRequest,
+  assertAdminTokenEconomySummary,
+  assertAdminTokenTrendRequest,
+  assertAdminTokenTrendResult,
+  assertAdminTokenTrendResultForRequest,
+  assertAdminTokenWalletBalanceCursorBinding,
+  assertAdminTokenWalletBalancePage,
+  assertAdminTokenWalletBalancePageForRequest,
+  assertAdminTokenWalletBalancePageRequest,
   assertAuditedEconomyCommandEnvelope,
   assertBalancedTransaction,
   assertDeterministicWalletBalanceSummary,
@@ -8444,6 +9948,10 @@ export {
   assertModuleSpendQuote,
   assertNonNegativeAccounts,
   assertOpenPurchaseIntent,
+  assertOperatorAdjustmentDecision,
+  assertOperatorAdjustmentExecution,
+  assertOperatorAdjustmentPreview,
+  assertOperatorAdjustmentProposal,
   assertPaidLotLifecycle,
   assertPaidLotLifecycleEvent,
   assertPaidLotPurchaseProvenance,
@@ -8507,11 +10015,18 @@ export {
   canonicalEconomyRegionalEvidenceReceiptBodyPayload,
   canonicalEconomyRegionalEvidenceReceiptPayload,
   canonicalEconomyRegionalEvidenceReceiptSigningPayload,
+  canonicalOperatorAdjustmentDecisionPayload,
+  canonicalOperatorAdjustmentExecutionPayload,
+  canonicalOperatorAdjustmentPreviewPayload,
+  canonicalOperatorAdjustmentProposalPayload,
   canonicalPersonalWalletInitializationCommandPayload,
   canonicalPersonalWalletInitializationOutboxPayload,
   canonicalTransactionPayload,
   closeModuleAllowance,
   convertRewardPayout,
+  createAdminTokenAnomalyIndicator,
+  createAdminTokenAnomalyUnavailable,
+  createDefaultAdminTokenReportingWindow,
   createEarlyBackerRetentionFromPaidLot,
   createEconomyPortableCustomerReceipt,
   createEconomyRecoveryAcceptanceEnvelope,