@reinconsole/graph 0.1.1 → 0.3.0-rc.1

package/dist/index.js

@@ -1,8 +1,101 @@
-// ../../packages/core/dist/index.js
+// ../../packages/core/dist/chunk-6H2LDEB7.js
 import { z } from "zod";
-var Chain = z.enum(["base", "solana", "polygon", "bnb"]);
-var Asset = z.enum(["USDC", "USDT", "EURC"]);
-var DecimalString = z.string().regex(/^\d+(\.\d+)?$/, 'must be a non-negative decimal string, e.g. "5.00"');
+var ULID_BODY = "[0-9A-HJKMNP-TV-Z]{26}";
+function prefixedId(prefix) {
+  return z.string().regex(new RegExp(`^${prefix}_${ULID_BODY}$`), `expected a "${prefix}_" prefixed id`);
+}
+var OrgId = prefixedId("org");
+var AgentId = prefixedId("agt");
+var PolicyId = prefixedId("pol");
+var IntentId = prefixedId("int");
+var DecisionId = prefixedId("dec");
+var ReceiptId = prefixedId("rcp");
+var SessionId = prefixedId("ses");
+var GateReceiptId = prefixedId("grc");
+var ApiKeyId = prefixedId("key");
+var ApproverKeyId = prefixedId("apk");
+var ApiKeyScope = z.enum(["read", "evaluate", "approve", "report", "admin"]);
+var ApiKey = z.object({
+  id: ApiKeyId,
+  name: z.string().min(1).max(200),
+  scopes: z.array(ApiKeyScope).min(1),
+  /**
+   * The org this key acts inside. ABSENT means unscoped — an operator key that
+   * reads and writes across every org, which is what a self-hosted single-org
+   * deployment and every env-seeded boot secret have always been. That is the
+   * compatibility rule the whole tenancy design rests on: adding tenancy
+   * changed no existing key's behaviour, because no existing key has this
+   * field.
+   *
+   * Present, it is a hard confinement, not a default: the key cannot read,
+   * spend, approve or govern outside the org, and a write it submits is
+   * stamped with this org rather than the one the body asked for.
+   */
+  orgId: OrgId.optional(),
+  /**
+   * Narrow an org-scoped key further, to specific agents — what an agent
+   * runtime should carry, so a stolen key spends one agent's budget rather
+   * than the org's. Only meaningful alongside {@link ApiKey.orgId}: agent
+   * narrowing without an org is refused at issuance, because the scope it
+   * would describe has no org to resolve policies and approvers in.
+   *
+   * Capped at 64: a list long enough to need more is a fleet, and a fleet is
+   * what the org scope is for.
+   */
+  agentIds: z.array(AgentId).max(64).optional(),
+  createdAt: z.coerce.date(),
+  /** Last successful authentication, for spotting keys that can be retired. */
+  lastUsedAt: z.coerce.date().optional(),
+  /** Set by revoke(); a revoked key never authenticates again. */
+  revokedAt: z.coerce.date().optional(),
+  /** Set by rotate(); with `previousSecretExpiresAt` it dates the overlap. */
+  rotatedAt: z.coerce.date().optional()
+});
+var ApiKeyRecord = ApiKey.extend({
+  secretHash: z.string(),
+  previousSecretHash: z.string().optional(),
+  previousSecretExpiresAt: z.coerce.date().optional()
+});
+function toPublicApiKey(record) {
+  const { secretHash, previousSecretHash, previousSecretExpiresAt, ...pub } = record;
+  return pub;
+}
+var ENCODING = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+var TIME_LEN = 10;
+var RANDOM_LEN = 16;
+function randomBytes(length) {
+  const bytes = new Uint8Array(length);
+  globalThis.crypto.getRandomValues(bytes);
+  return bytes;
+}
+function encodeTime(now) {
+  let time = now;
+  let out = "";
+  for (let i = TIME_LEN - 1; i >= 0; i--) {
+    out = ENCODING.charAt(time % 32) + out;
+    time = Math.floor(time / 32);
+  }
+  return out;
+}
+function encodeRandom() {
+  let out = "";
+  for (const byte of randomBytes(RANDOM_LEN)) {
+    out += ENCODING.charAt(byte % 32);
+  }
+  return out;
+}
+function ulid(seedTime = Date.now()) {
+  return encodeTime(seedTime) + encodeRandom();
+}
+function newId(prefix) {
+  return `${prefix}_${ulid()}`;
+}
+
+// ../../packages/core/dist/index.js
+import { z as z2 } from "zod";
+var Chain = z2.enum(["base", "solana", "polygon", "bnb"]);
+var Asset = z2.enum(["USDC", "USDT", "EURC"]);
+var DecimalString = z2.string().regex(/^\d+(\.\d+)?$/, 'must be a non-negative decimal string, e.g. "5.00"');
 var DECIMAL_RE = /^\d+(\.\d+)?$/;
 function isValidDecimal(value) {
   return DECIMAL_RE.test(value);
@@ -41,34 +134,25 @@ function sumDecimal(values) {
   for (const v of values) total += toScaled(v, scale);
   return fromScaled(total, scale);
 }
-var ULID_BODY = "[0-9A-HJKMNP-TV-Z]{26}";
-function prefixedId(prefix) {
-  return z.string().regex(new RegExp(`^${prefix}_${ULID_BODY}$`), `expected a "${prefix}_" prefixed id`);
-}
-var OrgId = prefixedId("org");
-var AgentId = prefixedId("agt");
-var PolicyId = prefixedId("pol");
-var IntentId = prefixedId("int");
-var DecisionId = prefixedId("dec");
-var ReceiptId = prefixedId("rcp");
-var SessionId = prefixedId("ses");
-var GateReceiptId = prefixedId("grc");
-var EnforcementMode = z.enum(["observed", "sdk", "session-key"]);
-var AgentWallet = z.object({
+var EnforcementMode = z2.enum(["observed", "sdk", "session-key"]);
+var AgentWallet = z2.object({
   chain: Chain,
-  address: z.string().min(1),
+  address: z2.string().min(1),
   mode: EnforcementMode
 });
-var AgentStatus = z.enum(["active", "frozen"]);
-var Agent = z.object({
+var AgentStatus = z2.enum(["active", "frozen"]);
+var AgentLabel = z2.string().max(40).regex(/^[a-z0-9][a-z0-9-]*$/, 'label must be a lowercase slug like "research" or "prod-trading"');
+var Agent = z2.object({
   id: AgentId,
   orgId: OrgId,
-  name: z.string().min(1).max(200),
+  name: z2.string().min(1).max(200),
   /** On-chain ERC-8004 identity, if the agent is registered. */
-  erc8004Id: z.string().optional(),
-  wallets: z.array(AgentWallet).default([]),
+  erc8004Id: z2.string().optional(),
+  /** Semantic grouping labels — the targets of policy `appliesTo.labels`. */
+  labels: z2.array(AgentLabel).max(16).refine((ls) => new Set(ls).size === ls.length, { message: "labels must be unique" }).default([]),
+  wallets: z2.array(AgentWallet).default([]),
   status: AgentStatus.default("active"),
-  createdAt: z.coerce.date()
+  createdAt: z2.coerce.date()
 });
 var REGISTRY_PATTERN = /^0x[0-9a-fA-F]{40}$/;
 var ID_PATTERN = /^eip155:(\d+):(0x[0-9a-fA-F]{40})\/(\d+)$/;
@@ -95,33 +179,33 @@ function parseErc8004Id(value) {
     tokenId: BigInt(match[3])
   };
 }
-var Erc8004Id = z.string().refine((value) => parseErc8004Id(value) !== void 0, {
+var Erc8004Id = z2.string().refine((value) => parseErc8004Id(value) !== void 0, {
   message: 'expected "eip155:{chainId}:{registry}/{tokenId}"'
 });
-var Vendor = z.object({
-  host: z.string().min(1),
-  address: z.string().min(1),
-  erc8004Id: z.string().optional()
+var Vendor = z2.object({
+  host: z2.string().min(1),
+  address: z2.string().min(1),
+  erc8004Id: z2.string().optional()
 });
-var TaskContext = z.object({
-  taskId: z.string().optional(),
-  parentRunId: z.string().optional(),
-  purpose: z.string().max(500).optional()
+var TaskContext = z2.object({
+  taskId: z2.string().optional(),
+  parentRunId: z2.string().optional(),
+  purpose: z2.string().max(500).optional()
 });
-var PaymentIntent = z.object({
+var PaymentIntent = z2.object({
   id: IntentId,
   agentId: AgentId,
   vendor: Vendor,
-  resource: z.string(),
+  resource: z2.string(),
   amount: DecimalString,
   asset: Asset,
   chain: Chain,
   taskContext: TaskContext.default({}),
-  nonce: z.string().min(1),
-  createdAt: z.coerce.date()
+  nonce: z2.string().min(1),
+  createdAt: z2.coerce.date()
 });
-var DecisionOutcome = z.enum(["allow", "deny", "escalate"]);
-var Decision = z.object({
+var DecisionOutcome = z2.enum(["allow", "deny", "escalate"]);
+var Decision = z2.object({
   id: DecisionId,
   intentId: IntentId,
   /**
@@ -130,211 +214,428 @@ var Decision = z.object({
    * chain — so a signer can verify an {intent, decision} pair offline as a
    * self-contained spend voucher, not just a reference by id.
    */
-  intentHash: z.string(),
+  intentHash: z2.string(),
   outcome: DecisionOutcome,
   /** Ids of the rules that fired, for explainability. */
-  matchedRules: z.array(z.string()).default([]),
+  matchedRules: z2.array(z2.string()).default([]),
   /** Human-readable explanation surfaced in the dashboard. */
-  reason: z.string().optional(),
-  policyId: z.string(),
-  policyVersion: z.string(),
+  reason: z2.string().optional(),
+  policyId: z2.string(),
+  policyVersion: z2.string(),
   /** Hash of the previous decision in the chain (tamper-evident log). */
-  prevHash: z.string(),
+  prevHash: z2.string(),
   /** Hash of this decision's canonical content. */
-  hash: z.string(),
+  hash: z2.string(),
   /** Service signing-key signature over `hash`. */
-  signature: z.string(),
-  latencyMs: z.number().nonnegative(),
-  decidedAt: z.coerce.date()
+  signature: z2.string(),
+  latencyMs: z2.number().nonnegative(),
+  decidedAt: z2.coerce.date()
 });
-var Session = z.object({
+var AttributedDecision = Decision.extend({ agentId: AgentId.optional() });
+var Session = z2.object({
   id: SessionId,
   agentId: AgentId,
   /** sha256 hex of the bearer token. */
-  tokenHash: z.string(),
+  tokenHash: z2.string(),
   /** Cumulative ceiling across the session's lifetime. Absent = uncapped. */
   capAmount: DecimalString.optional(),
   /** Ceiling per individual signature. Absent = uncapped. */
   maxPerPayment: DecimalString.optional(),
-  expiresAt: z.coerce.date(),
-  createdAt: z.coerce.date(),
-  revokedAt: z.coerce.date().optional()
+  expiresAt: z2.coerce.date(),
+  createdAt: z2.coerce.date(),
+  revokedAt: z2.coerce.date().optional()
 });
-var SettledPayment = z.object({
+var SettledPayment = z2.object({
   intentId: IntentId,
-  txHash: z.string(),
+  txHash: z2.string(),
   chain: Chain,
-  blockNumber: z.coerce.bigint(),
-  facilitator: z.string().optional(),
+  blockNumber: z2.coerce.bigint(),
+  facilitator: z2.string().optional(),
   feePaid: DecimalString.optional(),
-  confirmedAt: z.coerce.date()
+  confirmedAt: z2.coerce.date()
 });
-var ReceiptSettlement = z.object({
-  txHash: z.string().optional(),
-  networkId: z.string().optional(),
+var SettlementReport = z2.object({
+  intentId: IntentId,
+  /** The settling transaction, when the observer saw one. */
+  txHash: z2.string().optional(),
+  chain: Chain.optional(),
+  /** The amount as SETTLED, when known — may differ from the amount allowed. */
+  amount: DecimalString.optional(),
+  /** Free-form observer tag, e.g. "indexer", "guard", "facilitator". */
+  source: z2.string().min(1).max(64).optional(),
+  confirmedAt: z2.coerce.date()
+});
+var ReceiptSettlement = z2.object({
+  txHash: z2.string().optional(),
+  networkId: z2.string().optional(),
   /** Raw header payload, kept for forensics until the indexer confirms. */
-  raw: z.string().optional()
+  raw: z2.string().optional()
 });
-var Receipt = z.object({
+var Receipt = z2.object({
   id: ReceiptId,
   agentId: AgentId,
   intentId: IntentId,
   decisionId: DecisionId,
   outcome: DecisionOutcome,
   /** The URL the agent actually fetched (the paywalled resource). */
-  url: z.string(),
-  method: z.string().default("GET"),
-  vendorHost: z.string(),
+  url: z2.string(),
+  method: z2.string().default("GET"),
+  vendorHost: z2.string(),
   amount: DecimalString,
   asset: Asset,
   chain: Chain,
   taskContext: TaskContext.default({}),
   /** Human-readable explanation copied from the decision. */
-  reason: z.string().optional(),
+  reason: z2.string().optional(),
   /** Present only once a payment was made and the vendor confirmed it. */
   settlement: ReceiptSettlement.optional(),
-  createdAt: z.coerce.date()
+  createdAt: z2.coerce.date()
 });
-var GateReceipt = z.object({
+var GateReceipt = z2.object({
   id: GateReceiptId,
-  at: z.coerce.date(),
+  at: z2.coerce.date(),
   /** The route pattern that priced this request, e.g. "/api/reports/*". */
-  route: z.string().min(1),
+  route: z2.string().min(1),
   /** The concrete resource paid for (URL path actually requested). */
-  resource: z.string().min(1),
-  method: z.string().min(1),
+  resource: z2.string().min(1),
+  method: z2.string().min(1),
   /** The paying wallet address, as asserted by the settled payment. */
-  payer: z.string().min(1),
-  payTo: z.string().min(1),
+  payer: z2.string().min(1),
+  payTo: z2.string().min(1),
   /** Human-unit decimal amount, e.g. "0.05". */
   amount: DecimalString,
   /** The same amount in the asset's atomic units, e.g. "50000". */
-  amountAtomic: z.string().regex(/^\d+$/, "atomic amount must be an integer string"),
+  amountAtomic: z2.string().regex(/^\d+$/, "atomic amount must be an integer string"),
   /** Token symbol or contract address, exactly as quoted in the requirement. */
-  asset: z.string().min(1),
-  network: z.string().min(1),
+  asset: z2.string().min(1),
+  network: z2.string().min(1),
   /** Settlement transaction hash (mock ledger or on-chain). */
-  transaction: z.string().min(1)
+  transaction: z2.string().min(1)
 });
-var Window = z.string().regex(/^\d+[smhd]$/, 'window must be like "30s", "15m", "1h", or "7d"');
-var Multiplier = z.string().regex(/^\d+(\.\d+)?x$/, 'multiplier must be like "3x"');
-var Condition = z.object({
+var Window = z2.string().regex(/^\d+[smhd]$/, 'window must be like "30s", "15m", "1h", or "7d"');
+var Multiplier = z2.string().regex(/^\d+(\.\d+)?x$/, 'multiplier must be like "3x"');
+var Condition = z2.object({
   /** Per-transaction amount exceeds this value. */
   amountGt: DecimalString.optional(),
   /** Sum of spend in a rolling window exceeds `gt`. */
-  rollingSum: z.object({ window: Window, gt: DecimalString }).optional(),
+  rollingSum: z2.object({ window: Window, gt: DecimalString }).optional(),
   /** Transaction count in a rolling window exceeds `gt`. */
-  txCount: z.object({ window: Window, gt: z.number().int().nonnegative() }).optional(),
+  txCount: z2.object({ window: Window, gt: z2.number().int().nonnegative() }).optional(),
   /** Vendor host matches one of these patterns (supports `*` globs). */
-  vendorHostIn: z.array(z.string()).optional(),
+  vendorHostIn: z2.array(z2.string()).optional(),
+  /**
+   * Resource PATH matches one of these patterns (supports `*` globs, e.g.
+   * "/v1/reports/*"). A full-URL resource is reduced to its pathname before
+   * matching (see `resourcePathOf`), so the same pattern works whether the
+   * vendor declares "https://api.x.com/v1/answer" or "/v1/answer". Pair
+   * with `vendorHostIn` to scope a path rule to specific vendors.
+   */
+  resourceIn: z2.array(z2.string()).optional(),
   /** First time Rein has seen this vendor for the agent. */
-  vendorFirstSeen: z.boolean().optional(),
+  vendorFirstSeen: z2.boolean().optional(),
   /** Vendor reputation score is below this threshold (Phase 3 hook). */
-  vendorReputationLt: z.number().min(0).max(100).optional(),
+  vendorReputationLt: z2.number().min(0).max(100).optional(),
   /** Amount is more than `gt`-times the observed median for this resource. */
-  amountVsResourceMedian: z.object({ gt: Multiplier }).optional()
+  amountVsResourceMedian: z2.object({ gt: Multiplier }).optional(),
+  /**
+   * Cumulative spend attributed to THIS intent's `taskContext.taskId`
+   * (prior spend on the task plus this payment) exceeds `gt`. Scopes a
+   * budget to one unit of work rather than to a window: a research run that
+   * is meant to cost a dollar cannot quietly cost fifty, however slowly.
+   *
+   * An intent carrying no `taskId` cannot be attributed to a task, so the
+   * predicate never triggers for one. Requiring attribution is a separate,
+   * deliberate rule (deny on `taskIdMissing`), not a side effect of setting
+   * a budget — otherwise every untagged probe payment would trip every
+   * task budget in the policy.
+   */
+  taskBudget: z2.object({ gt: DecimalString }).optional(),
+  /** The intent carries no `taskContext.taskId` (or an empty one). */
+  taskIdMissing: z2.boolean().optional()
 }).refine((c) => Object.values(c).some((v) => v !== void 0), {
   message: "a condition must specify at least one predicate"
 });
-var Rule = z.object({
-  id: z.string().min(1),
+var Breaker = z2.object({
+  id: z2.string().min(1),
+  /** The trailing span the tripwires measure over. */
+  window: Window,
+  /**
+   * Trip when the window would hold MORE than this many transactions.
+   * `10` permits ten in the window and escalates the eleventh.
+   */
+  txCount: z2.number().int().positive().optional(),
+  /**
+   * Trip when the window's spend would exceed this total. `"50.00"` permits
+   * a window totalling exactly 50.00 and escalates the payment that would
+   * carry it past. Prospective, like every other spend predicate: the
+   * payment that would breach the cap is the one that escalates, rather
+   * than the innocent one after it.
+   */
+  valueCap: DecimalString.optional()
+}).refine((b) => b.txCount !== void 0 || b.valueCap !== void 0, {
+  message: "a breaker must specify at least one of txCount / valueCap"
+});
+var Rule = z2.object({
+  id: z2.string().min(1),
   allow: Condition.optional(),
   deny: Condition.optional(),
   escalate: Condition.optional()
 }).refine((r) => [r.allow, r.deny, r.escalate].filter((v) => v !== void 0).length === 1, {
   message: "a rule must specify exactly one of allow / deny / escalate"
 });
-var PolicyDefault = z.enum(["allow", "deny"]);
-var AppliesTo = z.object({
+var PolicyDefault = z2.enum(["allow", "deny"]);
+var AppliesTo = z2.object({
   /** Agent id patterns (supports `*` globs, e.g. "agt_research_*"). */
-  agents: z.array(z.string()).optional(),
-  chains: z.array(Chain).optional()
+  agents: z2.array(z2.string()).optional(),
+  /**
+   * Agent label patterns (supports `*` globs) — semantic targeting. Matches
+   * when the agent carries at least one label matching any pattern. Requires
+   * the agent DOCUMENT: an intent from an unregistered agent never matches a
+   * labels-targeted policy (and so fails closed when no other policy applies).
+   */
+  labels: z2.array(z2.string()).optional(),
+  chains: z2.array(Chain).optional()
 });
-var Escalation = z.object({
-  approvers: z.array(z.string()).default([]),
+var Escalation = z2.object({
+  approvers: z2.array(z2.string()).default([]),
   timeoutAction: PolicyDefault.default("deny"),
-  timeoutMin: z.number().int().positive().default(15)
+  timeoutMin: z2.number().int().positive().default(15)
 });
-var Policy = z.object({
-  policyId: z.string().min(1),
-  version: z.string().default("1"),
+var Policy = z2.object({
+  policyId: z2.string().min(1),
+  version: z2.string().default("1"),
+  /**
+   * The org this policy governs. ABSENT means GLOBAL — it is considered for
+   * every agent, which is what every policy written before tenancy existed is
+   * and stays.
+   *
+   * This is separate from {@link AppliesTo} on purpose, and it has to be:
+   * `appliesTo: {}` matches every agent, so a tenant's policy carrying the
+   * default targeting would otherwise govern other tenants' agents the moment
+   * it was written. Org scoping is applied BEFORE targeting — a policy whose
+   * `orgId` is not the agent's org is not a candidate at all.
+   */
+  orgId: OrgId.optional(),
   appliesTo: AppliesTo.default({}),
-  rules: z.array(Rule).default([]),
+  rules: z2.array(Rule).default([]),
+  /**
+   * Behavioral breakers evaluated alongside the rules. A tripped breaker
+   * escalates at the same precedence as an `escalate` rule — so an explicit
+   * DENY still wins, and an ALLOW rule cannot wave past a tripped breaker.
+   */
+  breakers: z2.array(Breaker).default([]),
   default: PolicyDefault.default("deny"),
   /** Below this amount, fail-open is permitted during a policy-service outage. */
   denyFloor: DecimalString.default("0.05"),
   escalation: Escalation.optional()
 });
-var ReputationSubject = z.object({
-  kind: z.enum(["agent", "vendor"]),
-  id: z.string()
+var LivenessSource = z2.enum([
+  /** It submitted an intent — ANY outcome, including a denial. */
+  "intent",
+  /** It reported in explicitly, having nothing to buy. */
+  "heartbeat"
+]);
+var DEFAULT_LIVENESS_GRACE_MS = 6e4;
+var LivenessExpectation = z2.object({
+  agentId: AgentId,
+  /** Longest silence still considered normal, e.g. '15m'. */
+  interval: Window,
+  /** Extra slack past `interval` before the silence is an alarm. */
+  graceMs: z2.number().int().nonnegative().default(DEFAULT_LIVENESS_GRACE_MS),
+  /**
+   * When watching began. An agent that has NEVER been seen is measured from
+   * here, so a watch on an agent that never starts does raise an alarm — a
+   * detector that never came up is exactly as dead as one that stopped.
+   */
+  since: z2.coerce.date(),
+  /** What this agent is supposed to be doing, shown beside the alarm. */
+  note: z2.string().max(200).optional()
+});
+var LivenessWatchInput = LivenessExpectation.omit({ since: true }).extend({
+  graceMs: z2.number().int().nonnegative().optional()
+});
+var Heartbeat = z2.object({
+  agentId: AgentId,
+  /** When the agent was alive. Defaults to arrival time. */
+  at: z2.coerce.date().optional(),
+  /** Free-form note from the reporter, e.g. "poll cycle 41 ok". */
+  note: z2.string().max(200).optional()
+});
+var LivenessStatus = z2.enum(["alive", "late", "missing", "unknown"]);
+var ApprovalVerdict = z2.enum(["approve", "reject"]);
+var ApprovalStatus = z2.enum(["pending", "approved", "rejected", "expired"]);
+var ApproverKey = z2.object({
+  id: ApproverKeyId,
+  orgId: OrgId,
+  name: z2.string().min(1).max(200),
+  /** ed25519 public key, SPKI PEM — the same encoding as the decision log's. */
+  publicKey: z2.string().min(1),
+  algorithm: z2.literal("ed25519").default("ed25519"),
+  createdAt: z2.coerce.date(),
+  revokedAt: z2.coerce.date().optional()
+});
+var ApprovalRequest = z2.object({
+  /** The `escalate` decision this request answers (primary key). */
+  decisionId: DecisionId,
+  intentId: IntentId,
+  /** Binds the approval to the exact transfer — the signed bytes commit to it. */
+  intentHash: z2.string(),
+  agentId: AgentId,
+  /**
+   * The org the escalating agent belongs to, stamped when the request is
+   * parked. ABSENT means the agent was never registered (or the request
+   * predates tenancy), and such a request is answerable only by an unscoped
+   * operator — there is no org to check an approver against, and guessing one
+   * is how a cross-tenant approval happens.
+   */
+  orgId: OrgId.optional(),
+  vendorHost: z2.string(),
+  resource: z2.string(),
+  amount: DecimalString,
+  asset: Asset,
+  chain: Chain,
+  /**
+   * Task attribution copied from the intent. Carried so an approved payment
+   * still counts against its `taskBudget` — an escalation that lost its task
+   * id on the way through would make the budget silently under-count exactly
+   * the payments a human had to look at.
+   */
+  taskId: z2.string().optional(),
+  /** Why policy escalated, verbatim from the decision. */
+  reason: z2.string(),
+  /**
+   * Breaker ids whose trip contributed to this escalation. An approval of
+   * this request resets exactly these — moving their counting floor to the
+   * approval instant — so a human waving one payment through also clears the
+   * behavior that stopped it, rather than being asked again immediately.
+   * Empty when ordinary rules did the escalating.
+   */
+  breakers: z2.array(z2.string()).default([]),
+  status: ApprovalStatus,
+  createdAt: z2.coerce.date(),
+  /** Past this instant the request denies, whatever arrives afterwards. */
+  expiresAt: z2.coerce.date(),
+  resolvedAt: z2.coerce.date().optional(),
+  /** Which registered key signed — absent when the TTL lapsed instead. */
+  approverKeyId: ApproverKeyId.optional(),
+  /**
+   * The follow-up decision appended to the chain when this resolved. That
+   * decision, not this record, is the voucher a signer verifies: the original
+   * `escalate` decision is never rewritten.
+   */
+  finalDecisionId: DecisionId.optional()
+});
+var ApprovalChallenges = z2.object({
+  approve: z2.string(),
+  reject: z2.string()
+});
+var ApprovalGrant = z2.object({
+  decisionId: DecisionId,
+  intentHash: z2.string(),
+  verdict: ApprovalVerdict,
+  approverKeyId: ApproverKeyId,
+  signature: z2.string().min(1)
+});
+var ReputationSubject = z2.object({
+  kind: z2.enum(["agent", "vendor"]),
+  id: z2.string()
 });
-var ReputationComponents = z.object({
-  volume: z.number(),
-  longevity: z.number(),
-  disputeRate: z.number(),
-  counterpartyQuality: z.number(),
-  settlementReliability: z.number()
+var ReputationComponents = z2.object({
+  volume: z2.number(),
+  longevity: z2.number(),
+  disputeRate: z2.number(),
+  counterpartyQuality: z2.number(),
+  settlementReliability: z2.number()
 });
-var ReputationScore = z.object({
+var ReputationScore = z2.object({
   subject: ReputationSubject,
-  score: z.number().min(0).max(100),
+  score: z2.number().min(0).max(100),
   components: ReputationComponents,
-  confidence: z.number().min(0).max(1),
-  asOf: z.coerce.date(),
+  confidence: z2.number().min(0).max(1),
+  asOf: z2.coerce.date(),
   /** Hash-anchored attestation, optionally published on-chain (ERC-8004). */
-  evidenceUri: z.string().optional()
-});
-var ReinEvent = z.discriminatedUnion("type", [
-  z.object({ type: z.literal("intent.created"), at: z.coerce.date(), intent: PaymentIntent }),
-  z.object({ type: z.literal("decision.made"), at: z.coerce.date(), decision: Decision }),
-  z.object({ type: z.literal("payment.settled"), at: z.coerce.date(), payment: SettledPayment }),
-  z.object({
-    type: z.literal("shadow.spend"),
-    at: z.coerce.date(),
+  evidenceUri: z2.string().optional()
+});
+var ReinEvent = z2.discriminatedUnion("type", [
+  z2.object({ type: z2.literal("intent.created"), at: z2.coerce.date(), intent: PaymentIntent }),
+  z2.object({ type: z2.literal("decision.made"), at: z2.coerce.date(), decision: Decision }),
+  z2.object({ type: z2.literal("payment.settled"), at: z2.coerce.date(), payment: SettledPayment }),
+  z2.object({
+    type: z2.literal("shadow.spend"),
+    at: z2.coerce.date(),
     agentId: AgentId,
-    txHash: z.string(),
+    txHash: z2.string(),
     chain: Chain,
     amount: DecimalString
   }),
-  z.object({
-    type: z.literal("signature.released"),
-    at: z.coerce.date(),
+  z2.object({
+    type: z2.literal("signature.released"),
+    at: z2.coerce.date(),
     sessionId: SessionId,
     agentId: AgentId,
     intentId: IntentId,
     decisionId: DecisionId,
     amount: DecimalString
   }),
-  z.object({
-    type: z.literal("signature.refused"),
-    at: z.coerce.date(),
+  z2.object({
+    type: z2.literal("signature.refused"),
+    at: z2.coerce.date(),
     /** Refusal code, e.g. "decision_replayed" (see @reinconsole/signer). */
-    code: z.string(),
-    reason: z.string(),
+    code: z2.string(),
+    reason: z2.string(),
     sessionId: SessionId.optional(),
     agentId: AgentId.optional(),
     intentId: IntentId.optional()
   }),
-  z.object({
-    type: z.literal("gate.quoted"),
-    at: z.coerce.date(),
-    resource: z.string(),
-    method: z.string(),
+  z2.object({
+    type: z2.literal("gate.quoted"),
+    at: z2.coerce.date(),
+    resource: z2.string(),
+    method: z2.string(),
     amount: DecimalString,
-    asset: z.string(),
-    network: z.string()
+    asset: z2.string(),
+    network: z2.string()
+  }),
+  z2.object({ type: z2.literal("gate.settled"), at: z2.coerce.date(), receipt: GateReceipt }),
+  z2.object({
+    type: z2.literal("approval.requested"),
+    at: z2.coerce.date(),
+    request: ApprovalRequest
+  }),
+  z2.object({
+    type: z2.literal("approval.resolved"),
+    at: z2.coerce.date(),
+    request: ApprovalRequest,
+    /** The follow-up allow/deny decision this resolution appended. */
+    decision: Decision
+  }),
+  z2.object({
+    type: z2.literal("liveness.missing"),
+    at: z2.coerce.date(),
+    agentId: AgentId,
+    expectation: LivenessExpectation,
+    /** How long the agent has been silent when the alarm was raised. */
+    silentMs: z2.number().int().nonnegative(),
+    /** Last sighting, absent when the agent was never seen at all. */
+    lastSeenAt: z2.coerce.date().optional()
   }),
-  z.object({ type: z.literal("gate.settled"), at: z.coerce.date(), receipt: GateReceipt }),
-  z.object({
-    type: z.literal("gate.refused"),
-    at: z.coerce.date(),
+  z2.object({
+    type: z2.literal("liveness.recovered"),
+    at: z2.coerce.date(),
+    agentId: AgentId,
+    /** How long the silence lasted, measured to this sighting. */
+    silentMs: z2.number().int().nonnegative(),
+    source: LivenessSource
+  }),
+  z2.object({
+    type: z2.literal("gate.refused"),
+    at: z2.coerce.date(),
     /** Refusal code, e.g. "payment_replayed" (see @reinconsole/gate). */
-    code: z.string(),
-    reason: z.string(),
-    resource: z.string(),
+    code: z2.string(),
+    reason: z2.string(),
+    resource: z2.string(),
     /** Known only when the payment header decoded far enough to name a payer. */
-    payer: z.string().optional()
+    payer: z2.string().optional()
   })
 ]);
 
@@ -542,7 +843,7 @@ function confidence(ev, nowMs) {
   const observations = ev.attempts + ev.disputes + ev.endorsements + ev.shadowSpends + replays + others;
   const depth = 1 - Math.exp(-observations / 10);
   const knownDays = Math.max(0, nowMs - ev.firstSeenMs) / DAY_MS;
-  const age = 0.4 + 0.6 * Math.min(1, knownDays / 7);
+  const age = 0.1 + 0.9 * Math.min(1, knownDays / 7);
   return clamp(depth * age, 0, 1);
 }
 function blend(components, weights) {
@@ -816,32 +1117,253 @@ function payerCheck(graph, options = {}) {
 import { fileURLToPath } from "url";
 import { realpathSync } from "fs";
 import Fastify from "fastify";
-import { z as z2 } from "zod";
-var ReportInput = z2.object({
+import { z as z3 } from "zod";
+
+// ../../packages/core/dist/auth.js
+import { randomBytes as randomBytes2, createHash, timingSafeEqual } from "crypto";
+var SECRET_PREFIX = "rk_";
+var TOUCH_INTERVAL_MS = 6e4;
+var DEFAULT_ROTATION_GRACE_MS = 36e5;
+function mintSecret() {
+  return SECRET_PREFIX + randomBytes2(32).toString("base64url");
+}
+function hashSecret(secret) {
+  return createHash("sha256").update(secret).digest("hex");
+}
+function digestsEqual(a, b) {
+  const left = Buffer.from(a, "hex");
+  const right = Buffer.from(b, "hex");
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+var InMemoryApiKeyStore = class {
+  byId = /* @__PURE__ */ new Map();
+  hashes = /* @__PURE__ */ new Map();
+  // secretHash -> keyId
+  put(record) {
+    const existing = this.byId.get(record.id);
+    if (existing) {
+      this.hashes.delete(existing.secretHash);
+      if (existing.previousSecretHash) this.hashes.delete(existing.previousSecretHash);
+    }
+    this.byId.set(record.id, record);
+    this.hashes.set(record.secretHash, record.id);
+    if (record.previousSecretHash) this.hashes.set(record.previousSecretHash, record.id);
+  }
+  get(id) {
+    return this.byId.get(id);
+  }
+  byHash(hash) {
+    const id = this.hashes.get(hash);
+    return id === void 0 ? void 0 : this.byId.get(id);
+  }
+  list() {
+    return [...this.byId.values()];
+  }
+};
+var AuthError = class _AuthError extends Error {
+  constructor(status, code, message) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.name = "AuthError";
+  }
+  status;
+  code;
+  /**
+   * A brand, because `instanceof` is not enough here. Every service bundles
+   * `@reinconsole/core` into its own output (`noExternal`, for self-contained
+   * deploys), so an `ApiKeyAuth` built from one package and handed to a server
+   * in another throws an AuthError from a DIFFERENT copy of this class. An
+   * `instanceof` check in the catching service then misses it and a 401 turns
+   * into a 500 — which is what happened the first time the graph was handed
+   * the engine's auth object.
+   */
+  reinAuthError = true;
+  /** Use this, never a bare `instanceof`, when catching across packages. */
+  static is(err) {
+    return err instanceof _AuthError || typeof err === "object" && err !== null && err.reinAuthError === true;
+  }
+};
+var ApiKeyAuth = class {
+  store;
+  now;
+  constructor(options = {}) {
+    this.store = options.store ?? new InMemoryApiKeyStore();
+    this.now = options.now ?? Date.now;
+  }
+  /**
+   * Mint a key. The secret in the result is the only copy that will exist.
+   *
+   * `orgId` confines the key to one tenant; omitting it mints the unscoped
+   * operator key that every deployment had before tenancy. `agentIds` narrows
+   * an org-scoped key to named agents and is refused without an org, because a
+   * scope with no org cannot say which policies or approvers the key may
+   * reach — and a half-defined scope is the kind that fails open.
+   */
+  async issue(input) {
+    if (input.scopes.length === 0) throw new TypeError("an API key needs at least one scope");
+    if (input.agentIds?.length && input.orgId === void 0) {
+      throw new TypeError("agentIds narrows an org-scoped key; pass orgId as well");
+    }
+    const secret = input.secret ?? mintSecret();
+    const record = ApiKeyRecord.parse({
+      id: newId("key"),
+      name: input.name,
+      scopes: input.scopes,
+      ...input.orgId !== void 0 ? { orgId: input.orgId } : {},
+      ...input.agentIds?.length ? { agentIds: input.agentIds } : {},
+      createdAt: new Date(this.now()),
+      secretHash: hashSecret(secret)
+    });
+    await this.store.put(record);
+    return { key: toPublicApiKey(record), secret };
+  }
+  /**
+   * Mint a replacement secret for an existing key. The outgoing secret keeps
+   * working for `graceMs` so callers can be redeployed one at a time; pass 0
+   * to cut it off immediately (what a compromised secret needs).
+   */
+  async rotate(keyId, options = {}) {
+    const record = this.store.get(keyId);
+    if (!record) throw new AuthError(404, "unknown_key_id", `no such key: ${keyId}`);
+    const graceMs = options.graceMs ?? DEFAULT_ROTATION_GRACE_MS;
+    const secret = mintSecret();
+    const rotated = {
+      ...record,
+      secretHash: hashSecret(secret),
+      rotatedAt: new Date(this.now())
+    };
+    delete rotated.previousSecretHash;
+    delete rotated.previousSecretExpiresAt;
+    if (graceMs > 0) {
+      rotated.previousSecretHash = record.secretHash;
+      rotated.previousSecretExpiresAt = new Date(this.now() + graceMs);
+    }
+    await this.store.put(rotated);
+    return { key: toPublicApiKey(rotated), secret };
+  }
+  async revoke(keyId) {
+    const record = this.store.get(keyId);
+    if (!record) return void 0;
+    const revoked = { ...record, revokedAt: new Date(this.now()) };
+    await this.store.put(revoked);
+    return toPublicApiKey(revoked);
+  }
+  list() {
+    return this.store.list().map(toPublicApiKey);
+  }
+  /** One key's public record, for an ownership check before rotate/revoke. */
+  get(keyId) {
+    const record = this.store.get(keyId);
+    return record === void 0 ? void 0 : toPublicApiKey(record);
+  }
+  /** True once at least one key exists — what "auth is configured" means. */
+  hasKeys() {
+    return this.store.list().length > 0;
+  }
+  /**
+   * Resolve a request's credentials, or throw. `scope` is what the route
+   * needs; an `admin` key satisfies every scope, any other key must hold the
+   * exact one.
+   */
+  authenticate(headers, scope) {
+    const presented = readCredential(headers);
+    if (presented === void 0) {
+      throw new AuthError(401, "missing_credentials", "missing API key (Authorization: Bearer ...)");
+    }
+    const hash = hashSecret(presented);
+    const record = this.store.byHash(hash);
+    if (!record) throw new AuthError(401, "invalid_key", "unknown API key");
+    if (!digestsEqual(record.secretHash, hash)) {
+      const expiry = record.previousSecretExpiresAt;
+      if (record.previousSecretHash === void 0 || !digestsEqual(record.previousSecretHash, hash) || expiry === void 0 || this.now() >= expiry.getTime()) {
+        throw new AuthError(401, "secret_expired", "rotated API key secret is no longer accepted");
+      }
+    }
+    if (record.revokedAt) throw new AuthError(401, "key_revoked", "API key has been revoked");
+    if (!record.scopes.includes("admin") && !record.scopes.includes(scope)) {
+      throw new AuthError(403, "insufficient_scope", `API key lacks the "${scope}" scope`);
+    }
+    void this.touch(record);
+    return toPublicApiKey(record);
+  }
+  /** Throttled write-through of `lastUsedAt` — never on the critical path. */
+  async touch(record) {
+    const at = this.now();
+    if (record.lastUsedAt && at - record.lastUsedAt.getTime() < TOUCH_INTERVAL_MS) return;
+    try {
+      await this.store.put({ ...record, lastUsedAt: new Date(at) });
+    } catch {
+    }
+  }
+};
+function first(value) {
+  return Array.isArray(value) ? value[0] : value;
+}
+function readCredential(headers) {
+  const auth = first(headers.authorization)?.trim();
+  if (auth) {
+    const match = /^Bearer\s+(.+)$/i.exec(auth);
+    if (match?.[1]) return match[1].trim();
+  }
+  const apiKey = first(headers["x-api-key"])?.trim();
+  return apiKey === void 0 || apiKey === "" ? void 0 : apiKey;
+}
+
+// src/server.ts
+var ReportInput = z3.object({
   subject: ReputationSubject,
-  kind: z2.enum(["dispute", "endorsement"]),
-  at: z2.coerce.date().optional(),
-  note: z2.string().max(500).optional()
+  kind: z3.enum(["dispute", "endorsement"]),
+  at: z3.coerce.date().optional(),
+  note: z3.string().max(500).optional()
 });
-var ScoresQuery = z2.object({ kind: z2.enum(["agent", "vendor"]).optional() });
-var LinkInput = z2.object({
+var ScoresQuery = z3.object({ kind: z3.enum(["agent", "vendor"]).optional() });
+var LinkInput = z3.object({
   canonical: ReputationSubject,
   alias: ReputationSubject
 }).refine((l) => l.canonical.kind === l.alias.kind, {
   message: "canonical and alias must be the same kind"
 });
-function buildGraphServer(graph = new ReputationGraph()) {
+function isWrite(method) {
+  return method !== "GET" && method !== "HEAD" && method !== "OPTIONS";
+}
+function buildGraphServer(graph = new ReputationGraph(), options = {}) {
   const app = Fastify({ logger: false });
+  const auth = options.auth;
   app.setErrorHandler((err, _req, reply) => {
-    if (err instanceof z2.ZodError) {
+    if (err instanceof z3.ZodError) {
       return reply.status(400).send({ error: "validation_error", issues: err.issues });
     }
+    if (AuthError.is(err)) {
+      return reply.status(err.status).send({ error: err.code, message: err.message });
+    }
     const message = err instanceof Error ? err.message : String(err);
     return reply.status(500).send({ error: "internal_error", message });
   });
-  app.get("/health", () => ({ status: "ok", subjects: graph.subjects() }));
+  if (auth) {
+    app.addHook("onRequest", async (req, reply) => {
+      if (!isWrite(req.method)) return;
+      try {
+        auth.authenticate(req.headers, "report");
+      } catch (err) {
+        if (AuthError.is(err)) {
+          if (err.status === 401) reply.header("WWW-Authenticate", 'Bearer realm="rein-graph"');
+          return reply.status(err.status).send({ error: err.code, message: err.message });
+        }
+        throw err;
+      }
+      return;
+    });
+  }
+  app.get("/health", () => ({
+    status: "ok",
+    subjects: graph.subjects(),
+    // Advertised so a producer can tell "this graph wants a key" apart from
+    // "my key is wrong" without guessing from a 401.
+    auth: auth ? "api-key" : "none"
+  }));
   app.post("/v1/events", async (req) => {
-    const events = z2.union([ReinEvent.transform((e) => [e]), z2.array(ReinEvent)]).parse(req.body);
+    const events = z3.union([ReinEvent.transform((e) => [e]), z3.array(ReinEvent)]).parse(req.body);
     for (const event of events) graph.ingest(event);
     await graph.flush();
     return { ingested: events.length };
@@ -853,7 +1375,7 @@ function buildGraphServer(graph = new ReputationGraph()) {
     return graph.score(input.subject);
   });
   app.post("/v1/links", async (req) => {
-    const links = z2.union([LinkInput.transform((l) => [l]), z2.array(LinkInput)]).parse(req.body);
+    const links = z3.union([LinkInput.transform((l) => [l]), z3.array(LinkInput)]).parse(req.body);
     for (const link of links) graph.link(link.canonical, link.alias);
     await graph.flush();
     return { linked: links.length };
@@ -872,6 +1394,36 @@ function buildGraphServer(graph = new ReputationGraph()) {
   });
   return app;
 }
+var LOOPBACK = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+async function graphAuthFromEnv(env) {
+  const raw = env["REIN_GRAPH_API_KEY"]?.trim();
+  if (!raw) return void 0;
+  const auth = new ApiKeyAuth();
+  const secrets = raw.split(",").map((secret) => secret.trim()).filter(Boolean);
+  for (const [i, secret] of secrets.entries()) {
+    await auth.issue({ name: `env-key-${i + 1}`, scopes: ["report"], secret });
+  }
+  return auth.hasKeys() ? auth : void 0;
+}
+function resolveGraphHost(env, hasAuth = false) {
+  const requested = env["HOST"]?.trim();
+  const optedIn = env["REIN_GRAPH_PUBLIC"]?.trim() === "1";
+  if (hasAuth) return { host: requested || "0.0.0.0" };
+  if (optedIn) {
+    return {
+      host: requested || "0.0.0.0",
+      warning: "REIN_GRAPH_PUBLIC=1 \u2014 this reputation graph is answering unauthenticated requests. Anyone who can reach it can write evidence that moves scores."
+    };
+  }
+  if (requested && !LOOPBACK.has(requested)) {
+    throw new Error(
+      `refusing to bind ${requested}: the reputation graph has no authentication.
+  Set REIN_GRAPH_API_KEY=<secret> to protect its writes, or
+  set REIN_GRAPH_PUBLIC=1 to expose an open graph deliberately.`
+    );
+  }
+  return { host: requested || "127.0.0.1" };
+}
 function isMainModule() {
   if (!process.argv[1]) return false;
   try {
@@ -882,9 +1434,16 @@ function isMainModule() {
 }
 if (isMainModule()) {
   const port = Number(process.env.PORT ?? 8788);
-  const host = process.env.HOST ?? "0.0.0.0";
-  const app = buildGraphServer();
-  app.listen({ port, host }).then(() => console.log(`[rein] graph listening on http://${host}:${port}`)).catch((err) => {
+  graphAuthFromEnv(process.env).then((auth) => {
+    const { host, warning } = resolveGraphHost(process.env, auth !== void 0);
+    if (warning) console.warn(`[rein] ${warning}`);
+    const app = buildGraphServer(new ReputationGraph(), { ...auth ? { auth } : {} });
+    return app.listen({ port, host }).then(
+      () => console.log(
+        `[rein] graph listening on http://${host}:${port} (auth: ${auth ? "api-key" : "none"})`
+      )
+    );
+  }).catch((err) => {
     console.error(err);
     process.exit(1);
   });
@@ -900,10 +1459,12 @@ export {
   buildGraphServer,
   confidence,
   disputeComponent,
+  graphAuthFromEnv,
   longevityComponent,
   normalizeSubject,
   payerCheck,
   reliabilityComponent,
+  resolveGraphHost,
   subjectKey,
   volumeComponent
 };